joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003300
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x140003320
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, dh
movzx edi, ah
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, bh
shr eax, 0x10
movzx ebp, ch
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr ecx, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, bh
movzx edi, ch
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
movzx esi, dh
mov edx, dword [r15 + 0xc]
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 1]
mov eax, dword [r15]
xor r8d, dword [r14 + rbp*8 + 1]
xor eax, r10d
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor ecx, r12d
xor ebx, r11d
xor edx, r8d
sub r13d, 1
jne 0x140003320
lea r14, [r14 + 0x800]
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi]
movzx r11d, byte [r14 + rdi]
movzx r12d, byte [r14 + rbp]
movzx esi, dl
movzx edi, dh
movzx ebp, ah
movzx r8d, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl edi, 8
shl ebp, 8
xor r10d, edi
xor r11d, ebp
shr edx, 0x10
movzx esi, bh
movzx edi, ch
shr eax, 0x10
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
shl esi, 8
shl edi, 8
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr ecx, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl esi, 0x10
shl edi, 0x10
shl ebp, 0x10
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, bh
movzx ebp, ch
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl esi, 0x10
shl edi, 0x18
shl ebp, 0x18
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, dh
movzx edi, ah
mov edx, dword [r15 + 0x1c]
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
mov eax, dword [r15 + 0x10]
shl esi, 0x18
shl edi, 0x18
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
lea r14, [r14 - 0x800]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret
Function at 0x1400037d0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
mov r10, rsp
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r10
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x1400057c0]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
shr rbp, 3
add r14, rbp
call fcn.1400034e0
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi]
mov r14, qword [rsi + 8]
mov r13, qword [rsi + 0x10]
mov r12, qword [rsi + 0x18]
mov rbp, qword [rsi + 0x20]
mov rbx, qword [rsi + 0x28]
lea rsp, [rsi + 0x30]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret

Function at 0x1400037dd
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
mov r10, rsp
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r10
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x1400057c0]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
shr rbp, 3
add r14, rbp
call fcn.1400034e0
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi]
mov r14, qword [rsi + 8]
mov r13, qword [rsi + 0x10]
mov r12, qword [rsi + 0x18]
mov rbp, qword [rsi + 0x20]
mov rbx, qword [rsi + 0x28]
lea rsp, [rsi + 0x30]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x1400080c0
Capabilities:
Encode data using xor

Disassembly:
lea r11, [0x140009e80]
movdqu xmm7, xmmword [rcx]
lea rcx, [rcx + 0x10]
movdqa xmm0, xmmword [r11]
movdqa xmm1, xmmword [r11 + 0x10]
movdqa xmm2, xmmword [r11 + 0x20]
movdqa xmm3, xmmword [r11 + 0x30]
movdqa xmm4, xmmword [r11 + 0x40]
pcmpeqd xmm5, xmm5
movdqu xmm6, xmmword [rcx]
movdqa xmmword [rax], xmm7
lea rax, [rax + 0x10]
dec r10d
jmp 0x140008110
pshufb xmm6, xmm4
movdqa xmm8, xmm0
movdqa xmm9, xmm1
pand xmm8, xmm6
pand xmm9, xmm6
movdqa xmm10, xmm2
pcmpeqb xmm8, xmm0
psllq xmm0, 4
movdqa xmm11, xmm3
pcmpeqb xmm9, xmm1
psllq xmm1, 4
pand xmm10, xmm6
pand xmm11, xmm6
movdqa xmm12, xmm0
pcmpeqb xmm10, xmm2
psllq xmm2, 4
movdqa xmm13, xmm1
pcmpeqb xmm11, xmm3
psllq xmm3, 4
movdqa xmm14, xmm2
movdqa xmm15, xmm3
pxor xmm8, xmm5
pxor xmm9, xmm5
pand xmm12, xmm6
pand xmm13, xmm6
movdqa xmmword [rax], xmm8
pcmpeqb xmm12, xmm0
psrlq xmm0, 4
movdqa xmmword [rax + 0x10], xmm9
pcmpeqb xmm13, xmm1
psrlq xmm1, 4
lea rcx, [rcx + 0x10]
pand xmm14, xmm6
pand xmm15, xmm6
movdqa xmmword [rax + 0x20], xmm10
pcmpeqb xmm14, xmm2
psrlq xmm2, 4
movdqa xmmword [rax + 0x30], xmm11
pcmpeqb xmm15, xmm3
psrlq xmm3, 4
movdqu xmm6, xmmword [rcx]
pxor xmm13, xmm5
pxor xmm14, xmm5
movdqa xmmword [rax + 0x40], xmm12
movdqa xmmword [rax + 0x50], xmm13
movdqa xmmword [rax + 0x60], xmm14
movdqa xmmword [rax + 0x70], xmm15
lea rax, [rax + 0x80]
dec r10d
jne 0x140008110
movdqa xmm7, xmmword [r11 + 0x50]
repz ret

Function at 0x14000a120
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000a140
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret

Function at 0x14000a180
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000a1a0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret
Function at 0x14000a1e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000a203
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x14000a250
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000a273
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret

Function at 0x14000a2c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000a2e9
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret

Function at 0x14000a350
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000a379
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
repz ret
Function at 0x14000a3e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14000a43f

Function at 0x14000a430
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.14000a430
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
repz ret

Function at 0x14000a4c0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14000a51f
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000a510
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
repz ret

Function at 0x14000a5a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesenc xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14000a5fa
Function at 0x14000a61a
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000a5f0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
repz ret

Function at 0x14000a6b0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesdec xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14000a70a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14000a700
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
aesdeclast xmm8, xmm0
aesdeclast xmm9, xmm0
repz ret
Function at 0x14000d5b0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
call fcn.14000d620
shl edx, 4
test eax, eax
jne 0x14000d616
lea rcx, [r8 + rdx + 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
movups xmmword [rcx], xmm0
movups xmmword [r8], xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmmword [rcx + 0x10], xmm0
movups xmmword [r8 - 0x10], xmm1
cmp rcx, r8
ja 0x14000d5db
movups xmm0, xmmword [r8]
aesimc xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [rcx], xmm0
pxor xmm0, xmm0
add rsp, 8
repz ret
Function at 0x14000e640
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x14000e760
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x14000e6a0
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x14000e6a0
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x14000e6a0
Function at 0x140048c30
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, 1
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x140048c7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.do_move:_err_moving__s_____s___u_
mov r8, rbx
mov r9d, eax
mov rdx, rdi
call fcn.1400494a0
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140049180
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r9
push rdi
push r14
push r15
sub rsp, 0x20
mov r15, r8
mov r14, rdx
call fcn.1400494b0
lea rdx, [0x140134a84]
mov rcx, rax
mov rdi, rax
call fcn.1400cf234
xor ebx, ebx
mov rsi, rax
test rax, rax
jne 0x1400491dc
lea rcx, str.Unable_to_open__s
mov rdx, rdi
call fcn.1400494a0
mov rbp, qword [rsp + 0x58]
mov edi, ebx
jmp 0x14004922e
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call fcn.1400cf5d4
mov rcx, rsi
call fcn.1400cf95c
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov edi, eax
call fcn.1400cf5d4
mov edx, edi
mov ecx, 1
call fcn.1400cbdb0
mov r9, rsi
mov r8d, edi
mov rcx, rax
mov edx, 1
mov rbp, rax
call fcn.1400cf460
mov rcx, rsi
mov rdi, rax
call fcn.1400ced1c
mov rdx, rdi
mov rcx, rbp
call fcn.1400490f0
mov edx, 0x20
lea ecx, [rdx - 0x1f]
mov rsi, rax
call fcn.1400cbdb0
mov r9, rsi
mov ecx, ebx
mov rdi, rax
mov rdx, rax
sub r9, rax
test ecx, ecx
jne 0x140049262
movzx r8d, byte [rsi + 0x1f]
jmp 0x140049266
movzx r8d, byte [rsi]
movzx eax, byte [r9 + rdx]
inc ecx
inc rdx
xor al, r8b
mov byte [rdx - 1], al
cmp ecx, 0x20
jb 0x140049257
mov edx, 0x10
mov qword [r14], rdi
lea ecx, [rdx - 0xf]
call fcn.1400cbdb0
mov r8, rdi
mov r9, rax
mov rcx, rax
sub r8, rax
test ebx, ebx
jne 0x1400492a1
movzx edx, byte [rdi + 0xf]
jmp 0x1400492a4
movzx edx, byte [rdi]
movzx eax, byte [r8 + rcx]
inc ebx
inc rcx
xor al, dl
mov byte [rcx - 1], al
cmp ebx, 0x10
jb 0x140049297
mov rcx, rsi
mov qword [r15], r9
call fcn.1400cbd70
mov rcx, rbp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.1400cbd70
Function at 0x1400492f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r15, rdx
lea rdx, [0x140134a84]
mov r14, r8
mov rdi, rcx
call fcn.1400cf234
mov rsi, rax
test rax, rax
jne 0x14004933d
lea rcx, str.Unable_to_open__s
mov rdx, rdi
call fcn.1400494a0
mov rbp, qword [rsp + 0x58]
xor ebx, ebx
jmp 0x14004938f
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call fcn.1400cf5d4
mov rcx, rsi
call fcn.1400cf95c
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov ebx, eax
call fcn.1400cf5d4
mov edx, ebx
mov ecx, 1
call fcn.1400cbdb0
mov r9, rsi
mov r8d, ebx
mov rcx, rax
mov edx, 1
mov rbp, rax
call fcn.1400cf460
mov rcx, rsi
mov rbx, rax
call fcn.1400ced1c
lea rcx, str.Read__u_bytes_from__s...
mov r8, rdi
mov rdx, rbx
call fcn.1400494a0
mov r9, r14
mov r8, r15
mov rcx, rbp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp 0x1400493d0
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x48
mov rax, qword [0x140175060]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, rcx
mov ecx, 1
mov rsi, r9
mov rdi, r8
mov r14, rdx
call fcn.1400cbdb0
mov r15, rax
mov dword [rsp + 0x30], r14d
call fcn.140061080
mov rbx, rax
call fcn.140054a70
mov r9, rsi
mov r8, rdi
mov rcx, rbx
mov rdx, rax
call fcn.1400616f0
lea r8, [rsp + 0x30]
mov r9, rbp
mov rdx, r15
mov rcx, rbx
mov dword [rsp + 0x20], r14d
call fcn.140061790
movsxd rdi, dword [rsp + 0x30]
lea r8, [rsp + 0x30]
lea rdx, [rdi + r15]
mov rcx, rbx
call fcn.140061540
cmp byte [r15], 0x4d
je 0x140049467
cmp byte [r15 + 1], 0x5a
je 0x140049467
xor eax, eax
jmp 0x140049483
mov rdx, rdi
mov rcx, r15
call fcn.140049d10
mov rbx, rax
test rax, rax
jne 0x140049480
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400cbcb0
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret