joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14012f0f0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140432240]
mov ecx, dword [0x14042a04c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14012f12b
movzx eax, word [0x140432210]
cmp eax, 9
jne 0x14012f173
mov eax, 1
add rsp, 0x28
ret
lea rcx, [0x140432240]
call fcn.140240e30
cmp dword [0x140432240], 0xffffffff
jne 0x14012f115
xorps xmm0, xmm0
movups xmmword [0x140432230], xmm0
movups xmmword [0x140432220], xmm0
movups xmmword [0x140432210], xmm0
lea rcx, [0x140432210]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x140432240]
call fcn.140240ec8
jmp 0x14012f115
test eax, eax
je 0x14012f126
cmp eax, 6
jne 0x14012f183
mov eax, 2
jmp 0x14012f126
cmp eax, 0xc
jne 0x14012f18f
mov eax, 3
jmp 0x14012f126
mov eax, 4
jmp 0x14012f126
Function at 0x14012faf0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rdi, r9
mov r14, r8
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x68]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
lea rcx, [0x140390808]
lea r9, [0x1403be790]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14012fc79
xor r12d, r12d
lea r13, [rsp + 0x60]
mov qword [r13], r12
mov r15, qword [rsp + 0x68]
movzx eax, byte [r14 + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [r14]
cmovns rax, r14
lea rdx, [rsp + 0x48]
mov qword [rdx], rax
cmovs rcx, qword [r14 + 8]
mov qword [rdx + 8], rcx
lea r14, [rsp + 0x58]
mov rcx, r14
call fcn.140161060
mov rdx, qword [r14]
mov rax, qword [r15]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x40], r13
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x28], 0
mov rcx, r15
xor r8d, r8d
xor r9d, r9d
call qword [case.0x1402bbc90.0]
mov ebp, eax
mov rcx, r14
call fcn.1401610b0
test ebp, ebp
js 0x14012fc85
test bl, bl
je 0x14012fc12
mov rcx, qword [rsp + 0x60]
mov eax, 3
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x14012fc91
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x60], 0
mov rcx, qword [rdi]
mov qword [rdi], rax
test rcx, rcx
jne 0x14012fc9d
mov byte [rsi], 0
mov rcx, qword [rsp + 0x60]
test rcx, rcx
jne 0x14012fcaf
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14012fc58
mov qword [rsp + 0x68], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1402bbc90.0]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140242430
mov rax, rsi
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov byte [rsi], 1
mov dword [rsi + 4], 0
jmp 0x14012fc38
mov byte [rsi], 1
mov dword [rsi + 4], 1
jmp 0x14012fc2e
mov byte [rsi], 1
mov dword [rsi + 4], 2
jmp 0x14012fc2e
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1402bbc90.0]
jmp 0x14012fc2b
mov qword [rsp + 0x60], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1402bbc90.0]
jmp 0x14012fc38
Function at 0x140134120
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov qword [rcx], 0
movabs r14, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x50]
mov qword [rdi + 0x10], r14
movaps xmm0, xmmword [0x1403aa440]
movaps xmmword [rdi], xmm0
lea rdx, str.Global_
mov rcx, rdi
call fcn.14027e510
lea rbx, [0x1403becd0]
mov rcx, rbx
call fcn.140268c14
mov rcx, rdi
mov rdx, rbx
mov r8, rax
call fcn.1400c9200
call fcn.140100680
xor al, 1
lea rbx, [rsp + 0x68]
mov rcx, rbx
mov edx, eax
call fcn.14010a480
movzx r8d, byte [rbx + 0x17]
test r8b, r8b
jns 0x1401341bd
mov r8, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
jmp 0x1401341c1
and r8d, 0x7f
mov rcx, rdi
mov rdx, rbx
call fcn.1400c9200
cmp byte [rsp + 0x7f], 0
jns 0x1401341dd
mov rcx, qword [rsp + 0x68]
call fcn.140240d14
lea rdx, str.ExperimentStorageMutex
mov r8d, 0x16
mov rcx, rdi
call fcn.1400c9200
mov qword [rsp + 0x48], r14
movzx eax, byte [rsp + 0x67]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rsp + 0x50]
cmovns rax, rdi
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
cmovs rcx, qword [rsp + 0x58]
mov qword [rdx + 8], rcx
lea rbx, [rsp + 0x68]
mov rcx, rbx
call fcn.1400ee120
movzx eax, byte [rbx + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [rbx]
cmovns rax, rbx
cmovs rcx, qword [rbx + 8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1404322c0]
mov ecx, dword [0x14042a04c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140134377
mov rdx, qword [0x1404322b8]
lea rcx, [rsp + 0x48]
lea r8, [rsp + 0x38]
call fcn.1401382a0
cmp byte [rsp + 0x7f], 0
jns 0x140134298
mov rcx, qword [rsp + 0x68]
call fcn.140240d14
cmp byte [rsp + 0x67], 0
jns 0x1401342a4
mov rdi, qword [rsp + 0x50]
xor ecx, ecx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
test rax, rax
je 0x140134341
cmp qword [rsi], rdi
je 0x1401342f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14013432b
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1401342e8
mov qword [rsi], rdi
call fcn.1401de850
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsp + 0x48]
call fcn.140138320
cmp byte [rsp + 0x67], 0
jns 0x14013430b
mov rcx, qword [rsp + 0x50]
call fcn.140240d14
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140242430
mov rax, rsi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1401de850
mov rcx, qword [rsi]
call fcn.1401f05b0
mov qword [rsi], 0
jmp 0x1401342d6
lea rdx, str.....chromeinstallerutilexperiment_storage.cc
lea rbx, [rsp + 0x68]
mov rcx, rbx
mov r8d, 0x10b
call fcn.140309100
lea rdx, str.Failed_to_create_ExperimentStorage_mutex
mov rcx, rbx
call fcn.1402cee30
mov rcx, rbx
call fcn.140309130
jmp 0x1401342bd
lea rcx, [0x1404322c0]
call fcn.140240e30
cmp dword [0x1404322c0], 0xffffffff
jne 0x140134271
lea rcx, str.ExperimentStorage_mutex_name
mov edx, 0x100
call fcn.140138280
mov qword [0x1404322b8], rax
lea rcx, [0x1404322c0]
call fcn.140240ec8
jmp 0x140134271
Function at 0x1401343f0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
jne 0x1401344de
cmp qword [rsi], 0
jne 0x1401344de
cmp dword [rsi + 0x14], 0
jne 0x1401344de
cmp qword [rsi + 8], 0
jne 0x1401344de
xor eax, eax
mov r14, qword [rdi]
cmp rax, r14
je 0x140134460
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1401344b0
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140134458
mov qword [rsi], r14
call fcn.1401de850
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rdi + 8]
cmp qword [rsi + 8], r14
je 0x14013449a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x1401344c6
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140134492
mov qword [rsi + 8], r14
call fcn.1401de850
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1401de850
mov rcx, qword [rsi]
call fcn.1401f05b0
mov qword [rsi], 0
jmp 0x140134446
call fcn.1401de850
mov rcx, qword [rsi + 8]
call fcn.1401f05b0
mov qword [rsi + 8], 0
jmp 0x14013447f
mov rcx, rsi
call fcn.140300f40
mov rax, qword [rsi]
jmp 0x14013442a
Function at 0x14013bcb0
Capabilities:
Set thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x50], rax
test rcx, rcx
je 0x14013becc
movabs rax, 0xe69e32f3ad9ea63
cmp qword [0x14041d760], rax
jne 0x14013becf
mov rsi, rcx
mov r14d, dword [rcx + 0xc]
add r14, 0x518
mov byte [rsp + 0x3f], 0xaa
mov dl, byte [rcx + 2]
mov rcx, r14
call fcn.1401e0580
movzx eax, ax
lea r12, [rax + rax*4]
lea r15, [rsi + r12*8]
add r15, 0x48
lea rbx, [rsi + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14013be8e
mov rax, qword [r15]
mov rdi, qword [rax]
test rdi, rdi
je 0x14013be1c
mov byte [rsp + 0x3f], 0
mov rcx, qword [rdi]
test rcx, rcx
je 0x14013be87
lea rdx, [rsi + r12*8]
bswap rcx
mov r14d, dword [rdx + 0x60]
mov rdx, rcx
xor rdx, rdi
cmp rdx, 0x1fffff
ja 0x14013be9b
mov edx, ecx
and edx, 0x1fc000
je 0x14013be9b
prefetcht0 byte [rcx]
mov qword [rax], rcx
mov ecx, dword [rax + 0x18]
lea edx, [rcx + 2]
and edx, 0x3ffe
and ecx, 0xffffc001
or ecx, edx
mov dword [rax + 0x18], ecx
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0x18]
add rax, qword [rsi + 0x1498]
mov qword [rsi + 0x1498], rax
mov rcx, qword [rsi + 0x14a0]
cmp rcx, rax
cmova rax, rcx
mov qword [rsi + 0x14a0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, rdi
mov rdx, rsi
call fcn.14020b3d0
mov ecx, dword [0x140435758]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x14042a04c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x120], rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140242430
mov rax, rdi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, [rsp + 0x3f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x4000
mov rcx, r15
mov rdx, rsi
mov r8d, 2
mov r9, r14
call fcn.14020c3b0
test rax, rax
je 0x14013bed2
mov rdi, rax
mov rcx, rax
and rcx, 0xffffffffffe00000
mov rdx, rax
shr rdx, 9
and edx, 0xfe0
lea rax, [rdx + rcx]
movzx ecx, byte [rdx + rcx + 0x101e]
and ecx, 0x3f
shl rcx, 5
sub rax, rcx
add rax, 0x1000
jmp 0x14013bd97
xor ecx, ecx
jmp 0x14013bd7d
mov rcx, rbx
call fcn.14020c220
jmp 0x14013bd2e
movaps xmm0, xmmword [0x1403aa440]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi], xmm0
mov r8, qword [rdi]
lea rdx, str.first
mov rcx, rsi
call fcn.1402b4490
mov rcx, rsi
call fcn.140098280
mov rcx, r14
call fcn.1402b4500
int3
int3
xor edi, edi
jmp 0x14013bdc1
Function at 0x1401418e0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x30]
lea rdx, [rsi + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0x90]
call qword [case.0x1402bbc90.0]
mov byte [rsi + 0x429], 1
mov rcx, qword [rsi + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
call qword [case.0x1402bbc90.0]
test rax, rax
je 0x14014198d
mov eax, dword [0x1404371a0]
mov ecx, dword [0x14042a04c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140141952
lea rcx, [0x140437190]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.1401eaa10
lea rcx, [0x1404371a0]
call fcn.140240e30
cmp dword [0x1404371a0], 0xffffffff
jne 0x14014193e
xorps xmm0, xmm0
movups xmmword [0x140437190], xmm0
lea rcx, [0x140437190]
xor edx, edx
call fcn.1400eeb90
lea rcx, [0x1404371a0]
call fcn.140240ec8
jmp 0x14014193e
add rsp, 0x20
pop rsi
ret

Function at 0x140143830
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x1404371f0]
cmp rdi, 1
jbe 0x140143859
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1401eaa10
lea rcx, [0x1404371f0]
call fcn.1400e2f80
test al, al
je 0x14014389e
xorps xmm0, xmm0
movups xmmword [0x1404371f8], xmm0
lea rbx, [0x1404371f0]
lea rdi, [0x1404371f8]
mov rcx, rdi
xor edx, edx
call fcn.1400eeb90
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.1400e3040
jmp 0x140143847
mov rdi, qword [0x1404371f0]
jmp 0x140143847

Function at 0x140143ce0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140143cf5
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret

Function at 0x140144870
Capabilities:
Get thread local storage value

Disassembly:
cmp byte [rcx], 0
je 0x14014487d
mov ecx, dword [rcx + 4]
jmp fcn.1401462b0
ret
Function at 0x1401452b0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
test r8b, r8b
jne 0x140145379
lea r8, [rsp + 0x30]
mov rcx, rdx
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1401453e7
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x140145371
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp rbx, 0xffffffffffffffff
je 0x140145375
call fcn.1401de850
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi], 1
mov qword [rsi + 8], 0
cmp rbx, 0xffffffffffffffff
je 0x140145336
test rbx, rbx
je 0x140145359
call fcn.1401de850
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rax, [rbx + 1]
cmp rax, 2
jb 0x140145351
mov qword [rsi + 8], rbx
call fcn.1401de850
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140242430
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
xor ebx, ebx
jmp 0x14014531b
xor ebx, ebx
jmp 0x140145313
lea r8, [rsp + 0x30]
mov rcx, rdx
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1401453e7
lea rdi, [rsp + 0x30]
mov rdx, qword [rdi]
lea rbx, [rsp + 0x28]
mov qword [rbx], 0
mov rcx, rbx
call fcn.1401c8060
mov rcx, qword [rbx]
mov edx, 1
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x1401453ef
mov rax, qword [rsp + 0x28]
inc rax
cmp rax, 2
jb 0x1401452f6
call fcn.1401de850
mov rcx, qword [rsp + 0x28]
call fcn.1401f05b0
jmp 0x1401452f6
mov byte [rsi], 0
jmp 0x140145359
mov byte [rsi], 0
mov rax, qword [rsp + 0x28]
inc rax
cmp rax, 2
jb 0x140145359
call fcn.1401de850
mov rcx, qword [rsp + 0x28]
call fcn.1401f05b0
jmp 0x140145359

Function at 0x1401462b0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov esi, ecx
call fcn.1400ee230
test al, al
jne 0x140146338
call fcn.1400ee1c0
movzx edx, al
mov ecx, esi
call fcn.1400f7a30
mov eax, dword [0x1404372b0]
mov ecx, dword [0x14042a04c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140146307
movsxd rdx, esi
inc rdx
lea rcx, [0x1404372a0]
add rsp, 0x20
pop rsi
jmp fcn.1401eaa10
lea rcx, [0x1404372b0]
call fcn.140240e30
cmp dword [0x1404372b0], 0xffffffff
jne 0x1401462f0
lea rcx, [0x1404372a0]
xor edx, edx
call fcn.1400eeb90
lea rcx, [0x1404372b0]
call fcn.140240ec8
jmp 0x1401462f0
mov edx, 3
jmp 0x1401462c8

Function at 0x140146340
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov esi, ecx
call fcn.1400f7a30
mov eax, dword [0x1404372b0]
mov ecx, dword [0x14042a04c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140146384
movsxd rdx, esi
inc rdx
lea rcx, [0x1404372a0]
add rsp, 0x20
pop rsi
jmp fcn.1401eaa10
lea rcx, [0x1404372b0]
call fcn.140240e30
cmp dword [0x1404372b0], 0xffffffff
jne 0x14014636d
lea rcx, [0x1404372a0]
xor edx, edx
call fcn.1400eeb90
lea rcx, [0x1404372b0]
call fcn.140240ec8
jmp 0x14014636d
Function at 0x1401485f0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
cmp rdx, r9
mov r10, r9
cmovb r10, rdx
xor eax, eax
test r10, r10
je 0x140148661
xor r11d, r11d
mov rdi, qword [r8 + r11*8]
mov rsi, qword [rcx + r11*8]
mov rbx, rsi
xor rbx, rdi
mov r14d, eax
lea rax, [rbx - 1]
mov r15, rsi
sub r15, rdi
xor r15, rsi
or r15, rbx
not rbx
and rax, rbx
sar rax, 0x3f
xor r15, rsi
sar r15, 0x3f
mov rsi, r15
not r15
and r15d, 1
or r15, rsi
mov rsi, rax
and r14d, esi
not rax
and rax, r15
or rax, r14
inc r11
cmp r10, r11
jne 0x14014860b
cmp rdx, r9
jb 0x140148670
ja 0x14014869c
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor ecx, ecx
or rcx, qword [r8 + rdx*8]
inc rdx
cmp r9, rdx
jne 0x140148672
mov rdx, rcx
not rdx
dec rcx
and rcx, rdx
sar rcx, 0x3f
mov rdx, rcx
and edx, eax
not rcx
or ecx, edx
mov eax, ecx
jmp 0x140148668
xor r8d, r8d
or r8, qword [rcx + r9*8]
inc r9
cmp rdx, r9
jne 0x14014869f
mov rcx, r8
not rcx
dec r8
and r8, rcx
sar r8, 0x3f
mov rcx, r8
and ecx, eax
not r8
and r8d, 1
or r8d, ecx
mov eax, r8d
jmp 0x140148668
Function at 0x14014a0d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rdx
movsxd rdx, dword [rdx + 8]
test rdx, rdx
je 0x14014a20a
mov rsi, rcx
mov rax, qword [rdi]
cmp rdx, 2
mov ecx, 1
cmovae rcx, rdx
xor r8d, r8d
xor r9d, r9d
or r9, qword [rax + r8*8]
inc r8
cmp rcx, r8
jne 0x14014a100
test r9, r9
je 0x14014a20a
test edx, edx
jle 0x14014a22f
mov rax, qword [rdi]
test byte [rax], 1
je 0x14014a22f
cmp dword [rdi + 0x10], 0
jne 0x14014a286
lea rbx, [rsi + 0x18]
cmp rbx, rdi
je 0x14014a177
mov rcx, rbx
call fcn.140147cc0
test eax, eax
je 0x14014a24f
movsxd r8, dword [rdi + 8]
test r8, r8
je 0x14014a2a6
shl r8, 3
mov rcx, qword [rbx]
mov rdx, qword [rdi]
call fcn.140243eb0
mov eax, dword [rdi + 8]
mov dword [rsi + 0x20], eax
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x28], eax
mov rdi, rbx
test rdi, rdi
je 0x14014a24f
mov eax, dword [rsi + 0x20]
test eax, eax
jle 0x14014a26f
mov rdx, qword [rbx]
lea rcx, [rax - 1]
cmp qword [rdx + rax*8 - 8], 0
mov rax, rcx
je 0x14014a183
inc ecx
mov dword [rsi + 0x20], ecx
mov rax, qword [rbx]
mov rax, qword [rax]
mov r9d, 1
mov edx, 0x40
xor ecx, ecx
movabs r8, 0x8000000000000000
mov r10d, r9d
and r10d, 1
neg r10
mov r11, rax
and r11, r10
mov rdi, r11
xor rdi, r9
shr rdi, 1
and r11, r9
add r11, rdi
and r10, r8
shr rcx, 1
or rcx, r10
mov r9, r11
dec rdx
jne 0x14014a1bf
mov qword [rsi + 0x30], rcx
mov qword [rsi + 0x38], 0
mov esi, 1
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov dword [rsp + 0x20], 0xa4
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x69
call fcn.1403497b0
jmp 0x14014a200
mov dword [rsp + 0x20], 0xa8
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x68
jmp 0x14014a228
mov dword [rsp + 0x20], 0xb2
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x44
jmp 0x14014a228
mov dword [rsi + 0x20], eax
test eax, eax
jne 0x14014a1a2
mov dword [rsi + 0x28], 0
jmp 0x14014a1a2
mov dword [rsp + 0x20], 0xac
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x6d
jmp 0x14014a228
xor eax, eax
jmp 0x14014a16b
Function at 0x14014acc0
Capabilities:
Hash data using sha256

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov rsi, r8
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x98], rax
xorps xmm0, xmm0
lea rdi, [rsp + 0x50]
movups xmmword [rdi + 0x34], xmm0
movups xmmword [rdi + 0x28], xmm0
movups xmmword [rdi + 0x18], xmm0
movups xmmword [rdi + 8], xmm0
movups xmmword [rdi - 8], xmm0
movaps xmm0, xmmword [0x1403c1ce0]
movups xmmword [rdi - 0x28], xmm0
movaps xmm0, xmmword [0x1403c1cf0]
movups xmmword [rdi - 0x18], xmm0
mov dword [rdi + 0x44], 0x20
test rdx, rdx
je 0x14014ad7e
mov r14, rdx
mov rbx, rcx
lea eax, [rdx*8]
mov rcx, rdx
shr rcx, 0x1d
mov dword [rsp + 0x4c], ecx
mov dword [rsp + 0x48], eax
cmp rdx, 0x40
jb 0x14014ad68
mov r8, r14
shr r8, 6
lea rcx, [rsp + 0x28]
mov rdx, rbx
call fcn.140085680
mov r8, r14
and r8, 0x3f
je 0x14014ad7e
and r14, 0xffffffffffffffc0
add rbx, r14
jmp 0x14014ad6b
mov r8, r14
mov dword [rsp + 0x90], r8d
mov rcx, rdi
mov rdx, rbx
call fcn.140243eb0
mov eax, dword [rsp + 0x90]
lea rcx, [rax + 1]
mov ebx, dword [rsp + 0x94]
mov ebp, dword [rsp + 0x48]
mov r14d, dword [rsp + 0x4c]
mov byte [rsp + rax + 0x50], 0x80
cmp rax, 0x38
jae 0x14014ae48
cmp rcx, 0x38
je 0x14014adc1
mov r8d, 0x38
sub r8, rcx
add rcx, rdi
xor edx, edx
call fcn.140244560
bswap r14d
lea rcx, [rsp + 0x28]
mov dword [rcx + 0x60], r14d
bswap ebp
mov dword [rcx + 0x64], ebp
mov r8d, 1
mov rdx, rdi
call fcn.140085680
xorps xmm0, xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi], xmm0
mov dword [rdi + 0x40], 0
lea eax, [rbx - 0x21]
cmp eax, 0xffffffe3
jb 0x14014ae18
shr rbx, 2
xor eax, eax
mov ecx, dword [rsp + rax*4 + 0x28]
bswap ecx
mov dword [rsi + rax*4], ecx
inc rax
cmp rbx, rax
jne 0x14014ae07
lea rcx, [rsp + 0x28]
mov edx, 0x70
call fcn.140212f90
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140242430
mov rax, rsi
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
cmp eax, 0x3f
je 0x14014ae60
mov r8d, 0x3f
sub r8, rax
add rcx, rdi
xor edx, edx
call fcn.140244560
lea rcx, [rsp + 0x28]
mov r8d, 1
mov rdx, rdi
call fcn.140085680
xor ecx, ecx
jmp 0x14014adae
Function at 0x14014d530
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp r8, 0x30
ja 0x14014d67d
mov r14, r8
mov r15, rdx
mov rsi, rcx
movaps xmm0, xmmword [0x1403aa440]
lea rdi, [rsp + 0x40]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi - 0x10], xmm0
movaps xmmword [rdi - 0x20], xmm0
lea r12, [rsp + 0x30]
lea rbx, [rcx + 0x108]
mov eax, dword [rcx + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rcx + 0x114], eax
mov rax, qword [rcx + 0xf8]
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r8, rsi
call qword [case.0x1402bbc90.0]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, r12
mov r8, rsi
call qword [case.0x1402bbc90.0]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [case.0x1402bbc90.0]
test r14, r14
je 0x14014d613
xor eax, eax
mov cl, byte [r15 + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp r14, rax
jne 0x14014d603
lea r14, [rsi + 0xf8]
mov eax, dword [0x140437374]
lea rcx, [rsp + 0x20]
mov edx, 0x100
mov r8, rsi
bt eax, 0x19
jae 0x14014d681
call fcn.140075160
lea rax, [0x140073c60]
test r14, r14
je 0x14014d64e
lea rcx, [0x140072f00]
mov qword [r14], rcx
mov qword [rsi + 0x100], rax
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
mov esi, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140242430
mov eax, esi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor esi, esi
jmp 0x14014d660
bt eax, 9
jae 0x14014d6a1
call fcn.140076350
lea rax, [0x140076820]
test r14, r14
je 0x14014d64e
lea rcx, [0x140076520]
jmp 0x14014d64b
call fcn.14030ab50
lea rax, [0x14030b350]
test r14, r14
je 0x14014d64e
lea rcx, [0x14030aa10]
jmp 0x14014d64b