joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140057850
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401d7a13], 0
je 0x140057889
lea rax, [0x1401d1bb0]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x40
pop rbp
ret
mov eax, dword [0x1401d5d60]
mov ecx, eax
imul ecx, eax
and ecx, 0x8000000f
jge 0x1400578a3
dec ecx
or ecx, 0xfffffff0
inc ecx
xor r8d, r8d
cmp ecx, 8
jne 0x1400578c8
mov r9d, r8d
test eax, eax
je 0x1400578c1
mov ecx, eax
cdq
and ecx, 1
sub eax, edx
add r9d, ecx
sar eax, 1
jne 0x1400578b2
mov dword [0x1401d5d60], r9d
mov dword [rbp - 0x40], 0x11002b
mov dword [rbp - 0x3c], 0xd002f
mov dword [rbp - 0x38], 0x40003
mov dword [rbp - 0x34], 0xb0002
mov dword [rbp - 0x30], 0x100000
mov dword [rbp - 0x2c], 0xc003f
mov dword [rbp - 0x28], 0x1001d
mov dword [rbp - 0x24], 0x6001e
mov dword [rbp - 0x20], 0x240007
mov dword [rbp - 0x1c], 0x1e0000
mov dword [rbp - 0x18], 0x14001d
mov dword [rbp - 0x14], 0x52000b
mov dword [rbp - 0x10], 0x4a
lea rdx, [0x1401d1bb0]
lea r9, [0x1401d0d91]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rbp + r8*2 - 0x3e]
add r8, 5
xor ax, word [rbp + r8*2 - 0x4a]
mov word [rdx + r8*2 - 0xa], ax
movzx eax, byte [r8 + r9 - 5]
xor cx, ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rbp + r8*2 - 0x46]
mov word [rdx + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0x19
jl 0x140057940
mov byte [0x1401d7a13], 1
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x40
pop rbp
ret

Function at 0x140057ac0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401d7a00], 0
lea rax, [0x1401d1630]
jne 0x140057bbc
xor r8d, r8d
mov dword [rbp - 0x50], 0xa0029
mov dword [rbp - 0x4c], 0xa0001
mov dword [rbp - 0x48], 0x1b001a
mov dword [rbp - 0x44], 0x180031
mov dword [rbp - 0x40], 0x3001d
mov word [rbp - 0x18], r8w
mov dword [rbp - 0x3c], 0x90000
mov dword [rbp - 0x38], 0x12000a
mov dword [rbp - 0x34], 0x31000e
mov dword [rbp - 0x30], 0x5000a
mov dword [rbp - 0x2c], 0x160010
mov dword [rbp - 0x28], 0x52
mov dword [rbp - 0x24], 0x10013
mov dword [rbp - 0x20], 0x150006
mov dword [rbp - 0x1c], 0x410014
lea r9, [0x1401d0d91]
nop dword [rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x4e]
add r8, 4
xor cx, word [rbp + r8*2 - 0x58]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x54]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x52]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x1c
jl 0x140057b60
mov byte [0x1401d7a00], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x50
pop rbp
ret
Function at 0x140057bd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [0x1401d7a0e], 0
je 0x140057c08
lea rax, [0x1401d13e0]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x70
pop rbx
ret
mov qword [rsp + 0x80], rdi
xor edi, edi
mov dword [rsp + 0x40], 0x210043
mov dword [rsp + 0x44], 0xd0002
mov dword [rsp + 0x48], 0xe0039
mov dword [rsp + 0x4c], 0x190013
mov word [rsp + 0x58], di
mov edx, edi
mov dword [rsp + 0x50], 0x1a001d
mov dword [rsp + 0x54], 0x580007
lea rbx, [0x1401d13e0]
lea r8, [0x1401d0d91]
nop word [rax + rax]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rsp + rdx*2 + 0x42]
add rdx, 6
xor ax, word [rsp + rdx*2 + 0x34]
mov word [rbx + rdx*2 - 0xc], ax
movzx eax, byte [rdx + r8 - 6]
xor cx, ax
movzx eax, byte [rdx + r8 - 5]
xor ax, word [rsp + rdx*2 + 0x38]
mov word [rbx + rdx*2 - 0xa], cx
mov word [rbx + rdx*2 - 8], ax
movzx eax, byte [rdx + r8 - 4]
xor ax, word [rsp + rdx*2 + 0x3a]
mov word [rbx + rdx*2 - 6], ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rsp + rdx*2 + 0x3c]
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rsp + rdx*2 + 0x3e]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0xc
jl 0x140057c60
mov ecx, dword [0x1401d5d60]
mov eax, ecx
imul eax, ecx
and eax, 0x8000000f
jge 0x140057ce6
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 8
jne 0x140057d48
mov eax, 0x3531dec1
mov r8d, edi
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
imul edx, edx, 0x4d
sub eax, edx
cmp eax, 0x76
je 0x140057d41
nop dword [rax + rax]
mov eax, ecx
inc r8d
or eax, 0xffffffee
add ecx, eax
mov eax, ecx
imul eax, ecx
cmp r8d, eax
jg 0x140057d41
mov eax, 0x3531dec1
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
imul edx, edx, 0x4d
sub eax, edx
cmp eax, 0x76
jne 0x140057d10
mov dword [0x1401d5d60], r8d
mov byte [0x1401d7a0e], 1
call fcn.140055230
test al, al
jne 0x140057d7f
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rax, rbx
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x70
pop rbx
ret
Function at 0x140057da0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x370
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rsp + 0x350], rax
call fcn.140055390
mov ecx, dword [0x1401d5d60]
xor r9d, r9d
lea ebx, [r9 + 1]
test al, al
jne 0x140057e5a
mov qword [rsp + 0x380], rbp
mov qword [rsp + 0x388], rsi
mov qword [rsp + 0x390], rdi
mov qword [rsp + 0x368], r14
mov edi, r9d
lea r10, [rsp + 0x51]
mov qword [rsp + 0x360], r15
nop word [rax + rax]
movzx r11d, cl
mov esi, ebx
mov ebp, 0x10
sub r11b, dil
nop
inc esi
add r10, 3
dec rbp
jne 0x140057e20
inc edi
cmp edi, 0x10
jl 0x140057e10
mov r15, qword [rsp + 0x360]
mov r14, qword [rsp + 0x368]
mov rdi, qword [rsp + 0x390]
mov rsi, qword [rsp + 0x388]
mov rbp, qword [rsp + 0x380]
mov r8d, ecx
mov eax, 0x38e38e39
imul r8d, ecx
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 0x10
jne 0x140057ea3
mov r8d, ebx
mov eax, ebx
mov edx, 0x36
nop
dec edx
lea ecx, [rax + r8]
lea r8d, [rax]
mov eax, ecx
jns 0x140057e90
mov dword [0x1401d5d60], ecx
cmp byte [0x1401d7a15], r9b
je 0x140057eb8
lea rax, [0x1401d1848]
jmp 0x140057fbc
mov dword [rsp + 0x20], 0x13000b
mov dword [rsp + 0x24], 0x3e001e
mov dword [rsp + 0x28], 0x1f001c
mov dword [rsp + 0x2c], 0x350005
mov dword [rsp + 0x30], 0xd0011
mov dword [rsp + 0x34], 0xa
mov dword [rsp + 0x38], 0x1001f
mov dword [rsp + 0x3c], 0x80002
mov dword [rsp + 0x40], 5
lea r10, [0x1401d1848]
lea rdx, [0x1401d0d90]
nop
movzx eax, byte [r9 + rdx]
inc r9
xor ax, word [rsp + r9*2 + 0x1e]
mov word [r10 + r9*2 - 2], ax
cmp r9, 0x11
jl 0x140057f10
lea r8d, [rcx + 1]
mov eax, 0xb21642c9
imul r8d, ecx
imul r8d
add edx, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
imul edx, edx, 0x17
sub eax, edx
cmp eax, 0xd
jne 0x140057fb2
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, 0xa
jne 0x140057f95
mov eax, 0xf0
mov r8d, 0x29
nop dword [rax]
test r8d, r8d
je 0x140057f95
cdq
mov ecx, r8d
idiv r8d
mov eax, ecx
mov r8d, edx
test ecx, ecx
jne 0x140057f80
mov ecx, ebx
mov r8d, 0x95
nop dword [rax]
dec r8d
lea edx, [rcx + rbx]
lea ebx, [rcx]
mov ecx, edx
jns 0x140057fa0
mov dword [0x1401d5d60], edx
mov byte [0x1401d7a15], 1
mov rax, r10
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x370
pop rbx
ret
Function at 0x140057fe0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401d7a0c], 0
lea rax, [0x1401d1758]
jne 0x1400580f0
xor r8d, r8d
mov dword [rbp - 0x40], 0x13000b
mov dword [rbp - 0x3c], 0x3e001e
mov dword [rbp - 0x38], 0x5001a
mov dword [rbp - 0x34], 0x120004
mov dword [rbp - 0x30], 0x100004
mov word [rbp - 0x10], r8w
mov dword [rbp - 0x2c], 0x11000a
mov dword [rbp - 0x28], 0x11000a
mov dword [rbp - 0x24], 0x20034
mov dword [rbp - 0x20], 0xa0013
mov dword [rbp - 0x1c], 0x30000
mov dword [rbp - 0x18], 0xf0006
mov dword [rbp - 0x14], 0x6001d
lea r9, [0x1401d0d91]
nop
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 6
xor cx, word [rbp + r8*2 - 0x4c]
mov word [rax + r8*2 - 0xc], cx
movzx ecx, byte [r8 + r9 - 6]
xor dx, cx
movzx ecx, byte [r8 + r9 - 5]
xor cx, word [rbp + r8*2 - 0x48]
mov word [rax + r8*2 - 0xa], dx
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x18
jl 0x140058070
mov byte [0x1401d7a0c], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x40
pop rbp
ret
Function at 0x140058340
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, dword [0x1401d5d60]
lea edx, [rcx + 2]
lea eax, [rcx + 1]
imul edx, eax
imul edx, ecx
and edx, 0x80000007
jge 0x14005837f
dec edx
or edx, 0xfffffff8
inc edx
xor edi, edi
cmp edx, 5
jne 0x1400583dc
lea ecx, [rdi + 0x28]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rsi
call fcn.1400d2e28
mov ebx, edi
mov rsi, rax
call fcn.1400d41a0
inc rbx
add eax, dword [0x1401d5d60]
mov dword [rsi + rbx*4 - 4], eax
cmp rbx, 0xa
jl 0x1400583a3
mov ecx, dword [rsi + 0x24]
mov dword [0x1401d5d60], ecx
mov rcx, rsi
call fcn.1400d3f08
mov rsi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
cmp byte [0x1401d7a09], dil
je 0x1400583f1
lea rax, [0x1401d1370]
jmp 0x1400584d7
mov dword [rbp - 0x60], 0x170000
mov dword [rbp - 0x5c], 0xe001c
mov dword [rbp - 0x58], 0x34001d
mov dword [rbp - 0x54], 0x50002
mov dword [rbp - 0x50], 0x180019
mov dword [rbp - 0x4c], 0xb001c
mov dword [rbp - 0x48], 0x160006
mov dword [rbp - 0x44], 0x13000a
mov dword [rbp - 0x40], 0x70002
mov dword [rbp - 0x3c], 0x2c0002
mov dword [rbp - 0x38], 0xa0016
mov dword [rbp - 0x34], 0x37001e
mov dword [rbp - 0x30], 0x150018
mov dword [rbp - 0x2c], 0x80017
mov dword [rbp - 0x28], 0x100019
mov dword [rbp - 0x24], 0x1e0000
mov word [rbp - 0x20], di
lea rdx, [0x1401d1370]
lea r8, [0x1401d0d91]
nop word [rax + rax]
movzx eax, byte [rdi + r8 - 1]
movzx ecx, word [rbp + rdi*2 - 0x5e]
add rdi, 4
xor ax, word [rbp + rdi*2 - 0x68]
mov word [rdx + rdi*2 - 8], ax
movzx eax, byte [rdi + r8 - 4]
xor cx, ax
mov word [rdx + rdi*2 - 6], cx
movzx ecx, byte [rdi + r8 - 3]
xor cx, word [rbp + rdi*2 - 0x64]
mov word [rdx + rdi*2 - 4], cx
movzx ecx, byte [rdi + r8 - 2]
xor cx, word [rbp + rdi*2 - 0x62]
mov word [rdx + rdi*2 - 2], cx
cmp rdi, 0x20
jl 0x140058480
mov byte [0x1401d7a09], 1
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d37e0
mov rdi, qword [rsp + 0xa0]
add rsp, 0x80
pop rbp
ret
Function at 0x140058500
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rsp + 0x20], rax
cmp byte [0x1401d7a04], 0
je 0x140058535
lea rax, [0x1401d1b90]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x38
ret
mov dword [rsp], 0x170026
mov dword [rsp + 4], 0xb
xor r8d, r8d
mov dword [rsp + 8], 0xe001b
mov dword [rsp + 0xc], 0x20035
mov dword [rsp + 0x10], 0x100006
mov dword [rsp + 0x14], 0x10008
mov dword [rsp + 0x18], 0xd002a
mov dword [rsp + 0x1c], 0x51
lea rdx, [0x1401d1b90]
lea r9, [0x1401d0d91]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 2]
add r8, 5
xor ax, word [rsp + r8*2 - 0xa]
mov word [rdx + r8*2 - 0xa], ax
movzx eax, byte [r8 + r9 - 5]
xor cx, ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rsp + r8*2 - 6]
mov word [rdx + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0xf
jl 0x140058590
mov byte [0x1401d7a04], 1
mov rax, rdx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x38
ret
Function at 0x140058c20
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401d7a38], 0
lea rax, [0x1401d16d0]
jne 0x140058d30
xor r8d, r8d
mov dword [rbp - 0x40], 0x40006
mov dword [rbp - 0x3c], 0x150000
mov dword [rbp - 0x38], 0xa004f
mov dword [rbp - 0x34], 0x6000d
mov dword [rbp - 0x30], 0x16001b
mov word [rbp - 0x10], r8w
mov dword [rbp - 0x2c], 0x40049
mov dword [rbp - 0x28], 0x16000c
mov dword [rbp - 0x24], 0x14000e
mov dword [rbp - 0x20], 0x490018
mov dword [rbp - 0x1c], 0x160001
mov dword [rbp - 0x18], 0xf001c
mov dword [rbp - 0x14], 0xc0017
lea r9, [0x1401d0d91]
nop
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 6
xor cx, word [rbp + r8*2 - 0x4c]
mov word [rax + r8*2 - 0xc], cx
movzx ecx, byte [r8 + r9 - 6]
xor dx, cx
movzx ecx, byte [r8 + r9 - 5]
xor cx, word [rbp + r8*2 - 0x48]
mov word [rax + r8*2 - 0xa], dx
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x18
jl 0x140058cb0
mov byte [0x1401d7a38], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x40
pop rbp
ret

Function at 0x140058d50
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x38
cmp byte [0x1401d7a0b], 0
jne 0x140058e70
movzx eax, byte [0x1401d0d90]
mov ecx, dword [0x1401d5d60]
mov byte [0x1401d7a0b], 1
xor al, 0x43
lea r8d, [rcx + 2]
movzx eax, al
mov word [0x1401d1488], ax
movzx eax, byte [0x1401d0d91]
mov word [0x1401d148a], ax
movzx eax, byte [0x1401d0d92]
xor al, 0x16
movzx eax, al
mov word [0x1401d148c], ax
movzx eax, byte [0x1401d0d93]
xor al, 4
movzx eax, al
mov word [reloc.OLEAUT32.dll_SysReAllocStringLen], ax
movzx eax, byte [0x1401d0d94]
xor al, 0xc
movzx eax, al
mov word [str._f__b_a], ax
movzx eax, byte [0x1401d0d95]
xor al, 0x3f
movzx eax, al
mov word [0x1401d1492], ax
movzx eax, byte [0x1401d0d96]
xor al, 8
movzx eax, al
mov word [reloc.OLEAUT32.dll_VariantClear], ax
movzx eax, byte [0x1401d0d97]
xor al, 7
movzx eax, al
mov word [reloc.OLEAUT32.dll_VariantInit], ax
movzx eax, byte [0x1401d0d98]
xor al, 0x11
movzx eax, al
mov word [0x1401d1498], ax
movzx eax, byte [0x1401d0d99]
xor al, 0x48
movzx eax, al
mov word [0x1401d149a], ax
lea eax, [rcx + 1]
imul r8d, eax
mov eax, 0x2aaaaaab
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 0xa
jne 0x140058e70
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
lea rax, [0x1401d1488]
add rsp, 0x38
ret
Function at 0x140058e80
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x208
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rsp + 0x1f8], rax
mov r8d, dword [0x1401d5d60]
mov eax, 0x2aaaaaab
lea ecx, [r8 + 1]
imul ecx, r8d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 5
jne 0x140058f11
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x2f4
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400d2e28
mov rcx, rax
call fcn.1400d3f08
mov r8d, dword [0x1401d5d60]
cmp byte [0x1401d7a1c], 0
je 0x140058f39
lea rax, [0x1401d19b0]
mov rcx, qword [rsp + 0x1f8]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x208
ret
xor r9d, r9d
mov dword [rsp + 0x1d0], 0x13000b
mov dword [rsp + 0x1d4], 0x3e001e
mov dword [rsp + 0x1d8], 0x1b0006
mov dword [rsp + 0x1dc], 0x350002
mov dword [rsp + 0x1e0], 0xd0011
mov eax, r9d
mov dword [rsp + 0x1e4], 0xa
mov dword [rsp + 0x1e8], 0x1001f
mov dword [rsp + 0x1ec], 0x80002
mov dword [rsp + 0x1f0], 5
lea r10, [0x1401d19b0]
lea rdx, [0x1401d0d90]
movzx ecx, byte [rax + rdx]
inc rax
xor cx, word [rsp + rax*2 + 0x1ce]
mov word [r10 + rax*2 - 2], cx
cmp rax, 0x11
jl 0x140058fb0
mov ecx, r8d
mov eax, 0x6bca1af3
mov byte [0x1401d7a1c], 1
imul ecx, r8d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 0xc
jne 0x140059022
lea rdx, [rsp + 0x20]
nop dword [rax]
mov ecx, dword [rdx]
inc r9d
lea rdx, [rdx + 4]
shl ecx, 5
add r8d, ecx
movsxd rcx, r9d
cmp rcx, 0x1a8
jb 0x140059000
mov dword [0x1401d5d60], r8d
mov rax, r10
mov rcx, qword [rsp + 0x1f8]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x208
ret

Function at 0x1400591f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401d7a2c], 0
lea rax, [0x1401d1518]
jne 0x1400592ec
xor r8d, r8d
mov dword [rbp - 0x50], 0x13000b
mov dword [rbp - 0x4c], 0x3e001e
mov dword [rbp - 0x48], 0x20009
mov dword [rbp - 0x44], 0x190013
mov dword [rbp - 0x40], 0x2a0000
mov word [rbp - 0x18], r8w
mov dword [rbp - 0x3c], 0xb0000
mov dword [rbp - 0x38], 0x100005
mov dword [rbp - 0x34], 0x130008
mov dword [rbp - 0x30], 0x60002
mov dword [rbp - 0x2c], 0x2c000b
mov dword [rbp - 0x28], 0x30016
mov dword [rbp - 0x24], 0xd0006
mov dword [rbp - 0x20], 0x40009
mov dword [rbp - 0x1c], 0x50015
lea r9, [0x1401d0d91]
nop dword [rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x4e]
add r8, 4
xor cx, word [rbp + r8*2 - 0x58]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x54]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x52]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x1c
jl 0x140059290
mov byte [0x1401d7a2c], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x50
pop rbp
ret
Function at 0x140059300
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
call fcn.140055320
xor ecx, ecx
test al, al
jne 0x14005936d
mov qword [rsp + 0x310], rbx
mov ebx, dword [0x1401d5d60]
mov r9d, ecx
mov r11d, ebx
lea r10, [rsp + 0x20]
nop word [rax + rax]
inc r9d
dec r11d
lea r10, [r10 + 4]
movsxd rax, r9d
cmp rax, 0x9d
jb 0x140059350
mov rbx, qword [rsp + 0x310]
cmp byte [0x1401d7a1b], cl
je 0x140059381
lea rax, [0x1401d1400]
jmp 0x140059493
mov dword [rbp + 0x1a0], 0x170000
mov dword [rbp + reloc.OLEAUT32.dll_OleTranslateColor], 0xe001c
mov dword [rbp + 0x1a8], 0x4b001d
mov dword [rbp + 0x1ac], 0xf0006
mov dword [rbp + 0x1b0], 0x10000
mov dword [rbp + 0x1b4], 0xb0000
mov dword [rbp + 0x1b8], 0x550008
mov dword [rbp + 0x1bc], 0xe000d
mov dword [rbp + 0x1c0], 0x1a0019
mov dword [rbp + 0x1c4], 0x530011
mov dword [rbp + 0x1c8], 0x140002
mov dword [rbp + 0x1cc], 0xb001d
mov dword [rbp + 0x1d0], 0x3000f
mov dword [rbp + 0x1d4], 0x410003
mov dword [rbp + 0x1d8], 0xa0003
mov dword [rbp + 0x1dc], 0x80014
mov dword [rbp + 0x1e0], 0x58
lea r8, [0x1401d1400]
lea r9, [0x1401d0d91]
nop dword [rax]
movzx eax, byte [rcx + r9 - 1]
movzx edx, word [rbp + rcx*2 + 0x1a2]
add rcx, 3
xor ax, word [rbp + rcx*2 + 0x19a]
mov word [r8 + rcx*2 - 6], ax
movzx eax, byte [rcx + r9 - 3]
xor dx, ax
mov word [r8 + rcx*2 - 4], dx
movzx edx, byte [rcx + r9 - 2]
xor dx, word [rbp + rcx*2 + 0x19e]
mov word [r8 + rcx*2 - 2], dx
cmp rcx, 0x21
jl 0x140059440
mov byte [0x1401d7a1b], 1
mov rax, r8
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x300
pop rbp
ret

Function at 0x1400594b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rsp + 0x18], rax
cmp byte [0x1401d7a36], 0
lea rax, [0x1401d1c58]
jne 0x14005952f
mov dword [rsp], 0x13
xor ecx, ecx
mov dword [rsp + 4], 0x12001c
mov dword [rsp + 8], 0x40006
mov dword [rsp + 0xc], 0x4a000f
mov dword [rsp + 0x10], 0x70011
mov dword [rsp + 0x14], 0x1b
lea r8, [0x1401d0d90]
nop dword [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 - 2]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0xb
jl 0x140059510
mov byte [0x1401d7a36], 1
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x28
ret
Function at 0x140059550
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r8d, dword [0x1401d5d60]
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x66666667
imul ecx, r8d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 9
jne 0x1400595a6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov r8d, dword [0x1401d5d60]
cmp byte [0x1401d7a31], 0
mov qword [rsp + 0x50], rbx
je 0x1400595c0
lea rax, [0x1401d12f8]
jmp 0x1400596e2
mov dword [rsp + 0x20], 0x15002a
mov dword [rsp + 0x24], 0xf000b
mov dword [rsp + 0x28], 0x19003f
mov dword [rsp + 0x2c], 0x9000e
mov dword [rsp + 0x30], 0x60011
mov dword [rsp + 0x34], 0x45001a
mov dword [rsp + 0x38], 0xc
xor edx, edx
mov dword [rsp + 0x3c], 0x19
lea rbx, [0x1401d12f8]
lea r9, [0x1401d0d91]
movzx eax, byte [rdx + r9 - 1]
movzx ecx, word [rsp + rdx*2 + 0x22]
add rdx, 5
xor ax, word [rsp + rdx*2 + 0x16]
mov word [rbx + rdx*2 - 0xa], ax
movzx eax, byte [rdx + r9 - 5]
xor cx, ax
movzx eax, byte [rdx + r9 - 4]
xor ax, word [rsp + rdx*2 + 0x1a]
mov word [rbx + rdx*2 - 8], cx
mov word [rbx + rdx*2 - 6], ax
movzx eax, byte [rdx + r9 - 3]
xor ax, word [rsp + rdx*2 + 0x1c]
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r9 - 2]
xor ax, word [rsp + rdx*2 + 0x1e]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0xf
jl 0x140059610
lea ecx, [r8 + 1]
mov eax, 0x2aaaaaab
mov byte [0x1401d7a31], 1
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 9
jne 0x1400596df
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x2f4
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400d2e28
mov rcx, rax
call fcn.1400d3f08
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x58
ret