joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004df60
Capabilities:
Check os version
Get disk size

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x30], edi
mov edx, dword [0x1401bdd80]
lea r8d, [rdx + 2]
lea eax, [rdx + 1]
imul r8d, eax
imul r8d, edx
mov eax, 0x66666667
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub r8d, eax
cmp r8d, 5
jne 0x14004dfcd
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
movzx esi, al
shr ax, 8
movzx ebp, al
cmp ecx, 0x80000000
jae 0x14004dfec
shr ecx, 0x10
mov edi, ecx
mov r9d, dword [0x1401bdd80]
lea r8d, [r9 + 2]
lea ecx, [r9 + 1]
imul r8d, ecx
imul r8d, r9d
mov eax, 0x66666667
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 0x13
jne 0x14004e045
mov ecx, 1
cmp r9d, ecx
jle 0x14004e03f
nop
mov eax, r9d
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, r9d
jl 0x14004e030
mov dword [0x1401bdd80], ecx
cmp esi, 6
jb 0x14004e062
cmp ebp, 2
jb 0x14004e062
mov rcx, rbx
call fcn.14004e370
nop
mov dword [rsp + 0x30], 1
jmp 0x14004e0c9
lea rcx, [0x1401b59a8]
mov rax, qword [0x1401b59a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x20], edi
mov r9d, ebp
mov r8d, esi
lea rdx, str._d._d___d_
lea rcx, [rsp + 0x68]
call fcn.140012200
mov rdi, qword [rsp + 0x68]
lea rcx, [rdi - 0x18]
call fcn.1400024f0
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x30], 1
lock add dword [rdi - 8], 0xffffffff
jg 0x14004e0c9
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004f300
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [0x1401bdd80]
lea eax, [rdx + 1]
lea ecx, [rdx + 2]
imul ecx, eax
imul ecx, edx
and ecx, 0x80000007
jge 0x14004f321
dec ecx
or ecx, 0xfffffff8
inc ecx
cmp ecx, 1
jne 0x14004f3e7
imul eax, eax
imul eax, edx
imul eax, edx
and eax, 0x80000003
jge 0x14004f341
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x14004f3e4
xor r8d, r8d
nop dword [rax]
mov ecx, r8d
mov eax, r8d
inc r8d
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, edx
xor eax, ecx
mov ecx, eax
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, edx
xor eax, ecx
mov ecx, eax
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, edx
xor eax, ecx
mov ecx, eax
sar eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, edx
xor ecx, eax
mov eax, ecx
sar ecx, 1
and eax, 1
dec eax
not eax
and eax, edx
xor eax, ecx
add edx, eax
cmp r8d, 0x100
jl 0x14004f350
mov dword [0x1401bdd80], edx
xor al, al
ret
mov al, 1
ret

Function at 0x14004f9c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401bf557], 0
je 0x14004f9f9
lea rax, [0x1401b9b10]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x60
pop rbp
ret
mov dword [rbp - 0x40], 0xe0004
mov dword [rbp - 0x3c], 0x60006
xor eax, eax
mov dword [rbp - 0x38], 0xb0000
mov dword [rbp - 0x34], 0x150031
mov dword [rbp - 0x30], 0x2f0005
mov dword [rbp - 0x2c], 0xa
mov dword [rbp - 0x28], 0xb0002
mov dword [rbp - 0x24], 4
mov dword [rbp - 0x20], 0x18003b
mov dword [rbp - 0x1c], 0x20000
mov dword [rbp - 0x18], 0x80005
mov dword [rbp - 0x14], 0x1c
lea r10, [0x1401b9b10]
lea rdx, [0x1401b8da0]
nop dword [rax]
movzx ecx, byte [rax + rdx]
inc rax
xor cx, word [rbp + rax*2 - 0x42]
mov word [r10 + rax*2 - 2], cx
cmp rax, 0x17
jl 0x14004fa60
mov r9d, dword [0x1401bdd80]
mov eax, 0x30c30c31
mov byte [0x1401bf557], 1
lea r8d, [r9 + 1]
mov ecx, r8d
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 3
cmove r9d, r8d
mov dword [0x1401bdd80], r9d
call fcn.14004f300
test al, al
jne 0x14004fad4
mov eax, dword [0x1401bdd80]
mov ecx, 1
test eax, eax
cmove eax, ecx
mov dword [0x1401bdd80], eax
mov rax, r10
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x60
pop rbp
ret
Function at 0x14004fb70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp - 8], rax
mov r12d, dword [0x1401bdd80]
mov eax, 0x6bca1af3
xor r10d, r10d
mov r13d, r12d
imul r13d, r12d
mov ecx, r13d
imul ecx, r12d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 0xd
jne 0x14004fc53
mov eax, r12d
lea r11d, [r10 + 0x31]
mov r14d, r10d
cdq
sub eax, edx
sar eax, 1
mov r15d, eax
test r15d, r15d
jle 0x14004fc4b
mov eax, r12d
mov ebx, r10d
mov rsi, r15
cdq
and edx, 3
lea edi, [rdx + rax]
sar edi, 2
nop
mov r8d, r10d
mov r9d, r10d
mov ecx, r10d
cmp edi, 2
jl 0x14004fc31
lea ecx, [rdi - 2]
mov edx, ebx
shr ecx, 1
inc ecx
mov eax, ecx
add ecx, ecx
nop dword [rax + rax]
dec r9d
add r8d, edx
add r9d, edx
sub edx, 2
dec rax
jne 0x14004fc20
cmp ecx, edi
jge 0x14004fc3c
mov eax, ebx
sub eax, ecx
add r11d, eax
lea eax, [r9 + r8]
add ebx, r14d
add r11d, eax
dec rsi
jne 0x14004fc00
inc r14d
cmp r14d, r11d
jl 0x14004fbe6
cmp byte [0x1401bf574], r10b
je 0x14004fc68
lea rax, [0x1401b9558]
jmp 0x14004fdc8
mov eax, 0x2aaaaaab
mov dword [rbp - 0x40], 0x19000c
mov dword [rbp - 0x3c], 0x35001f
mov dword [rbp - 0x38], 0x10010
mov dword [rbp - 0x34], 0x19000b
mov dword [rbp - 0x30], 0x15001a
imul r13d
mov eax, edx
mov dword [rbp - 0x2c], 0x6000a
mov dword [rbp - 0x28], 0xe0002
shr eax, 0x1f
mov dword [rbp - 0x24], 0x17002f
mov dword [rbp - 0x20], 0x20001
add edx, eax
mov dword [rbp - 0x1c], 0x180006
mov dword [rbp - 0x18], 0x380004
lea eax, [rdx + rdx*2]
mov dword [rbp - 0x14], 0x80003
mov dword [rbp - 0x10], 0x60009
add eax, eax
mov word [rbp - 0xc], r10w
sub r13d, eax
cmp r13d, 2
jne 0x14004fd73
mov eax, r12d
mov r11d, 0xd2
mov r14d, r10d
cdq
sub eax, edx
sar eax, 1
mov r15d, eax
nop dword [rax]
test r15d, r15d
jle 0x14004fd6b
mov eax, r12d
mov ebx, r10d
mov rsi, r15
cdq
and edx, 3
lea edi, [rdx + rax]
sar edi, 2
nop dword [rax + rax]
mov r8d, r10d
mov r9d, r10d
mov edx, r10d
cmp edi, 2
jl 0x14004fd51
lea edx, [rdi - 2]
mov ecx, ebx
shr edx, 1
inc edx
mov eax, edx
add edx, edx
nop dword [rax + rax]
dec r9d
add r8d, ecx
add r9d, ecx
sub ecx, 2
dec rax
jne 0x14004fd40
cmp edx, edi
jge 0x14004fd5c
mov eax, ebx
sub eax, edx
add r11d, eax
lea eax, [r9 + r8]
add ebx, r14d
add r11d, eax
dec rsi
jne 0x14004fd20
inc r14d
cmp r14d, r11d
jl 0x14004fd00
lea rax, [0x1401b9558]
lea r8, [0x1401b8da1]
nop word [rax + rax]
movzx ecx, byte [r10 + r8 - 1]
movzx edx, word [rbp + r10*2 - 0x3e]
add r10, 2
xor cx, word [rbp + r10*2 - 0x44]
mov word [rax + r10*2 - 4], cx
movzx ecx, byte [r10 + r8 - 2]
xor dx, cx
mov word [rax + r10*2 - 2], dx
cmp r10, 0x1a
jl 0x14004fd90
mov byte [0x1401bf574], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400cbae0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14004fe00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401bf56f], 0
je 0x14004fe35
lea rax, [0x1401b96d8]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x38
ret
mov r9d, dword [0x1401bdd80]
xor r8d, r8d
mov eax, 0xb21642c9
mov ecx, r9d
mov r10d, 1
mov dword [rsp], 0x70001
mov dword [rsp + 4], 0x12002a
mov dword [rsp + 8], 0x1b000c
mov dword [rsp + 0xc], 0xe002d
imul ecx, r9d
imul ecx
add edx, ecx
mov dword [rsp + 0x10], 0x15000e
mov dword [rsp + 0x14], 0x11004f
sar edx, 4
mov dword [rsp + 0x18], 0xe0008
mov dword [rsp + 0x1c], 0x580015
mov eax, edx
mov word [rsp + 0x20], r8w
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 0x16
jne 0x14004febc
test r9d, r9d
cmove r9d, r10d
mov dword [0x1401bdd80], r9d
lea rax, [0x1401b96d8]
lea r9, [0x1401b8da1]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rsp + r8*2 + 2]
add r8, 4
xor cx, word [rsp + r8*2 - 8]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x10
jl 0x14004fed0
mov byte [0x1401bf56f], r10b
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x38
ret

Function at 0x140050480
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp - 0x20], rax
mov r8d, dword [0x1401bdd80]
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x55555556
imul ecx, r8d
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub ecx, eax
cmp ecx, 1
jne 0x140050522
movsd xmm3, qword [0x14014da70]
movsd xmm5, qword [0x14014da98]
movd xmm4, r8d
xorps xmm2, xmm2
movaps xmmword [rsp + 0x50], xmm6
movsd xmm6, qword [0x14014da68]
cvtdq2pd xmm4, xmm4
nop
addsd xmm2, xmm3
movaps xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x140050509
invalid
subsd xmm2, xmm3
divsd xmm3, xmm5
movaps xmm1, xmm2
movaps xmm0, xmm4
mulsd xmm1, xmm2
subsd xmm0, xmm1
comisd xmm0, xmm6
ja 0x1400504f0
movaps xmm6, xmmword [rsp + 0x50]
cmp byte [0x1401bf57c], 0
lea rax, [0x1401b9660]
jne 0x1400505cf
mov dword [rbp - 0x60], 0xb0023
mov dword [rbp - 0x5c], 0x1f0005
mov dword [rbp - 0x58], 0x1b0016
mov dword [rbp - 0x54], 0xe003a
mov dword [rbp - 0x50], 0x150001
mov dword [rbp - 0x4c], 0x220007
mov dword [rbp - 0x48], 0x30015
mov dword [rbp - 0x44], 0xc0006
mov dword [rbp - 0x40], 0xa0008
mov dword [rbp - 0x3c], 0x9000e
mov dword [rbp - 0x38], 0x470012
mov dword [rbp - 0x34], 0x8000d
mov dword [rbp - 0x30], 0x1e000c
mov dword [rbp - 0x2c], 0x20010
mov dword [rbp - 0x28], 0x50
xor edx, edx
lea r8, [0x1401b8da0]
nop dword [rax + rax]
movzx ecx, byte [rdx + r8]
inc rdx
xor cx, word [rbp + rdx*2 - 0x62]
mov word [rax + rdx*2 - 2], cx
cmp rdx, 0x1d
jl 0x1400505b0
mov byte [0x1401bf57c], 1
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x60
pop rbp
ret
Function at 0x1400505f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401bf566], 0
lea rax, [0x1401b9778]
jne 0x1400506b7
xor ecx, ecx
mov dword [rbp - 0x40], 0x30003
mov dword [rbp - 0x3c], 0x4a0003
mov dword [rbp - 0x38], 0x230021
mov dword [rbp - 0x34], 0x120022
mov dword [rbp - 0x30], 0x14004a
mov word [rbp - 0x14], cx
mov dword [rbp - 0x2c], 0x170006
mov dword [rbp - 0x28], 0x40014
mov dword [rbp - 0x24], 0x450004
mov dword [rbp - 0x20], 0x170001
mov dword [rbp - 0x1c], 0x1f0000
mov dword [rbp - 0x18], 0x490015
lea r9, [0x1401b8da1]
nop word [rax + rax]
movzx edx, byte [rcx + r9 - 1]
movzx r8d, word [rbp + rcx*2 - 0x3e]
add rcx, 2
xor dx, word [rbp + rcx*2 - 0x44]
mov word [rax + rcx*2 - 4], dx
movzx edx, byte [rcx + r9 - 2]
xor r8w, dx
mov word [rax + rcx*2 - 2], r8w
cmp rcx, 0x16
jl 0x140050680
mov byte [0x1401bf566], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x40
pop rbp
ret

Function at 0x140050a40
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp - 0x20], rax
mov r9d, dword [0x1401bdd80]
mov eax, r9d
imul eax, r9d
and eax, 0x8000000f
jge 0x140050a76
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 0xa
jne 0x140050a8a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov r9d, dword [0x1401bdd80]
cmp byte [0x1401bf54f], 0
je 0x140050a9f
lea rax, str.__ne:
jmp 0x140050be1
lea eax, [r9 + 1]
lea ecx, [r9 + 2]
xor r8d, r8d
mov qword [rsp + 0x90], rbx
mov rbx, qword [rsp + 0x90]
mov dword [rbp - 0x60], 0xa0025
imul ecx, eax
imul ecx, r9d
mov eax, 0x2e8ba2e9
mov dword [rbp - 0x5c], 0x3a001b
mov dword [rbp - 0x58], 0x17
mov dword [rbp - 0x54], 0x20000d
mov dword [rbp - 0x50], 0x14000e
mov dword [rbp - 0x4c], 0x17001b
imul ecx
sar edx, 1
mov dword [rbp - 0x48], 0x190014
mov dword [rbp - 0x44], 0xa0050
mov eax, edx
mov dword [rbp - 0x40], 0x4f0002
mov dword [rbp - 0x3c], 0x30025
shr eax, 0x1f
mov dword [rbp - 0x38], 0x30000
mov dword [rbp - 0x34], 0x27
add edx, eax
mov dword [rbp - 0x30], 7
mov dword [rbp - 0x2c], 0x140014
mov dword [rbp - 0x28], 0x570009
mov dword [rbp - 0x24], 0x47
imul edx, edx, 0xb
sub ecx, edx
cmp ecx, 4
jne 0x140050bb2
movsd xmm3, qword [0x14014da70]
movsd xmm5, qword [0x14014da98]
movd xmm4, r9d
xorps xmm2, xmm2
movaps xmmword [rsp + 0x70], xmm6
movsd xmm6, qword [0x14014da68]
cvtdq2pd xmm4, xmm4
nop word [rax + rax]
addsd xmm2, xmm3
movaps xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x140050b99
subsd xmm2, xmm3
divsd xmm3, xmm5
movaps xmm1, xmm2
movaps xmm0, xmm4
mulsd xmm1, xmm2
subsd xmm0, xmm1
comisd xmm0, xmm6
ja 0x140050b80
movaps xmm6, xmmword [rsp + 0x70]
lea rax, str.__ne:
lea rdx, [0x1401b8da0]
movzx ecx, byte [r8 + rdx]
inc r8
xor cx, word [rbp + r8*2 - 0x62]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x1f
jl 0x140050bc0
mov byte [0x1401bf54f], 1
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x80
pop rbp
ret
Function at 0x140050c00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rsp + 0x18], rax
cmp byte [0x1401bf56a], 0
lea rax, [0x1401b9c28]
jne 0x140050c7f
mov dword [rsp], 0x1004f
xor ecx, ecx
mov dword [rsp + 4], 0x1c0000
mov dword [rsp + 8], 0x590004
mov dword [rsp + 0xc], 0x4f005a
mov dword [rsp + 0x10], 0x1c000e
mov dword [rsp + 0x14], 5
lea r8, [0x1401b8da0]
nop dword [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 - 2]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0xb
jl 0x140050c60
mov byte [0x1401bf56a], 1
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x28
ret

Function at 0x140050ca0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401bf577], 0
lea rax, [0x1401b9700]
jne 0x140050dac
xor r8d, r8d
mov dword [rbp - 0x60], 0x30003
mov dword [rbp - 0x5c], 0x50003
mov dword [rbp - 0x58], 0x4f0006
mov dword [rbp - 0x54], 8
mov dword [rbp - 0x50], 0x1c0003
mov word [rbp - 0x20], r8w
mov dword [rbp - 0x4c], 0x16000c
mov dword [rbp - 0x48], 0x1a0047
mov dword [rbp - 0x44], 0xa0002
mov dword [rbp - 0x40], 0x4f0007
mov dword [rbp - 0x3c], 0x1f0000
mov dword [rbp - 0x38], 0x130041
mov dword [rbp - 0x34], 0x1b000e
mov dword [rbp - 0x30], 0x1b0008
mov dword [rbp - 0x2c], 0x7001b
mov dword [rbp - 0x28], 0x40004
mov dword [rbp - 0x24], 0xe0009
lea r9, [0x1401b8da1]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x5e]
add r8, 4
xor cx, word [rbp + r8*2 - 0x68]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x64]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x62]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x20
jl 0x140050d50
mov byte [0x1401bf577], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x60
pop rbp
ret
Function at 0x140050dc0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401bf57a], 0
lea rax, [0x1401b9590]
jne 0x140050ec0
xor r8d, r8d
mov dword [rbp - 0x30], 0x70001
mov dword [rbp - 0x2c], 0x1c0030
mov dword [rbp - 0x28], 0x1d0000
mov dword [rbp - 0x24], 0x8001d
mov dword [rbp - 0x20], 0x1e0005
mov word [rbp - 0xc], r8w
mov dword [rbp - 0x1c], 0x110036
mov dword [rbp - 0x18], 0xb000f
mov dword [rbp - 0x14], 0x2001e
mov dword [rbp - 0x10], 0x300001
lea r9, [0x1401b8da1]
nop dword [rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x2e]
add r8, 6
xor cx, word [rbp + r8*2 - 0x3c]
mov word [rax + r8*2 - 0xc], cx
movzx ecx, byte [r8 + r9 - 6]
xor dx, cx
movzx ecx, byte [r8 + r9 - 5]
xor cx, word [rbp + r8*2 - 0x38]
mov word [rax + r8*2 - 0xa], dx
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x36]
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x34]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x32]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x12
jl 0x140050e40
mov byte [0x1401bf57a], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x30
pop rbp
ret

Function at 0x140050fc0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.14004f300
xor ecx, ecx
test al, al
jne 0x140051006
mov eax, dword [0x1401bdd80]
mov r8d, ecx
test eax, eax
je 0x140050fff
nop
mov edx, eax
and edx, 1
add r8d, edx
cdq
sub eax, edx
sar eax, 1
jne 0x140050ff0
mov dword [0x1401bdd80], r8d
cmp byte [0x1401bf56c], cl
lea rax, [0x1401b9980]
jne 0x14005108f
mov dword [rbp - 0x40], 0xe0001
mov dword [rbp - 0x3c], 0x1e0001
mov dword [rbp - 0x38], 0x90045
mov dword [rbp - 0x34], 0xf0007
mov dword [rbp - 0x30], 0x50000e
mov dword [rbp - 0x2c], 0x7000a
mov dword [rbp - 0x28], 0x180015
mov dword [rbp - 0x24], 0xb0015
mov dword [rbp - 0x20], 0x220010
mov dword [rbp - 0x1c], 0x80006
mov dword [rbp - 0x18], 0xb0014
mov dword [rbp - 0x14], 0xe
lea r8, [0x1401b8da0]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rbp + rcx*2 - 0x42]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x17
jl 0x140051070
mov byte [0x1401bf56c], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x60
pop rbp
ret
Function at 0x1400510b0
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x70
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r8d, dword [0x1401bdd80]
mov eax, 0x2aaaaaab
xor edi, edi
lea ecx, [r8 + 1]
imul ecx, r8d
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
cmp ecx, 4
jne 0x14005111e
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r8d, dword [0x1401bdd80]
cmp byte [0x1401bf54a], dil
mov qword [rsp + 0x80], rbx
je 0x14005113b
lea rax, [0x1401b9b98]
jmp 0x140051222
mov dword [rsp + 0x40], 0x19000c
mov dword [rsp + 0x44], 0x35001f
mov dword [rsp + 0x48], 0x1f000c
mov dword [rsp + 0x4c], 0x3e000d
mov dword [rsp + 0x50], 0x19001e
mov dword [rsp + 0x54], 0x170004
mov dword [rsp + 0x58], 0x50003
mov dword [rsp + 0x5c], 0x110005
mov word [rsp + 0x60], di
mov rdx, rdi
lea rbx, [0x1401b9b98]
lea r9, [0x1401b8da1]
movzx eax, byte [rdx + r9 - 1]
movzx ecx, word [rsp + rdx*2 + 0x42]
add rdx, 4
xor ax, word [rsp + rdx*2 + 0x38]
mov word [rbx + rdx*2 - 8], ax
movzx eax, byte [rdx + r9 - 4]
xor cx, ax
movzx eax, byte [rdx + r9 - 3]
xor ax, word [rsp + rdx*2 + 0x3c]
mov word [rbx + rdx*2 - 6], cx
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r9 - 2]
xor ax, word [rsp + rdx*2 + 0x3e]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0x10
jl 0x140051191
imul r8d, r8d
mov eax, 0xb21642c9
mov byte [0x1401bf54a], 1
imul r8d
add edx, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub r8d, edx
cmp r8d, 0x16
jne 0x14005121f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov rax, rbx
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x70
pop rdi
ret
Function at 0x140051240
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp - 8], rax
mov r8d, dword [0x1401bdd80]
xor ebx, ebx
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x88888889
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 4
jne 0x1400512c1
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r8d, dword [0x1401bdd80]
cmp byte [0x1401bf565], bl
je 0x1400512d5
lea rax, [0x1401b9508]
jmp 0x1400513f4
lea ecx, [r8 + 1]
mov eax, 0x38e38e39
mov dword [rbp - 0x40], 0x1f002d
mov dword [rbp - 0x3c], 0x4000a
mov dword [rbp - 0x38], 0x1d0035
mov dword [rbp - 0x34], 0x20001
imul ecx, r8d
imul ecx
sar edx, 2
mov dword [rbp - 0x30], 0x3000f
mov dword [rbp - 0x2c], 0x26001a
mov eax, edx
mov dword [rbp - 0x28], 0x10008
mov dword [rbp - 0x24], 0xb0015
shr eax, 0x1f
mov dword [rbp - 0x20], 0x90044
mov dword [rbp - 0x1c], 0x50008
add edx, eax
mov dword [rbp - 0x18], 0x2000d
mov dword [rbp - 0x14], 0x49000f
lea eax, [rdx + rdx*8]
mov edx, 0x7f90cb9a
mov word [rbp - 0x10], bx
add eax, eax
lea r8, [0x1401b8da1]
sub ecx, eax
mov eax, dword [0x1401bf190]
cmp ecx, 3
cmove eax, edx
mov dword [0x1401bf190], eax
lea rax, [0x1401b9508]
nop word [rax + rax]
movzx ecx, byte [rbx + r8 - 1]
movzx edx, word [rbp + rbx*2 - 0x3e]
add rbx, 6
xor cx, word [rbp + rbx*2 - 0x4c]
mov word [rax + rbx*2 - 0xc], cx
movzx ecx, byte [rbx + r8 - 6]
xor dx, cx
movzx ecx, byte [rbx + r8 - 5]
xor cx, word [rbp + rbx*2 - 0x48]
mov word [rax + rbx*2 - 0xa], dx
mov word [rax + rbx*2 - 8], cx
movzx ecx, byte [rbx + r8 - 4]
xor cx, word [rbp + rbx*2 - 0x46]
mov word [rax + rbx*2 - 6], cx
movzx ecx, byte [rbx + r8 - 3]
xor cx, word [rbp + rbx*2 - 0x44]
mov word [rax + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor cx, word [rbp + rbx*2 - 0x42]
mov word [rax + rbx*2 - 2], cx
cmp rbx, 0x18
jl 0x140051380
mov byte [0x1401bf565], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400cbae0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x140051420
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401bf550], 0
lea rax, [0x1401b97d8]
jne 0x14005150e
xor r8d, r8d
mov dword [rbp - 0x40], 0x1d0021
mov dword [rbp - 0x3c], 0xb000a
mov dword [rbp - 0x38], 0xa0011
mov dword [rbp - 0x34], 0x4003c
mov dword [rbp - 0x30], 0x1f0007
mov word [rbp - 0x18], r8w
mov dword [rbp - 0x2c], 0x17001d
mov dword [rbp - 0x28], 0x20033
mov dword [rbp - 0x24], 2
mov dword [rbp - 0x20], 0xb0005
mov dword [rbp - 0x1c], 0x4c0053
lea r9, [0x1401b8da1]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 5
xor cx, word [rbp + r8*2 - 0x4a]
mov word [rax + r8*2 - 0xa], cx
movzx ecx, byte [r8 + r9 - 5]
xor dx, cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 8], dx
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x14
jl 0x1400514a0
mov byte [0x1401bf550], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x40
pop rbp
ret