joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140039790
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
sub rsp, 0x108
mov r8, rdx
mov rdx, rcx
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0xa0], r8
mov eax, 0xffffffff
mov eax, eax
mov r9d, eax
lea rcx, [rsp + 0x58]
lea rax, [0x1400597c0]
mov qword [rsp + 0x20], rax
call fcn.140038c10
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x58]
call fcn.140038d50
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x70]
call fcn.140038d70
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x88]
mov eax, 1
xor ecx, ecx
cmp rdx, 0
cmove rax, rcx
cmp rax, 0
jne 0x140039841
mov dword [rsp + 0x3c], 0
jmp 0x1400398de
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 0x28], rdx
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xe0], 0
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0xd8], rcx
mov rcx, qword [rsp + 0xd8]
mov qword [rsp + 0xf8], rdx
mov qword [rsp + 0x100], rax
mov r8d, eax
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0xb8], eax
shr eax, 0x1e
cmp eax, 3
je 0x1400398ea
jmp 0x1400397fd
mov eax, dword [rsp + 0x3c]
add rsp, 0x108
ret
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0xe8], rcx
mov qword [rsp + 0xf0], rax
mov edx, eax
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
mov byte [rsp + 0xbf], al
cmp al, 0
jne 0x1400397fd
mov ecx, dword [rsp + 0x38]
xor ecx, 0x80000000
mov dword [rsp + 0xc0], ecx
call fcn.140038ab0
mov ecx, eax
mov dword [rsp + 0xc4], ecx
call fcn.1400395c0
mov dword [rsp + 0x3c], eax
jmp 0x1400398de

Function at 0x14003c510
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
test rax, rax
je 0x14003c546
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14003c556
lea rax, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x50
pop rsi
ret
Function at 0x14003c570
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x14003c600
jmp 0x14003c5ef
jae 0x14003c6c0
cmp r8, 0x201
jae 0x14003c600
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x14003c658
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x14003c62f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.1400556c0
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x14003c681
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14003c728
mov r8d, r14d
cmp r15, r8
jne 0x14003c5e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14003c74b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14003c5ef
jmp 0x14003c600
cmp rsi, r8
jb 0x14003c765
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.14003e540
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x14003c711
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.140007b00
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x14003c6f9
jmp 0x14003c711
lea rcx, str.internal_error:_entered_unreachable_code_rustc_cc66ad468955717ab92600c770da8c1601a4ff33library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140056640
jmp 0x14003c77a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.140056b30
ud2
Function at 0x140044900
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14005b2f0]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x140044944
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1400449aa
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x1400449e1
test eax, eax
js 0x1400449bb
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400449d4
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
lea rdx, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
lea rsi, [rsp + 0x78]
lea r9, [rsp + 0x50]
mov r8d, 1
mov rcx, rsi
call fcn.140039d70
lea rcx, [rsp + 0x58]
mov rdx, rsi
call fcn.14003e2e0
mov rcx, rax
call fcn.14003a2b0
mov ecx, 7
int 0x29
ud2

Function at 0x140046490
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
invalid
dec dword [rcx + rcx*4 - 0x39]
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x140069121]
mov ecx, 0x10
mov edx, 8
call fcn.140007af0
test rax, rax
je 0x14004656f
mov rbx, rax
mov qword [rax], r14
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
jge 0x14004655f
Function at 0x140053490
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14005350a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140053500
cmp r11, r10
ja 0x1400535a3
cmp r10, rdx
ja 0x1400535b7
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140053502
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x1400534e0
jmp 0x140053577
ja 0x14005350a
mov r11, r10
cmp rax, r8
jne 0x1400534b2
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14005357b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140053550
mov r8, r10
sub ecx, r9d
jns 0x14005356e
jmp 0x14005357d
cmp r10, rdx
je 0x140053589
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14005357d
xor al, 1
cmp r8, rdx
jne 0x140053530
jmp 0x14005357d
xor eax, eax
jmp 0x14005357d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuelibrarycore_src_nummod.rsfrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140056640
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140056ba0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140056b30
ud2

Function at 0x140055068
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400550b2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400550b2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400550b2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400550b2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400550b2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400550b4
xor al, al
add rsp, 0x28
ret
Function at 0x140011226
Capabilities:
Terminate process

Disassembly:
jmp 0x140013ce0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x1400112bc
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015030
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015050
xor al, al
jmp 0x1400150d1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015063
xor al, al
jmp 0x1400150d1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001508d
xor al, al
jmp 0x1400150d1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400150a1
xor al, al
jmp 0x1400150d1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400150b3
xor al, al
jmp 0x1400150d1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400150cf
xor al, al
jmp 0x1400150d1
mov al, 1
add rsp, 0x38
ret
Function at 0x140012f20
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001141f
movzx eax, al
test eax, eax
jne 0x140012f40
mov ecx, 7
call fcn.140011370
nop
mov byte [rsp + 0x20], 0
call fcn.140011384
mov byte [rsp + 0x21], al
cmp dword [0x14001f8b8], 1
jne 0x140012f64
mov ecx, 7
call fcn.140011370
nop
jmp 0x140012fbc
cmp dword [0x14001f8b8], 0
jne 0x140012fb7
mov dword [0x14001f8b8], 1
lea rdx, [0x14001b660]
lea rcx, [0x14001b330]
call fcn.1400111d1
test eax, eax
je 0x140012f98
mov eax, 0xff
jmp 0x1400130c1
lea rdx, [0x14001b220]
lea rcx, [section..rdata]
call fcn.14001137a
mov dword [0x14001f8b8], 2
jmp 0x140012fbc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011357
call fcn.1400112e9
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140013019
mov rcx, qword [rsp + 0x30]
call fcn.14001117c
movzx eax, al
test eax, eax
je 0x140013019
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140026020]
nop
call fcn.140011320
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001304d
mov rcx, qword [rsp + 0x38]
call fcn.14001117c
movzx eax, al
test eax, eax
je 0x14001304d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400113cf
nop
call fcn.140013170
mov dword [rsp + 0x28], eax
call fcn.1400112bc
movzx eax, al
test eax, eax
jne 0x14001306c
mov ecx, dword [rsp + 0x28]
call fcn.140011064
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001307b
call fcn.1400113de
nop
xor edx, edx
mov cl, 1
call fcn.140011163
mov eax, dword [rsp + 0x28]
jmp 0x1400130c1
add rsp, 0x68
ret
Function at 0x14015c1bc
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
test rbp, rbp
mov qword [rsp], 0xfffffffff33da72d
lea rsp, [rsp + 8]
je 0x14016976f
push r10
mov r9d, 0xa912e1a1
lea r9, [0x140179308]
mov r10d, 0x67379f99
movzx r10d, byte [r10 + rbx - 0x67379f99]
push 0x1c1e3cbb
xor r10d, r8d
push 0x35178ebe
and r10d, 0xff
rol qword [rsp + 1], 0x16
mov r10d, dword [r9 + r10*4]
shr r8d, 8
xor r8d, r10d
shl byte [rsp + 0xb], 1
inc rbx
xor r8d, 0xb7a32d21
dec rbp
lea rsp, [rsp + 0x10]
jne 0x14015c1e4
jmp 0x140169767
mov r10d, 0xd19c8f25
pop r10
push 0xffffffffe619c724
push 0x5e85d187
not r8d
call fcn.140150725
mov edx, 0xe0343135
not rdx
mov r9, qword [rbp + riz]
mov rdx, qword [r9]
call fcn.1401539b7
mov eax, 0x4183d918
mov dx, word [rax + rbx - 0x4183d918]
rol ax, 0x6f
rol ax, 0x63
shl al, 0x83
lea rbx, [rax + rbx - 0x41836416]
movzx eax, word [r11 + rax - 0x41836418]
push 0xffffffffe8a782ad
rol byte [rsp + 2], 0x22
adc r11, 2
xor ax, di
sub ax, 0x430d
ror ax, 1
call fcn.14016ae06

Function at 0x14017973d
Capabilities:
Encode data using xor

Disassembly:
test r10, r10
lea rsp, [rsp + 8]
je 0x140143911
mov ebx, 0x19b067bc
rol bx, 0x8d
push r11
mov r11d, 0x12359f28
xchg bh, bl
lea rbx, [0x140142448]
mov r11d, 0xdc903aaf
movzx r11d, byte [rdx]
push 0x3a7a588
xor r11d, ecx
ror word [rsp + 5], 0xcb
and r11d, 0xff
mov r11d, dword [rbx + r11*4]
rol byte [rsp + 6], 0xe7
shr ecx, 8
xor ecx, r11d
inc rdx
xor ecx, 0x7a1d4d8c
sal qword [rsp], 2
dec r10
lea rsp, [rsp + 8]
jne 0x1401438bf
mov r11d, 0x471094a2
pop r11
push 0xffffffffa29466a8
not ecx
push 0xffffffffc88d5731
mov dword [r11], ecx
push 0xffffffffd71be3a4
lea rsp, [rsp + 0x18]
jmp fcn.14014d600
mov rdx, qword [r11]
mov r10, qword [r11 + 8]
add r11, 0xc
mov qword [rsp], 0xffffffffeb123317
sal word [rsp + 1], 0x21
xor ecx, ecx
jmp 0x140143897
Function at 0x180001440
Capabilities:
Encode data using base64

Disassembly:
mov rax, r8
mov r8d, edx
mov rdx, rcx
mov rcx, rax
jmp fcn.180004e90

Function at 0x180004e90
Capabilities:
Encode data using base64

Disassembly:
mov eax, 8
call fcn.180030460
sub rsp, rax
xor r11d, r11d
mov r9, rcx
test r8d, r8d
jle 0x180004f9d
mov qword [rsp], rbx
lea r10, [rdx + 1]
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop dword [rax + rax]
movzx ecx, byte [r10 - 1]
cmp r8d, 3
jl 0x180004f1f
movzx eax, byte [r10]
shl ecx, 8
or ecx, eax
movzx eax, byte [r10 + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
mov edx, ecx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9], al
mov eax, ecx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9 + 1], al
mov eax, ecx
shr rax, 6
and eax, 0x3f
and edx, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9 + 2], al
movzx eax, byte [rdx + rbx]
mov byte [r9 + 3], al
jmp 0x180004f74
shl ecx, 0x10
cmp r8d, 2
jne 0x180004f31
movzx eax, byte [r10]
shl eax, 8
or ecx, eax
mov rax, rcx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9 + 1], al
cmp r8d, 1
jne 0x180004f60
lea eax, [r8 + 0x3c]
jmp 0x180004f6b
shr rcx, 6
and ecx, 0x3f
movzx eax, byte [rcx + rbx]
mov byte [r9 + 2], al
mov byte [r9 + 3], 0x3d
sub r8d, 3
add r9, 4
add r11d, 4
add r10, 3
test r8d, r8d
jg 0x180004ec0
mov rbx, qword [rsp]
mov byte [r9], 0
mov eax, r11d
add rsp, 8
ret
mov byte [rcx], r11b
mov eax, r11d
add rsp, 8
ret
Function at 0x1800055f0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0xb8
call fcn.180030460
sub rsp, rax
mov rax, qword [0x180070650]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r14, qword [rsp + 0x110]
xor esi, esi
mov r13, r9
movsxd rdi, r8d
mov r12, rdx
mov rbp, rcx
mov eax, esi
test r9, r9
je 0x18000563e
lea eax, [rsi + 1]
mov qword [rcx], r9
jmp 0x180005641
mov r13, qword [rcx]
mov qword [rsp + 0xb0], rbx
test rdx, rdx
je 0x180005711
mov rcx, r13
call fcn.18000e7e0
mov ebx, eax
cmp eax, 0x80
jle 0x18000567b
lea r8, str.j____int_sizeof_ctx__key_
lea rcx, str..cryptohmachmac.c
mov edx, 0x54
call fcn.1800061b0
cmp ebx, edi
jge 0x1800056b3
lea rcx, [rbp + 8]
mov r8, r14
mov rdx, r13
call fcn.1800046d0
lea rcx, [rbp + 8]
mov r8, rdi
mov rdx, r12
call fcn.1800047b0
lea r12, [rbp + 0x68]
lea rdx, [rbp + 0x6c]
lea rcx, [rbp + 8]
mov r8, r12
call fcn.1800047d0
jmp 0x1800056ee
test edi, edi
js 0x1800056bf
cmp edi, 0x80
jle 0x1800056d7
lea r8, str.len_0__len__int_sizeof_ctx__key_
lea rcx, str..cryptohmachmac.c
mov edx, 0x5e
call fcn.1800061b0
lea rcx, [rbp + 0x6c]
mov r8, rdi
mov rdx, r12
call fcn.18002fe60
lea r12, [rbp + 0x68]
mov dword [r12], edi
mov ecx, dword [r12]
cmp ecx, 0x80
je 0x180005719
mov r8d, 0x80
xor edx, edx
sub r8d, ecx
lea rcx, [rcx + rbp + 0x6c]
call fcn.180030560
jmp 0x180005719
test eax, eax
je 0x1800057cd
lea rax, [rsp + 0x20]
mov rdi, rbp
mov rdx, rsi
sub rdi, rax
nop word [rax + rax]
lea rcx, [rsp + rdx + 0x20]
add rdx, 2
movzx eax, byte [rdi + rcx + 0x6c]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [rdi + rcx + 0x6d]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x80
jl 0x180005730
lea rcx, [rbp + 0x28]
mov r8, r14
mov rdx, r13
call fcn.1800046d0
mov rcx, r13
call fcn.18000e7e0
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x28]
movsxd r8, eax
call fcn.1800047b0
nop dword [rax]
lea rdx, [rsp + rsi + 0x20]
add rsi, 2
movzx eax, byte [rdi + rdx + 0x6c]
xor al, 0x5c
mov byte [rdx], al
movzx eax, byte [rdi + rdx + 0x6d]
xor al, 0x5c
mov byte [rdx + 1], al
cmp rsi, 0x80
jl 0x180005780
lea rcx, [rbp + 0x48]
mov r8, r14
mov rdx, r13
call fcn.1800046d0
mov rcx, r13
call fcn.18000e7e0
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x48]
movsxd r8, eax
call fcn.1800047b0
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 8]
call fcn.180004970
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.18002fe30
add rsp, 0xb8
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800061b0
Capabilities:
Terminate process

Disassembly:
mov eax, 0x28
call fcn.180030460
sub rsp, rax
mov r9, r8
mov r8d, edx
mov rdx, rcx
lea rcx, str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
call fcn.180005ee0
add rsp, 0x28
jmp fcn.180030bf4

Function at 0x1800066f0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov r9, rcx
test rcx, rcx
je 0x180006748
movzx eax, byte [rcx]
test al, al
je 0x180006748
mov r10d, 0x100
nop dword [rax + rax]
movsx edx, al
inc r9
or edx, r10d
add r10d, 0x100
mov eax, edx
shr eax, 2
xor eax, edx
and eax, 0xf
movzx ecx, al
movzx eax, byte [r9]
imul edx, edx
rol r8d, cl
xor r8d, edx
test al, al
jne 0x180006710
mov eax, r8d
shr eax, 0x10
xor eax, r8d
ret
xor eax, eax
ret
Function at 0x18000d5b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, 0x20
call fcn.180030460
sub rsp, rax
mov rbx, r8
call fcn.18000cfc0
test eax, eax
js 0x18000d7ee
mov eax, dword [rbx + 0xf0]
xor r10d, r10d
shl eax, 2
movsxd r9, eax
test eax, eax
jle 0x18000d639
lea rdx, [rbx + r9*4 + 8]
lea r8, [rbx + 8]
nop dword [rax + rax]
mov eax, dword [rdx - 8]
mov ecx, dword [r8 - 8]
add r10, 4
mov dword [r8 - 8], eax
mov eax, dword [rdx - 4]
mov dword [rdx - 8], ecx
mov ecx, dword [r8 - 4]
mov dword [r8 - 4], eax
mov eax, dword [rdx]
mov dword [rdx - 4], ecx
mov ecx, dword [r8]
mov dword [r8], eax
mov eax, dword [rdx + 4]
mov dword [rdx], ecx
mov ecx, dword [r8 + 4]
mov dword [r8 + 4], eax
sub r9, 4
mov dword [rdx + 4], ecx
sub rdx, 0x10
add r8, 0x10
cmp r10, r9
jl 0x18000d5f0
mov r11d, 1
cmp dword [rbx + 0xf0], r11d
jle 0x18000d7ec
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 2]
lea rdi, [0x180000000]
nop dword [rax]
mov r8d, dword [r10 + 0xe]
add r10, 0x10
inc r11d
mov eax, r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x4d540]
movzx eax, byte [r10 - 1]
movzx ecx, byte [rdi + rax*4 + 0x4d540]
mov r9d, dword [rdi + rdx*4 + 0x4e140]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0x4e940]
movzx ecx, byte [rdi + rax*4 + 0x4d540]
movzx eax, byte [r10]
xor r9d, dword [rdi + rcx*4 + 0x4ed40]
movzx ecx, byte [rdi + rax*4 + 0x4d540]
xor r9d, dword [rdi + rcx*4 + 0x4e540]
mov dword [r10 - 2], r9d
mov r9d, dword [r10 + 2]
mov eax, r9d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x4d540]
movzx eax, byte [r10 + 3]
movzx ecx, byte [rdi + rax*4 + 0x4d540]
mov r8d, dword [rdi + rdx*4 + 0x4e140]
movzx eax, byte [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0x4e940]
movzx ecx, byte [rdi + rax*4 + 0x4d540]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x4e540]
movzx ecx, byte [rdi + rax*4 + 0x4d540]
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rcx*4 + 0x4ed40]
mov eax, r9d
mov dword [r10 + 2], r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x4d540]
movzx eax, byte [r10 + 7]
movzx ecx, byte [rdi + rax*4 + 0x4d540]
mov r8d, dword [rdi + rdx*4 + 0x4e140]
movzx eax, byte [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0x4e940]
movzx ecx, byte [rdi + rax*4 + 0x4d540]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x4e540]
movzx ecx, byte [rdi + rax*4 + 0x4d540]
movzx eax, byte [r10 + 0xb]
xor r8d, dword [rdi + rcx*4 + 0x4ed40]
mov r9d, dword [r10 + 0xa]
mov dword [r10 + 6], r8d
movzx edx, byte [rdi + rax*4 + 0x4d540]
movzx eax, byte [r10 + 0xc]
movzx ecx, byte [rdi + rax*4 + 0x4d540]
mov r8d, dword [rdi + rdx*4 + 0x4e940]
mov eax, r9d
xor r8d, dword [rdi + rcx*4 + 0x4e540]
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x4d540]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x4e140]
movzx ecx, byte [rdi + rax*4 + 0x4d540]
xor r8d, dword [rdi + rcx*4 + 0x4ed40]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x18000d660
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret