joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140059210
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401dfd17], 0
lea rax, [0x1401d9458]
jne 0x1400592ec
xor r8d, r8d
mov dword [rsp], 0x1c000b
mov dword [rsp + 4], 0x1d0027
mov dword [rsp + 8], 0x180002
mov dword [rsp + 0xc], 0x50022
mov dword [rsp + 0x10], 0xc0011
mov word [rsp + 0x20], r8w
mov dword [rsp + 0x14], 0x60048
mov dword [rsp + 0x18], 0x80004
mov dword [rsp + 0x1c], 0x5a0004
lea r9, [0x1401d8d91]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rsp + r8*2 + 2]
add r8, 4
xor cx, word [rsp + r8*2 - 8]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x10
jl 0x140059290
mov byte [0x1401dfd17], 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x38
ret
Function at 0x1400598a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401dfd26], 0
je 0x1400598d9
lea rax, [0x1401d93b0]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 0x80], rbx
call fcn.140058700
mov edx, dword [0x1401ddd80]
xor ebx, ebx
test al, al
jne 0x140059994
mov r8d, ebx
nop dword [rax]
mov ecx, r8d
mov eax, r8d
inc r8d
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, edx
xor eax, ecx
mov ecx, eax
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, edx
xor eax, ecx
mov ecx, eax
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, edx
xor eax, ecx
mov ecx, eax
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, edx
xor eax, ecx
add edx, eax
cmp r8d, 0x100
jl 0x140059900
mov dword [0x1401ddd80], edx
lea eax, [rdx + 1]
lea ecx, [rdx + 2]
mov dword [rbp - 0x50], 0x100029
mov dword [rbp - 0x4c], 0x100008
mov dword [rbp - 0x48], 0x180018
mov dword [rbp - 0x44], 0x50035
imul ecx, eax
imul ecx, edx
mov eax, 0x92492493
mov dword [rbp - 0x40], 0xc001e
mov dword [rbp - 0x3c], 0x350000
mov dword [rbp - 0x38], 0x50019
mov dword [rbp - 0x34], 0xe0017
mov dword [rbp - 0x30], 0x4001c
imul ecx
add edx, ecx
mov dword [rbp - 0x2c], 0x16000f
mov dword [rbp - 0x28], 0x430007
sar edx, 3
mov dword [rbp - 0x24], 0x60012
mov dword [rbp - 0x20], 0x1d001b
mov eax, edx
mov dword [rbp - 0x1c], 0xf000c
mov dword [rbp - 0x18], 0x54
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 7
jne 0x140059a31
call fcn.1400d7b94
mov dword [0x1401ddd80], eax
lea rax, [0x1401d93b0]
lea rdx, [0x1401d8d90]
nop
movzx ecx, byte [rbx + rdx]
inc rbx
xor cx, word [rbp + rbx*2 - 0x52]
mov word [rax + rbx*2 - 2], cx
cmp rbx, 0x1d
jl 0x140059a40
mov byte [0x1401dfd26], 1
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x70
pop rbp
ret
Function at 0x140059a80
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401dfd11], 0
je 0x140059ab9
lea rax, [0x1401d9c50]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x40
pop rbp
ret
xor r8d, r8d
mov dword [rbp - 0x40], 0x180009
mov dword [rbp - 0x3c], 0x45000e
mov dword [rbp - 0x38], 0x20002f
mov dword [rbp - 0x34], 0x19002d
mov dword [rbp - 0x30], 0xd0055
mov word [rbp - 0x14], r8w
mov eax, r8d
mov dword [rbp - 0x2c], 1
mov dword [rbp - 0x28], 0x20018
mov dword [rbp - 0x24], 0x470015
mov dword [rbp - 0x20], 0x190015
mov dword [rbp - 0x1c], 1
mov dword [rbp - 0x18], 0x4d0000
lea r10, [0x1401d9c50]
lea r9, [0x1401d8d91]
nop
movzx ecx, byte [rax + r9 - 1]
movzx edx, word [rbp + rax*2 - 0x3e]
add rax, 2
xor cx, word [rbp + rax*2 - 0x44]
mov word [r10 + rax*2 - 4], cx
movzx ecx, byte [rax + r9 - 2]
xor dx, cx
mov word [r10 + rax*2 - 2], dx
cmp rax, 0x16
jl 0x140059b20
mov r11d, dword [0x1401ddd80]
mov eax, 0x88888889
mov ecx, r11d
imul ecx, r11d
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 0xd
jne 0x140059c17
nop
mov ecx, r8d
mov eax, r8d
inc r8d
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, r11d
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, r11d
xor eax, ecx
mov ecx, eax
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, r11d
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, r11d
xor eax, ecx
mov ecx, eax
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, r11d
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, r11d
xor eax, ecx
mov ecx, eax
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, r11d
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, r11d
xor eax, ecx
add r11d, eax
cmp r8d, 0x100
jl 0x140059b80
lea r9d, [r11 + 1]
mov eax, 0x92492493
mov byte [0x1401dfd11], 1
mov r8d, r9d
imul r8d, r11d
imul r8d
mov rax, r10
add edx, r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 7
sub r8d, edx
cmp r8d, 3
cmove r11d, r9d
mov dword [0x1401ddd80], r11d
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x40
pop rbp
ret
Function at 0x140059f90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov ebx, dword [0x1401ddd80]
lea eax, [rbx + 1]
lea ecx, [rbx + 2]
imul ecx, eax
mov eax, 0x78787879
imul ecx, ebx
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 2
jne 0x140059ff1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov ebx, dword [0x1401ddd80]
lea r8d, [rbx + 1]
mov eax, 0x2e8ba2e9
xor ecx, ecx
imul r8d, ebx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, 0x10
jne 0x14005a043
mov r9d, ecx
lea r10, [rsp + 0x20]
mov r11d, ebx
nop word [rax + rax]
inc r9d
dec r11d
lea r10, [r10 + 4]
movsxd rax, r9d
cmp rax, 0x6b
jb 0x14005a030
cmp byte [0x1401dfd35], cl
lea rax, [0x1401d98e0]
jne 0x14005a122
mov dword [rbp + 0xd0], 0x11002f
mov dword [rbp + 0xd4], 0x350016
mov dword [rbp + 0xd8], 0x30019
mov dword [rbp + 0xdc], 0x2b0002
mov dword [rbp + 0xe0], 0xd0011
mov dword [rbp + 0xe4], 0x1c
mov dword [rbp + 0xe8], 0x1f0018
mov dword [rbp + 0xec], 0x80041
mov dword [rbp + 0xf0], 0x410016
mov dword [rbp + 0xf4], 0x1c0024
mov dword [rbp + 0xf8], 0x70015
mov dword [rbp + 0xfc], 0xe0038
mov dword [rbp + 0x100], 0x30010
mov dword [rbp + 0x104], 0x190008
mov dword [rbp + 0x108], 0x54000d
mov dword [rbp + 0x10c], 0x51
lea r8, [0x1401d8d90]
nop dword [rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rbp + rcx*2 + 0xce]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x1f
jl 0x14005a100
mov byte [0x1401dfd35], 1
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.1400d72a0
mov rbx, qword [rsp + 0x230]
add rsp, 0x220
pop rbp
ret

Function at 0x14005a150
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp byte [0x1401dfd13], 0
je 0x14005a185
lea rax, [0x1401d9920]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x48
ret
mov r8d, dword [0x1401ddd80]
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x66666667
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
cmp ecx, 7
jne 0x14005a1d3
call fcn.1400d7b94
mov r8d, dword [0x1401ddd80]
cmp r8d, eax
jne 0x14005a1d3
dec r8d
mov dword [0x1401ddd80], r8d
mov dword [rsp + 0x20], 0x1a0045
mov dword [rsp + 0x24], 0x13000d
mov dword [rsp + 0x28], 0x5a000a
mov dword [rsp + 0x2c], 0x440055
mov dword [rsp + 0x30], 0x50011
mov dword [rsp + 0x34], 2
xor eax, eax
lea rdx, [0x1401d9920]
lea r9, [0x1401d8d90]
movzx ecx, byte [rax + r9]
inc rax
xor cx, word [rsp + rax*2 + 0x1e]
mov word [rdx + rax*2 - 2], cx
cmp rax, 0xb
jl 0x14005a213
mov ecx, r8d
mov byte [0x1401dfd13], 1
imul ecx, r8d
imul ecx, r8d
and ecx, 0x80000007
jge 0x14005a24c
dec ecx
or ecx, 0xfffffff8
inc ecx
cmp ecx, 6
jne 0x14005a264
mov eax, 1
test r8d, r8d
cmove r8d, eax
mov dword [0x1401ddd80], r8d
mov rax, rdx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x48
ret
Function at 0x14005a6a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401dfd23], 0
je 0x14005a6d0
lea rax, [0x1401d9c28]
jmp 0x14005a831
call fcn.1400589c0
test al, al
jne 0x14005a6ee
mov edx, 0xc9
lea rcx, [0x14016469c]
lea r8d, [rdx + 1]
call fcn.1400d7c60
xor edx, edx
mov dword [rbp - 0x30], 0x1c000b
mov dword [rbp - 0x2c], 0x13003d
mov dword [rbp - 0x28], 0x1e000e
mov dword [rbp - 0x24], 0x30012
mov dword [rbp - 0x20], 0x7001a
mov word [rbp - 0xc], dx
mov dword [rbp - 0x1c], 0x60031
mov dword [rbp - 0x18], 0xd0003
mov dword [rbp - 0x14], 0xf
mov dword [rbp - 0x10], 0x3e0015
lea rbx, [0x1401d9c28]
lea r8, [0x1401d8d91]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rbp + rdx*2 - 0x2e]
add rdx, 6
xor ax, word [rbp + rdx*2 - 0x3c]
mov word [rbx + rdx*2 - 0xc], ax
movzx eax, byte [rdx + r8 - 6]
xor cx, ax
movzx eax, byte [rdx + r8 - 5]
xor ax, word [rbp + rdx*2 - 0x38]
mov word [rbx + rdx*2 - 0xa], cx
mov word [rbx + rdx*2 - 8], ax
movzx eax, byte [rdx + r8 - 4]
xor ax, word [rbp + rdx*2 - 0x36]
mov word [rbx + rdx*2 - 6], ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rbp + rdx*2 - 0x34]
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rbp + rdx*2 - 0x32]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0x12
jl 0x14005a741
mov r8d, dword [0x1401ddd80]
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x2aaaaaab
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 1
jne 0x14005a827
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x141
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400d68e8
mov rcx, rax
call fcn.1400d834c
mov byte [0x1401dfd23], 1
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d72a0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14005a850
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x38
cmp byte [0x1401dfd10], 0
jne 0x14005a963
mov r9d, dword [0x1401ddd80]
mov eax, 0x30c30c31
mov ecx, r9d
imul ecx, r9d
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xc
jne 0x14005a8da
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r9d, edx
add r9d, 0x141
movsxd rcx, r9d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400d68e8
mov rcx, rax
call fcn.1400d834c
mov r9d, dword [0x1401ddd80]
movzx ecx, byte [0x1401d8d91]
movzx eax, byte [0x1401d8d90]
lea r8d, [r9 + 2]
xor cl, 0x5a
xor al, 0x30
movzx ecx, cl
movzx eax, al
mov word [0x1401d9c0a], cx
movzx ecx, byte [0x1401d8d92]
mov word [0x1401d9c08], ax
xor cl, 0x3a
mov eax, 0x30c30c31
movzx ecx, cl
mov word [0x1401d9c0c], cx
lea ecx, [r9 + 1]
imul r8d, ecx
imul r8d, r9d
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 1
jne 0x14005a95c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov byte [0x1401dfd10], 1
lea rax, [0x1401d9c08]
add rsp, 0x38
ret
Function at 0x14005ade0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x3d8
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rsp + 0x3c8], rax
cmp byte [0x1401dfd2e], 0
je 0x14005ae21
lea rax, [0x1401d98b8]
mov rcx, qword [rsp + 0x3c8]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x3d8
ret
xor r9d, r9d
mov dword [rsp + 0x3a0], 0x20006
mov dword [rsp + 0x3a4], 0x3a0012
mov dword [rsp + 0x3a8], 0x1c0002
mov dword [rsp + 0x3ac], 0x350002
mov dword [rsp + 0x3b0], 1
mov word [rsp + 0x3c0], r9w
mov edx, r9d
mov dword [rsp + 0x3b4], 3
mov dword [rsp + 0x3b8], 0x3000f
mov dword [rsp + 0x3bc], 0x130014
lea r10, [0x1401d98b8]
lea r8, [0x1401d8d91]
nop word [rax + rax]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rsp + rdx*2 + 0x3a2]
add rdx, 4
xor ax, word [rsp + rdx*2 + 0x398]
mov word [r10 + rdx*2 - 8], ax
movzx eax, byte [rdx + r8 - 4]
xor cx, ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rsp + rdx*2 + 0x39c]
mov word [r10 + rdx*2 - 6], cx
mov word [r10 + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rsp + rdx*2 + 0x39e]
mov word [r10 + rdx*2 - 2], ax
cmp rdx, 0x10
jl 0x14005aea0
mov ecx, dword [0x1401ddd80]
mov eax, 0x92492493
lea r8d, [rcx + 1]
imul r8d, ecx
imul r8d
add edx, r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
sub r8d, edx
cmp r8d, 3
jne 0x14005af51
lea r8, [rsp]
mov edx, dword [r8]
inc r9d
lea r8, [r8 + 4]
imul edx, edx, 0x4b
add ecx, edx
movsxd rdx, r9d
cmp rdx, 0x39c
jb 0x14005af30
mov dword [0x1401ddd80], ecx
mov byte [0x1401dfd2e], 1
mov rax, r10
mov rcx, qword [rsp + 0x3c8]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x3d8
ret

Function at 0x14005af80
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401dfd36], 0
lea rax, [0x1401d9698]
jne 0x14005b090
xor r8d, r8d
mov dword [rbp - 0x40], 0x40027
mov dword [rbp - 0x3c], 0xb0007
mov dword [rbp - 0x38], 0x1e003b
mov dword [rbp - 0x34], 0x9000e
mov dword [rbp - 0x30], 0x1a0010
mov word [rbp - 0x10], r8w
mov dword [rbp - 0x2c], 0x31001d
mov dword [rbp - 0x28], 0x70004
mov dword [rbp - 0x24], 0x90004
mov dword [rbp - 0x20], 0x70050
mov dword [rbp - 0x1c], 0x1a0009
mov dword [rbp - 0x18], 0x60018
mov dword [rbp - 0x14], 0x470010
lea r9, [0x1401d8d91]
nop
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 6
xor cx, word [rbp + r8*2 - 0x4c]
mov word [rax + r8*2 - 0xc], cx
movzx ecx, byte [r8 + r9 - 6]
xor dx, cx
movzx ecx, byte [r8 + r9 - 5]
xor cx, word [rbp + r8*2 - 0x48]
mov word [rax + r8*2 - 0xa], dx
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x18
jl 0x14005b010
mov byte [0x1401dfd36], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x40
pop rbp
ret
Function at 0x14005b0b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.140058770
or r14, 0xffffffffffffffff
mov esi, 4
test al, al
jne 0x14005b123
mov ecx, dword [0x1401ddd80]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, esi
imul edx, edx, 0x64
sub ecx, edx
add ecx, 0x2f4
movsxd rcx, ecx
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.1400d68e8
mov rcx, rax
call fcn.1400d834c
cmp byte [0x1401dfd0c], 0
mov qword [rsp + 0x90], rbx
je 0x14005b140
lea rax, [0x1401d94e0]
jmp 0x14005b2ed
mov qword [rsp + 0x98], rdi
call fcn.140058860
test al, al
jne 0x14005b16e
call fcn.1400d7b94
mov r9d, dword [0x1401ddd80]
cmp r9d, eax
jne 0x14005b175
dec r9d
mov dword [0x1401ddd80], r9d
jmp 0x14005b175
mov r9d, dword [0x1401ddd80]
lea ecx, [r9 + 1]
xor edi, edi
mov eax, 0xb21642c9
mov dword [rbp - 0x40], 0x6002b
mov dword [rbp - 0x3c], 0x40007
mov dword [rbp - 0x38], 0x9001f
imul ecx, r9d
imul ecx
add edx, ecx
mov dword [rbp - 0x34], 0xf0033
mov dword [rbp - 0x30], 0x60018
sar edx, 4
mov dword [rbp - 0x2c], 0x1a
mov dword [rbp - 0x28], 0x4003f
mov eax, edx
mov dword [rbp - 0x24], 0x20013
mov dword [rbp - 0x20], 0x50011
shr eax, 0x1f
mov dword [rbp - 0x1c], 0x530052
mov word [rbp - 0x18], di
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 8
jne 0x14005b214
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r9d, dword [0x1401ddd80]
lea rbx, [0x1401d94e0]
lea rdx, [0x1401d8d91]
movzx eax, byte [rdi + rdx - 1]
movzx ecx, word [rbp + rdi*2 - 0x3e]
add rdi, 5
xor ax, word [rbp + rdi*2 - 0x4a]
mov word [rbx + rdi*2 - 0xa], ax
movzx eax, byte [rdi + rdx - 5]
xor cx, ax
movzx eax, byte [rdi + rdx - 4]
xor ax, word [rbp + rdi*2 - 0x46]
mov word [rbx + rdi*2 - 8], cx
mov word [rbx + rdi*2 - 6], ax
movzx eax, byte [rdi + rdx - 3]
xor ax, word [rbp + rdi*2 - 0x44]
mov word [rbx + rdi*2 - 4], ax
movzx eax, byte [rdi + rdx - 2]
xor ax, word [rbp + rdi*2 - 0x42]
mov word [rbx + rdi*2 - 2], ax
cmp rdi, 0x14
jl 0x14005b222
mov rdi, qword [rsp + 0x98]
lea r8d, [r9 + 1]
mov eax, 0x38e38e39
imul r8d, r9d
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*8]
add ecx, ecx
sub r8d, ecx
cmp r8d, 0x10
jne 0x14005b2e3
mov eax, 0x51eb851f
imul r9d
mov rax, rsi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x64
sub r9d, edx
add r9d, 0x63
movsxd rcx, r9d
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.1400d68e8
mov rcx, rax
call fcn.1400d834c
mov byte [0x1401dfd0c], 1
mov rax, rbx
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d72a0
lea r11, [rsp + 0x80]
mov rsi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14005b320
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rbp - 8], rax
mov r9d, dword [0x1401ddd80]
mov eax, 0x30c30c31
lea ecx, [r9 + 1]
lea r8d, [r9 + 2]
imul r8d, ecx
imul r8d, r9d
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 0xb
jne 0x14005b372
dec dword [0x1401df728]
cmp byte [0x1401dfd2b], 0
je 0x14005b394
lea rax, [0x1401d9b00]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x40
pop rbp
ret
imul ecx, r9d
and ecx, 0x8000000f
jge 0x14005b3a7
dec ecx
or ecx, 0xfffffff0
inc ecx
cmp ecx, 0xd
jne 0x14005b3b2
dec dword [0x1401df764]
mov dword [rbp - 0x40], 0x26
xor r8d, r8d
mov dword [rbp - 0x3c], 0x90023
mov dword [rbp - 0x38], 0x30007
mov dword [rbp - 0x34], 0xb0002
mov dword [rbp - 0x30], 0xc0001
mov dword [rbp - 0x2c], 0xc0038
mov dword [rbp - 0x28], 0x180019
mov dword [rbp - 0x24], 0x60014
mov dword [rbp - 0x20], 0x2c001c
mov dword [rbp - 0x1c], 0x1e000d
mov dword [rbp - 0x18], 0x11001b
mov dword [rbp - 0x14], 0x5d000d
mov dword [rbp - 0x10], 0x52
lea rdx, [0x1401d9b00]
lea r9, [0x1401d8d91]
nop
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rbp + r8*2 - 0x3e]
add r8, 5
xor ax, word [rbp + r8*2 - 0x4a]
mov word [rdx + r8*2 - 0xa], ax
movzx eax, byte [r8 + r9 - 5]
xor cx, ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rbp + r8*2 - 0x46]
mov word [rdx + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0x19
jl 0x14005b420
mov byte [0x1401dfd2b], 1
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x40
pop rbp
ret
Function at 0x14005b4b0
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x38
cmp byte [0x1401dfd25], 0
jne 0x14005b5dc
mov r8d, dword [0x1401ddd80]
mov eax, 0xb21642c9
lea ecx, [r8 + 1]
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 8
jne 0x14005b50d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov r8d, dword [0x1401ddd80]
movzx eax, byte [0x1401d8d90]
lea ecx, [r8 + 2]
xor al, 0x45
movzx eax, al
mov word [0x1401d99c8], ax
movzx eax, byte [0x1401d8d91]
xor al, 0x13
movzx eax, al
mov word [0x1401d99ca], ax
movzx eax, byte [0x1401d8d92]
xor al, 0x10
movzx eax, al
mov word [0x1401d99cc], ax
movzx eax, byte [0x1401d8d93]
xor al, 4
movzx eax, al
mov word [reloc.OLEAUT32.dll_SysReAllocStringLen], ax
movzx eax, byte [0x1401d8d94]
xor al, 0x18
movzx eax, al
mov word [0x1401d99d0], ax
movzx eax, byte [0x1401d8d95]
xor al, 0x1c
movzx eax, al
mov word [0x1401d99d2], ax
movzx eax, byte [0x1401d8d96]
xor al, 0x28
movzx eax, al
mov word [0x1401d99d4], ax
lea eax, [r8 + 1]
imul ecx, eax
mov eax, 0x30c30c31
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 1
jne 0x14005b5d5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov byte [0x1401dfd25], 1
lea rax, [0x1401d99c8]
add rsp, 0x38
ret
Function at 0x14005b5f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401dfd15], 0
je 0x14005b629
lea rax, [0x1401d99d8]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 0x80], rbx
call fcn.140058700
mov ebx, 4
test al, al
jne 0x14005b681
mov ecx, dword [0x1401ddd80]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ebx
imul edx, edx, 0x64
sub ecx, edx
add ecx, 0x63
movsxd rcx, ecx
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400d68e8
mov rcx, rax
call fcn.1400d834c
mov rbx, qword [rsp + 0x80]
xor r10d, r10d
mov dword [rbp - 0x50], 0x1b0024
mov word [rbp - 0x18], r10w
mov edx, r10d
mov dword [rbp - 0x4c], 0xe000d
mov dword [rbp - 0x48], 0x1c001e
mov dword [rbp - 0x44], 0x180031
mov dword [rbp - 0x40], 0x1f001c
mov dword [rbp - 0x3c], 0x90007
mov dword [rbp - 0x38], 0xb000e
mov dword [rbp - 0x34], 0x310004
mov dword [rbp - 0x30], 0xd0011
mov dword [rbp - 0x2c], 0x16001d
mov dword [rbp - 0x28], 0x50054
mov dword [rbp - 0x24], 0xe0015
mov dword [rbp - 0x20], 0x14001e
mov dword [rbp - 0x1c], 0x4b000d
lea r9, [0x1401d99d8]
lea r8, [0x1401d8d91]
nop word [rax + rax]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rbp + rdx*2 - 0x4e]
add rdx, 4
xor ax, word [rbp + rdx*2 - 0x58]
mov word [r9 + rdx*2 - 8], ax
movzx eax, byte [rdx + r8 - 4]
xor cx, ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rbp + rdx*2 - 0x54]
mov word [r9 + rdx*2 - 6], cx
mov word [r9 + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rbp + rdx*2 - 0x52]
mov word [r9 + rdx*2 - 2], ax
cmp rdx, 0x1c
jl 0x14005b710
mov ecx, dword [0x1401ddd80]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x30c30c31
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 1
jne 0x14005b803
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
imul edx, edx, 0xb0
sub eax, edx
cmp eax, 0xf0
je 0x14005b7fc
nop word [rax + rax]
mov eax, ecx
inc r10d
or eax, 0xffffff18
add ecx, eax
mov eax, ecx
imul eax, ecx
cmp r10d, eax
jg 0x14005b7fc
mov eax, 0x2e8ba2e9
mov r8d, ecx
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb0
sub r8d, edx
cmp r8d, 0xf0
jne 0x14005b7c0
mov dword [0x1401ddd80], r10d
mov byte [0x1401dfd15], 1
mov rax, r9
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x70
pop rbp
ret