joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140146230
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
pshufd xmm0, xmmword [rdx], 0x55
lea r10, [0x1403cc8c0]
mov rbp, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov r14, rdx
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
movzx esi, byte [r8 + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or esi, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl esi, 8
movzx eax, byte [rcx + r10]
or esi, eax
movzx eax, r9b
shl esi, 8
movzx ecx, byte [rax + r10]
or esi, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r10]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r10]
or edi, ecx
mov ecx, edi
call fcn.140348828
mov ebx, eax
mov edx, 8
mov ecx, esi
xor ebx, 8
call fcn.140348828
movd xmm1, ebx
lea rcx, [rsp + 0x20]
xor eax, 8
movd xmm2, edi
punpckldq xmm2, xmm1
movd xmm3, esi
movd xmm0, eax
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
movdqu xmm2, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm0, xmm2
pshufd xmm4, xmm3, 0xff
xorps xmm0, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm4
movdqu xmmword [rbp], xmm1
movdqa xmmword [rsp + 0x20], xmm1
call fcn.1401463b8
movdqu xmm2, xmmword [r14]
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movdqa xmm0, xmm2
xorps xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm3
movdqu xmmword [r14], xmm1
add rsp, 0x30
pop r14
ret

Function at 0x1401463b8
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
pshufd xmm0, xmmword [rcx], 0x55
lea r9, [0x1403cc8c0]
movd eax, xmm0
pshufd xmm0, xmmword [rcx], 0xff
mov r8d, eax
shr rax, 0x10
movzx edx, al
mov eax, r8d
shr rax, 0x18
movzx esi, byte [rdx + r9]
movzx eax, byte [rax + r9]
shl eax, 8
or esi, eax
mov eax, r8d
shr rax, 8
movzx edx, al
shl esi, 8
movzx eax, byte [rdx + r9]
or esi, eax
movzx eax, r8b
shl esi, 8
movzx edx, byte [rax + r9]
movd eax, xmm0
or esi, edx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r9]
movzx eax, byte [rax + r9]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r9]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r9]
or edi, ecx
mov ecx, edi
call fcn.140348828
mov edx, 8
mov ecx, esi
mov ebx, eax
call fcn.140348828
movd xmm2, ebx
mov rbx, qword [rsp + 0x30]
movd xmm0, esi
mov rsi, qword [rsp + 0x38]
movd xmm1, eax
movd xmm3, edi
punpckldq xmm0, xmm1
punpckldq xmm3, xmm2
punpcklqdq xmm0, xmm3
add rsp, 0x20
pop rdi
ret
Function at 0x14014efe4
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm4, xmmword [rcx + 0x10]
movdqu xmm3, xmmword [rcx]
vbroadcastf128 ymm1, xmmword [rcx]
vmovdqu ymmword [rdx], ymm1
mov rax, qword [rsp + 0x28]
vmovdqa xmm1, xmm3
vpslldq xmm1, xmm1, 4
vinsertf128 ymm0, ymm4, xmm4, 1
vmovdqu ymmword [r8], ymm0
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm3
vmovdqa xmm3, xmm1
vxorps xmm3, xmm3, xmm0
vpslldq xmm1, xmm1, 4
vxorps xmm3, xmm3, xmm1
vaeskeygenassist xmm0, xmm4, 1
vpshufd xmm1, xmm0, 0xff
vxorps xmm3, xmm3, xmm1
vmovdqa xmm1, xmm4
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm4
vmovdqa xmm4, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm4, xmm4, xmm0
vxorps xmm4, xmm4, xmm1
vaeskeygenassist xmm0, xmm3, 0
vpshufd xmm1, xmm0, 0xaa
vxorps xmm4, xmm4, xmm1
vinsertf128 ymm1, ymm3, xmm3, 1
vmovdqu ymmword [r9], ymm1
vmovdqa xmm1, xmm3
vpslldq xmm1, xmm1, 4
vinsertf128 ymm0, ymm4, xmm4, 1
vmovdqu ymmword [rax], ymm0
mov rax, qword [rsp + 0x30]
vmovdqa xmm0, xmm1
vxorps xmm0, xmm0, xmm3
vpslldq xmm1, xmm1, 4
vmovdqa xmm3, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm3, xmm3, xmm0
vxorps xmm3, xmm3, xmm1
vaeskeygenassist xmm0, xmm4, 2
vpshufd xmm1, xmm0, 0xff
vxorps xmm3, xmm3, xmm1
vmovdqa xmm1, xmm4
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm4
vmovdqa xmm4, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm4, xmm4, xmm0
vxorps xmm4, xmm4, xmm1
vaeskeygenassist xmm0, xmm3, 0
vpshufd xmm1, xmm0, 0xaa
vxorps xmm4, xmm4, xmm1
vinsertf128 ymm1, ymm3, xmm3, 1
vmovdqu ymmword [rax], ymm1
mov rax, qword [rsp + 0x38]
vmovdqa xmm1, xmm3
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm3
vmovdqa xmm3, xmm1
vxorps xmm3, xmm3, xmm0
vpslldq xmm1, xmm1, 4
vxorps xmm3, xmm3, xmm1
vaeskeygenassist xmm0, xmm4, 4
vpshufd xmm1, xmm0, 0xff
vxorps xmm3, xmm3, xmm1
vmovdqa xmm1, xmm4
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vinsertf128 ymm2, ymm4, xmm4, 1
vxorps xmm0, xmm0, xmm4
vmovdqu ymmword [rax], ymm2
mov rax, qword [rsp + 0x40]
vpslldq xmm1, xmm1, 4
vmovdqa xmm4, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm4, xmm4, xmm0
vxorps xmm4, xmm4, xmm1
vaeskeygenassist xmm0, xmm3, 0
vpshufd xmm1, xmm0, 0xaa
vxorps xmm4, xmm4, xmm1
vinsertf128 ymm1, ymm3, xmm3, 1
vmovdqu ymmword [rax], ymm1
mov rax, qword [rsp + 0x48]
vmovdqa xmm1, xmm3
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm3
vmovdqa xmm3, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm3, xmm3, xmm0
vxorps xmm3, xmm3, xmm1
vinsertf128 ymm2, ymm4, xmm4, 1
vmovdqu ymmword [rax], ymm2
mov rax, qword [rsp + 0x50]
vaeskeygenassist xmm0, xmm4, 8
vpshufd xmm1, xmm0, 0xff
vxorps xmm3, xmm3, xmm1
vmovdqa xmm1, xmm4
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vmovdqa xmm2, xmm1
vxorps xmm0, xmm0, xmm4
vxorps xmm2, xmm2, xmm0
vpslldq xmm1, xmm1, 4
vxorps xmm2, xmm2, xmm1
vaeskeygenassist xmm0, xmm3, 0
vpshufd xmm1, xmm0, 0xaa
vxorps xmm2, xmm2, xmm1
vinsertf128 ymm1, ymm3, xmm3, 1
vmovdqu ymmword [rax], ymm1
mov rax, qword [rsp + 0x58]
vinsertf128 ymm2, ymm2, xmm2, 1
vmovdqu ymmword [rax], ymm2
vzeroupper
ret
Function at 0x140155de8
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rsp
sub rsp, 0x98
movdqu xmm2, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm4, xmmword [rcx + 0x20]
movdqu xmm5, xmmword [rcx + 0x30]
mov ecx, 2
movaps xmmword [rax - 0x18], xmm6
movdqa xmm6, xmmword [0x1404f0e70]
movaps xmmword [rax - 0x28], xmm7
movdqa xmm7, xmmword [0x1404f0e80]
movaps xmmword [rax - 0x38], xmm8
movdqa xmm8, xmmword [0x1404f0e90]
movaps xmmword [rax - 0x48], xmm9
movdqa xmm9, xmmword [0x1404f0ea0]
movaps xmmword [rax - 0x58], xmm10
movdqa xmm10, xmmword [0x1404f0eb0]
movaps xmmword [rax - 0x68], xmm11
movdqa xmm11, xmmword [0x1404f0ec0]
movaps xmmword [rax - 0x78], xmm12
lea rax, [rdx + r8]
movdqa xmm12, xmmword [0x1404f0ed0]
movaps xmmword [rsp + 0x10], xmm13
movdqa xmm13, xmmword [0x1404f0ee0]
movaps xmmword [rsp], xmm14
aesdec xmm2, xmm6
aesenc xmm3, xmm6
aesdec xmm4, xmm10
aesenc xmm5, xmm10
aesdec xmm2, xmm7
aesenc xmm3, xmm7
aesdec xmm4, xmm11
aesenc xmm5, xmm11
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm4, xmm12
aesenc xmm5, xmm12
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm4, xmm13
aesenc xmm5, xmm13
movdqu xmmword [r8], xmm2
movdqu xmmword [r8 + 0x10], xmm3
movdqu xmmword [r8 + 0x20], xmm4
movdqu xmmword [r8 + 0x30], xmm5
add r8, 0x40
sub rcx, 1
jne 0x140155e80
movdqa xmm14, xmmword [0x1403ccc20]
jmp 0x140155fa2
aesdec xmm2, xmm6
aesenc xmm3, xmm6
aesdec xmm4, xmm10
aesenc xmm5, xmm10
aesdec xmm2, xmm7
aesenc xmm3, xmm7
aesdec xmm4, xmm11
aesenc xmm5, xmm11
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm2, xmm9
movdqa xmm0, xmm14
movdqa xmm1, xmm14
andps xmm0, xmm2
movdqu xmmword [r8], xmm0
movdqa xmm0, xmm14
aesenc xmm3, xmm9
andps xmm1, xmm3
movdqu xmmword [r8 + 0x10], xmm1
movdqa xmm1, xmm14
aesdec xmm4, xmm12
aesenc xmm5, xmm12
aesdec xmm4, xmm13
aesenc xmm5, xmm13
andps xmm0, xmm4
andps xmm1, xmm5
movdqu xmmword [r8 + 0x20], xmm0
movdqu xmmword [r8 + 0x30], xmm1
add r8, 0x40
cmp r8, rax
jb 0x140155f0b
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x98]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm8, xmmword [r11 - 0x38]
movaps xmm9, xmmword [r11 - 0x48]
movaps xmm10, xmmword [r11 - 0x58]
movaps xmm11, xmmword [r11 - 0x68]
movaps xmm12, xmmword [r11 - 0x78]
movaps xmm13, xmmword [rsp + 0x10]
movaps xmm14, xmmword [rsp]
mov rsp, r11
ret
mov eax, dword [0x1404f0dec]
lea r8, [rcx + 0x40]
mov r9, rdx
mov rcx, r9
lea edx, [rax*8 + 0x80]
jmp 0x140155de8
Function at 0x140156d7c
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
movdqa xmm2, xmmword [0x1403ccca0]
lea r9, [rcx + rdx]
movdqa xmm3, xmmword [0x1403ccc80]
movdqa xmm4, xmmword [0x1403cccb0]
movdqa xmm5, xmmword [0x1403ccc70]
cmp rcx, r9
jae 0x140156dcd
add rcx, 0x20
aesenc xmm2, xmmword [rcx - 0x20]
aesdec xmm3, xmmword [rcx - 0x10]
aesenc xmm4, xmmword [rcx]
aesdec xmm5, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x40]
lea rax, [rcx - 0x20]
cmp rax, r9
jb 0x140156da9
movdqa xmm0, xmmword [0x1403ccc30]
movdqa xmm1, xmmword [0x1403cccc0]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm4, xmm0
aesdec xmm5, xmm0
aesenc xmm2, xmm1
aesdec xmm3, xmm1
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [r8], xmm2
movdqu xmmword [r8 + 0x10], xmm3
movdqu xmmword [r8 + 0x20], xmm4
movdqu xmmword [r8 + 0x30], xmm5
ret

Function at 0x14015e1ec
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x28
movdqa xmm2, xmmword [0x1403ccca0]
lea r11, [rcx + 0x1c00]
movdqa xmm3, xmmword [0x1403ccc80]
mov r10, rcx
movdqa xmm4, xmmword [0x1403cccb0]
mov rax, rcx
movdqa xmm5, xmmword [0x1403ccc70]
lea rcx, [rdx - 0x1c00]
movdqu xmm0, xmmword [r9]
add rcx, rax
movdqu xmm1, xmmword [r9 + 0x10]
mov edx, 2
movaps xmmword [rsp + 0x10], xmm6
movdqu xmm6, xmmword [r9 + 0x20]
movaps xmmword [rsp], xmm7
movdqu xmm7, xmmword [r9 + 0x30]
jmp 0x14015e303
aesenc xmm2, xmmword [rax]
aesdec xmm3, xmmword [rax + 0x10]
aesenc xmm4, xmmword [rax + 0x20]
aesdec xmm5, xmmword [rax + 0x30]
aesenc xmm2, xmmword [rax + 0x40]
aesdec xmm3, xmmword [rax + 0x50]
aesenc xmm4, xmmword [rax + 0x60]
aesdec xmm5, xmmword [rax + 0x70]
aesdec xmm0, xmmword [0x1403ccc90]
aesenc xmm1, xmmword [0x1403ccc40]
aesdec xmm6, xmmword [0x1403ccc50]
aesenc xmm7, xmmword [0x1403ccc60]
movdqu xmmword [rax], xmm0
aesdec xmm0, xmmword [0x1403ccc90]
movdqu xmmword [rax + 0x10], xmm1
aesenc xmm1, xmmword [0x1403ccc40]
movdqu xmmword [rax + 0x20], xmm6
aesdec xmm6, xmmword [0x1403ccc50]
movdqu xmmword [rax + 0x30], xmm7
aesenc xmm7, xmmword [0x1403ccc60]
movdqu xmmword [rax + 0x40], xmm0
movdqu xmmword [rax + 0x50], xmm1
movdqu xmmword [rax + 0x60], xmm6
movdqu xmmword [rax + 0x70], xmm7
prefetcht0 byte [r11]
prefetcht0 byte [r11 + 0x40]
sub rax, 0xffffffffffffff80
lea r11, [r11 + 0x80]
cmp rax, rcx
jb 0x14015e251
add rcx, 0x1c00
mov r11, r10
sub rdx, 1
jne 0x14015e303
movdqu xmmword [r9], xmm0
movdqa xmm0, xmmword [0x1403ccc30]
movdqu xmmword [r9 + 0x10], xmm1
movdqa xmm1, xmmword [0x1403cccc0]
movdqu xmmword [r9 + 0x20], xmm6
movaps xmm6, xmmword [rsp + 0x10]
movdqu xmmword [r9 + 0x30], xmm7
movaps xmm7, xmmword [rsp]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm4, xmm0
aesdec xmm5, xmm0
aesenc xmm2, xmm1
aesdec xmm3, xmm1
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [r8], xmm2
movdqu xmmword [r8 + 0x10], xmm3
movdqu xmmword [r8 + 0x20], xmm4
movdqu xmmword [r8 + 0x30], xmm5
add rsp, 0x28
ret
Function at 0x14015f188
Capabilities:
Encode data using xor
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x14015f20e
test rcx, rcx
je 0x14015f20e
xor edx, edx
mov r8d, 0xf0
call fcn.140337660
mov r8d, 0x40
lea rdx, [0x1403ccce0]
mov rcx, rbx
call fcn.140336c00
mov rsi, rbx
mov rbp, rdi
mov r14d, 8
mov r8d, 8
lea rcx, [rsp + 0x48]
mov rdx, rbp
call fcn.140336c00
mov rax, qword [rsp + 0x48]
add rbp, 8
xor qword [rsi], rax
lea rsi, [rsi + 8]
sub r14, 1
jne 0x14015f1d8
movzx eax, byte [rdi]
mov dword [rbx + 0xe4], eax
xor eax, eax
jmp 0x14015f211
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140163218
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rsp
sub rsp, 0x98
movdqu xmm2, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm4, xmmword [rcx + 0x20]
movdqu xmm5, xmmword [rcx + 0x30]
mov ecx, 2
movaps xmmword [rax - 0x18], xmm6
movdqa xmm6, xmmword [0x1404f0e70]
movaps xmmword [rax - 0x28], xmm7
movdqa xmm7, xmmword [0x1404f0e80]
movaps xmmword [rax - 0x38], xmm8
movdqa xmm8, xmmword [0x1404f0e90]
movaps xmmword [rax - 0x48], xmm9
movdqa xmm9, xmmword [0x1404f0ea0]
movaps xmmword [rax - 0x58], xmm10
movdqa xmm10, xmmword [0x1404f0eb0]
movaps xmmword [rax - 0x68], xmm11
movdqa xmm11, xmmword [0x1404f0ec0]
movaps xmmword [rax - 0x78], xmm12
lea rax, [rdx + r8]
movdqa xmm12, xmmword [0x1404f0ed0]
movaps xmmword [rsp + 0x10], xmm13
movdqa xmm13, xmmword [0x1404f0ee0]
movaps xmmword [rsp], xmm14
aesdec xmm2, xmm6
aesenc xmm3, xmm6
aesdec xmm4, xmm10
aesenc xmm5, xmm10
aesdec xmm2, xmm7
aesenc xmm3, xmm7
aesdec xmm4, xmm11
aesenc xmm5, xmm11
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm4, xmm12
aesenc xmm5, xmm12
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm4, xmm13
aesenc xmm5, xmm13
movdqu xmmword [r8], xmm2
movdqu xmmword [r8 + 0x10], xmm3
movdqu xmmword [r8 + 0x20], xmm4
movdqu xmmword [r8 + 0x30], xmm5
add r8, 0x40
sub rcx, 1
jne 0x140155e80
movdqa xmm14, xmmword [0x1403ccc20]
jmp 0x140155fa2
aesdec xmm2, xmm6
aesenc xmm3, xmm6
aesdec xmm4, xmm10
aesenc xmm5, xmm10
aesdec xmm2, xmm7
aesenc xmm3, xmm7
aesdec xmm4, xmm11
aesenc xmm5, xmm11
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm2, xmm9
movdqa xmm0, xmm14
movdqa xmm1, xmm14
andps xmm0, xmm2
movdqu xmmword [r8], xmm0
movdqa xmm0, xmm14
aesenc xmm3, xmm9
andps xmm1, xmm3
movdqu xmmword [r8 + 0x10], xmm1
movdqa xmm1, xmm14
aesdec xmm4, xmm12
aesenc xmm5, xmm12
aesdec xmm4, xmm13
aesenc xmm5, xmm13
andps xmm0, xmm4
andps xmm1, xmm5
movdqu xmmword [r8 + 0x20], xmm0
movdqu xmmword [r8 + 0x30], xmm1
add r8, 0x40
cmp r8, rax
jb 0x140155f0b
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x98]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm8, xmmword [r11 - 0x38]
movaps xmm9, xmmword [r11 - 0x48]
movaps xmm10, xmmword [r11 - 0x58]
movaps xmm11, xmmword [r11 - 0x68]
movaps xmm12, xmmword [r11 - 0x78]
movaps xmm13, xmmword [rsp + 0x10]
movaps xmm14, xmmword [rsp]
mov rsp, r11
ret
mov eax, dword [0x1404f0dec]
lea r8, [rcx + 0x40]
mov r9, rdx
mov rcx, r9
lea edx, [rax*8 + 0x80]
jmp 0x140155de8
Function at 0x1401639a8
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1404e8f18]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rcx, qword [rcx + 0xab8]
mov rbx, r8
shr rdx, 6
mov r8d, edx
lea rdx, [rsp + 0x20]
call fcn.140160180
lea rdx, [rsp + 0x20]
mov ecx, 8
sub rdx, rbx
mov rax, qword [rdx + rbx]
xor qword [rbx], rax
lea rbx, [rbx + 8]
sub rcx, 1
jne 0x1401639e5
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1403358f0
add rsp, 0x70
pop rbx
ret

Function at 0x140163aa8
Capabilities:
Encode data using xor

Disassembly:
mov r9, qword [rcx + 0xaa8]
mov ecx, 8
add r9, rdx
sub r9, r8
mov rax, qword [r9 + r8]
xor qword [r8], rax
lea r8, [r8 + 8]
sub rcx, 1
jne 0x140163aba
ret

Function at 0x140163e8c
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140163218
mov rcx, rbx
call fcn.1401633ac
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140163acc
Function at 0x1401678a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x20]
lea r14, [rdx + 0x100]
shr rax, 3
mov rbx, rcx
and eax, 0x3f
add rcx, 0x28
add rcx, rax
mov edi, 0x38
mov rsi, rdx
lea rdx, [0x1403cd5d0]
lea rbp, [rbx + 0x28]
cmp rax, rdi
jae 0x140167901
sub rdi, rax
mov r8, rdi
call fcn.140336c00
jmp 0x14016792d
mov r8d, 0x40
sub r8, rax
call fcn.140336c00
mov r9, r14
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.140167a68
mov r8, rdi
xor edx, edx
mov rcx, rbp
call fcn.140337660
mov rcx, qword [rbx + 0x20]
mov r9, r14
mov rax, rcx
mov byte [rbx + 0x67], cl
shr rax, 8
mov r8, rsi
mov byte [rbx + 0x66], al
mov rdx, rbp
mov rax, rcx
shr rax, 0x10
mov byte [rbx + 0x65], al
mov rax, rcx
shr rax, 0x18
mov byte [rbx + 0x64], al
mov rax, rcx
shr rax, 0x20
mov byte [rbx + 0x63], al
mov rax, rcx
shr rax, 0x28
mov byte [rbx + 0x62], al
mov rax, rcx
shr rcx, 0x38
mov byte [rbx + 0x60], cl
mov rcx, rbx
shr rax, 0x30
mov byte [rbx + 0x61], al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.140167a68
Function at 0x140168670
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, qword [rsp + 0x60]
mov r15d, 0x40
mov r14, r9
mov rsi, r8
mov rbx, rdx
mov rbp, rcx
cmp r8, r15
jbe 0x1401686d1
call fcn.140168a74
mov r9, r14
mov r8, rsi
mov rdx, rbx
mov rcx, rbp
call fcn.1401687b4
mov rbx, qword [rsp + 0x68]
mov r8, r14
mov rcx, rbx
mov rdx, rbp
call fcn.14016877c
lea esi, [r15 - 0x20]
mov rcx, rbp
call fcn.140168a74
mov r8, r15
mov edx, 0x36
mov rcx, rdi
call fcn.140337660
sub rbx, rdi
test rsi, rsi
je 0x140168705
mov rcx, rdi
mov rdx, rsi
mov al, byte [rbx + rcx]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1401686f7
mov r9, r14
mov r8, r15
mov rdx, rdi
mov rcx, rbp
call fcn.1401687b4
lea rcx, [rbp + 0x68]
call fcn.140168a74
mov r8, r15
mov edx, 0x5c
mov rcx, rdi
call fcn.140337660
test rsi, rsi
je 0x140168747
mov r9, rdi
mov al, byte [rbx + r9]
xor byte [r9], al
inc r9
sub rsi, 1
jne 0x140168737
mov r9, r14
lea rcx, [rbp + 0x68]
mov r8, r15
mov rdx, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.1401687b4

Function at 0x140168a74
Capabilities:
Hash data using sha256

Disassembly:
and qword [rcx + 0x20], 0
lea rdx, [0x1403cd610]
mov r8d, 0x20
jmp fcn.140336c00

Function at 0x140168fb4
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r11d, r8d
test r9d, r9d
je 0x140168fd4
mov al, byte [rdx]
lea r8d, [r10 + r11]
xor byte [r8 + rcx], al
inc r10d
inc rdx
cmp r10d, r9d
jb 0x140168fbf
ret

Function at 0x14016900c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x1404e8f18]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
xor r10d, r10d
mov r14d, 0xcccccccd
mov eax, r14d
lea rsi, [rsp]
mul r10d
xor edi, edi
mov r11d, r10d
shr edx, 2
lea eax, [rdx + rdx*4]
sub r11d, eax
lea ebp, [r11 + r11*4]
lea r8d, [rdi + 2]
mov eax, r14d
lea ecx, [r8 - 1]
mul ecx
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
mov eax, r14d
mul r8d
add ecx, ebp
shr edx, 2
mov r9, qword [rbx + rcx*8]
mov ecx, r11d
lea eax, [rdx + rdx*4]
not r9
sub r8d, eax
mov eax, r14d
mul edi
add r8d, ebp
shr edx, 2
sub ecx, edx
and r9, qword [rbx + r8*8]
lea eax, [rdi + rcx*4]
inc edi
add ecx, eax
xor r9, qword [rbx + rcx*8]
mov qword [rsi], r9
lea rsi, [rsi + 8]
cmp edi, 5
jb 0x140169055
xor r8d, r8d
lea r9, [rsp]
mov eax, r14d
mov ecx, r11d
mul r8d
shr edx, 2
sub ecx, edx
lea eax, [r8 + rcx*4]
inc r8d
add ecx, eax
mov rax, qword [r9]
lea r9, [r9 + 8]
mov qword [rbx + rcx*8], rax
cmp r8d, 5
jb 0x1401690b4
inc r10d
cmp r10d, 5
jb 0x140169039
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1403358f0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1401692ac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x60
mov rax, qword [0x1404e8f18]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rcx
lea r9, [rsp]
xor r8d, r8d
mov ebp, 0xcccccccd
mov eax, ebp
xor ebx, ebx
mul r8d
xor r11d, r11d
mov r10d, edx
shr r10d, 2
mov ecx, r11d
mov eax, ebp
mul r11d
inc r11d
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
sub ecx, r10d
lea eax, [r8 + rcx*4]
add ecx, eax
xor rbx, qword [rdi + rcx*8]
cmp r11d, 5
jb 0x1401692ea
mov qword [r9], rbx
inc r8d
add r9, 8
cmp r8d, 5
jb 0x1401692d9
mov r9d, 4
lea r10, [rsp + 0x28]
lea r11d, [r9 + 1]
lea ecx, [r9 - 3]
mov eax, ebp
mul ecx
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
mov eax, ebp
mul r9d
mov r8, qword [rsp + rcx*8]
mov ecx, r9d
shr edx, 2
inc r9d
lea eax, [rdx + rdx*4]
sub ecx, eax
mov eax, ecx
mov rcx, r8
shr rcx, 0x3f
xor rcx, qword [rsp + rax*8]
lea rax, [r8 + r8]
xor rcx, rax
mov qword [r10], rcx
lea r10, [r10 + 8]
sub r11, 1
jne 0x14016932f
xor r8d, r8d
lea r9, [rsp + 0x28]
mov rbx, qword [r9]
mov eax, ebp
mul r8d
xor r10d, r10d
mov r11d, edx
shr r11d, 2
mov ecx, r10d
mov eax, ebp
mul r10d
inc r10d
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
sub ecx, r11d
lea eax, [r8 + rcx*4]
add ecx, eax
xor qword [rdi + rcx*8], rbx
cmp r10d, 5
jb 0x140169391
inc r8d
add r9, 8
cmp r8d, 5
jb 0x14016937f
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1403358f0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret