joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800be280
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x68
call fcn.180188f30
sub rsp, rax
mov rax, qword [0x180237160]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx ebx, byte [rcx]
mov rax, qword [rcx + 0x28]
mov r13, qword [rsp + 0xd0]
mov r14, qword [rcx + 0x30]
mov rsi, r9
mov r10, r8
mov qword [rsp + 0x38], r8
mov r15, rdx
mov rdi, rcx
mov byte [rsp + 0x30], bl
mov qword [rsp + 0x40], rax
test bl, 0x40
jne 0x1800be2e9
lea rdx, [rcx + 0x10]
mov r8, r14
call rax
mov r10, qword [rsp + 0x38]
movzx eax, bl
mov r8d, reloc.WS2_32.dll_ntohs
xor ebp, ebp
and eax, 7
mov r12d, r8d
mov ecx, ebp
sub r12d, eax
mov byte [rdi], al
movsxd rax, r12d
cmp r12d, r8d
jae 0x1800be325
lea rdx, [rax + rdi]
sub r8d, r12d
movzx eax, byte [rdx]
mov byte [rdx], bpl
inc rdx
or rcx, rax
shl rcx, 8
dec r8
jne 0x1800be310
movzx eax, byte [rdi + 0xf]
mov byte [rdi + 0xf], 1
or rcx, rax
cmp rcx, rsi
je 0x1800be33d
or eax, 0xffffffff
jmp 0x1800be47a
mov rbx, rsi
shr rbx, 4
test rbx, rbx
je 0x1800be3c1
lea rax, [rdi + 0x10]
mov r9, r14
mov r8, rbx
mov qword [rsp + 0x28], rax
mov rdx, r10
mov rcx, r15
mov qword [rsp + 0x20], rdi
call r13
mov r13, qword [rsp + 0x38]
shl rbx, 4
add r13, rbx
add r15, rbx
sub rsi, rbx
je 0x1800be430
lea r9, [rdi + 8]
shr rbx, 4
mov rdx, rbp
lea r8, [r9 + 8]
neg r9
movzx eax, byte [r8 - 1]
dec r8
movzx ecx, bl
add rdx, rax
lea rax, [r9 + r8]
shr rbx, 8
add rdx, rcx
mov byte [r8], dl
shr rdx, 8
test rax, rax
je 0x1800be3c6
test rbx, rbx
jne 0x1800be390
test rdx, rdx
jne 0x1800be390
jmp 0x1800be3c6
mov r13, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
test rsi, rsi
je 0x1800be435
lea rdx, [rsp + 0x48]
mov r8, r14
mov rcx, rdi
call rbx
test rsi, rsi
je 0x1800be422
lea rax, [rsp + 0x48]
mov r8, rdi
lea rdx, [rsp + 0x48]
sub r15, rax
lea rax, [rsp + 0x48]
sub r13, rax
lea rax, [rsp + 0x48]
sub r8, rax
movzx ecx, byte [r15 + rdx]
movzx eax, byte [rdx]
inc ebp
xor ecx, eax
mov eax, ebp
inc rdx
mov byte [r13 + rdx - 1], cl
xor byte [r8 + rdx + 0xf], cl
cmp rax, rsi
jb 0x1800be402
lea rcx, [rdi + 0x10]
mov r8, r14
mov rdx, rcx
call rbx
jmp 0x1800be435
mov rbx, qword [rsp + 0x40]
movsxd rax, r12d
cmp r12d, 0x10
jae 0x1800be452
mov r8d, reloc.WS2_32.dll_recv
lea rcx, [rax + rdi]
xor edx, edx
sub r8d, r12d
call fcn.180189610
lea rdx, [rsp + 0x48]
mov r8, r14
mov rcx, rdi
call rbx
mov rax, qword [rsp + 0x48]
xor qword [rdi + 0x10], rax
mov rax, qword [rsp + 0x50]
xor qword [rdi + 0x18], rax
movzx eax, byte [rsp + 0x30]
mov byte [rdi], al
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180183a50
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800bebb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push r12
mov eax, 0x20
call fcn.180188f30
sub rsp, rax
mov r12, qword [rcx + 0x28]
mov rsi, rdx
mov rbp, rcx
cmp rdx, r12
ja 0x1800bebe5
shl rsi, 4
add rsi, qword [rcx + 0x58]
mov rax, rsi
add rsp, 0x20
pop r12
pop rsi
pop rbp
ret
mov rcx, qword [rcx + 0x30]
cmp rdx, rcx
jb 0x1800bec2c
sub rdx, rcx
lea r8, str.cryptomodesocb128.c
mov r9d, WSAStartup
add rdx, 4
and rdx, 0xfffffffffffffffc
add rdx, rcx
mov rcx, qword [rbp + 0x58]
mov qword [rbp + 0x30], rdx
shl rdx, 4
call fcn.1800b7370
test rax, rax
jne 0x1800bec28
add rsp, 0x20
pop r12
pop rsi
pop rbp
ret
mov qword [rbp + 0x58], rax
cmp r12, rsi
jae 0x1800beca6
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r14
mov r14, r12
mov r13, rsi
sub r13, r12
shl r14, 4
add r12, r13
nop word [rax + rax]
mov rax, qword [rbp + 0x58]
mov edx, 1
movzx ebx, byte [r14 + rax]
lea rcx, [r14 + rax]
lea rdi, [rcx + 0x10]
shr bl, 7
neg bl
mov r8, rdi
and bl, 0x87
call fcn.1800beb00
xor byte [rdi + 0xf], bl
add r14, 0x10
dec r13
jne 0x1800bec60
mov r14, qword [rsp + 0x58]
mov r13, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
shl rsi, 4
mov qword [rbp + 0x28], r12
add rsi, qword [rbp + 0x58]
mov rax, rsi
add rsp, 0x20
pop r12
pop rsi
pop rbp
ret
Function at 0x1800bf270
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x60
call fcn.180188f30
sub rsp, rax
mov rax, qword [0x180237160]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 0x68]
mov rsi, r9
xor edi, edi
shr rsi, 4
mov rbp, r9
mov r12, r8
mov r14, rdx
mov rbx, rcx
lea r13, [rax + rsi]
test rsi, rsi
je 0x1800bf32b
cmp qword [rcx + 0x20], rdi
je 0x1800bf32b
mov rax, r13
mov edx, edi
shr rax, 1
je 0x1800bf2d8
nop dword [rax]
inc rdx
shr rax, 1
jne 0x1800bf2d0
call fcn.1800bebb0
test rax, rax
jne 0x1800bf2e9
xor eax, eax
jmp 0x1800bf4aa
mov rdx, qword [rbx + 0x68]
mov r9, qword [rbx + 0x10]
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x58]
inc rdx
mov qword [rsp + 0x30], rax
lea rcx, [rbx + 0x90]
mov r8, rsi
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
mov rdx, r12
mov rcx, r14
call qword [rbx + 0x20]
jmp 0x1800bf3fe
lea rsi, [rax + 1]
cmp rsi, r13
ja 0x1800bf3fe
nop dword [rax + rax]
mov rax, rsi
mov ecx, edi
test sil, 1
jne 0x1800bf359
nop dword [rax + rax]
shr rax, 1
inc ecx
test al, 1
je 0x1800bf350
mov edx, ecx
mov rcx, rbx
call fcn.1800bebb0
test rax, rax
je 0x1800bf2e2
mov rcx, qword [rax]
mov r8, qword [rbx + 0x10]
lea rdx, [rsp + 0x40]
xor qword [rbx + 0x90], rcx
mov rax, qword [rax + 8]
add r14, 0x10
xor qword [rbx + 0x98], rax
mov rcx, qword [r14 - 8]
mov rax, qword [r14 - 0x10]
xor qword [rbx + 0xa8], rcx
xor rcx, qword [rbx + 0x98]
xor qword [rbx + 0xa0], rax
xor rax, qword [rbx + 0x90]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call qword [rbx]
mov r11, qword [rsp + 0x40]
xor r11, qword [rbx + 0x90]
mov rax, qword [rsp + 0x48]
inc rsi
xor rax, qword [rbx + 0x98]
mov qword [r12], r11
add r12, 0x10
mov qword [r12 - 8], rax
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], rax
cmp rsi, r13
jbe 0x1800bf340
and ebp, 0xf
jbe 0x1800bf4a1
mov rax, qword [rbx + 0x38]
mov r8, qword [rbx + 0x10]
lea rcx, [rbx + 0x90]
xor qword [rcx], rax
mov rax, qword [rbx + 0x40]
lea rdx, [rsp + 0x40]
xor qword [rbx + 0x98], rax
call qword [rbx]
test rbp, rbp
je 0x1800bf468
lea rax, [rsp + 0x40]
mov r8, r14
sub r8, rax
lea rax, [rsp + 0x40]
sub r12, rax
nop word [rax + rax]
lea rcx, [rsp + rdi + 0x40]
inc rdi
movzx eax, byte [r8 + rcx]
xor al, byte [rcx]
mov byte [r12 + rcx], al
cmp rdi, rbp
jb 0x1800bf450
xor eax, eax
lea rcx, [rsp + 0x40]
mov r8, rbp
mov rdx, r14
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call fcn.180183a80
mov byte [rsp + rbp + 0x40], 0x80
mov rax, qword [rsp + 0x40]
xor qword [rbx + 0xa0], rax
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0xa8], rax
mov qword [rbx + 0x68], r13
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180183a50
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800bf4d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x60
call fcn.180188f30
sub rsp, rax
mov rax, qword [0x180237160]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 0x68]
mov rsi, r9
xor edi, edi
shr rsi, 4
mov rbp, r9
mov r14, r8
mov r12, rdx
mov rbx, rcx
lea r13, [rax + rsi]
test rsi, rsi
je 0x1800bf58b
cmp qword [rcx + 0x20], rdi
je 0x1800bf58b
mov rax, r13
mov edx, edi
shr rax, 1
je 0x1800bf538
nop dword [rax]
inc rdx
shr rax, 1
jne 0x1800bf530
call fcn.1800bebb0
test rax, rax
jne 0x1800bf549
xor eax, eax
jmp 0x1800bf70a
mov rdx, qword [rbx + 0x68]
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x58]
inc rdx
mov qword [rsp + 0x30], rax
lea rcx, [rbx + 0x90]
mov r8, rsi
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov rcx, r12
call qword [rbx + 0x20]
jmp 0x1800bf65f
lea rsi, [rax + 1]
cmp rsi, r13
ja 0x1800bf65f
nop dword [rax + rax]
mov rax, rsi
mov ecx, edi
test sil, 1
jne 0x1800bf5b9
nop dword [rax + rax]
shr rax, 1
inc ecx
test al, 1
je 0x1800bf5b0
mov edx, ecx
mov rcx, rbx
call fcn.1800bebb0
test rax, rax
je 0x1800bf542
mov rcx, qword [rax]
mov r8, qword [rbx + 0x18]
lea rdx, [rsp + 0x40]
xor qword [rbx + 0x90], rcx
mov rax, qword [rax + 8]
add r12, 0x10
xor qword [rbx + 0x98], rax
mov rcx, qword [r12 - 8]
mov rax, qword [r12 - 0x10]
xor rcx, qword [rbx + 0x98]
xor rax, qword [rbx + 0x90]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call qword [rbx + htons]
mov r11, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
xor r11, qword [rbx + 0x90]
xor rax, qword [rbx + 0x98]
inc rsi
xor qword [rbx + 0xa0], r11
xor qword [rbx + 0xa8], rax
mov qword [r14], r11
mov qword [r14 + 8], rax
add r14, 0x10
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], rax
cmp rsi, r13
jbe 0x1800bf5a0
and ebp, 0xf
jbe 0x1800bf701
mov rax, qword [rbx + 0x38]
mov r8, qword [rbx + 0x10]
lea rcx, [rbx + 0x90]
xor qword [rcx], rax
mov rax, qword [rbx + 0x40]
lea rdx, [rsp + 0x40]
xor qword [rbx + 0x98], rax
call qword [rbx]
test rbp, rbp
je 0x1800bf6c8
lea rax, [rsp + 0x40]
mov r8, r14
sub r12, rax
lea rax, [rsp + 0x40]
sub r8, rax
nop word [rax + rax]
lea rcx, [rsp + rdi + 0x40]
inc rdi
movzx eax, byte [r12 + rcx]
xor al, byte [rcx]
mov byte [r8 + rcx], al
cmp rdi, rbp
jb 0x1800bf6b0
xor eax, eax
lea rcx, [rsp + 0x40]
mov r8, rbp
mov rdx, r14
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call fcn.180183a80
mov byte [rsp + rbp + 0x40], 0x80
mov rax, qword [rsp + 0x40]
xor qword [rbx + 0xa0], rax
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0xa8], rax
mov qword [rbx + 0x68], r13
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180183a50
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1800c0060
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
mov eax, 0x20
call fcn.180188f30
sub rsp, rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
xor ecx, ecx
cmp eax, 0xffffffff
mov dword [rbx], eax
setne cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x1800c00d0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.180188f30
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1800c05f0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov r9, rcx
test rcx, rcx
je 0x1800c0648
movzx eax, byte [rcx]
test al, al
je 0x1800c0648
mov r10d, 0x100
nop dword [rax + rax]
movsx edx, al
inc r9
or edx, r10d
add r10d, 0x100
mov eax, edx
shr eax, 2
xor eax, edx
and eax, 0xf
movzx ecx, al
movzx eax, byte [r9]
imul edx, edx
rol r8d, cl
xor r8d, edx
test al, al
jne 0x1800c0610
mov eax, r8d
shr eax, 0x10
xor eax, r8d
ret
xor eax, eax
ret

Function at 0x1800c0650
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x20
call fcn.180188f30
sub rsp, rax
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
je 0x1800c06c2
movzx eax, byte [rcx]
test al, al
je 0x1800c06c2
mov qword [rsp + 0x30], rsi
mov esi, 0x100
nop
movsx ecx, al
call fcn.1800c1420
inc rdi
or eax, esi
add esi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
rol ebx, cl
imul eax, eax
xor ebx, eax
movzx eax, byte [rdi]
test al, al
jne 0x1800c0680
mov rsi, qword [rsp + 0x30]
mov eax, ebx
shr eax, 0x10
xor eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1800c5680
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x20
call fcn.180188f30
sub rsp, rax
lea edx, [rax - 0x1f]
mov rdi, rcx
call fcn.1800b9fc0
mov rcx, rdi
mov rdx, rax
mov rsi, rax
call fcn.1800ba1a0
test rax, rax
je 0x1800c56f4
mov qword [rsp + 0x30], rbx
xor ebx, ebx
mov r8d, esi
lea r9d, [rbx + 2]
mov rdx, rax
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
mov rcx, rdi
test eax, eax
cmove rbx, rsi
mov rdx, rbx
lea r8, [rbx*8]
call fcn.1800ba230
mov rcx, rdi
call fcn.1800b9e30
mov rbx, qword [rsp + 0x30]
test rax, rax
jne 0x1800c56fc
mov rcx, rdi
call fcn.1800b9e30
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1800ca230
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.180188f30
sub rsp, rax
lea rcx, [0x180240bd4]
add rsp, 0x28
jmp fcn.1800c0090
Function at 0x1800ccd30
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r12
push r13
push r14
push r15
mov eax, gethostbyname
call fcn.180188f30
sub rsp, rax
mov r14, rdx
mov r13, r8
mov rbp, rcx
mov r15d, 0x20
lea rdx, str.enginese_capi.c
mov r8d, 0x5cb
mov ecx, r15d
mov r12d, r9d
call fcn.1800b71e0
mov rsi, rax
test rax, rax
jne 0x1800ccd8d
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
mov qword [rsp + 0x68], rdi
cmp r12d, 1
jne 0x1800ccdd3
cmp dword [0x180240c38], 0
je 0x1800ccdd3
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
mov rax, r13
sub r8, r13
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1800ccdc4
add rax, 2
test ecx, ecx
jne 0x1800ccdb0
test edx, edx
jne 0x1800ccdd3
lea r13, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
lea r12d, [rdx + 0x18]
mov qword [rsp + 0x60], rbx
test rbp, rbp
je 0x1800cce44
cmp dword [rbp], 2
jl 0x1800cce44
cmp qword [rbp + 8], 0
je 0x1800cce44
mov rcx, r14
call fcn.1800cb890
mov rcx, r13
mov rdi, rax
call fcn.1800cb890
lea rdx, str.capi_get_key__contname_s__provname_s__type_d_n
mov r8, rdi
mov rcx, rbp
mov r9, rax
mov rbx, rax
mov dword [rsp + 0x20], r12d
call fcn.1800cb7f0
lea rdx, str.enginese_capi.c
mov r8d, 0x5df
mov rcx, rbx
call fcn.1800b72b0
lea rdx, str.enginese_capi.c
mov r8d, 0x5e0
mov rcx, rdi
call fcn.1800b72b0
test dword [rbp + 0x38], 0x20000
mov eax, 0
lea rcx, [rsi + 8]
cmovne eax, r15d
mov r9d, r12d
mov r8, r13
mov rdx, r14
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1800cceaa
mov eax, dword [0x180240c20]
test eax, eax
jne 0x1800cce84
call fcn.1800b84d0
mov dword [0x180240c20], eax
mov edx, 0x67
lea r9, str.enginese_capi.c
mov ecx, eax
lea r8d, [rdx + 1]
mov dword [rsp + 0x20], 0x5e6
call fcn.1800b8900
call fcn.1800cc2d0
jmp 0x1800ccf0a
mov ebx, dword [rsp + 0x80]
mov rcx, qword [rsi + 8]
lea r8, [rsi + 0x10]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetUserKey]
test eax, eax
jne 0x1800ccf23
mov eax, dword [0x180240c20]
test eax, eax
jne 0x1800cceda
call fcn.1800b84d0
mov dword [0x180240c20], eax
mov edx, 0x67
lea r9, str.enginese_capi.c
mov ecx, eax
lea r8d, [rdx + 0xe]
mov dword [rsp + 0x20], 0x5eb
call fcn.1800b8900
call fcn.1800cc2d0
mov rcx, qword [rsi + 8]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rdx, str.enginese_capi.c
mov r8d, 0x5f5
mov rcx, rsi
call fcn.1800b72b0
xor eax, eax
jmp 0x1800ccf30
mov dword [rsi + 0x18], ebx
mov qword [rsi], 0
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x1800d3300
Capabilities:
Encode data using xor

Disassembly:
push rdi
movsxd rdi, r9d
mov r10, r8
mov r11, rdx
cmp rdx, r8
je 0x1800d33b4
movsxd rdx, dword [rdx + 8]
mov qword [rsp + 0x10], rbx
lea rbx, [rcx - 1]
not rcx
shr rbx, 0x3f
xor r9d, r9d
shr rcx, 0x3f
and rbx, rcx
movsxd rcx, dword [r8 + 8]
xor rcx, rdx
dec rbx
and rcx, rbx
xor edx, ecx
mov dword [r11 + 8], edx
xor dword [r8 + 8], ecx
movsxd rdx, dword [r11 + 0x10]
movsxd rcx, dword [r8 + 0x10]
xor rcx, rdx
and rcx, rbx
xor edx, ecx
mov dword [r11 + 0x10], edx
xor dword [r8 + 0x10], ecx
mov ecx, dword [r11 + 0x14]
mov eax, dword [r8 + 0x14]
xor rax, rcx
and eax, 4
and rax, rbx
xor ecx, eax
mov dword [r11 + 0x14], ecx
xor dword [r8 + 0x14], eax
test rdi, rdi
jle 0x1800d33af
mov rax, qword [r10]
mov r8, qword [r11]
inc r9
mov rcx, qword [r8 + r9*8 - 8]
mov rdx, qword [rax + r9*8 - 8]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + r9*8 - 8], rcx
mov rax, qword [r10]
xor qword [rax + r9*8 - 8], rdx
cmp r9, rdi
jl 0x1800d3381
mov rbx, qword [rsp + 0x10]
pop rdi
ret
Function at 0x1800d9700
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
push r12
push r13
mov eax, 0x48
call fcn.180188f30
sub rsp, rax
mov r12, r9
mov rdi, r8
mov r13, rdx
mov rbx, rcx
call fcn.1800c6f10
cmp eax, 0x72
jne 0x1800d9881
mov rbx, rdi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], r14
and edi, 1
shr rbx, 1
mov qword [rsp + 0x40], r15
lea r14, [rdi + rbx]
call fcn.1800e9240
mov rsi, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x98]
mov r15, qword [rsp + 0x90]
mov qword [rsp + 0x30], rsi
mov rcx, rax
mov r9, r12
mov r8, r14
mov rdx, r13
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r15
call fcn.1800d9480
test eax, eax
je 0x1800d97d5
lea rdx, str.cryptokdf_tls1_prf.c
mov r8d, 0x104
mov rcx, rsi
mov qword [rsp + 0x70], rbp
call fcn.1800b71e0
mov rbp, rax
test rax, rax
jne 0x1800d97f2
lea r9, str.cryptokdf_tls1_prf.c
lea edx, [rax + 0x6f]
lea ecx, [rax + 0x34]
lea r8d, [rax + 0x41]
mov dword [rsp + 0x20], 0x105
call fcn.1800b8900
xor eax, eax
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
add rsp, 0x48
pop r13
pop r12
pop rdi
pop rbx
ret
add rbx, r13
call fcn.1800e8ab0
mov qword [rsp + 0x30], rsi
mov r9, r12
mov r8, r14
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], r15
call fcn.1800d9480
test eax, eax
jne 0x1800d9838
lea r8, str.cryptokdf_tls1_prf.c
mov r9d, 0x10a
mov rdx, rsi
mov rcx, rbp
call fcn.1800b72f0
jmp 0x1800d97ce
test rsi, rsi
je 0x1800d985f
mov rdx, rbp
mov rcx, rsi
sub rdx, rdi
nop word [rax + rax]
movzx eax, byte [rdx + rdi]
inc rdi
xor byte [rdi - 1], al
dec rcx
jne 0x1800d9850
lea r8, str.cryptokdf_tls1_prf.c
mov r9d, 0x10f
mov rdx, rsi
mov rcx, rbp
call fcn.1800b72f0
mov eax, 1
jmp 0x1800d97d0
mov rax, qword [rsp + 0xa0]
mov r9, r12
mov r8, rdi
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x98]
mov rdx, r13
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x90]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1800d9480
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x48
pop r13
pop r12
pop rdi
pop rbx
ret

Function at 0x1800dee00
Capabilities:
Encode data using xor

Disassembly:
mov r11, rdx
mov r9, rcx
test rdx, rdx
je 0x1800dee79
test r8, r8
je 0x1800dee79
mov r10, qword [rcx + 0x28]
cmp r8, r10
cmovb r10, r8
test r10, r10
je 0x1800dee40
add rcx, 0x30
sub rdx, r9
nop word [rax + rax]
movzx eax, byte [rdx + rcx - 0x30]
inc rcx
xor byte [rcx - 1], al
dec r10
jne 0x1800dee30
mov rax, qword [r9 + 0x28]
cmp r8, rax
jbe 0x1800dee79
sub r8, rax
mov eax, reloc.WS2_32.dll_recv
cmp r8, rax
cmova r8, rax
xor ecx, ecx
test r8, r8
je 0x1800dee79
nop
mov rax, qword [r9 + 0x28]
add rax, rcx
inc rcx
movzx eax, byte [rax + r11]
xor byte [r9 + rcx + 0x4f], al
cmp rcx, r8
jb 0x1800dee60
repz ret
Function at 0x1800dee80
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, reloc.WS2_32.dll_WSASetLastError
call fcn.180188f30
sub rsp, rax
mov rax, qword [0x180237160]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, qword [rdx]
mov r11, rcx
mov cl, 2
cmp qword [r11 + 0x28], 0x10
mov qword [rsp + 0x38], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x40], rax
mov rax, qword [rdx]
mov qword [rsp + 0x48], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x50], rax
je 0x1800deedf
mov rax, qword [rdx]
mov cl, 3
mov qword [rsp + 0x58], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x60], rax
movzx ebx, cl
lea rdx, [r11 + 0x78]
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
shl ebx, 4
movsxd r9, ebx
test ebx, ebx
jle 0x1800def21
lea r10, [rsp + 0x38]
mov r8, rdx
sub r10, rdx
nop word [rax + rax]
movzx eax, byte [r10 + r8]
inc r8
xor byte [r8 - 1], al
dec r9
jne 0x1800def10
mov rcx, qword [r11 + 0x10]
lea r8, [rsp + 0x30]
mov r9, rdx
mov dword [rsp + 0x20], ebx
call fcn.1800ac000
test eax, eax
je 0x1800def58
cmp dword [rsp + 0x30], ebx
jne 0x1800def58
mov eax, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180183a50
add rsp, 0x70
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180183a50
add rsp, 0x70
pop rbx
ret

Function at 0x1800def70
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, reloc.WS2_32.dll_WSASetLastError
call fcn.180188f30
sub rsp, rax
mov rax, qword [0x180237160]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor eax, eax
lea rdx, [rcx + 0x78]
xor ebx, ebx
mov qword [rdx], rax
mov qword [rdx + 8], rax
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], rax
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], rax
cmp qword [rcx + 0x28], 0x10
mov qword [rsp + 0x49], rax
mov qword [rsp + 0x59], rax
setne bl
mov byte [rsp + 0x38], 0
mov qword [rsp + 0x39], rax
add ebx, 2
mov qword [rsp + 0x41], rax
mov qword [rsp + 0x51], rax
shl ebx, 4
mov dword [rsp + 0x61], eax
mov word [rsp + 0x65], ax
mov byte [rsp + 0x67], al
mov byte [rsp + 0x4b], 1
mov byte [rsp + 0x5b], 2
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
movsxd r9, ebx
test ebx, ebx
jle 0x1800df021
lea r10, [rsp + 0x38]
mov r8, rdx
sub r10, rdx
nop word [rax + rax]
movzx eax, byte [r10 + r8]
inc r8
xor byte [r8 - 1], al
dec r9
jne 0x1800df010
mov rcx, qword [rcx + 0x10]
lea r8, [rsp + 0x30]
mov r9, rdx
mov dword [rsp + 0x20], ebx
call fcn.1800ac000
test eax, eax
je 0x1800df058
cmp dword [rsp + 0x30], ebx
jne 0x1800df058
mov eax, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180183a50
add rsp, 0x70
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180183a50
add rsp, 0x70
pop rbx
ret
Function at 0x1800df070
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rdi
mov eax, 0x80
call fcn.180188f30
sub rsp, rax
mov rax, qword [0x180237160]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, r8
mov rdi, rdx
mov rbp, rcx
test rdx, rdx
je 0x1800df1fc
test rbx, rbx
je 0x1800df1fc
mov rax, qword [rcx + 0x70]
mov qword [rsp + 0x78], rsi
test rax, rax
je 0x1800df0f5
mov esi, reloc.WS2_32.dll_recv
sub rsi, rax
cmp rbx, rsi
jb 0x1800df0f5
lea rcx, [rax + rcx + 0x60]
mov r8, rsi
call fcn.180183a80
lea rdx, [rbp + 0x60]
mov rcx, rbp
call fcn.1800dee80
test eax, eax
je 0x1800df1db
sub rbx, rsi
mov qword [rbp + 0x70], 0
add rdi, rsi
mov qword [rsp + 0x70], r12
cmp rbx, 0x10
jb 0x1800df1b4
lea r12, [rbp + 0x78]
nop dword [rax + rax]
cmp qword [rbp + 0x28], 0x10
mov rax, qword [rdi]
mov cl, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi]
mov qword [rsp + 0x48], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x50], rax
je 0x1800df14e
mov rax, qword [rdi]
mov cl, 3
mov qword [rsp + 0x58], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x60], rax
movzx esi, cl
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
shl esi, 4
movsxd rdx, esi
test esi, esi
jle 0x1800df180
lea r8, [rsp + 0x38]
mov rcx, r12
sub r8, r12
nop
movzx eax, byte [r8 + rcx]
inc rcx
xor byte [rcx - 1], al
dec rdx
jne 0x1800df170
mov rcx, qword [rbp + 0x10]
lea r8, [rsp + 0x30]
mov r9, r12
mov rdx, r12
mov dword [rsp + 0x20], esi
call fcn.1800ac000
test eax, eax
je 0x1800df1f8
cmp dword [rsp + 0x30], esi
jne 0x1800df1f8
sub rbx, 0x10
add rdi, 0x10
cmp rbx, 0x10
jae 0x1800df110
test rbx, rbx
je 0x1800df1d1
mov rax, qword [rbp + 0x70]
mov r8, rbx
mov rdx, rdi
lea rcx, [rax + rbp + 0x60]
call fcn.180183a80
add qword [rbp + 0x70], rbx
mov eax, 1
mov r12, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180183a50
add rsp, 0x80
pop rdi
pop rbp
pop rbx
ret
xor eax, eax
jmp 0x1800df1d6
mov eax, 1
jmp 0x1800df1e0