joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140055f10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp byte [0x1401d7a01], 0
je 0x140055f45
lea rax, [0x1401d1a30]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x78
ret
mov eax, dword [0x1401d5d60]
mov qword [rsp + 0x70], rbx
xor ebx, ebx
mov dword [rsp + 0x40], 0xd0006
mov dword [rsp + 0x44], 0x19002b
mov dword [rsp + 0x48], 0x1f0006
imul eax, eax
mov dword [rsp + 0x4c], 0x50022
mov dword [rsp + 0x50], 0x100010
mov dword [rsp + 0x54], 0x6004f
mov dword [rsp + 0x58], 0x110000
mov dword [rsp + 0x5c], 0x5a000e
mov word [rsp + 0x60], bx
and eax, 0x8000000f
jge 0x140055fa8
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 8
jne 0x140055fd4
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
lea rdx, [0x1401d1a30]
lea r8, [0x1401d0d91]
nop word [rax + rax]
movzx eax, byte [rbx + r8 - 1]
movzx ecx, word [rsp + rbx*2 + 0x42]
add rbx, 4
xor ax, word [rsp + rbx*2 + 0x38]
mov word [rdx + rbx*2 - 8], ax
movzx eax, byte [rbx + r8 - 4]
xor cx, ax
mov word [rdx + rbx*2 - 6], cx
movzx ecx, byte [rbx + r8 - 3]
xor cx, word [rsp + rbx*2 + 0x3c]
mov word [rdx + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor cx, word [rsp + rbx*2 + 0x3e]
mov word [rdx + rbx*2 - 2], cx
cmp rbx, 0x10
jl 0x140055ff0
mov rbx, qword [rsp + 0x70]
mov byte [0x1401d7a01], 1
mov rax, rdx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x78
ret
Function at 0x140056170
Capabilities:
Get disk size

Disassembly:
sub rsp, 0xf8
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov r8d, dword [0x1401d5d60]
mov eax, 0x30c30c31
mov ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xd
jne 0x1400561fe
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x2f4
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400d2e28
mov rcx, rax
call fcn.1400d3f08
mov r8d, dword [0x1401d5d60]
cmp byte [0x1401d7a1d], 0
jne 0x1400562c3
movzx eax, byte [0x1401d0d90]
xor al, 0x2b
movzx eax, al
mov word [0x1401d14a0], ax
movzx eax, byte [0x1401d0d91]
xor al, 0xa
movzx eax, al
mov word [0x1401d14a2], ax
movzx eax, byte [0x1401d0d92]
xor al, 0x18
movzx eax, al
mov word [0x1401d14a4], ax
movzx eax, byte [0x1401d0d93]
mov word [0x1401d14a6], ax
mov eax, r8d
imul eax, r8d
and eax, 0x8000000f
jge 0x140056267
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 6
jne 0x14005628c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov r8d, dword [0x1401d5d60]
imul r8d, r8d
mov eax, 0xb21642c9
mov byte [0x1401d7a1d], 1
imul r8d
add edx, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub r8d, edx
cmp r8d, 0xa
jne 0x1400562c3
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
lea rax, [0x1401d14a0]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0xf8
ret
Function at 0x1400563e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r8d, dword [0x1401d5d60]
mov edi, 4
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x2aaaaaab
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x14
jne 0x140056485
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, edi
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x141
movsxd rcx, r8d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400d2e28
mov rcx, rax
call fcn.1400d3f08
mov r8d, dword [0x1401d5d60]
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
xor ebx, ebx
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 9
jne 0x1400564c6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
cmp byte [0x1401d7a28], bl
lea rax, [0x1401d19d8]
jne 0x14005656e
mov dword [rbp - 0x50], 0x10024
mov dword [rbp - 0x4c], 0x140004
mov dword [rbp - 0x48], 0x1f001c
mov dword [rbp - 0x44], 0x50035
mov dword [rbp - 0x40], 0x10001f
mov dword [rbp - 0x3c], 0x350007
mov dword [rbp - 0x38], 0x1c001d
mov dword [rbp - 0x34], 0xe001d
mov dword [rbp - 0x30], 0xc0007
mov dword [rbp - 0x2c], 0x160002
mov dword [rbp - 0x28], 0x460001
mov dword [rbp - 0x24], 0x90014
mov dword [rbp - 0x20], 0x1c0003
mov dword [rbp - 0x1c], 0x50015
mov dword [rbp - 0x18], 0x4a
lea rdx, [0x1401d0d90]
nop dword [rax]
movzx ecx, byte [rbx + rdx]
inc rbx
xor cx, word [rbp + rbx*2 - 0x52]
mov word [rax + rbx*2 - 2], cx
cmp rbx, 0x1d
jl 0x140056550
mov byte [0x1401d7a28], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d37e0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140056590
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401d7a30], 0
je 0x1400565c9
lea rax, [0x1401d1ab0]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x60
pop rbp
ret
call fcn.140055320
test al, al
jne 0x1400565ef
call fcn.1400d41a0
mov r9d, dword [0x1401d5d60]
cmp r9d, eax
jne 0x1400565f6
dec r9d
mov dword [0x1401d5d60], r9d
jmp 0x1400565f6
mov r9d, dword [0x1401d5d60]
xor eax, eax
mov dword [rbp - 0x40], 0x90004
mov dword [rbp - 0x3c], 0x410002
mov dword [rbp - 0x38], 0x27002b
mov dword [rbp - 0x34], 0x19002d
mov dword [rbp - 0x30], 0x110054
mov word [rbp - 0x14], ax
mov dword [rbp - 0x2c], 6
mov dword [rbp - 0x28], 0x1b001c
mov dword [rbp - 0x24], 0x47001f
mov dword [rbp - 0x20], 0x11000e
mov dword [rbp - 0x1c], 0xc
mov dword [rbp - 0x18], 0x480006
lea r10, [0x1401d1ab0]
lea r8, [0x1401d0d91]
nop word [rax + rax]
movzx ecx, byte [rax + r8 - 1]
movzx edx, word [rbp + rax*2 - 0x3e]
add rax, 2
xor cx, word [rbp + rax*2 - 0x44]
mov word [r10 + rax*2 - 4], cx
movzx ecx, byte [rax + r8 - 2]
xor dx, cx
mov word [r10 + rax*2 - 2], dx
cmp rax, 0x16
jl 0x140056660
mov r8d, r9d
mov eax, 0x2e8ba2e9
mov byte [0x1401d7a30], 1
imul r8d, r9d
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, 0x12
jne 0x1400566c5
inc r9d
mov dword [0x1401d5d60], r9d
mov rax, r10
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x60
pop rbp
ret

Function at 0x1400566e0
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x38
call fcn.140055320
test al, al
jne 0x140056706
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
cmp byte [0x1401d7a06], 0
jne 0x1400567c5
movzx eax, byte [0x1401d0d90]
mov byte [0x1401d7a06], 1
xor al, 0xb
movzx eax, al
mov word [0x1401d1960], ax
movzx eax, byte [0x1401d0d91]
xor al, 0x11
movzx eax, al
mov word [0x1401d1962], ax
movzx eax, byte [0x1401d0d92]
xor al, 0xa
movzx eax, al
mov word [0x1401d1964], ax
movzx eax, byte [0x1401d0d93]
xor al, 0xd
movzx eax, al
mov word [0x1401d1966], ax
movzx eax, byte [0x1401d0d94]
xor al, 3
movzx eax, al
mov word [0x1401d1968], ax
movzx eax, byte [0x1401d0d95]
xor al, 0x45
movzx eax, al
mov word [0x1401d196a], ax
movzx eax, byte [0x1401d0d96]
xor al, 5
movzx eax, al
mov word [0x1401d196c], ax
movzx eax, byte [0x1401d0d97]
xor al, 6
movzx eax, al
mov word [reloc.OLEAUT32.dll_SysStringLen], ax
movzx eax, byte [0x1401d0d98]
xor al, 0x18
movzx eax, al
mov word [0x1401d1970], ax
lea rax, [0x1401d1960]
add rsp, 0x38
ret
Function at 0x140056a20
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401d7a22], 0
je 0x140056a59
lea rax, [0x1401d1670]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x50
pop rbp
ret
mov r9d, dword [0x1401d5d60]
lea eax, [r9 + 1]
lea ecx, [r9 + 2]
imul ecx, eax
mov eax, 0x2aaaaaab
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0xa
jne 0x140056a97
dec r9d
mov dword [0x1401d5d60], r9d
mov r8d, r9d
mov eax, 0x66666667
xor ecx, ecx
mov dword [rbp - 0x50], 0x22
mov dword [rbp - 0x4c], 0x31001a
mov dword [rbp - 0x48], 0x4001d
imul r8d, r9d
imul r8d
sar edx, 3
mov dword [rbp - 0x44], 0x2b0002
mov dword [rbp - 0x40], 0x110010
mov eax, edx
mov dword [rbp - 0x3c], 0x1b
mov dword [rbp - 0x38], 0x6001c
shr eax, 0x1f
mov dword [rbp - 0x34], 0x8004b
mov dword [rbp - 0x30], 0x49000d
add edx, eax
mov dword [rbp - 0x2c], 0x1c0029
mov dword [rbp - 0x28], 0x20013
lea eax, [rdx + rdx*4]
mov dword [rbp - 0x24], 0x1003e
mov dword [rbp - 0x20], 0x20008
shl eax, 2
mov dword [rbp - 0x1c], 0x130011
mov dword [rbp - 0x18], 0x5e0013
sub r8d, eax
mov dword [rbp - 0x14], 0x52
cmp r8d, 7
jne 0x140056b3b
inc r9d
mov dword [0x1401d5d60], r9d
lea rax, [0x1401d1670]
lea r8, [0x1401d0d90]
nop dword [rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rbp + rcx*2 - 0x52]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x1f
jl 0x140056b50
mov byte [0x1401d7a22], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x50
pop rbp
ret
Function at 0x140056b90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x1c8
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rsp + 0x1b8], rax
mov r9d, dword [0x1401d5d60]
mov eax, 0x2aaaaaab
lea ecx, [r9 + 1]
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 9
jne 0x140056be5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, eax
mov dword [0x1401d5d60], eax
cmp byte [0x1401d7a35], 0
je 0x140056c0d
lea rax, [0x1401d1500]
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x1c8
ret
mov ecx, r9d
mov eax, 0x2aaaaaab
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x11
jne 0x140056c8c
mov eax, dword [str.I5EoUH]
or r8, 0xffffffffffffffff
mov dword [rsp + 0x20], eax
movzx eax, word [0x14015cf30]
mov rcx, r8
mov word [rsp + 0x24], ax
movzx eax, byte [0x14015cf32]
mov byte [rsp + 0x26], al
lea rax, [rsp + 0x20]
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x140056c60
mov eax, 4
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.1400d2e28
mov rcx, rax
call fcn.1400d3f08
mov r9d, dword [0x1401d5d60]
xor r10d, r10d
mov dword [rsp + 0x1a0], 0xb0048
mov dword [rsp + reloc.OLEAUT32.dll_OleTranslateColor], 0x170001
mov dword [rsp + 0x1a8], 0x5d000e
mov dword [rsp + 0x1ac], 0x440055
mov dword [rsp + 0x1b0], 0x190010
mov edx, r10d
mov dword [rsp + 0x1b4], 5
lea r11, [0x1401d1500]
lea r8, [0x1401d0d90]
nop word [rax + rax]
movzx ecx, byte [rdx + r8]
inc rdx
xor cx, word [rsp + rdx*2 + 0x19e]
mov word [r11 + rdx*2 - 2], cx
cmp rdx, 0xb
jl 0x140056cf0
lea r8d, [r9 + 2]
lea ecx, [r9 + 1]
mov eax, 0x2aaaaaab
mov byte [0x1401d7a35], 1
imul r8d, ecx
imul r8d, r9d
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 0xa
jne 0x140056d72
lea rdx, [rsp + 0x30]
nop dword [rax]
mov ecx, dword [rdx]
inc r10d
lea rdx, [rdx + 4]
imul ecx, ecx, 0x26
add r9d, ecx
movsxd rcx, r10d
cmp rcx, 0x170
jb 0x140056d50
mov dword [0x1401d5d60], r9d
mov rax, r11
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x1c8
ret
Function at 0x140056d90
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, dword [0x1401d5d60]
mov eax, 0x6bca1af3
xor r9d, r9d
mov r8d, ecx
imul r8d, ecx
imul r8d, ecx
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub r8d, edx
cmp r8d, 0x10
jne 0x140056e3e
mov eax, 0x66666667
mov r8d, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
mov edx, ecx
add eax, eax
sub edx, eax
cmp edx, 0xe4
je 0x140056e37
nop
mov eax, ecx
inc r8d
or eax, 0xffffff1a
add ecx, eax
mov eax, ecx
imul eax, ecx
cmp r8d, eax
jg 0x140056e37
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
lea edx, [rdx + rdx*4]
add edx, edx
sub eax, edx
cmp eax, 0xe4
jne 0x140056e00
mov dword [0x1401d5d60], r8d
cmp byte [0x1401d7a07], r9b
je 0x140056e60
lea rax, [0x1401d1710]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x60
pop rbp
ret
mov dword [rbp - 0x60], 0x90004
mov dword [rbp - 0x5c], 0xe0002
mov dword [rbp - 0x58], 0x4b000c
mov dword [rbp - 0x54], 0xb0007
mov dword [rbp - 0x50], 0x19001d
mov dword [rbp - 0x4c], 0x1000c
mov dword [rbp - 0x48], 0x5004f
mov dword [rbp - 0x44], 0x80019
mov dword [rbp - 0x40], 0x490008
mov dword [rbp - 0x3c], 0xc
mov dword [rbp - 0x38], 0x120052
mov dword [rbp - 0x34], 0x1a0017
mov dword [rbp - 0x30], 0x190007
mov dword [rbp - 0x2c], 0x1e
mov dword [rbp - 0x28], 0xd001e
mov dword [rbp - 0x24], 0x1c
mov word [rbp - 0x20], r9w
lea rdx, [0x1401d1710]
lea r8, [0x1401d0d91]
nop word [rax + rax]
movzx eax, byte [r9 + r8 - 1]
movzx ecx, word [rbp + r9*2 - 0x5e]
add r9, 4
xor ax, word [rbp + r9*2 - 0x68]
mov word [rdx + r9*2 - 8], ax
movzx eax, byte [r9 + r8 - 4]
xor cx, ax
mov word [rdx + r9*2 - 6], cx
movzx ecx, byte [r9 + r8 - 3]
xor cx, word [rbp + r9*2 - 0x64]
mov word [rdx + r9*2 - 4], cx
movzx ecx, byte [r9 + r8 - 2]
xor cx, word [rbp + r9*2 - 0x62]
mov word [rdx + r9*2 - 2], cx
cmp r9, 0x20
jl 0x140056ef0
mov byte [0x1401d7a07], 1
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x60
pop rbp
ret
Function at 0x140056f70
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x320]
sub rsp, 0x420
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp + 0x318], rax
cmp byte [0x1401d7a11], 0
je 0x140056fa7
lea rax, [0x1401d1938]
jmp 0x140057147
mov r10d, dword [0x1401d5d60]
mov ecx, dword [0x1401d746c]
mov dword [rbp + 0x2f0], 0xd0006
lea eax, [r10 + 1]
lea r8d, [r10 + 2]
mov dword [rbp + 0x2f4], 0x170031
mov dword [rbp + 0x2f8], 0x19000a
mov dword [rbp + 0x2fc], 0x30012
mov dword [rbp + 0x300], 0x1b001b
imul r8d, eax
imul r8d, r10d
mov eax, 0x2e8ba2e9
mov dword [rbp + 0x304], 0x60036
mov dword [rbp + 0x308], 0x140007
mov dword [rbp + 0x30c], 5
mov dword [rbp + 0x310], 0x36000e
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
imul edx, edx, 0x16
sub eax, edx
mov edx, 0xd7f08ddb
cmp eax, 9
mov eax, 0x78787879
cmove ecx, edx
xor r9d, r9d
mov dword [0x1401d746c], ecx
mov word [rbp + 0x314], r9w
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub r8d, edx
cmp r8d, 0xf
jne 0x1400570a3
mov ecx, r9d
lea rdx, [rsp]
nop dword [rax]
mov eax, dword [rdx]
inc ecx
lea rdx, [rdx + 4]
imul eax, eax, 0xae
add r10d, eax
movsxd rax, ecx
cmp rax, 0x3f0
jb 0x140057080
mov dword [0x1401d5d60], r10d
lea rax, [0x1401d1938]
lea r8, [0x1401d0d91]
movzx ecx, byte [r9 + r8 - 1]
movzx edx, word [rbp + r9*2 + 0x2f2]
add r9, 6
xor cx, word [rbp + r9*2 + 0x2e4]
mov word [rax + r9*2 - 0xc], cx
movzx ecx, byte [r9 + r8 - 6]
xor dx, cx
movzx ecx, byte [r9 + r8 - 5]
xor cx, word [rbp + r9*2 + 0x2e8]
mov word [rax + r9*2 - 0xa], dx
mov word [rax + r9*2 - 8], cx
movzx ecx, byte [r9 + r8 - 4]
xor cx, word [rbp + r9*2 + 0x2ea]
mov word [rax + r9*2 - 6], cx
movzx ecx, byte [r9 + r8 - 3]
xor cx, word [rbp + r9*2 + 0x2ec]
mov word [rax + r9*2 - 4], cx
movzx ecx, byte [r9 + r8 - 2]
xor cx, word [rbp + r9*2 + 0x2ee]
mov word [rax + r9*2 - 2], cx
cmp r9, 0x12
jl 0x1400570b1
mov byte [0x1401d7a11], 1
mov rcx, qword [rbp + 0x318]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x420
pop rbp
ret
Function at 0x140057240
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp + 0x80], rax
cmp byte [0x1401d7a2b], 0
je 0x140057277
lea rax, [0x1401d17d0]
jmp 0x140057414
mov dword [rbp + 0x50], 0x40006
xor r10d, r10d
mov dword [rbp + 0x54], 0x150000
mov dword [rbp + 0x58], 0xd004f
mov dword [rbp + 0x5c], 0x40008
mov dword [rbp + 0x60], 0x550010
mov dword [rbp + 0x64], 0x10000a
mov dword [rbp + 0x68], 0x7001d
mov dword [rbp + 0x6c], 0x9000e
mov dword [rbp + 0x70], 0x24001f
mov dword [rbp + 0x74], 0x17000a
mov dword [rbp + 0x78], 0xa0007
mov dword [rbp + 0x7c], 0x17
call fcn.140055480
test al, al
jne 0x1400572fa
mov eax, dword [0x1401d5d60]
mov ecx, r10d
test eax, eax
je 0x1400572f2
mov edx, eax
and edx, 1
add ecx, edx
cdq
sub eax, edx
sar eax, 1
jne 0x1400572e4
mov dword [0x1401d5d60], ecx
jmp 0x140057300
mov ecx, dword [0x1401d5d60]
mov rdx, r10
lea r9, [0x1401d17d0]
lea r8, [0x1401d0d90]
movzx eax, byte [rdx + r8]
inc rdx
xor ax, word [rbp + rdx*2 + 0x4e]
mov word [r9 + rdx*2 - 2], ax
cmp rdx, 0x17
jl 0x140057311
lea eax, [rcx + 1]
imul eax, eax
imul eax, ecx
imul eax, ecx
and eax, 0x80000003
jge 0x140057344
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x1400573b6
test ecx, ecx
je 0x1400573b6
nop dword [rax]
mov eax, ecx
and eax, 0x80000001
jge 0x140057360
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x140057375
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov dword [0x1401d5d60], eax
jmp 0x140057382
lea ecx, [rcx*2 + 1]
mov dword [0x1401d5d60], ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov edx, ecx
sub edx, eax
je 0x1400573a4
sub edx, 2
je 0x1400573a7
dec edx
je 0x1400573a9
jmp 0x1400573b2
add ecx, 2
inc ecx
add ecx, 2
mov dword [0x1401d5d60], ecx
test ecx, ecx
jne 0x140057350
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
mov byte [0x1401d7a2b], 1
imul r8d, eax
mov eax, 0x78787879
imul r8d, ecx
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub r8d, edx
cmp r8d, 0xf
jne 0x140057411
lea r8, [rsp + 0x20]
nop
mov edx, dword [r8]
inc r10d
lea r8, [r8 + 4]
imul edx, edx, 0x2b
add ecx, edx
movsxd rdx, r10d
cmp rdx, 0x124
jb 0x1400573f0
mov dword [0x1401d5d60], ecx
mov rax, r9
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x190
pop rbp
ret
Function at 0x140057430
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401d7a1a], 0
je 0x140057465
lea rax, [0x1401d14d8]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x38
ret
xor r8d, r8d
mov dword [rsp], 0x13000b
mov dword [rsp + 4], 0x3e001e
mov dword [rsp + 8], 0x1b0006
mov dword [rsp + 0xc], 0x350002
mov dword [rsp + 0x10], 0x1c0000
mov word [rsp + 0x20], r8w
mov dword [rsp + 0x14], 4
mov dword [rsp + 0x18], 0x1a000b
mov dword [rsp + 0x1c], 0x13001e
lea rcx, [0x1401d14d8]
lea r9, [0x1401d0d91]
nop dword [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx edx, word [rsp + r8*2 + 2]
add r8, 4
xor ax, word [rsp + r8*2 - 8]
mov word [rcx + r8*2 - 8], ax
movzx eax, byte [r8 + r9 - 4]
xor dx, ax
movzx eax, byte [r8 + r9 - 3]
xor ax, word [rsp + r8*2 - 4]
mov word [rcx + r8*2 - 6], dx
mov word [rcx + r8*2 - 4], ax
movzx eax, byte [r8 + r9 - 2]
xor ax, word [rsp + r8*2 - 2]
mov word [rcx + r8*2 - 2], ax
cmp r8, 0x10
jl 0x1400574c0
mov r9d, dword [0x1401d5d60]
mov eax, 0x2aaaaaab
mov r8d, r9d
imul r8d, r9d
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 0x11
jne 0x14005754e
inc r9d
mov dword [0x1401d5d60], r9d
mov byte [0x1401d7a1a], 1
mov rax, rcx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400d37e0
add rsp, 0x38
ret
Function at 0x140057570
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401d7a2f], 0
je 0x1400575a0
lea rax, [0x1401d1318]
jmp 0x1400576c8
xor edx, edx
mov dword [rbp - 0x40], 0x15002a
mov dword [rbp - 0x3c], 0xf000b
mov dword [rbp - 0x38], 0x19003f
mov dword [rbp - 0x34], 0x9000e
mov dword [rbp - 0x30], 0x60011
mov word [rbp - 0x10], dx
mov dword [rbp - 0x2c], 0x31001a
mov dword [rbp - 0x28], 0x1e0000
mov dword [rbp - 0x24], 0x9000e
mov dword [rbp - 0x20], 0xf004b
mov dword [rbp - 0x1c], 0x1a0004
mov dword [rbp - 0x18], 0x3001e
mov dword [rbp - 0x14], 0x480016
lea rbx, [0x1401d1318]
lea r8, [0x1401d0d91]
nop dword [rax + rax]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rbp + rdx*2 - 0x3e]
add rdx, 6
xor ax, word [rbp + rdx*2 - 0x4c]
mov word [rbx + rdx*2 - 0xc], ax
movzx eax, byte [rdx + r8 - 6]
xor cx, ax
movzx eax, byte [rdx + r8 - 5]
xor ax, word [rbp + rdx*2 - 0x48]
mov word [rbx + rdx*2 - 0xa], cx
mov word [rbx + rdx*2 - 8], ax
movzx eax, byte [rdx + r8 - 4]
xor ax, word [rbp + rdx*2 - 0x46]
mov word [rbx + rdx*2 - 6], ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rbp + rdx*2 - 0x44]
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rbp + rdx*2 - 0x42]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0x18
jl 0x140057610
mov ecx, dword [0x1401d5d60]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x38e38e39
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 3
jne 0x1400576be
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401d5d60], eax
mov byte [0x1401d7a2f], 1
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d37e0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x1400576e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401cde90]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.140055320
xor ebx, ebx
test al, al
jne 0x14005771b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
cmp byte [0x1401d7a24], bl
je 0x14005772f
lea rax, [0x1401d1b10]
jmp 0x140057827
call fcn.140055230
test al, al
jne 0x140057765
mov r8d, dword [0x1401d5d60]
mov ecx, 1
cmp r8d, ecx
jle 0x14005775f
nop dword [rax]
mov eax, r8d
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, r8d
jl 0x140057750
mov dword [0x1401d5d60], ecx
mov dword [rbp - 0x40], 0x170026
mov dword [rbp - 0x3c], 0xb
mov dword [rbp - 0x38], 0xe001b
mov dword [rbp - 0x34], 0xf0033
mov dword [rbp - 0x30], 0x1a0019
mov dword [rbp - 0x2c], 0x1d
mov dword [rbp - 0x28], 0x1d003b
mov dword [rbp - 0x24], 0x20019
mov dword [rbp - 0x20], 0xd000a
mov dword [rbp - 0x1c], 0x53005f
mov word [rbp - 0x18], bx
lea rdx, [0x1401d1b10]
lea r8, [0x1401d0d91]
nop dword [rax]
movzx eax, byte [rbx + r8 - 1]
movzx ecx, word [rbp + rbx*2 - 0x3e]
add rbx, 5
xor ax, word [rbp + rbx*2 - 0x4a]
mov word [rdx + rbx*2 - 0xa], ax
movzx eax, byte [rbx + r8 - 5]
xor cx, ax
movzx eax, byte [rbx + r8 - 4]
xor ax, word [rbp + rbx*2 - 0x46]
mov word [rdx + rbx*2 - 8], cx
movzx ecx, byte [rbx + r8 - 3]
xor cx, word [rbp + rbx*2 - 0x44]
mov word [rdx + rbx*2 - 6], ax
mov word [rdx + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor cx, word [rbp + rbx*2 - 0x42]
mov word [rdx + rbx*2 - 2], cx
cmp rbx, 0x14
jl 0x1400577c0
mov byte [0x1401d7a24], 1
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d37e0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret