joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bf584
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x100
mov rax, qword [0x1404e8f18]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, qword [rcx + 0xe0]
mov rdi, rcx
xor esi, esi
mov ebp, 0xb0
mov r8d, 0xc8
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.1403367f0
xor qword [rsp + 0x20], rsi
lea rcx, [rsp + 0x20]
mov edx, 0x18
call fcn.1400118b8
mov r8d, 0xa0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1403367f0
mov edx, 0x18
lea rcx, [rsp + 0x20]
add rbx, 0xa0
call fcn.1400118b8
mov r8, rbp
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1403367f0
mov edx, 0x18
lea rcx, [rsp + 0x20]
add rbx, rbp
call fcn.1400118b8
mov r8, rbp
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1403367f0
add rbx, rbp
inc rsi
cmp rsi, 0x1000
jb 0x1400bf5be
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1403354e0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140122b5c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rsi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x140122b9f
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call fcn.140337250
jmp 0x140122d8d
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.140011778
mov r8, qword [rbx + 8]
lea r15, [r14 + rsi]
mov rcx, r15
mov r9d, r12d
mov edx, esi
call fcn.140011778
lea rdi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rdi]
lea r13, [r14 + rsi*2]
mov rcx, r13
mov edx, esi
call fcn.140011778
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rsi*2]
add rcx, rsi
mov r9d, r12d
mov edx, esi
call fcn.140011778
cmp byte [0x1404f03d1], 0
mov r12d, 0x40000
mov rcx, qword [rbx]
je 0x140122c27
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8d, r12d
call fcn.14014d120
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8d, r12d
call fcn.14014d120
jmp 0x140122c46
call fcn.1400baf3c
mov rcx, qword [rbx + 8]
call fcn.1400baf3c
mov rcx, qword [rdi]
call fcn.1400baf3c
mov rcx, qword [rbx + 0x18]
call fcn.1400baf3c
mov r9, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rdi
mov r10d, 2
mov rax, qword [r9 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r9 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rsi
mov qword [rcx + 0xf0], rax
sub r10, 1
jne 0x140122c7e
lea rax, [0x1403cb440]
mov rcx, rbx
mov qword [r9 + 0xe8], rax
call qword [0x1404f03c0]
cmp byte [0x1404f03d1], 0
mov rcx, qword [rbx]
je 0x140122ce5
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8, r12
call fcn.14014da94
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8, r12
call fcn.14014da94
jmp 0x140122d04
call fcn.1400c047c
mov rcx, qword [rbx + 8]
call fcn.1400c047c
mov rcx, qword [rdi]
call fcn.1400c047c
mov rcx, qword [rbx + 0x18]
call fcn.1400c047c
mov rcx, qword [rbx]
mov esi, 0x18
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx + 8]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rdi]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx + 0x18]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx]
lea rsi, [0x1403cc940]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rdi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140122dac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rdi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x140122def
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call fcn.140337250
jmp 0x140122ff3
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.140011778
mov r8, qword [rbx + 8]
lea r15, [r14 + rdi]
mov rcx, r15
mov r9d, r12d
mov edx, edi
call fcn.140011778
lea rsi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rsi]
lea r13, [r14 + rdi*2]
mov rcx, r13
mov edx, edi
call fcn.140011778
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rdi*2]
add rcx, rdi
mov r9d, r12d
mov edx, edi
call fcn.140011778
xor ecx, ecx
mov rax, qword [rbx + rcx*8]
inc rcx
mov byte [rax + 0x1b0], 1
cmp rcx, 4
jl 0x140122e44
cmp byte [0x1404f03d1], 0
mov r12d, 0x40000
mov rcx, qword [rbx]
je 0x140122e8d
mov rdx, qword [rbx + 8]
mov r9b, 1
mov r8d, r12d
call fcn.14014d120
mov rdx, qword [rbx + 0x18]
mov r9b, 1
mov rcx, qword [rsi]
mov r8d, r12d
call fcn.14014d120
jmp 0x140122eac
call fcn.1400bb858
mov rcx, qword [rbx + 8]
call fcn.1400bb858
mov rcx, qword [rsi]
call fcn.1400bb858
mov rcx, qword [rbx + 0x18]
call fcn.1400bb858
mov r10, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rsi
mov r9d, 2
mov rax, qword [r10 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r10 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rdi
mov qword [rcx + 0xf0], rax
sub r9, 1
jne 0x140122ee4
lea rax, [0x1403cb440]
mov rcx, rbx
mov qword [r10 + 0xe8], rax
call qword [0x1404f03c8]
cmp byte [0x1404f03d1], 0
mov rcx, qword [rbx]
je 0x140122f4b
mov rdx, qword [rbx + 8]
mov r9b, 1
mov r8, r12
call fcn.14014da94
mov rdx, qword [rbx + 0x18]
mov r9b, 1
mov rcx, qword [rsi]
mov r8, r12
call fcn.14014da94
jmp 0x140122f6a
call fcn.1400c0e18
mov rcx, qword [rbx + 8]
call fcn.1400c0e18
mov rcx, qword [rsi]
call fcn.1400c0e18
mov rcx, qword [rbx + 0x18]
call fcn.1400c0e18
mov rcx, qword [rbx]
mov edi, 0x18
mov edx, edi
call fcn.1400118b8
mov rcx, qword [rbx + 8]
mov edx, edi
call fcn.1400118b8
mov rcx, qword [rsi]
mov edx, edi
call fcn.1400118b8
mov rcx, qword [rbx + 0x18]
mov edx, edi
call fcn.1400118b8
mov rcx, qword [rbx]
lea rdi, [0x1403cc940]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rsi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140123010
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rsi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x140123053
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call fcn.140337250
jmp 0x140123241
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.140011778
mov r8, qword [rbx + 8]
lea r15, [r14 + rsi]
mov rcx, r15
mov r9d, r12d
mov edx, esi
call fcn.140011778
lea rdi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rdi]
lea r13, [r14 + rsi*2]
mov rcx, r13
mov edx, esi
call fcn.140011778
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rsi*2]
add rcx, rsi
mov r9d, r12d
mov edx, esi
call fcn.140011778
cmp byte [0x1404f03d1], 0
mov r12d, 0x80000
mov rcx, qword [rbx]
je 0x1401230db
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8d, r12d
call fcn.14014d120
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8d, r12d
call fcn.14014d120
jmp 0x1401230fa
call fcn.1400bc164
mov rcx, qword [rbx + 8]
call fcn.1400bc164
mov rcx, qword [rdi]
call fcn.1400bc164
mov rcx, qword [rbx + 0x18]
call fcn.1400bc164
mov r9, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rdi
mov r10d, 2
mov rax, qword [r9 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r9 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rsi
mov qword [rcx + 0xf0], rax
sub r10, 1
jne 0x140123132
lea rax, [0x1403cb440]
mov rcx, rbx
mov qword [r9 + 0xe8], rax
call qword [0x1404f03a0]
cmp byte [0x1404f03d1], 0
mov rcx, qword [rbx]
je 0x140123199
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8, r12
call fcn.14014da94
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8, r12
call fcn.14014da94
jmp 0x1401231b8
call fcn.1400c1764
mov rcx, qword [rbx + 8]
call fcn.1400c1764
mov rcx, qword [rdi]
call fcn.1400c1764
mov rcx, qword [rbx + 0x18]
call fcn.1400c1764
mov rcx, qword [rbx]
mov esi, 0x18
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx + 8]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rdi]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx + 0x18]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx]
lea rsi, [0x1403cc940]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rdi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140123260
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rdi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x1401232a3
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call fcn.140337250
jmp 0x1401234a7
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.140011778
mov r8, qword [rbx + 8]
lea r15, [r14 + rdi]
mov rcx, r15
mov r9d, r12d
mov edx, edi
call fcn.140011778
lea rsi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rsi]
lea r13, [r14 + rdi*2]
mov rcx, r13
mov edx, edi
call fcn.140011778
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rdi*2]
add rcx, rdi
mov r9d, r12d
mov edx, edi
call fcn.140011778
xor ecx, ecx
mov rax, qword [rbx + rcx*8]
inc rcx
mov byte [rax + 0x1b0], 1
cmp rcx, 4
jl 0x1401232f8
cmp byte [0x1404f03d1], 0
mov r12d, 0x80000
mov rcx, qword [rbx]
je 0x140123341
mov rdx, qword [rbx + 8]
mov r9b, 1
mov r8d, r12d
call fcn.14014d120
mov rdx, qword [rbx + 0x18]
mov r9b, 1
mov rcx, qword [rsi]
mov r8d, r12d
call fcn.14014d120
jmp 0x140123360
call fcn.1400bca80
mov rcx, qword [rbx + 8]
call fcn.1400bca80
mov rcx, qword [rsi]
call fcn.1400bca80
mov rcx, qword [rbx + 0x18]
call fcn.1400bca80
mov r10, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rsi
mov r9d, 2
mov rax, qword [r10 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r10 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rdi
mov qword [rcx + 0xf0], rax
sub r9, 1
jne 0x140123398
lea rax, [0x1403cb440]
mov rcx, rbx
mov qword [r10 + 0xe8], rax
call qword [0x1404f03a8]
cmp byte [0x1404f03d1], 0
mov rcx, qword [rbx]
je 0x1401233ff
mov rdx, qword [rbx + 8]
mov r9b, 1
mov r8, r12
call fcn.14014da94
mov rdx, qword [rbx + 0x18]
mov r9b, 1
mov rcx, qword [rsi]
mov r8, r12
call fcn.14014da94
jmp 0x14012341e
call fcn.1400c2100
mov rcx, qword [rbx + 8]
call fcn.1400c2100
mov rcx, qword [rsi]
call fcn.1400c2100
mov rcx, qword [rbx + 0x18]
call fcn.1400c2100
mov rcx, qword [rbx]
mov edi, 0x18
mov edx, edi
call fcn.1400118b8
mov rcx, qword [rbx + 8]
mov edx, edi
call fcn.1400118b8
mov rcx, qword [rsi]
mov edx, edi
call fcn.1400118b8
mov rcx, qword [rbx + 0x18]
mov edx, edi
call fcn.1400118b8
mov rcx, qword [rbx]
lea rdi, [0x1403cc940]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rsi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401234c4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rsi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x140123507
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call fcn.140337250
jmp 0x1401236f5
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.140011778
mov r8, qword [rbx + 8]
lea r15, [r14 + rsi]
mov rcx, r15
mov r9d, r12d
mov edx, esi
call fcn.140011778
lea rdi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rdi]
lea r13, [r14 + rsi*2]
mov rcx, r13
mov edx, esi
call fcn.140011778
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rsi*2]
add rcx, rsi
mov r9d, r12d
mov edx, esi
call fcn.140011778
cmp byte [0x1404f03d1], 0
mov r12d, 0x100000
mov rcx, qword [rbx]
je 0x14012358f
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8d, r12d
call fcn.14014d120
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8d, r12d
call fcn.14014d120
jmp 0x1401235ae
call fcn.1400bd38c
mov rcx, qword [rbx + 8]
call fcn.1400bd38c
mov rcx, qword [rdi]
call fcn.1400bd38c
mov rcx, qword [rbx + 0x18]
call fcn.1400bd38c
mov r9, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rdi
mov r10d, 2
mov rax, qword [r9 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r9 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rsi
mov qword [rcx + 0xf0], rax
sub r10, 1
jne 0x1401235e6
lea rax, [0x1403cb440]
mov rcx, rbx
mov qword [r9 + 0xe8], rax
call qword [0x1404f03b8]
cmp byte [0x1404f03d1], 0
mov rcx, qword [rbx]
je 0x14012364d
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8, r12
call fcn.14014da94
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8, r12
call fcn.14014da94
jmp 0x14012366c
call fcn.1400c2a4c
mov rcx, qword [rbx + 8]
call fcn.1400c2a4c
mov rcx, qword [rdi]
call fcn.1400c2a4c
mov rcx, qword [rbx + 0x18]
call fcn.1400c2a4c
mov rcx, qword [rbx]
mov esi, 0x18
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx + 8]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rdi]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx + 0x18]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx]
lea rsi, [0x1403cc940]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rdi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140123714
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rsi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x140123757
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call fcn.140337250
jmp 0x140123945
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.140011778
mov r8, qword [rbx + 8]
lea r15, [r14 + rsi]
mov rcx, r15
mov r9d, r12d
mov edx, esi
call fcn.140011778
lea rdi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rdi]
lea r13, [r14 + rsi*2]
mov rcx, r13
mov edx, esi
call fcn.140011778
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rsi*2]
add rcx, rsi
mov r9d, r12d
mov edx, esi
call fcn.140011778
cmp byte [0x1404f03d1], 0
mov r12d, 0x200000
mov rcx, qword [rbx]
je 0x1401237df
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8d, r12d
call fcn.14014d120
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8d, r12d
call fcn.14014d120
jmp 0x1401237fe
call fcn.1400bdc00
mov rcx, qword [rbx + 8]
call fcn.1400bdc00
mov rcx, qword [rdi]
call fcn.1400bdc00
mov rcx, qword [rbx + 0x18]
call fcn.1400bdc00
mov r9, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rdi
mov r10d, 2
mov rax, qword [r9 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r9 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rsi
mov qword [rcx + 0xf0], rax
sub r10, 1
jne 0x140123836
lea rax, [0x1403cb440]
mov rcx, rbx
mov qword [r9 + 0xe8], rax
call qword [0x1404f03b0]
cmp byte [0x1404f03d1], 0
mov rcx, qword [rbx]
je 0x14012389d
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8, r12
call fcn.14014da94
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8, r12
call fcn.14014da94
jmp 0x1401238bc
call fcn.1400c3348
mov rcx, qword [rbx + 8]
call fcn.1400c3348
mov rcx, qword [rdi]
call fcn.1400c3348
mov rcx, qword [rbx + 0x18]
call fcn.1400c3348
mov rcx, qword [rbx]
mov esi, 0x18
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx + 8]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rdi]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx + 0x18]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx]
lea rsi, [0x1403cc940]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rdi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140144ed0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
pshufd xmm0, xmmword [rdx], 0x55
lea r10, [0x1403cc840]
mov rbp, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov r14, rdx
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
movzx esi, byte [r8 + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or esi, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl esi, 8
movzx eax, byte [rcx + r10]
or esi, eax
movzx eax, r9b
shl esi, 8
movzx ecx, byte [rax + r10]
or esi, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r10]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r10]
or edi, ecx
mov ecx, edi
call fcn.140348418
mov ebx, eax
mov edx, 8
mov ecx, esi
xor ebx, 1
call fcn.140348418
movd xmm1, ebx
lea rcx, [rsp + 0x20]
xor eax, 1
movd xmm2, edi
punpckldq xmm2, xmm1
movd xmm3, esi
movd xmm0, eax
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
movdqu xmm2, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm0, xmm2
pshufd xmm4, xmm3, 0xff
xorps xmm0, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm4
movdqu xmmword [rbp], xmm1
movdqa xmmword [rsp + 0x20], xmm1
call fcn.1401454f0
movdqu xmm2, xmmword [r14]
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movdqa xmm0, xmm2
xorps xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm3
movdqu xmmword [r14], xmm1
add rsp, 0x30
pop r14
ret
Function at 0x140145058
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
pshufd xmm0, xmmword [rdx], 0x55
lea r10, [0x1403cc840]
mov rbp, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov r14, rdx
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
movzx esi, byte [r8 + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or esi, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl esi, 8
movzx eax, byte [rcx + r10]
or esi, eax
movzx eax, r9b
shl esi, 8
movzx ecx, byte [rax + r10]
or esi, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r10]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r10]
or edi, ecx
mov ecx, edi
call fcn.140348418
mov ebx, eax
mov edx, 8
mov ecx, esi
xor ebx, 2
call fcn.140348418
movd xmm1, ebx
lea rcx, [rsp + 0x20]
xor eax, 2
movd xmm2, edi
punpckldq xmm2, xmm1
movd xmm3, esi
movd xmm0, eax
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
movdqu xmm2, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm0, xmm2
pshufd xmm4, xmm3, 0xff
xorps xmm0, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm4
movdqu xmmword [rbp], xmm1
movdqa xmmword [rsp + 0x20], xmm1
call fcn.1401454f0
movdqu xmm2, xmmword [r14]
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movdqa xmm0, xmm2
xorps xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm3
movdqu xmmword [r14], xmm1
add rsp, 0x30
pop r14
ret