joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140123a24
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rsi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x140123a67
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call fcn.140337660
jmp 0x140123c55
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.140011778
mov r8, qword [rbx + 8]
lea r15, [r14 + rsi]
mov rcx, r15
mov r9d, r12d
mov edx, esi
call fcn.140011778
lea rdi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rdi]
lea r13, [r14 + rsi*2]
mov rcx, r13
mov edx, esi
call fcn.140011778
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rsi*2]
add rcx, rsi
mov r9d, r12d
mov edx, esi
call fcn.140011778
cmp byte [0x1404f03d1], 0
mov r12d, 0x40000
mov rcx, qword [rbx]
je 0x140123aef
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8d, r12d
call fcn.14014dfe8
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8d, r12d
call fcn.14014dfe8
jmp 0x140123b0e
call fcn.1400bbe04
mov rcx, qword [rbx + 8]
call fcn.1400bbe04
mov rcx, qword [rdi]
call fcn.1400bbe04
mov rcx, qword [rbx + 0x18]
call fcn.1400bbe04
mov r9, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rdi
mov r10d, 2
mov rax, qword [r9 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r9 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rsi
mov qword [rcx + 0xf0], rax
sub r10, 1
jne 0x140123b46
lea rax, [0x1403cb4c0]
mov rcx, rbx
mov qword [r9 + 0xe8], rax
call qword [0x1404f03c0]
cmp byte [0x1404f03d1], 0
mov rcx, qword [rbx]
je 0x140123bad
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8, r12
call fcn.14014e95c
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8, r12
call fcn.14014e95c
jmp 0x140123bcc
call fcn.1400c1344
mov rcx, qword [rbx + 8]
call fcn.1400c1344
mov rcx, qword [rdi]
call fcn.1400c1344
mov rcx, qword [rbx + 0x18]
call fcn.1400c1344
mov rcx, qword [rbx]
mov esi, 0x18
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx + 8]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rdi]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx + 0x18]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx]
lea rsi, [0x1403cc9c0]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rdi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140123c74
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rdi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x140123cb7
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call fcn.140337660
jmp 0x140123ebb
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.140011778
mov r8, qword [rbx + 8]
lea r15, [r14 + rdi]
mov rcx, r15
mov r9d, r12d
mov edx, edi
call fcn.140011778
lea rsi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rsi]
lea r13, [r14 + rdi*2]
mov rcx, r13
mov edx, edi
call fcn.140011778
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rdi*2]
add rcx, rdi
mov r9d, r12d
mov edx, edi
call fcn.140011778
xor ecx, ecx
mov rax, qword [rbx + rcx*8]
inc rcx
mov byte [rax + 0x1b0], 1
cmp rcx, 4
jl 0x140123d0c
cmp byte [0x1404f03d1], 0
mov r12d, 0x40000
mov rcx, qword [rbx]
je 0x140123d55
mov rdx, qword [rbx + 8]
mov r9b, 1
mov r8d, r12d
call fcn.14014dfe8
mov rdx, qword [rbx + 0x18]
mov r9b, 1
mov rcx, qword [rsi]
mov r8d, r12d
call fcn.14014dfe8
jmp 0x140123d74
call fcn.1400bc720
mov rcx, qword [rbx + 8]
call fcn.1400bc720
mov rcx, qword [rsi]
call fcn.1400bc720
mov rcx, qword [rbx + 0x18]
call fcn.1400bc720
mov r10, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rsi
mov r9d, 2
mov rax, qword [r10 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r10 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rdi
mov qword [rcx + 0xf0], rax
sub r9, 1
jne 0x140123dac
lea rax, [0x1403cb4c0]
mov rcx, rbx
mov qword [r10 + 0xe8], rax
call qword [0x1404f03c8]
cmp byte [0x1404f03d1], 0
mov rcx, qword [rbx]
je 0x140123e13
mov rdx, qword [rbx + 8]
mov r9b, 1
mov r8, r12
call fcn.14014e95c
mov rdx, qword [rbx + 0x18]
mov r9b, 1
mov rcx, qword [rsi]
mov r8, r12
call fcn.14014e95c
jmp 0x140123e32
call fcn.1400c1ce0
mov rcx, qword [rbx + 8]
call fcn.1400c1ce0
mov rcx, qword [rsi]
call fcn.1400c1ce0
mov rcx, qword [rbx + 0x18]
call fcn.1400c1ce0
mov rcx, qword [rbx]
mov edi, 0x18
mov edx, edi
call fcn.1400118b8
mov rcx, qword [rbx + 8]
mov edx, edi
call fcn.1400118b8
mov rcx, qword [rsi]
mov edx, edi
call fcn.1400118b8
mov rcx, qword [rbx + 0x18]
mov edx, edi
call fcn.1400118b8
mov rcx, qword [rbx]
lea rdi, [0x1403cc9c0]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rsi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140123ed8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rsi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x140123f1b
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call fcn.140337660
jmp 0x140124109
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.140011778
mov r8, qword [rbx + 8]
lea r15, [r14 + rsi]
mov rcx, r15
mov r9d, r12d
mov edx, esi
call fcn.140011778
lea rdi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rdi]
lea r13, [r14 + rsi*2]
mov rcx, r13
mov edx, esi
call fcn.140011778
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rsi*2]
add rcx, rsi
mov r9d, r12d
mov edx, esi
call fcn.140011778
cmp byte [0x1404f03d1], 0
mov r12d, 0x80000
mov rcx, qword [rbx]
je 0x140123fa3
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8d, r12d
call fcn.14014dfe8
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8d, r12d
call fcn.14014dfe8
jmp 0x140123fc2
call fcn.1400bd02c
mov rcx, qword [rbx + 8]
call fcn.1400bd02c
mov rcx, qword [rdi]
call fcn.1400bd02c
mov rcx, qword [rbx + 0x18]
call fcn.1400bd02c
mov r9, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rdi
mov r10d, 2
mov rax, qword [r9 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r9 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rsi
mov qword [rcx + 0xf0], rax
sub r10, 1
jne 0x140123ffa
lea rax, [0x1403cb4c0]
mov rcx, rbx
mov qword [r9 + 0xe8], rax
call qword [0x1404f03a0]
cmp byte [0x1404f03d1], 0
mov rcx, qword [rbx]
je 0x140124061
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8, r12
call fcn.14014e95c
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8, r12
call fcn.14014e95c
jmp 0x140124080
call fcn.1400c262c
mov rcx, qword [rbx + 8]
call fcn.1400c262c
mov rcx, qword [rdi]
call fcn.1400c262c
mov rcx, qword [rbx + 0x18]
call fcn.1400c262c
mov rcx, qword [rbx]
mov esi, 0x18
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx + 8]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rdi]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx + 0x18]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx]
lea rsi, [0x1403cc9c0]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rdi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140124128
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rdi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x14012416b
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call fcn.140337660
jmp 0x14012436f
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.140011778
mov r8, qword [rbx + 8]
lea r15, [r14 + rdi]
mov rcx, r15
mov r9d, r12d
mov edx, edi
call fcn.140011778
lea rsi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rsi]
lea r13, [r14 + rdi*2]
mov rcx, r13
mov edx, edi
call fcn.140011778
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rdi*2]
add rcx, rdi
mov r9d, r12d
mov edx, edi
call fcn.140011778
xor ecx, ecx
mov rax, qword [rbx + rcx*8]
inc rcx
mov byte [rax + 0x1b0], 1
cmp rcx, 4
jl 0x1401241c0
cmp byte [0x1404f03d1], 0
mov r12d, 0x80000
mov rcx, qword [rbx]
je 0x140124209
mov rdx, qword [rbx + 8]
mov r9b, 1
mov r8d, r12d
call fcn.14014dfe8
mov rdx, qword [rbx + 0x18]
mov r9b, 1
mov rcx, qword [rsi]
mov r8d, r12d
call fcn.14014dfe8
jmp 0x140124228
call fcn.1400bd948
mov rcx, qword [rbx + 8]
call fcn.1400bd948
mov rcx, qword [rsi]
call fcn.1400bd948
mov rcx, qword [rbx + 0x18]
call fcn.1400bd948
mov r10, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rsi
mov r9d, 2
mov rax, qword [r10 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r10 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rdi
mov qword [rcx + 0xf0], rax
sub r9, 1
jne 0x140124260
lea rax, [0x1403cb4c0]
mov rcx, rbx
mov qword [r10 + 0xe8], rax
call qword [0x1404f03a8]
cmp byte [0x1404f03d1], 0
mov rcx, qword [rbx]
je 0x1401242c7
mov rdx, qword [rbx + 8]
mov r9b, 1
mov r8, r12
call fcn.14014e95c
mov rdx, qword [rbx + 0x18]
mov r9b, 1
mov rcx, qword [rsi]
mov r8, r12
call fcn.14014e95c
jmp 0x1401242e6
call fcn.1400c2fc8
mov rcx, qword [rbx + 8]
call fcn.1400c2fc8
mov rcx, qword [rsi]
call fcn.1400c2fc8
mov rcx, qword [rbx + 0x18]
call fcn.1400c2fc8
mov rcx, qword [rbx]
mov edi, 0x18
mov edx, edi
call fcn.1400118b8
mov rcx, qword [rbx + 8]
mov edx, edi
call fcn.1400118b8
mov rcx, qword [rsi]
mov edx, edi
call fcn.1400118b8
mov rcx, qword [rbx + 0x18]
mov edx, edi
call fcn.1400118b8
mov rcx, qword [rbx]
lea rdi, [0x1403cc9c0]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rsi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14012438c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rsi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x1401243cf
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call fcn.140337660
jmp 0x1401245bd
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.140011778
mov r8, qword [rbx + 8]
lea r15, [r14 + rsi]
mov rcx, r15
mov r9d, r12d
mov edx, esi
call fcn.140011778
lea rdi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rdi]
lea r13, [r14 + rsi*2]
mov rcx, r13
mov edx, esi
call fcn.140011778
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rsi*2]
add rcx, rsi
mov r9d, r12d
mov edx, esi
call fcn.140011778
cmp byte [0x1404f03d1], 0
mov r12d, 0x100000
mov rcx, qword [rbx]
je 0x140124457
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8d, r12d
call fcn.14014dfe8
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8d, r12d
call fcn.14014dfe8
jmp 0x140124476
call fcn.1400be254
mov rcx, qword [rbx + 8]
call fcn.1400be254
mov rcx, qword [rdi]
call fcn.1400be254
mov rcx, qword [rbx + 0x18]
call fcn.1400be254
mov r9, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rdi
mov r10d, 2
mov rax, qword [r9 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r9 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rsi
mov qword [rcx + 0xf0], rax
sub r10, 1
jne 0x1401244ae
lea rax, [0x1403cb4c0]
mov rcx, rbx
mov qword [r9 + 0xe8], rax
call qword [0x1404f03b8]
cmp byte [0x1404f03d1], 0
mov rcx, qword [rbx]
je 0x140124515
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8, r12
call fcn.14014e95c
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8, r12
call fcn.14014e95c
jmp 0x140124534
call fcn.1400c3914
mov rcx, qword [rbx + 8]
call fcn.1400c3914
mov rcx, qword [rdi]
call fcn.1400c3914
mov rcx, qword [rbx + 0x18]
call fcn.1400c3914
mov rcx, qword [rbx]
mov esi, 0x18
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx + 8]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rdi]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx + 0x18]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx]
lea rsi, [0x1403cc9c0]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rdi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401245dc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rsi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x14012461f
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call fcn.140337660
jmp 0x14012480d
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.140011778
mov r8, qword [rbx + 8]
lea r15, [r14 + rsi]
mov rcx, r15
mov r9d, r12d
mov edx, esi
call fcn.140011778
lea rdi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rdi]
lea r13, [r14 + rsi*2]
mov rcx, r13
mov edx, esi
call fcn.140011778
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rsi*2]
add rcx, rsi
mov r9d, r12d
mov edx, esi
call fcn.140011778
cmp byte [0x1404f03d1], 0
mov r12d, 0x200000
mov rcx, qword [rbx]
je 0x1401246a7
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8d, r12d
call fcn.14014dfe8
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8d, r12d
call fcn.14014dfe8
jmp 0x1401246c6
call fcn.1400beac8
mov rcx, qword [rbx + 8]
call fcn.1400beac8
mov rcx, qword [rdi]
call fcn.1400beac8
mov rcx, qword [rbx + 0x18]
call fcn.1400beac8
mov r9, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rdi
mov r10d, 2
mov rax, qword [r9 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r9 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rsi
mov qword [rcx + 0xf0], rax
sub r10, 1
jne 0x1401246fe
lea rax, [0x1403cb4c0]
mov rcx, rbx
mov qword [r9 + 0xe8], rax
call qword [0x1404f03b0]
cmp byte [0x1404f03d1], 0
mov rcx, qword [rbx]
je 0x140124765
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8, r12
call fcn.14014e95c
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8, r12
call fcn.14014e95c
jmp 0x140124784
call fcn.1400c4210
mov rcx, qword [rbx + 8]
call fcn.1400c4210
mov rcx, qword [rdi]
call fcn.1400c4210
mov rcx, qword [rbx + 0x18]
call fcn.1400c4210
mov rcx, qword [rbx]
mov esi, 0x18
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx + 8]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rdi]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx + 0x18]
mov edx, esi
call fcn.1400118b8
mov rcx, qword [rbx]
lea rsi, [0x1403cc9c0]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rdi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140145d98
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
pshufd xmm0, xmmword [rdx], 0x55
lea r10, [0x1403cc8c0]
mov rbp, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov r14, rdx
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
movzx esi, byte [r8 + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or esi, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl esi, 8
movzx eax, byte [rcx + r10]
or esi, eax
movzx eax, r9b
shl esi, 8
movzx ecx, byte [rax + r10]
or esi, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r10]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r10]
or edi, ecx
mov ecx, edi
call fcn.140348828
mov ebx, eax
mov edx, 8
mov ecx, esi
xor ebx, 1
call fcn.140348828
movd xmm1, ebx
lea rcx, [rsp + 0x20]
xor eax, 1
movd xmm2, edi
punpckldq xmm2, xmm1
movd xmm3, esi
movd xmm0, eax
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
movdqu xmm2, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm0, xmm2
pshufd xmm4, xmm3, 0xff
xorps xmm0, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm4
movdqu xmmword [rbp], xmm1
movdqa xmmword [rsp + 0x20], xmm1
call fcn.1401463b8
movdqu xmm2, xmmword [r14]
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movdqa xmm0, xmm2
xorps xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm3
movdqu xmmword [r14], xmm1
add rsp, 0x30
pop r14
ret
Function at 0x140145f20
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
pshufd xmm0, xmmword [rdx], 0x55
lea r10, [0x1403cc8c0]
mov rbp, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov r14, rdx
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
movzx esi, byte [r8 + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or esi, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl esi, 8
movzx eax, byte [rcx + r10]
or esi, eax
movzx eax, r9b
shl esi, 8
movzx ecx, byte [rax + r10]
or esi, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r10]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r10]
or edi, ecx
mov ecx, edi
call fcn.140348828
mov ebx, eax
mov edx, 8
mov ecx, esi
xor ebx, 2
call fcn.140348828
movd xmm1, ebx
lea rcx, [rsp + 0x20]
xor eax, 2
movd xmm2, edi
punpckldq xmm2, xmm1
movd xmm3, esi
movd xmm0, eax
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
movdqu xmm2, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm0, xmm2
pshufd xmm4, xmm3, 0xff
xorps xmm0, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm4
movdqu xmmword [rbp], xmm1
movdqa xmmword [rsp + 0x20], xmm1
call fcn.1401463b8
movdqu xmm2, xmmword [r14]
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movdqa xmm0, xmm2
xorps xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm3
movdqu xmmword [r14], xmm1
add rsp, 0x30
pop r14
ret
Function at 0x1401460a8
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
pshufd xmm0, xmmword [rdx], 0x55
lea r10, [0x1403cc8c0]
mov rbp, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov r14, rdx
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
movzx esi, byte [r8 + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or esi, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl esi, 8
movzx eax, byte [rcx + r10]
or esi, eax
movzx eax, r9b
shl esi, 8
movzx ecx, byte [rax + r10]
or esi, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r10]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r10]
or edi, ecx
mov ecx, edi
call fcn.140348828
mov ebx, eax
mov edx, 8
mov ecx, esi
xor ebx, 4
call fcn.140348828
movd xmm1, ebx
lea rcx, [rsp + 0x20]
xor eax, 4
movd xmm2, edi
punpckldq xmm2, xmm1
movd xmm3, esi
movd xmm0, eax
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
movdqu xmm2, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm0, xmm2
pshufd xmm4, xmm3, 0xff
xorps xmm0, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm4
movdqu xmmword [rbp], xmm1
movdqa xmmword [rsp + 0x20], xmm1
call fcn.1401463b8
movdqu xmm2, xmmword [r14]
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movdqa xmm0, xmm2
xorps xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm3
movdqu xmmword [r14], xmm1
add rsp, 0x30
pop r14
ret