joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140055000
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rsp + 0x18], rax
mov r9d, dword [0x1401c3d80]
mov eax, 0xb21642c9
xor ecx, ecx
lea r8d, [r9 + 1]
imul r8d, r9d
imul r8d
add edx, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub r8d, edx
cmp r8d, 0xe
jne 0x140055070
mov r8d, ecx
test r9d, r9d
je 0x140055066
nop dword [rax]
mov edx, r9d
mov eax, r9d
and edx, 1
add r8d, edx
cdq
sub eax, edx
sar eax, 1
mov r9d, eax
jne 0x140055050
mov r9d, r8d
mov dword [0x1401c3d80], r8d
cmp byte [0x1401c5963], cl
je 0x140055091
lea rax, [0x1401bf8d8]
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x28
ret
lea r8d, [r9 + 1]
mov eax, 0x2e8ba2e9
mov dword [rsp], 0x70011
mov dword [rsp + 4], 0x100019
mov dword [rsp + 8], 0x1b0019
mov dword [rsp + 0xc], 0x4d0008
imul r8d, r9d
imul r8d
sar edx, 1
mov dword [rsp + 0x10], 0x1a000c
mov dword [rsp + 0x14], 0x1d
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub r8d, edx
cmp r8d, 3
jne 0x140055110
mov eax, 0xa7
mov r9d, 0xe5
test r9d, r9d
je 0x140055107
cdq
mov r8d, r9d
idiv r9d
mov eax, r8d
mov r9d, edx
test r8d, r8d
jne 0x1400550f0
add eax, r9d
mov dword [0x1401c3d80], eax
lea rax, [0x1401bf8d8]
lea r8, [0x1401bed90]
nop
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 - 2]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0xb
jl 0x140055120
mov byte [0x1401c5963], 1
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x28
ret

Function at 0x140055160
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rsp + 0x20], rax
cmp byte [0x1401c595a], 0
je 0x140055195
lea rax, [0x1401bf9a0]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x38
ret
mov dword [rsp], 0x120028
mov dword [rsp + 4], 0xd000e
mov dword [rsp + 8], 0x60020
mov dword [rsp + 0xc], 0xe0009
mov dword [rsp + 0x10], 0x1b000c
mov dword [rsp + 0x14], 0x49001c
mov dword [rsp + 0x18], 0x50017
mov dword [rsp + 0x1c], 7
xor r8d, r8d
lea rdx, [0x1401bf9a0]
lea r9, [0x1401bed91]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 2]
add r8, 5
xor ax, word [rsp + r8*2 - 0xa]
mov word [rdx + r8*2 - 0xa], ax
movzx eax, byte [r8 + r9 - 5]
xor cx, ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rsp + r8*2 - 6]
mov word [rdx + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0xf
jl 0x1400551f0
mov byte [0x1401c595a], 1
mov rax, rdx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x38
ret
Function at 0x140055280
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r8d, dword [0x1401c3d80]
mov eax, 0x88888889
xor ebx, ebx
lea ecx, [r8 + 1]
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 8
jne 0x1400552e8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov r8d, dword [0x1401c3d80]
cmp byte [0x1401c595b], bl
je 0x1400552fc
lea rax, [0x1401bf470]
jmp 0x14005540e
lea ecx, [r8 + 1]
mov eax, 0x2aaaaaab
mov dword [rbp - 0x50], 0x100024
mov dword [rbp - 0x4c], 0x2000e
mov r11d, 4
mov dword [rbp - 0x48], 0x110004
imul ecx, r8d
imul ecx
sar edx, 1
mov dword [rbp - 0x44], 0x20032
mov dword [rbp - 0x40], 0x40006
mov eax, edx
mov dword [rbp - 0x3c], 0xc0007
mov dword [rbp - 0x38], 0x18
shr eax, 0x1f
mov dword [rbp - 0x34], 0x550046
mov dword [rbp - 0x30], 0xb0023
add edx, eax
mov dword [rbp - 0x2c], 0x17000f
mov dword [rbp - 0x28], 0x20019
lea eax, [rdx + rdx*2]
mov dword [rbp - 0x24], 0x18000d
mov dword [rbp - 0x20], 0xe004f
shl eax, 2
mov dword [rbp - 0x1c], 0x4000d
mov dword [rbp - 0x18], 0x1c
sub ecx, eax
mov dword [rbp - 0x14], 0x10
cmp ecx, 3
jne 0x1400553d7
mov eax, 0x51eb851f
imul r8d
mov eax, r11d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x7b
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400cd108
mov rcx, rax
call fcn.1400cebfc
lea rax, [0x1401bf470]
lea rdx, [0x1401bed90]
nop word [rax + rax]
movzx ecx, byte [rbx + rdx]
inc rbx
xor cx, word [rbp + rbx*2 - 0x52]
mov word [rax + rbx*2 - 2], cx
cmp rbx, 0x1f
jl 0x1400553f0
mov byte [0x1401c595b], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cdac0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x140055430
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r14
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0xe0
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov ecx, dword [0x1401c3d80]
xor r14d, r14d
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x2aaaaaab
imul r8d, ecx
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub r8d, eax
cmp r8d, 9
jne 0x14005551e
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov edi, r14d
lea rsi, [rbp - 0x69]
mov r9d, r14d
nop word [rax + rax]
mov eax, ecx
lea r8d, [rdi + 1]
lea ebx, [r9 + 1]
cdq
idiv r8d
mov eax, ecx
sub eax, edi
mov r8d, edx
imul r8d, eax
mov eax, ecx
lea rcx, [0x14014c428]
cdq
idiv ebx
add r8d, eax
sub r8d, r9d
mov edx, r8d
call fcn.1400ce3cc
add rsi, 4
mov r9d, ebx
cmp ebx, 0x10
jge 0x1400554f7
mov ecx, dword [0x1401c3d80]
jmp 0x1400554b0
inc edi
cmp edi, 2
jge 0x140055506
mov ecx, dword [0x1401c3d80]
jmp 0x1400554a0
mov rsi, qword [rsp + 0xf8]
mov rbx, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0x100]
cmp byte [0x1401c5940], r14b
je 0x140055533
lea rax, [0x1401bf4b0]
jmp 0x140055601
mov dword [rbp + 0x17], 0x100030
mov dword [rbp + 0x1b], 0x170002
mov dword [rbp + 0x1f], 0x240015
mov dword [rbp + 0x23], 0x20014
mov dword [rbp + 0x27], 0xd000a
mov dword [rbp + 0x2b], 0x1a001c
mov dword [rbp + 0x2f], 0x150039
mov dword [rbp + 0x33], 0x80018
mov dword [rbp + 0x37], 0x1c0002
mov dword [rbp + 0x3b], 0x470054
mov word [rbp + 0x3f], r14w
lea rdx, [0x1401bf4b0]
lea r8, [0x1401bed91]
nop dword [rax]
movzx eax, byte [r14 + r8 - 1]
movzx ecx, word [rbp + r14*2 + 0x19]
add r14, 5
xor ax, word [rbp + r14*2 + 0xd]
mov word [rdx + r14*2 - 0xa], ax
movzx eax, byte [r14 + r8 - 5]
xor cx, ax
movzx eax, byte [r14 + r8 - 4]
xor ax, word [rbp + r14*2 + 0x11]
mov word [rdx + r14*2 - 8], cx
movzx ecx, byte [r14 + r8 - 3]
xor cx, word [rbp + r14*2 + 0x13]
mov word [rdx + r14*2 - 6], ax
mov word [rdx + r14*2 - 4], cx
movzx ecx, byte [r14 + r8 - 2]
xor cx, word [rbp + r14*2 + 0x15]
mov word [rdx + r14*2 - 2], cx
cmp r14, 0x14
jl 0x140055590
mov byte [0x1401c5940], 1
mov rax, rdx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400cdac0
mov r14, qword [rsp + 0x108]
add rsp, 0xe0
pop rbp
ret
Function at 0x140055620
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401c5976], 0
lea rax, [0x1401bf5f8]
jne 0x1400556fc
xor r8d, r8d
mov dword [rsp], 0x70011
mov dword [rsp + 4], 0x100019
mov dword [rsp + 8], 0x1b0019
mov dword [rsp + 0xc], 0x570008
mov dword [rsp + 0x10], 0x580049
mov word [rsp + 0x20], r8w
mov dword [rsp + 0x14], 0x590041
mov dword [rsp + 0x18], 0x40005a
mov dword [rsp + 0x1c], 0x57005b
lea r9, [0x1401bed91]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rsp + r8*2 + 2]
add r8, 4
xor cx, word [rsp + r8*2 - 8]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x10
jl 0x1400556a0
mov byte [0x1401c5976], 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x38
ret
Function at 0x140055710
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov ecx, dword [0x1401c3d80]
mov eax, 0x66666667
xor edi, edi
imul ecx, ecx
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
cmp ecx, 3
jne 0x140055887
mov qword [rsp + 0x2f0], rbx
mov ebx, edi
nop dword [rax]
call fcn.1400ce478
inc rbx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rsp + rbx*8 + 0x18], xmm0
cmp rbx, 0x51
jb 0x140055770
mov rbx, qword [rsp + 0x2f0]
mov r9d, 0x50
mov r8, rdi
lea r10d, [r9 + 1]
mov ecx, 0x50
cmp r8, rcx
jge 0x140055878
cmp r9, 4
jl 0x14005584d
mov edx, 0x4c
mov ecx, 0x14
lea rax, [rbp + 0x190]
sub rdx, r8
shr rdx, 2
inc rdx
sub rcx, rdx
shl rcx, 2
nop dword [rax + rax]
movsd xmm0, qword [rax + 0x10]
movsd xmm1, qword [rax + 8]
comisd xmm0, xmm1
jbe 0x1400557fa
movsd qword [rax + 0x10], xmm1
movsd qword [rax + 8], xmm0
movsd xmm0, qword [rax + 8]
movsd xmm1, qword [rax]
comisd xmm0, xmm1
jbe 0x140055812
movsd qword [rax + 8], xmm1
movsd qword [rax], xmm0
movsd xmm0, qword [rax]
movsd xmm1, qword [rax - 8]
comisd xmm0, xmm1
jbe 0x14005582a
movsd qword [rax], xmm1
movsd qword [rax - 8], xmm0
movsd xmm0, qword [rax - 8]
movsd xmm1, qword [rax - 0x10]
comisd xmm0, xmm1
jbe 0x140055844
movsd qword [rax - 8], xmm1
movsd qword [rax - 0x10], xmm0
sub rax, 0x20
dec rdx
jne 0x1400557e0
cmp rcx, r8
jle 0x140055878
movsd xmm0, qword [rsp + rcx*8 + 0x20]
movsd xmm1, qword [rsp + rcx*8 + 0x18]
comisd xmm0, xmm1
jbe 0x140055870
movsd qword [rsp + rcx*8 + 0x20], xmm1
movsd qword [rsp + rcx*8 + 0x18], xmm0
dec rcx
cmp rcx, r8
jg 0x140055852
inc r8
dec r9
dec r10
jne 0x1400557a1
cmp byte [0x1401c5949], dil
je 0x14005589c
lea rax, [0x1401bfc48]
jmp 0x140055976
mov dword [rbp + 0x1b0], 0xf000e
mov dword [rbp + 0x1b4], 0x4000a
mov dword [rbp + 0x1b8], 0x540015
mov dword [rbp + 0x1bc], 0xc0008
mov dword [rbp + 0x1c0], 0xd0004
mov dword [rbp + 0x1c4], 0x1a004f
mov dword [rbp + 0x1c8], 0x1c0011
mov dword [rbp + 0x1cc], 0x13
lea rdx, [0x1401bfc48]
lea r8, [0x1401bed91]
nop word [rax + rax]
movzx eax, byte [rdi + r8 - 1]
movzx ecx, word [rbp + rdi*2 + 0x1b2]
add rdi, 5
xor ax, word [rbp + rdi*2 + 0x1a6]
mov word [rdx + rdi*2 - 0xa], ax
movzx eax, byte [rdi + r8 - 5]
xor cx, ax
movzx eax, byte [rdi + r8 - 4]
xor ax, word [rbp + rdi*2 + 0x1aa]
mov word [rdx + rdi*2 - 8], cx
movzx ecx, byte [rdi + r8 - 3]
xor cx, word [rbp + rdi*2 + 0x1ac]
mov word [rdx + rdi*2 - 6], ax
mov word [rdx + rdi*2 - 4], cx
movzx ecx, byte [rdi + r8 - 2]
xor cx, word [rbp + rdi*2 + 0x1ae]
mov word [rdx + rdi*2 - 2], cx
cmp rdi, 0xf
jl 0x140055900
mov byte [0x1401c5949], 1
mov rax, rdx
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1400cdac0
mov rdi, qword [rsp + 0x2f8]
add rsp, 0x2e0
pop rbp
ret
Function at 0x140055af0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp - 8], rax
mov r8d, dword [0x1401c3d80]
mov eax, 0x30c30c31
xor edi, edi
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xb
jne 0x140055b86
lea ecx, [rdi + 0x28]
mov qword [rsp + 0x70], rsi
call fcn.1400cd108
mov ebx, edi
mov rsi, rax
call fcn.1400ce478
inc rbx
add eax, dword [0x1401c3d80]
mov dword [rsi + rbx*4 - 4], eax
cmp rbx, 0xa
jl 0x140055b51
mov eax, dword [rsi + 0x24]
mov rcx, rsi
mov dword [0x1401c3d80], eax
call fcn.1400cebfc
mov r8d, dword [0x1401c3d80]
mov rsi, qword [rsp + 0x70]
cmp byte [0x1401c5950], dil
je 0x140055b9b
lea rax, [0x1401bf380]
jmp 0x140055cc4
lea ecx, [r8 + 1]
mov eax, 0x6bca1af3
mov dword [rbp - 0x40], 0x30004
mov dword [rbp - 0x3c], 0x170005
mov dword [rbp - 0x38], 0x150050
mov dword [rbp - 0x34], 0x1000a
imul ecx, r8d
imul ecx
sar edx, 3
mov dword [rbp - 0x30], 0xb0006
mov dword [rbp - 0x2c], 0x6004f
mov eax, edx
mov dword [rbp - 0x28], 0x40001
mov dword [rbp - 0x24], 0x80055
shr eax, 0x1f
mov dword [rbp - 0x20], 0x450016
mov dword [rbp - 0x1c], 0x20003
add edx, eax
mov dword [rbp - 0x18], 0x50007
mov dword [rbp - 0x14], 0x150010
mov word [rbp - 0x10], di
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 8
jne 0x140055c3d
mov r9d, edi
test r8d, r8d
je 0x140055c36
nop
mov eax, r8d
mov ecx, r8d
cdq
and ecx, 1
sub eax, edx
add r9d, ecx
sar eax, 1
mov r8d, eax
jne 0x140055c20
mov dword [0x1401c3d80], r9d
lea rax, [0x1401bf380]
lea r8, [0x1401bed91]
nop dword [rax + rax]
movzx ecx, byte [rdi + r8 - 1]
movzx edx, word [rbp + rdi*2 - 0x3e]
add rdi, 6
xor cx, word [rbp + rdi*2 - 0x4c]
mov word [rax + rdi*2 - 0xc], cx
movzx ecx, byte [rdi + r8 - 6]
xor dx, cx
movzx ecx, byte [rdi + r8 - 5]
xor cx, word [rbp + rdi*2 - 0x48]
mov word [rax + rdi*2 - 0xa], dx
mov word [rax + rdi*2 - 8], cx
movzx ecx, byte [rdi + r8 - 4]
xor cx, word [rbp + rdi*2 - 0x46]
mov word [rax + rdi*2 - 6], cx
movzx ecx, byte [rdi + r8 - 3]
xor cx, word [rbp + rdi*2 - 0x44]
mov word [rax + rdi*2 - 4], cx
movzx ecx, byte [rdi + r8 - 2]
xor cx, word [rbp + rdi*2 - 0x42]
mov word [rax + rdi*2 - 2], cx
cmp rdi, 0x18
jl 0x140055c50
mov byte [0x1401c5950], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400cdac0
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret
Function at 0x140055cf0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.140051170
test al, al
jne 0x140055d38
mov ecx, 4
mov qword [rsp + 0x50], rbx
call fcn.1400ce278
mov rbx, rax
call fcn.1400ce478
mov rcx, rbx
mov dword [rbx], eax
mov dword [0x1401c3d80], eax
call fcn.1400cdaa0
mov rbx, qword [rsp + 0x50]
cmp byte [0x1401c5955], 0
lea rax, str.5_a_n_a
jne 0x140055dc0
mov dword [rsp + 0x20], 0x70035
mov dword [rsp + 0x24], 0x7000a
mov dword [rsp + 0x28], 0x60020
mov dword [rsp + 0x2c], 0xe0009
mov dword [rsp + 0x30], 0x1b000c
mov dword [rsp + 0x34], 0x24001c
mov dword [rsp + 0x38], 0x1d0011
mov dword [rsp + 0x3c], 0x15001a
mov dword [rsp + 0x40], 0x5f0009
mov dword [rsp + 0x44], 0x4e
xor ecx, ecx
lea r8, [0x1401bed90]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 + 0x1e]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x13
jl 0x140055da1
mov byte [0x1401c5955], 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x58
ret

Function at 0x140055de0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rsp + 0x40], rax
call fcn.1400510b0
cmp byte [0x1401c5952], 0
lea rax, [0x1401bf740]
jne 0x140055e87
xor ecx, ecx
mov dword [rsp + 0x20], 0xd0009
mov dword [rsp + 0x24], 0x2001d
mov dword [rsp + 0x28], 0x11005d
mov dword [rsp + 0x2c], 0x1f0014
mov dword [rsp + 0x30], 0x1a0006
mov word [rsp + 0x3c], cx
mov dword [rsp + 0x34], 0xe0041
mov dword [rsp + 0x38], 0x16001d
lea r9, [0x1401bed91]
nop
movzx edx, byte [rcx + r9 - 1]
movzx r8d, word [rsp + rcx*2 + 0x22]
add rcx, 2
xor dx, word [rsp + rcx*2 + 0x1c]
mov word [rax + rcx*2 - 4], dx
movzx edx, byte [rcx + r9 - 2]
xor r8w, dx
mov word [rax + rcx*2 - 2], r8w
cmp rcx, 0xe
jl 0x140055e50
mov byte [0x1401c5952], 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x58
ret
Function at 0x140055ea0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r8d, dword [0x1401c3d80]
mov eax, 0x66666667
mov ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
cmp ecx, 3
jne 0x140055f24
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x2f4
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400cd108
mov rcx, rax
call fcn.1400cebfc
cmp byte [0x1401c5951], 0
lea rax, [0x1401bf710]
jne 0x140055fd7
xor ecx, ecx
mov dword [rbp - 0x40], 0x70000
mov dword [rbp - 0x3c], 0x2e001f
mov dword [rbp - 0x38], 0x10001f
mov dword [rbp - 0x34], 0x10013
mov dword [rbp - 0x30], 0x20000c
mov word [rbp - 0x14], cx
mov dword [rbp - 0x2c], 0x7000e
mov dword [rbp - 0x28], 0x1c0010
mov dword [rbp - 0x24], 0x290010
mov dword [rbp - 0x20], 0x10024
mov dword [rbp - 0x1c], 0xb0002
mov dword [rbp - 0x18], 0x4a0050
lea r9, [0x1401bed91]
nop word [rax + rax]
movzx edx, byte [rcx + r9 - 1]
movzx r8d, word [rbp + rcx*2 - 0x3e]
add rcx, 2
xor dx, word [rbp + rcx*2 - 0x44]
mov word [rax + rcx*2 - 4], dx
movzx edx, byte [rcx + r9 - 2]
xor r8w, dx
mov word [rax + rcx*2 - 2], r8w
cmp rcx, 0x16
jl 0x140055fa0
mov byte [0x1401c5951], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x60
pop rbp
ret
Function at 0x140055ff0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp - 8], rax
mov ecx, dword [0x1401c3d80]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x38e38e39
imul r8d, ecx
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub r8d, eax
cmp r8d, 5
jne 0x140056050
call fcn.1400ce478
mov ecx, dword [0x1401c3d80]
cmp ecx, eax
jne 0x140056050
dec ecx
mov dword [0x1401c3d80], ecx
lea r8d, [rcx + 1]
mov eax, 0x2e8ba2e9
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, 1
jne 0x140056084
mov eax, r8d
test ecx, ecx
cmove ecx, eax
mov dword [0x1401c3d80], ecx
cmp byte [0x1401c595c], 0
mov qword [rsp + 0x70], rbx
je 0x14005609e
lea rax, [0x1401bfaa8]
jmp 0x1400561d4
mov dword [rbp - 0x40], 0x140009
mov dword [rbp - 0x3c], 0x3c001b
mov dword [rbp - 0x38], 0x1a0005
mov dword [rbp - 0x34], 0x150003
mov dword [rbp - 0x30], 0xd0019
mov dword [rbp - 0x2c], 0x1d000c
mov dword [rbp - 0x28], 0x140011
mov dword [rbp - 0x24], 0xb002a
mov dword [rbp - 0x20], 0x6001f
mov dword [rbp - 0x1c], 0xb000f
mov dword [rbp - 0x18], 0x20035
mov dword [rbp - 0x14], 3
xor r8d, r8d
mov dword [rbp - 0x10], 0x1b
lea rbx, [0x1401bfaa8]
lea r9, [0x1401bed91]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 5
xor ax, word [rbp + r8*2 - 0x4a]
mov word [rbx + r8*2 - 0xa], ax
movzx eax, byte [r8 + r9 - 5]
xor dx, ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rbp + r8*2 - 0x46]
mov word [rbx + r8*2 - 8], dx
mov word [rbx + r8*2 - 6], ax
movzx eax, byte [r8 + r9 - 3]
xor ax, word [rbp + r8*2 - 0x44]
mov word [rbx + r8*2 - 4], ax
movzx eax, byte [r8 + r9 - 2]
xor ax, word [rbp + r8*2 - 0x42]
mov word [rbx + r8*2 - 2], ax
cmp r8, 0x19
jl 0x140056110
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
mov byte [0x1401c595c], 1
imul r8d, eax
mov eax, 0x66666667
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub r8d, eax
cmp r8d, 5
jne 0x1400561d1
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401c3d80]
mov edx, 7
test rax, rax
cmove ecx, edx
mov dword [0x1401c3d80], ecx
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x60
pop rbp
ret
Function at 0x1400561f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0xa10
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rsp + 0xa08], rax
mov ecx, dword [0x1401c3d80]
mov eax, 0x30c30c31
xor ebp, ebp
mov r8d, ecx
imul r8d, ecx
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 0x13
jne 0x1400562e4
mov r8d, ebp
nop word [rax + rax]
mov edx, r8d
mov eax, r8d
inc r8d
sar eax, 1
and edx, 1
dec edx
not edx
and edx, ecx
xor edx, eax
mov eax, edx
sar edx, 1
and eax, 1
dec eax
not eax
and eax, ecx
xor eax, edx
mov edx, eax
sar eax, 1
and edx, 1
dec edx
not edx
and edx, ecx
xor edx, eax
mov eax, edx
sar edx, 1
and eax, 1
dec eax
not eax
and eax, ecx
xor eax, edx
mov edx, eax
sar eax, 1
and edx, 1
dec edx
not edx
and edx, ecx
xor edx, eax
mov eax, edx
sar edx, 1
and eax, 1
dec eax
not eax
and eax, ecx
xor eax, edx
mov edx, eax
sar eax, 1
and edx, 1
dec edx
not edx
and edx, ecx
xor edx, eax
mov eax, edx
sar edx, 1
and eax, 1
dec eax
not eax
and eax, ecx
xor eax, edx
add ecx, eax
cmp r8d, 0x100
jl 0x140056250
mov dword [0x1401c3d80], ecx
cmp byte [0x1401c594e], bpl
je 0x1400562f9
lea rax, [0x1401bfbb8]
jmp 0x140056471
lea r8d, [rcx + 1]
mov eax, 0xb21642c9
imul r8d, ecx
imul r8d
add edx, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub r8d, edx
cmp r8d, 9
jne 0x1400563ce
mov qword [rsp + 0xa20], rbx
mov qword [rsp + 0xa28], rsi
mov qword [rsp + 0xa30], rdi
lea rdi, [rsp + 0x20]
mov esi, ebp
nop word [rax + rax]
mov r9d, ebp
nop word [rax + rax]
mov eax, ecx
lea r8d, [rsi + 1]
lea ebx, [r9 + 1]
cdq
idiv r8d
mov eax, ecx
sub eax, esi
mov r8d, edx
imul r8d, eax
mov eax, ecx
lea rcx, [0x14014c428]
cdq
idiv ebx
add r8d, eax
sub r8d, r9d
mov edx, r8d
call fcn.1400ce3cc
add rdi, 4
mov r9d, ebx
cmp ebx, 0x18
jge 0x1400563a7
mov ecx, dword [0x1401c3d80]
jmp 0x140056360
inc esi
cmp esi, 0x1a
jge 0x1400563b6
mov ecx, dword [0x1401c3d80]
jmp 0x140056350
mov rsi, qword [rsp + 0xa28]
mov rbx, qword [rsp + 0xa20]
mov rdi, qword [rsp + 0xa30]
mov dword [rsp + 0x9e0], 0x230031
mov dword [rsp + 0x9e4], 0xf0007
mov dword [rsp + 0x9e8], 0x17001f
mov dword [rsp + 0x9ec], 0x150023
mov dword [rsp + 0x9f0], 0x26005b
mov dword [rsp + 0x9f4], 0x44001b
mov dword [rsp + 0x9f8], 0x50027
mov dword [rsp + 0x9fc], 0x40016
mov dword [rsp + 0xa00], 0x160015
mov dword [rsp + 0xa04], 0x1d
lea rax, [0x1401bfbb8]
lea rdx, [0x1401bed90]
nop word [rax + rax]
movzx ecx, byte [rdx + rbp]
inc rbp
xor cx, word [rsp + rbp*2 + 0x9de]
mov word [rax + rbp*2 - 2], cx
cmp rbp, 0x13
jl 0x140056450
mov byte [0x1401c594e], 1
mov rcx, qword [rsp + 0xa08]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0xa10
pop rbp
ret
Function at 0x140056490
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401c5941], 0
je 0x1400564c5
lea rax, [0x1401bf760]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x48
ret
xor edx, edx
mov dword [rsp], 0x30017
mov dword [rsp + 4], 0x60019
mov dword [rsp + 8], 0x1e
mov dword [rsp + 0xc], 0x1d0046
mov dword [rsp + 0x10], 0x7001b
mov word [rsp + 0x20], dx
mov dword [rsp + 0x14], 0x49000c
mov dword [rsp + 0x18], 0x11001a
mov dword [rsp + 0x1c], 0x20018
lea r8, [0x1401bf760]
lea r9, [0x1401bed91]
nop dword [rax]
movzx eax, byte [rdx + r9 - 1]
movzx ecx, word [rsp + rdx*2 + 2]
add rdx, 4
xor ax, word [rsp + rdx*2 - 8]
mov word [r8 + rdx*2 - 8], ax
movzx eax, byte [rdx + r9 - 4]
xor cx, ax
movzx eax, byte [rdx + r9 - 3]
xor ax, word [rsp + rdx*2 - 4]
mov word [r8 + rdx*2 - 6], cx
mov word [r8 + rdx*2 - 4], ax
movzx eax, byte [rdx + r9 - 2]
xor ax, word [rsp + rdx*2 - 2]
mov word [r8 + rdx*2 - 2], ax
cmp rdx, 0x10
jl 0x140056520
mov r9d, dword [0x1401c3d80]
mov byte [0x1401c5941], 1
lea eax, [r9 + 1]
lea ecx, [r9 + 2]
imul ecx, eax
mov eax, 0x6bca1af3
imul ecx, r9d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 0xc
jne 0x140056612
movsd xmm3, qword [0x140153278]
movsd xmm5, qword [0x1401532a0]
movd xmm4, r9d
xorps xmm2, xmm2
movaps xmmword [rsp + 0x30], xmm6
movsd xmm6, qword [0x140153270]
cvtdq2pd xmm4, xmm4
nop word [rax + rax]
addsd xmm2, xmm3
movaps xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x1400565f9
subsd xmm2, xmm3
divsd xmm3, xmm5
movaps xmm1, xmm2
movaps xmm0, xmm4
mulsd xmm1, xmm2
subsd xmm0, xmm1
comisd xmm0, xmm6
ja 0x1400565e0
movaps xmm6, xmmword [rsp + 0x30]
mov rax, r8
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x48
ret