joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f1f80
Capabilities:
Move file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4b8
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x450]
mov qword [r14 + 0x50], rax
movaps xmm0, xmmword [0x1403aa440]
movaps xmmword [r14 + 0x40], xmm0
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, [0x1403b5da3]
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x240]
mov rcx, r15
mov r9d, 0x196
call fcn.1401de830
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.1401ea620
lea r14, [rsp + 0x240]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.140244560
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x1400f2035
mov rdx, qword [rbx]
mov r8d, 0x104
mov rcx, r14
call fcn.1401e86b0
mov rcx, r14
call fcn.1401c6fa0
lea r14, [rsp + 0x30]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.140244560
cmp byte [rdi + 0x17], 0
mov rdx, rdi
jns 0x1400f206c
mov rdx, qword [rdi]
mov r8d, 0x104
mov rcx, r14
call fcn.1401e86b0
mov rcx, r14
call fcn.1401c6fa0
cmp byte [rbx + 0x17], 0
mov rdx, rbx
jns 0x1400f208e
mov rdx, qword [rbx]
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x1400f209a
mov rcx, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x1400f2120
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400f3ca0
mov ebp, eax
cmp byte [rdi + 0x17], 0
jns 0x1400f20cd
mov rdi, qword [rdi]
cmp byte [rbx + 0x17], 0
jns 0x1400f20d6
mov rbx, qword [rbx]
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne dil
test rsi, rsi
je 0x1400f20f1
test eax, eax
je 0x1400f2125
lea rcx, [rsp + 0x450]
call fcn.1401ea680
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.140242430
mov eax, edi
add rsp, 0x4b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov dil, 1
jmp 0x1400f20f1
cmp ebp, 0xfffffffc
jne 0x1400f2131
call fcn.1402ba020
mov ebp, eax
mov dword [rsi], ebp
xor edi, edi
jmp 0x1400f20f1

Function at 0x1400f2140
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x50], rax
movaps xmm0, xmmword [0x1403aa440]
movaps xmmword [rsi + 0x40], xmm0
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.PathExists
lea r8, str....._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x1c9
call fcn.1401de830
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.1401ea620
cmp byte [rdi + 0x17], 0
jns 0x1400f21c4
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rsi
call fcn.1401ea680
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140242430
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
Function at 0x140289db0
Capabilities:
Modify service

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b8
mov rsi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
movzx eax, byte [rdx + 0x57]
test al, al
jns 0x140289de3
mov rax, qword [rdx + 0x48]
mov r10, qword [rdx + 0x40]
jmp 0x140289dea
lea r10, [rdx + 0x40]
and eax, 0x7f
test rax, rax
cmove r10, rax
mov rax, qword [rdx + 0x28]
xor r11d, r11d
cmp rax, qword [rdx + 0x30]
cmovne r11, rax
movzx eax, byte [rdx + 0x27]
test al, al
jns 0x140289e12
mov rax, qword [rdx + 0x18]
mov rdi, qword [rdx + 0x10]
jmp 0x140289e19
lea rdi, [rdx + 0x10]
and eax, 0x7f
test rax, rax
cmove rdi, rax
mov r9d, dword [rdx + 0xc]
mov eax, dword [rdx + 4]
mov r8d, dword [rdx + 8]
mov rcx, qword [rsi + 0x130]
mov qword [rsp + 0x50], r10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], r11
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rdi
mov edx, eax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov edi, eax
test eax, eax
jne 0x140289e6a
mov ecx, 1
call fcn.1401de860
test al, al
jne 0x140289e8e
test edi, edi
setne bl
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.140242430
mov eax, ebx
add rsp, 0x1b8
pop rbx
pop rdi
pop rsi
pop r14
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstallerutilinstall_service_work_item_impl.cc
lea rcx, [rsp + 0x70]
mov r8d, 0x1e0
mov r9d, 1
call fcn.1402b3940
lea rcx, [rsp + 0x80]
lea rdx, str.Failed_to_change_service_config
mov r8d, 0x20
call fcn.14027e630
mov rbx, rax
lea r14, [rsp + 0x58]
mov rcx, rsi
mov rdx, r14
call fcn.140288f20
cmp byte [r14 + 0x17], 0
jns 0x140289eed
mov r14, qword [rsp + 0x58]
mov rcx, rbx
mov rdx, r14
call fcn.1402b3a80
cmp byte [rsp + 0x6f], 0
jns 0x140289f09
mov rcx, qword [rsp + 0x58]
call fcn.140240d14
lea rcx, [rsp + 0x70]
call fcn.1402b39c0
jmp 0x140289e6a
Function at 0x14028a2a0
Capabilities:
Create service

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1d8
mov rsi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rax, qword [rdx + 0x28]
xor r14d, r14d
cmp rax, qword [rdx + 0x30]
cmovne r14, rax
cmp byte [rdx + 0x27], 0
jns 0x14028a2e3
mov r15, qword [rdx + 0x10]
jmp 0x14028a2e7
lea r15, [rdx + 0x10]
cmp byte [rdx + 0x57], 0
jns 0x14028a2f3
mov rdi, qword [rdx + 0x40]
jmp 0x14028a2f7
lea rdi, [rdx + 0x40]
mov r12d, dword [rdx + 0xc]
mov ebp, dword [rdx + 4]
mov r13d, dword [rdx + 8]
lea rbx, [rsp + 0x88]
mov rcx, rsi
mov rdx, rbx
call fcn.140288f20
cmp byte [rbx + 0x17], 0
jns 0x14028a323
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsi + 0x128]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x50], r14
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], ebp
mov rdx, rbx
mov r8, rdi
mov r9d, 0x10003
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
lea rcx, [rsp + 0x1c8]
mov qword [rcx], 0
mov rdx, rax
call fcn.140288cb0
cmp byte [rsp + 0x9f], 0
jns 0x14028a38f
mov rcx, qword [rsp + 0x88]
call fcn.140240d14
mov rdi, qword [rsp + 0x1c8]
test rdi, rdi
jne 0x14028a3f4
mov ecx, 1
call fcn.1401de860
test al, al
jne 0x14028a419
cmp qword [rsp + 0x1c8], 0
je 0x14028a3c8
call fcn.1401de850
mov rcx, qword [rsp + 0x1c8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140242430
mov eax, ebx
add rsp, 0x1d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add rsi, 0x130
mov qword [rsp + 0x1c8], 0
call fcn.1401de850
mov rcx, rsi
mov rdx, rdi
call fcn.140288cb0
jmp 0x14028a3aa
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstallerutilinstall_service_work_item_impl.cc
lea rcx, [rsp + 0x88]
mov r8d, 0x299
mov r9d, 1
call fcn.1402b3940
lea rcx, [rsp + 0x98]
lea rdx, str.Failed_to_create_service
mov r8d, 0x19
call fcn.14027e630
mov rbx, rax
lea r14, [rsp + 0x70]
mov rcx, rsi
mov rdx, r14
call fcn.140288f20
cmp byte [r14 + 0x17], 0
jns 0x14028a47b
mov r14, qword [rsp + 0x70]
mov rcx, rbx
mov rdx, r14
call fcn.1402b3a80
cmp byte [rsp + 0x87], 0
jns 0x14028a49a
mov rcx, qword [rsp + 0x70]
call fcn.140240d14
lea rcx, [rsp + 0x88]
call fcn.1402b39c0
jmp 0x14028a3aa
Function at 0x140295850
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rdi, [rsp + 0x28]
mov qword [rdi], rdx
mov rdx, rdi
call fcn.1401cd6e0
lea rdx, [rsi + 0xb0]
mov r8d, dword [rdi]
mov rcx, qword [rsi + 0x78]
mov qword [rsp + 0x20], rdx
mov rdx, rax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1402958a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1402958c8
mov byte [rsi + 0xd1], 1
lock inc dword [rsi + 8]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140242430
nop
add rsp, 0x38
pop rdi
pop rsi
ret
mov rcx, rsi
xor edx, edx
call fcn.1400af750
jmp 0x1402958b3

Function at 0x1402979a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x140297ad0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x60], 0
je 0x140297b2c
mov edi, dword [rsi + 0x5c]
test bl, bl
je 0x140297b0c
mov dword [rsi + 0x5c], 0xffffffff
mov byte [rsi + 0x60], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140242430
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], rdi
mov eax, dword [rsi + 0x58]
cmp eax, 2
mov r14d, 1
cmovge r14d, eax
xor r15d, r15d
mov rcx, qword [rsi + 0x40]
call fcn.140263570
cmp eax, 0xffffffff
je 0x140297bae
mov byte [rsp + r15 + 0x58], al
inc r15
cmp r14, r15
jne 0x140297b4e
mov byte [rsp + 0x57], 0xaa
cmp byte [rsi + 0x61], 0
je 0x140297bb8
mov al, byte [rsp + 0x58]
mov byte [rsp + 0x57], al
test bl, bl
je 0x140297b8a
movzx edi, byte [rsp + 0x57]
mov dword [rsi + 0x5c], edi
jmp 0x140297b0c
mov edi, r14d
test rdi, rdi
jle 0x140297c5e
mov rdx, qword [rsi + 0x40]
dec rdi
mov eax, edi
movzx ecx, byte [rsp + rax + 0x58]
call fcn.140269068
cmp eax, 0xffffffff
jne 0x140297b8d
mov edi, 0xffffffff
jmp 0x140297b0c
lea r15, [rsp + 0x48]
mov qword [r15], rdi
lea r12, [rsp + 0x40]
mov qword [r12], rdi
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx edi, word [rdx + 6]
lea r9, [rsp + r14 + 0x58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x58]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x57]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r15
lea r8, [rsp + 0x58]
call qword [case.0x1402bbc90.0]
cmp eax, 1
jne 0x140297c47
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], di
cmp r14d, 8
je 0x140297bae
mov rcx, qword [rsi + 0x40]
call fcn.140263570
cmp eax, 0xffffffff
je 0x140297bae
mov byte [rsp + r14 + 0x58], al
inc r14
jmp 0x140297bc9
cmp eax, 2
je 0x140297bae
cmp eax, 3
je 0x140297b74
jmp 0x140297b7c
movzx edi, byte [rsp + 0x57]
jmp 0x140297b0c
Function at 0x140297f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x1402980b0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x5e], 0
je 0x14029810c
movzx edi, word [rsi + 0x5c]
test bl, bl
je 0x1402980ec
mov word [rsi + 0x5c], 0xffff
mov byte [rsi + 0x5e], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140242430
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], rdi
mov eax, dword [rsi + 0x58]
cmp eax, 2
mov r14d, 1
cmovge r14d, eax
xor r15d, r15d
mov rcx, qword [rsi + 0x40]
call fcn.140263570
cmp eax, 0xffffffff
je 0x140298199
mov byte [rsp + r15 + 0x58], al
inc r15
cmp r14, r15
jne 0x14029812e
mov word [rsp + 0x56], 0xaaaa
cmp byte [rsi + 0x5f], 0
je 0x1402981a2
movsx eax, byte [rsp + 0x58]
mov word [rsp + 0x56], ax
test bl, bl
je 0x140298172
movzx edi, word [rsp + 0x56]
mov word [rsi + 0x5c], di
jmp 0x1402980ec
mov edi, r14d
test rdi, rdi
jle 0x140298248
mov rdx, qword [rsi + 0x40]
dec rdi
mov eax, edi
movsx eax, byte [rsp + rax + 0x58]
movzx ecx, ax
call fcn.140269068
cmp eax, 0xffffffff
jne 0x140298175
mov di, 0xffff
jmp 0x1402980ec
lea r15, [rsp + 0x48]
mov qword [r15], rdi
lea r12, [rsp + 0x40]
mov qword [r12], rdi
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx edi, word [rdx + 6]
lea r9, [rsp + r14 + 0x58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x58]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x56]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r15
lea r8, [rsp + 0x58]
call qword [case.0x1402bbc90.0]
cmp eax, 1
jne 0x140298231
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], di
cmp r14d, 8
je 0x140298199
mov rcx, qword [rsi + 0x40]
call fcn.140263570
cmp eax, 0xffffffff
je 0x140298199
mov byte [rsp + r14 + 0x58], al
inc r14
jmp 0x1402981b3
cmp eax, 2
je 0x140298199
cmp eax, 3
je 0x140298156
jmp 0x140298160
movzx edi, word [rsp + 0x56]
jmp 0x1402980ec

Function at 0x1402984e0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140298517
movabs rcx, 0xf000000000000000
shl rax, 4
movsx r9, byte [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
inc rdx
cmp rdx, r8
jne 0x1402984f1
ret

Function at 0x140298580
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1402985b8
movabs rcx, 0xf000000000000000
shl rax, 4
movzx r9d, word [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
add rdx, 2
cmp rdx, r8
jne 0x140298591
ret
Function at 0x1402ae090
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.140240cd8
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1402ae100]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.140254594
mov qword [rbx], rax
test rax, rax
je 0x1402ae0e7
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x1402b29d0
Capabilities:
Move file

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.1401de320
test al, al
jne 0x1402b29f1
mov rcx, rsi
call fcn.1401de320
test al, al
je 0x1402b29fa
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x1402b9ce0
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x40]
mov qword [r14 + 0x50], rax
movaps xmm0, xmmword [0x1403aa440]
movaps xmmword [r14 + 0x40], xmm0
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.MoveUnsafe
lea r8, str....._base_files_file_util_win.cc
lea r15, [rsp + 0x20]
mov rcx, r15
mov r9d, 0x438
call fcn.1401de830
xor ebx, ebx
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.1401ea620
mov al, byte [rdi + 0x17]
test al, al
jns 0x1402b9da7
cmp qword [rdi + 8], 0x103
jbe 0x1402b9da7
lea rcx, [rsp + 0x40]
call fcn.1401ea680
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140242430
mov eax, ebx
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov cl, byte [rsi + 0x17]
test cl, cl
jns 0x1402b9dbc
cmp qword [rsi + 8], 0x103
jbe 0x1402b9dbc
xor ebx, ebx
jmp 0x1402b9d7b
mov rdx, rsi
test cl, cl
jns 0x1402b9dc6
mov rdx, qword [rsi]
mov rcx, rdi
test al, al
jns 0x1402b9dd0
mov rcx, qword [rdi]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov bl, 1
test eax, eax
jne 0x1402b9d7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, rdi
call fcn.1400f2200
test al, al
jne 0x1402b9e00
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1402b9db8
mov rcx, rdi
mov rdx, rsi
call fcn.1402b9e20
test al, al
jne 0x1402b9d7b
jmp 0x1402b9df6
Function at 0x14030c880
Capabilities:
Encode data using xor

Disassembly:
push rsi
movsxd r9, dword [rcx + 8]
movsxd rax, dword [rdx + 8]
cmp r9d, eax
jge 0x14030c8a5
mov r10, qword [rdx]
xor r8d, r8d
mov r11, r9
or r8, qword [r10 + r11*8]
inc r11
cmp rax, r11
jne 0x14030c897
jmp 0x14030c8a8
xor r8d, r8d
cmp eax, r9d
jge 0x14030c8bf
mov r10, qword [rcx]
mov r11, rax
or r8, qword [r10 + r11*8]
inc r11
cmp r9, r11
jne 0x14030c8b3
cmp r9d, eax
cmovl eax, r9d
test eax, eax
jle 0x14030c8e8
mov r9, qword [rcx]
mov r10, qword [rdx]
mov eax, eax
xor r11d, r11d
mov rsi, qword [r10 + r11*8]
xor rsi, qword [r9 + r11*8]
or r8, rsi
inc r11
cmp rax, r11
jne 0x14030c8d5
mov eax, dword [rdx + 0x10]
xor eax, dword [rcx + 0x10]
movsxd rcx, eax
xor eax, eax
or rcx, r8
sete al
pop rsi
ret
Function at 0x1403148c0
Capabilities:
Hash data using sha512

Disassembly:
push rsi
push rdi
sub rsp, 0x108
mov rsi, r8
mov r8, rdx
mov rdx, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x100], rax
movaps xmm0, xmmword [0x1403aa440]
lea rdi, [rsp + 0x28]
movups xmmword [rdi + 0xc0], xmm0
movups xmmword [rdi + 0xb0], xmm0
movups xmmword [rdi + 0xa0], xmm0
movups xmmword [rdi + 0x90], xmm0
movups xmmword [rdi + 0x80], xmm0
movups xmmword [rdi + 0x70], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x50], xmm0
movabs rax, 0x6a09e667f3bcc908
mov qword [rdi], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rdi + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rdi + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rdi + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rdi + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rdi + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rdi + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rdi + 0x38], rax
movabs rax, 0x4000000000
mov qword [rdi + 0xd0], rax
xorps xmm0, xmm0
movups xmmword [rdi + 0x40], xmm0
mov rcx, rdi
call fcn.14014ae80
mov edx, dword [rdi + 0xd4]
mov rcx, rsi
mov r8, rdi
call fcn.14014ea20
mov edx, 0xd8
mov rcx, rdi
call fcn.140212f90
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140242430
mov rax, rsi
add rsp, 0x108
pop rdi
pop rsi
ret
Function at 0x140315430
Capabilities:
Hash data using sha512

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1c8
movaps xmmword [rsp + 0x1b0], xmm6
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
mov rax, qword [r8 + 0x28]
test rax, rax
je 0x140315497
cmp qword [rax + 0x28], 0
je 0x140315497
mov dword [rsp + 0x20], 0x136
lea r9, str....._third_party_boringssl_srccrypto_fipsmoduleecdsaecdsa.c
xor r12d, r12d
mov ecx, 0x1a
xor edx, edx
mov r8d, 0x67
jmp 0x14031568b
mov rbx, qword [r8]
test rbx, rbx
je 0x14031566c
mov r14, qword [r8 + 0x10]
test r14, r14
je 0x14031566c
add r14, 0x18
movaps xmm6, xmmword [0x1403aa440]
lea r12, [rsp + 0xd0]
movups xmmword [r12 + 0xc0], xmm6
movups xmmword [r12 + 0xb0], xmm6
movups xmmword [r12 + 0xa0], xmm6
movups xmmword [r12 + 0x90], xmm6
movups xmmword [r12 + 0x80], xmm6
movups xmmword [r12 + 0x70], xmm6
movups xmmword [r12 + 0x60], xmm6
movups xmmword [r12 + 0x50], xmm6
lea r15, [rsp + 0x90]
movaps xmmword [r15 + 0x30], xmm6
movaps xmmword [r15 + 0x20], xmm6
movaps xmmword [r15 + 0x10], xmm6
movaps xmmword [r15], xmm6
movabs rax, 0x6a09e667f3bcc908
mov qword [r12], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [r12 + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [r12 + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [r12 + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [r12 + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [r12 + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [r12 + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [r12 + 0x38], rax
mov dword [r12 + 0xd0], 0
xorps xmm0, xmm0
movups xmmword [r12 + 0x40], xmm0
mov dword [r12 + 0xd4], 0x40
movsxd r8, dword [rbx + 0x18]
shl r8, 3
mov rcx, r12
mov rdx, r14
call fcn.14014ae80
mov rcx, r12
mov rdx, rdi
mov r8, rsi
call fcn.14014ae80
mov edx, dword [r12 + 0xd4]
mov rcx, r15
mov r8, r12
call fcn.14014ea20
movabs rbp, 0xaaaaaaaaaaaaaaaa
lea r13, [rsp + 0x40]
mov qword [rsp + 0x80], rbp
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movsxd r9, dword [rbx + 0x18]
mov r8, qword [rbx + 0x10]
mov qword [rsp + 0x20], r15
mov edx, 1
mov rcx, r13
call fcn.140312f00
test eax, eax
je 0x1403156bf
mov dword [rsp + 0x3c], 0xaaaaaaaa
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
mov rcx, rbx
lea rdx, [rsp + 0x3c]
mov r8, r14
mov r9, r13
call fcn.1403150e0
mov r12, rax
test rax, rax
jne 0x140315690
cmp dword [rsp + 0x3c], 0
jne 0x1403155f8
jmp 0x140315690
mov dword [rsp + 0x20], 0x13c
lea r9, str....._third_party_boringssl_srccrypto_fipsmoduleecdsaecdsa.c
xor r12d, r12d
mov ecx, 0x1a
xor edx, edx
mov r8d, 0x43
call fcn.1403497b0
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.140242430
mov rax, r12
movaps xmm6, xmmword [rsp + 0x1b0]
add rsp, 0x1c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r12d, r12d
jmp 0x140315690
Function at 0x1403626a0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
xor r15d, r15d
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
cmp rdi, rsi
jae 0x140362728
mov dword [rsp + 0x2c], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r12
test eax, eax
sete dl
mov ecx, dword [rsp + 0x2c]
test rcx, rcx
sete al
or al, dl
mov edx, 0
jne 0x140362721
mov rdx, rcx
add rdi, rdx
cmp al, 1
jne 0x1403626e2
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140242430
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14036d200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp edx, 0x33ff
jg 0x14036d222
add edx, edx
movzx r8d, dx
movzx edx, word [rcx]
cmp r8d, edx
jbe 0x14036d280
and edx, 1
or edx, 2
lea rcx, [rcx + rdx*2]
jmp 0x14036d20e
mov r8d, edx
shr r8d, 9
add r8d, 0x3400
shl edx, 6
and r8d, 0xfffe
mov eax, 0xffffffff
movzx r9d, word [rcx]
cmp r8d, r9d
jbe 0x14036d259
and r9d, 1
or r9, 2
mov r10, r9
lea rcx, [rcx + r10*2]
jmp 0x14036d23f
mov r10d, r9d
and r10d, 0x7ffe
cmp r8d, r10d
jne 0x14036d27f
movzx r10d, word [rcx + 2]
cmp r10w, dx
jae 0x14036d2ac
mov r10d, 3
test r9w, r9w
jns 0x14036d253
ret
mov r9d, edx
and r9d, 0x7ffe
mov eax, 0xffffffff
cmp r8d, r9d
jne 0x14036d27f
movzx eax, word [rcx + 2]
test dl, 1
je 0x14036d27f
shl eax, 0x10
mov r10d, eax
movzx eax, word [rcx + 4]
or eax, r10d
jmp 0x14036d27f
xor edx, r10d
test edx, 0xffc0
jne 0x14036d27f
and r10d, 0x3f
shl r10d, 0x10
jmp 0x14036d2a3

Function at 0x140371e70
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x110
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x108], rax
movaps xmm0, xmmword [0x1403aa440]
lea r14, [rsp + 0xc0]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov edx, 0x20
mov rcx, r8
mov r8, r14
call fcn.1403148c0
and byte [r14], 0xf8
mov al, byte [r14 + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [r14 + 0x1f], al
lea r15, [rsp + 0x20]
mov r8d, 0xa0
mov rcx, r15
mov dl, 0xaa
call fcn.140244560
lea r8, [0x1404003d0]
mov rcx, r15
mov rdx, r14
call fcn.140233bf0
mov rcx, rdi
mov rdx, r15
call fcn.140370f90
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.140242430
nop
add rsp, 0x110
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret