joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140075150
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov qword [rsp + 0x10], rbx
mov r10, r8
movzx ebx, r9w
xor r9d, r9d
movsx r11d, cl
mov qword [rsp], rdi
mov edi, ebx
movd xmm2, r11d
punpcklbw xmm2, xmm2
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
cmp ebx, 0x40
jb 0x14007525a
movsxd rax, ebx
lea rcx, [rdx - 1]
add rcx, rax
dec rax
add rax, r8
cmp rdx, rax
ja 0x1400751a6
cmp rcx, r8
jae 0x14007525a
mov qword [rsp + 0x18], rsi
mov eax, 0xffffffc0
lea r8, [rdx + 0x10]
mov rcx, r10
and rdi, rax
sub rcx, rdx
mov rsi, 0xfffffffffffffff0
sub rsi, rdx
nop word [rax + rax]
movdqu xmm0, xmmword [r8 - 0x10]
add r9d, 0x40
movdqu xmm1, xmmword [rcx + r8 - 0x10]
lea r8, [r8 + 0x40]
lea rax, [rsi + r8]
xorps xmm1, xmm0
andps xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [r8 - 0x50], xmm1
movdqu xmm0, xmmword [r8 - 0x40]
movdqu xmm1, xmmword [rcx + r8 - 0x40]
xorps xmm1, xmm0
andps xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [r8 - 0x40], xmm1
movdqu xmm0, xmmword [r8 - 0x30]
movdqu xmm1, xmmword [rcx + r8 - 0x30]
xorps xmm1, xmm0
andps xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [r8 - 0x30], xmm1
movdqu xmm0, xmmword [r8 - 0x20]
movdqu xmm1, xmmword [rcx + r8 - 0x20]
xorps xmm1, xmm0
andps xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [r8 - 0x20], xmm1
cmp rax, rdi
jl 0x1400751d0
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp]
mov r8, rbx
mov rbx, qword [rsp + 0x10]
movsxd rcx, r9d
cmp rcx, r8
jge 0x140075297
sub r10, rdx
lea rax, [rcx + rdx]
sub r8, rcx
nop dword [rax + rax]
movzx edx, byte [rax]
xor dl, byte [rax + r10]
lea rax, [rax + 1]
and dl, r11b
xor byte [rax - 1], dl
sub r8, 1
jne 0x140075280
add rsp, 8
ret

Function at 0x140077c20
Capabilities:
Encode data using xor

Disassembly:
movzx eax, cl
mov r11, rdx
or al, dl
mov r9, rcx
test al, 3
jne 0x140077c65
shr r8d, 2
test r8d, r8d
je 0x140077ca6
sub r11, rcx
mov edx, r8d
nop
mov ecx, dword [r11 + r9]
lea r9, [r9 + 4]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [r9 - 4], ecx
sub rdx, 1
jne 0x140077c40
ret
mov r10d, 0
and r8d, 0xfffffffc
jbe 0x140077ca6
nop dword [rax]
nop word [rax + rax]
mov edx, r10d
add r10d, 4
mov ecx, dword [rdx + r11]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rdx + r9], ecx
cmp r10d, r8d
jb 0x140077c80
ret

Function at 0x140077d00
Capabilities:
Hash data using sha256

Disassembly:
test rcx, rcx
jne 0x140077d0b
mov eax, 0xffffff53
ret
xor eax, eax
mov dword [rcx], 0x6a09e667
mov qword [rcx + 0x60], rax
mov dword [rcx + 0x68], eax
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
ret
Function at 0x1400787e0
Capabilities:
Hash data using sha224

Disassembly:
xor edx, edx
lea r8d, [rdx - 2]
jmp fcn.1400787f0

Function at 0x1400787f0
Capabilities:
Hash data using sha224

Disassembly:
test rcx, rcx
jne 0x140077cbb
mov eax, 0xffffff53
ret
xor eax, eax
mov dword [rcx], 0xc1059ed8
mov qword [rcx + 0x60], rax
mov dword [rcx + 0x68], eax
mov dword [rcx + 4], 0x367cd507
mov dword [rcx + 8], 0x3070dd17
mov dword [rcx + 0xc], 0xf70e5939
mov dword [rcx + 0x10], 0xffc00b31
mov dword [rcx + 0x14], 0x68581511
mov dword [rcx + 0x18], 0x64f98fa7
mov dword [rcx + 0x1c], 0xbefa4fa4
ret
test rcx, rcx
jne 0x1400787fb
mov eax, 0xffffff53
ret
mov qword [rcx + 0x70], rdx
jmp 0x140077cb0

Function at 0x140078850
Capabilities:
Hash data using sha224

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400788aa
test rdx, rdx
je 0x1400788aa
call fcn.140077d50
test eax, eax
jne 0x1400788af
lea r8d, [rax + 0x1c]
mov rdx, rbx
mov rcx, rbx
call fcn.140077c20
movups xmm0, xmmword [rbx]
mov rcx, rbx
movups xmmword [rdi], xmm0
movsd xmm1, qword [rbx + 0x10]
movsd qword [rdi + 0x10], xmm1
mov eax, dword [rbx + 0x18]
mov dword [rdi + 0x18], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140077cb0
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140078940
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140078992
test rdx, rdx
je 0x140078992
call fcn.140077d50
test eax, eax
jne 0x140078997
lea r8d, [rax + 0x20]
mov rdx, rbx
mov rcx, rbx
call fcn.140077c20
movups xmm0, xmmword [rbx]
mov rcx, rbx
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140077d00
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140079ca0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
test byte [0x140be6ab8], 8
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
je 0x140079ccc
xor ecx, ecx
call fcn.140079d50
test eax, eax
je 0x140079d33
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x140079d01
mov eax, 0xffffff99
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx]
mov r8, rsi
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x140079d28
mov eax, 0xffffff98
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14007a370
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
xor ebx, ebx
mov esi, edx
xor r11d, r11d
mov edi, edx
mov rbp, rcx
add rsi, 0xfffffffffffffff8
je 0x14007a40d
mov qword [rsp + 0x10], r14
lea eax, [rdi - 8]
mov r14d, 8
mov edx, r14d
cmp rsi, rdx
cmovbe edx, eax
nop dword [rax]
xor r8d, r8d
test edx, edx
jle 0x14007a3ec
mov eax, r11d
add rax, rbp
mov r10d, edx
mov r9d, edx
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rax + r10]
movzx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r8d, edx
sub r9, 1
jne 0x14007a3d0
test r8d, r8d
jne 0x14007a3f1
mov ebx, 3
add r11d, r14d
mov edx, edi
sub edx, r11d
mov ecx, r11d
cmp edx, r14d
cmova edx, r14d
cmp rcx, rsi
jb 0x14007a3b0
mov r14, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x20]
mov eax, ebx
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x28]
pop rdi
ret
Function at 0x140085250
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140085331
test rdx, rdx
je 0x140085331
mov eax, dword [rcx]
mov qword [rsp + 0x30], rdi
lea rdi, [rcx + 0xc]
cmp eax, 0x3f
jbe 0x140085297
mov rdi, qword [rsp + 0x30]
mov eax, 0xffffff7c
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov byte [rax + rdi], 0x80
mov ecx, dword [rcx]
inc ecx
mov dword [rbx], ecx
cmp ecx, 0x38
jbe 0x1400852ce
mov r8d, 0x40
xor edx, edx
sub r8d, ecx
add rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov rdx, rdi
mov dword [rbx], 0x40
mov rcx, rbx
call fcn.1400849a0
xor ecx, ecx
mov dword [rbx], ecx
mov r8d, 0x38
xor edx, edx
sub r8d, ecx
add rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rbx + 4]
mov rdx, rdi
mov eax, dword [rbx + 8]
mov ecx, r8d
shr ecx, 0x1d
lea ecx, [rcx + rax*8]
mov dword [rbx + 8], ecx
lea eax, [r8*8]
mov dword [rbx + 4], eax
mov rcx, rbx
mov dword [rdi + 0x38], eax
mov eax, dword [rbx + 8]
mov dword [rdi + 0x3c], eax
call fcn.1400849a0
movups xmm0, xmmword [rbx + 0x4c]
mov rcx, rbx
movups xmmword [rsi], xmm0
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.140085190
mov rbx, qword [rsp + 0x38]
mov eax, 0xffffff53
add rsp, 0x20
pop rsi
ret
Function at 0x1400887f0
Capabilities:
Hash data using sha384

Disassembly:
xor edx, edx
lea r8d, [rdx - 2]
jmp fcn.140088800

Function at 0x140088800
Capabilities:
Hash data using sha384

Disassembly:
test rcx, rcx
jne 0x140086f2b
mov eax, 0xffffff53
ret
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
xor eax, eax
mov dword [rcx + 0xc0], eax
mov qword [rcx + 0xc8], rax
mov qword [rcx + 0xd0], rax
ret
test rcx, rcx
jne 0x14008880b
mov eax, 0xffffff53
ret
mov qword [rcx + 0xd8], rdx
jmp 0x140086f20

Function at 0x140088910
Capabilities:
Hash data using sha384

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14008895b
test rdx, rdx
je 0x14008895b
call fcn.1400871c0
test eax, eax
jne 0x140088960
movups xmm0, xmmword [rbx]
mov rcx, rbx
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rdi + 0x20], xmm0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140086f20
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140088ca0
Capabilities:
Hash data using sha224
Hash data using sha256
Hash data using sha384
Hash data with md5

Disassembly:
mov r9d, 0xffffff18
test rcx, rcx
je 0x140088d16
test r8, r8
je 0x140088d16
cmp edx, 0x11
ja case.0x140088cca.0
movsxd rax, edx
lea r10, [0x140000000]
mov edx, dword [r10 + rax*4 + 0x88d1c]
add rdx, r10
jmp rdx
mov rdx, r8
jmp fcn.140085250
mov rdx, r8
jmp fcn.140086740
mov rdx, r8
jmp fcn.140078850
mov rdx, r8
jmp fcn.140078940
mov rdx, r8
jmp fcn.140088910
mov rdx, r8
jmp fcn.140088a80
mov rdx, r8
jmp fcn.140088ac0
mov rdx, r8
jmp fcn.140088af0
mov r9d, 0xffffff53
mov eax, r9d
ret
mov eax, 0xffffff53
ret

Function at 0x140088fe0
Capabilities:
Hash data using sha1
Hash data using sha224

Disassembly:
mov r9d, 0xfffffffe
xor r8d, r8d
jmp fcn.140088ff0
Function at 0x140088ff0
Capabilities:
Hash data using sha1
Hash data using sha224

Disassembly:
lea r9, [0x140087060]
jmp fcn.1400871a0
lea r9, [0x140087100]
jmp fcn.1400871a0
push rbx
mov rbx, r8
mov r11, rcx
mov r10d, 0xffffff18
test rcx, rcx
jne 0x140089009
lea eax, [r10 + 0x3b]
pop rbx
ret
cmp edx, 0x11
ja case.0x140089026.0
movsxd rax, edx
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x890ac]
add rcx, rdx
jmp rcx
mov r8d, r9d
mov rdx, rbx
mov rcx, r11
pop rbx
jmp fcn.1400851e0
mov r8d, r9d
mov rdx, rbx
mov rcx, r11
pop rbx
jmp fcn.140086720
mov r8d, r9d
mov rdx, rbx
mov rcx, r11
pop rbx
jmp fcn.1400787f0
mov r8d, r9d
mov rdx, rbx
mov rcx, r11
pop rbx
jmp fcn.140078820
mov r8d, r9d
mov rdx, rbx
mov rcx, r11
pop rbx
jmp fcn.140088800
mov r8d, r9d
mov rdx, rbx
mov rcx, r11
pop rbx
jmp fcn.140088870
mov r8d, r9d
mov rdx, rbx
mov rcx, r11
pop rbx
jmp 0x140088840
mov r8d, r9d
mov rdx, rbx
mov rcx, r11
pop rbx
jmp 0x140088860
mov r10d, 0xffffff53
mov eax, r10d
pop rbx
ret

Function at 0x140089110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
mov r11, r8
mov rbx, rcx
mov r10d, 0xffffff18
test rcx, rcx
je 0x1400891d7
test r8, r8
jne 0x140089135
test r9d, r9d
jne 0x1400891d7
cmp edx, 0x11
ja case.0x140089152.0
movsxd rax, edx
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x891e0]
add rcx, rdx
jmp rcx
mov r8d, r9d
mov rdx, r11
mov rcx, rbx
pop rbx
jmp fcn.1400853c0
mov r8d, r9d
mov rdx, r11
mov rcx, rbx
pop rbx
jmp fcn.140086a50
mov r8d, r9d
mov rdx, r11
mov rcx, rbx
pop rbx
jmp fcn.1400788c0
mov r8d, r9d
mov rdx, r11
mov rcx, rbx
pop rbx
jmp fcn.140078ba0
mov r8d, r9d
mov rdx, r11
mov rcx, rbx
pop rbx
jmp fcn.140088a60
mov r8d, r9d
mov rdx, r11
mov rcx, rbx
pop rbx
jmp fcn.140088a60
mov r8d, r9d
mov rdx, r11
mov rcx, rbx
pop rbx
jmp fcn.140088ae0
mov r8d, r9d
mov rdx, r11
mov rcx, rbx
pop rbx
jmp fcn.140088ae0
mov r10d, 0xffffff53
mov eax, r10d
pop rbx
ret
mov eax, 0xffffff53
pop rbx
ret
Function at 0x14008a360
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor r9d, r9d
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14008a488
test rdx, rdx
jne 0x14008a392
test r8d, r8d
jne 0x14008a488
cmp byte [rcx + 0x229], r9b
jne 0x14008a3ab
call fcn.140089650
mov r9d, eax
test eax, eax
jne 0x14008a48d
movzx eax, byte [rbx + 0x228]
add eax, 0xfffffffd
cmp eax, 5
ja case.default.0x14008a3d1
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x8a4a0]
add rcx, rdx
jmp rcx
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400853c0
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140086a50
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400788c0
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140078ba0
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140088a60
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call fcn.140088a60
mov r9d, eax
mov eax, r9d
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14008e7e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x850
mov rax, qword [0x1403d4408]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov esi, r9d
mov r10, rdx
mov r9d, dword [rcx]
neg esi
mov eax, r9d
mov r11, rcx
xor eax, dword [rdx]
and eax, esi
movsxd rdx, r8d
mov dword [rsp], eax
test r8d, r8d
jle 0x14008b3a2
mov qword [rsp + 0x848], rbx
add rcx, 8
mov qword [rsp + 0x840], rdi
mov rbx, r10
sub rbx, r11
lea rdi, [rsp]
sub rdi, r11
mov r8, rdx
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbx + rcx]
xor eax, dword [rcx]
lea rcx, [rcx + 4]
and eax, esi
mov dword [rdi + rcx - 4], eax
sub r8, 1
jne 0x14008b320
mov ebx, dword [rsp]
lea rcx, [r11 + 8]
mov rdi, qword [rsp + 0x840]
xor r9d, ebx
mov dword [r11], r9d
mov r8, rdx
lea r9, [rsp]
sub r9, r11
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [rcx + r9]
xor dword [rcx], eax
lea rcx, [rcx + 4]
sub r8, 1
jne 0x14008b360
xor dword [r10], ebx
lea r8, [rsp]
mov rbx, qword [rsp + 0x848]
lea rax, [r10 + 8]
sub r8, r10
nop word [rax + rax]
mov ecx, dword [r8 + rax]
xor dword [rax], ecx
lea rax, [rax + 4]
sub rdx, 1
jne 0x14008b390
jmp 0x14008b3ab
xor r9d, eax
mov dword [rcx], r9d
xor dword [r10], eax
xor eax, eax
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.1400b5880
add rsp, 0x850
pop rsi
ret
jmp 0x14008b2b0
Function at 0x140094e90
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x1a0
mov rax, qword [0x1403d4408]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rbx, r8
test rcx, rcx
je 0x14009500f
test rbx, rbx
je 0x14009500f
lea r8, [rsp + 0x20]
call fcn.140095030
cmp eax, 0xffffff53
je 0x14009500f
mov edx, dword [rsp + 0x110]
aesimc xmm1, xmmword [rsp + 0x30]
movdqa xmm0, xmmword [rsp + 0x20]
mov r8d, edx
mov dword [rbx + 0xf0], edx
add r8, r8
lea ecx, [rdx - 1]
add rcx, rcx
movdqu xmmword [rbx + r8*8], xmm0
aesimc xmm0, xmmword [rsp + 0x40]
movdqu xmmword [rbx + rcx*8], xmm1
lea ecx, [rdx - 2]
aesimc xmm1, xmmword [rsp + 0x50]
add rcx, rcx
movdqu xmmword [rbx + rcx*8], xmm0
lea ecx, [rdx - 3]
aesimc xmm0, xmmword [rsp + 0x60]
add rcx, rcx
movdqu xmmword [rbx + rcx*8], xmm1
lea ecx, [rdx - 4]
aesimc xmm1, xmmword [rsp + 0x70]
add rcx, rcx
movdqu xmmword [rbx + rcx*8], xmm0
lea ecx, [rdx - 5]
aesimc xmm0, xmmword [rsp + 0x80]
add rcx, rcx
movdqu xmmword [rbx + rcx*8], xmm1
lea ecx, [rdx - 6]
aesimc xmm1, xmmword [rsp + 0x90]
add rcx, rcx
movdqu xmmword [rbx + rcx*8], xmm0
lea ecx, [rdx - 7]
aesimc xmm0, xmmword [rsp + 0xa0]
add rcx, rcx
movdqu xmmword [rbx + rcx*8], xmm1
lea ecx, [rdx - 8]
aesimc xmm1, xmmword [rsp + 0xb0]
add rcx, rcx
movdqu xmmword [rbx + rcx*8], xmm0
lea ecx, [rdx - 9]
add rcx, rcx
movdqu xmmword [rbx + rcx*8], xmm1
cmp edx, 0xa
jbe 0x140094fd1
aesimc xmm0, xmmword [rsp + 0xc0]
aesimc xmm1, xmmword [rsp + 0xd0]
lea ecx, [rdx - 0xa]
add rcx, rcx
movdqu xmmword [rbx + rcx*8], xmm0
lea ecx, [rdx - 0xb]
add rcx, rcx
movdqu xmmword [rbx + rcx*8], xmm1
cmp edx, 0xc
jbe 0x140095000
aesimc xmm0, xmmword [rsp + 0xe0]
aesimc xmm1, xmmword [rsp + 0xf0]
lea ecx, [rdx - 0xc]
add rcx, rcx
movdqu xmmword [rbx + rcx*8], xmm0
lea ecx, [rdx - 0xd]
add rcx, rcx
movdqu xmmword [rbx + rcx*8], xmm1
movdqu xmm0, xmmword [rsp + r8*8 + 0x20]
xor eax, eax
movdqu xmmword [rbx], xmm0
jmp 0x140095014
mov eax, 0xffffff53
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400b5880
add rsp, 0x1a0
pop rbx
ret
Function at 0x140097960
Capabilities:
Encrypt data using aes
Reference aes constants
Resolve function by parsing pe exports

Disassembly:
mov rax, r8
mov r8, rdx
mov rdx, rax
jmp fcn.1400969a0
Function at 0x140099240
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r9, rdx
xor r10d, r10d
mov rax, r9
mov rdx, rcx
and eax, 7
and edx, 7
cmp rdx, rax
jne 0x140099348
test rdx, rdx
je 0x140099286
nop word [rax + rax]
test r8d, r8d
je 0x140099286
movzx eax, byte [r9]
inc r9
xor byte [rcx], al
inc rcx
dec r8d
jmp 0x140099270
mov r11d, r8d
mov ebx, r10d
shr r11d, 3
test r11d, r11d
je 0x140099344
cmp r11d, 8
jb 0x14009931d
lea eax, [r11 - 1]
lea rdi, [rcx + rax*8]
lea rax, [r9 + rax*8]
cmp rcx, rax
ja 0x1400992b5
cmp rdi, r9
jae 0x14009931d
mov eax, r11d
and eax, 0xfffffff8
nop dword [rax + rax]
movdqu xmm0, xmmword [rcx]
add ebx, 8
movdqu xmm1, xmmword [r9]
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
movdqu xmm0, xmmword [rcx + 0x10]
movdqu xmm1, xmmword [r9 + 0x10]
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x10], xmm1
movdqu xmm0, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [r9 + 0x20]
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x20], xmm1
movdqu xmm0, xmmword [rcx + 0x30]
movdqu xmm1, xmmword [r9 + 0x30]
add r9, 0x40
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x30], xmm1
add rcx, 0x40
cmp ebx, eax
jb 0x1400992c0
cmp ebx, r11d
jae 0x140099344
sub r11d, ebx
mov edx, r11d
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r9]
add r9, 8
xor qword [rcx], rax
add rcx, 8
sub rdx, 1
jne 0x140099330
and r8d, 7
test r8d, r8d
je 0x140099451
cmp r8d, 8
jb 0x140099423
lea eax, [r8 - 1]
lea r11, [rax + rcx]
add rax, r9
cmp rcx, rax
ja 0x140099374
cmp r11, r9
jae 0x140099423
cmp r8d, 0x40
jb 0x1400993f8
mov r11d, r8d
mov ebx, r8d
and r11d, 0x3f
sub ebx, r11d
mov edi, 0x20
nop dword [rax]
movdqu xmm0, xmmword [r10 + rcx]
lea eax, [rdi - 0x10]
movdqu xmm1, xmmword [r10 + r9]
xorps xmm1, xmm0
movdqu xmmword [r10 + rcx], xmm1
add r10d, 0x40
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + r9]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
mov eax, edi
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + r9]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
lea eax, [rdi + 0x10]
add edi, 0x40
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + r9]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
cmp r10d, ebx
jb 0x140099390
cmp r11d, 8
jb 0x14009941e
mov edx, r8d
and edx, 0xfffffff8
nop
movq xmm0, qword [r10 + rcx]
movq xmm1, qword [r10 + r9]
xorps xmm1, xmm0
movq qword [r10 + rcx], xmm1
add r10d, 8
cmp r10d, edx
jb 0x140099400
cmp r10d, r8d
jae 0x140099451
sub r9, rcx
mov edx, r10d
add rdx, rcx
sub r8d, r10d
mov ecx, r8d
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub rcx, 1
jne 0x140099440
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x140099460
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rax, rcx
mov r10, rdx
and eax, 7
and edx, 7
xor r11d, r11d
cmp rax, rdx
jne 0x14009959f
mov rax, r8
and eax, 7
cmp rdx, rax
jne 0x14009959f
test rdx, rdx
je 0x1400994c0
nop dword [rax + rax]
test r9d, r9d
je 0x1400994c0
movzx eax, byte [r8]
dec r9d
xor al, byte [r10]
inc r8
mov byte [rcx], al
inc r10
inc rcx
test r10b, 7
jne 0x1400994a0
mov ebx, r9d
mov edi, r11d
shr ebx, 3
test ebx, ebx
je 0x14009959b
cmp ebx, 8
jb 0x140099574
lea eax, [rbx - 1]
mov edx, eax
lea rsi, [rcx + rax*8]
lea rax, [r10 + rax*8]
cmp rcx, rax
ja 0x1400994f5
cmp rsi, r10
jae 0x140099574
lea rax, [r8 + rdx*8]
cmp rcx, rax
ja 0x140099503
cmp rsi, r8
jae 0x140099574
mov eax, ebx
and eax, 0xfffffff8
nop dword [rax + rax]
movdqu xmm0, xmmword [r10]
add edi, 8
movdqu xmm1, xmmword [r8]
xorps xmm1, xmm0
movdqu xmm0, xmmword [r10 + 0x10]
movdqu xmmword [rcx], xmm1
movdqu xmm1, xmmword [r8 + 0x10]
xorps xmm1, xmm0
movdqu xmm0, xmmword [r10 + 0x20]
movdqu xmmword [rcx + 0x10], xmm1
movdqu xmm1, xmmword [r8 + 0x20]
xorps xmm1, xmm0
movdqu xmm0, xmmword [r10 + 0x30]
add r10, 0x40
movdqu xmmword [rcx + 0x20], xmm1
movdqu xmm1, xmmword [r8 + 0x30]
add r8, 0x40
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x30], xmm1
add rcx, 0x40
cmp edi, eax
jb 0x140099510
cmp edi, ebx
jae 0x14009959b
sub ebx, edi
mov edx, ebx
nop dword [rax + rax]
mov rax, qword [r8]
add r8, 8
xor rax, qword [r10]
add r10, 8
mov qword [rcx], rax
add rcx, 8
sub rdx, 1
jne 0x140099580
and r9d, 7
test r9d, r9d
je 0x1400996c4
cmp r9d, 8
jb 0x140099693
lea eax, [r9 - 1]
mov edx, eax
lea rbx, [rax + rcx]
add rax, r10
cmp rcx, rax
ja 0x1400995cd
cmp rbx, r10
jae 0x140099693
lea rax, [rdx + r8]
cmp rcx, rax
ja 0x1400995df
cmp rbx, r8
jae 0x140099693
cmp r9d, 0x40
jb 0x14009966a
mov ebx, r9d
mov edi, r9d
and ebx, 0x3f
sub edi, ebx
mov esi, 0x20
nop dword [rax]
movdqu xmm0, xmmword [r11 + r10]
lea eax, [rsi - 0x10]
movdqu xmm1, xmmword [r11 + r8]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax + r10]
movdqu xmmword [r11 + rcx], xmm1
add r11d, 0x40
movdqu xmm1, xmmword [rax + r8]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
mov eax, esi
movdqu xmm0, xmmword [rax + r10]
movdqu xmm1, xmmword [rax + r8]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
lea eax, [rsi + 0x10]
add esi, 0x40
movdqu xmm1, xmmword [rax + r8]
movdqu xmm0, xmmword [rax + r10]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
cmp r11d, edi
jb 0x140099600
cmp ebx, 8
jb 0x14009968e
mov edx, r9d
and edx, 0xfffffff8
movq xmm1, qword [r11 + r8]
movq xmm0, qword [r11 + r10]
xorps xmm1, xmm0
movq qword [r11 + rcx], xmm1
add r11d, 8
cmp r11d, edx
jb 0x140099670
cmp r11d, r9d
jae 0x1400996c4
sub r8, r10
mov edx, r11d
add rdx, r10
sub rcx, r10
sub r9d, r11d
mov r10d, r9d
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
xor al, byte [rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
sub r10, 1
jne 0x1400996b0
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret