joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140109360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14010942c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x47a5692265126f15
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x17e4cc47
movabs rdx, 0x806040a0a020a07
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xa07070009090806
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x1401093c5
movzx r9d, byte [rsp + rsi + 0x2d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x74]
mov byte [rsp + rdi + 0x2d], dl
mov byte [rsp + rsi + 0x2d], r8b
add rax, 2
cmp rax, 0xe
jge 0x1401093fc
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x14010941f
movzx r8d, byte [rsp + rdi + 0x2d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x74]
cmp rsi, 0xb
jb 0x1401093ab
jmp 0x140109413
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.140046d40
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.140059800
mov eax, edi
mov ecx, 0xb
call fcn.140059800
nop
call fcn.140057520
jmp fcn.140109360

Function at 0x140109700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1401097fd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x7516ebb42f32b252
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xaca8b175f6eb7516
mov qword [rsp + 0x40], rdx
movabs rdx, 0x10b5746e151fa2af
mov qword [rsp + 0x48], rdx
movabs rdx, 0x110504150c090e14
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1100f0d010f0b0f
mov qword [rsp + 0x26], rdx
movabs rdx, 0x60f0b0e01100f0d
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x314090815021015
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x1401097a0
movzx r9d, byte [rsp + rsi + 0x3a]
sub r9d, edx
lea edx, [r9 + 0x74]
mov byte [rsp + rdi + 0x3a], dl
lea edx, [r8 + 0x74]
mov byte [rsp + rsi + 0x3a], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x1401097cd
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x1401097f0
movzx r8d, byte [rsp + rdi + 0x3a]
sub r8d, edx
cmp rsi, 0x16
jb 0x14010977f
jmp 0x1401097e4
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x16
call fcn.140046d40
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.140059800
mov eax, edi
mov ecx, 0x16
call fcn.140059800
nop
nop dword [rax]
call fcn.140057520
jmp fcn.140109700
Function at 0x140109f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140109fec
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x9472cbe2c5939cab
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0xe07b9e94
movabs rdx, 0x10502030405050a
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x20008090a070105
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x140109f85
movzx r9d, byte [rsp + rsi + 0x2d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x45]
mov byte [rsp + rdi + 0x2d], dl
mov byte [rsp + rsi + 0x2d], r8b
add rax, 2
cmp rax, 0xe
jge 0x140109fbc
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x140109fdf
movzx r8d, byte [rsp + rdi + 0x2d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x45]
cmp rsi, 0xb
jb 0x140109f6b
jmp 0x140109fd3
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.140046d40
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.140059800
mov eax, edi
mov ecx, 0xb
call fcn.140059800
nop
call fcn.140057520
jmp fcn.140109f20

Function at 0x14010aa60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14010ab2c
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xc10a63b0b8c5071c
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0xc2f3
movabs rdx, 0x401000306080000
mov qword [rsp + 0x18], rdx
movabs rdx, 0x807020609040401
mov qword [rsp + 0x1e], rdx
xor eax, eax
jmp 0x14010aac4
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x68]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
cmp rax, 0xe
jge 0x14010aafc
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xa
jae 0x14010ab1f
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x68]
cmp rsi, 0xa
jb 0x14010aaaa
jmp 0x14010ab13
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.140046d40
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.140059800
mov eax, edi
mov ecx, 0xa
call fcn.140059800
nop
call fcn.140057520
jmp fcn.14010aa60

Function at 0x1401103a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140110458
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6c9ed0ab69a9e51a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x201020401050400
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x605
xor eax, eax
jmp 0x1401103f8
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 - 0x30]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 - 0x30]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xa
jge 0x140110428
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x14011044b
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x1401103db
jmp 0x14011043f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.140046d40
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.140059800
mov eax, edi
mov ecx, 8
call fcn.140059800
nop
call fcn.140057520
nop dword [rax]
jmp fcn.1401103a0
Function at 0x140110480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1401105a7
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x23140569d805b6db
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x6623140569d805b6
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf301739ffe207214
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd1835fe04c50a95
mov qword [rsp + 0x50], rdx
movabs rdx, 0x657079742c1c12d8
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1814111e15100c05
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xf0d1e161814111e
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x1c0313121e1a0f1b
mov qword [rsp + 0x27], rdx
movabs rdx, 0x2011a171a180919
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x1107060207000912
mov qword [rsp + 0x37], rdx
xor eax, eax
jmp 0x140110549
movzx r9d, byte [rsp + rsi + 0x3f]
sub r9d, edx
lea edx, [r9 + 0x79]
mov byte [rsp + rdi + 0x3f], dl
lea edx, [r8 + 0x79]
mov byte [rsp + rsi + 0x3f], dl
add rax, 2
cmp rax, 0x24
jge 0x140110577
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x21
jae 0x14011059a
movzx r8d, byte [rsp + rdi + 0x3f]
sub r8d, edx
cmp rsi, 0x21
jb 0x14011052c
jmp 0x14011058e
xor eax, eax
lea rbx, [rsp + 0x3f]
mov ecx, 0x21
call fcn.140046d40
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.140059800
mov eax, edi
mov ecx, 0x21
call fcn.140059800
nop
call fcn.140057520
jmp fcn.140110480
Function at 0x140114e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x140114f7b
push rbp
mov rbp, rsp
sub rsp, 0xa8
movabs rdx, 0x9376241f203a0f5a
mov qword [rsp + 0x71], rdx
movabs rdx, 0x7040757396691593
mov qword [rsp + 0x78], rdx
movabs rdx, 0x469575744d86472
mov qword [rsp + 0x80], rdx
movabs rdx, 0xf561101dfc2d7c55
mov qword [rsp + 0x88], rdx
movabs rdx, 0xd453fc6ff84674ea
mov qword [rsp + 0x90], rdx
movabs rdx, 0x3b4474d5f72adc3c
mov qword [rsp + 0x98], rdx
movabs rdx, 0x441e6d376e15cee2
mov qword [rsp + 0xa0], rdx
movabs rdx, 0xa0d0e071c011607
mov qword [rsp + 0x1f], rdx
lea rdi, [rsp + 0x21]
lea rsi, [0x1401cc9f2]
nop word [rax + rax]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.140059e1a
mov rbp, qword [rbp]
xor eax, eax
jmp 0x140114f11
movzx r9d, byte [rsp + rsi + 0x71]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x30]
mov byte [rsp + rdi + 0x71], dl
mov byte [rsp + rsi + 0x71], r8b
add rax, 2
cmp rax, 0x52
jge 0x140114f48
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x37
jae 0x140114f6e
movzx r8d, byte [rsp + rdi + 0x71]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x30]
nop dword [rax + rax]
cmp rsi, 0x37
jb 0x140114ef7
jmp 0x140114f62
xor eax, eax
lea rbx, [rsp + 0x71]
mov ecx, 0x37
call fcn.140046d40
add rsp, 0xa8
pop rbp
ret
mov eax, esi
mov ecx, 0x37
call fcn.140059800
mov eax, edi
mov ecx, 0x37
call fcn.140059800
nop
nop dword [rax + rax]
call fcn.140057520
jmp fcn.140114e20

Function at 0x140114fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1401150bd
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xe0621c65e8f161ed
mov qword [rsp + 0x41], rdx
movabs rdx, 0xe66e69e9740a8063
mov qword [rsp + 0x49], rdx
movabs rdx, 0x558686161ccd9e6
mov qword [rsp + 0x50], rdx
movabs rdx, 0xda6fefe3cd984e46
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1b111b1705161a18
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x15050f1e1b111b17
mov qword [rsp + 0x21], rdx
movabs rdx, 0x13070f00170c0207
mov qword [rsp + 0x29], rdx
movabs rdx, 0x3090707061019
mov qword [rsp + 0x31], rdx
movabs rdx, 0x130a1607050c1c1a
mov qword [rsp + 0x39], rdx
xor eax, eax
jmp 0x140115060
movzx r9d, byte [rsp + rsi + 0x41]
sub r9d, edx
lea edx, [r9 - 0x5b]
mov byte [rsp + rdi + 0x41], dl
lea edx, [r8 - 0x5b]
mov byte [rsp + rsi + 0x41], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x14011508d
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x1401150b0
movzx r8d, byte [rsp + rdi + 0x41]
sub r8d, edx
cmp rsi, 0x1f
jb 0x14011503d
jmp 0x1401150a4
xor eax, eax
lea rbx, [rsp + 0x41]
mov ecx, 0x1f
call fcn.140046d40
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1f
call fcn.140059800
mov eax, edi
mov ecx, 0x1f
call fcn.140059800
nop
nop dword [rax]
call fcn.140057520
jmp fcn.140114fa0
Function at 0x140115d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140115e78
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x6120ab61476e396a
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x72cfc03b6120ab61
mov qword [rsp + 0x50], rdx
movabs rdx, 0xa223c6ed0d67327
mov qword [rsp + 0x58], rdx
movabs rdx, 0x652bb66d6f632067
mov qword [rsp + 0x60], rdx
movabs rdx, 0x56314e5175352078
mov qword [rsp + 0x68], rdx
movabs rdx, 0x30100050c09120c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x91223070f190703
mov qword [rsp + 0x24], rdx
movabs rdx, 0x190a0a090a070322
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x70f010f0e1122
mov qword [rsp + 0x34], rdx
movabs rdx, 0xf12210813210c05
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x121a1e1109200823
mov qword [rsp + 0x44], rdx
xor eax, eax
jmp 0x140115e18
movzx r9d, byte [rsp + rsi + 0x4c]
sub r9d, edx
lea edx, [r9 + 0x74]
mov byte [rsp + rdi + 0x4c], dl
lea edx, [r8 + 0x74]
mov byte [rsp + rsi + 0x4c], dl
add rax, 2
cmp rax, 0x30
jge 0x140115e48
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x140115e6b
movzx r8d, byte [rsp + rdi + 0x4c]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x24
jb 0x140115dfb
jmp 0x140115e5f
xor eax, eax
lea rbx, [rsp + 0x4c]
mov ecx, 0x24
call fcn.140046d40
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x24
call fcn.140059800
mov eax, edi
mov ecx, 0x24
call fcn.140059800
nop
call fcn.140057520
nop dword [rax]
jmp fcn.140115d40

Function at 0x14011ade0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14011af18
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0xe1e84ccdc8e39c66
mov qword [rsp + 0x45], rdx
movabs rdx, 0xd1724be1e84ccdc8
mov qword [rsp + 0x48], rdx
movabs rdx, 0x8b3db2d34795b640
mov qword [rsp + 0x50], rdx
movabs rdx, 0xea72ce6639d6dabb
mov qword [rsp + 0x58], rdx
movabs rdx, 0x20b21f63cc665720
mov qword [rsp + 0x60], rdx
movabs rdx, 0x140813201a1f0510
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xb0e1e0406010207
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1f1c0b0e1e040601
mov qword [rsp + 0x25], rdx
movabs rdx, 0x16101c0d0b1a1f11
mov qword [rsp + 0x2d], rdx
movabs rdx, 0x15100c2114120a1f
mov qword [rsp + 0x35], rdx
movabs rdx, 0x18130d0e1c0e0f03
mov qword [rsp + 0x3d], rdx
xor eax, eax
jmp 0x14011aeb5
movzx r9d, byte [rsp + rsi + 0x45]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x73]
mov byte [rsp + rdi + 0x45], dl
mov byte [rsp + rsi + 0x45], r8b
add rax, 2
cmp rax, 0x2a
jge 0x14011aee8
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x23
jae 0x14011af0b
movzx r8d, byte [rsp + rdi + 0x45]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x73]
nop
cmp rsi, 0x23
jb 0x14011ae9b
jmp 0x14011aeff
xor eax, eax
lea rbx, [rsp + 0x45]
mov ecx, 0x23
call fcn.140046d40
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x23
call fcn.140059800
mov eax, edi
mov ecx, 0x23
call fcn.140059800
nop
call fcn.140057520
nop dword [rax]
jmp fcn.14011ade0
Function at 0x14011e6c0
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x14011e73a
mov rax, 0
nop word [rax + rax]
nop dword [rax]
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x14011e6f0
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x14011e710
cmp rdx, 0
je 0x14011e75c
test rdx, 0xf
je 0x14011e6dd
test rdx, 7
jne 0x14011e710
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x14011e6dd
ret
Function at 0x1401268a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x1401268df
jb 0x1401268f4
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x140126960
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x140126a34
jb 0x140126a93
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.140126840
aeskeygenassist xmm1, xmm0, 1
call fcn.140126860
aeskeygenassist xmm1, xmm2, 2
call fcn.140126840
aeskeygenassist xmm1, xmm0, 2
call fcn.140126860
aeskeygenassist xmm1, xmm2, 4
call fcn.140126840
aeskeygenassist xmm1, xmm0, 4
call fcn.140126860
aeskeygenassist xmm1, xmm2, 8
call fcn.140126840
aeskeygenassist xmm1, xmm0, 8
call fcn.140126860
aeskeygenassist xmm1, xmm2, 0x10
call fcn.140126840
aeskeygenassist xmm1, xmm0, 0x10
call fcn.140126860
aeskeygenassist xmm1, xmm2, 0x20
call fcn.140126840
aeskeygenassist xmm1, xmm0, 0x20
call fcn.140126860
aeskeygenassist xmm1, xmm2, 0x40
call fcn.140126840
jmp 0x140126b01
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.1401267a0
aeskeygenassist xmm1, xmm2, 2
call fcn.140126800
aeskeygenassist xmm1, xmm2, 4
call fcn.1401267a0
aeskeygenassist xmm1, xmm2, 8
call fcn.140126800
aeskeygenassist xmm1, xmm2, 0x10
call fcn.1401267a0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.140126800
aeskeygenassist xmm1, xmm2, 0x40
call fcn.1401267a0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.140126800
jmp 0x140126b01
aeskeygenassist xmm1, xmm0, 1
call fcn.140126760
aeskeygenassist xmm1, xmm0, 2
call fcn.140126760
aeskeygenassist xmm1, xmm0, 4
call fcn.140126760
aeskeygenassist xmm1, xmm0, 8
call fcn.140126760
aeskeygenassist xmm1, xmm0, 0x10
call fcn.140126760
aeskeygenassist xmm1, xmm0, 0x20
call fcn.140126760
aeskeygenassist xmm1, xmm0, 0x40
call fcn.140126760
aeskeygenassist xmm1, xmm0, 0x80
call fcn.140126760
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.140126760
aeskeygenassist xmm1, xmm0, 0x36
call fcn.140126760
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x140126b0e
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret
Function at 0x140129220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14012945f
push rbp
mov rbp, rsp
sub rsp, 0x78
mov qword [rsp + 0x88], rax
nop word [rax + rax]
cmp rbx, 0x40
jne 0x140129445
mov qword [rsp + 0x88], rax
lea rax, [0x1401a0840]
call fcn.14000c820
mov qword [rsp + 0x70], rax
mov dword [rax + 0x140], 0x3d
mov rbx, qword [rsp + 0x88]
cmp rax, rbx
je 0x140129292
mov ecx, 0x40
nop
call fcn.14005a180
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x88]
lea rdx, [rax + 0x40]
lea rsi, [0x1401ae80f]
nop dword [rax]
cmp rsi, rdx
je 0x1401292c2
mov rax, rdx
mov rbx, rsi
mov ecx, 0x100
call fcn.14005a180
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x88]
xor ecx, ecx
jmp 0x1401292cd
mov byte [rax + rdx + 0x40], cl
inc rcx
cmp rcx, 0x40
jge 0x1401293b4
movzx edx, byte [rbx + rcx]
nop dword [rax + rax]
cmp dl, 0xa
je 0x140129356
cmp dl, 0xd
je 0x140129356
movzx esi, byte [rax + rdx + 0x40]
cmp sil, 0xff
je 0x1401292c6
movabs rdx, 0x34bc65a63d05aa9c
mov qword [rsp + 0x18], rdx
movabs rdx, 0x9381e430c6c49b4d
mov qword [rsp + 0x20], rdx
movabs rdx, 0x5e04c21b9381e430
mov qword [rsp + 0x24], rdx
movabs rdx, 0xf8c8f326ad4f6a99
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x2c01841e6bf5b2
mov qword [rsp + 0x34], rdx
movabs rdx, 0xe5151e4c48cc0ee9
mov qword [rsp + 0x3c], rdx
xor eax, eax
jmp 0x140129419
movabs rdx, 0xbb4590576460b861
mov qword [rsp + 0x44], rdx
movabs rdx, 0x10d2d870fb10a9ac
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x408d11ee10d2d870
mov qword [rsp + 0x50], rdx
movabs rdx, 0x6ac401382d8ca55
mov qword [rsp + 0x58], rdx
movabs rdx, 0xd01078c611f6fa44
mov qword [rsp + 0x60], rdx
movabs rdx, 0xb843c3160b4f2d59
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x1401293d4
add rsp, 0x78
pop rbp
ret
lea rdx, [0x1401ac515]
movzx esi, byte [rax + rdx]
movzx edi, byte [rsp + rax + 0x44]
sub edi, esi
mov byte [rsp + rax + 0x44], dil
inc rax
cmp rax, 0x2c
jl 0x1401293ba
xor eax, eax
lea rbx, [rsp + 0x44]
mov ecx, 0x2c
call fcn.140046d40
call fcn.14000a180
mov rbx, rax
lea rax, [0x140183fa0]
call fcn.140030e80
lea rdx, [0x1401ac541]
movzx esi, byte [rax + rdx]
movzx edi, byte [rsp + rax + 0x18]
sub edi, esi
mov byte [rsp + rax + 0x18], dil
inc rax
cmp rax, 0x2c
jl 0x1401293ff
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x2c
call fcn.140046d40
call fcn.14000a180
mov rbx, rax
lea rax, [0x140183fa0]
nop
call fcn.140030e80
call fcn.14012a1c0
call fcn.14000a180
mov rbx, rax
lea rax, [0x140183fa0]
call fcn.140030e80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140057520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.140129220
Function at 0x14012d240
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14012d994
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x14012d26d
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x14012d4f1
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x14012d51d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x1401cf900]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
nop dword [rax]
call fcn.14012dba0
call fcn.14000a180
mov rbx, rax
lea rax, [0x140183fa0]
call fcn.140030e80
inc rax
nop dword [rax]
cmp rax, r8
jge 0x14012d54e
mov r9, qword [rsi + rax*8]
xor r10d, r10d
jmp 0x14012d583
lea rdi, [0x140184020]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x14012d263
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x14012d567
jmp 0x14012d539
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.140057520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.14012d240

Function at 0x14012db20
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x14012db37
inc rax
cmp rax, 4
jge 0x14012db4f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x14012db34
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x14012db60
inc rax
cmp rax, 4
jge 0x14012db6e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x14012db97
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x14012db7b
jmp 0x14012db5d