joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c040
Capabilities:
Encode data using xor
Set registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15, r9
mov rbx, r8
mov r14, rdx
mov rdi, rcx
movzx eax, byte [0x141dd7ff8]
mov eax, dword [0x141dbf3f0]
xor edx, edx
div dword [0x141dbf3f4]
add eax, 0x65d1c94f
or eax, 0x4e8ac9a2
imul rcx, rax, 0x166a7d51
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
cmp eax, 0xcb6db8af
ja 0x14001c0c8
mov eax, dword [0x141dbf3f8]
xor edx, edx
div dword [0x141dbf3fc]
mov ebp, eax
xor ebp, 0x2840000a
and ebp, 0x6a4a970a
add ebp, 0x8b3ffe
mov edx, 4
xor ecx, ecx
call fcn.1400beea0
cmp ebp, 0x23afad5f
jae 0x14001c0d6
mov edx, 4
xor ecx, ecx
call fcn.1400beea0
jmp 0x14001c092
mov rsi, rax
nop dword [rax]
mov eax, dword [str.zxE_]
xor eax, dword [0x141dbf404]
xor eax, 0x5ba97258
imul eax, eax, 0x347a4d5c
cmp eax, 0x77f9e41b
je 0x14001c0e0
test rsi, rsi
je 0x14001c129
mov eax, dword [0x141dbf410]
sub eax, dword [0x141dbf414]
imul eax, eax, 0xd138acda
xor eax, 0x934761a4
imul eax, eax, 0xffe16cca
cmp eax, 0x1c3b9aeb
jne 0x14001c151
jmp 0x14001c175
ud2
mov eax, dword [0x141dbf418]
xor edx, edx
div dword [0x141dbf41c]
add eax, 0xff62eec1
or eax, 0x2110109e
mov ecx, dword [r15]
mov dword [rsi], ecx
cmp eax, 0xe567eed2
jne 0x14001c180
mov eax, dword [r15]
mov dword [rsi], eax
jmp 0x14001c151
mov eax, dword [0x141dbf420]
imul eax, dword [0x141dbf424]
and eax, 0x40655dfb
imul eax, eax, 0xbf8d803
cmp eax, 0x30d8af40
je 0x14001c180
add rbx, r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x40], 0
mov dword [rsp + 0x48], 1
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x30]
call fcn.140082020
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], 4
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp qword [rsp + 0x50], 0
je 0x14001c260
mov r14, qword [0x141dd7fe0]
mov eax, dword [0x141dbf428]
imul eax, dword [0x141dbf42c]
xor eax, 0x26428fc1
add eax, 0x2af66594
cmp eax, 0x5276c056
jb 0x14001c24f
mov ebp, dword [0x141dbf430]
imul ebp, dword [0x141dbf434]
or ebp, 0x7ddedd9b
add ebp, 0x79ac677c
mov rcx, r14
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebp, 0xf6a88dd
jae 0x14001c260
mov rcx, r14
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14001c220
mov eax, dword [0x141dbf438]
imul eax, dword [0x141dbf43c]
xor eax, 0x3b7cb258
imul eax, eax, 0xa5045c14
cmp eax, 0xc6439d84
ja 0x14001c260
mov eax, dword [0x141dbf440]
and eax, dword [0x141dbf444]
mov ecx, 0xed90de21
imul rcx, rax
shr rcx, 0x3e
add ecx, 0x83632819
cmp ecx, 0x2ddf16c3
jb 0x14001c2d4
mov rcx, qword [0x141dd7fe0]
xor ebx, ebx
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rdi
shl rcx, 0x20
or rcx, 2
test edi, edi
mov eax, 0
cmovne rax, rcx
test bl, bl
je 0x14001c2e8
mov rcx, qword [0x141dd7fe0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14001c2a6
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140028680
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x388
movaps xmmword [rsp + 0x370], xmm6
mov ecx, 5
call fcn.14008a260
lea rax, [0x141da6b5f]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rdx, 0x44f6c3cb1fd41a51
mov qword [rsp + 0x50], rdx
mov rdx, qword [rsp + 0x50]
call fcn.140018a30
mov rdi, qword [rax]
mov rbx, qword [rax + 8]
mov r14, qword [rax + 0x10]
mov ebp, dword [rax + 0x18]
movzx r15d, byte [rax + 0x1c]
movzx eax, byte [0x141dd7ff8]
mov edx, 0x1d
xor ecx, ecx
call fcn.1400beea0
test rax, rax
je 0x140028cee
mov qword [rsp + 0x280], rax
movabs rax, 0xcc88a9782c0b007a
xor r14, rax
movabs rax, 0x8d3ffe41ae851465
xor rbx, rax
xor r15b, 0x68
xor ebp, 0xed5f70cb
nop
mov eax, dword [0x141dc09b0]
xor eax, dword [0x141dc09b4]
or eax, 0x72d223b7
imul eax, eax, 0x236868e3
xor eax, 0x4df805ad
cmp eax, 0x1c1aeb1c
jb 0x140028730
movabs rsi, 0x834d7acfca72d760
xor eax, eax
test al, al
je 0x140028793
mov rax, rdi
xor rax, rsi
mov rdx, qword [rsp + 0x280]
mov qword [rdx], rax
mov qword [rdx + 8], rbx
mov qword [rdx + 0x10], r14
mov dword [rdx + 0x18], ebp
mov byte [rdx + 0x1c], r15b
lea rcx, [rsp + 0x50]
mov r8d, 0x1d
call fcn.14009b8a0
xor rdi, rsi
lea r9, [rsp + 0x50]
mov rsi, qword [rsp + 0x280]
nop word cs:[rax + rax]
mov r13d, dword [0x141dc09b8]
add r13d, dword [0x141dc09bc]
mov eax, 0xe9ce075d
imul r13, rax
shr r13, 0x3f
or r13d, 0x5775364a
mov qword [rsi], rdi
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r14
mov dword [rsi + 0x18], ebp
mov byte [rsi + 0x1c], r15b
mov r8d, 0x1d
mov rcx, r9
mov rdx, rsi
mov r12, r9
call fcn.14009b8a0
mov r9, r12
cmp r13d, 0x8d8747df
ja 0x1400287b0
mov rax, qword [rsp + 0x50]
cmp eax, 2
jne 0x140028d11
mov rax, qword [rsp + 0x58]
nop word [rax + rax]
mov ecx, dword [0x141dc09d0]
or ecx, dword [0x141dc09d4]
or ecx, 0x241a8f9
add ecx, 0xc0025163
xor ecx, 0xf42f1ddc
cmp ecx, 0xad12e5e9
ja 0x140028820
mov ecx, eax
and ecx, 3
lea rdx, [0x141db72cc]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov eax, dword [0x141dc09a0]
xor eax, dword [0x141dc09a4]
imul eax, eax, 0xd33e737a
add eax, 0xf039c08a
cmp eax, 0xc2ef185d
jbe 0x140028d74
jmp 0x140028d8e
mov eax, dword [0x141dc09c0]
or eax, dword [0x141dc09c4]
xor eax, 0x4002602
or eax, 0xa13f9924
and eax, 0xe5ffbfa6
cmp eax, 0x2a48e463
jae 0x140028d40
call fcn.1400becc0
nop dword [rax + rax]
mov eax, dword [0x141dc09c8]
imul eax, dword [0x141dc09cc]
or eax, 0xdc1e93b4
and eax, 0xdcbf97f4
shr eax, 2
imul rsi, rax, 0x434ff769
shr rsi, 0x3b
call fcn.1400becc0
cmp esi, 0xd9c5bffc
ja 0x140028d40
jmp 0x140028da4
mov eax, dword [0x141dc09a8]
xor eax, dword [0x141dc09ac]
and eax, 0x8b7a70c4
ud2
ud2
ud2
Function at 0x1400374d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
nop dword [rax]
mov eax, dword [0x141dc1ea8]
mov ecx, dword [0x141dc1eac]
add eax, ecx
add eax, 0x4525ad5f
xor eax, 0x79d87910
and eax, 0x7bf9f951
cmp eax, 0x9d53ecc7
ja 0x1400374e0
cmp rdx, 0x11
jb 0x140037563
nop word [rax + rax]
mov eax, dword [0x141dc1eb0]
and eax, dword [0x141dc1eb4]
or eax, 0x7af2ea14
and eax, 0xffffefb4
cmp eax, 0x7dedf68
je 0x140037510
mov rsi, qword [rsi - 8]
nop word cs:[rax + rax]
mov eax, dword [0x141dc1eb8]
add eax, dword [0x141dc1ebc]
and eax, 0x8996251
xor eax, 0x28b4183d
imul eax, eax, 0xa809779c
cmp eax, 0xe50ad22c
ja 0x140037540
mov eax, dword [0x141dc1ec0]
or eax, dword [0x141dc1ec4]
imul eax, eax, 0x326aed25
add eax, 0xedc9a20e
shr eax, 1
imul rax, rax, 0x47d94679
shr rax, 0x37
cmp eax, 0xf447befb
je 0x1400375c6
mov edi, dword [0x141dc1ec8]
or edi, dword [0x141dc1ecc]
or edi, 0xc195f224
xor edi, 0x84d52c0e
add edi, 0x25a1f5ac
mov rcx, qword [0x141dd7fe0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp edi, 0xcbe97e5a
jbe 0x1400375da
mov rcx, qword [0x141dd7fe0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14003758e
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140038630
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rsi, rcx
mov eax, dword [0x141dc2130]
xor edx, edx
div dword [0x141dc2134]
or eax, 0x60dfd1c0
xor eax, 0xe7c04a1a
add eax, 0x5a7b1b6b
cmp eax, 0x7df9dc14
jb 0x140038690
mov ecx, dword [0x141dc2138]
imul ecx, dword [0x141dc213c]
xor ecx, 0x500163da
or ecx, 0xaaee0c01
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov r8, rsp
cmp ecx, 0x246d5036
jae 0x14003869f
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
jmp 0x14003865f
mov eax, dword [0x141dc2140]
and eax, dword [0x141dc2144]
add eax, 0x99b5d844
imul rax, rax, 0x550aee67
shr rax, 0x3d
cmp eax, 0x4f118f13
je 0x1400386fe
mov eax, dword [0x141dc2148]
xor edx, edx
div dword [0x141dc214c]
mov ecx, eax
imul rax, rcx, 0x1959fca5
shr rax, 0x20
sub ecx, eax
shr ecx, 1
add ecx, eax
shr ecx, 0x1f
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov rdi, rsp
cmp ecx, 0xeca1dc93
jbe 0x14003870d
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
jmp 0x1400386c2
mov rcx, qword [rsi]
cmp rcx, 0xffffffffffffffff
je 0x1400388be
lea rax, [rcx + 1]
nop
mov edx, dword [0x141dc2150]
sub edx, dword [0x141dc2154]
add edx, 0xac9df9ba
or edx, 0xa8f9721c
xor edx, 0xe5df44ec
cmp edx, 0x7635bda6
ja 0x140038720
lea rdx, [rcx + rcx]
nop word [rax + rax]
mov r10d, dword [0x141dc2158]
sub r10d, dword [0x141dc215c]
and r10d, 0x4200022
xor r10d, 0xc10900e
cmp rdx, rax
mov r9, rax
cmova r9, rdx
cmp r10d, 0xaa27304a
ja 0x140038750
cmp r9, 9
mov ebx, 8
cmovae rbx, r9
test rbx, rbx
js 0x1400388be
nop word cs:[rax + rax]
mov eax, dword [0x141dc2160]
xor edx, edx
div dword [0x141dc2164]
xor eax, 0x8ca9d589
imul eax, eax, 0x77aad266
add eax, 0x4f1c52fa
cmp eax, 0x8107b25e
ja 0x1400387a0
test rcx, rcx
je 0x140038805
mov rax, qword [rsi + 8]
mov qword [r8], rax
mov qword [r8 + 0x10], rcx
nop word cs:[rax + rax]
mov eax, dword [0x141dc2168]
or eax, dword [0x141dc216c]
xor eax, 0xbb2d0251
imul eax, eax, 0x7ad5394d
cmp eax, 0x8f4ab16
je 0x1400387e0
mov eax, 1
jmp 0x140038807
xor eax, eax
mov qword [r8 + 8], rax
sub rsp, 0x20
mov rcx, rdi
mov rdx, rbx
call fcn.1400375f0
add rsp, 0x20
cmp qword [rdi], 0
jne 0x140038880
nop word cs:[rax + rax]
mov eax, dword [0x141dc2180]
xor eax, dword [0x141dc2184]
xor eax, 0x7ce7745e
add eax, 0x8b7ff7ba
imul rax, rax, 0x1ac87411
shr rax, 0x3c
cmp eax, 0xd32883dd
ja 0x140038830
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x140038860
mov rax, qword [rdi + 8]
mov qword [rsi + 8], rax
mov qword [rsi], rbx
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [0x141dc2170]
xor eax, dword [0x141dc2174]
xor eax, 0xbf694a97
imul eax, eax, 0xcc7666ad
cmp eax, 0xd02b7ec9
jb 0x140038880
nop
mov eax, dword [0x141dc2178]
and eax, dword [0x141dc217c]
imul eax, eax, 0xd91cfbe0
add eax, 0x1098b02b
cmp eax, 0xfd4d44b9
ja 0x1400388a0
ud2
Function at 0x140041640
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x141dc29d8]
or eax, dword [0x141dc29dc]
add eax, 0x75e44fea
or eax, 0x397a1771
imul eax, eax, 0x9c60d0ed
cmp eax, 0x3c55c2e1
jae 0x140041670
xor ecx, ecx
xgetbv
nop dword [rax + rax]
mov eax, dword [0x141dc29e0]
xor edx, edx
div dword [0x141dc29e4]
imul rcx, rax, 0x13f12cdb
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
imul r8d, eax, 0x3a66c4d1
add r8d, 0xd6d12643
xor ecx, ecx
xgetbv
cmp r8d, 0x55dfbd9f
jb 0x140041670
mov rcx, rax
shl rdx, 0x20
or rcx, rdx
mov r8d, 0xaafcfadd
nop
mov eax, dword [0x141dc29e8]
xor edx, edx
div dword [0x141dc29ec]
add eax, 0xf9556959
xor eax, 0x30954755
imul rax, r8
shr rax, 0x3e
cmp eax, 0x57b4bd86
je 0x1400416c0
mov rax, rcx
ret
Function at 0x1400534e0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, qword [rsp + 0x70]
mov rsi, r9
mov r14, rdx
mov rbx, rcx
nop word [rax + rax]
mov eax, dword [str.loy]
add eax, dword [0x141dc4e5c]
or eax, 0x865d4029
imul eax, eax, 0xe9f2fa7e
and eax, 0x9983b032
cmp eax, 0x8caf2c7a
jb 0x140053500
cmp r8d, 0x110000
je 0x14005355e
nop dword [rax]
mov eax, dword [0x141dc4e60]
xor eax, dword [0x141dc4e64]
and eax, 0xc902402
cmp eax, 0x35bca5bb
je 0x140053530
mov rcx, rbx
mov edx, r8d
call qword [r14 + 0x20]
mov ecx, eax
mov al, 1
test cl, cl
jne 0x140053620
mov eax, 0xdb1ed513
nop word cs:[rax + rax]
mov ecx, dword [0x141dc4e68]
and ecx, dword [0x141dc4e6c]
imul rcx, rax
shr rcx, 0x3f
or ecx, 0x42843140
cmp ecx, 0xf2c98a6d
ja 0x140053570
nop word cs:[rax + rax]
mov eax, dword [0x141dc4e70]
and eax, dword [0x141dc4e74]
add eax, 0x4797ca79
and eax, 0x924da899
add eax, 0x4c81657a
cmp eax, 0xc99c25aa
ja 0x1400535a0
test rsi, rsi
je 0x14005361e
mov eax, dword [0x141dc4e78]
xor edx, edx
div dword [0x141dc4e7c]
nop word cs:[rax + rax]
mov eax, dword [0x141dc4e80]
xor edx, edx
div dword [0x141dc4e84]
and eax, 0xbf9cbb3
imul eax, eax, 0x4351b02f
xor eax, 0x426a2b0f
cmp eax, 0x898c98e8
ja 0x1400535e0
mov rax, qword [r14 + 0x18]
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp rax
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14005d4b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov r8, rdx
nop word cs:[rax + rax]
mov eax, dword [0x141dc62c8]
sub eax, dword [0x141dc62cc]
and eax, 0x742110d4
add eax, 0x4c72b9c2
cmp eax, 0xb9e17a22
ja 0x14005d4c0
mov r10d, 1
test r8, r8
je 0x14005d543
cmp r8, 1
jne 0x14005d54a
mov eax, dword [0x141dc62d8]
xor edx, edx
div dword [0x141dc62dc]
nop dword [rax]
mov eax, dword [0x141dc62e0]
or eax, dword [0x141dc62e4]
xor eax, 0x56f04a48
imul eax, eax, 0xf883219a
cmp eax, 0x142678c7
ja 0x14005d500
movzx edx, byte [rcx]
mov eax, 0x100
cmp edx, 0x2b
je 0x14005d72b
mov r8d, 1
cmp edx, 0x2d
je 0x14005d72b
jmp 0x14005d5f2
xor eax, eax
jmp 0x14005d72b
movzx eax, byte [rcx]
mov edx, 0xb5b65b65
nop word cs:[rax + rax]
mov r9d, dword [0x141dc62e8]
mov r11d, dword [0x141dc62ec]
add r9d, r11d
add r9d, 0xaef58f51
shr r9d, 1
imul r9, rdx
shr r9, 0x3c
or r9d, 0xb27bfd51
cmp r9d, 0x84943bec
jb 0x14005d560
xor edx, edx
nop word cs:[rax + rax]
test dl, dl
jne 0x14005d5a0
cmp al, 0x2b
jne 0x14005d5ec
mov eax, 0xcd064f27
inc rcx
mov edx, dword [0x141dc62f0]
xor edx, dword [0x141dc62f4]
imul rdx, rax
shr rdx, 0x3e
or edx, 0xa6881116
imul rdx, rdx, 0x7ed00f1d
shr rdx, 0x3e
cmp edx, 0x8402f78a
je 0x14005d5b0
lea rax, [r8 - 1]
cmp r8, 6
mov r8, rax
jb 0x14005d5f2
jmp 0x14005d650
cmp r8, 5
jae 0x14005d650
xor r9d, r9d
nop word cs:[rax + rax]
movzx eax, byte [rcx]
add eax, 0xffffffd0
cmp eax, 9
ja 0x14005d726
add r9d, r9d
lea r9d, [r9 + r9*4]
dec r8
inc rcx
add r9d, eax
nop
mov eax, dword [0x141dc6310]
xor eax, dword [0x141dc6314]
add eax, 0x4dc0862b
xor eax, 0xafd3a45f
cmp eax, 0xcb3e5d47
ja 0x14005d620
test r8, r8
jne 0x14005d600
xor eax, eax
xor r10d, r10d
jmp 0x14005d72b
mov eax, dword [0x141dc62f8]
and eax, dword [0x141dc62fc]
or eax, 0x5aee9f84
xor eax, 0x5934ac30
add eax, 0x69fce8cc
cmp eax, 0x6747ce49
jb 0x14005d650
xor r11d, r11d
mov si, 0xa
xor eax, eax
nop dword [rax + rax]
mov r9d, eax
mov eax, dword [0x141dc6300]
xor eax, dword [0x141dc6304]
add eax, 0x60204b90
shr eax, 3
imul rax, rax, 0x910f7f7
shr rax, 0x37
cmp eax, 0x5c7b04a6
je 0x14005d683
test r8, r8
je 0x14005d642
mov eax, r9d
mul si
seto dil
movzx edx, byte [rcx]
add edx, 0xffffffd0
cmp edx, 0xa
setae bl
or bl, dil
nop word [rax + rax]
test r11b, r11b
jne 0x14005d6d0
test bl, bl
jne 0x14005d761
nop dword [rax]
mov edi, dword [0x141dc6308]
xor edi, dword [0x141dc630c]
imul rdi, rdi, 0xfa484f5
shr rdi, 0x3b
or edi, 0x4141dbb2
imul rdi, rdi, 0x1342ab31
shr rdi, 0x3a
cmp edi, 0x11701e5b
ja 0x14005d6e0
dec r8
inc rcx
add ax, dx
jae 0x14005d680
mov eax, 0x200
jmp 0x14005d72b
mov eax, 0x100
shl r9d, 0x10
or r9d, eax
or r9d, r10d
nop word cs:[rax + rax]
mov eax, dword [0x141dc6318]
imul eax, dword [0x141dc631c]
imul eax, eax, 0x379ce6b0
cmp eax, 0x97d3e84e
je 0x14005d740
mov eax, r9d
pop rbx
pop rdi
pop rsi
ret
xor eax, eax
nop word cs:[rax + rax]
cmp edx, 0xa
setb cl
mov r8d, dword [0x141dc62d0]
sub r8d, dword [0x141dc62d4]
and r8d, 0x8163b5f6
add r8d, 0x5873ab4b
or r8d, 0x2a99952c
cmp r8d, 0x2c3f8038
jbe 0x14005d770
mov al, cl
shl eax, 8
add eax, 0x100
jmp 0x14005d72b
Function at 0x14005d7c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov r8, rdx
test rdx, rdx
je 0x14005d85a
cmp r8, 1
jne 0x14005d862
nop dword [rax]
mov eax, dword [0x141dc6320]
xor edx, edx
div dword [0x141dc6324]
and eax, 0x3242104
xor eax, 0x4c100065
cmp eax, 0xffc13875
ja 0x14005d7e0
movzx r10d, byte [rcx]
nop word cs:[rax + rax]
mov eax, dword [0x141dc6328]
xor edx, edx
div dword [0x141dc632c]
imul eax, eax, 0x4b93d589
xor eax, 0x40104a32
or eax, 0x338da4c4
cmp eax, 0xea20a30c
je 0x14005d810
mov r11d, 0x100
mov r8d, 1
cmp r10d, 0x2b
je 0x14005da6e
cmp r10d, 0x2d
je 0x14005da6e
jmp 0x14005d9b7
mov r11, r8
jmp 0x14005da68
movzx eax, byte [rcx]
xor edx, edx
nop word [rax + rax]
test dl, dl
jne 0x14005d870
cmp al, 0x2b
jne 0x14005d990
inc rcx
lea rax, [r8 - 1]
cmp r8, 0xa
mov r8, rax
jb 0x14005d9b7
xor r11d, r11d
mov esi, 0xa
xor edx, edx
nop word [rax + rax]
mov r9d, edx
nop word cs:[rax + rax]
mov eax, dword [0x141dc6338]
or eax, dword [0x141dc633c]
imul eax, eax, 0xc6268957
and eax, 0x78d3f608
xor eax, 0xe9b68547
cmp eax, 0x4f31f528
jb 0x14005d8b0
test r8, r8
je 0x14005da3e
mov eax, dword [0x141dc6340]
xor edx, edx
div dword [0x141dc6344]
nop word [rax + rax]
mov edi, dword [0x141dc6348]
sub edi, dword [0x141dc634c]
add edi, 0x7878261a
and edi, 0x9ef4120
mov eax, r9d
mul esi
seto bl
cmp edi, 0x9434fd34
ja 0x14005d8f0
mov r10d, eax
lea rdi, [rcx + 1]
dec r8
mov eax, dword [0x141dc6350]
xor edx, edx
div dword [0x141dc6354]
add eax, 0x811029d5
or eax, 0x4ac89617
cmp eax, 0x3bf70734
je 0x14005d922
movzx eax, byte [rcx]
add eax, 0xffffffd0
test bl, bl
jne 0x14005da4b
cmp eax, 0xa
jae 0x14005da62
nop dword [rax + rax]
mov edx, r10d
add edx, eax
setb bl
test r11b, r11b
jne 0x14005d960
mov rcx, rdi
test bl, bl
je 0x14005d8a0
mov r11d, 0x200
jmp 0x14005da68
mov eax, dword [0x141dc6330]
xor eax, dword [0x141dc6334]
or eax, 0xdd54b53f
and eax, 0xdf54f57f
cmp eax, 0xd77c36b5
jb 0x14005d990
cmp r8, 9
jae 0x14005d890
xor r11d, r11d
xor eax, eax
nop dword [rax]
movzx r9d, byte [rcx]
add r9d, 0xffffffd0
cmp r9d, 9
ja 0x14005da43
nop
mov edx, dword [0x141dc6358]
sub edx, dword [0x141dc635c]
and edx, 0x86b42f10
shr edx, 3
imul rdx, rdx, 0x224bb249
shr rdx, 0x38
or edx, 0x83ed3e5c
cmp edx, 0x22e5c201
jb 0x14005d9d0
add eax, eax
dec r8
lea eax, [rax + rax*4]
nop word cs:[rax + rax]
mov edx, dword [0x141dc6360]
sub edx, dword [0x141dc6364]
add edx, 0xcaad4feb
or edx, 0xdd843f82
cmp edx, 0xc41b880a
je 0x14005da10
inc rcx
add r9d, eax
mov eax, r9d
test r8, r8
jne 0x14005d9c0
xor r8d, r8d
jmp 0x14005da6e
mov r11d, 0x100
jmp 0x14005da68
xor r11d, r11d
cmp eax, 0xa
setb r11b
shl r11, 8
add r11, 0x100
jmp 0x14005da68
mov r11d, 0x100
mov r8d, 1
or r11, r8
shl r9, 0x20
or r9, r11
mov rax, r9
pop rbx
pop rdi
pop rsi
ret
Function at 0x140062f70
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov byte [rbp + 7], r8b
mov qword [rbp - 0x10], rcx
movabs r9, 0x1ffffffffffffe
movabs rcx, 0x10000000000000
mov eax, dword [str.hb__f]
or eax, dword [0x141dc6d9c]
add eax, 0x8033c78a
cmp eax, 0xc695b204
jbe 0x140062ffa
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov eax, 0x60
call fcn.1400ed360
sub rsp, rax
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
movq r8, xmm1
mov r10, r8
shr r10, 0x34
lea rsi, [r8 + r8]
and rsi, r9
lea r11, [rcx - 1]
and r11, r8
mov r13, r11
or r13, rcx
nop word [rax + rax]
mov edx, dword [0x141dc6da0]
or edx, dword [0x141dc6da4]
add edx, 0x6fde6e2f
and edx, 0x4ccbe236
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov rbx, rsp
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov r14, rsp
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov rdi, rsp
mov eax, 0x60
call fcn.1400ed360
sub rsp, rax
mov r12, rsp
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov r15, rsp
out 0x44, eax
mov eax, edx
and ax, 0x7ff
mov r9, r13
cmove r9, rsi
cmp edx, 0x5f45838f
ja 0x140063020
ucomisd xmm1, xmm1
jp 0x140063787
movzx eax, ax
mov qword [rbp - 0x18], rax
add eax, 0xfffffbcd
mov dword [rbp - 8], eax
movabs rsi, 0x7ff0000000000000
mov r13, r8
and r13, rsi
nop word [rax + rax]
mov eax, dword [0x141dc6da8]
xor eax, dword [0x141dc6dac]
add eax, 0x4b624361
invalid
invalid
xor rax, 0xffffffffc42e98c1
add eax, 0xa9194afd
cmp eax, 0x7dbd055
jb 0x1400630d0
mov r10d, 1
nop dword [rax + rax]
xor edx, edx
test r13, r13
setne dl
mov eax, dword [0x141dc6db0]
and eax, dword [0x141dc6db4]
xor eax, 0x21428009
or eax, 0x562473b0
imul rax, rax, 0x73bcf11f
shr rax, 0x3c
lea rcx, [rdx*2 + 2]
cmp r13, rsi
cmove rcx, r10
add rdx, 3
test r11, r11
cmove rdx, rcx
cmp eax, 0x7e6bd487
jle 0x1400631c0
invalid
dec rdx
cmp rdx, 3
ja 0x14006378f
invalid
add byte [rax], al
mov r11b, 2
jmp 0x140063237
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400637a0
jmp 0x140063872

Function at 0x1400639c0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x140
mov rsi, rcx
movq rax, xmm1
mov rcx, rax
ror dword [rax - 0x3f], 0xe9
xor al, 0x49
mov ecx, 0
add byte [rax], al
adc byte [rax], al
Function at 0x14006c6a0
Capabilities:
Encode data using xor

Disassembly:
vbroadcastss ymm0, dword [rdx]
vmovaps ymmword [rcx], ymm0
mov eax, 0x8020b3b1
nop
mov ecx, dword [0x141dc7b20]
or ecx, dword [0x141dc7b24]
xor ecx, 0x9541fb8d
imul rcx, rax
shr rcx, 0x3c
and ecx, 2
cmp ecx, 0xd85c29b9
je 0x14006c6b0
vzeroupper
ret

Function at 0x14006c770
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xd8f7f81d
nop word cs:[rax + rax]
mov r9d, dword [0x141dc7b38]
imul r9d, dword [0x141dc7b3c]
xor r9d, 0xebff7182
imul r9, rax
shr r9, 0x3f
cmp r9d, 0xfee47107
je 0x14006c780
vmovaps ymm0, ymmword [rdx]
nop dword [rax + rax]
mov eax, dword [0x141dc7b40]
add eax, dword [0x141dc7b44]
xor eax, 0x2206
or eax, 0xf9d958f8
add eax, 0xd16f41c3
cmp eax, 0xf7117eaf
ja 0x14006c7b0
vblendps ymm0, ymm0, ymmword [r8], 3
mov eax, dword [0x141dc7b48]
or eax, dword [0x141dc7b4c]
add eax, 0xe5f67f4a
and eax, 0x27684ca2
cmp eax, 0x74aed321
ja 0x14006c7ff
vmovaps ymmword [rcx], ymm0
xor eax, eax
test al, al
je 0x14006c805
vmovaps ymmword [rcx], ymm0
jmp 0x14006c7f5
vzeroupper
ret

Function at 0x14006c8c0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x141dc7b70]
xor r9d, r9d
xor edx, edx
div dword [0x141dc7b74]
nop word cs:[rax + rax]
test r9b, r9b
jne 0x14006c8e0
mov eax, dword [0x141dc7b78]
and eax, dword [0x141dc7b7c]
or eax, 0x1454061
imul eax, eax, 0xfbdea7cd
xor eax, 0x70bd6dff
vpermpd ymm0, ymmword [r8], 0x4e
cmp eax, 0x27fdcfb9
jae 0x14006c920
vmovaps ymmword [rcx], ymm0
nop word cs:[rax + rax]
mov eax, dword [0x141dc7b80]
sub eax, dword [0x141dc7b84]
or eax, 0x70028ae0
xor eax, 0x37128a44
or eax, 0x80655513
vmovaps ymmword [rcx], ymm0
cmp eax, 0xeb2eaf57
je 0x14006c920
vzeroupper
ret

Function at 0x14006cbd0
Capabilities:
Encode data using xor

Disassembly:
vmovdqa ymm0, ymmword [rdx]
vpsrld ymm0, ymm0, 0x1a
vmovdqa ymmword [rcx], ymm0
nop dword [rax]
mov eax, dword [0x141dc7b90]
xor eax, dword [0x141dc7b94]
add eax, 0x9eef9900
and eax, 0x35ba89a3
cmp eax, 0x9f53917d
je 0x14006cbe0
vzeroupper
ret

Function at 0x14006cc10
Capabilities:
Encode data using xor

Disassembly:
vmovaps ymm0, ymmword [rdx]
nop word cs:[rax + rax]
mov eax, dword [0x141dc7b98]
xor edx, edx
div dword [0x141dc7b9c]
and eax, 0x55e319a8
imul eax, eax, 0x8d4a1565
xor eax, 0xd710b805
cmp eax, 0x4e400a00
jb 0x14006cc20
mov eax, dword [0x141dc7ba0]
and eax, dword [0x141dc7ba4]
or eax, 0x325ac276
imul rdx, rax, 0x1eda0569
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
vandps ymm0, ymm0, ymmword [r8]
cmp eax, 0xaf78144
je 0x14006cc97
mov eax, dword [0x141dc7ba8]
sub eax, dword [0x141dc7bac]
and eax, 0x5842d043
add eax, 0x3450de23
vmovaps ymmword [rcx], ymm0
cmp eax, 0x28b37f1c
jae 0x14006cc9d
vmovaps ymmword [rcx], ymm0
jmp 0x14006cc76
vzeroupper
ret