joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180019a50
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x180019c8e
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x180055040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x180048fd0]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x180019c56
mov rcx, rbp
call fcn.180019130
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x180019b21
movsxd rdx, dword [rbp + 0x31c0]
mov r8, qword [rbp + 0x31c8]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x180019b11
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x180019b09
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x180019b0c
mov rdx, rcx
test rdx, rdx
jne 0x180019ae0
cmp r8, r10
je 0x180019b21
cmp dword [r8], r9d
jne 0x180019b21
mov rcx, qword [r8 + 8]
jmp 0x180019b23
xor ecx, ecx
mov qword [rbx + 0x10], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x40], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x44], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xb8]
and eax, 0xfffffe49
movss dword [rbx + 0x50], xmm1
or eax, 0x49
mov dword [rbx + 0xb8], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
test rcx, rcx
je 0x180019bb7
cmp qword [rcx + 0x18], 0
jne 0x180019bac
mov qword [rcx + 0x18], rbx
jmp 0x180019bb7
cmp qword [rcx + 0x20], 0
jne 0x180019bb7
mov qword [rcx + 0x20], rbx
mov eax, dword [rdi - 0xe]
mov r9, rbx
mov dword [rbx + 0xb0], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x58], eax
mov eax, dword [rdi - 6]
and eax, 0x61fc20
or dword [rbx + 8], eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x180019bec
nop
mov r9, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x180019be0
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, 0x14
lea rcx, [rsp + 0x20]
call fcn.180002890
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x180019c48
cmp r9b, 0x23
jne 0x180019c2b
cmp byte [r8], r9b
jne 0x180019c2b
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x180019c18
not ecx
call fcn.18000a490
mov qword [rbx + 0x80], rax
add rdi, 0x24
sub rsi, 1
jne 0x180019aa0
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180045e90
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x180041cf0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x180055040]
xor rax, rsp
mov qword [rbp + 0x47], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x11], xmm1
mov r8d, 8
lea rdx, str.Dnscache
lea rcx, [rbp - 0x21]
call fcn.180041080
nop
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 0xf
cmova rdx, qword [rbp - 0x21]
mov r8, qword [rbp - 0x11]
add r8, rdx
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 0xf
cmova rdx, qword [rbp - 0x21]
lea rcx, [rbp - 1]
call fcn.180045830
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 7
cmova rdx, qword [rbp - 1]
mov r8d, 4
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x1f], xmm0
movups xmmword [rbp + 0x2f], xmm0
mov dword [rbp + 0x3f], eax
xor esi, esi
mov dword [rbp - 0x29], esi
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 0x24]
lea r8, [rbp + 0x1f]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, dword [rbp + 0x3b]
mov rdx, qword [rbp + 0x17]
cmp rdx, 7
jbe 0x180041e25
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180041e20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180041e20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180046410
movdqa xmm0, xmmword [0x18004d900]
movdqu xmmword [rbp + 0xf], xmm0
mov word [rbp - 1], si
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x180041e74
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180041e6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180041e6f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180046410
mov eax, ebx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180045e90
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1800452d0
Capabilities:
Create thread
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x270
mov rax, qword [0x180055040]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edi, edi
cmp edx, 1
jne 0x1800453d8
xorps xmm0, xmm0
mov qword [rsp + 0x280], rbx
lea r8d, [rdi + 0xf]
mov qword [rsp + 0x40], rdi
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x48], rdi
movups xmmword [rsp + 0x30], xmm0
call fcn.180045980
mov ebx, edi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp qword [rsp + 0x48], 7
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
cmova rdx, qword [rsp + 0x30]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x18004536e
test rbx, rbx
jne 0x180045320
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x280]
cmp rdx, 7
jbe 0x1800453bb
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800453b6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800453b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180046410
mov qword [rsp + 0x28], rdi
lea r8, [0x180043db0]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180045e90
add rsp, 0x270
pop rdi
ret
Function at 0x180045cf0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x180045d51
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x180045d10
mov ecx, dword [r9]
jmp 0x180045e38
cmp ecx, 0x4e0
jb 0x180045e38
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x180045d70
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x180045dc0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140006b40
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x20
call fcn.1400e9430
test rax, rax
je 0x140006b9b
mov r14, rax
mov r15, rdx
mov rcx, rax
call qword [rdx]
mov rdx, qword [r15 + 8]
test rdx, rdx
je 0x140006beb
mov r8, qword [r15 + 0x10]
mov rcx, r14
call fcn.14000e5c0
jmp 0x140006beb
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x70]
lea r8, [0x140151520]
lea rdx, [rsp + 0x40]
mov r9d, 8
call fcn.1400e92d0
movaps xmm0, xmmword [rsp + 0x70]
movaps xmm1, xmmword [rsp + 0x80]
movaps xmm2, xmmword [rsp + 0x90]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x40], rbx
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov edx, 6
mov r8, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400e6e90
Function at 0x140006c20
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140006c62
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x140006c6a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x140006c7b
jmp 0x140006c92
xor r10d, r10d
jmp 0x140006d1d
xor r9d, r9d
xor esi, esi
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140006c92
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140006ca9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140006cc9
add r11, r8
jmp 0x140006dfa
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140006d92
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140006d40
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x140006db0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140006dc2
jmp 0x140006ddc
xor r8d, r8d
xor r9d, r9d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140006ddc
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140006df6
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140011930
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x138
mov rsi, rcx
mov rdi, qword [rdx + 0x40]
mov rbx, qword [rdx + 0x48]
lea r14, [rsp + 0x40]
mov rcx, r14
call fcn.1400d48b0
lea rcx, [rsp + 0xe0]
mov rdx, r14
mov r8, rdi
mov r9, rbx
call fcn.1400d4800
cmp dword [rsp + 0xf8], 2
jne 0x140011981
movzx eax, byte [rsp + 0xe0]
jmp 0x140011ab3
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x90], rax
movups xmm0, xmmword [rsp + 0x120]
movaps xmmword [rsp + 0x80], xmm0
movups xmm0, xmmword [rsp + 0xe0]
movups xmm1, xmmword [rsp + 0xf0]
movups xmm2, xmmword [rsp + 0x100]
movups xmm3, xmmword [rsp + 0x110]
movaps xmmword [rsp + 0x70], xmm3
movaps xmmword [rsp + 0x60], xmm2
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.1400d4aa0
test rax, rax
je 0x140011a97
movzx eax, byte [rsp + 0x40]
movups xmm0, xmmword [rsp + 0x41]
movaps xmmword [rsp + 0x20], xmm0
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x2f], rcx
mov ecx, dword [rsp + 0x58]
movups xmm0, xmmword [rsp + 0x5c]
movaps xmmword [rsp + 0xa0], xmm0
movups xmm0, xmmword [rsp + 0x6c]
movaps xmmword [rsp + 0xb0], xmm0
movups xmm0, xmmword [rsp + 0x7c]
movaps xmmword [rsp + 0xc0], xmm0
movups xmm0, xmmword [rsp + 0x88]
movups xmmword [rsp + 0xcc], xmm0
cmp ecx, 2
je 0x140011ab3
mov rdx, qword [rsp + 0x2f]
mov qword [rsi + 0x10], rdx
movaps xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi + 1], xmm0
movaps xmm0, xmmword [rsp + 0xa0]
movaps xmm1, xmmword [rsp + 0xb0]
movaps xmm2, xmmword [rsp + 0xc0]
movups xmmword [rsi + 0x1c], xmm0
movups xmmword [rsi + 0x2c], xmm1
movups xmmword [rsi + 0x3c], xmm2
movups xmm0, xmmword [rsp + 0xcc]
movups xmmword [rsi + 0x48], xmm0
mov byte [rsi], al
mov dword [rsi + 0x18], ecx
mov dword [rsi + 0xc0], 3
jmp 0x140011b7e
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x140011ab1
mov rcx, qword [rsp + 0x48]
mov r8d, 1
call fcn.14000e5c0
xor eax, eax
mov byte [rsp + 0x20], al
lea rax, [rsp + 0x20]
mov qword [rsp + 0xa0], rax
lea rax, [0x1400dc680]
mov qword [rsp + 0xa8], rax
lea rax, str.failed_to_parse_URL:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rcx, [rsp + 0xe0]
lea rdx, [rsp + 0x40]
call fcn.14011a400
movzx ebx, byte [rsp + 0x20]
mov ecx, 1
mov edx, 1
call fcn.14000e5b0
test rax, rax
je 0x140011b8e
mov byte [rax], bl
movups xmm0, xmmword [rsp + 0xe0]
movups xmm1, xmmword [rsp + 0xf0]
movups xmm2, xmmword [rsp + 0x100]
movups xmmword [rsi + 0x30], xmm2
movups xmmword [rsi + 0x20], xmm1
movups xmmword [rsi + 0x10], xmm0
mov qword [rsi], rax
lea rax, fcn.140001d50
mov qword [rsi + 8], rax
mov dword [rsi + 0x40], 2
mov byte [rsi + 0x80], 0
mov dword [rsi + 0xc0], 2
mov rax, rsi
add rsp, 0x138
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 1
mov edx, 1
call fcn.14014e6d0
ud2
Function at 0x140076370
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x20]
cmp rax, qword [rdx + 0x20]
jne 0x1400763a2
test rax, rax
je 0x1400763a9
lea r8, [rax - 0x21]
cmp r8, 0xffffffffffffffe0
jb 0x1400764b3
cmp rax, 8
jae 0x1400763b0
xor r9d, r9d
xor r8d, r8d
jmp 0x140076490
xor eax, eax
add rsp, 0x28
ret
mov al, 1
add rsp, 0x28
ret
cmp rax, 0x10
jae 0x14007641c
xor r9d, r9d
xor r8d, r8d
mov r10, r8
mov r8, rax
and r8, 0xfffffffffffffff8
movzx r9d, r9b
movd xmm0, r9d
nop
mov r9, qword [rdx + r10]
xor r9, qword [rcx + r10]
movq xmm1, r9
por xmm0, xmm1
add r10, 8
cmp r8, r10
jne 0x1400763d0
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd r9d, xmm1
cmp rax, r8
jne 0x140076490
jmp 0x1400764a8
mov r8, rax
and r8, 0xfffffffffffffff0
movdqu xmm1, xmmword [rcx]
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm1
cmp r8, 0x10
je 0x140076447
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rdx + 0x10]
pxor xmm2, xmm1
por xmm0, xmm2
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movdqa xmm1, xmm0
psrld xmm1, 0x10
por xmm1, xmm0
movdqa xmm0, xmm1
psrlw xmm0, 8
por xmm0, xmm1
movd r9d, xmm0
cmp rax, r8
je 0x1400764a8
test al, 8
jne 0x1400763bc
nop word cs:[rax + rax]
movzx r10d, byte [rdx + r8]
xor r10b, byte [rcx + r8]
lea r11, [r8 + 1]
or r9b, r10b
mov r8, r11
cmp rax, r11
jne 0x140076490
test r9b, r9b
sete al
add rsp, 0x28
ret
lea r8, str..cargo_registry_srcindex.crates.io_6f17d22bba15001f_rustls_0.22.2_srcmsgshandshake.rsRandom
mov ecx, 0x20
mov edx, 0x20
call fcn.14014e920
ud2
Function at 0x140095fa0
Capabilities:
Hash data using sha512

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x238
mov r14, r9
mov r12, r8
mov r13, rdx
mov rsi, rcx
mov rdi, qword [rsp + 0x2b0]
mov rbx, qword [rsp + 0x2a8]
mov r15, qword [rsp + 0x2a0]
movzx ecx, byte [0x14020cc24]
call fcn.1400c1d70
cmp al, 2
jne 0x140096168
xorps xmm0, xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movups xmm0, xmmword [0x14017a890]
movaps xmmword [rsp + 0x100], xmm0
movups xmm0, xmmword [0x14017a8a0]
movaps xmmword [rsp + 0x110], xmm0
movups xmm0, xmmword [0x14017a8b0]
movaps xmmword [rsp + 0x120], xmm0
movups xmm0, xmmword [0x14017a8c0]
movaps xmmword [rsp + 0x130], xmm0
lea rax, [0x14017a890]
mov qword [rsp + 0x140], 0
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], 0
lea rbp, [rsp + 0x80]
mov rcx, rbp
mov rdx, r13
mov r8, r12
call fcn.1400959a0
mov rcx, rbp
mov rdx, r14
mov r8, r15
call fcn.1400959a0
mov rcx, rbp
mov rdx, rbx
mov r8, rdi
call fcn.1400959a0
lea rcx, [rsp + 0x160]
mov r8d, 0xd8
mov rdx, rbp
call fcn.1401497e0
mov rax, qword [rsp + 0x228]
mov r9, qword [rax + 0x50]
movups xmm0, xmmword [rsp + 0x220]
movaps xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [rsp + 0x1e0]
movups xmm1, xmmword [rsp + 0x1f0]
movups xmm2, xmmword [rsp + 0x200]
movups xmm3, xmmword [rsp + 0x210]
movaps xmmword [rsp + 0x60], xmm3
movaps xmmword [rsp + 0x50], xmm2
movaps xmmword [rsp + 0x40], xmm1
movaps xmmword [rsp + 0x30], xmm0
cmp r9, 0x81
jae 0x140096179
mov rax, qword [rsp + 0x230]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x160]
mov rcx, rsi
call fcn.1400956d0
mov rax, rsi
add rsp, 0x238
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x14020cc24]
call fcn.14014c4e0
jmp 0x140095feb
lea r8, [0x14017a6f0]
mov edx, 0x80
mov rcx, r9
call fcn.14014ed40
ud2
Function at 0x140099430
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rdx
mov r12, qword [rsp + 0xb0]
mov rax, qword [rcx]
bswap rax
mov qword [rsp + 0x38], rcx
mov rbx, qword [rcx + 8]
bswap rbx
test r12, r12
je 0x14009956e
mov rdi, r9
shl r12, 4
add r12, r9
mov rcx, qword [rsp + 0x30]
xor rcx, qword [rsp + 0x28]
mov qword [rsp + 0x40], rcx
nop word cs:[rax + rax]
mov r14, qword [rdi]
mov r15, qword [rdi + 8]
bswap r14
xor r14, rax
bswap r15
xor r15, rbx
mov rcx, r15
mov rdx, qword [rsp + 0x30]
call fcn.140099000
mov r13, rax
mov rbx, rdx
mov rcx, r14
mov rdx, qword [rsp + 0x28]
call fcn.140099000
mov rbp, rax
mov rsi, rdx
xor r15, r14
mov rcx, r15
mov rdx, qword [rsp + 0x40]
call fcn.140099000
mov rcx, r13
shl rcx, 0x3f
mov r8, r13
shl r8, 0x3e
xor r8, rcx
mov r9, r13
shl r9, 0x39
xor r9, rax
xor r9, r8
xor rbx, r13
mov rcx, rbx
xor rcx, rbp
xor rcx, r9
mov r8, r13
shr r8, 1
mov rax, rcx
shr rax, 1
mov r9, rcx
mov r11, rcx
shr r11, 2
xor r11, rax
mov r10, rcx
mov rax, rcx
shr rax, 7
xor rax, rsi
xor rax, r11
xor rax, rcx
shl rcx, 0x3f
mov r11, r13
shr r11, 2
xor r11, r8
shl r9, 0x3e
shr r13, 7
shl r10, 0x39
xor r10, r9
xor r13, rdx
xor r13, r11
xor r13, rcx
xor r13, r10
xor rbx, rsi
xor rbx, rbp
xor rbx, r13
add rdi, 0x10
cmp rdi, r12
jne 0x140099490
bswap rax
bswap rbx
mov rcx, rax
shr rcx, 0x10
mov rdx, rax
shr rdx, 0x18
mov r8, rax
shr r8, 0x20
mov r9, rax
shr r9, 0x28
mov r10, rax
shr r10, 0x30
mov r11, rax
shr r11, 0x38
mov rsi, rbx
shr rsi, 0x10
mov rdi, rbx
shr rdi, 0x18
mov r14, rbx
shr r14, 0x20
mov r15, rbx
shr r15, 0x28
mov r12, rbx
shr r12, 0x30
mov r13, rbx
shr r13, 0x38
mov rbp, qword [rsp + 0x38]
mov byte [rbp], al
mov byte [rbp + 1], ah
mov byte [rbp + 2], cl
mov byte [rbp + 3], dl
mov byte [rbp + 4], r8b
mov byte [rbp + 5], r9b
mov byte [rbp + 6], r10b
mov byte [rbp + 7], r11b
mov byte [rbp + 8], bl
mov byte [rbp + 9], bh
mov byte [rbp + 0xa], sil
mov byte [rbp + 0xb], dil
mov byte [rbp + 0xc], r14b
mov byte [rbp + 0xd], r15b
mov byte [rbp + 0xe], r12b
mov byte [rbp + 0xf], r13b
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400a07b0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
mov rcx, rax
call fcn.140025400
mov rcx, rax
mov al, 1
test rdx, rdx
je 0x1400a08de
test rcx, rcx
je 0x1400a08de
movzx r9d, byte [rcx]
mov r8, qword [rsi + 0x10]
movzx r8d, byte [r8]
not r8b
test r9b, r8b
jne 0x1400a08de
mov r10, qword [rsi + 8]
test r10, r10
je 0x1400a08e8
mov r8, qword [rsi]
xor byte [r8], r9b
mov r11d, 1
cmp r10, 1
je 0x1400a08d8
lea rbx, [rdx - 1]
lea rdi, [r10 - 2]
cmp rbx, rdi
mov rsi, rdi
cmovb rsi, rbx
lea r9, [r8 + 1]
inc rsi
cmp rsi, 0x10
jbe 0x1400a08ae
cmp rbx, rdi
cmovb rdi, rbx
lea rbx, [rcx + rdi]
add rbx, 2
cmp r9, rbx
jae 0x1400a0862
add rdi, r8
add rdi, 2
mov rbx, rcx
inc rbx
cmp rbx, rdi
jb 0x1400a08ae
mov r11d, esi
and r11d, 0xf
mov r14d, 0x10
cmovne r14, r11
mov rdi, rsi
sub rdi, r14
lea rbx, [r9 + rdi]
neg r14
lea r11, [rsi + r14]
inc r11
xor esi, esi
nop dword [rax]
movups xmm0, xmmword [rcx + rsi + 1]
movups xmm1, xmmword [r9 + rsi]
xorps xmm1, xmm0
movups xmmword [r9 + rsi], xmm1
add rsi, 0x10
cmp rdi, rsi
jne 0x1400a0890
mov r9, rbx
add r8, r10
nop word cs:[rax + rax]
cmp rdx, r11
je 0x1400a08de
movzx r10d, byte [rcx + r11]
xor byte [r9], r10b
inc r11
inc r9
cmp r9, r8
jne 0x1400a08c0
cmp r11, rdx
setne al
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea r8, str..cargo_registry_srcindex.crates.io_6f17d22bba15001f_ring_0.17.7_src_rsapaddingpss.rs
xor ecx, ecx
xor edx, edx
call fcn.14014e920
ud2