joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006cfd0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1401ab708]
cmp ecx, 0xffffffff
je 0x14006cff2
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14006cff7
call fcn.14006d120
mov eax, dword [0x1401b9c90]
mov ecx, dword [0x1401ab768]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14006d0a7
mov rbx, qword [0x1401b9c88]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14006d0f7
mov rax, qword [0x1401b8470]
inc rax
xor ecx, ecx
lea rdx, [0x1401b8480]
lea r8d, [rax + rcx]
movzx r8d, r8b
lea r9, [r8 + r8*2]
cmp dword [rdx + r9*8], 0
jne 0x14006d104
lea rax, [rdx + r9*8]
mov dword [rax], 1
mov qword [rax + 8], rdi
mov ecx, dword [0x1401b9c80]
inc ecx
mov dword [0x1401b9c80], ecx
mov dword [rax + 0x14], ecx
mov qword [0x1401b8470], r8
mov qword [rsi], r8
mov eax, dword [rax + 0x10]
mov dword [rsi + 8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp qword [rsi], 0x100
jae 0x14006d0f4
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1401b9c90]
call fcn.1400c5b3c
cmp dword [0x1401b9c90], 0xffffffff
jne 0x14006d01c
mov ecx, 8
call fcn.1400c5ab8
mov rbx, rax
mov qword [rax], 0
mov rcx, rax
call fcn.14009bc30
mov qword [0x1401b9c88], rbx
lea rcx, [0x1401b9c90]
call fcn.1400c5bf0
jmp 0x14006d01c
int3
mov rcx, rbx
call sub.KERNEL32.dll_AcquireSRWLockExclusive
jmp 0x14006d034
inc rcx
cmp rcx, 0x100
jne 0x14006d047
jmp 0x14006d08d

Function at 0x14006d120
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.1400c6d80
sub rsp, rax
mov rax, qword [0x14019d040]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov ecx, dword [0x1401ab708]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
je 0x14006d1da
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14006d218
lea rdi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rdi
xor edx, edx
call fcn.1400f5e20
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.1400c5b2c
mov rsi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rdi
call fcn.1400f5780
mov ecx, dword [rsp + 0x2c]
mov rdx, rsi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
cmp rcx, qword [0x14019d040]
je 0x14006d1cd
call fcn.1400c6de0
int3
mov rax, rsi
add rsp, 0x1038
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x2c]
call fcn.140079230
test al, al
je 0x14006d21b
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
je 0x14006d21e
mov eax, 0xffffffff
lock cmpxchg dword [0x1401ab708], ecx
je 0x14006d154
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x1401ab708]
mov dword [rsp + 0x2c], ecx
jmp 0x14006d154
int3
int3
lea rcx, [rsp + 0x2c]
call fcn.140079230
test al, al
je 0x14006d243
cmp dword [rsp + 0x2c], 0xffffffff
je 0x14006d243
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
jmp 0x14006d1f1
int3
Function at 0x14006d250
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1401ab708]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
jne 0x14006d278
test rdi, rdi
je 0x14006d291
call fcn.14006d120
mov rcx, qword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 8]
mov rdx, qword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140079230
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140079245
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret
Function at 0x1400886c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movdqu xmm4, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
movd xmm0, r8d
pxor xmm0, xmm4
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x40
jb 0x1400887be
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x1401768b0]
nop dword [rax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm3
pclmulqdq xmm7, xmm4, 0
movdqa xmm8, xmm2
pclmulqdq xmm8, xmm4, 0
movdqa xmm9, xmm1
pclmulqdq xmm9, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm3, xmm5, 0x11
pclmulqdq xmm2, xmm5, 0x11
pclmulqdq xmm1, xmm5, 0x11
movdqu xmm10, xmmword [rcx]
pxor xmm10, xmm6
pxor xmm0, xmm10
movdqu xmm6, xmmword [rcx + 0x10]
pxor xmm6, xmm7
pxor xmm3, xmm6
movdqu xmm6, xmmword [rcx + 0x20]
pxor xmm6, xmm8
pxor xmm2, xmm6
movdqu xmm6, xmmword [rcx + 0x30]
pxor xmm6, xmm9
pxor xmm1, xmm6
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x3f
ja 0x140088730
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
pmovzxdq xmm3, qword [0x1401768d0]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp rdx, 0x10
jb 0x14008884e
movdqu xmm1, xmmword [rcx]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
add rcx, 0x10
add rdx, 0xfffffffffffffff0
cmp rdx, 0xf
ja 0x140088824
pmovzxdq xmm1, qword [0x1401768d0]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
psrldq xmm0, 4
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
pxor xmm3, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm3, 3
pclmulqdq xmm0, xmmword [0x1401768c0], 0x10
pblendw xmm0, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm3
pextrd eax, xmm1, 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x14008f620
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor r8d, r8d
test edx, edx
sete r8b
xor ecx, ecx
mov edx, r8d
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x14008f6ba
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14008f6a4
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14008f681
mov qword [rsi], rdi
call fcn.140094940
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 0
inc rax
cmp rax, 1
jbe 0x14008f6be
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140094940
mov rcx, qword [rsi]
call fcn.14008f5f0
mov qword [rsi], 0
jmp 0x14008f66f
mov byte [rsi + 8], 0
int3

Function at 0x14008f900
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x14008f948
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x14008f951
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14008f938
mov qword [rdi], rsi
call fcn.140094940
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140094940
mov rcx, qword [rdi]
call fcn.14008f5f0
mov qword [rdi], 0
jmp 0x14008f926

Function at 0x140090990
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14019d040]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x140171db0]
lea r14, [rsp + 0x50]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.ReadAtCurrentPos
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, 0x60
call fcn.140094920
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14009adc0
test esi, esi
js 0x140090a9f
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
call fcn.14009b060
test al, al
jne 0x140090aab
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140090ac7
mov esi, dword [rsp + 0x2c]
test esi, esi
js 0x140090aa6
lea rcx, [rsp + 0x30]
call fcn.14009b0e0
lea rcx, [rsp + 0x50]
call fcn.14009ae50
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
cmp rcx, qword [0x14019d040]
je 0x140090a8e
call fcn.1400c6de0
int3
mov eax, esi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x140090a6a
int3
mov r9d, esi
lea rdx, str.File::ReadAtCurrentPos
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.14011dd10
jmp 0x140090a30
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
jmp 0x140090a60
Function at 0x140090ae0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14019d040]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [0x140171db0]
lea r14, [rsp + 0x60]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.DoInitialize
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x175
call fcn.140094920
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.14009adc0
mov eax, ebx
and eax, 1
neg eax
and eax, 3
test bl, 2
mov edx, 1
cmove edx, eax
test bl, 4
mov ecx, 4
cmovne edx, ecx
test bl, 8
mov r8d, 2
cmove r8d, edx
test bl, 0x10
mov eax, 5
cmove eax, r8d
test eax, eax
je 0x140090d55
mov edx, ebx
and edx, 0x40
shl edx, 0x18
test bl, bl
cmovns ecx, edx
mov r8d, ebx
rol r8d, 0x1a
and r8d, 0x80000100
or r8d, ecx
bt ebx, 0x12
jb 0x140090d2a
mov edx, ebx
shr edx, 4
and edx, 0x10000
or edx, r8d
mov ecx, ebx
shr ecx, 8
and ecx, 3
mov r8d, ebx
shr r8d, 0xd
and r8d, 4
or r8d, ecx
xor r8d, 3
mov r15d, ebx
and r15d, 0x400
mov ecx, r15d
shl ecx, 0x14
mov r9d, ebx
shr r9d, 3
and r9d, 0x100
or r9d, ecx
mov ecx, ebx
shr ecx, 0xb
and ecx, 2
or ecx, r9d
mov r10d, ebx
shl r10d, 0xd
and r10d, 0x4000000
or r10d, ecx
mov r9d, ebx
shl r9d, 8
and r9d, 0xa000000
or r9d, r10d
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x140090c43
mov rcx, qword [rdi]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x30], 0
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp qword [rsi], rax
je 0x140090c9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140090d3c
mov rax, r14
inc rax
cmp rax, 2
jb 0x140090c92
mov qword [rsi], r14
call fcn.140094940
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rsi]
inc r14
cmp r14, 2
jb 0x140090ced
shr r15d, 0xa
mov dword [rsi + 0x24], 0
mov byte [rsi + 0x29], r15b
test bl, 4
jne 0x140090d0f
test bl, 0xa
je 0x140090cc3
mov byte [rsi + 0x28], 1
bt ebx, 0x15
jb 0x140090d20
lea rcx, [rsp + 0x60]
call fcn.14009ae50
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
cmp rcx, qword [0x14019d040]
je 0x140090cff
call fcn.1400c6de0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14003a080
mov dword [rsi + 0x24], eax
jmp 0x140090cc9
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne byte [rsi + 0x28]
jmp 0x140090cc3
mov rcx, rdi
call fcn.14003b0e0
jmp 0x140090cc9
bt ebx, 0x15
jb 0x140090d58
or r8d, 0x20000000
jmp 0x140090bc1
call fcn.140094940
mov rcx, qword [rsi]
call fcn.14008f5f0
mov qword [rsi], 0
jmp 0x140090c7e
int3
int3
Function at 0x140094b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14019d040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r8, qword [rcx]
mov r9, qword [rcx + 8]
cmp r9, 2
jb 0x140094c90
cmp word [r8 + 2], 0x3a
jne 0x140094c90
movzx eax, word [r8]
and eax, 0xffffffdf
add eax, 0xffffffbf
cmp ax, 0x1a
jae 0x140094c90
mov ebx, 2
xor eax, eax
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
cmp rdx, 2
jb 0x140094c99
cmp word [rcx + 2], 0x3a
jne 0x140094c99
movzx r10d, word [rcx]
and r10d, 0xffffffdf
add r10d, 0xffffffa5
cmp r10w, 0xffe6
setae r10b
not al
test al, r10b
je 0x140094c99
cmp r9, rbx
cmovae r9, rbx
lea rdx, [rsp + 0x38]
mov qword [rdx], rcx
mov qword [rdx + 8], 2
lea rcx, [rsp + 0x28]
mov qword [rcx], r8
mov qword [rcx + 8], r9
mov r8d, 1
call fcn.14008fac0
test al, al
je 0x140094c46
mov rcx, qword [rdi + 8]
sub rcx, rbx
jb 0x140094cbd
mov rax, qword [rsi + 8]
cmp rax, 1
jbe 0x140094cbd
add rax, 0xfffffffffffffffe
cmp rcx, rax
je 0x140094c67
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
cmp rcx, qword [0x14019d040]
je 0x140094c5f
call fcn.1400c6de0
int3
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
mov al, 1
test rcx, rcx
je 0x140094c48
add ebx, ebx
add rbx, qword [rdi]
mov rdx, qword [rsi]
xor r8d, r8d
movzx r9d, word [rbx + r8*2]
cmp r9w, word [rdx + r8*2 + 4]
jne 0x140094c46
inc r8
cmp rcx, r8
jne 0x140094c79
jmp 0x140094c48
mov al, 1
xor ebx, ebx
jmp 0x140094bb4
cmp r9, rdx
jne 0x140094c46
mov al, 1
test r9, r9
je 0x140094c48
xor edx, edx
movzx r10d, word [r8 + rdx*2]
cmp r10w, word [rcx + rdx*2]
jne 0x140094c46
inc rdx
cmp r9, rdx
jne 0x140094ca7
jmp 0x140094c48
lea rcx, [0x140174fb6]
call fcn.1400f6cf0
int3

Function at 0x140096210
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.140090850
mov qword [rsi], 0
test rax, rax
je 0x140096263
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140096297
lea rax, [rbx + 1]
cmp rax, 2
jb 0x14009625b
mov qword [rsi], rbx
call fcn.140094940
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
lea rdx, [rdi + 8]
call fcn.140094970
lea rcx, [rsi + 0x20]
call fcn.14009b080
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov al, byte [rdi + 0x28]
mov byte [rsi + 0x28], al
mov al, byte [rdi + 0x29]
mov byte [rsi + 0x29], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.140094940
mov rcx, qword [rsi]
call fcn.14008f5f0
mov qword [rsi], 0
jmp 0x140096249
Function at 0x140098ed0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
jne 0x140098eea
test r8d, r8d
jne 0x140098ee3
call fcn.14009cff0
xor eax, eax
add rsp, 0x28
ret
mov r8d, r8d
add rsp, 0x28
jmp fcn.1400985c0

Function at 0x14009d520
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movsxd rax, dword [rdx + 8]
test rax, rax
je 0x14009d623
mov rsi, rcx
mov rcx, qword [rdx]
xor r8d, r8d
xor r9d, r9d
or r9, qword [rcx + r8*8]
inc r8
cmp rax, r8
jne 0x14009d53f
test r9, r9
je 0x14009d623
test eax, eax
jle 0x14009d663
mov rcx, qword [rdx]
test byte [rcx], 1
je 0x14009d663
cmp dword [rdx + 0x10], 0
jne 0x14009d6c1
cmp eax, 0x401
jae 0x14009d683
lea rdi, [rsi + 0x18]
mov rcx, rdi
call fcn.14004c580
test rax, rax
je 0x14009d6e4
mov eax, dword [rsi + 0x20]
test eax, eax
jle 0x14009d65b
mov rcx, qword [rdi]
mov edx, eax
cmp qword [rcx + rdx*8 - 8], 0
jne 0x14009d5b9
lea edx, [rax - 1]
cmp eax, 1
mov eax, edx
jg 0x14009d5a0
jmp 0x14009d648
mov dword [rsi + 0x20], eax
mov rax, qword [rdi]
mov rax, qword [rax]
mov r9d, 1
mov edx, 0x40
xor ecx, ecx
movabs r8, 0x8000000000000000
mov r10d, r9d
and r10d, 1
neg r10
mov r11, rax
and r11, r10
mov rdi, r11
and rdi, r9
xor r11, r9
shr r11, 1
add r11, rdi
and r10, r8
shr rcx, 1
or rcx, r10
mov r9, r11
dec rdx
jne 0x14009d5d9
mov qword [rsi + 0x30], rcx
mov qword [rsi + 0x38], 0
mov esi, 1
mov eax, esi
add rsp, 0x28
pop rdi
pop rsi
ret
mov dword [rsp + 0x20], 0xaa
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c.inc
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x69
call fcn.1401484b0
jmp 0x14009d61a
mov dword [rsi + 0x20], 0
mov dword [rsi + 0x28], 0
jmp 0x14009d5bc
jne 0x14009d5bc
jmp 0x14009d64f
mov dword [rsp + 0x20], 0xae
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c.inc
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x68
jmp 0x14009d641
mov r9d, 0x400
xor r8d, r8d
or r8, qword [rcx + r9*8]
inc r9
cmp rax, r9
jne 0x14009d68c
test r8, r8
je 0x14009d57d
mov dword [rsp + 0x20], 0xb6
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c.inc
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x66
jmp 0x14009d641
mov dword [rsp + 0x20], 0xb2
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c.inc
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x6d
jmp 0x14009d641
mov dword [rsp + 0x20], 0xbc
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c.inc
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x44
jmp 0x14009d641
Function at 0x14009edb0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rbx, r8
mov r12, rdx
mov rsi, rcx
mov r15, qword [rsp + 0xc0]
mov rcx, qword [rcx + 0x38]
add rcx, r15
setb dl
xor eax, eax
movabs r8, 0xfffffffe0
cmp rcx, r8
ja 0x14009ef44
test dl, dl
jne 0x14009ef44
mov rdi, r9
lea r13, [rsi + 0x50]
mov rbp, qword [rsi + 0x150]
mov r14, qword [rsi + 0x158]
mov qword [rsi + 0x38], rcx
cmp dword [rsi + 0x174], 0
je 0x14009ee34
lea rcx, [rsi + 0x40]
mov rdx, r13
mov rax, rbp
call qword [0x1401904a0]
mov dword [rsi + 0x174], 0
mov eax, dword [rsi + 0x170]
test eax, eax
jne 0x14009ef59
test byte [rsi + 0x168], 1
je 0x14009ee7d
test r15, r15
je 0x14009ee7d
lea rax, [rsi + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rsi
mov rcx, rbx
mov rdx, rdi
mov r8, r15
mov r9, r12
call fcn.14000cf00
add rbx, rax
add rdi, rax
sub r15, rax
mov rax, qword [rsp + 0xc8]
mov ebp, dword [rsi + 0xc]
bswap ebp
cmp r15, 0xc00
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r13
jae 0x14009efa2
mov r13, r12
mov r14, r15
and r14, 0xff0
je 0x14009eefc
mov r12, r15
shr r12, 4
mov qword [rsp + 0x20], rsi
mov rcx, rbx
mov rdx, rdi
mov r8, r12
mov r9, r13
call qword [0x1401904a0]
add ebp, r12d
mov eax, ebp
bswap eax
mov dword [rsi + 0xc], eax
add rbx, r14
and r15d, 0xf
lea rcx, [rsi + 0x40]
mov rdx, qword [rsp + 0x40]
mov r8, rdi
mov r9, r14
mov rax, qword [rsp + 0x48]
call qword [0x1401904a0]
add rdi, r14
test r15, r15
je 0x14009ef55
mov rax, qword [rsi + 0x160]
lea rdx, [rsi + 0x10]
mov rcx, rsi
mov r8, r13
call qword [0x1401904a0]
inc ebp
bswap ebp
mov dword [rsi + 0xc], ebp
xor eax, eax
mov ecx, eax
mov dl, byte [rsi + rcx + 0x10]
xor dl, byte [rbx + rcx]
mov byte [rdi + rcx], dl
xor byte [rsi + rcx + 0x40], dl
inc rax
cmp r15, rax
jne 0x14009ef21
mov dword [rsi + 0x170], eax
mov eax, 1
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x14009ef39
test r15, r15
je 0x14009ef39
mov ecx, eax
mov dl, byte [rsi + rcx + 0x10]
xor dl, byte [rbx]
inc rbx
mov byte [rdi], dl
xor byte [rsi + rcx + 0x40], dl
inc rdi
inc eax
and eax, 0xf
setne cl
cmp r15, 1
lea r15, [r15 - 1]
setne dl
test cl, dl
jne 0x14009ef5e
test eax, eax
jne 0x14009ef39
lea rcx, [rsi + 0x40]
mov rdx, r13
mov rax, rbp
call qword [0x1401904a0]
jmp 0x14009ee42
lea rcx, [rsi + 0x40]
mov qword [rsp + 0x50], rcx
mov r14d, 0xc00
mov qword [rsp + 0x20], rsi
mov r8d, 0xc0
mov rcx, rbx
mov rdx, rdi
mov r9, r12
mov r13, rax
call qword [0x1401904a0]
add ebp, 0xc0
mov eax, ebp
bswap eax
mov dword [rsi + 0xc], eax
mov r9d, 0xc00
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x40]
mov r8, rdi
mov rax, qword [rsp + 0x48]
call qword [0x1401904a0]
mov rax, r13
add rdi, r14
add rbx, r14
add r15, 0xfffffffffffff400
cmp r15, 0xbff
jbe 0x14009eea1
jmp 0x14009efb1
Function at 0x1400a4c10
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400a4c39
xor eax, eax
xor r9d, r9d
nop word [rax + rax]
movzx r10d, byte [rdx + rax]
xor r10b, byte [rcx + rax]
or r9b, r10b
inc rax
cmp r8, rax
jne 0x1400a4c20
movzx eax, r9b
ret
xor eax, eax
ret

Function at 0x1400a5240
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov esi, ecx
mov rax, qword [0x14019d040]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rax, [0x140062970]
mov qword [rsp + 0x20], rax
lea rcx, [0x1401b4840]
lea rdx, [0x1400627c0]
lea r8, [rsp + 0x20]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1400a52db
cmp dword [0x1401b4848], 0
jne 0x1400a52d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x1401b484c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x1400a52d7
movsxd rax, esi
mov rax, qword [rdi + rax*8]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
cmp rcx, qword [0x14019d040]
je 0x1400a52cf
call fcn.1400c6de0
int3
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x1400a52b8
call fcn.1400d896c
int3
Function at 0x1400b5420
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1401ab708]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400b5456
mov rcx, qword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 8]
jne 0x1400b5456
add rax, rcx
mov rax, qword [rax]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x1400b5450