joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140225610
Capabilities:
Read http header

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, qword [rcx + 0x10]
test rbx, rbx
jne 0x140225638
xor eax, eax
jmp 0x140225688
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x100
call fcn.14028e7e0
xor r8d, r8d
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0xff
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rcx, rbx
lea edx, [r8 + 0x13]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x140225634
lea rcx, [rsp + 0x40]
call fcn.14029f8e4
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14026d870
add rsp, 0x150
pop rbx
ret

Function at 0x1402256b0
Capabilities:
Receive http response

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
test rcx, rcx
jne 0x1402256c4
xor al, al
add rsp, 0x28
ret
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
cmp eax, 1
sete al
add rsp, 0x28
ret

Function at 0x1402256e0
Capabilities:
Receive http response

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
test rcx, rcx
jne 0x1402256f4
xor al, al
add rsp, 0x28
ret
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
cmp eax, 1
sete al
add rsp, 0x28
ret

Function at 0x140225900
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r9, rdx
mov byte [rsp + 0x20], cl
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8d, edx
call fcn.1402a2450
cmp rax, 1
sete al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14026d870
add rsp, 0x38
ret
Function at 0x140228010
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
cmp qword [rcx + 0x68], 0
je 0x1402281ba
cmp byte [rcx + 0x71], 0
je 0x1402281ba
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
jne 0x14022806a
xor al, al
jmp 0x1402281bc
mov qword [rbp - 0x18], sendto
mov qword [rbp - 0x20], 0
mov byte [rbp - 0x30], 0
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp - 0x30]
call fcn.1400535b0
nop
mov rcx, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
nop word [rax + rax]
lea rdx, [rbp - 0x30]
cmp r9, 0x10
cmovae rdx, rcx
lea r8, [rbp - 0x30]
cmovae r8, rcx
mov rcx, qword [rdi + 0x68]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x20]
add r9, rdx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x74]
call qword [r10 + 0x40]
test eax, eax
je 0x1402280de
sub eax, 1
jne 0x140228152
jmp 0x1402280e2
mov byte [rdi + 0x71], 0
lea rax, [rbp - 0x30]
mov rcx, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
cmp r9, 0x10
cmovae rax, rcx
mov rbx, qword [rbp - 0x38]
sub rbx, rax
je 0x14022812f
lea rax, [rbp - 0x30]
cmp r9, 0x10
cmovae rax, rcx
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, rax
call fcn.1402a2450
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
cmp rbx, rax
jne 0x14022815f
cmp byte [rdi + 0x71], 0
je 0x140228163
test rbx, rbx
jne 0x1402280a0
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rbp - 0x30]
call fcn.1400479c0
jmp 0x14022808f
sub eax, 2
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
je 0x140228163
xor bl, bl
jmp 0x140228165
mov bl, 1
cmp r9, 0x10
jb 0x1402281b5
lea rax, [r9 + 1]
cmp rax, 0x1000
jb 0x1402281b0
test byte [rbp - 0x30], 0x1f
je 0x140228183
call fcn.14029051c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140228192
call fcn.14029051c
int3
sub rcx, rax
cmp rcx, 8
jae 0x1402281a1
call fcn.14029051c
int3
cmp rcx, 0x27
jbe 0x1402281ad
call fcn.14029051c
int3
mov rcx, rax
call fcn.14026d850
movzx eax, bl
jmp 0x1402281bc
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14026d870
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140228770
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, rdx
mov rdi, rcx
mov rbx, qword [rdx]
mov r9, qword [rcx + 0x30]
mov r8d, 1
mov rdx, rbx
mov rcx, qword [r14 + 8]
call fcn.1402a2450
cmp rax, 1
je 0x1402287f0
test rbx, rbx
je 0x1402287f0
lea rax, str.Failed_to_write_to_file
mov qword [rbp - 0x30], rax
lea rax, vtable.std::runtime_error.0
mov qword [rbp - 0x38], rax
lea rdx, [0x1403d6f78]
lea rcx, [rbp - 0x38]
call fcn.14028e980
int3
cmp qword [rdi + 0x28], 0
jne 0x1402288e1
mov qword [rbp - 0x48], 7
xor esi, esi
mov qword [rbp - 0x50], rsi
mov word [rbp - 0x60], si
lea r8d, [rsi + 0xf]
lea rdx, str.X_Entity_Length
lea rcx, [rbp - 0x60]
call fcn.14002c3d0
nop
mov rcx, qword [rdi + 0x38]
add rcx, 0x60
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x28]
call fcn.140226250
nop
mov r8, qword [rbp - 0x48]
cmp r8, 8
jb 0x140228852
inc r8
mov rdx, qword [rbp - 0x60]
lea rcx, [rbp - 0x60]
call fcn.14002e610
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], rsi
mov word [rbp - 0x60], si
cmp qword [rbp - 0x18], 0
jne 0x14022886f
or rsi, 0xffffffffffffffff
jmp 0x1402288c3
lea rbx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rbx, qword [rbp - 0x28]
call fcn.1402946c4
mov dword [rax], esi
mov r8d, 0xa
lea rdx, [rbp - 0x38]
mov rcx, rbx
call fcn.14029f370
mov rsi, rax
cmp rbx, qword [rbp - 0x38]
jne 0x1402288ac
lea rcx, str.invalid_stoll_argument
call fcn.140107e90
int3
call fcn.1402946c4
cmp dword [rax], 0x22
jne 0x1402288c3
lea rcx, str.stoll_argument_out_of_range
call fcn.140107ed8
int3
mov qword [rdi + 0x18], rsi
mov r8, qword [rbp - 0x10]
cmp r8, 8
jb 0x1402288e1
inc r8
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x28]
call fcn.14002e610
mov r9, qword [r14]
mov r8, qword [rdi + 0x20]
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 8]
call qword [rdi + reloc.WS2_32.dll_recv]
mov rax, qword [r14]
add qword [rdi + 0x20], rax
inc qword [rdi + 0x28]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14026d870
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14022d800
Capabilities:
Read http header

Disassembly:
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov rbx, rdx
mov rdi, rcx
xor esi, esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x50], esi
mov qword [rdx + 0x18], 7
mov qword [rdx + 0x10], rsi
cmp qword [rdx + 0x18], 8
jb 0x14022d845
mov rax, qword [rdx]
jmp 0x14022d848
mov rax, rbx
mov word [rax], si
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x16]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14022d8e4
mov edx, dword [rsp + 0x50]
mov rax, qword [rbx + 0x10]
cmp rdx, rax
ja 0x14022d8a7
mov qword [rbx + 0x10], rdx
cmp qword [rbx + 0x18], 8
jb 0x14022d89e
mov rax, qword [rbx]
jmp 0x14022d8a1
mov rax, rbx
mov word [rax + rdx*2], si
jmp 0x14022d8b5
xor r8d, r8d
sub rdx, rax
mov rcx, rbx
call fcn.14002d970
cmp qword [rbx + 0x18], 8
jb 0x14022d8c1
mov r9, qword [rbx]
jmp 0x14022d8c4
mov r9, rbx
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r8 + 0x16]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x14022e570
Capabilities:
Read http header

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x40]
xor eax, eax
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov dword [rsp + 0x40], eax
mov edx, 0x20000013
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov ecx, dword [rsp + 0x40]
or edx, 0xffffffff
test eax, eax
cmove ecx, edx
mov eax, ecx
add rsp, 0x38
ret
Function at 0x14023db60
Capabilities:
Initialize winhttp library

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x80
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0xb8], rbx
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx ebp, r8w
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x60], rcx
xor eax, eax
mov qword [rcx], rax
lea rdi, [rcx + 8]
mov qword [rdi], rax
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
lea edx, [rax + 4]
lea rcx, str.Simple_HttpFetcher_1.1
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
lea rcx, [rsp + 0x30]
cmp rbx, rcx
je 0x14023dbd7
mov rcx, qword [rbx]
mov qword [rbx], rax
test rcx, rcx
je 0x14023dbe5
jmp 0x14023dbdf
test rax, rax
je 0x14023dbe5
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14023dc3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xffffd120
cmp eax, 0xbc
ja 0x14023dc06
call fcn.1402403b0
jmp 0x14023dc0b
call fcn.1400e1650
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r9, str.WinHttp:_Failed_to_create_session
mov r8, rbx
lea rcx, [rsp + 0x38]
call fcn.1400e16e0
lea rdx, [0x1403d7448]
lea rcx, [rsp + 0x38]
call fcn.14028e980
int3
mov dword [rsp + 0x68], 0xaa0
mov r9d, 4
lea r8, [rsp + 0x68]
lea edx, [r9 + 0x50]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x14023dcac
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xffffd120
cmp eax, 0xbc
ja 0x14023dc76
call fcn.1402403b0
jmp 0x14023dc7b
call fcn.1400e1650
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r9, str.WinHttp:_Failed_to_set_secure_protocols
mov r8, rbx
lea rcx, [rsp + 0x38]
call fcn.1400e16e0
lea rdx, [0x1403d7448]
lea rcx, [rsp + 0x38]
call fcn.14028e980
int3
cmp qword [rsi + 0x18], 8
jb 0x14023dcb6
mov rsi, qword [rsi]
xor r9d, r9d
movzx r8d, bp
mov rdx, rsi
mov rcx, qword [rbx]
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
lea rcx, [rsp + 0x30]
cmp rdi, rcx
je 0x14023dce0
mov rcx, qword [rdi]
mov qword [rdi], rax
test rcx, rcx
je 0x14023dcee
jmp 0x14023dce8
test rax, rax
je 0x14023dcee
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
cmp qword [rdi], 0
jne 0x14023dd43
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xffffd120
cmp eax, 0xbc
ja 0x14023dd0d
call fcn.1402403b0
jmp 0x14023dd12
call fcn.1400e1650
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r9, str.WinHttp:_Failed_to_connect_to_host
mov r8, rbx
lea rcx, [rsp + 0x38]
call fcn.1400e16e0
lea rdx, [0x1403d7448]
lea rcx, [rsp + 0x38]
call fcn.14028e980
nop
mov rax, rbx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14026d870
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x14023dde0
Capabilities:
Read http header

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov qword [rbp - 1], 0xfffffffffffffffe
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
xor r14d, r14d
mov dword [rbp - 0x29], r14d
mov dword [rbp + 7], r14d
mov qword [rsp + 0x28], r14
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x14023dfae
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2f76
jne 0x14023de66
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
mov word [rbx], r14w
jmp 0x14023dfd5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14023debe
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xffffd120
cmp eax, 0xbc
ja 0x14023de8a
call fcn.1402403b0
jmp 0x14023de8f
call fcn.1400e1650
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r9, str.WinHttp:_Failed_to_query_header_length
mov r8, rbx
lea rcx, [rbp - 0x21]
call fcn.1400e16e0
lea rdx, [0x1403d7448]
lea rcx, [rbp - 0x21]
call fcn.14028e980
int3
mov edx, dword [rbp + 7]
shr rdx, 1
mov qword [rbp + 0x27], 7
mov qword [rbp + 0x1f], r14
mov word [rbp + 0xf], r14w
xor r8d, r8d
dec rdx
lea rcx, [rbp + 0xf]
call fcn.140047ad0
nop
lea r9, [rbp + 0xf]
cmp qword [rbp + 0x27], 8
cmovae r9, qword [rbp + 0xf]
mov qword [rsp + 0x28], r14
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, esi
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x14023df60
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xffffd120
cmp eax, 0xbc
ja 0x14023df2c
call fcn.1402403b0
jmp 0x14023df31
call fcn.1400e1650
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r9, str.WinHttp:_Failed_to_query_header_value
mov r8, rbx
lea rcx, [rbp - 0x21]
call fcn.1400e16e0
lea rdx, [0x1403d7448]
lea rcx, [rbp - 0x21]
call fcn.14028e980
int3
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
mov word [rbx], r14w
mov rcx, qword [rbp + 0x27]
cmp rcx, 8
jae 0x14023df99
mov r8, qword [rbp + 0x1f]
add r8, 1
je 0x14023dfa0
add r8, r8
lea rdx, [rbp + 0xf]
mov rcx, rbx
call fcn.14028db80
mov rcx, qword [rbp + 0x27]
jmp 0x14023dfa0
mov rax, qword [rbp + 0xf]
mov qword [rbx], rax
mov rax, qword [rbp + 0x1f]
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rcx
jmp 0x14023dfd5
lea rax, str.WinHttp:_WinHttpQueryHeader_unexpectedly_returned_true
mov qword [rbp - 0x19], rax
lea rax, vtable.std::runtime_error.0
mov qword [rbp - 0x21], rax
lea rdx, [0x1403d6f78]
lea rcx, [rbp - 0x21]
call fcn.14028e980
int3
mov rax, rbx
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14026d870
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14023e000
Capabilities:
Set http header

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov qword [rbp - 0x80], 0xfffffffffffffffe
movaps xmmword [rsp + 0x100], xmm6
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov r8d, 2
lea rdx, [0x140348a80]
lea rcx, [rsp + 0x20]
call fcn.14023ddb0
nop
mov r8, rax
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.1400503c0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140032520
nop
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x14023e090
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.14002e610
mov qword [rsp + 0x58], 7
xor r14d, r14d
mov qword [rsp + 0x50], r14
mov word [rsp + 0x40], r14w
mov r8, qword [rsp + 0x38]
cmp r8, 8
jb 0x14023e0c4
inc r8
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x20]
call fcn.14002e610
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], r14
mov word [rsp + 0x20], r14w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov r9d, 0xa0000000
mov r8d, dword [rbp - 0x20]
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x14023e231
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2f76
je 0x14023e231
mov r8, rdi
lea rdx, str.WinHttp:_Failed_to_set__ls_request_header
lea rcx, [rbp - 0x50]
call fcn.1400d2180
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xffffd120
cmp eax, 0xbc
ja 0x14023e141
call fcn.1402403b0
jmp 0x14023e146
call fcn.1400e1650
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x38], sendto
mov qword [rsp + 0x30], r14
mov byte [rsp + 0x20], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.14002d740
movaps xmm6, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm6
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x70]
call fcn.14002d550
cmp qword [rax + 0x18], 0x10
jb 0x14023e1a7
mov rax, qword [rax]
mov qword [rsp + 0x68], rax
lea rax, vtable.std::runtime_error.0
mov qword [rsp + 0x60], rax
mov rax, qword [rbp - 0x58]
cmp rax, 0x10
jb 0x14023e20e
inc rax
mov rcx, qword [rbp - 0x70]
cmp rax, 0x1000
jb 0x14023e209
test cl, 0x1f
je 0x14023e1dc
call fcn.14029051c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14023e1eb
call fcn.14029051c
int3
sub rcx, rax
cmp rcx, 8
jae 0x14023e1fa
call fcn.14029051c
int3
cmp rcx, 0x27
jbe 0x14023e206
call fcn.14029051c
int3
mov rcx, rax
call fcn.14026d850
movups xmmword [rsp + 0x70], xmm6
lea rax, vtable.std::system_error.0
mov qword [rsp + 0x60], rax
lea rdx, [0x1403d7448]
lea rcx, [rsp + 0x60]
call fcn.14028e980
nop
mov r8, qword [rbp - 0x18]
cmp r8, 8
jb 0x14023e24b
inc r8
mov rdx, qword [rbp - 0x30]
lea rcx, [rbp - 0x30]
call fcn.14002e610
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14026d870
movaps xmm6, xmmword [rsp + 0x100]
add rsp, 0x110
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140247c10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
cmp rdx, 0x80
ja 0x140247c7f
call fcn.1400ac9f0
xor r9d, r9d
test rbx, rbx
je 0x140247c74
lea r11, [0x140312840]
mov r10d, 0x63
sub r10, r11
nop word [rax + rax]
lea r8, [r9 + r11]
xor edx, edx
lea rax, [r10 + r8]
div rbx
mov rax, qword [rdi]
movzx ecx, byte [rdx + r11]
xor cl, byte [r8]
mov byte [r9 + rax], cl
inc r9
cmp r9, rbx
jb 0x140247c50
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea rax, str.Requested_initialization_vector_is_too_big
mov qword [rsp + 0x28], rax
lea rdx, [0x1403d6f78]
lea rax, vtable.std::runtime_error.0
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
call fcn.14028e980
int3

Function at 0x140247cb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
cmp rdx, 0x80
ja 0x140247d1f
call fcn.1400ac9f0
xor r9d, r9d
test rbx, rbx
je 0x140247d14
lea r11, [0x1403127a0]
mov r10d, 6
sub r10, r11
nop word [rax + rax]
lea r8, [r9 + r11]
xor edx, edx
lea rax, [r10 + r8]
div rbx
mov rax, qword [rdi]
movzx ecx, byte [rdx + r11]
xor cl, byte [r8]
mov byte [r9 + rax], cl
inc r9
cmp r9, rbx
jb 0x140247cf0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea rax, str.Requested_key_is_too_big
mov qword [rsp + 0x28], rax
lea rdx, [0x1403d6f78]
lea rax, vtable.std::runtime_error.0
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
call fcn.14028e980
int3
Function at 0x14026c3f0
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
mov rsi, rcx
mov dword [rsp + 0x20], 0xf0000000
add rcx, 0x10
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov edi, eax
test eax, eax
jne 0x14026c49d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x14026c453
lea r9d, [rdi + 1]
mov dword [rsp + 0x20], 0xf0000008
xor r8d, r8d
lea rcx, [rsi + 0x10]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov edi, eax
test eax, eax
jne 0x14026c49d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140130750
mov dword [rsp + 0x68], ebx
mov rcx, rax
lea rax, str.Failed_to_acquire_crypt_context._Error__u
mov qword [rsp + 0x60], rax
lea rax, [0x140328340]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0xda
jmp 0x14026c509
mov rcx, qword [rsi + 0x10]
lea rax, [rsi + 0x18]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov edi, eax
test eax, eax
jne 0x14026c533
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140130750
mov dword [rsp + 0x68], ebx
mov rcx, rax
lea rax, str.Failed_to_create_crypto_hash_for_SHA1._Error__u
mov qword [rsp + 0x60], rax
lea rax, [0x140328340]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0xd5
mov r9d, 4
lea rax, str.....McCSPService_srcMcHardwareId.cpp
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, str.McAfee::MCSP::CMcHardwareId::InitCrypto
mov qword [rsp + 0x20], rax
lea edx, [r9 - 3]
call fcn.140130940
lea r11, [rsp + 0x70]
cmp edi, 1
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
sete al
mov rsp, r11
pop rdi
ret
Function at 0x140271740
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140271753
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.140271db8
lea rdx, [0x1403d6878]
lea rcx, [rsp + 0x20]
call fcn.14028e980
int3

Function at 0x14027c2e8
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1403f1498]
xor edx, edx
jmp fcn.140271740

Function at 0x14027cccc
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1403f1498]
jmp fcn.140271740
Function at 0x1402a2da4
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
movsxd r13, ecx
lea r10, [0x1403f1e60]
mov rdi, r13
mov r15, r13
sar r15, 6
and edi, 0x3f
shl rdi, 6
mov r14, rdx
mov r9d, 0xa
mov rax, qword [r10 + r15*8]
mov rcx, qword [rax + rdi + 0x28]
mov qword [rsp + 0x98], rcx
test r8, r8
je 0x1402a2dfc
cmp word [rdx], r9w
jne 0x1402a2dfc
or byte [rax + rdi + 0x38], 4
jmp 0x1402a2e01
and byte [rax + rdi + 0x38], 0xfb
lea r12, [rdx + r8*2]
mov rsi, rdx
mov rbx, rdx
cmp rdx, r12
jae 0x1402a2fb7
lea rbp, [rdx + 2]
mov edx, reloc.WS2_32.dll_listen
movzx eax, word [rsi]
cmp ax, 0x1a
je 0x1402a2f99
cmp ax, dx
je 0x1402a2e43
mov word [rbx], ax
add rbx, 2
add rsi, 2
add rbp, 2
jmp 0x1402a2ee4
cmp rbp, r12
jae 0x1402a2e69
cmp word [rbp], r9w
jne 0x1402a2e64
add rsi, 4
mov word [rbx], r9w
add rbp, 4
add rbx, 2
jmp 0x1402a2ee4
mov word [rbx], dx
jmp 0x1402a2e32
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x90]
mov r8d, 2
lea rdx, [rsp + 0x80]
add rsi, 2
add rbp, 2
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1402a2f7d
cmp dword [rsp + 0x90], 0
je 0x1402a2f7d
lea r10, [0x1403f1e60]
mov r9d, 0xa
mov rax, qword [r10 + r15*8]
test byte [rax + rdi + 0x38], 0x48
je 0x1402a2f2e
movzx eax, word [rsp + 0x80]
cmp ax, r9w
jne 0x1402a2ef2
mov word [rbx], r9w
add rbx, 2
mov edx, reloc.WS2_32.dll_listen
mov rcx, qword [rsp + 0x98]
cmp rsi, r12
jb 0x1402a2e1d
jmp 0x1402a2fb7
mov ecx, reloc.WS2_32.dll_listen
mov word [rsp + 0x88], ax
mov word [rbx], cx
add rbx, 2
xor edx, edx
mov rcx, qword [r10 + r15*8]
mov al, byte [rsp + rdx + 0x88]
add rcx, rdi
mov byte [rcx + rdx + 0x3a], al
inc rdx
cmp rdx, 2
jl 0x1402a2f08
mov rax, qword [r10 + r15*8]
mov byte [rax + rdi + 0x3c], r9b
jmp 0x1402a2ed7
cmp word [rsp + 0x80], r9w
jne 0x1402a2f3e
cmp rbx, r14
je 0x1402a2ecf
mov rdx, 0xfffffffffffffffe
mov ecx, r13d
lea r8d, [rdx + 3]
call fcn.1402a2d9c
mov r9d, 0xa
lea r10, [0x1403f1e60]
cmp word [rsp + 0x80], r9w
je 0x1402a2ed7
lea edx, [r9 + 3]
mov word [rbx], dx
add rbx, 2
jmp 0x1402a2edc
mov edx, reloc.WS2_32.dll_listen
lea r10, [0x1403f1e60]
mov word [rbx], dx
add rbx, 2
lea r9d, [rdx - 3]
jmp 0x1402a2edc
mov rcx, qword [r10 + r15*8]
mov al, byte [rcx + rdi + 0x38]
test al, 0x40
jne 0x1402a2fad
or al, 2
mov byte [rcx + rdi + 0x38], al
jmp 0x1402a2fb7
movzx ecx, word [rsi]
mov word [rbx], cx
add rbx, 2
sub rbx, r14
sar rbx, 1
lea rax, [rbx + rbx]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret