joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400413ec
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 8], rax
mov r9d, dword [0x1401a3d80]
mov eax, 0x2e8ba2e9
mov ebx, 4
lea ecx, [r9 + 1]
imul ecx, r9d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub ecx, edx
cmp ecx, 3
jne 0x140041454
mov ecx, ebx
call fcn.1400bb888
mov r9d, dword [0x1401a3d80]
mov dword [rax], r9d
mov ecx, r9d
mov esi, 0x2aaaaaab
mov edi, 0xa
mov eax, esi
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, edi
jne 0x14004149b
mov edx, 0xeb
lea rcx, str._d__d_n
lea r8d, [rdx + 1]
call fcn.1400bb9dc
mov r9d, dword [0x1401a3d80]
xor r8d, r8d
cmp byte [0x1401a58b0], r8b
je 0x1400414b3
lea rax, [0x14019f690]
jmp 0x1400415b3
mov ecx, r9d
mov eax, esi
mov dword [rbp - 0x40], 0x1f000d
mov dword [rbp - 0x3c], 0x35001e
mov dword [rbp - 0x38], 0x10007
mov r14d, 1
imul ecx, r9d
imul ecx
sar edx, 2
mov dword [rbp - 0x34], 0x1e0000
mov dword [rbp - 0x30], 0x100004
mov eax, edx
mov dword [rbp - 0x2c], 0x120013
mov dword [rbp - 0x28], 0x70011
shr eax, 0x1f
mov dword [rbp - 0x24], 0x16002f
mov dword [rbp - 0x20], 0xb0007
add edx, eax
mov dword [rbp - 0x1c], 0x11000c
mov dword [rbp - 0x18], 0x2c0008
lea eax, [rdx + rdx*2]
mov dword [rbp - 0x14], 0x5000a
mov dword [rbp - 0x10], 0x110006
shl eax, 3
mov word [rbp - 0xc], r8w
sub ecx, eax
cmp ecx, edi
jne 0x140041585
mov eax, r9d
lea r11d, [r14 + 0x39]
mov ecx, r8d
cdq
sub eax, edx
sar eax, 1
mov esi, eax
test esi, esi
jle 0x14004157d
mov eax, r9d
mov r10d, r8d
mov rdi, rsi
cdq
and edx, 3
add eax, edx
sar eax, 2
test eax, eax
jle 0x140041575
mov edx, r10d
mov ebx, eax
add r11d, edx
sub edx, r14d
sub rbx, r14
jne 0x14004156a
add r10d, ecx
sub rdi, r14
jne 0x140041561
add ecx, r14d
cmp ecx, r11d
jl 0x14004154b
lea rax, [0x14019f690]
lea rcx, [0x14019ed90]
movzx ecx, byte [r8 + rcx]
xor cx, word [rbp + r8*2 - 0x40]
mov word [rax + r8*2], cx
add r8, r14
cmp r8, 0x1a
jl 0x14004158c
mov byte [0x1401a58b0], r14b
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bb0d0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400415dc
Capabilities:
Encode data using xor
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 8], rax
mov r8d, dword [0x1401a3d80]
mov eax, 0x2e8ba2e9
xor ebx, ebx
mov ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0xa
jne 0x140041643
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov r8d, dword [0x1401a3d80]
cmp byte [0x1401a58ae], bl
je 0x140041657
lea rax, [0x14019f790]
jmp 0x14004179b
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
mov r11d, 1
imul ecx, eax
mov eax, 0x78787879
imul ecx, r8d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 3
jne 0x1400416c3
mov r9d, ebx
mov edx, r9d
mov r10d, 8
mov ecx, edx
mov eax, edx
and ecx, r11d
sar eax, 1
sub ecx, r11d
not ecx
and ecx, r8d
mov edx, ecx
xor edx, eax
sub r10, r11
jne 0x140041693
add r9d, r11d
add r8d, edx
cmp r9d, 0x100
jl 0x14004168a
mov dword [0x1401a3d80], r8d
mov dword [rbp - 0x30], 0x10000
mov dword [rbp - 0x2c], 0x12002b
mov dword [rbp - 0x28], 0x1b001b
mov dword [rbp - 0x24], 0x90026
mov edx, 0x10
mov dword [rbp - 0x20], 0x100010
mov dword [rbp - 0x1c], 0x50056
mov dword [rbp - 0x18], 0x7001b
mov dword [rbp - 0x14], 0x590015
mov word [rbp - 0x10], bx
lea rdi, [0x14019f790]
lea rax, [0x14019ed90]
movzx eax, byte [rbx + rax]
xor ax, word [rbp + rbx*2 - 0x30]
mov word [rdi + rbx*2], ax
add rbx, r11
cmp rbx, rdx
jl 0x14004170b
lea ecx, [r8 + 1]
mov eax, 0x92492493
mov byte [0x1401a58ae], r11b
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
sub ecx, edx
cmp ecx, 4
jne 0x140041798
mov eax, 0x51eb851f
imul r8d
mov eax, 4
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x2f4
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400ba748
mov rcx, rax
call fcn.1400bc20c
mov rax, rdi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bb0d0
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x1400417b8
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor ebx, ebx
cmp byte [0x1401a58b2], bl
je 0x1400417e3
lea rax, [0x14019f6e0]
jmp 0x140041893
mov r8d, dword [0x1401a3d80]
mov eax, 0x38e38e39
mov ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 3
jne 0x140041853
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x141
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400ba748
mov rcx, rax
call fcn.1400bc20c
mov dword [rsp + 0x20], 0x1f004e
mov dword [rsp + 0x24], 0x18000b
mov word [rsp + 0x28], bx
lea rax, [0x14019f6e0]
lea rcx, [0x14019ed90]
movzx ecx, byte [rbx + rcx]
xor cx, word [rsp + rbx*2 + 0x20]
mov word [rax + rbx*2], cx
inc rbx
cmp rbx, 4
jl 0x14004186f
mov byte [0x1401a58b2], 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400bb0d0
add rsp, 0x40
pop rbx
ret

Function at 0x1400418a8
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor ebx, ebx
cmp byte [0x1401a58be], bl
je 0x1400418d0
lea rax, [0x14019f930]
jmp 0x14004194c
call fcn.140040ee8
test al, al
jne 0x140041900
mov eax, 0xd7
lea r8d, [rax + 4]
test r8d, r8d
je 0x1400418f7
cdq
mov ecx, r8d
idiv r8d
mov eax, ecx
mov r8d, edx
test ecx, ecx
jne 0x1400418e2
add eax, r8d
mov dword [0x1401a3d80], eax
mov dword [rsp + 0x20], 0x3f0058
mov edx, 1
mov dword [rsp + 0x24], 0x2e0001
mov dword [rsp + 0x28], 0x300030
mov word [rsp + 0x2c], bx
lea rax, [0x14019f930]
lea rcx, [0x14019ed90]
movzx ecx, byte [rbx + rcx]
xor cx, word [rsp + rbx*2 + 0x20]
mov word [rax + rbx*2], cx
add rbx, rdx
cmp rbx, 6
jl 0x140041929
mov byte [0x1401a58be], dl
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400bb0d0
add rsp, 0x40
pop rbx
ret
Function at 0x140041960
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x3b0
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rsp + 0x3a8], rax
mov r9d, dword [0x1401a3d80]
xor edi, edi
lea eax, [r9 + 1]
lea ecx, [r9 + 2]
lea ebp, [rdi + 1]
imul ecx, eax
mov eax, 0x2aaaaaab
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x17
jne 0x140041a21
mov ebx, edi
lea esi, [rdi + 0x51]
call fcn.1400bba88
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rsp + rbx*8 + 0x20], xmm0
add rbx, rbp
cmp rbx, rsi
jb 0x1400419c7
mov rcx, rdi
mov eax, 0x50
jmp 0x140041a0d
movsd xmm1, qword [rsp + rax*8 + 0x20]
movsd xmm0, qword [rsp + rax*8 + 0x18]
comisd xmm1, xmm0
jbe 0x140041a0a
movsd qword [rsp + rax*8 + 0x20], xmm0
movsd qword [rsp + rax*8 + 0x18], xmm1
sub rax, rbp
cmp rax, rcx
jg 0x1400419ec
add rcx, rbp
sub rsi, rbp
jne 0x1400419e5
mov r9d, dword [0x1401a3d80]
cmp byte [0x1401a58a0], dil
je 0x140041a36
lea rax, [0x14019f9d0]
jmp 0x140041b48
lea r8d, [r9 + 1]
mov esi, 0x30c30c31
mov dword [rsp + 0x3a0], 0x1d004e
mov ecx, r8d
mov eax, esi
mov dword [rsp + 0x3a4], ebp
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x2aaaaaab
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xf
cmove r9d, r8d
mov dword [0x1401a3d80], r9d
lea ecx, [r9 + 1]
imul ecx, r9d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 4
jne 0x140041ac7
mov ecx, 4
call fcn.1400bb888
mov rbx, rax
call fcn.1400bba88
mov rcx, rbx
mov dword [rbx], eax
mov dword [0x1401a3d80], eax
call fcn.1400bb0b4
mov r9d, dword [0x1401a3d80]
mov rdx, rdi
lea r8, [0x14019f9d0]
lea rcx, [0x14019ed90]
movzx ecx, byte [rdx + rcx]
xor cx, word [rsp + rdx*2 + 0x3a0]
mov word [r8 + rdx*2], cx
add rdx, rbp
cmp rdx, 3
jl 0x140041ad1
mov ecx, r9d
mov eax, esi
imul ecx, r9d
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 5
jne 0x140041b3e
lea rax, [rsp + 0x20]
mov ecx, dword [rax]
add edi, ebp
lea rax, [rax + 4]
imul ecx, ecx, 0xc5
add r9d, ecx
movsxd rcx, edi
cmp rcx, 0x37c
jb 0x140041b1a
mov dword [0x1401a3d80], r9d
mov byte [0x1401a58a0], bpl
mov rax, r8
mov rcx, qword [rsp + 0x3a8]
xor rcx, rsp
call fcn.1400bb0d0
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140041b74
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov eax, dword [0x1401a3d80]
mov edi, 5
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, edi
jne 0x140041bcc
call fcn.1400bba88
mov dword [0x1401a3d80], eax
xor eax, eax
cmp byte [0x1401a58bd], al
je 0x140041be2
lea rax, [0x14019f738]
jmp 0x140041c7d
mov dword [rbp - 0x50], 0xd0022
mov dword [rbp - 0x4c], 0x1f0004
mov ebx, 1
mov dword [rbp - 0x48], 0x1b0001
mov dword [rbp - 0x44], 0x90031
mov dword [rbp - 0x40], 0x10001f
mov dword [rbp - 0x3c], 0x36001e
mov dword [rbp - 0x38], 0xa0006
mov dword [rbp - 0x34], 0xd0006
mov dword [rbp - 0x30], 0x3000e
mov dword [rbp - 0x2c], 4
mov dword [rbp - 0x28], 0x53001e
mov dword [rbp - 0x24], 0x50004
mov dword [rbp - 0x20], 0x90003
mov dword [rbp - 0x1c], 0xf0001
mov dword [rbp - 0x18], 0x50
lea rdx, [0x14019f738]
lea rcx, [0x14019ed90]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x50]
mov word [rdx + rax*2], cx
add rax, rbx
cmp rax, 0x1d
jl 0x140041c57
mov byte [0x1401a58bd], bl
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400bb0d0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x140041c9c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
cmp byte [0x1401a58a5], bl
je 0x140041cd7
lea rax, [0x14019f838]
jmp 0x140041da5
mov eax, dword [0x1401a3d80]
mov edi, 7
mov dword [rbp - 0x40], 0x50002
mov ecx, eax
mov dword [rbp - 0x3c], 0x4a0002
mov dword [rbp - 0x38], 0x230036
mov dword [rbp - 0x34], 0x150029
mov dword [rbp - 0x30], 0x110054
mov dword [rbp - 0x2c], 0x3001f
imul ecx, eax
imul ecx, eax
mov eax, 0x66666667
mov dword [rbp - 0x28], 0xd0007
mov dword [rbp - 0x24], 0x440004
mov dword [rbp - 0x20], 0x1e0007
mov dword [rbp - 0x1c], 0x16000a
lea esi, [rdi + 0xf]
imul ecx
sar edx, 3
mov dword [rbp - 0x18], 0x5d0019
mov word [rbp - 0x14], bx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0x12
jne 0x140041d7b
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401a3d80]
test rax, rax
cmove ecx, edi
mov dword [0x1401a3d80], ecx
lea rax, [0x14019f838]
lea rcx, [0x14019ed90]
movzx ecx, byte [rbx + rcx]
xor cx, word [rbp + rbx*2 - 0x40]
mov word [rax + rbx*2], cx
inc rbx
cmp rbx, rsi
jl 0x140041d82
mov byte [0x1401a58a5], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400bb0d0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140041dc8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor ebx, ebx
cmp byte [0x1401a5894], bl
je 0x140041e06
lea rax, [0x14019f6c8]
jmp 0x140041ecf
mov r14d, 0xa
mov dword [rsp + 0x20], 0x1d000d
mov dword [rsp + 0x24], 0x6000a
mov dword [rsp + 0x28], 0x41001e
mov dword [rsp + 0x2c], 0xa0001
mov dword [rsp + 0x30], 0x18
lea ebp, [r14 - 9]
mov rcx, rbx
lea rdi, [0x14019f6c8]
lea rax, [0x14019ed90]
movzx eax, byte [rcx + rax]
xor ax, word [rsp + rcx*2 + 0x20]
mov word [rdi + rcx*2], ax
add rcx, rbp
cmp rcx, 9
jl 0x140041e42
mov ecx, dword [0x1401a3d80]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x30c30c31
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 8
jne 0x140041ec5
lea ecx, [r8 + 0x20]
call fcn.1400ba748
mov rsi, rax
call fcn.1400bba88
add eax, dword [0x1401a3d80]
mov dword [rsi + rbx*4], eax
add rbx, rbp
cmp rbx, r14
jl 0x140041e9e
mov ecx, dword [rsi + 0x24]
mov dword [0x1401a3d80], ecx
mov rcx, rsi
call fcn.1400bc20c
mov byte [0x1401a5894], bpl
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400bb0d0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140041ef8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
sub rsp, 0x20
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rsp + 0x10], rax
xor ebp, ebp
cmp byte [0x1401a5896], bpl
je 0x140041f2d
lea rax, [0x14019f678]
jmp 0x140041fe7
mov dword [rsp], 0xd004d
mov dword [rsp + 4], 0x60002
mov word [rsp + 8], bp
mov rcx, rbp
lea r8, [0x14019f678]
lea rax, [0x14019ed90]
movzx eax, byte [rcx + rax]
xor ax, word [rsp + rcx*2]
mov word [r8 + rcx*2], ax
inc rcx
cmp rcx, 4
jl 0x140041f4b
mov ecx, dword [0x1401a3d80]
mov eax, 0x30c30c31
mov byte [0x1401a5896], 1
imul ecx, ecx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 3
jne 0x140041fe4
mov eax, dword [0x1401a3d80]
mov r10d, 0xdd
mov ecx, ebp
cdq
sub eax, edx
sar eax, 1
mov esi, eax
test esi, esi
jle 0x140041fdd
mov eax, dword [0x1401a3d80]
mov r9d, ebp
mov rbx, rsi
cdq
and edx, 3
add eax, edx
sar eax, 2
test eax, eax
jle 0x140041fd5
mov edx, r9d
mov r11d, eax
add r10d, edx
dec edx
dec r11
jne 0x140041fcb
add r9d, ecx
dec rbx
jne 0x140041fc1
inc ecx
cmp ecx, r10d
jl 0x140041fa8
mov rax, r8
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.1400bb0d0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
Function at 0x140042004
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
cmp byte [0x1401a5892], bl
je 0x140042035
lea rax, [0x14019f380]
jmp 0x1400420ff
mov eax, dword [0x1401a3d80]
mov r8d, 0xa
mov dword [rbp - 0x50], 0xc0024
lea ecx, [rax + 1]
mov qword [rbp - 0x4c], 0x3a001a
mov dword [rbp - 0x44], 0x270006
mov dword [rbp - 0x40], 0x110010
mov dword [rbp - 0x3c], 0x30002
mov dword [rbp - 0x38], 0x100007
imul ecx, eax
mov eax, 0x78787879
mov dword [rbp - 0x34], 0xb0050
mov dword [rbp - 0x30], 0x460004
mov dword [rbp - 0x2c], 0xa002f
mov dword [rbp - 0x28], 0x17000c
mov dword [rbp - 0x24], 0xd002e
imul ecx
sar edx, 3
mov dword [rbp - 0x20], 0x170008
mov dword [rbp - 0x1c], 0x190005
mov eax, edx
mov dword [rbp - 0x18], 0x540009
mov dword [rbp - 0x14], 0x41
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, r8d
jne 0x1400420d4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
lea rax, [0x14019f380]
lea rcx, [0x14019ed90]
movzx ecx, byte [rbx + rcx]
xor cx, word [rbp + rbx*2 - 0x50]
mov word [rax + rbx*2], cx
inc rbx
cmp rbx, 0x1f
jl 0x1400420db
mov byte [0x1401a5892], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400bb0d0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x14004211c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x3b8]
sub rsp, 0x4a0
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp + 0x398], rax
xor edi, edi
cmp byte [0x1401a58a7], dil
je 0x14004216a
lea rax, [0x14019fbb8]
jmp 0x140042324
mov r9d, dword [0x1401a3d80]
mov eax, 0x2aaaaaab
mov r12d, 1
lea ecx, [r9 + 1]
mov dword [rbp + 0x380], 0x7004e
mov dword [rbp + 0x384], 0x1c0001
mov dword [rbp + 0x388], 0x590013
mov dword [rbp + 0x38c], 0x480051
lea ebx, [r12 + 0xf]
imul ecx, r9d
imul ecx
mov eax, edx
mov dword [rbp + 0x390], 0x190010
mov dword [rbp + 0x394], 0x1c
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
cmp ecx, 4
jne 0x140042222
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rbx - 0xc]
imul edx, edx, 0x64
sub r9d, edx
add r9d, 0x2f4
movsxd rcx, r9d
mul rcx
lea rcx, [r12 - 2]
cmovo rax, rcx
mov rcx, rax
call fcn.1400ba748
mov rcx, rax
call fcn.1400bc20c
mov r9d, dword [0x1401a3d80]
mov rcx, rdi
lea rsi, [0x14019fbb8]
lea rax, [0x14019ed90]
movzx eax, byte [rcx + rax]
xor ax, word [rbp + rcx*2 + 0x380]
mov word [rsi + rcx*2], ax
add rcx, r12
cmp rcx, 0xb
jl 0x14004222c
lea eax, [r9 + 1]
lea ecx, [r9 + 2]
imul ecx, eax
mov eax, 0x2aaaaaab
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, ebx
jne 0x1400422d5
mov r14d, edi
lea r15, [rsp + 0x20]
mov r10d, edi
lea ecx, [r14 + 1]
mov eax, r9d
lea ebx, [r10 + 1]
cdq
idiv ecx
mov eax, r9d
mov ecx, r9d
sub ecx, r14d
mov r8d, edx
cdq
idiv ebx
imul r8d, ecx
lea rcx, [0x140131288]
add r8d, eax
sub r8d, r10d
mov edx, r8d
call fcn.1400bb9dc
mov r9d, dword [0x1401a3d80]
add r15, 4
mov r10d, ebx
cmp ebx, 0x1f
jl 0x140042283
add r14d, r12d
cmp r14d, 9
jl 0x140042280
mov ecx, r9d
mov eax, 0x2aaaaaab
mov byte [0x1401a58a7], r12b
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0xe
jne 0x140042321
test r9d, r9d
je 0x14004231b
mov eax, r9d
mov ecx, r9d
cdq
and ecx, r12d
sub eax, edx
add edi, ecx
sar eax, 1
mov r9d, eax
jne 0x140042306
mov dword [0x1401a3d80], edi
mov rax, rsi
mov rcx, qword [rbp + 0x398]
xor rcx, rsp
call fcn.1400bb0d0
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140042354
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov eax, dword [0x1401a3d80]
mov edi, 1
imul eax, eax
and eax, 0x80000007
jge 0x140042395
sub eax, edi
or eax, 0xfffffff8
add eax, edi
xor ebx, ebx
cmp eax, 6
jne 0x1400423b1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
cmp byte [0x1401a58b9], bl
lea rax, [0x14019f7c0]
jne 0x14004245c
mov dword [rbp - 9], 0x50002
mov dword [rbp - 5], 0x50002
mov dword [rbp - 1], 0x4f0011
mov dword [rbp + 3], 0x70003
mov dword [rbp + 7], 0x19001d
mov dword [rbp + 0xb], 0x20015
mov dword [rbp + 0xf], 0x130054
mov dword [rbp + 0x13], 0xb0002
mov dword [rbp + 0x17], 0x460001
mov dword [rbp + 0x1b], 0x16000a
mov dword [rbp + 0x1f], 0x7004d
mov dword [rbp + 0x23], 0x160007
mov dword [rbp + 0x27], 0xc0007
mov dword [rbp + 0x2b], 0xa000a
mov dword [rbp + 0x2f], 0x70004
mov dword [rbp + 0x33], 0xe000f
mov word [rbp + 0x37], bx
lea rcx, [0x14019ed90]
movzx ecx, byte [rbx + rcx]
xor cx, word [rbp + rbx*2 - 9]
mov word [rax + rbx*2], cx
add rbx, rdi
cmp rbx, 0x20
jl 0x140042438
mov byte [0x1401a58b9], dil
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400bb0d0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140042480
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 8], rax
mov r8d, dword [0x1401a3d80]
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x30c30c31
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 8
jne 0x140042515
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x63
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400ba748
mov rcx, rax
call fcn.1400bc20c
mov r8d, dword [0x1401a3d80]
mov ecx, r8d
mov eax, 0xb21642c9
mov ebx, 5
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, ebx
jne 0x14004254b
call fcn.1400bba88
mov r8d, eax
mov dword [0x1401a3d80], eax
xor r9d, r9d
cmp byte [0x1401a58ad], r9b
je 0x140042563
lea rax, [0x14019f898]
jmp 0x140042627
mov dword [rbp - 0x30], 0x10000
mov r11d, 1
mov dword [rbp - 0x2c], 0x1c0031
mov dword [rbp - 0x28], 0x1d0017
mov dword [rbp - 0x24], 0xf0016
mov dword [rbp - 0x20], 0x1b001b
mov dword [rbp - 0x1c], 0x5002f
mov dword [rbp - 0x18], 0x2001c
mov dword [rbp - 0x14], 0x3001e
mov dword [rbp - 0x10], 0x390007
mov word [rbp - 0xc], r9w
mov rcx, r9
lea r10, [0x14019f898]
lea rax, [0x14019ed90]
movzx eax, byte [rcx + rax]
xor ax, word [rbp + rcx*2 - 0x30]
mov word [r10 + rcx*2], ax
add rcx, r11
cmp rcx, 0x12
jl 0x1400425b7
lea ecx, [r8 + 1]
mov eax, 0x2aaaaaab
mov byte [0x1401a58ad], r11b
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x11
jne 0x140042624
test r8d, r8d
je 0x14004261d
mov eax, r8d
mov ecx, r8d
cdq
and ecx, r11d
sub eax, edx
add r9d, ecx
sar eax, 1
mov r8d, eax
jne 0x140042607
mov dword [0x1401a3d80], r9d
mov rax, r10
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bb0d0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140042640
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rsp + 8], rax
xor ecx, ecx
cmp byte [0x1401a58a2], cl
je 0x140042666
lea rax, [0x14019f688]
jmp 0x1400426d5
mov dword [rsp], 0x47003b
mov dword [rsp + 4], 0x36
lea r9, [0x14019f688]
lea rax, [0x14019ed90]
movzx eax, byte [rcx + rax]
xor ax, word [rsp + rcx*2]
mov word [r9 + rcx*2], ax
inc rcx
cmp rcx, 3
jl 0x14004267c
mov r8d, dword [0x1401a3d80]
mov eax, 0x2aaaaaab
mov byte [0x1401a58a2], 1
imul r8d, r8d
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
shl ecx, 3
sub r8d, ecx
cmp r8d, 0xe
jne 0x1400426d2
dec dword [0x1401a5348]
mov rax, r9
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1400bb0d0
add rsp, 0x18
ret