joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140046380
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
push r14
push r15
sub rsp, 0x60
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
mov r10, r9
mov rax, r8
mov rdi, rdx
mov r14, rcx
xor r15d, r15d
mov ebx, r15d
mov qword [r11 - 0x38], rbx
mov dword [r11 - 0x30], r15d
mov qword [r11 - 0x28], r15
mov qword [r11 + 0x18], r15
lea rcx, [r11 + 0x18]
mov qword [r11 - 0x58], rcx
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004652b
mov dword [rsp + 0x48], r15d
mov rbx, qword [rsp + 0x90]
mov qword [rsp + 0x40], rbx
mov rax, qword [r14]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, 0x800
or eax, ecx
jge 0x14004641d
mov edx, 0x800
mov rcx, r14
call fcn.1400024c0
mov rsi, qword [r14]
cmp dword [rsi - 0xc], 0x800
jge 0x140046434
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rsi - 0x10], 0x800
mov rax, qword [r14]
mov word [rax + 0x1000], r15w
mov dword [rsp + 0x90], 0x1000
mov ebp, r15d
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400464c5
mov eax, dword [rsp + 0x30]
dec eax
cmp eax, 1
jbe 0x140046492
mov edi, 0xd
jmp 0x1400464c5
mov ecx, dword [rsp + 0x90]
test rsi, rsi
je 0x1400464be
test ecx, ecx
je 0x1400464ba
test cl, 1
jne 0x1400464b3
mov eax, ecx
shr rax, 1
cmp word [rsi + rax*2 - 2], bp
je 0x1400464be
mov edi, 0xd
jmp 0x1400464c5
mov word [rsi], r15w
mov ebp, ecx
shr ebp, 1
mov edi, r15d
lea eax, [rbp - 1]
cmp eax, 0xffffffff
jne 0x1400464e3
mov rcx, qword [r14]
test rcx, rcx
jne 0x1400464da
mov eax, r15d
jmp 0x1400464e7
movsxd rdx, dword [rcx - 0xc]
call fcn.1400c8708
test eax, eax
js 0x140046520
mov rcx, qword [r14]
cmp eax, dword [rcx - 0xc]
jg 0x140046520
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [r14]
mov word [rax + rcx*2], r15w
test rbx, rbx
je 0x140046513
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r15
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], r15d
test edi, edi
sete dil
jmp 0x14004652e
mov ecx, 0x80070057
call fcn.140001920
int3
xor dil, dil
test rbx, rbx
je 0x140046541
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], r15d
movzx eax, dil
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140046570
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [r11 - 0x30], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
mov r10, r9
mov rax, r8
mov rdi, rdx
mov rsi, rcx
xor ebp, ebp
mov ebx, ebp
mov qword [r11 - 0x28], rbx
mov dword [rsp + 0x48], ebp
mov qword [r11 - 0x18], rbp
mov qword [r11 + 0x18], rbp
lea rcx, [r11 + 0x18]
mov qword [r11 - 0x48], rcx
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140046646
mov dword [rsp + 0x48], ebp
mov rbx, qword [rsp + 0x80]
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x80], 4
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140046624
mov edi, ebp
mov eax, 0xd
cmp dword [rsp + 0x30], 4
cmovne edi, eax
test rbx, rbx
je 0x14004663a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rbp
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], ebp
test edi, edi
sete dil
jmp 0x140046698
mov eax, dword [0x1401b4d80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
sub ecx, edx
cmp ecx, 3
jne 0x140046695
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov edx, dword [0x1401b4d80]
mov ecx, 7
test rax, rax
cmove edx, ecx
mov dword [0x1401b4d80], edx
xor dil, dil
test rbx, rbx
je 0x1400466ab
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
movzx eax, dil
mov dword [rsp + 0x48], ebp
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
Function at 0x1400466d0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov r10d, dword [0x1401b4d80]
mov rsi, rdx
mov eax, 0x66666667
mov r11d, r10d
mov rbx, r9
mov rdi, r8
mov r14, rcx
imul r11d, r10d
imul r11d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub r11d, eax
cmp r11d, 8
jne 0x140046796
test r10d, r10d
je 0x140046796
mov eax, r10d
and eax, 0x80000001
jge 0x140046735
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x14004674c
mov eax, r10d
cdq
sub eax, edx
sar eax, 1
mov r10d, eax
mov dword [0x1401b4d80], eax
jmp 0x14004675b
lea r10d, [r10*2 + 1]
mov dword [0x1401b4d80], r10d
mov eax, 0x55555556
mov ecx, r10d
imul r10d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub ecx, eax
je 0x14004677f
sub ecx, 2
je 0x140046783
dec ecx
je 0x140046786
jmp 0x140046791
add r10d, 2
inc r10d
add r10d, 2
mov dword [0x1401b4d80], r10d
test r10d, r10d
jne 0x140046724
mov rdx, qword [rdi]
lea rax, [rsp + 0x50]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400467bd
xor al, al
jmp 0x1400467fe
mov rcx, qword [rsi]
mov rdx, qword [r14]
mov r9d, 1
mov eax, dword [rcx - 0x10]
xor r8d, r8d
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test ebx, ebx
sete al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140048e60
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rbx, rcx
xor ecx, ecx
mov dword [rsp + 0x30], ecx
mov edx, dword [0x1401b4d80]
lea r8d, [rdx + 2]
lea eax, [rdx + 1]
imul r8d, eax
imul r8d, edx
mov eax, 0x66666667
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 8
jne 0x140048ec5
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x58]
call fcn.140047cb0
nop
mov r8d, 1
mov rdx, rax
mov rcx, rbx
call fcn.14004b240
mov dword [rsp + 0x30], 1
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x14004b350
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x30], edi
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx esi, al
movzx edx, ax
shr dx, 8
movzx ebp, dl
cmp eax, 0x80000000
jae 0x14004b392
mov edi, eax
shr edi, 0x10
cmp esi, 6
jb 0x14004b3af
cmp ebp, 2
jb 0x14004b3af
mov rcx, rbx
call fcn.14004b690
nop
mov dword [rsp + 0x30], 1
jmp 0x14004b416
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x20], edi
mov r9d, ebp
mov r8d, esi
lea rdx, str._d._d___d_
lea rcx, [rsp + 0x68]
call fcn.140011990
mov rdi, qword [rsp + 0x68]
lea rcx, [rdi - 0x18]
call fcn.140002520
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x30], 1
lock add dword [rdi - 8], 0xffffffff
jg 0x14004b416
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004c980
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, dword [0x1401b4d80]
mov eax, 0x2e8ba2e9
imul ecx, ecx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 8
jne 0x14004c9df
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401b4d80]
mov edx, 7
test rax, rax
cmove ecx, edx
mov dword [0x1401b4d80], ecx
cmp byte [0x1401b5fc8], 0
lea rax, [0x1401b0b10]
jne 0x14004ca6f
mov dword [rbp - 0x40], 0xa000d
mov dword [rbp - 0x3c], 0x5000d
mov dword [rbp - 0x38], 0xd0006
mov dword [rbp - 0x34], 0x130034
mov dword [rbp - 0x30], 0x34001c
mov dword [rbp - 0x2c], 0x19000e
mov dword [rbp - 0x28], 0x14000b
mov dword [rbp - 0x24], 0xe001f
mov dword [rbp - 0x20], 0x130031
mov dword [rbp - 0x1c], 0x4001c
mov dword [rbp - 0x18], 0x90014
mov dword [rbp - 0x14], 0x11
xor ecx, ecx
lea r8, [0x1401afda0]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rbp + rcx*2 - 0x42]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x17
jl 0x14004ca50
mov byte [0x1401b5fc8], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x60
pop rbp
ret

Function at 0x14004cb10
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401b5fa6], 0
je 0x14004cb49
lea rax, [0x1401b0618]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x60
pop rbp
ret
mov eax, dword [0x1401b4d80]
mov qword [rsp + 0x70], rbx
xor ebx, ebx
lea ecx, [rax + 1]
mov qword [rsp + 0x78], rdi
mov edi, 7
mov dword [rbp - 0x40], 0x1d0005
mov dword [rbp - 0x3c], 0x360014
mov dword [rbp - 0x38], 0x70016
imul ecx, eax
mov eax, 0x2aaaaaab
mov dword [rbp - 0x34], 0x1f000e
mov dword [rbp - 0x30], 0xe0003
mov dword [rbp - 0x2c], 0x1f000e
mov dword [rbp - 0x28], 0x11000b
mov dword [rbp - 0x24], 0x190034
imul ecx
mov eax, edx
mov dword [rbp - 0x20], 0x9000b
mov dword [rbp - 0x1c], 0x1e001a
shr eax, 0x1f
mov dword [rbp - 0x18], 0x390015
mov dword [rbp - 0x14], 0x15000e
add edx, eax
mov dword [rbp - 0x10], edi
mov word [rbp - 0xc], bx
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
cmp ecx, 3
jne 0x14004cbfa
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401b4d80]
test rax, rax
cmove ecx, edi
mov dword [0x1401b4d80], ecx
mov rdi, qword [rsp + 0x78]
lea rax, [0x1401b0618]
lea r8, [0x1401afda1]
nop dword [rax]
movzx ecx, byte [rbx + r8 - 1]
movzx edx, word [rbp + rbx*2 - 0x3e]
add rbx, 2
xor cx, word [rbp + rbx*2 - 0x44]
mov word [rax + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor dx, cx
mov word [rax + rbx*2 - 2], dx
cmp rbx, 0x1a
jl 0x14004cc10
mov byte [0x1401b5fa6], 1
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x60
pop rbp
ret
Function at 0x14004cc60
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], r14
push rbp
lea rbp, [r11 - 0x358]
sub rsp, 0x450
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rbp + 0x348], rax
mov ecx, dword [0x1401b4d80]
mov eax, 0x66666667
xor r14d, r14d
lea r8d, [rcx + 1]
imul r8d, ecx
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 4
jne 0x14004cd3c
mov qword [r11 + 8], rsi
mov qword [r11 + 0x10], rdi
lea rdi, [rsp + 0x30]
mov esi, r14d
nop dword [rax]
mov r9d, r14d
nop word [rax + rax]
mov eax, ecx
lea r8d, [rsi + 1]
lea ebx, [r9 + 1]
cdq
idiv r8d
mov eax, ecx
sub eax, esi
mov r8d, edx
imul r8d, eax
mov eax, ecx
lea rcx, [0x140140c00]
cdq
idiv ebx
add r8d, eax
sub r8d, r9d
mov edx, r8d
call fcn.1400c8aec
mov ecx, dword [0x1401b4d80]
add rdi, 4
mov r9d, ebx
cmp ebx, 0x12
jl 0x14004cce0
inc esi
cmp esi, 0xe
jl 0x14004ccd0
mov rdi, qword [rsp + 0x468]
mov rsi, qword [rsp + 0x460]
cmp byte [0x1401b5fb3], r14b
je 0x14004cd51
lea rax, [0x1401b0708]
jmp 0x14004cefb
lea r8d, [rcx + 1]
mov eax, 0x38e38e39
or rbx, 0xffffffffffffffff
imul r8d, ecx
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub r8d, eax
cmp r8d, 5
jne 0x14004cdb8
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub ecx, edx
add ecx, 0x7b
movsxd rdx, ecx
mul rdx
cmovo rax, rbx
mov rcx, rax
call fcn.1400c7228
mov rcx, rax
call fcn.1400c8c8c
mov ecx, dword [0x1401b4d80]
lea r8d, [rcx + 1]
mov eax, 0x2aaaaaab
mov dword [rbp + 0x320], 0x30008
mov dword [rbp + 0x324], 0x110021
mov dword [rbp + 0x328], 0x1d000a
mov dword [rbp + 0x32c], 0x80028
imul r8d, ecx
imul r8d
mov eax, edx
mov dword [rbp + 0x330], 0xe0017
mov dword [rbp + 0x334], 0x8004b
shr eax, 0x1f
mov dword [rbp + 0x338], 0x110001
mov dword [rbp + 0x33c], 0x56000e
add edx, eax
mov word [rbp + 0x340], r14w
lea eax, [rdx + rdx*2]
add eax, eax
sub r8d, eax
cmp r8d, 3
jne 0x14004ce78
mov rax, qword [str.Mc3TcJ7BVIE]
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov eax, dword [0x1401437d0]
mov dword [rsp + 0x28], eax
inc rcx
cmp byte [rdx + rcx], r14b
jne 0x14004ce53
mov eax, 4
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.1400c7228
mov rcx, rax
call fcn.1400c8c8c
lea rdx, [0x1401b0708]
lea r8, [0x1401afda1]
nop word [rax + rax]
movzx eax, byte [r14 + r8 - 1]
movzx ecx, word [rbp + r14*2 + 0x322]
add r14, 4
xor ax, word [rbp + r14*2 + 0x318]
mov word [rdx + r14*2 - 8], ax
movzx eax, byte [r14 + r8 - 4]
xor cx, ax
mov word [rdx + r14*2 - 6], cx
movzx ecx, byte [r14 + r8 - 3]
xor cx, word [rbp + r14*2 + 0x31c]
mov word [rdx + r14*2 - 4], cx
movzx ecx, byte [r14 + r8 - 2]
xor cx, word [rbp + r14*2 + 0x31e]
mov word [rdx + r14*2 - 2], cx
cmp r14, 0x10
jl 0x14004ce90
mov byte [0x1401b5fb3], 1
mov rax, rdx
mov rcx, qword [rbp + 0x348]
xor rcx, rsp
call fcn.1400c7be0
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14004d2d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401b5f9c], 0
je 0x14004d309
lea rax, [0x1401b0540]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x50
pop rbp
ret
xor r10d, r10d
mov qword [rsp + 0x60], rbx
mov dword [rbp - 0x50], 0xf002a
mov dword [rbp - 0x4c], 0x1c000e
mov dword [rbp - 0x48], 0x1d0010
mov dword [rbp - 0x44], 0x8003f
mov eax, r10d
mov dword [rbp - 0x40], 0xe0018
mov dword [rbp - 0x3c], 0x3b0003
mov dword [rbp - 0x38], 0x1c001c
mov dword [rbp - 0x34], 0x2001d
mov ebx, 2
mov dword [rbp - 0x30], 0x10002
mov dword [rbp - 0x2c], 0xf0012
mov dword [rbp - 0x28], 0x460003
mov dword [rbp - 0x24], 0x150000
mov dword [rbp - 0x20], 0x180002
mov dword [rbp - 0x1c], 0x10000d
mov dword [rbp - 0x18], 0x48
lea r9, [0x1401b0540]
lea rdx, [0x1401afda0]
movzx ecx, byte [rax + rdx]
inc rax
xor cx, word [rbp + rax*2 - 0x52]
mov word [r9 + rax*2 - 2], cx
cmp rax, 0x1d
jl 0x14004d390
mov r8d, dword [0x1401b4d80]
mov eax, 0x2e8ba2e9
mov ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0xa
jne 0x14004d3f8
mov ecx, r8d
test r8d, r8d
je 0x14004d3f2
dec ecx
je 0x14004d3e9
inc r8d
mov dword [0x1401b4d80], r8d
jmp 0x14004d3f8
mov dword [0x1401b4d80], r10d
jmp 0x14004d3f8
mov dword [0x1401b4d80], ebx
mov rbx, qword [rsp + 0x60]
mov byte [0x1401b5f9c], 1
mov rax, r9
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x50
pop rbp
ret
Function at 0x14004d420
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401b5faa], 0
je 0x14004d459
lea rax, str._n_a_bI_
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x40
pop rbp
ret
xor r8d, r8d
mov dword [rbp - 0x40], 0x7000a
mov dword [rbp - 0x3c], 0x490008
mov dword [rbp - 0x38], 0x250027
mov dword [rbp - 0x34], 0x140027
mov dword [rbp - 0x30], 0xf0053
mov word [rbp - 0x14], r8w
mov edx, r8d
mov dword [rbp - 0x2c], 0xe0002
mov dword [rbp - 0x28], 0x1b001d
mov dword [rbp - 0x24], 0x4b001f
mov dword [rbp - 0x20], 0x1c000b
mov dword [rbp - 0x1c], 0x19001c
mov dword [rbp - 0x18], 0x480004
lea r9, str._n_a_bI_
lea r10, [0x1401afda1]
nop
movzx eax, byte [rdx + r10 - 1]
movzx ecx, word [rbp + rdx*2 - 0x3e]
add rdx, 2
xor ax, word [rbp + rdx*2 - 0x44]
mov word [r9 + rdx*2 - 4], ax
movzx eax, byte [rdx + r10 - 2]
xor cx, ax
mov word [r9 + rdx*2 - 2], cx
cmp rdx, 0x16
jl 0x14004d4c0
mov eax, dword [0x1401b4d80]
mov byte [0x1401b5faa], 1
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 0xa
jne 0x14004d584
xor eax, eax
lea rcx, [rbp - 0x40]
mov word [rbp - 0x40], r8w
sub rcx, 4
mov qword [rbp - 0x3e], rax
mov qword [rbp - 0x36], rax
mov qword [rbp - 0x2e], rax
mov dword [rbp - 0x26], eax
mov word [rbp - 0x22], ax
test r8, r8
je 0x14004d56d
movzx eax, word [rcx + 4]
movzx edx, word [rcx + 2]
inc ax
inc dx
add ax, word [rcx - 2]
mov word [rcx + 6], ax
inc ax
add ax, word [rcx]
add dx, ax
mov word [rcx + 8], ax
mov word [rcx + 0xa], dx
inc r8
add rcx, 8
cmp r8, 4
jl 0x14004d541
movsx ecx, word [rbp - 0x22]
mov dword [0x1401b4d80], ecx
mov rax, r9
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x40
pop rbp
ret
Function at 0x14004d760
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r8d, dword [0x1401b4d80]
mov ebx, 4
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x66666667
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
cmp ecx, 2
jne 0x14004d7f2
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ebx
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x7b
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400c7228
mov rcx, rax
call fcn.1400c8c8c
cmp byte [0x1401b5f93], 0
lea rax, [0x1401b0370]
jne 0x14004d89f
mov dword [rbp - 0x50], 0xe002c
mov dword [rbp - 0x4c], 0x390010
mov dword [rbp - 0x48], 0x60011
mov dword [rbp - 0x44], 0x260008
mov dword [rbp - 0x40], 0xf0017
mov dword [rbp - 0x3c], 0xe001f
mov dword [rbp - 0x38], 0x6001d
mov dword [rbp - 0x34], 0x4004b
mov dword [rbp - 0x30], 0x440008
mov dword [rbp - 0x2c], 0x50039
mov dword [rbp - 0x28], 0x20011
mov dword [rbp - 0x24], 0x1d002a
mov dword [rbp - 0x20], 0x60009
mov dword [rbp - 0x1c], 0x60009
mov dword [rbp - 0x18], 0x500011
mov dword [rbp - 0x14], 0x48
xor ecx, ecx
lea r8, [0x1401afda0]
nop
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rbp + rcx*2 - 0x52]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x1f
jl 0x14004d880
mov byte [0x1401b5f93], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c7be0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x14004d8c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp byte [0x1401b5fad], 0
je 0x14004d8f8
lea rax, [0x1401b0bc0]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x50
pop rbx
ret
mov r9d, dword [0x1401b4d80]
mov eax, 0xb21642c9
mov dword [rsp + 0x30], 0x50046
lea r8d, [r9 + 1]
lea ecx, [r9 + 2]
mov dword [rsp + 0x34], 0x1f000b
mov dword [rsp + 0x38], 0x5f0002
mov dword [rsp + 0x3c], 0x49005f
mov dword [rsp + 0x40], 0x70017
imul ecx, r8d
imul ecx, r9d
imul ecx
add edx, ecx
mov dword [rsp + 0x44], 1
lea rbx, [0x1401b0bc0]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
lea rdx, [0x1401afda0]
cmp ecx, 0xf
cmove r9d, r8d
xor r10d, r10d
mov eax, r10d
mov dword [0x1401b4d80], r9d
nop dword [rax]
movzx ecx, byte [rax + rdx]
inc rax
xor cx, word [rsp + rax*2 + 0x2e]
mov word [rbx + rax*2 - 2], cx
cmp rax, 0xb
jl 0x14004d980
lea r8d, [r9 + 1]
mov eax, 0x66666667
mov byte [0x1401b5fad], 1
imul r8d, r9d
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*4]
shl ecx, 2
sub r8d, ecx
cmp r8d, 4
jne 0x14004d9dc
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x50
pop rbx
ret
Function at 0x14004da00
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, dword [0x1401b4d80]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x88888889
imul r8d, ecx
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub r8d, edx
cmp r8d, 3
jne 0x14004da53
dec dword [0x1401b5ad0]
cmp byte [0x1401b5fb2], 0
lea rax, [0x1401b0480]
jne 0x14004db4c
xor r8d, r8d
mov dword [rbp - 0x60], 0x7000a
mov dword [rbp - 0x5c], 0x60008
mov dword [rbp - 0x58], 0x490000
mov dword [rbp - 0x54], 0x6000d
mov dword [rbp - 0x50], 0x7001a
mov word [rbp - 0x20], r8w
mov dword [rbp - 0x4c], 0xf0008
mov dword [rbp - 0x48], 0x5004e
mov dword [rbp - 0x44], 0x40019
mov dword [rbp - 0x40], 0x44000d
mov dword [rbp - 0x3c], 0x19001c
mov dword [rbp - 0x38], 0x120050
mov dword [rbp - 0x34], 0x60003
mov dword [rbp - 0x30], 0x1d0006
mov dword [rbp - 0x2c], 0x150006
mov dword [rbp - 0x28], 0x3001c
mov dword [rbp - 0x24], 0xd0006
lea r9, [0x1401afda1]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x5e]
add r8, 4
xor cx, word [rbp + r8*2 - 0x68]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x64]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x62]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x20
jl 0x14004daf0
mov byte [0x1401b5fb2], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x60
pop rbp
ret