joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007d5b0
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
mov rdi, rdx
mov qword [rsp + 0x20], rcx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov edx, 0x20
mov rcx, rdi
call fcn.1400a2680
or byte [rdi], 7
movzx eax, byte [rdi + 0x1f]
and al, 0x3f
or al, 0x80
mov byte [rdi + 0x1f], al
movups xmm0, xmmword [rdi]
mov rax, qword [rdi + 0x10]
mov ecx, dword [rdi + 0x18]
movzx edx, word [rdi + 0x1c]
movzx r8d, byte [rdi + 0x1e]
movzx r9d, byte [rdi + 0x1f]
movaps xmmword [rsp + 0x140], xmm0
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x158], ecx
mov word [rsp + 0x15c], dx
mov byte [rsp + 0x15e], r8b
mov byte [rsp + 0x15f], r9b
and byte [rsp + 0x140], 0xf8
movzx eax, byte [rsp + 0x15f]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0x15f], al
lea r8, [0x14039d210]
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x140]
call fcn.140077120
mov rax, qword [rsp + 0xf0]
mov r11, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xd0]
lea rdi, [r11 + rax]
mov rcx, qword [rsp + 0xf8]
lea rbx, [rsi + rcx]
mov rdx, qword [rsp + 0x100]
mov r14, qword [rsp + 0xd8]
lea r15, [r14 + rdx]
mov r8, qword [rsp + 0x108]
mov r12, qword [rsp + 0xe0]
lea r13, [r12 + r8]
mov r9, qword [rsp + 0x110]
mov rbp, qword [rsp + 0xe8]
lea r10, [rbp + r9]
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x98], r10
movabs r10, 0xffffffffffffe
add rax, r10
sub rax, r11
add rax, 0xffffffffffffffdc
add rcx, r10
sub rcx, rsi
add rdx, r10
sub rdx, r14
add r8, r10
sub r8, r12
add r9, r10
sub r9, rbp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x70], r9
lea rdi, [rsp + 0x28]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.14007ee00
lea rdx, [rsp + 0x78]
mov rcx, rdi
mov r8, rdi
call fcn.140081a60
mov rcx, qword [rsp + 0x20]
mov rdx, rdi
call fcn.1400731f0
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x14007d79c
add rsp, 0x168
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14029fd30
int3
Function at 0x14007d7b0
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
mov qword [rsp + 0x20], rcx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x160], rax
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movaps xmmword [rsp + 0x140], xmm0
movaps xmmword [rsp + 0x150], xmm1
and byte [rsp + 0x140], 0xf8
movzx eax, byte [rsp + 0x15f]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0x15f], al
lea r8, [0x14039d210]
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x140]
call fcn.140077120
mov rax, qword [rsp + 0xf0]
mov r11, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xd0]
lea rdi, [r11 + rax]
mov rcx, qword [rsp + 0xf8]
lea rbx, [rsi + rcx]
mov rdx, qword [rsp + 0x100]
mov r14, qword [rsp + 0xd8]
lea r15, [r14 + rdx]
mov r8, qword [rsp + 0x108]
mov r12, qword [rsp + 0xe0]
lea r13, [r12 + r8]
mov r9, qword [rsp + 0x110]
mov rbp, qword [rsp + 0xe8]
lea r10, [rbp + r9]
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x98], r10
movabs r10, 0xffffffffffffe
add rax, r10
sub rax, r11
add rax, 0xffffffffffffffdc
add rcx, r10
sub rcx, rsi
add rdx, r10
sub rdx, r14
add r8, r10
sub r8, r12
add r9, r10
sub r9, rbp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x70], r9
lea rdi, [rsp + 0x28]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.14007ee00
lea rdx, [rsp + 0x78]
mov rcx, rdi
mov r8, rdi
call fcn.140081a60
mov rcx, qword [rsp + 0x20]
mov rdx, rdi
call fcn.1400731f0
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x14007d94e
add rsp, 0x168
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14029fd30
int3
Function at 0x140089220
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x28]
mov r8d, 6
call fcn.14006cee0
test eax, eax
je 0x140089349
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
movzx eax, byte [reloc.WS2_32.dll_htons]
cmp rsi, rax
jne 0x14008928d
lea rbx, [0x14039f4f0]
test al, al
je 0x14008934b
lea rdx, [0x14039f4f4]
mov rcx, rdi
mov r8, rsi
call fcn.1402a43e0
test eax, eax
je 0x14008934b
movzx eax, byte [reloc.WS2_32.dll_getsockopt]
cmp rsi, rax
jne 0x1400892c2
lea rbx, [0x14039f238]
test al, al
je 0x14008934b
lea rdx, [0x14039f23c]
mov rcx, rdi
mov r8, rsi
call fcn.1402a43e0
test eax, eax
je 0x14008934b
movzx eax, byte [reloc.WS2_32.dll_getsockopt]
cmp rsi, rax
jne 0x1400892ef
lea rbx, [0x14039f118]
test al, al
je 0x14008934b
lea rdx, [0x14039f11c]
mov rcx, rdi
mov r8, rsi
call fcn.1402a43e0
test eax, eax
je 0x14008934b
movzx eax, byte [reloc.WS2_32.dll_closesocket]
cmp rsi, rax
jne 0x14008931c
lea rbx, [0x14039f358]
test al, al
je 0x14008934b
lea rdx, [0x14039f35c]
mov rcx, rdi
mov r8, rsi
call fcn.1402a43e0
test eax, eax
je 0x14008934b
movzx eax, byte [reloc.WS2_32.dll_closesocket]
cmp rsi, rax
jne 0x140089349
lea rbx, [0x14039f610]
test al, al
je 0x14008934b
lea rdx, [0x14039f614]
mov rcx, rdi
mov r8, rsi
call fcn.1402a43e0
test eax, eax
je 0x14008934b
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x140089367
mov rax, rbx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call fcn.14029fd30
int3
Function at 0x14008ebf0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp dword [rcx + 0x2c0], 0
je 0x14008ec61
mov dword [rsp + 0x20], 0x3f9
lea r9, str..._.._third_party_boringssl_src_crypto_hpke_hpke.c
xor esi, esi
mov ecx, 6
xor edx, edx
mov r8d, 0x42
call fcn.1400885a0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x14008ec5b
mov eax, esi
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.14029fd30
int3
mov rsi, rcx
cmp qword [rcx + 0x2b8], 0xffffffffffffffff
je 0x14008ecea
mov r14, rdx
mov r15, r8
mov r12, r9
mov rcx, qword [rsi + 0x18]
call fcn.140038fc0
mov rdi, rax
test rax, rax
je 0x14008ec97
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8, rdi
call fcn.1402a4b90
mov rbx, qword [rsp + 0xe8]
mov r11, qword [rsp + 0xe0]
mov r10, qword [rsp + 0xd8]
mov rax, qword [rsp + 0xd0]
lea rcx, [rsi + 0x18]
mov rdx, qword [rsi + 0x2b8]
bswap rdx
mov qword [rsp + rdi + 0x48], rdx
test rdi, rdi
mov r9, r12
mov r8, r15
mov rdx, r14
je 0x14008edae
cmp rdi, 8
jae 0x14008ed0d
xor r14d, r14d
jmp 0x14008ed98
mov dword [rsp + 0x20], 0x3fd
lea r9, str..._.._third_party_boringssl_src_crypto_hpke_hpke.c
xor esi, esi
mov ecx, 6
xor edx, edx
mov r8d, 0x45
jmp 0x14008ec34
cmp rdi, 0x20
jae 0x14008ed18
xor r14d, r14d
jmp 0x14008ed6e
mov r14, rdi
and r14, 0xffffffffffffffe0
xor r15d, r15d
nop word cs:[rax + rax]
movups xmm0, xmmword [rsi + r15 + 0x260]
movups xmm1, xmmword [rsi + r15 + 0x270]
xorps xmm0, xmmword [rsp + r15 + 0x50]
xorps xmm1, xmmword [rsp + r15 + 0x60]
movaps xmmword [rsp + r15 + 0x50], xmm0
movaps xmmword [rsp + r15 + 0x60], xmm1
add r15, 0x20
cmp r14, r15
jne 0x14008ed30
cmp rdi, r14
je 0x14008edae
test dil, 0x18
je 0x14008ed98
mov r15, r14
mov r14, rdi
and r14, 0xfffffffffffffff8
nop dword [rax + rax]
mov r12, qword [rsi + r15 + 0x260]
xor qword [rsp + r15 + 0x50], r12
add r15, 8
cmp r14, r15
jne 0x14008ed80
jmp 0x14008eda9
movzx ebp, byte [rsi + r14 + 0x260]
xor byte [rsp + r14 + 0x50], bpl
inc r14
cmp rdi, r14
jne 0x14008ed98
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.140039440
test eax, eax
je 0x14008edeb
inc qword [rsi + 0x2b8]
mov esi, 1
jmp 0x14008ec39
xor esi, esi
jmp 0x14008ec39
Function at 0x14008ee00
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp dword [rcx + 0x2c0], 0
je 0x14008eeb7
mov rsi, rcx
cmp qword [rcx + 0x2b8], 0xffffffffffffffff
je 0x14008eed7
mov r14, rdx
mov r15, r8
mov r12, r9
mov rcx, qword [rsi + 0x18]
call fcn.140038fc0
mov rdi, rax
test rax, rax
je 0x14008ee64
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8, rdi
call fcn.1402a4b90
mov rbx, qword [rsp + 0xe8]
mov r11, qword [rsp + 0xe0]
mov r10, qword [rsp + 0xd8]
mov rax, qword [rsp + 0xd0]
lea rcx, [rsi + 0x18]
mov rdx, qword [rsi + 0x2b8]
bswap rdx
mov qword [rsp + rdi + 0x48], rdx
test rdi, rdi
mov r9, r12
mov r8, r15
mov rdx, r14
je 0x14008efbe
cmp rdi, 8
jae 0x14008ef20
xor r14d, r14d
jmp 0x14008efa8
mov dword [rsp + 0x20], 0x411
lea r9, str..._.._third_party_boringssl_src_crypto_hpke_hpke.c
xor esi, esi
mov ecx, 6
xor edx, edx
mov r8d, 0x42
jmp 0x14008eef5
mov dword [rsp + 0x20], 0x415
lea r9, str..._.._third_party_boringssl_src_crypto_hpke_hpke.c
xor esi, esi
mov ecx, 6
xor edx, edx
mov r8d, 0x45
call fcn.1400885a0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x14008f00b
mov eax, esi
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
cmp rdi, 0x20
jae 0x14008ef2b
xor r14d, r14d
jmp 0x14008ef7e
mov r14, rdi
and r14, 0xffffffffffffffe0
xor r15d, r15d
nop word cs:[rax + rax]
movups xmm0, xmmword [rsi + r15 + 0x260]
movups xmm1, xmmword [rsi + r15 + 0x270]
xorps xmm0, xmmword [rsp + r15 + 0x50]
xorps xmm1, xmmword [rsp + r15 + 0x60]
movaps xmmword [rsp + r15 + 0x50], xmm0
movaps xmmword [rsp + r15 + 0x60], xmm1
add r15, 0x20
cmp r14, r15
jne 0x14008ef40
cmp rdi, r14
je 0x14008efbe
test dil, 0x18
je 0x14008efa8
mov r15, r14
mov r14, rdi
and r14, 0xfffffffffffffff8
nop dword [rax + rax]
mov r12, qword [rsi + r15 + 0x260]
xor qword [rsp + r15 + 0x50], r12
add r15, 8
cmp r14, r15
jne 0x14008ef90
jmp 0x14008efb9
movzx ebp, byte [rsi + r14 + 0x260]
xor byte [rsp + r14 + 0x50], bpl
inc r14
cmp rdi, r14
jne 0x14008efa8
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.140039150
test eax, eax
je 0x14008f011
inc qword [rsi + 0x2b8]
mov esi, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
je 0x14008ef0f
call fcn.14029fd30
int3
xor esi, esi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
je 0x14008ef0f
jmp 0x14008f00b
Function at 0x140090d10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1f8
mov rsi, rcx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movaps xmmword [rsp + 0x120], xmm1
movaps xmmword [rsp + 0x110], xmm0
xor r15d, r15d
lea rdi, [rsp + 0x28]
lea rbx, [rsp + 0x110]
lea r14, [rsp + 0x140]
jmp 0x140090d7d
inc r15
cmp r15, 3
je 0x140091018
mov byte [rsp + 0x130], r15b
mov byte [rsp + 0x131], 0
mov rcx, rdi
mov edx, 2
call fcn.14008f850
mov r8d, 0x22
mov rcx, rdi
mov rdx, rbx
call fcn.14008f410
lea r12, [r15 + r15*2]
shl r12, 9
lea r13, [rsi + r12]
xor ebp, ebp
jmp 0x140090dcc
cmp ebp, 0x100
jge 0x140090e60
mov r8d, 0xa8
mov rcx, rdi
mov rdx, r14
call fcn.14008f760
xor eax, eax
nop
movzx ecx, byte [rsp + rax + 0x140]
movzx edx, byte [rsp + rax + 0x141]
mov r8d, edx
and r8d, 0xf
shl r8d, 8
or r8d, ecx
movzx ecx, byte [rsp + rax + 0x142]
cmp r8d, 0xd00
ja 0x140090e1a
movsxd r9, ebp
inc ebp
mov word [r13 + r9*2], r8w
shr edx, 4
shl ecx, 4
or ecx, edx
cmp ecx, 0xd00
ja 0x140090e3d
cmp ebp, 0xff
jg 0x140090e3d
movsxd rdx, ebp
inc ebp
mov word [r13 + rdx*2], cx
cmp rax, 0xa4
ja 0x140090dc0
add rax, 3
cmp ebp, 0x100
jl 0x140090de0
jmp 0x140090dc0
mov byte [rsp + 0x130], r15b
mov byte [rsp + 0x131], 1
mov rcx, rdi
mov edx, 2
call fcn.14008f850
mov r8d, 0x22
mov rcx, rdi
mov rdx, rbx
call fcn.14008f410
lea r13, [rsi + r12]
add r13, 0x200
xor ebp, ebp
jmp 0x140090eac
cmp ebp, 0x100
jge 0x140090f40
mov r8d, 0xa8
mov rcx, rdi
mov rdx, r14
call fcn.14008f760
xor eax, eax
nop
movzx ecx, byte [rsp + rax + 0x140]
movzx edx, byte [rsp + rax + 0x141]
mov r8d, edx
and r8d, 0xf
shl r8d, 8
or r8d, ecx
movzx ecx, byte [rsp + rax + 0x142]
cmp r8d, 0xd00
ja 0x140090efa
movsxd r9, ebp
inc ebp
mov word [r13 + r9*2], r8w
shr edx, 4
shl ecx, 4
or ecx, edx
cmp ecx, 0xd00
ja 0x140090f1d
cmp ebp, 0xff
jg 0x140090f1d
movsxd rdx, ebp
inc ebp
mov word [r13 + rdx*2], cx
cmp rax, 0xa4
ja 0x140090ea0
add rax, 3
cmp ebp, 0x100
jl 0x140090ec0
jmp 0x140090ea0
mov byte [rsp + 0x130], r15b
mov byte [rsp + 0x131], 2
mov rcx, rdi
mov edx, 2
call fcn.14008f850
mov r8d, 0x22
mov rcx, rdi
mov rdx, rbx
call fcn.14008f410
add r12, rsi
add r12, 0x400
xor ebp, ebp
jmp 0x140090f8c
cmp ebp, 0x100
jge 0x140090d70
mov r8d, 0xa8
mov rcx, rdi
mov rdx, r14
call fcn.14008f760
xor eax, eax
nop
movzx ecx, byte [rsp + rax + 0x140]
movzx edx, byte [rsp + rax + 0x141]
mov r8d, edx
and r8d, 0xf
shl r8d, 8
or r8d, ecx
movzx ecx, byte [rsp + rax + 0x142]
cmp r8d, 0xd00
ja 0x140090fd9
movsxd r9, ebp
inc ebp
mov word [r12 + r9*2], r8w
shr edx, 4
shl ecx, 4
or ecx, edx
cmp ecx, 0xd00
ja 0x140090ffb
cmp ebp, 0xff
jg 0x140090ffb
movsxd rdx, ebp
inc ebp
mov word [r12 + rdx*2], cx
cmp rax, 0xa4
ja 0x140090f80
add rax, 3
cmp ebp, 0x100
jl 0x140090fa0
jmp 0x140090f80
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x140091040
add rsp, 0x1f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14029fd30
int3
Function at 0x140098870
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x140098885
cmp r8, 8
jae 0x140098888
xor eax, eax
xor r9d, r9d
jmp 0x140098984
xor eax, eax
ret
cmp r8, 0x20
jae 0x140098898
xor r9d, r9d
xor eax, eax
jmp 0x140098923
mov rax, r8
and rax, 0xffffffffffffffe0
pxor xmm0, xmm0
xor r9d, r9d
pxor xmm1, xmm1
nop word [rax + rax]
movdqu xmm2, xmmword [rcx + r9]
movdqu xmm3, xmmword [rcx + r9 + 0x10]
movdqu xmm4, xmmword [rdx + r9]
pxor xmm4, xmm2
por xmm0, xmm4
movdqu xmm2, xmmword [rdx + r9 + 0x10]
pxor xmm2, xmm3
por xmm1, xmm2
add r9, 0x20
cmp rax, r9
jne 0x1400988b0
por xmm1, xmm0
pshufd xmm0, xmm1, 0xee
por xmm0, xmm1
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd r9d, xmm1
cmp r8, rax
je 0x140098998
test r8b, 0x18
je 0x140098984
mov r10, rax
mov rax, r8
and rax, 0xfffffffffffffff8
movzx r9d, r9b
movd xmm0, r9d
nop word cs:[rax + rax]
mov r9, qword [rdx + r10]
xor r9, qword [rcx + r10]
movq xmm1, r9
por xmm0, xmm1
add r10, 8
cmp rax, r10
jne 0x140098940
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd r9d, xmm1
jmp 0x140098993
movzx r10d, byte [rdx + rax]
xor r10b, byte [rcx + rax]
or r9b, r10b
inc rax
cmp r8, rax
jne 0x140098984
movzx eax, r9b
ret
Function at 0x1400a2720
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
mov eax, dword [rcx]
mov r10d, dword [rcx + 4]
test rdx, rdx
je 0x1400a2779
xor r11d, r11d
nop word cs:[rax + rax]
inc eax
movzx eax, al
mov esi, dword [rcx + rax*4 + 8]
add r10d, esi
movzx r10d, r10b
mov edi, dword [rcx + r10*4 + 8]
mov dword [rcx + rax*4 + 8], edi
mov dword [rcx + r10*4 + 8], esi
add edi, esi
movzx esi, dil
movzx ebx, byte [r8 + r11]
xor bl, byte [rcx + rsi*4 + 8]
mov byte [r9 + r11], bl
inc r11
cmp rdx, r11
jne 0x1400a2740
mov dword [rcx], eax
mov dword [rcx + 4], r10d
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400a5030
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov esi, ecx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rax, [0x1400a50e0]
mov qword [rsp + 0x20], rax
lea rcx, [0x1404aa4b0]
lea rdx, [0x1400a4ec0]
lea r8, [rsp + 0x20]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1400a50da
cmp dword [0x1404aa4b8], 0
je 0x1400a5098
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x1400a50d4
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x1404aa4bc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x1400a507d
movsxd rax, esi
mov rax, qword [rdi + rax*8]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
je 0x1400a5090
call fcn.14029fd30
int3
call fcn.1402b5ec8
int3

Function at 0x1400a5110
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, r8
mov rsi, rdx
mov ebx, ecx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rax, [0x1400a50e0]
mov qword [rsp + 0x28], rax
lea rcx, [0x1404aa4b0]
lea rdx, [0x1400a4ec0]
lea r8, [rsp + 0x28]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1400a5237
cmp dword [0x1404aa4b8], 0
je 0x1400a5191
mov rcx, rsi
call rdi
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x1400a51f6
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov ecx, dword [0x1404aa4bc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14, r14
je 0x1400a51fc
lea r15, [0x1404aa4c0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
movsxd rbx, ebx
lea rax, [0x1404aa4d0]
mov qword [rax + rbx*8], rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [r14 + rbx*8], rsi
mov eax, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
je 0x1400a5184
call fcn.14029fd30
int3
mov ecx, 1
mov edx, 0x28
call fcn.1402ba1b4
test rax, rax
je 0x1400a516c
mov r14, rax
mov ecx, dword [0x1404aa4bc]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1400a51b5
mov rcx, r14
call fcn.1402bbd1c
jmp 0x1400a516c
call fcn.1402b5ec8
int3
Function at 0x1400d5750
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rax, qword [rcx + 0x68]
cmp qword [rax + 0x1f8], 0
je 0x1400d59c8
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
lea r14, [rsp + 0x38]
mov rcx, r14
call fcn.14006aed0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
mov rcx, rbx
call fcn.1402c0ec0
mov rcx, qword [rdi + 8]
lea rdx, [rax + rcx*2]
add rdx, 0x43
mov rcx, r14
call fcn.14006aee0
test eax, eax
je 0x1400d5998
mov rcx, rbx
call fcn.1402c0ec0
lea rcx, [rsp + 0x38]
mov rdx, rbx
mov r8, rax
call fcn.14006b6f0
test eax, eax
je 0x1400d5998
lea rcx, [rsp + 0x38]
mov dl, 0x20
call fcn.14006b680
test eax, eax
je 0x1400d5998
mov rbx, qword [rsi + 0x30]
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x68]
mov r8d, 0x40
call fcn.14006b770
test eax, eax
je 0x1400d5998
xor eax, eax
mov ecx, 0xff
nop dword [rax + rax]
movzx edx, byte [rbx + rax + 0x30]
mov r8d, edx
shr r8b, 4
lea r9d, [r8 + 0x57]
or r8b, 0x30
cmp dl, 0xa0
mov r10d, 0
cmovb r10, rcx
xor r8b, r9b
and r8b, r10b
xor r8b, r9b
mov r9, qword [rsp + 0x68]
lea r10, [r9 + 1]
mov qword [rsp + 0x68], r10
mov byte [r9], r8b
and dl, 0xf
lea r8d, [rdx + 0x57]
lea r9d, [rdx + 0x30]
cmp dl, 0xa
mov edx, 0
cmovb rdx, rcx
xor r9b, r8b
and r9b, dl
xor r9b, r8b
mov rdx, qword [rsp + 0x68]
lea r8, [rdx + 1]
mov qword [rsp + 0x68], r8
mov byte [rdx], r9b
inc rax
cmp rax, 0x20
jne 0x1400d5820
lea rcx, [rsp + 0x38]
mov dl, 0x20
call fcn.14006b680
test eax, eax
je 0x1400d5998
mov rbx, qword [rdi]
mov rdi, qword [rdi + 8]
lea r8, [rdi + rdi]
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x68]
call fcn.14006b770
test eax, eax
je 0x1400d5998
test rdi, rdi
je 0x1400d5953
xor eax, eax
mov ecx, 0xff
nop dword [rax + rax]
movzx edx, byte [rbx + rax]
mov r8d, edx
shr r8b, 4
lea r9d, [r8 + 0x57]
or r8b, 0x30
cmp dl, 0xa0
mov r10d, 0
cmovb r10, rcx
xor r8b, r9b
and r8b, r10b
xor r8b, r9b
mov r9, qword [rsp + 0x68]
lea r10, [r9 + 1]
mov qword [rsp + 0x68], r10
mov byte [r9], r8b
and dl, 0xf
lea r8d, [rdx + 0x57]
lea r9d, [rdx + 0x30]
cmp dl, 0xa
mov edx, 0
cmovb rdx, rcx
xor r9b, r8b
and r9b, dl
xor r9b, r8b
mov rdx, qword [rsp + 0x68]
lea r8, [rdx + 1]
mov qword [rsp + 0x68], r8
mov byte [rdx], r9b
inc rax
cmp rdi, rax
jne 0x1400d58e0
xor edi, edi
lea rcx, [rsp + 0x38]
xor edx, edx
call fcn.14006b680
test eax, eax
je 0x1400d59e2
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x20]
call fcn.1400d54d0
mov rcx, qword [rsp + 0x20]
test al, al
je 0x1400d599a
mov rax, qword [rsi + 0x68]
mov rdi, rcx
mov rcx, rsi
mov rdx, rdi
call qword [rax + 0x1f8]
mov rcx, rdi
mov dil, 1
jmp 0x1400d599c
xor ecx, ecx
xor edi, edi
call fcn.140098760
lea rcx, [rsp + 0x38]
call fcn.14006af70
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x1400d59dc
mov eax, edi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
mov dil, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
je 0x1400d59bc
call fcn.14029fd30
int3
xor ecx, ecx
jmp 0x1400d599c
Function at 0x1401072d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
movaps xmmword [rsp + 0x50], xmm6
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rcx, qword [rcx + 0x20]
lea r12, [rsp + 0x44]
mov qword [rsp + 0x30], r12
xorps xmm6, xmm6
movups xmmword [rsp + 0x20], xmm6
xor ebx, ebx
xor edx, edx
mov r8d, 1
mov r9d, 1
call fcn.14011f590
test eax, eax
js 0x14010747f
mov ebp, eax
jmp 0x14010736f
mov ebx, ebp
inc ebx
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x30], r12
movups xmmword [rsp + 0x20], xmm6
mov edx, ebx
mov r8d, 1
mov r9d, 1
call fcn.14011f590
mov ebp, eax
test eax, eax
js 0x14010747f
mov rcx, qword [rsi]
mov edx, ebx
call qword [rsi + ioctlsocket]
cmp ebx, ebp
je 0x140107340
mov eax, dword [rsp + 0x44]
cmp word [rdi + 0x1a], ax
setbe cl
cmp word [rdi + 0x1e], ax
seta dl
and eax, 6
cmp eax, 3
setae al
and al, dl
and al, cl
cmp al, 1
jne 0x140107340
movzx eax, word [rdi + 8]
cmp ebx, eax
jge 0x1401073ab
xor r14d, r14d
jmp 0x1401073e7
cmp ebx, 0xffff
ja 0x1401073da
mov rdx, qword [rdi + 0x38]
mov r8d, ebx
mov ecx, ebx
shr cl, 5
mov eax, 1
shl eax, cl
shr r8d, 8
movzx ecx, byte [rdx + r8]
xor r14d, r14d
test ecx, ecx
je 0x1401073e7
and eax, ecx
je 0x1401073e7
mov rcx, rdi
mov edx, ebx
call fcn.14010cfc0
mov r14d, eax
cmp ebx, ebp
jge 0x140107340
mov r13d, ebp
neg r13d
inc ebx
jmp 0x140107415
lea eax, [rbx + r13]
inc eax
mov ecx, ebx
inc ecx
mov ebx, ecx
cmp eax, 1
je 0x140107340
movzx eax, word [rdi + 8]
cmp ebx, eax
jge 0x140107430
xor r15d, r15d
jmp 0x14010746c
cmp ebx, 0xffff
ja 0x14010745f
mov rdx, qword [rdi + 0x38]
mov r8d, ebx
mov ecx, ebx
shr cl, 5
mov eax, 1
shl eax, cl
shr r8d, 8
movzx ecx, byte [rdx + r8]
xor r15d, r15d
test ecx, ecx
je 0x14010746c
and eax, ecx
je 0x14010746c
mov rcx, rdi
mov edx, ebx
call fcn.14010cfc0
mov r15d, eax
cmp r15w, r14w
je 0x140107400
mov rcx, qword [rsi]
mov edx, ebx
call qword [rsi + ioctlsocket]
mov r14d, r15d
jmp 0x140107400
mov edi, 0xac00
nop word cs:[rax + rax]
mov rcx, qword [rsi]
mov edx, edi
call qword [rsi + ioctlsocket]
mov rcx, qword [rsi]
lea edx, [rdi + 1]
call qword [rsi + ioctlsocket]
lea eax, [rdi + 0x1c]
cmp edi, 0xd788
mov edi, eax
jb 0x140107490
mov rcx, qword [rsi]
mov edx, 0xd7a4
call qword [rsi + ioctlsocket]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x1401074e0
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14029fd30
int3