joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400544f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.140053ca0
test al, al
jne 0x140054516
inc dword [0x1401cbd80]
cmp byte [0x1401cdd91], 0
lea rax, [0x1401c7850]
jne 0x1400545a2
mov dword [rbp - 0x40], 0xc000c
mov dword [rbp - 0x3c], 0x9001c
mov dword [rbp - 0x38], 0x11000a
mov dword [rbp - 0x34], 0x70039
mov dword [rbp - 0x30], 0x39000c
mov dword [rbp - 0x2c], 0xf
xor ecx, ecx
mov dword [rbp - 0x28], 0xe0006
mov dword [rbp - 0x24], 0x15001b
mov dword [rbp - 0x20], 0x110035
mov dword [rbp - 0x1c], 0x1f000d
mov dword [rbp - 0x18], 0xe0017
mov dword [rbp - 0x14], 0x1d
lea r8, [0x1401c6d90]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rbp + rcx*2 - 0x42]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x17
jl 0x140054583
mov byte [0x1401cdd91], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x60
pop rbp
ret

Function at 0x1400546d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rbp - 8], rax
mov eax, dword [0x1401cbd80]
xor ebx, ebx
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0xb21642c9
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 1
jne 0x140054730
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp byte [0x1401cdd82], bl
lea rax, [0x1401c73d8]
jne 0x1400547e4
mov dword [rbp - 0x40], 0x1b0004
mov dword [rbp - 0x3c], 0x3a0005
mov dword [rbp - 0x38], 0x1b001a
mov dword [rbp - 0x34], 0xb0003
mov dword [rbp - 0x30], 0x30013
mov dword [rbp - 0x2c], 0x6000f
mov dword [rbp - 0x28], 0xb0006
mov dword [rbp - 0x24], 0x20030
mov dword [rbp - 0x20], 0xb000f
mov dword [rbp - 0x1c], 0x5000b
mov dword [rbp - 0x18], 0x3e0016
mov dword [rbp - 0x14], 0xd0002
mov dword [rbp - 0x10], 0x12001d
mov word [rbp - 0xc], bx
lea r8, [0x1401c6d91]
nop dword [rax]
movzx ecx, byte [rbx + r8 - 1]
movzx edx, word [rbp + rbx*2 - 0x3e]
add rbx, 2
xor cx, word [rbp + rbx*2 - 0x44]
mov word [rax + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor dx, cx
mov word [rax + rbx*2 - 2], dx
cmp rbx, 0x1a
jl 0x1400547b0
mov byte [0x1401cdd82], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d1680
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x140054800
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.140053d40
test al, al
jne 0x140054822
dec dword [0x1401cd930]
mov r8d, dword [0x1401cbd80]
mov eax, 0x2aaaaaab
mov ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 3
jne 0x14005488f
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x63
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400d0cc8
mov rcx, rax
call fcn.1400d272c
call fcn.140053d40
test al, al
jne 0x1400548bf
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0xcccccccd
mul r8d
shr edx, 6
lea ecx, [rdx + rdx*4]
shl ecx, 4
sub r8d, ecx
inc r8d
mov dword [0x1401cbd80], r8d
cmp byte [0x1401cdd93], 0
je 0x1400548e1
lea rax, [0x1401c7378]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x58
ret
xor r8d, r8d
mov dword [rsp + 0x20], 0x50009
mov dword [rsp + 0x24], 0x1d0030
mov dword [rsp + 0x28], 0x10006
mov dword [rsp + 0x2c], 0x1c0025
mov dword [rsp + 0x30], 0x30007
mov word [rsp + 0x40], r8w
mov dword [rsp + 0x34], 0x11004a
mov dword [rsp + 0x38], 0xb000c
mov dword [rsp + 0x3c], 0x4d000a
lea rdx, [0x1401c7378]
lea r9, [0x1401c6d91]
nop dword [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 0x22]
add r8, 4
xor ax, word [rsp + r8*2 + 0x18]
mov word [rdx + r8*2 - 8], ax
movzx eax, byte [r8 + r9 - 4]
xor cx, ax
mov word [rdx + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 + 0x1c]
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 + 0x1e]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0x10
jl 0x140054940
mov byte [0x1401cdd93], 1
mov rax, rdx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x58
ret
Function at 0x140054ff0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rbp + 0x10], rax
call fcn.140054040
mov ebx, 1
test al, al
jne 0x140055046
mov edx, ebx
mov eax, ebx
mov ecx, 0x65
nop word [rax + rax]
dec ecx
lea r9d, [rax + rdx]
lea edx, [rax]
mov eax, r9d
jns 0x140055030
mov dword [0x1401cbd80], r9d
jmp 0x14005504d
mov r9d, dword [0x1401cbd80]
lea eax, [r9 + 1]
lea ecx, [r9 + 2]
imul ecx, eax
mov eax, 0x66666667
imul ecx, r9d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0xd
jne 0x1400550c6
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r9d, edx
add r9d, 0x2f4
movsxd rcx, r9d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400d0cc8
mov rcx, rax
call fcn.1400d272c
mov r9d, dword [0x1401cbd80]
cmp byte [0x1401cdd98], 0
je 0x1400550db
lea rax, [0x1401c7c28]
jmp 0x1400551a9
mov dword [rbp - 0x30], 0x9002b
mov dword [rbp - 0x2c], 0x10001f
mov dword [rbp - 0x28], 0x1001c
mov dword [rbp - 0x24], 0x1c0032
mov dword [rbp - 0x20], 0x30008
mov dword [rbp - 0x1c], 0x220002
mov dword [rbp - 0x18], 0x60011
mov dword [rbp - 0x14], RtlUnwindEx
mov dword [rbp - 0x10], 0x30006
mov dword [rbp - 0xc], 0x140003
xor eax, eax
mov dword [rbp - 8], 0x410000
mov dword [rbp - 4], 0xd000c
mov dword [rbp], 0xa0018
mov dword [rbp + 4], 0x30008
mov dword [rbp + 8], 0x4d
lea rbx, [0x1401c7c28]
lea rdx, [0x1401c6d90]
movzx ecx, byte [rax + rdx]
inc rax
xor cx, word [rbp + rax*2 - 0x32]
mov word [rbx + rax*2 - 2], cx
cmp rax, 0x1d
jl 0x140055154
mov r8d, r9d
mov eax, 0x4ec4ec4f
imul r8d, r9d
imul r8d, r9d
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0xd
sub r8d, edx
cmp r8d, 0xa
jne 0x14005519f
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov byte [0x1401cdd98], 1
mov rax, rbx
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1400d1680
mov rbx, qword [rsp + 0x130]
add rsp, 0x120
pop rbp
ret
Function at 0x1400551d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401cddac], 0
je 0x140055203
lea rax, [0x1401c7ae8]
jmp 0x140055398
mov ecx, dword [0x1401cbd80]
mov eax, 0x38e38e39
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rdi
xor edi, edi
imul ecx, ecx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 3
jne 0x140055255
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov dword [rbp - 0x40], 0x1000b
mov dword [rbp - 0x3c], 0x450019
mov dword [rbp - 0x38], 0x39002b
mov dword [rbp - 0x34], 0x2a
mov dword [rbp - 0x30], 0x20043
mov esi, 2
mov dword [rbp - 0x2c], 0x170003
mov dword [rbp - 0x28], 0x10010
mov dword [rbp - 0x24], 0x50001b
mov dword [rbp - 0x20], 0x1e000f
mov dword [rbp - 0x1c], 0x2000d
mov dword [rbp - 0x18], 0x4f0007
mov word [rbp - 0x14], di
mov rdx, rdi
lea rbx, [0x1401c7ae8]
lea r8, [0x1401c6d91]
nop dword [rax]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rbp + rdx*2 - 0x3e]
xor ax, word [rbp + rdx*2 - 0x40]
mov word [rbx + rdx*2], ax
movzx eax, byte [rdx + r8]
xor cx, ax
mov word [rbx + rdx*2 + 2], cx
add rdx, rsi
cmp rdx, 0x16
jl 0x1400552c0
call fcn.140053e60
mov edx, dword [0x1401cbd80]
test al, al
jne 0x140055313
mov ecx, edx
test edx, edx
je 0x14005530b
dec ecx
je 0x140055307
inc edx
jmp 0x14005530d
mov edx, edi
jmp 0x14005530d
mov edx, esi
mov dword [0x1401cbd80], edx
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
lea eax, [rdx + 1]
lea ecx, [rdx + 2]
mov byte [0x1401cddac], 1
imul ecx, eax
mov eax, 0x30c30c31
imul ecx, edx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xb
jne 0x140055395
mov rax, qword [str.jbQsz7RXRFK]
or r8, 0xffffffffffffffff
mov qword [rbp - 0x50], rax
mov eax, dword [0x140159690]
mov rcx, r8
mov dword [rbp - 0x48], eax
lea rax, [rbp - 0x50]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140055370
mov eax, 4
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.1400d0cc8
mov rcx, rax
call fcn.1400d272c
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d1680
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rbp
ret
Function at 0x140055640
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rbp + 0x47], rax
cmp byte [0x1401cdd9a], 0
je 0x140055675
lea rax, [0x1401c7730]
jmp 0x14005577c
xor r9d, r9d
mov dword [rbp + 7], 0x8002d
mov dword [rbp + 0xb], 0x350001
mov dword [rbp + 0xf], 0x1a001d
mov dword [rbp + 0x13], 0x320005
mov dword [rbp + 0x17], 0x20007
mov eax, r9d
mov dword [rbp + 0x1b], 0x17001e
mov dword [rbp + 0x1f], 0x1c0010
mov dword [rbp + 0x23], 0x1f004f
mov dword [rbp + 0x27], 0x46000c
mov dword [rbp + 0x2b], 0x1e0028
mov dword [rbp + 0x2f], 0x50012
mov dword [rbp + 0x33], 0x50026
mov dword [rbp + 0x37], 0x140013
mov dword [rbp + 0x3b], 0x15000c
mov dword [rbp + 0x3f], 0x5f0014
mov dword [rbp + 0x43], 0x44
lea rbx, [0x1401c7730]
lea rdx, [0x1401c6d90]
nop dword [rax]
movzx ecx, byte [rax + rdx]
inc rax
xor cx, word [rbp + rax*2 + 5]
mov word [rbx + rax*2 - 2], cx
cmp rax, 0x1f
jl 0x140055700
mov ecx, dword [0x1401cbd80]
mov byte [0x1401cdd9a], 1
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x2aaaaaab
imul r8d, ecx
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub r8d, eax
cmp r8d, 1
jne 0x140055779
mov qword [rsp + 0x30], r9
mov dword [rsp + 0x28], r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rax, rbx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400d1680
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret
Function at 0x1400557a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rsp + 0x18], rax
mov ecx, dword [0x1401cbd80]
mov eax, 0x30c30c31
lea r8d, [rcx + 1]
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 0xa
jne 0x140055849
test ecx, ecx
je 0x140055849
mov eax, ecx
and eax, 0x80000001
jge 0x1400557f3
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x140055808
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov dword [0x1401cbd80], eax
jmp 0x140055815
lea ecx, [rcx*2 + 1]
mov dword [0x1401cbd80], ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov edx, ecx
sub edx, eax
je 0x140055837
sub edx, 2
je 0x14005583a
dec edx
je 0x14005583c
jmp 0x140055845
add ecx, 2
inc ecx
add ecx, 2
mov dword [0x1401cbd80], ecx
test ecx, ecx
jne 0x1400557e3
cmp byte [0x1401cdd8a], 0
je 0x14005586b
lea rax, [0x1401c76d8]
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x28
ret
mov dword [rsp], 0x30047
mov dword [rsp + 4], 0x13001a
mov dword [rsp + 8], 0x43000e
mov dword [rsp + 0xc], 0x5d0052
mov qword [rsp + 0x10], 0xa0007
xor edx, edx
lea r11, [0x1401c76d8]
lea r8, [0x1401c6d90]
movzx eax, byte [rdx + r8]
inc rdx
xor ax, word [rsp + rdx*2 - 2]
mov word [r11 + rdx*2 - 2], ax
cmp rdx, 0xb
jl 0x1400558a3
lea r10d, [rcx + 1]
lea r9d, [rcx + 2]
mov eax, 0x2aaaaaab
mov byte [0x1401cdd8a], 1
imul r9d, r10d
imul r9d, ecx
imul r9d
mov rax, r11
sar edx, 1
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
lea edx, [rdx + rdx*2]
shl edx, 2
sub r9d, edx
cmp r9d, 1
cmove ecx, r10d
mov dword [0x1401cbd80], ecx
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x28
ret
Function at 0x140055920
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r8d, dword [0x1401cbd80]
mov eax, 0x78787879
lea ecx, [r8 + 1]
imul ecx, r8d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 0xf
jne 0x140055972
call fcn.1400d2038
mov r8d, eax
mov dword [0x1401cbd80], eax
cmp byte [0x1401cdd7c], 0
je 0x140055987
lea rax, [0x1401c7800]
jmp 0x140055acc
lea eax, [r8 + 1]
mov qword [rsp + 0x90], rbx
lea ecx, [r8 + 2]
xor ebx, ebx
mov qword [rsp + 0x98], rdi
mov rdi, qword [rsp + 0x98]
imul ecx, eax
imul ecx, r8d
mov eax, 0x66666667
mov dword [rbp - 0x60], 0x1000b
mov dword [rbp - 0x5c], 0xa0019
mov dword [rbp - 0x58], 0x55000c
mov dword [rbp - 0x54], 0x120000
mov dword [rbp - 0x50], 0xa000a
imul ecx
sar edx, 3
mov dword [rbp - 0x4c], 0x160009
mov dword [rbp - 0x48], 0x1f0043
mov eax, edx
mov dword [rbp - 0x44], 0x1f001d
mov dword [rbp - 0x40], 0x460009
shr eax, 0x1f
mov dword [rbp - 0x3c], 0x2000d
mov dword [rbp - 0x38], 0x150053
add edx, eax
mov dword [rbp - 0x34], 0x1e000f
mov dword [rbp - 0x30], 0xf001c
lea eax, [rdx + rdx*4]
mov dword [rbp - 0x2c], 0x60003
mov dword [rbp - 0x28], 0xc0019
shl eax, 2
mov dword [rbp - 0x24], 0x16000a
mov word [rbp - 0x20], bx
sub ecx, eax
cmp ecx, 0xd
jne 0x140055a55
lea edx, [rcx + 0x76]
lea r8d, [rcx + 0x77]
lea rcx, str._d__d_n
call fcn.1400d1f8c
lea rax, [0x1401c7800]
lea r8, [0x1401c6d91]
nop word [rax + rax]
movzx ecx, byte [rbx + r8 - 1]
movzx edx, word [rbp + rbx*2 - 0x5e]
add rbx, 4
xor cx, word [rbp + rbx*2 - 0x68]
mov word [rax + rbx*2 - 8], cx
movzx ecx, byte [rbx + r8 - 4]
xor dx, cx
movzx ecx, byte [rbx + r8 - 3]
xor cx, word [rbp + rbx*2 - 0x64]
mov word [rax + rbx*2 - 6], dx
mov word [rax + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor cx, word [rbp + rbx*2 - 0x62]
mov word [rax + rbx*2 - 2], cx
cmp rbx, 0x20
jl 0x140055a70
mov rbx, qword [rsp + 0x90]
mov byte [0x1401cdd7c], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x80
pop rbp
ret
Function at 0x140055af0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rbp - 8], rax
mov ecx, dword [0x1401cbd80]
mov eax, ecx
imul eax, ecx
and eax, 0x8000000f
jge 0x140055b24
dec eax
or eax, 0xfffffff0
inc eax
xor esi, esi
cmp eax, 6
jne 0x140055b7b
lea ecx, [rsi + 0x28]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
call fcn.1400d0cc8
mov ebx, esi
mov rdi, rax
call fcn.1400d2038
inc rbx
add eax, dword [0x1401cbd80]
mov dword [rdi + rbx*4 - 4], eax
cmp rbx, 0xa
jl 0x140055b42
mov ecx, dword [rdi + 0x24]
mov dword [0x1401cbd80], ecx
mov rcx, rdi
call fcn.1400d272c
mov ecx, dword [0x1401cbd80]
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
imul r8d, ecx
mov eax, r8d
and eax, 0x80000007
jge 0x140055b9b
dec eax
or eax, 0xfffffff8
inc eax
cmp eax, 5
jne 0x140055c31
mov eax, 0x88888889
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub r8d, edx
cmp r8d, 0xc
jne 0x140055bef
mov eax, 0xb1
mov r8d, LoadRegTypeLib
test r8d, r8d
je 0x140055be5
cdq
mov ecx, r8d
idiv r8d
mov eax, ecx
mov r8d, edx
test ecx, ecx
jne 0x140055bd0
lea ecx, [r8 + rax]
mov dword [0x1401cbd80], ecx
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub ecx, edx
add ecx, 0x141
movsxd rcx, ecx
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400d0cc8
mov rcx, rax
call fcn.1400d272c
cmp byte [0x1401cddaf], sil
je 0x140055c46
lea rax, [0x1401c7968]
jmp 0x140055d17
mov dword [rbp - 0x30], 0x50009
mov dword [rbp - 0x2c], 0x13002a
mov dword [rbp - 0x28], 0x7000a
mov dword [rbp - 0x24], 0x1a0015
mov dword [rbp - 0x20], 0x8000c
mov dword [rbp - 0x1c], 0x110033
mov dword [rbp - 0x18], 0xe000b
mov dword [rbp - 0x14], 0x170001
mov dword [rbp - 0x10], 0x39000f
mov word [rbp - 0xc], si
lea rdx, [0x1401c7968]
lea r8, [0x1401c6d91]
nop word [rax + rax]
movzx eax, byte [rsi + r8 - 1]
movzx ecx, word [rbp + rsi*2 - 0x2e]
add rsi, 6
xor ax, word [rbp + rsi*2 - 0x3c]
mov word [rdx + rsi*2 - 0xc], ax
movzx eax, byte [rsi + r8 - 6]
xor cx, ax
movzx eax, byte [rsi + r8 - 5]
xor ax, word [rbp + rsi*2 - 0x38]
mov word [rdx + rsi*2 - 0xa], cx
movzx ecx, byte [rsi + r8 - 3]
xor cx, word [rbp + rsi*2 - 0x34]
mov word [rdx + rsi*2 - 8], ax
movzx eax, byte [rsi + r8 - 4]
xor ax, word [rbp + rsi*2 - 0x36]
mov word [rdx + rsi*2 - 4], cx
movzx ecx, byte [rsi + r8 - 2]
xor cx, word [rbp + rsi*2 - 0x32]
mov word [rdx + rsi*2 - 6], ax
mov word [rdx + rsi*2 - 2], cx
cmp rsi, 0x12
jl 0x140055ca0
mov byte [0x1401cddaf], 1
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d1680
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x140055e80
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x620]
sub rsp, 0x720
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rbp + 0x5f0], rax
mov r11d, dword [0x1401cbd80]
mov eax, 0x30c30c31
mov ecx, r11d
imul ecx, r11d
imul ecx, r11d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 3
jne 0x140055ed5
dec dword [0x1401cda18]
cmp byte [0x1401cdd95], 0
mov qword [rsp + 0x718], r12
je 0x140055ef2
lea rax, [0x1401c78c0]
jmp 0x14005607a
mov qword [rsp + 0x710], r13
xor r13d, r13d
mov dword [rsp], 0xc0009
mov dword [rsp + 4], 0x11001b
mov dword [rsp + 8], 0x13004f
mov dword [rsp + 0xc], 0x1d000f
mov ecx, r13d
mov dword [rsp + 0x10], 0x460007
mov dword [rsp + 0x14], 0x7000f
mov dword [rsp + 0x18], 0x1d0011
mov dword [rsp + 0x1c], 0x1e000a
mov dword [rsp + 0x20], 0x2b001e
mov dword [rsp + 0x24], 0x15000b
mov dword [rsp + 0x28], 0xd0006
mov dword [rsp + 0x2c], 0xf
lea r12, [0x1401c78c0]
lea rdx, [0x1401c6d90]
nop dword [rax]
movzx eax, byte [rcx + rdx]
inc rcx
xor ax, word [rsp + rcx*2 - 2]
mov word [r12 + rcx*2 - 2], ax
cmp rcx, 0x17
jl 0x140055f70
lea eax, [r11 + 1]
lea ecx, [r11 + 2]
mov byte [0x1401cdd95], 1
imul ecx, eax
mov eax, 0x66666667
imul ecx, r11d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0xd
jne 0x14005606f
mov qword [rsp + 0x730], rbx
mov qword [rsp + 0x738], rsi
mov qword [rsp + 0x740], rdi
mov qword [rsp + 0x708], r14
mov qword [rsp + 0x700], r15
lea r10, [rsp + 0x30]
mov r15d, r13d
mov r12d, 0xc
nop word [rax + rax]
movzx edi, r11b
mov esi, 1
mov r14, r12
sub dil, r15b
nop
mov rcx, r13
mov r9d, 1
nop dword [rax]
inc rcx
inc r9d
cmp rcx, 0xb
jl 0x140056020
inc esi
add r10, 0xb
dec r14
jne 0x140056010
inc r15d
cmp r15d, 0xd
jl 0x140056000
mov r15, qword [rsp + 0x700]
mov r14, qword [rsp + 0x708]
mov rdi, qword [rsp + 0x740]
mov rsi, qword [rsp + 0x738]
mov rbx, qword [rsp + 0x730]
lea r12, [0x1401c78c0]
mov r13, qword [rsp + 0x710]
mov rax, r12
mov r12, qword [rsp + 0x718]
mov rcx, qword [rbp + 0x5f0]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x720
pop rbp
ret
Function at 0x1400560a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp byte [0x1401cdd94], 0
je 0x1400560d8
lea rax, [0x1401c7600]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x50
pop rbx
ret
xor edx, edx
mov dword [rsp + 0x20], 0x1b0004
mov dword [rsp + 0x24], 0x3a0005
mov dword [rsp + 0x28], 0x50006
mov dword [rsp + 0x2c], 0x2c0005
mov dword [rsp + 0x30], 0xf0017
mov word [rsp + 0x40], dx
mov dword [rsp + 0x34], 0x170001
mov dword [rsp + 0x38], 7
mov dword [rsp + 0x3c], 0x4001a
lea rbx, [0x1401c7600]
lea r8, [0x1401c6d91]
nop dword [rax]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rsp + rdx*2 + 0x22]
add rdx, 4
xor ax, word [rsp + rdx*2 + 0x18]
mov word [rbx + rdx*2 - 8], ax
movzx eax, byte [rdx + r8 - 4]
xor cx, ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rsp + rdx*2 + 0x1c]
mov word [rbx + rdx*2 - 6], cx
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rsp + rdx*2 + 0x1e]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0x10
jl 0x140056130
mov ecx, dword [0x1401cbd80]
mov eax, 0x38e38e39
imul ecx, ecx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 3
jne 0x1400561ab
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov byte [0x1401cdd94], 1
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x50
pop rbx
ret
Function at 0x1400561d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401cdd99], 0
je 0x140056209
lea rax, [0x1401c7438]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 0x70], rbx
call fcn.140053ca0
xor ebx, ebx
test al, al
jne 0x140056245
mov ecx, dword [0x1401cbd80]
mov edx, ecx
test ecx, ecx
je 0x14005623b
dec edx
je 0x140056233
inc ecx
mov dword [0x1401cbd80], ecx
jmp 0x140056245
mov dword [0x1401cbd80], ebx
jmp 0x140056245
mov dword [0x1401cbd80], 2
mov dword [rbp - 0x40], 0x1d0025
mov dword [rbp - 0x3c], 0xb0010
mov dword [rbp - 0x38], 0x7003f
mov dword [rbp - 0x34], 0x100009
mov dword [rbp - 0x30], 0x150006
mov dword [rbp - 0x2c], 0x26001f
mov dword [rbp - 0x28], 0x4000c
mov dword [rbp - 0x24], 0x1e000a
mov dword [rbp - 0x20], 0x4a
mov dword [rbp - 0x1c], 0x180005
mov dword [rbp - 0x18], 0x4001f
mov dword [rbp - 0x14], 0x4c000e
mov word [rbp - 0x10], bx
call fcn.1400540c0
lea rax, [0x1401c7438]
lea r8, [0x1401c6d91]
movzx ecx, byte [rbx + r8 - 1]
movzx edx, word [rbp + rbx*2 - 0x3e]
add rbx, 6
xor cx, word [rbp + rbx*2 - 0x4c]
mov word [rax + rbx*2 - 0xc], cx
movzx ecx, byte [rbx + r8 - 6]
xor dx, cx
movzx ecx, byte [rbx + r8 - 5]
xor cx, word [rbp + rbx*2 - 0x48]
mov word [rax + rbx*2 - 0xa], dx
mov word [rax + rbx*2 - 8], cx
movzx ecx, byte [rbx + r8 - 4]
xor cx, word [rbp + rbx*2 - 0x46]
mov word [rax + rbx*2 - 6], cx
movzx ecx, byte [rbx + r8 - 3]
xor cx, word [rbp + rbx*2 - 0x44]
mov word [rax + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor cx, word [rbp + rbx*2 - 0x42]
mov word [rax + rbx*2 - 2], cx
cmp rbx, 0x18
jl 0x1400562b0
mov byte [0x1401cdd99], 1
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x60
pop rbp
ret