joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140171130
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x14040f060]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x14016e6cd
lea rdx, str.Win32:_Failed_to_open_clipboard
mov ecx, 0x10008
call fcn.14016d120
xor eax, eax
add rsp, 0x28
ret
mov ecx, reloc.WS2_32.dll_listen
mov qword [rsp + 0x30], rbx
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
test rax, rax
jne 0x14016e708
lea rdx, str.Win32:_Failed_to_convert_clipboard_to_string
mov ecx, 0x10009
call fcn.14016d120
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
test rax, rax
jne 0x14016e746
lea rdx, str.Win32:_Failed_to_lock_global_handle
mov ecx, 0x10008
call fcn.14016d120
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdi, qword [rsp + 0x20]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
mov rcx, qword [0x14040f078]
call fcn.140294df4
mov rcx, rdi
call fcn.14016cf70
mov rcx, rbx
mov qword [0x14040f078], rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, qword [0x14040f078]
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
sub rsp, 0x28
cmp dword [0x14040ebb0], 0
jne 0x140171150
xor edx, edx
mov ecx, 0x10001
call fcn.14016dc60
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x14016e6a0
Function at 0x140171360
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor eax, eax
mov rsi, rcx
mov r8, rcx
mov dword [rsp + 0x28], eax
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
lea r9d, [rax - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
test eax, eax
je 0x14016ec6e
mov rdx, rdi
mov qword [rsp + 0x40], rbx
add rdx, rdx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
jne 0x14016ebd5
lea rdx, str.Win32:_Failed_to_allocate_global_handle_for_clipboard
mov ecx, 0x10008
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.14016d120
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
jne 0x14016ebec
lea rdx, str.Win32:_Failed_to_lock_global_handle
jmp 0x14016ec2c
mov dword [rsp + 0x28], edi
mov r9d, 0xffffffff
mov r8, rsi
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [0x14040f060]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x14016ec4f
lea rdx, str.Win32:_Failed_to_open_clipboard
mov ecx, 0x10008
call fcn.14016d120
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.KERNEL32.dll_GlobalFree]
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rbx
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [0x14040ebb0], 0
jne 0x140171375
xor edx, edx
mov ecx, 0x10001
jmp fcn.14016dc60
mov rcx, rdx
jmp 0x14016eb60
Function at 0x1401714a0
Capabilities:
Register raw input devices

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
cmp edx, 0x34003
jne 0x14016ed1d
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp qword [rbx + 0x340], rax
jne 0x14016ed46
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14016f8d0
cmp qword [0x14040fe20], rbx
jne 0x14016ed30
add rsp, 0x20
pop rbx
jmp fcn.14016fa50
call fcn.14016f830
test eax, eax
je 0x14016ed46
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14016fe80
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [0x14040ebb0], 0
mov edi, r8d
mov rbx, rcx
jne 0x1401714cf
xor edx, edx
mov ecx, 0x10001
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14016dc60
cmp edx, 0x33001
jne 0x140171522
lea eax, [r8 - 0x34001]
cmp eax, 2
jbe 0x1401714ef
lea rdx, str.Invalid_cursor_mode_0x_08X
jmp 0x140171610
cmp dword [rcx + 0x74], edi
je 0x14017161a
lea r8, [rcx + 0x1e8]
mov dword [rcx + 0x74], edi
lea rdx, [rcx + 0x1e0]
call fcn.14016e790
mov edx, edi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14016ecf0
cmp edx, 0x33002
jne 0x14017156f
xor edx, edx
test edi, edi
setne dl
cmp dword [rcx + 0x68], edx
je 0x14017161a
test edi, edi
jne 0x140171561
lea rax, [rcx + 0x80]
mov ecx, 0x15d
nop word [rax + rax]
cmp byte [rax], 3
jne 0x140171558
mov byte [rax], 0
inc rax
sub rcx, 1
jne 0x140171550
mov dword [rbx + 0x68], edx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp edx, 0x33003
jne 0x1401715e9
xor edx, edx
test edi, edi
setne dl
cmp dword [rcx + 0x6c], edx
je 0x14017161a
test edi, edi
jne 0x1401715db
cmp byte [rcx + 0x78], 3
jne 0x140171595
mov byte [rcx + 0x78], dil
cmp byte [rcx + 0x79], 3
jne 0x14017159f
mov byte [rcx + 0x79], 0
cmp byte [rcx + 0x7a], 3
jne 0x1401715a9
mov byte [rcx + 0x7a], 0
cmp byte [rcx + 0x7b], 3
jne 0x1401715b3
mov byte [rcx + 0x7b], 0
cmp byte [rcx + 0x7c], 3
jne 0x1401715bd
mov byte [rcx + 0x7c], 0
cmp byte [rcx + 0x7d], 3
jne 0x1401715c7
mov byte [rcx + 0x7d], 0
cmp byte [rcx + 0x7e], 3
jne 0x1401715d1
mov byte [rcx + 0x7e], 0
cmp byte [rcx + 0x7f], 3
jne 0x1401715db
mov byte [rcx + 0x7f], 0
mov dword [rcx + 0x6c], edx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp edx, 0x33004
jne 0x140171606
xor edx, edx
test edi, edi
setne dl
mov dword [rcx + 0x70], edx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov r8d, edx
lea rdx, str.Invalid_input_mode_0x_08X
mov ecx, 0x10003
call fcn.14016dc60
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140171720
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx + 4], eax
cmp eax, 0xffffffff
jne 0x140171750
lea rdx, str.Win32:_Failed_to_allocate_TLS_index
mov ecx, 0x10008
call fcn.14016d120
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov dword [rbx], 1
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x140174ed0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1403d66b0]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [0x14040ffc8], 0
lea rax, str.libOSMesa.dll
lea rcx, str.OSMesa.dll
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], 0
je 0x140174f25
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14027f960
add rsp, 0x48
ret
mov qword [rsp + 0x40], rbx
xor ebx, ebx
nop dword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14040ffc8], rax
test rax, rax
jne 0x140174f68
mov rax, qword [rsp + rbx*8 + 0x28]
inc rbx
test rax, rax
jne 0x140174f30
lea rdx, str.OSMesa:_Library_not_found
mov ecx, 0x10006
call fcn.14016dc60
jmp 0x14017508d
lea rdx, str.OSMesaCreateContextExt
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14040ffc8]
lea rdx, str.OSMesaCreateContextAttribs
mov qword [0x14040ffd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14040ffc8]
lea rdx, str.OSMesaDestroyContext
mov qword [0x14040ffd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14040ffc8]
lea rdx, str.OSMesaMakeCurrent
mov qword [0x14040ffe0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14040ffc8]
lea rdx, str.OSMesaGetColorBuffer
mov qword [0x14040ffe8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14040ffc8]
lea rdx, str.OSMesaGetDepthBuffer
mov qword [0x14040fff0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14040ffc8]
lea rdx, str.OSMesaGetProcAddress
mov qword [0x14040fff8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x14040ffd0], 0
mov qword [0x140410000], rax
je 0x14017505f
cmp qword [0x14040ffe0], 0
je 0x14017505f
cmp qword [0x14040ffe8], 0
je 0x14017505f
cmp qword [0x14040fff0], 0
je 0x14017505f
cmp qword [0x14040fff8], 0
je 0x14017505f
test rax, rax
je 0x14017505f
mov eax, 1
jmp 0x14017508f
lea rdx, str.OSMesa:_Failed_to_load_required_entry_points
mov ecx, 0x10008
call fcn.14016dc60
mov rcx, qword [0x14040ffc8]
test rcx, rcx
je 0x14017508d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14040ffc8], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14027f960
add rsp, 0x48
ret

Function at 0x140175590
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x1401755b7
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x1401755a0
movzx eax, r9b
ret
Function at 0x140184f70
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x30
call fcn.140280460
sub rsp, rax
mov rbx, rdx
mov rsi, rcx
call fcn.1401850c0
mov rdi, rax
test rax, rax
jne 0x140185049
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, [0x1403af3a0]
mov dword [rsp + 0x20], 0xaf
mov r8d, eax
lea edx, [rdi + 1]
lea ecx, [rdi + 2]
call fcn.140176d10
lea rax, [0x1403af3b8]
mov r8, rsi
mov qword [rsp + 0x28], rax
lea r9, [0x1403af3bc]
lea rdx, [0x1403af3c0]
mov qword [rsp + 0x20], rbx
lea ecx, [rdi + 5]
call fcn.1401761c0
call fcn.14028f26c
cmp dword [rax], 2
je 0x140185015
call fcn.14028f26c
cmp dword [rax], 6
je 0x140185015
mov dword [rsp + 0x20], 0xb8
lea r9, [0x1403af3e0]
lea r8d, [rdi + 2]
jmp 0x14018502a
mov dword [rsp + 0x20], 0xb6
lea r9, [0x1403af3c8]
mov r8d, 0x80
mov edx, WSASetLastError
lea ecx, [rdx - 0x4d]
call fcn.140176d10
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rcx, [0x1403af340]
call fcn.140178b70
mov rbx, rax
test rax, rax
jne 0x140185077
mov rcx, rdi
call fcn.14029b40c
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
xor edx, edx
mov rcx, rbx
call fcn.1401785e0
mov edx, 0x6a
mov r9, rdi
mov rcx, rbx
lea r8d, [rdx - 0x69]
call fcn.140178610
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140199380
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.140280460
sub rsp, rax
add rsp, 0x28
jmp 0x140199f90
push rbx
mov eax, 0x20
call fcn.140280460
sub rsp, rax
mov rbx, r8
call fcn.14019a1e0
test eax, eax
js 0x14019a1ce
mov eax, dword [rbx + 0xf0]
xor r10d, r10d
shl eax, 2
movsxd r9, eax
test eax, eax
jle 0x14019a01d
lea r8, [rbx + 8]
lea r8, [r8 + r9*4]
lea rax, [rbx + 8]
nop
mov edx, dword [rax - 8]
add r10, 4
mov ecx, dword [r8 - 8]
lea r8, [r8 - 0x10]
mov dword [rax - 8], ecx
lea rax, [rax + 0x10]
mov ecx, dword [r8 + 0xc]
sub r9, 4
mov dword [r8 + 8], edx
mov edx, dword [rax - 0x14]
mov dword [rax - 0x14], ecx
mov ecx, dword [r8 + 0x10]
mov dword [r8 + 0xc], edx
mov edx, dword [rax - 0x10]
mov dword [rax - 0x10], ecx
mov ecx, dword [r8 + 0x14]
mov dword [r8 + 0x10], edx
mov edx, dword [rax - 0xc]
mov dword [rax - 0xc], ecx
mov dword [r8 + 0x14], edx
cmp r10, r9
jl 0x140199fd0
mov r11d, 1
cmp dword [rbx + 0xf0], r11d
jle 0x14019a1cc
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 2]
lea rdi, [0x140000000]
mov r8d, dword [r10 + 0xe]
lea r10, [r10 + 0x10]
mov eax, r8d
inc r11d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x30d070]
movzx eax, byte [r10 - 1]
mov r9d, dword [rdi + rdx*4 + 0x30dc70]
movzx ecx, byte [rdi + rax*4 + 0x30d070]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0x30e470]
movzx ecx, byte [rdi + rax*4 + 0x30d070]
movzx eax, byte [r10]
xor r9d, dword [rdi + rcx*4 + 0x30e870]
movzx ecx, byte [rdi + rax*4 + 0x30d070]
movzx eax, byte [r10 + 3]
xor r9d, dword [rdi + rcx*4 + 0x30e070]
movzx edx, byte [rdi + rax*4 + 0x30d070]
movzx eax, byte [r10 + 4]
mov dword [r10 - 2], r9d
mov r9d, dword [r10 + 2]
mov r8d, dword [rdi + rdx*4 + 0x30e470]
movzx ecx, byte [rdi + rax*4 + 0x30d070]
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rdi + rcx*4 + 0x30e070]
movzx ecx, byte [rdi + rax*4 + 0x30d070]
movzx eax, r9b
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rcx*4 + 0x30dc70]
movzx ecx, byte [rdi + rax*4 + 0x30d070]
movzx eax, byte [r10 + 7]
xor r8d, dword [rdi + rcx*4 + 0x30e870]
movzx edx, byte [rdi + rax*4 + 0x30d070]
movzx eax, byte [r10 + 8]
mov dword [r10 + 2], r8d
mov r8d, dword [rdi + rdx*4 + 0x30e470]
movzx ecx, byte [rdi + rax*4 + 0x30d070]
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rdi + rcx*4 + 0x30e070]
movzx ecx, byte [rdi + rax*4 + 0x30d070]
movzx eax, r9b
mov r9d, dword [r10 + 0xa]
xor r8d, dword [rdi + rcx*4 + 0x30dc70]
movzx ecx, byte [rdi + rax*4 + 0x30d070]
movzx eax, byte [r10 + 0xb]
xor r8d, dword [rdi + rcx*4 + 0x30e870]
movzx edx, byte [rdi + rax*4 + 0x30d070]
movzx eax, byte [r10 + 0xc]
mov dword [r10 + 6], r8d
mov r8d, dword [rdi + rdx*4 + 0x30e470]
movzx ecx, byte [rdi + rax*4 + 0x30d070]
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rdi + rcx*4 + 0x30e070]
movzx ecx, byte [rdi + rax*4 + 0x30d070]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x30dc70]
movzx ecx, byte [rdi + rax*4 + 0x30d070]
xor r8d, dword [rdi + rcx*4 + 0x30e870]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x14019a040
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x14019aea0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x30
call fcn.140280460
sub rsp, rax
mov rdi, r8
mov r14, rdx
mov r8, qword [rsp + 0xa0]
mov r15, rcx
mov ebx, dword [r8]
mov dword [rsp + 0x80], ebx
test ebx, ebx
je 0x14019af18
mov rdx, qword [rsp + 0x98]
nop dword [rax]
test rdi, rdi
je 0x14019af11
mov eax, ebx
dec rdi
movzx ecx, byte [rax + rdx]
xor cl, byte [r15]
inc r15
mov byte [r14], cl
inc r14
inc ebx
and ebx, 0xf
jne 0x14019aef0
mov dword [rsp + 0x80], ebx
mov rcx, qword [rsp + 0x90]
mov esi, ntohl
movzx r13d, byte [rcx + 0xc]
lea r12, [rcx + 0xc]
mov r10, qword [rsp + 0xa8]
shl r13d, 8
movzx eax, byte [rcx + 0xd]
lea ebp, [rsi - 0xb]
or r13d, eax
movzx eax, byte [rcx + 0xe]
shl r13d, 8
or r13d, eax
movzx eax, byte [rcx + 0xf]
shl r13d, 8
or r13d, eax
cmp rdi, 0x10
jb 0x14019b03d
mov eax, 0x10000000
mov ebx, esi
nop dword [rax + rax]
mov rsi, rdi
shr rsi, 4
cmp rsi, rax
cmova rsi, rax
add r13d, esi
mov eax, r13d
cmp rax, rsi
jae 0x14019af8f
sub rsi, rax
xor r13d, r13d
mov qword [rsp + 0x20], rcx
mov r8, rsi
mov rcx, r15
mov rdx, r14
call r10
mov rcx, qword [rsp + 0x90]
mov eax, r13d
shr eax, 0x18
mov byte [r12], al
mov eax, r13d
shr eax, 0x10
mov byte [rcx + 0xd], al
mov eax, r13d
shr eax, 8
mov byte [rcx + 0xe], al
mov byte [rcx + 0xf], r13b
test r13d, r13d
jne 0x14019affd
mov r8d, ebx
mov ecx, ebp
mov rdx, r12
nop word [rax + rax]
movzx eax, byte [rdx - 1]
lea rdx, [rdx - 1]
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
add r8d, 0xffffffff
jne 0x14019afe0
mov rcx, qword [rsp + 0x90]
mov r9, qword [rsp + 0x88]
mov eax, 0x10000000
mov r10, qword [rsp + 0xa8]
shl rsi, 4
sub rdi, rsi
add r14, rsi
add r15, rsi
cmp rdi, 0x10
jae 0x14019af70
mov ebx, dword [rsp + 0x80]
mov esi, ntohl
mov r8, qword [rsp + 0xa0]
test rdi, rdi
je 0x14019b0f2
mov rax, qword [rsp + 0x98]
xor edx, edx
mov qword [rsp + 0x20], rcx
mov r8, rbp
mov rcx, rax
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov rdx, rax
call r10
mov rcx, qword [rsp + 0x90]
inc r13d
mov eax, r13d
shr eax, 0x18
mov byte [r12], al
mov eax, r13d
shr eax, 0x10
mov byte [rcx + 0xd], al
mov eax, r13d
shr eax, 8
mov byte [rcx + 0xe], al
mov byte [rcx + 0xf], r13b
test r13d, r13d
jne 0x14019b0b9
nop dword [rax + rax]
movzx eax, byte [r12 - 1]
lea r12, [r12 - 1]
add ebp, eax
mov byte [r12], bpl
shr ebp, 8
add esi, 0xffffffff
jne 0x14019b0a0
mov rdx, qword [rsp + 0x98]
nop dword [rax]
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r15]
xor al, byte [rcx + rdx]
mov byte [rcx + r14], al
sub rdi, 1
jne 0x14019b0d0
mov rax, qword [rsp + 0xa0]
mov dword [rax], ebx
jmp 0x14019b0f5
mov dword [r8], ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14019b7c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
mov eax, 0x20
call fcn.140280460
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov rbx, r8
mov r14, rdx
mov rsi, rcx
je 0x14019b7ff
mov eax, 0xfffffffe
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rcx, qword [rcx + 0x30]
movabs rax, 0x2000000000000000
add rcx, rbx
cmp rcx, rax
ja 0x14019b8d0
cmp rcx, rbx
jb 0x14019b8d0
mov qword [rsp + 0x38], rdi
mov edi, dword [rsi + 0x174]
mov qword [rsi + 0x30], rcx
test edi, edi
je 0x14019b864
test rbx, rbx
je 0x14019b853
movzx eax, byte [r14]
dec rbx
mov ecx, edi
inc r14
xor byte [rcx + rsi + 0x40], al
inc edi
and edi, 0xf
jne 0x14019b835
jmp 0x14019b857
test edi, edi
jne 0x14019b8b2
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call fcn.14019cc20
mov qword [rsp + 0x30], rbp
mov rbp, rbx
and rbp, 0xfffffffffffffff0
je 0x14019b88b
lea rdx, [rsi + 0x60]
mov r9, rbp
lea rcx, [rsi + 0x40]
mov r8, r14
call fcn.14019ca50
add r14, rbp
sub rbx, rbp
mov rbp, qword [rsp + 0x30]
test rbx, rbx
je 0x14019b8b2
mov edi, ebx
lea rcx, [rsi + 0x40]
sub r14, rsi
nop
movzx eax, byte [r14 + rcx - 0x40]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rbx, 1
jne 0x14019b8a0
mov dword [rsi + 0x174], edi
xor eax, eax
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rbx, qword [rsp + 0x40]
or eax, 0xffffffff
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14019ca50
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov rsi, rcx
lea r14, [r8 + 0xe]
sub rsi, r8
lea r13, [0x14030eda0]
mov r12, r9
mov rbp, rdx
mov r11, rcx
nop word [rax + rax]
movzx eax, byte [r11 + 0xf]
mov rdi, r14
movzx ecx, byte [r14 + 1]
mov r15d, reloc.WS2_32.dll_ntohs
xor rcx, rax
mov r9, rcx
and ecx, 0xf
add rcx, rcx
and r9, 0xfffffffffffffff0
mov r8, qword [rbp + rcx*8]
mov rcx, qword [rbp + rcx*8 + 8]
mov rax, r8
mov rdx, rcx
shr r8, 4
and edx, 0xf
shl rax, 0x3c
shr rcx, 4
or rax, rcx
mov rbx, qword [r13 + rdx*8]
xor rbx, r8
xor rbx, qword [r9 + rbp]
xor rax, qword [r9 + rbp + 8]
nop word [rax + rax]
movzx ecx, byte [rdi]
mov r9, rbx
movzx edx, byte [rsi + rdi]
lea rdi, [rdi - 1]
xor rdx, rcx
shr rbx, 4
mov rcx, rax
shl r9, 0x3c
shr rax, 4
and ecx, 0xf
or r9, rax
mov r10, rdx
and r10, 0xfffffffffffffff0
and edx, 0xf
add rdx, rdx
mov r8, qword [r13 + rcx*8]
xor r8, rbx
xor r9, qword [rbp + rdx*8 + 8]
xor r8, qword [rbp + rdx*8]
mov rcx, r9
and ecx, 0xf
shr r9, 4
mov rax, r8
shr r8, 4
shl rax, 0x3c
or rax, r9
mov rbx, qword [r13 + rcx*8]
xor rax, qword [r10 + rbp + 8]
xor rbx, r8
xor rbx, qword [r10 + rbp]
sub r15, 1
jne 0x14019caf0
mov rdx, rbx
mov byte [r11 + 7], bl
shr rdx, 0x20
add r14, 0x10
mov ecx, edx
mov byte [r11 + 3], dl
shr ecx, 0x18
sub rsi, 0x10
mov byte [r11], cl
mov ecx, edx
shr ecx, 0x10
mov byte [r11 + 1], cl
mov ecx, edx
shr ecx, 8
mov rdx, rax
mov byte [r11 + 2], cl
mov ecx, ebx
shr ecx, 0x18
mov byte [r11 + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [r11 + 5], cl
mov ecx, ebx
shr ecx, 8
mov byte [r11 + 6], cl
shr rdx, 0x20
mov ecx, edx
mov byte [r11 + 0xb], dl
shr ecx, 0x18
mov byte [r11 + 8], cl
mov ecx, edx
shr ecx, 0x10
mov byte [r11 + 9], cl
mov ecx, edx
shr ecx, 8
mov byte [r11 + 0xa], cl
mov ecx, eax
shr ecx, 0x18
mov byte [r11 + 0xc], cl
mov ecx, eax
shr ecx, 0x10
mov byte [r11 + 0xd], cl
mov ecx, eax
shr ecx, 8
mov byte [r11 + 0xe], cl
mov byte [r11 + 0xf], al
sub r12, 0x10
jne 0x14019ca90
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x14019cc20
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
movzx eax, byte [rcx + 0xf]
lea r14, [0x14030eda0]
mov r10d, eax
mov rdi, rdx
and eax, 0xf
and r10, 0xfffffffffffffff0
add rax, rax
mov esi, reloc.WS2_32.dll_ntohl
mov r9, qword [rdx + rax*8]
mov r8, qword [rdx + rax*8 + 8]
mov r11, r9
mov rax, r8
shr r9, 4
and eax, 0xf
shl r11, 0x3c
shr r8, 4
or r11, r8
mov rbx, qword [r14 + rax*8]
xor rbx, r9
xor rbx, qword [r10 + rdx]
xor r11, qword [r10 + rdx + 8]
nop word [rax + rax]
movzx edx, byte [rsi + rcx]
mov rax, r11
shr r11, 4
mov r9, rbx
shr rbx, 4
and eax, 0xf
shl r9, 0x3c
mov r10d, edx
or r9, r11
and r10, 0xfffffffffffffff0
and edx, 0xf
mov r8, qword [r14 + rax*8]
add rdx, rdx
xor r8, rbx
xor r9, qword [rdi + rdx*8 + 8]
xor r8, qword [rdi + rdx*8]
mov rax, r9
and eax, 0xf
shr r9, 4
mov r11, r8
shr r8, 4
shl r11, 0x3c
or r11, r9
mov rbx, qword [r14 + rax*8]
xor r11, qword [r10 + rdi + 8]
xor rbx, r8
xor rbx, qword [r10 + rdi]
sub rsi, 1
jns 0x14019cc90
mov rsi, qword [rsp + 0x10]
mov rdx, rbx
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
shr rdx, 0x20
mov eax, edx
mov byte [rcx + 3], dl
shr eax, 0x18
mov byte [rcx], al
mov eax, edx
shr eax, 0x10
mov byte [rcx + 1], al
mov eax, edx
shr eax, 8
mov rdx, r11
mov byte [rcx + 2], al
mov eax, ebx
shr eax, 0x18
mov byte [rcx + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [rcx + 5], al
mov eax, ebx
shr eax, 8
mov byte [rcx + 6], al
shr rdx, 0x20
mov eax, edx
mov byte [rcx + 7], bl
mov rbx, qword [rsp + 8]
shr eax, 0x18
mov byte [rcx + 8], al
mov eax, edx
shr eax, 0x10
mov byte [rcx + 9], al
mov eax, edx
shr eax, 8
mov byte [rcx + 0xa], al
mov eax, r11d
shr eax, 0x18
mov byte [rcx + 0xc], al
mov eax, r11d
shr eax, 0x10
mov byte [rcx + 0xd], al
mov eax, r11d
shr eax, 8
mov byte [rcx + 0xe], al
mov byte [rcx + 0xb], dl
mov byte [rcx + 0xf], r11b
ret

Function at 0x1401a0b50
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38
call fcn.140280460
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x1401a0b79
lea rax, [0x14019f120]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.14019aad0
lea rax, [0x14019e280]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.14019a800