joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff65ee00000
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov r11, rcx
movaps xmmword [rsp], xmm6
movdqu xmm6, xmmword [rdx]
lea rdi, str.cw
pshufd xmm0, xmm6, 0x55
mov rbx, rdx
movd eax, xmm0
movdqu xmm5, xmmword [r11]
pshufd xmm0, xmm6, 0xff
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r10d, byte [r8 + rdi]
movzx eax, byte [rax + rdi]
pxor xmm4, xmmword [r11]
shl eax, 8
or r10d, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl r10d, 8
movzx eax, byte [rcx + rdi]
or r10d, eax
movzx eax, r9b
shl r10d, 8
movzx ecx, byte [rax + rdi]
or r10d, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r10d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov eax, r10d
or r8d, ecx
ror eax, 8
xor eax, 2
mov ecx, r8d
ror ecx, 8
xor ecx, 2
movd xmm2, r8d
movd xmm0, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, ecx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpcklqdq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqu xmmword [r11], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
movdqa xmm5, xmm6
or r9d, eax
pshufd xmm0, xmm1, 0xff
shl r9d, 8
mov eax, edx
shr rax, 8
movzx ecx, al
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
pxor xmm4, xmm6
movaps xmm6, xmmword [rsp]
movzx eax, byte [rcx + rdi]
or r9d, eax
movzx eax, dl
shl r9d, 8
movzx ecx, byte [rax + rdi]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
or r8d, ecx
mov ecx, r9d
mov eax, r8d
ror eax, 8
ror ecx, 8
movd xmm2, r8d
movd xmm1, eax
punpckldq xmm2, xmm1
movd xmm0, ecx
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
pxor xmm0, xmm4
punpcklqdq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xaa
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x7ff65ee00220
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov r11, rcx
movaps xmmword [rsp], xmm6
movdqu xmm6, xmmword [rdx]
lea rdi, str.cw
pshufd xmm0, xmm6, 0x55
mov rbx, rdx
movd eax, xmm0
movdqu xmm5, xmmword [r11]
pshufd xmm0, xmm6, 0xff
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r10d, byte [r8 + rdi]
movzx eax, byte [rax + rdi]
pxor xmm4, xmmword [r11]
shl eax, 8
or r10d, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl r10d, 8
movzx eax, byte [rcx + rdi]
or r10d, eax
movzx eax, r9b
shl r10d, 8
movzx ecx, byte [rax + rdi]
or r10d, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r10d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov eax, r10d
or r8d, ecx
ror eax, 8
xor eax, 4
mov ecx, r8d
ror ecx, 8
xor ecx, 4
movd xmm2, r8d
movd xmm0, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, ecx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpcklqdq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqu xmmword [r11], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
movdqa xmm5, xmm6
or r9d, eax
pshufd xmm0, xmm1, 0xff
shl r9d, 8
mov eax, edx
shr rax, 8
movzx ecx, al
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
pxor xmm4, xmm6
movaps xmm6, xmmword [rsp]
movzx eax, byte [rcx + rdi]
or r9d, eax
movzx eax, dl
shl r9d, 8
movzx ecx, byte [rax + rdi]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
or r8d, ecx
mov ecx, r9d
mov eax, r8d
ror eax, 8
ror ecx, 8
movd xmm2, r8d
movd xmm1, eax
punpckldq xmm2, xmm1
movd xmm0, ecx
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
pxor xmm0, xmm4
punpcklqdq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xaa
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x7ff65ee00440
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov r11, rcx
movaps xmmword [rsp], xmm6
movdqu xmm6, xmmword [rdx]
lea rdi, str.cw
pshufd xmm0, xmm6, 0x55
mov rbx, rdx
movd eax, xmm0
movdqu xmm5, xmmword [r11]
pshufd xmm0, xmm6, 0xff
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r10d, byte [r8 + rdi]
movzx eax, byte [rax + rdi]
pxor xmm4, xmmword [r11]
shl eax, 8
or r10d, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl r10d, 8
movzx eax, byte [rcx + rdi]
or r10d, eax
movzx eax, r9b
shl r10d, 8
movzx ecx, byte [rax + rdi]
or r10d, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r10d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov eax, r10d
or r8d, ecx
ror eax, 8
xor eax, 8
mov ecx, r8d
ror ecx, 8
xor ecx, 8
movd xmm2, r8d
movd xmm0, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, ecx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpcklqdq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqu xmmword [r11], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
movdqa xmm5, xmm6
or r9d, eax
pshufd xmm0, xmm1, 0xff
shl r9d, 8
mov eax, edx
shr rax, 8
movzx ecx, al
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
pxor xmm4, xmm6
movaps xmm6, xmmword [rsp]
movzx eax, byte [rcx + rdi]
or r9d, eax
movzx eax, dl
shl r9d, 8
movzx ecx, byte [rax + rdi]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
or r8d, ecx
mov ecx, r9d
mov eax, r8d
ror eax, 8
ror ecx, 8
movd xmm2, r8d
movd xmm1, eax
punpckldq xmm2, xmm1
movd xmm0, ecx
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
pxor xmm0, xmm4
punpcklqdq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xaa
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x7ff65ee08350
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x68
movdqa xmm2, xmmword [0x7ff65f153ee0]
mov r10, rcx
movdqa xmm3, xmmword [0x7ff65f153e90]
mov rax, rcx
movdqa xmm4, xmmword [0x7ff65f153f00]
mov r11, r8
movdqa xmm5, xmmword [0x7ff65f153df0]
lea r8, [rcx + 0x1c00]
movdqu xmm0, xmmword [r9]
lea rcx, [rdx - 0x1c00]
movdqu xmm1, xmmword [r9 + 0x10]
add rcx, rax
movaps xmmword [rsp + 0x50], xmm6
mov edx, 2
movdqu xmm6, xmmword [r9 + 0x20]
movaps xmmword [rsp + 0x40], xmm7
movdqu xmm7, xmmword [r9 + 0x30]
movaps xmmword [rsp + 0x30], xmm8
movdqa xmm8, xmmword [0x7ff65f153eb0]
movaps xmmword [rsp + 0x20], xmm9
movdqa xmm9, xmmword [0x7ff65f153ae0]
movaps xmmword [rsp + 0x10], xmm10
movdqa xmm10, xmmword [0x7ff65f153b50]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x7ff65f153cc0]
nop
cmp rax, rcx
jae 0x7ff65ee084a3
nop dword [rax]
aesenc xmm2, xmmword [rax]
aesdec xmm3, xmmword [rax + 0x10]
aesenc xmm4, xmmword [rax + 0x20]
aesdec xmm5, xmmword [rax + 0x30]
aesenc xmm2, xmmword [rax + 0x40]
aesdec xmm3, xmmword [rax + 0x50]
aesenc xmm4, xmmword [rax + 0x60]
aesdec xmm5, xmmword [rax + 0x70]
aesdec xmm0, xmm8
movdqu xmmword [rax], xmm0
aesenc xmm1, xmm9
movdqu xmmword [rax + 0x10], xmm1
aesdec xmm6, xmm10
movdqu xmmword [rax + 0x20], xmm6
aesenc xmm7, xmm11
movdqu xmmword [rax + 0x30], xmm7
aesdec xmm0, xmm8
movdqu xmmword [rax + 0x40], xmm0
aesenc xmm1, xmm9
movdqu xmmword [rax + 0x50], xmm1
aesdec xmm6, xmm10
aesenc xmm7, xmm11
movdqu xmmword [rax + 0x60], xmm6
movdqu xmmword [rax + 0x70], xmm7
prefetcht0 byte [r8]
prefetcht0 byte [r8 + 0x40]
sub rax, 0xffffffffffffff80
lea r8, [r8 + 0x80]
cmp rax, rcx
jb 0x7ff65ee08400
add rcx, 0x1c00
mov r8, r10
sub rdx, 1
jne 0x7ff65ee083f0
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
movdqu xmmword [r9], xmm0
movdqa xmm0, xmmword [0x7ff65f153ab0]
movdqu xmmword [r9 + 0x10], xmm1
movdqa xmm1, xmmword [0x7ff65f153f10]
movdqu xmmword [r9 + 0x20], xmm6
movaps xmm6, xmmword [rsp + 0x50]
movdqu xmmword [r9 + 0x30], xmm7
movaps xmm7, xmmword [rsp + 0x40]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm4, xmm0
aesdec xmm5, xmm0
aesenc xmm2, xmm1
aesdec xmm3, xmm1
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [r11], xmm2
movdqu xmmword [r11 + 0x10], xmm3
movdqu xmmword [r11 + 0x20], xmm4
movdqu xmmword [r11 + 0x30], xmm5
add rsp, 0x68
ret
Function at 0x7ff65ee10d10
Capabilities:
Create thread

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r12, r8
mov rbx, rdx
mov r14, rcx
mov rdx, qword [rcx]
mov rdi, rbx
sub rdi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r9, 0xfffffffffffffff
cmp rax, r9
je 0x7ff65ee10f0c
lea r8, [rax + 1]
mov qword [rsp + 0xa8], r8
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r9
sub rax, rdx
cmp rcx, rax
jbe 0x7ff65ee10e4e
mov rsi, r9
mov qword [rsp + 0x98], r9
mov rcx, rsi
shl rcx, 4
call fcn.7ff65ec844e0
mov r15, rax
mov qword [rsp + 0x38], rax
and rdi, 0xfffffffffffffff0
lea r13, [rdi + rax]
lea rdi, [r13 + 0x10]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x90], rdi
mov ecx, 0x30
call fcn.7ff65efe06d0
movups xmm0, xmmword [r12]
movups xmmword [rax], xmm0
movups xmm1, xmmword [r12 + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [r12 + 0x20]
movups xmmword [rax + 0x20], xmm0
mov qword [rsp + 0x40], rax
lea r12, [r13 + 8]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x7ff65ee10ff0]
xor edx, edx
xor ecx, ecx
call fcn.7ff65efeeb2c
mov qword [r13], rax
test rax, rax
je 0x7ff65ee10ef9
mov qword [rsp + 0x90], r13
mov rcx, qword [r14 + 8]
mov rax, qword [r14]
mov rdx, r15
cmp rbx, rcx
jne 0x7ff65ee10e72
cmp rax, rcx
je 0x7ff65ee10ed0
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rcx
jne 0x7ff65ee10e30
jmp 0x7ff65ee10ed0
lea rax, [rdx + rcx]
mov rsi, r8
cmp rax, r8
cmovae rsi, rax
mov qword [rsp + 0x98], rsi
cmp rsi, r9
ja 0x7ff65ee10f12
jmp 0x7ff65ee10d87
cmp rax, rbx
je 0x7ff65ee10e9d
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x7ff65ee10e80
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x90], r15
cmp rbx, rcx
je 0x7ff65ee10ed0
sub rdi, rbx
nop dword [rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rdi + rbx], xmm1
add rbx, 0x10
cmp rbx, rcx
jne 0x7ff65ee10eb0
nop word [rax + rax]
mov r9, rsi
mov r8, qword [rsp + 0xa8]
mov rdx, r15
mov rcx, r14
call fcn.7ff65ee10f20
mov rax, r13
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [r12], 0
mov ecx, 6
call fcn.7ff65efdec80
nop
call fcn.7ff65ec94750
int3
call fcn.7ff65ec842d0
int3
Function at 0x7ff65ee11260
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [str.e41k2]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x7ff65ee11353
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x7ff65ee1133a
xorps xmm0, xmm0
mov byte [rsp + 0x20], dil
xor edx, edx
mov word [rsp + 0x21], 0x100
mov r8d, 0xf0
mov byte [rsp + 0x23], 1
movups xmmword [rsp + 0x32], xmm0
mov dword [rsp + 0x24], 0
movups xmmword [rsp + 0x42], xmm0
mov word [rsp + 0x30], 0
call fcn.7ff65efe35e0
movaps xmm0, xmmword [0x7ff65f0fb0d0]
mov rax, qword [rsp + 0x20]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x7ff65f0fb0e0]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x7ff65f0fb0f0]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x7ff65f0fb100]
movups xmmword [rbx + 0x30], xmm1
xor qword [rbx], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x38]
xor qword [rbx + 0x18], rax
mov rax, qword [rsp + 0x40]
xor qword [rbx + 0x20], rax
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x28], rax
xor qword [rbx + 8], 0
movzx eax, dil
mov dword [rbx + 0xe4], eax
xor eax, eax
jmp 0x7ff65ee11358
cmp byte [rcx + 0xe8], 0
je 0x7ff65ee1134b
mov qword [rcx + 0x58], 0xffffffffffffffff
mov qword [rcx + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.7ff65efe06b0
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x7ff65ee158b0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0xab0]
mov ecx, dword [0x7ff65f42e918]
movdqa xmm4, xmmword [0x7ff65f153eb0]
add rcx, rax
movdqa xmm5, xmmword [0x7ff65f153ae0]
movdqu xmm0, xmmword [rdx]
movdqu xmm1, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm3, xmmword [rdx + 0x30]
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm6, xmmword [0x7ff65f153b50]
movaps xmmword [rsp], xmm7
movdqa xmm7, xmmword [0x7ff65f153cc0]
cmp rax, rcx
jae 0x7ff65ee15940
nop word [rax + rax]
aesdec xmm0, xmm4
aesenc xmm1, xmm5
aesdec xmm2, xmm6
aesenc xmm3, xmm7
movdqu xmmword [rax], xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmmword [rax + 0x20], xmm2
movdqu xmmword [rax + 0x30], xmm3
add rax, 0x40
cmp rax, rcx
jb 0x7ff65ee15910
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp]
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
add rsp, 0x28
ret

Function at 0x7ff65ee15ab0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x68
movdqa xmm4, xmmword [0x7ff65f42e9a0]
lea rax, [rcx + 0x40]
mov ecx, dword [0x7ff65f42e91c]
movdqa xmm5, xmmword [0x7ff65f42e9b0]
movdqu xmm0, xmmword [rdx]
movdqu xmm1, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
lea r8d, [rcx*8 + 0x80]
movdqu xmm3, xmmword [rdx + 0x30]
add r8, rax
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x7ff65f42e9c0]
movaps xmmword [rsp + 0x40], xmm7
movdqa xmm7, xmmword [0x7ff65f42e9d0]
movaps xmmword [rsp + 0x30], xmm8
movdqa xmm8, xmmword [0x7ff65f42e9e0]
movaps xmmword [rsp + 0x20], xmm9
movdqa xmm9, xmmword [0x7ff65f42e9f0]
movaps xmmword [rsp + 0x10], xmm10
movdqa xmm10, xmmword [0x7ff65f42ea00]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x7ff65f42ea10]
cmp rax, r8
jae 0x7ff65ee15bc4
nop word [rax + rax]
aesdec xmm0, xmm4
aesenc xmm1, xmm4
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm0, xmm5
aesenc xmm1, xmm5
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm0, xmm6
aesenc xmm1, xmm6
aesdec xmm2, xmm10
aesenc xmm3, xmm10
aesdec xmm0, xmm7
aesenc xmm1, xmm7
aesdec xmm2, xmm11
aesenc xmm3, xmm11
movdqu xmmword [rax], xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmmword [rax + 0x20], xmm2
movdqu xmmword [rax + 0x30], xmm3
add rax, 0x40
cmp rax, r8
jb 0x7ff65ee15b50
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
add rsp, 0x68
ret
Function at 0x7ff65ee18db0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, r9
mov rbx, rdx
mov r14, rcx
mov rdx, qword [rcx]
mov rdi, rbx
sub rdi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r9, 0xfffffffffffffff
cmp rax, r9
je 0x7ff65ee18fe9
lea r8, [rax + 1]
mov qword [rsp + 0x30], r8
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r9
sub rax, rdx
cmp rcx, rax
jbe 0x7ff65ee18f2e
mov rsi, r9
mov qword [rsp + 0x98], r9
mov rcx, rsi
shl rcx, 4
call fcn.7ff65ec844e0
mov r15, rax
mov qword [rsp + 0x40], rax
and rdi, 0xfffffffffffffff0
lea r12, [rdi + rax]
lea rdi, [r12 + 0x10]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x90], rdi
mov ecx, 0x28
call fcn.7ff65efe06d0
mov r9, rax
mov rax, qword [rsp + 0xc8]
mov ecx, dword [rax]
mov dword [r9], ecx
mov rax, qword [rsp + 0xc0]
mov ecx, dword [rax]
mov dword [r9 + 4], ecx
mov rax, qword [rsp + 0xb8]
mov ecx, dword [rax]
mov dword [r9 + 8], ecx
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax]
mov qword [r9 + 0x10], rcx
mov rax, qword [r13]
mov qword [r9 + 0x18], rax
mov rax, qword [rsp + 0xa0]
mov qword [r9 + 0x20], rax
mov qword [rsp + 0x48], r9
lea r13, [r12 + 8]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0
lea r8, [0x7ff65ee19020]
xor edx, edx
xor ecx, ecx
call fcn.7ff65efeeb2c
mov qword [r12], rax
test rax, rax
je 0x7ff65ee18fd6
mov qword [rsp + 0x90], r12
mov rcx, qword [r14 + 8]
mov rax, qword [r14]
mov rdx, r15
cmp rbx, rcx
jne 0x7ff65ee18f52
cmp rax, rcx
je 0x7ff65ee18fb0
nop dword [rax]
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rcx
jne 0x7ff65ee18f10
jmp 0x7ff65ee18fb0
lea rax, [rdx + rcx]
mov rsi, r8
cmp rax, r8
cmovae rsi, rax
mov qword [rsp + 0x98], rsi
cmp rsi, r9
ja 0x7ff65ee18fef
jmp 0x7ff65ee18e28
cmp rax, rbx
je 0x7ff65ee18f7d
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x7ff65ee18f60
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x90], r15
cmp rbx, rcx
je 0x7ff65ee18fb0
sub rdi, rbx
nop dword [rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rbx + rdi], xmm1
add rbx, 0x10
cmp rbx, rcx
jne 0x7ff65ee18f90
nop word [rax + rax]
mov r9, rsi
mov r8, qword [rsp + 0x30]
mov rdx, r15
mov rcx, r14
call fcn.7ff65ee10f20
mov rax, r12
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [r13], 0
mov ecx, 6
call fcn.7ff65efdec80
nop
call fcn.7ff65ec94750
int3
call fcn.7ff65ec842d0
int3
Function at 0x7ff65ee19280
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
lea rax, vtable.xmrig::RxQueue.0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
xor ebp, ebp
mov qword [rcx + 0x10], rbp
mov dword [rcx + 0x18], ebp
mov qword [rcx + 0x20], rbp
mov qword [rcx + 0x28], rbp
mov qword [rcx + 0x30], rbp
mov dword [rcx + 0x38], ebp
add rcx, 0x40
call fcn.7ff65efdf8c8
nop
lea rcx, [rsi + 0x88]
lea edx, [rbp + 2]
call fcn.7ff65efdef20
nop
mov qword [rsi + 0xd8], rbp
mov qword [rsi + 0xe0], rbp
xorps xmm0, xmm0
movups xmmword [rsi + 0xe8], xmm0
mov qword [rsi + 0xf8], rbp
mov qword [rsi + 0x100], rbp
mov qword [rsi + 0x108], rbp
lea ecx, [rbp + 0x18]
call fcn.7ff65efe06d0
mov rdi, rax
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_obj2_class_xmrig::Async_.0
mov qword [rdi], rax
lea rbx, [rdi + 0x10]
mov rdx, rsi
mov rcx, rbx
call fcn.7ff65ec96280
nop
mov qword [rsi + 0xd8], rbx
mov rbx, qword [rsi + 0xe0]
mov qword [rsi + 0xe0], rdi
test rbx, rbx
je 0x7ff65ee19385
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x7ff65ee19385
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x7ff65ee19385
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov ecx, 0x10
call fcn.7ff65efe06d0
mov qword [rax], rsi
lea rcx, [0x7ff65ee198a0]
mov qword [rax + 8], rcx
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x7ff65ececa90]
xor edx, edx
xor ecx, ecx
call fcn.7ff65efeeb2c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x7ff65ee193f8
cmp dword [rsi + 0xf0], 0
jne 0x7ff65ee193f2
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi + 0xe8], xmm0
mov rax, rsi
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
call fcn.7ff65efebbe8
nop
mov dword [rsp + 0x38], ebp
mov ecx, 6
call fcn.7ff65efdec80
int3