joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d05a0
Capabilities:
Enumerate pe sections

Disassembly:
mov rax, qword [rcx + 0x70]
test rdx, rdx
je 0x5d06f8
movzx ecx, byte [rdx + 1]
movzx r9d, byte [rdx + 2]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx]
or ecx, r9d
movzx r9d, byte [rdx + 3]
shl r9d, 0x18
or ecx, r9d
mov dword [rax], ecx
movzx ecx, byte [rdx + 5]
movzx r9d, byte [rdx + 6]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 4]
or ecx, r9d
movzx r9d, byte [rdx + 7]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 4], ecx
movzx ecx, byte [rdx + 9]
movzx r9d, byte [rdx + 0xa]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 8]
or ecx, r9d
movzx r9d, byte [rdx + 0xb]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 8], ecx
movzx ecx, byte [rdx + 0xd]
movzx r9d, byte [rdx + 0xe]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0xc]
or ecx, r9d
movzx r9d, byte [rdx + 0xf]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 0xc], ecx
movzx ecx, byte [rdx + 0x11]
movzx r9d, byte [rdx + 0x12]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0x10]
or ecx, r9d
movzx r9d, byte [rdx + 0x13]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 0x10], ecx
movzx ecx, byte [rdx + 0x15]
movzx r9d, byte [rdx + 0x16]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0x14]
or ecx, r9d
movzx r9d, byte [rdx + 0x17]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 0x14], ecx
movzx ecx, byte [rdx + 0x19]
movzx r9d, byte [rdx + 0x1a]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0x18]
or ecx, r9d
movzx r9d, byte [rdx + 0x1b]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 0x18], ecx
movzx ecx, byte [rdx + 0x1d]
movzx r9d, byte [rdx + 0x1e]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0x1c]
movzx edx, byte [rdx + 0x1f]
or ecx, r9d
shl edx, 0x18
or edx, ecx
mov dword [rax + 0x1c], edx
test r8, r8
je 0x5d0798
movzx edx, byte [r8 + 2]
movzx ecx, byte [r8 + 1]
shl edx, 0x10
shl ecx, 8
or edx, ecx
movzx ecx, byte [r8]
or edx, ecx
movzx ecx, byte [r8 + 3]
shl ecx, 0x18
or edx, ecx
mov dword [rax + 0x20], edx
movzx edx, byte [r8 + 6]
movzx ecx, byte [r8 + 5]
shl edx, 0x10
shl ecx, 8
or edx, ecx
movzx ecx, byte [r8 + 4]
or edx, ecx
movzx ecx, byte [r8 + 7]
shl ecx, 0x18
or edx, ecx
mov dword [rax + 0x24], edx
movzx edx, byte [r8 + 0xa]
movzx ecx, byte [r8 + 9]
shl edx, 0x10
shl ecx, 8
or edx, ecx
movzx ecx, byte [r8 + 8]
or edx, ecx
movzx ecx, byte [r8 + 0xb]
shl ecx, 0x18
or edx, ecx
mov dword [rax + 0x28], edx
movzx edx, byte [r8 + 0xd]
movzx ecx, byte [r8 + 0xe]
shl edx, 8
shl ecx, 0x10
or edx, ecx
movzx ecx, byte [r8 + 0xc]
or edx, ecx
movzx ecx, byte [r8 + 0xf]
shl ecx, 0x18
or edx, ecx
mov dword [rax + 0x2c], edx
mov dword [rax + 0x70], 0
mov eax, 1
ret
Function at 0x5da640
Capabilities:
Hash data using sha256

Disassembly:
sub rsp, 0x28
call sym.EVP_MD_CTX_md_data
mov rcx, rax
add rsp, 0x28
jmp sym.SHA256_Init

Function at 0x5da740
Capabilities:
Hash data using sha384

Disassembly:
sub rsp, 0x28
call sym.EVP_MD_CTX_md_data
mov rcx, rax
add rsp, 0x28
jmp sym.SHA384_Init

Function at 0x5da760
Capabilities:
Hash data using sha512

Disassembly:
sub rsp, 0x28
call sym.EVP_MD_CTX_md_data
mov rcx, rax
add rsp, 0x28
jmp sym.SHA512_Init

Function at 0x5e0830
Capabilities:
Query environment variable

Disassembly:
push r12
sub rsp, 0x20
mov r12, rcx
call sym.OPENSSL_issetugid
test eax, eax
jne 0x5e0850
mov rcx, r12
add rsp, 0x20
pop r12
jmp sym.getenv
xor eax, eax
add rsp, 0x20
pop r12
ret
Function at 0x5e5f70
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
je 0x5e5fd0
movsx ecx, byte [rcx]
xor eax, eax
test cl, cl
je 0x5e5fc0
mov edi, 0x100
xor ebx, ebx
nop
call sym.ossl_tolower
add rsi, 1
or eax, edi
add edi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
rol ebx, cl
movsx ecx, byte [rsi]
xor ebx, eax
test cl, cl
jne 0x5e5f90
mov eax, ebx
shr eax, 0x10
xor eax, ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x5e9d90
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xc8]
mov rbx, rcx
mov rdi, rdx
mov r12, r9
test r8, r8
je 0x5e9e13
lea r13, [rcx + r8]
mov ecx, dword [rsp + 0xc0]
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
test ecx, ecx
jne 0x5e9e20
mov qword [rsp + 0x20], rax
mov r8, r12
mov rcx, rsi
add rbx, 1
mov qword [rsp + 0x28], rdx
mov rdx, rsi
add rdi, 1
call rbp
movzx eax, byte [rbx - 1]
movzx edx, byte [rsi]
xor edx, eax
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x21]
mov byte [rdi - 1], dl
mov rdx, qword [rsp + 0x29]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
cmp r13, rbx
jne 0x5e9dd0
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov qword [rsp + 0x20], rax
mov r8, r12
mov rcx, rsi
add rbx, 1
mov qword [rsp + 0x28], rdx
mov rdx, rsi
add rdi, 1
call rbp
movzx eax, byte [rbx - 1]
xor al, byte [rsi]
mov byte [rdi - 1], al
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x21]
mov rdx, qword [rsp + 0x29]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
cmp r13, rbx
jne 0x5e9e20
jmp 0x5e9e13
Function at 0x5ea740
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
lea rbx, [0x0093e5a0]
movzx r9d, byte [rcx + 0xf]
mov rax, r9
and r9d, 0xf0
and eax, 0xf
shl rax, 4
add r9, rdx
lea r11, [rcx + 0xe]
add rax, rdx
mov rdi, qword [rax]
mov rax, qword [rax + 8]
mov r10, rax
mov r8, rdi
shr rax, 4
shr r8, 4
and r10d, 0xf
xor r8, qword [r9]
shl rdi, 0x3c
xor r8, qword [rbx + r10*8]
mov r10, r8
mov r8, rax
or r8, rdi
mov rdi, qword [r9 + 8]
xor rdi, r8
nop
movzx r9d, byte [r11]
mov r8, rdi
mov rax, r10
shl r10, 0x3c
shr rdi, 4
and r8d, 0xf
shr rax, 4
mov rsi, r9
xor rax, qword [rbx + r8*8]
and r9d, 0xf0
mov r8, r10
and esi, 0xf
or r8, rdi
add r9, rdx
shl rsi, 4
mov rdi, qword [r9 + 8]
add rsi, rdx
xor rax, qword [rsi]
xor r8, qword [rsi + 8]
mov r10, rax
mov rsi, r8
shl rax, 0x3c
shr r8, 4
and esi, 0xf
shr r10, 4
xor r10, qword [r9]
or r8, rax
mov rax, r11
xor r10, qword [rbx + rsi*8]
sub r11, 1
xor rdi, r8
cmp rax, rcx
jne 0x5ea7a0
bswap r10
bswap rdi
mov qword [rcx], r10
mov qword [rcx + 8], rdi
pop rbx
pop rsi
pop rdi
ret
Function at 0x5ec8a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 0x30]
lea rdi, [rax*8]
mov rax, qword [rcx + 0x38]
mov rbx, rcx
mov r12, rdx
lea r13, [rcx + 0x188]
mov rbp, r8
lea rsi, [rax*8]
mov eax, dword [rcx + 0x170]
lea r15, [rcx + 0x60]
lea r14, [rcx + 0x40]
test eax, eax
jne 0x5ec998
mov edx, dword [rcx + 0x174]
mov rax, r13
mov r9d, 0x10
test edx, edx
jne 0x5ec978
movq xmm1, rsi
movq xmm0, rdi
bswap rsi
bswap rdi
punpcklqdq xmm0, xmm1
mov r8, r13
mov rdx, r15
mov rcx, r14
movups xmmword [rbx + 0x30], xmm0
mov qword [rax], rdi
mov qword [rax + 8], rsi
call sym.gcm_ghash_4bit
movdqu xmm0, xmmword [rbx + 0x40]
movdqu xmm2, xmmword [rbx + 0x20]
pxor xmm0, xmm2
movups xmmword [rbx + 0x40], xmm0
test r12, r12
je 0x5eca00
cmp rbp, 0x10
ja 0x5eca00
mov r8, rbp
mov rdx, r12
mov rcx, r14
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.CRYPTO_memcmp
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0x28], r9
call sym.gcm_gmult_4bit
mov r9, qword [rsp + 0x28]
mov rax, r13
jmp 0x5ec901
lea r9d, [rax + 0xf]
mov ecx, eax
xor edx, edx
and r9d, 0xfffffff0
add rcx, r13
mov r8d, r9d
mov dword [rsp + 0x28], r9d
sub r8d, eax
call sym.memset
mov r9d, dword [rsp + 0x28]
cmp r9d, 0x30
je 0x5ec9d8
mov eax, r9d
add r9d, 0x10
add rax, r13
jmp 0x5ec901
mov r9d, 0x30
mov r8, r13
mov rdx, r15
mov rcx, r14
call sym.gcm_ghash_4bit
mov rax, r13
mov r9d, 0x10
jmp 0x5ec901
mov eax, 0xffffffff
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x5ecc90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, qword [rcx + 0x28]
mov rax, qword [rcx + 0x58]
mov rbx, rcx
mov rsi, rdx
cmp rdi, rdx
jae 0x5ece7f
mov rcx, qword [rcx + 0x30]
cmp rcx, rdx
jbe 0x5ece46
lea r11, [rdi + 1]
mov r10, r11
shl r10, 4
jmp 0x5eccd8
mov rax, qword [rbx + 0x58]
add r11, 1
lea rdx, [rax + r10]
lea rax, [rax + r10 - 0x10]
movzx r9d, byte [rax + 0xf]
movzx r8d, byte [rax + 0xe]
movzx ecx, byte [rax]
lea ebp, [r8 + r8]
lea edi, [r9 + r9]
sar r9d, 7
sar r8d, 7
or r9d, ebp
sar cl, 7
mov byte [rdx + 0xe], r9b
movzx r9d, byte [rax + 0xd]
and ecx, 0xffffff87
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 0xd], r8b
movzx r8d, byte [rax + 0xc]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 0xc], r9b
movzx r9d, byte [rax + 0xb]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 0xb], r8b
movzx r8d, byte [rax + 0xa]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 0xa], r9b
movzx r9d, byte [rax + 9]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 9], r8b
movzx r8d, byte [rax + 8]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 8], r9b
movzx r9d, byte [rax + 7]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 7], r8b
movzx r8d, byte [rax + 6]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 6], r9b
movzx r9d, byte [rax + 5]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 5], r8b
movzx r8d, byte [rax + 4]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 4], r9b
movzx r9d, byte [rax + 3]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 3], r8b
movzx r8d, byte [rax + 2]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 2], r9b
movzx r9d, byte [rax + 1]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 1], r8b
movzx r8d, byte [rax]
lea eax, [r8 + r8]
or eax, r9d
xor ecx, edi
add r10, 0x10
mov byte [rdx], al
mov byte [rdx + 0xf], cl
cmp r11, rsi
jne 0x5eccd0
mov rax, qword [rbx + 0x58]
mov qword [rbx + 0x28], r11
shl r11, 4
add rax, r11
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, [rdx + 4]
mov r9d, 0x71
lea r8, str.crypto_modes_ocb128.c
sub rdx, rcx
and rdx, 0xfffffffffffffffc
add rdx, rcx
mov rcx, rax
mov qword [rbx + 0x30], rdx
shl rdx, 4
call sym.CRYPTO_realloc
test rax, rax
je 0x5ece3d
mov qword [rbx + 0x58], rax
jmp 0x5eccbc
shl rsi, 4
add rax, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x5f1030
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r8d, dword [rcx]
mov rdx, qword [rcx + 8]
mov rbx, rcx
cmp r8d, 2
je 0x5f10f0
jg 0x5f1078
test r8d, r8d
je 0x5f1098
cmp r8d, 1
jne 0x5f1088
mov rcx, qword [rdx]
call sym.OPENSSL_LH_strhash
mov r8d, dword [rbx]
and eax, 0x3fffffff
shl r8d, 0x1e
or eax, r8d
add rsp, 0x28
pop rbx
pop rsi
ret
cmp r8d, 3
jne 0x5f1088
mov eax, dword [rdx + 0x10]
jmp 0x5f1062
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov ecx, dword [rdx + 0x14]
mov r11, qword [rdx + 0x18]
mov eax, ecx
shl eax, 0x14
test ecx, ecx
jle 0x5f1062
lea esi, [rcx + rcx*2]
xor r9d, r9d
mov ebx, 0xaaaaaaab
nop dword [rax + rax]
mov edx, r9d
movzx r10d, byte [r11]
mov ecx, r9d
add r9d, 3
imul rdx, rbx
add r11, 1
shr rdx, 0x24
lea edx, [rdx + rdx*2]
shl edx, 3
sub ecx, edx
shl r10d, cl
xor eax, r10d
cmp esi, r9d
jne 0x5f10b8
jmp 0x5f1062
mov rcx, qword [rdx + 8]
call sym.OPENSSL_LH_strhash
mov r8d, dword [rbx]
jmp 0x5f1062
Function at 0x602bf0
Capabilities:
Generate random numbers via winapi

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x50
mov edx, 1
mov r12, rcx
call sym.rand_pool_bytes_needed
mov rcx, r12
mov rdx, rax
mov r13, rax
call sym.rand_pool_add_begin
mov rbx, rax
test rax, rax
je 0x602c70
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x602cf0
xor r8d, r8d
xor r13d, r13d
mov rcx, r12
mov rdx, r13
call sym.rand_pool_add_end
mov rcx, r12
call sym.rand_pool_entropy_available
test rax, rax
je 0x602c70
add rsp, 0x50
pop rbx
pop r12
pop r13
ret
mov edx, 1
mov rcx, r12
call sym.rand_pool_bytes_needed
mov rcx, r12
mov rdx, rax
mov r13, rax
call sym.rand_pool_add_begin
mov rbx, rax
test rax, rax
je 0x602cdb
xor edx, edx
mov dword [rsp + 0x20], 0xf0000040
lea rcx, [rsp + 0x48]
mov r9d, 0x16
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x602d40
xor r8d, r8d
xor r13d, r13d
mov rcx, r12
mov rdx, r13
call sym.rand_pool_add_end
mov rcx, r12
call sym.rand_pool_entropy_available
test rax, rax
jne 0x602c60
mov rcx, r12
call sym.rand_pool_entropy_available
add rsp, 0x50
pop rbx
pop r12
pop r13
ret
mov rcx, qword [rsp + 0x48]
mov r8, rbx
mov edx, r13d
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x602d30
xor r8d, r8d
xor r13d, r13d
mov qword [rsp + 0x38], r8
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r8, qword [rsp + 0x38]
jmp 0x602c48
lea r8, [r13*8]
jmp 0x602d0b
mov rcx, qword [rsp + 0x48]
mov r8, rbx
mov edx, r13d
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x602d80
lea r8, [r13*8]
mov qword [rsp + 0x38], r8
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r8, qword [rsp + 0x38]
jmp 0x602cc3
xor r8d, r8d
xor r13d, r13d
jmp 0x602d5d
Function at 0x607140
Capabilities:
Encode data using xor

Disassembly:
mov rcx, qword [rcx + 0x18]
jmp sym.BN_num_bits
Function at 0x60eb90
Capabilities:
Check for software breakpoints

Disassembly:
push r12
sub rsp, 0x30
mov eax, dword [rsp + 0x60]
cmp eax, r9d
jne 0x60ec68
movzx r9d, byte [r8]
lea edx, [r9 - 0x6a]
cmp dl, 1
ja 0x60ec68
lea rdx, [r8 + 1]
lea r12d, [rax - 2]
cmp r9b, 0x6b
je 0x60ebe8
movsxd rax, r12d
cmp byte [rdx + rax], 0xcc
jne 0x60ec97
mov r8d, r12d
call sym.memcpy
mov eax, r12d
add rsp, 0x30
pop r12
ret
lea r12d, [rax - 3]
test r12d, r12d
jle 0x60ec1b
xor eax, eax
jmp 0x60ec06
cmp r8b, 0xbb
jne 0x60ec28
add eax, 1
cmp r12d, eax
je 0x60ec60
movzx r8d, byte [rdx]
add rdx, 1
cmp r8b, 0xba
jne 0x60ebf8
sub r12d, eax
test eax, eax
jne 0x60ebc2
mov dword [rsp + 0x20], 0x50
jmp 0x60ec30
mov dword [rsp + 0x20], 0x48
mov r8d, 0x8a
mov edx, pe_nt_image_headers64
mov ecx, 4
mov r12d, 0xffffffff
lea r9, str.crypto_rsa_rsa_x931.c
call sym.ERR_put_error
mov eax, r12d
add rsp, 0x30
pop r12
ret
xor r12d, r12d
jmp 0x60ebc2
mov r8d, 0x89
mov edx, pe_nt_image_headers64
mov ecx, 4
mov dword [rsp + 0x20], 0x3d
lea r9, str.crypto_rsa_rsa_x931.c
mov r12d, 0xffffffff
call sym.ERR_put_error
jmp 0x60ebd7
mov r8d, 0x8b
mov edx, pe_nt_image_headers64
mov ecx, 4
mov dword [rsp + 0x20], 0x59
lea r9, str.crypto_rsa_rsa_x931.c
mov r12d, 0xffffffff
call sym.ERR_put_error
jmp 0x60ebd7

Function at 0x6125d0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, 1
jmp sym.sha1_block_data_order
Function at 0x613f70
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
mov r8d, 1
jmp sym.sha256_block_data_order

Function at 0x6142a0
Capabilities:
Hash data using sha256

Disassembly:
push r13
push r12
push rdi
sub rsp, 0x90
lea rax, [0x00a5c3e0]
movdqu xmm0, xmmword [0x0095ab80]
test r8, r8
mov r12, r8
lea r8, [rsp + 0x40]
mov r9, rcx
cmove r12, rax
mov ecx, 9
xor eax, eax
mov rdi, r8
rep stosq qword [rdi], rax
movups xmmword [rsp + 0x20], xmm0
movdqu xmm0, xmmword [0x0095ab90]
lea r13, [rsp + 0x20]
movups xmmword [rsp + 0x30], xmm0
mov dword [rdi], 0
mov dword [rsp + 0x8c], 0x20
test rdx, rdx
je 0x614315
mov r8, rdx
mov rcx, r13
mov rdx, r9
call sym.SHA256_Update.part.0
mov rdx, r13
mov rcx, r12
call sym.SHA256_Final
mov edx, 0x70
mov rcx, r13
call sym.OPENSSL_cleanse
mov rax, r12
add rsp, 0x90
pop rdi
pop r12
pop r13
ret
Function at 0x616610
Capabilities:
Encode data using xor
Hash data using sha512

Disassembly:
mov r8d, 1
jmp sym.sha512_block_data_order
Function at 0x61f6b0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [rbx], eax
setne al
movzx eax, al
add rsp, 0x20
pop rbx
ret

Function at 0x61f6d0
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [r12]
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, r13d
mov r12, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, r12
add rsp, 0x28
pop r12
pop r13
ret

Function at 0x61f710
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
setne al
movzx eax, al
add rsp, 0x28
ret
Function at 0x641d00
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, r8
call sym.AES_set_encrypt_key
test eax, eax
js 0x641f14
mov edx, dword [rsi + 0xf0]
mov rcx, rsi
lea r11d, [rdx*4]
test r11d, r11d
jle 0x641da3
movsxd rax, r11d
mov rdx, rsi
xor r8d, r8d
lea rax, [rsi + rax*4]
nop dword [rax + rax]
mov r9d, dword [rdx]
mov r10d, dword [rax]
add r8d, 4
add rdx, 0x10
sub rax, 0x10
mov dword [rdx - 0x10], r10d
mov r10d, dword [rax + 0x14]
mov dword [rax + 0x10], r9d
mov r9d, dword [rdx - 0xc]
mov dword [rdx - 0xc], r10d
mov r10d, dword [rax + 0x18]
mov dword [rax + 0x14], r9d
mov r9d, dword [rdx - 8]
mov dword [rdx - 8], r10d
mov r10d, dword [rax + 0x1c]
mov dword [rax + 0x18], r9d
mov r9d, dword [rdx - 4]
mov dword [rdx - 4], r10d
mov dword [rax + 0x1c], r9d
mov r9d, r11d
sub r9d, r8d
cmp r8d, r9d
jl 0x641d48
mov edx, dword [rsi + 0xf0]
mov edi, 1
lea r11, [0x00960ce0]
lea rax, [0x009618e0]
lea r10, [0x009600e0]
lea r9, [0x009608e0]
lea r8, [0x009604e0]
cmp edx, 1
jle 0x641f12
nop dword [rax]
mov r13d, dword [rcx + 0x10]
mov r12d, dword [rcx + 0x14]
add rcx, 0x10
add edi, 1
mov ebp, dword [rcx + 8]
mov r15d, dword [rcx + 0xc]
mov edx, r13d
movzx r14d, r13b
mov ebx, r13d
shr edx, 0x18
movzx r14d, byte [rax + r14*4]
movzx ebx, bh
movzx edx, byte [rax + rdx*4]
mov edx, dword [r11 + rdx*4]
xor edx, dword [r10 + r14*4]
mov r14d, r13d
shr r14d, 0x10
movzx r13d, byte [rax + rbx*4]
mov ebx, r12d
movzx r14d, r14b
movzx ebx, bh
movzx r14d, byte [rax + r14*4]
xor edx, dword [r9 + r14*4]
xor edx, dword [r8 + r13*4]
movzx r13d, r12b
movd xmm0, edx
mov edx, r12d
movzx r13d, byte [rax + r13*4]
shr edx, 0x18
movzx edx, byte [rax + rdx*4]
mov edx, dword [r11 + rdx*4]
xor edx, dword [r10 + r13*4]
mov r13d, r12d
shr r13d, 0x10
movzx r12d, byte [rax + rbx*4]
mov ebx, ebp
movzx r13d, r13b
movzx r13d, byte [rax + r13*4]
xor edx, dword [r9 + r13*4]
xor edx, dword [r8 + r12*4]
movzx r13d, bpl
mov r12d, edx
mov edx, ebp
movzx r13d, byte [rax + r13*4]
shr edx, 0x18
movd xmm3, r12d
movzx edx, byte [rax + rdx*4]
punpckldq xmm0, xmm3
mov edx, dword [r11 + rdx*4]
xor edx, dword [r10 + r13*4]
mov r13d, ebp
movzx ebp, bh
shr r13d, 0x10
movzx ebp, byte [rax + rbp*4]
mov ebx, r15d
movzx r13d, r13b
shr ebx, 0x18
movzx r13d, byte [rax + r13*4]
xor edx, dword [r9 + r13*4]
movzx r13d, r15b
xor edx, dword [r8 + rbp*4]
mov ebp, ebx
movzx r13d, byte [rax + r13*4]
movzx ebp, byte [rax + rbp*4]
mov ebx, r15d
movd xmm1, edx
shr ebx, 0x10
mov ebp, dword [r11 + rbp*4]
xor ebp, dword [r10 + r13*4]
movzx r13d, bl
mov ebx, r15d
movzx ebx, bh
movzx r13d, byte [rax + r13*4]
movzx ebx, byte [rax + rbx*4]
xor ebp, dword [r9 + r13*4]
xor ebp, dword [r8 + rbx*4]
movd xmm2, ebp
punpckldq xmm1, xmm2
punpcklqdq xmm0, xmm1
movups xmmword [rcx], xmm0
cmp dword [rsi + 0xf0], edi
jg 0x641dd8
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x6450a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rbx
sub rsp, 0x38
test r9, r9
je 0x645170
movzx r10d, byte [r8]
mov ebx, r10d
and ebx, 0xffffff80
test rdx, rdx
je 0x6450c3
movzx eax, bl
mov dword [rdx], eax
cmp r9, 1
je 0x6451a8
movzx eax, byte [r8]
test al, al
jne 0x645138
movzx eax, byte [r8 + 1]
and eax, 0xffffff80
cmp bl, al
je 0x6451d8
lea r11, [r9 - 1]
test rcx, rcx
je 0x645127
movsx eax, r10b
sub r9, r11
sar r10b, 7
lea rdx, [r11 - 1]
shr eax, 0x1f
add r9, r8
nop dword [rax + rax]
movzx r8d, byte [r9 + rdx]
xor r8d, r10d
movzx r8d, r8b
add eax, r8d
mov byte [rcx + rdx], al
sub rdx, 1
shr eax, 8
cmp rdx, 0xffffffffffffffff
jne 0x645108
mov rax, r11
add rsp, 0x38
pop rbx
pop rsi
ret
mov r11, r9
cmp al, 0xff
jne 0x6450e9
lea rax, [r8 + 1]
lea rsi, [r8 + r9]
xor edx, edx
nop dword [rax]
movzx r11d, byte [rax]
add rax, 1
or edx, r11d
cmp rsi, rax
jne 0x645150
test edx, edx
jne 0x6450d5
mov r11, r9
jmp 0x6450e9
mov r8d, 0xde
mov edx, 0xe2
mov ecx, 0xd
mov dword [rsp + 0x20], 0x9a
lea r9, str.crypto_asn1_a_int.c
call sym.ERR_put_error
xor r11d, r11d
mov rax, r11
add rsp, 0x38
pop rbx
pop rsi
ret
mov r11d, 1
test rcx, rcx
je 0x645127
movzx eax, byte [r8]
mov edx, eax
neg eax
test r10b, r10b
cmovns eax, edx
mov byte [rcx], al
mov rax, r11
add rsp, 0x38
pop rbx
pop rsi
ret
mov r8d, 0xdd
mov edx, 0xe2
mov ecx, 0xd
mov dword [rsp + 0x20], 0xbb
lea r9, str.crypto_asn1_a_int.c
call sym.ERR_put_error
xor r11d, r11d
jmp 0x645127

Function at 0x645270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
push rsi
push rbx
movsxd r8, dword [rcx]
mov r11, qword [rcx + 8]
mov r10, r8
test r11, r11
je 0x6452b8
test r8, r8
je 0x6452b8
mov eax, dword [rcx + 4]
movzx ecx, byte [r11]
and eax, 0x100
jne 0x645338
cmp rcx, 0x7f
jbe 0x645328
lea rdi, [r8 + 1]
xor ebx, ebx
mov r10d, edi
mov rsi, rdi
jmp 0x6452ca
xor esi, esi
mov r10d, 1
xor ebx, ebx
mov edi, 1
xor r8d, r8d
test rdx, rdx
je 0x64531b
mov r9, qword [rdx]
test r9, r9
je 0x64531b
mov eax, ebx
sub rsi, r8
mov byte [r9], bl
lea rcx, [r8 - 1]
and eax, 1
add r9, rsi
movzx eax, al
test r8, r8
je 0x645318
nop dword [rax]
movzx r8d, byte [r11 + rcx]
xor r8d, ebx
movzx r8d, r8b
add eax, r8d
mov byte [r9 + rcx], al
sub rcx, 1
shr eax, 8
cmp rcx, 0xffffffffffffffff
jne 0x6452f8
add qword [rdx], rdi
mov eax, r10d
pop rbx
pop rsi
pop rdi
ret
mov rdi, r8
xor ebx, ebx
test eax, eax
je 0x6452ac
nop dword [rax]
cmp rcx, 0x80
jbe 0x645358
lea rdi, [r8 + 1]
mov ebx, 0xffffffff
mov r10d, edi
jmp 0x6452ac
mov rdi, r8
mov ebx, 0xffffffff
jne 0x6452ac
cmp r8, 1
jbe 0x6453a8
lea rax, [r11 + 1]
lea r10, [r11 + r8]
xor ecx, ecx
nop word cs:[rax + rax]
movzx r9d, byte [rax]
add rax, 1
or ecx, r9d
cmp r10, rax
jne 0x645380
test ecx, ecx
setne dil
mov ebx, edi
and edi, 1
add rdi, r8
neg ebx
mov r10d, edi
jmp 0x6452ac
mov edi, 1
xor ebx, ebx
jmp 0x6452ac
Function at 0x646ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x10
mov r10d, 8
lea rax, [rsp + 0xf]
nop dword [rax]
mov byte [rax], dl
mov r11, r10
mov edi, edx
sub r10, 1
mov rbx, rdx
shr rdx, 8
mov r9, rax
mov rsi, rax
lea rax, [rax - 1]
jne 0x646af8
mov eax, 8
sub rax, r10
mov rbp, rax
je 0x646ba0
test dil, dil
jns 0x646bc0
test r8d, r8d
jne 0x646be0
mov edx, 9
xor edi, edi
sub rdx, r10
mov r12d, edx
test rcx, rcx
je 0x646bae
sub r11, 9
mov eax, edi
mov r8d, 7
mov byte [rcx], dil
and eax, 1
sub r8, r10
lea r10, [rbp + r11]
add rdx, r11
movzx eax, al
add r9, r10
add rcx, rdx
nop dword [rax]
movzx edx, byte [r9 + r8]
xor edx, edi
movzx edx, dl
add eax, edx
mov byte [rcx + r8], al
sub r8, 1
shr eax, 8
cmp r8, 0xffffffffffffffff
jne 0x646b70
mov eax, r12d
add rsp, 0x10
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test rcx, rcx
je 0x646bcf
mov byte [rcx], 0
mov r12d, 1
mov eax, r12d
add rsp, 0x10
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test r8d, r8d
jne 0x646be0
mov rdx, rbp
xor edi, edi
jmp 0x646b3f
mov r12d, 1
jmp 0x646bae
cmp dil, 0x80
jbe 0x646bf8
mov edx, 9
mov edi, 0xffffffff
sub rdx, r10
jmp 0x646b3f
mov rdx, rbp
mov edi, 0xffffffff
cmp rbx, 0x80
jne 0x646b3f
cmp rbp, 1
je 0x646bc5
lea rax, [r9 + 1]
add rsi, rbp
xor edx, edx
nop dword [rax]
movzx r8d, byte [rax]
add rax, 1
or edx, r8d
cmp rsi, rax
jne 0x646c20
test edx, edx
setne dl
mov edi, edx
and edx, 1
neg edi
add rdx, rbp
jmp 0x646b3f

Function at 0x648520
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov eax, 1
mov r9, rcx
mov ebx, r8d
mov rcx, rdx
test r9, r9
je 0x648550
movsxd r8, r8d
mov edx, 1
mov ebx, ebx
call sym.fwrite
cmp rbx, rax
sete al
movzx eax, al
add rsp, 0x20
pop rbx
ret