joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005d350
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rsp + 0x20], rax
cmp byte [0x1401dfd08], 0
je 0x14005d385
lea rax, [0x1401d9870]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x38
ret
mov dword [rsp], 0x40027
mov dword [rsp + 4], 0xb0007
mov dword [rsp + 8], 0x1e003b
mov dword [rsp + 0xc], 0x9000e
mov dword [rsp + 0x10], 0x1a0010
mov dword [rsp + 0x14], 0x45001d
mov dword [rsp + 0x18], 0x190008
mov dword [rsp + 0x1c], 0x13
xor edx, edx
lea r9, [0x1401d9870]
lea r8, [0x1401d8d91]
nop word [rax + rax]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rsp + rdx*2 + 2]
add rdx, 5
xor ax, word [rsp + rdx*2 - 0xa]
mov word [r9 + rdx*2 - 0xa], ax
movzx eax, byte [rdx + r8 - 5]
xor cx, ax
movzx eax, byte [rdx + r8 - 4]
xor ax, word [rsp + rdx*2 - 6]
mov word [r9 + rdx*2 - 8], cx
mov word [r9 + rdx*2 - 6], ax
movzx eax, byte [rdx + r8 - 3]
xor ax, word [rsp + rdx*2 - 4]
mov word [r9 + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor ax, word [rsp + rdx*2 - 2]
mov word [r9 + rdx*2 - 2], ax
cmp rdx, 0xf
jl 0x14005d3e0
mov r8d, dword [0x1401ddd80]
mov eax, 0x38e38e39
lea ecx, [r8 + 1]
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 3
jne 0x14005d495
mov ecx, 1
cmp r8d, ecx
jle 0x14005d48f
nop dword [rax + rax]
mov eax, r8d
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, r8d
jl 0x14005d480
mov dword [0x1401ddd80], ecx
mov byte [0x1401dfd08], 1
mov rax, r9
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x38
ret

Function at 0x14005d4c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, dword [0x1401ddd80]
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x66666667
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub r8d, eax
cmp r8d, 7
jne 0x14005d514
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp byte [0x1401dfd12], 0
lea rax, [0x1401d9ac0]
jne 0x14005d5c0
mov dword [rbp - 0x50], 0x6002b
mov dword [rbp - 0x4c], 0x40007
mov dword [rbp - 0x48], 0x9001f
mov dword [rbp - 0x44], 0x50035
mov dword [rbp - 0x40], 0x5001a
mov dword [rbp - 0x3c], 6
xor ecx, ecx
mov dword [rbp - 0x38], 0x1c0007
mov dword [rbp - 0x34], 0x550052
mov dword [rbp - 0x30], 0xf0023
mov dword [rbp - 0x2c], 0x30009
mov dword [rbp - 0x28], 0xb0007
mov dword [rbp - 0x24], 0x13001b
mov dword [rbp - 0x20], 0x170052
mov dword [rbp - 0x1c], 0x20008
mov dword [rbp - 0x18], 0xb0018
mov dword [rbp - 0x14], 0x15
lea r8, [0x1401d8d90]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rbp + rcx*2 - 0x52]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x1f
jl 0x14005d5a1
mov byte [0x1401dfd12], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x70
pop rbp
ret
Function at 0x14005d5e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, dword [0x1401ddd80]
xor edi, edi
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x66666667
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub r8d, eax
cmp r8d, 7
jne 0x14005d652
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov ecx, dword [0x1401ddd80]
cmp byte [0x1401dfd39], dil
mov qword [rsp + 0x80], rbx
je 0x14005d66f
lea rax, [0x1401d9b90]
jmp 0x14005d775
mov dword [rbp - 0x40], 0x6003f
mov dword [rbp - 0x3c], 0x11000b
mov dword [rbp - 0x38], 0x3c000e
mov dword [rbp - 0x34], 0x50013
mov dword [rbp - 0x30], 0xc0016
mov dword [rbp - 0x2c], 0x16001d
mov dword [rbp - 0x28], 0x90026
mov dword [rbp - 0x24], 0x8000c
mov dword [rbp - 0x20], 0x180002
mov dword [rbp - 0x1c], 0x530052
mov word [rbp - 0x18], di
lea rbx, [0x1401d9b90]
lea r8, [0x1401d8d91]
nop word [rax + rax]
movzx eax, byte [rdi + r8 - 1]
movzx edx, word [rbp + rdi*2 - 0x3e]
add rdi, 5
xor ax, word [rbp + rdi*2 - 0x4a]
mov word [rbx + rdi*2 - 0xa], ax
movzx eax, byte [rdi + r8 - 5]
xor dx, ax
movzx eax, byte [rdi + r8 - 4]
xor ax, word [rbp + rdi*2 - 0x46]
mov word [rbx + rdi*2 - 8], dx
mov word [rbx + rdi*2 - 6], ax
movzx eax, byte [rdi + r8 - 3]
xor ax, word [rbp + rdi*2 - 0x44]
mov word [rbx + rdi*2 - 4], ax
movzx eax, byte [rdi + r8 - 2]
xor ax, word [rbp + rdi*2 - 0x42]
mov word [rbx + rdi*2 - 2], ax
cmp rdi, 0x14
jl 0x14005d6d0
imul ecx, ecx
and ecx, 0x80000003
jge 0x14005d73f
dec ecx
or ecx, 0xfffffffc
inc ecx
cmp ecx, 2
jne 0x14005d76b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0xcccccccd
mul r8d
shr edx, 6
lea ecx, [rdx + rdx*4]
shl ecx, 4
sub r8d, ecx
inc r8d
mov dword [0x1401ddd80], r8d
mov byte [0x1401dfd39], 1
mov rax, rbx
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d72a0
mov rdi, qword [rsp + 0x88]
add rsp, 0x70
pop rbp
ret
Function at 0x14005d7a0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push rdi
sub rsp, 0x70
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r11d, dword [0x1401ddd80]
mov eax, 0xb21642c9
xor edi, edi
lea ecx, [r11 + 1]
imul ecx, r11d
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 8
jne 0x14005d840
lea ecx, [rdi + 0x28]
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rsi
call fcn.1400d68e8
mov ebx, edi
mov rsi, rax
call fcn.1400d7b94
inc rbx
add eax, dword [0x1401ddd80]
mov dword [rsi + rbx*4 - 4], eax
cmp rbx, 0xa
jl 0x14005d800
mov ecx, dword [rsi + 0x24]
mov dword [0x1401ddd80], ecx
mov rcx, rsi
call fcn.1400d834c
mov r11d, dword [0x1401ddd80]
mov rsi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
lea ecx, [r11 + 1]
mov eax, 0xb21642c9
imul ecx, r11d
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 8
jne 0x14005d891
mov r8d, edi
lea r9, [rsp + 0x20]
mov r10d, r11d
mov eax, r10d
lea ecx, [r11 + r8]
inc r8d
cdq
dec r10d
lea r9, [r9 + 4]
idiv ecx
movsxd rax, r8d
mov dword [r9 - 4], edx
cmp rax, 0xf
jb 0x14005d870
cmp byte [0x1401dfd24], dil
je 0x14005d8b4
lea rax, [0x1401d9388]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x70
pop rdi
ret
mov dword [rsp + 0x20], 0x11001e
mov dword [rsp + 0x24], 0x160010
mov dword [rsp + 0x28], 0x30002
mov dword [rsp + 0x2c], 0x50000f
mov dword [rsp + 0x30], 0x590055
mov dword [rsp + 0x34], 0x550040
mov dword [rsp + 0x38], 0x5c0045
mov dword [rsp + 0x3c], 0x57004f
mov word [rsp + 0x40], di
lea rdx, [0x1401d9388]
lea r8, [0x1401d8d91]
nop word [rax + rax]
movzx eax, byte [rdi + r8 - 1]
movzx ecx, word [rsp + rdi*2 + 0x22]
add rdi, 4
xor ax, word [rsp + rdi*2 + 0x18]
mov word [rdx + rdi*2 - 8], ax
movzx eax, byte [rdi + r8 - 4]
xor cx, ax
mov word [rdx + rdi*2 - 6], cx
movzx ecx, byte [rdi + r8 - 3]
xor cx, word [rsp + rdi*2 + 0x1c]
mov word [rdx + rdi*2 - 4], cx
movzx ecx, byte [rdi + r8 - 2]
xor cx, word [rsp + rdi*2 + 0x1e]
mov word [rdx + rdi*2 - 2], cx
cmp rdi, 0x10
jl 0x14005d910
mov byte [0x1401dfd24], 1
mov rax, rdx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x70
pop rdi
ret
Function at 0x14005d980
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x558
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rsp + 0x540], rax
mov ecx, dword [0x1401ddd80]
mov eax, 0x38e38e39
mov r8d, ecx
imul r8d, ecx
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 0xc
jne 0x14005d9d8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov dword [0x1401ddd80], eax
cmp byte [0x1401dfd0d], 0
je 0x14005da00
lea rax, [0x1401d9678]
mov rcx, qword [rsp + 0x540]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x558
ret
lea r8d, [rcx + 1]
mov eax, 0x66666667
mov qword [rsp + 0x568], rbp
xor ebp, ebp
imul r8d, ecx
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 7
jne 0x14005dade
mov qword [rsp + 0x560], rbx
mov qword [rsp + 0x570], rsi
mov qword [rsp + 0x550], rdi
mov edi, ebp
lea rsi, [rsp + 0x20]
nop word [rax + rax]
mov r9d, ebp
nop word [rax + rax]
mov eax, ecx
lea r8d, [rdi + 1]
lea ebx, [r9 + 1]
cdq
idiv r8d
mov eax, ecx
sub eax, edi
mov r8d, edx
imul r8d, eax
mov eax, ecx
lea rcx, [0x14016477c]
cdq
idiv ebx
add r8d, eax
sub r8d, r9d
mov edx, r8d
call fcn.1400d7c60
add rsi, 4
mov r9d, ebx
cmp ebx, 0x1d
jge 0x14005dab7
mov ecx, dword [0x1401ddd80]
jmp 0x14005da70
inc edi
cmp edi, 0xb
jge 0x14005dac6
mov ecx, dword [0x1401ddd80]
jmp 0x14005da60
mov rsi, qword [rsp + 0x570]
mov rbx, qword [rsp + 0x560]
mov rdi, qword [rsp + 0x550]
mov dword [rsp + 0x520], 0x190001
mov dword [rsp + 0x524], 0x20003
mov dword [rsp + 0x528], 0x4c000e
mov dword [rsp + 0x52c], 0xb000f
mov dword [rsp + 0x530], 0xc0018
mov dword [rsp + 0x534], 0x16004e
mov dword [rsp + 0x538], 0xe
mov dword [rsp + 0x53c], 7
lea rdx, [0x1401d9678]
lea r8, [0x1401d8d91]
nop word [rax + rax]
movzx eax, byte [r8 + rbp - 1]
movzx ecx, word [rsp + rbp*2 + 0x522]
add rbp, 5
xor ax, word [rsp + rbp*2 + 0x516]
mov word [rdx + rbp*2 - 0xa], ax
movzx eax, byte [r8 + rbp - 5]
xor cx, ax
movzx eax, byte [r8 + rbp - 4]
xor ax, word [rsp + rbp*2 + 0x51a]
mov word [rdx + rbp*2 - 8], cx
movzx ecx, byte [r8 + rbp - 3]
xor cx, word [rsp + rbp*2 + 0x51c]
mov word [rdx + rbp*2 - 6], ax
mov word [rdx + rbp*2 - 4], cx
movzx ecx, byte [r8 + rbp - 2]
xor cx, word [rsp + rbp*2 + 0x51e]
mov word [rdx + rbp*2 - 2], cx
cmp rbp, 0xf
jl 0x14005db50
mov rbp, qword [rsp + 0x568]
mov byte [0x1401dfd0d], 1
mov rax, rdx
mov rcx, qword [rsp + 0x540]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x558
ret
Function at 0x14005ddf0
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rbp + 8], rax
call fcn.140058930
test al, al
jne 0x14005de20
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp byte [0x1401dfd2a], 0
lea rax, [0x1401d9938]
jne 0x14005df20
xor r8d, r8d
mov dword [rbp - 0x30], 0x15000b
mov dword [rbp - 0x2c], 0x11000c
mov dword [rbp - 0x28], 0xd004b
mov dword [rbp - 0x24], 0x6000d
mov dword [rbp - 0x20], 0xa001a
mov word [rbp], r8w
mov dword [rbp - 0x1c], 0xa004e
mov dword [rbp - 0x18], 0x18001e
mov dword [rbp - 0x14], 0x80041
mov dword [rbp - 0x10], 0x410016
mov dword [rbp - 0xc], 0x160005
mov dword [rbp - 8], 0xc0019
mov dword [rbp - 4], 0x1e0006
lea r9, [0x1401d8d91]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rbp + r8*2 - 0x2e]
add r8, 6
xor cx, word [rbp + r8*2 - 0x3c]
mov word [rax + r8*2 - 0xc], cx
movzx ecx, byte [r8 + r9 - 6]
xor dx, cx
movzx ecx, byte [r8 + r9 - 5]
xor cx, word [rbp + r8*2 - 0x38]
mov word [rax + r8*2 - 0xa], dx
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor cx, word [rbp + r8*2 - 0x36]
mov word [rax + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rbp + r8*2 - 0x34]
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rbp + r8*2 - 0x32]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x18
jl 0x14005dea0
mov byte [0x1401dfd2a], 1
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x110
pop rbp
ret

Function at 0x14005df40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401dfd2c], 0
lea rax, [0x1401d97c0]
jne 0x14005dfdf
mov dword [rsp], 0x11003a
mov dword [rsp + 4], 0x10003
mov dword [rsp + 8], 0x1e003b
mov dword [rsp + 0xc], 0x9000e
mov dword [rsp + 0x10], 0x1a0010
mov dword [rsp + 0x14], 0x28001d
mov dword [rsp + 0x18], 0x1000e
mov dword [rsp + 0x1c], 0x15000e
mov dword [rsp + 0x20], 0x5b0009
mov dword [rsp + 0x24], 0x48
xor ecx, ecx
lea r8, [0x1401d8d90]
nop dword [rax + rax]
movzx edx, byte [rcx + r8]
inc rcx
xor dx, word [rsp + rcx*2 - 2]
mov word [rax + rcx*2 - 2], dx
cmp rcx, 0x13
jl 0x14005dfc0
mov byte [0x1401dfd2c], 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x38
ret
Function at 0x14005e000
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rsp + 0x40], rax
call fcn.1400589c0
mov ebx, 4
test al, al
jne 0x14005e068
mov ecx, dword [0x1401ddd80]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ebx
imul edx, edx, 0x64
sub ecx, edx
add ecx, 0x141
movsxd rcx, ecx
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400d68e8
mov rcx, rax
call fcn.1400d834c
cmp byte [0x1401dfd0e], 0
mov qword [rsp + 0x68], rdi
je 0x14005e082
lea rax, [0x1401d9a18]
jmp 0x14005e171
xor ebx, ebx
mov dword [rsp + 0x20], 0x1b0006
mov dword [rsp + 0x24], 0x40014
mov dword [rsp + 0x28], 0x90046
mov dword [rsp + 0x2c], 0x180013
mov dword [rsp + 0x30], 0x1b001a
mov word [rsp + 0x3c], bx
mov edx, ebx
mov dword [rsp + 0x34], 0x20040
mov dword [rsp + 0x38], 0xa0002
lea rdi, [0x1401d9a18]
lea r8, [0x1401d8d91]
movzx eax, byte [rdx + r8 - 1]
movzx ecx, word [rsp + rdx*2 + 0x22]
add rdx, 2
xor ax, word [rsp + rdx*2 + 0x1c]
mov word [rdi + rdx*2 - 4], ax
movzx eax, byte [rdx + r8 - 2]
xor cx, ax
mov word [rdi + rdx*2 - 2], cx
cmp rdx, 0xe
jl 0x14005e0d1
mov ecx, dword [0x1401ddd80]
mov eax, 0x4ec4ec4f
mov byte [0x1401dfd0e], 1
imul ecx, ecx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 7
jne 0x14005e16e
mov ecx, 0x28
mov qword [rsp + 0x60], rsi
call fcn.1400d68e8
mov rsi, rax
nop dword [rax + rax]
call fcn.1400d7b94
inc rbx
add eax, dword [0x1401ddd80]
mov dword [rsi + rbx*4 - 4], eax
cmp rbx, 0xa
jl 0x14005e140
mov ecx, dword [rsi + 0x24]
mov dword [0x1401ddd80], ecx
mov rcx, rsi
call fcn.1400d834c
mov rsi, qword [rsp + 0x60]
mov rax, rdi
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x50
pop rbx
ret

Function at 0x14005e190
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rbp - 0x10], rax
cmp byte [0x1401dfd40], 0
lea rax, [0x1401d9480]
jne 0x14005e257
xor ecx, ecx
mov dword [rbp - 0x40], 0x11000f
mov dword [rbp - 0x3c], 0x280016
mov dword [rbp - 0x38], 0x80004
mov dword [rbp - 0x34], 0x60014
mov dword [rbp - 0x30], 0x210010
mov word [rbp - 0x14], cx
mov dword [rbp - 0x2c], 0xb000f
mov dword [rbp - 0x28], 0xf
mov dword [rbp - 0x24], 0x290004
mov dword [rbp - 0x20], 0x50024
mov dword [rbp - 0x1c], 0x1f0004
mov dword [rbp - 0x18], 0x43004e
lea r9, [0x1401d8d91]
nop word [rax + rax]
movzx edx, byte [rcx + r9 - 1]
movzx r8d, word [rbp + rcx*2 - 0x3e]
add rcx, 2
xor dx, word [rbp + rcx*2 - 0x44]
mov word [rax + rcx*2 - 4], dx
movzx edx, byte [rcx + r9 - 2]
xor r8w, dx
mov word [rax + rcx*2 - 2], r8w
cmp rcx, 0x16
jl 0x14005e220
mov byte [0x1401dfd40], 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x40
pop rbp
ret
Function at 0x14005e270
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rbp - 8], rax
mov r8d, dword [0x1401ddd80]
mov eax, 0x6bca1af3
xor ebx, ebx
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 0xa
jne 0x14005e2eb
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r8d, dword [0x1401ddd80]
cmp byte [0x1401dfd34], bl
je 0x14005e2ff
lea rax, [0x1401d9990]
jmp 0x14005e407
mov ecx, r8d
mov eax, 0x66666667
imul ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0x12
jne 0x14005e334
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401ddd80], eax
mov dword [rbp - 0x40], 0x20006
mov dword [rbp - 0x3c], 0x3a0012
mov dword [rbp - 0x38], 0x2001e
mov dword [rbp - 0x34], 0x120004
mov dword [rbp - 0x30], 0xc0005
mov dword [rbp - 0x2c], 0x11000d
mov dword [rbp - 0x28], 0x8000e
mov dword [rbp - 0x24], 0xb003e
mov dword [rbp - 0x20], 0x2001f
mov dword [rbp - 0x1c], 0x1f0009
mov dword [rbp - 0x18], 0xb002b
mov dword [rbp - 0x14], 0xb0015
mov dword [rbp - 0x10], 6
lea rdx, [0x1401d9990]
lea r8, [0x1401d8d91]
nop dword [rax]
movzx eax, byte [rbx + r8 - 1]
movzx ecx, word [rbp + rbx*2 - 0x3e]
add rbx, 5
xor ax, word [rbp + rbx*2 - 0x4a]
mov word [rdx + rbx*2 - 0xa], ax
movzx eax, byte [rbx + r8 - 5]
xor cx, ax
movzx eax, byte [rbx + r8 - 4]
xor ax, word [rbp + rbx*2 - 0x46]
mov word [rdx + rbx*2 - 8], cx
movzx ecx, byte [rbx + r8 - 3]
xor cx, word [rbp + rbx*2 - 0x44]
mov word [rdx + rbx*2 - 6], ax
mov word [rdx + rbx*2 - 4], cx
movzx ecx, byte [rbx + r8 - 2]
xor cx, word [rbp + rbx*2 - 0x42]
mov word [rdx + rbx*2 - 2], cx
cmp rbx, 0x19
jl 0x14005e3a0
mov byte [0x1401dfd34], 1
mov rax, rdx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400d72a0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x14005e430
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ecx, dword [0x1401ddd80]
mov eax, 0x66666667
xor ebx, ebx
mov r8d, ecx
imul r8d, ecx
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 8
jne 0x14005e4da
mov eax, 0x13e22cbd
mov r8d, ebx
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
imul edx, edx, 0x67
sub eax, edx
cmp eax, 0x36
je 0x14005e4d1
nop word [rax + rax]
mov eax, ecx
inc r8d
or eax, 0xffffff83
add ecx, eax
mov eax, ecx
imul eax, ecx
cmp r8d, eax
jg 0x14005e4d1
mov eax, 0x13e22cbd
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
imul edx, edx, 0x67
sub eax, edx
cmp eax, 0x36
jne 0x14005e4a0
mov ecx, r8d
mov dword [0x1401ddd80], ecx
cmp byte [0x1401dfd27], bl
je 0x14005e4fc
lea rax, [0x1401d9510]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x50
pop rbx
ret
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x66666667
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub r8d, eax
cmp r8d, 3
jne 0x14005e539
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov dword [0x1401ddd80], eax
mov r8d, ecx
mov eax, 0x6bca1af3
mov dword [rsp + 0x20], 0x35003e
mov dword [rsp + 0x24], 0x9000e
mov dword [rsp + 0x28], 0xf0004
mov dword [rsp + 0x2c], 0x120024
imul r8d, ecx
imul r8d, ecx
imul r8d
sar edx, 3
mov dword [rsp + 0x30], 0x270047
mov dword [rsp + 0x34], 0x48001a
mov eax, edx
mov dword [rsp + 0x38], 0x190038
mov dword [rsp + 0x3c], 0x40002
shr eax, 0x1f
mov dword [rsp + 0x40], 0x120015
mov dword [rsp + 0x44], 0x1b
add edx, eax
imul edx, edx, 0x13
sub r8d, edx
cmp r8d, 0xa
jne 0x14005e5b8
inc dword [0x1401df570]
lea rax, [0x1401d9510]
lea rdx, [0x1401d8d90]
nop word [rax + rax]
movzx ecx, byte [rbx + rdx]
inc rbx
xor cx, word [rsp + rbx*2 + 0x1e]
mov word [rax + rbx*2 - 2], cx
cmp rbx, 0x13
jl 0x14005e5d0
mov byte [0x1401dfd27], 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x50
pop rbx
ret
Function at 0x14005e610
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1401dfd0a], 0
lea rax, [0x1401d96d0]
jne 0x14005e6ec
xor r8d, r8d
mov dword [rsp], 0x150018
mov dword [rsp + 4], 0x10
mov dword [rsp + 8], 0x180005
mov dword [rsp + 0xc], 0x1a0041
mov dword [rsp + 0x10], 0x60007
mov word [rsp + 0x20], r8w
mov dword [rsp + 0x14], 0x45000d
mov dword [rsp + 0x18], 0xd0005
mov dword [rsp + 0x1c], 0x2000c
lea r9, [0x1401d8d91]
nop word [rax + rax]
movzx ecx, byte [r8 + r9 - 1]
movzx edx, word [rsp + r8*2 + 2]
add r8, 4
xor cx, word [rsp + r8*2 - 8]
mov word [rax + r8*2 - 8], cx
movzx ecx, byte [r8 + r9 - 4]
xor dx, cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 - 4]
mov word [rax + r8*2 - 6], dx
mov word [rax + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 - 2]
mov word [rax + r8*2 - 2], cx
cmp r8, 0x10
jl 0x14005e690
mov byte [0x1401dfd0a], 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x38
ret

Function at 0x14005e8b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.140058860
mov r8d, dword [0x1401ddd80]
mov eax, 0x30c30c31
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xa
jne 0x14005e8ff
dec r8d
mov dword [0x1401ddd80], r8d
cmp byte [0x1401dfd28], 0
je 0x14005e921
lea rax, [0x1401d9b68]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x58
ret
mov qword [rsp + 0x50], rdi
xor edi, edi
mov dword [rsp + 0x20], 0x40027
mov r9d, 4
mov dword [rsp + 0x24], 0xb0007
mov dword [rsp + 0x28], 0x1e003b
mov word [rsp + 0x40], di
mov dword [rsp + 0x2c], 0x9000e
mov dword [rsp + 0x30], 0x1a0010
mov dword [rsp + 0x34], 0x45001d
mov dword [rsp + 0x38], 0x90018
mov dword [rsp + 0x3c], 0x1000d
call fcn.140058770
test al, al
jne 0x14005e9a6
mov ecx, r9d
mov qword [rsp + 0x60], rbx
call fcn.1400d7a58
mov rbx, rax
call fcn.1400d7b94
mov rcx, rbx
mov dword [rbx], eax
mov dword [0x1401ddd80], eax
call fcn.1400d7280
mov rbx, qword [rsp + 0x60]
mov rdx, rdi
lea r8, [0x1401d9b68]
lea r9, [0x1401d8d91]
nop word [rax + rax]
movzx eax, byte [rdx + r9 - 1]
movzx ecx, word [rsp + rdx*2 + 0x22]
add rdx, 4
xor ax, word [rsp + rdx*2 + 0x18]
mov word [r8 + rdx*2 - 8], ax
movzx eax, byte [rdx + r9 - 4]
xor cx, ax
movzx eax, byte [rdx + r9 - 3]
xor ax, word [rsp + rdx*2 + 0x1c]
mov word [r8 + rdx*2 - 6], cx
mov word [r8 + rdx*2 - 4], ax
movzx eax, byte [rdx + r9 - 2]
xor ax, word [rsp + rdx*2 + 0x1e]
mov word [r8 + rdx*2 - 2], ax
cmp rdx, 0x10
jl 0x14005e9c0
mov eax, dword [0x1401ddd80]
mov byte [0x1401dfd28], 1
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 0x8000000f
jge 0x14005ea33
dec ecx
or ecx, 0xfffffff0
inc ecx
cmp ecx, 0xb
jne 0x14005ea54
test eax, eax
je 0x14005ea4e
nop dword [rax]
mov ecx, eax
cdq
and ecx, 1
sub eax, edx
add edi, ecx
sar eax, 1
jne 0x14005ea40
mov dword [0x1401ddd80], edi
mov rax, r8
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x58
ret