joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d2e0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp dword [rcx + 0x818], 0
je 0x14000d424
lea r15, [rbx + 0x810]
xor r12d, r12d
lea r14, [rbx + r12*8]
add r14, 0x10
jmp 0x14000d336
mov qword [rcx], rax
mov rcx, rbx
mov rdx, r14
mov r8, rsi
call rdi
test eax, eax
jne 0x14000d437
mov r14, qword [r14]
test r14, r14
je 0x14000d3dc
mov ebp, dword [r14 + 0xc]
test ebp, ebp
je 0x14000d323
mov r13d, dword [r14 + 8]
mov ecx, 0x10
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x14000d3f8
mov qword [rax], 0
mov dword [rax + 8], r13d
mov dword [rax + 0xc], ebp
mov r8, qword [r15]
mov rcx, r15
test r8, r8
je 0x14000d320
lea edx, [r13 + rbp - 1]
nop
mov rcx, r8
mov r9d, dword [r8 + 8]
mov r8d, dword [r8 + 0xc]
add r8d, r9d
dec r8d
cmp r9d, r13d
ja 0x14000d39b
cmp r8d, r13d
jae 0x14000d3f0
cmp r8d, r13d
setb r10b
cmp edx, r9d
setb r11b
cmp edx, r8d
seta bpl
cmp r9d, r13d
setb r9b
and r9b, bpl
or r9b, r11b
cmp r8d, edx
seta r8b
cmp r9b, 1
jne 0x14000d3f0
or r10b, r8b
je 0x14000d3f0
mov r8, qword [rcx]
test r8, r8
jne 0x14000d380
jmp 0x14000d320
inc r12
xor eax, eax
cmp r12, 0x100
jne 0x14000d310
jmp 0x14000d437
mov rcx, rax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.ERROR:_file_content_collision_in_mar_enum_items___n
mov edx, 0x32
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov eax, 1
jmp 0x14000d437
mov rcx, rbx
call fcn.14000e170
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
je 0x14000d448
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rbx + 0x818], 1
jmp 0x14000d306
Function at 0x14000d6a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
mov qword [rdx], 0
mov ecx, 0x820
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x14000d778
mov rsi, rax
mov rcx, rbx
xor edx, edx
mov r8d, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
mov rcx, rbx
test eax, eax
je 0x14000d782
call sub.api_ms_win_crt_stdio_l1_1_0.dll_rewind
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.Warning:_MAR_size_could_not_be_determined_n
mov edx, 0x2a
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r14d, 0x1f400000
mov rcx, r14
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov qword [rsi], rax
test rax, rax
je 0x14000d7d8
mov edx, 1
mov rcx, rax
mov r8, r14
mov r9, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
mov qword [rsi + 8], rax
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fgetc
cmp eax, 0xffffffff
je 0x14000d80c
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.ERROR:_File_is_larger_than_buffer___lli__n
mov rcx, rax
mov r8, r14
call fcn.140018b90
jmp 0x14000d83d
mov ebx, 2
jmp 0x14000d852
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
mov r15, rax
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_rewind
test r15d, r15d
js 0x14000d6ef
mov r14d, r15d
cmp r15d, 0x1f400001
jb 0x14000d71a
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.ERROR:_MAR_exceeds_maximum_size___lli__n
mov rcx, rax
mov r8, r14
call fcn.140018b90
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ebx, 3
jmp 0x14000d852
mov ebx, 2
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.ERROR:_MAR_buffer_could_not_be_allocated_n
mov edx, 0x29
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x14000d852
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ferror
test eax, eax
je 0x14000d860
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.ERROR:_Failed_to_read_MAR_n
mov edx, 0x1a
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, qword [rsi]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ebx, 1
mov eax, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, rsi
add rcx, 0x10
xor ebx, ebx
mov r8d, 0x80c
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov qword [rdi], rsi
jmp 0x14000d852
Function at 0x14000d880
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [0x14003da78]
mov rax, qword [rbx]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov qword [rdx], 0
lea r8, [0x140040068]
lea rcx, [rsp + 0x20]
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14000d8db
mov rdx, rdi
call fcn.14000d6a0
mov esi, eax
mov rcx, qword [rsp + 0x20]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
jmp 0x14000d90e
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.ERROR:_could_not_open_file_in_mar_wopen___n
mov edx, 0x2a
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wperror]
mov esi, 1
mov rax, qword [rsp + 0x28]
xor rax, rsp
mov rcx, qword [rbx]
cmp rcx, rax
jne 0x14000d928
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
call fcn.140018700
int3

Function at 0x14000e010
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rdi, rcx
cmp dword [rcx + 0x818], 0
je 0x14000e10c
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, rbx
mov rdx, rax
call fcn.1400142c0
movzx eax, al
lea rsi, [rdi + rax*8]
add rsi, 0x10
nop word [rax + rax]
mov rsi, qword [rsi]
test rsi, rsi
je 0x14000e068
lea rcx, [rsi + 0x14]
mov rdx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x14000e050
mov r14d, dword [rsi + 0xc]
test r14d, r14d
je 0x14000e156
mov ebx, dword [rsi + 8]
mov ecx, 0x10
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x14000e12f
mov qword [rax], 0
mov dword [rax + 8], ebx
mov dword [rax + 0xc], r14d
mov r8, qword [rdi + 0x810]
test r8, r8
je 0x14000e163
lea ecx, [rbx + r14]
dec ecx
nop
mov rdx, r8
mov r9d, dword [r8 + 8]
mov r8d, dword [r8 + 0xc]
add r8d, r9d
dec r8d
cmp r9d, ebx
ja 0x14000e0cb
cmp r8d, ebx
jae 0x14000e127
cmp r8d, ebx
setb r10b
cmp ecx, r9d
setb r11b
cmp ecx, r8d
seta dil
cmp r9d, ebx
setb r9b
and r9b, dil
or r9b, r11b
cmp r8d, ecx
seta r8b
cmp r9b, 1
jne 0x14000e127
or r10b, r8b
je 0x14000e127
mov r8, qword [rdx]
test r8, r8
jne 0x14000e0b0
mov qword [rdx], rax
jmp 0x14000e156
mov rcx, rdi
call fcn.14000e170
test eax, eax
jne 0x14000e154
mov dword [rdi + 0x818], 1
jmp 0x14000e02c
mov rcx, rax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.ERROR:_file_content_collision_in_mar_find_item___n
mov edx, 0x31
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
xor esi, esi
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rdi + 0x810], rax
jmp 0x14000e156
Function at 0x14000e420
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov edx, 0x2f
call sub.api_ms_win_crt_private_l1_1_0.dll_strrchr
test rax, rax
je 0x14000e452
mov rdi, rax
mov byte [rax], 0
mov rcx, rsi
call fcn.14000e420
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov byte [rdi], 0x2f
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x14000e460
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
movdqa xmmword [rsp + 0x60], xmm12
movdqa xmmword [rsp + 0x50], xmm11
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
movdqa xmm0, xmmword [0x1400402a0]
xor eax, eax
movdqa xmm1, xmmword [0x1400402b0]
movdqa xmm2, xmmword [0x1400402c0]
movdqa xmm3, xmmword [0x1400402d0]
movdqa xmm4, xmmword [0x1400402e0]
movdqa xmm5, xmmword [0x1400402f0]
movdqa xmm6, xmmword [0x140040300]
lea rcx, [0x14005cb30]
movdqa xmm7, xmmword [0x140040310]
nop dword [rax]
movdqa xmm9, xmm0
psrld xmm9, 1
movdqa xmm8, xmm0
pslld xmm8, 0x1f
psrad xmm8, 0x1f
pand xmm8, xmm1
pxor xmm8, xmm9
movdqa xmm10, xmm8
psrld xmm10, 1
movdqa xmm9, xmm0
pslld xmm9, 0x1e
psrad xmm9, 0x1f
pand xmm9, xmm1
pxor xmm9, xmm10
movdqa xmm10, xmm9
psrld xmm10, 6
movdqa xmm11, xmm0
pslld xmm11, 0x1d
psrad xmm11, 0x1f
pand xmm11, xmm2
movdqa xmm12, xmm0
pslld xmm12, 0x1c
psrad xmm12, 0x1f
pand xmm12, xmm3
pxor xmm12, xmm11
movdqa xmm11, xmm0
pslld xmm11, 0x1b
psrad xmm11, 0x1f
pand xmm11, xmm4
pxor xmm11, xmm12
movdqa xmm12, xmm0
pslld xmm12, 0x1a
psrad xmm12, 0x1f
pand xmm12, xmm5
pxor xmm12, xmm11
pxor xmm12, xmm10
pslld xmm8, 0x1a
psrad xmm8, 0x1f
pand xmm8, xmm6
pslld xmm9, 0x1a
psrad xmm9, 0x1f
pand xmm9, xmm1
pxor xmm9, xmm12
pxor xmm9, xmm8
movdqa xmmword [rax + rcx], xmm9
paddd xmm0, xmm7
add rax, 0x10
cmp rax, 0x400
jne 0x14000e4e0
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x14000e6b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
movdqa xmm0, xmmword [0x140040320]
xor eax, eax
movdqa xmm1, xmmword [0x140040330]
movdqa xmm2, xmmword [0x140040340]
lea rcx, [0x14005cf30]
movdqa xmm3, xmmword [0x140040350]
nop word cs:[rax + rax]
movdqa xmm4, xmm0
psrlq xmm4, 1
movdqa xmm5, xmm0
psllq xmm5, 0x3f
psrad xmm5, 0x1f
pshufd xmm5, xmm5, 0xf5
pand xmm5, xmm1
pxor xmm5, xmm4
movdqa xmm4, xmm5
psrlq xmm4, 1
movdqa xmm6, xmm0
psllq xmm6, 0x3e
psrad xmm6, 0x1f
pshufd xmm6, xmm6, 0xf5
pand xmm6, xmm1
pxor xmm6, xmm4
movdqa xmm4, xmm6
psrlq xmm4, 1
psllq xmm5, 0x3e
psrad xmm5, 0x1f
pshufd xmm5, xmm5, 0xf5
pand xmm5, xmm1
pxor xmm5, xmm4
movdqa xmm4, xmm5
psrlq xmm4, 1
psllq xmm6, 0x3e
psrad xmm6, 0x1f
pshufd xmm6, xmm6, 0xf5
pand xmm6, xmm1
pxor xmm6, xmm4
movdqa xmm4, xmm6
psrlq xmm4, 1
psllq xmm5, 0x3e
psrad xmm5, 0x1f
pshufd xmm5, xmm5, 0xf5
pand xmm5, xmm1
pxor xmm5, xmm4
movdqa xmm4, xmm5
psrlq xmm4, 1
psllq xmm6, 0x3e
psrad xmm6, 0x1f
pshufd xmm6, xmm6, 0xf5
pand xmm6, xmm1
pxor xmm6, xmm4
movdqa xmm4, xmm6
psrlq xmm4, 2
psllq xmm5, 0x3e
psrad xmm5, 0x1f
pshufd xmm5, xmm5, 0xf5
pand xmm5, xmm2
psllq xmm6, 0x3e
psrad xmm6, 0x1f
pshufd xmm6, xmm6, 0xf5
pand xmm6, xmm1
pxor xmm6, xmm4
pxor xmm6, xmm5
movdqa xmmword [rax + rcx], xmm6
paddq xmm0, xmm3
add rax, 0x10
cmp rax, 0x800
jne 0x14000e6f0
movaps xmm6, xmmword [rsp]
add rsp, 0x18
ret
Function at 0x14000f310
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov r14, rcx
cmp dword [rcx], 4
jne 0x14000f330
mov rax, qword [r8]
sub r9, rax
cmp r9, 5
jae 0x14000f337
xor esi, esi
jmp 0x14000f4d5
add rdx, rax
mov r13d, dword [r14 + 0x10]
add r9, 0xfffffffffffffffc
mov rax, 0xffffffffffffffff
xor esi, esi
lea rdi, [0x140040370]
mov ebp, 0xe8
jmp 0x14000f372
mov rcx, rsi
mov rsi, rcx
inc rsi
cmp rsi, r9
jae 0x14000f4bb
movzx ecx, byte [rdx + rsi]
and cl, 0xfe
cmp cl, 0xe8
jne 0x14000f360
mov rcx, rsi
sub rcx, rax
cmp rcx, 3
jbe 0x14000f390
xor r13d, r13d
jmp 0x14000f3d0
dec cl
shl r13d, cl
mov eax, r13d
mov r13d, 0
and eax, 7
je 0x14000f3d0
bt ebp, eax
jb 0x14000f4a9
movzx ecx, byte [rax + rdi]
mov rbx, rsi
sub rbx, rcx
movzx ecx, byte [rbx + rdx + 4]
dec cl
cmp cl, 0xfe
jae 0x14000f4a9
mov r13d, eax
nop dword [rax]
movzx eax, byte [rdx + rsi + 4]
lea ecx, [rax - 1]
cmp cl, 0xfe
jae 0x14000f3e8
add r13d, r13d
inc r13d
jmp 0x14000f4b0
movzx ecx, byte [rdx + rsi + 1]
movzx r10d, byte [rdx + rsi + 2]
shl r10d, 8
movzx r11d, byte [rdx + rsi + 3]
shl r11d, 0x10
shl eax, 0x18
or eax, ecx
or eax, r10d
or eax, r11d
mov ecx, dword [r14 + 0xc]
add ecx, esi
mov r15d, 0xfffffffb
sub r15d, ecx
add eax, r15d
test r13d, r13d
je 0x14000f47a
mov ecx, r13d
movzx r11d, byte [rcx + rdi]
shl r11d, 3
mov r10d, 0x18
sub r10d, r11d
mov r12d, eax
mov ecx, r10d
shr r12d, cl
dec r12b
cmp r12b, 0xfe
jb 0x14000f47a
neg r11b
mov r12d, 0xffffffff
mov ecx, r11d
shl r12d, cl
nop dword [rax]
xor eax, r12d
not eax
add eax, r15d
mov r11d, eax
mov ecx, r10d
shr r11d, cl
dec r11b
cmp r11b, 0xfd
ja 0x14000f460
lea rcx, [rsi + 4]
mov ebx, eax
and ebx, 0x1000000
mov r10d, ebx
neg r10d
or r10d, ebx
mov byte [rdx + rsi + 1], al
mov byte [rdx + rsi + 2], ah
shr eax, 0x10
mov byte [rdx + rsi + 3], al
shr r10d, 0x18
mov byte [rdx + rsi + 4], r10b
jmp 0x14000f4b3
lea r13d, [rax + rax]
inc r13d
mov rcx, rsi
mov rax, rsi
jmp 0x14000f363
mov rdx, rsi
sub rdx, rax
lea ecx, [rdx - 1]
shl r13d, cl
xor eax, eax
cmp rdx, 4
cmovb eax, r13d
mov dword [r14 + 0x10], eax
add qword [r8], rsi
add dword [r14 + 0xc], esi
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400113e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov r8, rcx
cmp dword [rcx + 4], 0
sete cl
lea r9, [0x14005cb30]
mov r10, qword [rdx]
mov r11, qword [rdx + 0x10]
test cl, 1
je 0x140011410
mov qword [r8 + 8], 0
nop dword [rax + rax]
mov rax, qword [rdx + 8]
cmp rax, r11
jae 0x140011570
movzx esi, byte [r10 + rax]
inc rax
mov qword [rdx + 8], rax
mov eax, esi
and eax, 0x7f
mov ecx, dword [r8 + 4]
shl rax, cl
or rax, qword [r8 + 8]
mov qword [r8 + 8], rax
test sil, sil
jns 0x140011460
add ecx, 7
mov dword [r8 + 4], ecx
cmp ecx, 0x3f
jne 0x140011410
jmp 0x140011574
jne 0x14001146a
test ecx, ecx
jne 0x140011574
mov dword [r8 + 4], 0
mov ecx, dword [r8 + 0x80]
cmp ecx, 2
je 0x1400114b0
cmp ecx, 1
je 0x140011542
test ecx, ecx
jne 0x140011554
mov qword [r8 + 0x90], rax
cmp rax, qword [r8 + 0x60]
jne 0x140011608
mov dword [r8 + 0x80], 1
jmp 0x14001155b
add qword [r8 + 0xa0], rax
mov eax, dword [r8 + 0xa8]
not eax
mov rcx, 0xffffffffffffffe8
nop word [rax + rax]
movzx r10d, byte [r8 + rcx + 0xb0]
movzx r11d, al
xor r11d, r10d
shr eax, 8
xor eax, dword [r9 + r11*4]
movzx r10d, byte [r8 + rcx + 0xb1]
movzx r11d, al
xor r11d, r10d
shr eax, 8
xor eax, dword [r9 + r11*4]
movzx r10d, byte [r8 + rcx + 0xb2]
movzx r11d, al
xor r11d, r10d
shr eax, 8
xor eax, dword [r9 + r11*4]
add rcx, 3
jne 0x1400114d0
not eax
mov dword [r8 + 0xa8], eax
mov rax, qword [r8 + 0x90]
dec rax
mov qword [r8 + 0x90], rax
mov dword [r8 + 0x80], 1
jmp 0x14001155b
add qword [r8 + 0x98], rax
mov dword [r8 + 0x80], 2
mov rax, qword [r8 + 0x90]
mov cl, 1
test rax, rax
jne 0x1400113f4
mov eax, 1
jmp 0x140011604
xor eax, eax
jmp 0x140011579
mov eax, 7
mov r11, qword [rdx + 8]
mov rsi, qword [r8 + 0x10]
mov r10, r11
sub r10, rsi
add qword [r8 + 0x88], r10
mov ecx, dword [r8 + 0x20]
test r10, r10
je 0x1400115fe
mov rdx, qword [rdx]
add rdx, rsi
not ecx
inc rsi
test r10b, 1
je 0x1400115bd
movzx edi, byte [rdx]
inc rdx
movzx ebx, cl
xor ebx, edi
shr ecx, 8
xor ecx, dword [r9 + rbx*4]
dec r10
cmp r11, rsi
je 0x1400115fc
xor r11d, r11d
nop word cs:[rax + rax]
movzx esi, byte [rdx + r11]
movzx edi, cl
xor edi, esi
shr ecx, 8
xor ecx, dword [r9 + rdi*4]
movzx esi, byte [rdx + r11 + 1]
movzx edi, cl
xor edi, esi
shr ecx, 8
xor ecx, dword [r9 + rdi*4]
add r11, 2
cmp r10, r11
jne 0x1400115d0
not ecx
mov ecx, ecx
mov qword [r8 + 0x20], rcx
pop rbx
pop rdi
pop rsi
ret
mov eax, 7
jmp 0x140011604
Function at 0x140011610
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov r9, qword [rdx + 8]
mov r10, qword [rcx + 0x10]
mov r8, r9
sub r8, r10
add qword [rcx + 0x88], r8
mov eax, dword [rcx + 0x20]
test r8, r8
je 0x1400116a0
mov rdx, qword [rdx]
add rdx, r10
not eax
inc r10
test r8b, 1
je 0x14001165d
movzx r11d, byte [rdx]
inc rdx
movzx esi, al
xor esi, r11d
lea r11, [0x14005cb30]
shr eax, 8
xor eax, dword [r11 + rsi*4]
dec r8
cmp r9, r10
je 0x14001169e
xor r9d, r9d
lea r10, [0x14005cb30]
nop dword [rax]
movzx r11d, byte [rdx + r9]
movzx esi, al
xor esi, r11d
shr eax, 8
xor eax, dword [r10 + rsi*4]
movzx r11d, byte [rdx + r9 + 1]
movzx esi, al
xor esi, r11d
shr eax, 8
xor eax, dword [r10 + rsi*4]
add r9, 2
cmp r8, r9
jne 0x140011670
not eax
mov eax, eax
mov qword [rcx + 0x20], rax
pop rsi
ret
Function at 0x140011810
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r14, qword [0x14003da78]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0x38], rax
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x20], xmm0
movq xmm1, rcx
movq xmm2, rdx
punpcklqdq xmm2, xmm1
movq xmm1, r9
movq xmm3, r8
punpcklqdq xmm3, xmm1
pcmpeqd xmm3, xmm0
pshufd xmm1, xmm3, 0xb1
pand xmm1, xmm3
pcmpeqd xmm2, xmm0
pshufd xmm0, xmm2, 0xb1
pand xmm0, xmm2
packssdw xmm0, xmm1
movmskps eax, xmm0
test eax, eax
jne 0x1400118ea
mov r15, qword [rsp + 0x90]
test r15, r15
je 0x1400118ea
mov rbx, r9
mov rdi, r8
mov rsi, rdx
lea rdx, [rsp + 0x20]
call sub.nss3.dll_PK11_FindCertFromNickname
mov qword [rbx], rax
test rax, rax
je 0x140011903
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.nss3.dll_PK11_FindKeyByAnyCert
mov qword [rdi], rax
test rax, rax
je 0x14001191c
mov rcx, rax
call sub.nss3.dll_PK11_SignatureLen
mov dword [r15], eax
cmp eax, 0x1001
jb 0x140011966
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, dword [r15]
lea rdx, str.ERROR:_Program_must_be_compiled_with_a_larger_block_size_to_support_signing_with_signatures_this_large:__u._n
mov rcx, rax
call fcn.140018b90
jmp 0x140011941
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.ERROR:_Invalid_parameter_passed_to_NSSSignBegin_n
mov edx, 0x30
jmp 0x140011933
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.ERROR:_Could_not_find_cert_from_nickname_n
mov edx, 0x29
jmp 0x140011933
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.ERROR:_Could_not_find_private_key_n
mov edx, 0x22
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
mov rdx, qword [r14]
cmp rdx, rcx
jne 0x1400119ef
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
cmp eax, 0xff
ja 0x14001198f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.ERROR:_Key_length_must_be____d_bytes_n
mov rcx, rax
mov r8d, 0x100
call fcn.140018b90
jmp 0x140011941
mov rdx, qword [rdi]
mov ecx, 0xc3
call sub.nss3.dll_SGN_NewContext
mov qword [rsi], rax
test rax, rax
je 0x1400119cc
mov rcx, rax
call sub.nss3.dll_SGN_Begin
test eax, eax
je 0x1400119e8
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.ERROR:_Could_not_begin_signature_n
mov edx, 0x21
jmp 0x140011933
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.ERROR:_Could_not_create_signature_context_n
mov edx, 0x2a
jmp 0x140011933
xor eax, eax
jmp 0x140011946
call fcn.140018700
int3
Function at 0x140011a00
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
xor esi, esi
test r8d, r8d
je 0x140011ab3
mov rdi, r9
mov ebx, r8d
mov r14, rdx
mov r9, rcx
mov edx, r8d
mov r8d, 1
mov rcx, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp rax, 1
jne 0x140011a7f
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x140011ab3
mov esi, eax
xor r12d, r12d
lea r15, str.ERROR:_Could_not_update_signature_context_for__s_n
nop word cs:[rax + rax]
mov rcx, qword [rdi + r12*8]
mov rdx, r14
mov r8d, ebx
call sub.nss3.dll_SGN_Update
test eax, eax
jne 0x140011a8d
inc r12
cmp rsi, r12
jne 0x140011a60
xor esi, esi
jmp 0x140011ab3
mov esi, 0xfffffffe
lea r15, str.ERROR:_Could_not_write__s_n
jmp 0x140011a92
mov esi, 0xfffffffd
mov rdi, qword [rsp + 0x88]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, r15
mov r8, rdi
call fcn.140018b90
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140011b30
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov edi, r9d
xor esi, esi
test r9d, r9d
je 0x140011c11
mov rbx, r8
mov r14, rdx
mov r9, rcx
mov r15d, edi
mov r8d, 1
mov rcx, rbx
mov rdx, r15
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp rax, 1
jne 0x140011bcf
mov r8d, 1
mov rcx, rbx
mov rdx, r15
mov r9, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp rax, 1
jne 0x140011bdd
mov eax, dword [rsp + 0x88]
test eax, eax
je 0x140011c11
mov rsi, qword [rsp + 0x80]
mov r15d, eax
xor r12d, r12d
lea r14, str.ERROR:_Could_not_update_signature_context_for__s_n
nop dword [rax]
mov rcx, qword [rsi + r12*8]
mov rdx, rbx
mov r8d, edi
call sub.nss3.dll_SGN_Update
test eax, eax
jne 0x140011beb
inc r12
cmp r15, r12
jne 0x140011bb0
xor esi, esi
jmp 0x140011c11
mov esi, 0xffffffff
lea r14, str.ERROR:_Could_not_read__s_n
jmp 0x140011bf0
mov esi, 0xfffffffe
lea r14, str.ERROR:_Could_not_write__s_n
jmp 0x140011bf0
mov esi, 0xfffffffd
mov rdi, qword [rsp + 0x90]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, r14
mov r8, rdi
call fcn.140018b90
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140011c30
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
xor esi, esi
test r9d, r9d
je 0x140011cb8
mov rdi, r8
mov rbx, rdx
mov rax, rcx
mov r14d, r9d
mov r8d, 1
mov rcx, rdi
mov rdx, r14
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp rax, 1
jne 0x140011c8e
mov r8d, 1
mov rcx, rdi
mov rdx, r14
mov r9, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp rax, 1
je 0x140011cb8
mov esi, 0xfffffffe
lea rdi, str.ERROR:_Could_not_write__s_n
jmp 0x140011c9a
mov esi, 0xffffffff
lea rdi, str.ERROR:_Could_not_read__s_n
mov rbx, qword [rsp + 0x70]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rdi
mov r8, rbx
call fcn.140018b90
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret