diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..4fcf731
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,21 @@
+Src/Container/64/decryption_payload.asm
+Src/Container/64/image_base.inc
+Src/Container/64/image_size.inc
+Src/Container/64/infile_array.inc
+Src/Container/64/infile_size.inc
+Src/Container/64/key_size.inc
+Src/Container/64/logfile_select.asm
+Src/Container/64/main_prolog.inc
+Src/Container/32/decryption_payload.asm
+Src/Container/32/image_base.inc
+Src/Container/32/image_size.inc
+Src/Container/32/infile_array.inc
+Src/Container/32/infile_size.inc
+Src/Container/32/key_size.inc
+Src/Container/32/logfile_select.asm
+Src/Container/32/main_prolog.inc
+Src/Crypter/*.o
+Src/Payloads/Aes/c/*.o
+hyperion.exe
+log.txt
+*.exe
diff --git a/Examples/helloworld.exe b/Examples/helloworld.exe
deleted file mode 100755
index 9c66691..0000000
Binary files a/Examples/helloworld.exe and /dev/null differ
diff --git a/Examples/helloworld64.EXE b/Examples/helloworld64.EXE
deleted file mode 100755
index 550d1c9..0000000
Binary files a/Examples/helloworld64.EXE and /dev/null differ
diff --git a/Makefile b/Makefile
old mode 100755
new mode 100644
index 7ef4bf8..43c5d50
--- a/Makefile
+++ b/Makefile
@@ -1,55 +1,11 @@
 CC = gcc
-SRC = Src\Crypter
-BIN = .
-OBJ = Obj
-CFLAGS = -std=c99 -c -Wall -pedantic -O2 -m32
-
-CONTAINER32 = Src\Container\32
-CONTAINER64 = Src\Container\64
-GENERATED_ASM = $(CONTAINER32)\decryption_payload.asm $(CONTAINER32)\image_base.inc\
-	$(CONTAINER32)\image_size.ing $(CONTAINER32)\infile_array.inc $(CONTAINER32)\infile_size.inc\
-	$(CONTAINER32)\key_size.inc $(CONTAINER32)\logfile_select.asm\
-	$(CONTAINER64)\decryption_payload.asm $(CONTAINER64)\image_base.inc\
-	$(CONTAINER64)\image_size.ing $(CONTAINER64)\infile_array.inc $(CONTAINER64)\infile_size.inc\
-	$(CONTAINER64)\key_size.inc $(CONTAINER64)\logfile_select.asm
-
-.PHONY:all
-all: verbose.o fileaccess.o hyperion.o pe_general.o pe32.o pe64.o fasmoutput.o \
-	encryption.o secure_string.o aes.o
-	$(CC) -o $(BIN)\hyperion.exe $(OBJ)\hyperion.o $(OBJ)\verbose.o \
-	$(OBJ)\fileaccess.o $(OBJ)\pe_general.o $(OBJ)\pe32.o $(OBJ)\pe64.o \
-	$(OBJ)\fasmoutput.o $(OBJ)\encryption.o $(OBJ)\secure_string.o $(OBJ)\aes.o
-
-hyperion.o: $(SRC)\hyperion.c
-	$(CC) $(CFLAGS) -o $(OBJ)\hyperion.o $(SRC)\hyperion.c
-
-verbose.o: $(SRC)\verbose.c
-	$(CC) $(CFLAGS) -o $(OBJ)\verbose.o $(SRC)\verbose.c
-
-secure_string.o: $(SRC)\secure_string.c
-	$(CC) $(CFLAGS) -o $(OBJ)\secure_string.o $(SRC)\secure_string.c
-
-fileaccess.o: $(SRC)\fileaccess.c
-	$(CC) $(CFLAGS) -o $(OBJ)\fileaccess.o $(SRC)\fileaccess.c
-
-pe_general.o: $(SRC)\pe_general.c
-	$(CC) $(CFLAGS) -o $(OBJ)\pe_general.o $(SRC)\pe_general.c
-
-pe32.o: $(SRC)\pe32.c
-	$(CC) $(CFLAGS) -o $(OBJ)\pe32.o $(SRC)\pe32.c
-
-pe64.o: $(SRC)\pe64.c
-	$(CC) $(CFLAGS) -o $(OBJ)\pe64.o $(SRC)\pe64.c
-
-fasmoutput.o: $(SRC)\fasmoutput.c
-	$(CC) $(CFLAGS) -Wno-format -o $(OBJ)\fasmoutput.o $(SRC)\fasmoutput.c
-
-encryption.o: $(SRC)\encryption.c
-	$(CC) $(CFLAGS) -o $(OBJ)\encryption.o $(SRC)\encryption.c
-
-aes.o: $(SRC)\aes.c
-	$(CC) $(CFLAGS) -o $(OBJ)\aes.o $(SRC)\aes.c
-
-.PHONY:clean
-clean:
-	del $(BIN)\hyperion.exe $(OBJ)\*.o $(GENERATED_ASM) >nul 2>&1
+AES_INCLUDE_DIR = Src/Payloads/Aes/c
+CFLAGS = -std=c99 -Wall -pedantic -O2 -m32 -I$(AES_INCLUDE_DIR)
+SRC = $(wildcard Src/Crypter/*.c) $(wildcard Src/Payloads/Aes/c/*.c)
+OBJ = $(SRC:.c=.o)
+EXECUTABLE=hyperion.exe
+ 
+all: hyperion
+ 
+hyperion: $(OBJ)
+	$(CC) $(CFLAGS) -o $(EXECUTABLE) $^
diff --git a/Obj/readme.txt b/Obj/readme.txt
deleted file mode 100755
index 8b771bf..0000000
--- a/Obj/readme.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-Some mingw32-make versions seem to fail when creating this directory on the
-fly. 
diff --git a/Src/Container/32/createstrings.inc b/Src/Container/32/createstrings.inc
old mode 100755
new mode 100644
diff --git a/Src/Container/32/hyperion.inc b/Src/Container/32/hyperion.inc
old mode 100755
new mode 100644
diff --git a/Src/Container/32/loadapis.asm b/Src/Container/32/loadapis.asm
old mode 100755
new mode 100644
index 3cef3a8..0f22687
--- a/Src/Container/32/loadapis.asm
+++ b/Src/Container/32/loadapis.asm
@@ -1,135 +1,135 @@
-;Dynamically load the needed APIs
-;Strings are created on stack
-
-;dllname: zero terminated string with dll name
-;store: save the dll image base here
-;Jumps to LoadLogAPIsExit if an Error Occurs
-macro loadDLL dllname, store, exit
-{
-	lea eax,[dllname]
-	invoke LoadLibrary,eax
-	test eax,eax
-	jz exit
-	mov [store],eax
-}
-
-;functionname: zero terminated string with functions name
-;dll_imagebase: imagebase of the dll
-;returns: function pointer in eax
-macro loadAPI functionname, dll_imagebase, exit
-{
-	lea eax,[functionname]
-	invoke GetProcAddress,dword [dll_imagebase],eax
-	test eax,eax
-	jz exit
-}
-
-;Loads all necessary APISs
-proc loadRegularAPIs stdcall APITable:DWORD
-
-local str1[256]:BYTE, kernel32_imagebase:DWORD
-
-	pushad
-	writeWithNewLine createStringLoading, str1, LoadRegularAPIsExit_Error
-
-	;Get Kernel32.Dll Imagebase
-	writeWithNewLine createStringKernel32, str1, LoadRegularAPIsExit_Error
-	loadDLL str1, kernel32_imagebase, LoadRegularAPIsExit_Error
-
-	;Load GetModuleHandle
-	writeWithNewLine createStringGetModuleHandle, str1, LoadRegularAPIsExit_Error
-	loadAPI str1, kernel32_imagebase, LoadRegularAPIsExit_Error
-	mov edx,[APITable]
-	mov [edx+GetModuleHandle],eax
-
-	;Load VirtualAlloc
-	writeWithNewLine createStringVirtualAlloc, str1, LoadRegularAPIsExit_Error
-	loadAPI str1, kernel32_imagebase, LoadRegularAPIsExit_Error
-	mov edx,[APITable]
-	mov [edx+VirtualAlloc],eax
-
-	;Load VirtualProtect
-	writeWithNewLine createStringVirtualProtect, str1, LoadRegularAPIsExit_Error
-	loadAPI str1, kernel32_imagebase, LoadRegularAPIsExit_Error
-	mov edx,[APITable]
-	mov [edx+VirtualProtect],eax
-
-	;Load VirtualFree
-	writeWithNewLine createStringVirtualFree, str1, LoadRegularAPIsExit_Error
-	loadAPI str1, kernel32_imagebase, LoadRegularAPIsExit_Error
-	mov edx,[APITable]
-	mov [edx+VirtualFree],eax
-
-	popad
-	mov eax,1
-	ret
-	
-LoadRegularAPIsExit_Error:
-	popad
-	mov eax,0
-	ret
-endp
-
-;Loads the basic functions for log file access
-proc loadLogAPIs stdcall APITable:DWORD
-
-local str1[256]:BYTE, kernel32_imagebase:DWORD
-
-	pushad
-	;Get Kernel32.Dll Imagebase
-	createStringKernel32 str1
-	loadDLL str1, kernel32_imagebase, LoadLogAPIsExit_Error
-
-	;Load CreateFileMapping API
-	createStringCreateFileMapping str1
-	loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error
-	mov edx,[APITable]
-	mov [edx+CreateFileMapping],eax
-
-	;Load MapViewOfFile API
-	createStringMapViewOfFile str1
-	loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error
-	mov edx,[APITable]
-	mov [edx+MapViewOfFile],eax
-
-	;Load UnmapViewOfFile API
-	createStringUnmapViewOfFile str1
-	loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error
-	mov edx,[APITable]
-	mov [edx+UnmapViewOfFile],eax
-
-	;Load UnmapViewOfFile API
-	createStringCreateFile str1
-	loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error
-	mov edx,[APITable]
-	mov [edx+CreateFile],eax
-
-	;Load CloseHandle API
-	createStringCloseHandle str1
-	loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error
-	mov edx,[APITable]
-	mov [edx+CloseHandle],eax
-
-	;Load GetFileSize API
-	createStringGetFileSize str1
-	loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error
-	mov edx,[APITable]
-	mov [edx+GetFileSize],eax
-
-	;Load DeleteFile API
-	createStringDeleteFile str1
-	loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error
-	mov edx,[APITable]
-	mov [edx+DeleteFile],eax
-
-	;apis loaded successfully
-	popad
-	mov eax,1
-	ret
-
-LoadLogAPIsExit_Error:
-	popad
-	mov eax,0
-	ret
-
-endp
+;Dynamically load the needed APIs
+;Strings are created on stack
+
+;dllname: zero terminated string with dll name
+;store: save the dll image base here
+;Jumps to LoadLogAPIsExit if an Error Occurs
+macro loadDLL dllname, store, exit
+{
+	lea eax,[dllname]
+	invoke LoadLibrary,eax
+	test eax,eax
+	jz exit
+	mov [store],eax
+}
+
+;functionname: zero terminated string with functions name
+;dll_imagebase: imagebase of the dll
+;returns: function pointer in eax
+macro loadAPI functionname, dll_imagebase, exit
+{
+	lea eax,[functionname]
+	invoke GetProcAddress,dword [dll_imagebase],eax
+	test eax,eax
+	jz exit
+}
+
+;Loads all necessary APISs
+proc loadRegularAPIs stdcall APITable:DWORD
+
+local str1[256]:BYTE, kernel32_imagebase:DWORD
+
+	pushad
+	writeWithNewLine createStringLoading, str1, LoadRegularAPIsExit_Error
+
+	;Get Kernel32.Dll Imagebase
+	writeWithNewLine createStringKernel32, str1, LoadRegularAPIsExit_Error
+	loadDLL str1, kernel32_imagebase, LoadRegularAPIsExit_Error
+
+	;Load GetModuleHandle
+	writeWithNewLine createStringGetModuleHandle, str1, LoadRegularAPIsExit_Error
+	loadAPI str1, kernel32_imagebase, LoadRegularAPIsExit_Error
+	mov edx,[APITable]
+	mov [edx+GetModuleHandle],eax
+
+	;Load VirtualAlloc
+	writeWithNewLine createStringVirtualAlloc, str1, LoadRegularAPIsExit_Error
+	loadAPI str1, kernel32_imagebase, LoadRegularAPIsExit_Error
+	mov edx,[APITable]
+	mov [edx+VirtualAlloc],eax
+
+	;Load VirtualProtect
+	writeWithNewLine createStringVirtualProtect, str1, LoadRegularAPIsExit_Error
+	loadAPI str1, kernel32_imagebase, LoadRegularAPIsExit_Error
+	mov edx,[APITable]
+	mov [edx+VirtualProtect],eax
+
+	;Load VirtualFree
+	writeWithNewLine createStringVirtualFree, str1, LoadRegularAPIsExit_Error
+	loadAPI str1, kernel32_imagebase, LoadRegularAPIsExit_Error
+	mov edx,[APITable]
+	mov [edx+VirtualFree],eax
+
+	popad
+	mov eax,1
+	ret
+	
+LoadRegularAPIsExit_Error:
+	popad
+	mov eax,0
+	ret
+endp
+
+;Loads the basic functions for log file access
+proc loadLogAPIs stdcall APITable:DWORD
+
+local str1[256]:BYTE, kernel32_imagebase:DWORD
+
+	pushad
+	;Get Kernel32.Dll Imagebase
+	createStringKernel32 str1
+	loadDLL str1, kernel32_imagebase, LoadLogAPIsExit_Error
+
+	;Load CreateFileMapping API
+	createStringCreateFileMapping str1
+	loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error
+	mov edx,[APITable]
+	mov [edx+CreateFileMapping],eax
+
+	;Load MapViewOfFile API
+	createStringMapViewOfFile str1
+	loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error
+	mov edx,[APITable]
+	mov [edx+MapViewOfFile],eax
+
+	;Load UnmapViewOfFile API
+	createStringUnmapViewOfFile str1
+	loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error
+	mov edx,[APITable]
+	mov [edx+UnmapViewOfFile],eax
+
+	;Load UnmapViewOfFile API
+	createStringCreateFile str1
+	loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error
+	mov edx,[APITable]
+	mov [edx+CreateFile],eax
+
+	;Load CloseHandle API
+	createStringCloseHandle str1
+	loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error
+	mov edx,[APITable]
+	mov [edx+CloseHandle],eax
+
+	;Load GetFileSize API
+	createStringGetFileSize str1
+	loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error
+	mov edx,[APITable]
+	mov [edx+GetFileSize],eax
+
+	;Load DeleteFile API
+	createStringDeleteFile str1
+	loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error
+	mov edx,[APITable]
+	mov [edx+DeleteFile],eax
+
+	;apis loaded successfully
+	popad
+	mov eax,1
+	ret
+
+LoadLogAPIsExit_Error:
+	popad
+	mov eax,0
+	ret
+
+endp
diff --git a/Src/Container/32/loadexecutable.asm b/Src/Container/32/loadexecutable.asm
old mode 100755
new mode 100644
index 2d56519..9014946
--- a/Src/Container/32/loadexecutable.asm
+++ b/Src/Container/32/loadexecutable.asm
@@ -1,584 +1,584 @@
-;Loads the exe which is stored in input_image
-;into memory and starts its execution
-proc loadExecutable stdcall APITable:DWORD,\
-input_image:DWORD
-
-local str1[256]:BYTE, ret_val:DWORD, image_file_header:DWORD,\
-loaded_file:DWORD
-
-	pushad
-	;verify checksum of packed executable
-	writeWithNewLine createStringVerifyChecksum, str1, le_exit_error
-	stdcall verifyChecksum, [input_image], INFILE_SIZE
-	test eax,eax
-	jz le_exit_error
-
-	;verify whether the content of the data section is pe
-	writeWithNewLine createStringVerifyPE, str1, le_exit_error
-	mov eax,[input_image]
-	add eax,4
-	stdcall verifyPE, eax, INFILE_SIZE
-	test eax,eax
-	mov [image_file_header],eax
-	jz le_exit_error
-
-	;copy pe header and sections into memory
-	writeNewLineToLog APITable
-	writeWithNewLine createStringMappingFileInMemory, str1, le_exit_error
-	mov eax,[input_image]
-	add eax,4
-	mov ebx,INFILE_SIZE
-	sub ebx,4
-	stdcall loadFile, [APITable], [image_file_header], eax, ebx
-	test eax,eax
-	mov [loaded_file],eax
-	jz le_exit_error
-
-	;loading import table
-	writeNewLineToLog APITable
-	writeWithNewLine createStringLoadingFilesAPIs, str1, le_exit_error
-	stdcall loadImportTable, [APITable], [loaded_file]
-	test eax,eax
-	jz le_exit_error
-
-	;set the correct permissions for each section
-	writeNewLineToLog APITable
-	writeWithNewLine createStringSettingPermissions, str1, le_exit_error
-	mov eax,[input_image]
-	add eax,4
-	mov ebx,INFILE_SIZE
-	sub ebx,4
-	stdcall setPermissions, [APITable], [image_file_header], eax, ebx
-	test eax,eax
-	jz le_exit_error
-
-le_exit_success:
-	popad
-	mov eax,1
-	ret
-
-le_exit_error:
-	popad
-	mov eax,0
-	ret
-
-endp
-
-;load the APIs in the import table
-proc loadImportTable, APITable:DWORD, image_base:DWORD
-
-local str1[256]:BYTE, import_table:DWORD, null_directory_entry[sizeof.IMAGE_IMPORT_DESCRIPTOR]:BYTE
-
-	pushad
-	;find import table in data directory
-	mov edx,[image_base]
-	mov eax,[edx+IMAGE_DOS_HEADER.e_lfanew]
-	add eax,edx
-	add eax,4
-	;image file header now in eax
-	add eax,sizeof.IMAGE_FILE_HEADER
-	lea eax,[eax+IMAGE_OPTIONAL_HEADER32.DataDirectory]
-	;first data directory entry now in eax
-	add eax,sizeof.IMAGE_DATA_DIRECTORY
-	;import data directory entry now in eax
-	mov eax,[eax+IMAGE_DATA_DIRECTORY.VirtualAddress]
-	add eax,edx
-	;pointer to import table now in eax
-	mov [import_table],eax
-	writeWithNewLine createStringFoundImportTable, str1, le_exit_error
-	writeRegisterToLog APITable, [import_table]
-	test eax,eax
-	jz pit_exit_error
-
-	;init null directory entry
-	lea esi,[null_directory_entry]
-	mov ecx,sizeof.IMAGE_IMPORT_DESCRIPTOR
-	mov al,0
-pit_init_null_directory_loop:
-	mov [esi],al
-	inc esi
-	dec ecx
-	jnz pit_init_null_directory_loop
-
-	mov ebx,[import_table]
-	;iterate over the directory tables
-pit_next_directory_entry:
-	lea esi,[null_directory_entry]
-	mov edi,ebx
-	mov ecx,sizeof.IMAGE_IMPORT_DESCRIPTOR
-	rep cmpsb
-	je pit_exit_success
-	;load APIs of this directory
-	stdcall loadImportDirectoryTable, [APITable], [image_base], ebx
-	test eax,eax
-	jz pit_exit_error
-	;next entry
-	add ebx,sizeof.IMAGE_IMPORT_DESCRIPTOR
-	jmp pit_next_directory_entry
-
-pit_exit_success:
-	popad
-	mov eax,1
-	ret
-
-pit_exit_error:
-	popad
-	mov eax,0
-	ret
-endp
-
-;loads the APIs
-proc loadImportDirectoryTable stdcall, APITable:DWORD, image_base:DWORD, directory_entry:DWORD
-
-local str1[256]:BYTE, lookup_table:DWORD, import_address_table:DWORD, dll_image_base:DWORD
-
-	pushad
-	;write info about data directory table to logfile
-	writeNewLineToLog APITable
-	test eax,eax
-	jz lidt_exit_error
-	writeWithNewLine createStringProcessImportDirectory, str1, lidt_exit_error
-	mov eax,[directory_entry]
-	mov eax,[eax+IMAGE_IMPORT_DESCRIPTOR.Name_]
-	add eax,[image_base]
-	mov ebx,eax
-	;pointer to dll name in ebx
-	writeLog APITable, eax
-	test eax,eax
-	jz lidt_exit_error
-	writeNewLineToLog APITable
-	test eax,eax
-	jz lidt_exit_error
-
-	;load the corresponding dll
-	invoke LoadLibrary, ebx
-	test eax,eax
-	jz lidt_exit_error
-	mov [dll_image_base],eax
-
-	;read pointer to the api tables
-	mov edx,[directory_entry]
-	mov eax,[edx+IMAGE_IMPORT_DESCRIPTOR.OriginalFirstThunk]
-	add eax,[image_base]
-	mov [lookup_table],eax
-	mov eax,[edx+IMAGE_IMPORT_DESCRIPTOR.FirstThunk]
-	add eax,[image_base]
-	mov [import_address_table],eax
-
-	;index to current API
-	sub ecx,ecx
-	;iterate the lookup_table entries
-lidt_next_lookup_entry:
-	mov eax,[lookup_table]
-	add eax,ecx
-	mov eax,[eax]
-	test eax,eax
-	jz lidt_exit_success
-	mov ebx,eax
-	and eax,IMAGE_ORDINAL_FLAG32
-	jnz lidt_byordinal
-lidt_byname:
-	createStringName str1
-	lea eax,[str1]
-	writeLog APITable, eax
-	test eax,eax
-	jz lidt_exit_error
-	add ebx,[image_base]
-	lea ebx,[ebx+IMAGE_IMPORT_BY_NAME.Name_]
-	mov eax,ebx
-	writeLog APITable, eax
-	test eax,eax
-	jz lidt_exit_error
-	writeNewLineToLog APITable
-	test eax,eax
-	jz lidt_exit_error
-	;API name pointer in ebx
-	push ecx
-	invoke GetProcAddress, [dll_image_base], ebx
-	pop ecx
-	test eax,eax
-	jz lidt_exit_error
-	mov ebx,[import_address_table]
-	add ebx,ecx
-	mov [ebx],eax
-	;fetch next API
-	add ecx,4
-	jmp lidt_next_lookup_entry
-
-lidt_byordinal:
-	createStringOrdinal str1
-	lea eax,[str1]
-	writeLog APITable, eax
-	test eax,eax
-	jz lidt_exit_error
-	;remove the ordinal flag
-	xor ebx,IMAGE_ORDINAL_FLAG32
-	mov eax,ebx
-	writeRegisterToLog APITable, eax
-	test eax,eax
-	jz pit_exit_error
-	;API ordinal in ebx
-	push ecx
-	invoke GetProcAddress, [dll_image_base], ebx
-	pop ecx
-	test eax,eax
-	jz lidt_exit_error
-	mov ebx,[import_address_table]
-	add ebx,ecx
-	mov [ebx],eax
-	;fetch next API
-	add ecx,4
-	jmp lidt_next_lookup_entry
-
-lidt_exit_success:
-	popad
-	mov eax,1
-	ret
-
-lidt_exit_error:
-	popad
-	mov eax,0
-	ret
-endp;
-
-;sets the memory permissions for each section
-proc setPermissions stdcall, APITable:DWORD, image_file_header:DWORD, file_image_base:DWORD, \
-file_image_size:DWORD
-
-local number_of_sections:DWORD, image_base:DWORD, section_headers:DWORD,\
-pe_header_size:DWORD, str1[256]:BYTE, vprotect_ret:DWORD
-
-	pushad
-	;find section header
-	mov edx,[image_file_header]
-	sub eax,eax
-	mov ax,[edx+IMAGE_FILE_HEADER.NumberOfSections]
-	mov [number_of_sections],eax
-	add edx,sizeof.IMAGE_FILE_HEADER
-	mov eax,[edx+IMAGE_OPTIONAL_HEADER32.ImageBase]
-	mov [image_base],eax
-	;search for section header
-	lea ebx,[edx+IMAGE_OPTIONAL_HEADER32.DataDirectory]
-	mov eax,[edx+IMAGE_OPTIONAL_HEADER32.NumberOfRvaAndSizes]
-	mov edx,sizeof.IMAGE_DATA_DIRECTORY
-	mul edx
-	add eax,ebx
-	;first section header found
-	mov [section_headers],eax
-	mov eax,sizeof.IMAGE_SECTION_HEADER
-	mov edx,[number_of_sections]
-	mul edx
-	;end of section header sections found
-	add eax,[section_headers]
-	mov ebx,[file_image_base]
-	sub eax,ebx
-	;unaligned size of pe header in eax
-	mov [pe_header_size],eax
-
-	;set pe header page read-only
-	mov edx,[APITable]
-	lea eax,[vprotect_ret]
-	stdcall dword [edx+VirtualProtect], [image_base], [pe_header_size], PAGE_READONLY, eax
-	test eax,eax
-	jz sp_exit_error
-
-	;some output for the user
-	writeRegisterToLog APITable, [image_base]
-	test eax,eax
-	jz sp_exit_error
-
-	;set the section page permissions
-	mov ecx,[number_of_sections]
-	mov ebx,[section_headers]
-sp_load_section_loop:
-	stdcall setSection, [APITable], ebx, [image_base], [file_image_base]
-	test eax,eax
-	jz sp_exit_error
-	add ebx,sizeof.IMAGE_SECTION_HEADER
-	dec ecx
-	jnz sp_load_section_loop
-
-sp_exit_success:
-	popad
-	mov eax,1
-	ret
-
-sp_exit_error:
-	popad
-	sub eax,eax
-	ret
-endp;
-
-;sets the complete image of the decrypted file writeable so
-;we can copy pe header and sections into into
-proc loadFile stdcall, APITable:DWORD, image_file_header:DWORD, file_image_base:DWORD, \
-file_image_size:DWORD
-
-local number_of_sections:DWORD, image_base:DWORD, aux:DWORD,\
-str1[256]:BYTE, vprotect_ret:DWORD, section_headers:DWORD, pe_header_size:DWORD
-
-	pushad
-	;find section header
-	mov edx,[image_file_header]
-	sub eax,eax
-	mov ax,[edx+IMAGE_FILE_HEADER.NumberOfSections]
-	mov [number_of_sections],eax
-	add edx,sizeof.IMAGE_FILE_HEADER
-	mov eax,[edx+IMAGE_OPTIONAL_HEADER32.ImageBase]
-	mov [image_base],eax
-	;make the complete image writable
-	mov eax,[edx+IMAGE_OPTIONAL_HEADER32.SizeOfImage]
-	mov [aux],edx ;store edx, we need it later
-	lea edx,[vprotect_ret]
-	mov ebx,[APITable]
-	stdcall dword [ebx+VirtualProtect], [image_base], eax, PAGE_READWRITE, edx
-	test eax,eax
-	jz lf_exit_error
-
-	;some output for the user
-	writeWithNewLine createStringLoadedPEHeader, str1, lf_exit_error
-	writeRegisterToLog APITable, [image_base]
-	test eax,eax
-	jz lf_exit_error
-
-	mov edx,[aux] ;restore edx
-	;continue search for section header
-	lea ebx,[edx+IMAGE_OPTIONAL_HEADER32.DataDirectory]
-	mov eax,[edx+IMAGE_OPTIONAL_HEADER32.NumberOfRvaAndSizes]
-	mov edx,sizeof.IMAGE_DATA_DIRECTORY
-	mul edx
-	add eax,ebx
-
-	;first section header found
-	mov [section_headers],eax
-	mov eax,sizeof.IMAGE_SECTION_HEADER
-	mov edx,[number_of_sections]
-	mul edx
-	;end of section header sections found
-	add eax,[section_headers]
-	mov ebx,[file_image_base]
-	sub eax,ebx
-	;unaligned size of pe header in eax
-	mov [pe_header_size],eax
-
-	;copy header to memory
-	mov edi,[image_base]
-	mov esi,[file_image_base]
-	mov ecx,[pe_header_size]
-	rep movsb
-
-	;load the sections
-	mov ecx,[number_of_sections]
-	mov ebx,[section_headers]
-lf_load_section_loop:
-	stdcall loadSection, [APITable], ebx, [image_base], [file_image_base]
-	test eax,eax
-	jz lf_exit_error
-	add ebx,sizeof.IMAGE_SECTION_HEADER
-	dec ecx
-	jnz lf_load_section_loop
-
-lf_exit_success:
-	popad
-	mov eax,[image_base]
-	ret
-
-lf_exit_error:
-	popad
-	mov eax,0
-	ret
-
-endp
-
-;load the corresponding section into memory
-proc loadSection stdcall, APITable:DWORD, section_header:DWORD, image_base:DWORD,\
-file_image_base:DWORD
-
-local str1[256]:BYTE
-
-	pushad
-	;copy from file into memory
-	mov edx,[section_header]
-	mov edi,[edx+IMAGE_SECTION_HEADER.VirtualAddress]
-	add edi,[image_base]
-	mov esi,[file_image_base]
-	add esi,[edx+IMAGE_SECTION_HEADER.PointerToRawData]
-	mov ecx,[edx+IMAGE_SECTION_HEADER.SizeOfRawData]
-	rep movsb
-
-	;print some infos to the log file
-	createStringLoaded str1
-	lea eax,[str1]
-	writeLog APITable, eax
-	test eax,eax
-	jz ls_exit_error
-	lea edi,[str1]
-	mov byte [edi+8],0
-	mov edx,[section_header]
-	lea esi,[edx+IMAGE_SECTION_HEADER._Name]
-	mov ecx,8
-	push edi
-	rep movsb
-	pop edi
-	writeLog APITable, edi
-	writeNewLineToLog APITable
-	mov edx,[section_header]
-	mov eax,[edx+IMAGE_SECTION_HEADER.VirtualAddress]
-	add eax,[image_base]
-	writeRegisterToLog APITable, eax
-
-ls_exit_success:
-	popad
-	mov eax,1
-	ret
-
-ls_exit_error:
-	popad
-	sub eax,eax
-	ret
-
-endp
-
-;set the memory page permission for the corresponding section
-proc setSection stdcall, APITable:DWORD, section_header:DWORD, image_base:DWORD,\
-file_image_base:DWORD
-
-local section_flags:DWORD, vprotect_ret:DWORD, str1[256]:BYTE
-
-	pushad
-	mov edx,[section_header]
-;section execute/read/write?
-	mov ebx,[edx+IMAGE_SECTION_HEADER.Characteristics]
-	and ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE
-	cmp ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE
-	jne ssn_no_execute_read_write
-	mov eax,PAGE_EXECUTE_READWRITE
-	mov [section_flags],eax
-	jmp ssn_set_memory
-ssn_no_execute_read_write:
-	;section execute/read?
-	mov ebx,[edx+IMAGE_SECTION_HEADER.Characteristics]
-	and ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ
-	cmp ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ
-	jne ssn_no_execute_read
-	mov eax,PAGE_EXECUTE_READ
-	mov [section_flags],eax
-	jmp ssn_set_memory
-ssn_no_execute_read:
-	;section read/write?
-	mov ebx,[edx+IMAGE_SECTION_HEADER.Characteristics]
-	and ebx,IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE
-	cmp ebx,IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE
-	jne ssn_no_read_write
-	mov eax,PAGE_READWRITE
-	mov [section_flags],eax
-	jmp ssn_set_memory
-ssn_no_read_write:
-	;section read?
-	mov ebx,[edx+IMAGE_SECTION_HEADER.Characteristics]
-	and ebx,IMAGE_SCN_MEM_READ
-	cmp ebx,IMAGE_SCN_MEM_READ
-	jne ssn_no_read
-	mov eax,PAGE_READONLY
-	mov [section_flags],eax
-	jmp ssn_set_memory
-ssn_no_read:
-	mov eax,PAGE_NOACCESS
-	mov [section_flags],eax
-
-	;set section permissions
-ssn_set_memory:
-	mov edx,[section_header]
-	mov eax,[edx+IMAGE_SECTION_HEADER.VirtualAddress]
-	add eax,[image_base]
-	mov ebx,[edx+IMAGE_SECTION_HEADER.VirtualSize]
-	mov ecx,[APITable]
-	lea edx,[vprotect_ret]
-	stdcall dword [ecx+VirtualProtect],eax,ebx,[section_flags], edx
-	test eax,eax
-	jz ssn_exit_error
-
-	;some output for the user
-	mov edx,[section_header]
-	mov eax,[edx+IMAGE_SECTION_HEADER.VirtualAddress]
-	add eax,[image_base]
-	writeRegisterToLog APITable, eax
-
-ssn_exit_success:
-	popad
-	mov eax,1
-	ret
-
-ssn_exit_error:
-	popad
-	sub eax,eax
-	ret
-endp;
-
-;check MZ und PE signature and return start of the image file header
-proc verifyPE stdcall, image_base:DWORD, section_size:DWORD
-
-local retval:DWORD
-
-	pushad
-	mov edx,[image_base]
-	mov ax,[edx+IMAGE_DOS_HEADER.e_magic]
-	cmp ax,IMAGE_DOS_SIGNATURE
-	jne vpe_exit_error
-	mov eax,[edx+IMAGE_DOS_HEADER.e_lfanew]
-	add edx,eax
-	mov eax,dword [edx]
-	cmp eax,IMAGE_NT_SIGNATURE
-	jne vpe_exit_error
-	add edx,4
-	mov [retval],edx
-
-vpe_exit_success:
-	popad
-	mov eax,[retval]
-	ret
-
-vpe_exit_error:
-	popad
-	sub eax,eax
-	ret
-
-endp
-
-;First 4 bytes of data seciton contain a checksum
-;Verify that the checksum is correct
-;TODO: CHECKSUM SIZE is atm hardcoded
-proc verifyChecksum stdcall, section_address:DWORD, section_size:DWORD
-
-	pushad
-	mov ebx,dword [section_address]
-	mov eax,[ebx]
-	add ebx,4
-	mov ecx,[section_size]
-	sub ecx,4
-	;checksum is in eax
-	;pointer to file in ebx
-	;size of file in ecx
-	sub edi,edi
-vs_calc_cs:
-	sub edx,edx
-	mov dl,byte [ebx]
-	add edi,edx
-	inc ebx
-	dec ecx
-	jnz vs_calc_cs
-	;calculated checksum is in edi
-	cmp edi,eax
-	jne vs_exit_error
-
-vs_exit_success:
-	popad
-	mov eax,1
-	ret
-
-vs_exit_error:
-	popad
-	sub eax,eax
-	ret
-
+;Loads the exe which is stored in input_image
+;into memory and starts its execution
+proc loadExecutable stdcall APITable:DWORD,\
+input_image:DWORD
+
+local str1[256]:BYTE, ret_val:DWORD, image_file_header:DWORD,\
+loaded_file:DWORD
+
+	pushad
+	;verify checksum of packed executable
+	writeWithNewLine createStringVerifyChecksum, str1, le_exit_error
+	stdcall verifyChecksum, [input_image], INFILE_SIZE
+	test eax,eax
+	jz le_exit_error
+
+	;verify whether the content of the data section is pe
+	writeWithNewLine createStringVerifyPE, str1, le_exit_error
+	mov eax,[input_image]
+	add eax,4
+	stdcall verifyPE, eax, INFILE_SIZE
+	test eax,eax
+	mov [image_file_header],eax
+	jz le_exit_error
+
+	;copy pe header and sections into memory
+	writeNewLineToLog APITable
+	writeWithNewLine createStringMappingFileInMemory, str1, le_exit_error
+	mov eax,[input_image]
+	add eax,4
+	mov ebx,INFILE_SIZE
+	sub ebx,4
+	stdcall loadFile, [APITable], [image_file_header], eax, ebx
+	test eax,eax
+	mov [loaded_file],eax
+	jz le_exit_error
+
+	;loading import table
+	writeNewLineToLog APITable
+	writeWithNewLine createStringLoadingFilesAPIs, str1, le_exit_error
+	stdcall loadImportTable, [APITable], [loaded_file]
+	test eax,eax
+	jz le_exit_error
+
+	;set the correct permissions for each section
+	writeNewLineToLog APITable
+	writeWithNewLine createStringSettingPermissions, str1, le_exit_error
+	mov eax,[input_image]
+	add eax,4
+	mov ebx,INFILE_SIZE
+	sub ebx,4
+	stdcall setPermissions, [APITable], [image_file_header], eax, ebx
+	test eax,eax
+	jz le_exit_error
+
+le_exit_success:
+	popad
+	mov eax,1
+	ret
+
+le_exit_error:
+	popad
+	mov eax,0
+	ret
+
+endp
+
+;load the APIs in the import table
+proc loadImportTable, APITable:DWORD, image_base:DWORD
+
+local str1[256]:BYTE, import_table:DWORD, null_directory_entry[sizeof.IMAGE_IMPORT_DESCRIPTOR]:BYTE
+
+	pushad
+	;find import table in data directory
+	mov edx,[image_base]
+	mov eax,[edx+IMAGE_DOS_HEADER.e_lfanew]
+	add eax,edx
+	add eax,4
+	;image file header now in eax
+	add eax,sizeof.IMAGE_FILE_HEADER
+	lea eax,[eax+IMAGE_OPTIONAL_HEADER32.DataDirectory]
+	;first data directory entry now in eax
+	add eax,sizeof.IMAGE_DATA_DIRECTORY
+	;import data directory entry now in eax
+	mov eax,[eax+IMAGE_DATA_DIRECTORY.VirtualAddress]
+	add eax,edx
+	;pointer to import table now in eax
+	mov [import_table],eax
+	writeWithNewLine createStringFoundImportTable, str1, le_exit_error
+	writeRegisterToLog APITable, [import_table]
+	test eax,eax
+	jz pit_exit_error
+
+	;init null directory entry
+	lea esi,[null_directory_entry]
+	mov ecx,sizeof.IMAGE_IMPORT_DESCRIPTOR
+	mov al,0
+pit_init_null_directory_loop:
+	mov [esi],al
+	inc esi
+	dec ecx
+	jnz pit_init_null_directory_loop
+
+	mov ebx,[import_table]
+	;iterate over the directory tables
+pit_next_directory_entry:
+	lea esi,[null_directory_entry]
+	mov edi,ebx
+	mov ecx,sizeof.IMAGE_IMPORT_DESCRIPTOR
+	rep cmpsb
+	je pit_exit_success
+	;load APIs of this directory
+	stdcall loadImportDirectoryTable, [APITable], [image_base], ebx
+	test eax,eax
+	jz pit_exit_error
+	;next entry
+	add ebx,sizeof.IMAGE_IMPORT_DESCRIPTOR
+	jmp pit_next_directory_entry
+
+pit_exit_success:
+	popad
+	mov eax,1
+	ret
+
+pit_exit_error:
+	popad
+	mov eax,0
+	ret
+endp
+
+;loads the APIs
+proc loadImportDirectoryTable stdcall, APITable:DWORD, image_base:DWORD, directory_entry:DWORD
+
+local str1[256]:BYTE, lookup_table:DWORD, import_address_table:DWORD, dll_image_base:DWORD
+
+	pushad
+	;write info about data directory table to logfile
+	writeNewLineToLog APITable
+	test eax,eax
+	jz lidt_exit_error
+	writeWithNewLine createStringProcessImportDirectory, str1, lidt_exit_error
+	mov eax,[directory_entry]
+	mov eax,[eax+IMAGE_IMPORT_DESCRIPTOR.Name_]
+	add eax,[image_base]
+	mov ebx,eax
+	;pointer to dll name in ebx
+	writeLog APITable, eax
+	test eax,eax
+	jz lidt_exit_error
+	writeNewLineToLog APITable
+	test eax,eax
+	jz lidt_exit_error
+
+	;load the corresponding dll
+	invoke LoadLibrary, ebx
+	test eax,eax
+	jz lidt_exit_error
+	mov [dll_image_base],eax
+
+	;read pointer to the api tables
+	mov edx,[directory_entry]
+	mov eax,[edx+IMAGE_IMPORT_DESCRIPTOR.OriginalFirstThunk]
+	add eax,[image_base]
+	mov [lookup_table],eax
+	mov eax,[edx+IMAGE_IMPORT_DESCRIPTOR.FirstThunk]
+	add eax,[image_base]
+	mov [import_address_table],eax
+
+	;index to current API
+	sub ecx,ecx
+	;iterate the lookup_table entries
+lidt_next_lookup_entry:
+	mov eax,[lookup_table]
+	add eax,ecx
+	mov eax,[eax]
+	test eax,eax
+	jz lidt_exit_success
+	mov ebx,eax
+	and eax,IMAGE_ORDINAL_FLAG32
+	jnz lidt_byordinal
+lidt_byname:
+	createStringName str1
+	lea eax,[str1]
+	writeLog APITable, eax
+	test eax,eax
+	jz lidt_exit_error
+	add ebx,[image_base]
+	lea ebx,[ebx+IMAGE_IMPORT_BY_NAME.Name_]
+	mov eax,ebx
+	writeLog APITable, eax
+	test eax,eax
+	jz lidt_exit_error
+	writeNewLineToLog APITable
+	test eax,eax
+	jz lidt_exit_error
+	;API name pointer in ebx
+	push ecx
+	invoke GetProcAddress, [dll_image_base], ebx
+	pop ecx
+	test eax,eax
+	jz lidt_exit_error
+	mov ebx,[import_address_table]
+	add ebx,ecx
+	mov [ebx],eax
+	;fetch next API
+	add ecx,4
+	jmp lidt_next_lookup_entry
+
+lidt_byordinal:
+	createStringOrdinal str1
+	lea eax,[str1]
+	writeLog APITable, eax
+	test eax,eax
+	jz lidt_exit_error
+	;remove the ordinal flag
+	xor ebx,IMAGE_ORDINAL_FLAG32
+	mov eax,ebx
+	writeRegisterToLog APITable, eax
+	test eax,eax
+	jz pit_exit_error
+	;API ordinal in ebx
+	push ecx
+	invoke GetProcAddress, [dll_image_base], ebx
+	pop ecx
+	test eax,eax
+	jz lidt_exit_error
+	mov ebx,[import_address_table]
+	add ebx,ecx
+	mov [ebx],eax
+	;fetch next API
+	add ecx,4
+	jmp lidt_next_lookup_entry
+
+lidt_exit_success:
+	popad
+	mov eax,1
+	ret
+
+lidt_exit_error:
+	popad
+	mov eax,0
+	ret
+endp;
+
+;sets the memory permissions for each section
+proc setPermissions stdcall, APITable:DWORD, image_file_header:DWORD, file_image_base:DWORD, \
+file_image_size:DWORD
+
+local number_of_sections:DWORD, image_base:DWORD, section_headers:DWORD,\
+pe_header_size:DWORD, str1[256]:BYTE, vprotect_ret:DWORD
+
+	pushad
+	;find section header
+	mov edx,[image_file_header]
+	sub eax,eax
+	mov ax,[edx+IMAGE_FILE_HEADER.NumberOfSections]
+	mov [number_of_sections],eax
+	add edx,sizeof.IMAGE_FILE_HEADER
+	mov eax,[edx+IMAGE_OPTIONAL_HEADER32.ImageBase]
+	mov [image_base],eax
+	;search for section header
+	lea ebx,[edx+IMAGE_OPTIONAL_HEADER32.DataDirectory]
+	mov eax,[edx+IMAGE_OPTIONAL_HEADER32.NumberOfRvaAndSizes]
+	mov edx,sizeof.IMAGE_DATA_DIRECTORY
+	mul edx
+	add eax,ebx
+	;first section header found
+	mov [section_headers],eax
+	mov eax,sizeof.IMAGE_SECTION_HEADER
+	mov edx,[number_of_sections]
+	mul edx
+	;end of section header sections found
+	add eax,[section_headers]
+	mov ebx,[file_image_base]
+	sub eax,ebx
+	;unaligned size of pe header in eax
+	mov [pe_header_size],eax
+
+	;set pe header page read-only
+	mov edx,[APITable]
+	lea eax,[vprotect_ret]
+	stdcall dword [edx+VirtualProtect], [image_base], [pe_header_size], PAGE_READONLY, eax
+	test eax,eax
+	jz sp_exit_error
+
+	;some output for the user
+	writeRegisterToLog APITable, [image_base]
+	test eax,eax
+	jz sp_exit_error
+
+	;set the section page permissions
+	mov ecx,[number_of_sections]
+	mov ebx,[section_headers]
+sp_load_section_loop:
+	stdcall setSection, [APITable], ebx, [image_base], [file_image_base]
+	test eax,eax
+	jz sp_exit_error
+	add ebx,sizeof.IMAGE_SECTION_HEADER
+	dec ecx
+	jnz sp_load_section_loop
+
+sp_exit_success:
+	popad
+	mov eax,1
+	ret
+
+sp_exit_error:
+	popad
+	sub eax,eax
+	ret
+endp;
+
+;sets the complete image of the decrypted file writeable so
+;we can copy pe header and sections into into
+proc loadFile stdcall, APITable:DWORD, image_file_header:DWORD, file_image_base:DWORD, \
+file_image_size:DWORD
+
+local number_of_sections:DWORD, image_base:DWORD, aux:DWORD,\
+str1[256]:BYTE, vprotect_ret:DWORD, section_headers:DWORD, pe_header_size:DWORD
+
+	pushad
+	;find section header
+	mov edx,[image_file_header]
+	sub eax,eax
+	mov ax,[edx+IMAGE_FILE_HEADER.NumberOfSections]
+	mov [number_of_sections],eax
+	add edx,sizeof.IMAGE_FILE_HEADER
+	mov eax,[edx+IMAGE_OPTIONAL_HEADER32.ImageBase]
+	mov [image_base],eax
+	;make the complete image writable
+	mov eax,[edx+IMAGE_OPTIONAL_HEADER32.SizeOfImage]
+	mov [aux],edx ;store edx, we need it later
+	lea edx,[vprotect_ret]
+	mov ebx,[APITable]
+	stdcall dword [ebx+VirtualProtect], [image_base], eax, PAGE_READWRITE, edx
+	test eax,eax
+	jz lf_exit_error
+
+	;some output for the user
+	writeWithNewLine createStringLoadedPEHeader, str1, lf_exit_error
+	writeRegisterToLog APITable, [image_base]
+	test eax,eax
+	jz lf_exit_error
+
+	mov edx,[aux] ;restore edx
+	;continue search for section header
+	lea ebx,[edx+IMAGE_OPTIONAL_HEADER32.DataDirectory]
+	mov eax,[edx+IMAGE_OPTIONAL_HEADER32.NumberOfRvaAndSizes]
+	mov edx,sizeof.IMAGE_DATA_DIRECTORY
+	mul edx
+	add eax,ebx
+
+	;first section header found
+	mov [section_headers],eax
+	mov eax,sizeof.IMAGE_SECTION_HEADER
+	mov edx,[number_of_sections]
+	mul edx
+	;end of section header sections found
+	add eax,[section_headers]
+	mov ebx,[file_image_base]
+	sub eax,ebx
+	;unaligned size of pe header in eax
+	mov [pe_header_size],eax
+
+	;copy header to memory
+	mov edi,[image_base]
+	mov esi,[file_image_base]
+	mov ecx,[pe_header_size]
+	rep movsb
+
+	;load the sections
+	mov ecx,[number_of_sections]
+	mov ebx,[section_headers]
+lf_load_section_loop:
+	stdcall loadSection, [APITable], ebx, [image_base], [file_image_base]
+	test eax,eax
+	jz lf_exit_error
+	add ebx,sizeof.IMAGE_SECTION_HEADER
+	dec ecx
+	jnz lf_load_section_loop
+
+lf_exit_success:
+	popad
+	mov eax,[image_base]
+	ret
+
+lf_exit_error:
+	popad
+	mov eax,0
+	ret
+
+endp
+
+;load the corresponding section into memory
+proc loadSection stdcall, APITable:DWORD, section_header:DWORD, image_base:DWORD,\
+file_image_base:DWORD
+
+local str1[256]:BYTE
+
+	pushad
+	;copy from file into memory
+	mov edx,[section_header]
+	mov edi,[edx+IMAGE_SECTION_HEADER.VirtualAddress]
+	add edi,[image_base]
+	mov esi,[file_image_base]
+	add esi,[edx+IMAGE_SECTION_HEADER.PointerToRawData]
+	mov ecx,[edx+IMAGE_SECTION_HEADER.SizeOfRawData]
+	rep movsb
+
+	;print some infos to the log file
+	createStringLoaded str1
+	lea eax,[str1]
+	writeLog APITable, eax
+	test eax,eax
+	jz ls_exit_error
+	lea edi,[str1]
+	mov byte [edi+8],0
+	mov edx,[section_header]
+	lea esi,[edx+IMAGE_SECTION_HEADER._Name]
+	mov ecx,8
+	push edi
+	rep movsb
+	pop edi
+	writeLog APITable, edi
+	writeNewLineToLog APITable
+	mov edx,[section_header]
+	mov eax,[edx+IMAGE_SECTION_HEADER.VirtualAddress]
+	add eax,[image_base]
+	writeRegisterToLog APITable, eax
+
+ls_exit_success:
+	popad
+	mov eax,1
+	ret
+
+ls_exit_error:
+	popad
+	sub eax,eax
+	ret
+
+endp
+
+;set the memory page permission for the corresponding section
+proc setSection stdcall, APITable:DWORD, section_header:DWORD, image_base:DWORD,\
+file_image_base:DWORD
+
+local section_flags:DWORD, vprotect_ret:DWORD, str1[256]:BYTE
+
+	pushad
+	mov edx,[section_header]
+;section execute/read/write?
+	mov ebx,[edx+IMAGE_SECTION_HEADER.Characteristics]
+	and ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE
+	cmp ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE
+	jne ssn_no_execute_read_write
+	mov eax,PAGE_EXECUTE_READWRITE
+	mov [section_flags],eax
+	jmp ssn_set_memory
+ssn_no_execute_read_write:
+	;section execute/read?
+	mov ebx,[edx+IMAGE_SECTION_HEADER.Characteristics]
+	and ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ
+	cmp ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ
+	jne ssn_no_execute_read
+	mov eax,PAGE_EXECUTE_READ
+	mov [section_flags],eax
+	jmp ssn_set_memory
+ssn_no_execute_read:
+	;section read/write?
+	mov ebx,[edx+IMAGE_SECTION_HEADER.Characteristics]
+	and ebx,IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE
+	cmp ebx,IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE
+	jne ssn_no_read_write
+	mov eax,PAGE_READWRITE
+	mov [section_flags],eax
+	jmp ssn_set_memory
+ssn_no_read_write:
+	;section read?
+	mov ebx,[edx+IMAGE_SECTION_HEADER.Characteristics]
+	and ebx,IMAGE_SCN_MEM_READ
+	cmp ebx,IMAGE_SCN_MEM_READ
+	jne ssn_no_read
+	mov eax,PAGE_READONLY
+	mov [section_flags],eax
+	jmp ssn_set_memory
+ssn_no_read:
+	mov eax,PAGE_NOACCESS
+	mov [section_flags],eax
+
+	;set section permissions
+ssn_set_memory:
+	mov edx,[section_header]
+	mov eax,[edx+IMAGE_SECTION_HEADER.VirtualAddress]
+	add eax,[image_base]
+	mov ebx,[edx+IMAGE_SECTION_HEADER.VirtualSize]
+	mov ecx,[APITable]
+	lea edx,[vprotect_ret]
+	stdcall dword [ecx+VirtualProtect],eax,ebx,[section_flags], edx
+	test eax,eax
+	jz ssn_exit_error
+
+	;some output for the user
+	mov edx,[section_header]
+	mov eax,[edx+IMAGE_SECTION_HEADER.VirtualAddress]
+	add eax,[image_base]
+	writeRegisterToLog APITable, eax
+
+ssn_exit_success:
+	popad
+	mov eax,1
+	ret
+
+ssn_exit_error:
+	popad
+	sub eax,eax
+	ret
+endp;
+
+;check MZ und PE signature and return start of the image file header
+proc verifyPE stdcall, image_base:DWORD, section_size:DWORD
+
+local retval:DWORD
+
+	pushad
+	mov edx,[image_base]
+	mov ax,[edx+IMAGE_DOS_HEADER.e_magic]
+	cmp ax,IMAGE_DOS_SIGNATURE
+	jne vpe_exit_error
+	mov eax,[edx+IMAGE_DOS_HEADER.e_lfanew]
+	add edx,eax
+	mov eax,dword [edx]
+	cmp eax,IMAGE_NT_SIGNATURE
+	jne vpe_exit_error
+	add edx,4
+	mov [retval],edx
+
+vpe_exit_success:
+	popad
+	mov eax,[retval]
+	ret
+
+vpe_exit_error:
+	popad
+	sub eax,eax
+	ret
+
+endp
+
+;First 4 bytes of data seciton contain a checksum
+;Verify that the checksum is correct
+;TODO: CHECKSUM SIZE is atm hardcoded
+proc verifyChecksum stdcall, section_address:DWORD, section_size:DWORD
+
+	pushad
+	mov ebx,dword [section_address]
+	mov eax,[ebx]
+	add ebx,4
+	mov ecx,[section_size]
+	sub ecx,4
+	;checksum is in eax
+	;pointer to file in ebx
+	;size of file in ecx
+	sub edi,edi
+vs_calc_cs:
+	sub edx,edx
+	mov dl,byte [ebx]
+	add edi,edx
+	inc ebx
+	dec ecx
+	jnz vs_calc_cs
+	;calculated checksum is in edi
+	cmp edi,eax
+	jne vs_exit_error
+
+vs_exit_success:
+	popad
+	mov eax,1
+	ret
+
+vs_exit_error:
+	popad
+	sub eax,eax
+	ret
+
 endp
\ No newline at end of file
diff --git a/Src/Container/32/logfile_disable.asm b/Src/Container/32/logfile_disable.asm
old mode 100755
new mode 100644
index 277c91c..de2ead3
--- a/Src/Container/32/logfile_disable.asm
+++ b/Src/Container/32/logfile_disable.asm
@@ -1,25 +1,25 @@
-;writes a string and a newline to the logfile
-macro writeWithNewLine char_sequence, char_buffer, error_exit{
-    char_sequence char_buffer
-	mov eax,1
-}
-
-;write a string to the logfile
-macro writeLog apitable, content{
-	mov eax,1
-}
-
-;delete old log file and create a new one
-macro initLogFile apitable{
-	 mov eax,1
-}
-
-;write a newline into logfile
-macro writeNewLineToLog apitable{
-	mov eax,1
-}
-
-;write a register value into logile
-macro writeRegisterToLog apitable, value{
-	mov eax,1
+;writes a string and a newline to the logfile
+macro writeWithNewLine char_sequence, char_buffer, error_exit{
+    char_sequence char_buffer
+	mov eax,1
+}
+
+;write a string to the logfile
+macro writeLog apitable, content{
+	mov eax,1
+}
+
+;delete old log file and create a new one
+macro initLogFile apitable{
+	 mov eax,1
+}
+
+;write a newline into logfile
+macro writeNewLineToLog apitable{
+	mov eax,1
+}
+
+;write a register value into logile
+macro writeRegisterToLog apitable, value{
+	mov eax,1
 }
\ No newline at end of file
diff --git a/Src/Container/32/logfile_enable.asm b/Src/Container/32/logfile_enable.asm
old mode 100755
new mode 100644
index 993c16f..b2946f2
--- a/Src/Container/32/logfile_enable.asm
+++ b/Src/Container/32/logfile_enable.asm
@@ -1,251 +1,251 @@
-;-------------------------------------------
-;the content of this file is excluded,      |
-;when the user disables logging features    |
-;in hyperion command line. pls keep in mind |
-;and dont rely on its existence.            |
-;-------------------------------------------  
-
-;--- Begin Macro Section ---
-
-;writes a string and a newline to the logfile
-macro writeWithNewLine char_sequence, char_buffer, error_exit
-{
-	char_sequence char_buffer
-	lea eax,[str1]
-	stdcall writeLog_,[APITable],eax
-	test eax,eax
-	jz error_exit
-	stdcall writeNewLineToLog_,[APITable]
-	test eax,eax
-	jz error_exit
-}
-
-;write a string to the logfile
-macro writeLog apitable, content{
-	stdcall writeLog_,[apitable], content
-}
-
-;delete old log file and create a new one
-macro initLogFile apitable{
-	 stdcall initLogFile_, [apitable]
-}
-
-;write a newline into logfile
-macro writeNewLineToLog apitable{
-	stdcall writeNewLineToLog_, [apitable]
-}
-
-;write a register value into logile
-macro writeRegisterToLog apitable, value{
-	stdcall writeRegisterToLog_, [apitable], value
-}
-
-;--- End Macro Section ---
-
-;write <content> into log.txt
-;returns false if an eerror occurs
-proc writeLog_ stdcall APITable:DWORD, content:DWORD
-
-local str1[256]:BYTE, oldlogsize:DWORD, newlogsize:DWORD, contentsize:DWORD,\
-      filehandle:DWORD, filemappingobject:DWORD, mapaddress:DWORD, retval:DWORD
-
-	 pushad
-	 ;open file
-	 createStringLogTxt str1
-	 mov eax,[APITable]
-	 lea ebx,[str1]
-	 sub edx,edx
-	 stdcall dword [eax+CreateFile], ebx, GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ, edx, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, edx
-	 mov [retval],eax
-	 test eax,eax
-	 jz wl_logexit
-	 mov [filehandle],eax
-
-	 ;get logfile size
-	 mov eax,[APITable]
-	 stdcall dword [eax+GetFileSize], dword [filehandle], 0
-	 mov [oldlogsize],eax
-
-	 ;get size of string for logfile for concatenation
-	 stdcall strlen_, dword [content]
-	 mov [contentsize], eax
-	 add eax,dword [oldlogsize]
-	 mov [newlogsize], eax
-
-	 ;create the file mapping
-	 sub ebx,ebx
-	 mov edx,[APITable]
-	 stdcall dword [edx+CreateFileMapping], dword [filehandle], ebx, PAGE_READWRITE, ebx, eax, ebx
-	 mov [retval],eax
-	 test eax, eax
-	 jz wl_closelogfile
-	 mov [filemappingobject],eax
-
-	 sub ebx,ebx
-	 mov edx,[APITable]
-	 stdcall dword [edx+MapViewOfFile], eax, FILE_MAP_ALL_ACCESS, ebx, ebx, dword [newlogsize]
-	 mov [retval],eax
-	 test eax, eax
-	 jz wl_closemaphandle
-	 mov [mapaddress],eax
-
-	 ;copy string into map
-	 add eax,[oldlogsize]
-	 mov edi,eax
-	 mov esi,[content]
-	 mov ecx,[contentsize]
-	 repz movsb
-	 mov [retval],1
-
-wl_unmapfile:
-	 mov edx,[APITable]
-	 stdcall dword [edx+UnmapViewOfFile], dword [mapaddress]
-
-wl_closemaphandle:
-	 mov edx,[APITable]
-	 stdcall dword [edx+CloseHandle], dword [filemappingobject]
-
-wl_closelogfile:
-	 mov eax,[APITable]
-	 stdcall dword [eax+CloseHandle], dword [filehandle]
-
-wl_logexit:
-	 popad
-	 mov eax,[retval]
-	 ret;
-
-endp
-
-;adds a <newline> to the logfile
-;returns false if an error occurs
-proc writeNewLineToLog_ APITable:DWORD
-
-local str1[3]:BYTE
-
-	 lea eax,[str1]
-	 mov byte [eax+0],13
-	 mov byte [eax+1],10
-	 mov byte [eax+2],0
-	 stdcall writeLog_, [APITable], eax
-	 ret
-
-endp
-
-;adds "<hexadecimal value>" to the logfile
-;returns false if an error occurs
-proc writeRegisterToLog_ stdcall APITable:DWORD, Value:DWORD
-
-local str1[10]:BYTE, retval:DWORD
-
-	 pushad
-	 lea eax,[str1]
-	 stdcall binToString_, eax, [Value]
-	 stdcall writeLog_,[APITable],eax
-	 mov [retval],eax
-	 test eax,eax
-	 jz wrtl_exit
-	 stdcall writeNewLineToLog_,[APITable]
-	 mov [retval],eax
-	 test eax,eax
-	 jz wrtl_exit
-
-wrtl_exit:
-	 popad
-	 mov eax,[retval]
-	 ret
-
-endp
-
-;converts <bin> into an 8 byte string and stores it <buffer>
-proc binToString_ stdcall buffer:DWORD, bin:DWORD
-
-	 pushad
-	 mov ebx,[bin]
-	 mov ecx,8
-
-bts_next_byte:
-	 mov eax,ebx
-	 and eax,0000000fh
-	 cmp eax,9
-	 jg bts_add_55
-bts_add_48:
-	 add eax,48
-	 jmp bts_store_bin
-bts_add_55:
-	 add eax,55
-bts_store_bin:
-	 dec ecx
-	 mov edx,[buffer]
-	 mov byte [ecx+edx],al
-	 test ecx,ecx
-	 jz bts_finished_conversion
-	 shr ebx,4
-	 jmp bts_next_byte
-
-bts_finished_conversion:
-	 mov eax,[buffer]
-	 mov byte [eax+8],0
-	 popad
-	 ret
-endp
-
-;get the length of a string
-proc strlen_ stdcall string_ptr:DWORD
-
-	 push edi
-	 push ecx
-	 mov edi,[string_ptr]
-	 sub ecx, ecx
-	 sub al, al
-	 not ecx
-	 cld
-	 repne scasb
-	 not ecx
-	 dec ecx
-	 mov eax,ecx
-	 pop ecx
-	 pop edi
-	 ret
-
-endp
-
-;Write initial message into logfile
-proc initLogFile_ stdcall APITable:DWORD
-
-local str1[256]:BYTE
-
-	pushad
-	createStringLogTxt str1
-	mov eax,[APITable]
-	lea ebx,[str1]
-	stdcall dword [eax+DeleteFile],ebx
-	createStringStartingHyperionLines str1
-	lea eax,[str1]
-	stdcall writeLog_,[APITable],eax
-	test eax,eax
-	jz ilf_exit_error
-	createStringStartingHyperion str1
-	lea eax,[str1]
-	stdcall writeLog_,[APITable],eax
-	test eax,eax
-	jz ilf_exit_error
-	createStringStartingHyperionLines str1
-	lea eax,[str1]
-	stdcall writeLog_,[APITable],eax
-	test eax,eax
-	jz ilf_exit_error
-	stdcall writeNewLineToLog_,[APITable]
-	test eax,eax
-	jz ilf_exit_error
-
-ilf_exit_success:
-	popad
-	mov eax,1
-	ret
-
-ilf_exit_error:
-	popad
-	sub eax,eax
-	ret
-
+;-------------------------------------------
+;the content of this file is excluded,      |
+;when the user disables logging features    |
+;in hyperion command line. pls keep in mind |
+;and dont rely on its existence.            |
+;-------------------------------------------  
+
+;--- Begin Macro Section ---
+
+;writes a string and a newline to the logfile
+macro writeWithNewLine char_sequence, char_buffer, error_exit
+{
+	char_sequence char_buffer
+	lea eax,[str1]
+	stdcall writeLog_,[APITable],eax
+	test eax,eax
+	jz error_exit
+	stdcall writeNewLineToLog_,[APITable]
+	test eax,eax
+	jz error_exit
+}
+
+;write a string to the logfile
+macro writeLog apitable, content{
+	stdcall writeLog_,[apitable], content
+}
+
+;delete old log file and create a new one
+macro initLogFile apitable{
+	 stdcall initLogFile_, [apitable]
+}
+
+;write a newline into logfile
+macro writeNewLineToLog apitable{
+	stdcall writeNewLineToLog_, [apitable]
+}
+
+;write a register value into logile
+macro writeRegisterToLog apitable, value{
+	stdcall writeRegisterToLog_, [apitable], value
+}
+
+;--- End Macro Section ---
+
+;write <content> into log.txt
+;returns false if an eerror occurs
+proc writeLog_ stdcall APITable:DWORD, content:DWORD
+
+local str1[256]:BYTE, oldlogsize:DWORD, newlogsize:DWORD, contentsize:DWORD,\
+      filehandle:DWORD, filemappingobject:DWORD, mapaddress:DWORD, retval:DWORD
+
+	 pushad
+	 ;open file
+	 createStringLogTxt str1
+	 mov eax,[APITable]
+	 lea ebx,[str1]
+	 sub edx,edx
+	 stdcall dword [eax+CreateFile], ebx, GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ, edx, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, edx
+	 mov [retval],eax
+	 test eax,eax
+	 jz wl_logexit
+	 mov [filehandle],eax
+
+	 ;get logfile size
+	 mov eax,[APITable]
+	 stdcall dword [eax+GetFileSize], dword [filehandle], 0
+	 mov [oldlogsize],eax
+
+	 ;get size of string for logfile for concatenation
+	 stdcall strlen_, dword [content]
+	 mov [contentsize], eax
+	 add eax,dword [oldlogsize]
+	 mov [newlogsize], eax
+
+	 ;create the file mapping
+	 sub ebx,ebx
+	 mov edx,[APITable]
+	 stdcall dword [edx+CreateFileMapping], dword [filehandle], ebx, PAGE_READWRITE, ebx, eax, ebx
+	 mov [retval],eax
+	 test eax, eax
+	 jz wl_closelogfile
+	 mov [filemappingobject],eax
+
+	 sub ebx,ebx
+	 mov edx,[APITable]
+	 stdcall dword [edx+MapViewOfFile], eax, FILE_MAP_ALL_ACCESS, ebx, ebx, dword [newlogsize]
+	 mov [retval],eax
+	 test eax, eax
+	 jz wl_closemaphandle
+	 mov [mapaddress],eax
+
+	 ;copy string into map
+	 add eax,[oldlogsize]
+	 mov edi,eax
+	 mov esi,[content]
+	 mov ecx,[contentsize]
+	 repz movsb
+	 mov [retval],1
+
+wl_unmapfile:
+	 mov edx,[APITable]
+	 stdcall dword [edx+UnmapViewOfFile], dword [mapaddress]
+
+wl_closemaphandle:
+	 mov edx,[APITable]
+	 stdcall dword [edx+CloseHandle], dword [filemappingobject]
+
+wl_closelogfile:
+	 mov eax,[APITable]
+	 stdcall dword [eax+CloseHandle], dword [filehandle]
+
+wl_logexit:
+	 popad
+	 mov eax,[retval]
+	 ret;
+
+endp
+
+;adds a <newline> to the logfile
+;returns false if an error occurs
+proc writeNewLineToLog_ APITable:DWORD
+
+local str1[3]:BYTE
+
+	 lea eax,[str1]
+	 mov byte [eax+0],13
+	 mov byte [eax+1],10
+	 mov byte [eax+2],0
+	 stdcall writeLog_, [APITable], eax
+	 ret
+
+endp
+
+;adds "<hexadecimal value>" to the logfile
+;returns false if an error occurs
+proc writeRegisterToLog_ stdcall APITable:DWORD, Value:DWORD
+
+local str1[10]:BYTE, retval:DWORD
+
+	 pushad
+	 lea eax,[str1]
+	 stdcall binToString_, eax, [Value]
+	 stdcall writeLog_,[APITable],eax
+	 mov [retval],eax
+	 test eax,eax
+	 jz wrtl_exit
+	 stdcall writeNewLineToLog_,[APITable]
+	 mov [retval],eax
+	 test eax,eax
+	 jz wrtl_exit
+
+wrtl_exit:
+	 popad
+	 mov eax,[retval]
+	 ret
+
+endp
+
+;converts <bin> into an 8 byte string and stores it <buffer>
+proc binToString_ stdcall buffer:DWORD, bin:DWORD
+
+	 pushad
+	 mov ebx,[bin]
+	 mov ecx,8
+
+bts_next_byte:
+	 mov eax,ebx
+	 and eax,0000000fh
+	 cmp eax,9
+	 jg bts_add_55
+bts_add_48:
+	 add eax,48
+	 jmp bts_store_bin
+bts_add_55:
+	 add eax,55
+bts_store_bin:
+	 dec ecx
+	 mov edx,[buffer]
+	 mov byte [ecx+edx],al
+	 test ecx,ecx
+	 jz bts_finished_conversion
+	 shr ebx,4
+	 jmp bts_next_byte
+
+bts_finished_conversion:
+	 mov eax,[buffer]
+	 mov byte [eax+8],0
+	 popad
+	 ret
+endp
+
+;get the length of a string
+proc strlen_ stdcall string_ptr:DWORD
+
+	 push edi
+	 push ecx
+	 mov edi,[string_ptr]
+	 sub ecx, ecx
+	 sub al, al
+	 not ecx
+	 cld
+	 repne scasb
+	 not ecx
+	 dec ecx
+	 mov eax,ecx
+	 pop ecx
+	 pop edi
+	 ret
+
+endp
+
+;Write initial message into logfile
+proc initLogFile_ stdcall APITable:DWORD
+
+local str1[256]:BYTE
+
+	pushad
+	createStringLogTxt str1
+	mov eax,[APITable]
+	lea ebx,[str1]
+	stdcall dword [eax+DeleteFile],ebx
+	createStringStartingHyperionLines str1
+	lea eax,[str1]
+	stdcall writeLog_,[APITable],eax
+	test eax,eax
+	jz ilf_exit_error
+	createStringStartingHyperion str1
+	lea eax,[str1]
+	stdcall writeLog_,[APITable],eax
+	test eax,eax
+	jz ilf_exit_error
+	createStringStartingHyperionLines str1
+	lea eax,[str1]
+	stdcall writeLog_,[APITable],eax
+	test eax,eax
+	jz ilf_exit_error
+	stdcall writeNewLineToLog_,[APITable]
+	test eax,eax
+	jz ilf_exit_error
+
+ilf_exit_success:
+	popad
+	mov eax,1
+	ret
+
+ilf_exit_error:
+	popad
+	sub eax,eax
+	ret
+
 endp
\ No newline at end of file
diff --git a/Src/Container/32/main.asm b/Src/Container/32/main.asm
old mode 100755
new mode 100644
index db1a6b9..8f64bfc
--- a/Src/Container/32/main.asm
+++ b/Src/Container/32/main.asm
@@ -1,133 +1,133 @@
-; Hyperion 32-Bit container.exe
-
-include 'image_base.inc'
-format PE GUI 4.0 at IMAGE_BASE
-entry start
-
-include '..\..\..\Fasm\INCLUDE\win32a.inc'
-include 'hyperion.inc'
-include 'createstrings.inc'
-include 'pe.inc'
-;automatically generated by hyperion cpp stub
-include 'key_size.inc'
-include 'infile_size.inc'
-include 'image_size.inc'
-;---
-
-;this contains the decrypted and loaded executable
-section '.bss' data readable writeable
-
-decrypted_infile: db IMAGE_SIZE dup (?)
-
-;--------------------------------------------------
-
-;this contains the encrypted exe
-section '.data' data readable writeable
-
-encrypted_infile: include 'infile_array.inc'
-
-;--------------------------------------------------
-
-section '.text' code readable executable
-
-;include necessary functions
-include 'logfile_select.asm'
-include 'loadapis.asm'
-include 'loadexecutable.asm'
-;automatically generated by hyperion cpp stub
-include 'decryption_payload.asm'
-;---
-
-start:	 stdcall MainMethod
-	 invoke ExitProcess,0
-
-proc MainMethod stdcall
-	 local str1[256]:BYTE,\
-	 APITable:DWORD,\
-	 CreateFileMapping_:DWORD,\
-	 MapViewOfFile_:DWORD,\
-	 UnmapViewOfFile_:DWORD,\
-	 CreateFile_:DWORD,\
-	 CloseHandle_:DWORD,\
-	 DeleteFile_:DWORD,\
-	 GetModuleHandle_:DWORD,\
-	 VirtualAlloc_:DWORD,\
-	 VirtualProtect_:DWORD,\
-	 VirtualFree_:DWORD
-
-	 ;pointer to the API table
-	 lea eax,[CreateFileMapping_]
-	 mov [APITable],eax
-
-	 ;load APIs for log file access
-	 stdcall loadLogAPIs,[APITable]
-	 test eax,eax
-	 jz main_exiterrornolog
-
-	 ;create logfile and write initial message into it
-	 initLogFile APITable 
-	 test eax,eax
-	 jz main_exiterrornolog
-
-	 ;load all necessary APIs
-	 stdcall loadRegularAPIs, [APITable]
-	 test eax,eax
-	 jz main_exiterror
-	 writeNewLineToLog APITable
-	 test eax,eax
-	 jz main_exiterror
-
-	 ;decrypt exe in data section
-	 stdcall decryptExecutable, [APITable], encrypted_infile
-	 test eax,eax
-	 jz main_exiterror
-
-	 ;load the executable at its image base
-	 ;(this will overwrite current MZ header and bss section)
-	 stdcall loadExecutable, [APITable], encrypted_infile
-	 test eax,eax
-	 jz main_exiterror
-
-	 ;start program execution
-	 mov edx,IMAGE_BASE
-	 mov eax,[edx+IMAGE_DOS_HEADER.e_lfanew]
-	 add eax,edx
-	 add eax,4
-	 ;image file header now in eax
-	 add eax,sizeof.IMAGE_FILE_HEADER
-	 mov eax,[eax+IMAGE_OPTIONAL_HEADER32.AddressOfEntryPoint]
-	 add eax,IMAGE_BASE
-	 ;entry point of original exe is now in eax
-	 jmp eax
-
-;finished without errors
-main_exitsuccess:
-	 writeNewLineToLog APITable
-	 createStringDone str1
-	 lea eax,[str1]
-	 writeLog APITable, eax
-	 ret
-
-;finished with errors after logfile API loading
-main_exiterror:
-	 writeNewLineToLog APITable
-	 createStringError str1
-	 lea eax,[str1]
-	 writeLog APITable, eax
-	 ret
-
-;finished with errors before logfile API loading
-main_exiterrornolog:
-	 ret
-
-endp
-
-;import table
-section '.idata' import data readable writeable
-
-	 library kernel,'KERNEL32.DLL'
-
-	 import kernel,\
-	    GetProcAddress,'GetProcAddress',\
-	    LoadLibrary,'LoadLibraryA',\
-	    ExitProcess,'ExitProcess'
+; Hyperion 32-Bit container.exe
+
+include 'image_base.inc'
+include 'main_prolog.inc' ;format PE ...
+entry start
+
+include '..\..\..\Fasm\INCLUDE\win32a.inc'
+include 'hyperion.inc'
+include 'createstrings.inc'
+include 'pe.inc'
+;automatically generated by hyperion cpp stub
+include 'key_size.inc'
+include 'infile_size.inc'
+include 'image_size.inc'
+;---
+
+;this contains the decrypted and loaded executable
+section '.bss' data readable writeable
+
+decrypted_infile: db IMAGE_SIZE dup (?)
+
+;--------------------------------------------------
+
+;this contains the encrypted exe
+section '.data' data readable writeable
+
+encrypted_infile: include 'infile_array.inc'
+
+;--------------------------------------------------
+
+section '.text' code readable executable
+
+;include necessary functions
+include 'logfile_select.asm'
+include 'loadapis.asm'
+include 'loadexecutable.asm'
+;automatically generated by hyperion cpp stub
+include 'decryption_payload.asm'
+;---
+
+start:	 stdcall MainMethod
+	 invoke ExitProcess,0
+
+proc MainMethod stdcall
+	 local str1[256]:BYTE,\
+	 APITable:DWORD,\
+	 CreateFileMapping_:DWORD,\
+	 MapViewOfFile_:DWORD,\
+	 UnmapViewOfFile_:DWORD,\
+	 CreateFile_:DWORD,\
+	 CloseHandle_:DWORD,\
+	 DeleteFile_:DWORD,\
+	 GetModuleHandle_:DWORD,\
+	 VirtualAlloc_:DWORD,\
+	 VirtualProtect_:DWORD,\
+	 VirtualFree_:DWORD
+
+	 ;pointer to the API table
+	 lea eax,[CreateFileMapping_]
+	 mov [APITable],eax
+
+	 ;load APIs for log file access
+	 stdcall loadLogAPIs,[APITable]
+	 test eax,eax
+	 jz main_exiterrornolog
+
+	 ;create logfile and write initial message into it
+	 initLogFile APITable 
+	 test eax,eax
+	 jz main_exiterrornolog
+
+	 ;load all necessary APIs
+	 stdcall loadRegularAPIs, [APITable]
+	 test eax,eax
+	 jz main_exiterror
+	 writeNewLineToLog APITable
+	 test eax,eax
+	 jz main_exiterror
+
+	 ;decrypt exe in data section
+	 stdcall decryptExecutable, [APITable], encrypted_infile
+	 test eax,eax
+	 jz main_exiterror
+
+	 ;load the executable at its image base
+	 ;(this will overwrite current MZ header and bss section)
+	 stdcall loadExecutable, [APITable], encrypted_infile
+	 test eax,eax
+	 jz main_exiterror
+
+	 ;start program execution
+	 mov edx,IMAGE_BASE
+	 mov eax,[edx+IMAGE_DOS_HEADER.e_lfanew]
+	 add eax,edx
+	 add eax,4
+	 ;image file header now in eax
+	 add eax,sizeof.IMAGE_FILE_HEADER
+	 mov eax,[eax+IMAGE_OPTIONAL_HEADER32.AddressOfEntryPoint]
+	 add eax,IMAGE_BASE
+	 ;entry point of original exe is now in eax
+	 jmp eax
+
+;finished without errors
+main_exitsuccess:
+	 writeNewLineToLog APITable
+	 createStringDone str1
+	 lea eax,[str1]
+	 writeLog APITable, eax
+	 ret
+
+;finished with errors after logfile API loading
+main_exiterror:
+	 writeNewLineToLog APITable
+	 createStringError str1
+	 lea eax,[str1]
+	 writeLog APITable, eax
+	 ret
+
+;finished with errors before logfile API loading
+main_exiterrornolog:
+	 ret
+
+endp
+
+;import table
+section '.idata' import data readable writeable
+
+	 library kernel,'KERNEL32.DLL'
+
+	 import kernel,\
+	    GetProcAddress,'GetProcAddress',\
+	    LoadLibrary,'LoadLibraryA',\
+	    ExitProcess,'ExitProcess'
diff --git a/Src/Container/32/pe.inc b/Src/Container/32/pe.inc
old mode 100755
new mode 100644
diff --git a/Src/Container/64/createstrings.inc b/Src/Container/64/createstrings.inc
deleted file mode 100755
index 289ef4c..0000000
--- a/Src/Container/64/createstrings.inc
+++ /dev/null
@@ -1,560 +0,0 @@
-macro createStringBruteforcing location
-{
-	 mov [location+0],'B'
-	 mov [location+1],'r'
-	 mov [location+2],'u'
-	 mov [location+3],'t'
-	 mov [location+4],'e'
-	 mov [location+5],'f'
-	 mov [location+6],'o'
-	 mov [location+7],'r'
-	 mov [location+8],'c'
-	 mov [location+9],'i'
-	 mov [location+10],'n'
-	 mov [location+11],'g'
-	 mov [location+12],' '
-	 mov [location+13],'K'
-	 mov [location+14],'e'
-	 mov [location+15],'y'
-	 mov [location+16],0
-}
-
-macro createStringSettingPermissions location
-{
-	 mov [location+0],'S'
-	 mov [location+1],'e'
-	 mov [location+2],'t'
-	 mov [location+3],'t'
-	 mov [location+4],'i'
-	 mov [location+5],'n'
-	 mov [location+6],'g'
-	 mov [location+7],' '
-	 mov [location+8],'S'
-	 mov [location+9],'e'
-	 mov [location+10],'c'
-	 mov [location+11],'t'
-	 mov [location+12],'i'
-	 mov [location+13],'o'
-	 mov [location+14],'n'
-	 mov [location+15],' '
-	 mov [location+16],'P'
-	 mov [location+17],'e'
-	 mov [location+18],'r'
-	 mov [location+19],'m'
-	 mov [location+20],'i'
-	 mov [location+21],'s'
-	 mov [location+22],'s'
-	 mov [location+23],'i'
-	 mov [location+24],'o'
-	 mov [location+25],'n'
-	 mov [location+26],'s'
-	 mov [location+27],0
-}
-
-macro createStringOrdinal location
-{
-	 mov [location+0],'O'
-	 mov [location+1],'r'
-	 mov [location+2],'d'
-	 mov [location+3],'i'
-	 mov [location+4],'n'
-	 mov [location+5],'a'
-	 mov [location+6],'l'
-	 mov [location+7],':'
-	 mov [location+8],' '
-	 mov [location+9],0
-}
-
-macro createStringName location
-{
-	 mov [location+0],'N'
-	 mov [location+1],'a'
-	 mov [location+2],'m'
-	 mov [location+3],'e'
-	 mov [location+4],':'
-	 mov [location+5],' '
-	 mov [location+6],0
-}
-
-macro createStringProcessImportDirectory location
-{
-	 mov [location+0],'P'
-	 mov [location+1],'r'
-	 mov [location+2],'o'
-	 mov [location+3],'c'
-	 mov [location+4],'e'
-	 mov [location+5],'s'
-	 mov [location+6],'s'
-	 mov [location+7],'i'
-	 mov [location+8],'n'
-	 mov [location+9],'g'
-	 mov [location+10],' '
-	 mov [location+11],'I'
-	 mov [location+12],'m'
-	 mov [location+13],'p'
-	 mov [location+14],'o'
-	 mov [location+15],'r'
-	 mov [location+16],'t'
-	 mov [location+17],' '
-	 mov [location+18],'D'
-	 mov [location+19],'i'
-	 mov [location+20],'r'
-	 mov [location+21],'e'
-	 mov [location+22],'c'
-	 mov [location+23],'t'
-	 mov [location+24],'o'
-	 mov [location+25],'r'
-	 mov [location+26],'y'
-	 mov [location+27],':'
-	 mov [location+28],0
-}
-
-macro createStringFoundImportTable location
-{
-	 mov [location+0],'I'
-	 mov [location+1],'m'
-	 mov [location+2],'p'
-	 mov [location+3],'o'
-	 mov [location+4],'r'
-	 mov [location+5],'t'
-	 mov [location+6],' '
-	 mov [location+7],'T'
-	 mov [location+8],'a'
-	 mov [location+9],'b'
-	 mov [location+10],'l'
-	 mov [location+11],'e'
-	 mov [location+12],':'
-	 mov [location+13],0
-}
-
-macro createStringLoadingFilesAPIs location
-{
-	 mov [location+0],'L'
-	 mov [location+1],'o'
-	 mov [location+2],'a'
-	 mov [location+3],'d'
-	 mov [location+4],'i'
-	 mov [location+5],'n'
-	 mov [location+6],'g'
-	 mov [location+7],' '
-	 mov [location+8],'A'
-	 mov [location+9],'P'
-	 mov [location+10],'I'
-	 mov [location+11],'s'
-	 mov [location+12],0
-}
-
-macro createStringMappingFileInMemory location
-{
-	 mov [location+0],'M'
-	 mov [location+1],'a'
-	 mov [location+2],'p'
-	 mov [location+3],'p'
-	 mov [location+4],'i'
-	 mov [location+5],'n'
-	 mov [location+6],'g'
-	 mov [location+7],' '
-	 mov [location+8],'F'
-	 mov [location+9],'i'
-	 mov [location+10],'l'
-	 mov [location+11],'e'
-	 mov [location+12],' '
-	 mov [location+13],'i'
-	 mov [location+14],'n'
-	 mov [location+15],'t'
-	 mov [location+16],'o'
-	 mov [location+17],' '
-	 mov [location+18],'M'
-	 mov [location+19],'e'
-	 mov [location+20],'m'
-	 mov [location+21],'o'
-	 mov [location+22],'r'
-	 mov [location+23],'y'
-	 mov [location+24],0
-}
-
-macro createStringLoaded location
-{
-	 mov [location+0],'L'
-	 mov [location+1],'o'
-	 mov [location+2],'a'
-	 mov [location+3],'d'
-	 mov [location+4],'e'
-	 mov [location+5],'d'
-	 mov [location+6],' '
-	 mov [location+7],0
-}
-
-macro createStringLoadedPEHeader location
-{
-	 mov [location+0],'S'
-	 mov [location+1],'e'
-	 mov [location+2],'t'
-	 mov [location+3],' '
-	 mov [location+4],'I'
-	 mov [location+5],'m'
-	 mov [location+6],'a'
-	 mov [location+7],'g'
-	 mov [location+8],'e'
-	 mov [location+9],' '
-	 mov [location+10],'w'
-	 mov [location+11],'r'
-	 mov [location+12],'i'
-	 mov [location+13],'t'
-	 mov [location+14],'a'
-	 mov [location+15],'b'
-	 mov [location+16],'l'
-	 mov [location+17],'e'
-	 mov [location+18],':'
-	 mov [location+19],0
-}
-
-macro createStringVerifyPE location
-{
-	 mov [location+0],'V'
-	 mov [location+1],'e'
-	 mov [location+2],'r'
-	 mov [location+3],'i'
-	 mov [location+4],'f'
-	 mov [location+5],'y'
-	 mov [location+6],'i'
-	 mov [location+7],'n'
-	 mov [location+8],'g'
-	 mov [location+9],' '
-	 mov [location+10],'P'
-	 mov [location+11],'E'
-	 mov [location+12],0
-}
-
-macro createStringVerifyChecksum location
-{
-	 mov [location+0],'V'
-	 mov [location+1],'e'
-	 mov [location+2],'r'
-	 mov [location+3],'i'
-	 mov [location+4],'f'
-	 mov [location+5],'y'
-	 mov [location+6],'i'
-	 mov [location+7],'n'
-	 mov [location+8],'g'
-	 mov [location+9],' '
-	 mov [location+10],'C'
-	 mov [location+11],'h'
-	 mov [location+12],'e'
-	 mov [location+13],'c'
-	 mov [location+14],'k'
-	 mov [location+15],'s'
-	 mov [location+16],'u'
-	 mov [location+17],'m'
-	 mov [location+18],0
-}
-
-macro createStringDone location
-{
-	 mov [location+0],'D'
-	 mov [location+1],'o'
-	 mov [location+2],'n'
-	 mov [location+3],'e'
-	 mov [location+4],0
-}
-
-macro createStringLoading location
-{
-	 mov [location+0],'L'
-	 mov [location+1],'o'
-	 mov [location+2],'a'
-	 mov [location+3],'d'
-	 mov [location+4],'i'
-	 mov [location+5],'n'
-	 mov [location+6],'g'
-	 mov [location+7],' '
-	 mov [location+8],'A'
-	 mov [location+9],'P'
-	 mov [location+10],'I'
-	 mov [location+11],'s'
-	 mov [location+12],':'
-	 mov [location+13],0
-}
-
-macro createStringError location
-{
-	 mov [location+0],'E'
-	 mov [location+1],'r'
-	 mov [location+2],'r'
-	 mov [location+3],'o'
-	 mov [location+4],'r'
-	 mov [location+5],0
-}
-
-macro createStringStartingHyperion location
-{
-	 mov [location+00],'H'
-	 mov [location+01],'y'
-	 mov [location+02],'p'
-	 mov [location+03],'e'
-	 mov [location+04],'r'
-	 mov [location+05],'i'
-	 mov [location+06],'o'
-	 mov [location+07],'n'
-	 mov [location+08],' '
-	 mov [location+09],'L'
-	 mov [location+10],'o'
-	 mov [location+11],'g'
-	 mov [location+12],'f'
-	 mov [location+13],'i'
-	 mov [location+14],'l'
-	 mov [location+15],'e'
-	 mov [location+16],13
-	 mov [location+17],10
-	 mov [location+18],0
-}
-
-macro createStringStartingHyperionLines location
-{
-	 mov [location+00],'-'
-	 mov [location+01],'-'
-	 mov [location+02],'-'
-	 mov [location+03],'-'
-	 mov [location+04],'-'
-	 mov [location+05],'-'
-	 mov [location+06],'-'
-	 mov [location+07],'-'
-	 mov [location+08],'-'
-	 mov [location+09],'-'
-	 mov [location+10],'-'
-	 mov [location+11],'-'
-	 mov [location+12],'-'
-	 mov [location+13],'-'
-	 mov [location+14],'-'
-	 mov [location+15],'-'
-	 mov [location+16],13
-	 mov [location+17],10
-	 mov [location+18],0
-}
-
-macro createStringLogTxt location
-{
-	 mov [location+0],'l'
-	 mov [location+1],'o'
-	 mov [location+2],'g'
-	 mov [location+3],'.'
-	 mov [location+4],'t'
-	 mov [location+5],'x'
-	 mov [location+6],'t'
-	 mov [location+7],0
-}
-
-macro createStringKernel32 location
-{
-	 mov [location+00],'k'
-	 mov [location+01],'e'
-	 mov [location+02],'r'
-	 mov [location+03],'n'
-	 mov [location+04],'e'
-	 mov [location+05],'l'
-	 mov [location+06],'3'
-	 mov [location+07],'2'
-	 mov [location+08],'.'
-	 mov [location+09],'d'
-	 mov [location+10],'l'
-	 mov [location+11],'l'
-	 mov [location+12],0
-}
-
-macro  createStringCreateFileMapping location
-{
-	 mov [location+00],'C'
-	 mov [location+01],'r'
-	 mov [location+02],'e'
-	 mov [location+03],'a'
-	 mov [location+04],'t'
-	 mov [location+05],'e'
-	 mov [location+06],'F'
-	 mov [location+07],'i'
-	 mov [location+08],'l'
-	 mov [location+09],'e'
-	 mov [location+10],'M'
-	 mov [location+11],'a'
-	 mov [location+12],'p'
-	 mov [location+13],'p'
-	 mov [location+14],'i'
-	 mov [location+15],'n'
-	 mov [location+16],'g'
-	 mov [location+17],'A'
-	 mov [location+18],0
-}
-
-macro createStringMapViewOfFile location
-{
-	 mov [location+00],'M'
-	 mov [location+01],'a'
-	 mov [location+02],'p'
-	 mov [location+03],'V'
-	 mov [location+04],'i'
-	 mov [location+05],'e'
-	 mov [location+06],'w'
-	 mov [location+07],'O'
-	 mov [location+08],'f'
-	 mov [location+09],'F'
-	 mov [location+10],'i'
-	 mov [location+11],'l'
-	 mov [location+12],'e'
-	 mov [location+13],0
-}
-
-macro createStringUnmapViewOfFile location
-{
-	 mov [location+00],'U'
-	 mov [location+01],'n'
-	 mov [location+02],'m'
-	 mov [location+03],'a'
-	 mov [location+04],'p'
-	 mov [location+05],'V'
-	 mov [location+06],'i'
-	 mov [location+07],'e'
-	 mov [location+08],'w'
-	 mov [location+09],'O'
-	 mov [location+10],'f'
-	 mov [location+11],'F'
-	 mov [location+12],'i'
-	 mov [location+13],'l'
-	 mov [location+14],'e'
-	 mov [location+15],0
-}
-
-macro createStringCreateFile location
-{
-	 mov [location+00],'C'
-	 mov [location+01],'r'
-	 mov [location+02],'e'
-	 mov [location+03],'a'
-	 mov [location+04],'t'
-	 mov [location+05],'e'
-	 mov [location+06],'F'
-	 mov [location+07],'i'
-	 mov [location+08],'l'
-	 mov [location+09],'e'
-	 mov [location+10],'A'
-	 mov [location+11],0
-}
-
-macro createStringCloseHandle location
-{
-	 mov [location+00],'C'
-	 mov [location+01],'l'
-	 mov [location+02],'o'
-	 mov [location+03],'s'
-	 mov [location+04],'e'
-	 mov [location+05],'H'
-	 mov [location+06],'a'
-	 mov [location+07],'n'
-	 mov [location+08],'d'
-	 mov [location+09],'l'
-	 mov [location+10],'e'
-	 mov [location+11],0
-}
-
-macro createStringGetFileSize location
-{
-	 mov [location+00],'G'
-	 mov [location+01],'e'
-	 mov [location+02],'t'
-	 mov [location+03],'F'
-	 mov [location+04],'i'
-	 mov [location+05],'l'
-	 mov [location+06],'e'
-	 mov [location+07],'S'
-	 mov [location+08],'i'
-	 mov [location+09],'z'
-	 mov [location+10],'e'
-	 mov [location+11],0
-}
-
-macro createStringDeleteFile location
-{
-	 mov [location+00],'D'
-	 mov [location+01],'e'
-	 mov [location+02],'l'
-	 mov [location+03],'e'
-	 mov [location+04],'t'
-	 mov [location+05],'e'
-	 mov [location+06],'F'
-	 mov [location+07],'i'
-	 mov [location+08],'l'
-	 mov [location+09],'e'
-	 mov [location+10],'A'
-	 mov [location+11],0
-}
-
-macro createStringGetModuleHandle location
-{
-	 mov [location+00],'G'
-	 mov [location+01],'e'
-	 mov [location+02],'t'
-	 mov [location+03],'M'
-	 mov [location+04],'o'
-	 mov [location+05],'d'
-	 mov [location+06],'u'
-	 mov [location+07],'l'
-	 mov [location+08],'e'
-	 mov [location+09],'H'
-	 mov [location+10],'a'
-	 mov [location+11],'n'
-	 mov [location+12],'d'
-	 mov [location+13],'l'
-	 mov [location+14],'e'
-	 mov [location+15],'A'
-	 mov [location+16],0
-}
-
-macro createStringVirtualAlloc location
-{
-	 mov [location+00],'V'
-	 mov [location+01],'i'
-	 mov [location+02],'r'
-	 mov [location+03],'t'
-	 mov [location+04],'u'
-	 mov [location+05],'a'
-	 mov [location+06],'l'
-	 mov [location+07],'A'
-	 mov [location+08],'l'
-	 mov [location+09],'l'
-	 mov [location+10],'o'
-	 mov [location+11],'c'
-	 mov [location+12],0
-}
-
-macro createStringVirtualProtect location
-{
-	 mov [location+00],'V'
-	 mov [location+01],'i'
-	 mov [location+02],'r'
-	 mov [location+03],'t'
-	 mov [location+04],'u'
-	 mov [location+05],'a'
-	 mov [location+06],'l'
-	 mov [location+07],'P'
-	 mov [location+08],'r'
-	 mov [location+09],'o'
-	 mov [location+10],'t'
-	 mov [location+11],'e'
-	 mov [location+12],'c'
-	 mov [location+13],'t'
-	 mov [location+14],0
-}
-
-macro createStringVirtualFree location
-{
-	 mov [location+00],'V'
-	 mov [location+01],'i'
-	 mov [location+02],'r'
-	 mov [location+03],'t'
-	 mov [location+04],'u'
-	 mov [location+05],'a'
-	 mov [location+06],'l'
-	 mov [location+07],'F'
-	 mov [location+08],'r'
-	 mov [location+09],'e'
-	 mov [location+10],'e'
-	 mov [location+11],0
-}
diff --git a/Src/Container/64/hyperion.inc b/Src/Container/64/hyperion.inc
deleted file mode 100755
index 54758d8..0000000
--- a/Src/Container/64/hyperion.inc
+++ /dev/null
@@ -1,14 +0,0 @@
-CreateFileMapping	equ 0
-MapViewOfFile		equ CreateFileMapping + 8
-UnmapViewOfFile 	equ MapViewOfFile     + 8
-CreateFile		equ UnmapViewOfFile   + 8
-CloseHandle		equ CreateFile	      + 8
-GetFileSize		equ CloseHandle       + 8
-DeleteFile		equ GetFileSize       + 8
-GetModuleHandle 	equ DeleteFile	      + 8
-VirtualAlloc		equ GetModuleHandle   + 8
-VirtualProtect		equ VirtualAlloc      + 8
-VirtualFree		equ VirtualProtect    + 8
-
-SIZE_DATA_SECTION_NAME	equ 5
-SIZE_CHECKSUM		equ 4
diff --git a/Src/Container/64/loadapis.asm b/Src/Container/64/loadapis.asm
deleted file mode 100644
index 620038e..0000000
--- a/Src/Container/64/loadapis.asm
+++ /dev/null
@@ -1,131 +0,0 @@
-;Dynamically load the needed APIs
-;Strings are created on stack
-
-;dllname: zero terminated string with dll name
-;store: save the dll image base here
-;Jumps to LoadLogAPIsExit if an Error Occurs
-macro loadDLL dllname, store, exit
-{
-        lea rax,[dllname]
-        invoke LoadLibrary,rax
-        test rax,rax
-        jz exit
-        mov [store],rax
-}
-
-;functionname: zero terminated string with functions name
-;dll_imagebase: imagebase of the dll
-;returns: function pointer in eax
-macro loadAPI functionname, dll_imagebase, exit
-{
-        lea rax,[functionname]
-        invoke GetProcAddress,qword [dll_imagebase],rax
-        test rax,rax
-        jz exit
-}
-
-;Loads all necessary APISs
-proc loadRegularAPIs APITable:QWORD
-
-local str1[256]:BYTE, kernel32_imagebase:QWORD
-        mov [APITable],rcx
-        writeWithNewLine createStringLoading, str1, LoadRegularAPIsExit_Error
-
-        ;Get Kernel32.Dll Imagebase
-        writeWithNewLine createStringKernel32, str1, LoadRegularAPIsExit_Error
-        loadDLL str1, kernel32_imagebase, LoadRegularAPIsExit_Error
-
-        ;Load GetModuleHandle
-        writeWithNewLine createStringGetModuleHandle, str1, LoadRegularAPIsExit_Error
-        loadAPI str1, kernel32_imagebase, LoadRegularAPIsExit_Error
-        mov r10,[APITable]
-        mov [r10+GetModuleHandle],rax
-
-        ;Load VirtualAlloc
-        writeWithNewLine createStringVirtualAlloc, str1, LoadRegularAPIsExit_Error
-        loadAPI str1, kernel32_imagebase, LoadRegularAPIsExit_Error
-        mov r10,[APITable]
-        mov [r10+VirtualAlloc],rax
-
-        ;Load VirtualProtect
-        writeWithNewLine createStringVirtualProtect, str1, LoadRegularAPIsExit_Error
-        loadAPI str1, kernel32_imagebase, LoadRegularAPIsExit_Error
-        mov r10,[APITable]
-        mov [r10+VirtualProtect],rax
-
-        ;Load VirtualFree
-        writeWithNewLine createStringVirtualFree, str1, LoadRegularAPIsExit_Error
-        loadAPI str1, kernel32_imagebase, LoadRegularAPIsExit_Error
-        mov r10,[APITable]
-        mov [r10+VirtualFree],rax
-
-        mov rax,1
-        ret
-        
-LoadRegularAPIsExit_Error:
-        sub rax,rax
-        ret
-
-endp
-
-;Loads the basic functions for log file access
-proc loadLogAPIs APITable:QWORD
-
-local str1[256]:BYTE, kernel32_imagebase:QWORD
-        mov [APITable], rcx
-
-        ;Get Kernel32.Dll Imagebase
-        createStringKernel32 str1
-        loadDLL str1, kernel32_imagebase, LoadLogAPIsExit_Error
-
-        ;Load CreateFileMapping API
-        createStringCreateFileMapping str1
-        loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error
-        mov r10,[APITable]
-        mov [r10+CreateFileMapping],rax
-
-        ;Load MapViewOfFile API
-        createStringMapViewOfFile str1
-        loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error
-        mov r10,[APITable]
-        mov [r10+MapViewOfFile],rax
-
-        ;Load UnmapViewOfFile API
-        createStringUnmapViewOfFile str1
-        loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error
-        mov r10,[APITable]
-        mov [r10+UnmapViewOfFile],rax
-
-        ;Load UnmapViewOfFile API
-        createStringCreateFile str1
-        loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error
-        mov r10,[APITable]
-        mov [r10+CreateFile],rax
-
-        ;Load CloseHandle API
-        createStringCloseHandle str1
-        loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error
-        mov r10,[APITable]
-        mov [r10+CloseHandle],rax
-
-        ;Load GetFileSize API
-        createStringGetFileSize str1
-        loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error
-        mov r10,[APITable]
-        mov [r10+GetFileSize],rax
-
-        ;Load DeleteFile API
-        createStringDeleteFile str1
-        loadAPI str1, kernel32_imagebase, LoadLogAPIsExit_Error
-        mov r10,[APITable]
-        mov [r10+DeleteFile],rax
-
-        ;apis loaded successfully
-        mov rax,1
-        ret
-
-LoadLogAPIsExit_Error:
-        sub rax,rax
-        ret
-
-endp
diff --git a/Src/Container/64/loadexecutable.asm b/Src/Container/64/loadexecutable.asm
index 45ed77f..d63f2bb 100644
--- a/Src/Container/64/loadexecutable.asm
+++ b/Src/Container/64/loadexecutable.asm
@@ -1,641 +1,553 @@
-;Loads the exe which is stored in input_image
-;into memory and starts its execution
-proc loadExecutable APITable:QWORD, input_image:QWORD
-
-local str1[256]:BYTE, ret_val:QWORD, image_file_header:QWORD,\
-loaded_file:QWORD
-
-	mov [APITable],rcx
-	mov [input_image],rdx
-
-	;verify checksum of packed executable
-	writeWithNewLine createStringVerifyChecksum, str1, le_exit_error
-	fastcall verifyChecksum, [input_image], INFILE_SIZE
-	test rax,rax
-	jz le_exit_error
-
-	;verify whether the content of the data section is pe
-	writeWithNewLine createStringVerifyPE, str1, le_exit_error
-	mov rax,[input_image]
-	add rax,4
-	fastcall verifyPE, rax
-	test rax,rax
-	mov [image_file_header],rax
-	jz le_exit_error
-
-	;copy pe header and sections into memory
-	writeNewLineToLog APITable
-	writeWithNewLine createStringMappingFileInMemory, str1, le_exit_error
-	mov rax,[input_image]
-	add rax,4
-	mov rcx,INFILE_SIZE
-	sub rcx,4
-	fastcall loadFile, [APITable], [image_file_header], rax, rcx
-	test rax,rax
-	mov [loaded_file],rax
-	jz le_exit_error
-
-	;loading import table
-	writeNewLineToLog APITable
-	writeWithNewLine createStringLoadingFilesAPIs, str1, le_exit_error
-	fastcall loadImportTable, [APITable], [loaded_file]
-	test rax,rax
-	jz le_exit_error
-
-	;set the correct permissions for each section
-	writeNewLineToLog APITable
-	writeWithNewLine createStringSettingPermissions, str1, le_exit_error
-	mov rax,[input_image]
-	add rax,4
-	mov rcx,INFILE_SIZE
-	sub rcx,4
-	fastcall setPermissions, [APITable], [image_file_header], rax, rcx
-	test rax,rax
-	jz le_exit_error
-
-le_exit_success:
-	mov rax,1
-	ret
-
-le_exit_error:
-	sub rax,rax
-	ret
-
-endp
-
-;load the APIs in the import table
-proc loadImportTable, APITable:QWORD, image_base:QWORD
-
-local str1[256]:BYTE, import_table:QWORD, null_directory_entry[sizeof.IMAGE_IMPORT_DESCRIPTOR]:BYTE
-
-	mov [APITable], rcx
-	mov [image_base], rdx
-	push rsi
-	push rdi
-	push rbx
-	sub rsp,8
-
-	;find import table in data directory
-	mov eax,[rdx+IMAGE_DOS_HEADER.e_lfanew]
-	add rax,rdx
-	add rax,4
-	;image file header now in eax
-	add rax,sizeof.IMAGE_FILE_HEADER
-	lea rax,[rax+IMAGE_OPTIONAL_HEADER64.DataDirectory]
-	;first data directory entry now in eax
-	add rax,sizeof.IMAGE_DATA_DIRECTORY
-	;import data directory entry now in eax
-	mov eax,[rax+IMAGE_DATA_DIRECTORY.VirtualAddress]
-	add rax,rdx
-	;pointer to import table now in eax
-	mov [import_table],rax
-	writeWithNewLine createStringFoundImportTable, str1, le_exit_error
-	writeRegisterToLog APITable, [import_table]
-	test rax,rax
-	jz pit_exit_error
-
-	;init null directory entry
-	lea r8,[null_directory_entry]
-	mov rcx,sizeof.IMAGE_IMPORT_DESCRIPTOR
-	mov al,0
-pit_init_null_directory_loop:
-	mov [r8],al
-	inc r8
-	dec rcx
-	jnz pit_init_null_directory_loop
-
-	mov rbx,[import_table]
-	;iterate over the directory tables
-pit_next_directory_entry:
-	lea rsi,[null_directory_entry]
-	mov rdi,rbx
-	mov rcx,sizeof.IMAGE_IMPORT_DESCRIPTOR
-	rep cmpsb
-	je pit_exit_success
-	;load APIs of this directory
-	fastcall loadImportDirectoryTable, [APITable], [image_base], rbx
-	test rax,rax
-	jz pit_exit_error
-	;next entry
-	add rbx,sizeof.IMAGE_IMPORT_DESCRIPTOR
-	jmp pit_next_directory_entry
-
-pit_exit_success:
-	mov eax,1
-	jmp pit_exit_ret
-
-pit_exit_error:
-	sub rax,rax
-
-pit_exit_ret:
-	add rsp,8
-	pop rbx
-	pop rdi
-	pop rsi
-	ret
-
-endp
-
-;loads the APIs
-proc loadImportDirectoryTable, APITable:QWORD, image_base:QWORD, directory_entry:QWORD
-
-local str1[256]:BYTE, lookup_table:QWORD, import_address_table:QWORD, dll_image_base:QWORD
-
-	mov [APITable],rcx
-	mov [image_base],rdx
-	mov [directory_entry],r8
-	push rbx
-	push r12
-
-	;write info about data directory table to logfile
-	writeNewLineToLog APITable
-	test rax,rax
-	jz lidt_exit_error
-	writeWithNewLine createStringProcessImportDirectory, str1, lidt_exit_error
-	mov rax,[directory_entry]
-	mov eax,[rax+IMAGE_IMPORT_DESCRIPTOR.Name_]
-	add rax,[image_base]
-	mov rbx,rax
-	;pointer to dll name in ebx
-	writeLog APITable, rax
-	test rax,rax
-	jz lidt_exit_error
-	writeNewLineToLog APITable
-	test rax,rax
-	jz lidt_exit_error
-
-	;load the corresponding dll
-	invoke LoadLibrary, rbx
-	test rax,rax
-	jz lidt_exit_error
-	mov [dll_image_base],rax
-
-	;read pointers to the api tables
-	mov rdx,[directory_entry]
-	mov eax,[rdx+IMAGE_IMPORT_DESCRIPTOR.FirstThunk]
-	add rax,[image_base]
-	mov [import_address_table],rax
-	;check whether OriginalFirstThunk exists and can be used
-	mov eax,[rdx+IMAGE_IMPORT_DESCRIPTOR.OriginalFirstThunk]
-	test eax,eax
-	jnz lidt_use_original_first_thunk
-	;in some binaries, OriginalFirstThunk table is empty
-	;in this case, use FirstThunk insteadt to fetch API names or ordinals
-	mov eax,[rdx+IMAGE_IMPORT_DESCRIPTOR.FirstThunk]
-lidt_use_original_first_thunk:
-	add rax,[image_base]
-	mov [lookup_table],rax
-
-	;index to current API
-	sub r12,r12
-	;iterate the lookup_table entries
-lidt_next_lookup_entry:
-	mov rcx,r12
-	mov rax,[lookup_table]
-	add rax,r12 ;counter is in r12
-	mov rax,[rax] ;get entry (64 bit in PE+)
-	test rax,rax
-	jz lidt_exit_success
-	mov rbx,rax
-	mov rcx,IMAGE_ORDINAL_FLAG64
-	and rax,rcx
-	jnz lidt_byordinal
-lidt_byname:
-	createStringName str1
-	lea rax,[str1]
-	writeLog APITable, rax
-	test rax,rax
-	jz lidt_exit_error
-	add rbx,[image_base] ;according to spec, first 32 bits are 0, therefore add is possible
-	lea rbx,[rbx+IMAGE_IMPORT_BY_NAME.Name_]
-	mov rax,rbx ;pointer to API name is now in rax and rbx
-	writeLog APITable, rax
-	test rax,rax
-	jz lidt_exit_error
-	writeNewLineToLog APITable
-	test rax,rax
-	jz lidt_exit_error
-	;API name pointer in rbx
-	invoke GetProcAddress, [dll_image_base], rbx
-	test rax,rax
-	jz lidt_exit_error
-	mov rbx,[import_address_table]
-	add rbx,r12
-	mov [rbx],rax
-	;fetch next API
-	add r12,8 ;size of entries in import lookup table and import address table is 8 in PE+
-	jmp lidt_next_lookup_entry
-
-lidt_byordinal:
-	createStringOrdinal str1
-	lea rax,[str1]
-	writeLog APITable, rax
-	test rax,rax
-	jz lidt_exit_error
-	;remove the ordinal flag
-	mov rcx,IMAGE_ORDINAL_FLAG64
-	xor rbx,rcx
-	mov rax,rbx
-	writeRegisterToLog APITable, rax
-	test rax,rax
-	jz pit_exit_error
-	;API ordinal in rbx
-	invoke GetProcAddress, [dll_image_base], rbx
-	test rax,rax
-	jz lidt_exit_error
-	mov rbx,[import_address_table]
-	add rbx,r12
-	mov [rbx],rax
-	;fetch next API
-	add r12,8
-	jmp lidt_next_lookup_entry
-
-lidt_exit_success:
-	mov rax,1
-	jmp lidt_exit_ret
-
-lidt_exit_error:
-	sub rax,rax
-
-lidt_exit_ret:
-	pop r12
-	pop rbx
-	ret
-
-endp;
-
-;sets the memory permissions for each section
-proc setPermissions, APITable:QWORD, image_file_header:QWORD, file_image_base:QWORD, \
-file_image_size:QWORD
-
-local number_of_sections:QWORD, image_base:QWORD, section_headers:QWORD,\
-pe_header_size:QWORD, str1[256]:BYTE, vprotect_ret:QWORD
-
-	mov [APITable],rcx
-	mov [image_file_header],rdx
-	mov [file_image_base],r8
-	mov [file_image_size],r9
-	push rbx
-	push r12
-
-	;find section header
-	sub rax,rax
-	mov ax,[rdx+IMAGE_FILE_HEADER.NumberOfSections]
-	mov [number_of_sections],rax
-	add rdx,sizeof.IMAGE_FILE_HEADER
-	mov rax,[rdx+IMAGE_OPTIONAL_HEADER64.ImageBase]
-	mov [image_base],rax
-	;search for section header
-	lea r12,[rdx+IMAGE_OPTIONAL_HEADER64.DataDirectory]
-	mov eax,[rdx+IMAGE_OPTIONAL_HEADER64.NumberOfRvaAndSizes]
-	mov rdx,sizeof.IMAGE_DATA_DIRECTORY
-	mul rdx
-	add rax,r12
-	;first section header found
-	mov [section_headers],rax
-	mov rax,sizeof.IMAGE_SECTION_HEADER
-	mov rdx,[number_of_sections]
-	mul rdx
-	;end of section header sections found
-	add rax,[section_headers]
-	mov r12,[file_image_base]
-	sub rax,r12
-	;unaligned size of pe header in eax
-	mov [pe_header_size],rax
-
-	;set pe header page read-only
-	mov rax,[APITable]
-	lea r12,[vprotect_ret]
-	fastcall qword [rax+VirtualProtect], [image_base], [pe_header_size], PAGE_READONLY, r12
-	test rax,rax
-	jz sp_exit_error
-
-	;some output for the user
-	writeRegisterToLog APITable, [image_base]
-	test rax,rax
-	jz sp_exit_error
-
-	;set the section page permissions
-	mov r12,[number_of_sections]
-	mov rbx,[section_headers]
-sp_load_section_loop:
-	fastcall setSection, [APITable], rbx, [image_base], [file_image_base]
-	test rax,rax
-	jz sp_exit_error
-	add rbx,sizeof.IMAGE_SECTION_HEADER
-	dec r12
-	jnz sp_load_section_loop
-
-sp_exit_success:
-	mov rax,1
-	jmp sp_exit_ret
-
-sp_exit_error:
-	sub rax,rax
-
-sp_exit_ret:
-	pop r12
-	pop rbx
-	ret
-
-endp;
-
-;sets the complete image of the decrypted file writeable so
-;we can copy pe header and sections into it
-proc loadFile, APITable:QWORD, image_file_header:QWORD, file_image_base:QWORD, \
-file_image_size:QWORD
-
-local number_of_sections:QWORD, image_base:QWORD, aux:QWORD,\
-str1[256]:BYTE, vprotect_ret:QWORD, section_headers:QWORD, pe_header_size:QWORD
-
-	mov [APITable],rcx
-	mov [image_file_header],rdx
-	mov [file_image_base],r8
-	mov [file_image_size],r9
-	push rbx
-	push rdi
-	push rsi
-	sub rsp,8 ;proper 16 byte stack alignment
-
-	;find section header
-	;mov edx,[image_file_header]
-	sub rax,rax
-	mov ax,[rdx+IMAGE_FILE_HEADER.NumberOfSections]
-	mov [number_of_sections],rax
-	add rdx,sizeof.IMAGE_FILE_HEADER
-	mov rax,[rdx+IMAGE_OPTIONAL_HEADER64.ImageBase]
-	mov [image_base],rax
-	;make the complete image writable
-	mov esi,[rdx+IMAGE_OPTIONAL_HEADER64.SizeOfImage]
-	mov [aux],rdx ;store edx, we need it later
-	lea rbx,[vprotect_ret]
-	mov rax,[APITable]
-	fastcall qword [rax+VirtualProtect], [image_base], rsi, PAGE_READWRITE, rbx
-	test rax,rax
-	jz lf_exit_error
-
-	;some output for the user
-	writeWithNewLine createStringLoadedPEHeader, str1, lf_exit_error
-	writeRegisterToLog APITable, [image_base]
-	test rax,rax
-	jz lf_exit_error
-
-	mov rdx,[aux] ;restore rdx
-	;continue search for section header
-	lea rbx,[rdx+IMAGE_OPTIONAL_HEADER64.DataDirectory]
-	mov eax,[rdx+IMAGE_OPTIONAL_HEADER64.NumberOfRvaAndSizes]
-	mov rdx,sizeof.IMAGE_DATA_DIRECTORY
-	mul rdx
-	add rax,rbx
-
-	;first section header found
-	mov [section_headers],rax
-	mov rax,sizeof.IMAGE_SECTION_HEADER
-	mov rdx,[number_of_sections]
-	mul rdx
-	;end of section header sections found
-	add rax,[section_headers]
-	mov rbx,[file_image_base]
-	sub rax,rbx
-	;unaligned size of pe header in eax
-	mov [pe_header_size],rax
-
-	;copy header to memory
-	mov rdi,[image_base]
-	mov rsi,[file_image_base]
-	mov rcx,[pe_header_size]
-	rep movsb
-
-	;load the sections
-	mov rsi,[number_of_sections]
-	mov rbx,[section_headers]
-lf_load_section_loop:
-	fastcall loadSection, [APITable], rbx, [image_base], [file_image_base]
-	test rax,rax
-	jz lf_exit_error
-	add rbx,sizeof.IMAGE_SECTION_HEADER
-	dec rsi
-	jnz lf_load_section_loop
-
-lf_exit_success:
-	mov rax,[image_base]
-	jmp lf_exit_ret
-
-lf_exit_error:
-	sub rax,rax
-
-lf_exit_ret:
-	add rsp,8
-	pop rsi
-	pop rdi
-	pop rbx
-	ret
-endp
-
-;load the corresponding section into memory
-proc loadSection, APITable:QWORD, section_header:QWORD, image_base:QWORD,\
-file_image_base:QWORD
-
-local str1[256]:BYTE
-
-	mov [APITable],rcx
-	mov [section_header],rdx
-	mov [image_base],r8
-	mov [file_image_base],r9
-	push rdi
-	push rsi
-
-	;copy from file into memory
-	mov rdx,[section_header]
-	mov edi,[rdx+IMAGE_SECTION_HEADER.VirtualAddress]
-	add rdi,[image_base]
-	mov esi,[rdx+IMAGE_SECTION_HEADER.PointerToRawData]
-	add rsi,[file_image_base]
-	mov ecx,[rdx+IMAGE_SECTION_HEADER.SizeOfRawData]
-	rep movsb
-
-	;print some infos to the log file
-	createStringLoaded str1
-	lea rax,[str1]
-	writeLog APITable, rax
-	test rax,rax
-	jz ls_exit_error
-	lea rdi,[str1]
-	mov byte [rdi+8],0
-	mov rdx,[section_header]
-	lea rsi,[rdx+IMAGE_SECTION_HEADER._Name]
-	mov rcx,8
-	push rdi
-	rep movsb
-	pop rdi
-	writeLog APITable, rdi
-	writeNewLineToLog APITable
-	mov rdx,[section_header]
-	mov eax,[rdx+IMAGE_SECTION_HEADER.VirtualAddress]
-	add rax,[image_base]
-	writeRegisterToLog APITable, rax
-
-ls_exit_success:
-	mov rax,1
-	jmp ls_exit_ret
-
-ls_exit_error:
-	sub rax,rax
-
-ls_exit_ret:
-	pop rsi
-	pop rdi
-	ret
-
-endp
-
-;set the memory page permission for the corresponding section
-proc setSection, APITable:QWORD, section_header:QWORD, image_base:QWORD,\
-file_image_base:QWORD
-
-local section_flags:QWORD, vprotect_ret:QWORD, str1[256]:BYTE
-
-	mov [APITable],rcx
-	mov [section_header],rdx
-	mov [image_base],r8
-	mov [file_image_base],r9
-	push rbx
-	push r12
-
-	;section execute/read/write?
-	mov ebx,[rdx+IMAGE_SECTION_HEADER.Characteristics]
-	and ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE
-	cmp ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE
-	jne ssn_no_execute_read_write
-	mov rax,PAGE_EXECUTE_READWRITE
-	mov [section_flags],rax
-	jmp ssn_set_memory
-ssn_no_execute_read_write:
-	;section execute/read?
-	mov ebx,[rdx+IMAGE_SECTION_HEADER.Characteristics]
-	and ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ
-	cmp ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ
-	jne ssn_no_execute_read
-	mov rax,PAGE_EXECUTE_READ
-	mov [section_flags],rax
-	jmp ssn_set_memory
-ssn_no_execute_read:
-	;section read/write?
-	mov ebx,[rdx+IMAGE_SECTION_HEADER.Characteristics]
-	and ebx,IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE
-	cmp ebx,IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE
-	jne ssn_no_read_write
-	mov rax,PAGE_READWRITE
-	mov [section_flags],rax
-	jmp ssn_set_memory
-ssn_no_read_write:
-	;section read?
-	mov ebx,[rdx+IMAGE_SECTION_HEADER.Characteristics]
-	and ebx,IMAGE_SCN_MEM_READ
-	cmp ebx,IMAGE_SCN_MEM_READ
-	jne ssn_no_read
-	mov rax,PAGE_READONLY
-	mov [section_flags],rax
-	jmp ssn_set_memory
-ssn_no_read:
-	mov rax,PAGE_NOACCESS
-	mov [section_flags],rax
-
-	;set section permissions
-ssn_set_memory:
-	mov eax,[rdx+IMAGE_SECTION_HEADER.VirtualAddress]
-	add rax,[image_base]
-	mov ebx,[rdx+IMAGE_SECTION_HEADER.VirtualSize]
-	mov r10,[APITable]
-	lea r12,[vprotect_ret]
-	fastcall qword [r10+VirtualProtect],rax,rbx,[section_flags], r12
-	test rax,rax
-	jz ssn_exit_error
-
-	;some output for the user
-	mov rdx,[section_header]
-	mov eax,[rdx+IMAGE_SECTION_HEADER.VirtualAddress]
-	add rax,[image_base]
-	writeRegisterToLog APITable, rax
-
-ssn_exit_success:
-	mov rax,1
-	jmp ssn_exit_ret
-
-ssn_exit_error:
-	sub rax,rax
-
-ssn_exit_ret:
-	pop r12
-	pop rbx
-	ret
-
-endp;
-
-;check MZ und PE signature and return start of the image file header
-proc verifyPE, image_base:QWORD
-
-	mov [image_base], rcx
-	mov ax,[rcx+IMAGE_DOS_HEADER.e_magic]
-	cmp ax,IMAGE_DOS_SIGNATURE
-	jne vpe_exit_error
-	mov eax,[rcx+IMAGE_DOS_HEADER.e_lfanew]
-	add rcx,rax
-	mov eax,dword [rcx]
-	cmp eax,IMAGE_NT_SIGNATURE
-	jne vpe_exit_error
-	add rcx,4
-
-vpe_exit_success:
-	mov rax,rcx
-	ret
-
-vpe_exit_error:
-	sub rax,rax
-	ret
-
-endp
-
-;First 4 bytes of data seciton contain a checksum
-;Verify that the checksum is correct
-;TODO: CHECKSUM SIZE is atm hardcoded
-proc verifyChecksum, section_address:QWORD, section_size:QWORD
-
-	mov [section_address],rcx
-	mov [section_size],rdx
-	push rbx
-	push rdi
-
-	mov rbx,[section_address]
-	mov eax,[rbx]
-	add rbx,4
-	mov rcx,[section_size]
-	sub rcx,4
-	;checksum is in eax
-	;pointer to file in ebx
-	;size of file in ecx
-	sub rdi,rdi
-vs_calc_cs:
-	sub rdx,rdx
-	mov dl,byte [rbx]
-	add edi,edx
-	inc rbx
-	dec rcx
-	jnz vs_calc_cs
-	;calculated checksum is in edi
-	cmp edi,eax
-	jne vs_exit_error
-
-vs_exit_success:
-	mov eax,1
-	jmp vs_exit_ret
-
-vs_exit_error:
-	sub eax,eax
-
-vs_exit_ret:
-	pop rdi
-	pop rbx
-	ret
-
-endp
+;Loads the exe which is stored in input_image
+;into memory and starts its execution
+proc loadExecutable input_image:QWORD
+
+local str1[256]:BYTE, ret_val:QWORD, image_file_header:QWORD,\
+loaded_file:QWORD
+
+	mov [input_image],rcx
+
+	;verify checksum of packed executable
+	writeWithNewLine createStringVerifyChecksum, str1, le_exit_error
+	fastcall verifyChecksum, [input_image], INFILE_SIZE
+	test rax,rax
+	jz le_exit_error
+
+	;verify whether the content of the data section is pe
+	writeWithNewLine createStringVerifyPE, str1, le_exit_error
+	mov rax,[input_image]
+	add rax,4
+	fastcall verifyPE, rax
+	test rax,rax
+	mov [image_file_header],rax
+	jz le_exit_error
+
+	;copy pe header and sections into memory
+	writeNewLineToLog le_exit_error
+	writeWithNewLine createStringMappingFileInMemory, str1, le_exit_error
+	mov rax,[input_image]
+	add rax,4
+	fastcall loadFile, [image_file_header], rax, INFILE_SIZE-4
+	test rax,rax
+	mov [loaded_file],rax
+	jz le_exit_error
+
+	;loading import table
+	writeNewLineToLog le_exit_error
+	writeWithNewLine createStringLoadingFilesAPIs, str1, le_exit_error
+	fastcall loadImportTable, [loaded_file]
+	test rax,rax
+	jz le_exit_error
+
+	;set the correct permissions for each section
+	writeNewLineToLog le_exit_error
+	writeWithNewLine createStringSettingPermissions, str1, le_exit_error
+	mov rax,[input_image]
+	add rax,4
+	fastcall setPermissions, [image_file_header], rax, INFILE_SIZE-4
+	test rax,rax
+	jz le_exit_error
+
+le_exit_success:
+	mov rax,1
+	ret
+
+le_exit_error:
+	sub rax,rax
+	ret
+
+endp
+
+;load the APIs in the import table
+proc loadImportTable uses rsi rdi rbx, image_base:QWORD
+
+local str1[256]:BYTE, import_table:QWORD, null_directory_entry[sizeof.IMAGE_IMPORT_DESCRIPTOR]:BYTE
+
+	mov [image_base], rcx
+
+	;find import table in data directory
+	mov rdx,[image_base]
+	mov eax,[rdx+IMAGE_DOS_HEADER.e_lfanew]
+	add rax,rdx
+	add rax,4
+	;image file header now in eax
+	add rax,sizeof.IMAGE_FILE_HEADER
+	lea rax,[rax+IMAGE_OPTIONAL_HEADER64.DataDirectory]
+	;first data directory entry now in eax
+	add rax,sizeof.IMAGE_DATA_DIRECTORY
+	;import data directory entry now in eax
+	mov eax,[rax+IMAGE_DATA_DIRECTORY.VirtualAddress]
+	add rax,rdx
+	;pointer to import table now in eax
+	mov [import_table],rax
+	writeWithNewLine createStringFoundImportTable, str1, le_exit_error
+	writeRegisterToLog [import_table], pit_exit_error
+
+	;init null directory entry
+	lea r8,[null_directory_entry]
+	mov rcx,sizeof.IMAGE_IMPORT_DESCRIPTOR
+	mov al,0
+pit_init_null_directory_loop:
+	mov [r8],al
+	inc r8
+	dec rcx
+	jnz pit_init_null_directory_loop
+
+	mov rbx,[import_table]
+	;iterate over the directory tables
+pit_next_directory_entry:
+	lea rsi,[null_directory_entry]
+	mov rdi,rbx
+	mov rcx,sizeof.IMAGE_IMPORT_DESCRIPTOR
+	rep cmpsb
+	je pit_exit_success
+	;load APIs of this directory
+	fastcall loadImportDirectoryTable, [image_base], rbx
+	test rax,rax
+	jz pit_exit_error
+	;next entry
+	add rbx,sizeof.IMAGE_IMPORT_DESCRIPTOR
+	jmp pit_next_directory_entry
+
+pit_exit_success:
+	mov eax,1
+	jmp pit_exit_ret
+
+pit_exit_error:
+	sub rax,rax
+
+pit_exit_ret:
+	ret
+
+endp
+
+;loads the APIs
+proc loadImportDirectoryTable uses rbx r12, image_base:QWORD, directory_entry:QWORD
+
+local str1[256]:BYTE, lookup_table:QWORD, import_address_table:QWORD, dll_image_base:QWORD
+
+	mov [image_base],rcx
+	mov [directory_entry],rdx
+
+	;write info about data directory table to logfile
+	writeNewLineToLog lidt_exit_error
+	writeWithNewLine createStringProcessImportDirectory, str1, lidt_exit_error
+	mov rax,[directory_entry]
+	mov eax,[rax+IMAGE_IMPORT_DESCRIPTOR.Name_]
+	add rax,[image_base]
+	mov rbx,rax
+	;pointer to dll name in ebx
+	writeLog rax, lidt_exit_error
+	writeNewLineToLog lidt_exit_error
+
+	;load the corresponding dll
+	invoke LoadLibrary, rbx
+	test rax,rax
+	jz lidt_exit_error
+	mov [dll_image_base],rax
+
+	;read pointers to the api tables
+	mov rdx,[directory_entry]
+	mov eax,[rdx+IMAGE_IMPORT_DESCRIPTOR.FirstThunk]
+	add rax,[image_base]
+	mov [import_address_table],rax
+	;check whether OriginalFirstThunk exists and can be used
+	mov eax,[rdx+IMAGE_IMPORT_DESCRIPTOR.OriginalFirstThunk]
+	test eax,eax
+	jnz lidt_use_original_first_thunk
+	;in some binaries, OriginalFirstThunk table is empty
+	;in this case, use FirstThunk insteadt to fetch API names or ordinals
+	mov eax,[rdx+IMAGE_IMPORT_DESCRIPTOR.FirstThunk]
+lidt_use_original_first_thunk:
+	add rax,[image_base]
+	mov [lookup_table],rax
+
+	;index to current API
+	sub r12,r12
+	;iterate the lookup_table entries
+lidt_next_lookup_entry:
+	mov rcx,r12
+	mov rax,[lookup_table]
+	add rax,r12 ;counter is in r12
+	mov rax,[rax] ;get entry (64 bit in PE+)
+	test rax,rax
+	jz lidt_exit_success
+	mov rbx,rax
+	mov rcx,IMAGE_ORDINAL_FLAG64
+	and rax,rcx
+	jnz lidt_byordinal
+lidt_byname:
+	createStringName str1
+	writeLog rax, lidt_exit_error
+	add rbx,[image_base] ;according to spec, first 32 bits are 0, therefore add is possible
+	lea rbx,[rbx+IMAGE_IMPORT_BY_NAME.Name_]
+	mov rax,rbx ;pointer to API name is now in rax and rbx
+	writeLog rax, lidt_exit_error
+	writeNewLineToLog lidt_exit_error
+	;API name pointer in rbx
+	invoke GetProcAddress, [dll_image_base], rbx
+	test rax,rax
+	jz lidt_exit_error
+	mov rbx,[import_address_table]
+	add rbx,r12
+	mov [rbx],rax
+	;fetch next API
+	add r12,8 ;size of entries in import lookup table and import address table is 8 in PE+
+	jmp lidt_next_lookup_entry
+
+lidt_byordinal:
+	createStringOrdinal str1
+	writeLog rax, lidt_exit_error
+	;remove the ordinal flag
+	mov rcx,IMAGE_ORDINAL_FLAG64
+	xor rbx,rcx
+	mov rax,rbx
+	writeRegisterToLog rax, lidt_exit_error
+	;API ordinal in rbx
+	invoke GetProcAddress, [dll_image_base], rbx
+	test rax,rax
+	jz lidt_exit_error
+	mov rbx,[import_address_table]
+	add rbx,r12
+	mov [rbx],rax
+	;fetch next API
+	add r12,8
+	jmp lidt_next_lookup_entry
+
+lidt_exit_success:
+	mov rax,1
+	jmp lidt_exit_ret
+
+lidt_exit_error:
+	sub rax,rax
+
+lidt_exit_ret:
+	ret
+
+endp;
+
+;sets the memory permissions for each section
+proc setPermissions uses rbx r12, image_file_header:QWORD, file_image_base:QWORD, \
+file_image_size:QWORD
+
+local number_of_sections:QWORD, image_base:QWORD, section_headers:QWORD,\
+pe_header_size:QWORD, str1[256]:BYTE, vprotect_ret:QWORD
+
+	mov [image_file_header],rcx
+	mov [file_image_base],rdx
+	mov [file_image_size],r8
+
+	;find section header
+	sub rax,rax
+	mov rdx,[image_file_header]
+	mov ax,[rdx+IMAGE_FILE_HEADER.NumberOfSections]
+	mov [number_of_sections],rax
+	add rdx,sizeof.IMAGE_FILE_HEADER
+	mov rax,[rdx+IMAGE_OPTIONAL_HEADER64.ImageBase]
+	mov [image_base],rax
+	;search for section header
+	lea r12,[rdx+IMAGE_OPTIONAL_HEADER64.DataDirectory]
+	mov eax,[rdx+IMAGE_OPTIONAL_HEADER64.NumberOfRvaAndSizes]
+	mov rdx,sizeof.IMAGE_DATA_DIRECTORY
+	mul rdx
+	add rax,r12
+	;first section header found
+	mov [section_headers],rax
+	mov rax,sizeof.IMAGE_SECTION_HEADER
+	mov rdx,[number_of_sections]
+	mul rdx
+	;end of section header sections found
+	add rax,[section_headers]
+	mov r12,[file_image_base]
+	sub rax,r12
+	;unaligned size of pe header in eax
+	mov [pe_header_size],rax
+
+	;set pe header page read-only
+	lea r12,[vprotect_ret]
+	invoke VirtualProtect, [image_base], [pe_header_size], PAGE_READONLY, r12
+	test rax,rax
+	jz sp_exit_error
+
+	;some output for the user
+	writeRegisterToLog [image_base], sp_exit_error
+
+	;set the section page permissions
+	mov r12,[number_of_sections]
+	mov rbx,[section_headers]
+sp_load_section_loop:
+	fastcall setSection, rbx, [image_base], [file_image_base]
+	test rax,rax
+	jz sp_exit_error
+	add rbx,sizeof.IMAGE_SECTION_HEADER
+	dec r12
+	jnz sp_load_section_loop
+
+sp_exit_success:
+	mov rax,1
+	jmp sp_exit_ret
+
+sp_exit_error:
+	sub rax,rax
+
+sp_exit_ret:
+	ret
+
+endp;
+
+;sets the complete image of the decrypted file writeable so
+;we can copy pe header and sections into it
+proc loadFile uses rbx rdi rsi, image_file_header:QWORD, file_image_base:QWORD, \
+file_image_size:QWORD
+
+local number_of_sections:QWORD, image_base:QWORD, aux:QWORD,\
+str1[256]:BYTE, vprotect_ret:QWORD, section_headers:QWORD, pe_header_size:QWORD
+
+	mov [image_file_header],rcx
+	mov [file_image_base],rdx
+	mov [file_image_size],r8
+
+	;find section header
+	;mov edx,[image_file_header]
+	sub rax,rax
+	mov rdx,[image_file_header]
+	mov ax,[rdx+IMAGE_FILE_HEADER.NumberOfSections]
+	mov [number_of_sections],rax
+	add rdx,sizeof.IMAGE_FILE_HEADER
+	mov rax,[rdx+IMAGE_OPTIONAL_HEADER64.ImageBase]
+	mov [image_base],rax
+	;make the complete image writable
+	mov esi,[rdx+IMAGE_OPTIONAL_HEADER64.SizeOfImage]
+	mov [aux],rdx ;store edx, we need it later
+	lea rbx,[vprotect_ret]
+	invoke VirtualProtect, [image_base], rsi, PAGE_READWRITE, rbx
+	test rax,rax
+	jz lf_exit_error
+
+	;some output for the user
+	writeWithNewLine createStringLoadedPEHeader, str1, lf_exit_error
+	writeRegisterToLog [image_base], lf_exit_error
+
+	mov rdx,[aux] ;restore rdx
+	;continue search for section header
+	lea rbx,[rdx+IMAGE_OPTIONAL_HEADER64.DataDirectory]
+	mov eax,[rdx+IMAGE_OPTIONAL_HEADER64.NumberOfRvaAndSizes]
+	mov rdx,sizeof.IMAGE_DATA_DIRECTORY
+	mul rdx
+	add rax,rbx
+
+	;first section header found
+	mov [section_headers],rax
+	mov rax,sizeof.IMAGE_SECTION_HEADER
+	mov rdx,[number_of_sections]
+	mul rdx
+	;end of section header sections found
+	add rax,[section_headers]
+	mov rbx,[file_image_base]
+	sub rax,rbx
+	;unaligned size of pe header in eax
+	mov [pe_header_size],rax
+
+	;copy header to memory
+	mov rdi,[image_base]
+	mov rsi,[file_image_base]
+	mov rcx,[pe_header_size]
+	rep movsb
+
+	;load the sections
+	mov rsi,[number_of_sections]
+	mov rbx,[section_headers]
+lf_load_section_loop:
+	fastcall loadSection, rbx, [image_base], [file_image_base]
+	test rax,rax
+	jz lf_exit_error
+	add rbx,sizeof.IMAGE_SECTION_HEADER
+	dec rsi
+	jnz lf_load_section_loop
+
+lf_exit_success:
+	mov rax,[image_base]
+	jmp lf_exit_ret
+
+lf_exit_error:
+	sub rax,rax
+
+lf_exit_ret:
+	ret
+endp
+
+;load the corresponding section into memory
+proc loadSection uses rdi rsi r12, section_header:QWORD, image_base:QWORD,\
+file_image_base:QWORD
+
+local str1[256]:BYTE
+
+	mov [section_header],rcx
+	mov [image_base],rdx
+	mov [file_image_base],r8
+
+	;copy from file into memory
+	mov rdx,[section_header]
+	mov edi,[rdx+IMAGE_SECTION_HEADER.VirtualAddress]
+	add rdi,[image_base]
+	mov esi,[rdx+IMAGE_SECTION_HEADER.PointerToRawData]
+	add rsi,[file_image_base]
+	mov ecx,[rdx+IMAGE_SECTION_HEADER.SizeOfRawData]
+	rep movsb
+	writeSectionNameAndAddressToLog
+
+ls_exit_success:
+	mov rax,1
+	jmp ls_exit_ret
+
+ls_exit_error:
+	sub rax,rax
+
+ls_exit_ret:
+	ret
+
+endp
+
+;set the memory page permission for the corresponding section
+proc setSection uses rbx r12, section_header:QWORD, image_base:QWORD,\
+file_image_base:QWORD
+
+local section_flags:QWORD, vprotect_ret:QWORD, str1[256]:BYTE
+
+	mov [section_header],rcx
+	mov [image_base],rdx
+	mov [file_image_base],r8
+
+	;section execute/read/write?
+	mov rdx,[section_header]
+	mov ebx,[rdx+IMAGE_SECTION_HEADER.Characteristics]
+	and ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE
+	cmp ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE
+	jne ssn_no_execute_read_write
+	mov rax,PAGE_EXECUTE_READWRITE
+	mov [section_flags],rax
+	jmp ssn_set_memory
+ssn_no_execute_read_write:
+	;section execute/read?
+	mov ebx,[rdx+IMAGE_SECTION_HEADER.Characteristics]
+	and ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ
+	cmp ebx,IMAGE_SCN_MEM_EXECUTE or IMAGE_SCN_MEM_READ
+	jne ssn_no_execute_read
+	mov rax,PAGE_EXECUTE_READ
+	mov [section_flags],rax
+	jmp ssn_set_memory
+ssn_no_execute_read:
+	;section read/write?
+	mov ebx,[rdx+IMAGE_SECTION_HEADER.Characteristics]
+	and ebx,IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE
+	cmp ebx,IMAGE_SCN_MEM_READ or IMAGE_SCN_MEM_WRITE
+	jne ssn_no_read_write
+	mov rax,PAGE_READWRITE
+	mov [section_flags],rax
+	jmp ssn_set_memory
+ssn_no_read_write:
+	;section read?
+	mov ebx,[rdx+IMAGE_SECTION_HEADER.Characteristics]
+	and ebx,IMAGE_SCN_MEM_READ
+	cmp ebx,IMAGE_SCN_MEM_READ
+	jne ssn_no_read
+	mov rax,PAGE_READONLY
+	mov [section_flags],rax
+	jmp ssn_set_memory
+ssn_no_read:
+	mov rax,PAGE_NOACCESS
+	mov [section_flags],rax
+
+	;set section permissions
+ssn_set_memory:
+	mov eax,[rdx+IMAGE_SECTION_HEADER.VirtualAddress]
+	add rax,[image_base]
+	mov ebx,[rdx+IMAGE_SECTION_HEADER.VirtualSize]
+	lea r12,[vprotect_ret]
+	invoke VirtualProtect,rax,rbx,[section_flags], r12
+	test rax,rax
+	jz ssn_exit_error
+
+	;some output for the user
+	mov rdx,[section_header]
+	mov eax,[rdx+IMAGE_SECTION_HEADER.VirtualAddress]
+	add rax,[image_base]
+	writeRegisterToLog rax, ssn_exit_error
+
+ssn_exit_success:
+	mov rax,1
+	jmp ssn_exit_ret
+
+ssn_exit_error:
+	sub rax,rax
+
+ssn_exit_ret:
+	ret
+
+endp;
+
+;check MZ und PE signature and return start of the image file header
+proc verifyPE, image_base:QWORD
+
+	mov [image_base], rcx
+
+	mov rcx,[image_base]
+	mov ax,[rcx+IMAGE_DOS_HEADER.e_magic]
+	cmp ax,IMAGE_DOS_SIGNATURE
+	jne vpe_exit_error
+	mov eax,[rcx+IMAGE_DOS_HEADER.e_lfanew]
+	add rcx,rax
+	mov eax,dword [rcx]
+	cmp eax,IMAGE_NT_SIGNATURE
+	jne vpe_exit_error
+	add rcx,4
+
+vpe_exit_success:
+	mov rax,rcx
+	ret
+
+vpe_exit_error:
+	sub rax,rax
+	ret
+
+endp
+
+;First 4 bytes of data seciton contain a checksum
+;Verify that the checksum is correct
+;TODO: CHECKSUM SIZE is atm hardcoded
+proc verifyChecksum uses rbx rdi, section_address:QWORD, section_size:QWORD
+
+	mov [section_address],rcx
+	mov [section_size],rdx
+
+	mov rbx,[section_address]
+	mov eax,[rbx]
+	add rbx,4
+	mov rcx,[section_size]
+	sub rcx,4
+	;checksum is in eax
+	;pointer to file in ebx
+	;size of file in ecx
+	sub rdi,rdi
+vs_calc_cs:
+	sub rdx,rdx
+	mov dl,byte [rbx]
+	add edi,edx
+	inc rbx
+	dec rcx
+	jnz vs_calc_cs
+	;calculated checksum is in edi
+	cmp edi,eax
+	jne vs_exit_error
+
+vs_exit_success:
+	mov eax,1
+	jmp vs_exit_ret
+
+vs_exit_error:
+	sub eax,eax
+
+vs_exit_ret:
+	ret
+
+endp
diff --git a/Src/Container/64/logfile_disable.asm b/Src/Container/64/logfile_disable.asm
old mode 100755
new mode 100644
index c0c9ac5..bad6210
--- a/Src/Container/64/logfile_disable.asm
+++ b/Src/Container/64/logfile_disable.asm
@@ -1,25 +1,114 @@
-;writes a string and a newline to the logfile
-macro writeWithNewLine char_sequence, char_buffer, error_exit{
-    char_sequence char_buffer
-        mov rax,1
-}
-
-;write a string to the logfile
-macro writeLog apitable, content{
-        mov rax,1
-}
-
-;delete old log file and create a new one
-macro initLogFile apitable{
-         mov rax,1
-}
-
-;write a newline into logfile
-macro writeNewLineToLog apitable{
-        mov rax,1
-}
-
-;write a register value into logile
-macro writeRegisterToLog apitable, value{
-        mov rax,1
+macro createStringBruteforcing location
+{
+
+}
+
+macro createStringSettingPermissions location
+{
+
+}
+
+macro createStringOrdinal location
+{
+
+}
+
+macro createStringName location
+{
+
+}
+
+macro createStringProcessImportDirectory location
+{
+
+}
+
+macro createStringFoundImportTable location
+{
+
+}
+
+macro createStringLoadingFilesAPIs location
+{
+
+}
+
+macro createStringMappingFileInMemory location
+{
+
+}
+
+macro createStringLoaded location
+{
+
+}
+
+macro createStringLoadedPEHeader location
+{
+
+}
+
+macro createStringVerifyPE location
+{
+
+}
+
+macro createStringVerifyChecksum location
+{
+
+}
+
+macro createStringDone location
+{
+
+}
+
+macro createStringError location
+{
+
+}
+
+macro createStringStartingHyperion location
+{
+
+}
+
+macro createStringStartingHyperionLines location
+{
+
+}
+
+macro createStringLogTxt location
+{
+
+}
+
+;writes a string and a newline to the logfile
+macro writeWithNewLine char_sequence, char_buffer, error_exit{
+    char_sequence char_buffer
+
+}
+
+;write a string to the logfile
+macro writeLog content, exit_error{
+
+}
+
+;delete old log file and create a new one
+macro initLogFile exit_error{
+
+}
+
+;write a newline into logfile
+macro writeNewLineToLog exit_error{
+
+}
+
+;write a register value into logile
+macro writeRegisterToLog value, exit_error{
+
+}
+
+macro writeSectionNameAndAddressToLog{
+
 }
\ No newline at end of file
diff --git a/Src/Container/64/logfile_enable.asm b/Src/Container/64/logfile_enable.asm
index d6f2cd3..28de8f1 100644
--- a/Src/Container/64/logfile_enable.asm
+++ b/Src/Container/64/logfile_enable.asm
@@ -1,256 +1,605 @@
-;-------------------------------------------
-;the content of this file is excluded,      |
-;when the user disables logging features    |
-;in hyperion command line. pls keep in mind |
-;and dont rely on its existence.            |
-;-------------------------------------------  
-
-;--- Begin Macro Section ---
-
-;writes a string and a newline to the logfile
-macro writeWithNewLine char_sequence, char_buffer, error_exit{
-        char_sequence char_buffer
-        lea rax,[str1]
-        fastcall writeLog_,[APITable],rax
-        test rax,rax
-        jz error_exit
-        fastcall writeNewLineToLog_,[APITable]
-        test rax,rax
-        jz error_exit
-}
-
-;write a string to the logfile
-macro writeLog apitable, content{
-        fastcall writeLog_,[apitable], content
-}
-
-;delete old log file and create a new one
-macro initLogFile apitable{
-        fastcall initLogFile_, [apitable]
-}
-
-;write a newline into logfile
-macro writeNewLineToLog apitable{
-        fastcall writeNewLineToLog_, [apitable]
-}
-
-;write a register value into logile
-macro writeRegisterToLog apitable, value{
-        fastcall writeRegisterToLog_, [apitable], value
-}
-
-;--- End Macro Section ---
-
-;get the length of a string
-proc strlen_ string_ptr:QWORD
-
-         mov [string_ptr],rcx
-         push rdi
-         push rcx
-
-         mov rdi,[string_ptr]
-         sub rcx, rcx
-         sub al, al
-         not rcx
-         cld
-         repne scasb
-         not rcx
-         dec rcx
-         mov rax,rcx
-
-         pop rcx
-         pop rdi
-         ret
-
-endp
-
-;write <content> into log.txt
-;returns false if an eerror occurs
-proc writeLog_ APITable:QWORD, content:QWORD
-
-local str1[256]:BYTE, oldlogsize:QWORD, newlogsize:QWORD, contentsize:QWORD,\
-      filehandle:QWORD, filemappingobject:QWORD, mapaddress:QWORD, retval:QWORD
-
-         mov [APITable],rcx
-         mov [content],rdx
-
-         ;open file
-         createStringLogTxt str1
-         mov rax,[APITable]
-         lea r10,[str1]
-         sub r11,r11
-         fastcall qword [rax+CreateFile], r10, GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ, r11, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, r11
-         mov [retval],rax
-         test rax,rax
-         jz wl_logexit
-         mov [filehandle],rax
-
-         ;get logfile size
-         mov rax,[APITable]
-         fastcall qword [rax+GetFileSize], qword [filehandle], 0
-         mov [oldlogsize],rax
-
-         ;get size of string for logfile for concatenation
-         fastcall strlen_, qword [content]
-         mov [contentsize], rax
-         add rax,qword [oldlogsize]
-         mov [newlogsize], rax
-
-         ;create the file mapping
-         sub r10,r10
-         mov r11,[APITable]
-         fastcall qword [r11+CreateFileMapping], qword [filehandle], r10, PAGE_READWRITE, r10, rax, r10
-         mov [retval],rax
-         test rax, rax
-         jz wl_closelogfile
-         mov [filemappingobject],rax
-
-         sub r10,r10
-         mov r11,[APITable]
-         fastcall qword [r11+MapViewOfFile], rax, FILE_MAP_ALL_ACCESS, r10, r10, qword [newlogsize]
-         mov [retval],rax
-         test rax, rax
-         jz wl_closemaphandle
-         mov [mapaddress],rax
-
-         ;copy string into map
-         add rax,[oldlogsize]
-         mov rdi,rax
-         mov rsi,[content]
-         mov rcx,[contentsize]
-         repz movsb
-         mov [retval],1
-
-wl_unmapfile:
-         mov rax,[APITable]
-         fastcall qword [rax+UnmapViewOfFile], qword [mapaddress]
-
-wl_closemaphandle:
-         mov rax,[APITable]
-         fastcall qword [rax+CloseHandle], qword [filemappingobject]
-
-wl_closelogfile:
-         mov rax,[APITable]
-         fastcall qword [rax+CloseHandle], qword [filehandle]
-
-wl_logexit:
-         mov rax,[retval]
-         ret;
-
-endp
-
-;adds a <newline> to the logfile
-;returns false if an error occurs
-proc writeNewLineToLog_ APITable:QWORD
-
-local str1[3]:BYTE
-         mov [APITable],rcx
-
-         lea rax,[str1]
-         mov byte [rax+0],13
-         mov byte [rax+1],10
-         mov byte [rax+2],0
-         fastcall writeLog_, [APITable], rax
-         ret
-
-endp
-
-;returns false if an error occurs
-proc writeRegisterToLog_ APITable:QWORD, Value:QWORD
-
-local str1[18]:BYTE, retval:QWORD
-         mov [APITable],rcx
-         mov [Value],rdx
-
-         lea rax,[str1]
-         fastcall binToString_, rax, [Value]
-         fastcall writeLog_,[APITable],rax
-         mov [retval],rax
-         test rax,rax
-         jz wrtl_exit
-         fastcall writeNewLineToLog_,[APITable]
-         mov [retval],rax
-         test rax,rax
-         jz wrtl_exit
-
-wrtl_exit:
-         mov rax,[retval]
-         ret
-
-endp
-
-;converts <bin> into an 8 byte string and stores it <buffer>
-proc binToString_ buffer:QWORD, bin:QWORD
-         mov [buffer],rcx
-         mov [bin], rdx
-
-         mov r10,[bin]
-         mov rcx,16
-bts_next_byte:
-         mov rax,r10
-         and rax,0000000fh
-         cmp rax,9
-         jg bts_add_55
-bts_add_48:
-         add rax,48
-         jmp bts_store_bin
-bts_add_55:
-         add rax,55
-bts_store_bin:
-         dec rcx
-         mov rdx,[buffer]
-         mov byte [rcx+rdx],al
-         test rcx,rcx
-         jz bts_finished_conversion
-         shr r10,4
-         jmp bts_next_byte
-
-bts_finished_conversion:
-         mov rax,[buffer]
-         mov byte [rax+16],0
-         ret
-endp
-
-;Write initial message into logfile
-proc initLogFile_ APITable:QWORD
-
-local str1[256]:BYTE
-
-        mov [APITable], rcx
-
-        createStringLogTxt str1
-        mov rax,[APITable]
-        lea r10,[str1]
-        fastcall qword [rax+DeleteFile],r10
-
-        createStringStartingHyperionLines str1
-        lea r10,[str1]
-        fastcall writeLog_,[APITable],r10
-        test rax,rax
-        jz ilf_exit_error
-
-        createStringStartingHyperion str1
-        lea r10,[str1]
-        fastcall writeLog_,[APITable],r10
-        test rax,rax
-        jz ilf_exit_error
-
-        createStringStartingHyperionLines str1
-        lea r10,[str1]
-        fastcall writeLog_,[APITable],r10
-        test rax,rax
-        jz ilf_exit_error
-
-        fastcall writeNewLineToLog_,[APITable]
-        test rax,rax
-        jz ilf_exit_error
-
-ilf_exit_success:
-        mov rax,1
-        ret
-
-ilf_exit_error:
-        sub rax,rax
-        ret
-
-endp
+;-------------------------------------------
+;the content of this file is excluded,	    |
+;when the user disables logging features    |
+;in hyperion command line. pls keep in mind |
+;and dont rely on its existence.	    |
+;-------------------------------------------  
+
+;--- Begin Macro Section ---
+
+macro createStringBruteforcing location
+{
+	 mov [location+0],'B'
+	 mov [location+1],'r'
+	 mov [location+2],'u'
+	 mov [location+3],'t'
+	 mov [location+4],'e'
+	 mov [location+5],'f'
+	 mov [location+6],'o'
+	 mov [location+7],'r'
+	 mov [location+8],'c'
+	 mov [location+9],'i'
+	 mov [location+10],'n'
+	 mov [location+11],'g'
+	 mov [location+12],' '
+	 mov [location+13],'K'
+	 mov [location+14],'e'
+	 mov [location+15],'y'
+	 mov [location+16],0
+	 lea rax,[location]
+}
+
+macro createStringSettingPermissions location
+{
+	 mov [location+0],'S'
+	 mov [location+1],'e'
+	 mov [location+2],'t'
+	 mov [location+3],'t'
+	 mov [location+4],'i'
+	 mov [location+5],'n'
+	 mov [location+6],'g'
+	 mov [location+7],' '
+	 mov [location+8],'S'
+	 mov [location+9],'e'
+	 mov [location+10],'c'
+	 mov [location+11],'t'
+	 mov [location+12],'i'
+	 mov [location+13],'o'
+	 mov [location+14],'n'
+	 mov [location+15],' '
+	 mov [location+16],'P'
+	 mov [location+17],'e'
+	 mov [location+18],'r'
+	 mov [location+19],'m'
+	 mov [location+20],'i'
+	 mov [location+21],'s'
+	 mov [location+22],'s'
+	 mov [location+23],'i'
+	 mov [location+24],'o'
+	 mov [location+25],'n'
+	 mov [location+26],'s'
+	 mov [location+27],0
+	 lea rax,[location]
+}
+
+macro createStringOrdinal location
+{
+	 mov [location+0],'O'
+	 mov [location+1],'r'
+	 mov [location+2],'d'
+	 mov [location+3],'i'
+	 mov [location+4],'n'
+	 mov [location+5],'a'
+	 mov [location+6],'l'
+	 mov [location+7],':'
+	 mov [location+8],' '
+	 mov [location+9],0
+	 lea rax,[location]
+}
+
+macro createStringName location
+{
+	 mov [location+0],'N'
+	 mov [location+1],'a'
+	 mov [location+2],'m'
+	 mov [location+3],'e'
+	 mov [location+4],':'
+	 mov [location+5],' '
+	 mov [location+6],0
+	 lea rax,[location]
+}
+
+macro createStringProcessImportDirectory location
+{
+	 mov [location+0],'P'
+	 mov [location+1],'r'
+	 mov [location+2],'o'
+	 mov [location+3],'c'
+	 mov [location+4],'e'
+	 mov [location+5],'s'
+	 mov [location+6],'s'
+	 mov [location+7],'i'
+	 mov [location+8],'n'
+	 mov [location+9],'g'
+	 mov [location+10],' '
+	 mov [location+11],'I'
+	 mov [location+12],'m'
+	 mov [location+13],'p'
+	 mov [location+14],'o'
+	 mov [location+15],'r'
+	 mov [location+16],'t'
+	 mov [location+17],' '
+	 mov [location+18],'D'
+	 mov [location+19],'i'
+	 mov [location+20],'r'
+	 mov [location+21],'e'
+	 mov [location+22],'c'
+	 mov [location+23],'t'
+	 mov [location+24],'o'
+	 mov [location+25],'r'
+	 mov [location+26],'y'
+	 mov [location+27],':'
+	 mov [location+28],0
+	 lea rax,[location]
+}
+
+macro createStringFoundImportTable location
+{
+	 mov [location+0],'I'
+	 mov [location+1],'m'
+	 mov [location+2],'p'
+	 mov [location+3],'o'
+	 mov [location+4],'r'
+	 mov [location+5],'t'
+	 mov [location+6],' '
+	 mov [location+7],'T'
+	 mov [location+8],'a'
+	 mov [location+9],'b'
+	 mov [location+10],'l'
+	 mov [location+11],'e'
+	 mov [location+12],':'
+	 mov [location+13],0
+	 lea rax,[location]
+}
+
+macro createStringLoadingFilesAPIs location
+{
+	 mov [location+0],'L'
+	 mov [location+1],'o'
+	 mov [location+2],'a'
+	 mov [location+3],'d'
+	 mov [location+4],'i'
+	 mov [location+5],'n'
+	 mov [location+6],'g'
+	 mov [location+7],' '
+	 mov [location+8],'A'
+	 mov [location+9],'P'
+	 mov [location+10],'I'
+	 mov [location+11],'s'
+	 mov [location+12],0
+	 lea rax,[location]
+}
+
+macro createStringMappingFileInMemory location
+{
+	 mov [location+0],'M'
+	 mov [location+1],'a'
+	 mov [location+2],'p'
+	 mov [location+3],'p'
+	 mov [location+4],'i'
+	 mov [location+5],'n'
+	 mov [location+6],'g'
+	 mov [location+7],' '
+	 mov [location+8],'F'
+	 mov [location+9],'i'
+	 mov [location+10],'l'
+	 mov [location+11],'e'
+	 mov [location+12],' '
+	 mov [location+13],'i'
+	 mov [location+14],'n'
+	 mov [location+15],'t'
+	 mov [location+16],'o'
+	 mov [location+17],' '
+	 mov [location+18],'M'
+	 mov [location+19],'e'
+	 mov [location+20],'m'
+	 mov [location+21],'o'
+	 mov [location+22],'r'
+	 mov [location+23],'y'
+	 mov [location+24],0
+	 lea rax,[location]
+}
+
+macro createStringLoaded location
+{
+	 mov [location+0],'L'
+	 mov [location+1],'o'
+	 mov [location+2],'a'
+	 mov [location+3],'d'
+	 mov [location+4],'e'
+	 mov [location+5],'d'
+	 mov [location+6],' '
+	 mov [location+7],0
+	 lea rax,[location]
+}
+
+macro createStringLoadedPEHeader location
+{
+	 mov [location+0],'S'
+	 mov [location+1],'e'
+	 mov [location+2],'t'
+	 mov [location+3],' '
+	 mov [location+4],'I'
+	 mov [location+5],'m'
+	 mov [location+6],'a'
+	 mov [location+7],'g'
+	 mov [location+8],'e'
+	 mov [location+9],' '
+	 mov [location+10],'w'
+	 mov [location+11],'r'
+	 mov [location+12],'i'
+	 mov [location+13],'t'
+	 mov [location+14],'a'
+	 mov [location+15],'b'
+	 mov [location+16],'l'
+	 mov [location+17],'e'
+	 mov [location+18],':'
+	 mov [location+19],0
+	 lea rax,[location]
+}
+
+macro createStringVerifyPE location
+{
+	 mov [location+0],'V'
+	 mov [location+1],'e'
+	 mov [location+2],'r'
+	 mov [location+3],'i'
+	 mov [location+4],'f'
+	 mov [location+5],'y'
+	 mov [location+6],'i'
+	 mov [location+7],'n'
+	 mov [location+8],'g'
+	 mov [location+9],' '
+	 mov [location+10],'P'
+	 mov [location+11],'E'
+	 mov [location+12],0
+	 lea rax,[location]
+}
+
+macro createStringVerifyChecksum location
+{
+	 mov [location+0],'V'
+	 mov [location+1],'e'
+	 mov [location+2],'r'
+	 mov [location+3],'i'
+	 mov [location+4],'f'
+	 mov [location+5],'y'
+	 mov [location+6],'i'
+	 mov [location+7],'n'
+	 mov [location+8],'g'
+	 mov [location+9],' '
+	 mov [location+10],'C'
+	 mov [location+11],'h'
+	 mov [location+12],'e'
+	 mov [location+13],'c'
+	 mov [location+14],'k'
+	 mov [location+15],'s'
+	 mov [location+16],'u'
+	 mov [location+17],'m'
+	 mov [location+18],0
+	 lea rax,[location]
+}
+
+macro createStringDone location
+{
+	 mov [location+0],'D'
+	 mov [location+1],'o'
+	 mov [location+2],'n'
+	 mov [location+3],'e'
+	 mov [location+4],0
+	 lea rax,[location]
+}
+
+macro createStringError location
+{
+	 mov [location+0],'E'
+	 mov [location+1],'r'
+	 mov [location+2],'r'
+	 mov [location+3],'o'
+	 mov [location+4],'r'
+	 mov [location+5],0
+	 lea rax,[location]
+}
+
+macro createStringStartingHyperion location
+{
+	 mov [location+00],'H'
+	 mov [location+01],'y'
+	 mov [location+02],'p'
+	 mov [location+03],'e'
+	 mov [location+04],'r'
+	 mov [location+05],'i'
+	 mov [location+06],'o'
+	 mov [location+07],'n'
+	 mov [location+08],' '
+	 mov [location+09],'L'
+	 mov [location+10],'o'
+	 mov [location+11],'g'
+	 mov [location+12],'f'
+	 mov [location+13],'i'
+	 mov [location+14],'l'
+	 mov [location+15],'e'
+	 mov [location+16],13
+	 mov [location+17],10
+	 mov [location+18],0
+	 lea rax,[location]
+}
+
+macro createStringStartingHyperionLines location
+{
+	 mov [location+00],'-'
+	 mov [location+01],'-'
+	 mov [location+02],'-'
+	 mov [location+03],'-'
+	 mov [location+04],'-'
+	 mov [location+05],'-'
+	 mov [location+06],'-'
+	 mov [location+07],'-'
+	 mov [location+08],'-'
+	 mov [location+09],'-'
+	 mov [location+10],'-'
+	 mov [location+11],'-'
+	 mov [location+12],'-'
+	 mov [location+13],'-'
+	 mov [location+14],'-'
+	 mov [location+15],'-'
+	 mov [location+16],13
+	 mov [location+17],10
+	 mov [location+18],0
+	 lea rax,[location]
+}
+
+macro createStringLogTxt location
+{
+	 mov [location+0],'l'
+	 mov [location+1],'o'
+	 mov [location+2],'g'
+	 mov [location+3],'.'
+	 mov [location+4],'t'
+	 mov [location+5],'x'
+	 mov [location+6],'t'
+	 mov [location+7],0
+	 lea rax,[location]
+}
+
+;writes a string and a newline to the logfile
+macro writeWithNewLine char_sequence, char_buffer, error_exit{
+	char_sequence char_buffer
+	lea rax,[str1]
+	fastcall writeLog_, rax
+	test rax,rax
+	jz error_exit
+	fastcall writeNewLineToLog_
+	test rax,rax
+	jz error_exit
+}
+
+;write a string to the logfile
+macro writeLog content, error_exit{
+	fastcall writeLog_, content
+	test rax,rax
+	jz error_exit
+}
+
+;delete old log file and create a new one
+macro initLogFile error_exit{
+	fastcall initLogFile_, error_exit
+	test rax,rax
+	jz error_exit
+}
+
+;write a newline into logfile
+macro writeNewLineToLog error_exit{
+	fastcall writeNewLineToLog_
+	test rax,rax
+	jz error_exit
+}
+
+;write a register value into logile
+macro writeRegisterToLog value, error_exit{
+	fastcall writeRegisterToLog_, value
+	test rax,rax
+	jz error_exit
+}
+
+;TODO: Does not really fit into architecture
+macro writeSectionNameAndAddressToLog{
+	lea rdi,[str1]
+	mov byte [rdi+8],0
+	mov rdx,[section_header]
+	lea rsi,[rdx+IMAGE_SECTION_HEADER._Name]
+	mov rcx,8
+	mov r12, rdi
+	rep movsb
+	mov rdi, r12
+	writeLog rdi, ls_exit_error
+	writeNewLineToLog ls_exit_error
+	mov rdx,[section_header]
+	mov eax,[rdx+IMAGE_SECTION_HEADER.VirtualAddress]
+	add rax,[image_base]
+	writeRegisterToLog rax, ls_exit_error
+}
+
+;--- End Macro Section ---
+
+;get the length of a string
+proc strlen_ uses rdi rcx, string_ptr:QWORD
+
+	 mov [string_ptr],rcx
+
+	 mov rdi,[string_ptr]
+	 sub rcx, rcx
+	 sub al, al
+	 not rcx
+	 cld
+	 repne scasb
+	 not rcx
+	 dec rcx
+	 mov rax,rcx
+
+	 ret
+
+endp
+
+;write <content> into log.txt
+;returns false if an eerror occurs
+proc writeLog_ content:QWORD
+
+local str1[256]:BYTE, oldlogsize:QWORD, newlogsize:QWORD, contentsize:QWORD,\
+      filehandle:QWORD, filemappingobject:QWORD, mapaddress:QWORD, retval:QWORD
+
+	 mov [content],rcx
+
+	 ;open file
+	 createStringLogTxt str1
+	 sub r11,r11
+	 invoke CreateFile, rax, GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ, r11, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, r11
+	 mov [retval],rax
+	 test rax,rax
+	 jz wl_logexit
+	 mov [filehandle],rax
+
+	 ;get logfile size
+	 invoke GetFileSize, qword [filehandle], 0
+	 mov [oldlogsize],rax
+
+	 ;get size of string for logfile for concatenation
+	 fastcall strlen_, qword [content]
+	 mov [contentsize], rax
+	 add rax,qword [oldlogsize]
+	 mov [newlogsize], rax
+
+	 ;create the file mapping
+	 sub r10,r10
+	 invoke CreateFileMapping, qword [filehandle], r10, PAGE_READWRITE, r10, rax, r10
+	 mov [retval],rax
+	 test rax, rax
+	 jz wl_closelogfile
+	 mov [filemappingobject],rax
+
+	 sub r10,r10
+	 invoke MapViewOfFile, rax, FILE_MAP_ALL_ACCESS, r10, r10, qword [newlogsize]
+	 mov [retval],rax
+	 test rax, rax
+	 jz wl_closemaphandle
+	 mov [mapaddress],rax
+
+	 ;copy string into map
+	 add rax,[oldlogsize]
+	 mov rdi,rax
+	 mov rsi,[content]
+	 mov rcx,[contentsize]
+	 repz movsb
+	 mov [retval],1
+
+wl_unmapfile:
+	 invoke UnmapViewOfFile, qword [mapaddress]
+
+wl_closemaphandle:
+	 invoke CloseHandle, qword [filemappingobject]
+
+wl_closelogfile:
+	 invoke CloseHandle, qword [filehandle]
+
+wl_logexit:
+	 mov rax,[retval]
+	 ret;
+
+endp
+
+;adds a <newline> to the logfile
+;returns false if an error occurs
+proc writeNewLineToLog_
+
+local str1[3]:BYTE
+
+	 lea rax,[str1]
+	 mov byte [rax+0],13
+	 mov byte [rax+1],10
+	 mov byte [rax+2],0
+	 fastcall writeLog_, rax
+	 ret
+
+endp
+
+;returns false if an error occurs
+proc writeRegisterToLog_ Value:QWORD
+
+local str1[18]:BYTE, retval:QWORD
+	 mov [Value],rcx
+
+	 lea rax,[str1]
+	 fastcall binToString_, rax, [Value]
+	 fastcall writeLog_, rax
+	 mov [retval],rax
+	 test rax,rax
+	 jz wrtl_exit
+	 fastcall writeNewLineToLog_
+	 mov [retval],rax
+	 test rax,rax
+	 jz wrtl_exit
+
+wrtl_exit:
+	 mov rax,[retval]
+	 ret
+
+endp
+
+;converts <bin> into an 8 byte string and stores it <buffer>
+proc binToString_ buffer:QWORD, bin:QWORD
+	 mov [buffer],rcx
+	 mov [bin], rdx
+
+	 mov r10,[bin]
+	 mov rcx,16
+bts_next_byte:
+	 mov rax,r10
+	 and rax,0000000fh
+	 cmp rax,9
+	 jg bts_add_55
+bts_add_48:
+	 add rax,48
+	 jmp bts_store_bin
+bts_add_55:
+	 add rax,55
+bts_store_bin:
+	 dec rcx
+	 mov rdx,[buffer]
+	 mov byte [rcx+rdx],al
+	 test rcx,rcx
+	 jz bts_finished_conversion
+	 shr r10,4
+	 jmp bts_next_byte
+
+bts_finished_conversion:
+	 mov rax,[buffer]
+	 mov byte [rax+16],0
+	 ret
+endp
+
+;Write initial message into logfile
+proc initLogFile_
+
+local str1[256]:BYTE
+
+	createStringLogTxt str1
+	invoke DeleteFile, rax
+
+	createStringStartingHyperionLines str1
+	fastcall writeLog_, rax
+	test rax,rax
+	jz ilf_exit_error
+
+	createStringStartingHyperion str1
+	fastcall writeLog_, rax
+	test rax,rax
+	jz ilf_exit_error
+
+	createStringStartingHyperionLines str1
+	fastcall writeLog_, rax
+	test rax,rax
+	jz ilf_exit_error
+
+	fastcall writeNewLineToLog_
+	test rax,rax
+	jz ilf_exit_error
+
+ilf_exit_success:
+	mov rax,1
+	ret
+
+ilf_exit_error:
+	sub rax,rax
+	ret
+
+endp
\ No newline at end of file
diff --git a/Src/Container/64/main.asm b/Src/Container/64/main.asm
index 61d8c80..1d0da63 100644
--- a/Src/Container/64/main.asm
+++ b/Src/Container/64/main.asm
@@ -1,149 +1,125 @@
-; Hyperion 64-Bit container.exe
-
-include 'image_base.inc'
-format PE64 GUI 5.0 at IMAGE_BASE
-entry start
-
-include '..\..\..\Fasm\INCLUDE\win64a.inc'
-include 'hyperion.inc'
-include 'createstrings.inc'
-include 'pe.inc'
-;automatically generated by hyperion cpp stub
-include 'key_size.inc'
-include 'infile_size.inc'
-include 'image_size.inc'
-;---
-
-;this contains the decrypted and loaded executable
-section '.bss' data readable writeable
-
-	 decrypted_infile: db IMAGE_SIZE dup (?)
-
-;--------------------------------------------------
-
-;this contains the encrypted exe
-section '.data' data readable writeable
-
-	 encrypted_infile: include 'infile_array.inc'
-
-;--------------------------------------------------
-
-section '.text' code readable executable
-
-;include necessary functions
-include 'logfile_select.asm'
-include 'loadapis.asm'
-include 'loadexecutable.asm'
-;automatically generated by hyperion cpp stub
-include 'decryption_payload.asm'
-;---
-
-start:
-	 sub rsp,8
-	 fastcall MainMethod
-	 test rax,rax
-	 jz the_end_my_friend
-	 ;file was loaded, execute it
-	 add rsp,8
-	 jmp rax
-the_end_my_friend:
-	 invoke ExitProcess,0
-
-proc MainMethod
-	 local str1[256]:BYTE,\
-	 APITable:QWORD,\
-	 CreateFileMapping_:QWORD,\
-	 MapViewOfFile_:QWORD,\
-	 UnmapViewOfFile_:QWORD,\
-	 CreateFile_:QWORD,\
-	 CloseHandle_:QWORD,\
-	 DeleteFile_:QWORD,\
-	 GetModuleHandle_:QWORD,\
-	 VirtualAlloc_:QWORD,\
-	 VirtualProtect_:QWORD,\
-	 VirtualFree_:QWORD,\
-	 RetVal:QWORD
-
-	 ;pointer to the API table
-	 lea rax,[CreateFileMapping_]
-	 mov [APITable],rax
-
-	 ;load APIs for log file access
-	 fastcall loadLogAPIs,[APITable]
-	 test rax,rax
-	 jz main_exiterrornolog
-
-	 ;create logfile and write initial message into it
-	 initLogFile APITable
-	 test rax,rax
-	 jz main_exiterrornolog
-
-	 ;load all necessary APIs
-	 fastcall loadRegularAPIs, [APITable]
-	 test rax,rax
-	 jz main_exiterror
-	 writeNewLineToLog APITable
-	 test rax,rax
-	 jz main_exiterror
-
-	 ;decrypt exe in data section
-	 fastcall decryptExecutable, [APITable], encrypted_infile
-	 test rax,rax
-	 jz main_exiterror
-
-	 ;load the executable at its image base
-	 ;(this will overwrite current MZ header and bss section)
-	 fastcall loadExecutable, [APITable], encrypted_infile
-	 test rax,rax
-	 jz main_exiterror
-
-	 ;start program execution
-	 mov rdx,IMAGE_BASE
-	 xor rax,rax
-	 mov eax,[rdx+IMAGE_DOS_HEADER.e_lfanew]
-	 add rax,rdx
-	 add rax,4
-	 ;image file header now in eax
-	 add rax,sizeof.IMAGE_FILE_HEADER
-	 xor rdx,rdx
-	 mov edx,[rax+IMAGE_OPTIONAL_HEADER64.AddressOfEntryPoint]
-	 mov rax,IMAGE_BASE
-	 add rdx,rax
-	 ;entry point of original exe is now in rdx
-	 mov [RetVal],rdx
-
-;finished without errors
-main_exitsuccess:
-	 writeNewLineToLog APITable
-	 createStringDone str1
-	 lea rax,[str1]
-	 writeLog APITable, rax
-	 mov rax,[RetVal]
-	 jmp main_exit
-
-;finished with errors after logfile API loading
-main_exiterror:
-	 writeNewLineToLog APITable
-	 createStringError str1
-	 lea rax,[str1]
-	 writeLog APITable, rax
-	 sub rax,rax
-
-main_exit:
-	 ret
-
-;finished with errors before logfile API loading
-main_exiterrornolog:
-	 ret
-
-endp
-
-;import table
-section '.idata' import data readable writeable
-
-	 library kernel,'KERNEL32.DLL'
-
-	 import kernel,\
-	    GetProcAddress,'GetProcAddress',\
-	    LoadLibrary,'LoadLibraryA',\
-	    ExitProcess,'ExitProcess'
+; Hyperion 64-Bit container.exe
+
+include 'image_base.inc'
+include 'main_prolog.inc' ;format PE64 ...
+entry start
+
+include '..\..\..\Fasm\INCLUDE\win64a.inc'
+include 'pe.inc'
+;automatically generated by hyperion cpp stub
+include 'key_size.inc'
+include 'infile_size.inc'
+include 'image_size.inc'
+;---
+
+SIZE_DATA_SECTION_NAME	equ 5
+SIZE_CHECKSUM		equ 4
+
+;this contains the decrypted and loaded executable
+section '.bss' data readable writeable
+
+	 decrypted_infile: db IMAGE_SIZE dup (?)
+
+;--------------------------------------------------
+
+;this contains the encrypted exe
+section '.data' data readable writeable
+
+	 encrypted_infile: include 'infile_array.inc'
+
+;--------------------------------------------------
+
+section '.text' code readable executable
+
+
+;automatically generated by hyperion cpp stub
+include 'logfile_select.asm'
+include 'decryption_payload.asm'
+;pe loader functions
+include 'loadexecutable.asm'
+
+;---
+
+start:
+	 sub rsp,8
+	 fastcall MainMethod
+	 test rax,rax
+	 jz the_end_my_friend
+	 ;file was loaded, execute it
+	 add rsp,8
+	 jmp rax
+the_end_my_friend:
+	 invoke ExitProcess,0
+
+proc MainMethod uses rbx
+	 local str1[256]:BYTE
+
+	 ;create logfile and write initial message into it
+	 initLogFile main_exit
+
+	 ;decrypt exe in data section
+	 fastcall decryptExecutable, encrypted_infile
+	 test rax,rax
+	 jz main_exiterror
+
+	 ;load the executable at its image base
+	 ;(this will overwrite current MZ header and bss section)
+	 fastcall loadExecutable, encrypted_infile
+	 test rax,rax
+	 jz main_exiterror
+
+	 ;start program execution
+	 mov rdx,IMAGE_BASE
+	 xor rax,rax
+	 mov eax,[rdx+IMAGE_DOS_HEADER.e_lfanew]
+	 add rax,rdx
+	 add rax,4
+	 ;image file header now in eax
+	 add rax,sizeof.IMAGE_FILE_HEADER
+	 xor rdx,rdx
+	 mov edx,[rax+IMAGE_OPTIONAL_HEADER64.AddressOfEntryPoint]
+	 mov rax,IMAGE_BASE
+	 add rdx,rax
+	 ;entry point of original exe is now in rbx
+	 mov rbx,rdx
+
+;finished without errors
+main_exitsuccess:
+	 writeNewLineToLog main_exit
+	 createStringDone str1
+	 writeLog rax, main_exit
+	 mov rax,rbx
+	 jmp main_exit
+
+;finished with errors after logfile API loading
+main_exiterror:
+	 writeNewLineToLog main_exit
+	 createStringError str1
+	 writeLog rax, main_exit
+	 sub rax,rax
+
+main_exit:
+	 ret
+
+endp
+
+;import table
+section '.idata' import data readable writeable
+
+	 library kernel,'KERNEL32.DLL'
+
+	 import kernel,\
+	    LoadLibrary,'LoadLibraryA',\
+	    GetProcAddress,'GetProcAddress',\
+	    GetFileSize,'GetFileSize',\
+	    CreateFileMapping,'CreateFileMappingA',\
+	    MapViewOfFile,'MapViewOfFile',\
+	    UnmapViewOfFile,'UnmapViewOfFile',\
+	    CreateFile,'CreateFileA',\
+	    CloseHandle,'CloseHandle',\
+	    DeleteFile,'DeleteFileA',\
+	    GetModuleHandle,'GetModuleHandle',\
+	    VirtualAlloc,'VirtualAlloc',\
+	    VirtualProtect,'VirtualProtect',\
+	    VirtualFree,'VirtualFree',\
+	    ExitProcess,'ExitProcess'
diff --git a/Src/Container/64/pe.inc b/Src/Container/64/pe.inc
old mode 100755
new mode 100644
diff --git a/Src/Crypter/aes.c b/Src/Crypter/aes.c
old mode 100755
new mode 100644
diff --git a/Src/Crypter/encryption.c b/Src/Crypter/encryption.c
old mode 100755
new mode 100644
index 89cd42d..6c5568c
--- a/Src/Crypter/encryption.c
+++ b/Src/Crypter/encryption.c
@@ -1,5 +1,10 @@
 #include "hyperion.h"
 
+#define CBC 0
+#define CTR 0
+#define ECB 1
+#include <aes.h>
+
 #include <time.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -50,22 +55,13 @@ BOOL encryptFile(uint8_t* input_file, unsigned int file_size,
  * (e.g. if the AES APIs could not been loaded).
  */
 BOOL encryptAES(uint8_t* input, unsigned int size, uint8_t* key){
-        //load the dll and the encryption api
-        //parameter: size, cleartext, encrypted text, key
-        HINSTANCE hDLL = LoadLibrary(AES_DLL);
-        if(!hDLL) {
-                fprintf(stderr, "Could not load %s\n", AES_DLL);
-                return FALSE;
-        }
-        void (__stdcall *aesEncrypt)(uint32_t, uint8_t*, uint8_t*, uint8_t*) =
-                (void (__stdcall *)(uint32_t, uint8_t*, uint8_t*, uint8_t*))
-                GetProcAddress(hDLL, AES_ENCRYPT_API);
-        if(!aesEncrypt) {
-                fprintf(stderr, "Could not load %s()\n", AES_ENCRYPT_API);
-                return FALSE;
-        }
+		int i;
+		struct AES_ctx ctx;
+		AES_init_ctx(&ctx, key);
 
-        //call the encryption api and do the encryption
-        aesEncrypt(size, input, input, key);
+		for (i = 0; i < size; i+=AES_BLOCKLEN)
+		{
+			AES_ECB_encrypt(&ctx, input + i);
+		}
         return TRUE;
 }
diff --git a/Src/Crypter/fasmoutput.c b/Src/Crypter/fasmoutput.c
index f6396ca..c1f17a3 100644
--- a/Src/Crypter/fasmoutput.c
+++ b/Src/Crypter/fasmoutput.c
@@ -52,22 +52,22 @@ BOOL fasmEncryptOutput(const char* output_dir, struct OpenFile* input_file,
                 return FALSE;
         }
 
-        strlcat(fasm_output, "db ", fasm_output_size);
+        strlcat(fasm_output, "db ", fasm_output_size);
         unsigned int fasm_output_pointer = strlen(fasm_output);
         for(unsigned int i=0; i<encrypted_size; i++) {
                 char sin[MAX_CHAR_SIZE];
                 sin[0] = 0;
                 sprintf(sin, "0x%x", encrypted_input[i]);
 
-                if(i!=(encrypted_size-1)){
-                        strlcat(sin, ", ", sizeof(sin));
+                if(i!=(encrypted_size-1)){
+                        strlcat(sin, ", ", sizeof(sin));
                 }
-                if(i!=0 && i%10==0){
-                        strlcat(sin, "\\\r\n", sizeof(sin));
+                if(i!=0 && i%10==0){
+                        strlcat(sin, "\\\r\n", sizeof(sin));
                 }
 
-                //strcat(fasm_output, sin);
-                memcpy(&(fasm_output[fasm_output_pointer]), sin, strlen(sin)+1);
+                //strcat(fasm_output, sin);
+                memcpy(&(fasm_output[fasm_output_pointer]), sin, strlen(sin)+1);
                 fasm_output_pointer+=strlen(sin);
         }
         free(encrypted_input);
@@ -153,3 +153,46 @@ BOOL fasmInclude(const char* output_dir, const char* file_name,
                 return TRUE;
         }
 }
+
+BOOL fasmHeader(BOOL guiApp, BOOL pe32plus){
+        //create output
+        char output_buffer[MAX_CHAR_SIZE];
+        output_buffer[0] = 0;
+        if(pe32plus){
+            strlcat(output_buffer, "format PE64 ", MAX_CHAR_SIZE);
+        }
+        else{
+            strlcat(output_buffer, "format PE ", MAX_CHAR_SIZE);
+        }
+
+        if(guiApp){
+            strlcat(output_buffer, "GUI ", MAX_CHAR_SIZE);
+        }
+        else{
+            strlcat(output_buffer, "console ", MAX_CHAR_SIZE);
+        }
+
+        if(pe32plus){
+            strlcat(output_buffer, "5.0 at IMAGE_BASE", MAX_CHAR_SIZE);
+        }
+        else{
+            strlcat(output_buffer, "4.0 at IMAGE_BASE", MAX_CHAR_SIZE);
+        }
+
+        //write output to file
+        char full_output_name[MAX_CHAR_SIZE];
+        full_output_name[0] = 0;
+        strlcat(full_output_name, (pe32plus ? CONTAINER64_DIR : CONTAINER32_DIR), 
+                MAX_CHAR_SIZE);
+        strlcat(full_output_name, MAIN_PROLOG_FILENAME, MAX_CHAR_SIZE);
+        if(!memToFile(full_output_name, output_buffer, strlen(output_buffer),
+                      FALSE)) {
+                fprintf(stderr, "Could not write include file %s\n",
+                        full_output_name);
+                return FALSE;
+        }
+        else{
+                verbose("%s written to %s\n", output_buffer, full_output_name);
+                return TRUE;
+        }
+}
diff --git a/Src/Crypter/fasmoutput.h b/Src/Crypter/fasmoutput.h
old mode 100755
new mode 100644
index 5b15979..705a8fc
--- a/Src/Crypter/fasmoutput.h
+++ b/Src/Crypter/fasmoutput.h
@@ -13,6 +13,7 @@
 #define IMAGE_BASE_FILENAME "image_base.inc"
 #define INFILE_ARRAY_FILENAME "infile_array.inc"
 #define INFILE_SIZE_FILENAME "infile_size.inc"
+#define MAIN_PROLOG_FILENAME "main_prolog.inc"
 
 #define LOG_ENABLE_FILENAME "logfile_enable.asm"
 #define LOG_DISABLE_FILENAME "logfile_disable.asm"
diff --git a/Src/Crypter/fileaccess.c b/Src/Crypter/fileaccess.c
old mode 100755
new mode 100644
diff --git a/Src/Crypter/hyperion.c b/Src/Crypter/hyperion.c
index 32b503d..72ed5f7 100644
--- a/Src/Crypter/hyperion.c
+++ b/Src/Crypter/hyperion.c
@@ -1,7 +1,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <windows.h>
+#include <windows.h>
 #include <inttypes.h>
 
 #include "hyperion.h"
@@ -11,7 +11,7 @@ extern BOOL display_verbose;
 int main(int argc, char *argv[]){
         if(argc<3) {
                 printf("Hyperion PE-Crypter\n");
-                printf("Version 2.0 by Christian Ammann\n");
+                printf("Version 2.3.1 by Christian Ammann\n");
                 printf("Http://www.phobosys.de/hyperion\n");
                 printf("\n");
                 printf("Usage: hyperion.exe <options> <infile> <outfile>\n");
@@ -94,9 +94,13 @@ int main(int argc, char *argv[]){
 
         //we need these later when we generate the asm code
         struct PEData pe_data;
+        pe_data.ImageBase32 = 0;
+        pe_data.ImageBase64 = 0;
         const char* container_directory;
 
         BOOL pe32 = isPE32(coff_header);
+        int idd_size = 0;
+        struct ImageDataDirectory* idd = NULL;
         if(pe32) {
                 verbose("Found 32 bit binary\n");
                 struct OptionalStandardHeader32* osh32 = getOSH32(coff_header);
@@ -106,6 +110,9 @@ int main(int argc, char *argv[]){
                 pe_data.ImageBase32 = owh32->ImageBase;
                 pe_data.SizeOfImage = owh32->SizeOfImage;
                 container_directory = CONTAINER32_DIR;
+                pe_data.GuiApplication = isGuiApplication(owh32->Subsystem);
+                idd = getIDD32(owh32);
+                idd_size = owh32->NumberOfRvaAndSizes;
         }
         else{
                 verbose("Found 64 bit binary\n");
@@ -116,6 +123,21 @@ int main(int argc, char *argv[]){
                 pe_data.ImageBase64 = owh64->ImageBase;
                 pe_data.SizeOfImage = owh64->SizeOfImage;
                 container_directory = CONTAINER64_DIR;
+                pe_data.GuiApplication = isGuiApplication(owh64->Subsystem);
+                idd = getIDD64(owh64);
+                idd_size = owh64->NumberOfRvaAndSizes;
+        }
+
+        //abort if input is a .NET executable
+        if(idd_size >= CLR_RUNTIME_HEADER_INDEX){
+            uint32_t va = idd[CLR_RUNTIME_HEADER_INDEX].VirtualAddress;
+            uint32_t size= idd[CLR_RUNTIME_HEADER_INDEX].Size;
+
+            if(va != 0 && size != 0){
+                fprintf(stderr, "Aborting because input file seems to be a .NET executable\n");
+                fprintf(stderr, "See \"Encryption of .NET Executables\" on nullsecurity.net for details\n");
+                goto error;
+            }
         }
 
         //create decryption stub
@@ -125,6 +147,12 @@ int main(int argc, char *argv[]){
         verbose(" -------------------------------\n");
         verbose("\n");
 
+        //generates something like: format PE console 4.0 at IMAGE_BASE
+        if(!fasmHeader(pe_data.GuiApplication, !pe32))
+        {
+                goto error;
+        }
+
         //encrypt input file and create fasm array
         if(!fasmEncryptOutput(container_directory, &open_file, key_length,
                               key_space))
@@ -248,6 +276,15 @@ int main(int argc, char *argv[]){
             printf("\nDone :-)\n");
         }
 
+        //warning for deprecation
+        if(pe32) {
+            printf("############################################\n");
+            printf("# Warning: You encrypted a 32 bit PE file. #\n");
+            printf("# 32 bit support is not maintained anymore #\n");
+            printf("# since release 2.3                        #\n");
+            printf("############################################\n");
+        }
+
         // Close the handles.
         CloseHandle( process_info.hProcess );
         CloseHandle( process_info.hThread );
diff --git a/Src/Crypter/hyperion.h b/Src/Crypter/hyperion.h
old mode 100755
new mode 100644
index a2dd60f..78eba1a
--- a/Src/Crypter/hyperion.h
+++ b/Src/Crypter/hyperion.h
@@ -25,6 +25,7 @@ struct PEData {
         uint32_t ImageBase32;
         uint64_t ImageBase64;
         uint32_t SizeOfImage;
+        BOOL GuiApplication;
 };
 
 //verbose api
@@ -39,10 +40,13 @@ BOOL memToFile(const char* file_name, char* content, unsigned long size,
 struct CoffHeader* getCoffHeader(struct OpenFile* input_file);
 BOOL isExecutable(struct CoffHeader* coff_header);
 BOOL isPE32(struct CoffHeader* coff_header);
+BOOL isGuiApplication(uint16_t subsystem);
 struct OptionalStandardHeader32* getOSH32(struct CoffHeader* coff_ptr);
 struct OptionalStandardHeader64* getOSH64(struct CoffHeader* coff_ptr);
 struct OptionalWindowsHeader32* getOWH32(struct OptionalStandardHeader32* os_ptr);
 struct OptionalWindowsHeader64* getOWH64(struct OptionalStandardHeader64* os_ptr);
+struct ImageDataDirectory* getIDD32(struct OptionalWindowsHeader32* owh_ptr);
+struct ImageDataDirectory* getIDD64(struct OptionalWindowsHeader64* owh_ptr);
 
 //fasm api
 BOOL fasmDefine(const char* output_dir, const char* filename,
@@ -51,6 +55,7 @@ BOOL fasmInclude(const char* output_dir, const char* filename,
                 const char* label, BOOL append);
 BOOL fasmEncryptOutput(const char* output_dir, struct OpenFile* input_file,
                        unsigned int key_length, unsigned int key_space);
+BOOL fasmHeader(BOOL guiApp, BOOL pe32plus);
 
 //encryption api
 uint32_t getChecksum(unsigned char* data, unsigned int size);
diff --git a/Src/Crypter/pe.h b/Src/Crypter/pe.h
old mode 100755
new mode 100644
index 8e60492..a1c09bf
--- a/Src/Crypter/pe.h
+++ b/Src/Crypter/pe.h
@@ -1,120 +1,125 @@
-#ifndef PE_H_INCLUDED
-#define PE_H_INCLUDED
-
-#include "stdint.h"
-
-#define MZ_SIGNATURE "MZ"
-#define MZ_SIGNATURE_SIZE 2
-#define PE_SIGNATURE "PE\0\0"
-#define PE_SIGNATURE_SIZE 4
-#define OPTIONAL_HEADER_MAGIC_PE32 0x10b
-#define OPTIONAL_HEADER_MAGIC_PE64 0x20b
-#define SECTION_NAME_SIZE 8
-#define IMAGE_BASE_ALIGNMENT 0x10000
-
-struct MZHeader {
-        uint8_t signature[MZ_SIGNATURE_SIZE];
-        uint8_t data[0x3a];
-        uint32_t ptrPE;
-};
-
-struct CoffHeader {
-        uint16_t Machine;
-        uint16_t NumberOfSections;
-        uint32_t TimeDateStamp;
-        uint32_t PointerToSymbolTable;
-        uint32_t NumberOfSymbols;
-        uint16_t SizeOfOptionalHeader;
-        uint16_t Characteristics;
-};
-
-struct OptionalStandardHeader32 {
-        uint16_t Magic;
-        uint8_t MajorLinkerVersion;
-        uint8_t MinorLinkerVersion;
-        uint32_t SizeOfCode;
-        uint32_t SizeOfInitializedData;
-        uint32_t SizeOfUninitializedData;
-        uint32_t AddressOfEntryPoint;
-        uint32_t BaseOfCode;
-        uint32_t BaseOfData;
-};
-
-struct OptionalStandardHeader64 {
-        uint16_t Magic;
-        uint8_t MajorLinkerVersion;
-        uint8_t MinorLinkerVersion;
-        uint32_t SizeOfCode;
-        uint32_t SizeOfInitializedData;
-        uint32_t SizeOfUninitializedData;
-        uint32_t AddressOfEntryPoint;
-        uint32_t BaseOfCode;
-};
-
-struct OptionalWindowsHeader32 {
-        uint32_t ImageBase; //plus
-        uint32_t SectionAlignment;
-        uint32_t FileAlignment;
-        uint16_t MajorOperatingSystemVersion;
-        uint16_t MinorOperatingSystemVersion;
-        uint16_t MajorImageVersion;
-        uint16_t MinorImageVersion;
-        uint16_t MajorSubsystemVersion;
-        uint16_t MinorSubsystemVersion;
-        uint32_t Win32VersionValue;
-        uint32_t SizeOfImage;
-        uint32_t SizeOfHeaders;
-        uint32_t CheckSum;
-        uint16_t Subsystem;
-        uint16_t DllCharacteristics;
-        uint32_t SizeOfStackReserve; //plus
-        uint32_t SizeOfStackCommit; //plus
-        uint32_t SizeOfHeapReserve; //plus
-        uint32_t SizeOfHeapCommit; //plus
-        uint32_t LoaderFlags;
-        uint32_t NumberOfRvaAndSizes;
-};
-
-struct OptionalWindowsHeader64 {
-        uint64_t ImageBase; //plus
-        uint32_t SectionAlignment;
-        uint32_t FileAlignment;
-        uint16_t MajorOperatingSystemVersion;
-        uint16_t MinorOperatingSystemVersion;
-        uint16_t MajorImageVersion;
-        uint16_t MinorImageVersion;
-        uint16_t MajorSubsystemVersion;
-        uint16_t MinorSubsystemVersion;
-        uint32_t Win32VersionValue;
-        uint32_t SizeOfImage;
-        uint32_t SizeOfHeaders;
-        uint32_t CheckSum;
-        uint16_t Subsystem;
-        uint16_t DllCharacteristics;
-        uint64_t SizeOfStackReserve; //plus
-        uint64_t SizeOfStackCommit; //plus
-        uint64_t SizeOfHeapReserve; //plus
-        uint64_t SizeOfHeapCommit; //plus
-        uint32_t LoaderFlags;
-        uint32_t NumberOfRvaAndSizes;
-};
-
-struct ImageDataDirectory {
-        uint32_t VirtualAddress;
-        uint32_t Size;
-};
-
-struct SectionHeader {
-        uint8_t Name[SECTION_NAME_SIZE];
-        uint32_t VirtualSize;
-        uint32_t VirtualAddress;
-        uint32_t SizeOfRawData;
-        uint32_t PointerToRawData;
-        uint32_t PointerToRelocations;
-        uint32_t PointerToLinenumbers;
-        uint16_t NumberOfRelocations;
-        uint16_t NumberOfLinenumbers;
-        uint32_t Characteristics;
-};
-
-#endif // PE_H_INCLUDED
+#ifndef PE_H_INCLUDED
+#define PE_H_INCLUDED
+
+#include "stdint.h"
+
+#define MZ_SIGNATURE "MZ"
+#define MZ_SIGNATURE_SIZE 2
+#define PE_SIGNATURE "PE\0\0"
+#define PE_SIGNATURE_SIZE 4
+#define OPTIONAL_HEADER_MAGIC_PE32 0x10b
+#define OPTIONAL_HEADER_MAGIC_PE64 0x20b
+#define SECTION_NAME_SIZE 8
+#define IMAGE_BASE_ALIGNMENT 0x10000
+
+#define IMAGE_SUBSYSTEM_WINDOWS_GUI 2
+#define IMAGE_SUBSYSTEM_WINDOWS_CUI 3
+
+struct MZHeader {
+        uint8_t signature[MZ_SIGNATURE_SIZE];
+        uint8_t data[0x3a];
+        uint32_t ptrPE;
+};
+
+struct CoffHeader {
+        uint16_t Machine;
+        uint16_t NumberOfSections;
+        uint32_t TimeDateStamp;
+        uint32_t PointerToSymbolTable;
+        uint32_t NumberOfSymbols;
+        uint16_t SizeOfOptionalHeader;
+        uint16_t Characteristics;
+};
+
+struct OptionalStandardHeader32 {
+        uint16_t Magic;
+        uint8_t MajorLinkerVersion;
+        uint8_t MinorLinkerVersion;
+        uint32_t SizeOfCode;
+        uint32_t SizeOfInitializedData;
+        uint32_t SizeOfUninitializedData;
+        uint32_t AddressOfEntryPoint;
+        uint32_t BaseOfCode;
+        uint32_t BaseOfData;
+};
+
+struct OptionalStandardHeader64 {
+        uint16_t Magic;
+        uint8_t MajorLinkerVersion;
+        uint8_t MinorLinkerVersion;
+        uint32_t SizeOfCode;
+        uint32_t SizeOfInitializedData;
+        uint32_t SizeOfUninitializedData;
+        uint32_t AddressOfEntryPoint;
+        uint32_t BaseOfCode;
+};
+
+struct OptionalWindowsHeader32 {
+        uint32_t ImageBase; //plus
+        uint32_t SectionAlignment;
+        uint32_t FileAlignment;
+        uint16_t MajorOperatingSystemVersion;
+        uint16_t MinorOperatingSystemVersion;
+        uint16_t MajorImageVersion;
+        uint16_t MinorImageVersion;
+        uint16_t MajorSubsystemVersion;
+        uint16_t MinorSubsystemVersion;
+        uint32_t Win32VersionValue;
+        uint32_t SizeOfImage;
+        uint32_t SizeOfHeaders;
+        uint32_t CheckSum;
+        uint16_t Subsystem;
+        uint16_t DllCharacteristics;
+        uint32_t SizeOfStackReserve; //plus
+        uint32_t SizeOfStackCommit; //plus
+        uint32_t SizeOfHeapReserve; //plus
+        uint32_t SizeOfHeapCommit; //plus
+        uint32_t LoaderFlags;
+        uint32_t NumberOfRvaAndSizes;
+};
+
+struct OptionalWindowsHeader64 {
+        uint64_t ImageBase; //plus
+        uint32_t SectionAlignment;
+        uint32_t FileAlignment;
+        uint16_t MajorOperatingSystemVersion;
+        uint16_t MinorOperatingSystemVersion;
+        uint16_t MajorImageVersion;
+        uint16_t MinorImageVersion;
+        uint16_t MajorSubsystemVersion;
+        uint16_t MinorSubsystemVersion;
+        uint32_t Win32VersionValue;
+        uint32_t SizeOfImage;
+        uint32_t SizeOfHeaders;
+        uint32_t CheckSum;
+        uint16_t Subsystem;
+        uint16_t DllCharacteristics;
+        uint64_t SizeOfStackReserve; //plus
+        uint64_t SizeOfStackCommit; //plus
+        uint64_t SizeOfHeapReserve; //plus
+        uint64_t SizeOfHeapCommit; //plus
+        uint32_t LoaderFlags;
+        uint32_t NumberOfRvaAndSizes;
+};
+
+#define RESOURCE_TABLE_INDEX 2
+#define CLR_RUNTIME_HEADER_INDEX 14
+struct ImageDataDirectory {
+        uint32_t VirtualAddress;
+        uint32_t Size;
+};
+
+struct SectionHeader {
+        uint8_t Name[SECTION_NAME_SIZE];
+        uint32_t VirtualSize;
+        uint32_t VirtualAddress;
+        uint32_t SizeOfRawData;
+        uint32_t PointerToRawData;
+        uint32_t PointerToRelocations;
+        uint32_t PointerToLinenumbers;
+        uint16_t NumberOfRelocations;
+        uint16_t NumberOfLinenumbers;
+        uint32_t Characteristics;
+};
+
+#endif // PE_H_INCLUDED
diff --git a/Src/Crypter/pe32.c b/Src/Crypter/pe32.c
old mode 100755
new mode 100644
index 0cd84a3..8e27878
--- a/Src/Crypter/pe32.c
+++ b/Src/Crypter/pe32.c
@@ -17,3 +17,13 @@ struct OptionalWindowsHeader32* getOWH32(struct OptionalStandardHeader32* os_ptr
         return (struct OptionalWindowsHeader32*)
                (((char*) os_ptr) + sizeof(struct OptionalStandardHeader32));
 }
+
+/*
+ * Retrives the DataDirectory List
+ */
+struct ImageDataDirectory* getIDD32(struct OptionalWindowsHeader32* owh_ptr){
+    struct ImageDataDirectory* ret = 
+        (struct ImageDataDirectory*) 
+        (((char*) owh_ptr) + sizeof(struct OptionalWindowsHeader32));
+    return ret;
+}
diff --git a/Src/Crypter/pe64.c b/Src/Crypter/pe64.c
old mode 100755
new mode 100644
index eb197e9..bac3a7d
--- a/Src/Crypter/pe64.c
+++ b/Src/Crypter/pe64.c
@@ -17,3 +17,13 @@ struct OptionalWindowsHeader64* getOWH64(struct OptionalStandardHeader64* os_ptr
         return (struct OptionalWindowsHeader64*)
                (((char*) os_ptr) + sizeof(struct OptionalStandardHeader64));
 }
+
+/*
+ * Retrives the DataDirectory List
+ */
+struct ImageDataDirectory* getIDD64(struct OptionalWindowsHeader64* owh_ptr){
+    struct ImageDataDirectory* ret = 
+        (struct ImageDataDirectory*) 
+        (((char*) owh_ptr) + sizeof(struct OptionalWindowsHeader64));
+    return ret;
+}
diff --git a/Src/Crypter/pe_general.c b/Src/Crypter/pe_general.c
old mode 100755
new mode 100644
index 03fd637..f4784d3
--- a/Src/Crypter/pe_general.c
+++ b/Src/Crypter/pe_general.c
@@ -4,6 +4,23 @@
 
 #include "hyperion.h"
 
+BOOL isGuiApplication(uint16_t subsystem){
+    switch(subsystem){
+        case IMAGE_SUBSYSTEM_WINDOWS_GUI: 
+            verbose("Found gui flag in binary\n");
+            return TRUE;
+            break;
+        case IMAGE_SUBSYSTEM_WINDOWS_CUI: 
+            verbose("Found commandline flag in binary\n");
+            return FALSE;
+            break;
+        default:
+            printf("Unknown subsystem 0x%x, handling binary as gui application\n");
+            return TRUE;
+            break;
+    }
+}
+
 BOOL isExecutable(struct CoffHeader* coff_header){
         if (coff_header==0) {
                 return FALSE;
diff --git a/Src/Crypter/secure_string.c b/Src/Crypter/secure_string.c
old mode 100755
new mode 100644
diff --git a/Src/Crypter/verbose.c b/Src/Crypter/verbose.c
old mode 100755
new mode 100644
diff --git a/Src/Payloads/Aes/32/aes.asm b/Src/Payloads/Aes/32/aes.asm
old mode 100755
new mode 100644
index abb1bd7..08b9be2
--- a/Src/Payloads/Aes/32/aes.asm
+++ b/Src/Payloads/Aes/32/aes.asm
@@ -1,142 +1,138 @@
-include 'sbox.asm'
-include 'rcon.asm'
-include 'keychain.asm'
-include 'encryptionrounds.asm'
-include 'decryptionrounds.asm'
-include 'galois.asm'
-
-;encrypts cleartext and stores the result at enctext
-proc encAES size:DWORD, cleartext_ptr:DWORD, enctext_ptr:DWORD,\
-     aeskey_ptr:DWORD
-
-local keychain[(ENCRYPTION_ROUNDS+1)*BLOCK_SIZE]:BYTE, sbox[SBOX_SIZE]:BYTE,\
-      rcon[RCON_SIZE]:BYTE, galois_mul2[GALOIS_SIZE]:BYTE,\
-      galois_mul3[GALOIS_SIZE]:BYTE, mul2_table_ptr:DWORD,\
-      mul3_table_ptr:DWORD, sbox_ptr:DWORD, keychain_ptr:DWORD,\
-      rcon_ptr:DWORD
-
-    pushad
-    ;sbox and rcon are created in memory
-    ;galois lookup tables too
-    lea eax,[sbox]
-    mov [sbox_ptr], eax
-    stdcall createSBox, eax
-    lea eax,[rcon]
-    mov [rcon_ptr], eax
-    stdcall createRcon, eax
-    lea eax,[galois_mul2]
-    mov [mul2_table_ptr], eax
-    lea ebx,[galois_mul3]
-    mov [mul3_table_ptr], ebx
-    stdcall createGaloisEncryption, eax, ebx
-
-    ;copy the key into the round key buffer
-    mov ecx, KEY_SIZE
-    mov esi, [aeskey_ptr]
-    lea edi, [keychain]
-    mov [keychain_ptr], edi
-    rep movsb
-
-    ;create the round keys
-    stdcall createKeyChain, [keychain_ptr], [sbox_ptr],\
-	    [rcon_ptr]
-
-    ;copy clear text to encryption buffer
-    mov ecx, [size]
-    mov esi, [cleartext_ptr]
-    mov edi, [enctext_ptr]
-    rep movsb
-
-    ;eax == current to be encrypted block
-    ;ebx == end of cleartext
-    mov eax,[enctext_ptr]
-    mov ebx,eax
-    add ebx,[size]
-eaes_block_loop:
-    stdcall encryptionRounds, eax, [keychain_ptr], \
-	    [sbox_ptr], [mul2_table_ptr], [mul3_table_ptr]
-
-    add eax,BLOCK_SIZE
-    cmp eax,ebx
-    jnge eaes_block_loop
-
-    popad
-    mov eax,1
-    ret
-
-endp
-
-;decrypts cleartext and stores the result at enctext
-proc decAES size:DWORD, enctext_ptr:DWORD, cleartext_ptr:DWORD,\
-     aeskey_ptr:DWORD
-
-local keychain[(ENCRYPTION_ROUNDS+1)*BLOCK_SIZE]:BYTE,\
-      sbox[SBOX_SIZE]:BYTE, invert_sbox[SBOX_SIZE]:BYTE,\
-      rcon[RCON_SIZE]:BYTE,\
-      galois_mul9[GALOIS_SIZE]:BYTE, galois_mul11[GALOIS_SIZE]:BYTE, \
-      galois_mul13[GALOIS_SIZE]:BYTE, galois_mul14[GALOIS_SIZE]:BYTE,\
-      mul9_table_ptr:DWORD, mul11_table_ptr:DWORD, mul13_table_ptr:DWORD,\
-      mul14_table_ptr:DWORD, sbox_ptr:DWORD, invert_sbox_ptr:DWORD,\
-      keychain_ptr:DWORD, rcon_ptr:DWORD
-
-    pushad
-    ;sbox, invert sbox
-    ;and rcon are created in memory
-    lea eax,[sbox]
-    mov [sbox_ptr], eax
-    stdcall createSBox, eax
-    lea eax,[rcon]
-    mov [rcon_ptr], eax
-    stdcall createRcon, eax
-    lea eax, [invert_sbox]
-    mov [invert_sbox_ptr], eax
-    stdcall createInvertSBox, eax
-
-    ;create galois lookup tables for
-    ;9, 11, 13 and 14
-    lea eax,[galois_mul9]
-    mov [mul9_table_ptr], eax
-    lea ebx,[galois_mul11]
-    mov [mul11_table_ptr], ebx
-    lea ecx,[galois_mul13]
-    mov [mul13_table_ptr], ecx
-    lea edx,[galois_mul14]
-    mov [mul14_table_ptr], edx
-    stdcall createGaloisDecryption, eax, ebx, ecx, edx
-
-    ;copy the key into the round key buffer
-    mov ecx, KEY_SIZE
-    mov esi, [aeskey_ptr]
-    lea edi, [keychain]
-    mov [keychain_ptr], edi
-    rep movsb
-
-    ;create the round keys
-    stdcall createKeyChain, [keychain_ptr], [sbox_ptr],\
-	    [rcon_ptr]
-
-    ;copy encrypted text to decryption buffer
-    mov ecx, [size]
-    mov esi, [enctext_ptr]
-    mov edi, [cleartext_ptr]
-    rep movsb
-
-    ;eax == current to be decrypted block
-    ;ebx == end of cleartext
-    mov eax,[cleartext_ptr]
-    mov ebx,eax
-    add ebx,[size]
-daes_block_loop:
-    stdcall decryptionRounds, eax, [keychain_ptr],\
-	    [invert_sbox_ptr], [mul9_table_ptr], [mul11_table_ptr],\
-	    [mul13_table_ptr], [mul14_table_ptr]
-
-    add eax,BLOCK_SIZE
-    cmp eax,ebx
-    jnge daes_block_loop
-
-    popad
-    mov eax,1
-    ret
-
+include 'sbox.asm'
+include 'rcon.asm'
+include 'keychain.asm'
+include 'encryptionrounds.asm'
+include 'decryptionrounds.asm'
+include 'galois.asm'
+
+;encrypts cleartext and stores the result at enctext
+proc encAES size:DWORD, cleartext_ptr:DWORD, enctext_ptr:DWORD,\
+     aeskey_ptr:DWORD
+
+local keychain[(ENCRYPTION_ROUNDS+1)*BLOCK_SIZE]:BYTE, sbox[SBOX_SIZE]:BYTE,\
+      rcon[RCON_SIZE]:BYTE, galois_mul2[GALOIS_SIZE]:BYTE,\
+      galois_mul3[GALOIS_SIZE]:BYTE, mul2_table_ptr:DWORD,\
+      mul3_table_ptr:DWORD, sbox_ptr:DWORD, keychain_ptr:DWORD,\
+      rcon_ptr:DWORD
+
+    ;sbox and rcon are created in memory
+    ;galois lookup tables too
+    lea eax,[sbox]
+    mov [sbox_ptr], eax
+    stdcall createSBox, eax
+    lea eax,[rcon]
+    mov [rcon_ptr], eax
+    stdcall createRcon, eax
+    lea eax,[galois_mul2]
+    mov [mul2_table_ptr], eax
+    lea ebx,[galois_mul3]
+    mov [mul3_table_ptr], ebx
+    stdcall createGaloisEncryption, eax, ebx
+
+    ;copy the key into the round key buffer
+    mov ecx, KEY_SIZE
+    mov esi, [aeskey_ptr]
+    lea edi, [keychain]
+    mov [keychain_ptr], edi
+    rep movsb
+
+    ;create the round keys
+    stdcall createKeyChain, [keychain_ptr], [sbox_ptr],\
+	    [rcon_ptr]
+    mov eax, [keychain_ptr]
+    ;int 3
+
+    ;copy clear text to encryption buffer
+    mov ecx, [size]
+    mov esi, [cleartext_ptr]
+    mov edi, [enctext_ptr]
+    rep movsb
+
+    ;eax == current to be encrypted block
+    ;ebx == end of cleartext
+    mov eax,[enctext_ptr]
+    mov ebx,eax
+    add ebx,[size]
+eaes_block_loop:
+    stdcall encryptionRounds, eax, [keychain_ptr], \
+	    [sbox_ptr], [mul2_table_ptr], [mul3_table_ptr]
+
+    add eax,BLOCK_SIZE
+    cmp eax,ebx
+    jnge eaes_block_loop
+
+    ret
+
+endp
+
+;decrypts cleartext and stores the result at enctext
+proc decAES size:DWORD, enctext_ptr:DWORD, cleartext_ptr:DWORD,\
+     aeskey_ptr:DWORD
+
+local keychain[(ENCRYPTION_ROUNDS+1)*BLOCK_SIZE]:BYTE,\
+      sbox[SBOX_SIZE]:BYTE, invert_sbox[SBOX_SIZE]:BYTE,\
+      rcon[RCON_SIZE]:BYTE,\
+      galois_mul9[GALOIS_SIZE]:BYTE, galois_mul11[GALOIS_SIZE]:BYTE, \
+      galois_mul13[GALOIS_SIZE]:BYTE, galois_mul14[GALOIS_SIZE]:BYTE,\
+      mul9_table_ptr:DWORD, mul11_table_ptr:DWORD, mul13_table_ptr:DWORD,\
+      mul14_table_ptr:DWORD, sbox_ptr:DWORD, invert_sbox_ptr:DWORD,\
+      keychain_ptr:DWORD, rcon_ptr:DWORD
+
+    ;sbox, invert sbox
+    ;and rcon are created in memory
+    lea eax,[sbox]
+    mov [sbox_ptr], eax
+    stdcall createSBox, eax
+    lea eax,[rcon]
+    mov [rcon_ptr], eax
+    stdcall createRcon, eax
+    lea eax, [invert_sbox]
+    mov [invert_sbox_ptr], eax
+    stdcall createInvertSBox, eax
+
+    ;create galois lookup tables for
+    ;9, 11, 13 and 14
+    lea eax,[galois_mul9]
+    mov [mul9_table_ptr], eax
+    lea ebx,[galois_mul11]
+    mov [mul11_table_ptr], ebx
+    lea ecx,[galois_mul13]
+    mov [mul13_table_ptr], ecx
+    lea edx,[galois_mul14]
+    mov [mul14_table_ptr], edx
+    stdcall createGaloisDecryption, eax, ebx, ecx, edx
+
+    ;copy the key into the round key buffer
+    mov ecx, KEY_SIZE
+    mov esi, [aeskey_ptr]
+    lea edi, [keychain]
+    mov [keychain_ptr], edi
+    rep movsb
+
+    ;create the round keys
+    stdcall createKeyChain, [keychain_ptr], [sbox_ptr],\
+	    [rcon_ptr]
+
+    ;copy encrypted text to decryption buffer
+    mov ecx, [size]
+    mov esi, [enctext_ptr]
+    mov edi, [cleartext_ptr]
+    rep movsb
+
+    ;eax == current to be decrypted block
+    ;ebx == end of cleartext
+    mov eax,[cleartext_ptr]
+    mov ebx,eax
+    add ebx,[size]
+daes_block_loop:
+    stdcall decryptionRounds, eax, [keychain_ptr],\
+	    [invert_sbox_ptr], [mul9_table_ptr], [mul11_table_ptr],\
+	    [mul13_table_ptr], [mul14_table_ptr]
+
+    add eax,BLOCK_SIZE
+    cmp eax,ebx
+    jnge daes_block_loop
+
+    ret
+
 endp
\ No newline at end of file
diff --git a/Src/Payloads/Aes/32/aes.inc b/Src/Payloads/Aes/32/aes.inc
old mode 100755
new mode 100644
index 2d52f1c..71c1bd7
--- a/Src/Payloads/Aes/32/aes.inc
+++ b/Src/Payloads/Aes/32/aes.inc
@@ -1,7 +1,7 @@
 ;select an AES mode
-AES128			equ 1
-;AES192                  equ 1
-;AES256                  equ 1
+AES128 		 equ 1
+;AES192 		 equ 1
+;AES256			equ 1
 
 ;internal constants, don't change them
 include 'aes_constants_intern.inc'
\ No newline at end of file
diff --git a/Src/Payloads/Aes/32/aes_constants_intern.inc b/Src/Payloads/Aes/32/aes_constants_intern.inc
old mode 100755
new mode 100644
diff --git a/Src/Payloads/Aes/32/decryptexecutable.asm b/Src/Payloads/Aes/32/decryptexecutable.asm
old mode 100755
new mode 100644
index a88ef19..774d014
--- a/Src/Payloads/Aes/32/decryptexecutable.asm
+++ b/Src/Payloads/Aes/32/decryptexecutable.asm
@@ -1,104 +1,104 @@
-;Decrypt the exe which is stored in input_image
-proc decryptExecutable stdcall APITable:DWORD, input_image:DWORD
-
-local str1[256]:BYTE, ret_val:DWORD,\
-key[KEY_SIZE]:BYTE, encrypted_backup:DWORD
-
-	pushad
-	writeWithNewLine createStringBruteforcing, str1, dec_exit_success
-	
-	;init key
-	lea edi,[key]
-	mov ecx, KEY_SIZE
-	mov al,0
-dec_init_key:
-	mov [edi],al
-	inc edi
-	dec ecx
-	jnz dec_init_key
-
-	;create a copy of the encrypted file
-	;which is used to brute force the key
-	mov eax,[APITable]
-	stdcall dword [eax+VirtualAlloc], 0, INFILE_SIZE, MEM_COMMIT+MEM_RESERVE, PAGE_READWRITE
-	test eax, eax
-	jz dec_exit_error
-	mov [encrypted_backup],eax
-	;now copy the file into the buffer
-	mov edi,eax
-	mov esi,[input_image]
-	mov ecx,INFILE_SIZE
-	;we can mov dwords because buffer is a multiple of 16
-	shr ecx,2
-	repz movsd
-
-keyspace_loop:
-	lea eax,[key]
-	stdcall decAES, INFILE_SIZE, [input_image], [input_image], eax
-	stdcall verifyChecksum, [input_image], INFILE_SIZE
-	test eax,eax
-	jnz dec_decrypted_success
-
-	;restore the encrypted version to try the next key
-	mov esi,[encrypted_backup]
-	mov edi,[input_image]
-	mov ecx,INFILE_SIZE
-	shr ecx,2
-	repz movsd
-	;lea eax,[key]
-	;stdcall encAES, [section_size],  [section_address],  [section_address], eax
-
-	;next key
-	lea eax,[key]
-	stdcall nextKey, eax
-	test eax,eax
-	jz dec_exit_error
-	;abort if key space was explored, else continue
-	jmp keyspace_loop
-
-dec_decrypted_success:
-	mov eax,[APITable]
-	stdcall dword [eax+VirtualFree], [encrypted_backup], 0, MEM_RELEASE
-	test eax, eax
-	jz dec_exit_error
-
-dec_exit_success:
-	popad
-	mov eax,1
-	ret
-
-dec_exit_error:
-	popad
-	sub eax,eax
-	ret
-
-endp
-
-;generate next decryption key
-proc nextKey stdcall key_ptr:DWORD
-
-	push ebx
-	mov eax,[key_ptr]
-	mov ebx,eax
-	add ebx,REAL_KEY_SIZE
-nkey_next_element:
-	inc byte [eax]
-	cmp byte [eax],REAL_KEY_RANGE
-	jne nkey_not_finished
-	mov byte [eax],0
-	inc eax
-	cmp eax,ebx
-	je nkey_finished
-	jmp nkey_next_element
-
-nkey_not_finished:
-	pop ebx
-	mov eax,1
-	ret
-
-nkey_finished:
-	pop ebx
-	sub eax,eax
-	ret
-
-endp;
+;Decrypt the exe which is stored in input_image
+proc decryptExecutable stdcall APITable:DWORD, input_image:DWORD
+
+local str1[256]:BYTE, ret_val:DWORD,\
+key[KEY_SIZE]:BYTE, encrypted_backup:DWORD
+
+	pushad
+	writeWithNewLine createStringBruteforcing, str1, dec_exit_success
+	
+	;init key
+	lea edi,[key]
+	mov ecx, KEY_SIZE
+	mov al,0
+dec_init_key:
+	mov [edi],al
+	inc edi
+	dec ecx
+	jnz dec_init_key
+
+	;create a copy of the encrypted file
+	;which is used to brute force the key
+	mov eax,[APITable]
+	stdcall dword [eax+VirtualAlloc], 0, INFILE_SIZE, MEM_COMMIT+MEM_RESERVE, PAGE_READWRITE
+	test eax, eax
+	jz dec_exit_error
+	mov [encrypted_backup],eax
+	;now copy the file into the buffer
+	mov edi,eax
+	mov esi,[input_image]
+	mov ecx,INFILE_SIZE
+	;we can mov dwords because buffer is a multiple of 16
+	shr ecx,2
+	repz movsd
+
+keyspace_loop:
+	lea eax,[key]
+	stdcall decAES, INFILE_SIZE, [input_image], [input_image], eax
+	stdcall verifyChecksum, [input_image], INFILE_SIZE
+	test eax,eax
+	jnz dec_decrypted_success
+
+	;restore the encrypted version to try the next key
+	mov esi,[encrypted_backup]
+	mov edi,[input_image]
+	mov ecx,INFILE_SIZE
+	shr ecx,2
+	repz movsd
+	;lea eax,[key]
+	;stdcall encAES, [section_size],  [section_address],  [section_address], eax
+
+	;next key
+	lea eax,[key]
+	stdcall nextKey, eax
+	test eax,eax
+	jz dec_exit_error
+	;abort if key space was explored, else continue
+	jmp keyspace_loop
+
+dec_decrypted_success:
+	mov eax,[APITable]
+	stdcall dword [eax+VirtualFree], [encrypted_backup], 0, MEM_RELEASE
+	test eax, eax
+	jz dec_exit_error
+
+dec_exit_success:
+	popad
+	mov eax,1
+	ret
+
+dec_exit_error:
+	popad
+	sub eax,eax
+	ret
+
+endp
+
+;generate next decryption key
+proc nextKey stdcall key_ptr:DWORD
+
+	push ebx
+	mov eax,[key_ptr]
+	mov ebx,eax
+	add ebx,REAL_KEY_SIZE
+nkey_next_element:
+	inc byte [eax]
+	cmp byte [eax],REAL_KEY_RANGE
+	jne nkey_not_finished
+	mov byte [eax],0
+	inc eax
+	cmp eax,ebx
+	je nkey_finished
+	jmp nkey_next_element
+
+nkey_not_finished:
+	pop ebx
+	mov eax,1
+	ret
+
+nkey_finished:
+	pop ebx
+	sub eax,eax
+	ret
+
+endp;
diff --git a/Src/Payloads/Aes/32/decryptionrounds.asm b/Src/Payloads/Aes/32/decryptionrounds.asm
old mode 100755
new mode 100644
index 027a386..3fa93a6
--- a/Src/Payloads/Aes/32/decryptionrounds.asm
+++ b/Src/Payloads/Aes/32/decryptionrounds.asm
@@ -1,168 +1,174 @@
-;uses the generated round keys to decrypt an aes block
-proc decryptionRounds decryption_ptr:DWORD,\
-     roundkeys_ptr:DWORD, inverse_sbox_ptr:DWORD, mul9_table_ptr:DWORD, \
-     mul11_table_ptr:DWORD, mul13_table_ptr:DWORD,\
-     mul14_table_ptr:DWORD
-
-    pushad
-
-    ;roundkey and decryption in eax and ebx
-    mov eax, [roundkeys_ptr]
-    add eax, BLOCK_SIZE*ENCRYPTION_ROUNDS
-    mov ebx, [decryption_ptr]
-
-    ;final round
-    stdcall addRoundKey, ebx, eax
-    stdcall inverseShiftRows, ebx
-    stdcall subBlockBytes, ebx, [inverse_sbox_ptr]
-    sub eax,BLOCK_SIZE
-
-    ;main round
-dr_main:
-    stdcall addRoundKey, ebx, eax
-    stdcall mixColumns9111314, ebx, [mul9_table_ptr], [mul11_table_ptr],\
-	    [mul13_table_ptr], [mul14_table_ptr]
-    stdcall inverseShiftRows, ebx
-    stdcall subBlockBytes, ebx, [inverse_sbox_ptr]
-    sub eax, BLOCK_SIZE
-    cmp eax, [roundkeys_ptr]
-    jne dr_main
-
-    ;initial_round
-    stdcall addRoundKey, ebx, eax
-
-    popad
-    ret
-endp
-
-;mix columns operation is a column matrix
-;multiplication
-proc mixColumns9111314, data_ptr:DWORD, mul9_table_ptr:DWORD,\
-     mul11_table_ptr:DWORD, mul13_table_ptr:DWORD, mul14_table_ptr:DWORD
-
-     local current_column:DWORD
-
-    push edx
-    push eax
-    push ebx
-    push ecx
-    mov edx, [data_ptr]
-
-    rept 4{
-    ;element 3
-    mov eax, [edx]
-    mov ebx, [mul9_table_ptr]
-    xlatb
-    mov cl, al
-    shr eax,8
-    mov ebx, [mul13_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax,8
-    mov ebx, [mul11_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax,8
-    mov ebx, [mul14_table_ptr]
-    xlatb
-    xor cl, al
-    mov [current_column], ecx
-    ;element 2
-    mov eax, [edx]
-    mov ebx, [mul13_table_ptr]
-    xlatb
-    mov cl, al
-    shr eax,8
-    mov ebx, [mul11_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax,8
-    mov ebx, [mul14_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax,8
-    mov ebx, [mul9_table_ptr]
-    xlatb
-    xor cl, al
-    mov eax, [current_column]
-    shl eax, 8
-    mov al, cl
-    mov [current_column], eax
-    ;element 1
-    mov eax, [edx]
-    mov ebx, [mul11_table_ptr]
-    xlatb
-    mov cl, al
-    shr eax,8
-    mov ebx, [mul14_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax,8
-    mov ebx, [mul9_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax,8
-    mov ebx, [mul13_table_ptr]
-    xlatb
-    xor cl, al
-    mov eax, [current_column]
-    shl eax, 8
-    mov al, cl
-    mov [current_column], eax
-    ;element 0
-    mov eax, [edx]
-    mov ebx, [mul14_table_ptr]
-    xlatb
-    mov cl, al
-    shr eax,8
-    mov ebx, [mul9_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax,8
-    mov ebx, [mul13_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax,8
-    mov ebx, [mul11_table_ptr]
-    xlatb
-    xor cl, al
-    mov eax, [current_column]
-    shl eax, 8
-    mov al, cl
-    ;finished, store it
-    mov [edx], eax
-    add edx, COLUMN_SIZE
-    }
-
-    pop ecx
-    pop ebx
-    pop eax
-    pop edx
-    ret
-
-endp
-
-;reverse shift operation for decryption
-proc inverseShiftRows, data_ptr:DWORD
-
-    push eax
-    push ebx
-    mov ebx,[data_ptr]
-
-    loadRow
-    rol eax, 8
-    storeRow
-    inc ebx
-    loadRow
-    rol eax, 16
-    storeRow
-    inc ebx
-    loadRow
-    rol eax, 24
-    storeRow
-
-    pop ebx
-    pop eax
-    ret
-
+;uses the generated round keys to decrypt an aes block
+proc decryptionRounds decryption_ptr:DWORD,\
+     roundkeys_ptr:DWORD, inverse_sbox_ptr:DWORD, mul9_table_ptr:DWORD, \
+     mul11_table_ptr:DWORD, mul13_table_ptr:DWORD,\
+     mul14_table_ptr:DWORD
+
+    pushad
+
+    ;roundkey and decryption in eax and ebx
+    mov eax, [roundkeys_ptr]
+    add eax, BLOCK_SIZE*ENCRYPTION_ROUNDS
+    mov ebx, [decryption_ptr]
+
+    ;final round
+    stdcall addRoundKey, ebx, eax
+    stdcall inverseShiftRows, ebx
+    stdcall subBlockBytes, ebx, [inverse_sbox_ptr]
+    sub eax,BLOCK_SIZE
+
+    ;main round
+dr_main:
+    stdcall addRoundKey, ebx, eax
+    stdcall mixColumns9111314, ebx, [mul9_table_ptr], [mul11_table_ptr],\
+	    [mul13_table_ptr], [mul14_table_ptr]
+    stdcall inverseShiftRows, ebx
+    stdcall subBlockBytes, ebx, [inverse_sbox_ptr]
+    sub eax, BLOCK_SIZE
+    cmp eax, [roundkeys_ptr]
+    jne dr_main
+
+    ;initial_round
+    stdcall addRoundKey, ebx, eax
+
+    popad
+    ret
+endp
+
+;mix columns operation is a column matrix
+;multiplication
+proc mixColumns9111314, data_ptr:DWORD, mul9_table_ptr:DWORD,\
+     mul11_table_ptr:DWORD, mul13_table_ptr:DWORD, mul14_table_ptr:DWORD
+
+     local current_column:DWORD
+
+    push edx
+    push eax
+    push ebx
+    push ecx
+    mov edx, [data_ptr]
+
+    rept 4{
+    ;element 3
+    mov eax, [edx]
+    bswap eax
+    mov ebx, [mul9_table_ptr]
+    xlatb
+    mov cl, al
+    shr eax,8
+    mov ebx, [mul13_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax,8
+    mov ebx, [mul11_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax,8
+    mov ebx, [mul14_table_ptr]
+    xlatb
+    xor cl, al
+    mov [current_column], ecx
+    ;element 2
+    mov eax, [edx]
+    bswap eax
+    mov ebx, [mul13_table_ptr]
+    xlatb
+    mov cl, al
+    shr eax,8
+    mov ebx, [mul11_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax,8
+    mov ebx, [mul14_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax,8
+    mov ebx, [mul9_table_ptr]
+    xlatb
+    xor cl, al
+    mov eax, [current_column]
+    shl eax, 8
+    mov al, cl
+    mov [current_column], eax
+    ;element 1
+    mov eax, [edx]
+    bswap eax
+    mov ebx, [mul11_table_ptr]
+    xlatb
+    mov cl, al
+    shr eax,8
+    mov ebx, [mul14_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax,8
+    mov ebx, [mul9_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax,8
+    mov ebx, [mul13_table_ptr]
+    xlatb
+    xor cl, al
+    mov eax, [current_column]
+    shl eax, 8
+    mov al, cl
+    mov [current_column], eax
+    ;element 0
+    mov eax, [edx]
+    bswap eax
+    mov ebx, [mul14_table_ptr]
+    xlatb
+    mov cl, al
+    shr eax,8
+    mov ebx, [mul9_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax,8
+    mov ebx, [mul13_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax,8
+    mov ebx, [mul11_table_ptr]
+    xlatb
+    xor cl, al
+    mov eax, [current_column]
+    shl eax, 8
+    mov al, cl
+    ;finished, store it
+    bswap eax
+    mov [edx], eax
+    add edx, COLUMN_SIZE
+    }
+
+    pop ecx
+    pop ebx
+    pop eax
+    pop edx
+    ret
+
+endp
+
+;reverse shift operation for decryption
+proc inverseShiftRows, data_ptr:DWORD
+
+    push eax
+    push ebx
+    mov ebx,[data_ptr]
+
+    inc ebx
+    stdcall loadRow, ebx
+    rol eax,24
+    stdcall storeRow, eax, ebx
+    inc ebx
+    stdcall loadRow, ebx
+    rol eax,16
+    stdcall storeRow, eax, ebx
+    inc ebx
+    stdcall loadRow, ebx
+    rol eax,8
+    stdcall storeRow, eax, ebx
+
+    pop ebx
+    pop eax
+    ret
+
 endp
\ No newline at end of file
diff --git a/Src/Payloads/Aes/32/encryptionrounds.asm b/Src/Payloads/Aes/32/encryptionrounds.asm
old mode 100755
new mode 100644
index f0e6654..2cfa92a
--- a/Src/Payloads/Aes/32/encryptionrounds.asm
+++ b/Src/Payloads/Aes/32/encryptionrounds.asm
@@ -1,227 +1,254 @@
-;uses the generated round keys to encrypt an aes block
-proc encryptionRounds encryption_ptr:DWORD,\
-     roundkeys_ptr:DWORD, sbox_ptr:DWORD, mul2_table_ptr:DWORD, \
-     mul3_table_ptr:DWORD
-    pushad
-
-    ;roundkey and encryption in eax and ebx
-    mov eax,[roundkeys_ptr]
-    mov ebx,[encryption_ptr]
-
-    ;initial round
-    stdcall addRoundKey, ebx, eax
-
-    ;main round
-    add eax,BLOCK_SIZE
-    mov ecx,ENCRYPTION_ROUNDS - 1
-er_main:
-    stdcall subBlockBytes, ebx, [sbox_ptr]
-    stdcall shiftRows, ebx
-    stdcall mixColumns23, ebx, [mul2_table_ptr], [mul3_table_ptr]
-    stdcall addRoundKey, ebx, eax
-
-    add eax,BLOCK_SIZE
-    dec ecx
-    jnz er_main
-
-    ;final round
-    stdcall subBlockBytes, ebx, [sbox_ptr]
-    stdcall shiftRows, ebx
-    stdcall addRoundKey, ebx, eax
-
-    popad
-    ret
-endp
-
-;mix columns operation is a column matrix
-;multiplication
-proc mixColumns23, data_ptr:DWORD, mul2_table_ptr:DWORD,\
-     mul3_table_ptr:DWORD
-
-     local current_column:DWORD
-
-    push edx
-    push eax
-    push ebx
-    push ecx
-    mov edx, [data_ptr]
-
-    rept 4{
-    ;element 3
-    mov eax, [edx]
-    mov cl, al
-    shr eax,8
-    xor cl, al
-    shr eax,8
-    mov ebx, [mul3_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax,8
-    mov ebx, [mul2_table_ptr]
-    xlatb
-    xor cl, al
-    mov [current_column], ecx
-    ;element 2
-    mov eax, [edx]
-    mov cl, al
-    shr eax, 8
-    mov ebx, [mul3_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax, 8
-    mov ebx, [mul2_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax, 8
-    xor cl, al
-    mov eax, [current_column]
-    shl eax, 8
-    mov al, cl
-    mov [current_column], eax
-    ;element 1
-    mov eax, [edx]
-    mov ebx, [mul3_table_ptr]
-    xlatb
-    mov cl, al
-    shr eax, 8
-    mov ebx, [mul2_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax, 8
-    xor cl, al
-    shr eax, 8
-    xor cl, al
-    mov eax, [current_column]
-    shl eax, 8
-    mov al, cl
-    mov [current_column], eax
-    ;element 0
-    mov eax, [edx]
-    mov ebx, [mul2_table_ptr]
-    xlatb
-    mov cl, al
-    shr eax, 8
-    xor cl, al
-    shr eax, 8
-    xor cl, al
-    shr eax, 8
-    mov ebx, [mul3_table_ptr]
-    xlatb
-    xor cl, al
-    mov eax, [current_column]
-    shl eax, 8
-    mov al, cl
-    ;finished, store it
-    mov [edx], eax
-    add edx, COLUMN_SIZE
-    }
-
-    pop ecx
-    pop ebx
-    pop eax
-    pop edx
-    ret
-
-endp
-
-;shifts the rows as desrcibed in the AES specification
-;the shift process is in the reversed order because of the
-;endiannes
-macro loadRow{
-    mov al, byte [ebx+00]
-    shl eax,8
-    mov al, byte [ebx+04]
-    shl eax,8
-    mov al, byte [ebx+08]
-    shl eax,8
-    mov al, byte [ebx+12]
-}
-
-macro storeRow{
-    mov byte [ebx+12], al
-    shr eax,8
-    mov byte [ebx+08], al
-    shr eax,8
-    mov byte [ebx+04], al
-    shr eax,8
-    mov byte [ebx+00], al
-}
-
-proc shiftRows, data_ptr:DWORD
-
-    push eax
-    push ebx
-    mov ebx,[data_ptr]
-
-    loadRow
-    rol eax, 24
-    storeRow
-    inc ebx
-    loadRow
-    rol eax, 16
-    storeRow
-    inc ebx
-    loadRow
-    rol eax, 8
-    storeRow
-
-    pop ebx
-    pop eax
-    ret
-
-endp
-
-;xors the data with the round key and stores result
-;in data
-proc addRoundKey data_ptr:DWORD, round_key_ptr:DWORD
-
-    push eax
-    push ebx
-    push edx
-
-    mov eax,[data_ptr]
-    mov ebx,[round_key_ptr]
-    rept 4{
-	 mov edx,[eax]
-	 xor edx,[ebx]
-	 mov [eax],edx
-	 add eax,COLUMN_SIZE
-	 add ebx,COLUMN_SIZE
-    }
-
-    pop edx
-    pop ebx
-    pop eax
-    ret
-
-endp
-
-;substitute aes block with s-box
-proc subBlockBytes data_ptr:DWORD, sbox_ptr:DWORD
-
-    push eax
-    push ebx
-    push edx
-    mov ebx, [sbox_ptr]
-    mov edx, [data_ptr]
-
-    rept 4{
-	 mov eax, [edx]
-	 xlatb
-	 ror eax, 8
-	 xlatb
-	 ror eax, 8
-	 xlatb
-	 ror eax, 8
-	 xlatb
-	 ror eax, 8
-	 mov [edx], eax
-	 add edx, COLUMN_SIZE
-    }
-
-    pop edx
-    pop ebx
-    pop eax
-    ret
-
+;uses the generated round keys to encrypt an aes block
+proc encryptionRounds encryption_ptr:DWORD,\
+     roundkeys_ptr:DWORD, sbox_ptr:DWORD, mul2_table_ptr:DWORD, \
+     mul3_table_ptr:DWORD
+    pushad
+
+    ;roundkey and encryption in eax and ebx
+    mov eax,[roundkeys_ptr]
+    mov ebx,[encryption_ptr]
+
+    ;initial round
+    stdcall addRoundKey, ebx, eax
+
+    ;main round
+    add eax,BLOCK_SIZE
+    mov ecx,ENCRYPTION_ROUNDS - 1
+er_main:
+    stdcall subBlockBytes, ebx, [sbox_ptr]
+    stdcall shiftRows, ebx
+    stdcall mixColumns23, ebx, [mul2_table_ptr], [mul3_table_ptr]
+    stdcall addRoundKey, ebx, eax
+
+    add eax,BLOCK_SIZE
+    dec ecx
+    jnz er_main
+
+    ;final round
+    stdcall subBlockBytes, ebx, [sbox_ptr]
+    stdcall shiftRows, ebx
+    stdcall addRoundKey, ebx, eax
+
+    popad
+    ret
+endp
+
+;mix columns operation is a column matrix
+;multiplication
+proc mixColumns23, data_ptr:DWORD, mul2_table_ptr:DWORD,\
+     mul3_table_ptr:DWORD
+
+     local current_column:DWORD
+
+    push edx
+    push eax
+    push ebx
+    push ecx
+    mov edx, [data_ptr]
+
+    rept 4{
+    ;element 3
+    mov eax, [edx]
+    bswap eax
+    mov cl, al
+    shr eax,8
+    xor cl, al
+    shr eax,8
+    mov ebx, [mul3_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax,8
+    mov ebx, [mul2_table_ptr]
+    xlatb
+    xor cl, al
+    mov [current_column], ecx
+    ;element 2
+    mov eax, [edx]
+    bswap eax
+    mov cl, al
+    shr eax, 8
+    mov ebx, [mul3_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax, 8
+    mov ebx, [mul2_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax, 8
+    xor cl, al
+    mov eax, [current_column]
+    shl eax, 8
+    mov al, cl
+    mov [current_column], eax
+    ;element 1
+    mov eax, [edx]
+    bswap eax
+    mov ebx, [mul3_table_ptr]
+    xlatb
+    mov cl, al
+    shr eax, 8
+    mov ebx, [mul2_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax, 8
+    xor cl, al
+    shr eax, 8
+    xor cl, al
+    mov eax, [current_column]
+    shl eax, 8
+    mov al, cl
+    mov [current_column], eax
+    ;element 0
+    mov eax, [edx]
+    bswap eax
+    mov ebx, [mul2_table_ptr]
+    xlatb
+    mov cl, al
+    shr eax, 8
+    xor cl, al
+    shr eax, 8
+    xor cl, al
+    shr eax, 8
+    mov ebx, [mul3_table_ptr]
+    xlatb
+    xor cl, al
+    mov eax, [current_column]
+    shl eax, 8
+    mov al, cl
+    ;finished, store it
+    bswap eax
+    mov [edx], eax
+    add edx, COLUMN_SIZE
+    }
+
+    pop ecx
+    pop ebx
+    pop eax
+    pop edx
+    ret
+
+endp
+
+proc shiftRows, data_ptr:DWORD
+
+    push eax
+    push ebx
+    mov ebx,[data_ptr]
+
+    inc ebx
+    stdcall loadRow, ebx
+    rol eax,8
+    stdcall storeRow, eax, ebx
+    inc ebx
+    stdcall loadRow, ebx
+    rol eax,16
+    stdcall storeRow, eax, ebx
+    inc ebx
+    stdcall loadRow, ebx
+    rol eax,24
+    stdcall storeRow, eax, ebx
+
+    pop ebx
+    pop eax
+    ret
+
+endp
+
+proc loadRow, data_ptr:DWORD
+
+   push esi
+   mov esi,[data_ptr]
+
+   lodsb
+   shl eax,8
+   add esi,3
+   lodsb
+   shl eax,8
+   add esi,3
+   lodsb
+   shl eax,8
+   add esi,3
+   lodsb
+
+   pop esi
+   ret
+
+endp
+
+proc storeRow, row:DWORD, data_ptr:DWORD
+
+   push edi
+   mov edi,[data_ptr]
+   mov eax,[row]
+   rol eax,8
+
+   stosb
+   rol eax,8
+   add edi,3
+   stosb
+   rol eax,8
+   add edi,3
+   stosb
+   rol eax,8
+   add edi,3
+   stosb
+
+   pop edi
+   ret
+
+endp
+
+;xors the data with the round key and stores result
+;in data
+proc addRoundKey data_ptr:DWORD, round_key_ptr:DWORD
+
+    push eax
+    push ebx
+    push edx
+
+    mov eax,[data_ptr]
+    mov ebx,[round_key_ptr]
+    rept 4{
+	 mov edx,[ebx]
+	 xor edx,[eax]
+	 mov [eax],edx
+	 add eax,COLUMN_SIZE
+	 add ebx,COLUMN_SIZE
+    }
+
+    pop edx
+    pop ebx
+    pop eax
+    ret
+
+endp
+
+;substitute aes block with s-box
+proc subBlockBytes data_ptr:DWORD, sbox_ptr:DWORD
+
+    push eax
+    push ebx
+    push edx
+    mov ebx, [sbox_ptr]
+    mov edx, [data_ptr]
+
+    rept 4{
+	 mov eax, [edx]
+	 xlatb
+	 ror eax, 8
+	 xlatb
+	 ror eax, 8
+	 xlatb
+	 ror eax, 8
+	 xlatb
+	 ror eax, 8
+	 mov [edx], eax
+	 add edx, COLUMN_SIZE
+    }
+
+    pop edx
+    pop ebx
+    pop eax
+    ret
+
 endp
\ No newline at end of file
diff --git a/Src/Payloads/Aes/32/galois.asm b/Src/Payloads/Aes/32/galois.asm
old mode 100755
new mode 100644
index 73f0a68..ee1dae2
--- a/Src/Payloads/Aes/32/galois.asm
+++ b/Src/Payloads/Aes/32/galois.asm
@@ -1,133 +1,133 @@
-macro CreateGalois target, [char]
-{
-    mov byte [target], char
-    inc target
-}
-
-;create 2 lookup tables for multiplication in the
-;galois field with 2 and 3
-proc createGaloisEncryption mul2_ptr:DWORD, mul3_ptr:DWORD
-
-     push eax
-     mov eax, [mul2_ptr]
-     CreateGalois eax, 0x00, 0x02, 0x04, 0x06, 0x08, 0x0a, 0x0c, 0x0e, 0x10, 0x12, 0x14, 0x16, 0x18, 0x1a, 0x1c, 0x1e,\
-		       0x20, 0x22, 0x24, 0x26, 0x28, 0x2a, 0x2c, 0x2e, 0x30, 0x32, 0x34, 0x36, 0x38, 0x3a, 0x3c, 0x3e,\
-		       0x40, 0x42, 0x44, 0x46, 0x48, 0x4a, 0x4c, 0x4e, 0x50, 0x52, 0x54, 0x56, 0x58, 0x5a, 0x5c, 0x5e,\
-		       0x60, 0x62, 0x64, 0x66, 0x68, 0x6a, 0x6c, 0x6e, 0x70, 0x72, 0x74, 0x76, 0x78, 0x7a, 0x7c, 0x7e,\
-		       0x80, 0x82, 0x84, 0x86, 0x88, 0x8a, 0x8c, 0x8e, 0x90, 0x92, 0x94, 0x96, 0x98, 0x9a, 0x9c, 0x9e,\
-		       0xa0, 0xa2, 0xa4, 0xa6, 0xa8, 0xaa, 0xac, 0xae, 0xb0, 0xb2, 0xb4, 0xb6, 0xb8, 0xba, 0xbc, 0xbe,\
-		       0xc0, 0xc2, 0xc4, 0xc6, 0xc8, 0xca, 0xcc, 0xce, 0xd0, 0xd2, 0xd4, 0xd6, 0xd8, 0xda, 0xdc, 0xde,\
-		       0xe0, 0xe2, 0xe4, 0xe6, 0xe8, 0xea, 0xec, 0xee, 0xf0, 0xf2, 0xf4, 0xf6, 0xf8, 0xfa, 0xfc, 0xfe,\
-		       0x1b, 0x19, 0x1f, 0x1d, 0x13, 0x11, 0x17, 0x15, 0x0b, 0x09, 0x0f, 0x0d, 0x03, 0x01, 0x07, 0x05,\
-		       0x3b, 0x39, 0x3f, 0x3d, 0x33, 0x31, 0x37, 0x35, 0x2b, 0x29, 0x2f, 0x2d, 0x23, 0x21, 0x27, 0x25,\
-		       0x5b, 0x59, 0x5f, 0x5d, 0x53, 0x51, 0x57, 0x55, 0x4b, 0x49, 0x4f, 0x4d, 0x43, 0x41, 0x47, 0x45,\
-		       0x7b, 0x79, 0x7f, 0x7d, 0x73, 0x71, 0x77, 0x75, 0x6b, 0x69, 0x6f, 0x6d, 0x63, 0x61, 0x67, 0x65,\
-		       0x9b, 0x99, 0x9f, 0x9d, 0x93, 0x91, 0x97, 0x95, 0x8b, 0x89, 0x8f, 0x8d, 0x83, 0x81, 0x87, 0x85,\
-		       0xbb, 0xb9, 0xbf, 0xbd, 0xb3, 0xb1, 0xb7, 0xb5, 0xab, 0xa9, 0xaf, 0xad, 0xa3, 0xa1, 0xa7, 0xa5,\
-		       0xdb, 0xd9, 0xdf, 0xdd, 0xd3, 0xd1, 0xd7, 0xd5, 0xcb, 0xc9, 0xcf, 0xcd, 0xc3, 0xc1, 0xc7, 0xc5,\
-		       0xfb, 0xf9, 0xff, 0xfd, 0xf3, 0xf1, 0xf7, 0xf5, 0xeb, 0xe9, 0xef, 0xed, 0xe3, 0xe1, 0xe7, 0xe5
-
-     mov eax,  [mul3_ptr]
-     CreateGalois eax, 0x00, 0x03, 0x06, 0x05, 0x0c, 0x0f, 0x0a, 0x09, 0x18, 0x1b, 0x1e, 0x1d, 0x14, 0x17, 0x12, 0x11,\
-		       0x30, 0x33, 0x36, 0x35, 0x3c, 0x3f, 0x3a, 0x39, 0x28, 0x2b, 0x2e, 0x2d, 0x24, 0x27, 0x22, 0x21,\
-		       0x60, 0x63, 0x66, 0x65, 0x6c, 0x6f, 0x6a, 0x69, 0x78, 0x7b, 0x7e, 0x7d, 0x74, 0x77, 0x72, 0x71,\
-		       0x50, 0x53, 0x56, 0x55, 0x5c, 0x5f, 0x5a, 0x59, 0x48, 0x4b, 0x4e, 0x4d, 0x44, 0x47, 0x42, 0x41,\
-		       0xc0, 0xc3, 0xc6, 0xc5, 0xcc, 0xcf, 0xca, 0xc9, 0xd8, 0xdb, 0xde, 0xdd, 0xd4, 0xd7, 0xd2, 0xd1,\
-		       0xf0, 0xf3, 0xf6, 0xf5, 0xfc, 0xff, 0xfa, 0xf9, 0xe8, 0xeb, 0xee, 0xed, 0xe4, 0xe7, 0xe2, 0xe1,\
-		       0xa0, 0xa3, 0xa6, 0xa5, 0xac, 0xaf, 0xaa, 0xa9, 0xb8, 0xbb, 0xbe, 0xbd, 0xb4, 0xb7, 0xb2, 0xb1,\
-		       0x90, 0x93, 0x96, 0x95, 0x9c, 0x9f, 0x9a, 0x99, 0x88, 0x8b, 0x8e, 0x8d, 0x84, 0x87, 0x82, 0x81,\
-		       0x9b, 0x98, 0x9d, 0x9e, 0x97, 0x94, 0x91, 0x92, 0x83, 0x80, 0x85, 0x86, 0x8f, 0x8c, 0x89, 0x8a,\
-		       0xab, 0xa8, 0xad, 0xae, 0xa7, 0xa4, 0xa1, 0xa2, 0xb3, 0xb0, 0xb5, 0xb6, 0xbf, 0xbc, 0xb9, 0xba,\
-		       0xfb, 0xf8, 0xfd, 0xfe, 0xf7, 0xf4, 0xf1, 0xf2, 0xe3, 0xe0, 0xe5, 0xe6, 0xef, 0xec, 0xe9, 0xea,\
-		       0xcb, 0xc8, 0xcd, 0xce, 0xc7, 0xc4, 0xc1, 0xc2, 0xd3, 0xd0, 0xd5, 0xd6, 0xdf, 0xdc, 0xd9, 0xda,\
-		       0x5b, 0x58, 0x5d, 0x5e, 0x57, 0x54, 0x51, 0x52, 0x43, 0x40, 0x45, 0x46, 0x4f, 0x4c, 0x49, 0x4a,\
-		       0x6b, 0x68, 0x6d, 0x6e, 0x67, 0x64, 0x61, 0x62, 0x73, 0x70, 0x75, 0x76, 0x7f, 0x7c, 0x79, 0x7a,\
-		       0x3b, 0x38, 0x3d, 0x3e, 0x37, 0x34, 0x31, 0x32, 0x23, 0x20, 0x25, 0x26, 0x2f, 0x2c, 0x29, 0x2a,\
-		       0x0b, 0x08, 0x0d, 0x0e, 0x07, 0x04, 0x01, 0x02, 0x13, 0x10, 0x15, 0x16, 0x1f, 0x1c, 0x19, 0x1a
-     pop eax
-     ret
-
-endp
-
-;create 4 lookup tables for multiplication in the
-;galois field with 9, 11, 13 and 14
-proc createGaloisDecryption mul9_ptr:DWORD, mul11_ptr:DWORD,\
-     mul13_ptr:DWORD, mul14_ptr:DWORD
-
-     push eax
-     mov eax, [mul9_ptr]
-     CreateGalois eax, 0x00, 0x09, 0x12, 0x1b, 0x24, 0x2d, 0x36, 0x3f, 0x48, 0x41, 0x5a, 0x53, 0x6c, 0x65, 0x7e, 0x77, \
-		       0x90, 0x99, 0x82, 0x8b, 0xb4, 0xbd, 0xa6, 0xaf, 0xd8, 0xd1, 0xca, 0xc3, 0xfc, 0xf5, 0xee, 0xe7, \
-		       0x3b, 0x32, 0x29, 0x20, 0x1f, 0x16, 0x0d, 0x04, 0x73, 0x7a, 0x61, 0x68, 0x57, 0x5e, 0x45, 0x4c, \
-		       0xab, 0xa2, 0xb9, 0xb0, 0x8f, 0x86, 0x9d, 0x94, 0xe3, 0xea, 0xf1, 0xf8, 0xc7, 0xce, 0xd5, 0xdc, \
-		       0x76, 0x7f, 0x64, 0x6d, 0x52, 0x5b, 0x40, 0x49, 0x3e, 0x37, 0x2c, 0x25, 0x1a, 0x13, 0x08, 0x01, \
-		       0xe6, 0xef, 0xf4, 0xfd, 0xc2, 0xcb, 0xd0, 0xd9, 0xae, 0xa7, 0xbc, 0xb5, 0x8a, 0x83, 0x98, 0x91, \
-		       0x4d, 0x44, 0x5f, 0x56, 0x69, 0x60, 0x7b, 0x72, 0x05, 0x0c, 0x17, 0x1e, 0x21, 0x28, 0x33, 0x3a, \
-		       0xdd, 0xd4, 0xcf, 0xc6, 0xf9, 0xf0, 0xeb, 0xe2, 0x95, 0x9c, 0x87, 0x8e, 0xb1, 0xb8, 0xa3, 0xaa, \
-		       0xec, 0xe5, 0xfe, 0xf7, 0xc8, 0xc1, 0xda, 0xd3, 0xa4, 0xad, 0xb6, 0xbf, 0x80, 0x89, 0x92, 0x9b, \
-		       0x7c, 0x75, 0x6e, 0x67, 0x58, 0x51, 0x4a, 0x43, 0x34, 0x3d, 0x26, 0x2f, 0x10, 0x19, 0x02, 0x0b, \
-		       0xd7, 0xde, 0xc5, 0xcc, 0xf3, 0xfa, 0xe1, 0xe8, 0x9f, 0x96, 0x8d, 0x84, 0xbb, 0xb2, 0xa9, 0xa0, \
-		       0x47, 0x4e, 0x55, 0x5c, 0x63, 0x6a, 0x71, 0x78, 0x0f, 0x06, 0x1d, 0x14, 0x2b, 0x22, 0x39, 0x30, \
-		       0x9a, 0x93, 0x88, 0x81, 0xbe, 0xb7, 0xac, 0xa5, 0xd2, 0xdb, 0xc0, 0xc9, 0xf6, 0xff, 0xe4, 0xed, \
-		       0x0a, 0x03, 0x18, 0x11, 0x2e, 0x27, 0x3c, 0x35, 0x42, 0x4b, 0x50, 0x59, 0x66, 0x6f, 0x74, 0x7d, \
-		       0xa1, 0xa8, 0xb3, 0xba, 0x85, 0x8c, 0x97, 0x9e, 0xe9, 0xe0, 0xfb, 0xf2, 0xcd, 0xc4, 0xdf, 0xd6, \
-		       0x31, 0x38, 0x23, 0x2a, 0x15, 0x1c, 0x07, 0x0e, 0x79, 0x70, 0x6b, 0x62, 0x5d, 0x54, 0x4f, 0x46
-
-     mov eax,  [mul11_ptr]
-     CreateGalois eax, 0x00, 0x0b, 0x16, 0x1d, 0x2c, 0x27, 0x3a, 0x31, 0x58, 0x53, 0x4e, 0x45, 0x74, 0x7f, 0x62, 0x69, \
-		       0xb0, 0xbb, 0xa6, 0xad, 0x9c, 0x97, 0x8a, 0x81, 0xe8, 0xe3, 0xfe, 0xf5, 0xc4, 0xcf, 0xd2, 0xd9, \
-		       0x7b, 0x70, 0x6d, 0x66, 0x57, 0x5c, 0x41, 0x4a, 0x23, 0x28, 0x35, 0x3e, 0x0f, 0x04, 0x19, 0x12, \
-		       0xcb, 0xc0, 0xdd, 0xd6, 0xe7, 0xec, 0xf1, 0xfa, 0x93, 0x98, 0x85, 0x8e, 0xbf, 0xb4, 0xa9, 0xa2, \
-		       0xf6, 0xfd, 0xe0, 0xeb, 0xda, 0xd1, 0xcc, 0xc7, 0xae, 0xa5, 0xb8, 0xb3, 0x82, 0x89, 0x94, 0x9f, \
-		       0x46, 0x4d, 0x50, 0x5b, 0x6a, 0x61, 0x7c, 0x77, 0x1e, 0x15, 0x08, 0x03, 0x32, 0x39, 0x24, 0x2f, \
-		       0x8d, 0x86, 0x9b, 0x90, 0xa1, 0xaa, 0xb7, 0xbc, 0xd5, 0xde, 0xc3, 0xc8, 0xf9, 0xf2, 0xef, 0xe4, \
-		       0x3d, 0x36, 0x2b, 0x20, 0x11, 0x1a, 0x07, 0x0c, 0x65, 0x6e, 0x73, 0x78, 0x49, 0x42, 0x5f, 0x54, \
-		       0xf7, 0xfc, 0xe1, 0xea, 0xdb, 0xd0, 0xcd, 0xc6, 0xaf, 0xa4, 0xb9, 0xb2, 0x83, 0x88, 0x95, 0x9e, \
-		       0x47, 0x4c, 0x51, 0x5a, 0x6b, 0x60, 0x7d, 0x76, 0x1f, 0x14, 0x09, 0x02, 0x33, 0x38, 0x25, 0x2e, \
-		       0x8c, 0x87, 0x9a, 0x91, 0xa0, 0xab, 0xb6, 0xbd, 0xd4, 0xdf, 0xc2, 0xc9, 0xf8, 0xf3, 0xee, 0xe5, \
-		       0x3c, 0x37, 0x2a, 0x21, 0x10, 0x1b, 0x06, 0x0d, 0x64, 0x6f, 0x72, 0x79, 0x48, 0x43, 0x5e, 0x55, \
-		       0x01, 0x0a, 0x17, 0x1c, 0x2d, 0x26, 0x3b, 0x30, 0x59, 0x52, 0x4f, 0x44, 0x75, 0x7e, 0x63, 0x68, \
-		       0xb1, 0xba, 0xa7, 0xac, 0x9d, 0x96, 0x8b, 0x80, 0xe9, 0xe2, 0xff, 0xf4, 0xc5, 0xce, 0xd3, 0xd8, \
-		       0x7a, 0x71, 0x6c, 0x67, 0x56, 0x5d, 0x40, 0x4b, 0x22, 0x29, 0x34, 0x3f, 0x0e, 0x05, 0x18, 0x13, \
-		       0xca, 0xc1, 0xdc, 0xd7, 0xe6, 0xed, 0xf0, 0xfb, 0x92, 0x99, 0x84, 0x8f, 0xbe, 0xb5, 0xa8, 0xa3
-
-     mov eax,  [mul13_ptr]
-     CreateGalois eax, 0x00, 0x0d, 0x1a, 0x17, 0x34, 0x39, 0x2e, 0x23, 0x68, 0x65, 0x72, 0x7f, 0x5c, 0x51, 0x46, 0x4b, \
-		       0xd0, 0xdd, 0xca, 0xc7, 0xe4, 0xe9, 0xfe, 0xf3, 0xb8, 0xb5, 0xa2, 0xaf, 0x8c, 0x81, 0x96, 0x9b, \
-		       0xbb, 0xb6, 0xa1, 0xac, 0x8f, 0x82, 0x95, 0x98, 0xd3, 0xde, 0xc9, 0xc4, 0xe7, 0xea, 0xfd, 0xf0, \
-		       0x6b, 0x66, 0x71, 0x7c, 0x5f, 0x52, 0x45, 0x48, 0x03, 0x0e, 0x19, 0x14, 0x37, 0x3a, 0x2d, 0x20, \
-		       0x6d, 0x60, 0x77, 0x7a, 0x59, 0x54, 0x43, 0x4e, 0x05, 0x08, 0x1f, 0x12, 0x31, 0x3c, 0x2b, 0x26, \
-		       0xbd, 0xb0, 0xa7, 0xaa, 0x89, 0x84, 0x93, 0x9e, 0xd5, 0xd8, 0xcf, 0xc2, 0xe1, 0xec, 0xfb, 0xf6, \
-		       0xd6, 0xdb, 0xcc, 0xc1, 0xe2, 0xef, 0xf8, 0xf5, 0xbe, 0xb3, 0xa4, 0xa9, 0x8a, 0x87, 0x90, 0x9d, \
-		       0x06, 0x0b, 0x1c, 0x11, 0x32, 0x3f, 0x28, 0x25, 0x6e, 0x63, 0x74, 0x79, 0x5a, 0x57, 0x40, 0x4d, \
-		       0xda, 0xd7, 0xc0, 0xcd, 0xee, 0xe3, 0xf4, 0xf9, 0xb2, 0xbf, 0xa8, 0xa5, 0x86, 0x8b, 0x9c, 0x91, \
-		       0x0a, 0x07, 0x10, 0x1d, 0x3e, 0x33, 0x24, 0x29, 0x62, 0x6f, 0x78, 0x75, 0x56, 0x5b, 0x4c, 0x41, \
-		       0x61, 0x6c, 0x7b, 0x76, 0x55, 0x58, 0x4f, 0x42, 0x09, 0x04, 0x13, 0x1e, 0x3d, 0x30, 0x27, 0x2a, \
-		       0xb1, 0xbc, 0xab, 0xa6, 0x85, 0x88, 0x9f, 0x92, 0xd9, 0xd4, 0xc3, 0xce, 0xed, 0xe0, 0xf7, 0xfa, \
-		       0xb7, 0xba, 0xad, 0xa0, 0x83, 0x8e, 0x99, 0x94, 0xdf, 0xd2, 0xc5, 0xc8, 0xeb, 0xe6, 0xf1, 0xfc, \
-		       0x67, 0x6a, 0x7d, 0x70, 0x53, 0x5e, 0x49, 0x44, 0x0f, 0x02, 0x15, 0x18, 0x3b, 0x36, 0x21, 0x2c, \
-		       0x0c, 0x01, 0x16, 0x1b, 0x38, 0x35, 0x22, 0x2f, 0x64, 0x69, 0x7e, 0x73, 0x50, 0x5d, 0x4a, 0x47, \
-		       0xdc, 0xd1, 0xc6, 0xcb, 0xe8, 0xe5, 0xf2, 0xff, 0xb4, 0xb9, 0xae, 0xa3, 0x80, 0x8d, 0x9a, 0x97
-
-     mov eax,  [mul14_ptr]
-     CreateGalois eax, 0x00, 0x0e, 0x1c, 0x12, 0x38, 0x36, 0x24, 0x2a, 0x70, 0x7e, 0x6c, 0x62, 0x48, 0x46, 0x54, 0x5a, \
-		       0xe0, 0xee, 0xfc, 0xf2, 0xd8, 0xd6, 0xc4, 0xca, 0x90, 0x9e, 0x8c, 0x82, 0xa8, 0xa6, 0xb4, 0xba, \
-		       0xdb, 0xd5, 0xc7, 0xc9, 0xe3, 0xed, 0xff, 0xf1, 0xab, 0xa5, 0xb7, 0xb9, 0x93, 0x9d, 0x8f, 0x81, \
-		       0x3b, 0x35, 0x27, 0x29, 0x03, 0x0d, 0x1f, 0x11, 0x4b, 0x45, 0x57, 0x59, 0x73, 0x7d, 0x6f, 0x61, \
-		       0xad, 0xa3, 0xb1, 0xbf, 0x95, 0x9b, 0x89, 0x87, 0xdd, 0xd3, 0xc1, 0xcf, 0xe5, 0xeb, 0xf9, 0xf7, \
-		       0x4d, 0x43, 0x51, 0x5f, 0x75, 0x7b, 0x69, 0x67, 0x3d, 0x33, 0x21, 0x2f, 0x05, 0x0b, 0x19, 0x17, \
-		       0x76, 0x78, 0x6a, 0x64, 0x4e, 0x40, 0x52, 0x5c, 0x06, 0x08, 0x1a, 0x14, 0x3e, 0x30, 0x22, 0x2c, \
-		       0x96, 0x98, 0x8a, 0x84, 0xae, 0xa0, 0xb2, 0xbc, 0xe6, 0xe8, 0xfa, 0xf4, 0xde, 0xd0, 0xc2, 0xcc, \
-		       0x41, 0x4f, 0x5d, 0x53, 0x79, 0x77, 0x65, 0x6b, 0x31, 0x3f, 0x2d, 0x23, 0x09, 0x07, 0x15, 0x1b, \
-		       0xa1, 0xaf, 0xbd, 0xb3, 0x99, 0x97, 0x85, 0x8b, 0xd1, 0xdf, 0xcd, 0xc3, 0xe9, 0xe7, 0xf5, 0xfb, \
-		       0x9a, 0x94, 0x86, 0x88, 0xa2, 0xac, 0xbe, 0xb0, 0xea, 0xe4, 0xf6, 0xf8, 0xd2, 0xdc, 0xce, 0xc0, \
-		       0x7a, 0x74, 0x66, 0x68, 0x42, 0x4c, 0x5e, 0x50, 0x0a, 0x04, 0x16, 0x18, 0x32, 0x3c, 0x2e, 0x20, \
-		       0xec, 0xe2, 0xf0, 0xfe, 0xd4, 0xda, 0xc8, 0xc6, 0x9c, 0x92, 0x80, 0x8e, 0xa4, 0xaa, 0xb8, 0xb6, \
-		       0x0c, 0x02, 0x10, 0x1e, 0x34, 0x3a, 0x28, 0x26, 0x7c, 0x72, 0x60, 0x6e, 0x44, 0x4a, 0x58, 0x56, \
-		       0x37, 0x39, 0x2b, 0x25, 0x0f, 0x01, 0x13, 0x1d, 0x47, 0x49, 0x5b, 0x55, 0x7f, 0x71, 0x63, 0x6d, \
-		       0xd7, 0xd9, 0xcb, 0xc5, 0xef, 0xe1, 0xf3, 0xfd, 0xa7, 0xa9, 0xbb, 0xb5, 0x9f, 0x91, 0x83, 0x8d
-
-     pop eax
-     ret
-
+macro CreateGalois target, [char]
+{
+    mov byte [target], char
+    inc target
+}
+
+;create 2 lookup tables for multiplication in the
+;galois field with 2 and 3
+proc createGaloisEncryption mul2_ptr:DWORD, mul3_ptr:DWORD
+
+     push eax
+     mov eax, [mul2_ptr]
+     CreateGalois eax, 0x00, 0x02, 0x04, 0x06, 0x08, 0x0a, 0x0c, 0x0e, 0x10, 0x12, 0x14, 0x16, 0x18, 0x1a, 0x1c, 0x1e,\
+		       0x20, 0x22, 0x24, 0x26, 0x28, 0x2a, 0x2c, 0x2e, 0x30, 0x32, 0x34, 0x36, 0x38, 0x3a, 0x3c, 0x3e,\
+		       0x40, 0x42, 0x44, 0x46, 0x48, 0x4a, 0x4c, 0x4e, 0x50, 0x52, 0x54, 0x56, 0x58, 0x5a, 0x5c, 0x5e,\
+		       0x60, 0x62, 0x64, 0x66, 0x68, 0x6a, 0x6c, 0x6e, 0x70, 0x72, 0x74, 0x76, 0x78, 0x7a, 0x7c, 0x7e,\
+		       0x80, 0x82, 0x84, 0x86, 0x88, 0x8a, 0x8c, 0x8e, 0x90, 0x92, 0x94, 0x96, 0x98, 0x9a, 0x9c, 0x9e,\
+		       0xa0, 0xa2, 0xa4, 0xa6, 0xa8, 0xaa, 0xac, 0xae, 0xb0, 0xb2, 0xb4, 0xb6, 0xb8, 0xba, 0xbc, 0xbe,\
+		       0xc0, 0xc2, 0xc4, 0xc6, 0xc8, 0xca, 0xcc, 0xce, 0xd0, 0xd2, 0xd4, 0xd6, 0xd8, 0xda, 0xdc, 0xde,\
+		       0xe0, 0xe2, 0xe4, 0xe6, 0xe8, 0xea, 0xec, 0xee, 0xf0, 0xf2, 0xf4, 0xf6, 0xf8, 0xfa, 0xfc, 0xfe,\
+		       0x1b, 0x19, 0x1f, 0x1d, 0x13, 0x11, 0x17, 0x15, 0x0b, 0x09, 0x0f, 0x0d, 0x03, 0x01, 0x07, 0x05,\
+		       0x3b, 0x39, 0x3f, 0x3d, 0x33, 0x31, 0x37, 0x35, 0x2b, 0x29, 0x2f, 0x2d, 0x23, 0x21, 0x27, 0x25,\
+		       0x5b, 0x59, 0x5f, 0x5d, 0x53, 0x51, 0x57, 0x55, 0x4b, 0x49, 0x4f, 0x4d, 0x43, 0x41, 0x47, 0x45,\
+		       0x7b, 0x79, 0x7f, 0x7d, 0x73, 0x71, 0x77, 0x75, 0x6b, 0x69, 0x6f, 0x6d, 0x63, 0x61, 0x67, 0x65,\
+		       0x9b, 0x99, 0x9f, 0x9d, 0x93, 0x91, 0x97, 0x95, 0x8b, 0x89, 0x8f, 0x8d, 0x83, 0x81, 0x87, 0x85,\
+		       0xbb, 0xb9, 0xbf, 0xbd, 0xb3, 0xb1, 0xb7, 0xb5, 0xab, 0xa9, 0xaf, 0xad, 0xa3, 0xa1, 0xa7, 0xa5,\
+		       0xdb, 0xd9, 0xdf, 0xdd, 0xd3, 0xd1, 0xd7, 0xd5, 0xcb, 0xc9, 0xcf, 0xcd, 0xc3, 0xc1, 0xc7, 0xc5,\
+		       0xfb, 0xf9, 0xff, 0xfd, 0xf3, 0xf1, 0xf7, 0xf5, 0xeb, 0xe9, 0xef, 0xed, 0xe3, 0xe1, 0xe7, 0xe5
+
+     mov eax,  [mul3_ptr]
+     CreateGalois eax, 0x00, 0x03, 0x06, 0x05, 0x0c, 0x0f, 0x0a, 0x09, 0x18, 0x1b, 0x1e, 0x1d, 0x14, 0x17, 0x12, 0x11,\
+		       0x30, 0x33, 0x36, 0x35, 0x3c, 0x3f, 0x3a, 0x39, 0x28, 0x2b, 0x2e, 0x2d, 0x24, 0x27, 0x22, 0x21,\
+		       0x60, 0x63, 0x66, 0x65, 0x6c, 0x6f, 0x6a, 0x69, 0x78, 0x7b, 0x7e, 0x7d, 0x74, 0x77, 0x72, 0x71,\
+		       0x50, 0x53, 0x56, 0x55, 0x5c, 0x5f, 0x5a, 0x59, 0x48, 0x4b, 0x4e, 0x4d, 0x44, 0x47, 0x42, 0x41,\
+		       0xc0, 0xc3, 0xc6, 0xc5, 0xcc, 0xcf, 0xca, 0xc9, 0xd8, 0xdb, 0xde, 0xdd, 0xd4, 0xd7, 0xd2, 0xd1,\
+		       0xf0, 0xf3, 0xf6, 0xf5, 0xfc, 0xff, 0xfa, 0xf9, 0xe8, 0xeb, 0xee, 0xed, 0xe4, 0xe7, 0xe2, 0xe1,\
+		       0xa0, 0xa3, 0xa6, 0xa5, 0xac, 0xaf, 0xaa, 0xa9, 0xb8, 0xbb, 0xbe, 0xbd, 0xb4, 0xb7, 0xb2, 0xb1,\
+		       0x90, 0x93, 0x96, 0x95, 0x9c, 0x9f, 0x9a, 0x99, 0x88, 0x8b, 0x8e, 0x8d, 0x84, 0x87, 0x82, 0x81,\
+		       0x9b, 0x98, 0x9d, 0x9e, 0x97, 0x94, 0x91, 0x92, 0x83, 0x80, 0x85, 0x86, 0x8f, 0x8c, 0x89, 0x8a,\
+		       0xab, 0xa8, 0xad, 0xae, 0xa7, 0xa4, 0xa1, 0xa2, 0xb3, 0xb0, 0xb5, 0xb6, 0xbf, 0xbc, 0xb9, 0xba,\
+		       0xfb, 0xf8, 0xfd, 0xfe, 0xf7, 0xf4, 0xf1, 0xf2, 0xe3, 0xe0, 0xe5, 0xe6, 0xef, 0xec, 0xe9, 0xea,\
+		       0xcb, 0xc8, 0xcd, 0xce, 0xc7, 0xc4, 0xc1, 0xc2, 0xd3, 0xd0, 0xd5, 0xd6, 0xdf, 0xdc, 0xd9, 0xda,\
+		       0x5b, 0x58, 0x5d, 0x5e, 0x57, 0x54, 0x51, 0x52, 0x43, 0x40, 0x45, 0x46, 0x4f, 0x4c, 0x49, 0x4a,\
+		       0x6b, 0x68, 0x6d, 0x6e, 0x67, 0x64, 0x61, 0x62, 0x73, 0x70, 0x75, 0x76, 0x7f, 0x7c, 0x79, 0x7a,\
+		       0x3b, 0x38, 0x3d, 0x3e, 0x37, 0x34, 0x31, 0x32, 0x23, 0x20, 0x25, 0x26, 0x2f, 0x2c, 0x29, 0x2a,\
+		       0x0b, 0x08, 0x0d, 0x0e, 0x07, 0x04, 0x01, 0x02, 0x13, 0x10, 0x15, 0x16, 0x1f, 0x1c, 0x19, 0x1a
+     pop eax
+     ret
+
+endp
+
+;create 4 lookup tables for multiplication in the
+;galois field with 9, 11, 13 and 14
+proc createGaloisDecryption mul9_ptr:DWORD, mul11_ptr:DWORD,\
+     mul13_ptr:DWORD, mul14_ptr:DWORD
+
+     push eax
+     mov eax, [mul9_ptr]
+     CreateGalois eax, 0x00, 0x09, 0x12, 0x1b, 0x24, 0x2d, 0x36, 0x3f, 0x48, 0x41, 0x5a, 0x53, 0x6c, 0x65, 0x7e, 0x77, \
+		       0x90, 0x99, 0x82, 0x8b, 0xb4, 0xbd, 0xa6, 0xaf, 0xd8, 0xd1, 0xca, 0xc3, 0xfc, 0xf5, 0xee, 0xe7, \
+		       0x3b, 0x32, 0x29, 0x20, 0x1f, 0x16, 0x0d, 0x04, 0x73, 0x7a, 0x61, 0x68, 0x57, 0x5e, 0x45, 0x4c, \
+		       0xab, 0xa2, 0xb9, 0xb0, 0x8f, 0x86, 0x9d, 0x94, 0xe3, 0xea, 0xf1, 0xf8, 0xc7, 0xce, 0xd5, 0xdc, \
+		       0x76, 0x7f, 0x64, 0x6d, 0x52, 0x5b, 0x40, 0x49, 0x3e, 0x37, 0x2c, 0x25, 0x1a, 0x13, 0x08, 0x01, \
+		       0xe6, 0xef, 0xf4, 0xfd, 0xc2, 0xcb, 0xd0, 0xd9, 0xae, 0xa7, 0xbc, 0xb5, 0x8a, 0x83, 0x98, 0x91, \
+		       0x4d, 0x44, 0x5f, 0x56, 0x69, 0x60, 0x7b, 0x72, 0x05, 0x0c, 0x17, 0x1e, 0x21, 0x28, 0x33, 0x3a, \
+		       0xdd, 0xd4, 0xcf, 0xc6, 0xf9, 0xf0, 0xeb, 0xe2, 0x95, 0x9c, 0x87, 0x8e, 0xb1, 0xb8, 0xa3, 0xaa, \
+		       0xec, 0xe5, 0xfe, 0xf7, 0xc8, 0xc1, 0xda, 0xd3, 0xa4, 0xad, 0xb6, 0xbf, 0x80, 0x89, 0x92, 0x9b, \
+		       0x7c, 0x75, 0x6e, 0x67, 0x58, 0x51, 0x4a, 0x43, 0x34, 0x3d, 0x26, 0x2f, 0x10, 0x19, 0x02, 0x0b, \
+		       0xd7, 0xde, 0xc5, 0xcc, 0xf3, 0xfa, 0xe1, 0xe8, 0x9f, 0x96, 0x8d, 0x84, 0xbb, 0xb2, 0xa9, 0xa0, \
+		       0x47, 0x4e, 0x55, 0x5c, 0x63, 0x6a, 0x71, 0x78, 0x0f, 0x06, 0x1d, 0x14, 0x2b, 0x22, 0x39, 0x30, \
+		       0x9a, 0x93, 0x88, 0x81, 0xbe, 0xb7, 0xac, 0xa5, 0xd2, 0xdb, 0xc0, 0xc9, 0xf6, 0xff, 0xe4, 0xed, \
+		       0x0a, 0x03, 0x18, 0x11, 0x2e, 0x27, 0x3c, 0x35, 0x42, 0x4b, 0x50, 0x59, 0x66, 0x6f, 0x74, 0x7d, \
+		       0xa1, 0xa8, 0xb3, 0xba, 0x85, 0x8c, 0x97, 0x9e, 0xe9, 0xe0, 0xfb, 0xf2, 0xcd, 0xc4, 0xdf, 0xd6, \
+		       0x31, 0x38, 0x23, 0x2a, 0x15, 0x1c, 0x07, 0x0e, 0x79, 0x70, 0x6b, 0x62, 0x5d, 0x54, 0x4f, 0x46
+
+     mov eax,  [mul11_ptr]
+     CreateGalois eax, 0x00, 0x0b, 0x16, 0x1d, 0x2c, 0x27, 0x3a, 0x31, 0x58, 0x53, 0x4e, 0x45, 0x74, 0x7f, 0x62, 0x69, \
+		       0xb0, 0xbb, 0xa6, 0xad, 0x9c, 0x97, 0x8a, 0x81, 0xe8, 0xe3, 0xfe, 0xf5, 0xc4, 0xcf, 0xd2, 0xd9, \
+		       0x7b, 0x70, 0x6d, 0x66, 0x57, 0x5c, 0x41, 0x4a, 0x23, 0x28, 0x35, 0x3e, 0x0f, 0x04, 0x19, 0x12, \
+		       0xcb, 0xc0, 0xdd, 0xd6, 0xe7, 0xec, 0xf1, 0xfa, 0x93, 0x98, 0x85, 0x8e, 0xbf, 0xb4, 0xa9, 0xa2, \
+		       0xf6, 0xfd, 0xe0, 0xeb, 0xda, 0xd1, 0xcc, 0xc7, 0xae, 0xa5, 0xb8, 0xb3, 0x82, 0x89, 0x94, 0x9f, \
+		       0x46, 0x4d, 0x50, 0x5b, 0x6a, 0x61, 0x7c, 0x77, 0x1e, 0x15, 0x08, 0x03, 0x32, 0x39, 0x24, 0x2f, \
+		       0x8d, 0x86, 0x9b, 0x90, 0xa1, 0xaa, 0xb7, 0xbc, 0xd5, 0xde, 0xc3, 0xc8, 0xf9, 0xf2, 0xef, 0xe4, \
+		       0x3d, 0x36, 0x2b, 0x20, 0x11, 0x1a, 0x07, 0x0c, 0x65, 0x6e, 0x73, 0x78, 0x49, 0x42, 0x5f, 0x54, \
+		       0xf7, 0xfc, 0xe1, 0xea, 0xdb, 0xd0, 0xcd, 0xc6, 0xaf, 0xa4, 0xb9, 0xb2, 0x83, 0x88, 0x95, 0x9e, \
+		       0x47, 0x4c, 0x51, 0x5a, 0x6b, 0x60, 0x7d, 0x76, 0x1f, 0x14, 0x09, 0x02, 0x33, 0x38, 0x25, 0x2e, \
+		       0x8c, 0x87, 0x9a, 0x91, 0xa0, 0xab, 0xb6, 0xbd, 0xd4, 0xdf, 0xc2, 0xc9, 0xf8, 0xf3, 0xee, 0xe5, \
+		       0x3c, 0x37, 0x2a, 0x21, 0x10, 0x1b, 0x06, 0x0d, 0x64, 0x6f, 0x72, 0x79, 0x48, 0x43, 0x5e, 0x55, \
+		       0x01, 0x0a, 0x17, 0x1c, 0x2d, 0x26, 0x3b, 0x30, 0x59, 0x52, 0x4f, 0x44, 0x75, 0x7e, 0x63, 0x68, \
+		       0xb1, 0xba, 0xa7, 0xac, 0x9d, 0x96, 0x8b, 0x80, 0xe9, 0xe2, 0xff, 0xf4, 0xc5, 0xce, 0xd3, 0xd8, \
+		       0x7a, 0x71, 0x6c, 0x67, 0x56, 0x5d, 0x40, 0x4b, 0x22, 0x29, 0x34, 0x3f, 0x0e, 0x05, 0x18, 0x13, \
+		       0xca, 0xc1, 0xdc, 0xd7, 0xe6, 0xed, 0xf0, 0xfb, 0x92, 0x99, 0x84, 0x8f, 0xbe, 0xb5, 0xa8, 0xa3
+
+     mov eax,  [mul13_ptr]
+     CreateGalois eax, 0x00, 0x0d, 0x1a, 0x17, 0x34, 0x39, 0x2e, 0x23, 0x68, 0x65, 0x72, 0x7f, 0x5c, 0x51, 0x46, 0x4b, \
+		       0xd0, 0xdd, 0xca, 0xc7, 0xe4, 0xe9, 0xfe, 0xf3, 0xb8, 0xb5, 0xa2, 0xaf, 0x8c, 0x81, 0x96, 0x9b, \
+		       0xbb, 0xb6, 0xa1, 0xac, 0x8f, 0x82, 0x95, 0x98, 0xd3, 0xde, 0xc9, 0xc4, 0xe7, 0xea, 0xfd, 0xf0, \
+		       0x6b, 0x66, 0x71, 0x7c, 0x5f, 0x52, 0x45, 0x48, 0x03, 0x0e, 0x19, 0x14, 0x37, 0x3a, 0x2d, 0x20, \
+		       0x6d, 0x60, 0x77, 0x7a, 0x59, 0x54, 0x43, 0x4e, 0x05, 0x08, 0x1f, 0x12, 0x31, 0x3c, 0x2b, 0x26, \
+		       0xbd, 0xb0, 0xa7, 0xaa, 0x89, 0x84, 0x93, 0x9e, 0xd5, 0xd8, 0xcf, 0xc2, 0xe1, 0xec, 0xfb, 0xf6, \
+		       0xd6, 0xdb, 0xcc, 0xc1, 0xe2, 0xef, 0xf8, 0xf5, 0xbe, 0xb3, 0xa4, 0xa9, 0x8a, 0x87, 0x90, 0x9d, \
+		       0x06, 0x0b, 0x1c, 0x11, 0x32, 0x3f, 0x28, 0x25, 0x6e, 0x63, 0x74, 0x79, 0x5a, 0x57, 0x40, 0x4d, \
+		       0xda, 0xd7, 0xc0, 0xcd, 0xee, 0xe3, 0xf4, 0xf9, 0xb2, 0xbf, 0xa8, 0xa5, 0x86, 0x8b, 0x9c, 0x91, \
+		       0x0a, 0x07, 0x10, 0x1d, 0x3e, 0x33, 0x24, 0x29, 0x62, 0x6f, 0x78, 0x75, 0x56, 0x5b, 0x4c, 0x41, \
+		       0x61, 0x6c, 0x7b, 0x76, 0x55, 0x58, 0x4f, 0x42, 0x09, 0x04, 0x13, 0x1e, 0x3d, 0x30, 0x27, 0x2a, \
+		       0xb1, 0xbc, 0xab, 0xa6, 0x85, 0x88, 0x9f, 0x92, 0xd9, 0xd4, 0xc3, 0xce, 0xed, 0xe0, 0xf7, 0xfa, \
+		       0xb7, 0xba, 0xad, 0xa0, 0x83, 0x8e, 0x99, 0x94, 0xdf, 0xd2, 0xc5, 0xc8, 0xeb, 0xe6, 0xf1, 0xfc, \
+		       0x67, 0x6a, 0x7d, 0x70, 0x53, 0x5e, 0x49, 0x44, 0x0f, 0x02, 0x15, 0x18, 0x3b, 0x36, 0x21, 0x2c, \
+		       0x0c, 0x01, 0x16, 0x1b, 0x38, 0x35, 0x22, 0x2f, 0x64, 0x69, 0x7e, 0x73, 0x50, 0x5d, 0x4a, 0x47, \
+		       0xdc, 0xd1, 0xc6, 0xcb, 0xe8, 0xe5, 0xf2, 0xff, 0xb4, 0xb9, 0xae, 0xa3, 0x80, 0x8d, 0x9a, 0x97
+
+     mov eax,  [mul14_ptr]
+     CreateGalois eax, 0x00, 0x0e, 0x1c, 0x12, 0x38, 0x36, 0x24, 0x2a, 0x70, 0x7e, 0x6c, 0x62, 0x48, 0x46, 0x54, 0x5a, \
+		       0xe0, 0xee, 0xfc, 0xf2, 0xd8, 0xd6, 0xc4, 0xca, 0x90, 0x9e, 0x8c, 0x82, 0xa8, 0xa6, 0xb4, 0xba, \
+		       0xdb, 0xd5, 0xc7, 0xc9, 0xe3, 0xed, 0xff, 0xf1, 0xab, 0xa5, 0xb7, 0xb9, 0x93, 0x9d, 0x8f, 0x81, \
+		       0x3b, 0x35, 0x27, 0x29, 0x03, 0x0d, 0x1f, 0x11, 0x4b, 0x45, 0x57, 0x59, 0x73, 0x7d, 0x6f, 0x61, \
+		       0xad, 0xa3, 0xb1, 0xbf, 0x95, 0x9b, 0x89, 0x87, 0xdd, 0xd3, 0xc1, 0xcf, 0xe5, 0xeb, 0xf9, 0xf7, \
+		       0x4d, 0x43, 0x51, 0x5f, 0x75, 0x7b, 0x69, 0x67, 0x3d, 0x33, 0x21, 0x2f, 0x05, 0x0b, 0x19, 0x17, \
+		       0x76, 0x78, 0x6a, 0x64, 0x4e, 0x40, 0x52, 0x5c, 0x06, 0x08, 0x1a, 0x14, 0x3e, 0x30, 0x22, 0x2c, \
+		       0x96, 0x98, 0x8a, 0x84, 0xae, 0xa0, 0xb2, 0xbc, 0xe6, 0xe8, 0xfa, 0xf4, 0xde, 0xd0, 0xc2, 0xcc, \
+		       0x41, 0x4f, 0x5d, 0x53, 0x79, 0x77, 0x65, 0x6b, 0x31, 0x3f, 0x2d, 0x23, 0x09, 0x07, 0x15, 0x1b, \
+		       0xa1, 0xaf, 0xbd, 0xb3, 0x99, 0x97, 0x85, 0x8b, 0xd1, 0xdf, 0xcd, 0xc3, 0xe9, 0xe7, 0xf5, 0xfb, \
+		       0x9a, 0x94, 0x86, 0x88, 0xa2, 0xac, 0xbe, 0xb0, 0xea, 0xe4, 0xf6, 0xf8, 0xd2, 0xdc, 0xce, 0xc0, \
+		       0x7a, 0x74, 0x66, 0x68, 0x42, 0x4c, 0x5e, 0x50, 0x0a, 0x04, 0x16, 0x18, 0x32, 0x3c, 0x2e, 0x20, \
+		       0xec, 0xe2, 0xf0, 0xfe, 0xd4, 0xda, 0xc8, 0xc6, 0x9c, 0x92, 0x80, 0x8e, 0xa4, 0xaa, 0xb8, 0xb6, \
+		       0x0c, 0x02, 0x10, 0x1e, 0x34, 0x3a, 0x28, 0x26, 0x7c, 0x72, 0x60, 0x6e, 0x44, 0x4a, 0x58, 0x56, \
+		       0x37, 0x39, 0x2b, 0x25, 0x0f, 0x01, 0x13, 0x1d, 0x47, 0x49, 0x5b, 0x55, 0x7f, 0x71, 0x63, 0x6d, \
+		       0xd7, 0xd9, 0xcb, 0xc5, 0xef, 0xe1, 0xf3, 0xfd, 0xa7, 0xa9, 0xbb, 0xb5, 0x9f, 0x91, 0x83, 0x8d
+
+     pop eax
+     ret
+
 endp
\ No newline at end of file
diff --git a/Src/Payloads/Aes/32/keychain.asm b/Src/Payloads/Aes/32/keychain.asm
old mode 100755
new mode 100644
index 8322625..24b1b49
--- a/Src/Payloads/Aes/32/keychain.asm
+++ b/Src/Payloads/Aes/32/keychain.asm
@@ -1,295 +1,297 @@
-;creates the round keys in keychain_ptr
-if defined AES128
-proc createKeyChain keychain_ptr:DWORD, sbox_ptr:DWORD,\
-		    rcon_ptr:DWORD
-
-local current_row:DWORD
-
-     ;current column in ecx
-     mov ecx, ROW_SIZE-1
-     ;current rcon index in edx
-     mov edx, 1
-
-key_schedule_round:
-     ;-------------------
-     ;get current column, apply key schedule core and
-     ;xor the result with ecx-ROW_SIZE-1
-     stdcall loadColumn, [keychain_ptr], ecx
-     ;shift rows
-     rol eax,8
-     ;substitute with sbox
-     stdcall subBytes, eax, [sbox_ptr]
-     ;xor with rcon
-     stdcall xorRcon, eax, [rcon_ptr], edx
-     inc edx
-     ;xor with column at index-ROW_SIZE-1
-     mov ebx,eax
-     push ecx
-     sub ecx,ROW_SIZE-1
-     stdcall loadColumn, [keychain_ptr],ecx
-     pop ecx
-     xor eax,ebx
-     ;store at index+1
-     inc ecx
-     stdcall storeColumn, eax, [keychain_ptr], ecx
-     ;-------------------
-
-     ;-------------------
-     ;three times: get current column and
-     ;xor it with ecx-ROW_SIZE-1
-     rept 3{
-	  stdcall loadColumn, [keychain_ptr], ecx ;can be removed
-	  mov ebx, eax
-	  push ecx
-	  sub ecx,ROW_SIZE-1
-	  stdcall loadColumn, [keychain_ptr],ecx
-	  pop ecx
-	  xor eax,ebx
-	  inc ecx
-	  stdcall storeColumn, eax, [keychain_ptr], ecx
-     }
-     ;-------------------
-
-     ;check for end of keychain generation
-     cmp ecx, EXTENDED_KEY_SIZE/COLUMN_SIZE - 1
-     jne key_schedule_round
-
-     ret
-endp
-end if
-
-if defined AES192
-proc createKeyChain keychain_ptr:DWORD, sbox_ptr:DWORD,\
-		    rcon_ptr:DWORD
-
-local current_row:DWORD
-
-     ;current column in ecx
-     mov ecx, ROW_SIZE-1
-     ;current rcon index in edx
-     mov edx, 1
-
-key_schedule_round:
-     ;-------------------
-     ;get current column, apply key schedule core and
-     ;xor the result with ecx-ROW_SIZE-1
-     stdcall loadColumn, [keychain_ptr], ecx
-     ;shift rows
-     rol eax,8
-     ;substitute with sbox
-     stdcall subBytes, eax, [sbox_ptr]
-     ;xor with rcon
-     stdcall xorRcon, eax, [rcon_ptr], edx
-     inc edx
-     ;xor with column at index-ROW_SIZE-1
-     mov ebx,eax
-     push ecx
-     sub ecx,ROW_SIZE-1
-     stdcall loadColumn, [keychain_ptr],ecx
-     pop ecx
-     xor eax,ebx
-     ;store at index+1
-     inc ecx
-     stdcall storeColumn, eax, [keychain_ptr], ecx
-     ;-------------------
-
-     ;-------------------
-     ;three times: get current column and
-     ;xor it with ecx-ROW_SIZE-1
-     rept 3{
-	  stdcall loadColumn, [keychain_ptr], ecx ;can be removed
-	  mov ebx, eax
-	  push ecx
-	  sub ecx,ROW_SIZE-1
-	  stdcall loadColumn, [keychain_ptr],ecx
-	  pop ecx
-	  xor eax,ebx
-	  inc ecx
-	  stdcall storeColumn, eax, [keychain_ptr], ecx
-     }
-     ;-------------------
-
-     ;check for end of keychain generation
-     cmp ecx, EXTENDED_KEY_SIZE/COLUMN_SIZE - 1
-     je exit_key_schedule_round
-
-     ;-------------------
-     ;two times: get current column and
-     ;xor it with ecx-ROW_SIZE-1
-     rept 2{
-	  stdcall loadColumn, [keychain_ptr], ecx ;can be removed
-	  mov ebx, eax
-	  push ecx
-	  sub ecx,ROW_SIZE-1
-	  stdcall loadColumn, [keychain_ptr],ecx
-	  pop ecx
-	  xor eax,ebx
-	  inc ecx
-	  stdcall storeColumn, eax, [keychain_ptr], ecx
-     }
-     ;-------------------
-
-     jmp key_schedule_round
-
-exit_key_schedule_round:
-     ret
-endp
-end if
-
-if defined AES256
-proc createKeyChain keychain_ptr:DWORD, sbox_ptr:DWORD,\
-		    rcon_ptr:DWORD
-
-local current_row:DWORD
-
-     ;current column in ecx
-     mov ecx, ROW_SIZE-1
-     ;current rcon index in edx
-     mov edx, 1
-
-key_schedule_round:
-     ;-------------------
-     ;get current column, apply key schedule core and
-     ;xor the result with ecx-ROW_SIZE-1
-     stdcall loadColumn, [keychain_ptr], ecx
-     ;shift rows
-     rol eax,8
-     ;substitute with sbox
-     stdcall subBytes, eax, [sbox_ptr]
-     ;xor with rcon
-     stdcall xorRcon, eax, [rcon_ptr], edx
-     inc edx
-     ;xor with column at index-ROW_SIZE-1
-     mov ebx,eax
-     push ecx
-     sub ecx,ROW_SIZE-1
-     stdcall loadColumn, [keychain_ptr],ecx
-     pop ecx
-     xor eax,ebx
-     ;store at index+1
-     inc ecx
-     stdcall storeColumn, eax, [keychain_ptr], ecx
-     ;-------------------
-
-     ;-------------------
-     ;three times: get current column and
-     ;xor it with ecx-ROW_SIZE-1
-     rept 3{
-	  stdcall loadColumn, [keychain_ptr], ecx ;can be removed
-	  mov ebx, eax
-	  push ecx
-	  sub ecx,ROW_SIZE-1
-	  stdcall loadColumn, [keychain_ptr],ecx
-	  pop ecx
-	  xor eax,ebx
-	  inc ecx
-	  stdcall storeColumn, eax, [keychain_ptr], ecx
-     }
-     ;-------------------
-
-     ;check for end of keychain generation
-     cmp ecx, EXTENDED_KEY_SIZE/COLUMN_SIZE - 1
-     je exit_key_schedule_round
-
-     ;-------------------
-     ;one times: get current column, subsitute with
-     ;sbox and xor it with ecx-ROW_SIZE-1
-     ;three times: get current column and
-     ;xor it with ecx-ROW_SIZE-1
-     stdcall loadColumn, [keychain_ptr], ecx ;can be removed
-     stdcall subBytes, eax, [sbox_ptr]
-     mov ebx, eax
-     push ecx
-     sub ecx,ROW_SIZE-1
-     stdcall loadColumn, [keychain_ptr],ecx
-     pop ecx
-     xor eax,ebx
-     inc ecx
-     stdcall storeColumn, eax, [keychain_ptr], ecx
-     ;three times
-     rept 3{
-	  stdcall loadColumn, [keychain_ptr], ecx ;can be removed
-	  mov ebx, eax
-	  push ecx
-	  sub ecx,ROW_SIZE-1
-	  stdcall loadColumn, [keychain_ptr],ecx
-	  pop ecx
-	  xor eax,ebx
-	  inc ecx
-	  stdcall storeColumn, eax, [keychain_ptr], ecx
-     }
-     ;-------------------
-
-     jmp key_schedule_round
-
-exit_key_schedule_round:
-     ret
-endp
-end if
-
-;store a column at column_index in keychain
-proc storeColumn column:DWORD, keychain_ptr:DWORD, column_index:DWORD
-     push eax
-     push ebx
-     push edx
-
-     ;create pointer to first byte of the column
-     ;and store column there
-     mov eax, [column_index]
-     mov ebx, COLUMN_SIZE
-     mul ebx
-     add eax, [keychain_ptr]
-     mov ebx, [column]
-     mov [eax], ebx
-
-     pop edx
-     pop ebx
-     pop eax
-     ret
-endp
-
-;xor key dword with (rcon(index) 00 00 00)
-proc xorRcon key:DWORD, rcon_ptr:DWORD, rcon_index:DWORD
-     push ebx
-     mov eax,[rcon_index]
-     mov ebx,[rcon_ptr]
-     xlatb
-     shl eax,24
-     mov ebx,[key]
-     xor eax,ebx
-     pop ebx
-     ret
-endp
-
-;returns in eax the column at column_index in the key chain
-proc loadColumn keychain_ptr:DWORD, column_index:DWORD
-     push ebx
-     push edx
-     ;create pointer to first byte of the colum
-     mov eax, [column_index]
-     mov ebx, COLUMN_SIZE
-     mul ebx
-     add eax, [keychain_ptr]
-     ;return dword and exit
-     mov eax,[eax]
-     pop edx
-     pop ebx
-     ret
-endp
-
-;substitute subkey's bytes with the sbox
-proc subBytes subkey:DWORD, sbox_ptr:DWORD
-     push ebx
-     mov eax, [subkey]
-     mov ebx, [sbox_ptr]
-     xlatb
-     ror eax, 8
-     xlatb
-     ror eax, 8
-     xlatb
-     ror eax, 8
-     xlatb
-     ror eax, 8
-     pop ebx
-     ret
+;creates the round keys in keychain_ptr
+if defined AES128
+proc createKeyChain keychain_ptr:DWORD, sbox_ptr:DWORD,\
+		    rcon_ptr:DWORD
+
+local current_row:DWORD
+
+     ;current column in ecx
+     mov ecx, ROW_SIZE-1
+     ;current rcon index in edx
+     mov edx, 1
+
+key_schedule_round:
+     ;-------------------
+     ;get current column, apply key schedule core and
+     ;xor the result with ecx-ROW_SIZE-1
+     stdcall loadColumn, [keychain_ptr], ecx
+     ;shift rows
+     rol eax,8
+     ;substitute with sbox
+     stdcall subBytes, eax, [sbox_ptr]
+     ;xor with rcon
+     stdcall xorRcon, eax, [rcon_ptr], edx
+     inc edx
+     ;xor with column at index-ROW_SIZE-1
+     mov ebx,eax
+     push ecx
+     sub ecx,ROW_SIZE-1
+     stdcall loadColumn, [keychain_ptr],ecx
+     pop ecx
+     xor eax,ebx
+     ;store at index+1
+     inc ecx
+     stdcall storeColumn, eax, [keychain_ptr], ecx
+     ;-------------------
+
+     ;-------------------
+     ;three times: get current column and
+     ;xor it with ecx-ROW_SIZE-1
+     rept 3{
+	  stdcall loadColumn, [keychain_ptr], ecx ;can be removed
+	  mov ebx, eax
+	  push ecx
+	  sub ecx,ROW_SIZE-1
+	  stdcall loadColumn, [keychain_ptr],ecx
+	  pop ecx
+	  xor eax,ebx
+	  inc ecx
+	  stdcall storeColumn, eax, [keychain_ptr], ecx
+     }
+     ;-------------------
+
+     ;check for end of keychain generation
+     cmp ecx, EXTENDED_KEY_SIZE/COLUMN_SIZE - 1
+     jne key_schedule_round
+
+     ret
+endp
+end if
+
+if defined AES192
+proc createKeyChain keychain_ptr:DWORD, sbox_ptr:DWORD,\
+		    rcon_ptr:DWORD
+
+local current_row:DWORD
+
+     ;current column in ecx
+     mov ecx, ROW_SIZE-1
+     ;current rcon index in edx
+     mov edx, 1
+
+key_schedule_round:
+     ;-------------------
+     ;get current column, apply key schedule core and
+     ;xor the result with ecx-ROW_SIZE-1
+     stdcall loadColumn, [keychain_ptr], ecx
+     ;shift rows
+     rol eax,8
+     ;substitute with sbox
+     stdcall subBytes, eax, [sbox_ptr]
+     ;xor with rcon
+     stdcall xorRcon, eax, [rcon_ptr], edx
+     inc edx
+     ;xor with column at index-ROW_SIZE-1
+     mov ebx,eax
+     push ecx
+     sub ecx,ROW_SIZE-1
+     stdcall loadColumn, [keychain_ptr],ecx
+     pop ecx
+     xor eax,ebx
+     ;store at index+1
+     inc ecx
+     stdcall storeColumn, eax, [keychain_ptr], ecx
+     ;-------------------
+
+     ;-------------------
+     ;three times: get current column and
+     ;xor it with ecx-ROW_SIZE-1
+     rept 3{
+	  stdcall loadColumn, [keychain_ptr], ecx ;can be removed
+	  mov ebx, eax
+	  push ecx
+	  sub ecx,ROW_SIZE-1
+	  stdcall loadColumn, [keychain_ptr],ecx
+	  pop ecx
+	  xor eax,ebx
+	  inc ecx
+	  stdcall storeColumn, eax, [keychain_ptr], ecx
+     }
+     ;-------------------
+
+     ;check for end of keychain generation
+     cmp ecx, EXTENDED_KEY_SIZE/COLUMN_SIZE - 1
+     je exit_key_schedule_round
+
+     ;-------------------
+     ;two times: get current column and
+     ;xor it with ecx-ROW_SIZE-1
+     rept 2{
+	  stdcall loadColumn, [keychain_ptr], ecx ;can be removed
+	  mov ebx, eax
+	  push ecx
+	  sub ecx,ROW_SIZE-1
+	  stdcall loadColumn, [keychain_ptr],ecx
+	  pop ecx
+	  xor eax,ebx
+	  inc ecx
+	  stdcall storeColumn, eax, [keychain_ptr], ecx
+     }
+     ;-------------------
+
+     jmp key_schedule_round
+
+exit_key_schedule_round:
+     ret
+endp
+end if
+
+if defined AES256
+proc createKeyChain keychain_ptr:DWORD, sbox_ptr:DWORD,\
+		    rcon_ptr:DWORD
+
+local current_row:DWORD
+
+     ;current column in ecx
+     mov ecx, ROW_SIZE-1
+     ;current rcon index in edx
+     mov edx, 1
+
+key_schedule_round:
+     ;-------------------
+     ;get current column, apply key schedule core and
+     ;xor the result with ecx-ROW_SIZE-1
+     stdcall loadColumn, [keychain_ptr], ecx
+     ;shift rows
+     rol eax,8
+     ;substitute with sbox
+     stdcall subBytes, eax, [sbox_ptr]
+     ;xor with rcon
+     stdcall xorRcon, eax, [rcon_ptr], edx
+     inc edx
+     ;xor with column at index-ROW_SIZE-1
+     mov ebx,eax
+     push ecx
+     sub ecx,ROW_SIZE-1
+     stdcall loadColumn, [keychain_ptr],ecx
+     pop ecx
+     xor eax,ebx
+     ;store at index+1
+     inc ecx
+     stdcall storeColumn, eax, [keychain_ptr], ecx
+     ;-------------------
+
+     ;-------------------
+     ;three times: get current column and
+     ;xor it with ecx-ROW_SIZE-1
+     rept 3{
+	  stdcall loadColumn, [keychain_ptr], ecx ;can be removed
+	  mov ebx, eax
+	  push ecx
+	  sub ecx,ROW_SIZE-1
+	  stdcall loadColumn, [keychain_ptr],ecx
+	  pop ecx
+	  xor eax,ebx
+	  inc ecx
+	  stdcall storeColumn, eax, [keychain_ptr], ecx
+     }
+     ;-------------------
+
+     ;check for end of keychain generation
+     cmp ecx, EXTENDED_KEY_SIZE/COLUMN_SIZE - 1
+     je exit_key_schedule_round
+
+     ;-------------------
+     ;one times: get current column, subsitute with
+     ;sbox and xor it with ecx-ROW_SIZE-1
+     ;three times: get current column and
+     ;xor it with ecx-ROW_SIZE-1
+     stdcall loadColumn, [keychain_ptr], ecx ;can be removed
+     stdcall subBytes, eax, [sbox_ptr]
+     mov ebx, eax
+     push ecx
+     sub ecx,ROW_SIZE-1
+     stdcall loadColumn, [keychain_ptr],ecx
+     pop ecx
+     xor eax,ebx
+     inc ecx
+     stdcall storeColumn, eax, [keychain_ptr], ecx
+     ;three times
+     rept 3{
+	  stdcall loadColumn, [keychain_ptr], ecx ;can be removed
+	  mov ebx, eax
+	  push ecx
+	  sub ecx,ROW_SIZE-1
+	  stdcall loadColumn, [keychain_ptr],ecx
+	  pop ecx
+	  xor eax,ebx
+	  inc ecx
+	  stdcall storeColumn, eax, [keychain_ptr], ecx
+     }
+     ;-------------------
+
+     jmp key_schedule_round
+
+exit_key_schedule_round:
+     ret
+endp
+end if
+
+;store a column at column_index in keychain
+proc storeColumn column:DWORD, keychain_ptr:DWORD, column_index:DWORD
+     push eax
+     push ebx
+     push edx
+
+     ;create pointer to first byte of the column
+     ;and store column there
+     mov eax, [column_index]
+     mov ebx, COLUMN_SIZE
+     mul ebx
+     add eax, [keychain_ptr]
+     mov ebx, [column]
+     bswap ebx
+     mov [eax], ebx
+
+     pop edx
+     pop ebx
+     pop eax
+     ret
+endp
+
+;xor key dword with (rcon(index) 00 00 00)
+proc xorRcon key:DWORD, rcon_ptr:DWORD, rcon_index:DWORD
+     push ebx
+     mov eax,[rcon_index]
+     mov ebx,[rcon_ptr]
+     xlatb
+     shl eax,24
+     mov ebx,[key]
+     xor eax,ebx
+     pop ebx
+     ret
+endp
+
+;returns in eax the column at column_index in the key chain
+proc loadColumn keychain_ptr:DWORD, column_index:DWORD
+     push ebx
+     push edx
+     ;create pointer to first byte of the colum
+     mov eax, [column_index]
+     mov ebx, COLUMN_SIZE
+     mul ebx
+     add eax, [keychain_ptr]
+     ;return dword and exit
+     mov eax,[eax]
+     bswap eax
+     pop edx
+     pop ebx
+     ret
+endp
+
+;substitute subkey's bytes with the sbox
+proc subBytes subkey:DWORD, sbox_ptr:DWORD
+     push ebx
+     mov eax, [subkey]
+     mov ebx, [sbox_ptr]
+     xlatb
+     ror eax, 8
+     xlatb
+     ror eax, 8
+     xlatb
+     ror eax, 8
+     xlatb
+     ror eax, 8
+     pop ebx
+     ret
 endp
\ No newline at end of file
diff --git a/Src/Payloads/Aes/license.txt b/Src/Payloads/Aes/32/license.txt
old mode 100755
new mode 100644
similarity index 92%
rename from Src/Payloads/Aes/license.txt
rename to Src/Payloads/Aes/32/license.txt
index 641bc9c..8025b70
--- a/Src/Payloads/Aes/license.txt
+++ b/Src/Payloads/Aes/32/license.txt
@@ -1,26 +1,26 @@
-Copyright (c) 2012, Christian Ammann
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met: 
-
-1. Redistributions of source code must retain the above copyright notice, this
-   list of conditions and the following disclaimer. 
-2. Redistributions in binary form must reproduce the above copyright notice,
-   this list of conditions and the following disclaimer in the documentation
-   and/or other materials provided with the distribution. 
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
-ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-The views and conclusions contained in the software and documentation are those
-of the authors and should not be interpreted as representing official policies, 
-either expressed or implied, of the Nullsecurity Project.
\ No newline at end of file
+Copyright (c) 2019, FasmAES by Christian Ammann
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met: 
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer. 
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution. 
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+The views and conclusions contained in the software and documentation are those
+of the authors and should not be interpreted as representing official policies, 
+either expressed or implied, of the Nullsecurity Project.
diff --git a/Src/Payloads/Aes/32/rcon.asm b/Src/Payloads/Aes/32/rcon.asm
old mode 100755
new mode 100644
index 3654f44..6a9dfc3
--- a/Src/Payloads/Aes/32/rcon.asm
+++ b/Src/Payloads/Aes/32/rcon.asm
@@ -1,30 +1,30 @@
-macro CreateRcon target, [char]
-{
-    mov byte [target], char
-    inc target
-}
-
-;dynamically generate the rcon in memory
-;uses hard coded values, no algorithm
-proc createRcon rcon_ptr:DWORD
-     push eax
-     mov eax, [rcon_ptr]
-     CreateRcon eax, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a,\
-		     0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39,\
-		     0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a,\
-		     0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8,\
-		     0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef,\
-		     0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc,\
-		     0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b,\
-		     0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3,\
-		     0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94,\
-		     0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20,\
-		     0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35,\
-		     0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f,\
-		     0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04,\
-		     0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63,\
-		     0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd,\
-		     0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d
-     pop eax
-     ret
+macro CreateRcon target, [char]
+{
+    mov byte [target], char
+    inc target
+}
+
+;dynamically generate the rcon in memory
+;uses hard coded values, no algorithm
+proc createRcon rcon_ptr:DWORD
+     push eax
+     mov eax, [rcon_ptr]
+     CreateRcon eax, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a,\
+		     0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39,\
+		     0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a,\
+		     0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8,\
+		     0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef,\
+		     0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc,\
+		     0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b,\
+		     0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3,\
+		     0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94,\
+		     0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20,\
+		     0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35,\
+		     0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f,\
+		     0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04,\
+		     0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63,\
+		     0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd,\
+		     0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d
+     pop eax
+     ret
 endp
\ No newline at end of file
diff --git a/Src/Payloads/Aes/32/sbox.asm b/Src/Payloads/Aes/32/sbox.asm
old mode 100755
new mode 100644
index cdceeee..bcc912d
--- a/Src/Payloads/Aes/32/sbox.asm
+++ b/Src/Payloads/Aes/32/sbox.asm
@@ -1,55 +1,55 @@
-macro CreateSBox target, [char]
-{
-    mov byte [target], char
-    inc target
-}
-
-;dynamically generate the sbox in memory
-;uses hard coded values, no algorithm
-proc createSBox sbox_ptr:DWORD
-     push eax
-     mov eax, [sbox_ptr]
-     CreateSBox eax, 0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,\
-		     0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,\
-		     0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,\
-		     0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,\
-		     0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,\
-		     0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,\
-		     0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,\
-		     0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,\
-		     0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,\
-		     0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,\
-		     0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,\
-		     0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,\
-		     0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,\
-		     0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,\
-		     0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,\
-		     0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16
-     pop eax
-     ret
-endp
-
-;the inverted sbox for decryption
-proc createInvertSBox sbox_ptr:DWORD
-     push eax
-     mov eax, [sbox_ptr]
-     CreateSBox eax, 0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb,\
-		     0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb,\
-		     0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e,\
-		     0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25,\
-		     0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92,\
-		     0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84,\
-		     0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06,\
-		     0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b,\
-		     0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73,\
-		     0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e,\
-		     0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b,\
-		     0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4,\
-		     0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f,\
-		     0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef,\
-		     0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61,\
-		     0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d
-     pop eax
-     ret
-endp
-
+macro CreateSBox target, [char]
+{
+    mov byte [target], char
+    inc target
+}
+
+;dynamically generate the sbox in memory
+;uses hard coded values, no algorithm
+proc createSBox sbox_ptr:DWORD
+     push eax
+     mov eax, [sbox_ptr]
+     CreateSBox eax, 0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,\
+		     0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,\
+		     0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,\
+		     0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,\
+		     0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,\
+		     0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,\
+		     0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,\
+		     0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,\
+		     0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,\
+		     0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,\
+		     0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,\
+		     0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,\
+		     0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,\
+		     0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,\
+		     0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,\
+		     0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16
+     pop eax
+     ret
+endp
+
+;the inverted sbox for decryption
+proc createInvertSBox sbox_ptr:DWORD
+     push eax
+     mov eax, [sbox_ptr]
+     CreateSBox eax, 0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb,\
+		     0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb,\
+		     0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e,\
+		     0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25,\
+		     0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92,\
+		     0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84,\
+		     0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06,\
+		     0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b,\
+		     0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73,\
+		     0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e,\
+		     0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b,\
+		     0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4,\
+		     0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f,\
+		     0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef,\
+		     0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61,\
+		     0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d
+     pop eax
+     ret
+endp
+
diff --git a/Src/Payloads/Aes/64/aes.asm b/Src/Payloads/Aes/64/aes.asm
index cbdc06d..e66b44a 100644
--- a/Src/Payloads/Aes/64/aes.asm
+++ b/Src/Payloads/Aes/64/aes.asm
@@ -1,166 +1,149 @@
-include 'sbox.asm'
-include 'rcon.asm'
-include 'keychain.asm'
-include 'encryptionrounds.asm'
-include 'decryptionrounds.asm'
-include 'galois.asm'
-
-;encrypts cleartext and stores the result at enctext
-proc encAES size:QWORD, cleartext_ptr:QWORD, enctext_ptr:QWORD,\
-     aeskey_ptr:QWORD
-
-local keychain[(ENCRYPTION_ROUNDS+1)*BLOCK_SIZE]:BYTE, sbox[SBOX_SIZE]:BYTE,\
-      rcon[RCON_SIZE]:BYTE, galois_mul2[GALOIS_SIZE]:BYTE,\
-      galois_mul3[GALOIS_SIZE]:BYTE, mul2_table_ptr:QWORD,\
-      mul3_table_ptr:QWORD, sbox_ptr:QWORD, keychain_ptr:QWORD,\
-      rcon_ptr:QWORD
-
-    mov [size],rcx
-    mov [cleartext_ptr],rdx
-    mov [enctext_ptr],r8
-    mov [aeskey_ptr],r9
-
-    push rbx
-    push rsi
-    push rdi
-    sub rsp,8 ;16 byte stack alignment
-        
-    ;sbox and rcon are created in memory
-    ;galois lookup tables too
-    lea rax,[sbox]
-    mov [sbox_ptr], rax
-    fastcall createSBox, rax
-    lea rax,[rcon]
-    mov [rcon_ptr], rax
-    fastcall createRcon, rax
-    lea rax,[galois_mul2]
-    mov [mul2_table_ptr], rax
-    lea rbx,[galois_mul3]
-    mov [mul3_table_ptr], rbx
-    fastcall createGaloisEncryption, rax, rbx
-
-    ;copy the key into the round key buffer
-    mov rcx, KEY_SIZE
-    mov rsi, [aeskey_ptr]
-    lea rdi, [keychain]
-    mov [keychain_ptr], rdi
-    rep movsb
-
-    ;create the round keys
-    fastcall createKeyChain, [keychain_ptr], [sbox_ptr],\
-            [rcon_ptr]
-
-    ;copy clear text to encryption buffer
-    mov rcx, [size]
-    mov rsi, [cleartext_ptr]
-    mov rdi, [enctext_ptr]
-    rep movsb
-
-    ;rsi == current to be encrypted block
-    ;ebx == end of cleartext
-    mov rsi,[enctext_ptr]
-    mov rbx,rsi
-    add rbx,[size]
-eaes_block_loop:
-    fastcall encryptionRounds, rsi, [keychain_ptr], \
-            [sbox_ptr], [mul2_table_ptr], [mul3_table_ptr]
-
-    add rsi,BLOCK_SIZE
-    cmp rsi,rbx
-    jnge eaes_block_loop
-
-    add rsp,8
-    pop rdi
-    pop rsi
-    pop rbx
-    mov rax,1
-    ret
-
-endp
-
-;decrypts cleartext and stores the result at enctext
-proc decAES size:QWORD, enctext_ptr:QWORD, cleartext_ptr:QWORD,\
-     aeskey_ptr:QWORD
-
-local keychain[(ENCRYPTION_ROUNDS+1)*BLOCK_SIZE]:BYTE,\
-      sbox[SBOX_SIZE]:BYTE, invert_sbox[SBOX_SIZE]:BYTE,\
-      rcon[RCON_SIZE]:BYTE,\
-      galois_mul9[GALOIS_SIZE]:BYTE, galois_mul11[GALOIS_SIZE]:BYTE, \
-      galois_mul13[GALOIS_SIZE]:BYTE, galois_mul14[GALOIS_SIZE]:BYTE,\
-      mul9_table_ptr:QWORD, mul11_table_ptr:QWORD, mul13_table_ptr:QWORD,\
-      mul14_table_ptr:QWORD, sbox_ptr:QWORD, invert_sbox_ptr:QWORD,\
-      keychain_ptr:QWORD, rcon_ptr:QWORD
-
-    mov [size],rcx
-    mov [enctext_ptr],rdx
-    mov [cleartext_ptr],r8
-    mov [aeskey_ptr],r9
-    push rbx
-    push rsi
-    push rdi
-    sub rsp,8 ;16 byte stack alignment
-        
-    ;sbox, invert sbox
-    ;and rcon are created in memory
-    lea rax,[sbox]
-    mov [sbox_ptr], rax
-    fastcall createSBox, rax
-    lea rax,[rcon]
-    mov [rcon_ptr], rax
-    fastcall createRcon, rax
-    lea rax, [invert_sbox]
-    mov [invert_sbox_ptr], rax
-    fastcall createInvertSBox, rax
-
-    ;create galois lookup tables for
-    ;9, 11, 13 and 14
-    lea rax,[galois_mul9]
-    mov [mul9_table_ptr], rax
-    lea rax,[galois_mul11]
-    mov [mul11_table_ptr], rax
-    lea rax,[galois_mul13]
-    mov [mul13_table_ptr], rax
-    lea rax,[galois_mul14]
-    mov [mul14_table_ptr], rax
-    fastcall createGaloisDecryption, [mul9_table_ptr],\
-        [mul11_table_ptr], [mul13_table_ptr], [mul14_table_ptr]
-
-    ;copy the key into the round key buffer
-    mov rcx, KEY_SIZE
-    mov rsi, [aeskey_ptr]
-    lea rdi, [keychain]
-    mov [keychain_ptr], rdi
-    rep movsb
-
-    ;create the round keys
-    fastcall createKeyChain, [keychain_ptr], [sbox_ptr],\
-            [rcon_ptr]
-
-    ;copy encrypted text to decryption buffer
-    mov rcx, [size]
-    mov rsi, [enctext_ptr]
-    mov rdi, [cleartext_ptr]
-    rep movsb
-
-    ;rsi == current to be decrypted block
-    ;ebx == end of cleartext
-    mov rsi,[cleartext_ptr]
-    mov rbx,rsi
-    add rbx,[size]
-daes_block_loop:
-    fastcall decryptionRounds, rsi, [keychain_ptr],\
-            [invert_sbox_ptr], [mul9_table_ptr], [mul11_table_ptr],\
-            [mul13_table_ptr], [mul14_table_ptr]
-
-    add rsi,BLOCK_SIZE
-    cmp rsi,rbx
-    jnge daes_block_loop
-
-    add rsp,8
-    pop rdi
-    pop rsi
-    pop rbx
-    mov rax,1
-    ret
-
-endp
+include 'sbox.asm'
+include 'rcon.asm'
+include 'keychain.asm'
+include 'encryptionrounds.asm'
+include 'decryptionrounds.asm'
+include 'galois.asm'
+
+;encrypts cleartext and stores the result at enctext
+proc encAES uses rbx rsi rdi,\
+     size:QWORD, cleartext_ptr:QWORD, enctext_ptr:QWORD, aeskey_ptr:QWORD
+
+local keychain[(ENCRYPTION_ROUNDS+1)*BLOCK_SIZE]:BYTE, sbox[SBOX_SIZE]:BYTE,\
+      rcon[RCON_SIZE]:BYTE, galois_mul2[GALOIS_SIZE]:BYTE,\
+      galois_mul3[GALOIS_SIZE]:BYTE, mul2_table_ptr:QWORD,\
+      mul3_table_ptr:QWORD, sbox_ptr:QWORD, keychain_ptr:QWORD,\
+      rcon_ptr:QWORD
+
+    mov [size],rcx
+    mov [cleartext_ptr],rdx
+    mov [enctext_ptr],r8
+    mov [aeskey_ptr],r9
+	
+    ;sbox and rcon are created in memory
+    ;galois lookup tables too
+    lea rax,[sbox]
+    mov [sbox_ptr], rax
+    fastcall createSBox, rax
+    lea rax,[rcon]
+    mov [rcon_ptr], rax
+    fastcall createRcon, rax
+    lea rax,[galois_mul2]
+    mov [mul2_table_ptr], rax
+    lea rbx,[galois_mul3]
+    mov [mul3_table_ptr], rbx
+    fastcall createGaloisEncryption, rax, rbx
+
+    ;copy the key into the round key buffer
+    mov rcx, KEY_SIZE
+    mov rsi, [aeskey_ptr]
+    lea rdi, [keychain]
+    mov [keychain_ptr], rdi
+    rep movsb
+
+    ;create the round keys
+    fastcall createKeyChain, [keychain_ptr], [sbox_ptr],\
+	    [rcon_ptr]
+
+    ;copy clear text to encryption buffer
+    mov rcx, [size]
+    mov rsi, [cleartext_ptr]
+    mov rdi, [enctext_ptr]
+    rep movsb
+
+    ;rsi == current to be encrypted block
+    ;ebx == end of cleartext
+    mov rsi,[enctext_ptr]
+    mov rbx,rsi
+    add rbx,[size]
+eaes_block_loop:
+    fastcall encryptionRounds, rsi, [keychain_ptr], \
+	    [sbox_ptr], [mul2_table_ptr], [mul3_table_ptr]
+
+    add rsi,BLOCK_SIZE
+    cmp rsi,rbx
+    jnge eaes_block_loop
+
+    mov rax,1
+    ret
+
+endp
+
+;decrypts cleartext and stores the result at enctext
+proc decAES uses rbx rsi rdi,\
+     size:QWORD, enctext_ptr:QWORD, cleartext_ptr:QWORD, aeskey_ptr:QWORD
+
+local keychain[(ENCRYPTION_ROUNDS+1)*BLOCK_SIZE]:BYTE,\
+      sbox[SBOX_SIZE]:BYTE, invert_sbox[SBOX_SIZE]:BYTE,\
+      rcon[RCON_SIZE]:BYTE,\
+      galois_mul9[GALOIS_SIZE]:BYTE, galois_mul11[GALOIS_SIZE]:BYTE, \
+      galois_mul13[GALOIS_SIZE]:BYTE, galois_mul14[GALOIS_SIZE]:BYTE,\
+      mul9_table_ptr:QWORD, mul11_table_ptr:QWORD, mul13_table_ptr:QWORD,\
+      mul14_table_ptr:QWORD, sbox_ptr:QWORD, invert_sbox_ptr:QWORD,\
+      keychain_ptr:QWORD, rcon_ptr:QWORD
+
+    mov [size],rcx
+    mov [enctext_ptr],rdx
+    mov [cleartext_ptr],r8
+    mov [aeskey_ptr],r9
+	
+    ;sbox, invert sbox
+    ;and rcon are created in memory
+    lea rax,[sbox]
+    mov [sbox_ptr], rax
+    fastcall createSBox, rax
+    lea rax,[rcon]
+    mov [rcon_ptr], rax
+    fastcall createRcon, rax
+    lea rax, [invert_sbox]
+    mov [invert_sbox_ptr], rax
+    fastcall createInvertSBox, rax
+
+    ;create galois lookup tables for
+    ;9, 11, 13 and 14
+    lea rax,[galois_mul9]
+    mov [mul9_table_ptr], rax
+    lea rax,[galois_mul11]
+    mov [mul11_table_ptr], rax
+    lea rax,[galois_mul13]
+    mov [mul13_table_ptr], rax
+    lea rax,[galois_mul14]
+    mov [mul14_table_ptr], rax
+    fastcall createGaloisDecryption, [mul9_table_ptr],\
+	[mul11_table_ptr], [mul13_table_ptr], [mul14_table_ptr]
+
+    ;copy the key into the round key buffer
+    mov rcx, KEY_SIZE
+    mov rsi, [aeskey_ptr]
+    lea rdi, [keychain]
+    mov [keychain_ptr], rdi
+    rep movsb
+
+    ;create the round keys
+    fastcall createKeyChain, [keychain_ptr], [sbox_ptr],\
+	    [rcon_ptr]
+
+    ;copy encrypted text to decryption buffer
+    mov rcx, [size]
+    mov rsi, [enctext_ptr]
+    mov rdi, [cleartext_ptr]
+    rep movsb
+
+    ;rsi == current to be decrypted block
+    ;ebx == end of cleartext
+    mov rsi,[cleartext_ptr]
+    mov rbx,rsi
+    add rbx,[size]
+daes_block_loop:
+    fastcall decryptionRounds, rsi, [keychain_ptr],\
+	    [invert_sbox_ptr], [mul9_table_ptr], [mul11_table_ptr],\
+	    [mul13_table_ptr], [mul14_table_ptr]
+
+    add rsi,BLOCK_SIZE
+    cmp rsi,rbx
+    jnge daes_block_loop
+
+    mov rax,1
+    ret
+
+endp
diff --git a/Src/Payloads/Aes/64/aes.inc b/Src/Payloads/Aes/64/aes.inc
old mode 100755
new mode 100644
index 2d52f1c..b4e838d
--- a/Src/Payloads/Aes/64/aes.inc
+++ b/Src/Payloads/Aes/64/aes.inc
@@ -1,7 +1,7 @@
 ;select an AES mode
 AES128			equ 1
-;AES192                  equ 1
-;AES256                  equ 1
+;AES192 		 equ 1
+;AES256 		 equ 1
 
 ;internal constants, don't change them
 include 'aes_constants_intern.inc'
\ No newline at end of file
diff --git a/Src/Payloads/Aes/64/aes_constants_intern.inc b/Src/Payloads/Aes/64/aes_constants_intern.inc
old mode 100755
new mode 100644
diff --git a/Src/Payloads/Aes/64/decryptexecutable.asm b/Src/Payloads/Aes/64/decryptexecutable.asm
index d7fb788..9087f45 100644
--- a/Src/Payloads/Aes/64/decryptexecutable.asm
+++ b/Src/Payloads/Aes/64/decryptexecutable.asm
@@ -1,107 +1,101 @@
-;Decrypt the exe which is stored in input_image
-proc decryptExecutable APITable:QWORD, input_image:QWORD
-
-local str1[256]:BYTE, ret_val:QWORD,\
-key[KEY_SIZE]:BYTE, encrypted_backup:QWORD
-
-        mov [APITable],rcx
-        mov [input_image],rdx
-        push rdi
-        push rsi
-        writeWithNewLine createStringBruteforcing, str1, dec_exit_success
-        
-        ;init key
-        lea rdi,[key]
-        mov rcx, KEY_SIZE
-        mov al,0
-dec_init_key:
-        mov [rdi],al
-        inc rdi
-        dec rcx
-        jnz dec_init_key
-
-        ;create a copy of the encrypted file
-        ;which is used to brute force the key
-        mov rax,[APITable]
-        fastcall qword [rax+VirtualAlloc], 0, INFILE_SIZE, MEM_COMMIT+MEM_RESERVE, PAGE_READWRITE
-        test rax, rax
-        jz dec_exit_error
-        mov [encrypted_backup],rax
-        ;now copy the file into the buffer
-        mov rdi,rax
-        mov rsi,[input_image]
-        mov rcx,INFILE_SIZE
-        ;we can mov qwords because buffer is a multiple of 16
-        shr rcx,3
-        repz movsq
-
-keyspace_loop:
-        lea rax,[key]
-        fastcall decAES, INFILE_SIZE, [input_image], [input_image], rax
-        fastcall verifyChecksum, [input_image], INFILE_SIZE
-        test rax,rax
-        jnz dec_decrypted_success
-
-        ;restore the encrypted version to try the next key
-        mov rsi,[encrypted_backup]
-        mov rdi,[input_image]
-        mov rcx,INFILE_SIZE
-        shr rcx,3
-        repz movsq
-        ;lea eax,[key]
-        ;stdcall encAES, [section_size],  [section_address],  [section_address], eax
-
-        ;next key
-        lea rax,[key]
-        fastcall nextKey, rax
-        test rax,rax
-        jz dec_exit_error
-        ;abort if key space was explored, else continue
-        jmp keyspace_loop
-
-dec_decrypted_success:
-        mov rax,[APITable]
-        fastcall qword [rax+VirtualFree], [encrypted_backup], 0, MEM_RELEASE
-        test rax, rax
-        jz dec_exit_error
-
-dec_exit_success:
-        mov rax,1
-        jmp dec_exit_ret 
-
-dec_exit_error:
-        sub rax,rax
-
-dec_exit_ret:
-        pop rsi
-        pop rdi
-        ret
-
-endp
-
-;generate next decryption key
-proc nextKey key_ptr:QWORD
-        mov [key_ptr],rcx
-
-        mov rax,rcx
-        mov r10,rax
-        add r10,REAL_KEY_SIZE
-nkey_next_element:
-        inc byte [rax]
-        cmp byte [rax],REAL_KEY_RANGE
-        jne nkey_not_finished
-        mov byte [rax],0
-        inc rax
-        cmp rax,r10
-        je nkey_finished
-        jmp nkey_next_element
-
-nkey_not_finished:
-        mov rax,1
-        ret
-
-nkey_finished:
-        sub rax,rax
-        ret
-
-endp;
+;Decrypt the exe which is stored in input_image
+proc decryptExecutable uses rsi rdi, input_image:QWORD
+
+local str1[256]:BYTE, ret_val:QWORD,\
+key[KEY_SIZE]:BYTE, encrypted_backup:QWORD
+
+	mov [input_image],rcx
+
+	writeWithNewLine createStringBruteforcing, str1, dec_exit_success
+	;init key
+	lea rdi,[key]
+	mov rcx, KEY_SIZE
+	mov al,0
+dec_init_key:
+	mov [rdi],al
+	inc rdi
+	dec rcx
+	jnz dec_init_key
+
+	;create a copy of the encrypted file
+	;which is used to brute force the key
+	invoke VirtualAlloc, 0, INFILE_SIZE, MEM_COMMIT+MEM_RESERVE, PAGE_READWRITE
+	test rax, rax
+	jz dec_exit_error
+	mov [encrypted_backup],rax
+	;now copy the file into the buffer
+	mov rdi,rax
+	mov rsi,[input_image]
+	mov rcx,INFILE_SIZE
+	;we can mov qwords because buffer is a multiple of 16
+	shr rcx,3
+	repz movsq
+
+keyspace_loop:
+	lea rax,[key]
+	fastcall decAES, INFILE_SIZE, [input_image], [input_image], rax
+	fastcall verifyChecksum, [input_image], INFILE_SIZE
+	test rax,rax
+	jnz dec_decrypted_success
+
+	;restore the encrypted version to try the next key
+	mov rsi,[encrypted_backup]
+	mov rdi,[input_image]
+	mov rcx,INFILE_SIZE
+	shr rcx,3
+	repz movsq
+	;lea eax,[key]
+	;stdcall encAES, [section_size],  [section_address],  [section_address], eax
+
+	;next key
+	lea rax,[key]
+	fastcall nextKey, rax
+	test rax,rax
+	jz dec_exit_error
+	;abort if key space was explored, else continue
+	jmp keyspace_loop
+
+dec_decrypted_success:
+	invoke VirtualFree, [encrypted_backup], 0, MEM_RELEASE
+	test rax, rax
+	jz dec_exit_error
+
+dec_exit_success:
+	mov rax,1
+	jmp dec_exit_ret 
+
+dec_exit_error:
+	sub rax,rax
+
+dec_exit_ret:
+	ret
+
+endp
+
+;generate next decryption key
+proc nextKey key_ptr:QWORD
+
+	mov [key_ptr],rcx
+
+	mov rax,[key_ptr]
+	mov r10,rax
+	add r10,REAL_KEY_SIZE
+nkey_next_element:
+	inc byte [rax]
+	cmp byte [rax],REAL_KEY_RANGE
+	jne nkey_not_finished
+	mov byte [rax],0
+	inc rax
+	cmp rax,r10
+	je nkey_finished
+	jmp nkey_next_element
+
+nkey_not_finished:
+	mov rax,1
+	ret
+
+nkey_finished:
+	sub rax,rax
+	ret
+
+endp;
diff --git a/Src/Payloads/Aes/64/decryptionrounds.asm b/Src/Payloads/Aes/64/decryptionrounds.asm
index 36726ac..2a776cb 100644
--- a/Src/Payloads/Aes/64/decryptionrounds.asm
+++ b/Src/Payloads/Aes/64/decryptionrounds.asm
@@ -1,168 +1,171 @@
-;uses the generated round keys to decrypt an aes block
-proc decryptionRounds decryption_ptr:QWORD,\
-     roundkeys_ptr:QWORD, inverse_sbox_ptr:QWORD, mul9_table_ptr:QWORD, \
-     mul11_table_ptr:QWORD, mul13_table_ptr:QWORD,\
-     mul14_table_ptr:QWORD
-
-    mov [decryption_ptr], rcx
-    mov [roundkeys_ptr], rdx
-    mov [inverse_sbox_ptr], r8
-    mov [mul9_table_ptr], r9
-    push rbx
-    push r12
-
-    ;roundkey and decryption in eax and ebx
-    mov r12, [roundkeys_ptr]
-    add r12, BLOCK_SIZE*ENCRYPTION_ROUNDS
-    mov rbx, [decryption_ptr]
-
-    ;final round
-    fastcall addRoundKey, rbx, r12
-    fastcall inverseShiftRows, rbx
-    fastcall subBlockBytes, rbx, [inverse_sbox_ptr]
-    sub r12,BLOCK_SIZE
-
-    ;main round
-dr_main:
-    fastcall addRoundKey, rbx, r12
-    fastcall mixColumns9111314, rbx, [mul9_table_ptr], [mul11_table_ptr],\
-            [mul13_table_ptr], [mul14_table_ptr]
-    fastcall inverseShiftRows, rbx
-    fastcall subBlockBytes, rbx, [inverse_sbox_ptr]
-    sub r12, BLOCK_SIZE
-    cmp r12, [roundkeys_ptr]
-    jne dr_main
-
-    ;initial_round
-    fastcall addRoundKey, rbx, r12
-
-    pop r12
-    pop rbx
-    ret
-endp
-
-;mix columns operation is a column matrix
-;multiplication
-proc mixColumns9111314, data_ptr:QWORD, mul9_table_ptr:QWORD,\
-     mul11_table_ptr:QWORD, mul13_table_ptr:QWORD, mul14_table_ptr:QWORD
-
-    local current_column:DWORD
-
-    mov [data_ptr],rcx
-    mov [mul9_table_ptr], rdx
-    mov [mul11_table_ptr], r8
-    mov [mul13_table_ptr], r9
-    push rbx ;16 byte alignment not neccessary because leaf function
-
-    mov rdx, [data_ptr]
-    rept 4{
-    ;element 3
-    mov eax, [rdx]
-    mov rbx, [mul9_table_ptr]
-    xlatb
-    mov cl, al
-    shr eax,8
-    mov rbx, [mul13_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax,8
-    mov rbx, [mul11_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax,8
-    mov rbx, [mul14_table_ptr]
-    xlatb
-    xor cl, al
-    mov [current_column], ecx
-    ;element 2
-    mov eax, [rdx]
-    mov rbx, [mul13_table_ptr]
-    xlatb
-    mov cl, al
-    shr eax,8
-    mov rbx, [mul11_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax,8
-    mov rbx, [mul14_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax,8
-    mov rbx, [mul9_table_ptr]
-    xlatb
-    xor cl, al
-    mov eax, [current_column]
-    shl eax, 8
-    mov al, cl
-    mov [current_column], eax
-    ;element 1
-    mov eax, [rdx]
-    mov rbx, [mul11_table_ptr]
-    xlatb
-    mov cl, al
-    shr eax,8
-    mov rbx, [mul14_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax,8
-    mov rbx, [mul9_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax,8
-    mov rbx, [mul13_table_ptr]
-    xlatb
-    xor cl, al
-    mov eax, [current_column]
-    shl eax, 8
-    mov al, cl
-    mov [current_column], eax
-    ;element 0
-    mov eax, [rdx]
-    mov rbx, [mul14_table_ptr]
-    xlatb
-    mov cl, al
-    shr eax,8
-    mov rbx, [mul9_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax,8
-    mov rbx, [mul13_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax,8
-    mov rbx, [mul11_table_ptr]
-    xlatb
-    xor cl, al
-    mov eax, [current_column]
-    shl eax, 8
-    mov al, cl
-    ;finished, store it
-    mov [rdx], eax
-    add rdx, COLUMN_SIZE
-    }
-
-    pop rbx
-    ret
-endp
-
-;reverse shift operation for decryption
-proc inverseShiftRows, data_ptr:QWORD
-    push rbx ;16 byte alignment not neccessary because leaf function
-
-    mov rbx,rcx;[data_ptr]
-    loadRow
-    rol eax, 8
-    storeRow
-    inc rbx
-    loadRow
-    rol eax, 16
-    storeRow
-    inc rbx
-    loadRow
-    rol eax, 24
-    storeRow
-
-    pop rbx
-    ret
-
-endp
+;uses the generated round keys to decrypt an aes block
+proc decryptionRounds uses rbx r12, decryption_ptr:QWORD,\
+     roundkeys_ptr:QWORD, inverse_sbox_ptr:QWORD, mul9_table_ptr:QWORD, \
+     mul11_table_ptr:QWORD, mul13_table_ptr:QWORD,\
+     mul14_table_ptr:QWORD
+
+    mov [decryption_ptr], rcx
+    mov [roundkeys_ptr], rdx
+    mov [inverse_sbox_ptr], r8
+    mov [mul9_table_ptr], r9
+
+    ;roundkey and decryption in eax and ebx
+    mov r12, [roundkeys_ptr]
+    add r12, BLOCK_SIZE*ENCRYPTION_ROUNDS
+    mov rbx, [decryption_ptr]
+
+    ;final round
+    fastcall addRoundKey, rbx, r12
+    fastcall inverseShiftRows, rbx
+    fastcall subBlockBytes, rbx, [inverse_sbox_ptr]
+    sub r12,BLOCK_SIZE
+
+    ;main round
+dr_main:
+    fastcall addRoundKey, rbx, r12
+    fastcall mixColumns9111314, rbx, [mul9_table_ptr], [mul11_table_ptr],\
+	    [mul13_table_ptr], [mul14_table_ptr]
+    fastcall inverseShiftRows, rbx
+    fastcall subBlockBytes, rbx, [inverse_sbox_ptr]
+    sub r12, BLOCK_SIZE
+    cmp r12, [roundkeys_ptr]
+    jne dr_main
+
+    ;initial_round
+    fastcall addRoundKey, rbx, r12
+    ret
+endp
+
+;mix columns operation is a column matrix
+;multiplication
+proc mixColumns9111314 uses r12 rbx, data_ptr:QWORD, mul9_table_ptr:QWORD,\
+     mul11_table_ptr:QWORD, mul13_table_ptr:QWORD, mul14_table_ptr:QWORD
+
+     local current_column:DWORD
+
+    mov [data_ptr],rcx
+    mov [mul9_table_ptr], rdx
+    mov [mul11_table_ptr], r8
+    mov [mul13_table_ptr], r9
+
+    mov rdx, [data_ptr]
+    mov r12,4
+
+mixColumns9111314_loop:
+    ;element 3
+    mov eax, [rdx]
+    bswap eax
+    mov rbx, [mul9_table_ptr]
+    xlatb
+    mov cl, al
+    shr eax,8
+    mov rbx, [mul13_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax,8
+    mov rbx, [mul11_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax,8
+    mov rbx, [mul14_table_ptr]
+    xlatb
+    xor cl, al
+    mov [current_column], ecx
+    ;element 2
+    mov eax, [rdx]
+    bswap eax
+    mov rbx, [mul13_table_ptr]
+    xlatb
+    mov cl, al
+    shr eax,8
+    mov rbx, [mul11_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax,8
+    mov rbx, [mul14_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax,8
+    mov rbx, [mul9_table_ptr]
+    xlatb
+    xor cl, al
+    mov eax, [current_column]
+    shl eax, 8
+    mov al, cl
+    mov [current_column], eax
+    ;element 1
+    mov eax, [rdx]
+    bswap eax
+    mov rbx, [mul11_table_ptr]
+    xlatb
+    mov cl, al
+    shr eax,8
+    mov rbx, [mul14_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax,8
+    mov rbx, [mul9_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax,8
+    mov rbx, [mul13_table_ptr]
+    xlatb
+    xor cl, al
+    mov eax, [current_column]
+    shl eax, 8
+    mov al, cl
+    mov [current_column], eax
+    ;element 0
+    mov eax, [rdx]
+    bswap eax
+    mov rbx, [mul14_table_ptr]
+    xlatb
+    mov cl, al
+    shr eax,8
+    mov rbx, [mul9_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax,8
+    mov rbx, [mul13_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax,8
+    mov rbx, [mul11_table_ptr]
+    xlatb
+    xor cl, al
+    mov eax, [current_column]
+    shl eax, 8
+    mov al, cl
+    ;finished, store it
+    bswap eax
+    mov [rdx], eax
+    add rdx, COLUMN_SIZE
+
+    dec r12
+    jnz mixColumns9111314_loop
+
+    ret
+endp
+
+;reverse shift operation for decryption
+proc inverseShiftRows uses rbx, data_ptr:QWORD
+
+    mov [data_ptr], rcx
+
+    mov rbx, [data_ptr]
+    inc rbx
+    fastcall loadRow, rbx
+    rol eax, 24
+    fastcall storeRow, rax, rbx
+    inc rbx
+    fastcall loadRow, rbx
+    rol eax, 16
+    fastcall storeRow, rax, rbx
+    inc rbx
+    fastcall loadRow, rbx
+    rol eax, 8
+    fastcall storeRow, rax, rbx
+
+    ret
+
+endp
diff --git a/Src/Payloads/Aes/64/encryptionrounds.asm b/Src/Payloads/Aes/64/encryptionrounds.asm
index a4cdf70..78c2ecb 100644
--- a/Src/Payloads/Aes/64/encryptionrounds.asm
+++ b/Src/Payloads/Aes/64/encryptionrounds.asm
@@ -1,227 +1,256 @@
-;uses the generated round keys to encrypt an aes block
-proc encryptionRounds encryption_ptr:QWORD,\
-     roundkeys_ptr:QWORD, sbox_ptr:QWORD, mul2_table_ptr:QWORD, \
-     mul3_table_ptr:QWORD
-
-    mov [encryption_ptr],rcx
-    mov [roundkeys_ptr],rdx
-    mov [sbox_ptr],r8
-    mov [mul2_table_ptr],r9
-    push rbx
-    push r12
-    push r13
-    sub rsp,8 ;TODO: Check alignment here
-
-    ;roundkey and encryption in eax and ebx
-    mov r12,[roundkeys_ptr]
-    mov rbx,[encryption_ptr]
-
-    ;initial round
-    fastcall addRoundKey, rbx, r12
-
-    ;main round
-    add r12,BLOCK_SIZE
-    mov r13,ENCRYPTION_ROUNDS - 1
-er_main:
-    fastcall subBlockBytes, rbx, [sbox_ptr]
-    fastcall shiftRows, rbx
-    fastcall mixColumns23, rbx, [mul2_table_ptr], [mul3_table_ptr]
-    fastcall addRoundKey, rbx, r12
-
-    add r12,BLOCK_SIZE
-    dec r13
-    jnz er_main
-
-    ;final round
-    fastcall subBlockBytes, rbx, [sbox_ptr]
-    fastcall shiftRows, rbx
-    fastcall addRoundKey, rbx, r12
-
-    add rsp,8
-    pop r13
-    pop r12
-    pop rbx
-    ret
-endp
-
-;mix columns operation is a column matrix
-;multiplication
-proc mixColumns23, data_ptr:QWORD, mul2_table_ptr:QWORD,\
-     mul3_table_ptr:QWORD
-
-    local current_column:DWORD
-
-    mov [data_ptr],rcx
-    mov [mul2_table_ptr],rdx
-    mov [mul3_table_ptr],r8
-    push rbx ;leaf function
-        
-    mov rdx, [data_ptr]
-    rept 4{
-    ;element 3
-    mov eax, [rdx]
-    mov cl, al
-    shr eax,8
-    xor cl, al
-    shr eax,8
-    mov rbx, [mul3_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax,8
-    mov rbx, [mul2_table_ptr]
-    xlatb
-    xor cl, al
-    mov [current_column], ecx
-    ;element 2
-    mov eax, [rdx]
-    mov cl, al
-    shr eax, 8
-    mov rbx, [mul3_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax, 8
-    mov rbx, [mul2_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax, 8
-    xor cl, al
-    mov eax, [current_column]
-    shl eax, 8
-    mov al, cl
-    mov [current_column], eax
-    ;element 1
-    mov eax, [rdx]
-    mov rbx, [mul3_table_ptr]
-    xlatb
-    mov cl, al
-    shr eax, 8
-    mov rbx, [mul2_table_ptr]
-    xlatb
-    xor cl, al
-    shr eax, 8
-    xor cl, al
-    shr eax, 8
-    xor cl, al
-    mov eax, [current_column]
-    shl eax, 8
-    mov al, cl
-    mov [current_column], eax
-    ;element 0
-    mov eax, [rdx]
-    mov rbx, [mul2_table_ptr]
-    xlatb
-    mov cl, al
-    shr eax, 8
-    xor cl, al
-    shr eax, 8
-    xor cl, al
-    shr eax, 8
-    mov rbx, [mul3_table_ptr]
-    xlatb
-    xor cl, al
-    mov eax, [current_column]
-    shl eax, 8
-    mov al, cl
-    ;finished, store it
-    mov [rdx], eax
-    add rdx, COLUMN_SIZE
-    }
-
-    pop rbx
-    ret
-
-endp
-
-;shifts the rows as desrcibed in the AES specification
-;the shift process is in the reversed order because of the
-;endiannes
-macro loadRow{
-    mov al, byte [rbx+00]
-    shl eax,8
-    mov al, byte [rbx+04]
-    shl eax,8
-    mov al, byte [rbx+08]
-    shl eax,8
-    mov al, byte [rbx+12]
-}
-
-macro storeRow{
-    mov byte [rbx+12], al
-    shr eax,8
-    mov byte [rbx+08], al
-    shr eax,8
-    mov byte [rbx+04], al
-    shr eax,8
-    mov byte [rbx+00], al
-}
-
-proc shiftRows, data_ptr:DWORD
-
-    push rbx ;leaf function
-    mov rbx,rcx ;[data_ptr]
-
-    loadRow
-    rol eax, 24
-    storeRow
-    inc rbx
-    loadRow
-    rol eax, 16
-    storeRow
-    inc rbx
-    loadRow
-    rol eax, 8
-    storeRow
-
-    pop rbx
-    ret
-
-endp
-
-;xors the data with the round key and stores result
-;in data
-proc addRoundKey data_ptr:QWORD, round_key_ptr:QWORD
-
-    mov r8,[rcx]
-    xor r8,[rdx]
-    mov [rcx],r8
-    add rcx,COLUMN_SIZE*2
-    add rdx,COLUMN_SIZE*2
-    mov r8,[rcx]
-    xor r8,[rdx]
-    mov [rcx],r8
-
-    ret
-
-endp
-
-;substitute aes block with s-box
-proc subBlockBytes data_ptr:QWORD, sbox_ptr:QWORD
-    push rbx ;leaf function
-
-    mov rbx,rdx ;sbox
-    rept 2{
-         mov rax,[rcx] ;data_ptr
-         xlatb
-         ror rax, 8
-         xlatb
-         ror rax, 8
-         xlatb
-         ror rax, 8
-         xlatb
-         ror rax, 8
-         xlatb
-         ror rax, 8
-         xlatb
-         ror rax, 8
-         xlatb
-         ror rax, 8
-         xlatb
-         ror rax, 8
-         mov [rcx], rax
-         add rcx,COLUMN_SIZE*2
-    }
-
-    pop rbx
-    ret
-
-endp
+;uses the generated round keys to encrypt an aes block
+proc encryptionRounds uses rbx r12 r13, encryption_ptr:QWORD,\
+     roundkeys_ptr:QWORD, sbox_ptr:QWORD, mul2_table_ptr:QWORD, \
+     mul3_table_ptr:QWORD
+
+    mov [encryption_ptr],rcx
+    mov [roundkeys_ptr],rdx
+    mov [sbox_ptr],r8
+    mov [mul2_table_ptr],r9
+
+    ;roundkey and encryption in eax and ebx
+    mov r12,[roundkeys_ptr]
+    mov rbx,[encryption_ptr]
+
+    ;initial round
+    fastcall addRoundKey, rbx, r12
+
+    ;main round
+    add r12,BLOCK_SIZE
+    mov r13,ENCRYPTION_ROUNDS - 1
+er_main:
+    fastcall subBlockBytes, rbx, [sbox_ptr]
+    fastcall shiftRows, rbx
+    fastcall mixColumns23, rbx, [mul2_table_ptr], [mul3_table_ptr]
+    fastcall addRoundKey, rbx, r12
+
+    add r12,BLOCK_SIZE
+    dec r13
+    jnz er_main
+
+    ;final round
+    fastcall subBlockBytes, rbx, [sbox_ptr]
+    fastcall shiftRows, rbx
+    fastcall addRoundKey, rbx, r12
+
+    ret
+endp
+
+;mix columns operation is a column matrix
+;multiplication
+proc mixColumns23 uses rbx r12, data_ptr:QWORD, mul2_table_ptr:QWORD,\
+     mul3_table_ptr:QWORD
+
+    local current_column:DWORD
+    mov [data_ptr],rcx
+    mov [mul2_table_ptr],rdx
+    mov [mul3_table_ptr],r8
+	
+    mov rdx, [data_ptr]
+    mov r12,4
+mixColumns23_loop:
+    ;element 3
+    mov eax, [rdx]
+    bswap eax
+    mov cl, al
+    shr eax,8
+    xor cl, al
+    shr eax,8
+    mov rbx, [mul3_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax,8
+    mov rbx, [mul2_table_ptr]
+    xlatb
+    xor cl, al
+    mov [current_column], ecx
+    ;element 2
+    mov eax, [rdx]
+    bswap eax
+    mov cl, al
+    shr eax, 8
+    mov rbx, [mul3_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax, 8
+    mov rbx, [mul2_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax, 8
+    xor cl, al
+    mov eax, [current_column]
+    shl eax, 8
+    mov al, cl
+    mov [current_column], eax
+    ;element 1
+    mov eax, [rdx]
+    bswap eax
+    mov rbx, [mul3_table_ptr]
+    xlatb
+    mov cl, al
+    shr eax, 8
+    mov rbx, [mul2_table_ptr]
+    xlatb
+    xor cl, al
+    shr eax, 8
+    xor cl, al
+    shr eax, 8
+    xor cl, al
+    mov eax, [current_column]
+    shl eax, 8
+    mov al, cl
+    mov [current_column], eax
+    ;element 0
+    mov eax, [rdx]
+    bswap eax
+    mov rbx, [mul2_table_ptr]
+    xlatb
+    mov cl, al
+    shr eax, 8
+    xor cl, al
+    shr eax, 8
+    xor cl, al
+    shr eax, 8
+    mov rbx, [mul3_table_ptr]
+    xlatb
+    xor cl, al
+    mov eax, [current_column]
+    shl eax, 8
+    mov al, cl
+    ;finished, store it
+    bswap eax
+    mov [rdx], eax
+    add rdx, COLUMN_SIZE
+
+    dec r12
+    jnz mixColumns23_loop
+
+    ret
+
+endp
+
+proc loadRow uses rsi, data_ptr:QWORD
+
+   mov [data_ptr], rcx
+
+   mov rsi, [data_ptr]
+   xor rax, rax
+   lodsb
+   shl eax, 8
+   add rsi, 3
+   lodsb
+   shl eax, 8
+   add rsi, 3
+   lodsb
+   shl eax, 8
+   add rsi, 3
+   lodsb
+
+   ret
+
+endp
+
+proc storeRow uses rdi, row:QWORD, data_ptr:QWORD
+
+   mov [row], rcx
+   mov [data_ptr], rdx
+
+   mov rdi, [data_ptr]
+   mov rcx, [row]
+   mov eax, ecx
+   rol eax, 8
+
+   stosb
+   rol eax, 8
+   add rdi, 3
+   stosb
+   rol eax, 8
+   add rdi, 3
+   stosb
+   rol eax, 8
+   add rdi, 3
+   stosb
+
+   ret
+
+endp
+
+proc shiftRows uses rbx, data_ptr:DWORD
+
+    mov [data_ptr], rcx
+
+    mov rbx, [data_ptr]
+    inc rbx
+    fastcall loadRow, rbx
+    rol eax, 8
+    fastcall storeRow, rax, rbx
+    inc rbx
+    fastcall loadRow, rbx
+    rol eax, 16
+    fastcall storeRow, rax, rbx
+    inc rbx
+    fastcall loadRow, rbx
+    rol eax, 24
+    fastcall storeRow, rax, rbx
+
+    ret
+
+endp
+
+;xors the data with the round key and stores result
+;in data
+proc addRoundKey data_ptr:QWORD, round_key_ptr:QWORD
+
+	mov [data_ptr], rcx
+	mov [round_key_ptr], rdx
+
+	mov rcx, [data_ptr]
+	mov rdx, [round_key_ptr]
+    mov r8, [rcx]
+    xor r8, [rdx]
+    mov [rcx], r8
+    add rcx, COLUMN_SIZE*2
+    add rdx, COLUMN_SIZE*2
+    mov r8, [rcx]
+    xor r8, [rdx]
+    mov [rcx], r8
+    ret
+
+endp
+
+;substitute aes block with s-box
+proc subBlockBytes uses rbx r12, data_ptr:QWORD, sbox_ptr:QWORD
+
+	mov [data_ptr], rcx
+	mov [sbox_ptr], rdx 
+
+    mov rbx, [sbox_ptr]
+	mov rcx, [data_ptr]
+    mov r12, 2
+subBlockBytes_loop:
+    mov rax, [rcx] ;data_ptr
+    xlatb
+    ror rax, 8
+    xlatb
+    ror rax, 8
+    xlatb
+    ror rax, 8
+    xlatb
+    ror rax, 8
+    xlatb
+    ror rax, 8
+    xlatb
+    ror rax, 8
+    xlatb
+    ror rax, 8
+    xlatb
+    ror rax, 8
+    mov [rcx], rax
+    add rcx, COLUMN_SIZE*2
+
+    dec r12
+    jnz subBlockBytes_loop
+
+    ret
+
+endp
diff --git a/Src/Payloads/Aes/64/galois.asm b/Src/Payloads/Aes/64/galois.asm
index 74f5e32..f18c9e3 100644
--- a/Src/Payloads/Aes/64/galois.asm
+++ b/Src/Payloads/Aes/64/galois.asm
@@ -1,123 +1,159 @@
-macro CreateGalois target, [char]
-{
-    mov byte [target], char
-    inc target
-}
-
-;create 2 lookup tables for multiplication in the
-;galois field with 2 and 3
-proc createGaloisEncryption mul2_ptr:QWORD, mul3_ptr:QWORD
-
-     CreateGalois rcx, 0x00, 0x02, 0x04, 0x06, 0x08, 0x0a, 0x0c, 0x0e, 0x10, 0x12, 0x14, 0x16, 0x18, 0x1a, 0x1c, 0x1e,\
-                       0x20, 0x22, 0x24, 0x26, 0x28, 0x2a, 0x2c, 0x2e, 0x30, 0x32, 0x34, 0x36, 0x38, 0x3a, 0x3c, 0x3e,\
-                       0x40, 0x42, 0x44, 0x46, 0x48, 0x4a, 0x4c, 0x4e, 0x50, 0x52, 0x54, 0x56, 0x58, 0x5a, 0x5c, 0x5e,\
-                       0x60, 0x62, 0x64, 0x66, 0x68, 0x6a, 0x6c, 0x6e, 0x70, 0x72, 0x74, 0x76, 0x78, 0x7a, 0x7c, 0x7e,\
-                       0x80, 0x82, 0x84, 0x86, 0x88, 0x8a, 0x8c, 0x8e, 0x90, 0x92, 0x94, 0x96, 0x98, 0x9a, 0x9c, 0x9e,\
-                       0xa0, 0xa2, 0xa4, 0xa6, 0xa8, 0xaa, 0xac, 0xae, 0xb0, 0xb2, 0xb4, 0xb6, 0xb8, 0xba, 0xbc, 0xbe,\
-                       0xc0, 0xc2, 0xc4, 0xc6, 0xc8, 0xca, 0xcc, 0xce, 0xd0, 0xd2, 0xd4, 0xd6, 0xd8, 0xda, 0xdc, 0xde,\
-                       0xe0, 0xe2, 0xe4, 0xe6, 0xe8, 0xea, 0xec, 0xee, 0xf0, 0xf2, 0xf4, 0xf6, 0xf8, 0xfa, 0xfc, 0xfe,\
-                       0x1b, 0x19, 0x1f, 0x1d, 0x13, 0x11, 0x17, 0x15, 0x0b, 0x09, 0x0f, 0x0d, 0x03, 0x01, 0x07, 0x05,\
-                       0x3b, 0x39, 0x3f, 0x3d, 0x33, 0x31, 0x37, 0x35, 0x2b, 0x29, 0x2f, 0x2d, 0x23, 0x21, 0x27, 0x25,\
-                       0x5b, 0x59, 0x5f, 0x5d, 0x53, 0x51, 0x57, 0x55, 0x4b, 0x49, 0x4f, 0x4d, 0x43, 0x41, 0x47, 0x45,\
-                       0x7b, 0x79, 0x7f, 0x7d, 0x73, 0x71, 0x77, 0x75, 0x6b, 0x69, 0x6f, 0x6d, 0x63, 0x61, 0x67, 0x65,\
-                       0x9b, 0x99, 0x9f, 0x9d, 0x93, 0x91, 0x97, 0x95, 0x8b, 0x89, 0x8f, 0x8d, 0x83, 0x81, 0x87, 0x85,\
-                       0xbb, 0xb9, 0xbf, 0xbd, 0xb3, 0xb1, 0xb7, 0xb5, 0xab, 0xa9, 0xaf, 0xad, 0xa3, 0xa1, 0xa7, 0xa5,\
-                       0xdb, 0xd9, 0xdf, 0xdd, 0xd3, 0xd1, 0xd7, 0xd5, 0xcb, 0xc9, 0xcf, 0xcd, 0xc3, 0xc1, 0xc7, 0xc5,\
-                       0xfb, 0xf9, 0xff, 0xfd, 0xf3, 0xf1, 0xf7, 0xf5, 0xeb, 0xe9, 0xef, 0xed, 0xe3, 0xe1, 0xe7, 0xe5
-
-     CreateGalois rdx, 0x00, 0x03, 0x06, 0x05, 0x0c, 0x0f, 0x0a, 0x09, 0x18, 0x1b, 0x1e, 0x1d, 0x14, 0x17, 0x12, 0x11,\
-                       0x30, 0x33, 0x36, 0x35, 0x3c, 0x3f, 0x3a, 0x39, 0x28, 0x2b, 0x2e, 0x2d, 0x24, 0x27, 0x22, 0x21,\
-                       0x60, 0x63, 0x66, 0x65, 0x6c, 0x6f, 0x6a, 0x69, 0x78, 0x7b, 0x7e, 0x7d, 0x74, 0x77, 0x72, 0x71,\
-                       0x50, 0x53, 0x56, 0x55, 0x5c, 0x5f, 0x5a, 0x59, 0x48, 0x4b, 0x4e, 0x4d, 0x44, 0x47, 0x42, 0x41,\
-                       0xc0, 0xc3, 0xc6, 0xc5, 0xcc, 0xcf, 0xca, 0xc9, 0xd8, 0xdb, 0xde, 0xdd, 0xd4, 0xd7, 0xd2, 0xd1,\
-                       0xf0, 0xf3, 0xf6, 0xf5, 0xfc, 0xff, 0xfa, 0xf9, 0xe8, 0xeb, 0xee, 0xed, 0xe4, 0xe7, 0xe2, 0xe1,\
-                       0xa0, 0xa3, 0xa6, 0xa5, 0xac, 0xaf, 0xaa, 0xa9, 0xb8, 0xbb, 0xbe, 0xbd, 0xb4, 0xb7, 0xb2, 0xb1,\
-                       0x90, 0x93, 0x96, 0x95, 0x9c, 0x9f, 0x9a, 0x99, 0x88, 0x8b, 0x8e, 0x8d, 0x84, 0x87, 0x82, 0x81,\
-                       0x9b, 0x98, 0x9d, 0x9e, 0x97, 0x94, 0x91, 0x92, 0x83, 0x80, 0x85, 0x86, 0x8f, 0x8c, 0x89, 0x8a,\
-                       0xab, 0xa8, 0xad, 0xae, 0xa7, 0xa4, 0xa1, 0xa2, 0xb3, 0xb0, 0xb5, 0xb6, 0xbf, 0xbc, 0xb9, 0xba,\
-                       0xfb, 0xf8, 0xfd, 0xfe, 0xf7, 0xf4, 0xf1, 0xf2, 0xe3, 0xe0, 0xe5, 0xe6, 0xef, 0xec, 0xe9, 0xea,\
-                       0xcb, 0xc8, 0xcd, 0xce, 0xc7, 0xc4, 0xc1, 0xc2, 0xd3, 0xd0, 0xd5, 0xd6, 0xdf, 0xdc, 0xd9, 0xda,\
-                       0x5b, 0x58, 0x5d, 0x5e, 0x57, 0x54, 0x51, 0x52, 0x43, 0x40, 0x45, 0x46, 0x4f, 0x4c, 0x49, 0x4a,\
-                       0x6b, 0x68, 0x6d, 0x6e, 0x67, 0x64, 0x61, 0x62, 0x73, 0x70, 0x75, 0x76, 0x7f, 0x7c, 0x79, 0x7a,\
-                       0x3b, 0x38, 0x3d, 0x3e, 0x37, 0x34, 0x31, 0x32, 0x23, 0x20, 0x25, 0x26, 0x2f, 0x2c, 0x29, 0x2a,\
-                       0x0b, 0x08, 0x0d, 0x0e, 0x07, 0x04, 0x01, 0x02, 0x13, 0x10, 0x15, 0x16, 0x1f, 0x1c, 0x19, 0x1a
-     ret
-
-endp
-
-;create 4 lookup tables for multiplication in the
-;galois field with 9, 11, 13 and 14
-proc createGaloisDecryption mul9_ptr:DWORD, mul11_ptr:QWORD,\
-     mul13_ptr:QWORD, mul14_ptr:QWORD
-
-     CreateGalois rcx, 0x00, 0x09, 0x12, 0x1b, 0x24, 0x2d, 0x36, 0x3f, 0x48, 0x41, 0x5a, 0x53, 0x6c, 0x65, 0x7e, 0x77, \
-                       0x90, 0x99, 0x82, 0x8b, 0xb4, 0xbd, 0xa6, 0xaf, 0xd8, 0xd1, 0xca, 0xc3, 0xfc, 0xf5, 0xee, 0xe7, \
-                       0x3b, 0x32, 0x29, 0x20, 0x1f, 0x16, 0x0d, 0x04, 0x73, 0x7a, 0x61, 0x68, 0x57, 0x5e, 0x45, 0x4c, \
-                       0xab, 0xa2, 0xb9, 0xb0, 0x8f, 0x86, 0x9d, 0x94, 0xe3, 0xea, 0xf1, 0xf8, 0xc7, 0xce, 0xd5, 0xdc, \
-                       0x76, 0x7f, 0x64, 0x6d, 0x52, 0x5b, 0x40, 0x49, 0x3e, 0x37, 0x2c, 0x25, 0x1a, 0x13, 0x08, 0x01, \
-                       0xe6, 0xef, 0xf4, 0xfd, 0xc2, 0xcb, 0xd0, 0xd9, 0xae, 0xa7, 0xbc, 0xb5, 0x8a, 0x83, 0x98, 0x91, \
-                       0x4d, 0x44, 0x5f, 0x56, 0x69, 0x60, 0x7b, 0x72, 0x05, 0x0c, 0x17, 0x1e, 0x21, 0x28, 0x33, 0x3a, \
-                       0xdd, 0xd4, 0xcf, 0xc6, 0xf9, 0xf0, 0xeb, 0xe2, 0x95, 0x9c, 0x87, 0x8e, 0xb1, 0xb8, 0xa3, 0xaa, \
-                       0xec, 0xe5, 0xfe, 0xf7, 0xc8, 0xc1, 0xda, 0xd3, 0xa4, 0xad, 0xb6, 0xbf, 0x80, 0x89, 0x92, 0x9b, \
-                       0x7c, 0x75, 0x6e, 0x67, 0x58, 0x51, 0x4a, 0x43, 0x34, 0x3d, 0x26, 0x2f, 0x10, 0x19, 0x02, 0x0b, \
-                       0xd7, 0xde, 0xc5, 0xcc, 0xf3, 0xfa, 0xe1, 0xe8, 0x9f, 0x96, 0x8d, 0x84, 0xbb, 0xb2, 0xa9, 0xa0, \
-                       0x47, 0x4e, 0x55, 0x5c, 0x63, 0x6a, 0x71, 0x78, 0x0f, 0x06, 0x1d, 0x14, 0x2b, 0x22, 0x39, 0x30, \
-                       0x9a, 0x93, 0x88, 0x81, 0xbe, 0xb7, 0xac, 0xa5, 0xd2, 0xdb, 0xc0, 0xc9, 0xf6, 0xff, 0xe4, 0xed, \
-                       0x0a, 0x03, 0x18, 0x11, 0x2e, 0x27, 0x3c, 0x35, 0x42, 0x4b, 0x50, 0x59, 0x66, 0x6f, 0x74, 0x7d, \
-                       0xa1, 0xa8, 0xb3, 0xba, 0x85, 0x8c, 0x97, 0x9e, 0xe9, 0xe0, 0xfb, 0xf2, 0xcd, 0xc4, 0xdf, 0xd6, \
-                       0x31, 0x38, 0x23, 0x2a, 0x15, 0x1c, 0x07, 0x0e, 0x79, 0x70, 0x6b, 0x62, 0x5d, 0x54, 0x4f, 0x46
-
-     CreateGalois rdx, 0x00, 0x0b, 0x16, 0x1d, 0x2c, 0x27, 0x3a, 0x31, 0x58, 0x53, 0x4e, 0x45, 0x74, 0x7f, 0x62, 0x69, \
-                       0xb0, 0xbb, 0xa6, 0xad, 0x9c, 0x97, 0x8a, 0x81, 0xe8, 0xe3, 0xfe, 0xf5, 0xc4, 0xcf, 0xd2, 0xd9, \
-                       0x7b, 0x70, 0x6d, 0x66, 0x57, 0x5c, 0x41, 0x4a, 0x23, 0x28, 0x35, 0x3e, 0x0f, 0x04, 0x19, 0x12, \
-                       0xcb, 0xc0, 0xdd, 0xd6, 0xe7, 0xec, 0xf1, 0xfa, 0x93, 0x98, 0x85, 0x8e, 0xbf, 0xb4, 0xa9, 0xa2, \
-                       0xf6, 0xfd, 0xe0, 0xeb, 0xda, 0xd1, 0xcc, 0xc7, 0xae, 0xa5, 0xb8, 0xb3, 0x82, 0x89, 0x94, 0x9f, \
-                       0x46, 0x4d, 0x50, 0x5b, 0x6a, 0x61, 0x7c, 0x77, 0x1e, 0x15, 0x08, 0x03, 0x32, 0x39, 0x24, 0x2f, \
-                       0x8d, 0x86, 0x9b, 0x90, 0xa1, 0xaa, 0xb7, 0xbc, 0xd5, 0xde, 0xc3, 0xc8, 0xf9, 0xf2, 0xef, 0xe4, \
-                       0x3d, 0x36, 0x2b, 0x20, 0x11, 0x1a, 0x07, 0x0c, 0x65, 0x6e, 0x73, 0x78, 0x49, 0x42, 0x5f, 0x54, \
-                       0xf7, 0xfc, 0xe1, 0xea, 0xdb, 0xd0, 0xcd, 0xc6, 0xaf, 0xa4, 0xb9, 0xb2, 0x83, 0x88, 0x95, 0x9e, \
-                       0x47, 0x4c, 0x51, 0x5a, 0x6b, 0x60, 0x7d, 0x76, 0x1f, 0x14, 0x09, 0x02, 0x33, 0x38, 0x25, 0x2e, \
-                       0x8c, 0x87, 0x9a, 0x91, 0xa0, 0xab, 0xb6, 0xbd, 0xd4, 0xdf, 0xc2, 0xc9, 0xf8, 0xf3, 0xee, 0xe5, \
-                       0x3c, 0x37, 0x2a, 0x21, 0x10, 0x1b, 0x06, 0x0d, 0x64, 0x6f, 0x72, 0x79, 0x48, 0x43, 0x5e, 0x55, \
-                       0x01, 0x0a, 0x17, 0x1c, 0x2d, 0x26, 0x3b, 0x30, 0x59, 0x52, 0x4f, 0x44, 0x75, 0x7e, 0x63, 0x68, \
-                       0xb1, 0xba, 0xa7, 0xac, 0x9d, 0x96, 0x8b, 0x80, 0xe9, 0xe2, 0xff, 0xf4, 0xc5, 0xce, 0xd3, 0xd8, \
-                       0x7a, 0x71, 0x6c, 0x67, 0x56, 0x5d, 0x40, 0x4b, 0x22, 0x29, 0x34, 0x3f, 0x0e, 0x05, 0x18, 0x13, \
-                       0xca, 0xc1, 0xdc, 0xd7, 0xe6, 0xed, 0xf0, 0xfb, 0x92, 0x99, 0x84, 0x8f, 0xbe, 0xb5, 0xa8, 0xa3
-
-     CreateGalois r8, 0x00, 0x0d, 0x1a, 0x17, 0x34, 0x39, 0x2e, 0x23, 0x68, 0x65, 0x72, 0x7f, 0x5c, 0x51, 0x46, 0x4b, \
-                       0xd0, 0xdd, 0xca, 0xc7, 0xe4, 0xe9, 0xfe, 0xf3, 0xb8, 0xb5, 0xa2, 0xaf, 0x8c, 0x81, 0x96, 0x9b, \
-                       0xbb, 0xb6, 0xa1, 0xac, 0x8f, 0x82, 0x95, 0x98, 0xd3, 0xde, 0xc9, 0xc4, 0xe7, 0xea, 0xfd, 0xf0, \
-                       0x6b, 0x66, 0x71, 0x7c, 0x5f, 0x52, 0x45, 0x48, 0x03, 0x0e, 0x19, 0x14, 0x37, 0x3a, 0x2d, 0x20, \
-                       0x6d, 0x60, 0x77, 0x7a, 0x59, 0x54, 0x43, 0x4e, 0x05, 0x08, 0x1f, 0x12, 0x31, 0x3c, 0x2b, 0x26, \
-                       0xbd, 0xb0, 0xa7, 0xaa, 0x89, 0x84, 0x93, 0x9e, 0xd5, 0xd8, 0xcf, 0xc2, 0xe1, 0xec, 0xfb, 0xf6, \
-                       0xd6, 0xdb, 0xcc, 0xc1, 0xe2, 0xef, 0xf8, 0xf5, 0xbe, 0xb3, 0xa4, 0xa9, 0x8a, 0x87, 0x90, 0x9d, \
-                       0x06, 0x0b, 0x1c, 0x11, 0x32, 0x3f, 0x28, 0x25, 0x6e, 0x63, 0x74, 0x79, 0x5a, 0x57, 0x40, 0x4d, \
-                       0xda, 0xd7, 0xc0, 0xcd, 0xee, 0xe3, 0xf4, 0xf9, 0xb2, 0xbf, 0xa8, 0xa5, 0x86, 0x8b, 0x9c, 0x91, \
-                       0x0a, 0x07, 0x10, 0x1d, 0x3e, 0x33, 0x24, 0x29, 0x62, 0x6f, 0x78, 0x75, 0x56, 0x5b, 0x4c, 0x41, \
-                       0x61, 0x6c, 0x7b, 0x76, 0x55, 0x58, 0x4f, 0x42, 0x09, 0x04, 0x13, 0x1e, 0x3d, 0x30, 0x27, 0x2a, \
-                       0xb1, 0xbc, 0xab, 0xa6, 0x85, 0x88, 0x9f, 0x92, 0xd9, 0xd4, 0xc3, 0xce, 0xed, 0xe0, 0xf7, 0xfa, \
-                       0xb7, 0xba, 0xad, 0xa0, 0x83, 0x8e, 0x99, 0x94, 0xdf, 0xd2, 0xc5, 0xc8, 0xeb, 0xe6, 0xf1, 0xfc, \
-                       0x67, 0x6a, 0x7d, 0x70, 0x53, 0x5e, 0x49, 0x44, 0x0f, 0x02, 0x15, 0x18, 0x3b, 0x36, 0x21, 0x2c, \
-                       0x0c, 0x01, 0x16, 0x1b, 0x38, 0x35, 0x22, 0x2f, 0x64, 0x69, 0x7e, 0x73, 0x50, 0x5d, 0x4a, 0x47, \
-                       0xdc, 0xd1, 0xc6, 0xcb, 0xe8, 0xe5, 0xf2, 0xff, 0xb4, 0xb9, 0xae, 0xa3, 0x80, 0x8d, 0x9a, 0x97
-
-     CreateGalois r9, 0x00, 0x0e, 0x1c, 0x12, 0x38, 0x36, 0x24, 0x2a, 0x70, 0x7e, 0x6c, 0x62, 0x48, 0x46, 0x54, 0x5a, \
-                       0xe0, 0xee, 0xfc, 0xf2, 0xd8, 0xd6, 0xc4, 0xca, 0x90, 0x9e, 0x8c, 0x82, 0xa8, 0xa6, 0xb4, 0xba, \
-                       0xdb, 0xd5, 0xc7, 0xc9, 0xe3, 0xed, 0xff, 0xf1, 0xab, 0xa5, 0xb7, 0xb9, 0x93, 0x9d, 0x8f, 0x81, \
-                       0x3b, 0x35, 0x27, 0x29, 0x03, 0x0d, 0x1f, 0x11, 0x4b, 0x45, 0x57, 0x59, 0x73, 0x7d, 0x6f, 0x61, \
-                       0xad, 0xa3, 0xb1, 0xbf, 0x95, 0x9b, 0x89, 0x87, 0xdd, 0xd3, 0xc1, 0xcf, 0xe5, 0xeb, 0xf9, 0xf7, \
-                       0x4d, 0x43, 0x51, 0x5f, 0x75, 0x7b, 0x69, 0x67, 0x3d, 0x33, 0x21, 0x2f, 0x05, 0x0b, 0x19, 0x17, \
-                       0x76, 0x78, 0x6a, 0x64, 0x4e, 0x40, 0x52, 0x5c, 0x06, 0x08, 0x1a, 0x14, 0x3e, 0x30, 0x22, 0x2c, \
-                       0x96, 0x98, 0x8a, 0x84, 0xae, 0xa0, 0xb2, 0xbc, 0xe6, 0xe8, 0xfa, 0xf4, 0xde, 0xd0, 0xc2, 0xcc, \
-                       0x41, 0x4f, 0x5d, 0x53, 0x79, 0x77, 0x65, 0x6b, 0x31, 0x3f, 0x2d, 0x23, 0x09, 0x07, 0x15, 0x1b, \
-                       0xa1, 0xaf, 0xbd, 0xb3, 0x99, 0x97, 0x85, 0x8b, 0xd1, 0xdf, 0xcd, 0xc3, 0xe9, 0xe7, 0xf5, 0xfb, \
-                       0x9a, 0x94, 0x86, 0x88, 0xa2, 0xac, 0xbe, 0xb0, 0xea, 0xe4, 0xf6, 0xf8, 0xd2, 0xdc, 0xce, 0xc0, \
-                       0x7a, 0x74, 0x66, 0x68, 0x42, 0x4c, 0x5e, 0x50, 0x0a, 0x04, 0x16, 0x18, 0x32, 0x3c, 0x2e, 0x20, \
-                       0xec, 0xe2, 0xf0, 0xfe, 0xd4, 0xda, 0xc8, 0xc6, 0x9c, 0x92, 0x80, 0x8e, 0xa4, 0xaa, 0xb8, 0xb6, \
-                       0x0c, 0x02, 0x10, 0x1e, 0x34, 0x3a, 0x28, 0x26, 0x7c, 0x72, 0x60, 0x6e, 0x44, 0x4a, 0x58, 0x56, \
-                       0x37, 0x39, 0x2b, 0x25, 0x0f, 0x01, 0x13, 0x1d, 0x47, 0x49, 0x5b, 0x55, 0x7f, 0x71, 0x63, 0x6d, \
-                       0xd7, 0xd9, 0xcb, 0xc5, 0xef, 0xe1, 0xf3, 0xfd, 0xa7, 0xa9, 0xbb, 0xb5, 0x9f, 0x91, 0x83, 0x8d
-
-     ret
-
-endp
+;loads the galois lookup tables into memory. idea behind this implementation:
+;add garbage code, split up array into sub-arrays, reverse order, etc.
+;to hide rcon where its neccessary
+
+;create 2 lookup tables for multiplication in the
+;galois field with 2 and 3
+proc createGaloisEncryption uses rdi rsi, mul2_ptr:QWORD, mul3_ptr:QWORD
+     mov [mul2_ptr],rcx
+     mov [mul3_ptr],rdx
+
+     mov rdi,[mul2_ptr]
+     mov rsi,galois_mul2
+     mov rcx,GALOIS_SIZE
+     repz movsb
+
+     mov rdi,[mul3_ptr]
+     mov rsi,galois_mul3
+     mov rcx,GALOIS_SIZE
+     repz movsb
+
+     ret
+
+     galois_mul2    db 0x00, 0x02, 0x04, 0x06, 0x08, 0x0a, 0x0c, 0x0e, 0x10, 0x12, 0x14, 0x16, 0x18, 0x1a, 0x1c, 0x1e,\
+		       0x20, 0x22, 0x24, 0x26, 0x28, 0x2a, 0x2c, 0x2e, 0x30, 0x32, 0x34, 0x36, 0x38, 0x3a, 0x3c, 0x3e,\
+		       0x40, 0x42, 0x44, 0x46, 0x48, 0x4a, 0x4c, 0x4e, 0x50, 0x52, 0x54, 0x56, 0x58, 0x5a, 0x5c, 0x5e,\
+		       0x60, 0x62, 0x64, 0x66, 0x68, 0x6a, 0x6c, 0x6e, 0x70, 0x72, 0x74, 0x76, 0x78, 0x7a, 0x7c, 0x7e,\
+		       0x80, 0x82, 0x84, 0x86, 0x88, 0x8a, 0x8c, 0x8e, 0x90, 0x92, 0x94, 0x96, 0x98, 0x9a, 0x9c, 0x9e,\
+		       0xa0, 0xa2, 0xa4, 0xa6, 0xa8, 0xaa, 0xac, 0xae, 0xb0, 0xb2, 0xb4, 0xb6, 0xb8, 0xba, 0xbc, 0xbe,\
+		       0xc0, 0xc2, 0xc4, 0xc6, 0xc8, 0xca, 0xcc, 0xce, 0xd0, 0xd2, 0xd4, 0xd6, 0xd8, 0xda, 0xdc, 0xde,\
+		       0xe0, 0xe2, 0xe4, 0xe6, 0xe8, 0xea, 0xec, 0xee, 0xf0, 0xf2, 0xf4, 0xf6, 0xf8, 0xfa, 0xfc, 0xfe,\
+		       0x1b, 0x19, 0x1f, 0x1d, 0x13, 0x11, 0x17, 0x15, 0x0b, 0x09, 0x0f, 0x0d, 0x03, 0x01, 0x07, 0x05,\
+		       0x3b, 0x39, 0x3f, 0x3d, 0x33, 0x31, 0x37, 0x35, 0x2b, 0x29, 0x2f, 0x2d, 0x23, 0x21, 0x27, 0x25,\
+		       0x5b, 0x59, 0x5f, 0x5d, 0x53, 0x51, 0x57, 0x55, 0x4b, 0x49, 0x4f, 0x4d, 0x43, 0x41, 0x47, 0x45,\
+		       0x7b, 0x79, 0x7f, 0x7d, 0x73, 0x71, 0x77, 0x75, 0x6b, 0x69, 0x6f, 0x6d, 0x63, 0x61, 0x67, 0x65,\
+		       0x9b, 0x99, 0x9f, 0x9d, 0x93, 0x91, 0x97, 0x95, 0x8b, 0x89, 0x8f, 0x8d, 0x83, 0x81, 0x87, 0x85,\
+		       0xbb, 0xb9, 0xbf, 0xbd, 0xb3, 0xb1, 0xb7, 0xb5, 0xab, 0xa9, 0xaf, 0xad, 0xa3, 0xa1, 0xa7, 0xa5,\
+		       0xdb, 0xd9, 0xdf, 0xdd, 0xd3, 0xd1, 0xd7, 0xd5, 0xcb, 0xc9, 0xcf, 0xcd, 0xc3, 0xc1, 0xc7, 0xc5,\
+		       0xfb, 0xf9, 0xff, 0xfd, 0xf3, 0xf1, 0xf7, 0xf5, 0xeb, 0xe9, 0xef, 0xed, 0xe3, 0xe1, 0xe7, 0xe5
+
+     galois_mul3    db 0x00, 0x03, 0x06, 0x05, 0x0c, 0x0f, 0x0a, 0x09, 0x18, 0x1b, 0x1e, 0x1d, 0x14, 0x17, 0x12, 0x11,\
+		       0x30, 0x33, 0x36, 0x35, 0x3c, 0x3f, 0x3a, 0x39, 0x28, 0x2b, 0x2e, 0x2d, 0x24, 0x27, 0x22, 0x21,\
+		       0x60, 0x63, 0x66, 0x65, 0x6c, 0x6f, 0x6a, 0x69, 0x78, 0x7b, 0x7e, 0x7d, 0x74, 0x77, 0x72, 0x71,\
+		       0x50, 0x53, 0x56, 0x55, 0x5c, 0x5f, 0x5a, 0x59, 0x48, 0x4b, 0x4e, 0x4d, 0x44, 0x47, 0x42, 0x41,\
+		       0xc0, 0xc3, 0xc6, 0xc5, 0xcc, 0xcf, 0xca, 0xc9, 0xd8, 0xdb, 0xde, 0xdd, 0xd4, 0xd7, 0xd2, 0xd1,\
+		       0xf0, 0xf3, 0xf6, 0xf5, 0xfc, 0xff, 0xfa, 0xf9, 0xe8, 0xeb, 0xee, 0xed, 0xe4, 0xe7, 0xe2, 0xe1,\
+		       0xa0, 0xa3, 0xa6, 0xa5, 0xac, 0xaf, 0xaa, 0xa9, 0xb8, 0xbb, 0xbe, 0xbd, 0xb4, 0xb7, 0xb2, 0xb1,\
+		       0x90, 0x93, 0x96, 0x95, 0x9c, 0x9f, 0x9a, 0x99, 0x88, 0x8b, 0x8e, 0x8d, 0x84, 0x87, 0x82, 0x81,\
+		       0x9b, 0x98, 0x9d, 0x9e, 0x97, 0x94, 0x91, 0x92, 0x83, 0x80, 0x85, 0x86, 0x8f, 0x8c, 0x89, 0x8a,\
+		       0xab, 0xa8, 0xad, 0xae, 0xa7, 0xa4, 0xa1, 0xa2, 0xb3, 0xb0, 0xb5, 0xb6, 0xbf, 0xbc, 0xb9, 0xba,\
+		       0xfb, 0xf8, 0xfd, 0xfe, 0xf7, 0xf4, 0xf1, 0xf2, 0xe3, 0xe0, 0xe5, 0xe6, 0xef, 0xec, 0xe9, 0xea,\
+		       0xcb, 0xc8, 0xcd, 0xce, 0xc7, 0xc4, 0xc1, 0xc2, 0xd3, 0xd0, 0xd5, 0xd6, 0xdf, 0xdc, 0xd9, 0xda,\
+		       0x5b, 0x58, 0x5d, 0x5e, 0x57, 0x54, 0x51, 0x52, 0x43, 0x40, 0x45, 0x46, 0x4f, 0x4c, 0x49, 0x4a,\
+		       0x6b, 0x68, 0x6d, 0x6e, 0x67, 0x64, 0x61, 0x62, 0x73, 0x70, 0x75, 0x76, 0x7f, 0x7c, 0x79, 0x7a,\
+		       0x3b, 0x38, 0x3d, 0x3e, 0x37, 0x34, 0x31, 0x32, 0x23, 0x20, 0x25, 0x26, 0x2f, 0x2c, 0x29, 0x2a,\
+		       0x0b, 0x08, 0x0d, 0x0e, 0x07, 0x04, 0x01, 0x02, 0x13, 0x10, 0x15, 0x16, 0x1f, 0x1c, 0x19, 0x1a
+
+endp
+
+;create 4 lookup tables for multiplication in the
+;galois field with 9, 11, 13 and 14
+proc createGaloisDecryption uses rdi rsi, mul9_ptr:QWORD, mul11_ptr:QWORD,\
+     mul13_ptr:QWORD, mul14_ptr:QWORD
+
+     mov [mul9_ptr],rcx
+     mov [mul11_ptr],rdx
+     mov [mul13_ptr],r8
+     mov [mul14_ptr],r9
+
+     mov rdi,[mul9_ptr]
+     mov rsi,galois_mul9
+     mov rcx,GALOIS_SIZE
+     repz movsb
+
+     mov rdi,[mul11_ptr]
+     mov rsi,galois_mul11
+     mov rcx,GALOIS_SIZE
+     repz movsb
+
+     mov rdi,[mul13_ptr]
+     mov rsi,galois_mul13
+     mov rcx,GALOIS_SIZE
+     repz movsb
+
+     mov rdi,[mul14_ptr]
+     mov rsi,galois_mul14
+     mov rcx,GALOIS_SIZE
+     repz movsb
+
+     ret
+
+     galois_mul9    db 0x00, 0x09, 0x12, 0x1b, 0x24, 0x2d, 0x36, 0x3f, 0x48, 0x41, 0x5a, 0x53, 0x6c, 0x65, 0x7e, 0x77, \
+		       0x90, 0x99, 0x82, 0x8b, 0xb4, 0xbd, 0xa6, 0xaf, 0xd8, 0xd1, 0xca, 0xc3, 0xfc, 0xf5, 0xee, 0xe7, \
+		       0x3b, 0x32, 0x29, 0x20, 0x1f, 0x16, 0x0d, 0x04, 0x73, 0x7a, 0x61, 0x68, 0x57, 0x5e, 0x45, 0x4c, \
+		       0xab, 0xa2, 0xb9, 0xb0, 0x8f, 0x86, 0x9d, 0x94, 0xe3, 0xea, 0xf1, 0xf8, 0xc7, 0xce, 0xd5, 0xdc, \
+		       0x76, 0x7f, 0x64, 0x6d, 0x52, 0x5b, 0x40, 0x49, 0x3e, 0x37, 0x2c, 0x25, 0x1a, 0x13, 0x08, 0x01, \
+		       0xe6, 0xef, 0xf4, 0xfd, 0xc2, 0xcb, 0xd0, 0xd9, 0xae, 0xa7, 0xbc, 0xb5, 0x8a, 0x83, 0x98, 0x91, \
+		       0x4d, 0x44, 0x5f, 0x56, 0x69, 0x60, 0x7b, 0x72, 0x05, 0x0c, 0x17, 0x1e, 0x21, 0x28, 0x33, 0x3a, \
+		       0xdd, 0xd4, 0xcf, 0xc6, 0xf9, 0xf0, 0xeb, 0xe2, 0x95, 0x9c, 0x87, 0x8e, 0xb1, 0xb8, 0xa3, 0xaa, \
+		       0xec, 0xe5, 0xfe, 0xf7, 0xc8, 0xc1, 0xda, 0xd3, 0xa4, 0xad, 0xb6, 0xbf, 0x80, 0x89, 0x92, 0x9b, \
+		       0x7c, 0x75, 0x6e, 0x67, 0x58, 0x51, 0x4a, 0x43, 0x34, 0x3d, 0x26, 0x2f, 0x10, 0x19, 0x02, 0x0b, \
+		       0xd7, 0xde, 0xc5, 0xcc, 0xf3, 0xfa, 0xe1, 0xe8, 0x9f, 0x96, 0x8d, 0x84, 0xbb, 0xb2, 0xa9, 0xa0, \
+		       0x47, 0x4e, 0x55, 0x5c, 0x63, 0x6a, 0x71, 0x78, 0x0f, 0x06, 0x1d, 0x14, 0x2b, 0x22, 0x39, 0x30, \
+		       0x9a, 0x93, 0x88, 0x81, 0xbe, 0xb7, 0xac, 0xa5, 0xd2, 0xdb, 0xc0, 0xc9, 0xf6, 0xff, 0xe4, 0xed, \
+		       0x0a, 0x03, 0x18, 0x11, 0x2e, 0x27, 0x3c, 0x35, 0x42, 0x4b, 0x50, 0x59, 0x66, 0x6f, 0x74, 0x7d, \
+		       0xa1, 0xa8, 0xb3, 0xba, 0x85, 0x8c, 0x97, 0x9e, 0xe9, 0xe0, 0xfb, 0xf2, 0xcd, 0xc4, 0xdf, 0xd6, \
+		       0x31, 0x38, 0x23, 0x2a, 0x15, 0x1c, 0x07, 0x0e, 0x79, 0x70, 0x6b, 0x62, 0x5d, 0x54, 0x4f, 0x46
+
+     galois_mul11   db 0x00, 0x0b, 0x16, 0x1d, 0x2c, 0x27, 0x3a, 0x31, 0x58, 0x53, 0x4e, 0x45, 0x74, 0x7f, 0x62, 0x69, \
+		       0xb0, 0xbb, 0xa6, 0xad, 0x9c, 0x97, 0x8a, 0x81, 0xe8, 0xe3, 0xfe, 0xf5, 0xc4, 0xcf, 0xd2, 0xd9, \
+		       0x7b, 0x70, 0x6d, 0x66, 0x57, 0x5c, 0x41, 0x4a, 0x23, 0x28, 0x35, 0x3e, 0x0f, 0x04, 0x19, 0x12, \
+		       0xcb, 0xc0, 0xdd, 0xd6, 0xe7, 0xec, 0xf1, 0xfa, 0x93, 0x98, 0x85, 0x8e, 0xbf, 0xb4, 0xa9, 0xa2, \
+		       0xf6, 0xfd, 0xe0, 0xeb, 0xda, 0xd1, 0xcc, 0xc7, 0xae, 0xa5, 0xb8, 0xb3, 0x82, 0x89, 0x94, 0x9f, \
+		       0x46, 0x4d, 0x50, 0x5b, 0x6a, 0x61, 0x7c, 0x77, 0x1e, 0x15, 0x08, 0x03, 0x32, 0x39, 0x24, 0x2f, \
+		       0x8d, 0x86, 0x9b, 0x90, 0xa1, 0xaa, 0xb7, 0xbc, 0xd5, 0xde, 0xc3, 0xc8, 0xf9, 0xf2, 0xef, 0xe4, \
+		       0x3d, 0x36, 0x2b, 0x20, 0x11, 0x1a, 0x07, 0x0c, 0x65, 0x6e, 0x73, 0x78, 0x49, 0x42, 0x5f, 0x54, \
+		       0xf7, 0xfc, 0xe1, 0xea, 0xdb, 0xd0, 0xcd, 0xc6, 0xaf, 0xa4, 0xb9, 0xb2, 0x83, 0x88, 0x95, 0x9e, \
+		       0x47, 0x4c, 0x51, 0x5a, 0x6b, 0x60, 0x7d, 0x76, 0x1f, 0x14, 0x09, 0x02, 0x33, 0x38, 0x25, 0x2e, \
+		       0x8c, 0x87, 0x9a, 0x91, 0xa0, 0xab, 0xb6, 0xbd, 0xd4, 0xdf, 0xc2, 0xc9, 0xf8, 0xf3, 0xee, 0xe5, \
+		       0x3c, 0x37, 0x2a, 0x21, 0x10, 0x1b, 0x06, 0x0d, 0x64, 0x6f, 0x72, 0x79, 0x48, 0x43, 0x5e, 0x55, \
+		       0x01, 0x0a, 0x17, 0x1c, 0x2d, 0x26, 0x3b, 0x30, 0x59, 0x52, 0x4f, 0x44, 0x75, 0x7e, 0x63, 0x68, \
+		       0xb1, 0xba, 0xa7, 0xac, 0x9d, 0x96, 0x8b, 0x80, 0xe9, 0xe2, 0xff, 0xf4, 0xc5, 0xce, 0xd3, 0xd8, \
+		       0x7a, 0x71, 0x6c, 0x67, 0x56, 0x5d, 0x40, 0x4b, 0x22, 0x29, 0x34, 0x3f, 0x0e, 0x05, 0x18, 0x13, \
+		       0xca, 0xc1, 0xdc, 0xd7, 0xe6, 0xed, 0xf0, 0xfb, 0x92, 0x99, 0x84, 0x8f, 0xbe, 0xb5, 0xa8, 0xa3
+
+     galois_mul13   db 0x00, 0x0d, 0x1a, 0x17, 0x34, 0x39, 0x2e, 0x23, 0x68, 0x65, 0x72, 0x7f, 0x5c, 0x51, 0x46, 0x4b, \
+		       0xd0, 0xdd, 0xca, 0xc7, 0xe4, 0xe9, 0xfe, 0xf3, 0xb8, 0xb5, 0xa2, 0xaf, 0x8c, 0x81, 0x96, 0x9b, \
+		       0xbb, 0xb6, 0xa1, 0xac, 0x8f, 0x82, 0x95, 0x98, 0xd3, 0xde, 0xc9, 0xc4, 0xe7, 0xea, 0xfd, 0xf0, \
+		       0x6b, 0x66, 0x71, 0x7c, 0x5f, 0x52, 0x45, 0x48, 0x03, 0x0e, 0x19, 0x14, 0x37, 0x3a, 0x2d, 0x20, \
+		       0x6d, 0x60, 0x77, 0x7a, 0x59, 0x54, 0x43, 0x4e, 0x05, 0x08, 0x1f, 0x12, 0x31, 0x3c, 0x2b, 0x26, \
+		       0xbd, 0xb0, 0xa7, 0xaa, 0x89, 0x84, 0x93, 0x9e, 0xd5, 0xd8, 0xcf, 0xc2, 0xe1, 0xec, 0xfb, 0xf6, \
+		       0xd6, 0xdb, 0xcc, 0xc1, 0xe2, 0xef, 0xf8, 0xf5, 0xbe, 0xb3, 0xa4, 0xa9, 0x8a, 0x87, 0x90, 0x9d, \
+		       0x06, 0x0b, 0x1c, 0x11, 0x32, 0x3f, 0x28, 0x25, 0x6e, 0x63, 0x74, 0x79, 0x5a, 0x57, 0x40, 0x4d, \
+		       0xda, 0xd7, 0xc0, 0xcd, 0xee, 0xe3, 0xf4, 0xf9, 0xb2, 0xbf, 0xa8, 0xa5, 0x86, 0x8b, 0x9c, 0x91, \
+		       0x0a, 0x07, 0x10, 0x1d, 0x3e, 0x33, 0x24, 0x29, 0x62, 0x6f, 0x78, 0x75, 0x56, 0x5b, 0x4c, 0x41, \
+		       0x61, 0x6c, 0x7b, 0x76, 0x55, 0x58, 0x4f, 0x42, 0x09, 0x04, 0x13, 0x1e, 0x3d, 0x30, 0x27, 0x2a, \
+		       0xb1, 0xbc, 0xab, 0xa6, 0x85, 0x88, 0x9f, 0x92, 0xd9, 0xd4, 0xc3, 0xce, 0xed, 0xe0, 0xf7, 0xfa, \
+		       0xb7, 0xba, 0xad, 0xa0, 0x83, 0x8e, 0x99, 0x94, 0xdf, 0xd2, 0xc5, 0xc8, 0xeb, 0xe6, 0xf1, 0xfc, \
+		       0x67, 0x6a, 0x7d, 0x70, 0x53, 0x5e, 0x49, 0x44, 0x0f, 0x02, 0x15, 0x18, 0x3b, 0x36, 0x21, 0x2c, \
+		       0x0c, 0x01, 0x16, 0x1b, 0x38, 0x35, 0x22, 0x2f, 0x64, 0x69, 0x7e, 0x73, 0x50, 0x5d, 0x4a, 0x47, \
+		       0xdc, 0xd1, 0xc6, 0xcb, 0xe8, 0xe5, 0xf2, 0xff, 0xb4, 0xb9, 0xae, 0xa3, 0x80, 0x8d, 0x9a, 0x97
+
+     galois_mul14   db 0x00, 0x0e, 0x1c, 0x12, 0x38, 0x36, 0x24, 0x2a, 0x70, 0x7e, 0x6c, 0x62, 0x48, 0x46, 0x54, 0x5a, \
+		       0xe0, 0xee, 0xfc, 0xf2, 0xd8, 0xd6, 0xc4, 0xca, 0x90, 0x9e, 0x8c, 0x82, 0xa8, 0xa6, 0xb4, 0xba, \
+		       0xdb, 0xd5, 0xc7, 0xc9, 0xe3, 0xed, 0xff, 0xf1, 0xab, 0xa5, 0xb7, 0xb9, 0x93, 0x9d, 0x8f, 0x81, \
+		       0x3b, 0x35, 0x27, 0x29, 0x03, 0x0d, 0x1f, 0x11, 0x4b, 0x45, 0x57, 0x59, 0x73, 0x7d, 0x6f, 0x61, \
+		       0xad, 0xa3, 0xb1, 0xbf, 0x95, 0x9b, 0x89, 0x87, 0xdd, 0xd3, 0xc1, 0xcf, 0xe5, 0xeb, 0xf9, 0xf7, \
+		       0x4d, 0x43, 0x51, 0x5f, 0x75, 0x7b, 0x69, 0x67, 0x3d, 0x33, 0x21, 0x2f, 0x05, 0x0b, 0x19, 0x17, \
+		       0x76, 0x78, 0x6a, 0x64, 0x4e, 0x40, 0x52, 0x5c, 0x06, 0x08, 0x1a, 0x14, 0x3e, 0x30, 0x22, 0x2c, \
+		       0x96, 0x98, 0x8a, 0x84, 0xae, 0xa0, 0xb2, 0xbc, 0xe6, 0xe8, 0xfa, 0xf4, 0xde, 0xd0, 0xc2, 0xcc, \
+		       0x41, 0x4f, 0x5d, 0x53, 0x79, 0x77, 0x65, 0x6b, 0x31, 0x3f, 0x2d, 0x23, 0x09, 0x07, 0x15, 0x1b, \
+		       0xa1, 0xaf, 0xbd, 0xb3, 0x99, 0x97, 0x85, 0x8b, 0xd1, 0xdf, 0xcd, 0xc3, 0xe9, 0xe7, 0xf5, 0xfb, \
+		       0x9a, 0x94, 0x86, 0x88, 0xa2, 0xac, 0xbe, 0xb0, 0xea, 0xe4, 0xf6, 0xf8, 0xd2, 0xdc, 0xce, 0xc0, \
+		       0x7a, 0x74, 0x66, 0x68, 0x42, 0x4c, 0x5e, 0x50, 0x0a, 0x04, 0x16, 0x18, 0x32, 0x3c, 0x2e, 0x20, \
+		       0xec, 0xe2, 0xf0, 0xfe, 0xd4, 0xda, 0xc8, 0xc6, 0x9c, 0x92, 0x80, 0x8e, 0xa4, 0xaa, 0xb8, 0xb6, \
+		       0x0c, 0x02, 0x10, 0x1e, 0x34, 0x3a, 0x28, 0x26, 0x7c, 0x72, 0x60, 0x6e, 0x44, 0x4a, 0x58, 0x56, \
+		       0x37, 0x39, 0x2b, 0x25, 0x0f, 0x01, 0x13, 0x1d, 0x47, 0x49, 0x5b, 0x55, 0x7f, 0x71, 0x63, 0x6d, \
+		       0xd7, 0xd9, 0xcb, 0xc5, 0xef, 0xe1, 0xf3, 0xfd, 0xa7, 0xa9, 0xbb, 0xb5, 0x9f, 0x91, 0x83, 0x8d
+
+endp
diff --git a/Src/Payloads/Aes/64/keychain.asm b/Src/Payloads/Aes/64/keychain.asm
index a09b19d..8dbe770 100644
--- a/Src/Payloads/Aes/64/keychain.asm
+++ b/Src/Payloads/Aes/64/keychain.asm
@@ -1,316 +1,298 @@
-;creates the round keys in keychain_ptr
-if defined AES128
-proc createKeyChain keychain_ptr:QWORD, sbox_ptr:QWORD,\
-                    rcon_ptr:QWORD
-
-     mov [keychain_ptr],rcx
-     mov [sbox_ptr],rdx
-     mov [rcon_ptr],r8
-     push r12
-     push r13
-     push rbx
-     sub rsp,8
-
-     mov r12, ROW_SIZE-1 ;rcx
-     mov r13, 1          ;rdx
-
-key_schedule_round:
-     ;-------------------
-     ;get current column, apply key schedule core and
-     ;xor the result with ecx-ROW_SIZE-1
-     fastcall loadColumn, [keychain_ptr], r12
-     ;shift rows
-     rol eax,8
-     ;substitute with sbox
-     fastcall subBytes, rax, [sbox_ptr]
-     ;xor with rcon
-     fastcall xorRcon, rax, [rcon_ptr], r13
-     inc r13
-     ;xor with column at index-ROW_SIZE-1
-     mov rbx,rax
-     push r12 ;TODO: fix stack alignment
-     sub r12,ROW_SIZE-1
-     fastcall loadColumn, [keychain_ptr],r12
-     pop r12
-     xor rax,rbx
-     ;store at index+1
-     inc r12
-     fastcall storeColumn, rax, [keychain_ptr], r12
-     ;-------------------
-
-     ;-------------------
-     ;three times: get current column and
-     ;xor it with ecx-ROW_SIZE-1
-     rept 3{
-          fastcall loadColumn, [keychain_ptr], r12 ;can be removed
-          mov rbx, rax
-          push r12 ;TODO: fix stack alignment
-          sub r12,ROW_SIZE-1
-          fastcall loadColumn, [keychain_ptr],r12
-          pop r12
-          xor rax,rbx
-          inc r12
-          fastcall storeColumn, rax, [keychain_ptr], r12
-     }
-     ;-------------------
-
-     ;check for end of keychain generation
-     cmp r12, EXTENDED_KEY_SIZE/COLUMN_SIZE - 1
-     jne key_schedule_round
-
-     add rsp,8
-     pop rbx
-     pop r13
-     pop r12
-     ret
-endp
-end if
-
-if defined AES192
-proc createKeyChain keychain_ptr:QWORD, sbox_ptr:QWORD,\
-                    rcon_ptr:QWORD
-
-     mov [keychain_ptr],rcx
-     mov [sbox_ptr],rdx
-     mov [rcon_ptr],r8
-     push r12
-     push r13
-     push rbx
-     sub rsp,8
-
-     mov r12, ROW_SIZE-1 ;rcx
-     mov r13, 1          ;rdx
-
-key_schedule_round:
-     ;-------------------
-     ;get current column, apply key schedule core and
-     ;xor the result with r12-ROW_SIZE-1
-     fastcall loadColumn, [keychain_ptr], r12
-     ;shift rows
-     rol eax,8
-     ;substitute with sbox
-     fastcall subBytes, rax, [sbox_ptr]
-     ;xor with rcon
-     fastcall xorRcon, rax, [rcon_ptr], r13
-     inc r13
-     ;xor with column at index-ROW_SIZE-1
-     mov rbx,rax
-     push r12 ;TODO: fix stack alignment
-     sub r12,ROW_SIZE-1
-     fastcall loadColumn, [keychain_ptr],r12
-     pop r12
-     xor rax,rbx
-     ;store at index+1
-     inc r12
-     fastcall storeColumn, rax, [keychain_ptr], r12
-     ;-------------------
-
-     ;-------------------
-     ;three times: get current column and
-     ;xor it with ecx-ROW_SIZE-1
-     rept 3{
-          fastcall loadColumn, [keychain_ptr], r12 ;can be removed
-          mov rbx, rax
-          push r12 ;TODO: fix stack alignment
-          sub r12,ROW_SIZE-1
-          fastcall loadColumn, [keychain_ptr],r12
-          pop r12
-          xor rax,rbx
-          inc r12
-          fastcall storeColumn, rax, [keychain_ptr], r12
-     }
-     ;-------------------
-
-     ;check for end of keychain generation
-     cmp r12, EXTENDED_KEY_SIZE/COLUMN_SIZE - 1
-     je exit_key_schedule_round
-
-     ;-------------------
-     ;two times: get current column and
-     ;xor it with ecx-ROW_SIZE-1
-     rept 2{
-          fastcall loadColumn, [keychain_ptr], r12 ;can be removed
-          mov rbx, rax
-          push r12 ;TODO: fix stack alignment
-          sub r12,ROW_SIZE-1
-          fastcall loadColumn, [keychain_ptr],r12
-          pop r12
-          xor rax,rbx
-          inc r12
-          fastcall storeColumn, rax, [keychain_ptr], r12
-     }
-     ;-------------------
-
-     jmp key_schedule_round
-
-exit_key_schedule_round:
-     add rsp,8
-     pop rbx
-     pop r13
-     pop r12
-     ret
-endp
-end if
-
-if defined AES256
-proc createKeyChain keychain_ptr:QWORD, sbox_ptr:QWORD,\
-                    rcon_ptr:QWORD
-
-     mov [keychain_ptr],rcx
-     mov [sbox_ptr],rdx
-     mov [rcon_ptr],r8
-     push r12
-     push r13
-     push rbx
-     sub rsp,8
-
-     mov r12, ROW_SIZE-1 ;rcx
-     mov r13, 1          ;rdx
-
-key_schedule_round:
-     ;-------------------
-     ;get current column, apply key schedule core and
-     ;xor the result with ecx-ROW_SIZE-1
-     fastcall loadColumn, [keychain_ptr], r12
-     ;shift rows
-     rol eax,8
-     ;substitute with sbox
-     fastcall subBytes, rax, [sbox_ptr]
-     ;xor with rcon
-     fastcall xorRcon, rax, [rcon_ptr], r13
-     inc r13
-     ;xor with column at index-ROW_SIZE-1
-     mov rbx,rax
-     push r12 ;TODO: fix stack alignment
-     sub r12,ROW_SIZE-1
-     fastcall loadColumn, [keychain_ptr],r12
-     pop r12
-     xor rax,rbx
-     ;store at index+1
-     inc r12
-     fastcall storeColumn, rax, [keychain_ptr], r12
-     ;-------------------
-
-     ;-------------------
-     ;three times: get current column and
-     ;xor it with ecx-ROW_SIZE-1
-     rept 3{
-          fastcall loadColumn, [keychain_ptr], r12 ;can be removed
-          mov rbx, rax
-          push r12 ;TODO: fix stack alignment
-          sub r12,ROW_SIZE-1
-          fastcall loadColumn, [keychain_ptr],r12
-          pop r12
-          xor rax,rbx
-          inc r12
-          fastcall storeColumn, rax, [keychain_ptr], r12
-     }
-     ;-------------------
-
-     ;check for end of keychain generation
-     cmp r12, EXTENDED_KEY_SIZE/COLUMN_SIZE - 1
-     je exit_key_schedule_round
-
-     ;-------------------
-     ;one times: get current column, subsitute with
-     ;sbox and xor it with ecx-ROW_SIZE-1
-     ;three times: get current column and
-     ;xor it with ecx-ROW_SIZE-1
-     fastcall loadColumn, [keychain_ptr], r12 ;can be removed
-     fastcall subBytes, rax, [sbox_ptr]
-     mov rbx, rax
-     push r12 ;TODO: fix stack alignment
-     sub r12,ROW_SIZE-1
-     fastcall loadColumn, [keychain_ptr],r12
-     pop r12
-     xor rax,rbx
-     inc r12
-     fastcall storeColumn, rax, [keychain_ptr], r12
-     ;three times
-     rept 3{
-          fastcall loadColumn, [keychain_ptr], r12 ;can be removed
-          mov rbx, rax
-          push r12 ;TODO: fix stack alignment
-          sub r12,ROW_SIZE-1
-          fastcall loadColumn, [keychain_ptr],r12
-          pop r12
-          xor rax,rbx
-          inc r12
-          fastcall storeColumn, rax, [keychain_ptr], r12
-     }
-     ;-------------------
-
-     jmp key_schedule_round
-
-exit_key_schedule_round:
-     add rsp,8
-     pop rbx
-     pop r13
-     pop r12
-     ret
-endp
-end if
-
-;store a column at column_index in keychain
-proc storeColumn column:QWORD, keychain_ptr:QWORD, column_index:QWORD
-     mov [column], rcx
-     mov [keychain_ptr],rdx
-     mov [column_index],r8
-
-     ;create pointer to first byte of the column
-     ;and store column there
-     mov rax, [column_index]
-     mov r9, COLUMN_SIZE
-     mul r9
-     add rax, [keychain_ptr]
-     mov rcx, [column]
-     mov [rax], ecx
-
-     ret
-endp
-
-;xor key dword with (rcon(index) 00 00 00)
-proc xorRcon key:QWORD, rcon_ptr:QWORD, rcon_index:QWORD
-     push rbx ;leaf function
-
-     mov rax,r8 ; [rcon_index]
-     mov rbx,rdx; [rcon_ptr]
-     xlatb
-     shl rax,24
-     xor eax,ecx ;[key]
-
-     pop rbx
-     ret
-endp
-
-;returns in eax the column at column_index in the key chain
-proc loadColumn keychain_ptr:QWORD, column_index:QWORD
-     ;create pointer to first byte of the colum
-     mov rax, rdx ;[column_index]
-     mov r8, COLUMN_SIZE
-     mul r8
-     add rax, rcx ;[keychain_ptr]
-     ;return dword and exit
-     mov eax,[rax]
-
-     ret
-endp
-
-;substitute subkey's bytes with the sbox
-proc subBytes subkey:QWORD, sbox_ptr:QWORD
-     push rbx ;leaf function
-
-     mov rax,rcx ;[subkey]
-     mov rbx,rdx ;[sbox_ptr]
-     xlatb
-     ror eax, 8
-     xlatb
-     ror eax, 8
-     xlatb
-     ror eax, 8
-     xlatb
-     ror eax, 8
-
-     pop rbx
-     ret
-endp
+;creates the round keys in keychain_ptr
+if defined AES128
+proc createKeyChain uses r12 r13 r14 r15 rbx, keychain_ptr:QWORD, sbox_ptr:QWORD,\
+		    rcon_ptr:QWORD
+
+     mov [keychain_ptr],rcx
+     mov [sbox_ptr],rdx
+     mov [rcon_ptr],r8
+
+     mov r12, ROW_SIZE-1 ;rcx
+     mov r13, 1 	 ;rdx
+
+key_schedule_round:
+     ;-------------------
+     ;get current column, apply key schedule core and
+     ;xor the result with ecx-ROW_SIZE-1
+     fastcall loadColumn, [keychain_ptr], r12
+     ;shift rows
+     rol eax,8
+     ;substitute with sbox
+     fastcall subBytes, rax, [sbox_ptr]
+     ;xor with rcon
+     fastcall xorRcon, rax, [rcon_ptr], r13
+     inc r13
+     ;xor with column at index-ROW_SIZE-1
+     mov rbx,rax
+     mov r14,r12
+     sub r14,ROW_SIZE-1
+     fastcall loadColumn, [keychain_ptr],r14
+     xor rax,rbx
+     ;store at index+1
+     inc r12
+     fastcall storeColumn, rax, [keychain_ptr], r12
+     ;-------------------
+
+     ;-------------------
+     ;three times: get current column and
+     ;xor it with ecx-ROW_SIZE-1
+     mov r15,3
+createKeyChain_loop:
+     fastcall loadColumn, [keychain_ptr], r12 ;can be removed
+     mov rbx, rax
+     mov r14,r12
+     sub r14,ROW_SIZE-1
+     fastcall loadColumn, [keychain_ptr], r14
+     xor rax,rbx
+     inc r12
+     fastcall storeColumn, rax, [keychain_ptr], r12
+     dec r15
+     jnz createKeyChain_loop
+     ;-------------------
+
+     ;check for end of keychain generation
+     cmp r12, EXTENDED_KEY_SIZE/COLUMN_SIZE - 1
+     jne key_schedule_round
+
+     ret
+endp
+end if
+
+if defined AES192
+proc createKeyChain uses r12 r13 r14 r15 rbx, keychain_ptr:QWORD, sbox_ptr:QWORD,\
+		    rcon_ptr:QWORD
+
+     mov [keychain_ptr],rcx
+     mov [sbox_ptr],rdx
+     mov [rcon_ptr],r8
+
+     mov r12, ROW_SIZE-1 ;rcx
+     mov r13, 1 	 ;rdx
+
+key_schedule_round:
+     ;-------------------
+     ;get current column, apply key schedule core and
+     ;xor the result with r12-ROW_SIZE-1
+     fastcall loadColumn, [keychain_ptr], r12
+     ;shift rows
+     rol eax,8
+     ;substitute with sbox
+     fastcall subBytes, rax, [sbox_ptr]
+     ;xor with rcon
+     fastcall xorRcon, rax, [rcon_ptr], r13
+     inc r13
+     ;xor with column at index-ROW_SIZE-1
+     mov rbx,rax
+     mov r14,r12
+     sub r14,ROW_SIZE-1
+     fastcall loadColumn, [keychain_ptr], r14
+     xor rax,rbx
+     ;store at index+1
+     inc r12
+     fastcall storeColumn, rax, [keychain_ptr], r12
+     ;-------------------
+
+     ;-------------------
+     ;three times: get current column and
+     ;xor it with ecx-ROW_SIZE-1
+     mov r15,3
+createKeyChain_loop:
+     fastcall loadColumn, [keychain_ptr], r12 ;can be removed
+     mov rbx, rax
+     mov r14,r12
+     sub r14,ROW_SIZE-1
+     fastcall loadColumn, [keychain_ptr], r14
+     xor rax,rbx
+     inc r12
+     fastcall storeColumn, rax, [keychain_ptr], r12
+     dec r15
+     jnz createKeyChain_loop
+     ;-------------------
+
+     ;check for end of keychain generation
+     cmp r12, EXTENDED_KEY_SIZE/COLUMN_SIZE - 1
+     je exit_key_schedule_round
+
+     ;-------------------
+     ;two times: get current column and
+     ;xor it with ecx-ROW_SIZE-1
+     mov r15,2
+createKeyChain_loop2:
+     fastcall loadColumn, [keychain_ptr], r12 ;can be removed
+     mov rbx, rax
+     mov r14,r12
+     sub r14,ROW_SIZE-1
+     fastcall loadColumn, [keychain_ptr], r14
+     xor rax,rbx
+     inc r12
+     fastcall storeColumn, rax, [keychain_ptr], r12
+     dec r15
+     jnz createKeyChain_loop2
+     ;-------------------
+
+     jmp key_schedule_round
+
+exit_key_schedule_round:
+     ret
+endp
+end if
+
+if defined AES256
+proc createKeyChain uses r12 r13 r14 r15 rbx, keychain_ptr:QWORD, sbox_ptr:QWORD,\
+		    rcon_ptr:QWORD
+
+     mov [keychain_ptr],rcx
+     mov [sbox_ptr],rdx
+     mov [rcon_ptr],r8
+
+     mov r12, ROW_SIZE-1 ;rcx
+     mov r13, 1 	 ;rdx
+
+key_schedule_round:
+     ;-------------------
+     ;get current column, apply key schedule core and
+     ;xor the result with ecx-ROW_SIZE-1
+     fastcall loadColumn, [keychain_ptr], r12
+     ;shift rows
+     rol eax,8
+     ;substitute with sbox
+     fastcall subBytes, rax, [sbox_ptr]
+     ;xor with rcon
+     fastcall xorRcon, rax, [rcon_ptr], r13
+     inc r13
+     ;xor with column at index-ROW_SIZE-1
+     mov rbx,rax
+     mov r14,r12
+     sub r14,ROW_SIZE-1
+     fastcall loadColumn, [keychain_ptr], r14
+     xor rax,rbx
+     ;store at index+1
+     inc r12
+     fastcall storeColumn, rax, [keychain_ptr], r12
+     ;-------------------
+
+     ;-------------------
+     ;three times: get current column and
+     ;xor it with ecx-ROW_SIZE-1
+     mov r15,3
+createKeyChain_loop:
+     fastcall loadColumn, [keychain_ptr], r12 ;can be removed
+     mov rbx, rax
+     mov r14,r12
+     sub r14,ROW_SIZE-1
+     fastcall loadColumn, [keychain_ptr], r14
+     xor rax,rbx
+     inc r12
+     fastcall storeColumn, rax, [keychain_ptr], r12
+     dec r15
+     jnz createKeyChain_loop
+     ;-------------------
+
+     ;check for end of keychain generation
+     cmp r12, EXTENDED_KEY_SIZE/COLUMN_SIZE - 1
+     je exit_key_schedule_round
+
+     ;-------------------
+     ;one times: get current column, subsitute with
+     ;sbox and xor it with ecx-ROW_SIZE-1
+     ;three times: get current column and
+     ;xor it with ecx-ROW_SIZE-1
+     fastcall loadColumn, [keychain_ptr], r12 ;can be removed
+     fastcall subBytes, rax, [sbox_ptr]
+     mov rbx, rax
+     mov r14,r12
+     sub r14,ROW_SIZE-1
+     fastcall loadColumn, [keychain_ptr],r14
+     xor rax,rbx
+     inc r12
+     fastcall storeColumn, rax, [keychain_ptr], r12
+
+     ;three times
+     mov r15,3
+createKeyChain_loop2:
+     fastcall loadColumn, [keychain_ptr], r12 ;can be removed
+     mov rbx, rax
+     mov r14,r12
+     sub r14,ROW_SIZE-1
+     fastcall loadColumn, [keychain_ptr],r14
+     xor rax,rbx
+     inc r12
+     fastcall storeColumn, rax, [keychain_ptr], r12
+     dec r15
+     jnz createKeyChain_loop2
+     ;-------------------
+
+     jmp key_schedule_round
+
+exit_key_schedule_round:
+     ret
+endp
+end if
+
+;store a column at column_index in keychain
+proc storeColumn column:QWORD, keychain_ptr:QWORD, column_index:QWORD
+     mov [column], rcx
+     mov [keychain_ptr],rdx
+     mov [column_index],r8
+
+     ;create pointer to first byte of the column
+     ;and store column there
+     mov rax, [column_index]
+     mov r9, COLUMN_SIZE
+     mul r9
+     add rax, [keychain_ptr]
+     mov rcx, [column]
+     bswap ecx
+     mov [rax], ecx
+
+     ret
+endp
+
+;xor key dword with (rcon(index) 00 00 00)
+proc xorRcon uses rbx, key:QWORD, rcon_ptr:QWORD, rcon_index:QWORD
+     mov [key], rcx
+	 mov [rcon_ptr], rdx
+	 mov [rcon_index], r8
+
+     mov rax, [rcon_index]
+     mov rbx, [rcon_ptr]
+     xlatb
+     shl rax, 24
+	 mov rcx, [key]
+     xor eax, ecx
+     ret
+endp
+
+;returns in eax the column at column_index in the key chain
+proc loadColumn keychain_ptr:QWORD, column_index:QWORD
+	 mov [keychain_ptr], rcx
+	 mov [column_index], rdx
+
+     ;create pointer to first byte of the colum
+     mov rax, [column_index]
+     mov r8, COLUMN_SIZE
+     mul r8
+     add rax, [keychain_ptr]
+     ;return dword and exit
+     mov eax,[rax]
+     bswap eax
+     ret
+endp
+
+;substitute subkey's bytes with the sbox
+proc subBytes uses rbx, subkey:QWORD, sbox_ptr:QWORD
+     mov [subkey], rcx
+	 mov [sbox_ptr], rdx
+
+     mov rax, [subkey]
+     mov rbx, [sbox_ptr]
+     xlatb
+     ror eax, 8
+     xlatb
+     ror eax, 8
+     xlatb
+     ror eax, 8
+     xlatb
+     ror eax, 8
+     ret
+endp
diff --git a/Src/Payloads/Aes/64/license.txt b/Src/Payloads/Aes/64/license.txt
new file mode 100644
index 0000000..8025b70
--- /dev/null
+++ b/Src/Payloads/Aes/64/license.txt
@@ -0,0 +1,26 @@
+Copyright (c) 2019, FasmAES by Christian Ammann
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met: 
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer. 
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution. 
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+The views and conclusions contained in the software and documentation are those
+of the authors and should not be interpreted as representing official policies, 
+either expressed or implied, of the Nullsecurity Project.
diff --git a/Src/Payloads/Aes/64/rcon.asm b/Src/Payloads/Aes/64/rcon.asm
index f87bb3a..95fdd1d 100644
--- a/Src/Payloads/Aes/64/rcon.asm
+++ b/Src/Payloads/Aes/64/rcon.asm
@@ -1,27 +1,30 @@
-macro CreateRcon target, [char]
-{
-    mov byte [target], char
-    inc target
-}
-
-;dynamically generate the rcon in memory
-;uses hard coded values, no algorithm
-proc createRcon rcon_ptr:QWORD
-     CreateRcon rcx, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a,\
-                     0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39,\
-                     0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a,\
-                     0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8,\
-                     0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef,\
-                     0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc,\
-                     0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b,\
-                     0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3,\
-                     0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94,\
-                     0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20,\
-                     0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35,\
-                     0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f,\
-                     0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04,\
-                     0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63,\
-                     0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd,\
-                     0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d
-     ret
-endp
+;loads the rcon into memory. idea behind this implementation:
+;add garbage code, split up array into sub-arrays, reverse order, etc.
+;to hide rcon where its neccessary
+proc createRcon uses rsi rdi, rcon_ptr:QWORD
+     mov [rcon_ptr],rcx
+
+     mov rdi,[rcon_ptr]
+     mov rsi,rcon_array
+     mov rcx,RCON_SIZE
+     repz movsb
+     ret
+
+     rcon_array   db 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a,\
+		     0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39,\
+		     0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a,\
+		     0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8,\
+		     0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef,\
+		     0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc,\
+		     0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b,\
+		     0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3,\
+		     0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94,\
+		     0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20,\
+		     0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35,\
+		     0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f,\
+		     0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04,\
+		     0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63,\
+		     0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd,\
+		     0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d
+
+endp
diff --git a/Src/Payloads/Aes/64/sbox.asm b/Src/Payloads/Aes/64/sbox.asm
index 95df4b5..bac37bc 100644
--- a/Src/Payloads/Aes/64/sbox.asm
+++ b/Src/Payloads/Aes/64/sbox.asm
@@ -1,49 +1,58 @@
-macro CreateSBox target, [char]
-{
-    mov byte [target], char
-    inc target
-}
-
-;dynamically generate the sbox in memory
-;uses hard coded values, no algorithm
-proc createSBox sbox_ptr:QWORD
-     CreateSBox rcx, 0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,\
-                     0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,\
-                     0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,\
-                     0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,\
-                     0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,\
-                     0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,\
-                     0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,\
-                     0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,\
-                     0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,\
-                     0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,\
-                     0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,\
-                     0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,\
-                     0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,\
-                     0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,\
-                     0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,\
-                     0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16
-     ret
-endp
-
-;the inverted sbox for decryption
-proc createInvertSBox sbox_ptr:QWORD
-     CreateSBox rcx, 0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb,\
-                     0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb,\
-                     0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e,\
-                     0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25,\
-                     0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92,\
-                     0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84,\
-                     0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06,\
-                     0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b,\
-                     0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73,\
-                     0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e,\
-                     0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b,\
-                     0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4,\
-                     0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f,\
-                     0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef,\
-                     0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61,\
-                     0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d
-     ret
-endp
-
+;loads the sbox into memory. idea behind this implementation:
+;add garbage code, split up array into sub-arrays, reverse order, etc.
+;to hide rcon where its neccessary
+proc createSBox uses rdi rsi, sbox_ptr:QWORD
+     mov [sbox_ptr],rcx
+
+     mov rdi,[sbox_ptr]
+     mov rsi,sbox_array
+     mov rcx,SBOX_SIZE
+     repz movsb
+     ret
+
+     sbox_array   db 0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,\
+		     0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,\
+		     0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,\
+		     0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,\
+		     0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,\
+		     0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,\
+		     0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,\
+		     0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,\
+		     0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,\
+		     0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,\
+		     0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,\
+		     0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,\
+		     0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,\
+		     0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,\
+		     0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,\
+		     0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16
+endp
+
+;the inverted sbox for decryption
+proc createInvertSBox uses rsi rdi, sbox_ptr:QWORD
+     mov [sbox_ptr],rcx
+
+     mov rdi,[sbox_ptr]
+     mov rsi,i_sbox_array
+     mov rcx,SBOX_SIZE
+     repz movsb
+     ret
+
+     i_sbox_array db 0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb,\
+		     0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb,\
+		     0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e,\
+		     0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25,\
+		     0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92,\
+		     0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84,\
+		     0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06,\
+		     0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b,\
+		     0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73,\
+		     0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e,\
+		     0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b,\
+		     0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4,\
+		     0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f,\
+		     0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef,\
+		     0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61,\
+		     0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d
+endp
+
diff --git a/Src/Payloads/Aes/bin/aes10.dll b/Src/Payloads/Aes/bin/aes10.dll
deleted file mode 100755
index 4a17245..0000000
Binary files a/Src/Payloads/Aes/bin/aes10.dll and /dev/null differ
diff --git a/Src/Payloads/Aes/c/aes.c b/Src/Payloads/Aes/c/aes.c
new file mode 100644
index 0000000..313ff71
--- /dev/null
+++ b/Src/Payloads/Aes/c/aes.c
@@ -0,0 +1,572 @@
+/*
+
+This is an implementation of the AES algorithm, specifically ECB, CTR and CBC mode.
+Block size can be chosen in aes.h - available choices are AES128, AES192, AES256.
+
+The implementation is verified against the test vectors in:
+  National Institute of Standards and Technology Special Publication 800-38A 2001 ED
+
+ECB-AES128
+----------
+
+  plain-text:
+    6bc1bee22e409f96e93d7e117393172a
+    ae2d8a571e03ac9c9eb76fac45af8e51
+    30c81c46a35ce411e5fbc1191a0a52ef
+    f69f2445df4f9b17ad2b417be66c3710
+
+  key:
+    2b7e151628aed2a6abf7158809cf4f3c
+
+  resulting cipher
+    3ad77bb40d7a3660a89ecaf32466ef97 
+    f5d3d58503b9699de785895a96fdbaaf 
+    43b1cd7f598ece23881b00e3ed030688 
+    7b0c785e27e8ad3f8223207104725dd4 
+
+
+NOTE:   String length must be evenly divisible by 16byte (str_len % 16 == 0)
+        You should pad the end of the string with zeros if this is not the case.
+        For AES192/256 the key size is proportionally larger.
+
+*/
+
+
+/*****************************************************************************/
+/* Includes:                                                                 */
+/*****************************************************************************/
+#include <stdint.h>
+#include <string.h> // CBC mode, for memset
+#include "aes.h"
+
+/*****************************************************************************/
+/* Defines:                                                                  */
+/*****************************************************************************/
+// The number of columns comprising a state in AES. This is a constant in AES. Value=4
+#define Nb 4
+
+#if defined(AES256) && (AES256 == 1)
+    #define Nk 8
+    #define Nr 14
+#elif defined(AES192) && (AES192 == 1)
+    #define Nk 6
+    #define Nr 12
+#else
+    #define Nk 4        // The number of 32 bit words in a key.
+    #define Nr 10       // The number of rounds in AES Cipher.
+#endif
+
+// jcallan@github points out that declaring Multiply as a function 
+// reduces code size considerably with the Keil ARM compiler.
+// See this link for more information: https://github.com/kokke/tiny-AES-C/pull/3
+#ifndef MULTIPLY_AS_A_FUNCTION
+  #define MULTIPLY_AS_A_FUNCTION 0
+#endif
+
+
+
+
+/*****************************************************************************/
+/* Private variables:                                                        */
+/*****************************************************************************/
+// state - array holding the intermediate results during decryption.
+typedef uint8_t state_t[4][4];
+
+
+
+// The lookup-tables are marked const so they can be placed in read-only storage instead of RAM
+// The numbers below can be computed dynamically trading ROM for RAM - 
+// This can be useful in (embedded) bootloader applications, where ROM is often limited.
+static const uint8_t sbox[256] = {
+  //0     1    2      3     4    5     6     7      8    9     A      B    C     D     E     F
+  0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,
+  0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0,
+  0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
+  0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75,
+  0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84,
+  0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
+  0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8,
+  0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5, 0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2,
+  0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
+  0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb,
+  0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c, 0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79,
+  0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
+  0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a,
+  0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, 0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e,
+  0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
+  0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16 };
+
+static const uint8_t rsbox[256] = {
+  0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb,
+  0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb,
+  0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e,
+  0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25,
+  0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92,
+  0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84,
+  0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06,
+  0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b,
+  0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73,
+  0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e,
+  0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b,
+  0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4,
+  0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f,
+  0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef,
+  0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61,
+  0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d };
+
+// The round constant word array, Rcon[i], contains the values given by 
+// x to the power (i-1) being powers of x (x is denoted as {02}) in the field GF(2^8)
+static const uint8_t Rcon[11] = {
+  0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36 };
+
+/*
+ * Jordan Goulder points out in PR #12 (https://github.com/kokke/tiny-AES-C/pull/12),
+ * that you can remove most of the elements in the Rcon array, because they are unused.
+ *
+ * From Wikipedia's article on the Rijndael key schedule @ https://en.wikipedia.org/wiki/Rijndael_key_schedule#Rcon
+ * 
+ * "Only the first some of these constants are actually used – up to rcon[10] for AES-128 (as 11 round keys are needed), 
+ *  up to rcon[8] for AES-192, up to rcon[7] for AES-256. rcon[0] is not used in AES algorithm."
+ */
+
+
+/*****************************************************************************/
+/* Private functions:                                                        */
+/*****************************************************************************/
+/*
+static uint8_t getSBoxValue(uint8_t num)
+{
+  return sbox[num];
+}
+*/
+#define getSBoxValue(num) (sbox[(num)])
+/*
+static uint8_t getSBoxInvert(uint8_t num)
+{
+  return rsbox[num];
+}
+*/
+#define getSBoxInvert(num) (rsbox[(num)])
+
+// This function produces Nb(Nr+1) round keys. The round keys are used in each round to decrypt the states. 
+static void KeyExpansion(uint8_t* RoundKey, const uint8_t* Key)
+{
+  unsigned i, j, k;
+  uint8_t tempa[4]; // Used for the column/row operations
+  
+  // The first round key is the key itself.
+  for (i = 0; i < Nk; ++i)
+  {
+    RoundKey[(i * 4) + 0] = Key[(i * 4) + 0];
+    RoundKey[(i * 4) + 1] = Key[(i * 4) + 1];
+    RoundKey[(i * 4) + 2] = Key[(i * 4) + 2];
+    RoundKey[(i * 4) + 3] = Key[(i * 4) + 3];
+  }
+
+  // All other round keys are found from the previous round keys.
+  for (i = Nk; i < Nb * (Nr + 1); ++i)
+  {
+    {
+      k = (i - 1) * 4;
+      tempa[0]=RoundKey[k + 0];
+      tempa[1]=RoundKey[k + 1];
+      tempa[2]=RoundKey[k + 2];
+      tempa[3]=RoundKey[k + 3];
+
+    }
+
+    if (i % Nk == 0)
+    {
+      // This function shifts the 4 bytes in a word to the left once.
+      // [a0,a1,a2,a3] becomes [a1,a2,a3,a0]
+
+      // Function RotWord()
+      {
+        const uint8_t u8tmp = tempa[0];
+        tempa[0] = tempa[1];
+        tempa[1] = tempa[2];
+        tempa[2] = tempa[3];
+        tempa[3] = u8tmp;
+      }
+
+      // SubWord() is a function that takes a four-byte input word and 
+      // applies the S-box to each of the four bytes to produce an output word.
+
+      // Function Subword()
+      {
+        tempa[0] = getSBoxValue(tempa[0]);
+        tempa[1] = getSBoxValue(tempa[1]);
+        tempa[2] = getSBoxValue(tempa[2]);
+        tempa[3] = getSBoxValue(tempa[3]);
+      }
+
+      tempa[0] = tempa[0] ^ Rcon[i/Nk];
+    }
+#if defined(AES256) && (AES256 == 1)
+    if (i % Nk == 4)
+    {
+      // Function Subword()
+      {
+        tempa[0] = getSBoxValue(tempa[0]);
+        tempa[1] = getSBoxValue(tempa[1]);
+        tempa[2] = getSBoxValue(tempa[2]);
+        tempa[3] = getSBoxValue(tempa[3]);
+      }
+    }
+#endif
+    j = i * 4; k=(i - Nk) * 4;
+    RoundKey[j + 0] = RoundKey[k + 0] ^ tempa[0];
+    RoundKey[j + 1] = RoundKey[k + 1] ^ tempa[1];
+    RoundKey[j + 2] = RoundKey[k + 2] ^ tempa[2];
+    RoundKey[j + 3] = RoundKey[k + 3] ^ tempa[3];
+  }
+}
+
+void AES_init_ctx(struct AES_ctx* ctx, const uint8_t* key)
+{
+  KeyExpansion(ctx->RoundKey, key);
+}
+#if (defined(CBC) && (CBC == 1)) || (defined(CTR) && (CTR == 1))
+void AES_init_ctx_iv(struct AES_ctx* ctx, const uint8_t* key, const uint8_t* iv)
+{
+  KeyExpansion(ctx->RoundKey, key);
+  memcpy (ctx->Iv, iv, AES_BLOCKLEN);
+}
+void AES_ctx_set_iv(struct AES_ctx* ctx, const uint8_t* iv)
+{
+  memcpy (ctx->Iv, iv, AES_BLOCKLEN);
+}
+#endif
+
+// This function adds the round key to state.
+// The round key is added to the state by an XOR function.
+static void AddRoundKey(uint8_t round, state_t* state, const uint8_t* RoundKey)
+{
+  uint8_t i,j;
+  for (i = 0; i < 4; ++i)
+  {
+    for (j = 0; j < 4; ++j)
+    {
+      (*state)[i][j] ^= RoundKey[(round * Nb * 4) + (i * Nb) + j];
+    }
+  }
+}
+
+// The SubBytes Function Substitutes the values in the
+// state matrix with values in an S-box.
+static void SubBytes(state_t* state)
+{
+  uint8_t i, j;
+  for (i = 0; i < 4; ++i)
+  {
+    for (j = 0; j < 4; ++j)
+    {
+      (*state)[j][i] = getSBoxValue((*state)[j][i]);
+    }
+  }
+}
+
+// The ShiftRows() function shifts the rows in the state to the left.
+// Each row is shifted with different offset.
+// Offset = Row number. So the first row is not shifted.
+static void ShiftRows(state_t* state)
+{
+  uint8_t temp;
+
+  // Rotate first row 1 columns to left  
+  temp           = (*state)[0][1];
+  (*state)[0][1] = (*state)[1][1];
+  (*state)[1][1] = (*state)[2][1];
+  (*state)[2][1] = (*state)[3][1];
+  (*state)[3][1] = temp;
+
+  // Rotate second row 2 columns to left  
+  temp           = (*state)[0][2];
+  (*state)[0][2] = (*state)[2][2];
+  (*state)[2][2] = temp;
+
+  temp           = (*state)[1][2];
+  (*state)[1][2] = (*state)[3][2];
+  (*state)[3][2] = temp;
+
+  // Rotate third row 3 columns to left
+  temp           = (*state)[0][3];
+  (*state)[0][3] = (*state)[3][3];
+  (*state)[3][3] = (*state)[2][3];
+  (*state)[2][3] = (*state)[1][3];
+  (*state)[1][3] = temp;
+}
+
+static uint8_t xtime(uint8_t x)
+{
+  return ((x<<1) ^ (((x>>7) & 1) * 0x1b));
+}
+
+// MixColumns function mixes the columns of the state matrix
+static void MixColumns(state_t* state)
+{
+  uint8_t i;
+  uint8_t Tmp, Tm, t;
+  for (i = 0; i < 4; ++i)
+  {  
+    t   = (*state)[i][0];
+    Tmp = (*state)[i][0] ^ (*state)[i][1] ^ (*state)[i][2] ^ (*state)[i][3] ;
+    Tm  = (*state)[i][0] ^ (*state)[i][1] ; Tm = xtime(Tm);  (*state)[i][0] ^= Tm ^ Tmp ;
+    Tm  = (*state)[i][1] ^ (*state)[i][2] ; Tm = xtime(Tm);  (*state)[i][1] ^= Tm ^ Tmp ;
+    Tm  = (*state)[i][2] ^ (*state)[i][3] ; Tm = xtime(Tm);  (*state)[i][2] ^= Tm ^ Tmp ;
+    Tm  = (*state)[i][3] ^ t ;              Tm = xtime(Tm);  (*state)[i][3] ^= Tm ^ Tmp ;
+  }
+}
+
+// Multiply is used to multiply numbers in the field GF(2^8)
+// Note: The last call to xtime() is unneeded, but often ends up generating a smaller binary
+//       The compiler seems to be able to vectorize the operation better this way.
+//       See https://github.com/kokke/tiny-AES-c/pull/34
+#if MULTIPLY_AS_A_FUNCTION
+static uint8_t Multiply(uint8_t x, uint8_t y)
+{
+  return (((y & 1) * x) ^
+       ((y>>1 & 1) * xtime(x)) ^
+       ((y>>2 & 1) * xtime(xtime(x))) ^
+       ((y>>3 & 1) * xtime(xtime(xtime(x)))) ^
+       ((y>>4 & 1) * xtime(xtime(xtime(xtime(x)))))); /* this last call to xtime() can be omitted */
+  }
+#else
+#define Multiply(x, y)                                \
+      (  ((y & 1) * x) ^                              \
+      ((y>>1 & 1) * xtime(x)) ^                       \
+      ((y>>2 & 1) * xtime(xtime(x))) ^                \
+      ((y>>3 & 1) * xtime(xtime(xtime(x)))) ^         \
+      ((y>>4 & 1) * xtime(xtime(xtime(xtime(x))))))   \
+
+#endif
+
+#if (defined(CBC) && CBC == 1) || (defined(ECB) && ECB == 1)
+// MixColumns function mixes the columns of the state matrix.
+// The method used to multiply may be difficult to understand for the inexperienced.
+// Please use the references to gain more information.
+static void InvMixColumns(state_t* state)
+{
+  int i;
+  uint8_t a, b, c, d;
+  for (i = 0; i < 4; ++i)
+  { 
+    a = (*state)[i][0];
+    b = (*state)[i][1];
+    c = (*state)[i][2];
+    d = (*state)[i][3];
+
+    (*state)[i][0] = Multiply(a, 0x0e) ^ Multiply(b, 0x0b) ^ Multiply(c, 0x0d) ^ Multiply(d, 0x09);
+    (*state)[i][1] = Multiply(a, 0x09) ^ Multiply(b, 0x0e) ^ Multiply(c, 0x0b) ^ Multiply(d, 0x0d);
+    (*state)[i][2] = Multiply(a, 0x0d) ^ Multiply(b, 0x09) ^ Multiply(c, 0x0e) ^ Multiply(d, 0x0b);
+    (*state)[i][3] = Multiply(a, 0x0b) ^ Multiply(b, 0x0d) ^ Multiply(c, 0x09) ^ Multiply(d, 0x0e);
+  }
+}
+
+
+// The SubBytes Function Substitutes the values in the
+// state matrix with values in an S-box.
+static void InvSubBytes(state_t* state)
+{
+  uint8_t i, j;
+  for (i = 0; i < 4; ++i)
+  {
+    for (j = 0; j < 4; ++j)
+    {
+      (*state)[j][i] = getSBoxInvert((*state)[j][i]);
+    }
+  }
+}
+
+static void InvShiftRows(state_t* state)
+{
+  uint8_t temp;
+
+  // Rotate first row 1 columns to right  
+  temp = (*state)[3][1];
+  (*state)[3][1] = (*state)[2][1];
+  (*state)[2][1] = (*state)[1][1];
+  (*state)[1][1] = (*state)[0][1];
+  (*state)[0][1] = temp;
+
+  // Rotate second row 2 columns to right 
+  temp = (*state)[0][2];
+  (*state)[0][2] = (*state)[2][2];
+  (*state)[2][2] = temp;
+
+  temp = (*state)[1][2];
+  (*state)[1][2] = (*state)[3][2];
+  (*state)[3][2] = temp;
+
+  // Rotate third row 3 columns to right
+  temp = (*state)[0][3];
+  (*state)[0][3] = (*state)[1][3];
+  (*state)[1][3] = (*state)[2][3];
+  (*state)[2][3] = (*state)[3][3];
+  (*state)[3][3] = temp;
+}
+#endif // #if (defined(CBC) && CBC == 1) || (defined(ECB) && ECB == 1)
+
+// Cipher is the main function that encrypts the PlainText.
+static void Cipher(state_t* state, const uint8_t* RoundKey)
+{
+  uint8_t round = 0;
+
+  // Add the First round key to the state before starting the rounds.
+  AddRoundKey(0, state, RoundKey); 
+  
+  // There will be Nr rounds.
+  // The first Nr-1 rounds are identical.
+  // These Nr-1 rounds are executed in the loop below.
+  for (round = 1; round < Nr; ++round)
+  {
+    SubBytes(state);
+    ShiftRows(state);
+    MixColumns(state);
+    AddRoundKey(round, state, RoundKey);
+  }
+  
+  // The last round is given below.
+  // The MixColumns function is not here in the last round.
+  SubBytes(state);
+  ShiftRows(state);
+  AddRoundKey(Nr, state, RoundKey);
+}
+
+#if (defined(CBC) && CBC == 1) || (defined(ECB) && ECB == 1)
+static void InvCipher(state_t* state, const uint8_t* RoundKey)
+{
+  uint8_t round = 0;
+
+  // Add the First round key to the state before starting the rounds.
+  AddRoundKey(Nr, state, RoundKey); 
+
+  // There will be Nr rounds.
+  // The first Nr-1 rounds are identical.
+  // These Nr-1 rounds are executed in the loop below.
+  for (round = (Nr - 1); round > 0; --round)
+  {
+    InvShiftRows(state);
+    InvSubBytes(state);
+    AddRoundKey(round, state, RoundKey);
+    InvMixColumns(state);
+  }
+  
+  // The last round is given below.
+  // The MixColumns function is not here in the last round.
+  InvShiftRows(state);
+  InvSubBytes(state);
+  AddRoundKey(0, state, RoundKey);
+}
+#endif // #if (defined(CBC) && CBC == 1) || (defined(ECB) && ECB == 1)
+
+/*****************************************************************************/
+/* Public functions:                                                         */
+/*****************************************************************************/
+#if defined(ECB) && (ECB == 1)
+
+
+void AES_ECB_encrypt(const struct AES_ctx* ctx, uint8_t* buf)
+{
+  // The next function call encrypts the PlainText with the Key using AES algorithm.
+  Cipher((state_t*)buf, ctx->RoundKey);
+}
+
+void AES_ECB_decrypt(const struct AES_ctx* ctx, uint8_t* buf)
+{
+  // The next function call decrypts the PlainText with the Key using AES algorithm.
+  InvCipher((state_t*)buf, ctx->RoundKey);
+}
+
+
+#endif // #if defined(ECB) && (ECB == 1)
+
+
+
+
+
+#if defined(CBC) && (CBC == 1)
+
+
+static void XorWithIv(uint8_t* buf, const uint8_t* Iv)
+{
+  uint8_t i;
+  for (i = 0; i < AES_BLOCKLEN; ++i) // The block in AES is always 128bit no matter the key size
+  {
+    buf[i] ^= Iv[i];
+  }
+}
+
+void AES_CBC_encrypt_buffer(struct AES_ctx *ctx, uint8_t* buf, uint32_t length)
+{
+  uintptr_t i;
+  uint8_t *Iv = ctx->Iv;
+  for (i = 0; i < length; i += AES_BLOCKLEN)
+  {
+    XorWithIv(buf, Iv);
+    Cipher((state_t*)buf, ctx->RoundKey);
+    Iv = buf;
+    buf += AES_BLOCKLEN;
+    //printf("Step %d - %d", i/16, i);
+  }
+  /* store Iv in ctx for next call */
+  memcpy(ctx->Iv, Iv, AES_BLOCKLEN);
+}
+
+void AES_CBC_decrypt_buffer(struct AES_ctx* ctx, uint8_t* buf,  uint32_t length)
+{
+  uintptr_t i;
+  uint8_t storeNextIv[AES_BLOCKLEN];
+  for (i = 0; i < length; i += AES_BLOCKLEN)
+  {
+    memcpy(storeNextIv, buf, AES_BLOCKLEN);
+    InvCipher((state_t*)buf, ctx->RoundKey);
+    XorWithIv(buf, ctx->Iv);
+    memcpy(ctx->Iv, storeNextIv, AES_BLOCKLEN);
+    buf += AES_BLOCKLEN;
+  }
+
+}
+
+#endif // #if defined(CBC) && (CBC == 1)
+
+
+
+#if defined(CTR) && (CTR == 1)
+
+/* Symmetrical operation: same function for encrypting as for decrypting. Note any IV/nonce should never be reused with the same key */
+void AES_CTR_xcrypt_buffer(struct AES_ctx* ctx, uint8_t* buf, uint32_t length)
+{
+  uint8_t buffer[AES_BLOCKLEN];
+  
+  unsigned i;
+  int bi;
+  for (i = 0, bi = AES_BLOCKLEN; i < length; ++i, ++bi)
+  {
+    if (bi == AES_BLOCKLEN) /* we need to regen xor compliment in buffer */
+    {
+      
+      memcpy(buffer, ctx->Iv, AES_BLOCKLEN);
+      Cipher((state_t*)buffer,ctx->RoundKey);
+
+      /* Increment Iv and handle overflow */
+      for (bi = (AES_BLOCKLEN - 1); bi >= 0; --bi)
+      {
+	/* inc will overflow */
+        if (ctx->Iv[bi] == 255)
+	{
+          ctx->Iv[bi] = 0;
+          continue;
+        } 
+        ctx->Iv[bi] += 1;
+        break;   
+      }
+      bi = 0;
+    }
+
+    buf[i] = (buf[i] ^ buffer[bi]);
+  }
+}
+
+#endif // #if defined(CTR) && (CTR == 1)
+
diff --git a/Src/Payloads/Aes/c/aes.h b/Src/Payloads/Aes/c/aes.h
new file mode 100644
index 0000000..87f1471
--- /dev/null
+++ b/Src/Payloads/Aes/c/aes.h
@@ -0,0 +1,90 @@
+#ifndef _AES_H_
+#define _AES_H_
+
+#include <stdint.h>
+
+// #define the macros below to 1/0 to enable/disable the mode of operation.
+//
+// CBC enables AES encryption in CBC-mode of operation.
+// CTR enables encryption in counter-mode.
+// ECB enables the basic ECB 16-byte block algorithm. All can be enabled simultaneously.
+
+// The #ifndef-guard allows it to be configured before #include'ing or at compile time.
+#ifndef CBC
+  #define CBC 1
+#endif
+
+#ifndef ECB
+  #define ECB 1
+#endif
+
+#ifndef CTR
+  #define CTR 1
+#endif
+
+
+#define AES128 1
+//#define AES192 1
+//#define AES256 1
+
+#define AES_BLOCKLEN 16 //Block length in bytes AES is 128b block only
+
+#if defined(AES256) && (AES256 == 1)
+    #define AES_KEYLEN 32
+    #define AES_keyExpSize 240
+#elif defined(AES192) && (AES192 == 1)
+    #define AES_KEYLEN 24
+    #define AES_keyExpSize 208
+#else
+    #define AES_KEYLEN 16   // Key length in bytes
+    #define AES_keyExpSize 176
+#endif
+
+struct AES_ctx
+{
+  uint8_t RoundKey[AES_keyExpSize];
+#if (defined(CBC) && (CBC == 1)) || (defined(CTR) && (CTR == 1))
+  uint8_t Iv[AES_BLOCKLEN];
+#endif
+};
+
+void AES_init_ctx(struct AES_ctx* ctx, const uint8_t* key);
+#if (defined(CBC) && (CBC == 1)) || (defined(CTR) && (CTR == 1))
+void AES_init_ctx_iv(struct AES_ctx* ctx, const uint8_t* key, const uint8_t* iv);
+void AES_ctx_set_iv(struct AES_ctx* ctx, const uint8_t* iv);
+#endif
+
+#if defined(ECB) && (ECB == 1)
+// buffer size is exactly AES_BLOCKLEN bytes; 
+// you need only AES_init_ctx as IV is not used in ECB 
+// NB: ECB is considered insecure for most uses
+void AES_ECB_encrypt(const struct AES_ctx* ctx, uint8_t* buf);
+void AES_ECB_decrypt(const struct AES_ctx* ctx, uint8_t* buf);
+
+#endif // #if defined(ECB) && (ECB == !)
+
+
+#if defined(CBC) && (CBC == 1)
+// buffer size MUST be mutile of AES_BLOCKLEN;
+// Suggest https://en.wikipedia.org/wiki/Padding_(cryptography)#PKCS7 for padding scheme
+// NOTES: you need to set IV in ctx via AES_init_ctx_iv() or AES_ctx_set_iv()
+//        no IV should ever be reused with the same key 
+void AES_CBC_encrypt_buffer(struct AES_ctx* ctx, uint8_t* buf, uint32_t length);
+void AES_CBC_decrypt_buffer(struct AES_ctx* ctx, uint8_t* buf, uint32_t length);
+
+#endif // #if defined(CBC) && (CBC == 1)
+
+
+#if defined(CTR) && (CTR == 1)
+
+// Same function for encrypting as for decrypting. 
+// IV is incremented for every block, and used after encryption as XOR-compliment for output
+// Suggesting https://en.wikipedia.org/wiki/Padding_(cryptography)#PKCS7 for padding scheme
+// NOTES: you need to set IV in ctx with AES_init_ctx_iv() or AES_ctx_set_iv()
+//        no IV should ever be reused with the same key 
+void AES_CTR_xcrypt_buffer(struct AES_ctx* ctx, uint8_t* buf, uint32_t length);
+
+#endif // #if defined(CTR) && (CTR == 1)
+
+
+#endif //_AES_H_
diff --git a/Src/Payloads/Aes/c/unlicense.txt b/Src/Payloads/Aes/c/unlicense.txt
new file mode 100644
index 0000000..68a49da
--- /dev/null
+++ b/Src/Payloads/Aes/c/unlicense.txt
@@ -0,0 +1,24 @@
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <http://unlicense.org/>
diff --git a/license.txt b/license.txt
old mode 100755
new mode 100644
index b9f7049..ab05c93
--- a/license.txt
+++ b/license.txt
@@ -1,4 +1,4 @@
-Copyright (c) 2019, Hyperion Runtime Crypter by Christian Ammann
+Copyright (c) 2020, Hyperion Runtime Crypter by Christian Ammann
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
diff --git a/readme.txt b/readme.txt
old mode 100755
new mode 100644
index a93995f..24ca9c3
--- a/readme.txt
+++ b/readme.txt
@@ -10,10 +10,10 @@
 # Hyperion: A runtime PE-Crypter                                              #
 #                                                                             #
 # VERSION                                                                     #
-# 2.0                                                                         #
+# 2.3.1                                                                       #
 #                                                                             #
 # DATE                                                                        #
-# 08/06/2019                                                                  #
+# 03/23/2020                                                                  #
 #                                                                             #
 # AUTHOR                                                                      #
 # belial - http://www.phobosys.de/hyperion                                    #
@@ -33,17 +33,37 @@
 # may take a few seconds) and generates a log file for debug purpose.         #
 #                                                                             #
 # TODO                                                                        #
+# - AES payload: Maybe use Windows crypto API instead because our fasm aes    #
+#   payload is full of static tables                                          #
+# - Better crypto blob hiding/obfuscation                                     #
+# - Dynamically morph code and add junk code                                  #
 # - Support late Binding of DLLs/APIs                                         #
-# - AV evasion (obfuscate sbox, strings, reduce entropy, etc.)                #
-# - Polymorphic generation of the container                                   #
-# - Add .NET Support                                                          #
-# - Preserve Icon and GUI/Console Flag                                        #
 # - Check for correct DLL Version Numbers before Loading                      #
-# - 64 bit asm code cleanup (container and aes payload)                       #
-# - Remove macros in Asm Code                                                 #
+# - Analysis: What else is missing in PE loader                               #
+# - Provide hyperion as free a web service to hide advanced implementation    #
+#   details                                                                   #
 #                                                                             #
 # CHANGELOG:                                                                  #
 #                                                                             #
+# v2.3.1:                                                                     #
+# - bugfix in .net file detection                                             #
+#                                                                             #
+# v2.3:                                                                       #
+# - log message strings were still in non-log binaries -> removed             #
+# - each function uses shadow registers -> preparation for code morphing      #
+# - basic win32 apis are part of import table and not loaded dynamically      #
+# - output size for non-log binaries reduced by 4kb                           #
+# - 32 bit is now deprecated                                                  #
+# - preserve GUI/Console Flag                                                 #
+# - abort if input is a .NET executable                                       #
+#                                                                             #
+# v2.2:                                                                       #
+# - removed aes.dll blob and use tinyAes c implementation instead             #
+# - aes payload uses new FasmAES 1.3 which has several bugfixes               # 
+#                                                                             #
+# v2.1:                                                                       #
+# - crappy makefile cleanup                                                   #
+#                                                                             #
 # v2.0:                                                                       #
 # - added 64-bit support                                                      #
 # - upgraded fasm.exe to 1.71                                                 #