joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006a6b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r13
push r14
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.140150d80
sub rsp, rax
mov r13, qword [rcx + 0x160]
xor r14d, r14d
mov rsi, r8
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x40], r14
mov qword [rcx + 0x48], r14
mov qword [rcx + 0x30], r14
mov qword [rcx + 0x38], r14
mov qword [rcx + 0x170], r14
mov rdi, rdx
mov rbx, rcx
cmp r8, 0xc
jne 0x14006a717
movsd xmm0, qword [rdx]
lea edi, [r8 - 0xb]
movsd qword [rcx], xmm0
mov eax, dword [rdx + 8]
mov dword [rcx + 8], eax
mov byte [rcx + 0xf], 1
jmp 0x14006a889
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], r8
mov rbp, r8
cmp r8, 0x10
jb 0x14006a7c2
mov qword [rsp + 0x60], r12
shr rbp, 4
mov r12, rcx
mov qword [rsp + 0x68], r15
neg r12
lea r15, [rcx + 0xf]
imul rax, rbp, 0xfffffffffffffff0
add rsi, rax
nop dword [rax]
lea r8, [r12 + rdi]
lea rax, [r8 + r15]
cmp rbx, rax
ja 0x14006a790
cmp r15, rdi
jb 0x14006a790
mov rax, rbx
mov edx, reloc.WS2_32.dll_recv
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
lea rax, [rax + 1]
xor byte [rax - 1], cl
dec rdx
jne 0x14006a770
jmp 0x14006a7a0
movdqu xmm1, xmmword [rbx]
movdqu xmm0, xmmword [rdi]
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
lea rdx, [rbx + 0x60]
mov rcx, rbx
call r13
add rdi, 0x10
dec rbp
jne 0x14006a750
mov rbp, qword [rsp + 0x50]
mov r15, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
test rsi, rsi
je 0x14006a86a
cmp rsi, 0x20
jb 0x14006a833
lea rax, [rdi - 1]
lea rcx, [rbx - 1]
add rax, rsi
add rcx, rsi
cmp rbx, rax
ja 0x14006a7e9
cmp rcx, rdi
jae 0x14006a833
mov rax, rsi
mov rdx, rsi
mov rcx, rdi
and eax, 0x1f
sub rdx, rax
mov rax, rbx
sub rcx, rbx
nop
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + rcx]
add r14, 0x20
lea rax, [rax + 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
movdqu xmm1, xmmword [rcx + rax - 0x10]
movdqu xmm0, xmmword [rax - 0x10]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x10], xmm1
cmp r14, rdx
jb 0x14006a800
cmp r14, rsi
jae 0x14006a860
sub rdi, rbx
lea rcx, [r14 + rbx]
sub rsi, r14
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + rdi]
lea rcx, [rcx + 1]
xor byte [rcx - 1], al
dec rsi
jne 0x14006a850
lea rdx, [rbx + 0x60]
mov rcx, rbx
call r13
shl rbp, 3
lea rdx, [rbx + 0x60]
mov rcx, rbx
bswap rbp
xor qword [rbx + 8], rbp
call r13
mov edi, dword [rbx + 0xc]
mov rbp, qword [rsp + 0x58]
bswap edi
mov r8, qword [rbx + 0x180]
lea rdx, [rbx + 0x20]
mov rcx, rbx
call qword [rbx + 0x178]
inc edi
bswap edi
mov dword [rbx + 0xc], edi
add rsp, 0x20
pop r14
pop r13
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006af00
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x68
call fcn.140150d80
sub rsp, rax
mov rax, qword [0x1402274c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx edi, byte [rcx]
mov r10, qword [rsp + 0xd0]
mov rax, qword [rcx + 0x28]
mov r15, qword [rcx + 0x30]
mov rbp, r9
mov r13, r8
mov r12, rdx
mov rbx, rcx
mov qword [rsp + 0x40], r10
mov byte [rsp + 0x30], dil
mov qword [rsp + 0x38], rax
test dil, 0x40
jne 0x14006af6b
lea rdx, [rcx + 0x10]
mov r8, r15
call rax
mov r10, qword [rsp + 0x40]
movzx eax, dil
mov edi, reloc.WS2_32.dll_ntohs
xor esi, esi
and eax, 7
mov r14d, edi
mov ecx, esi
sub r14d, eax
mov byte [rbx], al
cmp r14d, edi
jae 0x14006afa7
mov edx, r14d
add rdx, rbx
sub edi, r14d
movzx eax, byte [rdx]
mov byte [rdx], sil
lea rdx, [rdx + 1]
or rcx, rax
shl rcx, 8
dec rdi
jne 0x14006af91
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xf], 1
or rcx, rax
cmp rcx, rbp
je 0x14006afbf
or eax, 0xffffffff
jmp 0x14006b0cb
mov rdi, rbp
shr rdi, 4
test rdi, rdi
je 0x14006b041
lea rax, [rbx + 0x10]
mov r9, r15
mov r8, rdi
mov qword [rsp + 0x28], rax
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x20], rbx
call r10
shl rdi, 4
add r12, rdi
add r13, rdi
sub rbp, rdi
je 0x14006b089
lea r9, [rbx + 8]
shr rdi, 4
mov rdx, rsi
lea r8, [r9 + 8]
neg r9
nop dword [rax]
movzx eax, byte [r8 - 1]
lea r8, [r8 - 1]
movzx ecx, dil
add rdx, rax
lea rax, [r9 + r8]
shr rdi, 8
add rdx, rcx
mov byte [r8], dl
shr rdx, 8
test rax, rax
je 0x14006b041
test rdi, rdi
jne 0x14006b010
test rdx, rdx
jne 0x14006b010
test rbp, rbp
je 0x14006b089
mov rdi, qword [rsp + 0x38]
lea rdx, [rsp + 0x48]
mov r8, r15
mov rcx, rbx
call rdi
test rbp, rbp
je 0x14006b07d
mov rdx, rsi
movzx ecx, byte [rdx + r12]
movzx eax, byte [rsp + rdx + 0x48]
inc esi
xor ecx, eax
mov byte [rdx + r13], cl
xor byte [rdx + rbx + 0x10], cl
mov edx, esi
cmp rdx, rbp
jb 0x14006b060
lea rcx, [rbx + 0x10]
mov r8, r15
mov rdx, rcx
call rdi
cmp r14d, 0x10
jae 0x14006b0a1
mov ecx, reloc.WS2_32.dll_recv
mov edi, r14d
sub ecx, r14d
add rdi, rbx
xor eax, eax
rep stosb byte [rdi], al
lea rdx, [rsp + 0x48]
mov r8, r15
mov rcx, rbx
call qword [rsp + gethostname]
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x50]
xor qword [rbx + 0x18], rax
movzx eax, byte [rsp + 0x30]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140150a60
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14006bf10
Capabilities:
Hash data using sha1

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.140150d80
sub rsp, rax
lea r8d, [rax + 0x40]
xor edx, edx
mov rbx, rcx
call fcn.140152f60
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x14006c0b0
Capabilities:
Hash data using sha224

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.140150d80
sub rsp, rax
lea r8d, [rax + 0x50]
xor edx, edx
mov rbx, rcx
call fcn.140152f60
mov dword [rbx], 0xc1059ed8
mov dword [rbx + 4], 0x367cd507
mov dword [rbx + 8], 0x3070dd17
mov dword [rbx + 0xc], 0xf70e5939
mov dword [rbx + 0x10], 0xffc00b31
mov dword [rbx + 0x14], 0x68581511
mov dword [rbx + 0x18], 0x64f98fa7
mov dword [rbx + 0x1c], 0xbefa4fa4
mov dword [rbx + 0x6c], Ordinal_30
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x14006c450
Capabilities:
Hash data using sha256

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.140150d80
sub rsp, rax
lea r8d, [rax + 0x50]
xor edx, edx
mov rbx, rcx
call fcn.140152f60
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov dword [rbx + 0x6c], reloc.WLDAP32.dll_Ordinal_32
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x14006efc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, gethostname
call fcn.140150d80
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x14006efe9
lea rax, [0x14006d590]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.140068cb0
lea rax, [0x14006c6f0]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1400689e0

Function at 0x14006fe10
Capabilities:
Hash data with md5

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.140150d80
sub rsp, rax
lea r8d, [rax + 0x3c]
xor edx, edx
mov rbx, rcx
call fcn.140152f60
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x140072fb9
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400731a9
push rbx
mov eax, Ordinal_211
call fcn.140150d80
sub rsp, rax
mov rax, qword [0x1402274c0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea rbp, [r8 - 1]
mov qword [rsp + 0xc0], r15
shr rbp, 3
mov rbx, rdx
lea r14, [rcx + 0xc]
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
shl eax, 8
mov rcx, r14
lea rbx, [rbx + 8]
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
or esi, eax
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x2c], esi
mov dword [rsp + 0x24], esi
call fcn.14005f290
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.14005efe0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 1
call fcn.14005d9b0
mov rcx, r15
call fcn.14005f290
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.14005efe0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
mov r8d, 1
call fcn.14005d9b0
mov r8d, dword [rsp + 0x28]
mov edx, dword [rsp + 0x2c]
xor r8d, edi
xor edi, dword [rsp + 0x20]
xor edx, esi
xor esi, dword [rsp + 0x24]
mov byte [r14], dil
mov eax, edi
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr edi, 0x18
shr eax, 0x10
mov byte [r14 + 2], al
mov byte [r14 + 3], dil
mov byte [r14 + 4], dl
mov eax, edx
shr eax, 8
mov byte [r14 + 5], al
mov eax, edx
shr edx, 0x18
shr eax, 0x10
mov byte [r14 + 6], al
mov byte [r14 + 7], dl
mov byte [r15], r8b
mov eax, r8d
shr eax, 8
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
shr r8d, 0x18
mov byte [r15 + 2], al
mov byte [r15 + 3], r8b
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr esi, 0x18
shr eax, 0x10
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
dec rbp
jne 0x140073020
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140150a60
add rsp, 0xd0
pop rbx
ret
Function at 0x140075f50
Capabilities:
Terminate process

Disassembly:
mov eax, Ordinal_41
call fcn.140150d80
sub rsp, rax
lea r8, [0x1401ffb78]
lea edx, [rax - 0x26]
lea ecx, [rax - 0x1f]
mov r9d, 0xc9
call fcn.14004d570
mov rax, qword [0x14022aa90]
mov edx, 2
test rax, rax
lea rcx, str.0S_a_
lea r8, [0x1401ffb90]
cmovne rcx, rax
mov r9d, 0xcc
mov qword [0x14022aa90], rcx
lea ecx, [rdx + 8]
add rsp, 0x28
jmp fcn.14004d570
Function at 0x140076290
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r10, dword [rdx + 8]
lea rbx, [rcx - 1]
movsxd rcx, dword [r8 + 8]
xor rcx, r10
shr rbx, 0x3f
movsxd rsi, r9d
dec rbx
lea eax, [rsi - 1]
mov r11, r8
and rcx, rbx
mov rdi, rdx
xor r10d, ecx
mov dword [rdx + 8], r10d
xor dword [r8 + 8], ecx
cmp eax, 9
ja case.default.0x1400762e7
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x76490]
add rcx, rdx
jmp rcx
mov r9d, 0xa
cmp r9, rsi
jge case.0x1400762e7.10
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rdi]
mov rcx, qword [rax + r9*8]
lea rdx, [rax + r9*8]
mov rax, qword [r11]
inc r9
mov r8, qword [rax + r9*8 - 8]
xor r8, rcx
and r8, rbx
xor rcx, r8
mov qword [rdx], rcx
mov rax, qword [r11]
xor qword [rax + r9*8 - 8], r8
cmp r9, rsi
jl 0x140076300
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x48]
mov rdx, qword [rax + 0x48]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x48], rcx
mov rax, qword [r11]
xor qword [rax + 0x48], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x40]
mov rdx, qword [rax + 0x40]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x40], rcx
mov rax, qword [r11]
xor qword [rax + 0x40], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x38]
mov rdx, qword [rax + 0x38]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x38], rcx
mov rax, qword [r11]
xor qword [rax + 0x38], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x30]
mov rdx, qword [rax + 0x30]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x30], rcx
mov rax, qword [r11]
xor qword [rax + 0x30], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x28]
mov rdx, qword [rax + 0x28]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x28], rcx
mov rax, qword [r11]
xor qword [rax + 0x28], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x20]
mov rdx, qword [rax + 0x20]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x20], rcx
mov rax, qword [r11]
xor qword [rax + 0x20], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x18]
mov rdx, qword [rax + 0x18]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x18], rcx
mov rax, qword [r11]
xor qword [rax + 0x18], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x10]
mov rdx, qword [rax + 0x10]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x10], rcx
mov rax, qword [r11]
xor qword [rax + 0x10], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 8]
mov rdx, qword [rax + 8]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 8], rcx
mov rax, qword [r11]
xor qword [rax + 8], rdx
mov r8, qword [rdi]
mov rax, qword [r11]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [r8]
mov rcx, qword [rax]
mov rdi, qword [rsp + 0x18]
xor rcx, rdx
and rcx, rbx
mov rbx, qword [rsp + 8]
xor rdx, rcx
mov qword [r8], rdx
mov rax, qword [r11]
xor qword [rax], rcx
ret
Function at 0x1400821c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, Ordinal_41
call fcn.140150d80
sub rsp, rax
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x140082208
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x1400821ed
mov dword [reloc.WS2_32.dll_accept], eax
jmp 0x140082208
xorps xmm2, xmm2
lea rcx, [rsp + 0x38]
mov edx, 8
call fcn.14005f710
cmp dword [reloc.WS2_32.dll_accept], 0
jne 0x140082224
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorps xmm2, xmm2
lea rcx, [rsp + 0x30]
mov edx, 4
mov dword [rsp + 0x30], eax
call fcn.14005f710
add rsp, 0x28
ret
Function at 0x140082a00
Capabilities:
Query environment variable

Disassembly:
push rdi
mov eax, Ordinal_50
call fcn.140150d80
sub rsp, rax
mov rdi, rcx
test rcx, rcx
jne 0x140082a3d
lea r9, [0x140201e88]
lea edx, [rax + 0x3a]
lea ecx, [rax - 0xa]
lea r8d, [rax + 0x13]
mov dword [rsp + 0x20], 0x14a
call fcn.14004cd30
xor eax, eax
add rsp, 0x30
pop rdi
ret
mov edx, reloc.WLDAP32.dll_Ordinal_30
lea r8, [0x140201ea8]
mov r9d, 0x14d
lea ecx, [rdx - 0x15]
mov qword [rsp + 0x40], rbx
call fcn.14004d570
mov rbx, qword [0x14022af78]
test rbx, rbx
je 0x140082ad2
nop dword [rax + rax]
mov r8, qword [rbx]
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140082a93
inc rax
test ecx, ecx
jne 0x140082a80
test edx, edx
je 0x140082aa5
mov rbx, qword [rbx + 0xd0]
test rbx, rbx
jne 0x140082a70
jmp 0x140082ad2
test byte [rbx + 0xa8], 4
je 0x140082acc
call fcn.140083170
mov rcx, rax
test rax, rax
jne 0x140082abf
xor ebx, ebx
jmp 0x140082ad2
mov rdx, rbx
call fcn.140082c50
mov rbx, rcx
jmp 0x140082ad2
inc dword [rbx + 0xac]
mov edx, reloc.WLDAP32.dll_Ordinal_30
lea r8, [0x140201ec8]
mov r9d, 0x164
lea ecx, [rdx - 0x14]
call fcn.14004d570
test rbx, rbx
je 0x140082aff
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea r8, [0x140201ee8]
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140082b23
inc rax
test ecx, ecx
jne 0x140082b10
mov qword [rsp + 0x48], rsi
test edx, edx
je 0x140082bfa
lea rcx, str.OPENSSL_ENGINES
call fcn.140151688
lea rsi, str.C:openssl_64A_tmp_lib_engines
lea rcx, [0x140201f20]
test rax, rax
cmovne rsi, rax
call fcn.140082a00
mov rbx, rax
test rax, rax
je 0x140082bfa
lea rdx, [0x140201ba4]
xor r9d, r9d
mov r8, rdi
mov rcx, rax
call fcn.14008c070
test eax, eax
je 0x140082bfa
lea r8, [0x140201bc4]
lea rdx, str.DIR_LOAD
xor r9d, r9d
mov rcx, rbx
call fcn.14008c070
test eax, eax
je 0x140082bfa
lea rdx, str.DIR_ADD
xor r9d, r9d
mov r8, rsi
mov rcx, rbx
call fcn.14008c070
test eax, eax
je 0x140082bfa
lea r8, [0x140201be4]
lea rdx, [0x140201f40]
xor r9d, r9d
mov rcx, rbx
call fcn.14008c070
test eax, eax
je 0x140082bfa
lea rdx, [0x140201f4c]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call fcn.14008c070
test eax, eax
je 0x140082bfa
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, rbx
call fcn.140083150
mov edx, 0x6a
lea r9, [0x140201f58]
lea ecx, [rdx - 0x44]
lea r8d, [rdx + 0xa]
mov dword [rsp + 0x20], 0x186
call fcn.14004cd30
lea rdx, [0x140201c04]
mov r8, rdi
mov ecx, 2
call fcn.14004c220
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x140083cc0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
mov eax, 0xb8
call fcn.140150d80
sub rsp, rax
mov rax, qword [0x1402274c0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r12, qword [rsp + 0x110]
xor ebx, ebx
mov rbp, r9
movsxd rsi, r8d
mov r14, rdx
mov rdi, rcx
mov eax, ebx
test r9, r9
je 0x140083d26
cmp r9, qword [rcx]
je 0x140083d1c
test rdx, rdx
je 0x140083f19
test r8d, r8d
js 0x140083f19
mov eax, 1
mov qword [rcx], r9
jmp 0x140083d32
mov rbp, qword [rcx]
test rbp, rbp
je 0x140083f19
mov qword [rsp + 0xb0], r15
test rdx, rdx
je 0x140083e15
mov rcx, rbp
call fcn.14005d280
mov r15d, eax
cmp eax, 0x80
jle 0x140083d6d
lea r8, str.j____int_sizeof_ctx__key_
lea rcx, str..cryptohmachmac.c
mov edx, reloc.WS2_32.dll_WSACleanup
call fcn.14004dc30
cmp r15d, esi
jge 0x140083dc4
lea rcx, [rdi + 8]
mov r8, r12
mov rdx, rbp
call fcn.140082420
test eax, eax
je 0x140083f08
lea rcx, [rdi + 8]
mov r8, rsi
mov rdx, r14
call fcn.140082680
test eax, eax
je 0x140083f08
lea r14, [rdi + 0x98]
lea rdx, [rdi + 0x9c]
lea rcx, [rdi + 8]
mov r8, r14
call fcn.140082340
test eax, eax
je 0x140083f08
jmp 0x140083dec
cmp esi, 0x80
ja 0x140083f08
lea rcx, [rdi + 0x9c]
mov r8, rsi
mov rdx, r14
call fcn.140152980
lea r14, [rdi + 0x98]
mov dword [r14], esi
mov ecx, dword [r14]
cmp ecx, 0x80
je 0x140083e1d
mov eax, ecx
mov r8d, 0x80
xor edx, edx
sub r8d, ecx
lea rcx, [rdi + 0x9c]
add rcx, rax
call fcn.140152f60
jmp 0x140083e1d
test eax, eax
je 0x140083ef7
lea rcx, [rsp + 0x20]
mov rax, rdi
mov rdx, rbx
sub rax, rcx
lea rsi, [rax + 0x9c]
lea r14, [rax + 0x9d]
nop dword [rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rsi + rcx]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x80
jl 0x140083e40
lea rcx, [rdi + 0x38]
mov r8, r12
mov rdx, rbp
call fcn.140082420
test eax, eax
je 0x140083f08
mov rcx, rbp
call fcn.14005d280
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x38]
movsxd r8, eax
call fcn.140082680
test eax, eax
je 0x140083f08
nop dword [rax + rax]
lea rcx, [rsp + 0x20]
add rcx, rbx
add rbx, 2
movzx eax, byte [rsi + rcx]
xor al, 0x5c
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x5c
mov byte [rcx + 1], al
cmp rbx, 0x80
jl 0x140083ea0
lea rcx, [rdi + 0x68]
mov r8, r12
mov rdx, rbp
call fcn.140082420
test eax, eax
je 0x140083f08
mov rcx, rbp
call fcn.14005d280
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x68]
movsxd r8, eax
call fcn.140082680
test eax, eax
je 0x140083f08
lea rdx, [rdi + 0x38]
lea rcx, [rdi + 8]
call fcn.140082790
test eax, eax
jne 0x140083f0c
xor eax, eax
jmp 0x140083f11
mov eax, 1
mov r15, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140150a60
add rsp, 0xb8
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14009ccf0
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, gethostname
call fcn.140150d80
sub rsp, rax
mov r11, rcx
cmp dword [rsp + 0x60], r9d
jne 0x14009cddf
movzx r10d, byte [r8]
lea eax, [r10 - 0x6a]
cmp al, 1
ja 0x14009cddf
mov qword [rsp + 0x30], rbx
lea rdx, [r8 + 1]
cmp r10b, 0x6b
jne 0x14009cd8e
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x14009cd4a
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x14009cd4a
cmp cl, 0xbb
jne 0x14009cd7d
inc eax
cmp eax, ebx
jl 0x14009cd34
sub ebx, eax
test eax, eax
jne 0x14009cd92
mov dword [rsp + 0x20], 0x83
lea r9, [0x140206c08]
mov edx, 0x80
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xa]
call fcn.14004cd30
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov dword [rsp + 0x20], 0x7b
lea r9, [0x140206bf0]
jmp 0x14009cd5f
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x14009cdc8
mov edx, 0x80
lea r9, str..crypto_rsa_rsa_x931.c
mov dword [rsp + 0x20], Ordinal_143
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xb]
call fcn.14004cd30
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov r8d, ebx
mov rcx, r11
call fcn.140152980
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
mov edx, 0x80
lea r9, [0x140206bd8]
mov dword [rsp + 0x20], reloc.WS2_32.dll_WSASetLastError
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 9]
call fcn.14004cd30
or eax, 0xffffffff
add rsp, 0x38
ret
Function at 0x1400b3140
Capabilities:
Query environment variable

Disassembly:
mov eax, Ordinal_41
call fcn.140150d80
sub rsp, rax
lea rcx, str.OPENSSL_CONF
call fcn.140151688
test rax, rax
je 0x1400b316a
mov rcx, rax
add rsp, 0x28
jmp fcn.14004f150
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
call fcn.1400c4f20
xor edx, edx
mov ecx, edx
cmp byte [rax], cl
je 0x1400b3192
cmp ecx, 0x80000000
jae 0x1400b3192
inc rax
inc ecx
cmp byte [rax], dl
jne 0x1400b3181
btr ecx, 0x1f
lea rax, [0x140209e30]
inc ecx
cmp byte [reloc.WS2_32.dll_WSAGetLastError], dl
je 0x1400b31b9
cmp edx, 0x80000000
jae 0x1400b31b9
inc rax
inc edx
cmp byte [rax], 0
jne 0x1400b31a7
btr edx, 0x1f
mov r8d, 0x21b
lea ebx, [rdx + rcx]
lea rdx, [0x140209e40]
inc ebx
mov ecx, ebx
call fcn.14004e700
mov rdi, rax
test rax, rax
jne 0x1400b31ed
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
movsxd rbx, ebx
call fcn.1400c4f20
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.14004f220
lea rdx, [0x140209e3c]
mov r8, rbx
mov rcx, rdi
call fcn.14004f1a0
lea rdx, str.openssl.cnf
mov r8, rbx
mov rcx, rdi
call fcn.14004f1a0
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x1400c2580
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.140150d80
sub rsp, rax
mov eax, dword [r8 + 8]
mov rsi, rdx
mov rdi, rcx
cmp dword [rdx + 8], eax
jge 0x1400c25ac
mov rbx, r8
jmp 0x1400c25b2
mov rbx, rdx
mov rsi, r8
mov edx, dword [rbx + 8]
cmp edx, dword [rcx + 0xc]
jg 0x1400c25bf
mov rax, rcx
jmp 0x1400c25c4
call fcn.140076c50
test rax, rax
jne 0x1400c25d9
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor r8d, r8d
cmp dword [rsi + 8], r8d
jle 0x1400c2614
mov r9d, r8d
nop word [rax + rax]
mov rax, qword [rbx]
mov rcx, qword [rsi]
inc r8d
mov rdx, qword [rcx + r9]
lea r9, [r9 + 8]
xor rdx, qword [rax + r9 - 8]
mov rax, qword [rdi]
mov qword [r9 + rax - 8], rdx
cmp r8d, dword [rsi + 8]
jl 0x1400c25f0
cmp r8d, dword [rbx + 8]
jge 0x1400c264c
movsxd rax, r8d
lea rdx, [rax*8]
nop word [rax + rax]
mov rax, qword [rbx]
mov rcx, qword [rdi]
inc r8d
mov rax, qword [rdx + rax]
lea rdx, [rdx + 8]
mov qword [rdx + rcx - 8], rax
cmp r8d, dword [rbx + 8]
jl 0x1400c2630
mov edx, dword [rbx + 8]
mov dword [rdi + 8], edx
test edx, edx
jle 0x1400c2678
lea eax, [rdx - 1]
movsxd rcx, eax
mov rax, qword [rdi]
lea r8, [rax + rcx*8]
mov rax, qword [r8]
lea r8, [r8 - 8]
test rax, rax
jne 0x1400c2675
dec edx
test edx, edx
jg 0x1400c2663
mov dword [rdi + 8], edx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rdi
ret