joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401494e0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov dword [rsp + 0x20], 0xf0000040
mov rsi, rdx
mov rbp, rcx
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140149523
xor ebx, ebx
jmp 0x140149599
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x80090016
jne 0x140149595
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000048
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140149558
xor ebx, ebx
jmp 0x140149599
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x8009000f
jne 0x140149595
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14014958d
xor ebx, ebx
jmp 0x140149599
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x1401495c6
mov rcx, qword [rsp + 0x58]
mov r8, rbp
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x1401495b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test ebx, ebx
je 0x1401495d0
mov rdx, rdi
mov ecx, ebx
call fcn.1401493f0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14014da80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r9, qword [0x1404cbe88]
mov rbx, rdx
mov rax, r9
movsxd rsi, r8d
cqo
xor r15d, r15d
and edx, 0x1fff
mov rbp, rcx
add rax, rdx
mov r14d, r15d
and eax, 0x1fff
sub rax, rdx
sub r9, rax
mov rdi, rax
cmp rax, rsi
jle 0x14014db97
mov ecx, dword [0x1404cbe80]
xor r8d, r8d
mov rdx, r9
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__lseeki64]
mov rdx, qword [0x1404cbe48]
mov r8d, edi
mov ecx, dword [0x1404cbe80]
mov qword [0x1404cbe90], rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov dword [0x1404cbe58], eax
mov r9d, eax
cmp eax, edi
je 0x14014db19
mov eax, 2
jmp 0x14014dc9c
mov r8, qword [0x1404cbe48]
lea eax, [rsi + 4]
movsxd rcx, eax
movsxd rdx, edi
sub rdx, rcx
add rdx, r8
mov qword [0x1404cbe50], rdx
cmp rdx, r8
jb 0x14014db78
nop dword [rax + rax]
cmp byte [rdx], 0x50
jne 0x14014db4b
mov eax, dword [rdx]
cmp eax, dword [rbx]
je 0x14014db5c
dec rdx
mov qword [0x1404cbe50], rdx
cmp rdx, r8
jae 0x14014db40
jmp 0x14014db78
mov eax, dword [0x1404cbe48]
mov r14d, 1
sub eax, dword [0x1404cbe50]
add r9d, eax
mov dword [0x1404cbe58], r9d
movzx eax, word [r8]
mov rcx, qword [0x1404cbea8]
mov word [rcx], ax
movzx eax, byte [r8 + 2]
mov byte [rcx + 2], al
mov r9, qword [0x1404cbe90]
jmp 0x14014db9e
mov qword [0x1404cbe90], r9
sub rbp, rdi
mov edi, 1
lea rax, [rbp + 0x1fff]
cqo
and edx, 0x1fff
lea rsi, [rdx + rax]
sar rsi, 0xd
test r14d, r14d
jne 0x14014dc95
cmp edi, esi
jg 0x14014dc92
mov ecx, dword [0x1404cbe80]
sub r9, 0x2000
mov rdx, r9
mov qword [0x1404cbe90], r9
xor r8d, r8d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__lseeki64]
mov rdx, qword [0x1404cbe48]
mov r8d, 0x2000
mov ecx, dword [0x1404cbe80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov dword [0x1404cbe58], eax
cmp eax, 0x2000
jne 0x14014db0f
mov rdx, qword [0x1404cbe48]
lea rax, [rdx + 0x1fff]
mov qword [0x1404cbe50], rax
cmp rax, rdx
jb 0x14014dc6b
cmp byte [rax], 0x50
jne 0x14014dc3d
mov ecx, dword [rax]
cmp ecx, dword [rbx]
je 0x14014dc4e
dec rax
mov qword [0x1404cbe50], rax
cmp rax, rdx
jae 0x14014dc32
jmp 0x14014dc6b
mov eax, dword [0x1404cbe48]
mov r14d, 1
sub eax, dword [0x1404cbe50]
add eax, 0x2000
mov dword [0x1404cbe58], eax
movzx eax, word [rdx]
inc edi
mov rcx, qword [0x1404cbea8]
mov word [rcx], ax
movzx eax, byte [rdx + 2]
mov byte [rcx + 2], al
test r14d, r14d
jne 0x14014dc95
mov r9, qword [0x1404cbe90]
jmp 0x14014dbc6
test r14d, r14d
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1401539d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov esi, edx
mov r14, rcx
mov ebp, edx
test edx, edx
je 0x140153aa8
mov eax, dword [0x1404cbe58]
mov rdx, qword [0x1404cbe50]
test eax, eax
jg 0x140153a48
mov rdx, qword [0x1404cbe48]
mov r8d, 0x2000
mov ecx, dword [0x1404cbe80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov dword [0x1404cbe58], eax
test eax, eax
je 0x140153aa6
js 0x140153a82
mov rdx, qword [0x1404cbe48]
add qword [0x1404cbe90], 0x2000
mov qword [0x1404cbe50], rdx
cmp esi, eax
mov rcx, r14
cmovb eax, esi
mov r8d, eax
mov edi, eax
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [0x1404cbe50]
add r14, rdi
mov eax, dword [0x1404cbe58]
add rdx, rdi
sub eax, edi
mov qword [0x1404cbe50], rdx
mov dword [0x1404cbe58], eax
sub esi, edi
jne 0x140153a06
jmp 0x140153aa8
mov r9d, 0x401
lea rdx, str.error:__zipfile_read_error_n
mov r8d, 0x1b
lea rcx, [0x1403dbd40]
call qword [0x1404cc1f8]
xor eax, eax
jmp 0x140153aaa
sub ebp, esi
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140153ad0
Capabilities:
Encode data using xor
Read file on windows
Terminate process

Disassembly:
sub rsp, 0x28
cmp dword [0x1404cbf80], 0
jne 0x140153afd
mov rax, qword [0x1403dbe00]
test rax, rax
jg 0x140153b05
dec rax
mov dword [0x1404cbe58], 0
mov qword [0x1403dbe00], rax
or eax, 0xffffffff
add rsp, 0x28
ret
mov qword [rsp + 0x20], rdi
mov edi, dword [0x1404cbe58]
test edi, edi
jg 0x140153b9a
mov rdx, qword [0x1404cbe48]
mov r8d, 0x2000
mov ecx, dword [0x1404cbe80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov dword [0x1404cbe58], eax
test eax, eax
jne 0x140153b48
or eax, 0xffffffff
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
jns 0x140153b76
mov r9d, 0x401
lea rdx, str.error:__zipfile_read_error_n
mov r8d, 0x1b
lea rcx, [0x1403dbd40]
call qword [0x1404cc1f8]
mov ecx, 3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, qword [0x1404cbe48]
add qword [0x1404cbe90], 0x2000
mov qword [0x1404cbe50], rax
call fcn.1401523d0
mov edi, dword [0x1404cbe58]
mov rax, qword [0x1404bbe30]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1404cbe50]
test byte [rax + 0x28], 1
je 0x140153bdc
test edi, edi
je 0x140153bdc
call fcn.1401a0100
xor byte [rbx], al
movzx ecx, byte [rbx]
call fcn.1401a0320
lea rbx, [rbx + 1]
sub edi, 1
jne 0x140153bb7
mov edi, dword [0x1404cbe58]
mov rbx, qword [0x1404cbe50]
dec edi
mov dword [0x1404cbe58], edi
movzx eax, byte [rbx]
inc rbx
mov rdi, qword [rsp + 0x20]
mov qword [0x1404cbe50], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x140153c00
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [0x1404cbe98]
add r8, rcx
mov rax, r8
cqo
and edx, 0x1fff
add rax, rdx
and eax, 0x1fff
sub rax, rdx
mov rdx, r8
sub rdx, rax
mov rbx, rax
test r8, r8
jns 0x140153c7d
mov r8, qword [0x1404cbe78]
lea r9, str.___please_check_that_you_have_transferred_or_created_the_zipfile_in_the_n__appropriate_BINARY_mode_and_that_you_have_compiled_UnZip_properly__n
lea rdx, str.error___s_:__attempt_to_seek_before_beginning_of_zipfile_n_s
lea rcx, [0x1404bbe38]
call fcn.1401066c0
mov r8d, eax
lea rdx, [0x1404bbe38]
mov r9d, 1
lea rcx, [0x1403dbd40]
call qword [0x1404cc1f8]
mov eax, 3
add rsp, 0x20
pop rbx
ret
cmp rdx, qword [0x1404cbe90]
je 0x140153cd4
mov ecx, dword [0x1404cbe80]
xor r8d, r8d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__lseeki64]
mov rdx, qword [0x1404cbe48]
mov r8d, 0x2000
mov ecx, dword [0x1404cbe80]
mov qword [0x1404cbe90], rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov dword [0x1404cbe58], eax
test eax, eax
jg 0x140153cca
mov eax, 0x33
add rsp, 0x20
pop rbx
ret
sub eax, ebx
mov dword [0x1404cbe58], eax
jmp 0x140153ce8
mov eax, dword [0x1404cbe50]
sub eax, dword [0x1404cbe48]
sub eax, ebx
add dword [0x1404cbe58], eax
movsxd rax, ebx
add rax, qword [0x1404cbe48]
mov qword [0x1404cbe50], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140153ed0
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [0x1403aa6c8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r8d, 2
lea rdx, [0x14024e14c]
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x140153f1f
mov r8d, 2
lea rdx, [0x14028cbd8]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140153f33
movzx eax, byte [rbx + 2]
test al, al
je 0x140153f33
cmp al, 0x2f
je 0x140153f33
cmp al, 0x5c
jne 0x140154005
movzx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
test eax, eax
je 0x140153f46
cmp byte [rbx + 1], 0x3a
je 0x140153f71
lea r9, [rsp + 0x48]
mov edx, 0x104
lea r8, [rsp + 0x170]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x140154005
lea rbx, [rsp + 0x170]
mov r8d, 2
mov qword [rsp + 0x48], rbx
mov rdx, rbx
lea rcx, [0x1404cc24c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14015408d
mov rdx, qword [rsp + 0x48]
lea rcx, [0x1404cc24c]
mov r8d, 2
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x54]
lea rax, [rsp + 0x50]
mov word [0x1404cc24e], 0x2f
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x170]
lea rax, [rsp + 0x40]
mov r8d, 0x104
lea rcx, [0x1404cc24c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x14015400c
mov byte [0x1404cc24c], al
xor eax, eax
jmp 0x140154092
xor eax, eax
lea rcx, [rsp + 0x60]
cmp dword [rsp + 0x40], 0xc
setbe al
mov dword [0x1404cc250], eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strupr]
mov r8d, 4
lea rdx, str.VFAT
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x140154083
mov r8d, 4
lea rdx, str.HPFS
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x140154083
mov r8d, 3
lea rdx, [0x14028cc1c]
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
mov dword [0x1404cc254], 0
test eax, eax
jne 0x14015408d
mov dword [0x1404cc254], 1
mov eax, 1
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140229810
add rsp, 0x290
pop rbx
ret
Function at 0x140155320
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
mov r9d, 2
lea r8, [rsp + 0x30]
mov ecx, 0x400
lea edx, [r9 + 0x1f]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x140155368
movsx edx, byte [rsp + 0x30]
sub edx, 0x30
je 0x140155368
sub edx, 1
je 0x14015535e
cmp edx, 1
jne 0x140155368
lea eax, [rdx + 1]
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x140155370
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
mov r9d, 2
lea r8, [rsp + 0x30]
mov ecx, 0x400
lea edx, [r9 + 0x1b]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x14015539b
movzx eax, word [rsp + 0x30]
test al, al
jne 0x14015539d
mov al, 0x2d
add rsp, 0x28
ret

Function at 0x140155a40
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x28
add cl, 0x40
mov word [rsp + 0x31], 0x2f3a
mov byte [rsp + 0x30], cl
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x33], 0
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor ecx, ecx
cmp eax, 2
sete cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x140156860
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
xor esi, esi
mov dword [rsp + 0x70], 0xffffffff
mov qword [rsp + 0x30], rsi
lea rcx, str.CONIN_
or ebx, 0xffffffff
mov dword [rsp + 0x28], esi
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
lea r8d, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140156944
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x1401568ca
lea edx, [rbx + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rsi
mov r8d, 1
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140156929
cmp dword [rsp + 0x68], 1
jne 0x140156929
movzx ebx, byte [rsp + 0x60]
cmp ebx, 0xa
jne 0x140156929
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rsi
lea r8d, [rbx - 9]
mov rcx, rdi
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140156929
cmp dword [rsp + 0x68], 1
jne 0x140156929
movzx ebx, byte [rsp + 0x60]
mov edx, dword [rsp + 0x70]
cmp edx, 0xffffffff
je 0x14015693b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x140156d70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rdi
sub rsp, 0x58
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64]
mov rcx, rbx
test eax, eax
jne 0x140156f0a
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x50], rsi
call fcn.140153da0
mov ebp, eax
mov qword [rsp + 0x30], 0
mov eax, 0x80
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [rax - 0x7d]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140156ef7
lea r9, [rsp + 0x40]
mov rcx, rax
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140156ef7
lea rdx, [rdi + 0x28]
lea rcx, [rsp + 0x40]
test ebp, ebp
jne 0x140156e83
call fcn.1401540b0
cmp dword [rsp + 0x80], ebp
jne 0x140156e3a
cmp dword [rsp + 0x84], ebp
jne 0x140156e3a
mov rax, qword [rdi + 0x28]
mov qword [rdi + 0x20], rax
jmp 0x140156e4b
lea rdx, [rdi + 0x20]
lea rcx, [rsp + 0x80]
call fcn.1401540b0
cmp dword [rsp + 0x88], 0
jne 0x140156e5f
cmp dword [rsp + 0x8c], 0
je 0x140156ecb
lea rdx, [rdi + 0x30]
lea rcx, [rsp + 0x88]
call fcn.1401540b0
mov rsi, qword [rsp + 0x50]
xor eax, eax
mov rbp, qword [rsp + 0x70]
add rsp, 0x58
pop rdi
pop rbx
ret
call fcn.140154510
cmp dword [rsp + 0x80], 0
jne 0x140156ea6
cmp dword [rsp + 0x84], 0
jne 0x140156ea6
mov rax, qword [rdi + 0x28]
mov qword [rdi + 0x20], rax
jmp 0x140156eb7
lea rdx, [rdi + 0x20]
lea rcx, [rsp + 0x80]
call fcn.140154510
cmp dword [rsp + 0x88], 0
jne 0x140156ee6
cmp dword [rsp + 0x8c], 0
jne 0x140156ee6
mov rax, qword [rdi + 0x28]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x70]
mov qword [rdi + 0x30], rax
xor eax, eax
add rsp, 0x58
pop rdi
pop rbx
ret
lea rdx, [rdi + 0x30]
lea rcx, [rsp + 0x88]
call fcn.140154510
mov rsi, qword [rsp + 0x50]
xor eax, eax
mov rbp, qword [rsp + 0x70]
add rsp, 0x58
pop rdi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp eax, 0xffffffff
je 0x140156f72
test al, 0x10
je 0x140156f72
xor eax, eax
mov ecx, 0x210000
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x30], rax
call fcn.140152b70
shl bx, 7
mov qword [rdi + 0x28], rax
not bx
mov qword [rdi + 0x30], rax
mov qword [rdi + 0x20], rax
mov eax, 0x80
and bx, ax
mov eax, 0x4100
or bx, ax
mov word [rdi + 6], bx
xor eax, eax
add rsp, 0x58
pop rdi
pop rbx
ret
or eax, 0xffffffff
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x14015a3e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
mov eax, 0xb8
call fcn.140229de0
sub rsp, rax
mov rax, qword [0x1403aa6c8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r12, qword [rsp + 0x110]
xor edi, edi
movsxd rsi, r8d
mov rbp, r9
mov r14, rdx
mov rbx, rcx
mov eax, edi
test r9, r9
je 0x14015a446
cmp r9, qword [rcx]
je 0x14015a43c
test rdx, rdx
je 0x14015a629
test r8d, r8d
js 0x14015a629
mov eax, 1
mov qword [rcx], r9
jmp 0x14015a452
mov rbp, qword [rcx]
test rbp, rbp
je 0x14015a629
test r14, r14
je 0x14015a524
mov rcx, rbp
mov qword [rsp + 0xb0], r15
call fcn.1401209b0
mov r15d, eax
cmp eax, 0x80
jle 0x14015a48e
mov r8d, 0x28
lea rdx, str.cryptohmachmac.c
lea rcx, str.assertion_failed:_j____int_sizeof_ctx__key_
call fcn.14011ec10
cmp r15d, esi
mov r15, qword [rsp + 0xb0]
jge 0x14015a4e0
mov rcx, qword [rbx + 8]
mov r8, r12
mov rdx, rbp
call fcn.140113450
test eax, eax
je 0x14015a4d9
mov rcx, qword [rbx + 8]
mov r8, rsi
mov rdx, r14
call fcn.1401136c0
test eax, eax
je 0x14015a4d9
mov rcx, qword [rbx + 8]
lea r14, [rbx + 0x20]
mov r8, r14
lea rdx, [rbx + 0x24]
call fcn.140113370
test eax, eax
jne 0x14015a4fe
xor eax, eax
jmp 0x14015a629
cmp esi, 0x80
ja 0x14015a4d9
mov r8, rsi
lea rcx, [rbx + 0x24]
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
lea r14, [rbx + 0x20]
mov dword [r14], esi
mov ecx, dword [r14]
cmp ecx, 0x80
je 0x14015a52c
mov eax, ecx
mov r8d, 0x80
sub r8d, ecx
xor edx, edx
lea rcx, [rbx + 0x24]
add rcx, rax
call sub.VCRUNTIME140.dll_memset
jmp 0x14015a52c
test eax, eax
je 0x14015a60f
lea rcx, [rsp + 0x20]
mov rax, rbx
sub rax, rcx
mov rdx, rdi
lea rsi, [rax + 0x24]
lea r14, [rax + 0x25]
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rsi + rcx]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x80
jl 0x14015a550
mov rcx, qword [rbx + 0x10]
mov r8, r12
mov rdx, rbp
call fcn.140113450
test eax, eax
je 0x14015a4d9
mov rcx, rbp
call fcn.1401209b0
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.1401136c0
test eax, eax
je 0x14015a4d9
nop
lea rcx, [rsp + 0x20]
add rcx, rdi
add rdi, 2
movzx eax, byte [rsi + rcx]
xor al, 0x5c
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x5c
mov byte [rcx + 1], al
cmp rdi, 0x80
jl 0x14015a5b0
mov rcx, qword [rbx + 0x18]
mov r8, r12
mov rdx, rbp
call fcn.140113450
test eax, eax
je 0x14015a4d9
mov rcx, rbp
call fcn.1401209b0
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.1401136c0
test eax, eax
je 0x14015a4d9
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
call fcn.1401136e0
test eax, eax
je 0x14015a4d9
mov eax, 1
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140229810
add rsp, 0xb8
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401602a0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rdi
push r14
mov eax, 0x40
call fcn.140229de0
sub rsp, rax
cmp dword [rsp + 0x70], 2
mov rdi, r8
movsxd rbp, r9d
mov r14, rcx
je 0x140160330
test rdx, rdx
je 0x14016031c
mov r9, rdx
xor r8d, r8d
lea rdx, [rsp + 0x30]
xor ecx, ecx
call fcn.14012c3f0
cmp dword [rsp + 0x30], 0xffffffff
je 0x14016031c
mov dword [rsp + 0x20], 0x2f
mov ecx, reloc.WS2_32.dll_recv
lea r9, str.cryptoececx_meth.c
mov edx, 0x10a
lea r8d, [rcx + 0x56]
call fcn.14010c170
xor eax, eax
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
test rdi, rdi
je 0x140160326
cmp ebp, 0x20
je 0x140160330
mov dword [rsp + 0x20], 0x35
jmp 0x1401602ef
mov r8d, 0x3a
mov qword [rsp + 0x50], rbx
lea rdx, str.cryptoececx_meth.c
lea ecx, [r8 - 0x12]
call fcn.140113d20
mov rbx, rax
test rax, rax
jne 0x14016037a
lea r9, str.cryptoececx_meth.c
mov dword [rsp + 0x20], 0x3c
mov edx, 0x10a
lea ecx, [rax + 0x10]
lea r8d, [rax + 0x41]
call fcn.14010c170
xor eax, eax
jmp 0x14016046a
cmp dword [rsp + 0x70], 0
jne 0x140160394
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140160455
mov r8d, 0x43
lea rdx, str.cryptoececx_meth.c
lea ecx, [r8 - 0x23]
call fcn.14016fcc0
mov qword [rbx + 0x20], rax
test rax, rax
jne 0x1401603db
lea r9, str.cryptoececx_meth.c
mov dword [rsp + 0x20], 0x45
mov edx, 0x10a
lea ecx, [rax + 0x10]
lea r8d, [rax + 0x41]
call fcn.14010c170
mov r8d, 0x46
jmp 0x14016040f
cmp dword [rsp + 0x70], 2
jne 0x14016043b
mov edx, 0x20
mov rcx, rax
call fcn.140117e60
test eax, eax
jg 0x140160422
mov rcx, qword [rbx + 0x20]
lea rdx, str.cryptoececx_meth.c
mov r8d, 0x4b
call fcn.14016fca0
mov r8d, 0x4c
lea rdx, str.cryptoececx_meth.c
mov rcx, rbx
call fcn.140113a30
xor eax, eax
jmp 0x14016046a
mov rax, qword [rbx + 0x20]
and byte [rax], 0xf8
mov rax, qword [rbx + 0x20]
and byte [rax + 0x1f], 0x7f
mov rax, qword [rbx + 0x20]
or byte [rax + 0x1f], 0x40
jmp 0x140160449
movups xmm0, xmmword [rdi]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rax + 0x10], xmm1
mov rdx, qword [rbx + 0x20]
mov rcx, rbx
call fcn.1401abbd0
mov r8, rbx
mov edx, 0x40a
mov rcx, r14
call fcn.1400f66d0
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
Function at 0x14019fc00
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov ecx, 0x400
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x14019fc58
xor r8d, r8d
mov r9, rax
nop word [rax + rax]
mov ecx, r8d
mov edx, 8
test cl, 1
je 0x14019fc37
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x14019fc39
shr ecx, 1
sub edx, 1
jne 0x14019fc28
mov dword [r9], ecx
inc r8d
add r9, 4
cmp r8d, 0x100
jl 0x14019fc20
mov qword [0x1403d29e0], rax
add rsp, 0x28
ret

Function at 0x14019fc90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov ebx, ecx
test rdx, rdx
jne 0x14019fcbe
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.14019fc60
mov r9, rax
not ebx
test rsi, rsi
je 0x14019fcf3
nop dword [rax]
test dil, 3
je 0x14019fcf3
movzx edx, byte [rdi]
mov ecx, ebx
xor rdx, rcx
inc rdi
shr ecx, 8
movzx eax, dl
mov ebx, dword [r9 + rax*4]
xor ebx, ecx
sub rsi, 1
jne 0x14019fcd0
cmp rsi, 0x10
jb 0x14019fe08
mov r10, rsi
shr r10, 4
imul rax, r10, 0xfffffffffffffff0
add rsi, rax
nop dword [rax + rax]
xor ebx, dword [rdi]
movzx ecx, bl
shr ebx, 8
mov edx, dword [r9 + rcx*4]
xor edx, ebx
movzx ecx, dl
shr edx, 8
mov r8d, dword [r9 + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [r9 + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [r9 + rcx*4]
xor r8d, edx
xor r8d, dword [rdi + 4]
movzx ecx, r8b
shr r8d, 8
mov edx, dword [r9 + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [r9 + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [r9 + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [r9 + rcx*4]
xor r8d, edx
xor r8d, dword [rdi + 8]
movzx ecx, r8b
shr r8d, 8
mov edx, dword [r9 + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [r9 + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [r9 + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [r9 + rcx*4]
xor r8d, edx
xor r8d, dword [rdi + 0xc]
add rdi, 0x10
movzx ecx, r8b
shr r8d, 8
mov edx, dword [r9 + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [r9 + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [r9 + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov ebx, dword [r9 + rcx*4]
xor ebx, edx
sub r10, 1
jne 0x14019fd10
cmp rsi, 4
jb 0x14019fe60
mov r10, rsi
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add rsi, rax
nop dword [rax]
xor ebx, dword [rdi]
add rdi, 4
movzx ecx, bl
shr ebx, 8
mov edx, dword [r9 + rcx*4]
xor edx, ebx
movzx ecx, dl
shr edx, 8
mov r8d, dword [r9 + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [r9 + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov ebx, dword [r9 + rcx*4]
xor ebx, edx
sub r10, 1
jne 0x14019fe20
test rsi, rsi
je 0x14019fe90
nop word [rax + rax]
movzx ecx, byte [rdi]
lea rdi, [rdi + 1]
mov eax, ebx
xor rcx, rax
movzx eax, cl
mov ecx, ebx
shr ecx, 8
mov ebx, dword [r9 + rax*4]
xor ebx, ecx
sub rsi, 1
jne 0x14019fe70
mov rsi, qword [rsp + 0x38]
not ebx
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret