joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400dc4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x1400dc610
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x140178028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x5e], 0
je 0x1400dc66e
movzx edi, word [rsi + 0x5c]
test r15b, r15b
je 0x1400dc64e
mov word [rsi + 0x5c], 0xffff
mov byte [rsi + 0x5e], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400a8490
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
cmp eax, 2
mov edi, 1
cmovge edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.1400c290c
cmp eax, 0xffffffff
je 0x1400dc6f4
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x1400dc68d
mov word [rsp + 0x56], 0xaaaa
cmp byte [rsi + 0x5f], 0
je 0x1400dc6fd
movsx eax, byte [rsp + 0x58]
mov word [rsp + 0x56], ax
test r15b, r15b
je 0x1400dc6ce
movzx edi, word [rsp + 0x56]
mov word [rsi + 0x5c], di
jmp 0x1400dc64e
mov edi, edi
test rdi, rdi
jle 0x1400dc7af
mov rdx, qword [rsi + 0x40]
dec rdi
mov eax, edi
movsx eax, byte [rsp + rax + 0x58]
movzx ecx, ax
call fcn.1400c5a54
cmp eax, 0xffffffff
jne 0x1400dc6d0
mov di, 0xffff
jmp 0x1400dc64e
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea r12, [rsp + 0x40]
mov qword [r12], r14
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r14d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], r12
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x56]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x58]
call qword [0x14019d008]
cmp eax, 1
jne 0x1400dc798
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r14w
cmp edi, 8
je 0x1400dc6f4
mov rcx, qword [rsi + 0x40]
call fcn.1400c290c
cmp eax, 0xffffffff
je 0x1400dc6f4
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x1400dc70e
cmp eax, 2
je 0x1400dc6f4
cmp eax, 3
je 0x1400dc6b4
jmp 0x1400dc6be
movzx edi, word [rsp + 0x56]
jmp 0x1400dc64e

Function at 0x1400dcb20
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1400dcb57
movabs r9, 0xf000000000000000
shl rax, 4
movsx r10, byte [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
inc rdx
cmp rdx, r8
jne 0x1400dcb31
ret

Function at 0x1400dcba0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1400dcbd8
movabs r9, 0xf000000000000000
shl rax, 4
movzx r10d, word [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
add rdx, 2
cmp rdx, r8
jne 0x1400dcbb1
ret
Function at 0x1400e3430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov r12, r8
mov r14, rdx
mov bl, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x1400e3490
movzx edx, word [rbp + 0x60]
movzx ebx, bl
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], ebx
mov word [rsp + 0x20], dx
mov rdx, r14
mov r8, r12
call qword [0x14019d008]
mov rax, r14
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea rsi, [rbp - 0x20]
mov rcx, r9
mov rdx, rsi
call fcn.14006f110
lea rdx, [0x140189500]
mov rcx, rsi
call fcn.14006f3a0
mov rsi, rax
mov rcx, qword [rbp - 0x20]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x1400e34d0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x14019d008]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rbp - 0x20]
mov qword [r15 + 0x10], rax
movaps xmm0, xmmword [0x140156180]
movaps xmmword [r15], xmm0
mov rax, qword [rsi]
xor bl, 1
movzx ecx, bl
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, rsi
mov rdx, r15
call qword [0x14019d008]
movzx eax, byte [r15 + 0x17]
mov ebx, eax
and ebx, 0x7f
test al, al
mov rcx, qword [r15]
mov rsi, qword [r15 + 8]
cmovs rbx, rsi
test rbx, rbx
je 0x1400e35a1
test al, al
mov rbx, r15
cmovs rbx, rcx
test r12, r12
je 0x1400e3584
movzx eax, word [rbx]
mov rcx, qword [r12 + 0x30]
cmp rcx, qword [r12 + 0x38]
je 0x1400e3589
lea rdx, [rcx + 2]
mov qword [r12 + 0x30], rdx
mov word [rcx], ax
cmp ax, 0xffff
jne 0x1400e3555
xor r12d, r12d
mov al, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov rsi, qword [rbp - 0x18]
add rbx, 2
mov edx, eax
and dl, 0x7f
test al, al
mov rdi, r15
cmovs rdi, rcx
movzx edx, dl
cmovs rdx, rsi
lea rdx, [rdi + rdx*2]
cmp rbx, rdx
jne 0x1400e352c
jmp 0x1400e35a1
xor r12d, r12d
jmp 0x1400e3560
mov rcx, qword [r12]
mov rsi, qword [rcx + 0x60]
mov rcx, r12
mov edx, eax
mov rax, rsi
call qword [0x14019d008]
jmp 0x1400e354c
shr al, 7
mov qword [r14], r12
test al, al
je 0x1400e347e
call fcn.1400a70a0
jmp 0x1400e347e

Function at 0x1400f2650
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.1400a7064
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400f26c0]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.1400b6654
mov qword [rbx], rax
test rax, rax
je 0x1400f26a7
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x1400f3010
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x140178028]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x14018a298], 0
je 0x1400f3056
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1400a8490
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov rdi, qword [0x14018a270]
test rdi, rdi
je 0x1400f30f7
test byte [0x140179f68], 1
je 0x1400f3039
cmp byte [rdi + 0x17], 0
jns 0x1400f3078
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14018a298], rax
inc rax
cmp rax, 1
ja 0x1400f3039
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400aa5c0
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x1400f31b6
xor esi, esi
jmp 0x1400f3039
mov ecx, 0x18
call fcn.1400a7064
mov rdi, rax
lea rbx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.1400aa5c0
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x140156180]
movups xmmword [rdi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdi + 0x10], rax
mov rcx, rdi
mov rdx, rbx
call fcn.14002a500
movzx r8d, byte [rdi + 0x17]
test r8b, r8b
jns 0x1400f315d
mov r8, qword [rdi + 8]
jmp 0x1400f3161
and r8d, 0x7f
mov rcx, rdi
mov dx, 0x5c
call fcn.140070980
cmp rax, 0xffffffffffffffff
je 0x1400f319b
lea rcx, [rax + 1]
movzx edx, byte [rdi + 0x17]
test dl, dl
jns 0x1400f3271
cmp qword [rdi + 8], rax
jbe 0x1400f3281
mov rdx, qword [rdi]
mov qword [rdi + 8], rcx
mov word [rdx + rax*2 + 2], 0
lea rdx, str.debug.log
mov rcx, rdi
call fcn.14002b750
mov qword [0x14018a270], rdi
jmp 0x1400f3066
mov rcx, qword [0x14018a270]
lea rdx, [rsp + 0x40]
call fcn.14002b380
mov rcx, qword [0x14018a270]
movzx eax, byte [rcx + 0x17]
test al, al
js 0x1400f3265
mov rdx, rcx
cmp word [rdx + rax*2 - 2], 0x5c
je 0x1400f31f8
lea rdx, [0x14015992a]
call fcn.14002b750
mov rcx, qword [0x14018a270]
lea rdx, str.debug.log
call fcn.14002b750
mov rcx, qword [0x14018a270]
cmp byte [rcx + 0x17], 0
jns 0x1400f3214
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14018a298], rax
inc rax
cmp rax, 1
ja 0x1400f3039
mov qword [0x14018a298], 0
jmp 0x1400f30f0
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
jmp 0x1400f31dd
cmp rax, rdx
jae 0x1400f3281
mov byte [rdi + 0x17], cl
mov rdx, rdi
jmp 0x1400f3194
call fcn.1400bc5c0
int3
Function at 0x1400f4570
Capabilities:
Move file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rsi, rcx
mov rax, qword [0x140178028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx + 0x50], rax
movaps xmm0, xmmword [0x140156180]
movaps xmmword [rbx + 0x40], xmm0
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DeleteFileAfterReboot
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0x194
call fcn.140072b00
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.140079ca0
mov al, byte [rsi + 0x17]
test al, al
jns 0x1400f4600
cmp qword [rsi + 8], 0x103
ja 0x1400f461e
test al, al
jns 0x1400f4607
mov rsi, qword [rsi]
mov rcx, rsi
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
lea rcx, [rsp + 0x40]
call fcn.140079d00
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400a8490
mov eax, edi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400f4f50
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x140178028]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x1400f4fcf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1400f4fd4
test bl, bl
je 0x1400f4fab
cmp byte [rdi + 8], 0
je 0x1400f5030
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
mov edx, esi
call fcn.140033770
mov sil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400a8490
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, qword [rdi]
jmp 0x1400f4f7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rdi + 8], 0
je 0x1400f4ffc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400f5001
xor esi, esi
jmp 0x1400f4fb8
mov rcx, qword [rdi]
jmp 0x1400f4fe9
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rdi + 8], 0
je 0x1400f5038
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1400f4fab
mov esi, dword [rsp + 0x24]
jmp 0x1400f4fab
mov rcx, qword [rdi]
jmp 0x1400f4fa0
mov rcx, qword [rdi]
jmp 0x1400f5018
Function at 0x140107a20
Capabilities:
Encode data using xor

Disassembly:
push rsi
movsxd r9, dword [rcx + 8]
movsxd r10, dword [rdx + 8]
cmp r9d, r10d
jge 0x140107a45
mov r11, qword [rdx]
xor r8d, r8d
mov rax, r9
or r8, qword [r11 + rax*8]
inc rax
cmp r10, rax
jne 0x140107a37
jmp 0x140107a48
xor r8d, r8d
cmp r10d, r9d
jge 0x140107a5f
mov r11, qword [rcx]
mov rax, r10
or r8, qword [r11 + rax*8]
inc rax
cmp r9, rax
jne 0x140107a53
cmp r9d, r10d
cmovl r10d, r9d
test r10d, r10d
jle 0x140107a89
mov r9, qword [rcx]
mov r11, qword [rdx]
mov r10d, r10d
xor eax, eax
mov rsi, qword [r11 + rax*8]
xor rsi, qword [r9 + rax*8]
or r8, rsi
inc rax
cmp r10, rax
jne 0x140107a76
mov eax, dword [rdx + 0x10]
xor eax, dword [rcx + 0x10]
movsxd rcx, eax
xor eax, eax
or rcx, r8
sete al
pop rsi
ret

Function at 0x14010f0f0
Capabilities:
Hash data using sha512

Disassembly:
push rsi
push rdi
sub rsp, 0x108
mov rsi, r8
mov r8, rdx
mov rdx, rcx
mov rax, qword [0x140178028]
xor rax, rsp
mov qword [rsp + 0x100], rax
movaps xmm0, xmmword [0x140156180]
lea rdi, [rsp + 0x28]
movups xmmword [rdi + 0xc0], xmm0
movups xmmword [rdi + 0xb0], xmm0
movups xmmword [rdi + 0xa0], xmm0
movups xmmword [rdi + 0x90], xmm0
movups xmmword [rdi + 0x80], xmm0
movups xmmword [rdi + 0x70], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x50], xmm0
movabs rax, 0x6a09e667f3bcc908
mov qword [rdi], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rdi + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rdi + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rdi + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rdi + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rdi + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rdi + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rdi + 0x38], rax
movabs rax, 0x4000000000
mov qword [rdi + 0xd0], rax
xorps xmm0, xmm0
movups xmmword [rdi + 0x40], xmm0
mov rcx, rdi
call fcn.140049100
mov rcx, rsi
mov rdx, rdi
call fcn.14004cca0
mov edx, 0xd8
mov rcx, rdi
call fcn.140089230
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1400a8490
mov rax, rsi
add rsp, 0x108
pop rdi
pop rsi
ret
Function at 0x14010fc80
Capabilities:
Hash data using sha512

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1c8
movaps xmmword [rsp + 0x1b0], xmm6
mov rsi, rdx
mov r12, rcx
mov rax, qword [0x140178028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
mov rax, qword [r8 + 0x28]
test rax, rax
je 0x14010fce6
cmp qword [rax + 0x28], 0
je 0x14010fce6
mov dword [rsp + 0x20], 0x136
lea r9, str....._third_party_boringssl_srccrypto_fipsmoduleecdsaecdsa.c
xor edi, edi
mov ecx, 0x1a
xor edx, edx
mov r8d, 0x67
jmp 0x14010fec2
mov r14, qword [r8]
test r14, r14
je 0x14010fea4
mov r15, qword [r8 + 0x10]
test r15, r15
je 0x14010fea4
add r15, 0x18
movaps xmm6, xmmword [0x140156180]
lea rdi, [rsp + 0xd0]
movups xmmword [rdi + 0xc0], xmm6
movups xmmword [rdi + 0xb0], xmm6
movups xmmword [rdi + 0xa0], xmm6
movups xmmword [rdi + 0x90], xmm6
movups xmmword [rdi + 0x80], xmm6
movups xmmword [rdi + 0x70], xmm6
movups xmmword [rdi + 0x60], xmm6
movups xmmword [rdi + 0x50], xmm6
lea rbx, [rsp + 0x90]
movaps xmmword [rbx + 0x30], xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
movabs rax, 0x6a09e667f3bcc908
mov qword [rdi], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rdi + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rdi + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rdi + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rdi + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rdi + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rdi + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rdi + 0x38], rax
mov dword [rdi + 0xd0], 0
xorps xmm0, xmm0
movups xmmword [rdi + 0x40], xmm0
mov dword [rdi + 0xd4], 0x40
movsxd r8, dword [r14 + 0x18]
shl r8, 3
mov rcx, rdi
mov rdx, r15
call fcn.140049100
mov rcx, rdi
mov rdx, r12
mov qword [rsp + 0x30], rsi
mov r8, rsi
call fcn.140049100
mov rcx, rbx
mov rdx, rdi
call fcn.14004cca0
movabs r13, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
lea rdi, [rsp + 0x3c]
mov qword [rsp + 0x80], r13
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movsxd r9, dword [r14 + 0x18]
mov r8, qword [r14 + 0x10]
mov qword [rsp + 0x20], rbx
mov edx, 1
mov rcx, rsi
call fcn.14010e0f0
test eax, eax
je 0x14010fef6
mov r9, rsi
mov dword [rsp + 0x3c], 0xaaaaaaaa
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov rcx, r14
mov rbp, rdi
mov rdx, rdi
mov r8, r15
call fcn.14010f930
mov rdi, rax
test rax, rax
jne 0x14010fec7
cmp dword [rsp + 0x3c], 0
je 0x14010fec7
mov rdi, rbp
jmp 0x14010fe27
mov dword [rsp + 0x20], 0x13c
lea r9, str....._third_party_boringssl_srccrypto_fipsmoduleecdsaecdsa.c
xor edi, edi
mov ecx, 0x1a
xor edx, edx
mov r8d, 0x43
call fcn.14012ee90
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1400a8490
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x1b0]
add rsp, 0x1c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor edi, edi
jmp 0x14010fec7
Function at 0x14010ff10
Capabilities:
Hash data using sha512

Disassembly:
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
movabs rax, 0x4000000000
mov qword [rcx + 0xd0], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x40], xmm0
mov eax, 1
ret
Function at 0x140113b10
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
mov r15, r8
mov rsi, rdx
mov r14, rcx
mov r10d, dword [rsp + 0xe0]
mov rax, qword [0x140178028]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8d, dword [rcx + 0x18]
lea ecx, [r10 + 4]
mov edi, ecx
shr edi, 6
xor edx, edx
mov ebx, 0
cmp edi, r8d
jae 0x140113b6b
mov eax, edi
mov rbx, qword [r9 + rax*8]
shr rbx, cl
shl ebx, 5
and ebx, 0x20
lea ecx, [r10 + 3]
mov eax, ecx
shr eax, 6
cmp eax, r8d
jae 0x140113b88
mov eax, eax
mov rdx, qword [r9 + rax*8]
shr rdx, cl
shl edx, 4
and edx, 0x10
or edx, ebx
lea ecx, [r10 + 2]
mov eax, ecx
shr eax, 6
xor ebx, ebx
mov edi, 0
cmp eax, r8d
jae 0x140113bae
mov eax, eax
mov rdi, qword [r9 + rax*8]
shr rdi, cl
shl edi, 3
and edi, 8
or edx, edi
lea ecx, [r10 + 1]
mov eax, ecx
shr eax, 6
cmp eax, r8d
jae 0x140113bcd
mov eax, eax
mov rbx, qword [r9 + rax*8]
shr rbx, cl
shl ebx, 2
and ebx, 4
or edx, ebx
mov eax, r10d
shr eax, 6
xor ebx, ebx
cmp eax, r8d
jae 0x140113bed
mov eax, eax
mov rbx, qword [r9 + rax*8]
mov ecx, r10d
shr rbx, cl
add ebx, ebx
and ebx, 2
or edx, ebx
test r10d, r10d
je 0x140113c15
dec r10d
mov eax, r10d
shr eax, 6
xor ecx, ecx
cmp eax, r8d
jae 0x140113c13
mov eax, eax
mov rax, qword [r9 + rax*8]
xor ecx, ecx
bt rax, r10
setb cl
or edx, ecx
mov r12d, edx
shr r12, 5
lea eax, [r12 - 1]
neg r12
and eax, edx
xor edx, 0x3f
mov edi, r12d
and edi, edx
or edi, eax
mov rax, rdi
shr rax, 1
and edi, 1
add rdi, rax
xor ebx, ebx
mov r8d, 0xd8
mov rcx, rsi
xor edx, edx
call fcn.1400aa5c0
mov r8, rbx
xor r8, rdi
dec r8
sar r8, 0x3f
mov qword [rsp + 0x20], rsi
mov rcx, r14
mov rdx, rsi
mov r9, r15
call fcn.140110c70
inc rbx
add r15, 0xd8
cmp rbx, 0x11
jne 0x140113c4e
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [0x140156180]
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
add rsi, 0x48
mov ecx, dword [r14 + 0x40]
test ecx, ecx
jle 0x140113cc6
xor edx, edx
xor eax, eax
or rax, qword [rsi + rdx*8]
inc rdx
cmp rcx, rdx
jne 0x140113cb8
jmp 0x140113cc8
xor eax, eax
test rcx, rcx
je 0x140113d61
movsxd rcx, ecx
mov rdx, qword [r14 + 0x38]
xor ebx, ebx
lea r8, [rsp + 0x30]
sub rdi, rdi
jmp 0x140113cf0
mov rdi, qword [rdx + rbx*8]
sbb rdi, qword [rsi + rbx*8]
mov qword [r8 + rbx*8], rdi
lea rbx, [rbx + 1]
dec rcx
jne 0x140113cf0
sbb rdi, rdi
mov ecx, dword [r14 + 0x40]
test ecx, ecx
jle 0x140113d2c
xor edx, edx
mov rbx, rax
test rax, rax
je 0x140113d1f
mov rbx, qword [rsp + rdx*8 + 0x30]
mov qword [rsp + rdx*8 + 0x30], rbx
inc rdx
cmp rcx, rdx
jne 0x140113d12
test rcx, rcx
je 0x140113d61
and r12d, 1
mov rax, r12
neg rax
dec r12
movsxd rcx, ecx
xor edx, edx
mov rbx, qword [rsp + rdx*8 + 0x30]
and rbx, rax
mov rdi, qword [rsi + rdx*8]
and rdi, r12
or rdi, rbx
mov qword [rsi + rdx*8], rdi
inc rdx
cmp rcx, rdx
jne 0x140113d43
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400a8490
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140115250
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rsi, r9
mov r12, r8
mov rdi, rdx
mov r14, rcx
mov r15, qword [rsp + 0x108]
mov rax, qword [rsp + 0x100]
mov rcx, qword [0x140178028]
xor rcx, rsp
mov qword [rsp + 0x80], rcx
test rax, rax
jne 0x1401152b0
lea rcx, [0x14018f820]
lea rdx, [0x14010ee90]
call fcn.1400946c0
lea rax, [0x14018f828]
test r15, r15
cmove r15, rax
mov ebx, dword [rax + 4]
lea rcx, [rbx + rbx]
add rcx, 2
cmp rcx, rdi
jbe 0x140115312
mov dword [rsp + 0x20], 0x147
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_rsapadding.c
xor r13d, r13d
mov ecx, 4
xor edx, edx
mov r8d, 0x7e
call fcn.14012ee90
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400a8490
mov eax, r13d
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rbx + rbx]
mov rbp, rcx
not rbp
lea rdx, [rdi + rbp]
dec rdx
cmp rdx, rsi
jae 0x140115349
mov dword [rsp + 0x20], 0x14d
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_rsapadding.c
xor r13d, r13d
mov ecx, 4
xor edx, edx
mov r8d, 0x72
jmp 0x1401152e6
dec rdi
or rcx, 1
cmp rdi, rcx
jae 0x140115362
mov dword [rsp + 0x20], 0x152
jmp 0x1401152cf
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xf0]
mov byte [r14], 0
lea r8, [r14 + rbx]
inc r8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
xor r13d, r13d
mov qword [rsp + 0x30], r8
xor r9d, r9d
call fcn.1400489f0
test eax, eax
je 0x1401154bb
mov qword [rsp + 0x38], r12
mov r12, rdi
sub r12, rsi
add rbp, r12
mov rcx, qword [rsp + 0x30]
je 0x1401153d0
mov rax, qword [rsp + 0x30]
lea rcx, [rax + rbx]
xor edx, edx
mov r8, rbp
call fcn.1400aa5c0
mov rcx, qword [rsp + 0x30]
inc r14
mov rax, rbx
not rax
add r12, rax
mov byte [rcx + r12], 1
test rsi, rsi
mov rbp, rcx
je 0x140115400
lea rcx, [rdi + rbp]
sub rcx, rsi
sub rcx, rbx
mov rdx, qword [rsp + 0x38]
mov r8, rsi
call fcn.1400a9f10
lea r8, [0x140161a10]
mov rcx, r14
mov rdx, rbx
call fcn.140087780
mov rsi, rdi
sub rsi, rbx
mov rcx, rsi
call fcn.1400891b0
test rax, rax
je 0x1401154cb
mov r12, rax
mov qword [rsp + 0x20], r15
mov rcx, rax
mov rdx, rsi
mov r8, r14
mov r9, rbx
call fcn.14004b8e0
test eax, eax
je 0x1401154be
cmp rdi, rbx
je 0x14011546a
cmp rsi, 2
mov eax, 1
cmovae rax, rsi
xor ecx, ecx
mov dl, byte [r12 + rcx]
xor byte [rbp + rcx], dl
inc rcx
cmp rax, rcx
jne 0x14011545a
movaps xmm0, xmmword [0x140156180]
lea rcx, [rsp + 0x40]
movaps xmmword [rcx + 0x30], xmm0
movaps xmmword [rcx + 0x20], xmm0
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
mov qword [rsp + 0x20], r15
mov rdx, rbx
mov r8, rbp
mov r9, rsi
call fcn.14004b8e0
test eax, eax
je 0x1401154be
mov r13d, 1
test rbx, rbx
je 0x1401154be
xor eax, eax
mov cl, byte [rsp + rax + 0x40]
xor byte [r14 + rax], cl
inc rax
cmp rbx, rax
jne 0x1401154a9
jmp 0x1401154be
xor r12d, r12d
mov rcx, r12
call fcn.1400891f0
jmp 0x1401152eb
mov dword [rsp + 0x20], 0x169
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_rsapadding.c
xor r12d, r12d
mov ecx, 4
xor edx, edx
mov r8d, 0x41
call fcn.14012ee90
xor r13d, r13d
jmp 0x1401154be