joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400571f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r8d, dword [0x1401d6d80]
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0xb
jne 0x140057242
dec r8d
mov dword [0x1401d6d80], r8d
cmp byte [0x1401d89ba], 0
je 0x140057264
lea rax, [0x1401d2430]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x40
pop rbp
ret
lea ecx, [r8 + 1]
mov eax, 0xb21642c9
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 4
jne 0x14005728f
dec dword [0x1401d831c]
mov dword [rbp - 0x40], 0x14000c
mov dword [rbp - 0x3c], 0xd0004
mov dword [rbp - 0x38], 0x7000a
mov dword [rbp - 0x34], 0x40032
mov dword [rbp - 0x30], 0x300007
mov dword [rbp - 0x2c], 0x1b000c
mov dword [rbp - 0x28], 0xe0011
mov dword [rbp - 0x24], 0x170015
mov dword [rbp - 0x20], 0x1f0031
mov dword [rbp - 0x1c], 0xf0019
mov dword [rbp - 0x18], 0x60015
mov dword [rbp - 0x14], 0x19
xor ecx, ecx
lea rax, [0x1401d2430]
lea r8, [0x1401d1da0]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rbp + rcx*2 - 0x42]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x17
jl 0x1400572f3
mov byte [0x1401d89ba], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x40
pop rbp
ret
Function at 0x140057330
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x1401d6d80]
mov eax, 0x38e38e39
lea r8d, [rcx + 1]
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 0xe
jne 0x140057386
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401d6d80]
mov edx, 7
test rax, rax
cmove ecx, edx
mov dword [0x1401d6d80], ecx
cmp byte [0x1401d89c3], 0
jne 0x1400574d6
lea r8d, [rcx + 1]
mov eax, 0x66666667
imul r8d, ecx
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 9
jne 0x1400573db
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov ecx, dword [0x1401d6d80]
movzx eax, byte [0x1401d1da0]
lea r8d, [rcx + 1]
mov byte [0x1401d89c3], 1
xor al, 0x4c
imul r8d, ecx
movzx eax, al
mov word [0x1401d2338], ax
movzx eax, byte [0x1401d1da1]
xor al, 5
movzx eax, al
mov word [0x1401d233a], ax
movzx eax, byte [0x1401d1da2]
xor al, 0x1d
movzx eax, al
mov word [0x1401d233c], ax
movzx eax, byte [0x1401d1da3]
xor al, 0x50
movzx eax, al
mov word [0x1401d233e], ax
movzx eax, byte [0x1401d1da4]
xor al, 0x52
movzx eax, al
mov word [0x1401d2340], ax
mov eax, 0x2aaaaaab
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub r8d, eax
cmp r8d, 3
jne 0x1400574d6
test ecx, ecx
je 0x1400574d6
nop word [rax + rax]
mov eax, ecx
and eax, 0x80000001
jge 0x140057480
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x140057495
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov dword [0x1401d6d80], eax
jmp 0x1400574a2
lea ecx, [rcx*2 + 1]
mov dword [0x1401d6d80], ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov edx, ecx
sub edx, eax
je 0x1400574c4
sub edx, 2
je 0x1400574c7
dec edx
je 0x1400574c9
jmp 0x1400574d2
add ecx, 2
inc ecx
add ecx, 2
mov dword [0x1401d6d80], ecx
test ecx, ecx
jne 0x140057470
lea rax, [0x1401d2338]
add rsp, 0x38
ret
Function at 0x1400574f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401d89d9], 0
je 0x14005751f
lea rax, [0x1401d2808]
jmp 0x14005763c
mov ecx, dword [0x1401d6d80]
mov qword [rsp + 0x90], rbx
xor ebx, ebx
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0xb21642c9
imul r8d, ecx
imul r8d
add edx, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub r8d, edx
cmp r8d, 4
jne 0x140057586
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [rbp - 0x40], 0x30004
mov dword [rbp - 0x3c], 0x3e001d
mov dword [rbp - 0x38], 0xd001a
mov dword [rbp - 0x34], 0x80008
mov dword [rbp - 0x30], 0xa0018
mov dword [rbp - 0x2c], 0x1d000c
mov dword [rbp - 0x28], 0xb0011
mov dword [rbp - 0x24], 0x3e
mov dword [rbp - 0x20], 0x5000b
mov dword [rbp - 0x1c], 0x15001f
mov dword [rbp - 0x18], 0x360014
mov dword [rbp - 0x14], 0x40006
mov dword [rbp - 0x10], 0x1f0003
mov word [rbp - 0xc], bx
lea rax, [0x1401d2808]
lea r8, [0x1401d1da1]
nop word [rax + rax]
movzx ecx, byte [rbx + r8 - 1]
movzx edx, word [rbp + rbx*2 - 0x3e]
add rbx, 2
xor cx, word [rbp + rbx*2 - 0x44]
mov word [rax + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor dx, cx
mov word [rax + rbx*2 - 2], dx
cmp rbx, 0x1a
jl 0x140057600
mov rbx, qword [rsp + 0x90]
mov byte [0x1401d89d9], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x80
pop rbp
ret

Function at 0x140057660
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ecx, dword [0x1401d6d80]
mov eax, 0x88888889
imul ecx, ecx
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 8
jne 0x1400576ac
lea edx, [rcx + 0x37]
lea r8d, [rcx + 0x38]
lea rcx, [0x14015e0f4]
call fcn.1400d5714
cmp byte [0x1401d89ad], 0
je 0x1400576ce
lea rax, [0x1401d2ba8]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x58
ret
xor r8d, r8d
mov dword [rsp + 0x20], 0x1d0009
mov dword [rsp + 0x24], 0x190028
mov dword [rsp + 0x28], 0x170006
mov dword [rsp + 0x2c], 0x1f002e
mov dword [rsp + 0x30], 0xa000c
mov word [rsp + 0x40], r8w
mov dword [rsp + 0x34], 0xa0049
mov dword [rsp + 0x38], 0xb001b
mov dword [rsp + 0x3c], 0x4f0004
lea rdx, [0x1401d2ba8]
lea r9, [0x1401d1da1]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 0x22]
add r8, 4
xor ax, word [rsp + r8*2 + 0x18]
mov word [rdx + r8*2 - 8], ax
movzx eax, byte [r8 + r9 - 4]
xor cx, ax
mov word [rdx + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 + 0x1c]
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 + 0x1e]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0x10
jl 0x140057730
mov byte [0x1401d89ad], 1
mov rax, rdx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x58
ret
Function at 0x140057c50
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401d89b5], 0
lea rax, [0x1401d2980]
jne 0x140057d0f
mov dword [rbp - 0x50], 0x11002b
mov dword [rbp - 0x4c], 0x140007
mov dword [rbp - 0x48], 0x17001c
mov dword [rbp - 0x44], 0x1f0039
mov dword [rbp - 0x40], 0xa0003
mov dword [rbp - 0x3c], 0x390001
mov dword [rbp - 0x38], 0x60006
mov dword [rbp - 0x34], 0x1b0017
mov dword [rbp - 0x30], 0xd0002
mov dword [rbp - 0x2c], 0x40017
mov dword [rbp - 0x28], 0x490002
mov dword [rbp - 0x24], 0x40008
mov dword [rbp - 0x20], 0x70006
xor ecx, ecx
mov dword [rbp - 0x1c], 0xb0000
mov dword [rbp - 0x18], 0x4e
lea r8, [0x1401d1da0]
nop dword [rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rbp + rcx*2 - 0x52]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x1d
jl 0x140057cf0
mov byte [0x1401d89b5], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x50
pop rbp
ret

Function at 0x140057d30
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401d89db], 0
je 0x140057d69
lea rax, [0x1401d29f0]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 0x70], rbx
xor ebx, ebx
mov dword [rbp - 0x40], 0x19000b
mov dword [rbp - 0x3c], 0x410001
mov dword [rbp - 0x38], 0x2f002b
mov dword [rbp - 0x34], 0x30021
mov word [rbp - 0x14], bx
mov dword [rbp - 0x30], 0xb0048
mov dword [rbp - 0x2c], 0xc0000
mov dword [rbp - 0x28], 0x10007
mov dword [rbp - 0x24], 0x520015
mov dword [rbp - 0x20], 0x10000b
mov dword [rbp - 0x1c], 0x120019
mov dword [rbp - 0x18], 0x470005
call fcn.140056d20
lea rax, [0x1401d29f0]
lea r8, [0x1401d1da1]
nop word [rax + rax]
movzx ecx, byte [rbx + r8 - 1]
movzx edx, word [rbp + rbx*2 - 0x3e]
add rbx, 2
xor cx, word [rbp + rbx*2 - 0x44]
mov word [rax + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor dx, cx
mov word [rax + rbx*2 - 2], dx
cmp rbx, 0x16
jl 0x140057de0
mov byte [0x1401d89db], 1
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x60
pop rbp
ret
Function at 0x1400580e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0xaa8]
sub rsp, 0xba8
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rbp + 0xa90], rax
mov ecx, dword [0x1401d6d80]
mov eax, 0x2aaaaaab
mov ebx, 4
mov r8d, ecx
imul r8d, ecx
imul r8d, ecx
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub r8d, eax
cmp r8d, 0xa
jne 0x14005817b
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ebx
imul edx, edx, 0x64
sub ecx, edx
add ecx, 0x7b
movsxd rdx, ecx
mov rcx, 0xffffffffffffffff
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.1400d4448
mov rcx, rax
call fcn.1400d5528
mov ecx, dword [0x1401d6d80]
cmp byte [0x1401d89c2], 0
mov qword [rsp + 0xbd0], r14
je 0x140058198
lea rax, [0x1401d2630]
jmp 0x14005834a
mov qword [rsp + 0xba0], r15
xor r15d, r15d
mov dword [rbp + 0xa50], 0x10002d
mov dword [rbp + 0xa54], 0x310019
mov dword [rbp + 0xa58], 0xc001d
mov dword [rbp + 0xa5c], 0x31000e
mov edx, r15d
mov dword [rbp + 0xa60], 0xb000c
mov dword [rbp + 0xa64], 0xc001d
mov dword [rbp + 0xa68], 0x1c0007
mov dword [rbp + 0xa6c], 0x1d0041
mov dword [rbp + 0xa70], 0x480008
mov dword [rbp + 0xa74], 0xe003c
mov dword [rbp + 0xa78], 0xd0010
mov dword [rbp + 0xa7c], 0xc0022
mov dword [rbp + 0xa80], 0x19000d
mov dword [rbp + 0xa84], 0x1d0004
mov dword [rbp + 0xa88], 0x590017
mov dword [rbp + 0xa8c], 0x47
lea r14, [0x1401d2630]
lea r8, [0x1401d1da0]
nop word [rax + rax]
movzx eax, byte [rdx + r8]
inc rdx
xor ax, word [rbp + rdx*2 + 0xa4e]
mov word [r14 + rdx*2 - 2], ax
cmp rdx, 0x1f
jl 0x140058260
mov r8d, ecx
mov eax, 0x38e38e39
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 2
jne 0x140058338
mov qword [rsp + 0xbc0], rsi
mov qword [rsp + 0xbc8], rdi
lea rdi, [rsp + 0x20]
mov esi, r15d
nop
mov r10d, r15d
nop word [rax + rax]
mov eax, ecx
lea r8d, [rsi + 1]
lea ebx, [r10 + 1]
cdq
idiv r8d
mov eax, ecx
mov r8d, ecx
sub r8d, esi
lea rcx, [0x14015e04c]
mov r9d, edx
cdq
idiv ebx
imul r9d, r8d
add r9d, eax
sub r9d, r10d
mov edx, r9d
call fcn.1400d5714
add rdi, 4
mov r10d, ebx
cmp ebx, 0x1f
jge 0x140058319
mov ecx, dword [0x1401d6d80]
jmp 0x1400582d0
inc esi
cmp esi, 0x17
jge 0x140058328
mov ecx, dword [0x1401d6d80]
jmp 0x1400582c0
mov rsi, qword [rsp + 0xbc0]
mov rdi, qword [rsp + 0xbc8]
mov r15, qword [rsp + 0xba0]
mov byte [0x1401d89c2], 1
mov rax, r14
mov r14, qword [rsp + 0xbd0]
mov rcx, qword [rbp + 0xa90]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0xba8
pop rbx
pop rbp
ret
Function at 0x140058370
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rsp + 0x18], rax
mov eax, dword [0x1401d6d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 9
jne 0x1400583b3
inc dword [0x1401d84ac]
cmp byte [0x1401d89b7], 0
lea rax, [0x1401d2578]
jne 0x14005841f
mov dword [rsp], 0x1b0047
mov dword [rsp + 4], 0x170002
mov dword [rsp + 8], 0x55000e
mov dword [rsp + 0xc], 0x5e0059
mov dword [rsp + 0x10], 0x3000c
mov dword [rsp + 0x14], 3
xor ecx, ecx
lea r8, [0x1401d1da0]
nop dword [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 - 2]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0xb
jl 0x140058400
mov byte [0x1401d89b7], 1
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x28
ret
Function at 0x140058440
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x140]
sub rsp, 0x240
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rbp + 0x130], rax
mov ecx, dword [0x1401d6d80]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0xb21642c9
imul r8d, ecx
imul r8d
add edx, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub r8d, edx
cmp r8d, 4
jne 0x1400584bc
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401d6d80]
mov edx, 7
test rax, rax
cmove ecx, edx
mov dword [0x1401d6d80], ecx
cmp byte [0x1401d89dc], 0
je 0x1400584d1
lea rax, [0x1401d2a90]
jmp 0x140058691
mov r8d, ecx
xor r10d, r10d
mov eax, 0x30c30c31
mov qword [rsp + 0x250], rbx
mov rbx, qword [rsp + 0x250]
mov dword [rbp + 0xe0], 0x19000b
imul r8d, ecx
imul r8d, ecx
imul r8d
sar edx, 2
mov dword [rbp + 0xe4], 0xe0001
mov dword [rbp + 0xe8], 0x43000c
mov eax, edx
mov dword [rbp + 0xec], 0x11000b
mov dword [rbp + 0xf0], 0x30001
shr eax, 0x1f
mov dword [rbp + 0xf4], 0xd000a
mov dword [rbp + 0xf8], 0x1f0054
add edx, eax
mov dword [rbp + 0xfc], 0x1d0013
mov dword [rbp + 0x100], 0x48000d
mov dword [rbp + 0x104], 0x120019
mov dword [rbp + 0x108], 0x1d0051
mov dword [rbp + 0x10c], 0x17000b
imul edx, edx, 0x15
sub r8d, edx
mov dword [rbp + 0x110], 0x20002
mov dword [rbp + 0x114], 0xe000b
mov dword [rbp + 0x118], 0xa001a
mov dword [rbp + 0x11c], 9
mov word [rbp + 0x120], r10w
cmp r8d, 0xa
jne 0x1400585bd
inc ecx
mov dword [0x1401d6d80], ecx
mov r8, r10
lea r9, [0x1401d2a90]
lea r11, [0x1401d1da1]
nop
movzx eax, byte [r8 + r11 - 1]
movzx edx, word [rbp + r8*2 + 0xe2]
add r8, 4
xor ax, word [rbp + r8*2 + 0xd8]
mov word [r9 + r8*2 - 8], ax
movzx eax, byte [r8 + r11 - 4]
xor dx, ax
movzx eax, byte [r8 + r11 - 3]
xor ax, word [rbp + r8*2 + 0xdc]
mov word [r9 + r8*2 - 6], dx
mov word [r9 + r8*2 - 4], ax
movzx eax, byte [r8 + r11 - 2]
xor ax, word [rbp + r8*2 + 0xde]
mov word [r9 + r8*2 - 2], ax
cmp r8, 0x20
jl 0x1400585d0
mov r8d, ecx
mov eax, 0x38e38e39
mov byte [0x1401d89dc], 1
imul r8d, ecx
imul r8d, ecx
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub r8d, eax
cmp r8d, 4
jne 0x14005868e
lea rax, [rsp + 0x20]
nop word [rax + rax]
mov edx, dword [rax]
inc r10d
lea rax, [rax + 4]
lea ecx, [rcx + rdx*4]
movsxd rdx, r10d
cmp rdx, 0x1b8
jb 0x140058670
mov dword [0x1401d6d80], ecx
mov rax, r9
mov rcx, qword [rbp + 0x130]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x240
pop rbp
ret
Function at 0x1400586b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401d89b2], 0
je 0x1400586e9
lea rax, [0x1401d28a0]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x30
pop rbp
ret
xor r8d, r8d
mov dword [rbp - 0x30], 0x1d0009
mov dword [rbp - 0x2c], 0x170032
mov dword [rbp - 0x28], 0x11000a
mov dword [rbp - 0x24], 0x19001e
mov dword [rbp - 0x20], 0x10007
mov word [rbp - 0xc], r8w
mov dword [rbp - 0x1c], 0xa0030
mov dword [rbp - 0x18], 0xe001c
mov dword [rbp - 0x14], 0x15000f
mov dword [rbp - 0x10], 0x37000b
lea rdx, [0x1401d28a0]
lea r9, [0x1401d1da1]
nop
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rbp + r8*2 - 0x2e]
add r8, 6
xor ax, word [rbp + r8*2 - 0x3c]
mov word [rdx + r8*2 - 0xc], ax
movzx eax, byte [r8 + r9 - 6]
xor cx, ax
movzx eax, byte [r8 + r9 - 5]
xor ax, word [rbp + r8*2 - 0x38]
mov word [rdx + r8*2 - 0xa], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x34]
mov word [rdx + r8*2 - 8], ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rbp + r8*2 - 0x36]
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x32]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 2], cx
cmp r8, 0x12
jl 0x140058740
mov byte [0x1401d89b2], 1
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x30
pop rbp
ret
Function at 0x1400588c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0x898]
sub rsp, 0x998
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rbp + 0x880], rax
cmp byte [0x1401d89d4], 0
je 0x1400588f9
lea rax, [0x1401d2790]
jmp 0x140058a99
mov qword [rsp + 0x990], r15
xor r15d, r15d
mov dword [rbp + 0x850], 0x140009
mov dword [rbp + 0x854], 0x150003
mov dword [rbp + 0x858], 0x5004f
mov dword [rbp + 0x85c], 0x1e0004
mov ecx, r15d
mov dword [rbp + 0x860], 0x4f000c
mov dword [rbp + 0x864], 0x1c000c
mov dword [rbp + 0x868], 0x1d0006
mov dword [rbp + 0x86c], 0x1c0004
mov dword [rbp + 0x870], 0x25001a
mov dword [rbp + 0x874], 0x5001f
mov dword [rbp + 0x878], 0x50004
mov dword [rbp + 0x87c], 0xb
lea r14, [0x1401d2790]
lea rdx, [0x1401d1da0]
nop dword [rax]
movzx eax, byte [rcx + rdx]
inc rcx
xor ax, word [rbp + rcx*2 + 0x84e]
mov word [r14 + rcx*2 - 2], ax
cmp rcx, 0x17
jl 0x140058990
mov ecx, dword [0x1401d6d80]
mov byte [0x1401d89d4], 1
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x30c30c31
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 0xa
jne 0x140058a8e
mov qword [rsp + 0x9b0], rbx
mov qword [rsp + 0x9b8], rsi
mov qword [rsp + 0x9c0], rdi
lea rdi, [rsp + 0x20]
mov esi, r15d
nop dword [rax]
mov r9d, r15d
nop word [rax + rax]
mov eax, ecx
lea r8d, [rsi + 1]
lea ebx, [r9 + 1]
cdq
idiv r8d
mov eax, ecx
sub eax, esi
mov r8d, edx
imul r8d, eax
mov eax, ecx
lea rcx, [0x14015e11c]
cdq
idiv ebx
add r8d, eax
sub r8d, r9d
mov edx, r8d
call fcn.1400d5714
add rdi, 4
mov r9d, ebx
cmp ebx, 0x15
jge 0x140058a67
mov ecx, dword [0x1401d6d80]
jmp 0x140058a20
inc esi
cmp esi, 0x1c
jge 0x140058a76
mov ecx, dword [0x1401d6d80]
jmp 0x140058a10
mov rsi, qword [rsp + 0x9b8]
mov rbx, qword [rsp + 0x9b0]
mov rdi, qword [rsp + 0x9c0]
mov r15, qword [rsp + 0x990]
mov rax, r14
mov rcx, qword [rbp + 0x880]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x998
pop r14
pop rbp
ret

Function at 0x140058ac0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401d89bb], 0
lea rax, [0x1401d24e8]
jne 0x140058b9c
xor r8d, r8d
mov dword [rsp], 0x30004
mov dword [rsp + 4], 0x3e001d
mov dword [rsp + 8], 0x130006
mov dword [rsp + 0xc], 0x2f000e
mov dword [rsp + 0x10], 0x6001c
mov word [rsp + 0x20], r8w
mov dword [rsp + 0x14], 0xc0002
mov dword [rsp + 0x18], 0x10
mov dword [rsp + 0x1c], 0x60014
lea r9, [0x1401d1da1]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rsp + r8*2 + 2]
add r8, 4
xor cx, word [rsp + r8*2 - 8]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x10
jl 0x140058b40
mov byte [0x1401d89bb], 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400d4e00
add rsp, 0x38
ret
Function at 0x140058bb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401cee90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401d89c1], 0
je 0x140058be0
lea rax, [0x1401d2c40]
jmp 0x140058d13
xor r9d, r9d
mov dword [rbp - 0x40], 0x50025
mov dword [rbp - 0x3c], 0xf0008
mov dword [rbp - 0x38], 0x11003f
mov dword [rbp - 0x34], 0x130002
mov dword [rbp - 0x30], 0x1c000d
mov word [rbp - 0x10], r9w
mov edx, r9d
mov dword [rbp - 0x2c], 0x3d001c
mov dword [rbp - 0x28], 0x4001b
mov dword [rbp - 0x24], 0x1c0004
mov dword [rbp - 0x20], 0xe004e
mov dword [rbp - 0x1c], 0x80011
mov dword [rbp - 0x18], 0xc001d
mov dword [rbp - 0x14], 0x45000a
lea rbx, [0x1401d2c40]
lea r8, [0x1401d1da1]
nop dword [rax]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rbp + rdx*2 - 0x3e]
add rdx, 6
xor ax, word [rbp + rdx*2 - 0x4c]
mov word [rbx + rdx*2 - 0xc], ax
movzx eax, byte [rdx + r8 - 6]
xor cx, ax
movzx eax, byte [rdx + r8 - 5]
xor ax, word [rbp + rdx*2 - 0x48]
mov word [rbx + rdx*2 - 0xa], cx
mov word [rbx + rdx*2 - 8], ax
movzx eax, byte [rdx + r8 - 4]
xor ax, word [rbp + rdx*2 - 0x46]
mov word [rbx + rdx*2 - 6], ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rbp + rdx*2 - 0x44]
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rbp + rdx*2 - 0x42]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0x18
jl 0x140058c50
mov ecx, dword [0x1401d6d80]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x38e38e39
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 0xe
jne 0x140058d09
mov qword [rsp + 0x28], r9
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r9
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov byte [0x1401d89c1], 1
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d4e00
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret