joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400875d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
sub rsp, 0x88
mov rax, qword [0x14023f780]
xor rax, rsp
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [r8]
mov rdi, rcx
lea rcx, [rsp + 0x20]
movups xmm1, xmmword [r8 + 0x10]
mov rbx, rdx
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [r8 + 0x20]
movaps xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [r8 + 0x30]
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm1
call fcn.1400885f0
xor r11d, r11d
test rbx, rbx
je 0x140087775
mov qword [rsp + 0xa8], rbp
movabs rbp, 0xff000000ff00
mov qword [rsp + 0xb8], rsi
mov esi, 0xffff0000
mov qword [rsp + 0x80], r12
movabs r12, 0xffffffff00000000
mov qword [rsp + 0x78], r14
movabs r14, 0xf000f000f000f0
mov qword [rsp + 0x70], r15
lea r15, [rsp + 0x20]
nop word [rax + rax]
mov r10, qword [rsp + r11*8 + 0x40]
lea rdi, [rdi + 0x10]
mov rdx, qword [r15 + r11*8]
mov r9, r10
shl r9, 0x20
and r10, r12
mov eax, edx
inc r11
or r9, rax
shr rdx, 0x20
or r10, rdx
mov rcx, r9
shr rcx, 0x10
xor rcx, r9
and rcx, rsi
mov rax, rcx
shl rax, 0x10
xor rax, rcx
xor r9, rax
mov rcx, r9
shr rcx, 8
xor rcx, r9
and rcx, rbp
mov rax, rcx
shl rax, 8
xor rax, rcx
mov rcx, r10
xor r9, rax
shr rcx, 0x10
xor rcx, r10
mov r8, r9
and rcx, rsi
shr r8, 4
mov rax, rcx
xor r8, r9
shl rax, 0x10
and r8, r14
xor rax, rcx
xor r10, rax
mov rcx, r10
shr rcx, 8
xor rcx, r10
and rcx, rbp
mov rax, rcx
shl rax, 8
xor rax, rcx
xor r10, rax
mov rax, r8
shl rax, 4
mov rcx, r10
xor rax, r8
shr rcx, 4
xor rax, r9
xor rcx, r10
mov qword [rdi - 0x10], rax
and rcx, r14
mov rax, rcx
shl rax, 4
xor rax, rcx
xor rax, r10
mov qword [rdi - 8], rax
cmp r11, rbx
jb 0x140087680
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
mov rsi, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14018eb60
add rsp, 0x88
pop rdi
pop rbx
ret
Function at 0x140087a10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rdi, r8
sub edx, 0x80
je 0x140087a84
sub edx, 0x40
je 0x140087a66
cmp edx, 0x40
je 0x140087a48
mov eax, 1
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
mov rdx, rcx
mov rcx, rdi
call fcn.140087f20
xor eax, eax
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
mov rdx, rcx
mov rcx, rdi
call fcn.140087bf0
xor eax, eax
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
mov qword [rsp + 0x90], rbp
mov rdx, rcx
mov qword [rsp + 0x98], rsi
lea rcx, [rsp + 0x20]
mov qword [rsp + 0xa0], r14
mov dword [r8 + 0xf0], 0xa
call fcn.140086e10
movups xmm2, xmmword [rsp + 0x20]
mov ebx, 1
lea r14, [0x1401ed180]
movabs rbp, 0xf000000000000
movups xmmword [rdi], xmm2
add rdi, 0x10
xor esi, esi
nop dword [rax + rax]
movq qword [rsp + 0x40], xmm2
lea rcx, [rsp + 0x40]
psrldq xmm2, 8
xorps xmm0, xmm0
xorps xmm1, xmm1
movq qword [rsp + 0x60], xmm2
mov qword [rsp + 0x48], rsi
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x68], rsi
movdqa xmmword [rsp + 0x70], xmm1
call fcn.1400885f0
lea rcx, [rsp + 0x40]
call fcn.140088120
lea rcx, [rsp + 0x40]
call fcn.1400885f0
mov rax, qword [rsp + 0x40]
movzx r9d, byte [rbx + r14 - 1]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov rax, rsi
nop dword [rax + rax]
mov rdx, qword [rsp + rax*8 + 0x30]
movzx ecx, al
shl cl, 2
mov r8, r9
shr r8, cl
mov rcx, rdx
shr rcx, 0x10
and r8d, 0xf
and rdx, rbp
or rcx, rdx
shr rcx, 0x24
xor r8, rcx
xor r8, qword [rsp + rax*8 + 0x20]
mov rcx, r8
shl rcx, 0x10
xor rcx, r8
shl rcx, 0x10
xor rcx, r8
shl rcx, 0x10
xor rcx, r8
mov qword [rsp + rax*8 + 0x20], rcx
inc rax
cmp rax, 2
jb 0x140087b50
movups xmm2, xmmword [rsp + 0x20]
inc rbx
movups xmmword [rdi], xmm2
add rdi, 0x10
cmp rbx, 0xa
jbe 0x140087ae0
mov r14, qword [rsp + 0xa0]
xor eax, eax
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140087f20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
mov dword [rcx + 0xf0], send
lea rcx, [rbp - 0x50]
mov rbx, rdx
call fcn.140086e10
movups xmm1, xmmword [rbp - 0x50]
lea rdx, [rbx + 0x10]
lea rcx, [rbp - 0x60]
movups xmmword [rdi], xmm1
call fcn.140086e10
movdqu xmm3, xmmword [rbp - 0x60]
mov ebx, 2
lea r15, [0x1401ed180]
movabs r14, 0xf000000000000
movups xmmword [rdi + 0x10], xmm3
add rdi, 0x20
xor esi, esi
xorps xmm0, xmm0
mov qword [rbp - 0x38], rsi
movdqu xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x40]
movdqa xmm0, xmm3
mov qword [rbp - 0x18], rsi
psrldq xmm0, 8
xorps xmm1, xmm1
movq qword [rbp - 0x20], xmm0
movdqu xmmword [rbp - 0x10], xmm1
movq qword [rbp - 0x40], xmm3
call fcn.1400885f0
lea rcx, [rbp - 0x40]
call fcn.140088120
lea rcx, [rbp - 0x40]
call fcn.1400885f0
mov rax, qword [rbp - 0x40]
mov rcx, rbx
mov qword [rbp - 0x60], rax
mov rax, qword [rbp - 0x20]
shr rcx, 1
mov qword [rbp - 0x58], rax
mov rax, rsi
movzx r9d, byte [rcx + r15 - 1]
nop word [rax + rax]
mov rdx, qword [rbp + rax*8 - 0x60]
movzx ecx, al
shl cl, 2
mov r8, r9
shr r8, cl
mov rcx, rdx
shr rcx, 0x10
and r8d, 0xf
and rdx, r14
or rcx, rdx
shr rcx, 0x24
xor r8, rcx
xor r8, qword [rbp + rax*8 - 0x50]
mov rcx, r8
shl rcx, 0x10
xor rcx, r8
shl rcx, 0x10
xor rcx, r8
shl rcx, 0x10
xor rcx, r8
mov qword [rbp + rax*8 - 0x50], rcx
inc rax
cmp rax, 2
jb 0x140088000
movups xmm2, xmmword [rbp - 0x50]
movups xmmword [rdi], xmm2
cmp rbx, 0xe
je 0x1400880fa
movq qword [rbp - 0x40], xmm2
lea rcx, [rbp - 0x40]
psrldq xmm2, 8
xorps xmm0, xmm0
xorps xmm1, xmm1
movq qword [rbp - 0x20], xmm2
mov qword [rbp - 0x38], rsi
movdqu xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x18], rsi
movdqu xmmword [rbp - 0x10], xmm1
call fcn.1400885f0
lea rcx, [rbp - 0x40]
call fcn.140088120
lea rcx, [rbp - 0x40]
call fcn.1400885f0
mov rax, qword [rbp - 0x40]
add rbx, 2
mov qword [rbp - 0x60], rax
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x58], rax
movdqu xmm1, xmmword [rbp - 0x60]
psrlq xmm1, 0x30
xorps xmm1, xmm3
movdqa xmm3, xmm1
movdqa xmm0, xmm1
psllq xmm3, 0x10
xorps xmm3, xmm1
psllq xmm0, 0x20
xorps xmm3, xmm0
psllq xmm1, 0x30
xorps xmm3, xmm1
movups xmmword [rdi + 0x10], xmm3
add rdi, 0x20
cmp rbx, 0xe
jbe 0x140087f90
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140088480
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
xorps xmm0, xmm0
xor esi, esi
mov rbx, r8
mov rdi, rdx
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm0
test r8, r8
je 0x1400885d7
mov qword [rsp + 0x40], rbp
movabs rbp, 0xf000f000f000f0
mov qword [rsp + 0x48], r12
movabs r12, 0xffffffff00000000
mov qword [rsp + 0x50], r14
movabs r14, 0xff000000ff00
mov qword [rsp + 0x58], r15
mov r15d, 0xffff0000
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdi]
mov r10, qword [rdi + 8]
lea rdi, [rdi + 0x10]
mov rax, rdx
shr rax, 4
xor rax, rdx
and rax, rbp
mov r8, rax
shl r8, 4
xor r8, rax
xor r8, rdx
mov rdx, r8
shr rdx, 8
xor rdx, r8
and rdx, r14
mov rax, rdx
shl rax, 8
xor rax, rdx
xor r8, rax
mov rax, r8
shr rax, 0x10
xor rax, r8
and rax, r15
mov r11, rax
shl r11, 0x10
xor r11, rax
mov rax, r10
shr rax, 4
xor r11, r8
xor rax, r10
and rax, rbp
mov r9, rax
shl r9, 4
xor r9, rax
xor r9, r10
mov rdx, r9
shr rdx, 8
xor rdx, r9
and rdx, r14
mov rax, rdx
shl rax, 8
xor rax, rdx
xor r9, rax
mov rax, r9
shr rax, 0x10
xor rax, r9
and rax, r15
mov r8, rax
shl r8, 0x10
xor r8, rax
mov eax, r11d
xor r8, r9
shr r11, 0x20
mov rdx, r8
and r8, r12
shl rdx, 0x20
or r11, r8
or rdx, rax
mov qword [rcx + rsi*8 + 0x20], r11
mov qword [rcx + rsi*8], rdx
inc rsi
cmp rsi, rbx
jb 0x1400884f0
mov r15, qword [rsp + 0x58]
mov r14, qword [rsp + 0x50]
mov r12, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbx
jmp fcn.1400885f0
Function at 0x140088bc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r14
xor ebx, ebx
mov qword [rsp + 0x28], rbp
cmp rdx, r9
mov rbp, r9
mov rdi, r8
mov r11, rdx
cmovb rbp, rdx
mov rsi, rcx
mov r14d, ebx
test rbp, rbp
je 0x140088c72
mov qword [rsp + 0x38], r12
mov r12, r8
mov qword [rsp + 0x40], r15
mov r15, rcx
sub r15, r8
nop
mov r10, qword [r15 + r12]
lea r12, [r12 + 8]
mov r8, r10
mov rcx, r10
sub r10, qword [r12 - 8]
xor r8, qword [r12 - 8]
shr rcx, 0x3f
mov rax, r8
shr r10, 0x3f
xor r10d, ecx
shr rax, 0x3f
or r10d, eax
lea rdx, [r8 - 1]
xor r10d, ecx
shr rdx, 0x3f
neg r10d
not r8
shr r8, 0x3f
mov ecx, r10d
and edx, r8d
not ecx
neg edx
and ecx, 1
mov eax, edx
or ecx, r10d
and edx, r14d
not eax
and ecx, eax
mov r14d, ecx
or r14d, edx
sub rbp, 1
jne 0x140088c00
mov r15, qword [rsp + 0x40]
mov r12, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x28]
cmp r11, r9
jae 0x140088d0e
mov rax, r9
sub rax, r11
cmp rax, 4
jb 0x140088ce0
and eax, 3
mov rcx, r9
sub rcx, rax
xorps xmm2, xmm2
xorps xmm1, xmm1
nop dword [rax + rax]
movdqu xmm0, xmmword [rdi + r11*8]
orps xmm2, xmm0
movdqu xmm0, xmmword [rdi + r11*8 + 0x10]
add r11, 4
orps xmm1, xmm0
cmp r11, rcx
jb 0x140088ca0
orps xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
orps xmm1, xmm0
movq rbx, xmm1
cmp r11, r9
jae 0x140088cec
nop word [rax + rax]
or rbx, qword [rdi + r11*8]
inc r11
cmp r11, r9
jb 0x140088ce0
lea rcx, [rbx - 1]
not rbx
shr rcx, 0x3f
shr rbx, 0x3f
and ecx, ebx
neg ecx
mov eax, ecx
not ecx
and eax, r14d
or eax, ecx
pop r14
pop rdi
pop rsi
pop rbx
ret
jbe 0x140088da1
mov rax, r11
sub rax, r9
cmp rax, 4
jb 0x140088d70
and eax, 3
mov rcx, r11
sub rcx, rax
xorps xmm2, xmm2
xorps xmm1, xmm1
nop
movdqu xmm0, xmmword [rsi + r9*8]
orps xmm2, xmm0
movdqu xmm0, xmmword [rsi + r9*8 + 0x10]
add r9, 4
orps xmm1, xmm0
cmp r9, rcx
jb 0x140088d30
orps xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
orps xmm1, xmm0
movq rbx, xmm1
cmp r9, r11
jae 0x140088d7c
nop word [rax + rax]
or rbx, qword [rsi + r9*8]
inc r9
cmp r9, r11
jb 0x140088d70
lea rcx, [rbx - 1]
not rbx
shr rcx, 0x3f
shr rbx, 0x3f
and ecx, ebx
neg ecx
mov eax, ecx
not ecx
and ecx, 1
and eax, r14d
or eax, ecx
pop r14
pop rdi
pop rsi
pop rbx
ret
mov eax, r14d
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14008b250
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
mov rcx, rbx
xor edx, edx
call fcn.1400894d0
test eax, eax
je 0x14008b298
xor edx, edx
mov dword [rsp + 0x20], 0xaa
lea r9, str.D:Program_Files_vcpkg_buildtrees_boringssl_src81732c5edd_6f4b2e14e9.cleancrypto_fipsmodule_bn_montgomery.c
lea ecx, [rdx + 3]
lea r8d, [rdx + 0x69]
call fcn.14009a320
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
cmp dword [rbx + 8], 0
jle 0x14008b401
mov rax, qword [rbx]
test byte [rax], 1
je 0x14008b401
cmp dword [rbx + 0x10], 0
je 0x14008b2de
xor edx, edx
mov dword [rsp + 0x20], 0xb2
lea r9, str.D:Program_Files_vcpkg_buildtrees_boringssl_src81732c5edd_6f4b2e14e9.cleancrypto_fipsmodule_bn_montgomery.c
lea ecx, [rdx + 3]
lea r8d, [rdx + 0x6d]
call fcn.14009a320
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
mov edx, 0x400
mov rcx, rbx
call fcn.1400894d0
test eax, eax
jne 0x14008b319
lea r9, str.D:Program_Files_vcpkg_buildtrees_boringssl_src81732c5edd_6f4b2e14e9.cleancrypto_fipsmodule_bn_montgomery.c
mov dword [rsp + 0x20], 0xb6
xor edx, edx
lea ecx, [rax + 3]
lea r8d, [rax + 0x66]
call fcn.14009a320
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
mov rdx, rbx
mov qword [rsp + 0x40], rdi
lea rcx, [rsi + 0x18]
call fcn.140078d00
test rax, rax
jne 0x14008b35e
lea r9, str.D:Program_Files_vcpkg_buildtrees_boringssl_src81732c5edd_6f4b2e14e9.cleancrypto_fipsmodule_bn_montgomery.c
mov dword [rsp + 0x20], 0xbc
xor edx, edx
lea ecx, [rax + 3]
lea r8d, [rax + 0x44]
call fcn.14009a320
mov rdi, qword [rsp + 0x40]
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
lea rcx, [rsi + 0x18]
call fcn.14008d940
mov rax, qword [rsi + 0x18]
mov r9d, 1
xor r8d, r8d
movabs rbx, 0x8000000000000000
mov r10, qword [rax]
lea r11d, [r9 + 0x1f]
nop word [rax + rax]
shr r8, 1
mov rdx, r9
and edx, 1
neg rdx
mov rax, rdx
and rdx, rbx
add rdx, r8
and rax, r10
mov rcx, rax
shr rdx, 1
and rax, r9
xor rcx, r9
shr rcx, 1
add rcx, rax
mov r8, rcx
and r8d, 1
neg r8
mov rax, r8
and r8, rbx
and rax, r10
add r8, rdx
mov r9, rax
and rax, rcx
xor r9, rcx
shr r9, 1
add r9, rax
sub r11, 1
jne 0x14008b390
mov rdi, qword [rsp + 0x40]
lea eax, [r11 + 1]
mov qword [rsi + 0x30], r8
mov qword [rsi + 0x38], r11
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
xor edx, edx
mov dword [rsp + 0x20], 0xae
lea r9, str.D:Program_Files_vcpkg_buildtrees_boringssl_src81732c5edd_6f4b2e14e9.cleancrypto_fipsmodule_bn_montgomery.c
lea ecx, [rdx + 3]
lea r8d, [rdx + 0x68]
call fcn.14009a320
mov rbx, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rsi
ret
Function at 0x14008f230
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x70
mov rax, qword [0x14023f780]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, r8
mov r15, rdx
mov rdi, rcx
cmp r8, 0x30
jbe 0x14008f25e
xor eax, eax
jmp 0x14008f3e0
mov qword [rsp + 0x98], rbx
xor ebx, ebx
mov qword [rsp + 0xa0], rbp
mov ebp, ebx
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x60], r14
lea r14, [rcx + 0xf8]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rdi + 0x114]
lea rdx, [rsp + 0x20]
bswap eax
inc eax
lea rcx, [rdi + 0x108]
bswap eax
add rdx, rbp
mov dword [rdi + 0x114], eax
mov r8, rdi
call qword [r14]
add rbp, 0x10
cmp rbp, 0x30
jb 0x14008f290
mov rbp, qword [rsp + 0xa0]
test rsi, rsi
je 0x14008f327
cmp rsi, 8
jb 0x14008f303
mov rax, rsi
and rax, 0xfffffffffffffff8
nop dword [rax + rax]
movq xmm0, qword [rsp + rbx + 0x20]
movq xmm1, qword [r15 + rbx]
xorps xmm1, xmm0
movq qword [rsp + rbx + 0x20], xmm1
add rbx, 8
cmp rbx, rax
jb 0x14008f2e0
cmp rbx, rsi
jae 0x14008f327
lea rax, [rsp + 0x20]
sub r15, rax
nop dword [rax + rax]
lea rcx, [rsp + 0x20]
add rcx, rbx
inc rbx
movzx eax, byte [r15 + rcx]
xor byte [rcx], al
cmp rbx, rsi
jb 0x14008f310
mov ecx, 1
call fcn.14009a050
mov rbx, qword [rsp + 0x98]
bt eax, 0x19
jae 0x14008f369
mov r8, rdi
lea rcx, [rsp + 0x20]
mov edx, 0x100
call fcn.140003260
test r14, r14
je 0x14008f360
lea rax, section..text
mov qword [r14], rax
lea rax, [0x140001d60]
jmp 0x14008f3be
mov ecx, 1
call fcn.14009a050
lea rcx, [rsp + 0x20]
mov r8, rdi
mov edx, 0x100
bt eax, 9
jae 0x14008f3a3
call fcn.140004350
test r14, r14
je 0x14008f39a
lea rax, [0x140004520]
mov qword [r14], rax
lea rax, [0x140004820]
jmp 0x14008f3be
call fcn.140087a10
test r14, r14
je 0x14008f3b7
lea rcx, [0x1400870c0]
mov qword [r14], rcx
lea rax, [0x140086f10]
movups xmm0, xmmword [rsp + 0x40]
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov qword [rdi + 0x100], rax
mov eax, 1
movups xmmword [rdi + 0x108], xmm0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14018eb60
add rsp, 0x70
pop r15
pop rdi
pop rsi
ret
Function at 0x140091420
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x30
movsxd r14, dword [rcx + 0x108]
mov rbx, r9
mov r13, r8
mov r15, rdx
mov rbp, rcx
call fcn.140090450
mov r10d, dword [rsp + 0x70]
xor esi, esi
mov edi, r10d
mov r9d, eax
shr rdi, 6
mov ecx, r10d
cmp rdi, r14
jb 0x140091473
mov edi, esi
jmp 0x140091480
mov rdi, qword [rbx + rdi*8]
and cl, 0x3f
shr rdi, cl
and edi, 1
add eax, r10d
mov ecx, eax
shr rax, 6
cmp rax, r14
jb 0x140091492
mov eax, esi
jmp 0x14009149f
mov rax, qword [rbx + rax*8]
and cl, 0x3f
shr rax, cl
and eax, 1
add eax, eax
or edi, eax
lea eax, [r10 + r9*2]
mov ecx, eax
shr rax, 6
cmp rax, r14
jb 0x1400914b6
mov eax, esi
jmp 0x1400914c3
mov rax, qword [rbx + rax*8]
and cl, 0x3f
shr rax, cl
and eax, 1
lea eax, [rax*4]
or edi, eax
lea ecx, [r10 + r9*2]
add ecx, r9d
mov eax, ecx
shr rax, 6
cmp rax, r14
jb 0x1400914e2
mov eax, esi
jmp 0x1400914ef
mov rax, qword [rbx + rax*8]
and cl, 0x3f
shr rax, cl
and eax, 1
lea eax, [rax*8]
or edi, eax
lea eax, [r10 + r9*4]
mov ecx, eax
shr rax, 6
cmp rax, r14
jb 0x14009150b
mov eax, esi
jmp 0x140091518
mov rax, qword [rbx + rax*8]
and cl, 0x3f
shr rax, cl
and eax, 1
shl eax, 4
xor edx, edx
or edi, eax
mov r8d, 0xd8
mov rcx, r15
call fcn.1401b9ec0
nop dword [rax]
mov eax, edi
inc esi
mov ebx, esi
mov r9, r15
xor rbx, rax
mov r8, r13
movsxd rax, dword [rbp + 0x148]
dec rbx
shr rbx, 0x3f
mov rcx, r15
neg rbx
mov qword [rsp + 0x20], rax
mov rdx, rbx
call fcn.14008d7e0
movsxd rax, dword [rbp + 0x148]
lea r8, [r13 + 0x48]
lea r9, [r15 + 0x48]
mov qword [rsp + 0x20], rax
mov rdx, rbx
lea rcx, [r15 + 0x48]
call fcn.14008d7e0
add r13, 0x90
cmp esi, 0x1f
jb 0x140091530
movsxd rax, dword [rbp + 0x148]
lea rcx, [r15 + 0x90]
mov edx, edi
lea r9, [rbp + 0xa0]
dec rdx
mov qword [rsp + 0x70], rax
shr rdx, 0x3f
mov r8, rcx
neg rdx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
jmp fcn.14008d7e0
Function at 0x1400993a0
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
xor r10d, r10d
mov r11, rcx
test r8, r8
je 0x140099456
sub rdx, rcx
cmp r8, 0x20
jb 0x14009943c
mov rcx, r8
lea rax, [r11 + 0x10]
and rcx, 0xffffffffffffffe0
xorps xmm3, xmm3
xorps xmm2, xmm2
movdqu xmm0, xmmword [rax - 0x10]
add r10, 0x20
movdqu xmm1, xmmword [rdx + rax - 0x10]
lea rax, [rax + 0x20]
xorps xmm1, xmm0
orps xmm3, xmm1
movdqu xmm1, xmmword [rdx + rax - 0x20]
movdqu xmm0, xmmword [rax - 0x20]
xorps xmm1, xmm0
orps xmm2, xmm1
cmp r10, rcx
jb 0x1400993d0
orps xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 2
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 1
orps xmm2, xmm0
movd r9d, xmm2
cmp r10, r8
jae 0x140099456
lea rax, [r10 + r11]
sub r8, r10
movzx ecx, byte [rdx + rax]
xor cl, byte [rax]
lea rax, [rax + 1]
or r9b, cl
sub r8, 1
jne 0x140099443
movzx eax, r9b
ret

Function at 0x140099ca0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
movsxd rsi, ecx
lea rax, [0x140099e90]
lea rcx, [0x140243640]
mov qword [rsp + 0x38], rax
xor r9d, r9d
lea r8, [rsp + 0x38]
lea rdx, [0x140099e80]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x140099d2d
cmp dword [0x14024364c], 0
mov qword [rsp + 0x40], rdi
jne 0x140099d20
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x140243648]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x30]
test rdi, rdi
je 0x140099d20
mov rax, qword [rdi + rsi*8]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rdi, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop rsi
ret
call fcn.14019dc7c
int3
Function at 0x140099d70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x20
mov rsi, r8
movsxd r14, ecx
mov rbp, rdx
lea rax, [0x140099e90]
lea r8, [rsp + 0x58]
mov qword [rsp + 0x58], rax
lea rdx, [0x140099e80]
xor r9d, r9d
lea rcx, [0x140243640]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x140099e76
cmp dword [0x14024364c], 0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
jne 0x140099e24
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x140243648]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
jne 0x140099e3e
lea ecx, [rdi + 0x28]
call fcn.14019e5d4
mov rdi, rax
test rax, rax
je 0x140099e24
mov ecx, dword [0x140243648]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
xor eax, eax
mov rdx, rdi
movups xmmword [rdi + 0x10], xmm0
mov qword [rdi + 0x20], rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140099e3e
mov rcx, rdi
call fcn.14019d3ec
mov rcx, rbp
call rsi
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
lea rcx, [0x140243610]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
lea rax, [0x140243618]
lea rbx, [r14*8]
lea rcx, [0x140243610]
mov qword [rbx + rax], rsi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, 1
mov qword [rbx + rdi], rbp
jmp 0x140099e2b
call fcn.14019dc7c
int3
Function at 0x1400a1180
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x130
mov rax, qword [0x14023f780]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rdi, rdx
mov rbx, rcx
mov edx, 0x20
lea rcx, [rsp + 0xc0]
call fcn.140083350
lea r8, [rsp + 0xe0]
mov edx, 0x20
lea rcx, [rsp + 0xc0]
call fcn.140086230
movzx eax, byte [rsp + 0xff]
lea rdx, [rsp + 0xe0]
and byte [rsp + 0xe0], 0xf8
lea rcx, [rsp + 0x20]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0xff], al
call fcn.1400a6a10
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400a3fd0
movups xmm0, xmmword [rsp + 0xd0]
movups xmm2, xmmword [rsp + 0xc0]
movups xmmword [rdi], xmm2
movups xmmword [rdi + 0x10], xmm0
movups xmm0, xmmword [rbx]
movups xmmword [rdi + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x30], xmm1
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14018eb60
mov rbx, qword [rsp + 0x150]
add rsp, 0x130
pop rdi
ret

Function at 0x1400a1260
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x110
mov rax, qword [0x14023f780]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
lea r8, [rsp + 0xc0]
mov rcx, rbx
mov edx, 0x20
call fcn.140086230
movzx eax, byte [rsp + 0xdf]
lea rdx, [rsp + 0xc0]
and byte [rsp + 0xc0], 0xf8
lea rcx, [rsp + 0x20]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0xdf], al
call fcn.1400a6a10
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400a3fd0
movups xmm2, xmmword [rbx]
movups xmmword [rsi], xmm2
movups xmm0, xmmword [rbx + 0x10]
movups xmmword [rsi + 0x10], xmm0
movups xmm0, xmmword [rdi]
movups xmmword [rsi + 0x20], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi + 0x30], xmm1
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.14018eb60
add rsp, 0x110
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400a1310
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x14023f780]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov rsi, r8
mov rdi, rdx
mov r14, rcx
lea r8, [rbp + 0xa0]
mov edx, 0x20
mov rcx, r9
mov rbx, r9
call fcn.140086230
movzx eax, byte [rbp + 0xbf]
lea rcx, [rsp + 0x20]
and byte [rbp + 0xa0], 0xf8
and al, 0x3f
or al, 0x40
mov byte [rbp + 0xbf], al
call fcn.140086460
mov r8d, 0x20
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x20]
call fcn.1400864f0
mov r8, rsi
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.1400864f0
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0xe0]
call fcn.140086450
lea rcx, [rbp + 0xe0]
call fcn.1400a75f0
lea rdx, [rbp + 0xe0]
lea rcx, [rbp]
call fcn.1400a6a10
lea rdx, [rbp]
mov rcx, r14
call fcn.1400a3fd0
lea rcx, [rsp + 0x20]
call fcn.140086460
mov r8d, 0x20
lea rcx, [rsp + 0x20]
mov rdx, r14
call fcn.1400864f0
lea rdx, [rbx + 0x20]
mov r8d, 0x20
lea rcx, [rsp + 0x20]
call fcn.1400864f0
mov r8, rsi
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.1400864f0
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x120]
call fcn.140086450
lea rcx, [rbp + 0x120]
call fcn.1400a75f0
lea rcx, [r14 + 0x20]
lea r9, [rbp + 0xe0]
lea r8, [rbp + 0xa0]
lea rdx, [rbp + 0x120]
call fcn.1400a40a0
mov eax, 1
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.14018eb60
add rsp, 0x270
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret