joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140175020
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140428078]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
cmp qword [rcx + 0x4f0], 0xffffffffffffffff
je 0x14017509e
mov ecx, 2
call fcn.140317644
mov rcx, rax
mov dword [rsp + 0x20], 0x5e
lea r9, str.C:UsersAdmin_vcpkg_buildtreeszeromq_src_v4.3.5_37c87b6b8c.clean_srcipc_connecter.cpp
lea r8, str._s__retired_fd
lea rdx, str.Assertion_failed:__s___s:_d__n
call fcn.140141c40
mov ecx, 2
call fcn.140317644
mov rcx, rax
call fcn.140317a9c
lea rcx, str._s__retired_fd
call fcn.1401429f0
xor r8d, r8d
mov edx, 1
mov ecx, edx
call fcn.1401532f0
mov qword [rdi + 0x4f0], rax
cmp rax, 0xffffffffffffffff
je 0x140175127
mov rcx, rax
call fcn.140153550
mov rcx, qword [rdi + 0x4e8]
mov rcx, qword [rcx + 0x48]
call fcn.140160920
mov ebx, eax
mov rcx, qword [rdi + 0x4e8]
mov rcx, qword [rcx + 0x48]
call fcn.1401468d0
mov rdx, rax
mov r8d, ebx
mov rcx, qword [rdi + 0x4f0]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x140175230
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea ecx, [rax - 0x2733]
cmp ecx, 1
jbe 0x140175220
call fcn.14030fe3c
mov rbx, rax
mov ecx, esi
call fcn.140142740
mov dword [rbx], eax
call fcn.14030fe3c
cmp dword [rax], 0x70
jne 0x140175258
mov rdx, qword [rdi + 0x4f0]
lea rcx, [rdi + 0x4d8]
call fcn.140171e40
mov qword [rdi + 0x4f8], rax
mov rdx, rax
lea rcx, [rdi + 0x4d8]
call fcn.140172040
lea rdx, [rdi + 0x500]
lea rcx, [rsp + 0x30]
call fcn.14015c0e0
mov rbx, rax
call fcn.140141ec0
mov r8d, eax
mov rdx, rbx
mov rcx, qword [rdi + 0x520]
call fcn.14014f2d0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1401751c7
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401751c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401752ce
call fcn.140308f48
movdqa xmm0, xmmword [0x1403433d0]
movdqa xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1401752a9
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140175216
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401752ce
call fcn.140308f48
jmp 0x1401752a9
call fcn.14030fe3c
mov dword [rax], reloc.WS2_32.dll_WSASetLastError
jmp 0x140175127
mov rdx, qword [rdi + 0x4f0]
lea rcx, [rdi + 0x4d8]
call fcn.140171e40
mov qword [rdi + 0x4f8], rax
lea rcx, [rdi + 0x4d8]
call fcn.140174d90
jmp 0x1401752a9
test byte [rdi + 0x15c], 4
je 0x14017528f
call fcn.14030fe3c
cmp dword [rax], 0x6b
jne 0x14017528f
mov rcx, qword [rdi + 0x520]
call fcn.14014fa70
test al, al
je 0x14017528f
cmp qword [rdi + 0x4f0], 0xffffffffffffffff
je 0x1401752a9
mov rcx, rdi
call fcn.140182150
jmp 0x1401752a9
cmp qword [rdi + 0x4f0], 0xffffffffffffffff
je 0x1401752a1
mov rcx, rdi
call fcn.140182150
mov rcx, rdi
call fcn.140182050
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140309780
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14030fcf0
int3
Function at 0x14017df30
Capabilities:
Send data
Send data on socket

Disassembly:
mov rcx, qword [rcx + 0x578]
jmp fcn.14016e1f0

Function at 0x140182d50
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x60
cmp qword [rdx + 0x18], 0xff
mov rdi, rdx
mov r14, rcx
jbe 0x140182dc5
mov ecx, 2
call fcn.140317644
mov rcx, rax
mov dword [rsp + 0x20], 0xd0
lea r9, str.C:UsersAdmin_vcpkg_buildtreeszeromq_src_v4.3.5_37c87b6b8c.clean_src_socks.cpp
lea r8, str.req_.hostname.size______UINT8_MAX
lea rdx, str.Assertion_failed:__s___s:_d__n
call fcn.140141c40
mov ecx, 2
call fcn.140317644
mov rcx, rax
call fcn.140317a9c
lea rcx, str.req_.hostname.size______UINT8_MAX
call fcn.1401429f0
lea rbx, [r14 + 0x10]
xorps xmm0, xmm0
mov byte [rbx], 5
lea rsi, [rdi + 8]
movzx eax, byte [rdi]
mov rcx, rsi
mov byte [rbx + 1], al
mov byte [rbx + 2], 0
cmp qword [rsi + 0x18], 0x10
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x80], 0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x30], 4
movups xmmword [rsp + 0x50], xmm0
jb 0x140182e0d
mov rcx, qword [rsi]
lea r9, [rsp + 0x80]
xor edx, edx
lea r8, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov rbp, qword [rsp + 0x80]
mov r15d, eax
test eax, eax
jne 0x140182e68
mov ecx, dword [rbp + 4]
cmp ecx, 2
jne 0x140182e4d
mov rax, qword [rbp + 0x20]
mov byte [rbx + 3], 1
mov eax, dword [rax + 4]
mov dword [rbx + 4], eax
add rbx, 8
jmp 0x140182e99
cmp ecx, 0x17
jne 0x140182e68
mov rax, qword [rbp + 0x20]
mov byte [rbx + 3], 4
movups xmm0, xmmword [rax + 8]
movups xmmword [rbx + 4], xmm0
add rbx, 0x14
jmp 0x140182e99
mov byte [rbx + 3], 3
movzx eax, byte [rdi + 0x18]
mov byte [rbx + 4], al
add rbx, 5
cmp qword [rsi + 0x18], 0x10
jb 0x140182e81
mov rsi, qword [rsi]
mov r8, qword [rdi + 0x18]
mov rdx, rsi
mov rcx, rbx
call fcn.14030a190
add rbx, qword [rdi + 0x18]
test r15d, r15d
jne 0x140182ea2
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
movzx eax, byte [rdi + 0x29]
lea r11, [rsp + 0x60]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov byte [rbx], al
inc rbx
movzx eax, byte [rdi + 0x28]
mov byte [rbx], al
sub rbx, r14
sub rbx, 0xf
mov qword [r14 + 8], 0
mov qword [r14], rbx
mov rbx, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140189f30
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x140189f58
mov qword [rdi], 0
mov rax, rdi
add rsp, 0x20
pop rdi
ret
cmp qword [rsp + 0x40], 0
jle 0x140189f48
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x38]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x140189f8c
inc ebx
cmp ebx, 3
ja 0x140189fc2
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140189f76
mov rbx, qword [rsp + 0x30]
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x38]
xorps xmm0, xmm0
mulsd xmm1, qword [0x140341fd0]
cvtsi2sd xmm0, qword [rsp + 0x40]
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov qword [rdi], rax
mov rax, rdi
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov qword [rdi], 0
add rsp, 0x20
pop rdi
ret

Function at 0x14018a0c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x140424240]
cmp ecx, 0xffffffff
jne 0x14018a0de
xor esi, esi
jmp 0x14018a0e7
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov qword [rsp + 0x30], rsi
test rsi, rsi
je 0x14018a1dd
mov rax, qword [rsi + 0x30]
nop dword [rax]
test rax, rax
jne 0x14018a116
cmp qword [rsi + 0x18], 0
je 0x14018a1b6
mov rbx, qword [rsi + 0x18]
jmp 0x14018a120
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x14018a178
nop
mov rax, qword [rbx + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x14018a157
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rbx]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0x18]
test rbx, rbx
jne 0x14018a120
mov rax, qword [rsi + 0x30]
test rax, rax
je 0x14018a105
nop dword [rax]
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14018a19c
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x14018a19c
call qword [rbx + 0x28]
mov rdx, rbx
lea rcx, [rsi + 0x28]
call fcn.1401891a0
cmp qword [rsi + 0x30], 0
jne 0x14018a180
xor eax, eax
jmp 0x14018a100
lea rdx, [0x1401894a0]
lea rcx, [0x14042c590]
call fcn.140189210
mov ecx, dword [0x140424240]
cmp ecx, 0xffffffff
je 0x14018a1dd
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test rsi, rsi
je 0x14018a20f
mov eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x14018a20f
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14018a220
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r9, qword [rcx]
lea r8, [0x14018a2b0]
mov rdi, rcx
xor edx, edx
xor ecx, ecx
lea rax, [r9 + 0x20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
call fcn.140318c80
mov rsi, rax
test rax, rax
jne 0x14018a264
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rdi]
mov qword [rsp + 0x40], rbx
lock inc dword [rax + 8]
mov rbx, qword [rdi]
mov rcx, qword [rbx + 0x10]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14018a287
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rsi
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rsp + 0x40]
mov al, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14019ea10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
push r12
push r15
mov eax, gethostbyaddr
call fcn.140309830
sub rsp, rax
mov rsi, qword [rsp + 0x88]
mov r10, r9
mov rdi, r8
mov r15, rdx
mov r12, rcx
mov ebx, dword [rsi]
test ebx, ebx
jns 0x14019ea55
mov dword [rsi], 0xffffffff
add rsp, 0x30
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x60], rbp
mov rbp, qword [rsp + 0x80]
test ebx, ebx
je 0x14019ea88
test rdi, rdi
je 0x14019ea88
mov eax, ebx
dec rdi
movzx ecx, byte [rax + rbp]
xor cl, byte [r12]
inc r12
mov byte [r15], cl
inc r15
inc ebx
and ebx, 0xf
jne 0x14019ea66
mov r9, qword [rsp + 0x90]
cmp rdi, 0x10
jb 0x14019eb59
mov qword [rsp + 0x28], r13
mov rsi, r15
mov r13, rdi
mov qword [rsp + 0x20], r14
shr r13, 4
mov r14, r12
imul rax, r13, 0xfffffffffffffff0
sub rsi, rbp
sub r14, rbp
add rdi, rax
mov rax, r13
shl rax, 4
add r15, rax
mov qword [rsp + 0x68], r15
add r12, rax
mov r15, qword [rsp + 0x78]
nop word [rax + rax]
mov r8, r15
mov rdx, rbp
mov rcx, rbp
call r9
cmp ebx, 0x10
jae 0x14019eb25
mov edx, reloc.WS2_32.dll_ntohs
mov eax, ebx
sub edx, ebx
add rax, rbp
shr edx, 3
inc edx
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r14 + rax]
xor rcx, qword [rax]
mov qword [rsi + rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x14019eb10
mov r9, qword [rsp + 0x90]
add rsi, 0x10
add r14, 0x10
xor ebx, ebx
sub r13, 1
jne 0x14019eae0
mov r15, qword [rsp + 0x68]
mov r10, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
test rdi, rdi
je 0x14019eb86
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r9
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r12]
xor al, byte [rcx + rbp]
mov byte [rcx + r15], al
sub rdi, 1
jne 0x14019eb70
mov dword [rsi], ebx
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14019f0f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push r14
mov eax, 0x20
call fcn.140309830
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov rbx, r8
mov r14, rdx
mov rbp, rcx
je 0x14019f120
mov eax, 0xfffffffe
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov rcx, qword [rcx + 0x30]
movabs rax, 0x2000000000000000
add rcx, rbx
cmp rcx, rax
ja 0x14019f212
cmp rcx, rbx
jb 0x14019f212
mov qword [rsp + 0x40], rsi
mov esi, dword [rbp + 0x17c]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
mov qword [rbp + 0x30], rcx
test esi, esi
je 0x14019f196
test rbx, rbx
je 0x14019f1f2
movzx eax, byte [r14]
dec rbx
mov ecx, esi
inc r14
xor byte [rcx + rbp + 0x40], al
inc esi
and esi, 0xf
jne 0x14019f160
lea r12, [rbp + 0x60]
lea rdi, [rbp + 0x40]
mov rdx, r12
mov rcx, rdi
call qword [rbp + 0x170]
jmp 0x14019f19e
lea r12, [rbp + 0x60]
lea rdi, [rbp + 0x40]
mov qword [rsp + 0x58], r15
mov r15, rbx
and r15, 0xfffffffffffffff0
je 0x14019f1c4
mov r9, r15
mov r8, r14
mov rdx, r12
mov rcx, rdi
call qword [rbp + 0x168]
add r14, r15
sub rbx, r15
mov r15, qword [rsp + 0x58]
test rbx, rbx
je 0x14019f1f2
mov esi, ebx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r14 + rdi - 0x40]
xor byte [rdi], al
lea rdi, [rdi + 1]
sub rbx, 1
jne 0x14019f1e0
mov rdi, qword [rsp + 0x48]
xor eax, eax
mov r12, qword [rsp + 0x50]
mov dword [rbp + 0x17c], esi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov eax, 0xffffffff
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
Function at 0x1401a0200
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r13
mov eax, 0x28
call fcn.140309830
sub rsp, rax
xor r13d, r13d
mov rdi, r8
mov qword [rcx + 0x30], r13
mov rsi, rdx
mov qword [rcx + 0x38], r13
mov rbx, rcx
mov qword [rcx + 0x178], r13
cmp r8, 0xc
jne 0x1401a0252
movsd xmm0, qword [rdx]
lea edi, [r8 - 0xb]
movsd qword [rcx], xmm0
mov eax, dword [rdx + 8]
mov dword [rcx + 8], eax
mov dword [rcx + 0xc], 0x1000000
jmp 0x1401a0390
mov qword [rsp + 0x50], rbp
mov rbp, rdi
mov qword [rsp + 0x58], r12
mov qword [rcx + 0x40], r13
mov qword [rsp + 0x60], r14
mov qword [rcx + 0x48], r13
cmp rdi, 0x10
jb 0x1401a0320
mov qword [rsp + 0x20], r15
mov r15, rdi
shr r15, 4
imul rax, r15, 0xfffffffffffffff0
add rdi, rax
nop dword [rax]
movzx eax, byte [rsi]
lea rdx, [rbx + 0x60]
xor byte [rbx + 0x40], al
lea rcx, [rbx + 0x40]
movzx eax, byte [rsi + 1]
xor byte [rbx + 0x41], al
movzx eax, byte [rsi + 2]
xor byte [rbx + 0x42], al
movzx eax, byte [rsi + 3]
xor byte [rbx + 0x43], al
movzx eax, byte [rsi + 4]
xor byte [rbx + 0x44], al
movzx eax, byte [rsi + 5]
xor byte [rbx + 0x45], al
movzx eax, byte [rsi + 6]
xor byte [rbx + 0x46], al
movzx eax, byte [rsi + 7]
xor byte [rbx + 0x47], al
movzx eax, byte [rsi + 8]
xor byte [rbx + 0x48], al
movzx eax, byte [rsi + 9]
xor byte [rbx + 0x49], al
movzx eax, byte [rsi + 0xa]
xor byte [rbx + 0x4a], al
movzx eax, byte [rsi + 0xb]
xor byte [rbx + 0x4b], al
movzx eax, byte [rsi + 0xc]
xor byte [rbx + 0x4c], al
movzx eax, byte [rsi + 0xd]
xor byte [rbx + 0x4d], al
movzx eax, byte [rsi + 0xe]
xor byte [rbx + 0x4e], al
movzx eax, byte [rsi + 0xf]
xor byte [rbx + 0x4f], al
call qword [rbx + 0x170]
add rsi, 0x10
sub r15, 1
jne 0x1401a0290
mov r15, qword [rsp + 0x20]
test rdi, rdi
je 0x1401a034f
lea rcx, [rbx + 0x40]
sub rsi, rbx
nop dword [rax]
movzx eax, byte [rsi + rcx - 0x40]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdi, 1
jne 0x1401a0330
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
call qword [rbx + 0x170]
shl rbp, 3
lea rdx, [rbx + 0x60]
bswap rbp
xor qword [rbx + 0x48], rbp
lea rcx, [rbx + 0x40]
call qword [rbx + 0x170]
mov rax, qword [rbx + 0x40]
mov edi, dword [rbx + 0x4c]
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov qword [rbx], rax
mov rax, qword [rbx + 0x48]
mov qword [rbx + 8], rax
bswap edi
nop dword [rax + rax]
mov qword [rbx + 0x40], r13
lea rdx, [rbx + 0x20]
mov qword [rbx + 0x48], r13
mov rcx, rbx
mov r8, qword [rbx + 0x188]
call qword [rbx + 0x180]
inc edi
bswap edi
mov dword [rbx + 0xc], edi
add rsp, 0x28
pop r13
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401a3f10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r11, rdx
movsxd rdi, r9d
lea rsi, [rcx - 1]
mov r10, r8
not rcx
shr rsi, 0x3f
shr rcx, 0x3f
and rsi, rcx
mov ecx, dword [rdx + 8]
xor ecx, dword [r8 + 8]
dec rsi
and ecx, esi
xor dword [rdx + 8], ecx
xor dword [r8 + 8], ecx
mov edx, dword [rdx + 0x10]
movq xmm4, rsi
xor edx, dword [r8 + 0x10]
and edx, esi
punpcklqdq xmm4, xmm4
xor dword [r11 + 0x10], edx
xor dword [r8 + 0x10], edx
mov ecx, dword [r11 + 0x14]
mov edx, ecx
mov eax, dword [r8 + 0x14]
xor rdx, rax
and edx, 4
and rdx, rsi
mov eax, edx
xor eax, ecx
xor ecx, ecx
mov dword [r11 + 0x14], eax
xor dword [r8 + 0x14], edx
mov edx, ecx
test r9d, r9d
jle 0x1401a402d
cmp edi, 2
jb 0x1401a402d
mov r9, qword [r8]
lea rax, [rdi - 1]
mov r8, qword [r11]
lea rbx, [rdi - 1]
lea rbx, [r9 + rbx*8]
lea rax, [r8 + rax*8]
cmp r9, rax
ja 0x1401a3fbc
cmp rbx, r8
jae 0x1401a402d
cmp r9, r10
ja 0x1401a3fc6
cmp rbx, r10
jae 0x1401a402d
cmp r9, r11
ja 0x1401a3fd0
cmp rbx, r11
jae 0x1401a402d
cmp r8, r10
ja 0x1401a3fda
cmp rax, r10
jae 0x1401a402d
cmp r8, r11
ja 0x1401a3fe4
cmp rax, r11
jae 0x1401a402d
mov eax, edi
and eax, 0xfffffffe
nop dword [rax]
movdqu xmm2, xmmword [rcx + r9]
add edx, 2
movdqu xmm1, xmmword [rcx + r8]
lea rcx, [rcx + 0x10]
movdqa xmm3, xmm2
pxor xmm3, xmm1
pand xmm3, xmm4
movdqa xmm0, xmm3
pxor xmm3, xmm2
pxor xmm0, xmm1
movdqu xmmword [rcx + r8 - 0x10], xmm0
movdqu xmmword [rcx + r9 - 0x10], xmm3
cmp edx, eax
jl 0x1401a3ff0
movsxd rax, edx
cmp rax, rdi
jge 0x1401a406d
nop word [rax + rax]
mov rcx, qword [r11]
mov rdx, qword [rcx + rax*8]
lea r8, [rcx + rax*8]
mov rcx, qword [r10]
mov r9, rdx
xor r9, qword [rcx + rax*8]
and r9, rsi
xor rdx, r9
mov qword [r8], rdx
mov rcx, qword [r10]
xor qword [rcx + rax*8], r9
inc rax
cmp rax, rdi
jl 0x1401a4040
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1401a48e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
test byte [rcx + 0x14], 4
mov rbx, rdx
mov r10, qword [rcx]
mov r11, qword [rdx]
je 0x1401a49c8
mov eax, dword [rdx + 8]
cmp dword [rcx + 8], eax
jne 0x1401a49c8
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov edi, r9d
test eax, eax
jle 0x1401a49be
sub r10, r11
nop word [rax + rax]
mov r8, qword [r10 + r11]
inc edi
mov rdx, qword [r11]
lea r11, [r11 + 8]
mov rcx, r8
shr rdx, 0x3f
sub r8, qword [r11 - 8]
shr r8, 0x3f
xor r8d, edx
shr rcx, 0x3f
xor edx, ecx
or r8d, edx
xor r8d, ecx
neg r8d
mov dword [rsp + 0x18], r8d
not r8d
mov dword [rsp + 0x10], r8d
mov eax, dword [rsp + 0x10]
and eax, r9d
mov r9d, dword [rsp + 0x18]
mov r8, qword [r11 - 8]
or r9d, eax
mov rdx, qword [r10 + r11 - 8]
mov rcx, r8
sub r8, qword [r10 + r11 - 8]
shr r8, 0x3f
shr rcx, 0x3f
shr rdx, 0x3f
xor r8d, edx
xor edx, ecx
or r8d, edx
xor r8d, ecx
neg r8d
mov dword [rsp + 0x18], r8d
not r8d
mov dword [rsp + 0x10], r8d
mov ecx, dword [rsp + 0x10]
and ecx, r9d
mov r9d, dword [rsp + 0x18]
and r9d, 1
or r9d, ecx
cmp edi, dword [rbx + 8]
jl 0x1401a4920
mov rdi, qword [rsp + 0x20]
mov eax, r9d
pop rbx
ret
mov edx, dword [rcx + 8]
mov eax, edx
sub eax, dword [rbx + 8]
jne 0x1401a49f8
lea eax, [rdx - 1]
movsxd rcx, eax
test eax, eax
js 0x1401a49f6
lea rax, [r11 + rcx*8]
sub r10, r11
mov rdx, qword [rax + r10]
cmp rdx, qword [rax]
jne 0x1401a49fa
sub rax, 8
sub rcx, 1
jns 0x1401a49e3
xor eax, eax
pop rbx
ret
mov eax, 0xffffffff
mov ecx, 1
cmova eax, ecx
pop rbx
ret

Function at 0x1401a6fd0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140309830
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1401a71c0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
push rdi
push r13
mov eax, gethostbyaddr
call fcn.140309830
sub rsp, rax
mov eax, dword [0x14042c6c4]
mov r13d, ecx
mov ebx, 1
cmp eax, 2
je 0x1401a723c
nop word [rax + rax]
xor eax, eax
lock cmpxchg dword [0x14042c6c4], ebx
je 0x1401a7216
cmp eax, ebx
je 0x1401a71f0
mov eax, dword [0x14042c6c4]
cmp eax, 2
je 0x1401a723c
xor eax, eax
add rsp, 0x30
pop r13
pop rdi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
lea r8, [0x1401a70e0]
xor edx, edx
xor ecx, ecx
mov dword [0x14042c6c0], eax
call fcn.1401b78d0
mov dword [0x14042c6c4], 2
mov r8d, 0x97
lea rdx, str.crypto_threads_win.c
lea ecx, [r8 - 0x3f]
call fcn.1401914f0
mov rdi, rax
test rax, rax
jne 0x1401a7263
add rsp, 0x30
pop r13
pop rdi
pop rbx
ret
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
call fcn.1401c5a20
mov qword [rdi + 0x30], rax
call fcn.1401c5640
mov qword [rdi + 0x40], rax
call fcn.1401c5640
mov qword [rdi + 0x50], rax
call fcn.1401c5a20
mov qword [rdi + 0x38], rax
call fcn.1401c5a20
cmp r13d, ebx
mov qword [rdi + 0x48], rax
mov r8d, 0x85
lea rdx, str.crypto_threads_win.c
cmovge ebx, r13d
inc ebx
movsxd rbx, ebx
lea rcx, [rbx*8]
call fcn.1401914f0
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x10], rax
test rax, rax
je 0x1401a72ff
cmp qword [rdi + 0x40], 0
je 0x1401a72ff
cmp qword [rdi + 0x50], 0
je 0x1401a72ff
cmp qword [rdi + 0x30], 0
je 0x1401a72ff
cmp qword [rdi + 0x38], 0
je 0x1401a72ff
cmp qword [rdi + 0x48], 0
jne 0x1401a7358
mov r8d, 0xa8
lea rdx, str.crypto_threads_win.c
mov rcx, rax
call fcn.140191260
lea rcx, [rdi + 0x40]
call fcn.1401c55a0
lea rcx, [rdi + 0x50]
call fcn.1401c55a0
lea rcx, [rdi + 0x38]
call fcn.1401c59b0
lea rcx, [rdi + 0x48]
call fcn.1401c59b0
lea rcx, [rdi + 0x30]
call fcn.1401c59b0
mov r8d, 0xae
lea rdx, str.crypto_threads_win.c
mov rcx, rdi
call fcn.140191260
xor edi, edi
mov r15, qword [rsp + 0x20]
mov rax, rdi
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop r13
pop rdi
pop rbx
ret
Function at 0x1401a7380
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
mov eax, 0x20
call fcn.140309830
sub rsp, rax
mov rbx, rcx
lea esi, [rax - 0x21]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x14042c6c0]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov r14, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14, r14
jne 0x1401a740e
mov r8d, 0xdd
lea rdx, str.crypto_threads_win.c
lea ecx, [r8 + 0x13]
call fcn.1401914f0
mov r14, rax
test rax, rax
jne 0x1401a73ff
mov r8d, 0xde
lea rdx, str.crypto_threads_win.c
lea rcx, str.assertion_failed:_data___NULL
call fcn.140191530
mov ecx, dword [0x14042c6c0]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
mov rax, r14
cmp qword [rax], 0
jne 0x1401a741f
cmp esi, 0xffffffff
cmove esi, ecx
cmp qword [rax + 0x10], rbx
je 0x1401a74ff
inc ecx
add rax, 0x18
cmp ecx, 0xa
jl 0x1401a7413
prefetchw byte [rbx + 0x24]
mov eax, dword [rbx + 0x24]
nop dword [rax + rax]
mov ecx, eax
lock cmpxchg dword [rbx + 0x24], ecx
jne 0x1401a7440
mov rdx, qword [rbx + 0x10]
mov ecx, 1
mov r8d, eax
lea r9, [r8*8]
lock xadd qword [rdx + r9], rcx
prefetchw byte [rbx + 0x24]
mov eax, dword [rbx + 0x24]
nop word [rax + rax]
mov ecx, eax
lock cmpxchg dword [rbx + 0x24], ecx
jne 0x1401a7470
cmp r8d, eax
je 0x1401a74de
nop
mov rcx, qword [rbx + 0x10]
mov rax, 0xffffffffffffffff
lock xadd qword [rcx + r9], rax
prefetchw byte [rbx + 0x24]
mov eax, dword [rbx + 0x24]
nop dword [rax + rax]
mov ecx, eax
lock cmpxchg dword [rbx + 0x24], ecx
jne 0x1401a74a0
mov rcx, qword [rbx + 0x10]
mov r8d, eax
mov eax, 1
lea r9, [r8*8]
lock xadd qword [rcx + r9], rax
prefetchw byte [rbx + 0x24]
mov eax, dword [rbx + 0x24]
nop word [rax + rax]
mov ecx, eax
lock cmpxchg dword [rbx + 0x24], ecx
jne 0x1401a74d0
cmp r8d, eax
jne 0x1401a7480
movsxd rax, esi
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x10]
lea rdx, [r14 + rcx*8]
mov dword [rdx + 8], 1
mov qword [rdx + 0x10], rbx
lea rcx, [rax + r8*8]
mov qword [rdx], rcx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret