Function at 0x1400101ee
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2b8
movaps xmmword [rsp + 0x2a0], xmm15
movaps xmmword [rsp + 0x290], xmm14
movaps xmmword [rsp + 0x280], xmm13
movaps xmmword [rsp + 0x270], xmm12
movaps xmmword [rsp + 0x260], xmm11
movaps xmmword [rsp + 0x250], xmm10
movaps xmmword [rsp + 0x240], xmm9
movaps xmmword [rsp + 0x230], xmm8
movaps xmmword [rsp + 0x220], xmm7
movaps xmmword [rsp + 0x210], xmm6
mov rsi, qword [rdx]
mov rax, qword [rdx + 8]
mov qword [rsp + 0x38], rax
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x30], rax
mov rax, qword [rdx + 0x18]
mov rdi, rax
shr rdi, 3
mov rdx, rax
mov qword [rsp + 0x28], rax
and rax, 0xfffffffffffffff8
mov qword [rsp + 0xc8], rax
movdqa xmm0, xmmword [rcx + 0x150]
movdqa xmmword [rsp + 0x150], xmm0
movdqa xmm7, xmmword [rcx + 0x140]
movdqa xmm8, xmmword [rcx + 0x130]
movdqa xmm9, xmmword [rcx + 0x120]
movdqa xmm10, xmmword [rcx + 0x110]
movdqa xmm11, xmmword [rcx + 0x100]
movdqa xmm12, xmmword [rcx + 0xf0]
movdqa xmm13, xmmword [rcx + 0xb0]
movdqa xmm14, xmmword [rcx + 0xc0]
movdqa xmm15, xmmword [rcx + 0xd0]
movdqa xmm6, xmmword [rcx + 0xe0]
xor ebx, ebx
lea r14, [rsp + 0x190]
lea r15, [rsp + 0xd0]
lea r12, [rsp + 0x40]
cmp rdi, rbx
je 0x14001069f
mov r13, rbx
shl r13, 7
mov rax, qword [rsp + 0x38]
lea rbp, [rax + r13]
mov rcx, r14
mov rdx, rbp
call fcn.140009e9f
mov rcx, r15
mov rdx, rbp
call fcn.140009e9f
movaps xmm0, xmmword [rsp + 0xd0]
movaps xmm1, xmmword [rsp + 0x150]
xorps xmm0, xmm1
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [rsp + 0xe0]
xorps xmm0, xmm1
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [rsp + 0xf0]
xorps xmm0, xmm1
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [rsp + 0x100]
xorps xmm0, xmm1
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [rsp + 0x110]
xorps xmm0, xmm1
movaps xmmword [rsp + 0x80], xmm0
movaps xmm0, xmmword [rsp + 0x120]
xorps xmm0, xmm1
movaps xmmword [rsp + 0x90], xmm0
movaps xmm0, xmmword [rsp + 0x130]
xorps xmm0, xmm1
movaps xmmword [rsp + 0xa0], xmm0
movaps xmm0, xmmword [rsp + 0x140]
xorps xmm0, xmm1
movaps xmmword [rsp + 0xb0], xmm0
xor eax, eax
cmp rax, 0x80
je 0x1400103f1
movdqa xmm0, xmmword [rsp + rax + 0x40]
aesdec xmm0, xmm7
movdqa xmmword [rsp + rax + 0x40], xmm0
add rax, 0x10
jmp 0x1400103d2
xor eax, eax
cmp rax, 0x80
je 0x140010413
movdqa xmm0, xmmword [rsp + rax + 0x40]
aesdec xmm0, xmm8
movdqa xmmword [rsp + rax + 0x40], xmm0
add rax, 0x10
jmp 0x1400103f3
xor eax, eax
cmp rax, 0x80
je 0x140010435
movdqa xmm0, xmmword [rsp + rax + 0x40]
aesdec xmm0, xmm9
movdqa xmmword [rsp + rax + 0x40], xmm0
add rax, 0x10
jmp 0x140010415
xor eax, eax
cmp rax, 0x80
je 0x140010457
movdqa xmm0, xmmword [rsp + rax + 0x40]
aesdec xmm0, xmm10
movdqa xmmword [rsp + rax + 0x40], xmm0
add rax, 0x10
jmp 0x140010437
xor eax, eax
cmp rax, 0x80
je 0x140010479
movdqa xmm0, xmmword [rsp + rax + 0x40]
aesdec xmm0, xmm11
movdqa xmmword [rsp + rax + 0x40], xmm0
add rax, 0x10
jmp 0x140010459
xor eax, eax
cmp rax, 0x80
je 0x14001049b
movdqa xmm0, xmmword [rsp + rax + 0x40]
aesdec xmm0, xmm12
movdqa xmmword [rsp + rax + 0x40], xmm0
add rax, 0x10
jmp 0x14001047b
xor eax, eax
cmp rax, 0x80
je 0x1400104bc
movdqa xmm0, xmmword [rsp + rax + 0x40]
aesdec xmm0, xmm6
movdqa xmmword [rsp + rax + 0x40], xmm0
add rax, 0x10
jmp 0x14001049d
xor eax, eax
cmp rax, 0x80
je 0x1400104de
movdqa xmm0, xmmword [rsp + rax + 0x40]
aesdec xmm0, xmm15
movdqa xmmword [rsp + rax + 0x40], xmm0
add rax, 0x10
jmp 0x1400104be
xor eax, eax
cmp rax, 0x80
je 0x140010500
movdqa xmm0, xmmword [rsp + rax + 0x40]
aesdec xmm0, xmm14
movdqa xmmword [rsp + rax + 0x40], xmm0
add rax, 0x10
jmp 0x1400104e0
xor eax, eax
cmp rax, 0x80
je 0x140010522
movdqa xmm0, xmmword [rsp + rax + 0x40]
aesdeclast xmm0, xmm13
movdqa xmmword [rsp + rax + 0x40], xmm0
add rax, 0x10
jmp 0x140010502
movaps xmm0, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0x170], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movaps xmm2, xmmword [rsp + 0x60]
movaps xmm3, xmmword [rsp + 0x70]
movaps xmm4, xmmword [rsp + 0x80]
movaps xmm5, xmmword [rsp + 0x90]
movaps xmm0, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0x180], xmm0
movaps xmm0, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0x160], xmm0
movaps xmm0, xmmword [rsp + 0x170]
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xe0], xmm1
movaps xmmword [rsp + 0xf0], xmm2
movaps xmmword [rsp + 0x100], xmm3
movaps xmmword [rsp + 0x110], xmm4
movaps xmmword [rsp + 0x120], xmm5
movaps xmm0, xmmword [rsp + 0x180]
movaps xmmword [rsp + 0x130], xmm0
movdqa xmm0, xmmword [rsp + 0x160]
movdqa xmmword [rsp + 0x140], xmm0
mov rcx, r12
mov rdx, r15
lea r8, [rsp + 0xe0]
mov r9, rsi
call fcn.14000e1ee
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
cmp r8, rdx
jae 0x140010604
mov r9b, byte [rcx + r8]
xor byte [rax + r8], r9b
inc r8
jmp 0x1400105f2
mov ebp, 1
cmp rbp, 8
je 0x140010667
mov rax, rbp
shl rax, 4
lea rdx, [rsp + rax]
add rdx, 0xd0
lea r9, [rax + r14]
add r9, 0xfffffffffffffff0
lea r8, [rsp + rax]
add r8, 0xe0
mov rcx, r12
call fcn.14000e1ee
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
cmp r8, rdx
jae 0x140010662
mov r9b, byte [rcx + r8]
xor byte [rax + r8], r9b
inc r8
jmp 0x140010650
inc rbp
jmp 0x140010609
add r13, qword [rsp + 0x30]
inc rbx
mov r8d, pe_nt_image_headers64
mov rcx, r13
mov rdx, r15
call sub.msvcrt.dll_memmove
mov rcx, r12
lea rdx, [rsp + 0x200]
call fcn.1400aa88f
movdqu xmm0, xmmword [rsp + 0x40]
movdqu xmmword [rsi], xmm0
jmp 0x14001030d
mov rcx, qword [rsp + 0xc8]
shl rcx, 4
add qword [rsp + 0x38], rcx
mov rax, qword [rsp + 0x28]
and eax, 7
mov qword [rsp + 0x28], rax
add qword [rsp + 0x30], rcx
lea rdi, [rsp + 0xe0]
xor r13d, r13d
lea rbx, [rsp + 0x190]
lea r14, [rsp + 0xd0]
lea r15, [rsp + 0x40]
cmp qword [rsp + 0x28], r13
je 0x1400107c5
mov rbp, r13
shl rbp, 4
mov rax, qword [rsp + 0x38]
lea r12, [rax + rbp]
mov rcx, rbx
mov rdx, r12
call fcn.1400aa88f
mov rcx, r14
mov rdx, r12
call fcn.1400aa88f
movdqa xmm0, xmmword [rsp + 0xd0]
pxor xmm0, xmmword [rsp + 0x150]
aesdec xmm0, xmm7
aesdec xmm0, xmm8
aesdec xmm0, xmm9
aesdec xmm0, xmm10
aesdec xmm0, xmm11
aesdec xmm0, xmm12
aesdec xmm0, xmm6
aesdec xmm0, xmm15
aesdec xmm0, xmm14
aesdeclast xmm0, xmm13
movdqa xmmword [rsp + 0xd0], xmm0
mov rcx, r15
mov rdx, r14
mov r8, rdi
mov r9, rsi
call fcn.14000e1ee
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
cmp r8, rdx
jae 0x14001079f
mov r9b, byte [rcx + r8]
xor byte [rax + r8], r9b
inc r8
jmp 0x14001078d
inc r13
movaps xmm0, xmmword [rsp + 0xd0]
mov rax, qword [rsp + 0x30]
movups xmmword [rax + rbp], xmm0
movdqu xmm0, xmmword [rsp + 0x190]
movdqu xmmword [rsi], xmm0
jmp 0x1400106e2
movaps xmm6, xmmword [rsp + 0x210]
movaps xmm7, xmmword [rsp + 0x220]
movaps xmm8, xmmword [rsp + 0x230]
movaps xmm9, xmmword [rsp + 0x240]
movaps xmm10, xmmword [rsp + 0x250]
movaps xmm11, xmmword [rsp + 0x260]
movaps xmm12, xmmword [rsp + 0x270]
movaps xmm13, xmmword [rsp + 0x280]
movaps xmm14, xmmword [rsp + 0x290]
movaps xmm15, xmmword [rsp + 0x2a0]
add rsp, 0x2b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret