joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140192670
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
push rbx
mov eax, 0xd0
call fcn.1401d04b0
sub rsp, rax
mov rax, qword [0x1402bdaf8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebx, 0x40
test eax, eax
je 0x140192702
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x80]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1401926f5
xorps xmm2, xmm2
cvtsi2sd xmm2, rbx
test rbx, rbx
jns 0x1401926e6
addsd xmm2, qword [0x140262148]
mov edx, ebx
lea rcx, [rsp + 0x80]
call fcn.14011c0f0
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r9d, reloc.WS2_32.dll_shutdown
mov dword [rsp + 0x20], 0xf0000040
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140192772
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x80]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x140192765
xorps xmm2, xmm2
cvtsi2sd xmm2, rbx
test rbx, rbx
jns 0x140192756
addsd xmm2, qword [0x140262148]
mov edx, ebx
lea rcx, [rsp + 0x80]
call fcn.14011c0f0
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x1401927ad
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x140192792
mov dword [reloc.WS2_32.dll_accept], eax
jmp 0x1401927ad
xorps xmm2, xmm2
lea rcx, [rsp + 0x40]
mov edx, 8
call fcn.14011c0f0
cmp dword [reloc.WS2_32.dll_accept], 0
jne 0x1401927c9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorps xmm2, xmm2
lea rcx, [rsp + 0x38]
mov edx, 4
mov dword [rsp + 0x38], eax
call fcn.14011c0f0
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
movsd xmm2, qword [0x140262118]
lea rcx, [rsp + 0x48]
mov edx, gethostname
call fcn.14011c0f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movsd xmm2, qword [0x140262118]
lea rcx, [rsp + 0x3c]
mov edx, 4
mov dword [rsp + 0x3c], eax
call fcn.14011c0f0
mov eax, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1401cf6b0
add rsp, 0xd0
pop rbx
ret
Function at 0x1401b8769
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1401b895a
push rbx
mov eax, 0xd0
call fcn.1401d04b0
sub rsp, rax
mov rax, qword [0x1402bdaf8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov rbx, rdx
mov qword [rsp + 0xf0], rsi
lea rbp, [r8 - 1]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea r14, [rcx + 0xc]
shr rbp, 3
mov qword [rsp + 0xc0], r15
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r14
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
lea rbx, [rbx + 8]
shl eax, 8
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
or esi, eax
mov dword [rsp + 0x20], edi
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
mov dword [rsp + 0x28], edi
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x2c], esi
call fcn.140165db0
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.140165b00
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.1401625b0
mov rcx, r15
call fcn.140165db0
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.140165b00
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1401625b0
mov r8d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
xor r8d, edi
xor edi, dword [rsp + 0x28]
xor edx, esi
xor esi, dword [rsp + 0x2c]
mov eax, edi
mov byte [r14], dil
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, edx
shr eax, 8
shr edi, 0x18
mov byte [r14 + 3], dil
mov byte [r14 + 4], dl
mov byte [r14 + 5], al
mov eax, edx
shr eax, 0x10
mov byte [r14 + 6], al
mov eax, r8d
shr eax, 8
shr edx, 0x18
mov byte [r14 + 7], dl
mov byte [r15], r8b
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
mov byte [r15 + 2], al
shr r8d, 0x18
mov byte [r15 + 3], r8b
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr eax, 0x10
shr esi, 0x18
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
sub rbp, 1
jne 0x1401b87d0
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401cf6b0
add rsp, 0xd0
pop rbx
ret
Function at 0x1401c8110
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x220], rbx
mov rax, qword [0x1402bdaf8]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov r12, r9
mov r15, rdx
mov qword [rsp + 0x20], rcx
mov r13d, dword [rdx + 0x18]
mov r14d, dword [r8]
movups xmm0, xmmword [r8]
movaps xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [r8 + 0x10]
movaps xmmword [rbp - 0x40], xmm1
movups xmm0, xmmword [r8 + 0x20]
movaps xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [r8 + 0x30]
movaps xmmword [rbp - 0x20], xmm1
movups xmm0, xmmword [r8]
movaps xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [r8 + 0x10]
movaps xmmword [rbp], xmm1
movups xmm0, xmmword [r8 + 0x20]
movaps xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [r8 + 0x30]
movaps xmmword [rbp + 0x20], xmm1
xor ebx, ebx
mov edi, ebx
mov esi, ebx
nop dword [rax + rax]
mov rdx, rsi
and edx, 0x1f
mov eax, edi
xor eax, r14d
imul ecx, eax, 0x1000193
mov eax, dword [rbp + rdx*4 - 0x50]
xor eax, ecx
xor edx, edx
div r13d
mov r8d, edx
mov rdx, r15
lea rcx, [rsp + 0x30]
call r12
nop
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp + 0x60], xmm1
movups xmm0, xmmword [rax + 0x20]
movaps xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rbp + 0x80], xmm1
movups xmm0, xmmword [rax + 0x40]
movaps xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x50]
movaps xmmword [rbp + 0xa0], xmm1
movups xmm0, xmmword [rax + 0x60]
movaps xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rax + 0x70]
movaps xmmword [rbp + 0xc0], xmm1
mov rax, rbx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x1401c8290
movdqa xmm2, xmmword [0x14023fe60]
nop dword [rax]
movdqu xmm1, xmmword [rbp + rax - 0x50]
pmulld xmm1, xmm2
movdqu xmm0, xmmword [rbp + rax + 0x50]
pxor xmm1, xmm0
movdqu xmmword [rbp + rax - 0x50], xmm1
movdqu xmm1, xmmword [rbp + rax - 0x40]
pmulld xmm1, xmm2
movdqu xmm0, xmmword [rbp + rax + 0x60]
pxor xmm1, xmm0
movdqu xmmword [rbp + rax - 0x40], xmm1
add rax, 0x20
cmp rax, 0x80
jb 0x1401c8240
jmp 0x1401c82ae
imul ecx, dword [rbp + rax - 0x50], 0x1000193
mov edx, dword [rbp + rax + 0x50]
xor edx, ecx
mov dword [rbp + rax - 0x50], edx
add rax, 4
cmp rax, 0x80
jb 0x1401c8290
inc edi
inc rsi
cmp edi, 0x40
jb 0x1401c81b0
mov r14, qword [rsp + 0x20]
imul eax, dword [rbp + rbx*4 - 0x50], 0x1000193
xor eax, dword [rbp + rbx*4 - 0x4c]
imul ecx, eax, 0x1000193
xor ecx, dword [rbp + rbx*4 - 0x48]
imul edx, ecx, 0x1000193
xor edx, dword [rbp + rbx*4 - 0x44]
mov rax, rbx
shr rax, 2
mov dword [rbp + rax*4 + 0x30], edx
add rbx, 4
cmp rbx, 0x20
jb 0x1401c82c1
movups xmm0, xmmword [rbp + 0x30]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rbp + 0x40]
movups xmmword [r14 + 0x10], xmm1
mov rax, r14
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.1401cf6b0
nop
mov rbx, qword [rsp + 0x220]
add rsp, 0x1e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401c8520
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov dword [rcx], 0x159a55e5
mov r11, rcx
mov dword [rcx + 4], 0x1f123bb5
xor eax, eax
mov dword [rcx + 8], 0x75bcd15
mov r8, rdx
mov dword [rcx + 0xc], 0x16a81cc0
mov r10, rdx
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x98], rax
mov ecx, edx
xor ecx, 0x811c9dc5
shr r10, 0x20
imul r9d, ecx, 0x1000193
mov ecx, r9d
mov dword [rsp], r9d
xor ecx, r10d
imul edx, ecx, 0x1000193
mov ecx, edx
mov dword [rsp + 4], edx
xor ecx, r8d
imul r8d, ecx, 0x1000193
mov dword [rsp + 8], r8d
xor r8d, r10d
imul ecx, r8d, 0x1000193
mov dword [rsp + 0xc], ecx
lea rcx, [r11 + 0xa0]
movups xmm0, xmmword [rsp]
movups xmmword [r11], xmm0
mov dword [rcx - 0x88], eax
mov dword [rcx], eax
lea rcx, [rcx + 4]
inc eax
cmp eax, 0x20
jb 0x1401c85b0
mov edi, 0x20
lea rbx, [r11 + 0x11c]
nop
mov edx, dword [r11]
lea rbx, [rbx - 4]
movzx r9d, word [r11 + 6]
imul r8d, dword [r11 + 0xc], 0x10dcd
movzx eax, dx
imul r10d, eax, 0x9069
movzx eax, word [r11 + 4]
imul ecx, eax, 0x4650
mov eax, dword [r11 + 8]
add r8d, 0x12d687
shl eax, 0x11
xor eax, dword [r11 + 8]
mov dword [r11 + 0xc], r8d
shr edx, 0x10
add r9d, ecx
add r10d, edx
mov dword [r11 + 4], r9d
mov dword [r11], r10d
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
shl r10d, 0x10
mov edx, ecx
shl edx, 5
xor edx, ecx
mov dword [r11 + 8], edx
lea eax, [r9 + r10]
mov ecx, dword [rbx - 0x84]
xor eax, r8d
add eax, edx
xor edx, edx
div edi
mov eax, dword [r11 + rdx*4 + 0x18]
lea rdx, [r11 + rdx*4]
mov dword [rbx - 0x84], eax
mov dword [rdx + 0x18], ecx
mov edx, dword [r11]
movzx r9d, word [r11 + 6]
imul r8d, dword [r11 + 0xc], 0x10dcd
movzx eax, dx
imul r10d, eax, 0x9069
movzx eax, word [r11 + 4]
imul ecx, eax, 0x4650
mov eax, dword [r11 + 8]
add r8d, 0x12d687
shr edx, 0x10
add r10d, edx
shl eax, 0x11
xor eax, dword [r11 + 8]
add r9d, ecx
mov dword [r11], r10d
mov ecx, eax
shl r10d, 0x10
shr ecx, 0xd
xor ecx, eax
mov dword [r11 + 4], r9d
mov edx, ecx
mov dword [r11 + 0xc], r8d
shl edx, 5
lea eax, [r9 + r10]
xor edx, ecx
xor eax, r8d
mov dword [r11 + 8], edx
add eax, edx
mov ecx, dword [rbx + 4]
xor edx, edx
div edi
dec edi
lea rdx, [r11 + rdx*4]
mov eax, dword [rdx + 0xa0]
mov dword [rbx + 4], eax
mov dword [rdx + 0xa0], ecx
cmp edi, 1
ja 0x1401c85d0
mov rax, r11
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x1401c8a00
Capabilities:
Encode data using xor
Hash data using fnv
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
mov eax, edx
lea r14, [rcx + 0x80]
xor eax, 0x811c9dc5
shr rdx, 0x20
imul r12d, eax, 0x1000193
xor ebx, ebx
mov r9, rcx
xor edx, r12d
imul r15d, edx, 0x1000193
xor r13d, r13d
nop dword [rax + rax]
mov eax, ebx
lea rdx, [r9 + 0x80]
xor eax, r15d
mov esi, 0x20
imul ecx, eax, 0x1000193
mov r10d, r12d
mov r11d, r15d
mov rbp, r13
mov eax, ecx
xor eax, ebx
imul edi, eax, 0x1000193
mov rax, r9
cmp r9, r14
cmova rsi, r13
cmp r9, rdx
ja 0x1401c8af4
nop dword [rax]
movzx edx, r10w
lea rax, [rax + 4]
imul r8d, edx, 0x9069
inc rbp
movzx edx, r11w
shr r11d, 0x10
shr r10d, 0x10
imul edi, edi, 0x10dcd
add r10d, r8d
imul r8d, edx, 0x4650
mov edx, ecx
shl edx, 0x11
xor ecx, edx
mov edx, ecx
add edi, 0x12d687
shr edx, 0xd
add r8d, r11d
xor ecx, edx
mov r11d, r8d
mov edx, ecx
shl edx, 5
xor ecx, edx
mov edx, r10d
shl edx, 0x10
add edx, r8d
xor edx, edi
add edx, ecx
mov dword [rax - 4], edx
cmp rbp, rsi
jne 0x1401c8a90
inc ebx
sub r9, 0xffffffffffffff80
sub r14, 0xffffffffffffff80
cmp ebx, 0x10
jb 0x1401c8a50
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401c9620
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x110
mov rax, qword [0x1402bdaf8]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rsi, r8
mov qword [rsp + 0x20], 0
mov rbx, rdx
lea r14, [rsp + 0x20]
mov rbp, rcx
xor edx, edx
mov r8d, 0xc8
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
cmp rsi, 0x88
jb 0x1401c9730
movabs rax, 0xf0f0f0f0f0f0f0f1
mul rsi
mov rdi, rdx
shr rdi, 7
nop dword [rax]
xor ecx, ecx
lea rax, [rbx + 0x80]
lea rdx, [rsp + 0x30]
cmp rdx, rax
ja 0x1401c96c0
lea rax, [rsp + 0xb0]
cmp rax, rbx
jae 0x1401c9700
movdqu xmm0, xmmword [rsp + rcx*8 + 0x30]
movdqu xmm1, xmmword [rbx]
pxor xmm1, xmm0
movdqu xmmword [rsp + rcx*8 + 0x30], xmm1
movdqu xmm0, xmmword [rsp + rcx*8 + 0x40]
movdqu xmm1, xmmword [rbx + 0x10]
add rbx, 0x20
pxor xmm1, xmm0
movdqu xmmword [rsp + rcx*8 + 0x40], xmm1
add rcx, 4
cmp rcx, 0x10
jb 0x1401c96c0
cmp rcx, 0x11
jae 0x1401c9715
nop dword [rax]
mov rax, qword [rbx]
add rbx, 8
xor qword [rsp + rcx*8 + 0x30], rax
inc rcx
cmp rcx, 0x11
jb 0x1401c9700
lea rcx, [rsp + 0x30]
call fcn.1401ca370
sub rsi, 0x88
sub rdi, 1
jne 0x1401c96a0
lea rdi, [rsp + 0x30]
cmp rsi, 8
jb 0x1401c9764
mov rcx, rsi
shr rcx, 3
imul rax, rcx, 0xfffffffffffffff8
add rsi, rax
nop dword [rax]
mov rax, qword [rbx]
add rbx, 8
xor qword [rdi], rax
add rdi, 8
sub rcx, 1
jne 0x1401c9750
test rsi, rsi
je 0x1401c9781
mov r8, rsi
lea rcx, [rsp + 0x20]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea r14, [rsp + 0x20]
add r14, rsi
mov byte [r14], 1
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x20]
xor qword [rdi], rax
movabs rax, 0x8000000000000000
xor qword [rsp + 0xb0], rax
call fcn.1401ca370
movaps xmm0, xmmword [rsp + 0x30]
mov rax, rbp
movaps xmm1, xmmword [rsp + 0x40]
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm1
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1401cf6b0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x1401c97f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x110
mov rax, qword [0x1402bdaf8]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rbx, rdx
mov qword [rsp + 0x20], 0
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0xc8
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, 4
nop word [rax + rax]
mov r8, qword [rbx]
lea rbx, [rbx + 8]
xor qword [rax], r8
lea rax, [rax + 8]
sub rdx, 1
jne 0x1401c9840
mov byte [rsp + 0x20], 1
mov rcx, qword [rsp + 0x20]
xor qword [rax], rcx
movabs rax, 0x8000000000000000
xor qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x30]
call fcn.1401ca370
movaps xmm0, xmmword [rsp + 0x30]
mov rax, rdi
movaps xmm1, xmmword [rsp + 0x40]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1401cf6b0
mov rbx, qword [rsp + 0x120]
add rsp, 0x110
pop rdi
ret
Function at 0x1401c98c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x110
mov rax, qword [0x1402bdaf8]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rsi, r8
mov qword [rsp + 0x20], 0
mov rbx, rdx
lea r14, [rsp + 0x20]
mov rbp, rcx
xor edx, edx
mov r8d, 0xc8
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
cmp rsi, 0x48
jb 0x1401c99cd
movabs rax, 0xe38e38e38e38e38f
mul rsi
mov rdi, rdx
shr rdi, 6
nop word [rax + rax]
xor ecx, ecx
lea rax, [rbx + 0x40]
lea rdx, [rsp + 0x30]
cmp rdx, rax
ja 0x1401c9960
lea rax, [rsp + 0x70]
cmp rax, rbx
jae 0x1401c99a0
nop word [rax + rax]
movdqu xmm0, xmmword [rsp + rcx*8 + 0x30]
movdqu xmm1, xmmword [rbx]
pxor xmm1, xmm0
movdqu xmmword [rsp + rcx*8 + 0x30], xmm1
movdqu xmm0, xmmword [rsp + rcx*8 + 0x40]
movdqu xmm1, xmmword [rbx + 0x10]
add rbx, 0x20
pxor xmm1, xmm0
movdqu xmmword [rsp + rcx*8 + 0x40], xmm1
add rcx, 4
cmp rcx, 8
jb 0x1401c9960
cmp rcx, 9
jae 0x1401c99b5
nop dword [rax]
mov rax, qword [rbx]
add rbx, 8
xor qword [rsp + rcx*8 + 0x30], rax
inc rcx
cmp rcx, 9
jb 0x1401c99a0
lea rcx, [rsp + 0x30]
call fcn.1401ca370
sub rsi, 0x48
sub rdi, 1
jne 0x1401c9940
lea rdi, [rsp + 0x30]
cmp rsi, 8
jb 0x1401c9a04
mov rcx, rsi
shr rcx, 3
imul rax, rcx, 0xfffffffffffffff8
add rsi, rax
nop word [rax + rax]
mov rax, qword [rbx]
add rbx, 8
xor qword [rdi], rax
add rdi, 8
sub rcx, 1
jne 0x1401c99f0
test rsi, rsi
je 0x1401c9a21
mov r8, rsi
lea rcx, [rsp + 0x20]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea r14, [rsp + 0x20]
add r14, rsi
mov byte [r14], 1
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x20]
xor qword [rdi], rax
movabs rax, 0x8000000000000000
xor qword [rsp + 0x70], rax
call fcn.1401ca370
movaps xmm0, xmmword [rsp + 0x30]
mov rax, rbp
movaps xmm1, xmmword [rsp + 0x40]
movups xmmword [rbp], xmm0
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rbp + 0x10], xmm1
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm1
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1401cf6b0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1401c9aa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x110
mov rax, qword [0x1402bdaf8]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rbx, rdx
mov qword [rsp + 0x20], 0
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0xc8
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, 8
nop word [rax + rax]
mov r8, qword [rbx]
lea rbx, [rbx + 8]
xor qword [rax], r8
lea rax, [rax + 8]
sub rdx, 1
jne 0x1401c9af0
mov byte [rsp + 0x20], 1
mov rcx, qword [rsp + 0x20]
xor qword [rax], rcx
movabs rax, 0x8000000000000000
xor qword [rsp + 0x70], rax
lea rcx, [rsp + 0x30]
call fcn.1401ca370
movaps xmm0, xmmword [rsp + 0x30]
mov rax, rdi
movaps xmm1, xmmword [rsp + 0x40]
movups xmmword [rdi], xmm0
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rdi + 0x10], xmm1
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm1
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1401cf6b0
mov rbx, qword [rsp + 0x120]
add rsp, 0x110
pop rdi
ret
Function at 0x1401cbde0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x1401cbf10
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov ecx, dword [0x1402bda28]
cmp ecx, 0xffffffff
jne 0x1401cbf38
xor esi, esi
jmp 0x1401cbf41
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov qword [rsp + 0x40], rsi
test rsi, rsi
je 0x1401cc033
nop
mov rbx, qword [rsi + 0x18]
cmp qword [rsi + 0x30], 0
jne 0x1401cbf66
test rbx, rbx
je 0x1401cc00c
jmp 0x1401cbf70
test rbx, rbx
je 0x1401cbfc4
nop dword [rax + rax]
mov rax, qword [rbx + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401cbfa7
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rbx]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0x18]
test rbx, rbx
jne 0x1401cbf70
cmp qword [rsi + 0x30], 0
je 0x1401cbf50
nop dword [rax + rax]
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1401cbfef
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x1401cbfef
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov r8, rbx
lea rdx, [rsp + 0x48]
lea rcx, [rsi + 0x28]
call fcn.1401cb110
cmp qword [rsi + 0x30], 0
jne 0x1401cbfd0
jmp 0x1401cbf50
lea rdx, [0x1401caf80]
lea rcx, [0x1402c7ea0]
call fcn.1401cad50
mov ecx, dword [0x1402bda28]
cmp ecx, 0xffffffff
je 0x1401cc033
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test rsi, rsi
je 0x1401cc063
or eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x1401cc063
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1401cbf10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x1401cbf10
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov ecx, dword [0x1402bda28]
cmp ecx, 0xffffffff
jne 0x1401cbf38
xor esi, esi
jmp 0x1401cbf41
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov qword [rsp + 0x40], rsi
test rsi, rsi
je 0x1401cc033
nop
mov rbx, qword [rsi + 0x18]
cmp qword [rsi + 0x30], 0
jne 0x1401cbf66
test rbx, rbx
je 0x1401cc00c
jmp 0x1401cbf70
test rbx, rbx
je 0x1401cbfc4
nop dword [rax + rax]
mov rax, qword [rbx + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401cbfa7
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rbx]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0x18]
test rbx, rbx
jne 0x1401cbf70
cmp qword [rsi + 0x30], 0
je 0x1401cbf50
nop dword [rax + rax]
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1401cbfef
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x1401cbfef
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov r8, rbx
lea rdx, [rsp + 0x48]
lea rcx, [rsi + 0x28]
call fcn.1401cb110
cmp qword [rsi + 0x30], 0
jne 0x1401cbfd0
jmp 0x1401cbf50
lea rdx, [0x1401caf80]
lea rcx, [0x1402c7ea0]
call fcn.1401cad50
mov ecx, dword [0x1402bda28]
cmp ecx, 0xffffffff
je 0x1401cc033
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test rsi, rsi
je 0x1401cc063
or eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x1401cc063
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret