joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff7ed4a3260
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rdi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x7ff7ed4a32a3
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call fcn.7ff7ed6b7250
jmp 0x7ff7ed4a34a7
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.7ff7ed391778
mov r8, qword [rbx + 8]
lea r15, [r14 + rdi]
mov rcx, r15
mov r9d, r12d
mov edx, edi
call fcn.7ff7ed391778
lea rsi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rsi]
lea r13, [r14 + rdi*2]
mov rcx, r13
mov edx, edi
call fcn.7ff7ed391778
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rdi*2]
add rcx, rdi
mov r9d, r12d
mov edx, edi
call fcn.7ff7ed391778
xor ecx, ecx
mov rax, qword [rbx + rcx*8]
inc rcx
mov byte [rax + 0x1b0], 1
cmp rcx, 4
jl 0x7ff7ed4a32f8
cmp byte [0x7ff7ed8703d1], 0
mov r12d, 0x80000
mov rcx, qword [rbx]
je 0x7ff7ed4a3341
mov rdx, qword [rbx + 8]
mov r9b, 1
mov r8d, r12d
call fcn.7ff7ed4cd120
mov rdx, qword [rbx + 0x18]
mov r9b, 1
mov rcx, qword [rsi]
mov r8d, r12d
call fcn.7ff7ed4cd120
jmp 0x7ff7ed4a3360
call fcn.7ff7ed43ca80
mov rcx, qword [rbx + 8]
call fcn.7ff7ed43ca80
mov rcx, qword [rsi]
call fcn.7ff7ed43ca80
mov rcx, qword [rbx + 0x18]
call fcn.7ff7ed43ca80
mov r10, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rsi
mov r9d, 2
mov rax, qword [r10 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r10 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rdi
mov qword [rcx + 0xf0], rax
sub r9, 1
jne 0x7ff7ed4a3398
lea rax, [0x7ff7ed74b440]
mov rcx, rbx
mov qword [r10 + 0xe8], rax
call qword [0x7ff7ed8703a8]
cmp byte [0x7ff7ed8703d1], 0
mov rcx, qword [rbx]
je 0x7ff7ed4a33ff
mov rdx, qword [rbx + 8]
mov r9b, 1
mov r8, r12
call fcn.7ff7ed4cda94
mov rdx, qword [rbx + 0x18]
mov r9b, 1
mov rcx, qword [rsi]
mov r8, r12
call fcn.7ff7ed4cda94
jmp 0x7ff7ed4a341e
call fcn.7ff7ed442100
mov rcx, qword [rbx + 8]
call fcn.7ff7ed442100
mov rcx, qword [rsi]
call fcn.7ff7ed442100
mov rcx, qword [rbx + 0x18]
call fcn.7ff7ed442100
mov rcx, qword [rbx]
mov edi, 0x18
mov edx, edi
call fcn.7ff7ed3918b8
mov rcx, qword [rbx + 8]
mov edx, edi
call fcn.7ff7ed3918b8
mov rcx, qword [rsi]
mov edx, edi
call fcn.7ff7ed3918b8
mov rcx, qword [rbx + 0x18]
mov edx, edi
call fcn.7ff7ed3918b8
mov rcx, qword [rbx]
lea rdi, [0x7ff7ed74c940]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rsi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x7ff7ed4a34c4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rsi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x7ff7ed4a3507
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call fcn.7ff7ed6b7250
jmp 0x7ff7ed4a36f5
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.7ff7ed391778
mov r8, qword [rbx + 8]
lea r15, [r14 + rsi]
mov rcx, r15
mov r9d, r12d
mov edx, esi
call fcn.7ff7ed391778
lea rdi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rdi]
lea r13, [r14 + rsi*2]
mov rcx, r13
mov edx, esi
call fcn.7ff7ed391778
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rsi*2]
add rcx, rsi
mov r9d, r12d
mov edx, esi
call fcn.7ff7ed391778
cmp byte [0x7ff7ed8703d1], 0
mov r12d, 0x100000
mov rcx, qword [rbx]
je 0x7ff7ed4a358f
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8d, r12d
call fcn.7ff7ed4cd120
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8d, r12d
call fcn.7ff7ed4cd120
jmp 0x7ff7ed4a35ae
call fcn.7ff7ed43d38c
mov rcx, qword [rbx + 8]
call fcn.7ff7ed43d38c
mov rcx, qword [rdi]
call fcn.7ff7ed43d38c
mov rcx, qword [rbx + 0x18]
call fcn.7ff7ed43d38c
mov r9, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rdi
mov r10d, 2
mov rax, qword [r9 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r9 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rsi
mov qword [rcx + 0xf0], rax
sub r10, 1
jne 0x7ff7ed4a35e6
lea rax, [0x7ff7ed74b440]
mov rcx, rbx
mov qword [r9 + 0xe8], rax
call qword [0x7ff7ed8703b8]
cmp byte [0x7ff7ed8703d1], 0
mov rcx, qword [rbx]
je 0x7ff7ed4a364d
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8, r12
call fcn.7ff7ed4cda94
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8, r12
call fcn.7ff7ed4cda94
jmp 0x7ff7ed4a366c
call fcn.7ff7ed442a4c
mov rcx, qword [rbx + 8]
call fcn.7ff7ed442a4c
mov rcx, qword [rdi]
call fcn.7ff7ed442a4c
mov rcx, qword [rbx + 0x18]
call fcn.7ff7ed442a4c
mov rcx, qword [rbx]
mov esi, 0x18
mov edx, esi
call fcn.7ff7ed3918b8
mov rcx, qword [rbx + 8]
mov edx, esi
call fcn.7ff7ed3918b8
mov rcx, qword [rdi]
mov edx, esi
call fcn.7ff7ed3918b8
mov rcx, qword [rbx + 0x18]
mov edx, esi
call fcn.7ff7ed3918b8
mov rcx, qword [rbx]
lea rsi, [0x7ff7ed74c940]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rdi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x7ff7ed4a3714
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rsi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x7ff7ed4a3757
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call fcn.7ff7ed6b7250
jmp 0x7ff7ed4a3945
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.7ff7ed391778
mov r8, qword [rbx + 8]
lea r15, [r14 + rsi]
mov rcx, r15
mov r9d, r12d
mov edx, esi
call fcn.7ff7ed391778
lea rdi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rdi]
lea r13, [r14 + rsi*2]
mov rcx, r13
mov edx, esi
call fcn.7ff7ed391778
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rsi*2]
add rcx, rsi
mov r9d, r12d
mov edx, esi
call fcn.7ff7ed391778
cmp byte [0x7ff7ed8703d1], 0
mov r12d, 0x200000
mov rcx, qword [rbx]
je 0x7ff7ed4a37df
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8d, r12d
call fcn.7ff7ed4cd120
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8d, r12d
call fcn.7ff7ed4cd120
jmp 0x7ff7ed4a37fe
call fcn.7ff7ed43dc00
mov rcx, qword [rbx + 8]
call fcn.7ff7ed43dc00
mov rcx, qword [rdi]
call fcn.7ff7ed43dc00
mov rcx, qword [rbx + 0x18]
call fcn.7ff7ed43dc00
mov r9, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rdi
mov r10d, 2
mov rax, qword [r9 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r9 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rsi
mov qword [rcx + 0xf0], rax
sub r10, 1
jne 0x7ff7ed4a3836
lea rax, [0x7ff7ed74b440]
mov rcx, rbx
mov qword [r9 + 0xe8], rax
call qword [0x7ff7ed8703b0]
cmp byte [0x7ff7ed8703d1], 0
mov rcx, qword [rbx]
je 0x7ff7ed4a389d
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8, r12
call fcn.7ff7ed4cda94
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8, r12
call fcn.7ff7ed4cda94
jmp 0x7ff7ed4a38bc
call fcn.7ff7ed443348
mov rcx, qword [rbx + 8]
call fcn.7ff7ed443348
mov rcx, qword [rdi]
call fcn.7ff7ed443348
mov rcx, qword [rbx + 0x18]
call fcn.7ff7ed443348
mov rcx, qword [rbx]
mov esi, 0x18
mov edx, esi
call fcn.7ff7ed3918b8
mov rcx, qword [rbx + 8]
mov edx, esi
call fcn.7ff7ed3918b8
mov rcx, qword [rdi]
mov edx, esi
call fcn.7ff7ed3918b8
mov rcx, qword [rbx + 0x18]
mov edx, esi
call fcn.7ff7ed3918b8
mov rcx, qword [rbx]
lea rsi, [0x7ff7ed74c940]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rdi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x7ff7ed4c4ed0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
pshufd xmm0, xmmword [rdx], 0x55
lea r10, [0x7ff7ed74c840]
mov rbp, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov r14, rdx
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
movzx esi, byte [r8 + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or esi, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl esi, 8
movzx eax, byte [rcx + r10]
or esi, eax
movzx eax, r9b
shl esi, 8
movzx ecx, byte [rax + r10]
or esi, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r10]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r10]
or edi, ecx
mov ecx, edi
call fcn.7ff7ed6c8418
mov ebx, eax
mov edx, 8
mov ecx, esi
xor ebx, 1
call fcn.7ff7ed6c8418
movd xmm1, ebx
lea rcx, [rsp + 0x20]
xor eax, 1
movd xmm2, edi
punpckldq xmm2, xmm1
movd xmm3, esi
movd xmm0, eax
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
movdqu xmm2, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm0, xmm2
pshufd xmm4, xmm3, 0xff
xorps xmm0, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm4
movdqu xmmword [rbp], xmm1
movdqa xmmword [rsp + 0x20], xmm1
call fcn.7ff7ed4c54f0
movdqu xmm2, xmmword [r14]
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movdqa xmm0, xmm2
xorps xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm3
movdqu xmmword [r14], xmm1
add rsp, 0x30
pop r14
ret
Function at 0x7ff7ed4c5058
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
pshufd xmm0, xmmword [rdx], 0x55
lea r10, [0x7ff7ed74c840]
mov rbp, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov r14, rdx
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
movzx esi, byte [r8 + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or esi, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl esi, 8
movzx eax, byte [rcx + r10]
or esi, eax
movzx eax, r9b
shl esi, 8
movzx ecx, byte [rax + r10]
or esi, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r10]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r10]
or edi, ecx
mov ecx, edi
call fcn.7ff7ed6c8418
mov ebx, eax
mov edx, 8
mov ecx, esi
xor ebx, 2
call fcn.7ff7ed6c8418
movd xmm1, ebx
lea rcx, [rsp + 0x20]
xor eax, 2
movd xmm2, edi
punpckldq xmm2, xmm1
movd xmm3, esi
movd xmm0, eax
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
movdqu xmm2, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm0, xmm2
pshufd xmm4, xmm3, 0xff
xorps xmm0, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm4
movdqu xmmword [rbp], xmm1
movdqa xmmword [rsp + 0x20], xmm1
call fcn.7ff7ed4c54f0
movdqu xmm2, xmmword [r14]
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movdqa xmm0, xmm2
xorps xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm3
movdqu xmmword [r14], xmm1
add rsp, 0x30
pop r14
ret
Function at 0x7ff7ed4c51e0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
pshufd xmm0, xmmword [rdx], 0x55
lea r10, [0x7ff7ed74c840]
mov rbp, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov r14, rdx
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
movzx esi, byte [r8 + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or esi, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl esi, 8
movzx eax, byte [rcx + r10]
or esi, eax
movzx eax, r9b
shl esi, 8
movzx ecx, byte [rax + r10]
or esi, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r10]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r10]
or edi, ecx
mov ecx, edi
call fcn.7ff7ed6c8418
mov ebx, eax
mov edx, 8
mov ecx, esi
xor ebx, 4
call fcn.7ff7ed6c8418
movd xmm1, ebx
lea rcx, [rsp + 0x20]
xor eax, 4
movd xmm2, edi
punpckldq xmm2, xmm1
movd xmm3, esi
movd xmm0, eax
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
movdqu xmm2, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm0, xmm2
pshufd xmm4, xmm3, 0xff
xorps xmm0, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm4
movdqu xmmword [rbp], xmm1
movdqa xmmword [rsp + 0x20], xmm1
call fcn.7ff7ed4c54f0
movdqu xmm2, xmmword [r14]
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movdqa xmm0, xmm2
xorps xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm3
movdqu xmmword [r14], xmm1
add rsp, 0x30
pop r14
ret
Function at 0x7ff7ed4c5368
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
pshufd xmm0, xmmword [rdx], 0x55
lea r10, [0x7ff7ed74c840]
mov rbp, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov r14, rdx
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
movzx esi, byte [r8 + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or esi, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl esi, 8
movzx eax, byte [rcx + r10]
or esi, eax
movzx eax, r9b
shl esi, 8
movzx ecx, byte [rax + r10]
or esi, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r10]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r10]
or edi, ecx
mov ecx, edi
call fcn.7ff7ed6c8418
mov ebx, eax
mov edx, 8
mov ecx, esi
xor ebx, 8
call fcn.7ff7ed6c8418
movd xmm1, ebx
lea rcx, [rsp + 0x20]
xor eax, 8
movd xmm2, edi
punpckldq xmm2, xmm1
movd xmm3, esi
movd xmm0, eax
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
movdqu xmm2, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm0, xmm2
pshufd xmm4, xmm3, 0xff
xorps xmm0, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm4
movdqu xmmword [rbp], xmm1
movdqa xmmword [rsp + 0x20], xmm1
call fcn.7ff7ed4c54f0
movdqu xmm2, xmmword [r14]
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movdqa xmm0, xmm2
xorps xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
xorps xmm1, xmm0
xorps xmm1, xmm2
xorps xmm1, xmm3
movdqu xmmword [r14], xmm1
add rsp, 0x30
pop r14
ret

Function at 0x7ff7ed4c54f0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
pshufd xmm0, xmmword [rcx], 0x55
lea r9, [0x7ff7ed74c840]
movd eax, xmm0
pshufd xmm0, xmmword [rcx], 0xff
mov r8d, eax
shr rax, 0x10
movzx edx, al
mov eax, r8d
shr rax, 0x18
movzx esi, byte [rdx + r9]
movzx eax, byte [rax + r9]
shl eax, 8
or esi, eax
mov eax, r8d
shr rax, 8
movzx edx, al
shl esi, 8
movzx eax, byte [rdx + r9]
or esi, eax
movzx eax, r8b
shl esi, 8
movzx edx, byte [rax + r9]
movd eax, xmm0
or esi, edx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r9]
movzx eax, byte [rax + r9]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r9]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r9]
or edi, ecx
mov ecx, edi
call fcn.7ff7ed6c8418
mov edx, 8
mov ecx, esi
mov ebx, eax
call fcn.7ff7ed6c8418
movd xmm2, ebx
mov rbx, qword [rsp + 0x30]
movd xmm0, esi
mov rsi, qword [rsp + 0x38]
movd xmm1, eax
movd xmm3, edi
punpckldq xmm0, xmm1
punpckldq xmm3, xmm2
punpcklqdq xmm0, xmm3
add rsp, 0x20
pop rdi
ret
Function at 0x7ff7ed4ce11c
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm4, xmmword [rcx + 0x10]
movdqu xmm3, xmmword [rcx]
vbroadcastf128 ymm1, xmmword [rcx]
vmovdqu ymmword [rdx], ymm1
mov rax, qword [rsp + 0x28]
vmovdqa xmm1, xmm3
vpslldq xmm1, xmm1, 4
vinsertf128 ymm0, ymm4, xmm4, 1
vmovdqu ymmword [r8], ymm0
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm3
vmovdqa xmm3, xmm1
vxorps xmm3, xmm3, xmm0
vpslldq xmm1, xmm1, 4
vxorps xmm3, xmm3, xmm1
vaeskeygenassist xmm0, xmm4, 1
vpshufd xmm1, xmm0, 0xff
vxorps xmm3, xmm3, xmm1
vmovdqa xmm1, xmm4
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm4
vmovdqa xmm4, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm4, xmm4, xmm0
vxorps xmm4, xmm4, xmm1
vaeskeygenassist xmm0, xmm3, 0
vpshufd xmm1, xmm0, 0xaa
vxorps xmm4, xmm4, xmm1
vinsertf128 ymm1, ymm3, xmm3, 1
vmovdqu ymmword [r9], ymm1
vmovdqa xmm1, xmm3
vpslldq xmm1, xmm1, 4
vinsertf128 ymm0, ymm4, xmm4, 1
vmovdqu ymmword [rax], ymm0
mov rax, qword [rsp + 0x30]
vmovdqa xmm0, xmm1
vxorps xmm0, xmm0, xmm3
vpslldq xmm1, xmm1, 4
vmovdqa xmm3, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm3, xmm3, xmm0
vxorps xmm3, xmm3, xmm1
vaeskeygenassist xmm0, xmm4, 2
vpshufd xmm1, xmm0, 0xff
vxorps xmm3, xmm3, xmm1
vmovdqa xmm1, xmm4
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm4
vmovdqa xmm4, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm4, xmm4, xmm0
vxorps xmm4, xmm4, xmm1
vaeskeygenassist xmm0, xmm3, 0
vpshufd xmm1, xmm0, 0xaa
vxorps xmm4, xmm4, xmm1
vinsertf128 ymm1, ymm3, xmm3, 1
vmovdqu ymmword [rax], ymm1
mov rax, qword [rsp + 0x38]
vmovdqa xmm1, xmm3
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm3
vmovdqa xmm3, xmm1
vxorps xmm3, xmm3, xmm0
vpslldq xmm1, xmm1, 4
vxorps xmm3, xmm3, xmm1
vaeskeygenassist xmm0, xmm4, 4
vpshufd xmm1, xmm0, 0xff
vxorps xmm3, xmm3, xmm1
vmovdqa xmm1, xmm4
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vinsertf128 ymm2, ymm4, xmm4, 1
vxorps xmm0, xmm0, xmm4
vmovdqu ymmword [rax], ymm2
mov rax, qword [rsp + 0x40]
vpslldq xmm1, xmm1, 4
vmovdqa xmm4, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm4, xmm4, xmm0
vxorps xmm4, xmm4, xmm1
vaeskeygenassist xmm0, xmm3, 0
vpshufd xmm1, xmm0, 0xaa
vxorps xmm4, xmm4, xmm1
vinsertf128 ymm1, ymm3, xmm3, 1
vmovdqu ymmword [rax], ymm1
mov rax, qword [rsp + 0x48]
vmovdqa xmm1, xmm3
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm0, xmm0, xmm3
vmovdqa xmm3, xmm1
vpslldq xmm1, xmm1, 4
vxorps xmm3, xmm3, xmm0
vxorps xmm3, xmm3, xmm1
vinsertf128 ymm2, ymm4, xmm4, 1
vmovdqu ymmword [rax], ymm2
mov rax, qword [rsp + 0x50]
vaeskeygenassist xmm0, xmm4, 8
vpshufd xmm1, xmm0, 0xff
vxorps xmm3, xmm3, xmm1
vmovdqa xmm1, xmm4
vpslldq xmm1, xmm1, 4
vmovdqa xmm0, xmm1
vpslldq xmm1, xmm1, 4
vmovdqa xmm2, xmm1
vxorps xmm0, xmm0, xmm4
vxorps xmm2, xmm2, xmm0
vpslldq xmm1, xmm1, 4
vxorps xmm2, xmm2, xmm1
vaeskeygenassist xmm0, xmm3, 0
vpshufd xmm1, xmm0, 0xaa
vxorps xmm2, xmm2, xmm1
vinsertf128 ymm1, ymm3, xmm3, 1
vmovdqu ymmword [rax], ymm1
mov rax, qword [rsp + 0x58]
vinsertf128 ymm2, ymm2, xmm2, 1
vmovdqu ymmword [rax], ymm2
vzeroupper
ret
Function at 0x7ff7ed4d4f20
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rsp
sub rsp, 0x98
movdqu xmm2, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm4, xmmword [rcx + 0x20]
movdqu xmm5, xmmword [rcx + 0x30]
mov ecx, 2
movaps xmmword [rax - 0x18], xmm6
movdqa xmm6, xmmword [0x7ff7ed870e70]
movaps xmmword [rax - 0x28], xmm7
movdqa xmm7, xmmword [0x7ff7ed870e80]
movaps xmmword [rax - 0x38], xmm8
movdqa xmm8, xmmword [0x7ff7ed870e90]
movaps xmmword [rax - 0x48], xmm9
movdqa xmm9, xmmword [0x7ff7ed870ea0]
movaps xmmword [rax - 0x58], xmm10
movdqa xmm10, xmmword [0x7ff7ed870eb0]
movaps xmmword [rax - 0x68], xmm11
movdqa xmm11, xmmword [0x7ff7ed870ec0]
movaps xmmword [rax - 0x78], xmm12
lea rax, [rdx + r8]
movdqa xmm12, xmmword [0x7ff7ed870ed0]
movaps xmmword [rsp + 0x10], xmm13
movdqa xmm13, xmmword [0x7ff7ed870ee0]
movaps xmmword [rsp], xmm14
aesdec xmm2, xmm6
aesenc xmm3, xmm6
aesdec xmm4, xmm10
aesenc xmm5, xmm10
aesdec xmm2, xmm7
aesenc xmm3, xmm7
aesdec xmm4, xmm11
aesenc xmm5, xmm11
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm4, xmm12
aesenc xmm5, xmm12
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm4, xmm13
aesenc xmm5, xmm13
movdqu xmmword [r8], xmm2
movdqu xmmword [r8 + 0x10], xmm3
movdqu xmmword [r8 + 0x20], xmm4
movdqu xmmword [r8 + 0x30], xmm5
add r8, 0x40
sub rcx, 1
jne 0x7ff7ed4d4fb8
movdqa xmm14, xmmword [0x7ff7ed74cba0]
jmp 0x7ff7ed4d50da
aesdec xmm2, xmm6
aesenc xmm3, xmm6
aesdec xmm4, xmm10
aesenc xmm5, xmm10
aesdec xmm2, xmm7
aesenc xmm3, xmm7
aesdec xmm4, xmm11
aesenc xmm5, xmm11
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm2, xmm9
movdqa xmm0, xmm14
movdqa xmm1, xmm14
andps xmm0, xmm2
movdqu xmmword [r8], xmm0
movdqa xmm0, xmm14
aesenc xmm3, xmm9
andps xmm1, xmm3
movdqu xmmword [r8 + 0x10], xmm1
movdqa xmm1, xmm14
aesdec xmm4, xmm12
aesenc xmm5, xmm12
aesdec xmm4, xmm13
aesenc xmm5, xmm13
andps xmm0, xmm4
andps xmm1, xmm5
movdqu xmmword [r8 + 0x20], xmm0
movdqu xmmword [r8 + 0x30], xmm1
add r8, 0x40
cmp r8, rax
jb 0x7ff7ed4d5043
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x98]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm8, xmmword [r11 - 0x38]
movaps xmm9, xmmword [r11 - 0x48]
movaps xmm10, xmmword [r11 - 0x58]
movaps xmm11, xmmword [r11 - 0x68]
movaps xmm12, xmmword [r11 - 0x78]
movaps xmm13, xmmword [rsp + 0x10]
movaps xmm14, xmmword [rsp]
mov rsp, r11
ret
mov eax, dword [0x7ff7ed870dec]
lea r8, [rcx + 0x40]
mov r9, rdx
mov rcx, r9
lea edx, [rax*8 + 0x80]
jmp 0x7ff7ed4d4f20