joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140051860
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, dword [0x1401c4d60]
mov eax, 0x4ec4ec4f
mov ebx, 4
imul ecx, ecx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 8
jne 0x1400518e9
mov rax, qword [str.NtjeBuauXMw]
or r8, 0xffffffffffffffff
mov qword [rbp - 0x60], rax
mov eax, dword [0x140152be8]
mov rcx, r8
mov dword [rbp - 0x58], eax
lea rax, [rbp - 0x60]
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400518c6
mov rax, rbx
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.1400cd918
mov rcx, rax
call fcn.1400cf37c
cmp byte [0x1401c69bc], 0
lea rax, [0x1401c06b0]
jne 0x14005198f
mov dword [rbp - 0x50], 0xc0033
mov dword [rbp - 0x4c], 0x16001a
mov dword [rbp - 0x48], 0x11001e
mov dword [rbp - 0x44], 0xa0033
mov dword [rbp - 0x40], 0xc0007
mov dword [rbp - 0x3c], 0x34001d
mov dword [rbp - 0x38], 0x190010
mov dword [rbp - 0x34], 0x60004
mov dword [rbp - 0x30], 0xc0004
mov dword [rbp - 0x2c], 0x6000d
mov dword [rbp - 0x28], 0x4b001c
mov dword [rbp - 0x24], 0x8000c
mov dword [rbp - 0x20], 0x50019
mov dword [rbp - 0x1c], 0x90016
mov dword [rbp - 0x18], 0x44
xor ecx, ecx
lea r8, [0x1401bfd90]
nop
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rbp + rcx*2 - 0x52]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x1d
jl 0x140051970
mov byte [0x1401c69bc], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400ce2d0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x1400519b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp], rax
mov ecx, dword [0x1401c4d60]
mov eax, 0x2aaaaaab
mov r8d, ecx
imul r8d, ecx
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub r8d, eax
cmp r8d, 2
jne 0x140051a0a
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov ecx, dword [0x1401c4d60]
cmp byte [0x1401c69a2], 0
je 0x140051a1f
lea rax, [0x1401c07a8]
jmp 0x140051b62
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
xor r9d, r9d
mov r10d, 1
mov dword [rbp - 0x30], 0x40013
mov dword [rbp - 0x2c], 0x43001c
imul r8d, eax
imul r8d, ecx
mov eax, 0x38e38e39
mov dword [rbp - 0x28], 0x290029
mov dword [rbp - 0x24], 0x16002b
mov dword [rbp - 0x20], 0xd004c
mov dword [rbp - 0x1c], 0x1001c
mov dword [rbp - 0x18], 0x1e0011
imul r8d
sar edx, 2
mov dword [rbp - 0x14], 0x4f0006
mov dword [rbp - 0x10], 0x11000d
mov eax, edx
mov dword [rbp - 0xc], 0x100003
mov dword [rbp - 8], 0x45001b
shr eax, 0x1f
mov word [rbp - 4], r9w
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, r10d
jne 0x140051acc
mov r8d, r9d
test ecx, ecx
je 0x140051ac3
nop
mov eax, ecx
and eax, r10d
add r8d, eax
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
jne 0x140051ab0
mov ecx, r8d
mov dword [0x1401c4d60], ecx
lea r11, [0x1401c07a8]
lea r8, [0x1401bfd91]
nop word [rax + rax]
movzx eax, byte [r9 + r8 - 1]
movzx edx, word [rbp + r9*2 - 0x2e]
add r9, 2
xor ax, word [rbp + r9*2 - 0x34]
mov word [r11 + r9*2 - 4], ax
movzx eax, byte [r9 + r8 - 2]
xor dx, ax
mov word [r11 + r9*2 - 2], dx
cmp r9, 0x16
jl 0x140051ae0
mov r8d, ecx
mov eax, 0x66666667
imul r8d, ecx
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 0x13
jne 0x140051b58
cmp ecx, r10d
jle 0x140051b51
nop
mov eax, ecx
cdq
idiv r10d
inc r10d
add r10d, edx
cmp r10d, ecx
jl 0x140051b40
mov dword [0x1401c4d60], r10d
mov byte [0x1401c69a2], 1
mov rax, r11
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x110
pop rbp
ret
Function at 0x140051df0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp - 0x10], rax
call fcn.1400509b0
mov r8d, dword [0x1401c4d60]
mov eax, 0x2aaaaaab
mov ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
xor eax, eax
cmp ecx, 2
jne 0x140051ede
mov r9d, eax
mov edx, r9d
mov ecx, r9d
inc r9d
sar ecx, 1
and edx, 1
dec edx
not edx
and edx, r8d
xor edx, ecx
mov ecx, edx
sar edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, r8d
xor ecx, edx
mov edx, ecx
sar ecx, 1
and edx, 1
dec edx
not edx
and edx, r8d
xor edx, ecx
mov ecx, edx
sar edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, r8d
xor ecx, edx
mov edx, ecx
sar ecx, 1
and edx, 1
dec edx
not edx
and edx, r8d
xor edx, ecx
mov ecx, edx
sar edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, r8d
xor ecx, edx
mov edx, ecx
sar ecx, 1
and edx, 1
dec edx
not edx
and edx, r8d
xor edx, ecx
mov ecx, edx
sar edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, r8d
xor ecx, edx
add r8d, ecx
cmp r9d, 0x100
jl 0x140051e40
mov dword [0x1401c4d60], r8d
cmp byte [0x1401c698f], al
mov qword [rsp + 0x80], rbx
je 0x140051efa
lea rax, [0x1401c0bb0]
jmp 0x140051fb2
mov dword [rbp - 0x50], 0xd0035
mov dword [rbp - 0x4c], 0x330004
mov dword [rbp - 0x48], 0xa001f
mov dword [rbp - 0x44], 0x240004
mov dword [rbp - 0x40], 0xd0008
mov dword [rbp - 0x3c], 0x10001
mov dword [rbp - 0x38], 0x30011
mov dword [rbp - 0x34], 0x52
mov dword [rbp - 0x30], 0x49000e
mov dword [rbp - 0x2c], 0xc0026
mov dword [rbp - 0x28], 0xf000e
mov dword [rbp - 0x24], 0x26
mov dword [rbp - 0x20], 0x1b0012
mov dword [rbp - 0x1c], 0x1f0012
mov dword [rbp - 0x18], 0x48001d
mov dword [rbp - 0x14], 0x50
lea rbx, [0x1401c0bb0]
lea rdx, [0x1401bfd90]
nop dword [rax + rax]
movzx ecx, byte [rax + rdx]
inc rax
xor cx, word [rbp + rax*2 - 0x52]
mov word [rbx + rax*2 - 2], cx
cmp rax, 0x1f
jl 0x140051f80
call fcn.1400507b0
test al, al
jne 0x140051fa8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov byte [0x1401c698f], 1
mov rax, rbx
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x70
pop rbp
ret
Function at 0x140051fd0
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x40
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r9d, dword [0x1401c4d60]
mov eax, 0x38e38e39
or rdi, 0xffffffffffffffff
lea ecx, [r9 + 1]
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 4
jne 0x140052057
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r9d, edx
add r9d, 0x7b
movsxd rcx, r9d
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.1400cd918
mov rcx, rax
call fcn.1400cf37c
mov r9d, dword [0x1401c4d60]
mov ecx, r9d
mov eax, 0x38e38e39
imul ecx, r9d
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 5
jne 0x14005209b
mov edx, 0xcb
lea rcx, str._d__d_n
lea r8d, [rdx + 1]
call fcn.1400cf1dc
mov r9d, dword [0x1401c4d60]
cmp byte [0x1401c69a8], 0
mov qword [rsp + 0x50], rbx
je 0x1400520b5
lea rax, [0x1401c05c8]
jmp 0x14005218d
mov dword [rsp + 0x20], 0x6005f
mov dword [rsp + 0x24], 0x15001f
mov dword [rsp + 0x28], 0x53000c
mov dword [rsp + 0x2c], 0x4b0053
mov dword [rsp + 0x30], 0x50008
mov dword [rsp + 0x34], 0x1f
xor ecx, ecx
lea rbx, [0x1401c05c8]
lea rdx, [0x1401bfd90]
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
inc rcx
xor ax, word [rsp + rcx*2 + 0x1e]
mov word [rbx + rcx*2 - 2], ax
cmp rcx, 0xb
jl 0x140052100
lea eax, [r9 + 1]
lea r8d, [r9 + 2]
imul r8d, eax
mov eax, 0x30c30c31
imul r8d, r9d
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 7
jne 0x140052183
mov eax, 0x51eb851f
imul r9d
mov eax, 4
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x64
sub r9d, edx
add r9d, 0x141
movsxd rcx, r9d
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.1400cd918
mov rcx, rax
call fcn.1400cf37c
mov byte [0x1401c69a8], 1
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x40
pop rdi
ret
Function at 0x1400521b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov ecx, dword [0x1401c4d60]
mov eax, 0x66666667
mov r8d, ecx
imul r8d, ecx
imul r8d, ecx
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 0xa
jne 0x14005226c
test ecx, ecx
je 0x14005226c
mov eax, ecx
and eax, 0x80000001
jge 0x140052216
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x14005222b
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov dword [0x1401c4d60], eax
jmp 0x140052238
lea ecx, [rcx*2 + 1]
mov dword [0x1401c4d60], ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov edx, ecx
sub edx, eax
je 0x14005225a
sub edx, 2
je 0x14005225d
dec edx
je 0x14005225f
jmp 0x140052268
add ecx, 2
inc ecx
add ecx, 2
mov dword [0x1401c4d60], ecx
test ecx, ecx
jne 0x140052206
mov eax, ecx
imul eax, ecx
and eax, 0x8000000f
jge 0x14005227f
dec eax
or eax, 0xfffffff0
inc eax
xor ebx, ebx
cmp eax, 7
jne 0x1400522a1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov ecx, dword [0x1401c4d60]
cmp byte [0x1401c69aa], bl
je 0x1400522b5
lea rax, [0x1401c0730]
jmp 0x140052417
mov r8d, ecx
mov eax, 0x92492493
mov dword [rbp - 9], 0x40013
mov dword [rbp - 5], 0xc001c
mov dword [rbp - 1], 0x45000e
mov dword [rbp + 3], 0x40001
imul r8d, ecx
imul r8d, ecx
imul r8d
add edx, r8d
mov dword [rbp + 7], 0x50005
mov dword [rbp + 0xb], 0x16
sar edx, 3
mov qword [rbp + 0xf], 0x42
mov dword [rbp + 0x17], 0x49000b
mov eax, edx
mov dword [rbp + 0x1b], 0x100003
mov dword [rbp + 0x1f], 0x1f004f
shr eax, 0x1f
mov dword [rbp + 0x23], 0x1b000f
mov dword [rbp + 0x27], 0x1d
add edx, eax
mov dword [rbp + 0x2b], 0xc001d
mov dword [rbp + 0x2f], 0x1b0010
mov dword [rbp + 0x33], 0x1e
mov word [rbp + 0x37], bx
imul edx, edx, 0xe
sub r8d, edx
cmp r8d, 0xc
jne 0x1400523ad
mov eax, 0x38e38e39
mov r8d, ebx
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
mov edx, ecx
sub edx, eax
cmp edx, 0x9d
je 0x1400523a6
mov eax, ecx
inc r8d
or eax, 0xffffff2f
add ecx, eax
mov eax, ecx
imul eax, ecx
cmp r8d, eax
jg 0x1400523a6
mov eax, 0x38e38e39
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
mov edx, ecx
sub edx, eax
cmp edx, 0x9d
jne 0x140052371
mov dword [0x1401c4d60], r8d
lea rdx, [0x1401c0730]
lea r8, [0x1401bfd91]
nop dword [rax + rax]
movzx eax, byte [rbx + r8 - 1]
movzx ecx, word [rbp + rbx*2 - 7]
add rbx, 4
xor ax, word [rbp + rbx*2 - 0x11]
mov word [rdx + rbx*2 - 8], ax
movzx eax, byte [rbx + r8 - 4]
xor cx, ax
mov word [rdx + rbx*2 - 6], cx
movzx ecx, byte [rbx + r8 - 3]
xor cx, word [rbp + rbx*2 - 0xd]
mov word [rdx + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor cx, word [rbp + rbx*2 - 0xb]
mov word [rdx + rbx*2 - 2], cx
cmp rbx, 0x20
jl 0x1400523c0
mov byte [0x1401c69aa], 1
mov rax, rdx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400ce2d0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret
Function at 0x140052440
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401c69ba], 0
lea rax, [0x1401c05f8]
jne 0x140052540
xor r8d, r8d
mov dword [rbp - 0x30], 0x11
mov dword [rbp - 0x2c], 0x15002f
mov dword [rbp - 0x28], 0x170008
mov dword [rbp - 0x24], 0xc0014
mov dword [rbp - 0x20], 0x70003
mov word [rbp - 0xc], r8w
mov dword [rbp - 0x1c], 0x7002c
mov dword [rbp - 0x18], 0x11000a
mov dword [rbp - 0x14], 0x8001c
mov dword [rbp - 0x10], 0x36000d
lea r9, [0x1401bfd91]
nop dword [rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x2e]
add r8, 6
xor cx, word [rbp + r8*2 - 0x3c]
mov word [rax + r8*2 - 0xc], cx
movzx ecx, byte [r8 + r9 - 6]
xor dx, cx
movzx ecx, byte [r8 + r9 - 5]
xor cx, word [rbp + r8*2 - 0x38]
mov word [rax + r8*2 - 0xa], dx
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x36]
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x34]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x32]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x12
jl 0x1400524c0
mov byte [0x1401c69ba], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x30
pop rbp
ret

Function at 0x1400526a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401c699c], 0
je 0x1400526d9
lea rax, [0x1401c04f0]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x60
pop rbp
ret
mov eax, dword [0x1401c4d60]
mov qword [rsp + 0x70], rbx
xor ebx, ebx
mov ecx, eax
mov dword [rbp - 0x40], 0x90011
mov dword [rbp - 0x3c], 0x17001e
mov dword [rbp - 0x38], 0x3004d
mov dword [rbp - 0x34], 0xb000e
mov dword [rbp - 0x30], 0x490008
imul ecx, eax
imul ecx, eax
mov eax, 0x30c30c31
mov dword [rbp - 0x2c], 0x110010
mov dword [rbp - 0x28], 0x20010
mov dword [rbp - 0x24], 0x10017
mov dword [rbp - 0x20], 0x24001c
mov dword [rbp - 0x1c], 0x70005
imul ecx
sar edx, 2
mov dword [rbp - 0x18], 0x7001a
mov dword [rbp - 0x14], 0xf
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 3
jne 0x140052774
call fcn.1400cebc4
mov ecx, dword [0x1401c4d60]
cmp ecx, eax
jne 0x140052774
dec ecx
mov dword [0x1401c4d60], ecx
lea rax, [0x1401c04f0]
lea rdx, [0x1401bfd90]
movzx ecx, byte [rbx + rdx]
inc rbx
xor cx, word [rbp + rbx*2 - 0x42]
mov word [rax + rbx*2 - 2], cx
cmp rbx, 0x17
jl 0x140052782
mov byte [0x1401c699c], 1
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x60
pop rbp
ret
Function at 0x1400527c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401c698b], 0
je 0x1400527f5
lea rax, [0x1401c0b88]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x38
ret
xor edx, edx
mov dword [rsp], 0x1e001c
mov dword [rsp + 4], 0x3c0000
mov dword [rsp + 8], 0x150004
mov dword [rsp + 0xc], 0x3a0004
mov dword [rsp + 0x10], 0x18
mov word [rsp + 0x20], dx
mov dword [rsp + 0x14], 0x1001e
mov dword [rsp + 0x18], 0x1f0006
mov dword [rsp + 0x1c], 0x1b0007
lea r8, [0x1401c0b88]
lea r9, [0x1401bfd91]
nop dword [rax]
movzx eax, byte [rdx + r9 - 1]
movzx ecx, word [rsp + rdx*2 + 2]
add rdx, 4
xor ax, word [rsp + rdx*2 - 8]
mov word [r8 + rdx*2 - 8], ax
movzx eax, byte [rdx + r9 - 4]
xor cx, ax
mov word [r8 + rdx*2 - 6], cx
movzx ecx, byte [rdx + r9 - 3]
xor cx, word [rsp + rdx*2 - 4]
mov word [r8 + rdx*2 - 4], cx
movzx ecx, byte [rdx + r9 - 2]
xor cx, word [rsp + rdx*2 - 2]
mov word [r8 + rdx*2 - 2], cx
cmp rdx, 0x10
jl 0x140052850
mov byte [0x1401c698b], 1
mov rax, r8
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x38
ret
Function at 0x1400528c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp + 0x408], rax
cmp byte [0x1401c6990], 0
je 0x1400528f7
lea rax, [0x1401c0968]
jmp 0x140052b11
mov ecx, dword [0x1401c4d60]
mov qword [rsp + 0x538], r14
xor r14d, r14d
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
mov dword [rbp + 0x3d0], 0x18003d
mov dword [rbp + 0x3d4], 0xd0015
mov dword [rbp + 0x3d8], 0x17003d
mov dword [rbp + 0x3dc], 0x60008
imul r8d, eax
imul r8d, ecx
mov eax, 0x2aaaaaab
mov dword [rbp + 0x3e0], 0x1a0009
mov dword [rbp + 0x3e4], 0x300000
mov dword [rbp + 0x3e8], 0x1b000d
mov dword [rbp + 0x3ec], 0x10017
mov dword [rbp + 0x3f0], 0xf0048
imul r8d
sar edx, 1
mov dword [rbp + 0x3f4], 0xa000b
mov dword [rbp + 0x3f8], 0xe0003
mov eax, edx
mov dword [rbp + 0x3fc], 0x49000e
mov word [rbp + 0x400], r14w
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub r8d, eax
cmp r8d, 9
jne 0x140052a5e
mov qword [rsp + 0x520], rbx
mov qword [rsp + 0x528], rsi
mov qword [rsp + 0x530], rdi
lea rdi, [rsp + 0x20]
mov esi, r14d
nop dword [rax + rax]
mov r9d, r14d
nop word [rax + rax]
mov eax, ecx
lea r8d, [rsi + 1]
lea ebx, [r9 + 1]
cdq
idiv r8d
mov eax, ecx
sub eax, esi
mov r8d, edx
imul r8d, eax
mov eax, ecx
lea rcx, [0x14014d9a0]
cdq
idiv ebx
add r8d, eax
sub r8d, r9d
mov edx, r8d
call fcn.1400cf1dc
add rdi, 4
mov r9d, ebx
cmp ebx, 0xf
jge 0x140052a37
mov ecx, dword [0x1401c4d60]
jmp 0x1400529f0
inc esi
cmp esi, 0x14
jge 0x140052a46
mov ecx, dword [0x1401c4d60]
jmp 0x1400529e0
mov rsi, qword [rsp + 0x528]
mov rbx, qword [rsp + 0x520]
mov rdi, qword [rsp + 0x530]
lea rdx, [0x1401c0968]
lea r8, [0x1401bfd91]
nop dword [rax]
movzx eax, byte [r14 + r8 - 1]
movzx ecx, word [rbp + r14*2 + 0x3d2]
add r14, 6
xor ax, word [rbp + r14*2 + 0x3c4]
mov word [rdx + r14*2 - 0xc], ax
movzx eax, byte [r14 + r8 - 6]
xor cx, ax
movzx eax, byte [r14 + r8 - 5]
xor ax, word [rbp + r14*2 + 0x3c8]
mov word [rdx + r14*2 - 0xa], cx
movzx ecx, byte [r14 + r8 - 3]
xor cx, word [rbp + r14*2 + 0x3cc]
mov word [rdx + r14*2 - 8], ax
movzx eax, byte [r14 + r8 - 4]
xor ax, word [rbp + r14*2 + 0x3ca]
mov word [rdx + r14*2 - 4], cx
movzx ecx, byte [r14 + r8 - 2]
xor cx, word [rbp + r14*2 + 0x3ce]
mov word [rdx + r14*2 - 6], ax
mov word [rdx + r14*2 - 2], cx
cmp r14, 0x18
jl 0x140052a70
mov r14, qword [rsp + 0x538]
mov byte [0x1401c6990], 1
mov rax, rdx
mov rcx, qword [rbp + 0x408]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x510
pop rbp
ret
Function at 0x140052b30
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401c6992], 0
lea rax, [0x1401c0808]
jne 0x140052c1e
xor r8d, r8d
mov dword [rbp - 0x40], 0x1a0031
mov dword [rbp - 0x3c], 0x20015
mov dword [rbp - 0x38], 0x19
mov dword [rbp - 0x34], 0x35
mov dword [rbp - 0x30], 0x60001
mov word [rbp - 0x18], r8w
mov dword [rbp - 0x2c], 0x10007
mov dword [rbp - 0x28], 0x180036
mov dword [rbp - 0x24], 0xa0000
mov dword [rbp - 0x20], 0xd0009
mov dword [rbp - 0x1c], 0x430050
lea r9, [0x1401bfd91]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 5
xor cx, word [rbp + r8*2 - 0x4a]
mov word [rax + r8*2 - 0xa], cx
movzx ecx, byte [r8 + r9 - 5]
xor dx, cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 8], dx
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x14
jl 0x140052bb0
mov byte [0x1401c6992], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x40
pop rbp
ret

Function at 0x140052c30
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp - 8], rax
mov eax, dword [0x1401c4d60]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 0x11
jne 0x140052c87
call fcn.1400cebc4
mov ecx, dword [0x1401c4d60]
cmp ecx, eax
jne 0x140052c87
dec ecx
mov dword [0x1401c4d60], ecx
cmp byte [0x1401c6989], 0
lea rax, [0x1401c08c0]
jne 0x140052d6e
mov dword [rbp - 0x40], 0x1c003c
mov dword [rbp - 0x3c], 0xf0031
mov dword [rbp - 0x38], 0xa0001
mov dword [rbp - 0x34], 0x40004
mov dword [rbp - 0x30], 0xc0018
mov dword [rbp - 0x2c], 0xd0025
mov dword [rbp - 0x28], 0x40010
mov dword [rbp - 0x24], 0xe0007
mov dword [rbp - 0x20], 0x240004
mov dword [rbp - 0x1c], 0xe000f
xor r8d, r8d
mov dword [rbp - 0x18], 0x190000
mov dword [rbp - 0x14], 0x530013
mov dword [rbp - 0x10], 0x50
lea r9, [0x1401bfd91]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x3e]
add r8, 5
xor cx, word [rbp + r8*2 - 0x4a]
mov word [rax + r8*2 - 0xa], cx
movzx ecx, byte [r8 + r9 - 5]
xor dx, cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x46]
mov word [rax + r8*2 - 8], dx
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x19
jl 0x140052d00
mov byte [0x1401c6989], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x60
pop rbp
ret
Function at 0x140052f30
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401c69ab], 0
lea rax, [0x1401c0340]
jne 0x14005302c
xor r8d, r8d
mov dword [rbp - 0x50], 0x7003e
mov dword [rbp - 0x4c], 0x8001f
mov dword [rbp - 0x48], 0x150018
mov dword [rbp - 0x44], 0x170037
mov dword [rbp - 0x40], 0x1f0005
mov word [rbp - 0x18], r8w
mov dword [rbp - 0x3c], 0x8001a
mov dword [rbp - 0x38], 0x170007
mov dword [rbp - 0x34], 0x390017
mov dword [rbp - 0x30], 0x50009
mov dword [rbp - 0x2c], 0x6001f
mov dword [rbp - 0x28], 0xd004f
mov dword [rbp - 0x24], 0xb
mov dword [rbp - 0x20], 0xc001c
mov dword [rbp - 0x1c], 0x4d0017
lea r9, [0x1401bfd91]
nop dword [rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x4e]
add r8, 4
xor cx, word [rbp + r8*2 - 0x58]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x54]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x52]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x1c
jl 0x140052fd0
mov byte [0x1401c69ab], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x50
pop rbp
ret

Function at 0x140053040
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x100
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rsp + 0xf0], rax
cmp byte [0x1401c69b6], 0
je 0x140053070
lea rax, [0x1401c0a90]
jmp 0x140053199
xor edx, edx
mov dword [rsp + 0xd0], 0x2c0054
mov dword [rsp + 0xd4], 0xf001c
mov dword [rsp + 0xd8], 0x3b
mov dword [rsp + 0xdc], 0x160015
mov dword [rsp + 0xe0], 0x60005
mov word [rsp + 0xe8], dx
mov dword [rsp + 0xe4], 0x59001d
lea rbx, [0x1401c0a90]
lea r8, [0x1401bfd91]
nop word [rax + rax]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rsp + rdx*2 + 0xd2]
add rdx, 6
xor ax, word [rsp + rdx*2 + 0xc4]
mov word [rbx + rdx*2 - 0xc], ax
movzx eax, byte [rdx + r8 - 6]
xor cx, ax
movzx eax, byte [rdx + r8 - 5]
xor ax, word [rsp + rdx*2 + 0xc8]
mov word [rbx + rdx*2 - 0xa], cx
mov word [rbx + rdx*2 - 8], ax
movzx eax, byte [rdx + r8 - 4]
xor ax, word [rsp + rdx*2 + 0xca]
mov word [rbx + rdx*2 - 6], ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rsp + rdx*2 + 0xcc]
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rsp + rdx*2 + 0xce]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0xc
jl 0x1400530d0
mov ecx, dword [0x1401c4d60]
mov byte [0x1401c69b6], 1
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x38e38e39
imul r8d, ecx
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*8]
add ecx, ecx
sub r8d, ecx
cmp r8d, 1
jne 0x140053196
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov rax, rbx
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x100
pop rbx
ret