joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140051910
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov eax, dword [0x1401c3d80]
mov r9d, 1
lea ecx, [rax + 1]
lea r10d, [r9 + 0x36]
imul ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 3
jne 0x140051976
mov r8d, r9d
mov eax, r9d
mov edx, r10d
dec edx
lea ecx, [rax + r8]
lea r8d, [rax]
mov eax, ecx
jns 0x140051963
mov dword [0x1401c3d80], ecx
cmp byte [0x1401c5967], 0
lea rax, [0x1401bfaf0]
jne 0x140051a02
mov dword [rbp - 0x40], 0x30001
mov dword [rbp - 0x3c], 0xf0002
mov dword [rbp - 0x38], 0x100015
mov dword [rbp - 0x34], 0x190039
mov dword [rbp - 0x30], 0x370006
mov dword [rbp - 0x2c], 0x1b000c
mov dword [rbp - 0x28], 0x110011
mov dword [rbp - 0x24], 0x20001
mov dword [rbp - 0x20], 0x12002f
mov dword [rbp - 0x1c], 0x90007
mov dword [rbp - 0x18], 0x5000e
mov dword [rbp - 0x14], 0x15
xor ecx, ecx
lea r8, [0x1401bed90]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rbp + rcx*2 - 0x42]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x17
jl 0x1400519e3
mov byte [0x1401c5967], r9b
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x40
pop rbp
ret
Function at 0x140051aa0
Capabilities:
Encode data using xor
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r8d, dword [0x1401c3d80]
xor ebx, ebx
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x66666667
imul ecx, r8d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
cmp ecx, 3
jne 0x140051b0c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov r8d, dword [0x1401c3d80]
cmp byte [0x1401c5969], bl
je 0x140051b20
lea rax, [0x1401bf958]
jmp 0x140051c44
mov ecx, r8d
mov eax, 0x66666667
imul ecx, r8d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
cmp ecx, 3
jne 0x140051ba2
movsd xmm3, qword [0x140153278]
movsd xmm5, qword [0x1401532a0]
movd xmm4, r8d
xorps xmm2, xmm2
movaps xmmword [rsp + 0x70], xmm6
movsd xmm6, qword [0x140153270]
cvtdq2pd xmm4, xmm4
nop word [rax + rax]
addsd xmm2, xmm3
movaps xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x140051b89
subsd xmm2, xmm3
divsd xmm3, xmm5
movaps xmm1, xmm2
movaps xmm0, xmm4
mulsd xmm1, xmm2
subsd xmm0, xmm1
comisd xmm0, xmm6
ja 0x140051b70
movaps xmm6, xmmword [rsp + 0x70]
mov dword [rbp - 0x50], 0x140009
mov dword [rbp - 0x4c], 0x3c001b
mov dword [rbp - 0x48], 0x1a0005
mov dword [rbp - 0x44], 0x150003
mov dword [rbp - 0x40], 0xd0019
mov dword [rbp - 0x3c], 0x1d000c
mov dword [rbp - 0x38], 0x140011
mov dword [rbp - 0x34], 0x15002a
mov dword [rbp - 0x30], 0x80015
mov dword [rbp - 0x2c], 0x130001
mov dword [rbp - 0x28], 0x35000f
mov dword [rbp - 0x24], 0xd000a
mov dword [rbp - 0x20], 0x1c0003
mov word [rbp - 0x1c], bx
lea rax, [0x1401bf958]
lea r8, [0x1401bed91]
nop
movzx ecx, byte [rbx + r8 - 1]
movzx edx, word [rbp + rbx*2 - 0x4e]
add rbx, 2
xor cx, word [rbp + rbx*2 - 0x54]
mov word [rax + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor dx, cx
mov word [rax + rbx*2 - 2], dx
cmp rbx, 0x1a
jl 0x140051c10
mov byte [0x1401c5969], 1
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.1400cdac0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x140051c70
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp byte [0x1401c5968], 0
je 0x140051ca8
lea rax, [0x1401bf6e8]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x50
pop rbx
ret
xor edx, edx
mov dword [rsp + 0x20], 0xa0004
mov dword [rsp + 0x24], 0x1b002e
mov dword [rsp + 0x28], 0x19
mov dword [rsp + 0x2c], 0x20025
mov dword [rsp + 0x30], 0xd000d
mov word [rsp + 0x40], dx
mov dword [rsp + 0x34], 0xa0049
mov dword [rsp + 0x38], 0x14001b
mov dword [rsp + 0x3c], 0x5a0010
lea rbx, [0x1401bf6e8]
lea r8, [0x1401bed91]
nop dword [rax]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rsp + rdx*2 + 0x22]
add rdx, 4
xor ax, word [rsp + rdx*2 + 0x18]
mov word [rbx + rdx*2 - 8], ax
movzx eax, byte [rdx + r8 - 4]
xor cx, ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rsp + rdx*2 + 0x1c]
mov word [rbx + rdx*2 - 6], cx
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rsp + rdx*2 + 0x1e]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0x10
jl 0x140051d00
mov r8d, dword [0x1401c3d80]
mov eax, 0x2aaaaaab
mov r9d, r8d
imul r9d, r8d
imul r9d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
lea ecx, [rdx + rdx*2]
shl ecx, 3
sub eax, ecx
cmp eax, 0x12
jne 0x140051dfc
mov eax, 0x2e8ba2e9
imul r9d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0xb
sub r9d, edx
cmp r9d, 6
je 0x140051de5
lea ecx, [r8 + 1]
mov eax, 0x2aaaaaab
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 7
jne 0x140051de5
mov ecx, 1
cmp r8d, ecx
jle 0x140051ddf
nop word [rax + rax]
mov eax, r8d
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, r8d
jl 0x140051dd0
mov dword [0x1401c3d80], ecx
call fcn.1400ce478
mov ecx, dword [0x1401c3d80]
cmp ecx, eax
jne 0x140051dfc
dec ecx
mov dword [0x1401c3d80], ecx
mov byte [0x1401c5968], 1
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x50
pop rbx
ret
Function at 0x140052020
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401c5973], 0
je 0x140052059
lea rax, [0x1401bf620]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x70
pop rbp
ret
mov ecx, dword [0x1401c3d80]
mov qword [rsp + 0x80], rbx
xor ebx, ebx
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
mov dword [rbp - 0x50], 0x60026
mov dword [rbp - 0x4c], 0x160001
mov dword [rbp - 0x48], 3
mov dword [rbp - 0x44], 0x20032
imul r8d, eax
imul r8d, ecx
mov eax, 0xb21642c9
mov dword [rbp - 0x40], 0xd0002
mov dword [rbp - 0x3c], 0x390001
mov dword [rbp - 0x38], 0x190006
mov dword [rbp - 0x34], 0xe0003
mov dword [rbp - 0x30], 0x1c
imul r8d
add edx, r8d
mov dword [rbp - 0x2c], 0x20009
mov dword [rbp - 0x28], 0x4a0019
sar edx, 4
mov dword [rbp - 0x24], 0xd0004
mov dword [rbp - 0x20], 0x40006
mov eax, edx
mov dword [rbp - 0x1c], 0x90009
mov dword [rbp - 0x18], 0x50
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub r8d, edx
cmp r8d, 0xf
jne 0x140052159
lea ecx, [rbx + 0x28]
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rdi
call fcn.1400cd108
mov edi, ebx
mov rsi, rax
nop
call fcn.1400ce478
inc rdi
add eax, dword [0x1401c3d80]
mov dword [rsi + rdi*4 - 4], eax
cmp rdi, 0xa
jl 0x140052120
mov ecx, dword [rsi + 0x24]
mov dword [0x1401c3d80], ecx
mov rcx, rsi
call fcn.1400cebfc
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x88]
lea rax, [0x1401bf620]
lea rdx, [0x1401bed90]
nop word [rax + rax]
movzx ecx, byte [rbx + rdx]
inc rbx
xor cx, word [rbp + rbx*2 - 0x52]
mov word [rax + rbx*2 - 2], cx
cmp rbx, 0x1d
jl 0x140052170
mov byte [0x1401c5973], 1
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x70
pop rbp
ret
Function at 0x1400521b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401c5959], 0
je 0x1400521e9
lea rax, [0x1401bf788]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x40
pop rbp
ret
xor r10d, r10d
mov dword [rbp - 0x38], 0xe0006
mov dword [rbp - 0x34], 0x430007
mov dword [rbp - 0x30], 0x380034
mov dword [rbp - 0x2c], 0x1e002a
mov dword [rbp - 0x28], 0xc0049
mov word [rbp - 0xc], r10w
mov edx, r10d
mov dword [rbp - 0x24], 0xc0000
mov dword [rbp - 0x20], 0x1e0007
mov dword [rbp - 0x1c], 0x470001
mov dword [rbp - 0x18], 0x1d0015
mov dword [rbp - 0x14], 0x140007
mov dword [rbp - 0x10], 0x44001e
lea r11, [0x1401bf788]
lea r8, [0x1401bed91]
nop
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rbp + rdx*2 - 0x36]
add rdx, 2
xor ax, word [rbp + rdx*2 - 0x3c]
mov word [r11 + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor cx, ax
mov word [r11 + rdx*2 - 2], cx
cmp rdx, 0x16
jl 0x140052250
mov ecx, dword [0x1401c3d80]
mov eax, 0x38e38e39
lea r8d, [rcx + 1]
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 0xd
jne 0x1400522b5
dec ecx
mov dword [0x1401c3d80], ecx
mov r8d, ecx
mov eax, 0x2aaaaaab
mov byte [0x1401c5959], 1
imul r8d, ecx
imul r8d, ecx
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub r8d, eax
cmp r8d, 6
jne 0x140052311
lea r9, [rbp - 0x40]
nop dword [rax + rax]
mov edx, dword [r9]
inc r10d
lea r9, [r9 + 4]
lea r8d, [rdx + rdx*4]
movsxd rdx, r10d
lea ecx, [rcx + r8*2]
cmp rdx, 8
jb 0x1400522f0
mov dword [0x1401c3d80], ecx
mov rax, r11
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x40
pop rbp
ret
Function at 0x140052550
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401c5948], 0
je 0x140052580
lea rax, [0x1401bf340]
jmp 0x140052661
mov dword [rbp - 0x50], 0x70020
mov dword [rbp - 0x4c], 0x33001f
mov dword [rbp - 0x48], 0x1b0002
mov dword [rbp - 0x44], 0x2c0005
mov dword [rbp - 0x40], 0xc000d
mov dword [rbp - 0x3c], 0xc001d
mov dword [rbp - 0x38], 0x30007
mov dword [rbp - 0x34], 0x80055
mov dword [rbp - 0x30], 0x450016
mov dword [rbp - 0x2c], 0x80022
mov dword [rbp - 0x28], 0xe000b
mov dword [rbp - 0x24], 0x5002e
mov dword [rbp - 0x20], 0x1a000d
mov dword [rbp - 0x1c], 0x1f000d
mov dword [rbp - 0x18], 0x5f0009
mov dword [rbp - 0x14], 0x54
xor eax, eax
lea rbx, [0x1401bf340]
lea rdx, [0x1401bed90]
movzx ecx, byte [rax + rdx]
inc rax
xor cx, word [rbp + rax*2 - 0x52]
mov word [rbx + rax*2 - 2], cx
cmp rax, 0x1f
jl 0x140052600
mov eax, dword [0x1401c3d80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
sub ecx, edx
cmp ecx, 3
jne 0x140052657
mov edx, 0xe7
lea rcx, str._d__d_n
lea r8d, [rdx + 1]
call fcn.1400ce3cc
mov byte [0x1401c5948], 1
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cdac0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x140052680
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rsp + 0x18], rax
cmp byte [0x1401c5960], 0
lea rax, [0x1401bfbe0]
jne 0x1400526ff
mov dword [rsp], 0xc004a
mov dword [rsp + 4], 0x150004
mov dword [rsp + 8], 0x420011
mov dword [rsp + 0xc], 0x430052
mov dword [rsp + 0x10], 0x4000d
mov dword [rsp + 0x14], 3
xor ecx, ecx
lea r8, [0x1401bed90]
nop dword [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 - 2]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0xb
jl 0x1400526e0
mov byte [0x1401c5960], 1
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x28
ret
Function at 0x140052720
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401c5971], 0
lea rax, [0x1401bf6a0]
jne 0x14005282c
xor r8d, r8d
mov dword [rbp - 0x60], 0xe0006
mov dword [rbp - 0x5c], 0xc0007
mov dword [rbp - 0x58], 0x540013
mov dword [rbp - 0x54], 0xc0000
mov dword [rbp - 0x50], 0x40000
mov word [rbp - 0x20], r8w
mov dword [rbp - 0x4c], 0xd000a
mov dword [rbp - 0x48], 0x54
mov dword [rbp - 0x44], 0x80007
mov dword [rbp - 0x40], 0x450013
mov dword [rbp - 0x3c], 0x140007
mov dword [rbp - 0x38], 0x1e004a
mov dword [rbp - 0x34], 0x1e0007
mov dword [rbp - 0x30], 0x10002
mov dword [rbp - 0x2c], 0xc0002
mov dword [rbp - 0x28], 0xc0004
mov dword [rbp - 0x24], 0x4001a
lea r9, [0x1401bed91]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x5e]
add r8, 4
xor cx, word [rbp + r8*2 - 0x68]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x64]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x62]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x20
jl 0x1400527d0
mov byte [0x1401c5971], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x60
pop rbp
ret

Function at 0x140052840
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401c5972], 0
lea rax, [0x1401bf558]
jne 0x140052940
xor r8d, r8d
mov dword [rbp - 0x30], 0xa0004
mov dword [rbp - 0x2c], 0x150034
mov dword [rbp - 0x28], 0x60015
mov dword [rbp - 0x24], 0x40015
mov dword [rbp - 0x20], 0x60006
mov word [rbp - 0xc], r8w
mov dword [rbp - 0x1c], 0xa0030
mov dword [rbp - 0x18], 0x11001c
mov dword [rbp - 0x14], 0x1b
mov dword [rbp - 0x10], 0x3a0015
lea r9, [0x1401bed91]
nop dword [rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x2e]
add r8, 6
xor cx, word [rbp + r8*2 - 0x3c]
mov word [rax + r8*2 - 0xc], cx
movzx ecx, byte [r8 + r9 - 6]
xor dx, cx
movzx ecx, byte [r8 + r9 - 5]
xor cx, word [rbp + r8*2 - 0x38]
mov word [rax + r8*2 - 0xa], dx
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x36]
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x34]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x32]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x12
jl 0x1400528c0
mov byte [0x1401c5972], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x30
pop rbp
ret
Function at 0x140052bd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp + 0x10], rax
cmp byte [0x1401c5954], 0
je 0x140052c05
lea rax, [0x1401bf438]
jmp 0x140052d1f
mov r9d, dword [0x1401c3d80]
mov eax, 0x2aaaaaab
mov qword [rsp + 0x130], rbx
mov ecx, r9d
xor ebx, ebx
mov dword [rbp - 0x20], 0x30004
mov dword [rbp - 0x1c], 0x170005
mov dword [rbp - 0x18], 0x120050
mov dword [rbp - 0x14], 0x3000f
imul ecx, r9d
imul ecx, r9d
imul ecx
sar edx, 2
mov dword [rbp - 0x10], 0x48000d
mov dword [rbp - 0xc], 0x1c000c
mov eax, edx
mov dword [rbp - 8], 0x20006
mov dword [rbp - 4], 0x90010
shr eax, 0x1f
mov dword [rbp], 0x280004
mov dword [rbp + 4], 0x30001
add edx, eax
mov dword [rbp + 8], 0x6001f
mov dword [rbp + 0xc], 7
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 6
jne 0x140052cb4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov r9d, dword [0x1401c3d80]
lea rdi, [0x1401bf438]
lea rcx, [0x1401bed90]
movzx eax, byte [rbx + rcx]
inc rbx
xor ax, word [rbp + rbx*2 - 0x22]
mov word [rdi + rbx*2 - 2], ax
cmp rbx, 0x17
jl 0x140052cc2
mov rbx, qword [rsp + 0x130]
lea r8d, [r9 + 1]
mov eax, 0xb21642c9
imul r8d, r9d
imul r8d
add edx, r8d
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x17
sub r8d, edx
cmp r8d, 9
jne 0x140052d15
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov byte [0x1401c5954], 1
mov rax, rdi
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1400cdac0
mov rdi, qword [rsp + 0x138]
add rsp, 0x120
pop rbp
ret
Function at 0x140052d40
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ecx, dword [0x1401c3d80]
lea eax, [rcx + 1]
imul eax, ecx
and eax, 0x8000000f
jge 0x140052d6f
dec eax
or eax, 0xfffffff0
inc eax
xor ebx, ebx
cmp eax, 7
jne 0x140052d8b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
cmp byte [0x1401c595d], bl
je 0x140052dad
lea rax, [0x1401bfb70]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x60
pop rbx
ret
mov dword [rsp + 0x30], 0x140009
mov dword [rsp + 0x34], 0x3c001b
mov dword [rsp + 0x38], 0x40019
mov dword [rsp + 0x3c], 0x320005
mov dword [rsp + 0x40], 0x1001d
mov dword [rsp + 0x44], 0xc0002
mov dword [rsp + 0x48], 0x1f0010
mov dword [rsp + 0x4c], 0x130000
mov word [rsp + 0x50], bx
lea rdx, [0x1401bfb70]
lea r8, [0x1401bed91]
movzx eax, byte [rbx + r8 - 1]
movzx ecx, word [rsp + rbx*2 + 0x32]
add rbx, 4
xor ax, word [rsp + rbx*2 + 0x28]
mov word [rdx + rbx*2 - 8], ax
movzx eax, byte [rbx + r8 - 4]
xor cx, ax
mov word [rdx + rbx*2 - 6], cx
movzx ecx, byte [rbx + r8 - 3]
xor cx, word [rsp + rbx*2 + 0x2c]
mov word [rdx + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor cx, word [rsp + rbx*2 + 0x2e]
mov word [rdx + rbx*2 - 2], cx
cmp rbx, 0x10
jl 0x140052e00
mov byte [0x1401c595d], 1
mov rax, rdx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x60
pop rbx
ret
Function at 0x140052e70
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp - 8], rax
mov ecx, dword [0x1401c3d80]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x38e38e39
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 0xa
jne 0x140052ee2
mov eax, 0xef
mov ecx, 0xd7
test ecx, ecx
je 0x140052eda
cdq
mov r8d, ecx
idiv ecx
mov eax, r8d
mov ecx, edx
test r8d, r8d
jne 0x140052ec6
add eax, ecx
mov dword [0x1401c3d80], eax
cmp byte [0x1401c5961], 0
je 0x140052f04
lea rax, [0x1401bf508]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x40
pop rbp
ret
xor r8d, r8d
mov dword [rbp - 0x40], 0x120028
mov dword [rbp - 0x3c], 0xd000e
mov dword [rbp - 0x38], 0x60020
mov dword [rbp - 0x34], 0xe0009
mov dword [rbp - 0x30], 0x1b000c
mov word [rbp - 0x10], r8w
mov dword [rbp - 0x2c], 0x3d001c
mov dword [rbp - 0x28], 0x1b001b
mov dword [rbp - 0x24], 0x90010
mov dword [rbp - 0x20], 0x30050
mov dword [rbp - 0x1c], 0xe000f
mov dword [rbp - 0x18], 0xf0006
mov dword [rbp - 0x14], 0x4c0006
lea rdx, [0x1401bf508]
lea r9, [0x1401bed91]
nop
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rbp + r8*2 - 0x3e]
add r8, 6
xor ax, word [rbp + r8*2 - 0x4c]
mov word [rdx + r8*2 - 0xc], ax
movzx eax, byte [r8 + r9 - 6]
xor cx, ax
movzx eax, byte [r8 + r9 - 5]
xor ax, word [rbp + r8*2 - 0x48]
mov word [rdx + r8*2 - 0xa], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rdx + r8*2 - 8], ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rbp + r8*2 - 0x46]
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 2], cx
cmp r8, 0x18
jl 0x140052f70
mov byte [0x1401c5961], 1
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x40
pop rbp
ret
Function at 0x140053010
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400511e0
test al, al
jne 0x140053047
call fcn.1400ce478
mov ecx, dword [0x1401c3d80]
cmp ecx, eax
jne 0x140053047
dec ecx
mov dword [0x1401c3d80], ecx
cmp byte [0x1401c594f], 0
lea rax, [0x1401bf7e8]
jne 0x14005311e
xor r8d, r8d
mov dword [rbp - 0x40], 0x100024
mov dword [rbp - 0x3c], 0x2000e
mov dword [rbp - 0x38], 0x110004
mov dword [rbp - 0x34], 0x80034
mov dword [rbp - 0x30], 0x70004
mov word [rbp - 0x18], r8w
mov dword [rbp - 0x2c], 0xc001b
mov dword [rbp - 0x28], 0x180020
mov dword [rbp - 0x24], 0x20007
mov dword [rbp - 0x20], 0x10011
mov dword [rbp - 0x1c], 0x470054
lea r9, [0x1401bed91]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 5
xor cx, word [rbp + r8*2 - 0x4a]
mov word [rax + r8*2 - 0xa], cx
movzx ecx, byte [r8 + r9 - 5]
xor dx, cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 8], dx
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x14
jl 0x1400530b0
mov byte [0x1401c594f], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x60
pop rbp
ret

Function at 0x140053130
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401c5975], 0
lea rax, [0x1401bf878]
jne 0x14005322e
mov dword [rbp - 0x40], 0x160029
mov dword [rbp - 0x3c], 0xf002a
mov dword [rbp - 0x38], 0x1b001c
mov dword [rbp - 0x34], 0xc0005
mov dword [rbp - 0x30], 0xd001d
mov dword [rbp - 0x2c], 0x39
xor r8d, r8d
mov dword [rbp - 0x28], 0x40006
mov dword [rbp - 0x24], 0x60000
mov dword [rbp - 0x20], 0x28001c
mov dword [rbp - 0x1c], 0xa000b
mov dword [rbp - 0x18], 0x180005
mov dword [rbp - 0x14], 0x56001b
mov dword [rbp - 0x10], 0x4f
lea r9, [0x1401bed91]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 5
xor cx, word [rbp + r8*2 - 0x4a]
mov word [rax + r8*2 - 0xa], cx
movzx ecx, byte [r8 + r9 - 5]
xor dx, cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 8], dx
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x19
jl 0x1400531c0
mov byte [0x1401c5975], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x40
pop rbp
ret
Function at 0x140053480
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r8d, dword [0x1401c3d80]
mov eax, 0x2aaaaaab
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 2
jne 0x1400534d6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov r8d, dword [0x1401c3d80]
imul r8d, r8d
mov eax, 0xb21642c9
imul r8d
add edx, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub r8d, edx
cmp r8d, 0xf
jne 0x14005351f
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401c3d80]
mov edx, 7
test rax, rax
cmove ecx, edx
mov dword [0x1401c3d80], ecx
cmp byte [0x1401c5962], 0
lea rax, [0x1401bf660]
jne 0x14005360c
xor r8d, r8d
mov dword [rbp - 0x50], 0xd002b
mov dword [rbp - 0x4c], 0x80004
mov dword [rbp - 0x48], 0x40005
mov dword [rbp - 0x44], 0x1f0036
mov dword [rbp - 0x40], 0x1e0000
mov word [rbp - 0x18], r8w
mov dword [rbp - 0x3c], 0x50006
mov dword [rbp - 0x38], 0x170011
mov dword [rbp - 0x34], 0x310010
mov dword [rbp - 0x30], 0x90011
mov dword [rbp - 0x2c], 0x2001b
mov dword [rbp - 0x28], 0xc004a
mov dword [rbp - 0x24], 0x50003
mov dword [rbp - 0x20], 0xd0003
mov dword [rbp - 0x1c], 0x4d0008
lea r9, [0x1401bed91]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x4e]
add r8, 4
xor cx, word [rbp + r8*2 - 0x58]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x54]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x52]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x1c
jl 0x1400535b0
mov byte [0x1401c5962], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cdac0
add rsp, 0x70
pop rbp
ret