joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d7e70
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x140175040]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x140186418], 0
je 0x1400d7eb6
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.140084ac0
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov rdi, qword [0x140186420]
test rdi, rdi
jne 0x1400d7f83
mov ecx, 0x18
call fcn.140083794
mov rdi, rax
lea rbx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.1400b71c0
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x14014c6c0]
movups xmmword [rdi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdi + 0x10], rax
mov rcx, rdi
mov rdx, rbx
call fcn.140027230
movsx rax, byte [rdi + 0x17]
mov rcx, rdi
test rax, rax
jns 0x1400d7f30
mov rax, qword [rdi + 8]
mov rcx, qword [rdi]
test rax, rax
je 0x1400d7f67
add rax, rax
test rax, rax
je 0x1400d7f67
lea rdx, [rax - 2]
cmp word [rcx + rax - 2], 0x5c
mov rax, rdx
jne 0x1400d7f38
cmp rdx, 0xfffffffffffffffe
je 0x1400d7f67
sar rdx, 1
inc rdx
mov rcx, rdi
mov r8, 0xffffffffffffffff
call fcn.14002f7d0
lea rdx, str.debug.log
mov r8d, 9
mov rcx, rdi
call fcn.140035c00
mov qword [0x140186420], rdi
test byte [0x140177044], 1
je 0x1400d7e99
cmp byte [rdi + 0x17], 0
jns 0x1400d7f99
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140186418], rax
inc rax
cmp rax, 1
ja 0x1400d7e99
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400b71c0
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jb 0x1400d80d5
mov rcx, qword [0x140186420]
lea rdx, [rsp + 0x40]
call fcn.140035bd0
mov rcx, qword [0x140186420]
movsx rax, byte [rcx + 0x17]
test rax, rax
js 0x1400d80dc
test al, al
je 0x1400d80ed
mov rdx, rcx
cmp word [rdx + rax*2 - 2], 0x5c
je 0x1400d8067
lea rdx, [0x14014e1ee]
mov r8d, 1
call fcn.140035c00
mov rcx, qword [0x140186420]
lea rdx, str.debug.log
mov r8d, 9
call fcn.140035c00
mov rcx, qword [0x140186420]
cmp byte [rcx + 0x17], 0
jns 0x1400d8089
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140186418], rax
inc rax
cmp rax, 1
ja 0x1400d7e99
mov qword [0x140186418], 0
xor esi, esi
jmp 0x1400d7e99
mov rax, qword [rcx + 8]
test rax, rax
je 0x1400d80ed
mov rdx, qword [rcx]
jmp 0x1400d8046
ud2
Function at 0x1400edfe0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
cmp rdx, r9
mov r10, r9
cmovb r10, rdx
xor eax, eax
test r10, r10
je 0x1400ee03f
xor r11d, r11d
mov rsi, qword [r8 + r11*8]
mov rdi, qword [rcx + r11*8]
mov rbx, rdi
xor rbx, rsi
lea r14, [rbx - 1]
mov r15, rdi
sub r15, rsi
xor r15, rdi
or r15, rbx
not rbx
and r14, rbx
sar r14, 0x3f
xor r15, rdi
sar r15, 0x3f
or r15, 1
xor rax, r15
and rax, r14
xor rax, r15
inc r11
cmp r10, r11
jne 0x1400edffb
cmp rdx, r9
jb 0x1400ee070
jbe 0x1400ee092
xor r8d, r8d
or r8, qword [rcx + r9*8]
inc r9
cmp rdx, r9
jne 0x1400ee049
mov rcx, r8
not rcx
dec r8
and r8, rcx
sar r8, 0x3f
xor eax, 1
and eax, r8d
xor eax, 1
jmp 0x1400ee092
xor ecx, ecx
or rcx, qword [r8 + rdx*8]
inc rdx
cmp r9, rdx
jne 0x1400ee072
mov rdx, rcx
not rdx
dec rcx
and rcx, rdx
sar rcx, 0x3f
not ecx
or eax, ecx
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400ee130
Capabilities:
Encode data using xor

Disassembly:
push rsi
movsxd r9, dword [rcx + 8]
movsxd rax, dword [rdx + 8]
cmp r9d, eax
jge 0x1400ee155
mov r10, qword [rdx]
xor r8d, r8d
mov r11, r9
or r8, qword [r10 + r11*8]
inc r11
cmp rax, r11
jne 0x1400ee147
jmp 0x1400ee158
xor r8d, r8d
cmp eax, r9d
jge 0x1400ee16f
mov r10, qword [rcx]
mov r11, rax
or r8, qword [r10 + r11*8]
inc r11
cmp r9, r11
jne 0x1400ee163
cmp r9d, eax
cmovl eax, r9d
test eax, eax
jle 0x1400ee198
mov r9, qword [rcx]
mov r10, qword [rdx]
mov eax, eax
xor r11d, r11d
mov rsi, qword [r10 + r11*8]
xor rsi, qword [r9 + r11*8]
or r8, rsi
inc r11
cmp rax, r11
jne 0x1400ee185
mov eax, dword [rdx + 0x10]
xor eax, dword [rcx + 0x10]
movsxd rcx, eax
xor eax, eax
or rcx, r8
sete al
pop rsi
ret
Function at 0x1400f3d50
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movsxd rax, dword [rdx + 8]
test rax, rax
je 0x1400f3da8
mov rsi, rcx
mov rcx, qword [rdx]
xor r8d, r8d
xor r9d, r9d
or r9, qword [rcx + r8*8]
inc r8
cmp rax, r8
jne 0x1400f3d6b
test r9, r9
je 0x1400f3da8
test eax, eax
jle 0x1400f3d88
mov rcx, qword [rdx]
test byte [rcx], 1
jne 0x1400f3dd4
mov dword [rsp + 0x20], 0xae
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x68
jmp 0x1400f3dc6
mov dword [rsp + 0x20], 0xaa
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x69
call fcn.140117640
mov eax, esi
add rsp, 0x28
pop rdi
pop rsi
ret
cmp dword [rdx + 0x10], 0
je 0x1400f3dfa
mov dword [rsp + 0x20], 0xb2
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x6d
jmp 0x1400f3dc6
cmp eax, 0x401
jb 0x1400f3e3b
mov r9d, 0x400
xor r8d, r8d
or r8, qword [rcx + r9*8]
inc r9
cmp rax, r9
jne 0x1400f3e0a
test r8, r8
je 0x1400f3e3b
mov dword [rsp + 0x20], 0xb6
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x66
jmp 0x1400f3dc6
lea rdi, [rsi + 0x18]
mov rcx, rdi
call fcn.1400edb30
test rax, rax
je 0x1400f3eec
mov eax, dword [rsi + 0x20]
test eax, eax
jle 0x1400f3ee3
mov rcx, qword [rdi]
mov edx, eax
cmp qword [rcx + rdx*8 - 8], 0
jne 0x1400f3ee7
lea edx, [rax - 1]
cmp eax, 1
mov eax, edx
jg 0x1400f3e5e
mov dword [rsi + 0x20], 0
mov dword [rsi + 0x28], 0
mov rax, qword [rdi]
mov rax, qword [rax]
mov r9d, 1
mov edx, 0x40
xor ecx, ecx
movabs r8, 0x8000000000000000
mov r10d, r9d
and r10d, 1
neg r10
mov r11, rax
and r11, r10
mov rdi, r11
xor rdi, r9
shr rdi, 1
and r11, r9
add r11, rdi
and r10, r8
shr rcx, 1
or rcx, r10
mov r9, r11
dec rdx
jne 0x1400f3e9d
mov qword [rsi + 0x30], rcx
mov qword [rsi + 0x38], 0
mov esi, 1
jmp 0x1400f3dcb
jne 0x1400f3e80
jmp 0x1400f3e79
mov dword [rsi + 0x20], eax
jmp 0x1400f3e80
mov dword [rsp + 0x20], 0xbc
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x44
jmp 0x1400f3dc6
Function at 0x1400f51b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
movsxd rdx, dword [rcx + 8]
test rdx, rdx
jle 0x1400f532e
mov rcx, qword [rcx]
shl rdx, 6
xor r8d, r8d
xor eax, eax
xor r9d, r9d
mov rdi, qword [rcx]
mov r11, rdi
shl r11, 0x20
mov r10, r11
not r10
dec r11
and r11, r10
sar r11, 0x3f
mov r10, rdi
shr r10, 0x20
mov rbx, r11
and r10d, ebx
not rbx
and rbx, rdi
or rbx, r10
lea r10, [rdi - 1]
mov rsi, rbx
shl rsi, 0x30
mov r14, rsi
mov r15, rdi
not r14
dec rsi
and rsi, r14
sar rsi, 0x3f
mov rdi, rbx
shr rdi, 0x10
mov r14, rsi
xor rdi, rbx
and rdi, r14
xor rdi, rbx
not r15
mov rbx, rdi
shl rbx, 0x38
mov r14, rbx
and r10, r15
not r14
dec rbx
and rbx, r14
sar rbx, 0x3f
mov r15, rdi
shr r15, 8
mov r14, rbx
xor r15, rdi
and r15, r14
xor r15, rdi
sar r10, 0x3f
mov r14, r15
shl r14, 0x3c
mov r12, r14
mov rdi, r10
not r12
dec r14
and r14, r12
sar r14, 0x3f
mov r13, r15
shr r13, 4
mov r12, r14
xor r13, r15
and r13, r12
xor r13, r15
not rdi
mov r15, r13
shl r15, 0x3e
mov r12, r15
or rdi, r9
not r12
dec r15
and r15, r12
sar r15, 0x3f
mov rbp, r15
mov r12d, r13d
shr r12d, 2
xor r12d, r13d
and r12d, ebp
xor r12d, r13d
shl r12, 0x3f
mov r13, r12
dec r12
and r11d, 0x20
not r13
and esi, 0x10
or esi, r11d
and ebx, 8
and r12, r13
or ebx, esi
and r14d, 4
or r14d, ebx
shr r12, 0x3f
and r15d, 2
or r15d, r14d
or r12d, r15d
add r12d, r8d
or r9d, r10d
not r9d
and r9d, r12d
or eax, r9d
add r8, 0x40
add rcx, 8
mov r9, rdi
cmp rdx, r8
jne 0x1400f51d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x1400f5321
Function at 0x1400f88c0
Capabilities:
Hash data using sha512

Disassembly:
push rsi
push rdi
sub rsp, 0x108
mov rsi, r8
mov r8, rdx
mov rdx, rcx
mov rax, qword [0x140175040]
xor rax, rsp
mov qword [rsp + 0x100], rax
movaps xmm0, xmmword [0x14014c6c0]
lea rdi, [rsp + 0x28]
movups xmmword [rdi + 0xc0], xmm0
movups xmmword [rdi + 0xb0], xmm0
movups xmmword [rdi + 0xa0], xmm0
movups xmmword [rdi + 0x90], xmm0
movups xmmword [rdi + 0x80], xmm0
movups xmmword [rdi + 0x70], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x50], xmm0
movabs rax, 0x6a09e667f3bcc908
mov qword [rdi], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rdi + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rdi + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rdi + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rdi + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rdi + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rdi + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rdi + 0x38], rax
movabs rax, 0x4000000000
mov qword [rdi + 0xd0], rax
xorps xmm0, xmm0
movups xmmword [rdi + 0x40], xmm0
mov rcx, rdi
call fcn.1400483c0
mov edx, dword [rdi + 0xd4]
mov rcx, rsi
mov r8, rdi
call fcn.140048910
mov edx, 0xd8
mov rcx, rdi
call fcn.14007aba0
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140084ac0
mov rax, rsi
add rsp, 0x108
pop rdi
pop rsi
ret
Function at 0x1400f9740
Capabilities:
Hash data using sha512

Disassembly:
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
movabs rax, 0x4000000000
mov qword [rcx + 0xd0], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x40], xmm0
mov eax, 1
ret
Function at 0x1400feec0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov edx, dword [rsp + 0xe0]
mov rax, qword [0x140175040]
xor rax, rsp
mov qword [rsp + 0x78], rax
movsxd r8, dword [rcx + 0x108]
lea ecx, [rdx + 4]
mov r11d, ecx
shr r11d, 6
xor eax, eax
mov r10d, 0
cmp r11, r8
jae 0x1400fef1e
mov r10, qword [r9 + r11*8]
shr r10, cl
shl r10d, 5
and r10d, 0x20
lea ecx, [rdx + 3]
mov r11d, ecx
shr r11d, 6
cmp r11, r8
jae 0x1400fef3a
mov rax, qword [r9 + r11*8]
shr rax, cl
shl eax, 4
and eax, 0x10
or eax, r10d
lea ecx, [rdx + 2]
mov r14d, ecx
shr r14d, 6
xor r10d, r10d
mov r11d, 0
cmp r14, r8
jae 0x1400fef64
mov r11, qword [r9 + r14*8]
shr r11, cl
shl r11d, 3
and r11d, 8
or eax, r11d
lea ecx, [rdx + 1]
mov r11d, ecx
shr r11d, 6
cmp r11, r8
jae 0x1400fef85
mov r10, qword [r9 + r11*8]
shr r10, cl
shl r10d, 2
and r10d, 4
or eax, r10d
mov r11d, edx
shr r11d, 6
xor r10d, r10d
cmp r11, r8
jae 0x1400fefa7
mov ecx, edx
mov r10, qword [r9 + r11*8]
shr r10, cl
add r10d, r10d
and r10d, 2
or eax, r10d
test edx, edx
je 0x1400fefcd
dec edx
mov r10d, edx
shr r10d, 6
xor ecx, ecx
cmp r10, r8
jae 0x1400fefcb
mov r8, qword [r9 + r10*8]
xor ecx, ecx
bt r8, rdx
setb cl
or eax, ecx
mov r14d, eax
shr r14d, 5
mov ecx, r14d
dec ecx
neg r14
and ecx, eax
xor eax, 0x3f
mov r15d, r14d
and r15d, eax
or r15d, ecx
mov eax, r15d
shr eax, 1
sub r15, rax
xor r12d, r12d
mov r8d, 0xd8
mov rcx, rsi
xor edx, edx
call fcn.1400b71c0
mov r13, r15
not r13
mov r8, r12
xor r8, r15
dec r8
and r8, r13
sar r8, 0x3f
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov rdx, rsi
mov r9, rbx
call fcn.1400fb320
inc r12
add rbx, 0xd8
cmp r12, 0x11
jne 0x1400ff00b
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [0x14014c6c0]
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
add rsi, 0x48
movsxd rcx, dword [rdi + 0x148]
test rcx, rcx
jle 0x1400ff0d8
xor eax, eax
xor edx, edx
or rdx, qword [rsi + rax*8]
inc rax
cmp rcx, rax
jne 0x1400ff07c
test rdx, rdx
sete dl
test ecx, ecx
je 0x1400ff128
mov rax, qword [rdi + 0x140]
xor r8d, r8d
lea r9, [rsp + 0x30]
sub r10, r10
jmp 0x1400ff0b0
mov r10, qword [rax + r8*8]
sbb r10, qword [rsi + r8*8]
mov qword [r9 + r8*8], r10
lea r8, [r8 + 1]
dec rcx
jne 0x1400ff0b0
sbb r10, r10
movsxd rax, dword [rdi + 0x148]
test rax, rax
jle 0x1400ff0f7
xor ecx, ecx
jmp 0x1400ff0ec
mov dl, 1
jmp 0x1400ff08e
xor r8d, r8d
mov qword [rsp + rcx*8 + 0x30], r8
inc rcx
cmp rax, rcx
je 0x1400ff0f7
test dl, dl
jne 0x1400ff0dc
mov r8, qword [rsp + rcx*8 + 0x30]
jmp 0x1400ff0df
test eax, eax
je 0x1400ff128
and r14d, 1
neg r14
mov rcx, r14
not rcx
xor edx, edx
mov r8, qword [rsp + rdx*8 + 0x30]
and r8, r14
mov r9, qword [rsi + rdx*8]
and r9, rcx
or r9, r8
mov qword [rsi + rdx*8], r9
inc rdx
cmp rax, rdx
jne 0x1400ff10a
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140084ac0
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14010d410
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x28], rdx
mov rax, qword [0x140175040]
xor rax, rsp
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [r9]
movaps xmmword [rsp + 0x40], xmm0
or byte [rsp + 0x4f], 0x80
test r8, r8
je 0x14010d47c
mov rsi, r8
mov rbx, rcx
mov r14, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xe0]
xor ebp, ebp
movaps xmm6, xmmword [0x14014c6c0]
lea r12, [rsp + 0x40]
lea r13, [rsp + 0x30]
mov edi, 0x10
jmp 0x14010d4a7
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140084ac0
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add rbp, rax
cmp rbp, rsi
jae 0x14010d47c
movaps xmmword [rsp + 0x30], xmm6
mov rcx, r12
mov rdx, r13
mov r8, r14
mov rax, r15
call qword [0x1401689f8]
inc dword [rsp + 0x40]
mov rax, rsi
sub rax, rbp
cmp rax, 0x10
cmovae rax, rdi
cmp rsi, rbp
je 0x14010d49f
cmp rax, 1
mov rcx, rax
adc rcx, 0
lea rdx, [rbx + rbp]
mov r8, qword [rsp + 0x28]
add r8, rbp
xor r9d, r9d
mov r10b, byte [r8 + r9]
xor r10b, byte [rsp + r9 + 0x30]
mov byte [rdx + r9], r10b
inc r9
cmp rcx, r9
jne 0x14010d4ef
jmp 0x14010d49f

Function at 0x14010f6c0
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x14010f6d0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x14010f6f1
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x14010f715
cmp byte [r14 + 0x50], 1
jne 0x14010f70f
or edi, 0x80000000
jmp 0x14010f715
or edi, 0x20000000
test dil, 8
je 0x14010f730
cmp byte [r14 + 0x68], 1
je 0x14010f72a
or edi, 0x10000000
jmp 0x14010f730
or edi, 0x40000000
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r12d, 0
je 0x14010f744
mov r12, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov r13d, 0
je 0x14010f755
mov r13, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 1
jne 0x14010f768
lea rcx, [r14 + 0x20]
call fcn.1400e39c0
mov r15, rax
cmp byte [r14 + 0x18], 1
je 0x14010f78d
xor r9d, r9d
jmp 0x14010f798
xor edx, edx
jmp 0x14010f7b4
mov edx, 4
jmp 0x14010f7b4
mov edx, 1
jmp 0x14010f7b4
mov edx, 6
jmp 0x14010f7b4
mov rcx, r14
call fcn.1400e39c0
mov r9, rax
cmp ebx, 4
ja case.default.0x14010f7ad
mov eax, ebx
lea rcx, [0x1401605a4]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov edx, 7
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
je 0x14010f7dd
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14010f800
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x14010f83c
cmp byte [r14 + 0x50], 1
je 0x14010f836
or edi, 0x20000000
jmp 0x14010f83c
or edi, 0x80000000
test dil, 8
je 0x14010f857
cmp byte [r14 + 0x68], 1
je 0x14010f851
or edi, 0x10000000
jmp 0x14010f857
or edi, 0x40000000
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r12d, 0
je 0x14010f86b
mov r12, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov r13d, 0
je 0x14010f87c
mov r13, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 1
jne 0x14010f88f
lea rcx, [r14 + 0x20]
call fcn.1400e39c0
mov r15, rax
cmp byte [r14 + 0x18], 1
je 0x14010f8b4
xor r9d, r9d
jmp 0x14010f8bf
xor edx, edx
jmp 0x14010f8db
mov edx, 1
jmp 0x14010f8db
mov edx, 4
jmp 0x14010f8db
mov edx, 6
jmp 0x14010f8db
mov rcx, r14
call fcn.1400e39c0
mov r9, rax
cmp ebx, 4
ja case.default.0x14010f8d4
mov eax, ebx
lea rcx, [0x1401605b8]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov edx, 7
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov esi, eax
test eax, eax
je 0x14010f904
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140113670
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rax, qword [0x140175040]
xor rax, rsp
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [0x14014c6c0]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
mov r8d, 6
call fcn.14011c6e0
test eax, eax
je 0x1401137a3
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
movzx eax, byte [0x140160e95]
cmp rsi, rax
jne 0x1401136e7
lea rbx, [0x140160e88]
test al, al
je 0x1401137a5
lea rdx, [0x140160e8c]
mov rcx, rdi
mov r8, rsi
call fcn.1400b6a20
test eax, eax
je 0x1401137a5
movzx eax, byte [0x1401610cd]
cmp rsi, rax
jne 0x14011371c
lea rbx, [0x1401610c0]
test al, al
je 0x1401137a5
lea rdx, [0x1401610c4]
mov rcx, rdi
mov r8, rsi
call fcn.1400b6a20
test eax, eax
je 0x1401137a5
movzx eax, byte [0x140160fad]
cmp rsi, rax
jne 0x140113749
lea rbx, [0x140160fa0]
test al, al
je 0x1401137a5
lea rdx, [0x140160fa4]
mov rcx, rdi
mov r8, rsi
call fcn.1400b6a20
test eax, eax
je 0x1401137a5
movzx eax, byte [0x1401611ad]
cmp rsi, rax
jne 0x140113776
lea rbx, [0x1401611a0]
test al, al
je 0x1401137a5
lea rdx, [0x1401611a4]
mov rcx, rdi
mov r8, rsi
call fcn.1400b6a20
test eax, eax
je 0x1401137a5
movzx eax, byte [0x140161295]
cmp rsi, rax
jne 0x1401137a3
lea rbx, [0x140161288]
test al, al
je 0x1401137a5
lea rdx, [0x14016128c]
mov rcx, rdi
mov r8, rsi
call fcn.1400b6a20
test eax, eax
je 0x1401137a5
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140084ac0
mov rax, rbx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x140120950
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov r12, r9
mov r13, r8
mov r15, rdx
mov rbp, rcx
mov r14, qword [rsp + 0x118]
mov rdi, qword [rsp + 0x110]
mov rax, qword [0x140175040]
xor rax, rsp
mov qword [rsp + 0x90], rax
test rdi, rdi
jne 0x14012099e
call fcn.1400f82e0
mov rdi, rax
test r14, r14
cmove r14, rdi
mov rcx, rdi
call fcn.1400f80b0
mov rsi, rax
lea rax, [rax*2 + 2]
cmp rax, r15
ja 0x1401209f3
lea rax, [rsi + rsi]
mov rbx, rax
not rbx
lea rcx, [r15 + rbx]
dec rcx
cmp rcx, r12
jae 0x140120a3c
mov dword [rsp + 0x20], 0x6a
lea r9, str....._third_party_boringssl_srccrypto_rsa_extra_rsa_crypt.c
xor edi, edi
mov ecx, 4
xor edx, edx
mov r8d, 0x72
jmp 0x140120a11
mov dword [rsp + 0x20], 0x64
lea r9, str....._third_party_boringssl_srccrypto_rsa_extra_rsa_crypt.c
xor edi, edi
mov ecx, 4
xor edx, edx
mov r8d, 0x7e
call fcn.140117640
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140084ac0
mov eax, edi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [r15 - 1]
mov qword [rsp + 0x40], rcx
cmp rcx, rax
ja 0x140120a54
mov dword [rsp + 0x20], 0x6f
jmp 0x1401209fb
mov rdx, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x100]
mov byte [rbp], 0
lea r8, [rsi + rbp]
inc r8
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x38], r8
xor r9d, r9d
call fcn.1400f80c0
xor ecx, ecx
mov edi, 0
test eax, eax
je 0x140120bc0
mov rdi, qword [rsp + 0x40]
sub rdi, r12
add rbx, rdi
mov rcx, qword [rsp + 0x38]
je 0x140120ac3
mov rax, qword [rsp + 0x38]
lea rcx, [rax + rsi]
xor edx, edx
mov r8, rbx
call fcn.1400b71c0
mov rcx, qword [rsp + 0x38]
lea rax, [rbp + 1]
mov qword [rsp + 0x48], rax
mov rax, rsi
not rax
add rdi, rcx
mov byte [rax + rdi], 1
test r12, r12
mov rbx, rcx
je 0x140120afb
add rbp, rsi
add rbp, r15
sub rbp, r12
sub rbp, rsi
mov rcx, rbp
mov rdx, r13
mov r8, r12
call fcn.1400b6b20
mov r13, qword [rsp + 0x48]
mov rcx, r13
mov rdx, rsi
call fcn.140076970
test eax, eax
je 0x140120bca
mov r15, qword [rsp + 0x40]
sub r15, rsi
mov rcx, r15
call fcn.14004d580
xor edi, edi
test rax, rax
je 0x140120bd0
mov r12, rax
mov qword [rsp + 0x20], r14
mov rcx, rax
mov rdx, r15
mov r8, r13
mov r9, rsi
call fcn.140101b20
test eax, eax
je 0x140120bbd
cmp qword [rsp + 0x40], rsi
je 0x140120b6e
cmp r15, 1
mov rax, r15
adc rax, 0
xor ecx, ecx
mov dl, byte [r12 + rcx]
xor byte [rbx + rcx], dl
inc rcx
cmp rax, rcx
jne 0x140120b5f
movaps xmm0, xmmword [0x14014c6c0]
lea rcx, [rsp + 0x50]
movaps xmmword [rcx + 0x30], xmm0
movaps xmmword [rcx + 0x20], xmm0
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
mov qword [rsp + 0x20], r14
mov rdx, rsi
mov r8, rbx
mov r9, r15
call fcn.140101b20
test eax, eax
je 0x140120bbd
mov edi, 1
test rsi, rsi
je 0x140120bbd
xor eax, eax
mov cl, byte [rsp + rax + 0x50]
xor byte [r13 + rax], cl
inc rax
cmp rsi, rax
jne 0x140120bac
mov rcx, r12
call fcn.14004d6f0
jmp 0x140120a16
xor ecx, ecx
xor edi, edi
jmp 0x140120bc0
xor ecx, ecx
jmp 0x140120bc0
Function at 0x14012d670
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x110
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140175040]
xor rax, rsp
mov qword [rsp + 0x108], rax
movaps xmm0, xmmword [0x14014c6c0]
lea r14, [rsp + 0xc0]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov edx, 0x20
mov rcx, r8
mov r8, r14
call fcn.1400f88c0
and byte [r14], 0xf8
mov al, byte [r14 + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [r14 + 0x1f], al
lea r15, [rsp + 0x20]
mov r8d, 0xa0
mov rcx, r15
mov dl, 0xaa
call fcn.1400b71c0
lea r8, [0x1401619c0]
mov rcx, r15
mov rdx, r14
call fcn.14012c140
mov rcx, rdi
mov rdx, r15
call fcn.14012bf10
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.140084ac0
nop
add rsp, 0x110
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret