joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140203220
Capabilities:
Create service

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1d8
mov r15, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rax, qword [rdx + 0x28]
xor esi, esi
cmp rax, qword [rdx + 0x30]
cmovne rsi, rax
cmp byte [rdx + 0x27], 0
jns 0x140203262
mov r14, qword [rdx + 0x10]
jmp 0x140203266
lea r14, [rdx + 0x10]
cmp byte [rdx + 0x57], 0
jns 0x140203272
mov r12, qword [rdx + 0x40]
jmp 0x140203276
lea r12, [rdx + 0x40]
mov edi, dword [rdx + 0xc]
mov r13d, dword [rdx + 4]
mov ebp, dword [rdx + 8]
lea rbx, [rsp + 0x88]
mov rcx, r15
mov rdx, rbx
call fcn.140201ea0
cmp byte [rbx + 0x17], 0
jns 0x1402032a1
mov rbx, qword [rsp + 0x88]
mov rcx, qword [r15 + 0x118]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x50], rsi
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r13d
mov rdx, rbx
mov r8, r12
mov r9d, 0x10003
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
lea rcx, [rsp + 0x1c8]
mov qword [rcx], 0
mov rdx, rax
call fcn.140201c30
cmp byte [rsp + 0x9f], 0
jns 0x14020330c
mov rcx, qword [rsp + 0x88]
call fcn.1401b9ce8
mov rdi, qword [rsp + 0x1c8]
test rdi, rdi
jne 0x140203371
mov ecx, 1
call fcn.140160660
test al, al
jne 0x140203396
cmp qword [rsp + 0x1c8], 0
je 0x140203345
call fcn.140160650
mov rcx, qword [rsp + 0x1c8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
setne bl
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1401bb0d0
mov eax, ebx
add rsp, 0x1d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add r15, 0x120
mov qword [rsp + 0x1c8], 0
call fcn.140160650
mov rcx, r15
mov rdx, rdi
call fcn.140201c30
jmp 0x140203327
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstallerutilinstall_service_work_item_impl.cc
lea rcx, [rsp + 0x88]
mov r8d, 0x299
mov r9d, 1
call fcn.140224610
lea rcx, [rsp + 0x98]
lea rdx, str.Failed_to_create_service
mov r8d, 0x19
call fcn.1401f9cc0
mov r14, rax
lea rbx, [rsp + 0x70]
mov rcx, r15
mov rdx, rbx
call fcn.140201ea0
cmp byte [rbx + 0x17], 0
jns 0x1402033f7
mov rbx, qword [rsp + 0x70]
mov rcx, r14
mov rdx, rbx
call fcn.140224750
cmp byte [rsp + 0x87], 0
jns 0x140203416
mov rcx, qword [rsp + 0x70]
call fcn.1401b9ce8
lea rcx, [rsp + 0x88]
call fcn.140224690
jmp 0x140203327
Function at 0x14020b660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x14020b790
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x60], 0
je 0x14020b7ee
mov edi, dword [rsi + 0x5c]
test r15b, r15b
je 0x14020b7ce
mov dword [rsi + 0x5c], 0xffffffff
mov byte [rsi + 0x60], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401bb0d0
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
cmp eax, 2
mov edi, 1
cmovge edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.1401dca2c
cmp eax, 0xffffffff
je 0x14020b86c
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x14020b80d
mov byte [rsp + 0x57], 0xaa
cmp byte [rsi + 0x61], 0
je 0x14020b876
mov al, byte [rsp + 0x58]
mov byte [rsp + 0x57], al
test r15b, r15b
je 0x14020b849
movzx edi, byte [rsp + 0x57]
mov dword [rsi + 0x5c], edi
jmp 0x14020b7ce
mov edi, edi
test rdi, rdi
jle 0x14020b928
mov rdx, qword [rsi + 0x40]
dec rdi
mov eax, edi
movzx ecx, byte [rsp + rax + 0x58]
call fcn.1401e3ae4
cmp eax, 0xffffffff
jne 0x14020b84b
mov edi, 0xffffffff
jmp 0x14020b7ce
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea r12, [rsp + 0x40]
mov qword [r12], r14
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r14d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], r12
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x57]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x58]
call qword [0x1403de008]
cmp eax, 1
jne 0x14020b911
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r14w
cmp edi, 8
je 0x14020b86c
mov rcx, qword [rsi + 0x40]
call fcn.1401dca2c
cmp eax, 0xffffffff
je 0x14020b86c
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x14020b887
cmp eax, 2
je 0x14020b86c
cmp eax, 3
je 0x14020b832
jmp 0x14020b83a
movzx edi, byte [rsp + 0x57]
jmp 0x14020b7ce
Function at 0x14020bc60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x14020bd90
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x5e], 0
je 0x14020bdee
movzx edi, word [rsi + 0x5c]
test r15b, r15b
je 0x14020bdce
mov word [rsi + 0x5c], 0xffff
mov byte [rsi + 0x5e], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401bb0d0
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
cmp eax, 2
mov edi, 1
cmovge edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.1401dca2c
cmp eax, 0xffffffff
je 0x14020be74
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x14020be0d
mov word [rsp + 0x56], 0xaaaa
cmp byte [rsi + 0x5f], 0
je 0x14020be7d
movsx eax, byte [rsp + 0x58]
mov word [rsp + 0x56], ax
test r15b, r15b
je 0x14020be4e
movzx edi, word [rsp + 0x56]
mov word [rsi + 0x5c], di
jmp 0x14020bdce
mov edi, edi
test rdi, rdi
jle 0x14020bf2f
mov rdx, qword [rsi + 0x40]
dec rdi
mov eax, edi
movsx eax, byte [rsp + rax + 0x58]
movzx ecx, ax
call fcn.1401e3ae4
cmp eax, 0xffffffff
jne 0x14020be50
mov di, 0xffff
jmp 0x14020bdce
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea r12, [rsp + 0x40]
mov qword [r12], r14
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r14d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], r12
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x56]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x58]
call qword [0x1403de008]
cmp eax, 1
jne 0x14020bf18
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r14w
cmp edi, 8
je 0x14020be74
mov rcx, qword [rsi + 0x40]
call fcn.1401dca2c
cmp eax, 0xffffffff
je 0x14020be74
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x14020be8e
cmp eax, 2
je 0x14020be74
cmp eax, 3
je 0x14020be34
jmp 0x14020be3e
movzx edi, word [rsp + 0x56]
jmp 0x14020bdce

Function at 0x14020c2a0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x14020c2d7
movabs r9, 0xf000000000000000
shl rax, 4
movsx r10, byte [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
inc rdx
cmp rdx, r8
jne 0x14020c2b1
ret

Function at 0x14020c320
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x14020c358
movabs r9, 0xf000000000000000
shl rax, 4
movzx r10d, word [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
add rdx, 2
cmp rdx, r8
jne 0x14020c331
ret
Function at 0x140212bb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov r12, r8
mov r14, rdx
mov bl, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x140212c10
movzx edx, word [rbp + 0x60]
movzx ebx, bl
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], ebx
mov word [rsp + 0x20], dx
mov rdx, r14
mov r8, r12
call qword [0x1403de008]
mov rax, r14
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea rsi, [rbp - 0x20]
mov rcx, r9
mov rdx, rsi
call fcn.14015b5c0
lea rdx, [0x1403b3b60]
mov rcx, rsi
call fcn.14015b850
mov rsi, rax
mov rcx, qword [rbp - 0x20]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x140212c50
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1403de008]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rbp - 0x20]
mov qword [r15 + 0x10], rax
movaps xmm0, xmmword [0x14032f5c0]
movaps xmmword [r15], xmm0
mov rax, qword [rsi]
xor bl, 1
movzx ecx, bl
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, rsi
mov rdx, r15
call qword [0x1403de008]
movzx eax, byte [r15 + 0x17]
mov ebx, eax
and ebx, 0x7f
test al, al
mov rcx, qword [r15]
mov rsi, qword [r15 + 8]
cmovs rbx, rsi
test rbx, rbx
je 0x140212d21
test al, al
mov rbx, r15
cmovs rbx, rcx
test r12, r12
je 0x140212d04
movzx eax, word [rbx]
mov rcx, qword [r12 + 0x30]
cmp rcx, qword [r12 + 0x38]
je 0x140212d09
lea rdx, [rcx + 2]
mov qword [r12 + 0x30], rdx
mov word [rcx], ax
cmp ax, 0xffff
jne 0x140212cd5
xor r12d, r12d
mov al, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov rsi, qword [rbp - 0x18]
add rbx, 2
mov edx, eax
and dl, 0x7f
test al, al
mov rdi, r15
cmovs rdi, rcx
movzx edx, dl
cmovs rdx, rsi
lea rdx, [rdi + rdx*2]
cmp rbx, rdx
jne 0x140212cac
jmp 0x140212d21
xor r12d, r12d
jmp 0x140212ce0
mov rcx, qword [r12]
mov rsi, qword [rcx + 0x60]
mov rcx, r12
mov edx, eax
mov rax, rsi
call qword [0x1403de008]
jmp 0x140212ccc
shr al, 7
mov qword [r14], r12
test al, al
je 0x140212bfe
call fcn.1401b9ce8
jmp 0x140212bfe

Function at 0x140221f70
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.1401b9cac
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140221fe0]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.1401cd234
mov qword [rbx], rax
test rax, rax
je 0x140221fc7
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x140223690
Capabilities:
Move file

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.14015ff00
test al, al
jne 0x1402236b1
mov rcx, rsi
call fcn.14015ff00
test al, al
je 0x1402236ba
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x14022a470
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov r14, rdx
mov rdi, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x50], rax
movaps xmm0, xmmword [0x14032f5c0]
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
lea rdx, str.MoveUnsafe
lea r8, str....._base_files_file_util_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r9d, 0x430
call fcn.140160630
xor ebx, ebx
mov rcx, rbp
mov rdx, rsi
xor r8d, r8d
call fcn.14016ac30
mov al, byte [rdi + 0x17]
test al, al
jns 0x14022a52f
cmp qword [rdi + 8], 0x103
jbe 0x14022a52f
lea rcx, [rsp + 0x40]
call fcn.14016ac90
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401bb0d0
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov cl, byte [r14 + 0x17]
test cl, cl
jns 0x14022a545
cmp qword [r14 + 8], 0x103
jbe 0x14022a545
xor ebx, ebx
jmp 0x14022a505
mov rdx, r14
test cl, cl
jns 0x14022a54f
mov rdx, qword [r14]
mov rcx, rdi
test al, al
jns 0x14022a559
mov rcx, qword [rdi]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov bl, 1
test eax, eax
jne 0x14022a505
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, rdi
call fcn.1400815f0
test al, al
jne 0x14022a589
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14022a541
mov rcx, rdi
mov rdx, r14
call fcn.14022a5a0
test al, al
jne 0x14022a505
jmp 0x14022a57f
Function at 0x1402311e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
movsxd r9, dword [rcx + 8]
movsxd r10, dword [rdx + 8]
cmp r9d, r10d
jge 0x140231205
mov r11, qword [rdx]
xor r8d, r8d
mov rax, r9
or r8, qword [r11 + rax*8]
inc rax
cmp r10, rax
jne 0x1402311f7
jmp 0x140231208
xor r8d, r8d
cmp r10d, r9d
jge 0x14023121f
mov r11, qword [rcx]
mov rax, r10
or r8, qword [r11 + rax*8]
inc rax
cmp r9, rax
jne 0x140231213
cmp r9d, r10d
cmovl r10d, r9d
test r10d, r10d
jle 0x140231249
mov r9, qword [rcx]
mov r11, qword [rdx]
mov r10d, r10d
xor eax, eax
mov rsi, qword [r11 + rax*8]
xor rsi, qword [r9 + rax*8]
or r8, rsi
inc rax
cmp r10, rax
jne 0x140231236
mov eax, dword [rdx + 0x10]
xor eax, dword [rcx + 0x10]
movsxd rcx, eax
xor eax, eax
or rcx, r8
sete al
pop rsi
ret

Function at 0x140238a40
Capabilities:
Hash data using sha512

Disassembly:
push rsi
push rdi
sub rsp, 0x108
mov rsi, r8
mov r8, rdx
mov rdx, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x100], rax
movaps xmm0, xmmword [0x14032f5c0]
lea rdi, [rsp + 0x28]
movups xmmword [rdi + 0xc0], xmm0
movups xmmword [rdi + 0xb0], xmm0
movups xmmword [rdi + 0xa0], xmm0
movups xmmword [rdi + 0x90], xmm0
movups xmmword [rdi + 0x80], xmm0
movups xmmword [rdi + 0x70], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x50], xmm0
movabs rax, 0x6a09e667f3bcc908
mov qword [rdi], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rdi + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rdi + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rdi + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rdi + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rdi + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rdi + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rdi + 0x38], rax
movabs rax, 0x4000000000
mov qword [rdi + 0xd0], rax
xorps xmm0, xmm0
movups xmmword [rdi + 0x40], xmm0
mov rcx, rdi
call fcn.140094ee0
mov rcx, rsi
mov rdx, rdi
call fcn.140098a80
mov edx, 0xd8
mov rcx, rdi
call fcn.14018afb0
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1401bb0d0
mov rax, rsi
add rsp, 0x108
pop rdi
pop rsi
ret
Function at 0x1402395d0
Capabilities:
Hash data using sha512

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1c8
movaps xmmword [rsp + 0x1b0], xmm6
mov rsi, rdx
mov r12, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
mov rax, qword [r8 + 0x28]
test rax, rax
je 0x140239636
cmp qword [rax + 0x28], 0
je 0x140239636
mov dword [rsp + 0x20], 0x136
lea r9, str....._third_party_boringssl_srccrypto_fipsmoduleecdsaecdsa.c
xor edi, edi
mov ecx, 0x1a
xor edx, edx
mov r8d, 0x67
jmp 0x140239812
mov r14, qword [r8]
test r14, r14
je 0x1402397f4
mov r15, qword [r8 + 0x10]
test r15, r15
je 0x1402397f4
add r15, 0x18
movaps xmm6, xmmword [0x14032f5c0]
lea rdi, [rsp + 0xd0]
movups xmmword [rdi + 0xc0], xmm6
movups xmmword [rdi + 0xb0], xmm6
movups xmmword [rdi + 0xa0], xmm6
movups xmmword [rdi + 0x90], xmm6
movups xmmword [rdi + 0x80], xmm6
movups xmmword [rdi + 0x70], xmm6
movups xmmword [rdi + 0x60], xmm6
movups xmmword [rdi + 0x50], xmm6
lea rbx, [rsp + 0x90]
movaps xmmword [rbx + 0x30], xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
movabs rax, 0x6a09e667f3bcc908
mov qword [rdi], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rdi + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rdi + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rdi + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rdi + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rdi + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rdi + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rdi + 0x38], rax
mov dword [rdi + 0xd0], 0
xorps xmm0, xmm0
movups xmmword [rdi + 0x40], xmm0
mov dword [rdi + 0xd4], 0x40
movsxd r8, dword [r14 + 0x18]
shl r8, 3
mov rcx, rdi
mov rdx, r15
call fcn.140094ee0
mov rcx, rdi
mov rdx, r12
mov qword [rsp + 0x30], rsi
mov r8, rsi
call fcn.140094ee0
mov rcx, rbx
mov rdx, rdi
call fcn.140098a80
movabs r13, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
lea rdi, [rsp + 0x3c]
mov qword [rsp + 0x80], r13
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movsxd r9, dword [r14 + 0x18]
mov r8, qword [r14 + 0x10]
mov qword [rsp + 0x20], rbx
mov edx, 1
mov rcx, rsi
call fcn.1402378b0
test eax, eax
je 0x140239846
mov r9, rsi
mov dword [rsp + 0x3c], 0xaaaaaaaa
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov rcx, r14
mov rbp, rdi
mov rdx, rdi
mov r8, r15
call fcn.140239280
mov rdi, rax
test rax, rax
jne 0x140239817
cmp dword [rsp + 0x3c], 0
je 0x140239817
mov rdi, rbp
jmp 0x140239777
mov dword [rsp + 0x20], 0x13c
lea r9, str....._third_party_boringssl_srccrypto_fipsmoduleecdsaecdsa.c
xor edi, edi
mov ecx, 0x1a
xor edx, edx
mov r8d, 0x43
call fcn.140299620
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1401bb0d0
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x1b0]
add rsp, 0x1c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor edi, edi
jmp 0x140239817
Function at 0x14023ec10
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rsi, r9
mov r12, r8
mov rdi, rdx
mov r14, rcx
mov r15, qword [rsp + 0x108]
mov rax, qword [rsp + 0x100]
mov rcx, qword [0x1403a0028]
xor rcx, rsp
mov qword [rsp + 0x80], rcx
test rax, rax
jne 0x14023ec70
lea rcx, [0x1403b5080]
lea rdx, [0x140238650]
call fcn.14018b320
lea rax, [0x1403b5088]
test r15, r15
cmove r15, rax
mov ebx, dword [rax + 4]
lea rcx, [rbx + rbx]
add rcx, 2
cmp rcx, rdi
jbe 0x14023ecd2
mov dword [rsp + 0x20], 0x147
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_rsapadding.c
xor r13d, r13d
mov ecx, 4
xor edx, edx
mov r8d, 0x7e
call fcn.140299620
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401bb0d0
mov eax, r13d
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rbx + rbx]
mov rbp, rcx
not rbp
lea rdx, [rdi + rbp]
dec rdx
cmp rdx, rsi
jae 0x14023ed09
mov dword [rsp + 0x20], 0x14d
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_rsapadding.c
xor r13d, r13d
mov ecx, 4
xor edx, edx
mov r8d, 0x72
jmp 0x14023eca6
dec rdi
or rcx, 1
cmp rdi, rcx
jae 0x14023ed22
mov dword [rsp + 0x20], 0x152
jmp 0x14023ec8f
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xf0]
mov byte [r14], 0
lea r8, [r14 + rbx]
inc r8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
xor r13d, r13d
mov qword [rsp + 0x30], r8
xor r9d, r9d
call fcn.140094780
test eax, eax
je 0x14023ee7b
mov qword [rsp + 0x38], r12
mov r12, rdi
sub r12, rsi
add rbp, r12
mov rcx, qword [rsp + 0x30]
je 0x14023ed90
mov rax, qword [rsp + 0x30]
lea rcx, [rax + rbx]
xor edx, edx
mov r8, rbp
call fcn.1401bd200
mov rcx, qword [rsp + 0x30]
inc r14
mov rax, rbx
not rax
add r12, rax
mov byte [rcx + r12], 1
test rsi, rsi
mov rbp, rcx
je 0x14023edc0
lea rcx, [rdi + rbp]
sub rcx, rsi
sub rcx, rbx
mov rdx, qword [rsp + 0x38]
mov r8, rsi
call fcn.1401bcb50
lea r8, [0x14033b900]
mov rcx, r14
mov rdx, rbx
call fcn.140173360
mov rsi, rdi
sub rsi, rbx
mov rcx, rsi
call fcn.14018af30
test rax, rax
je 0x14023ee8b
mov r12, rax
mov qword [rsp + 0x20], r15
mov rcx, rax
mov rdx, rsi
mov r8, r14
mov r9, rbx
call fcn.1400976c0
test eax, eax
je 0x14023ee7e
cmp rdi, rbx
je 0x14023ee2a
cmp rsi, 2
mov eax, 1
cmovae rax, rsi
xor ecx, ecx
mov dl, byte [r12 + rcx]
xor byte [rbp + rcx], dl
inc rcx
cmp rax, rcx
jne 0x14023ee1a
movaps xmm0, xmmword [0x14032f5c0]
lea rcx, [rsp + 0x40]
movaps xmmword [rcx + 0x30], xmm0
movaps xmmword [rcx + 0x20], xmm0
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
mov qword [rsp + 0x20], r15
mov rdx, rbx
mov r8, rbp
mov r9, rsi
call fcn.1400976c0
test eax, eax
je 0x14023ee7e
mov r13d, 1
test rbx, rbx
je 0x14023ee7e
xor eax, eax
mov cl, byte [rsp + rax + 0x40]
xor byte [r14 + rax], cl
inc rax
cmp rbx, rax
jne 0x14023ee69
jmp 0x14023ee7e
xor r12d, r12d
mov rcx, r12
call fcn.14018af70
jmp 0x14023ecab
mov dword [rsp + 0x20], 0x169
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_rsapadding.c
xor r12d, r12d
mov ecx, 4
xor edx, edx
mov r8d, 0x41
call fcn.140299620
xor r13d, r13d
jmp 0x14023ee7e
Function at 0x1402d4dd0
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x1402d4deb
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.1400f0810
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x1402d4e99
mov rbx, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x1402d4e99
mov qword [rsp + 0x20], 0
mov rcx, r14
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x1402d4ec4
mov qword [rdi + 0x28], r14
mov al, 1
jmp 0x1402d4de1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x1402d4ddf
mov dword [rsi], 7
jmp 0x1402d4ddf
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1402d4ddf

Function at 0x1402e3980
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x110
mov rbx, r8
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x108], rax
movaps xmm0, xmmword [0x14032f5c0]
lea rdi, [rsp + 0xc0]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov edx, 0x20
mov rcx, r8
mov r8, rdi
call fcn.140238a40
and byte [rdi], 0xf8
mov al, byte [rdi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [rdi + 0x1f], al
lea r15, [rsp + 0x20]
mov r8d, 0xa0
mov rcx, r15
mov dl, 0xaa
call fcn.1401bd200
lea r8, [0x140388cf0]
mov rcx, r15
mov rdx, rdi
call fcn.1401af4f0
mov rcx, r14
mov rdx, r15
call fcn.1402e2960
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
movups xmm0, xmmword [r14]
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.1401bb0d0
nop
add rsp, 0x110
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1402e6030
Capabilities:
Parse pe header

Disassembly:
cmp rdx, 0x40
jb 0x1402e607e
cmp byte [rcx], 0x4d
jne 0x1402e607e
cmp byte [rcx + 1], 0x5a
jne 0x1402e607e
mov r9d, dword [rcx + 0x3c]
mov r10, rdx
sub r10, r9
xor eax, eax
cmp r10, 0x18
jb 0x1402e6080
cmp r9, rdx
jae 0x1402e6080
cmp r9d, 0x40
jb 0x1402e6080
mov r10d, r9d
and r10d, 7
jne 0x1402e6080
cmp byte [rcx + r9], 0x50
jne 0x1402e607e
cmp byte [rcx + r9 + 1], 0x45
jne 0x1402e607e
cmp byte [rcx + r9 + 2], 0
je 0x1402e6081
xor eax, eax
ret
cmp byte [rcx + r9 + 3], 0
jne 0x1402e607e
add r9, 0x18
xor eax, eax
sub rdx, r9
jbe 0x1402e6080
cmp rdx, 2
jb 0x1402e6080
cmp word [rcx + r9], r8w
sete al
jmp 0x1402e6080