joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140056340
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.140053de0
test al, al
jne 0x140056382
mov ecx, 1
mov r8d, 0x60
mov eax, ecx
nop dword [rax]
dec r8d
lea edx, [rax + rcx]
lea ecx, [rax]
mov eax, edx
jns 0x140056370
mov dword [0x1401cbd80], edx
cmp byte [0x1401cdda1], 0
je 0x1400563a4
lea rax, [0x1401c7b68]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x60
pop rbp
ret
xor r8d, r8d
mov dword [rbp - 0x40], 0x1f0029
mov dword [rbp - 0x3c], 0x40010
mov dword [rbp - 0x38], 0x10001b
mov dword [rbp - 0x34], 0x160034
mov dword [rbp - 0x30], 0x9000e
mov word [rbp - 0x18], r8w
mov dword [rbp - 0x2c], 0x170018
mov dword [rbp - 0x28], 0x70037
mov dword [rbp - 0x24], 0x15001d
mov dword [rbp - 0x20], 0x2000b
mov dword [rbp - 0x1c], 0x51005e
lea rdx, [0x1401c7b68]
lea r9, [0x1401c6d91]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rbp + r8*2 - 0x3e]
add r8, 5
xor ax, word [rbp + r8*2 - 0x4a]
mov word [rdx + r8*2 - 0xa], ax
movzx eax, byte [r8 + r9 - 5]
xor cx, ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rbp + r8*2 - 0x46]
mov word [rdx + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0x14
jl 0x140056400
mov byte [0x1401cdda1], 1
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x60
pop rbp
ret

Function at 0x140056490
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rbp - 8], rax
call fcn.140053d40
test al, al
jne 0x1400564b6
dec dword [0x1401cbd80]
cmp byte [0x1401cdd8f], 0
lea rax, [0x1401c7318]
jne 0x14005659e
mov dword [rbp - 0x40], GetCPInfo
mov dword [rbp - 0x3c], 0x90034
mov dword [rbp - 0x38], 0x1a0003
mov dword [rbp - 0x34], 0x120005
mov dword [rbp - 0x30], 0x30017
mov dword [rbp - 0x2c], 0x1b003a
mov dword [rbp - 0x28], 0x1b0011
mov dword [rbp - 0x24], 0x11001a
mov dword [rbp - 0x20], 0x2b0006
mov dword [rbp - 0x1c], 0x1c0001
mov dword [rbp - 0x18], 0x13001c
mov dword [rbp - 0x14], 0x560013
mov dword [rbp - 0x10], 0x51
xor r8d, r8d
lea r9, [0x1401c6d91]
nop
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 5
xor cx, word [rbp + r8*2 - 0x4a]
mov word [rax + r8*2 - 0xa], cx
movzx ecx, byte [r8 + r9 - 5]
xor dx, cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 8], dx
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x19
jl 0x140056530
mov byte [0x1401cdd8f], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x60
pop rbp
ret
Function at 0x140056750
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401cdd7b], 0
lea rax, [0x1401c76f0]
jne 0x14005684c
xor r8d, r8d
mov dword [rbp - 0x50], 0x20026
mov dword [rbp - 0x4c], 0xe001a
mov dword [rbp - 0x48], 0x5001a
mov dword [rbp - 0x44], 0x10036
mov dword [rbp - 0x40], 0x10000a
mov word [rbp - 0x18], r8w
mov dword [rbp - 0x3c], 0x1e0005
mov dword [rbp - 0x38], 0x80006
mov dword [rbp - 0x34], 0x26000a
mov dword [rbp - 0x30], 0xa000b
mov dword [rbp - 0x2c], 0x140011
mov dword [rbp - 0x28], 0x70053
mov dword [rbp - 0x24], 0x5000b
mov dword [rbp - 0x20], 0x3001d
mov dword [rbp - 0x1c], 0x470009
lea r9, [0x1401c6d91]
nop dword [rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x4e]
add r8, 4
xor cx, word [rbp + r8*2 - 0x58]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x54]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x52]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x1c
jl 0x1400567f0
mov byte [0x1401cdd7b], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x50
pop rbp
ret

Function at 0x140056860
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rsp + 0x40], rax
cmp byte [0x1401cdd89], 0
je 0x140056895
lea rax, [0x1401c7528]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x58
ret
mov ecx, dword [0x1401cbd80]
mov eax, 0x66666667
imul ecx, ecx
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 7
jne 0x1400568d3
call fcn.1400d2038
mov ecx, dword [0x1401cbd80]
cmp ecx, eax
jne 0x1400568d3
dec ecx
mov dword [0x1401cbd80], ecx
xor r8d, r8d
mov dword [rsp + 0x20], 0x29004c
mov dword [rsp + 0x24], 0x90019
mov dword [rsp + 0x28], 0x100039
mov dword [rsp + 0x2c], 0x14
mov dword [rsp + 0x30], 0x9000a
mov word [rsp + 0x38], r8w
mov dword [rsp + 0x34], 0x4f0002
lea rdx, [0x1401c7528]
lea r9, [0x1401c6d91]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 0x22]
add r8, 6
xor ax, word [rsp + r8*2 + 0x14]
mov word [rdx + r8*2 - 0xc], ax
movzx eax, byte [r8 + r9 - 6]
xor cx, ax
movzx eax, byte [r8 + r9 - 5]
xor ax, word [rsp + r8*2 + 0x18]
mov word [rdx + r8*2 - 0xa], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 + 0x1c]
mov word [rdx + r8*2 - 8], ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rsp + r8*2 + 0x1a]
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 + 0x1e]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 2], cx
cmp r8, 0xc
jl 0x140056920
mov byte [0x1401cdd89], 1
mov rax, rdx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x58
ret
Function at 0x1400569c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x1401cbd80]
xor ebx, ebx
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0xb21642c9
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 0xe
jne 0x140056a1a
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp byte [0x1401cddae], bl
lea rax, [0x1401c7548]
jne 0x140056a9e
mov dword [rsp + 0x30], 0x1b0004
mov dword [rsp + 0x34], 0x3a0005
mov dword [rsp + 0x38], 0x1001c
mov dword [rsp + 0x3c], 0x2c0002
mov dword [rsp + 0x40], 0x1e0006
mov dword [rsp + 0x44], 0x17000f
mov dword [rsp + 0x48], 0x1b0013
mov dword [rsp + 0x4c], 0x1f0006
mov dword [rsp + 0x50], 4
lea rdx, [0x1401c6d90]
nop dword [rax + rax]
movzx ecx, byte [rbx + rdx]
inc rbx
xor cx, word [rsp + rbx*2 + 0x2e]
mov word [rax + rbx*2 - 2], cx
cmp rbx, 0x11
jl 0x140056a80
mov byte [0x1401cddae], 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x60
pop rbx
ret
Function at 0x140056ac0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x2c0]
sub rsp, 0x3c0
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rbp + 0x2b8], rax
mov ebx, dword [0x1401cbd80]
mov eax, 0x2aaaaaab
xor r9d, r9d
lea ecx, [rbx + 1]
imul ecx, ebx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x16
jne 0x140056b35
mov r8d, r9d
lea r10, [rsp]
mov r11d, ebx
nop dword [rax]
inc r8d
dec r11d
lea r10, [r10 + 4]
movsxd rax, r8d
cmp rax, 0xdd
jb 0x140056b20
cmp byte [0x1401cddad], r9b
je 0x140056b4a
lea rax, [0x1401c7ab0]
jmp 0x140056ca6
mov ecx, ebx
mov eax, 0x92492493
imul ecx, ebx
imul ecx, ebx
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 3
jne 0x140056b75
inc dword [0x1401cd8ac]
mov dword [rbp + 0x280], 0x1b0004
mov dword [rbp + 0x284], 0x3a0005
mov dword [rbp + 0x288], 0x1b001a
mov dword [rbp + 0x28c], 0xb0003
mov dword [rbp + 0x290], 0x30013
mov dword [rbp + 0x294], 0x6000f
mov dword [rbp + 0x298], 0xb0006
mov dword [rbp + 0x29c], 0x150030
mov dword [rbp + 0x2a0], 0x50012
mov dword [rbp + 0x2a4], 0x10001
mov dword [rbp + 0x2a8], 0x80007
mov dword [rbp + 0x2ac], 0x20005
mov word [rbp + 0x2b0], r9w
lea rax, [0x1401c7ab0]
lea r8, [0x1401c6d91]
nop word [rax + rax]
movzx ecx, byte [r9 + r8 - 1]
movzx edx, word [rbp + r9*2 + 0x282]
add r9, 6
xor cx, word [rbp + r9*2 + 0x274]
mov word [rax + r9*2 - 0xc], cx
movzx ecx, byte [r9 + r8 - 6]
xor dx, cx
movzx ecx, byte [r9 + r8 - 5]
xor cx, word [rbp + r9*2 + 0x278]
mov word [rax + r9*2 - 0xa], dx
mov word [rax + r9*2 - 8], cx
movzx ecx, byte [r9 + r8 - 4]
xor cx, word [rbp + r9*2 + 0x27a]
mov word [rax + r9*2 - 6], cx
movzx ecx, byte [r9 + r8 - 3]
xor cx, word [rbp + r9*2 + 0x27c]
mov word [rax + r9*2 - 4], cx
movzx ecx, byte [r9 + r8 - 2]
xor cx, word [rbp + r9*2 + 0x27e]
mov word [rax + r9*2 - 2], cx
cmp r9, 0x18
jl 0x140056c10
mov byte [0x1401cddad], 1
mov rcx, qword [rbp + 0x2b8]
xor rcx, rsp
call fcn.1400d1680
mov rbx, qword [rsp + 0x3d0]
add rsp, 0x3c0
pop rbp
ret
Function at 0x140057020
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x9f50]
mov eax, 0xa050
call fcn.1400d6730
sub rsp, rax
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rbp + 0x9f40], rax
mov r8d, dword [0x1401cbd80]
mov eax, 0x66666667
xor ebx, ebx
lea r9d, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, r9d
imul ecx, r8d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0xd
jne 0x1400570b1
test r8d, r8d
je 0x1400570a4
dec r8d
je 0x140057099
mov r8d, r9d
mov dword [0x1401cbd80], r9d
jmp 0x1400570b1
mov r8d, ebx
mov dword [0x1401cbd80], ebx
jmp 0x1400570b1
mov r8d, 2
mov dword [0x1401cbd80], r8d
cmp byte [0x1401cdd8c], bl
je 0x1400570c5
lea rax, [0x1401c7ba0]
jmp 0x140057257
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
mov dword [rsp + 0x20], 0x1f000f
mov dword [rsp + 0x24], 0xa0007
mov dword [rsp + 0x28], 0x2a001d
mov dword [rsp + 0x2c], 0x1c0005
imul ecx, eax
imul ecx, r8d
mov eax, 0x2aaaaaab
mov dword [rsp + 0x30], 0xb000e
mov dword [rsp + 0x34], 0x1c0019
mov dword [rsp + 0x38], 0xc000a
mov dword [rsp + 0x3c], 0x4000e
mov dword [rsp + 0x40], 0x80003
imul ecx
sar edx, 2
mov dword [rsp + 0x44], 0x2e0003
mov dword [rsp + 0x48], 0xd0017
mov eax, edx
mov dword [rsp + 0x4c], 0x330006
mov dword [rsp + 0x50], 0x30003
shr eax, 0x1f
mov dword [rsp + 0x54], 0xe000a
mov dword [rsp + 0x58], 0x11001e
add edx, eax
mov dword [rsp + 0x5c], 0x80016
mov word [rsp + 0x60], bx
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x14
jne 0x1400571f1
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0x9fc0
mov word [rsp + 0x70], bx
call fcn.1400d6ac0
mov r10, rbx
mov r9, rbx
mov rax, rbx
test r10, r10
je 0x1400571c6
test rax, rax
je 0x1400571c6
lea rcx, [r9 + rax]
lea r8, [rsp + 0x70]
lea r8, [r8 + rcx*2]
lea rcx, [r9 + rax]
movzx edx, word [rbp + rcx*2 - 0x1ae]
inc dx
add dx, word [r8 - 2]
mov word [r8], dx
inc rax
cmp rax, 0x8f
jl 0x140057197
add r9, 0x8f
inc r10
cmp r9, 0x4fe1
jl 0x140057194
movsx eax, word [rbp + 0x9f30]
mov dword [0x1401cbd80], eax
lea rdx, [0x1401c7ba0]
lea r8, [0x1401c6d91]
nop
movzx eax, byte [rbx + r8 - 1]
movzx ecx, word [rsp + rbx*2 + 0x22]
add rbx, 4
xor ax, word [rsp + rbx*2 + 0x18]
mov word [rdx + rbx*2 - 8], ax
movzx eax, byte [rbx + r8 - 4]
xor cx, ax
mov word [rdx + rbx*2 - 6], cx
movzx ecx, byte [rbx + r8 - 3]
xor cx, word [rsp + rbx*2 + 0x1c]
mov word [rdx + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor cx, word [rsp + rbx*2 + 0x1e]
mov word [rdx + rbx*2 - 2], cx
cmp rbx, 0x20
jl 0x140057200
mov byte [0x1401cdd8c], 1
mov rax, rdx
mov rcx, qword [rbp + 0x9f40]
xor rcx, rsp
call fcn.1400d1680
mov rbx, qword [rsp + 0xa060]
add rsp, 0xa050
pop rbp
ret
Function at 0x140057280
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rsp + 0x20], rax
cmp byte [0x1401cdd80], 0
je 0x1400572b5
lea rax, [0x1401c72f8]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x38
ret
mov dword [rsp], 0x1f0029
mov dword [rsp + 4], 0x40010
mov dword [rsp + 8], 0x10001b
mov dword [rsp + 0xc], 0x1b0032
mov dword [rsp + 0x10], 0x30011
mov dword [rsp + 0x14], 0x16000d
mov dword [rsp + 0x18], 0x170026
mov dword [rsp + 0x1c], 0x55
xor r8d, r8d
lea rdx, [0x1401c72f8]
lea r9, [0x1401c6d91]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 2]
add r8, 5
xor ax, word [rsp + r8*2 - 0xa]
mov word [rdx + r8*2 - 0xa], ax
movzx eax, byte [r8 + r9 - 5]
xor cx, ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rsp + r8*2 - 6]
mov word [rdx + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0xf
jl 0x140057310
mov byte [0x1401cdd80], 1
mov rax, rdx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x38
ret
Function at 0x1400573a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r9d, dword [0x1401cbd80]
mov eax, 0x6bca1af3
mov ecx, r9d
imul ecx, r9d
imul ecx, r9d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 3
jne 0x1400573ec
inc dword [0x1401cd7dc]
cmp byte [0x1401cdd86], 0
mov qword [rsp + 0x150], rbx
je 0x140057409
lea rax, [0x1401c73b8]
jmp 0x1400575a6
lea eax, [r9 + 1]
lea ecx, [r9 + 2]
imul ecx, eax
mov eax, 0x38e38e39
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xf
jne 0x140057481
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r9d, edx
add r9d, 0x141
movsxd rcx, r9d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400d0cc8
mov rcx, rax
call fcn.1400d272c
mov r9d, dword [0x1401cbd80]
xor r8d, r8d
mov dword [rsp + 0x120], 3
mov dword [rsp + 0x124], 0x20014
mov dword [rsp + 0x128], 0x55000a
mov dword [rsp + 0x12c], 0x10016
mov dword [rsp + 0x130], 0x5000c
mov edx, r8d
mov dword [rsp + 0x134], 0x1c004c
mov dword [rsp + 0x138], 0x20002
mov dword [rsp + 0x13c], 0xa
lea rbx, [0x1401c73b8]
lea r10, [0x1401c6d91]
nop dword [rax]
movzx eax, byte [rdx + r10 - 1]
movzx ecx, word [rsp + rdx*2 + 0x122]
add rdx, 5
xor ax, word [rsp + rdx*2 + 0x116]
mov word [rbx + rdx*2 - 0xa], ax
movzx eax, byte [rdx + r10 - 5]
xor cx, ax
movzx eax, byte [rdx + r10 - 4]
xor ax, word [rsp + rdx*2 + 0x11a]
mov word [rbx + rdx*2 - 8], cx
mov word [rbx + rdx*2 - 6], ax
movzx eax, byte [rdx + r10 - 3]
xor ax, word [rsp + rdx*2 + 0x11c]
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r10 - 2]
xor ax, word [rsp + rdx*2 + 0x11e]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0xf
jl 0x1400574f0
lea ecx, [r9 + 1]
mov eax, 0x66666667
mov byte [0x1401cdd86], 1
imul ecx, r9d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
cmp ecx, 4
jne 0x1400575a3
lea r10, [rsp + 0x20]
mov r11d, r9d
nop dword [rax]
inc r8d
dec r11d
lea r10, [r10 + 4]
movsxd rcx, r8d
cmp rcx, 0x3d
jb 0x140057590
mov rax, rbx
mov rbx, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x158
ret
Function at 0x1400578b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401cdd7a], 0
je 0x1400578e9
lea rax, [0x1401c7770]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 0x70], rbx
xor ebx, ebx
mov dword [rbp - 0x40], 0xc0009
mov dword [rbp - 0x3c], 0x11001b
mov dword [rbp - 0x38], 0x14004f
mov dword [rbp - 0x34], 0x1f000a
mov word [rbp - 0x10], bx
mov dword [rbp - 0x30], 0x5000c
mov dword [rbp - 0x2c], 0x13004c
mov dword [rbp - 0x28], 0xc0000
mov dword [rbp - 0x24], 0x3000a
mov dword [rbp - 0x20], 0x460019
mov dword [rbp - 0x1c], 0x140000
mov dword [rbp - 0x18], 0x8001d
mov dword [rbp - 0x14], 0x8000f
call fcn.140053e60
test al, al
jne 0x140057962
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, eax
mov dword [0x1401cbd80], eax
jmp 0x140057969
mov r9d, dword [0x1401cbd80]
lea rcx, [0x1401c7770]
lea r8, [0x1401c6d91]
nop word [rax + rax]
movzx eax, byte [rbx + r8 - 1]
movzx edx, word [rbp + rbx*2 - 0x3e]
add rbx, 6
xor ax, word [rbp + rbx*2 - 0x4c]
mov word [rcx + rbx*2 - 0xc], ax
movzx eax, byte [rbx + r8 - 6]
xor dx, ax
movzx eax, byte [rbx + r8 - 5]
xor ax, word [rbp + rbx*2 - 0x48]
mov word [rcx + rbx*2 - 0xa], dx
mov word [rcx + rbx*2 - 8], ax
movzx eax, byte [rbx + r8 - 4]
xor ax, word [rbp + rbx*2 - 0x46]
mov word [rcx + rbx*2 - 6], ax
movzx eax, byte [rbx + r8 - 3]
xor ax, word [rbp + rbx*2 - 0x44]
mov word [rcx + rbx*2 - 4], ax
movzx eax, byte [rbx + r8 - 2]
xor ax, word [rbp + rbx*2 - 0x42]
mov word [rcx + rbx*2 - 2], ax
cmp rbx, 0x18
jl 0x140057980
mov rbx, qword [rsp + 0x70]
mov r8d, r9d
mov eax, 0x92492493
mov byte [0x1401cdd7a], 1
imul r8d, r9d
imul r8d, r9d
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub r8d, edx
cmp r8d, 2
jne 0x140057a2f
dec r9d
mov dword [0x1401cbd80], r9d
mov rax, rcx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x60
pop rbp
ret
Function at 0x140057a50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
call fcn.140053de0
test al, al
jne 0x140057a83
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401cbd80]
mov edx, 7
test rax, rax
cmove ecx, edx
mov dword [0x1401cbd80], ecx
jmp 0x140057a89
mov ecx, dword [0x1401cbd80]
cmp byte [0x1401cdd87], 0
jne 0x140057c1b
movzx eax, byte [0x1401c6d90]
lea r8d, [rcx + 1]
xor al, 0x4c
movzx eax, al
mov word [0x1401c7590], ax
movzx eax, byte [0x1401c6d91]
imul r8d, ecx
xor al, 8
movzx eax, al
mov word [reloc.OLEAUT32.dll_VariantClear], ax
movzx eax, byte [0x1401c6d92]
xor al, 0xd
movzx eax, al
mov word [0x1401c7594], ax
movzx eax, byte [0x1401c6d93]
mov word [0x1401c7596], ax
movzx eax, byte [0x1401c6d94]
xor al, 0xc
movzx eax, al
mov word [0x1401c7598], ax
movzx eax, byte [0x1401c6d95]
xor al, 0x21
movzx eax, al
mov word [0x1401c759a], ax
movzx eax, byte [0x1401c6d96]
xor al, 0xf
movzx eax, al
mov word [0x1401c759c], ax
movzx eax, byte [0x1401c6d97]
xor al, 0x1e
movzx eax, al
mov word [0x1401c759e], ax
movzx eax, byte [0x1401c6d98]
xor al, 6
movzx eax, al
mov word [reloc.OLEAUT32.dll_SysStringLen], ax
movzx eax, byte [0x1401c6d99]
xor al, 0x5b
movzx eax, al
mov word [0x1401c75a2], ax
mov eax, 0x30c30c31
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 0x12
jne 0x140057c14
xor r8d, r8d
nop dword [rax]
mov edx, r8d
mov eax, r8d
inc r8d
sar eax, 1
and edx, 1
dec edx
not edx
and edx, ecx
xor edx, eax
mov eax, edx
sar edx, 1
and eax, 1
dec eax
not eax
and eax, ecx
xor eax, edx
mov edx, eax
sar eax, 1
and edx, 1
dec edx
not edx
and edx, ecx
xor edx, eax
mov eax, edx
sar edx, 1
and eax, 1
dec eax
not eax
and eax, ecx
xor eax, edx
mov edx, eax
sar eax, 1
and edx, 1
dec edx
not edx
and edx, ecx
xor edx, eax
mov eax, edx
sar edx, 1
and eax, 1
dec eax
not eax
and eax, ecx
xor eax, edx
mov edx, eax
sar eax, 1
and edx, 1
dec edx
not edx
and edx, ecx
xor edx, eax
mov eax, edx
sar edx, 1
and eax, 1
dec eax
not eax
and eax, ecx
xor eax, edx
add ecx, eax
cmp r8d, 0x100
jl 0x140057b80
mov dword [0x1401cbd80], ecx
mov byte [0x1401cdd87], 1
lea rax, [0x1401c7590]
add rsp, 0x28
ret
Function at 0x140057c30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r9d, dword [0x1401cbd80]
lea eax, [r9 + 1]
lea r8d, [r9 + 2]
imul r8d, eax
mov eax, 0x38e38e39
imul r8d, r9d
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*8]
sub r8d, ecx
xor ecx, ecx
cmp r8d, 8
jne 0x140057ca1
mov r8d, ecx
test r9d, r9d
je 0x140057c97
mov edx, r9d
mov eax, r9d
and edx, 1
add r8d, edx
cdq
sub eax, edx
sar eax, 1
mov r9d, eax
jne 0x140057c81
mov r9d, r8d
mov dword [0x1401cbd80], r8d
cmp byte [0x1401cdd90], cl
mov qword [rsp + 0x50], rbx
je 0x140057cba
lea rax, [0x1401c77d0]
jmp 0x140057d7e
mov dword [rsp + 0x20], 0x1b0004
mov dword [rsp + 0x24], 0x3a0005
mov dword [rsp + 0x28], 0x50006
mov dword [rsp + 0x2c], 0x2c0005
mov dword [rsp + 0x30], 0x1e0006
mov dword [rsp + 0x34], 0x17000f
mov dword [rsp + 0x38], 0x1b0013
mov dword [rsp + 0x3c], 0x1f0006
mov dword [rsp + 0x40], 4
lea rbx, [0x1401c77d0]
lea rdx, [0x1401c6d90]
movzx eax, byte [rcx + rdx]
inc rcx
xor ax, word [rsp + rcx*2 + 0x1e]
mov word [rbx + rcx*2 - 2], ax
cmp rcx, 0x11
jl 0x140057d10
lea eax, [r9 + 1]
lea ecx, [r9 + 2]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx, r9d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub ecx, edx
cmp ecx, 7
jne 0x140057d74
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401cbd80]
mov edx, 7
test rax, rax
cmove ecx, edx
mov dword [0x1401cbd80], ecx
mov byte [0x1401cdd90], 1
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x58
ret

Function at 0x140057f80
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401cdd9d], 0
lea rax, [0x1401c7650]
jne 0x14005807c
xor r8d, r8d
mov dword [rbp - 0x50], 0x1b0004
mov dword [rbp - 0x4c], 0x3a0005
mov dword [rbp - 0x48], 0x1c0009
mov dword [rbp - 0x44], 0x14
mov dword [rbp - 0x40], 0x390017
mov word [rbp - 0x18], r8w
mov dword [rbp - 0x3c], 0x1c0005
mov dword [rbp - 0x38], 0xa0009
mov dword [rbp - 0x34], 0x4000c
mov dword [rbp - 0x30], 0x90003
mov dword [rbp - 0x2c], 0x2e000a
mov dword [rbp - 0x28], 0x40017
mov dword [rbp - 0x24], 0x9001e
mov dword [rbp - 0x20], 0x120012
mov dword [rbp - 0x1c], 0x30008
lea r9, [0x1401c6d91]
nop dword [rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x4e]
add r8, 4
xor cx, word [rbp + r8*2 - 0x58]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x54]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x52]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x1c
jl 0x140058020
mov byte [0x1401cdd9d], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x50
pop rbp
ret