joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140105be0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rdi, rdx
mov rax, qword [rcx + 0x30]
mov rbx, qword [rax + 0x40]
mov rax, qword [rcx + 0x18]
mov r8, qword [rax + 0x18]
call r8
lea r8, [rbp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x40]
call rbx
nop
mov rcx, qword [rsp + 0x58]
mov qword [rbp - 0x70], rcx
mov rax, qword [rsp + 0x68]
mov qword [rbp - 0x60], rax
lea rax, fcn.1400af360
mov qword [rsp + 0x58], rax
lea rax, [0x140302eb8]
mov qword [rsp + 0x68], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x78]
call rax
mov qword [rsp + 0x60], 0
mov rax, qword [rsp + 0x70]
mov qword [rbp - 0x58], rax
lea rax, [0x140302ee0]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax]
lea rax, [fcn.1400af360]
cmp rdx, rax
je 0x140105c92
lea rcx, [rsp + 0x40]
call rdx
nop
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x140105cc1
lea rcx, [0x140105ff0]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x78]
call rax
jmp 0x140105d84
mov rsi, qword [rcx + 0x10]
mov rdx, rdi
lea rcx, [rbp - 0x50]
call fcn.140103b00
movups xmm0, xmmword [rdi + 0x60]
movups xmmword [rbp + 0x10], xmm0
lea rax, [rbp - 0x50]
mov qword [rbp + 0x40], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov ecx, dword [0x1403386c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140105d01
mov rdx, qword [rax + 8]
jmp 0x140105d03
xor edx, edx
mov r8d, 0x80
call fcn.140106180
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov rdx, rax
mov ecx, 0x80
call fcn.1400accf0
mov rdi, rax
lea rdx, [rbp - 0x50]
lea rcx, [rax + 8]
call fcn.140103b00
movups xmm0, xmmword [rbp + 0x10]
movups xmmword [rdi + 0x68], xmm0
lea rax, [0x1401065f0]
mov qword [rdi], rax
mov qword [rbp + 0x58], rdi
lea rcx, [rbp - 0x10]
call fcn.1400c8cb0
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140105d67
call fcn.1400ad0f0
nop
lea rdx, [rbp + 0x58]
lea rcx, [rsp + 0x78]
call rsi
nop
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x140105d84
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov rax, qword [rbp - 0x70]
mov rdx, qword [rax]
lea rcx, [rsp + 0x78]
call rdx
nop
mov rbx, qword [rsp + 0x148]
add rsp, 0x120
pop rdi
pop rsi
pop rbp
ret
Function at 0x140105dc0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rdi, rcx
test rbx, rbx
je 0x140105df5
lea rcx, [rbx + 0x48]
call fcn.1400c8cb0
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140105ded
call fcn.1400ad0f0
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140105e42
mov ecx, dword [0x1403386c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140105e32
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140105e32
mov ecx, 4
mov eax, ecx
nop
cmp qword [rdx + rax*8], 0
je 0x140105e4d
inc ecx
inc rax
cmp rax, 6
jl 0x140105e20
mov rcx, rbx
call fcn.140239c64
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x80]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x1401073c0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1401073e7
add rcx, 0x48
call fcn.1400c8cb0
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140107433
mov ecx, dword [0x1403386c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140107423
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140107423
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14010743e
inc ecx
inc rax
cmp rax, 6
jl 0x140107411
mov rcx, rbx
call fcn.140239c64
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x88]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x140107470
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140107497
add rcx, 0x48
call fcn.1400c8cb0
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1401074e3
mov ecx, dword [0x1403386c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1401074d3
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1401074d3
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x1401074ee
inc ecx
inc rax
cmp rax, 6
jl 0x1401074c1
mov rcx, rbx
call fcn.140239c64
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x80]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret
Function at 0x1401079d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rdi, rdx
mov rax, qword [rcx + 0x30]
mov rbx, qword [rax + 0x40]
mov rax, qword [rcx + 0x18]
mov r8, qword [rax + 0x18]
call r8
lea r8, [rbp + 0x80]
mov rdx, rax
lea rcx, [rsp + 0x40]
call rbx
nop
mov rcx, qword [rsp + 0x58]
mov qword [rbp - 0x70], rcx
mov rax, qword [rsp + 0x68]
mov qword [rbp - 0x60], rax
lea rax, fcn.1400af360
mov qword [rsp + 0x58], rax
lea rax, [0x140302eb8]
mov qword [rsp + 0x68], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x78]
call rax
mov qword [rsp + 0x60], 0
mov rax, qword [rsp + 0x70]
mov qword [rbp - 0x58], rax
lea rax, [0x140302ee0]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax]
lea rax, [fcn.1400af360]
cmp rdx, rax
je 0x140107a85
lea rcx, [rsp + 0x40]
call rdx
nop
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x140107ab4
lea rcx, [0x140109060]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x78]
call rax
jmp 0x140107b94
mov rsi, qword [rcx + 0x10]
mov rdx, rdi
lea rcx, [rbp - 0x50]
call fcn.140107270
movups xmm0, xmmword [rdi + 0x90]
movups xmmword [rbp + 0x40], xmm0
mov rax, qword [rdi + 0xa0]
mov qword [rbp + 0x50], rax
lea rax, [rbp - 0x50]
mov qword [rbp + 0x80], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
mov ecx, dword [0x1403386c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140107b08
mov rdx, qword [rax + 8]
jmp 0x140107b0a
xor edx, edx
mov r8d, 0xb8
call fcn.140106180
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov rdx, rax
mov ecx, 0xb8
call fcn.1400accf0
mov rdi, rax
lea rdx, [rbp - 0x50]
lea rcx, [rax + 8]
call fcn.140107270
movups xmm0, xmmword [rbp + 0x40]
movups xmmword [rdi + 0x98], xmm0
mov rcx, qword [rbp + 0x50]
mov qword [rdi + 0xa8], rcx
lea rax, [0x140109560]
mov qword [rdi], rax
mov qword [rbp + 0x98], rdi
lea rcx, [rbp + 0x20]
call fcn.1400c8cb0
nop
lea rdx, [rbp + 0x98]
lea rcx, [rsp + 0x78]
call rsi
nop
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140107b94
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov rax, qword [rbp - 0x70]
mov rdx, qword [rax]
lea rcx, [rsp + 0x78]
call rdx
nop
mov rbx, qword [rsp + 0x188]
add rsp, 0x160
pop rdi
pop rsi
pop rbp
ret
Function at 0x140108aa0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rdi, rdx
xor esi, esi
cmp qword [rcx + 0x20], rsi
jne 0x140108ad3
lea rdx, [r8 + 0xa0]
mov rcx, rdi
call fcn.140109e90
jmp 0x140108c2b
mov rax, qword [rcx + 0x30]
mov rbx, qword [rax + 0x40]
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax + 0x18]
call rdx
lea r8, [rbp + 0x90]
mov rdx, rax
lea rcx, [rsp + 0x20]
call rbx
nop
mov rcx, qword [rsp + 0x38]
mov qword [rbp - 0x78], rcx
mov rax, qword [rsp + 0x48]
mov qword [rbp - 0x68], rax
lea rax, fcn.1400af360
mov qword [rsp + 0x38], rax
lea rax, [0x140302eb8]
mov qword [rsp + 0x48], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x70]
call rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x50]
mov qword [rbp - 0x60], rax
lea rax, [0x140302ee0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
lea rax, [fcn.1400af360]
cmp rdx, rax
je 0x140108b67
lea rcx, [rsp + 0x20]
call rdx
nop
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x140108b96
lea rcx, [0x140109ab0]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdi
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x70]
call rax
jmp 0x140108c1c
mov rbx, qword [rcx + 0x10]
mov rdx, rdi
lea rcx, [rbp - 0x58]
call fcn.140109940
mov rdi, rax
mov ecx, dword [0x1403386c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140108bbe
mov rsi, qword [rax + 8]
mov r8d, 0xd0
mov rdx, rsi
call fcn.140106180
mov rdx, rax
mov ecx, 0xd0
call fcn.1400accf0
mov r8, rax
lea rcx, [rax + 8]
mov rdx, rdi
call fcn.140109940
lea rcx, [0x140109b10]
mov qword [r8], rcx
mov qword [rbp + 0xa8], r8
lea rdx, [rbp + 0xa8]
lea rcx, [rsp + 0x70]
call rbx
nop
mov rcx, qword [rbp + 0xa8]
test rcx, rcx
je 0x140108c1c
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov rax, qword [rbp - 0x78]
mov rdx, qword [rax]
lea rcx, [rsp + 0x70]
call rdx
nop
mov rbx, qword [rsp + 0x198]
add rsp, 0x170
pop rdi
pop rsi
pop rbp
ret
Function at 0x140108c40
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rdi, rdx
xor esi, esi
cmp qword [rcx + 0x20], rsi
jne 0x140108c73
lea rdx, [r8 + 0xa0]
mov rcx, rdi
call fcn.140109ed0
jmp 0x140108dcb
mov rax, qword [rcx + 0x30]
mov rbx, qword [rax + 0x40]
mov rax, qword [rcx + 0x18]
mov rdx, qword [rax + 0x18]
call rdx
lea r8, [rbp + 0x90]
mov rdx, rax
lea rcx, [rsp + 0x20]
call rbx
nop
mov rcx, qword [rsp + 0x38]
mov qword [rbp - 0x78], rcx
mov rax, qword [rsp + 0x48]
mov qword [rbp - 0x68], rax
lea rax, fcn.1400af360
mov qword [rsp + 0x38], rax
lea rax, [0x140302eb8]
mov qword [rsp + 0x48], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x70]
call rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x50]
mov qword [rbp - 0x60], rax
lea rax, [0x140302ee0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
lea rax, [fcn.1400af360]
cmp rdx, rax
je 0x140108d07
lea rcx, [rsp + 0x20]
call rdx
nop
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x140108d36
lea rcx, [0x140109ae0]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdi
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x70]
call rax
jmp 0x140108dbc
mov rbx, qword [rcx + 0x10]
mov rdx, rdi
lea rcx, [rbp - 0x58]
call fcn.140109940
mov rdi, rax
mov ecx, dword [0x1403386c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140108d5e
mov rsi, qword [rax + 8]
mov r8d, 0xd0
mov rdx, rsi
call fcn.140106180
mov rdx, rax
mov ecx, 0xd0
call fcn.1400accf0
mov r8, rax
lea rcx, [rax + 8]
mov rdx, rdi
call fcn.140109940
lea rcx, [0x140109cd0]
mov qword [r8], rcx
mov qword [rbp + 0xa8], r8
lea rdx, [rbp + 0xa8]
lea rcx, [rsp + 0x70]
call rbx
nop
mov rcx, qword [rbp + 0xa8]
test rcx, rcx
je 0x140108dbc
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov rax, qword [rbp - 0x78]
mov rdx, qword [rax]
lea rcx, [rsp + 0x70]
call rdx
nop
mov rbx, qword [rsp + 0x198]
add rsp, 0x170
pop rdi
pop rsi
pop rbp
ret

Function at 0x140108f50
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140108f77
add rcx, 0x78
call fcn.1400c8cb0
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140108fc3
mov ecx, dword [0x1403386c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140108fb3
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140108fb3
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x140108fce
inc ecx
inc rax
cmp rax, 6
jl 0x140108fa1
mov rcx, rbx
call fcn.140239c64
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0xb8]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x14010b4b0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov rax, qword [rsp + 0x28]
add rsp, 0x10
syscall
sub rsp, 0x10
ret
Function at 0x1401183e0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140239ef0
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1401259e0
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x140125a07
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x1401259f0
movzx eax, r9b
ret

Function at 0x140126290
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x28
call fcn.140239ef0
sub rsp, rax
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x28
jmp fcn.140126650

Function at 0x14012a850
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140239ef0
sub rsp, rax
lea rcx, [0x14032dd40]
add rsp, 0x28
jmp fcn.140118240
Function at 0x14017e480
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x30
call fcn.140239ef0
sub rsp, rax
mov r10, r9
mov rbx, r8
mov r9, qword [rsp + 0xa0]
mov r14, rdx
mov rbp, rcx
mov edi, dword [r9]
mov dword [rsp + 0x80], edi
test edi, edi
je 0x14017e4f8
mov rdx, qword [rsp + 0x98]
nop dword [rax]
test rbx, rbx
je 0x14017e4f1
mov eax, edi
dec rbx
movzx ecx, byte [rax + rdx]
xor cl, byte [rbp]
inc rbp
mov byte [r14], cl
inc r14
inc edi
and edi, 0xf
jne 0x14017e4d0
mov dword [rsp + 0x80], edi
mov r8, qword [rsp + 0x90]
mov esi, 1
movzx r12d, byte [r8 + 0xc]
lea r15, [r8 + 0xc]
mov r11, qword [rsp + 0xa8]
shl r12d, 8
movzx eax, byte [r8 + 0xd]
lea r13d, [rsi + 0xb]
or r12d, eax
movzx eax, byte [r8 + 0xe]
shl r12d, 8
or r12d, eax
movzx eax, byte [r8 + 0xf]
shl r12d, 8
or r12d, eax
cmp rbx, 0x10
jb 0x14017e62e
mov eax, 0x10000000
mov edi, r13d
mov qword [rsp + 0x20], r8
mov rdx, rbx
shr rdx, 4
mov r9, r10
cmp rdx, rax
cmova rdx, rax
add r12d, edx
mov r13, rdx
mov eax, r12d
mov ecx, r12d
sub r13, rax
cmp rax, rdx
cmovae r13, rdx
xor r12d, r12d
cmp rax, rdx
mov r8, r13
mov rdx, r14
cmovae r12d, ecx
mov rcx, rbp
call r11
mov r8, qword [rsp + 0x90]
mov eax, r12d
shr eax, 0x18
mov byte [r15], al
mov eax, r12d
shr eax, 0x10
mov byte [r8 + 0xd], al
mov eax, r12d
shr eax, 8
mov byte [r8 + 0xe], al
mov byte [r8 + 0xf], r12b
test r12d, r12d
jne 0x14017e5ed
mov r8d, edi
mov eax, esi
mov rdx, r15
nop dword [rax + rax]
movzx ecx, byte [rdx - 1]
lea rdx, [rdx - 1]
add eax, ecx
mov byte [rdx], al
shr eax, 8
add r8d, 0xffffffff
jne 0x14017e5d0
mov r8, qword [rsp + 0x90]
mov r10, qword [rsp + 0x88]
mov eax, 0x10000000
mov r11, qword [rsp + 0xa8]
shl r13, 4
sub rbx, r13
add r14, r13
add rbp, r13
cmp rbx, 0x10
jae 0x14017e550
mov edi, dword [rsp + 0x80]
mov r13d, ntohs
mov r9, qword [rsp + 0xa0]
test rbx, rbx
je 0x14017e6d1
mov rax, qword [rsp + 0x98]
xorps xmm0, xmm0
mov qword [rsp + 0x20], r8
mov r9, r10
mov r8, rsi
mov rdx, rax
mov rcx, rax
movups xmmword [rax], xmm0
call r11
mov rcx, qword [rsp + 0x90]
inc r12d
mov eax, r12d
shr eax, 0x18
mov byte [r15], al
mov eax, r12d
shr eax, 0x10
mov byte [rcx + 0xd], al
mov eax, r12d
shr eax, 8
mov byte [rcx + 0xe], al
mov byte [rcx + 0xf], r12b
test r12d, r12d
jne 0x14017e6a7
nop dword [rax + rax]
movzx eax, byte [r15 - 1]
lea r15, [r15 - 1]
add esi, eax
mov byte [r15], sil
shr esi, 8
add r13d, 0xffffffff
jne 0x14017e690
mov rdx, qword [rsp + 0x98]
nop
mov ecx, edi
inc edi
movzx eax, byte [rcx + rbp]
xor al, byte [rcx + rdx]
mov byte [rcx + r14], al
sub rbx, 1
jne 0x14017e6b0
mov rax, qword [rsp + 0xa0]
mov dword [rax], edi
jmp 0x14017e6d4
mov dword [r9], edi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14017ee60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push r14
mov eax, 0x20
call fcn.140239ef0
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov rbx, r8
mov r14, rdx
mov rbp, rcx
je 0x14017ee90
mov eax, 0xfffffffe
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov rcx, qword [rcx + 0x30]
movabs rax, 0x2000000000000000
add rcx, rbx
cmp rcx, rax
ja 0x14017ef82
cmp rcx, rbx
jb 0x14017ef82
mov qword [rsp + 0x40], rsi
mov esi, dword [rbp + 0x174]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
mov qword [rbp + 0x30], rcx
test esi, esi
je 0x14017ef05
test rbx, rbx
je 0x14017ef62
movzx eax, byte [r14]
dec rbx
mov ecx, esi
inc r14
xor byte [rcx + rbp + 0x40], al
inc esi
and esi, 0xf
jne 0x14017eed0
lea r12, [rbp + 0x60]
lea rdi, [rbp + 0x40]
mov rdx, r12
mov rcx, rdi
call fcn.140180540
jmp 0x14017ef0d
lea r12, [rbp + 0x60]
lea rdi, [rbp + 0x40]
mov qword [rsp + 0x58], r15
mov r15, rbx
and r15, 0xfffffffffffffff0
je 0x14017ef32
mov r9, r15
mov r8, r14
mov rdx, r12
mov rcx, rdi
call fcn.140180360
add r14, r15
sub rbx, r15
mov r15, qword [rsp + 0x58]
test rbx, rbx
je 0x14017ef62
mov esi, ebx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r14 + rdi - 0x40]
xor byte [rdi], al
lea rdi, [rdi + 1]
sub rbx, 1
jne 0x14017ef50
mov rdi, qword [rsp + 0x48]
xor eax, eax
mov r12, qword [rsp + 0x50]
mov dword [rbp + 0x174], esi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov eax, 0xffffffff
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
Function at 0x140180360
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
movzx eax, byte [rcx + 0xf]
lea r14, [r8 + 0xe]
mov rsi, rcx
lea r13, [0x1402ac210]
sub rsi, r8
mov r12, r9
mov rbp, rdx
mov rbx, rcx
nop word [rax + rax]
movzx edx, byte [r14 + 1]
mov rdi, r14
movzx ecx, al
mov r15d, reloc.WS2_32.dll_ntohs
xor rdx, rcx
mov r8, rdx
and edx, 0xf
add rdx, rdx
and r8, 0xfffffffffffffff0
mov r9, qword [rbp + rdx*8]
mov rax, qword [rbp + rdx*8 + 8]
mov rcx, r9
mov rdx, rax
shr rcx, 4
and edx, 0xf
shr rax, 4
shl r9, 0x3c
or rax, r9
mov r11, qword [r13 + rdx*8]
xor r11, rcx
xor r11, qword [r8 + rbp]
xor rax, qword [r8 + rbp + 8]
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rdi]
movzx edx, byte [rsi + rdi]
lea rdi, [rdi - 1]
xor rdx, rcx
mov rcx, r11
mov r9, rdx
shl r11, 0x3c
and edx, 0xf
shr rcx, 4
add rdx, rdx
and r9, 0xfffffffffffffff0
lea r8, [rdx*8]
mov rdx, rax
shr rax, 4
and edx, 0xf
or r11, rax
xor r11, qword [r8 + rbp + 8]
mov r10, qword [r13 + rdx*8]
mov rdx, r11
xor r10, rcx
shr rdx, 4
xor r10, qword [r8 + rbp]
mov rcx, r11
and ecx, 0xf
mov rax, r10
shr rax, 4
mov r11, qword [r13 + rcx*8]
xor r11, rax
mov rax, r10
xor r11, qword [r9 + rbp]
shl rax, 0x3c
or rax, rdx
xor rax, qword [r9 + rbp + 8]
sub r15, 1
jne 0x140180400
mov rdx, r11
mov byte [rbx + 7], r11b
shr rdx, 0x20
add r14, 0x10
mov ecx, edx
mov byte [rbx + 3], dl
shr ecx, 0x18
sub rsi, 0x10
mov byte [rbx], cl
mov ecx, edx
shr ecx, 0x10
mov byte [rbx + 1], cl
mov ecx, edx
shr ecx, 8
mov rdx, rax
mov byte [rbx + 2], cl
mov ecx, r11d
shr ecx, 0x18
mov byte [rbx + 4], cl
mov ecx, r11d
shr ecx, 0x10
mov byte [rbx + 5], cl
mov ecx, r11d
shr ecx, 8
mov byte [rbx + 6], cl
shr rdx, 0x20
mov ecx, edx
mov byte [rbx + 0xb], dl
shr ecx, 0x18
mov byte [rbx + 8], cl
mov ecx, edx
shr ecx, 0x10
mov byte [rbx + 9], cl
mov ecx, edx
shr ecx, 8
mov byte [rbx + 0xa], cl
mov ecx, eax
shr ecx, 0x18
mov byte [rbx + 0xc], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rbx + 0xd], cl
mov ecx, eax
shr ecx, 8
mov byte [rbx + 0xe], cl
mov byte [rbx + 0xf], al
sub r12, 0x10
jne 0x1401803a0
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x140180540
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
movzx eax, byte [rcx + 0xf]
lea r14, [0x1402ac210]
mov r8d, eax
mov rdi, rdx
and eax, 0xf
mov r11, rcx
add rax, rax
and r8, 0xfffffffffffffff0
mov esi, reloc.WS2_32.dll_ntohl
mov r9, qword [rdx + rax*8]
mov rax, qword [rdx + rax*8 + 8]
mov rcx, r9
mov rdx, rax
shr rcx, 4
and edx, 0xf
shr rax, 4
shl r9, 0x3c
or rax, r9
mov rbx, qword [r14 + rdx*8]
xor rbx, rcx
xor rbx, qword [r8 + rdi]
xor rax, qword [r8 + rdi + 8]
nop dword [rax + rax]
movzx ecx, byte [rsi + r11]
mov rdx, rax
shr rax, 4
mov r9d, ecx
and ecx, 0xf
and edx, 0xf
add rcx, rcx
and r9, 0xfffffffffffffff0
lea r8, [rdi + rcx*8]
mov rcx, rbx
shl rbx, 0x3c
mov r10, qword [r14 + rdx*8]
or rbx, rax
xor rbx, qword [r8 + 8]
shr rcx, 4
mov rdx, rbx
xor r10, rcx
shr rdx, 4
xor r10, qword [r8]
mov rcx, rbx
and ecx, 0xf
mov rax, r10
shr rax, 4
mov rbx, qword [r14 + rcx*8]
xor rbx, rax
mov rax, r10
xor rbx, qword [r9 + rdi]
shl rax, 0x3c
or rax, rdx
xor rax, qword [r9 + rdi + 8]
sub rsi, 1
jns 0x1401805b0
mov rsi, qword [rsp + 0x10]
mov rdx, rbx
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
shr rdx, 0x20
mov ecx, edx
mov byte [r11 + 3], dl
shr ecx, 0x18
mov byte [r11], cl
mov ecx, edx
shr ecx, 0x10
mov byte [r11 + 1], cl
mov ecx, edx
shr ecx, 8
mov rdx, rax
mov byte [r11 + 2], cl
mov ecx, ebx
shr ecx, 0x18
mov byte [r11 + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [r11 + 5], cl
mov ecx, ebx
shr ecx, 8
mov byte [r11 + 6], cl
shr rdx, 0x20
mov ecx, edx
mov byte [r11 + 7], bl
mov rbx, qword [rsp + 8]
shr ecx, 0x18
mov byte [r11 + 8], cl
mov ecx, edx
shr ecx, 0x10
mov byte [r11 + 9], cl
mov ecx, edx
shr ecx, 8
mov byte [r11 + 0xa], cl
mov ecx, eax
shr ecx, 0x18
mov byte [r11 + 0xc], cl
mov ecx, eax
shr ecx, 0x10
mov byte [r11 + 0xd], cl
mov ecx, eax
shr ecx, 8
mov byte [r11 + 0xe], cl
mov byte [r11 + 0xb], dl
mov byte [r11 + 0xf], al
ret