joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14013bd30
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov edi, r8d
mov rax, rdx
mov rbx, rcx
cmp qword [rcx + 0x18], 0
je 0x14013bdf6
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x140445990]
movdqu xmmword [rsp + 0x30], xmm1
xor ecx, ecx
mov word [rsp + 0x20], cx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.14013b990
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova rdx, qword [rsp + 0x20]
lea rcx, [rbx + 0x28]
cmp qword [rcx + 0x18], 7
jbe 0x14013bd97
mov rcx, qword [rcx]
and edi, 1
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14013be13
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x14013bde5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14013bde0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013bdf0
call fcn.1402ba9fc
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
call fcn.1402caabc
int3
xor r9d, r9d
mov r8d, 0x128
lea rdx, str.D:JenkinsworkspaceN_Poco_VS2022poco_1.12.4Foundation_srcFile_WIN32U.cpp
lea rcx, str.__path.empty__
call fcn.140138f40
nop
lea rcx, [rbx + 8]
call fcn.14013c0c0
int3

Function at 0x14013bed0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
je 0x14013bf29
call fcn.14013bfb0
test al, al
je 0x14013befd
mov rcx, rbx
call fcn.14013c4c0
test al, al
je 0x14013befd
xor al, al
add rsp, 0x20
pop rbx
ret
cmp qword [rbx + 0x40], 7
lea rcx, [rbx + 0x28]
jbe 0x14013bf0b
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14013bf1f
mov al, 1
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 8]
call fcn.14013c0c0
int3
xor r9d, r9d
lea rdx, str.D:JenkinsworkspaceN_Poco_VS2022poco_1.12.4Foundation_srcFile_WIN32U.cpp
mov r8d, 0x183
lea rcx, str.__path.empty__
call fcn.140138f40
int3

Function at 0x14013bfb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
je 0x14013c00d
add rcx, 0x28
cmp qword [rcx + 0x18], 7
jbe 0x14013bfce
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14013bffb
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 2
je 0x14013bff3
sub eax, 1
je 0x14013bff3
sub eax, 0xc
je 0x14013bff3
cmp eax, 6
jne 0x14013c003
xor al, al
add rsp, 0x20
pop rbx
ret
mov al, 1
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 8]
call fcn.14013c0c0
int3
xor r9d, r9d
lea rdx, str.D:JenkinsworkspaceN_Poco_VS2022poco_1.12.4Foundation_srcFile_WIN32U.cpp
lea rcx, str.__path.empty__
lea r8d, [r9 + 0x5e]
call fcn.140138f40
int3
Function at 0x14013c4c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
je 0x14013c4fe
add rcx, 0x28
cmp qword [rcx + 0x18], 7
jbe 0x14013c4de
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14013c4f4
shr eax, 4
and al, 1
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 8]
call fcn.14013c0c0
int3
xor r9d, r9d
lea rdx, str.D:JenkinsworkspaceN_Poco_VS2022poco_1.12.4Foundation_srcFile_WIN32U.cpp
mov r8d, 0x9f
lea rcx, str.__path.empty__
call fcn.140138f40
int3

Function at 0x14013c520
Capabilities:
Check if file exists

Disassembly:
jmp 0x14013c530
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
je 0x14013c576
add rcx, 0x28
cmp qword [rcx + 0x18], 7
jbe 0x14013c54e
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14013c56c
and eax, 0x410
cmp eax, 0x400
sete al
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 8]
call fcn.14013c0c0
int3
xor r9d, r9d
lea rdx, str.D:JenkinsworkspaceN_Poco_VS2022poco_1.12.4Foundation_srcFile_WIN32U.cpp
mov r8d, 0xaa
lea rcx, str.__path.empty__
call fcn.140138f40
int3

Function at 0x14013c530
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x14013c530
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
je 0x14013c576
add rcx, 0x28
cmp qword [rcx + 0x18], 7
jbe 0x14013c54e
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14013c56c
and eax, 0x410
cmp eax, 0x400
sete al
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 8]
call fcn.14013c0c0
int3
xor r9d, r9d
lea rdx, str.D:JenkinsworkspaceN_Poco_VS2022poco_1.12.4Foundation_srcFile_WIN32U.cpp
mov r8d, 0xaa
lea rcx, str.__path.empty__
call fcn.140138f40
int3

Function at 0x14013c820
Capabilities:
Delete directory
Delete file

Disassembly:
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rdi, rcx
je 0x14013c87d
mov qword [rsp + 0x30], rbx
lea rbx, [rcx + 0x28]
call fcn.14013c4c0
test al, al
je 0x14013c864
cmp qword [rbx + 0x18], 7
jbe 0x14013c84c
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x14013c89a
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp qword [rbx + 0x18], 7
jbe 0x14013c86e
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14013c89a
jmp 0x14013c859
xor r9d, r9d
lea rdx, str.D:JenkinsworkspaceN_Poco_VS2022poco_1.12.4Foundation_srcFile_WIN32U.cpp
mov r8d, 0x160
lea rcx, str.__path.empty__
call fcn.140138f40
int3
lea rcx, [rdi + 8]
call fcn.14013c0c0
int3
Function at 0x14013c8e0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov edi, r8d
mov rax, rdx
mov rbx, rcx
cmp qword [rcx + 0x18], 0
je 0x14013c9db
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x140445990]
movdqu xmmword [rsp + 0x30], xmm1
xor ecx, ecx
mov word [rsp + 0x20], cx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.14013b990
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x28]
test dil, 1
je 0x14013c9a3
cmp qword [rsp + 0x38], 7
cmova rdx, qword [rsp + 0x20]
cmp qword [rcx + 0x18], 7
jbe 0x14013c94d
mov rcx, qword [rcx]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x14013c9d1
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x14013c998
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14013c993
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013c9cb
call fcn.1402ba9fc
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
cmp qword [rsp + 0x38], 7
cmova rdx, qword [rsp + 0x20]
cmp qword [rcx + 0x18], 7
jbe 0x14013c9b9
mov rcx, qword [rcx]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x14013c9d1
jmp 0x14013c95a
call fcn.1402caabc
nop
lea rcx, [rbx + 8]
call fcn.14013c0c0
nop
xor r9d, r9d
mov r8d, 0x133
lea rdx, str.D:JenkinsworkspaceN_Poco_VS2022poco_1.12.4Foundation_srcFile_WIN32U.cpp
lea rcx, str.__path.empty__
call fcn.140138f40
int3

Function at 0x1401462f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0xa8], 0xffffffffffffffff
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140146374
mov eax, dword [rcx + 0x80]
test al, 1
je 0x140146374
test al, 2
je 0x140146326
mov rax, qword [rcx]
call qword [rax + 0x68]
mov rcx, qword [rbx + 0xa8]
lea r9, [rsp + 0x40]
xor eax, eax
mov r8d, edi
mov rdx, rsi
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140146359
lea rcx, [rbx + 0x88]
call fcn.14013c0b0
mov eax, dword [rsp + 0x40]
add qword [rbx + 0xb0], rax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1401466e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, r8
mov rcx, qword [rcx + 0xa8]
mov rsi, rdx
cmp rcx, 0xffffffffffffffff
je 0x1401467b6
mov eax, dword [rbx + 0x80]
test al, 2
je 0x1401467b6
test al, 8
je 0x140146762
mov r9d, 2
mov qword [rsp + 0x58], 0
lea r8, [rsp + 0x5c]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x58], eax
cmp eax, 0xffffffff
jne 0x140146756
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140146756
lea rcx, [rbx + 0x88]
call fcn.14013c0b0
mov rax, qword [rsp + 0x58]
mov qword [rbx + 0xb0], rax
mov rcx, qword [rbx + 0xa8]
lea r9, [rsp + 0x40]
mov r8d, edi
mov dword [rsp + 0x40], 0
mov rdx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14014679b
lea rcx, [rbx + 0x88]
call fcn.14013c0b0
mov eax, dword [rsp + 0x40]
add qword [rbx + 0xb0], rax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14014d490
Capabilities:
Hash data with md5

Disassembly:
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x50], xmm0
mov qword [rcx + 0x18], rax
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
ret

Function at 0x14014e220
Capabilities:
Hash data using sha1

Disassembly:
xorps xmm0, xmm0
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
xor eax, eax
mov qword [rcx + 0x1c], rax
mov dword [rcx + 0x64], eax
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov dword [rcx + 0x18], 0xc3d2e1f0
movups xmmword [rcx + 0x24], xmm0
movups xmmword [rcx + 0x34], xmm0
movups xmmword [rcx + 0x44], xmm0
movups xmmword [rcx + 0x54], xmm0
ret
Function at 0x140151b80
Capabilities:
Hash data using sha224
Hash data using sha256
Hash data using sha384
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140151b97
call fcn.1402cab34
mov edx, 0xd0
mov ecx, 1
call fcn.1402cab48
mov ecx, dword [rbx + 0x10]
mov qword [rbx + 8], rax
cmp ecx, 1
jne 0x140151bf0
mov dword [rax + 0x10], 0xc1059ed8
mov dword [rax + 0x14], 0x367cd507
mov dword [rax + 0x18], 0x3070dd17
mov dword [rax + 0x1c], 0xf70e5939
mov dword [rax + 0x20], 0xffc00b31
mov dword [rax + 0x24], 0x68581511
mov dword [rax + 0x28], 0x64f98fa7
mov dword [rax + 0x2c], 0xbefa4fa4
add rsp, 0x20
pop rbx
ret
cmp ecx, 2
jne 0x140151c33
mov dword [rax + 0x10], 0x6a09e667
mov dword [rax + 0x14], 0xbb67ae85
mov dword [rax + 0x18], 0x3c6ef372
mov dword [rax + 0x1c], 0xa54ff53a
mov dword [rax + 0x20], 0x510e527f
mov dword [rax + 0x24], 0x9b05688c
mov dword [rax + 0x28], 0x1f83d9ab
mov dword [rax + 0x2c], 0x5be0cd19
add rsp, 0x20
pop rbx
ret
cmp ecx, 3
jne 0x140151cae
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax + 0x10], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 0x18], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x20], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x28], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x30], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x38], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x40], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x48], rcx
add rsp, 0x20
pop rbx
ret
cmp ecx, 4
jne 0x140151d29
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax + 0x10], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 0x18], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x20], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x28], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x30], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x38], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x40], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x48], rcx
add rsp, 0x20
pop rbx
ret
cmp ecx, 5
jne 0x140151da4
movabs rcx, 0x8c3d37c819544da2
mov qword [rax + 0x10], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 0x18], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x20], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x28], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x30], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x38], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x40], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x48], rcx
add rsp, 0x20
pop rbx
ret
movabs rcx, 0x22312194fc2bf72c
mov qword [rax + 0x10], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 0x18], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x20], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x28], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x30], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x38], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x40], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x48], rcx
add rsp, 0x20
pop rbx
ret
Function at 0x14015c420
Capabilities:
Get mac address on windows

Disassembly:
jmp 0x14015c430
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rsp + 0x38], 0x2c0
mov dword [rcx], eax
mov rbx, rcx
mov word [rcx + 4], ax
mov ecx, 0x2c0
call fcn.1402bb024
lea rdx, [rsp + 0x38]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x14015c483
mov rcx, rdi
call fcn.1402ba9fc
mov ecx, dword [rsp + 0x38]
call fcn.1402bb024
mov rdi, rax
jmp 0x14015c487
test eax, eax
jne 0x14015c4de
lea rdx, [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x14015c4d6
xor dl, dl
mov rax, rdi
test rdi, rdi
je 0x14015c4d6
test dl, dl
jne 0x14015c4d6
cmp dword [rax + 0x1a4], 6
jne 0x14015c4ce
cmp dword [rax + 0x194], 6
jne 0x14015c4ce
mov ecx, dword [rax + 0x198]
mov dl, 1
mov dword [rbx], ecx
movzx ecx, word [rax + 0x19c]
mov word [rbx + 4], cx
mov rax, qword [rax]
test rax, rax
jne 0x14015c4a3
mov rcx, rdi
call fcn.1402ba9fc
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14015c430
Capabilities:
Get mac address on windows

Disassembly:
jmp 0x14015c430
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rsp + 0x38], 0x2c0
mov dword [rcx], eax
mov rbx, rcx
mov word [rcx + 4], ax
mov ecx, 0x2c0
call fcn.1402bb024
lea rdx, [rsp + 0x38]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x14015c483
mov rcx, rdi
call fcn.1402ba9fc
mov ecx, dword [rsp + 0x38]
call fcn.1402bb024
mov rdi, rax
jmp 0x14015c487
test eax, eax
jne 0x14015c4de
lea rdx, [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x14015c4d6
xor dl, dl
mov rax, rdi
test rdi, rdi
je 0x14015c4d6
test dl, dl
jne 0x14015c4d6
cmp dword [rax + 0x1a4], 6
jne 0x14015c4ce
cmp dword [rax + 0x194], 6
jne 0x14015c4ce
mov ecx, dword [rax + 0x198]
mov dl, 1
mov dword [rbx], ecx
movzx ecx, word [rax + 0x19c]
mov word [rbx + 4], cx
mov rax, qword [rax]
test rax, rax
jne 0x14015c4a3
mov rcx, rdi
call fcn.1402ba9fc
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14015c9d0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov qword [rsp + 0x50], 0
mov rbx, rdx
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov rcx, qword [rsp + 0x50]
mov r8, rbx
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x40]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x140184140
Capabilities:
Hash data with crc32

Disassembly:
mov r8d, ecx
lea r9, [0x14036b700]
shr r8d, 8
movzx ecx, cl
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx edx, r8b
shr r8d, 8
xor r8d, dword [r9 + rdx*4]
mov eax, r8d
ret
Function at 0x1401b8870
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r15
mov eax, 0xd8
call fcn.1402bb5d0
sub rsp, rax
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r12, qword [rdx + 8]
xor esi, esi
mov r15, qword [rdx + 0x10]
mov rax, r12
sub rax, r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov rdi, r8
mov r13, rdx
mov ebp, esi
cmp r15, r8
jb 0x1401b8a56
cmp r8, 0x40
ja 0x1401b8a56
lea rax, [rsp + 0x40]
mov qword [rsp + 0x118], rbx
neg rax
mov qword [rsp + 0xd0], r14
and eax, 0x3f
lea r14, [rsp + 0x40]
add r14, rax
lea rax, [r8 + 0x100]
cmp r15, rax
jbe 0x1401b890a
mov rbp, r15
sub rbp, r8
sub rbp, 0x100
xor edx, edx
mov qword [rsp + 0x20], rsi
mov rcx, r14
mov rbx, rsi
call fcn.14030b3a0
mov r9, rsi
cmp rbp, r15
jae 0x1401b89c7
mov r11, qword [r13 + 0x20]
mov r10, qword [rsp + 0x28]
lea r13, [r11 + r12]
nop word [rax + rax]
lea rdx, [r11 + rbp]
mov rax, rbp
xor rax, r10
mov rcx, rdx
sub rcx, r13
xor rcx, r12
lea r8, [rax - 1]
not rax
shr rax, 0x3f
shr r8, 0x3f
and r8, rax
mov rax, rbp
xor rax, r12
neg r8
or rcx, rax
mov rax, r8
xor rcx, rbp
or rax, rsi
shr rcx, 0x3f
and r8, r9
neg rcx
or rbx, r8
mov rsi, rcx
inc rbp
and rsi, rax
movzx eax, byte [rdx]
and al, sil
or byte [r9 + r14], al
inc r9
mov rcx, r9
mov rax, rdi
sub rcx, rdi
xor rax, r9
xor rcx, rdi
or rcx, rax
xor rcx, r9
shr rcx, 0x3f
neg rcx
and r9, rcx
cmp rbp, r15
jb 0x1401b8940
xor esi, esi
test rdi, rdi
je 0x1401b8a3f
mov r9, qword [rsp + 0x30]
mov rax, rbx
and rax, 0xffffffffffffffdf
movzx r8d, byte [rax + r14]
mov rax, rbx
or rax, 0x20
movzx edx, byte [rax + r14]
mov eax, ebx
and eax, 0x20
inc rbx
dec eax
shr eax, 0x1f
neg al
movzx eax, al
mov dword [rsp + 0x28], eax
not eax
mov dword [rsp + 0x20], eax
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x28]
and cl, dl
and al, r8b
or al, cl
mov rcx, rbx
sub rcx, rdi
mov byte [r9 + rsi], al
xor rcx, rdi
mov rax, rdi
xor rax, rbx
inc rsi
or rcx, rax
xor rcx, rbx
shr rcx, 0x3f
neg rcx
and rbx, rcx
cmp rsi, rdi
jb 0x1401b89d1
mov r14, qword [rsp + 0xd0]
mov eax, 1
mov rbx, qword [rsp + 0x118]
jmp 0x1401b8a58
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1402ba9b0
add rsp, 0xd8
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401b9bf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
mov eax, 0x20
call fcn.1402bb5d0
sub rsp, rax
mov rax, qword [rcx + 8]
lea rsi, [r9 + 1]
mov rbx, rdx
mov rdx, qword [rdx + 8]
mov r9, qword [rax + 0xc0]
test byte [r9 + 0x60], 1
je 0x1401b9c88
lea rax, [rsi + r8]
cmp rax, rdx
ja 0x1401b9c8d
add qword [rbx + 0x20], r8
sub rdx, r8
add qword [rbx + 0x28], r8
sub qword [rbx + 0x10], r8
mov qword [rbx + 8], rdx
mov rax, qword [rbx + 0x20]
mov rcx, qword [rcx + 0x438]
mov qword [rsp + 0x38], rdi
movzx edi, byte [rax + rdx - 1]
call fcn.1401960e0
mov rcx, rax
call fcn.1401e92f0
mov rdx, qword [rbx + 8]
and eax, 0x200000
je 0x1401b9c9a
sub rdx, rdi
mov eax, 1
mov rdi, qword [rsp + 0x38]
dec rdx
mov qword [rbx + 8], rdx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
cmp rsi, rdx
jbe 0x1401b9c3c
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
lea rcx, [rdi + rsi]
mov r8, rdx
sub r8, rcx
mov esi, 0x100
xor r8, rcx
mov rax, rdx
xor rax, rcx
or r8, rax
xor r8, rdx
shr r8, 0x3f
dec r8
cmp rdx, rsi
cmovb rsi, rdx
xor r9d, r9d
test rsi, rsi
je 0x1401b9d1d
mov r11, qword [rbx + 0x20]
mov r10, rdi
shr r10, 0x3f
dec r11
add r11, rdx
nop
mov rax, r9
lea r11, [r11 - 1]
shr rax, 0x3f
mov rcx, rdi
sub rcx, r9
inc r9
shr rcx, 0x3f
xor cl, al
xor al, r10b
or cl, al
xor cl, r10b
dec cl
movzx edx, cl
movzx ecx, byte [r11 + 1]
xor rcx, rdi
and rdx, rcx
not rdx
and r8, rdx
cmp r9, rsi
jb 0x1401b9ce0
lea rax, [rdi + 1]
not r8
mov rdi, qword [rsp + 0x38]
movzx ecx, r8b
dec rcx
shr rcx, 0x3f
neg rcx
and rax, rcx
sub qword [rbx + 8], rax
mov rbx, qword [rsp + 0x40]
mov dword [rsp + 0x30], ecx
not ecx
mov dword [rsp + 0x48], ecx
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x48]
and ecx, 1
or eax, ecx
add rsp, 0x20
pop rsi
ret
Function at 0x1401d9f30
Capabilities:
Encode data using xor

Disassembly:
push rbx
movsxd rbx, r9d
mov r10, r8
mov r11, rdx
cmp rdx, r8
je 0x1401da092
mov qword [rsp + 0x10], rsi
lea rsi, [rcx - 1]
not rcx
shr rsi, 0x3f
shr rcx, 0x3f
and rsi, rcx
mov ecx, dword [rdx + 8]
xor ecx, dword [r8 + 8]
dec rsi
and ecx, esi
xor dword [rdx + 8], ecx
xor dword [r8 + 8], ecx
mov ecx, dword [rdx + 0x10]
movq xmm4, rsi
xor ecx, dword [r8 + 0x10]
and ecx, esi
punpcklqdq xmm4, xmm4
xor dword [rdx + 0x10], ecx
xor dword [r8 + 0x10], ecx
mov edx, dword [rdx + 0x14]
mov ecx, dword [r8 + 0x14]
xor rcx, rdx
and ecx, 4
and rcx, rsi
mov eax, ecx
xor eax, edx
mov dword [r11 + 0x14], eax
xor dword [r8 + 0x14], ecx
xor ecx, ecx
mov edx, ecx
test r9d, r9d
jle 0x1401da04e
cmp ebx, 2
jb 0x1401da04e
mov r9, qword [r8]
lea rax, [rbx - 1]
mov r8, qword [r11]
mov qword [rsp + 0x18], rdi
lea rdi, [rbx - 1]
lea rdi, [r9 + rdi*8]
lea rax, [r8 + rax*8]
cmp r9, rax
ja 0x1401d9fde
cmp rdi, r8
jae 0x1401da049
cmp r9, r10
ja 0x1401d9fe8
cmp rdi, r10
jae 0x1401da049
cmp r9, r11
ja 0x1401d9ff2
cmp rdi, r11
jae 0x1401da049
cmp r8, r10
ja 0x1401d9ffc
cmp rax, r10
jae 0x1401da049
cmp r8, r11
ja 0x1401da006
cmp rax, r11
jae 0x1401da049
mov eax, ebx
and eax, 0xfffffffe
nop dword [rax + rax]
movdqu xmm2, xmmword [rcx + r9]
add edx, 2
movdqu xmm1, xmmword [rcx + r8]
lea rcx, [rcx + 0x10]
movdqa xmm3, xmm2
xorps xmm3, xmm1
andps xmm3, xmm4
movdqa xmm0, xmm3
xorps xmm3, xmm2
xorps xmm0, xmm1
movdqu xmmword [rcx + r8 - 0x10], xmm0
movdqu xmmword [rcx + r9 - 0x10], xmm3
cmp edx, eax
jl 0x1401da010
mov rdi, qword [rsp + 0x18]
movsxd rax, edx
cmp rax, rbx
jge 0x1401da08d
nop word [rax + rax]
mov rcx, qword [r11]
mov rdx, qword [rcx + rax*8]
lea r8, [rcx + rax*8]
mov rcx, qword [r10]
mov r9, rdx
xor r9, qword [rcx + rax*8]
and r9, rsi
xor rdx, r9
mov qword [r8], rdx
mov rcx, qword [r10]
xor qword [rcx + rax*8], r9
inc rax
cmp rax, rbx
jl 0x1401da060
mov rsi, qword [rsp + 0x10]
pop rbx
ret
Function at 0x1401e6370
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x38
call fcn.1402bb5d0
sub rsp, rax
mov r10, rcx
test r9, r9
jne 0x1401e63ac
mov edx, 0xe2
mov dword [rsp + 0x20], 0x9a
lea r9, str.crypto_asn1_a_int.c
lea ecx, [rax - 0x2b]
lea r8d, [rdx - 4]
call fcn.1401d91c0
xor eax, eax
add rsp, 0x38
ret
movzx r11d, byte [r8]
and r11d, 0x80
test rdx, rdx
je 0x1401e63bf
mov dword [rdx], r11d
cmp r9, 1
jne 0x1401e63e1
test r10, r10
je 0x1401e63d7
movzx eax, byte [r8]
test r11d, r11d
je 0x1401e63d5
neg al
mov byte [rcx], al
mov eax, 1
add rsp, 0x38
ret
movzx ecx, byte [r8]
test cl, cl
jne 0x1401e63f3
mov eax, 1
jmp 0x1401e64aa
xor eax, eax
cmp cl, 0xff
jne 0x1401e64e3
xor edx, edx
lea rcx, [r9 - 1]
mov eax, 1
cmp r9, rax
jbe 0x1401e649f
cmp rcx, 8
jb 0x1401e6490
and ecx, 7
mov rdx, r9
sub rdx, rcx
xorps xmm3, xmm3
xorps xmm2, xmm2
nop word [rax + rax]
movd xmm1, dword [rax + r8]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
orps xmm3, xmm1
movd xmm1, dword [r8 + rax + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
orps xmm2, xmm1
cmp rax, rdx
jb 0x1401e6430
orps xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
orps xmm2, xmm0
movd edx, xmm2
cmp rax, r9
jae 0x1401e649f
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rax + r8]
inc rax
or edx, ecx
cmp rax, r9
jb 0x1401e6490
xor eax, eax
test edx, edx
setne al
test edx, edx
je 0x1401e64e3
movzx ecx, byte [r8 + 1]
and ecx, 0x80
cmp r11d, ecx
jne 0x1401e64e3
mov edx, 0xe2
mov dword [rsp + 0x20], 0xbb
lea r9, str.crypto_asn1_a_int.c
mov ecx, reloc.WS2_32.dll_listen
lea r8d, [rdx - 5]
call fcn.1401d91c0
xor eax, eax
add rsp, 0x38
ret
mov qword [rsp + 0x30], rbx
mov rbx, r9
sub rbx, rax
test r10, r10
je 0x1401e652d
neg r11d
sbb r11d, r11d
add r9, r8
movzx r11d, r11b
mov edx, r11d
and edx, 1
test rbx, rbx
je 0x1401e652d
mov r8, rbx
nop
movzx ecx, byte [r9 - 1]
lea r9, [r9 - 1]
dec r8
xor ecx, r11d
add edx, ecx
mov byte [r8 + r10], dl
shr edx, 8
test r8, r8
jne 0x1401e6510
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret