joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002f873
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x68], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x68]
add rax, 0x60
mov qword [rsp + 0x70], rax
mov rax, qword [rcx]
movabs rcx, 0xbe4a117a30921714
movabs rdx, 0xbe4a117a30921714
xor rcx, rdx
cmp rax, rcx
jle 0x14002fa74
mov rax, qword [rsp + 0x68]
add rax, 8
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x48], rcx
mov rax, qword [rax]
mov rax, qword [rax + rcx*8 + 8]
mov qword [rsp + 0x50], rax
cmp rax, 0
je 0x14002fa1b
mov rax, qword [rsp + 0x50]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x38], rcx
mov rax, qword [rax - 0x10]
mov qword [rsp + 0x40], rax
cmp rax, 0x10
jb 0x14002f9b5
mov rcx, qword [rsp + 0x40]
mov rax, rcx
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x30], rax
mov r8, rax
xor r8, rcx
xor r8, 0xffffffffffffffff
mov rdx, rcx
and rdx, r8
shl rdx, 1
sub rdx, rcx
mov rcx, rax
sub rcx, rdx
movabs rdx, 0x5a27b1e98db2bab3
movabs r8, 0x5a27b1e98db2bab3
xor rdx, r8
cmp rcx, rdx
setl dl
movabs rcx, 0x40d741b22bf1de96
movabs r8, 0xbf28be4dd40e2169
xor rcx, r8
cmp rax, rcx
setg cl
mov al, 1
xor al, 0
xor dl, al
mov al, cl
xor al, dl
and al, cl
test al, 1
jne 0x14002f999
jmp 0x14002f9a3
call fcn.14000a590
jmp 0x14002fa1b
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
jmp 0x14002fa1b
mov rcx, qword [rsp + 0x50]
call fcn.140135c59
mov rax, qword [rsp + 0x70]
cmp byte [rax], 0
jne 0x14002faa9
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov rax, qword [rax + rcx*8 + 8]
movabs rcx, 0xf785ee804d99a087
movabs rdx, 0x87a117fb2665f77
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x28], rax
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x28]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
movabs rdx, 0x149f1fa490e98e7e
movabs r8, 0xda8b53262be58ae7
xor rdx, r8
add rax, rdx
movabs rdx, 0xa12caac72dc50691
movabs r8, 0xa12caac72dc50690
xor rdx, r8
add rax, rdx
movabs rdx, 0xce144c82bb0c0499
sub rax, rdx
cmp rax, qword [rcx]
mov qword [rsp + 0x60], rax
jl 0x14002f8ce
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x14002faa9
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
nop
add rsp, 0x78
ret

Function at 0x14002fcba
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.14016bfe4
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14002fcfa
mov rcx, qword [rsp + 0x28]
call fcn.14016c113
nop
add rsp, 0x38
ret
Function at 0x14002feca
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
add rax, 0x60
mov qword [rsp + 0x68], rax
mov rax, qword [rcx]
mov qword [rsp + 0x70], rax
cmp rax, rdx
jle 0x14002ff1c
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call fcn.14002fd00
jmp 0x1400301b8
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
cmp rax, rcx
jge 0x1400301b8
mov rax, qword [rsp + 0x58]
mov rcx, rax
add rcx, 8
mov qword [rsp + 0x48], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x50], rax
cmp rax, 0
je 0x14002fff2
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
or rax, rax
xor rax, 0xffffffffffffffff
movabs rdx, 0x65cc60ed9c7a703c
movabs r8, 0xda339f1263858fc3
xor rdx, r8
movabs r8, 0x699de0685e0d4fd9
movabs r9, 0x96621f97a1f2b026
xor r8, r9
xor rdx, r8
movabs r8, 0x901df0ee84f00631
movabs r9, 0x2fe20f117b0ff9ce
xor r8, r9
movabs r9, 0x9516af0e497490af
movabs r10, 0x6ae950f1b68b6f50
xor r9, r10
xor r8, r9
and rdx, r8
or rax, rdx
movabs rdx, 0xa6e995eedddd6cd9
movabs r8, 0x59166a1122229326
xor rdx, r8
xor rax, rdx
cmp rax, rcx
jge 0x1400300a2
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x60]
mov rcx, rdx
sub rcx, r8
mov qword [rsp + 0x40], rcx
mov rax, rcx
xor rax, rdx
cmp rax, 0
setl al
mov r9, rcx
xor r9, r8
movabs rdx, 0x1d80b0fe7f485143
movabs r10, 0xe27f4f0180b7aebc
xor rdx, r10
xor r9, rdx
mov rdx, r8
and rdx, r9
shl rdx, 1
sub rdx, r8
sub rcx, rdx
cmp rcx, 0xffffffffffffffff
setg dl
mov cl, al
xor cl, dl
mov r8b, 1
xor r8b, 0
xor cl, r8b
or al, dl
and al, cl
test al, 1
jne 0x140030098
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
mov r9d, 8
mov qword [rsp + 0x20], 8
call fcn.1400184ef
mov rcx, rax
mov rax, qword [rsp + 0x48]
mov qword [rax], rcx
jmp 0x1400300a2
call fcn.14000a590
jmp 0x1400301b8
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov qword [rcx], rdx
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
cmp rax, rcx
jge 0x1400301b8
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
add rcx, 8
shl rax, 3
add rcx, rax
xor eax, eax
mov edx, eax
call fcn.14016c11b
mov rax, qword [rsp + 0x68]
cmp byte [rax], 0
jne 0x1400301b8
mov rdx, qword [rsp + 0x30]
movabs rcx, 0x5ec3c841e3db122d
movabs rax, 0xab755264c00e42ea
xor rcx, rax
mov rax, rdx
sub rax, rcx
movabs rcx, 0xe21ab402351d5430
movabs r8, 0xe21ab402351d5431
xor rcx, r8
add rax, rcx
movabs rcx, 0xf5b69a2523d550c7
add rax, rcx
mov r8, rdx
and r8, 0xffffffffffffffff
movabs rcx, 0x2f7ec24be32e2302
movabs r9, 0x2f7ec24be32e2300
xor rcx, r9
imul rcx, r8
movabs r8, 0x8c08d41e0b6b734
movabs r9, 0xf73f72be1f4948cb
xor r8, r9
add rdx, r8
sub rdx, rcx
mov rcx, rax
and rcx, rdx
movabs rdx, 0x1a412b7eac73a68a
movabs r8, 0x1a412b7eac73a68a
xor rdx, r8
cmp rcx, rdx
mov qword [rsp + 0x38], rax
jge 0x1400300b9
call fcn.14000a590
nop
add rsp, 0x78
ret
Function at 0x1400306e2
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x40]
cmp rcx, 0
je 0x14003083a
mov rax, qword [rsp + 0x40]
movabs rcx, 0xb525b1f3ec5726b4
movabs rdx, 0xb525b1f3ec5726b4
xor rcx, rdx
sub rcx, rax
xor eax, eax
sub rax, 0xfffffffffffffff0
add rcx, rax
xor eax, eax
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
movabs rcx, 0xd52c96c84b9a6714
movabs rdx, 0xd52c96c84b9a6704
xor rcx, rdx
cmp rax, rcx
jb 0x140030819
mov rcx, qword [rsp + 0x38]
mov rax, rcx
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x28], rax
mov rdx, rax
xor rdx, rcx
movabs r8, 0xe0f040d6b30455ed
movabs r9, 0x1f0fbf294cfbaa12
xor r8, r9
xor rdx, r8
mov r8, rcx
and r8, rdx
movabs rdx, 0xcf658fcefd742074
movabs r9, 0xcf658fcefd742076
xor rdx, r9
imul rdx, r8
sub rdx, rcx
mov rcx, rax
sub rcx, rdx
movabs rdx, 0xa93c0d125c093f65
movabs r8, 0xa93c0d125c093f65
xor rdx, r8
cmp rcx, rdx
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x1400307ee
jmp 0x1400307f8
call fcn.14000a590
jmp 0x14003083a
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov r8, qword [rax]
xor ecx, ecx
call fcn.140013f0f
jmp 0x14003083a
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rax]
mov ecx, 1
call fcn.140013f0f
mov rcx, qword [rsp + 0x40]
call fcn.140014085
nop
add rsp, 0x48
ret

Function at 0x140030840
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x40], rax
mov al, byte [rax + 0x60]
mov cl, 0xfd
xor cl, 0xfd
cmp al, cl
je 0x140030889
mov rax, qword [rsp + 0x40]
mov rcx, rax
add rcx, 0x10
mov qword [rsp + 0x30], rcx
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x38], rax
cmp rax, 0
jne 0x14003088e
add rsp, 0x48
ret
mov rax, qword [0x1401ab090]
mov qword [rsp + 0x28], rax
cmp rax, 0
je 0x1400308b0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
call rax
mov rcx, qword [rsp + 0x30]
xor eax, eax
mov edx, eax
call fcn.140019910
mov ecx, 0x9a567b61
xor ecx, 0x9a567b60
call sub.msvcrt.dll_exit
int3

Function at 0x1400308cf
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x140030903
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
nop
add rsp, 0x28
ret
Function at 0x140030909
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x60], rcx
cmp qword [rcx], 0
jle 0x140030ab9
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x40], rcx
mov rax, qword [rax]
mov rax, qword [rax + rcx*8 + 8]
mov qword [rsp + 0x48], rax
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [rsp + 0x48]
cmp rax, 0
je 0x140030a8e
mov rax, qword [rsp + 0x48]
movabs rcx, 0xa79dc29d2b878795
movabs rdx, 0x820dc2e9124ec548
xor rcx, rdx
sub rax, rcx
movabs rcx, 0x161563631e7d8514
movabs rdx, 0xe9ea9c9ce1827ae4
xor rcx, rdx
add rax, rcx
movabs rcx, 0x2590007439c942dd
add rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
movabs rcx, 0xf2922febafa24d89
movabs rdx, 0xf2922febafa24d99
xor rcx, rdx
cmp rax, rcx
jb 0x140030a60
mov rdx, qword [rsp + 0x38]
xor eax, eax
mov ecx, eax
sub rcx, 0xfffffffffffffff0
mov rax, rdx
sub rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, rdx
movabs rdx, 0x4370a67a91d5854d
movabs r8, 0x4370a67a91d5854d
xor rdx, r8
cmp rcx, rdx
setl dl
cmp rax, 0xffffffffffffffff
setg al
mov cl, al
xor cl, dl
xor cl, 0xff
or al, dl
and al, cl
test al, 1
jne 0x140030a35
jmp 0x140030a3f
call fcn.14000a590
jmp 0x140030a8e
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov r8, qword [rax]
xor ecx, ecx
call fcn.140013f0f
jmp 0x140030a8e
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov r8, qword [rax]
mov ecx, 1
call fcn.140013f0f
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.140014085
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
xor edx, edx
sub rdx, rax
xor eax, eax
sub rax, 1
add rdx, rax
xor eax, eax
sub rax, rdx
cmp rax, qword [rcx]
mov qword [rsp + 0x58], rax
jl 0x140030931
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x140030aee
mov ecx, dword [0x1401ab0a0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.14000ffaa
nop
add rsp, 0x68
ret
Function at 0x140031224
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401ab0a0]
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
lea rcx, [0x1401ab060]
mov rax, qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call rax
lea rcx, [0x14000a41e]
add rsp, 0x28
jmp 0x140001510
Function at 0x14004a998
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x18], rcx
mov eax, 0x10
call fcn.140195b60
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
mov rdx, qword [rdx]
sub rsp, 0x20
call fcn.140025d6b
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
cmp qword [rcx], 0
jle 0x14004aaca
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x18]
add rcx, 8
mov qword [rbp - 0x40], rcx
add rax, 8
mov qword [rbp - 0x38], rax
xor eax, eax
mov qword [rbp - 0x30], rax
mov rdx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x40]
mov qword [rbp - 0x48], rdx
mov rcx, qword [rcx]
add rcx, 8
mov r8, rdx
shl r8, 5
add rcx, r8
mov rax, qword [rax]
add rax, 8
shl rdx, 5
add rax, rdx
mov rdx, qword [rax]
mov qword [rbp - 0x10], rdx
mov rax, qword [rax + 8]
mov qword [rbp - 8], rax
lea rdx, [rbp - 0x10]
sub rsp, 0x20
call fcn.140021260
mov rcx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x48]
add rsp, 0x20
mov rcx, qword [rcx]
add rcx, 8
mov r9, r8
shl r9, 5
add rcx, r9
add rcx, 0x10
mov rax, qword [rax]
add rax, 8
shl r8, 5
add rax, r8
add rax, 0x10
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140021260
mov rax, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
movabs rdx, 0x399ce87e3f924a1e
movabs r8, 0x399ce87e3f924a1f
xor rdx, r8
add rax, rdx
cmp rax, qword [rcx]
mov qword [rbp - 0x30], rax
jl 0x14004a9fa
mov rsp, rbp
pop rbp
ret
Function at 0x14007952a
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x90
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x80], rcx
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x78], rax
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
call fcn.14000a414
mov rcx, qword [rsp + 0x80]
mov rax, rcx
add rax, 8
mov qword [rsp + 0x88], rax
cmp qword [rcx + 8], 0
je 0x14007962a
movabs rcx, 0x263ab9fb3d319447
movabs rax, 0x263ab9fb3d319407
xor rcx, rax
movabs rdx, 0xfa549138866d7a40
movabs rax, 0xfa549138866d7a48
xor rdx, rax
call fcn.140019bef
mov rcx, rax
mov rax, qword [0x1401a1578]
mov qword [rcx], rax
lea rax, [0x14019e300]
mov qword [rcx + 0x10], rax
mov rax, qword [0x14019e310]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14019e318]
mov qword [rcx + 0x20], rax
mov qword [rcx + 8], 0
movabs rax, 0xe3843f8a402519b
movabs rdx, 0xe3843f893d9f5e0
xor rax, rdx
lea rdx, [0x14019e300]
lea r8, [0x14019e320]
lea r9, [0x14019e329]
mov qword [rsp + 0x20], rax
call fcn.140019b17
jmp 0x1400797de
mov rdx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx]
mov rax, qword [rax]
xor r8d, r8d
sub r8, rdx
mov rdx, rax
sub rdx, r8
mov qword [rsp + 0x50], rdx
cmp rcx, rdx
mov qword [rsp + 0x58], rax
jge 0x140079680
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
call fcn.14001b50c
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov r9, qword [rsp + 0x70]
mov rax, qword [rsp + 0x58]
mov r9, qword [r9 + 8]
add r9, 8
add r9, rax
mov qword [rsp + 0x30], r9
add rcx, r8
mov qword [rsp + 0x38], rcx
movabs r8, 0x697c59520b14c027
movabs rcx, 0x697c59520b14c027
xor r8, rcx
xor ecx, ecx
cmp rdx, r8
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
jle 0x140079765
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov r8b, byte [r8 + rax]
mov byte [rdx + rax], r8b
movabs rdx, 0xe44ee92dcdfc980a
movabs r8, 0xca0340a56ea9276d
xor rdx, r8
add rax, rdx
movabs rdx, 0x27f82a3e88117650
movabs r8, 0x27f82a3e88117651
xor rdx, r8
add rax, rdx
movabs rdx, 0x74d407ca6659f701
movabs r8, 0x5a99ae42c50c4866
xor rdx, r8
sub rax, rdx
cmp rax, rcx
mov qword [rsp + 0x40], rax
jne 0x1400796dd
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
mov r10, qword [rsp + 0x48]
shl rcx, 3
mov r8, qword [rax]
mov qword [rsp + 0x28], r8
add r8, rcx
movabs rcx, 0x836c15b11b68721e
movabs r9, 0x836c15b11b68721d
xor rcx, r9
sar r8, cl
mov rcx, qword [rsp + 0x28]
mov r9, r8
and r9, r10
movabs r11, 0x62277fe2190fa4f3
movabs rsi, 0x62277fe2190fa4f1
xor r11, rsi
imul r9, r11
xor r8, r10
add r8, r9
mov qword [rdx], r8
and rcx, 7
mov qword [rax], rcx
add rsp, 0x90
pop rsi
ret
Function at 0x14009f071
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x98
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x70], rcx
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
call fcn.14000a414
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
add rax, 0x60
mov qword [rsp + 0x88], rax
movabs rax, 0x13f52f5d86c74b39
movabs r8, 0x13f52f5d86c74b39
xor rax, r8
mov qword [rcx], rax
mov rax, rcx
add rax, 8
mov qword [rsp + 0x90], rax
mov qword [rcx + 8], 0
cmp rdx, 0
je 0x14009f2cb
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
call fcn.14009e71a
mov rax, qword [rsp + 0x88]
cmp byte [rax], 0
jne 0x14009f2cb
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x78]
mov rcx, qword [rcx]
mov qword [rsp + 0x58], rcx
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
call fcn.14000a414
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rax, qword [rsp + 0x88]
add rcx, 8
lea rdx, [0x14019ed30]
cmp r8, 0
cmove rcx, rdx
mov qword [rsp + 0x60], rcx
mov al, byte [rax]
mov cl, 0x49
xor cl, 0x49
cmp al, cl
jne 0x14009f2cb
mov rcx, qword [rsp + 0x68]
mov rax, rcx
shl rax, 1
mov qword [rsp + 0x38], rax
cvtsi2sd xmm0, rcx
movsd xmm1, qword [0x14019ecb0]
mulsd xmm0, xmm1
movsd qword [rsp + 0x40], xmm0
cvtsi2sd xmm1, rax
movsd qword [rsp + 0x48], xmm1
ucomisd xmm0, xmm1
jne 0x14009f1bd
jp 0x14009f1bd
jmp 0x14009f20c
movsd xmm1, qword [rsp + 0x40]
movsd xmm0, qword [rsp + 0x48]
subsd xmm0, xmm1
call fcn.140195ba0
movaps xmm1, xmm0
movsd xmm0, qword [rsp + 0x40]
movsd qword [rsp + 0x30], xmm1
call fcn.140195ba0
movsd xmm1, qword [rsp + 0x30]
movsd xmm2, qword [0x14019ecb8]
mulsd xmm1, xmm2
ucomisd xmm0, xmm1
jae 0x14009f20c
call fcn.14000a590
jmp 0x14009f2cb
mov rax, qword [rsp + 0x38]
cmp rax, 0
jge 0x14009f258
mov rcx, qword [rsp + 0x38]
movabs rdx, 0x976a8b7127b19411
movabs rax, 0x976a8b7127b19411
xor rdx, rax
movabs r8, 0xae882872dad6f303
movabs rax, 0xd177d78d25290cfc
xor r8, rax
call fcn.140010917
jmp 0x14009f2cb
mov rcx, qword [rsp + 0x38]
movabs rdx, 0x50a641373daac433
movabs rax, 0x50a641373daac433
xor rdx, rax
xor eax, eax
cmp rcx, rdx
mov qword [rsp + 0x28], rax
je 0x14009f2cb
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x80]
mov r8b, byte [r8 + rax]
mov byte [rdx + rax], r8b
movabs rdx, 0xf1f0279e78800864
movabs r8, 0xf1f0279e78800865
xor rdx, r8
add rax, rdx
cmp rax, rcx
mov qword [rsp + 0x28], rax
jne 0x14009f284
mov rax, qword [rsp + 0x70]
add rsp, 0x98
ret
Function at 0x14009f2d8
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
call fcn.14000a414
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
add rax, 0x60
mov qword [rsp + 0x68], rax
movabs rax, 0xfc693f02bedf060f
movabs r8, 0xfc693f02bedf060f
xor rax, r8
mov qword [rcx], rax
mov rax, rcx
add rax, 8
mov qword [rsp + 0x70], rax
mov qword [rcx + 8], 0
cmp rdx, 0
je 0x14009f470
mov rax, qword [rsp + 0x60]
mov ax, word [rax]
mov cx, 0x7c13
xor cx, 0x7c12
shr ax, cl
mov rcx, qword [rsp + 0x58]
movzx eax, ax
mov edx, eax
call fcn.14009e71a
mov rax, qword [rsp + 0x68]
mov al, byte [rax]
mov cl, 0x26
xor cl, 0x26
cmp al, cl
jne 0x14009f470
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
mov qword [rsp + 0x40], rcx
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
call fcn.14000a414
mov rcx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
mov rax, qword [rsp + 0x68]
add rcx, 8
lea rdx, [0x14019ed30]
cmp r8, 0
cmove rcx, rdx
mov qword [rsp + 0x48], rcx
cmp byte [rax], 0
jne 0x14009f470
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x20], rcx
mov cx, word [rax]
movzx eax, cx
mov qword [rsp + 0x28], rax
mov dx, 0x9ec5
xor dx, 0x9ec5
xor eax, eax
cmp cx, dx
mov qword [rsp + 0x30], rax
je 0x14009f470
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x20]
mov r8b, byte [r8 + rax]
mov byte [rdx + rax], r8b
movabs rdx, 0x568cbed979bd547f
movabs r8, 0xa20c2f8f0759f23e
xor rdx, r8
add rax, rdx
movabs rdx, 0xe39517719c97e791
movabs r8, 0xe39517719c97e790
xor rdx, r8
add rax, rdx
movabs rdx, 0xf48091567ee4a641
sub rax, rdx
cmp rax, rcx
mov qword [rsp + 0x30], rax
jne 0x14009f405
mov rax, qword [rsp + 0x50]
add rsp, 0x78
ret
Function at 0x1400b775b
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x50], rdx
mov qword [rbp - 0x48], rcx
mov eax, 0x10
call fcn.140195b60
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000a414
add rsp, 0x20
xor eax, eax
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x50]
xorps xmm0, xmm0
movups xmmword [rcx + rax], xmm0
movabs rcx, 0x7ea0937f7a8dfbbe
movabs rdx, 0x76b2ecd81e18073
xor rcx, rdx
sub rax, rcx
movabs rcx, 0x61a867c5dae1a84f
movabs rdx, 0x61a867c5dae1a85f
xor rcx, rdx
add rax, rcx
movabs rcx, 0x79cbbdb2fb6c7bcd
add rax, rcx
movabs rcx, 0x726fef9826f48846
movabs rdx, 0x726fef9826f48876
xor rcx, rdx
cmp rax, rcx
mov qword [rbp - 0x38], rax
jne 0x1400b779d
mov rcx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
mov dl, byte [rax]
mov byte [rcx], dl
mov rcx, qword [rax + 8]
mov qword [rbp - 0x20], rcx
mov rax, qword [rax + 0x10]
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x10]
lea rdx, [rbp - 0x20]
sub rsp, 0x20
call fcn.140024b17
mov rcx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x50]
add rsp, 0x20
mov r8, qword [rbp - 0x10]
mov qword [rdx + 8], r8
mov r8, qword [rbp - 8]
mov qword [rdx + 0x10], r8
mov rdx, qword [rax + 0x18]
mov qword [rbp - 0x30], rdx
mov rax, qword [rax + 0x20]
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x30]
sub rsp, 0x20
call fcn.140024b17
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x50]
add rsp, 0x20
mov r8, qword [rdx]
mov qword [rax + 0x18], r8
mov rdx, qword [rdx + 8]
mov qword [rax + 0x20], rdx
mov rcx, qword [rcx + 0x28]
mov qword [rax + 0x28], rcx
mov rsp, rbp
pop rbp
ret
Function at 0x1400bab98
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
call fcn.14000a414
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140019683
Function at 0x1400c5316
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401a1928]
mov ecx, dword [rax]
call fcn.14000a414
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140019683