joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14012d320
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rsi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x14012d363
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call sub.VCRUNTIME140.dll_memset
jmp 0x14012d551
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.14007f644
mov r8, qword [rbx + 8]
lea r15, [r14 + rsi]
mov rcx, r15
mov r9d, r12d
mov edx, esi
call fcn.14007f644
lea rdi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rdi]
lea r13, [r14 + rsi*2]
mov rcx, r13
mov edx, esi
call fcn.14007f644
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rsi*2]
add rcx, rsi
mov r9d, r12d
mov edx, esi
call fcn.14007f644
cmp byte [0x140709c89], 0
mov r12d, 0x80000
mov rcx, qword [rbx]
je 0x14012d3eb
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8d, r12d
call fcn.1401c5fcc
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8d, r12d
call fcn.1401c5fcc
jmp 0x14012d40a
call fcn.14012c040
mov rcx, qword [rbx + 8]
call fcn.14012c040
mov rcx, qword [rdi]
call fcn.14012c040
mov rcx, qword [rbx + 0x18]
call fcn.14012c040
mov r9, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rdi
mov r10d, 2
mov rax, qword [r9 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r9 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rsi
mov qword [rcx + 0xf0], rax
sub r10, 1
jne 0x14012d442
lea rax, [0x140321bc0]
mov rcx, rbx
mov qword [r9 + 0xe8], rax
call qword [0x140709da0]
cmp byte [0x140709c89], 0
mov rcx, qword [rbx]
je 0x14012d4a9
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8, r12
call fcn.1401c6940
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8, r12
call fcn.1401c6940
jmp 0x14012d4c8
call fcn.14012c414
mov rcx, qword [rbx + 8]
call fcn.14012c414
mov rcx, qword [rdi]
call fcn.14012c414
mov rcx, qword [rbx + 0x18]
call fcn.14012c414
mov rcx, qword [rbx]
mov esi, 0x18
mov edx, esi
call fcn.14007f784
mov rcx, qword [rbx + 8]
mov edx, esi
call fcn.14007f784
mov rcx, qword [rdi]
mov edx, esi
call fcn.14007f784
mov rcx, qword [rbx + 0x18]
mov edx, esi
call fcn.14007f784
mov rcx, qword [rbx]
lea rsi, [0x1403220c0]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rdi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14012eb50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rdi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x14012eb93
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call sub.VCRUNTIME140.dll_memset
jmp 0x14012ed97
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.14007f644
mov r8, qword [rbx + 8]
lea r15, [r14 + rdi]
mov rcx, r15
mov r9d, r12d
mov edx, edi
call fcn.14007f644
lea rsi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rsi]
lea r13, [r14 + rdi*2]
mov rcx, r13
mov edx, edi
call fcn.14007f644
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rdi*2]
add rcx, rdi
mov r9d, r12d
mov edx, edi
call fcn.14007f644
xor ecx, ecx
mov rax, qword [rbx + rcx*8]
inc rcx
mov byte [rax + 0x1b0], 1
cmp rcx, 4
jl 0x14012ebe8
cmp byte [0x140709c89], 0
mov r12d, 0x80000
mov rcx, qword [rbx]
je 0x14012ec31
mov rdx, qword [rbx + 8]
mov r9b, 1
mov r8d, r12d
call fcn.1401c5fcc
mov rdx, qword [rbx + 0x18]
mov r9b, 1
mov rcx, qword [rsi]
mov r8d, r12d
call fcn.1401c5fcc
jmp 0x14012ec50
call fcn.14012d628
mov rcx, qword [rbx + 8]
call fcn.14012d628
mov rcx, qword [rsi]
call fcn.14012d628
mov rcx, qword [rbx + 0x18]
call fcn.14012d628
mov r10, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rsi
mov r9d, 2
mov rax, qword [r10 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r10 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rdi
mov qword [rcx + 0xf0], rax
sub r9, 1
jne 0x14012ec88
lea rax, [0x140321bc0]
mov rcx, rbx
mov qword [r10 + 0xe8], rax
call qword [0x140709da8]
cmp byte [0x140709c89], 0
mov rcx, qword [rbx]
je 0x14012ecef
mov rdx, qword [rbx + 8]
mov r9b, 1
mov r8, r12
call fcn.1401c6940
mov rdx, qword [rbx + 0x18]
mov r9b, 1
mov rcx, qword [rsi]
mov r8, r12
call fcn.1401c6940
jmp 0x14012ed0e
call fcn.14012da94
mov rcx, qword [rbx + 8]
call fcn.14012da94
mov rcx, qword [rsi]
call fcn.14012da94
mov rcx, qword [rbx + 0x18]
call fcn.14012da94
mov rcx, qword [rbx]
mov edi, 0x18
mov edx, edi
call fcn.14007f784
mov rcx, qword [rbx + 8]
mov edx, edi
call fcn.14007f784
mov rcx, qword [rsi]
mov edx, edi
call fcn.14007f784
mov rcx, qword [rbx + 0x18]
mov edx, edi
call fcn.14007f784
mov rcx, qword [rbx]
lea rdi, [0x1403220c0]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rsi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14012efc8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rsi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x14012f00b
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call sub.VCRUNTIME140.dll_memset
jmp 0x14012f1f9
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.14007f644
mov r8, qword [rbx + 8]
lea r15, [r14 + rsi]
mov rcx, r15
mov r9d, r12d
mov edx, esi
call fcn.14007f644
lea rdi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rdi]
lea r13, [r14 + rsi*2]
mov rcx, r13
mov edx, esi
call fcn.14007f644
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rsi*2]
add rcx, rsi
mov r9d, r12d
mov edx, esi
call fcn.14007f644
cmp byte [0x140709c89], 0
mov r12d, 0x200000
mov rcx, qword [rbx]
je 0x14012f093
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8d, r12d
call fcn.1401c5fcc
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8d, r12d
call fcn.1401c5fcc
jmp 0x14012f0b2
call fcn.140120f60
mov rcx, qword [rbx + 8]
call fcn.140120f60
mov rcx, qword [rdi]
call fcn.140120f60
mov rcx, qword [rbx + 0x18]
call fcn.140120f60
mov r9, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rdi
mov r10d, 2
mov rax, qword [r9 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r9 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rsi
mov qword [rcx + 0xf0], rax
sub r10, 1
jne 0x14012f0ea
lea rax, [0x140321bc0]
mov rcx, rbx
mov qword [r9 + 0xe8], rax
call qword [0x140709db0]
cmp byte [0x140709c89], 0
mov rcx, qword [rbx]
je 0x14012f151
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8, r12
call fcn.1401c6940
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8, r12
call fcn.1401c6940
jmp 0x14012f170
call fcn.140123d34
mov rcx, qword [rbx + 8]
call fcn.140123d34
mov rcx, qword [rdi]
call fcn.140123d34
mov rcx, qword [rbx + 0x18]
call fcn.140123d34
mov rcx, qword [rbx]
mov esi, 0x18
mov edx, esi
call fcn.14007f784
mov rcx, qword [rbx + 8]
mov edx, esi
call fcn.14007f784
mov rcx, qword [rdi]
mov edx, esi
call fcn.14007f784
mov rcx, qword [rbx + 0x18]
mov edx, esi
call fcn.14007f784
mov rcx, qword [rbx]
lea rsi, [0x1403220c0]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rdi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14012f42c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rsi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x14012f46f
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call sub.VCRUNTIME140.dll_memset
jmp 0x14012f65d
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.14007f644
mov r8, qword [rbx + 8]
lea r15, [r14 + rsi]
mov rcx, r15
mov r9d, r12d
mov edx, esi
call fcn.14007f644
lea rdi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rdi]
lea r13, [r14 + rsi*2]
mov rcx, r13
mov edx, esi
call fcn.14007f644
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rsi*2]
add rcx, rsi
mov r9d, r12d
mov edx, esi
call fcn.14007f644
cmp byte [0x140709c89], 0
mov r12d, 0x100000
mov rcx, qword [rbx]
je 0x14012f4f7
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8d, r12d
call fcn.1401c5fcc
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8d, r12d
call fcn.1401c5fcc
jmp 0x14012f516
call fcn.140125124
mov rcx, qword [rbx + 8]
call fcn.140125124
mov rcx, qword [rdi]
call fcn.140125124
mov rcx, qword [rbx + 0x18]
call fcn.140125124
mov r9, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rdi
mov r10d, 2
mov rax, qword [r9 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r9 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rsi
mov qword [rcx + 0xf0], rax
sub r10, 1
jne 0x14012f54e
lea rax, [0x140321bc0]
mov rcx, rbx
mov qword [r9 + 0xe8], rax
call qword [0x140709db8]
cmp byte [0x140709c89], 0
mov rcx, qword [rbx]
je 0x14012f5b5
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8, r12
call fcn.1401c6940
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8, r12
call fcn.1401c6940
jmp 0x14012f5d4
call fcn.1401254f8
mov rcx, qword [rbx + 8]
call fcn.1401254f8
mov rcx, qword [rdi]
call fcn.1401254f8
mov rcx, qword [rbx + 0x18]
call fcn.1401254f8
mov rcx, qword [rbx]
mov esi, 0x18
mov edx, esi
call fcn.14007f784
mov rcx, qword [rbx + 8]
mov edx, esi
call fcn.14007f784
mov rcx, qword [rdi]
mov edx, esi
call fcn.14007f784
mov rcx, qword [rbx + 0x18]
mov edx, esi
call fcn.14007f784
mov rcx, qword [rbx]
lea rsi, [0x1403220c0]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rdi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14012f890
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rsi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x14012f8d3
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call sub.VCRUNTIME140.dll_memset
jmp 0x14012fac1
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.14007f644
mov r8, qword [rbx + 8]
lea r15, [r14 + rsi]
mov rcx, r15
mov r9d, r12d
mov edx, esi
call fcn.14007f644
lea rdi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rdi]
lea r13, [r14 + rsi*2]
mov rcx, r13
mov edx, esi
call fcn.14007f644
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rsi*2]
add rcx, rsi
mov r9d, r12d
mov edx, esi
call fcn.14007f644
cmp byte [0x140709c89], 0
mov r12d, 0x40000
mov rcx, qword [rbx]
je 0x14012f95b
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8d, r12d
call fcn.1401c5fcc
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8d, r12d
call fcn.1401c5fcc
jmp 0x14012f97a
call fcn.140129c8c
mov rcx, qword [rbx + 8]
call fcn.140129c8c
mov rcx, qword [rdi]
call fcn.140129c8c
mov rcx, qword [rbx + 0x18]
call fcn.140129c8c
mov r9, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rdi
mov r10d, 2
mov rax, qword [r9 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r9 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rsi
mov qword [rcx + 0xf0], rax
sub r10, 1
jne 0x14012f9b2
lea rax, [0x140321bc0]
mov rcx, rbx
mov qword [r9 + 0xe8], rax
call qword [0x140709dc0]
cmp byte [0x140709c89], 0
mov rcx, qword [rbx]
je 0x14012fa19
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8, r12
call fcn.1401c6940
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8, r12
call fcn.1401c6940
jmp 0x14012fa38
call fcn.14012a060
mov rcx, qword [rbx + 8]
call fcn.14012a060
mov rcx, qword [rdi]
call fcn.14012a060
mov rcx, qword [rbx + 0x18]
call fcn.14012a060
mov rcx, qword [rbx]
mov esi, 0x18
mov edx, esi
call fcn.14007f784
mov rcx, qword [rbx + 8]
mov edx, esi
call fcn.14007f784
mov rcx, qword [rdi]
mov edx, esi
call fcn.14007f784
mov rcx, qword [rbx + 0x18]
mov edx, esi
call fcn.14007f784
mov rcx, qword [rbx]
lea rsi, [0x1403220c0]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rdi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14012fd10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rdi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x14012fd53
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call sub.VCRUNTIME140.dll_memset
jmp 0x14012ff57
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.14007f644
mov r8, qword [rbx + 8]
lea r15, [r14 + rdi]
mov rcx, r15
mov r9d, r12d
mov edx, edi
call fcn.14007f644
lea rsi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rsi]
lea r13, [r14 + rdi*2]
mov rcx, r13
mov edx, edi
call fcn.14007f644
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rdi*2]
add rcx, rdi
mov r9d, r12d
mov edx, edi
call fcn.14007f644
xor ecx, ecx
mov rax, qword [rbx + rcx*8]
inc rcx
mov byte [rax + 0x1b0], 1
cmp rcx, 4
jl 0x14012fda8
cmp byte [0x140709c89], 0
mov r12d, 0x40000
mov rcx, qword [rbx]
je 0x14012fdf1
mov rdx, qword [rbx + 8]
mov r9b, 1
mov r8d, r12d
call fcn.1401c5fcc
mov rdx, qword [rbx + 0x18]
mov r9b, 1
mov rcx, qword [rsi]
mov r8d, r12d
call fcn.1401c5fcc
jmp 0x14012fe10
call fcn.1401288dc
mov rcx, qword [rbx + 8]
call fcn.1401288dc
mov rcx, qword [rsi]
call fcn.1401288dc
mov rcx, qword [rbx + 0x18]
call fcn.1401288dc
mov r10, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rsi
mov r9d, 2
mov rax, qword [r10 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r10 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rdi
mov qword [rcx + 0xf0], rax
sub r9, 1
jne 0x14012fe48
lea rax, [0x140321bc0]
mov rcx, rbx
mov qword [r10 + 0xe8], rax
call qword [0x140709dc8]
cmp byte [0x140709c89], 0
mov rcx, qword [rbx]
je 0x14012feaf
mov rdx, qword [rbx + 8]
mov r9b, 1
mov r8, r12
call fcn.1401c6940
mov rdx, qword [rbx + 0x18]
mov r9b, 1
mov rcx, qword [rsi]
mov r8, r12
call fcn.1401c6940
jmp 0x14012fece
call fcn.140128d48
mov rcx, qword [rbx + 8]
call fcn.140128d48
mov rcx, qword [rsi]
call fcn.140128d48
mov rcx, qword [rbx + 0x18]
call fcn.140128d48
mov rcx, qword [rbx]
mov edi, 0x18
mov edx, edi
call fcn.14007f784
mov rcx, qword [rbx + 8]
mov edx, edi
call fcn.14007f784
mov rcx, qword [rsi]
mov edx, edi
call fcn.14007f784
mov rcx, qword [rbx + 0x18]
mov edx, edi
call fcn.14007f784
mov rcx, qword [rbx]
lea rdi, [0x1403220c0]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rsi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140131074
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm0, xmmword [rcx]
mov rax, qword [rsp + 0x28]
movdqa xmm2, xmm0
movdqu xmmword [rdx], xmm0
pslldq xmm2, 4
movdqa xmm1, xmm2
movdqu xmmword [r8], xmm3
pxor xmm1, xmm0
pslldq xmm2, 4
movdqa xmm4, xmm2
pslldq xmm2, 4
pxor xmm4, xmm1
pxor xmm4, xmm2
aeskeygenassist xmm0, xmm3, 1
pshufd xmm1, xmm0, 0xff
pxor xmm4, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [r9], xmm4
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm4, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rax], xmm2
mov rax, qword [rsp + 0x30]
pxor xmm0, xmm4
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 2
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rax], xmm3
mov rax, qword [rsp + 0x38]
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rax], xmm2
pxor xmm0, xmm3
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movdqa xmm2, xmm1
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
mov rax, qword [rsp + 0x40]
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqu xmmword [rax], xmm3
movdqa xmm0, xmm1
mov rax, qword [rsp + 0x48]
pxor xmm0, xmm3
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
movdqu xmmword [rax], xmm2
pxor xmm3, xmm1
mov rax, qword [rsp + 0x50]
aeskeygenassist xmm0, xmm2, 8
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rax], xmm3
mov rax, qword [rsp + 0x58]
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqu xmmword [rax], xmm2
ret
Function at 0x14013134c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
pshufd xmm0, xmmword [rdx], 0x55
lea r10, str.cw
mov rbp, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov r14, rdx
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
movzx esi, byte [r8 + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or esi, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl esi, 8
movzx eax, byte [rcx + r10]
or esi, eax
movzx eax, r9b
shl esi, 8
movzx ecx, byte [rax + r10]
or esi, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r10]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r10]
or edi, ecx
mov ecx, edi
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
mov ebx, eax
mov edx, 8
mov ecx, esi
xor ebx, 1
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
movd xmm1, ebx
lea rcx, [rsp + 0x20]
xor eax, 1
movd xmm2, edi
punpckldq xmm2, xmm1
movd xmm3, esi
movd xmm0, eax
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
movdqu xmm2, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm0, xmm2
pshufd xmm4, xmm3, 0xff
pxor xmm0, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
pxor xmm1, xmm2
pxor xmm1, xmm4
movdqu xmmword [rbp], xmm1
movdqa xmmword [rsp + 0x20], xmm1
call fcn.14013198c
movdqu xmm2, xmmword [r14]
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movdqa xmm0, xmm2
pxor xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
pxor xmm1, xmm2
pxor xmm1, xmm3
movdqu xmmword [r14], xmm1
add rsp, 0x30
pop r14
ret
Function at 0x1401314dc
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
pshufd xmm0, xmmword [rdx], 0x55
lea r10, str.cw
mov rbp, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov r14, rdx
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
movzx esi, byte [r8 + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or esi, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl esi, 8
movzx eax, byte [rcx + r10]
or esi, eax
movzx eax, r9b
shl esi, 8
movzx ecx, byte [rax + r10]
or esi, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r10]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r10]
or edi, ecx
mov ecx, edi
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
mov ebx, eax
mov edx, 8
mov ecx, esi
xor ebx, 2
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
movd xmm1, ebx
lea rcx, [rsp + 0x20]
xor eax, 2
movd xmm2, edi
punpckldq xmm2, xmm1
movd xmm3, esi
movd xmm0, eax
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
movdqu xmm2, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm0, xmm2
pshufd xmm4, xmm3, 0xff
pxor xmm0, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
pxor xmm1, xmm2
pxor xmm1, xmm4
movdqu xmmword [rbp], xmm1
movdqa xmmword [rsp + 0x20], xmm1
call fcn.14013198c
movdqu xmm2, xmmword [r14]
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movdqa xmm0, xmm2
pxor xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
pxor xmm1, xmm2
pxor xmm1, xmm3
movdqu xmmword [r14], xmm1
add rsp, 0x30
pop r14
ret