joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003ae0c
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
cmp byte [0x14018d864], al
je 0x14003ae39
lea rax, [0x140188510]
jmp 0x14003aec1
mov dword [rbp - 0x40], 0x40002
mov dword [rbp - 0x3c], 0x10002
mov r11d, 1
mov dword [rbp - 0x38], 0xd0044
mov dword [rbp - 0x34], 0xb0006
mov dword [rbp - 0x30], 0x4d0007
mov dword [rbp - 0x2c], 0x40005
mov dword [rbp - 0x28], 0x1c0006
mov dword [rbp - 0x24], 0x50000
mov dword [rbp - 0x20], 0x3d0001
mov dword [rbp - 0x1c], 0x100000
mov dword [rbp - 0x18], 0x50007
mov dword [rbp - 0x14], 0x11
lea rdx, [0x140188510]
lea rcx, [0x140187da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x40]
mov word [rdx + rax*2], cx
add rax, r11
cmp rax, 0x17
jl 0x14003ae9a
mov byte [0x14018d864], r11b
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x40
pop rbp
ret

Function at 0x14003aed4
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 8], rax
xor eax, eax
cmp byte [0x14018d850], al
je 0x14003aefe
lea rax, [0x140188bb8]
jmp 0x14003af71
mov r9d, 0x10
mov dword [rbp - 0x30], 0x13000f
mov dword [rbp - 0x2c], 0x2a001c
mov dword [rbp - 0x28], 0x1b000d
mov dword [rbp - 0x24], 0x3a000c
mov dword [rbp - 0x20], 0x40017
lea r8d, [r9 - 0xf]
mov dword [rbp - 0x1c], 0x14000b
mov dword [rbp - 0x18], 0x10010
mov dword [rbp - 0x14], 0x1f0010
mov word [rbp - 0x10], ax
lea rdx, [0x140188bb8]
lea rcx, [0x140187da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x30]
mov word [rdx + rax*2], cx
add rax, r8
cmp rax, r9
jl 0x14003af4b
mov byte [0x14018d850], r8b
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x30
pop rbp
ret
Function at 0x14003af84
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 8], rax
mov r8d, dword [0x14018cd80]
mov eax, 0x78787879
xor ebx, ebx
mov ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 3
jne 0x14003b010
lea ecx, [rbx + 0x28]
call fcn.1400b0308
mov edi, ebx
mov rsi, rax
call fcn.1400b1650
add eax, dword [0x14018cd80]
mov dword [rsi + rdi*4], eax
inc rdi
cmp rdi, 0xa
jl 0x14003afe1
mov ecx, dword [rsi + 0x24]
mov dword [0x14018cd80], ecx
mov rcx, rsi
call fcn.1400b13b8
mov r8d, dword [0x14018cd80]
cmp byte [0x14018d855], bl
je 0x14003b024
lea rax, [0x140188a18]
jmp 0x14003b11a
mov ecx, r8d
mov eax, 0xb21642c9
mov r9d, 0x15
mov dword [rbp - 0x40], 0x15002e
mov dword [rbp - 0x3c], 0x1b0009
mov dword [rbp - 0x38], 0x190034
imul ecx, r8d
imul ecx
add edx, ecx
mov dword [rbp - 0x34], 0x60000
mov dword [rbp - 0x30], 0x1e0006
sar edx, 4
mov dword [rbp - 0x2c], 0x250015
mov dword [rbp - 0x28], 0x5001b
mov eax, edx
mov dword [rbp - 0x24], 0x50000
mov dword [rbp - 0x20], 0x160055
shr eax, 0x1f
mov dword [rbp - 0x1c], 0x1d000e
mov dword [rbp - 0x18], 0xc001e
add edx, eax
mov dword [rbp - 0x14], 0x4b0010
mov word [rbp - 0x10], bx
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, r9d
jne 0x14003b0ef
mov eax, r8d
lea r10d, [r9 - 0x14]
mov ecx, ebx
cdq
sub eax, edx
sar eax, 1
mov esi, eax
test esi, esi
jle 0x14003b0e8
mov eax, r8d
mov r9d, ebx
mov rdi, rsi
cdq
and edx, 3
add eax, edx
sar eax, 2
test eax, eax
jle 0x14003b0e0
mov edx, r9d
mov r11d, eax
add r10d, edx
dec edx
dec r11
jne 0x14003b0d6
add r9d, ecx
dec rdi
jne 0x14003b0cc
inc ecx
cmp ecx, r10d
jl 0x14003b0b6
lea rax, [0x140188a18]
lea rcx, [0x140187da0]
movzx ecx, byte [rbx + rcx]
xor cx, word [rbp + rbx*2 - 0x40]
mov word [rax + rbx*2], cx
inc rbx
cmp rbx, 0x18
jl 0x14003b0f6
mov byte [0x14018d855], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b0c90
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x14003b13c
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
cmp byte [0x14018d857], al
je 0x14003b166
lea rax, [0x140188888]
jmp 0x14003b1e3
mov dword [rbp - 0x40], 0x170022
mov dword [rbp - 0x3c], 0x140009
mov r9d, 0x14
mov dword [rbp - 0x38], 0xe0010
mov dword [rbp - 0x34], 0x3d
mov dword [rbp - 0x30], 0x2000e
mov dword [rbp - 0x2c], 0x140012
mov dword [rbp - 0x28], 0x60020
mov dword [rbp - 0x24], 0xe0017
mov dword [rbp - 0x20], 0x140014
mov dword [rbp - 0x1c], 0x540055
mov word [rbp - 0x18], ax
lea rdx, [0x140188888]
lea rcx, [0x140187da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x40]
mov word [rdx + rax*2], cx
inc rax
cmp rax, r9
jl 0x14003b1bd
mov byte [0x14018d857], 1
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x40
pop rbp
ret
Function at 0x14003b1f8
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 8], rax
xor eax, eax
cmp byte [0x14018d885], al
je 0x14003b225
lea rax, [0x140188940]
jmp 0x14003b2b3
mov dword [rbp - 0x40], 0x11002f
mov dword [rbp - 0x3c], 0x19002d
mov r9d, 0x19
mov dword [rbp - 0x38], 0x40008
mov dword [rbp - 0x34], 0x4000c
mov dword [rbp - 0x30], 0x80017
mov dword [rbp - 0x2c], 0x180030
mov dword [rbp - 0x28], 0x1a0006
mov dword [rbp - 0x24], 0xa0010
mov dword [rbp - 0x20], 0x3d0019
mov dword [rbp - 0x1c], 0x19000a
mov dword [rbp - 0x18], 0x1b001d
mov dword [rbp - 0x14], 0x51000d
mov dword [rbp - 0x10], 0x48
lea rdx, [0x140188940]
lea rcx, [0x140187da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x40]
mov word [rdx + rax*2], cx
inc rax
cmp rax, r9
jl 0x14003b28d
mov byte [0x14018d885], 1
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x40
pop rbp
ret

Function at 0x14003b2c8
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
cmp byte [0x14018d873], al
je 0x14003b2f5
lea rax, [0x1401883a0]
jmp 0x14003b38e
mov dword [rbp - 0x50], 0xa002d
mov dword [rbp - 0x4c], 0x1e0003
mov dword [rbp - 0x48], 0x1b0011
mov dword [rbp - 0x44], 0x17003f
mov dword [rbp - 0x40], 0x1b000a
mov dword [rbp - 0x3c], 0x1d000f
mov dword [rbp - 0x38], 0x90011
mov dword [rbp - 0x34], 0x3d0000
mov dword [rbp - 0x30], 0x1c0014
mov r10d, 0x1c
mov dword [rbp - 0x2c], 0x11001a
mov dword [rbp - 0x28], 0xf0052
mov dword [rbp - 0x24], 0x20015
mov dword [rbp - 0x20], 0xa0004
mov dword [rbp - 0x1c], 0x470006
mov word [rbp - 0x18], ax
lea rdx, [0x1401883a0]
lea rcx, [0x140187da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x50]
mov word [rdx + rax*2], cx
inc rax
cmp rax, r10
jl 0x14003b368
mov byte [0x14018d873], 1
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x50
pop rbp
ret
Function at 0x14003b3a0
Capabilities:
Encode data using xor
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor r9d, r9d
cmp byte [0x14018d87f], r9b
je 0x14003b3d3
lea rax, [0x140188af8]
jmp 0x14003b471
mov dword [rbp - 0x30], 0x210047
mov dword [rbp - 0x2c], 0x190000
mov dword [rbp - 0x28], 0xe0032
mov dword [rbp - 0x24], 0x16001d
mov dword [rbp - 0x20], 0x2000a
mov dword [rbp - 0x1c], 0x4c0008
mov word [rbp - 0x18], r9w
mov rcx, r9
lea rbx, [0x140188af8]
lea rax, [0x140187da0]
movzx eax, byte [rcx + rax]
xor ax, word [rbp + rcx*2 - 0x30]
mov word [rbx + rcx*2], ax
inc rcx
cmp rcx, 0xc
jl 0x14003b40c
mov r8d, dword [0x14018cd80]
mov eax, 0x66666667
mov byte [0x14018d87f], 1
imul r8d, r8d
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*4]
shl ecx, 2
sub r8d, ecx
cmp r8d, 0x13
jne 0x14003b46e
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r9
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b0c90
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14003b488
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 8], rax
xor eax, eax
cmp byte [0x14018d852], al
je 0x14003b4b2
lea rax, [0x140188540]
jmp 0x14003b51f
mov dword [rbp - 0x30], 0x13000f
mov dword [rbp - 0x2c], 0x2a001c
mov dword [rbp - 0x28], 0x1f0017
mov dword [rbp - 0x24], 0x3a000b
mov dword [rbp - 0x20], 0x150006
mov dword [rbp - 0x1c], 0x140005
mov dword [rbp - 0x18], 0x1a0004
mov dword [rbp - 0x14], 0x4000c
mov dword [rbp - 0x10], 0x1b
lea rdx, [0x140188540]
lea rcx, [0x140187da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x30]
mov word [rdx + rax*2], cx
inc rax
cmp rax, 0x11
jl 0x14003b4f8
mov byte [0x14018d852], 1
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x30
pop rbp
ret

Function at 0x14003b534
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 8], rax
xor eax, eax
cmp byte [0x14018d865], al
je 0x14003b561
lea rax, [0x140188438]
jmp 0x14003b5e7
mov dword [rbp - 0x40], 0x13000f
mov dword [rbp - 0x3c], 0x2a001c
mov dword [rbp - 0x38], 0x50011
mov dword [rbp - 0x34], 0x1d000a
mov dword [rbp - 0x30], 0x80013
mov dword [rbp - 0x2c], 0x50005
mov dword [rbp - 0x28], 0xa0011
mov dword [rbp - 0x24], 0xe003a
mov dword [rbp - 0x20], 0x13000d
mov dword [rbp - 0x1c], 0x4000a
mov dword [rbp - 0x18], 6
mov dword [rbp - 0x14], 0x5001b
mov word [rbp - 0x10], ax
lea rdx, [0x140188438]
lea rcx, [0x140187da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x40]
mov word [rdx + rax*2], cx
inc rax
cmp rax, 0x18
jl 0x14003b5c0
mov byte [0x14018d865], 1
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x40
pop rbp
ret
Function at 0x14003b5fc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
cmp byte [0x14018d854], al
je 0x14003b63b
lea rax, [0x140188a60]
jmp 0x14003b6dd
mov dword [rbp - 0x60], 0x170004
mov dword [rbp - 0x5c], 0x1a001e
mov dword [rbp - 0x58], 0x340016
mov dword [rbp - 0x54], 0xa000c
mov dword [rbp - 0x50], 0xe
mov dword [rbp - 0x4c], 0x1f0013
mov dword [rbp - 0x48], 0xd001d
mov dword [rbp - 0x44], 0x1f0004
mov dword [rbp - 0x40], 0x1e001c
mov dword [rbp - 0x3c], 0x2b0008
mov dword [rbp - 0x38], 0x50016
mov dword [rbp - 0x34], 0x340018
mov dword [rbp - 0x30], 0xa001a
mov dword [rbp - 0x2c], 0xe0005
mov dword [rbp - 0x28], 0x1b001f
mov dword [rbp - 0x24], 0x1a001c
mov word [rbp - 0x20], ax
lea rdx, [0x140188a60]
lea rcx, [0x140187da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x60]
mov word [rdx + rax*2], cx
inc rax
cmp rax, 0x20
jl 0x14003b6b6
mov byte [0x14018d854], 1
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b0c90
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x14003b704
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov eax, dword [0x14018cd80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 0xb
jne 0x14003b74c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
xor eax, eax
cmp byte [0x14018d85e], al
je 0x14003b75f
lea rax, [0x140188920]
jmp 0x14003b7c5
mov dword [rbp - 0x30], 0x170022
mov dword [rbp - 0x2c], 0x140009
mov dword [rbp - 0x28], 0xe0010
mov dword [rbp - 0x24], 0xd003b
mov dword [rbp - 0x20], 0x80011
mov dword [rbp - 0x1c], 0x150007
mov dword [rbp - 0x18], 0x160031
mov dword [rbp - 0x14], 0x5f
lea rdx, [0x140188920]
lea rcx, [0x140187da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x30]
mov word [rdx + rax*2], cx
inc rax
cmp rax, 0xf
jl 0x14003b79e
mov byte [0x14018d85e], 1
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x50
pop rbp
ret
Function at 0x14003b7d8
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
cmp byte [0x14018d87c], al
je 0x14003b802
lea rax, [0x1401889b0]
jmp 0x14003b868
mov dword [rbp - 0x30], 0x80008
mov dword [rbp - 0x2c], 0x12000d
mov r8d, 1
mov dword [rbp - 0x28], 0x4b0001
mov dword [rbp - 0x24], 0x17001f
mov dword [rbp - 0x20], 0xe000c
mov dword [rbp - 0x1c], 0x1f0046
mov qword [rbp - 0x18], 0x30015
lea rdx, [0x1401889b0]
lea rcx, [0x140187da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x30]
mov word [rdx + rax*2], cx
add rax, r8
cmp rax, 0xf
jl 0x14003b841
mov byte [0x14018d87c], r8b
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x30
pop rbp
ret

Function at 0x14003b87c
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor ecx, ecx
cmp byte [0x14018d86f], cl
je 0x14003b8a7
lea rax, [0x140188710]
jmp 0x14003b947
mov r9d, 3
mov dword [rsp + 0x20], 0xb004c
mov dword [rsp + 0x24], 0x30003
mov dword [rsp + 0x28], 0x450005
mov dword [rsp + 0x2c], 0x9000b
mov dword [rsp + 0x30], 0xf
lea edx, [r9 + 6]
lea rbx, [0x140188710]
lea rax, [0x140187da0]
movzx eax, byte [rcx + rax]
xor ax, word [rsp + rcx*2 + 0x20]
mov word [rbx + rcx*2], ax
inc rcx
cmp rcx, rdx
jl 0x14003b8e0
mov ecx, dword [0x14018cd80]
mov byte [0x14018d86f], 1
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x66666667
imul r8d, ecx
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
shl ecx, 2
sub r8d, ecx
cmp r8d, r9d
jne 0x14003b944
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14018cd80], eax
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x40
pop rbx
ret

Function at 0x14003b95c
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 8], rax
xor r9d, r9d
cmp byte [0x14018d872], r9b
je 0x14003b98b
lea rax, [0x140188400]
jmp 0x14003ba57
mov ecx, dword [0x14018cd80]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x88888889
imul r8d, ecx
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub r8d, edx
mov edx, 1
cmp r8d, 7
jne 0x14003b9cc
sub dword [0x14018d634], edx
mov dword [rbp - 0x40], 0x40002
mov dword [rbp - 0x3c], 0x10002
mov dword [rbp - 0x38], 0xa0044
mov dword [rbp - 0x34], 0x90003
mov dword [rbp - 0x30], 0xe000c
mov dword [rbp - 0x2c], 0x100046
mov dword [rbp - 0x28], 0xd0017
mov dword [rbp - 0x24], 0x180000
mov r8d, 0x18
mov dword [rbp - 0x20], 0x500006
mov dword [rbp - 0x1c], 0x11000b
mov dword [rbp - 0x18], 0x1c
mov dword [rbp - 0x14], 0xf0011
mov word [rbp - 0x10], r9w
lea rax, [0x140188400]
lea rcx, [0x140187da0]
movzx ecx, byte [r9 + rcx]
xor cx, word [rbp + r9*2 - 0x40]
mov word [rax + r9*2], cx
add r9, rdx
cmp r9, r8
jl 0x14003ba32
mov byte [0x14018d872], dl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x40
pop rbp
ret
Function at 0x14003ba6c
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 8], rax
xor eax, eax
cmp byte [0x14018d863], al
je 0x14003ba96
lea rax, [0x140188498]
jmp 0x14003bb03
mov dword [rbp - 0x30], 0x13000f
mov dword [rbp - 0x2c], 0x2a001c
mov dword [rbp - 0x28], 0x1b000d
mov dword [rbp - 0x24], 0x3a000c
mov dword [rbp - 0x20], 0x150006
mov dword [rbp - 0x1c], 0x140005
mov dword [rbp - 0x18], 0x1a0004
mov dword [rbp - 0x14], 0x4000c
mov dword [rbp - 0x10], 0x1b
lea rdx, [0x140188498]
lea rcx, [0x140187da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x30]
mov word [rdx + rax*2], cx
inc rax
cmp rax, 0x11
jl 0x14003badc
mov byte [0x14018d863], 1
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x30
pop rbp
ret

Function at 0x14003bb18
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r8d, dword [0x14018cd80]
xor ebx, ebx
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
lea edi, [rbx + 7]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx, r8d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub ecx, edx
cmp ecx, edi
jne 0x14003bb8a
mov qword [r11 - 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [r11 - 0x38], rbx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov r8d, dword [0x14018cd80]
cmp byte [0x14018d86a], bl
je 0x14003bb9e
lea rax, [0x1401888c8]
jmp 0x14003bc32
mov dword [rsp + 0x30], 0x2a
mov dword [rsp + 0x34], 0x1b001e
mov esi, 1
mov dword [rsp + 0x38], 0x70001
mov dword [rsp + 0x3c], 0x57005c
mov word [rsp + 0x40], bx
lea rdi, [0x1401888c8]
lea rax, [0x140187da0]
movzx eax, byte [rbx + rax]
xor ax, word [rsp + rbx*2 + 0x30]
mov word [rdi + rbx*2], ax
add rbx, rsi
cmp rbx, 8
jl 0x14003bbcf
imul r8d, r8d
mov eax, 0x66666667
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 8
jne 0x14003bc28
call fcn.1400b1650
mov ecx, dword [0x14018cd80]
cmp ecx, eax
jne 0x14003bc28
sub ecx, esi
mov dword [0x14018cd80], ecx
mov byte [0x14018d86a], sil
mov rax, rdi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400b0c90
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14003bc50
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
cmp byte [0x14018d85a], al
je 0x14003bc7d
lea rax, [0x140188c08]
jmp 0x14003bd1a
mov r11d, 0x1c
mov dword [rbp - 0x50], 0x13000f
mov dword [rbp - 0x4c], 0x2a001c
mov dword [rbp - 0x48], 0x20002
mov dword [rbp - 0x44], 0x16001d
mov dword [rbp - 0x40], 0x320017
lea r10d, [r11 - 0x1b]
mov dword [rbp - 0x3c], 0x1f000f
mov dword [rbp - 0x38], 0xb001e
mov dword [rbp - 0x34], 0x1f0006
mov dword [rbp - 0x30], 0x1f001c
mov dword [rbp - 0x2c], 0x2b0001
mov dword [rbp - 0x28], 0xc0016
mov dword [rbp - 0x24], 0xe0000
mov dword [rbp - 0x20], 0x1b000b
mov dword [rbp - 0x1c], 0x30007
mov word [rbp - 0x18], ax
lea rdx, [0x140188c08]
lea rcx, [0x140187da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x50]
mov word [rdx + rax*2], cx
add rax, r10
cmp rax, r11
jl 0x14003bcf4
mov byte [0x14018d85a], r10b
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x50
pop rbp
ret

Function at 0x14003bd2c
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
cmp byte [0x14018d879], al
je 0x14003bd59
lea rax, [0x140188660]
jmp 0x14003be04
mov dword [rbp - 0x60], 0x170004
mov dword [rbp - 0x5c], 0x1a001e
mov dword [rbp - 0x58], 0x4b0016
mov dword [rbp - 0x54], 8
mov dword [rbp - 0x50], 0x190017
mov dword [rbp - 0x4c], 0x1f000f
mov dword [rbp - 0x48], 0x4e0013
mov dword [rbp - 0x44], 0x20003
mov dword [rbp - 0x40], 0x30007
mov dword [rbp - 0x3c], 0x54001b
mov dword [rbp - 0x38], 0x1b0002
mov dword [rbp - 0x34], 0x8001b
mov dword [rbp - 0x30], 0x1c000d
mov dword [rbp - 0x2c], 0x470011
mov dword [rbp - 0x28], 0x10005
mov r8d, 1
mov dword [rbp - 0x24], 0xc0008
mov dword [rbp - 0x20], 0x5d
lea rdx, [0x140188660]
lea rcx, [0x140187da0]
movzx ecx, byte [rax + rcx]
xor cx, word [rbp + rax*2 - 0x60]
mov word [rdx + rax*2], cx
add rax, r8
cmp rax, 0x21
jl 0x14003bddd
mov byte [0x14018d879], r8b
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b0c90
add rsp, 0x60
pop rbp
ret
Function at 0x14003be18
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, dword [0x14018cd80]
mov eax, 0x4ec4ec4f
xor ebx, ebx
imul ecx, ecx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 8
jne 0x14003be80
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp byte [0x14018d862], bl
lea rax, [0x1401889f8]
jne 0x14003beeb
mov dword [rbp - 0x30], 0x15002e
mov dword [rbp - 0x2c], 0x1b0009
mov dword [rbp - 0x28], 0x190034
mov dword [rbp - 0x24], 0x60000
mov dword [rbp - 0x20], 0x1e0006
mov dword [rbp - 0x1c], 0x510015
mov dword [rbp - 0x18], 0x1b0017
mov dword [rbp - 0x14], 0x17
lea rcx, [0x140187da0]
movzx ecx, byte [rbx + rcx]
xor cx, word [rbp + rbx*2 - 0x30]
mov word [rax + rbx*2], cx
inc rbx
cmp rbx, 0xf
jl 0x14003bec7
mov byte [0x14018d862], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b0c90
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x14003bf08
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor r8d, r8d
cmp byte [0x14018d866], r8b
je 0x14003bf3b
lea rax, [0x1401884d0]
jmp 0x14003c011
mov eax, dword [0x14018cd80]
mov r11d, 1
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0x11
jne 0x14003bf6f
sub dword [0x14018d688], r11d
mov dword [rbp - 0x50], 0x170022
mov dword [rbp - 0x4c], 0x140009
mov dword [rbp - 0x48], 0xe0010
mov dword [rbp - 0x44], 0xa003b
mov dword [rbp - 0x40], 0x1000c
mov dword [rbp - 0x3c], 0x14000e
mov dword [rbp - 0x38], 0x1e0018
mov dword [rbp - 0x34], 0x590056
mov dword [rbp - 0x30], 0x1e0026
mov dword [rbp - 0x2c], 0x4000e
mov dword [rbp - 0x28], 0x10001
mov dword [rbp - 0x24], 0x1f001b
mov ebx, 0x1f
mov dword [rbp - 0x20], 0x90048
mov dword [rbp - 0x1c], 0xe0003
mov dword [rbp - 0x18], 0xa0000
mov dword [rbp - 0x14], 0xa
lea rax, [0x1401884d0]
lea rcx, [0x140187da0]
movzx ecx, byte [r8 + rcx]
xor cx, word [rbp + r8*2 - 0x50]
mov word [rax + r8*2], cx
add r8, r11
cmp r8, rbx
jl 0x14003bfeb
mov byte [0x14018d866], r11b
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400b0c90
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret