joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005646a
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
movabs r10, 0x8000000000000000
cmp rdx, r9
mov r11, r9
cmovb r11, rdx
xor eax, eax
test r11, r11
je 0x1400564ed
mov r14, 0xffffffffffffffff
xor edi, edi
mov r15, qword [r8 + rdi*8]
mov r12, qword [rcx + rdi*8]
mov r13, r12
xor r13, r15
mov ebp, eax
lea rax, [r13 - 1]
mov rbx, r12
sub rbx, r15
xor rbx, r12
or rbx, r13
xor r13, r10
and rax, r13
sar rax, 0x3f
xor rbx, r12
sar rbx, 0x3f
mov rsi, rbx
xor rbx, r14
and ebx, 1
or rbx, rsi
mov rsi, rax
and ebp, esi
xor rax, r14
and rax, rbx
or rax, rbp
inc rdi
cmp rdi, r11
jb 0x14005649a
cmp rdx, r9
jae 0x14005651b
xor ecx, ecx
or rcx, qword [r8 + rdx*8]
inc rdx
cmp r9, rdx
jne 0x1400564f4
xor r10, rcx
dec rcx
and rcx, r10
sar rcx, 0x3f
mov rdx, rcx
and edx, eax
not rcx
or ecx, edx
mov eax, ecx
jmp 0x14005654a
cmp r9, rdx
jae 0x14005654a
xor ebx, ebx
or rbx, qword [rcx + r9*8]
inc r9
cmp rdx, r9
jne 0x140056522
xor r10, rbx
dec rbx
and rbx, r10
sar rbx, 0x3f
mov rcx, rbx
and ecx, eax
not rbx
and ebx, 1
or ebx, ecx
mov eax, ebx
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140056654
Capabilities:
Encode data using xor

Disassembly:
push rsi
movsxd r9, dword [rcx + 8]
movsxd r10, dword [rdx + 8]
cmp r9d, r10d
jge 0x140056679
mov r11, qword [rdx]
xor r8d, r8d
mov rax, r9
or r8, qword [r11 + rax*8]
inc rax
cmp rax, r10
jl 0x14005666b
jmp 0x14005667c
xor r8d, r8d
cmp r10d, r9d
jge 0x140056693
mov r11, qword [rcx]
mov rax, r10
or r8, qword [r11 + rax*8]
inc rax
cmp r9, rax
jne 0x140056687
cmp r9d, r10d
cmovl r10d, r9d
test r10d, r10d
jle 0x1400566bd
mov r9, qword [rcx]
mov r11, qword [rdx]
movsxd r10, r10d
xor eax, eax
mov rsi, qword [r11 + rax*8]
xor rsi, qword [r9 + rax*8]
or r8, rsi
inc rax
cmp rax, r10
jl 0x1400566aa
mov eax, dword [rdx + 0x10]
xor eax, dword [rcx + 0x10]
movsxd rcx, eax
xor eax, eax
or rcx, r8
sete al
pop rsi
ret
Function at 0x14005bb3b
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
movsxd rax, dword [rdx + 8]
test rax, rax
je 0x14005bb91
mov r14, rcx
mov rcx, qword [rdx]
xor edi, edi
xor esi, esi
or rsi, qword [rcx + rdi*8]
inc rdi
cmp rdi, rax
jb 0x14005bb57
test rsi, rsi
je 0x14005bb91
test eax, eax
jle 0x14005bb71
test byte [rcx], 1
jne 0x14005bbc0
mov dword [rsp + 0x20], 0xa9
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x68
jmp 0x14005bbaf
mov dword [rsp + 0x20], 0xa5
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x69
call fcn.140081e26
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
cmp dword [rdx + 0x10], 0
je 0x14005bbe6
mov dword [rsp + 0x20], 0xad
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x6d
jmp 0x14005bbaf
lea rdi, [r14 + 0x18]
mov rcx, rdi
call fcn.140056026
test rax, rax
je 0x14005bc86
movsxd rcx, dword [r14 + 0x20]
mov rax, rcx
test rcx, rcx
jle 0x14005bc16
mov rdx, qword [rdi]
lea rcx, [rax - 1]
cmp qword [rdx + rax*8 - 8], 0
je 0x14005bbff
mov dword [r14 + 0x20], eax
test eax, eax
jne 0x14005bc26
mov dword [r14 + 0x28], 0
mov rax, qword [rdi]
mov r9, qword [rax]
mov esi, 1
mov edx, 0x40
xor ecx, ecx
movabs r8, 0x8000000000000000
mov edi, esi
and edi, 1
neg rdi
mov rax, r9
and rax, rdi
mov rbx, rax
xor rbx, rsi
shr rbx, 1
and rax, rsi
add rax, rbx
and rdi, r8
shr rcx, 1
or rcx, rdi
mov rsi, rax
dec rdx
jne 0x14005bc42
mov qword [r14 + 0x30], rcx
mov qword [r14 + 0x38], 0
mov esi, 1
jmp 0x14005bbb4
mov dword [rsp + 0x20], 0xb3
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_bn_montgomery.c
xor esi, esi
mov ecx, 3
xor edx, edx
mov r8d, 0x44
jmp 0x14005bbaf
Function at 0x14005d202
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
movsxd r8, dword [rcx + 8]
test r8, r8
jle 0x14005d380
movabs r11, 0x8000000000000000
mov r9, qword [rcx]
xor r14d, r14d
mov r10, 0xffffffffffffffff
xor r13d, r13d
xor eax, eax
xor r12d, r12d
mov rsi, qword [r9 + r13*8]
lea rdi, [rsi - 1]
mov rbx, rsi
shl rbx, 0x20
mov rcx, rbx
xor rcx, r11
dec rbx
and rbx, rcx
sar rbx, 0x3f
mov ecx, ebx
mov rbp, rsi
mov rdx, rbx
xor rbx, r10
and rbx, rsi
xor rsi, r11
and rdi, rsi
sar rdi, 0x3f
mov esi, r12d
xor rdi, r10
not esi
and ecx, 0x20
shr rbp, 0x20
or r12, rdi
mov r15d, edi
and ebp, edx
or rbx, rbp
mov rdi, rbx
and r15d, esi
shl rdi, 0x30
mov rdx, rdi
xor rdx, r11
dec rdi
and rdi, rdx
sar rdi, 0x3f
mov edx, edi
and edx, 0x10
mov rsi, rdi
xor rdi, r10
or edx, ecx
and rdi, rbx
shr rbx, 0x10
and rsi, rbx
or rdi, rsi
mov rbx, rdi
shl rbx, 0x38
mov rcx, rbx
xor rcx, r11
dec rbx
and rbx, rcx
sar rbx, 0x3f
mov ecx, ebx
and ecx, 8
or ecx, edx
mov rdx, rbx
xor rbx, r10
and rbx, rdi
shr rdi, 8
and rdx, rdi
or rbx, rdx
mov rdi, rbx
shl rdi, 0x3c
mov rdx, rdi
xor rdx, r11
dec rdi
and rdi, rdx
sar rdi, 0x3f
mov edx, edi
and edx, 4
mov rsi, rdi
xor rdi, r10
or edx, ecx
and rdi, rbx
shr rbx, 4
and rsi, rbx
or rdi, rsi
mov rbx, rdi
shl rbx, 0x3e
mov rcx, rbx
xor rcx, r11
dec rbx
and rbx, rcx
sar rbx, 0x3f
mov ecx, ebx
and ecx, 2
or ecx, edx
mov rdx, rbx
xor rbx, r10
and ebx, edi
mov esi, edi
shr esi, 2
and esi, edx
or ebx, esi
shl rbx, 0x3f
mov rdx, rbx
xor rdx, r11
dec rbx
and rbx, rdx
shr rbx, 0x3f
or ebx, ecx
add ebx, r14d
and ebx, r15d
or eax, ebx
inc r13
add r14d, 0x40
cmp r13, r8
jl 0x14005d23a
jmp 0x14005d382
xor eax, eax
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14005d884
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1c0
mov rax, qword [0x140102388]
xor rax, rsp
mov qword [rsp + 0x1b8], rax
test rdx, rdx
je 0x14005da67
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
test byte [0x140108e97], 0x40
je 0x14005d8d9
lea rcx, [rsp + 0x190]
mov edx, 0x20
call fcn.1400901d0
test eax, eax
jne 0x14005d909
call fcn.140090204
test eax, eax
je 0x14005d8f7
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1a0], xmm0
movaps xmmword [rsp + 0x190], xmm0
jmp 0x14005d909
lea rcx, [rsp + 0x190]
mov edx, 0x20
call fcn.140090228
xor eax, eax
movups xmm0, xmmword [rbx + rax]
xorps xmm0, xmmword [rsp + rax + 0x190]
movaps xmmword [rsp + rax + 0x190], xmm0
add rax, 0x10
cmp rax, 0x20
jne 0x14005d90b
mov ecx, 1
call fcn.140089357
test rax, rax
je 0x14005d98d
mov r14, rax
mov r12, rax
add r12, 0x120
cmp dword [rax + 0x120], 0x1000
jb 0x14005da04
lea rbx, [rsp + 0x60]
mov edx, 0x30
mov rcx, rbx
call fcn.140090228
mov r8d, 0x30
mov rcx, r14
mov rdx, rbx
call fcn.140063dba
test eax, eax
je 0x14005da8b
mov qword [r14 + 0x118], 1
jmp 0x14005d9f9
mov ecx, 0x128
call fcn.14006c96c
test rax, rax
je 0x14005d9b7
mov r14, rax
lea r8, [0x140064090]
mov ecx, 1
mov rdx, rax
call fcn.1400893f2
test eax, eax
jne 0x14005d9bc
lea r14, [rsp + 0x60]
mov dword [r14 + 0x124], 0
lea rbx, [rsp + 0x30]
mov edx, 0x30
mov rcx, rbx
call fcn.140090228
mov rcx, r14
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call fcn.140063cea
test eax, eax
je 0x14005da8b
lea r12, [r14 + 0x120]
mov dword [r14 + 0x120], 0
mov eax, 0x20
mov r13d, 0x10000
lea r15, [rsp + 0x190]
cmp rsi, r13
mov ebx, 0x10000
cmovb rbx, rsi
mov qword [rsp + 0x20], rax
mov rcx, r14
mov rdx, rdi
mov r8, rbx
mov r9, r15
call fcn.140063e97
test eax, eax
je 0x14005da8b
inc dword [r12]
add rdi, rbx
mov eax, 0
sub rsi, rbx
jne 0x14005da17
lea rax, [rsp + 0x60]
cmp r14, rax
jne 0x14005da67
lea rcx, [rsp + 0x60]
mov edx, 0x120
call fcn.14006c9ca
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.1400aaed0
nop
add rsp, 0x1c0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400bba84
int3

Function at 0x14005ec42
Capabilities:
Hash data using sha512

Disassembly:
push rsi
push rdi
sub rsp, 0x108
mov rsi, r8
mov r8, rdx
mov rdx, rcx
mov rax, qword [0x140102388]
xor rax, rsp
mov qword [rsp + 0x100], rax
movaps xmm0, xmmword [0x1400dfd20]
lea rdi, [rsp + 0x20]
movaps xmmword [rdi], xmm0
movaps xmm0, xmmword [0x1400dfd30]
movaps xmmword [rdi + 0x10], xmm0
movaps xmm0, xmmword [0x1400dfd40]
movaps xmmword [rdi + 0x20], xmm0
movaps xmm0, xmmword [0x1400dfd50]
movaps xmmword [rdi + 0x30], xmm0
movabs rax, 0x4000000000
mov qword [rdi + 0xd0], rax
xorps xmm0, xmm0
movaps xmmword [rdi + 0x40], xmm0
mov rcx, rdi
call fcn.1400685f7
mov rcx, rsi
mov rdx, rdi
call fcn.1400686f5
mov edx, 0xd8
mov rcx, rdi
call fcn.14006c9ca
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1400aaed0
mov rax, rsi
add rsp, 0x108
pop rdi
pop rsi
ret
Function at 0x140063cea
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x140102388]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edi, edi
cmp r9, 0x30
ja 0x140063da4
mov rsi, rcx
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmm2, xmmword [rdx + 0x20]
movaps xmmword [rsp + 0x50], xmm2
movaps xmmword [rsp + 0x40], xmm1
movaps xmmword [rsp + 0x30], xmm0
test r9, r9
je 0x140063d3f
xor eax, eax
mov cl, byte [r8 + rax]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp r9, rax
jne 0x140063d2f
xor eax, eax
lea rcx, [0x1400e0340]
movaps xmm0, xmmword [rsp + rax + 0x30]
xorps xmm0, xmmword [rax + rcx]
movaps xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
cmp rax, 0x30
jne 0x140063d48
lea r8, [rsi + 0xf8]
mov qword [rsp + 0x20], 0x20
lea rdi, [rsp + 0x30]
mov rcx, rsi
xor edx, edx
mov r9, rdi
call fcn.14005e42c
mov qword [rsi + 0x100], rax
movaps xmm0, xmmword [rdi + 0x20]
movups xmmword [rsi + 0x108], xmm0
mov qword [rsi + 0x118], 1
mov edi, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400aaed0
mov eax, edi
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x140063dba
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rax, qword [0x140102388]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edi, edi
cmp r8, 0x30
ja 0x140063e7a
mov r12, r8
mov r14, rdx
mov rsi, rcx
lea r15, [rcx + 0xf8]
lea rdi, [rcx + 0x108]
xor ebx, ebx
mov ecx, dword [rsi + 0x114]
call fcn.1400b6660
lea ecx, [rax + 1]
call fcn.1400b6660
mov dword [rsi + 0x114], eax
lea rdx, [rsp + rbx]
add rdx, 0x30
mov rcx, rdi
mov r8, rsi
call qword [rsi + 0xf8]
add rbx, 0x10
cmp rbx, 0x30
jb 0x140063dfb
test r12, r12
je 0x140063e49
xor eax, eax
mov cl, byte [r14 + rax]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp r12, rax
jne 0x140063e39
mov qword [rsp + 0x20], 0x20
lea rbx, [rsp + 0x30]
mov rcx, rsi
xor edx, edx
mov r8, r15
mov r9, rbx
call fcn.14005e42c
mov qword [rsi + 0x100], rax
movaps xmm0, xmmword [rbx + 0x20]
movups xmmword [rdi], xmm0
mov edi, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400aaed0
mov eax, edi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400645c8
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r15, qword [rsp + 0x90]
test r15, r15
je 0x14006460d
cmp r15, 0xa
ja 0x140064630
mov dword [rsp + 0x20], 0xcb
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_rsa_padding.c
xor esi, esi
mov ecx, 4
xor edx, edx
mov r8d, 0x7e
jmp 0x1400646ed
mov dword [rsp + 0x20], 0xc2
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_rsa_padding.c
xor esi, esi
mov ecx, 4
xor edx, edx
mov r8d, pe_nt_image_headers64
jmp 0x1400646ed
mov r14, rdx
movzx r10d, byte [r9]
dec r10
movzx r11d, byte [r9 + 1]
xor r11, 2
dec r11
mov esi, 2
mov r12, 0xffffffffffffffff
xor edi, edi
mov rbx, 0xffffffffffffffff
mov r13, rbx
movzx ebx, byte [r9 + rsi]
dec rbx
sar rbx, 0x3f
mov rdx, rbx
and rdx, r13
mov rax, rdx
and rax, rsi
xor rdx, r12
and rdi, rdx
or rdi, rax
xor rbx, r12
and rbx, r13
inc rsi
cmp r15, rsi
jne 0x14006465b
mov rdx, 0xffffffffffffffff
xor rbx, rdx
and r11, r10
sar r11, 0x3f
and r11, rbx
lea rbx, [rdi - 0xa]
mov rax, rdi
xor rax, rdx
and rax, rbx
sar rax, 0x3f
xor rax, rdx
test r11, rax
je 0x1400646cf
inc rdi
sub r15, rdi
cmp r15, r8
jbe 0x140064704
mov dword [rsp + 0x20], 0xf8
jmp 0x1400646d7
mov dword [rsp + 0x20], 0xf0
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_rsa_padding.c
xor esi, esi
mov ecx, 4
xor edx, edx
mov r8d, 0x89
call fcn.140081e26
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test r15, r15
je 0x140064717
add r9, rdi
mov rdx, r9
mov r8, r15
call fcn.1400ad770
mov qword [r14], r15
mov esi, 1
jmp 0x1400646f2
Function at 0x14006478f
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov r12, r9
mov r13, r8
mov rdi, rdx
mov r14, rcx
mov r15, qword [rsp + 0x108]
mov rax, qword [rsp + 0x100]
mov rcx, qword [0x140102388]
xor rcx, rsp
mov qword [rsp + 0x80], rcx
test rax, rax
jne 0x1400647ef
lea rcx, [0x140108928]
lea rdx, [0x14005e940]
call fcn.140089210
lea rax, [0x140108930]
test r15, r15
cmove r15, rax
mov ebx, dword [rax + 4]
lea rcx, [rbx + rbx]
add rcx, 2
cmp rcx, rdi
jbe 0x140064826
mov dword [rsp + 0x20], 0x14a
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_rsa_padding.c
xor esi, esi
mov ecx, 4
xor edx, edx
mov r8d, 0x7e
jmp 0x14006485b
lea rcx, [rbx + rbx]
mov rbp, rcx
not rbp
lea rdx, [rdi + rbp]
add rdx, 0xffffffffffffffff
cmp rdx, r12
jae 0x140064886
mov dword [rsp + 0x20], 0x150
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_rsa_padding.c
xor esi, esi
mov ecx, 4
xor edx, edx
mov r8d, 0x72
call fcn.140081e26
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400aaed0
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
dec rdi
or rcx, 1
cmp rdi, rcx
jae 0x14006489f
mov dword [rsp + 0x20], 0x155
jmp 0x14006480e
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xf0]
mov byte [r14], 0
lea r8, [r14 + rbx]
add r8, 1
mov qword [rsp + 0x20], rax
xor esi, esi
mov qword [rsp + 0x38], r8
xor r9d, r9d
call fcn.14005e874
test eax, eax
je 0x140064860
mov rsi, rdi
sub rsi, r12
add rbp, rsi
mov rcx, qword [rsp + 0x38]
je 0x1400648fb
mov rax, qword [rsp + 0x38]
lea rcx, [rax + rbx]
xor edx, edx
mov r8, rbp
call fcn.1400adb80
mov rcx, qword [rsp + 0x38]
inc r14
mov rax, rbx
not rax
add rsi, rax
mov byte [rcx + rsi], 1
test r12, r12
mov rbp, rcx
je 0x140064928
lea rcx, [rdi + rbp]
sub rcx, r12
sub rcx, rbx
mov rdx, r13
mov r8, r12
call fcn.1400ad770
lea r8, [0x1400e0370]
mov rcx, r14
mov rdx, rbx
call fcn.14005d884
sub rdi, rbx
mov rcx, rdi
call fcn.14006c96c
test rax, rax
je 0x1400649c4
mov r12, rax
mov qword [rsp + 0x20], r15
mov rcx, rax
mov rdx, rdi
mov r8, r14
mov r9, rbx
call fcn.1400649e7
xor esi, esi
test eax, eax
je 0x1400649b7
test rdi, rdi
je 0x140064980
xor eax, eax
mov cl, byte [r12 + rax]
xor byte [rbp + rax], cl
inc rax
cmp rdi, rax
jne 0x140064970
mov qword [rsp + 0x20], r15
lea rcx, [rsp + 0x40]
mov rdx, rbx
mov r8, rbp
mov r9, rdi
call fcn.1400649e7
test eax, eax
je 0x1400649b7
mov esi, 1
test ebx, ebx
je 0x1400649b7
xor eax, eax
mov cl, byte [rsp + rax + 0x40]
xor byte [r14 + rax], cl
inc rax
cmp rbx, rax
jne 0x1400649a7
mov rcx, r12
call fcn.14006c993
jmp 0x140064860
mov dword [rsp + 0x20], 0x169
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_rsa_padding.c
xor esi, esi
mov ecx, 4
xor edx, edx
mov r8d, 0x41
jmp 0x14006485b
Function at 0x14006c469
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
xorps xmm0, xmm0
movups xmmword [r9 + 0x50], xmm0
movups xmmword [r9 + 0x40], xmm0
movups xmmword [r9 + 0x30], xmm0
movups xmmword [r9 + 0x20], xmm0
movups xmmword [r9 + 0x10], xmm0
movups xmmword [r9], xmm0
test rdx, rdx
je 0x14006c4fb
mov r12, r9
mov rdi, r8
mov r15, rdx
mov r14, rcx
lea r13, [r9 + 0x20]
lea rsi, [r9 + 0x40]
xor ebp, ebp
mov rbx, rbp
xor rbx, r14
mov rcx, r12
mov rdx, rbx
mov r8, rdi
mov r9, r12
call fcn.14006c411
lea r8, [rdi + 0x20]
mov rcx, r13
mov rdx, rbx
mov r9, r13
call fcn.14006c411
lea r8, [rdi + 0x40]
mov rcx, rsi
mov rdx, rbx
mov r9, rsi
call fcn.14006c411
inc rbp
add rdi, 0x60
cmp r15, rbp
jne 0x14006c4b4
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14006ca6d
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x14006ca8f
xor r9d, r9d
xor eax, eax
mov r10b, byte [rdx + r9]
xor r10b, byte [rcx + r9]
movzx r10d, r10b
or eax, r10d
inc r9
cmp r8, r9
jne 0x14006ca77
ret
xor eax, eax
ret
Function at 0x140075ad0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140075ae9
mov dword [rsi], eax
mov al, 1
jmp 0x140075aeb
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x140080260
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140108e78]
mov ecx, dword [0x140105b70]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140080295
lea rcx, [0x140108e70]
add rsp, 0x28
jmp fcn.140049c00
lea rcx, [0x140108e78]
call fcn.1400aac80
cmp dword [0x140108e78], 0xffffffff
jne 0x140080285
mov qword [0x140108e70], 0
lea rcx, [0x140108e70]
xor edx, edx
call fcn.140049c90
lea rcx, [0x140108e78]
call fcn.1400aad18
jmp 0x140080285

Function at 0x140081bb0
Capabilities:
Encode data using xor

Disassembly:
cmp rdx, 0x7fffffff
jbe 0x1400549ec
xor eax, eax
ret
jmp 0x140081bb0
push rsi
xor eax, eax
test rcx, rcx
je 0x140081ce1
test edx, edx
jle 0x140081ce1
mov r8d, edx
and r8d, 3
mov r11d, edx
shr r11d, 2
je 0x140081c62
lea r10d, [r11 - 1]
test dl, 4
jne 0x140081be9
mov r9d, r11d
mov rsi, rcx
jmp 0x140081c11
movzx r9d, word [rcx]
add r9d, edx
movzx eax, word [rcx + 2]
shl eax, 0xb
xor eax, r9d
shl r9d, 0x10
xor r9d, eax
lea rsi, [rcx + 4]
mov edx, r9d
shr edx, 0xb
add edx, r9d
mov r9d, r10d
lea r10, [r10*4 + 4]
cmp r11d, 1
je 0x140081c5f
nop
movzx eax, word [rsi]
add eax, edx
movzx edx, word [rsi + 2]
shl edx, 0xb
xor edx, eax
shl eax, 0x10
xor eax, edx
mov edx, eax
shr edx, 0xb
add edx, eax
movzx eax, word [rsi + 4]
add eax, edx
movzx edx, word [rsi + 6]
shl edx, 0xb
xor edx, eax
shl eax, 0x10
xor eax, edx
mov edx, eax
shr edx, 0xb
add edx, eax
add rsi, 8
add r9d, 0xfffffffe
jg 0x140081c20
add rcx, r10
cmp r8d, 1
je 0x140081c90
cmp r8d, 2
je 0x140081ca2
cmp r8d, 3
jne 0x140081cb5
movzx eax, word [rcx]
add edx, eax
movsx eax, byte [rcx + 2]
shl eax, 0x12
xor eax, edx
mov ecx, edx
shl ecx, 0x10
xor eax, ecx
mov edx, eax
shr edx, 0xb
jmp 0x140081cb3
movsx eax, byte [rcx]
add edx, eax
mov eax, edx
shl eax, 0xa
xor eax, edx
mov edx, eax
shr edx, 1
jmp 0x140081cb3
movzx eax, word [rcx]
add edx, eax
mov eax, edx
shl eax, 0xb
xor eax, edx
mov edx, eax
shr edx, 0x11
add edx, eax
lea eax, [rdx*8]
xor eax, edx
mov ecx, eax
shr ecx, 5
add ecx, eax
mov eax, ecx
shl eax, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
add ecx, eax
mov edx, ecx
shl edx, 0x19
xor edx, ecx
mov eax, edx
shr eax, 6
add eax, edx
pop rsi
ret

Function at 0x1400820e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140082100
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret
Function at 0x140082140
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140082160
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret

Function at 0x1400821a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400821c3
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x140082220
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140082243
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret

Function at 0x1400822a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400822c9
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret