joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401451e0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
pshufd xmm0, xmmword [rdx], 0x55
lea r10, [0x1403cc840]
mov rbp, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov r14, rdx
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
movzx esi, byte [r8 + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or esi, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl esi, 8
movzx eax, byte [rcx + r10]
or esi, eax
movzx eax, r9b
shl esi, 8
movzx ecx, byte [rax + r10]
or esi, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r10]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r10]
or edi, ecx
mov ecx, edi
call fcn.140348418
mov ebx, eax
mov edx, 8
mov ecx, esi
xor ebx, 4
call fcn.140348418
movd xmm1, ebx
lea rcx, [rsp + 0x20]
xor eax, 4
movd xmm2, edi
punpckldq xmm2, xmm1
movd xmm3, esi
movd xmm0, eax
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
movdqu xmm2, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm0, xmm2
pshufd xmm4, xmm3, 0xff
xorps xmm0, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm4
movdqu xmmword [rbp], xmm1
movdqa xmmword [rsp + 0x20], xmm1
call fcn.1401454f0
movdqu xmm2, xmmword [r14]
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movdqa xmm0, xmm2
xorps xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm3
movdqu xmmword [r14], xmm1
add rsp, 0x30
pop r14
ret
Function at 0x140145368
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
pshufd xmm0, xmmword [rdx], 0x55
lea r10, [0x1403cc840]
mov rbp, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov r14, rdx
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
movzx esi, byte [r8 + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or esi, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl esi, 8
movzx eax, byte [rcx + r10]
or esi, eax
movzx eax, r9b
shl esi, 8
movzx ecx, byte [rax + r10]
or esi, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r10]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r10]
or edi, ecx
mov ecx, edi
call fcn.140348418
mov ebx, eax
mov edx, 8
mov ecx, esi
xor ebx, 8
call fcn.140348418
movd xmm1, ebx
lea rcx, [rsp + 0x20]
xor eax, 8
movd xmm2, edi
punpckldq xmm2, xmm1
movd xmm3, esi
movd xmm0, eax
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
movdqu xmm2, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm0, xmm2
pshufd xmm4, xmm3, 0xff
xorps xmm0, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm4
movdqu xmmword [rbp], xmm1
movdqa xmmword [rsp + 0x20], xmm1
call fcn.1401454f0
movdqu xmm2, xmmword [r14]
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movdqa xmm0, xmm2
xorps xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm3
movdqu xmmword [r14], xmm1
add rsp, 0x30
pop r14
ret

Function at 0x1401454f0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
pshufd xmm0, xmmword [rcx], 0x55
lea r9, [0x1403cc840]
movd eax, xmm0
pshufd xmm0, xmmword [rcx], 0xff
mov r8d, eax
shr rax, 0x10
movzx edx, al
mov eax, r8d
shr rax, 0x18
movzx esi, byte [rdx + r9]
movzx eax, byte [rax + r9]
shl eax, 8
or esi, eax
mov eax, r8d
shr rax, 8
movzx edx, al
shl esi, 8
movzx eax, byte [rdx + r9]
or esi, eax
movzx eax, r8b
shl esi, 8
movzx edx, byte [rax + r9]
movd eax, xmm0
or esi, edx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r9]
movzx eax, byte [rax + r9]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r9]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r9]
or edi, ecx
mov ecx, edi
call fcn.140348418
mov edx, 8
mov ecx, esi
mov ebx, eax
call fcn.140348418
movd xmm2, ebx
mov rbx, qword [rsp + 0x30]
movd xmm0, esi
mov rsi, qword [rsp + 0x38]
movd xmm1, eax
movd xmm3, edi
punpckldq xmm0, xmm1
punpckldq xmm3, xmm2
punpcklqdq xmm0, xmm3
add rsp, 0x20
pop rdi
ret
Function at 0x14014e11c
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm4, xmmword [rcx + 0x10]
movdqu xmm3, xmmword [rcx]
vbroadcastf128 ymm1, xmmword [rcx]
vmovdqu ymmword [rdx], ymm1
mov rax, qword [rsp + 0x28]
vmovdqa xmm1, xmm3
vpslldq xmm1, xmm1, 4
vinsertf128 ymm0, ymm4, xmm4, 1
vmovdqu ymmword [r8], ymm0
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm3
vmovdqa xmm3, xmm1
vxorps xmm3, xmm3, xmm0
vpslldq xmm1, xmm1, 4
vxorps xmm3, xmm3, xmm1
vaeskeygenassist xmm0, xmm4, 1
vpshufd xmm1, xmm0, 0xff
vxorps xmm3, xmm3, xmm1
vmovdqa xmm1, xmm4
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm4
vmovdqa xmm4, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm4, xmm4, xmm0
vxorps xmm4, xmm4, xmm1
vaeskeygenassist xmm0, xmm3, 0
vpshufd xmm1, xmm0, 0xaa
vxorps xmm4, xmm4, xmm1
vinsertf128 ymm1, ymm3, xmm3, 1
vmovdqu ymmword [r9], ymm1
vmovdqa xmm1, xmm3
vpslldq xmm1, xmm1, 4
vinsertf128 ymm0, ymm4, xmm4, 1
vmovdqu ymmword [rax], ymm0
mov rax, qword [rsp + 0x30]
vmovdqa xmm0, xmm1
vxorps xmm0, xmm0, xmm3
vpslldq xmm1, xmm1, 4
vmovdqa xmm3, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm3, xmm3, xmm0
vxorps xmm3, xmm3, xmm1
vaeskeygenassist xmm0, xmm4, 2
vpshufd xmm1, xmm0, 0xff
vxorps xmm3, xmm3, xmm1
vmovdqa xmm1, xmm4
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm4
vmovdqa xmm4, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm4, xmm4, xmm0
vxorps xmm4, xmm4, xmm1
vaeskeygenassist xmm0, xmm3, 0
vpshufd xmm1, xmm0, 0xaa
vxorps xmm4, xmm4, xmm1
vinsertf128 ymm1, ymm3, xmm3, 1
vmovdqu ymmword [rax], ymm1
mov rax, qword [rsp + 0x38]
vmovdqa xmm1, xmm3
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm3
vmovdqa xmm3, xmm1
vxorps xmm3, xmm3, xmm0
vpslldq xmm1, xmm1, 4
vxorps xmm3, xmm3, xmm1
vaeskeygenassist xmm0, xmm4, 4
vpshufd xmm1, xmm0, 0xff
vxorps xmm3, xmm3, xmm1
vmovdqa xmm1, xmm4
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vinsertf128 ymm2, ymm4, xmm4, 1
vxorps xmm0, xmm0, xmm4
vmovdqu ymmword [rax], ymm2
mov rax, qword [rsp + 0x40]
vpslldq xmm1, xmm1, 4
vmovdqa xmm4, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm4, xmm4, xmm0
vxorps xmm4, xmm4, xmm1
vaeskeygenassist xmm0, xmm3, 0
vpshufd xmm1, xmm0, 0xaa
vxorps xmm4, xmm4, xmm1
vinsertf128 ymm1, ymm3, xmm3, 1
vmovdqu ymmword [rax], ymm1
mov rax, qword [rsp + 0x48]
vmovdqa xmm1, xmm3
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm3
vmovdqa xmm3, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm3, xmm3, xmm0
vxorps xmm3, xmm3, xmm1
vinsertf128 ymm2, ymm4, xmm4, 1
vmovdqu ymmword [rax], ymm2
mov rax, qword [rsp + 0x50]
vaeskeygenassist xmm0, xmm4, 8
vpshufd xmm1, xmm0, 0xff
vxorps xmm3, xmm3, xmm1
vmovdqa xmm1, xmm4
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vmovdqa xmm2, xmm1
vxorps xmm0, xmm0, xmm4
vxorps xmm2, xmm2, xmm0
vpslldq xmm1, xmm1, 4
vxorps xmm2, xmm2, xmm1
vaeskeygenassist xmm0, xmm3, 0
vpshufd xmm1, xmm0, 0xaa
vxorps xmm2, xmm2, xmm1
vinsertf128 ymm1, ymm3, xmm3, 1
vmovdqu ymmword [rax], ymm1
mov rax, qword [rsp + 0x58]
vinsertf128 ymm2, ymm2, xmm2, 1
vmovdqu ymmword [rax], ymm2
vzeroupper
ret
Function at 0x14015e2c0
Capabilities:
Encode data using xor
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x14015e346
test rcx, rcx
je 0x14015e346
xor edx, edx
mov r8d, 0xf0
call fcn.140337250
mov r8d, 0x40
lea rdx, [0x1403ccc60]
mov rcx, rbx
call fcn.1403367f0
mov rsi, rbx
mov rbp, rdi
mov r14d, 8
mov r8d, 8
lea rcx, [rsp + 0x48]
mov rdx, rbp
call fcn.1403367f0
mov rax, qword [rsp + 0x48]
add rbp, 8
xor qword [rsi], rax
lea rsi, [rsi + 8]
sub r14, 1
jne 0x14015e310
movzx eax, byte [rdi]
mov dword [rbx + 0xe4], eax
xor eax, eax
jmp 0x14015e349
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140166ba8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x20]
lea r14, [rdx + 0x100]
shr rax, 3
mov rbx, rcx
and eax, 0x3f
add rcx, 0x28
add rcx, rax
mov edi, 0x38
mov rsi, rdx
lea rdx, [0x1403cd590]
lea rbp, [rbx + 0x28]
cmp rax, rdi
jae 0x140166c01
sub rdi, rax
mov r8, rdi
call fcn.1403367f0
jmp 0x140166c2d
mov r8d, 0x40
sub r8, rax
call fcn.1403367f0
mov r9, r14
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.140166d68
mov r8, rdi
xor edx, edx
mov rcx, rbp
call fcn.140337250
mov rcx, qword [rbx + 0x20]
mov r9, r14
mov rax, rcx
mov byte [rbx + 0x67], cl
shr rax, 8
mov r8, rsi
mov byte [rbx + 0x66], al
mov rdx, rbp
mov rax, rcx
shr rax, 0x10
mov byte [rbx + 0x65], al
mov rax, rcx
shr rax, 0x18
mov byte [rbx + 0x64], al
mov rax, rcx
shr rax, 0x20
mov byte [rbx + 0x63], al
mov rax, rcx
shr rax, 0x28
mov byte [rbx + 0x62], al
mov rax, rcx
shr rcx, 0x38
mov byte [rbx + 0x60], cl
mov rcx, rbx
shr rax, 0x30
mov byte [rbx + 0x61], al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.140166d68
Function at 0x140167970
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, qword [rsp + 0x60]
mov r15d, 0x40
mov r14, r9
mov rsi, r8
mov rbx, rdx
mov rbp, rcx
cmp r8, r15
jbe 0x1401679d1
call fcn.140167d74
mov r9, r14
mov r8, rsi
mov rdx, rbx
mov rcx, rbp
call fcn.140167ab4
mov rbx, qword [rsp + 0x68]
mov r8, r14
mov rcx, rbx
mov rdx, rbp
call fcn.140167a7c
lea esi, [r15 - 0x20]
mov rcx, rbp
call fcn.140167d74
mov r8, r15
mov edx, 0x36
mov rcx, rdi
call fcn.140337250
sub rbx, rdi
test rsi, rsi
je 0x140167a05
mov rcx, rdi
mov rdx, rsi
mov al, byte [rbx + rcx]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1401679f7
mov r9, r14
mov r8, r15
mov rdx, rdi
mov rcx, rbp
call fcn.140167ab4
lea rcx, [rbp + 0x68]
call fcn.140167d74
mov r8, r15
mov edx, 0x5c
mov rcx, rdi
call fcn.140337250
test rsi, rsi
je 0x140167a47
mov r9, rdi
mov al, byte [rbx + r9]
xor byte [r9], al
inc r9
sub rsi, 1
jne 0x140167a37
mov r9, r14
lea rcx, [rbp + 0x68]
mov r8, r15
mov rdx, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.140167ab4

Function at 0x140167d74
Capabilities:
Hash data using sha256

Disassembly:
and qword [rcx + 0x20], 0
lea rdx, [0x1403cd5d0]
mov r8d, 0x20
jmp fcn.1403367f0

Function at 0x1401682b4
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r11d, r8d
test r9d, r9d
je 0x1401682d4
mov al, byte [rdx]
lea r8d, [r10 + r11]
xor byte [r8 + rcx], al
inc r10d
inc rdx
cmp r10d, r9d
jb 0x1401682bf
ret

Function at 0x14016830c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x1404e8f18]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
xor r10d, r10d
mov r14d, 0xcccccccd
mov eax, r14d
lea rsi, [rsp]
mul r10d
xor edi, edi
mov r11d, r10d
shr edx, 2
lea eax, [rdx + rdx*4]
sub r11d, eax
lea ebp, [r11 + r11*4]
lea r8d, [rdi + 2]
mov eax, r14d
lea ecx, [r8 - 1]
mul ecx
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
mov eax, r14d
mul r8d
add ecx, ebp
shr edx, 2
mov r9, qword [rbx + rcx*8]
mov ecx, r11d
lea eax, [rdx + rdx*4]
not r9
sub r8d, eax
mov eax, r14d
mul edi
add r8d, ebp
shr edx, 2
sub ecx, edx
and r9, qword [rbx + r8*8]
lea eax, [rdi + rcx*4]
inc edi
add ecx, eax
xor r9, qword [rbx + rcx*8]
mov qword [rsi], r9
lea rsi, [rsi + 8]
cmp edi, 5
jb 0x140168355
xor r8d, r8d
lea r9, [rsp]
mov eax, r14d
mov ecx, r11d
mul r8d
shr edx, 2
sub ecx, edx
lea eax, [r8 + rcx*4]
inc r8d
add ecx, eax
mov rax, qword [r9]
lea r9, [r9 + 8]
mov qword [rbx + rcx*8], rax
cmp r8d, 5
jb 0x1401683b4
inc r10d
cmp r10d, 5
jb 0x140168339
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1403354e0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1401685ac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x60
mov rax, qword [0x1404e8f18]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rcx
lea r9, [rsp]
xor r8d, r8d
mov ebp, 0xcccccccd
mov eax, ebp
xor ebx, ebx
mul r8d
xor r11d, r11d
mov r10d, edx
shr r10d, 2
mov ecx, r11d
mov eax, ebp
mul r11d
inc r11d
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
sub ecx, r10d
lea eax, [r8 + rcx*4]
add ecx, eax
xor rbx, qword [rdi + rcx*8]
cmp r11d, 5
jb 0x1401685ea
mov qword [r9], rbx
inc r8d
add r9, 8
cmp r8d, 5
jb 0x1401685d9
mov r9d, 4
lea r10, [rsp + 0x28]
lea r11d, [r9 + 1]
lea ecx, [r9 - 3]
mov eax, ebp
mul ecx
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
mov eax, ebp
mul r9d
mov r8, qword [rsp + rcx*8]
mov ecx, r9d
shr edx, 2
inc r9d
lea eax, [rdx + rdx*4]
sub ecx, eax
mov eax, ecx
mov rcx, r8
shr rcx, 0x3f
xor rcx, qword [rsp + rax*8]
lea rax, [r8 + r8]
xor rcx, rax
mov qword [r10], rcx
lea r10, [r10 + 8]
sub r11, 1
jne 0x14016862f
xor r8d, r8d
lea r9, [rsp + 0x28]
mov rbx, qword [r9]
mov eax, ebp
mul r8d
xor r10d, r10d
mov r11d, edx
shr r11d, 2
mov ecx, r10d
mov eax, ebp
mul r10d
inc r10d
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
sub ecx, r11d
lea eax, [r8 + rcx*4]
add ecx, eax
xor qword [rdi + rcx*8], rbx
cmp r10d, 5
jb 0x140168691
inc r8d
add r9, 8
cmp r8d, 5
jb 0x14016867f
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1403354e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14016a3c0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1404e8f18]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
lea r9, [rdx + 0x40]
mov rdx, rcx
lea r10, [r11 - 0x58]
sub rdx, rdi
mov rsi, rcx
sub r10, rdi
mov rbp, r8
mov ecx, 8
mov rax, qword [rdx + r9]
xor rax, qword [r9]
mov qword [r10 + r9 - 0x40], rax
lea r9, [r9 + 8]
sub rcx, 1
jne 0x14016a402
xor ebx, ebx
mov ecx, ebx
mov rax, qword [rsi + rcx*8]
xor qword [rsp + rcx*8 + 0x20], rax
inc rcx
cmp rcx, 8
jl 0x14016a41c
mov rcx, rbx
mov rax, qword [rdi + rcx*8]
xor qword [rsp + rcx*8 + 0x20], rax
inc rcx
cmp rcx, 8
jl 0x14016a431
mov r8d, 4
lea rcx, [rsp + 0x20]
mov rdx, rbp
call fcn.1401707c0
mov rcx, rbx
mov rax, qword [rsi + rcx*8 + 0x40]
xor qword [rsp + rcx*8 + 0x20], rax
inc rcx
cmp rcx, 8
jl 0x14016a459
mov rax, qword [rdi + rbx*8 + 0x40]
xor qword [rsp + rbx*8 + 0x20], rax
inc rbx
cmp rbx, 8
jl 0x14016a46c
lea rdx, [rbp + 0x40]
mov r8d, 4
lea rcx, [rsp + 0x20]
call fcn.1401707c0
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1403354e0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14016a4bc
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1404e8f18]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
lea r9, [rdx + 0x40]
mov rdx, rcx
lea r10, [r11 - 0x58]
sub rdx, rdi
mov rsi, rcx
sub r10, rdi
mov rbp, r8
mov ecx, 8
mov rax, qword [rdx + r9]
xor rax, qword [r9]
mov qword [r10 + r9 - 0x40], rax
lea r9, [r9 + 8]
sub rcx, 1
jne 0x14016a4fe
xor ebx, ebx
mov ecx, ebx
mov rax, qword [rsi + rcx*8]
xor qword [rsp + rcx*8 + 0x20], rax
inc rcx
cmp rcx, 8
jl 0x14016a518
mov rcx, rbx
mov rax, qword [rdi + rcx*8]
xor qword [rsp + rcx*8 + 0x20], rax
inc rcx
cmp rcx, 8
jl 0x14016a52d
mov r8d, 1
lea rcx, [rsp + 0x20]
mov rdx, rbp
call fcn.1401707c0
mov rcx, rbx
mov rax, qword [rsi + rcx*8 + 0x40]
xor qword [rsp + rcx*8 + 0x20], rax
inc rcx
cmp rcx, 8
jl 0x14016a555
mov rax, qword [rdi + rbx*8 + 0x40]
xor qword [rsp + rbx*8 + 0x20], rax
inc rbx
cmp rbx, 8
jl 0x14016a568
lea rdx, [rbp + 0x40]
mov r8d, 1
lea rcx, [rsp + 0x20]
call fcn.1401707c0
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1403354e0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1402db854
Capabilities:
Encode data using xor

Disassembly:
sub rdx, rcx
mov r8d, 0x80
mov rax, qword [rdx + rcx]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub r8, 1
jne 0x1402db85d
ret

Function at 0x1402e4d58
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1404e8f18]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r12, qword [r9]
xor r14d, r14d
mov r13d, edx
mov rsi, r9
mov dword [rsp + 0x30], r8d
mov rbx, rcx
mov dword [rsp + 0x34], r13d
mov rbp, rcx
lea edi, [r14 + 4]
mov qword [rsp + 0x38], r12
mov ecx, dword [rsi + 0x24]
lea r8, [r14 + r13]
mov edx, dword [rsi + 0x20]
mov eax, dword [rsi + 0x1c]
add rdx, r8
imul rdx, rax
shr rdx, cl
mov rcx, rbp
imul edx, dword [rsi + 0x18]
sub r8d, edx
mov edx, r8d
mov r8d, 0x40
shl rdx, 6
add rdx, r12
call fcn.1403367f0
mov r9d, 0x40
mov dword [rsp + 0x28], 0x40
lea eax, [r14 + r13]
mov qword [rsp + 0x20], rbp
xor dword [rbp], eax
mov r8, rbp
mov ecx, 0x200
lea edx, [r9 - 0x3f]
call fcn.140012168
inc r14
add rbp, 0x40
cmp r14, rdi
jb 0x1402e4da0
xor r8d, r8d
cmp dword [rsp + 0x30], r8d
je 0x1402e4f35
mov ebp, dword [rsi + 0x24]
lea r10, [rsp + 0x40]
mov r14d, dword [rsi + 0x20]
mov eax, r8d
mov r15d, dword [rsi + 0x1c]
xor r9d, r9d
mov r13d, dword [rsp + 0x34]
and eax, 0xf
mov r12, qword [rsp + 0x38]
lea r11, [rbx + rax*4]
lea eax, [r9 + r13]
xor eax, r8d
imul ecx, eax, 0x1000193
xor ecx, dword [r11]
mov edx, ecx
lea rax, [r14 + rcx]
mov rcx, rbp
imul rax, r15
shr rax, cl
imul eax, dword [rsi + 0x18]
sub edx, eax
mov ecx, edx
shl rcx, 6
add rcx, r12
mov qword [r10], rcx
prefetcht0 byte [rcx]
inc r9d
lea r11, [r11 + 0x40]
lea r10, [r10 + 8]
cmp r9d, edi
jb 0x1402e4e42
mov rdx, qword [rsp + 0x40]
mov r10d, 0x10
mov r12d, dword [rsp + 0x30]
sub rdx, rbx
mov r9d, r10d
mov rcx, rbx
imul eax, dword [rcx], 0x1000193
xor eax, dword [rdx + rcx]
mov dword [rcx], eax
add rcx, rdi
sub r9, 1
jne 0x1402e4ea0
mov rdx, qword [rsp + 0x48]
lea rcx, [rbx + 0x40]
sub rdx, rbx
mov r9, r10
imul eax, dword [rcx], 0x1000193
xor eax, dword [rdx + rcx - 0x40]
mov dword [rcx], eax
add rcx, rdi
sub r9, 1
jne 0x1402e4ec3
mov rdx, qword [rsp + 0x50]
lea rcx, [rbx + 0x80]
sub rdx, rbx
mov r9, r10
imul eax, dword [rcx], 0x1000193
xor eax, dword [rdx + rcx - 0x80]
mov dword [rcx], eax
add rcx, rdi
sub r9, 1
jne 0x1402e4eea
mov rdx, qword [rsp + 0x58]
lea rcx, [rbx + 0xc0]
sub rdx, rbx
mov r9, r10
imul eax, dword [rcx], 0x1000193
xor eax, dword [rdx + rcx - 0xc0]
mov dword [rcx], eax
add rcx, rdi
sub r9, 1
jne 0x1402e4f11
inc r8d
cmp r8d, r12d
jne 0x1402e4e1b
mov r9d, 0x40
mov dword [rsp + 0x28], 0x40
mov r8, rbx
mov qword [rsp + 0x20], rbx
mov ecx, 0x200
lea edx, [r9 - 0x3f]
call fcn.140012168
add rbx, 0x40
sub rdi, 1
jne 0x1402e4f35
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1403354e0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402e4f88
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r10d, dword [r9 + 0x20]
mov rbx, rcx
mov ecx, dword [r9 + 0x24]
mov ebp, r8d
mov eax, dword [r9 + 0x1c]
mov r12d, 0x40
mov r15, qword [r9]
mov r8d, r12d
mov r14d, edx
mov rsi, r9
add r10, r14
imul r10, rax
shr r10, cl
mov rcx, rbx
imul r10d, dword [r9 + 0x18]
sub edx, r10d
shl rdx, 6
add rdx, r15
call fcn.1403367f0
xor dword [rbx], r14d
lea edx, [r12 - 0x3f]
mov r9d, r12d
mov dword [rsp + 0x28], r12d
mov r8, rbx
mov qword [rsp + 0x20], rbx
mov ecx, 0x200
call fcn.140012168
xor r10d, r10d
test ebp, ebp
je 0x1402e5079
mov ecx, dword [rsi + 0x24]
mov edx, r10d
and edx, 0xf
mov eax, r10d
xor eax, r14d
mov edi, 0x10
imul r8d, eax, 0x1000193
mov eax, dword [rsi + 0x1c]
xor r8d, dword [rbx + rdx*4]
mov edx, dword [rsi + 0x20]
add rdx, r8
imul rdx, rax
shr rdx, cl
imul edx, dword [rsi + 0x18]
sub r8d, edx
mov r11d, r8d
mov r8, rbx
shl r11, 6
add r11, r15
sub r11, rbx
imul eax, dword [r8], 0x1000193
xor eax, dword [r11 + r8]
mov dword [r8], eax
lea r8, [r8 + 4]
sub rdi, 1
jne 0x1402e5059
inc r10d
cmp r10d, ebp
jne 0x1402e5013
mov dword [rsp + 0x28], r12d
mov r9d, r12d
mov r8, rbx
mov qword [rsp + 0x20], rbx
mov edx, 1
mov ecx, 0x200
call fcn.140012168
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x1402e50b8
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x80
mov rax, qword [0x1404e8f18]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rdx
mov rsi, rcx
test dl, 0x3f
je 0x1402e50e7
xor al, al
jmp 0x1402e5204
mov r15d, 0x40
shr rbx, 6
mov dword [rsp + 0x28], r15d
mov ecx, 0x200
mov qword [rsp + 0x20], rsi
lea edx, [r15 - 0x3f]
lea r9d, [r15 - 0x20]
call fcn.140012168
lea edi, [r15 - 0x3f]
cmp ebx, edi
je 0x1402e514b
mov ecx, edi
lea r8d, [rdi - 1]
shl rcx, 6
mov r9d, r15d
add rcx, rsi
shl r8, 6
mov dword [rsp + 0x28], r15d
add r8, rsi
mov qword [rsp + 0x20], rcx
mov edx, 1
mov ecx, 0x200
call fcn.140012168
inc edi
cmp edi, ebx
jne 0x1402e5115
mov ebp, 3
xor edi, edi
test ebx, ebx
je 0x1402e51f8
xor edx, edx
mov r9d, edi
shl r9, 6
add r9, rsi
mov eax, dword [r9]
div ebx
lea eax, [rbx - 1]
mov r8d, edx
add eax, edi
xor edx, edx
shl r8, 6
div ebx
mov ecx, edx
lea rdx, [rsp + 0x30]
shl rcx, 6
sub r8, rdx
add r8, rsi
mov edx, 0x10
movups xmm0, xmmword [rcx + rsi]
movups xmm1, xmmword [rcx + rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rcx + rsi + 0x20]
movaps xmmword [rsp + 0x40], xmm1
movups xmm1, xmmword [rcx + rsi + 0x30]
lea rcx, [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm1
mov eax, dword [r8 + rcx]
xor dword [rcx], eax
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x1402e51bd
mov dword [rsp + 0x28], r15d
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r9
mov edx, 1
mov r9d, r15d
mov ecx, 0x200
call fcn.140012168
inc edi
cmp edi, ebx
jne 0x1402e515a
sub rbp, 1
jne 0x1402e5150
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1403354e0
add rsp, 0x80
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1402e859c
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdx, [0x140462cc8]
add rcx, 0x40
mov r8d, 0x20
call fcn.1403367f0
and qword [rbx + 0x60], 0
add rsp, 0x20
pop rbx
ret