joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140074df0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140074e1f
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x140074e17
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140074e68
mov ecx, dword [0x1400f5dc0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140074e58
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140074e58
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x140074e73
inc ecx
inc rax
cmp rax, 2
jl 0x140074e46
mov rcx, rbx
call case.0x14007e53b.0
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x28]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140075310
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x1400ed368]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x20], 0
je 0x140075361
mov r8, qword [rcx + 0x18]
mov qword [rbp - 0x21], r8
mov rax, qword [rcx + 0x28]
mov qword [rbp - 0x11], rax
mov rax, qword [r8 + 8]
mov rdx, rcx
lea rcx, [rbp - 0x39]
call rax
jmp 0x140075371
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], 0
mov rax, qword [rbx + 0x30]
mov qword [rbp - 9], rax
lea rdx, [rdi + 8]
lea rcx, [rbp + 0x1f]
call fcn.1400784d4
nop
cmp qword [rbp - 0x19], 0
je 0x1400754a4
mov rcx, qword [rbp - 0x11]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x1400753c1
lea rcx, [0x140076370]
mov qword [rbp - 0x49], rcx
lea rcx, [rbp + 0x17]
mov qword [rbp - 0x41], rcx
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x39]
call rax
jmp 0x140075464
mov rdi, qword [rcx + 0x10]
lea rdx, [rbp + 0x1f]
lea rcx, [rbp + 7]
call fcn.1400784d4
lea rax, [rbp - 1]
mov qword [rbp - 0x49], rax
lea rax, [rbp - 0x59]
mov qword [rbp + 0x2f], rax
mov ecx, dword [0x1400f5dc0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400753f9
mov rdx, qword [rax + 8]
jmp 0x1400753fb
xor edx, edx
mov r8d, 0x28
call fcn.140041ba0
mov rbx, rax
mov qword [rbp + 0x3f], 0
lea rcx, [rax + 0x10]
lea rdx, [rbp + 7]
call fcn.1400784d4
lea rax, [0x1400763d0]
mov qword [rbx], rax
mov qword [rbp - 0x51], rbx
mov qword [rbp + 0x37], 0
lea rcx, [rbp + 0x2f]
call fcn.1400762d0
nop
lea rcx, [rbp + 7]
call fcn.1400785b4
nop
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x39]
call rdi
nop
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x140075464
mov rax, qword [rcx]
xor edx, edx
call rax
nop
lea rcx, [rbp + 0x1f]
call fcn.1400785b4
nop
cmp qword [rbp - 0x19], 0
je 0x140075483
mov rax, qword [rbp - 0x21]
mov rdx, qword [rax]
lea rcx, [rbp - 0x39]
call rdx
nop
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140084ea0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
lea rcx, [rbp + 0x2f]
call fcn.140037e50
nop
lea rcx, [rbp + 0x2f]
call fcn.14003d920
int3
Function at 0x140075f20
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1400ed368]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
cmp qword [rcx + 0x20], 0
je 0x14007603c
mov rcx, qword [rcx + 0x28]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x140075f93
lea rcx, [0x1400763a0]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
lea rdx, [rsp + 0x40]
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140084ea0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rdi, qword [rcx + 0x10]
mov rax, qword [rdx]
xor esi, esi
mov qword [rdx], rsi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov ecx, dword [0x1400f5dc0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140075fcf
mov rdx, qword [rax + 8]
jmp 0x140075fd2
mov rdx, rsi
mov r8d, 0x18
call fcn.140041ba0
mov qword [rsp + 0x60], rsi
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x28], rsi
mov qword [rax + 8], rcx
lea rcx, [0x140076520]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x58], rsi
lea rcx, [rsp + 0x50]
call fcn.140076230
nop
lea rcx, [rsp + 0x28]
call fcn.140040290
nop
lea rdx, [rsp + 0x30]
mov rcx, rbx
call rdi
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140076037
mov rax, qword [rcx]
xor edx, edx
call rax
nop
jmp 0x140075f74
lea rcx, [rsp + 0x50]
call fcn.140037e50
nop
lea rcx, [rsp + 0x50]
call fcn.14003d920
int3

Function at 0x140076230
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140076257
add rcx, 8
call fcn.140040290
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400762a3
mov ecx, dword [0x1400f5dc0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140076293
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140076293
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x1400762ae
inc ecx
inc rax
cmp rax, 6
jl 0x140076281
mov rcx, rbx
call case.0x14007e53b.0
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x18]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret
Function at 0x1400762d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400762f7
add rcx, 0x10
call fcn.1400785b4
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140076343
mov ecx, dword [0x1400f5dc0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140076333
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140076333
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14007634e
inc ecx
inc rax
cmp rax, 6
jl 0x140076321
mov rcx, rbx
call case.0x14007e53b.0
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x28]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x1400778f8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14007797c
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400c47c0]
cmp byte [rcx + rax], 0
je 0x14007797c
dec r8
sub rdx, 1
jne 0x140077962
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x14007c8b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x50
mov rax, r8
mov rbx, rcx
test rdx, rdx
jne 0x14007c8d5
mov eax, 0xfffffff7
add rsp, 0x50
pop rbx
ret
test rax, rax
je 0x14007c9c8
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov ecx, dword [rbx + 0x88]
test ecx, ecx
jne 0x14007c973
mov eax, dword [rbx + 0x10]
lea edx, [rcx + 1]
mov r14d, dword [rbx + 0x94]
mov rcx, rbx
mov edi, dword [rbx + 0x3c]
mov esi, dword [rbx + 0x8c]
mov ebp, dword [rbx]
mov r13d, dword [rbx + 0x98]
mov r15d, dword [rbx + 0x14]
mov r12d, dword [rbx + 0x90]
mov dword [rsp + 0x78], eax
call fcn.14007c9d0
lea eax, [r14 + rdi]
mov dword [rbx + 0x88], 8
xor eax, esi
mov ecx, 8
xor eax, ebp
bswap eax
mov dword [rbx + 0x80], eax
lea eax, [r15 + r13]
xor eax, r12d
xor eax, dword [rsp + 0x78]
bswap eax
mov dword [rbx + 0x84], eax
mov eax, 8
sub eax, ecx
cdqe
movzx ecx, byte [rax + rbx + 0x80]
mov rax, qword [rsp + 0x68]
xor byte [rax], cl
inc rax
dec dword [rbx + 0x88]
sub qword [rsp + 0x70], 1
mov qword [rsp + 0x68], rax
jne 0x14007c901
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x50
pop rbx
ret
Function at 0x14007cbb0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
movzx eax, dl
lea r10, str.cw
movzx esi, byte [rax + r10]
mov eax, edx
shr eax, 8
movzx ecx, al
mov eax, edx
shr eax, 0x10
lea edi, [rsi + rsi]
movzx r15d, byte [rcx + r10]
movzx ecx, al
mov eax, edx
shr rax, 0x18
lea r9d, [r15 + r15]
movzx r14d, byte [rcx + r10]
mov r8d, r9d
xor r8d, r15d
movzx r10d, byte [rax + r10]
movzx eax, dil
xor al, 0x1b
movzx ebp, al
bt edi, 8
movzx eax, dil
cmovae ebp, eax
movzx eax, r8b
xor al, 0x1b
movzx ecx, al
bt r8d, 8
movzx eax, r8b
lea r8d, [r14 + r14]
cmovae ecx, eax
mov edx, r8d
xor bpl, cl
xor edx, r14d
xor bpl, r10b
movzx eax, dl
xor al, 0x1b
xor bpl, r14b
movzx r11d, al
bt edx, 8
movzx eax, dl
cmovae r11d, eax
movzx eax, r9b
xor al, 0x1b
movzx ecx, al
bt r9d, 8
movzx eax, r9b
lea r9d, [r10 + r10]
cmovae ecx, eax
mov edx, r9d
xor edx, r10d
xor r11b, cl
xor r11b, r10b
movzx eax, dl
xor al, 0x1b
xor r11b, sil
movzx r10d, al
bt edx, 8
movzx eax, dl
cmovae r10d, eax
movzx eax, r8b
xor al, 0x1b
movzx ecx, al
bt r8d, 8
movzx eax, r8b
cmovae ecx, eax
xor edi, esi
xor r10b, cl
movzx eax, dil
xor al, 0x1b
xor r10b, r15b
movzx ecx, al
xor r10b, sil
movzx eax, dil
bt edi, 8
cmovae ecx, eax
movzx eax, r9b
xor al, 0x1b
movzx r8d, cl
movzx ecx, al
movzx eax, r9b
mov rbx, qword [rsp + 0x18]
bt r9d, 8
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
cmovae ecx, eax
movzx eax, cl
xor eax, r8d
movzx ecx, r10b
xor eax, r14d
xor eax, r15d
shl eax, 8
or eax, ecx
movzx ecx, r11b
shl eax, 8
or eax, ecx
movzx ecx, bpl
mov rbp, qword [rsp + 0x20]
shl eax, 8
or eax, ecx
pop r15
pop r14
ret
Function at 0x140083380
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov r9, rdx
mov r8, rcx
mov edx, 8
lea ecx, [rdx + 6]
jmp 0x140083680
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
xor r11d, r11d
mov r10d, edx
lea esi, [rcx*4 + 4]
mov rdi, r8
lea rbp, [0x1400c6420]
test edx, edx
je 0x1400836f1
mov rbx, r8
lea eax, [r11*4]
inc r11d
movzx edx, byte [rax + r9 + 3]
lea rbx, [rbx + 4]
shl edx, 8
mov ecx, eax
movzx eax, byte [rax + r9 + 2]
or edx, eax
shl edx, 8
movzx eax, byte [rcx + r9 + 1]
or edx, eax
movzx eax, byte [rcx + r9]
shl edx, 8
or edx, eax
mov dword [rbx - 4], edx
cmp r11d, r10d
jb 0x1400836b2
mov r9d, r10d
cmp r10d, esi
jae 0x1400837d4
lea r11, [r8 + r10*4]
lea rbx, [0x1400c6430]
nop dword [rax + rax]
lea eax, [r9 - 1]
xor edx, edx
mov ecx, dword [rdi + rax*4]
mov eax, r9d
div r10d
test edx, edx
jne 0x14008376c
mov r8d, ecx
movzx eax, cl
movzx ecx, byte [rax + rbx]
mov eax, r8d
shr rax, 0x18
shl ecx, 8
movzx eax, byte [rax + rbx]
or ecx, eax
mov eax, r8d
shr rax, 0x10
shl ecx, 8
movzx edx, al
shr r8, 8
movzx eax, byte [rdx + rbx]
or ecx, eax
movzx eax, r8b
shl ecx, 8
movzx edx, byte [rax + rbx]
movzx eax, byte [rbp]
or ecx, edx
xor ecx, eax
inc rbp
jmp 0x1400837b8
cmp r10d, 6
jbe 0x1400837b8
cmp edx, 4
jne 0x1400837b8
mov r8, rcx
mov rax, rcx
shr rax, 0x10
movzx ecx, al
mov rax, r8
shr rax, 0x18
movzx ecx, byte [rcx + rbx]
movzx eax, byte [rax + rbx]
shl eax, 8
or ecx, eax
mov rax, r8
shr rax, 8
movzx edx, al
shl ecx, 8
movzx eax, byte [rdx + rbx]
or ecx, eax
movzx eax, r8b
shl ecx, 8
movzx edx, byte [rax + rbx]
or ecx, edx
mov eax, r9d
inc r9d
sub eax, r10d
xor ecx, dword [rdi + rax*4]
mov dword [r11], ecx
add r11, 4
cmp r9d, esi
jb 0x140083710
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret

Function at 0x1400833a0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], r9
mov r9, rdx
mov rdx, rcx
mov qword [rsp + 0x20], r8
mov ecx, 0xe
lea r8, [0x1400c6430]
call fcn.1400837f0
add rsp, 0x38
ret

Function at 0x1400833d0
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140083500
movups xmm0, xmmword [0x1400c63e0]
xor eax, eax
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x1400c63f0]
mov qword [rbx + 0x20], rax
mov dword [rbx + 0x28], eax
movups xmmword [rbx + 0x10], xmm1
add rsp, 0x20
pop rbx
ret
Function at 0x140083680
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov r9, rdx
mov r8, rcx
mov edx, 8
lea ecx, [rdx + 6]
jmp 0x140083680
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
xor r11d, r11d
mov r10d, edx
lea esi, [rcx*4 + 4]
mov rdi, r8
lea rbp, [0x1400c6420]
test edx, edx
je 0x1400836f1
mov rbx, r8
lea eax, [r11*4]
inc r11d
movzx edx, byte [rax + r9 + 3]
lea rbx, [rbx + 4]
shl edx, 8
mov ecx, eax
movzx eax, byte [rax + r9 + 2]
or edx, eax
shl edx, 8
movzx eax, byte [rcx + r9 + 1]
or edx, eax
movzx eax, byte [rcx + r9]
shl edx, 8
or edx, eax
mov dword [rbx - 4], edx
cmp r11d, r10d
jb 0x1400836b2
mov r9d, r10d
cmp r10d, esi
jae 0x1400837d4
lea r11, [r8 + r10*4]
lea rbx, [0x1400c6430]
nop dword [rax + rax]
lea eax, [r9 - 1]
xor edx, edx
mov ecx, dword [rdi + rax*4]
mov eax, r9d
div r10d
test edx, edx
jne 0x14008376c
mov r8d, ecx
movzx eax, cl
movzx ecx, byte [rax + rbx]
mov eax, r8d
shr rax, 0x18
shl ecx, 8
movzx eax, byte [rax + rbx]
or ecx, eax
mov eax, r8d
shr rax, 0x10
shl ecx, 8
movzx edx, al
shr r8, 8
movzx eax, byte [rdx + rbx]
or ecx, eax
movzx eax, r8b
shl ecx, 8
movzx edx, byte [rax + rbx]
movzx eax, byte [rbp]
or ecx, edx
xor ecx, eax
inc rbp
jmp 0x1400837b8
cmp r10d, 6
jbe 0x1400837b8
cmp edx, 4
jne 0x1400837b8
mov r8, rcx
mov rax, rcx
shr rax, 0x10
movzx ecx, al
mov rax, r8
shr rax, 0x18
movzx ecx, byte [rcx + rbx]
movzx eax, byte [rax + rbx]
shl eax, 8
or ecx, eax
mov rax, r8
shr rax, 8
movzx edx, al
shl ecx, 8
movzx eax, byte [rdx + rbx]
or ecx, eax
movzx eax, r8b
shl ecx, 8
movzx edx, byte [rax + rbx]
or ecx, edx
mov eax, r9d
inc r9d
sub eax, r10d
xor ecx, dword [rdi + rax*4]
mov dword [r11], ecx
add r11, 4
cmp r9d, esi
jb 0x140083710
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x140085d2c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140085d76
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140085d76
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140085d76
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140085d76
cmp dword [rcx + 0x84], 0xe
jbe 0x140085d76
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140085d78
xor al, al
add rsp, 0x28
ret

Function at 0x140098544
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140098370
Function at 0x1400ad200
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400ad228
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400ad228
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14008eaa0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14008eac0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret

Function at 0x14008eb00
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14008eb20
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret

Function at 0x14008eb60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14008eb83
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x14008ebe0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14008ec03
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret

Function at 0x14008ec60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14008ec89
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret
Function at 0x14008ecf0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14008ed19
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
repz ret

Function at 0x14008ed80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14008eddf

Function at 0x14008edd0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.14008edd0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
repz ret

Function at 0x14008ee60
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14008eebf
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14008eeb0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
repz ret
Function at 0x14008ef40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesenc xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14008ef9a

Function at 0x14008efba
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14008ef90
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
repz ret

Function at 0x14008f050
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesdec xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14008f0aa
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14008f0a0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
aesdeclast xmm8, xmm0
aesdeclast xmm9, xmm0
repz ret