joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140750058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1407501df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140750089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14075006f
add dl, dl
jne 0x140750096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407500f6
xor eax, eax
add dl, dl
jne 0x1407500a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407501ad
add dl, dl
jne 0x1407500b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407500c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407500d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407500dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407500ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14075007e
mov eax, 1
add dl, dl
jne 0x140750106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140750113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407500fb
sub eax, ebx
mov ebx, 1
jne 0x14075014c
mov ecx, 1
add dl, dl
jne 0x14075012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14075013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140750123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14075007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140750168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140750175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14075015d
cmp eax, 0x7d00
jae 0x14075019b
cmp eax, 0x500
jb 0x140750196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14075007e
cmp eax, 0x7f
ja 0x14075019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14075007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407501d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14075007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x141162058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1411621df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141162089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14116206f
add dl, dl
jne 0x141162096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1411620f6
xor eax, eax
add dl, dl
jne 0x1411620a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1411621ad
add dl, dl
jne 0x1411620b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1411620c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1411620d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1411620dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1411620ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14116207e
mov eax, 1
add dl, dl
jne 0x141162106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141162113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1411620fb
sub eax, ebx
mov ebx, 1
jne 0x14116214c
mov ecx, 1
add dl, dl
jne 0x14116212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14116213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141162123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14116207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141162168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141162175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14116215d
cmp eax, 0x7d00
jae 0x14116219b
cmp eax, 0x500
jb 0x141162196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14116207e
cmp eax, 0x7f
ja 0x14116219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14116207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1411621d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14116207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001c10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1130
call fcn.1400a06f0
sub rsp, rax
mov rax, qword [0x1400fb010]
xor rax, rsp
mov qword [rsp + 0x1120], rax
mov rbp, r8
xor ebx, ebx
mov qword [rsp + 0x80], rbx
mov esi, 0xf
mov qword [rsp + 0x88], rsi
mov byte [rsp + 0x70], bl
xor r8d, r8d
lea rdx, [0x1400ec068]
lea rcx, [rsp + 0x70]
call fcn.140002620
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rsi
mov byte [rsp + 0x90], bl
mov dword [rsp + 0x10f8], ebx
mov qword [rsp + 0x1100], rbx
mov dword [rsp + 0x1108], ebx
mov qword [rsp + 0x1110], rbx
mov dword [rsp + 0x20], 0x100
lea r9d, [rbx + 0x20]
mov r8d, 0x8000
lea rdx, str.._user_permit.txt
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__sopen_s]
test eax, eax
jne 0x140001d8a
lea rdx, [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat64i32]
mov ebx, dword [rsp + 0x4c]
lea eax, [rbx + 1]
movsxd rcx, eax
call fcn.1400035bc
mov rdi, rax
mov r8d, ebx
mov rdx, rax
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
movsxd rbx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
mov byte [rbx + rdi], 0
cmp rbx, 0x1c
jb 0x140001d82
lea rdx, [rdi + 0x10]
call fcn.1400020b0
mov ebx, eax
mov rdx, rdi
call fcn.140002a00
cmp eax, ebx
jne 0x140001d82
lea rdx, str.59397
lea rcx, [rsp + 0xb0]
call fcn.140002bb0
mov r8, rbp
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.1400021e0
mov r8, rdi
lea edx, [rsi + 0xe]
lea rcx, [0x140105df0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov rcx, rdi
call fcn.140002de4
mov bl, 1
mov rsi, qword [rsp + 0xa8]
jmp 0x140001d8c
mov rcx, rdi
call fcn.140002de4
xor bl, bl
cmp rsi, 0x10
jb 0x140001dc4
lea rdx, [rsi + 1]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001dbf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001dfb
call fcn.140002de4
mov rdx, qword [rsp + 0x88]
cmp rdx, 0x10
jb 0x140001e07
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e02
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002de4
movzx eax, bl
mov rcx, qword [rsp + 0x1120]
xor rcx, rsp
call fcn.140002dc0
lea r11, [rsp + 0x1130]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400021e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1400fb010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, r8
lea rsi, [rcx + 0x40]
mov rdi, rdx
call fcn.1400020b0
lea rdx, [rdi + 8]
mov ebx, eax
call fcn.1400020b0
mov edi, eax
lea r10, [rsi + 0x44]
mov r11d, 0x10
nop word [rax + rax]
xor ebx, dword [r10]
lea r10, [r10 - 4]
mov ecx, ebx
mov r9d, ebx
mov ebp, ebx
shr ecx, 8
mov edx, ecx
shr rdx, 8
mov r8d, ecx
mov rcx, rdx
shr rcx, 8
movzx eax, dl
mov ebx, dword [rsi + rcx*4 + 0x48]
add ebx, dword [rsi + rax*4 + 0x448]
movzx eax, r8b
xor ebx, dword [rsi + rax*4 + 0x848]
movzx eax, r9b
add ebx, dword [rsi + rax*4 + 0xc48]
xor ebx, edi
mov edi, ebp
sub r11, 1
jne 0x140002230
mov ecx, dword [rsi]
mov edx, dword [rsi + 4]
xor ecx, ebp
mov r8d, ecx
mov eax, ecx
shr eax, 0x10
xor edx, ebx
and r8d, 0xff0000
or r8d, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr r8d, 8
shl eax, 8
mov ecx, edx
or r8d, eax
and ecx, 0xff0000
mov eax, edx
mov dword [r14], r8d
shr eax, 0x10
or ecx, eax
mov eax, edx
shl eax, 0x10
and edx, 0xff00
or eax, edx
shr ecx, 8
shl eax, 8
or ecx, eax
mov dword [rsp + 0x24], ecx
movzx eax, cl
mov byte [r14 + 4], cl
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140002dc0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x140002a00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r10, rdx
mov eax, 0xffffffff
xor r11d, r11d
nop dword [rax + rax]
movzx r9d, byte [r10]
lea r10, [r10 + 1]
mov r8d, eax
mov ecx, r9d
xor ecx, eax
shr r8d, 1
mov edx, r8d
xor edx, 0xedb88320
and cl, 1
cmove edx, r8d
shr r9w, 1
mov ecx, edx
movzx eax, r9w
xor eax, edx
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
and al, 1
cmove edx, ecx
shr r9w, 1
mov ecx, edx
movzx eax, r9w
xor eax, edx
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
and al, 1
cmove edx, ecx
shr r9w, 1
mov ecx, edx
movzx eax, r9w
xor eax, edx
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
and al, 1
cmove edx, ecx
shr r9w, 1
mov ecx, edx
movzx eax, r9w
xor eax, edx
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
and al, 1
cmove edx, ecx
shr r9w, 1
mov ecx, edx
movzx eax, r9w
xor eax, edx
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
and al, 1
cmove edx, ecx
shr r9w, 1
mov eax, edx
movzx r8d, r9w
shr eax, 1
xor edx, r8d
mov ecx, eax
xor ecx, 0xedb88320
and dl, 1
cmove ecx, eax
shr r8d, 1
xor r8d, ecx
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, 0xedb88320
and r8b, 1
cmove eax, edx
inc r11d
cmp r11d, 0x10
jb 0x140002a10
not eax
ret
Function at 0x140002bb0
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movaps xmm0, xmmword [0x1400efbd0]
mov rdi, rdx
movups xmmword [rcx], xmm0
lea rdx, [0x1400eebd0]
mov rbx, rcx
movaps xmm1, xmmword [0x1400efbe0]
mov r8d, 0x1000
movups xmmword [rcx + 0x10], xmm1
movaps xmm0, xmmword [0x1400efbf0]
movups xmmword [rcx + 0x20], xmm0
movaps xmm1, xmmword [0x1400efc00]
movups xmmword [rcx + 0x30], xmm1
movsd xmm0, qword [0x1400efc10]
movsd qword [rcx + 0x40], xmm0
add rcx, 0x48
call sub.VCRUNTIME140.dll_memcpy
xor edx, edx
mov r11, rbx
movzx r8d, dx
mov r14d, 4
lea esi, [rdx + 0x12]
mov r9d, edx
mov r10, r14
nop word [rax + rax]
movsx rax, r8w
shl r9d, 8
movsx ecx, byte [rax + rdi]
movzx eax, cl
or r9d, eax
lea eax, [r8 + 1]
cmp ax, 5
mov r8d, edx
cmovl r8w, ax
sub r10, 1
jne 0x140002c40
xor dword [r11], r9d
add r11, r14
sub rsi, 1
jne 0x140002c30
mov r9d, edx
lea ebp, [rsi + 9]
mov r11, rbx
nop dword [rax]
mov ecx, edx
mov r10, rbx
mov esi, 0x10
nop word [rax + rax]
xor ecx, dword [r10]
lea r10, [r10 + 4]
mov eax, ecx
mov r8d, ecx
mov edi, ecx
shr eax, 8
mov edx, eax
shr rax, 8
mov rcx, rax
movzx eax, al
shr rcx, 8
mov ecx, dword [rbx + rcx*4 + 0x48]
add ecx, dword [rbx + rax*4 + 0x448]
movzx eax, dl
xor ecx, dword [rbx + rax*4 + 0x848]
movzx eax, r8b
add ecx, dword [rbx + rax*4 + 0xc48]
xor ecx, r9d
mov r9d, edi
sub rsi, 1
jne 0x140002c90
mov edx, dword [rbx + 0x44]
mov r9d, dword [rbx + 0x40]
xor edx, edi
xor r9d, ecx
mov dword [r11], edx
mov dword [r11 + 4], r9d
add r11, 8
sub rbp, 1
jne 0x140002c80
lea r10, [rbx + 0x4c]
nop
mov ebp, 0x80
nop word [rax + rax]
mov eax, edx
mov r11, rbx
mov esi, 0x10
nop word [rax + rax]
xor eax, dword [r11]
lea r11, [r11 + 4]
mov ecx, eax
mov r8d, eax
mov edi, eax
shr ecx, 8
mov edx, ecx
shr rcx, 8
mov rax, rcx
movzx ecx, cl
shr rax, 8
mov eax, dword [rbx + rax*4 + 0x48]
add eax, dword [rbx + rcx*4 + 0x448]
movzx ecx, dl
xor eax, dword [rbx + rcx*4 + 0x848]
movzx ecx, r8b
add eax, dword [rbx + rcx*4 + 0xc48]
xor eax, r9d
mov r9d, edi
sub rsi, 1
jne 0x140002d20
mov edx, dword [rbx + 0x44]
mov r9d, dword [rbx + 0x40]
xor edx, edi
xor r9d, eax
mov dword [r10 - 4], edx
mov dword [r10], r9d
add r10, 8
sub rbp, 1
jne 0x140002d10
sub r14, 1
jne 0x140002d00
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140007170
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1400a06f0
sub rsp, rax
mov ecx, dword [rcx]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1400072f0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1400a06f0
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1400101b0
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov qword [rsp + 0x10], rdx
mov r10, qword [rsp + 0x10]
test r8, r8
je 0x1400101e7
sub r10, rax
nop
movzx edx, byte [r10 + rax]
movzx ecx, byte [rax]
lea rax, [rax + 1]
xor dl, cl
or r9b, dl
sub r8, 1
jne 0x1400101d0
movzx eax, r9b
ret
Function at 0x14003f260
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rdi
push r14
mov eax, 0x40
call fcn.1400a06f0
sub rsp, rax
cmp dword [rsp + 0x70], 2
mov rdi, r8
movsxd rbp, r9d
mov r14, rcx
je 0x14003f2f0
test rdx, rdx
je 0x14003f2dc
mov r9, rdx
xor r8d, r8d
lea rdx, [rsp + 0x30]
xor ecx, ecx
call fcn.14000f720
cmp dword [rsp + 0x30], 0xffffffff
je 0x14003f2dc
mov dword [rsp + 0x20], 0x2f
mov ecx, 0x10
lea r9, str.cryptoececx_meth.c
mov edx, 0x10a
lea r8d, [rcx + 0x56]
call fcn.140006c60
xor eax, eax
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
test rdi, rdi
je 0x14003f2e6
cmp ebp, 0x20
je 0x14003f2f0
mov dword [rsp + 0x20], 0x35
jmp 0x14003f2af
mov r8d, 0x3a
mov qword [rsp + 0x50], rbx
lea rdx, str.cryptoececx_meth.c
lea ecx, [r8 - 0x12]
call fcn.140007f20
mov rbx, rax
test rax, rax
jne 0x14003f33a
lea r9, str.cryptoececx_meth.c
mov dword [rsp + 0x20], 0x3c
mov edx, 0x10a
lea ecx, [rax + 0x10]
lea r8d, [rax + 0x41]
call fcn.140006c60
xor eax, eax
jmp 0x14003f42a
cmp dword [rsp + 0x70], 0
jne 0x14003f354
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14003f415
mov r8d, 0x43
lea rdx, str.cryptoececx_meth.c
lea ecx, [r8 - 0x23]
call fcn.14000afd0
mov qword [rbx + 0x20], rax
test rax, rax
jne 0x14003f39b
lea r9, str.cryptoececx_meth.c
mov dword [rsp + 0x20], 0x45
mov edx, 0x10a
lea ecx, [rax + 0x10]
lea r8d, [rax + 0x41]
call fcn.140006c60
mov r8d, 0x46
jmp 0x14003f3cf
cmp dword [rsp + 0x70], 2
jne 0x14003f3fb
mov edx, 0x20
mov rcx, rax
call fcn.14000e8b0
test eax, eax
jg 0x14003f3e2
mov rcx, qword [rbx + 0x20]
lea rdx, str.cryptoececx_meth.c
mov r8d, 0x4b
call fcn.14000afb0
mov r8d, 0x4c
lea rdx, str.cryptoececx_meth.c
mov rcx, rbx
call fcn.140007c60
xor eax, eax
jmp 0x14003f42a
mov rax, qword [rbx + 0x20]
and byte [rax], 0xf8
mov rax, qword [rbx + 0x20]
and byte [rax + 0x1f], 0x7f
mov rax, qword [rbx + 0x20]
or byte [rax + 0x1f], 0x40
jmp 0x14003f409
movups xmm0, xmmword [rdi]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rax + 0x10], xmm1
mov rdx, qword [rbx + 0x20]
mov rcx, rbx
call fcn.140057f10
mov r8, rbx
mov edx, 0x40a
mov rcx, r14
call fcn.140005d80
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
Function at 0x140043910
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x28
call fcn.1400a06f0
sub rsp, rax
lea rcx, str.OPENSSL_CONF
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
je 0x140043947
mov r8d, 0x1e3
lea rdx, str.cryptoconfconf_mod.c
mov rcx, rax
add rsp, 0x28
jmp fcn.140016c80
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
call fcn.140065900
xor edx, edx
mov ecx, edx
cmp byte [rax], cl
je 0x140043971
nop
cmp ecx, 0x80000000
jae 0x140043971
inc rax
inc ecx
cmp byte [rax], dl
jne 0x140043960
btr ecx, 0x1f
lea rax, str.openssl.cnf
nop dword [rax]
cmp edx, 0x80000000
jae 0x140043992
inc rax
inc edx
cmp byte [rax], 0
jne 0x140043980
btr edx, 0x1f
lea eax, [rcx + 2]
add eax, edx
mov r8d, 0x1eb
movsxd rdi, eax
lea rdx, str.cryptoconfconf_mod.c
mov rcx, rdi
call fcn.140007c10
mov rbx, rax
test rax, rax
jne 0x1400439ca
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.140065900
mov rdx, rax
mov r8, rdi
mov rcx, rbx
call fcn.140017180
mov r8, rdi
lea rdx, [0x1400ba61c]
mov rcx, rbx
call fcn.140017100
mov r8, rdi
lea rdx, str.openssl.cnf
mov rcx, rbx
call fcn.140017100
mov rdi, qword [rsp + 0x20]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x140045c50
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
push rbx
mov eax, 0xd0
call fcn.1400a06f0
sub rsp, rax
mov rax, qword [0x1400fb010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebx, 0x40
test eax, eax
je 0x140045ce2
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x80]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x140045cd5
xorps xmm2, xmm2
cvtsi2sd xmm2, rbx
test rbx, rbx
jns 0x140045cc6
addsd xmm2, qword [0x1400c3770]
mov edx, ebx
lea rcx, [rsp + 0x80]
call fcn.14000e860
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r9d, 0x16
mov dword [rsp + 0x20], 0xf0000040
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140045d52
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x80]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x140045d45
xorps xmm2, xmm2
cvtsi2sd xmm2, rbx
test rbx, rbx
jns 0x140045d36
addsd xmm2, qword [0x1400c3770]
mov edx, ebx
lea rcx, [rsp + 0x80]
call fcn.14000e860
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp dword [0x1400fbc18], 0
je 0x140045d8d
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x140045d72
mov dword [0x1400fbc18], eax
jmp 0x140045d8d
xorps xmm2, xmm2
lea rcx, [rsp + 0x40]
mov edx, 8
call fcn.14000e860
cmp dword [0x1400fbc18], 0
jne 0x140045da9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorps xmm2, xmm2
lea rcx, [rsp + 0x38]
mov edx, 4
mov dword [rsp + 0x38], eax
call fcn.14000e860
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
movsd xmm2, qword [0x1400bb920]
lea rcx, [rsp + 0x48]
mov edx, 0x38
call fcn.14000e860
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movsd xmm2, qword [0x1400bb920]
lea rcx, [rsp + 0x3c]
mov edx, 4
mov dword [rsp + 0x3c], eax
call fcn.14000e860
mov eax, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140002dc0
add rsp, 0xd0
pop rbx
ret
Function at 0x14006d7a0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
mov eax, 0xb8
call fcn.1400a06f0
sub rsp, rax
mov rax, qword [0x1400fb010]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r12, qword [rsp + 0x110]
xor edi, edi
movsxd rsi, r8d
mov rbp, r9
mov r14, rdx
mov rbx, rcx
mov eax, edi
test r9, r9
je 0x14006d806
cmp r9, qword [rcx]
je 0x14006d7fc
test rdx, rdx
je 0x14006d9e9
test r8d, r8d
js 0x14006d9e9
mov eax, 1
mov qword [rcx], r9
jmp 0x14006d812
mov rbp, qword [rcx]
test rbp, rbp
je 0x14006d9e9
test r14, r14
je 0x14006d8e4
mov rcx, rbp
mov qword [rsp + 0xb0], r15
call fcn.14001a490
mov r15d, eax
cmp eax, 0x80
jle 0x14006d84e
mov r8d, 0x28
lea rdx, str.cryptohmachmac.c
lea rcx, str.assertion_failed:_j____int_sizeof_ctx__key_
call fcn.1400101f0
cmp r15d, esi
mov r15, qword [rsp + 0xb0]
jge 0x14006d8a0
mov rcx, qword [rbx + 8]
mov r8, r12
mov rdx, rbp
call fcn.140019a40
test eax, eax
je 0x14006d899
mov rcx, qword [rbx + 8]
mov r8, rsi
mov rdx, r14
call fcn.140019b70
test eax, eax
je 0x14006d899
mov rcx, qword [rbx + 8]
lea r14, [rbx + 0x20]
mov r8, r14
lea rdx, [rbx + 0x24]
call fcn.1400199a0
test eax, eax
jne 0x14006d8be
xor eax, eax
jmp 0x14006d9e9
cmp esi, 0x80
ja 0x14006d899
mov r8, rsi
lea rcx, [rbx + 0x24]
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
lea r14, [rbx + 0x20]
mov dword [r14], esi
mov ecx, dword [r14]
cmp ecx, 0x80
je 0x14006d8ec
mov eax, ecx
mov r8d, 0x80
sub r8d, ecx
xor edx, edx
lea rcx, [rbx + 0x24]
add rcx, rax
call sub.VCRUNTIME140.dll_memset
jmp 0x14006d8ec
test eax, eax
je 0x14006d9cf
lea rcx, [rsp + 0x20]
mov rax, rbx
sub rax, rcx
mov rdx, rdi
lea rsi, [rax + 0x24]
lea r14, [rax + 0x25]
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rsi + rcx]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x80
jl 0x14006d910
mov rcx, qword [rbx + 0x10]
mov r8, r12
mov rdx, rbp
call fcn.140019a40
test eax, eax
je 0x14006d899
mov rcx, rbp
call fcn.14001a490
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.140019b70
test eax, eax
je 0x14006d899
nop
lea rcx, [rsp + 0x20]
add rcx, rdi
add rdi, 2
movzx eax, byte [rsi + rcx]
xor al, 0x5c
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x5c
mov byte [rcx + 1], al
cmp rdi, 0x80
jl 0x14006d970
mov rcx, qword [rbx + 0x18]
mov r8, r12
mov rdx, rbp
call fcn.140019a40
test eax, eax
je 0x14006d899
mov rcx, rbp
call fcn.14001a490
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.140019b70
test eax, eax
je 0x14006d899
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
call fcn.140019b90
test eax, eax
je 0x14006d899
mov eax, 1
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140002dc0
add rsp, 0xb8
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret