joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e990
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x140070040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0xa0]
mov r11, r9
mov rax, qword [rcx + 8]
mov r10, r8
mov rsi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x98], 0
je 0x14000e9e0
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call fcn.14000b840
jmp 0x14000ea78
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x14000ea00
mov rcx, qword [rsi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rdi
call fcn.14000b840
jmp 0x14000ea78
xor eax, eax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov r8d, r11d
mov eax, dword [rsp + 0x90]
mov rdx, r10
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
mov rbx, qword [rsp + 0x50]
je 0x14000ea6c
cmp eax, 0x3e5
je 0x14000ea6c
mov r9d, dword [rsp + 0x40]
mov r8d, eax
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.14000b840
jmp 0x14000ea78
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.14000b7b0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140052030
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x14000ea90
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
sub rsp, 0x58
mov rax, qword [0x140070040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, qword [rsp + 0xa0]
mov r11, r9
mov rax, qword [rcx + 8]
mov r10, r8
mov rdi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x98], 0
je 0x14000eae0
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call fcn.14000b840
jmp 0x14000eb91
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x14000eb03
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rbx
call fcn.14000b840
jmp 0x14000eb91
mov eax, dword [rsp + 0x90]
lea r9, [rsp + 0x40]
xor edx, edx
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x44]
mov dword [rsp + 0x40], edx
mov r8d, r11d
mov qword [rsp + 0x28], rbx
mov rdx, r10
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rsi
call qword [sym.imp.WS2_32.dll_WSARecv]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x14000eb52
mov eax, 0x2746
jmp 0x14000eb5f
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
mov rsi, qword [rsp + 0x50]
je 0x14000eb85
cmp eax, 0x3e5
je 0x14000eb85
mov r9d, dword [rsp + 0x40]
mov r8d, eax
mov rcx, qword [rdi + 8]
mov rdx, rbx
call fcn.14000b840
jmp 0x14000eb91
mov rcx, qword [rdi + 8]
mov rdx, rbx
call fcn.14000b7b0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140052030
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x1400136e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140070040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x40], edi
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], dil
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftCryptography
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140013817
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MachineGuid
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001380c
mov ecx, dword [rsp + 0x40]
call fcn.1400527e0
mov rsi, rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MachineGuid
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140013804
mov edi, dword [rsp + 0x40]
mov rax, qword [rbx + 0x18]
cmp rdi, rax
ja 0x1400137f6
mov r14, rbx
cmp rax, 0xf
jbe 0x1400137dd
mov r14, qword [rbx]
mov qword [rbx + 0x10], rdi
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rdi], 0
jmp 0x140013804
mov r9, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.140024a20
mov rcx, rsi
call fcn.140052050
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140052030
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140019620
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x200
mov rax, qword [0x140070040]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x1400757a0], eax
inc eax
cmp eax, 1
jne 0x14001966d
lea ecx, [rax + 1]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x1400757a4], eax
test bl, bl
je 0x140019711
xor ebx, ebx
lock xadd dword [0x1400757a4], ebx
test ebx, ebx
je 0x140019711
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x210], rsi
add rcx, qword [0x1400700d8]
lea rsi, [0x1400700d0]
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x1400196c6
mov rax, qword [0x1400700d0]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x1400196c8
mov al, 1
lea rcx, str.C:Users_boranDesktop_boost_1_83_0_boost_asiodetailimplwinsock_init.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.throw_on_error
mov rsi, qword [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x48
mov dword [rsp + 0x34], 0x1a
test al, 1
jne 0x140019735
mov rax, rdi
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.140052030
mov rbx, qword [rsp + 0x218]
add rsp, 0x200
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.140008c60
int3
Function at 0x140039c10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
mov rax, qword [0x140070040]
xor rax, rsp
mov qword [rsp + 8], rax
cmp qword [r8 + 0x18], 0xf
mov r10, r8
mov dword [rsp], r9d
jbe 0x140039c34
mov r10, qword [r8]
cmp qword [rdx + 0x18], 0xf
mov rax, qword [rdx + 0x10]
jbe 0x140039c47
add rax, qword [rdx]
mov rdx, qword [rdx]
jmp 0x140039c4a
add rax, rdx
xor r8d, r8d
cmp rdx, rax
je 0x140039c7a
sub r10, rdx
nop word [rax + rax]
movzx ecx, byte [rsp + r8]
xor cl, byte [rdx]
inc r8
mov byte [r10 + rdx], cl
and r8d, 3
inc rdx
cmp rdx, rax
jne 0x140039c60
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.140052030
add rsp, 0x18
ret

Function at 0x140039c90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
cmp byte [rcx + 0x19], 0
mov r12, r9
mov rdi, r8
mov r10, rdx
mov rbp, rcx
jge 0x140039d00
mov rax, qword [rcx + 0x80]
xor ecx, ecx
mov rdx, qword [rax + 0x10]
mov dword [rsp + 0x20], edx
test r8, r8
je 0x140039cee
nop word [rax + rax]
mov rax, rcx
and eax, 3
movzx eax, byte [rsp + rax + 0x20]
xor byte [r10 + rcx], al
inc rcx
cmp rcx, rdi
jb 0x140039cd0
mov rax, qword [rbp + 0x80]
mov rcx, rdi
and ecx, 3
je 0x140039cfc
shl cl, 3
ror rdx, cl
mov qword [rax + 0x10], rdx
mov rax, qword [rbp + 0x80]
mov rdx, r10
mov rbx, qword [rax]
add rbx, 0x50
mov r15, qword [rbx + 0x10]
lea r14, [rbx + 0x10]
mov rcx, rbx
call fcn.14001a220
mov r10, qword [rbp + 0x80]
mov rax, qword [r10]
cmp dword [rax + 0x70], 1
jne 0x140039dba
cmp qword [rbx + 0x18], 0xf
jbe 0x140039d47
mov rdx, qword [rbx]
mov rbx, rdx
add rdx, qword [r14]
jmp 0x140039d4d
mov rdx, qword [r14]
add rdx, rbx
lea rax, [r15 + rbx]
cmp rax, rdx
je 0x140039dba
lea rbx, [0x140059cc0]
nop dword [rax]
cmp dword [r10 + 0x18], 0
movzx r8d, byte [rax]
mov r9d, r8d
movzx r11d, byte [r8 + rbx]
je 0x140039d83
mov ecx, dword [r10 + 0x1c]
and r9d, 0x3f
shl ecx, 6
or r9d, ecx
jmp 0x140039d92
mov r8d, 0xff
mov ecx, r11d
sar r8d, cl
and r9d, r8d
mov dword [r10 + 0x1c], r9d
mov ecx, dword [r10 + 0x18]
add ecx, 0x10
shl ecx, 4
add ecx, r11d
movzx r8d, byte [rcx + rbx]
mov dword [r10 + 0x18], r8d
cmp r8d, 1
je 0x140039dd0
inc rax
cmp rax, rdx
jne 0x140039d60
sub qword [rbp + 0x30], rdi
mov rax, rdi
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov dword [rsp + 0x28], select
call fcn.140011230
mov qword [rsp + 0x30], rax
xor eax, eax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [r12], xmm0
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400516f0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14005172a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14005172f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140051778
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x140051778
dec r8
sub rdx, 1
jne 0x14005175e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140051f30
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
lea r8, [rsp + 0x30]
mov edx, 4
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x140051f5a
mov eax, dword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
lea rdx, str.error_while_reading
mov rcx, rbx
call fcn.140051f70
int3

Function at 0x140052f44
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140052f8e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140052f8e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140052f8e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140052f8e
cmp dword [rcx + 0x84], 0xe
jbe 0x140052f8e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140052f90
xor al, al
add rsp, 0x28
ret
Function at 0x140001ce0
Capabilities:
Encode data using xor

Disassembly:
xor rax, rax
xor r10, r10
cmp r8, 0
je 0x140001d2d
cmp r8, 0x10
jne 0x140001d10
mov r10, qword [rcx]
mov r11, qword [rcx + 8]
mov r8d, 1
xor r10, qword [rdx]
xor r11, qword [rdx + 8]
or r10, r11
cmovne rax, r8
repz ret
mov r10b, byte [rcx]
lea rcx, [rcx + 1]
xor r10b, byte [rdx]
lea rdx, [rdx + 1]
or al, r10b
dec r8
jne 0x140001d10
neg rax
shr rax, 0x3f
repz ret

Function at 0x140002fa0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140002fc0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret

Function at 0x140003000
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140003020
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret

Function at 0x140003060
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140003083
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x1400030d0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400030f3
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret
Function at 0x140003140
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140003169
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret

Function at 0x1400031d0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400031f9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
repz ret

Function at 0x140003260
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400032bf

Function at 0x1400032b0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.1400032b0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
repz ret
Function at 0x140003340
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14000339f
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140003390
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
repz ret

Function at 0x140003420
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesenc xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14000347a

Function at 0x14000349a
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140003470
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
repz ret
Function at 0x140003530
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesdec xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14000358a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140003580
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
aesdeclast xmm8, xmm0
aesdeclast xmm9, xmm0
repz ret
Function at 0x140005d60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
movdqa xmm14, xmm10
pxor xmm10, xmm15
movdqu xmm15, xmmword [rbx + r14]
pxor xmm11, xmm10
pxor xmm8, xmm2
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm8, xmm3
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm8, xmm4
pxor xmm4, xmm12
pxor xmm14, xmm13
pxor xmm8, xmm5
pxor xmm5, xmm13
pxor xmm15, xmm14
pxor xmm8, xmm6
pxor xmm6, xmm14
pxor xmm8, xmm7
pxor xmm7, xmm15
movups xmm0, xmmword [r11 + 0x20]
lea r12, [r8 + 1]
lea r13, [r8 + 3]
lea r14, [r8 + 5]
add r8, 6
pxor xmm10, xmm9
bsf r12, r12
bsf r13, r13
bsf r14, r14
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
pxor xmm11, xmm9
pxor xmm12, xmm9
aesenc xmm6, xmm1
pxor xmm13, xmm9
pxor xmm14, xmm9
aesenc xmm7, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm15, xmm9
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [r11 + 0x40]
shl r12, 4
shl r13, 4
jmp 0x140005e80
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140005e80
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [r11 + 0x10]
shl r14, 4
aesenclast xmm2, xmm10
movdqu xmm10, xmmword [rbx]
mov rax, r10
aesenclast xmm3, xmm11
aesenclast xmm4, xmm12
aesenclast xmm5, xmm13
aesenclast xmm6, xmm14
aesenclast xmm7, xmm15
repz ret

Function at 0x140005f20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm8, xmm2
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm8, xmm3
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm8, xmm4
pxor xmm4, xmm12
pxor xmm8, xmm5
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x140005fc0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140005fc0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesenclast xmm2, xmm10
aesenclast xmm3, xmm11
aesenclast xmm4, xmm12
aesenclast xmm5, xmm13
repz ret