joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004b6f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401aa92c], 0
lea rax, [0x1401a58b8]
jne 0x14004b7ee
mov dword [rbp - 0x40], 0x18003e
mov dword [rbp - 0x3c], 0x190028
mov dword [rbp - 0x38], 0x1c0019
mov dword [rbp - 0x34], 0xd000d
mov dword [rbp - 0x30], 0xf001f
mov dword [rbp - 0x2c], 0xb003b
mov dword [rbp - 0x28], 0x5001b
mov dword [rbp - 0x24], 0x140007
mov dword [rbp - 0x20], 0x2f0004
mov dword [rbp - 0x1c], 0xe000f
mov dword [rbp - 0x18], 0x180008
mov dword [rbp - 0x14], 0x57001a
mov dword [rbp - 0x10], 0x54
xor r8d, r8d
lea r9, [0x1401a4d91]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 5
xor cx, word [rbp + r8*2 - 0x4a]
mov word [rax + r8*2 - 0xa], cx
movzx ecx, byte [r8 + r9 - 5]
xor dx, cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 8], dx
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x19
jl 0x14004b780
mov byte [0x1401aa92c], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x40
pop rbp
ret
Function at 0x14004b8b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401aa919], 0
je 0x14004b8df
lea rax, [0x1401a5390]
jmp 0x14004bacf
mov r8d, dword [0x1401a9d80]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rdi
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
xor edi, edi
imul ecx, eax
mov eax, 0x30c30c31
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xa
jne 0x14004b96f
lea ecx, [rdi + 0x28]
mov qword [rsp + 0x98], rsi
call fcn.1400c2fb8
mov ebx, edi
mov rsi, rax
call fcn.1400c426c
inc rbx
add eax, dword [0x1401a9d80]
mov dword [rsi + rbx*4 - 4], eax
cmp rbx, 0xa
jl 0x14004b937
mov ecx, dword [rsi + 0x24]
mov dword [0x1401a9d80], ecx
mov rcx, rsi
call fcn.1400c4098
mov r8d, dword [0x1401a9d80]
mov rsi, qword [rsp + 0x98]
imul r8d, r8d
mov dword [rbp - 0x50], 0x3003c
mov dword [rbp - 0x4c], 0x1e0006
mov dword [rbp - 0x48], 0x30000
mov dword [rbp - 0x44], 0x1e003e
mov dword [rbp - 0x40], 0x1c0002
mov ebx, 4
mov dword [rbp - 0x3c], 0xe0004
mov dword [rbp - 0x38], 0x16000c
mov dword [rbp - 0x34], 0x230017
mov dword [rbp - 0x30], 0xe0009
mov dword [rbp - 0x2c], 0x6001f
mov dword [rbp - 0x28], 0xc0047
mov dword [rbp - 0x24], 0x40002
mov dword [rbp - 0x20], 0x150018
mov dword [rbp - 0x1c], 0x4e0017
mov word [rbp - 0x18], di
and r8d, 0x80000007
jge 0x14004b9f1
dec r8d
or r8d, 0xfffffff8
inc r8d
cmp r8d, 5
jne 0x14004ba53
mov rax, qword [str.fi1n8qCR6RlV9R]
or r8, 0xffffffffffffffff
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x60], rax
mov eax, dword [0x140138bd0]
mov rcx, r8
mov dword [rbp - 0x58], eax
movzx eax, word [0x140138bd4]
mov word [rbp - 0x54], ax
movzx eax, byte [0x140138bd6]
mov byte [rbp - 0x52], al
nop dword [rax + rax]
inc rcx
cmp byte [rdx + rcx], dil
jne 0x14004ba30
mov rax, rbx
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.1400c2fb8
mov rcx, rax
call fcn.1400c4098
mov rbx, qword [rsp + 0x90]
lea rdx, [0x1401a5390]
lea r8, [0x1401a4d91]
nop dword [rax]
movzx eax, byte [rdi + r8 - 1]
movzx ecx, word [rbp + rdi*2 - 0x4e]
add rdi, 4
xor ax, word [rbp + rdi*2 - 0x58]
mov word [rdx + rdi*2 - 8], ax
movzx eax, byte [rdi + r8 - 4]
xor cx, ax
mov word [rdx + rdi*2 - 6], cx
movzx ecx, byte [rdi + r8 - 3]
xor cx, word [rbp + rdi*2 - 0x54]
mov word [rdx + rdi*2 - 4], cx
movzx ecx, byte [rdi + r8 - 2]
xor cx, word [rbp + rdi*2 - 0x52]
mov word [rdx + rdi*2 - 2], cx
cmp rdi, 0x1c
jl 0x14004ba70
mov rdi, qword [rsp + 0xa0]
mov byte [0x1401aa919], 1
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x80
pop rbp
ret
Function at 0x14004baf0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rsp + 0x20], rax
cmp byte [0x1401aa926], 0
je 0x14004bb25
lea rax, [0x1401a5ab0]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x38
ret
xor r8d, r8d
mov dword [rsp], 0x280056
mov dword [rsp + 4], 0x190005
mov dword [rsp + 8], 0x160023
mov dword [rsp + 0xc], 0x1f001c
mov dword [rsp + 0x10], 0x50002
mov word [rsp + 0x18], r8w
mov dword [rsp + 0x14], 0x5f0003
lea rdx, [0x1401a5ab0]
lea r9, [0x1401a4d91]
nop dword [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 2]
add r8, 6
xor ax, word [rsp + r8*2 - 0xc]
mov word [rdx + r8*2 - 0xc], ax
movzx eax, byte [r8 + r9 - 6]
xor cx, ax
movzx eax, byte [r8 + r9 - 5]
xor ax, word [rsp + r8*2 - 8]
mov word [rdx + r8*2 - 0xa], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rdx + r8*2 - 8], ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rsp + r8*2 - 6]
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 2], cx
cmp r8, 0xc
jl 0x14004bb70
mov byte [0x1401aa926], 1
mov rax, rdx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x38
ret

Function at 0x14004bc10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r8d, dword [0x1401a9d80]
mov eax, 0x66666667
mov ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
cmp ecx, 3
jne 0x14004bc90
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x7b
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400c2fb8
mov rcx, rax
call fcn.1400c4098
cmp byte [0x1401aa8fa], 0
lea rax, [0x1401a5570]
jne 0x14004bd10
mov dword [rsp + 0x20], 0x1a001e
mov dword [rsp + 0x24], 0x2a0019
mov dword [rsp + 0x28], 0x70006
mov dword [rsp + 0x2c], 0x33000a
mov dword [rsp + 0x30], 0x12000e
mov dword [rsp + 0x34], 0x7000e
mov dword [rsp + 0x38], 0x50019
mov dword [rsp + 0x3c], 0x1a001b
mov dword [rsp + 0x40], 6
xor ecx, ecx
lea r8, [0x1401a4d90]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 + 0x1e]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x11
jl 0x14004bcf1
mov byte [0x1401aa8fa], 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x58
ret
Function at 0x14004bd30
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401aa90d], 0
lea rax, [0x1401a5428]
jne 0x14004be40
xor r8d, r8d
mov dword [rbp - 0x40], 0x1a001e
mov dword [rbp - 0x3c], 0x2a0019
mov dword [rbp - 0x38], 0x1d0000
mov dword [rbp - 0x34], 0x14000b
mov dword [rbp - 0x30], 0xf001b
mov word [rbp - 0x10], r8w
mov dword [rbp - 0x2c], 0x16000e
mov dword [rbp - 0x28], 0x15000c
mov dword [rbp - 0x24], 0x10002d
mov dword [rbp - 0x20], 0x10010
mov dword [rbp - 0x1c], 0x13000f
mov dword [rbp - 0x18], 0x30013
mov dword [rbp - 0x14], 0x3000c
lea r9, [0x1401a4d91]
nop
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 6
xor cx, word [rbp + r8*2 - 0x4c]
mov word [rax + r8*2 - 0xc], cx
movzx ecx, byte [r8 + r9 - 6]
xor dx, cx
movzx ecx, byte [r8 + r9 - 5]
xor cx, word [rbp + r8*2 - 0x48]
mov word [rax + r8*2 - 0xa], dx
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x18
jl 0x14004bdc0
mov byte [0x1401aa90d], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x40
pop rbp
ret

Function at 0x14004bfe0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401aa8fb], 0
lea rax, [0x1401a5a40]
jne 0x14004c10c
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov rdi, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x10]
mov rbx, qword [r11 + 8]
xor r8d, r8d
mov dword [rbp - 0x60], 0x1e0015
mov dword [rbp - 0x5c], 0x1a001b
mov dword [rbp - 0x58], 0x2c0007
mov dword [rbp - 0x54], 0x3000d
mov dword [rbp - 0x50], 0x70006
mov word [rbp - 0x20], r8w
mov dword [rbp - 0x4c], 0xc0018
mov dword [rbp - 0x48], 0x120000
mov dword [rbp - 0x44], 0x10013
mov dword [rbp - 0x40], 0xc0001
mov dword [rbp - 0x3c], 0x3c000d
mov dword [rbp - 0x38], 0x60003
mov dword [rbp - 0x34], 0x32000f
mov dword [rbp - 0x30], 0x150006
mov dword [rbp - 0x2c], 0x70014
mov dword [rbp - 0x28], 0x1001c
mov dword [rbp - 0x24], 0x1a001c
lea r9, [0x1401a4d91]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x5e]
add r8, 4
xor cx, word [rbp + r8*2 - 0x68]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x64]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x62]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x20
jl 0x14004c0b0
mov byte [0x1401aa8fb], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x60
pop rbp
ret
Function at 0x14004c120
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rsp + 0x20], rax
cmp byte [0x1401aa91d], 0
je 0x14004c155
lea rax, [0x1401a5898]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x38
ret
mov dword [rsp], 0x1e0033
mov dword [rsp + 4], 0x14000c
mov dword [rsp + 8], 0x160001
mov dword [rsp + 0xc], 0x4003a
mov dword [rsp + 0x10], 0xf0019
mov dword [rsp + 0x14], 0x6000c
mov dword [rsp + 0x18], 0x9002c
mov dword [rsp + 0x1c], 0x48
xor r8d, r8d
lea rdx, [0x1401a5898]
lea r9, [0x1401a4d91]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 2]
add r8, 5
xor ax, word [rsp + r8*2 - 0xa]
mov word [rdx + r8*2 - 0xa], ax
movzx eax, byte [r8 + r9 - 5]
xor cx, ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rsp + r8*2 - 6]
mov word [rdx + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0xf
jl 0x14004c1b0
mov byte [0x1401aa91d], 1
mov rax, rdx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x38
ret

Function at 0x14004c240
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rsp + 0x20], rax
cmp byte [0x1401aa921], 0
je 0x14004c275
lea rax, [0x1401a5950]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x38
ret
mov dword [rsp], 0x10019
mov dword [rsp + 4], 0x120008
mov dword [rsp + 8], 0x530010
mov dword [rsp + 0xc], 0x1e001e
mov dword [rsp + 0x10], 0x90004
mov dword [rsp + 0x14], 0xc004d
mov dword [rsp + 0x18], 0x1c0008
mov dword [rsp + 0x1c], 0x17
xor r8d, r8d
lea rdx, [0x1401a5950]
lea r9, [0x1401a4d91]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 2]
add r8, 5
xor ax, word [rsp + r8*2 - 0xa]
mov word [rdx + r8*2 - 0xa], ax
movzx eax, byte [r8 + r9 - 5]
xor cx, ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rsp + r8*2 - 6]
mov word [rdx + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0xf
jl 0x14004c2d0
mov byte [0x1401aa921], 1
mov rax, rdx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x38
ret
Function at 0x14004c550
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp - 8], rax
mov eax, dword [0x1401a9d80]
mov r9d, 1
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, r9d
jne 0x14004c5b5
mov r8d, r9d
mov eax, r9d
mov edx, 0x21
dec edx
lea ecx, [rax + r8]
lea r8d, [rax]
mov eax, ecx
jns 0x14004c5a2
mov dword [0x1401a9d80], ecx
cmp byte [0x1401aa8f8], 0
lea rax, [0x1401a53f0]
jne 0x14004c6b0
xor r8d, r8d
mov dword [rbp - 0x40], 0xd0013
mov dword [rbp - 0x3c], 0x10007
mov dword [rbp - 0x38], 0x120055
mov dword [rbp - 0x34], 2
mov dword [rbp - 0x30], 0x90004
mov word [rbp - 0x10], r8w
mov dword [rbp - 0x2c], 0x3004d
mov dword [rbp - 0x28], 0x12000a
mov dword [rbp - 0x24], 0x60017
mov dword [rbp - 0x20], 0x42001b
mov dword [rbp - 0x1c], 0x6000e
mov dword [rbp - 0x18], 0x30009
mov dword [rbp - 0x14], 0x90006
lea r9, [0x1401a4d91]
nop dword [rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 6
xor cx, word [rbp + r8*2 - 0x4c]
mov word [rax + r8*2 - 0xc], cx
movzx ecx, byte [r8 + r9 - 6]
xor dx, cx
movzx ecx, byte [r8 + r9 - 5]
xor cx, word [rbp + r8*2 - 0x48]
mov word [rax + r8*2 - 0xa], dx
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x18
jl 0x14004c630
mov byte [0x1401aa8f8], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x40
pop rbp
ret

Function at 0x14004c7b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp byte [0x1401aa90a], 0
je 0x14004c7e8
lea rax, [0x1401a5488]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x20], 0x1a001e
mov dword [rsp + 0x24], 0x2a0019
mov edi, 7
mov dword [rsp + 0x28], 0x3001c
mov dword [rsp + 0x2c], 0x33000d
mov dword [rsp + 0x30], 0x12000e
mov dword [rsp + 0x34], 0x7000e
mov dword [rsp + 0x38], 0x50019
mov dword [rsp + 0x3c], 0x1a001b
mov dword [rsp + 0x40], 6
xor eax, eax
lea rbx, [0x1401a5488]
lea rdx, [0x1401a4d90]
nop word [rax + rax]
movzx ecx, byte [rax + rdx]
inc rax
xor cx, word [rsp + rax*2 + 0x1e]
mov word [rbx + rax*2 - 2], cx
cmp rax, 0x11
jl 0x14004c850
mov ecx, dword [0x1401a9d80]
mov eax, 0x30c30c31
mov byte [0x1401aa90a], 1
imul ecx, ecx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 8
jne 0x14004c8b1
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401a9d80]
test rax, rax
cmove ecx, edi
mov dword [0x1401a9d80], ecx
mov rax, rbx
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x50
pop rbx
ret
Function at 0x14004c8d0
Capabilities:
Check for time delay via gettickcount
Get disk size

Disassembly:
sub rsp, 0x38
mov r8d, dword [0x1401a9d80]
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x6bca1af3
imul ecx, r8d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [0x1401aa658]
imul edx, edx, 0x13
sub ecx, edx
mov edx, 0xef0f63ad
cmp ecx, 0xc
mov ecx, r8d
cmove eax, edx
mov dword [0x1401aa658], eax
mov eax, 0x4ec4ec4f
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 8
jne 0x14004c960
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0xcccccccd
mul r8d
shr edx, 6
lea ecx, [rdx + rdx*4]
shl ecx, 4
sub r8d, ecx
inc r8d
mov dword [0x1401a9d80], r8d
cmp byte [0x1401aa911], 0
jne 0x14004ca7e
movzx eax, byte [0x1401a4d90]
xor al, 0x3b
movzx eax, al
mov word [str.__tee], ax
movzx eax, byte [0x1401a4d91]
xor al, 9
movzx eax, al
mov word [reloc.OLEAUT32.dll_VariantCopy], ax
movzx eax, byte [0x1401a4d92]
xor al, 0x1b
movzx eax, al
mov word [0x1401a593c], ax
movzx eax, byte [0x1401a4d93]
xor al, 0x1b
movzx eax, al
mov word [0x1401a593e], ax
movzx eax, byte [0x1401a4d94]
xor al, 0x10
movzx eax, al
mov word [0x1401a5940], ax
movzx eax, byte [0x1401a4d95]
xor al, 0x1f
movzx eax, al
mov word [0x1401a5942], ax
movzx eax, byte [0x1401a4d96]
xor al, 0x5d
movzx eax, al
mov word [0x1401a5944], ax
movzx eax, byte [0x1401a4d97]
xor al, 0x5e
movzx eax, al
mov word [0x1401a5946], ax
mov eax, r8d
imul eax, r8d
and eax, 0x8000000f
jge 0x14004ca1a
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 0xa
jne 0x14004ca3f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov r8d, dword [0x1401a9d80]
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
mov byte [0x1401aa911], 1
imul ecx, eax
mov eax, 0xb21642c9
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 0xd
jne 0x14004ca7e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401a9d80], eax
lea rax, str.__tee
add rsp, 0x38
ret
Function at 0x14004ca90
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, dword [0x1401a9d80]
mov eax, 0x4ec4ec4f
imul ecx, ecx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 8
jne 0x14004caf1
mov eax, 0xbd
mov ecx, 0x39
test ecx, ecx
je 0x14004cae9
cdq
mov r8d, ecx
idiv ecx
mov eax, r8d
mov ecx, edx
test r8d, r8d
jne 0x14004cad5
add eax, ecx
mov dword [0x1401a9d80], eax
cmp byte [0x1401aa900], 0
je 0x14004cb13
lea rax, [0x1401a5bc8]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x50
pop rbp
ret
xor r8d, r8d
mov dword [rbp - 0x50], 0x1a001e
mov dword [rbp - 0x4c], 0x2a0019
mov dword [rbp - 0x48], 0x1a0013
mov dword [rbp - 0x44], 0x1f001c
mov dword [rbp - 0x40], 0x35001f
mov word [rbp - 0x18], r8w
mov dword [rbp - 0x3c], 0xc0004
mov dword [rbp - 0x38], 0x140003
mov dword [rbp - 0x34], 0x10011
mov dword [rbp - 0x30], 0xd0001
mov dword [rbp - 0x2c], 0x3c0004
mov dword [rbp - 0x28], 0xf0003
mov dword [rbp - 0x24], 0x80017
mov dword [rbp - 0x20], 0x40017
mov dword [rbp - 0x1c], 0xa0016
lea rdx, [0x1401a5bc8]
lea r9, [0x1401a4d91]
nop dword [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rbp + r8*2 - 0x4e]
add r8, 4
xor ax, word [rbp + r8*2 - 0x58]
mov word [rdx + r8*2 - 8], ax
movzx eax, byte [r8 + r9 - 4]
xor cx, ax
mov word [rdx + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x54]
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x52]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0x1c
jl 0x14004cb90
mov byte [0x1401aa900], 1
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x50
pop rbp
ret
Function at 0x14004cc10
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401aa91f], 0
je 0x14004cc49
lea rax, [0x1401a5690]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x60
pop rbp
ret
mov dword [rbp - 0x60], 0x1e0015
mov dword [rbp - 0x5c], 0x1a001b
mov dword [rbp - 0x58], 0x530007
mov dword [rbp - 0x54], 0x90009
mov dword [rbp - 0x50], 0x1e001f
mov dword [rbp - 0x4c], 0xc0004
mov dword [rbp - 0x48], 0x51000e
mov dword [rbp - 0x44], 0x1c0014
mov dword [rbp - 0x40], 0x11001a
mov dword [rbp - 0x3c], 0x43001e
mov dword [rbp - 0x38], 0x180017
mov dword [rbp - 0x34], 0xe000c
mov dword [rbp - 0x30], 0x30011
xor ecx, ecx
mov dword [rbp - 0x2c], 0x4e0000
mov dword [rbp - 0x28], 0x1b0006
mov dword [rbp - 0x24], 0xc0008
mov dword [rbp - 0x20], 0x4e
lea r8, [0x1401a5690]
lea r9, [0x1401a4d91]
movzx eax, byte [rcx + r9 - 1]
movzx edx, word [rbp + rcx*2 - 0x5e]
add rcx, 3
xor ax, word [rbp + rcx*2 - 0x66]
mov word [r8 + rcx*2 - 6], ax
movzx eax, byte [rcx + r9 - 3]
xor dx, ax
mov word [r8 + rcx*2 - 4], dx
movzx edx, byte [rcx + r9 - 2]
xor dx, word [rbp + rcx*2 - 0x62]
mov word [r8 + rcx*2 - 2], dx
cmp rcx, 0x21
jl 0x14004ccd0
mov byte [0x1401aa91f], 1
mov rax, r8
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x60
pop rbp
ret

Function at 0x14004cd30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp byte [0x1401aa918], 0
je 0x14004cd65
lea rax, [0x1401a5970]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x48
ret
mov eax, dword [0x1401a9d80]
mov qword [rsp + 0x40], rbx
xor ebx, ebx
lea ecx, [rax + 1]
mov dword [rsp + 0x20], 0x90006
mov dword [rsp + 0x24], 0x6001b
mov dword [rsp + 0x28], 0x1c001c
mov dword [rsp + 0x2c], 0x4c0000
mov dword [rsp + 0x30], 0x18000e
imul ecx, eax
mov eax, 0x2e8ba2e9
mov dword [rsp + 0x34], 0x1f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0x13
jne 0x14004cde7
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401a9d80]
mov edx, 7
test rax, rax
cmove ecx, edx
mov dword [0x1401a9d80], ecx
lea rax, [0x1401a5970]
lea rdx, [0x1401a4d90]
nop word [rax + rax]
movzx ecx, byte [rbx + rdx]
inc rbx
xor cx, word [rsp + rbx*2 + 0x1e]
mov word [rax + rbx*2 - 2], cx
cmp rbx, 0xb
jl 0x14004ce00
mov byte [0x1401aa918], 1
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x48
ret
Function at 0x14004ce40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rsp + 0x20], rax
cmp byte [0x1401aa915], 0
je 0x14004ce75
lea rax, [0x1401a5998]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x38
ret
mov dword [rsp], 0x1c003f
mov dword [rsp + 4], 0x1b000c
mov dword [rsp + 8], 0x10025
mov dword [rsp + 0xc], 0xf0001
mov dword [rsp + 0x10], 0x19000e
mov dword [rsp + 0x14], 0x42001e
mov qword [rsp + 0x18], 0x4000a
xor r8d, r8d
lea rdx, [0x1401a5998]
lea r9, [0x1401a4d91]
nop
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 2]
add r8, 5
xor ax, word [rsp + r8*2 - 0xa]
mov word [rdx + r8*2 - 0xa], ax
movzx eax, byte [r8 + r9 - 5]
xor cx, ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rsp + r8*2 - 6]
mov word [rdx + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0xf
jl 0x14004cec0
mov byte [0x1401aa915], 1
mov rax, rdx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x38
ret

Function at 0x14004cf50
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401aa90e], 0
lea rax, [0x1401a54c0]
jne 0x14004d01f
mov dword [rbp - 0x50], 0x1e0033
mov dword [rbp - 0x4c], 0x14000c
mov dword [rbp - 0x48], 0x160001
mov dword [rbp - 0x44], 0x3003a
mov dword [rbp - 0x40], 0x60004
mov dword [rbp - 0x3c], 0x70005
mov dword [rbp - 0x38], 0x10005
mov dword [rbp - 0x34], 0x470041
mov dword [rbp - 0x30], 0xc003b
mov dword [rbp - 0x2c], 0x13000b
mov dword [rbp - 0x28], 0x20014
mov dword [rbp - 0x24], 0x19000c
mov dword [rbp - 0x20], 0x160054
mov dword [rbp - 0x1c], 0x70012
mov dword [rbp - 0x18], 0x100003
mov dword [rbp - 0x14], 0xa
xor ecx, ecx
lea r8, [0x1401a4d90]
nop word [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rbp + rcx*2 - 0x52]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x1f
jl 0x14004d000
mov byte [0x1401aa90e], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x50
pop rbp
ret