joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006f5b0
Capabilities:
Send data
Send data on socket
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [rcx + 0x1b8]
mov r12, qword [rcx + 0x20]
mov rsi, rcx
cmp edx, 0x1f
je 0x14006f5e8
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rbp, [rbx + 0x1cd8]
lea rdi, [rbx + 0x1ed8]
cmp rbp, rdi
jb 0x14006f788
mov qword [rbx + 0x1ed8], rbp
lea r13, [rbx + 0x1cdb]
movzx ecx, word [rbx + 0x1ca8]
mov r15, qword [sym.imp.WS2_32.dll_htons]
call r15
movzx ecx, word [rbx + 0x1caa]
mov r14d, eax
call r15
mov rdx, qword [rbx + 0x1ed8]
cmp rdx, rdi
jae 0x14006f6d2
lea rcx, [rdx + 1]
mov qword [rbx + 0x1ed8], rcx
mov byte [rdx], r14b
mov rdx, qword [rbx + 0x1ed8]
cmp rdx, rdi
jae 0x14006f6d2
lea rcx, [rdx + 1]
mov qword [rbx + 0x1ed8], rcx
mov ecx, r14d
mov byte [rdx], ch
mov rdx, qword [rbx + 0x1ed8]
cmp rdx, rdi
jae 0x14006f6d2
lea rcx, [rdx + 1]
mov qword [rbx + 0x1ed8], rcx
mov byte [rdx], al
mov rdx, qword [rbx + 0x1ed8]
cmp rdx, rdi
jae 0x14006f6d2
lea rcx, [rdx + 1]
mov qword [rbx + 0x1ed8], rcx
mov byte [rdx], ah
mov rdx, qword [rbx + 0x1ed8]
cmp rdx, rdi
jae 0x14006f6d2
lea rax, [rdx + 1]
mov qword [rbx + 0x1ed8], rax
mov byte [rdx], 0xff
mov rdx, qword [rbx + 0x1ed8]
cmp rdx, rdi
jae 0x14006f6d2
lea rax, [rdx + 1]
mov qword [rbx + 0x1ed8], rax
mov byte [rdx], 0xf0
mov rdx, qword [rbx + 0x1ed8]
mov qword [rbx + 0x1ee0], rdx
mov qword [rbx + 0x1ed8], rbp
test byte [rsi + 0xa37], 0x10
je 0x14006f704
sub rdx, rbp
lea r8, [rbx + 0x1cda]
mov rcx, rsi
lea r9, [rdx - 2]
mov edx, 0x3e
call sym.printsub.part.0
xor r9d, r9d
mov rdi, qword [sym.imp.WS2_32.dll_send]
mov r8d, 3
mov rdx, rbp
mov rcx, qword [r12 + 0x220]
call rdi
test eax, eax
js 0x14006f7b0
mov r8d, 4
mov rdx, r13
mov rcx, rsi
call sym.send_telnet_data
xor r9d, r9d
mov rcx, qword [r12 + 0x220]
lea rdx, [rbx + 0x1cdf]
mov r8d, 2
call rdi
test eax, eax
jns 0x14006f5d3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.Curl_failf
lea r13, [rbx + 0x1cdb]
mov eax, 0xfffffaff
mov byte [rbx + 0x1cda], 0x1f
mov qword [rbx + 0x1ed8], r13
mov word [rbx + 0x1cd8], ax
jmp 0x14006f60d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call sym.Curl_failf
jmp 0x14006f729
Function at 0x14006f7d0
Capabilities:
Send data
Send data on socket

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
xor r9d, r9d
mov rax, qword [rcx + 0x20]
mov byte [rsp + 0x3e], dl
mov rbx, rcx
mov esi, edx
mov edi, r8d
mov byte [rsp + 0x3f], r8b
lea rdx, [rsp + 0x3d]
mov rcx, qword [rax + 0x220]
mov r8d, 3
mov byte [rsp + 0x3d], 0xff
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x14006f8a8
test byte [rbx + 0xa37], 0x10
je 0x14006f89a
lea r9, [0x14010bd90]
cmp esi, 0xfd
je 0x14006f853
lea r9, str.DONT
cmp esi, 0xfe
je 0x14006f853
cmp esi, 0xfc
lea r9, str.WONT
lea rax, str.WILL
cmovne r9, rax
cmp edi, 0x27
jg 0x14006f8c8
movsxd rdx, edi
lea rax, str.BINARY
mov rax, qword [rax + rdx*8]
test rax, rax
je 0x14006f8d0
mov rdx, qword [rbx + 0x11e8]
test rdx, rdx
je 0x14006f87e
mov edx, dword [rdx + 8]
test edx, edx
jle 0x14006f89a
mov qword [rsp + 0x20], rax
lea r8, str.SENT
lea rdx, [0x14010bd9e]
mov rcx, rbx
call sym.Curl_infof
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbx
mov r8d, eax
call sym.Curl_failf
jmp 0x14006f814
cmp edi, 0xff
je 0x14006f910
mov rax, qword [rbx + 0x11e8]
test rax, rax
je 0x14006f8e3
mov eax, dword [rax + 8]
test eax, eax
jle 0x14006f89a
mov dword [rsp + 0x20], edi
lea r8, str.SENT
lea rdx, str._s__s__d
mov rcx, rbx
call sym.Curl_infof
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
lea rax, str.EXOPL
jmp 0x14006f86b
Function at 0x1400725b0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx]
mov r9, qword [rcx + 0x10]
cmp eax, 2
je 0x140072650
ja 0x1400725e0
test eax, eax
je 0x140072660
add rsp, 0x28
jmp sym.tftp_rx
cmp eax, 3
jne 0x140072628
test r9, r9
je 0x14007261d
test byte [r9 + 0xa37], 0x10
je 0x14007261d
mov rax, qword [r9 + 0x11e8]
test rax, rax
je 0x140072607
mov eax, dword [rax + 8]
test eax, eax
jle 0x14007261d
lea r8, str.TFTP_finished
lea rdx, [0x14010c425]
mov rcx, r9
call sym.Curl_infof
xor eax, eax
jmp 0x140072643
lea r8, str.Internal_state_machine_error
lea rdx, [0x14010c425]
mov rcx, r9
call sym.Curl_failf
mov eax, 0x47
add rsp, 0x28
ret
add rsp, 0x28
jmp sym.tftp_tx
add rsp, 0x28
jmp sym.tftp_send_first
Function at 0x140074250
Capabilities:
Generate random numbers via winapi

Disassembly:
mov rcx, rdx
mov rdx, r8
jmp sym.Curl_win32_random

Function at 0x140074320
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, r8
mov rdi, rcx
mov r8, r9
mov rbp, rdx
mov rcx, rsi
xor edx, edx
mov dword [rsp + 0x3c], r9d
mov rbx, r9
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x38], 4
call sym.memset
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x20], 0xf0000040
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140074398
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1400743f0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x1400743e8
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14007438a
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x1400743c6
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov r8d, ebp
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x48]
test eax, eax
je 0x1400743c1
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x34]
mov edx, 4
mov dword [rsp + 0x20], 0
mov rdi, qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
call rdi
mov rcx, qword [rsp + 0x48]
test eax, eax
je 0x1400743c1
mov eax, dword [rsp + 0x34]
cmp rbx, rax
jb 0x1400743c1
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov r8, rsi
mov edx, 2
call rdi
jmp 0x1400743bc
Function at 0x140074e10
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, r8
mov rdi, rcx
mov r8, r9
mov rbp, rdx
mov rcx, rsi
xor edx, edx
mov dword [rsp + 0x3c], r9d
mov rbx, r9
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x38], 4
call sym.memset
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x20], 0xf0000040
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140074e88
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x140074ee0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x140074ed8
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140074e7a
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x140074eb6
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov r8d, ebp
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x48]
test eax, eax
je 0x140074eb1
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x34]
mov edx, 4
mov dword [rsp + 0x20], 0
mov rdi, qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
call rdi
mov rcx, qword [rsp + 0x48]
test eax, eax
je 0x140074eb1
mov eax, dword [rsp + 0x34]
cmp rbx, rax
jb 0x140074eb1
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov r8, rsi
mov edx, 2
call rdi
jmp 0x140074eac
Function at 0x1400805a0
Capabilities:
Get hostname

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
movsxd rbx, edx
mov rsi, rcx
mov byte [rcx], 0
mov edx, ebx
call qword [sym.imp.WS2_32.dll_gethostname]
mov byte [rsi + rbx - 1], 0
mov edi, eax
test eax, eax
jne 0x1400805d8
mov edx, 0x2e
mov rcx, rsi
call sym.strchr
test rax, rax
je 0x1400805d8
mov byte [rax], 0
mov eax, edi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x1400805f0
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov r9d, 1
mov rsi, rcx
mov rbx, rdx
mov rbp, r8
xor edx, edx
xor r8d, r8d
mov dword [rsp + 0x4c], 8
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140080640
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor eax, eax
mov edx, 0x208
movzx r8d, byte [rbp + 1]
movzx r9d, byte [rbp + 2]
mov word [rsp + 0x62], ax
movzx r10d, byte [rbp + 3]
lea rdi, [rsp + 0x60]
movzx r11d, byte [rbp + 4]
movzx r12d, byte [rbp + 5]
mov word [rsp + 0x60], dx
mov rax, qword [0x14010fbf0]
movzx edx, byte [rbp]
mov qword [rsp + 0x64], rax
mov ecx, edx
movzx eax, byte [rbp + 6]
mov ebp, r8d
shr bpl, 1
shl ecx, 7
or ecx, ebp
mov ebp, r9d
shl r8d, 6
shr bpl, 2
shl r9d, 5
movzx ecx, cl
or r8d, ebp
mov ebp, r10d
shl r10d, 4
shr bpl, 3
movzx r8d, r8b
or r9d, ebp
mov ebp, r11d
shl r11d, 3
shr bpl, 4
movzx r9d, r9b
or r10d, ebp
mov ebp, r12d
shl r12d, 2
shr bpl, 5
movzx r10d, r10b
or r11d, ebp
mov ebp, eax
add eax, eax
shr bpl, 6
movzx eax, al
movzx r11d, r11b
or r12d, ebp
shl rax, 8
movzx r12d, r12b
or rax, r12
shl rax, 8
or rax, r11
shl rax, 8
or rax, r10
shl rax, 8
or rax, r9
shl rax, 8
or rax, r8
shl rax, 8
or rax, rcx
lea rcx, [rsp + 0x6c]
shl rax, 8
or rax, rdx
mov edx, 8
mov qword [rsp + 0x6c], rax
call sym.Curl_des_set_odd_parity
lea rax, [rsp + 0x58]
xor r9d, r9d
mov rdx, rdi
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x50]
mov r8d, 0x14
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x14008079e
mov rax, qword [rsi]
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rbx], rax
mov eax, dword [rsp + 0x4c]
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
nop
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400807c0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rbx, r8
mov rdi, rcx
mov r8, rcx
mov rdx, rbx
mov rcx, rsi
call sym.encrypt_des.isra.0
lea rdx, [rbx + 8]
lea r8, [rdi + 7]
mov rcx, rsi
call sym.encrypt_des.isra.0
lea rdx, [rbx + 0x10]
lea r8, [rdi + 0xe]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.encrypt_des.isra.0
Function at 0x140083530
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [rcx + 0x18]
mov rsi, rdx
lea edx, [rax + rax]
mov eax, dword [rcx + 0x20]
mov rbx, rcx
mov r12d, r8d
lea rcx, [rdx + rax + 0x18]
mov rax, qword [0x140129dc0]
call qword [rax]
mov rdi, rax
test rax, rax
je 0x14008362c
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rdi + 0x10], rax
cmp dword [rbx + 0x1c], r12d
jb 0x140083640
call qword [rbx]
mov ebp, r12d
mov rcx, qword [rdi + 0x10]
call qword [rbx]
test r12d, r12d
je 0x140083670
lea r13, [rsi + rbp]
lea r12, [rsp + 0x2f]
nop dword [rax]
movzx eax, byte [rsi]
add rsi, 1
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r8d, 1
xor eax, 0x36
mov byte [rsp + 0x2f], al
call qword [rbx + 8]
movzx eax, byte [rsi - 1]
mov rcx, qword [rdi + 0x10]
mov rdx, r12
mov r8d, 1
xor eax, 0x5c
mov byte [rsp + 0x2f], al
call qword [rbx + 8]
cmp r13, rsi
jne 0x1400835a8
mov eax, dword [rbx + 0x1c]
cmp rbp, rax
jae 0x14008362c
lea r12, [0x14010fea1]
lea rsi, [0x14010fea0]
nop dword [rax]
mov rcx, qword [rdi + 8]
mov r8d, 1
mov rdx, r12
add rbp, 1
call qword [rbx + 8]
mov rcx, qword [rdi + 0x10]
mov r8d, 1
mov rdx, rsi
call qword [rbx + 8]
mov eax, dword [rbx + 0x1c]
cmp rbp, rax
jb 0x140083600
mov rax, rdi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [rbx]
mov r8d, r12d
mov rdx, rsi
mov rcx, qword [rdi + 8]
call qword [rbx + 8]
mov esi, dword [rbx + 0x18]
add rsi, qword [rdi + 0x10]
mov rcx, rsi
mov rdx, qword [rdi + 8]
call qword [rbx + 0x10]
mov r12d, dword [rbx + 0x20]
mov rcx, qword [rdi + 8]
jmp 0x140083587
xor ebp, ebp
jmp 0x1400835e6
Function at 0x140083f50
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
pxor xmm0, xmm0
mov r9d, 1
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
xor edx, edx
xor r8d, r8d
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140083fa0
mov eax, 2
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0x8002
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140084080
mov rcx, rbx
call sym.curlx_uztoui
mov rdx, rsi
lea rsi, [rsp + 0x3c]
xor r9d, r9d
mov rcx, qword [rsp + 0x48]
mov r8d, eax
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
mov r9, rsi
mov dword [rsp + 0x3c], 0
mov rbx, qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, 2
mov dword [rsp + 0x20], 0
call rbx
cmp dword [rsp + 0x3c], 0x10
je 0x140084060
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x140084050
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x140084040
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x14008402f
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x140084023
mov rcx, qword [rsp + 0x48]
mov r9, rsi
mov r8, rdi
mov edx, 2
mov dword [rsp + 0x20], 0
call rbx
jmp 0x140084019
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x140083f8b

Function at 0x140084150
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push rbx
sub rsp, 0x30
xor edx, edx
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000040
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov edx, eax
mov eax, 0x1b
test edx, edx
je 0x1400841a1
lea rax, [rbx + 8]
mov rcx, qword [rbx]
mov edx, 0x8003
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov edx, eax
xor eax, eax
test edx, edx
je 0x1400841b0
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov qword [rbx], 0
mov eax, 2
jmp 0x1400841a1
Function at 0x1400841d0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000040
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
xor edx, edx
lea rcx, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov edx, eax
mov eax, 0x1b
test edx, edx
je 0x14008429c
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400842e0
mov rcx, rbx
call sym.curlx_uztoui
mov rdx, rsi
lea rsi, [rsp + 0x3c]
xor r9d, r9d
mov rcx, qword [rsp + 0x48]
mov r8d, eax
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
mov r9, rsi
mov dword [rsp + 0x3c], 0
mov rbx, qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, 2
mov dword [rsp + 0x20], 0
call rbx
cmp dword [rsp + 0x3c], 0x10
je 0x1400842a8
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x1400842d8
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x1400842c8
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
mov rcx, qword [rsp + 0x48]
mov r9, rsi
mov r8, rdi
mov edx, 2
mov dword [rsp + 0x20], 0
call rbx
jmp 0x140084286
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x14008429c
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x140084290
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
jmp 0x14008429c
Function at 0x140085320
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
movaps xmmword [rsp], xmm6
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x60], xmm12
mov r8, rcx
mov r10, rdx
test rdx, rdx
je 0x1400854f3
lea rax, [rdx - 1]
cmp rax, 0xe
jbe 0x14008551f
mov rax, rcx
mov rcx, rdx
movdqa xmm10, xmmword [str._a_a_a_a_a_a_a_a_a_a_a_a_a_a_a_a]
movdqa xmm9, xmmword [0x140110140]
and rcx, 0xfffffffffffffff0
movdqa xmm2, xmmword [0x140110150]
movdqa xmm8, xmmword [0x140110160]
pxor xmm3, xmm3
movdqa xmm7, xmmword [0x140110170]
movdqa xmm6, xmmword [str.________________]
lea rdx, [r8 + rcx]
movdqa xmm5, xmmword [0x140110190]
movdqa xmm4, xmmword [0x1401101a0]
nop dword [rax]
movdqu xmm1, xmmword [rax]
add rax, 0x10
movdqa xmm0, xmm1
movdqa xmm11, xmm1
movdqa xmm12, xmm1
psrlw xmm0, 5
psrlw xmm11, 4
pand xmm11, xmm9
psrlw xmm12, 6
pand xmm0, xmm10
pxor xmm0, xmm11
movdqa xmm11, xmm1
pand xmm12, xmm8
psrlw xmm11, 7
pand xmm11, xmm2
pxor xmm11, xmm12
movdqa xmm12, xmm1
pxor xmm0, xmm11
psrlw xmm12, 2
movdqa xmm11, xmm1
psrlw xmm11, 3
pand xmm12, xmm6
pand xmm11, xmm7
pxor xmm11, xmm12
movdqa xmm12, xmm1
psrlw xmm12, 1
pand xmm12, xmm5
pxor xmm11, xmm12
pxor xmm0, xmm11
movdqa xmm11, xmm1
pand xmm1, xmm4
pand xmm0, xmm2
por xmm11, xmm2
pcmpeqb xmm0, xmm3
pand xmm11, xmm0
pandn xmm0, xmm1
por xmm0, xmm11
movups xmmword [rax - 0x10], xmm0
cmp rdx, rax
jne 0x1400853c0
cmp rcx, r10
je 0x1400854f3
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
mov edx, eax
mov r9d, eax
shr r9b, 6
shr dl, 7
xor edx, r9d
mov r9d, eax
shr r9b, 5
xor edx, r9d
mov r9d, eax
shr r9b, 4
xor edx, r9d
mov r9d, eax
shr r9b, 3
xor edx, r9d
mov r9d, eax
shr r9b, 2
xor edx, r9d
mov r9d, eax
shr r9b, 1
xor edx, r9d
mov r9d, eax
or eax, 1
and r9d, 0xfffffffe
and edx, 1
cmovne eax, r9d
mov byte [r8 + rcx], al
add rcx, 1
cmp rcx, r10
jb 0x140085490
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
add rsp, 0x78
ret
xor ecx, ecx
jmp 0x140085490

Function at 0x14008d650
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r8d, 0x1000
mov edx, 1
mov rbx, qword [rcx + 0x28]
mov r9, qword [rbx + 0x28]
mov rsi, rcx
mov rcx, qword [rbx + 0x30]
call sym.fwrite
cmp rax, 0x1000
je 0x14008d68c
mov rax, qword [rsi]
mov rcx, rsi
mov dword [rax + 0x28], 0x25
call qword [rax]
mov rax, qword [rbx + 0x30]
mov qword [rbx + 8], 0x1000
mov qword [rbx], rax
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x14008d750
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r8d, 0x1000
mov rdi, r8
mov rbx, qword [rcx + 0x28]
mov rsi, rcx
mov rcx, qword [rbx + 0x28]
sub rdi, qword [rbx + 8]
jne 0x14008d7b0
call sym.fflush
mov rcx, qword [rbx + 0x28]
call sym.ferror
test eax, eax
je 0x14008d7a0
mov rax, qword [rsi]
mov rcx, rsi
mov dword [rax + 0x28], 0x25
mov rax, qword [rax]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov r9, rcx
mov rcx, qword [rbx + 0x30]
mov r8, rdi
mov edx, 1
call sym.fwrite
cmp rax, rdi
je 0x14008d7d8
mov rax, qword [rsi]
mov rcx, rsi
mov dword [rax + 0x28], 0x25
call qword [rax]
mov rcx, qword [rbx + 0x28]
jmp 0x14008d771

Function at 0x14008eff0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x58
mov qword [rcx + 8], 0
mov rsi, rcx
call sym.jpeg_mem_init
mov edx, 0xa0
mov rcx, rsi
mov dword [rsp + 0x2c], eax
call sym.jpeg_get_small
mov rbx, rax
test rax, rax
je 0x14008f1c0
lea rax, [sym.alloc_large]
lea rdx, [sym.alloc_small]
mov dword [rbx + 0x5c], 0x3b9aca00
movq xmm1, rax
movq xmm0, rdx
lea rax, [sym.alloc_barray]
mov qword [rbx + 0x90], 0xa0
punpcklqdq xmm0, xmm1
lea rdx, [sym.alloc_sarray]
movq xmm2, rax
movups xmmword [rbx], xmm0
movq xmm0, rdx
lea rax, [sym.request_virt_barray]
lea rdx, [sym.request_virt_sarray]
punpcklqdq xmm0, xmm2
movq xmm3, rax
lea rax, [sym.access_virt_sarray]
movups xmmword [rbx + 0x10], xmm0
movq xmm0, rdx
movq xmm4, rax
lea rdx, [sym.realize_virt_arrays]
punpcklqdq xmm0, xmm3
lea rax, [sym.free_pool]
lea rcx, str.JPEGMEM
mov qword [rsp + 0x30], 0
movups xmmword [rbx + 0x20], xmm0
movq xmm0, rdx
lea rdx, [sym.access_virt_barray]
movq xmm5, rax
punpcklqdq xmm0, xmm4
lea rax, [sym.self_destruct]
mov qword [rsp + 0x38], 0
movups xmmword [rbx + 0x30], xmm0
movq xmm0, rdx
mov qword [rbx + 0x50], rax
punpcklqdq xmm0, xmm5
mov eax, dword [rsp + 0x2c]
movups xmmword [rbx + 0x40], xmm0
pxor xmm0, xmm0
mov dword [rbx + 0x58], eax
movups xmmword [rbx + 0x60], xmm0
movups xmmword [rbx + 0x70], xmm0
movups xmmword [rbx + 0x80], xmm0
mov qword [rsi + 8], rbx
mov qword [rsp + 0x3e], 0
mov qword [rsp + 0x46], 0
call sym.getenv
mov rsi, rax
test rax, rax
je 0x14008f164
mov rcx, rax
call sym.strlen
add rax, 1
cmp rax, 0x1e
ja 0x14008f164
lea rcx, [rsp + 0x30]
mov r8d, 0x1e
mov rdx, rsi
call sym.strncpy
cmp byte [rsp + 0x30], 0
mov rcx, rax
jne 0x14008f170
add rsp, 0x58
pop rbx
pop rsi
ret
lea r9, [rsp + 0x2b]
lea r8, [rsp + 0x2c]
mov byte [rsp + 0x2b], 0x78
lea rdx, str._ld_c
call sym.sscanf.constprop.0_3
test eax, eax
jle 0x14008f164
movzx edx, byte [rsp + 0x2b]
mov eax, dword [rsp + 0x2c]
and edx, 0xffffffdf
cmp dl, 0x4d
jne 0x14008f1a6
imul eax, eax, 0x3e8
imul eax, eax, 0x3e8
mov dword [rbx + 0x58], eax
add rsp, 0x58
pop rbx
pop rsi
ret
mov rcx, rsi
call sym.jpeg_mem_term
mov rax, qword [rsi]
mov rcx, rsi
mov qword [rax + 0x28], 0x36
call qword [rax]
jmp 0x14008f023