joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140088e50
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x1404b3fb8]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
call fcn.140088d90
test al, al
je 0x140088ed7
mov qword [rsp + 0x1d0], rbx
lea rdx, [rsp + 0x20]
mov ebx, 0x202
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140088e97
cmp word [rsp + 0x20], bx
je 0x140088eae
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, ebx
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140088eb5
mov byte [0x1404bc7d9], 1
xor al, al
mov rbx, qword [rsp + 0x1d0]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14012e750
add rsp, 0x1d8
ret
xor al, al
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14012e750
add rsp, 0x1d8
ret

Function at 0x140088f00
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x980]
sub rsp, 0xa80
mov rax, qword [0x1404b3fb8]
xor rax, rsp
mov qword [rbp + 0x970], rax
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMySQL
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14008907e
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0x60]
mov qword [rsp + 0xa90], rbx
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
lea rax, [rsp + 0x48]
mov qword [rsp + 0xa98], rdi
xor edi, edi
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rdi
mov ebx, edi
mov dword [rsp + 0x44], 0xff
mov dword [rsp + 0x40], 0x3ff
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x140089063
nop dword [rax]
inc ebx
cmp eax, 0xea
je 0x14008900f
test eax, eax
jne 0x140089063
cmp dword [rsp + 0x48], 1
jne 0x14008900f
lea r9, [rbp + 0x60]
mov qword [rsp + 0x20], rdi
lea r8, [0x140138c38]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x460]
call fcn.1400844d0
lea rcx, [rbp + 0x460]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0x60]
mov dword [rsp + 0x44], 0xff
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x40], 0x3ff
mov qword [rsp + 0x28], rax
mov edx, ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x140088fc0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0xa98]
mov rbx, qword [rsp + 0xa90]
mov rcx, qword [rbp + 0x970]
xor rcx, rsp
call fcn.14012e750
add rsp, 0xa80
pop rbp
ret
Function at 0x1400891b0
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
cmp byte [0x1404bc7f9], 0
je 0x1400891c4
xor al, al
add rsp, 0x28
ret
mov qword [rsp + 0x20], rbx
mov byte [0x1404bc7f9], 1
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
xor ebx, ebx
mov dword [0x1404bc7fc], eax
cmp eax, 0xffffffff
mov r8d, ebx
sete r8b
test r8d, r8d
jne 0x140089208
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x1404bc800], eax
mov r8d, ebx
sete r8b
test r8d, r8d
je 0x140089222
lea rdx, str.Cant_initialize_threads:_error__d
xor ecx, ecx
call fcn.14007eab0
mov rbx, qword [rsp + 0x20]
mov al, 1
add rsp, 0x28
ret
lea rcx, [0x140529e00]
mov byte [0x1404bc7f8], 1
mov qword [0x140529e28], rbx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x140529dc0]
mov qword [0x140529de8], rbx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x140529d00]
mov qword [0x140529d28], rbx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x140529d80]
mov qword [0x140529da8], rbx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x140529ec0]
mov qword [0x140529ee8], rbx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x140529e40]
mov qword [0x140529e68], rbx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x140529e80]
mov qword [0x140529ea8], rbx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x140529d40]
mov qword [0x140529d68], rbx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rbx, qword [rsp + 0x20]
xor al, al
add rsp, 0x28
ret

Function at 0x140097af0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1404b3fb8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, qword [rcx + 0xa0]
mov rdi, r8
mov r14, qword [rsp + 0xc0]
mov rsi, rdx
mov r15, qword [rsp + 0xc8]
mov r8, r9
mov rdx, rdi
mov rbx, rcx
call qword [rax + 0x30]
mov r8, qword [rbx + 0x50]
lea rcx, [rsp + 0x30]
mov r9, rdi
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [rsi]
mov ebx, dword [r14]
lea rcx, [rsp + 0x30]
mov edi, dword [r15]
call qword [rsi + reloc.WS2_32.dll_htonl]
test eax, eax
jle 0x140097ba0
nop dword [rax]
mov ecx, eax
mov edx, ebx
sar ecx, 8
and edx, 0x3f
add edx, edi
movzx eax, al
imul edx, ecx
add edi, 3
mov ecx, ebx
shl ecx, 8
add edx, ecx
xor ebx, edx
mov ecx, ebx
and ecx, 0x3f
add ecx, edi
add edi, 3
imul ecx, eax
mov eax, ebx
shl eax, 8
add ecx, eax
xor ebx, ecx
lea rcx, [rsp + 0x30]
call qword [rsi + reloc.WS2_32.dll_htonl]
test eax, eax
jg 0x140097b60
mov dword [r14], ebx
mov dword [r15], edi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14012e750
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140098650
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
push r15
sub rsp, 0xc8
mov rax, qword [0x1404b3fb8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rax, rdx
mov ebp, r9d
mov r9, rcx
mov r15, rcx
mov rcx, rax
mov edx, 1
mov rbx, r8
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r14, rax
cmp rax, rbx
je 0x14009879a
test bpl, 0x1a
je 0x140098764
mov qword [rsp + 0x108], rsi
mov rcx, r15
mov qword [rsp + 0xc0], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
test eax, eax
je 0x1400986ff
mov rcx, r15
call fcn.1400b88b0
mov edi, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov r8d, dword [rbx]
lea rcx, [rsp + 0x30]
mov edx, 0x80
mov rsi, rax
call fcn.14007ec00
mov ecx, edi
mov rbx, rax
call fcn.1400b8700
mov ecx, 2
jmp 0x140098742
test bpl, 6
je 0x140098754
mov rcx, r15
call fcn.1400b88b0
mov edi, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov r8d, dword [rbx]
lea rcx, [rsp + 0x30]
mov edx, 0x80
mov rsi, rax
call fcn.14007ec00
mov ecx, edi
mov rbx, rax
call fcn.1400b8700
mov ecx, 9
mov r9d, dword [rsi]
mov r8, rax
xor edx, edx
mov qword [rsp + 0x20], rbx
call fcn.14007e930
mov rsi, qword [rsp + 0x108]
mov rdi, qword [rsp + 0xc0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0
je 0x140098779
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
jmp 0x14009877c
or ecx, 0xffffffff
call fcn.140089320
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
test eax, eax
jne 0x140098794
test bpl, 6
je 0x14009879e
or rax, 0xffffffffffffffff
jmp 0x1400987aa
test bpl, 6
mov eax, 0
cmovne r14, rax
mov rax, r14
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14012e750
add rsp, 0xc8
pop r15
pop r14
pop rbp
pop rbx
ret
Function at 0x14009dc90
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3f]
sub rsp, 0xa0
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov r14d, r9d
mov r12, r8
mov r13d, edx
mov rbx, rcx
lea r15d, [r9 + 1]
shr r15d, 1
mov edx, r15d
lea rcx, [rbp - 9]
call fcn.1400ca6b0
nop
mov edx, r15d
lea rcx, [rbp - 0x21]
call fcn.1400ca6b0
nop
mov edi, dword [rbp + 0x6f]
mov esi, dword [rbp + 0x7f]
lea edx, [rdi + rsi]
lea rcx, [rbp - 0x69]
call fcn.1400ca6b0
nop
mov r8d, r15d
mov rdx, r12
lea rcx, [rbp - 9]
call fcn.1400caa10
mov eax, r14d
and eax, 1
mov edx, r15d
sub rdx, rax
add rdx, r12
mov r8d, r15d
lea rcx, [rbp - 0x21]
call fcn.1400caa10
mov r8d, edi
mov rdx, qword [rbp + 0x67]
lea rcx, [rbp - 0x69]
call fcn.1400caa10
mov r8d, esi
mov rdx, qword [rbp + 0x77]
lea rcx, [rbp - 0x69]
call fcn.1400caa10
mov edx, r13d
lea rcx, [rbp - 0x39]
call fcn.1400ca6b0
nop
mov edx, r13d
lea rcx, [rbp - 0x51]
call fcn.1400ca6b0
nop
mov r9d, 1
lea r8, [rbp - 0x69]
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x39]
call fcn.14009f8a0
mov r9d, 2
lea r8, [rbp - 0x69]
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 0x51]
call fcn.14009f8a0
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400ca9f0
xor edx, edx
lea rcx, [rbp - 0x51]
call fcn.1400ca9f0
test r13d, r13d
je 0x14009dde0
mov esi, r13d
nop dword [rax + rax]
mov edx, 0xfeedbeef
lea rcx, [rbp - 0x51]
call fcn.1400ca7a0
mov rdi, rax
mov edx, 0xfeedbeef
lea rcx, [rbp - 0x39]
call fcn.1400ca7a0
movzx ecx, byte [rdi]
xor cl, byte [rax]
mov byte [rbx], cl
lea rbx, [rbx + 1]
sub rsi, 1
jne 0x14009ddb0
lea rcx, [rbp - 0x51]
call fcn.140099c10
nop
lea rcx, [rbp - 0x39]
call fcn.140099c10
nop
lea rcx, [rbp - 0x69]
call fcn.140099c10
nop
lea rcx, [rbp - 0x21]
call fcn.140099c10
nop
lea rcx, [rbp - 9]
call fcn.140099c10
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400a8980
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
mov rbx, rcx
add rcx, 0x20
mov esi, r8d
mov rbp, rdx
call qword [rax + 0x18]
mov byte [rbx + 0x18], 0
mov rdx, rbp
cmp esi, 0x40
ja 0x1400a89c1
mov rcx, qword [rbx]
mov r8d, esi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400a89e2
mov rax, qword [rbx + 0x20]
lea rcx, [rbx + 0x20]
mov r8d, esi
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rbx + 0x20]
lea rcx, [rbx + 0x20]
mov rdx, qword [rbx]
call qword [rax + reloc.WS2_32.dll_recv]
mov esi, reloc.WS2_32.dll_recv
mov edi, 0x40
mov ecx, esi
add rcx, qword [rbx]
mov r8d, edi
sub r8d, esi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [rbx]
lea r8, [rbx + 8]
mov rcx, qword [r8]
lea rax, [rdx + 0x3f]
lea r9, [rcx + 0x3f]
cmp rdx, r9
ja 0x1400a8a15
cmp rax, rcx
jae 0x1400a8a3d
cmp rdx, rbx
ja 0x1400a8a1f
cmp rax, rbx
jae 0x1400a8a3d
cmp rdx, r8
ja 0x1400a8a29
cmp rax, r8
jae 0x1400a8a3d
cmp rcx, rbx
ja 0x1400a8a33
cmp r9, rbx
jae 0x1400a8a3d
cmp rcx, r8
ja 0x1400a8a66
cmp r9, r8
jb 0x1400a8a66
xor eax, eax
nop
mov rcx, qword [rbx]
lea rax, [rax + 1]
movzx edx, byte [rax + rcx - 1]
mov rcx, qword [r8]
xor dl, 0x5c
mov byte [rax + rcx - 1], dl
mov rcx, qword [rbx]
xor byte [rax + rcx - 1], 0x36
sub rdi, 1
jne 0x1400a8a40
jmp 0x1400a8ad1
movdqa xmm2, xmmword [0x1401a0d20]
xor eax, eax
movdqa xmm3, xmmword [str.6666666666666666_]
lea r8d, [rax + 2]
nop dword [rax]
movdqu xmm0, xmmword [rax + rdx]
lea rax, [rax + 0x20]
pxor xmm0, xmm2
movdqu xmmword [rax + rcx - 0x20], xmm0
movdqu xmm1, xmmword [rax + rdx - 0x20]
pxor xmm1, xmm3
movdqu xmmword [rax + rdx - 0x20], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax + rdx - 0x10]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx - 0x10], xmm1
movdqa xmm1, xmm3
movdqu xmm0, xmmword [rax + rdx - 0x10]
pxor xmm1, xmm0
movdqu xmmword [rax + rdx - 0x10], xmm1
sub r8, 1
jne 0x1400a8a80
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a8af0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
mov rbx, rcx
add rcx, 0x20
mov esi, r8d
mov rbp, rdx
call qword [rax + 0x18]
mov byte [rbx + 0x18], 0
mov rdx, rbp
cmp esi, 0x40
ja 0x1400a8b31
mov rcx, qword [rbx]
mov r8d, esi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400a8b52
mov rax, qword [rbx + 0x20]
lea rcx, [rbx + 0x20]
mov r8d, esi
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rbx + 0x20]
lea rcx, [rbx + 0x20]
mov rdx, qword [rbx]
call qword [rax + reloc.WS2_32.dll_recv]
mov esi, reloc.WS2_32.dll_sendto
mov edi, 0x40
mov ecx, esi
add rcx, qword [rbx]
mov r8d, edi
sub r8d, esi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [rbx]
lea r8, [rbx + 8]
mov rcx, qword [r8]
lea rax, [rdx + 0x3f]
lea r9, [rcx + 0x3f]
cmp rdx, r9
ja 0x1400a8b85
cmp rax, rcx
jae 0x1400a8bad
cmp rdx, rbx
ja 0x1400a8b8f
cmp rax, rbx
jae 0x1400a8bad
cmp rdx, r8
ja 0x1400a8b99
cmp rax, r8
jae 0x1400a8bad
cmp rcx, rbx
ja 0x1400a8ba3
cmp r9, rbx
jae 0x1400a8bad
cmp rcx, r8
ja 0x1400a8bd6
cmp r9, r8
jb 0x1400a8bd6
xor eax, eax
nop
mov rcx, qword [rbx]
lea rax, [rax + 1]
movzx edx, byte [rax + rcx - 1]
mov rcx, qword [r8]
xor dl, 0x5c
mov byte [rax + rcx - 1], dl
mov rcx, qword [rbx]
xor byte [rax + rcx - 1], 0x36
sub rdi, 1
jne 0x1400a8bb0
jmp 0x1400a8c41
movdqa xmm2, xmmword [0x1401a0d20]
xor eax, eax
movdqa xmm3, xmmword [str.6666666666666666_]
lea r8d, [rax + 2]
nop dword [rax]
movdqu xmm0, xmmword [rax + rdx]
lea rax, [rax + 0x20]
pxor xmm0, xmm2
movdqu xmmword [rax + rcx - 0x20], xmm0
movdqu xmm1, xmmword [rax + rdx - 0x20]
pxor xmm1, xmm3
movdqu xmmword [rax + rdx - 0x20], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax + rdx - 0x10]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx - 0x10], xmm1
movdqa xmm1, xmm3
movdqu xmm0, xmmword [rax + rdx - 0x10]
pxor xmm1, xmm0
movdqu xmmword [rax + rdx - 0x10], xmm1
sub r8, 1
jne 0x1400a8bf0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400adad0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
lea r8, [rsp + 0x30]
mov edx, 0x4004667f
mov dword [rsp + 0x30], 0
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x1400adc70
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
shr r8d, 3
mov r10, rdx
mov r9, rcx
test r8d, r8d
je 0x1400adcf1
mov qword [rsp], rbx
sub r10, rcx
mov r11d, r8d
movabs rbx, 0xffff0000ffff
movabs r8, 0xff00ff00ff00ff
mov rcx, qword [r10 + r9]
lea r9, [r9 + 8]
mov rdx, rcx
mov rax, rcx
shl rcx, 8
shr rdx, 8
shl rax, 8
xor rdx, rax
and rdx, r8
xor rdx, rcx
mov rcx, rdx
mov rax, rdx
shr rcx, 0x10
shl rax, 0x10
xor rcx, rax
shl rdx, 0x10
and rcx, rbx
xor rcx, rdx
rol rcx, 0x20
mov qword [r9 - 8], rcx
sub r11, 1
jne 0x1400adca1
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x1400ae360
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [rcx + 0x14], 0x67452301
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], eax
mov dword [rcx + 0x18], 0xefcdab89
mov dword [rcx + 0x1c], 0x98badcfe
mov dword [rcx + 0x20], 0x10325476
ret
Function at 0x1400b8a50
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
test r8, r8
jne 0x1400b8a60
xor eax, eax
add rsp, 0x38
ret
mov eax, 0xffffffff
mov qword [rsp + 0x20], 0
cmp r8, rax
lea r9, [rsp + 0x50]
cmova r8, rax
movsxd rax, ecx
lea rcx, [rax + rax*2]
mov rax, qword [0x140451a60]
mov rcx, qword [rax + rcx*8 + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400b8ab7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x1400b8a59
cmp eax, 0x6d
je 0x1400b8a59
mov ecx, eax
call fcn.1400bef10
or rax, 0xffffffffffffffff
add rsp, 0x38
ret
mov eax, dword [rsp + 0x50]
add rsp, 0x38
ret

Function at 0x1400b9000
Capabilities:
Get inbound credentials handle via credssp
Get outbound credentials handle via credssp

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x60
mov qword [r11 - 0x18], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov r9d, r8d
mov rbx, rcx
lea rax, vtable.Handshake.0
mov qword [rcx], rax
xor r10d, r10d
mov dword [rcx + 0x30], r10d
mov dword [rcx + 0x38], r10d
mov word [rcx + 0x3c], r10w
mov byte [rcx + 0x3e], r10b
mov byte [rcx + 0x60], 1
mov dword [rcx + 0x40], r10d
mov dword [rcx + 0x44], 1
lea rax, [rcx + 0x50]
mov qword [rcx + 0x48], rax
mov dword [rcx + 0x54], 2
mov qword [rcx + 0x58], r10
mov dword [rax], r10d
lea rax, [rcx + 0x28]
add rcx, 0x18
mov r8d, r10d
cmp r9d, 1
setne r8b
inc r8d
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x30], rcx
mov qword [r11 - 0x38], r10
mov qword [r11 - 0x40], r10
mov qword [r11 - 0x48], r10
xor r9d, r9d
xor ecx, ecx
call sub.Secur32.dll_AcquireCredentialsHandleA
mov edi, eax
test eax, eax
je 0x1400b90aa
lea rcx, str.Could_not_obtain_local_credentials_required_for_authentication
call fcn.14008d910
mov dword [rbx + 0x38], edi
mov byte [rbx + 0x3d], 1
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x1400bb320
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [rcx + 0x14], 0x6a09e667
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], eax
mov dword [rcx + 0x18], 0xbb67ae85
mov dword [rcx + 0x1c], 0x3c6ef372
mov dword [rcx + 0x20], 0xa54ff53a
mov dword [rcx + 0x24], 0x510e527f
mov dword [rcx + 0x28], 0x9b05688c
mov dword [rcx + 0x2c], 0x1f83d9ab
mov dword [rcx + 0x30], 0x5be0cd19
ret

Function at 0x1400bb370
Capabilities:
Hash data using sha384

Disassembly:
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx + 0x18], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 0x20], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x28], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x30], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x38], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x40], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x48], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x50], rax
xor eax, eax
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], eax
ret
Function at 0x1400bb3f0
Capabilities:
Hash data using sha512

Disassembly:
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx + 0x18], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 0x20], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x28], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x30], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x38], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x40], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x48], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x50], rax
xor eax, eax
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], eax
ret

Function at 0x1400bb470
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [rcx + 0x14], 0x67452301
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], eax
mov dword [rcx + 0x18], 0xefcdab89
mov dword [rcx + 0x1c], 0x98badcfe
mov dword [rcx + 0x20], 0x10325476
mov dword [rcx + 0x24], 0xc3d2e1f0
ret
Function at 0x1400c8de0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [str._lJ_]
mov rsi, r8
movsxd r9, r9d
mov rbx, rcx
mov edi, edx
mov rcx, rsi
xor edx, edx
mov r10d, dword [rax + r9*4]
shr r10d, 3
mov r8d, r10d
lea rbp, [r10 + rsi]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rdi + rbx]
cmp rbx, rcx
mov rax, rsi
cmova edi, edx
test rdi, rdi
je 0x1400c8e5c
mov rdx, rbx
neg rdx
nop dword [rax]
movzx ecx, byte [rbx]
lea rbx, [rbx + 1]
cmp rax, rbp
cmove rax, rsi
xor byte [rax], cl
inc rax
lea rcx, [rdx + rbx]
cmp rcx, rdi
jb 0x1400c8e40
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400c8fd0
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r11, rcx
test r8d, r8d
je 0x1400c8fc1
cmp r8d, 4
jb 0x1400c8f98
lea eax, [r8 - 1]
lea rcx, [rcx + rax*8]
lea rax, [rdx + rax*8]
cmp r11, rax
ja 0x1400c8f4b
cmp rcx, rdx
jae 0x1400c8f98
mov r9d, r8d
and r9d, 0xfffffffc
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [r11 + r10*8]
lea eax, [r10 + 2]
movdqu xmm1, xmmword [rdx + r10*8]
pxor xmm1, xmm0
movdqu xmmword [r11 + r10*8], xmm1
add r10d, 4
movdqu xmm1, xmmword [rdx + rax*8]
movdqu xmm0, xmmword [r11 + rax*8]
pxor xmm1, xmm0
movdqu xmmword [r11 + rax*8], xmm1
cmp r10d, r9d
jb 0x1400c8f60
cmp r10d, r8d
jae 0x1400c8fc1
sub rdx, r11
lea rax, [r11 + r10*8]
sub r8d, r10d
nop word [rax + rax]
mov rcx, qword [rdx + rax]
xor qword [rax], rcx
lea rax, [rax + 8]
sub r8, 1
jne 0x1400c8fb0
ret
mov eax, r8d
or al, cl
or al, dl
test al, 7
jne 0x1400c8fe4
shr r8d, 3
jmp 0x1400c8f20
xor r9d, r9d
test r8d, r8d
je 0x1400c9080
cmp r8d, 0x20
jb 0x1400c9056
lea eax, [r8 - 1]
lea r11, [rax + rcx]
add rax, rdx
cmp rcx, rax
ja 0x1400c900b
cmp r11, rdx
jae 0x1400c9056
mov r11d, r8d
and r11d, 0xffffffe0
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [r9 + rcx]
lea eax, [r9 + 0x10]
movdqu xmm1, xmmword [r9 + rdx]
pxor xmm1, xmm0
movdqu xmmword [r9 + rcx], xmm1
add r9d, 0x20
movdqu xmm1, xmmword [rax + rdx]
movdqu xmm0, xmmword [rax + rcx]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
cmp r9d, r11d
jb 0x1400c9020
cmp r9d, r8d
jae 0x1400c9080
mov eax, r9d
sub rdx, rcx
add rax, rcx
sub r8d, r9d
mov r9d, r8d
nop word [rax + rax]
movzx ecx, byte [rdx + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x1400c9070
ret
Function at 0x1400cc570
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov r10d, dword [rdx]
lea rsi, [rcx + 8]
mov r11d, dword [r8]
lea r14, [0x1403f2940]
mov rbx, r8
mov rdi, rdx
mov ebp, 8
mov eax, dword [rsi - 8]
mov r9d, r11d
mov r8d, dword [rsi - 4]
lea rsi, [rsi + 0x10]
ror r9d, 4
xor r9, rax
mov eax, r11d
xor r8, rax
mov rcx, r8
mov rax, r8
shr rax, 0x10
and eax, 0x3f
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [r14 + rcx*4 + 0x100]
xor edx, dword [r14 + rax*4 + 0x300]
mov rax, r8
shr rax, 8
and r8d, 0x3f
and eax, 0x3f
xor edx, dword [r14 + rax*4 + 0x500]
mov rax, r9
shr rax, 0x18
and eax, 0x3f
xor edx, dword [r14 + rax*4]
mov rax, r9
shr rax, 0x10
and eax, 0x3f
xor edx, dword [r14 + rax*4 + 0x200]
mov rax, r9
shr rax, 8
and r9d, 0x3f
and eax, 0x3f
xor edx, dword [r14 + rax*4 + 0x400]
xor edx, dword [r14 + r8*4 + 0x700]
xor edx, dword [r14 + r9*4 + 0x600]
mov eax, dword [rsi - 0x10]
xor r10d, edx
mov r8d, dword [rsi - 0xc]
mov r9d, r10d
ror r9d, 4
xor r9, rax
mov eax, r10d
xor r8, rax
mov rcx, r8
mov rax, r8
shr rax, 0x10
and eax, 0x3f
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [r14 + rcx*4 + 0x100]
xor edx, dword [r14 + rax*4 + 0x300]
mov rax, r8
shr rax, 8
and r8d, 0x3f
and eax, 0x3f
xor edx, dword [r14 + rax*4 + 0x500]
mov rax, r9
shr rax, 0x18
and eax, 0x3f
xor edx, dword [r14 + rax*4]
mov rax, r9
shr rax, 0x10
and eax, 0x3f
xor edx, dword [r14 + rax*4 + 0x200]
mov rax, r9
shr rax, 8
and r9d, 0x3f
and eax, 0x3f
xor edx, dword [r14 + rax*4 + 0x400]
xor edx, dword [r14 + r8*4 + 0x700]
xor edx, dword [r14 + r9*4 + 0x600]
xor r11d, edx
sub rbp, 1
jne 0x1400cc5a2
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov dword [rdi], r10d
mov rdi, qword [rsp + 0x28]
mov dword [rbx], r11d
mov rbx, qword [rsp + 0x10]
pop r14
ret

Function at 0x1400cc920
Capabilities:
Encrypt data using des

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rdx
mov eax, r9d
neg eax
mov rdi, rcx
mov esi, r9d
mov ebp, r8d
sbb rdx, rdx
add rcx, 0x48
and edx, 0x10
add rdx, rbx
call fcn.1400cc710
xor r14d, r14d
lea rdx, [rbx + 8]
mov r9d, r14d
lea rcx, [rdi + 0xc8]
test esi, esi
mov r8d, ebp
sete r9b
call fcn.1400cc710
cmp esi, 1
lea rcx, [rdi + 0x148]
mov edx, reloc.WS2_32.dll_recv
mov r9d, esi
cmove edx, r14d
mov r8d, ebp
add rdx, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.1400cc710