joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140028274
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x30
mov edi, dword [0x14002ecfc]
xor ebx, ebx
test edi, edi
jne 0x14002834a
lea rax, [rbp + 0x30]
lea rdx, [0x1400091b8]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
lea edi, [rbx + 2]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140028344
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x28]
lea rdx, [0x140002820]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x20], ebx
mov dword [rbp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002833a
cmp dword [rbp + 0x20], ebx
je 0x14002833a
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x28]
lea rdx, [0x1400091d8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140028335
cmp dword [rbp + 0x20], ebx
jne 0x14002833a
mov edi, 1
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x14002ecfc], edi
cmp edi, 1
sete bl
mov eax, ebx
add rsp, 0x30
pop rdi
pop rbx
pop rbp
ret

Function at 0x140028360
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
and qword [r8], 0
mov rax, qword gs:[0x60]
mov rdi, r8
cmp dword [rax + 0x2c0], 0
je 0x1400283ec
lea r8, [rsp + 0x38]
lea rdx, [0x140009208]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x1400283d2
cmp dword [rsp + 0x38], 0
jne 0x1400283d2
lea rcx, [rsp + 0x40]
call fcn.140028654
mov ebx, eax
test eax, eax
js 0x1400283d7
mov rcx, qword [rsp + 0x40]
mov r8, rdi
call fcn.1400281c4
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400283fa
mov ebx, 0x80004005
call fcn.140028274
test eax, eax
je 0x1400283fa
mov r8, rdi
lea rcx, [0x140009200]
jmp 0x1400283f3
lea rcx, [0x1400091f8]
call fcn.1400281c4
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140028c48
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor r8d, r8d
xor r11d, r11d
mov rdi, r9
cmp qword [0x1400083d8], r8
je 0x140028d60
lea r9, [0x1400083d0]
xor r10d, r10d
mov rax, r9
cmp ecx, dword [rax]
je 0x140028cac
inc r10
inc r11d
lea rax, [r10 + r10*2]
lea rax, [r9 + rax*8]
cmp qword [rax + 8], r8
jne 0x140028c8f
jmp 0x140028d60
movsxd rbx, r11d
mov r8d, dword [rdi + rbx*4]
cmp r8d, 0xffffffff
jne 0x140028d60
and dword [rsp + 0x30], 0
lea rax, [rbx + rbx*2]
test rdx, rdx
mov rsi, qword [r9 + rax*8 + 0x10]
mov r9, qword [r9 + rax*8 + 8]
lea r8, [0x140009250]
cmovne r8, rdx
lea rcx, [rsp + 0x40]
mov edx, 0x104
call fcn.140011294
lea rax, [rsp + 0x34]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov r8, rsi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x20], rax
call sub.SHLWAPI.dll_SHGetValueW
test eax, eax
je 0x140028d57
lea rax, [rsp + 0x34]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov r8, rsi
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x20], rax
call sub.SHLWAPI.dll_SHGetValueW
mov r8d, dword [rsp + 0x30]
mov dword [rdi + rbx*4], r8d
mov eax, r8d
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14002ad70
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140029310
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1050
call fcn.14002b5e0
sub rsp, rax
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea rax, [rsp + 0x34]
mov rbx, rcx
xor edi, edi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov word [rcx], di
lea r9, [rsp + 0x30]
lea r8, [0x1400092d0]
lea rdx, [0x1400092f0]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 0x1000
call sub.SHLWAPI.dll_SHGetValueW
test eax, eax
jne 0x1400293d2
cmp dword [rsp + 0x30], 1
jne 0x1400293d2
lea rax, [rsp + 0x40]
cmp word [rsp + 0x40], di
je 0x1400293a9
cmp word [rax], 0x2c
je 0x1400293a9
cmp word [rax], 0x3b
je 0x1400293a9
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
cmp word [rax], di
jne 0x14002938f
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
mov word [rax], di
call qword [sym.imp.MLANG.dll_Ordinal_123]
test eax, eax
js 0x1400293d2
lea r8, [rsp + 0x40]
mov edx, 0x104
mov rcx, rbx
call fcn.140009608
cmp di, word [rbx]
jne 0x1400293e5
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14002ad70
mov rbx, qword [rsp + 0x1068]
add rsp, 0x1050
pop rdi
ret
Function at 0x140029f50
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x10
mov r14, r9
xor r10d, r10d
mov ebp, edx
mov r15d, 0xaaaaaaab
mov rdi, rcx
mov r11d, r10d
mov eax, r15d
lea ebx, [r10 + 0x13]
mul edx
mov esi, edx
mov eax, 0xaf286bcb
shr esi, 1
mov r13d, esi
shl r13d, 2
mov r9d, r13d
mul r13d
sub r9d, edx
shr r9d, 1
add r9d, edx
shr r9d, 6
test r8, r8
je 0x14002a136
test r14, r14
je 0x14002a136
mov r14d, dword [r14]
lea rax, [rcx + rbp]
mov ecx, ebp
mov qword [rsp], rax
shl ecx, 2
mov eax, r15d
lea r12, [r8 + r14]
mul ecx
mov ecx, edx
lea edx, [rsi + rsi*2]
mov eax, ebp
sub eax, edx
mov dword [rsp + 0x60], edx
shr ecx, 1
add ecx, eax
mov eax, 0xaf286bcb
lea esi, [rbx - 0xf]
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
mov edx, ecx
shr eax, 6
imul eax, eax, 0x4c
sub edx, eax
je 0x14002a012
and edx, 3
je 0x14002a012
mov eax, esi
sub eax, edx
add ecx, eax
cmp r14d, ecx
jb 0x14002a12e
mov edx, r10d
cmp edx, r9d
jne 0x14002a02f
imul eax, r9d, 0x4c
mov ebx, r13d
sub ebx, eax
shr ebx, 2
mov r15d, r10d
test ebx, ebx
je 0x14002a095
mov ecx, r10d
mov r14d, r10d
cmp rdi, qword [rsp]
jae 0x14002a136
movzx eax, byte [rdi]
inc r14d
inc rdi
or ecx, eax
shl ecx, 8
cmp r14d, 3
jl 0x14002a03c
mov r14d, r10d
cmp r8, r12
jae 0x14002a12e
mov eax, ecx
lea rbp, [0x140009370]
inc r14d
shr eax, 0x1a
shl ecx, 6
and eax, 0x3f
mov al, byte [rax + rbp]
mov ebp, dword [rsp + 0x58]
mov byte [r8], al
inc r8
cmp r14d, esi
jb 0x14002a05d
inc r15d
cmp r15d, ebx
jb 0x14002a036
inc edx
lea r11d, [r11 + rbx*4]
cmp edx, r9d
jbe 0x14002a021
sub ebp, dword [rsp + 0x60]
lea edx, [rbp + 1]
jne 0x14002a0ac
mov edx, r10d
test edx, edx
je 0x14002a124
mov ecx, r10d
mov r9d, r10d
cmp r9d, ebp
jae 0x14002a0c9
cmp rdi, qword [rsp]
jae 0x14002a136
movzx eax, byte [rdi]
or ecx, eax
inc rdi
inc r9d
shl ecx, 8
cmp r9d, 3
jb 0x14002a0b6
mov r9d, r10d
test edx, edx
je 0x14002a105
lea r14, [0x140009370]
cmp r8, r12
jae 0x14002a12e
mov eax, ecx
inc r9d
shl ecx, 6
shr eax, 0x1a
and eax, 0x3f
mov al, byte [rax + r14]
mov byte [r8], al
inc r8
cmp r9d, edx
jb 0x14002a0e3
add r11d, edx
mov eax, r10d
sub esi, edx
je 0x14002a121
cmp r8, r12
jae 0x14002a12e
inc eax
mov byte [r8], 0x3d
inc r8
cmp eax, esi
jb 0x14002a10f
add r11d, esi
mov rax, qword [rsp + 0x68]
mov dword [rax], r11d
jmp 0x14002a13c
mov r10d, 0x8007007a
jmp 0x14002a13c
mov r10d, 0x80070057
mov eax, r10d
mov rbx, qword [rsp + 0x50]
add rsp, 0x10
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002a388
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xc0
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rbp + 0xf], rax
and qword [r9], 0
mov rdi, qword [rbp + 0x7f]
mov rsi, r9
and qword [rdi], 0
mov r14d, r8d
mov r15, rdx
mov r12, rcx
test rdx, rdx
je 0x14002a4bc
test r8d, r8d
je 0x14002a4bc
xor edx, edx
lea rcx, [rbp - 0x61]
lea r8d, [rdx + 0x68]
call sub.msvcrt.dll_memset
and dword [rbp - 0x5d], 0
and dword [rbp - 0x61], 0
lea rcx, [rbp - 0x61]
mov r8d, r14d
mov rdx, r15
mov dword [rbp - 0x59], 0x67452301
mov dword [rbp - 0x55], 0xefcdab89
mov dword [rbp - 0x51], 0x98badcfe
mov dword [rbp - 0x4d], 0x10325476
call fcn.140029d54
lea rcx, [rbp - 0x61]
call fcn.140029e40
mov rax, qword [r12]
and qword [rbp - 0x69], 0
mov rbx, qword [rax + 8]
and dword [rbp - 0x71], 0
mov rcx, rbx
call qword [0x140031ba0]
lea rax, [rbp - 0x71]
lea r9, [rbp - 9]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x69]
mov r8d, r14d
mov rdx, r15
mov rcx, r12
mov qword [rsp + 0x20], rax
call rbx
mov ebx, eax
test eax, eax
js 0x14002a496
lea r8, [rbp - 9]
mov r9d, 0x10
mov rdx, rsi
call fcn.14002a2d0
test al, al
je 0x14002a48d
mov r9d, dword [rbp - 0x71]
mov r8, qword [rbp - 0x69]
mov rdx, rdi
call fcn.14002a2d0
test al, al
jne 0x14002a492
mov ebx, 0x80004005
test ebx, ebx
jns 0x14002a4b0
mov rcx, qword [rsi]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
and qword [rsi], 0
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
and qword [rdi], 0
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
jmp 0x14002a4f2
mov ebx, 1
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov ecx, ebx
mov qword [rsi], rax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov ebx, 0x8007000e
mov qword [rdi], rax
mov rcx, qword [rsi]
test rcx, rcx
je 0x14002a4f2
test rax, rax
je 0x14002a4f2
xor ebx, ebx
mov byte [rcx], bl
mov rax, qword [rdi]
mov byte [rax], bl
mov eax, ebx
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.14002ad70
add rsp, 0xc0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x14002adb8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x14002b12c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14002b178
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002b170
cmp dword [rcx + 0x3c], edx
jl 0x14002b170
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14002b170
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14002b178
mov rax, rdx
add rsp, 0x18
ret

Function at 0x14002b2c4
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14002e008]
and qword [rbp + 0x18], 0
movabs rbx, 0x2b992ddfa232
cmp rax, rbx
jne 0x14002b37f
lea rcx, [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
xor qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
xor qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
shl rax, 0x18
xor qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rbp + 0x10]
mov eax, eax
xor rax, qword [rbp + 0x10]
xor rax, rcx
lea rcx, [rbp + 0x20]
mov qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
shl rax, 0x20
movabs rcx, 0xffffffffffff
xor rax, qword [rbp + 0x20]
xor rax, qword [rbp + 0x10]
and rax, rcx
movabs rcx, 0x2b992ddfa233
cmp rax, rbx
cmove rax, rcx
mov qword [0x14002e008], rax
mov rbx, qword [rsp + 0x48]
not rax
mov qword [0x14002e010], rax
add rsp, 0x20
pop rbp
ret
Function at 0x140017760
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
nop dword [rax + rax]
mov eax, dword [0x141dbebb8]
xor edx, edx
div dword [0x141dbebbc]
or eax, 0xf7f96f6a
imul eax, eax, 0x1859e3f6
cmp eax, 0x8d8955f9
je 0x140017770
mov eax, dword [0x141dbebc0]
xor eax, dword [0x141dbebc4]
mov rdi, qword [rsi + 0x10]
or eax, 0x32361dd3
and eax, 0x3b371ff3
cmp eax, 0xda9b38b4
ja 0x1400177da
mov eax, dword [0x141dbebc8]
sub eax, dword [0x141dbebcc]
imul ebx, eax, 0x2a5b3f95
add ebx, 0x4a9179bd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0x3454d065
jae 0x1400177e5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400177b1
test eax, eax
jne 0x140017820
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov eax, dword [0x141dbebd0]
sub eax, dword [0x141dbebd4]
imul rax, rax, 0x39c9f1fd
shr rax, 0x3b
imul eax, eax, 0x597e569d
or eax, 0x81aa6ff9
cmp eax, 0xdbedbf91
je 0x1400177f0
nop dword [rax]
mov eax, dword [0x141dbebd8]
add eax, dword [0x141dbebdc]
imul eax, eax, 0x282a11f8
add eax, 0xdc035990
cmp eax, 0x21cc9784
jb 0x140017820
nop
mov eax, dword [0x141dbebe0]
imul eax, dword [0x141dbebe4]
imul eax, eax, 0xa09aaac0
and eax, 0x253d9b40
cmp eax, 0x35e28ec8
ja 0x140017840
cmp rsi, 0xffffffffffffffff
je 0x1400179a0
mov eax, dword [0x141dbebe8]
or eax, dword [str.z.e_s_]
add eax, 0x226f045d
xor eax, 0x1080058a
or eax, 0xca40b861
cmp eax, 0xf999d269
je 0x140017899
lock dec qword [rsi + 8]
sete al
xor ecx, ecx
test cl, cl
je 0x1400178a0
lock dec qword [rsi + 8]
jmp 0x14001788b
test al, al
je 0x1400179a0
mov eax, dword [0x141dbebf0]
xor edx, edx
div dword [0x141dbebf4]
or eax, 0x4f103311
add eax, 0x90fb2c92
cmp eax, 0x1ddaee0e
jae 0x1400178d0
nop word [rax + rax]
mov eax, dword [0x141dbebf8]
xor eax, dword [0x141dbebfc]
add eax, 0x44affa2e
or eax, 0x21dbd253
imul eax, eax, 0xb3cf30cf
cmp eax, 0xb5d4226b
ja 0x1400178d0
mov eax, dword [0x141dbec00]
add eax, dword [0x141dbec04]
imul eax, eax, 0xecf56cf5
add eax, 0x5800cd9b
mov ecx, 0xb4e933df
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x8c09361
jbe 0x140017930
mov rax, qword [0x141dd7fe0]
nop word cs:[rax + rax]
mov eax, dword [0x141dbec08]
xor eax, dword [0x141dbec0c]
mov rdi, qword [0x141dd7fe0]
cmp eax, 0x11bc8ac5
je 0x140017930
mov eax, dword [0x141dbec10]
xor eax, dword [0x141dbec14]
xor eax, 0x41240a9
or eax, 0x8aedad14
cmp eax, 0x244911e5
jne 0x140017975
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov ebp, dword [0x141dbec18]
imul ebp, dword [0x141dbec1c]
mov rcx, rdi
xor edx, edx
mov r8, rsi
call rbx
cmp ebp, 0x246e2db9
je 0x140017980
nop
mov eax, dword [0x141dbec20]
imul eax, dword [0x141dbec24]
add eax, 0x9c779986
xor eax, 0x8b6d7648
cmp eax, 0xc0c33d20
ja 0x1400179a0
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140018760
Capabilities:
Encode data using xor

Disassembly:
mov rax, 0xffffffffdf6819da
sub rax, rdx
mov r8, rax
shr r8, 6
xor r8, rax
mov eax, dword [0x141dbee18]
xor edx, edx
div dword [0x141dbee1c]
add r8, 0xffffffffd3868f39
mov rax, r8
rol rax, 4
mov edx, dword [0x141dbee20]
and edx, dword [0x141dbee24]
and edx, 0xab7684f3
xor edx, 0x791da07b
add edx, 0x93b6bc88
cmp edx, 0x66bfda13
ja 0x140018790
xor eax, r8d
movzx eax, ax
add rcx, rax
nop
mov eax, dword [0x141dbee28]
sub eax, dword [0x141dbee2c]
imul eax, eax, 0xeb801f
or eax, 0x678b6e45
and eax, 0x77ff6eed
cmp eax, 0xbfdd4f37
je 0x1400187c0
mov rax, rcx
ret

Function at 0x1400188e0
Capabilities:
Encode data using xor

Disassembly:
inc rdx
mov rax, rdx
rol rax, 2
xor eax, edx
movzx eax, ax
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141dbee48]
and ecx, dword [0x141dbee4c]
or ecx, 0x37bb319a
add ecx, 0x79d49096
xor ecx, 0x4a205cc9
cmp ecx, 0xe618df7a
ja 0x140018900
ret

Function at 0x140018b40
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0x673d1440
mov rcx, rdx
rol rcx, 3
nop word cs:[rax + rax]
mov r8d, dword [0x141dbee78]
or r8d, dword [0x141dbee7c]
imul r8d, r8d, 0xb2b90f5d
xor r8d, 0x2004b4b3
or r8d, 0x9b8a4b4c
cmp r8d, 0x27fd09b1
jb 0x140018b60
xor rcx, rdx
neg rcx
mov rdx, rcx
rol rdx, 3
xor rdx, rcx
nop dword [rax]
mov ecx, dword [0x141dbee80]
imul ecx, dword [0x141dbee84]
imul ecx, ecx, 0x461307be
add ecx, 0x3d7cec62
cmp ecx, 0x395097e1
ja 0x140018ba0
mov ecx, 0xd047f43b
movzx edx, dx
add rax, rdx
nop dword [rax]
mov edx, dword [0x141dbee88]
imul edx, dword [0x141dbee8c]
imul rdx, rcx
shr rdx, 0x3f
xor edx, 0x107ba9d7
imul edx, edx, 0xc70cf6b4
cmp edx, 0x1f96e1c9
jb 0x140018bd0
ret

Function at 0x140018c00
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rdx
xor rdx, 0xffffffffc7cde61c
mov rcx, rdx
shr rcx, 0x12
xor rcx, rdx
add rcx, 0x1b0eeb36
mov rdx, rcx
rol rdx, 7
nop word cs:[rax + rax]
mov r8d, dword [0x141dbee90]
imul r8d, dword [0x141dbee94]
xor r8d, 0x80404100
or r8d, 0x1c8fa886
and r8d, 0x9cffed9e
cmp r8d, 0x182c99ed
jb 0x140018c30
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x140018c70
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, 1
sub rcx, rdx
nop dword [rax + rax]
mov edx, dword [0x141dbee98]
and edx, dword [0x141dbee9c]
and edx, 0x4101f941
xor edx, 0x50000801
or edx, 0xae7e06be
cmp edx, 0xa87ae78c
jb 0x140018c80
xor rcx, 0xffffffffec02bcb6
mov rdx, rcx
rol rdx, 1
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret
Function at 0x140018cc0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0xffffffffaf6a7303
imul rdx, rdx, 0xffffffff892d7105
add rdx, 0xfffffffffef716c7
mov rcx, rdx
shr rcx, 1
nop
mov r8d, dword [0x141dbeea0]
add r8d, dword [0x141dbeea4]
imul r8d, r8d, 0x1b82abae
or r8d, 0xaf0115e2
imul r8, r8, 0x10e27919
shr r8, 0x3c
cmp r8d, 0xa3381fc5
je 0x140018ce0
xor rcx, rdx
mov rdx, rcx
rol rdx, 1
nop dword [rax]
mov r8d, dword [0x141dbeea8]
sub r8d, dword [0x141dbeeac]
imul r8d, r8d, 0xe7b3de82
or r8d, 0x2369868a
and r8d, 0x2bff87ca
cmp r8d, 0x308cbd02
ja 0x140018d20
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141dbeeb0]
imul ecx, dword [0x141dbeeb4]
add ecx, 0xfc01d8e2
imul rcx, rcx, 0x5b8b186f
shr rcx, 0x3e
xor ecx, 0xad3d876d
cmp ecx, 0xee1400f7
ja 0x140018d60
ret

Function at 0x140018f00
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
neg r8
nop word cs:[rax + rax]
mov eax, dword [0x141dbeed8]
xor eax, dword [0x141dbeedc]
add eax, 0x50246573
or eax, 0x4f65490b
add eax, 0xd93e75e3
cmp eax, 0x1a49a1f9
jb 0x140018f10
xor r8, 0x53f3ec6e
add r8, 0x763f6713
mov r9, r8
rol r9, 5
nop word [rax + rax]
mov eax, dword [0x141dbeee0]
xor edx, edx
div dword [0x141dbeee4]
xor eax, 0xaade84
imul eax, eax, 0xf1bc3921
or eax, 0xfd66ea39
cmp eax, 0x5df47a01
jb 0x140018f50
xor r9d, r8d
movzx eax, r9w
add rcx, rax
mov rax, rcx
ret

Function at 0x140019040
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov r8d, 0x8a5c525d
mov rcx, 0xffffffffde6555c5
sub rcx, rdx
nop word cs:[rax + rax]
mov edx, dword [0x141dbef08]
xor edx, dword [0x141dbef0c]
or edx, 0xeebf9e9f
imul rdx, r8
shr rdx, 0x3e
cmp edx, 0x28405c0b
ja 0x140019060
mov rdx, rcx
shr rdx, 6
xor rdx, rcx
mov rcx, 0xffffffffe0036f85
sub rcx, rdx
nop word cs:[rax + rax]
mov edx, dword [0x141dbef10]
xor edx, dword [0x141dbef14]
xor edx, 0x99105000
or edx, 0x6e786ef
cmp edx, 0x1e6688e
je 0x1400190a0
mov rdx, rcx
rol rdx, 2
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x140019170
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov r8, rdx
rol r8, 1
xor r8, rdx
mov rcx, r8
rol rcx, 5
nop word cs:[rax + rax]
mov edx, dword [0x141dbef38]
or edx, dword [0x141dbef3c]
or edx, 0x622352f5
cmp edx, 0x993d5621
je 0x140019190
xor rcx, r8
mov rdx, rcx
rol rdx, 1
nop word cs:[rax + rax]
mov r8d, dword [0x141dbef40]
sub r8d, dword [0x141dbef44]
imul r8d, r8d, 0xee783345
add r8d, 0x5497e1de
or r8d, 0x86813eea
cmp r8d, 0xd3190830
ja 0x1400191c0
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141dbef48]
sub ecx, dword [0x141dbef4c]
or ecx, 0x11068a40
xor ecx, 0x80800002
and ecx, 0xd5968ad3
cmp ecx, 0xb179f9a
jb 0x140019200
ret

Function at 0x140019230
Capabilities:
Encode data using xor

Disassembly:
add rdx, 0x5e04f423
mov rax, rcx
mov r8, rdx
shr r8, 2
xor r8, rdx
mov rcx, r8
rol rcx, 1
xor rcx, r8
movzx ecx, cx
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141dbef50]
xor ecx, dword [0x141dbef54]
imul ecx, ecx, 0xbcde80b8
and ecx, 0xa00fa600
add ecx, 0x74c68cf8
cmp ecx, 0xcb0a1bd0
ja 0x140019260
ret
Function at 0x140019290
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
rol rcx, 3
xor rcx, rdx
mov r8d, 0x81bcd2e7
add rcx, 0xffffffffeb98a398
mov rdx, rcx
rol rdx, 7
nop word cs:[rax + rax]
mov r9d, dword [0x141dbef58]
xor r9d, dword [0x141dbef5c]
imul r9, r8
shr r9, 0x3f
add r9d, 0x390ad7d1
cmp r9d, 0xe1263a00
ja 0x1400192c0
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x1400192f0
Capabilities:
Encode data using xor

Disassembly:
imul rax, rdx, 0xffffffffb361bc45
nop word [rax + rax]
mov edx, dword [0x141dbef60]
xor edx, dword [0x141dbef64]
and edx, 0xe96e7930
add edx, 0xc746ed9d
cmp edx, 0x8d7ff50d
ja 0x140019300
add rax, 0x4c9e43bb
mov r8, rax
rol r8, 7
xor r8, rax
mov r9, r8
rol r9, 5
nop word [rax + rax]
mov eax, dword [0x141dbef68]
xor edx, edx
div dword [0x141dbef6c]
and eax, 0x33d0407
add eax, 0xfb3e5c76
and eax, 0x24e0820
cmp eax, 0x88c310a7
ja 0x140019340
xor r9d, r8d
movzx eax, r9w
add rcx, rax
mov rax, rcx
ret

Function at 0x1400193e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov r8, rdx
rol r8, 7
xor ecx, ecx
nop dword [rax]
test cl, cl
jne 0x1400193f0
xor r8, rdx
not r8
mov rcx, r8
rol rcx, 1
xor rcx, r8
neg rcx
mov rdx, rcx
rol rdx, 6
nop dword [rax]
mov r8d, dword [0x141dbef78]
and r8d, dword [0x141dbef7c]
xor r8d, 0xe2d48ae3
add r8d, 0x1dd7096b
xor r8d, 0x9efb1f8f
cmp r8d, 0xd3ada9b8
ja 0x140019410
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x1400194e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc7863c3d
mov r8, rdx
rol r8, 7
xor r8, rdx
add r8, 0x47e95d86
xor r8, 0xffffffffca17153b
mov rdx, r8
rol rdx, 1
xor rdx, r8
mov r8, rdx
rol r8, 4
nop dword [rax]
mov r9d, dword [0x141dbef88]
mov r10d, dword [0x141dbef8c]
add r9d, r10d
add r9d, 0xfeedff13
xor r9d, 0x1259617d
imul r9, rax
shr r9, 0x3e
cmp r9d, 0x96fc3355
ja 0x140019510
xor r8, rdx
nop word cs:[rax + rax]
mov eax, dword [0x141dbef90]
sub eax, dword [0x141dbef94]
imul eax, eax, 0x2ac8f8cc
add eax, 0xb16c08f6
cmp eax, 0xc079bb53
ja 0x140019550
mov eax, dword [0x141dbef98]
xor r9d, r9d
xor edx, edx
div dword [0x141dbef9c]
movzx eax, r8w
add rcx, rax
nop word cs:[rax + rax]
test r9b, r9b
jne 0x140019590
mov rax, rcx
ret

Function at 0x140019600
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
xor r8, 0x2dcc8548
nop word [rax + rax]
mov eax, dword [0x141dbefa8]
xor edx, edx
div dword [0x141dbefac]
xor eax, 0x621e0f3a
cmp eax, 0x3d9eb2eb
jb 0x140019610
add r8, 2
mov rax, r8
rol rax, 1
xor eax, r8d
movzx eax, ax
add rcx, rax
mov rax, rcx
ret

Function at 0x1400196b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
movabs r8, 0xb06c7d8dc4a2771
mov rcx, 0xffffffffaab5972c
sub rcx, rdx
imul rcx, r8
add rcx, 0x79fcc603
nop word cs:[rax + rax]
mov edx, dword [0x141dbefb8]
xor edx, dword [0x141dbefbc]
xor edx, 0x24000109
or edx, 0xdbf5fef2
cmp edx, 0x32619f5e
je 0x1400196e0
mov rdx, rcx
rol rdx, 2
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret