joyce8/EMBER2024-capa huggingface dataset:
Function at 0x188a4
Capabilities:
Delete file

Disassembly:
mov r11, rsp
sub rsp, 0x58
mov dword [rsp + 0x20], 0x30
xor eax, eax
mov qword [r11 - 0x30], rax
mov dword [rsp + 0x38], 0x40
mov qword [r11 - 0x28], rcx
lea rcx, [r11 - 0x38]
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x10], rax
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
add rsp, 0x58
ret

Function at 0x18c98
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
mov r11b, byte [rcx]
mov bl, byte [rcx + 1]
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov r10, rcx
test r9, r9
je 0x18d3a
mov r12d, 0xff
movzx eax, r11b
inc eax
cdq
and edx, r12d
add eax, edx
and eax, r12d
sub eax, edx
movzx r9d, al
mov r11d, eax
movzx eax, bl
movzx r8d, byte [r9 + r10 + 2]
add eax, r8d
cdq
and edx, r12d
add eax, edx
and eax, r12d
sub eax, edx
movzx edx, al
mov ebx, eax
mov cl, byte [rdx + r10 + 2]
mov byte [r9 + r10 + 2], cl
mov byte [rdx + r10 + 2], r8b
movzx eax, byte [r9 + r10 + 2]
add eax, r8d
cdq
and edx, r12d
add eax, edx
and eax, r12d
sub eax, edx
movsxd rcx, eax
mov al, byte [rcx + r10 + 2]
xor al, byte [rbp]
inc rbp
mov byte [rsi], al
inc rsi
sub rdi, 1
jne 0x18cca
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov byte [r10 + 1], bl
mov rbx, qword [rsp + 0x10]
mov byte [r10], r11b
pop r12
ret
Function at 0x195f4
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x520
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x510], rax
xor esi, esi
xor edx, edx
lea r8d, [rsi + 1]
mov rbx, rsi
call fcn.0001881c
mov r12, rax
cmp rax, rsi
je 0x19853
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x110]
mov ebp, 0x400
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor edx, edx
mov rcx, r12
mov edi, esi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xa4], esi
mov dword [rsp + 0xa0], ebx
mov dword [rsp + 0xa8], 0x67452301
mov dword [rsp + 0xac], 0xefcdab89
mov dword [rsp + 0xb0], 0x98badcfe
mov dword [rsp + 0xb4], 0x10325476
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
cmp eax, esi
cmovge eax, dword [rsp + 0x58]
cmp eax, esi
jle 0x19720
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0xa0]
mov r8d, eax
call fcn.00018d60
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x110]
mov dword [rsp + 0x30], ebp
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
cmp eax, esi
cmovge eax, dword [rsp + 0x58]
cmp eax, esi
jg 0x196b9
mov edi, dword [rsp + 0xa4]
mov ebx, dword [rsp + 0xa0]
mov dword [rsp + 0x98], ebx
shr ebx, 3
mov eax, 0x38
and ebx, 0x3f
mov r8d, 0x78
lea rdx, [0x00078710]
sub eax, ebx
sub r8d, ebx
cmp ebx, 0x38
lea rcx, [rsp + 0xa0]
cmovl r8d, eax
mov dword [rsp + 0x9c], edi
call fcn.00018d60
mov ebx, 4
lea r11, [rsp + 0xba]
lea r8d, [rbx + 0xa]
lea rdx, [rsp + 0x60]
movzx eax, byte [r11]
movzx ecx, byte [r11 + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [r11 - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [r11 - 2]
add r11, rbx
shl ecx, 8
or ecx, eax
mov dword [rdx], ecx
add rdx, rbx
sub r8, 1
jne 0x19775
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xa8]
call fcn.00018e1c
lea r11, [rsp + 0xf9]
lea rcx, [rsp + 0xa9]
mov rdx, rbx
mov al, byte [rcx - 1]
mov byte [r11 - 1], al
mov al, byte [rcx]
mov byte [r11], al
mov al, byte [rcx + 1]
mov byte [r11 + 1], al
mov al, byte [rcx + 2]
add rcx, rbx
mov byte [r11 + 2], al
add r11, rbx
sub rdx, 1
jne 0x197ca
lea edi, [rdx + 0x21]
mov r8d, 0x35646d54
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
cmp rax, rsi
je 0x1984a
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.0005d630
lea rdi, [rsp + 0xf8]
mov rsi, rbx
mov ebp, 0x10
movzx r8d, byte [rdi]
lea rdx, [0x0005e510]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_sprintf]
add rsi, 2
inc rdi
sub rbp, 1
jne 0x19829
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rax, rbx
mov rcx, qword [rsp + 0x510]
xor rcx, rsp
call fcn.0005cf80
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x19afc
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x80
mov rbx, qword [0x0007b240]
xor esi, esi
lea rcx, [0x0007cb20]
mov byte [rax - 0x48], sil
mov qword [rax + 0x10], rsi
xor eax, eax
mov qword [rsp + 0x41], rax
mov dword [rsp + 0x49], eax
mov word [rsp + 0x4d], ax
mov byte [rsp + 0x4f], al
lea rax, [0x0007cb00]
xor r8d, r8d
xor edx, edx
mov edi, esi
mov qword [0x0007cb10], rsi
mov qword [0x0007cb08], rax
mov qword [0x0007cb00], rax
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
xor r8d, r8d
mov edx, 0x75377977
mov rcx, rbx
call qword [sym.imp.NDIS.SYS_NdisAllocateGenericObject]
mov qword [0x0007b608], rax
cmp rax, rsi
je 0x19c97
lea edx, [rsi + 2]
lea r8, [0x0007b610]
mov ecx, edx
call sub.fwpkclnt.sys_FwpsInjectionHandleCreate0
cmp eax, esi
jl 0x19c85
mov rcx, qword [0x0007b608]
lea eax, [rsi + 0x10]
lea rdx, [rsp + 0x40]
mov word [rsp + 0x42], ax
mov byte [rsp + 0x40], 0x80
mov byte [rsp + 0x41], 1
mov byte [rsp + 0x44], sil
mov byte [rsp + 0x45], 1
mov word [rsp + 0x46], si
mov dword [rsp + 0x48], 0x49555943
mov dword [rsp + 0x4c], esi
call qword [sym.imp.NDIS.SYS_NdisAllocateNetBufferListPool]
mov qword [0x0007b618], rax
cmp rax, rsi
je 0x19c85
lea rax, [0x00019d00]
mov qword [rsp + 0x30], rsi
lea r8, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x98]
xor r9d, r9d
mov edx, 0x1fffff
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x68], 0x200
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov rcx, qword [rsp + 0x98]
cmp rcx, rsi
je 0x19c85
mov r8, qword [sym.imp.ntoskrnl.exe_PsThreadType]
lea rax, [0x0007b4f8]
xor r9d, r9d
mov r8, qword [r8]
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov ecx, 0xc0000000
and eax, ecx
cmp eax, ecx
je 0x19c85
lea edi, [rsi + 1]
jmp 0x19ccf
mov rcx, qword [0x0007b608]
cmp rcx, rsi
je 0x19c97
call qword [sym.imp.NDIS.SYS_NdisFreeGenericObject]
mov rcx, qword [0x0007b610]
cmp rcx, rsi
je 0x19ca8
call sub.fwpkclnt.sys_FwpsInjectionHandleDestroy0
mov rax, qword [0x0007b618]
cmp rax, rsi
je 0x19cbd
mov rcx, rax
call qword [sym.imp.NDIS.SYS_NdisFreeNetBufferListPool]
mov rcx, qword [0x0007b4f8]
cmp rcx, rsi
je 0x19ccf
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x98]
cmp rcx, rsi
je 0x19ce2
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea r11, [rsp + 0x80]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1cab0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x360
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov qword [rsp + 0x20], rcx
mov rdi, r8
mov rbx, rdx
lea rcx, [rsp + 0x1b0]
xor edx, edx
mov r8d, 0x1a0
call fcn.0005d630
mov r12d, 0x120
lea rcx, [rsp + 0x30]
mov r8, r12
xor edx, edx
call fcn.0005d630
mov rax, rdi
mov r11, rdi
shr rax, 0x10
shr r11, 0x18
lea rcx, [rsp + 0x1c8]
mov byte [rsp + 0x1c1], al
mov rax, rdi
mov r8, rdi
shr rax, 8
mov rdx, rbx
mov byte [rsp + 0x1c0], r11b
mov byte [rsp + 0x1c3], dil
mov byte [rsp + 0x1c7], 0x30
mov byte [rsp + 0x1c2], al
call fcn.0005d130
mov byte [rsp + rdi + 0x1c8], 0x80
lea r14, [rdi + 0x19]
xor eax, eax
lea rcx, [rsp + 0x190]
mov byte [rcx], al
inc eax
inc rcx
cmp eax, 0x20
jl 0x1cb6d
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x30]
mov r8d, 0x100
call fcn.000387e8
mov bpl, byte [rsp + 0x1b3]
xor edi, edi
lea r13d, [rdi + 0x10]
lea rcx, [rsp + 0x150]
mov r8, r13
xor edx, edx
call fcn.0005d630
mov rsi, r14
test r14, r14
je 0x1cc19
lea rbx, [rsp + 0x1b0]
lea rax, [rsp + 0x150]
sub rbx, rax
lea rcx, [rsp + 0x150]
mov rdx, r13
mov al, byte [rbx + rcx]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1cbd7
mov rax, rsi
add rbx, r13
cmp rsi, r13
cmovae rax, r13
lea r9, [rsp + 0x150]
lea r8, [rsp + 0x150]
lea rcx, [rsp + 0x30]
mov edx, 1
sub rsi, rax
call fcn.00038c68
test rsi, rsi
jne 0x1cbcc
movdqu xmm0, xmmword [rsp + 0x150]
inc bpl
mov byte [rsp + 0x1b3], bpl
movdqu xmmword [rsp + rdi + 0x160], xmm0
add rdi, r13
cmp rdi, 0x30
jl 0x1cb9f
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x30]
mov r8d, 0x100
call fcn.000387e8
mov r13, qword [rsp + 0x20]
mov ebx, 3
lea r9, [rsp + 0x180]
lea r8, [rsp + 0x180]
lea rcx, [rsp + 0x30]
mov edx, 1
call fcn.00038c68
movdqu xmm5, xmmword [rsp + 0x180]
movdqu xmmword [r13], xmm5
add r13, 0x10
sub rbx, 1
jne 0x1cc65
lea rax, [rsp + 0x30]
mov byte [rax], 0
inc rax
sub r12, 1
jne 0x1cca2
xor eax, eax
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.0005cf80
add rsp, 0x360
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1ccd8
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rdx
xor edx, edx
mov rsi, rcx
lea rcx, [r11 - 0x68]
lea r8d, [rdx + 0x30]
lea rbp, [r11 - 0x68]
call fcn.0005d630
mov r14d, 1
sub r14, rsi
xor ebx, ebx
lea r13d, [rbx + 3]
lea rcx, [rsi + 0xf]
add byte [rcx], 1
jne 0x1cd40
dec rcx
lea rax, [r14 + rcx]
cmp rax, rbx
jg 0x1cd2f
lea rcx, [rsi + 0x28]
mov r9, rbp
mov r8, rsi
mov edx, 1
call fcn.00038c68
add rbp, 0x10
sub r13, 1
jne 0x1cd2b
lea rax, [rsp + 0x20]
sub rdi, rax
lea rdx, [rsp + rbx + 0x20]
inc rbx
mov al, byte [rdi + rdx]
xor byte [rdx], al
cmp rbx, 0x30
jl 0x1cd66
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x28]
mov r8d, 0x100
call fcn.000387e8
xor eax, eax
movdqu xmm5, xmmword [rsp + 0x40]
movdqu xmmword [rsi], xmm5
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.0005cf80
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x20cf4
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x30
lea rax, [rdx + r8]
mov rdi, rcx
mov r8, rcx
lea rcx, [r11 + 0x10]
mov rsi, rdx
xor r13d, r13d
mov qword [r11 + 0x10], rax
call fcn.00020c04
movsxd r11, eax
test eax, eax
jns 0x20d38
mov eax, r11d
jmp 0x20e8e
mov rcx, qword [rsp + 0x58]
mov rax, rcx
sub rax, rsi
cmp rax, 1
jl 0x20e89
dec rcx
lea rbx, [r11 + 1]
mov rdx, rsi
mov byte [rcx], r13b
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x58]
mov r8, rbx
call fcn.0003a918
test eax, eax
js 0x20e8e
mov rcx, qword [rsp + 0x58]
cdqe
add rbx, rax
mov rax, rcx
sub rax, rsi
cmp rax, 1
jl 0x20e89
dec rcx
inc rbx
mov byte [rcx], 3
mov qword [rsp + 0x58], rcx
test rdi, rdi
je 0x20dad
mov rax, qword [rdi]
test rax, rax
je 0x20dad
mov ecx, dword [rax]
jmp 0x20daf
xor ecx, ecx
lea rax, [0x0006d490]
cmp qword [0x0006d490], r13
je 0x20dcd
cmp dword [rax + 0x20], ecx
je 0x20dd7
add rax, 0x28
cmp qword [rax], r13
jne 0x20dbf
mov eax, 0xffffffd2
jmp 0x20e8e
mov rbp, qword [rax]
mov r12, qword [rax + 8]
test rdi, rdi
je 0x20def
mov rax, qword [rdi]
test rax, rax
je 0x20def
mov ecx, dword [rax]
jmp 0x20df1
xor ecx, ecx
cmp ecx, 2
jne 0x20e35
mov rax, qword [rdi + 8]
lea r8, [0x0006d530]
mov ecx, dword [rax]
cmp qword [0x0006d530], r13
je 0x20dcd
cmp dword [r8 + 0x20], ecx
je 0x20e1d
add r8, 0x28
cmp qword [r8], r13
jne 0x20e0c
jmp 0x20dcd
mov r9, qword [r8 + 8]
mov r8, qword [r8]
lea rcx, [rsp + 0x58]
call fcn.0003aaa8
test eax, eax
js 0x20e8e
movsxd r13, eax
lea rcx, [rsp + 0x58]
mov r9, r12
mov r8, rbp
mov rdx, rsi
mov qword [rsp + 0x20], r13
call fcn.0003ab10
test eax, eax
js 0x20e8e
cdqe
lea rcx, [rsp + 0x58]
mov rdx, rsi
add rbx, rax
mov r8, rbx
call fcn.0003a918
test eax, eax
js 0x20e8e
mov rcx, qword [rsp + 0x58]
cdqe
add rbx, rax
mov rax, rcx
sub rax, rsi
cmp rax, 1
jl 0x20e89
mov byte [rcx - 1], 0x30
lea eax, [rbx + 1]
jmp 0x20e8e
mov eax, 0xffffff94
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x21b18
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x80
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, qword [rsp + 0xe0]
mov rsi, rdx
xor edx, edx
mov r13, r8
mov rbp, rcx
lea r8d, [rdx + 0x40]
lea rcx, [rsp + 0x30]
mov r14, r9
call fcn.0005d630
mov rax, qword [rdi]
xor r11d, r11d
mov dword [rsp + 0x20], r11d
test rsi, rsi
je 0x21beb
mov r12d, dword [rax + 0x10]
mov rbx, r12
cmp rsi, r12
mov rcx, rdi
cmovb rbx, rsi
call fcn.00037018
mov r11, qword [rdi]
test r11, r11
je 0x21bc9
mov rcx, qword [rdi + 8]
mov r8, r14
mov rdx, r13
call qword [r11 + 0x20]
mov r11, qword [rdi]
test r11, r11
je 0x21bc9
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x20]
mov r8d, 4
call qword [r11 + 0x20]
mov r11, qword [rdi]
test r11, r11
je 0x21bc9
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x30]
call qword [r11 + 0x28]
xor ecx, ecx
test rbx, rbx
je 0x21be2
mov al, byte [rsp + rcx + 0x30]
inc rcx
xor byte [rbp], al
inc rbp
cmp rcx, rbx
jb 0x21bd0
inc byte [rsp + 0x23]
sub rsi, rbx
jne 0x21b71
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.0005cf80
add rsp, 0x80
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x21f14
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x890
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x880], rax
cmp dword [rcx + 0x148], 1
mov r12, qword [rsp + 0x900]
mov r9, qword [rsp + 0x908]
mov r13, qword [rsp + 0x910]
mov r10, rcx
jne 0x220d1
mov rsi, qword [rcx + 8]
lea rax, [rsi - 0x10]
cmp rax, 0x7f0
ja 0x220d1
mov ecx, dword [rcx + 0x14c]
call fcn.00036f1c
mov rbx, rax
test rax, rax
je 0x220d1
lea rax, [rsp + 0x80]
mov rcx, r10
mov qword [rsp + 0x20], rax
call fcn.000217bc
test eax, eax
jne 0x220d6
movzx r14d, byte [rbx + 0x10]
xor eax, eax
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
call fcn.00036fbc
lea r8, [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call qword [rbx + 0x30]
lea rax, [rsp + 0x30]
mov rbx, rsi
sub rbx, r14
lea rdi, [rsp + r14 + 0x81]
lea rcx, [rsp + 0x81]
lea r9, [rbx - 1]
mov rdx, r14
mov r8, rdi
mov qword [rsp + 0x20], rax
call fcn.00021b18
lea r11, [rsp + 0x30]
lea r8, [rsp + 0x81]
lea rdx, [rbx - 1]
mov r9, r14
mov rcx, rdi
mov qword [rsp + 0x20], r11
call fcn.00021b18
lea rcx, [rsp + 0x30]
call fcn.00036f80
mov r11b, byte [rsp + 0x80]
xor ecx, ecx
lea rdx, [rsp + r14 + 0x81]
test r14d, r14d
je 0x22057
mov al, byte [rsp + rcx + 0x40]
inc rcx
xor al, byte [rdx]
inc rdx
or r11b, al
cmp rcx, r14
jb 0x22043
lea ecx, [r14 + r14]
mov r8, rsi
xor ebx, ebx
sub r8, rcx
xor r9b, r9b
xor r10d, r10d
sub r8, 2
je 0x2208f
or r9b, byte [r10 + rdx]
inc r10
mov al, r9b
neg al
or al, r9b
not al
movzx eax, al
shr rax, 7
add rbx, rax
cmp r10, r8
jb 0x2206f
add rdx, rbx
mov al, byte [rdx]
inc rdx
xor al, 1
or r11b, al
je 0x220a5
mov eax, 0xffffbf00
jmp 0x220d6
sub rsi, rdx
lea r8, [rsp + rsi + 0x80]
cmp r8, qword [rsp + 0x918]
jbe 0x220c1
mov eax, 0xffffbc00
jmp 0x220d6
mov rcx, r13
mov qword [r12], r8
call fcn.0005d130
xor eax, eax
jmp 0x220d6
mov eax, 0xffffbf80
mov rcx, qword [rsp + 0x880]
xor rcx, rsp
call fcn.0005cf80
add rsp, 0x890
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x2782c
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x40
xor eax, eax
mov rbp, r8
lea r8, [r11 - 0x28]
mov qword [r9], rax
mov qword [r9 + 8], rax
mov qword [r9 + 0x10], rax
mov rdi, r9
call fcn.0003759c
test eax, eax
je 0x27867
add eax, 0xffffd580
jmp 0x278ac
cmp qword [0x0006d490], 0
lea rbx, [0x0006d490]
mov rcx, rbx
je 0x278a7
mov rsi, qword [rsp + 0x28]
cmp qword [rcx + 8], rsi
jne 0x2789a
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rcx]
mov r8, rsi
call fcn.0005d730
test eax, eax
je 0x278c1
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x27880
mov eax, 0xffffd380
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
test rbx, rbx
je 0x278a7
mov eax, dword [rbx + 0x20]
mov dword [rbp], eax
cmp eax, 1
jne 0x278e9
cmp dword [rdi], 5
je 0x278db
cmp dword [rdi], 0
jne 0x278e2
cmp qword [rdi + 8], 0
je 0x278e9
mov eax, 0xffffd580
jmp 0x278ac
xor eax, eax
jmp 0x278ac
Function at 0x2cf3c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
lea rcx, [0x0006ffa8]
call fcn.00044148
mov r8d, dword [rbx + 0x1c0]
mov rax, qword [rbx + 0xe0]
lea rdx, [rsp + 0x30]
xor r8d, 1
mov rcx, rbx
call qword [rax + 0x810]
lea rcx, str.switching_to_new_transform_spec_for_inbound_data
call fcn.00044148
mov rax, qword [rbx + 0x100]
xor ecx, ecx
mov qword [rbx + 0xe8], rax
mov rax, qword [rbx + 0xd8]
mov qword [rbx + 0xc0], rax
mov rax, qword [rbx + 0x108]
mov qword [rax], rcx
cmp dword [rbx + 0x10], 2
jl 0x2cfdd
mov rax, qword [rbx + 0x100]
mov rcx, qword [rax + 0x18]
sub rcx, qword [rax + 0x20]
add rcx, qword [rbx + 0x118]
mov qword [rbx + 0x120], rcx
jmp 0x2cfeb
mov rax, qword [rbx + 0x118]
mov qword [rbx + 0x120], rax
mov rcx, rbx
call fcn.0002b438
mov edi, eax
test eax, eax
je 0x2d02a
mov dword [rsp + 0x28], eax
lea rax, str.ssl_read_record
lea r8, [0x0006f138]
mov r9d, 0xd69
mov edx, 1
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.00044190
mov eax, edi
jmp 0x2d115
cmp dword [rbx + 0x130], 0x16
je 0x2d03a
mov ebx, 0xffff8900
jmp 0x2d09c
mov eax, dword [rbx + 0x10]
mov r8, qword [rbx + 0x120]
neg eax
sbb edx, edx
and edx, 0xffffffe8
add edx, 0x24
cmp byte [r8], 0x14
jne 0x2d104
lea ecx, [rdx + 4]
cmp qword [rbx + 0x148], rcx
jne 0x2d104
xor r9b, r9b
lea rcx, [r8 + 4]
mov r8d, edx
test edx, edx
je 0x2d0ac
lea rdx, [rsp + 0x30]
mov r10, r8
sub rdx, rcx
mov al, byte [rdx + rcx]
xor al, byte [rcx]
inc rcx
or r9b, al
sub r10, 1
jne 0x2d081
test r9b, r9b
je 0x2d0ac
mov ebx, 0xffff8180
lea rcx, str.bad_finished_message
call fcn.00044148
mov eax, ebx
jmp 0x2d115
lea rcx, [rbx + 0x2bc]
lea rdx, [rsp + 0x30]
mov qword [rbx + 0x290], r8
call fcn.0005d130
mov r11, qword [rbx + 0xe0]
cmp dword [r11 + 0x108c], 0
je 0x2d0f2
mov eax, dword [rbx + 0x1c0]
test eax, eax
jne 0x2d0e5
mov dword [rbx], 0xa
cmp eax, 1
jne 0x2d0f4
mov dword [rbx], 0xf
jmp 0x2d0f4
inc dword [rbx]
lea rcx, str.__parse_finished
call fcn.00044148
xor eax, eax
jmp 0x2d115
lea rcx, str.bad_finished_message
call fcn.00044148
mov eax, 0xffff8180
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.0005cf80
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x2d134
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edx, edx
mov r8d, 0x10a8
mov rsi, rcx
call fcn.0005d630
lea rcx, [rsi + 0x388]
xor edx, edx
mov r8d, 0xd8
call fcn.0005d630
lea rcx, [rsi + 0x460]
xor edx, edx
mov r8d, 0xdc
call fcn.0005d630
xor r9d, r9d
mov edx, 0xefcdab89
mov dword [rsi + 0x394], edx
mov dword [rsi + 0x388], r9d
mov dword [rsi + 0x38c], r9d
mov r8d, 0x67452301
mov ecx, 0x98badcfe
mov eax, 0x10325476
mov dword [rsi + 0x390], r8d
mov dword [rsi + 0x398], ecx
mov dword [rsi + 0x39c], eax
mov dword [rsi + 0x470], ecx
mov dword [rsi + 0x468], r8d
mov dword [rsi + 0x46c], edx
lea rcx, [rsi + 0x53c]
xor edx, edx
mov r8d, 0xec
mov dword [rsi + 0x460], r9d
mov dword [rsi + 0x464], r9d
mov dword [rsi + 0x474], eax
mov dword [rsi + 0x478], 0xc3d2e1f0
call fcn.0005d630
lea rcx, [rsi + 0x53c]
xor edx, edx
call fcn.0003e93c
lea rcx, [rsi + 0x628]
mov r8d, 0x1d8
call fcn.0005d630
lea rcx, [rsi + 0x628]
mov edx, 1
call fcn.00039a38
lea rcx, [0x0002c25c]
xor edx, edx
mov qword [rsi + 0x800], rcx
lea rcx, [rsi + 0x10]
mov r8d, 0xf8
mov dword [rsi], 2
call fcn.0005d630
lea rcx, [rsi + 0x108]
xor edx, edx
mov r8d, 0x268
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.0005d630

Function at 0x2ed98
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 4], 0
mov rbx, rcx
je 0x2ee2b
mov r9, qword [rcx + 0x290]
lea rcx, [r9 + r9]
lea rax, [rcx + 1]
cmp r8, rax
jne 0x2ee22
movzx eax, byte [rdx]
cmp rax, rcx
jne 0x2ee22
xor r8b, r8b
lea rcx, [rdx + 1]
lea r10, [rbx + 0x298]
test r9, r9
je 0x2edf7
sub r10, rcx
mov r11, r9
mov al, byte [r10 + rcx]
xor al, byte [rcx]
inc rcx
or r8b, al
sub r11, 1
jne 0x2ede0
test r8b, r8b
jne 0x2ee22
lea rcx, [r9 + rdx + 1]
xor dl, dl
lea r8, [rbx + 0x2bc]
test r9, r9
je 0x2ee3d
sub r8, rcx
mov al, byte [r8 + rcx]
xor al, byte [rcx]
inc rcx
or dl, al
sub r9, 1
jne 0x2ee0d
test dl, dl
je 0x2ee3d
lea rcx, str.non_matching_renegotiation_info
jmp 0x2ee48
cmp r8, 1
jne 0x2ee41
cmp byte [rdx], 0
jne 0x2ee41
mov dword [rcx + 0x288], r8d
xor eax, eax
jmp 0x2ee66
lea rcx, str.non_zero_length_renegotiation_info
call fcn.00044148
mov r8b, 0x28
mov dl, 2
mov rcx, rbx
call fcn.0002b8c8
mov ecx, 0xffff8680
test eax, eax
cmovne ecx, eax
mov eax, ecx
add rsp, 0x20
pop rbx
ret