joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401e0460
Capabilities:
Enumerate pe sections

Disassembly:
mov rax, rdx
mov rdx, qword [rcx + 0x70]
test rax, rax
je 0x1401e05bb
movzx ecx, byte [rax + 1]
movzx r9d, byte [rax + 2]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rax]
or ecx, r9d
movzx r9d, byte [rax + 3]
shl r9d, 0x18
or ecx, r9d
mov dword [rdx], ecx
movzx ecx, byte [rax + 5]
movzx r9d, byte [rax + 6]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rax + 4]
or ecx, r9d
movzx r9d, byte [rax + 7]
shl r9d, 0x18
or ecx, r9d
mov dword [rdx + 4], ecx
movzx ecx, byte [rax + 9]
movzx r9d, byte [rax + 0xa]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rax + 8]
or ecx, r9d
movzx r9d, byte [rax + 0xb]
shl r9d, 0x18
or ecx, r9d
mov dword [rdx + 8], ecx
movzx ecx, byte [rax + 0xd]
movzx r9d, byte [rax + 0xe]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rax + 0xc]
or ecx, r9d
movzx r9d, byte [rax + 0xf]
shl r9d, 0x18
or ecx, r9d
mov dword [rdx + 0xc], ecx
movzx ecx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x12]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rax + 0x10]
or ecx, r9d
movzx r9d, byte [rax + 0x13]
shl r9d, 0x18
or ecx, r9d
mov dword [rdx + 0x10], ecx
movzx ecx, byte [rax + 0x15]
movzx r9d, byte [rax + 0x16]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rax + 0x14]
or ecx, r9d
movzx r9d, byte [rax + 0x17]
shl r9d, 0x18
or ecx, r9d
mov dword [rdx + 0x14], ecx
movzx ecx, byte [rax + 0x19]
movzx r9d, byte [rax + 0x1a]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rax + 0x18]
or ecx, r9d
movzx r9d, byte [rax + 0x1b]
shl r9d, 0x18
or ecx, r9d
mov dword [rdx + 0x18], ecx
movzx ecx, byte [rax + 0x1d]
movzx r9d, byte [rax + 0x1e]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rax + 0x1c]
movzx eax, byte [rax + 0x1f]
or ecx, r9d
shl eax, 0x18
or eax, ecx
mov dword [rdx + 0x1c], eax
test r8, r8
je 0x1401e065b
movzx eax, byte [r8 + 2]
movzx ecx, byte [r8 + 1]
shl eax, 0x10
shl ecx, 8
or eax, ecx
movzx ecx, byte [r8]
or eax, ecx
movzx ecx, byte [r8 + 3]
shl ecx, 0x18
or eax, ecx
mov dword [rdx + 0x20], eax
movzx eax, byte [r8 + 6]
movzx ecx, byte [r8 + 5]
shl eax, 0x10
shl ecx, 8
or eax, ecx
movzx ecx, byte [r8 + 4]
or eax, ecx
movzx ecx, byte [r8 + 7]
shl ecx, 0x18
or eax, ecx
mov dword [rdx + 0x24], eax
movzx eax, byte [r8 + 0xa]
movzx ecx, byte [r8 + 9]
shl eax, 0x10
shl ecx, 8
or eax, ecx
movzx ecx, byte [r8 + 8]
or eax, ecx
movzx ecx, byte [r8 + 0xb]
shl ecx, 0x18
or eax, ecx
mov dword [rdx + 0x28], eax
movzx eax, byte [r8 + 0xd]
movzx ecx, byte [r8 + 0xe]
shl eax, 8
shl ecx, 0x10
or eax, ecx
movzx ecx, byte [r8 + 0xc]
or eax, ecx
movzx ecx, byte [r8 + 0xf]
shl ecx, 0x18
or eax, ecx
mov dword [rdx + 0x2c], eax
mov eax, 1
mov dword [rdx + 0x70], 0
ret
Function at 0x1401f48e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, rcx
test rcx, rcx
je 0x1401f4958
movsx ecx, byte [rcx]
xor eax, eax
test cl, cl
je 0x1401f4949
mov ebp, 0x100
xor ebx, ebx
mov esi, 0x20
nop dword [rax]
call fcn.1401aece0
mov r8d, ebx
add rdi, 1
or eax, ebp
add ebp, 0x100
mov edx, eax
shr edx, 2
xor edx, eax
imul eax, eax
and edx, 0xf
mov ecx, edx
shl r8d, cl
mov ecx, esi
sub ecx, edx
shr rbx, cl
movsx ecx, byte [rdi]
or r8d, ebx
xor eax, r8d
mov ebx, eax
test cl, cl
jne 0x1401f4908
shr eax, 0x10
xor eax, ebx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x1401f5a80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x1401f5ba0
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x1401f5ae0
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x1401f5ae0
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x1401f5ae0
Function at 0x1401f9670
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xc8]
mov rbx, rcx
mov rdi, rdx
mov r12, r9
test r8, r8
je 0x1401f96f3
lea r13, [rcx + r8]
mov ecx, dword [rsp + 0xc0]
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
test ecx, ecx
jne 0x1401f9700
mov qword [rsp + 0x20], rax
mov r8, r12
mov rcx, rsi
add rbx, 1
mov qword [rsp + 0x28], rdx
mov rdx, rsi
add rdi, 1
call rbp
movzx eax, byte [rbx - 1]
movzx edx, byte [rsi]
xor edx, eax
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x21]
mov byte [rdi - 1], dl
mov rdx, qword [rsp + 0x29]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
cmp r13, rbx
jne 0x1401f96b0
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov qword [rsp + 0x20], rax
mov r8, r12
mov rcx, rsi
add rbx, 1
mov qword [rsp + 0x28], rdx
mov rdx, rsi
add rdi, 1
call rbp
movzx eax, byte [rbx - 1]
xor al, byte [rsi]
mov byte [rdi - 1], al
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x21]
mov rdx, qword [rsp + 0x29]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
cmp rbx, r13
jne 0x1401f9700
jmp 0x1401f96f3
Function at 0x1401fe7c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, qword [rcx + 0x28]
mov rax, qword [rcx + 0x58]
mov rbx, rcx
mov rsi, rdx
cmp rdi, rdx
jae 0x1401fe9ac
mov rcx, qword [rcx + 0x30]
cmp rcx, rdx
jbe 0x1401fe973
lea r11, [rdi + 1]
mov r10, r11
shl r10, 4
jmp 0x1401fe808
mov rax, qword [rbx + 0x58]
add r11, 1
lea rdx, [rax + r10]
lea rax, [rax + r10 - 0x10]
movzx r9d, byte [rax + 0xf]
movzx r8d, byte [rax + 0xe]
movzx ecx, byte [rax]
lea ebp, [r8 + r8]
lea edi, [r9 + r9]
sar r9d, 7
sar r8d, 7
or r9d, ebp
sar cl, 7
mov byte [rdx + 0xe], r9b
movzx r9d, byte [rax + 0xd]
and ecx, 0xffffff87
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 0xd], r8b
movzx r8d, byte [rax + 0xc]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 0xc], r9b
movzx r9d, byte [rax + 0xb]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 0xb], r8b
movzx r8d, byte [rax + 0xa]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 0xa], r9b
movzx r9d, byte [rax + 9]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 9], r8b
movzx r8d, byte [rax + 8]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 8], r9b
movzx r9d, byte [rax + 7]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 7], r8b
movzx r8d, byte [rax + 6]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 6], r9b
movzx r9d, byte [rax + 5]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 5], r8b
movzx r8d, byte [rax + 4]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 4], r9b
movzx r9d, byte [rax + 3]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 3], r8b
movzx r8d, byte [rax + 2]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 2], r9b
movzx r9d, byte [rax + 1]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 1], r8b
movzx eax, byte [rax]
add eax, eax
or eax, r9d
xor ecx, edi
add r10, 0x10
mov byte [rdx], al
mov byte [rdx + 0xf], cl
cmp r11, rsi
jne 0x1401fe800
mov rax, qword [rbx + 0x58]
mov qword [rbx + 0x28], r11
shl r11, 4
add rax, r11
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, [rdx + 4]
mov r9d, 0x71
lea r8, str.crypto_modes_ocb128.c
sub rdx, rcx
and rdx, 0xfffffffffffffffc
add rdx, rcx
mov rcx, rax
mov qword [rbx + 0x30], rdx
shl rdx, 4
call fcn.1401f4df0
test rax, rax
je 0x1401fe96a
mov qword [rbx + 0x58], rax
jmp 0x1401fe7ec
shl rsi, 4
add rax, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140213040
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x140213075
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x140213050
and r10, 0xf
je 0x1402130a6
mov r9, 0x10
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x140213081
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x14021309a
mov rax, r8
repz ret
Function at 0x1402130b0
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x1402130ed
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x1402130c0
pxor xmm1, xmm1
and r10, 0xf
je 0x140213124
mov r9, 0x10
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x1402130fc
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x140213118
mov rax, r8
repz ret
Function at 0x1402263b0
Capabilities:
Check for software breakpoints

Disassembly:
push r12
sub rsp, 0x30
mov eax, dword [rsp + 0x60]
mov r10, rcx
cmp eax, r9d
jne 0x140226488
movzx ecx, byte [r8]
lea edx, [rcx - 0x6a]
cmp dl, 1
ja 0x140226488
lea rdx, [r8 + 1]
lea r12d, [rax - 2]
cmp cl, 0x6b
je 0x140226408
movsxd rax, r12d
cmp byte [rdx + rax], 0xcc
jne 0x1402264b7
mov r8d, r12d
mov rcx, r10
call fcn.14042d770
mov eax, r12d
add rsp, 0x30
pop r12
ret
lea r12d, [rax - 3]
test r12d, r12d
jle 0x140226438
xor eax, eax
jmp 0x140226425
cmp cl, 0xbb
jne 0x140226448
add eax, 1
cmp r12d, eax
je 0x140226480
movzx ecx, byte [rdx]
add rdx, 1
cmp cl, 0xba
jne 0x140226418
sub r12d, eax
test eax, eax
jne 0x1402263e3
mov dword [rsp + 0x20], 0x50
jmp 0x140226450
mov dword [rsp + 0x20], 0x48
mov r8d, 0x8a
mov edx, pe_nt_image_headers64
mov ecx, 4
mov r12d, 0xffffffff
lea r9, str.crypto_rsa_rsa_x931.c
call fcn.1401d1f90
mov eax, r12d
add rsp, 0x30
pop r12
ret
xor r12d, r12d
jmp 0x1402263e3
mov r8d, 0x89
mov edx, pe_nt_image_headers64
mov ecx, 4
mov dword [rsp + 0x20], 0x3d
lea r9, str.crypto_rsa_rsa_x931.c
mov r12d, 0xffffffff
call fcn.1401d1f90
jmp 0x1402263fb
mov r8d, 0x8b
mov edx, pe_nt_image_headers64
mov ecx, 4
mov dword [rsp + 0x20], 0x59
lea r9, str.crypto_rsa_rsa_x931.c
mov r12d, 0xffffffff
call fcn.1401d1f90
jmp 0x1402263fb
Function at 0x140243600
Capabilities:
Hash data using sha256

Disassembly:
push r13
push r12
push rdi
sub rsp, 0x90
lea rax, [0x1407e1800]
movdqu xmm0, xmmword [0x1406af250]
test r8, r8
mov r12, r8
lea r8, [rsp + 0x40]
mov r9, rcx
cmove r12, rax
mov ecx, 9
xor eax, eax
mov rdi, r8
rep stosq qword [rdi], rax
movups xmmword [rsp + 0x20], xmm0
movdqu xmm0, xmmword [0x1406af260]
lea r13, [rsp + 0x20]
movups xmmword [rsp + 0x30], xmm0
mov dword [rdi], 0
mov dword [rsp + 0x8c], 0x20
test rdx, rdx
je 0x140243675
mov r8, rdx
mov rcx, r13
mov rdx, r9
call fcn.140242bc0
mov rdx, r13
mov rcx, r12
call fcn.1402432f0
mov edx, 0x70
mov rcx, r13
call fcn.1402746b0
mov rax, r12
add rsp, 0x90
pop rdi
pop r12
pop r13
ret
Function at 0x140274710
Capabilities:
Encode data using xor

Disassembly:
xor rax, rax
xor r10, r10
cmp r8, 0
je 0x14027475d
cmp r8, 0x10
jne 0x140274740
mov r10, qword [rcx]
mov r11, qword [rcx + 8]
mov r8, 1
xor r10, qword [rdx]
xor r11, qword [rdx + 8]
or r10, r11
cmovne rax, r8
repz ret
mov r10b, byte [rcx]
lea rcx, [rcx + 1]
xor r10b, byte [rdx]
lea rdx, [rdx + 1]
or al, r10b
dec r8
jne 0x140274740
neg rax
shr rax, 0x3f
repz ret
Function at 0x1402832e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140283300
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret

Function at 0x140283340
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140283360
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret

Function at 0x1402833a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1402833c3
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x140283410
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140283433
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret

Function at 0x140283480
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1402834a9
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret
Function at 0x140283510
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140283539
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
repz ret

Function at 0x1402835a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1402835ff

Function at 0x1402835f0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.1402835f0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
repz ret

Function at 0x140283680
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1402836df
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1402836d0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
repz ret
Function at 0x140283760
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesenc xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1402837ba

Function at 0x1402837da
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1402837b0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
repz ret

Function at 0x140283870
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesdec xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1402838ca
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1402838c0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
aesdeclast xmm8, xmm0
aesdeclast xmm9, xmm0
repz ret
Function at 0x1402860a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
movdqa xmm14, xmm10
pxor xmm10, xmm15
movdqu xmm15, xmmword [rbx + r14]
pxor xmm11, xmm10
pxor xmm8, xmm2
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm8, xmm3
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm8, xmm4
pxor xmm4, xmm12
pxor xmm14, xmm13
pxor xmm8, xmm5
pxor xmm5, xmm13
pxor xmm15, xmm14
pxor xmm8, xmm6
pxor xmm6, xmm14
pxor xmm8, xmm7
pxor xmm7, xmm15
movups xmm0, xmmword [r11 + 0x20]
lea r12, [r8 + 1]
lea r13, [r8 + 3]
lea r14, [r8 + 5]
add r8, 6
pxor xmm10, xmm9
bsf r12, r12
bsf r13, r13
bsf r14, r14
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
pxor xmm11, xmm9
pxor xmm12, xmm9
aesenc xmm6, xmm1
pxor xmm13, xmm9
pxor xmm14, xmm9
aesenc xmm7, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm15, xmm9
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [r11 + 0x40]
shl r12, 4
shl r13, 4
jmp 0x1402861c0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1402861c0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [r11 + 0x10]
shl r14, 4
aesenclast xmm2, xmm10
movdqu xmm10, xmmword [rbx]
mov rax, r10
aesenclast xmm3, xmm11
aesenclast xmm4, xmm12
aesenclast xmm5, xmm13
aesenclast xmm6, xmm14
aesenclast xmm7, xmm15
repz ret

Function at 0x140286260
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm8, xmm2
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm8, xmm3
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm8, xmm4
pxor xmm4, xmm12
pxor xmm8, xmm5
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x140286300
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140286300
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesenclast xmm2, xmm10
aesenclast xmm3, xmm11
aesenclast xmm4, xmm12
aesenclast xmm5, xmm13
repz ret