joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400424e0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x230
mov rsi, rcx
mov rax, qword [0x14018a040]
xor rax, rsp
mov qword [rsp + 0x228], rax
lea rdi, [rsp + 0x20]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400e6f50
mov word [rdi], 0
lea rcx, str.PROGRAMFILES
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140042567
mov ebx, eax
cmp word [rsp + rbx*2 + 0x1e], 0x5c
je 0x1400426ce
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140042554
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, rbx
call fcn.1400cd0b0
test eax, eax
je 0x140042662
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str.PROGRAMFILES_X86_
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x1400425bc
mov ebx, eax
cmp word [rsp + rbx*2 + 0x1e], 0x5c
je 0x1400426dc
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1400425a9
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, rbx
call fcn.1400cd0b0
test eax, eax
je 0x140042696
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str.PROGRAMW6432
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14004260d
mov ebx, eax
cmp word [rsp + rbx*2 + 0x1e], 0x5c
je 0x1400426ea
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1400425fe
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, rbx
call fcn.1400cd0b0
test eax, eax
je 0x140042634
xor eax, eax
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
cmp rcx, qword [0x14018a040]
je 0x140042629
call fcn.1400b6410
int3
add rsp, 0x230
pop rbx
pop rdi
pop rsi
ret
movsx rcx, byte [rsi + 0x17]
mov rdx, rcx
test rcx, rcx
jns 0x140042645
mov rdx, qword [rsi + 8]
mov al, 1
cmp rdx, rbx
je 0x14004260f
jb 0x1400426f8
test cl, cl
jns 0x140042659
mov rsi, qword [rsi]
cmp word [rsi + rbx*2], 0x5c
jne 0x14004260d
jmp 0x14004260f
movsx rcx, byte [rsi + 0x17]
mov rdx, rcx
test rcx, rcx
jns 0x140042673
mov rdx, qword [rsi + 8]
mov al, 1
cmp rdx, rbx
je 0x14004260f
jb 0x1400426f8
mov rdx, rsi
test cl, cl
jns 0x140042686
mov rdx, qword [rsi]
cmp word [rdx + rbx*2], 0x5c
jne 0x140042567
jmp 0x14004260f
movsx rcx, byte [rsi + 0x17]
mov rdx, rcx
test rcx, rcx
jns 0x1400426a7
mov rdx, qword [rsi + 8]
mov al, 1
cmp rdx, rbx
je 0x14004260f
jb 0x1400426f8
mov rdx, rsi
test cl, cl
jns 0x1400426be
mov rdx, qword [rsi]
cmp word [rdx + rbx*2], 0x5c
jne 0x1400425bc
jmp 0x14004260f
dec rbx
jne 0x14004253c
jmp 0x140042567
dec rbx
jne 0x140042591
jmp 0x1400425bc
dec rbx
jne 0x1400425e6
jmp 0x14004260d
ud2

Function at 0x140043860
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
jne 0x14004387a
test r8d, r8d
jne 0x140043873
call fcn.140093db0
xor eax, eax
add rsp, 0x28
ret
mov r8d, r8d
add rsp, 0x28
jmp fcn.14008eca0
Function at 0x1400440f0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x14018a040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x14019ba08]
mov ecx, dword [0x140198758]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140044157
lea rax, [0x14019ba00]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
cmp rcx, qword [0x14018a040]
je 0x14004414d
call fcn.1400b6410
int3
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x14019ba08]
call fcn.1400b516c
cmp dword [0x14019ba08], 0xffffffff
jne 0x14004412c
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.1400e6f50
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x88
call fcn.1400b50e8
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x14019ba50]
mov ecx, dword [0x140198758]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140044217
lea r8, [0x14019ba20]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.140044310
mov qword [0x14019ba00], rsi
lea rcx, [0x14019ba08]
call fcn.1400b5220
jmp 0x14004412c
lea rcx, [0x14019ba50]
call fcn.1400b516c
cmp dword [0x14019ba50], 0xffffffff
jne 0x1400441e8
xorps xmm0, xmm0
movups xmmword [0x14019ba40], xmm0
movups xmmword [0x14019ba30], xmm0
movups xmmword [0x14019ba20], xmm0
lea rcx, [0x14019ba20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x14019ba50]
call fcn.1400b5220
jmp 0x1400441e8

Function at 0x140044260
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14019ba50]
mov ecx, dword [0x140198758]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14004429b
movzx eax, word [0x14019ba20]
cmp eax, 9
jne 0x1400442e3
mov eax, 1
add rsp, 0x28
ret
lea rcx, [0x14019ba50]
call fcn.1400b516c
cmp dword [0x14019ba50], 0xffffffff
jne 0x140044285
xorps xmm0, xmm0
movups xmmword [0x14019ba40], xmm0
movups xmmword [0x14019ba30], xmm0
movups xmmword [0x14019ba20], xmm0
lea rcx, [0x14019ba20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x14019ba50]
call fcn.1400b5220
jmp 0x140044285
test eax, eax
je 0x140044296
cmp eax, 6
jne 0x1400442f3
mov eax, 2
jmp 0x140044296
cmp eax, 0xc
jne 0x1400442ff
mov eax, 3
jmp 0x140044296
mov eax, 4
jmp 0x140044296
Function at 0x140045cf0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
jne 0x140045dde
cmp qword [rsi], 0
jne 0x140045dde
cmp dword [rsi + 0x14], 0
jne 0x140045dde
cmp qword [rsi + 8], 0
jne 0x140045dde
xor eax, eax
mov r14, qword [rdi]
cmp rax, r14
je 0x140045d60
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140045db0
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140045d58
mov qword [rsi], r14
call fcn.14008b040
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rdi + 8]
cmp qword [rsi + 8], r14
je 0x140045d9a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x140045dc6
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140045d92
mov qword [rsi + 8], r14
call fcn.14008b040
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14008b040
mov rcx, qword [rsi]
call fcn.140086370
mov qword [rsi], 0
jmp 0x140045d46
call fcn.14008b040
mov rcx, qword [rsi + 8]
call fcn.140086370
mov qword [rsi + 8], 0
jmp 0x140045d7f
mov rcx, rsi
call fcn.14010cdd0
mov rax, qword [rsi]
jmp 0x140045d2a
Function at 0x140049580
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x248
mov rax, qword [0x14018a040]
xor rax, rsp
mov qword [rsp + 0x240], rax
movaps xmm0, xmmword [0x14015feb0]
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
call sub.ntdll.dll_RtlFormatCurrentUserKeyPath
mov esi, eax
test eax, eax
js 0x1400496fc
lea rdi, [rsp + 0x20]
mov rdx, qword [rdi + 8]
lea rbx, [0x14019c0b0]
mov r14d, 0xff
mov r8d, 0xff
mov rcx, rbx
call fcn.1400d1f6c
mov rcx, rbx
call fcn.1400d1b18
sub r14, rax
lea rdx, [0x1401647be]
mov rcx, rbx
mov r8, r14
call fcn.1400d1f6c
mov rcx, rdi
call sub.ntdll.dll_RtlFreeUnicodeString
lea rbx, [rsp + 0x30]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call fcn.1400e6f50
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdi, rax
lea rcx, str.PROGRAMFILES
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14004965c
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400d1fb4
test eax, eax
je 0x140049728
lea rcx, str.PROGRAMFILES_X86_
lea rdx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140049697
mov r8d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400d1fb4
test eax, eax
je 0x140049728
xor eax, eax
mov byte [0x14019bca9], al
mov dword [rsp + 0x30], 0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140171954]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004972f
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rax, rdi
call qword [0x14017da68]
test eax, eax
je 0x14004972f
cmp dword [rsp + 0x30], 0
setne al
mov byte [0x14019c2b0], al
mov byte [0x14019bca8], 1
test esi, esi
setns al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
cmp rcx, qword [0x14018a040]
je 0x14004971b
call fcn.1400b6410
int3
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r14
ret
mov al, 1
jmp 0x140049699
xor eax, eax
jmp 0x1400496ef
Function at 0x140049960
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rsi, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x14018a040]
xor rax, rsp
mov qword [rsp + 0x70], rax
movsx rax, byte [r8 + 0x17]
test rax, rax
jns 0x140049994
mov rax, qword [rsi + 8]
test rax, rax
je 0x140049a9a
bt ebx, 8
jae 0x1400499b0
mov eax, ebx
and eax, 0x200
jne 0x140049a9a
cmp edi, 2
lea rax, [0x14019bcb0]
lea rcx, [0x14019beb0]
cmove rcx, rax
cmp word [rcx], 0
jne 0x140049a9a
xorps xmm0, xmm0
lea r14, [rsp + 0x40]
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [r14], 0
je 0x140049a9a
bt ebx, 8
jb 0x140049a9a
shr ebx, 9
and ebx, 1
or bl, byte [0x14019c2b0]
test bl, 1
je 0x140049a9a
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea r12, str.SOFTWARE
cmove r12, rax
movsx r13, byte [rsi + 0x17]
test r13, r13
jns 0x140049ac2
mov r14, qword [rsi]
mov r13, qword [rsi + 8]
mov edi, 1
xor ebx, ebx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x2c], 0
mov r15, qword [r12 + 8]
mov rbp, r13
sub rbp, r15
jb 0x140049a83
mov rdx, qword [r12]
mov rcx, r14
mov r8, r15
call fcn.1400cd0b0
test eax, eax
je 0x140049aca
add r12, 0x28
inc rbx
cmp rbx, rdi
jb 0x140049a63
cmp dword [rsp + 0x2c], 0
jne 0x140049b45
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
cmp rcx, qword [0x14018a040]
je 0x140049ab1
call fcn.1400b6410
int3
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, rsi
jmp 0x140049a42
movzx ecx, word [r14 + r15*2]
cmp ecx, 0x5c
je 0x140049ad8
test ecx, ecx
jne 0x140049a83
lea rax, [r14 + r15*2]
mov edx, dword [r12 + 0x10]
mov dword [rsp + 0x2c], edx
cmp edx, 1
je 0x140049b04
cmp dword [rsp + 0x2c], 2
jne 0x140049b15
lea rdx, str.WOW6432Node
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
jmp 0x140049b15
lea rdx, str.WOW6432Node_
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], r14
cmp cx, 0x5c
jne 0x140049b2e
lea r14, [rax + 2]
dec rbp
cmp word [rax + 2], 0x5c
mov rax, r14
je 0x140049b1b
jmp 0x140049b31
mov r14, rax
mov rdi, qword [r12 + 0x20]
mov r12, qword [r12 + 0x18]
xor ebx, ebx
mov r13, rbp
jmp 0x140049a8a
cmp byte [rsi + 0x17], 0
mov rax, rsi
jns 0x140049b51
mov rax, qword [rsi]
cmp qword [rsp + 0x30], 0
je 0x140049b87
mov rbx, qword [rsp + 0x38]
sub rbx, rax
sar rbx, 1
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call fcn.1400d1b18
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
mov r9, rax
call fcn.140036070
jmp 0x140049a9a
ud2
Function at 0x140052d90
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r15, rcx
mov r13, qword [rsp + 0xb0]
mov rax, qword [0x14018a040]
xor rax, rsp
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
xor r14d, r14d
test r13, r13
je 0x140052e00
mov ecx, dword [r13 + 0x2c]
call fcn.14009b6e0
test rax, rax
je 0x140052edb
mov r12, rax
xor ecx, ecx
call fcn.14009b740
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
mov r14, r12
mov rax, qword [r13 + 0x10]
lea rcx, [0x14012b250]
cmp rax, rcx
jne 0x140052edf
xorps xmm0, xmm0
movups xmmword [r14 + 0x5c], xmm0
movups xmmword [r14 + 0x50], xmm0
movups xmmword [r14 + 0x40], xmm0
movups xmmword [r14 + 0x30], xmm0
movups xmmword [r14 + 0x20], xmm0
movaps xmm0, xmmword [0x1401742e0]
movups xmmword [r14], xmm0
movaps xmm0, xmmword [0x1401742f0]
movups xmmword [r14 + 0x10], xmm0
mov dword [r14 + 0x6c], 0x20
lea r14, [rsp + 0x20]
mov rax, qword [r14]
mov rax, qword [rax + 0x18]
mov rcx, r14
mov rdx, r15
mov r8, rbx
call qword [0x14017da68]
mov rax, qword [r14]
mov rax, qword [rax + 0x20]
mov rcx, r14
mov rdx, rdi
call qword [0x14017da68]
mov rax, qword [r14]
test rsi, rsi
je 0x140052e8a
mov ecx, dword [rax + 4]
mov dword [rsi], ecx
mov edx, dword [rax + 0x2c]
mov rcx, qword [rsp + 0x28]
call fcn.14009b780
mov r14d, 1
mov rcx, qword [rsp + 0x28]
call fcn.14009b740
mov rax, qword [rsp + 0x38]
test rax, rax
jne 0x140052eef
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
cmp rcx, qword [0x14018a040]
je 0x140052ec8
call fcn.1400b6410
int3
mov eax, r14d
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor ecx, ecx
jmp 0x140052ea2
lea rcx, [rsp + 0x20]
call qword [0x14017da68]
jmp 0x140052e4f
mov rax, qword [rax]
mov rcx, qword [rsp + 0x30]
call qword [0x14017da68]
jmp 0x140052eb1

Function at 0x140052f50
Capabilities:
Hash data using sha256

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rax, qword [rcx]
cmp rax, rdx
je 0x140052f88
mov rdi, rdx
mov ecx, dword [rdx + 0x2c]
call fcn.14009b6e0
test rax, rax
je 0x140052fdc
mov rbx, rax
mov rcx, qword [rsi + 8]
call fcn.14009b740
mov qword [rsi + 8], rbx
mov qword [rsi], rdi
mov rax, rdi
mov rax, qword [rax + 0x10]
lea rcx, [0x14012b250]
cmp rax, rcx
jne 0x140052fe0
mov rax, qword [rsi + 8]
xorps xmm0, xmm0
movups xmmword [rax + 0x5c], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x1401742e0]
movups xmmword [rax], xmm0
movaps xmm0, xmmword [0x1401742f0]
movups xmmword [rax + 0x10], xmm0
mov dword [rax + 0x6c], 0x20
mov eax, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x140052fd4
mov rcx, rsi
call qword [0x14017da68]
jmp 0x140052fcf
Function at 0x140053080
Capabilities:
Hash data using sha256

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 0x10], 0
jne 0x1400530b7
mov rcx, qword [rsp + 0x80]
mov rdx, r9
call fcn.140060690
mov qword [rdi + 0x10], rax
test rax, rax
je 0x1400531c1
mov ebp, dword [rsp + 0x88]
lea rcx, [0x14019e250]
lea rdx, [0x140056b70]
call fcn.14009be10
lea rax, [0x14019e258]
mov qword [rdi + 0x18], rax
mov rcx, qword [rdi + 0x10]
cmp ebp, 1
jne 0x1400531c5
call fcn.140060990
test eax, eax
je 0x1400531c1
test rbx, rbx
je 0x14005310f
mov rcx, qword [rdi + 0x10]
mov rdx, rbx
call fcn.14005e250
test eax, eax
je 0x1400531c1
xor eax, eax
test ebp, ebp
setne al
mov rcx, qword [rdi + 0x10]
mov rcx, qword [rcx]
shl eax, 4
cmp qword [rcx + rax + 0x28], 0
je 0x1400531a3
test rbx, rbx
je 0x1400531da
mov rax, qword [rdi]
cmp rax, rbx
je 0x14005315c
mov ecx, dword [rbx + 0x2c]
call fcn.14009b6e0
test rax, rax
je 0x1400531c1
mov r14, rax
mov rcx, qword [rdi + 8]
call fcn.14009b740
mov qword [rdi + 8], r14
mov qword [rdi], rbx
mov rax, rbx
mov rax, qword [rax + 0x10]
lea rcx, [0x14012b250]
cmp rax, rcx
jne 0x1400531cf
mov rax, qword [rdi + 8]
xorps xmm0, xmm0
movups xmmword [rax + 0x5c], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x1401742e0]
movups xmmword [rax], xmm0
movaps xmm0, xmmword [0x1401742f0]
movups xmmword [rax + 0x10], xmm0
mov dword [rax + 0x6c], 0x20
mov ebx, 1
test rsi, rsi
je 0x1400531b4
mov rax, qword [rdi + 0x10]
mov qword [rsi], rax
mov eax, ebx
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
jmp 0x1400531b4
call fcn.140138030
jmp 0x1400530ee
mov rcx, rdi
call qword [0x14017da68]
jmp 0x1400531a3
mov dword [rsp + 0x20], 0x6d
lea r9, str....._third_party_boringssl_srccrypto_fipsmoduledigestsigndigestsign.c
xor ebx, ebx
mov ecx, 6
xor edx, edx
mov r8d, 0x77
call fcn.140137eb0
jmp 0x1400531b4
Function at 0x140054750
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, r8
mov rsi, rdx
mov rdi, rcx
movsxd r8, dword [rcx + 0x148]
test r8, r8
jle 0x140054966
mov r10, qword [rdi + 0x140]
xor ecx, ecx
mov edx, r8d
mov r11d, edx
cmp qword [r10 + r11*8 - 8], 0
je 0x140054926
movsxd rcx, edx
shl edx, 6
mov r10, qword [r10 + rcx*8 - 8]
xor ecx, ecx
test r10, r10
setne cl
or ecx, edx
xor edx, edx
mov r11, r10
shr r11, 0x20
setne dl
cmove r11, r10
shl edx, 5
mov rbx, r11
shr rbx, 0x10
xor r10d, r10d
cmp r11, 0x10000
setae r10b
cmovb rbx, r11
shl r10d, 4
mov r14, rbx
shr r14, 8
xor r11d, r11d
cmp rbx, 0x100
setae r11b
cmovb r14, rbx
mov rbx, r14
shr rbx, 4
xor r15d, r15d
cmp r14, 0x10
setae r15b
cmovb rbx, r14
mov r14, rbx
shr r14, 2
xor r12d, r12d
cmp rbx, 4
setae r12b
cmovb r14, rbx
or edx, ecx
or edx, r10d
cmp r14, 2
lea ecx, [rdx + r11*8]
lea ecx, [rcx + r15*4]
lea ecx, [rcx + r12*2]
sbb ecx, 0xffffffff
add ecx, 0xffffffc7
shr ecx, 3
cmp rcx, r9
jne 0x14005493b
lea rcx, [r8*8]
cmp rcx, r9
jb 0x140054961
mov rcx, rsi
cmp r9, 8
jb 0x140054878
mov rdx, qword [rax + r9 - 8]
add r9, 0xfffffffffffffff8
bswap rdx
mov qword [rcx], rdx
add rcx, 8
dec r8
cmp r9, 7
ja 0x14005485c
test r9, r9
je 0x1400548a3
xor edx, edx
xor r10d, r10d
mov r11, r10
shl r11, 8
movzx r10d, byte [rax + rdx]
or r10, r11
inc rdx
cmp r9, rdx
jne 0x140054882
mov qword [rcx], r10
add rcx, 8
dec r8
shl r8, 3
test r8, r8
jne 0x14005497a
movsxd rcx, dword [rdi + 0x148]
mov eax, 0x14b
test rcx, rcx
je 0x140054940
mov r8, qword [rdi + 0x140]
xor edx, edx
xor r9d, r9d
mov r10, qword [r8 + r9*8]
mov r11, qword [rsi + r9*8]
mov rdi, r11
xor rdi, r10
lea rbx, [rdi - 1]
mov r14, r11
sub r14, r10
xor r14, r11
or r14, rdi
not rdi
and rbx, rdi
sar rbx, 0x3f
xor r14, r11
sar r14, 0x3f
xor rdx, r14
and rdx, rbx
xor rdx, r14
inc r9
cmp rcx, r9
jne 0x1400548cd
mov esi, 1
test edx, edx
jns 0x140054940
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r11d, [rdx - 1]
cmp edx, 1
mov edx, r11d
jg 0x140054782
jmp 0x140054839
mov eax, 0x144
mov dword [rsp + 0x20], eax
lea r9, str....._third_party_boringssl_srccrypto_fipsmoduleec_simple.c
xor esi, esi
mov ecx, 0xf
xor edx, edx
mov r8d, 0x80
call fcn.140137eb0
jmp 0x140054916
call fcn.1400c9a9c
test r8d, r8d
je 0x140054986
mov r10, qword [rdi + 0x140]
mov edx, r8d
jmp 0x140054791
xor edx, edx
call fcn.1400e6f50
jmp 0x1400548b0
xor ecx, ecx
jmp 0x140054839
Function at 0x140054fb0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x14018a040]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp r8, 0x30
ja 0x14005510a
mov r14, r8
mov r15, rdx
mov rsi, rcx
movaps xmm0, xmmword [0x14015feb0]
lea rdi, [rsp + 0x40]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi - 0x10], xmm0
movaps xmmword [rdi - 0x20], xmm0
lea r12, [rsp + 0x30]
lea rbx, [rcx + 0x108]
mov eax, dword [rcx + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rcx + 0x114], eax
mov rax, qword [rcx + 0xf8]
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r8, rsi
call qword [0x14017da68]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, r12
mov r8, rsi
call qword [0x14017da68]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [0x14017da68]
test r14, r14
je 0x140055093
xor eax, eax
mov cl, byte [r15 + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp r14, rax
jne 0x140055083
mov ecx, 1
call fcn.14009c5c0
bt eax, 0x19
jae 0x140055115
not eax
lea rcx, [rsp + 0x20]
mov edx, 0x100
mov r8, rsi
test eax, 0x12000000
jne 0x14005510e
call fcn.1400032c0
lea rax, [0x140001d60]
lea rcx, [fcn.140001000]
mov qword [rsi + 0xf8], rcx
mov qword [rsi + 0x100], rax
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
cmp rcx, qword [0x14018a040]
je 0x1400550fc
call fcn.1400b6410
int3
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor eax, eax
jmp 0x1400550e5
call fcn.140002fd0
jmp 0x1400550be
lea rcx, [rsp + 0x20]
mov edx, 0x100
mov r8, rsi
bt eax, 9
jae 0x14005513d
call fcn.1400040d0
lea rax, [0x1400045a0]
lea rcx, [fcn.1400042a0]
jmp 0x1400550cc
call fcn.140113560
lea rax, [0x1401141a0]
lea rcx, [0x140113430]
jmp 0x1400550cc
Function at 0x140055170
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm8
movaps xmmword [rsp + 0xc0], xmm7
movaps xmmword [rsp + 0xb0], xmm6
mov qword [rsp + 0x28], r9
mov rax, qword [0x14018a040]
xor rax, rsp
mov qword [rsp + 0xa8], rax
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x24], 1
test rdx, rdx
je 0x14005533f
mov r15, r8
mov rdi, rdx
mov rbx, rcx
mov rsi, qword [rsp + 0x150]
mov r13d, dword [rsi + 4]
xor r14d, r14d
movaps xmm7, xmmword [0x1401742e0]
movaps xmm8, xmmword [0x1401742f0]
lea r12, [rsp + 0x30]
mov eax, r14d
bswap eax
mov dword [rsp + 0x5c], eax
mov rax, qword [rsp + 0x30]
cmp rax, rsi
je 0x14005523b
mov ecx, dword [rsi + 0x2c]
call fcn.14009b6e0
test rax, rax
je 0x14005539e
mov rbp, rax
mov rcx, qword [rsp + 0x38]
call fcn.14009b740
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rsi
mov rax, rsi
mov rax, qword [rax + 0x10]
lea rcx, [0x14012b250]
cmp rax, rcx
jne 0x1400553a8
mov rax, qword [rsp + 0x38]
movups xmmword [rax + 0x5c], xmm6
movups xmmword [rax + 0x50], xmm6
movups xmmword [rax + 0x40], xmm6
movups xmmword [rax + 0x30], xmm6
movups xmmword [rax + 0x20], xmm6
movups xmmword [rax], xmm7
movups xmmword [rax + 0x10], xmm8
mov dword [rax + 0x6c], 0x20
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x18]
mov rcx, r12
mov rdx, r15
mov r8, qword [rsp + 0x28]
call qword [0x14017da68]
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x18]
mov r8d, 4
mov rcx, r12
lea rdx, [rsp + 0x5c]
call qword [0x14017da68]
cmp rdi, r13
jb 0x1400552eb
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x20]
mov rcx, r12
mov rdx, rbx
call qword [0x14017da68]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov edx, dword [rax + 0x2c]
call fcn.14009b780
add rbx, r13
inc r14d
sub rdi, r13
jne 0x1400551fd
jmp 0x14005533f
movaps xmm0, xmmword [0x14015feb0]
lea r14, [rsp + 0x60]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea r15, [rsp + 0x30]
mov rax, qword [r15]
mov rax, qword [rax + 0x20]
mov rcx, r15
mov rdx, r14
call qword [0x14017da68]
mov rax, qword [r15]
mov rcx, qword [r15 + 8]
mov edx, dword [rax + 0x2c]
call fcn.14009b780
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call fcn.1400e68b0
mov rcx, qword [rsp + 0x38]
call fcn.14009b740
mov rax, qword [rsp + 0x48]
test rax, rax
jne 0x1400553b8
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
cmp rcx, qword [0x14018a040]
je 0x14005536d
call fcn.1400b6410
int3
mov eax, dword [rsp + 0x24]
movaps xmm6, xmmword [rsp + 0xb0]
movaps xmm7, xmmword [rsp + 0xc0]
movaps xmm8, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsp + 0x24], 0
jmp 0x14005533f
lea rcx, [rsp + 0x30]
call qword [0x14017da68]
jmp 0x140055277
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [0x14017da68]
jmp 0x140055353