joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140041140
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x140
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x138], rax
test rdx, rdx
je 0x1400411ce
mov rsi, rdx
mov rdi, rcx
mov r13d, 0xffffffff
lea r14, str..._.._base_rand_util_win.cc
lea r15, str.success
lea r12, [rsp + 0x28]
nop dword [rax + rax]
cmp rsi, r13
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x1400411c6
mov rcx, r12
mov rdx, r14
mov r8d, 0x20
mov r9, r15
call fcn.140018570
mov rcx, r12
call fcn.1400186e0
add rdi, rbx
sub rsi, rbx
jne 0x140041190
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.1400a8dd0
nop
add rsp, 0x140
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140048240
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x34], 0
mov rcx, qword [rcx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400482bb
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x1400482bb
cmp dword [rsp + 0x38], 4
jne 0x1400482bb
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400a8dd0
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x140048320
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
test byte [0x14012c417], 2
je 0x14007a2b0
jmp fcn.140080f30
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 8
call fcn.14007a300
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret

Function at 0x140049ea0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
movabs r10, 0x8000000000000000
mov r11d, 0xffffffff
cmp rdx, r9
mov r14, r9
cmovb r14, rdx
xor eax, eax
test r14, r14
je 0x140049f1e
xor edi, edi
mov r15, qword [r8 + rdi*8]
mov r13, qword [rcx + rdi*8]
mov rsi, r13
xor rsi, r15
mov r12d, eax
lea rax, [rsi - 1]
mov rbx, r13
sub rbx, r15
xor rbx, r13
or rbx, rsi
xor rsi, r10
and rax, rsi
sar rax, 0x3f
and r12d, eax
xor rbx, r13
sar rbx, 0x3f
mov esi, ebx
not esi
and esi, 1
or rsi, rbx
xor rax, r11
and rax, rsi
or rax, r12
inc rdi
cmp rdi, r14
jb 0x140049ece
cmp rdx, r9
jae 0x140049f4b
xor ecx, ecx
or rcx, qword [r8 + rdx*8]
inc rdx
cmp r9, rdx
jne 0x140049f25
xor r10, rcx
dec rcx
and rcx, r10
sar rcx, 0x3f
and eax, ecx
xor r11d, ecx
or r11d, eax
mov eax, r11d
jmp 0x140049f76
cmp r9, rdx
jae 0x140049f76
xor edi, edi
or rdi, qword [rcx + r9*8]
inc r9
cmp rdx, r9
jne 0x140049f52
xor r10, rdi
dec rdi
and rdi, r10
sar rdi, 0x3f
and eax, edi
not edi
and edi, 1
or edi, eax
mov eax, edi
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14004a0b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
movsxd r9, dword [rcx + 8]
movsxd r10, dword [rdx + 8]
cmp r9d, r10d
jge 0x14004a0d5
mov rax, qword [rdx]
xor r8d, r8d
mov rsi, r9
or r8, qword [rax + rsi*8]
inc rsi
cmp rsi, r10
jl 0x14004a0c7
jmp 0x14004a0d8
xor r8d, r8d
cmp r10d, r9d
jge 0x14004a0fc
lea r11, [r10*8]
add r11, qword [rcx]
mov rax, r9
sub rax, r10
xor esi, esi
or r8, qword [r11 + rsi*8]
inc rsi
cmp rax, rsi
jne 0x14004a0f0
cmp r9d, r10d
cmovl r10d, r9d
test r10d, r10d
jle 0x14004a126
mov r9, qword [rcx]
mov r11, qword [rdx]
movsxd r10, r10d
xor eax, eax
mov rsi, qword [r11 + rax*8]
xor rsi, qword [r9 + rax*8]
or r8, rsi
inc rax
cmp rax, r10
jl 0x14004a113
mov eax, dword [rdx + 0x10]
xor eax, dword [rcx + 0x10]
movsxd rcx, eax
xor eax, eax
or rcx, r8
sete al
pop rsi
ret

Function at 0x14004f670
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
movsxd rax, dword [rdx + 8]
test rax, rax
je 0x14004f6c6
mov r14, rcx
mov rcx, qword [rdx]
xor edi, edi
xor esi, esi
or rsi, qword [rcx + rdi*8]
inc rdi
cmp rdi, rax
jb 0x14004f68c
test rsi, rsi
je 0x14004f6c6
test eax, eax
jle 0x14004f6a6
test byte [rcx], 1
jne 0x14004f6f5
mov dword [rsp + 0x20], 0xb0
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x68
jmp 0x14004f6e4
mov dword [rsp + 0x20], 0xac
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x69
call fcn.1400819b0
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
cmp dword [rdx + 0x10], 0
je 0x14004f71b
mov dword [rsp + 0x20], 0xb4
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x6d
jmp 0x14004f6e4
lea rdi, [r14 + 0x18]
mov rcx, rdi
call fcn.140049a10
test rax, rax
je 0x14004f7bb
movsxd rcx, dword [r14 + 0x20]
mov rax, rcx
test rcx, rcx
jle 0x14004f74b
mov rdx, qword [rdi]
lea rcx, [rax - 1]
cmp qword [rdx + rax*8 - 8], 0
je 0x14004f734
mov dword [r14 + 0x20], eax
test eax, eax
jne 0x14004f75b
mov dword [r14 + 0x28], 0
mov rax, qword [rdi]
mov r9, qword [rax]
mov esi, 1
mov edx, 0x40
xor ecx, ecx
movabs r8, 0x8000000000000000
mov edi, esi
and edi, 1
neg rdi
mov rax, r9
and rax, rdi
mov rbx, rax
xor rbx, rsi
shr rbx, 1
and rax, rsi
add rax, rbx
and rdi, r8
shr rcx, 1
or rcx, rdi
mov rsi, rax
dec rdx
jne 0x14004f777
mov qword [r14 + 0x30], rcx
mov qword [r14 + 0x38], 0
mov esi, 1
jmp 0x14004f6e9
mov dword [rsp + 0x20], 0xba
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x44
jmp 0x14004f6e4
Function at 0x140050d90
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
movsxd r8, dword [rcx + 8]
test r8, r8
jle 0x140050ef1
movabs r10, 0x8000000000000000
mov r9, qword [rcx]
xor r11d, r11d
xor edx, edx
xor eax, eax
xor r14d, r14d
mov rcx, qword [r9 + rdx*8]
mov rsi, rcx
xor rsi, r10
lea rbx, [rcx - 1]
and rbx, rsi
sar rbx, 0x3f
not rbx
mov ebp, r14d
not ebp
or r14, rbx
mov r15d, ebx
and r15d, ebp
mov rbx, rcx
shl rbx, 0x20
mov rbp, rbx
xor rbp, r10
dec rbx
and rbx, rbp
mov rbp, rbx
shr rbp, 0x3a
and ebp, 0xffffffe0
mov rdi, rcx
shr rdi, 0x20
test rbx, rbx
cmovns rdi, rcx
mov rcx, rdi
shl rcx, 0x30
mov rbx, rcx
xor rbx, r10
dec rcx
and rcx, rbx
mov rbx, rcx
shr rbx, 0x3b
and ebx, 0xfffffff0
or ebx, ebp
mov rbp, rdi
shr rbp, 0x10
test rcx, rcx
cmovns rbp, rdi
mov rcx, rbp
shl rcx, 0x38
mov rdi, rcx
xor rdi, r10
dec rcx
and rcx, rdi
mov rdi, rcx
shr rdi, 0x3c
and edi, 0xfffffff8
or edi, ebx
mov rbx, rbp
shr rbx, 8
test rcx, rcx
cmovns rbx, rbp
mov rcx, rbx
shl rcx, 0x3c
mov rbp, rcx
xor rbp, r10
dec rcx
and rcx, rbp
mov rbp, rcx
shr rbp, 0x3d
and ebp, 0xfffffffc
or ebp, edi
mov rsi, rbx
shr rsi, 4
test rcx, rcx
cmovns rsi, rbx
mov rcx, rsi
shl rcx, 0x3e
mov rbx, rcx
xor rbx, r10
dec rcx
and rcx, rbx
mov rbx, rcx
shr rbx, 0x3e
and ebx, 0xfffffffe
or ebx, ebp
mov rdi, rsi
shr rdi, 2
test rcx, rcx
cmovns rdi, rsi
shl rdi, 0x3f
mov rcx, rdi
xor rcx, r10
dec rdi
and rdi, rcx
shr rdi, 0x3f
or edi, ebx
add edi, r11d
and edi, r15d
or eax, edi
inc rdx
add r11d, 0x40
cmp rdx, r8
jl 0x140050dbc
jmp 0x140050ef3
xor eax, eax
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140051400
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1c0
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x1b8], rax
test rdx, rdx
je 0x140051632
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
call fcn.140088900
mov r14d, eax
test byte [0x14012c417], 0x40
je 0x14005145c
lea rcx, [rsp + 0x190]
mov edx, 0x20
call fcn.140088970
test eax, eax
jne 0x140051488
test r14d, r14d
je 0x140051476
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1a0], xmm0
movaps xmmword [rsp + 0x190], xmm0
jmp 0x140051488
lea rcx, [rsp + 0x190]
mov edx, 0x20
call fcn.1400889d0
xor eax, eax
movups xmm0, xmmword [rsi + rax]
xorps xmm0, xmmword [rsp + rax + 0x190]
movaps xmmword [rsp + rax + 0x190], xmm0
add rax, 0x10
cmp rax, 0x20
jne 0x14005148a
test r14d, r14d
je 0x1400514bc
mov ecx, 1
call fcn.140081d10
mov rsi, rax
jmp 0x1400514ee
lea rcx, [0x14012bfb8]
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rsi, qword [0x14012bfc0]
test rsi, rsi
je 0x1400514e2
mov rax, qword [rsi + 0x120]
mov qword [0x14012bfc0], rax
lea rcx, [0x14012bfb8]
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
test rsi, rsi
jne 0x14005153f
mov ecx, 0x130
call fcn.140060000
test rax, rax
je 0x140051532
mov rsi, rax
mov rcx, rax
call fcn.140057ba0
test r14d, r14d
je 0x14005153f
lea r8, [0x14005fc00]
mov ecx, 1
mov rdx, rsi
call fcn.140081db0
test eax, eax
jne 0x14005153f
mov rcx, rsi
call fcn.140060030
lea rsi, [rsp + 0x60]
mov rcx, rsi
call fcn.140057ba0
cmp qword [rsi + 0x128], 0x1000
jb 0x14005158d
lea rbp, [rsp + 0x30]
mov edx, 0x30
mov rcx, rbp
call fcn.1400889d0
mov r8d, 0x30
mov rcx, rsi
mov rdx, rbp
call fcn.1400578c0
test eax, eax
je 0x140051655
mov qword [rsi + 0x118], 1
mov qword [rsi + 0x128], 0
mov eax, 0x20
mov r12d, 0x10000
lea r15, [rsp + 0x190]
cmp rdi, r12
mov ebp, 0x10000
cmovb rbp, rdi
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov rdx, rbx
mov r8, rbp
mov r9, r15
call fcn.1400579a0
test eax, eax
je 0x140051655
inc qword [rsi + 0x128]
add rbx, rbp
mov eax, 0
sub rdi, rbp
jne 0x1400515a0
lea rdi, [rsp + 0x60]
cmp rsi, rdi
jne 0x1400515f7
lea rcx, [rsp + 0x60]
mov edx, 0x120
call fcn.140060080
cmp rsi, rdi
setne al
test r14d, r14d
jne 0x140051632
test al, al
je 0x140051632
lea rdi, [0x14012bfb8]
mov rcx, rdi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [0x14012bfc0]
mov qword [rsi + 0x120], rax
mov qword [0x14012bfc0], rsi
mov rcx, rdi
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.1400a8dd0
nop
add rsp, 0x1c0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400dad20
ud2
Function at 0x1400528a0
Capabilities:
Hash data using sha512

Disassembly:
push rsi
push rdi
sub rsp, 0x108
mov rsi, r8
mov r8, rdx
mov rdx, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x100], rax
movaps xmm0, xmmword [0x1400fc070]
lea rdi, [rsp + 0x20]
movaps xmmword [rdi], xmm0
movaps xmm0, xmmword [0x1400fc080]
movaps xmmword [rdi + 0x10], xmm0
movaps xmm0, xmmword [0x1400fc090]
movaps xmmword [rdi + 0x20], xmm0
movaps xmm0, xmmword [0x1400fc0a0]
movaps xmmword [rdi + 0x30], xmm0
movabs rax, 0x4000000000
mov qword [rdi + 0xd0], rax
xorps xmm0, xmm0
movaps xmmword [rdi + 0x40], xmm0
mov rcx, rdi
call fcn.14005c240
mov rcx, rsi
mov rdx, rdi
call fcn.14005c340
mov edx, 0xd8
mov rcx, rdi
call fcn.140060080
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1400a8dd0
mov rax, rsi
add rsp, 0x108
pop rdi
pop rsi
ret
Function at 0x1400577f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edi, edi
cmp r9, 0x30
ja 0x1400578aa
mov rsi, rcx
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmm2, xmmword [rdx + 0x20]
movaps xmmword [rsp + 0x50], xmm2
movaps xmmword [rsp + 0x40], xmm1
movaps xmmword [rsp + 0x30], xmm0
test r9, r9
je 0x140057845
xor eax, eax
mov cl, byte [r8 + rax]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp r9, rax
jne 0x140057835
xor eax, eax
lea rcx, [0x1400fc690]
movaps xmm0, xmmword [rsp + rax + 0x30]
xorps xmm0, xmmword [rax + rcx]
movaps xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
cmp rax, 0x30
jne 0x14005784e
lea r8, [rsi + 0xf8]
mov qword [rsp + 0x20], 0x20
lea rdi, [rsp + 0x30]
mov rcx, rsi
xor edx, edx
mov r9, rdi
call fcn.140051ff0
mov qword [rsi + 0x100], rax
movaps xmm0, xmmword [rdi + 0x20]
movups xmmword [rsi + 0x108], xmm0
mov qword [rsi + 0x118], 1
mov edi, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400a8dd0
mov eax, edi
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x1400578c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edi, edi
cmp r8, 0x30
ja 0x140057980
mov r12, r8
mov r14, rdx
mov rsi, rcx
lea r15, [rcx + 0xf8]
lea rdi, [rcx + 0x108]
xor ebx, ebx
mov ecx, dword [rsi + 0x114]
call fcn.1400d58c0
lea ecx, [rax + 1]
call fcn.1400d58c0
mov dword [rsi + 0x114], eax
lea rdx, [rsp + rbx]
add rdx, 0x30
mov rcx, rdi
mov r8, rsi
call qword [rsi + 0xf8]
add rbx, 0x10
cmp rbx, 0x30
jb 0x140057901
test r12, r12
je 0x14005794f
xor eax, eax
mov cl, byte [r14 + rax]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp r12, rax
jne 0x14005793f
mov qword [rsp + 0x20], 0x20
lea rbx, [rsp + 0x30]
mov rcx, rsi
xor edx, edx
mov r8, r15
mov r9, rbx
call fcn.140051ff0
mov qword [rsi + 0x100], rax
movaps xmm0, xmmword [rbx + 0x20]
movups xmmword [rdi], xmm0
mov edi, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400a8dd0
mov eax, edi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140058330
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov r12, r9
mov r13, r8
mov rdi, rdx
mov r14, rcx
mov r15, qword [rsp + 0x108]
mov rax, qword [rsp + 0x100]
mov rcx, qword [0x140125058]
xor rcx, rsp
mov qword [rsp + 0x80], rcx
test rax, rax
jne 0x140058390
lea rcx, [0x14012bd20]
lea rdx, [0x140052560]
call fcn.140081ba0
lea rax, [0x14012bd28]
test r15, r15
cmove r15, rax
mov ebx, dword [rax + 4]
lea rcx, [rbx + rbx]
add rcx, 2
cmp rcx, rdi
jbe 0x1400583c7
mov dword [rsp + 0x20], 0x14a
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_rsa_padding.c
xor esi, esi
mov ecx, 4
xor edx, edx
mov r8d, 0x7e
jmp 0x1400583fc
lea rcx, [rbx + rbx]
mov rbp, rcx
not rbp
lea rdx, [rdi + rbp]
add rdx, 0xffffffffffffffff
cmp rdx, r12
jae 0x140058427
mov dword [rsp + 0x20], 0x150
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_rsa_padding.c
xor esi, esi
mov ecx, 4
xor edx, edx
mov r8d, 0x72
call fcn.1400819b0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400a8dd0
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
dec rdi
or rcx, 1
cmp rdi, rcx
jae 0x140058440
mov dword [rsp + 0x20], 0x155
jmp 0x1400583af
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xf0]
mov byte [r14], 0
lea r8, [r14 + rbx]
add r8, 1
mov qword [rsp + 0x20], rax
xor esi, esi
mov qword [rsp + 0x38], r8
xor r9d, r9d
call fcn.140052480
test eax, eax
je 0x140058401
mov rsi, rdi
sub rsi, r12
add rbp, rsi
mov rcx, qword [rsp + 0x38]
je 0x14005849c
mov rax, qword [rsp + 0x38]
lea rcx, [rax + rbx]
xor edx, edx
mov r8, rbp
call fcn.1400ccbd0
mov rcx, qword [rsp + 0x38]
inc r14
mov rax, rbx
not rax
add rsi, rax
mov byte [rcx + rsi], 1
test r12, r12
mov rbp, rcx
je 0x1400584c9
lea rcx, [rdi + rbp]
sub rcx, r12
sub rcx, rbx
mov rdx, r13
mov r8, r12
call fcn.1400cc760
lea r8, [0x1400fc6c0]
mov rcx, r14
mov rdx, rbx
call fcn.140051400
sub rdi, rbx
mov rcx, rdi
call fcn.140060000
test rax, rax
je 0x140058565
mov r12, rax
mov qword [rsp + 0x20], r15
mov rcx, rax
mov rdx, rdi
mov r8, r14
mov r9, rbx
call fcn.140058590
xor esi, esi
test eax, eax
je 0x140058558
test rdi, rdi
je 0x140058521
xor eax, eax
mov cl, byte [r12 + rax]
xor byte [rbp + rax], cl
inc rax
cmp rdi, rax
jne 0x140058511
mov qword [rsp + 0x20], r15
lea rcx, [rsp + 0x40]
mov rdx, rbx
mov r8, rbp
mov r9, rdi
call fcn.140058590
test eax, eax
je 0x140058558
mov esi, 1
test ebx, ebx
je 0x140058558
xor eax, eax
mov cl, byte [rsp + rax + 0x40]
xor byte [r14 + rax], cl
inc rax
cmp rbx, rax
jne 0x140058548
mov rcx, r12
call fcn.140060030
jmp 0x140058401
mov dword [rsp + 0x20], 0x169
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_rsa_padding.c
xor esi, esi
mov ecx, 4
xor edx, edx
mov r8d, 0x41
jmp 0x1400583fc
Function at 0x140060130
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x140060152
xor r9d, r9d
xor eax, eax
mov r10b, byte [rdx + r9]
xor r10b, byte [rcx + r9]
movzx r10d, r10b
or eax, r10d
inc r9
cmp r8, r9
jne 0x14006013a
ret
xor eax, eax
ret
Function at 0x140065d80
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [rcx + 0x28]
call fcn.1400d58c0
mov dword [rsi + 0x28], eax
mov ecx, dword [rsi + 0x2c]
call fcn.1400d58c0
mov dword [rsi + 0x2c], eax
mov ecx, dword [rsi + 0x30]
call fcn.1400d58c0
mov dword [rsi + 0x30], eax
mov ecx, dword [rsi + 0x34]
call fcn.1400d58c0
mov dword [rsi + 0x34], eax
mov ecx, dword [rsi + 0x38]
call fcn.1400d58c0
mov dword [rsi + 0x38], eax
mov ecx, dword [rsi + 0x3c]
call fcn.1400d58c0
mov dword [rsi + 0x3c], eax
mov ecx, dword [rsi + 0x40]
call fcn.1400d58c0
mov dword [rsi + 0x40], eax
mov ecx, dword [rsi + 0x44]
call fcn.1400d58c0
mov dword [rsi + 0x44], eax
mov ecx, dword [rsi + 0x48]
call fcn.1400d58c0
mov dword [rsi + 0x48], eax
mov ecx, dword [rsi + 0x4c]
call fcn.1400d58c0
mov dword [rsi + 0x4c], eax
mov ecx, dword [rsi + 0x50]
call fcn.1400d58c0
mov dword [rsi + 0x50], eax
mov ecx, dword [rsi + 0x54]
call fcn.1400d58c0
mov dword [rsi + 0x54], eax
mov ecx, dword [rsi + 0x58]
call fcn.1400d58c0
mov dword [rsi + 0x58], eax
mov ecx, dword [rsi + 0x5c]
call fcn.1400d58c0
mov dword [rsi + 0x5c], eax
mov ecx, dword [rsi + 0x60]
call fcn.1400d58c0
mov dword [rsi + 0x60], eax
mov ecx, dword [rsi + 0x64]
call fcn.1400d58c0
mov dword [rsi + 0x64], eax
xor eax, eax
nop
mov ecx, dword [rsi + rax*4 + 0x48]
xor ecx, dword [rsi + rax*4 + 0x5c]
xor ecx, dword [rsi + rax*4 + 0x30]
xor ecx, dword [rsi + rax*4 + 0x28]
rol ecx, 1
mov dword [rsi + rax*4 + 0x68], ecx
add rax, 1
cmp rax, 0x40
jne 0x140065e40
movdqu xmm0, xmmword [rsi + 0x14]
movdqu xmmword [rsi], xmm0
mov r8d, dword [rsi + 0x24]
mov dword [rsi + 0x10], r8d
movd edi, xmm0
pshufd xmm1, xmm0, 0xe5
movd ebp, xmm1
pshufd xmm1, xmm0, 0x4e
movd ecx, xmm1
pshufd xmm1, xmm0, 0xe7
movd r10d, xmm1
xor eax, eax
mov r11d, 0x8f1bbcdc
mov ebx, r8d
nop dword [rax]
mov r14d, edi
mov r9d, r10d
mov r10d, ecx
mov ecx, ebp
mov ebp, edi
rol ebp, 5
cmp rax, 0x14
jae 0x140065ee0
mov edx, ecx
and edx, r10d
mov edi, ecx
not edi
and edi, r9d
or edi, edx
add edi, ebp
add edi, ebx
add edi, dword [rsi + rax*4 + 0x28]
mov ebx, 0x5a827999
jmp 0x140065f35
cmp rax, 0x28
jae 0x140065f00
mov edi, r10d
xor edi, r9d
xor edi, ecx
add edi, ebp
add edi, ebx
add edi, dword [rsi + rax*4 + 0x28]
mov ebx, 0x6ed9eba1
jmp 0x140065f35
cmp rax, 0x3b
ja 0x140065f18
mov edx, r10d
or edx, r9d
and edx, ecx
mov edi, r10d
and edi, r9d
or edi, edx
jmp 0x140065f20
mov edi, r10d
xor edi, r9d
xor edi, ecx
add edi, ebp
add edi, ebx
add edi, dword [rsi + rax*4 + 0x28]
cmp rax, 0x3c
mov ebx, 0xca62c1d6
cmovb ebx, r11d
add edi, ebx
rol ecx, 0x1e
add rax, 1
mov ebx, r9d
mov ebp, r14d
cmp rax, 0x50
jne 0x140065ea0
mov dword [rsi + 0x10], r9d
mov dword [rsi + 0xc], r10d
mov dword [rsi + 8], ecx
mov dword [rsi + 4], r14d
mov dword [rsi], edi
movd xmm1, r10d
movd xmm2, ecx
punpckldq xmm2, xmm1
movd xmm1, r14d
movd xmm3, edi
punpckldq xmm3, xmm1
punpcklqdq xmm3, xmm2
paddd xmm3, xmm0
movdqu xmmword [rsi + 0x14], xmm3
add r8d, r9d
mov dword [rsi + 0x24], r8d
mov dword [rsi + 0x168], 0
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140069d70
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140069d89
mov dword [rsi], eax
mov al, 1
jmp 0x140069d8b
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x140070490
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, r8
mov qword [rsp + 0x20], rdx
mov r15, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0xf
jbe 0x1400704b6
mov rdi, qword [rdi]
movabs rdx, 0xcbf29ce484222325
test r15, r15
je 0x1400704e4
movabs rax, 0x100000001b3
lea rbp, [r15 - 1]
mov r8d, r15d
and r8d, 3
cmp rbp, 3
jae 0x1400704e9
xor ebp, ebp
jmp 0x140070538
mov rbx, rdx
jmp 0x140070568
mov rsi, r15
sub rsi, r8
xor ebp, ebp
nop word cs:[rax + rax]
nop dword [rax + rax]
movzx ebx, byte [rdi + rbp]
xor rbx, rdx
imul rbx, rax
movzx edx, byte [rdi + rbp + 1]
xor rdx, rbx
imul rdx, rax
movzx ebx, byte [rdi + rbp + 2]
xor rbx, rdx
imul rbx, rax
movzx edx, byte [rdi + rbp + 3]
xor rdx, rbx
imul rdx, rax
add rbp, 4
cmp rsi, rbp
jne 0x140070500
mov rbx, rdx
test r8, r8
je 0x140070568
add rbp, rdi
xor esi, esi
nop word cs:[rax + rax]
nop
movzx ebx, byte [rbp + rsi]
xor rbx, rdx
imul rbx, rax
add rsi, 1
mov rdx, rbx
cmp r8, rsi
jne 0x140070550
and rbx, qword [rcx + 0x30]
mov r14, qword [rcx + 8]
mov r12, qword [rcx + 0x18]
mov rax, rbx
shl rax, 4
mov r13, qword [r12 + rax]
lea rbp, [rbx + rbx]
add rbp, 1
mov rsi, r13
cmp r13, r14
jne 0x1400705a8
jmp 0x1400705d0
mov rsi, qword [rsi]
cmp r13, r14
je 0x1400705d0
mov rax, qword [r12 + rbp*8]
mov rax, qword [rax]
cmp rax, rsi
je 0x14007065d
cmp qword [rsi + 0x20], r15
jne 0x1400705a0
cmp qword [rsi + 0x28], 0xf
jbe 0x1400705e0
mov rcx, qword [rsi + 0x10]
jmp 0x1400705e4
mov rax, r14
cmp rax, rsi
jne 0x1400705b8
jmp 0x14007065d
lea rcx, [rsi + 0x10]
mov rdx, rdi
mov r8, r15
call fcn.1400cc660
test eax, eax
jne 0x1400705a0
mov rbx, rsi
cmp r13, r14
jne 0x140070608
jmp 0x140070650
mov rbx, qword [rbx]
cmp r13, r14
je 0x140070650
mov rax, qword [r12 + rbp*8]
mov rax, qword [rax]
cmp rax, rbx
je 0x140070658
cmp r15, qword [rbx + 0x20]
jne 0x140070658
cmp qword [rbx + 0x28], 0xf
jbe 0x140070630
mov rdx, qword [rbx + 0x10]
jmp 0x140070634
lea rdx, [rbx + 0x10]
mov rcx, rdi
mov r8, r15
call fcn.1400cc660
test eax, eax
je 0x140070600
jmp 0x140070658
mov rax, r14
cmp rax, rbx
jne 0x140070614
cmp rsi, rbx
jne 0x140070663
mov rsi, r14
mov rbx, r14
mov rax, qword [rsp + 0x20]
mov qword [rax], rsi
mov qword [rax + 8], rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400759b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov r8, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, r8
mov r9, rax
sar r9, 2
test rax, rax
je 0x140075a31
xor r11d, r11d
lea r10, [0x140103710]
mov edx, r9d
nop word cs:[rax + rax]
nop
mov eax, dword [r8 + r11*4]
mov esi, eax
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
mov esi, eax
shr esi, 8
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
mov esi, eax
shr esi, 0x10
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
movzx esi, dl
shr eax, 0x18
xor eax, esi
shr edx, 8
xor edx, dword [r10 + rax*4]
add r11, 1
cmp r11, r9
jb 0x1400759e0
jmp 0x140075a34
mov edx, r9d
cmp edx, dword [rcx + 0x18]
sete al
pop rsi
ret