joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140050d70
Capabilities:
Hash data using sha512

Disassembly:
push rsi
push rdi
sub rsp, 0x108
mov rsi, r8
mov r8, rdx
mov rdx, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x100], rax
movaps xmm0, xmmword [0x1400fbb50]
lea rdi, [rsp + 0x20]
movaps xmmword [rdi], xmm0
movaps xmm0, xmmword [0x1400fbb60]
movaps xmmword [rdi + 0x10], xmm0
movaps xmm0, xmmword [0x1400fbb70]
movaps xmmword [rdi + 0x20], xmm0
movaps xmm0, xmmword [0x1400fbb80]
movaps xmmword [rdi + 0x30], xmm0
movabs rax, 0x4000000000
mov qword [rdi + 0xd0], rax
xorps xmm0, xmm0
movaps xmmword [rdi + 0x40], xmm0
mov rcx, rdi
call fcn.14005a710
mov rcx, rsi
mov rdx, rdi
call fcn.14005a810
mov edx, 0xd8
mov rcx, rdi
call fcn.14005e550
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1400a6c00
mov rax, rsi
add rsp, 0x108
pop rdi
pop rsi
ret
Function at 0x140055cc0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edi, edi
cmp r9, 0x30
ja 0x140055d7a
mov rsi, rcx
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmm2, xmmword [rdx + 0x20]
movaps xmmword [rsp + 0x50], xmm2
movaps xmmword [rsp + 0x40], xmm1
movaps xmmword [rsp + 0x30], xmm0
test r9, r9
je 0x140055d15
xor eax, eax
mov cl, byte [r8 + rax]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp r9, rax
jne 0x140055d05
xor eax, eax
lea rcx, [0x1400fc170]
movaps xmm0, xmmword [rsp + rax + 0x30]
xorps xmm0, xmmword [rax + rcx]
movaps xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
cmp rax, 0x30
jne 0x140055d1e
lea r8, [rsi + 0xf8]
mov qword [rsp + 0x20], 0x20
lea rdi, [rsp + 0x30]
mov rcx, rsi
xor edx, edx
mov r9, rdi
call fcn.1400504c0
mov qword [rsi + 0x100], rax
movaps xmm0, xmmword [rdi + 0x20]
movups xmmword [rsi + 0x108], xmm0
mov qword [rsi + 0x118], 1
mov edi, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400a6c00
mov eax, edi
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x140055d90
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edi, edi
cmp r8, 0x30
ja 0x140055e50
mov r12, r8
mov r14, rdx
mov rsi, rcx
lea r15, [rcx + 0xf8]
lea rdi, [rcx + 0x108]
xor ebx, ebx
mov ecx, dword [rsi + 0x114]
call fcn.1400d37b0
lea ecx, [rax + 1]
call fcn.1400d37b0
mov dword [rsi + 0x114], eax
lea rdx, [rsp + rbx]
add rdx, 0x30
mov rcx, rdi
mov r8, rsi
call qword [rsi + 0xf8]
add rbx, 0x10
cmp rbx, 0x30
jb 0x140055dd1
test r12, r12
je 0x140055e1f
xor eax, eax
mov cl, byte [r14 + rax]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp r12, rax
jne 0x140055e0f
mov qword [rsp + 0x20], 0x20
lea rbx, [rsp + 0x30]
mov rcx, rsi
xor edx, edx
mov r8, r15
mov r9, rbx
call fcn.1400504c0
mov qword [rsi + 0x100], rax
movaps xmm0, xmmword [rbx + 0x20]
movups xmmword [rdi], xmm0
mov edi, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400a6c00
mov eax, edi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140056800
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov r12, r9
mov r13, r8
mov rdi, rdx
mov r14, rcx
mov r15, qword [rsp + 0x108]
mov rax, qword [rsp + 0x100]
mov rcx, qword [0x140125058]
xor rcx, rsp
mov qword [rsp + 0x80], rcx
test rax, rax
jne 0x140056860
lea rcx, [0x14012c5a8]
lea rdx, [0x140050a30]
call fcn.14007fa20
lea rax, [0x14012c5b0]
test r15, r15
cmove r15, rax
mov ebx, dword [rax + 4]
lea rcx, [rbx + rbx]
add rcx, 2
cmp rcx, rdi
jbe 0x140056897
mov dword [rsp + 0x20], 0x14a
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_rsa_padding.c
xor esi, esi
mov ecx, 4
xor edx, edx
mov r8d, 0x7e
jmp 0x1400568cc
lea rcx, [rbx + rbx]
mov rbp, rcx
not rbp
lea rdx, [rdi + rbp]
add rdx, 0xffffffffffffffff
cmp rdx, r12
jae 0x1400568f7
mov dword [rsp + 0x20], 0x150
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_rsa_padding.c
xor esi, esi
mov ecx, 4
xor edx, edx
mov r8d, 0x72
call fcn.14007f830
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400a6c00
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
dec rdi
or rcx, 1
cmp rdi, rcx
jae 0x140056910
mov dword [rsp + 0x20], 0x155
jmp 0x14005687f
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xf0]
mov byte [r14], 0
lea r8, [r14 + rbx]
add r8, 1
mov qword [rsp + 0x20], rax
xor esi, esi
mov qword [rsp + 0x38], r8
xor r9d, r9d
call fcn.140050950
test eax, eax
je 0x1400568d1
mov rsi, rdi
sub rsi, r12
add rbp, rsi
mov rcx, qword [rsp + 0x38]
je 0x14005696c
mov rax, qword [rsp + 0x38]
lea rcx, [rax + rbx]
xor edx, edx
mov r8, rbp
call fcn.1400caa00
mov rcx, qword [rsp + 0x38]
inc r14
mov rax, rbx
not rax
add rsi, rax
mov byte [rcx + rsi], 1
test r12, r12
mov rbp, rcx
je 0x140056999
lea rcx, [rdi + rbp]
sub rcx, r12
sub rcx, rbx
mov rdx, r13
mov r8, r12
call fcn.1400ca590
lea r8, [0x1400fc1a0]
mov rcx, r14
mov rdx, rbx
call fcn.14004f8d0
sub rdi, rbx
mov rcx, rdi
call fcn.14005e4d0
test rax, rax
je 0x140056a35
mov r12, rax
mov qword [rsp + 0x20], r15
mov rcx, rax
mov rdx, rdi
mov r8, r14
mov r9, rbx
call fcn.140056a60
xor esi, esi
test eax, eax
je 0x140056a28
test rdi, rdi
je 0x1400569f1
xor eax, eax
mov cl, byte [r12 + rax]
xor byte [rbp + rax], cl
inc rax
cmp rdi, rax
jne 0x1400569e1
mov qword [rsp + 0x20], r15
lea rcx, [rsp + 0x40]
mov rdx, rbx
mov r8, rbp
mov r9, rdi
call fcn.140056a60
test eax, eax
je 0x140056a28
mov esi, 1
test ebx, ebx
je 0x140056a28
xor eax, eax
mov cl, byte [rsp + rax + 0x40]
xor byte [r14 + rax], cl
inc rax
cmp rbx, rax
jne 0x140056a18
mov rcx, r12
call fcn.14005e500
jmp 0x1400568d1
mov dword [rsp + 0x20], 0x169
lea r9, str..._.._third_party_boringssl_src_crypto_fipsmodule_rsa_padding.c
xor esi, esi
mov ecx, 4
xor edx, edx
mov r8d, 0x41
jmp 0x1400568cc
Function at 0x14005e600
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x14005e622
xor r9d, r9d
xor eax, eax
mov r10b, byte [rdx + r9]
xor r10b, byte [rcx + r9]
movzx r10d, r10b
or eax, r10d
inc r9
cmp r8, r9
jne 0x14005e60a
ret
xor eax, eax
ret
Function at 0x140064240
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [rcx + 0x28]
call fcn.1400d37b0
mov dword [rsi + 0x28], eax
mov ecx, dword [rsi + 0x2c]
call fcn.1400d37b0
mov dword [rsi + 0x2c], eax
mov ecx, dword [rsi + 0x30]
call fcn.1400d37b0
mov dword [rsi + 0x30], eax
mov ecx, dword [rsi + 0x34]
call fcn.1400d37b0
mov dword [rsi + 0x34], eax
mov ecx, dword [rsi + 0x38]
call fcn.1400d37b0
mov dword [rsi + 0x38], eax
mov ecx, dword [rsi + 0x3c]
call fcn.1400d37b0
mov dword [rsi + 0x3c], eax
mov ecx, dword [rsi + 0x40]
call fcn.1400d37b0
mov dword [rsi + 0x40], eax
mov ecx, dword [rsi + 0x44]
call fcn.1400d37b0
mov dword [rsi + 0x44], eax
mov ecx, dword [rsi + 0x48]
call fcn.1400d37b0
mov dword [rsi + 0x48], eax
mov ecx, dword [rsi + 0x4c]
call fcn.1400d37b0
mov dword [rsi + 0x4c], eax
mov ecx, dword [rsi + 0x50]
call fcn.1400d37b0
mov dword [rsi + 0x50], eax
mov ecx, dword [rsi + 0x54]
call fcn.1400d37b0
mov dword [rsi + 0x54], eax
mov ecx, dword [rsi + 0x58]
call fcn.1400d37b0
mov dword [rsi + 0x58], eax
mov ecx, dword [rsi + 0x5c]
call fcn.1400d37b0
mov dword [rsi + 0x5c], eax
mov ecx, dword [rsi + 0x60]
call fcn.1400d37b0
mov dword [rsi + 0x60], eax
mov ecx, dword [rsi + 0x64]
call fcn.1400d37b0
mov dword [rsi + 0x64], eax
xor eax, eax
nop
mov ecx, dword [rsi + rax*4 + 0x48]
xor ecx, dword [rsi + rax*4 + 0x5c]
xor ecx, dword [rsi + rax*4 + 0x30]
xor ecx, dword [rsi + rax*4 + 0x28]
rol ecx, 1
mov dword [rsi + rax*4 + 0x68], ecx
add rax, 1
cmp rax, 0x40
jne 0x140064300
movdqu xmm0, xmmword [rsi + 0x14]
movdqu xmmword [rsi], xmm0
mov r8d, dword [rsi + 0x24]
mov dword [rsi + 0x10], r8d
movd edi, xmm0
pshufd xmm1, xmm0, 0xe5
movd ebp, xmm1
pshufd xmm1, xmm0, 0x4e
movd ecx, xmm1
pshufd xmm1, xmm0, 0xe7
movd r10d, xmm1
xor eax, eax
mov r11d, 0x8f1bbcdc
mov ebx, r8d
nop dword [rax]
mov r14d, edi
mov r9d, r10d
mov r10d, ecx
mov ecx, ebp
mov ebp, edi
rol ebp, 5
cmp rax, 0x14
jae 0x1400643a0
mov edx, ecx
and edx, r10d
mov edi, ecx
not edi
and edi, r9d
or edi, edx
add edi, ebp
add edi, ebx
add edi, dword [rsi + rax*4 + 0x28]
mov ebx, 0x5a827999
jmp 0x1400643f5
cmp rax, 0x28
jae 0x1400643c0
mov edi, r10d
xor edi, r9d
xor edi, ecx
add edi, ebp
add edi, ebx
add edi, dword [rsi + rax*4 + 0x28]
mov ebx, 0x6ed9eba1
jmp 0x1400643f5
cmp rax, 0x3b
ja 0x1400643d8
mov edx, r10d
or edx, r9d
and edx, ecx
mov edi, r10d
and edi, r9d
or edi, edx
jmp 0x1400643e0
mov edi, r10d
xor edi, r9d
xor edi, ecx
add edi, ebp
add edi, ebx
add edi, dword [rsi + rax*4 + 0x28]
cmp rax, 0x3c
mov ebx, 0xca62c1d6
cmovb ebx, r11d
add edi, ebx
rol ecx, 0x1e
add rax, 1
mov ebx, r9d
mov ebp, r14d
cmp rax, 0x50
jne 0x140064360
mov dword [rsi + 0x10], r9d
mov dword [rsi + 0xc], r10d
mov dword [rsi + 8], ecx
mov dword [rsi + 4], r14d
mov dword [rsi], edi
movd xmm1, r10d
movd xmm2, ecx
punpckldq xmm2, xmm1
movd xmm1, r14d
movd xmm3, edi
punpckldq xmm3, xmm1
punpcklqdq xmm3, xmm2
paddd xmm3, xmm0
movdqu xmmword [rsi + 0x14], xmm3
add r8d, r9d
mov dword [rsi + 0x24], r8d
mov dword [rsi + 0x168], 0
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1400681d0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400681e9
mov dword [rsi], eax
mov al, 1
jmp 0x1400681eb
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x14006e890
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, r8
mov qword [rsp + 0x20], rdx
mov r15, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0xf
jbe 0x14006e8b6
mov rdi, qword [rdi]
movabs rdx, 0xcbf29ce484222325
test r15, r15
je 0x14006e8e4
movabs rax, 0x100000001b3
lea rbp, [r15 - 1]
mov r8d, r15d
and r8d, 3
cmp rbp, 3
jae 0x14006e8e9
xor ebp, ebp
jmp 0x14006e938
mov rbx, rdx
jmp 0x14006e968
mov rsi, r15
sub rsi, r8
xor ebp, ebp
nop word cs:[rax + rax]
nop dword [rax + rax]
movzx ebx, byte [rdi + rbp]
xor rbx, rdx
imul rbx, rax
movzx edx, byte [rdi + rbp + 1]
xor rdx, rbx
imul rdx, rax
movzx ebx, byte [rdi + rbp + 2]
xor rbx, rdx
imul rbx, rax
movzx edx, byte [rdi + rbp + 3]
xor rdx, rbx
imul rdx, rax
add rbp, 4
cmp rsi, rbp
jne 0x14006e900
mov rbx, rdx
test r8, r8
je 0x14006e968
add rbp, rdi
xor esi, esi
nop word cs:[rax + rax]
nop
movzx ebx, byte [rbp + rsi]
xor rbx, rdx
imul rbx, rax
add rsi, 1
mov rdx, rbx
cmp r8, rsi
jne 0x14006e950
and rbx, qword [rcx + 0x30]
mov r14, qword [rcx + 8]
mov r12, qword [rcx + 0x18]
mov rax, rbx
shl rax, 4
mov r13, qword [r12 + rax]
lea rbp, [rbx + rbx]
add rbp, 1
mov rsi, r13
cmp r13, r14
jne 0x14006e9a8
jmp 0x14006e9d0
mov rsi, qword [rsi]
cmp r13, r14
je 0x14006e9d0
mov rax, qword [r12 + rbp*8]
mov rax, qword [rax]
cmp rax, rsi
je 0x14006ea5d
cmp qword [rsi + 0x20], r15
jne 0x14006e9a0
cmp qword [rsi + 0x28], 0xf
jbe 0x14006e9e0
mov rcx, qword [rsi + 0x10]
jmp 0x14006e9e4
mov rax, r14
cmp rax, rsi
jne 0x14006e9b8
jmp 0x14006ea5d
lea rcx, [rsi + 0x10]
mov rdx, rdi
mov r8, r15
call fcn.1400ca490
test eax, eax
jne 0x14006e9a0
mov rbx, rsi
cmp r13, r14
jne 0x14006ea08
jmp 0x14006ea50
mov rbx, qword [rbx]
cmp r13, r14
je 0x14006ea50
mov rax, qword [r12 + rbp*8]
mov rax, qword [rax]
cmp rax, rbx
je 0x14006ea58
cmp r15, qword [rbx + 0x20]
jne 0x14006ea58
cmp qword [rbx + 0x28], 0xf
jbe 0x14006ea30
mov rdx, qword [rbx + 0x10]
jmp 0x14006ea34
lea rdx, [rbx + 0x10]
mov rcx, rdi
mov r8, r15
call fcn.1400ca490
test eax, eax
je 0x14006ea00
jmp 0x14006ea58
mov rax, r14
cmp rax, rbx
jne 0x14006ea14
cmp rsi, rbx
jne 0x14006ea63
mov rsi, r14
mov rbx, r14
mov rax, qword [rsp + 0x20]
mov qword [rax], rsi
mov qword [rax + 8], rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140073920
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov r8, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, r8
mov r9, rax
sar r9, 2
test rax, rax
je 0x1400739a1
xor r11d, r11d
lea r10, [0x140103000]
mov edx, r9d
nop word cs:[rax + rax]
nop
mov eax, dword [r8 + r11*4]
mov esi, eax
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
mov esi, eax
shr esi, 8
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
mov esi, eax
shr esi, 0x10
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
movzx esi, dl
shr eax, 0x18
xor eax, esi
shr edx, 8
xor edx, dword [r10 + rax*4]
add r11, 1
cmp r11, r9
jb 0x140073950
jmp 0x1400739a4
mov edx, r9d
cmp edx, dword [rcx + 0x18]
sete al
pop rsi
ret
Function at 0x1400739b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov r8, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, r8
mov r9, rax
sar r9, 2
test rax, rax
je 0x140073a31
xor r11d, r11d
lea r10, [0x140103000]
mov edx, r9d
nop word cs:[rax + rax]
nop
mov eax, dword [r8 + r11*4]
mov esi, eax
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
mov esi, eax
shr esi, 8
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
mov esi, eax
shr esi, 0x10
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
movzx esi, dl
shr eax, 0x18
xor eax, esi
shr edx, 8
xor edx, dword [r10 + rax*4]
add r11, 1
cmp r11, r9
jb 0x1400739e0
jmp 0x140073a34
mov edx, r9d
mov dword [rcx + 0x18], edx
pop rsi
ret

Function at 0x1400774c0
Capabilities:
Encode data using xor

Disassembly:
cmp rdx, 0x7fffffff
jbe 0x1400467cc
xor eax, eax
ret
jmp 0x1400774c0
push rsi
xor eax, eax
test rcx, rcx
je 0x1400775f1
test edx, edx
jle 0x1400775f1
mov r8d, edx
and r8d, 3
mov r11d, edx
shr r11d, 2
je 0x140077572
lea r10d, [r11 - 1]
test dl, 4
jne 0x1400774f9
mov r9d, r11d
mov rsi, rcx
jmp 0x140077521
movzx r9d, word [rcx]
add r9d, edx
movzx eax, word [rcx + 2]
shl eax, 0xb
xor eax, r9d
shl r9d, 0x10
xor r9d, eax
lea rsi, [rcx + 4]
mov edx, r9d
shr edx, 0xb
add edx, r9d
mov r9d, r10d
lea r10, [r10*4 + 4]
cmp r11d, 1
je 0x14007756f
nop
movzx eax, word [rsi]
add eax, edx
movzx edx, word [rsi + 2]
shl edx, 0xb
xor edx, eax
shl eax, 0x10
xor eax, edx
mov edx, eax
shr edx, 0xb
add edx, eax
movzx eax, word [rsi + 4]
add eax, edx
movzx edx, word [rsi + 6]
shl edx, 0xb
xor edx, eax
shl eax, 0x10
xor eax, edx
mov edx, eax
shr edx, 0xb
add edx, eax
add rsi, 8
add r9d, 0xfffffffe
jg 0x140077530
add rcx, r10
cmp r8d, 1
je 0x1400775a0
cmp r8d, 2
je 0x1400775b2
cmp r8d, 3
jne 0x1400775c5
movzx eax, word [rcx]
add edx, eax
movsx eax, byte [rcx + 2]
shl eax, 0x12
xor eax, edx
mov ecx, edx
shl ecx, 0x10
xor eax, ecx
mov edx, eax
shr edx, 0xb
jmp 0x1400775c3
movsx eax, byte [rcx]
add edx, eax
mov eax, edx
shl eax, 0xa
xor eax, edx
mov edx, eax
shr edx, 1
jmp 0x1400775c3
movzx eax, word [rcx]
add edx, eax
mov eax, edx
shl eax, 0xb
xor eax, edx
mov edx, eax
shr edx, 0x11
add edx, eax
lea eax, [rdx*8]
xor eax, edx
mov ecx, eax
shr ecx, 5
add ecx, eax
mov eax, ecx
shl eax, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
add ecx, eax
mov edx, ecx
shl edx, 0x19
xor edx, ecx
mov eax, edx
shr eax, 6
add eax, edx
pop rsi
ret
Function at 0x140077640
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x140077660
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, bh
movzx edi, ch
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, dh
shr ecx, 0x10
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, dh
movzx edi, ah
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
mov edx, dword [r15 + 0xc]
movzx edi, bh
movzx ebp, ch
mov eax, dword [r15]
xor r12d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 1]
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
sub r13d, 1
jne 0x140077660
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi*8 + 2]
movzx r11d, byte [r14 + rdi*8 + 2]
movzx r12d, byte [r14 + rbp*8 + 2]
movzx esi, dl
movzx edi, bh
movzx ebp, ch
movzx r8d, byte [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and edi, 0xff00
and ebp, 0xff00
xor r10d, edi
xor r11d, ebp
shr ecx, 0x10
movzx esi, dh
movzx edi, ah
shr edx, 0x10
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
and esi, 0xff00
and edi, 0xff00
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and esi, 0xff0000
and edi, 0xff0000
and ebp, 0xff0000
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, dh
movzx ebp, ah
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8 + 2]
mov ebp, dword [r14 + rbp*8 + 2]
and esi, 0xff0000
and edi, 0xff000000
and ebp, 0xff000000
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, bh
movzx edi, ch
mov edx, dword [r15 + 0x1c]
mov esi, dword [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8 + 2]
mov eax, dword [r15 + 0x10]
and esi, 0xff000000
and edi, 0xff000000
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret
Function at 0x140077aa0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rax, rsp
push rbx
push rbp
push r12
push r13
push r14
push r15
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rax
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x140079480]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
call fcn.140077830
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi - 0x30]
mov r14, qword [rsi - 0x28]
mov r13, qword [rsi - 0x20]
mov r12, qword [rsi - 0x18]
mov rbp, qword [rsi - 0x10]
mov rbx, qword [rsi - 8]
lea rsp, [rsi]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret

Function at 0x140077aad
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rax, rsp
push rbx
push rbp
push r12
push r13
push r14
push r15
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rax
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x140079480]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
call fcn.140077830
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi - 0x30]
mov r14, qword [rsi - 0x28]
mov r13, qword [rsi - 0x20]
mov r12, qword [rsi - 0x18]
mov rbp, qword [rsi - 0x10]
mov rbx, qword [rsi - 8]
lea rsp, [rsi]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x140077b80
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x140077ba0
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, dh
movzx edi, ah
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, bh
shr eax, 0x10
movzx ebp, ch
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr ecx, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, bh
movzx edi, ch
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
movzx esi, dh
mov edx, dword [r15 + 0xc]
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 1]
mov eax, dword [r15]
xor r8d, dword [r14 + rbp*8 + 1]
xor eax, r10d
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor ecx, r12d
xor ebx, r11d
xor edx, r8d
sub r13d, 1
jne 0x140077ba0
lea r14, [r14 + 0x800]
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi]
movzx r11d, byte [r14 + rdi]
movzx r12d, byte [r14 + rbp]
movzx esi, dl
movzx edi, dh
movzx ebp, ah
movzx r8d, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl edi, 8
shl ebp, 8
xor r10d, edi
xor r11d, ebp
shr edx, 0x10
movzx esi, bh
movzx edi, ch
shr eax, 0x10
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
shl esi, 8
shl edi, 8
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr ecx, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl esi, 0x10
shl edi, 0x10
shl ebp, 0x10
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, bh
movzx ebp, ch
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl esi, 0x10
shl edi, 0x18
shl ebp, 0x18
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, dh
movzx edi, ah
mov edx, dword [r15 + 0x1c]
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
mov eax, dword [r15 + 0x10]
shl esi, 0x18
shl edi, 0x18
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
lea r14, [r14 - 0x800]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret