joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400720e0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx]
mov r9, qword [rcx + 0x10]
cmp eax, 2
je 0x140072180
ja 0x140072110
test eax, eax
je 0x140072190
add rsp, 0x28
jmp sym.tftp_rx
cmp eax, 3
jne 0x140072158
test r9, r9
je 0x14007214d
test byte [r9 + 0xa37], 0x10
je 0x14007214d
mov rax, qword [r9 + 0x11e8]
test rax, rax
je 0x140072137
mov eax, dword [rax + 8]
test eax, eax
jle 0x14007214d
lea r8, str.TFTP_finished
lea rdx, [0x140101305]
mov rcx, r9
call sym.Curl_infof
xor eax, eax
jmp 0x140072173
lea r8, str.Internal_state_machine_error
lea rdx, [0x140101305]
mov rcx, r9
call sym.Curl_failf
mov eax, 0x47
add rsp, 0x28
ret
add rsp, 0x28
jmp sym.tftp_tx
add rsp, 0x28
jmp sym.tftp_send_first
Function at 0x140073d80
Capabilities:
Generate random numbers via winapi

Disassembly:
mov rcx, rdx
mov rdx, r8
jmp sym.Curl_win32_random

Function at 0x140073e50
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, r8
mov rdi, rcx
mov r8, r9
mov rbp, rdx
mov rcx, rsi
xor edx, edx
mov dword [rsp + 0x3c], r9d
mov rbx, r9
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x38], 4
call sym.memset
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x20], 0xf0000040
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140073ec8
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x140073f20
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x140073f18
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140073eba
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x140073ef6
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov r8d, ebp
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x48]
test eax, eax
je 0x140073ef1
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x34]
mov edx, 4
mov dword [rsp + 0x20], 0
mov rdi, qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
call rdi
mov rcx, qword [rsp + 0x48]
test eax, eax
je 0x140073ef1
mov eax, dword [rsp + 0x34]
cmp rbx, rax
jb 0x140073ef1
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov r8, rsi
mov edx, 2
call rdi
jmp 0x140073eec
Function at 0x140074940
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, r8
mov rdi, rcx
mov r8, r9
mov rbp, rdx
mov rcx, rsi
xor edx, edx
mov dword [rsp + 0x3c], r9d
mov rbx, r9
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x38], 4
call sym.memset
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x20], 0xf0000040
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1400749b8
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x140074a10
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x140074a08
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400749aa
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x1400749e6
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov r8d, ebp
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x48]
test eax, eax
je 0x1400749e1
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x34]
mov edx, 4
mov dword [rsp + 0x20], 0
mov rdi, qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
call rdi
mov rcx, qword [rsp + 0x48]
test eax, eax
je 0x1400749e1
mov eax, dword [rsp + 0x34]
cmp rbx, rax
jb 0x1400749e1
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov r8, rsi
mov edx, 2
call rdi
jmp 0x1400749dc
Function at 0x1400800d0
Capabilities:
Get hostname

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
movsxd rbx, edx
mov rsi, rcx
mov byte [rcx], 0
mov edx, ebx
call qword [sym.imp.WS2_32.dll_gethostname]
mov byte [rsi + rbx - 1], 0
mov edi, eax
test eax, eax
jne 0x140080108
mov edx, 0x2e
mov rcx, rsi
call sym.strchr
test rax, rax
je 0x140080108
mov byte [rax], 0
mov eax, edi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140080120
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov r9d, 1
mov rsi, rcx
mov rbx, rdx
mov rbp, r8
xor edx, edx
xor r8d, r8d
mov dword [rsp + 0x4c], 8
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140080170
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor eax, eax
mov edx, 0x208
movzx r8d, byte [rbp + 1]
movzx r9d, byte [rbp + 2]
mov word [rsp + 0x62], ax
movzx r10d, byte [rbp + 3]
lea rdi, [rsp + 0x60]
movzx r11d, byte [rbp + 4]
movzx r12d, byte [rbp + 5]
mov word [rsp + 0x60], dx
mov rax, qword [0x140104ad0]
movzx edx, byte [rbp]
mov qword [rsp + 0x64], rax
mov ecx, edx
movzx eax, byte [rbp + 6]
mov ebp, r8d
shr bpl, 1
shl ecx, 7
or ecx, ebp
mov ebp, r9d
shl r8d, 6
shr bpl, 2
shl r9d, 5
movzx ecx, cl
or r8d, ebp
mov ebp, r10d
shl r10d, 4
shr bpl, 3
movzx r8d, r8b
or r9d, ebp
mov ebp, r11d
shl r11d, 3
shr bpl, 4
movzx r9d, r9b
or r10d, ebp
mov ebp, r12d
shl r12d, 2
shr bpl, 5
movzx r10d, r10b
or r11d, ebp
mov ebp, eax
add eax, eax
shr bpl, 6
movzx eax, al
movzx r11d, r11b
or r12d, ebp
shl rax, 8
movzx r12d, r12b
or rax, r12
shl rax, 8
or rax, r11
shl rax, 8
or rax, r10
shl rax, 8
or rax, r9
shl rax, 8
or rax, r8
shl rax, 8
or rax, rcx
lea rcx, [rsp + 0x6c]
shl rax, 8
or rax, rdx
mov edx, 8
mov qword [rsp + 0x6c], rax
call sym.Curl_des_set_odd_parity
lea rax, [rsp + 0x58]
xor r9d, r9d
mov rdx, rdi
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x50]
mov r8d, 0x14
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x1400802ce
mov rax, qword [rsi]
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rbx], rax
mov eax, dword [rsp + 0x4c]
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
nop
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400802f0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rbx, r8
mov rdi, rcx
mov r8, rcx
mov rdx, rbx
mov rcx, rsi
call sym.encrypt_des.isra.0
lea rdx, [rbx + 8]
lea r8, [rdi + 7]
mov rcx, rsi
call sym.encrypt_des.isra.0
lea rdx, [rbx + 0x10]
lea r8, [rdi + 0xe]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.encrypt_des.isra.0
Function at 0x140083060
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [rcx + 0x18]
mov rsi, rdx
lea edx, [rax + rax]
mov eax, dword [rcx + 0x20]
mov rbx, rcx
mov r12d, r8d
lea rcx, [rdx + rax + 0x18]
mov rax, qword [0x14011e810]
call qword [rax]
mov rdi, rax
test rax, rax
je 0x14008315c
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rdi + 0x10], rax
cmp dword [rbx + 0x1c], r12d
jb 0x140083170
call qword [rbx]
mov ebp, r12d
mov rcx, qword [rdi + 0x10]
call qword [rbx]
test r12d, r12d
je 0x1400831a0
lea r13, [rsi + rbp]
lea r12, [rsp + 0x2f]
nop dword [rax]
movzx eax, byte [rsi]
add rsi, 1
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r8d, 1
xor eax, 0x36
mov byte [rsp + 0x2f], al
call qword [rbx + 8]
movzx eax, byte [rsi - 1]
mov rcx, qword [rdi + 0x10]
mov rdx, r12
mov r8d, 1
xor eax, 0x5c
mov byte [rsp + 0x2f], al
call qword [rbx + 8]
cmp r13, rsi
jne 0x1400830d8
mov eax, dword [rbx + 0x1c]
cmp rbp, rax
jae 0x14008315c
lea r12, [0x140104d81]
lea rsi, [0x140104d80]
nop dword [rax]
mov rcx, qword [rdi + 8]
mov r8d, 1
mov rdx, r12
add rbp, 1
call qword [rbx + 8]
mov rcx, qword [rdi + 0x10]
mov r8d, 1
mov rdx, rsi
call qword [rbx + 8]
mov eax, dword [rbx + 0x1c]
cmp rbp, rax
jb 0x140083130
mov rax, rdi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [rbx]
mov r8d, r12d
mov rdx, rsi
mov rcx, qword [rdi + 8]
call qword [rbx + 8]
mov esi, dword [rbx + 0x18]
add rsi, qword [rdi + 0x10]
mov rcx, rsi
mov rdx, qword [rdi + 8]
call qword [rbx + 0x10]
mov r12d, dword [rbx + 0x20]
mov rcx, qword [rdi + 8]
jmp 0x1400830b7
xor ebp, ebp
jmp 0x140083116
Function at 0x140083a80
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
pxor xmm0, xmm0
mov r9d, 1
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
xor edx, edx
xor r8d, r8d
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140083ad0
mov eax, 2
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0x8002
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140083bb0
mov rcx, rbx
call sym.curlx_uztoui
mov rdx, rsi
lea rsi, [rsp + 0x3c]
xor r9d, r9d
mov rcx, qword [rsp + 0x48]
mov r8d, eax
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
mov r9, rsi
mov dword [rsp + 0x3c], 0
mov rbx, qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, 2
mov dword [rsp + 0x20], 0
call rbx
cmp dword [rsp + 0x3c], 0x10
je 0x140083b90
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x140083b80
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x140083b70
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x140083b5f
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x140083b53
mov rcx, qword [rsp + 0x48]
mov r9, rsi
mov r8, rdi
mov edx, 2
mov dword [rsp + 0x20], 0
call rbx
jmp 0x140083b49
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x140083abb

Function at 0x140083c80
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push rbx
sub rsp, 0x30
xor edx, edx
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000040
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov edx, eax
mov eax, 0x1b
test edx, edx
je 0x140083cd1
lea rax, [rbx + 8]
mov rcx, qword [rbx]
mov edx, 0x8003
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov edx, eax
xor eax, eax
test edx, edx
je 0x140083ce0
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov qword [rbx], 0
mov eax, 2
jmp 0x140083cd1
Function at 0x140083d00
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000040
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
xor edx, edx
lea rcx, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov edx, eax
mov eax, 0x1b
test edx, edx
je 0x140083dcc
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140083e10
mov rcx, rbx
call sym.curlx_uztoui
mov rdx, rsi
lea rsi, [rsp + 0x3c]
xor r9d, r9d
mov rcx, qword [rsp + 0x48]
mov r8d, eax
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
mov r9, rsi
mov dword [rsp + 0x3c], 0
mov rbx, qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, 2
mov dword [rsp + 0x20], 0
call rbx
cmp dword [rsp + 0x3c], 0x10
je 0x140083dd8
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x140083e08
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x140083df8
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
mov rcx, qword [rsp + 0x48]
mov r9, rsi
mov r8, rdi
mov edx, 2
mov dword [rsp + 0x20], 0
call rbx
jmp 0x140083db6
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x140083dcc
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x140083dc0
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
jmp 0x140083dcc
Function at 0x140084e50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
movaps xmmword [rsp], xmm6
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x60], xmm12
mov r8, rcx
mov r10, rdx
test rdx, rdx
je 0x140085023
lea rax, [rdx - 1]
cmp rax, 0xe
jbe 0x14008504f
mov rax, rcx
mov rcx, rdx
movdqa xmm10, xmmword [str._a_a_a_a_a_a_a_a_a_a_a_a_a_a_a_a]
movdqa xmm9, xmmword [0x140105020]
and rcx, 0xfffffffffffffff0
movdqa xmm2, xmmword [0x140105030]
movdqa xmm8, xmmword [0x140105040]
pxor xmm3, xmm3
movdqa xmm7, xmmword [0x140105050]
movdqa xmm6, xmmword [str.________________]
lea rdx, [r8 + rcx]
movdqa xmm5, xmmword [0x140105070]
movdqa xmm4, xmmword [0x140105080]
nop dword [rax]
movdqu xmm1, xmmword [rax]
add rax, 0x10
movdqa xmm0, xmm1
movdqa xmm11, xmm1
movdqa xmm12, xmm1
psrlw xmm0, 5
psrlw xmm11, 4
pand xmm11, xmm9
psrlw xmm12, 6
pand xmm0, xmm10
pxor xmm0, xmm11
movdqa xmm11, xmm1
pand xmm12, xmm8
psrlw xmm11, 7
pand xmm11, xmm2
pxor xmm11, xmm12
movdqa xmm12, xmm1
pxor xmm0, xmm11
psrlw xmm12, 2
movdqa xmm11, xmm1
psrlw xmm11, 3
pand xmm12, xmm6
pand xmm11, xmm7
pxor xmm11, xmm12
movdqa xmm12, xmm1
psrlw xmm12, 1
pand xmm12, xmm5
pxor xmm11, xmm12
pxor xmm0, xmm11
movdqa xmm11, xmm1
pand xmm1, xmm4
pand xmm0, xmm2
por xmm11, xmm2
pcmpeqb xmm0, xmm3
pand xmm11, xmm0
pandn xmm0, xmm1
por xmm0, xmm11
movups xmmword [rax - 0x10], xmm0
cmp rdx, rax
jne 0x140084ef0
cmp rcx, r10
je 0x140085023
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
mov edx, eax
mov r9d, eax
shr r9b, 6
shr dl, 7
xor edx, r9d
mov r9d, eax
shr r9b, 5
xor edx, r9d
mov r9d, eax
shr r9b, 4
xor edx, r9d
mov r9d, eax
shr r9b, 3
xor edx, r9d
mov r9d, eax
shr r9b, 2
xor edx, r9d
mov r9d, eax
shr r9b, 1
xor edx, r9d
mov r9d, eax
or eax, 1
and r9d, 0xfffffffe
and edx, 1
cmovne eax, r9d
mov byte [r8 + rcx], al
add rcx, 1
cmp rcx, r10
jb 0x140084fc0
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
add rsp, 0x78
ret
xor ecx, ecx
jmp 0x140084fc0

Function at 0x14008d180
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r8d, 0x1000
mov edx, 1
mov rbx, qword [rcx + 0x28]
mov r9, qword [rbx + 0x28]
mov rsi, rcx
mov rcx, qword [rbx + 0x30]
call sym.fwrite
cmp rax, 0x1000
je 0x14008d1bc
mov rax, qword [rsi]
mov rcx, rsi
mov dword [rax + 0x28], 0x25
call qword [rax]
mov rax, qword [rbx + 0x30]
mov qword [rbx + 8], 0x1000
mov qword [rbx], rax
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x14008d280
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r8d, 0x1000
mov rdi, r8
mov rbx, qword [rcx + 0x28]
mov rsi, rcx
mov rcx, qword [rbx + 0x28]
sub rdi, qword [rbx + 8]
jne 0x14008d2e0
call sym.fflush
mov rcx, qword [rbx + 0x28]
call sym.ferror
test eax, eax
je 0x14008d2d0
mov rax, qword [rsi]
mov rcx, rsi
mov dword [rax + 0x28], 0x25
mov rax, qword [rax]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov r9, rcx
mov rcx, qword [rbx + 0x30]
mov r8, rdi
mov edx, 1
call sym.fwrite
cmp rax, rdi
je 0x14008d308
mov rax, qword [rsi]
mov rcx, rsi
mov dword [rax + 0x28], 0x25
call qword [rax]
mov rcx, qword [rbx + 0x28]
jmp 0x14008d2a1

Function at 0x14008eb20
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x58
mov qword [rcx + 8], 0
mov rsi, rcx
call sym.jpeg_mem_init
mov edx, 0xa0
mov rcx, rsi
mov dword [rsp + 0x2c], eax
call sym.jpeg_get_small
mov rbx, rax
test rax, rax
je 0x14008ecf0
lea rax, [sym.alloc_large]
lea rdx, [sym.alloc_small]
mov dword [rbx + 0x5c], 0x3b9aca00
movq xmm1, rax
movq xmm0, rdx
lea rax, [sym.alloc_barray]
mov qword [rbx + 0x90], 0xa0
punpcklqdq xmm0, xmm1
lea rdx, [sym.alloc_sarray]
movq xmm2, rax
movups xmmword [rbx], xmm0
movq xmm0, rdx
lea rax, [sym.request_virt_barray]
lea rdx, [sym.request_virt_sarray]
punpcklqdq xmm0, xmm2
movq xmm3, rax
lea rax, [sym.access_virt_sarray]
movups xmmword [rbx + 0x10], xmm0
movq xmm0, rdx
movq xmm4, rax
lea rdx, [sym.realize_virt_arrays]
punpcklqdq xmm0, xmm3
lea rax, [sym.free_pool]
lea rcx, str.JPEGMEM
mov qword [rsp + 0x30], 0
movups xmmword [rbx + 0x20], xmm0
movq xmm0, rdx
lea rdx, [sym.access_virt_barray]
movq xmm5, rax
punpcklqdq xmm0, xmm4
lea rax, [sym.self_destruct]
mov qword [rsp + 0x38], 0
movups xmmword [rbx + 0x30], xmm0
movq xmm0, rdx
mov qword [rbx + 0x50], rax
punpcklqdq xmm0, xmm5
mov eax, dword [rsp + 0x2c]
movups xmmword [rbx + 0x40], xmm0
pxor xmm0, xmm0
mov dword [rbx + 0x58], eax
movups xmmword [rbx + 0x60], xmm0
movups xmmword [rbx + 0x70], xmm0
movups xmmword [rbx + 0x80], xmm0
mov qword [rsi + 8], rbx
mov qword [rsp + 0x3e], 0
mov qword [rsp + 0x46], 0
call sym.getenv
mov rsi, rax
test rax, rax
je 0x14008ec94
mov rcx, rax
call sym.strlen
add rax, 1
cmp rax, 0x1e
ja 0x14008ec94
lea rcx, [rsp + 0x30]
mov r8d, 0x1e
mov rdx, rsi
call sym.strncpy
cmp byte [rsp + 0x30], 0
mov rcx, rax
jne 0x14008eca0
add rsp, 0x58
pop rbx
pop rsi
ret
lea r9, [rsp + 0x2b]
lea r8, [rsp + 0x2c]
mov byte [rsp + 0x2b], 0x78
lea rdx, str._ld_c
call sym.sscanf.constprop.0_3
test eax, eax
jle 0x14008ec94
movzx edx, byte [rsp + 0x2b]
mov eax, dword [rsp + 0x2c]
and edx, 0xffffffdf
cmp dl, 0x4d
jne 0x14008ecd6
imul eax, eax, 0x3e8
imul eax, eax, 0x3e8
mov dword [rbx + 0x58], eax
add rsp, 0x58
pop rbx
pop rsi
ret
mov rcx, rsi
call sym.jpeg_mem_term
mov rax, qword [rsi]
mov rcx, rsi
mov qword [rax + 0x28], 0x36
call qword [rax]
jmp 0x14008eb53
Function at 0x14009d400
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x18
mov r11, rcx
mov rcx, rdx
mov r10, r8
mov rax, qword [r11 + 0x1a0]
mov edi, dword [r11 + 0x30]
cmp byte [rax + 0x1a], 1
sbb eax, eax
and eax, 7
add eax, 1
imul eax, dword [rdx + 0x1c]
mov edx, eax
lea ebx, [rdx + rdx]
sub ebx, edi
test ebx, ebx
jle 0x14009d55e
movsxd rax, dword [r11 + 0x12c]
test eax, eax
jle 0x14009d55e
lea r14, [r8 + rax*8]
mov eax, ebx
mov esi, ebx
mov dword [rsp + 0xc], edx
and eax, 0xfffffff8
mov qword [rsp + 0x68], rcx
shr esi, 3
mov ebp, ebx
mov dword [rsp + 8], eax
lea r13, [rdi + rdi]
shl rsi, 4
lea r15, [rax + rax]
mov qword [rsp + 0x70], r8
and ebp, 7
mov qword [rsp + 0x78], r9
nop dword [rax + rax]
mov r11, qword [r8]
lea rax, [r11 + r13]
movzx r9d, word [rax - 2]
cmp ebx, 7
jle 0x14009d5ec
movd xmm0, r9d
mov rdx, rax
lea rcx, [rax + rsi]
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
movdqa xmm1, xmm0
test sil, 0x10
je 0x14009d4d0
lea rdx, [rax + 0x10]
movups xmmword [rax], xmm0
cmp rcx, rdx
je 0x14009d4e0
movups xmmword [rdx], xmm1
add rdx, 0x20
movups xmmword [rdx - 0x10], xmm1
cmp rcx, rdx
jne 0x14009d4d0
test ebp, ebp
je 0x14009d5ce
mov edx, dword [rsp + 8]
add rax, r15
mov r10d, ebp
mov ecx, ebx
sub ecx, edx
lea r12d, [rcx - 1]
cmp r12d, 2
jbe 0x14009d524
movd xmm3, r9d
add rdx, rdi
pshuflw xmm2, xmm3, 0
movq qword [r11 + rdx*2], xmm2
test cl, 3
je 0x14009d53e
and ecx, 0xfffffffc
mov edx, ecx
sub r10d, ecx
lea rax, [rax + rdx*2]
mov word [rax], r9w
cmp r10d, 1
je 0x14009d53e
mov word [rax + 2], r9w
cmp r10d, 2
je 0x14009d53e
mov word [rax + 4], r9w
add r8, 8
cmp r8, r14
jne 0x14009d490
mov edx, dword [rsp + 0xc]
mov rcx, qword [rsp + 0x68]
mov r10, qword [rsp + 0x70]
mov r9, qword [rsp + 0x78]
movsxd rax, dword [rcx + 0xc]
test eax, eax
jle 0x14009d5bd
test edx, edx
je 0x14009d5bd
lea rbp, [rax*8]
lea rdi, [rdx*4]
xor esi, esi
nop dword [rax]
mov rdx, qword [r10 + rsi]
mov r8, qword [r9 + rsi]
xor ecx, ecx
lea rbx, [rdx + rdi]
nop
movsx eax, word [rdx]
movsx r11d, word [rdx + 2]
add r8, 2
add rdx, 4
add eax, r11d
add eax, ecx
xor ecx, 1
sar eax, 1
mov word [r8 - 2], ax
cmp rdx, rbx
jne 0x14009d590
add rsi, 8
cmp rbp, rsi
jne 0x14009d580
add rsp, 0x18
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
add r8, 8
cmp r8, r14
je 0x14009d54b
mov r11, qword [r8]
lea rax, [r11 + r13]
movzx r9d, word [rax - 2]
jmp 0x14009d4a5
mov r10d, ebx
xor edx, edx
jmp 0x14009d4f2
Function at 0x14009d600
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x18
mov r11, rcx
mov rcx, rdx
mov r10, r8
mov rax, qword [r11 + 0x1a0]
mov edi, dword [r11 + 0x30]
cmp byte [rax + 0x1a], 1
sbb eax, eax
and eax, 7
add eax, 1
imul eax, dword [rdx + 0x1c]
mov edx, eax
lea ebx, [rdx + rdx]
sub ebx, edi
test ebx, ebx
jle 0x14009d75e
movsxd rax, dword [r11 + 0x12c]
test eax, eax
jle 0x14009d75e
lea r14, [r8 + rax*8]
mov eax, ebx
mov esi, ebx
mov dword [rsp + 0xc], edx
and eax, 0xfffffff8
mov qword [rsp + 0x68], rcx
shr esi, 3
mov ebp, ebx
mov dword [rsp + 8], eax
lea r13, [rdi + rdi]
shl rsi, 4
lea r15, [rax + rax]
mov qword [rsp + 0x70], r8
and ebp, 7
mov qword [rsp + 0x78], r9
nop dword [rax + rax]
mov r11, qword [r8]
lea rax, [r11 + r13]
movzx r9d, word [rax - 2]
cmp ebx, 7
jle 0x14009d7fc
movd xmm0, r9d
mov rdx, rax
lea rcx, [rsi + rax]
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
movdqa xmm1, xmm0
test sil, 0x10
je 0x14009d6d0
lea rdx, [rax + 0x10]
movups xmmword [rax], xmm0
cmp rcx, rdx
je 0x14009d6e0
movups xmmword [rdx], xmm1
add rdx, 0x20
movups xmmword [rdx - 0x10], xmm1
cmp rcx, rdx
jne 0x14009d6d0
test ebp, ebp
je 0x14009d7de
mov edx, dword [rsp + 8]
add rax, r15
mov r10d, ebp
mov ecx, ebx
sub ecx, edx
lea r12d, [rcx - 1]
cmp r12d, 2
jbe 0x14009d724
movd xmm3, r9d
add rdx, rdi
pshuflw xmm2, xmm3, 0
movq qword [r11 + rdx*2], xmm2
test cl, 3
je 0x14009d73e
and ecx, 0xfffffffc
mov edx, ecx
sub r10d, ecx
lea rax, [rax + rdx*2]
mov word [rax], r9w
cmp r10d, 1
je 0x14009d73e
mov word [rax + 2], r9w
cmp r10d, 2
je 0x14009d73e
mov word [rax + 4], r9w
add r8, 8
cmp r8, r14
jne 0x14009d690
mov edx, dword [rsp + 0xc]
mov rcx, qword [rsp + 0x68]
mov r10, qword [rsp + 0x70]
mov r9, qword [rsp + 0x78]
movsxd rax, dword [rcx + 0xc]
test eax, eax
jle 0x14009d7cd
test edx, edx
je 0x14009d7cd
lea rdi, [rax + rax]
lea rsi, [rdx + rdx]
xor ebp, ebp
nop dword [rax]
mov rbx, qword [r9 + rbp*4]
mov r11, qword [r10 + rbp*8]
xor edx, edx
mov ecx, 1
mov r8, qword [r10 + rbp*8 + 8]
nop dword [rax]
movsx r12d, word [r11 + rdx*2 + 2]
movsx eax, word [r11 + rdx*2]
add eax, r12d
movsx r12d, word [r8 + rdx*2]
add eax, r12d
movsx r12d, word [r8 + rdx*2 + 2]
add eax, r12d
add eax, ecx
xor ecx, 3
sar eax, 2
mov word [rbx + rdx], ax
add rdx, 2
cmp rdx, rsi
jne 0x14009d790
add rbp, 2
cmp rbp, rdi
jne 0x14009d778
add rsp, 0x18
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
add r8, 8
cmp r8, r14
je 0x14009d74b
mov r11, qword [r8]
lea rax, [r11 + r13]
movzx r9d, word [rax - 2]
jmp 0x14009d6a5
mov r10d, ebx
xor edx, edx
jmp 0x14009d6f2