Function at 0x140038cc2
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm15
movaps xmmword [rsp + 0x2c0], xmm14
movaps xmmword [rsp + 0x2b0], xmm13
movaps xmmword [rsp + 0x2a0], xmm12
movaps xmmword [rsp + 0x290], xmm11
movaps xmmword [rsp + 0x280], xmm10
movaps xmmword [rsp + 0x270], xmm9
movaps xmmword [rsp + 0x260], xmm8
movaps xmmword [rsp + 0x250], xmm7
movaps xmmword [rsp + 0x240], xmm6
mov r13, qword [rdx]
mov rbp, qword [rdx + 8]
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x28], rax
mov rsi, qword [rdx + 0x18]
mov qword [rsp + 0xb8], rsi
shr rsi, 3
lea r14, [rsp + 0x230]
movaps xmm0, xmmword [rcx + 0x1d0]
movaps xmmword [rsp + 0x100], xmm0
movaps xmm0, xmmword [rcx + 0x1c0]
movaps xmmword [rsp + 0xf0], xmm0
movaps xmm0, xmmword [rcx + 0x1b0]
movaps xmmword [rsp + 0xe0], xmm0
movaps xmm0, xmmword [rcx + 0x1a0]
movaps xmmword [rsp + 0xd0], xmm0
movdqa xmm0, xmmword [rcx + 0x190]
movdqa xmmword [rsp + 0xc0], xmm0
movdqa xmm11, xmmword [rcx + 0x180]
movdqa xmm12, xmmword [rcx + 0x170]
movdqa xmm13, xmmword [rcx + 0x160]
movdqa xmm14, xmmword [rcx + 0x150]
movdqa xmm15, xmmword [rcx + 0x140]
movdqa xmm6, xmmword [rcx + 0x130]
movdqa xmm7, xmmword [rcx + 0xf0]
movdqa xmm8, xmmword [rcx + 0x100]
movdqa xmm9, xmmword [rcx + 0x110]
movdqa xmm10, xmmword [rcx + 0x120]
xor edi, edi
lea rbx, [rsp + 0x110]
cmp rsi, rdi
je 0x1400391f1
mov r15, rdi
shl r15, 7
lea r12, [r15 + rbp]
lea rcx, [rsp + 0x1c0]
mov rdx, r12
call fcn.14003936e
mov rcx, rbx
mov rdx, r12
call fcn.14003936e
movaps xmm0, xmmword [rsp + 0x110]
movaps xmm1, xmmword [rsp + 0x100]
xorps xmm0, xmm1
movaps xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [rsp + 0x120]
xorps xmm0, xmm1
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [rsp + 0x130]
xorps xmm0, xmm1
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [rsp + 0x140]
xorps xmm0, xmm1
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [rsp + 0x150]
xorps xmm0, xmm1
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [rsp + 0x160]
xorps xmm0, xmm1
movaps xmmword [rsp + 0x80], xmm0
movaps xmm0, xmmword [rsp + 0x170]
xorps xmm0, xmm1
movaps xmmword [rsp + 0x90], xmm0
movaps xmm0, xmmword [rsp + 0x180]
xorps xmm0, xmm1
movdqa xmm1, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0xa0], xmm0
xor eax, eax
cmp rax, 0x80
je 0x140038eee
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm1
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x140038ecf
xor eax, eax
movdqa xmm1, xmmword [rsp + 0xe0]
cmp rax, 0x80
je 0x140038f18
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm1
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x140038ef9
xor eax, eax
movdqa xmm1, xmmword [rsp + 0xd0]
cmp rax, 0x80
je 0x140038f42
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm1
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x140038f23
xor eax, eax
movdqa xmm1, xmmword [rsp + 0xc0]
cmp rax, 0x80
je 0x140038f6c
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm1
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x140038f4d
xor eax, eax
cmp rax, 0x80
je 0x140038f8e
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm11
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x140038f6e
xor eax, eax
cmp rax, 0x80
je 0x140038fb0
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm12
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x140038f90
xor eax, eax
cmp rax, 0x80
je 0x140038fd2
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm13
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x140038fb2
xor eax, eax
cmp rax, 0x80
je 0x140038ff4
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm14
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x140038fd4
xor eax, eax
cmp rax, 0x80
je 0x140039016
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm15
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x140038ff6
xor eax, eax
cmp rax, 0x80
je 0x140039037
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm6
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x140039018
xor eax, eax
cmp rax, 0x80
je 0x140039059
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm10
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x140039039
xor eax, eax
cmp rax, 0x80
je 0x14003907b
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm9
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x14003905b
xor eax, eax
cmp rax, 0x80
je 0x14003909d
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdec xmm0, xmm8
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x14003907d
xor eax, eax
cmp rax, 0x80
je 0x1400390be
movdqa xmm0, xmmword [rsp + rax + 0x30]
aesdeclast xmm0, xmm7
movdqa xmmword [rsp + rax + 0x30], xmm0
add rax, 0x10
jmp 0x14003909f
movaps xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x190], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
movaps xmm2, xmmword [rsp + 0x50]
movaps xmm3, xmmword [rsp + 0x60]
movaps xmm4, xmmword [rsp + 0x70]
movaps xmm5, xmmword [rsp + 0x80]
movaps xmm0, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x1b0], xmm0
movaps xmm0, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0x1a0], xmm0
movaps xmm0, xmmword [rsp + 0x190]
movaps xmmword [rsp + 0x110], xmm0
movdqa xmmword [rsp + 0x120], xmm1
movaps xmmword [rsp + 0x130], xmm2
movaps xmmword [rsp + 0x140], xmm3
movaps xmmword [rsp + 0x150], xmm4
movaps xmmword [rsp + 0x160], xmm5
movaps xmm0, xmmword [rsp + 0x1b0]
movaps xmmword [rsp + 0x170], xmm0
movdqa xmm0, xmmword [rsp + 0x1a0]
movdqa xmmword [rsp + 0x180], xmm0
xor eax, eax
cmp rax, 0x10
je 0x14003917c
mov cl, byte [r13 + rax]
xor byte [rsp + rax + 0x110], cl
inc rax
jmp 0x140039165
mov eax, 1
lea rcx, [rsp + 0x1c0]
lea rdx, [rsp + 0x120]
cmp rax, 8
je 0x1400391ba
xor r8d, r8d
cmp r8, 0x10
je 0x1400391ad
mov r9b, byte [rcx + r8]
xor byte [rdx + r8], r9b
inc r8
jmp 0x14003919a
inc rax
add rdx, 0x10
add rcx, 0x10
jmp 0x140039191
add r15, qword [rsp + 0x28]
inc rdi
mov r8d, pe_nt_image_headers64
mov rcx, r15
mov rdx, rbx
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x30]
mov rdx, r14
call fcn.14000ab7b
movdqu xmm0, xmmword [rsp + 0x30]
movdqu xmmword [r13], xmm0
jmp 0x140038e04
mov rcx, qword [rsp + 0xb8]
mov rax, rcx
shl rax, 4
and rax, 0xffffffffffffff80
add rbp, rax
mov r14, rbp
and ecx, 7
mov rbp, rcx
add qword [rsp + 0x28], rax
xor r15d, r15d
lea rsi, [rsp + 0x110]
lea rdi, [rsp + 0x30]
cmp rbp, r15
je 0x140039302
mov r12, r15
shl r12, 4
lea rbx, [r14 + r12]
mov rcx, rsi
mov rdx, rbx
call fcn.14000ab7b
mov rcx, rdi
mov rdx, rbx
call fcn.14000ab7b
movdqa xmm0, xmmword [rsp + 0x30]
pxor xmm0, xmmword [rsp + 0x100]
aesdec xmm0, xmmword [rsp + 0xf0]
aesdec xmm0, xmmword [rsp + 0xe0]
aesdec xmm0, xmmword [rsp + 0xd0]
aesdec xmm0, xmmword [rsp + 0xc0]
aesdec xmm0, xmm11
aesdec xmm0, xmm12
aesdec xmm0, xmm13
aesdec xmm0, xmm14
aesdec xmm0, xmm15
aesdec xmm0, xmm6
aesdec xmm0, xmm10
aesdec xmm0, xmm9
aesdec xmm0, xmm8
aesdeclast xmm0, xmm7
movdqa xmmword [rsp + 0x30], xmm0
xor eax, eax
cmp rax, 0x10
je 0x1400392dc
mov cl, byte [r13 + rax]
xor byte [rsp + rax + 0x30], cl
inc rax
jmp 0x1400392c8
inc r15
movaps xmm0, xmmword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
movups xmmword [rax + r12], xmm0
movdqu xmm0, xmmword [rsp + 0x110]
movdqu xmmword [r13], xmm0
jmp 0x140039225
movaps xmm6, xmmword [rsp + 0x240]
movaps xmm7, xmmword [rsp + 0x250]
movaps xmm8, xmmword [rsp + 0x260]
movaps xmm9, xmmword [rsp + 0x270]
movaps xmm10, xmmword [rsp + 0x280]
movaps xmm11, xmmword [rsp + 0x290]
movaps xmm12, xmmword [rsp + 0x2a0]
movaps xmm13, xmmword [rsp + 0x2b0]
movaps xmm14, xmmword [rsp + 0x2c0]
movaps xmm15, xmmword [rsp + 0x2d0]
add rsp, 0x2e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret