joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f2660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x60]
cmp eax, 0xa
je 0x1400f26e0
jg 0x1400f2681
cmp eax, 8
je 0x1400f26d0
cmp eax, 9
jne 0x1400f26a0
add rsp, 0x28
jmp 0x140126310
cmp eax, 0xb
je 0x1400f26c0
cmp eax, 0x10001
jne 0x1400f26a0
add rsp, 0x28
jmp fcn.140125050
lea rcx, str.gcry_cipher_gettag:_invalid_mode__d_n
mov edx, eax
call fcn.1400ea2f0
mov eax, 0x47
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x1401272c0
add rsp, 0x28
jmp 0x140123f50
add rsp, 0x28
jmp 0x140127e80
xor r9d, r9d
jmp fcn.140123e00
test byte [rcx + 0xf4], 8
je 0x140126320
mov eax, 0x9c
ret
xor r9d, r9d
jmp fcn.140125760
push rdi
push rsi
push rbx
sub rsp, 0x30
movzx r9d, byte [rcx + 0x221]
mov eax, 0xc8
mov rbx, rcx
cmp r9, r8
jbe 0x1401272e4
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
test byte [rcx + 0x224], 1
mov eax, 0x9c
je 0x1401272dc
test byte [rcx + 0x68], 4
je 0x140127390
cmp r9d, 8
lea rsi, [rbx + 0x1d0]
mov ecx, r9d
jae 0x140127340
and r9d, 4
jne 0x140127375
test ecx, ecx
je 0x140127330
movzx eax, byte [rbx + 0x1d0]
test cl, 2
mov byte [rdx], al
je 0x140127330
movzx eax, word [rsi + rcx - 2]
mov word [rdx + rcx - 2], ax
nop
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [rbx + 0x1d0]
lea rdi, [rdx + 8]
and rdi, 0xfffffffffffffff8
mov qword [rdx], rax
mov eax, r9d
mov rcx, qword [rsi + rax - 8]
mov qword [rdx + rax - 8], rcx
sub rdx, rdi
xor eax, eax
lea ecx, [r9 + rdx]
sub rsi, rdx
shr ecx, 3
mov ecx, ecx
rep movsq qword [rdi], qword [rsi]
jmp 0x140127332
mov eax, dword [rbx + 0x1d0]
mov dword [rdx], eax
mov eax, dword [rsi + rcx - 4]
mov dword [rdx + rcx - 4], eax
xor eax, eax
jmp 0x140127332
mov qword [rsp + 0x28], rdx
call fcn.1401263b0
movzx r9d, byte [rbx + 0x221]
mov rdx, qword [rsp + 0x28]
jmp 0x1401272fc
xor r9d, r9d
jmp fcn.1401279a0

Function at 0x1400f26f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x60]
cmp eax, 0xa
je 0x1400f2770
jg 0x1400f2711
cmp eax, 8
je 0x1400f2760
cmp eax, 9
jne 0x1400f2730
add rsp, 0x28
jmp 0x140126330
cmp eax, 0xb
je 0x1400f2750
cmp eax, 0x10001
jne 0x1400f2730
add rsp, 0x28
jmp 0x1401250c0
lea rcx, str.gcry_cipher_checktag:_invalid_mode__d_n
mov edx, eax
call fcn.1400ea2f0
mov eax, 0x47
add rsp, 0x28
ret
add rsp, 0x28
jmp fcn.1401273b0
add rsp, 0x28
jmp 0x140123f60
add rsp, 0x28
jmp 0x140127e90
mov r9d, 1
jmp fcn.140123e00
push rbx
sub rsp, 0x30
test rdx, rdx
mov rbx, rcx
je 0x1401250d2
test r8, r8
jne 0x1401250e0
mov eax, 0x2d
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rcx + 0x18]
mov eax, 0x2d
cmp r8, qword [rcx + 0x20]
ja 0x1401250d7
test byte [rbx + 0xb0], 1
je 0x140125130
add rbx, 0x70
xor ecx, ecx
xor eax, eax
movzx r10d, byte [rbx + rax]
xor r9d, r9d
cmp byte [rdx + rax], r10b
setne r9b
add rax, 1
sub rcx, r9
cmp r8, rax
jne 0x140125100
cmp rcx, 1
sbb eax, eax
not eax
and eax, 0xa
jmp 0x1401250d7
mov rcx, rbx
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rdx
call fcn.140124ae0
or byte [rbx + 0xb0], 1
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
jmp 0x1401250f8
mov r9d, 1
jmp fcn.140125760
mov r9d, 1
jmp fcn.1401279a0
Function at 0x1400f9470
Capabilities:
Encrypt data using curve25519

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov ebx, dword [r8 + 0xc]
mov eax, 0x3f
mov rsi, rcx
mov r12, rdx
mov qword [rcx], 0
add ebx, 7
shr ebx, 3
cmp ebx, 0x20
je 0x1400f94b0
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov edx, 0x20
mov ecx, 2
call fcn.1400ebb70
test rax, rax
mov rbp, rax
je 0x1400f95c6
lea r13, [rsp + 0x50]
xor eax, eax
mov ecx, 8
lea r8, [rsp + 0x4c]
xor r9d, r9d
xor edx, edx
mov rdi, r13
rep stosq qword [rdi], rax
mov rcx, r12
call fcn.14011df30
test rax, rax
mov r12, rax
je 0x1400f95be
mov eax, dword [rsp + 0x4c]
mov edx, 0
mov r9, r13
mov r8, rbp
mov ecx, 0xa
mov dword [rsp + 0x20], 2
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x88], r12
mov qword [rsp + 0x78], 0
sub ebx, eax
cmp eax, 0x1f
mov qword [rsp + 0x80], rax
cmova ebx, edx
mov edi, ebx
mov qword [rsp + 0x60], rdi
call fcn.1400fd290
mov rcx, r12
mov dword [rsp + 0x3c], eax
call fcn.1400eba10
mov eax, dword [rsp + 0x3c]
mov rcx, rbp
lea rdx, [rbp + 0x1f]
lea r10, [rbp + 0xf]
test eax, eax
jne 0x1400f95b0
movzx r8d, byte [rcx]
movzx r9d, byte [rdx]
sub rdx, 1
add rcx, 1
mov byte [rcx - 1], r9b
mov byte [rdx + 1], r8b
cmp rdx, r10
jne 0x1400f9571
movzx edx, byte [rbp]
and byte [rbp + 0x1f], 0xf8
mov qword [rsi], rbp
and edx, 0x3f
or edx, 0x40
mov byte [rbp], dl
jmp 0x1400f94a0
call fcn.1400eba10
mov eax, dword [rsp + 0x3c]
jmp 0x1400f94a0
mov rcx, rbp
call fcn.1400eba10
call fcn.14014d490
jmp 0x1400f94a0
Function at 0x1400f95d0
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
xor r12d, r12d
lea rbp, [rsp + 0x40]
mov ebx, r9d
mov rsi, rcx
mov rdi, rdx
mov qword [rsp + 0xe0], r8
mov rcx, rbp
call fcn.140117890
and ebx, 0x20
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
sete r12b
xor ecx, ecx
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
add r12d, 1
call fcn.140121ca0
xor ecx, ecx
mov r13, rax
call fcn.140121c90
xor ecx, ecx
mov qword [rsp + 0x38], rax
call fcn.140121c90
mov ecx, 0x40
mov r15, rax
call fcn.1400eb8e0
test rax, rax
mov rbx, rax
je 0x1400f9850
mov edx, r12d
mov ecx, 0x20
call fcn.1401162f0
lea r9, [rsp + 0x60]
xor edx, edx
mov dword [rsp + 0x20], 1
mov r8, rbx
mov ecx, 0xa
mov r14, rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], 0x20
call fcn.1400fd290
test eax, eax
mov r12d, eax
je 0x1400f96f0
mov rcx, rbp
call fcn.1401178f0
mov rcx, r13
call fcn.140121cb0
mov rcx, qword [rsp + 0x38]
call fcn.140121cb0
mov rcx, r15
call fcn.140121cb0
mov rcx, rbx
call fcn.1400eba10
mov eax, r12d
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, r14
mov r8d, 0x100
xor ecx, ecx
call fcn.140121470
lea r9, [rbx + 0xf]
mov qword [rsi + 0x68], rax
lea rax, [rbx + 0x1f]
mov rdx, rbx
nop
movzx ecx, byte [rdx]
movzx r8d, byte [rax]
sub rax, 1
add rdx, 1
mov byte [rdx - 1], r8b
mov byte [rax + 1], cl
cmp rax, r9
jne 0x1400f9710
movzx eax, byte [rbx]
and byte [rbx + 0x1f], 0xf8
xor r9d, r9d
mov r8d, 0x20
mov rdx, rbx
mov rcx, r13
and eax, 0x3f
or eax, 0x40
mov byte [rbx], al
call fcn.14011dfb0
mov rcx, rbx
call fcn.1400eba10
mov r9, qword [rsp + 0xe0]
lea r8, [rdi + 0x20]
mov rdx, r13
mov rcx, rbp
call fcn.140118f60
mov ecx, 1
call fcn.1400ebf00
test eax, eax
jne 0x1400f9834
mov eax, dword [rdi]
mov rcx, qword [rdi + 8]
xor ebx, ebx
mov dword [rsi], eax
mov eax, dword [rdi + 4]
mov dword [rsi + 4], eax
call fcn.140121680
mov rcx, qword [rdi + 0x10]
mov qword [rsi + 8], rax
call fcn.140121680
mov rcx, qword [rdi + 0x18]
mov qword [rsi + 0x10], rax
call fcn.140121680
lea rcx, [rsi + 0x20]
mov qword [rsi + 0x18], rax
call fcn.140117890
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rsi + 0x20]
call fcn.140121940
mov rdx, qword [rdi + 0x28]
mov rcx, qword [rsi + 0x28]
call fcn.140121940
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rsi + 0x30]
call fcn.140121940
mov rcx, qword [rdi + 0x38]
call fcn.140121680
mov rcx, qword [rdi + 0x40]
mov qword [rsi + 0x38], rax
call fcn.140121680
lea rcx, [rsi + 0x50]
mov qword [rsi + 0x40], rax
call fcn.140117890
mov rcx, qword [rsi + 0x50]
mov rdx, qword [rsp + 0x40]
call fcn.140121940
mov rcx, qword [rsi + 0x58]
mov rdx, qword [rsp + 0x48]
call fcn.140121940
mov rcx, qword [rsi + 0x60]
mov rdx, qword [rsp + 0x50]
call fcn.140121940
jmp 0x1400f96aa
mov r8, qword [rsp + 0xe0]
lea rcx, str.ecgen______pk
mov rdx, rbp
call fcn.1401180c0
jmp 0x1400f977f
call fcn.14014d490
mov r12d, eax
jmp 0x1400f96aa
Function at 0x1400fbf40
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx]
mov rdi, rcx
mov r12, rdx
mov rbp, r8
mov r9, qword [rax + 0x10]
test r9, r9
je 0x1400fbf6e
movsxd rdx, dword [rcx + 8]
test edx, edx
jne 0x1400fbfd0
test rbp, rbp
jne 0x1400fbfed
mov rbx, qword [rax + 0x20]
lea r13, [rdi + 0x10]
test rbx, rbx
jne 0x1400fbf98
jmp 0x1400fbfb3
mov rax, qword [rbx]
mov r8, rbp
mov rdx, r12
mov rcx, rsi
call qword [rax + 0x38]
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x1400fbfb3
movsxd r8, dword [rdi + 8]
lea rsi, [rbx + 0x18]
test r8d, r8d
je 0x1400fbf80
mov rax, qword [rbx]
mov rdx, r13
mov rcx, rsi
call qword [rax + 0x38]
jmp 0x1400fbf80
mov dword [rdi + 8], 0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rcx, [rcx + 0x10]
mov r8d, 1
call sub.msvcrt.dll_fwrite
cmp rax, 1
jne 0x1400fc010
test rbp, rbp
mov rax, qword [rdi]
je 0x1400fbf6e
mov r9, qword [rax + 0x10]
mov r8d, 1
mov rdx, rbp
mov rcx, r12
call sub.msvcrt.dll_fwrite
cmp rax, 1
jne 0x1400fc028
mov rax, qword [rdi]
jmp 0x1400fbf6e
lea r8, str.md_write
lea rcx, str.md.c
mov edx, 0x258
call fcn.1400ea230
lea r8, str.md_write
lea rcx, str.md.c
mov edx, 0x25a
call fcn.1400ea230
nop
nop dword [rax + rax]
nop word cs:[rax + rax]
Function at 0x140107ac0
Capabilities:
Hash data using sha1

Disassembly:
push rsi
push rbx
sub rsp, 0xe8
lea rax, [0x140107910]
lea rsi, [rsp + 0x20]
mov rbx, rcx
mov dword [rsp + 0xc8], 0x67452301
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0xcc], 0xefcdab89
mov rcx, rsi
mov dword [rsp + 0xd0], 0x98badcfe
mov dword [rsp + 0xd4], 0x10325476
mov dword [rsp + 0xd8], 0xc3d2e1f0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0x40
call fcn.140133600
mov rcx, rsi
call fcn.140107950
mov rax, qword [rsp + 0x20]
mov qword [rbx], rax
mov rax, qword [rsp + 0x28]
mov qword [rbx + 8], rax
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x10], eax
add rsp, 0xe8
pop rbx
pop rsi
ret
Function at 0x14010cc30
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1400ef420
mov edx, eax
lea rcx, [fcn.14010ce00]
mov dword [rbx + 0xa8], 0x67452301
shr edx, 7
mov dword [rbx + 0xac], 0xefcdab89
mov dword [rbx + 0xb0], 0x98badcfe
mov r8d, edx
movzx edx, byte [rbx + 0xbc]
mov qword [rbx + 0xa0], rcx
mov ecx, eax
and r8d, 1
mov dword [rbx + 0xb4], 0x10325476
and ecx, 0x1020
mov dword [rbx + 0xb8], 0xc3d2e1f0
mov qword [rbx + 0x80], 0
mov qword [rbx + 0x88], 0
mov dword [rbx + 0x90], 0
and edx, 0xfffffffc
cmp ecx, 0x1020
mov qword [rbx + 0x98], 0x40
sete cl
or edx, r8d
and eax, 0x1040
add ecx, ecx
or edx, ecx
cmp eax, 0x1040
sete al
lea ecx, [rax*4]
mov eax, edx
and eax, 0xfffffffb
or eax, ecx
mov byte [rbx + 0xbc], al
add rsp, 0x20
pop rbx
ret
Function at 0x140116630
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rsi, rcx
lea rcx, str.GCRYPT_RNDW32_NOPERF
mov edi, edx
call sub.msvcrt.dll_getenv
test rax, rax
je 0x1401166a0
mov eax, dword [0x1402a3f78]
test eax, eax
je 0x140116680
mov rcx, 0xffffffff80000004
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.note:_get_performance_data_has_been_disabled_n
mov dword [0x1402a3f78], 1
call fcn.1400ea290
jmp 0x140116660
movsxd rcx, dword [0x14016f160]
lea r14, [rsp + 0x3c]
lea r12, str.Global
mov ebx, 0xa
mov rbp, 0xffffffff80000004
call fcn.1400ebbf0
mov r13, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r15, rax
nop
mov eax, dword [0x14016f160]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov rdx, r12
mov rcx, rbp
mov dword [rsp + 0x3c], eax
call r13
test eax, eax
je 0x140116730
cmp eax, 0xea
jne 0x140116760
mov eax, dword [0x14016f160]
mov rcx, r15
lea edx, [rax + 0x4000]
mov dword [0x14016f160], edx
movsxd rdx, edx
call fcn.1400ebc70
sub ebx, 1
mov r15, rax
jne 0x1401166d0
mov rcx, r15
call fcn.1400eba10
jmp 0x140116660
lea rdx, str.PERF
mov r8d, 8
mov rcx, r15
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14011677e
mov edx, dword [rsp + 0x3c]
mov r8d, edi
mov rcx, r15
call rsi
jmp 0x140116723
cmp eax, dword [0x1402a3f74]
je 0x140116723
lea rcx, str.rndw32:_get_performance_data_problem:_ec_ld_n
mov edx, eax
mov dword [0x1402a3f74], eax
call fcn.1400ea380
jmp 0x140116723
lea rcx, str.rndw32:_no_PERF_signature_n
call fcn.1400ea380
jmp 0x140116723
Function at 0x140117230
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbx, qword [rsp + 0xa0]
mov rsi, rcx
mov ecx, dword [0x1402a4000]
mov ebp, edx
test ecx, ecx
je 0x140117300
cmp r8d, 1
mov dword [rsi], ebp
mov dword [rsi + 4], r8d
mov dword [rsi + 8], r9d
je 0x1401172f0
mov rcx, rbx
call fcn.14011a560
mov dword [rsi + 0xc], eax
mov rcx, rbx
call fcn.140121680
mov rcx, qword [rsp + 0xa8]
mov qword [rsi + 0x10], rax
call fcn.140121680
mov rcx, qword [rsp + 0xb0]
mov qword [rsi + 0x18], rax
call fcn.140121680
mov edx, dword [0x1402a4000]
mov qword [rsi + 0x20], rax
xor eax, eax
test edx, edx
jle 0x1401172b7
mov rcx, qword [rsi + 0x10]
xor edx, edx
call fcn.14011bcc0
and byte [rsi + 0x50], 0xfc
cmp ebp, 1
mov qword [rsi + 0x60], rax
lea rbx, [rsi + 0x68]
lea rdi, [rsi + 0xc0]
je 0x140117340
nop
mov rcx, qword [rsi + 0x10]
add rbx, 8
call fcn.1401217e0
mov qword [rbx - 8], rax
cmp rbx, rdi
jne 0x1401172d0
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov dword [rsi + 0xc], 0x100
jmp 0x140117272
lea rcx, str.GCRYPT_BARRETT
mov dword [rsp + 0x3c], r9d
mov dword [rsp + 0x38], r8d
call sub.msvcrt.dll_getenv
test rax, rax
mov r9d, dword [rsp + 0x3c]
mov r8d, dword [rsp + 0x38]
sete al
movzx eax, al
neg eax
or eax, 1
mov dword [0x1402a4000], eax
jmp 0x140117253
lea r8, str.0x0000000000000000000000000000000000000000000000000000000000000000
lea rbp, [rsp + 0x48]
lea rdi, str.0x0000000000000000000000000000000000000000000000000000000000000000
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov edx, 4
mov rcx, rbp
call fcn.14011e110
test eax, eax
jne 0x14011738e
mov rax, qword [rsp + 0x48]
mov qword [rsi + rbx + 0x68], rax
add rbx, 8
mov r8, qword [rdi + rbx]
test r8, r8
jne 0x140117355
jmp 0x1401172e6
mov ecx, eax
call fcn.14014d440
lea rcx, str.scanning_ECC_parameter_failed:__s_n
mov rdx, rax
call fcn.1400ea320
nop
nop
nop word cs:[rax + rax]

Function at 0x140121a30
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, dword [rdx]
neg r8d
cmp esi, dword [rcx]
mov rax, rcx
jne 0x140121a9d
test esi, esi
jle 0x140121a70
mov rbx, qword [rcx + 0x10]
mov rdi, qword [rdx + 0x10]
xor r9d, r9d
mov r11d, dword [rbx + r9*4]
mov r10d, dword [rdi + r9*4]
xor r10d, r11d
and r10d, r8d
xor r10d, r11d
mov dword [rbx + r9*4], r10d
add r9, 1
cmp esi, r9d
jg 0x140121a52
mov r9d, dword [rax + 4]
mov ecx, dword [rdx + 4]
mov edi, dword [rdx + 8]
xor ecx, r9d
and ecx, r8d
xor ecx, r9d
mov dword [rax + 4], ecx
mov ecx, dword [rax + 8]
xor edi, ecx
and r8d, edi
xor r8d, ecx
mov dword [rax + 8], r8d
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea rcx, str.mpi_set_cond:_different_sizes_n
call fcn.1400ea350
nop
nop word [rax + rax]
Function at 0x140121bf0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, dword [rdx]
mov r9d, dword [rcx + 4]
neg r8d
cmp dword [rcx], esi
cmovle esi, dword [rcx]
cmp r9d, esi
jg 0x140121c77
mov eax, dword [rdx + 4]
cmp eax, esi
jg 0x140121c77
test esi, esi
jle 0x140121c48
mov rbx, qword [rcx + 0x10]
mov r11, qword [rdx + 0x10]
xor eax, eax
nop
mov r10d, dword [rbx + rax*4]
mov r9d, dword [r11 + rax*4]
xor r9d, r10d
and r9d, r8d
xor r10d, r9d
mov dword [rbx + rax*4], r10d
xor dword [r11 + rax*4], r9d
add rax, 1
cmp esi, eax
jg 0x140121c20
mov r9d, dword [rcx + 4]
mov eax, dword [rdx + 4]
xor eax, r9d
and eax, r8d
xor r9d, eax
mov dword [rcx + 4], r9d
mov r9d, dword [rcx + 8]
xor dword [rdx + 4], eax
mov eax, dword [rdx + 8]
xor eax, r9d
and r8d, eax
xor r9d, r8d
mov dword [rcx + 8], r9d
xor dword [rdx + 8], r8d
add rsp, 0x28
pop rbx
pop rsi
ret
lea rcx, str.mpi_swap_cond:_different_sizes_n
call fcn.1400ea350
nop
nop
nop word cs:[rax + rax]
Function at 0x140121ff0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
mov eax, dword [rcx]
lea r8, [rsp + 0x20]
mov dword [rsp], eax
mov eax, dword [rcx + 4]
lea r10, [r8 + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rcx + 8]
mov dword [rsp + 8], eax
mov eax, dword [rcx + 0xc]
mov dword [rsp + 0xc], eax
mov eax, dword [rcx + 0x10]
mov dword [rsp + 0x10], eax
mov eax, dword [rcx + 0x14]
mov dword [rsp + 0x14], eax
mov eax, dword [rcx + 0x18]
mov dword [rsp + 0x18], eax
mov eax, dword [rcx + 0x1c]
mov dword [rsp + 0x1c], eax
mov rax, r8
movzx r9d, byte [rdx]
add rdx, 4
add rax, 4
mov byte [rax - 1], r9b
movzx r9d, byte [rdx - 3]
mov byte [rax - 2], r9b
movzx r9d, byte [rdx - 2]
mov byte [rax - 3], r9b
movzx r9d, byte [rdx - 1]
mov byte [rax - 4], r9b
cmp rax, r10
jne 0x140122045
lea r13, [rsp + 0x60]
xor eax, eax
nop dword [rax]
mov edx, dword [r8 + rax]
mov dword [r13 + rax], edx
add rax, 4
cmp rax, 0x40
jne 0x140122080
lea r10, [r13 + 0xc0]
mov r9, r13
nop dword [rax]
mov eax, dword [r9 + 0x38]
mov r8d, dword [r9 + 4]
add r9, 4
mov edx, eax
mov r11d, eax
shr eax, 0xa
rol r11d, 0xd
rol edx, 0xf
xor edx, r11d
mov r11d, r8d
xor edx, eax
mov eax, dword [r9 - 4]
add eax, dword [r9 + 0x20]
rol r11d, 0xe
add edx, eax
mov eax, r8d
shr r8d, 3
ror eax, 7
xor eax, r11d
xor eax, r8d
add eax, edx
mov dword [r9 + 0x3c], eax
cmp r10, r9
jne 0x1401220a0
mov edx, dword [rsp + 0x1c]
mov ebx, dword [rsp + 0x18]
xor r11d, r11d
mov edi, dword [rsp + 0x14]
mov r10d, dword [rsp + 0x10]
mov r8d, 0x428a2f98
mov r12d, dword [rsp + 0xc]
mov ebp, dword [rsp + 8]
lea r14, [0x14027cec0]
mov esi, dword [rsp + 4]
mov r9d, dword [rsp]
jmp 0x140122139
mov r8d, dword [r14 + r11]
mov r12d, ebp
mov edx, ebx
mov ebp, esi
mov ebx, edi
mov esi, r9d
mov edi, r10d
mov r9d, eax
mov r10d, r15d
mov eax, r10d
mov r15d, r10d
ror r15d, 0xb
ror eax, 6
xor eax, r15d
mov r15d, r10d
rol r15d, 7
xor r15d, eax
mov eax, edi
xor eax, ebx
and eax, r10d
xor eax, ebx
add eax, r15d
add eax, dword [r13 + r11]
mov r15d, r9d
and r15d, esi
add r11, 4
add eax, edx
mov edx, r9d
add eax, r8d
mov r8d, r9d
ror edx, 2
ror r8d, 0xd
xor edx, r8d
mov r8d, r9d
rol r8d, 0xa
xor edx, r8d
mov r8d, r9d
or r8d, esi
and r8d, ebp
or r8d, r15d
lea r15d, [rax + r12]
add edx, r8d
add eax, edx
cmp r11, 0x100
jne 0x140122120
add eax, dword [rsp]
add r9d, dword [rsp + 4]
add esi, dword [rsp + 8]
add ebp, dword [rsp + 0xc]
add r15d, dword [rsp + 0x10]
add r10d, dword [rsp + 0x14]
add edi, dword [rsp + 0x18]
add ebx, dword [rsp + 0x1c]
mov dword [rcx], eax
mov dword [rcx + 4], r9d
mov dword [rcx + 8], esi
mov dword [rcx + 0xc], ebp
mov dword [rcx + 0x10], r15d
mov dword [rcx + 0x14], r10d
mov dword [rcx + 0x18], edi
mov dword [rcx + 0x1c], ebx
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140122600
Capabilities:
Authenticate hmac
Encode data using xor
Hash data using sha256

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rbp, rcx
mov ecx, 0xac
mov r12, rdx
call sub.msvcrt.dll_malloc
test rax, rax
mov rsi, rax
je 0x140122781
and byte [rax + 0x28], 0xfc
test rbp, rbp
mov dword [rax], 0x6a09e667
mov dword [rax + 4], 0xbb67ae85
mov dword [rax + 8], 0x3c6ef372
mov dword [rax + 0xc], 0xa54ff53a
mov dword [rax + 0x10], 0x510e527f
mov dword [rax + 0x14], 0x9b05688c
mov dword [rax + 0x18], 0x1f83d9ab
mov dword [rax + 0x1c], 0x5be0cd19
mov dword [rax + 0x20], 0
mov dword [rax + 0x24], 0
je 0x140122781
lea rbx, [rsp + 0x20]
xor eax, eax
mov ecx, 8
lea r13, [rsi + 0x69]
mov rdi, rbx
rep stosq qword [rdi], rax
lea rdi, [rsi + 0x71]
mov rcx, r13
mov qword [rsi + 0x69], 0
mov qword [rsi + 0xa1], 0
and rdi, 0xfffffffffffffff8
sub rcx, rdi
add ecx, 0x40
shr ecx, 3
cmp r12, 0x40
rep stosq qword [rdi], rax
jbe 0x140122791
xor edx, edx
xor ecx, ecx
call fcn.140122600
test rax, rax
mov rdi, rax
je 0x1401227bc
mov r8, r12
mov rdx, rbp
mov rcx, rax
call fcn.140122240
test byte [rdi + 0x28], 1
je 0x1401227af
mov rdx, qword [rdi + 0x29]
mov rcx, rdi
mov qword [rsp + 0x20], rdx
mov rdx, qword [rdi + 0x31]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rdi + 0x39]
mov qword [rsp + 0x30], rdx
mov rdx, qword [rdi + 0x41]
mov qword [rsp + 0x38], rdx
mov rdx, qword [rdi + 0x29]
mov qword [r13], rdx
mov rdx, qword [rdi + 0x31]
mov qword [r13 + 8], rdx
mov rdx, qword [rdi + 0x39]
mov qword [r13 + 0x10], rdx
mov rax, qword [rdi + 0x41]
mov qword [r13 + 0x18], rax
call fcn.140122200
xor eax, eax
nop
xor byte [rbx + rax], 0x36
xor byte [rsi + rax + 0x69], 0x5c
add rax, 1
cmp rax, 0x40
jne 0x140122740
or byte [rsi + 0x28], 2
mov r8d, 0x40
mov rdx, rbx
mov rcx, rsi
call fcn.140122240
mov rax, rbx
nop dword [rax + rax]
lea rdi, [rsp + 0x60]
mov byte [rax], 0
add rax, 1
cmp rax, rdi
jne 0x140122770
mov rax, rsi
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r8, r12
mov rdx, rbp
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov r8, r12
mov rdx, rbp
mov rcx, r13
call sub.msvcrt.dll_memcpy
jmp 0x14012273d
mov rcx, rdi
call fcn.1401223d0
jmp 0x1401226f1
mov rcx, rsi
xor esi, esi
call fcn.14016b5d8
jmp 0x140122781
Function at 0x140123800
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
test r8, r8
mov rdi, rdx
mov r14, rcx
mov rsi, r8
mov dword [rsp + 0xc8], r9d
mov edx, dword [rcx + 0xd4]
jne 0x14012383d
test edx, edx
je 0x14012394c
test r9d, r9d
je 0x14012394c
mov rax, qword [r14 + 0x18]
lea rbx, [r14 + 0x70]
lea rbp, [r14 + 0x280]
xor r15d, r15d
mov r12, qword [rax + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
nop dword [rax]
mov ecx, edx
lea rax, [rcx + rsi]
cmp rax, 0xf
jbe 0x140123960
test edx, edx
jne 0x140123960
test rsi, rsi
jne 0x1401238ce
mov ecx, dword [rsp + 0xc8]
test ecx, ecx
je 0x140123935
xor eax, eax
nop
mov edx, eax
add eax, 1
cmp eax, 0x10
mov byte [r14 + rdx + 0xc4], 0
jne 0x140123890
xor esi, esi
mov rax, qword [r14 + 0xc4]
xor qword [r14 + 0x70], rax
mov r8, rbx
mov rax, qword [r14 + 0xcc]
xor qword [r14 + 0x78], rax
mov rdx, rbx
mov rcx, rbp
call r12
cmp r15d, eax
cmovb r15d, eax
mov r13, qword [r14 + 0x38]
test r13, r13
je 0x1401239c0
mov rax, rsi
mov r9, rdi
mov dword [rsp + 0x28], 1
shr rax, 4
mov r8, qword [rsp + 0x40]
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rbp
call r13
mov rax, rsi
mov qword [rsp + 0x50], 0
and esi, 0xf
and rax, 0xfffffffffffffff0
mov qword [rsp + 0x58], 0
add rdi, rax
xor edx, edx
test rsi, rsi
jne 0x140123860
mov dword [rsp + 0xc8], 0
mov eax, dword [rsp + 0xc8]
test r15d, r15d
mov dword [r14 + 0xd4], eax
lea eax, [r15 + 0x20]
jne 0x14012394e
xor eax, eax
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test rsi, rsi
je 0x140123a28
cmp edx, 0xf
jbe 0x14012397a
jmp 0x140123a28
cmp eax, 0xf
ja 0x140123995
mov ecx, eax
add rdi, 1
lea eax, [rdx + 1]
sub rsi, 1
movzx edx, byte [rdi - 1]
mov byte [r14 + rcx + 0xc4], dl
mov edx, eax
jne 0x140123973
test rsi, rsi
jne 0x1401238a5
mov edx, dword [rsp + 0xc8]
test edx, edx
je 0x140123a40
cmp eax, 0xf
jbe 0x140123890
jmp 0x1401238a3
cmp rsi, 0xf
jbe 0x14012391f
lea rax, [rsi - 0x10]
mov r13, rdi
mov qword [rsp + 0x48], rax
and rax, 0xfffffffffffffff0
lea rax, [rdi + rax + 0x10]
mov qword [rsp + 0x38], rax
mov rax, qword [r13]
xor qword [r14 + 0x70], rax
mov r8, rbx
mov rax, qword [r13 + 8]
xor qword [r14 + 0x78], rax
mov rdx, rbx
mov rcx, rbp
call r12
cmp r15d, eax
cmovb r15d, eax
add r13, 0x10
cmp qword [rsp + 0x38], r13
jne 0x1401239e4
mov rax, qword [rsp + 0x48]
and esi, 0xf
and rax, 0xfffffffffffffff0
lea rdi, [rdi + rax + 0x10]
jmp 0x14012391f
test rsi, rsi
je 0x140123a4c
test edx, edx
je 0x1401238ce
jmp 0x1401238a5
mov dword [rsp + 0xc8], eax
jmp 0x140123935
mov eax, edx
jmp 0x14012399e