joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c9560
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rsi, rdx
mov rbx, rcx
je 0x1400c95fb
mov rdi, r8
test r8, r8
jle 0x1400c95f0
mov rcx, rbx
call fcn.14003d260
test rax, rax
jle 0x1400c95d0
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.140194c10
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400c95e8
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1400c95f0
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1400c9592
sub r14, rdi
mov rax, r14
jmp 0x1400c96aa
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1400c9612
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400c9614
xor ecx, ecx
movsxd rdi, ecx
test r14, r14
jle 0x1400c96a4
test ecx, ecx
jle 0x1400c964c
cmp r14, rdi
mov rcx, rsi
cmovl rdi, r14
mov r8, rdi
call fcn.140194c10
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub r14, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
test r14, r14
jle 0x1400c96a4
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x1400c96a4
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400c9691
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov r9, qword [rbx + 0x80]
mov r8, r14
mov edx, 1
mov rcx, rsi
call fcn.1401a4ac0
sub r14, rax
sub rbp, r14
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400c96d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
je 0x1400c976a
mov rbx, r8
test r8, r8
jle 0x1400c9762
mov rcx, rdi
call fcn.14003dc40
test rax, rax
jle 0x1400c9740
mov rcx, qword [rdi + 0x40]
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov r8, rsi
mov rcx, qword [rcx]
call fcn.140194c10
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x1400c975a
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400c9762
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x1400c9702
sub r14, rbx
mov rax, r14
jmp 0x1400c97e1
mov rax, qword [rcx + 0x40]
mov rsi, r14
mov r9, qword [rax]
test r9, r9
je 0x1400c9781
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400c9783
xor ecx, ecx
movsxd rbx, ecx
test r14, r14
jle 0x1400c97db
test ecx, ecx
jle 0x1400c97b7
cmp r14, rbx
mov rcx, r9
cmovl rbx, r14
mov r8, rbx
call fcn.140194c10
mov rax, qword [rdi + 0x58]
add rbp, rbx
sub r14, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x40]
movsxd rax, ebx
add qword [rcx], rax
test r14, r14
jle 0x1400c97db
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400c97db
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.1401a5028
sub r14, rax
sub rsi, r14
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400cef50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor ebx, ebx
movsxd r11, r8d
mov r9, rdx
mov r10, rcx
test r8d, r8d
jle 0x1400cf00f
cmp r11d, 0x40
jb 0x1400cf00f
lea eax, [r11 - 1]
movsxd r8, eax
add rcx, r8
lea rax, [r8 + rdx]
cmp r10, rax
ja 0x1400cef8f
cmp rcx, rdx
jae 0x1400cf00f
mov ecx, r11d
and ecx, 0x8000003f
jge 0x1400cefa1
dec ecx
or ecx, 0xffffffc0
inc ecx
mov eax, r11d
sub eax, ecx
mov rcx, r10
movsxd r8, eax
sub rdx, r10
nop
movdqu xmm0, xmmword [rcx]
add ebx, 0x40
movdqu xmm1, xmmword [rdx + rcx]
pxor xmm1, xmm0
movdqu xmmword [rcx], xmm1
movdqu xmm0, xmmword [rcx + 0x10]
movdqu xmm1, xmmword [rdx + rcx + 0x10]
pxor xmm1, xmm0
movdqu xmmword [rcx + 0x10], xmm1
movdqu xmm0, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rdx + rcx + 0x20]
pxor xmm1, xmm0
movdqu xmmword [rcx + 0x20], xmm1
movdqu xmm0, xmmword [rcx + 0x30]
movdqu xmm1, xmmword [rdx + rcx + 0x30]
pxor xmm1, xmm0
movdqu xmmword [rcx + 0x30], xmm1
add rcx, 0x40
mov rax, rcx
sub rax, r10
cmp rax, r8
jl 0x1400cefb0
movsxd rcx, ebx
mov rdx, r11
cmp rcx, r11
jge 0x1400cf041
sub r9, r10
lea rax, [rcx + r10]
sub rdx, rcx
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rax + r9]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400cf030
mov rbx, qword [rsp + 8]
ret
Function at 0x1400cf050
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x100
mov rax, qword [0x140a23bc8]
xor rax, rsp
mov qword [rsp + 0xf0], rax
xor eax, eax
mov rsi, rdx
mov qword [rcx], rax
mov r14, rcx
mov qword [rcx + 8], rax
xor edx, edx
mov qword [rcx + 0x10], rax
mov r8d, 0xc8
mov qword [rcx + 0x18], rax
lea rcx, [rsp + 0x20]
call fcn.140195bd0
mov r8, qword [rsi + 8]
movabs rax, 0xf0f0f0f0f0f0f0f1
mov r9, qword [rsi]
mov rcx, r8
sub rcx, r9
mov rbx, r8
mul rcx
mov rcx, r9
mov rbp, rdx
shr rbp, 7
movsxd rdi, ebp
test ebp, ebp
jle 0x1400cf14b
lea rbx, [rsp + 0x20]
neg rbx
nop word [rax + rax]
mov r8, qword [rsi]
xor eax, eax
add r8, rbx
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
add rdx, rax
add rax, 4
movzx ecx, byte [r8 + rdx]
xor byte [rdx], cl
movzx ecx, byte [r8 + rdx + 1]
xor byte [rdx + 1], cl
movzx ecx, byte [r8 + rdx + 2]
xor byte [rdx + 2], cl
movzx ecx, byte [r8 + rdx + 3]
xor byte [rdx + 3], cl
cmp rax, 0x88
jl 0x1400cf0f0
lea rcx, [rsp + 0x20]
call fcn.1400cf1e0
add rbx, 0x88
sub rdi, 1
jne 0x1400cf0e0
mov r8d, dword [rsi + 8]
mov rbx, qword [rsi + 8]
mov r9d, dword [rsi]
mov rcx, qword [rsi]
imul eax, ebp, 0x88
movsxd rdx, eax
sub r8d, eax
add rdx, rcx
sub r8d, r9d
lea rcx, [rsp + 0x20]
call fcn.1400cef50
sub ebx, dword [rsi]
lea rcx, [rsp + 0x20]
mov eax, 0x78787879
imul ebx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x88
sub ebx, eax
movsxd rax, ebx
xor byte [rsp + rax + 0x20], 1
xor byte [rsp + 0xa7], 0x80
call fcn.1400cf1e0
movaps xmm0, xmmword [rsp + 0x20]
mov rax, r14
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [r14], xmm0
movups xmmword [r14 + 0x10], xmm1
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1401777c0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400d4f40
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
add rcx, 0x40
xor edx, edx
mov r8d, 0xb8
call fcn.140195bd0
movabs rsi, 0x1f83d9abfb41bd6b
movabs rbp, 0x5be0cd19137e2179
mov qword [rdi + 0x30], rsi
movabs rcx, 0x6a09e667f3bcc908
mov qword [rdi + 0x38], rbp
movabs rdx, 0xbb67ae8584caa73b
mov qword [rdi], rcx
movabs r8, 0x3c6ef372fe94f82b
mov qword [rdi + 8], rdx
movabs r9, 0xa54ff53a5f1d36f1
mov qword [rdi + 0x10], r8
movabs r10, 0x510e527fade682d1
mov qword [rdi + 0x18], r9
movabs r11, 0x9b05688c2b3e6c1f
mov qword [rdi + 0x20], r10
mov qword [rdi + 0x28], r11
mov rax, qword [rbx]
xor rax, rcx
mov qword [rdi], rax
mov rax, qword [rbx + 8]
xor rax, rdx
mov qword [rdi + 8], rax
mov rax, qword [rbx + 0x10]
xor rax, r8
mov qword [rdi + 0x10], rax
mov rax, qword [rbx + 0x18]
xor rax, r9
mov qword [rdi + 0x18], rax
mov rax, qword [rbx + 0x20]
xor rax, r10
mov qword [rdi + 0x20], rax
mov rax, qword [rbx + 0x28]
xor rax, r11
mov qword [rdi + 0x28], rax
mov rax, qword [rbx + 0x30]
xor rax, rsi
mov rsi, qword [rsp + 0x40]
mov qword [rdi + 0x30], rax
mov rax, qword [rbx + 0x38]
xor rax, rbp
mov rbp, qword [rsp + 0x38]
mov qword [rdi + 0x38], rax
movzx eax, byte [rbx]
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 0xe8], rax
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400d55b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x100
mov rax, qword [0x140a23bc8]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, qword [rsp + 0x150]
mov rbp, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
test rcx, rcx
je 0x1400d5793
test r8, r8
jne 0x1400d55fb
test r9, r9
jne 0x1400d5793
cmp rbx, 0xc8
jae 0x1400d5793
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0xc8
call fcn.140195bd0
cmp rbp, rbx
jb 0x1400d5720
xor eax, eax
test rbx, rbx
je 0x1400d5707
cmp rbx, 0x40
jb 0x1400d56dc
lea rcx, [rbx - 1]
add rcx, rdi
lea r8, [rsp + 0x20]
lea rdx, [rsp + rbx + 0x1f]
cmp r8, rcx
ja 0x1400d5657
cmp rdx, rdi
jae 0x1400d56dc
mov r8, rbx
and r8, 0xffffffffffffffc0
lea rcx, [rsp + 0x20]
mov rdx, rdi
sub rdx, rcx
nop dword [rax]
movdqu xmm0, xmmword [rsp + rax + 0x20]
lea rcx, [rdx + rax]
movdqu xmm1, xmmword [rdi + rax]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax + 0x20], xmm1
movdqu xmm0, xmmword [rsp + rax + 0x30]
movdqu xmm1, xmmword [rsp + rcx + 0x30]
lea rcx, [rdx + rax]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax + 0x30], xmm1
movdqu xmm0, xmmword [rsp + rax + 0x40]
movdqu xmm1, xmmword [rsp + rcx + 0x40]
lea rcx, [rdx + rax]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax + 0x40], xmm1
movdqu xmm0, xmmword [rsp + rax + 0x50]
movdqu xmm1, xmmword [rsp + rcx + 0x50]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax + 0x50], xmm1
add rax, 0x40
cmp rax, r8
jb 0x1400d5670
cmp rax, rbx
jae 0x1400d5707
lea rcx, [rsp + 0x20]
mov r8, rdi
sub r8, rcx
nop dword [rax]
lea rdx, [rsp + 0x20]
add rdx, rax
inc rax
movzx ecx, byte [r8 + rdx]
xor byte [rdx], cl
cmp rax, rbx
jb 0x1400d56f0
lea rcx, [rsp + 0x20]
call fcn.1400d57c0
add rdi, rbx
sub rbp, rbx
cmp rbp, rbx
jae 0x1400d5623
movzx eax, byte [rsp + 0x158]
lea rcx, [rsp + 0x20]
xor byte [rsp + rbp + 0x20], al
mov r8, rbp
xor byte [rsp + rbx + 0x1f], 0x80
mov rdx, rdi
call fcn.1400d5dc0
lea rcx, [rsp + 0x20]
call fcn.1400d57c0
cmp rsi, rbx
jb 0x1400d577a
test rbx, rbx
je 0x1400d5765
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.140194c10
lea rcx, [rsp + 0x20]
call fcn.1400d57c0
add r14, rbx
sub rsi, rbx
cmp rsi, rbx
jae 0x1400d5750
test rsi, rsi
je 0x1400d578f
mov r8, rsi
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.140194c10
xor eax, eax
jmp 0x1400d5798
mov eax, 0xffffffff
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1401777c0
add rsp, 0x100
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400da2f0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rdx + 0x3f8]
mov r8d, 0x80
lea r10, [rcx + 0x3f8]
cmp rcx, rax
ja 0x1400da311
xor r9d, r9d
cmp r10, rdx
jae 0x1400da381
mov r9, rdx
lea rax, [rcx + 0x10]
sub r9, rcx
mov r10d, 0x10
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm1, xmmword [r9 + rax - 0x10]
movdqu xmm2, xmmword [r9 + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [r9 + rax - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [r9 + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
sub r10, 1
jne 0x1400da321
mov r9, r8
cmp r9, r8
jae 0x1400da3a1
sub rdx, rcx
lea rax, [rcx + r9*8]
sub r8, r9
mov rcx, qword [rax + rdx]
xor qword [rax], rcx
lea rax, [rax + 8]
sub r8, 1
jne 0x1400da390
ret
Function at 0x1400dbc90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140a23bc8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, rcx
mov rbx, r8
inc r8
movabs rax, 0x5851f42d4c957f2d
imul r8, rax
movabs rcx, 0x810a978a59f5a1fc
mov rsi, rdx
mov qword [rbp - 0x50], r8
lea rdi, [r15 + 0x28]
mov rax, r8
mov r14d, 8
xor rax, rcx
movabs rcx, 0xa77099df38c2d846
mov qword [rbp - 0x48], rax
mov rax, r8
xor rax, rcx
movabs rcx, 0x8126b91cbf22495c
mov qword [rbp - 0x40], rax
mov rax, r8
xor rax, rcx
movabs rcx, 0x494d2597179f8a62
mov qword [rbp - 0x38], rax
mov rax, r8
xor rax, rcx
movabs rcx, 0x9237efb9ceaaec0c
mov qword [rbp - 0x30], rax
mov rax, r8
xor rax, rcx
movabs rcx, 0x2f2a56746ce62d78
mov qword [rbp - 0x28], rax
mov rax, r8
xor rax, rcx
mov qword [rbp - 0x20], rax
movabs rax, 0x84853bf7b62ce54e
xor r8, rax
mov qword [rbp - 0x18], r8
nop dword [rax + rax]
and ebx, 0x3fffff
shl rbx, 6
add rbx, qword [r15]
prefetchnta byte [rbx]
lea r8, [r15 + 0x8368]
mov rdx, rdi
lea rcx, [rbp - 0x50]
call fcn.1400e0d80
mov rax, qword [rbx]
xor qword [rbp - 0x50], rax
mov rax, qword [rbx + 8]
xor qword [rbp - 0x48], rax
mov rax, qword [rbx + 0x10]
xor qword [rbp - 0x40], rax
mov rax, qword [rbx + 0x18]
xor qword [rbp - 0x38], rax
mov rax, qword [rbx + 0x20]
xor qword [rbp - 0x30], rax
mov rax, qword [rbx + 0x28]
xor qword [rbp - 0x28], rax
mov rax, qword [rbx + 0x30]
xor qword [rbp - 0x20], rax
mov rax, qword [rbx + 0x38]
movsxd rbx, dword [rdi + 0x1004]
add rdi, 0x1068
xor qword [rbp - 0x18], rax
mov rbx, qword [rbp + rbx*8 - 0x50]
sub r14, 1
jne 0x1400dbd70
movaps xmm0, xmmword [rbp - 0x50]
movaps xmm1, xmmword [rbp - 0x40]
movups xmmword [rsi], xmm0
movaps xmm0, xmmword [rbp - 0x30]
movups xmmword [rsi + 0x10], xmm1
movaps xmm1, xmmword [rbp - 0x20]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1401777c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret

Function at 0x1400dbfd0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x20
movdqa xmm0, xmmword [0x140a2e610]
mov rbx, rcx
aesenc xmm0, xmm0
mov ecx, 0x200000
movdqa xmmword [0x140a2e610], xmm0
call fcn.1400d94e0
mov qword [rbx + 0x9f0], rax
add rsp, 0x20
pop rbx
ret

Function at 0x1400dc030
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x20
movdqa xmm0, xmmword [0x140a2e610]
mov rbx, rcx
aesenc xmm0, xmm0
mov ecx, 0x200000
movdqa xmmword [0x140a2e610], xmm0
call fcn.1400d94f0
mov qword [rbx + 0x9f0], rax
add rsp, 0x20
pop rbx
ret
Function at 0x1400dc090
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rdx
lea r8, [rcx + 0x40]
mov rcx, rax
mov edx, 0x880
jmp 0x1400e1fe0
sub rsp, 0x68
movdqa xmm4, xmmword [0x140201410]
lea r9, [rdx + r8]
movdqa xmm5, xmmword [0x140201420]
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x1402013c0]
movaps xmmword [rsp + 0x40], xmm7
movdqa xmm7, xmmword [0x140201480]
movaps xmmword [rsp + 0x30], xmm8
movdqa xmm8, xmmword [0x1402013d0]
movaps xmmword [rsp + 0x20], xmm9
movdqa xmm9, xmmword [0x140201440]
movaps xmmword [rsp + 0x10], xmm10
movdqa xmm10, xmmword [0x1402014b0]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x140201460]
cmp r8, r9
jae 0x1400e20e9
lea rcx, [r8 + 0x20]
nop dword [rax]
aesdec xmm0, xmm4
aesenc xmm1, xmm4
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm0, xmm5
aesenc xmm1, xmm5
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm0, xmm6
aesenc xmm1, xmm6
aesdec xmm0, xmm7
movdqu xmmword [rcx - 0x20], xmm0
lea rcx, [rcx + 0x40]
aesdec xmm2, xmm10
aesenc xmm1, xmm7
movdqu xmmword [rcx - 0x50], xmm1
lea rax, [rcx - 0x20]
aesenc xmm3, xmm10
aesdec xmm2, xmm11
movdqu xmmword [rcx - 0x40], xmm2
aesenc xmm3, xmm11
movdqu xmmword [rcx - 0x30], xmm3
cmp rax, r9
jb 0x1400e2070
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
add rsp, 0x68
ret

Function at 0x1400dc290
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov r8, qword [rcx + 0x9f0]
mov rax, rdx
mov rcx, rax
mov edx, 0x200000
jmp 0x1400e1c10
sub rsp, 0x28
movdqa xmm4, xmmword [0x140201450]
lea r10, [rdx + r8]
movdqa xmm5, xmmword [0x1402013b0]
mov r9, rcx
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm6, xmmword [0x1402013e0]
movaps xmmword [rsp], xmm7
movdqa xmm7, xmmword [0x1402013f0]
cmp r8, r10
jae 0x1400e1c95
lea rcx, [r8 + 0x20]
aesdec xmm0, xmm4
movdqu xmmword [rcx - 0x20], xmm0
lea rcx, [rcx + 0x40]
aesenc xmm1, xmm5
movdqu xmmword [rcx - 0x50], xmm1
lea rax, [rcx - 0x20]
aesdec xmm2, xmm6
movdqu xmmword [rcx - 0x40], xmm2
aesenc xmm3, xmm7
movdqu xmmword [rcx - 0x30], xmm3
cmp rax, r10
jb 0x1400e1c60
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp]
movdqu xmmword [r9], xmm0
movdqu xmmword [r9 + 0x10], xmm1
movdqu xmmword [r9 + 0x20], xmm2
movdqu xmmword [r9 + 0x30], xmm3
add rsp, 0x28
ret

Function at 0x1400df5e0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rcx, qword [rcx + 0x38]
mov edx, 0x13000
jmp 0x1400df5e0
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x28
ret
Function at 0x1400df600
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rcx, qword [rcx + 0x38]
mov edx, 0x13000
jmp 0x1400df600
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x28
ret

Function at 0x1400df620
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rcx, qword [rcx + 0x38]
mov edx, 0x13000
jmp 0x1400df620
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x28
ret

Function at 0x1400e1c10
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov r8, qword [rcx + 0x9f0]
mov rax, rdx
mov rcx, rax
mov edx, 0x200000
jmp 0x1400e1c10
sub rsp, 0x28
movdqa xmm4, xmmword [0x140201450]
lea r10, [rdx + r8]
movdqa xmm5, xmmword [0x1402013b0]
mov r9, rcx
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm6, xmmword [0x1402013e0]
movaps xmmword [rsp], xmm7
movdqa xmm7, xmmword [0x1402013f0]
cmp r8, r10
jae 0x1400e1c95
lea rcx, [r8 + 0x20]
aesdec xmm0, xmm4
movdqu xmmword [rcx - 0x20], xmm0
lea rcx, [rcx + 0x40]
aesenc xmm1, xmm5
movdqu xmmword [rcx - 0x50], xmm1
lea rax, [rcx - 0x20]
aesdec xmm2, xmm6
movdqu xmmword [rcx - 0x40], xmm2
aesenc xmm3, xmm7
movdqu xmmword [rcx - 0x30], xmm3
cmp rax, r10
jb 0x1400e1c60
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp]
movdqu xmmword [r9], xmm0
movdqu xmmword [r9 + 0x10], xmm1
movdqu xmmword [r9 + 0x20], xmm2
movdqu xmmword [r9 + 0x30], xmm3
add rsp, 0x28
ret
Function at 0x1400e1fe0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rdx
lea r8, [rcx + 0x40]
mov rcx, rax
mov edx, 0x880
jmp 0x1400e1fe0
sub rsp, 0x68
movdqa xmm4, xmmword [0x140201410]
lea r9, [rdx + r8]
movdqa xmm5, xmmword [0x140201420]
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x1402013c0]
movaps xmmword [rsp + 0x40], xmm7
movdqa xmm7, xmmword [0x140201480]
movaps xmmword [rsp + 0x30], xmm8
movdqa xmm8, xmmword [0x1402013d0]
movaps xmmword [rsp + 0x20], xmm9
movdqa xmm9, xmmword [0x140201440]
movaps xmmword [rsp + 0x10], xmm10
movdqa xmm10, xmmword [0x1402014b0]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x140201460]
cmp r8, r9
jae 0x1400e20e9
lea rcx, [r8 + 0x20]
nop dword [rax]
aesdec xmm0, xmm4
aesenc xmm1, xmm4
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm0, xmm5
aesenc xmm1, xmm5
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm0, xmm6
aesenc xmm1, xmm6
aesdec xmm0, xmm7
movdqu xmmword [rcx - 0x20], xmm0
lea rcx, [rcx + 0x40]
aesdec xmm2, xmm10
aesenc xmm1, xmm7
movdqu xmmword [rcx - 0x50], xmm1
lea rax, [rcx - 0x20]
aesenc xmm3, xmm10
aesdec xmm2, xmm11
movdqu xmmword [rcx - 0x40], xmm2
aesenc xmm3, xmm11
movdqu xmmword [rcx - 0x30], xmm3
cmp rax, r9
jb 0x1400e2070
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
add rsp, 0x68
ret

Function at 0x1400e2380
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
movdqa xmm2, xmmword [0x140201470]
lea r9, [rcx + rdx]
movdqa xmm3, xmmword [0x140201430]
movdqa xmm4, xmmword [0x140201490]
movdqa xmm5, xmmword [0x140201400]
cmp rcx, r9
jae 0x1400e23d4
add rcx, 0x20
nop dword [rax]
aesenc xmm2, xmmword [rcx - 0x20]
aesdec xmm3, xmmword [rcx - 0x10]
aesenc xmm4, xmmword [rcx]
aesdec xmm5, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x40]
lea rax, [rcx - 0x20]
cmp rax, r9
jb 0x1400e23b0
movdqa xmm0, xmmword [0x1402013a0]
movdqa xmm1, xmmword [0x1402014a0]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm2, xmm1
movdqu xmmword [r8], xmm2
aesenc xmm4, xmm0
aesdec xmm3, xmm1
movdqu xmmword [r8 + 0x10], xmm3
aesdec xmm5, xmm0
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [r8 + 0x20], xmm4
movdqu xmmword [r8 + 0x30], xmm5
ret
Function at 0x1400e2830
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x60
movdqu xmm0, xmmword [r9]
mov rbx, r8
movdqu xmm1, xmmword [r9 + 0x10]
lea r8, [rdx - 0x1000]
movdqa xmm2, xmmword [0x140201470]
mov r11, r9
movdqa xmm3, xmmword [0x140201430]
mov r10, rcx
movdqa xmm4, xmmword [0x140201490]
mov rax, rcx
movdqa xmm5, xmmword [0x140201400]
add r8, rcx
movaps xmmword [rsp + 0x50], xmm6
mov edx, 2
movdqu xmm6, xmmword [r9 + 0x20]
movaps xmmword [rsp + 0x40], xmm7
movdqu xmm7, xmmword [r9 + 0x30]
lea r9, [rcx + 0x1000]
movaps xmmword [rsp + 0x30], xmm8
movdqa xmm8, xmmword [0x140201450]
movaps xmmword [rsp + 0x20], xmm9
movdqa xmm9, xmmword [0x1402013b0]
movaps xmmword [rsp + 0x10], xmm10
movdqa xmm10, xmmword [0x1402013e0]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x1402013f0]
cmp rax, r8
jae 0x1400e2932
lea rcx, [rax + 0x20]
sub r9, rax
aesenc xmm2, xmmword [rax]
aesdec xmm3, xmmword [rcx - 0x10]
aesenc xmm4, xmmword [rcx]
aesdec xmm5, xmmword [rcx + 0x10]
aesdec xmm0, xmm8
movdqu xmmword [rax], xmm0
aesenc xmm1, xmm9
movdqu xmmword [rcx - 0x10], xmm1
aesdec xmm6, xmm10
aesenc xmm7, xmm11
movdqu xmmword [rcx], xmm6
movdqu xmmword [rcx + 0x10], xmm7
prefetcht0 byte [r9 + rax]
add rax, 0x40
lea rcx, [rcx + 0x40]
cmp rax, r8
jb 0x1400e28e0
add r8, 0x1000
mov r9, r10
sub rdx, 1
jne 0x1400e28d4
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
movdqu xmmword [r11], xmm0
movdqa xmm0, xmmword [0x1402013a0]
movdqu xmmword [r11 + 0x10], xmm1
movdqa xmm1, xmmword [0x1402014a0]
movdqu xmmword [r11 + 0x20], xmm6
movaps xmm6, xmmword [rsp + 0x50]
movdqu xmmword [r11 + 0x30], xmm7
movaps xmm7, xmmword [rsp + 0x40]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm2, xmm1
movdqu xmmword [rbx], xmm2
aesenc xmm4, xmm0
aesdec xmm3, xmm1
movdqu xmmword [rbx + 0x10], xmm3
aesdec xmm5, xmm0
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [rbx + 0x20], xmm4
movdqu xmmword [rbx + 0x30], xmm5
add rsp, 0x60
pop rbx
ret