joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140053620
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rdi
push r12
sub rsp, 0x188
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov qword [r11 + 8], rbx
mov ebx, dword [0x1401c3d80]
xor edi, edi
lea ecx, [rbx + 1]
mov eax, 0x38e38e39
lea r12d, [rdi + 1]
imul ecx, ebx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 3
jne 0x1400536d4
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], r14
mov qword [r11 - 0x18], r15
lea rcx, [rsp + 0x21]
mov r11d, edi
nop word [rax + rax]
movzx r10d, bl
mov esi, r12d
mov ebp, 0xa
sub r10b, r11b
nop
inc esi
add rcx, 3
dec rbp
jne 0x1400536a0
inc r11d
cmp r11d, 0xb
jl 0x140053690
mov r15, qword [rsp + 0x180]
mov r14, qword [rsp + 0x1b8]
mov rsi, qword [rsp + 0x1b0]
mov rbp, qword [rsp + 0x1a8]
cmp byte [0x1401c5964], dil
mov rbx, qword [rsp + 0x1a0]
je 0x1400536f1
lea rax, [0x1401bfb98]
jmp 0x1400537b7
mov dword [rsp], 0x260041
mov dword [rsp + 4], 0xf0007
mov dword [rsp + 8], 0x110026
mov dword [rsp + 0xc], 0x1e0014
mov dword [rsp + 0x10], 0x70000
mov dword [rsp + 0x14], 0x540001
mov word [rsp + 0x18], di
lea rdx, [0x1401bfb98]
lea r8, [0x1401bed91]
nop word [rax + rax]
movzx eax, byte [rdi + r8 - 1]
movzx ecx, word [rsp + rdi*2 + 2]
add rdi, 6
xor ax, word [rsp + rdi*2 - 0xc]
mov word [rdx + rdi*2 - 0xc], ax
movzx eax, byte [rdi + r8 - 6]
xor cx, ax
movzx eax, byte [rdi + r8 - 5]
xor ax, word [rsp + rdi*2 - 8]
mov word [rdx + rdi*2 - 0xa], cx
movzx ecx, byte [rdi + r8 - 3]
xor cx, word [rsp + rdi*2 - 4]
mov word [rdx + rdi*2 - 8], ax
movzx eax, byte [rdi + r8 - 4]
xor ax, word [rsp + rdi*2 - 6]
mov word [rdx + rdi*2 - 4], cx
movzx ecx, byte [rdi + r8 - 2]
xor cx, word [rsp + rdi*2 - 2]
mov word [rdx + rdi*2 - 6], ax
mov word [rdx + rdi*2 - 2], cx
cmp rdi, 0xc
jl 0x140053740
mov byte [0x1401c5964], r12b
mov rax, rdx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x188
pop r12
pop rdi
ret
Function at 0x1400537e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x5e0
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rsp + 0x5d8], rax
mov r8d, dword [0x1401c3d80]
mov eax, 0x66666667
xor ebx, ebx
mov ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
cmp ecx, 3
jne 0x140053841
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov r8d, dword [0x1401c3d80]
cmp byte [0x1401c5942], bl
mov qword [rsp + 0x600], r14
je 0x14005385d
lea rax, [0x1401bf4e0]
jmp 0x140053a59
mov dword [rsp + 0x5b0], 0x140009
mov dword [rsp + 0x5b4], 0x3c001b
mov dword [rsp + 0x5b8], 3
mov dword [rsp + 0x5bc], 0x320002
mov dword [rsp + 0x5c0], 0x10000c
mov dword [rsp + 0x5c4], 0xc000c
mov dword [rsp + 0x5c8], 0x40004
mov dword [rsp + 0x5cc], 0x8001c
mov dword [rsp + 0x5d0], 0x1e
mov rcx, rbx
lea r14, [0x1401bf4e0]
lea rdx, [0x1401bed90]
movzx eax, byte [rcx + rdx]
inc rcx
xor ax, word [rsp + rcx*2 + 0x5ae]
mov word [r14 + rcx*2 - 2], ax
cmp rcx, 0x11
jl 0x1400538d1
lea ecx, [r8 + 1]
mov eax, 0x92492493
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 0xb
jne 0x140053a4f
mov qword [rsp + 0x5f0], rsi
mov qword [rsp + 0x5f8], rdi
mov rdi, rbx
mov esi, 0xaf
nop dword [rax]
call fcn.1400ce478
inc rdi
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rsp + rdi*8 + 0x28], xmm0
cmp rdi, rsi
jb 0x140053930
mov rdi, qword [rsp + 0x5f8]
mov r9d, 0xae
nop dword [rax]
mov edx, 0xae
cmp rbx, rdx
jge 0x140053a38
cmp r9, 4
jl 0x140053a0d
mov r8d, 0xaa
lea rcx, [rsp + 0x590]
sub r8, rbx
shr r8, 2
inc r8
lea rax, [r8*4]
sub rdx, rax
nop dword [rax + rax]
movsd xmm0, qword [rcx + 0x10]
movsd xmm1, qword [rcx + 8]
comisd xmm0, xmm1
jbe 0x1400539ba
movsd qword [rcx + 0x10], xmm1
movsd qword [rcx + 8], xmm0
movsd xmm0, qword [rcx + 8]
movsd xmm1, qword [rcx]
comisd xmm0, xmm1
jbe 0x1400539d2
movsd qword [rcx + 8], xmm1
movsd qword [rcx], xmm0
movsd xmm0, qword [rcx]
movsd xmm1, qword [rcx - 8]
comisd xmm0, xmm1
jbe 0x1400539ea
movsd qword [rcx], xmm1
movsd qword [rcx - 8], xmm0
movsd xmm0, qword [rcx - 8]
movsd xmm1, qword [rcx - 0x10]
comisd xmm0, xmm1
jbe 0x140053a04
movsd qword [rcx - 8], xmm1
movsd qword [rcx - 0x10], xmm0
sub rcx, 0x20
dec r8
jne 0x1400539a0
cmp rdx, rbx
jle 0x140053a38
movsd xmm0, qword [rsp + rdx*8 + 0x30]
movsd xmm1, qword [rsp + rdx*8 + 0x28]
comisd xmm0, xmm1
jbe 0x140053a30
movsd qword [rsp + rdx*8 + 0x30], xmm1
movsd qword [rsp + rdx*8 + 0x28], xmm0
dec rdx
cmp rdx, rbx
jg 0x140053a12
inc rbx
dec r9
dec rsi
jne 0x140053960
mov rsi, qword [rsp + 0x5f0]
mov byte [0x1401c5942], 1
mov rax, r14
mov r14, qword [rsp + 0x600]
mov rcx, qword [rsp + 0x5d8]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x5e0
pop rbx
ret
Function at 0x140053a80
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov ecx, dword [0x1401c3d80]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0xb21642c9
imul r8d, ecx
imul r8d
add edx, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub r8d, edx
cmp r8d, 0xf
jne 0x140053b32
movsd xmm3, qword [0x140153278]
movsd xmm5, qword [0x1401532a0]
movd xmm4, ecx
xorps xmm2, xmm2
movaps xmmword [rsp + 0x60], xmm6
movsd xmm6, qword [0x140153270]
cvtdq2pd xmm4, xmm4
nop word [rax + rax]
addsd xmm2, xmm3
movaps xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x140053b19
subsd xmm2, xmm3
divsd xmm3, xmm5
movaps xmm1, xmm2
movaps xmm0, xmm4
mulsd xmm1, xmm2
subsd xmm0, xmm1
comisd xmm0, xmm6
ja 0x140053b00
movaps xmm6, xmmword [rsp + 0x60]
cmp byte [0x1401c595f], 0
mov qword [rsp + 0x80], rbx
je 0x140053b4f
lea rax, [0x1401bf8f0]
jmp 0x140053c48
xor edx, edx
mov dword [rbp - 0x50], 0x140009
mov dword [rbp - 0x4c], 0x3c001b
mov dword [rbp - 0x48], 0x1a0005
mov dword [rbp - 0x44], 0x150003
mov dword [rbp - 0x40], 0xd0019
mov word [rbp - 0x20], dx
mov dword [rbp - 0x3c], 0x1d000c
mov dword [rbp - 0x38], 0x140011
mov dword [rbp - 0x34], 0x2002a
mov dword [rbp - 0x30], 0x60008
mov dword [rbp - 0x2c], 0x17000b
mov dword [rbp - 0x28], 0x3001e
mov dword [rbp - 0x24], 0x2000d
lea rbx, [0x1401bf8f0]
lea r9, [0x1401bed91]
nop word [rax + rax]
movzx eax, byte [rdx + r9 - 1]
movzx ecx, word [rbp + rdx*2 - 0x4e]
add rdx, 6
xor ax, word [rbp + rdx*2 - 0x5c]
mov word [rbx + rdx*2 - 0xc], ax
movzx eax, byte [rdx + r9 - 6]
xor cx, ax
movzx eax, byte [rdx + r9 - 5]
xor ax, word [rbp + rdx*2 - 0x58]
mov word [rbx + rdx*2 - 0xa], cx
mov word [rbx + rdx*2 - 8], ax
movzx eax, byte [rdx + r9 - 4]
xor ax, word [rbp + rdx*2 - 0x56]
mov word [rbx + rdx*2 - 6], ax
movzx eax, byte [rdx + r9 - 3]
xor ax, word [rbp + rdx*2 - 0x54]
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r9 - 2]
xor ax, word [rbp + rdx*2 - 0x52]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0x18
jl 0x140053bc0
cmp r8d, 0xf
jne 0x140053c3e
call fcn.1400ce478
mov dword [0x1401c3d80], eax
mov byte [0x1401c595f], 1
mov rax, rbx
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x70
pop rbp
ret
Function at 0x140053d80
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401c5945], 0
lea rax, [0x1401bfa00]
jne 0x140053e8c
xor r8d, r8d
mov dword [rbp - 0x60], 0x100002
mov dword [rbp - 0x5c], 0xc0019
mov dword [rbp - 0x58], 0x2b0002
mov dword [rbp - 0x54], 0x20005
mov dword [rbp - 0x50], 0x50004
mov word [rbp - 0x20], r8w
mov dword [rbp - 0x4c], 0x7001a
mov dword [rbp - 0x48], 0x13001d
mov dword [rbp - 0x44], 0x130014
mov dword [rbp - 0x40], 0xb0019
mov dword [rbp - 0x3c], 0x380009
mov dword [rbp - 0x38], 0x6000e
mov dword [rbp - 0x34], 0x33000e
mov dword [rbp - 0x30], 0xd001d
mov dword [rbp - 0x2c], 0x4000b
mov dword [rbp - 0x28], 0x110003
mov dword [rbp - 0x24], 0x1a0006
lea r9, [0x1401bed91]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x5e]
add r8, 4
xor cx, word [rbp + r8*2 - 0x68]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x64]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x62]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x20
jl 0x140053e30
mov byte [0x1401c5945], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x60
pop rbp
ret
Function at 0x140053ea0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401c596a], 0
je 0x140053ed0
lea rax, [0x1401bf858]
jmp 0x140054084
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], r14
mov r14d, 4
mov dword [rbp - 0x30], 0x100024
mov dword [rbp - 0x2c], 0x2000e
mov dword [rbp - 0x28], 0x110004
mov dword [rbp - 0x24], 0x50032
mov dword [rbp - 0x20], 0xd001b
mov dword [rbp - 0x1c], 0xd000e
mov dword [rbp - 0x18], 0x80031
mov dword [rbp - 0x14], 0x4f
xor edi, edi
call fcn.1400511e0
or rsi, 0xffffffffffffffff
test al, al
jne 0x140053f78
mov rax, qword [str.C7GpRv9hbgQYt]
mov rcx, rsi
mov qword [rbp - 0x40], rax
mov eax, dword [0x140151b50]
mov dword [rbp - 0x38], eax
movzx eax, word [0x140151b54]
mov word [rbp - 0x34], ax
lea rax, [rbp - 0x40]
inc rcx
cmp byte [rax + rcx], dil
jne 0x140053f55
mov rax, r14
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400cd108
mov rcx, rax
call fcn.1400cebfc
lea rbx, [0x1401bf858]
lea rdx, [0x1401bed91]
nop word [rax + rax]
movzx eax, byte [rdi + rdx - 1]
movzx ecx, word [rbp + rdi*2 - 0x2e]
add rdi, 5
xor ax, word [rbp + rdi*2 - 0x3a]
mov word [rbx + rdi*2 - 0xa], ax
movzx eax, byte [rdi + rdx - 5]
xor cx, ax
movzx eax, byte [rdi + rdx - 4]
xor ax, word [rbp + rdi*2 - 0x36]
mov word [rbx + rdi*2 - 8], cx
mov word [rbx + rdi*2 - 6], ax
movzx eax, byte [rdi + rdx - 3]
xor ax, word [rbp + rdi*2 - 0x34]
mov word [rbx + rdi*2 - 4], ax
movzx eax, byte [rdi + rdx - 2]
xor ax, word [rbp + rdi*2 - 0x32]
mov word [rbx + rdi*2 - 2], ax
cmp rdi, 0xf
jl 0x140053f90
mov ecx, dword [0x1401c3d80]
mov rdi, qword [rsp + 0x78]
mov byte [0x1401c596a], 1
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0xb21642c9
imul r8d, ecx
imul r8d
add edx, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub r8d, edx
cmp r8d, 0xf
jne 0x140054074
mov rax, qword [str.uxTJz7HRQ6]
lea rdx, [rbp - 0x40]
mov rcx, rsi
mov qword [rbp - 0x40], rax
movzx eax, word [0x140151b30]
mov word [rbp - 0x38], ax
movzx eax, byte [0x140151b32]
mov byte [rbp - 0x36], al
inc rcx
cmp byte [rdx + rcx], 0
jne 0x140054051
mov rax, r14
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400cd108
mov rcx, rax
call fcn.1400cebfc
mov r14, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x70]
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cdac0
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rbp
ret
Function at 0x1400540a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, dword [0x1401c3d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub ecx, edx
cmp ecx, 3
jne 0x1400540ee
mov edx, 0x8c
lea rcx, str._d__d_n
lea r8d, [rdx + 1]
call fcn.1400ce3cc
cmp byte [0x1401c5947], 0
je 0x140054110
lea rax, [0x1401bf938]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x58
ret
mov dword [rsp + 0x20], 0xf000e
mov dword [rsp + 0x24], 0x4000a
mov dword [rsp + 0x28], 0x540015
mov dword [rsp + 0x2c], 0x1f0016
mov dword [rsp + 0x30], 0xb0006
mov dword [rsp + 0x34], 0x7004f
mov dword [rsp + 0x38], 0x1d0015
mov dword [rsp + 0x3c], 0x10
xor r8d, r8d
lea rdx, [0x1401bf938]
lea r9, [0x1401bed91]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 0x22]
add r8, 5
xor ax, word [rsp + r8*2 + 0x16]
mov word [rdx + r8*2 - 0xa], ax
movzx eax, byte [r8 + r9 - 5]
xor cx, ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rsp + r8*2 + 0x1a]
mov word [rdx + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 + 0x1c]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 + 0x1e]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0xf
jl 0x140054170
mov byte [0x1401c5947], 1
mov rax, rdx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x58
ret
Function at 0x140054200
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push rdi
sub rsp, 0x100
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov r11d, dword [0x1401c3d80]
mov eax, 0x38e38e39
xor edi, edi
lea ecx, [r11 + 1]
imul ecx, r11d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 3
jne 0x1400542ea
mov edx, edi
nop
mov ecx, edx
mov eax, edx
inc edx
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, r11d
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, r11d
xor eax, ecx
mov ecx, eax
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, r11d
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, r11d
xor eax, ecx
mov ecx, eax
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, r11d
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, r11d
xor eax, ecx
mov ecx, eax
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, r11d
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, r11d
xor eax, ecx
add r11d, eax
cmp edx, 0x100
jl 0x140054250
mov dword [0x1401c3d80], r11d
cmp byte [0x1401c5943], dil
jne 0x140054467
mov ecx, r11d
mov eax, 0x2aaaaaab
imul ecx, r11d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 2
jne 0x1400543db
mov qword [rsp + 0x110], rbx
mov qword [rsp + 0x118], rbp
mov qword [rsp + 0x120], rsi
mov qword [rsp + 0x128], r12
mov eax, 0x66666667
mov qword [rsp + 0xf8], r14
mov qword [rsp + 0xf0], r15
imul r11d
mov ebp, edx
sar ebp, 1
mov ecx, ebp
shr ecx, 0x1f
add ebp, ecx
lea rcx, [rsp + 1]
nop word [rax + rax]
mov ebx, 1
movzx r10d, r11b
lea esi, [rbx + 0xa]
sub r10b, dil
nop
mov eax, r11d
add rcx, 5
cdq
idiv ebx
inc ebx
mov r9d, edx
movzx eax, r9b
imul bpl
movzx edx, al
movzx eax, r10b
imul dl
dec rsi
jne 0x140054380
inc edi
cmp edi, 4
jl 0x140054370
mov r15, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xf8]
mov r12, qword [rsp + 0x128]
mov rsi, qword [rsp + 0x120]
mov rbp, qword [rsp + 0x118]
mov rbx, qword [rsp + 0x110]
movzx eax, byte [0x1401bed90]
mov byte [0x1401c5943], 1
xor al, 0x4a
movzx eax, al
mov word [0x1401bfa98], ax
movzx eax, byte [0x1401bed91]
xor al, 0xc
movzx eax, al
mov word [0x1401bfa9a], ax
movzx eax, byte [0x1401bed92]
xor al, 4
movzx eax, al
mov word [reloc.OLEAUT32.dll_SysReAllocStringLen], ax
movzx eax, byte [0x1401bed93]
xor al, 0x15
movzx eax, al
mov word [0x1401bfa9e], ax
movzx eax, byte [0x1401bed94]
xor al, 0x11
movzx eax, al
mov word [0x1401bfaa0], ax
movzx eax, byte [0x1401bed95]
xor al, 0x42
movzx eax, al
mov word [0x1401bfaa2], ax
movzx eax, byte [0x1401bed96]
xor al, 0x52
movzx eax, al
mov word [0x1401bfaa4], ax
lea rax, [0x1401bfa98]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x100
pop rdi
ret
Function at 0x140054490
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ecx, dword [0x1401c3d80]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x2aaaaaab
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 2
jne 0x140054512
xor edx, edx
lea r8, [rsp + 0x30]
nop word [rax + rax]
mov eax, dword [r8]
inc edx
lea r8, [r8 + 4]
imul eax, eax, 0xda
add ecx, eax
movsxd rax, edx
cmp rax, 0x18c
jb 0x1400544f0
mov dword [0x1401c3d80], ecx
cmp byte [0x1401c595e], 0
jne 0x140054663
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x92492493
imul r8d, ecx
imul r8d
add edx, r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
sub r8d, edx
cmp r8d, 5
jne 0x14005456e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov ecx, dword [0x1401c3d80]
movzx eax, byte [0x1401bed90]
mov r8d, ecx
mov byte [0x1401c595e], 1
xor al, 0x4a
imul r8d, ecx
imul r8d, ecx
movzx eax, al
mov word [0x1401bf9d8], ax
movzx eax, byte [0x1401bed91]
xor al, 0xc
movzx eax, al
mov word [0x1401bf9da], ax
movzx eax, byte [0x1401bed92]
xor al, 4
movzx eax, al
mov word [reloc.OLEAUT32.dll_SysReAllocStringLen], ax
movzx eax, byte [0x1401bed93]
xor al, 0x15
movzx eax, al
mov word [0x1401bf9de], ax
movzx eax, byte [0x1401bed94]
xor al, 0x11
movzx eax, al
mov word [0x1401bf9e0], ax
movzx eax, byte [0x1401bed95]
xor al, 0x5a
movzx eax, al
mov word [0x1401bf9e2], ax
movzx eax, byte [0x1401bed96]
xor al, 2
movzx eax, al
mov word [reloc.OLEAUT32.dll_SysReAllocString], ax
movzx eax, byte [0x1401bed97]
xor al, 1
movzx eax, al
mov word [0x1401bf9e6], ax
movzx eax, byte [0x1401bed98]
xor al, 5
movzx eax, al
mov word [0x1401bf9e8], ax
mov eax, 0x66666667
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 0xe
jne 0x140054663
call fcn.1400ce478
mov ecx, dword [0x1401c3d80]
cmp ecx, eax
jne 0x140054663
dec ecx
mov dword [0x1401c3d80], ecx
lea rax, [0x1401bf9d8]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x1d8
ret
Function at 0x140054690
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401c5965], 0
lea rax, [0x1401bf308]
jne 0x1400547a0
xor r8d, r8d
mov dword [rbp - 0x40], 0x30004
mov dword [rbp - 0x3c], 0x170005
mov dword [rbp - 0x38], 0x150050
mov dword [rbp - 0x34], 0x1000a
mov dword [rbp - 0x30], 0xb0006
mov word [rbp - 0x10], r8w
mov dword [rbp - 0x2c], 0x8004f
mov dword [rbp - 0x28], 0x130017
mov dword [rbp - 0x24], 0x140010
mov dword [rbp - 0x20], 0x450003
mov dword [rbp - 0x1c], 0x2000a
mov dword [rbp - 0x18], 0x30004
mov dword [rbp - 0x14], 0x80007
lea r9, [0x1401bed91]
nop
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 6
xor cx, word [rbp + r8*2 - 0x4c]
mov word [rax + r8*2 - 0xc], cx
movzx ecx, byte [r8 + r9 - 6]
xor dx, cx
movzx ecx, byte [r8 + r9 - 5]
xor cx, word [rbp + r8*2 - 0x48]
mov word [rax + r8*2 - 0xa], dx
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x18
jl 0x140054720
mov byte [0x1401c5965], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x40
pop rbp
ret

Function at 0x1400549f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp byte [0x1401c5953], 0
je 0x140054a25
lea rax, [0x1401bf3e0]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x58
ret
mov dword [rsp + 0x20], 0x140009
mov dword [rsp + 0x24], 0x3c001b
mov dword [rsp + 0x28], 0x40019
mov dword [rsp + 0x2c], 0x320005
mov dword [rsp + 0x30], 0x10000c
mov dword [rsp + 0x34], 0xc000c
mov dword [rsp + 0x38], 0x40004
mov dword [rsp + 0x3c], 0x8001c
mov dword [rsp + 0x40], 0x1e
xor r10d, r10d
call fcn.140051480
test al, al
jne 0x140054a7f
dec dword [0x1401c3d80]
lea rax, [0x1401bf3e0]
lea rdx, [0x1401bed90]
nop dword [rax]
movzx ecx, byte [r10 + rdx]
inc r10
xor cx, word [rsp + r10*2 + 0x1e]
mov word [rax + r10*2 - 2], cx
cmp r10, 0x11
jl 0x140054a90
mov byte [0x1401c5953], 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x58
ret
Function at 0x140054ca0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r8d, dword [0x1401c3d80]
mov eax, 0x38e38e39
mov ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xf
jne 0x140054d27
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x141
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400cd108
mov rcx, rax
call fcn.1400cebfc
cmp byte [0x1401c594b], 0
lea rax, [0x1401bfc08]
jne 0x140054e0c
xor r8d, r8d
mov dword [rbp - 0x50], 0x140009
mov dword [rbp - 0x4c], 0x3c001b
mov dword [rbp - 0x48], 0x1d0016
mov dword [rbp - 0x44], 0x1e0014
mov dword [rbp - 0x40], 0x37001d
mov word [rbp - 0x18], r8w
mov dword [rbp - 0x3c], 0x70006
mov dword [rbp - 0x38], 0x15001e
mov dword [rbp - 0x34], 0x130016
mov dword [rbp - 0x30], 0xa0019
mov dword [rbp - 0x2c], 0x380000
mov dword [rbp - 0x28], 0xf000e
mov dword [rbp - 0x24], 0x90016
mov dword [rbp - 0x20], 0x1c000c
mov dword [rbp - 0x1c], 0x90009
lea r9, [0x1401bed91]
nop dword [rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x4e]
add r8, 4
xor cx, word [rbp + r8*2 - 0x58]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x54]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x52]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x1c
jl 0x140054db0
mov byte [0x1401c594b], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x70
pop rbp
ret
Function at 0x140054e20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401c596e], 0
je 0x140054e53
lea rax, [0x1401bf5b0]
jmp 0x140054fd8
call fcn.1400510b0
mov ebx, 1
test al, al
jne 0x140054e87
mov r8d, dword [0x1401c3d80]
mov ecx, ebx
cmp r8d, ebx
jle 0x140054e7f
nop
mov eax, r8d
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, r8d
jl 0x140054e70
mov dword [0x1401c3d80], ecx
jmp 0x140054e8d
mov ecx, dword [0x1401c3d80]
mov dword [rbp - 0x60], 0x100002
mov dword [rbp - 0x5c], 0xc0019
mov dword [rbp - 0x58], 0x540002
mov dword [rbp - 0x54], 0x80001
mov dword [rbp - 0x50], 0x1c001d
mov dword [rbp - 0x4c], 0x70006
mov dword [rbp - 0x48], 0x500013
mov dword [rbp - 0x44], 0xe0013
mov dword [rbp - 0x40], 0x160002
mov dword [rbp - 0x3c], 0x47001a
mov dword [rbp - 0x38], 0x18001a
mov dword [rbp - 0x34], 0xf000d
mov dword [rbp - 0x30], 0x1b000a
mov dword [rbp - 0x2c], 0x4d001f
mov dword [rbp - 0x28], 0xb0019
mov dword [rbp - 0x24], 0xc0012
mov dword [rbp - 0x20], 0x54
xor r8d, r8d
lea rbx, [0x1401bf5b0]
lea r9, [0x1401bed91]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x5e]
add r8, 3
xor ax, word [rbp + r8*2 - 0x66]
mov word [rbx + r8*2 - 6], ax
movzx eax, byte [r8 + r9 - 3]
xor dx, ax
movzx eax, byte [r8 + r9 - 2]
xor ax, word [rbp + r8*2 - 0x62]
mov word [rbx + r8*2 - 4], dx
mov word [rbx + r8*2 - 2], ax
cmp r8, 0x21
jl 0x140054f20
lea r8d, [rcx + 1]
mov eax, 0x92492493
imul r8d, ecx
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub r8d, edx
cmp r8d, 0xd
jne 0x140054fce
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub ecx, edx
add ecx, 0x141
movsxd rdx, ecx
mov rcx, 0xffffffffffffffff
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.1400cd108
mov rcx, rax
call fcn.1400cebfc
mov byte [0x1401c596e], 1
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cdac0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret