joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400533a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rsp + 0x18], rax
cmp byte [0x1401bf56b], 0
lea rax, [0x1401b9958]
jne 0x14005341f
mov dword [rsp], 0xa0014
mov dword [rsp + 4], 0x19001d
mov dword [rsp + 8], 0xc
xor ecx, ecx
mov dword [rsp + 0xc], 0x410000
mov dword [rsp + 0x10], 0x2000f
mov dword [rsp + 0x14], 0x1b
lea r8, [0x1401b8da0]
nop dword [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 - 2]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0xb
jl 0x140053400
mov byte [0x1401bf56b], 1
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x28
ret

Function at 0x140053440
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rsp + 0x20], rax
cmp byte [0x1401bf55d], 0
lea rax, [0x1401b9b40]
jne 0x14005351e
mov dword [rsp], 0x1f002d
mov dword [rsp + 4], 0x4000a
mov dword [rsp + 8], 0x1d0035
mov dword [rsp + 0xc], 0x20001
mov dword [rsp + 0x10], 0x3000f
mov dword [rsp + 0x14], 0x52001a
mov dword [rsp + 0x18], 0x1f0004
mov dword [rsp + 0x1c], 2
xor r8d, r8d
lea r9, [0x1401b8da1]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rsp + r8*2 + 2]
add r8, 5
xor cx, word [rsp + r8*2 - 0xa]
mov word [rax + r8*2 - 0xa], cx
movzx ecx, byte [r8 + r9 - 5]
xor dx, cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rsp + r8*2 - 6]
mov word [rax + r8*2 - 8], dx
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rax + r8*2 - 2], cx
cmp r8, 0xf
jl 0x1400534b0
mov byte [0x1401bf55d], 1
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x38
ret
Function at 0x140053530
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, dword [0x1401bdd80]
mov eax, 0x2aaaaaab
xor ebx, ebx
imul ecx, ecx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 7
jne 0x1400535c9
mov qword [r11 + 8], rsi
lea ecx, [rbx + 0x28]
mov qword [r11 + 0x10], rdi
call fcn.1400cb128
mov edi, ebx
mov rsi, rax
nop dword [rax + rax]
call fcn.1400cc4a0
inc rdi
add eax, dword [0x1401bdd80]
mov dword [rsi + rdi*4 - 4], eax
cmp rdi, 0xa
jl 0x140053590
mov ecx, dword [rsi + 0x24]
mov dword [0x1401bdd80], ecx
mov rcx, rsi
call fcn.1400cc208
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
cmp byte [0x1401bf54d], bl
lea rax, [0x1401b9820]
jne 0x140053671
mov dword [rbp - 0x50], 0x1d0021
mov dword [rbp - 0x4c], 0xb000a
mov dword [rbp - 0x48], 0xa0011
mov dword [rbp - 0x44], 0xe003a
mov dword [rbp - 0x40], 0x1c0005
mov dword [rbp - 0x3c], 0x170001
mov dword [rbp - 0x38], 0x1a000b
mov dword [rbp - 0x34], 0x570043
mov dword [rbp - 0x30], 0x10037
mov dword [rbp - 0x2c], 0x1c0008
mov dword [rbp - 0x28], 0xf0012
mov dword [rbp - 0x24], 0x1d0004
mov dword [rbp - 0x20], 0x140045
mov dword [rbp - 0x1c], 0xf0014
mov dword [rbp - 0x18], 0x8001c
mov dword [rbp - 0x14], 3
lea rdx, [0x1401b8da0]
movzx ecx, byte [rbx + rdx]
inc rbx
xor cx, word [rbp + rbx*2 - 0x52]
mov word [rax + rbx*2 - 2], cx
cmp rbx, 0x1f
jl 0x140053653
mov byte [0x1401bf54d], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cbae0
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rbp
ret
Function at 0x140053690
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r8d, dword [0x1401bdd80]
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 8
jne 0x1400536ff
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov r8d, dword [0x1401bdd80]
mov ecx, 7
test rax, rax
cmove r8d, ecx
mov dword [0x1401bdd80], r8d
cmp byte [0x1401bf552], 0
je 0x140053721
lea rax, [0x1401b94a0]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x60
pop rbp
ret
lea ecx, [r8 + 1]
mov eax, 0x30c30c31
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 3
jne 0x14005374c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
xor r8d, r8d
mov dword [rbp - 0x40], 0x1d0035
mov dword [rbp - 0x3c], 0x1e0006
mov dword [rbp - 0x38], 0x3f0000
mov dword [rbp - 0x34], 0xe001c
mov dword [rbp - 0x30], 0x150009
mov word [rbp - 0x18], r8w
mov dword [rbp - 0x2c], 0x1001a
mov dword [rbp - 0x28], 0xf002a
mov dword [rbp - 0x24], 0xa001d
mov dword [rbp - 0x20], 0x160016
mov dword [rbp - 0x1c], 0x4c0053
lea rdx, [0x1401b94a0]
lea r9, [0x1401b8da1]
nop dword [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rbp + r8*2 - 0x3e]
add r8, 5
xor ax, word [rbp + r8*2 - 0x4a]
mov word [rdx + r8*2 - 0xa], ax
movzx eax, byte [r8 + r9 - 5]
xor cx, ax
movzx eax, byte [r8 + r9 - 4]
xor ax, word [rbp + r8*2 - 0x46]
mov word [rdx + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x44]
mov word [rdx + r8*2 - 6], ax
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x42]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0x14
jl 0x1400537b0
mov byte [0x1401bf552], 1
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x60
pop rbp
ret
Function at 0x140053840
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xb8
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rsp + 0xa8], rax
cmp byte [0x1401bf57f], 0
je 0x140053881
lea rax, [0x1401b9638]
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0xb8
ret
call fcn.14004f3f0
xor r9d, r9d
test al, al
jne 0x1400538c0
mov eax, dword [0x1401bdd80]
mov edx, r9d
lea r8, [rsp + 0x20]
nop dword [rax + rax]
mov ecx, dword [r8]
inc edx
lea r8, [r8 + 4]
imul ecx, ecx, 0xa8
add eax, ecx
movsxd rcx, edx
cmp rcx, 0x5c
jb 0x1400538a0
mov dword [0x1401bdd80], eax
mov dword [rsp + 0x80], 0xa0014
mov dword [rsp + 0x84], 0x19001d
mov dword [rsp + 0x88], 0xc
mov dword [rsp + 0x8c], 0x5b0000
mov dword [rsp + 0x90], 0x40004a
mov dword [rsp + 0x94], 0x420047
mov dword [rsp + 0x98], 0x5a0049
mov dword [rsp + 0x9c], 0x55005e
mov word [rsp + 0xa0], r9w
lea rdx, [0x1401b9638]
lea r8, [0x1401b8da1]
nop
movzx eax, byte [r9 + r8 - 1]
movzx ecx, word [rsp + r9*2 + 0x82]
add r9, 4
xor ax, word [rsp + r9*2 + 0x78]
mov word [rdx + r9*2 - 8], ax
movzx eax, byte [r9 + r8 - 4]
xor cx, ax
mov word [rdx + r9*2 - 6], cx
movzx ecx, byte [r9 + r8 - 3]
xor cx, word [rsp + r9*2 + 0x7c]
mov word [rdx + r9*2 - 4], cx
movzx ecx, byte [r9 + r8 - 2]
xor cx, word [rsp + r9*2 + 0x7e]
mov word [rdx + r9*2 - 2], cx
cmp r9, 0x10
jl 0x140053930
mov byte [0x1401bf57f], 1
mov rax, rdx
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0xb8
ret
Function at 0x1400539b0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbx
push r15
sub rsp, 0x58
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r15d, dword [0x1401bdd80]
mov eax, 0x38e38e39
xor ebx, ebx
lea ecx, [r15 + 1]
imul ecx, r15d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 3
jne 0x140053aaa
mov qword [r11 + 8], rbp
mov qword [r11 + 0x10], rsi
mov eax, r15d
cdq
mov qword [r11 + 0x18], rdi
mov qword [r11 - 0x18], r14
sub eax, edx
mov r10d, 0xf6
mov ebp, ebx
sar eax, 1
mov r14d, eax
nop
test r14d, r14d
jle 0x140053a8c
mov eax, r15d
mov r11d, ebx
mov rsi, r14
cdq
and edx, 3
lea edi, [rdx + rax]
sar edi, 2
nop dword [rax + rax]
mov r8d, ebx
mov r9d, ebx
mov edx, ebx
cmp edi, 2
jl 0x140053a71
lea edx, [rdi - 2]
mov ecx, r11d
shr edx, 1
inc edx
mov eax, edx
add edx, edx
nop dword [rax + rax]
dec r9d
add r8d, ecx
add r9d, ecx
sub ecx, 2
dec rax
jne 0x140053a60
cmp edx, edi
jge 0x140053a7d
mov eax, r11d
sub eax, edx
add r10d, eax
lea eax, [r9 + r8]
add r11d, ebp
add r10d, eax
dec rsi
jne 0x140053a40
inc ebp
cmp ebp, r10d
jl 0x140053a20
mov r14, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
cmp byte [0x1401bf55a], bl
je 0x140053abe
lea rax, [0x1401b9618]
jmp 0x140053ba7
mov ecx, r15d
mov eax, 0x6bca1af3
mov dword [rsp + 0x20], 0x2000b
mov dword [rsp + 0x24], 0xd000e
mov qword [rsp + 0x28], 0x4f0000
mov dword [rsp + 0x30], 0x150007
imul ecx, r15d
imul ecx, r15d
imul ecx
sar edx, 3
mov dword [rsp + 0x34], 0x10049
mov dword [rsp + 0x38], 0x60002
mov eax, edx
mov dword [rsp + 0x3c], 0x16
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 0xd
jne 0x140053b28
call fcn.1400cc4a0
mov dword [0x1401bdd80], eax
lea rdx, [0x1401b9618]
lea r8, [0x1401b8da1]
nop word [rax + rax]
movzx eax, byte [rbx + r8 - 1]
movzx ecx, word [rsp + rbx*2 + 0x22]
add rbx, 5
xor ax, word [rsp + rbx*2 + 0x16]
mov word [rdx + rbx*2 - 0xa], ax
movzx eax, byte [rbx + r8 - 5]
xor cx, ax
movzx eax, byte [rbx + r8 - 4]
xor ax, word [rsp + rbx*2 + 0x1a]
mov word [rdx + rbx*2 - 8], cx
movzx ecx, byte [rbx + r8 - 3]
xor cx, word [rsp + rbx*2 + 0x1c]
mov word [rdx + rbx*2 - 6], ax
mov word [rdx + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor cx, word [rsp + rbx*2 + 0x1e]
mov word [rdx + rbx*2 - 2], cx
cmp rbx, 0xf
jl 0x140053b40
mov byte [0x1401bf55a], 1
mov rax, rdx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x58
pop r15
pop rbx
ret
Function at 0x140053c30
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401bf579], 0
je 0x140053c69
lea rax, [0x1401b9c40]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 0x78], rdi
xor edi, edi
mov dword [rbp - 0x40], 0xe0001
mov dword [rbp - 0x3c], 0x1e0001
mov dword [rbp - 0x38], 0xe0045
mov dword [rbp - 0x34], 0xd0002
mov word [rbp - 0x10], di
mov dword [rbp - 0x30], 0x130005
mov dword [rbp - 0x2c], 0x1d0049
mov dword [rbp - 0x28], 0x1e0012
mov dword [rbp - 0x24], 0xa0050
mov dword [rbp - 0x20], 0x4f0002
mov r9d, 4
mov dword [rbp - 0x1c], 0x90004
mov dword [rbp - 0x18], 0x8000c
mov dword [rbp - 0x14], 0x100019
call fcn.14004f300
test al, al
jne 0x140053d01
mov ecx, r9d
mov qword [rsp + 0x70], rbx
call fcn.1400cc2a0
mov rbx, rax
call fcn.1400cc4a0
mov rcx, rbx
mov dword [rbx], eax
mov dword [0x1401bdd80], eax
call fcn.1400cbac0
mov rbx, qword [rsp + 0x70]
lea rax, [0x1401b9c40]
lea r8, [0x1401b8da1]
nop
movzx ecx, byte [rdi + r8 - 1]
movzx edx, word [rbp + rdi*2 - 0x3e]
add rdi, 6
xor cx, word [rbp + rdi*2 - 0x4c]
mov word [rax + rdi*2 - 0xc], cx
movzx ecx, byte [rdi + r8 - 6]
xor dx, cx
movzx ecx, byte [rdi + r8 - 5]
xor cx, word [rbp + rdi*2 - 0x48]
mov word [rax + rdi*2 - 0xa], dx
mov word [rax + rdi*2 - 8], cx
movzx ecx, byte [rdi + r8 - 4]
xor cx, word [rbp + rdi*2 - 0x46]
mov word [rax + rdi*2 - 6], cx
movzx ecx, byte [rdi + r8 - 3]
xor cx, word [rbp + rdi*2 - 0x44]
mov word [rax + rdi*2 - 4], cx
movzx ecx, byte [rdi + r8 - 2]
xor cx, word [rbp + rdi*2 - 0x42]
mov word [rax + rdi*2 - 2], cx
cmp rdi, 0x18
jl 0x140053d10
mov byte [0x1401bf579], 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x60
pop rbp
ret
Function at 0x140053da0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r8d, dword [0x1401bdd80]
mov eax, 0x38e38e39
lea ecx, [r8 + 1]
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 3
jne 0x140053e06
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0xcccccccd
mul r8d
shr edx, 6
lea ecx, [rdx + rdx*4]
shl ecx, 4
sub r8d, ecx
inc r8d
mov dword [0x1401bdd80], r8d
imul r8d, r8d
mov eax, 0x38e38e39
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 3
jne 0x140053e55
lea ecx, [r8 + 1]
mov qword [rsp + 0x50], rbx
call fcn.1400cc2a0
mov rbx, rax
call fcn.1400cc4a0
mov rcx, rbx
mov dword [rbx], eax
mov dword [0x1401bdd80], eax
call fcn.1400cbac0
mov rbx, qword [rsp + 0x50]
cmp byte [0x1401bf548], 0
lea rax, [0x1401b9ab8]
jne 0x140053edf
mov dword [rsp + 0x20], 0xa0030
mov dword [rsp + 0x24], 0xe000e
mov dword [rsp + 0x28], 0x1d0035
mov dword [rsp + 0x2c], 0x20001
mov dword [rsp + 0x30], 0x3000f
mov dword [rsp + 0x34], 0x3f001a
mov dword [rsp + 0x38], 0x70002
mov dword [rsp + 0x3c], 0x17001f
mov dword [rsp + 0x40], 0x55001d
mov dword [rsp + 0x44], 0x49
xor ecx, ecx
lea r8, [0x1401b8da0]
nop
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 + 0x1e]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x13
jl 0x140053ec0
mov byte [0x1401bf548], 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x58
ret

Function at 0x140053f00
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ecx, dword [0x1401bdd80]
mov eax, 0xb21642c9
xor ebx, ebx
imul ecx, ecx
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 0x16
jne 0x140053f52
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
cmp byte [0x1401bf55c], bl
lea rax, [0x1401b9390]
jne 0x140053fe4
mov dword [rsp + 0x30], 0xc
mov dword [rsp + 0x34], 0xb0019
mov dword [rsp + 0x38], 0xa0048
mov dword [rsp + 0x3c], 0x13001c
mov dword [rsp + 0x40], 0x20005
mov dword [rsp + 0x44], 0x150047
mov dword [rsp + 0x48], 0xc000e
mov word [rsp + 0x4c], bx
lea r8, [0x1401b8da1]
nop dword [rax]
movzx ecx, byte [rbx + r8 - 1]
movzx edx, word [rsp + rbx*2 + 0x32]
add rbx, 2
xor cx, word [rsp + rbx*2 + 0x2c]
mov word [rax + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor dx, cx
mov word [rax + rbx*2 - 2], dx
cmp rbx, 0xe
jl 0x140053fb0
mov byte [0x1401bf55c], 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x60
pop rbx
ret
Function at 0x140054000
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x330]
sub rsp, 0x430
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp + 0x320], rax
cmp byte [0x1401bf55b], 0
je 0x140054037
lea rax, [0x1401b9748]
jmp 0x140054168
xor r8d, r8d
mov qword [rsp + 0x440], rbx
mov dword [rbp + 0x2f0], 0xa0005
mov dword [rbp + 0x2f4], 0x27001b
mov dword [rbp + 0x2f8], 0xb000a
mov dword [rbp + 0x2fc], 0xd001b
mov word [rbp + 0x31c], r8w
mov eax, r8d
mov dword [rbp + 0x300], 0x38000f
mov dword [rbp + 0x304], 0x1c0008
mov dword [rbp + 0x308], 0x60003
mov dword [rbp + 0x30c], 0x2b0015
mov dword [rbp + 0x310], 0xb0030
mov dword [rbp + 0x314], 5
mov dword [rbp + 0x318], 0x47005b
lea r11, [0x1401b9748]
lea r9, [0x1401b8da1]
nop dword [rax]
movzx ecx, byte [rax + r9 - 1]
movzx edx, word [rbp + rax*2 + 0x2f2]
add rax, 2
xor cx, word [rbp + rax*2 + 0x2ec]
mov word [r11 + rax*2 - 4], cx
movzx ecx, byte [rax + r9 - 2]
xor dx, cx
mov word [r11 + rax*2 - 2], dx
cmp rax, 0x16
jl 0x1400540d0
mov ebx, dword [0x1401bdd80]
mov eax, 0x2aaaaaab
mov ecx, ebx
imul ecx, ebx
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 8
jne 0x140054156
lea r9, [rsp]
mov r10d, ebx
nop word [rax + rax]
inc r8d
dec r10d
lea r9, [r9 + 4]
movsxd rcx, r8d
cmp rcx, 0xfb
jb 0x140054140
mov rbx, qword [rsp + 0x440]
mov byte [0x1401bf55b], 1
mov rax, r11
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x430
pop rbp
ret
Function at 0x140054180
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x1401bf570], 0
je 0x1400541b0
lea rax, [0x1401b9308]
jmp 0x1400542c5
mov dword [rbp - 0x40], 0x19000c
mov dword [rbp - 0x3c], 0x35001f
mov dword [rbp - 0x38], 0x10010
mov dword [rbp - 0x34], 0x19000b
mov dword [rbp - 0x30], 0x15001a
mov dword [rbp - 0x2c], 0x6000a
mov dword [rbp - 0x28], 0xe0002
mov dword [rbp - 0x24], 0x9002f
mov dword [rbp - 0x20], 0xc000b
mov dword [rbp - 0x1c], 8
xor edx, edx
mov dword [rbp - 0x18], 0xf003e
mov dword [rbp - 0x14], 0x5000a
mov dword [rbp - 0x10], 0x11
lea rbx, [0x1401b9308]
lea r8, [0x1401b8da1]
nop dword [rax + rax]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rbp + rdx*2 - 0x3e]
add rdx, 5
xor ax, word [rbp + rdx*2 - 0x4a]
mov word [rbx + rdx*2 - 0xa], ax
movzx eax, byte [rdx + r8 - 5]
xor cx, ax
movzx eax, byte [rdx + r8 - 4]
xor ax, word [rbp + rdx*2 - 0x46]
mov word [rbx + rdx*2 - 8], cx
mov word [rbx + rdx*2 - 6], ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rbp + rdx*2 - 0x44]
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rbp + rdx*2 - 0x42]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0x19
jl 0x140054220
mov eax, dword [0x1401bdd80]
mov byte [0x1401bf570], 1
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 0x11
jne 0x1400542c2
call fcn.1400cc4a0
mov ecx, dword [0x1401bdd80]
cmp ecx, eax
jne 0x1400542c2
dec ecx
mov dword [0x1401bdd80], ecx
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400cbae0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x1400542e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.14004f300
cmp byte [0x1401bf554], 0
je 0x14005431d
lea rax, [0x1401b9c00]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x50
pop rbx
ret
mov dword [rsp + 0x20], 0x2e0034
mov dword [rsp + 0x24], 0x60003
mov dword [rsp + 0x28], 0xc000a
mov dword [rsp + 0x2c], 0x19002b
mov dword [rsp + 0x30], 0x3e0058
mov dword [rsp + 0x34], 0x5f001d
mov dword [rsp + 0x38], 0x1f0034
mov dword [rsp + 0x3c], 0x60013
mov dword [rsp + 0x40], 0x1c0001
mov dword [rsp + 0x44], 0x1a
xor eax, eax
lea rbx, [0x1401b9c00]
lea rdx, [0x1401b8da0]
nop dword [rax]
movzx ecx, byte [rax + rdx]
inc rax
xor cx, word [rsp + rax*2 + 0x1e]
mov word [rbx + rax*2 - 2], cx
cmp rax, 0x13
jl 0x140054380
mov ecx, dword [0x1401bdd80]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x2aaaaaab
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
shl ecx, 3
sub r8d, ecx
cmp r8d, 0xb
jne 0x1400543d5
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov byte [0x1401bf554], 1
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x50
pop rbx
ret
Function at 0x140054400
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp byte [0x1401bf55f], 0
je 0x140054438
lea rax, [0x1401b99b0]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x50
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x20], 0xe0012
mov dword [rsp + 0x24], 0xf001d
mov dword [rsp + 0x28], 0x1b000b
mov dword [rsp + 0x2c], 0x11004e
mov word [rsp + 0x40], dx
mov dword [rsp + 0x30], 0x1f0018
mov dword [rsp + 0x34], 0x52000a
mov dword [rsp + 0x38], 0xb0009
mov dword [rsp + 0x3c], 0x1d
lea rbx, [0x1401b99b0]
lea r8, [0x1401b8da1]
nop word [rax + rax]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rsp + rdx*2 + 0x22]
add rdx, 4
xor ax, word [rsp + rdx*2 + 0x18]
mov word [rbx + rdx*2 - 8], ax
movzx eax, byte [rdx + r8 - 4]
xor cx, ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rsp + rdx*2 + 0x1c]
mov word [rbx + rdx*2 - 6], cx
mov word [rbx + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rsp + rdx*2 + 0x1e]
mov word [rbx + rdx*2 - 2], ax
cmp rdx, 0x10
jl 0x1400544a0
mov r9d, dword [0x1401bdd80]
or rdi, 0xffffffffffffffff
lea eax, [r9 + 1]
lea ecx, [r9 + 2]
imul ecx, eax
mov eax, 0x38e38e39
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 2
jne 0x140054566
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 4
imul edx, edx, 0x64
sub r9d, edx
add r9d, 0x7b
movsxd rcx, r9d
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.1400cb128
mov rcx, rax
call fcn.1400cc208
mov r9d, dword [0x1401bdd80]
lea eax, [r9 + 1]
lea r8d, [r9 + 2]
mov byte [0x1401bf55f], 1
imul r8d, eax
mov eax, 0x78787879
imul r8d, r9d
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x11
sub r8d, edx
cmp r8d, 5
jne 0x1400545d6
mov eax, 0x51eb851f
imul r9d
mov eax, 4
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x64
sub r9d, edx
add r9d, 0x63
movsxd rcx, r9d
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.1400cb128
mov rcx, rax
call fcn.1400cc208
mov rax, rbx
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x50
pop rbx
ret
Function at 0x140054680
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r8d, dword [0x1401bdd80]
lea eax, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, eax
mov eax, 0x55555556
imul ecx, r8d
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub ecx, eax
cmp ecx, 1
jne 0x1400546cb
dec r8d
mov dword [0x1401bdd80], r8d
cmp byte [0x1401bf580], 0
je 0x1400546ed
lea rax, [0x1401b9478]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x38
ret
xor r8d, r8d
mov dword [rsp], 0x1f002d
mov dword [rsp + 4], 0x4000a
mov dword [rsp + 8], 0x1d0035
mov dword [rsp + 0xc], 0x20001
mov dword [rsp + 0x10], 0x3000f
mov word [rsp + 0x20], r8w
mov dword [rsp + 0x14], 0x52001a
mov dword [rsp + 0x18], 0xf0014
mov dword [rsp + 0x1c], 0x3001c
lea rdx, [0x1401b9478]
lea r9, [0x1401b8da1]
nop word [rax + rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 2]
add r8, 4
xor ax, word [rsp + r8*2 - 8]
mov word [rdx + r8*2 - 8], ax
movzx eax, byte [r8 + r9 - 4]
xor cx, ax
mov word [rdx + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0x10
jl 0x140054750
mov byte [0x1401bf580], 1
mov rax, rdx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400cbae0
add rsp, 0x38
ret