joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006040
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm8, xmm2
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesenc xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesenc xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x140006080
aesenc xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140006080
aesenc xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesenclast xmm2, xmm7
repz ret

Function at 0x140006480
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
movdqa xmm14, xmm10
pxor xmm10, xmm15
movdqu xmm15, xmmword [rbx + r14]
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm14, xmm13
pxor xmm5, xmm13
pxor xmm15, xmm14
pxor xmm6, xmm14
pxor xmm7, xmm15
movups xmm0, xmmword [r11 + 0x20]
lea r12, [r8 + 1]
lea r13, [r8 + 3]
lea r14, [r8 + 5]
add r8, 6
pxor xmm10, xmm9
bsf r12, r12
bsf r13, r13
bsf r14, r14
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
pxor xmm11, xmm9
pxor xmm12, xmm9
aesdec xmm6, xmm1
pxor xmm13, xmm9
pxor xmm14, xmm9
aesdec xmm7, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm15, xmm9
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [r11 + 0x40]
shl r12, 4
shl r13, 4
jmp 0x140006580
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140006580
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [r11 + 0x10]
shl r14, 4
aesdeclast xmm2, xmm10
movdqu xmm10, xmmword [rbx]
mov rax, r10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
aesdeclast xmm6, xmm14
aesdeclast xmm7, xmm15
repz ret
Function at 0x140006620
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x1400066c0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400066c0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
repz ret

Function at 0x140006740
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesdec xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x140006780
aesdec xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140006780
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm7
repz ret
Function at 0x1400071f0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
call fcn.140007260
shl edx, 4
test eax, eax
jne 0x140007256
lea rcx, [r8 + rdx + 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
movups xmmword [rcx], xmm0
movups xmmword [r8], xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmmword [rcx + 0x10], xmm0
movups xmmword [r8 - 0x10], xmm1
cmp rcx, r8
ja 0x14000721b
movups xmm0, xmmword [r8]
aesimc xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [rcx], xmm0
pxor xmm0, xmm0
add rsp, 8
repz ret
Function at 0x140008340
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x140008460
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x1400083a0
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x1400083a0
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x1400083a0
Function at 0x1400298ad
Capabilities:
Encode data using xor
Hash data using sha256 via x86 extensions

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
Function at 0x14008f810
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rsi, rcx
mov qword [rcx], 7
xor ebp, ebp
add rcx, 8
xor r8d, r8d
lea rdx, [0x1402653eb]
call fcn.140087610
lea rcx, [rsi + 0x28]
xor r8d, r8d
lea rdx, [0x1402653eb]
call fcn.140087610
lea rcx, [rsi + 0x48]
xor r8d, r8d
lea rdx, [0x1402653eb]
call fcn.140087610
lea rcx, [rsp + 0x40]
call fcn.1401c28c0
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1401c0630
lea rcx, [rsi + 0x90]
mov rdx, rax
call fcn.1400920e0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14008f8cd
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008f8c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008f9aa
call fcn.140188c8c
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], recv
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14008f922
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008f91d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008f9a4
call fcn.140188c8c
lea rcx, [rsi + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, [rsi + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rsi + 0xd0], rbp
mov rbx, qword [rsi + 0xd8]
mov r8, qword [rbx + 8]
lea rdx, [rsi + 0xd8]
lea rcx, [rsi + 0xd8]
call fcn.140093010
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov qword [rbx + 0x10], rbx
mov qword [rsi + 0xe0], rbp
xorps xmm0, xmm0
movups xmmword [rsi + 0x118], xmm0
mov rcx, rsi
call fcn.14008bc10
mov rcx, rsi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
jmp fcn.1400902b0
call fcn.1401925bc
nop
call fcn.1401925bc
nop
Function at 0x1400a32d0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1400a32f2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x1400a336c
mov rdi, r14
mov rcx, rbx
call fcn.140092230
test rax, rax
jle 0x1400a3344
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.14018d9c0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400a335c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1400a3364
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1400a3306
sub r14, rdi
jmp 0x1400a3459
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1400a3383
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400a3385
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400a33ba
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14018d9c0
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400a3456
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x1400a33f5
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x1400a3431
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1401a2e98
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x1400a346f
cmp rbp, rax
ja 0x1400a3401
mov r8, rdi
test rdi, rdi
je 0x1400a3456
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1401a2e98
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x1400a3459
Function at 0x1400bbbe0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140189640
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1400c7190
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x1400c71fc
movzx ecx, byte [rcx]
test cl, cl
je 0x1400c71fc
mov r11d, 0x100
nop word [rax + rax]
movsx r9d, cl
lea r10, [r10 + 1]
or r9d, r11d
mov r8d, eax
mov edx, r9d
mov ecx, 0x20
shr edx, 2
add r11d, 0x100
xor edx, r9d
imul r9d, r9d
and edx, 0xf
sub ecx, edx
shr r8, cl
mov ecx, edx
mov edx, eax
mov eax, r8d
shl edx, cl
movzx ecx, byte [r10]
or eax, edx
xor eax, r9d
test cl, cl
jne 0x1400c71b0
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
ret

Function at 0x1400c72c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x20
call fcn.140189640
sub rsp, rax
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
je 0x1400c7353
movzx eax, byte [rcx]
test al, al
je 0x1400c7353
mov qword [rsp + 0x30], rsi
mov esi, 0x100
nop
movsx ecx, al
call fcn.1400c43f0
mov r9d, eax
mov edx, ebx
or r9d, esi
lea rdi, [rdi + 1]
mov eax, ebx
mov r8d, r9d
shr r8d, 2
mov ecx, 0x20
xor r8d, r9d
add esi, 0x100
and r8d, 0xf
imul r9d, r9d
sub ecx, r8d
shr rdx, cl
mov ecx, r8d
shl eax, cl
mov ebx, edx
or ebx, eax
movzx eax, byte [rdi]
xor ebx, r9d
test al, al
jne 0x1400c72f0
mov rsi, qword [rsp + 0x30]
mov eax, ebx
shr eax, 0x10
xor eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x1400cf7e0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140189640
sub rsp, rax
lea rcx, [0x14028f038]
add rsp, 0x28
jmp fcn.1400bba40
Function at 0x140102360
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x38
call fcn.140189640
sub rsp, rax
mov r10, r8
mov r11, rcx
test r9, r9
jne 0x14010239f
mov edx, 0xe2
mov dword [rsp + 0x20], 0x9a
lea r9, str.crypto_asn1_a_int.c
lea ecx, [rax - 0x2b]
lea r8d, [rdx - 4]
call fcn.1400ba320
xor eax, eax
add rsp, 0x38
ret
movzx r8d, byte [r8]
and r8d, 0x80
test rdx, rdx
je 0x1401023b2
mov dword [rdx], r8d
cmp r9, 1
jne 0x1401023d4
test r11, r11
je 0x1401023ca
movzx eax, byte [r10]
test r8d, r8d
je 0x1401023c8
neg al
mov byte [rcx], al
mov eax, 1
add rsp, 0x38
ret
movzx ecx, byte [r10]
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov eax, ebx
test cl, cl
jne 0x1401023f1
mov eax, 1
mov ebx, eax
jmp 0x14010249f
cmp cl, 0xff
jne 0x1401024dd
mov eax, 1
lea rcx, [r9 - 1]
mov edx, ebx
cmp r9, rax
jbe 0x14010248f
cmp rcx, 8
jb 0x140102480
and ecx, 7
mov rdx, r9
sub rdx, rcx
xorps xmm2, xmm2
xorps xmm3, xmm3
movd xmm1, dword [rax + r10]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm2, xmm1
movd xmm1, dword [rax + r10 + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm1, xmm3
movdqa xmm3, xmm1
cmp rax, rdx
jb 0x140102423
por xmm2, xmm1
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd edx, xmm2
cmp rax, r9
jae 0x14010248f
nop
movzx ecx, byte [rax + r10]
inc rax
or edx, ecx
cmp rax, r9
jb 0x140102480
test edx, edx
mov eax, ebx
setne al
test edx, edx
setne bl
test edx, edx
je 0x1401024dd
movzx ecx, byte [r10 + 1]
and ecx, 0x80
cmp r8d, ecx
jne 0x1401024dd
mov edx, 0xe2
mov dword [rsp + 0x20], 0xbb
lea r9, str.crypto_asn1_a_int.c
mov ecx, recv
lea r8d, [rdx - 5]
call fcn.1400ba320
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x38
ret
mov ecx, eax
sub r9, rcx
test r11, r11
je 0x140102531
neg r8d
mov qword [rsp + 0x30], rdi
lea r8, [rbx + r10]
sbb edi, edi
add r8, r9
movzx edi, dil
mov ecx, edi
and ecx, 1
test r9, r9
je 0x14010252c
mov rdx, r8
sub rdx, rbx
sub rdx, r10
nop
movzx eax, byte [r8 - 1]
lea r8, [r8 - 1]
dec rdx
xor eax, edi
add ecx, eax
mov byte [rdx + r11], cl
shr ecx, 8
test rdx, rdx
jne 0x140102510
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rax, r9
add rsp, 0x38
ret
Function at 0x140132850
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38
call fcn.140189640
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x140132879
lea rax, [0x140130eb0]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1400bf9f0
lea rax, [0x140130060]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1400bf730

Function at 0x140155270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor r10d, r10d
movsxd rbx, r8d
mov r11, rdx
mov rdi, rcx
test r8d, r8d
jle 0x1401552af
mov r9, rdx
mov rdx, rcx
sub rdx, r9
movzx eax, byte [r9]
cmp byte [rdx + r9], al
jne 0x1401552af
inc r9
inc r10d
mov rax, r9
sub rax, r11
cmp rax, rbx
jl 0x140155294
lea edx, [r8 - 1]
movsxd rax, edx
test edx, edx
js 0x1401552da
mov r8, rdi
lea rcx, [rax + r11]
sub r8, r11
cmp byte [rcx + r8], 0
jne 0x1401552da
cmp byte [rcx], 0xff
jne 0x1401552da
dec edx
dec rcx
cmp rcx, r11
jns 0x1401552c4
cmp r10d, edx
jl case.0x140155333.2
jle 0x1401552f8
lea eax, [r10*8]
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
movsxd rax, r10d
movzx r8d, byte [rax + r11]
movzx r9d, byte [rax + rdi]
movzx edx, r8b
xor dl, r9b
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x140155333.2
lea r11, [0x140000000]
cdqe
movzx eax, byte [r11 + rax + 0x1553a8]
mov ecx, dword [r11 + rax*4 + 0x155388]
add rcx, r11
jmp rcx
mov eax, 7
jmp 0x140155364
mov eax, 6
jmp 0x140155364
mov eax, 5
jmp 0x140155364
mov eax, 4
jmp 0x140155364
mov eax, 3
jmp 0x140155364
mov eax, 2
jmp 0x140155364
mov eax, 1
test dl, r9b
jne case.0x140155333.2
and r8b, dl
lea eax, [rax + r10*8]
cmp r8b, dl
je 0x14015537a
mov eax, 0xffffffff
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x14018c1d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x140289d20]
cmp ecx, 0xffffffff
jne 0x14018c1ee
xor esi, esi
jmp 0x14018c1f7
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov qword [rsp + 0x30], rsi
test rsi, rsi
je 0x14018c300
mov rax, qword [rsi + 0x30]
test rax, rax
jne 0x14018c220
cmp qword [rsi + 0x18], 0
je 0x14018c2f8
nop dword [rax]
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x14018c2c1
mov rax, qword [rbx + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x14018c286
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rdi, qword [rbx]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x14018c286
lea r9d, [rax + 0x23]
lea r8, str.._boost_thread_win32_thread_heap_alloc.hpp
lea rdx, str.void___cdecl_boost::detail::free_raw_heap_memory_void__
lea rcx, str.winapi::HeapFree_winapi::GetProcessHeap___0_heap_memory__0
call fcn.1401c1d50
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x14018c220
lea r9d, [rax + 0x23]
lea r8, str.._boost_thread_win32_thread_heap_alloc.hpp
lea rdx, str.void___cdecl_boost::detail::free_raw_heap_memory_void__
lea rcx, str.winapi::HeapFree_winapi::GetProcessHeap___0_heap_memory__0
call fcn.1401c1d50
jmp 0x14018c220
mov rax, qword [rsi + 0x30]
test rax, rax
je 0x14018c20e
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14018c2ea
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x14018c2ea
call qword [rbx + 0x28]
mov rdx, rbx
lea rcx, [rsi + 0x28]
call fcn.14018b2a0
jmp 0x14018c2c1
xor ecx, ecx
call fcn.14018c370
nop
test rsi, rsi
je 0x14018c355
mov eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x14018c355
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x14018c355
lea r9d, [rax + 0x23]
lea r8, str.._boost_thread_win32_thread_heap_alloc.hpp
lea rdx, str.void___cdecl_boost::detail::free_raw_heap_memory_void__
lea rcx, str.winapi::HeapFree_winapi::GetProcessHeap___0_heap_memory__0
call fcn.1401c1d50
nop
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14018c370
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdx, [0x14018bbe0]
lea rcx, [0x1402901a8]
call fcn.14018b770
mov ecx, dword [0x140289d20]
cmp ecx, 0xffffffff
je 0x14018c3b1
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x14018c3d6
lea r9d, [rax + 0x70]
lea rcx, str.TlsSetValue_current_thread_tls_key__new_data_
jmp 0x14018c3be
mov r9d, reloc.WS2_32.dll_WSACleanup
lea rcx, str.false
lea r8, str.libs_thread_srcwin32_thread.cpp
lea rdx, str.void___cdecl_boost::_anonymous_namespace::set_current_thread_data_struct_boost::detail::thread_data_base__
add rsp, 0x20
pop rbx
jmp fcn.1401c1d50
add rsp, 0x20
pop rbx
ret

Function at 0x14018c3e0
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x30
mov r9, qword [rcx]
mov rbx, rcx
test r9, r9
jne 0x14018c418
mov r9d, 0xc7
lea r8, str.._boost_smart_ptr_intrusive_ptr.hpp
lea rdx, str.struct_boost::detail::thread_data_base___cdecl_boost::intrusive_ptr_struct_boost::detail::thread_data_base_::operator____void__const
lea rcx, str.px___0
call fcn.1401c1d50
mov r9, qword [rbx]
lea rax, [r9 + 0x20]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r8, [0x14018c510]
xor ecx, ecx
mov dword [rsp + 0x20], 4
call fcn.1401acc6c
mov rsi, rax
test rax, rax
jne 0x14018c44c
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
mov rax, qword [rbx]
mov qword [rsp + 0x40], rdi
lock inc dword [rax + 8]
mov rdi, qword [rbx]
test rdi, rdi
jne 0x14018c483
mov r9d, 0xc7
lea r8, str.._boost_smart_ptr_intrusive_ptr.hpp
lea rdx, str.struct_boost::detail::thread_data_base___cdecl_boost::intrusive_ptr_struct_boost::detail::thread_data_base_::operator____void__const
lea rcx, str.px___0
call fcn.1401c1d50
mov rdi, qword [rbx]
mov rcx, qword [rdi + 0x10]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14018c4bb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14018c4bb
mov r9d, 0xe7
lea r8, str.._boost_thread_win32_thread_primitives.hpp
lea rdx, str.void___cdecl_boost::detail::win32::handle_manager::cleanup_void_
lea rcx, str.::boost::winapi::CloseHandle_handle_to_manage_
call fcn.1401c1d50
mov qword [rdi + 0x10], rsi
mov rcx, qword [rbx]
mov rdi, qword [rsp + 0x40]
test rcx, rcx
jne 0x14018c4ef
mov r9d, 0xc7
lea r8, str.._boost_smart_ptr_intrusive_ptr.hpp
lea rdx, str.struct_boost::detail::thread_data_base___cdecl_boost::intrusive_ptr_struct_boost::detail::thread_data_base_::operator____void__const
lea rcx, str.px___0
call fcn.1401c1d50
mov rcx, qword [rbx]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rsp + 0x48]
mov al, 1
add rsp, 0x30
pop rsi
ret
Function at 0x1401a43f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140189640
sub rsp, rax
mov rax, qword [0x140289cf0]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.1401a6ce8
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1401a443f
mov rax, rbp
jmp 0x1401a4547
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x290800]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.1401b6414
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x290800]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x1401a4543
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401a4543
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.1401b6414
test rax, rax
js 0x1401a4543
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x1401a4543
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x1401a4535
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x1401a4535
cmp byte [rcx], 0xd
jne 0x1401a451b
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x1401a452a
cmp byte [rcx + 1], 0xa
jne 0x1401a452a
inc rcx
jmp 0x1401a452a
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x28a830]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x1401a44fd
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x1401a4547
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1401889e0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret