joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bd980
Capabilities:
Decode data using base64 via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rbx, r9
mov r14, r8
mov rdi, rdx
mov rsi, rcx
lea r15, [rsp + 0x38]
mov rcx, r15
mov rdx, r8
mov r8, r9
call fcn.14023c4d0
cmp qword [rsp + 0x38], 0
je 0x1400bd9e8
lea rdx, str.invalid_utf_81.3.14.3.2.26
mov r8d, 0xd
mov cl, 0x15
call fcn.1400bc850
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
call fcn.1400bec20
cmp rdx, 5
jb 0x1400bda16
mov ecx, 0x2d2d2d2d
xor ecx, dword [rax]
movzx r8d, byte [rax + 4]
xor r8d, 0x2d
or r8d, ecx
je 0x1400bdb0f
mov rax, rbx
shr rax, 0x20
jne 0x1400bdb9d
mov dword [rsp + 0x38], 0
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], r15
mov rcx, r14
mov edx, ebx
mov r8d, 6
xor r9d, r9d
call sub.crypt32.dll_CryptStringToBinaryA
test eax, eax
je 0x1400bda7f
mov r12d, dword [rsp + 0x38]
test r12, r12
je 0x1400bda91
mov edx, 1
mov rcx, r12
call fcn.14000ea60
mov r13, rax
test rax, rax
jne 0x1400bda97
mov ecx, 1
mov rdx, r12
call fcn.140226c80
ud2
call fcn.1401f5ba0
shl rax, 0x20
or rax, 2
jmp 0x1400bd9ca
mov r13d, 1
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], r15
mov rcx, r14
mov edx, ebx
mov r8d, 6
mov r9, r13
call sub.crypt32.dll_CryptStringToBinaryA
test eax, eax
je 0x1400bdad8
mov rcx, rsi
mov rdx, rdi
mov r8, r13
mov r9, r12
call fcn.1400bd8b0
test r12, r12
jne 0x1400bdaf9
jmp 0x1400bd9d5
call fcn.1401f5ba0
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
test r12, r12
je 0x1400bd9d5
mov r8d, 1
mov rcx, r13
mov rdx, r12
call fcn.14000ea40
jmp 0x1400bd9d5
cmp rdx, 0x1b
jb 0x1400bdb8b
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0xb]
pcmpeqb xmm1, xmmword [str.PRIVATE_KEY__________BEGIN_PRIVA_____END_PRIVATEassertion_failed:_der.len_____u32::max_value___as_usize_home_admin_.local_share_cargo_registry_src_index.crates.io_6f17d22bba15001f_schannel_0.1.23_src_crypt_prov.rs]
pcmpeqb xmm0, xmmword [0x140269fa0]
pand xmm0, xmm1
pmovmskb ecx, xmm0
cmp ecx, 0xffff
jne 0x1400bdb8b
movabs rcx, 0x2d2d2d2d2d59454b
movabs r8, 0x2045544156495250
movdqu xmm0, xmmword [rdx + rax - 0x19]
movdqu xmm1, xmmword [rdx + rax - 0x10]
movq xmm2, r8
movq xmm3, rcx
punpcklqdq xmm2, xmm3
pcmpeqb xmm0, xmmword [0x140269fb0]
pcmpeqb xmm2, xmm1
pand xmm0, xmm2
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x1400bda16
lea rdx, [0x14026a0d1]
mov r8d, 0x50
jmp 0x1400bd9c3
lea rcx, [0x14026a121]
lea r8, [0x14026a160]
mov edx, 0x38
call fcn.140235da0
ud2

Function at 0x1400bdf50
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x20]
mov edx, 0x53
call sub.secur32.dll_QueryContextAttributesW
mov edx, eax
xor eax, eax
test edx, edx
setne cl
jne 0x1400bdf83
mov rdx, qword [rsp + 0x20]
mov al, cl
add rsp, 0x28
ret
shl rdx, 0x20
or rdx, 2
mov al, cl
add rsp, 0x28
ret
Function at 0x1400c5240
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x1400c52d6
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [0x14026c660]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x14026c670]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1400c84c0
test rdi, rdi
je 0x1400c5365
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x1400c537e
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x1400c5476
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x1400c54f8
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x1400c5483
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x1400c5340
cmp r9, 8
jae 0x1400c548c
jmp 0x1400c54f8
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1400c84c0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x1400c54f8
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x1400c54f8
mov r8, rcx
cmp r9, 8
jb 0x1400c54f8
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x1400c5490
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x1400c5510
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
cmp dword [rcx], 2
jne 0x1400c55a6
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [0x14026c680]
pshufd xmm2, xmm0, 0xee
pxor xmm2, xmmword [0x14026c690]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rsi, qword [rdx]
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1400c84c0
test rdi, rdi
je 0x1400c5635
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x1400c564e
mov rcx, qword [rdx]
mov r8, qword [rcx]
xor edx, edx
test r8, r8
setne dl
movabs rax, 0xcbf29ce484222325
xor rax, rdx
movabs rdx, 0x1efac7090aef4a21
imul rax, rdx
test r8, r8
je 0x1400c5746
mov r9, qword [rcx + 0x10]
test r9, r9
je 0x1400c57c8
mov rcx, qword [rcx + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x1400c5753
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x1400c5610
cmp r9, 8
jae 0x1400c575c
jmp 0x1400c57c8
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1400c84c0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x1400c57c8
movzx ecx, byte [rcx + 8]
xor rax, rcx
imul rax, rdx
jmp 0x1400c57c8
mov r8, rcx
cmp r9, 8
jb 0x1400c57c8
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x1400c5760
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x1400c84c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x1400c8502
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x1400c850a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x1400c851b
jmp 0x1400c8532
xor r10d, r10d
jmp 0x1400c85bd
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x1400c8532
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x1400c8549
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x1400c8569
add r11, r8
jmp 0x1400c869a
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x1400c8632
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x1400c85e0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x1400c8650
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x1400c8662
jmp 0x1400c867c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x1400c867c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x1400c8696
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400d0a10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rdi, rdx
mov rbx, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x1400d0b6e
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x1400d0a46
mov rsi, rax
cmp qword [rax + 8], 0
jne 0x1400d0b9c
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x1400d0ba2
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x1400d0bbb
mov rsi, rax
test rax, rax
jne 0x1400d0aaf
mov rax, qword [0x14031ef28]
movzx eax, byte [rax]
mov ecx, 0x60
mov edx, 8
call fcn.14000ea30
test rax, rax
je 0x1400d0bda
mov rsi, rax
mov qword [rax], rbx
mov qword [rax + 8], 0
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x1400d0bcb
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rcx, [rsi + 8]
test rdi, rdi
je 0x1400d0ad4
lea rdx, [rdi + 8]
cmp qword [rdi], 0
mov qword [rdi], 0
lea rax, [0x1402724a8]
cmovne rax, rdx
jmp 0x1400d0adb
lea rax, [0x1402724a8]
mov rdx, qword [rcx + 0x50]
mov qword [rsp + 0x70], rdx
movups xmm0, xmmword [rcx + 0x40]
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmm2, xmmword [rcx + 0x20]
movups xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x50], xmm3
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 8], 1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rsi + 0x50], xmm0
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmm2, xmmword [rax + 0x20]
movups xmm3, xmmword [rax + 0x30]
movups xmmword [rsi + 0x40], xmm3
movups xmmword [rsi + 0x30], xmm2
movups xmmword [rsi + 0x20], xmm1
movups xmmword [rsi + 0x10], xmm0
cmp qword [rsp + 0x20], 0
je 0x1400d0b9c
mov rax, qword [rsp + 0x30]
cmp rax, 2
je 0x1400d0b9c
lea rcx, [rsp + 0x38]
test rax, rax
je 0x1400d0b8c
mov rax, qword [rsp + 0x38]
lock dec qword [rax]
jne 0x1400d0b9c
call fcn.1400dfad0
jmp 0x1400d0b9c
mov rcx, rbx
call fcn.140200490
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x1400d0a38
jmp 0x1400d0a46
mov rax, qword [rsp + 0x38]
lock dec qword [rax]
jne 0x1400d0b9c
call fcn.1400df790
add rsi, 0x10
jmp 0x1400d0bbd
mov rcx, rbx
call fcn.140200490
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x1400d0a62
xor esi, esi
mov rax, rsi
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret
mov rcx, rbx
call fcn.140200490
mov ecx, eax
jmp 0x1400d0aa7
mov ecx, 8
mov edx, 0x60
call fcn.140226c80
ud2
Function at 0x1400fc750
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x1400fc7e6
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x1402879e0]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1400fe1c0
test rdi, rdi
je 0x1400fc875
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x1400fc88e
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x1400fc986
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x1400fca08
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x1400fc993
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x1400fc850
cmp r9, 8
jae 0x1400fc99c
jmp 0x1400fca08
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1400fe1c0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x1400fca08
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x1400fca08
mov r8, rcx
cmp r9, 8
jb 0x1400fca08
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x1400fc9a0
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x1400fe1c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x1400fe202
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x1400fe20a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x1400fe21b
jmp 0x1400fe232
xor r10d, r10d
jmp 0x1400fe2bd
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x1400fe232
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x1400fe249
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x1400fe269
add r11, r8
jmp 0x1400fe39a
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x1400fe332
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x1400fe2e0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x1400fe350
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x1400fe362
jmp 0x1400fe37c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x1400fe37c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x1400fe396
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14011c910
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rbx, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x14011ca5d
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14011c943
mov rsi, rax
cmp qword [rax + 8], 0
jne 0x14011ca57
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x14011ca7b
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14011ca94
mov rsi, rax
test rax, rax
jne 0x14011c9ac
mov rax, qword [0x14031ef28]
movzx eax, byte [rax]
mov ecx, 0x38
mov edx, 8
call fcn.14000ea30
test rax, rax
je 0x14011cab0
mov rsi, rax
mov qword [rax], rbx
mov qword [rax + 8], 0
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x14011caa1
dec ecx
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
lea rcx, [rsi + 8]
movaps xmm0, xmmword [0x1402a9ea0]
mov al, 1
test rdi, rdi
je 0x14011c9ea
cmp qword [rdi], 0
mov qword [rdi], 0
je 0x14011c9ea
movups xmm0, xmmword [rdi + 8]
movups xmm1, xmmword [rdi + 0x18]
movaps xmmword [rsp + 0x60], xmm1
movzx eax, byte [rdi + 0x28]
mov edx, dword [rdi + 0x2c]
mov dword [rsp + 0x2b], edx
mov edx, dword [rdi + 0x29]
mov dword [rsp + 0x28], edx
movups xmm1, xmmword [rcx]
movups xmm2, xmmword [rcx + 0x10]
movups xmm3, xmmword [rcx + 0x20]
movaps xmmword [rsp + 0x50], xmm3
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
mov qword [rsi + 8], 1
movups xmmword [rsi + 0x10], xmm0
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x20], xmm0
mov byte [rsi + 0x30], al
mov eax, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x2b]
mov dword [rsi + 0x34], ecx
mov dword [rsi + 0x31], eax
cmp qword [rsp + 0x30], 0
je 0x14011ca57
mov rax, qword [rsp + 0x40]
cmp rax, 2
je 0x14011ca57
test rax, rax
je 0x14011ca57
mov rax, qword [rsp + 0x48]
lock dec qword [rax]
jne 0x14011ca57
lea rcx, [rsp + 0x48]
call fcn.140122460
add rsi, 0x10
jmp 0x14011ca96
mov rcx, rbx
call fcn.140200490
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x14011c935
jmp 0x14011c943
mov rcx, rbx
call fcn.140200490
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14011c95f
xor esi, esi
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov rcx, rbx
call fcn.140200490
mov ecx, eax
jmp 0x14011c9a4
mov ecx, 8
mov edx, 0x38
call fcn.140226c80
ud2

Function at 0x1401203e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
lea rcx, [0x1402514e8]
jmp fcn.14011c910
Function at 0x140120550
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, qword [rcx]
mov rsi, qword [rdi]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x14012059a
dec ecx
mov edx, 1
call sub.KERNEL32.dll_TlsSetValue
cmp qword [rdi + 8], 0
je 0x1401205b5
mov rax, qword [rdi + 0x18]
cmp rax, 2
je 0x1401205b5
test rax, rax
je 0x1401205b5
mov rax, qword [rdi + 0x20]
lock dec qword [rax]
jne 0x1401205b5
lea rcx, [rdi + 0x20]
call fcn.140122460
jmp 0x1401205b5
mov rcx, rsi
call fcn.140200490
mov ecx, eax
mov edx, 1
call sub.KERNEL32.dll_TlsSetValue
cmp qword [rdi + 8], 0
jne 0x140120576
mov edx, 0x38
mov r8d, 8
mov rcx, rdi
call fcn.14000ea40
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x1401205e1
dec ecx
xor edx, edx
call sub.KERNEL32.dll_TlsSetValue
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rsi
call fcn.140200490
mov ecx, eax
jmp 0x1401205d1

Function at 0x14012c470
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x14012c4a6
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x14012c4bb
mov r14, rax
cmp qword [rax + 8], 0
je 0x14012c4bb
add r14, 0x10
jmp 0x14012c5b7
mov rcx, rdi
call fcn.140200490
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x14012c493
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x14012c59b
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x14012c5b4
mov rbx, rax
test rax, rax
jne 0x14012c524
mov rax, qword [0x14031ef28]
movzx eax, byte [rax]
mov ecx, 0x20
mov edx, 8
call fcn.14000ea30
test rax, rax
je 0x14012c5d3
mov rbx, rax
mov qword [rax], rdi
mov qword [rax + 8], 0
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x14012c5c4
dec ecx
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
xor eax, eax
test rsi, rsi
je 0x14012c543
mov rcx, qword [rsi]
mov qword [rsi], 0
test rcx, rcx
je 0x14012c545
mov rcx, qword [rsi + 8]
mov eax, dword [rsi + 0x10]
jmp 0x14012c545
xor ecx, ecx
lea r14, [rbx + 0x10]
cmp qword [rbx + 8], 0
mov rsi, qword [rbx + 0x10]
mov qword [rbx + 8], 1
mov qword [rbx + 0x10], rcx
mov byte [rbx + 0x18], al
je 0x14012c5b7
test rsi, rsi
je 0x14012c5b7
dec qword [rsi]
jne 0x14012c5b7
mov rax, qword [rsi + 0x10]
lock dec qword [rax]
jne 0x14012c580
lea rcx, [rsi + 0x10]
call fcn.140135870
dec qword [rsi + 8]
jne 0x14012c5b7
mov edx, 0x20
mov r8d, 8
mov rcx, rsi
call fcn.14000ea40
jmp 0x14012c5b7
mov rcx, rdi
call fcn.140200490
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x14012c4d7
xor r14d, r14d
mov rax, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, rdi
call fcn.140200490
mov ecx, eax
jmp 0x14012c51c
mov ecx, 8
mov edx, 0x20
call fcn.140226c80
ud2