joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c5300
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
mov rcx, rdx
call fcn.1400c3ee0
test eax, eax
je 0x1400c5334
mov rcx, rbx
call fcn.1400c4480
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rbp
mov ebp, dword [rsi + 8]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r14
mov r14, qword [rsi]
lea eax, [rbp - 1]
movsxd rdi, eax
xor eax, eax
mov rcx, qword [r14 + rdi*8]
cmp rcx, 1
sete al
sub ebp, eax
cmp rsi, rbx
je 0x1400c537c
mov edx, ebp
mov rcx, rbx
call fcn.1400c48f0
test rax, rax
je 0x1400c53ed
mov eax, dword [rsi + 0x10]
mov dword [rbx + 0x10], eax
mov rcx, qword [r14 + rdi*8]
mov rax, qword [rbx]
mov rdx, rcx
xor rdx, 1
inc rdx
neg rdx
shl rdx, 0x3f
lea r8, [rax + rdi*8]
shr rcx, 1
je 0x1400c539c
mov qword [r8], rcx
test rdi, rdi
jle 0x1400c53de
sub r14, rax
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [r14 + r8 - 8]
lea r8, [r8 - 8]
mov rax, rcx
dec rdi
shr rax, 1
or rax, rdx
mov rdx, rcx
xor rdx, 1
mov qword [r8], rax
inc rdx
neg rdx
shl rdx, 0x3f
test rdi, rdi
jg 0x1400c53b0
mov dword [rbx + 8], ebp
test ebp, ebp
jne 0x1400c53e8
mov dword [rbx + 0x10], ebp
mov eax, 1
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x1400d0290
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
push r12
push r15
sub rsp, 0x48
mov r15, r9
mov rbx, r8
mov r12, rdx
mov rdi, rcx
call fcn.140061a80
cmp eax, 0x72
jne 0x1400d04b3
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x40], r14
mov r14, rbx
shr r14, 1
and ebx, 1
lea r13, [rbx + r14]
call fcn.1400b3720
mov rdi, qword [rsp + 0xa0]
mov rcx, rax
mov rax, qword [rsp + 0x90]
mov r9, r15
mov rbp, qword [rsp + 0x98]
mov r8, r13
mov qword [rsp + 0x30], rdi
mov rdx, r12
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.1400d0000
test eax, eax
je 0x1400d035c
mov r8d, 0x104
mov qword [rsp + 0x78], rsi
lea rdx, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_kdf_tls1_prf.c
mov rcx, rdi
call fcn.14006cb00
mov rsi, rax
test rax, rax
jne 0x1400d0379
lea r9, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_kdf_tls1_prf.c
mov dword [rsp + 0x20], 0x105
lea edx, [rax + 0x6f]
lea ecx, [rax + 0x34]
lea r8d, [rax + 0x41]
call fcn.14006c4b0
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov r13, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x70]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rbx
ret
lea rbx, [r14 + r12]
call fcn.1400b3de0
mov rcx, rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x90]
mov r9, r15
mov qword [rsp + 0x28], rsi
mov r8, r13
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400d0000
test eax, eax
jne 0x1400d03c8
mov r9d, 0x10a
lea r8, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_kdf_tls1_prf.c
mov rdx, rdi
mov rcx, rsi
call fcn.14006cc20
jmp 0x1400d0355
xor ecx, ecx
test rdi, rdi
je 0x1400d0491
cmp rdi, 0x40
jb 0x1400d046b
lea rdx, [rbp - 1]
lea rax, [rdi - 1]
add rdx, rdi
add rax, rsi
cmp rbp, rax
ja 0x1400d03f5
cmp rdx, rsi
jae 0x1400d046b
mov r8, rdi
and r8, 0xffffffffffffffc0
mov rdx, rsi
mov rax, rbp
sub rdx, rbp
nop word [rax + rax]
movdqu xmm0, xmmword [rax]
add rcx, 0x40
movdqu xmm1, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x40], xmm1
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rdx + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm1, xmmword [rdx + rax - 0x10]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x10], xmm1
cmp rcx, r8
jb 0x1400d0410
cmp rcx, rdi
jae 0x1400d0491
mov r8, rsi
lea rax, [rcx + rbp]
sub r8, rbp
mov rdx, rdi
sub rdx, rcx
movzx ecx, byte [rax + r8]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400d0480
mov r9d, 0x10f
lea r8, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_kdf_tls1_prf.c
mov rdx, rdi
mov rcx, rsi
call fcn.14006cc20
mov eax, 1
jmp 0x1400d0357
mov rax, qword [rsp + 0xa0]
mov r9, r15
mov qword [rsp + 0x30], rax
mov r8, rbx
mov rax, qword [rsp + 0x98]
mov rdx, r12
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
call fcn.1400d0000
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rbx
ret
Function at 0x1400d6c40
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov r10, r8
mov r11, rcx
test r9, r9
jne 0x1400d6c78
mov edx, 0xe2
mov dword [rsp + 0x20], 0x9a
lea r9, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_asn1_a_int.c
mov ecx, reloc.WS2_32.dll_listen
lea r8d, [rdx - 4]
call fcn.14006c4b0
xor eax, eax
add rsp, 0x38
ret
movzx r8d, byte [r8]
and r8d, 0x80
test rdx, rdx
je 0x1400d6c8b
mov dword [rdx], r8d
cmp r9, 1
jne 0x1400d6caf
test r11, r11
je 0x1400d6ca5
movzx eax, byte [r10]
test r8d, r8d
je 0x1400d6ca3
not al
inc al
mov byte [rcx], al
mov eax, 1
add rsp, 0x38
ret
movzx ecx, byte [r10]
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov eax, ebx
test cl, cl
jne 0x1400d6ccc
mov eax, 1
mov ebx, eax
jmp 0x1400d6d7f
cmp cl, 0xff
jne 0x1400d6dbd
mov eax, 1
lea rcx, [r9 - 1]
mov edx, ebx
cmp r9, rax
jbe 0x1400d6d6f
cmp rcx, 8
jb 0x1400d6d5b
and ecx, 7
mov rdx, r9
sub rdx, rcx
xorps xmm2, xmm2
xorps xmm3, xmm3
nop
movd xmm1, dword [r10 + rax]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm1, xmm2
movdqa xmm2, xmm1
movd xmm1, dword [r10 + rax + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm1, xmm3
movdqa xmm3, xmm1
cmp rax, rdx
jb 0x1400d6d00
por xmm2, xmm1
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd edx, xmm2
cmp rax, r9
jae 0x1400d6d6f
movzx ecx, byte [rax + r10]
inc rax
or edx, ecx
cmp rax, r9
jb 0x1400d6d60
test edx, edx
mov eax, ebx
setne al
test edx, edx
setne bl
test edx, edx
je 0x1400d6dbd
movzx ecx, byte [r10 + 1]
and ecx, 0x80
cmp r8d, ecx
jne 0x1400d6dbd
mov edx, 0xe2
mov dword [rsp + 0x20], 0xbb
lea r9, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_asn1_a_int.c
mov ecx, reloc.WS2_32.dll_listen
lea r8d, [rdx - 5]
call fcn.14006c4b0
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x38
ret
mov ecx, eax
sub r9, rcx
test r11, r11
je 0x1400d6e11
neg r8d
mov qword [rsp + 0x30], rdi
lea r8, [rbx + r10]
sbb edi, edi
add r8, r9
movzx edi, dil
mov ecx, edi
and ecx, 1
test r9, r9
je 0x1400d6e0c
mov rdx, r8
sub rdx, rbx
sub rdx, r10
nop
movzx eax, byte [r8 - 1]
lea r8, [r8 - 1]
dec rdx
xor eax, edi
add ecx, eax
mov byte [rdx + r11], cl
shr ecx, 8
test rdx, rdx
jne 0x1400d6df0
mov rdi, qword [rsp + 0x30]
mov rax, r9
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret

Function at 0x1400d6ef0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r8d, dword [rcx + 4]
mov r9, rdx
movsxd rdx, dword [rcx]
and r8d, 0x100
mov rcx, qword [rcx + 8]
jmp fcn.1400d6f10
Function at 0x1400d6f10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push r14
xor r10d, r10d
xor bl, bl
mov r14, r9
mov rdi, rcx
test rcx, rcx
je 0x1400d7026
test rdx, rdx
je 0x1400d7026
movzx eax, byte [rcx]
test r8d, r8d
jne 0x1400d6f5a
cmp al, 0x7f
jbe 0x1400d701e
mov r10d, 1
mov eax, r10d
add rax, rdx
jmp 0x1400d702e
mov bl, 0xff
cmp al, 0x80
jbe 0x1400d6f71
mov r10d, 1
mov eax, r10d
add rax, rdx
jmp 0x1400d702e
jne 0x1400d701e
mov eax, 1
lea rcx, [rdx - 1]
cmp rdx, rax
jbe 0x1400d700f
cmp rcx, 8
jb 0x1400d6ffa
and ecx, 7
mov r8, rdx
sub r8, rcx
xorps xmm3, xmm3
xorps xmm2, xmm2
nop
movd xmm1, dword [rdi + rax]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm1, xmm3
movdqa xmm3, xmm1
movd xmm1, dword [rdi + rax + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm1, xmm2
movdqa xmm2, xmm1
cmp rax, r8
jb 0x1400d6fa0
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd r10d, xmm2
cmp rax, rdx
jae 0x1400d700f
nop
movzx ecx, byte [rax + rdi]
inc rax
or r10d, ecx
cmp rax, rdx
jb 0x1400d7000
neg r10d
sbb bl, bl
movzx ebx, bl
mov r10d, ebx
and r10d, 1
mov eax, r10d
add rax, rdx
jmp 0x1400d702e
mov eax, 1
mov rdx, r10
mov qword [rsp + 0x10], rsi
test r14, r14
je 0x1400d7084
mov rsi, qword [r9]
test rsi, rsi
je 0x1400d7084
movzx r8d, bl
lea r11, [rdi + rdx]
and r8d, 1
mov byte [rsi], bl
test rdx, rdx
je 0x1400d7081
mov r9, r11
mov r10d, r10d
sub r9, rdi
add r10, rsi
nop
movzx edx, byte [r11 - 1]
lea r11, [r11 - 1]
dec r9
movzx ecx, bl
xor edx, ecx
add r8d, edx
mov byte [r10 + r9], r8b
shr r8d, 8
test r9, r9
jne 0x1400d7060
add qword [r14], rax
mov rsi, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
pop r14
ret
Function at 0x1400e5240
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x10], rbx
mov rbx, rdx
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x20], rdi
mov rdi, rcx
test rcx, rcx
je 0x1400e538f
test rdx, rdx
je 0x1400e538f
call fcn.1401762d4
mov dword [rax], 0
mov rcx, qword [rdi]
test rcx, rcx
jne 0x1400e53ba
xor eax, eax
mov rcx, rbx
cmp byte [rbx], al
je 0x1400e52a1
nop
cmp eax, 0x80000000
jae 0x1400e52a1
inc rcx
inc eax
cmp byte [rcx], 0
jne 0x1400e5290
mov esi, eax
btr esi, 0x1f
lea rax, [rsi - 1]
cmp rax, 0x7ffffffb
ja 0x1400e53ad
mov ecx, 0x248
call fcn.140176304
mov qword [rdi], rax
test rax, rax
jne 0x1400e52d9
call fcn.1401762d4
mov dword [rax], listen
jmp 0x1400e539a
xor edx, edx
mov r8d, 0x248
mov rcx, rax
call fcn.140174d10
cmp byte [rsi + rbx - 1], 0x2a
je 0x1400e5360
lea rax, [rsi + 3]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400e5307
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140174150
sub rsp, rcx
lea rdx, [rsp + 0x20]
mov rcx, rdx
sub rcx, rbx
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x1400e5321
movzx eax, byte [rdx + rsi - 1]
cmp al, 0x2f
je 0x1400e5354
cmp al, 0x5c
je 0x1400e5354
movzx eax, word [0x1401fe9d8]
mov word [rdx + rsi], ax
movzx eax, byte [0x1401fe9da]
mov byte [rdx + rsi + 2], al
jmp 0x1400e535d
mov eax, 0x2a
mov word [rdx + rsi], ax
mov rbx, rdx
mov rdx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, qword [rdi]
mov qword [rcx + 0x140], rax
mov rcx, qword [rdi]
cmp qword [rcx + 0x140], 0xffffffffffffffff
jne 0x1400e53ce
call fcn.1401762fc
mov qword [rdi], 0
call fcn.1401762d4
mov dword [rax], reloc.WS2_32.dll_shutdown
xor eax, eax
mov rbx, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x18]
mov rdi, qword [rbp + 0x20]
mov rsp, rbp
pop rbp
ret
call fcn.1401762d4
mov dword [rax], 2
jmp 0x1400e539a
mov rdx, rcx
mov rcx, qword [rcx + 0x140]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1400e539a
mov rcx, qword [rdi]
mov r8d, 0xff
lea rdx, [rcx + 0x2c]
add rcx, 0x148
call fcn.140188030
mov rax, qword [rdi]
mov rbx, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x18]
mov byte [rax + 0x247], 0
mov rax, qword [rdi]
mov rdi, qword [rbp + 0x20]
add rax, 0x148
mov rsp, rbp
pop rbp
ret
Function at 0x1400e6950
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0xa8
mov rax, qword [rdx + 8]
xor esi, esi
mov r15, qword [rdx + 0x10]
sub rax, r8
mov qword [rsp + 0xe8], rax
mov rdi, r8
mov r13, rdx
mov r12, rcx
mov ebp, esi
cmp r15, r8
jb 0x1400e6b08
cmp r8, 0x40
ja 0x1400e6b08
lea rax, [rsp + 0x20]
mov qword [r11 + 0x20], rbx
neg rax
mov qword [r11 - 0x38], r14
and eax, 0x3f
lea r14, [rsp + 0x20]
add r14, rax
lea rax, [r8 + 0x100]
cmp r15, rax
jbe 0x1400e69ce
mov rbp, r15
sub rbp, r8
sub rbp, 0x100
xor edx, edx
mov rcx, r14
mov rbx, rsi
call fcn.140174d10
mov r9, rsi
cmp rbp, r15
jae 0x1400e6a9e
mov rcx, qword [r13 + 0x20]
mov r12, rsi
mov r10, qword [r13 + 8]
mov r11, qword [rsp + 0xe8]
mov qword [rsp + 0xf0], rcx
lea r13, [rcx + r10]
nop word [rax + rax]
add rcx, rbp
mov rax, rbp
xor rax, r11
mov rdx, rcx
sub rdx, r13
xor rdx, r10
lea r8, [rax - 1]
not rax
shr rax, 0x3f
shr r8, 0x3f
and r8, rax
mov rax, rbp
xor rax, r10
neg r8
or rdx, rax
or r12, r8
xor rdx, rbp
and r8, r9
shr rdx, 0x3f
or rbx, r8
neg rdx
inc rbp
and r12, rdx
movzx eax, r12b
and al, byte [rcx]
or byte [r9 + r14], al
inc r9
mov rcx, r9
mov rax, r9
sub rcx, rdi
xor rax, rdi
xor rcx, rdi
or rcx, rax
xor rcx, r9
shr rcx, 0x3f
neg rcx
and r9, rcx
mov rcx, qword [rsp + 0xf0]
cmp rbp, r15
jb 0x1400e6a10
mov r12, qword [rsp + 0xe0]
test rdi, rdi
je 0x1400e6ae2
mov rax, rbx
xor rax, 0x20
movzx eax, byte [rax + r14]
movzx eax, byte [rbx + r14]
inc rbx
mov byte [rsi + r12], al
mov rcx, rbx
sub rcx, rdi
mov rax, rbx
xor rcx, rdi
xor rax, rdi
or rcx, rax
inc rsi
xor rcx, rbx
shr rcx, 0x3f
neg rcx
and rbx, rcx
cmp rsi, rdi
jb 0x1400e6aa3
mov r14, qword [rsp + 0xa0]
mov eax, 1
mov rbx, qword [rsp + 0xf8]
add rsp, 0xa8
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8d, 0x612
lea rdx, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_ssl_record_ssl3_record.c
lea rcx, str.Assertion_failed:_rec__orig_len___md_size__md_size___EVP_MAX_MD_SIZE
call fcn.14006ea90
xor eax, eax
add rsp, 0xa8
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e7d30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rax, qword [rcx + 8]
lea rsi, [r9 + 1]
mov rbx, rdx
mov rdx, qword [rdx + 8]
mov r9, qword [rax + 0xc0]
test byte [r9 + 0x60], 1
je 0x1400e7d82
lea rax, [rsi + r8]
cmp rax, rdx
jbe 0x1400e7d6d
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
add qword [rbx + 0x20], r8
sub rdx, r8
add qword [rbx + 0x28], r8
sub qword [rbx + 0x10], r8
mov qword [rbx + 8], rdx
jmp 0x1400e7d87
cmp rsi, rdx
ja 0x1400e7d60
mov rax, qword [rbx + 0x20]
mov rcx, qword [rcx + 0x430]
mov qword [rsp + 0x40], rdi
movzx edi, byte [rax + rdx - 1]
call fcn.1400611e0
mov rcx, rax
call fcn.1400613c0
mov r8, qword [rbx + 8]
and eax, 0x200000
je 0x1400e7dc4
sub r8, rdi
mov eax, 1
dec r8
jmp 0x1400e7e76
lea rcx, [rdi + rsi]
mov qword [rsp + 0x38], rbp
mov ebp, 0x100
mov r9, r8
sub r9, rcx
mov rax, r8
xor r9, rcx
xor rax, rcx
or r9, rax
xor r9, r8
shr r9, 0x3f
dec r9
cmp r8, rbp
cmovb rbp, r8
xor r10d, r10d
test rbp, rbp
je 0x1400e7e4d
mov r11, qword [rbx + 0x20]
mov rsi, rdi
shr rsi, 0x3f
dec r11
add r11, r8
nop
mov rax, r10
lea r11, [r11 - 1]
shr rax, 0x3f
mov rcx, rdi
sub rcx, r10
inc r10
shr rcx, 0x3f
xor cl, al
xor al, sil
or cl, al
movzx eax, byte [r11 + 1]
dec cl
movzx edx, cl
mov rcx, rdi
xor rcx, rax
and rdx, rcx
not rdx
and r9, rdx
cmp r10, rbp
jb 0x1400e7e10
mov rbp, qword [rsp + 0x38]
lea rax, [rdi + 1]
not r9
movzx ecx, r9b
dec rcx
shr rcx, 0x3f
neg rcx
and rax, rcx
sub r8, rax
mov eax, ecx
and eax, 1
not ecx
or eax, ecx
mov rdi, qword [rsp + 0x40]
mov qword [rbx + 8], r8
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x1400ec6e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xb0
mov rax, qword [rcx]
xor r14d, r14d
movsxd rdi, r8d
mov rbp, r9
mov rsi, rdx
mov rbx, rcx
mov r13d, r14d
lea r12d, [r14 + 1]
test r9, r9
je 0x1400ec735
cmp r9, rax
je 0x1400ec72d
test rdx, rdx
je 0x1400ec726
test r8d, r8d
jns 0x1400ec72d
xor eax, eax
jmp 0x1400ec938
mov r13d, r12d
mov qword [rcx], r9
jmp 0x1400ec73d
test rax, rax
je 0x1400ec726
mov rbp, rax
mov qword [rsp + 0xe0], r15
mov r15, qword [rsp + 0x100]
test rsi, rsi
je 0x1400ec954
mov rcx, rbp
mov r13d, r12d
call fcn.140061950
cmp eax, 0x90
mov r12d, r14d
mov r15d, eax
setle r12b
jle 0x1400ec78b
mov r8d, 0x29
lea rdx, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_hmac_hmac.c
lea rcx, str.Assertion_failed:_j____int_sizeof_ctx__key_
call fcn.14006ea90
test r12d, r12d
je 0x1400ec7db
cmp r15d, edi
jge 0x1400ec7e2
mov r15, qword [rsp + 0x100]
mov rdx, rbp
mov rcx, qword [rbx + 8]
mov r8, r15
call fcn.140079600
test eax, eax
je 0x1400ec7db
mov rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, rsi
call fcn.140079850
test eax, eax
je 0x1400ec7db
mov rcx, qword [rbx + 8]
lea rsi, [rbx + 0x20]
mov r8, rsi
lea rdx, [rbx + 0x24]
call fcn.140079530
test eax, eax
jne 0x1400ec807
xor eax, eax
jmp 0x1400ec930
cmp edi, 0x90
ja 0x1400ec7db
mov r8, rdi
lea rcx, [rbx + 0x24]
mov rdx, rsi
call fcn.140174ed0
mov r15, qword [rsp + 0x100]
lea rsi, [rbx + 0x20]
mov dword [rsi], edi
mov ecx, dword [rsi]
cmp ecx, 0x90
je 0x1400ec82a
mov eax, ecx
mov r8d, 0x90
sub r8d, ecx
xor edx, edx
lea rcx, [rbx + 0x24]
add rcx, rax
call fcn.140174d10
mov r12d, r13d
lea rcx, [rsp + 0x20]
mov rax, rbx
sub rax, rcx
mov rdx, r14
lea rdi, [rax + 0x24]
lea rsi, [rax + 0x25]
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rdi + rcx]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [rsi + rcx]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x90
jl 0x1400ec850
mov rcx, qword [rbx + 0x10]
mov r8, r15
mov rdx, rbp
call fcn.140079600
test eax, eax
je 0x1400ec919
mov rcx, rbp
call fcn.140061950
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.140079850
test eax, eax
je 0x1400ec919
mov rdx, r14
nop dword [rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rdi + rcx]
xor al, 0x5c
mov byte [rcx], al
movzx eax, byte [rsi + rcx]
xor al, 0x5c
mov byte [rcx + 1], al
cmp rdx, 0x90
jl 0x1400ec8b0
mov rcx, qword [rbx + 0x18]
mov r8, r15
mov rdx, rbp
call fcn.140079600
test eax, eax
je 0x1400ec919
mov rcx, rbp
call fcn.140061950
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.140079850
test eax, eax
je 0x1400ec919
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
call fcn.140079890
test eax, eax
cmovne r14d, r12d
test r13d, r13d
je 0x1400ec92d
mov edx, 0x90
lea rcx, [rsp + 0x20]
call fcn.14006c890
mov eax, r14d
mov r15, qword [rsp + 0xe0]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
test r13d, r13d
je 0x1400ec906
jmp 0x1400ec82d
Function at 0x1400fb640
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 8
xor r11d, r11d
test rcx, rcx
je 0x1400fb659
test byte [rcx + 0x5c], 2
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x1400fb660
lea r10, [0x140209430]
test r9d, r9d
jle 0x1400fb74f
inc r8
mov qword [rsp], rbx
movzx eax, byte [r8 - 1]
cmp r9d, 3
jl 0x1400fb6d1
movzx ecx, al
movzx eax, byte [r8]
shl rcx, 8
or rcx, rax
movzx eax, byte [r8 + 1]
shl rcx, 8
or rcx, rax
mov rax, rcx
shr rax, 0x12
movzx eax, byte [rax + r10]
mov byte [rdx], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r10]
mov byte [rdx + 1], al
mov rax, rcx
shr rax, 6
and eax, 0x3f
and ecx, 0x3f
movzx eax, byte [rax + r10]
mov byte [rdx + 2], al
movzx ecx, byte [rcx + r10]
jmp 0x1400fb721
movzx ecx, al
shl ecx, 0x10
cmp r9d, 2
jne 0x1400fb6e6
movzx eax, byte [r8]
shl eax, 8
or ecx, eax
mov rax, rcx
shr rax, 0x12
movzx eax, byte [rax + r10]
mov byte [rdx], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r10]
mov byte [rdx + 1], al
cmp r9d, 1
jne 0x1400fb710
mov al, 0x3d
jmp 0x1400fb71c
shr rcx, 6
and ecx, 0x3f
movzx eax, byte [rcx + r10]
mov byte [rdx + 2], al
mov cl, 0x3d
lea rax, [rdx + 3]
add r11d, 4
lea rdx, [rax + 1]
mov byte [rax], cl
add r8, 3
sub r9d, 3
test r9d, r9d
jg 0x1400fb670
mov rbx, qword [rsp]
mov eax, r11d
mov byte [rdx], 0
add rsp, 8
ret
mov byte [rdx], r11b
mov eax, r11d
add rsp, 8
ret

Function at 0x1401011f0
Capabilities:
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x100
test r8, r8
mov dword [rsp + 0xf4], 0x40
movabs rax, 0x6a09e667f3bcc908
lea rbx, [0x14027c680]
mov qword [rsp + 0x20], rax
cmovne rbx, r8
movabs rax, 0xbb67ae8584caa73b
mov r8, rdx
mov qword [rsp + 0x28], rax
mov rdx, rcx
movabs rax, 0x3c6ef372fe94f82b
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rsp + 0x38], rax
movabs rax, 0x510e527fade682d1
mov qword [rsp + 0x40], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rsp + 0x48], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsp + 0x50], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0xf0], eax
call fcn.140101b60
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1401012e0
mov edx, 0xd8
lea rcx, [rsp + 0x20]
call fcn.14006c890
mov rax, rbx
add rsp, 0x100
pop rbx
ret
Function at 0x140105f90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [rbp + 0x50]
mov r12, rcx
movzx ecx, byte [rax + 7]
lea rdi, [rax + 1]
mov r13, qword [rbp + 0x58]
mov rsi, rdx
movzx edx, byte [rdi + 3]
xor r15d, r15d
movzx r11d, byte [rax]
mov r14d, r8d
movzx eax, byte [rdi]
mov ebx, dword [r13]
shl eax, 8
or r11d, eax
shl ecx, 8
movzx eax, byte [rdi + 1]
shl eax, 0x10
or r11d, eax
movzx eax, byte [rdi + 2]
shl eax, 0x18
or r11d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
or edx, eax
mov dword [rbp - 8], r11d
movzx eax, byte [rdi + 5]
or ecx, eax
mov byte [rbp - 0x10], r11b
shl ecx, 0x10
mov eax, r11d
shr eax, 8
or edx, ecx
mov byte [rbp - 0xf], al
mov eax, r11d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r11d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov dword [rbp - 4], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 9], al
test r8d, r8d
je 0x140106138
mov r13, qword [rbp + 0x48]
sub r12, rsi
movzx r8d, dl
movzx r9d, r11b
nop dword [rax]
dec r14d
test ebx, ebx
jne 0x1401060d6
lea r8d, [rbx + 1]
mov rdx, r13
lea rcx, [rbp - 8]
call fcn.140102400
mov r11d, dword [rbp - 8]
mov eax, r11d
mov edx, dword [rbp - 4]
movzx r9d, byte [rbp - 8]
movzx r8d, byte [rbp - 4]
shr eax, 8
mov byte [rbp - 0xf], al
mov eax, r11d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r11d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
inc r15d
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [r12 + rsi]
mov byte [rsi], cl
inc rsi
inc ebx
and ebx, 7
test r14d, r14d
jne 0x140106070
mov r13, qword [rbp + 0x58]
test r15d, r15d
je 0x140106138
mov rax, qword [rbp + 0x50]
mov byte [rax], r9b
mov eax, r11d
shr eax, 8
mov byte [rdi], al
mov eax, r11d
shr eax, 0x10
mov byte [rdi + 1], al
mov eax, edx
shr eax, 8
shr r11d, 0x18
mov byte [rdi + 2], r11b
mov byte [rdi + 3], r8b
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov dword [r13], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret