joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007d500
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
jne 0x14007d51a
test r8d, r8d
jne 0x14007d513
call fcn.1400aeda0
xor eax, eax
add rsp, 0x28
ret
mov r8d, r8d
add rsp, 0x28
jmp fcn.14007cbf0

Function at 0x14007e400
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rsi, rcx
mov rax, qword [0x140363040]
xor rax, rsp
mov qword [rsp + 0x248], rax
lea rdi, [rsp + 0x40]
mov r8d, 0x200
mov rcx, rdi
mov dl, 0xaa
call fcn.140189d00
lea rbx, [rsp + 0x3c]
mov dword [rbx], 0x100
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
setne al
mov ecx, dword [rbx]
test rcx, rcx
setne bl
and bl, al
je 0x14007e562
movsx r8, byte [rsi + 0x17]
test r8, r8
js 0x14007e53d
mov rdx, rsi
cmp ecx, 0xa
jbe 0x14007e4f2
mov eax, r8d
mov rdx, r8
cmp rdx, rcx
cmova rcx, rdx
mov r9d, 0xa
mov edx, 0xa
cmp rcx, 0xb
jb 0x14007e4ae
mov rdx, rcx
and rdx, 0xfffffffffffffffc
add rdx, 4
or rcx, 3
cmp rcx, 0xb
cmove rcx, rdx
mov rdx, rcx
test r8b, r8b
js 0x14007e56f
cmp rdx, r9
je 0x14007e4c7
mov rcx, rsi
call fcn.14003dde0
mov al, byte [rsi + 0x17]
mov rdx, rsi
test al, al
jns 0x14007e4f2
mov rax, qword [rsi + 0x10]
mov rcx, rax
btr rcx, 0x3f
cmp rcx, 1
je 0x14007e587
shr rax, 0x38
mov rdx, rsi
test al, al
jns 0x14007e4f2
mov rdx, qword [rsi]
mov word [rdx], 0x2e
cmp byte [rsi + 0x17], 0
jns 0x14007e569
mov qword [rsi + 8], 1
mov word [rdx + 2], 0
mov r8d, dword [rsp + 0x3c]
dec r8d
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400f4d70
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.140151210
mov eax, ebx
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rsi + 0x10]
mov rdx, rax
btr rdx, 0x3f
dec rdx
shr rax, 0x38
cmp rdx, rcx
jae 0x14007e4c7
mov rdx, qword [rsi + 8]
jmp 0x14007e47c
call fcn.1401c68f0
jmp 0x14007e520
mov byte [rsi + 0x17], 1
jmp 0x14007e505
mov rax, qword [rsi + 0x10]
mov r9, rax
btr r9, 0x3f
dec r9
shr rax, 0x38
jmp 0x14007e4b7
mov r9, qword [rsi + 8]
mov r8d, 2
sub r8, rcx
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], rdi
mov rcx, rsi
xor edx, edx
call fcn.1400e5ce0
mov qword [rsi + 8], rdi
mov al, byte [rsi + 0x17]
jmp 0x14007e4e8
Function at 0x140085cc0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140363040]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov byte [rcx], 0
mov qword [rcx + 8], 0
movabs r14, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x28
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140085dd0
mov r15, qword [rsp + 0x40]
cmp qword [rsi + 8], r15
je 0x140085d5b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x140085dec
lea rax, [r15 + 1]
cmp rax, 2
jb 0x140085d53
mov qword [rsi + 8], r15
call fcn.140106410
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8, [rsp + 0x38]
mov qword [r8], r14
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140085dc3
lea r8, [rsp + 0x48]
mov dword [r8], 1
mov rax, qword [rsp + 0x38]
mov qword [r8 + 4], rax
mov dword [r8 + 0xc], 2
lea rax, [rsp + 0x34]
mov dword [rax], 0xaaaaaaaa
lea rdx, [rsi + 0x10]
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
xor edx, edx
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x140085dc3
mov byte [rsi], 1
jmp 0x140085dd0
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x140085e07
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140151210
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140106410
mov rcx, qword [rsi + 8]
call fcn.1400f62c0
mov qword [rsi + 8], 0
jmp 0x140085d40
call fcn.140106410
mov rcx, qword [rsi + 8]
call fcn.1400f62c0
mov qword [rsi + 8], 0
jmp 0x140085dd0
Function at 0x14008c0d0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
mov rax, qword [0x140363040]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea r9, [rsp + 0x60]
mov qword [r9], 0
lea rcx, [0x1402d40a0]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x14008c1bc
mov rdx, qword [rsp + 0x60]
lea rdi, [rsp + 0x20]
mov rcx, rdi
call fcn.14002c370
movsx rax, byte [rdi + 0x17]
test rax, rax
jns 0x14008c134
mov rax, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rax
test rax, rax
js 0x14008c1a9
je 0x14008c14a
test rdi, rdi
je 0x14008c1c8
lea rdi, [rsp + 0x48]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140106dd0
mov rcx, rsi
mov rdx, rdi
call fcn.1400716d0
mov rcx, rdi
call fcn.140106f00
cmp byte [rsp + 0x37], 0
jns 0x14008c180
mov rcx, qword [rsp + 0x20]
call fcn.14014fcd8
mov bl, 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14008c192
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140151210
mov eax, ebx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1402ea01c]
lea rdx, str....._third_partylibc_srcinclude_string_view:314:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
call fcn.14018e880
mov rcx, rsi
call fcn.14021c3a0
mov ebx, eax
jmp 0x14008c182
lea rcx, [0x1402ea01c]
lea rdx, str....._third_partylibc_srcinclude_string_view:316:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
call fcn.14018e880
int3
Function at 0x14008c290
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x140363040]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x14008c2b7
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14008c2f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14008c310
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140151210
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.14008c410
mov sil, 1
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140151210
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140106140
test al, al
je 0x14008c3d5
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x265
mov r9d, 2
call fcn.1401c3e40
lea rcx, [rsp + 0x60]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1400e59c0
mov rdi, rax
movsx rax, byte [rsi + 0x17]
test rax, rax
jns 0x14008c373
mov rax, qword [rsi + 8]
mov rsi, qword [rsi]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rax
test rax, rax
js 0x14008c3dc
je 0x14008c389
test rsi, rsi
je 0x14008c3ef
lea rsi, [rsp + 0x38]
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.1400fe610
movsx r8, byte [rsi + 0x17]
test r8, r8
jns 0x14008c3af
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.1400e59c0
cmp byte [rsp + 0x4f], 0
jns 0x14008c3cb
mov rcx, qword [rsp + 0x38]
call fcn.14014fcd8
lea rcx, [rsp + 0x50]
call fcn.1401c3ec0
xor esi, esi
jmp 0x14008c2f4
lea rcx, [0x1402ea01c]
lea rdx, str....._third_partylibc_srcinclude_string_view:314:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
call fcn.14018e880
lea rcx, [0x1402ea01c]
lea rdx, str....._third_partylibc_srcinclude_string_view:316:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
call fcn.14018e880
int3
Function at 0x14008c410
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x140363040]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x14008c437
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14008c4dd
mov dil, 1
test al, 0x10
je 0x14008c469
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140151210
mov eax, edi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140106140
test al, al
je 0x14008c4d6
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x255
mov r9d, 2
call fcn.14006f590
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400e59c0
mov rcx, rax
mov rdx, rsi
call fcn.1401c4e00
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.1400e59c0
mov rcx, rdi
call fcn.14006fb80
xor edi, edi
jmp 0x14008c44d
mov ecx, 2
call fcn.140106140
test al, al
je 0x14008c4d6
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadclientcrash_report_database_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x251
mov r9d, 2
call fcn.1401c3e40
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400e59c0
mov rcx, rax
mov rdx, rsi
call fcn.1401c4e00
mov rcx, rdi
call fcn.1401c3ec0
jmp 0x14008c4d6
Function at 0x14008d910
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x140363040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.14008c5d0
mov rax, qword [rsi]
test rax, rax
je 0x14008d987
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x14008d98e
lea rcx, [rsp + 0x28]
call fcn.14008d090
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140151210
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x14008d960
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 0
jne 0x14008d9b2
cmp byte [rbx + 0x27], 0
js 0x14008d9a7
lea rcx, [rbx + 0x10]
jmp 0x14008d9ab
mov rcx, qword [rbx + 0x10]
call r12
test al, 0x10
je 0x14008d9bd
add rbx, 0x70
cmp rbx, r15
je 0x14008d960
jmp 0x14008d995
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
jae 0x14008d9dc
mov rcx, r14
mov rdx, rbx
call fcn.14021dc50
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x14008d9b2
mov rcx, rdi
mov rdx, rbx
call fcn.14021daf0
mov r14, rax
jmp 0x14008d9d6

Function at 0x14008d9f0
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x140363040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.14008c5d0
mov rax, qword [rsi]
test rax, rax
je 0x14008da67
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x14008da6e
lea rcx, [rsp + 0x28]
call fcn.14008d090
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140151210
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x14008da40
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 2
jne 0x14008da92
cmp byte [rbx + 0x27], 0
js 0x14008da87
lea rcx, [rbx + 0x10]
jmp 0x14008da8b
mov rcx, qword [rbx + 0x10]
call r12
test al, 0x10
je 0x14008da9d
add rbx, 0x70
cmp rbx, r15
je 0x14008da40
jmp 0x14008da75
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
jae 0x14008dabc
mov rcx, r14
mov rdx, rbx
call fcn.14021dc50
add r14, 0x68
mov qword [rdi + 8], r14
jmp 0x14008da92
mov rcx, rdi
mov rdx, rbx
call fcn.14021daf0
mov r14, rax
jmp 0x14008dab6
Function at 0x14008e430
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x140363040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x1403797b8]
mov ecx, dword [0x140374080]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14008e490
lea rsi, [0x1403797b0]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140151210
mov rax, rsi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x1403797b8]
call fcn.14014fd1c
cmp dword [0x1403797b8], 0xffffffff
jne 0x14008e46c
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.140189d00
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.14014fc9c
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x140379800]
mov ecx, dword [0x140374080]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14008e550
lea r8, [0x1403797d0]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.14008e650
mov qword [0x1403797b0], rsi
lea rcx, [0x1403797b8]
call fcn.14014fdd0
jmp 0x14008e46c
lea rcx, [0x140379800]
call fcn.14014fd1c
cmp dword [0x140379800], 0xffffffff
jne 0x14008e521
xorps xmm0, xmm0
movups xmmword [0x1403797f0], xmm0
movups xmmword [0x1403797e0], xmm0
movups xmmword [0x1403797d0], xmm0
lea rcx, [0x1403797d0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x140379800]
call fcn.14014fdd0
jmp 0x14008e521

Function at 0x14008e5a0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140379800]
mov ecx, dword [0x140374080]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14008e5db
movzx eax, word [0x1403797d0]
cmp eax, 9
jne 0x14008e623
mov eax, 1
add rsp, 0x28
ret
lea rcx, [0x140379800]
call fcn.14014fd1c
cmp dword [0x140379800], 0xffffffff
jne 0x14008e5c5
xorps xmm0, xmm0
movups xmmword [0x1403797f0], xmm0
movups xmmword [0x1403797e0], xmm0
movups xmmword [0x1403797d0], xmm0
lea rcx, [0x1403797d0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x140379800]
call fcn.14014fdd0
jmp 0x14008e5c5
test eax, eax
je 0x14008e5d6
cmp eax, 6
jne 0x14008e633
mov eax, 2
jmp 0x14008e5d6
cmp eax, 0xc
jne 0x14008e63f
mov eax, 3
jmp 0x14008e5d6
mov eax, 4
jmp 0x14008e5d6
Function at 0x14008f020
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rdi, r9
mov r14, r8
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x140363040]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x68]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x1402d40c0]
lea r9, [0x140306a30]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14008f1d6
mov qword [rsp + 0x60], 0
movsx rax, byte [r14 + 0x17]
test rax, rax
jns 0x14008f095
mov rax, qword [r14 + 8]
mov r14, qword [r14]
mov r15, qword [rsp + 0x68]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], rax
test rax, rax
js 0x14008f1e2
je 0x14008f0b8
test r14, r14
je 0x14008f222
lea r14, [rsp + 0x58]
lea rdx, [rsp + 0x48]
mov rcx, r14
call fcn.1400b5990
mov rdx, qword [r14]
mov rax, qword [r15]
mov rax, qword [rax + 0x18]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x40], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, r15
xor r8d, r8d
xor r9d, r9d
call qword [0x140352210]
mov ebp, eax
mov rcx, r14
call fcn.1400b59e0
test ebp, ebp
js 0x14008f1c4
test bl, bl
je 0x14008f154
mov rcx, qword [rsp + 0x60]
mov eax, 3
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x14008f1cc
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x60], 0
mov rcx, qword [rdi]
mov qword [rdi], rax
test rcx, rcx
jne 0x14008f1f5
mov byte [rsi], 0
xor eax, eax
mov byte [rsi + 4], al
mov rcx, qword [rsp + 0x60]
test rcx, rcx
jne 0x14008f207
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14008f1a7
mov qword [rsp + 0x68], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140352210]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140151210
mov rax, rsi
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov dword [rsi], 1
jmp 0x14008f1d2
mov dword [rsi], 2
mov al, 1
jmp 0x14008f176
mov dword [rsi], 0
mov byte [rsi + 4], 1
jmp 0x14008f187
lea rcx, [0x1402ea01c]
lea rdx, str....._third_partylibc_srcinclude_string_view:314:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
call fcn.14018e880
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140352210]
jmp 0x14008f171
mov qword [rsp + 0x60], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140352210]
jmp 0x14008f187
lea rcx, [0x1402ea01c]
lea rdx, str....._third_partylibc_srcinclude_string_view:316:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
call fcn.14018e880
int3
Function at 0x140092090
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
cmp rdx, r9
mov r10, r9
cmovb r10, rdx
xor eax, eax
test r10, r10
je 0x1400920ef
xor r11d, r11d
mov rsi, qword [r8 + r11*8]
mov rdi, qword [rcx + r11*8]
mov rbx, rdi
xor rbx, rsi
lea r14, [rbx - 1]
mov r15, rdi
sub r15, rsi
xor r15, rdi
or r15, rbx
not rbx
and r14, rbx
sar r14, 0x3f
xor r15, rdi
sar r15, 0x3f
or r15, 1
xor rax, r15
and rax, r14
xor rax, r15
inc r11
cmp r10, r11
jne 0x1400920ab
cmp rdx, r9
jb 0x1400920fe
ja 0x140092122
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor ecx, ecx
or rcx, qword [r8 + rdx*8]
inc rdx
cmp r9, rdx
jne 0x140092100
mov rdx, rcx
not rdx
dec rcx
and rcx, rdx
sar rcx, 0x3f
not ecx
or eax, ecx
jmp 0x1400920f6
xor r8d, r8d
or r8, qword [rcx + r9*8]
inc r9
cmp rdx, r9
jne 0x140092125
mov rcx, r8
not rcx
dec r8
and r8, rcx
sar r8, 0x3f
xor eax, 1
and eax, r8d
xor eax, 1
jmp 0x1400920f6
Function at 0x140093b80
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rdx
movsxd rdx, dword [rdx + 8]
test rdx, rdx
je 0x140093cc0
mov rsi, rcx
mov rax, qword [rdi]
xor ecx, ecx
xor r8d, r8d
or r8, qword [rax + rcx*8]
inc rcx
cmp rdx, rcx
jne 0x140093ba2
test r8, r8
je 0x140093cc0
test edx, edx
jle 0x140093d07
mov rax, qword [rdi]
test byte [rax], 1
je 0x140093d07
cmp dword [rdi + 0x10], 0
jne 0x140093d87
cmp edx, 0x401
jae 0x140093d47
lea rbx, [rsi + 0x18]
cmp rbx, rdi
je 0x140093c25
mov rcx, rbx
call fcn.140091d40
test eax, eax
je 0x140093d27
movsxd r8, dword [rdi + 8]
test r8, r8
je 0x140093cf8
shl r8, 3
mov rcx, qword [rbx]
mov rdx, qword [rdi]
call fcn.140189660
mov eax, dword [rdi + 8]
mov dword [rsi + 0x20], eax
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x28], eax
mov rdi, rbx
test rdi, rdi
je 0x140093d27
mov eax, dword [rsi + 0x20]
test eax, eax
jle 0x140093cff
mov rcx, qword [rbx]
mov edx, eax
cmp qword [rcx + rdx*8 - 8], 0
jne 0x140093c55
lea edx, [rax - 1]
cmp eax, 1
mov eax, edx
jg 0x140093c3c
jmp 0x140093ce5
mov dword [rsi + 0x20], eax
mov rax, qword [rbx]
mov rax, qword [rax]
mov r9d, 1
mov edx, 0x40
xor ecx, ecx
movabs r8, 0x8000000000000000
mov r10d, r9d
and r10d, 1
neg r10
mov r11, rax
and r11, r10
mov rdi, r11
xor rdi, r9
shr rdi, 1
and r11, r9
add r11, rdi
and r10, r8
shr rcx, 1
or rcx, r10
mov r9, r11
dec rdx
jne 0x140093c75
mov qword [rsi + 0x30], rcx
mov qword [rsi + 0x38], 0
mov esi, 1
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov dword [rsp + 0x20], 0xaa
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x69
call fcn.1402657b0
jmp 0x140093cb6
mov dword [rsi + 0x20], 0
mov dword [rsi + 0x28], 0
jmp 0x140093c58
xor eax, eax
jmp 0x140093c19
jne 0x140093c58
jmp 0x140093cec
mov dword [rsp + 0x20], 0xae
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x68
jmp 0x140093cde
mov dword [rsp + 0x20], ILCreateFromPathW
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x44
jmp 0x140093cde
mov r8d, 0x400
xor ecx, ecx
or rcx, qword [rax + r8*8]
inc r8
cmp rdx, r8
jne 0x140093d4f
test rcx, rcx
je 0x140093be1
mov dword [rsp + 0x20], 0xb6
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x66
jmp 0x140093cde
mov dword [rsp + 0x20], 0xb2
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x6d
jmp 0x140093cde
Function at 0x1400940f0
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r15, rcx
mov r13, qword [rsp + 0xb0]
mov rax, qword [0x140363040]
xor rax, rsp
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
xor r14d, r14d
test r13, r13
je 0x140094160
mov ecx, dword [r13 + 0x2c]
call fcn.140115b60
test rax, rax
je 0x140094241
mov r12, rax
xor ecx, ecx
call fcn.140115bc0
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
mov r14, r12
mov rax, qword [r13 + 0x10]
lea rcx, [0x140235b20]
cmp rax, rcx
jne 0x140094231
xorps xmm0, xmm0
movups xmmword [r14 + 0x5c], xmm0
movups xmmword [r14 + 0x50], xmm0
movups xmmword [r14 + 0x40], xmm0
movups xmmword [r14 + 0x30], xmm0
movups xmmword [r14 + 0x20], xmm0
movaps xmm0, xmmword [0x140309b60]
movups xmmword [r14], xmm0
movaps xmm0, xmmword [0x140309b70]
movups xmmword [r14 + 0x10], xmm0
mov dword [r14 + 0x6c], 0x20
lea r14, [rsp + 0x20]
mov rax, qword [r14]
mov rax, qword [rax + 0x18]
mov rcx, r14
mov rdx, r15
mov r8, rbx
call qword [0x140352210]
mov rax, qword [r14]
mov rax, qword [rax + 0x20]
mov rcx, r14
mov rdx, rdi
call qword [0x140352210]
mov rax, qword [r14]
test rsi, rsi
je 0x1400941ea
mov ecx, dword [rax + 4]
mov dword [rsi], ecx
mov edx, dword [rax + 0x2c]
mov rcx, qword [rsp + 0x28]
call fcn.140115c00
mov r14d, 1
mov rcx, qword [rsp + 0x28]
call fcn.140115bc0
mov rax, qword [rsp + 0x38]
test rax, rax
jne 0x140094245
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140151210
mov eax, r14d
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x20]
call qword [0x140352210]
jmp 0x1400941af
xor ecx, ecx
jmp 0x140094202
mov rax, qword [rax]
mov rcx, qword [rsp + 0x30]
call qword [0x140352210]
jmp 0x140094211

Function at 0x140094400
Capabilities:
Hash data using sha256

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
cmp qword [rcx], rdx
je 0x140094432
mov ecx, dword [rdi + 0x2c]
call fcn.140115b60
test rax, rax
je 0x140094491
mov rbx, rax
mov rcx, qword [rsi + 8]
call fcn.140115bc0
mov qword [rsi + 8], rbx
mov qword [rsi], rdi
mov rax, qword [rdi + 0x10]
lea rcx, [0x140235b20]
cmp rax, rcx
jne 0x140094486
mov rax, qword [rsi + 8]
xorps xmm0, xmm0
movups xmmword [rax + 0x5c], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x140309b60]
movups xmmword [rax], xmm0
movaps xmm0, xmmword [0x140309b70]
movups xmmword [rax + 0x10], xmm0
mov dword [rax + 0x6c], 0x20
mov eax, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
call qword [0x140352210]
jmp 0x140094479
xor eax, eax
jmp 0x14009447e