joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012000
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x1401d3b98]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 1
mov rcx, rax
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
cmp dword [0x1401d3ba8], 2
movups xmm0, xmmword [0x1401ba7c8]
movzx eax, word [0x1401ba7f0]
movups xmm1, xmmword [0x1401ba7d8]
mov word [rsp + 0x48], ax
movups xmmword [rsp + 0x20], xmm0
movsd xmm0, qword [0x1401ba7e8]
movsd qword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x30], xmm1
jl 0x1400121fa
movdqa xmm0, xmmword [str.3333333333333333]
lea rcx, [rsp + 0x24]
movdqa xmm5, xmmword [0x1401bba40]
mov eax, 4
movdqa xmm4, xmmword [0x1401bba90]
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm7
movdqa xmm7, xmmword [0x1401bba60]
movd xmm6, eax
mov eax, 0x1f
movaps xmmword [rsp + 0x70], xmm8
movdqa xmmword [rsp + 0x50], xmm0
mov edx, dword [rsp + 0x50]
movd xmm8, eax
nop dword [rax]
nop word [rax + rax]
movd xmm2, ebx
lea eax, [rbx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ebx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
pand xmm2, xmmword [0x1401bba70]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
pxor xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1401bba70]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
pxor xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp ebx, 0x28
jl 0x1400120e0
movaps xmm8, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
cmp ebx, 0x2a
jge 0x14001223d
movsxd rax, ebx
lea r8, [rsp + 0x20]
add r8, rax
nop word [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, bl
inc ebx
sub al, cl
add al, 0x33
xor byte [r8 - 1], al
cmp ebx, 0x2a
jl 0x140012210
lea rcx, [rsp + 0x20]
call fcn.140001dc0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14010fe10
add rsp, 0xa0
pop rbx
ret
Function at 0x1400134f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov edx, 0x3e8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x1400135b5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, rax
test rax, rax
je 0x1400135b5
cmp qword [rbx + 0x18], 0x10
mov rcx, rbx
jb 0x140013546
mov rcx, qword [rbx]
sub rdx, rcx
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140013550
mov rdx, rdi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400135b1
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400135ac
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140013611
mov rcx, r8
call fcn.14010fe30
mov al, 1
jmp 0x1400135f3
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400135f1
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400135ec
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140013611
mov rcx, r8
call fcn.14010fe30
xor al, al
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.14011d47c
int3
Function at 0x140013620
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x98
call fcn.14000fb40
call fcn.14000ff20
movups xmm0, xmmword [0x1401bac20]
movzx eax, word [0x1401bac48]
xor ecx, ecx
cmp dword [0x1401d3ba8], 2
movups xmm1, xmmword [0x1401bac30]
mov word [rsp + 0x58], ax
movups xmmword [rsp + 0x30], xmm0
movsd xmm0, qword [0x1401bac40]
movsd qword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm1
jl 0x1400137e9
movdqa xmm0, xmmword [str.3333333333333333]
lea rdx, [rsp + 0x34]
movdqa xmm5, xmmword [0x1401bba40]
mov eax, 4
movdqa xmm4, xmmword [0x1401bba90]
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm7
movdqa xmm7, xmmword [0x1401bba60]
movd xmm6, eax
mov eax, 0x1f
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x60], xmm8
movd xmm8, eax
nop dword [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
pand xmm2, xmmword [0x1401bba70]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
pxor xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1401bba70]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
pxor xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x28
jl 0x1400136d0
movaps xmm8, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x80]
cmp ecx, 0x2a
jge 0x14001382d
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x33
xor byte [r8 - 1], al
cmp ecx, 0x2a
jl 0x140013800
lea rcx, [rsp + 0x30]
call fcn.1401174ec
add rsp, 0x98
ret
Function at 0x14001dad0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14001daf2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14001db6c
mov rdi, r14
mov rcx, rbx
call fcn.14001f850
test rax, rax
jle 0x14001db44
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.140112040
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14001db5c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14001db64
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14001db06
sub r14, rdi
jmp 0x14001dc59
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14001db83
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001db85
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14001dbba
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140112040
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14001dc56
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x14001dbf5
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x14001dc31
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14011cf68
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x14001dc6f
cmp rbp, rax
ja 0x14001dc01
mov r8, rdi
test rdi, rdi
je 0x14001dc56
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14011cf68
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x14001dc59
Function at 0x14001e080
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1401d3b98]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14001e0ad
xor eax, eax
jmp 0x14001e1f3
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14001e0e7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14001e0e7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14001e1f3
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14001e1e6
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14001e12a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14001e139
movsx ecx, dil
jmp 0x14001e18d
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
je 0x14001e1a7
sub eax, 1
je 0x14001e1a7
cmp eax, 2
jne 0x14001e1e6
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.140116984
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14001e1eb
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14001e1d4
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.14011c398
cmp rsi, rax
jne 0x14001e1e6
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14001e1eb
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14010fe10
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140034030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push rdi
sub rsp, 0x80
mov rax, qword [0x1401d3b98]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, qword [rsp + 0xb0]
xor ebx, ebx
mov qword [r11 - 0x60], rbx
mov rbp, rcx
test rcx, rcx
je 0x14003412f
test r8, r8
je 0x14003412f
test rdi, rdi
je 0x14003412f
movzx eax, byte [r8]
mov byte [rsp + 0x20], al
movzx eax, byte [r8 + 1]
mov byte [rsp + 0x21], al
movzx eax, byte [r8 + 2]
mov byte [rsp + 0x22], al
movzx eax, byte [r8 + 3]
mov byte [rsp + 0x23], al
movzx eax, byte [r8 + 4]
mov byte [rsp + 0x24], al
movzx eax, byte [r8 + 5]
mov byte [rsp + 0x25], al
movzx eax, byte [r8 + 6]
mov byte [rsp + 0x26], al
movzx eax, byte [r8 + 7]
mov qword [r11 + 0x10], rsi
mov esi, ebx
mov byte [rsp + 0x27], al
nop dword [rax + rax]
test bl, 0x3f
jne 0x140034109
mov ecx, ebx
lea r8, [rsp + 0x30]
shr ecx, 6
lea rdx, [rsp + 0x20]
mov eax, ecx
mov byte [rsp + 0x28], cl
shr eax, 8
mov byte [rsp + 0x29], al
mov eax, ecx
shr ecx, 0x18
mov byte [rsp + 0x2b], cl
mov rcx, rbp
shr eax, 0x10
mov byte [rsp + 0x2a], al
call fcn.140033ee0
mov rax, rsi
inc ebx
and eax, 0x3f
inc rsi
movzx eax, byte [rsp + rax + 0x30]
xor byte [rdi], al
inc rdi
cmp ebx, 0x22
jb 0x1400340d0
mov rsi, qword [rsp + 0x98]
xor eax, eax
jmp 0x140034134
mov eax, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14010fe10
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14003a920
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x14003a947
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x14003a930
movzx eax, r9b
ret

Function at 0x14003e5c0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140110a00
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x140041510
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x30
call fcn.140110a00
sub rsp, rax
mov r10, r9
mov rbx, r8
mov r9, qword [rsp + 0xa0]
mov r14, rdx
mov rbp, rcx
mov edi, dword [r9]
mov dword [rsp + 0x80], edi
test edi, edi
je 0x140041588
mov rdx, qword [rsp + 0x98]
nop dword [rax]
test rbx, rbx
je 0x140041581
mov eax, edi
dec rbx
movzx ecx, byte [rax + rdx]
xor cl, byte [rbp]
inc rbp
mov byte [r14], cl
inc r14
inc edi
and edi, 0xf
jne 0x140041560
mov dword [rsp + 0x80], edi
mov r8, qword [rsp + 0x90]
mov esi, 1
movzx r12d, byte [r8 + 0xc]
lea r15, [r8 + 0xc]
mov r11, qword [rsp + 0xa8]
shl r12d, 8
movzx eax, byte [r8 + 0xd]
lea r13d, [rsi + 0xb]
or r12d, eax
movzx eax, byte [r8 + 0xe]
shl r12d, 8
or r12d, eax
movzx eax, byte [r8 + 0xf]
shl r12d, 8
or r12d, eax
cmp rbx, 0x10
jb 0x1400416be
mov eax, 0x10000000
mov edi, r13d
mov qword [rsp + 0x20], r8
mov rdx, rbx
shr rdx, 4
mov r9, r10
cmp rdx, rax
cmova rdx, rax
add r12d, edx
mov r13, rdx
mov eax, r12d
mov ecx, r12d
sub r13, rax
cmp rax, rdx
cmovae r13, rdx
xor r12d, r12d
cmp rax, rdx
mov r8, r13
mov rdx, r14
cmovae r12d, ecx
mov rcx, rbp
call r11
mov r8, qword [rsp + 0x90]
mov eax, r12d
shr eax, 0x18
mov byte [r15], al
mov eax, r12d
shr eax, 0x10
mov byte [r8 + 0xd], al
mov eax, r12d
shr eax, 8
mov byte [r8 + 0xe], al
mov byte [r8 + 0xf], r12b
test r12d, r12d
jne 0x14004167d
mov r8d, edi
mov eax, esi
mov rdx, r15
nop dword [rax + rax]
movzx ecx, byte [rdx - 1]
lea rdx, [rdx - 1]
add eax, ecx
mov byte [rdx], al
shr eax, 8
add r8d, 0xffffffff
jne 0x140041660
mov r8, qword [rsp + 0x90]
mov r10, qword [rsp + 0x88]
mov eax, 0x10000000
mov r11, qword [rsp + 0xa8]
shl r13, 4
sub rbx, r13
add r14, r13
add rbp, r13
cmp rbx, 0x10
jae 0x1400415e0
mov edi, dword [rsp + 0x80]
mov r13d, ntohs
mov r9, qword [rsp + 0xa0]
test rbx, rbx
je 0x140041761
mov rax, qword [rsp + 0x98]
xorps xmm0, xmm0
mov qword [rsp + 0x20], r8
mov r9, r10
mov r8, rsi
mov rdx, rax
mov rcx, rax
movups xmmword [rax], xmm0
call r11
mov rcx, qword [rsp + 0x90]
inc r12d
mov eax, r12d
shr eax, 0x18
mov byte [r15], al
mov eax, r12d
shr eax, 0x10
mov byte [rcx + 0xd], al
mov eax, r12d
shr eax, 8
mov byte [rcx + 0xe], al
mov byte [rcx + 0xf], r12b
test r12d, r12d
jne 0x140041737
nop dword [rax + rax]
movzx eax, byte [r15 - 1]
lea r15, [r15 - 1]
add esi, eax
mov byte [r15], sil
shr esi, 8
add r13d, 0xffffffff
jne 0x140041720
mov rdx, qword [rsp + 0x98]
nop
mov ecx, edi
inc edi
movzx eax, byte [rcx + rbp]
xor al, byte [rcx + rdx]
mov byte [rcx + r14], al
sub rbx, 1
jne 0x140041740
mov rax, qword [rsp + 0xa0]
mov dword [rax], edi
jmp 0x140041764
mov dword [r9], edi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140041ee0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push r14
mov eax, 0x20
call fcn.140110a00
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov rbx, r8
mov r14, rdx
mov rbp, rcx
je 0x140041f10
mov eax, 0xfffffffe
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov rcx, qword [rcx + 0x30]
movabs rax, 0x2000000000000000
add rcx, rbx
cmp rcx, rax
ja 0x140042002
cmp rcx, rbx
jb 0x140042002
mov qword [rsp + 0x40], rsi
mov esi, dword [rbp + 0x174]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
mov qword [rbp + 0x30], rcx
test esi, esi
je 0x140041f85
test rbx, rbx
je 0x140041fe2
movzx eax, byte [r14]
dec rbx
mov ecx, esi
inc r14
xor byte [rcx + rbp + 0x40], al
inc esi
and esi, 0xf
jne 0x140041f50
lea r12, [rbp + 0x60]
lea rdi, [rbp + 0x40]
mov rdx, r12
mov rcx, rdi
call fcn.140043590
jmp 0x140041f8d
lea r12, [rbp + 0x60]
lea rdi, [rbp + 0x40]
mov qword [rsp + 0x58], r15
mov r15, rbx
and r15, 0xfffffffffffffff0
je 0x140041fb2
mov r9, r15
mov r8, r14
mov rdx, r12
mov rcx, rdi
call fcn.1400433d0
add r14, r15
sub rbx, r15
mov r15, qword [rsp + 0x58]
test rbx, rbx
je 0x140041fe2
mov esi, ebx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r14 + rdi - 0x40]
xor byte [rdi], al
lea rdi, [rdi + 1]
sub rbx, 1
jne 0x140041fd0
mov rdi, qword [rsp + 0x48]
xor eax, eax
mov r12, qword [rsp + 0x50]
mov dword [rbp + 0x174], esi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov eax, 0xffffffff
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
Function at 0x1400433d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
movzx r10d, byte [rcx + 0xf]
lea rbp, [r8 + 0xe]
mov rdi, rcx
lea r12, [0x1401473c0]
sub rdi, r8
mov r15, r9
mov rsi, rdx
mov r11, rcx
nop dword [rax]
movzx ecx, byte [rbp + 1]
mov rbx, rbp
movzx eax, r10b
mov r14d, reloc.WS2_32.dll_ntohs
xor rcx, rax
mov rdx, rcx
and ecx, 0xf
add rcx, rcx
and rdx, 0xfffffffffffffff0
mov r8, qword [rsi + rcx*8]
mov r10, qword [rsi + rcx*8 + 8]
mov rax, r8
mov rcx, r10
shr rax, 4
and ecx, 0xf
shr r10, 4
shl r8, 0x3c
or r10, r8
xor rax, qword [r12 + rcx*8]
xor rax, qword [rdx + rsi]
xor r10, qword [rdx + rsi + 8]
nop
movzx ecx, byte [rbx]
mov r9, rax
movzx edx, byte [rdi + rbx]
lea rbx, [rbx - 1]
xor rdx, rcx
shl rax, 0x3c
mov rcx, r10
shr r9, 4
shr r10, 4
mov r8, rdx
or rax, r10
and edx, 0xf
add rdx, rdx
and ecx, 0xf
and r8, 0xfffffffffffffff0
xor rax, qword [rsi + rdx*8 + 8]
xor r9, qword [r12 + rcx*8]
mov rcx, rax
xor r9, qword [rsi + rdx*8]
and ecx, 0xf
mov rdx, rax
mov r10, r9
shl r10, 0x3c
mov rax, r9
shr rax, 4
xor rax, qword [r12 + rcx*8]
xor rax, qword [r8 + rsi]
shr rdx, 4
or r10, rdx
xor r10, qword [r8 + rsi + 8]
sub r14, 1
jne 0x140043460
mov rdx, rax
mov byte [r11 + 7], al
shr rdx, 0x20
add rbp, 0x10
mov ecx, edx
mov byte [r11 + 3], dl
shr ecx, 0x18
sub rdi, 0x10
mov byte [r11], cl
mov ecx, edx
shr ecx, 0x10
mov byte [r11 + 1], cl
mov ecx, edx
shr ecx, 8
mov byte [r11 + 2], cl
mov ecx, eax
shr ecx, 0x18
mov byte [r11 + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [r11 + 5], cl
mov ecx, eax
shr ecx, 8
mov byte [r11 + 6], cl
mov rcx, r10
shr rcx, 0x20
mov eax, ecx
mov byte [r11 + 0xb], cl
shr eax, 0x18
mov byte [r11 + 8], al
mov eax, ecx
shr eax, 0x10
mov byte [r11 + 9], al
mov eax, ecx
shr eax, 8
mov byte [r11 + 0xa], al
mov eax, r10d
shr eax, 0x18
mov byte [r11 + 0xc], al
mov eax, r10d
shr eax, 0x10
mov byte [r11 + 0xd], al
mov eax, r10d
shr eax, 8
mov byte [r11 + 0xe], al
mov byte [r11 + 0xf], r10b
sub r15, 0x10
jne 0x140043410
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x140043590
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movzx eax, byte [rcx + 0xf]
lea rsi, [0x1401473c0]
mov r8d, eax
mov r11, rcx
and eax, 0xf
and r8, 0xfffffffffffffff0
add rax, rax
mov rbx, rdx
mov edi, select
mov r10, qword [rdx + rax*8 + 8]
mov r9, qword [rdx + rax*8]
mov rcx, r10
and ecx, 0xf
shr r10, 4
mov rax, r9
shl r9, 0x3c
shr rax, 4
or r10, r9
xor rax, qword [rsi + rcx*8]
xor rax, qword [r8 + rdx]
xor r10, qword [r8 + rdx + 8]
movzx ecx, byte [rdi + r11]
mov r9, rax
mov r8d, ecx
shl rax, 0x3c
and ecx, 0xf
shr r9, 4
add rcx, rcx
and r8, 0xfffffffffffffff0
lea rdx, [rbx + rcx*8]
mov rcx, r10
shr r10, 4
and ecx, 0xf
or rax, r10
xor rax, qword [rdx + 8]
xor r9, qword [rsi + rcx*8]
mov rcx, rax
xor r9, qword [rdx]
and ecx, 0xf
mov rdx, rax
mov r10, r9
shl r10, 0x3c
mov rax, r9
shr rax, 4
xor rax, qword [rsi + rcx*8]
xor rax, qword [r8 + rbx]
shr rdx, 4
or r10, rdx
xor r10, qword [r8 + rbx + 8]
sub rdi, 1
jns 0x1400435f0
mov rbx, qword [rsp + 8]
mov rdx, rax
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov byte [r11 + 7], al
shr rdx, 0x20
mov ecx, edx
mov byte [r11 + 3], dl
shr ecx, 0x18
mov byte [r11], cl
mov ecx, edx
shr ecx, 0x10
mov byte [r11 + 1], cl
mov ecx, edx
shr ecx, 8
mov byte [r11 + 2], cl
mov ecx, eax
shr ecx, 0x18
mov byte [r11 + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [r11 + 5], cl
mov ecx, eax
shr ecx, 8
mov byte [r11 + 6], cl
mov rcx, r10
shr rcx, 0x20
mov eax, ecx
mov byte [r11 + 0xb], cl
shr eax, 0x18
mov byte [r11 + 8], al
mov eax, ecx
shr eax, 0x10
mov byte [r11 + 9], al
mov eax, ecx
shr eax, 8
mov byte [r11 + 0xa], al
mov eax, r10d
shr eax, 0x18
mov byte [r11 + 0xc], al
mov eax, r10d
shr eax, 0x10
mov byte [r11 + 0xd], al
mov eax, r10d
shr eax, 8
mov byte [r11 + 0xe], al
mov byte [r11 + 0xf], r10b
ret

Function at 0x140046740
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x28
call fcn.140110a00
sub rsp, rax
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x28
jmp fcn.140046b00

Function at 0x140051b70
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140110a00
sub rsp, rax
lea rcx, [0x1401d8d70]
add rsp, 0x28
jmp fcn.14003e420