joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400065c0
Capabilities:
Encode data using xor

Disassembly:
lea r11, [0x140008380]
movdqu xmm7, xmmword [rcx]
lea rcx, [rcx + 0x10]
movdqa xmm0, xmmword [r11]
movdqa xmm1, xmmword [r11 + 0x10]
movdqa xmm2, xmmword [r11 + 0x20]
movdqa xmm3, xmmword [r11 + 0x30]
movdqa xmm4, xmmword [r11 + 0x40]
pcmpeqd xmm5, xmm5
movdqu xmm6, xmmword [rcx]
movdqa xmmword [rax], xmm7
lea rax, [rax + 0x10]
dec r10d
jmp 0x140006610
pshufb xmm6, xmm4
movdqa xmm8, xmm0
movdqa xmm9, xmm1
pand xmm8, xmm6
pand xmm9, xmm6
movdqa xmm10, xmm2
pcmpeqb xmm8, xmm0
psllq xmm0, 4
movdqa xmm11, xmm3
pcmpeqb xmm9, xmm1
psllq xmm1, 4
pand xmm10, xmm6
pand xmm11, xmm6
movdqa xmm12, xmm0
pcmpeqb xmm10, xmm2
psllq xmm2, 4
movdqa xmm13, xmm1
pcmpeqb xmm11, xmm3
psllq xmm3, 4
movdqa xmm14, xmm2
movdqa xmm15, xmm3
pxor xmm8, xmm5
pxor xmm9, xmm5
pand xmm12, xmm6
pand xmm13, xmm6
movdqa xmmword [rax], xmm8
pcmpeqb xmm12, xmm0
psrlq xmm0, 4
movdqa xmmword [rax + 0x10], xmm9
pcmpeqb xmm13, xmm1
psrlq xmm1, 4
lea rcx, [rcx + 0x10]
pand xmm14, xmm6
pand xmm15, xmm6
movdqa xmmword [rax + 0x20], xmm10
pcmpeqb xmm14, xmm2
psrlq xmm2, 4
movdqa xmmword [rax + 0x30], xmm11
pcmpeqb xmm15, xmm3
psrlq xmm3, 4
movdqu xmm6, xmmword [rcx]
pxor xmm13, xmm5
pxor xmm14, xmm5
movdqa xmmword [rax + 0x40], xmm12
movdqa xmmword [rax + 0x50], xmm13
movdqa xmmword [rax + 0x60], xmm14
movdqa xmmword [rax + 0x70], xmm15
lea rax, [rax + 0x80]
dec r10d
jne 0x140006610
movdqa xmm7, xmmword [r11 + 0x50]
repz ret

Function at 0x140008600
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140008620
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret

Function at 0x140008660
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140008680
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret
Function at 0x1400086c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400086e3
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x140008730
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140008753
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret

Function at 0x1400087a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400087c9
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret

Function at 0x140008830
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140008859
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
repz ret
Function at 0x1400088c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
add rax, 0x10
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm0, xmmword [rcx + rax - 0x10]
jmp 0x14000893e

Function at 0x140008920
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.140008920
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
repz ret

Function at 0x1400089b0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm4, xmm1
pxor xmm7, xmm0
add rax, 0x10
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm0, xmmword [rcx + rax - 0x10]
jmp 0x140008a2e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140008a10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
repz ret

Function at 0x140008aa0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm2, xmm1
add rax, 0x10
pxor xmm7, xmm0
aesenc xmm3, xmm1
pxor xmm8, xmm0
pxor xmm9, xmm0
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm0, xmmword [rcx + rax - 0x10]
jmp fcn.140008b3a
Function at 0x140008b3a
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140008b10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
repz ret

Function at 0x140008bd0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
add rax, 0x10
pxor xmm7, xmm0
aesdec xmm3, xmm1
pxor xmm8, xmm0
pxor xmm9, xmm0
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm0, xmmword [rcx + rax - 0x10]
jmp 0x140008c6a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140008c40
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
aesdeclast xmm8, xmm0
aesdeclast xmm9, xmm0
repz ret
Function at 0x14000b770
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
call fcn.14000b7e0
shl edx, 4
test eax, eax
jne 0x14000b7ce
lea rcx, [r8 + rdx + 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
movups xmmword [rcx], xmm0
movups xmmword [r8], xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmmword [rcx + 0x10], xmm0
movups xmmword [r8 - 0x10], xmm1
cmp rcx, r8
ja 0x14000b79b
movups xmm0, xmmword [r8]
aesimc xmm0, xmm0
movups xmmword [rcx], xmm0
add rsp, 8
repz ret

Function at 0x14000b7e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
mov rax, 0xffffffffffffffff
test rcx, rcx
je 0x14000b9e7
test r8, r8
je 0x14000b9e7
movups xmm0, xmmword [rcx]
xorps xmm4, xmm4
lea rax, [r8 + 0x10]
cmp edx, 0x100
je 0x14000b930
cmp edx, 0xc0
je 0x14000b8b0
cmp edx, 0x80
jne 0x14000b9e0
mov edx, 9
movups xmmword [r8], xmm0
aeskeygenassist xmm1, xmm0, 1
call fcn.14000b9f7
aeskeygenassist xmm1, xmm0, 2
call fcn.14000b9f0
aeskeygenassist xmm1, xmm0, 4
call fcn.14000b9f0
aeskeygenassist xmm1, xmm0, 8
call fcn.14000b9f0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.14000b9f0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.14000b9f0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.14000b9f0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.14000b9f0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.14000b9f0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.14000b9f0
movups xmmword [rax], xmm0
mov dword [rax + 0x50], edx
xor eax, eax
jmp 0x14000b9e7
movq xmm2, qword [rcx + 0x10]
mov edx, 0xb
movups xmmword [r8], xmm0
aeskeygenassist xmm1, xmm2, 1
call fcn.14000ba17
aeskeygenassist xmm1, xmm2, 2
call fcn.14000ba50
aeskeygenassist xmm1, xmm2, 4
call fcn.14000ba10
aeskeygenassist xmm1, xmm2, 8
call fcn.14000ba50
aeskeygenassist xmm1, xmm2, 0x10
call fcn.14000ba10
aeskeygenassist xmm1, xmm2, 0x20
call fcn.14000ba50
aeskeygenassist xmm1, xmm2, 0x40
call fcn.14000ba10
aeskeygenassist xmm1, xmm2, 0x80
call fcn.14000ba50
movups xmmword [rax], xmm0
mov dword [rax + 0x30], edx
xor rax, rax
jmp 0x14000b9e7
movups xmm2, xmmword [rcx + 0x10]
mov edx, 0xd
lea rax, [rax + 0x10]
movups xmmword [r8], xmm0
movups xmmword [r8 + 0x10], xmm2
aeskeygenassist xmm1, xmm2, 1
call fcn.14000ba77
aeskeygenassist xmm1, xmm0, 1
call fcn.14000ba90
aeskeygenassist xmm1, xmm2, 2
call fcn.14000ba70
aeskeygenassist xmm1, xmm0, 2
call fcn.14000ba90
aeskeygenassist xmm1, xmm2, 4
call fcn.14000ba70
aeskeygenassist xmm1, xmm0, 4
call fcn.14000ba90
aeskeygenassist xmm1, xmm2, 8
call fcn.14000ba70
aeskeygenassist xmm1, xmm0, 8
call fcn.14000ba90
aeskeygenassist xmm1, xmm2, 0x10
call fcn.14000ba70
aeskeygenassist xmm1, xmm0, 0x10
call fcn.14000ba90
aeskeygenassist xmm1, xmm2, 0x20
call fcn.14000ba70
aeskeygenassist xmm1, xmm0, 0x20
call fcn.14000ba90
aeskeygenassist xmm1, xmm2, 0x40
call fcn.14000ba70
movups xmmword [rax], xmm0
mov dword [rax + 0x10], edx
xor rax, rax
jmp 0x14000b9e7
mov rax, 0xfffffffffffffffe
add rsp, 8
repz ret
Function at 0x14000c500
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x14000c620
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x14000c560
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x14000c560
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x14000c560
Function at 0x1400383c0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1403e5188]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rcx
mov qword [rsp + 0x20], rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r13, rax
xor edi, edi
test rax, rax
jne 0x14003841b
mov qword [rsi], rdi
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rdi
jmp 0x140038513
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov r15, rdi
mov qword [rsp + 0x38], rdi
mov ebp, 1
mov rbx, qword [rsp + 0x30]
cmp dword [rsp + 0x20], ebp
jle 0x1400384fa
lea r14, [rax + 8]
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [r14]
lea rcx, [rsp + 0x40]
call fcn.140038550
nop
cmp rbx, r15
je 0x140038496
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
add rbx, 0x20
mov qword [rsp + 0x30], rbx
jmp 0x1400384b0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140037f20
mov r15, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jb 0x1400384ea
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400384e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003853c
call fcn.14026f798
inc ebp
add r14, 8
cmp ebp, dword [rsp + 0x20]
jl 0x140038450
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x28]
mov qword [rsi], rax
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov rax, rsi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14026fc70
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
call qword [0x1402da078]
nop
int3

Function at 0x140041330
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp eax, 0xffffffff
jne 0x1400413bf
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [0x1403c20f8]
lea rsi, [0x1403c20f0]
mov ebx, eax
mov dword [rsp + 0x24], 0
movabs rax, 0x4d54ee85da812030
add rdx, rax
cmp rdx, 1
jbe 0x140041392
mov rcx, qword [0x1403c20f0]
mov edx, ebx
mov r8, qword [rcx + 0x30]
mov rcx, rsi
call r8
jmp 0x140041397
test ebx, ebx
setne al
movzx eax, al
add rax, 2
mov qword [rsp + 0x28], rsi
mov rsi, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], ebx
test al, 1
je 0x1400413bf
cmp rax, 1
jne 0x1400413cc
test ebx, ebx
jne 0x1400413cc
mov rbx, qword [rsp + 0x58]
mov eax, edi
add rsp, 0x40
pop rdi
ret
lea rdx, [0x1402dbf70]
lea rcx, [rsp + 0x20]
call fcn.14003fed0
int3
Function at 0x14004e6a0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
xor edi, edi
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 7
mov word [rcx], di
mov qword [rcx + 0x20], rdi
mov qword [rcx + 0x30], rdi
mov qword [rcx + 0x38], 7
mov word [rcx + 0x20], di
mov dword [rsp + 0x48], 0x101
mov ecx, 0x202
call fcn.14026fe6c
mov rbx, rax
test rax, rax
je 0x14004e709
xor edx, edx
mov r8d, 0x202
mov rcx, rax
call fcn.1402b61f1
jmp 0x14004e70c
mov rbx, rdi
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rdx, str..pipe_
lea rcx, [rsi + 0x20]
call fcn.14004e900
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x14004e740
mov rdx, rbx
lea rcx, [rsi + 0x20]
call fcn.140042df0
mov r8d, 0x1d
lea rdx, str._Tencent.WXWork.IPC_WXFlutter
lea rcx, [rsi + 0x20]
call fcn.140042df0
lea rdx, str..pipe_
mov rcx, rsi
call fcn.14004e900
nop dword [rax]
inc rdi
cmp word [rbx + rdi*2], 0
jne 0x14004e780
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.140042df0
mov r8d, 0x1d
lea rdx, str._Tencent.WXFlutter.IPC_WXWork
mov rcx, rsi
call fcn.140042df0
nop
test rbx, rbx
je 0x14004e7bc
mov rcx, rbx
call fcn.14026fe74
nop
mov rax, rsi
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x1400579b0
Capabilities:
Connect pipe
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdx, [rcx + 0x30]
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x1400579ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x1400579ec
cmp eax, 0x3e5
jne 0x1400579f9
mov dword [rbx + 0x58], 1
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140057a00
add rsp, 0x20
pop rbx
ret

Function at 0x140057a00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, 1
mov rbx, rcx
xchg byte [rcx + 0x50], al
cmp byte [0x1403f15d8], 0
mov rsi, qword [rcx + 0x20]
jne 0x140057a5a
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.GetNamedPipeClientProcessId
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x28], 1
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [0x1403f15d0], xmm0
mov rax, qword [0x1403f15d0]
xor edi, edi
test rax, rax
je 0x140057a81
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], edi
mov rcx, rsi
call rax
mov ecx, dword [rsp + 0x40]
test eax, eax
cmove ecx, edi
mov edi, ecx
mov rcx, qword [rbx + 0x1098]
mov dword [rbx + 0x54], edi
test rcx, rcx
je 0x140057a9f
mov dword [rsp + 0x40], edi
lea rdx, [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rbx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.1400581c0
Function at 0x1400581c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
lea rdi, [rcx + 0x30]
mov rbx, rcx
lea r9, [rcx + 0x105c]
mov qword [rsp + 0x20], rdi
lea rdx, [rcx + 0x5c]
mov r8d, 0x1000
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140058230
nop
mov rcx, rbx
call fcn.140057b30
mov rcx, qword [rbx + 0x20]
test al, al
je 0x14005824a
lea r9, [rbx + 0x105c]
mov qword [rsp + 0x20], rdi
mov r8d, 0x1000
lea rdx, [rbx + 0x5c]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140058200
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140058246
mov dword [rbx + 0x58], 2
jmp 0x140058276
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor eax, eax
xchg byte [rbx + 0x50], al
mov rcx, qword [rbx + 0x10d8]
mov dword [rbx + 0x58], 0
test rcx, rcx
je 0x14005826e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rbx
call fcn.1400579b0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400582d0
Capabilities:
Connect pipe
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x58]
mov rbx, rcx
cmp eax, 1
jne 0x140058315
lea rdx, [rcx + 0x30]
mov dword [rsp + 0x30], 0
mov rcx, qword [rcx + 0x20]
lea r8, [rsp + 0x30]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x1400583b5
mov rcx, rbx
call fcn.140057a00
add rsp, 0x20
pop rbx
ret
cmp eax, 2
jne 0x1400583e1
lea rdx, [rcx + 0x30]
mov qword [rsp + 0x38], rsi
mov rcx, qword [rcx + 0x20]
lea r8, [rsp + 0x30]
xor r9d, r9d
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x14005835b
mov eax, dword [rsp + 0x30]
mov rcx, rbx
mov dword [rbx + 0x105c], eax
call fcn.140057b30
test al, al
jne 0x1400583ce
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor eax, eax
xchg byte [rbx + 0x50], al
mov rcx, qword [rbx + 0x10d8]
mov dword [rbx + 0x58], 0
test rcx, rcx
je 0x140058383
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 0x20]
lea rdx, [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x1400583bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x1400583bb
cmp eax, 0x3e5
jne 0x1400583b0
mov dword [rbx + 0x58], 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
call fcn.140057a00
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
call fcn.1400581c0
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
movzx eax, byte [rcx + 0x50]
nop
test al, al
jne 0x1400583b5
add rsp, 0x20
pop rbx
jmp fcn.1400579b0