joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bc820
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor esi, esi
mov rdi, rcx
mov ebx, esi
lea edx, [rsi + 1]
call fcn.14006dbe0
mov rdx, rax
mov rcx, rdi
mov rbp, rax
call fcn.14006da70
mov r14, rax
test rax, rax
je 0x1400bc8c1
lea r9d, [rsi + 1]
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400bc89a
mov rcx, qword [rsp + 0x58]
mov r8, r14
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rbx, rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rbx*8]
mov rdx, rbx
mov rcx, rdi
call fcn.14006daf0
mov rcx, rdi
call fcn.14006dc90
mov rbx, rax
test rax, rax
jne 0x1400bc95d
mov edx, 1
mov rcx, rdi
call fcn.14006dbe0
mov rdx, rax
mov rcx, rdi
mov rbp, rax
call fcn.14006da70
mov r14, rax
test rax, rax
je 0x1400bc94b
mov r9d, reloc.WS2_32.dll_shutdown
mov dword [rsp + 0x20], 0xf0000040
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400bc92d
mov rcx, qword [rsp + 0x58]
mov r8, r14
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rsi, rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rsi*8]
mov rdx, rsi
mov rcx, rdi
call fcn.14006daf0
mov rcx, rdi
call fcn.14006dc90
mov rbx, rax
test rbx, rbx
je 0x1400bc955
mov rax, rbx
jmp 0x1400bc95d
mov rcx, rdi
call fcn.14006dc90
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x1400bce10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov r10, rdx
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
add rdx, 0xf
lea rax, [r8 + 0xf]
mov r11, rcx
cmp r10, rax
ja 0x1400bce37
xor r9d, r9d
cmp rdx, r8
jae 0x1400bce50
movdqu xmm1, xmmword [r10]
movdqu xmm0, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [r10], xmm1
mov r9d, reloc.WS2_32.dll_recv
cmp r9, 0x10
jae 0x1400bce81
sub r8, r10
lea rax, [r9 + r10]
mov edx, reloc.WS2_32.dll_recv
sub rdx, r9
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400bce70
mov rcx, qword [r11 + 8]
lea r8, [rsp + 0x40]
mov r9, r10
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rdx, r10
call fcn.1400613d0
test eax, eax
je 0x1400bceb2
cmp dword [rsp + 0x40], 0x10
jne 0x1400bceb2
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret
Function at 0x1400bd050
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x1400bd0d8
test r8, r8
je 0x1400bd0d8
mov rax, qword [rcx + 0x18]
cmp r8, rax
mov r9, rax
cmovb r9, r8
test r9, r9
je 0x1400bd096
add rcx, 0x20
mov r11, rdx
sub r11, r10
nop
movzx eax, byte [r11 + rcx - 0x20]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x1400bd080
mov rax, qword [r10 + 0x18]
cmp r8, rax
jbe 0x1400bd0d8
sub r8, rax
mov eax, reloc.WS2_32.dll_recv
cmp r8, rax
cmova r8, rax
xor ecx, ecx
test r8, r8
je 0x1400bd0d8
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + 0x18]
add rax, rcx
movzx eax, byte [rax + rdx]
xor byte [r10 + rcx + 0x40], al
inc rcx
cmp rcx, r8
jb 0x1400bd0c0
ret
Function at 0x1400c5a70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
mov rcx, rdx
call fcn.1400c4650
test eax, eax
je 0x1400c5aa4
mov rcx, rbx
call fcn.1400c4bf0
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rbp
mov ebp, dword [rsi + 8]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r14
mov r14, qword [rsi]
lea eax, [rbp - 1]
movsxd rdi, eax
xor eax, eax
mov rcx, qword [r14 + rdi*8]
cmp rcx, 1
sete al
sub ebp, eax
cmp rsi, rbx
je 0x1400c5aec
mov edx, ebp
mov rcx, rbx
call fcn.1400c5060
test rax, rax
je 0x1400c5b5d
mov eax, dword [rsi + 0x10]
mov dword [rbx + 0x10], eax
mov rcx, qword [r14 + rdi*8]
mov rax, qword [rbx]
mov rdx, rcx
xor rdx, 1
inc rdx
neg rdx
shl rdx, 0x3f
lea r8, [rax + rdi*8]
shr rcx, 1
je 0x1400c5b0c
mov qword [r8], rcx
test rdi, rdi
jle 0x1400c5b4e
sub r14, rax
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [r14 + r8 - 8]
lea r8, [r8 - 8]
mov rax, rcx
dec rdi
shr rax, 1
or rax, rdx
mov rdx, rcx
xor rdx, 1
mov qword [r8], rax
inc rdx
neg rdx
shl rdx, 0x3f
test rdi, rdi
jg 0x1400c5b20
mov dword [rbx + 8], ebp
test ebp, ebp
jne 0x1400c5b58
mov dword [rbx + 0x10], ebp
mov eax, 1
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x1400d0a00
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
push r12
push r15
sub rsp, 0x48
mov r15, r9
mov rbx, r8
mov r12, rdx
mov rdi, rcx
call fcn.1400608b0
cmp eax, 0x72
jne 0x1400d0c23
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x40], r14
mov r14, rbx
shr r14, 1
and ebx, 1
lea r13, [rbx + r14]
call fcn.140061cb0
mov rdi, qword [rsp + 0xa0]
mov rcx, rax
mov rax, qword [rsp + 0x90]
mov r9, r15
mov rbp, qword [rsp + 0x98]
mov r8, r13
mov qword [rsp + 0x30], rdi
mov rdx, r12
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.1400d0770
test eax, eax
je 0x1400d0acc
mov r8d, 0x104
mov qword [rsp + 0x78], rsi
lea rdx, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_kdf_tls1_prf.c
mov rcx, rdi
call fcn.14006c030
mov rsi, rax
test rax, rax
jne 0x1400d0ae9
lea r9, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_kdf_tls1_prf.c
mov dword [rsp + 0x20], 0x105
lea edx, [rax + 0x6f]
lea ecx, [rax + 0x34]
lea r8d, [rax + 0x41]
call fcn.14006b9e0
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov r13, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x70]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rbx
ret
lea rbx, [r14 + r12]
call fcn.1400b4690
mov rcx, rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x90]
mov r9, r15
mov qword [rsp + 0x28], rsi
mov r8, r13
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400d0770
test eax, eax
jne 0x1400d0b38
mov r9d, 0x10a
lea r8, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_kdf_tls1_prf.c
mov rdx, rdi
mov rcx, rsi
call fcn.14006c150
jmp 0x1400d0ac5
xor ecx, ecx
test rdi, rdi
je 0x1400d0c01
cmp rdi, 0x40
jb 0x1400d0bdb
lea rdx, [rbp - 1]
lea rax, [rdi - 1]
add rdx, rdi
add rax, rsi
cmp rbp, rax
ja 0x1400d0b65
cmp rdx, rsi
jae 0x1400d0bdb
mov r8, rdi
and r8, 0xffffffffffffffc0
mov rdx, rsi
mov rax, rbp
sub rdx, rbp
nop word [rax + rax]
movdqu xmm0, xmmword [rax]
add rcx, 0x40
movdqu xmm1, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x40], xmm1
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rdx + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm1, xmmword [rdx + rax - 0x10]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x10], xmm1
cmp rcx, r8
jb 0x1400d0b80
cmp rcx, rdi
jae 0x1400d0c01
mov r8, rsi
lea rax, [rcx + rbp]
sub r8, rbp
mov rdx, rdi
sub rdx, rcx
movzx ecx, byte [rax + r8]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400d0bf0
mov r9d, 0x10f
lea r8, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_kdf_tls1_prf.c
mov rdx, rdi
mov rcx, rsi
call fcn.14006c150
mov eax, 1
jmp 0x1400d0ac7
mov rax, qword [rsp + 0xa0]
mov r9, r15
mov qword [rsp + 0x30], rax
mov r8, rbx
mov rax, qword [rsp + 0x98]
mov rdx, r12
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
call fcn.1400d0770
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rbx
ret
Function at 0x1400d8040
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov r10, r8
mov r11, rcx
test r9, r9
jne 0x1400d8078
mov edx, 0xe2
mov dword [rsp + 0x20], 0x9a
lea r9, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_asn1_a_int.c
mov ecx, reloc.WS2_32.dll_listen
lea r8d, [rdx - 4]
call fcn.14006b9e0
xor eax, eax
add rsp, 0x38
ret
movzx r8d, byte [r8]
and r8d, 0x80
test rdx, rdx
je 0x1400d808b
mov dword [rdx], r8d
cmp r9, 1
jne 0x1400d80af
test r11, r11
je 0x1400d80a5
movzx eax, byte [r10]
test r8d, r8d
je 0x1400d80a3
not al
inc al
mov byte [rcx], al
mov eax, 1
add rsp, 0x38
ret
movzx ecx, byte [r10]
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov eax, ebx
test cl, cl
jne 0x1400d80cc
mov eax, 1
mov ebx, eax
jmp 0x1400d817f
cmp cl, 0xff
jne 0x1400d81bd
mov eax, 1
lea rcx, [r9 - 1]
mov edx, ebx
cmp r9, rax
jbe 0x1400d816f
cmp rcx, 8
jb 0x1400d815b
and ecx, 7
mov rdx, r9
sub rdx, rcx
xorps xmm2, xmm2
xorps xmm3, xmm3
nop
movd xmm1, dword [r10 + rax]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm1, xmm2
movdqa xmm2, xmm1
movd xmm1, dword [r10 + rax + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm1, xmm3
movdqa xmm3, xmm1
cmp rax, rdx
jb 0x1400d8100
por xmm2, xmm1
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd edx, xmm2
cmp rax, r9
jae 0x1400d816f
movzx ecx, byte [rax + r10]
inc rax
or edx, ecx
cmp rax, r9
jb 0x1400d8160
test edx, edx
mov eax, ebx
setne al
test edx, edx
setne bl
test edx, edx
je 0x1400d81bd
movzx ecx, byte [r10 + 1]
and ecx, 0x80
cmp r8d, ecx
jne 0x1400d81bd
mov edx, 0xe2
mov dword [rsp + 0x20], 0xbb
lea r9, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_asn1_a_int.c
mov ecx, reloc.WS2_32.dll_listen
lea r8d, [rdx - 5]
call fcn.14006b9e0
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x38
ret
mov ecx, eax
sub r9, rcx
test r11, r11
je 0x1400d8211
neg r8d
mov qword [rsp + 0x30], rdi
lea r8, [rbx + r10]
sbb edi, edi
add r8, r9
movzx edi, dil
mov ecx, edi
and ecx, 1
test r9, r9
je 0x1400d820c
mov rdx, r8
sub rdx, rbx
sub rdx, r10
nop
movzx eax, byte [r8 - 1]
lea r8, [r8 - 1]
dec rdx
xor eax, edi
add ecx, eax
mov byte [rdx + r11], cl
shr ecx, 8
test rdx, rdx
jne 0x1400d81f0
mov rdi, qword [rsp + 0x30]
mov rax, r9
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret

Function at 0x1400d82f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r8d, dword [rcx + 4]
mov r9, rdx
movsxd rdx, dword [rcx]
and r8d, 0x100
mov rcx, qword [rcx + 8]
jmp fcn.1400d8310
Function at 0x1400d8310
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push r14
xor r10d, r10d
xor bl, bl
mov r14, r9
mov rdi, rcx
test rcx, rcx
je 0x1400d8426
test rdx, rdx
je 0x1400d8426
movzx eax, byte [rcx]
test r8d, r8d
jne 0x1400d835a
cmp al, 0x7f
jbe 0x1400d841e
mov r10d, 1
mov eax, r10d
add rax, rdx
jmp 0x1400d842e
mov bl, 0xff
cmp al, 0x80
jbe 0x1400d8371
mov r10d, 1
mov eax, r10d
add rax, rdx
jmp 0x1400d842e
jne 0x1400d841e
mov eax, 1
lea rcx, [rdx - 1]
cmp rdx, rax
jbe 0x1400d840f
cmp rcx, 8
jb 0x1400d83fa
and ecx, 7
mov r8, rdx
sub r8, rcx
xorps xmm3, xmm3
xorps xmm2, xmm2
nop
movd xmm1, dword [rdi + rax]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm1, xmm3
movdqa xmm3, xmm1
movd xmm1, dword [rdi + rax + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm1, xmm2
movdqa xmm2, xmm1
cmp rax, r8
jb 0x1400d83a0
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd r10d, xmm2
cmp rax, rdx
jae 0x1400d840f
nop
movzx ecx, byte [rax + rdi]
inc rax
or r10d, ecx
cmp rax, rdx
jb 0x1400d8400
neg r10d
sbb bl, bl
movzx ebx, bl
mov r10d, ebx
and r10d, 1
mov eax, r10d
add rax, rdx
jmp 0x1400d842e
mov eax, 1
mov rdx, r10
mov qword [rsp + 0x10], rsi
test r14, r14
je 0x1400d8484
mov rsi, qword [r9]
test rsi, rsi
je 0x1400d8484
movzx r8d, bl
lea r11, [rdi + rdx]
and r8d, 1
mov byte [rsi], bl
test rdx, rdx
je 0x1400d8481
mov r9, r11
mov r10d, r10d
sub r9, rdi
add r10, rsi
nop
movzx edx, byte [r11 - 1]
lea r11, [r11 - 1]
dec r9
movzx ecx, bl
xor edx, ecx
add r8d, edx
mov byte [r10 + r9], r8b
shr r8d, 8
test r9, r9
jne 0x1400d8460
add qword [r14], rax
mov rsi, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
pop r14
ret

Function at 0x1400dae70
Capabilities:
Hash data using sha224

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x70]
call fcn.140175020
mov eax, 1
mov dword [rbx], 0xc1059ed8
mov dword [rbx + 4], 0x367cd507
mov dword [rbx + 8], 0x3070dd17
mov dword [rbx + 0xc], 0xf70e5939
mov dword [rbx + 0x10], 0xffc00b31
mov dword [rbx + 0x14], 0x68581511
mov dword [rbx + 0x18], 0x64f98fa7
mov dword [rbx + 0x1c], 0xbefa4fa4
mov dword [rbx + 0x6c], 0x1c
add rsp, 0x20
pop rbx
ret

Function at 0x1400db200
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x70]
call fcn.140175020
mov eax, 1
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov dword [rbx + 0x6c], 0x20
add rsp, 0x20
pop rbx
ret
Function at 0x1400e6b80
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x10], rbx
mov rbx, rdx
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x20], rdi
mov rdi, rcx
test rcx, rcx
je 0x1400e6ccf
test rdx, rdx
je 0x1400e6ccf
call fcn.140176664
mov dword [rax], 0
mov rcx, qword [rdi]
test rcx, rcx
jne 0x1400e6cfa
xor eax, eax
mov rcx, rbx
cmp byte [rbx], al
je 0x1400e6be1
nop
cmp eax, 0x80000000
jae 0x1400e6be1
inc rcx
inc eax
cmp byte [rcx], 0
jne 0x1400e6bd0
mov esi, eax
btr esi, 0x1f
lea rax, [rsi - 1]
cmp rax, 0x7ffffffb
ja 0x1400e6ced
mov ecx, 0x248
call fcn.140181ab8
mov qword [rdi], rax
test rax, rax
jne 0x1400e6c19
call fcn.140176664
mov dword [rax], recv
jmp 0x1400e6cda
xor edx, edx
mov r8d, 0x248
mov rcx, rax
call fcn.140175020
cmp byte [rsi + rbx - 1], 0x2a
je 0x1400e6ca0
lea rax, [rsi + 3]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400e6c47
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140174770
sub rsp, rcx
lea rdx, [rsp + 0x20]
mov rcx, rdx
sub rcx, rbx
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x1400e6c61
movzx eax, byte [rdx + rsi - 1]
cmp al, 0x2f
je 0x1400e6c94
cmp al, 0x5c
je 0x1400e6c94
movzx eax, word [0x1401f1528]
mov word [rdx + rsi], ax
movzx eax, byte [0x1401f152a]
mov byte [rdx + rsi + 2], al
jmp 0x1400e6c9d
mov eax, 0x2a
mov word [rdx + rsi], ax
mov rbx, rdx
mov rdx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, qword [rdi]
mov qword [rcx + 0x140], rax
mov rcx, qword [rdi]
cmp qword [rcx + 0x140], 0xffffffffffffffff
jne 0x1400e6d0e
call fcn.14017668c
mov qword [rdi], 0
call fcn.140176664
mov dword [rax], reloc.WS2_32.dll_shutdown
xor eax, eax
mov rbx, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x18]
mov rdi, qword [rbp + 0x20]
mov rsp, rbp
pop rbp
ret
call fcn.140176664
mov dword [rax], 2
jmp 0x1400e6cda
mov rdx, rcx
mov rcx, qword [rcx + 0x140]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1400e6cda
mov rcx, qword [rdi]
mov r8d, 0xff
lea rdx, [rcx + 0x2c]
add rcx, 0x148
call fcn.140184c10
mov rax, qword [rdi]
mov rbx, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x18]
mov byte [rax + 0x247], 0
mov rax, qword [rdi]
mov rdi, qword [rbp + 0x20]
add rax, 0x148
mov rsp, rbp
pop rbp
ret
Function at 0x1400e8290
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0xa8
mov rax, qword [rdx + 8]
xor esi, esi
mov r15, qword [rdx + 0x10]
sub rax, r8
mov qword [rsp + 0xe8], rax
mov rdi, r8
mov r13, rdx
mov r12, rcx
mov ebp, esi
cmp r15, r8
jb 0x1400e8448
cmp r8, 0x40
ja 0x1400e8448
lea rax, [rsp + 0x20]
mov qword [r11 + 0x20], rbx
neg rax
mov qword [r11 - 0x38], r14
and eax, 0x3f
lea r14, [rsp + 0x20]
add r14, rax
lea rax, [r8 + 0x100]
cmp r15, rax
jbe 0x1400e830e
mov rbp, r15
sub rbp, r8
sub rbp, 0x100
xor edx, edx
mov rcx, r14
mov rbx, rsi
call fcn.140175020
mov r9, rsi
cmp rbp, r15
jae 0x1400e83de
mov rcx, qword [r13 + 0x20]
mov r12, rsi
mov r10, qword [r13 + 8]
mov r11, qword [rsp + 0xe8]
mov qword [rsp + 0xf0], rcx
lea r13, [rcx + r10]
nop word [rax + rax]
add rcx, rbp
mov rax, rbp
xor rax, r11
mov rdx, rcx
sub rdx, r13
xor rdx, r10
lea r8, [rax - 1]
not rax
shr rax, 0x3f
shr r8, 0x3f
and r8, rax
mov rax, rbp
xor rax, r10
neg r8
or rdx, rax
or r12, r8
xor rdx, rbp
and r8, r9
shr rdx, 0x3f
or rbx, r8
neg rdx
inc rbp
and r12, rdx
movzx eax, r12b
and al, byte [rcx]
or byte [r9 + r14], al
inc r9
mov rcx, r9
mov rax, r9
sub rcx, rdi
xor rax, rdi
xor rcx, rdi
or rcx, rax
xor rcx, r9
shr rcx, 0x3f
neg rcx
and r9, rcx
mov rcx, qword [rsp + 0xf0]
cmp rbp, r15
jb 0x1400e8350
mov r12, qword [rsp + 0xe0]
test rdi, rdi
je 0x1400e8422
mov rax, rbx
xor rax, 0x20
movzx eax, byte [rax + r14]
movzx eax, byte [rbx + r14]
inc rbx
mov byte [rsi + r12], al
mov rcx, rbx
sub rcx, rdi
mov rax, rbx
xor rcx, rdi
xor rax, rdi
or rcx, rax
inc rsi
xor rcx, rbx
shr rcx, 0x3f
neg rcx
and rbx, rcx
cmp rsi, rdi
jb 0x1400e83e3
mov r14, qword [rsp + 0xa0]
mov eax, 1
mov rbx, qword [rsp + 0xf8]
add rsp, 0xa8
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8d, 0x612
lea rdx, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_ssl_record_ssl3_record.c
lea rcx, str.Assertion_failed:_rec__orig_len___md_size__md_size___EVP_MAX_MD_SIZE
call fcn.14006c4a0
xor eax, eax
add rsp, 0xa8
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e9670
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rax, qword [rcx + 8]
lea rsi, [r9 + 1]
mov rbx, rdx
mov rdx, qword [rdx + 8]
mov r9, qword [rax + 0xc0]
test byte [r9 + 0x60], 1
je 0x1400e96c2
lea rax, [rsi + r8]
cmp rax, rdx
jbe 0x1400e96ad
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
add qword [rbx + 0x20], r8
sub rdx, r8
add qword [rbx + 0x28], r8
sub qword [rbx + 0x10], r8
mov qword [rbx + 8], rdx
jmp 0x1400e96c7
cmp rsi, rdx
ja 0x1400e96a0
mov rax, qword [rbx + 0x20]
mov rcx, qword [rcx + 0x430]
mov qword [rsp + 0x40], rdi
movzx edi, byte [rax + rdx - 1]
call fcn.140060010
mov rcx, rax
call fcn.1400601f0
mov r8, qword [rbx + 8]
and eax, 0x200000
je 0x1400e9704
sub r8, rdi
mov eax, 1
dec r8
jmp 0x1400e97b6
lea rcx, [rdi + rsi]
mov qword [rsp + 0x38], rbp
mov ebp, 0x100
mov r9, r8
sub r9, rcx
mov rax, r8
xor r9, rcx
xor rax, rcx
or r9, rax
xor r9, r8
shr r9, 0x3f
dec r9
cmp r8, rbp
cmovb rbp, r8
xor r10d, r10d
test rbp, rbp
je 0x1400e978d
mov r11, qword [rbx + 0x20]
mov rsi, rdi
shr rsi, 0x3f
dec r11
add r11, r8
nop
mov rax, r10
lea r11, [r11 - 1]
shr rax, 0x3f
mov rcx, rdi
sub rcx, r10
inc r10
shr rcx, 0x3f
xor cl, al
xor al, sil
or cl, al
movzx eax, byte [r11 + 1]
dec cl
movzx edx, cl
mov rcx, rdi
xor rcx, rax
and rdx, rcx
not rdx
and r9, rdx
cmp r10, rbp
jb 0x1400e9750
mov rbp, qword [rsp + 0x38]
lea rax, [rdi + 1]
not r9
movzx ecx, r9b
dec rcx
shr rcx, 0x3f
neg rcx
and rax, rcx
sub r8, rax
mov eax, ecx
and eax, 1
not ecx
or eax, ecx
mov rdi, qword [rsp + 0x40]
mov qword [rbx + 8], r8
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x1400ee020
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xb0
mov rax, qword [rcx]
xor r14d, r14d
movsxd rdi, r8d
mov rbp, r9
mov rsi, rdx
mov rbx, rcx
mov r13d, r14d
lea r12d, [r14 + 1]
test r9, r9
je 0x1400ee075
cmp r9, rax
je 0x1400ee06d
test rdx, rdx
je 0x1400ee066
test r8d, r8d
jns 0x1400ee06d
xor eax, eax
jmp 0x1400ee278
mov r13d, r12d
mov qword [rcx], r9
jmp 0x1400ee07d
test rax, rax
je 0x1400ee066
mov rbp, rax
mov qword [rsp + 0xe0], r15
mov r15, qword [rsp + 0x100]
test rsi, rsi
je 0x1400ee294
mov rcx, rbp
mov r13d, r12d
call fcn.140060780
cmp eax, 0x90
mov r12d, r14d
mov r15d, eax
setle r12b
jle 0x1400ee0cb
mov r8d, 0x29
lea rdx, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_hmac_hmac.c
lea rcx, str.Assertion_failed:_j____int_sizeof_ctx__key_
call fcn.14006c4a0
test r12d, r12d
je 0x1400ee11b
cmp r15d, edi
jge 0x1400ee122
mov r15, qword [rsp + 0x100]
mov rdx, rbp
mov rcx, qword [rbx + 8]
mov r8, r15
call fcn.140075930
test eax, eax
je 0x1400ee11b
mov rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, rsi
call fcn.140075b80
test eax, eax
je 0x1400ee11b
mov rcx, qword [rbx + 8]
lea rsi, [rbx + 0x20]
mov r8, rsi
lea rdx, [rbx + 0x24]
call fcn.140075860
test eax, eax
jne 0x1400ee147
xor eax, eax
jmp 0x1400ee270
cmp edi, 0x90
ja 0x1400ee11b
mov r8, rdi
lea rcx, [rbx + 0x24]
mov rdx, rsi
call fcn.1401757c0
mov r15, qword [rsp + 0x100]
lea rsi, [rbx + 0x20]
mov dword [rsi], edi
mov ecx, dword [rsi]
cmp ecx, 0x90
je 0x1400ee16a
mov eax, ecx
mov r8d, 0x90
sub r8d, ecx
xor edx, edx
lea rcx, [rbx + 0x24]
add rcx, rax
call fcn.140175020
mov r12d, r13d
lea rcx, [rsp + 0x20]
mov rax, rbx
sub rax, rcx
mov rdx, r14
lea rdi, [rax + 0x24]
lea rsi, [rax + 0x25]
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rdi + rcx]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [rsi + rcx]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x90
jl 0x1400ee190
mov rcx, qword [rbx + 0x10]
mov r8, r15
mov rdx, rbp
call fcn.140075930
test eax, eax
je 0x1400ee259
mov rcx, rbp
call fcn.140060780
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.140075b80
test eax, eax
je 0x1400ee259
mov rdx, r14
nop dword [rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rdi + rcx]
xor al, 0x5c
mov byte [rcx], al
movzx eax, byte [rsi + rcx]
xor al, 0x5c
mov byte [rcx + 1], al
cmp rdx, 0x90
jl 0x1400ee1f0
mov rcx, qword [rbx + 0x18]
mov r8, r15
mov rdx, rbp
call fcn.140075930
test eax, eax
je 0x1400ee259
mov rcx, rbp
call fcn.140060780
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.140075b80
test eax, eax
je 0x1400ee259
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
call fcn.140075bc0
test eax, eax
cmovne r14d, r12d
test r13d, r13d
je 0x1400ee26d
mov edx, 0x90
lea rcx, [rsp + 0x20]
call fcn.14006bdc0
mov eax, r14d
mov r15, qword [rsp + 0xe0]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
test r13d, r13d
je 0x1400ee246
jmp 0x1400ee16d