joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c9690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x20], 0
call fcn.140011370
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400c985e
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x38], 0x53
mov eax, 1
imul rax, rax, 0x14
mov byte [rsp + rax + 0x38], WSAStartup
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x38], 0x53
mov eax, 1
imul rax, rax, 0x17
mov byte [rsp + rax + 0x38], 0x79
mov eax, 1
imul rax, rax, 0x15
mov byte [rsp + rax + 0x38], 0x69
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x38], 0x69
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x38], 0x62
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x38], 0x4f
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x38], 0x63
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x38], 0x6a
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x38], 0x63
mov eax, 1
imul rax, rax, 0x18
mov byte [rsp + rax + 0x38], 0
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 0x16
mov byte [rsp + rax + 0x38], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x38], WSAStartup
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x38], 0x76
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x38], 0x53
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x38], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x38], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 0x13
mov byte [rsp + rax + 0x38], 0x75
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x38], 0x63
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400c9854
mov r8, qword [rsp + 0x80]
mov edx, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call fcn.140012520
mov eax, dword [rsp + 0x20]
add rsp, 0x68
ret
Function at 0x1400c9870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x20], 0
call fcn.140011370
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400c9a53
mov eax, 1
imul rax, rax, 0x16
mov byte [rsp + rax + 0x38], 0x63
mov eax, 1
imul rax, rax, 0x17
mov byte [rsp + rax + 0x38], 0x68
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x38], 0x53
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x38], 0x76
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x38], 0x63
mov eax, 1
imul rax, rax, 0x14
mov byte [rsp + rax + 0x38], 0x61
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x38], 0x69
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x38], WSASetLastError
mov eax, 1
imul rax, rax, 0x15
mov byte [rsp + rax + 0x38], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 0x18
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x38], WSAStartup
mov eax, 1
imul rax, rax, 0x19
mov byte [rsp + rax + 0x38], WSAStartup
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x38], 0x44
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x38], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x38], 0x53
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x38], reloc.WS2_32.dll_WSAStartup
mov eax, 1
imul rax, rax, 0x1a
mov byte [rsp + rax + 0x38], 0x41
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x38], 0x69
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x38], WSAStartup
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x38], 0x61
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x38], 0x43
mov eax, 1
imul rax, rax, 0x1b
mov byte [rsp + rax + 0x38], 0
mov eax, 1
imul rax, rax, 0x13
mov byte [rsp + rax + 0x38], reloc.WS2_32.dll_WSASetLastError
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x38], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x38], WSAStartup
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x38], reloc.WS2_32.dll_WSACleanup
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400c9a49
mov rcx, qword [rsp + 0x70]
call qword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call fcn.140012520
mov eax, dword [rsp + 0x20]
add rsp, 0x68
ret
Function at 0x1400c9b50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x20], send
call fcn.140011460
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400c9c79
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x38], 0
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x38], 0x53
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x38], 0x67
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x38], 0x55
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x38], 0x69
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x38], 0x64
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x38], 0x41
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x38], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x38], 0x75
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x38], WSAStartup
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x38], 0x69
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x38], 0x54
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x38], WSASetLastError
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x38], reloc.WS2_32.dll_WSAGetLastError
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400c9c6f
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call fcn.140012520
mov eax, dword [rsp + 0x20]
add rsp, 0x58
ret
Function at 0x1400c9c90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x20], 0
call fcn.1400c6250
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400c9ddb
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x38], 0x41
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x38], 0x61
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x38], 0
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x38], 0x56
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x38], WSAStartup
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x38], 0x75
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x38], 0x79
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x38], 0x75
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x38], WSAStartup
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x38], 0x56
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x38], WSASetLastError
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x38], 0x51
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400c9dd1
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call fcn.140012520
mov eax, dword [rsp + 0x20]
add rsp, 0x58
ret
Function at 0x1400c9df0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x30], WSAStartup
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x30], 0x56
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x30], WSASetLastError
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x30], WSASetLastError
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x30], 0x41
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x30], 0x63
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x30], 0x75
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x30], 0x61
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x30], 0x69
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x30], WSASetLastError
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x30], 0
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x30], reloc.WS2_32.dll_WSACleanup
call fcn.1400c61b0
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400c9f04
mov r9d, dword [rsp + 0x68]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret
Function at 0x1400ca1a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov dword [rsp + 0x20], 0
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x38], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x38], 0x33
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x38], 0x2e
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x38], 0x57
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x38], WSASetLastError
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x38], 0x69
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x38], 0
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x38], 0x32
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x38], WSASetLastError
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x38], reloc.WS2_32.dll_WSAStartup
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x38], 0x64
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x38], reloc.WS2_32.dll_WSASetLastError
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x38], 0x61
lea rcx, [rsp + 0x38]
call fcn.1400c7e60
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400ca3ba
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x48], 0x51
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x48], 0x55
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x48], 0x53
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x48], reloc.WS2_32.dll_WSAStartup
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x48], 0x65
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x48], 0x79
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x48], reloc.WS2_32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x48], WSAStartup
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x48], 0
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x48], WSASetLastError
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x48], 0x54
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x48], WSAStartup
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x48], 0x54
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x48], 0x65
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x48], 0x57
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x48], 0x75
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x48], WSAGetLastError
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x48], 0x65
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400ca3b0
mov rdx, qword [rsp + 0x78]
mov ecx, dword [rsp + 0x70]
call qword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call fcn.140012520
mov eax, dword [rsp + 0x20]
add rsp, 0x68
ret
Function at 0x1400ca3d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x30], 0
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x40], 0x46
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x40], 0x69
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x40], 0x65
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x40], 0x65
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x40], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x40], 0x57
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x40], 0x69
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x40], WSASetLastError
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x40], WSAStartup
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x40], 0
call fcn.1400c61b0
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1400ca4c5
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x78]
mov r8d, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0x38]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
add rsp, 0x58
ret

Function at 0x1400034a0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400034ea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400034ea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400034ea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400034ea
cmp dword [rcx + 0x84], 0xe
jbe 0x1400034ea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400034ec
xor al, al
add rsp, 0x28
ret
Function at 0x1400144c0
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x1400144f5
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x1400144d0
and r10, 0xf
je 0x140014525
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x140014500
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x140014519
mov rax, r8
repz ret

Function at 0x140014530
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x14001456d
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x140014540
pxor xmm1, xmm1
and r10, 0xf
je 0x1400145a3
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x14001457b
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x140014597
mov rax, r8
repz ret
Function at 0x14004a560
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14004a580
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret

Function at 0x14004a5c0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14004a5e0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret

Function at 0x14004a620
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14004a643
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x14004a690
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14004a6b3
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret

Function at 0x14004a700
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14004a729
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret
Function at 0x14004a790
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14004a7b9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
repz ret

Function at 0x14004a820
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14004a87f

Function at 0x14004a870
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.14004a870
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
repz ret

Function at 0x14004a900
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14004a95f
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14004a950
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
repz ret
Function at 0x14004a9e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesenc xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14004aa3a

Function at 0x14004aa5a
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14004aa30
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
repz ret

Function at 0x14004aaf0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesdec xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14004ab4a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14004ab40
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
aesdeclast xmm8, xmm0
aesdeclast xmm9, xmm0
repz ret