joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140387564
Capabilities:
Encrypt or decrypt via wincrypt
Generate random numbers via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov r12, r9
mov dword [rax + 0x10], r15d
mov ebp, r8d
mov rsi, rdx
mov rbx, rcx
mov edi, r15d
test rdx, rdx
je 0x14038777f
test r9, r9
je 0x14038777f
mov r14, qword [rsp + 0xa0]
test r14, r14
je 0x14038777f
cmp qword [rcx + 0x30], r15
jne 0x1403875c7
mov ebx, 0x80049e51
jmp 0x140387784
mov r13d, dword [r14]
lea rdx, str.http:__www.w3.org_2001_04_xmlencaes128_cbc
mov rcx, rsi
mov dword [r14], r15d
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x1403875f3
cmp dword [rbx + 0xc], 1
lea esi, [rax + 0x10]
je 0x14038762f
mov ebx, 0x80049e2e
jmp 0x140387784
lea rdx, str.http:__www.w3.org_2001_04_xmlencaes192_cbc
mov rcx, rsi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14038760f
cmp dword [rbx + 0xc], 2
lea esi, [rax + 0x18]
jmp 0x1403875e7
lea rdx, str.http:__www.w3.org_2001_04_xmlencaes256_cbc
mov rcx, rsi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140387778
cmp dword [rbx + 0xc], 3
lea esi, [rax + 0x20]
jmp 0x1403875e7
mov rcx, qword [rbx + 0x30]
lea r15d, [rsi + rbp]
xor r9d, r9d
mov dword [rsp + 0x30], r15d
lea rax, [rsp + 0x88]
mov dword [rsp + 0x88], r15d
mov qword [rsp + 0x28], rax
xor edx, edx
and qword [rsp + 0x20], rdi
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x140387682
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140387784
mov ebp, dword [rsp + 0x88]
mov dword [r14], ebp
mov r14, qword [rsp + 0xa8]
test r14, r14
je 0x140387774
cmp r13d, ebp
jae 0x1403876ac
mov ebx, 0x80049e19
jmp 0x140387784
mov dword [rsp + 0x88], r15d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x1403876da
mov ebx, 0x8007000e
jmp 0x140387784
mov r8, rbp
xor edx, edx
mov rcx, rdi
call sub.msvcrt.dll_memset
mov r8d, dword [rsp + 0x90]
mov rdx, r12
mov ecx, esi
add rcx, rdi
call sub.msvcrt.dll_memcpy
mov r15d, 2
mov r8d, esi
mov r9d, r15d
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
je 0x140387730
mov r9d, r15d
mov r8d, esi
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov ebx, eax
bts ebx, 0x1c
jmp 0x140387784
mov rcx, qword [rbx + 0x30]
lea rax, [rsp + 0x88]
xor r9d, r9d
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rdi
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x140387669
mov r8d, dword [rsp + 0x88]
mov rdx, rdi
mov rcx, r14
call sub.msvcrt.dll_memcpy
xor ebx, ebx
jmp 0x140387784
mov ebx, 0x80049e5b
jmp 0x140387784
mov ebx, 0x80070057
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1403877bc
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor edi, edi
mov r12d, r8d
mov dword [rax + 0x10], edi
mov r15, r9
mov rbp, rdx
mov rsi, rcx
mov ebx, edi
test rdx, rdx
je 0x14038792c
test r9, r9
je 0x14038792c
mov r14, qword [rsp + 0x80]
test r14, r14
je 0x14038792c
cmp qword [rcx + 0x30], rdi
jne 0x14038781e
mov edi, 0x80049e51
jmp 0x140387931
mov r13d, dword [r14]
lea rdx, str.http:__www.w3.org_2001_04_xmlencaes128_cbc
mov rcx, rbp
mov dword [r14], edi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140387847
cmp dword [rsi + 0xc], 1
je 0x14038787d
mov edi, 0x80049e2e
jmp 0x140387931
lea rdx, str.http:__www.w3.org_2001_04_xmlencaes192_cbc
mov rcx, rbp
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140387860
cmp dword [rsi + 0xc], 2
jmp 0x14038783b
lea rdx, str.http:__www.w3.org_2001_04_xmlencaes256_cbc
mov rcx, rbp
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140387925
cmp dword [rsi + 0xc], 3
jmp 0x14038783b
mov dword [rsp + 0x68], r12d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x1403878a8
mov edi, 0x8007000e
jmp 0x140387931
mov r8d, dword [rsp + 0x68]
mov rdx, r15
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsi + 0x30]
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rbx
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x1403878f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x140387931
mov eax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x88]
add eax, 0xfffffff0
mov dword [r14], eax
test rcx, rcx
je 0x140387931
cmp r13d, eax
jae 0x140387917
mov edi, 0x80049e19
jmp 0x140387931
mov r8d, eax
lea rdx, [rbx + 0x10]
call sub.msvcrt.dll_memcpy
jmp 0x140387931
mov edi, 0x80049e5b
jmp 0x140387931
mov edi, 0x80070057
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140388f7c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140388fc8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140388fc0
cmp dword [rcx + 0x3c], edx
jl 0x140388fc0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140388fc0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140388fc8
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1403890f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140389118
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140389118
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400291bc
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c7b4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c7b4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002930c
cmp rax, 0xffffffffffffffff
je 0x14002930c
xor edi, edi
test rbp, rbp
jle 0x1400292b7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f0c8
mov rbx, rax
test rax, rax
jne 0x140029244
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400292ad
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a0e8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d490
cmp eax, 0xffffffff
je 0x14002928d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029254
mov edx, r15d
mov ecx, r14d
call fcn.14001a0e8
jmp 0x1400292ad
cmp byte [rsi + 0x38], dil
je 0x1400292a4
cmp dword [rsi + 0x34], 5
jne 0x1400292a4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400292ad
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001ae7c
jmp 0x140029320
jns 0x140029320
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c7b4
cmp rax, 0xffffffffffffffff
jne 0x1400292d8
cmp byte [rsi + 0x30], dil
je 0x140029320
mov edi, dword [rsi + 0x2c]
jmp 0x140029320
mov ecx, r14d
call fcn.1400185a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029320
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029320
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029319
mov eax, dword [rsi + 0x2c]
jmp 0x14002931e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c7b4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140003578
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x6ff8fbf2
mov ecx, dword [rsp + 0x5c]
mov edx, dword [rsp + 0x5c]
push rsp
and al, 0x5c
xor ecx, 0x3aacafde
mov word [rsp + 0x62], 0x95da
and al, 0x62
invalid
xchg ebp, eax
int1
fisubr word [rdi - 0x3899c554]
cmp ah, byte [rsi - 0x39]
and al, 0x62
ficom dword [rbp + 0x4489d029]
and al, 0x48
cmp dword [rsp + 0x48], ecx
je 0x14000355e

Function at 0x140004dd8
Capabilities:
Encode data using xor

Disassembly:
movabs byte [0x66fff58366000000], al
mov dword [rsp + 0x17e], ebp
cmp rbx, rdi
je 0x140004a87
jmp 0x140004772
Function at 0x140003010
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r14, rdx
mov r13, rcx
mov rax, qword [0x1400ff028]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov byte [rcx], 1
mov qword [rcx + 8], 0
mov byte [rcx + 0x10], 0
mov eax, dword [0x140108668]
mov ecx, dword [0x1401025d8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400031c1
mov ecx, dword [0x140102430]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140003144
movsxd rcx, dword [0x140108660]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x140108664]
jne 0x140003144
mov rdi, qword [rax + rcx]
test rdi, rdi
je 0x140003144
movabs r12, 0x6000000000000000
movabs r15, 0xffffffffffffff
mov rax, qword [rdi]
mov rbx, rax
and rbx, r15
and rax, r12
movabs rcx, 0x4000000000000000
cmp rax, rcx
jne 0x14000310a
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400030f7
mov rsi, qword [rdi]
call qword [rcx + VariantCopy]
movabs rcx, 0xff00000000000000
and rcx, rsi
or rcx, rax
mov qword [rdi], rcx
movabs rax, 0xbfffffffffffffff
lock and qword [rdi], rax
mov byte [r13 + 0x10], 1
movabs rsi, 0x8000000000000001
mov qword [r13 + 8], rbx
lea rbx, [rsp + 0x20]
mov rcx, rbx
call qword [fcn.140047d70]
mov rax, qword [rbx]
lea rcx, [r14 + rsi]
cmp rcx, 2
jae 0x14000314b
add rsi, rax
cmp rsi, 1
ja 0x14000316d
cmp rax, r14
je 0x14000316d
int3
mov byte [r13], 0
jmp 0x1400031a1
xor ecx, ecx
mov rdx, rax
add rdx, r14
setns cl
movabs rdx, 0x7fffffffffffffff
add rdx, rcx
add rax, r14
cmovo rax, rdx
mov r14, rax
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000318f
mov rsi, qword [rdi]
call qword [rcx + VariantCopy]
movabs rcx, 0xff00000000000000
and rcx, rsi
or rcx, rax
mov qword [rdi], rcx
mov rax, qword [rdi]
and rax, r12
and r14, r15
or r14, rax
mov qword [rdi], r14
inc dword [rdi + 0x14]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140069b80
mov rax, r13
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x140108668]
call fcn.1400676e4
cmp dword [0x140108668], 0xffffffff
jne 0x140003068
mov qword [0x140108660], 0
lea rcx, [0x140108660]
xor edx, edx
call fcn.140036aa0
lea rcx, [0x140108668]
call fcn.140067684
jmp 0x140003068
Function at 0x1400055c0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.14003d750
test al, al
jne 0x1400055f1
mov rcx, rsi
mov rdx, rbx
mov r8d, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14003d990
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsi + 0x24], 0xfffffffb
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x140005610
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r14, r8
mov ebp, edx
mov rsi, rcx
mov ebx, dword [0x1401085a4]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test edi, edi
jne 0x1400056f5
cmp rbx, 1
je 0x140005653
mov eax, dword [rsi + 0x1518]
test eax, eax
je 0x14000565a
xor eax, eax
jmp 0x1400056ea
mov eax, 1
lock xadd dword [rsi + 0x1518], eax
cmp eax, 0x7fffffff
je 0x140005741
mov rcx, rsi
call fcn.140028d90
mov rdi, rax
lock dec dword [rsi + 0x1518]
inc qword [rax + 0x5a0]
cmp bp, 0x29
jae 0x140005702
movzx edx, bp
mov rsi, rdx
shl rsi, 4
mov rbx, rdi
add rbx, rsi
mov rax, qword [rdi + rsi]
test rax, rax
je 0x140005715
inc qword [rdi + 0x5a8]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400056cd
mov rdx, rcx
not rdx
cmp qword [rax + 8], rdx
jne 0x14000573c
bswap rcx
prefetcht0 byte [rcx]
jmp 0x1400056cf
xor ecx, ecx
dec byte [rdi + rsi + 8]
mov qword [rbx], rcx
movzx ecx, word [rdi + rsi + 0xa]
mov qword [r14], rcx
movzx ecx, word [rdi + rsi + 0xa]
sub qword [rdi + 0x590], rcx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140005643
inc qword [rdi + 0x5c0]
inc qword [rdi + 0x5b0]
jmp 0x140005653
inc qword [rdi + 0x5b8]
inc qword [rdi + 0x5b0]
mov rcx, rdi
call fcn.140039f40
mov rax, qword [rbx]
test rax, rax
jne 0x1400056b1
jmp 0x140005653
call fcn.140094cc0
int3

Function at 0x140005d40
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor ebx, ebx
test edx, edx
sete bl
xor ecx, ecx
mov edx, ebx
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x140005dfc
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140005dc9
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140005da4
mov qword [rsi], rdi
call fcn.140035e50
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 1
inc rax
cmp rax, 1
jbe 0x140005e00
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140035e50
mov r14, qword [rsi]
mov rcx, qword [0x140106b30]
test rcx, rcx
je 0x140005dee
mov rax, qword [rcx]
mov rdx, r14
call qword [rax]
mov qword [rsi], 0
jmp 0x140005d92
call fcn.14009d380
mov rcx, qword [0x140106b30]
jmp 0x140005ddd
mov byte [rsi + 8], 1
int3
Function at 0x140006940
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
mov eax, 0x1040
call fcn.140069b10
sub rsp, rax
mov rax, qword [0x1400ff028]
xor rax, rsp
mov qword [rsp + 0x1038], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x140102430]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
jne 0x1400069df
lea rcx, [rsp + 0x2c]
call fcn.140092e00
test al, al
je 0x140006a5c
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
jne 0x1400069c0
lea rcx, [rsp + 0x2c]
call fcn.140092e00
test al, al
je 0x140006a5f
cmp dword [rsp + 0x2c], 0xffffffff
je 0x140006a5f
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov ecx, dword [rsp + 0x2c]
mov eax, 0xffffffff
lock cmpxchg dword [0x140102430], ecx
je 0x1400069df
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov ecx, dword [0x140102430]
mov dword [rsp + 0x2c], ecx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x140006a59
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.14006c1b0
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
mov rbx, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rbx
mov ecx, 0x1000
call fcn.1400679c8
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.14006bb00
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call rbx
mov rcx, qword [rsp + 0x1038]
xor rcx, rsp
call fcn.140069b80
mov rax, rdi
add rsp, 0x1040
pop rbx
pop rdi
pop rsi
ret
int3
int3
int3

Function at 0x140006dd0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140108508]
cmp rsi, 1
jbe 0x140006e15
mov ecx, dword [0x140102430]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140006e67
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x140006e67
mov rax, qword [rax + rcx]
test rax, rax
je 0x140006e67
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140108508]
call fcn.140047cb0
test al, al
je 0x140006e5b
mov qword [0x140108510], 0
lea rdi, [0x140108508]
lea rsi, [0x140108510]
mov rcx, rsi
xor edx, edx
call fcn.140036aa0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.140047c20
jmp 0x140006de3
mov rsi, qword [0x140108508]
jmp 0x140006de3
int3
Function at 0x14000dd60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000dd80
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret

Function at 0x14000ddc0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000dde0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret

Function at 0x14000de20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000de43
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x14000dea0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000dec3
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret

Function at 0x14000df20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000df49
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret
Function at 0x14000dfb0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000dfd9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
repz ret

Function at 0x14000e040
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14000e09f

Function at 0x14000e090
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.14000e090
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
repz ret

Function at 0x14000e120
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14000e17f
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000e170
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
repz ret