joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a47c1
Capabilities:
Parse pe header

Disassembly:
sbb bx, 0xc0ab
pop rax
ror bx, 1
add bx, 0x6b19
and edx, 0x91861424
lea rdx, [rsi*4 - 0x514d7406]
xor bp, bx
push rdx
lea rbx, [rsp + rbx + 8]
mov rsi, qword [rbx + r11 - 0x3ff1cadc]
push r9
lea r10, [r11 + r10 - 0x3ff1cae4]
mov qword [r10 + r11*2 - 0x7fe395b8], rsi
shl rcx, cl
pop rsi
pop r11
jp fcn.1401a6864
Function at 0x1401a8973
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Hash data using murmur3
Parse pe header

Disassembly:
bswap rdx
lea r10, [r10 + rsi*8 - 0x6f829f2]
mov r11d, r9d
mov qword [rsp + r9 - 0x6a1aa2d6], rcx
add r11d, 0x9bc0106
xor dword [rsp + rsi*2 - 0x12ff8], eax
xchg esi, edx
dec dx
mov rbp, qword [rsp + r9 - 0x6a1aa2ce]
add esi, dword [rsp + r9 - 0x6a1aa2d5]
setnp r9b
movsxd rax, eax
adc r8, rax
mov word [rsp + r9 - 0x6a1aa200], r11w
mov qword [rsp + rsi*2 - 0x1be0a76], rsi
xadd sil, r9b
mov r11, qword [r10 + rsi - 0xdf053f]
not qword [rsp + rsi*2 - 0x1be0a76]
xor bl, sil
dec rcx
movzx bx, byte [r11 + rsi - 0xdf053f]
jge 0x140196632
Function at 0x1401aa439
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Hash data using murmur3
Parse pe header

Disassembly:
xor dword [rsp + r11], eax
not bl
dec cx
pop rbp
jno 0x1401b5ff0
mov qword [rcx + rdx - 0x3a1d5a6b], r11
mov r9d, dword [rdi + rcx*2 - 0x743ab4d6]
mov ebx, 0x693854d
lea rdi, [rcx + rdi - 0x3a1d5a67]
xor r9d, ebp
not r9d
cqo
bswap r9d
btc cx, bx
lea r9d, [r9 + rcx*2 + 0x6d478226]
and ecx, edx
btr rbx, 0xe3
xor r9d, 0xecb33ff8
movzx r11d, dx
mov esi, 0x67242cdc
push rbp
btc rax, rax
add esi, 0x76aeabc8
xor dword [rsp + rcx], r9d
and r11w, 0x6317
pop rbp
movsxd r9, r9d
not bl
jne fcn.1401adad3
not sil
adc r8, r9
not dl
add rcx, r8
jmp rcx
btc r11d, ebx
jae 0x1401b0c64
mov si, word [rcx + r11 - 0x6b3d1507]
lea r10, [r10 + r9 - 0x2a386e7a]
mov word [r10 + r9 - 0x2a386e78], si
lea rsi, [r9 + r9*8 + 0x5500c813]
push r11
lea rax, [r9 + rdx*2 + 0x458ec0c0]
mov eax, dword [rdi + r9 - 0x2a386e78]
lea rcx, [r11 + 0x4b8cc39f]
not rcx
lea rdi, [rdi + r9*2 - 0x5470dcec]
shl ebx, cl
lea r11, [r9*4 - 0xfeea0fa]
shr edx, 0x21
xor eax, ebp
rol r9w, 0xc8
jae 0x1401a936d
rol r9b, 1
not esi
add rax, qword [rsp + rbx - 0x5b400000]
ror bx, cl
adc r9b, dl
xor bpl, r9b
push rbx
sub bl, byte [rsp + rcx - 0x3a7a0066]
or dword [rsp + rbx - 0x5b3ffff7], 0xc2da124
lea r9, [rsp + r9 + 0x10]
ror cx, cl
mov dword [rbx + r9 - 0x5b400000], r11d
lea r11, [rax + rbx*2 + 0x25a7909f]
xadd bl, r11b
mov qword [rsp + rbx - 0x5b400029], r8
ret 8
sub r9d, dword [rsp + rbx - 0x45fffffc]
dec eax
sar r11w, 0xcf
ror eax, 2
dec rbx
sal dword [rsp + rdx - 0x100ebf11], cl
lea eax, [rax + r9*4 + 0x464b7a90]
pop rsi
btr bx, 0x41
not eax
bswap rcx
btr esi, edx
sal r11d, cl
xor eax, 0x63894013
rol bx, 0x83
btr esi, 0x64
push rbp
sal bl, 0xc4
dec bx
jae 0x140172eea
lea rdi, [rdi + r11 - 0x69]
xor eax, ebp
neg r9b
btr rdx, rsi
sub sil, 0xc6
dec eax
ror eax, 2
xadd r9b, r11b
not r9w
dec dx
bswap eax
lea eax, [rdx + rax - 0x73873f2c]
shr rbx, cl
push rbp
lea rbp, [r9 + rcx*2 + 0x2b7f562]
call fcn.140183ed9
movzx r11d, byte [rdi]
mov eax, 0x20b4c575
xor r11b, bpl
movzx ebx, ax
rol r11b, 1
mov edx, ebx
bt ax, bx
neg r11b
sub r11b, 0x71
movzx r9d, ax
neg r11b
movzx ecx, r9w
push rbx
btc cx, bx
xor bpl, r11b
call fcn.14018a5af
xor cx, 0xad43
not cx
cwde
pop rax
add r11, 0x6b3d14bf
xor bp, cx
mov edx, 0x201d7e2b
add rcx, rsp
jmp 0x14017b975
movzx ecx, r11w
not cx
sub ax, ax
adc esi, dword [r11 + rdi - 0x10]
movzx r9d, cx
sar eax, cl
lea rdi, [rdi + rax*8 + 4]
inc rcx
xor esi, ebp
cwd
xor eax, r9d
adc esi, 0xfe29e095
cwd
bswap r9
ror esi, 3
cbw
lea r9, [r11*2 - 0x4359933e]
movzx ebx, dx
xor esi, 0xaeb60802
ror rbx, 0x78
neg r11
not esi
seto dl
push rbp
dec rbx
xor dword [rsp + r11*4 + 0x40], esi
xor r9, rax
pop rbp
setg r9b
movsxd rsi, esi
cmovb ecx, ebx
adc r8, rsi
sal bl, 0x62
inc r9
jmp r8
sub r9b, 0x26
xchg al, sil
jmp 0x14018bf75
movsxd rax, eax
xchg bh, bl
shr r11w, 0x8e
ror sil, 0xa6
adc r8, rax
btc rcx, r9
sbb ecx, esi
ja fcn.1401a6864
shr esi, 0x71
setnp byte [rsp + rbx - 0x5b3fffff]
ror r9b, 1
jmp 0x1401b15c5
Function at 0x1401aae95
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Hash data using murmur3
Parse pe header

Disassembly:
xor r11d, 0xe7856a66
push rdx
shl bx, 0x41
rol ebx, 0x8a
neg r11d
or ebx, esi
rol r11d, 1
shr r9w, 0xa1
xor r11d, ebx
bswap r11d
add r11d, ebx
mov qword [rsp], rbp
lea rbp, [rbx + r9*8 + 0x50125e48]
xor dword [rsp], r11d
pop rbp
lea rcx, [r9*4 - 0x4bf911f0]
dec rcx
movsxd r11, r11d
btc dx, si
or rcx, rdx
adc r8, r11
call fcn.140181c9a
movsxd rdx, edx
adc r8, rdx
and cl, al
movsx edx, bx
sbb rax, rax
lea r11, [r10 + rax*4 + 2]
and rbx, 0x4594a887
or r9, rbx
mov qword [rax + r10 - 6], r11
lea r9, [rsi + rcx*2 - 0x5d78b193]
bt r9w, 0x4f
lea r10, [r10 + rax*4 - 6]
jae fcn.1401a6864
mov qword [rsp + rbx - 0x232eb036], rbx
not cl
ror edx, 3
inc byte [rsp + rcx - 0xe4]
pop rbx
push rbp
ror rax, cl
lea r9, [r11*4 - 0x16fd2136]
and r9w, 0xe07a
xor dword [rsp + rax - 0xff00000], edx
or r9, r9
xadd rax, rcx
pop rbp
shl cx, 0x8e
jbe 0x1401a66cd
mov r9, qword [r10]
mov edx, 0x7730b364
movsx esi, dx
mov r11, qword [rdx + r10 - 0x7730b35c]
lea rbx, [rsi + rdx*8 + 0x5195454a]
jmp 0x1401b55cc
call fcn.140173e0c
push r12
lea r10, [r10*2 - 0x364f0401]
push r15
call fcn.14019d4fb
call fcn.14018379d
mov edx, 0x8e2d83cd
movsx r9d, dl
mov ecx, dword [r10 + riz]
movsx r11d, r9b
sub r11, 0xfffffffff217cfa9
btr edx, r9d
mov esi, dword [r10 + riz + 4]
or ecx, esi
lea rsi, [rdx + rdx*4 - 0x2b79f37a]
not ecx
inc r9
or esi, r9d
mov ebx, edx
mov dword [r10 + riz + 4], ecx
inc bl
mov r11d, dword [rdi + riz]
btr edx, ebx
xor r11d, ebp
bts si, bx
jb 0x1401754f6
mov r9d, 0xd9bee43b
movsx eax, r9b
mov dx, word [r10 + rax*4 - 0xec]
lea r10, [r10 + rax*8 - 0x1d6]
push rax
movsx ecx, r9w
mov al, byte [rdi + rax*2 - 0x76]
movzx r11d, byte [rsp + 4]
not qword [rsp + r11*2]
lea rdi, [rdi + r11 + 1]
bswap r9
xor al, bpl
shl byte [rsp + r11 + 1], 0x41
call fcn.14018a1ed

Function at 0x1401ab170
Capabilities:
Authenticate hmac

Disassembly:
push rsi
mov rbp, qword [rsp + rcx*2 + 0x10]
jmp 0x1401875fa
xor edx, ebp
mov qword [rsp + rcx - 0x40282a44], rcx
ror byte [rsp + rcx - 0x40282a41], cl
push rcx
bswap edx
movsx eax, cl
shr qword [rsp + rcx - 0x40282a3c], cl
dec edx
xchg qword [rsp + rcx - 0x40282a3c], rcx
rol edx, 2
movsx esi, al
lea edx, [rdx + rcx*2 - 0xcc3c2b7]
sar dword [rsp + rcx*2 - 0x85053c], 0xf5
sbb sil, cl
dec ecx
mov qword [rsp + rcx*8 - 0x2141510], rbp
adc ecx, 0x8123c8eb
xor rcx, rcx
xor dword [rsp + rcx + 8], edx
jmp 0x140179a49
Function at 0x1401afb58
Capabilities:
Parse pe header

Disassembly:
mov rbp, qword [rsp + rcx*2 - 0x4a309e]
mov qword [rsp + rcx - 0x25184b], rdx
cbw
shl dl, 0x21
movsxd r9, r9d
sal sil, 0xa2
pop rcx
dec rcx
adc r8, r9
mov word [rsp + rsi*2 + 0x20743e4e], dx
xor dword [rsp + rcx - 0x7d12e6bd], ebx
pop rbp
neg al
and edx, 0xbf281569
movsxd rbx, ebx
adc r11b, r9b
adc r8, rbx
jmp r8
rol ax, 1
xor bp, ax
shl ebx, cl
xor ecx, ebx
shr rcx, 0xb2
adc rax, rsp
btc r9, 0x12
add cl, byte [rax + rcx]
xadd sil, dl
shr bl, 6
sbb r10, 2
jmp 0x1401a565a
or esi, 0xca2768af
neg ax
sal r11d, cl
add rsi, rsi
jne 0x14018648d
neg r9d
sal byte [rsp + rcx*2 - 0x4a30a4], 0xa2
not word [rsp + rcx*2 - 0x4a30a6]
mov qword [rsp + rcx*2 - 0x4a30a6], rbp
movsx eax, dl
xor dword [rsp + rcx*2 - 0x4a30a6], r9d
sar si, 0xe2
push rax
jae 0x14016f88b
mov r11d, 0x7c19d894
mov ebx, dword [rdi + r11 - 0x7c19d894]
movsx esi, r11w
movsx ecx, r11w
movzx r9d, si
lea rdi, [r11 + rdi - 0x7c19d890]
xor ebx, ebp
sar cl, 0x82
ja 0x14019caa2
mov rdx, qword [r10]
mov r9d, 0xfe2a21b6
movzx ecx, r9b
or ax, r11w
push rbp
bswap rdx
jle 0x1401827a8
mov r11d, 0x8995a5e
push r11
mov rax, qword [r11 + r10 - 0x8995a5e]
mov esi, r11d
movsx edx, sil
lea r10, [r10 + r11*2 - 0x1132b4b4]
mov ebx, dword [rsp + r11*2 - 0x1132b4bb]
or r11d, dword [rsp + r11*2 - 0x1132b4bb]
movq xmm0, rax
mov ebx, dword [r11 + rdi - 0x899db5e]
and qword [rsp + r11*8 - 0x44cedaf0], rsi
lea rdi, [rdi + r11 - 0x899db5a]
jo 0x14017098a
xor ebx, ebp
call fcn.1401b29e9
bswap ebx
neg r9b
dec ebx
movzx edx, r9w
shl rcx, cl
jbe 0x1401b4404
mov ecx, 0x5a9e5af3
mov ebx, 0x1ea85d09
mov edx, dword [rdi + rbx*2 - 0x3d50ba12]
lea rdi, [rdi + rcx - 0x5a9e5aef]
movsx r11d, bx
push rbx
xor edx, ebp
dec edx
xadd rbx, r11
bswap edx
lea r9, [rbx + r11*2 - 0x62e0f410]
shl word [rsp + rbx*2 - 0x3d517424], 0xcb
xor edx, 0xb8a3ac83
ror byte [rsp + rcx - 0x5a9e5af2], 0x46
pop r9
inc ebx
bswap edx
neg edx
push rbp
xor dword [rsp + rbx*2 - 0x3d517426], edx
movzx esi, r11b
xadd ecx, r9d
sub ecx, 0xbaa3708c
pop rbp
sar rcx, cl
not ecx
movsxd rdx, edx
add r11w, 0xc05c
inc ebx
push rbx
add r8, rdx
lea rbx, [rbx*2 + 0x1285e77c]
push r9
call fcn.140173f40
neg sil
ror rbx, 0x22
mov word [r10 + r11 - 0x80000000], cx
jae fcn.1401a6864
movsxd rbx, ebx
sub cl, dh
xor rcx, r9
adc r8, rbx
pop rbx
xadd r9, rax
btc r9w, cx
mov ax, word [rdi + rcx - 0x48343c7e]
not edx
lea rbx, [r11 + rcx + 0x89646f6]
lea rdi, [rdi + rcx - 0x48343c7c]
shr esi, 0xf6
lea rdx, [rcx*8 + 0x601a8679]
dec esi
xor ax, bp
or r9, rsi
sbb ax, 0xd3b0
and cx, 0x17df
or bl, cl
not rsi
ror ax, 1
btr esi, 0x9e
jae 0x14018fb7b
jmp 0x140199b47
Function at 0x1401afd36
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Hash data using murmur3
Parse pe header

Disassembly:
mov qword [rsp + rcx*2 - 0x1be], r9
and word [rsp + r9*8 + 9], 0xe6b9
neg r11d
or rbx, 0x5322a854
call fcn.140180942
mov ecx, 0xf13091d2
movsx eax, cx
movzx r9d, cx
movzx r11d, word [r9 + rdi - 0x91d2]
sub eax, eax
lea rdi, [rdi + rax + 2]
or ax, ax
sal ax, 0x85
xor r11w, bp
ror r11w, 1
not rcx
not r11w
movzx esi, cl
movsx edx, cl
inc r11w
add dx, ax
not r11w
btc esi, ecx
xor bp, r11w
lea r10, [r10 + rax - 8]
rol rsi, cl
bswap edx
mov qword [r10 + rax], r11
sar sil, 0x45
not r9d
push r9
mov ebx, dword [rdi + rax]
or rdx, 0x6baa39bb
lea rdi, [rdi + rax + 4]
xor ebx, ebp
cbw
neg ebx
call fcn.14018f9b1
mov r9d, 0x852afd21
mov ecx, dword [rdi + riz]
mov eax, r9d
xor ecx, ebp
mov ebx, r9d
push rbx
shr byte [rsp + 7], 0x64
sbb ecx, 0x9e39504b
mov esi, dword [rsp]
movzx edx, al
mov word [rsp + rdx*2 - 0x3f], si
xor ecx, 0x343da10a
shl bx, 0xa2
mov r11d, ebx
sub r9w, 0x3a33
inc ecx
xor qword [rsp + rdx - 0x21], rax
inc r9
adc r9d, dword [rsp + rdx*8 - 0x104]
xor ecx, 0x9a1ebba8
mov dword [rsp + rdx*2 - 0x40], eax
xor sil, 0xb
not ecx
btr rax, 0xe5
setae sil
mov qword [rsp + rdx*2 - 0x42], rbp
xor dword [rsp + rdx - 0x21], ecx
pop rbp
call fcn.140175c9c

Function at 0x1401b4bb0
Capabilities:
Authenticate hmac

Disassembly:
sbb r11w, dx
movzx edx, byte [rdi + rcx*2 - 0x200011f4]
and si, si
movsx eax, cl
sbb rcx, rbx
lea rdi, [rdi + rsi - 0x795d0a8c]
ror r9d, 0xcd
bts cx, ax
xor dl, bpl
add cl, ch
sbb r11b, 0x58
neg bx
neg dl
xchg rcx, r11
sub dl, 0x3b
btr r9, r11
xor dl, 0xa9
bt eax, ebx
shr r11b, 0xc1
sbb rax, rcx
adc dl, 0x8e
bts r11d, r11d
setae sil
xor bpl, dl
xadd esi, ebx
mov word [r9 + r10 - 0x2bf100ac], dx
inc si
not r11w
cqo
lea r10, [r10 + rbx - 0x795d09fa]
or rdx, r8
jmp rdx
movsxd rdx, edx
mov qword [rsp + r9*2 - 0x400], r9
sub r9, qword [rsp + r9*2 - 0x400]
dec qword [rsp + r9*2]
adc r8, rdx
or rbx, r9
pop rbx
mov rax, qword [r9 + r10]
btr si, bx
xor r9, r11
mov rbx, qword [r10 + rbx - 0x1f7]
adc r11b, r11b
not r11d
or rax, rbx
movzx edx, r11w
btc r11d, 4
not rax
mov ebx, r9d
xor r11w, bx
shl cx, 1
mov qword [r9 + r10 - 0x60164576], rax
jns 0x14019d10b
pop rbp
sal dl, 0xa6
movsxd rax, eax
adc r8, rax
lea rsi, [rdx + rcx + 0x3f9c480c]
ror bx, 0x64
movzx dx, byte [r10 + rbx - 0x4fed6ae7]
jb 0x1401adbab
not si
btc esi, 0x2f
mov r11b, byte [rbx + r10 - 0x4fed6ae5]
sbb ecx, esi
lea r10, [r10 + rcx - 0xf2eb180]
lea rax, [rcx + rbx*8 - 0x4cd8361a]
or dl, r11b
not dl
not rsi
mov word [rcx + r10 - 0xf2eb182], dx
jmp r8
Function at 0x140002ab0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov r8d, 0xd2703d91
nop dword [rax]
mov eax, dword [0x141dbe3a8]
xor edx, edx
div dword [0x141dbe3ac]
add eax, 0x588e2fb6
imul rax, r8
shr rax, 0x3f
xor eax, 0x7b8cf9
cmp eax, 0x1beb6570
ja 0x140002ad0
test rsi, rsi
je 0x1400033da
mov eax, dword [0x141dbe3b0]
xor edx, edx
div dword [0x141dbe3b4]
imul eax, eax, 0xed818493
cmp eax, 0x75272087
je 0x140002b00
mov rbx, qword [rcx]
nop
mov eax, dword [0x141dbe3b8]
imul eax, dword [0x141dbe3bc]
or eax, 0xc3d3494
imul eax, eax, 0xa89dec59
or eax, 0xf493f66f
cmp eax, 0x66915c83
jb 0x140002b20
mov r13d, 0xc7f23715
lea r12, [0x141db8f74]
mov bpl, 1
jmp 0x140002b69
test rsi, rsi
je 0x1400033da
mov eax, dword [0x141dbe3c0]
add eax, dword [0x141dbe3c4]
imul eax, eax, 0xcfec91f6
add eax, 0x65c42f74
cmp eax, 0xa5e7aa75
jbe 0x140002ba0
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.1400878d0
nop word cs:[rax + rax]
mov eax, dword [0x141dbe3c8]
or eax, dword [0x141dbe3cc]
xor eax, 0xf3b18dd9
imul r15, rax, 0x57eb7ad
shr r15, 0x39
add r15d, 0xc883b97d
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.1400878d0
cmp r15d, 0x87b38722
jb 0x140002ba0
mov r14, rdx
test rax, rax
je 0x140002c60
mov ecx, r14d
and ecx, 3
nop dword [rax + rax]
mov eax, dword [0x141dbe3d8]
xor edx, edx
div dword [0x141dbe3dc]
imul rax, r13
shr rax, 0x3f
or eax, 0x8d5c45d2
cmp eax, 0xe6a1eb20
je 0x140002bf0
movsxd rax, dword [r12 + rcx*4]
add rax, r12
mov r8d, 0x818e4095
jmp rax
mov eax, dword [0x141dbe3d0]
or eax, dword [0x141dbe3d4]
and eax, 0xe5bf771e
xor eax, 0x265b3501
cmp eax, 0x779ab3e0
jb 0x140002c60
test r14, r14
je 0x1400033f1
mov eax, dword [str.R3V]
xor edx, edx
div dword [0x141dbe47c]
nop word cs:[rax + rax]
mov eax, dword [0x141dbe480]
xor edx, edx
div dword [0x141dbe484]
xor eax, 0x4599484d
and eax, 0x45b949cd
imul rax, rax, 0xe496bc5
shr rax, 0x38
cmp eax, 0x5327b44d
je 0x140002ca0
nop word [rax + rax]
mov eax, dword [0x141dbe488]
xor edx, edx
div dword [0x141dbe48c]
xor eax, 0x65b50211
add eax, 0xdc58ce55
or eax, 0x72367e88
cmp eax, 0xf4cbca1
jb 0x140002cd0
sub rsi, r14
jb 0x1400033fa
add rdi, r14
jmp 0x140002b60
xor r14d, r14d
mov rax, r14
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r14, [0x141db84c0]
jmp 0x1400033dd
mov eax, dword [0x141dbe490]
sub eax, dword [0x141dbe494]
imul eax, eax, 0x59d73d30
add eax, 0xf28b13a4
cmp eax, 0x943273a5
ja 0x140003444
mov eax, dword [0x141dbe498]
and eax, dword [0x141dbe49c]
imul eax, eax, 0x757ccb61
imul rax, rax, 0x2f39cc1f
shr rax, 0x3a
imul eax, eax, 0xbf5793fa
ud2
ud2
Function at 0x14000de50
Capabilities:
Encode data using xor

Disassembly:
movzx r8d, byte [rcx]
nop word cs:[rax + rax]
mov eax, dword [0x141dbf818]
xor edx, edx
div dword [0x141dbf81c]
xor eax, 0x4044010
or eax, 0x2b611249
and eax, 0x3f65725d
cmp eax, 0xef20e42f
je 0x14000de60
cmp r8d, 0x12
je 0x14000deb0
cmp r8d, 0x13
je case.0x14000dea7.0
cmp r8b, 0x10
ja case.default.0x14000dea7
mov eax, r8d
lea rdx, [0x141db90d4]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
ret
mov eax, dword [0x141dbf820]
or eax, dword [0x141dbf824]
xor eax, 0x20c00010
and eax, 0x22d830b1
add eax, 0xb456f7a3
cmp eax, 0xc3117861
ja 0x14000deb0
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
jmp qword [rax + 0x10]
mov rdx, qword [rcx + 8]
mov eax, 0x8b63c413
nop word cs:[rax + rax]
mov r8d, dword [0x141dbf828]
add r8d, dword [0x141dbf82c]
imul r8, r8, 0x45a82afb
shr r8, 0x3e
imul r8d, r8d, 0x424f72b9
imul r8, rax
shr r8, 0x3e
cmp r8d, 0x74f8e729
ja 0x14000def0
jmp 0x14000e09e
mov eax, dword [0x141dbf830]
xor edx, edx
div dword [0x141dbf834]
nop word cs:[rax + rax]
mov eax, dword [0x141dbf838]
and eax, dword [0x141dbf83c]
or eax, 0xa0860800
xor eax, 0xa2414080
or eax, 0x5d30b57e
cmp eax, 0xf7bde091
ja 0x14000df40
mov r8, qword [rcx + 8]
nop word cs:[rax + rax]
mov eax, dword [0x141dbf840]
xor edx, edx
div dword [0x141dbf844]
imul eax, eax, 0xe1285a93
add eax, 0xbfb6c361
cmp eax, 0x47b53fb1
jb 0x14000df70
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x14000dfa0
mov eax, 0x10
test r8, r8
jne 0x14000e0f3
jmp case.0x14000dea7.0
mov eax, dword [0x141dbf848]
xor edx, edx
div dword [0x141dbf84c]
nop word cs:[rax + rax]
mov eax, dword [0x141dbf850]
sub eax, dword [0x141dbf854]
xor eax, 0x256e267c
imul eax, eax, 0x14b68394
imul rax, rax, 0x23ec2fbf
shr rax, 0x3b
cmp eax, 0xe376f62d
ja 0x14000dfd0
nop dword [rax]
mov eax, dword [0x141dbf858]
xor eax, dword [0x141dbf85c]
and eax, 0x20e080
xor eax, 0x8010a8a2
or eax, 0x1f8f0755
cmp eax, 0xcddc3eab
ja 0x14000e000
mov rdx, qword [rcx + 8]
xor eax, eax
nop dword [rax + rax]
test al, al
jne 0x14000e030
jmp 0x14000e09e
mov eax, 0x10
cmp qword [rcx + 8], 0
jne 0x14000e0f3
jmp case.0x14000dea7.0
mov eax, 0xa5527ed1
mov edx, dword [0x141dbf860]
and edx, dword [0x141dbf864]
add edx, 0x3317e981
imul rdx, rax
shr rdx, 0x3d
imul edx, edx, 0x33d35dbe
cmp edx, 0x322d1581
je 0x14000e050
mov rdx, qword [rcx + 8]
nop dword [rax]
mov eax, dword [0x141dbf868]
add eax, dword [0x141dbf86c]
imul eax, eax, 0x43498b51
or eax, 0xa6dfde5b
cmp eax, 0xa790985d
je 0x14000e080
mov eax, 0x10
test rdx, rdx
jne 0x14000e0f3
jmp case.0x14000dea7.0
mov eax, dword [0x141dbf870]
xor edx, edx
div dword [0x141dbf874]
nop dword [rax + rax]
mov eax, dword [0x141dbf878]
and eax, dword [0x141dbf87c]
and eax, 0xa55302be
xor eax, 0x29a86344
imul eax, eax, 0xdd457599
cmp eax, 0x2504639b
ja 0x14000e0c0
mov eax, 8
cmp qword [rcx + 0x10], 0
je case.0x14000dea7.0
mov r8, qword [rcx + rax]
mov rcx, qword [0x141dda6a0]
xor edx, edx
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
Function at 0x1400174b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov eax, dword [0x141dc0ba0]
and eax, dword [0x141dc0ba4]
mov rsi, rcx
imul eax, eax, 0xca27696d
add eax, 0xcbcc0e55
cmp eax, 0x900c40a3
jae 0x1400174e2
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax]
mov eax, dword [0x141dc0ba8]
xor edx, edx
div dword [0x141dc0bac]
imul ebx, eax, 0x247d7bbe
and ebx, 0x92131998
mov rcx, qword [rsi + 0x10]
call rdi
cmp ebx, 0xb5eaaf5c
je 0x1400174f0
test eax, eax
jne 0x1400175aa
mov eax, dword [0x141dc0bb0]
sub eax, dword [str._naNjT]
imul eax, eax, 0xe543f10c
cmp eax, 0x95685049
jne 0x14001753f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop word cs:[rax + rax]
mov ebx, dword [0x141dc0bb8]
xor ebx, dword [0x141dc0bbc]
xor ebx, 0xb100031
add ebx, 0x86d2ad7a
xor ebx, 0x2c105012
call rdi
cmp ebx, 0xc2a7467e
ja 0x140017550
nop dword [rax + rax]
mov eax, dword [0x141dc0bc0]
xor edx, edx
div dword [0x141dc0bc4]
add eax, 0xe924a98d
or eax, 0x106ee5c8
imul rax, rax, 0x3a92a057
shr rax, 0x3d
cmp eax, 0x7a77ebe4
ja 0x140017580
cmp rsi, 0xffffffffffffffff
je 0x1400176c3
mov ecx, dword [0x141dc0bc8]
add ecx, dword [0x141dc0bcc]
lea rax, [rsi + 8]
imul ecx, ecx, 0xfba9ae88
add ecx, 0x1ea37390
cmp ecx, 0xc6542147
jbe 0x1400175e0
lock dec qword [rax]
nop dword [rax]
mov ecx, dword [0x141dc0bd0]
imul ecx, dword [0x141dc0bd4]
xor ecx, 0x88f58b28
shr ecx, 3
imul rdx, rcx, 0x56bcaa3
shr rdx, 0x33
xor edx, 0xa4750a28
lock dec qword [rax]
sete cl
cmp edx, 0x4b21eeea
jb 0x1400175e0
test cl, cl
je 0x1400176c3
mov eax, dword [str._A:H8]
sub eax, dword [0x141dc0bdc]
add eax, 0x7780f2df
or eax, 0xcbe493c0
xor eax, 0xb3fbcd8f
cmp eax, 0x437cc4db
jae 0x140017652
mov rcx, qword [0x141dda6a0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov eax, dword [0x141dc0be0]
xor eax, dword [0x141dc0be4]
add eax, 0xea22f4ff
xor eax, 0xa20ceb1c
imul rbx, rax, 0x7b0dfa73
shr rbx, 0x3e
mov rcx, qword [0x141dda6a0]
xor edx, edx
mov r8, rsi
call rdi
cmp ebx, 0xb6b6a37a
ja 0x140017660
nop word [rax + rax]
mov eax, dword [0x141dc0be8]
add eax, dword [0x141dc0bec]
xor eax, 0x7b10841a
imul eax, eax, 0xfd1ee519
xor eax, 0x57ac08fa
cmp eax, 0x5dcb720a
jb 0x1400176a0
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140018430
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x141dc0db0]
xor edx, edx
div dword [0x141dc0db4]
mov rdx, 0xffffffffdf6819da
sub rdx, r8
mov rax, rdx
shr rax, 6
xor rax, rdx
add rax, 0xffffffffd3868f39
nop dword [rax + rax]
mov edx, dword [0x141dc0db8]
xor edx, dword [0x141dc0dbc]
add edx, 0xf20904a1
and edx, 0x9e4d125d
imul rdx, rdx, 0x583b7fff
shr rdx, 0x3c
cmp edx, 0x7a10d6ac
je 0x140018460
mov rdx, rax
rol rdx, 4
nop word cs:[rax + rax]
mov r8d, dword [0x141dc0dc0]
or r8d, dword [str.jp_c__tR]
and r8d, 0x7cb0f61f
xor r8d, 0x87a33584
cmp r8d, 0x543dddbc
jb 0x1400184a0
xor edx, eax
movzx r8d, dx
mov eax, dword [0x141dc0dc8]
xor edx, edx
div dword [0x141dc0dcc]
add rcx, r8
nop dword [rax]
mov eax, dword [0x141dc0dd0]
xor eax, dword [0x141dc0dd4]
cmp eax, 0x14c5ca40
je 0x1400184e0
mov rax, rcx
ret

Function at 0x140018740
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
shr r8, 0xe
xor r8, rdx
mov rax, r8
rol rax, 1
xor rax, r8
nop word cs:[rax + rax]
mov edx, dword [0x141dc0e10]
add edx, dword [0x141dc0e14]
and edx, 0x18301402
xor edx, 0x80041600
or edx, 0x678b69bd
cmp edx, 0x4a5cbaf4
je 0x140018760
mov rdx, 0xffffffffefcedbe3
sub rdx, rax
mov rax, rdx
rol rax, 5
xor rax, rdx
movzx eax, ax
add rcx, rax
mov eax, dword [0x141dc0e18]
xor edx, edx
div dword [0x141dc0e1c]
add eax, 0x7cb8599a
or eax, 0xe6db386b
add eax, 0xc4f5c186
cmp eax, 0xb0c500e1
jb 0x1400187a0
mov rax, rcx
ret

Function at 0x140018870
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov r8d, 0x881f815b
xor rdx, 0xffffffff87e6ab0a
mov rcx, rdx
shr rcx, 9
nop word [rax + rax]
mov r9d, dword [0x141dc0e30]
xor r9d, dword [0x141dc0e34]
shr r9d, 1
imul r9, r8
shr r9, 0x3e
or r9d, 0x5e0991fc
cmp r9d, 0x21f65906
jb 0x140018890
xor rcx, rdx
add rcx, 0xffffffffa94a4a2f
mov rdx, rcx
rol rdx, 6
nop word [rax + rax]
mov r8d, dword [0x141dc0e38]
imul r8d, dword [0x141dc0e3c]
add r8d, 0x3461b6ca
or r8d, 0x596f85b1
xor r8d, 0xf2587174
cmp r8d, 0xf07c3ea4
ja 0x1400188d0
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x140018910
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0x673d1440
mov rax, rcx
mov rcx, rdx
rol rcx, 3
xor rcx, rdx
neg rcx
mov rdx, rcx
rol rdx, 3
nop
mov r8d, dword [0x141dc0e40]
or r8d, dword [0x141dc0e44]
xor r8d, 0x41c00043
or r8d, 0xb637ffbc
cmp r8d, 0xfff501b4
ja 0x140018930
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x140018960
Capabilities:
Encode data using xor

Disassembly:
neg rdx
xor rdx, 0xffffffffc7cde61c
mov r8, rdx
shr r8, 0x12
xor r8, rdx
add r8, 0x1b0eeb36
mov r9, r8
rol r9, 7
nop word cs:[rax + rax]
mov eax, dword [0x141dc0e48]
xor edx, edx
div dword [0x141dc0e4c]
imul eax, eax, 0x28f0e45d
add eax, 0xc99adbfb
xor eax, 0xa907d39a
cmp eax, 0xe675a9e1
ja 0x140018990
xor r9d, r8d
movzx r8d, r9w
mov eax, dword [0x141dc0e50]
xor edx, edx
div dword [0x141dc0e54]
mov eax, 0x8927087d
add rcx, r8
nop word cs:[rax + rax]
mov edx, dword [0x141dc0e58]
sub edx, dword [0x141dc0e5c]
imul edx, edx, 0xe842e9d5
or edx, 0x9ae1079d
imul rdx, rax
shr rdx, 0x3f
cmp edx, 0xe7365216
je 0x1400189e0
mov rax, rcx
ret