joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140043c90
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4b8]
sub rsp, 0x590
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp + 0x480], rax
mov r8d, dword [0x1401a3d80]
mov eax, 0x30c30c31
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 5
jne 0x140043d40
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x2f4
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400ba748
mov rcx, rax
call fcn.1400bc20c
mov r8d, dword [0x1401a3d80]
lea ecx, [r8 + 1]
mov eax, 0x6bca1af3
imul ecx, r8d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 0x10
jne 0x140043d7d
lea edx, [rcx + 0x6d]
lea r8d, [rcx + 0x6e]
lea rcx, str._d__d_n
call fcn.1400bb9dc
mov r8d, dword [0x1401a3d80]
xor ecx, ecx
cmp byte [0x1401a58af], cl
je 0x140043d93
lea rax, [0x14019f778]
jmp 0x140043e5b
mov dword [rsp + 0x20], 0x7004e
mov r13d, 1
mov dword [rsp + 0x24], 0x1c0001
mov dword [rsp + 0x28], 0x410013
mov dword [rsp + 0x2c], 0xa0001
mov dword [rsp + 0x30], 0x18
lea r9, [0x14019f778]
lea rax, [0x14019ed90]
movzx eax, byte [rcx + rax]
xor ax, word [rsp + rcx*2 + 0x20]
mov word [r9 + rcx*2], ax
add rcx, r13
cmp rcx, 9
jl 0x140043dc8
mov ecx, r8d
mov eax, 0x38e38e39
mov byte [0x1401a58af], r13b
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 5
jne 0x140043e58
xor r9d, r9d
lea r11, [rsp + 0x40]
mov r10d, r9d
mov dil, r8b
mov ebx, r13d
mov esi, 0x10
sub dil, r10b
mov r14, r9
mov r15d, r13d
add r14, r13
add r15d, r13d
cmp r14, 6
jl 0x140043e30
add ebx, r13d
add r11, 6
sub rsi, r13
jne 0x140043e2a
add r10d, r13d
cmp r10d, 0xe
jl 0x140043e1c
lea r9, [0x14019f778]
mov rax, r9
mov rcx, qword [rbp + 0x480]
xor rcx, rsp
call fcn.1400bb0d0
lea r11, [rsp + 0x590]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140043e8c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 8], rax
xor ecx, ecx
cmp byte [0x1401a58aa], cl
je 0x140043ebd
lea rax, [0x14019f3c0]
jmp 0x140043fe2
mov dword [rbp - 0x40], 0x80000
mov dword [rbp - 0x3c], 0x1e0000
mov dword [rbp - 0x38], 0xe0052
mov dword [rbp - 0x34], 0xa0009
mov dword [rbp - 0x30], 0x16001b
mov dword [rbp - 0x2c], 0x70050
mov dword [rbp - 0x28], 0x17
mov dword [rbp - 0x24], 0x170015
mov dword [rbp - 0x20], 0x460011
mov dword [rbp - 0x1c], 7
mov dword [rbp - 0x18], 0x1a0003
mov dword [rbp - 0x14], 7
mov word [rbp - 0x10], cx
lea rbx, [0x14019f3c0]
lea rax, [0x14019ed90]
movzx eax, byte [rcx + rax]
xor ax, word [rbp + rcx*2 - 0x40]
mov word [rbx + rcx*2], ax
inc rcx
cmp rcx, 0x18
jl 0x140043f1c
mov r8d, dword [0x1401a3d80]
mov eax, 0x30c30c31
lea ecx, [r8 + 1]
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xf
jne 0x140043f72
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov r8d, dword [0x1401a3d80]
mov ecx, r8d
mov eax, 0x2e8ba2e9
mov byte [0x1401a58aa], 1
imul ecx, r8d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub ecx, edx
cmp ecx, 2
jne 0x140043fdf
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x141
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400ba748
mov rcx, rax
call fcn.1400bc20c
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bb0d0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x140043ffc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 8], rax
xor r10d, r10d
cmp byte [0x1401a58b7], r10b
je 0x14004402f
lea rax, [0x14019fb18]
jmp 0x1400440c9
mov ebx, 0xf
mov dword [rbp - 0x20], 0xc0045
mov dword [rbp - 0x1c], 0xf0016
mov dword [rbp - 0x18], 0x3b0011
mov dword [rbp - 0x14], 0xb000c
mov dword [rbp - 0x10], 0x480011
lea r11d, [rbx - 0xe]
mov word [rbp - 0xc], r10w
mov rcx, r10
lea r9, [0x14019fb18]
lea rax, [0x14019ed90]
movzx eax, byte [rcx + rax]
xor ax, word [rbp + rcx*2 - 0x20]
mov word [r9 + rcx*2], ax
add rcx, r11
cmp rcx, 0xa
jl 0x14004406a
mov r8d, dword [0x1401a3d80]
mov eax, 0x30c30c31
mov byte [0x1401a58b7], r11b
lea ecx, [r8 + 1]
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, ebx
jne 0x1400440c6
test r8d, r8d
cmove r8d, r11d
mov dword [0x1401a3d80], r8d
mov rax, r9
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bb0d0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rbp
ret
Function at 0x1400440e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 8], rax
mov r8d, dword [0x1401a3d80]
mov eax, 0x30c30c31
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 5
jne 0x14004412e
inc r8d
mov dword [0x1401a3d80], r8d
xor eax, eax
cmp byte [0x1401a588c], al
je 0x140044141
lea rax, [0x14019f488]
jmp 0x1400441b3
mov dword [rbp - 0x30], 0x1f000d
mov dword [rbp - 0x2c], 0x35001e
mov dword [rbp - 0x28], 0x1f001b
mov dword [rbp - 0x24], 0x390006
mov r9d, 0x11
mov dword [rbp - 0x20], 0xd0011
mov dword [rbp - 0x1c], 0x30013
mov dword [rbp - 0x18], 0x170004
mov dword [rbp - 0x14], 0xb0019
mov dword [rbp - 0x10], 0xc
lea rdx, [0x14019f488]
lea rcx, [0x14019ed90]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x30]
mov word [rdx + rax*2], cx
inc rax
cmp rax, r9
jl 0x14004418d
mov byte [0x1401a588c], 1
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bb0d0
add rsp, 0x30
pop rbp
ret

Function at 0x1400441c8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor edi, edi
cmp byte [0x1401a5898], dil
je 0x1400441f5
lea rax, [0x14019f9b8]
jmp 0x140044272
mov dword [rsp + 0x20], 0xc0028
mov dword [rsp + 0x24], 0x4001c
mov ebx, 4
mov dword [rsp + 0x28], 0x30017
mov dword [rsp + 0x2c], 0x540056
mov word [rsp + 0x30], di
call fcn.140040ee8
test al, al
jne 0x140044247
mov ecx, ebx
call fcn.1400bb888
mov rbx, rax
call fcn.1400bba88
mov rcx, rbx
mov dword [rbx], eax
mov dword [0x1401a3d80], eax
call fcn.1400bb0b4
lea rax, [0x14019f9b8]
lea rcx, [0x14019ed90]
movzx ecx, byte [rdi + rcx]
xor cx, word [rsp + rdi*2 + 0x20]
mov word [rax + rdi*2], cx
inc rdi
cmp rdi, 8
jl 0x14004424e
mov byte [0x1401a5898], 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400bb0d0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14004428c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r8d, dword [0x1401a3d80]
mov eax, 0x92492493
xor ebx, ebx
mov ecx, r8d
mov edi, 1
imul ecx, r8d
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
sub ecx, edx
cmp ecx, 2
jne 0x1400442f3
test r8d, r8d
cmove r8d, edi
mov dword [0x1401a3d80], r8d
cmp byte [0x1401a58a8], bl
je 0x140044307
lea rax, [0x14019fc08]
jmp 0x140044409
imul r8d, r8d
mov eax, 0x2aaaaaab
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 0xa
jne 0x140044378
mov rax, qword [str.nKUlS8Tb0rLS]
or r8, 0xffffffffffffffff
mov qword [rbp - 0x60], rax
mov eax, dword [0x140136ca8]
mov rcx, r8
mov dword [rbp - 0x58], eax
mov al, byte [0x140136cac]
mov byte [rbp - 0x54], al
lea rax, [rbp - 0x60]
inc rcx
cmp byte [rax + rcx], bl
jne 0x140044354
mov eax, 4
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.1400ba748
mov rcx, rax
call fcn.1400bc20c
mov dword [rbp - 0x50], 0x1f000d
mov dword [rbp - 0x4c], 0x35001e
mov dword [rbp - 0x48], 0x60014
mov dword [rbp - 0x44], 0x150017
mov dword [rbp - 0x40], 0x2a0000
mov dword [rbp - 0x3c], 0x80019
mov dword [rbp - 0x38], 0x6001e
mov dword [rbp - 0x34], 0x100013
mov dword [rbp - 0x30], 0x9000b
mov dword [rbp - 0x2c], 0x3a000d
mov dword [rbp - 0x28], 0x160009
mov dword [rbp - 0x24], 0x10016
mov dword [rbp - 0x20], 0x110009
mov dword [rbp - 0x1c], 0xf0001
mov word [rbp - 0x18], bx
lea rax, [0x14019fc08]
lea rcx, [0x14019ed90]
movzx ecx, byte [rbx + rcx]
xor cx, word [rbp + rbx*2 - 0x50]
mov word [rax + rbx*2], cx
add rbx, rdi
cmp rbx, 0x1c
jl 0x1400443e5
mov byte [0x1401a58a8], dil
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400bb0d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14004442c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r9d, dword [0x1401a3d80]
xor r8d, r8d
lea eax, [r9 + 1]
lea ecx, [r9 + 2]
lea ebx, [r8 + 1]
lea edi, [rbx + 0xf]
imul ecx, eax
imul ecx, r9d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, edi
jne 0x1400444ad
mov r10d, r8d
test r9d, r9d
je 0x1400444a6
mov eax, r9d
mov ecx, r9d
cdq
and ecx, ebx
sub eax, edx
add r10d, ecx
sar eax, 1
mov r9d, eax
jne 0x140044491
mov dword [0x1401a3d80], r10d
cmp byte [0x1401a5899], r8b
lea rax, [0x14019f6f0]
jne 0x14004455e
mov dword [rbp - 0x60], 0x1b0006
mov dword [rbp - 0x5c], 0x5001c
mov dword [rbp - 0x58], 0x4f0000
mov dword [rbp - 0x54], 0x30002
mov dword [rbp - 0x50], 0x10000
mov dword [rbp - 0x4c], 0x80019
mov dword [rbp - 0x48], 0x430013
mov dword [rbp - 0x44], 0xd0016
mov dword [rbp - 0x40], 0x150010
mov dword [rbp - 0x3c], 0x450017
mov dword [rbp - 0x38], 0x1001d
mov dword [rbp - 0x34], 0x7000d
mov dword [rbp - 0x30], 0x16000f
mov dword [rbp - 0x2c], 0x4b0017
mov dword [rbp - 0x28], 0x19
mov dword [rbp - 0x24], 0x60007
mov dword [rbp - 0x20], 0x4a
lea rcx, [0x14019ed90]
movzx ecx, byte [r8 + rcx]
xor cx, word [rbp + r8*2 - 0x60]
mov word [rax + r8*2], cx
add r8, rbx
cmp r8, 0x21
jl 0x140044538
mov byte [0x1401a5899], bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400bb0d0
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x14004457c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 8], rax
xor r14d, r14d
cmp byte [0x1401a58a9], r14b
je 0x1400445bd
lea rax, [0x14019f9d8]
jmp 0x140044692
mov dword [rbp - 0x20], 0xc0015
mov dword [rbp - 0x1c], 0x19001c
mov dword [rbp - 0x18], 0x1b
mov edx, 0xb
mov dword [rbp - 0x14], 0x46000b
mov dword [rbp - 0x10], 0x70011
mov dword [rbp - 0xc], 2
mov rcx, r14
lea r8, [0x14019f9d8]
lea rax, [0x14019ed90]
movzx eax, byte [rcx + rax]
xor ax, word [rbp + rcx*2 - 0x20]
mov word [r8 + rcx*2], ax
inc rcx
cmp rcx, rdx
jl 0x1400445f6
mov r11d, dword [0x1401a3d80]
mov eax, 0x30c30c31
lea ecx, [r11 + 1]
imul ecx, r11d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xf
jne 0x140044688
mov eax, r11d
mov r10d, 0xcd
mov ecx, r14d
cdq
sub eax, edx
sar eax, 1
mov esi, eax
test esi, esi
jle 0x140044681
mov eax, r11d
mov r9d, r14d
mov rdi, rsi
cdq
and edx, 3
add eax, edx
sar eax, 2
test eax, eax
jle 0x140044679
mov edx, r9d
mov ebx, eax
add r10d, edx
dec edx
dec rbx
jne 0x14004466f
add r9d, ecx
dec rdi
jne 0x140044666
inc ecx
cmp ecx, r10d
jl 0x140044650
mov byte [0x1401a58a9], 1
mov rax, r8
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bb0d0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret

Function at 0x1400446b8
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
cmp byte [0x1401a58a6], al
je 0x1400446e2
lea rax, [0x14019f9f0]
jmp 0x140044748
mov dword [rbp - 0x30], 0x19002c
mov dword [rbp - 0x2c], 0x4000b
mov dword [rbp - 0x28], 0x1d0022
mov dword [rbp - 0x24], 0x5000a
mov dword [rbp - 0x20], 0x60011
mov dword [rbp - 0x1c], 0x460003
mov dword [rbp - 0x18], 0x160017
mov dword [rbp - 0x14], 2
lea rdx, [0x14019f9f0]
lea rcx, [0x14019ed90]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x30]
mov word [rdx + rax*2], cx
inc rax
cmp rax, 0xf
jl 0x140044721
mov byte [0x1401a58a6], 1
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400bb0d0
add rsp, 0x30
pop rbp
ret
Function at 0x14004475c
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ecx, ecx
cmp byte [0x1401a589e], cl
je 0x140044789
lea rax, [0x14019f4e0]
jmp 0x14004486b
mov r11d, 5
mov dword [rbp - 0x50], 0x1b0020
mov dword [rbp - 0x4c], 0xb000b
mov dword [rbp - 0x48], 0xa0006
mov dword [rbp - 0x44], 0x90031
mov dword [rbp - 0x40], 0x19001b
mov dword [rbp - 0x14], r11d
mov dword [rbp - 0x3c], 0x30018
mov dword [rbp - 0x38], 0x130018
mov dword [rbp - 0x34], 0x560043
mov dword [rbp - 0x30], 0x80031
mov dword [rbp - 0x2c], 0x150002
mov dword [rbp - 0x28], 0x1b001e
mov dword [rbp - 0x24], 0x10000d
mov dword [rbp - 0x20], 0x3004a
mov dword [rbp - 0x1c], 0x20005
mov dword [rbp - 0x18], 0xb001c
lea r9, [0x14019f4e0]
lea rax, [0x14019ed90]
movzx eax, byte [rcx + rax]
xor ax, word [rbp + rcx*2 - 0x50]
mov word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x1f
jl 0x140044803
mov eax, dword [0x1401a3d80]
mov byte [0x1401a589e], 1
mov r8d, eax
imul r8d, eax
imul r8d, eax
mov eax, 0x30c30c31
imul r8d
mov eax, 0x4211773d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, dword [0x1401a5560]
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, r11d
cmove ecx, eax
mov rax, r9
mov dword [0x1401a5560], ecx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400bb0d0
add rsp, 0x50
pop rbp
ret
Function at 0x140044880
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xde90]
mov eax, 0xdf90
call fcn.1400c0180
sub rsp, rax
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp + 0xde80], rax
call fcn.140040ee8
xor ebx, ebx
mov edi, 1
test al, al
jne 0x140044939
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, 0xdf20
mov word [rsp + 0x50], bx
call fcn.1400c0510
mov r10d, ebx
or r9, 0xffffffffffffffff
mov r11d, 0xa9
mov r8, rbx
test r10, r10
je 0x140044913
test r8, r8
je 0x140044913
lea rax, [r9 + r8]
lea rcx, [r9 + r8]
movzx edx, word [rbp + rcx*2 - 0x200]
add dx, word [rsp + rax*2 + 0x50]
lea rax, [r9 + r8]
add dx, di
mov word [rsp + rax*2 + 0x52], dx
add r8, rdi
cmp r8, r11
jl 0x1400448e8
add r9, r11
add r10, rdi
cmp r9, 0x6f90
jl 0x1400448e5
movsx edx, word [rbp + 0xde70]
mov dword [0x1401a3d80], edx
jmp 0x14004493f
mov edx, dword [0x1401a3d80]
cmp byte [0x1401a5895], bl
je 0x140044953
lea rax, [0x14019f610]
jmp 0x140044a24
mov dword [rsp + 0x20], 0x1b0034
mov dword [rsp + 0x24], 0x1e0007
mov dword [rsp + 0x28], 0x3f0017
mov dword [rsp + 0x2c], 0x90017
mov dword [rsp + 0x30], 0x100017
mov r9d, 0x10
mov dword [rsp + 0x34], 0x150003
mov dword [rsp + 0x38], 0x60039
mov dword [rsp + 0x3c], 0xb001d
mov dword [rsp + 0x40], 0x1f0010
mov dword [rsp + 0x44], 0x450059
mov word [rsp + 0x48], bx
lea r8, [0x14019f610]
lea rax, [0x14019ed90]
movzx eax, byte [rbx + rax]
xor ax, word [rsp + rbx*2 + 0x20]
mov word [r8 + rbx*2], ax
add rbx, rdi
cmp rbx, 0x14
jl 0x1400449b5
lea eax, [rdx + 1]
lea ecx, [rdx + 2]
imul ecx, eax
mov eax, 0x2aaaaaab
imul ecx, edx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, r9d
jne 0x140044a1a
mov r9d, edi
mov eax, edi
mov edx, 2
sub edx, edi
lea ecx, [rax + r9]
lea r9d, [rax]
mov eax, ecx
jns 0x140044a07
mov dword [0x1401a3d80], ecx
mov byte [0x1401a5895], dil
mov rax, r8
mov rcx, qword [rbp + 0xde80]
xor rcx, rsp
call fcn.1400bb0d0
lea r11, [rsp + 0xdf90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140044a48
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 8], rax
mov r9d, dword [0x1401a3d80]
xor edi, edi
lea eax, [r9 + 1]
lea ecx, [r9 + 2]
imul ecx, eax
mov eax, 0x30c30c31
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 8
jne 0x140044ac3
mov r8d, edi
test r9d, r9d
je 0x140044ab9
mov eax, r9d
mov ecx, r9d
cdq
and ecx, 1
sub eax, edx
add r8d, ecx
sar eax, 1
mov r9d, eax
jne 0x140044aa3
mov r9d, r8d
mov dword [0x1401a3d80], r8d
cmp byte [0x1401a58bc], dil
je 0x140044ad8
lea rax, [0x14019f5c0]
jmp 0x140044bd5
mov ecx, r9d
mov eax, 0x2aaaaaab
mov dword [rbp - 0x30], 0xc0015
mov dword [rbp - 0x2c], 0x19001c
mov dword [rbp - 0x28], 0x1b
mov dword [rbp - 0x24], 0x5c000b
imul ecx, r9d
imul ecx
sar edx, 2
mov dword [rbp - 0x20], 0x450054
mov dword [rbp - 0x1c], 0x56005e
mov eax, edx
mov dword [rbp - 0x18], 0x53005a
mov dword [rbp - 0x14], 0x54005e
shr eax, 0x1f
mov word [rbp - 0x10], di
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0xe
jne 0x140044b62
mov ecx, 4
call fcn.1400bb888
mov rbx, rax
call fcn.1400bba88
mov rcx, rbx
mov dword [rbx], eax
mov dword [0x1401a3d80], eax
call fcn.1400bb0b4
mov r9d, dword [0x1401a3d80]
lea rbx, [0x14019f5c0]
lea rax, [0x14019ed90]
movzx ecx, byte [rdi + rax]
xor cx, word [rbp + rdi*2 - 0x30]
mov word [rbx + rdi*2], cx
inc rdi
cmp rdi, 0x10
jl 0x140044b69
lea r8d, [r9 + 2]
lea ecx, [r9 + 1]
mov eax, 0x30c30c31
imul r8d, ecx
imul r8d, r9d
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 8
jne 0x140044bcb
call fcn.1400bba88
mov ecx, dword [0x1401a3d80]
cmp ecx, eax
jne 0x140044bcb
dec ecx
mov dword [0x1401a3d80], ecx
mov byte [0x1401a58bc], 1
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bb0d0
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret

Function at 0x140044bf4
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
cmp byte [0x1401a58b6], al
je 0x140044c1e
lea rax, [0x14019fc48]
jmp 0x140044c89
mov dword [rbp - 0x30], 0x4000a
mov r8d, 0xf
mov dword [rbp - 0x2c], 0xd000f
mov dword [rbp - 0x28], 0x4f0017
mov dword [rbp - 0x24], 0x7000b
mov dword [rbp - 0x20], 0x100019
mov dword [rbp - 0x1c], 0x150050
mov dword [rbp - 0x18], 0xf0011
mov dword [rbp - 0x14], 0x16
lea rdx, [0x14019fc48]
lea rcx, [0x14019ed90]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x30]
mov word [rdx + rax*2], cx
inc rax
cmp rax, r8
jl 0x140044c63
mov byte [0x1401a58b6], 1
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400bb0d0
add rsp, 0x30
pop rbp
ret
Function at 0x140044c9c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
cmp byte [0x1401a58ba], bl
je 0x140044cd2
lea rax, [0x14019fbd0]
jmp 0x140044dc8
mov r8d, dword [0x1401a3d80]
mov eax, 0x30c30c31
mov edi, 1
mov ecx, r8d
mov dword [rbp - 0x40], 0x80000
mov dword [rbp - 0x3c], 0x1e0000
mov dword [rbp - 0x38], 0xe0052
mov dword [rbp - 0x34], 0xa0009
mov dword [rbp - 0x30], 0x16001b
imul ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 2
mov dword [rbp - 0x2c], 0x90050
mov dword [rbp - 0x28], 0x170001
mov eax, edx
mov dword [rbp - 0x24], 0xb0050
lea r9d, [rdi + 3]
shr eax, 0x1f
mov dword [rbp - 0x20], 0x460004
mov dword [rbp - 0x1c], 0xe
add edx, eax
mov dword [rbp - 0x18], 0x1c0000
mov dword [rbp - 0x14], 0x1d0010
mov word [rbp - 0x10], bx
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 5
jne 0x140044d9d
mov eax, 0x51eb851f
imul r8d
mov eax, r9d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x63
movsxd rcx, r8d
mul rcx
lea rcx, [rdi - 2]
cmovo rax, rcx
mov rcx, rax
call fcn.1400ba748
mov rcx, rax
call fcn.1400bc20c
lea rax, [0x14019fbd0]
lea rcx, [0x14019ed90]
movzx ecx, byte [rbx + rcx]
xor cx, word [rbp + rbx*2 - 0x40]
mov word [rax + rbx*2], cx
add rbx, rdi
cmp rbx, 0x18
jl 0x140044da4
mov byte [0x1401a58ba], dil
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bb0d0
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret

Function at 0x140044de4
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp - 8], rax
xor ecx, ecx
cmp byte [0x1401a589c], cl
je 0x140044e11
lea rax, [0x14019fae0]
jmp 0x140044eb8
mov dword [rbp - 0x30], 0xc0031
mov dword [rbp - 0x2c], 0xe000f
mov dword [rbp - 0x28], 0x1d0022
mov dword [rbp - 0x24], 0x5000a
mov dword [rbp - 0x20], 0x60011
mov dword [rbp - 0x1c], 0x2b0003
mov dword [rbp - 0x18], 0xe0011
mov dword [rbp - 0x14], 0x16001f
mov dword [rbp - 0x10], 0x5c001b
mov dword [rbp - 0xc], 0x43
lea r9, [0x14019fae0]
lea rax, [0x14019ed90]
movzx eax, byte [rcx + rax]
xor ax, word [rbp + rcx*2 - 0x30]
mov word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x13
jl 0x140044e5e
mov r8d, dword [0x1401a3d80]
mov eax, 0x66666667
mov byte [0x1401a589c], 1
imul r8d, r8d
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
shl ecx, 2
sub r8d, ecx
cmp r8d, 0x13
jne 0x140044eb5
inc dword [0x1401a521c]
mov rax, r9
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bb0d0
add rsp, 0x30
pop rbp
ret