joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18018b410
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdx, qword [rcx + 0x80]
mov rax, qword [str.master_secret]
mov rbp, qword [rcx + 0x128]
mov rcx, qword [rcx + 0x158]
mov qword [rsp + 0x40], rax
mov eax, dword [0x180330088]
mov dword [rsp + 0x48], eax
movzx eax, byte [reloc.WS2_32.dll_WSACleanup]
mov r10, r8
mov byte [rsp + 0x4c], al
mov rax, qword [rdx + 0xb8]
mov dword [rsp + getservbyname], 0x30
mov qword [rsp + 0x4d], rax
mov rax, qword [rdx + 0xc0]
add rbp, 0x14
mov qword [rsp + 0x55], rax
mov rax, qword [rdx + 0xc8]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x5d], rax
mov rax, qword [rdx + 0xd0]
mov dword [rsp + 0x20], 0x4d
mov qword [rsp + 0x65], rax
mov rax, qword [rdx + 0x98]
mov qword [r11 - 0x7b], rax
mov rax, qword [rdx + 0xa0]
mov qword [r11 - 0x73], rax
mov rax, qword [rdx + 0xa8]
mov qword [r11 - 0x6b], rax
mov rax, qword [rdx + 0xb0]
mov qword [r11 - 0x63], rax
mov rsi, qword [rcx + 0xe8]
mov rcx, qword [rcx + 0xe0]
mov eax, r9d
and r9d, 1
cdq
sub eax, edx
mov rdx, r10
sar eax, 1
movsxd rbx, eax
lea rdi, [r8 + rbx]
add ebx, r9d
lea r9, [rsp + 0x40]
mov r8d, ebx
call fcn.18018a180
lea rax, [rsp + 0x90]
mov dword [rsp + getservbyname], 0x30
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
mov dword [rsp + 0x20], 0x4d
call fcn.18018a180
lea r8, [rsp + 0x90]
lea r9, [rsp + 0x91]
lea r10, [rsp + 0x92]
lea r11, [rsp + 0x93]
lea rbx, [rsp + 0x94]
lea rdi, [rsp + 0x95]
sub r8, rbp
sub r9, rbp
sub r10, rbp
sub r11, rbp
sub rbx, rbp
sub rdi, rbp
mov edx, 8
nop dword [rax]
movzx eax, byte [r8 + rbp]
add rbp, 6
xor byte [rbp - 6], al
movzx eax, byte [r9 + rbp - 6]
xor byte [rbp - 5], al
movzx eax, byte [r10 + rbp - 6]
xor byte [rbp - 4], al
movzx ecx, byte [r11 + rbp - 6]
xor byte [rbp - 3], cl
movzx ecx, byte [rbx + rbp - 6]
xor byte [rbp - 2], cl
movzx ecx, byte [rdi + rbp - 6]
xor byte [rbp - 1], cl
dec rdx
jne 0x18018b590
lea eax, [rdx + 0x30]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180227610
mov rbx, qword [rsp + 0xf8]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
Function at 0x18018cf30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r12
cmp dword [rcx], 0xfeff
mov r11d, r8d
mov r10, rcx
sete r12b
xor ebx, ebx
test r12b, r12b
mov eax, ebx
cmovne eax, r8d
lea edi, [rax + r9 + 1]
mov eax, dword [rdx + 4]
cmp edi, eax
jbe 0x18018cf72
xor eax, eax
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r12
ret
test dword [r10 + 0x184], 0x200
lea ecx, [rax - 1]
mov rax, qword [rdx + 0x10]
movzx r9d, byte [rcx + rax]
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
je 0x18018cfd6
cmp qword [r10 + 0xd8], rbx
jne 0x18018cfd6
mov rax, qword [r10 + 0x80]
mov rax, qword [rax + 8]
cmp rax, qword [0x1803301b0]
jne 0x18018cfc2
test r9b, 1
jne 0x18018cfc2
mov rax, qword [r10 + 0x80]
or dword [rax], 8
mov rax, qword [r10 + 0x80]
test byte [rax], 8
je 0x18018cfd6
test r9d, r9d
je 0x18018cfd6
dec r9d
mov r8d, dword [rdx + 4]
mov ebp, dword [rdx + 4]
mov esi, 0xff
sub r8d, r9d
lea eax, [rbp - 1]
sub r8d, edi
not r8d
sar r8d, 0x1f
cmp eax, esi
cmovb esi, eax
test esi, esi
je 0x18018d02a
mov rdi, qword [rdx + 0x10]
mov r10d, r9d
mov eax, ebp
sub eax, ebx
inc ebx
dec eax
movzx ecx, byte [rax + rdi]
mov eax, r10d
dec r10d
xor ecx, r9d
not eax
sar eax, 0x1f
movzx eax, al
and ecx, eax
not ecx
and r8d, ecx
cmp ebx, esi
jb 0x18018d002
mov rsi, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x10]
mov eax, r8d
shr eax, 4
and r8d, eax
mov eax, r8d
shr eax, 2
and r8d, eax
lea eax, [r9 + 1]
lea ecx, [r8 + r8]
and ecx, r8d
shl ecx, 0x1e
sar ecx, 0x1f
and eax, ecx
sub dword [rdx + 4], eax
mov r8d, dword [rdx + 4]
test r12b, r12b
je 0x18018d07b
mov rax, r11
sub r8d, r11d
add qword [rdx + 0x10], rax
add qword [rdx + 0x18], rax
sub dword [rdx + 0x38], r11d
mov dword [rdx + 4], r8d
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov eax, ecx
and eax, 1
not ecx
or eax, ecx
pop r12
ret
Function at 0x180195a80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov r10d, edx
xor ebx, ebx
sub r10d, 0x49
je 0x180195abc
dec r10d
je 0x180195ab2
dec r10d
je 0x180195aa5
add rsp, 0x20
pop rbx
jmp sym.VBoxRT.dll_ssl3_ctrl
mov rdx, r9
add rsp, 0x20
pop rbx
jmp sym.VBoxRT.dll_dtls1_listen
add rsp, 0x20
pop rbx
jmp sym.VBoxRT.dll_dtls1_handle_timeout
mov rdx, r9
call sym.VBoxRT.dll_dtls1_get_timeout
mov ecx, 1
test rax, rax
cmovne ebx, ecx
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1801988e0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x460
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor ebp, ebp
mov ebx, edx
mov rdi, rcx
test rcx, rcx
jne 0x180198910
xor eax, eax
jmp 0x1801989d5
lea rdx, [rsp + 0x20]
call qword [sym.imp.MSVCR100.dll__stat64i32]
test eax, eax
js 0x180198909
xorpd xmm2, xmm2
lea rcx, [rsp + 0x20]
mov edx, gethostbyname
call sym.VBoxRT.dll_RAND_add
test ebx, ebx
je 0x180198909
lea rdx, [0x18030a8d4]
mov rcx, rdi
mov qword [rsp + 0x498], r12
call qword [sym.imp.MSVCR100.dll_fopen]
mov r12, rax
test rax, rax
je 0x1801989cb
mov qword [rsp + 0x490], rsi
nop
mov edi, 0x400
test ebx, ebx
jle 0x18019896e
cmp ebx, edi
cmovl edi, ebx
lea rcx, [rsp + 0x50]
movsxd r8, edi
mov r9, r12
mov edx, 1
call qword [sym.imp.MSVCR100.dll_fread]
mov rsi, rax
test eax, eax
jle 0x1801989ab
movd xmm2, esi
lea rcx, [rsp + 0x50]
mov edx, edi
cvtdq2pd xmm2, xmm2
call sym.VBoxRT.dll_RAND_add
add ebp, esi
test ebx, ebx
jle 0x180198960
sub ebx, edi
test ebx, ebx
jg 0x180198960
mov rcx, r12
call qword [sym.imp.MSVCR100.dll_fclose]
lea rcx, [rsp + 0x50]
mov edx, 0x400
call sym.VBoxRT.dll_OPENSSL_cleanse
mov rsi, qword [rsp + 0x490]
mov r12, qword [rsp + 0x498]
mov eax, ebp
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.180227610
add rsp, 0x460
pop rdi
pop rbp
pop rbx
ret
Function at 0x1801989f0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rdi
push r12
sub rsp, 0x468
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0x450], rax
lea rdx, [rsp + 0x20]
mov rbx, rcx
xor edi, edi
xor ebp, ebp
call qword [sym.imp.MSVCR100.dll__stat64i32]
lea rdx, [0x18030a8d8]
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_fopen]
mov r12, rax
test rax, rax
je 0x180198ade
mov qword [rsp + 0x498], rsi
mov edx, 0x180
mov rcx, rbx
mov qword [rsp + 0x4a0], r13
mov qword [rsp + 0x460], r14
call qword [sym.imp.MSVCR100.dll__chmod]
mov r13d, 0x400
lea r14d, [rdi + 1]
mov esi, r13d
mov ebx, esi
cmp esi, r13d
lea rcx, [rsp + 0x50]
cmovg ebx, r13d
sub esi, r13d
mov edx, ebx
call sym.VBoxRT.dll_RAND_bytes
lea rcx, [rsp + 0x50]
movsxd r8, ebx
test eax, eax
mov r9, r12
mov rdx, r14
cmovle ebp, r14d
call qword [sym.imp.MSVCR100.dll_fwrite]
test eax, eax
jle 0x180198aae
add edi, eax
test esi, esi
jg 0x180198a70
jmp 0x180198ab0
xor edi, edi
mov rcx, r12
call qword [sym.imp.MSVCR100.dll_fclose]
lea rcx, [rsp + 0x50]
mov rdx, r13
call sym.VBoxRT.dll_OPENSSL_cleanse
mov r14, qword [rsp + 0x460]
mov r13, qword [rsp + 0x4a0]
mov rsi, qword [rsp + 0x498]
or eax, 0xffffffff
test ebp, ebp
cmovne edi, eax
mov eax, edi
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.180227610
add rsp, 0x468
pop r12
pop rdi
pop rbp
pop rbx
ret

Function at 0x180198b10
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rbp, rdx
mov rsi, rcx
mov edi, ebx
call sym.VBoxRT.dll_OPENSSL_issetugid
test eax, eax
jne 0x180198b90
lea rcx, str.RANDFILE
call qword [sym.imp.MSVCR100.dll_getenv]
mov rdi, rax
test rax, rax
je 0x180198b90
cmp byte [rax], bl
je 0x180198b90
mov rdx, rax
mov ecx, ebx
cmp ecx, 0x80000000
jae 0x180198b66
inc rdx
inc ecx
cmp byte [rdx], bl
jne 0x180198b55
btr ecx, 0x1f
lea eax, [rcx + 1]
cmp rax, rbp
jae 0x180198b90
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
call sym.VBoxRT.dll_BUF_strlcpy
cmp rax, rbp
jb 0x180198c3a
xor eax, eax
jmp 0x180198c3d
call sym.VBoxRT.dll_OPENSSL_issetugid
test eax, eax
jne 0x180198ba9
lea rcx, str.HOME
call qword [sym.imp.MSVCR100.dll_getenv]
mov rdi, rax
test rdi, rdi
jne 0x180198bb7
lea rdi, [0x180330a20]
jmp 0x180198bbb
cmp byte [rdi], bl
je 0x180198c37
mov eax, ebx
mov rcx, rdi
cmp byte [rdi], al
je 0x180198bd4
cmp eax, 0x80000000
jae 0x180198bd4
inc rcx
inc eax
cmp byte [rcx], bl
jne 0x180198bc4
lea rcx, str..rnd
nop dword [rax + rax]
cmp ebx, 0x80000000
jae 0x180198bf2
inc rcx
inc ebx
cmp byte [rcx], 0
jne 0x180198be0
btr ebx, 0x1f
btr eax, 0x1f
lea ecx, [rbx + rax + 2]
cmp rcx, rbp
jae 0x180198c37
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
call sym.VBoxRT.dll_BUF_strlcpy
lea rdx, [0x1802615ac]
mov r8, rbp
mov rcx, rsi
call sym.VBoxRT.dll_BUF_strlcat
lea rdx, str..rnd
mov r8, rbp
mov rcx, rsi
call sym.VBoxRT.dll_BUF_strlcat
jmp 0x180198c3a
mov byte [rsi], 0
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18019a9b0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov r8d, 1
jmp sym.VBoxRT.dll_md5_block_data_order

Function at 0x18019c1b0
Capabilities:
Hash data using sha224

Disassembly:
xor eax, eax
mov dword [rcx], 0xc1059ed8
mov dword [rcx + 4], 0x367cd507
mov qword [rcx + 0x20], rax
mov dword [rcx + 0x68], eax
mov dword [rcx + 8], 0x3070dd17
mov eax, 1
mov dword [rcx + 0xc], 0xf70e5939
mov dword [rcx + 0x10], 0xffc00b31
mov dword [rcx + 0x14], 0x68581511
mov dword [rcx + 0x18], 0x64f98fa7
mov dword [rcx + 0x1c], 0xbefa4fa4
mov dword [rcx + 0x6c], 0x1c
ret

Function at 0x18019c200
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 0x24], eax
mov dword [rcx + 0x68], eax
mov dword [rcx + 8], 0x3c6ef372
mov eax, 1
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov qword [rcx + 0x1c], 0x5be0cd19
mov dword [rcx + 0x6c], 0x20
ret
Function at 0x18019d440
Capabilities:
Hash data using murmur3

Disassembly:
mov r8d, 1
jmp fcn.18019c250

Function at 0x18019d780
Capabilities:
Hash data using sha224

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xa0
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x20], 0xc1059ed8
mov dword [rsp + 0x24], 0x367cd507
mov dword [rsp + 0x28], 0x3070dd17
mov dword [rsp + 0x2c], 0xf70e5939
mov dword [rsp + 0x30], 0xffc00b31
mov dword [rsp + 0x34], 0x68581511
mov dword [rsp + 0x38], 0x64f98fa7
mov dword [rsp + 0x3c], 0xbefa4fa4
test r8, r8
lea rbx, [0x1803dafd8]
mov dword [r11 - 0x1c], 0x1c
cmovne rbx, r8
xor eax, eax
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov qword [r11 - 0x68], rax
mov dword [r11 - 0x20], eax
call sym.VBoxRT.dll_SHA256_Update
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sym.VBoxRT.dll_SHA256_Final
lea rcx, [rsp + 0x20]
mov edx, reloc.WS2_32.dll_WSASetLastError
call sym.VBoxRT.dll_OPENSSL_cleanse
mov rax, rbx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180227610
add rsp, 0xa0
pop rbx
ret

Function at 0x18019d850
Capabilities:
Hash data using sha256

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xa0
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x20], 0x6a09e667
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
test r8, r8
mov qword [r11 - 0x6c], 0x5be0cd19
lea rbx, [0x1803dafb8]
cmovne rbx, r8
xor eax, eax
mov r8, rdx
mov dword [rsp + 0x44], eax
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov dword [r11 - 0x20], eax
mov dword [r11 - 0x1c], 0x20
call sym.VBoxRT.dll_SHA256_Update
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sym.VBoxRT.dll_SHA256_Final
lea rcx, [rsp + 0x20]
mov edx, reloc.WS2_32.dll_WSASetLastError
call sym.VBoxRT.dll_OPENSSL_cleanse
mov rax, rbx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180227610
add rsp, 0xa0
pop rbx
ret
Function at 0x18019f7c0
Capabilities:
Hash data using sha512

Disassembly:
mov r8d, 1
jmp fcn.18019da60

Function at 0x18019f7d0
Capabilities:
Hash data using sha384

Disassembly:
push rbx
sub rsp, 0x110
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0x100], rax
test r8, r8
movabs rax, 0xcbbb9d5dc1059ed8
lea rbx, [0x1803db040]
mov qword [rsp + 0x20], rax
cmovne rbx, r8
movabs rax, 0x629a292a367cd507
mov qword [rsp + 0x28], rax
movabs rax, 0x9159015a3070dd17
mov r8, rdx
mov qword [rsp + 0x30], rax
movabs rax, 0x152fecd8f70e5939
mov rdx, rcx
mov qword [rsp + 0x38], rax
movabs rax, 0x67332667ffc00b31
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rax
movabs rax, 0x8eb44a8768581511
mov dword [rsp + 0xf4], getservbyname
mov qword [rsp + 0x48], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rsp + 0x50], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0xf0], eax
call sym.VBoxRT.dll_SHA512_Update
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sym.VBoxRT.dll_SHA512_Final
lea rcx, [rsp + 0x20]
mov edx, 0xd8
call sym.VBoxRT.dll_OPENSSL_cleanse
mov rax, rbx
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.180227610
add rsp, 0x110
pop rbx
ret

Function at 0x18019f8e0
Capabilities:
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x110
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0x100], rax
test r8, r8
movabs rax, 0x6a09e667f3bcc908
lea rbx, [0x1803db000]
mov qword [rsp + 0x20], rax
cmovne rbx, r8
movabs rax, 0xbb67ae8584caa73b
mov qword [rsp + 0x28], rax
movabs rax, 0x3c6ef372fe94f82b
mov r8, rdx
mov qword [rsp + 0x30], rax
movabs rax, 0xa54ff53a5f1d36f1
mov rdx, rcx
mov qword [rsp + 0x38], rax
movabs rax, 0x510e527fade682d1
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rax
movabs rax, 0x9b05688c2b3e6c1f
mov dword [rsp + 0xf4], 0x40
mov qword [rsp + 0x48], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsp + 0x50], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0xf0], eax
call sym.VBoxRT.dll_SHA512_Update
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sym.VBoxRT.dll_SHA512_Final
lea rcx, [rsp + 0x20]
mov edx, 0xd8
call sym.VBoxRT.dll_OPENSSL_cleanse
mov rax, rbx
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.180227610
add rsp, 0x110
pop rbx
ret
Function at 0x18019f9f0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xb8
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r14, qword [rsp + 0x110]
xor esi, esi
mov r13, r9
movsxd rdi, r8d
mov r12, rdx
mov rbp, rcx
mov eax, esi
test r9, r9
je 0x18019fa38
lea eax, [rsi + 1]
mov qword [rcx], r9
jmp 0x18019fa3b
mov r13, qword [rcx]
mov qword [rsp + 0xb0], rbx
test rdx, rdx
je 0x18019fb0b
mov rcx, r13
call sym.VBoxRT.dll_EVP_MD_block_size
mov ebx, eax
cmp eax, 0x80
jle 0x18019fa75
lea r8, str.j____int_sizeof_ctx__key_
lea rcx, str.D:_tinderboxwin_4.2_srclibsopenssl_0.9.8ycryptohmachmac.c
mov edx, 0x54
call sym.VBoxRT.dll_OpenSSLDie
cmp ebx, edi
jge 0x18019faad
lea rcx, [rbp + 8]
mov r8, r14
mov rdx, r13
call sym.VBoxRT.dll_EVP_DigestInit_ex
lea rcx, [rbp + 8]
mov r8, rdi
mov rdx, r12
call sym.VBoxRT.dll_EVP_DigestUpdate
lea r12, [rbp + 0x68]
lea rdx, [rbp + 0x6c]
lea rcx, [rbp + 8]
mov r8, r12
call sym.VBoxRT.dll_EVP_DigestFinal_ex
jmp 0x18019fae8
test edi, edi
js 0x18019fab9
cmp edi, 0x80
jle 0x18019fad1
lea r8, [0x180331860]
lea rcx, str.D:_tinderboxwin_4.2_srclibsopenssl_0.9.8ycryptohmachmac.c
mov edx, 0x5e
call sym.VBoxRT.dll_OpenSSLDie
lea rcx, [rbp + 0x6c]
mov r8, rdi
mov rdx, r12
call sub.MSVCR100.dll_memcpy
lea r12, [rbp + 0x68]
mov dword [r12], edi
mov ecx, dword [r12]
cmp ecx, 0x80
je 0x18019fb13
mov r8d, 0x80
xor edx, edx
sub r8d, ecx
lea rcx, [rcx + rbp + 0x6c]
call sub.MSVCR100.dll_memset
jmp 0x18019fb13
test eax, eax
je 0x18019fbcd
lea rax, [rsp + 0x20]
mov rdi, rbp
mov rdx, rsi
sub rdi, rax
nop word [rax + rax]
lea rcx, [rsp + rdx + 0x20]
add rdx, 2
movzx eax, byte [rdi + rcx + 0x6c]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [rdi + rcx + 0x6d]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x80
jl 0x18019fb30
lea rcx, [rbp + 0x28]
mov r8, r14
mov rdx, r13
call sym.VBoxRT.dll_EVP_DigestInit_ex
mov rcx, r13
call sym.VBoxRT.dll_EVP_MD_block_size
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x28]
movsxd r8, eax
call sym.VBoxRT.dll_EVP_DigestUpdate
nop dword [rax]
lea rdx, [rsp + rsi + 0x20]
add rsi, 2
movzx eax, byte [rdi + rdx + 0x6c]
xor al, 0x5c
mov byte [rdx], al
movzx eax, byte [rdi + rdx + 0x6d]
xor al, 0x5c
mov byte [rdx + 1], al
cmp rsi, 0x80
jl 0x18019fb80
lea rcx, [rbp + 0x48]
mov r8, r14
mov rdx, r13
call sym.VBoxRT.dll_EVP_DigestInit_ex
mov rcx, r13
call sym.VBoxRT.dll_EVP_MD_block_size
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x48]
movsxd r8, eax
call sym.VBoxRT.dll_EVP_DigestUpdate
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 8]
call sym.VBoxRT.dll_EVP_MD_CTX_copy_ex
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.180227610
add rsp, 0xb8
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801a0360
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x170
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
je 0x1801a03d3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x1801a03d3
lea rbx, [rsp + 0x188]
call qword [sym.imp.MSVCR100.dll___iob_func]
mov rdx, qword [rsp + 0x180]
lea rcx, [rax + 0x60]
mov r8, rbx
call qword [sym.imp.MSVCR100.dll_vfprintf]
jmp 0x1801a048a
mov r8, qword [rsp + 0x180]
lea r9, [rsp + 0x188]
lea rcx, [rsp + 0x60]
mov edx, 0xff
call qword [sym.imp.MSVCR100.dll__vsnprintf]
mov byte [rsp + 0x15f], 0
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x1801a0470
call sym.VBoxRT.dll_OPENSSL_isservice
test eax, eax
jle 0x1801a0470
lea rdx, str.OPENSSL
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
xor ecx, ecx
mov r9d, 1
mov qword [rsp + 0x40], rcx
mov rbx, rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov edx, r9d
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
mov word [rsp + 0x28], r9w
mov qword [rsp + 0x20], rcx
xor r8d, r8d
xor r9d, r9d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x1801a048a
lea r8, str.OpenSSL:_FATAL
lea rdx, [rsp + 0x60]
mov r9d, reloc.WS2_32.dll_recv
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180227610
add rsp, 0x170
pop rbx
ret

Function at 0x1801a0500
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
test r8, r8
je 0x1801a0522
sub rdx, rcx
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
xor al, byte [rcx - 1]
or r9b, al
dec r8
jne 0x1801a0510
movzx eax, r9b
ret
Function at 0x1801a4830
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
call qword [sym.imp.MSVCR100.dll_fopen]
mov rdi, rax
test rax, rax
jne 0x1801a48cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [rdi + 1]
lea ecx, [rdi + 2]
xor r9d, r9d
mov r8d, eax
mov dword [rsp + 0x20], edi
call sym.VBoxRT.dll_ERR_put_error
lea r11, [0x18032f054]
lea r9, [0x180331ce0]
mov qword [rsp + 0x28], r11
lea rdx, str.fopen_
lea ecx, [rdi + 5]
mov r8, rsi
mov qword [rsp + 0x20], rbx
call sym.VBoxRT.dll_ERR_add_error_data
call qword [sym.imp.MSVCR100.dll__errno]
lea edx, [rdi + 0x6d]
xor r9d, r9d
cmp dword [rax], 2
mov dword [rsp + 0x20], edi
lea ecx, [rdi + 0x20]
lea r8d, [rdx + 0x13]
je 0x1801a48b8
lea r8d, [rdi + 2]
call sym.VBoxRT.dll_ERR_put_error
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rcx, [0x1803c4c90]
call sym.VBoxRT.dll_BIO_new
mov rbx, rax
test rax, rax
jne 0x1801a48fe
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
xor edx, edx
mov rcx, rax
call sym.VBoxRT.dll_BIO_clear_flags
mov edx, 0x6a
mov r9, rdi
lea r8d, [rdx - 0x69]
mov rcx, rbx
call sym.VBoxRT.dll_BIO_ctrl
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1801a6610
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov r9, rcx
test rcx, rcx
je 0x1801a6668
movzx eax, byte [rcx]
test al, al
je 0x1801a6668
mov r10d, 0x100
nop dword [rax + rax]
movsx edx, al
inc r9
or edx, r10d
add r10d, 0x100
mov eax, edx
shr eax, 2
xor eax, edx
and eax, 0xf
movzx ecx, al
movzx eax, byte [r9]
imul edx, edx
rol r8d, cl
xor r8d, edx
test al, al
jne 0x1801a6630
mov eax, r8d
shr eax, 0x10
xor eax, r8d
ret
xor eax, eax
ret
Function at 0x1801b2410
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx + 0x28]
mov r12, qword [rcx + 0x40]
mov rdi, rcx
mov ebx, dword [rax + 0x14]
lea rcx, str.OPENSSL_ALLOW_PROXY_CERTS
xor r14d, r14d
shr ebx, 6
xor r13d, r13d
or ebp, 0xffffffff
and ebx, 1
call qword [sym.imp.MSVCR100.dll_getenv]
mov ecx, 1
test rax, rax
cmovne ebx, ecx
xor esi, esi
movsxd r15, ebx
cmp dword [rdi + 0x8c], esi
jle 0x1801b2659
mov rcx, qword [rdi + 0x90]
mov edx, esi
call sym.VBoxRT.dll_sk_value
mov rcx, qword [rdi + 0x28]
test byte [rcx + 0x14], 0x10
mov rbx, rax
jne 0x1801b24bd
test dword [rax + 0x40], 0x200
je 0x1801b24bd
mov rdx, rdi
xor ecx, ecx
mov dword [rdi + 0xa8], 0x22
mov dword [rdi + 0xa4], esi
mov qword [rdi + 0xb0], rax
call r12
test eax, eax
je 0x1801b265b
test r15, r15
jne 0x1801b24f2
test dword [rbx + 0x40], 0x400
je 0x1801b24f2
mov rdx, rdi
xor ecx, ecx
mov dword [rdi + 0xa8], 0x28
mov dword [rdi + 0xa4], esi
mov qword [rdi + 0xb0], rbx
call r12
test eax, eax
je 0x1801b265b
mov rcx, rbx
call sym.VBoxRT.dll_X509_check_ca
mov r11d, eax
cmp ebp, 0xffffffff
je 0x1801b2529
test ebp, ebp
je 0x1801b2519
test eax, eax
je 0x1801b253e
mov rcx, qword [rdi + 0x28]
test byte [rcx + 0x14], 0x20
je 0x1801b2565
cmp eax, 1
jmp 0x1801b253c
test eax, eax
je 0x1801b2565
mov dword [rdi + 0xa8], 0x25
jmp 0x1801b2548
mov rax, qword [rdi + 0x28]
test byte [rax + 0x14], 0x20
je 0x1801b2565
cmp r11d, 1
je 0x1801b2565
test r11d, r11d
je 0x1801b2565
mov dword [rdi + 0xa8], 0x18
mov rdx, rdi
xor ecx, ecx
mov dword [rdi + 0xa4], esi
mov qword [rdi + 0xb0], rbx
call r12
test eax, eax
je 0x1801b265b
mov rax, qword [rdi + 0x28]
mov edx, dword [rax + 0x18]
test edx, edx
jle 0x1801b25bb
xor r8d, r8d
test ebp, ebp
mov rcx, rbx
setg r8b
call sym.VBoxRT.dll_X509_check_purpose
test eax, eax
je 0x1801b2594
mov rcx, qword [rdi + 0x28]
test byte [rcx + 0x14], 0x20
je 0x1801b25bb
cmp eax, 1
je 0x1801b25bb
mov rdx, rdi
xor ecx, ecx
mov dword [rdi + 0xa8], 0x1a
mov dword [rdi + 0xa4], esi
mov qword [rdi + 0xb0], rbx
call r12
test eax, eax
je 0x1801b265b
cmp esi, 1
jle 0x1801b25fb
test byte [rbx + 0x40], 0x20
jne 0x1801b25fb
mov eax, dword [rbx + 0x38]
cmp eax, 0xffffffff
je 0x1801b25fb
lea eax, [rax + r13 + 1]
cmp r14d, eax
jle 0x1801b25fb
mov rdx, rdi
xor ecx, ecx
mov dword [rdi + 0xa8], 0x19
mov dword [rdi + 0xa4], esi
mov qword [rdi + 0xb0], rbx
call r12
test eax, eax
je 0x1801b265b
mov eax, dword [rbx + 0x40]
test al, 0x20
jne 0x1801b2605
inc r14d
bt eax, 0xa
jae 0x1801b2644
mov eax, dword [rbx + 0x3c]
cmp eax, 0xffffffff
je 0x1801b263a
cmp esi, eax
jle 0x1801b263a
mov rdx, rdi
xor ecx, ecx
mov dword [rdi + 0xa8], 0x26
mov dword [rdi + 0xa4], esi
mov qword [rdi + 0xb0], rbx
call r12
test eax, eax
je 0x1801b265b
inc r13d
xor ebp, ebp
lea ecx, [rbp + 1]
jmp 0x1801b264b
mov ecx, 1
mov ebp, ecx
inc esi
cmp esi, dword [rdi + 0x8c]
jl 0x1801b2472
mov eax, ecx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret