joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009cf60
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x140155cc0]
xor rax, rsp
mov qword [rsp + 0x170], rax
test rcx, rcx
je 0x14009d03e
movabs rax, 0xe69e32f3ad9ea63
cmp qword [0x140162280], rax
je 0x14009cfcb
lea rdx, str....._base_allocatorpartition_allocator_srcpartition_alloc_thread_cache.cc
lea r9, str.tools::kThreadCacheNeedleArray_0___tools::kNeedle1
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x1d4
call fcn.140070b10
mov rcx, rdi
call fcn.140070b70
mov rcx, rdi
call fcn.140070b80
call fcn.1400b1ba0
mov edx, 0x978
mov rcx, rax
xor r8d, r8d
call fcn.14009db80
mov rdi, rax
mov rcx, rax
mov rdx, rsi
call fcn.14009d0a0
mov ecx, dword [0x14016abd8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x1401652f8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x178], rdi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
cmp rcx, qword [0x140155cc0]
jne 0x14009d038
mov rax, rdi
add rsp, 0x178
pop rdi
pop rsi
ret
call fcn.1400e0180
int3
lea rdx, str....._base_allocatorpartition_allocator_srcpartition_alloc_thread_cache.cc
lea r9, str.root
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x1d1
call fcn.140070b10
mov rcx, rdi
call fcn.140070b70
mov rcx, rdi
call fcn.140070b80
movabs rax, 0xe69e32f3ad9ea63
cmp qword [0x140162280], rax
jne 0x14009cf9a
jmp 0x14009cfcb

Function at 0x1400a0790
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, qword [0x140155cc0]
xor rax, rsp
mov qword [rsp + 0x30], rax
test rdx, rdx
je 0x1400a0833
cmp ecx, dword [0x14016ac48]
jl 0x1400a0833
mov rsi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
movsxd r12, eax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add r12, rsi
lea r14, [rsp + 0x2c]
mov r15, qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
cmp rsi, r12
jae 0x1400a0827
mov dword [rsp + 0x2c], 0
mov r8d, r12d
sub r8d, esi
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rsi
mov r9, r14
call r15
test eax, eax
je 0x1400a0827
mov eax, dword [rsp + 0x2c]
add rsi, rax
test eax, eax
jne 0x1400a07f0
test edi, edi
je 0x1400a0833
cmp byte [r12 - 1], 0xa
jne 0x1400a0858
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
cmp rcx, qword [0x140155cc0]
jne 0x1400a0852
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.1400e0180
int3
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rsi, rax
xor eax, eax
lea rdi, [0x14011795f]
lea rbx, [rsp + 0x2c]
nop word cs:[rax + rax]
test rax, rax
jne 0x1400a0833
mov dword [rsp + 0x2c], 0
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, rdi
mov r8d, 1
mov r9, rbx
call r15
test eax, eax
je 0x1400a0833
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x1400a0880
jmp 0x1400a0833
Function at 0x1400a7560
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140155cc0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ebx, 0xffffffff
cmp r8, rbx
cmovb rbx, r8
mov dword [rsp + 0x5c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x5c]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400a76a5
lea r13, [rsp + 0x30]
lea rbp, [rsp + 0x50]
mov r15, qword [sym.imp.KERNEL32.dll_GetFileType]
lea r14, [rsp + 0x5c]
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
nop word cs:[rax + rax]
mov eax, dword [rsp + 0x5c]
cmp eax, 0xffffffff
je 0x1400a7626
test eax, eax
jne 0x1400a76be
mov rcx, rdi
call r15
cmp eax, 3
jne 0x1400a76ba
mov dword [rsp + 0x5c], 0xaaaaaaaa
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r12
test eax, eax
jne 0x1400a75e0
jmp 0x1400a76a5
mov ecx, 0xffffffff
call fcn.14005b050
mov qword [rsp + 0x28], rax
mov ecx, 0xffffffff
call fcn.14005b050
lea rcx, str.bytes_read___static_cast_DWORD___1_
mov rdx, rax
mov r8, qword [rsp + 0x28]
call fcn.14005b340
test rax, rax
je 0x1400a7697
mov rcx, r13
lea rdx, [0x14011deb2]
lea r8, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
mov r9d, 0x7f
mov qword [rsp + 0x28], rax
call fcn.140054de0
mov rcx, rbp
mov rdx, qword [rsp + 0x28]
mov r8d, 0xffffffff
mov r9, r13
call fcn.14005b6f0
mov rcx, rbp
call fcn.14005b960
mov eax, dword [rsp + 0x5c]
test eax, eax
je 0x1400a75f1
jmp 0x1400a76be
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
xor eax, eax
cmp ecx, 0x6d
setne al
neg rax
jmp 0x1400a76c0
mov eax, dword [rsp + 0x5c]
mov eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
cmp rcx, qword [0x140155cc0]
jne 0x1400a76e2
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400e0180
int3

Function at 0x1400a7e50
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rdi, rcx
mov rax, qword [0x140155cc0]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor esi, esi
xor edx, edx
xor r8d, r8d
call fcn.1400a7d30
test rax, rax
jne 0x1400a7ee7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov sil, 1
test eax, eax
jne 0x1400a7ee7
mov ecx, 2
call fcn.1400504a0
test al, al
je 0x1400a7ee5
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_file_io_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xfb
mov r9d, 2
call fcn.140051bb0
lea rcx, [rsp + 0x38]
lea rdx, [0x1401303e8]
mov r8d, 0xc
call fcn.1400034d0
mov rcx, rsi
call fcn.140051ca0
xor esi, esi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
cmp rcx, qword [0x140155cc0]
jne 0x1400a7f07
mov eax, esi
add rsp, 0x168
pop rdi
pop rsi
ret
call fcn.1400e0180
int3
Function at 0x1400a8610
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x140155cc0]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x1400a863a
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400a865b
test bl, bl
jne 0x1400a8653
mov ecx, eax
and ecx, 0x400
jne 0x1400a86bc
and eax, 0x10
shr eax, 4
jmp 0x1400a86be
mov ecx, 2
call fcn.1400504a0
test al, al
je 0x1400a86bc
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x80
mov r9d, 2
call fcn.140051bb0
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400034d0
mov rcx, rax
mov rdx, rsi
call fcn.140055380
mov rcx, rdi
call fcn.140051ca0
xor eax, eax
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
cmp rcx, qword [0x140155cc0]
jne 0x1400a86dd
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call fcn.1400e0180
int3

Function at 0x1400a86f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x140155cc0]
xor rax, rsp
mov qword [rsp + 0x160], rax
cmp byte [rcx + 0x17], 0
jns 0x1400a8717
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400a872c
test eax, 0x410
sete al
jmp 0x1400a878f
mov ecx, 2
call fcn.1400504a0
test al, al
je 0x1400a878d
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x73
mov r9d, 2
call fcn.140051bb0
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400034d0
mov rcx, rax
mov rdx, rsi
call fcn.140055380
mov rcx, rdi
call fcn.140051ca0
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
cmp rcx, qword [0x140155cc0]
jne 0x1400a87ad
add rsp, 0x168
pop rdi
pop rsi
ret
call fcn.1400e0180
int3
Function at 0x1400a87c0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x140155cc0]
xor rax, rsp
mov qword [rsp + 0x160], rax
cmp byte [rcx + 0x17], 0
jns 0x1400a87e7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
sete cl
not eax
test eax, 0x410
setne al
or al, cl
je 0x1400a88a0
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1400a8811
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, eax
mov al, 1
test ecx, ecx
jne 0x1400a8882
mov ecx, 2
call fcn.1400504a0
test al, al
je 0x1400a8880
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x93
mov r9d, 2
call fcn.140051bb0
lea rcx, [rsp + 0x38]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.1400034d0
mov rcx, rax
mov rdx, rsi
call fcn.140055380
mov rcx, rdi
call fcn.140051ca0
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
cmp rcx, qword [0x140155cc0]
jne 0x1400a88c1
add rsp, 0x168
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400e0180
mov rcx, rsi
add rsp, 0x168
pop rdi
pop rsi
jmp fcn.1400a88d0
call fcn.1400e0180
int3

Function at 0x1400a88d0
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x140155cc0]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x1400a88f8
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test eax, eax
jne 0x1400a8965
mov ecx, 2
call fcn.1400504a0
test al, al
je 0x1400a8965
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x2f
mov r9d, 2
call fcn.140051bb0
lea rcx, [rsp + 0x40]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.1400034d0
mov rcx, rax
mov rdx, rsi
call fcn.140055380
mov rcx, rbx
call fcn.140051ca0
test edi, edi
setne al
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
cmp rcx, qword [0x140155cc0]
jne 0x1400a8989
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call fcn.1400e0180
int3
Function at 0x1400b1a50
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140155cc0]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp qword [0x14016ad48], 0
je 0x1400b1aad
lea rdx, str....._base_allocatorpartition_allocator_srcpartition_allocpartition_tls_win.cc
lea r9, str.g_destructor__nullptr
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r8d, 0x29
call fcn.140070b10
mov rcx, rbx
call fcn.140070b70
mov rcx, rbx
call fcn.140070b80
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400b1ac7
mov dword [rdi], eax
mov dword [0x14016ad50], eax
mov qword [0x14016ad48], rsi
cmp eax, 0xffffffff
setne al
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
cmp rcx, qword [0x140155cc0]
jne 0x1400b1aec
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call fcn.1400e0180
int3
Function at 0x1400b3d60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400b3d80
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x1400b3dc0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400b3de0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x1400b3e20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400b3e43
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x1400b3ea0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400b3ec3
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x1400b3f20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400b3f49
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret
Function at 0x1400b3fb0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400b3fd9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x1400b4040
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400b409f
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400b4090
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x1400b4120
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400b417f
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400b4170
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret

Function at 0x1400b4200
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesenc xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400b425a
Function at 0x1400b427a
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400b4250
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
ret

Function at 0x1400b4310
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesdec xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400b436a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400b4360
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
aesdeclast xmm8, xmm0
aesdeclast xmm9, xmm0
ret
Function at 0x1400b5c90
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
movups xmm0, xmmword [rcx]
xorps xmm4, xmm4
lea rax, [r8 + 0x10]
cmp edx, 0x100
je 0x1400b5dd0
cmp edx, 0xc0
je 0x1400b5d50
cmp edx, 0x80
jne 0x1400b5e90
mov edx, 9
movups xmmword [r8], xmm0
aeskeygenassist xmm1, xmm0, 1
call fcn.1400b5ec7
aeskeygenassist xmm1, xmm0, 2
call fcn.1400b5ec0
aeskeygenassist xmm1, xmm0, 4
call fcn.1400b5ec0
aeskeygenassist xmm1, xmm0, 8
call fcn.1400b5ec0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.1400b5ec0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.1400b5ec0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.1400b5ec0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.1400b5ec0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.1400b5ec0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.1400b5ec0
movups xmmword [rax], xmm0
mov dword [rax + 0x50], edx
xor eax, eax
jmp 0x1400b5e97
movq xmm2, qword [rcx + 0x10]
mov edx, 0xb
movups xmmword [r8], xmm0
aeskeygenassist xmm1, xmm2, 1
call fcn.1400b5ee7
aeskeygenassist xmm1, xmm2, 2
call fcn.1400b5f20
aeskeygenassist xmm1, xmm2, 4
call fcn.1400b5ee0
aeskeygenassist xmm1, xmm2, 8
call fcn.1400b5f20
aeskeygenassist xmm1, xmm2, 0x10
call fcn.1400b5ee0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.1400b5f20
aeskeygenassist xmm1, xmm2, 0x40
call fcn.1400b5ee0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.1400b5f20
movups xmmword [rax], xmm0
mov dword [rax + 0x30], edx
xor rax, rax
jmp 0x1400b5e97
movups xmm2, xmmword [rcx + 0x10]
mov edx, 0xd
lea rax, [rax + 0x10]
movups xmmword [r8], xmm0
movups xmmword [r8 + 0x10], xmm2
aeskeygenassist xmm1, xmm2, 1
call fcn.1400b5f47
aeskeygenassist xmm1, xmm0, 1
call fcn.1400b5f60
aeskeygenassist xmm1, xmm2, 2
call fcn.1400b5f40
aeskeygenassist xmm1, xmm0, 2
call fcn.1400b5f60
aeskeygenassist xmm1, xmm2, 4
call fcn.1400b5f40
aeskeygenassist xmm1, xmm0, 4
call fcn.1400b5f60
aeskeygenassist xmm1, xmm2, 8
call fcn.1400b5f40
aeskeygenassist xmm1, xmm0, 8
call fcn.1400b5f60
aeskeygenassist xmm1, xmm2, 0x10
call fcn.1400b5f40
aeskeygenassist xmm1, xmm0, 0x10
call fcn.1400b5f60
aeskeygenassist xmm1, xmm2, 0x20
call fcn.1400b5f40
aeskeygenassist xmm1, xmm0, 0x20
call fcn.1400b5f60
aeskeygenassist xmm1, xmm2, 0x40
call fcn.1400b5f40
movups xmmword [rax], xmm0
mov dword [rax + 0x10], edx
xor rax, rax
jmp 0x1400b5e97
mov rax, 0xfffffffffffffffe
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
add rsp, 8
ret
Function at 0x1400b5f80
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
movups xmm0, xmmword [rcx]
xorps xmm4, xmm4
lea rax, [r8 + 0x10]
cmp edx, 0x100
je 0x1400b6150
cmp edx, 0xc0
je 0x1400b60b0
cmp edx, 0x80
jne 0x1400b6220
mov edx, 9
movdqa xmm5, xmmword [0x140130e50]
mov r10d, 8
movdqa xmm4, xmmword [0x140130e70]
movdqa xmm2, xmm0
movdqu xmmword [r8], xmm0
jmp 0x1400b5fe0
pshufb xmm0, xmm5
aesenclast xmm0, xmm4
pslld xmm4, 1
lea rax, [rax + 0x10]
movdqa xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm2, xmm3
pxor xmm0, xmm2
movdqu xmmword [rax - 0x10], xmm0
movdqa xmm2, xmm0
dec r10d
jne 0x1400b5fe0
movdqa xmm4, xmmword [str.eeee]
pshufb xmm0, xmm5
aesenclast xmm0, xmm4
pslld xmm4, 1
movdqa xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm2, xmm3
pxor xmm0, xmm2
movdqu xmmword [rax], xmm0
movdqa xmm2, xmm0
pshufb xmm0, xmm5
aesenclast xmm0, xmm4
movdqa xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm2, xmm3
pxor xmm0, xmm2
movdqu xmmword [rax + 0x10], xmm0
mov dword [rax + 0x60], edx
xor eax, eax
jmp 0x1400b6227
movq xmm2, qword [rcx + 0x10]
mov edx, 0xb
movdqa xmm5, xmmword [0x140130e60]
movdqa xmm4, xmmword [0x140130e70]
mov r10d, 8
movdqu xmmword [r8], xmm0
jmp 0x1400b60e0
movq qword [rax], xmm2
movdqa xmm1, xmm2
pshufb xmm2, xmm5
aesenclast xmm2, xmm4
pslld xmm4, 1
lea rax, [rax + 0x18]
movdqa xmm3, xmm0
pslldq xmm0, 4
pxor xmm3, xmm0
pslldq xmm0, 4
pxor xmm3, xmm0
pslldq xmm0, 4
pxor xmm0, xmm3
pshufd xmm3, xmm0, 0xff
pxor xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm1
pxor xmm0, xmm2
pxor xmm2, xmm3
movdqu xmmword [rax - 0x10], xmm0
dec r10d
jne 0x1400b60e0
mov dword [rax + 0x20], edx
xor eax, eax
jmp 0x1400b6227
movups xmm2, xmmword [rcx + 0x10]
mov edx, 0xd
lea rax, [rax + 0x10]
movdqa xmm5, xmmword [0x140130e50]
movdqa xmm4, xmmword [0x140130e70]
mov r10d, 7
movdqu xmmword [r8], xmm0
movdqa xmm1, xmm2
movdqu xmmword [r8 + 0x10], xmm2
jmp 0x1400b6190
pshufb xmm2, xmm5
aesenclast xmm2, xmm4
movdqa xmm3, xmm0
pslldq xmm0, 4
pxor xmm3, xmm0
pslldq xmm0, 4
pxor xmm3, xmm0
pslldq xmm0, 4
pxor xmm0, xmm3
pslld xmm4, 1
pxor xmm0, xmm2
movdqu xmmword [rax], xmm0
dec r10d
je 0x1400b6212
pshufd xmm2, xmm0, 0xff
pxor xmm3, xmm3
aesenclast xmm2, xmm3
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm1
pslldq xmm1, 4
pxor xmm1, xmm3
pxor xmm2, xmm1
movdqu xmmword [rax + 0x10], xmm2
lea rax, [rax + 0x20]
movdqa xmm1, xmm2
jmp 0x1400b6190
mov dword [rax + 0x10], edx
xor eax, eax
jmp 0x1400b6227
mov rax, 0xfffffffffffffffe
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
add rsp, 8
ret