joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006c4f0
Capabilities:
Encode data using xor

Disassembly:
push rax
mov byte [rsp + 7], cl
movzx eax, byte [rsp + 7]
mov ecx, 0x96ac7077
nop
mov edx, dword [0x141dcadc0]
or edx, dword [0x141dcadc4]
xor edx, 0x50e6bf66
imul rdx, rcx
shr rdx, 0x3d
cmp edx, 0xcea2d194
ja 0x14006c500
pop rcx
ret

Function at 0x14006c550
Capabilities:
Encode data using xor

Disassembly:
vmovdqa ymm0, ymmword [rdx]
vpslld ymm0, ymm0, 2
vmovdqa ymmword [rcx], ymm0
nop dword [rax]
mov eax, dword [0x141dcadc8]
and eax, dword [0x141dcadcc]
add eax, 0xd2b97cdb
xor eax, 0x32001c05
and eax, 0xb2245c45
cmp eax, 0xe3f82aa2
je 0x14006c560
vzeroupper
ret

Function at 0x14006cfe0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x141dcae08]
imul eax, dword [0x141dcae0c]
add eax, 0x4c6a1087
xor eax, 0x40005060
and eax, 0x4805ddf4
cmp eax, 0x77b0729f
je fcn.14006cfe0
vmovdqa ymm0, ymmword [rdx]
nop word [rax + rax]
mov eax, dword [0x141dcae10]
xor eax, dword [0x141dcae14]
and eax, 0x67402480
cmp eax, 0x4e4f840e
je 0x14006d010
vpmuludq ymm0, ymm0, ymmword [r8]
vmovdqa ymmword [rcx], ymm0
vzeroupper
ret

Function at 0x14006d330
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
vpermpd ymm0, ymmword [rdx], 2
nop word cs:[rax + rax]
mov eax, dword [0x141dcae98]
imul eax, dword [0x141dcae9c]
xor eax, 0xf4d91251
imul rdx, rax, 0x394c0429
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1c
cmp eax, 0x6f919be8
je 0x14006d340
vmovaps ymmword [rcx], ymm0
vzeroupper
ret

Function at 0x14006d700
Capabilities:
Encode data using xor

Disassembly:
vmovaps ymm0, ymmword [r8]
vandps ymm0, ymm0, ymmword [rdx]
vmovaps ymmword [rcx], ymm0
nop dword [rax]
mov eax, dword [0x141dcaeb0]
and eax, dword [0x141dcaeb4]
imul eax, eax, 0x2ca7b7b0
xor eax, 0x13566771
cmp eax, 0x4447ca23
jb 0x14006d710
vzeroupper
ret
Function at 0x14006f3d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x118
lea rbp, [rsp + 0x80]
and rsp, 0xffffffffffffffe0
cmp byte [rcx + 0x228], 0
jne 0x14006f629
mov r8, rdx
mov rsi, rcx
nop word [rax + rax]
mov eax, dword [0x141dcb018]
xor edx, edx
div dword [0x141dcb01c]
and eax, 0x2441f619
add eax, 0x15413c48
imul rcx, rax, 0x58a899a7
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
cmp eax, 0x8b36da7b
ja 0x14006f400
cmp qword [rsi + 0x220], 0
jne 0x14006f629
vpbroadcastd ymm0, dword [0x140102c80]
nop word [rax + rax]
mov eax, dword [0x141dcb020]
sub eax, dword [0x141dcb024]
or eax, 0x2512dca2
imul eax, eax, 0x39539f98
or eax, 0xdc33b1c7
cmp eax, 0xd349b842
jb 0x14006f450
vmovdqu ymm1, ymmword [r8]
vmovdqu ymm2, ymmword [r8 + 0x20]
vpunpckhqdq ymm3, ymm1, ymm2
vpermq ymm3, ymm3, 0xd8
vpunpcklqdq ymm1, ymm1, ymm2
vpermq ymm1, ymm1, 0xd8
vpsrlq ymm2, ymm3, 0x28
vpor ymm4, ymm2, ymm0
vpsrlq ymm0, ymm1, 0x2e
vpsllq ymm2, ymm3, 0x12
vpor ymm0, ymm2, ymm0
mov eax, dword [0x141dcb028]
xor edx, edx
div dword [0x141dcb02c]
mov eax, 0xafe07a03
vpsrlq ymm2, ymm1, 0x1a
vpbroadcastq ymm3, qword [0x140102c88]
vpblendd ymm2, ymm2, ymm0, 0xaa
vpand ymm2, ymm2, ymm3
vpsllq ymm0, ymm0, 0x1a
vpblendd ymm0, ymm1, ymm0, 0xaa
nop
mov ecx, dword [0x141dcb030]
and ecx, dword [0x141dcb034]
add ecx, 0x9b3be68e
mov rdx, rcx
imul rdx, rax
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1d
cmp ecx, 0xed96407a
je 0x14006f4e0
mov eax, dword [0x141dcb038]
sub eax, dword [0x141dcb03c]
mov ecx, 0x80ec99b3
imul rcx, rax
shr rcx, 0x3e
and ecx, 0xfffffffe
imul eax, ecx, 0xd05cd08d
cmp eax, 0x3217c658
vmovdqa ymmword [rsp + 0x60], ymm4
vmovdqa ymmword [rsp + 0x40], ymm2
jne 0x14006f5a1
vmovdqa ymmword [rsp + 0x20], ymm0
vpand ymm0, ymm3, ymmword [rsp + 0x20]
vmovdqa ymmword [rsp + 0x80], ymm0
vmovdqa ymmword [rsp + 0xa0], ymm2
vmovdqa ymmword [rsp + 0xc0], ymm4
lea rdx, [rsp + 0x80]
mov rcx, rsi
vmovdqa ymmword [rsp + 0xe0], ymm3
vzeroupper
call fcn.14006ecd0
vmovdqa ymm0, ymmword [rsp + 0x20]
vmovdqa ymm3, ymmword [rsp + 0xe0]
vmovdqa ymm2, ymmword [rsp + 0x40]
vmovdqa ymm4, ymmword [rsp + 0x60]
vpand ymm0, ymm0, ymm3
vmovdqa ymmword [rsp + 0x20], ymm0
lea rdi, [rsp + 0x80]
nop word cs:[rax + rax]
mov eax, dword [0x141dcb040]
or eax, dword [0x141dcb044]
xor eax, 0xdd2b2047
imul ebx, eax, 0xb73c07cb
vmovdqa ymm0, ymmword [rsp + 0x20]
vmovdqa ymmword [rsp + 0x80], ymm0
vmovdqa ymmword [rsp + 0xa0], ymm2
vmovdqa ymmword [rsp + 0xc0], ymm4
mov rcx, rsi
mov rdx, rdi
vzeroupper
call fcn.14006ecd0
vmovdqa ymm2, ymmword [rsp + 0x40]
vmovdqa ymm4, ymmword [rsp + 0x60]
cmp ebx, 0xfd8ab371
je 0x14006f5c0
lea rsp, [rbp + 0x98]
pop rbx
pop rdi
pop rsi
pop rbp
vzeroupper
ret
ud2
Function at 0x14006f630
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rbx, rcx
mov r13d, 0x3ffffff
nop dword [rax]
mov r8d, dword [0x141dcb048]
or r8d, dword [0x141dcb04c]
imul r8d, r8d, 0xa8dee857
or r8d, 0x56049e4b
imul r8d, r8d, 0x5eb1630f
cmp r8d, 0x6ca76486
je 0x14006f650
mov r10d, dword [rbx + 0x10]
mov eax, dword [rbx + 0x18]
mov qword [rsp + 0x18], rax
mov r8d, dword [rbx + 0x1c]
mov qword [rsp + 0x20], r8
mov ecx, dword [rbx + 0x20]
mov qword [rsp + 0x28], rcx
mov r9d, dword [rbx + 0x34]
mov r12d, dword [rdx + 3]
mov edi, dword [rdx + 6]
mov r15d, dword [rdx + 0xc]
mov r14d, dword [rdx + 9]
shr r14d, 6
add r14d, dword [rbx + 0x30]
shr edi, 4
and edi, 0x3ffffff
add edi, dword [rbx + 0x2c]
shr r12d, 2
and r12d, 0x3ffffff
add r12d, dword [rbx + 0x28]
and r13d, dword [rdx]
add r13d, dword [rbx + 0x24]
lea ecx, [rcx + rcx*4]
lea edx, [r8 + r8*4]
lea r8d, [rax + rax*4]
shr r15d, 8
add r9d, r15d
add r9d, 0x1000000
mov r15, r13
mov qword [rsp + 8], r10
imul r15, r10
mov rbp, r12
imul rbp, rcx
add rbp, r15
mov r15, rdi
imul r15, rdx
mov qword [rsp], rdx
mov r11, r14
imul r11, r8
add r11, r15
add r11, rbp
mov ebp, dword [rbx + 0x14]
lea r15d, [rbp + rbp*4]
imul r15, r9
add r15, r11
mov r11, r13
imul r11, rbp
mov rsi, r12
imul rsi, r10
add rsi, r11
mov r11, rdi
imul r11, rcx
mov qword [rsp + 0x10], rcx
mov rax, r14
imul rax, rdx
add rax, r11
add rax, rsi
imul r8, r9
add r8, rax
mov rax, r13
mov r10, qword [rsp + 0x18]
imul rax, r10
mov r11, r12
imul r11, rbp
add r11, rax
mov rax, rdi
mov rdx, qword [rsp + 8]
imul rax, rdx
mov rsi, r14
imul rsi, rcx
add rsi, rax
add rsi, r11
mov rax, qword [rsp]
imul rax, r9
add rax, rsi
mov qword [rsp], rax
mov rax, r13
mov rcx, qword [rsp + 0x20]
imul rax, rcx
mov r11, r12
imul r11, r10
add r11, rax
mov rax, rdi
imul rax, rbp
mov rsi, r14
imul rsi, rdx
add rsi, rax
add rsi, r11
mov r11, qword [rsp + 0x10]
imul r11, r9
add r11, rsi
imul r13, qword [rsp + 0x28]
imul r12, rcx
add r12, r13
imul rdi, r10
imul r14, rbp
add r14, rdi
add r14, r12
imul r9, rdx
add r9, r14
mov rax, r15
shr rax, 0x1a
and r15d, 0x3ffffff
mov eax, eax
add rax, r8
mov r8, rax
shr r8, 0x1a
and eax, 0x3ffffff
mov r8d, r8d
add r8, qword [rsp]
mov r10, r8
shr r10, 0x1a
mov r10d, r10d
add r10, r11
mov rdx, r10
shr rdx, 0x1a
mov edx, edx
add rdx, r9
mov r9, rdx
shr r9, 0x1a
lea r9d, [r9 + r9*4]
add r9d, r15d
mov r11d, r9d
shr r11d, 0x1a
add r11d, eax
and r9d, 0x3ffffff
mov dword [rbx + 0x24], r9d
mov dword [rbx + 0x28], r11d
and r8d, 0x3ffffff
mov dword [rbx + 0x2c], r8d
and r10d, 0x3ffffff
mov dword [rbx + 0x30], r10d
and edx, 0x3ffffff
mov dword [rbx + 0x34], edx
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140075240
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
nop dword [rax + rax]
mov eax, dword [0x141dcc1c0]
sub eax, dword [0x141dcc1c4]
imul eax, eax, 0x80b39ee4
xor eax, 0x18c06a
or eax, 0xefc30015
cmp eax, 0x850117e3
jb 0x140075250
mov r14, qword [rcx]
mov rsi, qword [r14 + 0x80]
and rsi, 0xfffffffffffffff8
cmp qword [rsi + 8], 0
je 0x14007534c
mov rdi, qword [rsi]
mov eax, dword [0x141dcc1c8]
xor eax, dword [0x141dcc1cc]
or eax, 0xfebfff7e
cmp eax, 0xb6c309cb
jne 0x1400752b0
mov rax, qword [0x141ddb9a0]
nop
mov eax, dword [0x141dcc1d0]
mov ecx, dword [0x141dcc1d4]
add eax, ecx
add eax, 0xe79055c8
xor eax, 0xae92a406
add eax, 0x1483e9df
mov rbx, qword [0x141ddb9a0]
cmp eax, 0xefe54671
ja 0x1400752b0
mov eax, dword [0x141dcc1d8]
sub eax, dword [0x141dcc1dc]
mov ecx, 0x85c0ccb3
imul rcx, rax
shr rcx, 0x3f
imul eax, ecx, 0xb974c53c
cmp eax, 0x222bfa56
ja 0x14007533c
mov eax, dword [0x141dcc1e0]
xor edx, edx
div dword [0x141dcc1e4]
and eax, 0x56864345
imul eax, eax, 0xe867bbf
imul r15, rax, 0x2e8df763
shr r15, 0x3d
mov rcx, rbx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r15d, 0x7263c977
jbe 0x14007534c
mov rcx, rbx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140075301
mov rcx, qword [0x141ddb9a0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov eax, dword [0x141dcc1e8]
mov ecx, dword [str._br_r_]
add eax, ecx
add eax, 0x267e56c5
and eax, 0x821f1649
imul rax, rax, 0x6f47f15f
shr rax, 0x3d
cmp eax, 0x20065d71
ja 0x140075360
cmp r14, 0xffffffffffffffff
je 0x140075442
lea rcx, [r14 + 8]
mov eax, dword [0x141dcc1f0]
xor edx, edx
div dword [0x141dcc1f4]
add eax, 0xb737204b
xor eax, 0x17e46d1f
add eax, 0x6b0938d9
cmp eax, 0x6e02e944
jbe 0x1400753c0
lock dec qword [rcx]
mov eax, dword [str.q_b__Li1]
or eax, dword [0x141dcc1fc]
imul edx, eax, 0xaa7dc397
add edx, 0xb6a9bd67
imul rax, rdx, 0x242f7239
shr rax, 0x20
sub edx, eax
shr edx, 1
add edx, eax
shr edx, 0x1e
lock dec qword [rcx]
sete al
cmp edx, 0xf66f29b8
ja 0x1400753c0
test al, al
je 0x140075442
mov r8, qword [r14 - 8]
mov rcx, qword [0x141ddb9a0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 0xb902ac4d
nop word [rax + rax]
mov eax, dword [0x141dcc200]
xor edx, edx
div dword [0x141dcc204]
xor eax, 0xa8be31a7
imul rax, rcx
shr rax, 0x3f
cmp eax, 0x396aac30
je 0x140075420
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140075ce0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
nop dword [rax + rax]
mov eax, dword [0x141dcc360]
or eax, dword [0x141dcc364]
and eax, 0x1b8ec7c
imul eax, eax, 0x2144a24b
add eax, 0x5e98080f
cmp eax, 0x911dc9d5
jb 0x140075cf0
cmp dword [rsi + 0x10], 1
jne 0x140075e10
mov eax, 0xdcfe10c7
nop word cs:[rax + rax]
mov ecx, dword [0x141dcc368]
and ecx, dword [0x141dcc36c]
imul ecx, ecx, 0xadf2cabc
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0xf4a51c0f
je 0x140075d30
mov rdi, qword [rsi + 0x18]
cmp qword [rsi + 0x20], 0
mov byte [rdi], 0
je 0x140075e10
mov rbx, qword [0x141ddb9a0]
mov eax, dword [0x141dcc370]
xor edx, edx
div dword [0x141dcc374]
imul eax, eax, 0xc42c3050
imul rcx, rax, 0x1e88b8f5
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
cmp eax, 0xb9e5f847
ja 0x140075dd5
mov eax, dword [0x141dcc378]
sub eax, dword [0x141dcc37c]
mov ecx, 0x8bf01c4d
imul rcx, rax
shr rcx, 0x3e
imul ebp, ecx, 0x664de565
xor ebp, 0x1ea56444
mov rcx, rbx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebp, 0xb020f028
jbe 0x140075df0
mov rcx, rbx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140075d9a
mov eax, dword [0x141dcc380]
and eax, dword [0x141dcc384]
add eax, 0xcc1f9e43
and eax, 0x270921a4
cmp eax, 0x6f235282
je 0x140075df0
nop dword [rax]
mov eax, dword [0x141dcc388]
sub eax, dword [0x141dcc38c]
cmp eax, 0xab887db6
je 0x140075e10
nop word cs:[rax + rax]
mov eax, dword [0x141dcc390]
and eax, dword [0x141dcc394]
xor eax, 0xf8c6372a
add eax, 0xe5cc5343
or eax, 0x2d953011
cmp eax, 0x69313c8b
jb 0x140075e30
cmp rsi, 0xffffffffffffffff
je 0x140075f2a
lea rax, [rsi + 8]
xor ecx, ecx
nop word cs:[rax + rax]
test cl, cl
jne 0x140075e70
mov ecx, dword [0x141dcc398]
mov edx, dword [0x141dcc39c]
add ecx, edx
add ecx, 0x2d63cdfe
imul rcx, rcx, 0x52b6ea71
shr rcx, 0x3e
add ecx, 0x4ce96e31
cmp ecx, 0x39a2590b
jb 0x140075ecf
mov ecx, dword [0x141dcc3a0]
xor ecx, dword [0x141dcc3a4]
xor ecx, 0xe93f24c8
mov edx, 0x8f26d4a7
imul rdx, rcx
shr rdx, 0x3f
lock dec qword [rax]
sete cl
cmp edx, 0x7b544465
jbe 0x140075ed5
lock dec qword [rax]
jmp 0x140075ea1
test cl, cl
je 0x140075f2a
mov eax, dword [0x141dcc3a8]
imul eax, dword [0x141dcc3ac]
or eax, 0x37eace22
imul eax, eax, 0xc4867715
or eax, 0xce06d115
cmp eax, 0x1b05d3c9
jb 0x140075f16
mov rcx, qword [0x141ddb9a0]
xor edi, edi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
test dil, dil
je 0x140075f2a
mov rcx, qword [0x141ddb9a0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140075efd
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140075f40
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x141dcc3b0]
xor edx, edx
div dword [0x141dcc3b4]
nop dword [rax + rax]
mov eax, dword [0x141dcc3b8]
sub eax, dword [0x141dcc3bc]
and eax, 0x6910931
or eax, 0x596ac04e
imul eax, eax, 0x9d957a97
cmp eax, 0x8fed8713
je 0x140075f60
mov rcx, qword [rsi]
mov rax, qword [rcx + 0x10]
lock dec qword [rax]
jne 0x140075ff0
mov eax, dword [0x141dcc3c0]
imul eax, dword [0x141dcc3c4]
imul eax, eax, 0x65288b7e
add eax, 0x5d82ffa2
cmp eax, 0xd476cc56
ja 0x140075fd3
mov eax, dword [0x141dcc3c8]
xor edx, edx
div dword [0x141dcc3cc]
and eax, 0xdc6a4f11
add eax, 0xee93a909
and eax, 0xf46b9501
cmp eax, 0x9536b7e6
jne 0x140075fd5
jmp 0x140075faf
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x140075fe0
mov rcx, qword [rcx + 0x10]
call fcn.140075ce0
nop dword [rax]
mov eax, dword [0x141dcc3d0]
xor edx, edx
div dword [0x141dcc3d4]
imul eax, eax, 0x843eee92
add eax, 0xdcd6d12c
xor eax, 0x8759cdf1
cmp eax, 0x9309bcaa
ja 0x140075ff0
mov rsi, qword [rsi]
cmp rsi, 0xffffffffffffffff
je 0x140076170
lea rax, [rsi + 8]
nop word cs:[rax + rax]
mov ecx, dword [0x141dcc3d8]
sub ecx, dword [0x141dcc3dc]
imul ecx, ecx, 0xc46e51f7
xor ecx, 0x830e00b9
or ecx, 0x8a15244
cmp ecx, 0x3c95f66c
jb 0x140076030
mov ecx, dword [0x141dcc3e0]
imul ecx, dword [0x141dcc3e4]
add ecx, 0xee12ec4d
and ecx, 0x3518804b
cmp ecx, 0x2c43f871
jae 0x140076080
lock dec qword [rax]
nop dword [rax + rax]
mov ecx, dword [0x141dcc3e8]
imul ecx, dword [0x141dcc3ec]
imul ecx, ecx, 0x3e6f5eea
xor ecx, 0x6625d4f2
imul edx, ecx, 0x849f3711
lock dec qword [rax]
sete cl
cmp edx, 0xfd53ecf6
ja 0x140076080
test cl, cl
je 0x140076170
mov eax, dword [0x141dcc3f0]
sub eax, dword [0x141dcc3f4]
mov ecx, 0xa830eb0b
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x7c82e050
jne 0x1400760e0
mov rax, qword [0x141ddb9a0]
nop
mov eax, dword [0x141dcc3f8]
or eax, dword [0x141dcc3fc]
and eax, 0x48838703
xor eax, 0xbcbde01
add eax, 0x615589d
mov rdi, qword [0x141ddb9a0]
cmp eax, 0x5abada2
jb 0x1400760e0
mov eax, dword [0x141dcc400]
xor eax, dword [0x141dcc404]
or eax, 0xf3db772f
add eax, 0xfcf83c43
cmp eax, 0x5f496923
jb 0x140076154
mov ebx, dword [0x141dcc408]
sub ebx, dword [0x141dcc40c]
and ebx, 0x40000aa0
add ebx, 0x62b8f3f3
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0xe975d36b
jbe 0x140076170
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140076126
mov eax, dword [0x141dcc410]
and eax, dword [0x141dcc414]
xor eax, 0x57a3befd
imul eax, eax, 0xdf31d9dd
add eax, 0x33832ad2
cmp eax, 0xe3c3a65e
jb 0x140076170
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140077f40
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov eax, dword [0x141dcc848]
imul eax, dword [0x141dcc84c]
add dword [rcx - 0x40], ebp
imul edx, ecx, 0xd4cb3d1a
invalid
wait
je 0x140077f9c
mov eax, dword [0x141dcc850]
xor eax, dword [0x141dcc854]
imul ecx, eax, 0x2e1ccaa7
add ecx, 0x6ef0e116
or ecx, 0x7aae92ed
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov r8, rsp
cmp ecx, 0x6f82881e
jne 0x140077fab
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
jmp 0x140077f66
xor eax, eax
test al, al
jne 0x140078002
mov eax, dword [0x141dcc858]
sub eax, dword [0x141dcc85c]
imul eax, eax, 0x73703881
xor eax, 0xa56443bf
imul rdx, rax, 0x4d4f25e7
shr rdx, 0x3e
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov rcx, rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov rsi, rsp
mov qword [rsi], 0
cmp edx, 0xfef0d27a
jne 0x140078028
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov rax, rsp
mov qword [rax], 0
jmp 0x140077fb1
xor eax, eax
test al, al
jne 0x14007805a
mov edx, dword [0x141dcc860]
xor edx, dword [0x141dcc864]
xor edx, 0x28302088
and edx, 0x6d75bdb9
add edx, 0x836c6565
mov eax, dword [0x141ddb8f8]
cmp edx, 0x46201ab6
jae 0x140078062
mov eax, dword [0x141ddb8f8]
jmp 0x14007802e
cmp eax, 3
jne 0x1400783ed
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
nop word cs:[rax + rax]
mov edx, dword [0x141dcc870]
add edx, dword [0x141dcc874]
and edx, 0xb5354976
add edx, 0x2274f9c4
or edx, 0x659f9f24
cmp edx, 0x4337f6d1
jb 0x140078080
cmp rcx, 3
jne 0x1400780e3
nop dword [rax]
mov edx, 0xa6642847
nop dword [rax + rax]
mov r8d, dword [0x141dcc880]
imul r8d, dword [0x141dcc884]
add r8d, 0xc8d850f5
imul r8, rdx
shr r8, 0x3f
or r8d, 0x1edc644
cmp r8d, 0x3bc5579b
ja 0x1400780f0
mov rdx, qword [0x141ddb8f0]
nop word cs:[rax + rax]
mov r8d, dword [0x141dcc888]
and r8d, dword [0x141dcc88c]
xor r8d, 0xf3dd2273
add r8d, 0x942d9614
cmp r8d, 0xb1d808a
ja 0x140078130
test rdx, rdx
je 0x140078433
lea rsi, [0x141ddb8f0]
cmp rcx, 2
jb case.0x1400781c4.0
nop
mov ecx, dword [0x141dcc898]
or ecx, dword [0x141dcc89c]
cmp ecx, 0x221135f
je 0x140078170
nop word cs:[rax + rax]
mov qword [rcx], rsi
mov qword [r8], rcx
sub rsp, 0x20
lea rcx, [0x141ddb8f8]
lea r9, [0x141db90a8]
xor edx, edx
call fcn.1400fa840
add rsp, 0x20
mov eax, dword [0x141dcc868]
imul eax, dword [0x141dcc86c]
and eax, 0x6a05683a
add eax, 0x3e19a30b
cmp eax, 0x7bdecace
jb 0x140078410
jmp 0x14007806b
ud2

Function at 0x1400784d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
Function at 0x140081400
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
nop dword [rax]
mov eax, dword [0x141dcdaf8]
sub eax, dword [0x141dcdafc]
or eax, 0x1f84a15d
add eax, 0x4b967cdb
or eax, 0x71772b36
cmp eax, 0x10865c34
jb 0x140081410
mov rax, qword [rsi]
nop word cs:[rax + rax]
mov ecx, dword [0x141dcdb00]
xor ecx, dword [0x141dcdb04]
xor ecx, 0xb0516365
imul rdx, rcx, 0x1ab220cf
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1f
cmp ecx, 0x71bab6d3
je 0x140081440
nop
mov ecx, dword [0x141dcdb08]
add ecx, dword [0x141dcdb0c]
and ecx, 0x65d6e9d8
fsubr st(1)
invalid
add ecx, 0x2a64356e
imul rcx, rcx, 0x3567cca9
shr rcx, 0x3c
cmp ecx, 0xc6b94b2e
ja 0x140081470
cmp eax, 3
jne 0x1400814f0
add rsi, 8
nop word cs:[rax + rax]
add byte [rax], al
mov ecx, dword [0x141dcdb38]
imul ecx, dword [0x141dcdb3c]
and ecx, 0x6da60d5a
imul ecx, ecx, 0xb9af1856
add ecx, 0xea774574
cmp ecx, 0x5fddd326
ja 0x1400814f0
cmp eax, 2
jb 0x1400818f5
mov rcx, qword [rsi + 8]
nop word cs:[rax + rax]
mov eax, dword [0x141dcdb40]
or eax, dword [0x141dcdb44]
xor eax, 0x3c08408
and eax, 0x3be0ac6a
imul eax, eax, 0xb347520
cmp eax, 0x96225564
ja 0x140081530
mov eax, dword [0x141dcdb48]
xor edx, edx
div dword [0x141dcdb4c]
nop word cs:[rax + rax]
mov eax, dword [0x141dcdb50]
add eax, dword [0x141dcdb54]
and eax, 0xf1f4317c
xor eax, 0x75b3469e
cmp eax, 0xd5bdcc9a
ja 0x140081570
mov eax, ecx
and eax, 3
lea rdx, [0x141dba2f0]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
Function at 0x140081d60
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x140081d80
mov rax, qword [r8 + 8]
nop dword [rax + rax]
mov ecx, dword [0x141dcdc98]
xor ecx, dword [0x141dcdc9c]
add ecx, 0x4fc23ab9
xor ecx, 0x6ec4d514
cmp ecx, 0xd11e3cb1
ja 0x140081d90
test rax, rax
je 0x140081e20
mov rbx, qword [r8]
mov rax, qword [r8 + 0x10]
nop dword [rax]
mov ecx, dword [0x141dcdca0]
imul ecx, dword [0x141dcdca4]
or ecx, 0x281084
and ecx, 0x2c15a4
cmp ecx, 0xba0f394d
je 0x140081dc0
test rax, rax
je 0x140081ef0
mov r14, qword [0x141ddb9a0]
mov eax, dword [0x141dcdcc8]
and eax, dword [0x141dcdccc]
or eax, 0x81410a3b
add eax, 0x2018a35a
or eax, 0x36289c7c
cmp eax, 0xcd761b0
jb 0x140081fb1
jmp 0x140081f99
mov eax, dword [0x141dcdcd0]
and eax, dword [0x141dcdcd4]
or eax, 0x5d14ede4
cmp eax, 0xe3bcab38
je 0x140081e20
nop dword [rax + rax]
mov eax, dword [0x141dcdcd8]
add eax, dword [0x141dcdcdc]
cmp eax, 0x7e67e56b
je 0x140081e40
test rdi, rdi
je 0x140081f92
mov eax, dword [0x141dcdce0]
or eax, dword [0x141dcdce4]
and eax, 0x84eb6c66
add eax, 0x8673ce18
or eax, 0x5d85f36f
cmp eax, 0xd0328e4d
jbe 0x140081e90
movzx eax, byte [0x141ddb9b8]
nop word cs:[rax + rax]
mov eax, dword [0x141dcdce8]
add eax, dword [0x141dcdcec]
or eax, 0x65de67d6
add eax, 0x8614d82d
or eax, 0x2b7de107
movzx ecx, byte [0x141ddb9b8]
cmp eax, 0xa6be3760
ja 0x140081e90
mov eax, dword [0x141dcdcf0]
and eax, dword [0x141dcdcf4]
add eax, 0x8b97ac17
xor eax, 0x104a64a
or eax, 0x741a19b0
cmp eax, 0x3c692c72
je 0x140081ffa
jmp 0x140081fc4
mov eax, dword [0x141dcdca8]
add eax, dword [0x141dcdcac]
imul eax, eax, 0x6d9f2b00
imul rax, rax, 0x165668d3
shr rax, 0x3c
cmp eax, 0x9c621c96
ja 0x140081ef0
test rdi, rdi
je 0x140081f92
mov eax, dword [0x141dcdcb0]
xor eax, dword [0x141dcdcb4]
or eax, 0x9d461199
cmp eax, 0x5e823b68
jne 0x140081f40
movzx eax, byte [0x141ddb9b8]
nop dword [rax + rax]
mov eax, dword [0x141dcdcb8]
sub eax, dword [0x141dcdcbc]
imul eax, eax, 0xb630796a
add eax, 0x1d6e8ee
movzx ecx, byte [0x141ddb9b8]
cmp eax, 0xa9cac43f
ja 0x140081f40
xor ecx, ecx
mov rdx, rdi
call fcn.1400bf820
nop
mov ecx, dword [0x141dcdcc0]
or ecx, dword [0x141dcdcc4]
xor ecx, 0x64000148
and ecx, 0xe613317a
cmp ecx, 0xe2f670cf
je 0x140081f70
jmp 0x140082006
mov eax, 8
jmp 0x140082006
xor ebp, ebp
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test bpl, bpl
je 0x140082006
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x140081f99
mov eax, dword [0x141dcdcf8]
xor eax, dword [0x141dcdcfc]
or eax, 0xd33e9fe6
mov ecx, 0xad78f479
imul rcx, rax
shr rcx, 0x3f
imul ebx, ecx, 0x372f6117
xor ecx, ecx
mov rdx, rdi
call fcn.1400bf820
cmp ebx, 0xa30cd8e6
jne 0x140082006
xor ecx, ecx
mov rdx, rdi
call fcn.1400bf820
jmp 0x140081fc4
xor ecx, ecx
test rax, rax
mov edx, 8
cmovne rdx, rax
sete cl
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rdi
mov qword [rsi], rcx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret