joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140057160
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov ecx, dword [0x1404100e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x1400571b0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, dword [0x1404100e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
jne 0x140057216
movsxd rax, dword [rsp + 0x20]
add rax, 0xa
mov r8, rax
xor edx, edx
mov rcx, qword [0x140418820]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
jmp 0x140057241
movsxd rax, dword [rsp + 0x20]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x140418820]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x20]
xor edx, edx
mov ecx, 2
div rcx
movsxd rcx, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x28]
add rcx, qword [rdx]
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call fcn.140057a40
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x140057300
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x1404100e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
add rsp, 0x38
ret

Function at 0x140057330
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x1404100e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
add rsp, 0x38
ret

Function at 0x1400573c0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x1404100e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x10]
add rax, 2
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x1400573f0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x1404100e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret
Function at 0x140057490
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [0x1404100e8], 0xffffffff
jne 0x1400574bf
call fcn.140057000
mov ecx, dword [0x1404100e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x140057440]
call fcn.14013eebc
jmp 0x1400574f0
mov ecx, dword [0x1404100e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x1400574f0
call fcn.140057ac0
mov ecx, dword [0x1404100e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x140057440]
call fcn.14013eebc
add rsp, 0x28
ret

Function at 0x1400575a0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x1404100e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
add rsp, 0x38
ret

Function at 0x1400575d0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov ecx, dword [0x1404100e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
cmp dword [rsp + 0x58], 0xffffffff
jne 0x140057600
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x58], eax
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
lea rax, [rcx + rax*2]
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
sub rcx, 4
cmp rax, rcx
jl 0x140057672
mov eax, dword [rsp + 0x20]
add eax, 0x4000
cdqe
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x140418820]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
jmp 0x1400576d0
mov rax, qword [rsp + 0x28]
cmp qword [rax + 8], 0x100000
jle 0x1400576d0
cmp dword [rsp + 0x20], 0x100000
jge 0x140057693
mov dword [rsp + 0x20], 0x100000
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x140418820]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
add rax, qword [rcx]
mov qword [rsp + 0x30], rax
movsxd rax, dword [rsp + 0x58]
movsxd rcx, dword [rsp + 0x50]
lea rax, [rax + rcx*2]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x140057710
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x1404100e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
xor edx, edx
mov word [rcx + rax], dx
add rsp, 0x38
ret
Function at 0x140057750
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x1404100e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x40]
shl eax, 1
cdqe
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x1400579a0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, dword [0x1404100e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
cmp qword [rsp + 0x40], rax
jb 0x1400579fb
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
cmp qword [rsp + 0x40], rax
ja 0x1400579fb
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
inc rax
jmp 0x1400579fd
xor eax, eax
add rsp, 0x38
ret

Function at 0x140057a10
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x1404100e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
lea rax, [rcx + rax - 1]
add rsp, 0x38
ret

Function at 0x140057ac0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov r8d, 0x18
xor edx, edx
mov rcx, qword [0x140418820]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x20], rax
mov r8d, 0x10
xor edx, edx
mov rcx, qword [0x140418820]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rax
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], 0x10
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x10], 0
mov rdx, qword [rsp + 0x20]
mov ecx, dword [0x1404100e8]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret
Function at 0x140060bec
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x10], edx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x10
movsxd r10, ecx
xor edi, edi
xor ecx, ecx
mov eax, r10d
mov r14, r9
mov r11d, edx
mov rbx, r10
imul eax, edx
movsxd rbp, eax
test edx, edx
jle 0x140060c76
lea eax, [r10*2 - 1]
mov r15, rbx
mov rdx, r9
movsxd rsi, eax
shl r15, 2
mov r9d, r11d
movsxd rax, ecx
add edi, r10d
lea rcx, [rax + rsi]
movss xmm0, dword [r8 + rcx*4]
addss xmm0, dword [r8 + rax*4]
movss dword [rdx], xmm0
movss xmm1, dword [r8 + rax*4]
subss xmm1, dword [r8 + rcx*4]
lea ecx, [rdi + rdi]
movss dword [rdx + rbp*4], xmm1
add rdx, r15
dec r9
jne 0x140060c40
cmp r10d, 2
jl 0x140060dfd
je 0x140060dad
xor r9d, r9d
xor eax, eax
test r11d, r11d
jle 0x140060d97
mov rsi, r11
mov r11, qword [rsp + 0x60]
xor edi, edi
cmp rbx, 2
jle 0x140060d7f
movsxd rdx, eax
lea eax, [rax + r10*2]
lea r12, [r11 + 4]
movsxd rcx, eax
mov rax, rdi
mov r11, rbp
sub r11, rdx
sub rax, rdx
lea r15, [r8 + rcx*4]
add r11, rdi
lea rax, [rax*4 + 4]
lea rcx, [r8 - 4]
lea rcx, [rcx + rdx*4]
shl r11, 2
lea rdx, [rbx - 3]
sub rax, r8
sub r11, r8
mov r13, rbp
add rax, r14
shr rdx, 1
neg r13
add r11, r14
inc rdx
mov rbx, rax
add rcx, 8
sub r15, 8
lea rax, [rcx + r11]
movss xmm0, dword [rcx]
addss xmm0, dword [r15 - 4]
movss dword [rax + r13*4], xmm0
movss xmm0, dword [rcx + 4]
movss xmm3, dword [rcx]
subss xmm3, dword [r15 - 4]
subss xmm0, dword [r15]
movaps xmm1, xmm3
movss dword [rcx + rbx], xmm0
movss xmm2, dword [rcx + 4]
mulss xmm1, dword [r12 - 4]
addss xmm2, dword [r15]
movaps xmm0, xmm2
mulss xmm0, dword [r12]
subss xmm1, xmm0
movss dword [rax], xmm1
mulss xmm3, dword [r12]
mulss xmm2, dword [r12 - 4]
add r12, 8
addss xmm3, xmm2
movss dword [rcx + r11 + 4], xmm3
dec rdx
jne 0x140060cfc
mov r11, qword [rsp + 0x60]
mov rbx, r10
add r9d, r10d
add rdi, rbx
lea eax, [r9 + r9]
dec rsi
jne 0x140060c9e
mov r11d, dword [rsp + 0x48]
mov eax, r10d
and eax, 0x80000001
jge 0x140060da8
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
je 0x140060dfd
dec r10d
test r11d, r11d
jle 0x140060dfd
movsxd rax, r10d
movsxd rcx, r10d
mov r9, rbx
lea rdx, [r14 + rax*4]
lea rax, [r8 + rcx*4]
shl r9, 2
mov ecx, r11d
shl rbx, 3
movss xmm0, dword [rax]
addss xmm0, xmm0
movss dword [rdx], xmm0
movss xmm1, dword [rax + 4]
add rax, rbx
addss xmm1, xmm1
xorps xmm1, xmmword [0x140161cf0]
movss dword [rdx + rbp*4], xmm1
add rdx, r9
dec rcx
jne 0x140060dd1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x10
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140062398
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r10, ecx
xor edi, edi
mov r14, r8
mov ebx, r10d
mov r11, r10
imul ebx, edx
mov dword [rsp + 0x70], ebx
test edx, edx
jle 0x14006241f
lea eax, [r10 + r10]
mov r12, r10
mov r13, r10
movsxd rsi, eax
shl r12, 2
shl r13, 3
dec rsi
movsxd rbp, ebx
mov r15d, edx
lea rsi, [r9 + rsi*4]
movss xmm0, dword [r8 + rbp*4]
lea eax, [rdi + rdi]
add edi, r10d
addss xmm0, dword [r8]
movsxd rcx, eax
movss dword [r9 + rcx*4], xmm0
movss xmm0, dword [r8]
subss xmm0, dword [r8 + rbp*4]
add r8, r12
movss dword [rsi], xmm0
add rsi, r13
dec r15
jne 0x1400623eb
cmp r10d, 2
jl 0x1400625b3
je 0x140062566
test edx, edx
jle 0x140062550
mov rdi, r10
mov r8, r10
mov rcx, r14
shl rdi, 3
neg r8
xor ebp, ebp
mov r13d, edx
mov rdx, qword [rsp + 0x90]
shl r8, 2
sub rcx, r9
lea r12, [rdi + r9]
movsxd rsi, ebx
lea rax, [r10 + r10]
lea r15, [r9 - 4]
cmp r10d, 2
jle 0x140062530
lea rax, [rdx + 4]
mov rdi, r12
mov qword [rsp + 0x18], rax
mov rax, rsi
mov rbx, qword [rsp + 0x18]
sub rax, rbp
shl rax, 2
sub rax, r9
add rax, r14
mov qword [rsp + 0x20], rax
lea eax, [r10 - 3]
mov rdx, qword [rsp + 0x20]
shr eax, 1
inc eax
mov qword [rsp], rax
mov rax, r15
movss xmm2, dword [rdx + rax + 0xc]
add rax, 8
sub rdi, 8
movss xmm1, dword [rdx + rax]
movaps xmm3, xmm2
mulss xmm2, dword [rbx - 4]
mulss xmm3, dword [rbx]
movaps xmm0, xmm1
mulss xmm0, dword [rbx - 4]
mulss xmm1, dword [rbx]
add rbx, 8
dec qword [rsp]
addss xmm3, xmm0
subss xmm2, xmm1
movaps xmm0, xmm2
addss xmm0, dword [rcx + rax + 4]
movss dword [rax + 4], xmm0
subss xmm2, dword [rcx + rax + 4]
movaps xmm0, xmm3
movss dword [rdi], xmm2
addss xmm0, dword [rcx + rax]
movss dword [rax], xmm0
movss xmm1, dword [rcx + rax]
subss xmm1, xmm3
movss dword [rdi - 4], xmm1
jne 0x1400624ae
mov rdx, qword [rsp + 0x90]
mov rdi, r10
lea rax, [r10 + r10]
shl rdi, 3
add r15, rdi
add rbp, rax
add r12, rdi
add rcx, r8
add rsi, r10
dec r13
jne 0x14006246a
mov edx, dword [rsp + 0x78]
mov ebx, dword [rsp + 0x70]
mov eax, r10d
and eax, 0x80000001
jge 0x140062561
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
je 0x1400625b3
dec r10d
test edx, edx
jle 0x1400625b3
lea eax, [r10 + rbx]
mov rbx, r11
shl r11, 2
movsxd rcx, eax
movsxd r10, r10d
shl rbx, 3
lea r8, [r11 + r9]
lea r9, [r14 + rcx*4]
sub r10, rcx
mov ecx, edx
movss xmm0, dword [r9]
xorps xmm0, xmmword [0x140161cf0]
movss dword [r8], xmm0
mov eax, dword [r9 + r10*4]
add r9, r11
mov dword [r8 - 4], eax
add r8, rbx
dec rcx
jne 0x14006258f
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006ef10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, r8d
mov r10, rdx
lea rbx, [0x14016fef0]
cmp r8d, 8
jl 0x14006efda
mov r11d, r9d
shr r11, 3
mov eax, r11d
neg eax
lea r9d, [r9 + rax*8]
nop dword [rax]
movzx eax, byte [r10 + 1]
movzx edx, byte [r10]
add r10, 8
shl edx, 8
or edx, eax
movzx eax, byte [r10 - 6]
shl edx, 8
or edx, eax
movzx eax, byte [r10 - 5]
shl edx, 8
or edx, eax
xor ecx, edx
mov r8d, ecx
mov eax, ecx
shr rax, 0x10
movzx ecx, al
mov eax, r8d
mov ecx, dword [rbx + rcx*4 + 0x1800]
shr rax, 8
movzx edx, al
mov eax, r8d
xor ecx, dword [rbx + rdx*4 + 0x1400]
shr rax, 0x18
xor ecx, dword [rbx + rax*4 + 0x1c00]
movzx eax, byte [r10 - 2]
xor ecx, dword [rbx + rax*4 + 0x400]
movzx eax, byte [r10 - 3]
xor ecx, dword [rbx + rax*4 + 0x800]
movzx eax, byte [r10 - 4]
xor ecx, dword [rbx + rax*4 + 0xc00]
movzx eax, byte [r10 - 1]
xor ecx, dword [rbx + rax*4]
movzx eax, r8b
xor ecx, dword [rbx + rax*4 + 0x1000]
dec r11
jne 0x14006ef40
test r9d, r9d
je 0x14006f000
nop
movzx eax, byte [r10]
mov edx, ecx
lea r10, [r10 + 1]
shr rdx, 0x18
xor rdx, rax
mov eax, ecx
mov ecx, dword [rbx + rdx*4]
shl eax, 8
xor ecx, eax
dec r9d
jne 0x14006efe0
mov rbx, qword [rsp + 8]
mov eax, ecx
ret
Function at 0x140075c04
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140076938
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140075c74
mov r9d, dword [rbx + 0x24]
mov edx, dword [rbx + 0x14]
mov rax, qword [rbx]
cmp r9d, r8d
jae 0x140075c74
mov r11d, dword [rax + rdx*4]
mov r10d, dword [rbx + 0x1c]
mov ecx, 0x18
mov eax, r10d
mov rdx, r11
sub ecx, r9d
shr rax, 8
add r9d, 8
shr rdx, cl
movzx ecx, dl
xor rcx, rax
lea rax, [0x1401733e0]
movzx edx, word [rax + rcx*2]
movzx eax, r10b
mov dword [rbx + 0x24], r9d
shl eax, 8
xor edx, eax
mov r10d, edx
mov dword [rbx + 0x1c], edx
cmp r9d, r8d
jb 0x140075c32
movzx eax, word [rbx + 0x1c]
add rsp, 0x20
pop rbx
ret

Function at 0x14007b720
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
movzx r9d, r8w
mov r10d, edx
mov rbx, rcx
lea rdi, [0x1401733e0]
cmp edx, 2
jb 0x14007b7d3
mov r11d, r10d
shr r11, 1
mov eax, dword [rbx]
mov r8d, dword [rbx + 4]
movzx ecx, byte [rbx]
shr eax, 0x10
add rbx, 8
add r10d, 0xfffffffe
xor r9w, ax
movzx edx, r9w
movzx r9d, word [rdi + rcx*2 + 0x800]
mov eax, edx
shr rax, 8
xor r9w, word [rdi + rax*2 + 0xe00]
mov eax, r8d
shr rax, 0x18
xor r9w, word [rdi + rax*2 + 0x600]
movzx eax, byte [rbx - 3]
xor r9w, word [rdi + rax*2 + 0x200]
movzx eax, byte [rbx - 2]
xor r9w, word [rdi + rax*2 + 0x400]
movzx eax, byte [rbx - 7]
xor r9w, word [rdi + rax*2 + 0xa00]
movzx eax, dl
xor r9w, word [rdi + rax*2 + 0xc00]
movzx eax, r8b
xor r9w, word [rdi + rax*2]
dec r11
jne 0x14007b74a
test r10d, r10d
je 0x14007b815
mov eax, dword [rbx]
movzx ecx, byte [rbx]
shr eax, 0x10
xor r9w, ax
movzx edx, r9w
movzx r9d, word [rdi + rcx*2]
mov eax, edx
shr rax, 8
xor r9w, word [rdi + rax*2 + 0x600]
movzx eax, byte [rbx + 1]
xor r9w, word [rdi + rax*2 + 0x200]
movzx eax, dl
xor r9w, word [rdi + rax*2 + 0x400]
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
movzx eax, r9w
ret

Function at 0x14007b824
Capabilities:
Encode data using xor

Disassembly:
xor al, al
test edx, edx
je 0x14007b846
movzx r8d, byte [rcx]
movzx eax, al
inc rcx
xor r8, rax
lea rax, [0x1401743e0]
mov al, byte [r8 + rax]
dec edx
jne 0x14007b82a
ret
Function at 0x14008d4d0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0x40
mov r12, r9
mov ebp, r8d
mov r9d, r8d
lea r8, [rsp + 0x30]
mov rsi, rdx
mov rbx, rcx
call fcn.140090330
mov edi, eax
test eax, eax
je 0x14008d544
movzx edx, word [rsi]
mov rcx, rbx
call fcn.140087f30
test rax, rax
je 0x14008d51d
mov r9, qword [rax + 0x20]
jmp 0x14008d524
lea r9, str.unknown_tagname
lea r8, str.TIFFFetchStripThing
mov edx, edi
mov rcx, rbx
mov dword [rsp + 0x20], 0
call fcn.140090a80
xor eax, eax
jmp 0x14008d63e
cmp qword [rsi + 8], rbp
jae 0x14008d630
movzx edx, word [rsi]
mov rcx, rbx
mov qword [rsp + 0x60], r14
call fcn.140087f30
lea rcx, str.LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT
mov r14, rax
call qword [sym.imp.msvcrt.dll_getenv]
mov edi, 0xf4240
test rax, rax
je 0x14008d583
mov rcx, rax
call qword [sym.imp.msvcrt.dll_atoi]
mov edi, eax
test r14, r14
je 0x14008d58e
mov r9, qword [r14 + 0x20]
jmp 0x14008d595
lea r9, str.unknown_tagname
mov r14, qword [rsp + 0x60]
mov rcx, qword [rbx + 0x438]
lea rdx, str.TIFFFetchStripThing
cmp ebp, edi
jbe 0x14008d5ba
lea r8, str.Incorrect_count_for___s_
call fcn.140087d50
jmp 0x14008d5c6
lea r8, str.Incorrect_count_for___s___tag_ignored
call fcn.140087470
cmp ebp, edi
jbe 0x14008d5d8
mov rcx, qword [rsp + 0x30]
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x14008d63e
lea r9, str.for_strip_array
mov r8d, 8
mov rdx, rbp
mov rcx, rbx
call fcn.140089b80
mov rdi, rax
test rax, rax
je 0x14008d5ca
mov r8d, dword [rsi + 8]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
shl r8, 3
call fcn.14007c3b0
mov eax, dword [rsi + 8]
xor edx, edx
sub ebp, eax
lea rcx, [rdi + rax*8]
mov r8d, ebp
shl r8, 3
call fcn.14007c3c0
mov rcx, qword [rsp + 0x30]
call sub.msvcrt.dll_free
jmp 0x14008d635
mov rdi, qword [rsp + 0x30]
mov qword [r12], rdi
mov eax, 1
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r12
pop rdi
ret

Function at 0x140098cc0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
lea rax, [rcx + 0x430]
mov rbx, rcx
mov qword [rcx + 0x10], rax
lea rcx, [0x140098a00]
mov dword [rbx + 0x55c], 0x64
mov qword [rax], rcx
lea rcx, str.LIBTIFF_JPEG_MAX_ALLOWED_SCAN_NUMBER
call qword [sym.imp.msvcrt.dll_getenv]
test rax, rax
je 0x140098d09
mov rcx, rax
call qword [sym.imp.msvcrt.dll_atoi]
mov dword [rbx + 0x55c], eax
lea rcx, [rbx + 0x330]
xor edx, edx
call sub.msvcrt.dll_setjmp
test eax, eax
je 0x140098d23
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
call fcn.140111cd0
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1400b8440
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
mov r11d, edx
mov r10, rcx
mov r8d, 0x80000000
test rcx, rcx
je 0x1400b84af
mov qword [rsp], rbx
lea rbx, [0x14019ad00]
test r10b, 1
je 0x1400b84a3
mov ecx, r11d
mov eax, r8d
mov edx, 0x80000000
and ecx, 0x1f
xor r8d, r8d
mov r9d, dword [rbx + rcx*4]
nop dword [rax + rax]
test r9d, edx
je 0x1400b8490
lea ecx, [rdx - 1]
xor r8d, eax
test r9d, ecx
je 0x1400b84a3
shr edx, 1
test al, 1
je 0x1400b849f
shr eax, 1
xor eax, 0xedb88320
jmp 0x1400b8480
shr eax, 1
jmp 0x1400b8480
inc r11d
sar r10, 1
jne 0x1400b8460
mov rbx, qword [rsp]
mov eax, r8d
add rsp, 8
ret

Function at 0x1400e2aa0
Capabilities:
Query environment variable

Disassembly:
push rdi
sub rsp, 0x20
lea rcx, str.OPJ_NUM_THREADS
call sub.msvcrt.dll_getenv
mov rdi, rax
test rax, rax
je 0x1400e2b25
call fcn.1400f3d70
test eax, eax
je 0x1400e2b25
mov qword [rsp + 0x30], rbx
call fcn.1400f3d60
lea rdx, str.ALL_CPUS
mov rcx, rdi
mov ebx, eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1400e2aef
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0x20
test ebx, ebx
mov rcx, rdi
cmove ebx, eax
call sub.msvcrt.dll_atoi
test eax, eax
jns 0x1400e2b12
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea ecx, [rbx + rbx]
mov rbx, qword [rsp + 0x30]
cmp eax, ecx
cmovg eax, ecx
add rsp, 0x20
pop rdi
ret
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140111cd0
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x24], 0xca
mov rbx, rcx
jne 0x140111d03
call fcn.140111f90
cmp byte [rbx + 0x58], 0
je 0x140111cfc
mov dword [rbx + 0x24], 0xcf
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
mov eax, dword [rbx + 0x24]
cmp eax, 0xcb
jne 0x140111d95
mov rax, qword [rbx + 0x240]
cmp byte [rax + 0x20], 0
je 0x140111d7c
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140111d2e
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x240]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x140111d74
cmp eax, 2
je 0x140111d7c
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140111d20
dec eax
test eax, 0xfffffffd
jne 0x140111d20
inc dword [rcx + 8]
mov rdx, qword [rbx + 0x10]
mov r8d, dword [rdx + 0xc]
cmp dword [rcx + 8], r8d
jl 0x140111d20
mov ecx, dword [rbx + 0x190]
add ecx, r8d
mov dword [rdx + 0xc], ecx
jmp 0x140111d20
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x9c]
mov rcx, rbx
mov dword [rbx + 0xa4], eax
add rsp, 0x20
pop rbx
jmp 0x140111e50
cmp eax, 0xcc
je 0x140111db7
mov rax, qword [rbx]
mov dword [rax + 0x28], 0x15
mov rcx, qword [rbx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140111e50
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
xor ebp, ebp
cmp dword [rcx + 0x24], 0xcc
mov rbx, rcx
je 0x140111e7e
mov rax, qword [rcx + 0x220]
call qword [rax]
mov dword [rbx + 0x98], ebp
mov dword [rbx + 0x24], 0xcc
mov rax, qword [rbx + 0x220]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
cmp byte [rax + 0x10], bpl
je 0x140111f2d
nop dword [rax]
mov eax, dword [rbx + 0x98]
cmp eax, dword [rbx + 0x78]
jae 0x140111efd
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140111ecf
mov dword [rcx + 8], eax
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x78]
mov dword [rcx + 0xc], eax
mov rax, qword [rbx + 0x10]
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x228]
mov edi, dword [rbx + 0x98]
lea r8, [rbx + 0x98]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call qword [rax + 8]
mov eax, dword [rbx + 0x98]
cmp eax, edi
je 0x140111f55
cmp eax, dword [rbx + 0x78]
jb 0x140111eb0
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax + 8]
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax]
mov dword [rbx + 0x98], ebp
mov rax, qword [rbx + 0x220]
cmp byte [rax + 0x10], bpl
jne 0x140111ea0
cmp byte [rbx + 0x59], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rbx + 0x24], ebp
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
xor al, al
jmp 0x140111f40