joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140084ae0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rdi, qword [rcx + 0x28]
mov eax, dword [0x141ddb9bc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x98]
nop dword [rax + rax]
mov ecx, dword [0x141dce230]
xor ecx, dword [0x141dce234]
or ecx, 0x7ffffe6c
imul rcx, rcx, 0x4d3e366d
shr rcx, 0x3e
cmp ecx, 0xe7f55d0c
ja 0x140084b10
test rax, rax
je 0x140084b76
cmp eax, 1
je 0x140084bc0
mov eax, dword [0x141dce248]
imul eax, dword [0x141dce24c]
imul rax, rax, 0x25079959
shr rax, 0x3d
imul eax, eax, 0xc4ccb878
add eax, 0xd8958acb
cmp eax, 0xf7137d5f
jbe 0x140084ced
jmp 0x140084cfa
mov eax, dword [0x141dce238]
mov ecx, dword [0x141dce23c]
add eax, ecx
add eax, 0x6de4224f
cmp eax, 0xaa38ce3
jb 0x140084c84
mov eax, dword [0x141dce240]
add eax, dword [0x141dce244]
xor eax, 0x252abcef
imul ebx, eax, 0x2e3dee63
add ebx, 0xf2542b21
call fcn.1400fb120
cmp ebx, 0xe137cc43
ja 0x140084b94
nop
mov eax, dword [0x141dce260]
sub eax, dword [0x141dce264]
or eax, 0xab3f7460
add eax, 0x70841835
xor eax, 0xecf1d76b
cmp eax, 0xc21dd2d3
ja 0x140084bc0
nop word cs:[rax + rax]
mov eax, dword [0x141dce268]
imul eax, dword [0x141dce26c]
add eax, 0x329093fa
xor eax, 0x12006101
and eax, 0x12946179
cmp eax, 0x339cfa93
ja 0x140084bf0
mov eax, dword [0x141ddb9bc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x90]
nop dword [rax]
mov ecx, dword [0x141dce270]
and ecx, dword [str.QNG]
add ecx, 0xdf6c4e55
or ecx, 0x73f0dfa3
xor ecx, 0x6699b06b
cmp ecx, 0x355606a5
jb 0x140084c30
test rax, rax
jne 0x140084c8e
mov eax, dword [0x141ddb9bc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x90], rsi
mov qword [rax + 0x88], rdi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
call fcn.1400fb120
jmp 0x140084b94
mov dword [rsp + 0x28], 0
mov byte [rsp + 0x2c], 0
lea rax, [0x141db9238]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x50], 0
mov eax, dword [0x141dce278]
and eax, dword [0x141dce27c]
add eax, 0xd47155cb
or eax, 0xf4dd4b2b
mov ecx, 0xaffafd5d
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x27fb2420
jne 0x140084d85
jmp 0x140084dad
lock dec qword [rsi]
sete al
xor ecx, ecx
test cl, cl
je 0x140084d00
lock dec qword [rsi]
jmp 0x140084ced
test al, al
je 0x140084d4f
mov eax, dword [0x141dce250]
and eax, dword [0x141dce254]
imul eax, eax, 0x78ffd267
cmp eax, 0xd9aa91f8
je 0x140084d45
mov edi, dword [0x141dce258]
add edi, dword [0x141dce25c]
xor edi, 0x71fe012d
add edi, 0xc42fb869
mov rcx, rsi
call fcn.140075ce0
cmp edi, 0x34fe5e27
jbe 0x140084d4f
mov rcx, rsi
call fcn.140075ce0
jmp 0x140084d1d
ud2
lea rax, [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.140087f00
xor ecx, ecx
test cl, cl
je 0x140084dd1
lea rax, [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.140087f00
jmp 0x140084d85
mov rcx, rax
call fcn.140088360
mov ecx, 7
int 0x29
ud2
Function at 0x140087f00
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
mov rbp, rsp
mov rsi, rdx

Function at 0x140088360
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
test rcx, rcx
je case.0x140088386.0
mov rsi, rcx
mov eax, esi
and eax, 3
mov rdi, qword [rsi - 1]
mov rbx, qword [rsi + 7]
mov rax, qword [rbx]
test rax, rax
je 0x1400883b8
mov rcx, rdi
call rax
nop dword [rax]
mov eax, dword [0x141dcec30]
add eax, dword [0x141dcec34]
and eax, 0x3b08310e
cmp eax, 0x9ecdf977
je 0x1400883a0
dec rsi
mov rax, qword [rbx + 8]
mov rcx, qword [rbx + 0x10]
nop word cs:[rax + rax]
xchg r13, rax
out dx, al
sbb ecx, dword [rdi]
add byte [rax], al
add byte [rbx - 0x2b9c7deb], cl
add dword [rbx], eax
adc eax, 0x1d46380
invalid
invalid
ja 0x14008897d
je 0x140088a13
loopne 0x1400889e9
cmp eax, 3
add al, 0x1e
pop rbp
ror byte [r15 - 0x6f5371db], 1
add al, 0x3d
invalid
pop word [rdi - 0x76]
invalid
or eax, 0x1d522cb
push rsp
invalid
invalid
in eax, dx
pop rdi
invalid
Function at 0x14008b490
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
test dl, dl
je 0x14008b4b0
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x14008b4a0
mov byte [rcx + 0x10], 1
nop dword [rax + rax]
mov eax, dword [0x141dcf2b8]
add eax, dword [0x141dcf2bc]
imul eax, eax, 0x8b60fbab
add eax, 0x8fa75d67
xor eax, 0x79d22bf
cmp eax, 0xa6906d2b
ja 0x14008b4b0
mov eax, dword [0x141dcf2c0]
xor eax, dword [str.x_:3]
add eax, 0xff2a14c3
and eax, 0x7e03ebc2
imul rdx, rax, 0x5045e541
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
cmp eax, 0x484704f2
jbe 0x14008b510
lock dec qword [rcx + 8]
nop dword [rax]
mov eax, dword [0x141dcf2c8]
sub eax, dword [0x141dcf2cc]
imul eax, eax, 0x1747861d
imul rdx, rax, 0x1fb037b7
shr rdx, 0x3c
add edx, 0x703a0fad
mov rax, 0xffffffffffffffff
lock xadd qword [rcx + 8], rax
cmp edx, 0xfd4ee16
jb 0x14008b510
nop dword [rax + rax]
mov edx, dword [0x141dcf2d0]
mov r8d, dword [0x141dcf2d4]
add edx, r8d
add edx, 0xf765f354
cmp edx, 0x117097c
jb 0x14008b550
cmp rax, 1
jne 0x14008b5e0
mov rcx, qword [rcx]
mov al, 1
xchg byte [rcx + 0x30], al
add rcx, 0x30
mov edx, dword [0x141dcf2d8]
and edx, dword [0x141dcf2dc]
or edx, 0x75346018
and edx, 0xfdb4609b
cmp edx, 0xc9358c1b
jb 0x14008b580
cmp al, 0xff
jne 0x14008b5e0
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
nop word [rax + rax]
mov eax, dword [0x141dcf2e0]
or eax, dword [0x141dcf2e4]
imul eax, eax, 0x7bc4929c
add eax, 0xb283d410
and eax, 0x602ff688
cmp eax, 0xd9acc19c
je 0x14008b5b0
nop word cs:[rax + rax]
mov eax, dword [0x141dcf2e8]
or eax, dword [0x141dcf2ec]
xor eax, 0xc0810506
and eax, 0xf8872dd7
cmp eax, 0xe2089665
jb 0x14008b5e0
add rsp, 0x28
ret
Function at 0x14008b950
Capabilities:
Encode data using xor
Get system information on windows

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
movaps xmmword [rbp - 0x10], xmm6
mov eax, dword [0x141dcf350]
xor edx, edx
div dword [0x141dcf354]
imul eax, eax, 0x3d4682c5
cmp eax, 0x815e9f35
jne 0x14008b990
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
nop dword [rax]
mov eax, dword [0x141dcf358]
add eax, dword [0x141dcf35c]
or eax, 0xacdf795b
imul ecx, eax, 0x10cbe8c
and ecx, 0xd4ee85b0
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
mov rsi, rsp
cmp ecx, 0xce79934b
je 0x14008b990
mov eax, dword [0x141dcf360]
sub eax, dword [0x141dcf364]
or eax, 0xf897866d
mov ecx, 0xc71b2ef5
imul rcx, rax
shr rcx, 0x3f
imul eax, ecx, 0xd57ed0c0
cmp eax, 0x66ba04be
jae 0x14008ba0f
xorps xmm0, xmm0
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
sub rsp, 0x20
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
add rsp, 0x20
xorps xmm6, xmm6
mov rdi, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop dword [rax]
mov eax, dword [0x141dcf368]
add eax, dword [0x141dcf36c]
xor eax, 0x11924900
and eax, 0x31924b5c
imul rbx, rax, 0x68bd077
shr rbx, 0x38
movups xmmword [rsi + 0x20], xmm6
movups xmmword [rsi + 0x10], xmm6
movups xmmword [rsi], xmm6
sub rsp, 0x20
mov rcx, rsi
call rdi
add rsp, 0x20
cmp ebx, 0x6f65f519
je 0x14008ba20
mov ecx, dword [rsi + 0x20]
xor eax, eax
test rcx, rcx
sete al
lea rdx, [0x141db9788]
cmovne rdx, rcx
movaps xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008e4f0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
movzx ecx, byte [rcx]
lea eax, [rcx - 6]
movzx r8d, al

Function at 0x14008ecb0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
mov r8, rdx
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x14008ecc0
movzx r11d, byte [r8 + 0x38]
movzx eax, byte [r8 + 0x3a]
test al, al
setne r9b
cmp r11b, 1
ja 0x14008eda0
test al, al
jne 0x14008edc0
movzx r10d, byte [r8 + 0x10]
lea eax, [r10 - 5]
nop
mov edx, dword [str._abQ3]
sub edx, dword [0x141dcfa84]
xor edx, 0x4e81ab28
imul edx, edx, 0xe098c2fa
cmp edx, 0x5cf67fb7
jb 0x14008ecf0
cmp al, 1
ja 0x14008edc0
mov eax, dword [0x141dcfa88]
xor edx, edx
div dword [0x141dcfa8c]
nop word cs:[rax + rax]
nop dword [rax + rax]
xor r9d, r9d
xor r10d, r10d
jmp 0x14008eded

Function at 0x14008f4d0
Capabilities:
Encode data using base64
Encode data using xor
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x498
mov rsi, r8
mov r14, rdx
mov r15, rcx
mov eax, dword [0x141dcfc10]
xor edx, edx
div dword [0x141dcfc14]
imul rax, rax, 0x220a45f7
shr rax, 0x3a
imul eax, eax, 0xc4bfa835
add eax, 0x7d26eac1
cmp eax, 0x41df89ce
jae 0x14008f52a
lea rcx, [rsp + 0x98]
mov rdx, r14
mov r8, rsi
call fcn.140090320
lea rbx, [rsp + 0x98]
nop word cs:[rax + rax]
add byte [rax], al
add byte [rax], al
Function at 0x140092b90
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rbx, rdx
mov rsi, rcx
xor eax, eax
test al, al
je 0x140092bd0
mov eax, 0x10

Function at 0x1400930a0
Capabilities:
Encode data using xor

Disassembly:
mov r8b, 1
cmp ecx, 0x3e2
stc
loop 0x1400930aa
add byte [rax], al
Function at 0x140097680
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x140097854

Function at 0x140097870
Capabilities:
Create directory
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r8, rdx
mov rdx, rcx
movabs rdi, 0x8000000000000000
lea rcx, [rsp + 0x20]

Function at 0x140097b20
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
and al, 0x40
mov rsi, rdx
mov eax, dword [0x141dd0c48]
add dword [rbx], esi
add eax, 0x1d39108
mov rdi, rcx
xor eax, 0xbf9a38f8
imul eax, eax, 0xa1906c0a
cmp eax, 0x8d5409cf
jae case.0x1400029e1.967
mov eax, 0x70
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x40
add al, ch
cmp al, 0x78
add eax, 0xc4294800
mov eax, 0x40
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x40
call fcn.1400ef3b0
sub rsp, rax
invalid
mov eax, 0x40
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x40
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
mov rcx, rsp
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
sub rsp, 0x20
sub esp, 0x20
mov rdx, rdi
mov r8, rsi
call fcn.14008c3d0
add rsp, 0x20
mov qword [rbp - 0x20], rsi
mov qword [rbp], rdi

Function at 0x1400993e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsp
Function at 0x14009a290
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
mov rsi, rdx
mov rdi, rcx
lea rcx, [rsp + 0x30]
mov rdx, rdi
mov r8, rsi
call fcn.14008c3d0
movzx eax, byte [rsp + 0x30]
cmp rax, 6
ja case.default.0x14009a2e6
mov rcx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
push rax
add rcx, 4
nop dword [rax]
mov eax, dword [0x141dd1150]
xor eax, dword [0x141dd1154]
add eax, 0xf734d1b2
or eax, 0x8316c03a
cmp al, al
invalid
cmp dword [0x189ebb73e], 0x74
invalid
jmp 0x14009a499
mov eax, dword [0x141dd1188]
or eax, dword [0x141dd118c]
and eax, 0xa0001b
xor eax, 0x2614432
or eax, 0x6d0eb804
cmp eax, 0x776ca76f
ja case.0x14009a2e6.5
mov ecx, 2
jmp 0x14009a499
mov eax, dword [0x141dd1148]
and eax, dword [str.Oo_n]
imul eax, eax, 0xaa11f008
xor eax, 0x8ef7d3cf
cmp eax, 0xd9f7a9b4
jb case.default.0x14009a2e6
jmp 0x14009ba24
add rcx, 4
nop word [rax + rax]
add rcx, 8
nop dword [rax]
mov eax, dword [0x141dd1158]
xor edx, edx
div dword [0x141dd115c]
add eax, 0x4c643bc0
or eax, 0x1899a38
cmp eax, 0xde559084
ja 0x14009a3b0
lea rax, [r8 + 1]
test r8, r8
cmove rax, r8
add rcx, rax
nop dword [rax]
mov eax, dword [0x141dd1160]
and eax, dword [0x141dd1164]
and eax, 0x4ddf613d
imul eax, eax, 0x29d0fea8
or eax, 0xabf08569
cmp eax, 0xa6366780
jb 0x14009a3e0
jmp 0x14009a499
mov ecx, 6
jmp 0x14009a499
add rcx, 2
nop word cs:[rax + rax]
mov eax, dword [0x141dd1170]
or eax, dword [0x141dd1174]
imul eax, eax, 0xabbe21b7
cmp eax, 0x2df093fe
je 0x14009a420
mov eax, dword [0x141dd1178]
xor r9d, r9d
xor edx, edx
div dword [0x141dd117c]
lea rax, [r8 + 1]
nop
test r9b, r9b
jne 0x14009a450
nop word cs:[rax + rax]

Function at 0x14009bab0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rdi, rdx
mov rbx, rcx
mov eax, dword [0x141dd1460]
imul eax, dword [0x141dd1464]
and eax, 0xf3c29bc4
imul eax, eax, 0xbdc98df8
leave
mov ebp, 0x1f6fc535
jo 0x14009bb1d
jle 0x14009baa5
invalid
sahf
jae 0x14009bb00
mov eax, 0x60
Function at 0x14009ca80
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov r10, r8
mov r11, rdx
mov qword [rbp], rcx
mov eax, dword [0x141dd1690]
or eax, dword [str.WOkU]
or eax, 0x64792603
imul eax, eax, 0xff62e50a
add eax, 0x7b38774c
movabs rcx, 0x700000000
cmp eax, 0x84d28e26
jae 0x14009cb3d
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x20
add byte [rax], al
add al, ch
int 0x28
add eax, 0xc4294800

Function at 0x14009d500
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rax, qword [rcx]
mov rbx, qword [rax]
nop word cs:[rax + rax]
mov eax, dword [0x141dd17c8]
sub eax, dword [0x141dd17cc]
imul eax, eax, 0x78006a0b
add eax, 0x46cc794a
cmp eax, 0xe349decf
ja 0x14009d520
mov rax, qword [rbx + 0x10]
xor ecx, ecx
nop word cs:[rax + rax]
add byte [rax], al
add byte [rax], al
invalid
test cl, cl
jne 0x14009d550
test rax, rax
jne 0x14009db35
mov qword [rbx + 0x10], 0xffffffffffffffff
lea rcx, [rbx + 0x18]
call case.0x1400029e1.462
test rax, rax
je 0x14009d640
ud2

Function at 0x14009e090
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
nop dword [rax + rax]
mov eax, dword [0x141dd1a18]
xor eax, dword [0x141dd1a1c]
and eax, 0x4b520df8
imul eax, eax, 0x44a7855e
cmp eax, 0x404fb801
je 0x14009e0a0
mov rax, qword [rsi + 0x18]
nop word cs:[rax + rax]
mov ecx, dword [0x141dd1a20]
or ecx, dword [0x141dd1a24]
xor ecx, 0x4600
and ecx, 0x80c622
cmp ecx, 0x1ca7da20
je 0x14009e0d0
mov ecx, dword [0x141dd1a28]
xor ecx, dword [0x141dd1a2c]
imul ecx, ecx, 0x91574911
add ecx, 0xa4f49081
cmp ecx, 0x524587c6
jb 0x14009e0f0
test rax, rax
je 0x14009e15b
mov eax, 0x8dcb36cd
nop word [rax + rax]
mov ecx, dword [0x141dd1a30]
and ecx, dword [0x141dd1a34]
imul ecx, ecx, 0x1198f353
imul rcx, rax
shr rcx, 0x3f
or ecx, 0x2ac641ae
cmp ecx, 0x90c889c7
ja 0x14009e120
mov r8, qword [rsi + 0x20]
mov rcx, qword [0x141ddb9a0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp rsi, 0xffffffffffffffff
je 0x14009e23a
lea rcx, [rsi + 8]
mov eax, dword [0x141dd1a38]
xor edx, edx
div dword [0x141dd1a3c]
shr eax, 1
imul rax, rax, 0x52abc3c3
shr rax, 0x37
imul eax, eax, 0x388a42b4
cmp eax, 0x30ae8856
je 0x14009e1b8
mov edx, dword [0x141dd1a40]
and edx, dword [0x141dd1a44]
xor edx, 0x204000a0
or edx, 0xdfb7ff5f
lock dec qword [rcx]
sete al
cmp edx, 0xf4dc9257
jne 0x14009e1be
lock dec qword [rcx]
jmp 0x14009e191
test al, al
je 0x14009e23a
mov eax, dword [0x141dd1a48]
imul eax, dword [0x141dd1a4c]
mov ecx, 0xbdfff3e9
imul rcx, rax
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x18
imul eax, eax, 0x8db97a8f
cmp eax, 0xd53d95d9
jne 0x14009e200
mov rax, qword [0x141ddb9a0]
nop dword [rax]
mov eax, dword [0x141dd1a50]
add eax, dword [0x141dd1a54]
or eax, 0x645895d3
add eax, 0x48747cde
or eax, 0x2ff951b5
mov rcx, qword [0x141ddb9a0]
cmp eax, 0xe581e894
ja 0x14009e200
xor edx, edx
mov r8, rsi
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
nop
add rsp, 0x20
pop rsi
ret
Function at 0x1400a07d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x98
mov rsi, rdx
mov rdi, rcx
lea rcx, [rsp + 0x20]
mov rdx, rdi
mov r8, rsi
call fcn.14008c3d0
movzx eax, byte [rsp + 0x20]
cmp rax, 6
ja case.default.0x1400a0818
mov rcx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
lea rdx, [0x141dbadcc]
movsxd r9, dword [rdx + rax*4]
add r9, rdx
mov rax, rsi
mov rdx, rdi
cli
add rcx, 4
nop
add rcx, 4
nop dword [rax + rax]
mov eax, dword [0x141dd1fa0]
imul eax, dword [0x141dd1fa4]
or eax, 0x33576b87
add eax, 0xd39c3bc2
imul rax, rax, 0x3cc5b421
shr rax, 0x3d
cmp eax, 0x63b39145
ja 0x1400a0880
jmp 0x1400a09ad
add rcx, 8
lea rax, [r8 + 1]
lea eax, [rax + 1]
mov ecx, 6
jmp 0x1400a09ad
nop
add byte [rax], al
invalid
add rcx, 2
mov eax, dword [0x141dd1fa8]
mov eax, 0xaaeb52cf
nop
mov ecx, dword [0x141dd1fb8]
and ecx, dword [0x141dd1fbc]
and ecx, 0xdaabfed3
xor ecx, 0x8bb76681
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0x1b9b9e98
je 0x1400a0980
mov ecx, 2
Function at 0x1400b0990
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
mov rbp, r8
mov r15, rdx
mov rsi, rcx
mov rdi, qword [rdx]
mov r13, qword [rdx + 0x10]
movzx r12d, word [rdi + 0x3d2]
imul rax, r13, 0x38
lea rcx, [rdi + rax]
add rcx, 0x168
mov rdx, qword [rdi + rax + 0x198]
mov qword [rsp + 0x60], rdx
movups xmm0, xmmword [rdi + rax + 0x168]
movups xmm1, xmmword [rdi + rax + 0x178]
movups xmm2, xmmword [rdi + rax + 0x188]
movaps xmmword [rsp + 0x50], xmm2
movaps xmmword [rsp + 0x40], xmm1
movaps xmmword [rsp + 0x30], xmm0
lea rbx, [r13 + 1]
lea rdx, [rdi + rax]
add rdx, 0x1a0
mov r14, r13
not r14
add r14, r12
imul r8, r14, 0x38
imul eax, esi, 0x38

Function at 0x1400b16e0
Capabilities:
Encode data using xor
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.140090320
movabs r15, 0x8000000000000000
mov rax, qword [rsp + 0x40]
nop word [rax + rax]
Function at 0x1400b32d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rdx + 0x40]
nop word [rax + rax]

Function at 0x1400b59a0
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp

Function at 0x1400b65b0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov eax, dword [0x141dd44e0]
and eax, dword [0x141dd44e4]
add eax, 0xa13c560d
shr eax, 1
mov ecx, 0x8a37c4f9
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0xbc4c416b
jbe 0x1400b65f1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov rbx, qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
xor ebp, ebp
nop word [rax + rax]
mov rcx, rsi
call rbx
test bpl, bpl
jne 0x1400b6600
test rdi, rdi
je 0x1400b66fe
mov eax, dword [0x141dd44e8]
imul eax, dword [0x141dd44ec]
xor eax, 0x116a4892
imul rax, rax, 0x54683855
shr rax, 0x3e
cmp eax, 0xd501a4eb
jne 0x1400b6640
mov rax, qword [0x141ddb9a0]
nop
mov eax, dword [0x141dd44f0]
add eax, dword [0x141dd44f4]
and eax, 0xf71ccfcd
xor eax, 0x4d27c203
imul eax, eax, 0xe404719b
mov rdi, qword [0x141ddb9a0]
cmp eax, 0x100cd45e
jb 0x1400b6640
mov eax, dword [0x141dd44f8]
xor edx, edx
div dword [0x141dd44fc]
or eax, 0xaa9f4914
cmp eax, 0xd7bb48a5
jne 0x1400b6692
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov eax, dword [0x141dd4500]
and eax, dword [0x141dd4504]
xor eax, 0x62eb66d1
add eax, 0x31038a45
shr eax, 1
imul r14, rax, 0x20aff801
invalid
add eax, edi
scasd eax, dword [rdi]
and byte [rcx - 0x3f], cl
out dx, al
cmp dword [rax - 0x77], ecx
stc
xor edx, edx
mov r8, rsi
call rbx
cmp r14d, 0xa4fedfbc
ja 0x1400b66a0
nop word cs:[rax + rax]

Function at 0x1400b6710
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
in eax, 0x89
iretd
mov eax, dword [0x141dd4510]
or eax, dword [0x141dd4514]
xor eax, 0xf7111a3b
mov ecx, 0x9a6d46d5
imul rcx, rax
scasd eax, dword [rdi]
enter 0xffffffffffffc148, 0xffffffffffffffe9
cmp byte [rcx + 0x569adcf1], al
cmp r9, 0xfffffffff417678e
Function at 0x1400bf620
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov eax, dword [0x141dd5518]
or eax, dword [str.j7WQ]
imul eax, eax, 0x34e2ba43
add eax, 0xa8ea2660
cmp eax, 0xefda88fb
jbe 0x1400bf660
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
nop word cs:[rax + rax]
mov eax, dword [0x141dd5520]
xor edx, edx
div dword [0x141dd5524]
mov ecx, eax
or ecx, 0xe1779187
add ecx, 0x45e38f9d
xor ecx, 0xfa88c68a
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov rsi, rsp
cmp ecx, 0xd227421e
jb 0x1400bf660
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov rdi, rsp
mov eax, dword [0x141ddb908]
cmp eax, 3
je 0x1400bf770
mov byte [rdi], 1
xor eax, eax
test al, al
jne 0x1400bf709
mov eax, dword [0x141dd5528]
and eax, dword [0x141dd552c]
add eax, 0x754942e8
xor eax, 0xe9312f54
imul ebx, eax, 0xc1d09e30
mov qword [rsi], rdi
sub rsp, 0x20
lea rcx, [0x141ddb908]
lea r9, [0x141db9188]
xor edx, edx
mov r8, rsi
call fcn.1400fa840
add rsp, 0x20
cmp ebx, 0x7f348087
jne 0x1400bf72e
mov qword [rsi], rdi
sub rsp, 0x20
lea rcx, [0x141ddb908]
lea r9, [0x141db9188]
xor edx, edx
mov r8, rsi
call fcn.1400fa840
add rsp, 0x20
jmp 0x1400bf6c2
mov eax, 0xbe985541
nop word cs:[rax + rax]
mov ecx, dword [0x141dd5530]
add ecx, dword [0x141dd5534]
imul rcx, rax
shr rcx, 0x3f
add ecx, 0x41c66a33
or ecx, 0x6dfd0c31
cmp ecx, 0xd5c98622
ja 0x1400bf740
nop dword [rax + rax]
mov eax, dword [0x141dd5538]
xor eax, dword [0x141dd553c]
xor eax, 0xf68e8408
and eax, 0xf68e9cc8
imul rcx, rax, 0x3878b453
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
cmp eax, 0xa686d2ee
je 0x1400bf770
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400bf7b0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov eax, dword [0x141dd5540]
xor eax, dword [0x141dd5544]
add eax, 0x2f6babf5
xor eax, 0x8619e024
or eax, 0x31c006d8
cmp eax, 0xf6ed696
jae 0x1400bf7e0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rsi, qword [sym.imp.KERNEL32.dll_ExitProcess]
nop word [rax + rax]
mov eax, dword [0x141dd5548]
xor edx, edx
div dword [0x141dd554c]
imul edi, eax, 0x982fdb81
and edi, 0x6fc7fe7
xor ecx, ecx
call rsi
cmp edi, 0x94718339
ja 0x1400bf7f0
ud2
Function at 0x1400bf820
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov edi, ecx
mov eax, dword [0x141dd5550]
or eax, dword [0x141dd5554]
xor eax, 0xa002c20
or eax, 0xf137425a
xor eax, 0xd6d0cfa2
cmp eax, 0x7ebed4ca
jbe 0x1400bf860
mov rax, qword [0x141ddb9a0]
nop word cs:[rax + rax]
mov eax, dword [0x141dd5558]
and eax, dword [0x141dd555c]
or eax, 0x8210008a
and eax, 0x8a5009ca
mov rcx, qword [0x141ddb9a0]
cmp eax, 0x69c31d0b
je 0x1400bf860
nop word cs:[rax + rax]
mov eax, dword [0x141dd5560]
sub eax, dword [0x141dd5564]
imul rax, rax, 0x1baf27ed
shr rax, 0x3c
imul eax, eax, 0xc905d9b6
xor eax, 0x8b044e93
cmp eax, 0x924a1c80
ja 0x1400bf890
mov r8d, 0x891742ed
nop
mov eax, dword [0x141dd5568]
xor edx, edx
div dword [0x141dd556c]
imul eax, eax, 0xa58dc3da
imul rax, r8
shr rax, 0x3f
imul eax, eax, 0xb3f0be76
cmp eax, 0xea6c13f1
ja 0x1400bf8c0
test rcx, rcx
je 0x1400bf91c
mov edx, edi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax]
mov ecx, dword [0x141dd5580]
sub ecx, dword [0x141dd5584]
or ecx, 0x2ff453e7
cmp ecx, 0x40ad628f
je 0x1400bf900
jmp 0x1400bf975
mov eax, dword [0x141dd5570]
xor eax, dword [0x141dd5574]
add eax, 0xcfad38db
imul rax, rax, 0x5074326d
shr rax, 0x3e
cmp eax, 0xced8f92f
ja 0x1400bf969
mov ebx, dword [0x141dd5578]
and ebx, dword [0x141dd557c]
add ebx, 0x411b10ae
or ebx, 0xafafffab
mov ecx, edi
mov rdx, rsi
call fcn.1400fc320
cmp ebx, 0x36c1dba4
jae 0x1400bf975
mov ecx, edi
mov rdx, rsi
call fcn.1400fc320
jmp 0x1400bf93f
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret