joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14013eb40
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
movd edx, xmm0
mov eax, edx
shr eax, 0x17
movzx r10d, al
cmp r10d, 0xff
je 0x14013ebba
ucomiss xmm1, xmm1
jp 0x14013ebba
movd r8d, xmm1
mov eax, r8d
and eax, 0x7fffffff
je 0x14013ebba
test edx, 0x7fffffff
je 0x14013ebc2
mov eax, r8d
shr eax, 0x17
movzx r9d, al
test r10d, r10d
je 0x14013ebc9
mov r11d, edx
and r11d, 0x7fffff
or r11d, 0x800000
test r9d, r9d
je 0x14013ebf7
mov edi, r8d
and edi, 0x7fffff
or edi, 0x800000
lea eax, [r10 + 1]
xor esi, esi
cmp eax, r9d
jne 0x14013ec30
jmp 0x14013ed01
mulss xmm0, xmm1
divss xmm0, xmm0
xor eax, eax
jmp 0x14013ed7b
mov eax, edx
xor r10d, r10d
shl eax, 9
js 0x14013ebe7
nop word cs:[rax + rax]
dec r10d
add eax, eax
jns 0x14013ebe0
mov cl, 1
sub cl, r10b
mov r11d, edx
shl r11d, cl
test r9d, r9d
jne 0x14013eb9b
mov eax, r8d
xor r9d, r9d
shl eax, 9
js 0x14013ec17
nop word cs:[rax + rax]
dec r9d
add eax, eax
jns 0x14013ec10
mov cl, 1
sub cl, r9b
mov edi, r8d
shl edi, cl
lea eax, [r10 + 1]
xor esi, esi
cmp eax, r9d
je 0x14013ed01
xor eax, eax
cmp r10d, r9d
jl 0x14013ed7b
xor eax, eax
mov esi, r10d
sub esi, r9d
jle 0x14013ec52
lea ecx, [r9 + 1]
cmp r10d, ecx
jne 0x14013ec56
xor ecx, ecx
jmp 0x14013eca1
xor ecx, ecx
jmp 0x14013ecc7
mov r10d, esi
and r10d, 0xfffffffe
xor ecx, ecx
mov ebx, r11d
nop word cs:[rax + rax]
xor ebp, ebp
sub r11d, edi
setns bpl
cmovs r11d, ebx
or ebp, ecx
add r11d, r11d
mov ecx, r11d
sub ecx, edi
cmovns r11d, ecx
add r11d, r11d
shrd ecx, ebp, 0x1e
and ecx, 0xfffffffe
xor ecx, 2
mov ebx, r11d
add r10d, 0xfffffffe
jne 0x14013ec70
mov r10d, r9d
test sil, 1
je 0x14013ecc7
xor r10d, r10d
mov esi, r11d
sub esi, edi
setns r10b
cmovs esi, r11d
or ecx, r10d
add esi, esi
add ecx, ecx
mov r11d, esi
mov r10d, r9d
mov ebx, r11d
xor esi, esi
sub r11d, edi
setns sil
cmovs r11d, ebx
or esi, ecx
test r11d, r11d
je 0x14013ed85
cmp r11d, 0x7fffff
ja 0x14013ed01
nop dword [rax + rax]
mov eax, r11d
lea r11d, [rax + rax]
dec r10d
cmp eax, 0x400000
jb 0x14013ecf0
test r10d, r10d
jle 0x14013ed80
add r11d, 0xff800000
mov eax, r10d
shl eax, 0x17
or eax, r11d
test r8d, r8d
jns 0x14013ed22
xorps xmm1, xmmword [0x140462030]
movd xmm0, eax
cmp r10d, r9d
jne 0x14013ed33
subss xmm0, xmm1
inc esi
jmp 0x14013ed56
inc r10d
cmp r10d, r9d
jne 0x14013ed56
movdqa xmm2, xmm0
addss xmm2, xmm0
ucomiss xmm2, xmm1
ja 0x14013ed2b
ucomiss xmm2, xmm1
jne 0x14013ed56
jp 0x14013ed56
mov eax, esi
and eax, 1
jne 0x14013ed2b
test r8d, r8d
sets al
and esi, 0x7fffffff
test edx, edx
sets cl
jns 0x14013ed70
xorps xmm0, xmmword [0x140462030]
xor cl, al
mov eax, esi
neg eax
test cl, cl
cmove eax, esi
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov eax, r11d
jmp 0x14013ed8b
mov r10d, 0xffffffe2
mov cl, 1
sub cl, r10b
shr eax, cl
test r8d, r8d
js 0x14013ed1b
jmp 0x14013ed22
Function at 0x140143300
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
ucomisd xmm1, xmm1
jp 0x140143392
movq rdx, xmm1
movabs rax, 0x7fffffffffffffff
and rax, rdx
je 0x140143392
movq r8, xmm0
mov r11, r8
shr r11, 0x34
and r11d, 0x7ff
cmp r11d, 0x7ff
je 0x140143392
lea rax, [r8*2]
test rax, rax
je 0x14014339a
mov r9, rdx
shr r9, 0x34
and r9d, 0x7ff
movabs rsi, 0x10000000000000
test r11d, r11d
je 0x1401433a1
lea r10, [rsi - 1]
and r10, r8
or r10, rsi
test r9d, r9d
je 0x1401433c8
lea rbx, [rsi - 1]
and rbx, rdx
or rbx, rsi
lea eax, [r11 + 1]
xor edi, edi
cmp eax, r9d
jne 0x140143402
jmp 0x1401434bf
mulsd xmm0, xmm1
divsd xmm0, xmm0
xor eax, eax
jmp 0x14014354a
mov rax, r8
xor r11d, r11d
shl rax, 0xc
js 0x1401433b8
nop dword [rax]
dec r11d
add rax, rax
jns 0x1401433b0
mov cl, 1
sub cl, r11b
mov r10, r8
shl r10, cl
test r9d, r9d
jne 0x140143378
mov rax, rdx
xor r9d, r9d
shl rax, 0xc
js 0x1401433e8
nop word cs:[rax + rax]
dec r9d
add rax, rax
jns 0x1401433e0
mov cl, 1
sub cl, r9b
mov rbx, rdx
shl rbx, cl
lea eax, [r11 + 1]
xor edi, edi
cmp eax, r9d
je 0x1401434bf
xor eax, eax
cmp r11d, r9d
jl 0x14014354a
xor eax, eax
mov ecx, r11d
sub ecx, r9d
jle 0x14014348c
lea eax, [r9 + 1]
cmp r11d, eax
jne 0x140143424
xor eax, eax
jmp 0x140143468
mov r11d, ecx
and r11d, 0xfffffffe
xor eax, eax
mov rdi, r10
xor r14d, r14d
sub r10, rbx
setns r14b
cmovs r10, rdi
or r14d, eax
add r10, r10
mov rax, r10
sub rax, rbx
cmovns r10, rax
add r10, r10
shr rax, 0x3e
and eax, 0xfffffffe
lea eax, [rax + r14*4]
xor eax, 2
mov rdi, r10
add r11d, 0xfffffffe
jne 0x140143430
mov r11d, r9d
test cl, 1
je 0x14014348c
xor ecx, ecx
mov r11, r10
sub r11, rbx
setns cl
cmovs r11, r10
or eax, ecx
add r11, r11
add eax, eax
mov r10, r11
mov r11d, r9d
mov rcx, r10
xor edi, edi
sub r10, rbx
setns dil
cmovs r10, rcx
or edi, eax
test r10, r10
je 0x140143550
cmp r10, rsi
jae 0x1401434bf
nop dword [rax]
mov rax, r10
add r10, r10
dec r11d
shr rax, 0x33
je 0x1401434b0
test r11d, r11d
jle 0x140143559
movabs rax, 0xfff0000000000000
add r10, rax
mov rax, r11
shl rax, 0x34
or r10, rax
test rdx, rdx
jns 0x1401434ec
xorpd xmm1, xmmword [0x1404637e0]
movq xmm0, r10
cmp r11d, r9d
jne 0x1401434fe
subsd xmm0, xmm1
inc edi
jmp 0x140143523
inc r11d
cmp r11d, r9d
jne 0x140143523
movdqa xmm2, xmm0
addsd xmm2, xmm0
ucomisd xmm2, xmm1
ja 0x1401434f6
ucomisd xmm2, xmm1
jne 0x140143523
jp 0x140143523
mov eax, edi
and eax, 1
jne 0x1401434f6
test rdx, rdx
sets al
and edi, 0x7fffffff
test r8, r8
sets cl
jns 0x14014353f
xorpd xmm0, xmmword [0x1404637e0]
xor cl, al
mov eax, edi
neg eax
test cl, cl
cmove eax, edi
pop rbx
pop rdi
pop rsi
pop r14
ret
mov r11d, 0xffffffc4
xor r10d, r10d
mov cl, 1
sub cl, r11b
shr r10, cl
test rdx, rdx
js 0x1401434e4
jmp 0x1401434ec
Function at 0x14016c910
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x420
mov rsi, rcx
mov rax, qword [rdx]
mov rbx, qword [r9]
movzx eax, byte [rax + 0x82]
cmp al, 2
mov ecx, 1
cmovne ecx, eax
movzx eax, byte [r8 + 0x18]
mov edx, dword [r8 + 0x1c]
mov dword [rsp + 0x3c], edx
mov edx, dword [r8 + 0x19]
mov dword [rsp + 0x39], edx
mov rdx, qword [r8 + 0x10]
mov qword [rsp + 0x30], rdx
movups xmm0, xmmword [r8]
movaps xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x38], al
mov byte [rsp + 0x40], cl
mov byte [rsp + 0x68], 2
mov byte [rsp + 0x60], 3
lea rcx, [rsp + 0x70]
call sym.regex_automata::nfa::thompson::compiler::Compiler::new::hbb89cd069f7aa9be
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x418], rax
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rsp + 0x408], xmm1
movups xmmword [rsp + 0x3f8], xmm0
lea rdi, [rsp + 0x238]
lea rdx, [rsp + 0x70]
mov r8d, 0x1c0
mov rcx, rdi
call sym.memcpy
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x90], rax
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x70], xmm0
lea rdx, [rsp + 0x70]
mov rcx, rdi
call sym.regex_automata::nfa::thompson::pikevm::Builder::configure::h4bfbb7b4959e4761
lock inc qword [rbx]
jle 0x14016caf8
movzx ecx, byte [rax + 0x1e0]
movzx edx, byte [rax + 0x1d8]
cmp rdx, 3
je 0x14016ca0d
cmp edx, 2
jne 0x14016ca0f
jmp 0x14016ca2e
mov r9, qword [rax + 0x1c0]
mov r8, qword [rax + 0x1c8]
lock inc qword [r9]
jle 0x14016caf8
mov rax, qword [rax + 0x1d0]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rdx
mov byte [rsp + 0x98], cl
movzx eax, byte [rsp + 0x410]
cmp al, 3
je 0x14016ca82
cmp al, 2
je 0x14016ca82
mov rax, qword [rsp + 0x3f8]
lock dec qword [rax]
jne 0x14016ca82
lea rcx, [rsp + 0x3f8]
call sym.alloc::sync::Arc_T_A_::drop_slow::h2704c352d48fb045
lea rcx, [rsp + 0x238]
call fcn.14016a270
mov rax, qword [rsp + 0x70]
movzx ecx, byte [rsp + 0x98]
mov edx, dword [rsp + 0x99]
movzx r8d, word [rsp + 0x9d]
movzx r9d, byte [rsp + 0x9f]
movups xmm0, xmmword [rsp + 0x88]
movups xmm1, xmmword [rsp + 0x78]
mov qword [rsi + 8], rax
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi + 0x20], xmm0
mov byte [rsi + 0x30], cl
mov byte [rsi + 0x37], r9b
mov word [rsi + 0x35], r8w
mov dword [rsi + 0x31], edx
movabs rax, 0x8000000000000002
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x420
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x140170c70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
sub rsp, 0x20
movabs rax, 0xcbf29ce484222325
test r8, r8
je 0x140170cce
movabs r9, 0x100000001b3
shl r8, 3
xor r10d, r10d
nop word cs:[rax + rax]
movzx r11d, byte [rdx + r10 + 4]
xor r11, rax
imul r11, r9
movzx esi, byte [rdx + r10 + 5]
xor rsi, r11
imul rsi, r9
mov eax, dword [rdx + r10]
xor rax, rsi
imul rax, r9
add r10, 8
cmp r8, r10
jne 0x140170ca0
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140170ce5
xor edx, edx
div rcx
mov rax, rdx
add rsp, 0x20
pop rsi
ret
lea rcx, [0x1404673d8]
call sym.core::panicking::panic_const::panic_const_rem_by_zero::he587b767e7626e3e
int3

Function at 0x140171170
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1401711be
mov eax, dword [rdx]
movabs r8, 0xcbf29ce484222325
xor r8, rax
movabs r9, 0x100000001b3
imul r8, r9
movzx r10d, byte [rdx + 4]
xor r10, r8
imul r10, r9
movzx eax, byte [rdx + 5]
xor rax, r10
imul rax, r9
xor edx, edx
div rcx
mov rax, rdx
add rsp, 0x28
ret
lea rcx, [0x140467438]
call sym.core::panicking::panic_const::panic_const_rem_by_zero::he587b767e7626e3e
int3
Function at 0x140183820
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r15, rdx
mov rdi, rcx
mov rsi, qword [rcx + 8]
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x140183886
mov rax, rbx
shr rax, 0x3d
lea r12, [rbx*4]
test rax, rax
jne 0x140183991
mov rax, qword [0x14050df18]
movzx eax, byte [rax]
mov r13d, 4
mov edx, 4
mov rcx, r12
call sym.__rust_alloc
test rax, rax
je 0x140183994
mov r14, rax
jmp 0x14018388f
mov r14d, 4
xor r12d, r12d
mov rcx, r14
mov rdx, rsi
mov r8, r12
call sym.memcpy
mov rdx, qword [r15 + 0x28]
movzx ecx, byte [r15 + 0x158]
shr rdx, cl
test rdx, rdx
je 0x140183917
mov rcx, qword [rdi + 0x18]
and ecx, 0x3f
xor r9d, r9d
lea r8, str._root_.cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.4.6_src_dfa_remapper.rs
lea r10, str._root_.cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.4.6_src_dfa_remapper.rs
jmp 0x1401838dc
mov dword [rsi + r9*4], ebp
inc r9
cmp r9, rdx
je 0x140183917
mov r11, r9
shl r11, cl
cmp r9, rbx
je 0x14018398c
mov eax, dword [r14 + r9*4]
cmp eax, r11d
je 0x1401838d4
nop word cs:[rax + rax]
mov ebp, eax
mov eax, eax
shr rax, cl
cmp rax, rbx
jae 0x14018397c
mov eax, dword [r14 + rax*4]
cmp eax, r11d
jne 0x140183900
jmp 0x1401838d0
lea r8, [rdi + 0x18]
mov rcx, r15
mov rdx, rdi
call sym._ZN14regex_automata3dfa8remapper7onepass105__LT_impl_u20_regex_automata..dfa..remapper..Remappable_u20_for_u20_regex_automata.
test rbx, rbx
je 0x140183940
shl rbx, 2
mov r8d, 4
mov rcx, r14
mov rdx, rbx
call sym.__rust_dealloc
mov rdx, qword [rdi]
test rdx, rdx
je 0x14018396a
shl rdx, 2
mov r8d, 4
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp sym.__rust_dealloc
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r8, r10
mov rcx, rax
mov rdx, rbx
call sym.core::panicking::panic_bounds_check::hc59ada7dadd9fb7c
jmp 0x14018399f
mov rax, rbx
jmp 0x14018397f
xor r13d, r13d
mov rcx, r13
mov rdx, r12
call sym.alloc::raw_vec::handle_error::hb4a2c97b2f2cc7c5
ud2
Function at 0x140193230
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rdx
mov rdi, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x140193260
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140193275
cmp qword [rax + 8], 0
je 0x140193275
add rax, 0x10
jmp 0x140193333
mov rcx, rdi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::haa087f69fbeb5f15
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x140193250
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x140193318
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x140193331
test rax, rax
jne 0x1401932da
mov rax, qword [0x14050df18]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x140193383
mov qword [rax], rdi
mov qword [rax + 8], 0
mov ecx, dword [rdi + 0x18]
test ecx, ecx
je 0x14019333a
dec ecx
mov rdx, rax
mov rdi, rax
call fcn.1402dd8f4
mov rax, rdi
test rsi, rsi
je 0x1401932f0
mov rcx, qword [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 0
jne 0x140193303
mov ecx, 1
lock xadd qword [0x1402e1118], rcx
test rcx, rcx
je 0x14019334c
lea rdx, [rax + 0x10]
mov qword [rax + 8], 1
mov qword [rax + 0x10], rcx
mov rax, rdx
jmp 0x140193333
mov rcx, rdi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::haa087f69fbeb5f15
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x140193291
xor eax, eax
add rsp, 0x58
pop rdi
pop rsi
ret
mov rcx, rdi
mov rdi, rax
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::haa087f69fbeb5f15
mov ecx, eax
mov rax, rdi
jmp 0x1401932cc
lea rax, str.regex:_thread_ID_allocation_space_exhausted
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rdx, str._root_.cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.4.6_src_util_pool.rs
lea rcx, [rsp + 0x28]
call sym.core::panicking::panic_fmt::hbf31d8edd17cf412
mov ecx, 8
mov edx, 0x18
call sym.alloc::alloc::handle_alloc_error::hac6683127b8aa11c
int3
Function at 0x14019e540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rbx
sub rsp, 0x28
tzcnt eax, edx
lea edx, [rax - 6]
cmp edx, 0xc
jae 0x14019e687
xor edx, edx
lea r9, [0x14046d290]
mov r10d, 1
xor ecx, ecx
movzx ecx, cx
cmp ecx, 0x100
mov r11d, 0xff
cmovae r11d, ecx
lea eax, [rcx - 1]
neg r11d
lea esi, [r11 + rax]
cmp si, 0xffff
je 0x14019e626
lea esi, [rax + 2]
cmp byte [rcx + r9], 0
setne bl
movzx esi, sil
cmp byte [rsi + r9], 0
sete sil
xor sil, bl
inc eax
test sil, sil
jne 0x14019e580
test cl, cl
je 0x14019e5e4
dec ecx
xor r11d, r11d
shld r11, r10, cl
mov ebx, ecx
mov esi, 1
shl rsi, cl
shr bl, 7
test cl, 0x40
cmovne r11, rsi
cmovne rsi, rdx
movzx ecx, bl
shl ecx, 4
or qword [r8 + rcx], rsi
or qword [r8 + rcx + 8], r11
xor r11d, r11d
mov ecx, eax
shld r11, r10, cl
mov ebx, eax
mov esi, 1
shl rsi, cl
shr bl, 7
test al, 0x40
cmovne r11, rsi
cmovne rsi, rdx
movzx ecx, bl
shl ecx, 4
or qword [r8 + rcx], rsi
or qword [r8 + rcx + 8], r11
lea ecx, [rax + 1]
movzx eax, ax
cmp eax, 0xff
jb 0x14019e567
jmp 0x14019e680
cmp ecx, 0xff
ja 0x14019e710
test cl, cl
je 0x14019e669
dec ecx
mov eax, ecx
shr al, 7
mov edx, 1
xor r9d, r9d
shld r9, rdx, cl
shl rdx, cl
xor r10d, r10d
test cl, 0x40
cmovne r9, rdx
cmovne rdx, r10
movzx eax, al
shl eax, 4
or qword [r8 + rax], rdx
or qword [r8 + rax + 8], r9
add r8, 0x10
movabs r9, 0x8000000000000000
xor edx, edx
or qword [r8], rdx
or qword [r8 + 8], r9
add rsp, 0x28
pop rbx
pop rsi
ret
mov edx, 0x3600
xor r9d, r9d
mov r10d, 3
bt r10d, eax
jb 0x14019e680
mov r10d, 0xc
bt r10d, eax
jae 0x14019e679
movzx eax, byte [rcx]
test rax, rax
je 0x14019e6e4
lea ecx, [rax - 1]
mov edx, ecx
shr dl, 7
mov r9d, 1
xor r10d, r10d
shld r10, r9, cl
shl r9, cl
xor r11d, r11d
test cl, 0x40
cmovne r10, r9
cmovne r9, r11
movzx ecx, dl
shl ecx, 4
or qword [r8 + rcx], r9
or qword [r8 + rcx + 8], r10
mov edx, 1
xor r9d, r9d
mov ecx, eax
shld r9, rdx, cl
xor r10d, r10d
shl rdx, cl
test al, 0x40
cmovne r9, rdx
cmovne rdx, r10
shr eax, 3
and eax, 0xfffffff0
add r8, rax
jmp 0x14019e679
lea rcx, [0x14046d3f0]
lea r8, str._root_.cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.4.6_src_util_look.rs
mov edx, 0x1b
call sym.core::panicking::panic::h2104b77c7bdaa98f
int3
Function at 0x1401b4e60
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x1401b4ea2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x1401b4eaa
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x1401b4ebb
jmp 0x1401b4ed2
xor r10d, r10d
jmp 0x1401b4f5d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x1401b4ed2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x1401b4ee9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x1401b4f09
add r11, r8
jmp 0x1401b503b
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x1401b4fd2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x1401b4f80
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x1401b4ff0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x1401b5002
jmp 0x1401b501d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x1401b501d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x1401b5037
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret

Function at 0x1401ba440
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, qword [rcx]
mov rsi, qword [rdi]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x1401ba457
dec ecx
jmp 0x1401ba461
mov rcx, rsi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::haa087f69fbeb5f15
mov ecx, eax
mov edx, 1
call fcn.1402dd8f4
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call sym.__rust_dealloc
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x1401ba489
dec ecx
jmp 0x1401ba493
mov rcx, rsi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::haa087f69fbeb5f15
mov ecx, eax
xor esi, esi
xor edx, edx
call fcn.1402dd8f4
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1401bd810
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rdx, rcx
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::h441d3d92f14e323f
jmp sym.std::sys::thread_local::os_local::Key_T_::get::h750e314171a11c10
Function at 0x1401e6af0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, rdx
mov rsi, rcx
mov r12, qword [rcx + 8]
mov rdi, qword [rcx + 0x10]
test rdi, rdi
je 0x1401e6b56
mov rax, rdi
shr rax, 0x3d
lea r15, [rdi*4]
test rax, rax
jne 0x1401e6c74
mov rax, qword [0x14050df18]
movzx eax, byte [rax]
mov r13d, 4
mov edx, 4
mov rcx, r15
call sym.__rust_alloc
test rax, rax
je 0x1401e6c77
mov rbx, rax
jmp 0x1401e6b5e
mov ebx, 4
xor r15d, r15d
mov rcx, rbx
mov rdx, r12
mov r8, r15
call sym.memcpy
mov r9, qword [r14 + 0x10]
test r9, r9
je 0x1401e6bee
mov rcx, qword [rsi + 0x18]
and ecx, 0x3f
xor r10d, r10d
lea r8, [0x140477a10]
lea r11, [0x140477a28]
lea r15, [0x140477a40]
jmp 0x1401e6ba8
inc r10
cmp r10, r9
je 0x1401e6bee
mov rdx, r10
shl rdx, cl
cmp r10, rdi
je 0x1401e6c64
mov eax, dword [rbx + r10*4]
cmp eax, edx
je 0x1401e6ba0
nop
mov ebp, eax
mov eax, eax
shr rax, cl
cmp rax, rdi
jae 0x1401e6c54
mov eax, dword [rbx + rax*4]
cmp eax, edx
jne 0x1401e6bc0
mov rdx, qword [rsi + 0x10]
cmp r10, rdx
jae 0x1401e6c6c
mov rax, qword [rsi + 8]
mov dword [rax + r10*4], ebp
jmp 0x1401e6ba0
lea r8, [rsi + 0x18]
mov rcx, r14
mov rdx, rsi
call sym._ZN98__LT_aho_corasick..nfa..noncontiguous..NFA_u20_as_u20_aho_corasick..util..remapper..Remappable_GT_5remap17hb759e881a85c23
test rdi, rdi
je 0x1401e6c17
shl rdi, 2
mov r8d, 4
mov rcx, rbx
mov rdx, rdi
call sym.__rust_dealloc
mov rdx, qword [rsi]
test rdx, rdx
je 0x1401e6c42
mov rcx, qword [rsi + 8]
shl rdx, 2
mov r8d, 4
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp sym.__rust_dealloc
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, rdi
mov r8, r11
mov rcx, rax
call sym.core::panicking::panic_bounds_check::hc59ada7dadd9fb7c
jmp 0x1401e6c82
mov rax, rdi
mov rdx, rdi
jmp 0x1401e6c5a
mov rax, r10
mov r8, r15
jmp 0x1401e6c5a
xor r13d, r13d
mov rcx, r13
mov rdx, r15
call sym.alloc::raw_vec::handle_error::hb4a2c97b2f2cc7c5
ud2
Function at 0x140205a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp r8, r9
jae 0x140205c26
mov r10, r9
sub r10, r8
cmp r10, 0xf
ja 0x140205abb
mov eax, 1
nop word [rax + rax]
cmp r9, r8
jbe 0x140205b20
movzx r10d, byte [r9 - 1]
dec r9
cmp r10b, cl
je 0x140205ab7
cmp r10b, dl
jne 0x140205aa0
mov rdx, r9
ret
movzx eax, cl
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
movzx eax, dl
movd xmm1, eax
punpcklbw xmm1, xmm1
pshuflw xmm1, xmm1, 0
pshufd xmm1, xmm1, 0
movdqu xmm2, xmmword [r9 - 0x10]
movdqa xmm3, xmm0
pcmpeqb xmm3, xmm2
pcmpeqb xmm2, xmm1
por xmm2, xmm3
pmovmskb eax, xmm2
test eax, eax
je 0x140205b26
add r9, 0xfffffffffffffff0
movzx eax, ax
bsr eax, eax
xor eax, 0xffffffe0
add eax, 0x21
lea rdx, [r9 + rax]
dec rdx
mov eax, 1
ret
xor eax, eax
mov rdx, r9
ret
mov rax, r9
and rax, 0xfffffffffffffff0
cmp r10, 0x20
jb 0x140205ba3
lea rcx, [r8 + 0x20]
cmp rax, rcx
jb 0x140205ba3
mov eax, r9d
and eax, 0xf
sub r9, rax
add r9, 0xffffffffffffffdf
nop dword [rax]
movdqa xmm2, xmmword [r9 + 1]
movdqa xmm3, xmmword [r9 + 0x11]
movdqa xmm4, xmm0
pcmpeqb xmm4, xmm2
movdqa xmm5, xmm0
pcmpeqb xmm5, xmm3
pcmpeqb xmm2, xmm1
por xmm2, xmm4
pcmpeqb xmm3, xmm1
por xmm3, xmm5
movdqa xmm4, xmm3
por xmm4, xmm2
pmovmskb eax, xmm4
test eax, eax
jne 0x140205c2c
lea rax, [r9 - 0x20]
inc r9
cmp r9, rcx
mov r9, rax
jae 0x140205b50
add rax, 0x21
lea rcx, [r8 + 0x10]
nop word [rax + rax]
cmp rax, rcx
jb 0x140205bef
movdqu xmm2, xmmword [rax - 0x10]
add rax, 0xfffffffffffffff0
movdqa xmm3, xmm0
pcmpeqb xmm3, xmm2
pcmpeqb xmm2, xmm1
por xmm2, xmm3
pmovmskb edx, xmm2
test edx, edx
je 0x140205bb0
movzx ecx, dx
bsr ecx, ecx
xor ecx, 0xffffffe0
add ecx, 0x21
lea rdx, [rax + rcx]
dec rdx
mov eax, 1
ret
cmp rax, r8
jbe 0x140205c26
movdqu xmm2, xmmword [r8]
pcmpeqb xmm0, xmm2
pcmpeqb xmm1, xmm2
por xmm1, xmm0
pmovmskb eax, xmm1
test eax, eax
je 0x140205c26
movzx eax, ax
bsr eax, eax
xor eax, 0xffffffe0
add eax, 0x21
lea rdx, [r8 + rax]
dec rdx
mov eax, 1
ret
xor eax, eax
mov rdx, r9
ret
pmovmskb eax, xmm3
test eax, eax
je 0x140205c4e
movzx eax, ax
bsr eax, eax
xor eax, 0xffffffe0
add eax, 0x21
lea rdx, [r9 + rax]
add rdx, 0x10
mov eax, 1
ret
psllw xmm2, 7
pmovmskb edx, xmm2
mov eax, 0x20
mov ecx, 0x20
test edx, edx
je 0x140205c6b
bsr ecx, edx
xor ecx, 0x1f
sub eax, ecx
add r9, rax
mov eax, 1
mov rdx, r9
ret