joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003c3a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
mov eax, 0x20
call fcn.140103e70
sub rsp, rax
mov rbx, rdx
test rcx, rcx
jne 0x14003c404
lea rcx, [rsp + 0x30]
call sub.MSVCR90.dll__time64
xor r11d, r11d
lea rcx, [rsp + 0x30]
mov dword [rbx], r11d
mov dword [rbx + 4], r11d
mov dword [rbx + 8], r11d
mov dword [rbx + 0xc], r11d
mov dword [rbx + 0x10], r11d
mov dword [rbx + 0x14], r11d
mov dword [rbx + 0x18], r11d
mov dword [rbx + 0x1c], r11d
mov rdx, rbx
mov dword [rbx + 0x20], r11d
call fcn.140062f10
xor ecx, ecx
test rax, rax
setne cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov rdx, rcx
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14003bbd0

Function at 0x1400471e0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov r9, rcx
test rcx, rcx
je 0x140047237
movzx eax, byte [rcx]
test al, al
je 0x140047237
mov r10d, 0x100
nop dword [rax + rax]
movsx edx, al
inc r9
or edx, r10d
add r10d, 0x100
mov eax, edx
shr eax, 2
xor eax, edx
and eax, 0xf
movzx ecx, al
mov al, byte [r9]
imul edx, edx
rol r8d, cl
xor r8d, edx
test al, al
jne 0x140047200
mov eax, r8d
shr eax, 0x10
xor eax, r8d
ret
xor eax, eax
ret

Function at 0x140047240
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x20
call fcn.140103e70
sub rsp, rax
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
je 0x1400472b1
movzx eax, byte [rcx]
test al, al
je 0x1400472b1
mov qword [rsp + 0x30], rsi
mov esi, 0x100
nop
movsx ecx, al
call fcn.14004bfe0
inc rdi
or eax, esi
add esi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
rol ebx, cl
imul eax, eax
xor ebx, eax
mov al, byte [rdi]
test al, al
jne 0x140047270
mov rsi, qword [rsp + 0x30]
mov eax, ebx
shr eax, 0x10
xor eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14004a260
Capabilities:
Encode data using xor

Disassembly:
push rdi
movsxd rdi, r9d
mov r10, r8
mov r11, rdx
cmp rdx, r8
je 0x14004a314
movsxd rdx, dword [rdx + 8]
mov qword [rsp + 0x10], rbx
lea rbx, [rcx - 1]
not rcx
shr rbx, 0x3f
xor r9d, r9d
shr rcx, 0x3f
and rbx, rcx
movsxd rcx, dword [r8 + 8]
xor rcx, rdx
dec rbx
and rcx, rbx
xor edx, ecx
mov dword [r11 + 8], edx
xor dword [r8 + 8], ecx
movsxd rdx, dword [r11 + 0x10]
movsxd rcx, dword [r8 + 0x10]
xor rcx, rdx
and rcx, rbx
xor edx, ecx
mov dword [r11 + 0x10], edx
xor dword [r8 + 0x10], ecx
mov ecx, dword [r11 + 0x14]
mov eax, dword [r8 + 0x14]
xor rax, rcx
and eax, 4
and rax, rbx
xor ecx, eax
mov dword [r11 + 0x14], ecx
xor dword [r8 + 0x14], eax
test rdi, rdi
jle 0x14004a30f
mov rax, qword [r10]
mov r8, qword [r11]
inc r9
mov rcx, qword [r8 + r9*8 - 8]
mov rdx, qword [rax + r9*8 - 8]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + r9*8 - 8], rcx
mov rax, qword [r10]
xor qword [rax + r9*8 - 8], rdx
cmp r9, rdi
jl 0x14004a2e1
mov rbx, qword [rsp + 0x10]
pop rdi
ret
Function at 0x14004c170
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
mov eax, 0x20
call fcn.140103e70
sub rsp, rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
xor ecx, ecx
cmp eax, 0xffffffff
mov dword [rbx], eax
setne cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x14004c1e0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140103e70
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x14004d020
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140103e70
sub rsp, rax
lea rcx, [0x14017b9a4]
add rsp, 0x28
jmp fcn.14004c1a0
Function at 0x140050e10
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x140050e36
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
inc rcx
xor dl, al
or r9b, dl
sub r8, 1
jne 0x140050e20
movzx eax, r9b
ret

Function at 0x140058980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
mov rbx, rcx
xor r10d, r10d
xor cl, cl
mov rsi, r9
mov r11, rdx
test rbx, rbx
je 0x140058a16
test rdx, rdx
je 0x140058a16
movzx eax, byte [rbx]
test r8d, r8d
jne 0x1400589ba
cmp rax, 0x7f
jbe 0x140058a0e
mov r10d, 1
mov edx, r10d
add rdx, r11
jmp 0x140058a1e
mov cl, 0xff
cmp rax, 0x80
jbe 0x1400589d2
mov r10d, 1
mov edx, r10d
add rdx, r11
jmp 0x140058a1e
cmp rax, 0x80
jne 0x140058a0e
mov edx, 1
cmp rdx, r11
jae 0x1400589ff
nop word [rax + rax]
movzx eax, byte [rdx + rbx]
inc rdx
or r10d, eax
cmp rdx, r11
jb 0x1400589f0
neg r10d
sbb cl, cl
movzx ecx, cl
mov r10d, ecx
and r10d, 1
mov edx, r10d
add rdx, r11
jmp 0x140058a1e
mov edx, 1
mov r11, r10
mov qword [rsp + 0x10], rbp
test r9, r9
je 0x140058a81
mov rbp, qword [r9]
test rbp, rbp
je 0x140058a81
mov qword [rsp + 0x18], rdi
movzx edi, cl
mov byte [rbp], cl
mov eax, edi
mov ecx, r10d
lea r8, [rbx + r11]
and eax, 1
test r11, r11
je 0x140058a79
sub rcx, r8
mov r9, r8
lea r10, [rbp + rcx]
sub r9, rbx
add r10, r11
nop dword [rax]
movzx ecx, byte [r8 - 1]
dec r8
xor ecx, edi
add eax, ecx
mov byte [r10 + r8], al
shr eax, 8
sub r9, 1
jne 0x140058a60
add qword [rsi], rdx
mov rdi, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x20]
mov rax, rdx
pop rsi
ret
Function at 0x140058a90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x38
call fcn.140103e70
sub rsp, rax
mov r10, r8
mov r11, rcx
test r9, r9
jne 0x140058acf
mov edx, 0xe2
lea r9, str.....Srcopenssl_1.1.1hcrypto_asn1_a_int.c
lea ecx, [rax - 0x2b]
lea r8d, [rdx - 4]
mov dword [rsp + 0x20], 0x9a
call fcn.140045670
xor eax, eax
add rsp, 0x38
ret
movzx r8d, byte [r8]
and r8d, 0x80
test rdx, rdx
je 0x140058ae2
mov dword [rdx], r8d
cmp r9, 1
jne 0x140058b19
test rcx, rcx
je 0x140058b0a
test r8d, r8d
je 0x140058b04
movzx eax, byte [r10]
not al
inc al
mov byte [rcx], al
mov rax, r9
add rsp, 0x38
ret
movzx eax, byte [r10]
mov byte [rcx], al
movabs rax, 1
add rsp, 0x38
ret
movzx eax, byte [r10]
mov qword [rsp + 0x40], rbx
xor ebx, ebx
test al, al
jne 0x140058b2f
mov ebx, 1
jmp 0x140058b58
cmp al, 0xff
jne 0x140058b95
mov ecx, 1
mov edx, ebx
cmp rcx, r9
jae 0x140058b4f
nop
movzx eax, byte [rcx + r10]
inc rcx
or edx, eax
cmp rcx, r9
jb 0x140058b40
test edx, edx
setne bl
test ebx, ebx
je 0x140058b95
movzx eax, byte [r10 + 1]
and eax, 0x80
cmp r8d, eax
jne 0x140058b95
mov edx, 0xe2
lea r9, str.....Srcopenssl_1.1.1hcrypto_asn1_a_int.c
mov ecx, recv
lea r8d, [rdx - 5]
mov dword [rsp + 0x20], 0xbb
call fcn.140045670
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x38
ret
mov qword [rsp + 0x30], rdi
movsxd rdi, ebx
sub r9, rdi
test r11, r11
je 0x140058beb
neg r8d
lea r8, [rdi + r10]
sbb al, al
add r8, r9
movzx eax, al
mov ecx, eax
mov ebx, eax
and ecx, 1
test r9, r9
je 0x140058beb
mov rdx, r8
sub rdx, rdi
sub rdx, r10
nop dword [rax]
movzx eax, byte [r8 - 1]
dec r8
dec rdx
xor eax, ebx
add ecx, eax
mov byte [rdx + r11], cl
shr ecx, 8
test rdx, rdx
jne 0x140058bd0
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rax, r9
add rsp, 0x38
ret

Function at 0x140058c00
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.140103e70
sub rsp, rax
mov r8d, dword [rcx + 4]
mov r9, rdx
movsxd rdx, dword [rcx]
mov rcx, qword [rcx + 8]
and r8d, 0x100
add rsp, 0x28
jmp fcn.140058980
Function at 0x140067330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x20
call fcn.140103e70
sub rsp, rax
movsxd rsi, r8d
mov rdi, rdx
mov rbp, rcx
mov r8, rsi
call sub.MSVCR90.dll_memcmp
test eax, eax
jle case.0x14006741a.2
xor r8d, r8d
mov rdx, r8
test esi, esi
jle 0x140067397
mov r9, rbp
mov rcx, rdi
sub r9, rdi
nop dword [rax]
movzx eax, byte [rcx]
cmp byte [r9 + rcx], al
jne 0x140067397
inc rdx
inc r8d
inc rcx
cmp rdx, rsi
jl 0x140067380
lea edx, [rsi - 1]
movsxd rcx, edx
test edx, edx
js 0x1400673c7
mov r9, rbp
lea rax, [rcx + rdi]
sub r9, rdi
nop dword [rax + rax]
cmp byte [rax + r9], 0
jne 0x1400673c7
cmp byte [rax], 0xff
jne 0x1400673c7
dec edx
dec rax
sub rcx, 1
jns 0x1400673b0
cmp r8d, edx
jl case.0x14006741a.2
jle 0x1400673df
lea eax, [r8*8]
jmp 0x140067461
movsxd rax, r8d
movzx r9d, byte [rax + rdi]
movzx r10d, byte [rax + rbp]
movzx edx, r9b
xor dl, r10b
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x14006741a.2
lea r11, [0x140000000]
cdqe
movzx eax, byte [r11 + rax + 0x67498]
mov ecx, dword [r11 + rax*4 + 0x67478]
add rcx, r11
jmp rcx
mov eax, 7
jmp 0x14006744b
mov eax, 6
jmp 0x14006744b
mov eax, 5
jmp 0x14006744b
mov eax, 4
jmp 0x14006744b
mov eax, 3
jmp 0x14006744b
mov eax, 2
jmp 0x14006744b
mov eax, 1
test dl, r10b
jne case.0x14006741a.2
and r9b, dl
cmp r9b, dl
jne case.0x14006741a.2
lea eax, [rax + r8*8]
jmp 0x140067461
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140076170
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
mov eax, 0x38
call fcn.140103e70
sub rsp, rax
mov rsi, qword [rcx + 0x70]
mov rdi, r9
mov rbp, r8
movsxd rcx, dword [rsi + 0x70]
mov rbx, rdx
test ecx, ecx
je 0x1400761e2
mov rdx, rcx
test r9, r9
je 0x1400761c1
nop
cmp ecx, 0x40
jae 0x1400761c1
movzx eax, byte [rdx + rsi + 0x30]
inc rbx
inc ecx
xor al, byte [rbp]
inc rdx
inc rbp
sub rdi, 1
mov byte [rbx - 1], al
jne 0x1400761a0
mov dword [rsi + 0x70], ecx
test rdi, rdi
je 0x1400762f7
cmp ecx, 0x40
jne 0x1400761e2
add dword [rsi + 0x20], 1
mov dword [rsi + 0x70], 0
jne 0x1400761e2
inc dword [rsi + 0x24]
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r14
mov r14d, dword [rsi + 0x20]
mov qword [rsp + 0x30], r15
mov r15d, edi
lea rax, [rsi + 0x20]
and r15d, 0x3f
mov r13d, r15d
mov dword [rsp + 0x60], r15d
sub rdi, r13
cmp rdi, 0x40
jb 0x140076285
mov qword [rsp + 0x68], r12
mov r15d, 0x10000000
lea r13, [rsi + 0x20]
mov r12, rdi
shr r12, 6
cmp r12, r15
cmova r12, r15
add r14d, r12d
mov eax, r14d
cmp rax, r12
jae 0x14007623f
sub r12, rax
xor r14d, r14d
shl r12, 6
mov r9, rsi
mov rdx, rbp
mov rcx, rbx
mov r8, r12
mov qword [rsp + 0x20], r13
call fcn.1400a98b0
sub rdi, r12
add rbp, r12
add rbx, r12
mov dword [r13], r14d
test r14d, r14d
jne 0x14007626e
inc dword [rsi + 0x24]
cmp rdi, 0x40
jae 0x140076220
mov r15d, dword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
lea rax, [rsi + 0x20]
mov r13, r15
mov r14, qword [rsp + 0x78]
test r15d, r15d
je 0x1400762ed
xor ecx, ecx
lea rdi, [rsi + 0x30]
mov r9, rsi
mov qword [rdi], rcx
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rcx
mov qword [rdi + 0x18], rcx
mov qword [rdi + 0x20], rcx
mov qword [rdi + 0x28], rcx
mov qword [rdi + 0x30], rcx
lea r8d, [rcx + 0x40]
mov qword [rdi + 0x38], rcx
mov rcx, rdi
mov rdx, rdi
mov qword [rsp + 0x20], rax
call fcn.1400a98b0
test r15d, r15d
je 0x1400762e9
sub rbp, rbx
movzx eax, byte [rbx + rbp]
inc rbx
inc rdi
xor al, byte [rdi - 1]
sub r13, 1
mov byte [rbx - 1], al
jne 0x1400762d3
mov dword [rsi + 0x70], r15d
mov r15, qword [rsp + 0x30]
mov r13, qword [rsp + 0x70]
mov eax, 1
add rsp, 0x38
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14007f980
Capabilities:
Encode data using xor

Disassembly:
mov r10, rdx
mov r9, rcx
test rdx, rdx
je 0x14007f9f9
test r8, r8
je 0x14007f9f9
mov r11, qword [rcx + 0x28]
cmp r8, r11
cmovb r11, r8
xor ecx, ecx
mov rdx, rcx
test r11, r11
je 0x14007f9c2
nop word [rax + rax]
movzx eax, byte [rdx + r10]
inc rdx
xor byte [r9 + rdx + 0x2f], al
cmp rdx, r11
jb 0x14007f9b0
mov rax, qword [r9 + 0x28]
cmp r8, rax
jbe 0x14007f9f9
sub r8, rax
mov eax, reloc.WS2_32.dll_recv
cmp r8, rax
cmova r8, rax
test r8, r8
je 0x14007f9f9
nop
mov rax, qword [r9 + 0x28]
add rax, rcx
inc rcx
movzx eax, byte [rax + r10]
xor byte [r9 + rcx + 0x4f], al
cmp rcx, r8
jb 0x14007f9e0
repz ret

Function at 0x14007fa00
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, reloc.WS2_32.dll_WSASetLastError
call fcn.140103e70
sub rsp, rax
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, qword [rdx]
lea r8, [rsp + 0x38]
mov r11, rcx
cmp qword [r11 + 0x28], 0x10
mov qword [r8], rax
mov rax, qword [rdx + 8]
mov qword [r8 + 8], rax
mov rax, qword [rdx]
lea r8, [rsp + 0x48]
mov qword [r8], rax
mov rax, qword [rdx + 8]
mov cl, 2
mov qword [r8 + 8], rax
je 0x14007fa65
mov rax, qword [rdx]
lea rcx, [rsp + 0x58]
mov qword [rcx], rax
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov cl, 3
movzx ebx, cl
lea rdx, [r11 + 0x78]
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
shl ebx, 4
movsxd r9, ebx
test ebx, ebx
jle 0x14007faa2
lea r10, [rsp + 0x38]
mov r8, rdx
sub r10, rdx
nop dword [rax]
movzx eax, byte [r10 + r8]
inc r8
xor byte [r8 - 1], al
sub r9, 1
jne 0x14007fa90
mov rcx, qword [r11 + 0x10]
lea r8, [rsp + 0x30]
mov r9, rdx
mov dword [rsp + 0x20], ebx
call fcn.140057560
test eax, eax
je 0x14007fad9
cmp dword [rsp + 0x30], ebx
jne 0x14007fad9
mov eax, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140103060
add rsp, 0x70
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140103060
add rsp, 0x70
pop rbx
ret
Function at 0x14007faf0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, reloc.WS2_32.dll_WSASetLastError
call fcn.140103e70
sub rsp, rax
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor eax, eax
lea rdx, [rcx + 0x78]
xor ebx, ebx
mov qword [rdx], rax
mov qword [rdx + 8], rax
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], rax
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], rax
cmp qword [rcx + 0x28], 0x10
mov qword [rsp + 0x49], rax
mov qword [rsp + 0x59], rax
setne bl
mov byte [rsp + 0x38], 0
mov qword [rsp + 0x39], rax
add ebx, 2
mov qword [rsp + 0x41], rax
mov qword [rsp + 0x51], rax
shl ebx, 4
mov dword [rsp + 0x61], eax
mov word [rsp + 0x65], ax
mov byte [rsp + 0x67], al
mov byte [rsp + 0x4b], 1
mov byte [rsp + 0x5b], 2
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
movsxd r9, ebx
test ebx, ebx
jle 0x14007fba2
lea r10, [rsp + 0x38]
mov r8, rdx
sub r10, rdx
nop word [rax + rax]
movzx eax, byte [r10 + r8]
inc r8
xor byte [r8 - 1], al
sub r9, 1
jne 0x14007fb90
mov rcx, qword [rcx + 0x10]
lea r8, [rsp + 0x30]
mov r9, rdx
mov dword [rsp + 0x20], ebx
call fcn.140057560
test eax, eax
je 0x14007fbd9
cmp dword [rsp + 0x30], ebx
jne 0x14007fbd9
mov eax, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140103060
add rsp, 0x70
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140103060
add rsp, 0x70
pop rbx
ret
Function at 0x140082f30
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
mov eax, 0x30
call fcn.140103e70
sub rsp, rax
lea edx, [rax - 0x2f]
xor esi, esi
mov rdi, rcx
mov rbx, rsi
call fcn.140050090
mov rcx, rdi
mov rdx, rax
mov rbp, rax
call fcn.140050270
mov r12, rax
test rax, rax
je 0x140082fdb
lea r9d, [rsi + 1]
lea rcx, [rsp + 0x58]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140082fb4
mov rcx, qword [rsp + 0x58]
mov r8, r12
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rbx, rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rbx*8]
mov rdx, rbx
mov rcx, rdi
call fcn.140050300
mov rcx, rdi
call fcn.14004ff00
mov rbx, rax
test rax, rax
jne 0x140083077
mov edx, 1
mov rcx, rdi
call fcn.140050090
mov rcx, rdi
mov rdx, rax
mov rbp, rax
call fcn.140050270
mov r12, rax
test rax, rax
je 0x140083065
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
lea rcx, [rsp + 0x58]
mov r9d, 0x16
xor edx, edx
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140083047
mov rcx, qword [rsp + 0x58]
mov r8, r12
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rsi, rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rsi*8]
mov rdx, rsi
mov rcx, rdi
call fcn.140050300
mov rcx, rdi
call fcn.14004ff00
mov rbx, rax
test rbx, rbx
je 0x14008306f
mov rax, rbx
jmp 0x140083077
mov rcx, rdi
call fcn.14004ff00
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret

Function at 0x1400844a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movzx r9d, byte [rdx]
lea eax, [r8 - 1]
xor ebx, ebx
movzx r11d, r9b
mov esi, r8d
mov rdi, rcx
shr r11b, 7
test eax, eax
jle 0x140084502
mov r10, rcx
inc rdx
mov ebx, eax
mov r8d, eax
nop word [rax + rax]
movzx ecx, byte [rdx]
add r9b, r9b
inc r10
movzx eax, cl
inc rdx
shr al, 7
or al, r9b
sub r8, 1
mov r9b, cl
mov byte [r10 - 1], al
jne 0x1400844e0
mov eax, 0x87
cmp esi, 0x10
mov rsi, qword [rsp + 0x10]
mov ecx, 0x1b
cmove ecx, eax
movsxd rax, ebx
mov rbx, qword [rsp + 8]
neg r11b
add r9b, r9b
and cl, r11b
xor cl, r9b
mov byte [rax + rdi], cl
mov rdi, qword [rsp + 0x18]
ret
Function at 0x140088f40
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
push r12
push r13
mov eax, 0x48
call fcn.140103e70
sub rsp, rax
mov r12, r9
mov rdi, r8
mov r13, rdx
mov rbx, rcx
call fcn.140034800
cmp eax, 0x72
jne 0x1400890c2
mov rbx, rdi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], r14
and edi, 1
shr rbx, 1
mov qword [rsp + 0x40], r15
lea r14, [rdi + rbx]
call fcn.14005adf0
mov rsi, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x98]
mov r15, qword [rsp + 0x90]
mov qword [rsp + 0x30], rsi
mov rcx, rax
mov r9, r12
mov r8, r14
mov rdx, r13
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r15
call fcn.140088cc0
test eax, eax
je 0x140089015
lea rdx, str.....Srcopenssl_1.1.1hcryptokdf_tls1_prf.c
mov r8d, 0x104
mov rcx, rsi
mov qword [rsp + 0x70], rbp
call fcn.1400469d0
mov rbp, rax
test rax, rax
jne 0x140089032
lea r9, str.....Srcopenssl_1.1.1hcryptokdf_tls1_prf.c
lea edx, [rax + 0x6f]
lea ecx, [rax + 0x34]
lea r8d, [rax + 0x41]
mov dword [rsp + 0x20], 0x105
call fcn.140045670
xor eax, eax
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
add rsp, 0x48
pop r13
pop r12
pop rdi
pop rbx
ret
add rbx, r13
call fcn.14005b3b0
mov qword [rsp + 0x30], rsi
mov r9, r12
mov r8, r14
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], r15
call fcn.140088cc0
test eax, eax
jne 0x14008907a
lea r8, str.....Srcopenssl_1.1.1hcryptokdf_tls1_prf.c
mov r9d, 0x10a
mov rdx, rsi
mov rcx, rbp
call fcn.140046ae0
xor eax, eax
jmp 0x140089010
test rsi, rsi
je 0x1400890a0
mov rdx, rbp
mov rcx, rsi
sub rdx, rdi
nop dword [rax + rax]
movzx eax, byte [rdx + rdi]
inc rdi
xor byte [rdi - 1], al
sub rcx, 1
jne 0x140089090
lea r8, str.....Srcopenssl_1.1.1hcryptokdf_tls1_prf.c
mov r9d, 0x10f
mov rdx, rsi
mov rcx, rbp
call fcn.140046ae0
mov eax, 1
jmp 0x140089010
mov rax, qword [rsp + 0xa0]
mov r9, r12
mov r8, rdi
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x98]
mov rdx, r13
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x90]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140088cc0
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x48
pop r13
pop r12
pop rdi
pop rbx
ret
Function at 0x14008e730
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
mov eax, 0xc0
call fcn.140103e70
sub rsp, rax
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rsi, qword [rsp + 0x118]
mov r13, qword [rsp + 0x128]
mov rbx, rcx
mov ebp, 1
mov rcx, rsi
mov dword [rsp + 0x3c], r9d
mov qword [rsp + 0x48], r8
mov edi, edx
mov dword [rsp + 0x34], ebp
call fcn.140034810
mov dword [rsp + 0x38], eax
test eax, eax
jns 0x14008e795
xor eax, eax
jmp 0x14008e9b1
mov qword [rsp + 0xb8], r12
call fcn.1400e4a80
mov r12, rax
test rax, rax
je 0x14008e9a9
mov qword [rsp + 0xa8], r15
mov r15d, dword [rsp + 0x120]
test rbx, rbx
jne 0x14008e7ce
lea rbx, [0x14010866b]
xor edi, edi
jmp 0x14008e7e5
cmp edi, 0xffffffff
jne 0x14008e7e5
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
mov r9, rsi
mov r8d, edi
mov rdx, rbx
mov rcx, r12
mov qword [rsp + 0x20], 0
call fcn.1400e44e0
test eax, eax
je 0x14008e810
call fcn.1400e4a80
mov rsi, rax
test rax, rax
jne 0x14008e81f
mov rcx, r12
call fcn.1400e4830
xor eax, eax
jmp 0x14008e9a1
mov qword [rsp + 0xb0], r14
test r15d, r15d
je 0x14008e984
mov r14d, dword [rsp + 0x110]
nop dword [rax + rax]
mov eax, dword [rsp + 0x38]
mov edi, r15d
mov rdx, r12
cmp r15d, eax
mov rcx, rsi
mov byte [rsp + 0x33], bpl
cmovg edi, eax
mov eax, ebp
shr eax, 0x18
mov dword [rsp + 0x40], edi
mov byte [rsp + 0x30], al
mov eax, ebp
shr eax, 0x10
mov byte [rsp + 0x31], al
mov eax, ebp
shr eax, 8
mov byte [rsp + 0x32], al
call fcn.1400e4990
test eax, eax
je 0x14008e970
movsxd r8, dword [rsp + 0x3c]
mov rdx, qword [rsp + 0x48]
mov rcx, rsi
call fcn.1400e4750
test eax, eax
je 0x14008e970
lea rdx, [rsp + 0x30]
mov r8d, 4
mov rcx, rsi
call fcn.1400e4750
test eax, eax
je 0x14008e970
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
call fcn.1400e4780
test eax, eax
je 0x14008e970
movsxd rbp, edi
lea rdx, [rsp + 0x50]
mov rcx, r13
mov r8, rbp
call sub.MSVCR90.dll_memcpy
mov ebx, 1
cmp r14d, ebx
jle 0x14008e95b
nop
mov rdx, r12
mov rcx, rsi
call fcn.1400e4990
test eax, eax
je 0x14008e970
movsxd r8, dword [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1400e4750
test eax, eax
je 0x14008e970
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
call fcn.1400e4780
test eax, eax
je 0x14008e970
test rbp, rbp
jle 0x14008e950
lea rdi, [rsp + 0x50]
mov rcx, r13
mov rdx, rbp
sub rdi, r13
nop dword [rax]
movzx eax, byte [rdi + rcx]
inc rcx
xor byte [rcx - 1], al
sub rdx, 1
jne 0x14008e940
inc ebx
cmp ebx, r14d
jl 0x14008e8f0
mov edi, dword [rsp + 0x40]
inc dword [rsp + 0x34]
add r13, rbp
sub r15d, edi
je 0x14008e984
mov ebp, dword [rsp + 0x34]
jmp 0x14008e840
mov rcx, rsi
call fcn.1400e4830
mov rcx, r12
call fcn.1400e4830
xor eax, eax
jmp 0x14008e999
mov rcx, rsi
call fcn.1400e4830
mov rcx, r12
call fcn.1400e4830
mov eax, 1
mov r14, qword [rsp + 0xb0]
mov r15, qword [rsp + 0xa8]
mov r12, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140103060
add rsp, 0xc0
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140095b90
Capabilities:
Hash data using sha512

Disassembly:
push rbx
mov eax, 0x110
call fcn.140103e70
sub rsp, rax
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x100], rax
test r8, r8
movabs rax, 0x6a09e667f3bcc908
lea rbx, [0x14017bd50]
mov qword [rsp + 0x20], rax
cmovne rbx, r8
movabs rax, 0xbb67ae8584caa73b
mov qword [rsp + 0x28], rax
movabs rax, 0x3c6ef372fe94f82b
mov r8, rdx
mov qword [rsp + 0x30], rax
movabs rax, 0xa54ff53a5f1d36f1
mov rdx, rcx
mov qword [rsp + 0x38], rax
movabs rax, 0x510e527fade682d1
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rax
movabs rax, 0x9b05688c2b3e6c1f
mov dword [rsp + 0xf4], 0x40
mov qword [rsp + 0x48], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsp + 0x50], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0xf0], eax
call fcn.140095a60
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140095220
lea rcx, [rsp + 0x20]
mov edx, 0xd8
call fcn.140055e30
mov rax, rbx
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140103060
add rsp, 0x110
pop rbx
ret