joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008aa40
Capabilities:
Create thread

Disassembly:
jmp 0x14008aa40
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebp, r9d
mov rdi, r8
mov rsi, rdx
mov r13, rcx
xor ebx, ebx
test rcx, rcx
setne bl
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xfffffffe00000000
shl ebx, 0x10
mov ecx, 0x10
call fcn.1401cfd80
mov r15, rax
mov rax, rsi
and rax, r12
cmp rax, qword [0x1403a7ec8]
jne 0x14008aaa4
mov rcx, rsi
call fcn.14017f670
mov qword [r15], rsi
test rdi, rdi
setne byte [r15 + 8]
mov dword [r15 + 0xc], ebp
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], 0
lea r8, [0x14008ae20]
xor ecx, ecx
mov rdx, r13
mov r9, r15
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r14, rax
test rax, rax
je 0x14008ab0b
test rdi, rdi
je 0x14008ab4f
mov qword [rdi], r14
test r14, r14
setne bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401d1390
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x14008ab24
mov edi, eax
cmp eax, 0x5af
je 0x14008ab24
cmp edi, 0xe
jne 0x14008ab5a
mov rcx, r13
call fcn.1402407a0
test r15, r15
je 0x14008aae5
mov rcx, qword [r15]
and r12, rcx
cmp r12, qword [0x1403a7ec8]
jne 0x14008ab45
call fcn.14017f7b0
mov rcx, r15
call fcn.1401cfdbc
jmp 0x14008aae5
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14008aae5
mov eax, dword [0x1403b6b28]
mov ecx, dword [0x1403b24e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14008abcd
lea rsi, [rsp + 0x38]
mov rcx, rsi
mov edx, edi
call fcn.140081a20
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
cmovs rax, qword [rsi + 8]
lea rdx, [rsp + 0x50]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rcx, qword [0x1403b6b20]
call fcn.1401a0a30
cmp byte [rsi + 0x17], 0
jns 0x14008ab2c
mov rcx, qword [rsp + 0x38]
call fcn.1401cfdbc
jmp 0x14008ab2c
lea rcx, [0x1403b6b28]
call fcn.1401cfee0
cmp dword [0x1403b6b28], 0xffffffff
jne 0x14008ab7b
lea rcx, str.create_thread_last_error
mov edx, 0x20
call fcn.1400f32c0
mov qword [0x1403b6b20], rax
lea rcx, [0x1403b6b28]
call fcn.1401cff78
jmp 0x14008ab7b

Function at 0x14008b310
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete al
add rsp, 0x38
ret
Function at 0x14008b3c0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
movaps xmmword [rsp + 0xa0], xmm6
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x98], rax
xor ebp, ebp
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
test eax, eax
jne 0x14008b433
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401d1390
mov eax, ebp
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [rsp + 0x90]
mov qword [rax], 0
mov r9d, esi
or r9d, 8
mov qword [rsp + 0x20], rax
xor ebp, ebp
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14008b46c
cmp eax, 2
je 0x14008b405
mov ebp, eax
jmp 0x14008b405
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbp, [rsp + 0x70]
mov qword [rbp + 0x10], rax
movaps xmm0, xmmword [0x14033b990]
movaps xmmword [rbp], xmm0
mov rcx, rbp
mov rdx, rdi
call fcn.1400573a0
mov al, byte [rbp + 0x17]
test al, al
mov rcx, qword [rbp + 8]
movzx r14d, al
mov rdx, r14
cmovs rdx, rcx
test rdx, rdx
je 0x14008b4db
test al, al
jns 0x14008b4b7
mov rbp, qword [rsp + 0x70]
cmp word [rbp + rdx*2 - 2], 0x5c
je 0x14008b4db
lea rbp, [rsp + 0x70]
mov rcx, rbp
mov dx, 0x5c
call fcn.14017b090
mov al, byte [rbp + 0x17]
mov rcx, qword [rbp + 8]
movzx r14d, al
xorps xmm6, xmm6
lea r15, [rsp + 0x50]
movaps xmmword [r15], xmm6
test al, al
cmovs r14, rcx
mov qword [r15 + 0x10], 0
lea r12, [rsp + 0x4c]
mov rbp, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea r13, [rsp + 0x70]
mov dword [rsp + 0x4c], 0x104
mov edx, 0x104
mov rcx, r15
call fcn.14008a710
mov rcx, qword [rsp + 0x90]
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
xor edx, edx
mov r8, rax
mov r9, r12
call rbp
test eax, eax
jne 0x14008b59d
mov edx, dword [rsp + 0x4c]
mov rcx, r15
xor r8d, r8d
call fcn.14017b4c0
mov rcx, r13
mov rdx, r14
xor r8d, r8d
call fcn.14017b4c0
movzx r8d, byte [rsp + 0x67]
mov rdx, r15
test r8b, r8b
jns 0x14008b570
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rcx, r13
call fcn.14017ae20
cmp byte [rsp + 0x87], 0
mov rdx, r13
jns 0x14008b58a
mov rdx, qword [rsp + 0x70]
mov rcx, rbx
mov r8d, esi
call fcn.14008b3c0
test eax, eax
je 0x14008b506
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
mov rdx, rdi
mov r8d, esi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov ebp, eax
cmp byte [rsp + 0x67], 0
jns 0x14008b5d0
mov rcx, qword [rsp + 0x50]
call fcn.1401cfdbc
cmp byte [rsp + 0x87], 0
jns 0x14008b405
mov rcx, qword [rsp + 0x70]
call fcn.1401cfdbc
jmp 0x14008b405
Function at 0x14008b600
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 4
lea r9, [rsp + 0x3c]
mov dword [r9], eax
lea rdi, [rsp + 0x38]
mov dword [rdi], eax
lea rax, [rsp + 0x34]
mov dword [rax], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008b687
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x14008b671
cmp dword [rsp + 0x38], 4
jne 0x14008b671
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401d1390
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret
mov edi, eax
jmp 0x14008b671

Function at 0x14008b690
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.1401d1330
sub rsp, rax
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea rsi, [rsp + 0x840]
mov r8d, 0x800
mov rcx, rsi
mov dl, 0xaa
call fcn.1401d34c0
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008b743
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x14008b747
lea rdx, [rsp + 0x840]
mov rcx, r14
call fcn.140063c90
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1401d1390
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x14008b724
cmp eax, 2
jne 0x14008b78f
lea rsi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rsi
mov dl, 0xaa
call fcn.1401d34c0
lea rcx, [rsp + 0x840]
mov rdx, rsi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x14008b796
lea rdx, [rsp + 0x40]
jmp 0x14008b71a
mov edi, 0x3f4
jmp 0x14008b724
mov edi, 0xea
jmp 0x14008b724

Function at 0x14008b7a0
Capabilities:
Set registry value

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x34]
mov dword [rax], r8d
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401d1390
mov eax, esi
add rsp, 0x40
pop rsi
ret

Function at 0x14008b800
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, r8
call fcn.1401f8b34
add eax, eax
add eax, 2
mov rcx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x14008b9a0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [rcx], 0
je 0x14008ba84
cmp dword [rsi + 8], 0
js 0x14008ba84
lea r15, [rsi + 0x10]
cmp byte [rsi + 0x27], 0
jns 0x14008baa6
mov ebp, dword [rsi + 0x20]
dec ebp
lea rdi, [rsp + 0x4c]
mov dword [rdi], ebp
lea r14, [rsi + 0x28]
mov eax, dword [rsi + 0x30]
mov rbx, qword [rsi + 0x28]
sub eax, ebx
add eax, 0xfffffffe
and eax, 0xfffffffe
lea r13, [rsi + 0x40]
mov dword [rsi + 0x40], eax
lea r12, [rsi + 0x44]
mov edx, ebp
mov rcx, r15
call fcn.14008a710
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 0
mov r8, rax
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
je 0x14008bab0
test eax, eax
jne 0x14008ba84
mov eax, dword [r13]
inc rax
and rax, 0xfffffffffffffffe
mov rcx, qword [r14]
mov word [rcx + rax], 0
mov dil, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401d1390
mov eax, edi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [rsi + 0x10]
cmp byte [rsi + 0x27], 0
jns 0x14008ba91
mov rax, qword [rax]
xor edi, edi
mov word [rax], di
mov rax, qword [rsi + 0x28]
mov word [rax], di
mov dword [rsi + 0x40], 0
jmp 0x14008ba64
mov ebp, 0xa
jmp 0x14008b9e9
mov edx, dword [rsi + 0x40]
inc rdx
shr rdx, 1
mov rdi, qword [rsi + 0x28]
mov rax, qword [rsi + 0x30]
sub rax, rdi
mov rcx, rax
sar rcx, 1
sub rdx, rcx
jb 0x14008baf0
lea r8, [rsp + 0x4a]
mov word [r8], 0
inc rdx
mov rcx, r14
call fcn.14008be60
mov rdi, qword [rsi + 0x28]
mov rax, qword [rsi + 0x30]
sub rax, rdi
add eax, 0xfffffffe
and eax, 0xfffffffe
mov dword [rsi + 0x40], eax
lea rbx, [rsp + 0x4c]
cmp dword [rbx], ebp
mov edx, 0x4000
cmovne edx, ebp
mov dword [rbx], edx
mov rcx, r15
call fcn.14008a710
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 0
mov r8, rax
mov r9, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x14008ba49
Function at 0x14008bbf0
Capabilities:
Query or enumerate registry key

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x70], rax
or r9d, 0x20019
mov qword [rsp + 0x20], rcx
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008bcca
lea rdi, [rsp + 0x60]
mov dword [rdi], 0
mov rcx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x58], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14008bcc1
mov edx, dword [rsp + 0x60]
dec edx
mov dword [rsi + 8], edx
mov rcx, qword [rsi]
test rcx, rcx
je 0x14008bcd1
test edx, edx
js 0x14008bcd1
lea r9, [rsp + 0x6c]
mov dword [r9], 0x104
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x60], rax
lea r8, [rsi + 0xc]
mov qword [rsp + 0x38], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14008bcd7
jmp 0x14008bcd1
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsi], 0
mov word [rsi + 0xc], 0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401d1390
nop
add rsp, 0x78
pop rdi
pop rsi
ret

Function at 0x14008bd70
Capabilities:
Query or enumerate registry key

Disassembly:
push rsi
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [rcx + 8]
lea edx, [rax - 1]
mov dword [rcx + 8], edx
mov rcx, qword [rcx]
test rcx, rcx
je 0x14008bdf2
test eax, eax
jle 0x14008bdf2
lea r9, [rsp + 0x54]
mov dword [r9], 0x104
movabs r8, 0xaaaaaaaaaaaaaaaa
lea rax, [rsp + 0x48]
mov qword [rax], r8
lea r8, [rsi + 0xc]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14008bdf2
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401d1390
nop
add rsp, 0x60
pop rsi
ret
mov word [rsi + 0xc], 0
jmp 0x14008bdde
Function at 0x14008feb0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov edi, edx
mov rsi, rcx
lea rax, str._u__
mov qword [rcx], rax
add rcx, 8
call fcn.140189370
lea rcx, [rsi + 0x10]
call fcn.140189370
xor ebx, ebx
mov byte [rsi + 0x18], bl
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], ebx
call fcn.140189370
mov byte [rsi + 0x48], bl
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], rbx
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
movups xmmword [rsi + 0xc0], xmm6
movups xmmword [rsi + 0xd0], xmm6
mov qword [rsi + 0xe0], rbx
mov ebp, 0x3f800000
mov dword [rsi + 0xe8], ebp
mov dword [rsi + 0xf0], ebx
movups xmmword [rsi + 0xf8], xmm6
movups xmmword [rsi + 0x108], xmm6
mov dword [rsi + 0x118], ebp
movups xmmword [rsi + 0x120], xmm6
movups xmmword [rsi + 0x130], xmm6
mov dword [rsi + 0x140], ebp
movups xmmword [rsi + 0x148], xmm6
movups xmmword [rsi + 0x158], xmm6
mov dword [rsi + 0x168], ebp
movups xmmword [rsi + 0x170], xmm6
movups xmmword [rsi + 0x180], xmm6
mov dword [rsi + 0x190], ebp
mov qword [rsi + 0x1b0], rbx
movups xmmword [rsi + 0x198], xmm6
mov dword [rsi + 0x1a8], ebx
mov eax, dword [0x140384a6c]
mov dword [rsi + 0x1b8], eax
lea rcx, [rsi + 0x1c0]
call fcn.1400f53b0
lea rcx, [rsi + 0x310]
movups xmmword [rsi + 0x2f8], xmm6
mov qword [rsi + 0x308], rbx
xor edx, edx
call fcn.1400ed1f0
lea rcx, [rsi + 0x318]
xor edx, edx
call fcn.1400ed1f0
lea rcx, [rsi + 0x320]
xor edx, edx
call fcn.1400ed1f0
movups xmmword [rsi + 0x328], xmm6
movups xmmword [rsi + 0x338], xmm6
mov dword [rsi + 0x348], ebp
movups xmmword [rsi + 0x350], xmm6
movups xmmword [rsi + 0x360], xmm6
movups xmmword [rsi + 0x370], xmm6
mov byte [rsi + 0x380], bl
mov dword [rsi + 0x384], edi
mov byte [rsi + 0x388], bl
movups xmmword [rsi + 0x390], xmm6
movups xmmword [rsi + 0x3a0], xmm6
call fcn.140039ae0
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rsi + 0x1a8], eax
cdqe
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x1a0], rax
mov rcx, rsi
call fcn.1400900e0
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
jne 0x1400900cb
call fcn.1400f4c40
lea r8, str.TraceLog
mov rcx, rax
mov rdx, rsi
xor r9d, r9d
call fcn.1400f4cf0
mov qword [0x1403b8f38], rsi
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [0x1403db008]
jmp 0x140090099
Function at 0x14009b500
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, r9
mov r14, r8
mov r15, rdx
mov r12, rcx
mov rdi, qword [rsp + 0xb0]
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
test rdi, rdi
je 0x14009b633
mov ecx, dword [rdi + 0x2c]
call fcn.1401a45c0
test rax, rax
je 0x14009b64a
mov rbx, rax
xor ecx, ecx
call fcn.1401a4600
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdi
mov rax, qword [rdi + 0x10]
lea rcx, [0x14025d290]
cmp rax, rcx
jne 0x14009b63a
xorps xmm0, xmm0
movups xmmword [rbx + 0x5c], xmm0
movups xmmword [rbx + 0x50], xmm0
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x20], xmm0
movaps xmm0, xmmword [0x140347d30]
movups xmmword [rbx], xmm0
movaps xmm0, xmmword [0x140347d40]
movups xmmword [rbx + 0x10], xmm0
mov dword [rbx + 0x6c], 0x20
lea rbx, [rsp + 0x30]
mov rax, qword [rbx]
mov rax, qword [rax + 0x18]
mov rcx, rbx
mov rdx, r12
mov r8, r15
call qword [0x1403db008]
mov rax, qword [rbx]
mov rax, qword [rax + 0x20]
mov rcx, rbx
mov rdx, r14
call qword [0x1403db008]
mov rax, qword [rbx]
test rsi, rsi
je 0x14009b5ed
mov ecx, dword [rax + 4]
mov dword [rsi], ecx
mov edx, dword [rax + 0x2c]
mov rcx, qword [rsp + 0x38]
call fcn.1401a4640
mov esi, 1
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call fcn.1401a4600
mov rax, qword [rsp + 0x48]
test rax, rax
jne 0x14009b671
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401d1390
mov eax, esi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor ebx, ebx
jmp 0x14009b56b
lea rcx, [rsp + 0x30]
call qword [0x1403db008]
jmp 0x14009b5b2
mov dword [rsp + 0x20], 0xd2
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_digest_digest.c
xor edi, edi
mov ecx, 0x1d
xor edx, edx
mov r8d, 0x41
call fcn.1402b48b0
xor esi, esi
jmp 0x14009b604
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [0x1403db008]
jmp 0x14009b616

Function at 0x14009b6e0
Capabilities:
Hash data using sha256

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
cmp qword [rcx], rdx
je 0x14009b712
mov ecx, dword [rdi + 0x2c]
call fcn.1401a45c0
test rax, rax
je 0x14009b773
mov rbx, rax
mov rcx, qword [rsi + 8]
call fcn.1401a4600
mov qword [rsi + 8], rbx
mov qword [rsi], rdi
mov rax, qword [rdi + 0x10]
lea rcx, [0x14025d290]
cmp rax, rcx
jne 0x14009b768
mov rax, qword [rsi + 8]
xorps xmm0, xmm0
movups xmmword [rax + 0x5c], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x140347d30]
movups xmmword [rax], xmm0
movaps xmm0, xmmword [0x140347d40]
movups xmmword [rax + 0x10], xmm0
mov dword [rax + 0x6c], 0x20
mov esi, 1
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
call qword [0x1403db008]
jmp 0x14009b759
mov dword [rsp + 0x20], 0xd2
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_digest_digest.c
xor esi, esi
mov ecx, 0x1d
xor edx, edx
mov r8d, 0x41
call fcn.1402b48b0
jmp 0x14009b75e
Function at 0x14009b970
Capabilities:
Hash data using sha256

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov rsi, r8
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0x98], rax
xorps xmm0, xmm0
lea rdi, [rsp + 0x50]
movups xmmword [rdi + 0x34], xmm0
movups xmmword [rdi + 0x28], xmm0
movups xmmword [rdi + 0x18], xmm0
movups xmmword [rdi + 8], xmm0
movups xmmword [rdi - 8], xmm0
movaps xmm0, xmmword [0x140347d30]
movups xmmword [rdi - 0x28], xmm0
movaps xmm0, xmmword [0x140347d40]
movups xmmword [rdi - 0x18], xmm0
mov dword [rdi + 0x44], 0x20
test rdx, rdx
je 0x14009ba2e
mov rbx, rdx
mov r14, rcx
lea eax, [rdx*8]
mov rcx, rdx
shr rcx, 0x1d
mov dword [rsp + 0x4c], ecx
mov dword [rsp + 0x48], eax
cmp rdx, 0x40
jb 0x14009ba18
mov r8, rbx
shr r8, 6
lea rcx, [rsp + 0x28]
mov rdx, r14
call fcn.140013a00
mov r8, rbx
and r8, 0x3f
je 0x14009ba2e
and rbx, 0xffffffffffffffc0
add r14, rbx
jmp 0x14009ba1b
mov r8, rbx
mov dword [rsp + 0x90], r8d
mov rcx, rdi
mov rdx, r14
call fcn.1401d2e10
mov ecx, dword [rsp + 0x90]
lea rax, [rcx + 1]
mov r14d, dword [rsp + 0x48]
mov ebp, dword [rsp + 0x4c]
mov byte [rsp + rcx + 0x50], 0x80
cmp rcx, 0x38
jae 0x14009bafc
cmp rax, 0x38
je 0x14009ba6f
mov r8d, 0x38
sub r8, rax
lea rcx, [rsp + rax]
add rcx, 0x50
xor edx, edx
call fcn.1401d34c0
bswap ebp
lea rbx, [rsp + 0x28]
mov dword [rbx + 0x60], ebp
bswap r14d
mov dword [rbx + 0x64], r14d
mov r8d, 1
mov rcx, rbx
mov rdx, rdi
call fcn.140013a00
xorps xmm0, xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi], xmm0
mov dword [rdi + 0x40], 0
mov eax, dword [rbx + 0x6c]
lea ecx, [rax - 0x21]
cmp ecx, 0xffffffe3
jb 0x14009bacc
shr rax, 2
xor ecx, ecx
mov edx, dword [rsp + rcx*4 + 0x28]
bswap edx
mov dword [rsi + rcx*4], edx
inc rcx
cmp rax, rcx
jne 0x14009babb
lea rcx, [rsp + 0x28]
mov edx, 0x70
call fcn.1401a4640
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401d1390
mov rax, rsi
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
cmp ecx, 0x3f
je 0x14009bb19
mov r8d, 0x3f
sub r8, rcx
lea rcx, [rsp + rax]
add rcx, 0x50
xor edx, edx
call fcn.1401d34c0
lea rcx, [rsp + 0x28]
mov r8d, 1
mov rdx, rdi
call fcn.140013a00
xor eax, eax
jmp 0x14009ba57
Function at 0x14009e360
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm8
movaps xmmword [rsp + 0xc0], xmm7
movaps xmmword [rsp + 0xb0], xmm6
mov qword [rsp + 0x28], r9
mov rax, qword [0x1403a7038]
xor rax, rsp
mov qword [rsp + 0xa8], rax
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov esi, 1
test rdx, rdx
je 0x14009e52e
mov r13, r8
mov rdi, rdx
mov rbx, rcx
mov r14, qword [rsp + 0x150]
mov r12d, dword [r14 + 4]
xor eax, eax
movaps xmm8, xmmword [0x140347d30]
movaps xmm7, xmmword [0x140347d40]
lea rsi, [rsp + 0x30]
xor r15d, r15d
mov ecx, r15d
bswap ecx
mov dword [rsp + 0x5c], ecx
cmp rax, r14
je 0x14009e423
mov ecx, dword [r14 + 0x2c]
call fcn.1401a45c0
test rax, rax
je 0x14009e591
mov rbp, rax
mov rcx, qword [rsp + 0x38]
call fcn.1401a4600
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r14
mov rax, qword [r14 + 0x10]
lea rcx, [0x14025d290]
cmp rax, rcx
jne 0x14009e581
mov rax, qword [rsp + 0x38]
movups xmmword [rax + 0x5c], xmm6
movups xmmword [rax + 0x50], xmm6
movups xmmword [rax + 0x40], xmm6
movups xmmword [rax + 0x30], xmm6
movups xmmword [rax + 0x20], xmm6
movups xmmword [rax], xmm8
movups xmmword [rax + 0x10], xmm7
mov dword [rax + 0x6c], 0x20
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x18]
mov rcx, rsi
mov rdx, r13
mov r8, qword [rsp + 0x28]
call qword [0x1403db008]
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x18]
mov r8d, 4
mov rcx, rsi
lea rdx, [rsp + 0x5c]
call qword [0x1403db008]
cmp rdi, r12
jb 0x14009e4d7
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x20]
mov rcx, rsi
mov rdx, rbx
call qword [0x1403db008]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov edx, dword [rax + 0x2c]
call fcn.1401a4640
sub rdi, r12
je 0x14009e529
add rbx, r12
inc r15d
mov rax, qword [rsp + 0x30]
jmp 0x14009e3ec
movaps xmm0, xmmword [0x14033b990]
lea rsi, [rsp + 0x60]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rbp, [rsp + 0x30]
mov rax, qword [rbp]
mov rax, qword [rax + 0x20]
mov rcx, rbp
mov rdx, rsi
call qword [0x1403db008]
mov rax, qword [rbp]
mov rcx, qword [rbp + 8]
mov edx, dword [rax + 0x2c]
call fcn.1401a4640
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.1401d2e10
mov esi, 1
mov rcx, qword [rsp + 0x38]
call fcn.1401a4600
mov rax, qword [rsp + 0x48]
test rax, rax
jne 0x14009e5b9
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1401d1390
mov eax, esi
movaps xmm6, xmmword [rsp + 0xb0]
movaps xmm7, xmmword [rsp + 0xc0]
movaps xmm8, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x30]
call qword [0x1403db008]
jmp 0x14009e45f
mov dword [rsp + 0x20], 0xd2
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_digest_digest.c
xor esi, esi
mov ecx, 0x1d
xor edx, edx
mov r8d, 0x41
call fcn.1402b48b0
jmp 0x14009e52e
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [0x1403db008]
jmp 0x14009e542