joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008b0b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rdx
movsxd rdx, dword [rdx + 8]
test rdx, rdx
je 0x14008b10a
mov rsi, rcx
mov rax, qword [rdi]
xor ecx, ecx
xor r8d, r8d
nop
or r8, qword [rax + rcx*8]
inc rcx
cmp rdx, rcx
jne 0x14008b0d0
test r8, r8
je 0x14008b10a
test edx, edx
jle 0x14008b0ea
test byte [rax], 1
jne 0x14008b137
mov dword [rsp + 0x20], 0xae
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x68
jmp 0x14008b128
mov dword [rsp + 0x20], 0xaa
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x69
call fcn.1400bacd0
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
cmp dword [rdi + 0x10], 0
je 0x14008b15d
mov dword [rsp + 0x20], 0xb2
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x6d
jmp 0x14008b128
cmp edx, 0x401
jb 0x14008b1a1
mov r8d, 0x400
xor ecx, ecx
nop dword [rax]
or rcx, qword [rax + r8*8]
inc r8
cmp rdx, r8
jne 0x14008b170
test rcx, rcx
je 0x14008b1a1
mov dword [rsp + 0x20], 0xb6
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x66
jmp 0x14008b128
lea rbx, [rsi + 0x18]
cmp rbx, rdi
je 0x14008b1e1
mov rcx, rbx
call fcn.140082450
test eax, eax
je 0x14008b21b
movsxd r8, dword [rdi + 8]
test r8, r8
je 0x14008b1d3
shl r8, 3
mov rcx, qword [rbx]
mov rdx, qword [rdi]
call fcn.14012d9b0
mov eax, dword [rdi + 8]
jmp 0x14008b1d5
xor eax, eax
mov dword [rsi + 0x20], eax
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x28], eax
mov rdi, rbx
test rdi, rdi
je 0x14008b21b
mov eax, dword [rsi + 0x20]
mov ecx, eax
sar ecx, 0x1f
and ecx, eax
lea edx, [rax + 1]
mov r8, rax
nop word cs:[rax + rax]
test r8d, r8d
jle 0x14008b23e
mov r9, qword [rbx]
dec edx
cmp qword [r9 + r8*8 - 8], 0
lea r8, [r8 - 1]
je 0x14008b200
mov dword [rsi + 0x20], edx
jmp 0x14008b24c
mov dword [rsp + 0x20], 0xbc
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x44
jmp 0x14008b128
mov dword [rsi + 0x20], ecx
test eax, eax
js 0x14008b24c
mov dword [rsi + 0x28], 0
mov rax, qword [rbx]
mov rax, qword [rax]
mov r9d, 1
mov edx, 0x40
xor ecx, ecx
movabs r8, 0x8000000000000000
nop dword [rax]
mov r10d, r9d
and r10d, 1
neg r10
mov r11, rax
and r11, r10
mov rdi, r11
xor rdi, r9
shr rdi, 1
and r11, r9
add r11, rdi
and r10, r8
shr rcx, 1
or rcx, r10
mov r9, r11
dec rdx
jne 0x14008b270
mov qword [rsi + 0x30], rcx
mov qword [rsi + 0x38], 0
mov esi, 1
jmp 0x14008b12d
Function at 0x14008cb60
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov edx, dword [rcx + 8]
test edx, edx
jle 0x14008ccd6
mov rcx, qword [rcx]
shl rdx, 6
xor r8d, r8d
xor eax, eax
xor r9d, r9d
nop word cs:[rax + rax]
mov rsi, qword [rcx]
mov r11, rsi
shl r11, 0x20
mov r10, r11
not r10
dec r11
and r11, r10
sar r11, 0x3f
mov r10d, r11d
mov rdi, rsi
shr rdi, 0x20
and edi, r11d
not r11
and r11, rsi
or r11, rdi
mov rbx, r11
shl rbx, 0x30
mov rdi, rbx
dec rbx
not rdi
and rbx, rdi
sar rbx, 0x3f
mov r14, r11
mov edi, ebx
shr r14, 0x10
xor r14, r11
and r14, rbx
xor r14, r11
mov r12, r14
shl r12, 0x38
lea r11, [rsi - 1]
mov rbx, r12
not rbx
dec r12
and r12, rbx
sar r12, 0x3f
mov r15, r14
shr r15, 8
mov ebx, r12d
xor r15, r14
and r15, r12
and r10d, 0x20
xor r15, r14
mov r12, r15
shl r12, 0x3c
mov r13, rsi
mov rsi, r12
not rsi
dec r12
and r12, rsi
sar r12, 0x3f
mov r14, r15
shr r14, 4
mov esi, r12d
xor r14, r15
and r14, r12
not r13
xor r14, r15
mov r12, r14
shl r12, 0x3e
and r11, r13
mov r15, r12
not r15
dec r12
and edi, 0x10
and r12, r15
sar r12, 0x3f
mov ebp, r12d
mov r15d, r14d
shr r15d, 2
xor r15d, r14d
or edi, r10d
and r15d, r12d
sar r11, 0x3f
and ebx, 8
or ebx, edi
mov r10, r11
not r10
and esi, 4
or esi, ebx
or r10, r9
xor r15d, r14d
shl r15, 0x3f
and ebp, 2
mov rdi, r15
not rdi
dec r15
or ebp, esi
and r15, rdi
shr r15, 0x3f
or r15d, ebp
or r15d, r8d
or r9d, r11d
not r9d
and r9d, r15d
or eax, r9d
add r8, 0x40
add rcx, 8
mov r9, r10
cmp rdx, r8
jne 0x14008cb90
jmp 0x14008ccd8
xor eax, eax
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14008e570
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x218
movaps xmmword [rsp + 0x200], xmm6
mov rax, qword [0x140165040]
xor rax, rsp
mov qword [rsp + 0x1f8], rax
test rdx, rdx
je 0x14008e852
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call fcn.140018a20
mov ebp, eax
movaps xmm6, xmmword [0x14013ab10]
movaps xmmword [rsp + 0x1e0], xmm6
movaps xmmword [rsp + 0x1d0], xmm6
mov ecx, 1
call fcn.140080580
test eax, 0x40000000
je 0x14008e602
xor ecx, ecx
call fcn.140080580
test eax, 0x40000000
je 0x14008e602
lea rcx, [rsp + 0x1d0]
mov edx, 0x20
call fcn.140018950
test eax, eax
jne 0x14008e615
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1e0], xmm0
movaps xmmword [rsp + 0x1d0], xmm0
xor eax, eax
nop word [rax + rax]
movzx ecx, byte [rbx + rax]
xor byte [rsp + rax + 0x1d0], cl
inc rax
cmp rax, 0x20
jne 0x14008e620
lea rbx, [rsp + 0x98]
mov r8d, 0x138
mov rcx, rbx
mov dl, 0xaa
call fcn.14012e050
mov ecx, 1
call fcn.1400ba4d0
test rax, rax
je 0x14008e68e
mov r14, rax
mov r13, rax
add r13, 0x128
cmp dword [rax + 0x128], 0xfff
ja 0x14008e751
cmp qword [r14 + 0x120], 0xc0ffee
je 0x14008e748
jmp 0x14008e751
mov ecx, 0x138
call fcn.1400ae130
test rax, rax
je 0x14008e6b8
mov r14, rax
lea r8, [0x14009dde0]
mov ecx, 1
mov rdx, rax
call fcn.1400ba5a0
test eax, eax
jne 0x14008e6bb
mov r14, rbx
mov dword [r14 + 0x12c], 0
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
lea r15, [rsp + 0x60]
mov edx, 0x30
mov rcx, r15
call fcn.1400ba700
lea r8, [rsp + 0x30]
mov rcx, r14
mov rdx, r15
xor r9d, r9d
call fcn.14009d5b0
test eax, eax
je 0x14008e87e
lea r13, [r14 + 0x128]
mov dword [r14 + 0x128], 0
mov qword [r14 + 0x120], 0xc0ffee
mov dword [r14 + 0x130], ebp
cmp qword [r14 + 0x120], 0xc0ffee
jne 0x14008e751
cmp dword [r14 + 0x130], ebp
je 0x14008e7b3
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
lea r15, [rsp + 0x60]
mov edx, 0x30
mov rcx, r15
call fcn.1400ba700
mov r8d, 0x30
mov rcx, r14
mov rdx, r15
call fcn.14009d890
test eax, eax
je 0x14008e87e
mov qword [r14 + 0x118], 1
mov dword [r13], 0
mov qword [r14 + 0x120], 0xc0ffee
mov dword [r14 + 0x130], ebp
cmp rsi, 0x10000
mov r15d, 0x10000
cmovb r15, rsi
mov qword [rsp + 0x20], 0x20
lea r9, [rsp + 0x1d0]
mov rcx, r14
mov rdx, rdi
mov r8, r15
call fcn.14009dbd0
test eax, eax
je 0x14008e87e
inc dword [r13]
sub rsi, r15
je 0x14008e83b
add rdi, r15
lea r15, [rsp + 0x1d0]
nop
cmp rsi, 0x10000
mov r12d, 0x10000
cmovb r12, rsi
mov qword [rsp + 0x20], 0
mov rcx, r14
mov rdx, rdi
mov r8, r12
mov r9, r15
call fcn.14009dbd0
test eax, eax
je 0x14008e87e
add rdi, r12
inc dword [r13]
sub rsi, r12
jne 0x14008e800
cmp r14, rbx
jne 0x14008e852
lea rcx, [rsp + 0x98]
mov edx, 0x120
call fcn.1400ae2e0
mov rcx, qword [rsp + 0x1f8]
xor rcx, rsp
call fcn.1400fb950
movaps xmm6, xmmword [rsp + 0x200]
add rsp, 0x218
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14010f2a0
int3
Function at 0x14008ff20
Capabilities:
Hash data using sha512

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x100
mov rsi, r8
mov r8, rdx
mov rdx, rcx
mov rax, qword [0x140165040]
xor rax, rsp
mov qword [rsp + 0xf8], rax
lea rdi, [rsp + 0x70]
movaps xmm0, xmmword [0x14013ab10]
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x70], xmm0
movabs rax, 0x6a09e667f3bcc908
mov qword [rsp + 0x20], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rsp + 0x28], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rsp + 0x30], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rsp + 0x38], rax
movabs rax, 0x510e527fade682d1
mov qword [rsp + 0x40], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rsp + 0x48], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsp + 0x50], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsp + 0x58], rax
movabs rax, 0x4000000000
mov qword [rsp + 0xf0], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x20]
call fcn.140091680
mov eax, dword [rsp + 0xf0]
mov ebx, dword [rsp + 0xf4]
lea rcx, [rax + 1]
mov byte [rsp + rax + 0x70], 0x80
cmp rax, 0x70
jb 0x140090076
cmp eax, 0x7f
je 0x14009005f
mov r8d, 0x7f
sub r8, rax
add rcx, rdi
xor edx, edx
call fcn.14012e050
lea rcx, [rsp + 0x20]
mov r8d, 1
mov rdx, rdi
call fcn.140015580
xor ecx, ecx
jmp 0x14009007c
cmp rcx, 0x70
je 0x14009008f
mov r8d, 0x70
sub r8, rcx
add rcx, rdi
xor edx, edx
call fcn.14012e050
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
bswap rcx
mov qword [rsp + 0xe0], rcx
bswap rax
mov qword [rsp + 0xe8], rax
lea rcx, [rsp + 0x20]
mov r8d, 1
mov rdx, rdi
call fcn.140015580
test rsi, rsi
je 0x1400900f4
cmp ebx, 8
jb 0x1400900f4
shr ebx, 3
xor eax, eax
nop word cs:[rax + rax]
mov rcx, qword [rsp + rax*8 + 0x20]
bswap rcx
mov qword [rsi + rax*8], rcx
inc rax
cmp rbx, rax
jne 0x1400900e0
lea rcx, [rsp + 0x20]
mov edx, 0xd8
call fcn.1400ae2e0
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.1400fb950
mov rax, rsi
add rsp, 0x100
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400915f0
Capabilities:
Hash data using sha512

Disassembly:
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
movabs rax, 0x4000000000
mov qword [rcx + 0xd0], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x40], xmm0
mov eax, 1
ret
Function at 0x1400aa5e0
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x1400aa5f0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x1400aa611
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x1400aa62d
cmp byte [r14 + 0x50], 0
je 0x1400aa642
or edi, 0x80000000
test dil, 8
je 0x1400aa656
cmp byte [r14 + 0x68], 0
je 0x1400aa650
or edi, 0x40000000
jmp 0x1400aa656
or edi, 0x20000000
test dil, 8
jne 0x1400aa633
jmp 0x1400aa656
or edi, 0x10000000
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r12d, 0
je 0x1400aa66a
mov r12, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov r13d, 0
je 0x1400aa67b
mov r13, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 0
je 0x1400aa68e
lea rcx, [r14 + 0x20]
call fcn.14004bf20
mov r15, rax
cmp byte [r14 + 0x18], 0
je 0x1400aa6be
mov rcx, r14
call fcn.14004bf20
mov r9, rax
cmp ebx, 4
ja case.default.0x1400aa6b5
mov eax, ebx
lea rcx, [0x140150d58]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov edx, 7
jmp 0x1400aa6dd
xor r9d, r9d
cmp ebx, 4
jbe 0x1400aa6a5
xor edx, edx
jmp 0x1400aa6dd
mov edx, 6
jmp 0x1400aa6dd
mov edx, 1
jmp 0x1400aa6dd
mov edx, 4
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
je 0x1400aa706
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400aa5f0
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x1400aa5f0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x1400aa611
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x1400aa62d
cmp byte [r14 + 0x50], 0
je 0x1400aa642
or edi, 0x80000000
test dil, 8
je 0x1400aa656
cmp byte [r14 + 0x68], 0
je 0x1400aa650
or edi, 0x40000000
jmp 0x1400aa656
or edi, 0x20000000
test dil, 8
jne 0x1400aa633
jmp 0x1400aa656
or edi, 0x10000000
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r12d, 0
je 0x1400aa66a
mov r12, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov r13d, 0
je 0x1400aa67b
mov r13, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 0
je 0x1400aa68e
lea rcx, [r14 + 0x20]
call fcn.14004bf20
mov r15, rax
cmp byte [r14 + 0x18], 0
je 0x1400aa6be
mov rcx, r14
call fcn.14004bf20
mov r9, rax
cmp ebx, 4
ja case.default.0x1400aa6b5
mov eax, ebx
lea rcx, [0x140150d58]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov edx, 7
jmp 0x1400aa6dd
xor r9d, r9d
cmp ebx, 4
jbe 0x1400aa6a5
xor edx, edx
jmp 0x1400aa6dd
mov edx, 6
jmp 0x1400aa6dd
mov edx, 1
jmp 0x1400aa6dd
mov edx, 4
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
je 0x1400aa706
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400aa720
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x1400aa754
cmp byte [r14 + 0x50], 0
je 0x1400aa769
or edi, 0x80000000
test dil, 8
je 0x1400aa77d
cmp byte [r14 + 0x68], 0
je 0x1400aa777
or edi, 0x40000000
jmp 0x1400aa77d
or edi, 0x20000000
test dil, 8
jne 0x1400aa75a
jmp 0x1400aa77d
or edi, 0x10000000
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r12d, 0
je 0x1400aa791
mov r12, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov r13d, 0
je 0x1400aa7a2
mov r13, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 0
je 0x1400aa7b5
lea rcx, [r14 + 0x20]
call fcn.14004bf20
mov r15, rax
cmp byte [r14 + 0x18], 0
je 0x1400aa7e5
mov rcx, r14
call fcn.14004bf20
mov r9, rax
cmp ebx, 4
ja case.default.0x1400aa7dc
mov eax, ebx
lea rcx, [0x140150d6c]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov edx, 7
jmp 0x1400aa804
xor r9d, r9d
cmp ebx, 4
jbe 0x1400aa7cc
xor edx, edx
jmp 0x1400aa804
mov edx, 6
jmp 0x1400aa804
mov edx, 1
jmp 0x1400aa804
mov edx, 4
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov esi, eax
test eax, eax
je 0x1400aa82d
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400ab4f0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x140165040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0x50], xmm0
lea rdi, [rsp + 0x68]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.1400522b0
cmp byte [rsp + 0x7f], 0
jns 0x1400ab53a
mov rdi, qword [rsp + 0x68]
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp byte [rsp + 0x7f], 0
js 0x1400ab55b
test rsi, rsi
jne 0x1400ab56e
jmp 0x1400ab617
mov rcx, qword [rsp + 0x68]
call fcn.1400fa65c
test rsi, rsi
je 0x1400ab617
test edi, edi
je 0x1400ab617
mov ecx, edi
add rcx, rcx
call fcn.1400fa69c
mov rbx, rax
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x40], xmm0
lea r14, [rsp + 0x68]
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.1400522b0
cmp byte [rsp + 0x7f], 0
jns 0x1400ab5aa
mov r14, qword [rsp + 0x68]
mov rcx, r14
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [rsp + 0x7f], 0
jns 0x1400ab5ca
mov rcx, qword [rsp + 0x68]
call fcn.1400fa65c
mov qword [rsp + 0x30], rbx
test rbx, rbx
je 0x1400ab63b
mov rcx, rbx
call fcn.140117318
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0x30]
call fcn.1400522e0
cmp byte [rsi + 0x17], 0
jns 0x1400ab5fe
mov rcx, qword [rsi]
call fcn.1400fa65c
mov rax, qword [rsp + 0x78]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rsi], xmm0
mov rcx, rbx
call fcn.1400fa6a4
test edi, edi
setne bl
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400fb950
mov eax, ebx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rax, str.null_pointer_passed_to_non_null_argument_of_char_traits_..._::length
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__s___nullptr
mov r8d, 0x109
call fcn.140021ffc
int3
Function at 0x1400ac610
Capabilities:
Set thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x140165040]
xor rax, rsp
mov qword [rsp + 0x50], rax
test rcx, rcx
je 0x1400ac881
movabs rax, 0xe69e32f3ad9ea63
cmp qword [0x1401675a0], rax
jne 0x1400ac884
mov rsi, rcx
mov r14d, dword [rcx + 8]
add r14, 0x518
mov byte [rsp + 0x3f], 0xaa
cmp byte [rcx + 2], 0
sete al
bsr rdx, r14
xor rdx, 0xffffffffffffffc0
lea rcx, [0x14014e210]
movzx ecx, byte [rdx + rcx + 0x41]
mov r8, r14
shr r8, cl
and r8d, 7
lea rcx, [0x14014e260]
mov rcx, qword [rcx + rdx*8 + 0x208]
and rcx, r14
lea rdx, [r8 + rdx*8]
add rdx, 0x208
cmp rcx, 1
sbb rdx, 0xffffffffffffffff
lea rcx, [0x14014d9f0]
movzx ecx, word [rcx + rdx*2 + 0x400]
cmp cx, 0x6e
setb dl
and dl, al
movzx eax, dl
or eax, ecx
movzx eax, ax
lea r12, [rax + rax*4]
mov eax, r12d
lea r15, [rsi + rax*8]
add r15, 0x48
lea rdi, [rsi + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
jne 0x1400ac6f1
mov rcx, rdi
call fcn.1400ad080
mov rax, qword [r15]
mov rbx, qword [rax]
test rbx, rbx
je 0x1400ac7e6
mov byte [rsp + 0x3f], 0
mov r8, qword [rbx]
test r8, r8
je 0x1400ac745
lea rdx, [rsi + 0x48]
mov r9d, r12d
mov rcx, r8
bswap rcx
mov r14d, dword [rdx + r9*8 + 0x18]
mov rdx, rcx
xor rdx, rbx
cmp rdx, 0x1fffff
ja 0x1400ac84a
mov edx, ecx
and edx, 0x1fc000
je 0x1400ac84a
prefetcht0 byte [rcx]
jmp 0x1400ac747
xor ecx, ecx
mov qword [rax], rcx
mov ecx, dword [rax + 0x18]
lea edx, [rcx + 2]
and edx, 0x3ffe
and ecx, 0xffffc001
or ecx, edx
mov dword [rax + 0x18], ecx
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0x18]
add rax, qword [rsi + 0x1498]
mov qword [rsi + 0x1498], rax
mov rcx, qword [rsi + 0x14a0]
cmp rcx, rax
cmova rax, rcx
mov qword [rsi + 0x14a0], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, rbx
mov rdx, rsi
call fcn.1400ac8a0
mov ecx, dword [0x14017ef60]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x140173698]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x150], rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400fb950
mov rax, rbx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, [rsp + 0x3f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x4000
mov rcx, r15
mov rdx, rsi
mov r8d, 2
mov r9, r14
call fcn.1400b4e10
test rax, rax
je 0x1400ac87a
mov rbx, rax
mov rcx, rax
and rcx, 0xffffffffffe00000
mov edx, ebx
shr edx, 9
and edx, 0xfe0
lea rax, [rdx + rcx]
add rax, 0x1000
movzx ecx, byte [rdx + rcx + 0x101e]
and ecx, 0x3f
shl ecx, 5
sub rax, rcx
jmp 0x1400ac761
movaps xmm0, xmmword [0x14013ab10]
movaps xmmword [rsp + 0x40], xmm0
lea rdx, str.first
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.140079660
mov rcx, rsi
call fcn.1400189e0
mov rcx, r14
call fcn.1400b4b60
xor ebx, ebx
jmp 0x1400ac78b
int3
int3
Function at 0x1400ae3b0
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400ae3d9
xor eax, eax
xor r9d, r9d
nop word [rax + rax]
movzx r10d, byte [rdx + rax]
xor r10b, byte [rcx + rax]
or r9b, r10b
inc rax
cmp r8, rax
jne 0x1400ae3c0
movzx eax, r9b
ret
xor eax, eax
ret

Function at 0x1400b0f50
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rax, qword [0x140165040]
xor rax, rsp
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [0x14013ab10]
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
mov r8d, 6
call fcn.1400b08c0
xor edi, edi
test eax, eax
je 0x1400b1113
lea rcx, [rsp + 0x20]
call fcn.140090640
movzx r15d, byte [0x140151645]
cmp rax, r15
jne 0x1400b0fe1
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.14004bf20
lea r14, [0x140151638]
test r15b, r15b
je 0x1400b1109
lea rdx, [0x14015163c]
mov rcx, rax
mov r8, rbx
call fcn.14012d8b0
test eax, eax
je 0x1400b1109
lea rcx, [rsp + 0x20]
call fcn.140090640
movzx r15d, byte [0x140151725]
cmp rax, r15
jne 0x1400b102f
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.14004bf20
lea r14, [0x140151718]
test r15b, r15b
je 0x1400b1109
lea rdx, [0x14015171c]
mov rcx, rax
mov r8, rbx
call fcn.14012d8b0
test eax, eax
je 0x1400b1109
lea rcx, [rsp + 0x20]
call fcn.140090640
movzx r15d, byte [0x140151805]
cmp rax, r15
jne 0x1400b107d
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.14004bf20
lea r14, [0x1401517f8]
test r15b, r15b
je 0x1400b1109
lea rdx, [0x1401517fc]
mov rcx, rax
mov r8, rbx
call fcn.14012d8b0
test eax, eax
je 0x1400b1109
lea rcx, [rsp + 0x20]
call fcn.140090640
movzx r15d, byte [0x1401518e5]
cmp rax, r15
jne 0x1400b10c3
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.14004bf20
lea r14, [0x1401518d8]
test r15b, r15b
je 0x1400b1109
lea rdx, [0x1401518dc]
mov rcx, rax
mov r8, rbx
call fcn.14012d8b0
test eax, eax
je 0x1400b1109
lea rcx, [rsp + 0x20]
call fcn.140090640
movzx r15d, byte [0x1401519cd]
cmp rax, r15
jne 0x1400b1113
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.14004bf20
lea r14, [0x1401519c0]
test r15b, r15b
je 0x1400b1109
lea rdx, [0x1401519c4]
mov rcx, rax
mov r8, rbx
call fcn.14012d8b0
test eax, eax
jne 0x1400b1113
mov eax, dword [r14]
mov dword [rsi], eax
mov edi, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400fb950
mov eax, edi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret