joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140228a60
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [0x1404c8a60]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x28]
lea r8, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov edx, 1
test eax, eax
je 0x140228abe
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x140228abe
xor edx, edx
nop dword [rax]
mov ecx, eax
and ecx, 1
add edx, ecx
shr rax, 1
jne 0x140228aa8
test edx, edx
mov eax, 1
cmove edx, eax
mov rax, qword [rsp + 0x38]
sub rax, qword [rbx]
jne 0x140228ad0
mov eax, edx
add rsp, 0x40
pop rbx
ret
call fcn.14021b9a0
nop
nop word cs:[rax + rax]
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbp, qword [0x1404c8a60]
mov r12, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rax, qword [rbp]
mov qword [rsp + 0x38], rax
xor eax, eax
mov edi, ecx
test ecx, ecx
mov eax, 1
cmove edi, eax
call r12
lea rdx, [rsp + 0x28]
lea r8, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov ebx, eax
test eax, eax
je 0x140228b6f
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x140228b90
xor ebx, ebx
xor esi, esi
nop dword [rax]
add rsi, rsi
cmp edi, ebx
jle 0x140228b52
test al, 1
je 0x140228b52
or rsi, 1
add ebx, 1
shr rax, 1
jne 0x140228b40
mov qword [rsp + 0x28], 0
call r12
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
mov rax, qword [rsp + 0x38]
sub rax, qword [rbp]
jne 0x140228b96
mov eax, ebx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor esi, esi
xor ebx, ebx
jmp 0x140228b60
call fcn.14021b9a0
nop
nop dword [rax]
Function at 0x140228ae0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [0x1404c8a60]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x28]
lea r8, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov edx, 1
test eax, eax
je 0x140228abe
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x140228abe
xor edx, edx
nop dword [rax]
mov ecx, eax
and ecx, 1
add edx, ecx
shr rax, 1
jne 0x140228aa8
test edx, edx
mov eax, 1
cmove edx, eax
mov rax, qword [rsp + 0x38]
sub rax, qword [rbx]
jne 0x140228ad0
mov eax, edx
add rsp, 0x40
pop rbx
ret
call fcn.14021b9a0
nop
nop word cs:[rax + rax]
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbp, qword [0x1404c8a60]
mov r12, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rax, qword [rbp]
mov qword [rsp + 0x38], rax
xor eax, eax
mov edi, ecx
test ecx, ecx
mov eax, 1
cmove edi, eax
call r12
lea rdx, [rsp + 0x28]
lea r8, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov ebx, eax
test eax, eax
je 0x140228b6f
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x140228b90
xor ebx, ebx
xor esi, esi
nop dword [rax]
add rsi, rsi
cmp edi, ebx
jle 0x140228b52
test al, 1
je 0x140228b52
or rsi, 1
add ebx, 1
shr rax, 1
jne 0x140228b40
mov qword [rsp + 0x28], 0
call r12
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
mov rax, qword [rsp + 0x38]
sub rax, qword [rbp]
jne 0x140228b96
mov eax, ebx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor esi, esi
xor ebx, ebx
jmp 0x140228b60
call fcn.14021b9a0
nop
nop dword [rax]
Function at 0x140228ba0
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r12, qword [0x1404c8a60]
mov rax, qword [r12]
mov qword [rsp + 0x38], rax
mov eax, dword [rcx]
mov rbx, rcx
mov rsi, rdx
test rdx, rdx
je 0x140228d00
cmp eax, 1
je 0x140228c05
call fcn.140227ba0
lea r13, [rax + 8]
mov rdi, rax
mov rcx, r13
call fcn.1402274b0
mov ebp, dword [rbx]
test ebp, ebp
je 0x140228c28
cmp ebp, 1
jne 0x140228cc8
mov rcx, r13
call fcn.140227780
mov rcx, rdi
call fcn.140227e80
xor eax, eax
mov rdx, qword [rsp + 0x38]
sub rdx, qword [r12]
jne 0x140228d4b
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rax, [0x140227f60]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.140228200
mov ecx, dword [0x1403ff578]
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rbp
test rax, rax
je 0x140228d38
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x30], rax
lock or qword [rsp], 0
call fcn.140228200
mov ecx, dword [0x1403ff578]
call rbp
test rax, rax
je 0x140228d20
lea rdx, [rsp + 0x20]
mov qword [rax + 0x18], rdx
lock or qword [rsp], 0
call rsi
call fcn.140228200
mov ecx, dword [0x1403ff578]
call rbp
test rax, rax
je 0x140228d10
mov rdx, qword [rsp + 0x30]
mov rcx, r13
mov qword [rax + 0x18], rdx
mov dword [rbx], 1
call fcn.140227780
mov rcx, rdi
call fcn.140227e80
jmp 0x140228c05
mov ecx, 2
call qword [fcn.140225420]
mov r9d, ebp
mov r8, rbx
lea rdx, str._once__p_is__ld_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
mov rcx, r13
call fcn.140227780
mov rcx, rdi
call fcn.140227e80
jmp 0x140228c05
mov eax, 0x16
jmp 0x140228c07
call fcn.1402282b0
test rax, rax
jne 0x140228c9e
jmp 0x1403f867e
call fcn.1402282b0
test rax, rax
jne 0x140228c7b
jmp 0x1403f866f
call fcn.1402282b0
test rax, rax
jne 0x140228c56
jmp 0x1403f8665
call fcn.14021b9a0
nop
nop word cs:[rax + rax]
nop dword [rax]
mov rax, qword [pe_dos_header]
ud2
lea rax, [rsp + 0x20]
mov qword [0], rax
ud2
mov rax, qword [rsp + 0x30]
mov qword [0], rax
ud2

Function at 0x140228fd0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.140228200
mov ecx, dword [0x1403ff578]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140229048
lea rbp, [rbx + 0x68]
xor r12d, r12d
mov rcx, rbp
call fcn.140227aa0
cmp esi, dword [rbx + 0x48]
jae 0x140229023
mov rax, qword [rbx + 0x58]
cmp byte [rax + rsi], 0
je 0x140229023
mov rax, qword [rbx + 0x50]
mov r12, qword [rax + rsi*8]
mov rcx, rbp
call fcn.140227af0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call fcn.1402282b0
mov rbx, rax
jmp 0x140228ffd
Function at 0x140229060
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov r12, rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call fcn.140228200
mov ecx, dword [0x1403ff578]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140229158
lea r13, [rbx + 0x68]
mov rcx, r13
call fcn.140227aa0
mov rdi, qword [rbx + 0x50]
cmp esi, dword [rbx + 0x48]
jb 0x140229123
lea r15d, [rsi + 1]
mov rcx, rdi
movsxd r14, r15d
lea rdx, [r14*8]
call sub.msvcrt.dll_realloc
mov rdi, rax
test rax, rax
je 0x140229165
mov rcx, qword [rbx + 0x58]
mov rdx, r14
call sub.msvcrt.dll_realloc
mov r14, rax
test rax, rax
je 0x140229165
mov eax, dword [rbx + 0x48]
mov edx, r15d
sub edx, eax
lea rcx, [rdi + rax*8]
lea r8, [rdx*8]
xor edx, edx
call sub.msvcrt.dll_memset
mov ecx, dword [rbx + 0x48]
mov r8d, r15d
xor edx, edx
mov rax, rcx
add rcx, r14
sub r8d, eax
call sub.msvcrt.dll_memset
mov qword [rbx + 0x50], rdi
mov qword [rbx + 0x58], r14
mov dword [rbx + 0x48], r15d
mov qword [rdi + rsi*8], r12
mov rax, qword [rbx + 0x58]
mov rcx, r13
mov byte [rax + rsi], 1
call fcn.140227af0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1402282b0
mov rbx, rax
jmp 0x14022909a
mov rcx, r13
call fcn.140227af0
mov eax, 0xc
jmp 0x140229141

Function at 0x140229200
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.140228200
mov ecx, dword [0x1403ff578]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140229228
mov rax, qword [rax + 0x30]
add rsp, 0x28
ret
call fcn.1402282b0
test rax, rax
jne 0x14022921a
add rsp, 0x28
ret

Function at 0x140229290
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.140228200
mov ecx, dword [0x1403ff578]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1402292b8
add rax, 0x18
add rsp, 0x28
ret
call fcn.1402282b0
test rax, rax
jne 0x1402292aa
jmp 0x1402292ae

Function at 0x1402293d0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140833b88]
test eax, eax
jne 0x1402293e8
xor eax, eax
add rsp, 0x28
ret
call fcn.140228200
mov ecx, dword [0x1403ff578]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140229418
mov edx, dword [rax + 0x20]
test edx, edx
jg 0x1402293de
test byte [rax + 0x40], 3
je 0x1402293de
mov eax, dword [rax + 0x44]
and eax, 1
jmp 0x1402293e0
call fcn.1402282b0
test rax, rax
je 0x1402293de
jmp 0x1402293fe

Function at 0x140229430
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.140228200
mov ecx, dword [0x1403ff578]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140229470
test ebx, ebx
jle 0x140229460
lock add dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
lock sub dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
call fcn.1402282b0
test rax, rax
jne 0x14022944d
add rsp, 0x20
pop rbx
ret
Function at 0x140229560
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.140228200
mov ecx, dword [0x1403ff578]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1402295d8
test byte [rbx + 0x40], 0xc
jne 0x14022958f
mov eax, dword [0x140833b88]
test eax, eax
jne 0x1402295a0
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.1402274b0
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x1402295c3
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x1402295c3
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x1402295ec
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140227780
call fcn.1402282b0
mov rbx, rax
test rax, rax
jne 0x14022957f
add rsp, 0x28
pop rbx
pop rsi
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x14022960a
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.140227780
call fcn.140229480
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x140229688
call fcn.140227170
mov rsi, rax
mov eax, 0xffffffff
cmp rsi, rax
cmovbe rax, rsi
mov rdi, rax
call fcn.140228200
mov ecx, dword [0x1403ff578]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1402296d0
test rsi, rsi
je 0x14022969e
call fcn.140229560
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1402296c0
mov edx, edi
call fcn.140227240
call fcn.140229560
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140228200
mov ecx, dword [0x1403ff578]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1402296e0
call fcn.140229560
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140229560
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140229676
call fcn.1402282b0
mov rbx, rax
jmp 0x14022965c
call fcn.1402282b0
jmp 0x14022969e
Function at 0x140229620
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.140228200
mov ecx, dword [0x1403ff578]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1402295d8
test byte [rbx + 0x40], 0xc
jne 0x14022958f
mov eax, dword [0x140833b88]
test eax, eax
jne 0x1402295a0
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.1402274b0
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x1402295c3
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x1402295c3
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x1402295ec
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140227780
call fcn.1402282b0
mov rbx, rax
test rax, rax
jne 0x14022957f
add rsp, 0x28
pop rbx
pop rsi
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x14022960a
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.140227780
call fcn.140229480
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x140229688
call fcn.140227170
mov rsi, rax
mov eax, 0xffffffff
cmp rsi, rax
cmovbe rax, rsi
mov rdi, rax
call fcn.140228200
mov ecx, dword [0x1403ff578]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1402296d0
test rsi, rsi
je 0x14022969e
call fcn.140229560
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1402296c0
mov edx, edi
call fcn.140227240
call fcn.140229560
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140228200
mov ecx, dword [0x1403ff578]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1402296e0
call fcn.140229560
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140229560
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140229676
call fcn.1402282b0
mov rbx, rax
jmp 0x14022965c
call fcn.1402282b0
jmp 0x14022969e

Function at 0x1402296f0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
call fcn.140228200
mov ecx, dword [0x1403ff578]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140229760
test esi, esi
je 0x140229740
call fcn.140229560
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140229770
mov edx, esi
call fcn.140227240
call fcn.140229560
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140229560
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140229560
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.1402282b0
mov rbx, rax
jmp 0x140229711
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14022972a
Function at 0x14022c3c0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x88
movups xmmword [rsp], xmm6
movups xmmword [rsp + 0x10], xmm7
movups xmmword [rsp + 0x20], xmm8
movups xmmword [rsp + 0x30], xmm9
movups xmmword [rsp + 0x40], xmm10
movups xmmword [rsp + 0x50], xmm11
movups xmmword [rsp + 0x60], xmm12
movups xmmword [rsp + 0x70], xmm13
mov rax, qword [0x1404c7360]
movdqu xmm0, xmmword [rcx]
movdqu xmm4, xmmword [rax + 0xb0]
movdqu xmm8, xmmword [rax + 0xf0]
movdqu xmm12, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
aesdec xmm0, xmm4
movdqu xmm5, xmmword [rax + 0xc0]
aesenc xmm12, xmm4
movdqu xmm9, xmmword [rax + 0x100]
aesdec xmm2, xmm8
aesenc xmm1, xmm8
add rdx, r8
sub r8, 0xffffffffffffff80
movdqu xmm6, xmmword [rax + 0xd0]
aesdec xmm0, xmm5
movdqu xmm10, xmmword [rax + 0x110]
aesenc xmm12, xmm5
movdqu xmm7, xmmword [rax + 0xe0]
aesdec xmm2, xmm9
movdqu xmm11, xmmword [rax + 0x120]
aesenc xmm1, xmm9
aesdec xmm0, xmm6
aesenc xmm12, xmm6
aesdec xmm2, xmm10
aesenc xmm1, xmm10
aesdec xmm0, xmm7
aesenc xmm12, xmm7
aesdec xmm2, xmm11
aesenc xmm1, xmm11
movups xmmword [r8 - 0x80], xmm0
aesdec xmm0, xmm4
movups xmmword [r8 - 0x70], xmm12
aesenc xmm12, xmm4
aesdec xmm0, xmm5
movups xmmword [r8 - 0x60], xmm2
aesdec xmm2, xmm8
aesenc xmm12, xmm5
aesdec xmm0, xmm6
movups xmmword [r8 - 0x50], xmm1
aesenc xmm1, xmm8
aesdec xmm2, xmm9
aesenc xmm12, xmm6
aesenc xmm1, xmm9
aesdec xmm2, xmm10
aesdec xmm0, xmm7
aesenc xmm1, xmm10
aesenc xmm12, xmm7
aesdec xmm2, xmm11
movups xmmword [r8 - 0x40], xmm0
aesenc xmm1, xmm11
movups xmmword [r8 - 0x30], xmm12
movups xmmword [r8 - 0x20], xmm2
movups xmmword [r8 - 0x10], xmm1
cmp r8, rdx
jae 0x14022c5fd
mov rax, 0xffffffffff0707ff
movq xmm3, rax
punpcklqdq xmm3, xmm3
nop dword [rax + rax]
aesdec xmm0, xmm4
aesenc xmm12, xmm4
aesdec xmm2, xmm8
add r8, 0x40
aesdec xmm0, xmm5
aesenc xmm12, xmm5
aesdec xmm2, xmm9
aesdec xmm0, xmm6
aesenc xmm12, xmm6
aesenc xmm1, xmm8
aesdec xmm0, xmm7
aesenc xmm12, xmm7
aesdec xmm2, xmm10
movdqa xmm13, xmm0
aesenc xmm1, xmm9
aesdec xmm2, xmm11
pand xmm13, xmm3
aesenc xmm1, xmm10
movups xmmword [r8 - 0x40], xmm13
movdqa xmm13, xmm12
aesenc xmm1, xmm11
pand xmm13, xmm3
movups xmmword [r8 - 0x30], xmm13
movdqa xmm13, xmm2
pand xmm13, xmm3
movups xmmword [r8 - 0x20], xmm13
movdqa xmm13, xmm1
pand xmm13, xmm3
movups xmmword [r8 - 0x10], xmm13
cmp r8, rdx
jb 0x14022c558
movups xmm6, xmmword [rsp]
movups xmm7, xmmword [rsp + 0x10]
movups xmm8, xmmword [rsp + 0x20]
movups xmm9, xmmword [rsp + 0x30]
movups xmm10, xmmword [rsp + 0x40]
movups xmm11, xmmword [rsp + 0x50]
movups xmm12, xmmword [rsp + 0x60]
movups xmm13, xmmword [rsp + 0x70]
add rsp, 0x88
ret
mov rax, rcx
mov rcx, rdx
mov rdx, qword [0x1404c7360]
lea r8, [rax + 0x40]
mov edx, dword [rdx + 0x20]
lea edx, [rdx*8 + 0x80]
jmp 0x14022c3c0
Function at 0x14022e890
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm0, xmmword [str._f__nc]
movdqu xmm1, xmmword [0x140460c90]
movdqu xmm2, xmmword [0x140460ca0]
movdqu xmm3, xmmword [0x140460cb0]
add rdx, rcx
cmp rcx, rdx
jae 0x14022e8e0
nop dword [rax + rax]
aesenc xmm3, xmmword [rcx]
aesdec xmm2, xmmword [rcx + 0x10]
aesenc xmm1, xmmword [rcx + 0x20]
add rcx, 0x40
aesdec xmm0, xmmword [rcx - 0x10]
cmp rcx, rdx
jb 0x14022e8c0
movdqu xmm4, xmmword [0x140460d00]
aesenc xmm3, xmm4
aesdec xmm2, xmm4
aesenc xmm1, xmm4
aesdec xmm0, xmm4
movdqu xmm4, xmmword [0x140460d10]
aesenc xmm3, xmm4
aesdec xmm2, xmm4
aesenc xmm1, xmm4
aesdec xmm0, xmm4
movups xmmword [r8], xmm3
movups xmmword [r8 + 0x10], xmm2
movups xmmword [r8 + 0x20], xmm1
movups xmmword [r8 + 0x30], xmm0
ret
Function at 0x14022f650
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x60
movups xmmword [rsp], xmm6
movups xmmword [rsp + 0x10], xmm7
movups xmmword [rsp + 0x20], xmm8
movups xmmword [rsp + 0x30], xmm9
movups xmmword [rsp + 0x40], xmm10
movups xmmword [rsp + 0x50], xmm11
movdqu xmm5, xmmword [0x140460c90]
movdqu xmm6, xmmword [0x140460ca0]
movdqu xmm7, xmmword [0x140460cb0]
movdqu xmm4, xmmword [str._f__nc]
movdqu xmm3, xmmword [r9]
movdqu xmm2, xmmword [r9 + 0x10]
movdqu xmm1, xmmword [r9 + 0x20]
movdqu xmm0, xmmword [r9 + 0x30]
movdqu xmm11, xmmword [0x140460cc0]
movdqu xmm10, xmmword [0x140460cd0]
movdqu xmm9, xmmword [0x140460ce0]
movdqu xmm8, xmmword [0x140460cf0]
mov rax, rdx
mov r11, rcx
lea rdx, [rcx + 0x1c00]
lea rcx, [rcx + rax - 0x1c00]
mov r10, r11
lea rbx, [rcx + 0x3800]
mov rax, r10
cmp r10, rcx
jae 0x14022f7ad
nop dword [rax]
aesdec xmm3, xmm11
aesenc xmm2, xmm10
aesenc xmm7, xmmword [rax]
sub rax, 0xffffffffffffff80
aesdec xmm1, xmm9
aesenc xmm0, xmm8
movups xmmword [rax - 0x80], xmm3
aesdec xmm6, xmmword [rax - 0x70]
aesenc xmm5, xmmword [rax - 0x60]
aesdec xmm4, xmmword [rax - 0x50]
movups xmmword [rax - 0x70], xmm2
prefetcht0 byte [rdx]
movups xmmword [rax - 0x60], xmm1
aesdec xmm3, xmm11
prefetcht0 byte [rdx + 0x40]
aesenc xmm2, xmm10
movups xmmword [rax - 0x50], xmm0
aesdec xmm1, xmm9
sub rdx, 0xffffffffffffff80
aesenc xmm0, xmm8
aesenc xmm7, xmmword [rax - 0x40]
aesdec xmm6, xmmword [rax - 0x30]
aesenc xmm5, xmmword [rax - 0x20]
movups xmmword [rax - 0x40], xmm3
aesdec xmm4, xmmword [rax - 0x10]
movups xmmword [rax - 0x30], xmm2
movups xmmword [rax - 0x20], xmm1
movups xmmword [rax - 0x10], xmm0
cmp rax, rcx
jb 0x14022f700
mov rax, rcx
sub rax, r10
sub rax, 1
and rax, 0xffffffffffffff80
lea r10, [r10 + rax + 0x80]
add rcx, 0x1c00
cmp rcx, rbx
je 0x14022f7c8
mov rdx, r11
jmp 0x14022f6f0
movups xmmword [r9], xmm3
movups xmm8, xmmword [rsp + 0x20]
movups xmm9, xmmword [rsp + 0x30]
movups xmmword [r9 + 0x30], xmm0
movdqu xmm0, xmmword [0x140460d00]
movups xmm10, xmmword [rsp + 0x40]
movups xmmword [r9 + 0x10], xmm2
movups xmm11, xmmword [rsp + 0x50]
aesenc xmm7, xmm0
aesdec xmm6, xmm0
aesenc xmm5, xmm0
movups xmmword [r9 + 0x20], xmm1
aesdec xmm4, xmm0
movdqu xmm0, xmmword [0x140460d10]
aesenc xmm7, xmm0
aesdec xmm6, xmm0
aesenc xmm5, xmm0
movups xmmword [r8], xmm7
movups xmm7, xmmword [rsp + 0x10]
aesdec xmm4, xmm0
movups xmmword [r8 + 0x10], xmm6
movups xmm6, xmmword [rsp]
movups xmmword [r8 + 0x20], xmm5
movups xmmword [r8 + 0x30], xmm4
add rsp, 0x60
pop rbx
ret
Function at 0x1402fa8a0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x88
movups xmmword [rsp], xmm6
movups xmmword [rsp + 0x10], xmm7
movups xmmword [rsp + 0x20], xmm8
movups xmmword [rsp + 0x30], xmm9
movups xmmword [rsp + 0x40], xmm10
movups xmmword [rsp + 0x50], xmm11
movups xmmword [rsp + 0x60], xmm12
movups xmmword [rsp + 0x70], xmm13
mov rax, qword [0x1404c7360]
movdqu xmm0, xmmword [rcx]
movdqu xmm4, xmmword [rax + 0xb0]
movdqu xmm8, xmmword [rax + 0xf0]
movdqu xmm12, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
aesdec xmm0, xmm4
movdqu xmm5, xmmword [rax + 0xc0]
aesenc xmm12, xmm4
movdqu xmm9, xmmword [rax + 0x100]
aesdec xmm2, xmm8
aesenc xmm1, xmm8
add rdx, r8
sub r8, 0xffffffffffffff80
movdqu xmm6, xmmword [rax + 0xd0]
aesdec xmm0, xmm5
movdqu xmm10, xmmword [rax + 0x110]
aesenc xmm12, xmm5
movdqu xmm7, xmmword [rax + 0xe0]
aesdec xmm2, xmm9
movdqu xmm11, xmmword [rax + 0x120]
aesenc xmm1, xmm9
aesdec xmm0, xmm6
aesenc xmm12, xmm6
aesdec xmm2, xmm10
aesenc xmm1, xmm10
aesdec xmm0, xmm7
aesenc xmm12, xmm7
aesdec xmm2, xmm11
aesenc xmm1, xmm11
movups xmmword [r8 - 0x80], xmm0
aesdec xmm0, xmm4
movups xmmword [r8 - 0x70], xmm12
aesenc xmm12, xmm4
aesdec xmm0, xmm5
movups xmmword [r8 - 0x60], xmm2
aesdec xmm2, xmm8
aesenc xmm12, xmm5
aesdec xmm0, xmm6
movups xmmword [r8 - 0x50], xmm1
aesenc xmm1, xmm8
aesdec xmm2, xmm9
aesenc xmm12, xmm6
aesenc xmm1, xmm9
aesdec xmm2, xmm10
aesdec xmm0, xmm7
aesenc xmm1, xmm10
aesenc xmm12, xmm7
aesdec xmm2, xmm11
movups xmmword [r8 - 0x40], xmm0
aesenc xmm1, xmm11
movups xmmword [r8 - 0x30], xmm12
movups xmmword [r8 - 0x20], xmm2
movups xmmword [r8 - 0x10], xmm1
cmp r8, rdx
jae 0x14022c5fd
mov rax, 0xffffffffff0707ff
movq xmm3, rax
punpcklqdq xmm3, xmm3
nop dword [rax + rax]
aesdec xmm0, xmm4
aesenc xmm12, xmm4
aesdec xmm2, xmm8
add r8, 0x40
aesdec xmm0, xmm5
aesenc xmm12, xmm5
aesdec xmm2, xmm9
aesdec xmm0, xmm6
aesenc xmm12, xmm6
aesenc xmm1, xmm8
aesdec xmm0, xmm7
aesenc xmm12, xmm7
aesdec xmm2, xmm10
movdqa xmm13, xmm0
aesenc xmm1, xmm9
aesdec xmm2, xmm11
pand xmm13, xmm3
aesenc xmm1, xmm10
movups xmmword [r8 - 0x40], xmm13
movdqa xmm13, xmm12
aesenc xmm1, xmm11
pand xmm13, xmm3
movups xmmword [r8 - 0x30], xmm13
movdqa xmm13, xmm2
pand xmm13, xmm3
movups xmmword [r8 - 0x20], xmm13
movdqa xmm13, xmm1
pand xmm13, xmm3
movups xmmword [r8 - 0x10], xmm13
cmp r8, rdx
jb 0x14022c558
movups xmm6, xmmword [rsp]
movups xmm7, xmmword [rsp + 0x10]
movups xmm8, xmmword [rsp + 0x20]
movups xmm9, xmmword [rsp + 0x30]
movups xmm10, xmmword [rsp + 0x40]
movups xmm11, xmmword [rsp + 0x50]
movups xmm12, xmmword [rsp + 0x60]
movups xmm13, xmmword [rsp + 0x70]
add rsp, 0x88
ret
mov rax, rcx
mov rcx, rdx
mov rdx, qword [0x1404c7360]
lea r8, [rax + 0x40]
mov edx, dword [rdx + 0x20]
lea edx, [rdx*8 + 0x80]
jmp 0x14022c3c0