joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140088a00
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x140088a80
mov rsi, rcx
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x140088a20
mov eax, esi
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x140088a80
test rax, rax
je 0x140088a80
mov rdi, qword [rsi - 1]
mov rbx, qword [rsi + 7]
mov r14, qword [rbx]
test r14, r14
je 0x140088ada
mov eax, dword [0x141dce4f8]
and eax, dword [0x141dce4fc]
imul eax, eax, 0x3f5c1473
or eax, 0x86d7d406
xor eax, 0x599413e1
cmp eax, 0x714b7be0
jae 0x140088aa8
jmp 0x140088ad2
mov eax, dword [0x141dce500]
add eax, dword [0x141dce504]
and eax, 0x9108385
or eax, 0x726b6c7a
imul ebp, eax, 0xa0d69e75
mov rcx, rdi
call r14
cmp ebp, 0xbc7083
jae 0x140088ada
mov rcx, rdi
call r14
jmp 0x140088aa8
cmp qword [rbx + 8], 0
je 0x140088b42
mov rax, qword [rbx + 0x10]
xor ecx, ecx
nop word [rax + rax]
test cl, cl
jne 0x140088af0
cmp rax, 0x11
jb 0x140088b30
nop word [rax + rax]
mov eax, dword [0x141dce508]
and eax, dword [0x141dce50c]
add eax, 0x22a9de56
imul rcx, rax, 0x2d79f5b7
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
cmp eax, 0xdcbbaedd
je 0x140088b00
mov rdi, qword [rdi - 8]
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
dec rsi
mov rdi, qword [0x141ddb260]
xor eax, eax
test al, al
je 0x140088b60
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word [rax + rax]

Function at 0x140089f70
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor eax, eax
nop dword [rax + rax]
test al, al
jne 0x140089f90
test rsi, rsi
je 0x14008a92b
xor r13d, r13d
lea r15, [0x141dba424]
mov r12d, 0x82905299
lea rbp, [0x141dba4d8]
nop word cs:[rax + rax]
Function at 0x14008aa30
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov eax, dword [0x141ddb27c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x48]
cmp rcx, 0xffffffffffffffff
je 0x14008acf8
lea rax, [rcx + 1]
nop
mov edx, dword [0x141dce970]
imul edx, dword [0x141dce974]
add edx, 0xed289ee4
imul rdx, rdx, 0x7e186765
shr rdx, 0x3d
or edx, 0x4121a99
cmp edx, 0x7acfe0a6
ja 0x14008aa60
movabs rdx, 0xfffffffffffffff
lea r8, [rcx + rcx]
mov r9d, 4
xor r10d, r10d
nop word cs:[rax + rax]
cmp r8, rax
mov rdi, rax
cmova rdi, r8
cmp rdi, 5
cmovb rdi, r9
test r10b, r10b
jne 0x14008aab0
mov rsi, rdi
shl rsi, 4
movabs rax, 0x7ffffffffffffff8
xor r8d, r8d
nop dword [rax + rax]
cmp rdi, rdx
seta r9b
cmp rsi, rax
seta r10b
test r8b, r8b
jne 0x14008aae0
or r9b, r10b
jne 0x14008acf8
nop dword [rax]
mov eax, dword [0x141dce978]
and eax, dword [0x141dce97c]
xor eax, 0x920dc12d
add eax, 0x8e274b18
or eax, 0x1dbaf75
cmp eax, 0x1d020dbd
jb 0x14008ab00
nop word cs:[rax + rax]
mov eax, dword [0x141dce980]
xor edx, edx
div dword [0x141dce984]
and eax, 0xc4c937db
xor eax, 0x2726f4a1
add eax, 0xfa11a365
cmp eax, 0xe3e2b381
ja 0x14008ab30
test rcx, rcx
je 0x14008ac05
mov eax, dword [0x141ddb27c]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
mov rax, qword [rax + 0x50]
shl rcx, 4
nop dword [rax + rax]
mov edx, dword [0x141dce988]
add edx, dword [0x141dce98c]
imul edx, edx, 0x28286e9d
add edx, 0xb613650c
or edx, 0xf0170db8
cmp edx, 0x1ae58d6f
je 0x14008ab80
mov edx, dword [0x141dce990]
and edx, dword [0x141dce994]
or edx, 0x3c6180
imul edx, edx, 0x2dce848b
or edx, 0xf4dd3653
cmp edx, 0x5613951d
jae 0x14008abe0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rcx
nop word cs:[rax + rax]
mov edx, dword [0x141dce998]
xor edx, dword [0x141dce99c]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rcx
cmp edx, 0xc598d171
je 0x14008abe0
mov ebx, 8
jmp 0x14008ac07
xor ebx, ebx
mov eax, dword [0x141dce9a0]
and eax, dword [0x141dce9a4]
imul eax, eax, 0x5cb51f23
add eax, 0xcd306af5
imul rax, rax, 0x4ed7c1dd
shr rax, 0x3e
cmp eax, 0xdd1d515b
ja 0x14008ac52
mov qword [rsp + 0x28], rbx
lea rcx, [rsp + 0x38]
lea r9, [rsp + 0x20]
mov edx, 8
mov r8, rsi
call fcn.1400c1320
xor eax, eax
test al, al
je 0x14008ac70
mov qword [rsp + 0x28], rbx
lea rcx, [rsp + 0x38]
lea r9, [rsp + 0x20]
mov edx, 8
mov r8, rsi
call fcn.1400c1320
jmp 0x14008ac30
cmp qword [rsp + 0x38], 0
jne 0x14008acc6
mov rax, qword [rsp + 0x40]
mov ecx, dword [0x141ddb27c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov qword [rcx + 0x50], rax
mov qword [rcx + 0x48], rdi
nop
mov eax, dword [0x141dce9b8]
imul eax, dword [0x141dce9bc]
add eax, 0x5ad1fd93
xor eax, 0xe4be62c
cmp eax, 0x49528464
jb 0x14008aca0
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
mov eax, 0xdb6c4b0b
nop dword [rax + rax]
mov ecx, dword [0x141dce9a8]
xor ecx, dword [0x141dce9ac]
add ecx, 0xa52132ed
and ecx, 0xa7e97e4c
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0xf8a4d00f
je 0x14008acd0
ud2
Function at 0x14008b840
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
test dl, dl
je 0x14008b84c
mov byte [rcx + 0x10], 1
lock dec qword [rcx + 8]
jne 0x14008b8c9
mov rcx, qword [rcx]
mov al, 1
xchg byte [rcx + 0x30], al
add rcx, 0x30
nop
mov edx, dword [0x141dceb00]
imul edx, dword [0x141dceb04]
imul edx, edx, 0x6451a706
cmp edx, 0x1e880a3
je 0x14008b860
nop dword [rax + rax]
mov edx, dword [0x141dceb08]
or edx, dword [0x141dceb0c]
add edx, 0x8c0c9992
xor edx, 0x55ef0d5f
cmp edx, 0xa21dca42
ja 0x14008b880
cmp al, 0xff
jne 0x14008b8c9
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
nop word [rax + rax]
mov eax, dword [0x141dceb10]
and eax, dword [0x141dceb14]
imul eax, eax, 0x21ba91ab
cmp eax, 0x7486091b
je 0x14008b8b0
add rsp, 0x28
ret
Function at 0x14008b8d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
mov eax, dword [0x141dceb18]
sub eax, dword [0x141dceb1c]
shr eax, 4
imul rax, rax, 0x1869f05d
shr rax, 0x36
xor eax, 0xc4dd9a7a
add eax, 0xd1401c7a
cmp eax, 0x2490f180
jb 0x14008b93a
mov eax, dword [0x141dceb20]
xor edx, edx
div dword [0x141dceb24]
mov ebx, eax
or ebx, 0xa48fc4cb
xor ecx, ecx
xor edx, edx
mov r8d, 2
mov r9d, 0x1f0003
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerExW]
cmp ebx, 0x529a0d05
jne 0x14008b952
xor ecx, ecx
xor edx, edx
mov r8d, 2
mov r9d, 0x1f0003
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerExW]
jmp 0x14008b906
mov rdi, rax
test rax, rax
je 0x14008ba93
nop
mov eax, dword [0x141dceb28]
or eax, dword [0x141dceb2c]
xor eax, 0x940a64
or eax, 0xf36a3198
imul rax, rax, 0x48e0cb03
shr rax, 0x3e
cmp eax, 0xea3fb4cc
ja 0x14008b960
imul rax, rsi, 0xffffffffff676980
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
mov rcx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
mov ecx, dword [0x141dceb30]
xor ecx, dword [0x141dceb34]
add ecx, 0xfcb5fee0
mov edx, 0x96211f43
imul rdx, rcx
shr rdx, 0x3f
cmp edx, 0x6bfbf11a
xor ecx, ecx
test cl, cl
jne 0x14008b9e0
test eax, eax
je 0x14008ba08
mov eax, dword [0x141dceb40]
add eax, dword [0x141dceb44]
imul eax, eax, 0x47ed1cd2
add eax, 0xcbe6ff4c
cmp eax, 0x6abb7444
jae 0x14008ba40
jmp 0x14008ba6f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word cs:[rax + rax]
mov eax, dword [0x141dceb38]
imul eax, dword [0x141dceb3c]
and eax, 0x9a83068
add eax, 0x41969d79
cmp eax, 0x2959400e
jb 0x14008ba20
jmp 0x14008ba93
mov ebp, dword [0x141dceb48]
imul ebp, dword [0x141dceb4c]
add ebp, 0x32effd9c
or ebp, 0x5606df66
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp ebp, 0x2da27c1
jne 0x14008ba7f
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x14008ba40
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0xffffffff
jne 0x14008bb33
imul rax, rsi, 0x3e8
mov esi, 0xffffffff
cmp rax, rsi
cmovb rsi, rax
mov eax, dword [0x141dceb50]
xor edx, edx
div dword [0x141dceb54]
and eax, 0x126810af
imul eax, eax, 0xe2664cff
cmp eax, 0x14859997
jae 0x14008bace
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
nop word cs:[rax + rax]
mov eax, dword [0x141dceb58]
sub eax, dword [0x141dceb5c]
add eax, 0xf0c95bf9
and eax, 0xa0dbb631
imul ebx, eax, 0x221f2ae6
mov ecx, esi
call rdi
cmp ebx, 0x4ef2eeaf
jb 0x14008bae0
nop dword [rax + rax]
mov eax, dword [0x141dceb60]
add eax, dword [0x141dceb64]
imul eax, eax, 0xf46fecd4
or eax, 0x438400
and eax, 0x7c78c04
cmp eax, 0xc5b96aad
ja 0x14008bb10
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14008bb40
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
xor ecx, ecx
test rax, rax
sete cl
lea r8, [0x141db9768]
cmovne r8, rax
nop dword [rax + rax]
mov eax, dword [0x141dceb68]
xor edx, edx
div dword [0x141dceb6c]
and eax, 0xa13d45b0
imul rax, rax, 0x37672d0f
shr rax, 0x3d
or eax, 0xf33bb894
cmp eax, 0x613c51e7
jb 0x14008bb80
mov rax, rcx
mov rdx, r8
add rsp, 0x58
ret
Function at 0x14008d660
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov r8, rdx
movzx r11d, byte [rdx + 0x38]
nop dword [rax + rax]
mov eax, dword [0x141dceef8]
mov edx, dword [0x141dceefc]
add eax, edx
add eax, 0x3d8c09f4
or eax, 0x8bac69ec
imul eax, eax, 0x7ee2483b
cmp eax, 0xeebad858
je 0x14008d680
cmp r11b, 3
je 0x14008d6db
movzx ebx, byte [r8 + 0x39]
movzx r10d, byte [r8 + 0x10]
xor edx, edx
cmp r10, 3
setae r9b
mov rsi, qword [r8 + 0x30]
lea rax, [rsi + 1]
test rsi, rsi
cmove rax, rsi
mov byte [rsp + 7], bl
cmp bl, 3
jne 0x14008d76d
mov dl, r9b
lea edx, [rdx + rdx*2]
add edx, 7
mov dword [rsp + 0x1c], edx
movzx edx, byte [r8 + 0x3a]
mov byte [rsp + 6], dl
mov r9, qword [r8 + 0x20]
lea rdx, [r9 + rax + 2]
mov qword [rsp + 8], rdx
add rax, r9
add rax, 8
mov qword [rsp + 0x10], rax
add r9, 4
nop word cs:[rax + rax]
mov eax, dword [0x141dcef00]
xor eax, dword [0x141dcef04]
and eax, 0xca00c118
add eax, 0xc717778
cmp eax, 0x5212f3f6
jb 0x14008d7b0
mov rdi, qword [r8 + 8]
nop word cs:[rax + rax]
mov eax, dword [0x141dcef08]
xor edx, edx
div dword [0x141dcef0c]
imul eax, eax, 0xefca62a2
xor eax, 0x843d98bf
cmp eax, 0x17920b6f
jb 0x14008d7e0
mov qword [rsp + 0x28], r9
mov rdx, qword [r8]
nop dword [rax + rax]
mov eax, dword [0x141dcef10]
and eax, dword [0x141dcef14]
add eax, 0x4d160052
xor eax, 0x27a0025
or eax, 0xf805d8ca
cmp eax, 0xc792134a
je 0x14008d810
xor r15d, r15d
mov r13d, 0x8b43aceb
mov r12d, 0xf76c9a57
mov esi, 0x93c4af7d
mov rbx, rdi
jmp 0x14008d856
Function at 0x14008ec20
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov r8, rdx
mov eax, 0xe96671b9
nop
mov edx, dword [0x141dcf1d8]
mov r9d, dword [0x141dcf1dc]
add edx, r9d
add edx, 0xcc667059
imul rdx, rax
shr rdx, 0x3d
cmp edx, 0x4a8adf74
ja 0x14008ec30
mov eax, dword [0x141dcf1e0]
xor edx, edx
div dword [0x141dcf1e4]
nop word cs:[rax + rax]
mov eax, dword [0x141dcf1e8]
add eax, dword [0x141dcf1ec]
imul eax, eax, 0x75a0adaf
xor eax, 0x39cb8589
cmp eax, 0xc8d17b27
ja 0x14008ec70
nop
mov eax, dword [0x141dcf1f0]
xor eax, dword [0x141dcf1f4]
imul eax, eax, 0xc37dae20
xor eax, 0xe0240000
or eax, 0x1540f2bf
movzx r10d, byte [r8 + 0x3a]
test r10b, r10b
setne r9b
cmp eax, 0x9dea33a8
je 0x14008ec90
movzx r11d, byte [r8 + 0x38]
cmp r11b, 1
ja 0x14008ee01
mov eax, dword [0x141dcf1f8]
xor edx, edx
div dword [0x141dcf1fc]
nop dword [rax]
mov eax, dword [0x141dcf200]
imul eax, dword [0x141dcf204]
xor eax, 0x24d0051
or eax, 0xe592ffae
cmp eax, 0x177a57e3
jb 0x14008ece0
test r10b, r10b
je 0x14008ed10
xor r10d, r10d
jmp 0x14008ef00
mov eax, dword [0x141dcf208]
sub eax, dword [0x141dcf20c]
xor eax, 0x60010120
or eax, 0x9efedccb
imul rax, rax, 0x38f13bbb
shr rax, 0x3d
cmp eax, 0x3dadb0c3
ja 0x14008ed10
nop dword [rax + rax]
mov eax, dword [0x141dcf210]
imul eax, dword [0x141dcf214]
imul eax, eax, 0xbf77524e
xor eax, 0x1807a100
or eax, 0xe7584ea7
cmp eax, 0xc934548c
je 0x14008ed40
movzx r10d, byte [r8 + 0x10]
lea eax, [r10 - 5]
cmp al, 1
ja 0x14008ee0c
mov rax, qword [r8]
mov rdx, qword [r8 + 8]
nop dword [rax]
mov esi, dword [0x141dcf218]
imul esi, dword [0x141dcf21c]
add esi, 0x9c9a3661
imul rsi, rsi, 0x7ca0c55
shr rsi, 0x3a
xor esi, 0x2f6e882f
cmp esi, 0xe93bd417
ja 0x14008ed80
xor edi, edi
test r11b, r11b
jne 0x14008edf4
cmp r10b, 6
je 0x14008edf4
nop dword [rax]
mov r10d, dword [0x141dcf220]
sub r10d, dword [0x141dcf224]
add r10d, 0x3a880c41
and r10d, 0xd5b4a6af
cmp r10d, 0x9d8c8e7a
jb 0x14008edc0
mov edi, 2
cmp rdx, 1
jbe 0x14008f4dd
cmp rdi, rdx
jne 0x14008ee14
xor r10d, r10d
jmp 0x14008ef00
xor r9d, r9d
xor r10d, r10d
jmp 0x14008ef68
xor r10d, r10d
jmp 0x14008ef00
add rdx, rax
lea rsi, [rax + rdi]
inc rsi
nop
mov ebx, dword [0x141dcf228]
sub ebx, dword [0x141dcf22c]
xor ebx, 0x11131463
add ebx, 0x17c504a5
cmp rsi, rdx
sete r10b
cmp ebx, 0xa13e823a
ja 0x14008ee20
movzx eax, byte [rax + rdi]
nop dword [rax + rax]
Function at 0x140092ca0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rbx, rdx
mov rsi, rcx
mov eax, dword [0x141dcfa60]
xor eax, dword [0x141dcfa64]
add eax, 0xff3211c
xor eax, 0xc100468a
imul eax, eax, 0x45373c72
cmp eax, 0x2893020a
jb 0x140092cfb
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r14, rsp
mov eax, 0x40
call fcn.1400ef330
sub rsp, rax
mov rdi, rsp
xor eax, eax
test al, al
je 0x140092d17
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x40
call fcn.1400ef330
sub rsp, rax
jmp 0x140092cd5
mov eax, dword [0x141dcfa68]
sub eax, dword [0x141dcfa6c]
and eax, 0x85355010
imul eax, eax, 0x6372d0fe
cmp eax, 0xf34cddcd
ja 0x140092d8a
Function at 0x1400948e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc8
add byte [rax], al
lea rbp, [rsp + 0x80]
mov r15, rdx
mov eax, dword [0x141dcfd80]
and eax, dword [0x141dcfd84]
add dword [rax - 0x77], ecx
cmp byte [r9 - 0x40], r13b
pop r8
sub al, 5
add dword [rbp + 0x2d3d2033], esp
pop rbp
xchg ebx, eax
sbb dh, byte [rbx + 0x4e]
mov eax, 0x30
call fcn.1400ef330
sub rsp, rax
mov eax, 0x30
call fcn.1400ef330
sub rsp, rax
mov eax, 0x30
xor byte [rax], al
add byte [rax], al
call fcn.1400ef330
sub rsp, rax
mov eax, 0x30
call fcn.1400ef330
sub rsp, rax
mov eax, 0x40
call fcn.1400ef330
sub rsp, rax
mov eax, 0x40
call fcn.1400ef330
sub rsp, rax
mov qword [rbp + 0x20], r8
xor ecx, ecx
nop word cs:[rax + rax]

Function at 0x140097bc0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r8, qword [rcx]
cmp r8, 0xffffffffffffffff
je 0x140097df0
mov rsi, rcx
lea r9, [r8 + 1]
lea r10, [r8 + r8]
mov r11d, 4
mov ebx, 0x38
nop word [rax + rax]
Function at 0x1400981b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x141dd04c8]
xor edx, edx
div dword [0x141dd04cc]
add eax, 0x92d01a7f
and eax, 0xb1d2ef51
cmp eax, 0xa56e5a4c
jne 0x140098279
mov eax, 0x70
call fcn.1400ef330
sub rsp, rax
mov eax, 0x40
call fcn.1400ef330
sub rsp, rax
mov eax, 0x40
call fcn.1400ef330
sub rsp, rax
mov eax, 0x40
call fcn.1400ef330
sub rsp, rax
mov eax, 0x40
call fcn.1400ef330
sub rsp, rax
mov eax, 0x30
call fcn.1400ef330
sub rsp, rax
mov eax, 0x40
call fcn.1400ef330
sub rsp, rax
mov eax, 0x30
call fcn.1400ef330
sub rsp, rax
mov rcx, rsp
mov eax, 0x30
call fcn.1400ef330
sub rsp, rax
sub rsp, 0x20
mov rdx, rdi
mov r8, rsi
call fcn.14008c370
add rsp, 0x20
mov qword [rbp], rdi
mov qword [rbp - 0x10], rsi
nop word cs:[rax + rax]

Function at 0x140099a20
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov rdi, rdx
nop word cs:[rax + rax]
mov eax, dword [0x141dd07f0]
or eax, dword [0x141dd07f4]
imul eax, eax, 0xc79e8029
add eax, 0xc1f74834
cmp eax, 0xd72927a4
ja 0x140099a40
movzx ebp, byte [rdi + 0x38]
mov qword [rsp + 0x28], rcx
nop word [rax + rax]
mov eax, dword [0x141dd07f8]
and eax, dword [0x141dd07fc]
or eax, 0x211ce2aa
and eax, 0xf31fe6ba
cmp eax, 0x222701ff
ja 0x140099a70
cmp bpl, 3
jne 0x140099b18
mov eax, 0x85407cc1
nop dword [rax]

Function at 0x14009bef0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
mov rbp, rsp
mov rdi, rdx
xlatb

Function at 0x14009c6a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xd8
mov rbx, r8
mov r14, rdx
mov rsi, rcx
lea rcx, [rsp + 0x80]
xor r9d, r9d
call fcn.14009cd30
cmp dword [rsp + 0x80], 2
jne 0x14009cb0d
nop word [rax + rax]
Function at 0x14009d8c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rbx, r8
mov r14, rdx
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax]
mov ecx, dword [0x141dd1028]
xor ecx, dword [0x141dd102c]
or ecx, 0x4b2dd748
xor ecx, 0x1c8f8c02
add ecx, 0xa3a17747
cmp ecx, 0xea99d7c3
ja 0x14009d8e0
mov r12, qword [rax]
cmp qword [r12 + 0x10], 0
jne 0x14009db69
mov eax, dword [0x141dd1040]
and eax, dword [0x141dd1044]
imul eax, eax, 0x8f91a700
cmp eax, 0x745d95fe
jae 0x14009d947
mov qword [r12 + 0x10], 0xffffffffffffffff
lea rcx, [r12 + 0x18]
mov rdx, r14
mov r8, rbx
call fcn.140089f70
lea r15, [r12 + 0x18]
nop dword [rax]
mov r13d, dword [0x141dd1048]
and r13d, dword [0x141dd104c]
and r13d, 0x535c8d26
add r13d, 0xff8905ee
imul rax, r13, 0xbb5709
shr rax, 0x20
sub r13d, eax
shr r13d, 1
add r13d, eax
shr r13d, 0x1d
mov qword [r12 + 0x10], 0xffffffffffffffff
mov rcx, r15
mov rdx, r14
mov r8, rbx
call fcn.140089f70
cmp r13d, 0x7de357f4
je 0x14009d950
mov rdi, rax
nop word [rax + rax]
mov eax, dword [0x141dd1050]
imul eax, dword [0x141dd1054]
and eax, 0xa93059c
or eax, 0x61247263
imul rax, rax, 0x5f39bcd3
shr rax, 0x3c
cmp eax, 0xe75c79d4
ja 0x14009d9b0
test rdi, rdi
je 0x14009da80
mov eax, edi
and eax, 3
nop word [rax + rax]
add byte [rax], al
mov eax, dword [0x141dd1030]
or eax, dword [0x141dd1034]
imul rax, rax, 0x26fdfd4d
shr rax, 0x3b
xor eax, 0xcf2dcacf
retf 0xcf2d
mov ecx, 0xe96b447d
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0xe58eca05
ja 0x14009dbbe
ud2
Function at 0x14009e5e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
nop dword [rax]
mov eax, dword [0x141dd12a0]
sub eax, dword [0x141dd12a4]
add eax, 0x126d874a
xor eax, 0x2b01b905
add eax, 0xb8bebe6f
cmp eax, 0xe17f9d0a
ja 0x14009e5f0
cmp qword [rsi + 0x18], 0
je 0x14009e6a0
mov eax, dword [0x141dd12a8]
xor edx, edx
div dword [0x141dd12ac]
or eax, 0xb596520a
imul rcx, rax, 0x35ea41a1
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
imul eax, eax, 0x637b44fe
cmp eax, 0x5b89174b
jbe 0x14009e660
mov rax, qword [0x141ddb260]
nop dword [rax + rax]
mov eax, dword [0x141dd12b0]
sub eax, dword [0x141dd12b4]
imul eax, eax, 0x6e3cc979
add eax, 0xb39ceecb
imul rax, rax, 0x71aa633b
shr rax, 0x3e
mov r8, qword [rsi + 0x20]
mov rcx, qword [0x141ddb260]
cmp eax, 0xe3eaaf47
ja 0x14009e660
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov eax, dword [0x141dd12b8]
imul eax, dword [0x141dd12bc]
imul eax, eax, 0x9ef29e57
or eax, 0x83e02818
cmp eax, 0x84e15d5f
je 0x14009e6a0
cmp rsi, 0xffffffffffffffff
je 0x14009e78f
mov eax, dword [0x141dd12c0]
or eax, dword [0x141dd12c4]
or eax, 0xa974e2a5
cmp eax, 0xa91f4bf0
je 0x14009e70f
mov ecx, dword [0x141dd12c8]
or ecx, dword [0x141dd12cc]
or ecx, 0x90082010
and ecx, 0x988e641b
xor ecx, 0xb6c6ab41
lock dec qword [rsi + 8]
sete al
cmp ecx, 0xba76cf60
jbe 0x14009e716
lock dec qword [rsi + 8]
jmp 0x14009e6e1
xor ecx, ecx
nop dword [rax + rax]
test cl, cl
jne 0x14009e720
test al, al
je 0x14009e78f
mov eax, dword [0x141dd12d0]
xor eax, dword [0x141dd12d4]
add eax, 0x151870fe
or eax, 0xb40226d
cmp eax, 0x2d000ba5
jb 0x14009e77b
mov eax, dword [0x141dd12d8]
xor eax, dword [0x141dd12dc]
add eax, 0x39b4ef4b
imul rdi, rax, 0x5318ac9
shr rdi, 0x38
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp edi, 0x4fca7ae9
jbe 0x14009e78f
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14009e745
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14009f0e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov eax, dword [0x141dd1420]
imul eax, dword [0x141dd1424]
mov rsi, rcx
imul eax, eax, 0xd04dd2d5
add eax, 0xfea783da
cmp eax, 0x38b5336b
jb 0x14009f15d
mov eax, dword [0x141dd1428]
xor edx, edx
div dword [0x141dd142c]
add eax, 0x90023aa8
xor eax, 0xa28a902f
imul rcx, rax, 0x22e2fad3
shr rcx, 0x3c
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov rdi, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r14, rsp
cmp ecx, 0xbc74e54d
jne 0x14009f179
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
jmp 0x14009f112
mov eax, dword [0x141dd1430]
or eax, dword [0x141dd1434]
and eax, 0x2301088
or eax, 0xc1c1ec17
xor eax, 0x9dd420f0
cmp eax, 0x36b98f8f
jae 0x14009f1b0
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
nop dword [rax + rax]
mov ecx, dword [0x141dd1438]
or ecx, dword [0x141dd143c]
add ecx, 0xa3e3b23e
xor ecx, 0x92598080
and ecx, 0x975fdce4
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov rbx, rsp
cmp ecx, 0x4cd3e558
ja 0x14009f1b0
movzx eax, byte [0x141ddb1d8]
test al, al
je 0x14009f5e0
mov eax, dword [0x141ddb27c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x60]
nop
mov ecx, dword [0x141dd1440]
sub ecx, dword [0x141dd1444]
xor ecx, 0xadf5873c
imul ecx, ecx, 0xb23ee524
and ecx, 0xdd00bfe4
cmp ecx, 0x5efe52d9
je 0x14009f210
test rax, rax
je 0x14009f271
cmp eax, 1
je 0x14009f2e0
cmp eax, 2
je 0x14009f5e0
nop dword [rax]
mov eax, dword [0x141dd1448]
xor edx, edx
div dword [0x141dd144c]
or eax, 0xb12d19bf
and eax, 0xb32dbbbf
cmp eax, 0x8c4619ac
je 0x14009f250
jmp 0x14009f299
mov eax, dword [0x141dd1450]
xor eax, dword [0x141dd1454]
or eax, 0xfcff7df7
mov ecx, 0xa4907243
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0xa3a2a1fb
jne 0x14009f29b
jmp 0x14009f2cd
mov r15d, dword [0x141dd1458]
and r15d, dword [0x141dd145c]
xor r15d, 0xd031059b
add r15d, 0x7e61409c
sub rsp, 0x20
call fcn.1400fc300
add rsp, 0x20
and byte [rcx - 0x7f], al
call [0x1b328ae0a]
invalid
sub rsp, 0x20
call fcn.1400fc300
add rsp, 0x20
jmp 0x14009f29b

Function at 0x1400a0a10
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov eax, dword [0x141dd17b0]
imul eax, dword [0x141dd17b4]
add eax, 0x1d30d92
Function at 0x1400b1650
Capabilities:
Encode data using xor
Get file attributes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rdi, r8
mov rbx, rdx
mov eax, dword [0x141dd3290]
and eax, dword [0x141dd3294]
mov rsi, rcx
and eax, 0x35034120
add eax, 0x5428d552
cmp eax, 0x4dbe1eea
jb 0x1400b16bc