joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004bbd0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x14004bc18
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x14004bc21
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14004bc08
mov qword [rdi], rsi
call fcn.14004cb60
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.14004cb60
mov rcx, qword [rdi]
call fcn.14004fcb0
mov qword [rdi], 0
jmp 0x14004bbf6
Function at 0x14004f360
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov esi, r8d
mov r14, rdx
mov r15, rcx
mov rax, qword [0x140173028]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x50]
mov qword [rdi + 0x50], r12
movaps xmm0, xmmword [0x14014df90]
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.WriteAtCurrentPos
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0x88
call fcn.14004cb40
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.140054820
test esi, esi
js 0x14004f468
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], 0
call fcn.140052ae0
test al, al
jne 0x14004f46f
lea rdi, [rsp + 0x2c]
mov dword [rdi], 0xaaaaaaaa
mov rcx, qword [r15]
mov qword [rsp + 0x20], 0
mov rdx, r14
mov r8d, esi
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [rdi]
lea rcx, [rsp + 0x30]
call fcn.140052b70
lea rcx, [rsp + 0x50]
call fcn.140054af0
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140083c00
mov eax, esi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x14004f43b
mov r9d, esi
lea rdx, str.File::WriteAtCurrentPos
lea rcx, [rsp + 0x30]
mov r8, r15
call fcn.1400d83f0
jmp 0x14004f402
Function at 0x14004f490
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc0
mov r12d, r8d
mov r14, rdx
mov r15, rcx
mov rax, qword [0x140173028]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbp, [rsp + 0x60]
mov qword [rbp + 0x50], rax
movaps xmm0, xmmword [0x14014df90]
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
lea rdx, str.DoInitialize
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov r9d, 0x160
call fcn.14004cb40
mov rcx, rbp
mov rdx, rbx
xor r8d, r8d
call fcn.140054820
mov eax, r12d
and eax, 1
neg eax
and eax, 3
test r12b, 2
mov edx, 1
cmove edx, eax
test r12b, 4
mov ecx, 4
cmovne edx, ecx
test r12b, 8
mov ebp, 2
cmove ebp, edx
test r12b, 0x10
mov eax, 5
cmove eax, ebp
test eax, eax
je 0x14004f6f8
mov edx, r12d
and edx, 0x40
shl edx, 0x18
test r12b, 0x80
cmove ecx, edx
mov edx, r12d
rol edx, 0x1a
mov edi, r12d
shl edi, 0xb
and edi, 0x20000000
mov esi, r12d
shr esi, 4
and esi, 0x10000
and edx, 0x80000100
or edx, edi
or edx, esi
or edx, ecx
mov ecx, r12d
shr ecx, 8
and ecx, 3
mov r8d, r12d
shr r8d, 0xd
and r8d, 4
or r8d, ecx
xor r8d, 3
mov edi, r12d
and edi, 0x400
mov ecx, edi
shl ecx, 0x14
mov ebp, r12d
shr ebp, 3
and ebp, 0x100
or ebp, ecx
mov ecx, r12d
shr ecx, 0xb
and ecx, 2
or ecx, ebp
mov ebp, r12d
shl ebp, 0xd
and ebp, 0x4000000
or ebp, ecx
mov ecx, r12d
shl ecx, 8
mov ebx, ecx
and ebx, 0x2000000
or ebx, ebp
and ecx, 0x8000000
or ecx, ebx
cmp byte [r14 + 0x17], 0
jns 0x14004f608
mov r14, qword [r14]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], 0
mov rcx, r14
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp qword [r15], rax
je 0x14004f664
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [r15]
inc rax
cmp rax, 2
jae 0x14004f6df
mov rax, rbx
inc rax
cmp rax, 2
jb 0x14004f659
mov qword [r15], rbx
call fcn.14004cb60
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [r15]
inc rbx
cmp rbx, 2
jb 0x14004f6cc
shr edi, 0xa
mov dword [r15 + 0x24], 0
mov byte [r15 + 0x29], dil
test r12b, 4
jne 0x14004f6ba
test r12b, 0xa
je 0x14004f68d
mov byte [r15 + 0x28], 1
lea rcx, [rsp + 0x60]
call fcn.140054af0
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140083c00
nop
add rsp, 0xc0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne byte [r15 + 0x28]
jmp 0x14004f68d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400d3b80
mov dword [r15 + 0x24], eax
jmp 0x14004f68d
call fcn.14004cb60
mov rcx, qword [r15]
call fcn.14004fcb0
mov qword [r15], 0
jmp 0x14004f645
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [r15 + 0x24], 0xffffffff
jmp 0x14004f68d
Function at 0x14004f740
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rdx]
mov qword [rdx], 0
lea rbp, [rbx + 1]
cmp rbp, 2
jae 0x14004f7b9
cmp qword [rsi], rbx
je 0x14004f795
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14004f7c0
cmp rbp, 2
jb 0x14004f78c
mov qword [rsi], rbx
call fcn.14004cb60
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x14004f7d6
mov rax, rsi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.14004cb60
jmp 0x14004f764
call fcn.14004cb60
mov rcx, qword [rsi]
call fcn.14004fcb0
mov qword [rsi], 0
jmp 0x14004f77e
call fcn.14004cb60
mov rcx, qword [rdi]
call fcn.14004fcb0
mov qword [rdi], 0
jmp 0x14004f7ab

Function at 0x14004fb40
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1058
call fcn.140083ba0
sub rsp, rax
mov qword [rsp + 0x38], r8
mov r13, rdx
mov rbx, rcx
mov rax, qword [0x140173028]
xor rax, rsp
mov qword [rsp + 0x1050], rax
lea r15, [rsp + 0x850]
mov r8d, 0x800
mov rcx, r15
mov dl, 0xaa
call fcn.140085d30
lea r12, [rsp + 0x44]
mov dword [r12], 1
lea r14, [rsp + 0x40]
mov dword [r14], 0x800
lea rsi, [rsp + 0x48]
mov byte [rsi], 0xaa
mov rdi, qword [rbx]
lea rdx, str.ReadValue
lea r8, str..._.._base_win_registry.cc
lea rbp, [rsp + 0x50]
mov rcx, rbp
mov r9d, 0x1a1
call fcn.14004cb40
mov rcx, rsi
mov rdx, rbp
mov r8, rdi
mov r9d, 1
call fcn.1400546a0
mov rcx, qword [rbx]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov rdx, r13
xor r8d, r8d
mov r9, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, rsi
call fcn.1400398c0
test edi, edi
jne 0x14004fc2e
mov eax, dword [rsp + 0x44]
cmp eax, 1
jne 0x14004fc54
lea rdx, [rsp + 0x850]
mov rcx, qword [rsp + 0x38]
call fcn.140047e90
xor edi, edi
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.140083c00
mov eax, edi
add rsp, 0x1058
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp eax, 2
jne 0x14004fc9c
lea rsi, [rsp + 0x50]
mov r8d, 0x800
mov rcx, rsi
mov dl, 0xaa
call fcn.140085d30
lea rcx, [rsp + 0x850]
mov rdx, rsi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x40], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x14004fca3
lea rdx, [rsp + 0x50]
jmp 0x14004fc22
mov edi, 0x3f4
jmp 0x14004fc2e
mov edi, 0xea
jmp 0x14004fc2e
Function at 0x140055130
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14017f8a0]
mov ecx, dword [0x14017c9f0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005516c
movzx ecx, word [0x14017f870]
cmp cx, 9
jne 0x1400551b4
mov eax, 1
add rsp, 0x28
ret
lea rcx, [0x14017f8a0]
call fcn.1400828b0
cmp dword [0x14017f8a0], 0xffffffff
jne 0x140055155
xorps xmm0, xmm0
movups xmmword [0x14017f890], xmm0
movups xmmword [0x14017f880], xmm0
movups xmmword [0x14017f870], xmm0
lea rcx, [0x14017f870]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x14017f8a0]
call fcn.140082948
jmp 0x140055155
cmp cx, 5
jg 0x1400551ce
xor eax, eax
test cx, cx
je 0x140055167
cmp cx, 5
jne 0x1400551eb
mov eax, 3
jmp 0x140055167
cmp cx, 6
jne 0x1400551db
mov eax, 2
jmp 0x140055167
cmp cx, 0xc
jne 0x1400551eb
mov eax, 4
jmp 0x140055167
mov eax, 5
jmp 0x140055167
Function at 0x140055420
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movapd xmmword [rsp + 0x40], xmm6
mov rsi, rcx
mov rax, qword [0x140173028]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
call fcn.140053e00
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
movsd xmm0, qword [0x14017f8c0]
xorpd xmm6, xmm6
ucomisd xmm0, xmm6
jne 0x14005547d
jnp 0x1400554e2
ucomisd xmm0, xmm6
jne 0x140055489
jnp 0x14005561c
movsd xmm1, qword [rsp + 0x28]
unpcklps xmm1, xmmword [0x14014dfa0]
subpd xmm1, xmmword [0x14014dfb0]
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
divsd xmm2, xmm0
mulsd xmm2, qword [0x1401580d0]
cvttsd2si rax, xmm2
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140083c00
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov r12d, eax
call rbx
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x14017f8d0]
mov ecx, dword [0x14017c9f0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140055623
mov eax, dword [0x14017f8e0]
mov ecx, dword [0x14017c9f0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005565d
rdtsc
mov r14, rax
mov r15, rdx
xor edi, edi
lea rbx, [rsp + 0x30]
mov qword [rbx], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbp, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rbx], rdi
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rbp, qword [0x14017f8d8]
movq xmm0, rbp
punpckldq xmm0, xmmword [0x14014dfa0]
subpd xmm0, xmmword [0x14014dfb0]
movapd xmm1, xmm0
unpckhpd xmm1, xmm0
addsd xmm1, xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rdi]
divsd xmm1, xmm0
xorpd xmm0, xmm0
movsd xmm2, qword [0x1401580c8]
ucomisd xmm2, xmm1
ja 0x14005547d
shl r15, 0x20
or r14, r15
sub r14, qword [0x14017f8c8]
movq xmm2, r14
punpckldq xmm2, xmmword [0x14014dfa0]
subpd xmm2, xmmword [0x14014dfb0]
movapd xmm0, xmm2
unpckhpd xmm0, xmm2
addsd xmm0, xmm2
divsd xmm0, xmm1
movsd qword [0x14017f8c0], xmm0
jmp 0x14005547d
xor eax, eax
jmp 0x1400554bb
lea rcx, [0x14017f8d0]
call fcn.1400828b0
cmp dword [0x14017f8d0], 0xffffffff
jne 0x14005552c
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x14017f8c8], rdx
lea rcx, [0x14017f8d0]
call fcn.140082948
jmp 0x14005552c
lea rcx, [0x14017f8e0]
call fcn.1400828b0
cmp dword [0x14017f8e0], 0xffffffff
jne 0x140055551
lea rbx, [rsp + 0x30]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
mov qword [0x14017f8d8], rax
lea rcx, [0x14017f8e0]
call fcn.140082948
jmp 0x140055551
Function at 0x14005c450
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x14017c5d0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14005c484
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x14005c484
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x14005c47e

Function at 0x14005c490
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x14017c5d0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14005c4ce
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x14005c4c7
call fcn.14002cb30
jmp 0x14005c4ae
Function at 0x14005c4e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x1040
call fcn.140083ba0
sub rsp, rax
mov r14, rdx
mov r15, rcx
mov rax, qword [0x140173028]
xor rax, rsp
mov qword [rsp + 0x1038], rax
mov eax, 0xffffffff
mov qword [rcx], rax
mov ecx, dword [0x14017c5d0]
cmp ecx, 0xffffffff
je 0x14005c529
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14005c5a3
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x14017c5d0]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
je 0x14005c680
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14005c740
lea rbx, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rbx
xor edx, edx
call fcn.140085d30
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.1400827cc
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rbx
call fcn.140085680
mov ecx, dword [rsp + 0x2c]
or rdi, 3
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
mov eax, dword [0x1401844f8]
mov ecx, dword [0x14017c9f0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005c6e7
mov rbx, qword [0x1401844f0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14005c72d
mov rax, qword [0x140182ce0]
inc rax
xor ecx, ecx
lea rdx, [0x140182cf0]
nop word cs:[rax + rax]
lea edi, [rax + rcx]
movzx edi, dil
lea rsi, [rdi + rdi*2]
cmp dword [rdx + rsi*8], 0
je 0x14005c61f
inc rcx
cmp rcx, 0x100
jne 0x14005c600
jmp 0x14005c63e
lea rax, [rdx + rsi*8]
mov dword [rax], 1
mov qword [rax + 8], r14
mov qword [0x140182ce0], rdi
mov dword [r15], edi
mov eax, dword [rax + 0x10]
mov dword [r15 + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [r15]
cmp eax, 0xffffffff
je 0x14005c73a
cmp eax, 0x100
jge 0x14005c73d
mov rcx, qword [rsp + 0x1038]
xor rcx, rsp
call fcn.140083c00
mov rax, r15
add rsp, 0x1040
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [rsp + 0x2c]
call fcn.140112680
test al, al
je 0x14005c743
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
je 0x14005c6c2
mov eax, 0xffffffff
lock cmpxchg dword [0x14017c5d0], ecx
je 0x14005c544
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x14017c5d0]
mov dword [rsp + 0x2c], ecx
jmp 0x14005c544
lea rcx, [rsp + 0x2c]
call fcn.140112680
test al, al
je 0x14005c746
cmp dword [rsp + 0x2c], 0xffffffff
je 0x14005c746
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
jmp 0x14005c69b
lea rcx, [0x1401844f8]
call fcn.1400828b0
cmp dword [0x1401844f8], 0xffffffff
jne 0x14005c5c8
mov ecx, 8
call fcn.140082758
mov rdi, rax
mov rcx, rax
call fcn.140051220
mov qword [0x1401844f0], rdi
lea rcx, [0x1401844f8]
call fcn.140082948
jmp 0x14005c5c8
mov rcx, rbx
call fcn.140051230
jmp 0x14005c5e0
int3
int3
int3
int3
int3
Function at 0x1400619b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
movzx eax, byte [rcx + 0x4f]
test al, al
js 0x140061a8f
test rax, rax
jne 0x140061a7e
cmp dword [rsi + 0x50], 0
jne 0x140061a7e
mov byte [rsi + 0x54], 0
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
je 0x140061ac1
lea rdi, [rsi + 0x20]
movabs r14, 0x100003600
lea rcx, [rax + 1]
mov qword [rsi + 0x10], rcx
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.1400470cc
cmp rax, 0xffffffffffffffff
jne 0x140061aaf
cmp dword [rsi + 0x58], 1
je 0x140061a98
mov rax, qword [rsi + 0x10]
mov bl, 1
cmp rax, qword [rsi + 0x18]
je 0x140061ac7
nop word cs:[rax + rax]
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.1400470cc
cmp rax, 0xffffffffffffffff
jne 0x140061ac7
cmp dword [rsi + 0x58], 1
mov rax, qword [rsi + 0x10]
je 0x140061a6d
inc rax
mov qword [rsi + 0x10], rax
cmp rax, qword [rsi + 0x18]
jne 0x140061a40
jmp 0x140061ac7
movzx ecx, byte [rax]
cmp rcx, 0x20
ja 0x140061a5e
bt r14, rcx
jae 0x140061a5e
jmp 0x140061ac7
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400ed330
mov rax, qword [rsi + 0x40]
jmp 0x1400619c8
mov rax, qword [rsi + 8]
movzx eax, byte [rax]
cmp rax, 0x20
ja 0x140061a25
bt r14, rax
jae 0x140061a25
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
jne 0x1400619ff
mov byte [rsi + 0x54], 1
xor ebx, ebx
mov eax, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140064220
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
cmp rdx, r9
mov r10, r9
cmovb r10, rdx
xor eax, eax
test r10, r10
je 0x14006428e
xor r11d, r11d
mov r14, qword [r8 + r11*8]
mov r15, qword [rcx + r11*8]
mov rbx, r15
xor rbx, r14
mov edi, eax
lea rax, [rbx - 1]
mov rsi, r15
sub rsi, r14
xor rsi, r15
or rsi, rbx
not rbx
and rax, rbx
sar rax, 0x3f
xor rsi, r15
sar rsi, 0x3f
mov rbx, rsi
not rsi
and esi, 1
or rsi, rbx
mov rbx, rax
and edi, ebx
not rax
and rax, rsi
or rax, rdi
inc r11
cmp r10, r11
jne 0x14006423b
cmp rdx, r9
jb 0x1400642c4
jbe 0x1400642ee
xor esi, esi
or rsi, qword [rcx + r9*8]
inc r9
cmp rdx, r9
jne 0x140064297
mov rcx, rsi
not rcx
dec rsi
and rsi, rcx
sar rsi, 0x3f
mov rcx, rsi
and ecx, eax
not rsi
and esi, 1
or esi, ecx
mov eax, esi
jmp 0x1400642ee
xor ecx, ecx
or rcx, qword [r8 + rdx*8]
inc rdx
cmp r9, rdx
jne 0x1400642c6
mov rdx, rcx
not rdx
dec rcx
and rcx, rdx
sar rcx, 0x3f
mov rdx, rcx
and edx, eax
not rcx
or ecx, edx
mov eax, ecx
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400653d0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
movsxd rax, dword [rdx + 8]
test rax, rax
je 0x1400654c3
mov r14, rcx
mov rcx, qword [rdx]
xor edi, edi
xor esi, esi
or rsi, qword [rcx + rdi*8]
inc rdi
cmp rax, rdi
jne 0x1400653f0
test rsi, rsi
je 0x1400654c3
test eax, eax
jle 0x1400654e8
mov rax, qword [rdx]
test byte [rax], 1
je 0x1400654e8
cmp dword [rdx + 0x10], 0
jne 0x140065521
lea rdi, [r14 + 0x18]
mov rcx, rdi
call fcn.1400f0270
test rax, rax
je 0x140065541
mov eax, dword [r14 + 0x20]
test eax, eax
jle 0x140065508
mov rdx, qword [rdi]
lea rcx, [rax - 1]
cmp qword [rdx + rax*8 - 8], 0
mov rax, rcx
je 0x14006543c
inc ecx
mov dword [r14 + 0x20], ecx
mov rax, qword [rdi]
mov r9, qword [rax]
mov ebx, 1
mov edx, 0x40
xor ecx, ecx
movabs r8, 0x8000000000000000
mov esi, ebx
and esi, 1
neg rsi
mov rax, r9
and rax, rsi
mov rdi, rax
xor rdi, rbx
shr rdi, 1
and rax, rbx
add rax, rdi
and rsi, r8
shr rcx, 1
or rcx, rsi
mov rbx, rax
dec rdx
jne 0x140065478
mov qword [r14 + 0x30], rcx
mov qword [r14 + 0x38], 0
mov esi, 1
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov dword [rsp + 0x20], 0xa5
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x69
call fcn.14011e510
jmp 0x1400654b7
mov dword [rsp + 0x20], 0xa9
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x68
jmp 0x1400654e1
mov dword [r14 + 0x20], eax
test eax, eax
jne 0x14006545c
mov dword [r14 + 0x28], 0
jmp 0x14006545c
mov dword [rsp + 0x20], 0xad
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x6d
jmp 0x1400654e1
mov dword [rsp + 0x20], 0xb3
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x44
jmp 0x1400654e1
Function at 0x140065830
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x208
movaps xmmword [rsp + 0x1f0], xmm6
mov rax, qword [0x140173028]
xor rax, rsp
mov qword [rsp + 0x1e8], rax
test rdx, rdx
je 0x1400659c9
mov rbx, r8
mov rsi, rdx
mov r12, rcx
movaps xmm6, xmmword [0x14014df90]
movaps xmmword [rsp + 0x1d0], xmm6
movaps xmmword [rsp + 0x1c0], xmm6
test byte [0x140185d07], 0x40
je 0x140065aa1
mov eax, 0x40000000
and eax, dword [0x140185d00]
je 0x140065aa1
lea rcx, [rsp + 0x1c0]
mov edx, 0x20
call fcn.140019a50
test eax, eax
je 0x140065aa1
lea rdi, [rsp + 0x1bc]
xor eax, eax
nop dword [rax + rax]
movzx ecx, byte [rbx + rax]
xor byte [rsp + rax + 0x1c0], cl
inc rax
cmp rax, 0x20
jne 0x1400658d0
lea r14, [rsp + 0x90]
mov r8d, 0x130
mov rcx, r14
mov dl, 0xaa
call fcn.140085d30
mov ecx, 1
call fcn.1400745d0
test rax, rax
je 0x1400659f5
mov rbx, rax
mov r13, rax
add r13, 0x128
cmp dword [rax + 0x128], 0xfff
ja 0x140065ac1
cmp qword [rbx + 0x120], 0
jne 0x140065ac1
mov edi, 0x10000
cmp rsi, rdi
cmovb rdi, rsi
mov qword [rsp + 0x20], 0x20
lea r9, [rsp + 0x1c0]
mov rcx, rbx
mov rdx, r12
mov r8, rdi
call fcn.1401009c0
test eax, eax
je 0x140065b16
inc dword [r13]
sub rsi, rdi
je 0x1400659c0
add r12, rdi
mov ebp, 0x10000
lea r15, [rsp + 0x1c0]
cmp rsi, rbp
mov edi, 0x10000
cmovb rdi, rsi
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, r12
mov r8, rdi
mov r9, r15
call fcn.1401009c0
test eax, eax
je 0x140065b16
add r12, rdi
inc dword [r13]
sub rsi, rdi
jne 0x140065986
cmp rbx, r14
je 0x140065b33
mov rcx, qword [rsp + 0x1e8]
xor rcx, rsp
call fcn.140083c00
movaps xmm6, xmmword [rsp + 0x1f0]
add rsp, 0x208
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 0x130
call fcn.140066d50
test rax, rax
je 0x140065b4a
mov rbx, rax
lea r8, [0x140100c20]
mov ecx, 1
mov rdx, rax
call fcn.14011e900
test eax, eax
je 0x140065b4a
mov rdi, rbx
add rdi, 0x12c
mov dword [rdi], 0
lea rdi, [rsp + 0x60]
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
mov edx, 0x30
mov rcx, rdi
call fcn.14011ebd0
xorps xmm0, xmm0
lea r8, [rsp + 0x30]
movaps xmmword [r8 + 0x20], xmm0
movaps xmmword [r8 + 0x10], xmm0
movaps xmmword [r8], xmm0
mov rcx, rbx
mov rdx, rdi
xor r9d, r9d
call fcn.1401008f0
test eax, eax
je 0x140065b16
lea r13, [rbx + 0x128]
mov dword [rbx + 0x128], 0
mov qword [rbx + 0x120], 0
jmp 0x14006592c
call fcn.14011eba0
test eax, eax
jne 0x140065b1b
lea rcx, [rsp + 0x1c0]
mov edx, 0x20
call fcn.14011ebd0
jmp 0x1400658be
lea rdi, [rsp + 0x60]
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
mov edx, 0x30
mov rcx, rdi
call fcn.14011ebd0
mov r8d, 0x30
mov rcx, rbx
mov rdx, rdi
call fcn.1400660c0
test eax, eax
je 0x140065b16
mov qword [rbx + 0x118], 1
mov dword [r13], 0
mov qword [rbx + 0x120], 0
jmp 0x14006593a
call fcn.140094740
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1d0], xmm0
movaps xmmword [rsp + 0x1c0], xmm0
jmp 0x1400658be
lea rcx, [rsp + 0x90]
mov edx, 0x120
call fcn.140066dd0
jmp 0x1400659c9
mov rbx, r14
jmp 0x140065a31