joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140070a90
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r12
push r13
push r15
sub rsp, 0x28
xor ebp, ebp
mov r13d, r9d
mov r15d, edx
mov r12d, ebp
cmp edx, 1
jl 0x140070bfb
test rcx, rcx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov edi, ebp
mov qword [rsp + 0x20], r14
lea r14, [0x1401a8080]
mov rsi, r14
cmovne rsi, rcx
test r8, r8
cmovne r14, r8
movzx ecx, word [r14]
test cx, cx
je 0x140070b8a
cmp word [r14 + 2], di
je 0x140070b8a
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [r14 + rax*2], di
jne 0x140070b00
mov rbx, rsi
movsxd rbp, eax
mov r8, rbp
mov rdx, r14
mov rcx, rbx
call fcn.14001fb74
test eax, eax
je 0x140070b2e
cmp word [rbx], r12w
je 0x140070b2e
add rbx, 2
jmp 0x140070b10
inc edi
cmp edi, r15d
je 0x140070b44
cmp word [rbx], r12w
je 0x140070b4d
lea rbx, [rbx + rbp*2]
mov rsi, rbx
jmp 0x140070b10
mov r12, rbx
sub r12, rsi
sar r12, 1
xor ebp, ebp
mov rcx, rbx
call fcn.140073330
mov r14, qword [rsp + 0x20]
movsxd rbx, r12d
test eax, eax
je 0x140070bc0
mov ecx, r13d
call fcn.1400733e0
lea r8, [rbx + rbx]
mov rdx, rsi
mov rcx, rax
call fcn.14002e3e0
mov edx, r13d
mov ecx, r12d
call fcn.1400731c0
mov rdi, rax
jmp 0x140070bdc
mov rbx, rsi
nop dword [rax]
movzx eax, word [rbx]
cmp ax, cx
je 0x140070ba3
test ax, ax
je 0x140070ba3
add rbx, 2
jmp 0x140070b90
inc edi
cmp edi, r15d
je 0x140070bb5
test ax, ax
je 0x140070b4f
lea rsi, [rbx + 2]
jmp 0x140070b8a
mov r12, rbx
sub r12, rsi
sar r12, 1
jmp 0x140070b4f
mov edx, r13d
mov ecx, r12d
call fcn.1400731c0
mov r8, rbx
mov rdx, rsi
mov rcx, rax
mov rdi, rax
call fcn.14014c098
mov rsi, qword [rsp + 0x58]
mov word [rdi + rbx*2], bp
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
ret
mov ecx, r13d
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
jmp fcn.1400732a0

Function at 0x140071e70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140212df0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x140071ef1
mov r8, qword [0x140212de8]
lea edx, [rax + 8]
mov rcx, qword [0x140210620]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x140212df0]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [0x140212de0]
jmp 0x140071edd
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x140071eda
mov rcx, qword [rbx + 0x10]
add rcx, rdi
call rdx
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140071ec8
mov rdx, rdi
lea rcx, [0x140071dd4]
call fcn.14000d550
mov rbx, qword [rsp + 0x30]
lea rax, [rdi + rsi]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140071f08
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, ecx
mov rbp, r8
mov rsi, rdx
and ecx, 7
je 0x140071f32
mov eax, 8
sub eax, ecx
add edi, eax
mov rbx, qword [0x140212de8]
test rbx, rbx
jne 0x140071f78
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, qword [0x140210620]
lea edx, [rbx + 8]
movsxd rdi, edi
mov r8, rdi
mov dword [0x140212df0], eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x140212df0]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [0x140212de8]
jmp 0x140071f7b
movsxd rdi, edi
mov ecx, dword [0x140212df0]
lea rax, [rdi + rbx]
mov qword [0x140212de8], rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, qword [0x140212de8]
mov edx, 8
mov rcx, qword [0x140210620]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [0x140212df0]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test rsi, rsi
jne 0x140071fca
test rbp, rbp
je 0x140071ff1
mov edx, 0x28
lea rcx, [0x140212de0]
call fcn.140072b00
mov qword [rax], rbx
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rbp
test rsi, rsi
je 0x140071ff1
lea rcx, [rdi + rbx]
call rsi
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140072b60
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14020c6c4]
cmp ecx, 0xffffffff
jne 0x140072b76
call fcn.140073190
jmp 0x140072b86
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140072ba5
call fcn.140073550
mov ecx, dword [0x14020c6c4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x140072bb0]
add rsp, 0x28
jmp fcn.14000d550
add rsp, 0x28
ret

Function at 0x140072ca0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x14020c6c4]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
dec qword [rax + 0x338]
mov rcx, qword [rax + 0x338]
mov rbx, qword [rax + rcx*8 + 0x18]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140072cf0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14020c6c4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
dec qword [rax + 0x338]
mov rcx, qword [rax + 0x338]
mov rax, qword [rax + rcx*8 + 0x18]
mov qword [rdx + 0x10], rax
add rsp, 0x28
ret

Function at 0x140072d20
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14020c6c4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
dec qword [rax + 0x338]
mov rcx, qword [rax + 0x338]
mov rdx, qword [rax + rcx*8 + 0x18]
mov qword [rax + 0x10], rdx
mov rax, qword [rax]
add rax, rdx
add rsp, 0x28
ret
Function at 0x140072d60
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14020c6c4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
dec qword [rax + 0x338]
mov rcx, qword [rax + 0x338]
mov rax, qword [rax + rcx*8 + 0x18]
add rax, qword [rdx]
add rsp, 0x28
ret

Function at 0x140072d90
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14020c6c4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rax + 0x338]
mov rcx, qword [rax + 0x10]
mov qword [rax + rdx*8 + 0x18], rcx
inc qword [rax + 0x338]
add rsp, 0x28
ret

Function at 0x140072df0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rcx
movsxd rbx, edx
mov ecx, dword [0x14020c6c4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [0x140214260]
xor edx, edx
mov rsi, rax
mov rax, qword [r14]
mov r8d, dword [rsi + 0x10]
sub r8d, ebx
movsxd rdi, r8d
lea r9, [rdi + 0xa]
test rax, rax
jne 0x140072e44
mov r8, r9
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x140072e4d
mov r8, rax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [r14], rax
mov rcx, rax
mov rdx, qword [rsi]
shr rdi, 1
add rdx, rbx
mov r8d, edi
call fcn.1400733a0
mov rdi, qword [rsp + 0x40]
mov qword [rsi + 0x10], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret

Function at 0x140072ea0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14020c6c4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add qword [rax + 0x10], 2
add rsp, 0x28
ret

Function at 0x140072f30
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x14020c6c4]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov qword [rax + 0x10], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]

Function at 0x140073020
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
mov ecx, edi
mov edx, 0xffffffff
call fcn.1400731c0
movzx r9d, word [rbx]
mov rcx, rax
mov r8d, edi
test r9w, r9w
je 0x14007306c
sub rbx, rax
nop
test r8d, r8d
je 0x14007306c
mov word [rax], r9w
dec r8d
movzx r9d, word [rbx + rax + 2]
add rax, 2
test r9w, r9w
jne 0x140073050
xor edx, edx
mov word [rax], dx
sub rax, rcx
sar rax, 1
sub edi, eax
mov ecx, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140073270

Function at 0x140073190
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
sub rsp, 0x28
xor r8d, r8d
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x140214260], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x14020c6c4], eax
add rsp, 0x28
jmp fcn.140073550
Function at 0x1400731c0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rbp, ecx
mov esi, edx
mov ecx, dword [0x14020c6c4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
cmp esi, 0xffffffff
jne 0x1400731f0
mov esi, dword [rax + 0x10]
mov eax, dword [rax + 0x10]
mov r8, qword [rbx + 8]
lea edx, [rax + rbp*2]
movsxd rax, edx
lea rcx, [r8 - 4]
cmp rax, rcx
jl 0x140073211
lea eax, [rdx + 0x4000]
movsxd r9, eax
jmp 0x140073223
mov eax, 0x100000
cmp r8, rax
jle 0x140073240
cmp edx, eax
cmovl edx, eax
mov r9d, edx
mov r8, qword [rbx]
xor edx, edx
mov qword [rbx + 8], r9
add r9, 0xa
mov rcx, qword [0x140214260]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rbx], rax
mov rax, qword [rbx]
movsxd rdx, esi
mov rsi, qword [rsp + 0x40]
add rax, rdx
lea rcx, [rdx + rbp*2]
mov rbp, qword [rsp + 0x38]
mov qword [rbx + 0x10], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140073270
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov ecx, dword [0x14020c6c4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [rbx + rbx]
movsxd rdx, ecx
sub qword [rax + 0x10], rdx
add rsp, 0x20
pop rbx
ret

Function at 0x1400732a0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
movsxd rbx, ecx
mov ecx, dword [0x14020c6c4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edx, edx
mov qword [rax + 0x10], rbx
mov rax, qword [rax]
mov word [rbx + rax], dx
add rsp, 0x20
pop rbx
ret

Function at 0x1400732d0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140073316
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400732e5
mov ecx, eax
call fcn.1400731c0
sub rax, rbx
nop dword [rax]
movzx ecx, word [rbx]
mov word [rax + rbx], cx
lea rbx, [rbx + 2]
test cx, cx
jne 0x140073300
add rsp, 0x20
pop rbx
ret
mov ecx, edx
add rsp, 0x20
pop rbx
jmp fcn.1400732a0

Function at 0x140073330
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x14020c6c4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rax]
cmp rbx, rcx
jb 0x140073364
mov rdx, qword [rax + 0x10]
add rdx, rcx
cmp rbx, rdx
ja 0x140073364
sub ebx, ecx
lea eax, [rbx + 1]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140073370
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
movsxd rbx, ecx
mov ecx, dword [0x14020c6c4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
dec rbx
mov rax, qword [rax]
add rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1400733e0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
movsxd rbx, ecx
mov ecx, dword [0x14020c6c4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rbx, qword [rax]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140073550
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x140214260]
xor edx, edx
mov r8d, 0x340
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [0x140214260]
xor edx, edx
mov rbx, rax
lea r8d, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx + 8], reloc.OLEAUT32.dll_SafeArrayGetDim
mov rdx, rbx
mov qword [rbx], rax
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x338], rax
mov ecx, dword [0x14020c6c4]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x140075db0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor ebx, ebx
mov r10d, 0x100
or edx, r10d
mov r11d, r8d
mov rdi, rcx
nop dword [rax + rax]
add r11d, r11d
mov r8d, edx
shr r8d, 8
mov ecx, edx
shr ecx, 7
mov eax, r10d
and ecx, 1
and eax, r11d
neg ecx
add eax, r10d
shr rcx, 4
add r8d, eax
and ecx, 0x7f
add edx, edx
movzx r8d, word [rdi + r8*2]
shr r8, 4
xor r8, rcx
mov ecx, edx
xor ecx, r11d
not ecx
and r10d, ecx
add ebx, dword [r9 + r8*4]
cmp edx, 0x10000
jb 0x140075dd0
mov rdi, qword [rsp + 0x10]
mov eax, ebx
mov rbx, qword [rsp + 8]
ret

Function at 0x140077b00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xcc], 0
mov rbp, rcx
jne 0x140077b2d
call fcn.1400739c0
mov rcx, rbp
call fcn.1400736e0
mov ecx, dword [rbp + 0xc4]
lea r8, [rbp + 0x22d8]
mov eax, dword [rbp + 0x48]
lea r9, [rbp + 0x588]
dec eax
mov dword [rbp + 0xec], 0x40
mov ebx, 1
mov dword [rbp + 0xaedc], eax
mov edx, ebx
mov dword [rbp + 0x6ad8], eax
shl edx, cl
lea rcx, [rbp + 0x6ad8]
call fcn.140075a20
mov ecx, dword [rbp + 0xc4]
lea r8, [rbp + 0x26d8]
shl ebx, cl
lea r9, [rbp + 0x588]
mov edx, ebx
lea rcx, [rbp + 0xaedc]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.140075a20

Function at 0x140078590
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov rbx, r9
mov rdi, r8
mov ebp, edx
mov rsi, rcx
xor r11d, r11d
mov r10d, r11d
lea rdi, [rdi + 8]
shr r10d, 1
mov r9d, r11d
shr r9d, 2
mov ecx, r10d
and ecx, 1
add r11d, 2
neg ecx
shr rcx, 4
and ecx, 0x7f
lea eax, [r9 + 2]
movzx edx, word [rsi + rax*2]
movzx eax, word [rsi + 2]
shr rax, 4
shr rdx, 4
xor rdx, rcx
mov ecx, r9d
neg ecx
shr rcx, 4
and ecx, 0x7f
mov r8d, dword [rbx + rdx*4]
xor rcx, rax
lea eax, [r10 + 4]
movzx edx, word [rsi + rax*2]
mov eax, edx
xor rdx, 0x7f0
add r8d, dword [rbx + rcx*4]
add r8d, ebp
shr rax, 4
shr rdx, 4
mov ecx, dword [rbx + rax*4]
add ecx, r8d
mov dword [rdi - 8], ecx
mov ecx, dword [rbx + rdx*4]
add ecx, r8d
mov dword [rdi - 4], ecx
cmp r11d, 8
jb 0x1400785b2
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x14007ade0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov qword [rcx + 0x480], 0xffffffffffffffff
mov qword [rcx + 0x40], rdx
lea r8, [rcx + 0x78]
mov word [rcx + 0x22], dx
mov qword [rcx + 0x28], rdx
mov dword [rcx + 0x3c], 0x20
mov byte [rcx + 0x21], 1
mov dword [rcx + 0x5c], 4
nop
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x14007ae10
ret
Function at 0x140090bf0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov ebx, 0xffffffff
mov rdi, rdx
cmp r8, rbx
cmovbe rbx, r8
test ecx, ecx
jns 0x140090c2a
call fcn.140017c68
mov dword [rax], 9
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x140090cd2
call fcn.140018b98
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140090cc3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x140090c83
call fcn.140017c68
mov dword [rax], reloc.WS2_32.dll_inet_addr
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp eax, 0x6d
je 0x140090cd2
cmp eax, 5
jne 0x140090caa
call fcn.140017c68
mov dword [rax], 9
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, eax
call fcn.140090830
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x140091310
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rdx
test ecx, ecx
jns 0x140091335
call fcn.140017c68
mov dword [rax], 9
mov rax, 0xffffffffffffffff
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x48], rbx
mov ebx, 0xffffffff
cmp r8, rbx
cmovbe ebx, r8d
call fcn.140018b98
mov rcx, rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x48]
test eax, eax
jne 0x1400913a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x140091394
call fcn.140017c68
mov dword [rax], 9
mov rax, 0xffffffffffffffff
add rsp, 0x30
pop rdi
ret
mov ecx, eax
call fcn.140090830
mov rax, 0xffffffffffffffff
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400a1360
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x30
mov edx, edx
mov r10, rcx
mov dword [rcx], 0x4000400
mov r9d, 0x400
mov qword [rsp + 0x58], rdx
test rdx, rdx
je 0x1400a13dd
lea rax, [rcx + 8]
mov ecx, edx
nop word [rax + rax]
mov dword [rax - 4], 0x4000400
mov dword [rax], 0x4000400
mov dword [rax + 4], 0x4000400
mov dword [rax + 8], 0x4000400
mov dword [rax + 0xfc], 0x4000400
mov dword [rax + 0x100], 0x4000400
mov dword [rax + 0x104], 0x4000400
mov dword [rax + 0x108], 0x4000400
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x1400a1390
movzx eax, r9w
lea rdi, [r10 + 0x204]
mov ecx, 0x100
rep stosw word [rdi], ax
test r8b, r8b
jne 0x1400a1556
xor eax, eax
mov qword [rsp + 0x40], rax
test rdx, rdx
je 0x1400a1556
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rbp
lea rbp, [0x1401cc140]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r12
mov qword [rsp + 0x10], r13
mov qword [rsp + 8], r14
mov qword [rsp], r15
mov esi, dword [r10 + 0x4804]
lea rdi, [0x1401cc140]
mov r14d, eax
xor r8d, r8d
imul r12, r14, 0x440
mov dword [r10 + r14*4 + 0x4808], esi
movzx ecx, word [r10]
add r12, 0x404
mov eax, ecx
add r12, r10
xor rcx, 0x7f0
shr rax, 4
shr rcx, 4
movzx ebp, byte [rax + rbp]
movzx edx, byte [rcx + rdi]
movzx ecx, word [r10 + 2]
mov eax, ecx
mov dword [rsp + 0x50], ebp
xor rcx, 0x7f0
shr rax, 4
shr rcx, 4
movzx r15d, byte [rax + rdi]
movzx r13d, byte [rcx + rdi]
add r15d, edx
add r13d, edx
test esi, esi
je 0x1400a1515
mov rbx, r12
nop dword [rax]
cmp r8d, 8
jae 0x1400a155c
xor r9d, r9d
lea edi, [r8 + 8]
lea r11, [r14*8]
lea rbp, [0x1401cc140]
mov ecx, edi
shr edi, 1
and ecx, 1
mov eax, edi
add rax, r11
movzx edx, word [r10 + rax*2 + 4]
mov eax, ecx
neg eax
shr rdx, 4
shr rax, 4
and eax, 0x7f
xor rdx, rax
movzx eax, byte [rdx + rbp]
add r9d, eax
cmp edi, 1
jne 0x1400a14d0
mov eax, dword [rsp + 0x50]
inc r8d
add eax, r9d
mov dword [rbx], eax
add rbx, 4
cmp r8d, esi
jb 0x1400a14b0
lea rbp, [0x1401cc140]
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
cmp rax, qword [rsp + 0x58]
jb 0x1400a1432
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp r8d, esi
jae 0x1400a1515
lea rbx, [r12 + r8*4]
lea rbp, [0x1401cc140]
nop dword [rax]
cmp r8d, 0x10
jae 0x1400a15ce
xor r9d, r9d
lea r11, [r14*8]
mov edi, r8d
mov ecx, edi
shr edi, 1
and ecx, 1
mov eax, edi
add rax, r11
movzx edx, word [r10 + rax*2 + 0x104]
mov eax, ecx
neg eax
shr rdx, 4
shr rax, 4
and eax, 0x7f
xor rdx, rax
movzx eax, byte [rdx + rbp]
add r9d, eax
cmp edi, 1
jne 0x1400a1584
lea eax, [r9 + r15]
inc r8d
mov dword [rbx], eax
add rbx, 4
cmp r8d, esi
jb 0x1400a1570
jmp 0x1400a151c
lea r11, [r12 + r8*4]
xor r9d, r9d
lea eax, [r8 + 0xf0]
nop dword [rax]
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
shr rcx, 4
movzx edi, word [r10 + rax*2 + 0x204]
and ecx, 0x7f
shr rdi, 4
xor rdi, rcx
movzx ecx, byte [rdi + rbp]
add r9d, ecx
cmp eax, 1
jne 0x1400a15e0
lea eax, [r9 + r13]
inc r8d
mov dword [r11], eax
add r11, 4
cmp r8d, esi
jb 0x1400a15d2
jmp 0x1400a151c
Function at 0x1400a1630
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r13
push r14
push r15
mov esi, dword [rcx + 0x4804]
lea r9, [0x1401cc140]
mov ebp, edx
mov r11, rcx
mov dword [rcx + rbp*4 + 0x4808], esi
lea r12, [r11 + 0x404]
movzx edx, word [rcx]
movzx ecx, word [rcx + 2]
mov eax, edx
shr rax, 4
xor rdx, 0x7f0
shr rdx, 4
movzx r14d, byte [rax + r9]
mov eax, ecx
movzx r8d, byte [rdx + r9]
xor rcx, 0x7f0
shr rax, 4
shr rcx, 4
mov dword [rsp + 0x38], r14d
movzx r15d, byte [rax + r9]
movzx r13d, byte [rcx + r9]
add r15d, r8d
imul rax, rbp, 0x440
add r13d, r8d
xor r9d, r9d
add r12, rax
test esi, esi
je 0x1400a1819
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rdi
mov rdi, r12
cmp r9d, 8
jae 0x1400a173f
xor r10d, r10d
lea r8d, [r9 + 8]
lea rbx, [rbp*8]
lea r14, [0x1401cc140]
nop dword [rax]
nop dword [rax + rax]
mov ecx, r8d
shr r8d, 1
and ecx, 1
mov eax, r8d
add rax, rbx
movzx edx, word [r11 + rax*2 + 4]
mov eax, ecx
neg eax
shr rdx, 4
shr rax, 4
and eax, 0x7f
xor rdx, rax
movzx eax, byte [rdx + r14]
add r10d, eax
cmp r8d, 1
jne 0x1400a16f0
mov eax, dword [rsp + 0x38]
inc r9d
add eax, r10d
mov dword [rdi], eax
add rdi, 4
cmp r9d, esi
jb 0x1400a16c8
jmp 0x1400a180f
cmp r9d, esi
jae 0x1400a180f
lea rdi, [r12 + r9*4]
lea r14, [0x1401cc140]
cmp r9d, 0x10
jae 0x1400a17bc
xor r10d, r10d
lea rbx, [rbp*8]
mov r8d, r9d
nop word [rax + rax]
mov ecx, r8d
shr r8d, 1
and ecx, 1
mov eax, r8d
add rax, rbx
movzx edx, word [r11 + rax*2 + 0x104]
mov eax, ecx
neg eax
shr rdx, 4
shr rax, 4
and eax, 0x7f
xor rdx, rax
movzx eax, byte [rdx + r14]
add r10d, eax
cmp r8d, 1
jne 0x1400a1770
lea eax, [r10 + r15]
inc r9d
mov dword [rdi], eax
add rdi, 4
cmp r9d, esi
jb 0x1400a1753
jmp 0x1400a180f
lea rbx, [r12 + r9*4]
xor r10d, r10d
lea eax, [r9 + 0xf0]
nop word [rax + rax]
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
shr rcx, 4
movzx r8d, word [r11 + rax*2 + 0x204]
and ecx, 0x7f
shr r8, 4
xor r8, rcx
movzx ecx, byte [r8 + r14]
add r10d, ecx
cmp eax, 1
jne 0x1400a17d0
lea eax, [r10 + r13]
inc r9d
mov dword [rbx], eax
add rbx, 4
cmp r9d, esi
jb 0x1400a17c0
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rsi
ret