joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140053cf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
sub rsp, 0xcc8
mov r9d, dword [rcx + 0x38]
lea rax, [rsp + 0xce0]
mov rdx, qword [rcx + 0x18]
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
xor ebx, ebx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov dword [rsp + 0x28], send
mov qword [rsp + 0x20], rax
lea r8d, [rbx + 0x32]
call fcn.140007ed0
cmp eax, 3
je 0x140053f62
lea edx, [rbx + 0x2a]
mov qword [rsp + 0xce8], rbp
xor ecx, ecx
lea r9d, [rbx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
je 0x140053f4d
mov qword [rsp + 0xcf0], rdi
mov qword [rsp + 0xcf8], r12
mov qword [rsp + 0xcc0], r13
mov qword [rsp + 0xcb8], r14
mov qword [rsp + 0xcb0], r15
cmp qword [rsi + 0x28], rbx
jne 0x140053d9a
mov qword [rsi + 0x28], rax
mov rdx, qword [rsi + 8]
mov r13d, 0x80000000
mov rcx, qword [rsi + 0x10]
mov rax, rdx
sub rax, rcx
mov rdi, rcx
sub rdi, rdx
mov r14d, 5
cmp rcx, rdx
mov r8d, r14d
mov r12d, send
cmovbe rdi, rax
cmp rdi, r13
mov edi, dword [rsp + 0xce0]
cmovae r8d, r12d
xor edx, edx
test edi, edi
je 0x140053dfb
nop
cmp ebx, r8d
jge 0x140053dfb
mov eax, edx
inc edx
imul rcx, rax, 0xd0
add ebx, dword [rsp + rcx + 0x140]
cmp edx, edi
jb 0x140053de0
mov rdx, qword [rsi + 0x18]
mov rcx, rbp
movsxd r15, ebx
mov r8, r15
call fcn.140174ce0
mov rdx, qword [rsi + 0x28]
mov rdi, qword [rsi + 0x10]
mov rcx, rdx
sub rcx, rdi
mov rax, rdi
sub rax, rdx
cmp rdx, rdi
lea r9, [r15 + rdx]
lea r8, [r15 + rdi]
mov edx, r14d
cmovbe rcx, rax
mov rax, r8
cmp rcx, r13
mov rcx, r9
cmovae edx, r12d
sub rax, r9
sub rcx, r8
cmp r9, r8
cmovbe rcx, rax
cmp rcx, r13
jae 0x140053e6c
sub r8d, r9d
mov eax, r14d
sub r8d, r14d
mov byte [rsp + 0x40], 0xe9
mov dword [rsp + 0x41], r8d
lea rdi, [rsp + 0x45]
jmp 0x140053e88
mov eax, r12d
lea rdi, [rsp + 0x4e]
mov word [rsp + 0x40], 0x25ff
mov dword [rsp + 0x42], 0
mov qword [rsp + 0x46], r8
mov r8d, edx
cmp eax, edx
jae 0x140053e9c
mov ecx, r8d
sub rcx, rax
mov eax, 0xcc
rep stosb byte [rdi], al
lea rcx, [r15 + rbp]
lea rdx, [rsp + 0x40]
call fcn.140174ce0
mov r9, qword [rsi + 0x10]
lea rax, [rsp + 0x80]
mov r8d, ebx
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, rbp
call fcn.140054010
mov r15, qword [rsp + 0xcb0]
test eax, eax
jne 0x140053f37
mov r8, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x28]
mov rcx, r8
sub rcx, rdx
mov qword [rsi + 0x20], rbp
mov rdi, rdx
mov dword [rsi + 0x30], ebx
sub rdi, r8
cmp rdx, r8
cmovbe rdi, rcx
cmp rdi, r13
cmovae r14d, r12d
add r14d, ebx
mov dword [rsi + 0x34], r14d
mov r13, qword [rsp + 0xcc0]
mov r12, qword [rsp + 0xcf8]
mov rdi, qword [rsp + 0xcf0]
mov r14, qword [rsp + 0xcb8]
mov rbp, qword [rsp + 0xce8]
add rsp, 0xcc8
pop rsi
pop rbx
ret
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
or eax, 0xffffffff
jmp 0x140053f05
or eax, 0xffffffff
mov rbp, qword [rsp + 0xce8]
add rsp, 0xcc8
pop rsi
pop rbx
ret
or eax, 0xffffffff
add rsp, 0xcc8
pop rsi
pop rbx
ret
Function at 0x140055b40
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r15
mov rdi, r9
mov rsi, r8
mov r15, rdx
test rcx, rcx
je 0x140055b92
cmp qword [rcx], 0
je 0x140055b92
cmp dword [rcx + 8], 0x40
jb 0x140055b92
xor r9d, r9d
test r8, r8
je 0x140055b6d
mov qword [r8], r9
test rdi, rdi
je 0x140055b75
mov qword [rdi], r9
mov r10, qword [rsp + 0x38]
test r10, r10
je 0x140055b82
mov qword [r10], r9
mov rax, qword [rcx]
mov edx, dword [rcx + 8]
mov ecx, 0x5a4d
cmp word [rax], cx
je 0x140055b9e
or eax, 0xffffffff
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret
movsxd r8, dword [rax + 0x3c]
lea ecx, [r8 + 0x14]
cmp ecx, edx
ja 0x140055b92
add ecx, 0x18
mov qword [rsp + 0x18], rbx
lea rbx, [rax + r8]
cmp ecx, edx
ja 0x140055cb0
cmp dword [rbx], 0x4550
jne 0x140055cb0
mov qword [rsp + 0x20], rbp
mov r8d, 0xe0
movzx ebp, word [rbx + 0x14]
mov qword [rsp + 0x28], r14
movzx eax, bp
sub ax, r8w
lea r14, [rbx + 4]
mov r8d, 0xffef
test r8w, ax
jne 0x140055cab
movzx eax, bp
add ecx, eax
cmp ecx, edx
ja 0x140055cab
movzx eax, word [rbx + 0x18]
lea r8, [rbx + 0x18]
mov r11d, 0x10b
sub ax, r11w
mov r11d, 0xfeff
test r11w, ax
jne 0x140055cab
movzx r11d, word [r14 + 2]
lea eax, [r11 + r11*4]
lea ecx, [rcx + rax*8]
cmp ecx, edx
ja 0x140055cab
cmp dword [r8 + 0x3c], edx
ja 0x140055cab
movzx ebp, bp
add rbp, r8
test r11d, r11d
je 0x140055c71
lea rcx, [rbp + 0x10]
nop dword [rax]
mov eax, dword [rcx + 4]
add eax, dword [rcx]
cmp eax, edx
ja 0x140055cab
mov eax, dword [rcx - 8]
add eax, dword [rcx - 4]
cmp eax, dword [r8 + 0x38]
ja 0x140055cab
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140055c50
test r15, r15
je 0x140055c79
mov qword [r15], rbx
test rsi, rsi
je 0x140055c81
mov qword [rsi], r14
test rdi, rdi
je 0x140055c89
mov qword [rdi], r8
test r10, r10
je 0x140055c91
mov qword [r10], rbp
xor eax, eax
mov rbp, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret
or eax, 0xffffffff
jmp 0x140055c93
mov rbx, qword [rsp + 0x18]
or eax, 0xffffffff
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret

Function at 0x140055cd0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov ebp, ecx
mov ebx, 0x1000
mov edx, 1
mov ecx, ebx
mov r14, r8
call fcn.140176104
mov rcx, qword [rsi]
mov rdi, rax
test rcx, rcx
je 0x140055d12
call fcn.14017610c
mov qword [rsi], 0
lea r9, [rsp + 0x48]
mov r8d, ebx
mov rdx, rdi
mov ecx, ebp
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, dword [rsp + 0x48]
cmp eax, 0xc0000004
je 0x140055d33
cmp ecx, ebx
jbe 0x140055d47
lea eax, [rcx + rbx*2]
mov rcx, rdi
mov edx, eax
mov ebx, eax
call fcn.14017d424
mov rdi, rax
jmp 0x140055d12
xor eax, eax
test r14, r14
je 0x140055d51
mov dword [r14], ecx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov qword [rsi], rdi
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14005a580
Capabilities:
List tcp connections and listeners

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x14027a2e4]
mov rbx, rcx
mov rcx, qword [rcx]
mov edx, eax
mov dword [rsp + 0x40], eax
call fcn.14017d424
mov r9d, 2
mov dword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rbx], rax
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x20], 5
mov rcx, rax
call sub.IPHLPAPI.DLL_GetExtendedTcpTable
cmp eax, 0x7a
jne 0x14005a63b
mov edx, dword [rsp + 0x40]
mov rcx, qword [rbx]
mov qword [rsp + 0x48], rdi
call fcn.14017d424
mov edx, dword [0x14027a2e4]
mov r9d, 2
cmp edx, dword [rsp + 0x40]
mov rcx, rax
mov dword [rsp + 0x28], 0
cmovb edx, dword [rsp + 0x40]
xor r8d, r8d
mov dword [0x14027a2e4], edx
lea rdx, [rsp + 0x40]
mov qword [rbx], rax
mov dword [rsp + 0x20], 5
call sub.IPHLPAPI.DLL_GetExtendedTcpTable
mov edi, eax
test eax, eax
je 0x14005a634
mov rcx, qword [rbx]
test rcx, rcx
je 0x14005a634
call fcn.14017610c
mov qword [rbx], 0
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret

Function at 0x14005a650
Capabilities:
List udp connections and listeners

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x14027a2e8]
mov rbx, rcx
mov rcx, qword [rcx]
mov edx, eax
mov dword [rsp + 0x40], eax
call fcn.14017d424
mov r9d, 2
mov dword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rbx], rax
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x20], 1
mov rcx, rax
call sub.IPHLPAPI.DLL_GetExtendedUdpTable
cmp eax, 0x7a
jne 0x14005a70b
mov edx, dword [rsp + 0x40]
mov rcx, qword [rbx]
mov qword [rsp + 0x48], rdi
call fcn.14017d424
mov edx, dword [0x14027a2e8]
mov r9d, 2
cmp edx, dword [rsp + 0x40]
mov rcx, rax
mov dword [rsp + 0x28], 0
cmovb edx, dword [rsp + 0x40]
xor r8d, r8d
mov dword [0x14027a2e8], edx
lea rdx, [rsp + 0x40]
mov qword [rbx], rax
mov dword [rsp + 0x20], 1
call sub.IPHLPAPI.DLL_GetExtendedUdpTable
mov edi, eax
test eax, eax
je 0x14005a704
mov rcx, qword [rbx]
test rcx, rcx
je 0x14005a704
call fcn.14017610c
mov qword [rbx], 0
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret

Function at 0x14005f020
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x60]
call fcn.140174b20
mov eax, 1
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
add rsp, 0x20
pop rbx
ret

Function at 0x14005f1c0
Capabilities:
Hash data using sha224

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x70]
call fcn.140174b20
mov eax, 1
mov dword [rbx], 0xc1059ed8
mov dword [rbx + 4], 0x367cd507
mov dword [rbx + 8], 0x3070dd17
mov dword [rbx + 0xc], 0xf70e5939
mov dword [rbx + 0x10], 0xffc00b31
mov dword [rbx + 0x14], 0x68581511
mov dword [rbx + 0x18], 0x64f98fa7
mov dword [rbx + 0x1c], 0xbefa4fa4
mov dword [rbx + 0x6c], 0x1c
add rsp, 0x20
pop rbx
ret
Function at 0x14005f550
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x70]
call fcn.140174b20
mov eax, 1
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov dword [rbx + 0x6c], 0x20
add rsp, 0x20
pop rbx
ret

Function at 0x140060510
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x5c]
call fcn.140174b20
mov eax, 1
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
add rsp, 0x20
pop rbx
ret

Function at 0x14006c6e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14006c720
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
xor ecx, ecx
mov dword [rbx], eax
cmp eax, 0xffffffff
setne cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x14006c870
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x14006e250
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor esi, esi
mov rdi, rcx
mov ebx, esi
lea edx, [rsi + 1]
call fcn.140060190
mov rdx, rax
mov rcx, rdi
mov rbp, rax
call fcn.140060020
mov r14, rax
test rax, rax
je 0x14006e2f1
lea r9d, [rsi + 1]
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14006e2ca
mov rcx, qword [rsp + 0x58]
mov r8, r14
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rbx, rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rbx*8]
mov rdx, rbx
mov rcx, rdi
call fcn.1400600a0
mov rcx, rdi
call fcn.140060240
mov rbx, rax
test rax, rax
jne 0x14006e38d
mov edx, 1
mov rcx, rdi
call fcn.140060190
mov rdx, rax
mov rcx, rdi
mov rbp, rax
call fcn.140060020
mov r14, rax
test rax, rax
je 0x14006e37b
mov r9d, reloc.WS2_32.dll_shutdown
mov dword [rsp + 0x20], 0xf0000040
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14006e35d
mov rcx, qword [rsp + 0x58]
mov r8, r14
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rsi, rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rsi*8]
mov rdx, rsi
mov rcx, rdi
call fcn.1400600a0
mov rcx, rdi
call fcn.140060240
mov rbx, rax
test rbx, rbx
je 0x14006e385
mov rax, rbx
jmp 0x14006e38d
mov rcx, rdi
call fcn.140060240
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x14006e850
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x14006e877
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x14006e860
movzx eax, r9b
ret
Function at 0x14006ea20
Capabilities:
Access the windows event log
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x168
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
test rax, rax
je 0x14006eadd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x14006eadd
mov qword [rsp + 0x160], rsi
lea rbx, [rsp + 0x188]
call fcn.14001fb00
mov r9, qword [rsp + 0x180]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rbx
mov esi, 0x100
xor ebx, ebx
mov r8d, esi
mov rcx, qword [rax]
or rcx, 1
mov qword [rsp + 0x20], rbx
call fcn.14017ba48
or ecx, 0xffffffff
mov qword [rsp + 0x20], rbx
test eax, eax
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x60]
cmovs eax, ecx
mov rcx, rdi
test eax, eax
cmovs eax, esi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rsi, qword [rsp + 0x160]
add rsp, 0x168
pop rdi
pop rbx
ret
lea rbx, [rsp + 0x188]
call fcn.14001fb00
mov r9, qword [rsp + 0x180]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rbx
mov r8d, 0xff
xor ebx, ebx
mov rcx, qword [rax]
or rcx, 1
mov qword [rsp + 0x20], rbx
call fcn.14017ba48
mov byte [rsp + 0x15f], bl
call fcn.14006e8c0
xor ecx, ecx
test eax, eax
jle 0x14006eb9b
lea rdx, str.OpenSSL
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov rdi, rax
test rax, rax
je 0x14006ebb3
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x60]
mov ecx, 1
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov edx, ecx
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov word [rsp + 0x28], cx
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
jne 0x14006eb88
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
add rsp, 0x168
pop rdi
pop rbx
ret
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.OpenSSL:_FATAL
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_MessageBoxA]
add rsp, 0x168
pop rdi
pop rbx
ret

Function at 0x1400712f0
Capabilities:
Get thread local storage value

Disassembly:
lea rcx, [0x14027c0b8]
jmp fcn.14006c6e0

Function at 0x140079100
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
je 0x140079168
movzx eax, byte [rcx]
test al, al
je 0x140079168
mov qword [rsp + 0x30], rsi
mov esi, 0x100
movsx ecx, al
call fcn.1400c32e0
or eax, esi
lea rdi, [rdi + 1]
mov ecx, eax
add esi, 0x100
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
rol ebx, cl
xor ebx, eax
movzx eax, byte [rdi]
test al, al
jne 0x140079125
mov rsi, qword [rsp + 0x30]
mov eax, ebx
shr eax, 0x10
xor eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400aa990
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rsi, r8d
mov rbx, rdx
mov r8, rsi
mov rbp, rcx
call fcn.140175340
test eax, eax
jle case.0x1400aaa69.2
xor r8d, r8d
test esi, esi
jle 0x1400aa9e9
mov rdx, rbp
mov rcx, rbx
sub rdx, rbx
nop dword [rax]
movzx eax, byte [rcx]
cmp byte [rdx + rcx], al
jne 0x1400aa9e9
inc rcx
inc r8d
mov rax, rcx
sub rax, rbx
cmp rax, rsi
jl 0x1400aa9d0
lea edx, [rsi - 1]
movsxd rax, edx
test edx, edx
js 0x1400aaa16
mov r9, rbp
lea rcx, [rax + rbx]
sub r9, rbx
nop dword [rax]
cmp byte [rcx + r9], 0
jne 0x1400aaa16
cmp byte [rcx], 0xff
jne 0x1400aaa16
dec edx
dec rcx
cmp rcx, rbx
jns 0x1400aaa00
cmp r8d, edx
jl case.0x1400aaa69.2
jle 0x1400aaa2e
lea eax, [r8*8]
jmp 0x1400aaab0
movsxd rax, r8d
movzx r9d, byte [rax + rbx]
movzx r10d, byte [rax + rbp]
movzx edx, r9b
xor dl, r10b
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x1400aaa69.2
lea r11, [0x140000000]
cdqe
movzx eax, byte [r11 + rax + 0xaaae8]
mov ecx, dword [r11 + rax*4 + 0xaaac8]
add rcx, r11
jmp rcx
mov eax, 7
jmp 0x1400aaa9a
mov eax, 6
jmp 0x1400aaa9a
mov eax, 5
jmp 0x1400aaa9a
mov eax, 4
jmp 0x1400aaa9a
mov eax, 3
jmp 0x1400aaa9a
mov eax, 2
jmp 0x1400aaa9a
mov eax, 1
test dl, r10b
jne case.0x1400aaa69.2
and r9b, dl
cmp r9b, dl
jne case.0x1400aaa69.2
lea eax, [rax + r8*8]
jmp 0x1400aaab0
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400bc060
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov r10, rdx
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
add rdx, 0xf
lea rax, [r8 + 0xf]
mov r11, rcx
cmp r10, rax
ja 0x1400bc087
xor r9d, r9d
cmp rdx, r8
jae 0x1400bc0a0
movdqu xmm1, xmmword [r10]
movdqu xmm0, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [r10], xmm1
mov r9d, reloc.WS2_32.dll_recv
cmp r9, 0x10
jae 0x1400bc0d1
sub r8, r10
lea rax, [r9 + r10]
mov edx, reloc.WS2_32.dll_recv
sub rdx, r9
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400bc0c0
mov rcx, qword [r11 + 8]
lea r8, [rsp + 0x40]
mov r9, r10
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rdx, r10
call fcn.140062000
test eax, eax
je 0x1400bc102
cmp dword [rsp + 0x40], 0x10
jne 0x1400bc102
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret

Function at 0x1400bc2a0
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x1400bc328
test r8, r8
je 0x1400bc328
mov rax, qword [rcx + 0x18]
cmp r8, rax
mov r9, rax
cmovb r9, r8
test r9, r9
je 0x1400bc2e6
add rcx, 0x20
mov r11, rdx
sub r11, r10
nop
movzx eax, byte [r11 + rcx - 0x20]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x1400bc2d0
mov rax, qword [r10 + 0x18]
cmp r8, rax
jbe 0x1400bc328
sub r8, rax
mov eax, reloc.WS2_32.dll_recv
cmp r8, rax
cmova r8, rax
xor ecx, ecx
test r8, r8
je 0x1400bc328
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + 0x18]
add rax, rcx
movzx eax, byte [rax + rdx]
xor byte [r10 + rcx + 0x40], al
inc rcx
cmp rcx, r8
jb 0x1400bc310
ret
Function at 0x1400c5100
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
mov rcx, rdx
call fcn.1400c3ce0
test eax, eax
je 0x1400c5134
mov rcx, rbx
call fcn.1400c4280
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rbp
mov ebp, dword [rsi + 8]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r14
mov r14, qword [rsi]
lea eax, [rbp - 1]
movsxd rdi, eax
xor eax, eax
mov rcx, qword [r14 + rdi*8]
cmp rcx, 1
sete al
sub ebp, eax
cmp rsi, rbx
je 0x1400c517c
mov edx, ebp
mov rcx, rbx
call fcn.1400c46f0
test rax, rax
je 0x1400c51ed
mov eax, dword [rsi + 0x10]
mov dword [rbx + 0x10], eax
mov rcx, qword [r14 + rdi*8]
mov rax, qword [rbx]
mov rdx, rcx
xor rdx, 1
inc rdx
neg rdx
shl rdx, 0x3f
lea r8, [rax + rdi*8]
shr rcx, 1
je 0x1400c519c
mov qword [r8], rcx
test rdi, rdi
jle 0x1400c51de
sub r14, rax
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [r14 + r8 - 8]
lea r8, [r8 - 8]
mov rax, rcx
dec rdi
shr rax, 1
or rax, rdx
mov rdx, rcx
xor rdx, 1
mov qword [r8], rax
inc rdx
neg rdx
shl rdx, 0x3f
test rdi, rdi
jg 0x1400c51b0
mov dword [rbx + 8], ebp
test ebp, ebp
jne 0x1400c51e8
mov dword [rbx + 0x10], ebp
mov eax, 1
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x1400d0090
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
push r12
push r15
sub rsp, 0x48
mov r15, r9
mov rbx, r8
mov r12, rdx
mov rdi, rcx
call fcn.140061880
cmp eax, 0x72
jne 0x1400d02b3
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x40], r14
mov r14, rbx
shr r14, 1
and ebx, 1
lea r13, [rbx + r14]
call fcn.1400b3520
mov rdi, qword [rsp + 0xa0]
mov rcx, rax
mov rax, qword [rsp + 0x90]
mov r9, r15
mov rbp, qword [rsp + 0x98]
mov r8, r13
mov qword [rsp + 0x30], rdi
mov rdx, r12
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.1400cfe00
test eax, eax
je 0x1400d015c
mov r8d, 0x104
mov qword [rsp + 0x78], rsi
lea rdx, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_kdf_tls1_prf.c
mov rcx, rdi
call fcn.14006c900
mov rsi, rax
test rax, rax
jne 0x1400d0179
lea r9, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_kdf_tls1_prf.c
mov dword [rsp + 0x20], 0x105
lea edx, [rax + 0x6f]
lea ecx, [rax + 0x34]
lea r8d, [rax + 0x41]
call fcn.14006c2b0
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov r13, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x70]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rbx
ret
lea rbx, [r14 + r12]
call fcn.1400b3be0
mov rcx, rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x90]
mov r9, r15
mov qword [rsp + 0x28], rsi
mov r8, r13
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400cfe00
test eax, eax
jne 0x1400d01c8
mov r9d, 0x10a
lea r8, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_kdf_tls1_prf.c
mov rdx, rdi
mov rcx, rsi
call fcn.14006ca20
jmp 0x1400d0155
xor ecx, ecx
test rdi, rdi
je 0x1400d0291
cmp rdi, 0x40
jb 0x1400d026b
lea rdx, [rbp - 1]
lea rax, [rdi - 1]
add rdx, rdi
add rax, rsi
cmp rbp, rax
ja 0x1400d01f5
cmp rdx, rsi
jae 0x1400d026b
mov r8, rdi
and r8, 0xffffffffffffffc0
mov rdx, rsi
mov rax, rbp
sub rdx, rbp
nop word [rax + rax]
movdqu xmm0, xmmword [rax]
add rcx, 0x40
movdqu xmm1, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x40], xmm1
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rdx + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm1, xmmword [rdx + rax - 0x10]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x10], xmm1
cmp rcx, r8
jb 0x1400d0210
cmp rcx, rdi
jae 0x1400d0291
mov r8, rsi
lea rax, [rcx + rbp]
sub r8, rbp
mov rdx, rdi
sub rdx, rcx
movzx ecx, byte [rax + r8]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400d0280
mov r9d, 0x10f
lea r8, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_kdf_tls1_prf.c
mov rdx, rdi
mov rcx, rsi
call fcn.14006ca20
mov eax, 1
jmp 0x1400d0157
mov rax, qword [rsp + 0xa0]
mov r9, r15
mov qword [rsp + 0x30], rax
mov r8, rbx
mov rax, qword [rsp + 0x98]
mov rdx, r12
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
call fcn.1400cfe00
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rbx
ret