joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a4210
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rdi, r8
mov rsi, rdx
mov r14, rcx
mov rbx, qword [rdx]
mov ecx, dword [0x1402daed4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400a4262
nop dword [rax]
cmp qword [rax], rbx
je 0x1400a43d7
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400a4250
mov qword [rbp + 0x27], rdi
mov rdx, rdi
mov ecx, 0x68
call fcn.140021fa0
mov rbx, rax
xor r15d, r15d
mov qword [rax + 0x20], r15
lea rax, [0x1400a4580]
mov qword [rbx + 0x28], rax
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
mov dword [rbx + 0x30], r15d
movups xmm0, xmmword [rdi]
movups xmmword [rbx + 0x38], xmm0
movsd xmm1, qword [rdi + 0x10]
movsd qword [rbx + 0x48], xmm1
movups xmm0, xmmword [rdi + 0x18]
movups xmmword [rbx + 0x50], xmm0
mov rax, qword [rdi + 0x28]
mov qword [rbx + 0x60], rax
mov r8, rbx
mov rdx, rsi
mov rcx, r14
call fcn.140024870
mov qword [rbp + 0x37], r15
mov qword [rbp + 0x2f], r15
test al, al
je 0x1400a43ba
mov rax, qword [rsi]
mov qword [rbp - 0x49], rax
mov ecx, dword [0x1402daed4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rbp - 0x39], rax
lea rax, [rbp - 0x49]
mov qword [rbp - 0x41], rax
lea rdx, [rbp - 0x49]
mov ecx, dword [0x1402daed4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rax, qword [r14 + 0x28]
mov qword [rbp - 0x19], rax
mov rax, qword [rsi]
mov qword [rbp - 0x11], rax
call fcn.1400b35b0
mov rdi, qword [r14 + 0x28]
mov qword [rbp - 0x29], rbx
mov qword [rbp - 0x21], rbx
movups xmm0, xmmword [rbx + 0x38]
movups xmmword [rbp - 9], xmm0
movsd xmm1, qword [rbx + 0x48]
movsd qword [rbp + 7], xmm1
movups xmm0, xmmword [rbx + 0x50]
movups xmmword [rbp + 0xf], xmm0
mov rax, qword [rbx + 0x60]
mov qword [rbp + 0x1f], rax
lea rax, [rbp - 9]
mov qword [rbp - 0x31], rax
test rbx, rbx
je 0x1400a4374
mov qword [rbp - 0x21], r15
lea r8, [rbp - 9]
lea edx, [r15 + 0x68]
mov rcx, rbx
call fcn.140022030
mov ebx, r15d
mov qword [rbp - 0x29], rbx
test rdi, rdi
je 0x1400a4388
lea rdx, [rbp - 9]
lea rcx, [rbp - 9]
call fcn.1400a4cb0
nop
nop
test rbx, rbx
je 0x1400a439f
lea r8, [rbp - 9]
mov edx, 0x68
mov rcx, rbx
call fcn.140022030
nop
lea rcx, [rbp - 0x19]
call fcn.140024650
nop
mov rdx, qword [rbp - 0x39]
mov ecx, dword [0x1402daed4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
cmp qword [rax + 8], 0
je 0x1400a4262
nop
mov rdx, rdi
mov rcx, rdi
call fcn.1400a4cb0
nop
nop
jmp 0x1400a43ba
Function at 0x1400a4630
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x80
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
mov rbx, qword [rdx]
mov ecx, dword [0x1402daed4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400a4682
nop word [rax + rax]
cmp qword [rax], rbx
je 0x1400a47eb
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400a4670
mov qword [rsp + 0x58], rdi
mov rdx, rdi
mov ecx, 0x98
call fcn.140021fa0
mov rbx, rax
xor r14d, r14d
mov qword [rax + 0x20], r14
lea rax, [fcn.1400a4870]
mov qword [rbx + 0x28], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
mov dword [rbx + 0x30], r14d
mov rcx, qword [rdi]
mov qword [rbx + 0x38], rcx
mov rax, qword [rdi + 8]
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x48], r14
mov qword [rbx + 0x50], r14
mov rax, qword [rdi + 0x10]
mov qword [rbx + 0x48], rax
mov rax, qword [rdi + 0x18]
mov qword [rbx + 0x50], rax
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
movups xmm0, xmmword [rdi + 0x20]
movups xmmword [rbx + 0x58], xmm0
mov rax, qword [rdi + 0x30]
mov qword [rbx + 0x68], rax
mov rax, qword [rdi + 0x38]
mov qword [rbx + 0x70], rax
mov qword [rbx + 0x78], r14
mov qword [rbx + 0x80], r14
mov rax, qword [rdi + 0x40]
mov qword [rbx + 0x78], rax
mov rax, qword [rdi + 0x48]
mov qword [rbx + 0x80], rax
mov qword [rdi + 0x40], r14
mov qword [rdi + 0x48], r14
movups xmm0, xmmword [rdi + 0x50]
movups xmmword [rbx + 0x88], xmm0
mov r8, rbx
mov rdx, rsi
mov rcx, rbp
call fcn.140024870
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r14
test al, al
je 0x1400a47cd
mov rax, qword [rsi]
mov qword [rsp + 0x40], rax
mov ecx, dword [0x1402daed4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
mov ecx, dword [0x1402daed4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
call fcn.1400b35b0
xor r9d, r9d
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, qword [rbp + 0x28]
call fcn.1400a4870
nop
lea rcx, [rsp + 0x20]
call fcn.140024650
nop
mov rdx, qword [rsp + 0x50]
mov ecx, dword [0x1402daed4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
cmp qword [rax + 8], 0
je 0x1400a4682
nop
mov rdx, rdi
mov rcx, rdi
call fcn.1400a4ce0
nop
nop
jmp 0x1400a47cd
Function at 0x1400a4de0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x80
mov rdi, rdx
lea rsi, [rcx + 8]
mov rbp, qword [rcx]
mov rbx, qword [rsi]
mov ecx, dword [0x1402daed4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400a4e32
nop dword [rax + rax]
cmp qword [rax], rbx
je 0x1400a4f5a
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400a4e20
mov qword [rsp + 0x58], rdi
mov rdx, rdi
mov ecx, 0x68
call fcn.140021fa0
mov rbx, rax
xor r14d, r14d
mov qword [rax + 0x20], r14
lea rax, [fcn.1400a4f90]
mov qword [rbx + 0x28], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
mov dword [rbx + 0x30], r14d
mov rcx, qword [rdi]
mov qword [rbx + 0x38], rcx
mov rax, qword [rdi + 8]
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x48], r14
mov qword [rbx + 0x50], r14
mov rax, qword [rdi + 0x10]
mov qword [rbx + 0x48], rax
mov rax, qword [rdi + 0x18]
mov qword [rbx + 0x50], rax
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
movups xmm0, xmmword [rdi + 0x20]
movups xmmword [rbx + 0x58], xmm0
mov r8, rbx
mov rdx, rsi
mov rcx, rbp
call fcn.140024870
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r14
test al, al
je 0x1400a4f3c
mov rax, qword [rsi]
mov qword [rsp + 0x40], rax
mov ecx, dword [0x1402daed4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
mov ecx, dword [0x1402daed4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
call fcn.1400b35b0
xor r9d, r9d
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, qword [rbp + 0x28]
call fcn.1400a4f90
nop
lea rcx, [rsp + 0x20]
call fcn.140024650
nop
mov rdx, qword [rsp + 0x50]
mov ecx, dword [0x1402daed4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
cmp qword [rax + 8], 0
je 0x1400a4e32
nop
mov rdx, rdi
mov rcx, rdi
call fcn.1400a54f0
nop
nop
jmp 0x1400a4f3c
Function at 0x1400a51a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x80
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
mov rbx, qword [rdx]
mov ecx, dword [0x1402daed4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400a51f2
nop word [rax + rax]
cmp qword [rax], rbx
je 0x1400a5366
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400a51e0
mov qword [rsp + 0x58], rdi
mov rdx, rdi
mov ecx, 0xd0
call fcn.140021fa0
mov rbx, rax
xor r14d, r14d
mov qword [rax + 0x20], r14
lea rax, [fcn.1400a53d0]
mov qword [rbx + 0x28], rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
mov dword [rbx + 0x30], r14d
movups xmm0, xmmword [rdi]
movups xmmword [rbx + 0x38], xmm0
movsd xmm1, qword [rdi + 0x10]
movsd qword [rbx + 0x48], xmm1
mov rax, qword [rdi + 0x18]
mov qword [rbx + 0x50], rax
movups xmm0, xmmword [rdi + 0x20]
movups xmmword [rbx + 0x58], xmm0
movsd xmm1, qword [rdi + 0x30]
movsd qword [rbx + 0x68], xmm1
mov eax, dword [rdi + 0x38]
mov dword [rbx + 0x70], eax
mov rax, qword [rdi + 0x40]
mov qword [rbx + 0x78], rax
mov rax, qword [rdi + 0x48]
mov qword [rbx + 0x80], rax
movups xmm0, xmmword [rdi + 0x58]
movups xmmword [rbx + 0x90], xmm0
movups xmm0, xmmword [rdi + 0x68]
movups xmmword [rbx + 0xa0], xmm0
movsd xmm1, qword [rdi + 0x78]
movsd qword [rbx + 0xb0], xmm1
movups xmm0, xmmword [rdi + 0x80]
movups xmmword [rbx + 0xb8], xmm0
mov rax, qword [rdi + 0x90]
mov qword [rbx + 0xc8], rax
mov r8, rbx
mov rdx, rsi
mov rcx, rbp
call fcn.140024870
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r14
test al, al
je 0x1400a5348
mov rax, qword [rsi]
mov qword [rsp + 0x40], rax
mov ecx, dword [0x1402daed4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
mov ecx, dword [0x1402daed4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
call fcn.1400b35b0
xor r9d, r9d
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, qword [rbp + 0x28]
call fcn.1400a53d0
nop
lea rcx, [rsp + 0x20]
call fcn.140024650
nop
mov rdx, qword [rsp + 0x50]
mov ecx, dword [0x1402daed4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
cmp qword [rax + 8], 0
je 0x1400a51f2
nop
mov rdx, rdi
mov rcx, rdi
call fcn.1400a55b0
nop
nop
jmp 0x1400a5348
Function at 0x1400b4860
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x1400b4a20
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x1402ca060]
cmp ecx, 0xffffffff
jne 0x1400b4a3e
xor esi, esi
jmp 0x1400b4a47
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov qword [rsp + 0x30], rsi
test rsi, rsi
je 0x1400b4b3e
cmp qword [rsi + 0x30], 0
jne 0x1400b4a6d
cmp qword [rsi + 0x18], 0
je 0x1400b4b17
mov rbx, qword [rsi + 0x18]
jmp 0x1400b4a80
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x1400b4ad4
nop word [rax + rax]
mov rax, qword [rbx + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400b4ab7
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rbx]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0x18]
test rbx, rbx
jne 0x1400b4a80
cmp qword [rsi + 0x30], 0
je 0x1400b4a5c
nop dword [rax + rax]
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1400b4aff
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x1400b4aff
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdx, rbx
lea rcx, [rsi + 0x28]
call fcn.1400b36a0
cmp qword [rsi + 0x30], 0
jne 0x1400b4ae0
jmp 0x1400b4a55
lea rdx, [0x1400b3d30]
lea rcx, [0x1402d6938]
call fcn.1400b3b10
mov ecx, dword [0x1402ca060]
cmp ecx, 0xffffffff
je 0x1400b4b3e
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test rsi, rsi
je 0x1400b4b70
mov eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x1400b4b70
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b4a20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x1400b4a20
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x1402ca060]
cmp ecx, 0xffffffff
jne 0x1400b4a3e
xor esi, esi
jmp 0x1400b4a47
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov qword [rsp + 0x30], rsi
test rsi, rsi
je 0x1400b4b3e
cmp qword [rsi + 0x30], 0
jne 0x1400b4a6d
cmp qword [rsi + 0x18], 0
je 0x1400b4b17
mov rbx, qword [rsi + 0x18]
jmp 0x1400b4a80
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x1400b4ad4
nop word [rax + rax]
mov rax, qword [rbx + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400b4ab7
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rbx]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0x18]
test rbx, rbx
jne 0x1400b4a80
cmp qword [rsi + 0x30], 0
je 0x1400b4a5c
nop dword [rax + rax]
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1400b4aff
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x1400b4aff
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdx, rbx
lea rcx, [rsi + 0x28]
call fcn.1400b36a0
cmp qword [rsi + 0x30], 0
jne 0x1400b4ae0
jmp 0x1400b4a55
lea rdx, [0x1400b3d30]
lea rcx, [0x1402d6938]
call fcn.1400b3b10
mov ecx, dword [0x1402ca060]
cmp ecx, 0xffffffff
je 0x1400b4b3e
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test rsi, rsi
je 0x1400b4b70
mov eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x1400b4b70
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400f3570
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
mov eax, 0x20
call fcn.1401fbe10
sub rsp, rax
mov rax, qword [rcx + 8]
lea rsi, [r9 + 1]
mov rbx, rdx
mov rdx, qword [rdx + 8]
mov r9, qword [rax + 0xc0]
test byte [r9 + 0x60], 1
je 0x1400f3608
lea rax, [rsi + r8]
cmp rax, rdx
ja 0x1400f360d
add qword [rbx + 0x20], r8
sub rdx, r8
add qword [rbx + 0x28], r8
sub qword [rbx + 0x10], r8
mov qword [rbx + 8], rdx
mov rax, qword [rbx + 0x20]
mov rcx, qword [rcx + 0x438]
mov qword [rsp + 0x38], rdi
movzx edi, byte [rax + rdx - 1]
call fcn.140030360
mov rcx, rax
call fcn.14010b950
mov rdx, qword [rbx + 8]
and eax, 0x200000
je 0x1400f361a
sub rdx, rdi
mov eax, 1
mov rdi, qword [rsp + 0x38]
dec rdx
mov qword [rbx + 8], rdx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
cmp rsi, rdx
jbe 0x1400f35bc
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
lea rcx, [rdi + rsi]
mov r8, rdx
sub r8, rcx
mov esi, 0x100
xor r8, rcx
mov rax, rdx
xor rax, rcx
or r8, rax
xor r8, rdx
shr r8, 0x3f
dec r8
cmp rdx, rsi
cmovb rsi, rdx
xor r9d, r9d
test rsi, rsi
je 0x1400f369d
mov r11, qword [rbx + 0x20]
mov r10, rdi
shr r10, 0x3f
dec r11
add r11, rdx
nop
mov rax, r9
lea r11, [r11 - 1]
shr rax, 0x3f
mov rcx, rdi
sub rcx, r9
inc r9
shr rcx, 0x3f
xor cl, al
xor al, r10b
or cl, al
xor cl, r10b
dec cl
movzx edx, cl
movzx ecx, byte [r11 + 1]
xor rcx, rdi
and rdx, rcx
not rdx
and r8, rdx
cmp r9, rsi
jb 0x1400f3660
lea rax, [rdi + 1]
not r8
mov rdi, qword [rsp + 0x38]
movzx ecx, r8b
dec rcx
shr rcx, 0x3f
neg rcx
and rax, rcx
sub qword [rbx + 8], rax
mov rbx, qword [rsp + 0x40]
mov dword [rsp + 0x30], ecx
not ecx
mov dword [rsp + 0x48], ecx
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x48]
and ecx, 1
or eax, ecx
add rsp, 0x20
pop rsi
ret

Function at 0x14010d890
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1401fbe10
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x140110ab0
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
mov r8, rcx
test rcx, rcx
je 0x140110b02
movzx eax, byte [rcx]
test al, al
je 0x140110b02
mov r9d, 0x100
nop word [rax + rax]
movsx eax, al
lea r8, [r8 + 1]
or eax, r9d
add r9d, 0x100
mov ecx, eax
shr ecx, 2
xor cl, al
imul eax, eax
and cl, 0xf
rol edx, cl
xor edx, eax
movzx eax, byte [r8]
test al, al
jne 0x140110ad0
mov eax, edx
shr eax, 0x10
xor eax, edx
ret
xor eax, eax
ret

Function at 0x140118b10
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1401fbe10
sub rsp, rax
lea rcx, [0x1402d9528]
add rsp, 0x28
jmp fcn.14010d6f0
Function at 0x14011f260
Capabilities:
Encode data using xor

Disassembly:
push rbx
movsxd rbx, r9d
mov r10, r8
mov r11, rdx
cmp rdx, r8
je 0x14011f3c2
mov qword [rsp + 0x10], rsi
lea rsi, [rcx - 1]
not rcx
shr rsi, 0x3f
shr rcx, 0x3f
and rsi, rcx
mov ecx, dword [rdx + 8]
xor ecx, dword [r8 + 8]
dec rsi
and ecx, esi
xor dword [rdx + 8], ecx
xor dword [r8 + 8], ecx
mov ecx, dword [rdx + 0x10]
movq xmm4, rsi
xor ecx, dword [r8 + 0x10]
and ecx, esi
punpcklqdq xmm4, xmm4
xor dword [rdx + 0x10], ecx
xor dword [r8 + 0x10], ecx
mov edx, dword [rdx + 0x14]
mov ecx, dword [r8 + 0x14]
xor rcx, rdx
and ecx, 4
and rcx, rsi
mov eax, ecx
xor eax, edx
mov dword [r11 + 0x14], eax
xor dword [r8 + 0x14], ecx
xor ecx, ecx
mov edx, ecx
test r9d, r9d
jle 0x14011f37e
cmp ebx, 2
jb 0x14011f37e
mov r9, qword [r8]
lea rax, [rbx - 1]
mov r8, qword [r11]
mov qword [rsp + 0x18], rdi
lea rdi, [rbx - 1]
lea rdi, [r9 + rdi*8]
lea rax, [r8 + rax*8]
cmp r9, rax
ja 0x14011f30e
cmp rdi, r8
jae 0x14011f379
cmp r9, r10
ja 0x14011f318
cmp rdi, r10
jae 0x14011f379
cmp r9, r11
ja 0x14011f322
cmp rdi, r11
jae 0x14011f379
cmp r8, r10
ja 0x14011f32c
cmp rax, r10
jae 0x14011f379
cmp r8, r11
ja 0x14011f336
cmp rax, r11
jae 0x14011f379
mov eax, ebx
and eax, 0xfffffffe
nop dword [rax + rax]
movdqu xmm2, xmmword [r9 + rcx]
add edx, 2
movdqu xmm1, xmmword [r8 + rcx]
lea rcx, [rcx + 0x10]
movdqa xmm3, xmm2
xorps xmm3, xmm1
andps xmm3, xmm4
movdqa xmm0, xmm3
xorps xmm3, xmm2
xorps xmm0, xmm1
movdqu xmmword [r8 + rcx - 0x10], xmm0
movdqu xmmword [r9 + rcx - 0x10], xmm3
cmp edx, eax
jl 0x14011f340
mov rdi, qword [rsp + 0x18]
movsxd rax, edx
cmp rax, rbx
jge 0x14011f3bd
nop word [rax + rax]
mov rcx, qword [r11]
mov rdx, qword [rcx + rax*8]
lea r8, [rcx + rax*8]
mov rcx, qword [r10]
mov r9, rdx
xor r9, qword [rcx + rax*8]
and r9, rsi
xor rdx, r9
mov qword [r8], rdx
mov rcx, qword [r10]
xor qword [rcx + rax*8], r9
inc rax
cmp rax, rbx
jl 0x14011f390
mov rsi, qword [rsp + 0x10]
pop rbx
ret
Function at 0x14012c2a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push r13
push r14
mov eax, 0x40
call fcn.1401fbe10
sub rsp, rax
mov rsi, qword [rcx + 0x70]
mov rbx, r8
mov r8d, dword [rsi + 0x70]
lea r13, [rsi + 0x70]
mov qword [rsp + 0x38], r13
mov rbp, r9
mov r14, rdx
test r8d, r8d
je 0x14012c326
test r9, r9
je 0x14012c302
nop dword [rax]
cmp r8d, 0x40
jae 0x14012c302
mov eax, r8d
inc r8d
movzx ecx, byte [rax + rsi + 0x30]
xor cl, byte [rbx]
inc rbx
mov byte [r14], cl
inc r14
sub rbp, 1
jne 0x14012c2e0
mov dword [r13], r8d
test rbp, rbp
je 0x14012c459
cmp r8d, 0x40
jne 0x14012c326
mov dword [r13], 0
add dword [rsi + 0x20], 1
jne 0x14012c326
inc dword [rsi + 0x24]
mov ecx, dword [rsi + 0x20]
lea rax, [rsi + 0x20]
mov qword [rsp + 0x80], r12
mov r12d, ebp
and r12d, 0x3f
mov qword [rsp + 0x88], r15
mov r15d, r12d
sub rbp, r15
mov dword [rsp + 0x30], r12d
cmp rbp, 0x40
jb 0x14012c3e6
mov qword [rsp + 0x78], rdi
lea r13, [rsi + 0x20]
mov r12d, 0x10000000
mov r15d, ecx
nop dword [rax + rax]
mov rdx, rbp
mov qword [rsp + 0x20], r13
shr rdx, 6
mov r9, rsi
cmp rdx, r12
cmova rdx, r12
mov rdi, rdx
lea eax, [rdx + r15]
xor r15d, r15d
mov ecx, eax
cmp rcx, rdx
cmovae r15d, eax
sub rdi, rcx
cmp rcx, rdx
mov rcx, r14
cmovae rdi, rdx
mov rdx, rbx
shl rdi, 6
mov r8, rdi
call fcn.14017c130
sub rbp, rdi
mov dword [r13], r15d
add rbx, rdi
add r14, rdi
test r15d, r15d
jne 0x14012c3ca
inc dword [rsi + 0x24]
cmp rbp, 0x40
jae 0x14012c370
mov r12d, dword [rsp + 0x30]
lea rax, [rsi + 0x20]
mov rdi, qword [rsp + 0x78]
mov r15d, r12d
mov r13, qword [rsp + 0x38]
test r12d, r12d
je 0x14012c449
lea rcx, [rsi + 0x30]
mov qword [rsp + 0x20], rax
xorps xmm0, xmm0
mov r9, rsi
movups xmmword [rcx], xmm0
mov r8d, 0x40
mov rdx, rcx
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm0
call fcn.14017c130
test r12d, r12d
je 0x14012c445
sub rsi, rbx
sub r14, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsi + rbx + 0x30]
xor al, byte [rbx]
mov byte [rbx + r14], al
lea rbx, [rbx + 1]
sub r15, 1
jne 0x14012c430
mov dword [r13], r12d
mov r12, qword [rsp + 0x80]
mov r15, qword [rsp + 0x88]
mov eax, 1
add rsp, 0x40
pop r14
pop r13
pop rsi
pop rbp
pop rbx
ret
Function at 0x14012d7d0
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x14012d7f7
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x14012d7e0
movzx eax, r9b
ret
Function at 0x140143010
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, gethostname
call fcn.1401fbe10
sub rsp, rax
mov r10, rcx
test r9, r9
jne 0x14014304c
mov edx, 0xe2
mov dword [rsp + 0x20], 0x9a
lea r9, str.crypto_asn1_a_int.c
lea ecx, [rax - 0x2b]
lea r8d, [rdx - 4]
call fcn.140103470
xor eax, eax
add rsp, 0x38
ret
movzx r11d, byte [r8]
and r11d, 0x80
test rdx, rdx
je 0x14014305f
mov dword [rdx], r11d
cmp r9, 1
jne 0x140143081
test r10, r10
je 0x140143077
movzx eax, byte [r8]
test r11d, r11d
je 0x140143075
neg al
mov byte [rcx], al
mov eax, 1
add rsp, 0x38
ret
movzx ecx, byte [r8]
test cl, cl
jne 0x140143093
mov eax, 1
jmp 0x14014314a
xor eax, eax
cmp cl, 0xff
jne 0x140143183
xor edx, edx
lea rcx, [r9 - 1]
mov eax, 1
cmp r9, rax
jbe 0x14014313f
cmp rcx, 8
jb 0x140143130
and ecx, 7
mov rdx, r9
sub rdx, rcx
xorps xmm3, xmm3
xorps xmm2, xmm2
nop word [rax + rax]
movd xmm1, dword [r8 + rax]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
orps xmm3, xmm1
movd xmm1, dword [r8 + rax + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
orps xmm2, xmm1
cmp rax, rdx
jb 0x1401430d0
orps xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
orps xmm2, xmm0
movd edx, xmm2
cmp rax, r9
jae 0x14014313f
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
inc rax
or edx, ecx
cmp rax, r9
jb 0x140143130
xor eax, eax
test edx, edx
setne al
test edx, edx
je 0x140143183
movzx ecx, byte [r8 + 1]
and ecx, 0x80
cmp r11d, ecx
jne 0x140143183
mov edx, 0xe2
mov dword [rsp + 0x20], 0xbb
lea r9, str.crypto_asn1_a_int.c
mov ecx, reloc.WS2_32.dll_listen
lea r8d, [rdx - 5]
call fcn.140103470
xor eax, eax
add rsp, 0x38
ret
mov qword [rsp + 0x30], rbx
mov rbx, r9
sub rbx, rax
test r10, r10
je 0x1401431cd
neg r11d
sbb r11d, r11d
add r9, r8
movzx r11d, r11b
mov edx, r11d
and edx, 1
test rbx, rbx
je 0x1401431cd
mov r8, rbx
nop
movzx ecx, byte [r9 - 1]
lea r9, [r9 - 1]
dec r8
xor ecx, r11d
add edx, ecx
mov byte [r10 + r8], dl
shr edx, 8
test r8, r8
jne 0x1401431b0
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret