joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001218
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [rcx + 0x28]
add rcx, 0x48
call fcn.1400010e0
xor r8d, r8d
mov qword [0x140004190], rdi
lea rdx, [0x140001750]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IoRegisterDriverReinitialization]
call fcn.140001568
mov ecx, eax
call fcn.140001f38
mov rax, qword [sym.imp.ntoskrnl.exe_PsInitialSystemProcess]
mov rdx, rbx
mov rcx, qword [rax]
mov qword [0x1400041a0], rcx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140001878
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0xe8]
sub rsp, 0x1e0
mov rbx, rcx
lea rcx, section..data
call fcn.140001d48
mov edi, 0xc
mov dword [rsp + 0x40], 1
mov edx, edi
mov dword [rsp + 0x44], 4
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x48], 8
mov dword [rsp + 0x4c], 0x10
mov dword [rsp + 0x50], 0x40
mov dword [rsp + 0x54], 0x100
mov dword [rsp + 0x58], 0x800
mov dword [rsp + 0x5c], 0x1000
mov dword [rsp + 0x60], 0x2000
mov dword [rsp + 0x64], 0x10000
mov dword [rsp + 0x68], 0x40000
mov dword [rsp + 0x6c], 0x80000
call fcn.140001528
mov esi, eax
lea edx, [rdi - 0xb]
xor ecx, ecx
mov dword [rsp + rcx*4 + 0x70], edx
inc edx
inc rcx
cmp rcx, 0x3b
jl 0x14000191d
mov ecx, 0x3e
lea rax, [rbp + 0x5c]
mov dword [rax], ecx
inc ecx
lea rax, [rax + 4]
sub rdi, 1
jne 0x140001935
lea eax, [rdi + 0x50]
lea rcx, [rbp + 0x8c]
lea edx, [rdi + 0x12]
mov dword [rcx], eax
inc eax
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x140001950
mov edx, 0x59
lea rcx, [rsp + 0x70]
call fcn.140001528
lea rcx, [0x140004180]
mov r9d, eax
mov qword [rsp + 0x30], rcx
lea r8, section..data
mov byte [rsp + 0x28], 0
mov rcx, rbx
xor edx, edx
mov dword [rsp + 0x20], esi
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
jne 0x140001a03
lea rdx, section..data
lea rcx, [0x140004010]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov edi, eax
test eax, eax
jns 0x1400019c6
mov rcx, qword [0x140004180]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, edi
jmp 0x140001a03
mov rax, qword [0x140004180]
lea rdi, [rbx + 0x70]
mov ecx, 0x1c
or dword [rax + 0x30], 4
mov rax, qword [0x140004180]
btr dword [rax + 0x30], 7
lea rax, [0x1400010c0]
rep stosq qword [rdi], rax
lea rax, [0x140001050]
mov qword [rbx + 0xe0], rax
mov eax, 0xc0000001
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400012f4
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd r9, dword [rcx + 0x3c]
lea rbx, [rcx + 0x18]
add rbx, r9
xor r10d, r10d
xor edi, edi
mov r14, r8
mov r15, rdx
mov rbp, rcx
movzx eax, word [r9 + rcx + 0x14]
movzx esi, word [r9 + rcx + 6]
add rbx, rax
test esi, esi
je 0x140001374
cmp dword [rbx], 0x45474150
je 0x14000134e
cmp dword [rbx], 0x7865742e
jne 0x14000136a
cmp byte [rbx + 4], 0x74
jne 0x14000136a
mov ecx, dword [rbx + 0xc]
mov r9, r14
mov edx, dword [rbx + 8]
add rcx, rbp
mov r8, r15
call fcn.140001284
mov r10, rax
test rax, rax
jne 0x140001374
inc edi
add rbx, 0x28
cmp edi, esi
jb 0x140001338
mov rbx, qword [rsp + 0x40]
mov rax, r10
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1400013cc
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x150
xor ebx, ebx
lea r9, [rax + 0x10]
mov rbp, rcx
mov dword [rax + 0x10], ebx
xor r8d, r8d
lea rdx, [rax + 0x10]
lea esi, [rbx + 0xb]
mov ecx, esi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
jne 0x14000150a
call fcn.1400021f0
mov edx, dword [rsp + 0x168]
mov r8, rax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x14000150a
mov r8d, dword [rsp + 0x168]
xor r9d, r9d
mov rdx, rax
mov ecx, esi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
js 0x1400014fa
mov esi, ebx
cmp dword [rdi], ebx
jbe 0x1400014fa
mov eax, esi
lea rcx, [rsp + 0x20]
imul rax, rax, 0x128
mov edx, 2
add rax, 8
add rax, rdi
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x14000146f
movups xmm0, xmmword [rax]
mov rdx, rbp
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
lea rcx, [rsp + 0x48]
call sub.ntoskrnl.exe_strstr
test rax, rax
jne 0x1400014f5
inc esi
cmp esi, dword [rdi]
jb 0x140001455
jmp 0x1400014fa
mov rbx, qword [rsp + 0x30]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rbx
jmp 0x14000150c
xor eax, eax
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140001b40
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
cmp qword [rcx + 0x10], 0
mov rdi, rcx
je 0x140001c14
lea rbx, [0x140004020]
lea rsi, [0x140004070]
movups xmm0, xmmword [rbx]
lea rcx, [rsp + 0x30]
movdqu xmmword [rsp + 0x30], xmm0
call fcn.140001ab8
test rax, rax
jne 0x140001b91
add rbx, 0x10
cmp rbx, rsi
jl 0x140001b6b
jmp 0x140001c14
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea rcx, [0x140002e70]
call fcn.1400013cc
test rax, rax
je 0x140001c09
lea r8, [0x140002e80]
mov rcx, rax
lea rdx, [0x140002e90]
call fcn.1400012f4
test rax, rax
je 0x140001c09
mov ecx, dword [rax + 1]
add ecx, 5
movsxd rdx, ecx
lea rcx, [rsp + 0x40]
add rdx, rax
mov qword [0x1400041a8], rdx
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rax, qword [0x1400041a8]
mov r9b, 0x11
mov rdx, qword [rdi + 0x10]
mov r8d, 1
xor ecx, ecx
call qword [0x140003160]
xor eax, eax
jmp 0x140001c19
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, 0xc0000001
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400159a0
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x140392fd8]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x100
call fcn.14025d2b0
mov edx, 0x100
lea rcx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x140015a2e
xor eax, eax
mov rcx, 0xffffffffffffffff
mov qword [rbx], rax
lea rax, [rsp + 0x30]
nop word [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140015a00
mov qword [rbx + 8], rcx
inc rcx
call fcn.14025ac98
mov r8, qword [rbx + 8]
lea rdx, [rsp + 0x30]
inc r8
mov qword [rbx], rax
mov rcx, rax
call fcn.14025cc00
jmp 0x140015a3d
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14025a720
add rsp, 0x140
pop rbx
ret

Function at 0x140016f60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140016f94
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140016f80
ret
Function at 0x14001da50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x14001e250
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x40
mov rax, qword [0x140392fd8]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp word [rcx + 0xe], 3
movzx esi, r8b
mov rbx, rcx
jne 0x14001e311
cmp dword [rcx], 0
je 0x14001e311
mov eax, 0x405
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov word [rsp + 0x36], ax
movabs rcx, 0xffff000000000000
mov rax, qword [rsp + 0x30]
and rax, rcx
or rax, rdx
mov qword [rsp + 0x30], rax
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x14001e2b7
lea r8, [rsp + 0x28]
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14001f320
mov ecx, dword [rbx]
movabs rdx, 0xffffffffffff
mov rax, qword [rbx + 8]
and rax, rdx
shl rcx, 5
add rcx, rax
mov rax, qword [rsp + 0x20]
cmp rax, rcx
je 0x14001e311
movzx ecx, word [rax + 0x1e]
movzx eax, cl
shr al, 3
test al, 1
je 0x14001e311
cmp cx, 0xa
sete al
jmp 0x14001e315
movzx eax, sil
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14025a720
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
ret
Function at 0x140024210
Capabilities:
Set console window title

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rsi, rcx
lea rax, vtable.xmrig::ConsoleLog.0
mov qword [rcx], rax
xor ebp, ebp
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
lea ecx, [rbp + 1]
call fcn.140241ed0
cmp eax, 0xe
je 0x140024250
cmp eax, 7
jne 0x14002427c
mov ecx, 0x158
call fcn.14025a740
mov rbx, rax
mov qword [rsi + 8], rax
call fcn.1402425e0
mov rcx, rax
xor r9d, r9d
lea r8d, [r9 + 1]
mov rdx, rbx
call fcn.140246130
test eax, eax
jns 0x140024288
mov byte [0x140393cd8], bpl
jmp 0x1400243d3
xor edx, edx
mov rcx, qword [rsi + 8]
call fcn.140246630
mov rax, qword [rsi + 8]
mov qword [rsi + 0x10], rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400242dd
mov dword [rsp + 0x50], ebp
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x1400242dd
mov edx, dword [rsp + 0x50]
and edx, 0xffffffbf
mov dword [rsp + 0x50], edx
bts edx, 7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
cmp byte [rdi], bpl
je 0x1400243d3
cmp qword [rdi + 8], rbp
jne 0x14002431d
mov ecx, reloc.WS2_32.dll_send
call fcn.14025ac98
mov rbx, rax
movups xmm0, xmmword [str.xmrig_proxy_6.22.0]
movups xmmword [rax], xmm0
movzx eax, word [0x14035cbf8]
mov word [rbx + 0x10], ax
movzx eax, byte [0x14035cbfa]
mov byte [rbx + 0x12], al
jmp 0x1400243c2
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], rbp
mov ecx, 0x40
call fcn.14025a740
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x20]
mov rdx, qword [rdi + 8]
lea rcx, [rsp + 0x30]
call fcn.140014830
nop
mov rcx, qword [rsp + 0x20]
mov rdi, qword [rcx + 8]
cmp byte [rdi + 0x19], 0
jne 0x1400243b3
nop word [rax + rax]
mov r8, qword [rdi + 0x10]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x20]
call fcn.140017e90
mov rbx, rdi
mov rdi, qword [rdi]
mov rcx, qword [rbx + 0x30]
call fcn.14025a77c
mov rcx, qword [rbx + 0x20]
call fcn.14025a77c
mov edx, 0x40
mov rcx, rbx
call fcn.14025a77c
cmp byte [rdi + 0x19], 0
je 0x140024370
mov rcx, qword [rsp + 0x20]
mov edx, 0x40
call fcn.14025a77c
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rcx, rbx
call fcn.14025a77c
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x14004a540
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
movzx eax, byte [rcx + 6]
mov rdx, rcx
movzx r8d, byte [rcx + 7]
movzx esi, byte [rcx + 0xb]
movzx ebp, byte [rcx + 0xf]
movzx r11d, byte [rcx + 0x13]
movzx ebx, byte [rcx + 0x17]
movzx edi, byte [rcx + 0x1b]
movzx r14d, byte [rcx + 0x1f]
shl r8, 8
or r8, rax
shl rsi, 8
movzx eax, byte [rcx + 5]
shl rbp, 8
shl r11, 8
shl rbx, 8
shl rdi, 8
shl r14, 8
shl r8, 8
or r8, rax
movzx eax, byte [rcx + 4]
shl r8, 8
or r8, rax
movzx eax, byte [rcx + 0xa]
or rsi, rax
movzx eax, byte [rcx + 9]
shl rsi, 8
or rsi, rax
movzx eax, byte [rcx + 8]
shl rsi, 8
or rsi, rax
movzx eax, byte [rcx + 0xe]
or rbp, rax
movzx eax, byte [rcx + 0xd]
shl rbp, 8
or rbp, rax
movzx eax, byte [rcx + 0xc]
shl rbp, 8
or rbp, rax
movzx eax, byte [rcx + 0x12]
or r11, rax
movzx eax, byte [rcx + 0x11]
shl r11, 8
or r11, rax
movzx eax, byte [rcx + 0x10]
shl r11, 8
or r11, rax
movzx eax, byte [rcx + 0x16]
or rbx, rax
movzx eax, byte [rcx + 0x15]
shl rbx, 8
or rbx, rax
movzx eax, byte [rcx + 0x14]
shl rbx, 8
or rbx, rax
movzx eax, byte [rcx + 0x1a]
or rdi, rax
movzx eax, byte [rcx + 0x19]
shl rdi, 8
or rdi, rax
movzx eax, byte [rcx + 0x18]
shl rdi, 8
or rdi, rax
movzx eax, byte [rcx + 0x1e]
or r14, rax
movzx eax, byte [rcx + 0x1d]
shl r14, 8
or r14, rax
movzx eax, byte [rcx + 0x1c]
movzx ecx, byte [rcx + 3]
shl rcx, 8
shl r14, 8
or r14, rax
movzx eax, byte [rdx + 2]
or rcx, rax
movzx eax, byte [rdx + 1]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx]
shl rcx, 8
or rcx, rax
mov edx, 0x5cf5d3ec
mov eax, 1
sub rdx, rcx
test rdx, rdx
jle 0x14004a69a
mov r10d, eax
jmp 0x14004a6a7
xor r10d, r10d
test rdx, rdx
setns r10b
dec r10d
mov ecx, 0x5812631a
sub rcx, r8
test rcx, rcx
jle 0x14004a6b9
mov r9d, eax
jmp 0x14004a6c6
xor r9d, r9d
test rcx, rcx
setns r9b
dec r9d
mov ecx, 0xa2f79cd6
sub rcx, rsi
test rcx, rcx
jle 0x14004a6d8
mov r8d, eax
jmp 0x14004a6e5
xor r8d, r8d
test rcx, rcx
setns r8b
dec r8d
mov ecx, 0x14def9de
sub rcx, rbp
test rcx, rcx
jle 0x14004a6f6
mov edx, eax
jmp 0x14004a700
xor edx, edx
test rcx, rcx
setns dl
dec edx
mov ecx, 0x10000000
neg r11
sub rcx, r14
neg rbx
neg rdi
test rcx, rcx
jg 0x14004a720
xor eax, eax
test rcx, rcx
setns al
dec eax
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
cdqe
sar rdi, 0x3f
sar rbx, 0x3f
sar r11, 0x3f
lea rcx, [rdi + rax*2]
mov rdi, qword [rsp + 0x28]
lea rax, [rbx + rcx*2]
mov rbx, qword [rsp + 0x10]
lea rcx, [r11 + rax*2]
movsxd rax, edx
lea rdx, [rax + rcx*2]
movsxd rax, r8d
lea rcx, [rax + rdx*2]
movsxd rax, r9d
lea rdx, [rax + rcx*2]
movsxd rax, r10d
lea rax, [rax + rdx*2]
sar rax, 8
pop r14
ret
Function at 0x14004bf40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15d, edx
lea r14d, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov esi, r12d
mov ebp, r12d
test r14d, r14d
je 0x14004c14a
mov r8, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [r8 + 0xff]
shl esi, cl
add esi, esi
nop dword [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x14004c004
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x14004bfc0
mov ecx, dword [r10]
jmp 0x14004c0e7
cmp ecx, 0x4e0
jb 0x14004c0e7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14004c020
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14004c070
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
mov edx, dword [rdi + 0x10]
cmp eax, edx
ja 0x14004bfa0
mov r8, qword [rdi + 8]
or esi, eax
lea ecx, [r8 + 0xff]
shl ebp, cl
add ebp, ebp
or ebp, edx
cmp ebp, r14d
jb 0x14004bf90
xor edx, edx
mov eax, ebp
div r15d
mov ecx, eax
mov r8d, edx
xor edx, edx
mov eax, esi
div r15d
cmp eax, ecx
jb 0x14004c16a
cmp r8d, r14d
jne 0x14004bf70
mov rbx, qword [rsp + 0x20]
mov eax, esi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15d
mov eax, edx
pop r15
pop r14
pop r12
ret
Function at 0x1400d3820
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.14025b1c0
sub rsp, rax
mov r10, rcx
test r9, r9
jne 0x1400d386a
call fcn.1400d77e0
lea r8, str.c2i_ibuf
mov edx, 0xa0
lea rcx, str.crypto_asn1_a_int.c
call fcn.1400d7900
xor r8d, r8d
mov edx, 0xde
lea ecx, [r8 + 0xd]
call fcn.1400d7a00
xor eax, eax
add rsp, 0x28
ret
mov qword [rsp + 0x20], rbx
movzx ebx, byte [r8]
and ebx, 0x80
test rdx, rdx
je 0x1400d3880
mov dword [rdx], ebx
cmp r9, 1
jne 0x1400d38a6
test r10, r10
je 0x1400d3897
movzx eax, byte [r8]
test ebx, ebx
je 0x1400d3895
neg al
mov byte [rcx], al
mov rbx, qword [rsp + 0x20]
mov eax, 1
add rsp, 0x28
ret
movzx ecx, byte [r8]
xor r11d, r11d
mov eax, r11d
test cl, cl
jne 0x1400d38c1
mov eax, 1
mov r11d, eax
jmp 0x1400d3981
cmp cl, 0xff
jne 0x1400d39ca
mov eax, 1
lea rcx, [r9 - 1]
mov edx, r11d
cmp r9, rax
jbe 0x1400d396f
cmp rcx, 8
jb 0x1400d3960
and ecx, 7
mov rdx, r9
sub rdx, rcx
xorps xmm2, xmm2
xorps xmm3, xmm3
nop dword [rax]
nop dword [rax + rax]
movd xmm1, dword [rax + r8]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm2, xmm1
movd xmm1, dword [rax + r8 + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm1, xmm3
movdqa xmm3, xmm1
cmp rax, rdx
jb 0x1400d3900
por xmm2, xmm1
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd edx, xmm2
cmp rax, r9
jae 0x1400d396f
nop dword [rax]
movzx ecx, byte [rax + r8]
inc rax
or edx, ecx
cmp rax, r9
jb 0x1400d3960
test edx, edx
mov eax, r11d
setne al
test edx, edx
setne r11b
test edx, edx
je 0x1400d39ca
movzx ecx, byte [r8 + 1]
and ecx, 0x80
cmp ebx, ecx
jne 0x1400d39ca
call fcn.1400d77e0
lea r8, str.c2i_ibuf
mov edx, 0xc1
lea rcx, str.crypto_asn1_a_int.c
call fcn.1400d7900
xor r8d, r8d
mov edx, 0xdd
lea ecx, [r8 + 0xd]
call fcn.1400d7a00
mov rbx, qword [rsp + 0x20]
xor eax, eax
add rsp, 0x28
ret
mov ecx, eax
sub r9, rcx
test r10, r10
je 0x1400d3a1d
neg ebx
lea rax, [r11 + r8]
sbb r11d, r11d
movzx r11d, r11b
mov ecx, r11d
and ecx, 1
test r9, r9
je 0x1400d3a1d
lea r8, [rax + r9]
mov rdx, r8
sub rdx, r8
add rdx, r9
nop dword [rax]
movzx eax, byte [r8 - 1]
lea r8, [r8 - 1]
dec rdx
xor eax, r11d
add ecx, eax
mov byte [r10 + rdx], cl
shr ecx, 8
test rdx, rdx
jne 0x1400d3a00
mov rbx, qword [rsp + 0x20]
mov rax, r9
add rsp, 0x28
ret
Function at 0x1400d3a30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
xor r10d, r10d
xor r11b, r11b
mov rsi, r9
mov rbx, rcx
test rcx, rcx
je 0x1400d3b48
test rdx, rdx
je 0x1400d3b48
movzx eax, byte [rcx]
test r8d, r8d
jne 0x1400d3a75
cmp al, 0x7f
jbe 0x1400d3b40
mov r10d, 1
mov eax, r10d
add rax, rdx
jmp 0x1400d3b50
mov r11b, 0xff
cmp al, 0x80
jbe 0x1400d3a8d
mov r10d, 1
mov eax, r10d
add rax, rdx
jmp 0x1400d3b50
jne 0x1400d3b40
mov eax, 1
lea rcx, [rdx - 1]
cmp rdx, rax
jbe 0x1400d3b2f
cmp rcx, 8
jb 0x1400d3b20
and ecx, 7
mov r8, rdx
sub r8, rcx
xorps xmm3, xmm3
xorps xmm2, xmm2
nop word [rax + rax]
movd xmm1, dword [rax + rbx]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm3, xmm1
movd xmm1, dword [rax + rbx + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm2, xmm1
cmp rax, r8
jb 0x1400d3ac0
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd r10d, xmm2
cmp rax, rdx
jae 0x1400d3b2f
nop word [rax + rax]
movzx ecx, byte [rax + rbx]
inc rax
or r10d, ecx
cmp rax, rdx
jb 0x1400d3b20
neg r10d
sbb r11b, r11b
movzx r11d, r11b
mov r10d, r11d
and r10d, 1
mov eax, r10d
add rax, rdx
jmp 0x1400d3b50
mov eax, 1
mov rdx, r10
test rsi, rsi
je 0x1400d3bba
mov rcx, qword [r9]
test rcx, rcx
je 0x1400d3bba
mov qword [rsp + 0x10], rdi
mov edi, r10d
movzx r8d, r11b
add rdi, rcx
and r8d, 1
mov byte [rcx], r11b
test rdx, rdx
je 0x1400d3bb2
lea r10, [rbx + rdx]
mov r9, r10
sub r9, r10
add r9, rdx
nop word [rax + rax]
movzx edx, byte [r10 - 1]
lea r10, [r10 - 1]
dec r9
movzx ecx, r11b
xor edx, ecx
add r8d, edx
mov byte [rdi + r9], r8b
shr r8d, 8
test r9, r9
jne 0x1400d3b90
add qword [rsi], rax
mov rdi, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
pop rsi
ret

Function at 0x1400d3db0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.14025b1c0
sub rsp, rax
mov r8d, dword [rcx + 4]
mov r9, rdx
movsxd rdx, dword [rcx]
and r8d, 0x100
mov rcx, qword [rcx + 8]
add rsp, 0x28
jmp fcn.1400d3a30

Function at 0x1400d76d0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.14025b1c0
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1400dd940
Capabilities:
Encode data using add xor sub operations

Disassembly:
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x1400dd9ac
movzx ecx, byte [rcx]
test cl, cl
je 0x1400dd9ac
mov r11d, 0x100
nop word [rax + rax]
movsx r9d, cl
lea r10, [r10 + 1]
or r9d, r11d
mov r8d, eax
mov edx, r9d
mov ecx, 0x20
shr edx, 2
add r11d, 0x100
xor edx, r9d
imul r9d, r9d
and edx, 0xf
sub ecx, edx
shr r8, cl
mov ecx, edx
mov edx, eax
mov eax, r8d
shl edx, cl
movzx ecx, byte [r10]
or eax, edx
xor eax, r9d
test cl, cl
jne 0x1400dd960
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
ret
Function at 0x1400dd9b0
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x20
call fcn.14025b1c0
sub rsp, rax
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
je 0x1400dda43
movzx eax, byte [rcx]
test al, al
je 0x1400dda43
mov qword [rsp + 0x30], rsi
mov esi, 0x100
nop
movsx ecx, al
call fcn.140141660
mov r9d, eax
mov edx, ebx
or r9d, esi
lea rdi, [rdi + 1]
mov eax, ebx
mov r8d, r9d
shr r8d, 2
mov ecx, 0x20
xor r8d, r9d
add esi, 0x100
and r8d, 0xf
imul r9d, r9d
sub ecx, r8d
shr rdx, cl
mov ecx, r8d
shl eax, cl
mov ebx, edx
or ebx, eax
movzx eax, byte [rdi]
xor ebx, r9d
test al, al
jne 0x1400dd9e0
mov rsi, qword [rsp + 0x30]
mov eax, ebx
shr eax, 0x10
xor eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x1400ece10
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.14025b1c0
sub rsp, rax
lea rcx, [0x1403960f0]
add rsp, 0x28
jmp fcn.1400d7550

Function at 0x140101830
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x140101857
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x140101840
movzx eax, r9b
ret