joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140056e90
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r9
mov ebp, r8d
mov r14, rdx
mov rbx, rcx
mov rdi, qword [rsp + 0x80]
mov eax, dword [0x141f35128]
xor edx, edx
div dword [0x141f3512c]
mov eax, 0x9365f29b
nop word cs:[rax + rax]
mov ecx, dword [0x141f35130]
or ecx, dword [0x141f35134]
imul rcx, rax
shr rcx, 0x3e
imul ecx, ecx, 0xadea0322
cmp ecx, 0xe1512250
ja 0x140056ed0
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x140056f00
cmp ebp, 0x110000
je 0x140056f80
mov eax, dword [0x141f35138]
add eax, dword [0x141f3513c]
imul eax, eax, 0xe426255b
add eax, 0x9db2d1c4
or eax, 0xff5d2dcb
cmp eax, 0x779356ca
jb 0x140056f5e
mov eax, dword [0x141f35140]
imul eax, dword [0x141f35144]
add eax, 0xff40f11a
imul r15, rax, 0x601dbf59
shr r15, 0x3e
mov rcx, rbx
mov edx, ebp
call qword [r14 + 0x20]
cmp r15d, 0xbfcff55a
jbe 0x140056f69
mov rcx, rbx
mov edx, ebp
call qword [r14 + 0x20]
jmp 0x140056f2f
mov ecx, eax
mov al, 1
test cl, cl
jne 0x140056fec
nop word cs:[rax + rax]
mov eax, dword [0x141f35148]
xor edx, edx
div dword [0x141f3514c]
imul eax, eax, 0xb3c1f0a8
add eax, 0x5fe5ffee
or eax, 0xd2a69311
cmp eax, 0x7a64c571
je 0x140056f80
nop word cs:[rax + rax]
mov eax, dword [0x141f35150]
xor eax, dword [0x141f35154]
imul eax, eax, 0xa027e13c
cmp eax, 0x20a1ddce
je 0x140056fb0
test rsi, rsi
je 0x140056fea
mov rax, qword [r14 + 0x18]
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp rax
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14005b940
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
mov r9, rdx
nop dword [rax + rax]
mov eax, dword [0x141f35ab8]
and eax, dword [str._a_s]
xor eax, 0x20000
and eax, 0x81520902
cmp eax, 0x2eaac10c
jb 0x14005b950
lea r10, [r9 + 7]
and r10, 0xfffffffffffffff8
sub r10, r9
je 0x14005ba88
cmp r10, r8
cmovae r10, r8
mov eax, 0xb454ec67
nop word [rax + rax]
mov edx, dword [0x141f35ac0]
xor edx, dword [0x141f35ac4]
imul rdx, rax
shr rdx, 0x3d
cmp edx, 0x45eb25a3
je 0x14005b990
test r10, r10
je 0x14005ba88
xor r11d, r11d
nop dword [rax + rax]
cmp byte [r9 + r11], cl
je 0x14005bb70
mov eax, dword [0x141f35af0]
xor eax, dword [0x141f35af4]
add eax, 0x9ea6b231
imul rax, rax, 0x5c22e3df
shr rax, 0x3a
and eax, 0xfffffffc
cmp eax, 0x2989d54e
ja 0x14005b9ca
inc r11
nop word cs:[rax + rax]
mov eax, dword [0x141f35af8]
xor edx, edx
div dword [0x141f35afc]
add eax, 0x12a7d0c2
imul rax, rax, 0x7eb8dcb1
shr rax, 0x3c
cmp eax, 0xefba7d8f
je 0x14005ba00
nop word cs:[rax + rax]
mov eax, dword [0x141f35b00]
xor edx, edx
div dword [0x141f35b04]
and eax, 0x10c
cmp eax, 0x3652318e
ja 0x14005ba30
cmp r11, r10
jne 0x14005b9c0
lea r11, [r8 - 0x10]
nop word [rax + rax]
mov eax, dword [0x141f35ac8]
or eax, dword [0x141f35acc]
imul eax, eax, 0x4cdc30e7
add eax, 0x3d72d53e
cmp eax, 0xd4c156a7
ja 0x14005ba60
cmp r10, r11
jbe 0x14005ba8f
jmp 0x14005bb51
lea r11, [r8 - 0x10]
xor r10d, r10d
movabs rsi, 0xfefefefefefefeff
movabs rdi, 0x8080808080808080
movzx eax, cl
movabs rbx, 0x101010101010101
imul rbx, rax
xor ebp, ebp
mov r14d, 0x95669dd1
nop dword [rax]
mov eax, dword [0x141f35ad0]
or eax, dword [0x141f35ad4]
and eax, 0x730654ec
cmp eax, 0x68fcb5f
je 0x14005bac0
mov rax, qword [r9 + r10]
xor rax, rbx
lea rdx, [rax + rsi]
not rax
and rax, rdx
mov rdx, qword [r9 + r10 + 8]
xor rdx, rbx
lea r15, [rdx + rsi]
not rdx
and rdx, r15
or rdx, rax
test rdx, rdi
jne 0x14005bb51
mov eax, dword [0x141f35ad8]
xor edx, edx
div dword [0x141f35adc]
mov eax, dword [str.WO7O_Ix]
xor eax, dword [0x141f35ae4]
imul rax, r14
shr rax, 0x3d
or eax, 0x1bbac8b
cmp eax, 0x9eb081e3
je 0x14005bb11
add r10, 0x10
mov eax, dword [0x141f35ae8]
xor edx, edx
div dword [0x141f35aec]
test bpl, bpl
jne 0x14005bb43
cmp r10, r11
jbe 0x14005bac0
xor eax, eax
cmp r10, r8
je 0x14005bb75
nop dword [rax + rax]
cmp byte [r9 + r10], cl
je 0x14005bb70
inc r10
cmp r8, r10
jne 0x14005bb60
jmp 0x14005bb75
mov eax, 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140060c00
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov r8b, 1
test rdx, rdx
je 0x140060ce6
mov r9, rdx
cmp rdx, 1
jne 0x140060c40
movzx r9d, byte [rcx]
mov dl, 1
cmp r9d, 0x2b
je 0x140060ecd
mov eax, 1
cmp r9d, 0x2d
je 0x140060ecd
jmp 0x140060d10
mov eax, dword [0x141f36590]
xor edx, edx
div dword [0x141f36594]
and eax, 0x924c6323
add eax, 0xe0c401db
cmp eax, 0xadac9ee7
jb 0x140060c40
movzx eax, byte [rcx]
xor edx, edx
nop word cs:[rax + rax]
test dl, dl
jne 0x140060c70
nop word cs:[rax + rax]
mov edx, dword [0x141f36598]
imul edx, dword [0x141f3659c]
xor edx, 0x88041
and edx, 0x24888951
cmp edx, 0xa38e7ccc
ja 0x140060c80
cmp al, 0x2b
jne 0x140060ced
inc rcx
nop dword [rax + rax]
mov eax, dword [0x141f365a0]
mov edx, dword [0x141f365a4]
add eax, edx
add eax, 0xf0ecbc1
or eax, 0x2fb6cd4d
xor eax, 0x9ee99727
cmp eax, 0xd99c7bb1
ja 0x140060cb0
lea rax, [r9 - 1]
cmp r9, 4
mov r9, rax
jb 0x140060d10
jmp 0x140060d90
xor edx, edx
jmp 0x140060ecd
xor eax, eax
nop
test al, al
jne 0x140060cf0
mov eax, 2
cmp r9, 3
jae 0x140060d90
nop word cs:[rax + rax]
mov edx, dword [0x141f36588]
and edx, dword [0x141f3658c]
or edx, 0xc9420400
and edx, 0xdb5a0645
imul edx, edx, 0x2dcdf4ed
cmp edx, 0xa31662b4
ja 0x140060d10
xor r9d, r9d
xor r10d, r10d
nop dword [rax]
movzx edx, byte [rcx]
add edx, 0xffffffd0
cmp edx, 0xa
setae r8b
jae 0x140060ecb
nop word cs:[rax + rax]
test r9b, r9b
jne 0x140060d60
movzx r10d, r10b
add r10d, r10d
lea r10d, [r10 + r10*4]
dec rax
inc rcx
add dl, r10b
mov r10d, edx
test rax, rax
jne 0x140060d40
jmp 0x140060ecd
mov eax, dword [0x141f365a8]
or eax, dword [0x141f365ac]
add eax, 0x798e3151
xor eax, 0xefe8d12c
cmp eax, 0x95c3b7a5
ja 0x140060d90
xor edx, edx
mov r11b, 0xa
nop word cs:[rax + rax]
add r9, 0xffffffffffffffff
setb bl
jae 0x140060e90
mov eax, edx
mul r11b
mov r10d, eax
seto al
nop dword [rax + rax]
mov edx, dword [0x141f365b0]
or edx, dword [0x141f365b4]
and edx, 0x1000060a
or edx, 0xc5dce841
imul edx, edx, 0x298c6b34
cmp edx, 0x69491758
jb 0x140060de0
movzx esi, byte [rcx]
add esi, 0xffffffd0
cmp esi, 0xa
setae dl
or dl, al
jne 0x140060ea0
inc rcx
mov eax, dword [0x141f365b8]
xor edx, edx
div dword [0x141f365bc]
mov edi, dword [0x141f365c0]
add edi, dword [0x141f365c4]
xor edi, 0x91a6200
or edi, 0x34408d5d
xor edi, 0x75b42644
mov edx, r10d
add dl, sil
setb al
cmp edi, 0x4db07bbe
jb 0x140060e2b
mov r10d, dword [0x141f365c8]
sub r10d, dword [0x141f365cc]
or r10d, 0x4ed08db8
xor r10d, 0xfe8444e0
add r10d, 0xee57386c
cmp r10d, 0x7f83db1c
jb 0x140060e5a
test al, al
je 0x140060dc0
mov dl, 2
mov r8d, ebx
jmp 0x140060ecd
mov eax, dword [0x141f36580]
xor eax, dword [0x141f36584]
imul rax, rax, 0x7162d6b1
shr rax, 0x3e
cmp esi, 0xa
mov edx, 0
adc dl, 1
cmp eax, 0x1728787a
je 0x140060ea0
jmp 0x140060ecd
mov dl, 1
mov eax, r8d
pop rbx
pop rdi
pop rsi
ret
Function at 0x14006c9d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
vmovdqa xmmword [rsp + 0x40], xmm10
vmovaps xmmword [rsp + 0x30], xmm9
vmovaps xmmword [rsp + 0x20], xmm8
vmovaps xmmword [rsp + 0x10], xmm7
vmovaps xmmword [rsp], xmm6
vbroadcasti128 ymm0, xmmword [rcx + 0x30]
vpaddd ymm0, ymm0, ymmword [0x140108820]
vbroadcasti128 ymm3, xmmword [rcx + 0x20]
vbroadcasti128 ymm1, xmmword [rcx + 0x10]
vbroadcasti128 ymm5, xmmword [rcx]
mov r8, rdx
xor r9d, r9d
vbroadcasti128 ymm6, xmmword [0x140108900]
vmovdqa ymm7, ymmword [0x140108860]
vmovdqa ymm4, ymm0
vmovdqa ymm9, ymm5
vmovdqa ymm2, ymm1
vmovdqa ymm8, ymm3
nop word [rax + rax]
mov eax, dword [0x141f37d98]
xor edx, edx
div dword [0x141f37d9c]
and eax, 0x4e8c208
xor eax, 0xefb9010b
cmp eax, 0x2a2bb25e
jb 0x14006ca40
inc r9
vpaddd ymm9, ymm9, ymm2
vpxor ymm4, ymm9, ymm4
vpshuflw ymm4, ymm4, 0xb1
vpshufhw ymm4, ymm4, 0xb1
vpaddd ymm8, ymm8, ymm4
vpxor ymm2, ymm8, ymm2
vpsrld ymm10, ymm2, 0x14
vpslld ymm2, ymm2, 0xc
vpor ymm2, ymm10, ymm2
vpaddd ymm9, ymm9, ymm2
vpshufb ymm10, ymm9, ymm6
vpshufb ymm4, ymm4, ymm6
vpxor ymm4, ymm10, ymm4
vpaddd ymm8, ymm8, ymm4
vpxor ymm2, ymm8, ymm2
vpsrld ymm10, ymm2, 0x19
vpslld ymm2, ymm2, 7
vpor ymm2, ymm10, ymm2
vpshufd ymm8, ymm8, 0x39
vpshufd ymm9, ymm9, 0x93
vpaddd ymm9, ymm9, ymm2
vpshuflw ymm10, ymm9, 0xb1
vpshufhw ymm10, ymm10, 0xb1
vpshufb ymm4, ymm4, ymm7
vpxor ymm4, ymm10, ymm4
vpaddd ymm8, ymm8, ymm4
vpxor ymm2, ymm8, ymm2
vpsrld ymm10, ymm2, 0x14
vpslld ymm2, ymm2, 0xc
vpor ymm2, ymm10, ymm2
vpaddd ymm9, ymm9, ymm2
vpxor ymm4, ymm9, ymm4
vpshufb ymm4, ymm4, ymm6
vpaddd ymm8, ymm8, ymm4
vpxor ymm2, ymm8, ymm2
vpsrld ymm10, ymm2, 0x19
vpslld ymm2, ymm2, 7
vpor ymm2, ymm10, ymm2
vpshufd ymm8, ymm8, 0x93
vpshufd ymm4, ymm4, 0x4e
vpshufd ymm9, ymm9, 0x39
cmp r9, 0xa
jne 0x14006ca40
mov eax, dword [str.Tw5M]
and eax, dword [0x141f37da4]
xor eax, 0x48c00140
or eax, 0xb11fd691
vpaddd ymm5, ymm9, ymm5
vpaddd ymm3, ymm8, ymm3
cmp eax, 0xff1da006
je 0x14006cb9c
mov eax, dword [0x141f37da8]
imul eax, dword [0x141f37dac]
imul eax, eax, 0x3782aa0a
add eax, 0x135e16b9
and eax, 0x425f1a54
vmovd edx, xmm0
inc edx
vpaddd xmm6, xmm2, xmm1
vinserti128 ymm6, ymm5, xmm6, 1
vmovdqu ymmword [r8], ymm6
vpaddd xmm6, xmm4, xmm0
vinserti128 ymm6, ymm3, xmm6, 1
vmovdqu ymmword [r8 + 0x20], ymm6
mov dword [rcx + 0x30], edx
cmp eax, 0x6c1cd74
jne 0x14006cbc6
vpaddd xmm6, xmm2, xmm1
vinserti128 ymm6, ymm5, xmm6, 1
vmovdqu ymmword [r8], ymm6
vpaddd xmm6, xmm4, xmm0
vinserti128 ymm6, ymm3, xmm6, 1
vmovdqu ymmword [r8 + 0x20], ymm6
vmovd eax, xmm0
inc eax
mov dword [rcx + 0x30], eax
jmp 0x14006cb50
vmovaps xmm6, xmmword [rsp]
vmovaps xmm7, xmmword [rsp + 0x10]
vmovaps xmm8, xmmword [rsp + 0x20]
vmovaps xmm9, xmmword [rsp + 0x30]
vmovaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
vzeroupper
ret
Function at 0x140071410
Capabilities:
Encode data using xor

Disassembly:
mov r9, rdx
mov eax, dword [str.oxTW]
xor edx, edx
div dword [0x141f38074]
nop word cs:[rax + rax]
mov eax, dword [0x141f38078]
add eax, dword [0x141f3807c]
xor eax, 0x32423012
add eax, 0x7729d070
or eax, 0xad7cbba6
cmp eax, 0xbcdf0d28
jb 0x140071430
vmovaps ymm0, ymmword [r8]
vpermps ymm0, ymm0, ymmword [r9]
vmovaps ymmword [rcx], ymm0
vzeroupper
ret

Function at 0x140072eb0
Capabilities:
Encode data using xor

Disassembly:
mov r9, rdx
mov eax, dword [0x141f380d0]
xor edx, edx
div dword [0x141f380d4]
nop word cs:[rax + rax]
mov eax, dword [0x141f380d8]
or eax, dword [0x141f380dc]
add eax, 0xcfbd591
xor eax, 0x22477e6d
cmp eax, 0x1a745e11
jb 0x140072ed0
vmovdqa ymm0, ymmword [r9]
mov eax, dword [0x141f380e0]
and eax, dword [0x141f380e4]
xor eax, 0x416e2101
or eax, 0x16111aa4
imul eax, eax, 0xd372f817
cmp eax, 0x31f44d49
ja 0x140072f24
vpmuludq ymm1, ymm0, ymmword [r8]
vmovdqa ymmword [rcx], ymm1
xor eax, eax
test al, al
je 0x140072f30
vpmuludq ymm1, ymm0, ymmword [r8]
vmovdqa ymmword [rcx], ymm1
jmp 0x140072f15
mov eax, dword [0x141f380e8]
xor edx, edx
div dword [0x141f380ec]
and eax, 0x827f4c14
add eax, 0xce4164f
or eax, 0x522c56af
cmp eax, 0x20aeba64
jb 0x140072f30
vzeroupper
ret
Function at 0x140074820
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x90
lea rbp, [rsp + 0x80]
and rsp, 0xffffffffffffffe0
mov rax, qword [rcx + 0x220]
nop dword [rax + rax]
mov r8d, dword [0x141f38290]
imul r8d, dword [0x141f38294]
add r8d, 0x4d4f90c7
xor r8d, 0x42220580
and r8d, 0x5a2205ec
cmp r8d, 0x655aaadc
je 0x140074840
cmp rax, 3
ja 0x140074929
shl rax, 4
vmovups xmm0, xmmword [rdx]
vmovups xmmword [rcx + rax + 0x1e0], xmm0
mov r8, qword [rcx + 0x220]
nop
mov eax, dword [0x141f38298]
xor edx, edx
div dword [0x141f3829c]
xor eax, 0xe800347b
add eax, 0x9f25e8f9
cmp eax, 0xeb9e7578
ja 0x140074890
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400748c0
cmp r8, 3
jae 0x14007490d
mov eax, dword [0x141f382b8]
xor edx, edx
div dword [0x141f382bc]
inc r8
nop dword [rax + rax]
mov eax, dword [0x141f382c0]
xor edx, edx
div dword [0x141f382c4]
or eax, 0xa2239889
imul eax, eax, 0xaeb57f53
cmp eax, 0x432ea673
je 0x1400748e0
mov qword [rcx + 0x220], r8
lea rsp, [rbp + 0x10]
pop rbp
ret
mov eax, dword [0x141f382a8]
mov edx, dword [0x141f382ac]
add eax, edx
add eax, 0xae0667d
cmp eax, 0x167394b3
jae 0x14007495b
jmp 0x14007496c
ud2
mov qword [rcx + 0x220], 0
xor eax, eax
test al, al
je 0x140074979
mov qword [rcx + 0x220], 0
jmp 0x14007495b
vmovdqa ymm0, ymmword [rcx + 0x1e0]
vmovdqa ymm1, ymmword [rcx + 0x200]
vpunpckhqdq ymm2, ymm0, ymm1
vpermq ymm2, ymm2, 0xd8
vpunpcklqdq ymm0, ymm0, ymm1
vpermq ymm0, ymm0, 0xd8
vpbroadcastd ymm1, dword [0x140108c80]
vpsrlq ymm3, ymm2, 0x28
vpor ymm1, ymm3, ymm1
vpsrlq ymm3, ymm0, 0x2e
vpsllq ymm2, ymm2, 0x12
vpor ymm2, ymm2, ymm3
vpsrlq ymm3, ymm0, 0x1a
vpbroadcastq ymm4, qword [0x140108c88]
vpblendd ymm3, ymm3, ymm2, 0xaa
vpand ymm3, ymm3, ymm4
vpsllq ymm2, ymm2, 0x1a
vpblendd ymm0, ymm0, ymm2, 0xaa
vpand ymm0, ymm0, ymm4
vmovdqa ymmword [rsp + 0x20], ymm0
vmovdqa ymmword [rsp + 0x40], ymm3
vmovdqa ymmword [rsp + 0x60], ymm1
lea rdx, [rsp + 0x20]
vzeroupper
call fcn.140074a30
nop word cs:[rax + rax]
mov eax, dword [0x141f382b0]
imul eax, dword [0x141f382b4]
imul eax, eax, 0xb661a607
cmp eax, 0x8da98027
je 0x140074a10
lea rsp, [rbp + 0x10]
pop rbp
ret
Function at 0x14007d660
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov rbp, rsp
mov eax, dword [0x141f39a98]
sub eax, dword [0x141f39a9c]
add eax, 0x3ea7bdec
or eax, 0x33b4b285
xor eax, 0x27465146
cmp eax, 0xf8fda949
ja 0x14007d6ec
mov eax, dword [0x141f39aa0]
sub eax, dword [0x141f39aa4]
imul eax, eax, 0xfbf25725
mov edx, 0xcec9eedb
imul rdx, rax
shr rdx, 0x3c
xor edx, 0xb593d7e1
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r8, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rcx, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rsi, rsp
cmp edx, 0x96e12ba0
jae 0x14007d718
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
jmp 0x14007d68f
mov qword [rsi], 0
mov eax, dword [0x141f48fb8]
cmp eax, 3
jne 0x14007db41
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
mov edx, 0xb2a65aa3
nop word [rax + rax]
mov r8d, dword [0x141f39aa8]
xor r8d, dword [0x141f39aac]
xor r8d, 0x11537ba
add r8d, 0x48742c4c
shr r8d, 1
imul r8, rdx
shr r8, 0x3b
cmp r8d, 0xb3080880
je 0x14007d740
cmp rax, 3
jne 0x14007d7e0
nop word cs:[rax + rax]
mov eax, dword [0x141f39ab0]
xor edx, edx
div dword [0x141f39ab4]
imul eax, eax, 0x62b44216
or eax, 0xd77f1f6d
imul eax, eax, 0x802ea4f6
cmp eax, 0x1ceb143f
jb 0x14007d780
nop word cs:[rax + rax]
mov eax, dword [0x141f39ab8]
sub eax, dword [0x141f39abc]
imul eax, eax, 0xf9589bea
cmp eax, 0xd0d477bc
je 0x14007d7b0
mov rsi, rcx
jmp 0x14007db8d
mov edx, dword [0x141f39ac0]
xor edx, dword [0x141f39ac4]
xor edx, 0x400
or edx, 0xd6fff9b9
cmp edx, 0x6eca233b
jb 0x14007d7e0
mov rdx, qword [0x141f48fb0]
nop word [rax + rax]
mov r8d, dword [0x141f39ac8]
and r8d, dword [0x141f39acc]
imul r8d, r8d, 0xed8aff9a
cmp r8d, 0x6803bcd6
je 0x14007d810
test rdx, rdx
je 0x14007db69
nop word [rax + rax]
mov edx, dword [0x141f39ae8]
or edx, dword [0x141f39aec]
and edx, 0xd4fc9928
add edx, 0x653e7b3a
xor edx, 0x71c22c36
cmp edx, 0x6671a8c6
ja 0x14007d840
lea rsi, [0x141f48fb0]
cmp rax, 2
jb 0x14007db8d
nop word [rax + rax]
mov eax, dword [0x141f39af0]
xor eax, dword [0x141f39af4]
or eax, 0xc7043bc1
add eax, 0x7415ba4f
cmp eax, 0x11660aad
jb 0x14007d880
mov eax, dword [0x141f39af8]
xor edx, edx
div dword [0x141f39afc]
nop dword [rax + rax]
mov eax, dword [0x141f39b00]
xor edx, edx
div dword [0x141f39b04]
or eax, 0xeeedffda
cmp eax, 0xa95e1e4e
je 0x14007d8b0
mov eax, ecx
and eax, 3
lea rdx, [0x141f266fc]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov qword [rcx], rsi
mov qword [r8], rcx
sub rsp, 0x20
lea rcx, [0x141f48fb8]
lea r9, [0x141f25570]
xor edx, edx
call fcn.1401005d0
add rsp, 0x20
jmp 0x14007d72e
mov eax, dword [0x141f39ad0]
or eax, dword [0x141f39ad4]
add eax, 0x964f1889
or eax, 0x18920019
and eax, 0x3bbad219
cmp eax, 0xfec5f411
jne 0x14007db9e
jmp 0x14007dbc2
mov rax, rsi
mov rsp, rbp
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov eax, dword [0x141f39ad8]
add eax, dword [0x141f39adc]
or eax, 0x9107bbf
add eax, 0xd49b00de
and eax, 0xef4b8018
ud2
ud2
Function at 0x14008e020
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov r8, rdx
mov eax, dword [0x141f3be40]
imul eax, dword [0x141f3be44]
imul eax, eax, 0xc60a385
add eax, 0x33384a24
and eax, 0xa89b1c8d
cmp eax, 0xa22afa35
jae 0x14008e05c
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
xor edx, edx
nop
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rsi, rsp
test dl, dl
jne 0x14008e060
mov qword [rsi], rcx
mov qword [rsi + 8], 0
sub rsp, 0x20
lea rdx, [0x141f255c0]
mov rcx, rsi
call fcn.140055bc0
add rsp, 0x20
mov rsi, qword [rsi + 8]
nop word [rax + rax]
mov ecx, dword [0x141f3be48]
and ecx, dword [0x141f3be4c]
xor ecx, 0x30000051
or ecx, 0x462c35a4
cmp ecx, 0xef3fedcd
ja 0x14008e0a0
test al, al
je 0x14008e100
nop word cs:[rax + rax]
mov eax, dword [0x141f3bec8]
xor eax, dword [0x141f3becc]
and eax, 0x6e9b4024
imul eax, eax, 0x1834546a
or eax, 0xbee20120
cmp eax, 0xb391b9ea
jb 0x14008e0d0
test rsi, rsi
jne 0x14008e19f
ud2
mov eax, dword [0x141f3be50]
sub eax, dword [0x141f3be54]
imul eax, eax, 0x7d6c448b
add eax, 0x665d7f1f
cmp eax, 0x86aa4326
jb 0x14008e100
test rsi, rsi
je 0x14008e19d
nop word cs:[rax + rax]
mov eax, dword [0x141f3be58]
xor eax, dword [0x141f3be5c]
add eax, 0xe2435929
xor eax, 0x5394740d
cmp eax, 0x29fb4616
jb 0x14008e130
mov eax, 0x953dc96f
nop word cs:[rax + rax]
mov ecx, dword [0x141f3be60]
or ecx, dword [0x141f3be64]
xor ecx, 0x6a2f7e08
imul rcx, rax
shr rcx, 0x3d
or ecx, 0xcaff8e4
cmp ecx, 0xb8f9d899
ja 0x14008e160
mov eax, esi
and eax, 3
lea rcx, [0x141f268f4]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
xor esi, esi
mov eax, 0x9ccee03d
nop word cs:[rax + rax]
mov ecx, dword [0x141f3bed0]
xor ecx, dword [0x141f3bed4]
and ecx, 0xc0c3b2d6
imul rcx, rax
shr rcx, 0x3c
cmp ecx, 0xd256abf3
je 0x14008e1b0
mov rax, rsi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008feb0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
nop dword [rax]
mov eax, dword [0x141f3c2d8]
add eax, dword [0x141f3c2dc]
imul eax, eax, 0x95da99ff
add eax, 0x7fab7c7d
and eax, 0x67096f58
cmp eax, 0x4c597ae2
ja 0x14008fed0
nop word cs:[rax + rax]
mov eax, dword [0x141f3c2e0]
mov ecx, dword [0x141f3c2e4]
add eax, ecx
add eax, 0x30c249cf
and eax, 0x73492c27
cmp eax, 0xa163230d
je 0x14008ff00
test rsi, rsi
je 0x14009071d
xor r13d, r13d
lea r14, [0x141f26954]
jmp 0x1b7c54036
int1
or esp, dword [rsi - 0x36c272b4]
push 0xffffffffffffffe9
add dword [rbp - 0x799c1ea9], edi
mov qword [rsp + 0x28], rbx
nop dword [rax]
Function at 0x1400907b0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov eax, dword [0x141f4907c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x48]
cmp rax, 0xffffffffffffffff
je 0x140090a04
lea rcx, [rax + 1]
lea rdx, [rax + rax]
cmp rdx, rcx
cmova rcx, rdx
cmp rcx, 5
mov ebx, 4
cmovae rbx, rcx
mov rsi, rbx
shl rsi, 4
movabs rcx, 0x7ffffffffffffff8
movabs rdx, 0xfffffffffffffff
mov r8d, 0xf591519b
nop word [rax + rax]
mov r9d, dword [0x141f3c418]
add r9d, dword [0x141f3c41c]
shr r9d, 1
imul r11, r9, 0x4e179145
shr r11, 0x3b
add r11d, 0xa7049e3d
imul r11, r8
shr r11, 0x39
cmp rbx, rdx
seta r9b
cmp rsi, rcx
seta r10b
cmp r11d, 0x86cd2fef
ja 0x140090820
or r9b, r10b
jne 0x140090a04
nop dword [rax + rax]
mov ecx, dword [0x141f3c420]
and ecx, dword [0x141f3c424]
xor ecx, 0x6c802900
or ecx, 0x9274c4ff
imul rcx, rcx, 0xb2a8585
shr rcx, 0x3a
cmp ecx, 0xf2627254
je 0x140090870
test rax, rax
je 0x14009090b
xor ecx, ecx
nop word cs:[rax + rax]
test cl, cl
jne 0x1400908b0
mov ecx, dword [0x141f4907c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov rcx, qword [rcx + 0x50]
shl rax, 4
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x38], rax
nop dword [rax]
mov eax, dword [0x141f3c428]
or eax, dword [0x141f3c42c]
add eax, 0x65e731d3
or eax, 0x7251744d
imul eax, eax, 0x3a699a1a
cmp eax, 0x8e48532e
jb 0x1400908e0
mov r14d, 8
jmp 0x14009090e
xor r14d, r14d
mov eax, dword [0x141f3c430]
xor eax, dword [0x141f3c434]
and eax, 0x68856ee0
add eax, 0x90f6fee5
imul rax, rax, 0x39d4272f
shr rax, 0x3c
cmp eax, 0x7d419e0f
ja 0x14009097c
mov eax, dword [0x141f3c438]
xor edx, edx
div dword [0x141f3c43c]
mov edi, eax
xor edi, 0x180d1b8c
add edi, 0xc2294ccd
and edi, 0x18a6f09e
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x40]
lea r9, [rsp + 0x28]
mov edx, 8
mov r8, rsi
call fcn.1400c7170
cmp edi, 0x8bdd65b
jae 0x14009099a
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x40]
lea r9, [rsp + 0x28]
mov edx, 8
mov r8, rsi
call fcn.1400c7170
jmp 0x140090936
cmp qword [rsp + 0x40], 0
jne 0x140090a04
nop word cs:[rax + rax]
mov eax, dword [0x141f3c448]
imul eax, dword [0x141f3c44c]
add eax, 0x6e52be84
imul rax, rax, 0x49ce4311
shr rax, 0x3d
cmp eax, 0x8f251d6f
je 0x1400909b0
mov rax, qword [rsp + 0x48]
mov ecx, dword [0x141f4907c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov qword [rcx + 0x50], rax
mov qword [rcx + 0x48], rbx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
ud2
Function at 0x1400917c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Get system information on windows

Disassembly:
push rbp
push rsi
push rdi
mov rbp, rsp
mov eax, dword [0x141f3c5d8]
xor eax, dword [0x141f3c5dc]
xor eax, 0x1800408
and eax, 0x41c5742a
xor eax, 0x55fcee70
cmp eax, 0x56ba92c
jb 0x14009184a
mov eax, dword [0x141f3c5e0]
and eax, dword [0x141f3c5e4]
or eax, 0x3b603a41
imul edi, eax, 0x57a7bcd
imul rax, rdi, 0x2786f4d
shr rax, 0x20
sub edi, eax
shr edi, 1
add edi, eax
shr edi, 0x1e
mov eax, 0x30
call fcn.1400f4d10
sub rsp, rax
mov rsi, rsp
xorps xmm0, xmm0
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
sub rsp, 0x20
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
add rsp, 0x20
cmp edi, 0xc27bbf45
jbe 0x14009187b
mov eax, 0x30
call fcn.1400f4d10
sub rsp, rax
mov rcx, rsp
xorps xmm0, xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx], xmm0
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
add rsp, 0x20
jmp 0x1400917e8
mov ecx, dword [rsi + 0x20]
nop
mov eax, dword [0x141f3c5e8]
xor eax, dword [0x141f3c5ec]
imul rdx, rax, 0x31048a1
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1e
or eax, 0xcf566e7c
cmp eax, 0x70d9d104
je 0x140091880
xor eax, eax
test rcx, rcx
sete al
lea rdx, [0x141f25c50]
cmovne rdx, rcx
mov rsp, rbp
pop rdi
pop rsi
pop rbp
ret