joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140037980
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14005e010]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12, rdx
mov r14, rcx
mov qword [rbp - 0x38], rcx
xor r13d, r13d
mov dword [rbp - 0x40], r13d
mov dword [rbp - 0x30], r13d
mov qword [rcx], r13
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], 0xf
mov byte [rcx], r13b
xor r8d, r8d
lea rdx, [0x140046ba6]
call fcn.14003f4a0
mov dword [rbp - 0x40], 1
mov rsi, 0xffffffffffffffff
mov rdi, rsi
nop dword [rax]
inc rdi
cmp byte [r12 + rdi], 0
jne 0x1400379f0
test edi, edi
je 0x140037b9b
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, edi
mov rcx, r12
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov eax, dword [rbp - 0x30]
test eax, eax
je 0x140037b04
xorps xmm0, xmm0
mov r15d, eax
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r13
cmp rax, 0x1000
jb 0x140037a6b
lea rcx, [rax + 0x27]
cmp rcx, rax
jbe 0x140037bc2
call fcn.140043934
mov rcx, rax
test rax, rax
je 0x140037af8
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140037a73
mov rcx, r15
call fcn.140043934
mov qword [rbp - 0x28], rax
lea rbx, [rax + r15]
mov qword [rbp - 0x18], rbx
mov r8, r15
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rbp - 0x20], rbx
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x28]
mov r8d, 1
mov edx, edi
mov rcx, r12
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov rdx, qword [rbp - 0x28]
inc rsi
cmp byte [rdx + rsi], 0
jne 0x140037ab2
mov r8, rsi
mov rcx, r14
call fcn.14003f4a0
nop
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140037b04
mov rdx, qword [rbp - 0x18]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037aff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140037aff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140043618
mov rcx, r14
call fcn.14003ed50
cmp rax, 0xffffffffffffffff
je 0x140037b9b
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], 0
mov r8d, 2
lea rdx, [0x140046c6c]
lea rcx, [rbp - 0x28]
call fcn.14003f4a0
nop
mov rcx, r14
call fcn.14003ed50
mov qword [rsp + 0x20], r13
mov r8, qword [rbp - 0x18]
mov rdx, rax
mov rcx, r14
call fcn.14003f2e0
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140037b04
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037aff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140037aff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, r14
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140043070
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14002c430
int3
Function at 0x1400380e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4a], 0
je 0x140038103
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x49
jb 0x1400380f0
mov byte [rcx + 0x4a], 0
mov rax, rcx
ret

Function at 0x140038110
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6f], 0
je 0x140038133
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x6e
jb 0x140038120
mov byte [rcx + 0x6f], 0
mov rax, rcx
ret
Function at 0x140038840
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3b], 0
je 0x140038863
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3a
jb 0x140038850
mov byte [rcx + 0x3b], 0
mov rax, rcx
ret
Function at 0x140039700
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x40], 0
je 0x140039723
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3f
jb 0x140039710
mov byte [rcx + 0x40], 0
mov rax, rcx
ret

Function at 0x140039730
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5d], 0
je 0x140039753
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5c
jb 0x140039740
mov byte [rcx + 0x5d], 0
mov rax, rcx
ret

Function at 0x140039760
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x58], 0
je 0x140039783
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x57
jb 0x140039770
mov byte [rcx + 0x58], 0
mov rax, rcx
ret

Function at 0x140039790
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xaf], 0
je 0x1400397b8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xae
jb 0x1400397a0
mov byte [rcx + 0xaf], 0
mov rax, rcx
ret

Function at 0x1400397c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x76], 0
je 0x1400397e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x75
jb 0x1400397d0
mov byte [rcx + 0x76], 0
mov rax, rcx
ret

Function at 0x1400397f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x60], 0
je 0x140039813
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5f
jb 0x140039800
mov byte [rcx + 0x60], 0
mov rax, rcx
ret
Function at 0x14003d4d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x68], 0
je 0x14003d4f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x67
jb 0x14003d4e0
mov byte [rcx + 0x68], 0
ret

Function at 0x14003d500
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa2], 0
je 0x14003d528
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa1
jb 0x14003d510
mov byte [rcx + 0xa2], 0
ret

Function at 0x14003d530
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3d], 0
je 0x14003d553
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3c
jb 0x14003d540
mov byte [rcx + 0x3d], 0
ret

Function at 0x14003d560
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x28], 0
je 0x14003d583
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x27
jb 0x14003d570
mov byte [rcx + 0x28], 0
ret

Function at 0x14003d590
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x14003d5b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x11
jb 0x14003d5a0
mov byte [rcx + 0x12], 0
ret

Function at 0x14003d5c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x22], 0
je 0x14003d5e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x21
jb 0x14003d5d0
mov byte [rcx + 0x22], 0
ret

Function at 0x14003d5f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x8f], 0
je 0x14003d618
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x8e
jb 0x14003d600
mov byte [rcx + 0x8f], 0
ret

Function at 0x14003d620
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2c], 0
je 0x14003d643
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2b
jb 0x14003d630
mov byte [rcx + 0x2c], 0
ret

Function at 0x14003d650
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2e], 0
je 0x14003d673
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2d
jb 0x14003d660
mov byte [rcx + 0x2e], 0
ret

Function at 0x14003d680
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x46], 0
je 0x14003d6a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x45
jb 0x14003d690
mov byte [rcx + 0x46], 0
ret

Function at 0x14003d6b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x34], 0
je 0x14003d6d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x33
jb 0x14003d6c0
mov byte [rcx + 0x34], 0
ret

Function at 0x14003d6e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2b], 0
je 0x14003d703
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2a
jb 0x14003d6f0
mov byte [rcx + 0x2b], 0
ret
Function at 0x14003d710
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1f], 0
je 0x14003d733
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1e
jb 0x14003d720
mov byte [rcx + 0x1f], 0
ret

Function at 0x14003d740
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5f], 0
je 0x14003d763
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5e
jb 0x14003d750
mov byte [rcx + 0x5f], 0
ret

Function at 0x14003d770
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x14003d793
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xd
jb 0x14003d780
mov byte [rcx + 0xe], 0
ret

Function at 0x14003d7a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x14003d7c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x14003d7b0
mov byte [rcx + 0xd], 0
ret

Function at 0x14003d7d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x40], 0
je 0x14003d7f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3f
jb 0x14003d7e0
mov byte [rcx + 0x40], 0
ret

Function at 0x14003d800
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x14003d823
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x14003d810
mov byte [rcx + 5], 0
ret

Function at 0x14003d830
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x68], 0
je 0x14003d855
xor eax, eax
mov r8d, 0x2907
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x33
jb 0x14003d840
mov byte [rcx + 0x68], 0
ret

Function at 0x14003d860
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x22], 0
je 0x14003d885
xor eax, eax
mov r8d, 0x2907
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x10
jb 0x14003d870
mov byte [rcx + 0x22], 0
ret

Function at 0x14003d890
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x14003d8b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x14003d8a0
mov byte [rcx + 4], 0
ret

Function at 0x14003d8c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x16], 0
je 0x14003d8e5
xor eax, eax
mov r8d, 0x2907
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0xa
jb 0x14003d8d0
mov byte [rcx + 0x16], 0
ret

Function at 0x14003d8f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x25], 0
je 0x14003d913
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x24
jb 0x14003d900
mov byte [rcx + 0x25], 0
ret

Function at 0x14003d920
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x14003d943
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x14003d930
mov byte [rcx + 3], 0
ret
Function at 0x14003d9b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x14003d9d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x14003d9c0
mov byte [rcx + 0xb], 0
ret

Function at 0x14003d9e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
je 0x14003da03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x18
jb 0x14003d9f0
mov byte [rcx + 0x19], 0
ret

Function at 0x14003da10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x37], 0
je 0x14003da33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x36
jb 0x14003da20
mov byte [rcx + 0x37], 0
ret

Function at 0x14003da40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2a], 0
je 0x14003da63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x29
jb 0x14003da50
mov byte [rcx + 0x2a], 0
ret

Function at 0x14003da70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x15], 0
je 0x14003da93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x14
jb 0x14003da80
mov byte [rcx + 0x15], 0
ret

Function at 0x14003daa0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1b], 0
je 0x14003dac3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1a
jb 0x14003dab0
mov byte [rcx + 0x1b], 0
ret

Function at 0x14003dad0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x17], 0
je 0x14003daf3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x16
jb 0x14003dae0
mov byte [rcx + 0x17], 0
ret

Function at 0x14003db00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x14003db23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x14003db10
mov byte [rcx + 0xa], 0
ret

Function at 0x14003db30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x14003db53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x17
jb 0x14003db40
mov byte [rcx + 0x18], 0
ret

Function at 0x14003db60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x14003db85
xor eax, eax
mov r8d, 0x2907
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 4
jb 0x14003db70
mov byte [rcx + 0xa], 0
ret
Function at 0x140042cc0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140042d21
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140042ce0
mov ecx, dword [r10]
jmp 0x140042e0a
cmp ecx, 0x4e0
jb 0x140042e0a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140042d40
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140042d90
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1400028c0
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x1400028e0
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, bh
movzx edi, ch
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, dh
shr ecx, 0x10
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, dh
movzx edi, ah
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
mov edx, dword [r15 + 0xc]
movzx edi, bh
movzx ebp, ch
mov eax, dword [r15]
xor r12d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 1]
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
sub r13d, 1
jne 0x1400028e0
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi*8 + 2]
movzx r11d, byte [r14 + rdi*8 + 2]
movzx r12d, byte [r14 + rbp*8 + 2]
movzx esi, dl
movzx edi, bh
movzx ebp, ch
movzx r8d, byte [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and edi, 0xff00
and ebp, 0xff00
xor r10d, edi
xor r11d, ebp
shr ecx, 0x10
movzx esi, dh
movzx edi, ah
shr edx, 0x10
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
and esi, 0xff00
and edi, 0xff00
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and esi, 0xff0000
and edi, 0xff0000
and ebp, 0xff0000
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, dh
movzx ebp, ah
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8 + 2]
mov ebp, dword [r14 + rbp*8 + 2]
and esi, 0xff0000
and edi, 0xff000000
and ebp, 0xff000000
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, bh
movzx edi, ch
mov edx, dword [r15 + 0x1c]
mov esi, dword [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8 + 2]
mov eax, dword [r15 + 0x10]
and esi, 0xff000000
and edi, 0xff000000
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret
Function at 0x140002d20
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
endbr64
mov rax, rsp
push rbx
push rbp
push r12
push r13
push r14
push r15
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rax
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x1400046c0]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
call fcn.140002ab0
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi - 0x30]
mov r14, qword [rsi - 0x28]
mov r13, qword [rsi - 0x20]
mov r12, qword [rsi - 0x18]
mov rbp, qword [rsi - 0x10]
mov rbx, qword [rsi - 8]
lea rsp, [rsi]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret

Function at 0x140002d2d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
endbr64
mov rax, rsp
push rbx
push rbp
push r12
push r13
push r14
push r15
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rax
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x1400046c0]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
call fcn.140002ab0
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi - 0x30]
mov r14, qword [rsi - 0x28]
mov r13, qword [rsi - 0x20]
mov r12, qword [rsi - 0x18]
mov rbp, qword [rsi - 0x10]
mov rbx, qword [rsi - 8]
lea rsp, [rsi]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x140002e00
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x140002e20
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, dh
movzx edi, ah
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, bh
shr eax, 0x10
movzx ebp, ch
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr ecx, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, bh
movzx edi, ch
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
movzx esi, dh
mov edx, dword [r15 + 0xc]
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 1]
mov eax, dword [r15]
xor r8d, dword [r14 + rbp*8 + 1]
xor eax, r10d
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor ecx, r12d
xor ebx, r11d
xor edx, r8d
sub r13d, 1
jne 0x140002e20
lea r14, [r14 + 0x800]
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi]
movzx r11d, byte [r14 + rdi]
movzx r12d, byte [r14 + rbp]
movzx esi, dl
movzx edi, dh
movzx ebp, ah
movzx r8d, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl edi, 8
shl ebp, 8
xor r10d, edi
xor r11d, ebp
shr edx, 0x10
movzx esi, bh
movzx edi, ch
shr eax, 0x10
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
shl esi, 8
shl edi, 8
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr ecx, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl esi, 0x10
shl edi, 0x10
shl ebp, 0x10
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, bh
movzx ebp, ch
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl esi, 0x10
shl edi, 0x18
shl ebp, 0x18
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, dh
movzx edi, ah
mov edx, dword [r15 + 0x1c]
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
mov eax, dword [r15 + 0x10]
shl esi, 0x18
shl edi, 0x18
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
lea r14, [r14 - 0x800]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret