joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009c5a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov rbx, r8
mov r14, rdx
mov rsi, rcx
lea rcx, [rsp + 0x80]
xor r9d, r9d
call fcn.14009cd20
mov rax, qword [rsp + 0x80]
mov ecx, dword [0x141dd0260]
xor ecx, dword [0x141dd0264]
add ecx, 0x840b7918
xor ecx, 0x2dbfca97
add ecx, 0xa1d866b1
cmp ecx, 0x237d6e24
jb 0x14009c5d0
cmp eax, 2
jne 0x14009c9a4
mov eax, 0x858eac35
nop word cs:[rax + rax]
mov ecx, dword [0x141dd0268]
add ecx, dword [0x141dd026c]
imul rcx, rax
shr rcx, 0x3f
xor ecx, 0x29d0f401
imul ecx, ecx, 0xdb184397
cmp ecx, 0x5b4481c5
ja 0x14009c610
mov rdi, qword [rsp + 0x88]
mov eax, edi
and eax, 3

Function at 0x14009cd20
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov edi, r9d
mov rbx, r8
mov r14, rdx
mov qword [rbp], rcx
mov eax, dword [0x141dd0368]
and eax, dword [0x141dd036c]
add eax, 0x9dbddd37
or eax, 0x3aa57e66
movabs rcx, 0x700000000
cmp eax, 0x864c364e
jb 0x14009cdf6
mov edx, dword [0x141dd0370]
and edx, dword [0x141dd0374]
add edx, 0xc83060bd
or edx, 0x55f75a33
and edx, 0xf5f7fa7f
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov r9, rsp
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov rsi, rsp
mov eax, 0x250
call fcn.1400eeec0
sub rsp, rax
mov r8, rsp
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov r10, rsp
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov r15, rsp
mov qword [r15 + 0x14], rcx
mov dword [r15 + 0x20], 0
mov word [r15 + 0x24], 0
cmp edx, 0xb76009bc
jne 0x14009ce50
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x250
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov rax, rsp
mov qword [rax + 0x14], rcx
mov dword [rax + 0x20], 0
mov word [rax + 0x24], 0
jmp 0x14009cd6d
mov eax, dword [0x141dd0378]
xor edx, edx
div dword [0x141dd037c]
and eax, 0x4df5bfa5
xor eax, 0xc609468b
add eax, 0xf52808d0
cmp eax, 0x82f563e
jae 0x14009ce8b
mov dword [r15 + 0x1c], 0
mov qword [r15 + 8], 0
mov qword [r15], 1
mov qword [rbp - 8], r8
nop
Function at 0x14009d7b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rbx, r8
mov r14, rdx
mov rsi, rcx
nop word [rax + rax]
mov eax, dword [0x141dd04b8]
add eax, dword [0x141dd04bc]
imul rax, rax, 0x4f0cdd67
shr rax, 0x3b
imul eax, eax, 0xecaa9ad6
cmp eax, 0x32b4cf49
ja 0x14009d7d0
mov rax, qword [rsi]
mov r12, qword [rax]
mov rax, qword [r12 + 0x10]
xor ecx, ecx
nop word cs:[rax + rax]
test cl, cl
jne 0x14009d810
test rax, rax
jne 0x14009d841
mov eax, dword [0x141dd04d0]
and eax, dword [0x141dd04d4]
imul eax, eax, 0x1b4f830
xor eax, 0x76224422
or eax, 0x88cda358
cmp eax, 0x5429cfaa
jne 0x14009d896
jmp 0x14009d8c1
mov eax, dword [0x141dd04c0]
sub eax, dword [0x141dd04c4]
add eax, 0x6149708
or eax, 0xc0005410
and eax, 0xe040dc96
cmp eax, 0x43ac8a34
jne 0x14009d870
ud2
mov eax, dword [0x141dd04c8]
and eax, dword [0x141dd04cc]
or eax, 0x6f3e90a3
ud2
mov eax, dword [0x141dd04d8]
or eax, dword [0x141dd04dc]
and eax, 0x1880110
xor eax, 0x5280040
or eax, 0xda57feac
mov qword [r12 + 0x10], 0xffffffffffffffff
cmp eax, 0x46c8a454
jae 0x14009d8cc
mov qword [r12 + 0x10], 0xffffffffffffffff
jmp 0x14009d896
lea r15, [r12 + 0x18]
xor eax, eax
test al, al
je 0x14009d8f0
mov rcx, r15
mov rdx, r14
mov r8, rbx
call fcn.140089d20
nop word cs:[rax + rax]
mov eax, dword [0x141dd04e0]
add eax, dword [0x141dd04e4]
imul ebp, eax, 0xe59356b7
and ebp, 0x192ded6e
xor ebp, 0x7e2a9e50
mov rcx, r15
mov rdx, r14
mov r8, rbx
call fcn.140089d20
cmp ebp, 0x32513fad
jb 0x14009d8f0
mov rdi, rax
test rax, rax
je 0x14009d9ef
Function at 0x14009e460
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
nop word [rax + rax]
mov eax, dword [0x141dd06b0]
add eax, dword [0x141dd06b4]
or eax, 0x49001809
and eax, 0x49009c6b
xor eax, 0x9598fef0
cmp eax, 0xfc0cdf5f
ja 0x14009e470
cmp qword [rsi + 0x18], 0
je 0x14009e4ac
mov r8, qword [rsi + 0x20]
mov rcx, qword [0x141dda6a0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
nop
test al, al
jne 0x14009e4b0
cmp rsi, 0xffffffffffffffff
je 0x14009e640
lea rcx, [rsi + 8]
nop word cs:[rax + rax]
mov eax, dword [0x141dd06b8]
add eax, dword [0x141dd06bc]
imul eax, eax, 0x95168030
add eax, 0x14479f30
cmp eax, 0x3c478ab7
jb 0x14009e4d0
mov eax, dword [0x141dd06c0]
xor edx, edx
div dword [0x141dd06c4]
imul rax, rax, 0x24c58735
shr rax, 0x3d
or eax, 0xb73f99ea
cmp eax, 0xec72d2fa
ja 0x14009e546
mov eax, dword [0x141dd06c8]
and eax, dword [0x141dd06cc]
imul eax, eax, 0x9bd47b9d
add eax, 0xb2e8d134
mov edx, 0xe612e255
imul rdx, rax
shr rdx, 0x3c
lock dec qword [rcx]
sete al
cmp edx, 0xb43fec05
jne 0x14009e54c
lock dec qword [rcx]
jmp 0x14009e513
xor ecx, ecx
nop
test cl, cl
jne 0x14009e550
test al, al
je 0x14009e640
mov eax, dword [0x141dd06d0]
imul eax, dword [str.__3N2]
imul eax, eax, 0xf9e8225c
add eax, 0xfcf0a868
cmp eax, 0x8408e196
ja 0x14009e599
mov eax, dword [0x141dd06d8]
and eax, dword [0x141dd06dc]
imul eax, eax, 0x38156604
add eax, 0x38c3e978
cmp eax, 0xbcc266a5
jbe 0x14009e59b
jmp 0x14009e57b
mov eax, dword [0x141dd06e0]
imul eax, dword [0x141dd06e4]
imul eax, eax, 0x7aabc2e2
xor eax, 0x8bd7fc7d
cmp eax, 0x2288f445
jae 0x14009e5cc
mov rcx, qword [0x141dda6a0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov eax, dword [0x141dd06e8]
xor edx, edx
div dword [0x141dd06ec]
mov edi, eax
xor edi, 0x41457005
mov rcx, qword [0x141dda6a0]
xor edx, edx
mov r8, rsi
call rbx
cmp edi, 0xfe11a41
jb 0x14009e5e0
nop dword [rax]
mov eax, dword [0x141dd06f0]
xor eax, dword [0x141dd06f4]
and eax, 0xd329d204
imul eax, eax, 0xb2f40475
add eax, 0xb0e6c677
cmp eax, 0xfaf7e0c3
ja 0x14009e610
nop word cs:[rax + rax]
mov eax, dword [0x141dd06f8]
mov ecx, dword [0x141dd06fc]
add eax, ecx
add eax, 0x1ca26bfb
xor eax, 0xce953fd2
cmp eax, 0xd71d5310
ja 0x14009e640
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400a0ae0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov rbp, rsp
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x141dd0be8]
add eax, dword [0x141dd0bec]
and eax, 0x5f2f7850
cmp eax, 0x77dd184c
jne 0x1400a0b20
mov eax, 0x30
call fcn.1400eeec0
jrcxz 0x1400a0b18
add byte [rax + 0x29], cl
invalid
Function at 0x1400b28d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
nop word cs:[rax + rax]
add byte [rax], al
add byte [rax], al

Function at 0x1400b4f40
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
movaps xmmword [rbp - 0x10], xmm6
mov r15, rdx
mov eax, dword [0x141dd2f30]
xor eax, dword [0x141dd2f34]
imul eax, eax, 0x306694e8
xor eax, 0x50621ef4
imul rax, rax, 0x119b8821
shr rax, 0x3b
cmp eax, 0xb8f992f4
jbe 0x1400b4fa0
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
nop word cs:[rax + rax]
mov edx, dword [0x141dd2f38]
imul edx, dword [0x141dd2f3c]
or edx, 0xb2bffdd8
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov r12, rsp
cmp edx, 0x4f649b8e
je 0x1400b4fa0
mov qword [r12], 0
mov rbx, qword [r15 + 0x10]
nop word [rax + rax]
mov eax, dword [0x141dd2f40]
imul eax, dword [0x141dd2f44]
or eax, 0xac40d806
xor eax, 0xcec0a8c2
ror dh, 0xd
cmp dword [rdi], eax
invalid
adc byte [0xd892ad89], bh
ja 0x1400b4fe0
mov rax, rbx
shr rax, 0x20
je 0x1400b5023
lea rax, [0x141db87a0]
mov qword [rcx + 8], rax
mov qword [rcx], 0
jmp 0x1400b5b00
mov qword [rbp - 0x18], rcx
nop word [rax + rax]
mov eax, dword [0x141dd2f48]
or eax, dword [0x141dd2f4c]
imul eax, eax, 0xb33983d2
imul rax, rax, 0xcc71e07
shr rax, 0x3a
cmp eax, 0xf5da7717
je 0x1400b5030
sub rsp, 0x20
xor ecx, ecx
mov edx, ebx
xor r8d, r8d
mov r9, r12
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
add rsp, 0x20
mov r13, qword [r12]
mov eax, dword [0x141dd2f50]
xor eax, dword [0x141dd2f54]
xor eax, 0x830000
or eax, 0x380108
and eax, 0x18ff01c8
cmp eax, 0x6a636d4c
je 0x1400b5070
test r13, r13
js 0x1400b5279
nop dword [rax + rax]
mov eax, dword [0x141dd2f60]
or eax, dword [0x141dd2f64]
imul eax, eax, 0x64338ef
imul rax, rax, 0x16ad2a93
shr rax, 0x3b
xor eax, 0x6cae77ad
cmp eax, 0x12647f1d
jb 0x1400b50a0
test r13, r13
je 0x1400b50f1
movzx eax, byte [0x141dda6b8]
sub rsp, 0x20
xor ecx, ecx
mov rdx, r13
call fcn.1400bf230
add rsp, 0x20
mov rdi, rax
test rax, rax
jne 0x1400b50f6
ud2
mov edi, 1
xor eax, eax
nop dword [rax + rax]
ud2
Function at 0x1400b5b30
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
nop word cs:[rax + rax]
mov eax, dword [0x141dd30a8]
xor eax, dword [str.7xe_]
or eax, 0x4700080
and eax, 0xd7313c2
add eax, 0x97fee46
cmp eax, 0xf27e89d6
ja 0x1400b5b50
nop word cs:[rax + rax]
mov eax, dword [0x141dd30b0]
imul eax, dword [0x141dd30b4]
xor eax, 0x1e095038
and eax, 0xbf2bd07c
add eax, 0x90e8a637
cmp eax, 0x694f29f4
ja 0x1400b5b80
test rdi, rdi
je 0x1400b5c12
mov eax, dword [0x141dd30b8]
imul eax, dword [0x141dd30bc]
imul eax, eax, 0x3f8a466e
add eax, 0x71d05ab9
or eax, 0xd5e0cfe8
cmp eax, 0xe284ab8
jb 0x1400b5bd9
mov rcx, qword [0x141dda6a0]
xor eax, eax
test al, al
je 0x1400b5be2
mov rax, qword [0x141dda6a0]
jmp 0x1400b5bcc
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov eax, dword [0x141dd30c0]
or eax, dword [0x141dd30c4]
add eax, 0x9400e960
or eax, 0x44021000
and eax, 0xc69e7f90
cmp eax, 0xa19e7d17
jb 0x1400b5bf0
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1400b5c20
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
mov rbp, rsp
mov edi, ecx
mov eax, dword [0x141dd30c8]
xor eax, dword [0x141dd30cc]
and eax, 0xf46ab2d0
add eax, 0xa2db0ab4
imul rax, rax, 0x1b9c4cf7
shr rax, 0x3b
cmp eax, 0x636176d1
ja 0x1400b5c9e
mov eax, dword [0x141dd30d0]
add eax, dword [0x141dd30d4]
imul eax, eax, 0x26c96384
and eax, 0xea377a8c
imul r14, rax, 0x5693473d
shr r14, 0x3e
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov rsi, rsp
sub rsp, 0x20
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
add rsp, 0x20
cmp r14d, 0x10687d19
jbe 0x1400b5cbd
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
sub rsp, 0x20
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
add rsp, 0x20
jmp 0x1400b5c53
mov rbx, rax
mov eax, dword [0x141dd30d8]
sub eax, dword [0x141dd30dc]
or eax, 0x6f967dee
add eax, 0xdd7fc65c
cmp eax, 0x4ec2215e
jb 0x1400b5cc0
test rbx, rbx
je 0x1400b5e1c
invalid
cmp rbx, 0xffffffffffffffff
jne 0x1400b5d50
movabs r9, 0x600000002
Function at 0x1400b9da0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rbx, rdx
mov eax, dword [0x141dd3980]
add eax, dword [0x141dd3984]
mov r14, rcx
and eax, 0x40068585
or eax, 0xbf796a78
cmp eax, 0x870d8a0c
jne 0x1400b9e00
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov rcx, rsp
lea r8, [rbx - 1]
sub rsp, 0x20
mov rdx, r14
call fcn.140054a50
add rsp, 0x20
dec rbx
nop word cs:[rax + rax]
Function at 0x1400bf1f0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1400bf230
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rdx
mov eax, dword [0x141dd4198]
xor eax, dword [0x141dd419c]
mov edi, ecx
and eax, 0xb77f7fcf
add eax, 0xcbabf7e8
cmp eax, 0x33dfdc20
jae 0x1400bf270
mov rax, qword [0x141dda6a0]
nop word cs:[rax + rax]
mov eax, dword [0x141dd41a0]
xor edx, edx
div dword [0x141dd41a4]
imul eax, eax, 0xd98aa49b
add eax, 0x3326f11a
and eax, 0x962d30a0
mov rbx, qword [0x141dda6a0]
cmp eax, 0xa8bdef32
je 0x1400bf270
test rbx, rbx
je 0x1400bf2d8
mov eax, dword [0x141dd41b8]
sub eax, dword [0x141dd41bc]
imul eax, eax, 0x5154e7ed
or eax, 0xdcafc77a
imul rcx, rax, 0x3a5bc2d7
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1d
cmp eax, 0x37d228a0
jne 0x1400bf33a
jmp 0x1400bf360
mov eax, dword [0x141dd41a8]
xor edx, edx
div dword [0x141dd41ac]
imul rax, rax, 0x1d70044d
shr rax, 0x3c
add eax, 0x1f936753
xor eax, 0x4084ce87
cmp eax, 0xd638b695
ja 0x1400bf32e
mov eax, dword [0x141dd41b0]
xor eax, dword [0x141dd41b4]
imul ebx, eax, 0xb4c0616c
add ebx, 0xeae4f618
mov ecx, edi
mov rdx, rsi
call fcn.1400fb990
cmp ebx, 0xc5a698c8
jae 0x1400bf302
jmp 0x1400bf390
mov ecx, edi
mov rdx, rsi
call fcn.1400fb990
jmp 0x1400bf302
mov eax, dword [0x141dd41c0]
xor edx, edx
div dword [0x141dd41c4]
mov ebp, eax
mov rcx, rbx
mov edx, edi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp ebp, 0xa6c08661
jne 0x1400bf370
mov rcx, rbx
mov edx, edi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x1400bf33a
mov ecx, dword [0x141dd41c8]
xor ecx, dword [0x141dd41cc]
and ecx, 0x89000001
cmp ecx, 0x1af3682b
je 0x1400bf370
nop word [rax + rax]
mov ecx, dword [0x141dd41d0]
imul ecx, dword [0x141dd41d4]
xor ecx, 0x1eb734b
imul ecx, ecx, 0xea170a1a
cmp ecx, 0x125a526b
jb 0x1400bf390
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400bf3c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
mov rbp, rsp
mov rsi, rcx
mov eax, dword [0x141dd41f8]
or eax, dword [0x141dd41fc]
and eax, 0x18ec4eaf
add eax, 0xd730c2e0
xor eax, 0x58b7b479
cmp eax, 0x64bcdb
jae 0x1400bf410
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
nop dword [rax + rax]
mov eax, dword [0x141dd4200]
xor eax, dword [0x141dd4204]
and eax, 0x26131dc6
xor eax, 0xcff6f911
imul rcx, rax, 0x2154b69
shr rcx, 0x37
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov r9, rsp
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov rdi, rsp
cmp ecx, 0x43ee5e8e
ja 0x1400bf410
mov rcx, qword [rsi]
nop dword [rax]
mov eax, dword [0x141dd4208]
sub eax, dword [0x141dd420c]
or eax, 0x7e7866b6
add eax, 0x818faed7
or eax, 0xa6af350c
cmp eax, 0xee2ca14e
ja 0x1400bf460
cmp rcx, 0xffffffffffffffff
je 0x1400bf66a
lea rax, [rcx + 1]
lea rdx, [rcx + rcx]
cmp rdx, rax
cmova rax, rdx
cmp rax, 5
mov ebx, 4
cmovae rbx, rax
movabs r10, 0x7ffffffffffffff8
mov eax, dword [0x141dd4210]
xor edx, edx
div dword [0x141dd4214]
mov r11d, 0x28
nop word cs:[rax + rax]
mov eax, dword [0x141dd4218]
sub eax, dword [0x141dd421c]
imul r14d, eax, 0x61ee2196
and r14d, 0xd4048d0
mov rax, rbx
mul r11
mov r8, rax
seto al
cmp r8, r10
seta dl
cmp r14d, 0x7e4b2e30
ja 0x1400bf4d0
or al, dl
nop word [rax + rax]
mov edx, dword [0x141dd4220]
imul edx, dword [0x141dd4224]
and edx, 0x10260024
xor edx, 0x1016000c
or edx, 0xcb40dfd0
cmp edx, 0xc52beec1
je 0x1400bf510
test al, al
jne 0x1400bf66a
test rcx, rcx
je 0x1400bf58e
mov r10, qword [rsi + 8]
mov eax, dword [0x141dd4228]
xor edx, edx
div dword [0x141dd422c]
shl rcx, 3
lea rax, [rcx + rcx*4]
nop
mov ecx, dword [0x141dd4230]
xor ecx, dword [0x141dd4234]
imul ecx, ecx, 0x9cb3c7cc
add ecx, 0xf33008ab
cmp ecx, 0xfacf5f04
ja 0x1400bf560
mov qword [r9], r10
mov qword [r9 + 0x10], rax
mov eax, 8
jmp 0x1400bf590
xor eax, eax
mov qword [r9 + 8], rax
sub rsp, 0x20
mov edx, 8
mov rcx, rdi
call fcn.1400c0610
add rsp, 0x20
cmp qword [rdi], 0
jne 0x1400bf620
mov rax, qword [rdi + 8]
mov ecx, dword [0x141dd4248]
sub ecx, dword [0x141dd424c]
or ecx, 0x4c1860
and ecx, 0x4dbae8
imul ecx, ecx, 0x77a2004a
cmp ecx, 0x162a24fc
jae 0x1400bf5e0
mov qword [rsi + 8], rax
mov qword [rsi], rbx
mov ecx, dword [0x141dd4250]
xor ecx, dword [0x141dd4254]
and ecx, 0x2006c09
xor ecx, 0x7000401
or ecx, 0x78f113e6
mov qword [rsi + 8], rax
mov qword [rsi], rbx
cmp ecx, 0x14c146f0
jb 0x1400bf5e0
mov rsp, rbp
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov eax, dword [0x141dd4238]
imul eax, dword [0x141dd423c]
imul rax, rax, 0x6044aefb
shr rax, 0x3e
or eax, 0xf2c7ad1c
cmp eax, 0xb6065da8
jb 0x1400bf620
nop word cs:[rax + rax]
mov eax, dword [0x141dd4240]
xor edx, edx
div dword [0x141dd4244]
or eax, 0x5c011d5b
cmp eax, 0xcf6c3021
je 0x1400bf650
ud2
Function at 0x1400c9a90
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
movaps xmmword [rbp - 0x10], xmm6
mov r12, r8
mov rdi, rdx
mov rbx, rcx
movabs rax, 0x7465646279746573
mov qword [rbp - 0x20], rax
movabs rax, 0x736f6d6570736575
mov qword [rbp - 0x18], rax
movabs r13, 0x6c7967656e657261
movabs rsi, 0x646f72616e646f6d
mov eax, dword [str.P6_]
and eax, dword [0x141dd57a4]
imul rax, rax, 0x7d92a323
shr rax, 0x3d
or eax, 0x5d226e98
cmp eax, 0xe2a687e4
jbe 0x1400c9b91
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov rdx, rsp
mov eax, 0x50
call fcn.1400eeec0
sub rsp, rax
mov rcx, rsp
mov rax, rbx
movabs r8, 0x736f6d6570736575
xor rax, r8
mov r8, rdi
xor r8, rsi
mov r9, rbx
xor r9, r13
mov r10, rdi
movabs r14, 0x7465646279746573
xor r10, r14
mov qword [rcx], rax
mov qword [rcx + 8], r9
mov qword [rcx + 0x10], r8
mov qword [rcx + 0x18], r10
mov qword [rcx + 0x20], rbx
mov qword [rcx + 0x28], rdi
xorps xmm0, xmm0
movups xmmword [rcx + 0x30], xmm0
mov qword [rcx + 0x40], 0
mov qword [rdx], r12
sub rsp, 0x20
mov r8d, 8
call fcn.14001bdc0
add rsp, 0x20
xor qword [rbp - 0x18], rbx
xor rsi, rdi
xor r13, rbx
xor qword [rbp - 0x20], rdi
xorps xmm6, xmm6
nop word cs:[rax + rax]
mov r15d, dword [0x141dd57a8]
or r15d, dword [0x141dd57ac]
or r15d, 0x9ae29a30
mov eax, 0xa7dec593
imul r15, rax
shr r15, 0x3f
or r15d, 0x968748a2
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov rdx, rsp
mov eax, 0x50
call fcn.1400eeec0
sub rsp, rax
mov r14, rsp
mov rax, qword [rbp - 0x18]
mov qword [r14], rax
mov qword [r14 + 8], r13
mov qword [r14 + 0x10], rsi
mov rax, qword [rbp - 0x20]
mov qword [r14 + 0x18], rax
mov qword [r14 + 0x20], rbx
mov qword [r14 + 0x28], rdi
movups xmmword [r14 + 0x30], xmm6
mov qword [r14 + 0x40], 0
mov qword [rdx], r12
sub rsp, 0x20
mov r8d, 8
mov rcx, r14
call fcn.14001bdc0
add rsp, 0x20
cmp r15d, 0xbb710d88
ja 0x1400c9bb0
mov r9, qword [r14 + 0x30]
shl r9, 0x38
mov rcx, qword [r14 + 0x10]
or r9, qword [r14 + 0x38]
mov rdx, qword [r14 + 0x18]
xor rdx, r9
mov rax, qword [r14]
add rax, rcx
mov r8, qword [r14 + 8]
add r8, rdx
rol rcx, 0xd
xor rcx, rax
rol rdx, 0x10
xor rdx, r8
rol rax, 0x20
add r8, rcx
add rax, rdx
rol rcx, 0x11
rol rdx, 0x15
xor rcx, r8
xor rdx, rax
rol r8, 0x20
xor rax, r9
xor r8, 0xff
add rax, rcx
add r8, rdx
rol rcx, 0xd
rol rdx, 0x10
xor rcx, rax
xor rdx, r8
rol rax, 0x20
add rax, rdx
xor r9d, r9d
nop word cs:[rax + rax]
test r9b, r9b
jne 0x1400c9cd0
add r8, rcx
rol rcx, 0x11
xor rcx, r8
rol rdx, 0x15
xor rdx, rax
rol r8, 0x20
add rax, rcx
add r8, rdx
rol rcx, 0xd
xor rcx, rax
rol rdx, 0x10
rol rax, 0x20
xor rdx, r8
add r8, rcx
rol rcx, 0x11
add rax, rdx
xor rcx, r8
rol rdx, 0x15
xor rdx, rax
rol r8, 0x20
add rax, rcx
add r8, rdx
rol rcx, 0xd
xor rcx, rax
rol rdx, 0x10
xor rdx, r8
add r8, rcx
rol rcx, 0x11
rol rdx, 0x15
mov rax, r8
rol rax, 0x20
xor rdx, rcx
xor rax, rdx
xor rax, r8
movaps xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400c9d60
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
nop dword [rax + rax]
mov eax, dword [0x141dd5970]
imul eax, dword [0x141dd5974]
or eax, 0x9c747423
add eax, 0xfad355ac
xor eax, 0xee5c4d50
cmp eax, 0xc1645698
ja 0x1400c9d70
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400c9e00
mov eax, dword [0x141dd5978]
and eax, dword [0x141dd597c]
add eax, 0xc1c9c697
xor eax, 0x34206024
or eax, 0xb570f9a
cmp eax, 0x3b8bb559
je 0x1400c9def
mov edi, dword [0x141dd5980]
or edi, dword [0x141dd5984]
or edi, 0x3853c0bb
add edi, 0x706521fc
and edi, 0x2a0c3ee7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0xd099afc3
jbe 0x1400c9e00
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400c9dc3
mov eax, dword [0x141dd5988]
sub eax, dword [0x141dd598c]
add eax, 0xa3f23a67
xor eax, 0x5e20f2cc
cmp eax, 0xa87484a0
ja 0x1400c9e00
nop dword [rax]
mov eax, dword [0x141dd5990]
mov ecx, dword [0x141dd5994]
add eax, ecx
add eax, 0x4f6c2838
or eax, 0xc92d0f4d
xor eax, 0x51d8ef5
cmp eax, 0xc8619c78
jb 0x1400c9e20
cmp rsi, 0xffffffffffffffff
je 0x1400c9f64
lea rcx, [rsi + 8]
mov eax, dword [0x141dd5998]
xor edx, edx
div dword [0x141dd599c]
or eax, 0x2c104839
xor eax, 0x6b420058
or eax, 0x9085b384
cmp eax, 0x81969062
jne 0x1400c9e80
lock dec qword [rcx]
nop word [rax + rax]
mov eax, dword [0x141dd59a0]
imul eax, dword [0x141dd59a4]
add eax, 0x313de6e7
or eax, 0x9119e1
imul edx, eax, 0x51533fa4
lock dec qword [rcx]
sete al
cmp edx, 0xd4a64f86
je 0x1400c9e80
test al, al
je 0x1400c9f64
xor eax, eax
test al, al
je 0x1400c9ed0
mov rax, qword [0x141dda6a0]
nop word cs:[rax + rax]
mov eax, dword [0x141dd59a8]
and eax, dword [0x141dd59ac]
imul eax, eax, 0xf82b5a16
and eax, 0x252e23dc
add eax, 0x9f3bd09d
mov rdi, qword [0x141dda6a0]
cmp eax, 0xdc713ad5
ja 0x1400c9ed0
mov eax, dword [0x141dd59b0]
imul eax, dword [0x141dd59b4]
shr eax, 3
imul rax, rax, 0x2485925d
shr rax, 0x3a
imul eax, eax, 0x9cb6019
xor eax, 0x882f04eb
cmp eax, 0xbb582f0c
jbe 0x1400c9f35
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov ebp, dword [0x141dd59b8]
or ebp, dword [0x141dd59bc]
and ebp, 0xd36bae20
mov rcx, rdi
xor edx, edx
mov r8, rsi
call rbx
cmp ebp, 0x9555ed6c
je 0x1400c9f40
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400d5200
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rax
mov rcx, rax
mov eax, dword [0x141dd7110]
xor edx, edx
div dword [0x141dd7114]
inc r8
nop word cs:[rax + rax]
mov eax, dword [0x141dd7118]
or eax, dword [0x141dd711c]
imul eax, eax, 0xe69b3476
or eax, 0xd6f8a33e
and eax, 0xfefae3be
cmp eax, 0x52c273b7
je 0x1400d5230
cmp r8, 2
jb 0x1400d52d2
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, eax
mov eax, dword [0x141dd7120]
xor edx, edx
div dword [0x141dd7124]
nop word cs:[rax + rax]
mov eax, dword [0x141dd7128]
xor edx, edx
div dword [0x141dd712c]
imul eax, eax, 0x9169b735
or eax, 0x6eb65092
imul eax, eax, 0x2c8ad8b4
cmp eax, 0x7244d60b
je 0x1400d5280
nop word cs:[rax + rax]
mov eax, dword [0x141dd7130]
and eax, dword [0x141dd7134]
imul eax, eax, 0x332e6e17
add eax, 0xf161c155
cmp eax, 0x641f7816
jb 0x1400d52b0
test ecx, ecx
jne 0x1400d52fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov eax, dword [0x141dd7138]
sub eax, dword [0x141dd713c]
xor eax, 0x20
and eax, 0x66a41020
cmp eax, 0x585b57f4
je 0x1400d52e0
add rsp, 0x20
pop rsi
ret