joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006d200
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x141dca770]
add eax, dword [0x141dca774]
or eax, 0x2f023144
add eax, 0xc0029a9f
imul rax, rax, 0x12ad3719
shr rax, 0x3c
cmp eax, 0xa5a9dd73
ja fcn.14006d200
vmovdqa ymm0, ymmword [rdx]
vmovdqa ymm1, ymmword [r8]
vpaddd ymm0, ymm1, ymm0
nop word cs:[rax + rax]
mov eax, dword [0x141dca778]
add eax, dword [0x141dca77c]
imul eax, eax, 0xa1858795
xor eax, 0x391069c9
add eax, 0xa7fd2971
cmp eax, 0x3a47d342
jb 0x14006d240
vmovdqa ymmword [rcx], ymm0
vzeroupper
ret

Function at 0x14006dbc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x141dca7d8]
imul eax, dword [0x141dca7dc]
imul eax, eax, 0x491423d5
and eax, 0x47cb359d
imul eax, eax, 0xc6a457d0
cmp eax, 0x36e132e2
jb fcn.14006dbc0
vmovaps xmm0, xmmword [rdx]
mov eax, dword [0x141dca7e0]
or eax, dword [0x141dca7e4]
and eax, 0x2848081
or eax, 0x40784e52
imul eax, eax, 0x20a6db6c
cmp eax, 0xe414c4cf
jbe 0x14006dc10
vmovaps xmmword [rcx], xmm0
mov eax, dword [0x141dca7e8]
xor edx, edx
div dword [0x141dca7ec]
imul eax, eax, 0x926c46d5
or eax, 0x41e0011d
xor eax, 0xc3170716
vmovaps xmmword [rcx], xmm0
cmp eax, 0xe6fe9ddf
ja 0x14006dc10
xor eax, eax
nop dword [rax + rax]
test al, al
jne 0x14006dc40
ret

Function at 0x14006dc50
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x141dca7f0]
or eax, dword [0x141dca7f4]
add eax, 0x2999e7a2
or eax, 0xef85881f
cmp eax, 0xb5f8088a
jb fcn.14006dc50
mov eax, dword [0x141dca7f8]
or eax, dword [0x141dca7fc]
add eax, 0xcc220f50
or eax, 0x9624621b
imul r8, rax, 0x2fc706bf
shr r8, 0x20
sub eax, r8d
shr eax, 1
add eax, r8d
shr eax, 0x1f
vbroadcastss ymm0, dword [rdx]
cmp eax, 0x51fb42c5
jbe 0x14006dca9
vmovaps ymmword [rcx], ymm0
mov eax, 0xb19fda3f
nop
mov edx, dword [0x141dca800]
xor edx, dword [0x141dca804]
add edx, 0x735f758a
or edx, 0xedf57121
imul rdx, rax
shr rdx, 0x3b
vmovaps ymmword [rcx], ymm0
cmp edx, 0xb3db9809
ja 0x14006dcb0
nop dword [rax]
mov eax, dword [0x141dca808]
sub eax, dword [0x141dca80c]
or eax, 0xd08c53ef
imul eax, eax, 0xf921c06a
cmp eax, 0x55da6ef0
je 0x14006dce0
vzeroupper
ret

Function at 0x14006dd40
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
vpermpd ymm0, ymmword [rdx], 0x42
test al, al
je 0x14006dd50
vmovaps ymmword [rcx], ymm0
mov eax, 0x965b5fb1
nop word cs:[rax + rax]
mov edx, dword [0x141dca810]
or edx, dword [0x141dca814]
imul rdx, rdx, 0x23dcaf3d
shr rdx, 0x3d
add edx, 0xec021c53
imul rdx, rax
shr rdx, 0x3c
vmovaps ymmword [rcx], ymm0
cmp edx, 0x1a5b69d2
ja 0x14006dd60
mov eax, 0xb0d4caa7
nop word cs:[rax + rax]
mov ecx, dword [0x141dca818]
xor ecx, dword [0x141dca81c]
xor ecx, 0xeedad112
imul ecx, ecx, 0x4b6243eb
imul rcx, rax
shr rcx, 0x3c
cmp ecx, 0x819cd89
ja 0x14006dda0
vzeroupper
ret
Function at 0x14006ddd0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x14006dde0
vmovaps ymm0, ymmword [rdx]
vblendps ymm0, ymm0, ymmword [r8], 3
mov eax, dword [0x141dca820]
xor eax, dword [0x141dca824]
add eax, 0xddece694
xor eax, 0x3104b920
or eax, 0x445b46de
cmp eax, 0x2e6742a
jae 0x14006de14
vmovaps ymmword [rcx], ymm0
mov eax, 0xa56de257
nop dword [rax]
mov edx, dword [0x141dca828]
xor edx, dword [0x141dca82c]
add edx, 0xacc56952
imul rdx, rax
shr rdx, 0x3f
or edx, 0x737c23e8
vmovaps ymmword [rcx], ymm0
cmp edx, 0xfe0f3df2
je 0x14006de20
vzeroupper
ret

Function at 0x14006de50
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xb851f417
nop word cs:[rax + rax]
mov r8d, dword [0x141dca830]
xor r8d, dword [0x141dca834]
add r8d, 0x2ad431f8
imul r8, rax
shr r8, 0x3f
cmp r8d, 0xd733aa83
ja 0x14006de60
vpermpd ymm0, ymmword [rdx], 0x29
mov eax, dword [0x141dca838]
add eax, dword [0x141dca83c]
mov edx, 0x9f4b9023
imul rdx, rax
shr rdx, 0x36
imul eax, edx, 0x1a1de499
imul rax, rax, 0x57c4d2af
shr rax, 0x3d
cmp eax, 0xb3261c26
ja 0x14006dedf
mov eax, dword [0x141dca840]
and eax, dword [0x141dca844]
imul eax, eax, 0xd0983682
add eax, 0x33bd2aec
vmovaps ymmword [rcx], ymm0
cmp eax, 0xf4c2cfe8
jbe 0x14006def0
vmovaps ymmword [rcx], ymm0
jmp 0x14006debd
mov eax, dword [0x141dca848]
xor eax, dword [0x141dca84c]
shr eax, 4
imul rax, rax, 0x1156aad3
shr rax, 0x36
or eax, 0x9b7afd1c
add eax, 0x26a02bdf
cmp eax, 0x322a5e9
jb 0x14006def0
vzeroupper
ret

Function at 0x14006df80
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x141dca860]
sub eax, dword [0x141dca864]
or eax, 0xd9f7d67e
add eax, 0xf08347a9
cmp eax, 0xd094cd6d
jb fcn.14006df80
mov eax, dword [0x141dca868]
sub eax, dword [0x141dca86c]
or eax, 0x34a0554
imul eax, eax, 0xf04f1133
mov r8d, 0xa05e7525
imul r8, rax
shr r8, 0x20
sub eax, r8d
shr eax, 1
add eax, r8d
shr eax, 0x1a
vpermpd ymm0, ymmword [rdx], 1
cmp eax, 0x569570d1
ja 0x14006dffc
mov eax, dword [0x141dca870]
or eax, dword [0x141dca874]
or eax, 0x8704c76b
imul eax, eax, 0x7acb7ac2
vmovaps ymmword [rcx], ymm0
cmp eax, 0x5ace12c9
jne 0x14006e010
vmovaps ymmword [rcx], ymm0
jmp 0x14006dfda
mov eax, dword [0x141dca878]
add eax, dword [0x141dca87c]
xor eax, 0x6d20
or eax, 0x75cd10d0
imul eax, eax, 0xf9500cc8
cmp eax, 0x887fc644
ja 0x14006e010
vzeroupper
ret

Function at 0x14006e4f0
Capabilities:
Encode data using xor

Disassembly:
vmovaps ymm0, ymmword [rdx]
mov eax, dword [0x141dca8b0]
xor eax, dword [0x141dca8b4]
imul eax, eax, 0xdf7b3823
add eax, 0xaf537ba1
or eax, 0x31169865
vandps ymm0, ymm0, ymmword [r8]
cmp eax, 0x3b27b2e8
jb 0x14006e534
mov eax, dword [0x141dca8b8]
imul eax, dword [0x141dca8bc]
vmovaps ymmword [rcx], ymm0
cmp eax, 0x641fb480
jne 0x14006e540
vmovaps ymmword [rcx], ymm0
jmp 0x14006e51c
mov eax, dword [0x141dca8c0]
imul eax, dword [0x141dca8c4]
xor eax, 0x210c8cc5
add eax, 0x21145e6c
imul rcx, rax, 0x1c7a36f5
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
cmp eax, 0xf8e438a9
ja 0x14006e540
vzeroupper
ret
Function at 0x14006f730
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rax
mov rbp, rsp
and rsp, 0xffffffffffffffe0
mov rbx, rsp
mov r8, rdx
mov eax, dword [0x141dca9b0]
xor edx, edx
div dword [0x141dca9b4]
imul eax, eax, 0x35d66411
add eax, 0x8dd95fdf
or eax, 0xf9f5c173
cmp eax, 0xc0b66b8
jb 0x14006f7a5
mov eax, dword [0x141dca9b8]
sub eax, dword [0x141dca9bc]
mov edx, 0xc423461b
imul rdx, rax
shr rdx, 0x3c
imul r9d, edx, 0x8499ac3c
mov eax, 0x60
call fcn.1400ef330
sub rsp, rax
mov rdx, rsp
and rdx, 0xffffffffffffffe0
mov rsp, rdx
cmp r9d, 0xe1571bff
jne 0x14006f7be
mov eax, 0x60
call fcn.1400ef330
sub rsp, rax
mov rax, rsp
and rax, 0xffffffffffffffe0
mov rsp, rax
jmp 0x14006f765
mov eax, 0xa2d8e44f
nop word cs:[rax + rax]
mov r9d, dword [0x141dca9c0]
imul r9d, dword [0x141dca9c4]
add r9d, 0xf4447c35
xor r9d, 0x48bd56e3
imul r9, rax
shr r9, 0x3f
cmp r9d, 0x415a2e1b
ja 0x14006f7d0
mov rax, qword [rcx + 0x220]
cmp rax, 3
ja 0x14006f840
shl rax, 4
mov r9d, dword [0x141dca9c8]
imul r9d, dword [0x141dca9cc]
add rax, rcx
add rax, 0x1e0
or r9d, 0x2046080
and r9d, 0x5a77629c
cmp r9d, 0xa064ca61
jne 0x14006f866
jmp 0x14006f89b
mov eax, dword [0x141dca9d8]
or eax, dword [0x141dca9dc]
and eax, 0x52c2a24e
add eax, 0x3fb5bb9
cmp eax, 0xe15091cc
jbe 0x14006f9a4
jmp 0x14006f9c4
mov r9d, dword [0x141dca9d0]
xor r9d, dword [0x141dca9d4]
and r9d, 0x29903896
add r9d, 0xa7a83c1
or r9d, 0x48a82e99
vmovdqu xmm0, xmmword [r8]
vmovdqu xmmword [rax], xmm0
cmp r9d, 0x1d924b88
jae 0x14006f8a6
vmovups xmm0, xmmword [r8]
vmovups xmmword [rax], xmm0
jmp 0x14006f866
mov rax, qword [rcx + 0x220]
cmp rax, 3
jae 0x14006f8c2
inc rax
mov qword [rcx + 0x220], rax
jmp 0x14006f99d
mov eax, dword [0x141dca9e8]
xor eax, dword [0x141dca9ec]
add eax, 0x69451f54
cmp eax, 0xe4df3d01
ja 0x14006f907
mov eax, dword [0x141dca9f0]
and eax, dword [0x141dca9f4]
add eax, 0x550a8301
xor eax, 0x68f34628
add eax, 0xadb948e8
mov qword [rcx + 0x220], 0
cmp eax, 0x2ee0eddc
jae 0x14006f914
mov qword [rcx + 0x220], 0
jmp 0x14006f8da
vmovdqa ymm0, ymmword [rcx + 0x1e0]
vmovdqa ymm1, ymmword [rcx + 0x200]
vpunpckhqdq ymm2, ymm0, ymm1
vpermq ymm2, ymm2, 0xd8
vpunpcklqdq ymm0, ymm0, ymm1
vpermq ymm0, ymm0, 0xd8
vpbroadcastd ymm1, dword [0x140102c80]
vpsrlq ymm3, ymm2, 0x28
vpor ymm1, ymm3, ymm1
vpsrlq ymm3, ymm0, 0x2e
vpsllq ymm2, ymm2, 0x12
vpor ymm3, ymm2, ymm3
vpsrlq ymm4, ymm0, 0x1a
vpbroadcastq ymm5, qword [0x140102c88]
vpblendd ymm2, ymm4, ymm2, 0xaa
vpand ymm2, ymm2, ymm5
vpsllq ymm3, ymm3, 0x1a
vpblendd ymm0, ymm0, ymm3, 0xaa
vpand ymm0, ymm0, ymm5
vmovdqa ymmword [rdx], ymm0
vmovdqa ymmword [rdx + 0x20], ymm2
vmovdqa ymmword [rdx + 0x40], ymm1
sub rsp, 0x20
vzeroupper
call fcn.14006f9d0
add rsp, 0x20
lea rsp, [rbp + 8]
pop rbx
pop rbp
ret
mov eax, dword [0x141dca9e0]
and eax, dword [0x141dca9e4]
imul eax, eax, 0xa6c45c68
add eax, 0xa72d91bf
ud2
ud2
Function at 0x140070620
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
nop word cs:[rax + rax]
mov eax, dword [0x141dcaa70]
xor edx, edx
div dword [0x141dcaa74]
xor eax, 0x79079e52
add eax, 0x33efaba0
xor eax, 0xc8d2943e
cmp eax, 0x7d3caa78
ja 0x140070630
vmovdqu ymm1, ymmword [r8]
vpmovzxdq ymm0, xmmword [r8 + 0x10]
vpand ymm1, ymm1, ymmword [0x140102d00]
vpsllvd ymm2, ymm1, ymmword [0x140102a60]
vpsrlvd ymm1, ymm1, ymmword [0x140102a80]
vmovdqa ymm3, ymmword [0x140102aa0]
vpermd ymm1, ymm3, ymm1
mov eax, dword [0x141dcaa78]
xor edx, edx
div dword [0x141dcaa7c]
imul eax, eax, 0x9469152
add eax, 0x69d01e46
or eax, 0xb9c2d52b
vpor ymm1, ymm1, ymm2
cmp eax, 0x200adf3
je 0x1400706fe
mov eax, dword [0x141dcaa80]
and eax, dword [0x141dcaa84]
add eax, 0x5b52c50
vpand ymm2, ymm1, ymmword [0x140102ac0]
vpslld ymm3, ymm2, 2
vpaddd ymm3, ymm2, ymm3
vmovdqa ymm4, ymmword [0x140102ce0]
vpermd ymm3, ymm4, ymm3
vpblendd ymm2, ymm2, ymm3, 0xe0
vpbroadcastq ymm3, xmm3
vmovdqa ymmword [rcx], ymm0
vmovdqa ymmword [rcx + 0x20], ymm2
vmovdqa ymmword [rcx + 0x40], ymm3
cmp eax, 0x66d72c06
jbe 0x14007073f
vpand ymm2, ymm1, ymmword [0x140102ac0]
vpbroadcastd ymm3, dword [0x140102d20]
vpmulld ymm3, ymm2, ymm3
vmovdqa ymm4, ymmword [0x140102ce0]
vpermd ymm3, ymm4, ymm3
vpblendd ymm2, ymm2, ymm3, 0xe0
vpbroadcastq ymm3, xmm3
vmovdqa ymmword [rcx], ymm0
vmovdqa ymmword [rcx + 0x20], ymm2
vmovdqa ymmword [rcx + 0x40], ymm3
jmp 0x1400706af
vzeroupper
ret

Function at 0x140070a70
Capabilities:
Encode data using xor

Disassembly:
mov r9, rdx
mov eax, dword [0x141dcacb8]
xor edx, edx
div dword [0x141dcacbc]
and eax, 0x10b84ea9
cmp eax, 0xa3e6e397
jne 0x140070aa0
vmovups xmm0, xmmword [r9]
vmovaps xmmword [rcx], xmm0
nop word cs:[rax + rax]
mov eax, dword [0x141dcacc0]
and eax, dword [0x141dcacc4]
add eax, 0x461608bd
and eax, 0x4000806e
vmovups xmm1, xmmword [r9]
vmovups xmm0, xmmword [r9 + 0x10]
vmovaps xmmword [rcx], xmm1
cmp eax, 0x3cd8396f
je 0x140070aa0
mov eax, dword [0x141dcacc8]
and eax, dword [0x141dcaccc]
or eax, 0x5200000
and eax, 0x57242102
add eax, 0xb06aa39c
cmp eax, 0xba57d14b
jbe 0x140070b00
vmovaps xmmword [rcx + 0x10], xmm0
mov dword [rcx + 0x20], 0
nop word [rax + rax]
mov eax, dword [0x141dcacd0]
xor eax, dword [0x141dcacd4]
xor eax, 0x7d2bd969
add eax, 0x1bf61ec3
and eax, 0x9fffd195
vmovaps xmmword [rcx + 0x10], xmm0
mov dword [rcx + 0x20], 0
cmp eax, 0xb3659de
jb 0x140070b00
mov eax, dword [0x141dcacd8]
imul eax, dword [0x141dcacdc]
add eax, 0x61aff763
imul rax, rax, 0x260c6013
shr rax, 0x3d
cmp eax, 0x3d28d9e7
ja 0x140070b7d
mov eax, dword [0x141dcace0]
sub eax, dword [0x141dcace4]
mov dword [rcx + 0x24], 0
mov rdx, qword [r8]
mov qword [rcx + 0x28], rdx
or eax, 0xbfbc908d
add eax, 0x85a0f416
cmp eax, 0x4f12e707
jae 0x140070b8d
mov dword [rcx + 0x24], 0
mov rax, qword [r8]
mov qword [rcx + 0x28], rax
jmp 0x140070b52
ret
Function at 0x140075c10
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r14, qword [rcx]
nop dword [rax]
mov eax, dword [0x141dcbb98]
mov ecx, dword [0x141dcbb9c]
add eax, ecx
add eax, 0xc14fdd5b
and eax, 0x5a51aad
cmp eax, 0xbe8da5ec
je 0x140075c20
mov rsi, qword [r14 + 0x80]
and rsi, 0xfffffffffffffff8
cmp qword [rsi + 8], 0
je 0x140075d1f
xor eax, eax
test al, al
jne 0x140075c82
mov eax, dword [0x141dcbba0]
xor eax, dword [0x141dcbba4]
add eax, 0x8f558fda
or eax, 0xf1bd831b
mov rdi, qword [rsi]
mov rbx, qword [0x141ddb260]
cmp eax, 0x96841281
jae 0x140075c8b
mov rax, qword [0x141ddb260]
jmp 0x140075c5b
mov eax, dword [0x141dcbba8]
xor edx, edx
div dword [0x141dcbbac]
or eax, 0x8b7257ae
xor eax, 0x131a109
mov ecx, 0xacd16a33
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x43446595
ja 0x140075cec
mov eax, dword [0x141dcbbb0]
sub eax, dword [0x141dcbbb4]
imul ebp, eax, 0x69ba9d3c
or ebp, 0x2d04c22d
and ebp, 0xad94f6fd
mov rcx, rbx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebp, 0x56b690f6
jae 0x140075d00
mov rcx, rbx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140075cb8
mov eax, dword [0x141dcbbb8]
xor edx, edx
div dword [0x141dcbbbc]
xor eax, 0x2206000
or eax, 0xe4d79f7b
cmp eax, 0x21855b00
je 0x140075d00
mov rdi, qword [0x141ddb260]
mov eax, dword [0x141dcbbc0]
xor edx, edx
div dword [0x141dcbbc4]
imul eax, eax, 0x41d08ae4
xor eax, 0xa6745abe
cmp eax, 0x52abffba
jb 0x140075d7a
mov ebx, dword [0x141dcbbc8]
and ebx, dword [0x141dcbbcc]
or ebx, 0x68084016
and ebx, 0x6c8deebe
add ebx, 0x16890d34
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0xa8f3d462
jbe 0x140075d8a
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140075d46
cmp r14, 0xffffffffffffffff
je 0x140075e34
mov rax, 0xffffffffffffffff
lock xadd qword [r14 + 8], rax
mov ecx, 0xc0b5365d
nop word cs:[rax + rax]
mov edx, dword [0x141dcbbd0]
or edx, dword [0x141dcbbd4]
xor edx, 0x72075768
imul rdx, rcx
shr rdx, 0x3f
cmp edx, 0x660179c6
je 0x140075db0
cmp rax, 1
jne 0x140075e34
mov eax, dword [0x141dcbbd8]
xor eax, dword [0x141dcbbdc]
and eax, 0x6e772f32
mov ecx, 0x8e2c5833
imul rcx, rax
shr rcx, 0x3c
add ecx, 0x7cea7817
cmp ecx, 0x63ded267
jae 0x140075e17
mov r8, qword [r14 - 8]
mov rcx, qword [0x141ddb260]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
mov rdi, qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [r14 - 8]
mov rcx, qword [0x141ddb260]
xor edx, edx
call rdi
test sil, sil
jne 0x140075e20
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140076430
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
nop word [rax + rax]
mov eax, dword [0x141dcbca8]
xor eax, dword [0x141dcbcac]
or eax, 0x37ebda30
add eax, 0x295bd918
and eax, 0x29064780
cmp eax, 0x5ae6bd7c
ja 0x140076440
mov rax, qword [rsi + 0x10]
mov ecx, 0x84b21ebd
nop dword [rax + rax]
mov edx, dword [0x141dcbcb0]
or edx, dword [0x141dcbcb4]
imul edx, edx, 0xee290ecf
imul rdx, rcx
shr rdx, 0x3d
imul edx, edx, 0xa5294639
cmp edx, 0x4ee4bf69
ja 0x140076470
cmp eax, 1
jne 0x14007650f
mov r8, qword [rsi + 0x18]
mov eax, dword [0x141dcbcb8]
xor edx, edx
div dword [0x141dcbcbc]
shr eax, 2
imul rax, rax, 0x482026cd
shr rax, 0x3c
or eax, 0x9aba7db4
cmp eax, 0xe9f73321
ja 0x1400764f5
mov eax, dword [0x141dcbcc0]
or eax, dword [0x141dcbcc4]
add eax, 0x8ef26b63
imul rcx, rax, 0x65c7193d
shr rcx, 0x3d
mov rax, qword [rsi + 0x20]
mov byte [r8], 0
cmp ecx, 0x90370bbc
jbe 0x1400764fb
mov byte [r8], 0
jmp 0x1400764c9
test rax, rax
je 0x14007650f
mov rcx, qword [0x141ddb260]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xfa1c29bb
nop word cs:[rax + rax]
mov ecx, dword [0x141dcbcc8]
xor ecx, dword [0x141dcbccc]
imul ecx, ecx, 0x82f1f3e7
add ecx, 0xcc7df196
imul rcx, rax
shr rcx, 0x3c
cmp ecx, 0x4a4a1c4c
ja 0x140076520
cmp rsi, 0xffffffffffffffff
je 0x1400766d0
mov eax, 0xbc2162c7
nop word [rax + rax]
mov ecx, dword [0x141dcbcd0]
add ecx, dword [0x141dcbcd4]
or ecx, 0x3c79971c
add ecx, 0xd2522214
imul rcx, rax
shr rcx, 0x39
cmp ecx, 0x8b39c380
je 0x140076560
mov eax, dword [0x141dcbcd8]
or eax, dword [0x141dcbcdc]
or eax, 0x24c4c9b4
imul eax, eax, 0x4381a43a
cmp eax, 0x4351ab88
jb 0x1400765de
mov eax, dword [0x141dcbce0]
add eax, dword [0x141dcbce4]
imul eax, eax, 0xdc2d38c6
imul rcx, rax, 0x3966dfd5
shr rcx, 0x3d
add ecx, 0x89b35edf
mov rax, 0xffffffffffffffff
lock xadd qword [rsi + 8], rax
cmp ecx, 0xdb5a750c
jbe 0x1400765e5
lock dec qword [rsi + 8]
jmp 0x1400765a6
xor ecx, ecx
nop word [rax + rax]
test cl, cl
jne 0x1400765f0
cmp rax, 1
jne 0x1400766d0
mov eax, dword [0x141dcbce8]
or eax, dword [0x141dcbcec]
mov ecx, 0xd1c7a64f
imul rcx, rax
shr rcx, 0x3d
add ecx, 0x9153fa09
cmp ecx, 0x9b9f9eed
jbe 0x140076630
nop word cs:[rax + rax]
mov eax, dword [0x141dcbcf0]
or eax, dword [0x141dcbcf4]
xor eax, 0xa704921a
add eax, 0xe91118f2
or eax, 0x7cb98a49
cmp eax, 0x94f24520
je 0x140076630
mov eax, dword [0x141dcbcf8]
xor eax, dword [0x141dcbcfc]
add eax, 0x7f17591e
xor eax, 0x621e82a7
mov ecx, 0xa1feddbf
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0xc2038fb2
jne 0x14007668f
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov ebx, dword [0x141dcbd00]
imul ebx, dword [0x141dcbd04]
add ebx, 0xaa2ee9ae
and ebx, 0xc6d5cb04
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rsi
call rdi
cmp ebx, 0x6705c214
je 0x1400766a0
nop
mov eax, dword [0x141dcbd08]
xor eax, dword [0x141dcbd0c]
and eax, 0x2bf81afd
imul eax, eax, 0x8d4d703e
cmp eax, 0x32d6315f
je 0x1400766d0
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140081fb0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
nop dword [rax]
mov eax, dword [0x141dcd5f8]
add eax, dword [0x141dcd5fc]
or eax, 0x3b4856fc
add eax, 0x2a85a023
or eax, 0x82fcf8a0
cmp eax, 0x14ad06bf
je 0x140081fc0
cmp qword [r8 + 8], 0
je 0x1400820a0
nop dword [rax]
mov eax, dword [0x141dcd600]
imul eax, dword [0x141dcd604]
or eax, 0x2ce2e9ae
imul eax, eax, 0x8c6888e6
cmp eax, 0xef98dc74
je 0x140081ff0
mov r9, qword [r8]
mov rcx, qword [r8 + 0x10]
nop word cs:[rax + rax]
mov eax, dword [0x141dcd608]
xor edx, edx
div dword [0x141dcd60c]
add eax, 0x6b0db76c
and eax, 0x2d252101
cmp eax, 0xefe11252
ja 0x140082020
test rcx, rcx
je 0x140082180
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x140082050
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, r9
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
nop dword [rax]
mov ecx, dword [0x141dcd628]
xor ecx, dword [0x141dcd62c]
imul ecx, ecx, 0xe3f23540
add ecx, 0x47cedcae
cmp ecx, 0xa80de8d1
jbe 0x140082070
jmp 0x14008225d
mov eax, dword [0x141dcd630]
or eax, dword [0x141dcd634]
imul eax, eax, 0x9b953ac2
add eax, 0x63930f04
cmp eax, 0x33ea7b55
ja 0x1400820a0
nop
mov eax, dword [0x141dcd638]
or eax, dword [0x141dcd63c]
and eax, 0x4fcb80f7
imul eax, eax, 0x3a8ee617
add eax, 0x2985d7c3
cmp eax, 0xcb9ca6ec
jb 0x1400820c0
test rdi, rdi
je 0x140082220
mov eax, dword [0x141dcd640]
imul eax, dword [0x141dcd644]
imul eax, eax, 0xf6955514
xor eax, 0x740a6117
and eax, 0x763f631f
cmp eax, 0x44f540a7
jbe 0x140082117
movzx eax, byte [0x141ddb278]
mov eax, 0x9ec42097
nop dword [rax]
mov ecx, dword [0x141dcd648]
mov edx, dword [0x141dcd64c]
add ecx, edx
add ecx, 0xface032d
and ecx, 0xdd2dfadd
imul rcx, rax
shr rcx, 0x3a
movzx edx, byte [0x141ddb278]
cmp ecx, 0x172fa49e
ja 0x140082120
mov eax, dword [0x141dcd650]
or eax, dword [0x141dcd654]
or eax, 0x3fe3cebd
cmp eax, 0x681f032c
je 0x140082251
jmp 0x140082227
mov eax, dword [0x141dcd610]
mov ecx, dword [0x141dcd614]
add eax, ecx
add eax, 0x3aabe132
or eax, 0xb878c78b
imul eax, eax, 0xef66ab9a
cmp eax, 0xb2344101
je 0x140082180
nop word cs:[rax + rax]
mov eax, dword [0x141dcd618]
imul eax, dword [0x141dcd61c]
and eax, 0x49d4591c
imul eax, eax, 0x9df2bb46
or eax, 0xa9d3d70f
cmp eax, 0xe2b79c33
je 0x1400821b0
test rdi, rdi
je 0x140082220
movzx eax, byte [0x141ddb278]
mov eax, dword [0x141dcd620]
xor edx, edx
div dword [0x141dcd624]
add eax, 0x6e4c187
and eax, 0x1f9087
cmp eax, 0x8092b91a
jbe 0x140082209
xor ecx, ecx
mov rdx, rdi
call fcn.1400c0180
mov bl, 1
nop dword [rax + rax]
xor ecx, ecx
mov rdx, rdi
call fcn.1400c0180
test bl, bl
je 0x140082210
jmp 0x14008225d
mov eax, 8
jmp 0x14008225d
mov ebx, dword [0x141dcd658]
xor ebx, dword [0x141dcd65c]
xor ebx, 0xe28d640
or ebx, 0x608629be
xor ecx, ecx
mov rdx, rdi
call fcn.1400c0180
cmp ebx, 0xbea8160c
jbe 0x14008225d
xor ecx, ecx
mov rdx, rdi
call fcn.1400c0180
jmp 0x140082227
xor ecx, ecx
test rax, rax
mov edx, 8
cmovne rdx, rax
sete cl
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rdi
mov qword [rsi], rcx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400885c0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov r8, rdx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0
lea rdx, [0x141db90d8]
lea rcx, [rsp + 0x20]
call fcn.140052610
mov ecx, eax
mov rax, qword [rsp + 0x28]
test cl, cl
je 0x14008862f
xor ecx, ecx
nop dword [rax]
test cl, cl
jne 0x140088600
test rax, rax
jne fcn.1400889a0
mov eax, dword [0x141dce4e0]
add eax, dword [0x141dce4e4]
imul eax, eax, 0x484caa22
cmp eax, 0x2827d3de
jne 0x1400889d1
jmp 0x1400889f5
test rax, rax
je 0x140088650
mov ecx, eax
and ecx, 3
lea rdx, [0x141dba3d4]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
xor eax, eax
jmp fcn.1400889a0
xor eax, eax
jmp fcn.1400889a0
lea rsi, [rax - 1]
nop dword [rax + rax]
mov ecx, dword [0x141dce460]
sub ecx, dword [0x141dce464]
and ecx, 0xf036ba2f
imul ecx, ecx, 0x5e4b092c
cmp ecx, 0x94d6bb34
je 0x140088660
xor ecx, ecx
nop word cs:[rax + rax]
test cl, cl
jne 0x140088690
mov rdi, qword [rax - 1]
mov ecx, 0xa1464a7f
nop dword [rax]
mov edx, dword [0x141dce468]
xor edx, dword [0x141dce46c]
add edx, 0x19df6bed
xor edx, 0x75473327
imul rdx, rcx
shr rdx, 0x3f
cmp edx, 0x2aac4fa3
ja 0x1400886a0
mov rbx, qword [rax + 7]
mov r14, qword [rbx]
test r14, r14
je 0x140088770
mov eax, dword [0x141dce470]
mov ecx, dword [0x141dce474]
add eax, ecx
add eax, 0x1a2a2782
mov ecx, 0xb91f166f
imul rcx, rax
shr rcx, 0x3e
imul eax, ecx, 0xdcabd745
cmp eax, 0xe63dcf1d
xor eax, eax
nop dword [rax]
mov ecx, dword [0x141dce458]
sub ecx, dword [0x141dce45c]
xor ecx, 0x87326cfa
imul ecx, ecx, 0x7c89aefb
cmp ecx, 0x5b8cd65f
je 0x140088830
jmp fcn.1400889a0
mov eax, dword [0x141dce4e8]
and eax, dword [0x141dce4ec]
or eax, 0x7695c751
add eax, 0xce68300e
and eax, 0x4f5c73e3
ud2
ud2
mov eax, dword [0x141dce5b8]
sub eax, dword [0x141dce5bc]
xor eax, 0x806a8c1
imul eax, eax, 0xf6baa62f
or eax, 0xd5460dfe
cmp eax, 0x7875da36
jb 0x140088fc0
test rbx, rbx
je 0x140089254
mov eax, ebx
and eax, 3
lea rcx, [0x141dba3f4]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
test byte [rsi + 0x48], al
imul ecx, eax
invalid
call 0x128b5d56f
mov esp, 0x4dd77768
mov esi, dword [rsi - 8]
mov eax, dword [0x141dce6f0]
mov ecx, dword [0x141dce6f4]
add eax, ecx
add eax, 0x9f340f3a
cmp cl, byte [rdi]
xor al, 0x9f
or al, 0xd1
invalid
invalid
loopne 0x14008a403
mov ecx, 0xd3764e45
add dword [rax], eax
nop word cs:[rax + rax]
nop word cs:[rax + rax]