joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400718a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x140159cc0]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rax, [rcx + 0x3c]
mov rbx, rcx
lea rcx, [rbp - 0x39]
mov edi, select
cmp rcx, rax
ja 0x140071903
xor r9d, r9d
lea rax, [rbp + 3]
cmp rax, rbx
jb 0x140071903
mov r8d, edi
lea rcx, [rbp - 0x39]
sub r8, r9
lea rcx, [rcx + r9*4]
shl r8, 2
lea rdx, [rbx + r9*4]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140071922
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movaps xmmword [rbp - 0x39], xmm0
movups xmm0, xmmword [rbx + 0x20]
movaps xmmword [rbp - 0x29], xmm1
movups xmm1, xmmword [rbx + 0x30]
movaps xmmword [rbp - 0x19], xmm0
movaps xmmword [rbp - 9], xmm1
xor r8d, r8d
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x39]
call fcn.140071a14
mov r8d, 1
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x79]
call fcn.140071a14
mov r8d, 2
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 7]
call fcn.140071a14
mov r8d, 3
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x79]
call fcn.140071a14
mov r8d, 4
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 7]
call fcn.140071a14
mov r8d, 5
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x79]
call fcn.140071a14
mov r8d, 6
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 7]
call fcn.140071a14
mov r8d, 7
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x79]
call fcn.140071a14
mov r8d, 8
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 7]
call fcn.140071a14
mov r8d, 9
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x79]
call fcn.140071a14
lea rcx, [rbp - 0x39]
sub rcx, rbx
mov eax, dword [rbx + rcx]
xor dword [rbx], eax
lea rbx, [rbx + 4]
sub rdi, 1
jne 0x1400719e4
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14011ae70
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x140073ec8
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
lea rbx, [rcx + 0x20]
mov r8d, 8
mov rdx, rbx
mov rax, qword [rdx + 0x80]
xor qword [rdx], rax
lea rdx, [rdx + 8]
sub r8, 1
jne 0x140073edb
call fcn.140073108
lea rcx, [rbx + 0x40]
mov edx, 8
mov rax, qword [rcx + 0x40]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x140073efd
add rsp, 0x20
pop rbx
ret
Function at 0x140075c90
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm0, xmmword [rcx]
mov rax, qword [rsp + 0x28]
movdqa xmm2, xmm0
movdqu xmmword [rdx], xmm0
pslldq xmm2, 4
movdqa xmm1, xmm2
movdqu xmmword [r8], xmm3
xorps xmm1, xmm0
pslldq xmm2, 4
movdqa xmm4, xmm2
pslldq xmm2, 4
xorps xmm4, xmm1
xorps xmm4, xmm2
aeskeygenassist xmm0, xmm3, 1
pshufd xmm1, xmm0, 0xff
xorps xmm4, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [r9], xmm4
pslldq xmm1, 4
xorps xmm0, xmm3
movdqa xmm2, xmm1
pslldq xmm1, 4
xorps xmm2, xmm0
xorps xmm2, xmm1
aeskeygenassist xmm0, xmm4, 0
pshufd xmm1, xmm0, 0xaa
xorps xmm2, xmm1
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rax], xmm2
mov rax, qword [rsp + 0x30]
xorps xmm0, xmm4
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm0
xorps xmm3, xmm1
aeskeygenassist xmm0, xmm2, 2
pshufd xmm1, xmm0, 0xff
xorps xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rax], xmm3
mov rax, qword [rsp + 0x38]
xorps xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
xorps xmm2, xmm0
xorps xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
xorps xmm2, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rax], xmm2
xorps xmm0, xmm3
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm0
xorps xmm3, xmm1
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
xorps xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
xorps xmm0, xmm2
movdqa xmm2, xmm1
xorps xmm2, xmm0
pslldq xmm1, 4
xorps xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
mov rax, qword [rsp + 0x40]
pshufd xmm1, xmm0, 0xaa
xorps xmm2, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqu xmmword [rax], xmm3
movdqa xmm0, xmm1
mov rax, qword [rsp + 0x48]
xorps xmm0, xmm3
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm0
movdqu xmmword [rax], xmm2
xorps xmm3, xmm1
mov rax, qword [rsp + 0x50]
aeskeygenassist xmm0, xmm2, 8
pshufd xmm1, xmm0, 0xff
xorps xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rax], xmm3
mov rax, qword [rsp + 0x58]
xorps xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
xorps xmm2, xmm0
xorps xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
xorps xmm2, xmm1
movdqu xmmword [rax], xmm2
ret
Function at 0x1400b9cd0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
pshufd xmm0, xmmword [rdx], 0x55
lea r10, [0x140138990]
mov rbp, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov r14, rdx
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
movzx esi, byte [r8 + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or esi, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl esi, 8
movzx eax, byte [rcx + r10]
or esi, eax
movzx eax, r9b
shl esi, 8
movzx ecx, byte [rax + r10]
or esi, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r10]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r10]
or edi, ecx
mov ecx, edi
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
mov ebx, eax
mov edx, 8
mov ecx, esi
xor ebx, 1
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
movd xmm1, ebx
lea rcx, [rsp + 0x20]
xor eax, 1
movd xmm2, edi
punpckldq xmm2, xmm1
movd xmm3, esi
movd xmm0, eax
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
movdqu xmm2, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm0, xmm2
pshufd xmm4, xmm3, 0xff
xorps xmm0, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm4
movdqu xmmword [rbp], xmm1
movdqa xmmword [rsp + 0x20], xmm1
call fcn.1400ba2f0
movdqu xmm2, xmmword [r14]
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movdqa xmm0, xmm2
xorps xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm3
movdqu xmmword [r14], xmm1
add rsp, 0x30
pop r14
ret
Function at 0x1400b9e58
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
pshufd xmm0, xmmword [rdx], 0x55
lea r10, [0x140138990]
mov rbp, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov r14, rdx
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
movzx esi, byte [r8 + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or esi, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl esi, 8
movzx eax, byte [rcx + r10]
or esi, eax
movzx eax, r9b
shl esi, 8
movzx ecx, byte [rax + r10]
or esi, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r10]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r10]
or edi, ecx
mov ecx, edi
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
mov ebx, eax
mov edx, 8
mov ecx, esi
xor ebx, 2
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
movd xmm1, ebx
lea rcx, [rsp + 0x20]
xor eax, 2
movd xmm2, edi
punpckldq xmm2, xmm1
movd xmm3, esi
movd xmm0, eax
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
movdqu xmm2, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm0, xmm2
pshufd xmm4, xmm3, 0xff
xorps xmm0, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm4
movdqu xmmword [rbp], xmm1
movdqa xmmword [rsp + 0x20], xmm1
call fcn.1400ba2f0
movdqu xmm2, xmmword [r14]
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movdqa xmm0, xmm2
xorps xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm3
movdqu xmmword [r14], xmm1
add rsp, 0x30
pop r14
ret
Function at 0x1400b9fe0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
pshufd xmm0, xmmword [rdx], 0x55
lea r10, [0x140138990]
mov rbp, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov r14, rdx
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
movzx esi, byte [r8 + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or esi, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl esi, 8
movzx eax, byte [rcx + r10]
or esi, eax
movzx eax, r9b
shl esi, 8
movzx ecx, byte [rax + r10]
or esi, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r10]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r10]
or edi, ecx
mov ecx, edi
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
mov ebx, eax
mov edx, 8
mov ecx, esi
xor ebx, 4
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
movd xmm1, ebx
lea rcx, [rsp + 0x20]
xor eax, 4
movd xmm2, edi
punpckldq xmm2, xmm1
movd xmm3, esi
movd xmm0, eax
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
movdqu xmm2, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm0, xmm2
pshufd xmm4, xmm3, 0xff
xorps xmm0, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm4
movdqu xmmword [rbp], xmm1
movdqa xmmword [rsp + 0x20], xmm1
call fcn.1400ba2f0
movdqu xmm2, xmmword [r14]
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movdqa xmm0, xmm2
xorps xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm3
movdqu xmmword [r14], xmm1
add rsp, 0x30
pop r14
ret
Function at 0x1400ba168
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
pshufd xmm0, xmmword [rdx], 0x55
lea r10, [0x140138990]
mov rbp, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov r14, rdx
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
movzx esi, byte [r8 + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or esi, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl esi, 8
movzx eax, byte [rcx + r10]
or esi, eax
movzx eax, r9b
shl esi, 8
movzx ecx, byte [rax + r10]
or esi, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r10]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r10]
or edi, ecx
mov ecx, edi
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
mov ebx, eax
mov edx, 8
mov ecx, esi
xor ebx, 8
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
movd xmm1, ebx
lea rcx, [rsp + 0x20]
xor eax, 8
movd xmm2, edi
punpckldq xmm2, xmm1
movd xmm3, esi
movd xmm0, eax
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
movdqu xmm2, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm0, xmm2
pshufd xmm4, xmm3, 0xff
xorps xmm0, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm4
movdqu xmmword [rbp], xmm1
movdqa xmmword [rsp + 0x20], xmm1
call fcn.1400ba2f0
movdqu xmm2, xmmword [r14]
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movdqa xmm0, xmm2
xorps xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm3
movdqu xmmword [r14], xmm1
add rsp, 0x30
pop r14
ret
Function at 0x1400ba2f0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
pshufd xmm0, xmmword [rcx], 0x55
lea r9, [0x140138990]
movd eax, xmm0
pshufd xmm0, xmmword [rcx], 0xff
mov r8d, eax
shr rax, 0x10
movzx edx, al
mov eax, r8d
shr rax, 0x18
movzx esi, byte [rdx + r9]
movzx eax, byte [rax + r9]
shl eax, 8
or esi, eax
mov eax, r8d
shr rax, 8
movzx edx, al
shl esi, 8
movzx eax, byte [rdx + r9]
or esi, eax
movzx eax, r8b
shl esi, 8
movzx edx, byte [rax + r9]
movd eax, xmm0
or esi, edx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r9]
movzx eax, byte [rax + r9]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r9]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r9]
or edi, ecx
mov ecx, edi
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
mov edx, 8
mov ecx, esi
mov ebx, eax
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
movd xmm2, ebx
mov rbx, qword [rsp + 0x30]
movd xmm0, esi
mov rsi, qword [rsp + 0x38]
movd xmm1, eax
movd xmm3, edi
punpckldq xmm0, xmm1
punpckldq xmm3, xmm2
punpcklqdq xmm0, xmm3
add rsp, 0x20
pop rdi
ret
Function at 0x1400c0154
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm4, xmmword [rcx + 0x10]
movdqu xmm3, xmmword [rcx]
vbroadcastf128 ymm1, xmmword [rcx]
vmovdqu ymmword [rdx], ymm1
mov rax, qword [rsp + 0x28]
vmovdqa xmm1, xmm3
vpslldq xmm1, xmm1, 4
vinsertf128 ymm0, ymm4, xmm4, 1
vmovdqu ymmword [r8], ymm0
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm3
vmovdqa xmm3, xmm1
vxorps xmm3, xmm3, xmm0
vpslldq xmm1, xmm1, 4
vxorps xmm3, xmm3, xmm1
vaeskeygenassist xmm0, xmm4, 1
vpshufd xmm1, xmm0, 0xff
vxorps xmm3, xmm3, xmm1
vmovdqa xmm1, xmm4
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm4
vmovdqa xmm4, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm4, xmm4, xmm0
vxorps xmm4, xmm4, xmm1
vaeskeygenassist xmm0, xmm3, 0
vpshufd xmm1, xmm0, 0xaa
vxorps xmm4, xmm4, xmm1
vinsertf128 ymm1, ymm3, xmm3, 1
vmovdqu ymmword [r9], ymm1
vmovdqa xmm1, xmm3
vpslldq xmm1, xmm1, 4
vinsertf128 ymm0, ymm4, xmm4, 1
vmovdqu ymmword [rax], ymm0
mov rax, qword [rsp + 0x30]
vmovdqa xmm0, xmm1
vxorps xmm0, xmm0, xmm3
vpslldq xmm1, xmm1, 4
vmovdqa xmm3, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm3, xmm3, xmm0
vxorps xmm3, xmm3, xmm1
vaeskeygenassist xmm0, xmm4, 2
vpshufd xmm1, xmm0, 0xff
vxorps xmm3, xmm3, xmm1
vmovdqa xmm1, xmm4
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm4
vmovdqa xmm4, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm4, xmm4, xmm0
vxorps xmm4, xmm4, xmm1
vaeskeygenassist xmm0, xmm3, 0
vpshufd xmm1, xmm0, 0xaa
vxorps xmm4, xmm4, xmm1
vinsertf128 ymm1, ymm3, xmm3, 1
vmovdqu ymmword [rax], ymm1
mov rax, qword [rsp + 0x38]
vmovdqa xmm1, xmm3
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm3
vmovdqa xmm3, xmm1
vxorps xmm3, xmm3, xmm0
vpslldq xmm1, xmm1, 4
vxorps xmm3, xmm3, xmm1
vaeskeygenassist xmm0, xmm4, 4
vpshufd xmm1, xmm0, 0xff
vxorps xmm3, xmm3, xmm1
vmovdqa xmm1, xmm4
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vinsertf128 ymm2, ymm4, xmm4, 1
vxorps xmm0, xmm0, xmm4
vmovdqu ymmword [rax], ymm2
mov rax, qword [rsp + 0x40]
vpslldq xmm1, xmm1, 4
vmovdqa xmm4, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm4, xmm4, xmm0
vxorps xmm4, xmm4, xmm1
vaeskeygenassist xmm0, xmm3, 0
vpshufd xmm1, xmm0, 0xaa
vxorps xmm4, xmm4, xmm1
vinsertf128 ymm1, ymm3, xmm3, 1
vmovdqu ymmword [rax], ymm1
mov rax, qword [rsp + 0x48]
vmovdqa xmm1, xmm3
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm3
vmovdqa xmm3, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm3, xmm3, xmm0
vxorps xmm3, xmm3, xmm1
vinsertf128 ymm2, ymm4, xmm4, 1
vmovdqu ymmword [rax], ymm2
mov rax, qword [rsp + 0x50]
vaeskeygenassist xmm0, xmm4, 8
vpshufd xmm1, xmm0, 0xff
vxorps xmm3, xmm3, xmm1
vmovdqa xmm1, xmm4
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vmovdqa xmm2, xmm1
vxorps xmm0, xmm0, xmm4
vxorps xmm2, xmm2, xmm0
vpslldq xmm1, xmm1, 4
vxorps xmm2, xmm2, xmm1
vaeskeygenassist xmm0, xmm3, 0
vpshufd xmm1, xmm0, 0xaa
vxorps xmm2, xmm2, xmm1
vinsertf128 ymm1, ymm3, xmm3, 1
vmovdqu ymmword [rax], ymm1
mov rax, qword [rsp + 0x58]
vinsertf128 ymm2, ymm2, xmm2, 1
vmovdqu ymmword [rax], ymm2
vzeroupper
ret
Function at 0x1400c21c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rdi, rdx
mov r12, rcx
mov r14, rdx
sub r14, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, qword [rcx]
sar rax, 4
movabs rsi, 0xfffffffffffffff
cmp rax, rsi
je 0x1400c23d7
lea r8, [rax + 1]
mov qword [rsp + 0x38], r8
mov rcx, qword [rcx + 0x10]
sub rcx, qword [r12]
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, rsi
sub rax, rdx
cmp rcx, rax
jbe 0x1400c223a
mov qword [rsp + 0x98], rsi
mov rcx, 0xfffffffffffffff0
jmp 0x1400c226c
lea rax, [rdx + rcx]
mov r15, r8
cmp rax, r8
cmovae r15, rax
cmp r15, rsi
ja 0x1400c23dd
mov rcx, r15
shl rcx, 4
mov rsi, r15
mov qword [rsp + 0x98], r15
cmp rcx, 0x1000
jb 0x1400c227b
call fcn.1400021e0
mov rbx, rax
mov qword [rsp + 0x30], rax
jmp 0x1400c229e
test rcx, rcx
je 0x1400c228f
call fcn.14011ace8
mov rbx, rax
mov qword [rsp + 0x30], rax
jmp 0x1400c2296
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x98], r15
and r14, 0xfffffffffffffff0
lea r13, [r14 + rbx]
lea rax, [r13 + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0xa8], rax
mov ecx, 0x30
call fcn.14011ace8
test rax, rax
je 0x1400c22e4
mov rcx, qword [rsp + 0xa0]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
mov qword [rsp + 0x48], rax
lea r15, [r13 + 8]
mov qword [rsp + 0x28], r15
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400c23e4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [r13], rax
test rax, rax
je 0x1400c23c8
mov qword [rsp + 0xa8], r13
mov rcx, qword [r12 + 8]
mov rax, qword [r12]
cmp rdi, rcx
jne 0x1400c2350
mov rdx, rbx
jmp 0x1400c2349
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movdqu xmmword [rax], xmm0
movdqu xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rcx
jne 0x1400c2333
jmp 0x1400c23a2
mov rcx, rbx
jmp 0x1400c236b
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movdqu xmmword [rax], xmm0
movdqu xmmword [rcx], xmm1
lea rcx, [rcx + 0x10]
add rax, 0x10
cmp rax, rdi
jne 0x1400c2355
mov qword [rsp + 0xa8], rbx
mov rax, qword [r12 + 8]
cmp rdi, rax
je 0x1400c23a2
sub r14, rdi
add r14, rbx
xorps xmm0, xmm0
movups xmm1, xmmword [rdi]
movdqu xmmword [rdi], xmm0
movdqu xmmword [r14 + rdi + 0x10], xmm1
add rdi, 0x10
cmp rdi, rax
jne 0x1400c2388
mov r9, rsi
mov r8, qword [rsp + 0x38]
mov rdx, rbx
mov rcx, r12
call fcn.1400cda94
mov rax, r13
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
and dword [r15], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
call fcn.1400025ac
int3
call fcn.14000258c
int3
Function at 0x1400c513c
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rsp
sub rsp, 0x98
movdqu xmm2, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm4, xmmword [rcx + 0x20]
movdqu xmm5, xmmword [rcx + 0x30]
mov ecx, 2
movaps xmmword [rax - 0x18], xmm6
movdqa xmm6, xmmword [0x14015e0e0]
movaps xmmword [rax - 0x28], xmm7
movdqa xmm7, xmmword [0x14015e0f0]
movaps xmmword [rax - 0x38], xmm8
movdqa xmm8, xmmword [0x14015e100]
movaps xmmword [rax - 0x48], xmm9
movdqa xmm9, xmmword [0x14015e110]
movaps xmmword [rax - 0x58], xmm10
movdqa xmm10, xmmword [0x14015e120]
movaps xmmword [rax - 0x68], xmm11
movdqa xmm11, xmmword [0x14015e130]
movaps xmmword [rax - 0x78], xmm12
lea rax, [rdx + r8]
movdqa xmm12, xmmword [0x14015e140]
movaps xmmword [rsp + 0x10], xmm13
movdqa xmm13, xmmword [0x14015e150]
movaps xmmword [rsp], xmm14
aesdec xmm2, xmm6
aesenc xmm3, xmm6
aesdec xmm4, xmm10
aesenc xmm5, xmm10
aesdec xmm2, xmm7
aesenc xmm3, xmm7
aesdec xmm4, xmm11
aesenc xmm5, xmm11
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm4, xmm12
aesenc xmm5, xmm12
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm4, xmm13
aesenc xmm5, xmm13
movdqu xmmword [r8], xmm2
movdqu xmmword [r8 + 0x10], xmm3
movdqu xmmword [r8 + 0x20], xmm4
movdqu xmmword [r8 + 0x30], xmm5
add r8, 0x40
sub rcx, 1
jne 0x1400c51d4
movdqa xmm14, xmmword [0x140138fe0]
jmp 0x1400c52f6
aesdec xmm2, xmm6
aesenc xmm3, xmm6
aesdec xmm4, xmm10
aesenc xmm5, xmm10
aesdec xmm2, xmm7
aesenc xmm3, xmm7
aesdec xmm4, xmm11
aesenc xmm5, xmm11
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm2, xmm9
movdqa xmm0, xmm14
movdqa xmm1, xmm14
andps xmm0, xmm2
movdqu xmmword [r8], xmm0
movdqa xmm0, xmm14
aesenc xmm3, xmm9
andps xmm1, xmm3
movdqu xmmword [r8 + 0x10], xmm1
movdqa xmm1, xmm14
aesdec xmm4, xmm12
aesenc xmm5, xmm12
aesdec xmm4, xmm13
aesenc xmm5, xmm13
andps xmm0, xmm4
andps xmm1, xmm5
movdqu xmmword [r8 + 0x20], xmm0
movdqu xmmword [r8 + 0x30], xmm1
add r8, 0x40
cmp r8, rax
jb 0x1400c525f
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x98]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm8, xmmword [r11 - 0x38]
movaps xmm9, xmmword [r11 - 0x48]
movaps xmm10, xmmword [r11 - 0x58]
movaps xmm11, xmmword [r11 - 0x68]
movaps xmm12, xmmword [r11 - 0x78]
movaps xmm13, xmmword [rsp + 0x10]
movaps xmm14, xmmword [rsp]
mov rsp, r11
ret
mov eax, dword [0x14015e05c]
lea r8, [rcx + 0x40]
mov r9, rdx
mov rcx, r9
lea edx, [rax*8 + 0x80]
jmp 0x1400c513c