joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a26d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [r8 + 4]
mov edi, r9d
mov r12, r8
mov r14, rdx
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rbx + 0x50c]
mov r13d, eax
cmp ecx, eax
jne 0x1400a286e
test byte [rbx + 0x726], 1
mov r9d, dword [rbx + 0x56c]
mov qword [rsp + 0x40], rbp
mov dword [rbx + 0x570], r9d
mov qword [rsp + 0x48], rsi
jne 0x1400a273b
mov dword [rbx + 0x56c], 2
jmp 0x1400a284a
test edi, edi
je 0x1400a274e
mov dword [rbx + 0x56c], 2
jmp 0x1400a284a
cmp byte [rbx + 0x735], 0
jne 0x1400a2840
movzx ecx, word [r12 + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx r11d, ax
sub r11, 8
shr r11, 1
test r11d, r11d
je 0x1400a27fc
xor edi, edi
movsxd rsi, r11d
test r11d, r11d
jle 0x1400a27b3
lea rbp, [r12 + 8]
nop word [rax + rax]
movzx ecx, word [rbp]
call qword [sym.imp.WS2_32.dll_ntohs]
cmp ax, word [rbx + 0x6e2]
jae 0x1400a27f0
inc rdi
mov word [rbp], ax
add rbp, 2
cmp rdi, rsi
jl 0x1400a2790
test rsi, rsi
jle 0x1400a2834
lea rcx, [r12 + 8]
nop dword [rax]
movzx eax, word [rcx]
lea rdx, [rax + rax*8]
mov rax, qword [rbx + 0x3c0]
cmp byte [rax + rdx*8 + 0x47], 2
jne 0x1400a27da
mov byte [rax + rdx*8 + 0x47], 3
add rcx, 2
sub rsi, 1
jne 0x1400a27c0
mov dword [rbx + 0x56c], 1
jmp 0x1400a284a
mov dword [rbx + 0x56c], 2
jmp 0x1400a284a
xor edi, edi
cmp di, word [rbx + 0x6e2]
jae 0x1400a2834
mov rcx, rdi
nop word [rax + rax]
mov rax, qword [rbx + 0x3c0]
cmp byte [rax + rcx + 0x47], 2
jne 0x1400a2823
mov byte [rax + rcx + 0x47], 3
movzx eax, word [rbx + 0x6e2]
inc edi
add rcx, 0x48
cmp edi, eax
jl 0x1400a2810
mov dword [rbx + 0x56c], 1
jmp 0x1400a284a
mov dword [rbx + 0x56c], 4
mov r8d, dword [rbx + 0x56c]
mov edx, r13d
mov rcx, r14
call fcn.1400b79d0
inc dword [rbx + 0x50c]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
jmp 0x1400a28a1
lea eax, [rcx - 1]
cmp eax, r13d
jne 0x1400a287f
mov r8d, dword [rbx + 0x56c]
jmp 0x1400a2896
lea eax, [rcx - 2]
cmp eax, r13d
jne 0x1400a2890
mov r8d, dword [rbx + 0x570]
jmp 0x1400a2896
mov r8d, 5
mov edx, r13d
mov rcx, r14
call fcn.1400b79d0
xor edx, edx
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
jmp fcn.1400b8260
Function at 0x1400a6af0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
mov ebx, r8d
sub r8d, r9d
mov r11, rdx
and r8d, 0xfffffff8
mov r10d, ecx
lea rsi, [0x140000000]
sub ebx, r8d
sub ebx, r9d
test r9d, r9d
je 0x1400a6b44
mov r9d, r9d
nop dword [rax + rax]
movzx ecx, byte [r11]
mov eax, r10d
inc r11
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r10d, dword [rsi + rdx*4 + 0x290180]
xor r10d, eax
sub r9, 1
jne 0x1400a6b20
shr r8d, 3
test r8d, r8d
je 0x1400a6bf9
mov qword [rsp + 0x10], rdi
mov edi, r8d
nop dword [rax]
xor r10d, dword [r11]
add r11, 8
mov eax, r10d
mov r9d, r10d
shr eax, 0x10
mov r8d, eax
shr rax, 8
movzx edx, al
mov eax, r10d
mov r10d, dword [rsi + rdx*4 + 0x291180]
mov edx, dword [r11 - 4]
shr rax, 8
movzx ecx, al
movzx eax, r8b
xor r10d, dword [rsi + rcx*4 + 0x291980]
xor r10d, dword [rsi + rax*4 + 0x291580]
movzx eax, r9b
xor r10d, dword [rsi + rax*4 + 0x291d80]
mov eax, edx
shr eax, 0x10
mov r8d, eax
shr rax, 8
movzx ecx, al
movzx eax, dl
mov edx, dword [rsi + rcx*4 + 0x290180]
xor edx, dword [rsi + rax*4 + 0x290d80]
movzx eax, byte [r11 - 3]
xor edx, dword [rsi + rax*4 + 0x290980]
movzx eax, r8b
xor edx, dword [rsi + rax*4 + 0x290580]
xor r10d, edx
sub rdi, 1
jne 0x1400a6b60
mov rdi, qword [rsp + 0x10]
test ebx, ebx
je 0x1400a6c24
mov r8d, ebx
movzx ecx, byte [r11]
mov eax, r10d
inc r11
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r10d, dword [rsi + rdx*4 + 0x290180]
xor r10d, eax
sub r8, 1
jne 0x1400a6c00
mov eax, r10d
mov rbx, qword [rsp + 0x18]
pop rsi
ret

Function at 0x1400a6c30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, dword [rcx + 0x38]
or r10d, 0xffffffff
mov rsi, rcx
test edi, edi
jle 0x1400a6cdd
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
lea rbp, [0x140292180]
nop dword [rax]
mov eax, dword [rsi + 0x18]
mov r11, qword [rsi + 0x10]
mov ebx, edi
cmp eax, edi
cmovl ebx, eax
cmp ebx, 4
jae 0x1400a6ca6
test ebx, ebx
je 0x1400a6cca
mov r8d, ebx
nop word [rax + rax]
movzx eax, byte [r11]
mov ecx, r10d
inc r11
xor rcx, rax
mov eax, r10d
shr eax, 8
movzx edx, cl
mov r10d, dword [rbp + rdx*4]
xor r10d, eax
sub r8, 1
jne 0x1400a6c80
jmp 0x1400a6cca
test ebx, ebx
je 0x1400a6cca
mov eax, r11d
mov r9d, 4
mov r8d, ebx
and eax, 3
mov rdx, r11
mov ecx, r10d
sub r9d, eax
call fcn.1400a6af0
mov r10d, eax
mov rsi, qword [rsi]
sub edi, ebx
test edi, edi
jg 0x1400a6c60
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
not r10d
mov eax, r10d
add rsp, 0x20
pop rdi
ret
Function at 0x1400bb750
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp qword [0x1402e8030], 0
jne 0x1400bb7f3
lea rcx, [0x1402e7fc8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1402e7fa0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor r11d, r11d
lea rax, [0x1402e8038]
mov qword [rsp + 0x28], r11
lea r9, [0x1400bb590]
lea r8, [0x140078f60]
mov edx, 0x1000
xor ecx, ecx
mov qword [0x1402e8040], rax
mov qword [0x1402e8038], r11
mov dword [rsp + 0x20], r11d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1402e8030], rax
test rax, rax
jne 0x1400bb7e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400bb7e9
mov rax, qword [0x1402e8778]
test rax, rax
je 0x1400bb7f3
lea rcx, str.ERROR:_Creating_sctp_iterator_thread_failed._n
add rsp, 0x38
jmp rax
mov dword [0x1402e8764], 1
add rsp, 0x38
ret
Function at 0x1400bc750
Capabilities:
Encode data using xor

Disassembly:
mov byte [rcx], 0
movzx eax, word [r8]
mov r10, rcx
cmp eax, 2
je 0x1400bc7f3
cmp eax, 0x17
jne 0x1400bc7fd
mov byte [rcx + 1], 2
cmp rdx, 0x14
jb 0x1400bc7fd
cmp r9d, 0x1c
jl 0x1400bc7fd
movzx eax, word [r8 + 2]
mov rcx, qword [rsp + 0x28]
lea r9, [r8 + 8]
xor ax, word [rcx]
lea r8, [r9 + 2]
lea rdx, [r10 + 5]
mov word [r10 + 2], ax
mov r10d, 4
sub r9, rcx
nop dword [rax + rax]
movzx eax, byte [r9 + rcx]
add rdx, 4
add rcx, 4
xor al, byte [rcx - 4]
add r8, 4
mov byte [rdx - 5], al
movzx eax, byte [rcx - 3]
xor al, byte [r8 - 5]
mov byte [rdx - 4], al
movzx eax, byte [rcx - 2]
xor al, byte [r8 - 4]
mov byte [rdx - 3], al
movzx eax, byte [rcx - 1]
xor al, byte [r8 - 3]
sub r10, 1
mov byte [rdx - 2], al
jne 0x1400bc7b0
lea eax, [r10 + 0x14]
ret
mov byte [rcx + 1], 1
cmp rdx, 8
jae 0x1400bc801
or eax, 0xffffffff
ret
cmp r9d, 0x10
jl 0x1400bc7fd
movzx eax, word [r8 + 2]
mov rcx, qword [rsp + 0x28]
xor ax, word [rcx]
mov word [r10 + 2], ax
movzx eax, byte [rcx]
xor al, byte [r8 + 4]
mov byte [r10 + 4], al
movzx eax, byte [r8 + 5]
xor al, byte [rcx + 1]
mov byte [r10 + 5], al
movzx eax, byte [r8 + 6]
xor al, byte [rcx + 2]
mov byte [r10 + 6], al
movzx eax, byte [r8 + 7]
xor al, byte [rcx + 3]
mov byte [r10 + 7], al
mov eax, 8
ret

Function at 0x1400bd2b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
movzx r10d, byte [rcx + 1]
mov r11, r9
mov rbx, rcx
sub r10d, 1
je 0x1400bd367
cmp r10d, 1
je 0x1400bd2dc
mov r9, rdx
mov eax, r9d
mov rbx, qword [rsp + 8]
ret
mov r9d, reloc.WS2_32.dll_sendto
cmp rdx, r9
jb 0x1400bd372
mov eax, reloc.WS2_32.dll_socket
mov dword [r8 + 0x80], 0x1c
lea rdx, [rbx + 5]
mov word [r8], ax
movzx eax, word [rcx + 2]
lea rcx, [r8 + 8]
xor ax, word [r11]
lea r10d, [r9 - 0x10]
mov word [r8 + 2], ax
lea r8, [r11 + 2]
sub r11, rcx
nop
movzx eax, byte [r11 + rcx]
add rcx, 4
add rdx, 4
xor al, byte [rdx - 5]
add r8, 4
mov byte [rcx - 4], al
movzx eax, byte [r8 - 5]
xor al, byte [rdx - 4]
mov byte [rcx - 3], al
movzx eax, byte [rdx - 3]
xor al, byte [r8 - 4]
mov byte [rcx - 2], al
movzx eax, byte [rdx - 2]
xor al, byte [r8 - 3]
sub r10, 1
mov byte [rcx - 1], al
jne 0x1400bd320
mov eax, r9d
mov rbx, qword [rsp + 8]
ret
mov r9d, 8
cmp rdx, r9
jae 0x1400bd37b
or eax, 0xffffffff
mov rbx, qword [rsp + 8]
ret
mov dword [r8 + 0x80], reloc.WS2_32.dll_recv
mov eax, 2
mov word [r8], ax
movzx eax, word [rcx + 2]
xor ax, word [r11]
mov word [r8 + 2], ax
movzx eax, byte [rcx + 4]
xor al, byte [r11]
mov byte [r8 + 4], al
movzx ecx, byte [rcx + 5]
mov eax, r9d
xor cl, byte [r11 + 1]
mov byte [r8 + 5], cl
movzx ecx, byte [rbx + 6]
xor cl, byte [r11 + 2]
mov byte [r8 + 6], cl
movzx ecx, byte [rbx + 7]
mov rbx, qword [rsp + 8]
xor cl, byte [r11 + 3]
mov byte [r8 + 7], cl
ret
Function at 0x1400be990
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
cmp dword [0x1402e68a0], 0
mov r10, rdx
mov r11, rcx
lea rbx, [0x1402e68a0]
jne 0x1400be9e8
xor r8d, r8d
mov r9, rbx
mov eax, r8d
mov ecx, 8
nop dword [rax]
test al, 1
je 0x1400be9cd
shr eax, 1
xor eax, 0xedb88320
jmp 0x1400be9cf
shr eax, 1
sub rcx, 1
jne 0x1400be9c0
inc r8d
mov dword [r9], eax
add r9, 4
cmp r8d, 0x100
jb 0x1400be9b1
or r8d, 0xffffffff
test rdx, rdx
je 0x1400bea12
movzx eax, byte [r11]
movzx edx, r8b
mov ecx, r8d
xor rdx, rax
shr ecx, 8
inc r11
mov r8d, dword [rbx + rdx*4]
xor r8d, ecx
sub r10, 1
jne 0x1400be9f1
mov rbx, qword [rsp + 8]
not r8d
mov eax, r8d
ret

Function at 0x1400bf4d0
Capabilities:
Authenticate hmac
Encode data using xor
Hash data using sha1

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x1b0
mov rax, qword [0x1402e0068]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rdi, qword [rsp + 0x1e8]
mov rbx, r9
test rdx, rdx
je 0x1400bf6da
test rbx, rbx
je 0x1400bf6da
test rdi, rdi
je 0x1400bf6da
xor eax, eax
mov ecx, 0x40
mov qword [r11 - 0x138], rax
mov qword [r11 - 0x130], rax
mov qword [r11 - 0xb8], rax
mov qword [r11 - 0xb0], rax
mov qword [r11 - 0x128], rax
mov qword [r11 - 0x120], rax
mov qword [r11 - 0x118], rax
mov qword [r11 - 0x110], rax
mov qword [r11 - 0x108], rax
mov qword [r11 - 0x100], rax
mov qword [r11 - 0xa8], rax
mov qword [r11 - 0xa0], rax
mov qword [r11 - 0x98], rax
mov qword [r11 - 0x90], rax
mov qword [r11 - 0x88], rax
mov qword [r11 - 0x80], rax
mov rax, qword [rdx]
mov qword [r11 - 0x138], rax
mov rax, qword [rdx + 8]
mov qword [r11 - 0x130], rax
mov eax, dword [rdx + 0x10]
mov dword [rsp + 0x90], eax
mov rax, qword [rdx]
mov qword [r11 - 0xb8], rax
mov rax, qword [rdx + 8]
mov qword [r11 - 0xb0], rax
mov eax, dword [rdx + 0x10]
mov dword [rsp + 0x110], eax
xor eax, eax
nop dword [rax + rax]
xor byte [rsp + rax + 0x80], 0x36
xor byte [rsp + rax + 0x100], 0x5c
inc rax
sub rcx, 1
jne 0x1400bf5d0
lea r8d, [rcx + 0x60]
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.1401e6750
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
mov r8d, 0x40
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
mov dword [rsp + 0x30], 0xc3d2e1f0
call fcn.1400117c0
lea rcx, [rsp + 0x20]
mov r8d, 4
mov rdx, rbx
call fcn.1400117c0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x180]
call fcn.1400118f0
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x60]
call fcn.1401e6750
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x20]
mov r8d, 0x40
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
mov dword [rsp + 0x30], 0xc3d2e1f0
call fcn.1400117c0
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x20]
mov r8d, reloc.WS2_32.dll_sendto
call fcn.1400117c0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400118f0
mov eax, reloc.WS2_32.dll_sendto
jmp 0x1400bf6dc
xor eax, eax
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1401e6720
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x1b0
pop rdi
ret
Function at 0x1400bfa00
Capabilities:
Hash data using sha1

Disassembly:
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0xd0
mov rax, qword [0x1402e0068]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbp, qword [rsp + 0x120]
mov r14d, r9d
mov rsi, r8
mov rdi, rdx
movzx r13d, cx
test rdx, rdx
je 0x1400bfb19
test r8, r8
je 0x1400bfb19
test rbp, rbp
je 0x1400bfb19
cmp cx, 1
jne 0x1400bfb19
cmp dword [rdx], 0x40
jbe 0x1400bfaf2
xor edx, edx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x100], rbx
lea r8d, [rdx + 0x60]
call fcn.1401e6750
mov r8d, dword [rdi]
lea rdx, [rdi + 4]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x67452301
mov dword [rsp + 0x44], 0xefcdab89
mov dword [rsp + 0x48], 0x98badcfe
mov dword [rsp + 0x4c], 0x10325476
mov dword [rsp + 0x50], 0xc3d2e1f0
call fcn.1400117c0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xa0]
call fcn.1400118f0
mov rbx, qword [rsp + 0x100]
lea rcx, [rsp + 0xa0]
mov rax, qword [rcx]
mov dword [rdi], reloc.WS2_32.dll_sendto
mov qword [rdi + 4], rax
mov rax, qword [rcx + 8]
mov qword [rdi + 0xc], rax
mov eax, dword [rcx + 0x10]
mov dword [rdi + 0x14], eax
mov r8d, dword [rdi]
mov dword [rsp + 0x30], 0
lea rdx, [rdi + 4]
mov r9, rsi
movzx ecx, r13w
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], r14d
call fcn.1400bf700
jmp 0x1400bfb1b
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1401e6720
add rsp, 0xd0
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c6539
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test rcx, rcx
je 0x1400c675d
push r12
push r14
sub rsp, 0x58
mov rax, qword [0x1402e0068]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r12d, r8d
mov qword [rsp + 0x30], r15
mov r14, rdx
lea r15d, [r12 + r9]
lea rax, [r12 + 4]
cmp rax, r15
ja 0x1400c6743
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x38], r13
lea r13, [rsp + 0x20]
mov ebp, 4
mov ecx, r12d
mov rsi, rdx
test r12d, r12d
js 0x1400c6734
test rdx, rdx
je 0x1400c6734
nop
test ecx, ecx
jle 0x1400c65ba
mov eax, dword [rsi + 0x18]
cmp ecx, eax
jl 0x1400c65ba
mov rsi, qword [rsi]
sub ecx, eax
test rsi, rsi
jne 0x1400c65a0
jmp 0x1400c6734
test rsi, rsi
je 0x1400c6734
mov eax, dword [rsi + 0x18]
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x40], rdi
sub eax, ecx
cmp eax, ebp
jl 0x1400c65e8
movsxd rbx, ecx
add rbx, qword [rsi + 0x10]
je 0x1400c6727
jmp 0x1400c6630
test ebp, ebp
jle 0x1400c661d
mov eax, dword [rsi + 0x18]
movsxd rdx, ecx
mov edi, ebp
sub eax, ecx
mov rcx, r13
cmp eax, ebp
cmovl edi, eax
add rdx, qword [rsi + 0x10]
mov r8d, edi
mov ebx, edi
call fcn.1401e75a0
mov rsi, qword [rsi]
sub ebp, edi
add r13, rbx
xor ecx, ecx
test rsi, rsi
jne 0x1400c65e8
jmp 0x1400c6622
test rsi, rsi
jne 0x1400c662a
test ebp, ebp
jg 0x1400c6727
lea rbx, [rsp + 0x20]
nop
movzx ecx, word [rbx]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [rbx + 2]
movzx edi, ax
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
add ecx, 3
test ecx, 0xfffffffc
je 0x1400c670a
and ecx, 0xfffffffc
add r12d, ecx
mov eax, r12d
add rax, 4
cmp rax, r15
ja 0x1400c6727
mov ebp, 4
mov ecx, r12d
mov rsi, r14
lea r13, [rsp + 0x20]
test r12d, r12d
js 0x1400c6727
test ecx, ecx
jle 0x1400c66a1
mov eax, dword [rsi + 0x18]
cmp ecx, eax
jl 0x1400c66a1
mov rsi, qword [rsi]
sub ecx, eax
test rsi, rsi
jne 0x1400c6687
jmp 0x1400c6727
test rsi, rsi
je 0x1400c6727
mov eax, dword [rsi + 0x18]
sub eax, ecx
cmp eax, ebp
jl 0x1400c66c2
movsxd rbx, ecx
add rbx, qword [rsi + 0x10]
jne 0x1400c6630
jmp 0x1400c6727
test ebp, ebp
jle 0x1400c66f7
mov eax, dword [rsi + 0x18]
movsxd rdx, ecx
mov edi, ebp
sub eax, ecx
mov rcx, r13
cmp eax, ebp
cmovl edi, eax
add rdx, qword [rsi + 0x10]
mov r8d, edi
mov ebx, edi
call fcn.1401e75a0
mov rsi, qword [rsi]
sub ebp, edi
add r13, rbx
xor ecx, ecx
test rsi, rsi
jne 0x1400c66c2
jmp 0x1400c66fc
test rsi, rsi
jne 0x1400c6700
test ebp, ebp
jg 0x1400c6727
lea rbx, [rsp + 0x20]
jmp 0x1400c6630
mov r9, qword [0x1402e8778]
test r9, r9
je 0x1400c6727
lea rcx, str.process_initack_addrs:_bad_len___d__type_xh_n
movzx r8d, di
movzx edx, ax
call r9
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov r13, qword [rsp + 0x38]
mov r15, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401e6720
add rsp, 0x58
pop r14
pop r12
repz ret
Function at 0x1400d8df0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
test byte [rcx + 0x14], 4
mov eax, dword [rcx + 8]
lea r11d, [rax - 1]
je 0x1400d8e0a
add rsp, 0x28
jmp fcn.1400d8d40
test eax, eax
jne 0x1400d8e13
add rsp, 0x28
ret
mov rcx, qword [rcx]
movsxd rax, r11d
mov rcx, qword [rcx + rax*8]
call fcn.1400d8c60
shl r11d, 6
add eax, r11d
add rsp, 0x28
ret
Function at 0x1400d9300
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push r12
push r13
sub rsp, 0x50
mov r13d, dword [rcx + 8]
xor ebx, ebx
test byte [rcx + 0x14], 4
mov r12d, r8d
mov rbp, rdx
mov rsi, rcx
lea r11d, [r13 - 1]
je 0x1400d9335
call fcn.1400d8d40
jmp 0x1400d9354
test r13d, r13d
jne 0x1400d933e
mov eax, ebx
jmp 0x1400d9354
mov rcx, qword [rcx]
movsxd rax, r11d
mov rcx, qword [rcx + rax*8]
call fcn.1400d8c60
shl r11d, 6
add eax, r11d
add eax, 7
mov qword [rsp + 0x98], rdi
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp r12d, 0xffffffff
jne 0x1400d9376
mov r12d, eax
jmp 0x1400d94ac
cmp r12d, eax
jge 0x1400d94ac
mov rax, qword [rsi]
lea rcx, [rsp + 0x28]
mov qword [rcx], rax
mov rax, qword [rsi + 8]
mov qword [rcx + 8], rax
mov rax, qword [rsi + 0x10]
mov qword [rcx + 0x10], rax
movsxd rcx, dword [rsp + 0x30]
mov r13, qword [rsp + 0x28]
test ecx, ecx
jle 0x1400d93bf
lea rdx, [r13 + rcx*8]
nop dword [rax]
sub rdx, 8
cmp qword [rdx], rbx
jne 0x1400d93bf
dec ecx
test ecx, ecx
jg 0x1400d93b0
test byte [rsp + 0x3c], 4
lea edi, [rcx - 1]
je 0x1400d9475
mov qword [rsp + 0x48], r14
mov r14d, dword [rsp + 0x34]
mov qword [rsp + 0x40], r15
mov r15d, ebx
mov ecx, ebx
test r14d, r14d
jle 0x1400d9456
mov ebp, ebx
mov r12d, ebx
nop dword [rax + rax]
mov rcx, qword [r13]
mov eax, r15d
xor eax, edi
lea r11d, [rax - 1]
not eax
shr r11d, 0x1f
shr eax, 0x1f
and r11d, eax
neg r11d
call fcn.1400d8c60
mov ecx, ebp
and eax, r11d
mov edx, r11d
not ecx
not edx
inc r15d
or ebp, r11d
and edx, ecx
add r13, 8
and edx, 0x40
add r12d, edx
add r12d, eax
cmp r15d, r14d
jl 0x1400d93f0
mov rbp, qword [rsp + 0x88]
mov dword [rsp + 0x80], r12d
mov r12d, dword [rsp + 0x90]
mov ecx, dword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
not edi
lea eax, [rdi - 1]
not edi
shr eax, 0x1f
shr edi, 0x1f
and eax, edi
dec eax
and eax, ecx
jmp 0x1400d948f
test ecx, ecx
jne 0x1400d947d
mov eax, ebx
jmp 0x1400d948f
movsxd rcx, edi
mov rcx, qword [r13 + rcx*8]
call fcn.1400d8c60
shl edi, 6
add eax, edi
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp r12d, eax
jge 0x1400d94a8
or eax, 0xffffffff
jmp 0x1400d9536
mov r13d, dword [rsi + 8]
mov eax, dword [rsi + 0xc]
shl eax, 3
movsxd rcx, eax
test eax, eax
jne 0x1400d94c6
movsxd rdx, r12d
mov rcx, rbp
call fcn.14013ab40
jmp 0x1400d9533
lea eax, [r13*8]
movsxd r11, r12d
lea rdi, [rcx - 1]
add rbp, r11
movsxd r10, eax
test r12d, r12d
je 0x1400d9533
neg r10
nop word [rax + rax]
mov rdx, qword [rsi]
mov r8, rbx
movzx ecx, bl
shr r8, 3
mov rax, r10
and cl, 7
mov r9, qword [rdx + r8*8]
shr rax, 0x3f
shl cl, 3
neg al
shr r9, cl
dec rbp
and r9b, al
mov rax, rbx
inc r10
sub rax, rdi
mov byte [rbp], r9b
shr rax, 0x3f
add rbx, rax
sub r11, 1
jne 0x1400d94f0
mov eax, r12d
mov rdi, qword [rsp + 0x98]
add rsp, 0x50
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400dcea0
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r13
push r15
sub rsp, 0x60
mov esi, dword [rsp + 0xb0]
mov r15, rcx
mov edi, 1
mov ecx, esi
mov r13d, r9d
mov rbx, r8
shl edi, cl
cmp edx, dword [r15 + 0xc]
mov r11d, edx
jg 0x1400dcedb
mov rax, r15
jmp 0x1400dceeb
mov rcx, r15
call fcn.1400d9000
mov r11d, dword [rsp + 0x98]
test rax, rax
jne 0x1400dcefc
add rsp, 0x60
pop r15
pop r13
pop rdi
pop rsi
pop rbx
ret
cmp esi, 3
movsxd r11, r11d
mov qword [rsp + 0xa0], r11
jg 0x1400dcf76
xor r10d, r10d
test r11, r11
jle 0x1400dd130
movsxd rsi, edi
shl rsi, 3
nop
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400dcf5e
mov r8, rbx
nop dword [rax]
mov ecx, edx
inc edx
add r8, 8
xor ecx, r13d
lea eax, [rcx - 1]
not ecx
shr ecx, 0x1f
shr eax, 0x1f
and ecx, eax
mov rax, qword [r8 - 8]
neg ecx
and ecx, 1
neg rcx
and rcx, rax
or r9, rcx
cmp edx, edi
jl 0x1400dcf30
mov rax, qword [r15]
inc r10
add rbx, rsi
cmp r10, r11
mov qword [rax + r10*8 - 8], r9
jl 0x1400dcf20
jmp 0x1400dd130
lea ecx, [rsi - 2]
mov edx, r13d
mov r8d, 1
sar edx, cl
shl r8d, cl
mov qword [rsp + 0xa8], rbp
lea ecx, [rdx - 1]
lea eax, [r8 - 1]
mov qword [rsp + 0x50], r14
and r13d, eax
shr ecx, 0x1f
mov eax, edx
not eax
xor r14d, r14d
movsxd rbp, r8d
shr eax, 0x1f
mov qword [rsp + 0x20], r14
and eax, ecx
mov ecx, edx
neg eax
xor ecx, 1
and eax, 1
neg rax
mov qword [rsp + 0x30], rax
lea eax, [rcx - 1]
not ecx
shr ecx, 0x1f
shr eax, 0x1f
and eax, ecx
mov ecx, edx
xor edx, 3
xor ecx, 2
neg eax
and eax, 1
neg rax
mov qword [rsp + 0x38], rax
lea eax, [rcx - 1]
not ecx
shr ecx, 0x1f
shr eax, 0x1f
and eax, ecx
lea ecx, [rdx - 1]
not edx
shr ecx, 0x1f
neg eax
shr edx, 0x1f
and ecx, edx
and eax, 1
neg ecx
neg rax
and ecx, 1
mov qword [rsp + 0x40], rax
neg rcx
mov qword [rsp + 0x28], rcx
test r11, r11
jle 0x1400dd123
movsxd rax, edi
mov qword [rsp + 0x58], r12
shl rax, 3
mov qword [rsp + 0x48], rax
mov rax, r11
nop word [rax + rax]
xor r12d, r12d
xor r11d, r11d
xor r10d, r10d
test rbp, rbp
jle 0x1400dd0fb
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r9, rbp
lea rax, [rbp + rbp*2]
shl r9, 4
lea rdi, [rbx + rbp*8]
add r9, rbx
lea rsi, [rbx + rax*8]
nop word [rax + rax]
mov rax, qword [rsi]
mov r8d, r11d
inc r10
and rax, rcx
mov rcx, qword [r9]
mov rdx, qword [rdi]
and rcx, qword [rsp + 0x40]
xor r8d, r13d
and rdx, r14
or rcx, rax
mov rax, qword [rbx + r10*8 - 8]
inc r11d
or rdx, rcx
lea ecx, [r8 - 1]
and rax, r15
shr ecx, 0x1f
or rax, rdx
not r8d
shr r8d, 0x1f
add rsi, 8
add r9, 8
and ecx, r8d
add rdi, 8
neg ecx
and ecx, 1
neg rcx
and rcx, rax
or r12, rcx
cmp r10, rbp
mov rcx, qword [rsp + 0x28]
jl 0x1400dd080
mov r14, qword [rsp + 0x20]
mov r15, qword [rsp + 0x90]
mov rax, qword [rsp + 0xa0]
mov rcx, qword [r15]
add rbx, qword [rsp + 0x48]
inc r14
cmp r14, rax
mov qword [rcx + r14*8 - 8], r12
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x20], r14
jl 0x1400dd040
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0xa8]
mov r14, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x98]
mov eax, 1
mov dword [r15 + 8], ecx
add rsp, 0x60
pop r15
pop r13
pop rdi
pop rsi
pop rbx
ret