joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a0240
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [r8 + 4]
mov edi, r9d
mov r12, r8
mov r14, rdx
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rbx + 0x50c]
mov r13d, eax
cmp ecx, eax
jne 0x1400a03de
test byte [rbx + 0x726], 1
mov r9d, dword [rbx + 0x56c]
mov qword [rsp + 0x40], rbp
mov dword [rbx + 0x570], r9d
mov qword [rsp + 0x48], rsi
jne 0x1400a02ab
mov dword [rbx + 0x56c], 2
jmp 0x1400a03ba
test edi, edi
je 0x1400a02be
mov dword [rbx + 0x56c], 2
jmp 0x1400a03ba
cmp byte [rbx + 0x735], 0
jne 0x1400a03b0
movzx ecx, word [r12 + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx r11d, ax
sub r11, 8
shr r11, 1
test r11d, r11d
je 0x1400a036c
xor edi, edi
movsxd rsi, r11d
test r11d, r11d
jle 0x1400a0323
lea rbp, [r12 + 8]
nop word [rax + rax]
movzx ecx, word [rbp]
call qword [sym.imp.WS2_32.dll_ntohs]
cmp ax, word [rbx + 0x6e2]
jae 0x1400a0360
inc rdi
mov word [rbp], ax
add rbp, 2
cmp rdi, rsi
jl 0x1400a0300
test rsi, rsi
jle 0x1400a03a4
lea rcx, [r12 + 8]
nop dword [rax]
movzx eax, word [rcx]
lea rdx, [rax + rax*8]
mov rax, qword [rbx + 0x3c0]
cmp byte [rax + rdx*8 + 0x47], 2
jne 0x1400a034a
mov byte [rax + rdx*8 + 0x47], 3
add rcx, 2
sub rsi, 1
jne 0x1400a0330
mov dword [rbx + 0x56c], 1
jmp 0x1400a03ba
mov dword [rbx + 0x56c], 2
jmp 0x1400a03ba
xor edi, edi
cmp di, word [rbx + 0x6e2]
jae 0x1400a03a4
mov rcx, rdi
nop word [rax + rax]
mov rax, qword [rbx + 0x3c0]
cmp byte [rax + rcx + 0x47], 2
jne 0x1400a0393
mov byte [rax + rcx + 0x47], 3
movzx eax, word [rbx + 0x6e2]
inc edi
add rcx, 0x48
cmp edi, eax
jl 0x1400a0380
mov dword [rbx + 0x56c], 1
jmp 0x1400a03ba
mov dword [rbx + 0x56c], 4
mov r8d, dword [rbx + 0x56c]
mov edx, r13d
mov rcx, r14
call fcn.1400b5540
inc dword [rbx + 0x50c]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
jmp 0x1400a0411
lea eax, [rcx - 1]
cmp eax, r13d
jne 0x1400a03ef
mov r8d, dword [rbx + 0x56c]
jmp 0x1400a0406
lea eax, [rcx - 2]
cmp eax, r13d
jne 0x1400a0400
mov r8d, dword [rbx + 0x570]
jmp 0x1400a0406
mov r8d, 5
mov edx, r13d
mov rcx, r14
call fcn.1400b5540
xor edx, edx
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
jmp fcn.1400b5dd0
Function at 0x1400a4660
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
mov ebx, r8d
sub r8d, r9d
mov r11, rdx
and r8d, 0xfffffff8
mov r10d, ecx
lea rsi, [0x140000000]
sub ebx, r8d
sub ebx, r9d
test r9d, r9d
je 0x1400a46b4
mov r9d, r9d
nop dword [rax + rax]
movzx ecx, byte [r11]
mov eax, r10d
inc r11
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r10d, dword [rsi + rdx*4 + 0x28d580]
xor r10d, eax
sub r9, 1
jne 0x1400a4690
shr r8d, 3
test r8d, r8d
je 0x1400a4769
mov qword [rsp + 0x10], rdi
mov edi, r8d
nop dword [rax]
xor r10d, dword [r11]
add r11, 8
mov eax, r10d
mov r9d, r10d
shr eax, 0x10
mov r8d, eax
shr rax, 8
movzx edx, al
mov eax, r10d
mov r10d, dword [rsi + rdx*4 + 0x28e580]
mov edx, dword [r11 - 4]
shr rax, 8
movzx ecx, al
movzx eax, r8b
xor r10d, dword [rsi + rcx*4 + 0x28ed80]
xor r10d, dword [rsi + rax*4 + 0x28e980]
movzx eax, r9b
xor r10d, dword [rsi + rax*4 + 0x28f180]
mov eax, edx
shr eax, 0x10
mov r8d, eax
shr rax, 8
movzx ecx, al
movzx eax, dl
mov edx, dword [rsi + rcx*4 + 0x28d580]
xor edx, dword [rsi + rax*4 + 0x28e180]
movzx eax, byte [r11 - 3]
xor edx, dword [rsi + rax*4 + 0x28dd80]
movzx eax, r8b
xor edx, dword [rsi + rax*4 + 0x28d980]
xor r10d, edx
sub rdi, 1
jne 0x1400a46d0
mov rdi, qword [rsp + 0x10]
test ebx, ebx
je 0x1400a4794
mov r8d, ebx
movzx ecx, byte [r11]
mov eax, r10d
inc r11
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r10d, dword [rsi + rdx*4 + 0x28d580]
xor r10d, eax
sub r8, 1
jne 0x1400a4770
mov eax, r10d
mov rbx, qword [rsp + 0x18]
pop rsi
ret

Function at 0x1400a47a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, dword [rcx + 0x38]
or r10d, 0xffffffff
mov rsi, rcx
test edi, edi
jle 0x1400a484d
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
lea rbp, [0x14028f580]
nop dword [rax]
mov eax, dword [rsi + 0x18]
mov r11, qword [rsi + 0x10]
mov ebx, edi
cmp eax, edi
cmovl ebx, eax
cmp ebx, 4
jae 0x1400a4816
test ebx, ebx
je 0x1400a483a
mov r8d, ebx
nop word [rax + rax]
movzx eax, byte [r11]
mov ecx, r10d
inc r11
xor rcx, rax
mov eax, r10d
shr eax, 8
movzx edx, cl
mov r10d, dword [rbp + rdx*4]
xor r10d, eax
sub r8, 1
jne 0x1400a47f0
jmp 0x1400a483a
test ebx, ebx
je 0x1400a483a
mov eax, r11d
mov r9d, 4
mov r8d, ebx
and eax, 3
mov rdx, r11
mov ecx, r10d
sub r9d, eax
call fcn.1400a4660
mov r10d, eax
mov rsi, qword [rsi]
sub edi, ebx
test edi, edi
jg 0x1400a47d0
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
not r10d
mov eax, r10d
add rsp, 0x20
pop rdi
ret
Function at 0x1400b92c0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp qword [0x1402e63f0], 0
jne 0x1400b9363
lea rcx, [0x1402e6388]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1402e6360]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor r11d, r11d
lea rax, [0x1402e63f8]
mov qword [rsp + 0x28], r11
lea r9, [0x1400b9100]
lea r8, [0x140076ad0]
mov edx, 0x1000
xor ecx, ecx
mov qword [0x1402e6400], rax
mov qword [0x1402e63f8], r11
mov dword [rsp + 0x20], r11d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1402e63f0], rax
test rax, rax
jne 0x1400b9359
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400b9359
mov rax, qword [0x1402e6b38]
test rax, rax
je 0x1400b9363
lea rcx, str.ERROR:_Creating_sctp_iterator_thread_failed._n
add rsp, 0x38
jmp rax
mov dword [0x1402e6b24], 1
add rsp, 0x38
ret
Function at 0x1400ba2c0
Capabilities:
Encode data using xor

Disassembly:
mov byte [rcx], 0
movzx eax, word [r8]
mov r10, rcx
cmp eax, 2
je 0x1400ba363
cmp eax, 0x17
jne 0x1400ba36d
mov byte [rcx + 1], 2
cmp rdx, 0x14
jb 0x1400ba36d
cmp r9d, 0x1c
jl 0x1400ba36d
movzx eax, word [r8 + 2]
mov rcx, qword [rsp + 0x28]
lea r9, [r8 + 8]
xor ax, word [rcx]
lea r8, [r9 + 2]
lea rdx, [r10 + 5]
mov word [r10 + 2], ax
mov r10d, 4
sub r9, rcx
nop dword [rax + rax]
movzx eax, byte [r9 + rcx]
add rdx, 4
add rcx, 4
xor al, byte [rcx - 4]
add r8, 4
mov byte [rdx - 5], al
movzx eax, byte [rcx - 3]
xor al, byte [r8 - 5]
mov byte [rdx - 4], al
movzx eax, byte [rcx - 2]
xor al, byte [r8 - 4]
mov byte [rdx - 3], al
movzx eax, byte [rcx - 1]
xor al, byte [r8 - 3]
sub r10, 1
mov byte [rdx - 2], al
jne 0x1400ba320
lea eax, [r10 + 0x14]
ret
mov byte [rcx + 1], 1
cmp rdx, 8
jae 0x1400ba371
or eax, 0xffffffff
ret
cmp r9d, 0x10
jl 0x1400ba36d
movzx eax, word [r8 + 2]
mov rcx, qword [rsp + 0x28]
xor ax, word [rcx]
mov word [r10 + 2], ax
movzx eax, byte [rcx]
xor al, byte [r8 + 4]
mov byte [r10 + 4], al
movzx eax, byte [r8 + 5]
xor al, byte [rcx + 1]
mov byte [r10 + 5], al
movzx eax, byte [r8 + 6]
xor al, byte [rcx + 2]
mov byte [r10 + 6], al
movzx eax, byte [r8 + 7]
xor al, byte [rcx + 3]
mov byte [r10 + 7], al
mov eax, 8
ret

Function at 0x1400bae20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
movzx r10d, byte [rcx + 1]
mov r11, r9
mov rbx, rcx
sub r10d, 1
je 0x1400baed7
cmp r10d, 1
je 0x1400bae4c
mov r9, rdx
mov eax, r9d
mov rbx, qword [rsp + 8]
ret
mov r9d, reloc.WS2_32.dll_sendto
cmp rdx, r9
jb 0x1400baee2
mov eax, reloc.WS2_32.dll_socket
mov dword [r8 + 0x80], 0x1c
lea rdx, [rbx + 5]
mov word [r8], ax
movzx eax, word [rcx + 2]
lea rcx, [r8 + 8]
xor ax, word [r11]
lea r10d, [r9 - 0x10]
mov word [r8 + 2], ax
lea r8, [r11 + 2]
sub r11, rcx
nop
movzx eax, byte [r11 + rcx]
add rcx, 4
add rdx, 4
xor al, byte [rdx - 5]
add r8, 4
mov byte [rcx - 4], al
movzx eax, byte [r8 - 5]
xor al, byte [rdx - 4]
mov byte [rcx - 3], al
movzx eax, byte [rdx - 3]
xor al, byte [r8 - 4]
mov byte [rcx - 2], al
movzx eax, byte [rdx - 2]
xor al, byte [r8 - 3]
sub r10, 1
mov byte [rcx - 1], al
jne 0x1400bae90
mov eax, r9d
mov rbx, qword [rsp + 8]
ret
mov r9d, 8
cmp rdx, r9
jae 0x1400baeeb
or eax, 0xffffffff
mov rbx, qword [rsp + 8]
ret
mov dword [r8 + 0x80], reloc.WS2_32.dll_recv
mov eax, 2
mov word [r8], ax
movzx eax, word [rcx + 2]
xor ax, word [r11]
mov word [r8 + 2], ax
movzx eax, byte [rcx + 4]
xor al, byte [r11]
mov byte [r8 + 4], al
movzx ecx, byte [rcx + 5]
mov eax, r9d
xor cl, byte [r11 + 1]
mov byte [r8 + 5], cl
movzx ecx, byte [rbx + 6]
xor cl, byte [r11 + 2]
mov byte [r8 + 6], cl
movzx ecx, byte [rbx + 7]
mov rbx, qword [rsp + 8]
xor cl, byte [r11 + 3]
mov byte [r8 + 7], cl
ret
Function at 0x1400bc500
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
cmp dword [0x1402e4c60], 0
mov r10, rdx
mov r11, rcx
lea rbx, [0x1402e4c60]
jne 0x1400bc558
xor r8d, r8d
mov r9, rbx
mov eax, r8d
mov ecx, 8
nop dword [rax]
test al, 1
je 0x1400bc53d
shr eax, 1
xor eax, 0xedb88320
jmp 0x1400bc53f
shr eax, 1
sub rcx, 1
jne 0x1400bc530
inc r8d
mov dword [r9], eax
add r9, 4
cmp r8d, 0x100
jb 0x1400bc521
or r8d, 0xffffffff
test rdx, rdx
je 0x1400bc582
movzx eax, byte [r11]
movzx edx, r8b
mov ecx, r8d
xor rdx, rax
shr ecx, 8
inc r11
mov r8d, dword [rbx + rdx*4]
xor r8d, ecx
sub r10, 1
jne 0x1400bc561
mov rbx, qword [rsp + 8]
not r8d
mov eax, r8d
ret

Function at 0x1400bd040
Capabilities:
Authenticate hmac
Encode data using xor
Hash data using sha1

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x1b0
mov rax, qword [0x1402de400]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rdi, qword [rsp + 0x1e8]
mov rbx, r9
test rdx, rdx
je 0x1400bd24a
test rbx, rbx
je 0x1400bd24a
test rdi, rdi
je 0x1400bd24a
xor eax, eax
mov ecx, 0x40
mov qword [r11 - 0x138], rax
mov qword [r11 - 0x130], rax
mov qword [r11 - 0xb8], rax
mov qword [r11 - 0xb0], rax
mov qword [r11 - 0x128], rax
mov qword [r11 - 0x120], rax
mov qword [r11 - 0x118], rax
mov qword [r11 - 0x110], rax
mov qword [r11 - 0x108], rax
mov qword [r11 - 0x100], rax
mov qword [r11 - 0xa8], rax
mov qword [r11 - 0xa0], rax
mov qword [r11 - 0x98], rax
mov qword [r11 - 0x90], rax
mov qword [r11 - 0x88], rax
mov qword [r11 - 0x80], rax
mov rax, qword [rdx]
mov qword [r11 - 0x138], rax
mov rax, qword [rdx + 8]
mov qword [r11 - 0x130], rax
mov eax, dword [rdx + 0x10]
mov dword [rsp + 0x90], eax
mov rax, qword [rdx]
mov qword [r11 - 0xb8], rax
mov rax, qword [rdx + 8]
mov qword [r11 - 0xb0], rax
mov eax, dword [rdx + 0x10]
mov dword [rsp + 0x110], eax
xor eax, eax
nop dword [rax + rax]
xor byte [rsp + rax + 0x80], 0x36
xor byte [rsp + rax + 0x100], 0x5c
inc rax
sub rcx, 1
jne 0x1400bd140
lea r8d, [rcx + 0x60]
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.1401e42d0
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
mov r8d, 0x40
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
mov dword [rsp + 0x30], 0xc3d2e1f0
call fcn.1400113a0
lea rcx, [rsp + 0x20]
mov r8d, 4
mov rdx, rbx
call fcn.1400113a0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x180]
call fcn.1400114d0
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x60]
call fcn.1401e42d0
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x20]
mov r8d, 0x40
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
mov dword [rsp + 0x30], 0xc3d2e1f0
call fcn.1400113a0
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x20]
mov r8d, reloc.WS2_32.dll_sendto
call fcn.1400113a0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400114d0
mov eax, reloc.WS2_32.dll_sendto
jmp 0x1400bd24c
xor eax, eax
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1401e42a0
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x1b0
pop rdi
ret
Function at 0x1400bd570
Capabilities:
Hash data using sha1

Disassembly:
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0xd0
mov rax, qword [0x1402de400]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbp, qword [rsp + 0x120]
mov r14d, r9d
mov rsi, r8
mov rdi, rdx
movzx r13d, cx
test rdx, rdx
je 0x1400bd689
test r8, r8
je 0x1400bd689
test rbp, rbp
je 0x1400bd689
cmp cx, 1
jne 0x1400bd689
cmp dword [rdx], 0x40
jbe 0x1400bd662
xor edx, edx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x100], rbx
lea r8d, [rdx + 0x60]
call fcn.1401e42d0
mov r8d, dword [rdi]
lea rdx, [rdi + 4]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x67452301
mov dword [rsp + 0x44], 0xefcdab89
mov dword [rsp + 0x48], 0x98badcfe
mov dword [rsp + 0x4c], 0x10325476
mov dword [rsp + 0x50], 0xc3d2e1f0
call fcn.1400113a0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xa0]
call fcn.1400114d0
mov rbx, qword [rsp + 0x100]
lea rcx, [rsp + 0xa0]
mov rax, qword [rcx]
mov dword [rdi], reloc.WS2_32.dll_sendto
mov qword [rdi + 4], rax
mov rax, qword [rcx + 8]
mov qword [rdi + 0xc], rax
mov eax, dword [rcx + 0x10]
mov dword [rdi + 0x14], eax
mov r8d, dword [rdi]
mov dword [rsp + 0x30], 0
lea rdx, [rdi + 4]
mov r9, rsi
movzx ecx, r13w
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], r14d
call fcn.1400bd270
jmp 0x1400bd68b
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1401e42a0
add rsp, 0xd0
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c40a9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test rcx, rcx
je 0x1400c42cd
push r12
push r14
sub rsp, 0x58
mov rax, qword [0x1402de400]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r12d, r8d
mov qword [rsp + 0x30], r15
mov r14, rdx
lea r15d, [r12 + r9]
lea rax, [r12 + 4]
cmp rax, r15
ja 0x1400c42b3
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x38], r13
lea r13, [rsp + 0x20]
mov ebp, 4
mov ecx, r12d
mov rsi, rdx
test r12d, r12d
js 0x1400c42a4
test rdx, rdx
je 0x1400c42a4
nop
test ecx, ecx
jle 0x1400c412a
mov eax, dword [rsi + 0x18]
cmp ecx, eax
jl 0x1400c412a
mov rsi, qword [rsi]
sub ecx, eax
test rsi, rsi
jne 0x1400c4110
jmp 0x1400c42a4
test rsi, rsi
je 0x1400c42a4
mov eax, dword [rsi + 0x18]
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x40], rdi
sub eax, ecx
cmp eax, ebp
jl 0x1400c4158
movsxd rbx, ecx
add rbx, qword [rsi + 0x10]
je 0x1400c4297
jmp 0x1400c41a0
test ebp, ebp
jle 0x1400c418d
mov eax, dword [rsi + 0x18]
movsxd rdx, ecx
mov edi, ebp
sub eax, ecx
mov rcx, r13
cmp eax, ebp
cmovl edi, eax
add rdx, qword [rsi + 0x10]
mov r8d, edi
mov ebx, edi
call fcn.1401e3ed0
mov rsi, qword [rsi]
sub ebp, edi
add r13, rbx
xor ecx, ecx
test rsi, rsi
jne 0x1400c4158
jmp 0x1400c4192
test rsi, rsi
jne 0x1400c419a
test ebp, ebp
jg 0x1400c4297
lea rbx, [rsp + 0x20]
nop
movzx ecx, word [rbx]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [rbx + 2]
movzx edi, ax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
add ecx, 3
test ecx, 0xfffffffc
je 0x1400c427a
and ecx, 0xfffffffc
add r12d, ecx
mov eax, r12d
add rax, 4
cmp rax, r15
ja 0x1400c4297
mov ebp, 4
mov ecx, r12d
mov rsi, r14
lea r13, [rsp + 0x20]
test r12d, r12d
js 0x1400c4297
test ecx, ecx
jle 0x1400c4211
mov eax, dword [rsi + 0x18]
cmp ecx, eax
jl 0x1400c4211
mov rsi, qword [rsi]
sub ecx, eax
test rsi, rsi
jne 0x1400c41f7
jmp 0x1400c4297
test rsi, rsi
je 0x1400c4297
mov eax, dword [rsi + 0x18]
sub eax, ecx
cmp eax, ebp
jl 0x1400c4232
movsxd rbx, ecx
add rbx, qword [rsi + 0x10]
jne 0x1400c41a0
jmp 0x1400c4297
test ebp, ebp
jle 0x1400c4267
mov eax, dword [rsi + 0x18]
movsxd rdx, ecx
mov edi, ebp
sub eax, ecx
mov rcx, r13
cmp eax, ebp
cmovl edi, eax
add rdx, qword [rsi + 0x10]
mov r8d, edi
mov ebx, edi
call fcn.1401e3ed0
mov rsi, qword [rsi]
sub ebp, edi
add r13, rbx
xor ecx, ecx
test rsi, rsi
jne 0x1400c4232
jmp 0x1400c426c
test rsi, rsi
jne 0x1400c4270
test ebp, ebp
jg 0x1400c4297
lea rbx, [rsp + 0x20]
jmp 0x1400c41a0
mov r9, qword [0x1402e6b38]
test r9, r9
je 0x1400c4297
lea rcx, str.process_initack_addrs:_bad_len___d__type_xh_n
movzx r8d, di
movzx edx, ax
call r9
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov r13, qword [rsp + 0x38]
mov r15, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401e42a0
add rsp, 0x58
pop r14
pop r12
repz ret
Function at 0x1400d6950
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
test byte [rcx + 0x14], 4
mov eax, dword [rcx + 8]
lea r11d, [rax - 1]
je 0x1400d696a
add rsp, 0x28
jmp fcn.1400d68a0
test eax, eax
jne 0x1400d6973
add rsp, 0x28
ret
mov rcx, qword [rcx]
movsxd rax, r11d
mov rcx, qword [rcx + rax*8]
call fcn.1400d67c0
shl r11d, 6
add eax, r11d
add rsp, 0x28
ret
Function at 0x1400d6e60
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push r12
push r13
sub rsp, 0x50
mov r13d, dword [rcx + 8]
xor ebx, ebx
test byte [rcx + 0x14], 4
mov r12d, r8d
mov rbp, rdx
mov rsi, rcx
lea r11d, [r13 - 1]
je 0x1400d6e95
call fcn.1400d68a0
jmp 0x1400d6eb4
test r13d, r13d
jne 0x1400d6e9e
mov eax, ebx
jmp 0x1400d6eb4
mov rcx, qword [rcx]
movsxd rax, r11d
mov rcx, qword [rcx + rax*8]
call fcn.1400d67c0
shl r11d, 6
add eax, r11d
add eax, 7
mov qword [rsp + 0x98], rdi
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp r12d, 0xffffffff
jne 0x1400d6ed6
mov r12d, eax
jmp 0x1400d700c
cmp r12d, eax
jge 0x1400d700c
mov rax, qword [rsi]
lea rcx, [rsp + 0x28]
mov qword [rcx], rax
mov rax, qword [rsi + 8]
mov qword [rcx + 8], rax
mov rax, qword [rsi + 0x10]
mov qword [rcx + 0x10], rax
movsxd rcx, dword [rsp + 0x30]
mov r13, qword [rsp + 0x28]
test ecx, ecx
jle 0x1400d6f1f
lea rdx, [r13 + rcx*8]
nop dword [rax]
sub rdx, 8
cmp qword [rdx], rbx
jne 0x1400d6f1f
dec ecx
test ecx, ecx
jg 0x1400d6f10
test byte [rsp + 0x3c], 4
lea edi, [rcx - 1]
je 0x1400d6fd5
mov qword [rsp + 0x48], r14
mov r14d, dword [rsp + 0x34]
mov qword [rsp + 0x40], r15
mov r15d, ebx
mov ecx, ebx
test r14d, r14d
jle 0x1400d6fb6
mov ebp, ebx
mov r12d, ebx
nop dword [rax + rax]
mov rcx, qword [r13]
mov eax, r15d
xor eax, edi
lea r11d, [rax - 1]
not eax
shr r11d, 0x1f
shr eax, 0x1f
and r11d, eax
neg r11d
call fcn.1400d67c0
mov ecx, ebp
and eax, r11d
mov edx, r11d
not ecx
not edx
inc r15d
or ebp, r11d
and edx, ecx
add r13, 8
and edx, 0x40
add r12d, edx
add r12d, eax
cmp r15d, r14d
jl 0x1400d6f50
mov rbp, qword [rsp + 0x88]
mov dword [rsp + 0x80], r12d
mov r12d, dword [rsp + 0x90]
mov ecx, dword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
not edi
lea eax, [rdi - 1]
not edi
shr eax, 0x1f
shr edi, 0x1f
and eax, edi
dec eax
and eax, ecx
jmp 0x1400d6fef
test ecx, ecx
jne 0x1400d6fdd
mov eax, ebx
jmp 0x1400d6fef
movsxd rcx, edi
mov rcx, qword [r13 + rcx*8]
call fcn.1400d67c0
shl edi, 6
add eax, edi
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp r12d, eax
jge 0x1400d7008
or eax, 0xffffffff
jmp 0x1400d7096
mov r13d, dword [rsi + 8]
mov eax, dword [rsi + 0xc]
shl eax, 3
movsxd rcx, eax
test eax, eax
jne 0x1400d7026
movsxd rdx, r12d
mov rcx, rbp
call fcn.140137cc0
jmp 0x1400d7093
lea eax, [r13*8]
movsxd r11, r12d
lea rdi, [rcx - 1]
add rbp, r11
movsxd r10, eax
test r12d, r12d
je 0x1400d7093
neg r10
nop word [rax + rax]
mov rdx, qword [rsi]
mov r8, rbx
movzx ecx, bl
shr r8, 3
mov rax, r10
and cl, 7
mov r9, qword [rdx + r8*8]
shr rax, 0x3f
shl cl, 3
neg al
shr r9, cl
dec rbp
and r9b, al
mov rax, rbx
inc r10
sub rax, rdi
mov byte [rbp], r9b
shr rax, 0x3f
add rbx, rax
sub r11, 1
jne 0x1400d7050
mov eax, r12d
mov rdi, qword [rsp + 0x98]
add rsp, 0x50
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400da9a0
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r13
push r15
sub rsp, 0x60
mov esi, dword [rsp + 0xb0]
mov r15, rcx
mov edi, 1
mov ecx, esi
mov r13d, r9d
mov rbx, r8
shl edi, cl
cmp edx, dword [r15 + 0xc]
mov r11d, edx
jg 0x1400da9db
mov rax, r15
jmp 0x1400da9eb
mov rcx, r15
call fcn.1400d6b60
mov r11d, dword [rsp + 0x98]
test rax, rax
jne 0x1400da9fc
add rsp, 0x60
pop r15
pop r13
pop rdi
pop rsi
pop rbx
ret
cmp esi, 3
movsxd r11, r11d
mov qword [rsp + 0xa0], r11
jg 0x1400daa76
xor r10d, r10d
test r11, r11
jle 0x1400dac30
movsxd rsi, edi
shl rsi, 3
nop
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400daa5e
mov r8, rbx
nop dword [rax]
mov ecx, edx
inc edx
add r8, 8
xor ecx, r13d
lea eax, [rcx - 1]
not ecx
shr ecx, 0x1f
shr eax, 0x1f
and ecx, eax
mov rax, qword [r8 - 8]
neg ecx
and ecx, 1
neg rcx
and rcx, rax
or r9, rcx
cmp edx, edi
jl 0x1400daa30
mov rax, qword [r15]
inc r10
add rbx, rsi
cmp r10, r11
mov qword [rax + r10*8 - 8], r9
jl 0x1400daa20
jmp 0x1400dac30
lea ecx, [rsi - 2]
mov edx, r13d
mov r8d, 1
sar edx, cl
shl r8d, cl
mov qword [rsp + 0xa8], rbp
lea ecx, [rdx - 1]
lea eax, [r8 - 1]
mov qword [rsp + 0x50], r14
and r13d, eax
shr ecx, 0x1f
mov eax, edx
not eax
xor r14d, r14d
movsxd rbp, r8d
shr eax, 0x1f
mov qword [rsp + 0x20], r14
and eax, ecx
mov ecx, edx
neg eax
xor ecx, 1
and eax, 1
neg rax
mov qword [rsp + 0x30], rax
lea eax, [rcx - 1]
not ecx
shr ecx, 0x1f
shr eax, 0x1f
and eax, ecx
mov ecx, edx
xor edx, 3
xor ecx, 2
neg eax
and eax, 1
neg rax
mov qword [rsp + 0x38], rax
lea eax, [rcx - 1]
not ecx
shr ecx, 0x1f
shr eax, 0x1f
and eax, ecx
lea ecx, [rdx - 1]
not edx
shr ecx, 0x1f
neg eax
shr edx, 0x1f
and ecx, edx
and eax, 1
neg ecx
neg rax
and ecx, 1
mov qword [rsp + 0x40], rax
neg rcx
mov qword [rsp + 0x28], rcx
test r11, r11
jle 0x1400dac23
movsxd rax, edi
mov qword [rsp + 0x58], r12
shl rax, 3
mov qword [rsp + 0x48], rax
mov rax, r11
nop word [rax + rax]
xor r12d, r12d
xor r11d, r11d
xor r10d, r10d
test rbp, rbp
jle 0x1400dabfb
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r9, rbp
lea rax, [rbp + rbp*2]
shl r9, 4
lea rdi, [rbx + rbp*8]
add r9, rbx
lea rsi, [rbx + rax*8]
nop word [rax + rax]
mov rax, qword [rsi]
mov r8d, r11d
inc r10
and rax, rcx
mov rcx, qword [r9]
mov rdx, qword [rdi]
and rcx, qword [rsp + 0x40]
xor r8d, r13d
and rdx, r14
or rcx, rax
mov rax, qword [rbx + r10*8 - 8]
inc r11d
or rdx, rcx
lea ecx, [r8 - 1]
and rax, r15
shr ecx, 0x1f
or rax, rdx
not r8d
shr r8d, 0x1f
add rsi, 8
add r9, 8
and ecx, r8d
add rdi, 8
neg ecx
and ecx, 1
neg rcx
and rcx, rax
or r12, rcx
cmp r10, rbp
mov rcx, qword [rsp + 0x28]
jl 0x1400dab80
mov r14, qword [rsp + 0x20]
mov r15, qword [rsp + 0x90]
mov rax, qword [rsp + 0xa0]
mov rcx, qword [r15]
add rbx, qword [rsp + 0x48]
inc r14
cmp r14, rax
mov qword [rcx + r14*8 - 8], r12
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x20], r14
jl 0x1400dab40
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0xa8]
mov r14, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x98]
mov eax, 1
mov dword [r15 + 8], ecx
add rsp, 0x60
pop r15
pop r13
pop rdi
pop rsi
pop rbx
ret