joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e9cd0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
lea rcx, str.RANDFILE
call qword [sym.imp.MSVCR120.dll_getenv]
xor edi, edi
mov ebx, 0x4000
test rax, rax
je 0x1400e9d4a
cmp byte [rax], dil
je 0x1400e9d4a
mov rdx, rax
mov ecx, edi
cmp ecx, 0x80000000
jae 0x1400e9d17
inc rdx
inc ecx
cmp byte [rdx], dil
jne 0x1400e9d05
btr ecx, 0x1f
inc ecx
cmp ecx, ebx
jae 0x1400e9d4a
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.1400f50b0
cmp rax, rbx
jb 0x1400e9e9d
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rcx, str.HOME
call qword [sym.imp.MSVCR120.dll_getenv]
lea rdx, [0x140268f0c]
test rax, rax
cmovne rdx, rax
cmp byte [rdx], dil
je 0x1400e9e9a
mov rcx, rdx
mov eax, edi
cmp eax, 0x80000000
jae 0x1400e9d84
inc rcx
inc eax
cmp byte [rcx], dil
jne 0x1400e9d73
mov ecx, edi
lea r8, [0x14027318c]
cmp byte [0x14027318c], cl
je 0x1400e9da7
cmp ecx, 0x80000000
jae 0x1400e9da7
inc r8
inc ecx
cmp byte [r8], dil
jne 0x1400e9d95
btr eax, 0x1f
btr ecx, 0x1f
add eax, 2
add eax, ecx
cmp eax, ebx
jae 0x1400e9e9a
mov r8, rbx
mov rcx, rsi
call fcn.1400f50b0
mov r11, rbx
mov rcx, rsi
nop dword [rax]
cmp byte [rcx], dil
je 0x1400e9ddd
inc rcx
dec r11
jne 0x1400e9dd0
lea rax, [0x140268f2c]
cmp r11, 1
jbe 0x1400e9e08
nop word [rax + rax]
movzx edx, byte [rax]
test dl, dl
je 0x1400e9e08
dec r11
mov byte [rcx], dl
inc rcx
inc rax
cmp r11, 1
ja 0x1400e9df0
test r11, r11
je 0x1400e9e10
mov byte [rcx], dil
mov ecx, edi
cmp byte [rax], cl
je 0x1400e9e28
cmp ecx, 0x80000000
jae 0x1400e9e28
inc rax
inc ecx
cmp byte [rax], dil
jne 0x1400e9e16
mov rcx, rsi
nop dword [rax + rax]
cmp byte [rcx], dil
je 0x1400e9e3d
inc rcx
dec rbx
jne 0x1400e9e30
lea rax, str..rnd
cmp rbx, 1
jbe 0x1400e9e68
nop word [rax + rax]
movzx edx, byte [rax]
test dl, dl
je 0x1400e9e68
dec rbx
mov byte [rcx], dl
inc rcx
inc rax
cmp rbx, 1
ja 0x1400e9e50
test rbx, rbx
je 0x1400e9e70
mov byte [rcx], dil
cmp byte [rax], dil
je 0x1400e9e9d
cmp edi, 0x80000000
jae 0x1400e9e9d
inc rax
inc edi
cmp byte [rax], 0
jne 0x1400e9e75
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov byte [rsi], dil
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400f4e20
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
mov r9, rcx
test rcx, rcx
je 0x1400f4e7a
movzx eax, byte [rcx]
test al, al
je 0x1400f4e7a
mov r10d, 0x100
nop word [rax + rax]
movsx r8d, al
lea r9, [r9 + 1]
or r8d, r10d
add r10d, 0x100
mov eax, r8d
shr eax, 2
xor eax, r8d
and eax, 0xf
movzx ecx, al
movzx eax, byte [r9]
imul r8d, r8d
rol edx, cl
xor edx, r8d
test al, al
jne 0x1400f4e40
mov eax, edx
shr eax, 0x10
xor eax, edx
ret
xor eax, eax
ret

Function at 0x1400f71e0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp dword [0x1402eaea8], 0
jne 0x1400f729b
lea rcx, str.OPENSSL_ia32cap
mov dword [0x1402eaea8], 1
call qword [sym.imp.MSVCR120.dll_getenv]
test rax, rax
je 0x1400f727d
mov qword [rsp + 0x38], rbx
xor ebx, ebx
cmp byte [rax], 0x7e
sete bl
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x30]
movsxd rdi, ebx
lea rdx, str._I64i
add rdi, rax
mov rcx, rdi
call qword [sym.imp.MSVCR120.dll_sscanf]
test eax, eax
jne 0x1400f7255
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.MSVCR120.dll_strtoul]
mov edx, eax
mov qword [rsp + 0x30], rdx
jmp 0x1400f725a
mov rdx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x20]
test ebx, ebx
mov rbx, qword [rsp + 0x38]
je 0x1400f7285
call fcn.140012a30
mov rdx, rax
mov rax, qword [rsp + 0x30]
not rax
and rdx, rax
jmp 0x1400f7285
call fcn.140012a30
mov rdx, rax
mov ecx, edx
bts ecx, 0xa
shr rdx, 0x20
mov dword [0x1402ed43c], edx
mov dword [0x1402ed438], ecx
add rsp, 0x28
ret

Function at 0x1400f7420
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x170
mov rax, qword [0x140264330]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
je 0x1400f7493
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x1400f7493
lea rbx, [rsp + 0x188]
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, qword [rsp + 0x180]
lea rcx, [rax + 0x60]
mov r8, rbx
call qword [sym.imp.MSVCR120.dll_vfprintf]
jmp 0x1400f753b
mov r8, qword [rsp + 0x180]
lea r9, [rsp + 0x188]
lea rcx, [rsp + 0x60]
mov edx, 0xff
call qword [sym.imp.MSVCR120.dll__vsnprintf]
mov byte [rsp + 0x15f], 0
call fcn.1400f72a0
xor ecx, ecx
test eax, eax
jle 0x1400f7523
lea rdx, str.OPENSSL
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
xor ecx, ecx
mov r9d, 1
mov qword [rsp + 0x40], rcx
mov rbx, rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov edx, r9d
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
mov word [rsp + 0x28], r9w
mov qword [rsp + 0x20], rcx
xor r8d, r8d
xor r9d, r9d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x1400f753b
lea r8, str.OpenSSL:_FATAL
lea rdx, [rsp + 0x60]
mov r9d, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1401bb2c0
add rsp, 0x170
pop rbx
ret
Function at 0x140102cc0
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, rcx
mov edx, 0x11d0
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 1]
mov r9d, setsockopt
mov qword [rsp + 0x28], rcx
mov rcx, rbx
mov dword [rsp + 0x20], 0x40
call qword [rax + 0x60]
cmp dword [rsp + 0x50], 0
mov edx, eax
je 0x140102de7
mov rax, qword [rbx + 0x80]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
cmp dword [rax + 0x1c8], 0
jne 0x140102d3e
mov edi, 0xa
mov dword [rsp + 0x20], 0x103
lea r9, [0x1402828c0]
mov r8d, 0x9a
jmp 0x140102dbe
mov dword [rax + 0x1c8], 0
mov r9, qword [rbx + 0x80]
mov rcx, qword [rbx + 0x58]
movsxd rdi, dword [r9 + 0x394]
cmp edi, edx
je 0x140102d78
mov edi, 0x32
mov dword [rsp + 0x20], 0x10e
lea r9, [0x1402828e8]
lea r8d, [rdi + 0x3d]
jmp 0x140102dbe
xor dl, dl
test edi, edi
je 0x140102ded
lea r10, [r9 + 0x314]
mov r8, rdi
sub r10, rcx
nop dword [rax + rax]
movzx eax, byte [r10 + rcx]
lea rcx, [rcx + 1]
xor al, byte [rcx - 1]
or dl, al
dec r8
jne 0x140102d90
test dl, dl
je 0x140102ded
lea edi, [r8 + 0x33]
mov dword [rsp + 0x20], 0x115
lea r9, [0x140282910]
lea r8d, [rdi + 0x62]
mov edx, 0x8c
lea ecx, [rdx - 0x78]
call fcn.1400dabf0
mov r8d, edi
mov edx, 2
mov rcx, rbx
call fcn.1400ff9d0
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rbx
ret
cmp dword [rbx + 4], 0x2000
jne 0x140102e6b
cmp edi, 0x40
jg 0x140102e34
lea rcx, [r9 + 0x418]
lea rdx, [r9 + 0x314]
mov r8, rdi
call sub.MSVCR120.dll_memcpy
mov rax, qword [rbx + 0x80]
mov rsi, qword [rsp + 0x40]
mov byte [rax + 0x458], dil
mov rdi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rbx
ret
lea r9, [0x140282938]
lea rdx, [0x140282950]
lea rcx, str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
mov r8d, 0x11d
call fcn.1400f7420
mov ecx, reloc.WS2_32.dll_shutdown
call qword [sym.imp.MSVCR120.dll_raise]
mov ecx, 3
call qword [sym.imp.MSVCR120.dll__exit]
int3
cmp edi, 0x40
jg 0x140102ea9
lea rcx, [r9 + 0x459]
lea rdx, [r9 + 0x314]
mov r8, rdi
call sub.MSVCR120.dll_memcpy
mov rax, qword [rbx + 0x80]
mov rsi, qword [rsp + 0x40]
mov byte [rax + 0x499], dil
mov rdi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rbx
ret
lea r9, str.i___EVP_MAX_MD_SIZE
lea rdx, [0x140282990]
lea rcx, str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
mov r8d, 0x124
call fcn.1400f7420
mov ecx, reloc.WS2_32.dll_shutdown
call qword [sym.imp.MSVCR120.dll_raise]
mov ecx, 3
call qword [sym.imp.MSVCR120.dll__exit]
int3
Function at 0x140122a30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
cmp dword [rcx + 0x48], 0x1060
mov rax, qword [rcx + 0x50]
mov rbx, rcx
mov rdi, qword [rax + 8]
jne 0x140122b51
movsxd rax, dword [rcx + 0x60]
mov r8d, 1
xor r9d, r9d
lea rdx, [rdi + rax]
sub r8d, eax
call fcn.14015bcf0
mov edx, dword [rbx + 0x60]
mov ecx, eax
mov eax, 1
sub eax, edx
cmp ecx, eax
jge 0x140122a95
mov r8d, ecx
mov edx, WSASetLastError
mov rcx, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
jmp fcn.14015c820
lea eax, [rdx + rcx]
mov dword [rbx + 0x48], 0x1061
mov dword [rbx + 0x60], eax
movzx eax, byte [rdi]
cmp al, 5
je 0x140122b51
test al, al
je 0x140122afb
cmp dword [rbx + 0x158], 0
jne 0x140122acd
mov rcx, rbx
mov qword [rbx + 0x158], 3
call fcn.140123a50
mov edx, WSASetLastError
lea r9, [0x14028d740]
mov dword [rsp + 0x20], 0x397
lea ecx, [rdx - 0x5a]
lea r8d, [rdx + 0x66]
call fcn.1400dabf0
or eax, 0xffffffff
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov edx, WSASetLastError
lea r9, [0x14028d7b8]
mov dword [rsp + 0x20], 0x39b
lea ecx, [rdx - 0x5a]
lea r8d, [rdx + 0x5a]
call fcn.1400dabf0
movsxd rax, dword [rbx + 0x60]
mov r8d, 3
lea rdx, [rdi + rax]
xor r9d, r9d
mov rcx, rbx
sub r8d, eax
call fcn.14015bcf0
mov edx, WSASetLastError
mov rcx, rbx
mov r8d, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
jmp fcn.14015c820
mov rax, qword [rbx + 0x50]
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov rsi, qword [rax + 8]
mov rax, qword [rbx + 0x78]
xor r9d, r9d
mov ebp, dword [rax + 0x90]
movsxd rax, dword [rbx + 0x60]
mov rcx, rbx
inc ebp
lea rdx, [rsi + rax]
mov edi, ebp
sub edi, eax
mov r8d, edi
call fcn.14015bcf0
cmp eax, edi
jge 0x140122ba2
mov r8d, eax
mov edx, WSASetLastError
mov rcx, rbx
call fcn.14015c820
jmp 0x140122c5d
mov r10, qword [rbx + 0x98]
test r10, r10
je 0x140122bd4
mov rax, qword [rbx + 0xa0]
mov edx, dword [rbx]
movsxd rcx, ebp
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
mov r9, rsi
xor r8d, r8d
call r10
mov rax, qword [rbx + 0x78]
xor dl, dl
lea rcx, [rsi + 1]
mov r8d, dword [rax + 0x90]
lea r9, [rax + 0x94]
test r8, r8
je 0x140122c58
sub r9, rcx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r9 + rcx]
lea rcx, [rcx + 1]
xor al, byte [rcx - 1]
or dl, al
dec r8
jne 0x140122c00
test dl, dl
je 0x140122c58
cmp dword [rbx + 0x158], r8d
jne 0x140122c33
mov rcx, rbx
mov qword [rbx + 0x158], 3
call fcn.140123a50
mov edx, WSASetLastError
lea r9, [0x14028d790]
mov dword [rsp + 0x20], 0x3b1
lea ecx, [rdx - 0x5a]
lea r8d, [rdx + 0x1a]
call fcn.1400dabf0
or eax, 0xffffffff
jmp 0x140122c5d
mov eax, 1
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140127920
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 8
xor r11d, r11d
mov r9d, r8d
test r8d, r8d
jle 0x140127a19
mov qword [rsp], rbx
lea r10, [rdx + 1]
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx edx, byte [r10 - 1]
cmp r9d, 3
jl 0x1401279a0
movzx eax, byte [r10]
shl edx, 8
or edx, eax
movzx eax, byte [r10 + 1]
shl edx, 8
or edx, eax
mov eax, edx
mov r8d, edx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx], al
mov eax, edx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx + 1], al
mov eax, edx
shr rax, 6
and eax, 0x3f
and r8d, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx + 2], al
movzx eax, byte [r8 + rbx]
mov byte [rcx + 3], al
jmp 0x1401279f1
shl edx, 0x10
cmp r9d, 2
jne 0x1401279b2
movzx eax, byte [r10]
shl eax, 8
or edx, eax
mov rax, rdx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx], al
mov rax, rdx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx + 1], al
cmp r9d, 1
jne 0x1401279df
lea eax, [r9 + 0x3c]
jmp 0x1401279ea
shr rdx, 6
and edx, 0x3f
movzx eax, byte [rdx + rbx]
mov byte [rcx + 2], al
mov byte [rcx + 3], 0x3d
sub r9d, 3
add rcx, 4
add r11d, 4
add r10, 3
test r9d, r9d
jg 0x140127942
mov rbx, qword [rsp]
mov byte [rcx], 0
mov eax, r11d
add rsp, 8
ret
mov byte [rcx], r11b
mov eax, r11d
add rsp, 8
ret
Function at 0x140128260
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0xb8
mov rax, qword [0x140264330]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r12, qword [rsp + 0x110]
xor ebx, ebx
mov rbp, r9
movsxd rsi, r8d
mov r14, rdx
mov rdi, rcx
mov eax, ebx
test r9, r9
je 0x1401282a7
lea eax, [rbx + 1]
mov qword [rcx], r9
jmp 0x1401282aa
mov rbp, qword [rcx]
mov qword [rsp + 0xb0], r15
test rdx, rdx
je 0x1401283d9
mov eax, dword [rbp + 0x5c]
cmp eax, 0x80
jg 0x1401283a2
cmp eax, esi
jge 0x14012831d
mov r8, r12
mov rdx, rbp
add rcx, 8
call fcn.1400fc3e0
test eax, eax
je 0x1401284b2
lea rcx, [rdi + 8]
mov r8, rsi
mov rdx, r14
call qword [rdi + 0x30]
test eax, eax
je 0x1401284b2
lea r14, [rdi + 0x98]
lea rdx, [rdi + 0x9c]
lea rcx, [rdi + 8]
mov r8, r14
call fcn.1400fc680
test eax, eax
je 0x1401284b2
jmp 0x14012833e
cmp esi, 0x80
ja 0x14012836b
mov r8, rsi
add rcx, 0x9c
call sub.MSVCR120.dll_memcpy
lea r14, [rdi + 0x98]
mov dword [r14], esi
mov ecx, dword [r14]
cmp ecx, 0x80
je 0x1401283e1
mov eax, ecx
mov r8d, 0x80
xor edx, edx
sub r8d, ecx
lea rcx, [rdi + 0x9c]
add rcx, rax
call sub.MSVCR120.dll_memset
jmp 0x1401283e1
lea r9, str.len_0__len__int_sizeof_ctx__key_
lea rdx, str.....opensslopensslcryptohmachmac.c
lea rcx, str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
mov r8d, 0x75
call fcn.1400f7420
mov ecx, reloc.WS2_32.dll_shutdown
call qword [sym.imp.MSVCR120.dll_raise]
mov ecx, 3
call qword [sym.imp.MSVCR120.dll__exit]
int3
lea r9, str.j____int_sizeof_ctx__key_
lea rdx, [0x140293d20]
lea rcx, str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
mov r8d, 0x68
call fcn.1400f7420
mov ecx, reloc.WS2_32.dll_shutdown
call qword [sym.imp.MSVCR120.dll_raise]
mov ecx, 3
call qword [sym.imp.MSVCR120.dll__exit]
int3
test eax, eax
je 0x1401284a1
lea rcx, [rsp + 0x20]
mov rax, rdi
mov rdx, rbx
sub rax, rcx
lea rsi, [rax + 0x9c]
lea r14, [rax + 0x9d]
nop dword [rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rsi + rcx]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x80
jl 0x140128400
lea rcx, [rdi + 0x38]
mov r8, r12
mov rdx, rbp
call fcn.1400fc3e0
test eax, eax
je 0x1401284b2
movsxd r8, dword [rbp + 0x5c]
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x38]
call qword [rdi + 0x60]
test eax, eax
je 0x1401284b2
nop
lea rcx, [rsp + 0x20]
add rcx, rbx
add rbx, 2
movzx eax, byte [rsi + rcx]
xor al, 0x5c
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x5c
mov byte [rcx + 1], al
cmp rbx, 0x80
jl 0x140128450
lea rcx, [rdi + 0x68]
mov r8, r12
mov rdx, rbp
call fcn.1400fc3e0
test eax, eax
je 0x1401284b2
movsxd r8, dword [rbp + 0x5c]
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x68]
call qword [rdi + 0x90]
test eax, eax
je 0x1401284b2
lea rdx, [rdi + 0x38]
lea rcx, [rdi + 8]
call fcn.1400fc730
test eax, eax
jne 0x1401284b6
xor eax, eax
jmp 0x1401284bb
mov eax, 1
mov r15, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1401bb2c0
add rsp, 0xb8
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140128c30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
xor r8d, r8d
lea r14, [0x140223bf8]
mov r13d, ecx
mov r11, r14
mov ebx, r8d
mov r10d, r8d
nop dword [rax]
cmp r10, 5
ja 0x140128c8b
mov eax, dword [r11]
shl eax, 0xa
test ecx, eax
je 0x140128c82
inc ebx
inc r10
add r11, 4
jmp 0x140128c70
mov ecx, dword [rsp + 0x120]
mov rsi, qword [rsp + 0x128]
mov r12, qword [rsp + 0x118]
mov eax, ecx
cdq
idiv ebx
cmp ebx, 1
movsxd rbx, dword [rsp + 0x138]
cmove ecx, r8d
mov r8, rbx
xor edx, edx
mov dword [rsp + 0x120], ecx
mov rcx, rsi
mov dword [rsp + 0x110], eax
call sub.MSVCR120.dll_memset
mov rdi, qword [rsp + 0x130]
xor r8d, r8d
lea r15, [0x1402eadb8]
mov ebp, r8d
cmp rbp, 5
ja 0x140128e7e
mov eax, dword [r14]
test eax, eax
je 0x140128cfc
mov rcx, qword [r15]
jmp 0x140128cff
mov rcx, r8
shl eax, 0xa
test r13d, eax
je 0x140128e44
test rcx, rcx
je 0x140128e54
mov eax, dword [rsp + 0x100]
mov r8d, dword [rsp + 0x120]
mov r9, qword [rsp + 0xc8]
mov dword [rsp + 0x70], ebx
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0xf8]
and r8d, 1
mov rdx, r12
add r8d, dword [rsp + 0x110]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0xf0]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xd0]
mov dword [rsp + 0x20], eax
call fcn.140128750
xor r8d, r8d
test eax, eax
je 0x140128e79
movsxd rax, dword [rsp + 0x110]
mov r9d, r8d
add r12, rax
test ebx, ebx
jle 0x140128e14
cmp ebx, 0x10
jb 0x140128e14
lea eax, [rbx - 1]
mov edx, r8d
movsxd rcx, eax
lea rax, [rcx + rdi]
lea r8, [rcx + rsi]
cmp rsi, rax
ja 0x140128dd1
cmp r8, rdi
jae 0x140128e11
mov eax, ebx
and eax, 0x8000000f
jge 0x140128de1
dec eax
or eax, 0xfffffff0
inc eax
mov ecx, ebx
sub ecx, eax
nop word [rax + rax]
movsxd rax, edx
add edx, 0x10
add r9, 0x10
movdqu xmm1, xmmword [rax + rdi]
movdqu xmm0, xmmword [rax + rsi]
pxor xmm1, xmm0
movdqu xmmword [rax + rsi], xmm1
cmp edx, ecx
jl 0x140128df0
xor r8d, r8d
cmp r9, rbx
jge 0x140128e44
mov r8, rdi
mov rdx, rbx
lea rax, [r9 + rsi]
sub r8, rsi
sub rdx, r9
nop dword [rax]
movzx ecx, byte [r8 + rax]
lea rax, [rax + 1]
xor byte [rax - 1], cl
dec rdx
jne 0x140128e30
xor r8d, r8d
inc rbp
add r14, 4
add r15, 8
jmp 0x140128ce6
mov edx, 0x11c
lea r9, [0x140293dc8]
mov ecx, setsockopt
lea r8d, [rdx + 0x2a]
mov dword [rsp + 0x20], 0x114
call fcn.1400dabf0
xor r8d, r8d
mov eax, r8d
jmp 0x140128e83
mov eax, 1
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401304b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, dword [rcx]
mov r11, rcx
lea ebx, [r9 + 1]
cmp eax, 0x302
jge 0x1401304d2
cmp eax, 0x100
je 0x1401304d2
cmp ebx, dword [rdx + 4]
jbe 0x1401304ee
xor eax, eax
pop rbx
ret
mov ecx, dword [rdx + 4]
lea eax, [rbx + r8]
cmp eax, ecx
ja 0x1401304ce
mov eax, r8d
add qword [rdx + 0x10], rax
add qword [rdx + 0x18], rax
sub ecx, r8d
mov dword [rdx + 4], ecx
mov ecx, dword [rdx + 4]
mov rax, qword [rdx + 0x10]
or r10d, 0xffffffff
dec ecx
test dword [r11 + 0x19c], 0x200
movzx r8d, byte [rcx + rax]
je 0x140130548
cmp qword [r11 + 0xe0], 0
jne 0x140130548
mov rcx, qword [r11 + 0x80]
mov rax, qword [rcx + 8]
cmp rax, qword [0x1402eafd8]
jne 0x140130534
test r8b, 1
jne 0x140130534
or dword [rcx], 8
mov rax, qword [r11 + 0x80]
test byte [rax], 8
je 0x140130548
test r8d, r8d
je 0x140130548
add r8d, r10d
mov rax, qword [r11 + 0xd0]
mov rcx, qword [rax]
test dword [rcx + 0x10], 0x200000
je 0x140130569
sub r10d, r8d
mov eax, 1
add dword [rdx + 4], r10d
pop rbx
ret
mov qword [rsp + 0x18], rsi
mov esi, 0xff
mov qword [rsp + 0x20], rdi
mov edi, dword [rdx + 4]
mov r9d, edi
sub r9d, r8d
lea eax, [rdi - 1]
sub r9d, ebx
not r9d
sar r9d, 0x1f
cmp eax, esi
cmovb esi, eax
xor r11d, r11d
test esi, esi
je 0x1401305df
mov qword [rsp + 0x10], rbp
mov rbp, qword [rdx + 0x10]
mov ebx, r8d
nop word [rax + rax]
mov eax, edi
sub eax, r11d
inc r11d
dec eax
movzx ecx, byte [rax + rbp]
mov eax, ebx
add ebx, r10d
xor ecx, r8d
not eax
sar eax, 0x1f
movzx eax, al
and ecx, eax
not ecx
and r9d, ecx
cmp r11d, esi
jb 0x1401305b0
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov eax, r9d
shr eax, 4
and r9d, eax
mov eax, r9d
shr eax, 2
and r9d, eax
lea eax, [r8 + 1]
lea ecx, [r9 + r9]
and ecx, r9d
shl ecx, 0x1e
sar ecx, 0x1f
and eax, ecx
sub edi, eax
shl eax, 8
or dword [rdx], eax
mov eax, ecx
not ecx
and eax, 1
mov dword [rdx + 4], edi
mov rdi, qword [rsp + 0x20]
or eax, ecx
pop rbx
ret
Function at 0x140130630
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xe0
mov rax, qword [0x140264330]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rsi, rcx
mov qword [rsp + 0x30], rcx
mov ecx, dword [rdx + 4]
xor r12d, r12d
sub ecx, r8d
mov r13d, r9d
mov edi, r8d
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], ecx
mov r14d, r12d
cmp r9d, r8d
jb 0x1401307e6
cmp edi, 0x40
ja 0x1401307af
mov qword [r11 + 0x10], rbx
mov qword [r11 - 0x30], rbp
lea rax, [rsp + 0x40]
neg rax
lea rbp, [rsp + 0x40]
mov qword [r11 - 0x38], r15
and eax, 0x3f
add rbp, rax
lea eax, [rdi + 0x100]
cmp r9d, eax
jbe 0x1401306c0
mov r14d, r9d
sub r14d, edi
sub r14d, 0x100
xor edx, edx
mov eax, edi
mov r8, rdi
and eax, 0xfffffffe
mov r15, rdi
shl eax, 0x17
sub eax, r14d
add eax, ecx
mov rcx, rbp
div edi
mov ebx, edx
xor edx, edx
call sub.MSVCR120.dll_memset
cmp r14d, r13d
jae 0x14013074c
mov rax, qword [rsp + 0x28]
mov r8d, r14d
mov r9d, r14d
mov esi, dword [rax + 4]
add r9, qword [rax + 0x10]
sub r8d, esi
sub esi, dword [rsp + 0x20]
sub r13d, r14d
mov r10d, r13d
nop word [rax + rax]
mov ecx, r8d
lea edx, [rsi + r8]
inc r8d
not ecx
not edx
lea r9, [r9 + 1]
sar ecx, 0x1f
sar edx, 0x1f
not cl
and cl, byte [r9 - 1]
and cl, dl
or byte [r12 + rbp], cl
inc r12d
mov eax, r12d
sub eax, edi
sar eax, 0x1f
and r12d, eax
dec r10
jne 0x140130710
mov rsi, qword [rsp + 0x30]
test edi, edi
je 0x140130777
mov eax, ebx
mov ecx, ebx
inc ebx
xor rax, 0x20
lea rsi, [rsi + 1]
movzx eax, byte [rax + rbp]
movzx eax, byte [rcx + rbp]
mov byte [rsi - 1], al
mov eax, ebx
sub eax, edi
sar eax, 0x1f
and ebx, eax
dec r15
jne 0x140130750
mov rbp, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0x118]
mov r15, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1401bb2c0
add rsp, 0xe0
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
lea r9, [0x1402967b8]
lea rdx, [0x140296830]
lea rcx, str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
mov r8d, 0x114
call fcn.1400f7420
mov ecx, reloc.WS2_32.dll_shutdown
call qword [sym.imp.MSVCR120.dll_raise]
mov ecx, 3
call qword [sym.imp.MSVCR120.dll__exit]
int3
lea r9, str.orig_len___md_size
lea rdx, [0x1402967d8]
lea rcx, str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
mov r8d, 0x113
call fcn.1400f7420
mov ecx, reloc.WS2_32.dll_shutdown
call qword [sym.imp.MSVCR120.dll_raise]
mov ecx, 3
call qword [sym.imp.MSVCR120.dll__exit]
int3