joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140035220
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov r14, rdx
mov r15, rcx
mov ecx, dword [0x140125180]
cmp ecx, 0xffffffff
je 0x14003524d
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140035252
call fcn.140035380
mov eax, dword [0x14012b7c8]
mov ecx, dword [0x140128b20]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14003531b
mov rbx, qword [0x14012b7c0]
mov rcx, rbx
call fcn.140022860
mov rcx, qword [0x140129fb8]
add rcx, 1
xor edx, edx
lea rax, [0x140129fc0]
nop word [rax + rax]
movzx edi, cl
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x1400352d1
lea edi, [rcx + 1]
movzx edi, dil
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x1400352d1
add rdx, 2
add rcx, 2
cmp rdx, 0x100
jb 0x1400352a0
jmp 0x1400352f6
lea rcx, [rax + rsi*8]
mov dword [rcx], 1
lea rcx, [rdi + rdi*2]
mov qword [rax + rcx*8 + 8], r14
mov qword [0x140129fb8], rdi
mov dword [r15], edi
mov eax, dword [rax + rcx*8 + 0x10]
mov dword [r15 + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [r15]
cmp eax, 0xffffffff
je 0x140035363
cmp eax, 0x100
jge 0x14003536a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, [0x14012b7c8]
call fcn.1400a6a20
mov eax, dword [0x14012b7c8]
cmp eax, 0xffffffff
jne 0x140035277
mov ecx, 8
call fcn.1400a6840
mov rbx, rax
mov rcx, rax
call fcn.140022850
mov qword [0x14012b7c0], rbx
lea rcx, [0x14012b7c8]
call fcn.1400a6a90
jmp 0x140035277
int3
int3

Function at 0x140035380
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0x1040
call fcn.1400a8980
sub rsp, rax
lea rbp, [rsp + 0x80]
mov rax, qword [0x140125058]
xor rax, rbp
mov qword [rbp + 0xfb8], rax
mov ecx, dword [0x140125180]
mov dword [rbp - 0x54], ecx
cmp ecx, 0xffffffff
jne 0x140035418
lea rcx, [rbp - 0x54]
call fcn.1400681d0
test al, al
je 0x14003548f
mov ecx, dword [rbp - 0x54]
cmp ecx, 0xffffffff
jne 0x1400353f8
lea rcx, [rbp - 0x54]
call fcn.1400681d0
test al, al
je 0x140035496
cmp dword [rbp - 0x54], 0xffffffff
je 0x140035496
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rbp - 0x54]
mov eax, 0xffffffff
lock cmpxchg dword [0x140125180], ecx
mov ecx, dword [rbp - 0x54]
je 0x140035418
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x140125180]
mov dword [rbp - 0x54], ecx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140035488
lea rsi, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.1400caa00
mov ecx, dword [rbp - 0x54]
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.1400a89e0
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.1400ca590
mov ecx, dword [rbp - 0x54]
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rbp + 0xfb8]
xor rcx, rbp
call fcn.1400a6c00
mov rax, rdi
add rsp, 0x1040
pop rdi
pop rsi
pop rbp
ret
int3
int3
int3
Function at 0x140035570
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140125180]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14003559f
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x14003559f
mov rax, qword [rax + rcx]
jmp 0x1400355a1
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x1400355b0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x140125180]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x1400355d2
call fcn.140035380
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1400358a0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r14, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x28], rax
movzx eax, byte [rdx]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx ebx, byte [rdx + 1]
xor rbx, rcx
imul rbx, rax
movzx ecx, byte [rdx + 2]
xor rcx, rbx
imul rcx, rax
movzx ebx, byte [rdx + 3]
xor rbx, rcx
imul rbx, rax
and rbx, qword [r14 + 0x30]
mov r9, qword [r14 + 8]
mov r10, qword [r14 + 0x18]
lea r11, [rbx + rbx]
add r11, 1
shl rbx, 4
mov rax, qword [r10 + rbx]
mov edx, dword [rdx]
xor edi, edi
mov r8, rax
jmp 0x140035933
mov r8, qword [r8]
mov rbx, rax
cmp rax, r9
je 0x140035942
mov rcx, qword [r10 + r11*8]
mov rbx, qword [rcx]
mov cl, 1
cmp rbx, r8
je 0x1400359b2
cmp dword [r8 + 0x10], edx
jne 0x140035930
mov rsi, r8
jmp 0x140035963
mov rsi, qword [rsi]
mov rdi, rax
cmp rax, r9
je 0x140035972
mov rdi, qword [r10 + r11*8]
mov rdi, qword [rdi]
cmp rdi, rsi
je 0x14003597c
cmp edx, dword [rsi + 0x10]
je 0x140035960
xor edi, edi
cmp r8, rsi
je 0x1400359b2
mov rax, r8
nop word cs:[rax + rax]
add rdi, 1
mov rax, qword [rax]
cmp rsi, rax
jne 0x140035990
xor ecx, ecx
cmp qword [r9], r8
jne 0x1400359bd
cmp rsi, r9
jne 0x1400359bd
mov rcx, r14
call fcn.1400379c0
jmp 0x1400359e6
mov r8, r9
mov rsi, r9
cmp qword [r9], r8
je 0x1400359a3
test cl, cl
jne 0x1400359e6
lea r15, [rsp + 0x20]
nop word cs:[rax + rax]
mov rbx, qword [r8]
mov rcx, r14
mov rdx, r15
call fcn.140039d80
mov r8, rbx
cmp rsi, rbx
jne 0x1400359d0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400a6c00
mov rax, rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140039930
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r13, r8
mov r14, rdx
mov r12, rcx
movzx eax, byte [r8]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx edx, byte [r8 + 1]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r8 + 2]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [r8 + 3]
xor rdx, rcx
imul rdx, rax
and rdx, qword [r12 + 0x30]
mov rax, qword [r12 + 8]
mov r8, qword [r12 + 0x18]
lea rsi, [rdx + rdx]
add rsi, 1
shl rdx, 4
mov rcx, qword [r8 + rdx]
mov ebx, dword [r13]
mov rdx, rcx
jmp 0x1400399c3
mov rdx, qword [rdx]
mov rdi, rcx
cmp rcx, rax
je 0x1400399d2
mov rdi, qword [r8 + rsi*8]
mov rdi, qword [rdi]
cmp rdi, rdx
je 0x1400399eb
cmp dword [rdx + 0x10], ebx
jne 0x1400399c0
cmp rdx, rax
je 0x1400399eb
mov qword [r14], rdx
mov byte [r14 + 8], 0
jmp 0x140039a5e
mov rsi, qword [rax]
mov r15, qword [rsi + 8]
mov ecx, 0x20
call fcn.1400a6840
test rsi, rsi
mov rcx, r15
cmove rcx, rax
mov rdx, rsi
cmove rdx, rax
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov ecx, dword [r13]
mov dword [rax + 0x10], ecx
mov qword [rax + 0x18], 0
mov rcx, qword [r12 + 0x10]
movabs rdx, 0x7fffffffffffffe
cmp rcx, rdx
je 0x140039a71
add rcx, 1
mov qword [r12 + 0x10], rcx
mov qword [rsi + 8], rax
mov qword [r15], rax
mov rax, qword [r12 + 8]
mov r9, qword [rax]
lea r8, [r9 + 0x10]
mov rcx, r12
mov rdx, r14
call fcn.140039a80
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.list_T__too_long
call fcn.1400a80d0
ud2
Function at 0x140039d80
Capabilities:
Hash data using fnv

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
movzx eax, byte [r8 + 0x10]
movabs rbx, 0xcbf29ce484222325
xor rbx, rax
movabs r8, 0x100000001b3
imul rbx, r8
movzx edi, byte [rsi + 0x11]
xor rdi, rbx
imul rdi, r8
movzx eax, byte [rsi + 0x12]
xor rax, rdi
imul rax, r8
movzx ebx, byte [rsi + 0x13]
xor rbx, rax
imul rbx, r8
and rbx, qword [rcx + 0x30]
mov r14, rdx
lea rdx, [rbx + rbx]
mov rdi, qword [rcx + 0x18]
mov rax, rbx
shl rax, 4
lea r8, [rdi + rax]
mov rax, qword [rdi + rax]
cmp qword [rdi + rdx*8 + 8], rsi
je 0x140039dfc
cmp rax, rsi
jne 0x140039e30
mov rdx, rsi
jmp 0x140039e2a
cmp rax, rsi
je 0x140039e0f
lea r8, [rdi + rdx*8]
add r8, 8
lea rdx, [rsi + 8]
jmp 0x140039e2a
mov rax, qword [rcx + 8]
mov qword [r8], rax
lea r8, [rbx + rbx]
add r8, 1
lea rdx, [rcx + 8]
shl r8, 3
add r8, qword [rcx + 0x18]
mov rax, qword [rdx]
mov qword [r8], rax
mov rbx, qword [rsi]
mov rax, qword [rsi + 8]
mov qword [rax], rbx
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov qword [rax + 8], rdx
add qword [rcx + 0x10], 0xffffffffffffffff
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x140039e67
lock sub dword [rcx + 8], 1
jne 0x140039e67
add rcx, 8
add rcx, 0xfffffffffffffff8
call fcn.1400465e0
mov edx, 0x20
mov rcx, rsi
call fcn.1400a68b0
mov qword [r14], rbx
mov rax, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14003a450
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r13, r8
mov r14, rdx
mov r12, rcx
movzx eax, byte [r8]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx edx, byte [r8 + 1]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r8 + 2]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [r8 + 3]
xor rdx, rcx
imul rdx, rax
and rdx, qword [r12 + 0x30]
mov rax, qword [r12 + 8]
mov r8, qword [r12 + 0x18]
lea rsi, [rdx + rdx]
add rsi, 1
shl rdx, 4
mov rcx, qword [r8 + rdx]
mov ebx, dword [r13]
mov rdx, rcx
jmp 0x14003a4e3
mov rdx, qword [rdx]
mov rdi, rcx
cmp rcx, rax
je 0x14003a4f2
mov rdi, qword [r8 + rsi*8]
mov rdi, qword [rdi]
cmp rdi, rdx
je 0x14003a50e
cmp dword [rdx + 0x10], ebx
jne 0x14003a4e0
cmp rdx, rax
je 0x14003a50e
mov qword [r14], rdx
mov byte [r14 + 8], 0
jmp 0x14003a591
mov rsi, qword [rax]
mov r15, qword [rsi + 8]
mov ecx, 0x38
call fcn.1400a6840
test rsi, rsi
mov rcx, r15
cmove rcx, rax
mov rdx, rsi
cmove rdx, rax
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov ecx, dword [r13]
mov dword [rax + 0x10], ecx
mov ecx, 0xf
movq xmm0, rcx
pslldq xmm0, 8
movdqu xmmword [rax + 0x28], xmm0
mov byte [rax + 0x18], 0
mov rcx, qword [r12 + 0x10]
movabs rdx, 0x492492492492491
cmp rcx, rdx
je 0x14003a5a4
add rcx, 1
mov qword [r12 + 0x10], rcx
mov qword [rsi + 8], rax
mov qword [r15], rax
mov rax, qword [r12 + 8]
mov r9, qword [rax]
lea r8, [r9 + 0x10]
mov rcx, r12
mov rdx, r14
call fcn.14003a5c0
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.list_T__too_long
call fcn.1400a80d0
ud2
Function at 0x14003a8f0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r13, r8
mov r14, rdx
mov r12, rcx
movzx eax, byte [r8]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx edx, byte [r8 + 1]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r8 + 2]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [r8 + 3]
xor rdx, rcx
imul rdx, rax
and rdx, qword [r12 + 0x30]
mov rax, qword [r12 + 8]
mov r8, qword [r12 + 0x18]
lea rsi, [rdx + rdx]
add rsi, 1
shl rdx, 4
mov rcx, qword [r8 + rdx]
mov ebx, dword [r13]
mov rdx, rcx
jmp 0x14003a983
mov rdx, qword [rdx]
mov rdi, rcx
cmp rcx, rax
je 0x14003a992
mov rdi, qword [r8 + rsi*8]
mov rdi, qword [rdi]
cmp rdi, rdx
je 0x14003a9ab
cmp dword [rdx + 0x10], ebx
jne 0x14003a980
cmp rdx, rax
je 0x14003a9ab
mov qword [r14], rdx
mov byte [r14 + 8], 0
jmp 0x14003aa21
mov rsi, qword [rax]
mov r15, qword [rsi + 8]
mov ecx, 0x38
call fcn.1400a6840
test rsi, rsi
mov rcx, r15
cmove rcx, rax
mov rdx, rsi
cmove rdx, rax
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov ecx, dword [r13]
mov dword [rax + 0x10], ecx
xorps xmm0, xmm0
movups xmmword [rax + 0x28], xmm0
movups xmmword [rax + 0x18], xmm0
mov rcx, qword [r12 + 0x10]
movabs rdx, 0x492492492492491
cmp rcx, rdx
je 0x14003aa34
add rcx, 1
mov qword [r12 + 0x10], rcx
mov qword [rsi + 8], rax
mov qword [r15], rax
mov rax, qword [r12 + 8]
mov r9, qword [rax]
lea r8, [r9 + 0x10]
mov rcx, r12
mov rdx, r14
call fcn.14003aa50
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.list_T__too_long
call fcn.1400a80d0
ud2
Function at 0x14003b050
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r12, r8
mov r15, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0xf
jbe 0x14003b072
mov r12, qword [r12]
movabs rbx, 0xcbf29ce484222325
test r15, r15
mov qword [rsp + 0x20], rdx
je 0x14003b0a5
movabs rax, 0x100000001b3
lea rdx, [r15 - 1]
mov r8d, r15d
and r8d, 3
cmp rdx, 3
jae 0x14003b0aa
xor esi, esi
jmp 0x14003b0fc
mov rdx, rbx
jmp 0x14003b127
mov rbp, r15
sub rbp, r8
xor esi, esi
nop word cs:[rax + rax]
nop dword [rax]
movzx edx, byte [r12 + rsi]
xor rdx, rbx
imul rdx, rax
movzx ebx, byte [r12 + rsi + 1]
xor rbx, rdx
imul rbx, rax
movzx edx, byte [r12 + rsi + 2]
xor rdx, rbx
imul rdx, rax
movzx ebx, byte [r12 + rsi + 3]
xor rbx, rdx
imul rbx, rax
add rsi, 4
cmp rbp, rsi
jne 0x14003b0c0
mov rdx, rbx
test r8, r8
je 0x14003b127
add rsi, r12
xor ebp, ebp
nop dword [rax]
movzx edx, byte [rsi + rbp]
xor rdx, rbx
imul rdx, rax
add rbp, 1
mov rbx, rdx
cmp r8, rbp
jne 0x14003b110
and rdx, qword [rcx + 0x30]
mov rbx, qword [rcx + 8]
mov r13, qword [rcx + 0x18]
mov rax, rdx
shl rax, 4
mov rbp, qword [r13 + rax]
lea r14, [rdx + rdx]
add r14, 1
mov rdi, rbp
cmp rbp, rbx
jne 0x14003b168
jmp 0x14003b190
mov rdi, qword [rdi]
cmp rbp, rbx
je 0x14003b190
mov rax, qword [r13 + r14*8]
mov rax, qword [rax]
cmp rax, rdi
je 0x14003b1c8
cmp qword [rdi + 0x20], r15
jne 0x14003b160
cmp qword [rdi + 0x28], 0xf
jbe 0x14003b1a0
mov rsi, qword [rdi + 0x10]
jmp 0x14003b1a4
mov rax, rbx
cmp rax, rdi
jne 0x14003b175
jmp 0x14003b1c8
lea rsi, [rdi + 0x10]
mov rcx, rsi
mov rdx, r12
mov r8, r15
call fcn.1400ca490
test eax, eax
jne 0x14003b160
mov rcx, r12
mov rdx, rsi
mov r8, r15
call fcn.1400ca490
test eax, eax
je 0x14003b1e1
mov rax, qword [rsp + 0x20]
mov qword [rax], rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x20]
mov qword [rax], rdi
jmp 0x14003b1d0
Function at 0x14003fe70
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test rdx, rdx
je 0x14003feb2
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14003febd
add rdi, rbx
sub rsi, rbx
jne 0x14003fe90
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
int3
Function at 0x1400466f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x34], 0
mov rcx, qword [rcx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14004676b
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x14004676b
cmp dword [rsp + 0x38], 4
jne 0x14004676b
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400a6c00
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x140046800
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
test byte [0x14012cb77], 2
je 0x140078130
jmp fcn.14007edb0
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 8
call fcn.140078180
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret

Function at 0x140048380
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
movabs r10, 0x8000000000000000
mov r11d, 0xffffffff
cmp rdx, r9
mov r14, r9
cmovb r14, rdx
xor eax, eax
test r14, r14
je 0x1400483fe
xor edi, edi
mov r15, qword [r8 + rdi*8]
mov r13, qword [rcx + rdi*8]
mov rsi, r13
xor rsi, r15
mov r12d, eax
lea rax, [rsi - 1]
mov rbx, r13
sub rbx, r15
xor rbx, r13
or rbx, rsi
xor rsi, r10
and rax, rsi
sar rax, 0x3f
and r12d, eax
xor rbx, r13
sar rbx, 0x3f
mov esi, ebx
not esi
and esi, 1
or rsi, rbx
xor rax, r11
and rax, rsi
or rax, r12
inc rdi
cmp rdi, r14
jb 0x1400483ae
cmp rdx, r9
jae 0x14004842b
xor ecx, ecx
or rcx, qword [r8 + rdx*8]
inc rdx
cmp r9, rdx
jne 0x140048405
xor r10, rcx
dec rcx
and rcx, r10
sar rcx, 0x3f
and eax, ecx
xor r11d, ecx
or r11d, eax
mov eax, r11d
jmp 0x140048456
cmp r9, rdx
jae 0x140048456
xor edi, edi
or rdi, qword [rcx + r9*8]
inc r9
cmp rdx, r9
jne 0x140048432
xor r10, rdi
dec rdi
and rdi, r10
sar rdi, 0x3f
and eax, edi
not edi
and edi, 1
or edi, eax
mov eax, edi
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140048590
Capabilities:
Encode data using xor

Disassembly:
push rsi
movsxd r9, dword [rcx + 8]
movsxd r10, dword [rdx + 8]
cmp r9d, r10d
jge 0x1400485b5
mov rax, qword [rdx]
xor r8d, r8d
mov rsi, r9
or r8, qword [rax + rsi*8]
inc rsi
cmp rsi, r10
jl 0x1400485a7
jmp 0x1400485b8
xor r8d, r8d
cmp r10d, r9d
jge 0x1400485dc
lea r11, [r10*8]
add r11, qword [rcx]
mov rax, r9
sub rax, r10
xor esi, esi
or r8, qword [r11 + rsi*8]
inc rsi
cmp rax, rsi
jne 0x1400485d0
cmp r9d, r10d
cmovl r10d, r9d
test r10d, r10d
jle 0x140048606
mov r9, qword [rcx]
mov r11, qword [rdx]
movsxd r10, r10d
xor eax, eax
mov rsi, qword [r11 + rax*8]
xor rsi, qword [r9 + rax*8]
or r8, rsi
inc rax
cmp rax, r10
jl 0x1400485f3
mov eax, dword [rdx + 0x10]
xor eax, dword [rcx + 0x10]
movsxd rcx, eax
xor eax, eax
or rcx, r8
sete al
pop rsi
ret

Function at 0x14004db40
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
movsxd rax, dword [rdx + 8]
test rax, rax
je 0x14004db96
mov r14, rcx
mov rcx, qword [rdx]
xor edi, edi
xor esi, esi
or rsi, qword [rcx + rdi*8]
inc rdi
cmp rdi, rax
jb 0x14004db5c
test rsi, rsi
je 0x14004db96
test eax, eax
jle 0x14004db76
test byte [rcx], 1
jne 0x14004dbc5
mov dword [rsp + 0x20], 0xb0
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x68
jmp 0x14004dbb4
mov dword [rsp + 0x20], 0xac
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x69
call fcn.14007f830
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
cmp dword [rdx + 0x10], 0
je 0x14004dbeb
mov dword [rsp + 0x20], 0xb4
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x6d
jmp 0x14004dbb4
lea rdi, [r14 + 0x18]
mov rcx, rdi
call fcn.140047ef0
test rax, rax
je 0x14004dc8b
movsxd rcx, dword [r14 + 0x20]
mov rax, rcx
test rcx, rcx
jle 0x14004dc1b
mov rdx, qword [rdi]
lea rcx, [rax - 1]
cmp qword [rdx + rax*8 - 8], 0
je 0x14004dc04
mov dword [r14 + 0x20], eax
test eax, eax
jne 0x14004dc2b
mov dword [r14 + 0x28], 0
mov rax, qword [rdi]
mov r9, qword [rax]
mov esi, 1
mov edx, 0x40
xor ecx, ecx
movabs r8, 0x8000000000000000
mov edi, esi
and edi, 1
neg rdi
mov rax, r9
and rax, rdi
mov rbx, rax
xor rbx, rsi
shr rbx, 1
and rax, rsi
add rax, rbx
and rdi, r8
shr rcx, 1
or rcx, rdi
mov rsi, rax
dec rdx
jne 0x14004dc47
mov qword [r14 + 0x30], rcx
mov qword [r14 + 0x38], 0
mov esi, 1
jmp 0x14004dbb9
mov dword [rsp + 0x20], 0xba
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x44
jmp 0x14004dbb4
Function at 0x14004f260
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
movsxd r8, dword [rcx + 8]
test r8, r8
jle 0x14004f3c1
movabs r10, 0x8000000000000000
mov r9, qword [rcx]
xor r11d, r11d
xor edx, edx
xor eax, eax
xor r14d, r14d
mov rcx, qword [r9 + rdx*8]
mov rsi, rcx
xor rsi, r10
lea rbx, [rcx - 1]
and rbx, rsi
sar rbx, 0x3f
not rbx
mov ebp, r14d
not ebp
or r14, rbx
mov r15d, ebx
and r15d, ebp
mov rbx, rcx
shl rbx, 0x20
mov rbp, rbx
xor rbp, r10
dec rbx
and rbx, rbp
mov rbp, rbx
shr rbp, 0x3a
and ebp, 0xffffffe0
mov rdi, rcx
shr rdi, 0x20
test rbx, rbx
cmovns rdi, rcx
mov rcx, rdi
shl rcx, 0x30
mov rbx, rcx
xor rbx, r10
dec rcx
and rcx, rbx
mov rbx, rcx
shr rbx, 0x3b
and ebx, 0xfffffff0
or ebx, ebp
mov rbp, rdi
shr rbp, 0x10
test rcx, rcx
cmovns rbp, rdi
mov rcx, rbp
shl rcx, 0x38
mov rdi, rcx
xor rdi, r10
dec rcx
and rcx, rdi
mov rdi, rcx
shr rdi, 0x3c
and edi, 0xfffffff8
or edi, ebx
mov rbx, rbp
shr rbx, 8
test rcx, rcx
cmovns rbx, rbp
mov rcx, rbx
shl rcx, 0x3c
mov rbp, rcx
xor rbp, r10
dec rcx
and rcx, rbp
mov rbp, rcx
shr rbp, 0x3d
and ebp, 0xfffffffc
or ebp, edi
mov rsi, rbx
shr rsi, 4
test rcx, rcx
cmovns rsi, rbx
mov rcx, rsi
shl rcx, 0x3e
mov rbx, rcx
xor rbx, r10
dec rcx
and rcx, rbx
mov rbx, rcx
shr rbx, 0x3e
and ebx, 0xfffffffe
or ebx, ebp
mov rdi, rsi
shr rdi, 2
test rcx, rcx
cmovns rdi, rsi
shl rdi, 0x3f
mov rcx, rdi
xor rcx, r10
dec rdi
and rdi, rcx
shr rdi, 0x3f
or edi, ebx
add edi, r11d
and edi, r15d
or eax, edi
inc rdx
add r11d, 0x40
cmp rdx, r8
jl 0x14004f28c
jmp 0x14004f3c3
xor eax, eax
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14004f8d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1c0
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x1b8], rax
test rdx, rdx
je 0x14004fb02
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
call fcn.140086780
mov r14d, eax
test byte [0x14012cb77], 0x40
je 0x14004f92c
lea rcx, [rsp + 0x190]
mov edx, 0x20
call fcn.1400867f0
test eax, eax
jne 0x14004f958
test r14d, r14d
je 0x14004f946
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1a0], xmm0
movaps xmmword [rsp + 0x190], xmm0
jmp 0x14004f958
lea rcx, [rsp + 0x190]
mov edx, 0x20
call fcn.140086850
xor eax, eax
movups xmm0, xmmword [rsi + rax]
xorps xmm0, xmmword [rsp + rax + 0x190]
movaps xmmword [rsp + rax + 0x190], xmm0
add rax, 0x10
cmp rax, 0x20
jne 0x14004f95a
test r14d, r14d
je 0x14004f98c
mov ecx, 1
call fcn.14007fb90
mov rsi, rax
jmp 0x14004f9be
lea rcx, [0x14012c840]
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rsi, qword [0x14012c848]
test rsi, rsi
je 0x14004f9b2
mov rax, qword [rsi + 0x120]
mov qword [0x14012c848], rax
lea rcx, [0x14012c840]
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
test rsi, rsi
jne 0x14004fa0f
mov ecx, 0x130
call fcn.14005e4d0
test rax, rax
je 0x14004fa02
mov rsi, rax
mov rcx, rax
call fcn.140056070
test r14d, r14d
je 0x14004fa0f
lea r8, [0x14005e0d0]
mov ecx, 1
mov rdx, rsi
call fcn.14007fc30
test eax, eax
jne 0x14004fa0f
mov rcx, rsi
call fcn.14005e500
lea rsi, [rsp + 0x60]
mov rcx, rsi
call fcn.140056070
cmp qword [rsi + 0x128], 0x1000
jb 0x14004fa5d
lea rbp, [rsp + 0x30]
mov edx, 0x30
mov rcx, rbp
call fcn.140086850
mov r8d, 0x30
mov rcx, rsi
mov rdx, rbp
call fcn.140055d90
test eax, eax
je 0x14004fb25
mov qword [rsi + 0x118], 1
mov qword [rsi + 0x128], 0
mov eax, 0x20
mov r12d, 0x10000
lea r15, [rsp + 0x190]
cmp rdi, r12
mov ebp, 0x10000
cmovb rbp, rdi
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov rdx, rbx
mov r8, rbp
mov r9, r15
call fcn.140055e70
test eax, eax
je 0x14004fb25
inc qword [rsi + 0x128]
add rbx, rbp
mov eax, 0
sub rdi, rbp
jne 0x14004fa70
lea rdi, [rsp + 0x60]
cmp rsi, rdi
jne 0x14004fac7
lea rcx, [rsp + 0x60]
mov edx, 0x120
call fcn.14005e550
cmp rsi, rdi
setne al
test r14d, r14d
jne 0x14004fb02
test al, al
je 0x14004fb02
lea rdi, [0x14012c840]
mov rcx, rdi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [0x14012c848]
mov qword [rsi + 0x120], rax
mov qword [0x14012c848], rsi
mov rcx, rdi
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.1400a6c00
nop
add rsp, 0x1c0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400d8c10
ud2