joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005a6c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401d89d2], 0
lea rax, [0x1401d2768]
jne 0x14005a74f
mov dword [rsp], 0x30004
mov dword [rsp + 4], 0x3e001d
mov dword [rsp + 8], 0x130006
mov dword [rsp + 0xc], 0x2f000e
mov dword [rsp + 0x10], 0x17000d
mov dword [rsp + 0x14], 0xc000c
mov dword [rsp + 0x18], 0x1b0004
mov qword [rsp + 0x1c], 0x1d0008
xor ecx, ecx
lea r8, [0x1401d1da0]
nop dword [rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 - 2]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x11
jl 0x14005a730
mov byte [0x1401d89d2], 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x38
ret

Function at 0x14005a930
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x770]
sub rsp, 0x870
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rbp + 0x760], rax
cmp byte [0x1401d89ca], 0
je 0x14005a96b
lea rax, [0x1401d2538]
jmp 0x14005aafd
mov qword [rsp + 0x880], rdi
xor edi, edi
mov dword [rsp + 0x20], 0x30004
mov dword [rsp + 0x24], 0x3e001d
mov dword [rsp + 0x28], 0xa0009
mov dword [rsp + 0x2c], 0x3001f
mov word [rsp + 0x58], di
mov edx, edi
mov dword [rsp + 0x30], 0x30001c
mov dword [rsp + 0x34], 0x70006
mov dword [rsp + 0x38], 0xa001e
mov dword [rsp + 0x3c], 0x60002
mov dword [rsp + 0x40], 0x70007
mov dword [rsp + 0x44], 0x3e001e
mov dword [rsp + 0x48], 0xc0015
mov dword [rsp + 0x4c], 0x1a
mov dword [rsp + 0x50], 0x1f000c
mov dword [rsp + 0x54], 0xb0000
lea rbx, [0x1401d2538]
lea r8, [0x1401d1da1]
nop word [rax + rax]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rsp + rdx*2 + 0x22]
add rdx, 4
xor ax, word [rsp + rdx*2 + 0x18]
mov word [rbx + rdx*2 - 8], ax
movzx eax, byte [rdx + r8 - 4]
xor cx, ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rsp + rdx*2 + 0x1c]
mov word [rbx + rdx*2 - 6], cx
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rsp + rdx*2 + 0x1e]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0x1c
jl 0x14005aa00
mov ecx, dword [0x1401d6d80]
mov eax, 0x38e38e39
mov byte [0x1401d89ca], 1
imul ecx, ecx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xc
jne 0x14005aaf2
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x60], di
call fcn.1400da240
mov r10, rdi
mov r9, rdi
mov rcx, rdi
nop word [rax + rax]
test r10, r10
je 0x14005aacc
test rcx, rcx
je 0x14005aacc
lea rax, [r9 + rcx]
lea r8, [rsp + 0x60]
lea r8, [r8 + rax*2]
lea rax, [r9 + rcx]
movzx edx, word [rsp + rax*2 + 0x20]
inc dx
add dx, word [r8 - 2]
mov word [r8], dx
inc rcx
cmp rcx, 0x20
jl 0x14005aaa0
add r9, 0x20
inc r10
cmp r9, 0x400
jl 0x14005aa97
movsx ecx, word [rbp + 0x75e]
mov dword [0x1401d6d80], ecx
mov rdi, qword [rsp + 0x880]
mov rax, rbx
mov rcx, qword [rbp + 0x760]
xor rcx, rsp
call fcn.1400d4e00
mov rbx, qword [rsp + 0x888]
add rsp, 0x870
pop rbp
ret
Function at 0x14005ab20
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401d89ae], 0
je 0x14005ab59
lea rax, [0x1401d2910]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x60
pop rbp
ret
mov r8d, dword [0x1401d6d80]
mov eax, 0x78787879
mov qword [rsp + 0x70], rbx
mov ecx, r8d
mov ebx, 1
imul ecx, r8d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 0xe
jne 0x14005aba8
mov ecx, ebx
cmp r8d, ebx
jle 0x14005aba2
mov eax, r8d
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, r8d
jl 0x14005ab93
mov dword [0x1401d6d80], ecx
mov rbx, qword [rsp + 0x70]
mov dword [rbp - 0x60], 0x7000f
mov dword [rbp - 0x5c], 0xe001f
mov dword [rbp - 0x58], 0x43001d
mov dword [rbp - 0x54], 0x15000a
mov dword [rbp - 0x50], 0x1b001c
mov dword [rbp - 0x4c], 0x70006
mov dword [rbp - 0x48], 0x4f0013
mov dword [rbp - 0x44], 0x1b0007
mov dword [rbp - 0x40], 0x1b001c
mov dword [rbp - 0x3c], 0x410004
mov dword [rbp - 0x38], 0x1b0001
mov dword [rbp - 0x34], 0x60001
mov dword [rbp - 0x30], 0x18000a
mov dword [rbp - 0x2c], 0x4f0016
mov dword [rbp - 0x28], 0xd0007
mov dword [rbp - 0x24], 0x80001
mov dword [rbp - 0x20], 0x53
xor edx, edx
lea r8, [0x1401d2910]
lea r9, [0x1401d1da1]
nop word [rax + rax]
movzx eax, byte [rdx + r9 - 1]
movzx ecx, word [rbp + rdx*2 - 0x5e]
add rdx, 3
xor ax, word [rbp + rdx*2 - 0x66]
mov word [r8 + rdx*2 - 6], ax
movzx eax, byte [rdx + r9 - 3]
xor cx, ax
mov word [r8 + rdx*2 - 4], cx
movzx ecx, byte [rdx + r9 - 2]
xor cx, word [rbp + rdx*2 - 0x62]
mov word [r8 + rdx*2 - 2], cx
cmp rdx, 0x21
jl 0x14005ac40
mov byte [0x1401d89ae], 1
mov rax, r8
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x60
pop rbp
ret
Function at 0x14005aca0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x108
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rsp + 0xf8], rax
mov r8d, dword [0x1401d6d80]
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x78787879
imul ecx, r8d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 0xe
jne 0x14005ad12
lea eax, [rcx + 0x79]
mov r8d, 0x57
test r8d, r8d
je 0x14005ad08
cdq
mov ecx, r8d
idiv r8d
mov eax, ecx
mov r8d, edx
test ecx, ecx
jne 0x14005acf3
add r8d, eax
mov dword [0x1401d6d80], r8d
lea ecx, [r8 + 1]
mov eax, 0x4ec4ec4f
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 1
jne 0x14005ad47
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov r8d, dword [0x1401d6d80]
cmp byte [0x1401d89aa], 0
je 0x14005ad6f
lea rax, [0x1401d2c28]
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x108
ret
lea ecx, [r8 + 1]
mov eax, 0xb21642c9
mov qword [rsp + 0x100], rbx
xor ebx, ebx
mov dword [rsp + 0xe0], 0x10001c
mov dword [rsp + 0xe4], 0x12001f
imul ecx, r8d
imul ecx
add edx, ecx
mov dword [rsp + 0xe8], 0xc0006
mov dword [rsp + 0xec], 0x500003
sar edx, 4
mov dword [rsp + 0xf0], 0x1d000d
mov dword [rsp + 0xf4], 0x1d
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 4
jne 0x14005adf5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea rax, [0x1401d2c28]
lea rdx, [0x1401d1da0]
nop word [rax + rax]
movzx ecx, byte [rbx + rdx]
inc rbx
xor cx, word [rsp + rbx*2 + 0xde]
mov word [rax + rbx*2 - 2], cx
cmp rbx, 0xb
jl 0x14005ae10
mov byte [0x1401d89aa], 1
mov rbx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x108
ret
Function at 0x14005ae60
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0xd0
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov eax, dword [0x1401d6d80]
imul eax, eax
and eax, 0x8000000f
jge 0x14005ae92
dec eax
or eax, 0xfffffff0
inc eax
xor edi, edi
cmp eax, 7
jne 0x14005aec0
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp byte [0x1401d89d1], dil
mov qword [rsp + 0xe8], rsi
je 0x14005aedd
lea rax, [0x1401d2490]
jmp 0x14005b077
mov dword [rsp + 0xa0], 0x50025
mov dword [rsp + 0xa4], 0xf0008
mov dword [rsp + 0xa8], 0x11003f
mov dword [rsp + 0xac], 0x130002
mov dword [rsp + 0xb0], 0x1c000d
mov dword [rsp + 0xb4], 0x49001c
mov dword [rsp + 0xb8], 0x1a0017
mov dword [rsp + 0xbc], 0x13
call fcn.140056c40
test al, al
jne 0x14005af65
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rdx, rdi
lea rsi, [0x1401d2490]
lea r8, [0x1401d1da1]
nop word [rax + rax]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rsp + rdx*2 + 0xa2]
add rdx, 5
xor ax, word [rsp + rdx*2 + 0x96]
mov word [rsi + rdx*2 - 0xa], ax
movzx eax, byte [rdx + r8 - 5]
xor cx, ax
movzx eax, byte [rdx + r8 - 4]
xor ax, word [rsp + rdx*2 + 0x9a]
mov word [rsi + rdx*2 - 8], cx
mov word [rsi + rdx*2 - 6], ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rsp + rdx*2 + 0x9c]
mov word [rsi + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rsp + rdx*2 + 0x9e]
mov word [rsi + rdx*2 - 2], ax
cmp rdx, 0xf
jl 0x14005af80
mov r8d, dword [0x1401d6d80]
mov eax, 0xb21642c9
mov ecx, r8d
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 0xa
jne 0x14005b06d
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xf0], r14
lea r14, [rsp + 0x40]
nop dword [rax]
mov eax, r8d
lea ebx, [rdi + 1]
lea rcx, [0x14015e154]
cdq
idiv ebx
sub eax, edi
mov edx, eax
call fcn.1400d5714
mov edi, ebx
lea r14, [r14 + 4]
cmp ebx, 0x17
jge 0x14005b05d
mov r8d, dword [0x1401d6d80]
jmp 0x14005b030
mov rbx, qword [rsp + 0xe0]
mov r14, qword [rsp + 0xf0]
mov byte [0x1401d89d1], 1
mov rax, rsi
mov rsi, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0xd0
pop rdi
ret
Function at 0x14005b0a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r9d, dword [0x1401d6d80]
mov ebx, 1
lea eax, [r9 + 1]
lea ecx, [r9 + 2]
imul ecx, eax
mov eax, 0x2aaaaaab
imul ecx, r9d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 9
jne 0x14005b118
mov ecx, ebx
cmp r9d, ebx
jle 0x14005b10f
nop word [rax + rax]
mov eax, r9d
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, r9d
jl 0x14005b100
mov r9d, ecx
mov dword [0x1401d6d80], ecx
cmp byte [0x1401d89ac], 0
je 0x14005b12d
lea rax, [0x1401d2860]
jmp 0x14005b200
mov dword [rbp - 0x50], 0x70029
mov dword [rbp - 0x4c], 8
xor eax, eax
mov dword [rbp - 0x48], 0x6001b
mov dword [rbp - 0x44], 0x1f0039
mov dword [rbp - 0x40], 0x30007
mov dword [rbp - 0x3c], 0xc0007
mov dword [rbp - 0x38], 0x1f0018
mov dword [rbp - 0x34], 0x400052
mov dword [rbp - 0x30], 0x6003d
mov dword [rbp - 0x2c], 0x110011
mov dword [rbp - 0x28], 0x10002
mov dword [rbp - 0x24], 0x110001
mov dword [rbp - 0x20], 0xd004f
mov dword [rbp - 0x1c], 0x60004
mov dword [rbp - 0x18], 0x60002
mov dword [rbp - 0x14], 3
lea r10, [0x1401d2860]
lea rdx, [0x1401d1da0]
nop dword [rax]
movzx ecx, byte [rax + rdx]
inc rax
xor cx, word [rbp + rax*2 - 0x52]
mov word [r10 + rax*2 - 2], cx
cmp rax, 0x1f
jl 0x14005b1b0
lea r8d, [r9 + 1]
mov eax, 0x66666667
imul r8d, r9d
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
shl ecx, 2
sub r8d, ecx
cmp r8d, 0x11
jne 0x14005b1f7
dec dword [0x1401d8474]
mov byte [0x1401d89ac], bl
mov rax, r10
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d4e00
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14005b220
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, dword [0x1401d6d80]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x2aaaaaab
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 9
jne 0x14005b292
lea eax, [r8 + 0x4e]
mov ecx, 0xda
test ecx, ecx
je 0x14005b28a
cdq
mov r8d, ecx
idiv ecx
mov eax, r8d
mov ecx, edx
test r8d, r8d
jne 0x14005b276
add eax, ecx
mov dword [0x1401d6d80], eax
cmp byte [0x1401d89de], 0
je 0x14005b2b4
lea rax, [0x1401d2460]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x40
pop rbp
ret
xor r8d, r8d
mov dword [rbp - 0x40], 0x7003d
mov dword [rbp - 0x3c], 0x150004
mov dword [rbp - 0x38], 0x33000a
mov dword [rbp - 0x34], 0x1f001f
mov dword [rbp - 0x30], 0xa000b
mov word [rbp - 0x18], r8w
mov dword [rbp - 0x2c], 0x1a001c
mov dword [rbp - 0x28], 0xa0039
mov dword [rbp - 0x24], 0x1d000c
mov dword [rbp - 0x20], 0x11001c
mov dword [rbp - 0x1c], 0x41004a
lea rdx, [0x1401d2460]
lea r9, [0x1401d1da1]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rbp + r8*2 - 0x3e]
add r8, 5
xor ax, word [rbp + r8*2 - 0x4a]
mov word [rdx + r8*2 - 0xa], ax
movzx eax, byte [r8 + r9 - 5]
xor cx, ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rbp + r8*2 - 0x46]
mov word [rdx + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0x14
jl 0x14005b310
mov byte [0x1401d89de], 1
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x40
pop rbp
ret
Function at 0x14005b3a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r8d, dword [0x1401d6d80]
mov eax, 0xb21642c9
lea ecx, [r8 + 1]
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 0xd
jne 0x14005b424
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x2f4
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400d4448
mov rcx, rax
call fcn.1400d5528
cmp byte [0x1401d89b8], 0
je 0x14005b446
lea rax, [0x1401d2958]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x58
ret
xor r8d, r8d
mov dword [rsp + 0x20], 0x10001c
mov dword [rsp + 0x24], 0x12001f
mov dword [rsp + 0x28], 0xc0006
mov dword [rsp + 0x2c], 0x4a0003
mov dword [rsp + 0x30], 0x5f0048
mov word [rsp + 0x40], r8w
mov dword [rsp + 0x34], 0x590041
mov dword [rsp + 0x38], 0x5f005a
mov dword [rsp + 0x3c], 0x42004f
lea rdx, [0x1401d2958]
lea r9, [0x1401d1da1]
nop dword [rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 0x22]
add r8, 4
xor ax, word [rsp + r8*2 + 0x18]
mov word [rdx + r8*2 - 8], ax
movzx eax, byte [r8 + r9 - 4]
xor cx, ax
mov word [rdx + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 + 0x1c]
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 + 0x1e]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0x10
jl 0x14005b4a0
mov byte [0x1401d89b8], 1
mov rax, rdx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x58
ret
Function at 0x14005b520
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ecx, dword [0x1401d6d80]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x66666667
imul r8d, ecx
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 1
jne 0x14005b571
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp byte [0x1401d89d7], 0
je 0x14005b593
lea rax, [0x1401d2590]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x58
ret
mov dword [rsp + 0x20], 0x180003
mov dword [rsp + 0x24], 0x6000c
mov dword [rsp + 0x28], 0x43000a
mov dword [rsp + 0x2c], 0x110003
mov dword [rsp + 0x30], 0xa0005
mov dword [rsp + 0x34], 0x1a004f
mov dword [rsp + 0x38], 0x30011
mov dword [rsp + 0x3c], 7
xor r8d, r8d
lea rdx, [0x1401d2590]
lea r9, [0x1401d1da1]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 0x22]
add r8, 5
xor ax, word [rsp + r8*2 + 0x16]
mov word [rdx + r8*2 - 0xa], ax
movzx eax, byte [r8 + r9 - 5]
xor cx, ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rsp + r8*2 + 0x1a]
mov word [rdx + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 + 0x1c]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 + 0x1e]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0xf
jl 0x14005b5f0
mov byte [0x1401d89d7], 1
mov rax, rdx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x58
ret
Function at 0x14005b6f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rbp - 8], rax
call fcn.140056cb0
xor r9d, r9d
test al, al
jne 0x14005b77a
mov ecx, dword [0x1401d6d80]
mov eax, 0x63e7063f
mov r8d, r9d
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
imul edx, edx, 0x52
sub eax, edx
cmp eax, 0x13
je 0x14005b773
nop dword [rax]
mov eax, ecx
inc r8d
or eax, 0xffffff76
add ecx, eax
mov eax, ecx
imul eax, ecx
cmp r8d, eax
jg 0x14005b773
mov eax, 0x63e7063f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
imul edx, edx, 0x52
sub eax, edx
cmp eax, 0x13
jne 0x14005b740
mov dword [0x1401d6d80], r8d
cmp byte [0x1401d89dd], r9b
je 0x14005b79c
lea rax, [0x1401d28c8]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x60
pop rbp
ret
mov dword [rbp - 0x40], 0x140009
mov dword [rbp - 0x3c], 0x150003
mov dword [rbp - 0x38], 0x2004f
mov dword [rbp - 0x34], 0x1c0001
mov dword [rbp - 0x30], 0xc0007
mov dword [rbp - 0x2c], 0x6004f
mov dword [rbp - 0x28], 0x1b0001
mov dword [rbp - 0x24], 0x1d0041
mov dword [rbp - 0x20], 0x480008
mov dword [rbp - 0x1c], 0x4001d
mov dword [rbp - 0x18], 0x6001c
mov dword [rbp - 0x14], 0x1c001c
mov word [rbp - 0x10], r9w
lea rdx, [0x1401d28c8]
lea r8, [0x1401d1da1]
nop word [rax + rax]
movzx eax, byte [r9 + r8 - 1]
movzx ecx, word [rbp + r9*2 - 0x3e]
add r9, 6
xor ax, word [rbp + r9*2 - 0x4c]
mov word [rdx + r9*2 - 0xc], ax
movzx eax, byte [r9 + r8 - 6]
xor cx, ax
movzx eax, byte [r9 + r8 - 5]
xor ax, word [rbp + r9*2 - 0x48]
mov word [rdx + r9*2 - 0xa], cx
movzx ecx, byte [r9 + r8 - 3]
xor cx, word [rbp + r9*2 - 0x44]
mov word [rdx + r9*2 - 8], ax
movzx eax, byte [r9 + r8 - 4]
xor ax, word [rbp + r9*2 - 0x46]
mov word [rdx + r9*2 - 4], cx
movzx ecx, byte [r9 + r8 - 2]
xor cx, word [rbp + r9*2 - 0x42]
mov word [rdx + r9*2 - 6], ax
mov word [rdx + r9*2 - 2], cx
cmp r9, 0x18
jl 0x14005b810
mov byte [0x1401d89dd], 1
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x60
pop rbp
ret
Function at 0x14005b8b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x108
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rsp + 0xf8], rax
mov eax, dword [0x1401d6d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 4
jne 0x14005b8fe
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp byte [0x1401d89d5], 0
lea rax, [0x1401d23d8]
jne 0x14005b9b2
mov dword [rsp + 0xd0], 0x100038
mov dword [rsp + 0xd4], 0x5000c
mov dword [rsp + 0xd8], 0x11003f
mov dword [rsp + 0xdc], 0x130002
mov dword [rsp + 0xe0], 0x1c000d
mov dword [rsp + 0xe4], 0x24001c
mov dword [rsp + 0xe8], 0x20011
mov dword [rsp + 0xec], 0xe
xor ecx, ecx
mov dword [rsp + 0xf0], 0x520017
mov dword [rsp + 0xf4], 0x50
lea r8, [0x1401d1da0]
nop dword [rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 + 0xce]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x13
jl 0x14005b990
mov byte [0x1401d89d5], 1
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x108
ret

Function at 0x14005b9d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov eax, dword [0x1401d6d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 5
jne 0x14005ba32
mov eax, 0x96
mov ecx, 0xb0
test ecx, ecx
je 0x14005ba2a
cdq
mov r8d, ecx
idiv ecx
mov eax, r8d
mov ecx, edx
test r8d, r8d
jne 0x14005ba16
add eax, ecx
mov dword [0x1401d6d80], eax
cmp byte [0x1401d89d8], 0
lea rax, [0x1401d26b0]
jne 0x14005bac8
xor r8d, r8d
mov dword [rsp], 0x1a0004
mov dword [rsp + 4], 0x1b
mov dword [rsp + 8], 0x60042
mov dword [rsp + 0xc], 0x2001f
mov dword [rsp + 0x10], 0x1d0007
mov word [rsp + 0x1c], r8w
mov dword [rsp + 0x14], 0xe0041
mov dword [rsp + 0x18], 0x9001d
lea r9, [0x1401d1da1]
nop dword [rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rsp + r8*2 + 2]
add r8, 2
xor cx, word [rsp + r8*2 - 4]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor dx, cx
mov word [rax + r8*2 - 2], dx
cmp r8, 0xe
jl 0x14005ba90
mov byte [0x1401d89d8], 1
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x38
ret
Function at 0x14005bae0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401d89d0], 0
lea rax, [0x1401d29c0]
jne 0x14005bba7
xor ecx, ecx
mov dword [rbp - 0x40], 0x10000d
mov dword [rbp - 0x3c], 0x2c0019
mov dword [rbp - 0x38], 0x70000
mov dword [rbp - 0x34], 0x1c0018
mov dword [rbp - 0x30], 0x27000d
mov word [rbp - 0x14], cx
mov dword [rbp - 0x2c], 0x7000e
mov dword [rbp - 0x28], 0x30010
mov dword [rbp - 0x24], 0x3c0004
mov dword [rbp - 0x20], 0xc003a
mov dword [rbp - 0x1c], 0xd001c
mov dword [rbp - 0x18], 0x49004b
lea r9, [0x1401d1da1]
nop word [rax + rax]
movzx edx, byte [rcx + r9 - 1]
movzx r8d, word [rbp + rcx*2 - 0x3e]
add rcx, 2
xor dx, word [rbp + rcx*2 - 0x44]
mov word [rax + rcx*2 - 4], dx
movzx edx, byte [rcx + r9 - 2]
xor r8w, dx
mov word [rax + rcx*2 - 2], r8w
cmp rcx, 0x16
jl 0x14005bb70
mov byte [0x1401d89d0], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x40
pop rbp
ret