joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005e060
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xa8
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
mov rax, qword [0x140078038]
xor rax, rsp
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [0x140066aa8]
movups xmmword [rsp + 0x20], xmm0
movzx eax, byte [0x140066ab8]
mov byte [rsp + 0x30], al
xor r9d, r9d
mov ecx, r9d
cmp dword [0x140078040], 2
jl 0x14005e1ff
movdqa xmm5, xmmword [0x140065cf0]
movdqa xmm4, xmmword [0x14006eef0]
mov eax, 5
movd xmm6, eax
movdqa xmm7, xmmword [str.3333]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm0, xmmword [str.0000000000000000]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x24]
mov r8d, dword [rsp + 0x40]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140065d20]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
pxor xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140065d20]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
pxor xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x10
jl 0x14005e0f3
cmp ecx, 0x11
jge 0x14005e23e
movsxd rax, ecx
lea r8, [rsp + 0x20]
add r8, rax
nop word [rax + rax]
mov eax, 0xa0a0a0a1
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x33
movzx eax, cl
sub al, dl
add al, 0x30
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x11
jl 0x14005e210
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], r9b
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r9b
jne 0x14005e262
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400050f0
nop
lea rcx, [rsp + 0x40]
call fcn.14000af40
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14005e2c6
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e2c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e2c1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400612e0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140061400
movaps xmm6, xmmword [rsp + 0x90]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm8, xmmword [rsp + 0x70]
add rsp, 0xa8
ret
Function at 0x14005e300
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm7
movaps xmmword [rsp + 0x60], xmm8
mov rax, qword [0x140078038]
xor rax, rsp
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [0x140066a98]
movups xmmword [rsp + 0x20], xmm0
xor r9d, r9d
psrldq xmm0, 0xf
movd eax, xmm0
test al, al
je 0x14005e4d5
mov ecx, r9d
cmp dword [0x140078040], 2
jl 0x14005e4a9
movdqa xmm5, xmmword [0x140065cf0]
mov edx, r9d
movdqa xmm4, xmmword [0x14006eef0]
mov eax, 5
movd xmm6, eax
movdqa xmm7, xmmword [str.3333]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm0, xmmword [str.0000000000000000]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x24]
mov r8d, dword [rsp + 0x30]
nop
movd xmm2, edx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140065d20]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
pxor xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [rdx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140065d20]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx]
pxor xmm2, xmm0
movd dword [rcx], xmm2
add edx, 8
lea rcx, [rcx + 8]
cmp edx, 0x10
jl 0x14005e3a0
jmp 0x14005e4d5
lea r8, [rsp + 0x20]
nop
mov eax, 0xa0a0a0a1
mul ecx
shr edx, 5
movsx eax, dl
imul edx, eax, 0x33
movzx eax, cl
sub al, dl
add al, 0x30
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x10
jl 0x14005e4b0
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], r9b
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], r9b
jne 0x14005e500
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.1400050f0
nop
lea rcx, [rsp + 0x30]
call fcn.14000af40
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14005e564
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e55f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e55f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400612e0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140061400
movaps xmm6, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm8, xmmword [rsp + 0x60]
add rsp, 0x98
ret
Function at 0x14005e590
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xa8
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
mov rax, qword [0x140078038]
xor rax, rsp
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [0x140066a80]
movups xmmword [rsp + 0x20], xmm0
mov eax, dword [0x140066a90]
mov dword [rsp + 0x30], eax
movzx eax, byte [0x140066a94]
mov byte [rsp + 0x34], al
xor r9d, r9d
mov ecx, r9d
cmp dword [0x140078040], 2
jl 0x14005e73c
movdqa xmm5, xmmword [0x140065cf0]
movdqa xmm4, xmmword [0x14006eef0]
mov eax, 5
movd xmm6, eax
movdqa xmm7, xmmword [str.3333]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm0, xmmword [str.0000000000000000]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x24]
mov r8d, dword [rsp + 0x40]
nop dword [rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140065d20]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
pxor xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140065d20]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
pxor xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x10
jl 0x14005e630
cmp ecx, 0x15
jge 0x14005e77e
movsxd rax, ecx
lea r8, [rsp + 0x20]
add r8, rax
nop word [rax + rax]
mov eax, 0xa0a0a0a1
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x33
movzx eax, cl
sub al, dl
add al, 0x30
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x15
jl 0x14005e750
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], r9b
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r9b
jne 0x14005e7a2
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400050f0
nop
lea rcx, [rsp + 0x40]
call fcn.14000af40
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14005e806
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e801
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e801
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400612e0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140061400
movaps xmm6, xmmword [rsp + 0x90]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm8, xmmword [rsp + 0x70]
add rsp, 0xa8
ret
Function at 0x14005e840
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xa8
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
mov rax, qword [0x140078038]
xor rax, rsp
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [0x140066a68]
movups xmmword [rsp + 0x20], xmm0
mov eax, dword [0x140066a78]
mov dword [rsp + 0x30], eax
xor r9d, r9d
cmp byte [0x140066a7b], r9b
je 0x14005ea2e
mov ecx, r9d
cmp dword [0x140078040], 2
jl 0x14005e9ec
movdqa xmm5, xmmword [0x140065cf0]
movdqa xmm4, xmmword [0x14006eef0]
mov eax, 5
movd xmm6, eax
movdqa xmm7, xmmword [str.3333]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm0, xmmword [str.0000000000000000]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x24]
mov r8d, dword [rsp + 0x40]
nop
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140065d20]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
pxor xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140065d20]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
pxor xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x10
jl 0x14005e8e0
cmp ecx, 0x14
jge 0x14005ea2e
movsxd rax, ecx
lea r8, [rsp + 0x20]
add r8, rax
nop word [rax + rax]
mov eax, 0xa0a0a0a1
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x33
movzx eax, cl
sub al, dl
add al, 0x30
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x14
jl 0x14005ea00
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], r9b
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r9b
jne 0x14005ea52
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400050f0
nop
lea rcx, [rsp + 0x40]
call fcn.14000af40
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14005eab6
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005eab1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005eab1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400612e0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140061400
movaps xmm6, xmmword [rsp + 0x90]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm8, xmmword [rsp + 0x70]
add rsp, 0xa8
ret
Function at 0x14005eaf0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xa8
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
mov rax, qword [0x140078038]
xor rax, rsp
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [str.TF__]
movups xmmword [rsp + 0x20], xmm0
mov eax, dword [0x140066ae8]
mov dword [rsp + 0x30], eax
xor r9d, r9d
cmp byte [0x140066aeb], r9b
je 0x14005ecde
mov ecx, r9d
cmp dword [0x140078040], 2
jl 0x14005ec9c
movdqa xmm5, xmmword [0x140065cf0]
movdqa xmm4, xmmword [0x14006eef0]
mov eax, 5
movd xmm6, eax
movdqa xmm7, xmmword [str.3333]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm0, xmmword [str.0000000000000000]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x24]
mov r8d, dword [rsp + 0x40]
nop
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140065d20]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
pxor xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140065d20]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
pxor xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x10
jl 0x14005eb90
cmp ecx, 0x14
jge 0x14005ecde
movsxd rax, ecx
lea r8, [rsp + 0x20]
add r8, rax
nop word [rax + rax]
mov eax, 0xa0a0a0a1
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x33
movzx eax, cl
sub al, dl
add al, 0x30
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x14
jl 0x14005ecb0
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], r9b
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r9b
jne 0x14005ed02
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400050f0
nop
lea rcx, [rsp + 0x40]
call fcn.14000af40
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14005ed66
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ed61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005ed61
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400612e0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140061400
movaps xmm6, xmmword [rsp + 0x90]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm8, xmmword [rsp + 0x70]
add rsp, 0xa8
ret
Function at 0x14005f150
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x1400
call fcn.140061b90
sub rsp, rax
mov rax, qword [0x140078038]
xor rax, rsp
mov qword [rsp + 0x13f8], rax
mov esi, edx
mov rbx, rcx
mov qword [rsp + 0x50], rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov qword [rcx], r14
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x18], 7
mov word [rcx], r14w
mov edi, 1
mov dword [rsp + 0x30], edi
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov ecx, eax
mov dword [rsp + 0x13e4], 0xffffffff
mov dword [rsp + 0x64], eax
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edi
mov dword [rsp + rdi*4 + 0x64], ecx
inc rdi
cmp rdi, 0x270
jb 0x14005f1c1
mov dword [rsp + 0x60], 0x270
test esi, esi
jle 0x14005f2bf
mov rbp, rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0x20
mov dword [rsp + 0x48], 0xffffffff
mov edx, 0x100
lea rcx, [rsp + 0x38]
call fcn.140009e10
mov r9d, eax
lea r8, str._02X
mov edx, 3
lea rcx, [rsp + 0x13f0]
call fcn.1400610d0
lea rax, [rsp + 0x13f0]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14005f250
mov rcx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14005f29d
lea rsi, [rcx + rdx]
mov qword [rbx + 0x10], rsi
mov rdi, rbx
cmp r8, 8
jb 0x14005f281
mov rdi, qword [rbx]
lea r8, [rdx + rdx]
lea rcx, [rdi + rcx*2]
lea rdx, [rsp + 0x13f0]
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + rsi*2], r14w
jmp 0x14005f2b5
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x13f0]
xor r8d, r8d
mov rcx, rbx
call fcn.1400072c0
sub rbp, 1
jne 0x14005f1f3
mov rax, rbx
mov rcx, qword [rsp + 0x13f8]
xor rcx, rsp
call fcn.140061400
lea r11, [rsp + 0x1400]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14005f5c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140078038]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, qword [rsp + 0x2c0]
mov rdi, r9
mov qword [rsp + 0x38], rcx
mov rax, r8
cmp qword [r8 + 0x18], 8
mov r10, rdx
mov rbx, rcx
mov dword [rsp + 0x30], 0x200
jb 0x14005f608
mov rax, qword [r8]
lea rcx, [rsp + 0x38]
mov r9d, 0x20019
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, r10
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005f759
cmp qword [rdi + 0x18], 8
jb 0x14005f639
mov rdi, qword [rdi]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov r9, rsi
lea rax, [rsp + 0x70]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14005f74e
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsi]
cmp eax, 1
jne 0x14005f690
mov r8d, dword [rsp + 0x30]
lea rdx, [rsp + 0x70]
shr r8, 1
dec r8
jmp 0x14005f763
cmp eax, 4
jne 0x14005f6d2
mov r8d, dword [rsp + 0x70]
lea r9, [rsp + 0x6a]
nop
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x14005f6a0
jmp 0x14005f720
cmp eax, 0xb
jne 0x14005f74e
mov r8, qword [rsp + 0x70]
lea r9, [rsp + 0x6a]
movabs r10, 0xcccccccccccccccd
nop dword [rax + rax]
sub r9, 2
mov rax, r10
mul r8
shr rdx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8, rdx
test rdx, rdx
jne 0x14005f6f0
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], ax
lea rax, [rsp + 0x6a]
cmp r9, rax
je 0x14005f77f
lea r8, [rsp + 0x6a]
mov rdx, r9
sub r8, r9
sar r8, 1
jmp 0x14005f777
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r8d, r8d
lea rdx, [0x140066744]
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], ax
mov rcx, rbx
call fcn.140013ac0
mov rax, rbx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140061400
add rsp, 0x280
pop rdi
pop rsi
pop rbx
ret
Function at 0x140060710
Capabilities:
Set registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x58
mov rax, qword [0x140078038]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rdx + 0x18], 8
mov rbx, r9
mov rdi, r8
jb 0x140060736
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140060890
mov eax, dword [rsp + 0x90]
mov qword [rsp + 0x50], rsi
cmp eax, 1
jne 0x14006079d
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x140060775
mov rcx, qword [rbx]
cmp qword [rdi + 0x18], 8
jb 0x14006077f
mov rdi, qword [rdi]
mov eax, dword [rbx + 0x10]
mov r9d, 1
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
jmp 0x14006086f
cmp eax, 4
jne 0x140060806
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp qword [rbx + 0x18], 8
mov rsi, rax
jb 0x1400607b5
mov rbx, qword [rbx]
mov r8d, 0xa
mov dword [rax], 0
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
cmp rbx, qword [rsp + 0x38]
je 0x1400608b1
cmp dword [rsi], 0x22
je 0x1400608be
cmp qword [rdi + 0x18], 8
mov dword [rsp + 0x40], eax
jb 0x1400607f1
mov rdi, qword [rdi]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x40]
mov r9d, 4
jmp 0x14006086a
cmp eax, 0xb
jne 0x140060880
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp qword [rbx + 0x18], 8
mov rsi, rax
jb 0x14006081e
mov rbx, qword [rbx]
mov r8d, 0xa
mov dword [rax], 0
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoull]
cmp rbx, qword [rsp + 0x38]
je 0x1400608cb
cmp dword [rsi], 0x22
je 0x1400608a4
cmp qword [rdi + 0x18], 8
mov qword [rsp + 0x40], rax
jb 0x140060857
mov rdi, qword [rdi]
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x40]
mov r9d, 0xb
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140061400
add rsp, 0x58
pop rdi
pop rbx
ret
lea rcx, str.stoull_argument_out_of_range
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_
int3
lea rcx, str.invalid_stoul_argument
call sub.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_
int3
lea rcx, str.stoul_argument_out_of_range
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_
int3
lea rcx, str.invalid_stoull_argument
call sub.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_
int3
Function at 0x140002d90
Capabilities:
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
xor rax, rsp
mov qword [rbp + 0x5f50], rax
mov rbx, qword [rcx]
lea r8, [0x14002ba60]
mov rsi, rcx
mov r9, rdx
mov edx, 0x1000
lea rcx, [rsp + 0x50]
call fcn.1400040a5
cmp eax, 0x1000

Function at 0x140002e65
Capabilities:
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
lea rdx, str._s_c_s_c_s_c_s
mov dword [rsp + 0x38], r9d
lea rcx, [rbp + 0x3f50]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x4f50]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rax
call fcn.14000543f
jmp 0x140002ec8
mov qword [rsp + 0x6090], rdi
test eax, eax
jne 0x140002f16
lea rdx, [rbx + 0x3070]
lea r8, [rbp + 0xf50]
lea rcx, [rbp + 0x3f50]
call fcn.14000989a
cmp eax, 0xffffffff
jne 0x140003171
lea r8, [rbp + 0x3f50]
lea rdx, [rbp + 0xf50]
lea rcx, str.Failed_to_copy_file__s_from__s__n
call fcn.140004e3d
jmp 0x1400052c7
lea rax, [rsp + 0x50]
mov r9d, 0x5c
lea r8, [rbp + 0x2f50]
mov qword [rsp + 0x20], rax
lea rdx, str._s_c_s.pkg
lea rcx, [rbp + 0x1f50]
call fcn.1400054ec
test eax, eax
je 0x140002fdc
lea rax, [rsp + 0x50]
mov r9d, 0x5c
lea r8, [rbp + 0x2f50]
mov qword [rsp + 0x20], rax
lea rdx, str._s_c_s.exe
lea rcx, [rbp + 0x1f50]
call fcn.14000551e
test eax, eax
je 0x140002fdc
lea rax, [rsp + 0x50]
mov r9d, 0x5c
lea r8, [rbp + 0x2f50]
mov qword [rsp + 0x20], rax
lea rdx, str._s_c_s
lea rcx, [rbp + 0x1f50]
call fcn.14000554c
test eax, eax
je 0x140002fdc
lea rdx, [rsp + 0x50]
lea rcx, str.Referenced_dependency_archive__s_not_found._n
invalid