joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008970
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x28
lea rcx, [0x140007570]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__tzset]
add rsp, 0x28
jmp 0x140008970
sub rsp, 0xa88
mov rax, qword [0x1403d4408]
xor rax, rsp
mov qword [rsp + 0xa70], rax
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMySQL
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140008aec
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x44]
lea rax, [rsp + 0x160]
mov qword [rsp + 0xa90], rbx
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
lea rax, [rsp + 0x48]
mov qword [rsp + 0xa80], rdi
xor edi, edi
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rdi
mov ebx, edi
mov dword [rsp + 0x44], 0xff
mov dword [rsp + 0x40], 0x3ff
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x140008ad1
inc ebx
cmp eax, 0xea
je 0x140008a79
test eax, eax
jne 0x140008ad1
cmp dword [rsp + 0x48], 1
jne 0x140008a79
lea r9, [rsp + 0x160]
mov qword [rsp + 0x20], rdi
lea r8, [0x1400b9dc8]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x560]
call fcn.140017270
lea rcx, [rsp + 0x560]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x44]
lea rax, [rsp + 0x160]
mov dword [rsp + 0x44], 0xff
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x40], 0x3ff
mov qword [rsp + 0x28], rax
mov edx, ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x140008a24
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0xa80]
mov rbx, qword [rsp + 0xa90]
mov rcx, qword [rsp + 0xa70]
xor rcx, rsp
call fcn.1400b5880
add rsp, 0xa88
ret
Function at 0x140008eb0
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x1403d4408]
xor rax, rsp
mov qword [rsp + 0x220], rax
xor ebp, ebp
mov rsi, rcx
mov edi, ebp
lea edx, [rbp + 0x40]
call fcn.140010900
mov rbx, rax
test rax, rax
je 0x140008ff4
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rax], xmm0
mov edx, 0x200
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
test eax, eax
je 0x140008f2c
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140008b10
mov edi, eax
mov edx, 0x200
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x140008f52
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140008b10
add edi, eax
mov r8, rbx
lea rdx, [0x1400ba478]
mov rcx, rsi
call fcn.140008b10
mov edx, 0x200
lea rcx, [rsp + 0x20]
add edi, eax
call fcn.140009040
test rax, rax
je 0x140008fb5
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140008b10
lea r8, str._data
mov edx, 0x200
lea rcx, [rsp + 0x20]
add edi, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140008b10
add edi, eax
lea rcx, str.MYSQL_HOME
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140008fd7
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.140008b10
add edi, eax
mov r8, rbx
lea rdx, [0x1400b8590]
mov rcx, rsi
call fcn.140008b10
add eax, edi
test eax, eax
cmovg rbx, rbp
mov rax, rbx
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1400b5880
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000d590
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
mov r11, rsp
push rbp
push rdi
push r14
sub rsp, 0x190
mov rax, qword [0x1403d4408]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov qword [r11 + 0x10], rbx
mov rdi, rcx
mov qword [r11 + 0x18], rsi
mov ebp, 0x32
xor r14d, r14d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14000d6bf
test al, 0x10
jne 0x14000d736
mov rcx, rdi
bt eax, 0xa
jae 0x14000d5f9
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14000d732
jmp 0x14000d6bf
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov edx, 0x10000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14000d659
mov r9d, 4
mov dword [rsp + 0x40], 3
lea r8, [rsp + 0x40]
mov rcx, rax
lea edx, [r9 + 0x11]
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x14000d732
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0x4000000
xor r8d, r8d
mov edx, 0x10000
mov dword [rsp + 0x20], 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x14000d729
mov qword [rsp + 0x30], r14
lea r8d, [rax + 8]
mov dword [rsp + 0x28], 0x4000000
xor r9d, r9d
mov edx, 0x10000
mov dword [rsp + 0x20], 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000d6e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x14000d6de
test ebp, ebp
je 0x14000d6de
lea ecx, [rax - 0x16]
call qword [sym.imp.KERNEL32.dll_Sleep]
dec ebp
jmp 0x14000d5c3
mov ecx, eax
call fcn.140016b80
jmp 0x14000d742
rdtsc
shl rdx, 0x20
lea r8, str._s._llx.deleted
or rax, rdx
lea rcx, [rsp + 0x50]
mov edx, 0x127
mov qword [rsp + 0x20], rax
mov r9, rdi
call fcn.140017ec0
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000d747
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000d747
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x1c0]
mov rbx, qword [rsp + 0x1b8]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400b5880
add rsp, 0x190
pop r14
pop rdi
pop rbp
ret

Function at 0x14000e5e0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsx ebx, cl
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, ebx
mov edi, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
lea ecx, [rax - 0x41]
cmp cl, 0x19
ja 0x14000e620
movsx ecx, al
sub ecx, 0x41
movzx edx, cl
bt edi, edx
jae 0x14000e620
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret
Function at 0x14000e6c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14000e6e4
test al, 1
je 0x14000e6dc
test bl, 2
jne 0x14000e6e4
xor eax, eax
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0xd
call fcn.140007520
mov dword [rax], 0xd
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
ret

Function at 0x14000f000
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1403d4408]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [0x140bd9fc8]
test rax, rax
jne 0x14000f0b7
movzx eax, word [0x1400bb438]
lea r8, [rsp + 0x22]
mov word [rsp + 0x20], ax
mov edx, 0x1004
movzx eax, byte [0x1400bb43a]
mov ecx, 0x800
mov byte [rsp + 0x22], al
xor eax, eax
mov dword [rsp + 0x23], eax
mov word [rsp + 0x27], ax
mov byte [rsp + 0x29], al
lea r9d, [rax + 7]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor edx, edx
lea r8, [rsp + 0x20]
mov eax, edx
lea r9, str.cp932
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
inc rax
cmp cl, byte [r9 + rax - 1]
jne 0x14000f097
cmp rax, 6
jne 0x14000f080
jmp 0x14000f09c
sbb edx, edx
or edx, 1
test edx, edx
lea rcx, [0x140245f30]
lea rax, [0x14021f770]
cmove rax, rcx
mov qword [0x140bd9fc8], rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400b5880
add rsp, 0x48
ret
Function at 0x140015300
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
xor eax, eax
mov rdi, r9
mov qword [rsp + 0x30], rax
mov rbx, r8
mov qword [rsp + 0x38], rax
mov rsi, rdx
mov qword [rsp + 0x48], rax
test r8, r8
je 0x1400153ad
call fcn.140014f00
mov r8d, 0xffffffff
mov dword [rsp + 0x40], edi
shr rdi, 0x20
lea rcx, [rsp + 0x30]
cmp rbx, r8
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x70]
mov dword [rsp + 0x44], edi
cmovbe r8d, ebx
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140015399
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x1400153ad
cmp eax, 0x6d
je 0x1400153ad
mov ecx, eax
call fcn.140016b80
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x60]
xor eax, eax
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x1400153c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
xor eax, eax
mov rdi, r9
mov qword [rsp + 0x30], rax
mov rbx, r8
mov qword [rsp + 0x38], rax
mov rsi, rdx
mov qword [rsp + 0x48], rax
test r8, r8
je 0x140015453
call fcn.140014f00
mov r8d, 0xffffffff
mov dword [rsp + 0x40], edi
shr rdi, 0x20
lea rcx, [rsp + 0x30]
cmp rbx, r8
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x70]
mov dword [rsp + 0x44], edi
cmovbe r8d, ebx
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14001544f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140016b80
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140015470
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, r8
mov rdi, rdx
test r8, r8
je 0x1400154ed
call fcn.140014f00
mov r8d, 0xffffffff
mov qword [rsp + 0x20], 0
cmp rbx, r8
lea r9, [rsp + 0x50]
mov rdx, rdi
mov rcx, rax
cmovbe r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400154de
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x1400154ed
cmp eax, 0x6d
je 0x1400154ed
mov ecx, eax
call fcn.140016b80
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1400157c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x50
xor ebx, ebx
mov rsi, rdx
mov r9d, ecx
test r8, r8
jne 0x1400157e4
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
mov edx, 0xffffffff
mov qword [rsp + 0x60], rdi
cmp r8, rdx
mov edi, edx
cmovbe rdi, r8
call fcn.140014ee0
test al, 8
je 0x14001581d
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rbx
lea rbx, [rsp + 0x30]
mov qword [rsp + 0x40], 0xffffffffffffffff
mov ecx, r9d
call fcn.140014f00
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rbx
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdi, qword [rsp + 0x60]
test eax, eax
jne 0x140015866
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140016b80
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret

Function at 0x140016d60
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x138
mov rax, qword [0x1403d4408]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov ebp, r9d
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
jne 0x140016dad
lea rdx, [rsp + 0x20]
mov ecx, 0xf6
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
lea rcx, [rsp + 0x20]
cmove rcx, rbx
mov rbx, rcx
mov r9, rsi
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x140016dca
mov eax, 0xffffffff
jmp 0x140016e10
mov r8d, dword [rsp + 0x180]
mov rcx, rsi
mov edx, r8d
and edx, 0x40
or edx, ebp
or edx, 0x302
call fcn.140008010
mov edi, eax
test eax, eax
jns 0x140016e08
call fcn.140007520
xor edx, edx
mov rcx, rsi
mov ebx, dword [rax]
call fcn.14000d4f0
call fcn.140007520
mov dword [rax], ebx
jmp 0x140016e0e
inc dword [0x140bd5b14]
mov eax, edi
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1400b5880
add rsp, 0x138
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140017200
Capabilities:
Hash data with crc32

Disassembly:
mov r8d, ecx
lea r9, [0x1400bbd30]
shr r8d, 8
movzx ecx, cl
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx edx, r8b
shr r8d, 8
xor r8d, dword [r9 + rdx*4]
mov eax, r8d
ret
Function at 0x14004e220
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor r9d, r9d
movsxd rbp, r8d
xor esi, esi
mov rdi, rdx
mov rbx, rcx
mov r14, rcx
test rcx, rcx
je 0x14004e3d1
mov rax, qword [rcx + 0x58]
lea r15, [rcx + 0x58]
test rax, rax
je 0x14004e281
mov r8, rdx
mov dword [rsp + 0x28], 1
lea edx, [rsi + 2]
mov dword [rsp + 0x20], esi
mov r9d, ebp
call rax
mov r9d, eax
test eax, eax
jle 0x14004e3d4
mov qword [rsp + 0x50], r12
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x14004e29d
cmp byte [rbx + 0x80], 3
je 0x14004e29d
mov rbx, rax
jmp 0x14004e286
lea r12, [0x140000000]
test r9d, r9d
js 0x14004e3a4
mov rax, qword [rbx + 8]
test rax, rax
je 0x14004e2d6
mov r10, qword [rax + 0x110]
test r10, r10
je 0x14004e2d6
mov r8d, ebp
mov rdx, rdi
mov rcx, rbx
call r10
mov r9d, eax
jmp case.default.0x14004e2f6
movzx eax, byte [rbx + 0x80]
add eax, 0xfffffffe
cmp eax, 6
ja case.default.0x14004e2f6
cdqe
mov ecx, dword [r12 + rax*4 + 0x4e3f0]
add rcx, r12
jmp rcx
test esi, esi
jle case.default.0x14004e2f6
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call fcn.14004d960
mov r9d, eax
jmp case.default.0x14004e2f6
mov r8d, ebp
mov rdx, rdi
mov rcx, rbx
call fcn.14004d9a0
mov r9d, eax
jmp case.default.0x14004e2f6
mov r8d, ebp
mov rdx, rdi
mov rcx, rbx
call fcn.14004da60
mov r9d, eax
jmp case.default.0x14004e2f6
mov r9, qword [rbx + 0x30]
test r9, r9
je case.0x14004e2f6.2
mov r8, rbp
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r9, rax
jmp case.default.0x14004e2f6
mov r9, r14
mov r8d, ebp
mov rdx, rdi
mov rcx, rbx
call fcn.14004dbc0
mov r9d, eax
jmp case.default.0x14004e2f6
mov r8d, r9d
mov rdx, rdi
mov rcx, rbx
call fcn.14004d9e0
mov r9d, eax
jmp case.default.0x14004e2f6
mov r9d, 0xffffff52
cmp rbx, r14
je 0x14004e3a4
mov rbx, qword [rbx + 0x10]
test r9d, r9d
mov eax, r9d
cmovle eax, esi
mov esi, eax
test rbx, rbx
jne 0x14004e2a4
mov rax, qword [r15]
mov r12, qword [rsp + 0x50]
test rax, rax
je 0x14004e3d1
mov dword [rsp + 0x28], r9d
mov r8, rdi
mov r9d, ebp
mov dword [rsp + 0x20], 0
mov edx, 0x82
mov rcx, r14
call rax
mov r9d, eax
mov eax, r9d
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x140053ad0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx r9d, byte [rcx + 0x228]
sub r9d, 4
je 0x140053b04
sub r9d, 2
je 0x140053aff
sub r9d, 1
je 0x140053afa
cmp r9d, 1
je fcn.140088a60
mov eax, 0xffffff53
ret
jmp fcn.140088a60
jmp fcn.140078ba0
jmp fcn.140086a50
Function at 0x1400593f0
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rdi, rcx
movzx eax, r8b
xor ecx, ecx
mov r12d, 0x50
mov dword [rsp + 0x70], r12d
movzx r15d, dl
mov dword [rsp + 0x78], ecx
mov ebp, ecx
mov r14d, dword [rdi + 0x5f0]
mov r13d, ecx
mov ebx, ecx
cmp dl, 0xcc
jne 0x140059466
mov ecx, eax
sub ecx, 0x15
je 0x140059451
sub ecx, 0x95
je 0x140059451
sub ecx, 1
je 0x140059451
cmp ecx, 2
jne 0x14005946e
mov eax, 1
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
lea eax, [r15 + 0x40]
test al, 0xef
jne 0x140059451
mov rcx, qword [rdi + 0x14f8]
mov edx, 0xa
call fcn.140054290
test rax, rax
je 0x140059451
mov qword [rsp + 0x28], rsi
mov rsi, qword [rax + 8]
test rsi, rsi
je 0x1400595cd
test ebx, ebx
jne 0x1400595cd
movzx edx, word [rsi]
cmp dx, 0x1e
ja 0x1400595c0
mov rcx, rdi
call fcn.140052410
test eax, eax
jne 0x1400595c0
movzx ecx, word [rsi]
sub ecx, 0x15
je 0x1400594f8
sub ecx, 2
je 0x1400594ec
sub ecx, 1
je 0x1400594e0
cmp ecx, 1
jne 0x1400595c0
mov edx, 0xd3
lea eax, [rbx + 0x42]
jmp 0x140059502
mov edx, 0xd2
mov eax, 0x30
jmp 0x140059502
mov edx, 0x20e
mov eax, 0x20
jmp 0x140059502
mov edx, 0xd1
mov eax, 0x1c
test ebp, ebp
jne 0x14005951c
cmp word [rdi + 0x618], ax
ja 0x14005951c
movzx ecx, ax
cmp r12d, ecx
jbe 0x14005951c
mov ebp, edx
mov r12d, ecx
test r14d, r14d
jne 0x14005952c
cmp word [rdi + 0x618], ax
cmove r14d, edx
movzx ecx, ax
test r13d, r13d
je 0x14005953a
cmp dword [rsp + 0x70], ecx
jbe 0x14005954a
cmp word [rdi + 0x618], ax
ja 0x14005954a
mov r13d, edx
mov dword [rsp + 0x70], ecx
cmp r15b, 0xc0
jne 0x140059581
movzx eax, byte [rsp + 0x80]
add eax, 0xfffffff9
cmp eax, 0xa8
ja case.0x14005957f.11
lea r8, [0x140000000]
cdqe
movzx eax, byte [r8 + rax + 0x59650]
mov ecx, dword [r8 + rax*4 + 0x59648]
add rcx, r8
jmp rcx
cmp r15b, 0xcc
jne 0x1400595c0
movzx ecx, byte [rsp + 0x80]
sub ecx, 0x13
je case.0x14005957f.7
sub ecx, 1
je case.0x14005957f.7
sub ecx, 0x94
je case.0x14005957f.7
cmp ecx, 1
je case.0x14005957f.7
mov ebx, 1
jmp 0x1400595c0
xor ebx, ebx
mov dword [rsp + 0x78], 1
cmp dword [rdi + 0x5f0], edx
sete bl
mov rsi, qword [rsi + 8]
test rsi, rsi
jne 0x140059496
mov ecx, dword [rdi + 0x5f0]
mov rdx, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x28]
mov dword [rdx], ecx
test ecx, ecx
jne 0x14005961b
movzx eax, word [rdi + 0x618]
cmp r12d, eax
jne 0x1400595f9
lea ebx, [rcx + 1]
mov dword [rdx], ebp
mov ecx, ebp
test ecx, ecx
jne 0x14005961b
lea ebx, [rcx + 1]
mov dword [rdx], r14d
mov ecx, r14d
test ecx, ecx
jne 0x14005961b
xor eax, eax
mov ecx, eax
cmp r12d, dword [rsp + 0x70]
jne 0x14005961d
mov dword [rdx], ebp
mov ecx, ebp
jmp 0x14005961d
xor eax, eax
test ecx, ecx
jne 0x140059633
mov ecx, r13d
mov dword [rdx], r13d
test ecx, ecx
jne 0x140059633
cmp dword [rsp + 0x78], r13d
cmovne ebx, eax
mov eax, ebx
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x14005a980
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x1403d4408]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, qword [rsp + 0xe0]
xorps xmm0, xmm0
mov r15, qword [rsp + 0xe8]
mov rbp, r8
mov r12, rdx
movzx r14d, r9w
mov rsi, rcx
mov rdx, rdi
mov rcx, qword [rcx + 0x270]
xor r8d, r8d
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call fcn.14009b680
test eax, eax
jne 0x14005abec
mov rcx, qword [rsi + 0x270]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x80], rbx
lea rdx, [rsp + 0x40]
mov ebx, 0x20
mov r9d, ebx
call fcn.14009b640
test eax, eax
jne 0x14005abe4
mov rcx, qword [rsi + 0x270]
lea r8d, [rbx - 0x1f]
mov rdx, rdi
call fcn.14009b680
lea rdi, [rsp + 0x40]
mov edx, eax
neg edi
and edi, 7
test eax, eax
je 0x14005aa87
sub ebx, edi
lea rcx, [rsp + 0x40]
test edi, edi
je 0x14005aa4b
mov byte [rcx], 0
inc rcx
add edi, 0xffffffff
jne 0x14005aa40
cmp ebx, 8
jb 0x14005aa70
mov eax, ebx
shr rax, 3
xor edi, edi
nop dword [rax + rax]
mov qword [rcx], rdi
add ebx, 0xfffffff8
add rcx, 8
sub rax, 1
jne 0x14005aa60
test ebx, ebx
je 0x14005aa80
mov byte [rcx], 0
lea rcx, [rcx + 1]
add ebx, 0xffffffff
jne 0x14005aa74
mov eax, edx
jmp 0x14005abe4
mov rcx, qword [rsi + 0x14e8]
lea rdx, [rsp + 0x40]
mov r8d, ebx
call fcn.1400a0d10
sub ebx, edi
lea rcx, [rsp + 0x40]
mov edx, eax
test edi, edi
je 0x14005aabb
nop dword [rax + rax]
mov byte [rcx], 0
inc rcx
add edi, 0xffffffff
jne 0x14005aab0
xor edi, edi
cmp ebx, 8
jb 0x14005aae0
mov eax, ebx
shr rax, 3
nop dword [rax + rax]
mov qword [rcx], rdi
add ebx, 0xfffffff8
add rcx, 8
sub rax, 1
jne 0x14005aad0
test ebx, ebx
je 0x14005aaf0
mov byte [rcx], dil
lea rcx, [rcx + 1]
add ebx, 0xffffffff
jne 0x14005aae4
test edx, edx
jne 0x14005aa80
movzx r8d, word [rsp + 0xf0]
lea rax, [rsp + 0x60]
mov rcx, qword [rsi + 0x14e8]
mov ebx, r14d
mov dword [rsp + 0x30], 0x10
mov r9, rbp
mov qword [rsp + 0x28], rax
mov rdx, r15
mov dword [rsp + 0x20], ebx
call fcn.1400a0f80
test eax, eax
jne 0x14005abe4
mov rcx, qword [rsp + 0xf8]
lea rax, [rsp + 0x60]
sub rcx, rax
xorps xmm4, xmm4
xorps xmm3, xmm3
nop word [rax + rax]
xorps xmm0, xmm0
lea rax, [rsp + 0x60]
add rax, rdi
add rdi, 8
movd xmm2, dword [rcx + rax]
movd xmm1, dword [rax]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [rax + 4]
punpcklbw xmm1, xmm0
orps xmm4, xmm2
movd xmm2, dword [rax + rcx + 4]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp rdi, 0x10
jl 0x14005ab50
orps xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd eax, xmm3
test eax, eax
je 0x14005abcf
mov eax, 0xfffffecf
jmp 0x14005abe4
mov rcx, qword [rsi + 0x270]
mov r9d, ebx
mov r8, rbp
mov rdx, r12
call fcn.14009b640
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400b5880
add rsp, 0x88
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140064100
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor eax, eax
mov r10, rcx
mov r9d, eax
test r8d, r8d
jle 0x1400641d2
cmp r8d, 8
jb 0x1400641d2
mov qword [rsp + 0x10], rbx
lea r11, [rdx + 4]
mov qword [rsp], rdi
sub rcx, rdx
movsxd rbx, r8d
mov rdi, 0xfffffffffffffffc
and rbx, 0xfffffffffffffff8
xorps xmm4, xmm4
sub rdi, rdx
xorps xmm3, xmm3
nop word [rax + rax]
movd xmm2, dword [rcx + r11 - 4]
xorps xmm0, xmm0
movd xmm1, dword [r11 - 4]
lea r11, [r11 + 8]
punpcklbw xmm2, xmm0
lea rax, [rdi + r11]
punpcklwd xmm2, xmm0
add r9d, 8
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [r11 - 8]
punpcklbw xmm1, xmm0
orps xmm4, xmm2
movd xmm2, dword [rcx + r11 - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp rax, rbx
jl 0x140064150
mov rdi, qword [rsp]
orps xmm3, xmm4
mov rbx, qword [rsp + 0x10]
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd eax, xmm3
movsxd r11, r9d
movsxd r9, r8d
cmp r11, r9
jge 0x140064208
sub r10, rdx
lea rcx, [r11 + rdx]
sub r9, r11
nop word [rax + rax]
movzx r8d, byte [rcx + r10]
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
xor r8d, edx
or eax, r8d
sub r9, 1
jne 0x1400641f0
add rsp, 8
ret

Function at 0x14006c690
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea r9d, [rdx - 1]
movsxd r10, edx
dec r10
add r10, rcx
mov ecx, 0xff
movzx ebx, byte [r10]
mov eax, ebx
sub eax, edx
add eax, r8d
shr eax, 0x1f
dec al
cmp r9d, ecx
cmovg r9d, ecx
xor r8d, r8d
movsxd r11, r9d
test r9d, r9d
jle 0x14006c6f2
nop
mov edx, ebx
lea r10, [r10 - 1]
sub edx, r8d
movzx ecx, bl
xor cl, byte [r10 + 1]
inc r8d
shr edx, 0x1f
dec dl
and dl, cl
or al, dl
sub r11, 1
jne 0x14006c6d0
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret