joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400531c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401c698c], 0
je 0x1400531f5
lea rax, [0x1401c0528]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x38
ret
mov ecx, dword [0x1401c4d60]
mov eax, 0x4ec4ec4f
imul ecx, ecx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 8
jne 0x14005321f
inc dword [0x1401c63ec]
mov dword [rsp], 0x1e001c
xor ecx, ecx
mov dword [rsp + 4], 0x3c0000
mov dword [rsp + 8], 0x11001e
mov dword [rsp + 0xc], 0x3a0003
mov dword [rsp + 0x10], 0x110009
mov dword [rsp + 0x14], 0x10010
mov dword [rsp + 0x18], 0x40012
mov dword [rsp + 0x1c], 0x1b
mov dword [rsp + 0x20], 6
lea rax, [0x1401c0528]
lea r8, [0x1401bfd90]
nop word [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 - 2]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x11
jl 0x140053280
mov byte [0x1401c698c], 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x38
ret
Function at 0x140053980
Capabilities:
Encode data using xor
Get disk size

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov ecx, dword [0x1401c4d60]
xor esi, esi
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x2e8ba2e9
imul r8d, ecx
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub r8d, edx
cmp r8d, 4
jne 0x1400539fc
mov r8d, esi
test ecx, ecx
je 0x1400539f3
nop dword [rax + rax]
mov eax, ecx
and eax, 1
add r8d, eax
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
jne 0x1400539e0
mov ecx, r8d
mov dword [0x1401c4d60], ecx
cmp byte [0x1401c69b1], sil
mov qword [rsp + 0xa0], rbx
je 0x140053a19
lea rax, [0x1401c0a20]
jmp 0x140053b4a
mov qword [rsp + 0xa8], rdi
mov rdi, qword [rsp + 0xa8]
mov dword [rbp - 9], 0x1a0017
mov dword [rbp - 5], 0xc0002
mov dword [rbp - 1], 0x3a001f
mov dword [rbp + 3], 0xa0004
mov dword [rbp + 7], 0x40001
mov dword [rbp + 0xb], 0xa0006
mov dword [rbp + 0xf], 0x13000b
mov dword [rbp + 0x13], 0x1b0013
mov dword [rbp + 0x17], 0x70001
mov dword [rbp + 0x1b], 0x3c000d
mov dword [rbp + 0x1f], 0x7000b
mov dword [rbp + 0x23], 0x360006
mov dword [rbp + 0x27], 0xc0002
mov dword [rbp + 0x2b], 0x40014
mov dword [rbp + 0x2f], 0x60017
mov dword [rbp + 0x33], 0x1e0002
mov word [rbp + 0x37], si
mov r8, rsi
lea rbx, [0x1401c0a20]
lea r9, [0x1401bfd91]
nop
movzx eax, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 7]
add r8, 4
xor ax, word [rbp + r8*2 - 0x11]
mov word [rbx + r8*2 - 8], ax
movzx eax, byte [r8 + r9 - 4]
xor dx, ax
movzx eax, byte [r8 + r9 - 3]
xor ax, word [rbp + r8*2 - 0xd]
mov word [rbx + r8*2 - 6], dx
movzx edx, byte [r8 + r9 - 2]
xor dx, word [rbp + r8*2 - 0xb]
mov word [rbx + r8*2 - 4], ax
mov word [rbx + r8*2 - 2], dx
cmp r8, 0x20
jl 0x140053ab0
lea r8d, [rcx + 1]
mov eax, 0x2e8ba2e9
mov byte [0x1401c69b1], 1
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, 1
jne 0x140053b47
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov rax, rbx
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400ce2d0
mov rsi, qword [rsp + 0xb0]
add rsp, 0x90
pop rbp
ret
Function at 0x140053b70
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r9d, dword [0x1401c4d60]
mov eax, 0x2e8ba2e9
lea ecx, [r9 + 1]
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 5
jne 0x140053bd4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov r9d, dword [0x1401c4d60]
mov ecx, 7
test rax, rax
cmove r9d, ecx
mov dword [0x1401c4d60], r9d
cmp byte [0x1401c69ae], 0
mov qword [rsp + 0x50], rbx
je 0x140053bee
lea rax, [0x1401c08a0]
jmp 0x140053cdb
mov dword [rsp + 0x20], 0x1a0031
mov dword [rsp + 0x24], 0x20015
mov dword [rsp + 0x28], 0x19
xor edx, edx
mov dword [rsp + 0x2c], 0xd0033
mov dword [rsp + 0x30], 0xc001e
mov dword [rsp + 0x34], 0x12
mov dword [rsp + 0x38], 0x80027
mov dword [rsp + 0x3c], 0x48
lea rbx, [0x1401c08a0]
lea r8, [0x1401bfd91]
nop
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rsp + rdx*2 + 0x22]
add rdx, 5
xor ax, word [rsp + rdx*2 + 0x16]
mov word [rbx + rdx*2 - 0xa], ax
movzx eax, byte [rdx + r8 - 5]
xor cx, ax
movzx eax, byte [rdx + r8 - 4]
xor ax, word [rsp + rdx*2 + 0x1a]
mov word [rbx + rdx*2 - 8], cx
mov word [rbx + rdx*2 - 6], ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rsp + rdx*2 + 0x1c]
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rsp + rdx*2 + 0x1e]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0xf
jl 0x140053c40
lea r8d, [r9 + 1]
mov eax, 0x2aaaaaab
mov byte [0x1401c69ae], 1
imul r8d, r9d
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
shl ecx, 2
sub r8d, ecx
cmp r8d, 7
jne 0x140053cd8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401c4d60], eax
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x58
ret
Function at 0x140054390
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401c69a9], 0
lea rax, [0x1401c0380]
jne 0x1400544a0
xor r8d, r8d
mov dword [rbp - 0x40], 0x90011
mov dword [rbp - 0x3c], 0x17001e
mov dword [rbp - 0x38], 0x4004d
mov dword [rbp - 0x34], 0x9000b
mov dword [rbp - 0x30], 0xa0003
mov word [rbp - 0x10], r8w
mov dword [rbp - 0x2c], 0x50053
mov dword [rbp - 0x28], 0x130001
mov dword [rbp - 0x24], 0x1c0017
mov dword [rbp - 0x20], 0x49001b
mov dword [rbp - 0x1c], 0x6000e
mov dword [rbp - 0x18], 0x20001
mov dword [rbp - 0x14], 0xd000f
lea r9, [0x1401bfd91]
nop
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 6
xor cx, word [rbp + r8*2 - 0x4c]
mov word [rax + r8*2 - 0xc], cx
movzx ecx, byte [r8 + r9 - 6]
xor dx, cx
movzx ecx, byte [r8 + r9 - 5]
xor cx, word [rbp + r8*2 - 0x48]
mov word [rax + r8*2 - 0xa], dx
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x18
jl 0x140054420
mov byte [0x1401c69a9], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x40
pop rbp
ret

Function at 0x1400545a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x1a8
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rsp + 0x198], rax
mov edx, dword [0x1401c4d60]
lea ecx, [rdx + 2]
lea eax, [rdx + 1]
imul ecx, eax
imul ecx, edx
and ecx, 0x80000007
jge 0x1400545da
dec ecx
or ecx, 0xfffffff8
inc ecx
xor eax, eax
cmp ecx, 7
jne 0x140054611
mov r8d, eax
lea r9, [rsp]
nop dword [rax + rax]
mov ecx, dword [r9]
inc r8d
lea r9, [r9 + 4]
imul ecx, ecx, 0xf
add edx, ecx
movsxd rcx, r8d
cmp rcx, 0x16c
jb 0x1400545f0
mov dword [0x1401c4d60], edx
cmp byte [0x1401c69bf], al
je 0x140054638
lea rax, [0x1401c0458]
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x1a8
ret
mov dword [rsp + 0x170], 0x1e001c
mov dword [rsp + 0x174], 0x3c0000
mov dword [rsp + 0x178], 0x150004
mov dword [rsp + 0x17c], 0x3a0004
mov dword [rsp + 0x180], 0x110009
mov dword [rsp + 0x184], 0x10010
mov dword [rsp + 0x188], 0x40012
mov dword [rsp + 0x18c], 0x1b
mov dword [rsp + 0x190], 6
lea r9, [0x1401c0458]
lea r8, [0x1401bfd90]
nop dword [rax]
movzx ecx, byte [rax + r8]
inc rax
xor cx, word [rsp + rax*2 + 0x16e]
mov word [r9 + rax*2 - 2], cx
cmp rax, 0x11
jl 0x1400546b0
mov r8d, edx
mov eax, 0x2aaaaaab
imul r8d, edx
imul r8d, edx
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
shl ecx, 2
sub r8d, ecx
cmp r8d, 0xa
jne 0x1400546fd
inc dword [0x1401c6648]
mov byte [0x1401c69bf], 1
mov rax, r9
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x1a8
ret
Function at 0x1400548b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400507b0
test al, al
jne 0x1400548f4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401c4d60]
mov edx, 7
test rax, rax
cmove ecx, edx
mov dword [0x1401c4d60], ecx
cmp byte [0x1401c6998], 0
lea rax, [0x1401c09c8]
jne 0x1400549ec
xor r8d, r8d
mov qword [rsp + 0x80], rbx
mov rbx, qword [rsp + 0x80]
mov word [rbp - 0x18], r8w
mov dword [rbp - 0x50], 0x1e001c
mov dword [rbp - 0x4c], 0x3c0000
mov dword [rbp - 0x48], 0xc000b
mov dword [rbp - 0x44], 0x160015
mov dword [rbp - 0x40], 0x360018
mov dword [rbp - 0x3c], 0xa001a
mov dword [rbp - 0x38], 0x150008
mov dword [rbp - 0x34], 0x1b0011
mov dword [rbp - 0x30], 0x60001
mov dword [rbp - 0x2c], 0x3c0004
mov dword [rbp - 0x28], 0xe000b
mov dword [rbp - 0x24], 0xc001e
mov dword [rbp - 0x20], 0x1d0013
mov dword [rbp - 0x1c], 0x90016
lea r9, [0x1401bfd91]
nop dword [rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x4e]
add r8, 4
xor cx, word [rbp + r8*2 - 0x58]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x54]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x52]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x1c
jl 0x140054990
mov byte [0x1401c6998], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x70
pop rbp
ret
Function at 0x140054a00
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x14e50]
mov eax, 0x14f50
call fcn.1400d3380
sub rsp, rax
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp + 0x14e40], rax
mov r8d, dword [0x1401c4d60]
mov eax, 0x66666667
lea ecx, [r8 + 1]
imul ecx, r8d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 7
jne 0x140054a9e
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x7b
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400cd918
mov rcx, rax
call fcn.1400cf37c
mov r8d, dword [0x1401c4d60]
cmp byte [0x1401c69ac], 0
mov qword [rsp + 0x14f60], rbx
je 0x140054abb
lea rax, [0x1401c0640]
jmp 0x140054c59
mov qword [rsp + 0x14f68], rdi
xor edi, edi
mov dword [rsp + 0x20], 0x1a0017
mov dword [rsp + 0x24], 0xc0002
mov qword [rsp + 0x28], 0x45001f
mov dword [rsp + 0x30], 0x1d0018
mov edx, edi
mov dword [rsp + 0x34], 0xa001a
mov dword [rsp + 0x38], 0x500005
mov dword [rsp + 0x3c], 0x60014
mov dword [rsp + 0x40], 0x1a001a
mov dword [rsp + 0x44], 0x43001e
mov dword [rsp + 0x48], 0x19001f
mov dword [rsp + 0x4c], 0xa0005
mov dword [rsp + 0x50], 0x1a0015
mov dword [rsp + 0x54], 0x4d0000
mov dword [rsp + 0x58], 0x1c000d
mov dword [rsp + 0x5c], 0x80016
mov dword [rsp + 0x60], 0x48
lea rbx, [0x1401c0640]
lea r9, [0x1401bfd91]
nop word [rax + rax]
movzx eax, byte [rdx + r9 - 1]
movzx ecx, word [rsp + rdx*2 + 0x22]
add rdx, 3
xor ax, word [rsp + rdx*2 + 0x1a]
mov word [rbx + rdx*2 - 6], ax
movzx eax, byte [rdx + r9 - 3]
xor cx, ax
movzx eax, byte [rdx + r9 - 2]
xor ax, word [rsp + rdx*2 + 0x1e]
mov word [rbx + rdx*2 - 4], cx
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0x21
jl 0x140054b60
mov ecx, r8d
mov eax, 0x92492493
mov byte [0x1401c69ac], 1
imul ecx, r8d
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 0xa
jne 0x140054c4e
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x14ec0
mov word [rsp + 0x70], di
call fcn.1400d3710
mov r10, rdi
mov r9, rdi
nop dword [rax]
mov rcx, rdi
test r10, r10
je 0x140054c22
test rcx, rcx
je 0x140054c22
lea rax, [r9 + rcx]
lea r8, [rsp + 0x70]
lea r8, [r8 + rax*2]
lea rax, [r9 + rcx]
movzx edx, word [rbp + rax*2 - 0x22e]
inc dx
add dx, word [r8 - 2]
mov word [r8], dx
inc rcx
cmp rcx, 0xcf
jl 0x140054bf3
add r9, 0xcf
inc r10
cmp r9, 0xa761
jl 0x140054bf0
movsx ecx, word [rbp + 0x14e30]
mov dword [0x1401c4d60], ecx
mov rdi, qword [rsp + 0x14f68]
mov rax, rbx
mov rbx, qword [rsp + 0x14f60]
mov rcx, qword [rbp + 0x14e40]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x14f50
pop rbp
ret
Function at 0x140054c80
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r8d, dword [0x1401c4d60]
mov eax, 0x38e38e39
lea ecx, [r8 + 1]
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0x11
jne 0x140054ce8
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov r8d, dword [0x1401c4d60]
mov ecx, 7
test rax, rax
cmove r8d, ecx
mov dword [0x1401c4d60], r8d
lea ecx, [r8 + 1]
mov eax, 0x38e38e39
xor ebx, ebx
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0x11
jne 0x140054d36
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp byte [0x1401c6991], bl
lea rax, [0x1401c0940]
jne 0x140054d9e
mov dword [rsp + 0x40], 0xd0004
mov dword [rsp + 0x44], 0x100002
mov dword [rsp + 0x48], 0xa0004
mov dword [rsp + 0x4c], 0x450009
mov dword [rsp + 0x50], 0x1b0009
mov dword [rsp + 0x54], 1
lea rdx, [0x1401bfd90]
nop dword [rax]
movzx ecx, byte [rbx + rdx]
inc rbx
xor cx, word [rsp + rbx*2 + 0x3e]
mov word [rax + rbx*2 - 2], cx
cmp rbx, 0xb
jl 0x140054d80
mov byte [0x1401c6991], 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x60
pop rbx
ret
Function at 0x140054dc0
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x1b6e0]
mov eax, 0x1b7e0
call fcn.1400d3380
sub rsp, rax
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp + 0x1b6d0], rax
mov r8d, dword [0x1401c4d60]
mov eax, 0x92492493
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
imul ecx
add edx, ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
sub ecx, edx
cmp ecx, 5
jne 0x140054e3e
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov r8d, dword [0x1401c4d60]
mov ecx, 7
test rax, rax
cmove r8d, ecx
mov dword [0x1401c4d60], r8d
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x6bca1af3
imul ecx, r8d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 0xb
jne 0x140054e7a
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov r8d, dword [0x1401c4d60]
cmp byte [0x1401c69b0], 0
mov qword [rsp + 0x1b7f0], rbx
je 0x140054e97
lea rax, [0x1401c0b40]
jmp 0x140055003
mov qword [rsp + 0x1b7f8], rdi
xor edi, edi
mov dword [rbp - 0x30], 0x18003d
mov dword [rbp - 0x2c], 0xd0015
mov dword [rbp - 0x28], 0x17003d
mov dword [rbp - 0x24], 0x60008
mov edx, edi
mov dword [rbp - 0x20], 0x1a0009
mov dword [rbp - 0x1c], 0x440000
mov qword [rbp - 0x18], 0x50001
lea rbx, [0x1401c0b40]
lea r9, [0x1401bfd91]
nop word [rax + rax]
movzx eax, byte [rdx + r9 - 1]
movzx ecx, word [rbp + rdx*2 - 0x2e]
add rdx, 5
xor ax, word [rbp + rdx*2 - 0x3a]
mov word [rbx + rdx*2 - 0xa], ax
movzx eax, byte [rdx + r9 - 5]
xor cx, ax
movzx eax, byte [rdx + r9 - 4]
xor ax, word [rbp + rdx*2 - 0x36]
mov word [rbx + rdx*2 - 8], cx
mov word [rbx + rdx*2 - 6], ax
movzx eax, byte [rdx + r9 - 3]
xor ax, word [rbp + rdx*2 - 0x34]
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r9 - 2]
xor ax, word [rbp + rdx*2 - 0x32]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0xf
jl 0x140054ef0
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x66666667
imul ecx, r8d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 9
jne 0x140054ff1
lea rcx, [rbp - 0xe]
xor edx, edx
mov r8d, 0x1b6d0
mov word [rbp - 0x10], di
call fcn.1400d3710
mov r10, rdi
mov r9, rdi
mov rax, rdi
test r10, r10
je 0x140054fc6
test rax, rax
je 0x140054fc6
lea rcx, [r9 + rax]
lea r8, [rbp - 0x10]
lea r8, [r8 + rcx*2]
lea rcx, [r9 + rax]
movzx edx, word [rbp + rcx*2 - 0x1ea]
inc dx
add dx, word [r8 - 2]
mov word [r8], dx
inc rax
cmp rax, 0xed
jl 0x140054f98
add r9, 0xed
inc r10
cmp r9, 0xdb69
jl 0x140054f95
movsx ecx, word [rbp + 0x1b6c0]
mov dword [0x1401c4d60], ecx
mov rdi, qword [rsp + 0x1b7f8]
mov byte [0x1401c69b0], 1
mov rax, rbx
mov rbx, qword [rsp + 0x1b7f0]
mov rcx, qword [rbp + 0x1b6d0]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x1b7e0
pop rbp
ret
Function at 0x140055030
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401c699f], 0
je 0x140055069
lea rax, [0x1401c04b0]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x50
pop rbp
ret
mov eax, dword [0x1401c4d60]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 4
jne 0x140055096
dec dword [0x1401c64b8]
mov dword [rbp - 0x50], 0x1a0031
mov dword [rbp - 0x4c], 0x20015
mov dword [rbp - 0x48], 0x19
xor ecx, ecx
mov dword [rbp - 0x44], 0xa0033
mov dword [rbp - 0x40], 0x50003
mov dword [rbp - 0x3c], 0x1001b
mov dword [rbp - 0x38], 0xe
mov dword [rbp - 0x34], 0x5d0041
mov dword [rbp - 0x30], 0x7003b
mov dword [rbp - 0x2c], 0x13000b
mov dword [rbp - 0x28], 0x3001c
mov dword [rbp - 0x24], 0x1d0005
mov dword [rbp - 0x20], 0xf0050
mov dword [rbp - 0x1c], 0x40012
mov dword [rbp - 0x18], 0x170008
mov dword [rbp - 0x14], 0x14
lea rax, [0x1401c04b0]
lea r8, [0x1401bfd90]
nop word [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rbp + rcx*2 - 0x52]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x1f
jl 0x140055120
mov byte [0x1401c699f], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x50
pop rbp
ret

Function at 0x140055160
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp], rax
cmp byte [0x1401c6995], 0
je 0x140055195
lea rax, [0x1401c0550]
jmp 0x140055288
xor edx, edx
mov dword [rbp - 0x30], 0x1a0025
mov dword [rbp - 0x2c], 0x170019
mov dword [rbp - 0x28], 0x350008
mov dword [rbp - 0x24], 0xa0015
mov dword [rbp - 0x20], 0xc000f
mov word [rbp - 8], dx
mov dword [rbp - 0x1c], 0x170000
mov dword [rbp - 0x18], 0x15002f
mov dword [rbp - 0x14], 0x1f
mov dword [rbp - 0x10], 0x10001a
mov dword [rbp - 0xc], 0x430050
lea rbx, [0x1401c0550]
lea r8, [0x1401bfd91]
nop
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rbp + rdx*2 - 0x2e]
add rdx, 5
xor ax, word [rbp + rdx*2 - 0x3a]
mov word [rbx + rdx*2 - 0xa], ax
movzx eax, byte [rdx + r8 - 5]
xor cx, ax
movzx eax, byte [rdx + r8 - 4]
xor ax, word [rbp + rdx*2 - 0x36]
mov word [rbx + rdx*2 - 8], cx
mov word [rbx + rdx*2 - 6], ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rbp + rdx*2 - 0x34]
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rbp + rdx*2 - 0x32]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0x14
jl 0x1400551f0
mov ecx, dword [0x1401c4d60]
mov eax, 0x38e38e39
mov byte [0x1401c6995], 1
imul ecx, ecx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xb
jne 0x140055285
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov rax, rbx
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1400ce2d0
mov rbx, qword [rsp + 0x120]
add rsp, 0x110
pop rbp
ret
Function at 0x1400552b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov ecx, dword [0x1401c4d60]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x2e8ba2e9
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, 0xb
jne 0x140055366
test ecx, ecx
je 0x140055366
nop word [rax + rax]
mov eax, ecx
and eax, 0x80000001
jge 0x140055310
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x140055325
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov dword [0x1401c4d60], eax
jmp 0x140055332
lea ecx, [rcx*2 + 1]
mov dword [0x1401c4d60], ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov edx, ecx
sub edx, eax
je 0x140055354
sub edx, 2
je 0x140055357
dec edx
je 0x140055359
jmp 0x140055362
add ecx, 2
inc ecx
add ecx, 2
mov dword [0x1401c4d60], ecx
test ecx, ecx
jne 0x140055300
cmp byte [0x1401c69be], 0
je 0x140055388
lea rax, [0x1401c0688]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x38
ret
xor r8d, r8d
mov dword [rsp], 0xd0004
mov dword [rsp + 4], 0x100002
mov dword [rsp + 8], 0xa0004
mov dword [rsp + 0xc], 0x5f0009
mov dword [rsp + 0x10], 0x59004c
mov word [rsp + 0x20], r8w
mov dword [rsp + 0x14], 0x54005d
mov dword [rsp + 0x18], 0x40004c
mov dword [rsp + 0x1c], 0x5f005c
lea rdx, [0x1401c0688]
lea r9, [0x1401bfd91]
nop
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 2]
add r8, 4
xor ax, word [rsp + r8*2 - 8]
mov word [rdx + r8*2 - 8], ax
movzx eax, byte [r8 + r9 - 4]
xor cx, ax
mov word [rdx + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0x10
jl 0x1400553e0
mov byte [0x1401c69be], 1
mov rax, rdx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x38
ret