joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000fbf5
Capabilities:
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x14], 0
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
call sym._fpreset
lea rax, [0x140018360]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
lea rax, [sym.pthread_tls_init]
mov rdx, rax
lea rax, [0x140021c70]
mov rcx, rax
call sym._pthread_once_raw
mov eax, dword [0x140018350]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 8]
mov dword [rdx + 0x70], eax
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rdx, rbp
mov rax, qword [rbp - 8]
add rax, 0xd0
mov rcx, rax
call sym._setjmp
test eax, eax
jne 0x14000fd0a
mov qword [rbp - 0x10], pe_nt_image_headers64
lea rax, [0x140018360]
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x14000fcd8
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov rcx, rax
call rdx
mov qword [rbp - 0x10], rax
nop
nop
lea rax, [0x140018360]
mov rcx, rax
call sym.pthread_mutex_lock
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call sym._pthread_cleanup_dest
jmp 0x14000fd19
lea rax, [0x140018360]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov dword [rbp - 0x14], eax
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x14000fd55
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 8]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x14000fdc3
mov rax, qword [rbp - 8]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.push_pthread_mem
mov qword [rbp - 8], 0
mov eax, dword [0x140018350]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x14000fe0d
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 8]
mov dword [rax + 0xbc], 1
jmp 0x14000fe0d
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [0x140018360]
mov rcx, rax
call sym.pthread_mutex_unlock
test eax, eax
je 0x14000fdff
mov eax, dword [rbp - 0x14]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__endthreadex]
call rax
nop
Function at 0x1402e91f3
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
enter pe_nt_image_headers64, 0
sub rsp, 0x1a0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rcx, qword [rbp + 0x18]
lea rdx, [rbp - 0x190]
call fcn.1402e9133
cmp qword [r12], 0
je 0x1402e92c0
lea rcx, [rbp - 0x190]
mov rax, qword [rbp + 0x10]
mov r11, rcx
and rax, 0xfffffffffffffff0
je 0x1402e93f6
lea r10, [rcx + 0xe0]
add rax, qword [rbp + 0x20]
pxor xmm0, xmm0
movups xmm1, xmmword [r8]
add r8, 0x10
pxor xmm0, xmm1
mov rcx, r11
pxor xmm0, xmmword [rcx]
aesenc xmm0, xmmword [rcx + 0x10]
aesenc xmm0, xmmword [rcx + 0x20]
aesenc xmm0, xmmword [rcx + 0x30]
aesenc xmm0, xmmword [rcx + 0x40]
aesenc xmm0, xmmword [rcx + 0x50]
aesenc xmm0, xmmword [rcx + 0x60]
aesenc xmm0, xmmword [rcx + 0x70]
add rcx, 0x80
aesenc xmm0, xmmword [rcx]
aesenc xmm0, xmmword [rcx + 0x10]
add rcx, 0x20
cmp rcx, r10
jb 0x1402e9294
aesenclast xmm0, xmmword [r10]
movups xmmword [r9], xmm0
add r9, 0x10
cmp r8, rax
jb 0x1402e9250
jmp 0x1402e93f6
shr qword [rbp + 0x10], 4
xor eax, eax
mov qword [rbp - 0x198], rax
mov rax, qword [rbp + 0x20]
sub rax, qword [rbp + 0x28]
mov qword [rbp - 0x1a0], rax
lea rdi, [rbp - 0xa0]
lea r10, [rbp - 0x190]
mov rsi, qword [rbp + 0x20]
mov rbx, qword [rbp + 0x28]
xor ecx, ecx
push rdi
lodsq rax, qword [rsi]
xor rax, qword [r10 + rcx*8]
cmp qword [rbp - 0x198], 0
je 0x1402e931b
cmp qword [rbp - 0x1a0], 0
jne 0x1402e9316
xor rax, qword [rsi - 0x18]
jmp 0x1402e931b
xor rax, qword [rbx + rcx*8 - 0x10]
stosq qword [rdi], rax
inc ecx
cmp ecx, 2
jne 0x1402e92f6
pop rsi
xor ebx, ebx
mov rdx, rbx
mov ecx, 0xd
add r10, 0x10
push rdi
xor r8, r8
xor r9, r9
mov dl, byte [r8 + rsi]
add r8, 5
and r8, 0xf
mov bl, byte [r8 + rsi]
mov eax, dword [r12 + rdx*4 + 8]
xor eax, dword [r12 + rbx*4 + 0x408]
add r8, 5
and r8, 0xf
mov dl, byte [r8 + rsi]
add r8, 5
and r8, 0xf
mov bl, byte [r8 + rsi]
xor eax, dword [r12 + rdx*4 + 0x808]
xor eax, dword [r12 + rbx*4 + 0xc08]
add r8, 5
and r8, 0xf
xor eax, dword [r10 + r9*4]
stosd dword [rdi], eax
inc r9
cmp r9, 4
jne 0x1402e933a
pop rdi
xchg rsi, rdi
loop 0x1402e932f
add r10, 0x10
mov rdi, qword [rbp + 0x28]
lea rbx, [r12 + 0x1008]
xor ecx, ecx
xor r8, r8
xor r9, r9
mov ecx, 8
mov al, byte [r8 + rsi]
xlatb
ror rax, 8
add r8, 5
and r8, 0xf
loop 0x1402e93b8
xor rax, qword [r10 + r9*8]
stosq qword [rdi], rax
inc r9
cmp r9, 2
jne 0x1402e93b3
dec qword [rbp + 0x10]
je 0x1402e93f6
add qword [rbp + 0x20], 0x10
add qword [rbp + 0x28], 0x10
inc qword [rbp - 0x198]
jmp 0x1402e92dd
xor rax, rax
lea rdi, [rbp - 0x190]
mov rcx, 0x26
rep stosq qword [rdi], rax
leave
ret
Function at 0x1402e991e
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push r9
push r8
push rdx
push rcx
push rsi
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
mov rsi, qword [rdx + 0x50]
movzx rcx, word [rdx + 0x4a]
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x1402e994b
sub al, 0x20
ror r9d, 7
add r9d, eax
loop 0x1402e9941
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1402e99d3
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1402e99d3
add rax, rdx
push rax
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
add r8, rdx
jrcxz 0x1402e99d2
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xb
add r9d, eax
cmp al, ah
jne 0x1402e9991
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x1402e9982
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x1402e9935
Function at 0x14001c744
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov edi, edx
mov rsi, rcx
mov qword [rsp + 0x20], rcx
mov eax, 0xeff920cc
cmp eax, 0x629980d2
je 0x14001c7a6
cmp eax, 0xeff920cc
jne 0x14001c759
mov eax, 0x2c6a4b70
mov rcx, qword [rsp + 0x20]
cmp eax, 0x2c6a4b70
je 0x14001c781
cmp eax, 0x4ca88642
jne 0x14001c771
jmp 0x14001c788
mov eax, 0x4ca88642
jmp 0x14001c771
mov dword [rcx + 0x1384], 0xffffffff
mov edx, edi
mov r8d, 0x6c078965
call fcn.14002deb6
mov eax, 0x629980d2
jmp 0x14001c759
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14002f6f6
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov qword [rsp + 0x40], rcx
mov eax, 0x860ce51f
mov r12d, 0x23fbb324
mov r14d, 0x49baf29c
mov r13d, 0x227f4e36
mov r15d, 0x63100287
mov ebx, 0x654b1374
mov edi, 0xb304a3c
cmp eax, 0xdb5c0fa5
jle 0x14002f77f
cmp eax, 0x23fbb323
jg 0x14002f7bb
cmp eax, 0xb304a3b
jg 0x14002f819
cmp eax, 0xdb5c0fa6
je 0x14002f8f9
cmp eax, 0xdbb9aaff
jne 0x14002f735
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
cmp eax, 0x270
mov eax, 0xc64cb8e1
cmove eax, r15d
jmp 0x14002f735
cmp eax, 0x9f71395d
jle 0x14002f7ee
cmp eax, 0xc9e4d15e
jg 0x14002f855
cmp eax, 0x9f71395e
je 0x14002f921
cmp eax, 0xc64cb8e1
jne 0x14002f735
mov eax, dword [rsp + 0x30]
cmp eax, 0x4e0
setae byte [rsp + 0x2f]
mov eax, 0xc9e4d15f
jmp 0x14002f735
cmp eax, 0x63100286
jg 0x14002f8ba
cmp eax, 0x23fbb324
je 0x14002f949
cmp eax, 0x49baf29c
jne 0x14002f735
mov rcx, rsi
call fcn.14002fdae
mov eax, 0x9f71395e
jmp 0x14002f735
cmp eax, 0x99fab9fb
jle 0x14002f8da
cmp eax, 0x99fab9fc
je 0x14002f96f
cmp eax, 0x9d310c2b
jne 0x14002f735
mov eax, 0x23fbb324
jmp 0x14002f735
cmp eax, 0xb304a3c
je 0x14002f8d0
cmp eax, 0x227f4e36
jne 0x14002f735
mov eax, dword [0x1403fbaf8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x99fab9fc
cmove eax, ebx
cmp dword [0x1403fbafc], 0xa
cmovl eax, ebx
jmp 0x14002f735
cmp eax, 0xc9e4d15f
je 0x14002f979
cmp eax, 0xcf96bc7b
jne 0x14002f735
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx]
lea edx, [rcx + 1]
mov rbp, qword [rsp + 0x38]
mov dword [rbp], edx
mov eax, dword [rax + rcx*4 + 4]
mov ecx, eax
shr ecx, 0xb
and ecx, dword [rsi + 0x1384]
xor ecx, eax
mov eax, ecx
shl eax, 7
and eax, 0x9d2c5680
xor eax, ecx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, eax
mov dword [rsp + 0x34], ecx
mov eax, 0x8de34f2c
jmp 0x14002f735
cmp eax, 0x63100287
je 0x14002f98c
cmp eax, 0x654b1374
jne 0x14002f735
mov eax, 0xcf96bc7b
jmp 0x14002f735
cmp eax, 0x860ce51f
jne 0x14002f99e
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov eax, 0xdbb9aaff
jmp 0x14002f735
mov eax, dword [0x1403fbaf8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x99fab9fc
cmove eax, r13d
cmp dword [0x1403fbafc], 0xa
cmovl eax, r13d
jmp 0x14002f735
mov eax, dword [0x1403fbaf8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x9d310c2b
cmove eax, r12d
cmp dword [0x1403fbafc], 0xa
cmovl eax, r12d
jmp 0x14002f735
mov eax, dword [0x1403fbaf8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x9d310c2b
cmove eax, edi
cmp dword [0x1403fbafc], 0xa
cmovl eax, edi
jmp 0x14002f735
mov eax, 0x227f4e36
jmp 0x14002f735
cmp byte [rsp + 0x2f], 0
mov eax, 0xcf96bc7b
cmovne eax, r14d
jmp 0x14002f735
mov rcx, rsi
call fcn.14002f9c6
mov eax, 0xdb5c0fa6
jmp 0x14002f735
cmp eax, 0x8de34f2c
jne 0x14002f735
mov eax, dword [rsp + 0x34]
shr eax, 0x12
xor eax, dword [rsp + 0x34]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400ae11c
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov eax, dword [0x1403fb1d4]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x1403fb1e8], 0xa
setl dl
or dl, al
mov edi, 0x10997b7e
mov eax, 0x3ce9914f
cmove edi, eax
mov ebx, 0xb5807b9b
cmove ebx, eax
mov edx, 0xbbf0ae59
mov eax, 0xefb4be04
cmove edx, eax
mov dword [rsp + 0x2c], edx
mov r15d, 0xf18dabb6
cmove r15d, eax
mov r12d, 0x31b6a53f
mov eax, 0x6e10d8c0
cmove r12d, eax
mov rsi, rcx
mov ebp, 0xd96fe858
cmove ebp, eax
mov ecx, 0xc6705004
mov eax, ecx
cmp ecx, 0x10997b7d
jg 0x1400ae1ce
cmp eax, 0xefb4be03
jg 0x1400ae1fb
cmp eax, 0xc6705003
jg 0x1400ae26e
mov ecx, edi
cmp eax, 0xb5807b9b
je 0x1400ae199
mov ecx, eax
cmp eax, 0xbbf0ae59
jne 0x1400ae199
mov ecx, 0x731559a8
jmp 0x1400ae199
cmp eax, 0x48d3b944
jle 0x1400ae234
cmp eax, 0x731559a7
jg 0x1400ae28e
cmp eax, 0x48d3b945
je 0x1400ae307
mov ecx, eax
cmp eax, 0x6e10d8c0
jne 0x1400ae199
mov ecx, 0xd96fe858
jmp 0x1400ae199
cmp eax, 0xc45895b
jg 0x1400ae2b0
cmp eax, 0xefb4be04
je 0x1400ae333
mov ecx, eax
cmp eax, 0xf18dabb6
jne 0x1400ae199
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x40], rax
mov ecx, dword [rsp + 0x2c]
jmp 0x1400ae199
cmp eax, 0x31b6a53e
jg 0x1400ae2f6
cmp eax, 0x10997b7e
je 0x1400ae35b
mov ecx, eax
cmp eax, 0x13f126a3
jne 0x1400ae199
mov ecx, 0xed952b6
xor r13d, r13d
movabs r14, 0xcbf29ce484222325
jmp 0x1400ae199
cmp eax, 0xc6705004
je 0x1400ae36f
mov ecx, eax
cmp eax, 0xd96fe858
jne 0x1400ae199
mov ecx, r12d
jmp 0x1400ae199
mov ecx, ebx
cmp eax, 0x731559a8
je 0x1400ae199
mov ecx, eax
cmp eax, 0x7d4294e6
jne 0x1400ae199
mov ecx, r15d
jmp 0x1400ae199
mov ecx, ebp
cmp eax, 0xc45895c
je 0x1400ae199
mov ecx, eax
cmp eax, 0xed952b6
jne 0x1400ae199
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x30], r14
mov rcx, rsi
call fcn.1403256f0
mov rcx, qword [rsp + 0x20]
cmp rcx, rax
mov ecx, 0xc45895c
mov eax, 0x48d3b945
cmovb ecx, eax
jmp 0x1400ae199
cmp eax, 0x3ce9914f
jne 0x1400ae379
mov ecx, 0xb5807b9b
jmp 0x1400ae199
mov rax, qword [rsp + 0x20]
movsx rax, byte [rsi + rax]
xor rax, qword [rsp + 0x30]
movabs rcx, 0x100000001b3
imul rax, rcx
mov qword [rsp + 0x38], rax
mov ecx, 0x7d4294e6
jmp 0x1400ae199
mov rax, qword [rsp + 0x20]
mov rax, qword [rsp + 0x20]
mov rax, qword [rsp + 0x20]
mov rax, qword [rsp + 0x20]
mov rax, qword [rsp + 0x20]
mov rax, qword [rsp + 0x20]
mov ecx, 0xf18dabb6
jmp 0x1400ae199
mov r14, qword [rsp + 0x38]
mov ecx, 0xed952b6
mov r13, qword [rsp + 0x40]
jmp 0x1400ae199
mov ecx, 0x13f126a3
jmp 0x1400ae199
mov ecx, eax
cmp eax, 0x31b6a53f
jne 0x1400ae199
mov rax, qword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400e7457
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov eax, dword [0x1404016c0]
lea ebp, [rax - 1]
imul ebp, eax
test bpl, 1
sete al
cmp dword [0x1404016c4], 0xa
setl bl
or bl, al
mov r8d, 0xfeb085a4
mov eax, 0xd1880dca
cmove r8d, eax
mov r9d, 0x63cc48a0
cmove r9d, eax
mov eax, dword [0x1404016c8]
lea ebp, [rax - 1]
imul ebp, eax
test bpl, 1
sete al
cmp dword [0x1404016cc], 0xa
setl bl
or bl, al
mov r10d, 0xdd6dd91c
mov eax, 0x920bfb9e
cmove r10d, eax
mov r11d, 0x177ac21b
cmove r11d, eax
mov esi, 0xba637460
mov eax, 0x5169902e
cmove esi, eax
mov r13d, 0x24acb5cc
cmove r13d, eax
mov eax, 0xdc7d6adb
mov r14d, 0x83257ff5
movabs r12, 0xcbf29ce484222325
movabs r15, 0x100000001b3
cmp eax, 0xdc7d6ada
jle 0x1400e76a4
cmp eax, 0x63cc48a0
je 0x1400e76c0
cmp eax, 0xfeb085a4
je 0x1400e76df
cmp eax, 0xdc7d6adb
jne 0x1400e750d
mov eax, 0xca4b9bbe
mov edi, eax
cmp eax, 0x24acb5cb
jg 0x1400e7574
cmp edi, 0xba63745f
jle 0x1400e75a1
cmp edi, 0xdd6dd91b
jg 0x1400e7637
cmp edi, 0xba637460
je 0x1400e7656
mov eax, edi
cmp edi, 0xca4b9bbe
jne 0x1400e753a
mov eax, 0x3b018266
jmp 0x1400e753a
cmp edi, 0x5169902d
jg 0x1400e75e5
mov eax, esi
cmp edi, 0x24acb5cc
je 0x1400e753a
cmp edi, 0x278eeff4
je 0x1400e7665
mov eax, edi
cmp edi, 0x3b018266
jne 0x1400e753a
mov eax, r13d
jmp 0x1400e753a
cmp edi, 0x83257ff5
je 0x1400e7679
cmp edi, 0x920bfb9e
je 0x1400e7690
mov eax, edi
cmp edi, 0x97db0d51
jne 0x1400e753a
mov qword [rsp], rbp
mov qword [rsp + 8], rbx
mov rax, qword [rsp]
cmp rax, rdx
mov eax, 0x567ba6f8
cmovb eax, r14d
jmp 0x1400e753a
cmp edi, 0x5169902e
je 0x1400e769a
mov eax, r11d
cmp edi, 0x567ba6f8
je 0x1400e753a
mov eax, edi
cmp edi, 0x73e3d469
jne 0x1400e753a
mov rax, qword [rsp + 0x18]
xor rax, qword [rsp + 8]
imul rax, r15
mov qword [rsp + 0x20], rax
mov rax, qword [rsp]
inc rax
mov qword [rsp + 0x28], rax
mov eax, 0x278eeff4
jmp 0x1400e753a
mov eax, r10d
cmp edi, 0x177ac21b
je 0x1400e753a
mov eax, edi
cmp edi, 0xdd6dd91c
jne 0x1400e753a
jmp 0x1400e76c8
mov eax, 0x97db0d51
xor ebp, ebp
mov rbx, r12
jmp 0x1400e753a
mov rbx, qword [rsp + 0x20]
mov eax, 0x97db0d51
mov rbp, qword [rsp + 0x28]
jmp 0x1400e753a
mov rax, qword [rsp]
movzx eax, byte [rcx + rax]
mov qword [rsp + 0x18], rax
mov eax, 0x73e3d469
jmp 0x1400e753a
mov eax, 0x177ac21b
jmp 0x1400e753a
mov eax, 0x24acb5cc
jmp 0x1400e753a
cmp eax, 0xc9a86c08
je 0x1400e76d7
cmp eax, 0xd1880dca
jne 0x1400e750d
mov eax, 0x63cc48a0
jmp 0x1400e750d
mov eax, r8d
jmp 0x1400e750d
mov rdi, qword [rsp + 8]
mov eax, 0xc9a86c08
jmp 0x1400e750d
mov eax, r9d
jmp 0x1400e750d
mov qword [rsp + 0x10], rdi
mov rax, qword [rsp + 0x10]
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14016dde0
Capabilities:
Encode data using xor

Disassembly:
xor rax, rax
xor r10, r10
cmp r8, 0
je 0x14016de2d
cmp r8, 0x10
jne 0x14016de10
mov r10, qword [rcx]
mov r11, qword [rcx + 8]
mov r8d, 1
xor r10, qword [rdx]
xor r11, qword [rdx + 8]
or r10, r11
cmovne rax, r8
repz ret
mov r10b, byte [rcx]
lea rcx, [rcx + 1]
xor r10b, byte [rdx]
lea rdx, [rdx + 1]
or al, r10b
dec r8
jne 0x14016de10
neg rax
shr rax, 0x3f
repz ret

Function at 0x14016f0a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14016f0c0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret

Function at 0x14016f100
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14016f120
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret

Function at 0x14016f160
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14016f183
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x14016f1d0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14016f1f3
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret
Function at 0x14016f240
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14016f269
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret

Function at 0x14016f2d0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14016f2f9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
repz ret

Function at 0x14016f360
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14016f3bf

Function at 0x14016f3b0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.14016f3b0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
repz ret
Function at 0x14016f440
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14016f49f
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14016f490
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
repz ret

Function at 0x14016f520
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesenc xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14016f57a

Function at 0x14016f59a
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14016f570
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
repz ret