joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140043f90
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rsi, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x140189028]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [r8 + 0x17]
test al, al
jns 0x140043fc3
mov rax, qword [rsi + 8]
test rax, rax
je 0x1400440bb
mov eax, ebx
not eax
test eax, 0x300
je 0x1400440bb
cmp edi, 2
lea rax, [0x14019f220]
lea rcx, [0x14019f420]
cmove rcx, rax
cmp word [rcx], 0
jne 0x1400440bb
xorps xmm0, xmm0
lea r14, [rsp + 0x40]
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [r14], 0
je 0x1400440bb
cmp byte [0x14019f210], 0
setne al
bt ebx, 8
jb 0x1400440bb
shr ebx, 9
and ebx, 1
or bl, al
je 0x1400440bb
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea r12, str.SOFTWARE
cmove r12, rax
movzx ebp, byte [rsi + 0x17]
test bpl, bpl
jns 0x140044117
mov r14, qword [rsi]
mov rbp, qword [rsi + 8]
mov edi, 1
xor ebx, ebx
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
mov r15, qword [r12 + 8]
mov r13, rbp
sub r13, r15
jb 0x1400440a8
mov rdx, qword [r12]
mov rcx, r14
mov r8, r15
call fcn.1400cc954
test eax, eax
je 0x1400440da
add r12, 0x28
inc rbx
cmp rbx, rdi
jb 0x140044088
cmp dword [rsp + 0x2c], 0
jne 0x14004411f
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400b51f0
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movzx ecx, word [r14 + r15*2]
cmp ecx, 0x5c
je 0x1400440e8
test ecx, ecx
jne 0x1400440a8
lea rax, [r14 + r15*2]
mov edx, dword [r12 + 0x10]
mov dword [rsp + 0x2c], edx
cmp edx, 1
je 0x140044148
cmp dword [rsp + 0x2c], 2
jne 0x140044159
lea rdx, str.WOW6432Node
mov qword [rsp + 0x38], rdx
mov rdx, rax
mov qword [rsp + 0x30], rax
jmp 0x140044159
mov r14, rsi
jmp 0x14004406b
cmp byte [rsi + 0x17], 0
mov rax, rsi
jns 0x14004412b
mov rax, qword [rsi]
mov rdx, qword [rsp + 0x30]
sub rdx, rax
sar rdx, 1
mov rcx, rsi
mov r8, qword [rsp + 0x38]
call fcn.1400fdb60
jmp 0x1400440bb
lea rdx, str.WOW6432Node_
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r14
cmp cx, 0x5c
jne 0x140044172
lea r14, [rax + 2]
dec r13
cmp word [rax + 2], 0x5c
mov rax, r14
je 0x14004415f
jmp 0x140044175
mov r14, rax
mov rdi, qword [r12 + 0x20]
mov r12, qword [r12 + 0x18]
xor ebx, ebx
mov rbp, r13
jmp 0x1400440af
Function at 0x1400466b0
Capabilities:
Set thread local storage value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x140189028]
xor rax, rsp
mov qword [rsp + 0x50], rax
test rcx, rcx
je 0x1400468cc
movabs rax, 0xe69e32f3ad9ea63
cmp qword [0x14018c770], rax
jne 0x1400468cf
mov rsi, rcx
mov r14d, dword [rcx + 0xc]
add r14, 0x518
mov byte [rsp + 0x3f], 0xaa
mov dl, byte [rcx + 2]
mov rcx, r14
call fcn.14008a5d0
movzx eax, ax
lea r12, [rax + rax*4]
lea r15, [rsi + r12*8]
add r15, 0x48
lea rbx, [rsi + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14004688e
mov rax, qword [r15]
mov rdi, qword [rax]
test rdi, rdi
je 0x14004681c
mov byte [rsp + 0x3f], 0
mov rcx, qword [rdi]
test rcx, rcx
je 0x140046887
lea rdx, [rsi + r12*8]
bswap rcx
mov r14d, dword [rdx + 0x60]
mov rdx, rcx
xor rdx, rdi
cmp rdx, 0x1fffff
ja 0x14004689b
mov edx, ecx
and edx, 0x1fc000
je 0x14004689b
prefetcht0 byte [rcx]
mov qword [rax], rcx
mov ecx, dword [rax + 0x18]
lea edx, [rcx + 2]
and edx, 0x3ffe
and ecx, 0xffffc001
or ecx, edx
mov dword [rax + 0x18], ecx
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0x18]
add rax, qword [rsi + 0x1498]
mov qword [rsi + 0x1498], rax
mov rcx, qword [rsi + 0x14a0]
cmp rcx, rax
cmova rax, rcx
mov qword [rsi + 0x14a0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, rdi
mov rdx, rsi
call fcn.14008cd20
mov ecx, dword [0x14019f850]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x140198954]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x120], rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400b51f0
mov rax, rdi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, [rsp + 0x3f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x4000
mov rcx, r15
mov rdx, rsi
mov r8d, 2
mov r9, r14
call fcn.140092cd0
test rax, rax
je 0x1400468d2
mov rdi, rax
mov rcx, rax
and rcx, 0xffffffffffe00000
mov rdx, rax
shr rdx, 9
and edx, 0xfe0
lea rax, [rdx + rcx]
movzx ecx, byte [rdx + rcx + 0x101e]
and ecx, 0x3f
shl rcx, 5
sub rax, rcx
add rax, 0x1000
jmp 0x140046797
xor ecx, ecx
jmp 0x14004677d
mov rcx, rbx
call fcn.14008d980
jmp 0x14004672e
movaps xmm0, xmmword [0x140165260]
lea rsi, [rsp + 0x40]
movaps xmmword [rsi], xmm0
mov r8, qword [rdi]
lea rdx, str.first
mov rcx, rsi
call fcn.14010abd0
mov rcx, rsi
call fcn.140019c10
mov rcx, r14
call fcn.14010ac40
int3
int3
xor edi, edi
jmp 0x1400467c1
Function at 0x1400475b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x140189028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 4
lea r9, [rsp + 0x3c]
mov dword [r9], eax
lea r8, [rsp + 0x38]
mov dword [r8], eax
lea rax, [rsp + 0x34]
mov dword [rax], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140047638
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x140047622
cmp dword [rsp + 0x38], 4
jne 0x140047622
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400b51f0
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret
mov edi, eax
jmp 0x140047622

Function at 0x140047640
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.1400b5190
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140189028]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r14, [rsp + 0x840]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.1400b7320
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140047703
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x140047707
lea rcx, [rsp + 0x840]
call fcn.1400d3030
lea rdx, [rsp + 0x840]
mov rcx, rsi
mov r8, rax
call fcn.14002b9f0
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400b51f0
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x1400476e4
cmp eax, 2
jne 0x140047763
lea rdi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.1400b7320
lea rcx, [rsp + 0x840]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x14004775c
lea rcx, [rsp + 0x40]
call fcn.1400d3030
lea rdx, [rsp + 0x40]
jmp 0x1400476d7
mov edi, 0xea
jmp 0x1400476e4
mov edi, 0x3f4
jmp 0x1400476e4
Function at 0x1400481d0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x140198794]
cmp ecx, 0xffffffff
je 0x140048299
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x140048299
mov eax, dword [0x1401a1d58]
mov ecx, dword [0x140198954]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400482a3
mov rbx, qword [0x1401a1d50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1400482e9
mov rax, qword [0x1401a0548]
inc rax
xor ecx, ecx
lea rdx, [0x1401a0550]
lea r8d, [rax + rcx]
movzx r8d, r8b
lea r9, [r8 + r8*2]
cmp dword [rdx + r9*8], 0
jne 0x1400482f6
lea rax, [rdx + r9*8]
mov dword [rax], 1
mov qword [rax + 8], rdi
mov qword [0x1401a0548], r8
mov qword [rsi], r8
mov eax, dword [rax + 0x10]
mov dword [rsi + 8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp qword [rsi], 0x100
jae 0x14004830b
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140048310
jmp 0x1400481fa
lea rcx, [0x1401a1d58]
call fcn.1400b3f20
cmp dword [0x1401a1d58], 0xffffffff
jne 0x14004821f
mov ecx, 8
call fcn.1400b3dc4
mov rbx, rax
mov rcx, rax
call fcn.140082530
mov qword [0x1401a1d50], rbx
lea rcx, [0x1401a1d58]
call fcn.1400b3fb8
jmp 0x14004821f
mov rcx, rbx
call fcn.140082540
jmp 0x140048237
inc rcx
cmp rcx, 0x100
jne 0x14004824a
jmp 0x14004827f
int3

Function at 0x140048310
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.1400b5190
sub rsp, rax
mov rax, qword [0x140189028]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x140198794]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
je 0x1400483c4
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x140048402
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.1400b7320
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.1400b3e3c
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.1400b6c70
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1400b51f0
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x2c]
call fcn.1400570a0
test al, al
je 0x140048405
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
je 0x140048408
mov eax, 0xffffffff
lock cmpxchg dword [0x140198794], ecx
je 0x140048348
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x140198794]
mov dword [rsp + 0x2c], ecx
jmp 0x140048348
int3
int3
lea rcx, [rsp + 0x2c]
call fcn.1400570a0
test al, al
je 0x14004842d
cmp dword [rsp + 0x2c], 0xffffffff
je 0x14004842d
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
jmp 0x1400483db
int3
Function at 0x1400492b0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov esi, ecx
call fcn.14004b730
test al, al
jne 0x140049338
call fcn.14004b700
movzx edx, al
mov ecx, esi
call fcn.14003bf60
mov eax, dword [0x1401a1dd8]
mov ecx, dword [0x140198954]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140049307
movsxd rdx, esi
inc rdx
lea rcx, [0x1401a1dc8]
add rsp, 0x20
pop rsi
jmp fcn.14008e800
lea rcx, [0x1401a1dd8]
call fcn.1400b3f20
cmp dword [0x1401a1dd8], 0xffffffff
jne 0x1400492f0
lea rcx, [0x1401a1dc8]
xor edx, edx
call fcn.140048510
lea rcx, [0x1401a1dd8]
call fcn.1400b3fb8
jmp 0x1400492f0
mov edx, 3
jmp 0x1400492c8

Function at 0x140049340
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov esi, ecx
call fcn.14003bf60
mov eax, dword [0x1401a1dd8]
mov ecx, dword [0x140198954]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140049384
movsxd rdx, esi
inc rdx
lea rcx, [0x1401a1dc8]
add rsp, 0x20
pop rsi
jmp fcn.14008e800
lea rcx, [0x1401a1dd8]
call fcn.1400b3f20
cmp dword [0x1401a1dd8], 0xffffffff
jne 0x14004936d
lea rcx, [0x1401a1dc8]
xor edx, edx
call fcn.140048510
lea rcx, [0x1401a1dd8]
call fcn.1400b3fb8
jmp 0x14004936d

Function at 0x140049780
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x1401a1ee8]
cmp rdi, 1
jbe 0x1400497a9
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14008e800
lea rcx, [0x1401a1ee8]
call fcn.140057240
test al, al
je 0x1400497ee
xorps xmm0, xmm0
movups xmmword [0x1401a1ef0], xmm0
lea rbx, [0x1401a1ee8]
lea rdi, [0x1401a1ef0]
mov rcx, rdi
xor edx, edx
call fcn.140048510
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140057300
jmp 0x140049797
mov rdi, qword [0x1401a1ee8]
jmp 0x140049797
Function at 0x14004cd70
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
cmp rdx, r9
mov r10, r9
cmovb r10, rdx
xor eax, eax
test r10, r10
je 0x14004cde1
xor r11d, r11d
mov rdi, qword [r8 + r11*8]
mov rsi, qword [rcx + r11*8]
mov rbx, rsi
xor rbx, rdi
mov r14d, eax
lea rax, [rbx - 1]
mov r15, rsi
sub r15, rdi
xor r15, rsi
or r15, rbx
not rbx
and rax, rbx
sar rax, 0x3f
xor r15, rsi
sar r15, 0x3f
mov rsi, r15
not r15
and r15d, 1
or r15, rsi
mov rsi, rax
and r14d, esi
not rax
and rax, r15
or rax, r14
inc r11
cmp r10, r11
jne 0x14004cd8b
cmp rdx, r9
jb 0x14004cdf0
ja 0x14004ce1c
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor ecx, ecx
or rcx, qword [r8 + rdx*8]
inc rdx
cmp r9, rdx
jne 0x14004cdf2
mov rdx, rcx
not rdx
dec rcx
and rcx, rdx
sar rcx, 0x3f
mov rdx, rcx
and edx, eax
not rcx
or ecx, edx
mov eax, ecx
jmp 0x14004cde8
xor r8d, r8d
or r8, qword [rcx + r9*8]
inc r9
cmp rdx, r9
jne 0x14004ce1f
mov rcx, r8
not rcx
dec r8
and r8, rcx
sar r8, 0x3f
mov rcx, r8
and ecx, eax
not r8
and r8d, 1
or r8d, ecx
mov eax, r8d
jmp 0x14004cde8
Function at 0x14004e850
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rdx
movsxd rdx, dword [rdx + 8]
test rdx, rdx
je 0x14004e996
mov rsi, rcx
mov rax, qword [rdi]
cmp rdx, 2
mov ecx, 1
cmovae rcx, rdx
xor r8d, r8d
xor r9d, r9d
or r9, qword [rax + r8*8]
inc r8
cmp rcx, r8
jne 0x14004e880
test r9, r9
je 0x14004e996
test edx, edx
jle 0x14004e9bb
mov rax, qword [rdi]
test byte [rax], 1
je 0x14004e9bb
cmp dword [rdi + 0x10], 0
jne 0x14004ea12
cmp edx, 0x401
jae 0x14004ea32
lea rbx, [rsi + 0x18]
cmp rbx, rdi
je 0x14004e903
mov rcx, rbx
call fcn.14004c440
test eax, eax
je 0x14004e9db
movsxd r8, dword [rdi + 8]
test r8, r8
je 0x14004ea72
shl r8, 3
mov rcx, qword [rbx]
mov rdx, qword [rdi]
call fcn.1400b6c70
mov eax, dword [rdi + 8]
mov dword [rsi + 0x20], eax
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x28], eax
mov rdi, rbx
test rdi, rdi
je 0x14004e9db
mov eax, dword [rsi + 0x20]
test eax, eax
jle 0x14004e9fb
mov rdx, qword [rbx]
lea rcx, [rax - 1]
cmp qword [rdx + rax*8 - 8], 0
mov rax, rcx
je 0x14004e90f
inc ecx
mov dword [rsi + 0x20], ecx
mov rax, qword [rbx]
mov rax, qword [rax]
mov r9d, 1
mov edx, 0x40
xor ecx, ecx
movabs r8, 0x8000000000000000
mov r10d, r9d
and r10d, 1
neg r10
mov r11, rax
and r11, r10
mov rdi, r11
xor rdi, r9
shr rdi, 1
and r11, r9
add r11, rdi
and r10, r8
shr rcx, 1
or rcx, r10
mov r9, r11
dec rdx
jne 0x14004e94b
mov qword [rsi + 0x30], rcx
mov qword [rsi + 0x38], 0
mov esi, 1
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov dword [rsp + 0x20], 0xa4
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x69
call fcn.14013e890
jmp 0x14004e98c
mov dword [rsp + 0x20], 0xa8
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x68
jmp 0x14004e9b4
mov dword [rsp + 0x20], 0xb6
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x44
jmp 0x14004e9b4
mov dword [rsi + 0x20], eax
test eax, eax
jne 0x14004e92e
mov dword [rsi + 0x28], 0
jmp 0x14004e92e
mov dword [rsp + 0x20], 0xac
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x6d
jmp 0x14004e9b4
mov r8d, 0x400
xor ecx, ecx
or rcx, qword [rax + r8*8]
inc r8
cmp rdx, r8
jne 0x14004ea3a
test rcx, rcx
je 0x14004e8bf
mov dword [rsp + 0x20], 0xb0
lea r9, str....._third_party_boringssl_srccrypto_fipsmodule_bnmontgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x66
jmp 0x14004e9b4
xor eax, eax
jmp 0x14004e8f7
Function at 0x14004ee70
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov r12, qword [rsp + 0xb0]
mov rax, qword [0x140189028]
xor rax, rsp
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
test r12, r12
je 0x14004efae
mov ecx, dword [r12 + 0x2c]
call fcn.140095900
test rax, rax
je 0x14004efc6
mov r15, rax
xor ecx, ecx
call fcn.140095940
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r12
mov rax, qword [r12 + 0x10]
lea rcx, [0x140129050]
cmp rax, rcx
jne 0x14004efb6
xorps xmm0, xmm0
movups xmmword [r15 + 0x5c], xmm0
movups xmmword [r15 + 0x50], xmm0
movups xmmword [r15 + 0x40], xmm0
movups xmmword [r15 + 0x30], xmm0
movups xmmword [r15 + 0x20], xmm0
movaps xmm0, xmmword [0x140171290]
movups xmmword [r15], xmm0
movaps xmm0, xmmword [0x1401712a0]
movups xmmword [r15 + 0x10], xmm0
mov dword [r15 + 0x6c], 0x20
lea r15, [rsp + 0x30]
mov rax, qword [r15]
mov rax, qword [rax + 0x18]
mov rcx, r15
mov rdx, r14
mov r8, rbx
call qword [0x1401b1008]
mov rax, qword [r15]
mov rax, qword [rax + 0x20]
mov rcx, r15
mov rdx, rdi
call qword [0x1401b1008]
mov rax, qword [r15]
test rsi, rsi
je 0x14004ef68
mov ecx, dword [rax + 4]
mov dword [rsi], ecx
mov edx, dword [rax + 0x2c]
mov rcx, qword [rsp + 0x38]
call fcn.140095980
mov esi, 1
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call fcn.140095940
mov rax, qword [rsp + 0x48]
test rax, rax
jne 0x14004efed
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400b51f0
mov eax, esi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor r15d, r15d
jmp 0x14004eedd
lea rcx, [rsp + 0x30]
call qword [0x1401b1008]
jmp 0x14004ef2d
mov dword [rsp + 0x20], 0xd2
lea r9, str....._third_party_boringssl_srccrypto_fipsmoduledigestdigest.c
xor edi, edi
mov ecx, 0x1d
xor edx, edx
mov r8d, 0x41
call fcn.14013e890
xor esi, esi
jmp 0x14004ef7f
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [0x1401b1008]
jmp 0x14004ef91

Function at 0x14004f050
Capabilities:
Hash data using sha256

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
cmp qword [rcx], rdx
je 0x14004f082
mov ecx, dword [rdi + 0x2c]
call fcn.140095900
test rax, rax
je 0x14004f0e3
mov rbx, rax
mov rcx, qword [rsi + 8]
call fcn.140095940
mov qword [rsi + 8], rbx
mov qword [rsi], rdi
mov rax, qword [rdi + 0x10]
lea rcx, [0x140129050]
cmp rax, rcx
jne 0x14004f0d8
mov rax, qword [rsi + 8]
xorps xmm0, xmm0
movups xmmword [rax + 0x5c], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x140171290]
movups xmmword [rax], xmm0
movaps xmm0, xmmword [0x1401712a0]
movups xmmword [rax + 0x10], xmm0
mov dword [rax + 0x6c], 0x20
mov esi, 1
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
call qword [0x1401b1008]
jmp 0x14004f0c9
mov dword [rsp + 0x20], 0xd2
lea r9, str....._third_party_boringssl_srccrypto_fipsmoduledigestdigest.c
xor esi, esi
mov ecx, 0x1d
xor edx, edx
mov r8d, 0x41
call fcn.14013e890
jmp 0x14004f0ce
Function at 0x14004f1a0
Capabilities:
Hash data using sha256

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 0x10], 0
jne 0x14004f1d7
mov rcx, qword [rsp + 0x80]
mov rdx, r9
call fcn.140060b60
mov qword [rdi + 0x10], rax
test rax, rax
je 0x14004f2ea
mov ebp, dword [rsp + 0x88]
lea rcx, [0x1401a2080]
lea rdx, [0x1400532d0]
call fcn.1400a0540
lea rax, [0x1401a2088]
mov qword [rdi + 0x18], rax
mov rcx, qword [rdi + 0x10]
cmp ebp, 1
jne 0x14004f2ee
call fcn.140060e90
test eax, eax
je 0x14004f2ea
test rbx, rbx
je 0x14004f22f
mov rcx, qword [rdi + 0x10]
mov rdx, rbx
call fcn.1400552e0
test eax, eax
je 0x14004f2ea
mov rax, qword [rdi + 0x10]
mov rax, qword [rax]
test ebp, ebp
je 0x14004f2f8
add rax, 0x38
cmp qword [rax], 0
je 0x14004f2c1
test rbx, rbx
je 0x14004f301
cmp qword [rdi], rbx
je 0x14004f27a
mov ecx, dword [rbx + 0x2c]
call fcn.140095900
test rax, rax
je 0x14004f321
mov r14, rax
mov rcx, qword [rdi + 8]
call fcn.140095940
mov qword [rdi + 8], r14
mov qword [rdi], rbx
mov rax, qword [rbx + 0x10]
lea rcx, [0x140129050]
cmp rax, rcx
jne 0x14004f2df
mov rax, qword [rdi + 8]
xorps xmm0, xmm0
movups xmmword [rax + 0x5c], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x140171290]
movups xmmword [rax], xmm0
movaps xmm0, xmmword [0x1401712a0]
movups xmmword [rax + 0x10], xmm0
mov dword [rax + 0x6c], 0x20
mov ebx, 1
test rsi, rsi
je 0x14004f2d2
mov rax, qword [rdi + 0x10]
mov qword [rsi], rax
mov eax, ebx
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov rcx, rdi
call qword [0x1401b1008]
jmp 0x14004f2c1
xor ebx, ebx
jmp 0x14004f2d2
call fcn.14013ea20
jmp 0x14004f20e
add rax, 0x28
jmp 0x14004f242
mov dword [rsp + 0x20], 0x6d
lea r9, str....._third_party_boringssl_srccrypto_fipsmoduledigestsigndigestsign.c
xor ebx, ebx
mov ecx, 6
xor edx, edx
mov r8d, 0x77
jmp 0x14004f33f
mov dword [rsp + 0x20], 0xd2
lea r9, str....._third_party_boringssl_srccrypto_fipsmoduledigestdigest.c
xor ebx, ebx
mov ecx, 0x1d
xor edx, edx
mov r8d, 0x41
call fcn.14013e890
jmp 0x14004f2d2
Function at 0x140051c70
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rax, qword [0x140189028]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp r8, 0x30
ja 0x140051dbd
mov r14, r8
mov r15, rdx
mov rsi, rcx
movaps xmm0, xmmword [0x140165260]
lea rdi, [rsp + 0x40]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi - 0x10], xmm0
movaps xmmword [rdi - 0x20], xmm0
lea r12, [rsp + 0x30]
lea rbx, [rcx + 0x108]
mov eax, dword [rcx + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rcx + 0x114], eax
mov rax, qword [rcx + 0xf8]
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r8, rsi
call qword [0x1401b1008]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, r12
mov r8, rsi
call qword [0x1401b1008]
mov eax, dword [rsi + 0x114]
bswap eax
inc eax
bswap eax
mov dword [rsi + 0x114], eax
mov rax, qword [rsi + 0xf8]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [0x1401b1008]
test r14, r14
je 0x140051d53
xor eax, eax
mov cl, byte [r15 + rax]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp r14, rax
jne 0x140051d43
lea r14, [rsi + 0xf8]
mov eax, dword [0x1401a2444]
lea rcx, [rsp + 0x20]
mov edx, 0x100
mov r8, rsi
bt eax, 0x19
jae 0x140051dc1
call fcn.140003260
lea rax, [0x140001d60]
test r14, r14
je 0x140051d8e
lea rcx, section..text
mov qword [r14], rcx
mov qword [rsi + 0x100], rax
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
mov esi, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400b51f0
mov eax, esi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor esi, esi
jmp 0x140051da0
bt eax, 9
jae 0x140051de1
call fcn.140004450
lea rax, [0x140004920]
test r14, r14
je 0x140051d8e
lea rcx, [0x140004620]
jmp 0x140051d8b
call fcn.1401149f0
lea rax, [0x1401151f0]
test r14, r14
je 0x140051d8e
lea rcx, [0x1401148b0]
jmp 0x140051d8b