joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140050190
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x30], edi
mov r8d, dword [0x1401c6d80]
mov r9d, r8d
imul r9d, r8d
mov eax, 0x2e8ba2e9
imul r9d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub r9d, edx
cmp r9d, 0x13
jne 0x140050256
test r8d, r8d
je 0x140050256
mov eax, r8d
and eax, 0x80000001
jge 0x1400501f5
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x14005020c
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov dword [0x1401c6d80], eax
jmp 0x14005021b
lea r8d, [r8*2 + 1]
mov dword [0x1401c6d80], r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov ecx, r8d
sub ecx, eax
je 0x14005023f
sub ecx, 2
je 0x140050243
dec ecx
je 0x140050246
jmp 0x140050251
add r8d, 2
inc r8d
add r8d, 2
mov dword [0x1401c6d80], r8d
test r8d, r8d
jne 0x1400501e4
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx esi, al
movzx ecx, ax
shr cx, 8
movzx ebp, cl
cmp eax, 0x80000000
jae 0x140050275
mov edi, eax
shr edi, 0x10
cmp esi, 6
jb 0x140050292
cmp ebp, 2
jb 0x140050292
mov rcx, rbx
call fcn.1400505a0
nop
mov dword [rsp + 0x30], 1
jmp 0x1400502f9
lea rcx, [0x1401be9a8]
mov rax, qword [0x1401be9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x20], edi
mov r9d, ebp
mov r8d, esi
lea rdx, str._d._d___d_
lea rcx, [rsp + 0x68]
call fcn.140011890
mov rdi, qword [rsp + 0x68]
lea rcx, [rdi - 0x18]
call fcn.140002540
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x30], 1
lock add dword [rdi - 8], 0xffffffff
jg 0x1400502f9
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140051980
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x2f0]
sub rsp, 0x3f0
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
call fcn.140051550
cmp byte [0x1401c7f82], 0
je 0x1400519bc
lea rax, [0x1401c2b18]
jmp 0x140051b14
mov ecx, dword [0x1401c6d80]
mov eax, 0x30c30c31
xor r9d, r9d
mov r8d, ecx
mov dword [rbp + 0x2b0], 0x30016
mov dword [rbp + 0x2b4], 0x20006
mov dword [rbp + 0x2b8], 0xf
mov dword [rbp + 0x2bc], 0x60037
mov dword [rbp + 0x2c0], 0x2d000c
imul r8d, ecx
imul r8d
sar edx, 2
mov dword [rbp + 0x2c4], 0x13000c
mov dword [rbp + 0x2c8], 0xc0010
mov eax, edx
mov dword [rbp + 0x2cc], 0x100016
mov dword [rbp + 0x2d0], 0x1c0039
shr eax, 0x1f
mov dword [rbp + 0x2d4], 0xc0002
mov dword [rbp + 0x2d8], 0x1f0014
add edx, eax
mov dword [rbp + 0x2dc], 0x11
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 0xc
jne 0x140051a8a
mov r8d, 1
cmp ecx, r8d
jle 0x140051a81
nop dword [rax]
mov eax, ecx
cdq
idiv r8d
inc r8d
add r8d, edx
cmp r8d, ecx
jl 0x140051a70
mov ecx, r8d
mov dword [0x1401c6d80], ecx
mov rdx, r9
lea r10, [0x1401c2b18]
lea r8, [0x1401c1da0]
nop dword [rax + rax]
movzx eax, byte [rdx + r8]
inc rdx
xor ax, word [rbp + rdx*2 + 0x2ae]
mov word [r10 + rdx*2 - 2], ax
cmp rdx, 0x17
jl 0x140051aa0
mov r8d, ecx
mov eax, 0x66666667
mov byte [0x1401c7f82], 1
imul r8d, ecx
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub r8d, eax
cmp r8d, 3
jne 0x140051b11
lea r8, [rsp + 0x20]
nop dword [rax]
mov edx, dword [r8]
inc r9d
lea r8, [r8 + 4]
imul edx, edx, 0x15
add ecx, edx
movsxd rdx, r9d
cmp rdx, 0x390
jb 0x140051af0
mov dword [0x1401c6d80], ecx
mov rax, r10
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x3f0
pop rbp
ret
Function at 0x140051bf0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401c7fa6], 0
je 0x140051c29
lea rax, [0x1401c29a8]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x40
pop rbp
ret
xor eax, eax
mov dword [rbp - 0x40], 0x14001e
mov dword [rbp - 0x3c], 0x31001f
mov dword [rbp - 0x38], 0xa001f
mov dword [rbp - 0x34], 0xa000d
mov dword [rbp - 0x30], 0x170013
mov word [rbp - 0xc], ax
mov dword [rbp - 0x2c], 0x15000c
mov dword [rbp - 0x28], 0x90010
mov dword [rbp - 0x24], 0x7003d
mov dword [rbp - 0x20], 0x60003
mov dword [rbp - 0x1c], 0x160004
mov dword [rbp - 0x18], 0x2f0015
mov dword [rbp - 0x14], 0xe
mov dword [rbp - 0x10], 0x1d001e
lea r9, [0x1401c29a8]
lea r8, [0x1401c1da1]
nop dword [rax + rax]
movzx ecx, byte [rax + r8 - 1]
movzx edx, word [rbp + rax*2 - 0x3e]
add rax, 2
xor cx, word [rbp + rax*2 - 0x44]
mov word [r9 + rax*2 - 4], cx
movzx ecx, byte [rax + r8 - 2]
xor dx, cx
mov word [r9 + rax*2 - 2], dx
cmp rax, 0x1a
jl 0x140051ca0
mov ecx, dword [0x1401c6d80]
mov byte [0x1401c7fa6], 1
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0xb21642c9
imul r8d, ecx
imul r8d
add edx, r8d
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x17
sub r8d, edx
cmp r8d, 0x13
jne 0x140051d12
inc dword [0x1401c7c6c]
mov rax, r9
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x40
pop rbp
ret

Function at 0x140051d30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401c7fa4], 0
lea rax, [0x1401c2718]
jne 0x140051e0c
xor r8d, r8d
mov dword [rsp], 0xa0013
mov dword [rsp + 4], 0x16002a
mov dword [rsp + 8], 0x100003
mov dword [rsp + 0xc], 0x1d002b
mov dword [rsp + 0x10], 0x170007
mov word [rsp + 0x20], r8w
mov dword [rsp + 0x14], 0x20049
mov dword [rsp + 0x18], 0x9001a
mov dword [rsp + 0x1c], 0x480007
lea r9, [0x1401c1da1]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rsp + r8*2 + 2]
add r8, 4
xor cx, word [rsp + r8*2 - 8]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x10
jl 0x140051db0
mov byte [0x1401c7fa4], 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x38
ret
Function at 0x140051fe0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, dword [0x1401c6d80]
mov eax, 0x2aaaaaab
imul ecx, ecx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov edx, 0xac971bba
shl eax, 3
sub ecx, eax
mov eax, dword [0x1401c7b54]
cmp ecx, 6
cmove eax, edx
cmp byte [0x1401c7fb3], 0
mov dword [0x1401c7b54], eax
lea rax, [0x1401c26c0]
jne 0x1400520cf
mov dword [rbp - 0x50], 0x60031
mov dword [rbp - 0x4c], 0x1b0005
mov dword [rbp - 0x48], 0x100019
mov dword [rbp - 0x44], 0x1d003c
mov dword [rbp - 0x40], 0x170008
mov dword [rbp - 0x3c], 0x310001
mov dword [rbp - 0x38], 0x40007
mov dword [rbp - 0x34], 0x1c0014
mov dword [rbp - 0x30], 0xe000a
mov dword [rbp - 0x2c], 0x7000c
mov qword [rbp - 0x28], 0x500003
xor ecx, ecx
mov dword [rbp - 0x20], 0x5001b
mov dword [rbp - 0x1c], 0x60010
mov dword [rbp - 0x18], 0x47
lea r8, [0x1401c1da0]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rbp + rcx*2 - 0x52]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x1d
jl 0x1400520b0
mov byte [0x1401c7fb3], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x50
pop rbp
ret

Function at 0x1400520f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401c7f9d], 0
lea rax, [0x1401c27e0]
jne 0x1400521b7
xor ecx, ecx
mov dword [rbp - 0x40], 0xe0011
mov dword [rbp - 0x3c], 0x4e0003
mov dword [rbp - 0x38], 0x28002e
mov dword [rbp - 0x34], 0x10024
mov dword [rbp - 0x30], 0x160043
mov word [rbp - 0x14], cx
mov dword [rbp - 0x2c], 0x40000
mov dword [rbp - 0x28], 0x30006
mov dword [rbp - 0x24], 0x550016
mov dword [rbp - 0x20], 0x130003
mov dword [rbp - 0x1c], 0x110002
mov dword [rbp - 0x18], 0x5e0004
lea r9, [0x1401c1da1]
nop word [rax + rax]
movzx edx, byte [rcx + r9 - 1]
movzx r8d, word [rbp + rcx*2 - 0x3e]
add rcx, 2
xor dx, word [rbp + rcx*2 - 0x44]
mov word [rax + rcx*2 - 4], dx
movzx edx, byte [rcx + r9 - 2]
xor r8w, dx
mov word [rax + rcx*2 - 2], r8w
cmp rcx, 0x16
jl 0x140052180
mov byte [0x1401c7f9d], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x40
pop rbp
ret
Function at 0x140052450
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401c7f8b], 0
lea rax, str.7_ae_
jne 0x14005251f
mov dword [rbp - 0x50], 0x70037
mov dword [rbp - 0x4c], 0x3e001b
mov dword [rbp - 0x48], 0xb0018
mov dword [rbp - 0x44], 0x33000b
mov dword [rbp - 0x40], 0x160007
mov dword [rbp - 0x3c], 0x4001d
mov dword [rbp - 0x38], 0x1e0006
mov dword [rbp - 0x34], 0x1a0042
xor ecx, ecx
mov dword [rbp - 0x30], 0x4b0000
mov dword [rbp - 0x2c], 0xd0027
mov dword [rbp - 0x28], 0x140011
mov dword [rbp - 0x24], 0x8002a
mov dword [rbp - 0x20], 0x1b0010
mov dword [rbp - 0x1c], 0x100014
mov dword [rbp - 0x18], 0x58001e
mov dword [rbp - 0x14], 0x46
lea r8, [0x1401c1da0]
nop word [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rbp + rcx*2 - 0x52]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x1f
jl 0x140052500
mov byte [0x1401c7f8b], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x50
pop rbp
ret

Function at 0x140052540
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r8d, dword [0x1401c6d80]
mov eax, 0x2aaaaaab
mov ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 8
jne 0x14005258e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov r8d, dword [0x1401c6d80]
cmp byte [0x1401c7f9f], 0
je 0x1400525b0
lea rax, [0x1401c2bd0]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x48
ret
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
mov qword [rsp + 0x50], rbx
xor ebx, ebx
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x20], 0xc005d
imul ecx, eax
imul ecx, r8d
mov eax, 0x78787879
mov dword [rsp + 0x24], 0x180000
mov dword [rsp + 0x28], 0x52000b
mov dword [rsp + 0x2c], 0x5c005c
lea edi, [rbx + 7]
mov dword [rsp + 0x30], 0x1e0007
imul ecx
sar edx, 3
mov dword [rsp + 0x34], 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 3
jne 0x140052638
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401c6d80]
test rax, rax
cmove ecx, edi
mov dword [0x1401c6d80], ecx
mov rdi, qword [rsp + 0x40]
lea rax, [0x1401c2bd0]
lea rdx, [0x1401c1da0]
nop dword [rax + rax]
movzx ecx, byte [rbx + rdx]
inc rbx
xor cx, word [rsp + rbx*2 + 0x1e]
mov word [rax + rbx*2 - 2], cx
cmp rbx, 0xb
jl 0x140052650
mov byte [0x1401c7f9f], 1
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x48
ret
Function at 0x140052690
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401c7fae], 0
je 0x1400526c9
lea rax, [0x1401c2740]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x60
pop rbp
ret
xor eax, eax
mov dword [rbp - 0x60], 0xe0011
mov dword [rbp - 0x5c], 0x10003
mov dword [rbp - 0x58], 0x440009
mov dword [rbp - 0x54], 0x13000e
mov dword [rbp - 0x50], 0x1e000a
mov word [rbp - 0x20], ax
mov dword [rbp - 0x4c], 0x5000a
mov dword [rbp - 0x48], 0x1d0055
mov dword [rbp - 0x44], 0x1a0010
mov dword [rbp - 0x40], 0x4b0005
mov dword [rbp - 0x3c], 0x110002
mov dword [rbp - 0x38], 0x40050
mov dword [rbp - 0x34], 0x130003
mov dword [rbp - 0x30], 0x1f
mov dword [rbp - 0x2c], 0x3001b
mov dword [rbp - 0x28], 0xb0013
mov dword [rbp - 0x24], 0x50008
lea r11, [0x1401c2740]
lea r8, [0x1401c1da1]
nop dword [rax]
movzx ecx, byte [rax + r8 - 1]
movzx edx, word [rbp + rax*2 - 0x5e]
add rax, 4
xor cx, word [rbp + rax*2 - 0x68]
mov word [r11 + rax*2 - 8], cx
movzx ecx, byte [rax + r8 - 4]
xor dx, cx
movzx ecx, byte [rax + r8 - 3]
xor cx, word [rbp + rax*2 - 0x64]
mov word [r11 + rax*2 - 6], dx
mov word [r11 + rax*2 - 4], cx
movzx ecx, byte [rax + r8 - 2]
xor cx, word [rbp + rax*2 - 0x62]
mov word [r11 + rax*2 - 2], cx
cmp rax, 0x20
jl 0x140052750
mov r10d, dword [0x1401c6d80]
mov eax, 0x92492493
mov byte [0x1401c7fae], 1
lea r9d, [r10 + 1]
mov r8d, r9d
imul r8d, r10d
imul r8d
mov rax, r11
add edx, r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0xe
sub r8d, edx
cmp r8d, 0xd
cmove r10d, r9d
mov dword [0x1401c6d80], r10d
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x60
pop rbp
ret

Function at 0x140052880
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401c7f96], 0
lea rax, [0x1401c2510]
jne 0x14005292f
mov dword [rbp - 0x40], 0x30013
mov dword [rbp - 0x3c], 0x1a0001
mov dword [rbp - 0x38], 0x2004a
mov dword [rbp - 0x34], 0x1c0001
mov dword [rbp - 0x30], 0x520007
mov dword [rbp - 0x2c], 0x14000c
mov dword [rbp - 0x28], 0x1f0007
mov dword [rbp - 0x24], 0x1b0007
mov dword [rbp - 0x20], 0x260012
mov dword [rbp - 0x1c], 0x60004
mov dword [rbp - 0x18], 0x1c0005
mov dword [rbp - 0x14], 3
xor ecx, ecx
lea r8, [0x1401c1da0]
nop dword [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rbp + rcx*2 - 0x42]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x17
jl 0x140052910
mov byte [0x1401c7f96], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x40
pop rbp
ret
Function at 0x140052950
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401c7f84], 0
lea rax, [0x1401c2b80]
jne 0x140052a2c
xor r8d, r8d
mov dword [rsp], 0x14001e
mov dword [rsp + 4], 0x31001f
mov dword [rsp + 8], 0x140003
mov dword [rsp + 0xc], 0x2d000b
mov dword [rsp + 0x10], 0x1b0017
mov word [rsp + 0x20], r8w
mov dword [rsp + 0x14], 0x40002
mov dword [rsp + 0x18], 0x20011
mov dword [rsp + 0x1c], 0x10017
lea r9, [0x1401c1da1]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rsp + r8*2 + 2]
add r8, 4
xor cx, word [rsp + r8*2 - 8]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x10
jl 0x1400529d0
mov byte [0x1401c7f84], 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x38
ret

Function at 0x140052a40
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401c7f8a], 0
lea rax, [0x1401c2a18]
jne 0x140052b50
xor r8d, r8d
mov dword [rbp - 0x40], 0x12003f
mov dword [rbp - 0x3c], 0xa
mov dword [rbp - 0x38], 0x16003a
mov dword [rbp - 0x34], 0x110007
mov dword [rbp - 0x30], 0x10006
mov word [rbp - 0x10], r8w
mov dword [rbp - 0x2c], 0x35001c
mov dword [rbp - 0x28], 0x6001a
mov dword [rbp - 0x24], 0x1b0007
mov dword [rbp - 0x20], 0xd0046
mov dword [rbp - 0x1c], 0xb000a
mov dword [rbp - 0x18], 0x15001c
mov dword [rbp - 0x14], 0x410002
lea r9, [0x1401c1da1]
nop
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 6
xor cx, word [rbp + r8*2 - 0x4c]
mov word [rax + r8*2 - 0xc], cx
movzx ecx, byte [r8 + r9 - 6]
xor dx, cx
movzx ecx, byte [r8 + r9 - 5]
xor cx, word [rbp + r8*2 - 0x48]
mov word [rax + r8*2 - 0xa], dx
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x18
jl 0x140052ad0
mov byte [0x1401c7f8a], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x40
pop rbp
ret
Function at 0x140052b70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401c7f8c], 0
je 0x140052ba0
lea rax, [0x1401c2860]
jmp 0x140052c96
xor edx, edx
mov dword [rbp - 0x40], 0x100033
mov dword [rbp - 0x3c], 0xf000a
mov dword [rbp - 0x38], 0x1001e
mov dword [rbp - 0x34], 0x17003a
mov dword [rbp - 0x30], 0x1d000e
mov word [rbp - 0x18], dx
mov dword [rbp - 0x2c], 0x4001b
mov dword [rbp - 0x28], 0x50021
mov dword [rbp - 0x24], 0x100010
mov dword [rbp - 0x20], 0xf0007
mov dword [rbp - 0x1c], 0x420051
lea rbx, [0x1401c2860]
lea r8, [0x1401c1da1]
nop word [rax + rax]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rbp + rdx*2 - 0x3e]
add rdx, 5
xor ax, word [rbp + rdx*2 - 0x4a]
mov word [rbx + rdx*2 - 0xa], ax
movzx eax, byte [rdx + r8 - 5]
xor cx, ax
movzx eax, byte [rdx + r8 - 4]
xor ax, word [rbp + rdx*2 - 0x46]
mov word [rbx + rdx*2 - 8], cx
mov word [rbx + rdx*2 - 6], ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rbp + rdx*2 - 0x44]
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rbp + rdx*2 - 0x42]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0x14
jl 0x140052c00
mov ecx, dword [0x1401c6d80]
mov eax, 0x66666667
imul ecx, ecx
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0x13
jne 0x140052c8c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov byte [0x1401c7f8c], 1
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cc8b0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x140052cb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401c7fb4], 0
lea rax, [0x1401c2910]
jne 0x140052dae
mov dword [rbp - 0x40], 0x16003e
mov dword [rbp - 0x3c], 0x2002e
mov dword [rbp - 0x38], 0xb0006
mov dword [rbp - 0x34], 0x13000b
mov dword [rbp - 0x30], 0x170017
mov dword [rbp - 0x2c], 0x80039
mov dword [rbp - 0x28], 0x190007
mov dword [rbp - 0x24], 0x140017
mov dword [rbp - 0x20], 0x26000a
mov dword [rbp - 0x1c], 0xf000e
mov dword [rbp - 0x18], 0x2001f
mov dword [rbp - 0x14], 0x5b001f
mov dword [rbp - 0x10], 0x52
xor r8d, r8d
lea r9, [0x1401c1da1]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 5
xor cx, word [rbp + r8*2 - 0x4a]
mov word [rax + r8*2 - 0xa], cx
movzx ecx, byte [r8 + r9 - 5]
xor dx, cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 8], dx
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x19
jl 0x140052d40
mov byte [0x1401c7fb4], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x40
pop rbp
ret
Function at 0x140052eb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401c7fa3], 0
lea rax, [0x1401c2350]
jne 0x140052fac
xor r8d, r8d
mov dword [rbp - 0x50], 0xd003c
mov dword [rbp - 0x4c], 0x50000
mov dword [rbp - 0x48], 0x14001f
mov dword [rbp - 0x44], 0x38
mov dword [rbp - 0x40], 0x4000a
mov word [rbp - 0x18], r8w
mov dword [rbp - 0x3c], 0xd0006
mov dword [rbp - 0x38], 0xa0010
mov dword [rbp - 0x34], 0x230007
mov dword [rbp - 0x30], 0x70007
mov dword [rbp - 0x2c], 0x7001e
mov dword [rbp - 0x28], 0x160050
mov dword [rbp - 0x24], 0x80007
mov dword [rbp - 0x20], 0xc001e
mov dword [rbp - 0x1c], 0x420011
lea r9, [0x1401c1da1]
nop dword [rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x4e]
add r8, 4
xor cx, word [rbp + r8*2 - 0x58]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x54]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x52]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x1c
jl 0x140052f50
mov byte [0x1401c7fa3], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x50
pop rbp
ret
Function at 0x140053260
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401c7f85], 0
je 0x140053295
lea rax, [0x1401c2540]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x38
ret
mov r8d, dword [0x1401c6d80]
mov eax, 0x66666667
xor ecx, ecx
mov dword [rsp], 0x14001e
mov dword [rsp + 4], 0x31001f
mov dword [rsp + 8], 0x100019
imul r8d, r8d
imul r8d
sar edx, 1
mov dword [rsp + 0xc], 0x2d000c
mov dword [rsp + 0x10], 0xa0006
mov eax, edx
mov dword [rsp + 0x14], 0x4000c
mov dword [rsp + 0x18], 0x190005
shr eax, 0x1f
mov dword [rsp + 0x1c], 0x1a000b
mov dword [rsp + 0x20], 8
add edx, eax
lea eax, [rdx + rdx*4]
sub r8d, eax
cmp r8d, 2
jne 0x14005330c
inc dword [0x1401c7c1c]
lea rax, [0x1401c2540]
lea r8, [0x1401c1da0]
nop word [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 - 2]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x11
jl 0x140053320
mov byte [0x1401c7f85], 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400cc8b0
add rsp, 0x38
ret

Function at 0x140053360
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401c7f97], 0
je 0x140053390
lea rax, [0x1401c2438]
jmp 0x1400534b2
xor r9d, r9d
mov dword [rbp - 0x40], 0x14001e
mov dword [rbp - 0x3c], 0x31001f
mov dword [rbp - 0x38], 0xa001f
mov dword [rbp - 0x34], 0xa000d
mov dword [rbp - 0x30], 0x170013
mov word [rbp - 0x10], r9w
mov edx, r9d
mov dword [rbp - 0x2c], 0x15000c
mov dword [rbp - 0x28], 0x90010
mov dword [rbp - 0x24], 0x10003d
mov dword [rbp - 0x20], 0x8001e
mov dword [rbp - 0x1c], 0x12000e
mov dword [rbp - 0x18], 0x190004
mov dword [rbp - 0x14], 0xf0009
lea rbx, [0x1401c2438]
lea r8, [0x1401c1da1]
nop dword [rax]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rbp + rdx*2 - 0x3e]
add rdx, 6
xor ax, word [rbp + rdx*2 - 0x4c]
mov word [rbx + rdx*2 - 0xc], ax
movzx eax, byte [rdx + r8 - 6]
xor cx, ax
movzx eax, byte [rdx + r8 - 5]
xor ax, word [rbp + rdx*2 - 0x48]
mov word [rbx + rdx*2 - 0xa], cx
mov word [rbx + rdx*2 - 8], ax
movzx eax, byte [rdx + r8 - 4]
xor ax, word [rbp + rdx*2 - 0x46]
mov word [rbx + rdx*2 - 6], ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rbp + rdx*2 - 0x44]
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rbp + rdx*2 - 0x42]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0x18
jl 0x140053400
mov eax, dword [0x1401c6d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xd
jne 0x1400534a8
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r9
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov byte [0x1401c7f97], 1
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400cc8b0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret