joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140051520
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0x8a8]
sub rsp, 0x9a8
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp + 0x898], rax
cmp byte [0x1401bf57d], 0
je 0x140051559
lea rax, [0x1401b98c0]
jmp 0x140051750
mov qword [rsp + 0x9a0], r15
xor r15d, r15d
mov dword [rbp + 0x860], 0x1b002c
mov dword [rbp + 0x864], 0x6002e
mov dword [rbp + 0x868], 9
mov dword [rbp + 0x86c], 0xd
mov edx, r15d
mov dword [rbp + 0x870], 0x15001e
mov dword [rbp + 0x874], 0x1b003f
mov dword [rbp + 0x878], 0x1e0015
mov dword [rbp + 0x87c], 0x40005
mov dword [rbp + 0x880], 0x220008
mov dword [rbp + 0x884], 0x1000c
mov dword [rbp + 0x888], 0x15000e
mov dword [rbp + 0x88c], 0x530012
mov dword [rbp + 0x890], 0x45
lea r14, [0x1401b98c0]
lea r8, [0x1401b8da1]
nop word [rax + rax]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rbp + rdx*2 + 0x862]
add rdx, 5
xor ax, word [rbp + rdx*2 + 0x856]
mov word [r14 + rdx*2 - 0xa], ax
movzx eax, byte [rdx + r8 - 5]
xor cx, ax
movzx eax, byte [rdx + r8 - 4]
xor ax, word [rbp + rdx*2 + 0x85a]
mov word [r14 + rdx*2 - 8], cx
mov word [r14 + rdx*2 - 6], ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rbp + rdx*2 + 0x85c]
mov word [r14 + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rbp + rdx*2 + 0x85e]
mov word [r14 + rdx*2 - 2], ax
cmp rdx, 0x19
jl 0x140051600
mov ecx, dword [0x1401bdd80]
mov eax, 0x38e38e39
lea r8d, [rcx + 1]
imul r8d, ecx
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub r8d, eax
cmp r8d, 5
jne 0x14005173e
mov qword [rsp + 0x9c0], rbx
mov qword [rsp + 0x9c8], rsi
mov qword [rsp + 0x9d0], rdi
lea rdi, [rsp + 0x20]
mov esi, r15d
mov r9d, r15d
nop word [rax + rax]
mov eax, ecx
lea r8d, [rsi + 1]
lea ebx, [r9 + 1]
cdq
idiv r8d
mov eax, ecx
sub eax, esi
mov r8d, edx
imul r8d, eax
mov eax, ecx
lea rcx, [0x140146c08]
cdq
idiv ebx
add r8d, eax
sub r8d, r9d
mov edx, r8d
call fcn.1400cc3f4
add rdi, 4
mov r9d, ebx
cmp ebx, 0x1f
jge 0x140051717
mov ecx, dword [0x1401bdd80]
jmp 0x1400516d0
inc esi
cmp esi, 0x13
jge 0x140051726
mov ecx, dword [0x1401bdd80]
jmp 0x1400516c0
mov rsi, qword [rsp + 0x9c8]
mov rbx, qword [rsp + 0x9c0]
mov rdi, qword [rsp + 0x9d0]
mov r15, qword [rsp + 0x9a0]
mov byte [0x1401bf57d], 1
mov rax, r14
mov rcx, qword [rbp + 0x898]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x9a8
pop r14
pop rbp
ret
Function at 0x140051820
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov eax, dword [0x1401bdd80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 4
jne 0x140051872
mov ecx, 4
call fcn.1400cc2a0
mov ecx, dword [0x1401bdd80]
mov dword [rax], ecx
cmp byte [0x1401bf56e], 0
lea rax, [0x1401b9350]
jne 0x14005195c
xor r8d, r8d
mov dword [rbp - 0x50], 0x2e
mov dword [rbp - 0x4c], 0x10000
mov dword [rbp - 0x48], 0x1f0010
mov dword [rbp - 0x44], 0x13003e
mov dword [rbp - 0x40], 0x60003
mov word [rbp - 0x18], r8w
mov dword [rbp - 0x3c], 0x1e0000
mov dword [rbp - 0x38], 0xd0002
mov dword [rbp - 0x34], 0x330015
mov dword [rbp - 0x30], 0x30005
mov dword [rbp - 0x2c], 0x9001c
mov dword [rbp - 0x28], 0x10041
mov dword [rbp - 0x24], 0xa
mov dword [rbp - 0x20], 0x170009
mov dword [rbp - 0x1c], 0x460011
lea r9, [0x1401b8da1]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x4e]
add r8, 4
xor cx, word [rbp + r8*2 - 0x58]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x54]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x52]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x1c
jl 0x140051900
mov byte [0x1401bf56e], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x70
pop rbp
ret
Function at 0x140051970
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rsp + 0x20], rax
cmp byte [0x1401bf578], 0
je 0x1400519a5
lea rax, [0x1401b9ae0]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x38
ret
xor r9d, r9d
mov dword [rsp], 0x2b0044
mov dword [rsp + 4], 0x60003
mov dword [rsp + 8], 0xa0033
mov dword [rsp + 0xc], 0x12001c
mov dword [rsp + 0x10], 0x1f0003
mov word [rsp + 0x18], r9w
mov edx, r9d
mov dword [rsp + 0x14], 0x4f0007
lea r10, [0x1401b9ae0]
lea r8, [0x1401b8da1]
nop
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rsp + rdx*2 + 2]
add rdx, 6
xor ax, word [rsp + rdx*2 - 0xc]
mov word [r10 + rdx*2 - 0xc], ax
movzx eax, byte [rdx + r8 - 6]
xor cx, ax
movzx eax, byte [rdx + r8 - 5]
xor ax, word [rsp + rdx*2 - 8]
mov word [r10 + rdx*2 - 0xa], cx
mov word [r10 + rdx*2 - 8], ax
movzx eax, byte [rdx + r8 - 4]
xor ax, word [rsp + rdx*2 - 6]
mov word [r10 + rdx*2 - 6], ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rsp + rdx*2 - 4]
mov word [r10 + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rsp + rdx*2 - 2]
mov word [r10 + rdx*2 - 2], ax
cmp rdx, 0xc
jl 0x1400519f0
mov ecx, dword [0x1401bdd80]
mov eax, 0x2aaaaaab
mov byte [0x1401bf578], 1
mov r8d, ecx
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 7
jne 0x140051aba
test ecx, ecx
je 0x140051ab3
nop dword [rax]
mov edx, ecx
mov eax, ecx
and edx, 1
add r9d, edx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
jne 0x140051aa0
mov dword [0x1401bdd80], r9d
mov rax, r10
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x38
ret
Function at 0x140051ad0
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0xe0
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov ecx, dword [0x1401bdd80]
xor edi, edi
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x2aaaaaab
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 0xd
jne 0x140051b4c
mov r8d, edi
test ecx, ecx
je 0x140051b43
nop word [rax + rax]
mov eax, ecx
and eax, 1
add r8d, eax
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
jne 0x140051b30
mov ecx, r8d
mov dword [0x1401bdd80], ecx
mov r8d, ecx
mov eax, 0x2aaaaaab
mov qword [rsp + 0xf0], rbx
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 7
jne 0x140051ba3
lea ecx, [r8 - 3]
call fcn.1400cc2a0
mov rbx, rax
call fcn.1400cc4a0
mov rcx, rbx
mov dword [rbx], eax
mov dword [0x1401bdd80], eax
call fcn.1400cbac0
mov ecx, dword [0x1401bdd80]
cmp byte [0x1401bf556], dil
je 0x140051bb8
lea rax, [0x1401b9450]
jmp 0x140051cae
mov eax, ecx
mov dword [rsp + 0x20], 0x19000c
mov dword [rsp + 0x24], 0x35001f
mov dword [rsp + 0x28], 0x1b0016
mov dword [rsp + 0x2c], 0x3e000a
mov dword [rsp + 0x30], 0x8000f
imul eax, ecx
mov dword [rsp + 0x34], 0x17000a
mov dword [rsp + 0x38], 0x1e0017
mov dword [rsp + 0x3c], 0xa0019
mov dword [rsp + 0x40], 0xa
and eax, 0x8000000f
jge 0x140051c13
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 0xa
jne 0x140051c77
mov qword [rsp + 0xf8], rbp
lea ebx, [rax - 9]
lea r11, [rsp + 0x50]
mov qword [rsp + 0x100], rsi
lea ebp, [rax - 1]
nop word [rax + rax]
mov r9, rdi
mov r10d, 1
nop dword [rax]
inc r9
inc r10d
cmp r9, 0xd
jl 0x140051c50
inc ebx
add r11, 0xd
dec rbp
jne 0x140051c40
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
lea rax, [0x1401b9450]
lea rdx, [0x1401b8da0]
nop word [rax + rax]
movzx ecx, byte [rdi + rdx]
inc rdi
xor cx, word [rsp + rdi*2 + 0x1e]
mov word [rax + rdi*2 - 2], cx
cmp rdi, 0x11
jl 0x140051c90
mov byte [0x1401bf556], 1
mov rbx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0xe0
pop rdi
ret
Function at 0x140051cd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401bf560], 0
je 0x140051d00
lea rax, [0x1401b93b0]
jmp 0x140051e27
xor r9d, r9d
mov dword [rbp - 0x40], 0x19000c
mov dword [rbp - 0x3c], 0x35001f
mov dword [rbp - 0x38], 0x10010
mov dword [rbp - 0x34], 0x19000b
mov dword [rbp - 0x30], 0x15001a
mov word [rbp - 0x10], r9w
mov edx, r9d
mov dword [rbp - 0x2c], 0x6000a
mov dword [rbp - 0x28], 0xe0002
mov dword [rbp - 0x24], 0x2f
mov dword [rbp - 0x20], 0xc001c
mov dword [rbp - 0x1c], 0x1c000c
mov dword [rbp - 0x18], 0xe0015
mov dword [rbp - 0x14], 0x70004
lea rbx, [0x1401b93b0]
lea r8, [0x1401b8da1]
nop dword [rax]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rbp + rdx*2 - 0x3e]
add rdx, 6
xor ax, word [rbp + rdx*2 - 0x4c]
mov word [rbx + rdx*2 - 0xc], ax
movzx eax, byte [rdx + r8 - 6]
xor cx, ax
movzx eax, byte [rdx + r8 - 5]
xor ax, word [rbp + rdx*2 - 0x48]
mov word [rbx + rdx*2 - 0xa], cx
mov word [rbx + rdx*2 - 8], ax
movzx eax, byte [rdx + r8 - 4]
xor ax, word [rbp + rdx*2 - 0x46]
mov word [rbx + rdx*2 - 6], ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rbp + rdx*2 - 0x44]
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rbp + rdx*2 - 0x42]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0x18
jl 0x140051d70
mov eax, dword [0x1401bdd80]
mov byte [0x1401bf560], 1
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 3
jne 0x140051e24
mov qword [rsp + 0x28], r9
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r9
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400cbae0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x140052100
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov eax, dword [0x1401bdd80]
imul eax, eax
and eax, 0x8000000f
jge 0x14005212e
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 7
jne 0x14005215c
mov eax, 0x93
mov ecx, 0xdb
nop dword [rax]
test ecx, ecx
je 0x140052154
cdq
mov r8d, ecx
idiv ecx
mov eax, r8d
mov ecx, edx
test r8d, r8d
jne 0x140052140
add eax, ecx
mov dword [0x1401bdd80], eax
cmp byte [0x1401bf576], 0
je 0x14005217e
lea rax, [0x1401b9a30]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x60
pop rbp
ret
xor r8d, r8d
mov dword [rbp - 0x60], 0x1d0007
mov dword [rbp - 0x5c], 0x5001d
mov dword [rbp - 0x58], 0x300017
mov dword [rbp - 0x54], 0xe000d
mov dword [rbp - 0x50], 0x1d0007
mov word [rbp - 0x20], r8w
mov dword [rbp - 0x4c], 0x1c001c
mov dword [rbp - 0x48], 0x9000e
mov dword [rbp - 0x44], 0x110011
mov dword [rbp - 0x40], 0x1000d
mov dword [rbp - 0x3c], 0x33000e
mov dword [rbp - 0x38], 0xb0005
mov dword [rbp - 0x34], 0x360007
mov dword [rbp - 0x30], 0x170017
mov dword [rbp - 0x2c], 0xf0012
mov dword [rbp - 0x28], 0x190003
mov dword [rbp - 0x24], 0x100015
lea rdx, [0x1401b9a30]
lea r9, [0x1401b8da1]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rbp + r8*2 - 0x5e]
add r8, 4
xor ax, word [rbp + r8*2 - 0x68]
mov word [rdx + r8*2 - 8], ax
movzx eax, byte [r8 + r9 - 4]
xor cx, ax
mov word [rdx + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x64]
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x62]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0x20
jl 0x140052210
mov byte [0x1401bf576], 1
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x60
pop rbp
ret

Function at 0x140052290
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rsp + 0x20], rax
cmp byte [0x1401bf573], 0
je 0x1400522c5
lea rax, [0x1401b98a0]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x38
ret
mov dword [rsp], 0x1d0021
mov dword [rsp + 4], 0xb000a
mov dword [rsp + 8], 0xa0011
mov dword [rsp + 0xc], 0x9003a
mov dword [rsp + 0x10], 0x150018
mov dword [rsp + 0x14], 0x160008
mov dword [rsp + 0x18], 0x120022
mov dword [rsp + 0x1c], 0x4a
xor r8d, r8d
lea rdx, [0x1401b98a0]
lea r9, [0x1401b8da1]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 2]
add r8, 5
xor ax, word [rsp + r8*2 - 0xa]
mov word [rdx + r8*2 - 0xa], ax
movzx eax, byte [r8 + r9 - 5]
xor cx, ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rsp + r8*2 - 6]
mov word [rdx + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0xf
jl 0x140052320
mov byte [0x1401bf573], 1
mov rax, rdx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x38
ret
Function at 0x1400523b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x3e0
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rsp + 0x3d0], rax
mov r11d, dword [0x1401bdd80]
xor ebx, ebx
lea eax, [r11 + 1]
lea ecx, [r11 + 2]
imul ecx, eax
mov eax, 0x88888889
imul ecx, r11d
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 4
jne 0x14005241c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov r11d, dword [0x1401bdd80]
lea eax, [r11 + 1]
lea ecx, [r11 + 2]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx, r11d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 8
jne 0x140052466
mov r8d, ebx
lea r9, [rsp + 0x30]
mov r10d, r11d
inc r8d
dec r10d
lea r9, [r9 + 4]
movsxd rax, r8d
cmp rax, 0xdd
jb 0x140052451
cmp byte [0x1401bf54c], bl
je 0x14005247a
lea rax, [0x1401b96b8]
jmp 0x140052556
mov dword [rsp + 0x3b0], 0x2000b
mov dword [rsp + 0x3b4], 0xd000e
mov dword [rsp + 0x3b8], 0x4f0000
mov dword [rsp + 0x3bc], 0x13001e
mov dword [rsp + 0x3c0], 0x130005
mov dword [rsp + 0x3c4], 0x1c0049
mov dword [rsp + 0x3c8], 0x70006
mov dword [rsp + 0x3cc], 0x15
lea rdx, [0x1401b96b8]
lea r8, [0x1401b8da1]
movzx eax, byte [rbx + r8 - 1]
movzx ecx, word [rsp + rbx*2 + 0x3b2]
add rbx, 5
xor ax, word [rsp + rbx*2 + 0x3a6]
mov word [rdx + rbx*2 - 0xa], ax
movzx eax, byte [rbx + r8 - 5]
xor cx, ax
movzx eax, byte [rbx + r8 - 4]
xor ax, word [rsp + rbx*2 + 0x3aa]
mov word [rdx + rbx*2 - 8], cx
movzx ecx, byte [rbx + r8 - 3]
xor cx, word [rsp + rbx*2 + 0x3ac]
mov word [rdx + rbx*2 - 6], ax
mov word [rdx + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor cx, word [rsp + rbx*2 + 0x3ae]
mov word [rdx + rbx*2 - 2], cx
cmp rbx, 0xf
jl 0x1400524e0
mov byte [0x1401bf54c], 1
mov rax, rdx
mov rcx, qword [rsp + 0x3d0]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x3e0
pop rbx
ret
Function at 0x1400527a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, dword [0x1401bdd80]
xor r10d, r10d
lea eax, [rcx + 1]
lea edi, [rcx + 2]
imul edi, eax
mov eax, 0x30c30c31
imul edi, ecx
imul edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, edi
imul edx, edx, 0x15
sub eax, edx
cmp eax, 0xd
jne 0x140052812
mov r9d, r10d
lea r11, [rbp - 0x60]
mov ebx, ecx
nop
inc r9d
dec ebx
lea r11, [r11 + 4]
movsxd rax, r9d
cmp rax, 6
jb 0x140052800
cmp byte [0x1401bf549], r10b
je 0x140052827
lea rax, [0x1401b94d0]
jmp 0x140052984
mov eax, 0x2e8ba2e9
mov r11d, 1
mov dword [rbp - 0x48], 0xe0001
mov dword [rbp - 0x44], 0x1e0001
mov dword [rbp - 0x40], 0xe0045
mov dword [rbp - 0x3c], 0xd0002
imul edi
sar edx, 2
mov dword [rbp - 0x38], 0x130005
mov dword [rbp - 0x34], 0x130049
mov eax, edx
lea ebx, [r11 + 3]
mov dword [rbp - 0x30], 0x90004
shr eax, 0x1f
mov dword [rbp - 0x2c], 0x160015
mov dword [rbp - 0x28], 0x4f0017
add edx, eax
mov dword [rbp - 0x24], 0x9000d
mov dword [rbp - 0x20], 0xe000f
mov dword [rbp - 0x1c], 0xd000e
mov word [rbp - 0x18], r10w
imul edx, edx, 0x16
sub edi, edx
cmp edi, 8
jne 0x1400528b1
test ecx, ecx
cmove ecx, r11d
mov dword [0x1401bdd80], ecx
lea rdi, [0x1401b94d0]
lea r8, [0x1401b8da1]
nop
movzx eax, byte [r10 + r8 - 1]
movzx edx, word [rbp + r10*2 - 0x46]
add r10, 6
xor ax, word [rbp + r10*2 - 0x54]
mov word [rdi + r10*2 - 0xc], ax
movzx eax, byte [r10 + r8 - 6]
xor dx, ax
movzx eax, byte [r10 + r8 - 5]
xor ax, word [rbp + r10*2 - 0x50]
mov word [rdi + r10*2 - 0xa], dx
mov word [rdi + r10*2 - 8], ax
movzx eax, byte [r10 + r8 - 4]
xor ax, word [rbp + r10*2 - 0x4e]
mov word [rdi + r10*2 - 6], ax
movzx eax, byte [r10 + r8 - 3]
xor ax, word [rbp + r10*2 - 0x4c]
mov word [rdi + r10*2 - 4], ax
movzx eax, byte [r10 + r8 - 2]
xor ax, word [rbp + r10*2 - 0x4a]
mov word [rdi + r10*2 - 2], ax
cmp r10, 0x18
jl 0x1400528c0
imul ecx, ecx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0xb
jne 0x14005297a
mov rcx, rbx
call fcn.1400cc2a0
mov rbx, rax
call fcn.1400cc4a0
mov rcx, rbx
mov dword [rbx], eax
mov dword [0x1401bdd80], eax
call fcn.1400cbac0
mov byte [0x1401bf549], 1
mov rax, rdi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cbae0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140052c50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401bf55e], 0
je 0x140052c85
lea rax, [0x1401b9420]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x38
ret
xor r9d, r9d
mov dword [rsp], 0x19000c
mov dword [rsp + 4], 0x35001f
mov dword [rsp + 8], 0x1f000c
mov dword [rsp + 0xc], 0x3e000d
mov dword [rsp + 0x10], 0x8000f
mov ecx, r9d
mov dword [rsp + 0x14], 0x17000a
mov dword [rsp + 0x18], 0x1e0017
mov dword [rsp + 0x1c], 0xa0019
mov dword [rsp + 0x20], 0xa
lea r10, [0x1401b9420]
lea rdx, [0x1401b8da0]
movzx eax, byte [rcx + rdx]
inc rcx
xor ax, word [rsp + rcx*2 - 2]
mov word [r10 + rcx*2 - 2], ax
cmp rcx, 0x11
jl 0x140052ce0
mov ecx, dword [0x1401bdd80]
mov eax, 0x4ec4ec4f
mov byte [0x1401bf55e], 1
mov r8d, ecx
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub r8d, edx
cmp r8d, 5
jne 0x140052d92
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
imul edx, edx, 0x78
sub eax, edx
cmp eax, 0xb6
je 0x140052d8b
nop dword [rax + rax]
mov eax, ecx
inc r9d
or eax, 0xffffff13
add ecx, eax
mov eax, ecx
imul eax, ecx
cmp r9d, eax
jg 0x140052d8b
mov eax, 0x88888889
mov r8d, ecx
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x78
sub r8d, edx
cmp r8d, 0xb6
jne 0x140052d50
mov dword [0x1401bdd80], r9d
mov rax, r10
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x38
ret
Function at 0x140052f20
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, dword [0x1401bdd80]
mov eax, 0x92492493
mov r8d, ecx
imul r8d, ecx
imul r8d, ecx
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub r8d, edx
cmp r8d, 3
jne 0x140052f77
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov ecx, dword [0x1401bdd80]
cmp byte [0x1401bf561], 0
je 0x140052f99
lea rax, [0x1401b99d8]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x70
pop rbp
ret
xor r10d, r10d
mov dword [rbp - 0x50], 0x19000c
mov dword [rbp - 0x4c], 0x35001f
mov dword [rbp - 0x48], 0x60003
mov dword [rbp - 0x44], 0x12001c
mov dword [rbp - 0x40], 0x2f001e
mov word [rbp - 0x18], r10w
mov r8d, r10d
mov dword [rbp - 0x3c], 0x1c0000
mov dword [rbp - 0x38], 0xf000d
mov dword [rbp - 0x34], 0x110013
mov dword [rbp - 0x30], 0xd
mov dword [rbp - 0x2c], 0x330007
mov dword [rbp - 0x28], 0x20005
mov dword [rbp - 0x24], 0xc001f
mov dword [rbp - 0x20], 0x60006
mov dword [rbp - 0x1c], 0x20010
lea r9, [0x1401b99d8]
lea r11, [0x1401b8da1]
nop word [rax + rax]
movzx eax, byte [r8 + r11 - 1]
movzx edx, word [rbp + r8*2 - 0x4e]
add r8, 4
xor ax, word [rbp + r8*2 - 0x58]
mov word [r9 + r8*2 - 8], ax
movzx eax, byte [r8 + r11 - 4]
xor dx, ax
movzx eax, byte [r8 + r11 - 3]
xor ax, word [rbp + r8*2 - 0x54]
mov word [r9 + r8*2 - 6], dx
mov word [r9 + r8*2 - 4], ax
movzx eax, byte [r8 + r11 - 2]
xor ax, word [rbp + r8*2 - 0x52]
mov word [r9 + r8*2 - 2], ax
cmp r8, 0x1c
jl 0x140053020
lea r8d, [rcx + 1]
mov eax, 0x38e38e39
mov byte [0x1401bf561], 1
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 3
jne 0x1400530cd
lea rax, [rbp - 0x50]
nop dword [rax + rax]
mov edx, dword [rax]
inc r10d
lea rax, [rax + 4]
imul edx, edx, 0x4f
add ecx, edx
movsxd rdx, r10d
cmp rdx, 0x34
jb 0x1400530b0
mov dword [0x1401bdd80], ecx
mov rax, r9
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x70
pop rbp
ret
Function at 0x1400530f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push r15
lea rbp, [rsp - 0xf00]
mov eax, 0x1000
call fcn.1400d0b90
sub rsp, rax
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp + 0xef0], rax
mov ecx, dword [0x1401bdd80]
mov eax, 0x66666667
mov r15d, 0x1e
lea r8d, [rcx + 1]
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub r8d, eax
cmp r8d, 7
jne 0x140053177
mov eax, 0xc3
mov r8d, r15d
test r8d, r8d
je 0x14005316d
cdq
mov ecx, r8d
idiv r8d
mov eax, ecx
mov r8d, edx
test ecx, ecx
jne 0x140053158
lea ecx, [r8 + rax]
mov dword [0x1401bdd80], ecx
mov r8d, ecx
mov eax, 0x92492493
xor r14d, r14d
imul r8d, ecx
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub r8d, edx
cmp r8d, 0xd
jne 0x140053250
mov qword [rsp + 0x1020], rbx
mov qword [rsp + 0x1028], rsi
mov qword [rsp + 0x1030], rdi
lea rdi, [rsp + 0x20]
mov esi, r14d
nop word [rax + rax]
mov r10d, r14d
nop word [rax + rax]
mov eax, ecx
lea r8d, [rsi + 1]
lea ebx, [r10 + 1]
cdq
idiv r8d
mov eax, ecx
mov r8d, ecx
sub r8d, esi
lea rcx, [0x140146c08]
mov r9d, edx
cdq
idiv ebx
imul r9d, r8d
add r9d, eax
sub r9d, r10d
mov edx, r9d
call fcn.1400cc3f4
add rdi, 4
mov r10d, ebx
cmp ebx, 0x20
jge 0x140053229
mov ecx, dword [0x1401bdd80]
jmp 0x1400531e0
inc esi
cmp esi, 0x1f
jge 0x140053238
mov ecx, dword [0x1401bdd80]
jmp 0x1400531d0
mov rsi, qword [rsp + 0x1028]
mov rbx, qword [rsp + 0x1020]
mov rdi, qword [rsp + 0x1030]
cmp byte [0x1401bf54b], r14b
je 0x140053265
lea rax, [0x1401b95d0]
jmp 0x140053376
mov dword [rbp + 0xea0], 0x1d0007
mov dword [rbp + 0xea4], 0x5001d
mov dword [rbp + 0xea8], 0x4f0017
mov dword [rbp + 0xeac], 0x40009
mov dword [rbp + 0xeb0], 0x4001e
mov dword [rbp + 0xeb4], 0x1c0000
mov dword [rbp + 0xeb8], 0x4a0000
mov dword [rbp + 0xebc], 0xc0016
mov dword [rbp + 0xec0], 0x1c0016
mov dword [rbp + 0xec4], 0x4c001d
mov dword [rbp + 0xec8], 0x150011
mov dword [rbp + 0xecc], 0xa0004
mov dword [rbp + 0xed0], 0x10000
mov dword [rbp + 0xed4], 0x460006
mov dword [rbp + 0xed8], 0x30019
mov dword [rbp + 0xedc], 0x60001
mov dword [rbp + 0xee0], 0x4f
lea rdx, [0x1401b95d0]
lea r8, [0x1401b8da1]
nop dword [rax]
movzx eax, byte [r14 + r8 - 1]
movzx ecx, word [rbp + r14*2 + 0xea2]
add r14, 3
xor ax, word [rbp + r14*2 + 0xe9a]
mov word [rdx + r14*2 - 6], ax
movzx eax, byte [r14 + r8 - 3]
xor cx, ax
mov word [rdx + r14*2 - 4], cx
movzx ecx, byte [r14 + r8 - 2]
xor cx, word [rbp + r14*2 + 0xe9e]
mov word [rdx + r14*2 - 2], cx
cmp r14, 0x21
jl 0x140053320
mov byte [0x1401bf54b], 1
mov rax, rdx
mov rcx, qword [rbp + 0xef0]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x1000
pop r15
pop r14
pop rbp
ret