joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466a60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
mov rdx, qword [rax + 0x91d8]
mov edx, dword [rdx + 0x18]
test edx, edx
jne 0x466ad1
cmp byte [rax + 0x436], 0
jne 0x466af0
cmp byte [rax + 0x44e], 0
je 0x466b12
mov r8, qword [rcx + 0x610]
test r8, r8
je 0x466b20
cmp byte [rax + 0x441], 0
lea rcx, [rcx + 0x590]
jne 0x466b00
lea rdx, str.PRET_RETR__s
call fcn.00483070
test eax, eax
jne 0x466acb
mov dword [rbx + 0x638], 0x1d
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov r8d, 0xd
mov edx, 1
mov dword [rcx + 0x638], 0xd
add rsp, 0x20
pop rbx
jmp fcn.004667e0
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.00464dc0
lea rdx, str.PRET_STOR__s
call fcn.00483070
test eax, eax
je 0x466abf
jmp 0x466acb
add rsp, 0x20
pop rbx
jmp fcn.00464910
mov r8, qword [rax + 0x498]
test r8, r8
je 0x466b4c
lea rcx, [rbx + 0x590]
lea rdx, str.PRET__s
call fcn.00483070
test eax, eax
je 0x466abf
jmp 0x466acb
cmp byte [rax + 0x435], 0
lea r8, str.NLST
lea rax, [0x006624cf]
cmove r8, rax
jmp 0x466b2c

Function at 0x466b70
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
mov rax, qword [rax + 0x91d8]
mov ecx, dword [rax + 0x18]
test ecx, ecx
je 0x466bc0
cmp qword [rbx + 0x610], 0
je 0x466bc0
lea rcx, [rbx + 0x590]
lea rdx, str.REST__d
xor r8d, r8d
call fcn.00483070
test eax, eax
jne 0x466bb7
mov dword [rbx + 0x638], 0x1a
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.00466a60

Function at 0x466bd0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rax, qword [rcx]
cmp byte [rax + 0x43f], 0
mov r8, qword [rax + 0x91d8]
je 0x466770
cmp qword [rcx + 0x610], 0
je 0x466770
movzx edx, byte [rax + 0x433]
movsx r9d, byte [rcx + 0x628]
cmp dl, 1
sbb eax, eax
and eax, 8
add eax, 0x41
cmp r9d, eax
je 0x466770
mov dword [r8 + 0x18], 1
mov r8d, 0x13
jmp fcn.004666b0
jmp 0x466bd0
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
mov rax, qword [rax + 0x91d8]
cmp dword [rax + 0x18], 1
je 0x466bf5
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.00466b70
mov r8, qword [rcx + 0x610]
test r8, r8
je 0x466be8
lea rcx, [rcx + 0x590]
lea rdx, str.SIZE__s
call fcn.00483070
test eax, eax
jne 0x466c22
mov dword [rbx + 0x638], 0x17
add rsp, 0x20
pop rbx
ret
Function at 0x466c30
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp edx, 0x13
mov rbx, rcx
je 0x466c80
cmp edx, 0x14
je 0x466c90
cmp edx, 0x15
mov r8d, 0xd
je 0x466c66
xor eax, eax
cmp edx, 0x16
je 0x466c60
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov r8d, 0xe
mov dl, 1
mov rcx, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp fcn.004667e0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp 0x466bd0
mov rsi, qword [rcx]
cmp dword [rsi + 0x418], 2
je 0x466d40
lea r9, [0x00661ea0]
xor edi, edi
mov r8, r9
mov rdx, qword [rsi + 0x498]
test rdx, rdx
je 0x466db1
lea rcx, [0x00662505]
call fcn.0044c410
test rax, rax
mov rsi, rax
je 0x466d24
lea rcx, [rbx + 0x590]
lea rdx, [0x00661fbf]
mov r8, rax
call fcn.00483070
test rdi, rdi
je 0x466cfc
mov dword [rsp + 0x2c], eax
mov rcx, rdi
call qword [sub.msvcrt.dll_free]
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x2c], eax
mov rcx, rsi
call qword [sub.msvcrt.dll_free]
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x466c56
mov dword [rbx + 0x638], 0x1f
jmp 0x466c56
test rdi, rdi
je 0x466d32
mov rcx, rdi
call qword [sub.msvcrt.dll_free]
mov eax, 0x1b
jmp 0x466c56
mov rdi, qword [rsi + 0x91a8]
test rdi, rdi
je 0x466ca0
cmp byte [rdi], 0
je 0x466ca0
mov dl, 0x2f
mov rcx, rdi
call sub.msvcrt.dll_strchr
test rax, rax
je 0x466ca0
mov rcx, rdi
call qword [sub.msvcrt.dll__strdup_1]
test rax, rax
mov rdi, rax
je 0x466d32
mov rcx, rax
call sub.msvcrt.dll_strlen
cmp byte [rdi + rax - 1], 0x2f
je 0x466da2
mov edx, 0x2f
mov rcx, rdi
call sub.msvcrt.dll_strrchr
test rax, rax
je 0x466da2
mov byte [rax + 1], 0
mov r9, rdi
lea r8, [0x00662503]
jmp 0x466cac
cmp byte [rsi + 0x435], 0
lea rdx, str.NLST
lea rax, [0x006624cf]
cmove rdx, rax
jmp 0x466cbc
Function at 0x46c9e0
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx + 0x10]
lea r8, str.Connected_for_receive
mov rbx, rcx
mov esi, edx
lea rdx, [0x00663fc8]
mov rcx, qword [rax]
call fcn.0044e9e0
mov dword [rbx], 1
mov rcx, rbx
call fcn.0046c7f0
test eax, eax
je 0x46ca20
add rsp, 0x28
pop rbx
pop rsi
ret
mov edx, esi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.0046c4b0
Function at 0x46cdc0
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx + 0x10]
lea r8, str.Connected_for_transmit
mov rbx, rcx
mov esi, edx
lea rdx, [0x00663fc8]
mov rcx, qword [rax]
call fcn.0044e9e0
mov dword [rbx], 2
mov rcx, rbx
call fcn.0046c7f0
test eax, eax
je 0x46ce00
add rsp, 0x28
pop rbx
pop rsi
ret
mov edx, esi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.0046ca30
Function at 0x47c800
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x130
call sub.msvcrt.dll_getenv
test rax, rax
mov byte [rsp + 0x20], 0
je 0x47c850
lea rbx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x47c850
mov rcx, rbx
call qword [sub.msvcrt.dll__strdup_1]
add rsp, 0x130
pop rbx
ret
xor eax, eax
add rsp, 0x130
pop rbx
ret
jmp 0x47c800

Function at 0x47c860
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x130
call sub.msvcrt.dll_getenv
test rax, rax
mov byte [rsp + 0x20], 0
je 0x47c850
lea rbx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x47c850
mov rcx, rbx
call qword [sub.msvcrt.dll__strdup_1]
add rsp, 0x130
pop rbx
ret
xor eax, eax
add rsp, 0x130
pop rbx
ret
jmp 0x47c800
Function at 0x480530
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov r10, qword [rcx]
mov rbx, rcx
mov rsi, rdx
cmp dword [r10 + 8], 2
je 0x480590
mov r9, qword [rcx + 0x10]
test r9, r9
je 0x4805b0
mov edx, 1
mov rcx, rsi
call sub.msvcrt.dll_fread
test rax, rax
jne 0x480582
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x480577
call sub.msvcrt.dll_fclose
mov qword [rbx + 0x10], 0
mov rax, qword [rbx]
mov rax, qword [rax]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
ret
mov r11, qword [rcx + 0x18]
xor eax, eax
test r11, r11
je 0x480582
mov r9, qword [r10 + 0x10]
mov edx, 1
mov rcx, rsi
call r11
jmp 0x48055c
mov rcx, qword [r10 + 0x10]
lea rdx, [0x006686e0]
mov qword [rsp + 0x28], r8
call sub.msvcrt.dll_fopen
mov r9, rax
mov qword [rbx + 0x10], rax
mov r8, qword [rsp + 0x28]
test r9, r9
mov rax, 0xffffffffffffffff
jne 0x48054f
jmp 0x480582
Function at 0x4853d0
Capabilities:
Get hostname

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
movsxd rdi, edx
mov rbx, rcx
mov byte [rcx], 0
mov edx, edi
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
mov byte [rbx + rdi - 1], 0
mov esi, eax
jne 0x485408
mov edx, 0x2e
mov rcx, rbx
call sub.msvcrt.dll_strchr
test rax, rax
je 0x485408
mov byte [rax], 0
mov eax, esi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x4874c0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [rcx + 0x18]
mov rsi, rdx
mov edx, dword [rcx + 0x20]
mov rbx, rcx
mov ebp, r8d
add eax, eax
lea rcx, [rdx + rax + 0x18]
call qword [sub.msvcrt.dll_malloc]
test rax, rax
mov rdi, rax
je 0x4875b4
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
cmp dword [rbx + 0x1c], ebp
mov qword [rdi + 0x10], rax
jb 0x4875c4
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
test rbp, rbp
nop dword [rax]
je 0x48756e
lea r13, [rsi + rbp]
lea r12, [rsp + 0x2f]
nop dword [rax + rax]
movzx eax, byte [rsi]
add rsi, 1
mov rcx, qword [rdi + 8]
mov r8d, 1
mov rdx, r12
xor eax, 0x36
mov byte [rsp + 0x2f], al
call qword [rbx + 8]
movzx eax, byte [rsi - 1]
mov rcx, qword [rdi + 0x10]
mov r8d, 1
mov rdx, r12
xor eax, 0x5c
mov byte [rsp + 0x2f], al
call qword [rbx + 8]
cmp rsi, r13
jne 0x487530
mov eax, dword [rbx + 0x1c]
cmp rbp, rax
jae 0x4875b4
nop word cs:[rax + rax]
mov rcx, qword [rdi + 8]
mov r8d, 1
lea rdx, [0x00669391]
call qword [rbx + 8]
mov rcx, qword [rdi + 0x10]
mov r8d, 1
lea rdx, [0x00669390]
call qword [rbx + 8]
mov eax, dword [rbx + 0x1c]
add rbp, 1
cmp rax, rbp
ja 0x487580
mov rax, rdi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [rbx]
mov r8d, ebp
mov rdx, rsi
mov rcx, qword [rdi + 8]
call qword [rbx + 8]
mov esi, dword [rbx + 0x18]
mov rdx, qword [rdi + 8]
add rsi, qword [rdi + 0x10]
mov rcx, rsi
call qword [rbx + 0x10]
mov ebp, dword [rbx + 0x20]
mov rcx, qword [rdi + 8]
jmp 0x487512

Function at 0x488340
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, str.CHARSET
call sub.msvcrt.dll_getenv
test rax, rax
je 0x488360
cmp byte [rax], 0
je 0x488360
add rsp, 0x28
ret
lea rax, [0x006693c0]
add rsp, 0x28
ret
Function at 0x48f8e0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, [0x00692c88]
mov rbx, rdx
call sub.msvcrt.dll_getenv
test rax, rax
je 0x48f8fe
cmp byte [rax], 0
jne 0x48f926
mov rcx, rbx
call sub.msvcrt.dll_getenv
test rax, rax
je 0x48f910
cmp byte [rax], 0
jne 0x48f926
lea rcx, [0x00692c8f]
call sub.msvcrt.dll_getenv
test rax, rax
je 0x48f930
cmp byte [rax], 0
je 0x48f930
add rsp, 0x20
pop rbx
ret
xor eax, eax
jmp 0x48f926

Function at 0x48f950
Capabilities:
Get geographical location
Query environment variable

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.DLL_GetThreadLocale]
movzx ecx, ax
add rsp, 0x28
jmp fcn.0048e1e0
Function at 0x490000
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, rdx
mov rdi, r8
mov rdx, rcx
mov rsi, rcx
mov ecx, 0x22
lea rbx, [rbp + 1]
call sub.msvcrt.dll_putc
cmp rbp, rdi
jne 0x490048
jmp 0x490075
cmp al, 0x22
je 0x490054
movsx ecx, al
mov rdx, rsi
call sub.msvcrt.dll_putc
cmp rdi, rbx
je 0x490075
add rbx, 1
movzx eax, byte [rbx - 1]
cmp al, 0xa
je 0x490090
cmp al, 0x5c
jne 0x490030
mov rdx, rsi
mov ecx, 0x5c
call sub.msvcrt.dll_putc
movzx eax, byte [rbx - 1]
mov rdx, rsi
movsx ecx, al
call sub.msvcrt.dll_putc
cmp rdi, rbx
jne 0x490044
mov rdx, rsi
mov ecx, 0x22
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp sub.msvcrt.dll_putc
lea rcx, [0x00692d20]
mov r9, rsi
mov r8d, 3
mov edx, 1
call sub.msvcrt.dll_fwrite
cmp rdi, rbx
je 0x4900ce
lea rcx, [0x00692d24]
mov r9, rsi
mov r8d, 2
mov edx, 1
call sub.msvcrt.dll_fwrite
jmp 0x490044
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x4900e0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, rcx
lea rcx, [0x006572e0]
mov rdi, rdx
mov rsi, r8
mov r12, r9
call fcn.0048d8b0
test eax, eax
jne 0x4902f9
mov rbx, qword [0x007ef988]
test rbx, rbx
je 0x490154
mov rdx, rbx
mov rcx, rbp
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x4902d0
mov rcx, qword [0x007ef980]
test rcx, rcx
je 0x49014c
call sub.msvcrt.dll_fclose
mov rbx, qword [0x007ef988]
mov qword [0x007ef980], 0
mov rcx, rbx
call sub.msvcrt.dll_free
mov rcx, rbp
call sub.msvcrt.dll_strlen
lea rbx, [rax + 1]
mov rcx, rbx
call sub.msvcrt.dll_malloc
test rax, rax
mov qword [0x007ef988], rax
je 0x4902af
mov r8, rbx
mov rdx, rbp
mov rcx, rax
call sub.msvcrt.dll_memcpy
lea rdx, [0x00692d27]
mov rcx, rbp
call sub.msvcrt.dll_fopen
test rax, rax
mov qword [0x007ef980], rax
je 0x4902af
mov rbx, rax
lea rcx, [0x00692d29]
mov r9, rbx
mov r8d, 7
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rdi
call sub.msvcrt.dll_strlen
lea r8, [rdi + rax]
mov rdx, rdi
mov rcx, rbx
call fcn.00490000
mov edx, 4
mov rcx, rsi
call sub.msvcrt.dll_strchr
test rax, rax
mov rdi, rax
je 0x49021a
lea rcx, str._nmsgctxt
mov r9, rbx
mov r8d, 9
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rdx, rsi
lea rsi, [rdi + 1]
mov r8, rdi
mov rcx, rbx
call fcn.00490000
lea rcx, str._nmsgid
mov r9, rbx
mov r8d, 7
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rsi
call sub.msvcrt.dll_strlen
lea r8, [rsi + rax]
mov rdx, rsi
mov rcx, rbx
call fcn.00490000
mov eax, dword [rsp + 0x70]
mov r9, rbx
test eax, eax
je 0x4902e0
lea rcx, str._nmsgid_plural
mov r8d, 0xe
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, r12
call sub.msvcrt.dll_strlen
lea r8, [r12 + rax]
mov rdx, r12
mov rcx, rbx
call fcn.00490000
lea rcx, str._nmsgstr_0_____n
mov r9, rbx
mov r8d, 0xe
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rdx, rbx
mov ecx, 0xa
call sub.msvcrt.dll_putc
lea rcx, [0x006572e0]
call fcn.0048d920
test eax, eax
jne 0x4902f9
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rbx, qword [0x007ef980]
jmp 0x4901a8
lea rcx, str._nmsgstr____n
mov r8d, 0xb
mov edx, 1
call sub.msvcrt.dll_fwrite
jmp 0x4902a2
call sub.msvcrt.dll_abort
nop
nop
Function at 0x4a5d61
Capabilities:
Set socket configuration

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov eax, dword [rbp + 0x18]
mov dword [rbp - 4], eax
lea rax, [rbp - 4]
mov r8, rax
mov edx, 0x8004667e
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.WS2_32.dll_ioctlsocket]
call rax
add rsp, 0x30
pop rbp
ret
Function at 0x4b36b2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov byte [rbp - 0x10], 0
mov byte [rbp - 0xf], 0
mov byte [rbp - 0xe], 0
mov byte [rbp - 0xd], 7
mov byte [rbp - 0xc], 0x73
mov byte [rbp - 0xb], 0x73
mov byte [rbp - 0xa], 0x68
mov byte [rbp - 9], 0x2d
mov byte [rbp - 8], 0x72
mov byte [rbp - 7], 0x73
mov byte [rbp - 6], 0x61
mov byte [rbp - 0x20], 0
mov byte [rbp - 0x1f], 0
mov byte [rbp - 0x1e], 0
mov byte [rbp - 0x1d], 7
mov byte [rbp - 0x1c], 0x73
mov byte [rbp - 0x1b], 0x73
mov byte [rbp - 0x1a], 0x68
mov byte [rbp - 0x19], 0x2d
mov byte [rbp - 0x18], 0x64
mov byte [rbp - 0x17], 0x73
mov byte [rbp - 0x16], 0x73
cmp qword [rbp + 0x18], 0xa
ja 0x4b3728
mov eax, 0
jmp 0x4b376f
lea rax, [rbp - 0x10]
mov r8d, 0xb
mov rdx, qword [rbp + 0x10]
mov rcx, rax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x4b3749
mov eax, 1
jmp 0x4b376f
lea rax, [rbp - 0x20]
mov r8d, 0xb
mov rdx, qword [rbp + 0x10]
mov rcx, rax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x4b376a
mov eax, 2
jmp 0x4b376f
mov eax, 0
add rsp, 0x40
pop rbp
ret

Function at 0x4b52de
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0x860
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x7f0], rcx
mov qword [rbp + 0x7f8], rdx
mov dword [rbp + 0x800], r8d
mov dword [rbp + 0x7d4], 0
cmp dword [rbp + 0x800], 1
je 0x4b5339
mov rax, qword [rbp + 0x7f0]
mov rax, qword [rax]
lea r8, str.Unsupported_type_of_known_host_information_store
mov edx, 0xffffffdf
mov rcx, rax
call fcn.004bcb4f
jmp 0x4b5482
mov rax, qword [rbp + 0x7f8]
lea rdx, [0x007625cf]
mov rcx, rax
call sub.msvcrt.dll_fopen
mov qword [rbp + 0x7c8], rax
cmp qword [rbp + 0x7c8], 0
jne 0x4b5383
mov rax, qword [rbp + 0x7f0]
mov rax, qword [rax]
lea r8, str.Failed_to_open_file
mov edx, 0xfffffff0
mov rcx, rax
call fcn.004bcb4f
jmp 0x4b5482
mov rax, qword [rbp + 0x7f0]
add rax, 8
mov rcx, rax
call fcn.004bd435
mov qword [rbp + 0x7d8], rax
jmp 0x4b545f
lea rcx, [rbp - 0x40]
mov rax, qword [rbp + 0x7d8]
mov edx, dword [rbp + 0x800]
mov dword [rsp + 0x28], edx
lea rdx, [rbp - 0x48]
mov qword [rsp + 0x20], rdx
mov r9d, 0x800
mov r8, rcx
mov rdx, rax
mov rcx, qword [rbp + 0x7f0]
call fcn.004b4e88
mov dword [rbp + 0x7d4], eax
cmp dword [rbp + 0x7d4], 0
je 0x4b53ec
jmp 0x4b546d
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp + 0x7c8]
lea rax, [rbp - 0x40]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov qword [rbp + 0x7c0], rax
mov rax, qword [rbp - 0x48]
cmp qword [rbp + 0x7c0], rax
je 0x4b5449
mov rax, qword [rbp + 0x7f0]
mov rax, qword [rax]
lea r8, str.Write_failed
mov edx, 0xfffffff0
mov rcx, rax
call fcn.004bcb4f
mov dword [rbp + 0x7d4], eax
nop
jmp 0x4b546d
mov rax, qword [rbp + 0x7d8]
mov rcx, rax
call fcn.004bd447
mov qword [rbp + 0x7d8], rax
cmp qword [rbp + 0x7d8], 0
jne 0x4b53a2
mov rax, qword [rbp + 0x7c8]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov eax, dword [rbp + 0x7d4]
add rsp, 0x860
pop rbp
ret
Function at 0x4c72f0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
call fcn.004c7d90
test eax, eax
jne 0x4c7311
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.004da310

Function at 0x4c74c0
Capabilities:
Authenticate hmac

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
call fcn.004c7d90
test eax, eax
jne 0x4c74f0
mov eax, 0x10000b0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.004da4c0

Function at 0x4cb6c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [0x007efa80]
mov ebx, ecx
mov rsi, rdx
mov rdi, r8
test rax, rax
je 0x4cb710
mov r9, r8
mov r8, rdx
mov edx, ecx
mov rcx, qword [0x007efa78]
call rax
cmp ebx, 0x32
je 0x4cb809
cmp ebx, 0x28
je 0x4cb809
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp ecx, 0x1e
je 0x4cb7a0
jle 0x4cb790
cmp ecx, 0x32
nop
je 0x4cb761
cmp ecx, 0x64
je 0x4cb7e0
cmp ecx, 0x28
nop
je 0x4cb7b0
mov rbp, qword [sym.imp.msvcrt.dll___iob_func]
call rbp
lea rdx, str._Unknown_log_level__d_:
lea rcx, [rax + 0x60]
mov r8d, ebx
call sub.msvcrt.dll_fprintf
call rbp
lea rcx, [rax + 0x60]
mov r8, rdi
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
jmp 0x4cb6ed
mov rbp, qword [sym.imp.msvcrt.dll___iob_func]
call rbp
lea rcx, str.Ohhhh_jeeee:
lea r9, [rax + 0x60]
mov r8d, 0xd
mov edx, 1
call sub.msvcrt.dll_fwrite
jmp 0x4cb74e
cmp ecx, 0xa
je 0x4cb7a0
cmp ecx, 0x14
je 0x4cb7a0
test ecx, ecx
jne 0x4cb732
nop
mov rbp, qword [sym.imp.msvcrt.dll___iob_func]
jmp 0x4cb74e
mov rbp, qword [sym.imp.msvcrt.dll___iob_func]
call rbp
lea rcx, str.Fatal:
lea r9, [rax + 0x60]
mov r8d, 7
mov edx, 1
call sub.msvcrt.dll_fwrite
jmp 0x4cb74e
mov rbp, qword [sym.imp.msvcrt.dll___iob_func]
call rbp
lea rcx, str.DBG:
lea r9, [rax + 0x60]
mov r8d, 5
mov edx, 1
call sub.msvcrt.dll_fwrite
jmp 0x4cb74e
lea rax, str.internal_error__fatal_or_bug_
lea r8, str._gcry_logv
lea rcx, [0x00765875]
mov r9d, 1
mov edx, 0x8b
mov qword [rsp + 0x20], rax
call fcn.004db2e0
call fcn.004e3c70
call sub.msvcrt.dll_abort
nop
nop
mov qword [0x007efa70], rcx
ret
Function at 0x4d9140
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx]
mov rdi, rcx
mov r12, rdx
mov rbp, r8
mov r9, qword [rax + 0x18]
test r9, r9
je 0x4d916e
movsxd rdx, dword [rcx + 8]
test edx, edx
jne 0x4d91d0
test rbp, rbp
jne 0x4d91ed
mov rbx, qword [rax + 0x28]
lea r13, [rdi + 0x10]
test rbx, rbx
jne 0x4d9198
jmp 0x4d91b4
mov rax, qword [rbx]
mov r8, rbp
mov rdx, r12
mov rcx, rsi
call qword [rax + 0x30]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x4d91b4
movsxd r8, dword [rdi + 8]
lea rsi, [rbx + 0x20]
test r8d, r8d
je 0x4d9180
mov r9, qword [rbx]
mov rdx, r13
mov rcx, rsi
call qword [r9 + 0x30]
jmp 0x4d9180
mov dword [rdi + 8], 0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rcx, [rcx + 0x10]
mov r8d, 1
call sub.msvcrt.dll_fwrite
cmp rax, 1
jne 0x4d9210
test rbp, rbp
mov rax, qword [rdi]
je 0x4d916e
mov r9, qword [rax + 0x18]
mov r8d, 1
mov rdx, rbp
mov rcx, r12
call sub.msvcrt.dll_fwrite
cmp rax, 1
jne 0x4d9228
mov rax, qword [rdi]
jmp 0x4d916e
lea r8, str.md_write
lea rcx, str.md.c
mov edx, 0x31a
call fcn.004cb980
lea r8, str.md_write
lea rcx, str.md.c
mov edx, 0x31c
call fcn.004cb980
nop
nop word cs:[rax + rax]

Function at 0x4da280
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rdi, rcx
mov rbx, qword [rax + 0x28]
mov dword [rax + 0x20], 0
mov dword [rcx + 8], 0
test rbx, rbx
je 0x4da2ce
mov rax, qword [rbx]
lea rsi, [rbx + 0x20]
xor edx, edx
mov rcx, rsi
mov r8, qword [rax + 0x48]
call sub.msvcrt.dll_memset
mov rax, qword [rbx]
mov rcx, rsi
call qword [rax + 0x28]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4da2a4
mov rax, qword [rdi]
mov rdx, qword [rax + 0x30]
test rdx, rdx
je 0x4da2f0
movsxd r8, dword [rax + 0x38]
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.004d9140
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x4da4c0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rcx]
mov r12, rdx
mov rbp, r8
cmp qword [rcx + 0x30], 0
je 0x4da560
call fcn.004d99f0
test eax, eax
mov esi, eax
mov r9d, 0x20000005
jne 0x4da504
mov eax, r9d
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rax, qword [rbx]
mov edx, dword [rax + 0x38]
movsxd rcx, edx
cmp rbp, rcx
jbe 0x4da570
mov ecx, esi
call fcn.004d9470
movsxd rcx, eax
call fcn.004c8580
test rax, rax
mov r13, rax
je 0x4da5fa
mov r9, rbp
mov rdx, rax
mov r8, r12
mov ecx, esi
call fcn.004da380
mov ecx, esi
call fcn.004d9470
movsxd rbp, eax
mov rax, qword [rbx]
mov edx, dword [rax + 0x38]
movsxd rcx, edx
cmp rbp, rcx
ja 0x4da61b
mov r12, r13
jmp 0x4da573
mov r9d, 0x20000046
jmp 0x4da4f4
xor r13d, r13d
lea r8d, [rdx + rdx]
mov rcx, qword [rax + 0x30]
xor edx, edx
movsxd r8, r8d
call sub.msvcrt.dll_memset
mov rax, qword [rbx]
mov r8, rbp
mov rdx, r12
movsxd rdi, dword [rax + 0x38]
mov rsi, qword [rax + 0x30]
mov rcx, rsi
add rdi, rsi
call sub.msvcrt.dll_memcpy
mov r8, rbp
mov rdx, r12
mov rcx, rdi
call sub.msvcrt.dll_memcpy
mov rax, qword [rbx]
xor r8d, r8d
mov r11d, dword [rax + 0x38]
test r11d, r11d
jle 0x4da5db
nop
xor byte [rsi + r8], 0x36
lea r10d, [r8 + 1]
xor byte [rdi + r8], 0x5c
add r8, 1
mov r9, qword [rbx]
cmp r10d, dword [r9 + 0x38]
jl 0x4da5c0
mov rcx, r13
call fcn.004c8620
mov rcx, rbx
call fcn.004da280
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call fcn.00512270
test eax, eax
je 0x4da5e3
movzx r9d, ax
or r9d, 0x20000000
jmp 0x4da4f4
lea r9, str.prepare_macpads
lea rdx, str.md.c
lea rcx, str.keylen___hd__ctx__macpads_Bsize
mov r8d, 0x367
call fcn.004cb9b0
nop
nop dword [rax]