joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b50c5
Capabilities:
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x14], 0
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
call sym._fpreset
lea rax, [0x1400bee50]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
lea rax, [sym.pthread_tls_init]
mov rdx, rax
lea rax, [0x1400d7d70]
mov rcx, rax
call sym._pthread_once_raw
mov eax, dword [0x1400bee40]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 8]
mov dword [rdx + 0x70], eax
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rdx, rbp
mov rax, qword [rbp - 8]
add rax, 0xd0
mov rcx, rax
call sym._setjmp
test eax, eax
jne 0x1400b51da
mov qword [rbp - 0x10], pe_nt_image_headers64
lea rax, [0x1400bee50]
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x1400b51a8
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov rcx, rax
call rdx
mov qword [rbp - 0x10], rax
nop
nop
lea rax, [0x1400bee50]
mov rcx, rax
call sym.pthread_mutex_lock
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call sym._pthread_cleanup_dest
jmp 0x1400b51e9
lea rax, [0x1400bee50]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov dword [rbp - 0x14], eax
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x1400b5225
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 8]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x1400b5293
mov rax, qword [rbp - 8]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.push_pthread_mem
mov qword [rbp - 8], 0
mov eax, dword [0x1400bee40]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x1400b52dd
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 8]
mov dword [rax + 0xbc], 1
jmp 0x1400b52dd
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [0x1400bee50]
mov rcx, rax
call sym.pthread_mutex_unlock
test eax, eax
je 0x1400b52cf
mov eax, dword [rbp - 0x14]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__endthreadex]
call rax
nop
Function at 0x140034960
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x388
movaps xmmword [rsp + 0x370], xmm7
movaps xmmword [rsp + 0x360], xmm6
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov r14, qword [0x140120080]
mov rax, qword [r14]
cmp rax, 5
jne 0x140034a2c
lea rax, [0x1400f4158]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x80], rax
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x88], xmm0
lea rcx, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_src_lib.rs
call fcn.1400b1e30
lea rcx, str.tokio_tungsteniteC:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_src_lib.rs:243_WebSocketStream.with_context
mov qword [rsp + 0x180], rcx
mov qword [rsp + 0x188], 0x11
mov qword [rsp + 0x190], rcx
mov qword [rsp + 0x198], 0x11
mov qword [rsp + 0x1a0], rax
lea rcx, [rsp + 0x70]
lea r8, [rsp + 0x180]
mov edx, 5
xor r9d, r9d
call fcn.1400b1d70
cmp byte [rdi + 0x139], 0
je 0x140034a41
mov qword [rsi], 0x10
jmp 0x140036049
mov rax, qword [r14]
cmp rax, 5
jne 0x140034ada
lea rax, [0x1400f3d50]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x80], rax
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x88], xmm0
lea rcx, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_src_lib.rs
call fcn.1400b1e30
lea rcx, str.tokio_tungsteniteC:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_src_lib.rs:243_WebSocketStream.with_context
mov qword [rsp + 0x180], rcx
mov qword [rsp + 0x188], 0x11
mov qword [rsp + 0x190], rcx
mov qword [rsp + 0x198], 0x11
mov qword [rsp + 0x1a0], rax
lea rcx, [rsp + 0x70]
lea r8, [rsp + 0x180]
mov edx, 5
xor r9d, r9d
call fcn.1400b1d70
mov rbx, qword [rbx]
mov rcx, qword [rdi + 0x28]
add rcx, 0x10
mov rdx, rbx
call fcn.1400884a0
mov rcx, qword [rdi + 0x30]
add rcx, 0x10
mov rdx, rbx
call fcn.1400884a0
mov rax, qword [r14]
cmp rax, 5
jne 0x140034b96
lea rax, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_src_lib.rs:298_Stream.with_context_poll_next____read__
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rax, [rsp + 0x38]
lea eax, [rsp + 0x38]
Function at 0x1400375b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x1400375f2
mov r10d, 8
sub r10, r11
cmp r10, r8
mov rdi, r8
cmovb rdi, r10
cmp rdi, 4
jb 0x1400375fa
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14003760b
jmp 0x140037622
xor r10d, r10d
jmp 0x1400376ad
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140037622
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140037639
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140037659
add r11, r8
jmp 0x14003778a
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov r11, qword [rax + 0x10]
mov r9, qword [rax]
add r9, r11
mov rdi, qword [rax + 8]
add rdi, rcx
rol r11, 0xd
xor r11, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, rdi
add rdi, r11
rol r11, 0x11
add r9, rcx
xor r11, rdi
rol rcx, 0x15
mov qword [rax + 0x10], r11
xor rcx, r9
rol rdi, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], rdi
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140037722
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x1400376d0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140037740
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140037752
jmp 0x14003776c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14003776c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140037786
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14003fa30
Capabilities:
Reference absolute stream path on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd8
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov r14, qword [0x140120080]
mov rax, qword [r14]
cmp rax, 5
jne 0x14003fac7
lea rax, [0x1400f5f28]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rax, [rsp + 0x28]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rcx, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_srccompat.rs
call fcn.1400b1e30
lea rcx, str.tokio_tungstenite::compat
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0x19
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], 0x19
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x58]
lea r8, [rsp + 0x30]
mov edx, 5
xor r9d, r9d
call fcn.1400b1d70
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], rdi
mov rax, qword [r14]
cmp rax, 5
jne 0x14003fb66
lea rax, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_srccompat.rs:126_AllowStd.with_context
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rax, [rsp + 0x28]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rcx, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_srccompat.rs
call fcn.1400b1e30
lea rcx, str.tokio_tungstenite::compat
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0x19
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], 0x19
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x58]
lea r8, [rsp + 0x30]
mov edx, 5
xor r9d, r9d
call fcn.1400b1d70
mov rax, qword [rsi + 0x30]
add rax, 0x10
lea rcx, [0x1400f5448]
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], 0
mov rax, qword [r14]
cmp rax, 5
jne 0x14003fc24
lea rax, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_srccompat.rs:152_Read.with_context_read____poll_read
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rax, [rsp + 0x28]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rcx, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_srccompat.rs
call fcn.1400b1e30
lea rcx, str.tokio_tungstenite::compat
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0x19
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], 0x19
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x58]
lea r8, [rsp + 0x30]
mov edx, 5
xor r9d, r9d
call fcn.1400b1d70
lea rdx, [rsp + 0xb8]
lea r8, [rsp + 0x88]
mov rcx, rsi
call fcn.14006ef40
test rax, rax
je 0x14003fc52
mov eax, 1
movabs rdx, 0xd00000003
jmp 0x14003fc72
test rdx, rdx
je 0x14003fc5e
mov eax, 1
jmp 0x14003fc72
mov rdx, qword [rsp + 0x98]
cmp rdx, qword [rsp + 0x90]
ja 0x14003fc7f
xor eax, eax
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r14
ret
ud2
Function at 0x14003fc90
Capabilities:
Reference absolute stream path on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov rdi, qword [0x140120080]
mov rax, qword [rdi]
lea rsi, [rsp + 0x28]
cmp rax, 5
je 0x14003fd41
mov rax, qword [rdi]
cmp rax, 5
je 0x14003fdbb
mov rax, qword [rdi]
cmp rax, 5
jne 0x14003fd35
lea rax, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_srccompat.rs:180_Write.with_context_flush____poll_flush
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
mov qword [rsp + 0x68], rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rcx, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_srccompat.rs
call fcn.1400b1e30
lea rcx, str.tokio_tungstenite::compat
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0x19
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], 0x19
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x58]
lea r8, [rsp + 0x30]
mov edx, 5
xor r9d, r9d
call fcn.1400b1d70
xor eax, eax
add rsp, 0x88
pop rdi
pop rsi
ret
lea rax, [0x1400f60c0]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
mov qword [rsp + 0x68], rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rcx, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_srccompat.rs
call fcn.1400b1e30
lea rcx, str.tokio_tungstenite::compat
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0x19
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], 0x19
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x58]
lea r8, [rsp + 0x30]
mov edx, 5
xor r9d, r9d
call fcn.1400b1d70
mov rax, qword [rdi]
cmp rax, 5
jne 0x14003fcbf
lea rax, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_srccompat.rs:126_AllowStd.with_context
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
mov qword [rsp + 0x68], rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rcx, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_srccompat.rs
call fcn.1400b1e30
lea rcx, str.tokio_tungstenite::compat
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0x19
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], 0x19
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x58]
lea r8, [rsp + 0x30]
mov edx, 5
xor r9d, r9d
call fcn.1400b1d70
mov rax, qword [rdi]
cmp rax, 5
je 0x14003fcc8
jmp 0x14003fd35
Function at 0x14003fe40
Capabilities:
Reference absolute stream path on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov r15, qword [0x140120080]
mov rax, qword [r15]
lea r14, [rsp + 0x30]
cmp rax, 5
jne 0x14003fed9
lea rax, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_srccompat.rs:167_Write.write
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x70], r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
lea rcx, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_srccompat.rs
call fcn.1400b1e30
lea rcx, str.tokio_tungstenite::compat
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 0x19
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], 0x19
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x38]
mov edx, 5
xor r9d, r9d
call fcn.1400b1d70
mov rax, qword [r15]
cmp rax, 5
jne 0x14003ff4f
lea rax, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_srccompat.rs:126_AllowStd.with_context
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x70], r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
lea rcx, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_srccompat.rs
call fcn.1400b1e30
lea rcx, str.tokio_tungstenite::compat
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 0x19
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], 0x19
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x38]
mov edx, 5
xor r9d, r9d
call fcn.1400b1d70
mov rax, qword [rbx + 0x28]
add rax, 0x10
lea rcx, [0x1400f5448]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], 0
mov rax, qword [r15]
cmp rax, 5
jne 0x140040008
lea rax, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_srccompat.rs:169_Write.with_context_write____poll_write
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x70], r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
lea rcx, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_srccompat.rs
call fcn.1400b1e30
lea rcx, str.tokio_tungstenite::compat
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 0x19
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], 0x19
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x38]
mov edx, 5
xor r9d, r9d
call fcn.1400b1d70
lea rdx, [rsp + 0xa0]
mov rcx, rbx
mov r8, rdi
mov r9, rsi
call fcn.14006ef50
cmp rax, 2
movabs rcx, 0xd00000003
cmove rdx, rcx
mov ecx, 1
cmove rax, rcx
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140053ff0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov r8, rdx
mov rax, qword [rcx + 0x38]
test rax, rax
jle 0x140054017
cmp qword [rcx + 0x40], 0
js 0x140054017
add rax, 0xffffffffffffff00
mov qword [rcx + 0x38], rax
mov edx, 6
jmp fcn.140060ba0
mov rdx, r8
jmp fcn.140054170

Function at 0x140054170
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rsi, rdx
mov rdi, rcx
add rcx, 0x48
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x20
call fcn.1400630d0
test rax, rax
je 0x1400541d2
mov rbx, rax
mov r14, rdx
mov rax, qword [rdx]
test rax, rax
je 0x1400541bb
mov rcx, rbx
call rax
mov rdx, qword [r14 + 8]
test rdx, rdx
je 0x140054222
mov r8, qword [r14 + 0x10]
mov rcx, rbx
call fcn.14004bad0
jmp 0x140054222
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x70]
lea r8, [0x1400f7cc8]
lea rdx, [rsp + 0x40]
mov r9d, 8
call fcn.140062f90
movaps xmm0, xmmword [rsp + 0x70]
movaps xmm1, xmmword [rsp + 0x80]
movaps xmm2, xmmword [rsp + 0x90]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov edx, 6
mov r8, rsi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140060ba0
Function at 0x1400592e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x140059376
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x1400f9ba0]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1400375b0
test rdi, rdi
je 0x140059405
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14005941e
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x140059516
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x140059598
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x140059523
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x1400593e0
cmp r9, 8
jae 0x14005952c
jmp 0x140059598
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1400375b0
mov rax, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, r9
mov r8, qword [rsp + 0x30]
add r8, rax
mov rdx, qword [rsp + 0x38]
add rdx, rcx
rol rax, 0xd
xor rax, r8
rol rcx, 0x10
rol r8, 0x20
xor rcx, rdx
add rdx, rax
rol rax, 0x11
add r8, rcx
xor rax, rdx
rol rcx, 0x15
xor rcx, r8
rol rdx, 0x20
xor r8, r9
xor rdx, 0xff
add r8, rax
rol rax, 0xd
add rdx, rcx
xor rax, r8
rol rcx, 0x10
xor rcx, rdx
rol r8, 0x20
add rdx, rax
add r8, rcx
rol rax, 0x11
xor rax, rdx
rol rcx, 0x15
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
add rdx, rcx
xor rax, r8
rol rcx, 0x10
xor rcx, rdx
rol r8, 0x20
add rdx, rax
add r8, rcx
rol rax, 0x11
xor rax, rdx
rol rcx, 0x15
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
add rdx, rcx
xor rax, r8
shl rcx, 0x10
xor rcx, rdx
add rdx, rax
shr rax, 0x2f
shr rcx, 0x2b
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x140059598
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x140059598
mov r8, rcx
cmp r9, 8
jb 0x140059598
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x140059530
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x140063370
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x1400633e2
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov r15, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov r12, qword [sym.imp.advapi32.dll_SystemFunction036]
jmp 0x1400633a8
add rdi, rbx
sub rsi, rbx
je 0x1400633e2
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call r15
cmp eax, 0xbfffffff
jbe 0x1400633a0
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call r12
test al, al
jne 0x1400633a0
add ebp, 0x80000000
jmp 0x1400633e4
xor ebp, ebp
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14006c830
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x14006c840
test al, 1
je 0x14006c85b
test al, 2
jne 0x14006c85b
xor rax, 3
ret
ud2

Function at 0x14006ef40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1400760b0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x1400760fa
mov r15, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov rdx, r15
mov r8, rdi
xor r9d, r9d
call fcn.14006c450
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x140076125
mov eax, 1
jmp 0x140076293
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov r8, rdi
xor r9d, r9d
call fcn.14006c450
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x14007625c
mov eax, 1
jmp 0x140076293
add rbx, 0x18
lea r13, [rsp + 0x20]
mov qword [rsp + 0x30], rdi
jmp 0x14007617f
dec r13
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.14004bad0
mov r13, rbx
mov rcx, rbx
mov rdx, r15
mov r8, qword [rsp + 0x30]
xor r9d, r9d
call fcn.14006c450
movzx eax, byte [rsp + 0x29]
cmp al, 3
mov rbx, rsi
mov rsi, r14
je 0x1400760f0
mov rbp, qword [rsp + 0x20]
cmp al, 2
je 0x140076265
mov r8, qword [rsi + 8]
mov r12, qword [rsi + 0x10]
sub r8, r12
jb 0x1400762af
movzx edi, byte [rsp + 0x28]
mov r14, rsi
mov rdx, qword [rsi]
add rdx, r12
mov rsi, rbx
mov qword [rsp + 0x20], rbx
mov rbx, r13
mov rcx, r13
call fcn.140081110
mov r13, rdx
test rax, rax
je 0x140076269
mov rcx, r13
call fcn.140075d50
cmp al, 0xd
jne 0x14007628e
and ebp, 0x23
mov rax, qword [r15 + 0x90]
xor rbp, 0x2f
mov rcx, rdi
shl rcx, 0x10
nop
mov edx, eax
shr edx, 0x10
cmp dil, dl
jne 0x14007620c
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r15 + 0x90], rdx
jne 0x1400761f0
mov eax, r13d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x140076156
test rax, rax
je 0x140076156
mov rbp, qword [r13 - 1]
mov rdi, qword [r13 + 7]
mov rax, qword [rdi]
test rax, rax
je 0x14007623e
mov rcx, rbp
call rax
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x140076140
mov r8, qword [rdi + 0x10]
mov rcx, rbp
call fcn.14004bad0
jmp 0x140076140
cmp al, 2
jne 0x1400762a7
mov rbp, qword [rsp + 0x20]
xor eax, eax
jmp 0x140076293
lea rax, [r12 + r13]
mov rcx, qword [r14 + 0x18]
cmp rax, rcx
jbe 0x14007627d
mov qword [r14 + 0x18], rax
mov rcx, rax
add r12, r13
jb 0x1400762af
cmp rax, rcx
ja 0x1400762af
mov qword [r14 + 0x10], rax
xor r13d, r13d
xor eax, eax
mov rbp, r13
mov rdx, rbp
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0x10]
cmp rax, qword [rsi + 8]
ud2