joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ed330
Capabilities:
Hash data using sha256

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
lea rax, [0x010a8600]
movdqa xmm0, xmmword [0x00d542d0]
lea rsi, [rsp + 0x20]
test r8, r8
mov rbx, r8
mov r9, rcx
lea r8, [rsi + 0x20]
cmove rbx, rax
mov ecx, 9
xor eax, eax
mov rdi, r8
movaps xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [0x00d542e0]
rep stosq qword [rdi], rax
movaps xmmword [rsp + 0x30], xmm0
mov dword [rdi], 0
mov dword [rsp + 0x8c], 0x20
test rdx, rdx
je 0x7ed3a2
mov r8, rdx
mov rcx, rsi
mov rdx, r9
call fcn.007ec9c0
mov rdx, rsi
mov rcx, rbx
call fcn.007ed030
mov edx, 0x70
mov rcx, rsi
call fcn.0081b4c0
mov rax, rbx
add rsp, 0x90
pop rbx
pop rsi
pop rdi
ret

Function at 0x7edde0
Capabilities:
Hash data using sha512

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x100
movdqa xmm0, xmmword [0x00d543b0]
lea rax, [0x010a8640]
movaps xmmword [rsp + 0x20], xmm0
mov rbx, r8
test r8, r8
mov rsi, rcx
movdqa xmm0, xmmword [0x00d543c0]
cmove rbx, rax
mov rbp, rdx
movabs rax, 0x4000000000
mov qword [rsp + 0xf0], rax
lea r12, [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [0x00d543d0]
movaps xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [0x00d543e0]
movaps xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
test rdx, rdx
je 0x7edec9
mov rax, rdx
lea r12, [rsp + 0x20]
shr rax, 0x3d
mov qword [rsp + 0x68], rax
lea rax, [rdx*8]
mov qword [rsp + 0x60], rax
cmp rdx, 0x7f
ja 0x7edef2
mov edx, ebp
lea rdi, [r12 + 0x50]
cmp ebp, 8
jb 0x7ede95
mov ecx, ebp
shr ecx, 3
rep movsq qword [rdi], qword [rsi]
xor eax, eax
test dl, 4
je 0x7edea5
mov eax, dword [rsi]
mov dword [rdi], eax
mov eax, 4
test dl, 2
je 0x7edeb6
movzx ecx, word [rsi + rax]
mov word [rdi + rax], cx
add rax, 2
and edx, 1
je 0x7edec2
movzx edx, byte [rsi + rax]
mov byte [rdi + rax], dl
mov dword [rsp + 0xf0], ebp
mov rdx, r12
mov rcx, rbx
call fcn.007ed520
mov edx, 0xd8
mov rcx, r12
call fcn.0081b4c0
mov rax, rbx
add rsp, 0x100
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8, rdx
mov rdx, rcx
mov rcx, r12
shr r8, 7
call fcn.008c7000
mov rax, rbp
and eax, 0x7f
je 0x7edec9
sub rbp, rax
add rsi, rbp
mov rbp, rax
jmp 0x7ede81

Function at 0x7f6260
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
mov dword [rbx], eax
setne al
movzx eax, al
add rsp, 0x20
pop rbx
ret

Function at 0x7f6280
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [rbx]
mov esi, eax
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov ecx, esi
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x7f62b0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.DLL_TlsSetValue]
test eax, eax
setne al
movzx eax, al
add rsp, 0x28
ret
Function at 0x80ae90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
movsxd r8, r8d
mov rsi, rcx
mov rdi, rdx
mov rbx, r8
call sub.msvcrt.dll_memcmp
test eax, eax
jle 0x80af5b
lea ecx, [rbx - 1]
test ebx, ebx
jle 0x80b00e
movzx eax, byte [rdi]
cmp byte [rsi], al
jne 0x80b012
mov r9d, ecx
mov eax, 1
add r9, 1
jmp 0x80aee2
movzx edx, byte [rsi + rax]
add rax, 1
cmp dl, byte [rdi + rax - 1]
jne 0x80aeea
mov r8d, eax
cmp rax, r9
jne 0x80aed4
movsxd rax, ecx
cmp byte [rsi + rax], 0
jne 0x80af90
cmp byte [rdi + rax], 0xff
jne 0x80af90
lea eax, [rbx - 2]
cdqe
jmp 0x80af21
cmp byte [rsi + rax], 0
jne 0x80af90
sub rax, 1
cmp byte [rdi + rax + 1], 0xff
jne 0x80af90
mov ecx, eax
test eax, eax
jns 0x80af10
cmp r8d, ecx
jg 0x80af9a
movsxd rax, r8d
movzx ecx, byte [rsi + rax]
movzx r9d, byte [rdi + rax]
mov edx, ecx
xor edx, r9d
cmp dl, 0xf
je 0x80b007
ja 0x80af70
cmp dl, 3
je 0x80aff0
cmp dl, 7
je 0x80afd5
cmp dl, 1
je 0x80afb0
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
cmp dl, 0x3f
je 0x80b000
cmp dl, 0x7f
je 0x80afe0
mov eax, 0xffffffff
cmp dl, 0x1f
jne 0x80af60
mov eax, 3
jmp 0x80afb5
cmp r8d, ecx
jl 0x80af5b
cmp r8d, ecx
jle 0x80af2c
lea eax, [r8*8]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov eax, 7
mov r10d, r9d
not r10d
test r10b, cl
jne 0x80af5b
not ecx
and ecx, r9d
cmp dl, cl
jne 0x80af5b
lea eax, [rax + r8*8]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov eax, 5
jmp 0x80afb5
mov eax, 1
jmp 0x80afb5
mov eax, 6
jmp 0x80afb5
mov eax, 2
jmp 0x80afb5
mov eax, 4
jmp 0x80afb5
test ecx, ecx
js 0x80b01a
xor r8d, r8d
jmp 0x80aeea
xor eax, eax
jmp 0x80af60

Function at 0x81b520
Capabilities:
Encode data using xor

Disassembly:
xor rax, rax
xor r10, r10
cmp r8, 0
je 0x81b56d
cmp r8, 0x10
jne 0x81b550
mov r10, qword [rcx]
mov r11, qword [rcx + 8]
mov r8, 1
xor r10, qword [rdx]
xor r11, qword [rdx + 8]
or r10, r11
cmovne rax, r8
repz ret
mov r10b, byte [rcx]
lea rcx, [rcx + 1]
xor r10b, byte [rdx]
lea rdx, [rdx + 1]
or al, r10b
dec r8
jne 0x81b550
neg rax
shr rax, 0x3f
repz ret
Function at 0x81c600
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov ebp, dword [rsp + 0xb0]
mov rsi, rcx
mov r13, rdx
mov r12, r8
mov ecx, 0x20
mov r8d, 0x5cb
lea rdx, str.engines_e_capi.c
mov edi, r9d
call fcn.007a1c30
mov rbx, rax
test rax, rax
je 0x81c706
cmp edi, 1
je 0x81c720
test rsi, rsi
je 0x81c6b9
cmp dword [rsi], 1
jle 0x81c6b9
cmp qword [rsi + 8], 0
je 0x81c6b9
mov rcx, r13
call fcn.0081bdd0
mov rcx, r12
mov r14, rax
call fcn.0081bdd0
mov dword [rsp + 0x20], edi
mov r8, r14
mov rcx, rsi
mov r15, rax
mov r9, rax
lea rdx, str.capi_get_key__contname_s__provname_s__type_d_n
call fcn.0081b920
mov r8d, 0x5df
lea rdx, str.engines_e_capi.c
mov rcx, r15
call fcn.007a1c00
mov r8d, 0x5e0
lea rdx, str.engines_e_capi.c
mov rcx, r14
call fcn.007a1c00
mov eax, dword [rsi + 0x38]
mov edx, 0x20
lea rcx, [rbx + 8]
mov r9d, edi
mov r8, r12
and eax, 0x20000
cmovne eax, edx
mov rdx, r13
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x81c760
mov rcx, qword [rbx + 8]
lea r8, [rbx + 0x10]
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptGetUserKey]
test eax, eax
je 0x81c7e0
mov dword [rbx + 0x18], ebp
mov qword [rbx], 0
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [0x010a8720]
test eax, eax
je 0x81c64f
lea rdx, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
mov rcx, r12
call sub.msvcrt.dll_wcscmp
mov edx, 0x18
test eax, eax
lea rax, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
cmove edi, edx
cmove r12, rax
jmp 0x81c64f
mov ecx, dword [0x010a873c]
test ecx, ecx
je 0x81c850
mov r8d, 0x68
mov edx, 0x67
lea rsi, [rsp + 0x36]
mov dword [rsp + 0x20], 0x5e6
lea r9, str.engines_e_capi.c
call fcn.00780b20
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea r8, [0x00d59ba1]
mov edx, 0xa
mov rcx, rsi
mov r9d, eax
call fcn.0074af70
mov r8, rsi
mov ecx, 2
lea rdx, str.Error_code_0x
call fcn.00782930
mov rcx, rbx
mov r8d, 0x5f5
lea rdx, str.engines_e_capi.c
xor ebx, ebx
call fcn.007a1c00
jmp 0x81c706
mov ecx, dword [0x010a873c]
test ecx, ecx
je 0x81c862
mov r8d, 0x75
mov edx, 0x67
lea rsi, [rsp + 0x36]
mov dword [rsp + 0x20], 0x5eb
lea r9, str.engines_e_capi.c
call fcn.00780b20
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rcx, rsi
mov edx, 0xa
lea r8, [0x00d59ba1]
mov r9d, eax
call fcn.0074af70
mov r8, rsi
mov ecx, 2
lea rdx, str.Error_code_0x
call fcn.00782930
mov rcx, qword [rbx + 8]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x81c7c3
call fcn.007826d0
mov ecx, eax
mov dword [0x010a873c], eax
jmp 0x81c76e
call fcn.007826d0
mov ecx, eax
mov dword [0x010a873c], eax
jmp 0x81c7ea
Function at 0x81f540
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x81f560
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, bh
movzx edi, ch
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, dh
shr ecx, 0x10
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, dh
movzx edi, ah
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
mov edx, dword [r15 + 0xc]
movzx edi, bh
movzx ebp, ch
mov eax, dword [r15]
xor r12d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 1]
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
sub r13d, 1
jne 0x81f560
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi*8 + 2]
movzx r11d, byte [r14 + rdi*8 + 2]
movzx r12d, byte [r14 + rbp*8 + 2]
movzx esi, dl
movzx edi, bh
movzx ebp, ch
movzx r8d, byte [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and edi, 0xff00
and ebp, 0xff00
xor r10d, edi
xor r11d, ebp
shr ecx, 0x10
movzx esi, dh
movzx edi, ah
shr edx, 0x10
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
and esi, 0xff00
and edi, 0xff00
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and esi, 0xff0000
and edi, 0xff0000
and ebp, 0xff0000
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, dh
movzx ebp, ah
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8 + 2]
mov ebp, dword [r14 + rbp*8 + 2]
and esi, 0xff0000
and edi, 0xff000000
and ebp, 0xff000000
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, bh
movzx edi, ch
mov edx, dword [r15 + 0x1c]
mov esi, dword [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8 + 2]
mov eax, dword [r15 + 0x10]
and esi, 0xff000000
and edi, 0xff000000
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret
Function at 0x81f9a0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rax, rsp
push rbx
push rbp
push r12
push r13
push r14
push r15
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rax
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x00821340]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
call fcn.0081f730
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi - 0x30]
mov r14, qword [rsi - 0x28]
mov r13, qword [rsi - 0x20]
mov r12, qword [rsi - 0x18]
mov rbp, qword [rsi - 0x10]
mov rbx, qword [rsi - 8]
lea rsp, [rsi]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret

Function at 0x81f9ad
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rax, rsp
push rbx
push rbp
push r12
push r13
push r14
push r15
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rax
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x00821340]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
call fcn.0081f730
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi - 0x30]
mov r14, qword [rsi - 0x28]
mov r13, qword [rsi - 0x20]
mov r12, qword [rsi - 0x18]
mov rbp, qword [rsi - 0x10]
mov rbx, qword [rsi - 8]
lea rsp, [rsi]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x81fa80
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x81faa0
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, dh
movzx edi, ah
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, bh
shr eax, 0x10
movzx ebp, ch
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr ecx, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, bh
movzx edi, ch
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
movzx esi, dh
mov edx, dword [r15 + 0xc]
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 1]
mov eax, dword [r15]
xor r8d, dword [r14 + rbp*8 + 1]
xor eax, r10d
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor ecx, r12d
xor ebx, r11d
xor edx, r8d
sub r13d, 1
jne 0x81faa0
lea r14, [r14 + 0x800]
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi]
movzx r11d, byte [r14 + rdi]
movzx r12d, byte [r14 + rbp]
movzx esi, dl
movzx edi, dh
movzx ebp, ah
movzx r8d, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl edi, 8
shl ebp, 8
xor r10d, edi
xor r11d, ebp
shr edx, 0x10
movzx esi, bh
movzx edi, ch
shr eax, 0x10
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
shl esi, 8
shl edi, 8
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr ecx, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl esi, 0x10
shl edi, 0x10
shl ebp, 0x10
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, bh
movzx ebp, ch
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl esi, 0x10
shl edi, 0x18
shl ebp, 0x18
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, dh
movzx edi, ah
mov edx, dword [r15 + 0x1c]
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
mov eax, dword [r15 + 0x10]
shl esi, 0x18
shl edi, 0x18
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
lea r14, [r14 - 0x800]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret
Function at 0x81ff50
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rax, rsp
push rbx
push rbp
push r12
push r13
push r14
push r15
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rax
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x00821f80]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
shr rbp, 3
add r14, rbp
call fcn.0081fc60
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi - 0x30]
mov r14, qword [rsi - 0x28]
mov r13, qword [rsi - 0x20]
mov r12, qword [rsi - 0x18]
mov rbp, qword [rsi - 0x10]
mov rbx, qword [rsi - 8]
lea rsp, [rsi]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret

Function at 0x81ff5d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rax, rsp
push rbx
push rbp
push r12
push r13
push r14
push r15
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rax
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x00821f80]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
shr rbp, 3
add r14, rbp
call fcn.0081fc60
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi - 0x30]
mov r14, qword [rsi - 0x28]
mov r13, qword [rsi - 0x20]
mov r12, qword [rsi - 0x18]
mov rbp, qword [rsi - 0x10]
mov rbx, qword [rsi - 8]
lea rsp, [rsi]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x82031d
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
push rdx
call fcn.00820080
mov r8, qword [rsp]
cmp eax, 0
jne 0x82051d
mov r14d, dword [r8 + 0xf0]
xor rdi, rdi
lea rcx, [rdi + r14*4]
mov rsi, r8
lea rdi, [r8 + rcx*4]
mov rax, qword [rsi]
mov rbx, qword [rsi + 8]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
mov qword [rdi], rax
mov qword [rdi + 8], rbx
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
lea rsi, [rsi + 0x10]
lea rdi, [rdi - 0x10]
cmp rdi, rsi
jne 0x820358
lea rax, [0x00821740]
mov rsi, qword [rax + 0x28]
mov rdi, qword [rax + 0x30]
mov rbp, qword [rax + 0x38]
mov r15, r8
sub r14d, 1
nop
lea r15, [r15 + 0x10]
mov rax, qword [r15]
mov rcx, qword [r15 + 8]
mov r9, rsi
mov r12, rsi
and r9, rax
and r12, rcx
mov rbx, r9
mov rdx, r12
shr r9, 7
lea r8, [rax + rax]
shr r12, 7
lea r11, [rcx + rcx]
sub rbx, r9
sub rdx, r12
and r8, rdi
and r11, rdi
and rbx, rbp
and rdx, rbp
xor r8, rbx
xor r11, rdx
mov r10, rsi
mov r13, rsi
and r10, r8
and r13, r11
mov rbx, r10
mov rdx, r13
shr r10, 7
lea r9, [r8 + r8]
shr r13, 7
lea r12, [r11 + r11]
sub rbx, r10
sub rdx, r13
and r9, rdi
and r12, rdi
and rbx, rbp
and rdx, rbp
xor r9, rbx
xor r12, rdx
mov r10, rsi
mov r13, rsi
and r10, r9
and r13, r12
mov rbx, r10
mov rdx, r13
shr r10, 7
xor r8, rax
shr r13, 7
xor r11, rcx
sub rbx, r10
sub rdx, r13
lea r10, [r9 + r9]
lea r13, [r12 + r12]
xor r9, rax
xor r12, rcx
and r10, rdi
and r13, rdi
and rbx, rbp
and rdx, rbp
xor r10, rbx
xor r13, rdx
xor rax, r10
xor rcx, r13
xor r8, r10
xor r11, r13
mov rbx, rax
mov rdx, rcx
xor r9, r10
shr rbx, 0x20
xor r12, r13
shr rdx, 0x20
xor r10, r8
rol eax, 8
xor r13, r11
rol ecx, 8
xor r10, r9
rol ebx, 8
xor r13, r12
rol edx, 8
xor eax, r10d
shr r10, 0x20
xor ecx, r13d
shr r13, 0x20
xor ebx, r10d
xor edx, r13d
mov r10, r8
rol r8d, 0x18
mov r13, r11
rol r11d, 0x18
shr r10, 0x20
xor eax, r8d
shr r13, 0x20
xor ecx, r11d
rol r10d, 0x18
mov r8, r9
rol r13d, 0x18
mov r11, r12
shr r8, 0x20
xor ebx, r10d
shr r11, 0x20
xor edx, r13d
rol r9d, 0x10
rol r12d, 0x10
rol r8d, 0x10
xor eax, r9d
rol r11d, 0x10
xor ecx, r12d
xor ebx, r8d
xor edx, r11d
mov dword [r15], eax
mov dword [r15 + 4], ebx
mov dword [r15 + 8], ecx
mov dword [r15 + 0xc], edx
sub r14d, 1
jne 0x82039c
xor rax, rax
mov r15, qword [rsp + 8]
mov r14, qword [rsp + 0x10]
mov r13, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x82b8e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x82b900
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret

Function at 0x82b940
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x82b960
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret

Function at 0x82b9a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x82b9c3
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x82ba10
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x82ba33
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret

Function at 0x82ba80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x82baa9
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret