joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400426e8
Capabilities:
Encode data using xor
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r10d, dword [0x1401a3d80]
mov eax, 0x2e8ba2e9
xor edi, edi
lea ecx, [r10 + 1]
imul ecx, r10d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0xe
jne 0x140042750
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov r10d, dword [0x1401a3d80]
cmp byte [0x1401a588a], dil
je 0x140042765
lea rax, [0x14019f520]
jmp 0x140042848
mov r9d, 0x10
mov dword [rbp - 0x40], 0x80000
mov dword [rbp - 0x3c], 0x1e0000
lea ebx, [r9 + 0x45]
mov dword [rbp - 0x38], 0x90052
mov dword [rbp - 0x34], 0x8000c
mov dword [rbp - 0x30], 0x550010
mov dword [rbp - 0x2c], 0x130013
mov dword [rbp - 0x28], 0x110006
lea edx, [rbx - 0x54]
mov dword [rbp - 0x24], 0xa0015
mov dword [rbp - 0x20], 0x2b0016
mov dword [rbp - 0x1c], 0x1000c
mov dword [rbp - 0x18], 0x1f0018
mov dword [rbp - 0x14], 7
mov rcx, rdi
lea r11, [0x14019f520]
lea rax, [0x14019ed90]
movzx eax, byte [rcx + rax]
xor ax, word [rbp + rcx*2 - 0x40]
mov word [r11 + rcx*2], ax
add rcx, rdx
cmp rcx, 0x17
jl 0x1400427d0
mov byte [0x1401a588a], dl
lea eax, [r10 + 1]
lea r8d, [r10 + 2]
imul r8d, eax
mov eax, 0x2aaaaaab
imul r8d, r10d
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
shl ecx, 3
sub r8d, ecx
cmp r8d, r9d
jne 0x140042845
test r9d, r9d
je 0x14004283b
mov eax, ebx
mov ecx, r9d
cdq
mov ebx, ecx
idiv r9d
mov r9d, edx
test ecx, ecx
jne 0x140042824
lea ecx, [r9 + rbx]
mov dword [0x1401a3d80], ecx
mov rax, r11
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400bb0d0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140042868
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 8], rax
xor edi, edi
cmp byte [0x1401a5889], dil
je 0x14004289f
lea rax, [0x14019fb68]
jmp 0x14004299f
mov r9d, dword [0x1401a3d80]
mov eax, 0x30c30c31
lea ecx, [r9 + 1]
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xf
jne 0x1400428d8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, eax
mov dword [0x1401a3d80], eax
mov dword [rbp - 0x30], 0x1f000d
mov dword [rbp - 0x2c], 0x35001e
mov dword [rbp - 0x28], 0x1f001b
mov dword [rbp - 0x24], 0x390006
mov dword [rbp - 0x20], 0x1c0000
mov dword [rbp - 0x1c], 0x3001d
mov r8d, 0x10
mov dword [rbp - 0x18], 0xc0010
mov dword [rbp - 0x14], 0x100005
mov word [rbp - 0x10], di
mov rdx, rdi
lea rbx, [0x14019fb68]
lea rax, [0x14019ed90]
movzx ecx, byte [rdx + rax]
xor cx, word [rbp + rdx*2 - 0x30]
mov word [rbx + rdx*2], cx
inc rdx
cmp rdx, r8
jl 0x140042924
lea r8d, [r9 + 2]
lea ecx, [r9 + 1]
mov eax, 0x30c30c31
imul r8d, ecx
imul r8d, r9d
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 8
jne 0x140042995
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov byte [0x1401a5889], 1
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bb0d0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400429c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 8], rax
mov r9d, dword [0x1401a3d80]
mov eax, 0x30c30c31
mov edi, 4
lea ecx, [r9 + 1]
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xf
jne 0x140042a35
mov ecx, edi
call fcn.1400bb888
mov rbx, rax
call fcn.1400bba88
mov rcx, rbx
mov dword [rbx], eax
mov dword [0x1401a3d80], eax
call fcn.1400bb0b4
mov r9d, dword [0x1401a3d80]
xor r8d, r8d
cmp byte [0x1401a58a3], r8b
je 0x140042a4d
lea rax, [0x14019f640]
jmp 0x140042b08
mov ecx, r9d
mov eax, 0x88888889
mov dword [rbp - 0x40], 0x19002c
mov dword [rbp - 0x3c], 0x4000b
mov dword [rbp - 0x38], 0x1d0022
mov dword [rbp - 0x34], 0x5000a
imul ecx, r9d
imul ecx
add edx, ecx
mov dword [rbp - 0x30], 0x60011
mov dword [rbp - 0x2c], 0x320003
sar edx, 3
mov dword [rbp - 0x28], 0x8001b
mov dword [rbp - 0x24], 0xa0015
mov eax, edx
mov dword [rbp - 0x20], 0x42
mov dword [rbp - 0x1c], 0xc0002
shr eax, 0x1f
mov r10d, 1
mov dword [rbp - 0x18], 0x160001
add edx, eax
mov dword [rbp - 0x14], 0x440006
mov word [rbp - 0x10], r8w
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 0xe
jne 0x140042ada
add r9d, r10d
mov dword [0x1401a3d80], r9d
lea rax, [0x14019f640]
lea rcx, [0x14019ed90]
movzx ecx, byte [r8 + rcx]
xor cx, word [rbp + r8*2 - 0x40]
mov word [rax + r8*2], cx
add r8, r10
cmp r8, 0x18
jl 0x140042ae1
mov byte [0x1401a58a3], r10b
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bb0d0
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret

Function at 0x140042b24
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
cmp byte [0x1401a5893], al
je 0x140042b4e
lea rax, [0x14019f8c0]
jmp 0x140042bcc
mov dword [rbp - 0x40], 0x1b0020
mov dword [rbp - 0x3c], 0xb000b
mov dword [rbp - 0x38], 0xa0006
mov dword [rbp - 0x34], 0x30037
mov dword [rbp - 0x30], 0x1a0019
mov dword [rbp - 0x2c], 0x30004
mov dword [rbp - 0x28], 0xb0020
mov dword [rbp - 0x24], 0x10002
mov r8d, 1
mov dword [rbp - 0x20], 0x20003
mov dword [rbp - 0x1c], 0x450059
mov word [rbp - 0x18], ax
lea rdx, [0x14019f8c0]
lea rcx, [0x14019ed90]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x40]
mov word [rdx + rax*2], cx
add rax, r8
cmp rax, 0x14
jl 0x140042ba5
mov byte [0x1401a5893], r8b
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400bb0d0
add rsp, 0x40
pop rbp
ret
Function at 0x140042be0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 8], rax
mov r8d, dword [0x1401a3d80]
mov eax, 0x2aaaaaab
mov ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0xa
jne 0x140042c70
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x63
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400ba748
mov rcx, rax
call fcn.1400bc20c
mov r8d, dword [0x1401a3d80]
xor r9d, r9d
cmp byte [0x1401a58c0], r9b
je 0x140042c88
lea rax, [0x14019f550]
jmp 0x140042dbb
lea eax, [r8 + 1]
mov ebx, 8
lea ecx, [r8 + 2]
lea r10d, [rbx - 7]
lea r11d, [rbx - 6]
imul ecx, eax
imul ecx, r8d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, ebx
jne 0x140042d32
jmp 0x140042d2d
mov eax, r8d
and eax, 0x80000001
jge 0x140042cd3
sub eax, r10d
or eax, 0xfffffffe
add eax, r10d
test eax, eax
jne 0x140042cea
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov dword [0x1401a3d80], eax
jmp 0x140042cf9
lea r8d, [r8*2 + 1]
mov dword [0x1401a3d80], r8d
mov eax, 0x55555556
mov ecx, r8d
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub ecx, eax
je 0x140042d1d
sub ecx, r11d
je 0x140042d20
dec ecx
je 0x140042d23
jmp 0x140042d2d
add r8d, r11d
add r8d, r10d
add r8d, r11d
mov dword [0x1401a3d80], r8d
test r8d, r8d
jne 0x140042cc0
mov dword [rbp - 0x40], 0x1d002d
mov dword [rbp - 0x3c], 0x6002f
mov dword [rbp - 0x38], 0x1e
mov dword [rbp - 0x34], 0x70006
mov dword [rbp - 0x30], 0x100000
mov dword [rbp - 0x2c], 0xf0026
mov dword [rbp - 0x28], 0x170006
mov dword [rbp - 0x24], 0x50005
mov dword [rbp - 0x20], 0x2b000e
mov dword [rbp - 0x1c], 0x80006
mov dword [rbp - 0x18], 0x10002
mov dword [rbp - 0x14], 0x5e001b
mov dword [rbp - 0x10], 0x4a
lea rax, [0x14019f550]
lea rcx, [0x14019ed90]
movzx ecx, byte [r9 + rcx]
xor cx, word [rbp + r9*2 - 0x40]
mov word [rax + r9*2], cx
add r9, r10
cmp r9, 0x19
jl 0x140042d94
mov byte [0x1401a58c0], r10b
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bb0d0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140043060
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ecx, ecx
cmp byte [0x1401a58ac], cl
je 0x140043096
lea rax, [0x14019f340]
jmp 0x1400431a3
mov edi, 1
mov dword [rbp - 0x50], 0x6002f
mov dword [rbp - 0x4c], 0x10001
mov dword [rbp - 0x48], 0x1f0007
mov dword [rbp - 0x44], 0x140035
mov dword [rbp - 0x40], 0x3001d
lea r10d, [rdi + 2]
lea r11d, [rdi + 3]
mov dword [rbp - 0x3c], 0xa0019
mov dword [rbp - 0x38], 0x40011
mov dword [rbp - 0x34], 0x320015
mov dword [rbp - 0x30], 0xa0003
mov dword [rbp - 0x2c], 0x16
mov dword [rbp - 0x28], 0x15004d
mov dword [rbp - 0x24], 0xd0003
mov dword [rbp - 0x20], 6
mov dword [rbp - 0x1c], 0x4b0000
mov word [rbp - 0x18], cx
lea rbx, [0x14019f340]
lea rax, [0x14019ed90]
movzx eax, byte [rcx + rax]
xor ax, word [rbp + rcx*2 - 0x50]
mov word [rbx + rcx*2], ax
add rcx, rdi
cmp rcx, 0x1c
jl 0x140043110
mov r8d, dword [0x1401a3d80]
mov eax, 0x2e8ba2e9
lea ecx, [r8 + 1]
imul ecx, r8d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub ecx, edx
cmp ecx, r10d
jne 0x140043199
mov eax, 0x51eb851f
imul r8d
mov rax, r11
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x141
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400ba748
mov rcx, rax
call fcn.1400bc20c
mov byte [0x1401a58ac], dil
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400bb0d0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x1400431c4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 8], rax
mov ecx, dword [0x1401a3d80]
mov eax, 0x2e8ba2e9
xor ebx, ebx
imul ecx, ecx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0x12
jne 0x140043251
mov eax, dword [str.wUnoX1]
or r8, 0xffffffffffffffff
mov dword [rbp - 0x30], eax
movzx eax, word [0x140136c9c]
mov rcx, r8
mov word [rbp - 0x2c], ax
mov al, byte [0x140136c9e]
mov byte [rbp - 0x2a], al
lea rax, [rbp - 0x30]
inc rcx
cmp byte [rax + rcx], bl
jne 0x14004322d
mov eax, 4
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.1400ba748
mov rcx, rax
call fcn.1400bc20c
cmp byte [0x1401a58ab], bl
lea rax, [0x14019fac0]
jne 0x1400432b2
mov dword [rbp - 0x28], 0x2d0045
mov dword [rbp - 0x24], 0x60002
mov dword [rbp - 0x20], 0xa0024
mov dword [rbp - 0x1c], 0x150017
mov dword [rbp - 0x18], 0x1a001d
mov dword [rbp - 0x14], 0x5b001e
mov word [rbp - 0x10], bx
lea rcx, [0x14019ed90]
movzx ecx, byte [rbx + rcx]
xor cx, word [rbp + rbx*2 - 0x28]
mov word [rax + rbx*2], cx
inc rbx
cmp rbx, 0xc
jl 0x14004328e
mov byte [0x1401a58ab], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bb0d0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x1400432cc
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 8], rax
xor eax, eax
cmp byte [0x1401a588b], al
je 0x1400432f6
lea rax, [0x14019f588]
jmp 0x14004336c
mov r8d, 1
mov dword [rbp - 0x30], 0x1f000d
mov dword [rbp - 0x2c], 0x35001e
mov dword [rbp - 0x28], 0x1b0001
mov dword [rbp - 0x24], 0x390001
mov dword [rbp - 0x20], 0xd0011
lea r9d, [r8 + 0x10]
mov dword [rbp - 0x1c], 0x30013
mov dword [rbp - 0x18], 0x170004
mov dword [rbp - 0x14], 0xb0019
mov dword [rbp - 0x10], 0xc
lea rdx, [0x14019f588]
lea rcx, [0x14019ed90]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x30]
mov word [rdx + rax*2], cx
add rax, r8
cmp rax, r9
jl 0x140043346
mov byte [0x1401a588b], r8b
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bb0d0
add rsp, 0x30
pop rbp
ret

Function at 0x140043380
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 8], rax
mov eax, dword [0x1401a3d80]
xor r8d, r8d
lea ecx, [rax + 1]
lea r11d, [r8 + 5]
imul ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, r11d
jne 0x1400433ee
mov eax, 0xf1
lea r9d, [r8 + 0x7e]
test r9d, r9d
je 0x1400433e5
cdq
mov ecx, r9d
idiv r9d
mov eax, ecx
mov r9d, edx
test ecx, ecx
jne 0x1400433d0
add eax, r9d
mov dword [0x1401a3d80], eax
cmp byte [0x1401a589d], r8b
lea rax, [0x14019f428]
jne 0x140043488
mov dword [rbp - 0x40], 0x1f000d
mov dword [rbp - 0x3c], 0x35001e
mov dword [rbp - 0x38], 0x10007
mov r10d, 1
mov dword [rbp - 0x34], 0x1e0000
mov dword [rbp - 0x30], 0x100004
mov dword [rbp - 0x2c], 0x120013
mov dword [rbp - 0x28], 0x70011
mov dword [rbp - 0x24], 0x1002f
mov dword [rbp - 0x20], 0x5001a
mov dword [rbp - 0x1c], 0x150006
mov dword [rbp - 0x18], 0x1a0019
mov dword [rbp - 0x14], 0xa000d
mov word [rbp - 0x10], r8w
lea rcx, [0x14019ed90]
movzx ecx, byte [r8 + rcx]
xor cx, word [rbp + r8*2 - 0x40]
mov word [rax + r8*2], cx
add r8, r10
cmp r8, 0x18
jl 0x140043461
mov byte [0x1401a589d], r10b
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bb0d0
add rsp, 0x40
pop rbp
ret
Function at 0x14004349c
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rsp + 0x10], rax
mov r8d, dword [0x1401a3d80]
mov eax, 0x88888889
xor r9d, r9d
lea ecx, [r8 + 1]
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 0xd
jne 0x140043552
jmp 0x14004354d
mov eax, r8d
and eax, 0x80000001
jge 0x1400434f1
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x140043508
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov dword [0x1401a3d80], eax
jmp 0x140043517
lea r8d, [r8*2 + 1]
mov dword [0x1401a3d80], r8d
mov eax, 0x55555556
mov ecx, r8d
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub ecx, eax
je 0x14004353b
sub ecx, 2
je 0x14004353f
dec ecx
je 0x140043542
jmp 0x14004354d
add r8d, 2
inc r8d
add r8d, 2
mov dword [0x1401a3d80], r8d
test r8d, r8d
jne 0x1400434e0
cmp byte [0x1401a58bf], r9b
lea rax, [0x14019f8f0]
jne 0x14004359f
mov dword [rsp], 0x190045
mov dword [rsp + 4], 0x58001e
mov dword [rsp + 8], 0x4f
lea rcx, [0x14019ed90]
movzx ecx, byte [r9 + rcx]
xor cx, word [rsp + r9*2]
mov word [rax + r9*2], cx
inc r9
cmp r9, 5
jl 0x140043579
mov byte [0x1401a58bf], 1
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.1400bb0d0
add rsp, 0x28
ret
Function at 0x1400435b4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x118]
sub rsp, 0x200
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp + 0xf0], rax
xor edi, edi
cmp byte [0x1401a588e], dil
je 0x140043602
lea rax, [0x14019fa50]
jmp 0x14004373f
mov r12d, 0x18
mov dword [rbp + 0xa0], 0x1b0006
mov dword [rbp + 0xa4], 0x5001c
mov dword [rbp + 0xa8], 0x300000
mov dword [rbp + 0xac], 0x90006
mov dword [rbp + 0xb0], 0x180019
lea r15d, [r12 - 0x14]
mov dword [rbp + 0xb4], 0x80005
mov dword [rbp + 0xb8], 0x1d
mov dword [rbp + 0xbc], 0x100011
mov dword [rbp + 0xc0], 0x8000b
mov dword [rbp + 0xc4], 0x3a0004
mov dword [rbp + 0xc8], 0x1f0009
mov dword [rbp + 0xcc], 0x3b000e
mov dword [rbp + 0xd0], r12d
mov dword [rbp + 0xd4], 0x20003
mov dword [rbp + 0xd8], 0x1a0003
mov dword [rbp + 0xdc], 0x100013
mov word [rbp + 0xe0], di
call fcn.140040ee8
test al, al
jne 0x140043711
mov esi, edi
lea r14, [rsp + 0x20]
mov r10d, edi
mov r8d, dword [0x1401a3d80]
lea ecx, [rsi + 1]
lea ebx, [r10 + 1]
mov eax, r8d
cdq
idiv ecx
mov eax, r8d
mov ecx, r8d
sub ecx, esi
mov r9d, edx
cdq
idiv ebx
imul r9d, ecx
lea rcx, [0x140131288]
add r9d, eax
sub r9d, r10d
mov edx, r9d
call fcn.1400bb9dc
add r14, r15
mov r10d, ebx
cmp ebx, r15d
jl 0x1400436c4
inc esi
cmp esi, r12d
jl 0x1400436c1
lea rax, [0x14019fa50]
lea rcx, [0x14019ed90]
movzx ecx, byte [rdi + rcx]
xor cx, word [rbp + rdi*2 + 0xa0]
mov word [rax + rdi*2], cx
inc rdi
cmp rdi, 0x20
jl 0x140043718
mov byte [0x1401a588e], 1
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.1400bb0d0
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140043770
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r8d, dword [0x1401a3d80]
mov eax, 0x30c30c31
lea r9d, [r8 + 1]
mov ecx, r9d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [0x1401a5504]
imul edx, edx, 0x15
sub ecx, edx
mov edx, 0x19e5618a
cmp ecx, 0xf
cmove eax, edx
xor ebx, ebx
cmp byte [0x1401a58b3], bl
mov dword [0x1401a5504], eax
je 0x1400437e0
lea rax, str._e_v_v
jmp 0x140043903
lea ecx, [r8 + 2]
mov eax, 0x92492493
imul ecx, r9d
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 5
jne 0x140043837
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r8d, dword [0x1401a3d80]
mov ecx, r8d
mov eax, 0x38e38e39
mov dword [rbp - 0x30], 0x1b0020
mov dword [rbp - 0x2c], 0xb000b
mov dword [rbp - 0x28], 0xa0006
mov dword [rbp - 0x24], 0xe0031
imul ecx, r8d
imul ecx
sar edx, 2
mov dword [rbp - 0x20], 0x100006
mov dword [rbp - 0x1c], 0x20011
mov eax, edx
mov dword [rbp - 0x18], 0x1b0031
mov dword [rbp - 0x14], 0x4a
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 8
jne 0x1400438d8
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x141
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400ba748
mov rcx, rax
call fcn.1400bc20c
lea rax, str._e_v_v
lea rcx, [0x14019ed90]
movzx ecx, byte [rbx + rcx]
xor cx, word [rbp + rbx*2 - 0x30]
mov word [rax + rbx*2], cx
inc rbx
cmp rbx, 0xf
jl 0x1400438df
mov byte [0x1401a58b3], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400bb0d0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x140043920
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x258]
sub rsp, 0x330
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp + 0x220], rax
xor edi, edi
cmp byte [0x1401a5891], dil
je 0x14004396e
lea rax, [0x14019f998]
jmp 0x140043a8b
mov r9d, dword [0x1401a3d80]
mov r13d, 4
mov eax, 0x2aaaaaab
mov ecx, r9d
lea r8d, [r13 + 0xa]
mov dword [rbp + 0x200], 0x4000a
lea r12d, [r13 + 0xb]
mov dword [rbp + 0x204], 0xd000f
mov dword [rbp + 0x208], 0x4f0017
imul ecx, r9d
imul ecx
sar edx, 2
mov dword [rbp + 0x20c], 0x140015
mov dword [rbp + 0x210], 0x16001b
mov eax, edx
mov dword [rbp + 0x214], 0x80050
lea r15d, [r13 + 4]
shr eax, 0x1f
mov dword [rbp + 0x218], 0xe0015
mov dword [rbp + 0x21c], 0x15
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, r8d
jne 0x140043a5e
mov esi, edi
lea r14, [rsp + 0x20]
mov r10d, edi
lea ecx, [rsi + 1]
mov eax, r9d
lea ebx, [r10 + 1]
cdq
idiv ecx
mov eax, r9d
mov ecx, r9d
sub ecx, esi
mov r8d, edx
cdq
idiv ebx
imul r8d, ecx
lea rcx, [0x140131288]
add r8d, eax
sub r8d, r10d
mov edx, r8d
call fcn.1400bb9dc
add r14, r13
mov r10d, ebx
cmp ebx, 0x17
jge 0x140043a4e
mov r9d, dword [0x1401a3d80]
jmp 0x140043a06
inc esi
cmp esi, r15d
jge 0x140043a5e
mov r9d, dword [0x1401a3d80]
jmp 0x140043a03
lea rax, [0x14019f998]
lea rcx, [0x14019ed90]
movzx ecx, byte [rdi + rcx]
xor cx, word [rbp + rdi*2 + 0x200]
mov word [rax + rdi*2], cx
inc rdi
cmp rdi, r12
jl 0x140043a65
mov byte [0x1401a5891], 1
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.1400bb0d0
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140043abc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x6fc8]
mov eax, 0x70c0
call fcn.1400c0180
sub rsp, rax
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp + 0x6fb0], rax
mov r8d, dword [0x1401a3d80]
xor ebx, ebx
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
lea r14d, [rbx + 1]
imul ecx, eax
mov eax, 0x66666667
imul ecx, r8d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 9
jne 0x140043b6b
lea ecx, [rbx + 0x28]
call fcn.1400ba748
mov edi, ebx
mov rsi, rax
call fcn.1400bba88
add eax, dword [0x1401a3d80]
mov dword [rsi + rdi*4], eax
add rdi, r14
cmp rdi, 0xa
jl 0x140043b3c
mov ecx, dword [rsi + 0x24]
mov dword [0x1401a3d80], ecx
mov rcx, rsi
call fcn.1400bc20c
mov r8d, dword [0x1401a3d80]
cmp byte [0x1401a58b1], bl
je 0x140043b7f
lea rax, [0x14019fb08]
jmp 0x140043c63
lea ecx, [r8 + 1]
mov eax, 0x2e8ba2e9
mov dword [rsp + 0x20], 0x7004e
mov edi, 7
mov dword [rsp + 0x24], 0x1c0001
mov dword [rsp + 0x28], 0x590013
imul ecx, r8d
imul ecx
sar edx, 1
mov dword [rsp + 0x2c], 0x51
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub ecx, edx
cmp ecx, 3
jne 0x140043c39
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x707e
mov word [rsp + 0x30], bx
call fcn.1400c0510
mov r10, rbx
or r9, 0xffffffffffffffff
mov r8, rbx
test r10, r10
je 0x140043c13
test r8, r8
je 0x140043c13
lea rax, [r9 + r8]
lea rcx, [r9 + r8]
movzx edx, word [rbp + rcx*2 - 0x1be]
add dx, word [rsp + rax*2 + 0x30]
lea rax, [r9 + r8]
add dx, r14w
mov word [rsp + rax*2 + 0x32], dx
add r8, r14
cmp r8, 0x78
jl 0x140043be7
add r9, 0x78
add r10, r14
cmp r9, 0x383f
jl 0x140043be4
movsx eax, word [rbp + 0x6fae]
mov dword [0x1401a3d80], eax
lea rax, [0x14019fb08]
lea rcx, [0x14019ed90]
movzx ecx, byte [rbx + rcx]
xor cx, word [rsp + rbx*2 + 0x20]
mov word [rax + rbx*2], cx
add rbx, r14
cmp rbx, rdi
jl 0x140043c40
mov byte [0x1401a58b1], r14b
mov rcx, qword [rbp + 0x6fb0]
xor rcx, rsp
call fcn.1400bb0d0
lea r11, [rsp + 0x70c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret