joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003d2e4
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x30
mov rdx, qword [r8]
mov rbx, rcx
mov rax, r9
lea rcx, [rsp + 0x50]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14003d31f
xor al, al
jmp 0x14003d357
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14003d364
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x7b8]
sub rsp, 0x890
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1401a0e90]
xor rax, rsp
mov qword [rbp + 0x780], rax
mov r15, rdx
xor r12d, r12d
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x58], r12
xor r8d, r8d
mov rdx, rcx
lea rcx, [rsp + 0x60]
call fcn.14003b320
nop
mov r9d, 0x2001f
mov r8, qword [rax]
mov rdx, qword [0x1401a3d48]
lea rcx, [rsp + 0x48]
call fcn.14001878c
test eax, eax
setne bl
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14003d3fd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14003d40e
mov dil, r12b
mov rbx, qword [rsp + 0x48]
jmp 0x14003d575
mov r14d, r12d
mov r8d, dword [0x1401a8d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0x12
jne 0x14003d462
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0xcccccccd
mul r8d
shr edx, 6
lea ecx, [rdx + rdx*4]
shl ecx, 4
sub r8d, ecx
inc r8d
mov dword [0x1401a8d80], r8d
mov edi, 1
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0x12
jne 0x14003d4c2
mov ecx, 0x28
call fcn.1400bc638
mov rsi, rax
mov rbx, r12
call fcn.1400bd978
add eax, dword [0x1401a8d80]
mov dword [rsi + rbx*4], eax
add rbx, rdi
cmp rbx, 0xa
jl 0x14003d49a
mov ecx, dword [rsi + 0x24]
mov dword [0x1401a8d80], ecx
mov rcx, rsi
call fcn.1400be0fc
mov word [rbp - 0x80], r12w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp - 0x7e]
call fcn.1400c2400
mov dword [rsp + 0x40], 0x400
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x80]
mov edx, r14d
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add r14d, edi
test eax, eax
jne 0x14003d55a
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x68]
call fcn.140001f2c
nop
mov rdx, rax
mov rcx, r15
call fcn.140019ee8
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14003d54e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, dword [0x1401a8d80]
jmp 0x14003d467
test rbx, rbx
je 0x14003d570
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r12
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], r12d
test rbx, rbx
je 0x14003d588
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], r12d
mov al, dil
mov rcx, qword [rbp + 0x780]
xor rcx, rsp
call fcn.1400bcfc0
lea r11, [rsp + 0x890]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14003da64
Capabilities:
Get disk size

Disassembly:
push rbx
sub rsp, 0x30
mov r9d, dword [0x1401a8d80]
mov eax, 0x88888889
mov bl, 1
lea r8d, [r9 + 1]
lea ecx, [r9 + 2]
imul ecx, r8d
imul ecx, r9d
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 0xc
jne 0x14003dafb
imul r8d, r9d
mov eax, 0x66666667
xor ebx, ebx
imul r8d
mov ecx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0xd
je 0x14003dafb
mov eax, 0x30c30c31
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 3
jne 0x14003dafb
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov al, bl
add rsp, 0x30
pop rbx
ret
Function at 0x140040708
Capabilities:
Check os version

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [r11 - 0x20], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rdi, rcx
and dword [rsp + 0x30], 0
mov r9d, dword [0x1401a8d80]
mov r8d, r9d
imul r8d, r9d
mov eax, 0x38e38e39
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub r8d, eax
cmp r8d, 8
jne 0x140040776
and qword [r11 - 0x30], 0
and qword [r11 - 0x38], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov r9d, dword [0x1401a8d80]
mov ecx, r9d
imul ecx, r9d
imul ecx, r9d
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0xa
jne 0x1400407c1
mov ecx, 4
call fcn.1400bd778
mov rbx, rax
call fcn.1400bd978
mov dword [rbx], eax
mov dword [0x1401a8d80], eax
mov rcx, rbx
call fcn.1400bcfa4
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx esi, al
movzx ecx, ax
shr cx, 8
movzx ebp, cl
cmp eax, 0x80000000
jae 0x1400407e2
mov ebx, eax
shr ebx, 0x10
cmp esi, 6
jb 0x1400407ff
cmp ebp, 2
jb 0x1400407ff
mov rcx, rdi
call fcn.140040bb8
nop
mov dword [rsp + 0x30], 1
jmp 0x140040862
lea rcx, [0x1401a09a8]
mov rax, qword [0x1401a09a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x20], ebx
mov r9d, ebp
mov r8d, esi
lea rdx, str._d._d___d_
lea rcx, [rsp + 0x68]
call fcn.14000fc08
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.140002bac
mov dword [rsp + 0x30], 1
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140040862
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rdi
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140041cb4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401a0e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ecx, ecx
cmp byte [0x1401aaeaf], cl
je 0x140041cea
lea rax, [0x1401a4578]
jmp 0x140041dad
mov r10d, 5
mov dword [rbp - 0x40], 0x20005
mov dword [rbp - 0x3c], 0x8001a
mov dword [rbp - 0x38], 0x20006
mov dword [rbp - 0x34], 0x180037
mov dword [rbp - 0x30], 0x3a000a
lea edi, [r10 - 4]
mov dword [rbp - 0x2c], 0x160012
mov dword [rbp - 0x28], 0x3000a
mov dword [rbp - 0x24], 0x60018
mov dword [rbp - 0x20], 0x3003c
mov dword [rbp - 0x1c], 0x1e0006
mov dword [rbp - 0x18], 0x10010
mov dword [rbp - 0x14], 7
lea rbx, [0x1401a4578]
lea rax, [0x1401a3d90]
movzx eax, byte [rcx + rax]
xor ax, word [rbp + rcx*2 - 0x40]
mov word [rbx + rcx*2], ax
add rcx, rdi
cmp rcx, 0x17
jl 0x140041d4f
mov eax, dword [0x1401a8d80]
lea r8d, [rax + 1]
imul r8d, eax
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0xd
sub r8d, edx
cmp r8d, r10d
jne 0x140041da3
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401a8d80], eax
mov byte [0x1401aaeaf], dil
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400bcfc0
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret

Function at 0x140041dcc
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401a0e90]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
cmp byte [0x1401aaeb8], bl
je 0x140041df7
lea rax, [0x1401a4488]
jmp 0x140041e78
mov eax, dword [0x1401a8d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 7
jne 0x140041e35
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov dword [rsp + 0x30], 0x130045
mov dword [rsp + 0x34], 0x550003
mov dword [rsp + 0x38], 0x5e
lea rax, [0x1401a4488]
lea rcx, [0x1401a3d90]
movzx ecx, byte [rbx + rcx]
xor cx, word [rsp + rbx*2 + 0x30]
mov word [rax + rbx*2], cx
inc rbx
cmp rbx, 5
jl 0x140041e54
mov byte [0x1401aaeb8], 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400bcfc0
add rsp, 0x50
pop rbx
ret
Function at 0x140041e8c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rax - 0x618]
sub rsp, 0x700
mov rax, qword [0x1401a0e90]
xor rax, rsp
mov qword [rbp + 0x5f0], rax
xor r13d, r13d
cmp byte [0x1401aaebc], r13b
je 0x140041edb
lea rax, [0x1401a4988]
jmp 0x140042003
mov r10d, dword [0x1401a8d80]
mov eax, 0x38e38e39
lea ecx, [r10 + 1]
imul ecx, r10d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
mov eax, 7
cmp ecx, eax
jne 0x140041f54
mov r9d, r13d
lea r8, [rsp + 0x60]
mov esi, 0xe
mov bl, r10b
lea r11d, [rsi - 0xd]
sub bl, r9b
mov r14d, 1
mov rdi, r13
lea r13d, [r14 + 7]
inc rdi
inc r14d
cmp rdi, r13
jl 0x140041f2f
add r8, r13
inc r11d
mov r13d, 0
dec rsi
jne 0x140041f22
inc r9d
cmp r9d, 0xf
jl 0x140041f13
mov dword [rsp + 0x20], 0x15000d
mov dword [rsp + 0x24], 0x3b0003
mov dword [rsp + 0x28], 0x80016
mov dword [rsp + 0x2c], 0x14000d
mov dword [rsp + 0x30], 0x15
mov dword [rsp + 0x34], 0x100012
mov dword [rsp + 0x38], 0x6000a
mov dword [rsp + 0x3c], 0x110033
mov dword [rsp + 0x40], 0x190006
mov dword [rsp + 0x44], 0x40000
mov dword [rsp + 0x48], 0x310011
mov dword [rsp + 0x4c], 0x70018
mov dword [rsp + 0x50], 0x1b000a
mov word [rsp + 0x54], r13w
mov rcx, r13
lea r10, [0x1401a4988]
lea rax, [0x1401a3d90]
movzx eax, byte [rcx + rax]
xor ax, word [rsp + rcx*2 + 0x20]
mov word [r10 + rcx*2], ax
inc rcx
cmp rcx, 0x1a
jl 0x140041fcc
call fcn.1400417e0
test al, al
jne 0x140041ff9
dec dword [0x1401aa8a0]
mov byte [0x1401aaebc], 1
mov rax, r10
mov rcx, qword [rbp + 0x5f0]
xor rcx, rsp
call fcn.1400bcfc0
lea r11, [rsp + 0x700]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140042034
Capabilities:
Encode data using xor
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401a0e90]
xor rax, rsp
mov qword [rbp - 8], rax
xor r8d, r8d
cmp byte [0x1401aae8e], r8b
je 0x14004206c
lea rax, [0x1401a4b58]
jmp 0x140042116
mov edi, 1
mov dword [rbp - 0x30], 0xb0000
mov dword [rbp - 0x2c], 0x1c0036
mov dword [rbp - 0x28], 0x12000a
mov dword [rbp - 0x24], 0x3002b
mov dword [rbp - 0x1c], 0x70057
mov dword [rbp - 0x20], edi
mov dword [rbp - 0x18], 0x60000
mov dword [rbp - 0x14], 0x5e0009
mov word [rbp - 0x10], r8w
mov rcx, r8
lea rbx, [0x1401a4b58]
lea rax, [0x1401a3d90]
movzx eax, byte [rcx + rax]
xor ax, word [rbp + rcx*2 - 0x30]
mov word [rbx + rcx*2], ax
add rcx, rdi
cmp rcx, 0x10
jl 0x1400420b4
mov eax, dword [0x1401a8d80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 0xd
jne 0x14004210c
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r8
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov byte [0x1401aae8e], dil
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400bcfc0
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret

Function at 0x140042134
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1401a0e90]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r9d, dword [0x1401a8d80]
mov eax, 0x38e38e39
or rdi, 0xffffffffffffffff
mov ecx, r9d
imul ecx, r9d
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 5
jne 0x1400421c0
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdi + 5]
imul edx, edx, 0x64
sub r9d, edx
add r9d, 0x7b
movsxd rcx, r9d
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.1400bc638
mov rcx, rax
call fcn.1400be0fc
mov r9d, dword [0x1401a8d80]
xor r10d, r10d
cmp byte [0x1401aae9b], r10b
je 0x1400421d8
lea rax, [0x1401a4328]
jmp 0x140042293
mov dword [rsp + 0x20], 0x350058
mov dword [rsp + 0x24], 0x20001c
mov dword [rsp + 0x28], 0x390021
mov word [rsp + 0x2c], r10w
mov rdx, r10
lea rbx, [0x1401a4328]
lea rax, [0x1401a3d90]
movzx ecx, byte [rdx + rax]
xor cx, word [rsp + rdx*2 + 0x20]
mov word [rbx + rdx*2], cx
inc rdx
cmp rdx, 6
jl 0x140042200
lea r8d, [r9 + 2]
lea ecx, [r9 + 1]
mov eax, 0x38e38e39
mov byte [0x1401aae9b], 1
imul r8d, ecx
imul r8d, r9d
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 7
jne 0x140042290
movabs rax, 0x6746384744434b
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov qword [rsp + 0x20], rax
inc rcx
cmp byte [rdx + rcx], r10b
jne 0x14004226b
mov eax, 4
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.1400bc638
mov rcx, rax
call fcn.1400be0fc
mov rax, rbx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400bcfc0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400422ac
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x104f8]
mov eax, 0x105f0
call fcn.1400c2070
sub rsp, rax
mov rax, qword [0x1401a0e90]
xor rax, rsp
mov qword [rbp + 0x104e0], rax
xor ebx, ebx
cmp byte [0x1401aae95], bl
je 0x1400422fb
lea rax, [0x1401a43d0]
jmp 0x140042465
call fcn.1400417e0
or r14, 0xffffffffffffffff
lea esi, [r14 + 2]
test al, al
jne 0x140042385
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x105a0
mov word [rsp + 0x30], bx
call fcn.1400c2400
mov r10, rbx
mov r9, r14
mov r11d, 0xb7
mov r8, rbx
test r10, r10
je 0x14004235d
test r8, r8
je 0x14004235d
lea rax, [r9 + r8]
lea rcx, [r9 + r8]
movzx edx, word [rbp + rcx*2 - 0x23c]
add dx, word [rsp + rax*2 + 0x30]
lea rax, [r9 + r8]
add dx, si
mov word [rsp + rax*2 + 0x32], dx
add r8, rsi
cmp r8, r11
jl 0x140042332
add r9, r11
add r10, rsi
cmp r9, 0x82d0
jl 0x14004232f
movsx r8d, word [rbp + 0x104d0]
mov dword [0x1401a8d80], r8d
jmp 0x14004238c
mov r8d, dword [0x1401a8d80]
lea eax, [r8 + 1]
mov dword [rsp + 0x20], 0xc002d
mov dword [rsp + 0x24], 0x50005
mov word [rsp + 0x28], bx
imul eax, r8d
and eax, 0x8000000f
jge 0x1400423b7
sub eax, esi
or eax, 0xfffffff0
add eax, esi
cmp eax, 0xf
jne 0x1400423d9
mov edx, esi
mov eax, esi
mov ecx, 0x44
sub ecx, esi
lea r8d, [rax + rdx]
lea edx, [rax]
mov eax, r8d
jns 0x1400423c5
mov dword [0x1401a8d80], r8d
lea rdi, [0x1401a43d0]
lea rax, [0x1401a3d90]
movzx eax, byte [rbx + rax]
xor ax, word [rsp + rbx*2 + 0x20]
mov word [rdi + rbx*2], ax
add rbx, rsi
cmp rbx, 4
jl 0x1400423e0
lea ecx, [r8 + 1]
mov eax, 0x2e8ba2e9
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 7
jne 0x14004245b
mov eax, 0x51eb851f
imul r8d
mov eax, 4
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x7b
movsxd rcx, r8d
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.1400bc638
mov rcx, rax
call fcn.1400be0fc
mov byte [0x1401aae95], sil
mov rax, rdi
mov rcx, qword [rbp + 0x104e0]
xor rcx, rsp
call fcn.1400bcfc0
lea r11, [rsp + 0x105f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140042494
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401a0e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor r9d, r9d
cmp byte [0x1401aae99], r9b
je 0x1400424c7
lea rax, [0x1401a4ab0]
jmp 0x14004259e
mov ecx, dword [0x1401a8d80]
mov ebx, 0x1d
mov dword [rbp - 0x50], 0x70022
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
lea r10d, [rbx - 8]
mov dword [rbp - 0x4c], 0x110019
mov dword [rbp - 0x48], 0x120010
mov dword [rbp - 0x44], 0x3003c
imul r8d, eax
imul r8d, ecx
mov eax, 0x2e8ba2e9
mov dword [rbp - 0x40], 0xe
mov dword [rbp - 0x3c], 0x34001f
mov dword [rbp - 0x38], 0xb001d
mov dword [rbp - 0x34], 0xa001a
mov dword [rbp - 0x30], 0x11000f
imul r8d
sar edx, 2
mov dword [rbp - 0x2c], 0x150008
mov dword [rbp - 0x28], 0x4e0007
mov eax, edx
mov dword [rbp - 0x24], 0x70016
mov dword [rbp - 0x20], 0x3000f
shr eax, 0x1f
mov dword [rbp - 0x1c], 0xf000d
mov dword [rbp - 0x18], 0x4d
add edx, eax
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, r10d
jne 0x140042571
inc dword [0x1401aaab8]
lea rax, [0x1401a4ab0]
lea rcx, [0x1401a3d90]
movzx ecx, byte [r9 + rcx]
xor cx, word [rbp + r9*2 - 0x50]
mov word [rax + r9*2], cx
inc r9
cmp r9, rbx
jl 0x140042578
mov byte [0x1401aae99], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400bcfc0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x1400425b8
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401a0e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r8d, dword [0x1401a8d80]
xor edi, edi
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x88888889
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 0xb
jne 0x14004262d
mov qword [r11 - 0x50], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [r11 - 0x58], rdi
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov r8d, dword [0x1401a8d80]
cmp byte [0x1401aaebe], dil
je 0x140042642
lea rax, [0x1401a49e8]
jmp 0x14004271c
lea ecx, [r8 + 1]
mov eax, 0x2aaaaaab
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x15
jne 0x140042682
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov dword [rbp - 0x40], 0xf0002
mov dword [rbp - 0x3c], 0x44001f
mov dword [rbp - 0x38], 0x2a0027
mov dword [rbp - 0x34], 0x1f0024
mov dword [rbp - 0x30], 0x10045
mov edx, 1
mov dword [rbp - 0x2c], 0x1001e
mov dword [rbp - 0x28], 0xc001c
mov dword [rbp - 0x24], 0x430018
mov dword [rbp - 0x20], 0xc0006
mov dword [rbp - 0x1c], 0x30006
mov dword [rbp - 0x18], 0x400000
mov word [rbp - 0x14], di
mov rcx, rdi
lea rbx, [0x1401a49e8]
lea rax, [0x1401a3d90]
movzx eax, byte [rcx + rax]
xor ax, word [rbp + rcx*2 - 0x40]
mov word [rbx + rcx*2], ax
add rcx, rdx
cmp rcx, 0x16
jl 0x1400426e2
mov byte [0x1401aaebe], dl
call fcn.140041630
test al, al
jne 0x140042719
call fcn.1400bd978
mov dword [0x1401a8d80], eax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400bcfc0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14004273c
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401a0e90]
xor rax, rsp
mov qword [rsp + 0x18], rax
xor r8d, r8d
cmp byte [0x1401aaea8], r8b
je 0x140042767
lea rax, [0x1401a49c0]
jmp 0x140042891
mov r9d, dword [0x1401a8d80]
lea eax, [r9 + 1]
lea ecx, [r9 + 2]
imul ecx, eax
mov eax, 0x88888889
imul ecx, r9d
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 0xb
jne 0x14004280e
jmp 0x140042809
mov eax, r9d
and eax, 0x80000001
jge 0x1400427ad
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x1400427c4
mov eax, r9d
cdq
sub eax, edx
sar eax, 1
mov r9d, eax
mov dword [0x1401a8d80], eax
jmp 0x1400427d3
lea r9d, [r9*2 + 1]
mov dword [0x1401a8d80], r9d
mov eax, 0x55555556
mov ecx, r9d
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub ecx, eax
je 0x1400427f7
sub ecx, 2
je 0x1400427fb
dec ecx
je 0x1400427fe
jmp 0x140042809
add r9d, 2
inc r9d
add r9d, 2
mov dword [0x1401a8d80], r9d
test r9d, r9d
jne 0x14004279c
mov ecx, 9
mov dword [rsp], 0x17000d
mov dword [rsp + 4], 0x80017
mov dword [rsp + 8], 0x48000f
mov dword [rsp + 0xc], 0xc
lea r10, [0x1401a49c0]
mov dword [rsp + 0x10], ecx
lea rax, [0x1401a3d90]
movzx eax, byte [r8 + rax]
xor ax, word [rsp + r8*2]
mov word [r10 + r8*2], ax
inc r8
cmp r8, rcx
jl 0x14004283d
lea r8d, [r9 + 1]
mov eax, 0x2e8ba2e9
mov byte [0x1401aaea8], 1
imul r8d, r9d
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, 7
jne 0x14004288e
dec dword [0x1401aa75c]
mov rax, r10
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1400bcfc0
add rsp, 0x28
ret
Function at 0x1400428a4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [0x1401a0e90]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov r8d, dword [0x1401a8d80]
xor ebx, ebx
mov eax, 0x92492493
lea r15d, [r8 + 1]
lea edi, [rbx + 8]
lea r13d, [rbx + 1]
mov ecx, r15d
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 5
jne 0x14004294f
mov r9d, ebx
lea r10, [rsp + 0x30]
mov r15d, edi
mov dil, r8b
mov r11d, r13d
mov rsi, r15
sub dil, r9b
mov rbp, rbx
mov r14d, r13d
add rbp, r13
add r14d, r13d
cmp rbp, 4
jl 0x14004292a
add r11d, r13d
add r10, 4
sub rsi, r13
jne 0x140042924
add r9d, r13d
cmp r9d, 0xb
jl 0x140042918
lea r15d, [r8 + 1]
lea ecx, [r8 + 2]
mov eax, 0x2e8ba2e9
imul ecx, r15d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0x15
jne 0x140042990
lea edx, [rcx + 0x24]
lea r8d, [rcx + 0x25]
lea rcx, str._d__d_n
call fcn.1400bd8cc
mov r8d, dword [0x1401a8d80]
imul r8d, r8d
mov eax, 0xb21642c9
imul r8d
add edx, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub r8d, edx
cmp r8d, 0xe
jne 0x1400429bc
sub dword [0x1401aaad0], r13d
cmp byte [0x1401aae8f], bl
lea rax, [0x1401a49d8]
jne 0x140042a04
mov dword [rsp + 0x20], 0x7004d
mov dword [rsp + 0x24], 0x8001f
mov word [rsp + 0x28], bx
lea rcx, [0x1401a3d90]
movzx ecx, byte [rbx + rcx]
xor cx, word [rsp + rbx*2 + 0x20]
mov word [rax + rbx*2], cx
add rbx, r13
cmp rbx, 4
jl 0x1400429e0
mov byte [0x1401aae8f], r13b
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400bcfc0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret