joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b7400
Capabilities:
Create thread
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rbx, r8
mov r14, rdx
mov rdi, rcx
xor eax, eax
test al, al
je 0x1400b7420
movzx eax, byte [0x141dd7ff8]
mov eax, dword [0x141dd1148]
and eax, dword [0x141dd114c]
add eax, 0x7cd0ce08
movzx ecx, byte [0x141dd7ff8]
cmp eax, 0x51cad02f
jb 0x1400b7420
mov edx, 0x10
xor ecx, ecx
call fcn.1400beea0
test rax, rax
je 0x1400b7537
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400b7f70]
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
nop word [rax + rax]
mov eax, dword [0x141dd1150]
imul eax, dword [0x141dd1154]
or eax, 0x8894e225
add eax, 0x909cc9b2
or eax, 0x6bf5bbc6
cmp eax, 0x547c642f
jb 0x1400b7490
test rdx, rdx
je 0x1400b74bf
xor eax, eax
jmp 0x1400b76c3
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
mov eax, dword [0x141dd1170]
xor edx, edx
div dword [0x141dd1174]
nop word cs:[rax + rax]
mov eax, dword [0x141dd1178]
and eax, dword [0x141dd117c]
or eax, 0x7ffb11c5
add eax, 0x7839e45b
cmp eax, 0x987a0113
ja 0x1400b74e0
mov r14, qword [rbx]
test r14, r14
je 0x1400b75e5
mov eax, dword [0x141dd1180]
xor edx, edx
div dword [0x141dd1184]
and eax, 0x7010411
or eax, 0x60d66bae
imul eax, eax, 0xcf1b8cde
cmp eax, 0x944a82c2
jne 0x1400b75b5
jmp 0x1400b75dd
mov eax, dword [0x141dd1158]
imul eax, dword [0x141dd115c]
or eax, 0x90004800
xor eax, 0x9000280
and eax, 0x99004a88
cmp eax, 0x19c71e5
jne 0x1400b7560
ud2
mov eax, dword [0x141dd1160]
imul eax, dword [0x141dd1164]
and eax, 0xa140051
or eax, 0xe1889b0a
imul eax, eax, 0x34bfebde
ud2
mov eax, dword [0x141dd1188]
xor edx, edx
div dword [0x141dd118c]
imul ebp, eax, 0xed04701d
add ebp, 0x1e495732
mov rcx, rdi
call r14
cmp ebp, 0x849ed85d
jbe 0x1400b75e5
mov rcx, rdi
call r14
jmp 0x1400b75b5
mov rax, qword [rbx + 8]
nop dword [rax]
mov ecx, dword [0x141dd1190]
or ecx, dword [0x141dd1194]
or ecx, 0x8831262
xor ecx, 0x105a11a0
or ecx, 0xa700cc15
cmp ecx, 0x6edecc4a
je 0x1400b75f0
mov rcx, qword [rbx + 0x10]
nop word [rax + rax]
mov edx, dword [0x141dd1198]
imul edx, dword [0x141dd119c]
imul edx, edx, 0xd6226633
and edx, 0x801701c8
cmp edx, 0x5d715b18
jb 0x1400b7620
test rax, rax
je 0x1400b769c
cmp rcx, 0x11
jb 0x1400b7650
mov rdi, qword [rdi - 8]
xor eax, eax
test al, al
jne 0x1400b7688
mov eax, dword [0x141dd11a0]
xor eax, dword [0x141dd11a4]
imul ebx, eax, 0xce125ab6
and ebx, 0x2fcaf0ae
mov rcx, qword [0x141dd7fe0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0xb60760ac
jne 0x1400b769c
mov rcx, qword [0x141dd7fe0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400b7656
mov rcx, qword [0x141dd7fe0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1400bed50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov eax, dword [str.9qUL]
xor eax, dword [0x141dd1eec]
and eax, 0xf9a9a527
imul eax, eax, 0x50749eef
cmp eax, 0x8011459d
je 0x1400beda0
mov eax, dword [0x141dd1ef0]
xor edx, edx
div dword [0x141dd1ef4]
imul ecx, eax, 0xf37ec23c
add ecx, 0x8ffbb780
or ecx, 0xc19f9ce9
mov eax, dword [0x141dd7f48]
cmp ecx, 0x5f7d2163
jne 0x1400beda8
mov eax, dword [0x141dd7f48]
jmp 0x1400bed72
cmp eax, 3
jne 0x1400bedd8
nop dword [rax]
mov eax, dword [0x141dd1ef8]
xor eax, dword [0x141dd1efc]
imul eax, eax, 0x5d1bc2d1
xor eax, 0x1b46298f
add eax, 0x1e4dba70
cmp eax, 0xe70e3112
jb 0x1400bedb0
add rsp, 0x38
ret
mov byte [rsp + 0x2f], 1
lea rax, [rsp + 0x2f]
mov qword [rsp + 0x30], rax
lea rcx, [0x141dd7f48]
lea r9, [0x141db6388]
lea r8, [rsp + 0x30]
xor edx, edx
call fcn.1400f7ed0
jmp 0x1400bedb0

Function at 0x1400bee10
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov eax, dword [0x141dd1f00]
sub eax, dword [0x141dd1f04]
or eax, 0xa820576
imul eax, eax, 0x1b502231
or eax, 0x9975c78d
cmp eax, 0xd80f426f
ja 0x1400bee66
mov eax, dword [0x141dd1f08]
sub eax, dword [0x141dd1f0c]
or eax, 0x7fedb6bf
mov esi, 0x8a1fd21d
imul rsi, rax
shr rsi, 0x3e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1400bef50
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x1400bf1f4
lea rax, [rcx + 1]
lea rdx, [rcx + rcx]
mov r8d, 4
nop word cs:[rax + rax]
mov r9d, dword [0x141dd1f40]
and r9d, dword [0x141dd1f44]
xor r9d, 0xa54400
and r9d, 0x8afdfe51
imul r9d, r9d, 0xa9d49a37
cmp rdx, rax
mov rdi, rax
cmova rdi, rdx
cmp rdi, 5
cmovb rdi, r8
cmp r9d, 0x8a512d99
je 0x1400bef80
mov r9d, 0x851d3131
mov r10d, 0x28
nop word [rax + rax]
mov r11d, dword [0x141dd1f48]
sub r11d, dword [0x141dd1f4c]
imul r11, r9
shr r11, 0x3f
mov rax, rdi
mul r10
mov r8, rax
seto al
cmp r11d, 0x4d5ba181
je 0x1400befd0
movabs rdx, 0x7ffffffffffffff8
cmp r8, rdx
seta dl
or al, dl
jne 0x1400bf1f4
nop word cs:[rax + rax]
mov eax, dword [0x141dd1f50]
xor edx, edx
div dword [0x141dd1f54]
add eax, 0x41f41d87
and eax, 0x5146bdd6
add eax, 0xeb8026da
cmp eax, 0x200fd309
jb 0x1400bf020
nop word cs:[rax + rax]
mov eax, dword [0x141dd1f58]
add eax, dword [0x141dd1f5c]
xor eax, 0xd53b1428
add eax, 0x683ffbbb
xor eax, 0x4800277
cmp eax, 0x656add31
ja 0x1400bf050
mov eax, 0xa4e21f8d
nop word [rax + rax]
mov edx, dword [0x141dd1f60]
or edx, dword [0x141dd1f64]
and edx, 0x13df32a3
xor edx, 0xc1c2aa04
imul rdx, rax
shr rdx, 0x3f
cmp edx, 0xf6b668f7
ja 0x1400bf080
test rcx, rcx
je 0x1400bf0d3
mov r9, qword [rsi + 8]
shl rcx, 3
lea rcx, [rcx + rcx*4]
mov eax, dword [0x141dd1f68]
add eax, dword [0x141dd1f6c]
and eax, 0x42c06429
cmp eax, 0xaeea523d
jne 0x1400bf0d7
jmp 0x1400bf106
xor eax, eax
jmp 0x1400bf152
mov eax, dword [0x141dd1f70]
xor edx, edx
div dword [0x141dd1f74]
xor eax, 0x5a3a5d37
imul rax, rax, 0x5f783685
shr rax, 0x3e
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x38], rcx
cmp eax, 0x11436bcc
jne 0x1400bf112
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x38], rcx
jmp 0x1400bf0d7
mov eax, 0xb58192ed
nop word [rax + rax]
mov ecx, dword [0x141dd1f78]
add ecx, dword [0x141dd1f7c]
imul rcx, rcx, 0x12753983
shr rcx, 0x3c
imul ecx, ecx, 0xad642f5f
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x99e27f63
ja 0x1400bf120
mov eax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
lea r9, [rsp + 0x28]
mov edx, 8
call fcn.1400bff80
cmp qword [rsp + 0x40], 0
jne 0x1400bf1ec
mov eax, dword [str.___d]
xor edx, edx
div dword [0x141dd1f84]
add eax, 0x76fc4087
mov ecx, 0xb4c5982d
imul rcx, rax
shr rcx, 0x3c
imul eax, ecx, 0xdbc40560
cmp eax, 0x26382a0c
nop
mov eax, dword [0x141dd1f88]
and eax, dword [0x141dd1f8c]
xor eax, 0xfc0cc6b5
imul eax, eax, 0xd2cd7ef0
cmp eax, 0x6b198ab7
je 0x1400bf1a0
mov rax, qword [rsp + 0x48]
mov qword [rsi + 8], rax
mov eax, dword [0x141dd1f90]
sub eax, dword [0x141dd1f94]
or eax, 0xa06bd924
imul eax, eax, 0xe1194dc4
add eax, 0x916bd9f4
cmp eax, 0x353d0295
jae 0x1400bf1f6
jmp 0x1400bf21b
xor eax, eax
nop
test al, al
jne 0x1400bf1f0
ud2
mov eax, dword [0x141dd1f98]
xor eax, dword [0x141dd1f9c]
xor eax, 0x20994c4b
add eax, 0xd79fc839
or eax, 0x9a26c957
mov qword [rsi], rdi
cmp eax, 0x5a76e939
jae 0x1400bf220
mov qword [rsi], rdi
jmp 0x1400bf1f6
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x1400c8fd0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov eax, dword [0x141dd3590]
xor edx, edx
div dword [0x141dd3594]
nop word [rax + rax]
mov eax, dword [0x141dd3598]
sub eax, dword [0x141dd359c]
and eax, 0x68c4cdd0
imul eax, eax, 0x322c9cf6
cmp eax, 0xe12a528c
je 0x1400c8ff0
mov rcx, qword [rsi + 0x10]
nop word cs:[rax + rax]
mov eax, dword [0x141dd35a0]
sub eax, dword [0x141dd35a4]
and eax, 0x18dcd48
or eax, 0xee6032a6
xor eax, 0x1ec3f9b
cmp eax, 0xf9ba68e8
ja 0x1400c9020
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400c90a0
mov eax, dword [0x141dd35a8]
mov ecx, dword [0x141dd35ac]
add eax, ecx
add eax, 0x2b67ef1c
and eax, 0xbb0f69e1
cmp eax, 0xfc161711
je 0x1400c9092
mov edi, dword [0x141dd35b0]
imul edi, dword [0x141dd35b4]
add edi, 0xce99b54c
and edi, 0x1400ad40
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0x58f135be
jbe 0x1400c90a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400c906b
mov eax, dword [0x141dd35b8]
sub eax, dword [0x141dd35bc]
add eax, 0xd8876802
imul rcx, rax, 0xc063c11
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1d
xor eax, 0x3d95bffa
cmp eax, 0x2b49f87
jb 0x1400c90a0
cmp rsi, 0xffffffffffffffff
je 0x1400c9110
lock dec qword [rsi + 8]
sete al
xor ecx, ecx
nop word cs:[rax + rax]
test cl, cl
jne 0x1400c90f0
test al, al
je 0x1400c9110
mov rcx, qword [0x141dd7fe0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop word [rax + rax]
mov eax, dword [str.ZTTb]
xor eax, dword [0x141dd35c4]
imul eax, eax, 0x5953df31
and eax, 0x1aa6dd99
xor eax, 0xdde6ef32
cmp eax, 0xa1068cb6
jb 0x1400c9110
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400d3f70
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rdi, rax
nop word cs:[rax + rax]
mov ecx, dword [0x141dd4c68]
or ecx, dword [0x141dd4c6c]
imul ecx, ecx, 0x8137419f
or ecx, 0x63302a89
imul rcx, rcx, 0x25d845e5
shr rcx, 0x3c
cmp ecx, 0x76519ba9
ja 0x1400d3f90
inc rax
nop
mov ecx, dword [0x141dd4c70]
add ecx, dword [0x141dd4c74]
imul ecx, ecx, 0xe4a5375d
cmp ecx, 0x7ddf3d02
je 0x1400d3fc0
cmp rax, 2
jb 0x1400d40ab
mov eax, dword [0x141dd4c78]
and eax, dword [0x141dd4c7c]
add eax, 0x389b2746
xor eax, 0x42698df5
add eax, 0xa24b7c7e
cmp eax, 0x5389308b
jae 0x1400d4014
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov eax, dword [0x141dd4c80]
and eax, dword [0x141dd4c84]
and eax, 0x3be755a2
imul r14, rax, 0x17625bdf
shr r14, 0x3a
xor r14d, 0xffeb16c1
mov rcx, rdi
xor edx, edx
mov r8, rsi
call rbx
cmp r14d, 0x5e62ac92
jb 0x1400d4020
nop word cs:[rax + rax]
mov ecx, dword [0x141dd4c88]
add ecx, dword [0x141dd4c8c]
imul ecx, ecx, 0xb5d96167
add ecx, 0xa624401
cmp ecx, 0xe0a40771
ja 0x1400d4060
mov ecx, dword [0x141dd4c90]
imul ecx, dword [0x141dd4c94]
xor ecx, 0x40900
and ecx, 0x6d58908
imul ecx, ecx, 0x4071b070
cmp ecx, 0x311f5194
je 0x1400d4080
test eax, eax
jne 0x1400d40da
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop word cs:[rax + rax]
mov eax, dword [0x141dd4c98]
xor edx, edx
div dword [0x141dd4c9c]
or eax, 0x794d1dff
cmp eax, 0x5d7d2bd9
je 0x1400d40c0
mov eax, 0x90ce35ff
nop
mov ecx, dword [0x141dd4ca0]
add ecx, dword [0x141dd4ca4]
xor ecx, 0x88201d9b
add ecx, 0x612fcd99
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0x9b2d52a
ja 0x1400d40e0
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400d46f0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rbx, r9
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov r13, r9
shr r13, 1
mov rax, r13
inc rax
mov qword [rsp + 0x30], rax
lea r12, [r13 + r13 + 2]
movabs rax, 0x8000000000000000
sets cl
add rax, 0xfffffffffffffffe
cmp r12, rax
seta al
or al, cl
nop dword [rax + rax]
mov ecx, dword [0x141dd4da8]
xor ecx, dword [0x141dd4dac]
cmp ecx, 0xaebf78aa
je 0x1400d4740
test al, al
jne 0x1400d4b01
nop dword [rax]
mov eax, dword [0x141dd4db0]
xor edx, edx
div dword [0x141dd4db4]
cmp eax, 0x636a30ba
je 0x1400d4760
nop word cs:[rax + rax]
mov eax, dword [0x141dd4db8]
sub eax, dword [0x141dd4dbc]
xor eax, 0xa46034b3
add eax, 0x80f324e8
and eax, 0xe720a510
cmp eax, 0x13381975
ja 0x1400d4780
test r12, r12
je 0x1400d47d5
movzx eax, byte [0x141dd7ff8]
mov eax, dword [0x141dd4dc0]
or eax, dword [0x141dd4dc4]
xor eax, 0x3d5a15d9
imul eax, eax, 0x63dd0a13
cmp eax, 0xe184cb41
jne 0x1400d4a5f
jmp 0x1400d4a93
mov edi, 2
xor r12d, r12d
ud2

Function at 0x1400d4f00
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rdi, rdx
mov rsi, rcx
mov eax, dword [0x141dd4e88]
sub eax, dword [0x141dd4e8c]
and eax, 0xa0210500
or eax, 0x599eea4a
imul eax, eax, 0x81ebc1c
cmp eax, 0xedb7a11f
jbe 0x1400d4f54
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov edx, 0x3c
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtQueryInformationProcess
lea rbx, [rsp + 0x3c]
nop dword [rax]
add byte [rax], al
add byte [rax], al
Function at 0x1400d6900
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x1400d6b4e
lea rax, [rcx + 1]
nop word [rax + rax]
mov edx, dword [0x141dd5208]
xor edx, dword [0x141dd520c]
imul edx, edx, 0x796ad11c
and edx, 0xe357b6e8
add edx, 0xbeae0bcc
cmp edx, 0xaec7b1cd
ja 0x1400d6920
movabs rdx, 0x7ffffffffffffffc
movabs r8, 0xfffffffffffffff
lea r9, [rcx + rcx]
mov r10d, 4
nop word cs:[rax + rax]
mov r11d, dword [0x141dd5210]
or r11d, dword [0x141dd5214]
add r11d, 0x4211105f
and r11d, 0xdffc2e20
xor r11d, 0x2950e6f6
cmp r9, rax
mov rdi, rax
cmova rdi, r9
cmp rdi, 5
cmovb rdi, r10
cmp r11d, 0x269b7807
jb 0x1400d6970
cmp rdi, r8
ja 0x1400d6b4e
mov r8, rdi
shl r8, 4
cmp r8, rdx
ja 0x1400d6b4e
xor eax, eax
nop dword [rax]
test al, al
jne 0x1400d69d0
mov r9d, 0x92fefe9b
nop word [rax + rax]
mov eax, dword [0x141dd5218]
xor edx, edx
div dword [0x141dd521c]
imul rax, r9
shr rax, 0x3d
imul eax, eax, 0x42b57b74
or eax, 0xb003a9d9
cmp eax, 0xb54a3943
ja 0x1400d69e0
test rcx, rcx
je 0x1400d6a3a
mov r9, qword [rsi + 8]
shl rcx, 4
mov eax, dword [0x141dd5220]
or eax, dword [0x141dd5224]
xor eax, 0x6cc6cfb
imul eax, eax, 0xc3d765a4
or eax, 0xe3dca09d
cmp eax, 0xa7e685ab
jne 0x1400d6a3e
jmp 0x1400d6a70
xor eax, eax
jmp 0x1400d6a81
mov eax, dword [0x141dd5228]
xor edx, edx
div dword [0x141dd522c]
or eax, 0x6137bbab
xor eax, 0xaa304ccc
mov edx, 0x907769a5
imul rdx, rax
shr rdx, 0x3d
mov qword [rsp + 0x28], r9
cmp edx, 0x2c0cebed
jbe 0x1400d6a77
mov qword [rsp + 0x28], r9
jmp 0x1400d6a3e
mov qword [rsp + 0x38], rcx
mov eax, 4
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
lea r9, [rsp + 0x28]
mov edx, 4
call fcn.1400bff80
cmp qword [rsp + 0x40], 0
jne 0x1400d6b30
mov eax, dword [0x141dd5248]
and eax, dword [0x141dd524c]
imul eax, eax, 0x45e873a7
shr eax, 1
imul rax, rax, 0x400f505b
shr rax, 0x3d
cmp eax, 0x59eaab25
nop word [rax + rax]
xor eax, eax
test al, al
jne 0x1400d6ad0
mov rcx, qword [rsp + 0x48]
mov eax, dword [0x141dd5250]
xor edx, edx
div dword [0x141dd5254]
or eax, 0xd3fdfefb
cmp eax, 0xf463f0cb
jne 0x1400d6b00
mov qword [rsi + 8], rcx
nop dword [rax]
mov eax, dword [0x141dd5258]
sub eax, dword [0x141dd525c]
or eax, 0xf2f5c091
and eax, 0xf3f5c1bb
mov qword [rsi + 8], rcx
cmp eax, 0x754be81
jb 0x1400d6b00
mov qword [rsi], rdi
add rsp, 0x58
pop rdi
pop rsi
ret
mov eax, dword [0x141dd5230]
and eax, dword [0x141dd5234]
imul rax, rax, 0x69093597
shr rax, 0x3c
cmp eax, 0xe1660596
je 0x1400d6b30
xor eax, eax
test al, al
jne 0x1400d6b7b
mov eax, dword [0x141dd5238]
xor edx, edx
div dword [0x141dd523c]
xor eax, 0x76ff0d1b
imul eax, eax, 0xe2b13302
or eax, 0x1cecdb67
ud2
ud2
Function at 0x1400d9420
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rax, qword [rcx]
mov rsi, rcx
mov ecx, 0xb7c09915
nop word cs:[rax + rax]
mov edx, dword [0x141dd5760]
xor edx, dword [0x141dd5764]
imul edx, edx, 0x372f4910
imul rdx, rcx
shr rdx, 0x3f
cmp edx, 0xf5398431
je 0x1400d9440
cmp rax, 0xffffffffffffffff
je 0x1400d96a2
lea rdx, [rax + 1]
movabs r9, 0x7ffffffffffffffe
lea rcx, [rax + rax]
mov r10d, 4
nop word cs:[rax + rax]
mov ebp, dword [0x141dd5768]
and ebp, dword [0x141dd576c]
add ebp, 0xc60b6754
xor ebp, 0xa0211852
or ebp, 0x1bdee500
cmp rcx, rdx
mov rdi, rdx
cmova rdi, rcx
cmp rdi, 5
cmovb rdi, r10
lea r8, [rdi + rdi]
test rdi, rdi
sets r11b
cmp r8, r9
seta bl
cmp ebp, 0xb343ec5b
ja 0x1400d9490
or r11b, bl
nop dword [rax]
mov edx, dword [0x141dd5770]
imul edx, dword [0x141dd5774]
add edx, 0x78ec7519
xor edx, 0xda81f043
cmp edx, 0x6051d0de
ja 0x1400d94e0
test r11b, r11b
jne 0x1400d96a2
nop word [rax + rax]
mov edx, dword [0x141dd5778]
and edx, dword [0x141dd577c]
add edx, 0x51e5cc83
or edx, 0xdedf0a2
add edx, 0xea329524
cmp edx, 0x9b2abaef
ja 0x1400d9510
nop word cs:[rax + rax]
mov edx, dword [0x141dd5780]
xor edx, dword [0x141dd5784]
and edx, 0x932d3dbe
imul edx, edx, 0x4ef1075f
cmp edx, 0x77ca215
jb 0x1400d9540
test rax, rax
je 0x1400d95de
mov eax, dword [0x141dd5788]
imul eax, dword [0x141dd578c]
xor eax, 0x2344edd6
imul eax, eax, 0xf4872c7a
add eax, 0x789695fe
cmp eax, 0xc52da6cf
jbe 0x1400d95a0
mov rax, qword [rsi + 8]
mov qword [rsp + 0x28], rax
nop word cs:[rax + rax]
mov eax, dword [0x141dd5790]
or eax, dword [0x141dd5794]
imul eax, eax, 0x936369fb
add eax, 0x8efa9e7d
mov rdx, qword [rsi + 8]
mov qword [rsp + 0x28], rdx
cmp eax, 0xfa37015b
ja 0x1400d95a0
mov eax, dword [0x141dd5798]
xor edx, edx
div dword [0x141dd579c]
cmp eax, 0x4a4f777e
jne 0x1400d95e2
jmp 0x1400d960b
xor eax, eax
jmp 0x1400d9644
mov eax, dword [0x141dd57a0]
xor edx, edx
div dword [0x141dd57a4]
and eax, 0x4134f5bf
add eax, 0xfb1a4337
xor eax, 0xabca3864
mov qword [rsp + 0x38], rcx
cmp eax, 0x547b7cf4
jbe 0x1400d9620
mov qword [rsp + 0x38], rcx
jmp 0x1400d95e2
mov eax, dword [0x141dd57a8]
imul eax, dword [0x141dd57ac]
imul eax, eax, 0x1d2a69c
or eax, 0x96bf6853
cmp eax, 0x97be33ae
je 0x1400d9620
mov eax, 2
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
lea r9, [rsp + 0x28]
mov edx, 2
call fcn.1400bff80
cmp qword [rsp + 0x40], 0
jne 0x1400d967a
mov rax, qword [rsp + 0x48]
mov qword [rsi + 8], rax
mov qword [rsi], rdi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov eax, 0xb5325c59
nop
mov ecx, dword [0x141dd57b0]
xor ecx, dword [0x141dd57b4]
imul rcx, rax
shr rcx, 0x3f
or ecx, 0xf1d3e26a
cmp ecx, 0x16c9cdbd
jb 0x1400d9680
mov eax, dword [0x141dd57b8]
imul eax, dword [0x141dd57bc]
and eax, 0x2168730
add eax, 0x15f23b26
cmp eax, 0x1f710ce1
ja 0x1400d96df
mov eax, dword [0x141dd57c0]
and eax, dword [0x141dd57c4]
xor eax, 0x8480002
or eax, 0xf7b6f9f9
ud2
ud2
Function at 0x1400ece40
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax]
mov ecx, dword [0x141dd7e00]
sub ecx, dword [0x141dd7e04]
xor ecx, 0x2a002025
and ecx, 0x2a4022af
cmp ecx, 0x87ff2781
je 0x1400ece50
mov ecx, dword [0x141dd7e08]
imul ecx, dword [0x141dd7e0c]
add ecx, 0x6d7b9b9a
or ecx, 0xbbffffaf
cmp ecx, 0x76296fa1
jb 0x1400ece70
cmp rax, 0xffffffffffffffff
je 0x1400ed052
lea rcx, [rax + 1]
lea rdx, [rax + rax]
cmp rdx, rcx
cmova rcx, rdx
cmp rcx, 9
mov edi, 8
cmovae rdi, rcx
test rdi, rdi
js 0x1400ed052
mov ecx, dword [0x141dd7e10]
sub ecx, dword [0x141dd7e14]
or ecx, 0xcb482980
cmp ecx, 0x5deb9e3a
je 0x1400ecec0
test rax, rax
je 0x1400ecf5d
mov rcx, qword [rsi + 8]
mov edx, dword [0x141dd7e18]
or edx, dword [0x141dd7e1c]
or edx, 0x290744fd
imul rdx, rdx, 0x10914a35
shr rdx, 0x3c
cmp edx, 0x8069f943
jne 0x1400ecf10
mov qword [rsp + 0x28], rcx
nop dword [rax]
mov edx, dword [0x141dd7e20]
and edx, dword [0x141dd7e24]
add edx, 0x70ef3d1
and edx, 0xe95c389d
add edx, 0x2ea038c6
mov qword [rsp + 0x28], rcx
cmp edx, 0xa57296af
ja 0x1400ecf10
mov ecx, dword [0x141dd7e28]
and ecx, dword [0x141dd7e2c]
imul ecx, ecx, 0x3dcfd4b
add ecx, 0xa0699429
cmp ecx, 0xd0b2d246
jbe 0x1400ecf61
jmp 0x1400ecf80
xor eax, eax
jmp 0x1400ecf8c
mov ecx, dword [0x141dd7e30]
sub ecx, dword [0x141dd7e34]
and ecx, 0x5100d2ca
mov qword [rsp + 0x38], rax
cmp ecx, 0x96643bd8
jne 0x1400ecf87
mov qword [rsp + 0x38], rax
jmp 0x1400ecf61
mov eax, 1
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
lea r9, [rsp + 0x28]
mov edx, 1
mov r8, rdi
call fcn.1400bff80
cmp qword [rsp + 0x40], 0
jne 0x1400ecff0
mov eax, dword [0x141dd7e58]
xor edx, edx
div dword [0x141dd7e5c]
and eax, 0x404402a1
imul eax, eax, 0x49dccd5a
cmp eax, 0xaefceaa8
ja 0x1400ecfb0
mov rax, qword [rsp + 0x48]
mov qword [rsi + 8], rax
mov qword [rsi], rdi
add rsp, 0x58
pop rdi
pop rsi
ret
mov eax, dword [0x141dd7e38]
and eax, dword [0x141dd7e3c]
add eax, 0xd8e0f826
imul rcx, rax, 0x3cac01e7
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
cmp eax, 0x1dba6d94
je 0x1400ecff0
mov ecx, 0xcf4142ef
nop word cs:[rax + rax]
mov eax, dword [0x141dd7e40]
xor edx, edx
div dword [0x141dd7e44]
add eax, 0x7a6fea26
imul rax, rcx
shr rax, 0x3f
cmp eax, 0xceb2dcf5
je 0x1400ed030
mov eax, dword [0x141dd7e48]
xor edx, edx
div dword [0x141dd7e4c]
imul eax, eax, 0x856e8205
or eax, 0x8efb86a2
cmp eax, 0xd5871854
jne 0x1400ed080
ud2
mov eax, dword [0x141dd7e50]
imul eax, dword [0x141dd7e54]
or eax, 0xc4916c6c
add eax, 0xa9016979
and eax, 0xbffa86b2
ud2

Function at 0x1400ed868
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400ed8b2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400ed8b2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400ed8b2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400ed8b2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400ed8b2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400ed8b4
xor al, al
add rsp, 0x28
ret