joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4af010
Capabilities:
Query environment variable

Disassembly:
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.0055e9c0
sub rsp, rax
test rcx, rcx
mov qword [rsp + 0x58], rdi
mov rdi, rcx
jne 0x4af054
lea r9, [0x005d97d8]
lea edx, [rax + 0x32]
lea ecx, [rax - 0x12]
lea r8d, [rax + 0xb]
mov dword [rsp + 0x20], 0x165
call fcn.0047c130
xor eax, eax
mov rdi, qword [rsp + 0x58]
add rsp, 0x38
ret
mov edx, 0x1e
lea r8, [0x005d97f8]
mov r9d, 0x168
lea ecx, [rdx - 0x15]
mov qword [rsp + 0x48], rbx
call fcn.004855c0
mov rbx, qword [0x005ecf80]
test rbx, rbx
je 0x4af0e2
nop
mov r8, qword [rbx]
mov rax, rdi
sub r8, rdi
nop
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x4af0a3
inc rax
test ecx, ecx
jne 0x4af090
test edx, edx
je 0x4af0b5
mov rbx, qword [rbx + 0xd0]
test rbx, rbx
jne 0x4af080
jmp 0x4af0e2
test byte [rbx + 0xa8], 4
je 0x4af0dc
call fcn.004ade10
test rax, rax
mov rcx, rax
jne 0x4af0cf
xor ebx, ebx
jmp 0x4af0e2
mov rdx, rbx
call fcn.004aef50
mov rbx, rcx
jmp 0x4af0e2
inc dword [rbx + 0xac]
mov edx, 0x1e
lea r8, [0x005d9818]
mov r9d, 0x182
lea ecx, [rdx - 0x14]
call fcn.004855c0
test rbx, rbx
je 0x4af113
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x38
ret
lea r8, [0x005d9838]
mov rax, rdi
sub r8, rdi
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x4af133
inc rax
test ecx, ecx
jne 0x4af120
test edx, edx
mov qword [rsp + 0x50], rsi
je 0x4af1ed
lea rcx, str.OPENSSL_ENGINES
call sub.msvcrt.dll_getenv
lea rsi, str.F:_dev_libraries_openssl_1.0.0a_lib_engines
lea rcx, str.dynamic
test rax, rax
cmovne rsi, rax
call fcn.004af010
test rax, rax
mov rbx, rax
je 0x4af1ed
lea rdx, [0x005d9888]
xor r9d, r9d
mov r8, rdi
mov rcx, rax
call fcn.004d5330
test eax, eax
je 0x4af1ed
lea r8, [0x005d988c]
lea rdx, str.DIR_LOAD
xor r9d, r9d
mov rcx, rbx
call fcn.004d5330
test eax, eax
je 0x4af1ed
lea rdx, str.DIR_ADD
xor r9d, r9d
mov r8, rsi
mov rcx, rbx
call fcn.004d5330
test eax, eax
je 0x4af1ed
lea rdx, str.LOAD
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call fcn.004d5330
test eax, eax
je 0x4af1ed
mov rsi, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x38
ret
mov rcx, rbx
call fcn.004adfc0
mov edx, 0x6a
lea r9, [0x005d98b0]
lea ecx, [rdx - 0x44]
lea r8d, [rdx + 0xa]
mov dword [rsp + 0x20], 0x1a1
call fcn.0047c130
lea rdx, [0x005d98cc]
mov r8, rdi
mov ecx, 2
call fcn.0047bb00
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x38
ret
Function at 0x4b5390
Capabilities:
Check if file exists

Disassembly:
push rbp
mov eax, reloc.WS2_32.dll_WSASetLastError
call fcn.0055e9c0
sub rsp, rax
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x38], rdi
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x28], r13
mov rax, qword [0x005ca070]
mov qword [rbp + 0x10], rax
xor edi, edi
mov rsi, rdx
mov r12, rcx
mov ebx, edi
mov rax, rcx
cmp byte [rcx], bl
je 0x4b53e6
cmp ebx, 0x80000000
jae 0x4b53e6
inc rax
inc ebx
cmp byte [rax], dil
jne 0x4b53d4
mov r8, rcx
btr ebx, 0x1f
mov edx, 8
lea r9d, [rbx + 1]
mov ecx, 0xfde9
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
movsxd r9, eax
jle 0x4b54c4
mov rax, r9
add rax, rax
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.0055e9c0
sub rsp, rax
mov r8, r12
mov dword [rsp + 0x28], r9d
lea r13, [rsp + 0x30]
lea r9d, [rbx + 1]
mov edx, 8
mov ecx, 0xfde9
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x4b54e8
cmp byte [rsi], dil
mov rax, rsi
je 0x4b5473
cmp edi, 0x80000000
jae 0x4b5473
inc rax
inc edi
cmp byte [rax], 0
jne 0x4b5461
lea rax, [rbp]
btr edi, 0x1f
mov r8, rsi
lea r9d, [rdi + 1]
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x4b54e8
lea rdx, [rbp]
mov rcx, r13
call sub.msvcrt.dll__wfopen
test rax, rax
mov rbx, rax
jne 0x4b5585
call sub.msvcrt.dll__errno
cmp dword [rax], 2
jne 0x4b54df
jmp 0x4b54d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x459
jne 0x4b54e8
mov rdx, rsi
mov rcx, r12
call sub.msvcrt.dll_fopen
mov rbx, rax
test rbx, rbx
jne 0x4b5585
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 1
lea r9, [0x005d9a00]
lea ecx, [rdx + 1]
mov r8d, eax
mov dword [rsp + 0x20], 0xa3
call fcn.0047c130
lea r11, [0x005d9a18]
lea r9, [0x005d9a1c]
mov qword [rsp + 0x28], r11
lea rdx, [0x005d9a20]
mov r8, r12
mov ecx, 5
mov qword [rsp + 0x20], rsi
call fcn.0047bb00
call sub.msvcrt.dll__errno
mov edx, WSASetLastError
cmp dword [rax], 2
lea ecx, [rdx - 0x4d]
jne 0x4b5567
lea r9, [0x005d9a28]
lea r8d, [rdx + 0x13]
mov dword [rsp + 0x20], 0xa6
call fcn.0047c130
xor eax, eax
jmp 0x4b55c6
lea r9, [0x005d9a40]
mov r8d, 2
mov dword [rsp + 0x20], 0xa8
call fcn.0047c130
xor eax, eax
jmp 0x4b55c6
lea rcx, [0x005d99b0]
call fcn.004793b0
test rax, rax
mov rdi, rax
jne 0x4b55a5
mov rcx, rbx
call sub.msvcrt.dll_fclose
xor eax, eax
jmp 0x4b55c6
xor edx, edx
mov rcx, rax
call fcn.00478520
mov edx, 0x6a
mov r9, rbx
lea r8d, [rdx - 0x69]
mov rcx, rdi
call fcn.00478ba0
mov rax, rdi
mov rcx, qword [rbp + 0x10]
call fcn.0055e990
mov rbx, qword [rbp + 0x60]
mov rsi, qword [rbp + 0x68]
mov rdi, qword [rbp + 0x38]
mov r12, qword [rbp + 0x30]
mov r13, qword [rbp + 0x28]
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x4d06f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x58
call fcn.0055e9c0
sub rsp, rax
cmp r8, 0x10
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov r13, qword [rsp + 0x88]
mov qword [rsp + 0x20], r14
mov r14, qword [rsp + 0x80]
mov r10, r14
mov r12, r9
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
jb 0x4d07a8
mov qword [rsp + 0x40], rsi
mov rsi, r8
shr rsi, 4
mov rax, rsi
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
nop
nop
nop
mov r8, rbx
sub r10, rbp
mov rcx, rbp
sub r8, rbp
mov edx, 2
mov rax, qword [r10 + rcx]
add rcx, 8
xor rax, qword [rcx - 8]
dec rdx
mov qword [r8 + rcx - 8], rax
jne 0x4d0771
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
mov r10, rbx
add rbx, 0x10
add rbp, 0x10
dec rsi
jne 0x4d0760
mov rsi, qword [rsp + 0x40]
test rdi, rdi
je 0x4d0837
mov rdx, r10
mov r9, rbx
xor r8d, r8d
sub rdx, rbp
sub r9, rbp
mov rcx, rbp
cmp r8, rdi
jae 0x4d07e2
movzx eax, byte [rcx + rdx]
inc r8
inc rcx
xor al, byte [rcx - 1]
cmp r8, 0x10
mov byte [rcx + r9 - 1], al
jb 0x4d07c3
jmp 0x4d0810
cmp r8, 0x10
jae 0x4d0810
mov edx, reloc.WS2_32.dll_recv
sub r10, rbx
lea rcx, [r8 + rbx]
sub rdx, r8
nop
nop
nop
movzx eax, byte [r10 + rcx]
inc rcx
dec rdx
mov byte [rcx - 1], al
jne 0x4d0800
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
cmp rdi, 0x10
mov r10, rbx
jbe 0x4d0837
add rbp, 0x10
add rbx, 0x10
sub rdi, 0x10
jne 0x4d07b1
mov rax, qword [r10]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov qword [r14], rax
mov rax, qword [r10 + 8]
mov qword [r14 + 8], rax
mov r14, qword [rsp + 0x20]
add rsp, 0x58
ret
Function at 0x4d0870
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x98
call fcn.0055e9c0
sub rsp, rax
mov rax, qword [0x005ca070]
mov qword [rsp + 0x48], rax
cmp rcx, rdx
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x68], r13
mov r13, qword [rsp + 0xc0]
mov qword [rsp + 0x58], r15
mov rdi, r8
mov rbp, rdx
mov qword [rsp + 0x30], r13
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov r15, r9
je 0x4d095f
cmp r8, 0x10
mov rsi, r13
jb 0x4d0946
mov r12, r8
shr r12, 4
mov rax, r12
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
mov qword [rsp + 0x28], rdi
mov rdi, qword [rsp + 0x20]
mov r8, r15
mov rdx, rbp
mov rcx, rbx
call rdi
mov r11, rbp
sub rsi, rbp
mov ecx, 2
nop
nop
mov rax, qword [rsi + r11]
add r11, 8
xor qword [r11 - 8], rax
dec rcx
jne 0x4d0920
mov rsi, rbx
add rbp, 0x10
add rbx, 0x10
dec r12
jne 0x4d0904
mov rdi, qword [rsp + 0x28]
mov rax, qword [rsi]
mov qword [r13], rax
mov rax, qword [rsi + 8]
mov qword [r13 + 8], rax
mov rax, qword [rsp + 0x20]
jmp 0x4d0a0a
cmp r8, 0x10
jb 0x4d0a0a
lea rax, [rsp + 0x38]
mov qword [rsp + 0x60], r14
mov rsi, rdx
sub r13, rax
lea rax, [rsp + 0x38]
mov r14, r8
sub rsi, rax
shr r14, 4
lea rax, [rsp + 0x38]
mov r12, rcx
sub r12, rax
mov rax, r14
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
mov rax, r14
shl rax, 4
add rbp, rax
mov qword [rsp + 0x28], rbp
mov rbp, qword [rsp + 0x20]
lea rdx, [rsp + 0x38]
mov r8, r15
mov rcx, rbx
call rbp
xor r11d, r11d
lea rdx, [rsp + r11 + 0x38]
add r11, 8
mov rax, qword [r13 + rdx]
mov rcx, qword [r12 + rdx]
xor rax, qword [rdx]
cmp r11, 0x10
mov qword [rsi + rdx], rax
mov qword [r13 + rdx], rcx
jb 0x4d09c1
add rbx, 0x10
add r12, 0x10
add rsi, 0x10
dec r14
jne 0x4d09b1
mov rbp, qword [rsp + 0x28]
mov rax, qword [rsp + 0x20]
mov r13, qword [rsp + 0x30]
mov r14, qword [rsp + 0x60]
test rdi, rdi
je 0x4d0abf
lea rcx, [rsp + 0x38]
mov r12, r13
mov rsi, rbx
sub r12, rcx
lea rcx, [rsp + 0x38]
sub rbp, rcx
lea rcx, [rsp + 0x38]
sub rsi, rcx
lea rdx, [rsp + 0x38]
mov r8, r15
mov rcx, rbx
call rax
xor r11d, r11d
cmp r11, rdi
jae 0x4d0a74
movzx ecx, byte [rsp + r11 + 0x38]
lea rax, [rsi + r11]
lea rdx, [r12 + r11]
movzx r8d, byte [rsp + rax + 0x38]
xor cl, byte [rsp + rdx + 0x38]
lea rax, [r11 + rbp]
inc r11
mov byte [rsp + rax + 0x38], cl
mov byte [rsp + rdx + 0x38], r8b
cmp r11, 0x10
jb 0x4d0a41
cmp rdi, 0x10
jbe 0x4d0a93
mov rax, qword [rsp + 0x20]
add rbx, 0x10
add rsi, 0x10
add rbp, 0x10
sub rdi, 0x10
jne 0x4d0a31
jmp 0x4d0abf
cmp r11, 0x10
jae 0x4d0abf
mov edx, reloc.WS2_32.dll_recv
sub rbx, r13
lea rcx, [r13 + r11]
sub rdx, r11
nop
nop
movzx eax, byte [rbx + rcx]
inc rcx
dec rdx
mov byte [rcx - 1], al
jne 0x4d0ab0
mov r15, qword [rsp + 0x58]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x48]
call fcn.0055e990
add rsp, 0x98
ret
Function at 0x4d0e30
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x78
call fcn.0055e9c0
sub rsp, rax
mov rax, qword [0x005ca070]
mov qword [rsp + 0x48], rax
mov r10, qword [rsp + 0xb0]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x60], rsi
mov rsi, qword [rsp + 0xa0]
lea eax, [r8 - 1]
cmp eax, 0x7f
mov qword [rsp + 0x58], rdi
mov ebp, r8d
mov rdi, rdx
mov rbx, rcx
ja 0x4d0fef
mov rax, qword [rsi]
lea rcx, [rsp + 0x20]
mov r8, r9
mov qword [rcx], rax
mov rax, qword [rsi + 8]
mov rdx, rsi
mov qword [rcx + 8], rax
mov rcx, rsi
call r10
lea eax, [rbp + 7]
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp dword [rsp + 0xa8], 0
movsxd r9, eax
je 0x4d0ee9
test eax, eax
jle 0x4d0f2d
lea rdx, [rsp + 0x30]
mov rcx, rsi
sub rdx, rbx
sub rcx, rbx
sub rdi, rbx
movzx eax, byte [rcx + rbx]
inc rbx
xor al, byte [rbx - 1]
dec r9
mov byte [rdx + rbx - 1], al
mov byte [rdi + rbx - 1], al
jne 0x4d0ed0
jmp 0x4d0f2d
xor r8d, r8d
test eax, eax
jle 0x4d0f2d
lea rax, [rsp + 0x30]
mov r10, rsi
sub rbx, rax
lea rax, [rsp + 0x30]
sub r10, rax
lea rax, [rsp + 0x30]
sub rdi, rax
nop
nop
lea rdx, [rsp + r8 + 0x30]
inc r8
movzx ecx, byte [rbx + rdx]
movzx eax, byte [r10 + rdx]
xor al, cl
cmp r8, r9
mov byte [rdx], cl
mov byte [rdi + rdx], al
jl 0x4d0f10
mov eax, ebp
cdq
mov ecx, eax
and edx, 7
add eax, edx
sar ecx, 3
and eax, 7
sub eax, edx
test eax, eax
mov r11d, eax
jne 0x4d0f5f
movsxd rcx, ecx
mov rax, qword [rsp + rcx + 0x20]
mov qword [rsi], rax
mov rax, qword [rsp + rcx + 0x28]
mov qword [rsi + 8], rax
jmp 0x4d0fef
movsxd rax, ecx
mov r10d, 8
mov edi, 4
sub r10b, r11b
inc rsi
lea rbx, [rsp + rax + 0x21]
nop
nop
movzx r8d, byte [rbx]
movzx r9d, byte [rbx + 1]
movzx edx, byte [rbx - 1]
mov ecx, r11d
movzx eax, r8b
add rsi, 4
shl dl, cl
movzx ecx, r10b
add rbx, 4
shr al, cl
mov ecx, r11d
or dl, al
shl r8b, cl
movzx eax, r9b
mov byte [rsi - 5], dl
movzx edx, byte [rbx - 2]
movzx ecx, r10b
shr al, cl
mov ecx, r11d
or r8b, al
shl r9b, cl
movzx ecx, r10b
movzx eax, dl
mov byte [rsi - 4], r8b
shr al, cl
or r9b, al
movzx eax, byte [rbx - 1]
shr al, cl
mov ecx, r11d
mov byte [rsi - 3], r9b
shl dl, cl
or al, dl
dec rdi
mov byte [rsi - 2], al
jne 0x4d0f80
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
call fcn.0055e990
add rsp, 0x78
ret
Function at 0x4d1230
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov eax, 0x68
call fcn.0055e9c0
sub rsp, rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rsi
mov rsi, qword [rsp + 0x98]
mov ebx, dword [rsi]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r12
test ebx, ebx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
mov r14, qword [rsp + 0x90]
mov r10, r9
mov rdi, r8
mov r12, rdx
mov r13, rcx
je 0x4d12a7
test rdi, rdi
je 0x4d12a7
mov eax, ebx
inc r12
inc r13
movzx ecx, byte [rax + r14]
dec rdi
xor cl, byte [r13 - 1]
inc ebx
and ebx, 0xf
mov byte [r12 - 1], cl
jne 0x4d1282
cmp rdi, 0x10
mov r9, qword [rsp + 0xa0]
mov qword [rsp + 0x28], r15
movsxd r15, ebx
jb 0x4d1380
mov rsi, r12
mov rcx, rdi
mov qword [rsp + 0x58], rbp
shr rcx, 4
mov rbp, r13
sub rsi, r14
mov rax, rcx
sub rbp, r14
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
mov rax, rcx
shl rax, 4
add r12, rax
add r13, rax
mov qword [rsp + 0x70], r13
mov r13, qword [rsp + 0x88]
mov qword [rsp + 0x78], r12
mov r12, rcx
nop
nop
nop
mov r8, r13
mov rdx, r14
mov rcx, r14
call r9
cmp ebx, 0x10
jae 0x4d1347
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [r15 + r14]
sub edx, ebx
shr edx, 3
inc edx
mov rax, qword [rcx + rbp]
add rcx, 8
xor rax, qword [rcx - 8]
dec rdx
mov qword [rsi + rcx - 8], rax
jne 0x4d1331
mov r9, qword [rsp + 0xa0]
add rsi, 0x10
add rbp, 0x10
xor ebx, ebx
xor r15d, r15d
dec r12
jne 0x4d1310
mov r12, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x98]
mov r10, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x58]
test rdi, rdi
mov r15, qword [rsp + 0x28]
je 0x4d13c5
mov r8, r10
mov rdx, r14
mov rcx, r14
call r9
movsxd rcx, ebx
sub r13, r14
add rcx, r14
sub r12, r14
add ebx, edi
nop
nop
nop
movzx eax, byte [rcx + r13]
inc rcx
xor al, byte [rcx - 1]
dec rdi
mov byte [rcx + r12 - 1], al
jne 0x4d13b0
mov r14, qword [rsp + 0x30]
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov dword [rsi], ebx
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x4f5810
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.0055e9c0
sub rsp, rax
mov eax, dword [r8 + 8]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rsi
cmp dword [rdx + 8], eax
mov qword [rsp + 0x48], rdi
mov rsi, rdx
mov rdi, rcx
jge 0x4f5840
mov rbx, r8
jmp 0x4f5846
mov rbx, rdx
mov rsi, r8
mov edx, dword [rbx + 8]
cmp edx, dword [rcx + 0xc]
jg 0x4f5853
mov rax, rcx
jmp 0x4f5858
call fcn.00488590
test rax, rax
jne 0x4f5871
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
add rsp, 0x28
ret
xor r8d, r8d
cmp dword [rsi + 8], r8d
jle 0x4f58a4
mov r9, r8
nop
mov rax, qword [rbx]
mov rcx, qword [rsi]
inc r8d
mov rdx, qword [rcx + r9]
add r9, 8
xor rdx, qword [rax + r9 - 8]
mov rax, qword [rdi]
mov qword [r9 + rax - 8], rdx
cmp r8d, dword [rsi + 8]
jl 0x4f5880
cmp r8d, dword [rbx + 8]
movsxd rdx, r8d
jge 0x4f58cd
shl rdx, 3
mov rax, qword [rbx]
mov rcx, qword [rdi]
inc r8d
mov rax, qword [rdx + rax]
add rdx, 8
mov qword [rdx + rcx - 8], rax
cmp r8d, dword [rbx + 8]
jl 0x4f58b1
mov edx, dword [rbx + 8]
test edx, edx
mov dword [rdi + 8], edx
jle 0x4f58f9
lea eax, [rdx - 1]
movsxd rcx, eax
mov rax, qword [rdi]
lea r8, [rax + rcx*8]
mov rax, qword [r8]
sub r8, 8
test rax, rax
jne 0x4f58f6
dec edx
test edx, edx
jg 0x4f58e4
mov dword [rdi + 8], edx
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x28
ret
Function at 0x4fff90
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x218
call fcn.0055e9c0
sub rsp, rax
mov rax, qword [0x005ca070]
mov qword [rsp + 0x1c0], rax
mov qword [rsp + 0x210], rbx
mov qword [rsp + 0x208], rbp
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0x1f8], rdi
mov rdi, qword [rsp + 0x258]
mov qword [rsp + 0x1f0], r12
mov qword [rsp + 0x1e8], r13
mov r13, rcx
mov qword [rsp + 0x1d8], r15
mov r15, qword [rsp + 0x248]
mov r12d, 1
movsxd rbx, r9d
mov rcx, r15
mov qword [rsp + 0x50], r8
mov esi, edx
mov dword [rsp + 0x44], r12d
call fcn.00481aa0
test eax, eax
mov ebp, eax
mov dword [rsp + 0x48], eax
jns 0x500025
xor eax, eax
jmp 0x5001cd
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x1e0], r14
call fcn.00513e70
test r13, r13
mov r14d, dword [rsp + 0x250]
jne 0x500048
xor esi, esi
jmp 0x50006e
cmp esi, 0xffffffff
jne 0x50006e
xor esi, esi
mov rax, r13
cmp byte [r13], sil
je 0x50006a
cmp esi, 0x80000000
jae 0x50006a
inc rax
inc esi
cmp byte [rax], 0
jne 0x500058
btr esi, 0x1f
test r14d, r14d
je 0x5001b6
mov qword [rsp + 0x58], rbx
nop
mov eax, r12d
mov ebx, r14d
cmp r14d, ebp
cmovg ebx, ebp
shr eax, 0x18
lea rcx, [rsp + 0x60]
mov byte [rsp + 0x40], al
mov eax, r12d
mov r9, r15
shr eax, 0x10
mov r8d, esi
mov rdx, r13
mov byte [rsp + 0x41], al
mov eax, r12d
mov dword [rsp + 0x4c], ebx
shr eax, 8
mov byte [rsp + 0x43], r12b
mov qword [rsp + 0x20], 0
mov byte [rsp + 0x42], al
call fcn.00513ac0
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.00513d70
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
mov r8d, 4
call fcn.00513d70
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x60]
xor r8d, r8d
call fcn.00513d90
movsxd rbp, ebx
lea rdx, [rsp + 0x180]
mov r8, rbp
mov rcx, rdi
call fcn.004435a0
mov eax, dword [rsp + 0x240]
cmp eax, 1
jle 0x50019e
movsxd r12, dword [rsp + 0x48]
lea ebx, [rax - 1]
lea rax, [rsp + 0x180]
mov qword [rsp + 0x30], 0
lea r9, [rsp + 0x180]
mov qword [rsp + 0x28], rax
mov r8d, esi
mov rdx, r13
mov rcx, r15
mov qword [rsp + 0x20], r12
call fcn.00514090
test rbp, rbp
jle 0x500190
lea r8, [rsp + 0x180]
mov rcx, rdi
mov rdx, rbp
sub r8, rdi
nop
nop
movzx eax, byte [r8 + rcx]
inc rcx
xor byte [rcx - 1], al
dec rdx
jne 0x500180
dec rbx
jne 0x500134
mov r12d, dword [rsp + 0x44]
mov ebx, dword [rsp + 0x4c]
inc r12d
add rdi, rbp
sub r14d, ebx
mov ebp, dword [rsp + 0x48]
mov dword [rsp + 0x44], r12d
jne 0x500080
lea rcx, [rsp + 0x60]
call fcn.00513f60
mov r14, qword [rsp + 0x1e0]
mov eax, 1
mov r15, qword [rsp + 0x1d8]
mov r13, qword [rsp + 0x1e8]
mov r12, qword [rsp + 0x1f0]
mov rdi, qword [rsp + 0x1f8]
mov rsi, qword [rsp + 0x200]
mov rbp, qword [rsp + 0x208]
mov rbx, qword [rsp + 0x210]
mov rcx, qword [rsp + 0x1c0]
call fcn.0055e990
add rsp, 0x218
ret
Function at 0x505fb0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x28
call fcn.0055e9c0
sub rsp, rax
lea rcx, str.OPENSSL_CONF
call sub.msvcrt.dll_getenv
test rax, rax
je 0x505fda
mov rcx, rax
add rsp, 0x28
jmp fcn.0048f9d0
call fcn.0051bee0
xor edx, edx
mov ecx, edx
cmp byte [rax], cl
je 0x505ff8
cmp ecx, 0x80000000
jae 0x505ff8
inc rax
inc ecx
cmp byte [rax], dl
jne 0x505fe7
btr ecx, 0x1f
lea rax, [0x005e4df8]
inc ecx
cmp byte [reloc.WS2_32.dll_WSAGetLastError], dl
je 0x506022
nop
cmp edx, 0x80000000
jae 0x506022
inc rax
inc edx
cmp byte [rax], 0
jne 0x506010
btr edx, 0x1f
mov qword [rsp + 0x40], rbx
mov r8d, 0x231
lea ebx, [rdx + rcx + 1]
lea rdx, [0x005e4e08]
mov qword [rsp + 0x48], rdi
mov ecx, ebx
call fcn.004844e0
test rax, rax
mov rdi, rax
jne 0x50605f
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x28
ret
movsxd rbx, ebx
call fcn.0051bee0
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.0048f7c0
lea rdx, [0x005e4e24]
mov r8, rbx
mov rcx, rdi
call fcn.0048f820
lea rdx, str.openssl.cnf
mov r8, rbx
mov rcx, rdi
call fcn.0048f820
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x28
ret
Function at 0x513ac0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0xf8
call fcn.0055e9c0
sub rsp, rax
mov rax, qword [0x005ca070]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xc0], r14
xor eax, eax
test r9, r9
mov qword [rsp + 0xb8], r15
mov r15, qword [rsp + 0x120]
mov r12, r9
movsxd rdi, r8d
mov r14, rdx
mov rsi, rcx
je 0x513b29
mov eax, 1
mov qword [rcx], r9
jmp 0x513b2c
mov r12, qword [rcx]
test rdx, rdx
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xe8], rbp
mov qword [rsp + 0xc8], r13
je 0x513c25
mov rcx, r12
call fcn.00481a70
mov ebx, 0x80
cmp eax, ebx
mov ebp, eax
jle 0x513b76
lea r8, str.j____int_sizeof_ctx__key_
lea edx, [rbx - 0x2e]
lea rcx, [0x005e6448]
call fcn.00485560
cmp ebp, edi
jge 0x513bcc
lea rcx, [rsi + 8]
mov r8, r15
mov rdx, r12
call fcn.0049d4a0
test eax, eax
je 0x513d10
lea rcx, [rsi + 8]
mov r8, rdi
mov rdx, r14
call fcn.0049d710
test eax, eax
je 0x513d10
lea rbp, [rsi + 0x98]
lea rdx, [rsi + 0x9c]
lea rcx, [rsi + 8]
mov r8, rbp
call fcn.0049d730
test eax, eax
je 0x513d10
jmp 0x513c08
test edi, edi
js 0x513bd4
cmp edi, ebx
jle 0x513bec
lea r8, str.len_0__len__int_sizeof_ctx__key_
lea rcx, str..cryptohmachmac.c
mov edx, 0x5f
call fcn.00485560
lea rcx, [rsi + 0x9c]
mov r8, rdi
mov rdx, r14
call fcn.004435a0
lea rbp, [rsi + 0x98]
mov dword [rbp], edi
mov eax, dword [rbp]
cmp eax, ebx
je 0x513c2d
sub ebx, eax
lea rcx, [rax + rsi + 0x9c]
xor edx, edx
mov r8d, ebx
call sub.msvcrt.dll_memset
jmp 0x513c2d
test eax, eax
je 0x513cff
lea rbx, [rsi + 0x9d]
mov edi, 0x40
lea rcx, [rsp + 0x21]
mov rdx, rbx
mov r8, rdi
nop
nop
nop
movzx eax, byte [rdx - 1]
add rcx, 2
add rdx, 2
xor al, 0x36
mov byte [rcx - 3], al
movzx eax, byte [rdx - 2]
xor al, 0x36
dec r8
mov byte [rcx - 2], al
jne 0x513c50
lea rcx, [rsi + 0x38]
mov r8, r15
mov rdx, r12
call fcn.0049d4a0
test eax, eax
je 0x513d10
mov rcx, r12
call fcn.00481a70
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x38]
movsxd r8, eax
call fcn.0049d710
test eax, eax
je 0x513d10
lea rdx, [rsp + 0x21]
nop
nop
movzx eax, byte [rbx - 1]
add rdx, 2
add rbx, 2
xor al, 0x5c
mov byte [rdx - 3], al
movzx eax, byte [rbx - 2]
xor al, 0x5c
dec rdi
mov byte [rdx - 2], al
jne 0x513cb0
lea rcx, [rsi + 0x68]
mov r8, r15
mov rdx, r12
call fcn.0049d4a0
test eax, eax
je 0x513d10
mov rcx, r12
call fcn.00481a70
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x68]
movsxd r8, eax
call fcn.0049d710
test eax, eax
je 0x513d10
lea rdx, [rsi + 0x38]
lea rcx, [rsi + 8]
call fcn.0049da30
test eax, eax
jne 0x513d14
xor eax, eax
jmp 0x513d19
mov eax, 1
mov r15, qword [rsp + 0xb8]
mov r14, qword [rsp + 0xc0]
mov r13, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xa0]
call fcn.0055e990
add rsp, 0xf8
ret