joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004faf0
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rbp + 0x120], rax
cmp byte [0x1401b5fb8], 0
je 0x14004fb27
lea rax, [0x1401b0680]
jmp 0x14004fd9c
mov ecx, dword [0x1401b4d80]
mov qword [rsp + 0x240], rbx
mov eax, 0x38e38e39
lea r8d, [rcx + 1]
mov qword [rsp + 0x250], rdi
mov qword [rsp + 0x258], r14
mov edi, 4
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 0xb
jne 0x14004fb81
mov ecx, edi
call fcn.1400c8398
mov ecx, dword [0x1401b4d80]
mov dword [rax], ecx
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
xor r14d, r14d
mov dword [rbp + 0xd0], 0x19000e
mov dword [rbp + 0xd4], 0x60016
mov dword [rbp + 0xd8], 0x490011
imul r8d, eax
imul r8d, ecx
mov eax, 0xb21642c9
mov dword [rbp + 0xdc], 0x2000c
mov dword [rbp + 0xe0], 0x1f0007
mov dword [rbp + 0xe4], 0x50004
mov dword [rbp + 0xe8], 0x550009
mov dword [rbp + 0xec], 0x2000d
imul r8d
add edx, r8d
mov dword [rbp + 0xf0], 0x17001c
mov dword [rbp + 0xf4], 0x4a0001
sar edx, 4
mov dword [rbp + 0xf8], 0x140000
mov dword [rbp + 0xfc], 0x170009
mov eax, edx
mov dword [rbp + 0x100], 0x7000e
mov dword [rbp + 0x104], 0x54001b
shr eax, 0x1f
mov dword [rbp + 0x108], 0x40001
mov dword [rbp + 0x10c], 0x5000e
add edx, eax
mov dword [rbp + 0x110], 0x4f
imul edx, edx, 0x17
sub r8d, edx
cmp r8d, 0xd
jne 0x14004fcd4
mov qword [rsp + 0x248], rsi
lea rdi, [rsp + 0x20]
mov esi, r14d
nop
mov r9d, r14d
nop word [rax + rax]
mov eax, ecx
lea r8d, [rsi + 1]
lea ebx, [r9 + 1]
cdq
idiv r8d
mov eax, ecx
sub eax, esi
mov r8d, edx
imul r8d, eax
mov eax, ecx
lea rcx, [0x140140c00]
cdq
idiv ebx
add r8d, eax
sub r8d, r9d
mov edx, r8d
call fcn.1400c8aec
mov ecx, dword [0x1401b4d80]
add rdi, 4
mov r9d, ebx
cmp ebx, 0x12
jl 0x14004fc80
inc esi
cmp esi, 6
jl 0x14004fc70
mov rsi, qword [rsp + 0x248]
mov rdi, qword [rsp + 0x250]
mov rbx, qword [rsp + 0x240]
lea r9, [0x1401b0680]
lea r8, [0x1401afda1]
nop word [rax + rax]
movzx eax, byte [r14 + r8 - 1]
movzx edx, word [rbp + r14*2 + 0xd2]
add r14, 3
xor ax, word [rbp + r14*2 + 0xca]
mov word [r9 + r14*2 - 6], ax
movzx eax, byte [r14 + r8 - 3]
xor dx, ax
movzx eax, byte [r14 + r8 - 2]
xor ax, word [rbp + r14*2 + 0xce]
mov word [r9 + r14*2 - 4], dx
mov word [r9 + r14*2 - 2], ax
cmp r14, 0x21
jl 0x14004fd00
mov r14, qword [rsp + 0x258]
mov r8d, ecx
mov eax, 0x2aaaaaab
mov byte [0x1401b5fb8], 1
imul r8d, ecx
imul r8d, ecx
imul r8d
mov eax, 0x80684011
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
shl ecx, 3
sub r8d, ecx
mov ecx, dword [0x1401b5ab0]
cmp r8d, 0xc
cmove ecx, eax
mov rax, r9
mov dword [0x1401b5ab0], ecx
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x230
pop rbp
ret
Function at 0x14004fdc0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp byte [0x1401b5fae], 0
je 0x14004fdf5
lea rax, [0x1401b09c0]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x48
ret
mov ecx, dword [0x1401b4d80]
mov eax, 0x66666667
mov qword [rsp + 0x50], rbx
xor ebx, ebx
mov dword [rsp + 0x20], 0xe001d
mov dword [rsp + 0x24], 0x1a0016
imul ecx, ecx
imul ecx
sar edx, 1
mov dword [rsp + 0x28], 0x6000a
mov dword [rsp + 0x2c], 0x470005
mov eax, edx
mov dword [rsp + 0x30], 0x190016
mov dword [rsp + 0x34], 0x1f
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
cmp ecx, 3
jne 0x14004fe99
lea ecx, [rbx + 0x28]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x40], rdi
call fcn.1400c7228
mov edi, ebx
mov rsi, rax
call fcn.1400c84d4
inc rdi
add eax, dword [0x1401b4d80]
mov dword [rsi + rdi*4 - 4], eax
cmp rdi, 0xa
jl 0x14004fe66
mov ecx, dword [rsi + 0x24]
mov dword [0x1401b4d80], ecx
mov rcx, rsi
call fcn.1400c8c8c
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
lea rax, [0x1401b09c0]
lea rdx, [0x1401afda0]
nop word [rax + rax]
movzx ecx, byte [rbx + rdx]
inc rbx
xor cx, word [rsp + rbx*2 + 0x1e]
mov word [rax + rbx*2 - 2], cx
cmp rbx, 0xb
jl 0x14004feb0
mov byte [0x1401b5fae], 1
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x48
ret

Function at 0x14004fef0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rsp + 0x20], rax
cmp byte [0x1401b5f9e], 0
je 0x14004ff25
lea rax, [0x1401b0b40]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x38
ret
mov dword [rsp], 0x1b0024
mov dword [rsp + 4], 0x70001
mov dword [rsp + 8], 0x1b0033
mov dword [rsp + 0xc], 0x40004
mov dword [rsp + 0x10], 0x180016
mov dword [rsp + 0x14], 0x4b001e
mov dword [rsp + 0x18], 0xd
xor r8d, r8d
mov dword [rsp + 0x1c], 0x19
lea rdx, [0x1401b0b40]
lea r9, [0x1401afda1]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 2]
add r8, 5
xor ax, word [rsp + r8*2 - 0xa]
mov word [rdx + r8*2 - 0xa], ax
movzx eax, byte [r8 + r9 - 5]
xor cx, ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rsp + r8*2 - 6]
mov word [rdx + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0xf
jl 0x14004ff80
mov byte [0x1401b5f9e], 1
mov rax, rdx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x38
ret
Function at 0x140050010
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401b5fa3], 0
je 0x140050049
lea rax, [0x1401b04d0]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x50
pop rbp
ret
mov r9d, dword [0x1401b4d80]
mov eax, 0x66666667
xor ecx, ecx
lea r8d, [r9 + 1]
mov dword [rbp - 0x50], 0x190028
mov r10d, 1
mov dword [rbp - 0x4c], 0x80001
mov dword [rbp - 0x48], 0xc0017
mov dword [rbp - 0x44], 0x8003f
imul r8d, r9d
imul r8d
sar edx, 2
mov dword [rbp - 0x40], 0x7001c
mov dword [rbp - 0x3c], 0xe0005
mov eax, edx
mov dword [rbp - 0x38], 0x50002
mov dword [rbp - 0x34], 0x590058
shr eax, 0x1f
mov dword [rbp - 0x30], 0xa003d
mov dword [rbp - 0x2c], 0x1a0014
add edx, eax
mov dword [rbp - 0x28], 0xe0003
mov dword [rbp - 0x24], 9
lea eax, [rdx + rdx*4]
mov dword [rbp - 0x20], 0x12004b
mov dword [rbp - 0x1c], 0x1d0009
add eax, eax
mov dword [rbp - 0x18], 0xf0004
mov dword [rbp - 0x14], 0xc
sub r8d, eax
cmp r8d, 5
jne 0x1400500fe
test r9d, r9d
cmove r9d, r10d
mov dword [0x1401b4d80], r9d
lea r10, [0x1401b04d0]
lea rdx, [0x1401afda0]
nop dword [rax]
movzx eax, byte [rcx + rdx]
inc rcx
xor ax, word [rbp + rcx*2 - 0x52]
mov word [r10 + rcx*2 - 2], ax
cmp rcx, 0x1f
jl 0x140050110
mov eax, 0x4ec4ec4f
mov r8d, r9d
mov byte [0x1401b5fa3], 1
imul r8d, r9d
imul r8d, r9d
imul r8d
mov eax, 0x704785e4
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, dword [0x1401b5be8]
imul edx, edx, 0xd
sub r8d, edx
cmp r8d, 9
cmove ecx, eax
mov rax, r10
mov dword [0x1401b5be8], ecx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x50
pop rbp
ret

Function at 0x140050180
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401b5f9a], 0
lea rax, [0x1401b05a8]
jne 0x14005026e
xor r8d, r8d
mov dword [rbp - 0x40], 0x19003c
mov dword [rbp - 0x3c], 0x1d000d
mov dword [rbp - 0x38], 0x390006
mov dword [rbp - 0x34], 0x80019
mov dword [rbp - 0x30], 0xe0010
mov word [rbp - 0x18], r8w
mov dword [rbp - 0x2c], 0x18001e
mov dword [rbp - 0x28], 0x100023
mov dword [rbp - 0x24], 0x40006
mov dword [rbp - 0x20], 0x1d001c
mov dword [rbp - 0x1c], 0x4a004f
lea r9, [0x1401afda1]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 5
xor cx, word [rbp + r8*2 - 0x4a]
mov word [rax + r8*2 - 0xa], cx
movzx ecx, byte [r8 + r9 - 5]
xor dx, cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 8], dx
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x14
jl 0x140050200
mov byte [0x1401b5f9a], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x40
pop rbp
ret
Function at 0x140050280
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x1401b4d80]
xor ebx, ebx
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 4
jne 0x1400502db
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp byte [0x1401b5fc6], bl
je 0x1400502fd
lea rax, [0x1401b06c8]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x60
pop rbx
ret
mov dword [rsp + 0x30], 0xe001d
mov dword [rsp + 0x34], 0x1a0016
mov dword [rsp + 0x38], 0x6000a
mov dword [rsp + 0x3c], 0x5d0005
mov dword [rsp + 0x40], 0x5b0053
mov dword [rsp + 0x44], 0x5b0043
mov dword [rsp + 0x48], 0x450040
mov dword [rsp + 0x4c], 0x5b0045
mov word [rsp + 0x50], bx
lea rdx, [0x1401b06c8]
lea r8, [0x1401afda1]
movzx eax, byte [rbx + r8 - 1]
movzx ecx, word [rsp + rbx*2 + 0x32]
add rbx, 4
xor ax, word [rsp + rbx*2 + 0x28]
mov word [rdx + rbx*2 - 8], ax
movzx eax, byte [rbx + r8 - 4]
xor cx, ax
mov word [rdx + rbx*2 - 6], cx
movzx ecx, byte [rbx + r8 - 3]
xor cx, word [rsp + rbx*2 + 0x2c]
mov word [rdx + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor cx, word [rsp + rbx*2 + 0x2e]
mov word [rdx + rbx*2 - 2], cx
cmp rbx, 0x10
jl 0x140050350
mov byte [0x1401b5fc6], 1
mov rax, rdx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x60
pop rbx
ret
Function at 0x1400503c0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rdi
push rbp
lea rbp, [r11 - 0x5e8]
sub rsp, 0x6e0
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rbp + 0x5d0], rax
mov ecx, dword [0x1401b4d80]
xor edi, edi
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x38e38e39
imul r8d, ecx
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub r8d, eax
cmp r8d, 5
jne 0x14005054f
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov esi, 0xd1
mov ebx, edi
nop
call fcn.1400c84d4
inc rbx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rsp + rbx*8 + 0x18], xmm0
cmp rbx, rsi
jb 0x140050430
mov rbx, qword [rsp + 0x6f0]
mov r8, rdi
mov r9d, 0xd0
nop dword [rax]
mov ecx, 0xd0
cmp r8, rcx
jge 0x140050538
cmp r9, 4
jl 0x14005050d
mov edx, 0xcc
mov ecx, 0x34
lea rax, [rbp + 0x590]
sub rdx, r8
shr rdx, 2
inc rdx
sub rcx, rdx
shl rcx, 2
nop word [rax + rax]
movsd xmm0, qword [rax + 0x10]
movsd xmm1, qword [rax + 8]
comisd xmm0, xmm1
jbe 0x1400504ba
movsd qword [rax + 0x10], xmm1
movsd qword [rax + 8], xmm0
movsd xmm0, qword [rax + 8]
movsd xmm1, qword [rax]
comisd xmm0, xmm1
jbe 0x1400504d2
movsd qword [rax + 8], xmm1
movsd qword [rax], xmm0
movsd xmm0, qword [rax]
movsd xmm1, qword [rax - 8]
comisd xmm0, xmm1
jbe 0x1400504ea
movsd qword [rax], xmm1
movsd qword [rax - 8], xmm0
movsd xmm0, qword [rax - 8]
movsd xmm1, qword [rax - 0x10]
comisd xmm0, xmm1
jbe 0x140050504
movsd qword [rax - 8], xmm1
movsd qword [rax - 0x10], xmm0
movups xmmword [rax - 0x10], xmm0
sub rax, 0x20
dec rdx
jne 0x1400504a0
cmp rcx, r8
jle 0x140050538
movsd xmm0, qword [rsp + rcx*8 + 0x20]
movsd xmm1, qword [rsp + rcx*8 + 0x18]
comisd xmm0, xmm1
jbe 0x140050530
movsd qword [rsp + rcx*8 + 0x20], xmm1
movsd qword [rsp + rcx*8 + 0x18], xmm0
dec rcx
cmp rcx, r8
jg 0x140050512
inc r8
dec r9
dec rsi
jne 0x140050460
mov rsi, qword [rsp + 0x6f8]
cmp byte [0x1401b5fba], dil
je 0x140050564
lea rax, [0x1401b0c50]
jmp 0x140050638
mov dword [rbp + 0x5b0], 0x60002
mov dword [rbp + 0x5b4], 0xe0005
mov dword [rbp + 0x5b8], 0x490006
mov dword [rbp + 0x5bc], 0x60005
mov dword [rbp + 0x5c0], 0xe001e
mov dword [rbp + 0x5c4], 0x18004d
mov dword [rbp + 0x5c8], 0x19000b
mov dword [rbp + 0x5cc], 0xd
lea rdx, [0x1401b0c50]
lea r8, [0x1401afda1]
movzx eax, byte [rdi + r8 - 1]
movzx ecx, word [rbp + rdi*2 + 0x5b2]
add rdi, 5
xor ax, word [rbp + rdi*2 + 0x5a6]
mov word [rdx + rdi*2 - 0xa], ax
movzx eax, byte [rdi + r8 - 5]
xor cx, ax
movzx eax, byte [rdi + r8 - 4]
xor ax, word [rbp + rdi*2 + 0x5aa]
mov word [rdx + rdi*2 - 8], cx
movzx ecx, byte [rdi + r8 - 3]
xor cx, word [rbp + rdi*2 + 0x5ac]
mov word [rdx + rdi*2 - 6], ax
mov word [rdx + rdi*2 - 4], cx
movzx ecx, byte [rdi + r8 - 2]
xor cx, word [rbp + rdi*2 + 0x5ae]
mov word [rdx + rdi*2 - 2], cx
cmp rdi, 0xf
jl 0x1400505c2
mov byte [0x1401b5fba], 1
mov rax, rdx
mov rcx, qword [rbp + 0x5d0]
xor rcx, rsp
call fcn.1400c7be0
mov rdi, qword [rsp + 0x700]
add rsp, 0x6e0
pop rbp
ret
Function at 0x140050660
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
lea rbp, [r11 - 0x3b8]
sub rsp, 0x4b0
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rbp + 0x3a8], rax
mov eax, dword [0x1401b4d80]
xor ebx, ebx
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 7
jne 0x1400507df
mov qword [r11 + 8], rsi
mov qword [r11 + 0x10], rdi
mov edi, ebx
mov esi, 0x89
call fcn.1400c84d4
inc rdi
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rsp + rdi*8 + 0x18], xmm0
cmp rdi, rsi
jb 0x1400506c3
mov rdi, qword [rsp + 0x4c8]
mov r8, rbx
mov r9d, 0x88
nop
mov ecx, 0x88
cmp r8, rcx
jge 0x1400507c8
cmp r9, 4
jl 0x14005079d
mov edx, 0x84
mov ecx, 0x22
lea rax, [rbp + 0x350]
sub rdx, r8
shr rdx, 2
inc rdx
sub rcx, rdx
shl rcx, 2
nop word [rax + rax]
movsd xmm0, qword [rax + 0x10]
movsd xmm1, qword [rax + 8]
comisd xmm0, xmm1
jbe 0x14005074a
movsd qword [rax + 0x10], xmm1
movsd qword [rax + 8], xmm0
movsd xmm0, qword [rax + 8]
movsd xmm1, qword [rax]
comisd xmm0, xmm1
jbe 0x140050762
movsd qword [rax + 8], xmm1
movsd qword [rax], xmm0
movsd xmm0, qword [rax]
movsd xmm1, qword [rax - 8]
comisd xmm0, xmm1
jbe 0x14005077a
movsd qword [rax], xmm1
movsd qword [rax - 8], xmm0
movsd xmm0, qword [rax - 8]
movsd xmm1, qword [rax - 0x10]
comisd xmm0, xmm1
jbe 0x140050794
movsd qword [rax - 8], xmm1
movsd qword [rax - 0x10], xmm0
sub rax, 0x20
dec rdx
jne 0x140050730
cmp rcx, r8
jle 0x1400507c8
movsd xmm0, qword [rsp + rcx*8 + 0x20]
movsd xmm1, qword [rsp + rcx*8 + 0x18]
comisd xmm0, xmm1
jbe 0x1400507c0
movsd qword [rsp + rcx*8 + 0x20], xmm1
movsd qword [rsp + rcx*8 + 0x18], xmm0
dec rcx
cmp rcx, r8
jg 0x1400507a2
inc r8
dec r9
dec rsi
jne 0x1400506f0
mov rsi, qword [rsp + 0x4c0]
cmp byte [0x1401b5fbd], bl
je 0x1400507f3
lea rax, [0x1401b0bd8]
jmp 0x140050909
mov dword [rbp + 0x370], 0xa0008
mov dword [rbp + 0x374], 0x1d000a
mov dword [rbp + 0x378], 0x80043
mov dword [rbp + 0x37c], 0xb0007
mov dword [rbp + 0x380], 0x8001c
mov dword [rbp + 0x384], 0x4004d
mov dword [rbp + 0x388], 0x1001b
mov dword [rbp + 0x38c], 0x4004b
mov dword [rbp + 0x390], 0x440008
mov dword [rbp + 0x394], 0xf0018
mov dword [rbp + 0x398], 0x9001d
mov dword [rbp + 0x39c], 0xd0014
mov word [rbp + 0x3a0], bx
lea rdx, [0x1401b0bd8]
lea r8, [0x1401afda1]
movzx eax, byte [rbx + r8 - 1]
movzx ecx, word [rbp + rbx*2 + 0x372]
add rbx, 6
xor ax, word [rbp + rbx*2 + 0x364]
mov word [rdx + rbx*2 - 0xc], ax
movzx eax, byte [rbx + r8 - 6]
xor cx, ax
movzx eax, byte [rbx + r8 - 5]
xor ax, word [rbp + rbx*2 + 0x368]
mov word [rdx + rbx*2 - 0xa], cx
movzx ecx, byte [rbx + r8 - 3]
xor cx, word [rbp + rbx*2 + 0x36c]
mov word [rdx + rbx*2 - 8], ax
movzx eax, byte [rbx + r8 - 4]
xor ax, word [rbp + rbx*2 + 0x36a]
mov word [rdx + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor cx, word [rbp + rbx*2 + 0x36e]
mov word [rdx + rbx*2 - 6], ax
mov word [rdx + rbx*2 - 2], cx
cmp rbx, 0x18
jl 0x140050880
mov byte [0x1401b5fbd], 1
mov rax, rdx
mov rcx, qword [rbp + 0x3a8]
xor rcx, rsp
call fcn.1400c7be0
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x4b0
pop rbp
ret
Function at 0x140050930
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x108
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rsp + 0xf8], rax
mov eax, dword [0x1401b4d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub ecx, edx
cmp ecx, 4
jne 0x14005097a
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp byte [0x1401b5f90], 0
lea rax, [0x1401b0a90]
jne 0x140050a32
mov dword [rsp + 0xd0], 0xe0039
mov dword [rsp + 0xd4], 0xd0005
mov dword [rsp + 0xd8], 0x1b0033
mov dword [rsp + 0xdc], 0x40004
mov dword [rsp + 0xe0], 0x180016
mov dword [rsp + 0xe4], 0x26001e
mov dword [rsp + 0xe8], 0x18000b
mov dword [rsp + 0xec], 0x190004
mov dword [rsp + 0xf0], 0x5e0017
mov dword [rsp + 0xf4], 0x55
xor ecx, ecx
lea r8, [0x1401afda0]
nop word [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 + 0xce]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x13
jl 0x140050a10
mov byte [0x1401b5f90], 1
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x108
ret

Function at 0x140050a50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rsp + 0x20], rax
cmp byte [0x1401b5fa5], 0
lea rax, [0x1401b0350]
jne 0x140050af7
xor ecx, ecx
mov dword [rsp], 0x40005
mov dword [rsp + 4], 0x80012
mov dword [rsp + 8], 0xc004e
mov dword [rsp + 0xc], 0x150019
mov dword [rsp + 0x10], 0x19001c
mov word [rsp + 0x1c], cx
mov dword [rsp + 0x14], 0xc0043
mov dword [rsp + 0x18], 0x130007
lea r9, [0x1401afda1]
nop dword [rax]
movzx edx, byte [rcx + r9 - 1]
movzx r8d, word [rsp + rcx*2 + 2]
add rcx, 2
xor dx, word [rsp + rcx*2 - 4]
mov word [rax + rcx*2 - 4], dx
movzx edx, byte [rcx + r9 - 2]
xor r8w, dx
mov word [rax + rcx*2 - 2], r8w
cmp rcx, 0xe
jl 0x140050ac0
mov byte [0x1401b5fa5], 1
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x38
ret
Function at 0x140050b10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, dword [0x1401b4d80]
mov eax, 0x6bca1af3
xor ebx, ebx
imul ecx, ecx
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 0xa
jne 0x140050b7b
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp byte [0x1401b5faf], bl
lea rax, [0x1401b0848]
jne 0x140050c24
mov dword [rbp - 0x40], 0xe000c
mov dword [rbp - 0x3c], 0x240010
mov dword [rbp - 0x38], 0xd000c
mov dword [rbp - 0x34], 0xb001e
mov dword [rbp - 0x30], 0x230016
mov dword [rbp - 0x2c], 0x5000c
mov dword [rbp - 0x28], 0x19000a
mov dword [rbp - 0x24], 0x25000e
mov dword [rbp - 0x20], 0x3a
mov dword [rbp - 0x1c], 0x60019
mov dword [rbp - 0x18], 0x46004a
mov word [rbp - 0x14], bx
lea r8, [0x1401afda1]
nop word [rax + rax]
movzx ecx, byte [rbx + r8 - 1]
movzx edx, word [rbp + rbx*2 - 0x3e]
add rbx, 2
xor cx, word [rbp + rbx*2 - 0x44]
mov word [rax + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor dx, cx
mov word [rax + rbx*2 - 2], dx
cmp rbx, 0x16
jl 0x140050bf0
mov byte [0x1401b5faf], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c7be0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x140050c50
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401b5fb4], 0
je 0x140050c89
lea rax, [0x1401b0318]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x70
pop rbp
ret
mov eax, dword [0x1401b4d80]
mov qword [rsp + 0x80], rbx
xor ebx, ebx
lea ecx, [rax + 1]
mov dword [rbp - 0x40], 0x1d0005
mov dword [rbp - 0x3c], 0x360014
mov dword [rbp - 0x38], 0x70016
mov dword [rbp - 0x34], 0x1f000e
mov dword [rbp - 0x30], 0xe0003
imul ecx, eax
mov eax, 0x2aaaaaab
mov dword [rbp - 0x2c], 0x1f000e
mov dword [rbp - 0x28], 0x11000b
mov dword [rbp - 0x24], 0x70034
mov dword [rbp - 0x20], 0x70001
mov dword [rbp - 0x1c], 0x60014
imul ecx
sar edx, 2
mov dword [rbp - 0x18], 0xe002f
mov dword [rbp - 0x14], 0x180007
mov eax, edx
mov dword [rbp - 0x10], 0x1f
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x17
jne 0x140050d65
mov rax, qword [str.CylRO3E253Cj]
or r8, 0xffffffffffffffff
mov qword [rbp - 0x50], rax
mov eax, dword [0x140143800]
mov rcx, r8
mov dword [rbp - 0x48], eax
movzx eax, byte [0x140143804]
mov byte [rbp - 0x44], al
lea rax, [rbp - 0x50]
inc rcx
cmp byte [rax + rcx], bl
jne 0x140050d41
mov eax, 4
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.1400c7228
mov rcx, rax
call fcn.1400c8c8c
lea rax, [0x1401b0318]
lea r8, [0x1401afda1]
nop word [rax + rax]
movzx ecx, byte [rbx + r8 - 1]
movzx edx, word [rbp + rbx*2 - 0x3e]
add rbx, 5
xor cx, word [rbp + rbx*2 - 0x4a]
mov word [rax + rbx*2 - 0xa], cx
movzx ecx, byte [rbx + r8 - 5]
xor dx, cx
movzx ecx, byte [rbx + r8 - 4]
xor cx, word [rbp + rbx*2 - 0x46]
mov word [rax + rbx*2 - 8], dx
mov word [rax + rbx*2 - 6], cx
movzx ecx, byte [rbx + r8 - 3]
xor cx, word [rbp + rbx*2 - 0x44]
mov word [rax + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor cx, word [rbp + rbx*2 - 0x42]
mov word [rax + rbx*2 - 2], cx
cmp rbx, 0x19
jl 0x140050d80
mov byte [0x1401b5fb4], 1
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x70
pop rbp
ret