joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015c70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 0xf
mov dword [rsp + 0x40], ebp
jbe 0x140015ca1
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x140015d3d
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140015d0f
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140015d0a
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140015dd9
mov rcx, r8
call fcn.1400262cc
mov al, 1
mov byte [rdi], bpl
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], rbp
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140026270
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x140015d7d
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140015d79
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140015d74
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140015dd9
mov rcx, r8
call fcn.1400262cc
xor al, al
jmp 0x140015d11
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0x296b0
mov qword [rsp + 0x20], rbp
lea rdx, [0x1400300b0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x140015dc6
cmp rax, 0xf
jbe 0x140015d79
lea rdx, [rax + 1]
jmp 0x140015d50
cmp rax, 0xf
jbe 0x140015d0f
lea rdx, [rax + 1]
jmp 0x140015ce2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400167a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
sub rsp, 0x278
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbp, r8
lea rax, [rsp + 0x30]
xor ebx, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov r9d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140016927
mov qword [rsp + 0x270], rsi
lea rcx, [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 0x208
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140016916
lea rcx, [rsp + 0x40]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], bx
jne 0x140016850
test rax, rax
je 0x1400168ef
mov qword [rsp + 0x268], rdi
mov rcx, rbx
mov qword [rsp + 0x260], r14
lea r14, str.abcdef012345789
nop dword [rax]
lea rdi, [rsp + 0x40]
lea rdi, [rdi + rcx*2]
movzx ecx, word [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswxdigit]
test eax, eax
je 0x1400168bd
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [r14 + rcx*2], 0
jne 0x1400168a5
xor edx, edx
div rcx
movzx eax, word [r14 + rdx*2]
mov word [rdi], ax
inc ebx
lea rdx, [rsp + 0x40]
mov ecx, ebx
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400168d0
cmp rcx, rax
jb 0x140016880
mov r14, qword [rsp + 0x260]
mov rdi, qword [rsp + 0x268]
mov eax, dword [rsp + 0x38]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rsp + 0x40]
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140026270
add rsp, 0x278
pop rbp
pop rbx
ret
Function at 0x140016950
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
mov eax, 0x2058
call fcn.1400271e0
sub rsp, rax
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rbp, r8
lea rax, [rsp + 0x30]
xor ebx, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov r9d, 0xf003f
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140016ab9
mov qword [rsp + 0x2070], rsi
lea rcx, [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
xor edx, edx
mov r8d, 0x1ffe
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 0x1ffe
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140016aa8
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x140016a85
mov qword [rsp + 0x2088], rdi
mov qword [rsp + 0x2050], r14
lea r14, str.abcdef012345789
nop dword [rax]
mov eax, ebx
lea rdi, [rsp + 0x40]
movzx ecx, word [rdi + rax*2]
lea rdi, [rdi + rax*2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswxdigit]
test eax, eax
je 0x140016a6b
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp word [r14 + rcx*2], 0
jne 0x140016a50
dec rcx
xor edx, edx
div rcx
movzx eax, word [r14 + rdx*2]
mov word [rdi], ax
mov eax, dword [rsp + 0x38]
inc ebx
cmp ebx, eax
jb 0x140016a20
mov r14, qword [rsp + 0x2050]
mov rdi, qword [rsp + 0x2088]
mov dword [rsp + 0x28], eax
mov r9d, 7
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x2070]
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.140026270
add rsp, 0x2058
pop rbp
pop rbx
ret

Function at 0x140016ae0
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, r8
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
xor r8d, r8d
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140016b77
xor eax, eax
mov qword [rsp + 0x78], rbx
mov rbx, qword [rsp + 0x30]
mov dword [rsp + 0x3c], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x38], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x28], 8
mov r9d, 0xb
mov dword [rsp + 0x3c], eax
xor r8d, r8d
lea rax, [rsp + 0x38]
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140026270
add rsp, 0x50
pop rdi
ret
Function at 0x140016b90
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
sub rsp, 0x58
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, r8
lea rax, [rsp + 0x38]
xor ebx, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x38], rbx
mov r9d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140016c88
mov qword [rsp + 0x88], rsi
lea rax, [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov rcx, rsi
xor r8d, r8d
mov qword [rsp + 0x50], rdi
mov rdx, rbp
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140016c72
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x140016c72
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x140016c4b
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x140016c3c
dec eax
or eax, 0xffffff00
inc eax
mov ecx, ebx
inc ebx
mov byte [rcx + rdi], al
mov ecx, dword [rsp + 0x30]
cmp ebx, ecx
jb 0x140016c26
mov dword [rsp + 0x28], ecx
mov r9d, 3
mov rcx, rsi
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140026270
add rsp, 0x58
pop rbp
pop rbx
ret
Function at 0x1400250a0
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
lea r13, [rsp + 0x78]
movabs rsi, 0x7a5db90d33787107
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], r13
mov rbx, qword [r13]
xor rbx, rsi
mov qword [rsp + 0x28], rbx
xor edi, edi
mov qword [r13], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r12, rax
mov dword [rsp + 0x20], edi
mov r10, qword [0x14005a0c8]
test r10, r10
jne 0x1400252ad
mov ebx, edi
mov r11d, 0xdec02e1e
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov rbp, qword [rcx]
mov rsi, rbp
nop dword [rax]
movups xmm0, xmmword [rsi + 0x58]
movd eax, xmm0
sub ax, 8
test ebx, ebx
je 0x14002518c
psrldq xmm0, 8
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
mov edx, 0xe56f887c
cmp rcx, r8
je 0x140025184
nop
movsx eax, byte [rcx]
xor eax, edx
imul edx, eax, 0xfff5db
add rcx, 2
cmp rcx, r8
jne 0x140025170
cmp edx, ebx
jne 0x14002527e
mov r9, qword [rsi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rcx, qword [rax + r9 + 0x88]
mov r15, rcx
shr r15, 0x20
mov edi, ecx
add rdi, r9
cmp rdi, r9
je 0x14002527e
mov r8d, dword [rdi + 0x18]
test r8d, r8d
je 0x14002527e
mov r14d, dword [rdi + 0x20]
dec r8d
lea rax, [r14 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0xe56f887c
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400251f6
nop
movsx eax, al
xor eax, edx
imul edx, eax, 0xfff5db
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1400251e0
cmp edx, r11d
je 0x140025202
test r8d, r8d
jne 0x1400251c2
jmp 0x14002527e
mov ecx, dword [rdi + 0x1c]
add rcx, r9
mov eax, dword [rdi + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
cmp r10, rdi
jbe 0x140025297
lea rax, [r15 + rdi]
cmp r10, rax
jae 0x140025297
mov ebx, 0xe56f887c
mov r11d, ebx
movzx eax, byte [r10]
cmp al, 0x2e
je 0x140025256
nop dword [rax + rax]
movsx eax, al
xor eax, ebx
imul ebx, eax, 0xfff5db
inc r10
movzx eax, byte [r10]
cmp al, 0x2e
jne 0x140025240
inc r10
movzx eax, byte [r10]
test al, al
je 0x14002527a
movsx eax, al
xor eax, r11d
imul r11d, eax, 0xfff5db
lea r10, [r10 + 1]
movzx eax, byte [r10]
test al, al
jne 0x140025261
mov rsi, qword [rbp]
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x140025294
cmp qword [rax + 0x30], 0
jne 0x140025140
xor r10d, r10d
mov qword [0x14005a0c8], r10
mov rbx, qword [rsp + 0x28]
movabs rsi, 0x7a5db90d33787107
lea r9, [rsp + 0x20]
mov edx, 0x1000
mov r8d, 0x40
mov rcx, r12
call r10
mov eax, 0x5a4d
cmp word [r12], ax
je 0x1400252d6
xor rbx, rsi
xor al, al
jmp 0x1400252e0
xor eax, eax
mov word [r12], ax
xor rbx, rsi
mov qword [r13], rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140026270
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140025310
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
lea rax, [rsp + 0x68]
movabs rcx, 0x7a5db90d33787107
mov qword [r11 - 0x38], rcx
mov qword [r11 - 0x30], rax
mov rbx, qword [rax]
xor rbx, rcx
mov qword [r11 - 0x40], rbx
mov qword [rax], 0
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r12, rax
mov r10, qword [0x14005a108]
test r10, r10
jne 0x140025513
xor ebx, ebx
mov r11d, 0xcfa41893
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov rbp, qword [rcx]
mov rsi, rbp
nop
movups xmm0, xmmword [rsi + 0x58]
movd eax, xmm0
sub ax, 8
test ebx, ebx
je 0x1400253fc
psrldq xmm0, 8
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
mov edx, 0x69b496f5
cmp rcx, r8
je 0x1400253f4
nop
movsx eax, byte [rcx]
xor eax, edx
imul edx, eax, 0xfff5db
add rcx, 2
cmp rcx, r8
jne 0x1400253e0
cmp edx, ebx
jne 0x1400254ee
mov r9, qword [rsi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rcx, qword [rax + r9 + 0x88]
mov r15, rcx
shr r15, 0x20
mov edi, ecx
add rdi, r9
cmp rdi, r9
je 0x1400254ee
mov r8d, dword [rdi + 0x18]
test r8d, r8d
je 0x1400254ee
mov r14d, dword [rdi + 0x20]
dec r8d
lea rax, [r14 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x69b496f5
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140025466
nop
movsx eax, al
xor eax, edx
imul edx, eax, 0xfff5db
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140025450
cmp edx, r11d
je 0x140025472
test r8d, r8d
jne 0x140025432
jmp 0x1400254ee
mov ecx, dword [rdi + 0x1c]
add rcx, r9
mov eax, dword [rdi + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
cmp r10, rdi
jbe 0x140025507
lea rax, [r15 + rdi]
cmp r10, rax
jae 0x140025507
mov ebx, 0x69b496f5
mov r11d, ebx
movzx eax, byte [r10]
cmp al, 0x2e
je 0x1400254c6
nop dword [rax + rax]
movsx eax, al
xor eax, ebx
imul ebx, eax, 0xfff5db
inc r10
movzx eax, byte [r10]
cmp al, 0x2e
jne 0x1400254b0
inc r10
movzx eax, byte [r10]
test al, al
je 0x1400254ea
movsx eax, al
xor eax, r11d
imul r11d, eax, 0xfff5db
lea r10, [r10 + 1]
movzx eax, byte [r10]
test al, al
jne 0x1400254d1
mov rsi, qword [rbp]
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x140025504
cmp qword [rax + 0x30], 0
jne 0x1400253b0
xor r10d, r10d
mov qword [0x14005a108], r10
mov rbx, qword [rsp + 0x28]
lea r9, [rsp + 0x20]
mov edx, 0x1000
mov r8d, pe_nt_image_headers64
mov rcx, r12
call r10
xor edx, edx
mov r8d, 0x1000
mov rcx, r12
call sub.VCRUNTIME140.dll_memset
nop
movabs rax, 0x7a5db90d33787107
xor rbx, rax
lea rax, [rsp + 0x68]
mov qword [rax], rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140026270
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140026f30
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140026f7a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140026f7a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140026f7a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140026f7a
cmp dword [rcx + 0x84], 0xe
jbe 0x140026f7a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140026f7c
xor al, al
add rsp, 0x28
ret
Function at 0x1400455c0
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x1400455e0
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, bh
movzx edi, ch
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, dh
shr ecx, 0x10
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, dh
movzx edi, ah
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
mov edx, dword [r15 + 0xc]
movzx edi, bh
movzx ebp, ch
mov eax, dword [r15]
xor r12d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 1]
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
sub r13d, 1
jne 0x1400455e0
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi*8 + 2]
movzx r11d, byte [r14 + rdi*8 + 2]
movzx r12d, byte [r14 + rbp*8 + 2]
movzx esi, dl
movzx edi, bh
movzx ebp, ch
movzx r8d, byte [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and edi, 0xff00
and ebp, 0xff00
xor r10d, edi
xor r11d, ebp
shr ecx, 0x10
movzx esi, dh
movzx edi, ah
shr edx, 0x10
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
and esi, 0xff00
and edi, 0xff00
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and esi, 0xff0000
and edi, 0xff0000
and ebp, 0xff0000
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, dh
movzx ebp, ah
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8 + 2]
mov ebp, dword [r14 + rbp*8 + 2]
and esi, 0xff0000
and edi, 0xff000000
and ebp, 0xff000000
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, bh
movzx edi, ch
mov edx, dword [r15 + 0x1c]
mov esi, dword [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8 + 2]
mov eax, dword [r15 + 0x10]
and esi, 0xff000000
and edi, 0xff000000
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret
Function at 0x140045a20
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
endbr64
mov rax, rsp
push rbx
push rbp
push r12
push r13
push r14
push r15
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rax
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x1400473c0]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
call fcn.1400457b0
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi - 0x30]
mov r14, qword [rsi - 0x28]
mov r13, qword [rsi - 0x20]
mov r12, qword [rsi - 0x18]
mov rbp, qword [rsi - 0x10]
mov rbx, qword [rsi - 8]
lea rsp, [rsi]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret

Function at 0x140045a2d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
endbr64
mov rax, rsp
push rbx
push rbp
push r12
push r13
push r14
push r15
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rax
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x1400473c0]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
call fcn.1400457b0
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi - 0x30]
mov r14, qword [rsi - 0x28]
mov r13, qword [rsi - 0x20]
mov r12, qword [rsi - 0x18]
mov rbp, qword [rsi - 0x10]
mov rbx, qword [rsi - 8]
lea rsp, [rsi]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x140045b00
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x140045b20
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, dh
movzx edi, ah
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, bh
shr eax, 0x10
movzx ebp, ch
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr ecx, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, bh
movzx edi, ch
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
movzx esi, dh
mov edx, dword [r15 + 0xc]
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 1]
mov eax, dword [r15]
xor r8d, dword [r14 + rbp*8 + 1]
xor eax, r10d
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor ecx, r12d
xor ebx, r11d
xor edx, r8d
sub r13d, 1
jne 0x140045b20
lea r14, [r14 + 0x800]
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi]
movzx r11d, byte [r14 + rdi]
movzx r12d, byte [r14 + rbp]
movzx esi, dl
movzx edi, dh
movzx ebp, ah
movzx r8d, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl edi, 8
shl ebp, 8
xor r10d, edi
xor r11d, ebp
shr edx, 0x10
movzx esi, bh
movzx edi, ch
shr eax, 0x10
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
shl esi, 8
shl edi, 8
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr ecx, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl esi, 0x10
shl edi, 0x10
shl ebp, 0x10
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, bh
movzx ebp, ch
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl esi, 0x10
shl edi, 0x18
shl ebp, 0x18
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, dh
movzx edi, ah
mov edx, dword [r15 + 0x1c]
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
mov eax, dword [r15 + 0x10]
shl esi, 0x18
shl edi, 0x18
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
lea r14, [r14 - 0x800]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret