joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008d7e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov eax, dword [0x140219128]
mov edx, dword [0x14021912c]
not eax
not edx
or edx, eax
mov eax, edx
not eax
and eax, 0xb54be9f
xor edx, 0x74ab4160
lea eax, [rdx + rax*2]
imul rax, rax, 0x4e36b05d
shr rax, 0x3e
not eax
and eax, 0xce32140b
cmp eax, 0x613f862e
jne 0x14008d830
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
nop
mov r8d, dword [0x140219130]
imul r8d, dword [0x140219134]
add r8d, 0xa8f76c3d
xor r8d, 0xbeb1cd22
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov rdx, rsp
cmp r8d, 0xab8a59c7
jb 0x14008d830
mov eax, dword [0x140219138]
mov r8d, dword [0x14021913c]
mov r9d, eax
not r9d
and r9d, r8d
mov r10d, r8d
not r10d
and r10d, eax
imul r10d, r9d
mov r9d, eax
and r9d, r8d
or eax, r8d
imul eax, r9d
add eax, r10d
imul eax, eax, 0x5a6dc441
mov r8d, eax
not r8d
or r8d, 0x2fb2b78a
add eax, r8d
inc eax
mov r8d, eax
and r8d, 0x340a3869
add r8d, r8d
sub eax, r8d
add eax, 0xb40a3869
cmp eax, 0xa31a17a3
jae 0x14008d8d2
mov byte [rdx], cl
movzx eax, byte [rdx]
mov r8d, 0xe3a21567
nop dword [rax + rax]
mov eax, dword [0x140219140]
sub eax, dword [0x140219144]
imul rax, r8
shr rax, 0x3e
imul r9d, eax, 0x4bd5529b
mov eax, r9d
not eax
mov r10d, r9d
and r10d, 0x604fee27
and eax, 0x9fb011d8
imul eax, r10d
mov r10d, r9d
and r10d, 0x9fb011d8
or r9d, 0x9fb011d8
imul r9d, r10d
add r9d, eax
mov byte [rdx], cl
movzx eax, byte [rdx]
cmp r9d, 0x3c765050
jb 0x14008d8e0
nop dword [rax]
mov ecx, dword [0x140219148]
mov edx, dword [0x14021914c]
xor edx, ecx
not edx
and edx, ecx
add edx, 0x9cdb094e
xor edx, 0xe09b4fea
mov ecx, edx
and ecx, 0x925af0a1
or edx, 0x925af0a1
add edx, ecx
cmp edx, 0x64adef04
jb 0x14008d940
mov rsp, rbp
pop rbp
ret

Function at 0x14008d980
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x140219150]
mov r9d, dword [0x140219154]
mov r10d, eax
xor r10d, r9d
not r10d
or eax, r9d
and eax, r10d
and eax, 0xc04602
imul eax, eax, 0x23e51748
cmp eax, 0x2783d5ed
je fcn.14008d980
vmovdqa ymm0, ymmword [rdx]
mov eax, dword [0x140219158]
or eax, dword [0x14021915c]
mov edx, 0xef15c017
imul rdx, rax
shr rdx, 0x3f
lea eax, [rdx - 0x43bf73ce]
not edx
and edx, 0x40362001
imul edx, edx, 0x3895048
imul eax, eax, 0xfffffc7b
add eax, edx
cmp eax, 0xcc07322b
je 0x14008da24
mov eax, dword [0x140219160]
sub eax, dword [0x140219164]
xor eax, 0x3dc45f8c
mov edx, eax
or edx, 0x1802
and edx, 0x8a427b16
or eax, 0xca53fbde
add eax, edx
vpaddd ymm1, ymm0, ymmword [r8]
vmovdqa ymmword [rcx], ymm1
cmp eax, 0x703a9a5f
jbe 0x14008da40
vmovdqa ymm1, ymmword [r8]
vpand ymm2, ymm1, ymm0
vpaddd ymm2, ymm2, ymm2
vpxor ymm1, ymm1, ymm0
vpaddd ymm1, ymm1, ymm2
vmovdqa ymmword [rcx], ymm1
jmp 0x14008d9ee
mov eax, dword [0x140219168]
xor edx, edx
div dword [0x14021916c]
and eax, 0x8204070d
add eax, 0xaa79a083
mov ecx, eax
and ecx, 0x8e05071f
xor ecx, 0x53a0489c
and eax, 0x2258a01c
or eax, ecx
cmp eax, 0x4fdb94bf
jb 0x14008da40
vzeroupper
ret
Function at 0x14008da80
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x140219170]
xor edx, edx
div dword [0x140219174]
nop word cs:[rax + rax]
mov eax, dword [0x140219178]
imul eax, dword [0x14021917c]
imul eax, eax, 0x2b8d963c
mov edx, eax
not edx
or edx, 0xb88e39a9
add eax, edx
inc eax
and eax, 0x8225ea78
cmp eax, 0x5103f8a6
jb 0x14008daa0
vmovdqa ymm0, ymmword [r8]
vpslld ymm0, ymm0, 2
mov edx, dword [0x140219180]
mov eax, dword [0x140219184]
mov r8d, edx
xor r8d, eax
not eax
and eax, edx
add eax, eax
sub eax, r8d
mov edx, eax
not edx
mov r8d, eax
and r8d, 0x4c03638a
and edx, 0xb3fc9c75
imul edx, r8d
mov r8d, eax
and r8d, 0xb3fc9c75
or eax, 0xb3fc9c75
imul eax, r8d
add eax, edx
xor eax, 0xabac2817
mov edx, 0x8027f15d
imul rdx, rax
shr rdx, 0x3d
cmp edx, 0xadc90432
jbe 0x14008db40
vmovdqa ymmword [rcx], ymm0
nop dword [rax]
mov eax, dword [0x140219188]
add eax, dword [0x14021918c]
mov edx, eax
xor edx, 0x3c26ae5e
and eax, 0x43d951a1
add eax, eax
sub eax, edx
mov edx, 0x4f5dcdd3
sub edx, eax
add eax, 0xb0a2322c
and edx, 0x9313b9cb
mov r8d, eax
and r8d, 0x6cec4634
or r8d, edx
xor r8d, 0x1fea5ad3
and eax, 0x8cf9e318
or eax, r8d
vmovdqa ymmword [rcx], ymm0
cmp eax, 0xb95199a1
jb 0x14008db40
vzeroupper
ret

Function at 0x14008dba0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
mov edi, dword [rsp + 0x58]
mov esi, dword [rsp + 0x50]
mov r11d, dword [rsp + 0x48]
mov r10d, dword [rsp + 0x40]
mov eax, dword [rsp + 0x38]
vmovd xmm0, edi
vpinsrd xmm0, xmm0, esi, 1
vpinsrd xmm0, xmm0, r11d, 2
vpinsrd xmm0, xmm0, r10d, 3
vmovd xmm1, eax
vinsertf128 ymm0, ymm0, xmm1, 1
nop dword [rax + rax]
mov eax, dword [0x140219190]
mov r10d, dword [0x140219194]
mov r11d, eax
and r11d, r10d
xor eax, r10d
lea eax, [rax + r11*2]
and eax, 0xf712b2bc
cmp eax, 0x9f83dadc
je 0x14008dbe0
mov eax, dword [0x140219198]
or eax, dword [0x14021919c]
and eax, 0x71a3f6e6
imul eax, eax, 0x29f9740
add eax, 0x645d6697
vextractf128 xmm1, ymm0, 1
cmp eax, 0x1cdeeb0e
jb 0x14008dc9b
mov eax, dword [str.9g]
mov r10d, eax
not r10d
or r10d, dword [0x1402191a4]
add eax, r10d
inc eax
shr eax, 1
mov r10d, 0x8480a891
imul r10, rax
shr r10, 0x3e
lea eax, [r10 - 0x7aff37d8]
not r10d
and r10d, 0x4a0113
imul r10d, r10d, 0x5a813404
imul eax, eax, 0xdfcbfd3f
vpinsrd xmm2, xmm1, r9d, 1
vpinsrd xmm2, xmm2, r8d, 2
vpinsrd xmm2, xmm2, edx, 3
add eax, r10d
vinsertf128 ymm2, ymm0, xmm2, 1
vmovaps ymmword [rcx], ymm2
cmp eax, 0xda2ba98
jae 0x14008dcc0
vpinsrd xmm2, xmm1, r9d, 1
vpinsrd xmm2, xmm2, r8d, 2
vpinsrd xmm2, xmm2, edx, 3
vinsertf128 ymm2, ymm0, xmm2, 1
vmovaps ymmword [rcx], ymm2
jmp 0x14008dc2f
mov eax, dword [0x1402191a8]
and eax, dword [0x1402191ac]
add eax, 0xd58d330c
and eax, 0xa70e9c9c
imul rcx, rax, 0x23174b3b
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
cmp eax, 0xa90673a8
ja 0x14008dcc0
pop rdi
pop rsi
vzeroupper
ret
Function at 0x14008dd00
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1402191b0]
mov r9d, dword [0x1402191b4]
mov r10d, eax
not r10d
and r10d, r9d
mov r11d, r9d
not r11d
and r11d, eax
imul r11d, r10d
mov r10d, eax
and r10d, r9d
or eax, r9d
imul eax, r10d
add eax, r11d
mov r9d, eax
not r9d
and r9d, 0xa6732401
mov r10d, eax
and r10d, 0x598cdbfe
imul r10d, r9d
mov r9d, eax
and r9d, 0xa6732401
or eax, 0xa6732401
imul eax, r9d
add eax, r10d
mov r9d, eax
xor r9d, 0x2a733a94
or eax, 0xd58cc56b
and eax, r9d
mov r9d, eax
xor r9d, 0xf4c2208f
add r9d, eax
and eax, 0xb3ddf70
sub r9d, eax
cmp r9d, 0x49160716
je fcn.14008dd00
vmovaps ymm0, ymmword [r8]
vpermps ymm0, ymm0, ymmword [rdx]
nop word cs:[rax + rax]
mov eax, dword [0x1402191b8]
imul eax, dword [0x1402191bc]
lea edx, [rax + 0x7e73e56a]
not edx
or edx, 0xe73aaf79
add eax, edx
add eax, 0x15d7a12e
cmp eax, 0x5c694737
jb 0x14008ddb0
vmovaps ymmword [rcx], ymm0
vzeroupper
ret

Function at 0x14008eb40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x140219210]
xor eax, dword [0x140219214]
mov r9d, eax
not r9d
and r9d, 0xc092748b
mov r10d, eax
and r10d, 0x3f6d8b74
imul r10d, r9d
mov r9d, eax
and r9d, 0xc092748b
or eax, 0xc092748b
imul eax, r9d
add eax, r10d
mov r9d, eax
xor r9d, 0x5e7c3127
and eax, 0x2183ced8
add eax, eax
sub eax, r9d
mov r9d, eax
and r9d, 0x3a6a87a5
add r9d, r9d
sub eax, r9d
cmp eax, 0xc5828008
je fcn.14008eb40
vmovdqa ymm0, ymmword [rdx]
vpcmpeqd ymm1, ymm1, ymm1
vpxor ymm2, ymm0, ymm1
nop word cs:[rax + rax]
mov eax, dword [0x140219218]
add eax, dword [0x14021921c]
and eax, 0x8008212
mov edx, eax
not edx
lea r9d, [rax - 0x585ad6d8]
mov r10d, r9d
and r10d, 0xa810a1a
and edx, 0x4050d485
imul edx, r10d
and r9d, 0xa524a120
or eax, 0xe7f5fdad
imul eax, r9d
add eax, edx
cmp eax, 0x5da69213
ja 0x14008ebc0
vmovdqa ymm3, ymmword [r8]
vpor ymm2, ymm2, ymm3
vpxor ymm1, ymm2, ymm1
vpandn ymm2, ymm0, ymm3
vpmuludq ymm1, ymm2, ymm1
vpand ymm2, ymm0, ymm3
vpor ymm0, ymm3, ymm0
vpmuludq ymm0, ymm0, ymm2
vpaddq ymm0, ymm0, ymm1
vmovdqa ymmword [rcx], ymm0
vzeroupper
ret
Function at 0x14008ecf0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x140219230]
mov r8d, dword [0x140219234]
mov r9d, eax
xor r9d, r8d
not r8d
and r8d, eax
add r8d, r8d
sub r8d, r9d
add r8d, 0x768f42c9
cmp r8d, 0x69a3fa5f
ja fcn.14008ecf0
vbroadcastss ymm0, dword [rdx]
mov eax, dword [0x140219238]
add eax, dword [0x14021923c]
mov edx, eax
not edx
and edx, 0xe185808e
mov r8d, eax
and r8d, 0x1e7a7f71
imul r8d, edx
mov edx, eax
and edx, 0xe185808e
or eax, 0xe185808e
imul eax, edx
add eax, r8d
imul rax, rax, 0x2ce729c1
shr rax, 0x3c
add eax, 0xbbde608b
cmp eax, 0x665673d6
jb 0x14008eda0
mov eax, dword [0x140219240]
sub eax, dword [0x140219244]
imul rax, rax, 0x266af84b
shr rax, 0x3d
not eax
and eax, 0x24168969
or eax, 0x90210004
vmovaps ymmword [rcx], ymm0
cmp eax, 0x791738c7
jae 0x14008edb0
vmovaps ymmword [rcx], ymm0
jmp 0x14008ed72
mov eax, dword [0x140219248]
mov ecx, dword [0x14021924c]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
imul rax, rax, 0x3a5c7213
shr rax, 0x3d
imul eax, eax, 0x8fd5db4d
and eax, 0x78e8738
cmp eax, 0xd6e88292
je 0x14008edb0
vzeroupper
ret

Function at 0x14008ee20
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x140219250]
mov r8d, dword [0x140219254]
not eax
not r8d
and r8d, eax
mov eax, r8d
not eax
or eax, 0x7ccc80c5
or r8d, 0x83337f3a
and r8d, eax
xor r8d, 0x621fd872
imul rax, r8, 0x2ede041b
shr rax, 0x3d
cmp eax, 0xd119357f
ja fcn.14008ee20
vpermpd ymm0, ymmword [rdx], 0x42
vmovaps ymmword [rcx], ymm0
mov eax, 0xcbabc915
nop word cs:[rax + rax]
mov ecx, dword [str.E_b:V]
mov edx, dword [0x14021925c]
mov r8d, ecx
not r8d
and r8d, edx
mov r9d, edx
not r9d
and r9d, ecx
imul r9d, r8d
mov r8d, ecx
and r8d, edx
or ecx, edx
imul ecx, r8d
add ecx, r9d
mov edx, ecx
xor edx, 0xcfbf8ee4
xor ecx, 0x10000118
and ecx, 0xd12f0df8
mov r8d, edx
and r8d, 0x2ed0f207
imul r8d, ecx
mov ecx, edx
and ecx, 0xd12f0df8
or edx, 0xd12f0df8
imul edx, ecx
add edx, r8d
imul rdx, rax
shr rdx, 0x3b
cmp edx, 0x2a883400
ja 0x14008ee80
vzeroupper
ret

Function at 0x14008ef00
Capabilities:
Encode data using xor

Disassembly:
vmovaps ymm0, ymmword [rdx]
vblendps ymm0, ymm0, ymmword [r8], 3
vmovaps ymmword [rcx], ymm0
nop
mov eax, dword [0x140219260]
mov ecx, dword [0x140219264]
xor ecx, eax
not ecx
and ecx, eax
imul rax, rcx, 0x356e700b
shr rax, 0x3d
xor eax, 0x2ba1bcc3
add eax, 0xa893b1dc
cmp eax, 0x2603dbb7
jb 0x14008ef10
vzeroupper
ret
Function at 0x140094640
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x140219598]
mov r9d, dword [0x14021959c]
mov r10d, r9d
not r10d
mov r11d, eax
and r11d, r10d
or r10d, eax
not r10d
imul r10d, r11d
mov r11d, eax
and r11d, r9d
or eax, r9d
imul eax, r11d
add eax, r10d
mov r9d, eax
not r9d
mov r10d, eax
and r10d, 0x4a9eb4a6
and r9d, 0xb5614b59
imul r9d, r10d
mov r10d, eax
and r10d, 0xb5614b59
or eax, 0xb5614b59
imul eax, r10d
add eax, r9d
xor eax, 0x8201021c
or eax, 0x2d86e460
cmp eax, 0x5d3bb03a
ja fcn.140094640
vmovdqa ymm0, ymmword [rdx]
vpsrlvq ymm0, ymm0, ymmword [r8]
vmovdqa ymmword [rcx], ymm0
vzeroupper
ret

Function at 0x1400946d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xe4929401
nop word cs:[rax + rax]
mov r8d, dword [0x1402195a0]
sub r8d, dword [0x1402195a4]
imul r8, rax
shr r8, 0x3e
lea r9d, [r8 - 0x32a5d979]
mov r10d, r9d
and r10d, 0xc5500485
xor r9d, 0x1aae630a
add r8d, r9d
add r8d, 0xcd5a2687
sub r8d, r10d
cmp r8d, 0x5b051b6
je 0x1400946e0
vmovdqa ymm0, ymmword [rdx]
mov eax, 0x90793c3f
vpsrlq ymm0, ymm0, 0x1a
nop word cs:[rax + rax]
mov edx, dword [0x1402195a8]
or edx, dword [0x1402195ac]
mov r8, rdx
imul r8, rax
shr r8, 0x20
sub edx, r8d
shr edx, 1
add edx, r8d
shr edx, 0x1d
cmp edx, 0x239a1e
je 0x140094740
mov eax, dword [0x1402195b0]
and eax, dword [0x1402195b4]
add eax, 0xea4d9036
cmp eax, 0xafdbe5da
ja 0x1400947bd
mov eax, dword [0x1402195bc]
add eax, dword [0x1402195b8]
imul rax, rax, 0xdef8681
shr rax, 0x3b
lea edx, [rax + 0x1a22d6]
imul edx, edx, 0x17444000
or eax, 0x7fff72f6
imul eax, eax, 0x68a11020
add eax, edx
vmovdqa ymmword [rcx], ymm0
cmp eax, 0xaab96d19
jbe 0x1400947c3
vmovdqa ymmword [rcx], ymm0
jmp 0x140094782
vzeroupper
ret
Function at 0x14009dae0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov eax, dword [0x14021af90]
mov ecx, dword [0x14021af94]
mov edx, eax
and edx, ecx
xor eax, ecx
lea eax, [rax + rdx*2]
add eax, 0xf6ca9ad7
mov ecx, 0xbec8a80f
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0x38241131
ja 0x14009db57
mov eax, dword [0x14021af98]
mov ecx, dword [0x14021af9c]
mov edx, eax
and edx, ecx
or eax, ecx
add eax, edx
mov ecx, 0x80fa4d63
imul rcx, rax
shr rcx, 0x3e
imul eax, ecx, 0x69acec5c
add eax, 0xfe28c9d0
mov qword [rsp + 0x28], 0
cmp eax, 0x50f55400
jae 0x14009db62
mov qword [rsp + 0x28], 0
jmp 0x14009db1b
mov eax, dword [0x14021afa0]
and eax, dword [0x14021afa4]
add eax, 0x722bf45c
mov ecx, eax
or ecx, 0x70b09537
xor ecx, 0xd08a68e1
or eax, 0x2f75971e
and eax, ecx
cmp eax, 0x7acf80c0
jne 0x14009dba0
mov eax, dword [0x14022cab8]
nop word cs:[rax + rax]
mov eax, dword [0x14021afa8]
add eax, dword [0x14021afac]
mov ecx, eax
and ecx, 0x51728c5d
xor eax, 0x51728c5d
lea eax, [rax + rcx*2]
mov ecx, eax
not ecx
and ecx, 0x98cf0eff
mov edx, eax
and edx, 0x6730f100
imul edx, ecx
mov ecx, eax
and ecx, 0x98cf0eff
or eax, 0x98cf0eff
imul eax, ecx
lea ecx, [rax + rdx]
adc byte [rcx + 0x98172c1], al
fisttp word [rbx + 0x18eec805]
add byte [rcx - 0x58de7107], al
xor byte [rdx - 0x58], dh
Function at 0x1400ab250
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov r8, qword [rcx]
nop
mov eax, dword [0x14021c728]
xor edx, edx
div dword [0x14021c72c]
xor eax, 0x64a15010
or eax, 0x10ead4b
mov ecx, eax
and ecx, 0x19845ad7
add ecx, ecx
neg ecx
add eax, ecx
add eax, 0x19845ad7
cmp eax, 0x51c67dc9
jb 0x1400ab260
cmp r8d, 3
jne 0x1400ab470
test esp, edx
add dword [rax], eax
invalid
add rsi, 8
mov eax, dword [0x14021c730]
mov ecx, dword [0x14021c734]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
imul eax, eax, 0xfa3cd9dc
imul rax, rax, 0x63ec06c3
shr rax, 0x3a
and eax, 0xfffffff7
cmp eax, 0x3228ade
ja 0x1400ab2a0
mov eax, dword [0x14021c738]
xor edx, edx
div dword [0x14021c73c]
mov ecx, eax
not ecx
or ecx, 0xd8a3900a
add eax, ecx
inc eax
mov ecx, eax
and ecx, 0x88803cb3
or eax, 0x88803cb3
add eax, ecx
cmp eax, 0x12219e5f
jne 0x1400ab320
mov rax, qword [rsi]
lock dec qword [rax]
nop
mov eax, dword [0x14021c740]
or eax, dword [0x14021c744]
mov ecx, eax
xor ecx, 0x166ff92c
and eax, 0x699006d3
add eax, eax
sub eax, ecx
imul ecx, eax, 0x894af3b0
xor ecx, 0xf0bf11f7
mov rax, qword [rsi]
lock dec qword [rax]
sete al
cmp ecx, 0xe8c12366
ja 0x1400ab320
test al, al
je 0x1400ab950
mov eax, dword [0x14021c748]
mov ecx, dword [0x14021c74c]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
imul rcx, rax, 0x9c2fd31
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
imul eax, eax, 0x4bcb2789
or eax, 0xe801a6db
cmp eax, 0x5d484d2f
jne 0x1400ab3b4
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400ab3c0
mov eax, dword [0x14021c750]
mov ecx, dword [0x14021c754]
add eax, ecx
add eax, 0x731006ba
mov ecx, eax
and ecx, 0x657bdee5
mov edx, ecx
not edx
and edx, 0xd3e18834
mov r8d, eax
and r8d, 0x241a56c1
imul r8d, edx
and eax, 0x41618824
or ecx, 0xd3e18834
imul ecx, eax
add ecx, r8d
cmp ecx, 0x831c243c
jae 0x1400ab420
mov rcx, rsi
call fcn.1401501d0
nop dword [rax + rax]
mov eax, dword [0x14021c758]
sub eax, dword [0x14021c75c]
mov ecx, eax
not ecx
or ecx, 0x87a4659d
and eax, 0x38018a40
xor ecx, 0x46de153e
lea eax, [rcx + rax*2]
mov edi, eax
xor edi, 0xa451c5f9
add edi, eax
and eax, 0x592e3a02
sub edi, eax
mov rcx, rsi
call fcn.140098330
cmp edi, 0xfbe27f0c
jae 0x1400ab420
jmp 0x1400ab950
Function at 0x1400b2630
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov r8, rdx
mov eax, dword [0x14021d950]
xor eax, dword [0x14021d954]
add eax, 0xf615d7d1
mov edx, eax
or edx, 0xbc7a0534
mov r9d, eax
not r9d
and r9d, 0x41041849
mov r10d, edx
and r10d, 0x3e99e3b2
imul r10d, r9d
and edx, 0xc1661c4d
or eax, 0xfd7e1d7d
imul eax, edx
add eax, r10d
cmp eax, 0xd50b5f91
ja 0x1400b26a0
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov rsi, rsp
mov qword [rsi], rcx
xor eax, eax
test al, al
je 0x1400b26b5
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov rax, rsp
mov qword [rax], rcx
jmp 0x1400b2687
mov qword [rsi + 8], 0
sub rsp, 0x20
lea rdx, [0x140206f70]
mov rcx, rsi
call fcn.14006d6c0
add rsp, 0x20
mov rdi, qword [rsi + 8]
test al, al
je 0x1400b2810
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400b26f0
test rdi, rdi
jne 0x1400b2cb0
mov eax, dword [0x14021d9e8]
add eax, dword [0x14021d9ec]
mov ecx, eax
xor ecx, 0xfd67fcdd
add ecx, eax
and eax, 0x2980322
sub ecx, eax
mov eax, ecx
not eax
or eax, 0x30508040
and eax, 0x35d09141
mov edx, ecx
and edx, 0x4a044a02
or edx, eax
xor edx, 0x3cd5db2b
and ecx, 0x9044a02
or ecx, edx
cmp ecx, 0xec14c855
jbe 0x1400b274a
ud2
mov eax, 0xef23e583
nop
mov edx, dword [0x14021d9f0]
mov r8d, dword [0x14021d9f4]
mov ecx, edx
not ecx
mov r9d, r8d
not r9d
mov r10d, ecx
and r10d, 0xcd418fed
and edx, 0x32be7012
or edx, r10d
or ecx, r9d
and r9d, 0xcd418fed
and r8d, 0x32be7012
or r8d, r9d
xor r8d, edx
not ecx
or ecx, r8d
imul rcx, rax
shr rcx, 0x3e
and ecx, 0xfffffffe
imul ecx, ecx, 0x52235dec
ud2
mov eax, dword [0x14021d958]
mov ecx, dword [0x14021d95c]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
imul eax, eax, 0xacc918be
mov ecx, eax
xor ecx, 0x645ed1e9
and eax, 0x1ba12e16
add eax, eax
sub eax, ecx
or eax, 0x4f0e2dad
cmp eax, 0x6dae9c8
jb 0x1400b2810
test rdi, rdi
je 0x1400b2967
nop word [rax + rax]
mov eax, dword [0x14021d960]
sub eax, dword [0x14021d964]
mov ecx, eax
or ecx, 0xcb0a454a
mov edx, ecx
not edx
mov r8d, ecx
and r8d, 0x9961ce4
and edx, 0x7669e31b
imul edx, r8d
and ecx, 0x7669e31b
or eax, 0xff6be75b
imul eax, ecx
add eax, edx
and eax, 0x691d51d4
cmp eax, 0x70a3e488
ja 0x1400b2870
nop dword [rax + rax]
mov eax, dword [0x14021d968]
imul eax, dword [0x14021d96c]
xor eax, 0x800080b0
or eax, 0x2e93770f
cmp eax, 0xa978d66c
je 0x1400b28c0
mov eax, edi
and eax, 3
lea rcx, [0x14020810c]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
xor edi, edi
jmp 0x1400b2cb0
Function at 0x1400b5110
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov r14, rcx
nop dword [rax]
mov eax, dword [0x14021dd70]
add eax, dword [0x14021dd74]
xor eax, 0x8804205
mov ecx, eax
and ecx, 0x68b0c205
mov edx, ecx
not edx
mov r8d, eax
and r8d, 0x6090c200
and edx, 0x92d3127
imul edx, r8d
and eax, 0x8200005
or ecx, 0x92d3127
imul ecx, eax
add ecx, edx
cmp ecx, 0x452cebc2
ja 0x1400b5130
nop dword [rax]
mov eax, dword [0x14021dd78]
mov ecx, dword [0x14021dd7c]
add eax, ecx
add eax, 0xa8204d0a
xor eax, 0x23d6484a
add eax, 0x23eadec2
cmp eax, 0xdf81c2c1
jb 0x1400b5180
test rsi, rsi
je 0x1400b60aa
mov r15d, 0xa41025e9
xor ebp, ebp
mov r13d, 0xbe29b385
mov r12d, 0xe1204875
mov qword [rsp + 0x20], r14
jmp 0x1400b51d9
Function at 0x1400b73a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
test dl, dl
je 0x1400b7444
mov eax, dword [0x14021e180]
xor edx, edx
div dword [0x14021e184]
mov edx, eax
and edx, 0xccc54777
mov r8d, edx
not r8d
mov r9d, eax
and r9d, 0x88810225
and r8d, 0x757455da
imul r8d, r9d
and eax, 0x44444552
or edx, 0x757455da
imul edx, eax
add edx, r8d
or edx, 0x550597a1
cmp edx, 0x3787bf4f
jae 0x1400b7400
mov byte [rcx + 0x10], 1
mov eax, dword [0x14021e188]
xor eax, dword [0x14021e18c]
mov edx, eax
not edx
or edx, 0x2800a281
and edx, 0x6840fb93
and eax, 0x100006c
or eax, edx
mov edx, eax
xor edx, 0x48a0112
and edx, 0x258a3917
xor eax, 0x63313e0d
lea eax, [rax + rdx*2]
mov byte [rcx + 0x10], 1
cmp eax, 0xb2170fcc
je 0x1400b7400
lea rax, [rcx + 8]
nop dword [rax + rax]
mov edx, dword [0x14021e168]
xor edx, dword [0x14021e16c]
or edx, 0x9743ac80
add edx, 0x50d71b31
mov r8d, edx
not r8d
mov r9d, edx
and r9d, 0xc07a89a8
and r8d, 0x3d857657
imul r8d, r9d
mov r9d, edx
and r9d, 0x38855657
or edx, 0x3d857657
imul edx, r9d
add edx, r8d
cmp edx, 0x5d57fff7
ja 0x1400b7450
mov edx, dword [0x14021e170]
mov r8d, dword [0x14021e174]
mov r9d, edx
not r9d
and r9d, r8d
mov r10d, r8d
not r10d
and r10d, edx
imul r10d, r9d
mov r9d, edx
and r9d, r8d
or edx, r8d
imul edx, r9d
add edx, r10d
mov r8d, edx
and r8d, 0x918ae22d
xor r8d, 0x81084028
and edx, 0x81084028
or edx, r8d
xor edx, 0xe6783e72
cmp edx, 0xf73d07dc
je 0x1400b755a
mov r8d, dword [0x14021e178]
xor r8d, dword [0x14021e17c]
mov edx, r8d
not edx
mov r9d, r8d
or r9d, 0x86bf3bf8
mov r10d, r9d
and r10d, 0x856dc9d7
and edx, 0x78000400
imul edx, r10d
and r9d, 0x7a923628
or r8d, 0xfebf3ff8
imul r8d, r9d
add r8d, edx
xor r8d, 0x47ae2b96
lock dec qword [rax]
sete dl
cmp r8d, 0x6bd2ff8d
jbe 0x1400b7560
lock dec qword [rax]
jmp 0x1400b74fd
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400b7570
test dl, dl
je 0x1400b7620
nop dword [rax]
mov eax, dword [0x14021e190]
xor edx, edx
div dword [0x14021e194]
xor eax, 0x9cc56b14
add eax, 0xde98b904
mov edx, eax
and edx, 0x5eabe6d1
or eax, 0x5eabe6d1
add eax, edx
cmp eax, 0xac2f0a65
jb 0x1400b7580
mov rcx, qword [rcx]
mov al, 1
xchg byte [rcx + 0x30], al
add rcx, 0x30
nop word [rax + rax]
mov edx, dword [0x14021e198]
mov r8d, dword [0x14021e19c]
mov r9d, edx
xor r9d, r8d
not r9d
and r9d, r8d
add r9d, r9d
sub r8d, r9d
add edx, r8d
add edx, 0x36eb9d5f
and edx, 0x8880d086
cmp edx, 0xc4cafa01
ja 0x1400b75c0
cmp al, 0xff
jne 0x1400b7620
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400b7610
nop word cs:[rax + rax]
mov eax, dword [0x14021e1a0]
mov ecx, dword [0x14021e1a4]
not ecx
not eax
mov edx, eax
or edx, ecx
and eax, ecx
not eax
and eax, edx
mov ecx, eax
and ecx, 0xef318d35
or eax, 0xef318d35
add eax, ecx
mov ecx, eax
and ecx, 0xdeb920d7
or eax, 0xdeb920d7
add eax, ecx
add eax, 0xcf12afbb
cmp eax, 0xf5f24a4b
ja 0x1400b7620
add rsp, 0x28
ret
Function at 0x1400b7670
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rsi
push rdi
mov rbp, rsp
mov eax, dword [0x14021e1a8]
xor eax, dword [0x14021e1ac]
shr eax, 3
imul rax, rax, 0x34a44ad
shr rax, 0x33
add eax, 0x19974832
mov ecx, eax
and ecx, 0x964826
xor eax, 0x46d6eb26
lea eax, [rax + rcx*2]
cmp eax, 0x7db8863b
je 0x1400b7715
mov edi, dword [0x14021e1b0]
sub edi, dword [0x14021e1b4]
mov eax, edi
not eax
and eax, 0x41eaca31
mov ecx, edi
and ecx, 0xbe1535ce
imul ecx, eax
mov eax, edi
and eax, 0x41eaca31
or edi, 0x41eaca31
imul edi, eax
add edi, ecx
mov eax, 0x30
call fcn.1401516e0
sub rsp, rax
mov rsi, rsp
xorps xmm0, xmm0
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
sub rsp, 0x20
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
add rsp, 0x20
cmp edi, 0x4a22b764
jne 0x1400b7746
mov eax, 0x30
call fcn.1401516e0
sub rsp, rax
mov rcx, rsp
xorps xmm0, xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx], xmm0
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
add rsp, 0x20
jmp 0x1400b76ac
mov ecx, dword [rsi + 0x20]
xor eax, eax
test rcx, rcx
sete al
lea rdx, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
cmovne rdx, rcx
mov rsp, rbp
pop rdi
pop rsi
pop rbp
ret