joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140043a34
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401a2e90]
xor rax, rsp
mov qword [rbp - 8], rax
mov ecx, dword [0x1401aad80]
mov r14d, 1
lea eax, [rcx + 1]
imul eax, ecx
and eax, 0x80000007
jge 0x140043a83
sub eax, r14d
or eax, 0xfffffff8
add eax, r14d
xor ebx, ebx
lea r12d, [rbx + 7]
lea r15d, [rbx + 3]
cmp eax, r12d
jne 0x140043adc
mov eax, ecx
lea r10d, [r15 + 0x7d]
mov r8d, ebx
cdq
sub eax, edx
sar eax, 1
mov esi, eax
test esi, esi
jle 0x140043ad4
mov eax, ecx
mov r9d, ebx
mov rdi, rsi
cdq
and edx, r15d
add eax, edx
sar eax, 2
test eax, eax
jle 0x140043acc
mov edx, r9d
mov r11d, eax
add r10d, edx
sub edx, r14d
sub r11, r14
jne 0x140043ac1
add r9d, r8d
sub rdi, r14
jne 0x140043ab7
add r8d, r14d
cmp r8d, r10d
jl 0x140043aa2
imul ecx, ecx
mov eax, 0x78787879
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, r15d
jne 0x140043b12
call fcn.1400be2e0
mov ecx, dword [0x1401aad80]
cmp ecx, eax
jne 0x140043b12
sub ecx, r14d
mov dword [0x1401aad80], ecx
cmp byte [0x1401acf44], bl
lea rax, [0x1401a6b58]
jne 0x140043b8c
mov dword [rbp - 0x30], 0x1c0002
mov dword [rbp - 0x2c], 0x150036
mov dword [rbp - 0x28], 0x10003
mov dword [rbp - 0x24], 0x80018
mov dword [rbp - 0x20], 0xc000e
mov dword [rbp - 0x1c], 0x80036
mov dword [rbp - 0x18], 0x120000
mov edx, 0x12
mov dword [rbp - 0x14], 0xa000f
mov dword [rbp - 0x10], 0x2a0007
mov word [rbp - 0xc], bx
lea rcx, [0x1401a5da0]
movzx ecx, byte [rbx + rcx]
xor cx, word [rbp + rbx*2 - 0x30]
mov word [rax + rbx*2], cx
add rbx, r14
cmp rbx, rdx
jl 0x140043b69
mov byte [0x1401acf44], r14b
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bd920
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140043bb8
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
mov rax, qword [0x1401a2e90]
xor rax, rsp
mov qword [rsp + 8], rax
xor r8d, r8d
cmp byte [0x1401acf50], r8b
je 0x140043be3
lea rax, [0x1401a6ab0]
jmp 0x140043c71
mov eax, dword [0x1401aad80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 2
jne 0x140043c35
lea eax, [rcx + 0x29]
mov r9d, 0xf3
test r9d, r9d
je 0x140043c2c
cdq
mov ecx, r9d
idiv r9d
mov eax, ecx
mov r9d, edx
test ecx, ecx
jne 0x140043c17
add eax, r9d
mov dword [0x1401aad80], eax
mov dword [rsp], 0x5a0039
mov dword [rsp + 4], 0x31
lea rax, [0x1401a6ab0]
lea rcx, [0x1401a5da0]
movzx ecx, byte [r8 + rcx]
xor cx, word [rsp + r8*2]
mov word [rax + r8*2], cx
inc r8
cmp r8, 3
jl 0x140043c4b
mov byte [0x1401acf50], 1
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1400bd920
add rsp, 0x18
ret
Function at 0x140043c84
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401a2e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r8d, dword [0x1401aad80]
mov edi, 4
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
lea ebx, [rdi - 1]
imul ecx, eax
mov eax, 0x78787879
imul ecx, r8d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, ebx
jne 0x140043d18
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, edi
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x63
movsxd rcx, r8d
mul rcx
lea rcx, [rdi - 5]
cmovo rax, rcx
mov rcx, rax
call fcn.1400bcf98
mov rcx, rax
call fcn.1400be048
xor eax, eax
cmp byte [0x1401acf34], al
je 0x140043d2e
lea rax, [0x1401a6bb0]
jmp 0x140043db3
mov r10d, 0x17
mov dword [rbp - 0x40], 0x150002
mov dword [rbp - 0x3c], 0x170007
mov dword [rbp - 0x38], 0x150046
mov dword [rbp - 0x34], 0xf0002
mov dword [rbp - 0x30], 0x420005
lea r9d, [r10 - 0x16]
mov dword [rbp - 0x2c], 0x1e000a
mov dword [rbp - 0x28], 0x1001a
mov dword [rbp - 0x24], 0x30004
mov dword [rbp - 0x20], 0x380016
mov dword [rbp - 0x1c], 0x16001e
mov qword [rbp - 0x18], 0x1e0014
lea rdx, [0x1401a6bb0]
lea rcx, [0x1401a5da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x40]
mov word [rdx + rax*2], cx
add rax, r9
cmp rax, r10
jl 0x140043d8d
mov byte [0x1401acf34], r9b
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400bd920
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret

Function at 0x140043dd0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x1401a2e90]
xor rax, rsp
mov qword [rbp - 8], rax
xor eax, eax
cmp byte [0x1401acf33], al
je 0x140043dfa
lea rax, [0x1401a6758]
jmp 0x140043e64
mov dword [rbp - 0x30], 0x2000f
mov dword [rbp - 0x2c], 0x3c0019
mov dword [rbp - 0x28], 0x3000f
mov dword [rbp - 0x24], 0x3e0008
mov dword [rbp - 0x20], 0xb0015
mov dword [rbp - 0x1c], 0xe0004
mov dword [rbp - 0x18], 0x1c000c
mov dword [rbp - 0x14], 0x190014
mov word [rbp - 0x10], ax
lea rdx, [0x1401a6758]
lea rcx, [0x1401a5da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x30]
mov word [rdx + rax*2], cx
inc rax
cmp rax, 0x10
jl 0x140043e3d
mov byte [0x1401acf33], 1
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bd920
add rsp, 0x30
pop rbp
ret
Function at 0x140043e78
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401a2e90]
xor rax, rsp
mov qword [rbp - 8], rax
mov ecx, dword [0x1401aad80]
mov eax, 0x38e38e39
mov r10d, 2
imul ecx, ecx
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
mov edx, 0x152bc4bb
sub ecx, eax
mov eax, dword [0x1401ac930]
cmp ecx, r10d
cmove eax, edx
mov dword [0x1401ac930], eax
xor eax, eax
cmp byte [0x1401acf18], al
je 0x140043ee0
lea rax, [0x1401a6a68]
jmp 0x140043f6f
mov r9d, 1
mov dword [rbp - 0x40], 0x4002e
mov dword [rbp - 0x3c], 0xd000c
mov dword [rbp - 0x38], 0x10036
mov dword [rbp - 0x34], 0x20004
mov dword [rbp - 0x30], 0x110004
lea r10d, [r9 + 0x17]
mov dword [rbp - 0x2c], 0x3f001a
mov dword [rbp - 0x28], 0x180007
mov dword [rbp - 0x24], 0x30004
mov dword [rbp - 0x20], 0x130042
mov dword [rbp - 0x1c], 0x1b0010
mov dword [rbp - 0x18], 0x17000d
mov dword [rbp - 0x14], 0x470001
mov word [rbp - 0x10], ax
lea rdx, [0x1401a6a68]
lea rcx, [0x1401a5da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x40]
mov word [rdx + rax*2], cx
add rax, r9
cmp rax, r10
jl 0x140043f49
mov byte [0x1401acf18], r9b
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bd920
add rsp, 0x40
pop rbp
ret

Function at 0x140043f84
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1401a2e90]
xor rax, rsp
mov qword [rbp], rax
mov r8d, dword [0x1401aad80]
mov eax, 0x2aaaaaab
lea ecx, [r8 + 1]
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x10
jne 0x140043fe3
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov r8d, dword [0x1401aad80]
xor ecx, ecx
cmp byte [0x1401acf4c], cl
je 0x140043ff9
lea rax, [0x1401a63a0]
jmp 0x1400440e4
mov r10d, 4
mov dword [rbp - 0x30], 0x60022
mov dword [rbp - 0x2c], 0x2000c
mov dword [rbp - 0x28], 0x160012
mov dword [rbp - 0x24], 0x40039
mov dword [rbp - 0x20], 0xd000c
lea r9d, [r10 - 1]
mov dword [rbp - 0x1c], 0xe001d
mov dword [rbp - 0x18], 0x1b003c
mov dword [rbp - 0x14], 0x80013
mov dword [rbp - 0x10], 0x110003
mov dword [rbp - 0xc], 0x52004b
mov word [rbp - 8], cx
lea rbx, [0x1401a63a0]
lea rax, [0x1401a5da0]
movzx eax, byte [rcx + rax]
xor ax, word [rbp + rcx*2 - 0x30]
mov word [rbx + rcx*2], ax
inc rcx
cmp rcx, 0x14
jl 0x140044054
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x66666667
imul ecx, r8d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
cmp ecx, r9d
jne 0x1400440da
mov eax, 0x51eb851f
imul r8d
mov rax, r10
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x63
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400bcf98
mov rcx, rax
call fcn.1400be048
mov byte [0x1401acf4c], 1
mov rax, rbx
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1400bd920
mov rbx, qword [rsp + 0x120]
add rsp, 0x110
pop rbp
ret
Function at 0x140044104
Capabilities:
Encode data using xor
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401a2e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r8d, dword [0x1401aad80]
mov eax, 0x30c30c31
xor edi, edi
lea ecx, [r8 + 1]
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0x10
jne 0x14004419e
mov eax, dword [str.12DWB]
or r8, 0xffffffffffffffff
mov dword [rbp - 0x50], eax
movzx eax, word [0x14013da68]
mov rcx, r8
mov word [rbp - 0x4c], ax
lea rax, [rbp - 0x50]
inc rcx
cmp byte [rax + rcx], dil
jne 0x140044172
mov eax, 4
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.1400bcf98
mov rcx, rax
call fcn.1400be048
mov r8d, dword [0x1401aad80]
cmp byte [0x1401acf30], dil
je 0x1400441b3
lea rax, [0x1401a6420]
jmp 0x140044280
mov dword [rbp - 0x48], 0x2f
mov dword [rbp - 0x44], 0xf0028
mov dword [rbp - 0x40], 0x1c000a
mov dword [rbp - 0x3c], 8
mov dword [rbp - 0x38], 0x70015
mov dword [rbp - 0x34], 0x2003f
mov dword [rbp - 0x30], 0x7001a
mov dword [rbp - 0x2c], 0xc0014
mov dword [rbp - 0x28], 0x38000e
mov dword [rbp - 0x24], 0x1f0014
mov dword [rbp - 0x20], 0xe
mov dword [rbp - 0x1c], 0x5d001c
mov dword [rbp - 0x18], 0x4d
mov rcx, rdi
lea rbx, [0x1401a6420]
lea rax, [0x1401a5da0]
movzx eax, byte [rcx + rax]
xor ax, word [rbp + rcx*2 - 0x48]
mov word [rbx + rcx*2], ax
inc rcx
cmp rcx, 0x19
jl 0x140044218
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
mov byte [0x1401acf30], 1
imul ecx, eax
mov eax, 0x92492493
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
sub ecx, edx
cmp ecx, 5
jne 0x14004427d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400bd920
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400442a4
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401a2e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov eax, dword [0x1401aad80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xf
jne 0x1400442ea
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
xor eax, eax
cmp byte [0x1401acf1f], al
je 0x140044300
lea rax, [0x1401a6be0]
jmp 0x14004439a
mov dword [rbp - 0x50], 0x1b002d
mov dword [rbp - 0x4c], 0x80006
mov dword [rbp - 0x48], 0x30013
mov dword [rbp - 0x44], 0x13003b
mov dword [rbp - 0x40], 0x140008
mov dword [rbp - 0x3c], 0x70000
mov dword [rbp - 0x38], 0x14000d
mov dword [rbp - 0x34], 0x3b0004
mov dword [rbp - 0x30], 0x190003
mov dword [rbp - 0x2c], 0x170004
mov dword [rbp - 0x28], 0x140041
mov dword [rbp - 0x24], 0xe0004
mov r8d, 1
mov dword [rbp - 0x20], 0x80001
mov dword [rbp - 0x1c], 0x500011
mov word [rbp - 0x18], ax
lea rdx, [0x1401a6be0]
lea rcx, [0x1401a5da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x50]
mov word [rdx + rax*2], cx
add rax, r8
cmp rax, 0x1c
jl 0x140044373
mov byte [0x1401acf1f], r8b
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400bd920
add rsp, 0x70
pop rbp
ret

Function at 0x1400443ac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401a2e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
cmp byte [0x1401acf2d], bl
je 0x1400443dd
lea rax, [0x1401a6660]
jmp 0x14004447e
mov ecx, dword [0x1401aad80]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x78787879
imul r8d, ecx
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub r8d, edx
cmp r8d, 3
jne 0x140044425
mov edx, 0xd7
lea rcx, str._d__d_n
lea r8d, [rdx + 1]
call fcn.1400be234
mov dword [rbp - 0x30], 0x300047
mov dword [rbp - 0x2c], 0xf0005
mov dword [rbp - 0x28], 0x160030
mov dword [rbp - 0x24], 0x120019
mov dword [rbp - 0x20], 0xd0008
mov dword [rbp - 0x1c], 0x560007
mov word [rbp - 0x18], bx
lea rax, [0x1401a6660]
lea rcx, [0x1401a5da0]
movzx ecx, byte [rbx + rcx]
xor cx, word [rbp + rbx*2 - 0x30]
mov word [rax + rbx*2], cx
inc rbx
cmp rbx, 0xc
jl 0x14004445a
mov byte [0x1401acf2d], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400bd920
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x140044498
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401a2e90]
xor rax, rsp
mov qword [rbp - 8], rax
mov r8d, dword [0x1401aad80]
xor ebx, ebx
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x66666667
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
cmp ecx, 1
jne 0x14004450d
mov qword [r11 - 0x40], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [r11 - 0x48], rbx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov r8d, dword [0x1401aad80]
lea ecx, [r8 + 1]
mov eax, 0x2aaaaaab
mov esi, 4
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, esi
jne 0x140044553
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov r8d, dword [0x1401aad80]
cmp byte [0x1401acf49], bl
je 0x140044567
lea rax, [0x1401a6680]
jmp 0x140044647
lea ecx, [r8 + 1]
mov eax, 0x2aaaaaab
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, esi
jne 0x1400445dd
mov ecx, ebx
mov r9d, 0xaf3addc7
mov r10d, 0xd7
jmp 0x1400445b4
mov eax, r8d
inc ecx
or eax, 0xffffff6e
add r8d, eax
mov eax, r8d
imul eax, r8d
cmp ecx, eax
jg 0x1400445d7
mov eax, r9d
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
imul edx, edx, 0xbb
sub eax, edx
cmp eax, r10d
jne 0x14004459c
mov dword [0x1401aad80], ecx
mov dword [rbp - 0x30], 0x2000f
mov dword [rbp - 0x2c], 0x3c0019
mov dword [rbp - 0x28], 0x70015
mov dword [rbp - 0x24], 0x3e000f
mov dword [rbp - 0x20], 0x1a0004
mov dword [rbp - 0x1c], 0xe000a
mov dword [rbp - 0x18], 0x70018
mov dword [rbp - 0x14], 0x20008
mov dword [rbp - 0x10], 0xc
lea rax, [0x1401a6680]
lea rcx, [0x1401a5da0]
movzx ecx, byte [rbx + rcx]
xor cx, word [rbp + rbx*2 - 0x30]
mov word [rax + rbx*2], cx
inc rbx
cmp rbx, 0x11
jl 0x140044623
mov byte [0x1401acf49], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bd920
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x140044664
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x608]
sub rsp, 0x6e0
mov rax, qword [0x1401a2e90]
xor rax, rsp
mov qword [rbp + 0x5d0], rax
mov r9d, dword [0x1401aad80]
xor r11d, r11d
mov eax, 0x38e38e39
mov ecx, r9d
lea r8d, [r11 + 1]
imul ecx, r9d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub ecx, eax
cmp ecx, 3
jne 0x14004470a
mov r10d, r11d
lea r11d, [r8 + 7]
mov edx, r10d
mov rbx, r11
mov ecx, edx
mov eax, edx
and ecx, r8d
sar eax, 1
sub ecx, r8d
not ecx
and ecx, r9d
mov edx, ecx
xor edx, eax
sub rbx, r8
jne 0x1400446d7
add r10d, r8d
add r9d, edx
cmp r10d, 0x100
jl 0x1400446d1
mov dword [0x1401aad80], r9d
xor r11d, r11d
cmp byte [0x1401acf4b], r11b
je 0x14004471f
lea rax, [0x1401a68e8]
jmp 0x1400448c9
lea r13d, [r9 + 1]
mov eax, 0x66666667
mov ecx, r13d
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
mov edx, 0xf
add eax, eax
sub ecx, eax
lea eax, [rdx - 8]
cmp ecx, eax
jne 0x1400447a6
mov ebx, r11d
lea r10, [rsp + 0x40]
mov dword [rsp], ebx
mov sil, r9b
mov edi, r8d
mov r15, rdx
sub sil, bl
mov ebx, 8
mov eax, r9d
mov r14, r11
mov r12d, r8d
cdq
idiv edi
mov dword [rsp + 4], edx
add r14, r8
add r12d, r8d
cmp r14, rbx
jl 0x14004477a
add edi, r8d
add r10, rbx
sub r15, r8
jne 0x14004476a
mov ebx, dword [rsp]
lea edx, [r15 + 0xf]
add ebx, r8d
mov dword [rsp], ebx
cmp ebx, 0xe
jl 0x140044759
lea r13d, [r9 + 1]
mov dword [rsp + 8], 0x2000f
mov dword [rsp + 0xc], 0x3c0019
mov dword [rsp + 0x10], 0x1d0013
mov dword [rsp + 0x14], 0x19000e
mov dword [rsp + 0x18], 0x70011
mov dword [rsp + 0x1c], 0x1f000a
mov edi, 0xd
mov dword [rsp + 0x20], 0x17000d
mov dword [rsp + 0x24], 0x8003e
mov dword [rsp + 0x28], 0x16001a
mov dword [rsp + 0x2c], 0x20014
mov dword [rsp + 0x30], 0x1b0015
mov dword [rsp + 0x34], 0x9000a
mov word [rsp + 0x38], r11w
mov rcx, r11
lea rbx, [0x1401a68e8]
lea rax, [0x1401a5da0]
movzx eax, byte [rcx + rax]
xor ax, word [rsp + rcx*2 + 8]
mov word [rbx + rcx*2], ax
add rcx, r8
cmp rcx, 0x18
jl 0x14004481b
lea r10d, [r9 + 2]
mov eax, 0x30c30c31
imul r10d, r13d
imul r10d, r9d
imul r10d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r10d
imul edx, edx, 0x15
sub eax, edx
cmp eax, edi
jne 0x140044880
lea rdi, [rsp + 0x40]
mov esi, r9d
add r11d, r8d
sub esi, r8d
lea rdi, [rdi + 4]
movsxd rcx, r11d
cmp rcx, 0xdd
jb 0x14004486a
mov eax, 0x66666667
mov byte [0x1401acf4b], r8b
imul r10d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r10d, eax
cmp r10d, 3
jne 0x1400448c6
cmp r9d, r8d
jle 0x1400448bf
mov eax, r9d
cdq
idiv r8d
inc r8d
add r8d, edx
cmp r8d, r9d
jl 0x1400448ad
mov dword [0x1401aad80], r8d
mov rax, rbx
mov rcx, qword [rbp + 0x5d0]
xor rcx, rsp
call fcn.1400bd920
lea r11, [rsp + 0x6e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400448fc
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401a2e90]
xor rax, rsp
mov qword [rsp + 0x10], rax
mov r9d, dword [0x1401aad80]
lea eax, [r9 + 1]
lea ecx, [r9 + 2]
imul ecx, eax
mov eax, 0x78787879
imul ecx, r9d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 3
jne 0x140044989
movsd xmm3, qword [0x14013f170]
movd xmm4, r9d
xorps xmm2, xmm2
cvtdq2pd xmm4, xmm4
addsd xmm2, xmm3
movaps xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x140044971
subsd xmm2, xmm3
divsd xmm3, qword [0x14013f198]
movaps xmm1, xmm2
movaps xmm0, xmm4
mulsd xmm1, xmm2
subsd xmm0, xmm1
comisd xmm0, xmmword [0x14013f168]
ja 0x140044954
xor r8d, r8d
cmp byte [0x1401acf1d], r8b
je 0x1400449a1
lea rax, [0x1401a6818]
jmp 0x140044a46
mov ecx, r9d
mov eax, 0x38e38e39
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xf
jne 0x140044a02
mov edx, r8d
mov r10d, edx
mov r11d, 8
mov ecx, r10d
mov eax, r10d
and ecx, 1
sar eax, 1
dec ecx
not ecx
and ecx, r9d
mov r10d, ecx
xor r10d, eax
dec r11
jne 0x1400449d1
inc edx
add r9d, r10d
cmp edx, 0x100
jl 0x1400449c8
mov dword [0x1401aad80], r9d
mov dword [rsp], 0x40047
mov dword [rsp + 4], 0x510019
mov dword [rsp + 8], 0x5b
lea rax, [0x1401a6818]
lea rcx, [0x1401a5da0]
movzx ecx, byte [r8 + rcx]
xor cx, word [rsp + r8*2]
mov word [rax + r8*2], cx
inc r8
cmp r8, 5
jl 0x140044a20
mov byte [0x1401acf1d], 1
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.1400bd920
add rsp, 0x28
ret
Function at 0x140044a58
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x5fa0]
mov eax, 0x60a0
call fcn.1400c29d0
sub rsp, rax
mov rax, qword [0x1401a2e90]
xor rax, rsp
mov qword [rbp + 0x5f90], rax
call fcn.140042320
xor ebx, ebx
test al, al
jne 0x140044aa4
call fcn.1400be2e0
mov r9d, eax
mov dword [0x1401aad80], eax
jmp 0x140044aab
mov r9d, dword [0x1401aad80]
cmp byte [0x1401acf47], bl
je 0x140044abf
lea rax, [0x1401a6400]
jmp 0x140044c44
lea eax, [r9 + 1]
lea ecx, [r9 + 2]
mov edi, 1
imul ecx, eax
mov eax, 0x66666667
imul ecx, r9d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
cmp ecx, 3
jne 0x140044b61
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x6040
mov word [rsp + 0x40], bx
call fcn.1400c2d60
mov r10, rbx
or r9, 0xffffffffffffffff
mov r8, rbx
test r10, r10
je 0x140044b39
test r8, r8
je 0x140044b39
lea rax, [r9 + r8]
lea rcx, [r9 + r8]
movzx edx, word [rbp + rcx*2 - 0x19c]
add dx, word [rsp + rax*2 + 0x40]
lea rax, [r9 + r8]
add dx, di
mov word [rsp + rax*2 + 0x42], dx
add r8, rdi
cmp r8, 0x6f
jl 0x140044b0e
add r9, 0x6f
add r10, rdi
cmp r9, 0x3020
jl 0x140044b0b
movsx r9d, word [rbp + 0x5f80]
mov dword [0x1401aad80], r9d
lea eax, [r9 + 1]
lea ecx, [r9 + 2]
mov dword [rsp + 0x20], 0x60022
mov dword [rsp + 0x24], 0x2000c
mov dword [rsp + 0x28], 0x160012
mov dword [rsp + 0x2c], 0x9003f
imul ecx, eax
imul ecx, r9d
mov eax, 0x2aaaaaab
mov dword [rsp + 0x30], 0x70013
mov dword [rsp + 0x34], 0xf0008
mov r8d, 0xf
mov dword [rsp + 0x38], 0xb002d
mov dword [rsp + 0x3c], 0x5b
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x11
jne 0x140044be2
test r9d, r9d
cmove r9d, edi
mov dword [0x1401aad80], r9d
lea r10, [0x1401a6400]
lea rax, [0x1401a5da0]
movzx eax, byte [rbx + rax]
xor ax, word [rsp + rbx*2 + 0x20]
mov word [r10 + rbx*2], ax
add rbx, rdi
cmp rbx, r8
jl 0x140044be9
lea eax, [r9 + 1]
lea r8d, [r9 + 2]
imul r8d, eax
mov eax, 0x78787879
imul r8d, r9d
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x11
sub r8d, edx
cmp r8d, 3
jne 0x140044c3a
add dword [0x1401aca6c], edi
mov byte [0x1401acf47], dil
mov rax, r10
mov rcx, qword [rbp + 0x5f90]
xor rcx, rsp
call fcn.1400bd920
lea r11, [rsp + 0x60a0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140044c68
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x1401a2e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
cmp byte [0x1401acf2c], al
je 0x140044c92
lea rax, [0x1401a6530]
jmp 0x140044cfe
mov dword [rbp - 0x30], 0x190008
mov dword [rbp - 0x2c], 0x40008
mov dword [rbp - 0x28], 0x530003
mov dword [rbp - 0x24], 0x13001b
mov dword [rbp - 0x20], 0x1000e
mov r8d, 1
mov dword [rbp - 0x1c], 0x50049
mov dword [rbp - 0x18], 0x1e0009
mov dword [rbp - 0x14], 4
lea rdx, [0x1401a6530]
lea rcx, [0x1401a5da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x30]
mov word [rdx + rax*2], cx
add rax, r8
cmp rax, 0xf
jl 0x140044cd7
mov byte [0x1401acf2c], r8b
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400bd920
add rsp, 0x30
pop rbp
ret

Function at 0x140044d10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1401a2e90]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor ecx, ecx
cmp byte [0x1401acf26], cl
je 0x140044d3b
lea rax, [0x1401a66d0]
jmp 0x140044dc8
mov dword [rsp + 0x20], 0x1a004c
mov dword [rsp + 0x24], 0x150006
mov edx, 7
mov dword [rsp + 0x28], 0x450007
mov dword [rsp + 0x2c], 0x5f
lea rbx, [0x1401a66d0]
lea rax, [0x1401a5da0]
movzx eax, byte [rcx + rax]
xor ax, word [rsp + rcx*2 + 0x20]
mov word [rbx + rcx*2], ax
inc rcx
cmp rcx, rdx
jl 0x140044d67
mov ecx, dword [0x1401aad80]
mov byte [0x1401acf26], 1
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x78787879
imul r8d, ecx
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x11
sub r8d, edx
cmp r8d, 3
jne 0x140044dc5
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov rax, rbx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400bd920
add rsp, 0x40
pop rbx
ret