joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a3cb0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x140173f78]
mov ecx, dword [0x14016f824]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400a3d0c
movzx eax, word [0x140173f48]
cmp ax, 9
jne 0x1400a3d6e
mov esi, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14010e4a0
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x140173f78]
call fcn.14010bdd8
cmp dword [0x140173f78], 0xffffffff
jne 0x1400a3ce5
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsi]
movaps xmm1, xmmword [rsi + 0x10]
movaps xmm2, xmmword [rsi + 0x20]
movups xmmword [0x140173f68], xmm2
movups xmmword [0x140173f58], xmm1
movups xmmword [0x140173f48], xmm0
lea rcx, [0x140173f78]
call fcn.14010ba50
jmp 0x1400a3ce5
cmp ax, 5
jg 0x1400a3d8f
xor esi, esi
test ax, ax
je 0x1400a3cf7
cmp ax, 5
jne 0x1400a3daf
mov esi, 3
jmp 0x1400a3cf7
cmp ax, 6
jne 0x1400a3d9f
mov esi, 2
jmp 0x1400a3cf7
cmp ax, 0xc
jne 0x1400a3daf
mov esi, 4
jmp 0x1400a3cf7
mov esi, 5
jmp 0x1400a3cf7
Function at 0x1400aa5d0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [0x140178b80]
cmp rdi, 1
jbe 0x1400aa618
mov ecx, dword [0x14016f428]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400aa64e
movsxd rcx, dword [rdi]
shl rcx, 4
mov qword [rax + rcx], rsi
mov ecx, dword [rdi + 4]
movsxd rdx, dword [rdi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140178b80]
call fcn.140022080
test al, al
je 0x1400aa65a
mov eax, 0xffffffff
mov qword [0x140178b88], rax
lea rdi, [0x140178b88]
mov rcx, rdi
xor edx, edx
call fcn.14001c0c0
mov qword [0x140178b80], rdi
jmp 0x1400aa5e6
test rsi, rsi
je 0x1400aa611
call fcn.14000bf20
jmp 0x1400aa5f8
mov rdi, qword [0x140178b80]
jmp 0x1400aa5e6

Function at 0x1400aa960
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
mov r9, qword [rcx]
mov rdx, qword [rcx + 8]
mov r8, rdx
sub r8, r9
je 0x1400aa988
mov rax, r8
shr rax, 2
mov rsi, r9
not rsi
add rsi, rdx
jne 0x1400aa98c
xor edx, edx
jmp 0x1400aa9d0
xor eax, eax
jmp 0x1400aa9ed
mov r10, r8
and r10, 0xfffffffffffffffe
xor edx, edx
mov r11d, 0xff
lea rsi, [0x14015d620]
mov edi, eax
and edi, r11d
movzx ebx, byte [r9 + rdx]
xor ebx, edi
shr eax, 8
xor eax, dword [rsi + rbx*4]
mov edi, eax
and edi, r11d
movzx ebx, byte [r9 + rdx + 1]
xor ebx, edi
shr eax, 8
xor eax, dword [rsi + rbx*4]
add rdx, 2
cmp r10, rdx
jne 0x1400aa9a2
test r8b, 1
je 0x1400aa9ed
movzx ebx, al
movzx edx, byte [r9 + rdx]
xor edx, ebx
lea rbx, [0x14015d620]
shr eax, 8
xor eax, dword [rbx + rdx*4]
cmp eax, dword [rcx + 0x18]
sete al
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400bc000
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
movsxd r10, dword [rcx + 8]
movsxd r9, dword [rdx + 8]
cmp r10d, r9d
jge 0x1400bc03d
mov rax, qword [rdx]
mov r11d, r9d
sub r11d, r10d
mov rdi, r10
not rdi
add rdi, r9
and r11d, 7
cmp rdi, 7
jae 0x1400bc14a
xor r8d, r8d
mov rsi, r10
jmp 0x1400bc18e
xor r8d, r8d
cmp r9d, r10d
jge 0x1400bc0a2
mov r11, qword [rcx]
mov edi, r10d
sub edi, r9d
mov rsi, r9
not rsi
add rsi, r10
mov rax, r9
and rdi, 7
je 0x1400bc06c
or r8, qword [r11 + rax*8]
inc rax
dec rdi
jne 0x1400bc060
cmp rsi, 7
jb 0x1400bc0a2
or r8, qword [r11 + rax*8]
or r8, qword [r11 + rax*8 + 8]
or r8, qword [r11 + rax*8 + 0x10]
or r8, qword [r11 + rax*8 + 0x18]
or r8, qword [r11 + rax*8 + 0x20]
or r8, qword [r11 + rax*8 + 0x28]
or r8, qword [r11 + rax*8 + 0x30]
or r8, qword [r11 + rax*8 + 0x38]
add rax, 8
cmp r10, rax
jne 0x1400bc072
cmp r10d, r9d
cmovl r9d, r10d
test r9d, r9d
jle 0x1400bc133
mov r10, qword [rcx]
mov r11, qword [rdx]
mov r14d, r9d
lea rax, [r14 - 1]
mov r9d, r14d
and r9d, 3
cmp rax, 3
jae 0x1400bc0d0
xor eax, eax
jmp 0x1400bc111
and r14d, 0xfffffffc
xor eax, eax
mov rdi, qword [r11 + rax*8]
mov rbx, qword [r11 + rax*8 + 8]
xor rdi, qword [r10 + rax*8]
xor rbx, qword [r10 + rax*8 + 8]
or rdi, r8
mov rsi, qword [r11 + rax*8 + 0x10]
xor rsi, qword [r10 + rax*8 + 0x10]
or rsi, rbx
mov r8, qword [r11 + rax*8 + 0x18]
xor r8, qword [r10 + rax*8 + 0x18]
or rsi, rdi
or r8, rsi
add rax, 4
cmp r14, rax
jne 0x1400bc0d6
test r9, r9
je 0x1400bc133
lea r11, [r11 + rax*8]
lea rax, [r10 + rax*8]
xor esi, esi
mov rdi, qword [r11 + rsi*8]
xor rdi, qword [rax + rsi*8]
or r8, rdi
inc rsi
cmp r9, rsi
jne 0x1400bc120
mov eax, dword [rdx + 0x10]
xor eax, dword [rcx + 0x10]
movsxd rcx, eax
xor eax, eax
or rcx, r8
sete al
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rdi, r9
sub rdi, r10
and rdi, 0xfffffffffffffff8
neg rdi
xor r8d, r8d
mov rsi, r10
or r8, qword [rax + rsi*8]
or r8, qword [rax + rsi*8 + 8]
or r8, qword [rax + rsi*8 + 0x10]
or r8, qword [rax + rsi*8 + 0x18]
or r8, qword [rax + rsi*8 + 0x20]
or r8, qword [rax + rsi*8 + 0x28]
or r8, qword [rax + rsi*8 + 0x30]
or r8, qword [rax + rsi*8 + 0x38]
add rsi, 8
add rdi, 8
jne 0x1400bc15d
test r11, r11
je 0x1400bc040
lea rax, [rax + rsi*8]
xor esi, esi
or r8, qword [rax + rsi*8]
inc rsi
cmp r11, rsi
jne 0x1400bc19d
jmp 0x1400bc040
Function at 0x1400be5b0
Capabilities:
Hash data using sha512

Disassembly:
push rsi
push rdi
sub rsp, 0x108
mov rsi, r8
mov r8, rdx
mov rdx, rcx
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x100], rax
movaps xmm0, xmmword [0x140146a10]
lea rdi, [rsp + 0x20]
movaps xmmword [rdi + 0xc0], xmm0
movaps xmmword [rdi + 0xb0], xmm0
movaps xmmword [rdi + 0xa0], xmm0
movaps xmmword [rdi + 0x90], xmm0
movaps xmmword [rdi + 0x80], xmm0
movaps xmmword [rdi + 0x70], xmm0
movaps xmmword [rdi + 0x60], xmm0
movaps xmmword [rdi + 0x50], xmm0
movaps xmm0, xmmword [0x140155e70]
movaps xmmword [rdi], xmm0
movaps xmm0, xmmword [0x140155e80]
movaps xmmword [rdi + 0x10], xmm0
movaps xmm0, xmmword [0x140155e90]
movaps xmmword [rdi + 0x20], xmm0
movaps xmm0, xmmword [0x140155ea0]
movaps xmmword [rdi + 0x30], xmm0
movabs rax, 0x4000000000
mov qword [rdi + 0xd0], rax
xorps xmm0, xmm0
movaps xmmword [rdi + 0x40], xmm0
mov rcx, rdi
call fcn.140056ae0
mov rcx, rsi
mov rdx, rdi
call fcn.140056e30
mov r8d, 0xd8
mov rcx, rdi
xor edx, edx
call fcn.140110bf0
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.14010e4a0
mov rax, rsi
add rsp, 0x108
pop rdi
pop rsi
ret

Function at 0x1400c1ba0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rax, [0x140109540]
lea r8, [rsp + 0x28]
mov qword [r8], rax
lea rcx, [0x140179a38]
lea rdx, [0x140109530]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1400c1c81
cmp dword [0x140179a40], 0
jne 0x1400c1c46
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, dword [0x140179a44]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
je 0x1400c1c46
mov rsi, qword [rsi]
test rsi, rsi
je 0x1400c1c46
mov eax, dword [rsi + 0x200]
xor edi, edi
cmp dword [rsi + 0x204], eax
je 0x1400c1c30
shl rax, 5
mov edi, dword [rsi + rax + 0x10]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14010e4a0
mov eax, edi
add rsp, 0x38
pop rdi
pop rsi
ret
mov ecx, 0x210
call fcn.14001bfa0
test rax, rax
je 0x1400c1c86
mov rsi, rax
xor edi, edi
mov r8d, 0x210
mov rcx, rax
xor edx, edx
call fcn.140110bf0
lea r8, [0x140109000]
xor ecx, ecx
mov rdx, rsi
call fcn.140024b10
test eax, eax
jne 0x1400c1c18
jmp 0x1400c1c30
call fcn.14010cab0
xor edi, edi
jmp 0x1400c1c30
Function at 0x1400c2790
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
mov r15, r8
mov r12, rdx
mov r14, rcx
mov eax, dword [rsp + 0xe0]
mov rcx, qword [0x14016c028]
xor rcx, rsp
mov qword [rsp + 0x78], rcx
movsxd r8, dword [r14 + 0x18]
lea ecx, [rax + 4]
mov esi, ecx
shr esi, 6
xor edx, edx
mov ebx, 0
cmp rsi, r8
jae 0x1400c27e6
mov rbx, qword [r9 + rsi*8]
shr rbx, cl
shl ebx, 5
and ebx, 0x20
lea ecx, [rax + 3]
mov edi, ecx
shr edi, 6
cmp rdi, r8
jae 0x1400c2800
mov rdx, qword [r9 + rdi*8]
shr rdx, cl
shl edx, 4
and edx, 0x10
or edx, ebx
lea ecx, [rax + 2]
mov edi, ecx
shr edi, 6
xor ebx, ebx
mov esi, 0
cmp rdi, r8
jae 0x1400c2823
mov rsi, qword [r9 + rdi*8]
shr rsi, cl
shl esi, 3
and esi, 8
or edx, esi
lea ecx, [rax + 1]
mov edi, ecx
shr edi, 6
cmp rdi, r8
jae 0x1400c283f
mov rbx, qword [r9 + rdi*8]
shr rbx, cl
shl ebx, 2
and ebx, 4
or edx, ebx
mov ecx, eax
shr ecx, 6
xor ebx, ebx
cmp rcx, r8
jae 0x1400c285b
mov rbx, qword [r9 + rcx*8]
mov ecx, eax
shr rbx, cl
add ebx, ebx
and ebx, 2
or edx, ebx
test eax, eax
je 0x1400c287d
dec eax
mov ecx, eax
shr ecx, 6
xor ebx, ebx
cmp rcx, r8
jae 0x1400c287b
mov rbx, qword [r9 + rcx*8]
mov ecx, eax
shr rbx, cl
and ebx, 1
or edx, ebx
mov edi, edx
shr rdi, 5
lea eax, [rdi - 1]
neg rdi
and eax, edx
xor edx, 0x3f
mov ebx, edi
and ebx, edx
or ebx, eax
mov rax, rbx
shr rax, 1
and ebx, 1
add rbx, rax
xor esi, esi
mov r8d, 0xd8
mov rcx, r12
xor edx, edx
call fcn.140110bf0
mov r13, rbx
not r13
mov r8, rsi
xor r8, rbx
dec r8
and r8, r13
sar r8, 0x3f
mov qword [rsp + 0x20], r12
mov rcx, r14
mov rdx, r12
mov r9, r15
call fcn.1400c22b0
inc rsi
add r15, 0xd8
cmp rsi, 0x11
jne 0x1400c28b8
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdx, [rsp + 0x30]
mov qword [rdx + 0x40], rax
movaps xmm0, xmmword [0x140146a10]
movaps xmmword [rdx + 0x30], xmm0
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
lea r8, [r12 + 0x48]
mov rcx, r14
call fcn.1400c29d0
movsxd rcx, dword [r14 + 0x40]
test rcx, rcx
je 0x1400c29a6
and edi, 1
mov rax, rdi
neg rax
dec rdi
test rcx, rcx
mov r8d, 1
cmovne r8, rcx
cmp ecx, 1
jne 0x1400c294c
xor ecx, ecx
jmp 0x1400c298e
mov rdx, r8
and rdx, 0xfffffffffffffffe
xor ecx, ecx
mov rsi, qword [rsp + rcx*8 + 0x30]
and rsi, rax
mov rbx, qword [r12 + rcx*8 + 0x48]
and rbx, rdi
or rbx, rsi
mov qword [r12 + rcx*8 + 0x48], rbx
mov rbx, qword [rsp + rcx*8 + 0x38]
and rbx, rax
mov rsi, qword [r12 + rcx*8 + 0x50]
and rsi, rdi
or rsi, rbx
mov qword [r12 + rcx*8 + 0x50], rsi
add rcx, 2
cmp rdx, rcx
jne 0x1400c2955
test r8b, 1
je 0x1400c29a6
and rax, qword [rsp + rcx*8 + 0x30]
and rdi, qword [r12 + rcx*8 + 0x48]
or rdi, rax
mov qword [r12 + rcx*8 + 0x48], rdi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14010e4a0
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400cb0c2
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400cb0fd
mov eax, dword [0x14016f824]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
lea rax, [rax + 0x120]
cmp qword [rcx + 8], rax
je 0x1400cb18c
mov rcx, qword [rcx + 0x20]
jmp 0x1400cb0ce
mov rax, qword [rsi + 0x28]
cmp rax, 0x60
mov edi, 0x60
cmova rdi, rax
mov rcx, rdi
call qword [rsi + 0x48]
mov rdx, rax
xor r8d, r8d
mov qword [rax], r8
mov qword [rax + 8], 0x18
mov qword [rax + 0x10], rdi
lock add qword [rsi + 0x10], rdi
lea rcx, [rax + 0x18]
mov qword [rax + 8], 0x60
mov qword [rax + 0x18], rsi
mov edi, dword [0x14016f824]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdi*8]
lea rax, [rax + 0x120]
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], rdx
lea rax, [rdx + 0x60]
mov qword [rdx + 0x40], rax
mov rax, qword [rdx + 0x10]
add rax, rdx
mov qword [rdx + 0x48], rax
mov qword [rdx + 0x30], r8
xorps xmm0, xmm0
movups xmmword [rdx + 0x50], xmm0
mov rax, qword [rsi]
mov qword [rdx + 0x38], rax
lock cmpxchg qword [rsi], rcx
jne 0x1400cb181
mov eax, dword [0x14016f824]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
mov qword [rax + 0x128], rcx
mov rdx, qword [rsi + 0x20]
mov qword [rax + 0x120], rdx
mov qword [rsi + 8], rcx
mov rax, rcx
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400cea27
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, r8d
mov r8d, dword [rcx]
mov r9d, dword [rcx + 8]
mov r10d, r8d
xor r10d, eax
mov r11d, 0xff
and r10d, r11d
shr r8d, 8
xor r8d, dword [rdx + r10*4]
mov dword [rcx], r8d
and r8d, r11d
add r8d, dword [rcx + 4]
imul r8d, r8d, 0x8088405
inc r8d
mov dword [rcx + 4], r8d
shr r8d, 0x18
and r11d, r9d
xor r11d, r8d
shr r9d, 8
xor r9d, dword [rdx + r11*4]
mov dword [rcx + 8], r9d
ret

Function at 0x1400cfba0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x1401790e0]
cmp rsi, 1
jbe 0x1400cfbec
mov ecx, dword [0x14016f428]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
mov al, 2
and rcx, 0xfffffffffffffffc
je 0x1400cfbe5
movsxd rdx, dword [rsi]
shl rdx, 4
mov edi, dword [rcx + rdx + 8]
cmp edi, dword [rsi + 4]
jne 0x1400cfbe5
mov rcx, qword [rcx + rdx]
test rcx, rcx
je 0x1400cfbe5
mov al, byte [rcx]
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1401790e0]
call fcn.140022080
test al, al
je 0x1400cfc32
mov qword [0x1401790e8], 0
lea rdi, [0x1401790e0]
lea rsi, [0x1401790e8]
mov rcx, rsi
xor edx, edx
call fcn.14001c0a0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14000ad70
jmp 0x1400cfbb3
mov rsi, qword [0x1401790e0]
jmp 0x1400cfbb3

Function at 0x1400d1a70
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rax, [0x140109540]
lea r8, [rsp + 0x28]
mov qword [r8], rax
lea rcx, [0x140179a38]
lea rdx, [0x140109530]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1400d1b49
cmp dword [0x140179a40], 0
jne 0x1400d1b0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, dword [0x140179a44]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
je 0x1400d1b0e
mov rsi, qword [rsi]
test rsi, rsi
je 0x1400d1b0e
mov eax, dword [rsi + 0x204]
xor edi, edi
cmp eax, dword [rsi + 0x200]
jne 0x1400d1b4e
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14010e4a0
mov eax, edi
add rsp, 0x38
pop rdi
pop rsi
ret
mov ecx, 0x210
call fcn.14001bfa0
test rax, rax
je 0x1400d1b5d
mov rsi, rax
xor edi, edi
mov r8d, 0x210
mov rcx, rax
xor edx, edx
call fcn.140110bf0
lea r8, [0x140109000]
xor ecx, ecx
mov rdx, rsi
call fcn.140024b10
test eax, eax
jne 0x1400d1ae8
jmp 0x1400d1af8
call fcn.14010cab0
inc eax
and eax, 0xf
shl rax, 5
mov edi, dword [rsi + rax + 0x10]
jmp 0x1400d1af8
xor edi, edi
jmp 0x1400d1af8
Function at 0x1400d1b70
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rax, [0x140109540]
lea r8, [rsp + 0x20]
mov qword [r8], rax
lea rcx, [0x140179a38]
lea rdx, [0x140109530]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1400d1ce8
cmp dword [0x140179a40], 0
jne 0x1400d1ca4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x140179a44]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x1400d1ca4
mov rdi, qword [rdi]
test rdi, rdi
je 0x1400d1ca4
mov eax, dword [rdi + 0x200]
cmp eax, dword [rdi + 0x204]
jne 0x1400d1c4f
test rsi, rsi
je 0x1400d1c66
mov r8, qword [rsi - 8]
add rsi, 0xfffffffffffffff8
add r8, 8
mov rcx, rsi
xor edx, edx
call fcn.140110bf0
mov rdi, qword [0x14016f470]
mov rbx, qword [rdi + 0x28]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14010e4a0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov rax, rbx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp rax
shl rax, 5
lea rbx, [rdi + rax]
add rbx, 8
mov rdi, qword [rbx]
test rdi, rdi
jne 0x1400d1c7c
mov qword [rbx], rsi
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14010e4a0
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov r8, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
add r8, 8
mov rcx, rdi
xor edx, edx
call fcn.140110bf0
mov rcx, qword [0x14016f470]
mov rdx, rdi
xor r8d, r8d
call qword [rcx + 0x28]
jmp 0x1400d1c63
mov ecx, 0x210
call fcn.14001bfa0
test rax, rax
je 0x1400d1c06
mov rdi, rax
mov r8d, 0x210
mov rcx, rax
xor edx, edx
call fcn.140110bf0
lea r8, [0x140109000]
xor ecx, ecx
mov rdx, rdi
call fcn.140024b10
test eax, eax
jne 0x1400d1bf8
jmp 0x1400d1c06
call fcn.14010cab0
int3

Function at 0x1400d5390
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x110
mov rbx, r8
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x108], rax
movaps xmm0, xmmword [0x140146a10]
lea rdi, [rsp + 0xc0]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov edx, 0x20
mov rcx, r8
mov r8, rdi
call fcn.1400be5b0
and byte [rdi], 0xf8
mov al, byte [rdi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [rdi + 0x1f], al
lea r15, [rsp + 0x20]
mov r8d, 0xa0
mov rcx, r15
mov dl, 0xaa
call fcn.140110bf0
mov rcx, r15
mov rdx, rdi
call fcn.14002baa0
mov rcx, r14
mov rdx, r15
call fcn.14006b8d0
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
movups xmm0, xmmword [r14]
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.14010e4a0
nop
add rsp, 0x110
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400d6f60
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x140179aa0]
cmp rdi, 1
jbe 0x1400d6f89
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14000bdf0
lea rcx, [0x140179aa0]
call fcn.140022080
test al, al
je 0x1400d6fcf
mov qword [0x140179aa8], 0
lea rbx, [0x140179aa0]
lea rdi, [0x140179aa8]
mov rcx, rdi
xor edx, edx
call fcn.14001c0a0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14000ad70
jmp 0x1400d6f77
mov rdi, qword [0x140179aa0]
jmp 0x1400d6f77
Function at 0x1400dac60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400dac80
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret

Function at 0x1400dacc0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400dace0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret

Function at 0x1400dad20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400dad43
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x1400dada0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400dadc3
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret

Function at 0x1400dae20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400dae49
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret
Function at 0x1400daeb0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400daed9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
repz ret

Function at 0x1400daf40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400daf9f

Function at 0x1400daf90
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.1400daf90
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
repz ret

Function at 0x1400db020
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400db07f
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400db070
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
repz ret