joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14017b400
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140431178]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
cmp qword [rcx + 0x4f0], 0xffffffffffffffff
je 0x14017b47e
mov ecx, 2
call fcn.14031c98c
mov rcx, rax
mov dword [rsp + 0x20], 0x5e
lea r9, str.C:UsersAdmin_vcpkg_buildtreeszeromq_src_v4.3.5_37c87b6b8c.clean_srcipc_connecter.cpp
lea r8, str._s__retired_fd
lea rdx, str.Assertion_failed:__s___s:_d__n
call fcn.140145b70
mov ecx, 2
call fcn.14031c98c
mov rcx, rax
call fcn.14031cde4
lea rcx, str._s__retired_fd
call fcn.140146920
xor r8d, r8d
mov edx, 1
mov ecx, edx
call fcn.140159880
mov qword [rdi + 0x4f0], rax
cmp rax, 0xffffffffffffffff
je 0x14017b507
mov rcx, rax
call fcn.140159ae0
mov rcx, qword [rdi + 0x4e8]
mov rcx, qword [rcx + 0x48]
call fcn.140166eb0
mov ebx, eax
mov rcx, qword [rdi + 0x4e8]
mov rcx, qword [rcx + 0x48]
call fcn.14014b420
mov rdx, rax
mov r8d, ebx
mov rcx, qword [rdi + 0x4f0]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x14017b610
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea ecx, [rax - 0x2733]
cmp ecx, 1
jbe 0x14017b600
call fcn.14031577c
mov rbx, rax
mov ecx, esi
call fcn.140146670
mov dword [rbx], eax
call fcn.14031577c
cmp dword [rax], 0x70
jne 0x14017b638
mov rdx, qword [rdi + 0x4f0]
lea rcx, [rdi + 0x4d8]
call fcn.140178220
mov qword [rdi + 0x4f8], rax
mov rdx, rax
lea rcx, [rdi + 0x4d8]
call fcn.140178420
lea rdx, [rdi + 0x500]
lea rcx, [rsp + 0x30]
call fcn.140162670
mov rbx, rax
call fcn.140145df0
mov r8d, eax
mov rdx, rbx
mov rcx, qword [rdi + 0x520]
call fcn.140155860
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14017b5a7
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017b5a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14017b6ae
call fcn.14030e898
movdqa xmm0, xmmword [0x14034a850]
movdqa xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14017b689
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017b5f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14017b6ae
call fcn.14030e898
jmp 0x14017b689
call fcn.14031577c
mov dword [rax], reloc.WS2_32.dll_WSASetLastError
jmp 0x14017b507
mov rdx, qword [rdi + 0x4f0]
lea rcx, [rdi + 0x4d8]
call fcn.140178220
mov qword [rdi + 0x4f8], rax
lea rcx, [rdi + 0x4d8]
call fcn.14017b170
jmp 0x14017b689
test byte [rdi + 0x15c], 4
je 0x14017b66f
call fcn.14031577c
cmp dword [rax], 0x6b
jne 0x14017b66f
mov rcx, qword [rdi + 0x520]
call fcn.140156000
test al, al
je 0x14017b66f
cmp qword [rdi + 0x4f0], 0xffffffffffffffff
je 0x14017b689
mov rcx, rdi
call fcn.140188530
jmp 0x14017b689
cmp qword [rdi + 0x4f0], 0xffffffffffffffff
je 0x14017b681
mov rcx, rdi
call fcn.140188530
mov rcx, rdi
call fcn.140188430
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14030f0d0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.140315630
int3
Function at 0x140184310
Capabilities:
Send data
Send data on socket

Disassembly:
mov rcx, qword [rcx + 0x578]
jmp fcn.1401745d0

Function at 0x140189130
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x60
cmp qword [rdx + 0x18], 0xff
mov rdi, rdx
mov r14, rcx
jbe 0x1401891a5
mov ecx, 2
call fcn.14031c98c
mov rcx, rax
mov dword [rsp + 0x20], 0xd0
lea r9, str.C:UsersAdmin_vcpkg_buildtreeszeromq_src_v4.3.5_37c87b6b8c.clean_src_socks.cpp
lea r8, str.req_.hostname.size______UINT8_MAX
lea rdx, str.Assertion_failed:__s___s:_d__n
call fcn.140145b70
mov ecx, 2
call fcn.14031c98c
mov rcx, rax
call fcn.14031cde4
lea rcx, str.req_.hostname.size______UINT8_MAX
call fcn.140146920
lea rbx, [r14 + 0x10]
xorps xmm0, xmm0
mov byte [rbx], 5
lea rsi, [rdi + 8]
movzx eax, byte [rdi]
mov rcx, rsi
mov byte [rbx + 1], al
mov byte [rbx + 2], 0
cmp qword [rsi + 0x18], 0x10
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x80], 0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x30], 4
movups xmmword [rsp + 0x50], xmm0
jb 0x1401891ed
mov rcx, qword [rsi]
lea r9, [rsp + 0x80]
xor edx, edx
lea r8, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov rbp, qword [rsp + 0x80]
mov r15d, eax
test eax, eax
jne 0x140189248
mov ecx, dword [rbp + 4]
cmp ecx, 2
jne 0x14018922d
mov rax, qword [rbp + 0x20]
mov byte [rbx + 3], 1
mov eax, dword [rax + 4]
mov dword [rbx + 4], eax
add rbx, 8
jmp 0x140189279
cmp ecx, 0x17
jne 0x140189248
mov rax, qword [rbp + 0x20]
mov byte [rbx + 3], 4
movups xmm0, xmmword [rax + 8]
movups xmmword [rbx + 4], xmm0
add rbx, 0x14
jmp 0x140189279
mov byte [rbx + 3], 3
movzx eax, byte [rdi + 0x18]
mov byte [rbx + 4], al
add rbx, 5
cmp qword [rsi + 0x18], 0x10
jb 0x140189261
mov rsi, qword [rsi]
mov r8, qword [rdi + 0x18]
mov rdx, rsi
mov rcx, rbx
call fcn.14030fae0
add rbx, qword [rdi + 0x18]
test r15d, r15d
jne 0x140189282
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
movzx eax, byte [rdi + 0x29]
lea r11, [rsp + 0x60]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov byte [rbx], al
inc rbx
movzx eax, byte [rdi + 0x28]
mov byte [rbx], al
sub rbx, r14
sub rbx, 0xf
mov qword [r14 + 8], 0
mov qword [r14], rbx
mov rbx, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1401a4360
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
push r12
push r15
mov eax, gethostbyname
call fcn.14030f180
sub rsp, rax
mov rsi, qword [rsp + 0x88]
mov r10, r9
mov rdi, r8
mov r15, rdx
mov r12, rcx
mov ebx, dword [rsi]
test ebx, ebx
jns 0x1401a43a5
mov dword [rsi], 0xffffffff
add rsp, 0x30
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x60], rbp
mov rbp, qword [rsp + 0x80]
test ebx, ebx
je 0x1401a43d8
test rdi, rdi
je 0x1401a43d8
mov eax, ebx
dec rdi
movzx ecx, byte [rax + rbp]
xor cl, byte [r12]
inc r12
mov byte [r15], cl
inc r15
inc ebx
and ebx, 0xf
jne 0x1401a43b6
mov r9, qword [rsp + 0x90]
cmp rdi, 0x10
jb 0x1401a44a9
mov qword [rsp + 0x28], r13
mov rsi, r15
mov r13, rdi
mov qword [rsp + 0x20], r14
shr r13, 4
mov r14, r12
imul rax, r13, 0xfffffffffffffff0
sub rsi, rbp
sub r14, rbp
add rdi, rax
mov rax, r13
shl rax, 4
add r15, rax
mov qword [rsp + 0x68], r15
add r12, rax
mov r15, qword [rsp + 0x78]
nop word [rax + rax]
mov r8, r15
mov rdx, rbp
mov rcx, rbp
call r9
cmp ebx, 0x10
jae 0x1401a4475
mov edx, reloc.WS2_32.dll_ntohs
mov eax, ebx
sub edx, ebx
add rax, rbp
shr edx, 3
inc edx
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r14 + rax]
xor rcx, qword [rax]
mov qword [rsi + rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1401a4460
mov r9, qword [rsp + 0x90]
add rsi, 0x10
add r14, 0x10
xor ebx, ebx
sub r13, 1
jne 0x1401a4430
mov r15, qword [rsp + 0x68]
mov r10, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
test rdi, rdi
je 0x1401a44d6
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r9
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r12]
xor al, byte [rcx + rbp]
mov byte [rcx + r15], al
sub rdi, 1
jne 0x1401a44c0
mov dword [rsi], ebx
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401a4a40
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push r14
mov eax, 0x20
call fcn.14030f180
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov rbx, r8
mov r14, rdx
mov rbp, rcx
je 0x1401a4a70
mov eax, 0xfffffffe
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov rcx, qword [rcx + 0x30]
movabs rax, 0x2000000000000000
add rcx, rbx
cmp rcx, rax
ja 0x1401a4b62
cmp rcx, rbx
jb 0x1401a4b62
mov qword [rsp + 0x40], rsi
mov esi, dword [rbp + 0x17c]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
mov qword [rbp + 0x30], rcx
test esi, esi
je 0x1401a4ae6
test rbx, rbx
je 0x1401a4b42
movzx eax, byte [r14]
dec rbx
mov ecx, esi
inc r14
xor byte [rcx + rbp + 0x40], al
inc esi
and esi, 0xf
jne 0x1401a4ab0
lea r12, [rbp + 0x60]
lea rdi, [rbp + 0x40]
mov rdx, r12
mov rcx, rdi
call qword [rbp + 0x170]
jmp 0x1401a4aee
lea r12, [rbp + 0x60]
lea rdi, [rbp + 0x40]
mov qword [rsp + 0x58], r15
mov r15, rbx
and r15, 0xfffffffffffffff0
je 0x1401a4b14
mov r9, r15
mov r8, r14
mov rdx, r12
mov rcx, rdi
call qword [rbp + 0x168]
add r14, r15
sub rbx, r15
mov r15, qword [rsp + 0x58]
test rbx, rbx
je 0x1401a4b42
mov esi, ebx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r14 + rdi - 0x40]
xor byte [rdi], al
lea rdi, [rdi + 1]
sub rbx, 1
jne 0x1401a4b30
mov rdi, qword [rsp + 0x48]
xor eax, eax
mov r12, qword [rsp + 0x50]
mov dword [rbp + 0x17c], esi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov eax, 0xffffffff
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
Function at 0x1401a5b50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r13
mov eax, 0x28
call fcn.14030f180
sub rsp, rax
xor r13d, r13d
mov rdi, r8
mov qword [rcx + 0x30], r13
mov rsi, rdx
mov qword [rcx + 0x38], r13
mov rbx, rcx
mov qword [rcx + 0x178], r13
cmp r8, 0xc
jne 0x1401a5ba2
movsd xmm0, qword [rdx]
lea edi, [r8 - 0xb]
movsd qword [rcx], xmm0
mov eax, dword [rdx + 8]
mov dword [rcx + 8], eax
mov dword [rcx + 0xc], 0x1000000
jmp 0x1401a5ce0
mov qword [rsp + 0x50], rbp
mov rbp, rdi
mov qword [rsp + 0x58], r12
mov qword [rcx + 0x40], r13
mov qword [rsp + 0x60], r14
mov qword [rcx + 0x48], r13
cmp rdi, 0x10
jb 0x1401a5c70
mov qword [rsp + 0x20], r15
mov r15, rdi
shr r15, 4
imul rax, r15, 0xfffffffffffffff0
add rdi, rax
nop dword [rax]
movzx eax, byte [rsi]
lea rdx, [rbx + 0x60]
xor byte [rbx + 0x40], al
lea rcx, [rbx + 0x40]
movzx eax, byte [rsi + 1]
xor byte [rbx + 0x41], al
movzx eax, byte [rsi + 2]
xor byte [rbx + 0x42], al
movzx eax, byte [rsi + 3]
xor byte [rbx + 0x43], al
movzx eax, byte [rsi + 4]
xor byte [rbx + 0x44], al
movzx eax, byte [rsi + 5]
xor byte [rbx + 0x45], al
movzx eax, byte [rsi + 6]
xor byte [rbx + 0x46], al
movzx eax, byte [rsi + 7]
xor byte [rbx + 0x47], al
movzx eax, byte [rsi + 8]
xor byte [rbx + 0x48], al
movzx eax, byte [rsi + 9]
xor byte [rbx + 0x49], al
movzx eax, byte [rsi + 0xa]
xor byte [rbx + 0x4a], al
movzx eax, byte [rsi + 0xb]
xor byte [rbx + 0x4b], al
movzx eax, byte [rsi + 0xc]
xor byte [rbx + 0x4c], al
movzx eax, byte [rsi + 0xd]
xor byte [rbx + 0x4d], al
movzx eax, byte [rsi + 0xe]
xor byte [rbx + 0x4e], al
movzx eax, byte [rsi + 0xf]
xor byte [rbx + 0x4f], al
call qword [rbx + 0x170]
add rsi, 0x10
sub r15, 1
jne 0x1401a5be0
mov r15, qword [rsp + 0x20]
test rdi, rdi
je 0x1401a5c9f
lea rcx, [rbx + 0x40]
sub rsi, rbx
nop dword [rax]
movzx eax, byte [rsi + rcx - 0x40]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdi, 1
jne 0x1401a5c80
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
call qword [rbx + 0x170]
shl rbp, 3
lea rdx, [rbx + 0x60]
bswap rbp
xor qword [rbx + 0x48], rbp
lea rcx, [rbx + 0x40]
call qword [rbx + 0x170]
mov rax, qword [rbx + 0x40]
mov edi, dword [rbx + 0x4c]
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov qword [rbx], rax
mov rax, qword [rbx + 0x48]
mov qword [rbx + 8], rax
bswap edi
nop dword [rax + rax]
mov qword [rbx + 0x40], r13
lea rdx, [rbx + 0x20]
mov qword [rbx + 0x48], r13
mov rcx, rbx
mov r8, qword [rbx + 0x188]
call qword [rbx + 0x180]
inc edi
bswap edi
mov dword [rbx + 0xc], edi
add rsp, 0x28
pop r13
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401a9860
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r11, rdx
movsxd rdi, r9d
lea rsi, [rcx - 1]
mov r10, r8
not rcx
shr rsi, 0x3f
shr rcx, 0x3f
and rsi, rcx
mov ecx, dword [rdx + 8]
xor ecx, dword [r8 + 8]
dec rsi
and ecx, esi
xor dword [rdx + 8], ecx
xor dword [r8 + 8], ecx
mov edx, dword [rdx + 0x10]
movq xmm4, rsi
xor edx, dword [r8 + 0x10]
and edx, esi
punpcklqdq xmm4, xmm4
xor dword [r11 + 0x10], edx
xor dword [r8 + 0x10], edx
mov ecx, dword [r11 + 0x14]
mov edx, ecx
mov eax, dword [r8 + 0x14]
xor rdx, rax
and edx, 4
and rdx, rsi
mov eax, edx
xor eax, ecx
xor ecx, ecx
mov dword [r11 + 0x14], eax
xor dword [r8 + 0x14], edx
mov edx, ecx
test r9d, r9d
jle 0x1401a997d
cmp edi, 2
jb 0x1401a997d
mov r9, qword [r8]
lea rax, [rdi - 1]
mov r8, qword [r11]
lea rbx, [rdi - 1]
lea rbx, [r9 + rbx*8]
lea rax, [r8 + rax*8]
cmp r9, rax
ja 0x1401a990c
cmp rbx, r8
jae 0x1401a997d
cmp r9, r10
ja 0x1401a9916
cmp rbx, r10
jae 0x1401a997d
cmp r9, r11
ja 0x1401a9920
cmp rbx, r11
jae 0x1401a997d
cmp r8, r10
ja 0x1401a992a
cmp rax, r10
jae 0x1401a997d
cmp r8, r11
ja 0x1401a9934
cmp rax, r11
jae 0x1401a997d
mov eax, edi
and eax, 0xfffffffe
nop dword [rax]
movdqu xmm2, xmmword [rcx + r9]
add edx, 2
movdqu xmm1, xmmword [rcx + r8]
lea rcx, [rcx + 0x10]
movdqa xmm3, xmm2
pxor xmm3, xmm1
pand xmm3, xmm4
movdqa xmm0, xmm3
pxor xmm3, xmm2
pxor xmm0, xmm1
movdqu xmmword [rcx + r8 - 0x10], xmm0
movdqu xmmword [rcx + r9 - 0x10], xmm3
cmp edx, eax
jl 0x1401a9940
movsxd rax, edx
cmp rax, rdi
jge 0x1401a99bd
nop word [rax + rax]
mov rcx, qword [r11]
mov rdx, qword [rcx + rax*8]
lea r8, [rcx + rax*8]
mov rcx, qword [r10]
mov r9, rdx
xor r9, qword [rcx + rax*8]
and r9, rsi
xor rdx, r9
mov qword [r8], rdx
mov rcx, qword [r10]
xor qword [rcx + rax*8], r9
inc rax
cmp rax, rdi
jl 0x1401a9990
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1401aa230
Capabilities:
Encode data using xor

Disassembly:
push rbx
test byte [rcx + 0x14], 4
mov rbx, rdx
mov r10, qword [rcx]
mov r11, qword [rdx]
je 0x1401aa318
mov eax, dword [rdx + 8]
cmp dword [rcx + 8], eax
jne 0x1401aa318
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov edi, r9d
test eax, eax
jle 0x1401aa30e
sub r10, r11
nop word [rax + rax]
mov r8, qword [r10 + r11]
inc edi
mov rdx, qword [r11]
lea r11, [r11 + 8]
mov rcx, r8
shr rdx, 0x3f
sub r8, qword [r11 - 8]
shr r8, 0x3f
xor r8d, edx
shr rcx, 0x3f
xor edx, ecx
or r8d, edx
xor r8d, ecx
neg r8d
mov dword [rsp + 0x18], r8d
not r8d
mov dword [rsp + 0x10], r8d
mov eax, dword [rsp + 0x10]
and eax, r9d
mov r9d, dword [rsp + 0x18]
mov r8, qword [r11 - 8]
or r9d, eax
mov rdx, qword [r10 + r11 - 8]
mov rcx, r8
sub r8, qword [r10 + r11 - 8]
shr r8, 0x3f
shr rcx, 0x3f
shr rdx, 0x3f
xor r8d, edx
xor edx, ecx
or r8d, edx
xor r8d, ecx
neg r8d
mov dword [rsp + 0x18], r8d
not r8d
mov dword [rsp + 0x10], r8d
mov ecx, dword [rsp + 0x10]
and ecx, r9d
mov r9d, dword [rsp + 0x18]
and r9d, 1
or r9d, ecx
cmp edi, dword [rbx + 8]
jl 0x1401aa270
mov rdi, qword [rsp + 0x20]
mov eax, r9d
pop rbx
ret
mov edx, dword [rcx + 8]
mov eax, edx
sub eax, dword [rbx + 8]
jne 0x1401aa348
lea eax, [rdx - 1]
movsxd rcx, eax
test eax, eax
js 0x1401aa346
lea rax, [r11 + rcx*8]
sub r10, r11
mov rdx, qword [rax + r10]
cmp rdx, qword [rax]
jne 0x1401aa34a
sub rax, 8
sub rcx, 1
jns 0x1401aa333
xor eax, eax
pop rbx
ret
mov eax, 0xffffffff
mov ecx, 1
cmova eax, ecx
pop rbx
ret

Function at 0x1401ac920
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.14030f180
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1401acb10
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
push rdi
push r13
mov eax, gethostbyname
call fcn.14030f180
sub rsp, rax
mov eax, dword [0x14043a1b4]
mov r13d, ecx
mov ebx, 1
cmp eax, 2
je 0x1401acb8c
nop word [rax + rax]
xor eax, eax
lock cmpxchg dword [0x14043a1b4], ebx
je 0x1401acb66
cmp eax, ebx
je 0x1401acb40
mov eax, dword [0x14043a1b4]
cmp eax, 2
je 0x1401acb8c
xor eax, eax
add rsp, 0x30
pop r13
pop rdi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
lea r8, [0x1401aca30]
xor edx, edx
xor ecx, ecx
mov dword [0x14043a1b0], eax
call fcn.1401bd220
mov dword [0x14043a1b4], 2
mov r8d, 0x97
lea rdx, str.crypto_threads_win.c
lea ecx, [r8 - 0x3f]
call fcn.140196e40
mov rdi, rax
test rax, rax
jne 0x1401acbb3
add rsp, 0x30
pop r13
pop rdi
pop rbx
ret
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
call fcn.1401cb370
mov qword [rdi + 0x30], rax
call fcn.1401caf90
mov qword [rdi + 0x40], rax
call fcn.1401caf90
mov qword [rdi + 0x50], rax
call fcn.1401cb370
mov qword [rdi + 0x38], rax
call fcn.1401cb370
cmp r13d, ebx
mov qword [rdi + 0x48], rax
mov r8d, 0x85
lea rdx, str.crypto_threads_win.c
cmovge ebx, r13d
inc ebx
movsxd rbx, ebx
lea rcx, [rbx*8]
call fcn.140196e40
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x10], rax
test rax, rax
je 0x1401acc4f
cmp qword [rdi + 0x40], 0
je 0x1401acc4f
cmp qword [rdi + 0x50], 0
je 0x1401acc4f
cmp qword [rdi + 0x30], 0
je 0x1401acc4f
cmp qword [rdi + 0x38], 0
je 0x1401acc4f
cmp qword [rdi + 0x48], 0
jne 0x1401acca8
mov r8d, 0xa8
lea rdx, str.crypto_threads_win.c
mov rcx, rax
call fcn.140196bb0
lea rcx, [rdi + 0x40]
call fcn.1401caef0
lea rcx, [rdi + 0x50]
call fcn.1401caef0
lea rcx, [rdi + 0x38]
call fcn.1401cb300
lea rcx, [rdi + 0x48]
call fcn.1401cb300
lea rcx, [rdi + 0x30]
call fcn.1401cb300
mov r8d, 0xae
lea rdx, str.crypto_threads_win.c
mov rcx, rdi
call fcn.140196bb0
xor edi, edi
mov r15, qword [rsp + 0x20]
mov rax, rdi
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop r13
pop rdi
pop rbx
ret
Function at 0x1401accd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
mov eax, 0x20
call fcn.14030f180
sub rsp, rax
mov rbx, rcx
lea esi, [rax - 0x21]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x14043a1b0]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov r14, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14, r14
jne 0x1401acd5e
mov r8d, 0xdd
lea rdx, str.crypto_threads_win.c
lea ecx, [r8 + 0x13]
call fcn.140196e40
mov r14, rax
test rax, rax
jne 0x1401acd4f
mov r8d, 0xde
lea rdx, str.crypto_threads_win.c
lea rcx, str.assertion_failed:_data___NULL
call fcn.140196e80
mov ecx, dword [0x14043a1b0]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
mov rax, r14
cmp qword [rax], 0
jne 0x1401acd6f
cmp esi, 0xffffffff
cmove esi, ecx
cmp qword [rax + 0x10], rbx
je 0x1401ace4f
inc ecx
add rax, 0x18
cmp ecx, 0xa
jl 0x1401acd63
prefetchw byte [rbx + 0x24]
mov eax, dword [rbx + 0x24]
nop dword [rax + rax]
mov ecx, eax
lock cmpxchg dword [rbx + 0x24], ecx
jne 0x1401acd90
mov rdx, qword [rbx + 0x10]
mov ecx, 1
mov r8d, eax
lea r9, [r8*8]
lock xadd qword [rdx + r9], rcx
prefetchw byte [rbx + 0x24]
mov eax, dword [rbx + 0x24]
nop word [rax + rax]
mov ecx, eax
lock cmpxchg dword [rbx + 0x24], ecx
jne 0x1401acdc0
cmp r8d, eax
je 0x1401ace2e
nop
mov rcx, qword [rbx + 0x10]
mov rax, 0xffffffffffffffff
lock xadd qword [rcx + r9], rax
prefetchw byte [rbx + 0x24]
mov eax, dword [rbx + 0x24]
nop dword [rax + rax]
mov ecx, eax
lock cmpxchg dword [rbx + 0x24], ecx
jne 0x1401acdf0
mov rcx, qword [rbx + 0x10]
mov r8d, eax
mov eax, 1
lea r9, [r8*8]
lock xadd qword [rcx + r9], rax
prefetchw byte [rbx + 0x24]
mov eax, dword [rbx + 0x24]
nop word [rax + rax]
mov ecx, eax
lock cmpxchg dword [rbx + 0x24], ecx
jne 0x1401ace20
cmp r8d, eax
jne 0x1401acdd0
movsxd rax, esi
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x10]
lea rdx, [r14 + rcx*8]
mov dword [rdx + 8], 1
mov qword [rdx + 0x10], rbx
lea rcx, [rax + r8*8]
mov qword [rdx], rcx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1401ace70
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x20
call fcn.14030f180
sub rsp, rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x14043a1b0]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r9d, r9d
lea rdx, [rsi + 0x10]
xor r8d, r8d
cmp qword [rdx], rdi
je 0x1401aced9
inc r9d
inc r8
add rdx, 0x18
cmp r8, 0xa
jl 0x1401aceb4
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movsxd rax, r9d
lea rcx, [rax + rax*2]
add dword [rsi + rcx*8 + 8], 0xffffffff
lea rbx, [rsi + rcx*8]
jne 0x1401acf28
mov rax, qword [rbx]
mov rcx, 0xffffffffffffffff
lock xadd qword [rax], rcx
cmp rcx, 1
jns 0x1401acf19
mov r8d, 0x10b
lea rdx, str.crypto_threads_win.c
lea rcx, str.assertion_failed:_ret___0
call fcn.140196e80
mov qword [rbx], 0
mov qword [rbx + 0x10], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1401ad830
Capabilities:
Encode data using add xor sub operations

Disassembly:
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x1401ad89c
movzx ecx, byte [rcx]
test cl, cl
je 0x1401ad89c
mov r11d, 0x100
nop word [rax + rax]
movsx r9d, cl
lea r10, [r10 + 1]
or r9d, r11d
mov r8d, eax
mov edx, r9d
mov ecx, 0x20
shr edx, 2
add r11d, 0x100
xor edx, r9d
imul r9d, r9d
and edx, 0xf
sub ecx, edx
shr r8, cl
mov ecx, edx
mov edx, eax
mov eax, r8d
shl edx, cl
movzx ecx, byte [r10]
or eax, edx
xor eax, r9d
test cl, cl
jne 0x1401ad850
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
ret

Function at 0x1401ad960
Capabilities:
Encode data using add xor sub operations

Disassembly:
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x1401ad9d0
movzx ecx, byte [rcx]
test cl, cl
je 0x1401ad9d0
mov r11d, 0x100
nop word [rax + rax]
movsx r9d, cl
lea r10, [r10 + 1]
mov r8d, eax
and r9d, 0xffffffdf
or r9d, r11d
mov ecx, 0x20
mov edx, r9d
add r11d, 0x100
shr edx, 2
xor edx, r9d
imul r9d, r9d
and edx, 0xf
sub ecx, edx
shr r8, cl
mov ecx, edx
mov edx, eax
mov eax, r8d
shl edx, cl
movzx ecx, byte [r10]
or eax, edx
xor eax, r9d
test cl, cl
jne 0x1401ad980
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
ret
Function at 0x1401bc860
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, gethostbyname
call fcn.14030f180
sub rsp, rax
lea edx, [rax - 0x2f]
mov rbx, rcx
call fcn.1401bc440
mov rdx, rax
mov rcx, rbx
mov rbp, rax
call fcn.1401bc320
xor edi, edi
mov r14, rax
test rax, rax
je 0x1401bc907
lea r9d, [rdi + 1]
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
mov esi, edi
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1401bc8e3
mov rcx, qword [rsp + 0x58]
mov r8, r14
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rsi, rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rsi*8]
mov rdx, rsi
mov rcx, rbx
call fcn.1401bc3d0
mov rcx, rbx
call fcn.1401bc590
test rax, rax
jne 0x1401bc99b
mov edx, 1
mov rcx, rbx
call fcn.1401bc440
mov rdx, rax
mov rcx, rbx
mov rsi, rax
call fcn.1401bc320
mov rbp, rax
test rax, rax
je 0x1401bc993
mov r9d, reloc.WS2_32.dll_shutdown
mov dword [rsp + 0x20], 0xf0000040
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1401bc973
mov rcx, qword [rsp + 0x58]
mov r8, rbp
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rdi, rsi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rdi*8]
mov rdx, rdi
mov rcx, rbx
call fcn.1401bc3d0
mov rcx, rbx
call fcn.1401bc590
test rax, rax
jne 0x1401bc99b
mov rcx, rbx
call fcn.1401bc590
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret