joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14016eaf0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
sub rsp, 0x30
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x50], rdi
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_recv]
lea rsi, str.C:UsersAdmin_vcpkg_buildtreeszeromq_src_v4.3.5_37c87b6b8c.clean_src_signaler.cpp
cmp eax, 0xffffffff
jne 0x14016eb84
call fcn.140150b40
mov rdi, rax
test rax, rax
je 0x14016eb89
mov qword [rsp + 0x48], rbx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call fcn.140337dc0
mov rcx, rax
mov dword [rsp + 0x28], 0x12a
mov r9d, ebx
mov qword [rsp + 0x20], rsi
mov r8, rdi
lea rdx, str.Assertion_failed:__s___i____s:_d__n
call fcn.140150370
mov ecx, 2
call fcn.140337dc0
mov rcx, rax
call fcn.140338218
mov rcx, rdi
call fcn.140151120
mov rbx, qword [rsp + 0x48]
jmp 0x14016eb89
cmp eax, 1
je 0x14016ebd2
mov ecx, 2
call fcn.140337dc0
mov rcx, rax
mov dword [rsp + 0x20], 0x132
mov r9, rsi
lea r8, str.nbytes__sizeof__dummy_
lea rdx, str.Assertion_failed:__s___s:_d__n
call fcn.140150370
mov ecx, 2
call fcn.140337dc0
mov rcx, rax
call fcn.140338218
lea rcx, str.nbytes__sizeof__dummy_
call fcn.140151120
cmp byte [rsp + 0x40], 0
mov rdi, qword [rsp + 0x50]
je 0x14016ec27
mov ecx, 2
call fcn.140337dc0
mov rcx, rax
mov dword [rsp + 0x20], 0x133
mov r9, rsi
lea r8, str.dummy__0
lea rdx, str.Assertion_failed:__s___s:_d__n
call fcn.140150370
mov ecx, 2
call fcn.140337dc0
mov rcx, rax
call fcn.140338218
lea rcx, str.dummy__0
call fcn.140151120
add rsp, 0x30
pop rsi
ret
Function at 0x14016ec30
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x40]
xor r9d, r9d
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_recv]
lea rsi, str.C:UsersAdmin_vcpkg_buildtreeszeromq_src_v4.3.5_37c87b6b8c.clean_src_signaler.cpp
cmp eax, 0xffffffff
jne 0x14016ecef
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x14016ec88
call fcn.14032e13c
mov dword [rax], reloc.WS2_32.dll_inet_addr
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
call fcn.140150b40
mov rdi, rax
test rax, rax
je 0x14016ecf4
mov qword [rsp + 0x48], rbx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call fcn.140337dc0
mov rcx, rax
mov dword [rsp + 0x28], 0x159
mov r9d, ebx
mov qword [rsp + 0x20], rsi
mov r8, rdi
lea rdx, str.Assertion_failed:__s___i____s:_d__n
call fcn.140150370
mov ecx, 2
call fcn.140337dc0
mov rcx, rax
call fcn.140338218
mov rcx, rdi
call fcn.140151120
mov rbx, qword [rsp + 0x48]
jmp 0x14016ecf4
cmp eax, 1
je 0x14016ed3d
mov ecx, 2
call fcn.140337dc0
mov rcx, rax
mov dword [rsp + 0x20], 0x170
mov r9, rsi
lea r8, str.nbytes__sizeof__dummy_
lea rdx, str.Assertion_failed:__s___s:_d__n
call fcn.140150370
mov ecx, 2
call fcn.140337dc0
mov rcx, rax
call fcn.140338218
lea rcx, str.nbytes__sizeof__dummy_
call fcn.140151120
cmp byte [rsp + 0x40], 0
je 0x14016ed8d
mov ecx, 2
call fcn.140337dc0
mov rcx, rax
mov dword [rsp + 0x20], 0x171
mov r9, rsi
lea r8, str.dummy__0
lea rdx, str.Assertion_failed:__s___s:_d__n
call fcn.140150370
mov ecx, 2
call fcn.140337dc0
mov rcx, rax
call fcn.140338218
lea rcx, str.dummy__0
call fcn.140151120
mov rsi, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x14016eda0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
sub rsp, 0x30
mov qword [rsp + 0x50], rsi
lea rbp, str.C:UsersAdmin_vcpkg_buildtreeszeromq_src_v4.3.5_37c87b6b8c.clean_src_signaler.cpp
mov qword [rsp + 0x48], rbx
mov rsi, rcx
mov qword [rsp + 0x58], rdi
mov byte [rsp + 0x40], 0
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rsi]
lea rdx, [rsp + 0x40]
xor r9d, r9d
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x14016ee47
call fcn.140150b40
mov rbx, rax
test rax, rax
je 0x14016edd0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov edi, eax
call fcn.140337dc0
mov rcx, rax
mov dword [rsp + 0x28], 0xa3
mov r9d, edi
mov qword [rsp + 0x20], rbp
mov r8, rbx
lea rdx, str.Assertion_failed:__s___i____s:_d__n
call fcn.140150370
mov ecx, 2
call fcn.140337dc0
mov rcx, rax
call fcn.140338218
mov rcx, rbx
call fcn.140151120
jmp 0x14016edd0
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
cmp eax, 1
je 0x14016eea4
mov ecx, 2
call fcn.140337dc0
mov rcx, rax
mov dword [rsp + 0x20], 0xa7
mov r9, rbp
lea r8, str.nbytes__sizeof__dummy_
lea rdx, str.Assertion_failed:__s___s:_d__n
call fcn.140150370
mov ecx, 2
call fcn.140337dc0
mov rcx, rax
call fcn.140338218
lea rcx, str.nbytes__sizeof__dummy_
call fcn.140151120
add rsp, 0x30
pop rbp
ret
Function at 0x140183480
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rdi
sub rsp, 0x30
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp eax, 0xffffffff
jne 0x14018355e
mov qword [rsp + 0x50], rsi
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp eax, 0x2733
jne 0x1401834be
call fcn.14032e13c
mov dword [rax], reloc.WS2_32.dll_inet_addr
jmp 0x140183559
add eax, 0xffffd8be
mov qword [rsp + 0x40], rbx
cmp eax, 0xb
ja 0x1401834d7
mov ecx, 0xcbd
bt ecx, eax
jb 0x140183543
mov qword [rsp + 0x48], rbp
call fcn.140150b40
mov rbp, rax
test rax, rax
je 0x14018353e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call fcn.140337dc0
mov rcx, rax
mov dword [rsp + 0x28], 0x107
lea rax, str.C:UsersAdmin_vcpkg_buildtreeszeromq_src_v4.3.5_37c87b6b8c.clean_src_tcp.cpp
mov r9d, ebx
mov r8, rbp
mov qword [rsp + 0x20], rax
lea rdx, str.Assertion_failed:__s___i____s:_d__n
call fcn.140150370
mov ecx, 2
call fcn.140337dc0
mov rcx, rax
call fcn.140338218
mov rcx, rbp
call fcn.140151120
mov rbp, qword [rsp + 0x48]
call fcn.14032e13c
mov ecx, esi
mov rbx, rax
call fcn.140150e70
mov dword [rbx], eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov eax, 0xffffffff
cmp edi, eax
cmove edi, eax
mov eax, edi
add rsp, 0x30
pop rdi
ret

Function at 0x140183650
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x30
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp esi, 0xffffffff
jne 0x140183715
cmp eax, 0x2733
je 0x14018371d
lea ecx, [rax - 0x2742]
cmp ecx, 0xf
ja 0x140183698
mov edx, 0x841d
bt edx, ecx
jae 0x140183698
mov eax, esi
add rsp, 0x30
pop rsi
ret
cmp eax, 0x2747
je 0x14018371d
mov qword [rsp + 0x48], rdi
call fcn.140150b40
mov rdi, rax
test rax, rax
je 0x140183710
mov qword [rsp + 0x40], rbx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call fcn.140337dc0
mov rcx, rax
mov dword [rsp + 0x28], 0xd3
lea rax, str.C:UsersAdmin_vcpkg_buildtreeszeromq_src_v4.3.5_37c87b6b8c.clean_src_tcp.cpp
mov r9d, ebx
mov r8, rdi
mov qword [rsp + 0x20], rax
lea rdx, str.Assertion_failed:__s___i____s:_d__n
call fcn.140150370
mov ecx, 2
call fcn.140337dc0
mov rcx, rax
call fcn.140338218
mov rcx, rdi
call fcn.140151120
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, esi
add rsp, 0x30
pop rsi
ret
xor eax, eax
add rsp, 0x30
pop rsi
ret

Function at 0x140183820
Capabilities:
Set socket configuration

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
test edx, edx
jg 0x140183835
xor eax, eax
add rsp, 0x30
pop rdi
ret
mov eax, 0x10624dd3
mov qword [rsp + 0x40], rbx
imul edx
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [rsp + 0x48], edx
mov edx, 6
lea r8d, [rdx - 1]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov edx, eax
mov rcx, rdi
mov ebx, eax
call fcn.140163720
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140183890
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edx, 6
mov dword [rsp + 0x48], 1
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
mov rdi, rcx
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov edx, eax
mov rcx, rdi
mov ebx, eax
call fcn.140163720
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14018ac80
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140464178]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
cmp qword [rcx + 0x4f0], 0xffffffffffffffff
je 0x14018acfe
mov ecx, 2
call fcn.140337dc0
mov rcx, rax
mov dword [rsp + 0x20], 0x5e
lea r9, str.C:UsersAdmin_vcpkg_buildtreeszeromq_src_v4.3.5_37c87b6b8c.clean_srcipc_connecter.cpp
lea r8, str._s__retired_fd
lea rdx, str.Assertion_failed:__s___s:_d__n
call fcn.140150370
mov ecx, 2
call fcn.140337dc0
mov rcx, rax
call fcn.140338218
lea rcx, str._s__retired_fd
call fcn.140151120
xor r8d, r8d
mov edx, 1
mov ecx, edx
call fcn.140164bc0
mov qword [rdi + 0x4f0], rax
cmp rax, 0xffffffffffffffff
je 0x14018ad87
mov rcx, rax
call fcn.140164e40
mov rcx, qword [rdi + 0x4e8]
mov rcx, qword [rcx + 0x48]
call fcn.140173800
mov ebx, eax
mov rcx, qword [rdi + 0x4e8]
mov rcx, qword [rcx + 0x48]
call fcn.1401737f0
mov rdx, rax
mov r8d, ebx
mov rcx, qword [rdi + 0x4f0]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x14018ae90
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea ecx, [rax - 0x2733]
cmp ecx, 1
jbe 0x14018ae80
call fcn.14032e13c
mov rbx, rax
mov ecx, esi
call fcn.140150e70
mov dword [rbx], eax
call fcn.14032e13c
cmp dword [rax], 0x70
jne 0x14018aeb8
mov rdx, qword [rdi + 0x4f0]
lea rcx, [rdi + 0x4d8]
call fcn.140187a50
mov qword [rdi + 0x4f8], rax
mov rdx, rax
lea rcx, [rdi + 0x4d8]
call fcn.140187c50
lea rdx, [rdi + 0x500]
lea rcx, [rsp + 0x30]
call fcn.14016e820
mov rbx, rax
call fcn.1401505f0
mov r8d, eax
mov rdx, rbx
mov rcx, qword [rdi + 0x520]
call fcn.140160ac0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14018ae27
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14018ae22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14018af2e
call fcn.1403271fc
movdqa xmm0, xmmword [0x140368420]
movdqa xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14018af09
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14018ae76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14018af2e
call fcn.1403271fc
jmp 0x14018af09
call fcn.14032e13c
mov dword [rax], reloc.WS2_32.dll_WSASetLastError
jmp 0x14018ad87
mov rdx, qword [rdi + 0x4f0]
lea rcx, [rdi + 0x4d8]
call fcn.140187a50
mov qword [rdi + 0x4f8], rax
lea rcx, [rdi + 0x4d8]
call fcn.14018a9f0
jmp 0x14018af09
test byte [rdi + 0x15c], 4
je 0x14018aeef
call fcn.14032e13c
cmp dword [rax], 0x6b
jne 0x14018aeef
mov rcx, qword [rdi + 0x520]
call fcn.140161260
test al, al
je 0x14018aeef
cmp qword [rdi + 0x4f0], 0xffffffffffffffff
je 0x14018af09
mov rcx, rdi
call fcn.140198800
jmp 0x14018af09
cmp qword [rdi + 0x4f0], 0xffffffffffffffff
je 0x14018af01
mov rcx, rdi
call fcn.140198800
mov rcx, rdi
call fcn.140198700
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140327a40
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14032dff0
int3
Function at 0x140193d00
Capabilities:
Send data
Send data on socket

Disassembly:
mov rcx, qword [rcx + 0x578]
jmp fcn.140183650

Function at 0x140199430
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x60
cmp qword [rdx + 0x18], 0xff
mov rdi, rdx
mov r14, rcx
jbe 0x1401994a5
mov ecx, 2
call fcn.140337dc0
mov rcx, rax
mov dword [rsp + 0x20], 0xd0
lea r9, str.C:UsersAdmin_vcpkg_buildtreeszeromq_src_v4.3.5_37c87b6b8c.clean_src_socks.cpp
lea r8, str.req_.hostname.size______UINT8_MAX
lea rdx, str.Assertion_failed:__s___s:_d__n
call fcn.140150370
mov ecx, 2
call fcn.140337dc0
mov rcx, rax
call fcn.140338218
lea rcx, str.req_.hostname.size______UINT8_MAX
call fcn.140151120
lea rbx, [r14 + 0x10]
xorps xmm0, xmm0
mov byte [rbx], 5
lea rsi, [rdi + 8]
movzx eax, byte [rdi]
mov rcx, rsi
mov byte [rbx + 1], al
mov byte [rbx + 2], 0
cmp qword [rsi + 0x18], 0x10
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x80], 0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x30], 4
movups xmmword [rsp + 0x50], xmm0
jb 0x1401994ed
mov rcx, qword [rsi]
lea r9, [rsp + 0x80]
xor edx, edx
lea r8, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov rbp, qword [rsp + 0x80]
mov r15d, eax
test eax, eax
jne 0x140199548
mov ecx, dword [rbp + 4]
cmp ecx, 2
jne 0x14019952d
mov rax, qword [rbp + 0x20]
mov byte [rbx + 3], 1
mov eax, dword [rax + 4]
mov dword [rbx + 4], eax
add rbx, 8
jmp 0x140199579
cmp ecx, 0x17
jne 0x140199548
mov rax, qword [rbp + 0x20]
mov byte [rbx + 3], 4
movups xmm0, xmmword [rax + 8]
movups xmmword [rbx + 4], xmm0
add rbx, 0x14
jmp 0x140199579
mov byte [rbx + 3], 3
movzx eax, byte [rdi + 0x18]
mov byte [rbx + 4], al
add rbx, 5
cmp qword [rsi + 0x18], 0x10
jb 0x140199561
mov rsi, qword [rsi]
mov r8, qword [rdi + 0x18]
mov rdx, rsi
mov rcx, rbx
call fcn.1403284a0
add rbx, qword [rdi + 0x18]
test r15d, r15d
jne 0x140199582
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
movzx eax, byte [rdi + 0x29]
lea r11, [rsp + 0x60]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov byte [rbx], al
inc rbx
movzx eax, byte [rdi + 0x28]
mov byte [rbx], al
sub rbx, r14
sub rbx, 0xf
mov qword [r14 + 8], 0
mov qword [r14], rbx
mov rbx, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1401b4d20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
push r12
push r15
mov eax, gethostbyname
call fcn.140327af0
sub rsp, rax
mov rsi, qword [rsp + 0x88]
mov r10, r9
mov rdi, r8
mov r15, rdx
mov r12, rcx
mov ebx, dword [rsi]
test ebx, ebx
jns 0x1401b4d65
mov dword [rsi], 0xffffffff
add rsp, 0x30
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x60], rbp
mov rbp, qword [rsp + 0x80]
test ebx, ebx
je 0x1401b4d98
test rdi, rdi
je 0x1401b4d98
mov eax, ebx
dec rdi
movzx ecx, byte [rax + rbp]
xor cl, byte [r12]
inc r12
mov byte [r15], cl
inc r15
inc ebx
and ebx, 0xf
jne 0x1401b4d76
mov r9, qword [rsp + 0x90]
cmp rdi, 0x10
jb 0x1401b4e69
mov qword [rsp + 0x28], r13
mov rsi, r15
mov r13, rdi
mov qword [rsp + 0x20], r14
shr r13, 4
mov r14, r12
imul rax, r13, 0xfffffffffffffff0
sub rsi, rbp
sub r14, rbp
add rdi, rax
mov rax, r13
shl rax, 4
add r15, rax
mov qword [rsp + 0x68], r15
add r12, rax
mov r15, qword [rsp + 0x78]
nop word [rax + rax]
mov r8, r15
mov rdx, rbp
mov rcx, rbp
call r9
cmp ebx, 0x10
jae 0x1401b4e35
mov edx, reloc.WS2_32.dll_ntohs
mov eax, ebx
sub edx, ebx
add rax, rbp
shr edx, 3
inc edx
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r14 + rax]
xor rcx, qword [rax]
mov qword [rsi + rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1401b4e20
mov r9, qword [rsp + 0x90]
add rsi, 0x10
add r14, 0x10
xor ebx, ebx
sub r13, 1
jne 0x1401b4df0
mov r15, qword [rsp + 0x68]
mov r10, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
test rdi, rdi
je 0x1401b4e96
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r9
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r12]
xor al, byte [rcx + rbp]
mov byte [rcx + r15], al
sub rdi, 1
jne 0x1401b4e80
mov dword [rsi], ebx
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401b5400
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push r14
mov eax, 0x20
call fcn.140327af0
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov rbx, r8
mov r14, rdx
mov rbp, rcx
je 0x1401b5430
mov eax, 0xfffffffe
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov rcx, qword [rcx + 0x30]
movabs rax, 0x2000000000000000
add rcx, rbx
cmp rcx, rax
ja 0x1401b5522
cmp rcx, rbx
jb 0x1401b5522
mov qword [rsp + 0x40], rsi
mov esi, dword [rbp + 0x17c]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
mov qword [rbp + 0x30], rcx
test esi, esi
je 0x1401b54a6
test rbx, rbx
je 0x1401b5502
movzx eax, byte [r14]
dec rbx
mov ecx, esi
inc r14
xor byte [rcx + rbp + 0x40], al
inc esi
and esi, 0xf
jne 0x1401b5470
lea r12, [rbp + 0x60]
lea rdi, [rbp + 0x40]
mov rdx, r12
mov rcx, rdi
call qword [rbp + 0x170]
jmp 0x1401b54ae
lea r12, [rbp + 0x60]
lea rdi, [rbp + 0x40]
mov qword [rsp + 0x58], r15
mov r15, rbx
and r15, 0xfffffffffffffff0
je 0x1401b54d4
mov r9, r15
mov r8, r14
mov rdx, r12
mov rcx, rdi
call qword [rbp + 0x168]
add r14, r15
sub rbx, r15
mov r15, qword [rsp + 0x58]
test rbx, rbx
je 0x1401b5502
mov esi, ebx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r14 + rdi - 0x40]
xor byte [rdi], al
lea rdi, [rdi + 1]
sub rbx, 1
jne 0x1401b54f0
mov rdi, qword [rsp + 0x48]
xor eax, eax
mov r12, qword [rsp + 0x50]
mov dword [rbp + 0x17c], esi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov eax, 0xffffffff
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
Function at 0x1401b6510
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r13
mov eax, 0x28
call fcn.140327af0
sub rsp, rax
xor r13d, r13d
mov rdi, r8
mov qword [rcx + 0x30], r13
mov rsi, rdx
mov qword [rcx + 0x38], r13
mov rbx, rcx
mov qword [rcx + 0x178], r13
cmp r8, 0xc
jne 0x1401b6562
movsd xmm0, qword [rdx]
lea edi, [r8 - 0xb]
movsd qword [rcx], xmm0
mov eax, dword [rdx + 8]
mov dword [rcx + 8], eax
mov dword [rcx + 0xc], 0x1000000
jmp 0x1401b66a0
mov qword [rsp + 0x50], rbp
mov rbp, rdi
mov qword [rsp + 0x58], r12
mov qword [rcx + 0x40], r13
mov qword [rsp + 0x60], r14
mov qword [rcx + 0x48], r13
cmp rdi, 0x10
jb 0x1401b6630
mov qword [rsp + 0x20], r15
mov r15, rdi
shr r15, 4
imul rax, r15, 0xfffffffffffffff0
add rdi, rax
nop dword [rax]
movzx eax, byte [rsi]
lea rdx, [rbx + 0x60]
xor byte [rbx + 0x40], al
lea rcx, [rbx + 0x40]
movzx eax, byte [rsi + 1]
xor byte [rbx + 0x41], al
movzx eax, byte [rsi + 2]
xor byte [rbx + 0x42], al
movzx eax, byte [rsi + 3]
xor byte [rbx + 0x43], al
movzx eax, byte [rsi + 4]
xor byte [rbx + 0x44], al
movzx eax, byte [rsi + 5]
xor byte [rbx + 0x45], al
movzx eax, byte [rsi + 6]
xor byte [rbx + 0x46], al
movzx eax, byte [rsi + 7]
xor byte [rbx + 0x47], al
movzx eax, byte [rsi + 8]
xor byte [rbx + 0x48], al
movzx eax, byte [rsi + 9]
xor byte [rbx + 0x49], al
movzx eax, byte [rsi + 0xa]
xor byte [rbx + 0x4a], al
movzx eax, byte [rsi + 0xb]
xor byte [rbx + 0x4b], al
movzx eax, byte [rsi + 0xc]
xor byte [rbx + 0x4c], al
movzx eax, byte [rsi + 0xd]
xor byte [rbx + 0x4d], al
movzx eax, byte [rsi + 0xe]
xor byte [rbx + 0x4e], al
movzx eax, byte [rsi + 0xf]
xor byte [rbx + 0x4f], al
call qword [rbx + 0x170]
add rsi, 0x10
sub r15, 1
jne 0x1401b65a0
mov r15, qword [rsp + 0x20]
test rdi, rdi
je 0x1401b665f
lea rcx, [rbx + 0x40]
sub rsi, rbx
nop dword [rax]
movzx eax, byte [rsi + rcx - 0x40]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdi, 1
jne 0x1401b6640
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
call qword [rbx + 0x170]
shl rbp, 3
lea rdx, [rbx + 0x60]
bswap rbp
xor qword [rbx + 0x48], rbp
lea rcx, [rbx + 0x40]
call qword [rbx + 0x170]
mov rax, qword [rbx + 0x40]
mov edi, dword [rbx + 0x4c]
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov qword [rbx], rax
mov rax, qword [rbx + 0x48]
mov qword [rbx + 8], rax
bswap edi
nop dword [rax + rax]
mov qword [rbx + 0x40], r13
lea rdx, [rbx + 0x20]
mov qword [rbx + 0x48], r13
mov rcx, rbx
mov r8, qword [rbx + 0x188]
call qword [rbx + 0x180]
inc edi
bswap edi
mov dword [rbx + 0xc], edi
add rsp, 0x28
pop r13
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401ba270
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r11, rdx
movsxd rdi, r9d
lea rsi, [rcx - 1]
mov r10, r8
not rcx
shr rsi, 0x3f
shr rcx, 0x3f
and rsi, rcx
mov ecx, dword [rdx + 8]
xor ecx, dword [r8 + 8]
dec rsi
and ecx, esi
xor dword [rdx + 8], ecx
xor dword [r8 + 8], ecx
mov edx, dword [rdx + 0x10]
movq xmm4, rsi
xor edx, dword [r8 + 0x10]
and edx, esi
punpcklqdq xmm4, xmm4
xor dword [r11 + 0x10], edx
xor dword [r8 + 0x10], edx
mov ecx, dword [r11 + 0x14]
mov edx, ecx
mov eax, dword [r8 + 0x14]
xor rdx, rax
and edx, 4
and rdx, rsi
mov eax, edx
xor eax, ecx
xor ecx, ecx
mov dword [r11 + 0x14], eax
xor dword [r8 + 0x14], edx
mov edx, ecx
test r9d, r9d
jle 0x1401ba38d
cmp edi, 2
jb 0x1401ba38d
mov r9, qword [r8]
lea rax, [rdi - 1]
mov r8, qword [r11]
lea rbx, [rdi - 1]
lea rbx, [r9 + rbx*8]
lea rax, [r8 + rax*8]
cmp r9, rax
ja 0x1401ba31c
cmp rbx, r8
jae 0x1401ba38d
cmp r9, r10
ja 0x1401ba326
cmp rbx, r10
jae 0x1401ba38d
cmp r9, r11
ja 0x1401ba330
cmp rbx, r11
jae 0x1401ba38d
cmp r8, r10
ja 0x1401ba33a
cmp rax, r10
jae 0x1401ba38d
cmp r8, r11
ja 0x1401ba344
cmp rax, r11
jae 0x1401ba38d
mov eax, edi
and eax, 0xfffffffe
nop dword [rax]
movdqu xmm2, xmmword [rcx + r9]
add edx, 2
movdqu xmm1, xmmword [rcx + r8]
lea rcx, [rcx + 0x10]
movdqa xmm3, xmm2
pxor xmm3, xmm1
pand xmm3, xmm4
movdqa xmm0, xmm3
pxor xmm3, xmm2
pxor xmm0, xmm1
movdqu xmmword [rcx + r8 - 0x10], xmm0
movdqu xmmword [rcx + r9 - 0x10], xmm3
cmp edx, eax
jl 0x1401ba350
movsxd rax, edx
cmp rax, rdi
jge 0x1401ba3cd
nop word [rax + rax]
mov rcx, qword [r11]
mov rdx, qword [rcx + rax*8]
lea r8, [rcx + rax*8]
mov rcx, qword [r10]
mov r9, rdx
xor r9, qword [rcx + rax*8]
and r9, rsi
xor rdx, r9
mov qword [r8], rdx
mov rcx, qword [r10]
xor qword [rcx + rax*8], r9
inc rax
cmp rax, rdi
jl 0x1401ba3a0
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1401bac70
Capabilities:
Encode data using xor

Disassembly:
push rbx
test byte [rcx + 0x14], 4
mov rbx, rdx
mov r10, qword [rcx]
mov r11, qword [rdx]
je 0x1401bad58
mov eax, dword [rdx + 8]
cmp dword [rcx + 8], eax
jne 0x1401bad58
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov edi, r9d
test eax, eax
jle 0x1401bad4e
sub r10, r11
nop word [rax + rax]
mov r8, qword [r10 + r11]
inc edi
mov rdx, qword [r11]
lea r11, [r11 + 8]
mov rcx, r8
shr rdx, 0x3f
sub r8, qword [r11 - 8]
shr r8, 0x3f
xor r8d, edx
shr rcx, 0x3f
xor edx, ecx
or r8d, edx
xor r8d, ecx
neg r8d
mov dword [rsp + 0x18], r8d
not r8d
mov dword [rsp + 0x10], r8d
mov eax, dword [rsp + 0x10]
and eax, r9d
mov r9d, dword [rsp + 0x18]
mov r8, qword [r11 - 8]
or r9d, eax
mov rdx, qword [r10 + r11 - 8]
mov rcx, r8
sub r8, qword [r10 + r11 - 8]
shr r8, 0x3f
shr rcx, 0x3f
shr rdx, 0x3f
xor r8d, edx
xor edx, ecx
or r8d, edx
xor r8d, ecx
neg r8d
mov dword [rsp + 0x18], r8d
not r8d
mov dword [rsp + 0x10], r8d
mov ecx, dword [rsp + 0x10]
and ecx, r9d
mov r9d, dword [rsp + 0x18]
and r9d, 1
or r9d, ecx
cmp edi, dword [rbx + 8]
jl 0x1401bacb0
mov rdi, qword [rsp + 0x20]
mov eax, r9d
pop rbx
ret
mov edx, dword [rcx + 8]
mov eax, edx
sub eax, dword [rbx + 8]
jne 0x1401bad88
lea eax, [rdx - 1]
movsxd rcx, eax
test eax, eax
js 0x1401bad86
lea rax, [r11 + rcx*8]
sub r10, r11
mov rdx, qword [rax + r10]
cmp rdx, qword [rax]
jne 0x1401bad8a
sub rax, 8
sub rcx, 1
jns 0x1401bad73
xor eax, eax
pop rbx
ret
mov eax, 0xffffffff
mov ecx, 1
cmova eax, ecx
pop rbx
ret

Function at 0x1401bd360
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140327af0
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret