joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cae90
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x120
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
mov rax, qword [0x140391620]
xor rax, rsp
mov qword [rsp + 0xe8], rax
mov rbx, rdx
lea rdx, [rsp + 0x30]
call fcn.140063a10
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xc8], rcx
mov rcx, qword [rax + 0x20]
mov qword [rsp + 0xd8], rcx
lea rax, method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_8
mov qword [rdi + 0x10], rax
lea rax, [0x140339d78]
mov qword [rdi + 0x20], rax
mov rdx, rdi
lea rcx, [rsp + 0xb8]
mov rax, qword [rsp + 0xc8]
call qword [rax + 0x10]
mov qword [rdi + 0x18], 0
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0xe0], rax
lea rax, [0x1403396e0]
mov qword [rdi + 0x28], rax
mov rax, qword [rdi + 0x10]
mov rdx, qword [rax]
lea rax, [sym.ethminer.exe_public_virtual:_void___cdecl_Json::CharReader::destructor_void____ptr64]
cmp rdx, rax
je 0x1400caf51
mov rcx, rdi
call rdx
nop
mov rax, qword [rsp + 0xd8]
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1400caf93
lea rax, [0x1400cb500]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xb8]
call r8
jmp 0x1400cb05a
mov rdi, qword [rbx]
mov rsi, qword [rbx + 8]
mov ebp, dword [rbx + 0x10]
mov r14, qword [rbx + 0x18]
movups xmm6, xmmword [rbx + 0x20]
movups xmm7, xmmword [rbx + 0x30]
movups xmm8, xmmword [rbx + 0x40]
mov rbx, qword [rbx + 0x50]
mov ecx, dword [0x1403a2700]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400caff2
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1400caff2
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x1400caff2
mov qword [rcx + 0x10], 0
movzx ecx, byte [rax]
cmp cl, 0x1a
jb 0x1400cafea
mov byte [rax + 0x68], cl
jmp 0x1400cb000
mov rcx, rax
call fcn.1400eadb0
mov ecx, 0x69
call fcn.140255070
mov byte [rax + 0x68], 0x1a
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rsi
mov dword [rax + 0x18], ebp
mov qword [rax + 0x20], r14
movups xmmword [rax + 0x28], xmm6
movups xmmword [rax + 0x38], xmm7
movups xmmword [rax + 0x48], xmm8
mov qword [rax + 0x58], rbx
lea rcx, [0x1400cb900]
mov qword [rax], rcx
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xb8]
mov rax, qword [rsp + 0xd8]
call qword [rax + 0x10]
nop
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x1400cb05a
xor edx, edx
mov rcx, rax
call qword [rax]
nop
lea rcx, [rsp + 0xb8]
mov rax, qword [rsp + 0xc8]
call qword [rax]
nop
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.140255050
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400cb510
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
movups xmm0, xmmword [rdx + 0x50]
movups xmmword [rbp - 0x59], xmm0
mov rax, qword [rcx]
mov qword [rbp - 0x49], rax
movups xmm0, xmmword [rcx + 8]
movups xmmword [rbp - 0x41], xmm0
movsd xmm1, qword [rcx + 0x18]
movsd qword [rbp - 0x31], xmm1
mov eax, dword [rcx + 0x20]
mov dword [rbp - 0x29], eax
mov rax, qword [rcx + 0x28]
mov qword [rbp - 0x21], rax
mov rax, qword [rcx + 0x30]
mov qword [rbp - 0x19], rax
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rbp - 9], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rbp + 7], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rbp + 0x17], xmm0
mov rax, qword [rcx + 0x70]
mov qword [rbp + 0x27], rax
lea rdi, [rdx + 0x48]
mov rsi, qword [rdx + 0x40]
mov rbx, qword [rdi]
mov ecx, dword [0x1403a2748]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400cb5b2
nop
cmp qword [rax], rbx
je 0x1400cb687
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400cb5a0
lea rax, [rbp - 0x59]
mov qword [rbp + 0x2f], rax
lea rdx, [rbp + 7]
mov ecx, 0xc8
call fcn.140035580
mov r8, rax
xor ecx, ecx
mov qword [rax + 0x20], rcx
lea rax, [0x1400cbcc0]
mov qword [r8 + 0x28], rax
mov qword [r8], rcx
mov qword [r8 + 8], rcx
mov qword [r8 + 0x10], rcx
mov qword [r8 + 0x18], rcx
mov dword [r8 + 0x30], ecx
movups xmm0, xmmword [rbp - 0x59]
movups xmmword [r8 + 0x38], xmm0
mov rax, qword [rbp - 0x49]
mov qword [r8 + 0x48], rax
movups xmm0, xmmword [rbp - 0x41]
movups xmmword [r8 + 0x50], xmm0
movsd xmm1, qword [rbp - 0x31]
movsd qword [r8 + 0x60], xmm1
mov eax, dword [rbp - 0x29]
mov dword [r8 + 0x68], eax
mov rax, qword [rbp - 0x21]
mov qword [r8 + 0x70], rax
mov rax, qword [rbp - 0x19]
mov qword [r8 + 0x78], rax
movups xmm0, xmmword [rbp - 9]
movups xmmword [r8 + 0x88], xmm0
movups xmm1, xmmword [rbp + 7]
movups xmmword [r8 + 0x98], xmm1
movups xmm0, xmmword [rbp + 0x17]
movups xmmword [r8 + 0xa8], xmm0
mov rax, qword [rbp + 0x27]
mov qword [r8 + 0xb8], rax
mov qword [rbp + 0x3f], rcx
mov qword [rbp + 0x37], rcx
mov rdx, rdi
mov rcx, rsi
call fcn.140037790
nop
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
cmp qword [rax + 8], 0
je 0x1400cb5b2
nop
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x59]
call fcn.1400cbdc0
nop
nop
jmp 0x1400cb66e
Function at 0x1400d5c50
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rdi, rcx
add rcx, 0x28
mov qword [rsp + 0x68], rcx
call fcn.1402329f8
test eax, eax
jne 0x1400d5d9f
xor ebx, ebx
cmp qword [rdi + 0x78], rbx
je 0x1400d5c8b
mov eax, 3
lock cmpxchg dword [rdi + 0x80], ebx
jmp 0x1400d5d04
mov eax, ebx
xchg dword [rdi + 0x80], eax
mov ecx, 0x10
call fcn.140255070
mov rsi, rax
mov qword [rsp + 0x60], rax
mov ecx, 8
call fcn.140255070
mov qword [rax], rdi
mov qword [rsp + 0x70], rax
lea r14, [rsi + 8]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1400d61d0]
xor edx, edx
xor ecx, ecx
call fcn.140261888
mov qword [rsi], rax
test rax, rax
je 0x1400d5d91
mov rcx, qword [rdi + 0x78]
mov qword [rdi + 0x78], rsi
test rcx, rcx
je 0x1400d5d04
cmp dword [rcx + 8], 0
jne 0x1400d5d8b
mov edx, 0x10
call fcn.1402550ac
mov eax, dword [rdi + 0x80]
nop
test eax, eax
jne 0x1400d5d77
movabs rbp, 0x7fffffffffffb1df
movabs rsi, 0x7fffffffffffffff
call fcn.1402318b4
mov rbx, rax
call fcn.140231898
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rbp
jge 0x1400d5d5d
add rax, 0x4e20
mov qword [rsp + 0x60], rax
jmp 0x1400d5d62
mov qword [rsp + 0x60], rsi
lea rcx, [rsp + 0x60]
call fcn.140090940
mov eax, dword [rdi + 0x80]
nop
test eax, eax
je 0x1400d5d23
mov rcx, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.140232a1c
call fcn.140265b64
nop
mov dword [r14], ebx
mov ecx, 6
call fcn.140231d70
nop
mov ecx, eax
call fcn.140231d34
int3
Function at 0x1400eaa20
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x70
mov rax, qword [0x140391620]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov edi, dword [rcx]
mov ecx, dword [0x1403a0e90]
mov rax, qword gs:[0x58]
mov esi, 0x1028
mov r14d, 0x1020
add rsi, qword [rax + rcx*8]
add r14, qword [rax + rcx*8]
movups xmm1, xmmword [rsi]
mov ebx, dword [r14]
movups xmm0, xmmword [rsi + 0x10]
movd ecx, xmm1
movups xmmword [rsp + 0x40], xmm1
movups xmmword [rsp + 0x50], xmm0
cmp ecx, edi
je 0x1400eab0e
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400ee570
cmp dword [rsp + 0x20], edi
jne 0x1400eaab6
movups xmm0, xmmword [rsp + 0x20]
lea eax, [rbx + 1]
movups xmm1, xmmword [rsp + 0x30]
mov dword [r14], eax
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x1400eab10
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x40], xmm0
xor ebx, ebx
movups xmmword [rsp + 0x50], xmm1
movd eax, xmm0
cmp eax, edi
je 0x1400eab04
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400ee570
movups xmm0, xmmword [rsp + 0x20]
inc ebx
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm1
cmp ebx, 0x7530
jl 0x1400eaac8
mov eax, 0xffffffff
jmp 0x1400eab10
movups xmmword [rsi], xmm0
mov dword [r14], ebx
movups xmmword [rsi + 0x10], xmm1
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140255050
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
Function at 0x1400ee360
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x110
mov rax, qword [0x140391620]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rsi, r8
mov qword [rsp + 0x20], 0
mov rbx, rdx
lea r15, [rsp + 0x20]
mov r14, rcx
xor edx, edx
mov r8d, 0xc8
lea rcx, [rsp + 0x30]
call fcn.140257fe0
cmp rsi, 0x88
jb 0x1400ee4a1
movabs rax, 0xf0f0f0f0f0f0f0f1
mul rsi
mov rdi, rdx
shr rdi, 7
nop dword [rax]
xor ecx, ecx
lea rax, [rbx + 0x80]
lea rdx, [rsp + 0x30]
cmp rdx, rax
ja 0x1400ee400
lea rax, [rsp + 0xb0]
cmp rax, rbx
jae 0x1400ee470
movdqu xmm0, xmmword [rsp + rcx*8 + 0x30]
movdqu xmm1, xmmword [rbx]
pxor xmm1, xmm0
movdqu xmmword [rsp + rcx*8 + 0x30], xmm1
movdqu xmm0, xmmword [rsp + rcx*8 + 0x40]
movdqu xmm1, xmmword [rbx + 0x10]
pxor xmm1, xmm0
movdqu xmmword [rsp + rcx*8 + 0x40], xmm1
movdqu xmm0, xmmword [rsp + rcx*8 + 0x50]
movdqu xmm1, xmmword [rbx + 0x20]
pxor xmm1, xmm0
movdqu xmmword [rsp + rcx*8 + 0x50], xmm1
movdqu xmm0, xmmword [rsp + rcx*8 + 0x60]
movdqu xmm1, xmmword [rbx + 0x30]
add rbx, 0x40
pxor xmm1, xmm0
movdqu xmmword [rsp + rcx*8 + 0x60], xmm1
add rcx, 8
cmp rcx, 0x10
jb 0x1400ee400
cmp rcx, 0x11
jae 0x1400ee485
nop word [rax + rax]
mov rax, qword [rbx]
add rbx, 8
xor qword [rsp + rcx*8 + 0x30], rax
inc rcx
cmp rcx, 0x11
jb 0x1400ee470
lea rcx, [rsp + 0x30]
call qword [0x14038c018]
sub rsi, 0x88
sub rdi, 1
jne 0x1400ee3e0
lea rdi, [rsp + 0x30]
cmp rsi, 8
jb 0x1400ee4d4
mov rcx, rsi
shr rcx, 3
imul rax, rcx, 0xfffffffffffffff8
add rsi, rax
nop word [rax + rax]
mov rax, qword [rbx]
add rbx, 8
xor qword [rdi], rax
add rdi, 8
sub rcx, 1
jne 0x1400ee4c0
test rsi, rsi
je 0x1400ee4f1
mov r8, rsi
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.140257930
lea r15, [rsp + 0x20]
add r15, rsi
mov byte [r15], 1
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x20]
xor qword [rdi], rax
movabs rax, 0x8000000000000000
xor qword [rsp + 0xb0], rax
call qword [0x14038c018]
mov rax, qword [rsp + 0x30]
mov qword [r14], rax
mov rax, qword [rsp + 0x38]
mov qword [r14 + 8], rax
mov rax, qword [rsp + 0x40]
mov qword [r14 + 0x10], rax
mov rax, qword [rsp + 0x48]
mov qword [r14 + 0x18], rax
mov rax, r14
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140255050
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x1400ee570
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x110
mov rax, qword [0x140391620]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rbx, rdx
mov qword [rsp + 0x20], 0
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0xc8
call fcn.140257fe0
lea rax, [rsp + 0x30]
mov edx, 4
nop word [rax + rax]
mov r8, qword [rbx]
lea rbx, [rbx + 8]
xor qword [rax], r8
lea rax, [rax + 8]
sub rdx, 1
jne 0x1400ee5c0
mov byte [rsp + 0x20], 1
mov rcx, qword [rsp + 0x20]
xor qword [rax], rcx
movabs rax, 0x8000000000000000
xor qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x30]
call qword [0x14038c018]
mov rax, qword [rsp + 0x30]
mov qword [rdi], rax
mov rax, qword [rsp + 0x38]
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x40]
mov qword [rdi + 0x10], rax
mov rax, qword [rsp + 0x48]
mov qword [rdi + 0x18], rax
mov rax, rdi
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140255050
mov rbx, qword [rsp + 0x120]
add rsp, 0x110
pop rdi
ret
Function at 0x1400ee650
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x140391620]
xor rax, rsp
mov qword [rbp], rax
mov rsi, r8
mov qword [rsp + 0x20], 0
mov rbx, rdx
lea r15, [rsp + 0x20]
mov r14, rcx
xor edx, edx
mov r8d, 0xc8
lea rcx, [rsp + 0x30]
call fcn.140257fe0
cmp rsi, 0x48
jb 0x1400ee72a
movabs rax, 0xe38e38e38e38e38f
mul rsi
mov rdi, rdx
shr rdi, 6
mov rax, qword [rbx]
lea rcx, [rsp + 0x30]
xor qword [rsp + 0x30], rax
mov rax, qword [rbx + 8]
xor qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x10]
xor qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x18]
xor qword [rsp + 0x48], rax
mov rax, qword [rbx + 0x20]
xor qword [rsp + 0x50], rax
mov rax, qword [rbx + 0x28]
xor qword [rsp + 0x58], rax
mov rax, qword [rbx + 0x30]
xor qword [rsp + 0x60], rax
mov rax, qword [rbx + 0x38]
xor qword [rsp + 0x68], rax
mov rax, qword [rbx + 0x40]
add rbx, 0x48
xor qword [rsp + 0x70], rax
call qword [0x14038c018]
sub rsi, 0x48
sub rdi, 1
jne 0x1400ee6c1
lea rdi, [rsp + 0x30]
cmp rsi, 8
jb 0x1400ee764
mov rcx, rsi
shr rcx, 3
imul rax, rcx, 0xfffffffffffffff8
add rsi, rax
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbx]
add rbx, 8
xor qword [rdi], rax
add rdi, 8
sub rcx, 1
jne 0x1400ee750
test rsi, rsi
je 0x1400ee781
mov r8, rsi
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.140257930
lea r15, [rsp + 0x20]
add r15, rsi
mov byte [r15], 1
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x20]
xor qword [rdi], rax
movabs rax, 0x8000000000000000
xor qword [rsp + 0x70], rax
call qword [0x14038c018]
mov rax, qword [rsp + 0x30]
mov qword [r14], rax
mov rax, qword [rsp + 0x38]
mov qword [r14 + 8], rax
mov rax, qword [rsp + 0x40]
mov qword [r14 + 0x10], rax
mov rax, qword [rsp + 0x48]
mov qword [r14 + 0x18], rax
mov rax, qword [rsp + 0x50]
mov qword [r14 + 0x20], rax
mov rax, qword [rsp + 0x58]
mov qword [r14 + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [r14 + 0x30], rax
mov rax, qword [rsp + 0x68]
mov qword [r14 + 0x38], rax
mov rax, r14
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140255050
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400ee820
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x110
mov rax, qword [0x140391620]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rbx, rdx
mov qword [rsp + 0x20], 0
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0xc8
call fcn.140257fe0
lea rax, [rsp + 0x30]
mov edx, 8
nop word [rax + rax]
mov r8, qword [rbx]
lea rbx, [rbx + 8]
xor qword [rax], r8
lea rax, [rax + 8]
sub rdx, 1
jne 0x1400ee870
mov byte [rsp + 0x20], 1
mov rcx, qword [rsp + 0x20]
xor qword [rax], rcx
movabs rax, 0x8000000000000000
xor qword [rsp + 0x70], rax
lea rcx, [rsp + 0x30]
call qword [0x14038c018]
mov rax, qword [rsp + 0x30]
mov qword [rdi], rax
mov rax, qword [rsp + 0x38]
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x40]
mov qword [rdi + 0x10], rax
mov rax, qword [rsp + 0x48]
mov qword [rdi + 0x18], rax
mov rax, qword [rsp + 0x50]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x30], rax
mov rax, qword [rsp + 0x68]
mov qword [rdi + 0x38], rax
mov rax, rdi
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140255050
mov rbx, qword [rsp + 0x120]
add rsp, 0x110
pop rdi
ret
Function at 0x14015c390
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140255e30
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x14016feb0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140255e30
sub rsp, rax
lea rcx, [0x14039f6f8]
add rsp, 0x28
jmp fcn.14015c1f0

Function at 0x14017bf60
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x14017bf87
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x14017bf70
movzx eax, r9b
ret
Function at 0x1401a7ab0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x30
call fcn.140255e30
sub rsp, rax
mov rdi, r8
mov r14, rdx
mov r8, qword [rsp + 0xa0]
mov r15, rcx
mov ebx, dword [r8]
mov dword [rsp + 0x80], ebx
test ebx, ebx
je 0x1401a7b28
mov rdx, qword [rsp + 0x98]
nop dword [rax]
test rdi, rdi
je 0x1401a7b21
mov eax, ebx
dec rdi
movzx ecx, byte [rax + rdx]
xor cl, byte [r15]
inc r15
mov byte [r14], cl
inc r14
inc ebx
and ebx, 0xf
jne 0x1401a7b00
mov dword [rsp + 0x80], ebx
mov rcx, qword [rsp + 0x90]
mov esi, 0xc
movzx r13d, byte [rcx + 0xc]
lea r12, [rcx + 0xc]
mov r10, qword [rsp + 0xa8]
shl r13d, 8
movzx eax, byte [rcx + 0xd]
lea ebp, [rsi - 0xb]
or r13d, eax
movzx eax, byte [rcx + 0xe]
shl r13d, 8
or r13d, eax
movzx eax, byte [rcx + 0xf]
shl r13d, 8
or r13d, eax
cmp rdi, 0x10
jb 0x1401a7c4d
mov eax, 0x10000000
mov ebx, esi
nop dword [rax + rax]
mov rsi, rdi
shr rsi, 4
cmp rsi, rax
cmova rsi, rax
add r13d, esi
mov eax, r13d
cmp rax, rsi
jae 0x1401a7b9f
sub rsi, rax
xor r13d, r13d
mov qword [rsp + 0x20], rcx
mov r8, rsi
mov rcx, r15
mov rdx, r14
call r10
mov rcx, qword [rsp + 0x90]
mov eax, r13d
shr eax, 0x18
mov byte [r12], al
mov eax, r13d
shr eax, 0x10
mov byte [rcx + 0xd], al
mov eax, r13d
shr eax, 8
mov byte [rcx + 0xe], al
mov byte [rcx + 0xf], r13b
test r13d, r13d
jne 0x1401a7c0d
mov r8d, ebx
mov ecx, ebp
mov rdx, r12
nop word [rax + rax]
movzx eax, byte [rdx - 1]
lea rdx, [rdx - 1]
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
add r8d, 0xffffffff
jne 0x1401a7bf0
mov rcx, qword [rsp + 0x90]
mov r9, qword [rsp + 0x88]
mov eax, 0x10000000
mov r10, qword [rsp + 0xa8]
shl rsi, 4
sub rdi, rsi
add r14, rsi
add r15, rsi
cmp rdi, 0x10
jae 0x1401a7b80
mov ebx, dword [rsp + 0x80]
mov esi, 0xc
mov r8, qword [rsp + 0xa0]
test rdi, rdi
je 0x1401a7d02
mov rax, qword [rsp + 0x98]
xor edx, edx
mov qword [rsp + 0x20], rcx
mov r8, rbp
mov rcx, rax
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov rdx, rax
call r10
mov rcx, qword [rsp + 0x90]
inc r13d
mov eax, r13d
shr eax, 0x18
mov byte [r12], al
mov eax, r13d
shr eax, 0x10
mov byte [rcx + 0xd], al
mov eax, r13d
shr eax, 8
mov byte [rcx + 0xe], al
mov byte [rcx + 0xf], r13b
test r13d, r13d
jne 0x1401a7cc9
nop dword [rax + rax]
movzx eax, byte [r12 - 1]
lea r12, [r12 - 1]
add ebp, eax
mov byte [r12], bpl
shr ebp, 8
add esi, 0xffffffff
jne 0x1401a7cb0
mov rdx, qword [rsp + 0x98]
nop dword [rax]
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r15]
xor al, byte [rcx + rdx]
mov byte [rcx + r14], al
sub rdi, 1
jne 0x1401a7ce0
mov rax, qword [rsp + 0xa0]
mov dword [rax], ebx
jmp 0x1401a7d05
mov dword [r8], ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401a83d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
mov eax, 0x20
call fcn.140255e30
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov rbx, r8
mov r14, rdx
mov rsi, rcx
je 0x1401a840f
mov eax, 0xfffffffe
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rcx, qword [rcx + 0x30]
movabs rax, 0x2000000000000000
add rcx, rbx
cmp rcx, rax
ja 0x1401a84e0
cmp rcx, rbx
jb 0x1401a84e0
mov qword [rsp + 0x38], rdi
mov edi, dword [rsi + 0x174]
mov qword [rsi + 0x30], rcx
test edi, edi
je 0x1401a8474
test rbx, rbx
je 0x1401a8463
movzx eax, byte [r14]
dec rbx
mov ecx, edi
inc r14
xor byte [rcx + rsi + 0x40], al
inc edi
and edi, 0xf
jne 0x1401a8445
jmp 0x1401a8467
test edi, edi
jne 0x1401a84c2
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call fcn.1401a9a60
mov qword [rsp + 0x30], rbp
mov rbp, rbx
and rbp, 0xfffffffffffffff0
je 0x1401a849b
lea rdx, [rsi + 0x60]
mov r9, rbp
lea rcx, [rsi + 0x40]
mov r8, r14
call fcn.1401a9890
add r14, rbp
sub rbx, rbp
mov rbp, qword [rsp + 0x30]
test rbx, rbx
je 0x1401a84c2
mov edi, ebx
lea rcx, [rsi + 0x40]
sub r14, rsi
nop
movzx eax, byte [r14 + rcx - 0x40]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rbx, 1
jne 0x1401a84b0
mov dword [rsi + 0x174], edi
xor eax, eax
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rbx, qword [rsp + 0x40]
or eax, 0xffffffff
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1401a9630
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r15
mov eax, 0x20
call fcn.140255e30
sub rsp, rax
xor ebp, ebp
mov rsi, r8
mov qword [rcx + 0x30], rbp
mov r15, rdx
mov qword [rcx + 0x38], rbp
mov rbx, rcx
mov qword [rcx + 0x170], rbp
cmp r8, 0xc
jne 0x1401a9681
movsd xmm0, qword [rdx]
lea edi, [rbp + 1]
movsd qword [rcx], xmm0
mov eax, dword [rdx + 8]
mov dword [rcx + 8], eax
mov dword [rcx + 0xc], 0x1000000
jmp 0x1401a97e2
mov qword [rsp + 0x58], r13
mov r13, rsi
mov qword [rcx + 0x40], rbp
mov qword [rsp + 0x60], r14
mov qword [rcx + 0x48], rbp
cmp rsi, 0x10
jb 0x1401a9724
mov rbp, rsi
mov qword [rsp + 0x50], r12
shr rbp, 4
mov rdi, r15
imul rax, rbp, 0xfffffffffffffff0
sub rdi, rbx
add rsi, rax
sub rdi, 0x3f
mov rax, rbp
shl rax, 4
add r15, rax
nop word [rax + rax]
lea rax, [rbx + 0x40]
mov edx, 4
nop dword [rax]
movzx ecx, byte [rax + rdi - 1]
xor byte [rax], cl
movzx ecx, byte [rax + rdi]
xor byte [rax + 1], cl
movzx ecx, byte [rax + rdi + 1]
xor byte [rax + 2], cl
movzx ecx, byte [rax + rdi + 2]
xor byte [rax + 3], cl
lea rax, [rax + 4]
sub rdx, 1
jne 0x1401a96e0
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
call fcn.1401a9a60
add rdi, 0x10
sub rbp, 1
jne 0x1401a96d0
mov r12, qword [rsp + 0x50]
test rsi, rsi
je 0x1401a974f
lea rcx, [rbx + 0x40]
sub r15, rbx
movzx eax, byte [r15 + rcx - 0x40]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rsi, 1
jne 0x1401a9730
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
call fcn.1401a9a60
shl r13, 3
lea rdx, [rbx + 0x60]
xor byte [rbx + 0x4f], r13b
lea rcx, [rbx + 0x40]
mov rax, r13
shr rax, 0x38
xor byte [rbx + 0x48], al
mov rax, r13
shr rax, 0x30
xor byte [rbx + 0x49], al
mov rax, r13
shr rax, 0x28
xor byte [rbx + 0x4a], al
mov rax, r13
shr rax, 0x20
xor byte [rbx + 0x4b], al
mov rax, r13
shr rax, 0x18
xor byte [rbx + 0x4c], al
mov rax, r13
shr rax, 0x10
xor byte [rbx + 0x4d], al
mov rax, r13
shr rax, 8
xor byte [rbx + 0x4e], al
call fcn.1401a9a60
movzx eax, byte [rbx + 0x4d]
movzx edi, byte [rbx + 0x4c]
mov r14, qword [rsp + 0x60]
mov r13, qword [rsp + 0x58]
shl edi, 8
or edi, eax
movzx eax, byte [rbx + 0x4e]
shl edi, 8
or edi, eax
movzx eax, byte [rbx + 0x4f]
shl edi, 8
or edi, eax
mov rax, qword [rbx + 0x40]
mov qword [rbx], rax
mov rax, qword [rbx + 0x48]
mov qword [rbx + 8], rax
mov qword [rbx + 0x40], rbp
lea rdx, [rbx + 0x20]
mov qword [rbx + 0x48], rbp
mov rcx, rbx
mov r8, qword [rbx + 0x180]
call qword [rbx + 0x178]
inc edi
mov eax, edi
mov byte [rbx + 0xf], dil
shr eax, 0x18
mov byte [rbx + 0xc], al
mov eax, edi
shr eax, 0x10
mov byte [rbx + 0xd], al
mov eax, edi
shr eax, 8
mov byte [rbx + 0xe], al
add rsp, 0x20
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret