joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1416e6200
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
xor eax, eax
test eax, eax
je 0x1416e641b
nop
nop
add byte [rax], al
add byte [rdi + rcx], cl
loope 0x1416e621a
sldt word [rax]
add byte [rax], al
add byte [rax], al
or ecx, dword [rsi]
add eax, 0x55808
add al, 4
add al, 9
add al, 7
invalid
xor eax, eax
test eax, eax
je 0x1416e6632
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add dh, bh
or ecx, dword [rdi]
and eax, dword [rcx]
add al, byte [rcx]
lsl esp, word [rcx + 0xa230707]
add byte [rax], al
add byte [rax + 0x50000f], cl
add byte [rdx], cl
add eax, 0
xchg esp, eax
sldt word [rax]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
invalid
xor eax, eax
test eax, eax
je 0x1416e6849
nop
nop
nop
nop
fimul dword [0x1507d9951]
invalid
xor eax, eax
test eax, eax
je 0x1416e6a60
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add dl, byte [rax + rax]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add al, 0xf
loop 0x1416e6877
bts dword [rdi], ecx
or dword [rdi + 7], ebp
invalid
xor eax, eax
test eax, eax
je 0x1416e6c77
nop
nop
nop
nop
nop
nop
add byte [rax], al
sbb dword [rax], eax
add byte [rax], al
add byte [rax], al
pop rbx
add byte [0x1426e6a7f], al
add dword [rbx], eax
in al, dx
add dword [0xce716d09], ecx
add eax, 0x2062c0a
jmp 0x142b67297
call fcn.1416ed740
xor eax, eax
test eax, eax
je 0x1416e6e93
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add dword [rcx], ecx
add dword [rax], eax
add byte [rax], al
add byte [rax], al
cmp al, 8
add al, 0x53
add byte [rax], al
add byte [rax], al
invalid
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1416ec2e0
Capabilities:
Get token membership

Disassembly:
sub rsp, 0x88
xor eax, eax
test eax, eax
je 0x1416ec4fe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add ecx, dword [rdi]
or ah, bl
or eax, 0xf0d2e0a
add byte es:[rbx], cl
mov bl, 8
or al, 0
add eax, dword [rax]
add byte [rax], al
add byte [rax], al
dec dword [rdi]
ud0
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x70], 0
mov byte [rsp + 0x64], 0
mov byte [rsp + 0x65], 0
mov byte [rsp + 0x66], 0
mov byte [rsp + 0x67], 0
mov byte [rsp + 0x68], 0
mov byte [rsp + 0x69], 5
xor eax, eax
test eax, eax
je 0x1416ec744
nop
nop
nop
nop
nop
nop
nop
nop
nop
add rax, 0x60fbc0f
invalid
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rsp + 0x64]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1416ecbfa
xor eax, eax
test eax, eax
je 0x1416ec9b6
nop
nop
nop
nop
nop
nop
nop
add byte [rax], al
add dword [rax], eax
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
dec dword [rdi]
leave
or dword [0x12279d253], eax
invalid
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1416ecbef
xor eax, eax
test eax, eax
je 0x1416ecbe7
nop
nop
nop
nop
nop
nop
inc dword [rcx]
invalid
mov dword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
xor eax, eax
test eax, eax
je 0x1416ece11
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add byte [rax], al
insb byte [rdi], dx
add byte [0xed6ecc6c], cl
add byte [0x1296ecc72], cl
add byte [rax], al
add byte [rsi + 7], al
add ch, byte [rcx]
add byte [rsi + rax + 8], dl
jne 0x1416ecc2d
add byte [rdi + 6], dl
loopne 0x1416ecc32
or al, 0x45
add byte [rax], al
lock add byte [rax*2], cl
or eax, 0x5650c45
add esi, dword [rdi + rax + 2]
imul eax, dword [rsi], 0x705670e
add byte [rax], al
add byte [rbp + 6], ah
invalid
mov eax, dword [rsp + 0x60]
add rsp, 0x88
ret
Function at 0x1416ece20
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rdi
sub rsp, 0x2b0
xor eax, eax
test eax, eax
je 0x1416ed040
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add byte [rax], dh
add byte [rcx], ah
add byte [rdx], dh
add byte [rcx], ah
add byte [0x149eace52], dh
or dl, byte [rax]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rsi], ch
add ecx, dword [rdi]
invalid
call fcn.1416ec2e0
test eax, eax
jne 0x1416ed735
xor eax, eax
test eax, eax
je 0x1416ed264
nop
nop
nop
nop
nop
nop
nop
nop
nop
or al, 0x94
femms
adc al, 0xc
or al, 0x95
femms
or eax, 0xe0fa704
add dword [rcx], ecx
add eax, dword [rax]
add byte [rax], al
add byte [rax], al
mov esp, 0x530e04
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rsi + 7], ah
or byte [rax], al
add byte [rax], al
invalid
mov r8d, 0x208
lea rdx, [rsp + 0xa0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
test eax, eax
je 0x1416ed491
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add al, byte [rbp]
add byte [rax + 6], al
cmovne eax, dword [rax]
add byte [rax + 0x450207], dl
add byte [rax], al
add byte [r8], r8b
add byte [rax], al
add byte [rax], al
add byte [rax], al
add ecx, dword cs:[rdi]
add eax, 0x606
or byte [rax], al
add byte [rsi + 0x80000], al
add byte [rsi], al
add byte [rax], cl
add byte [rax], al
mov dl, 9
or cl, byte [rdi]
add byte [rax + rax], al
add byte [rax], al
add byte [rax], al
ror byte [rcx], 9
outsb dx, byte [rsi]
invalid
mov dword [rsp + 0x30], 0x70
lea rax, [rsp + 0x34]
mov rdi, rax
xor eax, eax
mov ecx, 0x6c
rep stosb byte [rdi], al
mov eax, 0x72
mov word [rsp + 0x20], ax
mov eax, 0x75
mov word [rsp + 0x22], ax
mov eax, 0x6e
mov word [rsp + 0x24], ax
mov eax, 0x61
mov word [rsp + 0x26], ax
mov eax, 0x73
mov word [rsp + 0x28], ax
xor eax, eax
mov word [rsp + 0x2a], ax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x60], 1
xor eax, eax
test eax, eax
je 0x1416ed722
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add byte [rax], al
add byte [rax], al
add ecx, dword cs:[rdi]
add eax, 0x4023f06
invalid
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add rsp, 0x2b0
pop rdi
ret
Function at 0x140011212
Capabilities:
Terminate process

Disassembly:
jmp 0x140013370
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14001129e
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400146c0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400146e0
xor al, al
jmp 0x140014761
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400146f3
xor al, al
jmp 0x140014761
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001471d
xor al, al
jmp 0x140014761
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014731
xor al, al
jmp 0x140014761
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014743
xor al, al
jmp 0x140014761
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001475f
xor al, al
jmp 0x140014761
mov al, 1
add rsp, 0x38
ret
Function at 0x140003594
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140003427
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test rax, rax
je 0x140003427
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003427
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003427
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003427
cmp dword [rcx + 0x84], 0xe
jbe 0x140003427
cmp dword [rcx + 0xf8], 0
je 0x140003427
mov ecx, ebx
call fcn.1400034c8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400032b8
cmp dword [rbp + 0x20], 0
je 0x140003474
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000347c
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400033c0
Function at 0x140071180
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
movsxd r13, edx
lea rsi, [0x14022eaf0]
cmp r13, 1
jle 0x1400713c2
mov ebp, 1
mov r15, r8
nop dword [rax + rax]
mov r14, qword [r8 + rbp*8]
cmp word [r14], 0x2d
jne 0x1400713ac
movzx eax, word [r14 + 2]
lea rbx, [r14 + 2]
cmp ax, 0x2d
jne 0x1400712dd
cmp word [r14 + 4], 0
lea rdi, [r14 + 4]
je 0x1400713ac
cmp dword [0x14022eaf0], 0
mov rbx, rsi
je 0x140071242
nop
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x140071239
mov rax, 0xffffffffffffffff
cmp word [rdx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140071210
movzx ecx, word [rdi + rax*2]
test cx, cx
je 0x14007122b
cmp cx, 0x3d
jne 0x140071239
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
cmp rax, rdi
je 0x14007125d
add rbx, 0x38
cmp dword [rbx], 0
jne 0x140071200
mov eax, 1
mov rdx, r14
mov ecx, eax
call fcn.1400710a0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, 0x3d
mov rcx, r14
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
je 0x14007128d
lea rdx, [rax + 2]
xor r8d, r8d
mov rcx, rbx
call fcn.140070eb0
test eax, eax
jne 0x140071247
mov r8, qword [rsp + 0x70]
jmp 0x1400713b6
mov edx, dword [rbx + 0x30]
cmp edx, dword [rbx + 0x18]
je 0x140071403
mov ecx, dword [rbx]
sub ecx, 2
je 0x1400712be
sub ecx, 1
je 0x1400713f9
sub ecx, 1
je 0x1400713f9
cmp ecx, 1
jne 0x1400712cd
mov eax, 4
jmp 0x140071247
mov rcx, qword [rbx + 0x10]
cmp byte [rcx], 0
sete al
mov byte [rcx], al
mov edx, dword [rbx + 0x30]
mov r8, qword [rsp + 0x70]
lea eax, [rdx + 1]
mov dword [rbx + 0x30], eax
jmp 0x1400713b6
test ax, ax
je 0x1400713ac
lea rdi, [rbp + 1]
lea rdi, [r8 + rdi*8]
nop
cmp dword [0x14022eaf0], 0
mov rax, rsi
je 0x140071242
movzx ecx, word [rbx]
cmp cx, word [rax + 4]
je 0x140071317
add rax, 0x38
cmp dword [rax], 0
jne 0x140071303
jmp 0x140071242
test rax, rax
je 0x140071242
add rbx, 2
cmp word [rbx], 0
jne 0x140071352
mov rdx, qword [rdi]
lea r8, [rsp + 0x68]
mov rcx, rax
call fcn.140070eb0
cmp dword [rsp + 0x68], 0
je 0x140071348
inc rbp
add rdi, 8
test eax, eax
jne 0x140071247
jmp 0x14007139b
mov r8d, dword [rax + 0x30]
cmp r8d, dword [rax + 0x18]
je 0x140071403
mov edx, dword [rax]
sub edx, 2
je 0x140071384
sub edx, 1
je 0x1400713f9
sub edx, 1
je 0x1400713f9
cmp edx, 1
je 0x1400712b7
jmp 0x140071394
mov rdx, qword [rax + 0x10]
cmp byte [rdx], 0
sete cl
mov byte [rdx], cl
mov r8d, dword [rax + 0x30]
lea ecx, [r8 + 1]
mov dword [rax + 0x30], ecx
cmp word [rbx], 0
jne 0x1400712f0
mov r8, qword [rsp + 0x70]
jmp 0x1400713b6
inc r12d
mov qword [r15], r14
add r15, 8
inc rbp
cmp rbp, r13
jl 0x1400711c0
cmp dword [0x14022eaf0], 0
je 0x1400713e1
nop dword [rax + rax]
mov qword [rsi + 0x10], 0
lea rsi, [rsi + 0x38]
cmp dword [rsi], 0
jne 0x1400713d0
mov rbx, qword [rsp + 0x60]
mov eax, r12d
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, 3
jmp 0x140071247
mov eax, 2
jmp 0x140071247
Function at 0x140073280
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x20
mov rax, rdx
movzx r15d, r8b
mov rsi, rcx
lea rdx, [0x140194740]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
test rax, rax
jne 0x1400732b7
lea eax, [rdi + 3]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
xor edx, edx
mov qword [rsp + 0x40], rbx
mov rcx, rdi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
movsxd rbx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
cmp ebx, 0xffffffff
jne 0x140073304
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea eax, [rbx + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
mov rcx, rbx
mov qword [rsp + 0x48], rbp
call fcn.140074030
mov rbp, rax
test rax, rax
jne 0x14007332a
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea eax, [rbp + 1]
jmp 0x1400733ae
mov qword [rsp + 0x50], r14
movabs rax, 0xcccccccccccccccd
mul rbx
mov r9, rdi
mov rcx, rbp
mov r14, rdx
mov edx, 5
shr r14, 2
movsxd rbx, r14d
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
cmp rax, rbx
je 0x140073377
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rbp
call fcn.140073fb0
mov eax, 0x37
jmp 0x1400733a9
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rax, [0x140076340]
mov dword [rsi + 0x2608], r15d
mov qword [rsi + 0x25f8], rax
xor eax, eax
mov dword [rsi + 0x260c], r14d
mov qword [rsi + 0x2600], rbp
mov byte [rsi + 0x2610], 1
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret

Function at 0x1400741d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov rbx, rdx
mov r10d, ecx
test r8, r8
jne 0x1400741e1
mov eax, ecx
pop rbx
ret
lea r11, [r8 - 1]
mov qword [rsp + 0x10], rdi
lea rdi, section..data
test r11, r11
je 0x140074230
nop word [rax + rax]
movzx eax, byte [rbx]
mov r9d, r11d
and r9d, 0x1f
inc rbx
mov ecx, r9d
neg ecx
mov r8d, dword [rdi + rax*4]
and ecx, 0x1f
mov edx, r8d
shr edx, cl
mov ecx, r9d
shl r8d, cl
or edx, r8d
xor r10d, edx
sub r11, 1
jne 0x140074200
movzx eax, byte [rbx]
xor r10d, dword [rdi + rax*4]
mov rdi, qword [rsp + 0x10]
mov eax, r10d
pop rbx
ret
Function at 0x14007af80
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
xor ecx, ecx
mov edx, 0x1f
cmp eax, 0xffffffff
mov dword [rbx], eax
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x14007afe0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
mov edx, 0x1f
test eax, eax
cmove ecx, edx
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1400a7de0
Capabilities:
Parse pe header

Disassembly:
cmp rdx, 0x40
jb 0x1400a7e3a
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400a7e3a
movsxd rax, dword [rcx + 0x3c]
test eax, eax
js 0x1400a7e3a
lea r8, [rax + 0x18]
cmp rdx, r8
jb 0x1400a7e3a
add rax, rcx
cmp dword [rax], 0x4550
jne 0x1400a7e3a
lea rcx, [r8 + 0xe0]
cmp rdx, rcx
jb 0x1400a7e3a
mov r10d, 0x20b
mov ecx, 0xf0
cmp word [rax + 0x18], r10w
mov r9d, 0xe0
cmovne ecx, r9d
add rcx, r8
cmp rdx, rcx
jae 0x1400a7e3c
xor eax, eax
ret
Function at 0x1400adff0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15d, dword [rcx]
lea rsi, [rdx + 8]
movsxd rbx, r8d
lea r13, [rcx + 8]
movabs r10, 0xaaaaaaaaaaaaaaab
mov r8d, 3
mov rax, r10
xor edi, edi
lea rbp, [rbx + r15]
mul rbp
mov rax, r10
shr rdx, 1
lea rcx, [rdx + rdx*2]
mov rdx, rbp
sub rdx, rcx
lea rcx, [r15*4 + 3]
sub r8d, edx
test rdx, rdx
cmove r8d, edi
mul rcx
movsxd rcx, r8d
lea rax, [rbx + 9]
shr rdx, 1
add rax, rdx
mov dword [r9], r8d
add rcx, rax
call fcn.140074030
mov r14, rax
test rax, rax
je 0x1400ae093
mov rcx, rbp
call fcn.140074030
mov rbp, rax
test rax, rax
jne 0x1400ae09a
mov rcx, r14
call fcn.140073fb0
xor eax, eax
jmp 0x1400ae1b5
test ebx, ebx
jle 0x1400ae0ad
mov r8, rbx
mov dl, 0x41
mov rcx, rbp
mov edi, ebx
call sub.VCRUNTIME140.dll_memset
movsxd rdi, edi
mov r8, r15
mov rdx, r13
lea rcx, [rdi + rbp]
call sub.VCRUNTIME140.dll_memcpy
lea r8, [rdi + r15]
mov rdx, rbp
lea rbx, [r14 + 8]
lea r9, [r8 + rbp]
cmp r8, 3
jl 0x1400ae146
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
sub r8, 3
shr rax, 2
movzx eax, byte [rax + rsi]
mov byte [rbx], al
movzx ecx, byte [rdx]
movzx eax, byte [rdx + 1]
and ecx, 3
shr rax, 4
shl rcx, 4
or rcx, rax
movzx eax, byte [rcx + rsi]
mov byte [rbx + 1], al
movzx ecx, byte [rdx + 1]
movzx eax, byte [rdx + 2]
and ecx, 0xf
shr rax, 6
shl rcx, 2
or rcx, rax
movzx eax, byte [rcx + rsi]
mov byte [rbx + 2], al
movzx eax, byte [rdx + 2]
add rdx, 3
and eax, 0x3f
movzx eax, byte [rax + rsi]
mov byte [rbx + 3], al
add rbx, 4
cmp r8, 3
jge 0x1400ae0e0
sub r9, rdx
je 0x1400ae1a1
movzx eax, byte [rdx]
shr rax, 2
movzx eax, byte [rax + rsi]
mov byte [rbx], al
movzx ecx, byte [rdx]
and ecx, 3
shl rcx, 4
cmp r9, 1
jne 0x1400ae173
movzx eax, byte [rcx + rsi]
mov byte [rbx + 1], al
mov al, 0x3d
jmp 0x1400ae190
movzx eax, byte [rdx + 1]
shr rax, 4
or rax, rcx
movzx eax, byte [rax + rsi]
mov byte [rbx + 1], al
movzx eax, byte [rdx + 1]
and eax, 0xf
movzx eax, byte [rsi + rax*4]
lea rcx, [rbx + 2]
mov rbx, rcx
mov byte [rcx], al
add rbx, 2
mov byte [rcx + 1], 0x3d
mov rcx, rbp
call fcn.140073fb0
sub ebx, r14d
mov rax, r14
sub ebx, 8
mov dword [r14], ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400be0c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
add r8d, 0xdeadbeef
mov rdi, rdx
add r8d, edx
mov r11, rcx
mov r10d, r8d
mov ebx, r8d
cmp rdx, 0xc
jbe 0x1400be1f3
mov qword [rsp + 0x10], rsi
lea r9, [rdx - 0xd]
movabs rax, 0xaaaaaaaaaaaaaaab
mul r9
mov rsi, rdx
shr rsi, 3
inc rsi
imul rax, rsi, 0xfffffffffffffff4
add rdi, rax
nop dword [rax]
movzx eax, byte [r11 + 6]
movzx ecx, byte [r11 + 7]
movzx r9d, byte [r11 + 4]
movzx edx, byte [r11 + 8]
add r9d, r10d
shl ecx, 8
add edx, r8d
add ecx, eax
movzx eax, byte [r11 + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 + 0xa]
shl ecx, 8
add r9d, ecx
movzx ecx, byte [r11 + 0xb]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 + 9]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 + 2]
shl ecx, 8
add edx, ecx
movzx ecx, byte [r11 + 3]
shl ecx, 8
mov r8d, edx
add ecx, eax
rol r8d, 4
movzx eax, byte [r11 + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11]
shl ecx, 8
add r11, 0xc
add ecx, eax
sub ecx, edx
add edx, r9d
add ecx, ebx
xor r8d, ecx
sub r9d, r8d
mov eax, r8d
add r8d, edx
rol eax, 6
xor eax, r9d
sub edx, eax
mov ecx, eax
add eax, r8d
rol ecx, 8
xor ecx, edx
sub r8d, ecx
mov ebx, ecx
add ecx, eax
rol ebx, 0x10
xor ebx, r8d
sub eax, ebx
mov r10d, ebx
ror r10d, 0xd
add ebx, ecx
xor r10d, eax
sub ecx, r10d
mov r8d, r10d
rol r8d, 4
add r10d, ebx
xor r8d, ecx
sub rsi, 1
jne 0x1400be110
mov rsi, qword [rsp + 0x10]
cmp rdi, 0xc
ja 0x1400be27c
lea rcx, [0x140000000]
mov eax, dword [rcx + rdi*4 + 0xbe2dc]
add rax, rcx
jmp rax
movzx eax, byte [r11 + 0xb]
shl eax, 0x18
add r8d, eax
movzx eax, byte [r11 + 0xa]
shl eax, 0x10
add r8d, eax
movzx eax, byte [r11 + 9]
shl eax, 8
add r8d, eax
movzx eax, byte [r11 + 8]
add r8d, eax
movzx eax, byte [r11 + 7]
shl eax, 0x18
add r10d, eax
movzx eax, byte [r11 + 6]
shl eax, 0x10
add r10d, eax
movzx eax, byte [r11 + 5]
shl eax, 8
add r10d, eax
movzx eax, byte [r11 + 4]
add r10d, eax
movzx eax, byte [r11 + 3]
shl eax, 0x18
add ebx, eax
movzx eax, byte [r11 + 2]
shl eax, 0x10
add ebx, eax
movzx eax, byte [r11 + 1]
shl eax, 8
add ebx, eax
movzx eax, byte [r11]
add ebx, eax
xor r8d, r10d
mov eax, r10d
rol eax, 0xe
sub r8d, eax
mov eax, r8d
mov edx, r8d
rol eax, 0xb
xor edx, ebx
sub edx, eax
xor r10d, edx
mov eax, edx
ror eax, 7
sub r10d, eax
xor r8d, r10d
mov eax, r10d
rol eax, 0x10
sub r8d, eax
mov eax, r8d
mov ecx, r8d
rol eax, 4
xor ecx, edx
sub ecx, eax
xor r10d, ecx
mov eax, ecx
rol eax, 0xe
sub r10d, eax
mov eax, r10d
xor r8d, r10d
ror eax, 8
sub r8d, eax
mov eax, r8d
mov rbx, qword [rsp + 0x18]
pop rdi
ret

Function at 0x1400c1c50
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140193520
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1400ef250
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140193520
sub rsp, rax
lea rcx, [0x140231c00]
add rsp, 0x28
jmp fcn.1400c1ab0
Function at 0x140128870
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38
call fcn.140193520
sub rsp, rax
mov r10, rdx
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
add rdx, 0xf
lea rax, [r8 + 0xf]
mov r11, rcx
cmp r10, rax
ja 0x1401288a0
xor r9d, r9d
cmp rdx, r8
jae 0x1401288b9
movdqu xmm1, xmmword [r10]
movdqu xmm0, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [r10], xmm1
mov r9d, reloc.WS2_32.dll_recv
cmp r9, 0x10
jae 0x1401288e1
sub r8, r10
lea rax, [r9 + r10]
mov edx, reloc.WS2_32.dll_recv
sub rdx, r9
nop
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1401288d0
mov rcx, qword [r11 + 8]
lea r8, [rsp + 0x40]
mov r9, r10
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rdx, r10
call fcn.1400c6220
test eax, eax
je 0x140128912
cmp dword [rsp + 0x40], 0x10
jne 0x140128912
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret

Function at 0x140128ac0
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x140128b48
test r8, r8
je 0x140128b48
mov rax, qword [rcx + 0x18]
cmp r8, rax
mov r9, rax
cmovb r9, r8
test r9, r9
je 0x140128b06
add rcx, 0x20
mov r11, rdx
sub r11, r10
nop
movzx eax, byte [r11 + rcx - 0x20]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x140128af0
mov rax, qword [r10 + 0x18]
cmp r8, rax
jbe 0x140128b48
sub r8, rax
mov eax, reloc.WS2_32.dll_recv
cmp r8, rax
cmova r8, rax
xor ecx, ecx
test r8, r8
je 0x140128b48
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + 0x18]
add rax, rcx
movzx eax, byte [rax + rdx]
xor byte [r10 + rcx + 0x40], al
inc rcx
cmp rcx, r8
jb 0x140128b30
ret

Function at 0x140172810
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38
call fcn.140193520
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x140172839
lea rax, [0x140170e80]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.140169be0
lea rax, [0x140170040]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.140169930