joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140058d30
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.140056bb0
cmp byte [0x1401d89c4], 0
je 0x140058d6e
lea rax, [0x1401d2a60]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x60
pop rbp
ret
mov eax, dword [0x1401d6d80]
xor r8d, r8d
mov dword [rbp - 0x40], 0x70029
lea ecx, [rax + 1]
mov dword [rbp - 0x3c], 8
mov dword [rbp - 0x38], 0x6001b
mov dword [rbp - 0x34], 0x15003f
mov dword [rbp - 0x30], 5
mov dword [rbp - 0x2c], 0xc001b
imul ecx, eax
mov eax, 0x66666667
mov dword [rbp - 0x28], 0x70020
mov dword [rbp - 0x24], 0x170013
mov dword [rbp - 0x20], 0xc000f
mov dword [rbp - 0x1c], 0x41004a
mov word [rbp - 0x18], r8w
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 9
jne 0x140058dec
inc dword [0x1401d85e0]
lea rax, [0x1401d2a60]
lea r9, [0x1401d1da1]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 5
xor cx, word [rbp + r8*2 - 0x4a]
mov word [rax + r8*2 - 0xa], cx
movzx ecx, byte [r8 + r9 - 5]
xor dx, cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 8], dx
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x14
jl 0x140058e00
mov byte [0x1401d89c4], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x60
pop rbp
ret

Function at 0x140058e80
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401d89b6], 0
lea rax, [0x1401d2b48]
jne 0x140058f7e
mov dword [rbp - 0x40], 0x10024
mov dword [rbp - 0x3c], 0xd002c
mov dword [rbp - 0x38], 0xc0003
mov dword [rbp - 0x34], 0x11000e
mov dword [rbp - 0x30], 0xa001c
mov dword [rbp - 0x2c], 0x39
xor r8d, r8d
mov dword [rbp - 0x28], 0x1b0006
mov dword [rbp - 0x24], 0x130014
mov dword [rbp - 0x20], 0x250002
mov dword [rbp - 0x1c], 0xc0015
mov dword [rbp - 0x18], 0x1b001e
mov dword [rbp - 0x14], 0x5f0017
mov dword [rbp - 0x10], 0x4f
lea r9, [0x1401d1da1]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 5
xor cx, word [rbp + r8*2 - 0x4a]
mov word [rax + r8*2 - 0xa], cx
movzx ecx, byte [r8 + r9 - 5]
xor dx, cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 8], dx
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x19
jl 0x140058f10
mov byte [0x1401d89b6], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x40
pop rbp
ret
Function at 0x1400590d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, dword [0x1401d6d80]
mov edi, 4
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x2aaaaaab
imul r8d, ecx
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub r8d, eax
cmp r8d, 5
jne 0x14005915a
mov ecx, edi
mov qword [rsp + 0x80], rbx
call fcn.1400d55c0
mov rbx, rax
call fcn.1400d57c0
mov rcx, rbx
mov dword [rbx], eax
mov dword [0x1401d6d80], eax
call fcn.1400d4de0
mov ecx, dword [0x1401d6d80]
mov rbx, qword [rsp + 0x80]
cmp byte [0x1401d89df], 0
je 0x14005916f
lea rax, [0x1401d2670]
jmp 0x1400592dc
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
xor r9d, r9d
mov dword [rbp - 0x50], 0x1a0026
mov dword [rbp - 0x4c], 0xa0002
mov dword [rbp - 0x48], 0x13001a
imul r8d, eax
imul r8d, ecx
mov eax, 0x66666667
mov dword [rbp - 0x44], 0x2003d
mov dword [rbp - 0x40], 0x190001
mov dword [rbp - 0x3c], 0x50006
mov dword [rbp - 0x38], 0x80011
mov dword [rbp - 0x34], 0x240004
imul r8d
sar edx, 3
mov dword [rbp - 0x30], 0x4000f
mov dword [rbp - 0x2c], 0x40005
mov eax, edx
mov dword [rbp - 0x28], 0xf0051
mov dword [rbp - 0x24], 0xc000f
shr eax, 0x1f
mov dword [rbp - 0x20], 0xe0003
mov dword [rbp - 0x1c], 0x4f0001
add edx, eax
mov word [rbp - 0x18], r9w
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 7
jne 0x14005926a
mov eax, 0x63e7063f
mov r8d, r9d
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
imul edx, edx, 0x29
sub eax, edx
cmp eax, 0x73
je 0x140059263
nop dword [rax]
mov eax, ecx
inc r8d
or eax, 0xffffff25
add ecx, eax
mov eax, ecx
imul eax, ecx
cmp r8d, eax
jg 0x140059263
mov eax, 0x63e7063f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
imul edx, edx, 0x29
sub eax, edx
cmp eax, 0x73
jne 0x140059230
mov dword [0x1401d6d80], r8d
lea rdx, [0x1401d2670]
lea r8, [0x1401d1da1]
nop dword [rax + rax]
movzx eax, byte [r9 + r8 - 1]
movzx ecx, word [rbp + r9*2 - 0x4e]
xor ax, word [rbp + r9*2 - 0x50]
mov word [rdx + r9*2], ax
movzx eax, byte [r9 + r8]
xor cx, ax
mov word [rdx + r9*2 + 2], cx
movzx ecx, byte [r9 + r8 + 1]
xor cx, word [rbp + r9*2 - 0x4c]
mov word [rdx + r9*2 + 4], cx
movzx ecx, byte [r9 + r8 + 2]
xor cx, word [rbp + r9*2 - 0x4a]
mov word [rdx + r9*2 + 6], cx
add r9, rdi
cmp r9, 0x1c
jl 0x140059280
mov byte [0x1401d89df], 1
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d4e00
mov rdi, qword [rsp + 0x88]
add rsp, 0x70
pop rbp
ret
Function at 0x140059300
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rsp + 0x20], rax
cmp byte [0x1401d89b1], 0
je 0x140059335
lea rax, [0x1401d2400]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x38
ret
xor r8d, r8d
mov dword [rsp], 0x31004c
mov dword [rsp + 4], 0xd0001
mov dword [rsp + 8], 0x60039
mov dword [rsp + 0xc], 0x3001f
mov dword [rsp + 0x10], 1
mov word [rsp + 0x18], r8w
mov dword [rsp + 0x14], 0x540001
lea rdx, [0x1401d2400]
lea r9, [0x1401d1da1]
nop dword [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 2]
add r8, 6
xor ax, word [rsp + r8*2 - 0xc]
mov word [rdx + r8*2 - 0xc], ax
movzx eax, byte [r8 + r9 - 6]
xor cx, ax
movzx eax, byte [r8 + r9 - 5]
xor ax, word [rsp + r8*2 - 8]
mov word [rdx + r8*2 - 0xa], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rdx + r8*2 - 8], ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rsp + r8*2 - 6]
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 2], cx
cmp r8, 0xc
jl 0x140059380
mov byte [0x1401d89b1], 1
mov rax, rdx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x38
ret

Function at 0x140059420
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r8d, dword [0x1401d6d80]
mov eax, 0x2aaaaaab
mov ebx, 4
mov ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 2
jne 0x1400594a5
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ebx
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x63
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400d4448
mov rcx, rax
call fcn.1400d5528
cmp byte [0x1401d89bc], 0
lea rax, [0x1401d27c8]
jne 0x14005951f
mov dword [rsp + 0x20], 0x30004
mov dword [rsp + 0x24], 0x3e001d
mov dword [rsp + 0x28], 0x17001c
mov dword [rsp + 0x2c], 0x2f0009
mov dword [rsp + 0x30], 0x17000d
mov dword [rsp + 0x34], 0xc000c
mov dword [rsp + 0x38], 0x1b0004
mov qword [rsp + 0x3c], 0x1d0008
xor ecx, ecx
lea r8, [0x1401d1da0]
nop
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 + 0x1e]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x11
jl 0x140059500
mov byte [0x1401d89bc], 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x50
pop rbx
ret
Function at 0x140059540
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401d89d6], 0
je 0x140059570
lea rax, [0x1401d2708]
jmp 0x140059690
xor r9d, r9d
mov dword [rbp - 0x40], 0x30004
mov dword [rbp - 0x3c], 0x3e001d
mov dword [rbp - 0x38], 0xd001a
mov dword [rbp - 0x34], 0x80008
mov dword [rbp - 0x30], 0xa0018
mov word [rbp - 0x10], r9w
mov edx, r9d
mov dword [rbp - 0x2c], 0x1d000c
mov dword [rbp - 0x28], 0xb0011
mov dword [rbp - 0x24], 0x17003e
mov dword [rbp - 0x20], 0xb0016
mov dword [rbp - 0x1c], 0x110015
mov dword [rbp - 0x18], 5
mov dword [rbp - 0x14], 0xb0001
lea rbx, [0x1401d2708]
lea r8, [0x1401d1da1]
nop dword [rax]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rbp + rdx*2 - 0x3e]
add rdx, 6
xor ax, word [rbp + rdx*2 - 0x4c]
mov word [rbx + rdx*2 - 0xc], ax
movzx eax, byte [rdx + r8 - 6]
xor cx, ax
movzx eax, byte [rdx + r8 - 5]
xor ax, word [rbp + rdx*2 - 0x48]
mov word [rbx + rdx*2 - 0xa], cx
mov word [rbx + rdx*2 - 8], ax
movzx eax, byte [rdx + r8 - 4]
xor ax, word [rbp + rdx*2 - 0x46]
mov word [rbx + rdx*2 - 6], ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rbp + rdx*2 - 0x44]
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rbp + rdx*2 - 0x42]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0x18
jl 0x1400595e0
mov eax, dword [0x1401d6d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0x12
jne 0x140059686
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r9
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov byte [0x1401d89d6], 1
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d4e00
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1400596b0
Capabilities:
Get disk size

Disassembly:
sub rsp, 0xa48
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rsp + 0xa30], rax
mov r9d, dword [0x1401d6d80]
mov eax, 0x38e38e39
mov ecx, r9d
imul ecx, r9d
imul ecx, r9d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub ecx, eax
cmp ecx, 4
jne 0x140059715
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov r9d, dword [0x1401d6d80]
lea eax, [r9 + 1]
lea ecx, [r9 + 2]
imul ecx, eax
mov eax, 0x66666667
imul ecx, r9d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 7
jne 0x140059762
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov r9d, dword [0x1401d6d80]
cmp byte [0x1401d89b4], 0
jne 0x14005989a
lea ecx, [r9 + 1]
mov eax, 0x92492493
imul ecx, r9d
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 0xa
jne 0x140059834
mov qword [rsp + 0xa50], rbx
mov qword [rsp + 0xa58], rsi
mov qword [rsp + 0xa40], rdi
xor edi, edi
lea rsi, [rsp + 0x30]
nop word [rax + rax]
xor r10d, r10d
lea ecx, [rdi + 1]
mov eax, r9d
lea ebx, [r10 + 1]
cdq
idiv ecx
mov eax, r9d
mov ecx, r9d
sub ecx, edi
mov r8d, edx
cdq
idiv ebx
imul r8d, ecx
lea rcx, [0x14015e0bc]
add r8d, eax
sub r8d, r10d
mov edx, r8d
call fcn.1400d5714
add rsi, 4
mov r10d, ebx
cmp ebx, 0x14
jge 0x14005980c
mov r9d, dword [0x1401d6d80]
jmp 0x1400597c3
inc edi
cmp edi, 0x20
jge 0x14005981c
mov r9d, dword [0x1401d6d80]
jmp 0x1400597c0
mov rsi, qword [rsp + 0xa58]
mov rbx, qword [rsp + 0xa50]
mov rdi, qword [rsp + 0xa40]
movzx eax, byte [0x1401d1da0]
mov byte [0x1401d89b4], 1
xor al, 0x4c
movzx eax, al
mov word [0x1401d2ad8], ax
movzx eax, byte [0x1401d1da1]
xor al, 5
movzx eax, al
mov word [0x1401d2ada], ax
movzx eax, byte [0x1401d1da2]
xor al, 0x1d
movzx eax, al
mov word [0x1401d2adc], ax
movzx eax, byte [0x1401d1da3]
xor al, 0x53
movzx eax, al
mov word [0x1401d2ade], ax
movzx eax, byte [0x1401d1da4]
xor al, 0x52
movzx eax, al
mov word [0x1401d2ae0], ax
lea rax, [0x1401d2ad8]
mov rcx, qword [rsp + 0xa30]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0xa48
ret
Function at 0x1400598c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401d89bd], 0
je 0x1400598f3
lea rax, [0x1401d2350]
jmp 0x140059b33
mov r8d, dword [0x1401d6d80]
mov qword [rsp + 0x90], rbx
xor ebx, ebx
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
mov dword [rbp - 0x60], 0x7000f
mov dword [rbp - 0x5c], 0xe001f
mov dword [rbp - 0x58], 0x3c001d
mov dword [rbp - 0x54], 0x1f000e
imul ecx, eax
imul ecx, r8d
mov eax, 0x66666667
mov dword [rbp - 0x50], 0x20005
mov dword [rbp - 0x4c], 0x7001a
mov dword [rbp - 0x48], 0xc001d
mov dword [rbp - 0x44], 0x60000
mov dword [rbp - 0x40], 0x60007
imul ecx
sar edx, 3
mov dword [rbp - 0x3c], 0x3e0017
mov dword [rbp - 0x38], 0x50015
mov eax, edx
mov dword [rbp - 0x34], 0x3a0002
mov dword [rbp - 0x30], 0xe001d
shr eax, 0x1f
mov dword [rbp - 0x2c], 0x60002
mov dword [rbp - 0x28], 0x17001d
add edx, eax
mov dword [rbp - 0x24], 0x1e0015
mov word [rbp - 0x20], bx
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 7
jne 0x140059a4a
mov edx, ebx
nop dword [rax + rax]
mov ecx, edx
mov eax, edx
inc edx
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, r8d
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, r8d
xor eax, ecx
mov ecx, eax
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, r8d
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, r8d
xor eax, ecx
mov ecx, eax
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, r8d
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, r8d
xor eax, ecx
mov ecx, eax
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, r8d
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, r8d
xor eax, ecx
add r8d, eax
cmp edx, 0x100
jl 0x1400599b0
mov dword [0x1401d6d80], r8d
mov rdx, rbx
lea rdi, [0x1401d2350]
lea r9, [0x1401d1da1]
nop dword [rax + rax]
movzx eax, byte [rdx + r9 - 1]
movzx ecx, word [rbp + rdx*2 - 0x5e]
add rdx, 4
xor ax, word [rbp + rdx*2 - 0x68]
mov word [rdi + rdx*2 - 8], ax
movzx eax, byte [rdx + r9 - 4]
xor cx, ax
movzx eax, byte [rdx + r9 - 3]
xor ax, word [rbp + rdx*2 - 0x64]
mov word [rdi + rdx*2 - 6], cx
mov word [rdi + rdx*2 - 4], ax
movzx eax, byte [rdx + r9 - 2]
xor ax, word [rbp + rdx*2 - 0x62]
mov word [rdi + rdx*2 - 2], ax
cmp rdx, 0x20
jl 0x140059a60
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 7
jne 0x140059b21
mov ecx, 0x28
mov qword [rsp + 0x98], rsi
call fcn.1400d4448
mov rsi, rax
nop dword [rax]
call fcn.1400d57c0
inc rbx
add eax, dword [0x1401d6d80]
mov dword [rsi + rbx*4 - 4], eax
cmp rbx, 0xa
jl 0x140059af0
mov ecx, dword [rsi + 0x24]
mov dword [0x1401d6d80], ecx
mov rcx, rsi
call fcn.1400d5528
mov rsi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov byte [0x1401d89bd], 1
mov rax, rdi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d4e00
mov rdi, qword [rsp + 0xa0]
add rsp, 0x80
pop rbp
ret
Function at 0x140059b50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x108
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov ecx, dword [0x1401d6d80]
mov eax, 0x2aaaaaab
lea r8d, [rcx + 1]
imul r8d, ecx
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub r8d, eax
cmp r8d, 5
jne 0x140059ba8
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov ecx, dword [0x1401d6d80]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x55555556
imul r8d, ecx
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub r8d, eax
cmp r8d, 2
jne 0x140059c17
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub ecx, edx
add ecx, 0x63
movsxd rdx, ecx
mov rcx, 0xffffffffffffffff
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.1400d4448
mov rcx, rax
call fcn.1400d5528
mov ecx, dword [0x1401d6d80]
cmp byte [0x1401d89b9], 0
mov qword [rsp + 0x100], r14
je 0x140059c34
lea rax, [0x1401d2ae8]
jmp 0x140059df2
mov qword [rsp + 0x118], rbp
xor ebp, ebp
mov dword [rsp + 0xd0], 0x70029
mov dword [rsp + 0xd4], 8
mov dword [rsp + 0xd8], 0x6001b
mov dword [rsp + 0xdc], 0x180039
mov r8d, ebp
mov dword [rsp + 0xe0], 0xa001a
mov dword [rsp + 0xe4], 0xd000e
mov dword [rsp + 0xe8], 0x170031
mov dword [rsp + 0xec], 0x5b
lea r14, [0x1401d2ae8]
lea r9, [0x1401d1da1]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx edx, word [rsp + r8*2 + 0xd2]
add r8, 5
xor ax, word [rsp + r8*2 + 0xc6]
mov word [r14 + r8*2 - 0xa], ax
movzx eax, byte [r8 + r9 - 5]
xor dx, ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rsp + r8*2 + 0xca]
mov word [r14 + r8*2 - 8], dx
mov word [r14 + r8*2 - 6], ax
movzx eax, byte [r8 + r9 - 3]
xor ax, word [rsp + r8*2 + 0xcc]
mov word [r14 + r8*2 - 4], ax
movzx eax, byte [r8 + r9 - 2]
xor ax, word [rsp + r8*2 + 0xce]
mov word [r14 + r8*2 - 2], ax
cmp r8, 0xf
jl 0x140059cb0
lea eax, [rcx + 1]
imul eax, ecx
and eax, 0x8000000f
jge 0x140059d3a
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 0xb
jne 0x140059de0
mov qword [rsp + 0x110], rbx
mov qword [rsp + 0x120], rsi
mov qword [rsp + 0x128], rdi
mov edi, ebp
lea rsi, [rsp + 0x20]
mov r10d, ebp
nop word [rax + rax]
mov eax, ecx
lea r8d, [rdi + 1]
lea ebx, [r10 + 1]
cdq
idiv r8d
mov eax, ecx
mov r8d, ecx
sub r8d, edi
lea rcx, [0x14015e0cc]
mov r9d, edx
cdq
idiv ebx
imul r9d, r8d
add r9d, eax
sub r9d, r10d
mov edx, r9d
call fcn.1400d5714
add rsi, 4
mov r10d, ebx
cmp ebx, 0x11
jge 0x140059db9
mov ecx, dword [0x1401d6d80]
jmp 0x140059d70
inc edi
cmp edi, 2
jge 0x140059dc8
mov ecx, dword [0x1401d6d80]
jmp 0x140059d62
mov rsi, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x110]
mov rdi, qword [rsp + 0x128]
mov rbp, qword [rsp + 0x118]
mov byte [0x1401d89b9], 1
mov rax, r14
mov r14, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x108
ret
Function at 0x140059e20
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rsp + 0x40], rax
cmp byte [0x1401d89af], 0
je 0x140059e58
lea rax, [0x1401d2bf8]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x50
pop rbx
ret
call fcn.140056d20
test al, al
jne 0x140059e67
dec dword [0x1401d850c]
mov ecx, dword [0x1401d6d80]
xor r9d, r9d
mov dword [rsp + 0x20], 0x180003
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
mov dword [rsp + 0x24], 0x6000c
mov dword [rsp + 0x28], 0x43000a
mov dword [rsp + 0x2c], 0x2001d
mov dword [rsp + 0x30], 0xc0007
imul r8d, eax
imul r8d, ecx
mov eax, 0x78787879
mov dword [rsp + 0x34], 0x7004f
mov dword [rsp + 0x38], 0x20015
mov dword [rsp + 0x3c], 4
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub r8d, edx
cmp r8d, 0xe
jne 0x140059f47
test ecx, ecx
je 0x140059f47
mov eax, ecx
and eax, 0x80000001
jge 0x140059ef1
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x140059f06
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov dword [0x1401d6d80], eax
jmp 0x140059f13
lea ecx, [rcx*2 + 1]
mov dword [0x1401d6d80], ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov edx, ecx
sub edx, eax
je 0x140059f35
sub edx, 2
je 0x140059f38
dec edx
je 0x140059f3a
jmp 0x140059f43
add ecx, 2
inc ecx
add ecx, 2
mov dword [0x1401d6d80], ecx
test ecx, ecx
jne 0x140059ee1
lea rbx, [0x1401d2bf8]
lea rdx, [0x1401d1da1]
nop word [rax + rax]
movzx eax, byte [r9 + rdx - 1]
movzx ecx, word [rsp + r9*2 + 0x22]
add r9, 5
xor ax, word [rsp + r9*2 + 0x16]
mov word [rbx + r9*2 - 0xa], ax
movzx eax, byte [r9 + rdx - 5]
xor cx, ax
movzx eax, byte [r9 + rdx - 4]
xor ax, word [rsp + r9*2 + 0x1a]
mov word [rbx + r9*2 - 8], cx
mov word [rbx + r9*2 - 6], ax
movzx eax, byte [r9 + rdx - 3]
xor ax, word [rsp + r9*2 + 0x1c]
mov word [rbx + r9*2 - 4], ax
movzx eax, byte [r9 + rdx - 2]
xor ax, word [rsp + r9*2 + 0x1e]
mov word [rbx + r9*2 - 2], ax
cmp r9, 0xf
jl 0x140059f60
mov byte [0x1401d89af], 1
call fcn.140056dd0
test al, al
jne 0x140059ffe
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0xcccccccd
mul r8d
shr edx, 6
lea ecx, [rdx + rdx*4]
shl ecx, 4
sub r8d, ecx
inc r8d
mov dword [0x1401d6d80], r8d
mov rax, rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x50
pop rbx
ret
Function at 0x14005a3a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x17630]
mov eax, 0x17730
call fcn.1400d9eb0
sub rsp, rax
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rbp + 0x17620], rax
mov r8d, dword [0x1401d6d80]
mov eax, 0xb21642c9
lea ecx, [r8 + 1]
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [0x1401d8508]
imul edx, edx, 0x17
sub ecx, edx
mov edx, 0x143ba90e
cmp ecx, 4
cmove eax, edx
cmp byte [0x1401d89bf], 0
mov dword [0x1401d8508], eax
je 0x14005a41b
lea rax, [0x1401d26d0]
jmp 0x14005a5bf
mov ecx, r8d
mov eax, 0x2aaaaaab
mov qword [rsp + 0x17740], rbx
xor ebx, ebx
mov dword [rsp + 0x20], 0x140009
mov dword [rsp + 0x24], 0x150003
imul ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 1
mov dword [rsp + 0x28], 0x2004f
mov dword [rsp + 0x2c], 0x1c0001
mov eax, edx
mov dword [rsp + 0x30], 0xc0007
mov dword [rsp + 0x34], 0x8004f
shr eax, 0x1f
mov dword [rsp + 0x38], 0xc0017
mov dword [rsp + 0x3c], 0x10004
add edx, eax
mov dword [rsp + 0x40], 0x48001d
mov dword [rsp + 0x44], 0x40014
lea eax, [rdx + rdx*2]
mov dword [rsp + 0x48], 0x1f
mov dword [rsp + 0x4c], 0x1000b
shl eax, 2
mov word [rsp + 0x50], bx
sub ecx, eax
cmp ecx, 0xa
jne 0x14005a52d
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x176b0
mov word [rsp + 0x60], bx
call fcn.1400da240
mov r10d, ebx
mov r9d, ebx
nop
mov rax, rbx
test r10, r10
je 0x14005a502
test rax, rax
je 0x14005a502
lea rcx, [r9 + rax]
lea r8, [rsp + 0x60]
lea r8, [r8 + rcx*2]
lea rcx, [r9 + rax]
movzx edx, word [rbp + rcx*2 - 0x256]
inc dx
add dx, word [r8 - 2]
mov word [r8], dx
inc rax
cmp rax, 0xdb
jl 0x14005a4d3
add r9, 0xdb
inc r10
cmp r9, 0xbb59
jl 0x14005a4d0
movsx eax, word [rbp + 0x17610]
mov dword [0x1401d6d80], eax
lea rdx, [0x1401d26d0]
lea r8, [0x1401d1da1]
nop dword [rax + rax]
movzx eax, byte [rbx + r8 - 1]
movzx ecx, word [rsp + rbx*2 + 0x22]
add rbx, 6
xor ax, word [rsp + rbx*2 + 0x14]
mov word [rdx + rbx*2 - 0xc], ax
movzx eax, byte [rbx + r8 - 6]
xor cx, ax
movzx eax, byte [rbx + r8 - 5]
xor ax, word [rsp + rbx*2 + 0x18]
mov word [rdx + rbx*2 - 0xa], cx
movzx ecx, byte [rbx + r8 - 3]
xor cx, word [rsp + rbx*2 + 0x1c]
mov word [rdx + rbx*2 - 8], ax
movzx eax, byte [rbx + r8 - 4]
xor ax, word [rsp + rbx*2 + 0x1a]
mov word [rdx + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor cx, word [rsp + rbx*2 + 0x1e]
mov word [rdx + rbx*2 - 6], ax
mov word [rdx + rbx*2 - 2], cx
cmp rbx, 0x18
jl 0x14005a540
mov rbx, qword [rsp + 0x17740]
mov byte [0x1401d89bf], 1
mov rax, rdx
mov rcx, qword [rbp + 0x17620]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x17730
pop rbp
ret