joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b97e0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400b9905
test rdx, rdx
je 0x1400b9905
call fcn.1400b8660
test eax, eax
jne 0x1400b990a
mov eax, dword [rbx]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 4]
mov dword [rbx], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 8]
mov dword [rbx + 4], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0xc]
mov dword [rbx + 8], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0xc], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x14]
mov dword [rbx + 0x10], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x18]
mov dword [rbx + 0x14], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x1c]
mov dword [rbx + 0x18], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov dword [rbx + 0x1c], ecx
mov rcx, rbx
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1400b8610
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400b9b00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
shr r8d, 3
mov r10, rdx
mov r9, rcx
test r8d, r8d
je 0x1400b9b81
mov qword [rsp], rbx
sub r10, rcx
mov r11d, r8d
movabs rbx, 0xffff0000ffff
movabs r8, 0xff00ff00ff00ff
mov rcx, qword [r10 + r9]
lea r9, [r9 + 8]
mov rdx, rcx
mov rax, rcx
shl rcx, 8
shr rdx, 8
shl rax, 8
xor rdx, rax
and rdx, r8
xor rdx, rcx
mov rcx, rdx
mov rax, rdx
shr rcx, 0x10
shl rax, 0x10
xor rcx, rax
shl rdx, 0x10
and rcx, rbx
xor rcx, rdx
rol rcx, 0x20
mov qword [r9 - 8], rcx
sub r11, 1
jne 0x1400b9b31
mov rbx, qword [rsp]
add rsp, 8
ret

Function at 0x1400bc400
Capabilities:
Hash data using sha384

Disassembly:
xor edx, edx
lea r8d, [rdx - 2]
jmp fcn.1400bc410

Function at 0x1400bc410
Capabilities:
Hash data using sha384

Disassembly:
test rcx, rcx
jne 0x1400b9b9b
mov eax, 0xffffff53
ret
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
xor eax, eax
mov dword [rcx + 0xc0], eax
mov qword [rcx + 0xc8], rax
mov qword [rcx + 0xd0], rax
ret
test rcx, rcx
jne 0x1400bc41b
mov eax, 0xffffff53
ret
mov qword [rcx + 0xd8], rdx
jmp 0x1400b9b90
Function at 0x1400bc520
Capabilities:
Hash data using sha384

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400bc56b
test rdx, rdx
je 0x1400bc56b
call fcn.1400b9e30
test eax, eax
jne 0x1400bc570
movups xmm0, xmmword [rbx]
mov rcx, rbx
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rdi + 0x20], xmm0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1400b9b90
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400bf450
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
test byte [0x140c06fe8], 8
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
je 0x1400bf47c
xor ecx, ecx
call fcn.1400bf500
test eax, eax
je 0x1400bf4e3
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400bf4b1
mov eax, 0xffffff99
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx]
mov r8, rsi
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x1400bf4d8
mov eax, 0xffffff98
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400bfb20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
xor ebx, ebx
mov esi, edx
xor r11d, r11d
mov edi, edx
mov rbp, rcx
add rsi, 0xfffffffffffffff8
je 0x1400bfbbd
mov qword [rsp + 0x10], r14
lea eax, [rdi - 8]
mov r14d, 8
mov edx, r14d
cmp rsi, rdx
cmovbe edx, eax
nop dword [rax]
xor r8d, r8d
test edx, edx
jle 0x1400bfb9c
mov eax, r11d
add rax, rbp
mov r10d, edx
mov r9d, edx
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rax + r10]
movzx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r8d, edx
sub r9, 1
jne 0x1400bfb80
test r8d, r8d
jne 0x1400bfba1
mov ebx, 3
add r11d, r14d
mov edx, edi
sub edx, r11d
mov ecx, r11d
cmp edx, r14d
cmova edx, r14d
cmp rcx, rsi
jb 0x1400bfb60
mov r14, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x20]
mov eax, ebx
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x28]
pop rdi
ret
Function at 0x1400c3e90
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x850
mov rax, qword [0x1403f79f0]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov esi, r9d
mov r10, rdx
mov r9d, dword [rcx]
neg esi
mov eax, r9d
mov r11, rcx
xor eax, dword [rdx]
and eax, esi
movsxd rdx, r8d
mov dword [rsp], eax
test r8d, r8d
jle 0x1400c0a82
mov qword [rsp + 0x848], rbx
add rcx, 8
mov qword [rsp + 0x840], rdi
mov rbx, r10
sub rbx, r11
lea rdi, [rsp]
sub rdi, r11
mov r8, rdx
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbx + rcx]
xor eax, dword [rcx]
lea rcx, [rcx + 4]
and eax, esi
mov dword [rdi + rcx - 4], eax
sub r8, 1
jne 0x1400c0a00
mov ebx, dword [rsp]
lea rcx, [r11 + 8]
mov rdi, qword [rsp + 0x840]
xor r9d, ebx
mov dword [r11], r9d
mov r8, rdx
lea r9, [rsp]
sub r9, r11
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [rcx + r9]
xor dword [rcx], eax
lea rcx, [rcx + 4]
sub r8, 1
jne 0x1400c0a40
xor dword [r10], ebx
lea r8, [rsp]
mov rbx, qword [rsp + 0x848]
lea rax, [r10 + 8]
sub r8, r10
nop word [rax + rax]
mov ecx, dword [r8 + rax]
xor dword [rax], ecx
lea rax, [rax + 4]
sub rdx, 1
jne 0x1400c0a70
jmp 0x1400c0a8b
xor r9d, eax
mov dword [rcx], r9d
xor dword [r10], eax
xor eax, eax
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.1400da560
add rsp, 0x850
pop rsi
ret
jmp 0x1400c0990
Function at 0x1400cce40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x1a0
mov rax, qword [0x1403f79f0]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rbx, r8
test rcx, rcx
je 0x1400ccfcd
test rbx, rbx
je 0x1400ccfcd
lea r8, [rsp + 0x20]
call fcn.1400ccff0
cmp eax, 0xffffff53
je 0x1400ccfcd
movsxd rdx, dword [rsp + 0x110]
aesimc xmm1, xmmword [rsp + 0x30]
movdqa xmm0, xmmword [rsp + 0x20]
mov rax, rdx
add rax, rax
mov dword [rbx + 0xf0], edx
mov r8, rdx
add r8, r8
movdqu xmmword [rbx + rax*8 - 0x10], xmm1
lea rax, [rdx - 2]
aesimc xmm1, xmmword [rsp + 0x50]
add rax, rax
movdqu xmmword [rbx + r8*8], xmm0
aesimc xmm0, xmmword [rsp + 0x40]
movdqu xmmword [rbx + rax*8], xmm0
lea rax, [rdx - 3]
aesimc xmm0, xmmword [rsp + 0x60]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm1
lea rax, [rdx - 4]
aesimc xmm1, xmmword [rsp + 0x70]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm0
lea rax, [rdx - 5]
aesimc xmm0, xmmword [rsp + 0x80]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm1
lea rax, [rdx - 6]
aesimc xmm1, xmmword [rsp + 0x90]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm0
lea rax, [rdx - 7]
aesimc xmm0, xmmword [rsp + 0xa0]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm1
lea rax, [rdx - 8]
aesimc xmm1, xmmword [rsp + 0xb0]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm0
lea rax, [rdx - 9]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm1
cmp edx, 0xa
jle 0x1400ccf8d
aesimc xmm0, xmmword [rsp + 0xc0]
aesimc xmm1, xmmword [rsp + 0xd0]
lea rax, [rdx - 0xa]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm0
lea rax, [rdx - 0xb]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm1
cmp edx, 0xc
jle 0x1400ccfbe
aesimc xmm0, xmmword [rsp + 0xe0]
aesimc xmm1, xmmword [rsp + 0xf0]
lea rax, [rdx - 0xc]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm0
lea rax, [rdx - 0xd]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm1
movdqu xmm0, xmmword [rsp + r8*8 + 0x20]
xor eax, eax
movdqu xmmword [rbx], xmm0
jmp 0x1400ccfd2
mov eax, 0xffffff53
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400da560
add rsp, 0x1a0
pop rbx
ret
Function at 0x1400cfee0
Capabilities:
Encrypt data using aes
Reference aes constants
Resolve function by parsing pe exports

Disassembly:
mov rax, r8
mov r8, rdx
mov rdx, rax
jmp fcn.1400cef00
Function at 0x1400d1790
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov eax, r8d
xor r9d, r9d
or al, cl
mov r10, rcx
or al, dl
test al, 7
jne 0x1400d1887
shr r8d, 3
test r8d, r8d
je 0x1400d1950
cmp r8d, 8
jb 0x1400d185c
lea eax, [r8 - 1]
lea r11, [rcx + rax*8]
lea rax, [rdx + rax*8]
cmp rcx, rax
ja 0x1400d17db
cmp r11, rdx
jae 0x1400d185c
mov r11d, r8d
and r11d, 0xfffffff8
mov ebx, 4
nop word [rax + rax]
movdqu xmm0, xmmword [rcx + r9*8]
lea eax, [rbx - 2]
movdqu xmm1, xmmword [rdx + r9*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r9*8], xmm1
add r9d, 8
movdqu xmm0, xmmword [rcx + rax*8]
movdqu xmm1, xmmword [rdx + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
mov eax, ebx
movdqu xmm0, xmmword [rcx + rax*8]
movdqu xmm1, xmmword [rdx + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
lea eax, [rbx + 2]
add ebx, 8
movdqu xmm0, xmmword [rcx + rax*8]
movdqu xmm1, xmmword [rdx + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
cmp r9d, r11d
jb 0x1400d17f0
cmp r9d, r8d
jae 0x1400d1950
sub rdx, r10
lea rcx, [rcx + r9*8]
sub r8d, r9d
mov r9d, r8d
nop dword [rax]
mov rax, qword [rdx + rcx]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub r9, 1
jne 0x1400d1870
mov rbx, qword [rsp + 8]
ret
test r8d, r8d
je 0x1400d1950
cmp r8d, 0x40
jb 0x1400d192c
lea eax, [r8 - 1]
lea r11, [rax + rcx]
add rax, rdx
cmp r10, rax
ja 0x1400d18b3
cmp r11, rdx
jae 0x1400d192c
mov ebx, r8d
and ebx, 0xffffffc0
mov r11d, 0x20
nop
movdqu xmm0, xmmword [r9 + rcx]
lea eax, [r11 - 0x10]
movdqu xmm1, xmmword [r9 + rdx]
pxor xmm1, xmm0
movdqu xmmword [r9 + rcx], xmm1
add r9d, 0x40
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + rdx]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
mov eax, r11d
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + rdx]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
lea eax, [r11 + 0x10]
add r11d, 0x40
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + rdx]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
cmp r9d, ebx
jb 0x1400d18c0
cmp r9d, r8d
jae 0x1400d1950
mov eax, r9d
sub rdx, r10
add rax, r10
sub r8d, r9d
mov r9d, r8d
nop dword [rax + rax]
movzx ecx, byte [rdx + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x1400d1940
mov rbx, qword [rsp + 8]
ret
Function at 0x1400d1960
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov eax, r9d
mov r11d, r9d
or al, cl
xor r9d, r9d
or al, dl
mov r10, rdx
or al, r8b
test al, 7
jne 0x1400d1a80
shr r11d, 3
test r11d, r11d
je 0x1400d1b64
cmp r11d, 8
jb 0x1400d1a43
lea eax, [r11 - 1]
mov edx, eax
lea rbx, [rcx + rax*8]
lea rax, [r8 + rax*8]
cmp rcx, rax
ja 0x1400d19b8
cmp rbx, r8
jae 0x1400d1a43
lea rax, [r10 + rdx*8]
cmp rcx, rax
ja 0x1400d19c6
cmp rbx, r10
jae 0x1400d1a43
mov ebx, r11d
and ebx, 0xfffffff8
mov edi, 4
movdqu xmm0, xmmword [r8 + r9*8]
lea eax, [rdi - 2]
movdqu xmm1, xmmword [r10 + r9*8]
pxor xmm1, xmm0
movdqu xmm0, xmmword [r10 + rax*8]
movdqu xmmword [rcx + r9*8], xmm1
add r9d, 8
movdqu xmm1, xmmword [r8 + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
mov eax, edi
movdqu xmm0, xmmword [r8 + rax*8]
movdqu xmm1, xmmword [r10 + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
lea eax, [rdi + 2]
add edi, 8
movdqu xmm1, xmmword [r8 + rax*8]
movdqu xmm0, xmmword [r10 + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
cmp r9d, ebx
jb 0x1400d19d1
cmp r9d, r11d
jae 0x1400d1b64
sub r10, r8
lea rdx, [r8 + r9*8]
sub rcx, r8
sub r11d, r9d
mov r8d, r11d
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + rdx]
xor rax, qword [rdx]
mov qword [rcx + rdx], rax
lea rdx, [rdx + 8]
sub r8, 1
jne 0x1400d1a60
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
test r11d, r11d
je 0x1400d1b64
cmp r11d, 0x40
jb 0x1400d1b3e
lea eax, [r11 - 1]
mov edx, eax
lea rbx, [rax + rcx]
add rax, r10
cmp rcx, rax
ja 0x1400d1aae
cmp rbx, r10
jae 0x1400d1b3e
lea rax, [rdx + r8]
cmp rcx, rax
ja 0x1400d1ac0
cmp rbx, r8
jae 0x1400d1b3e
mov edi, r11d
and edi, 0xffffffc0
mov ebx, 0x20
nop dword [rax + rax]
movdqu xmm0, xmmword [r9 + r8]
lea eax, [rbx - 0x10]
movdqu xmm1, xmmword [r9 + r10]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax + r8]
movdqu xmmword [r9 + rcx], xmm1
add r9d, 0x40
movdqu xmm1, xmmword [rax + r10]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
mov eax, ebx
movdqu xmm0, xmmword [rax + r8]
movdqu xmm1, xmmword [rax + r10]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
lea eax, [rbx + 0x10]
add ebx, 0x40
movdqu xmm1, xmmword [rax + r10]
movdqu xmm0, xmmword [rax + r8]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
cmp r9d, edi
jb 0x1400d1ad0
cmp r9d, r11d
jae 0x1400d1b64
mov edx, r9d
sub r8, r10
add rdx, r10
sub rcx, r10
sub r11d, r9d
mov r9d, r11d
movzx eax, byte [r8 + rdx]
xor al, byte [rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x1400d1b50
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x1400d8530
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push r15
sub rsp, 0x20
mov r15d, edx
mov rsi, r8
neg r15d
mov rbp, rcx
test rcx, rcx
je 0x1400d8623
test r8, r8
je 0x1400d8623
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
xor r12d, r12d
mov ebx, r12d
mov qword [rsp + 0x58], r14
cmp dword [rcx], ebx
jle 0x1400d85aa
lea r14, [r8 + 8]
nop dword [rax]
mov edx, ebx
mov rcx, rbp
call fcn.1400d84f0
mov edx, ebx
mov rcx, rsi
mov edi, eax
call fcn.1400d84f0
xor edi, eax
lea r14, [r14 + 4]
and edi, r15d
inc ebx
xor dword [r14 - 4], edi
cmp ebx, dword [rbp]
jl 0x1400d8580
mov eax, dword [rsi]
cmp ebx, eax
jge 0x1400d85eb
movsxd r14, ebx
add r14, 2
lea r14, [rsi + r14*4]
nop dword [rax + rax]
mov edx, ebx
mov rcx, rbp
call fcn.1400d84f0
mov edx, ebx
mov rcx, rsi
mov edi, eax
call fcn.1400d84f0
xor edi, eax
lea r14, [r14 + 4]
and edi, r15d
inc ebx
xor dword [r14 - 4], edi
mov eax, dword [rsi]
cmp ebx, eax
jl 0x1400d85c0
mov edx, dword [rsi + 4]
mov ecx, eax
xor ecx, dword [rbp]
mov r14, qword [rsp + 0x58]
and ecx, r15d
mov rdi, qword [rsp + 0x48]
xor ecx, eax
mov rbx, qword [rsp + 0x40]
mov eax, r12d
mov r12, qword [rsp + 0x50]
mov dword [rsi], ecx
xor edx, dword [rbp + 4]
and edx, r15d
xor dword [rsi + 4], edx
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
mov eax, 0xffffff53
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret

Function at 0x1400d87a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
mov r8, qword [rsp + 0x28]
mov r9d, dword [rsp + 0x30]
mov r10, rcx
shr rcx, 4
shl r10, 0x3c
je 0x1400d87cd
add rcx, 1
sub rsi, 0x10
movdqa xmm1, xmmword [rdx]
pxor xmm1, xmmword [rdi]
pxor xmm1, xmmword [r8]
add rsi, 0x10
add rdi, 0x10
cmp r9d, 0xc
aesenc xmm1, xmmword [r8 + 0x10]
aesenc xmm1, xmmword [r8 + 0x20]
aesenc xmm1, xmmword [r8 + 0x30]
aesenc xmm1, xmmword [r8 + 0x40]
aesenc xmm1, xmmword [r8 + 0x50]
aesenc xmm1, xmmword [r8 + 0x60]
aesenc xmm1, xmmword [r8 + 0x70]
aesenc xmm1, xmmword [r8 + 0x80]
aesenc xmm1, xmmword [r8 + 0x90]
movdqa xmm2, xmmword [r8 + 0xa0]
jb 0x1400d887a
cmp r9d, 0xe
aesenc xmm1, xmmword [r8 + 0xa0]
aesenc xmm1, xmmword [r8 + 0xb0]
movdqa xmm2, xmmword [r8 + 0xc0]
jb 0x1400d887a
aesenc xmm1, xmmword [r8 + 0xc0]
aesenc xmm1, xmmword [r8 + 0xd0]
movdqa xmm2, xmmword [r8 + 0xe0]
dec rcx
aesenclast xmm1, xmm2
movdqu xmmword [rsi], xmm1
jne 0x1400d87d5
mov rdi, rax
mov rsi, r11
ret
Function at 0x1400d9e0d
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
mov dword [rsi + 0xf0], 0xa
movdqu xmm1, xmmword [rdi]
movdqa xmmword [rsi], xmm1
aeskeygenassist xmm2, xmm1, 1
call fcn.1400d9edb
movdqa xmmword [rsi + 0x10], xmm1
aeskeygenassist xmm2, xmm1, 2
call fcn.1400d9edb
movdqa xmmword [rsi + 0x20], xmm1
aeskeygenassist xmm2, xmm1, 4
call fcn.1400d9edb
movdqa xmmword [rsi + 0x30], xmm1
aeskeygenassist xmm2, xmm1, 8
call fcn.1400d9edb
movdqa xmmword [rsi + 0x40], xmm1
aeskeygenassist xmm2, xmm1, 0x10
call fcn.1400d9edb
movdqa xmmword [rsi + 0x50], xmm1
aeskeygenassist xmm2, xmm1, 0x20
call fcn.1400d9edb
movdqa xmmword [rsi + 0x60], xmm1
aeskeygenassist xmm2, xmm1, 0x40
call fcn.1400d9edb
movdqa xmmword [rsi + 0x70], xmm1
aeskeygenassist xmm2, xmm1, 0x80
call fcn.1400d9edb
movdqa xmmword [rsi + 0x80], xmm1
aeskeygenassist xmm2, xmm1, 0x1b
call fcn.1400d9edb
movdqa xmmword [rsi + 0x90], xmm1
aeskeygenassist xmm2, xmm1, 0x36
call fcn.1400d9edb
movdqa xmmword [rsi + 0xa0], xmm1
mov rdi, rax
mov rsi, r11
ret

Function at 0x1400d9f04
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
movdqu xmm1, xmmword [rdi]
movq xmm3, qword [rdi + 0x10]
movdqa xmmword [rsi], xmm1
movdqa xmm5, xmm3
aeskeygenassist xmm2, xmm3, 1
call fcn.1400da029
shufpd xmm5, xmm1, 0
movdqa xmmword [rsi + 0x10], xmm5
movdqa xmm6, xmm1
shufpd xmm6, xmm3, 1
movdqa xmmword [rsi + 0x20], xmm6
aeskeygenassist xmm2, xmm3, 2
call fcn.1400da029
movdqa xmmword [rsi + 0x30], xmm1
movdqa xmm5, xmm3
aeskeygenassist xmm2, xmm3, 4
call fcn.1400da029
shufpd xmm5, xmm1, 0
movdqa xmmword [rsi + 0x40], xmm5
movdqa xmm6, xmm1
shufpd xmm6, xmm3, 1
movdqa xmmword [rsi + 0x50], xmm6
aeskeygenassist xmm2, xmm3, 8
call fcn.1400da029
movdqa xmmword [rsi + 0x60], xmm1
movdqa xmm5, xmm3
aeskeygenassist xmm2, xmm3, 0x10
call fcn.1400da029
shufpd xmm5, xmm1, 0
movdqa xmmword [rsi + 0x70], xmm5
movdqa xmm6, xmm1
shufpd xmm6, xmm3, 1
movdqa xmmword [rsi + 0x80], xmm6
aeskeygenassist xmm2, xmm3, 0x20
call fcn.1400da029
movdqa xmmword [rsi + 0x90], xmm1
movdqa xmm5, xmm3
aeskeygenassist xmm2, xmm3, 0x40
call fcn.1400da029
shufpd xmm5, xmm1, 0
movdqa xmmword [rsi + 0xa0], xmm5
movdqa xmm6, xmm1
shufpd xmm6, xmm3, 1
movdqa xmmword [rsi + 0xb0], xmm6
aeskeygenassist xmm2, xmm3, 0x80
call fcn.1400da029
movdqa xmmword [rsi + 0xc0], xmm1
movdqa xmmword [rsi + 0xd0], xmm3
mov rdi, rax
mov rsi, r11
movdqa xmm6, xmmword [rsp]
add rsp, 0x18
ret
Function at 0x1400da068
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
movdqu xmm1, xmmword [rdi]
movdqu xmm3, xmmword [rdi + 0x10]
movdqa xmmword [rsi], xmm1
movdqa xmmword [rsi + 0x10], xmm3
aeskeygenassist xmm2, xmm3, 1
call fcn.1400da172
movdqa xmmword [rsi + 0x20], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400da19b
movdqa xmmword [rsi + 0x30], xmm3
aeskeygenassist xmm2, xmm3, 2
call fcn.1400da172
movdqa xmmword [rsi + 0x40], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400da19b
movdqa xmmword [rsi + 0x50], xmm3
aeskeygenassist xmm2, xmm3, 4
call fcn.1400da172
movdqa xmmword [rsi + 0x60], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400da19b
movdqa xmmword [rsi + 0x70], xmm3
aeskeygenassist xmm2, xmm3, 8
call fcn.1400da172
movdqa xmmword [rsi + 0x80], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400da19b
movdqa xmmword [rsi + 0x90], xmm3
aeskeygenassist xmm2, xmm3, 0x10
call fcn.1400da172
movdqa xmmword [rsi + 0xa0], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400da19b
movdqa xmmword [rsi + 0xb0], xmm3
aeskeygenassist xmm2, xmm3, 0x20
call fcn.1400da172
movdqa xmmword [rsi + 0xc0], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400da19b
movdqa xmmword [rsi + 0xd0], xmm3
aeskeygenassist xmm2, xmm3, 0x40
call fcn.1400da172
movdqa xmmword [rsi + 0xe0], xmm1
mov rdi, rax
mov rsi, r11
ret

Function at 0x1400dae50
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400dae9a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400dae9a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400dae9a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400dae9a
cmp dword [rcx + 0x84], 0xe
jbe 0x1400dae9a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400dae9c
xor al, al
add rsp, 0x28
ret
Function at 0x140003448
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003492
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003492
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003492
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003492
cmp dword [rcx + 0x84], 0xe
jbe 0x140003492
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003494
xor al, al
add rsp, 0x28
ret
Function at 0x140009ea0
Capabilities:
Reference sql statements

Disassembly:
mov dword [rcx + 0xb0], edx
mov r8d, edx
add rcx, 0xc0
lea rdx, str.SELECT__FROM__Block_Results__WHERE____Block_Results_.CondID__ld_
jmp qword [sym.imp.mfc140u.dll_CMFCZoomKernel::Filter]
Function at 0x140018930
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rbx, rcx
lea rbp, [rcx + 0x330]
mov rcx, rbp
call fcn.140017d50
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
mov r8d, dword [rbx + 0x234]
lea rdx, str.SELECT__FROM_BlockEffects_WHERE_CondID_ld
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCZoomKernel::Filter]
mov r9, qword [rsp + 0x78]
mov r8d, 4
lea rdx, str.Block_Data_Ex
mov rcx, rbx
call fcn.1400174e0
mov rsi, rax
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x50]
test eax, eax
je 0x140018a87
mov rdx, qword [rsi]
mov rcx, rsi
call qword [rdx + 0x58]
mov rdx, qword [rsi]
mov rcx, rsi
call qword [rdx + 0x78]
test eax, eax
jne 0x140018a87
nop dword [rax]
mov rax, qword [rsi]
lea r8, str.FromBlockID
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantTimeToSystemTime]
mov edi, dword [rax + 8]
lea rcx, [rsp + 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rax, qword [rsi]
lea r8, str.ToBlockID
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantTimeToSystemTime]
mov ebx, dword [rax + 8]
lea rcx, [rsp + 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rax, qword [rsi]
lea r8, str.EffectProb
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantTimeToSystemTime]
movsd xmm6, qword [rax + 8]
lea rcx, [rsp + 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov r9d, ebx
mov r8d, edi
lea rdx, [0x140137298]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCZoomKernel::Filter]
mov rdx, qword [rsp + 0x70]
mov rcx, rbp
call fcn.140011a70
movsd qword [rax], xmm6
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x60]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x78]
test eax, eax
je 0x1400189d0
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x40]
test eax, eax
je 0x140018a9d
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x48]
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rbx, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret