joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140077720
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r8d, 0xaebed8d1
mov eax, dword [0x141dccde8]
xor edx, edx
div dword [0x141dccdec]
add eax, 0x174db2c4
shr eax, 1
imul rax, r8
shr rax, 0x3e
or eax, 0x3aa0fc2c
cmp eax, 0xc2582310
ja 0x140077730
mov r14, qword [rcx]
mov rsi, qword [r14 + 0x80]
and rsi, 0xfffffffffffffff8
mov eax, dword [0x141dccdf0]
xor edx, edx
div dword [0x141dccdf4]
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x140077780
cmp qword [rsi + 8], 0
je 0x140077885
nop
mov eax, dword [0x141dccdf8]
or eax, dword [0x141dccdfc]
add eax, 0x10ac7ef6
xor eax, 0x33147e19
imul rcx, rax, 0x1ad4ea87
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
cmp eax, 0x14751f63
ja 0x140077790
mov rdi, qword [rsi]
mov eax, dword [0x141dcce00]
sub eax, dword [0x141dcce04]
or eax, 0xe5a95cc6
add eax, 0xfbd7bd76
imul rax, rax, 0x7241449b
shr rax, 0x3b
cmp eax, 0x5d74464c
ja 0x140077815
mov eax, dword [0x141dcce08]
sub eax, dword [0x141dcce0c]
xor eax, 0x3e2a36f6
add eax, 0xae6859c7
and eax, 0xc2033d85
mov rbx, qword [0x141ddc4e0]
cmp eax, 0xe0ace934
jbe 0x14007781e
mov rax, qword [0x141ddc4e0]
jmp 0x1400777ec
mov eax, dword [0x141dcce10]
imul eax, dword [0x141dcce14]
xor eax, 0xc90ad20a
or eax, 0x30f50cc5
add eax, 0x26b81625
cmp eax, 0x4830a6d3
ja 0x140077875
mov ebp, dword [0x141dcce18]
xor ebp, dword [0x141dcce1c]
add ebp, 0x8efaff3b
and ebp, 0x6f948c20
add ebp, 0x2c6e77f9
mov rcx, rbx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebp, 0x197f5225
jae 0x140077885
mov rcx, rbx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140077841
mov eax, dword [0x141dcce20]
imul eax, dword [0x141dcce24]
or eax, 0x9574a5f1
and eax, 0xb574a5fd
cmp eax, 0xf7c7654b
ja 0x1400778d5
mov edi, dword [0x141dcce28]
and edi, dword [0x141dcce2c]
and edi, 0x5ff46011
add edi, 0xa9798369
mov rcx, qword [0x141ddc4e0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp edi, 0xeca0aca4
jae 0x1400778e9
mov rcx, qword [0x141ddc4e0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400778a3
cmp r14, 0xffffffffffffffff
je 0x140077941
lea rax, [r14 + 8]
nop word cs:[rax + rax]
mov ecx, dword [0x141dcce30]
and ecx, dword [0x141dcce34]
add ecx, 0x22e87508
or ecx, 0x3c6b9bf
add ecx, 0xf9501b35
cmp ecx, 0xa8d335bf
ja 0x140077900
lock dec qword [rax]
jne 0x140077941
mov eax, dword [0x141dcce38]
xor eax, dword [0x141dcce3c]
cmp eax, 0xc2e8bee2
jne 0x14007794c
jmp 0x140077952
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
xor eax, eax
test al, al
je 0x140077954
jmp 0x14007794c
mov r8, qword [r14 - 8]
mov rcx, qword [0x141ddc4e0]
xor edx, edx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
Function at 0x1400780e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
nop dword [rax + rax]
mov eax, dword [0x141dccf60]
and eax, dword [str.53tZRg]
xor eax, 0x26772daf
add eax, 0xbdbb2544
or eax, 0xc8e3e33e
cmp eax, 0xcb20634b
jb 0x1400780f0
mov rax, qword [rsi + 0x10]
nop word cs:[rax + rax]
mov ecx, dword [0x141dccf68]
xor ecx, dword [0x141dccf6c]
imul ecx, ecx, 0x5da3be4
imul rcx, rcx, 0x3e5fd2f
shr rcx, 0x39
or ecx, 0x861fc604
cmp ecx, 0xa1e59873
ja 0x140078120
cmp eax, 1
jne 0x1400781ee
mov eax, dword [0x141dccf70]
xor edx, edx
div dword [0x141dccf74]
imul rax, rax, 0xcfa179f
shr rax, 0x3a
xor eax, 0xd9328a19
imul rax, rax, 0xd10c1bf
shr rax, 0x37
cmp eax, 0xaec9307d
ja 0x1400781b6
mov ecx, dword [0x141dccf78]
xor ecx, dword [0x141dccf7c]
add ecx, 0x1a1a5b98
xor ecx, 0x83365000
or ecx, 0x6848afc8
mov r8, qword [rsi + 0x18]
mov rax, qword [rsi + 0x20]
mov byte [r8], 0
cmp ecx, 0x15a780ee
jae 0x1400781c0
mov rax, qword [rsi + 0x18]
mov byte [rax], 0
jmp 0x140078184
mov ecx, dword [0x141dccf80]
add ecx, dword [0x141dccf84]
imul ecx, ecx, 0x65b5886
cmp ecx, 0x57a25207
je 0x1400781c0
test rax, rax
je 0x1400781ee
mov rcx, qword [0x141ddc4e0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp rsi, 0xffffffffffffffff
je 0x1400782c2
lea rax, [rsi + 8]
nop dword [rax]
mov ecx, dword [0x141dccf88]
and ecx, dword [0x141dccf8c]
imul ecx, ecx, 0xcf221288
add ecx, 0x82eaa7c8
cmp ecx, 0x6ae35d6c
jb 0x140078200
lock dec qword [rax]
jne 0x1400782c2
mov eax, dword [0x141dccf90]
or eax, dword [0x141dccf94]
xor eax, 0xf5d0c800
shr eax, 7
imul rax, rax, 0x2af523d
shr rax, 0x2f
imul eax, eax, 0x5d6fcd1d
cmp eax, 0xc04d1698
jae 0x140078260
nop word cs:[rax + rax]
mov eax, dword [0x141dccf98]
imul eax, dword [0x141dccf9c]
or eax, 0x4896dd47
imul eax, eax, 0x3bcf15e6
and eax, 0x6c61b232
cmp eax, 0x79afba41
je 0x140078260
mov rcx, qword [0x141ddc4e0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov eax, dword [0x141dccfa0]
xor eax, dword [0x141dccfa4]
or eax, 0x34520241
and eax, 0xf75b5341
add eax, 0x6e06184d
cmp eax, 0xd86e3c64
ja 0x1400782a0
add rsp, 0x20
pop rsi
ret
Function at 0x1400782d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov eax, 0xb6f4d9e3
nop
mov ecx, dword [0x141dccfa8]
sub ecx, dword [0x141dccfac]
imul rcx, rax
shr rcx, 0x3f
imul ecx, ecx, 0xf8e7fb0d
and ecx, 0x57342ea6
cmp ecx, 0xfad4b9f
ja 0x1400782e0
mov eax, dword [0x141dccfb0]
and eax, dword [0x141dccfb4]
mov rcx, qword [rsi]
xor eax, 0x50000008
and eax, 0xf080005c
cmp eax, 0xbe3895aa
jb 0x14007835c
mov eax, dword [0x141dccfb8]
xor eax, dword [0x141dccfbc]
and eax, 0xc4c119c8
add eax, 0x2d123b8a
imul rdx, rax, 0x1525ad2d
shr rdx, 0x3c
mov rax, qword [rcx + 0x10]
lock dec qword [rax]
sete al
cmp edx, 0x4f875c46
jne 0x140078366
mov rax, qword [rcx + 0x10]
lock dec qword [rax]
jmp 0x140078328
test al, al
je 0x140078430
mov eax, dword [0x141dccfc0]
xor edx, edx
div dword [0x141dccfc4]
and eax, 0x79b92051
imul eax, eax, 0xf2ea3f4f
cmp eax, 0xe8badfe7
je 0x1400783b4
mov eax, dword [0x141dccfc8]
sub eax, dword [0x141dccfcc]
shr eax, 3
imul rax, rax, 0x1076966d
shr rax, 0x39
or eax, 0x59c180d2
cmp eax, 0x74a55681
jbe 0x1400783b6
jmp 0x14007838e
mov rdi, qword [rcx + 0x10]
mov eax, dword [0x141dccfd0]
xor edx, edx
div dword [0x141dccfd4]
xor eax, 0x57548cce
mov ecx, 0xa0ef320b
imul rcx, rax
shr rcx, 0x3f
or ecx, 0xd234db94
cmp ecx, 0x824550bd
jb 0x14007841a
mov eax, dword [0x141dccfd8]
xor edx, edx
div dword [0x141dccfdc]
mov ebx, eax
and ebx, 0x284a0601
xor ebx, 0x90a0005
or ebx, 0xd6b5f9f8
mov rcx, rdi
call fcn.1400780e0
cmp ebx, 0x67caf3c0
jae 0x140078430
mov rcx, rdi
call fcn.1400780e0
jmp 0x1400783e8
mov eax, dword [0x141dccfe0]
or eax, dword [0x141dccfe4]
xor eax, 0x2b0cec
and eax, 0xc33b2eec
add eax, 0xe10a462d
cmp eax, 0xab3d731
jb 0x140078430
mov r8, qword [rsi]
cmp r8, 0xffffffffffffffff
je 0x1400784b3
mov rax, 0xffffffffffffffff
lock xadd qword [r8 + 8], rax
nop dword [rax + rax]
mov ecx, dword [0x141dccfe8]
xor ecx, dword [0x141dccfec]
add ecx, 0x8a78bcf4
xor ecx, 0x90604448
or ecx, 0x6c9aa2a5
cmp ecx, 0x5f2cd461
je 0x140078470
cmp rax, 1
jne 0x1400784b3
mov rcx, qword [0x141ddc4e0]
xor edx, edx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x14007a750
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov eax, dword [0x141dcd4b8]
and eax, dword [0x141dcd4bc]
xor eax, 0xa62f33a4
imul eax, eax, 0x37fbd2d5
shr eax, 2
imul rax, rax, 0x539cad21
shr rax, 0x3a
cmp eax, 0xf668fb3a
ja 0x14007a7c1
mov edx, dword [0x141dcd4c0]
or edx, dword [0x141dcd4c4]
add edx, 0xa6e4eab5
or edx, 0x8ffffe87
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov rsi, rsp
cmp edx, 0xcdb82a54
jbe 0x14007a7d0
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
jmp 0x14007a791
mov eax, dword [0x141dcd4c8]
add eax, dword [0x141dcd4cc]
imul eax, eax, 0xf44e1a61
or eax, 0xe28251de
and eax, 0xf78b57ff
cmp eax, 0x40743c3b
jne 0x14007a820
mov eax, 0x60
call fcn.1400f07c0
sub rsp, rax
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov rax, qword [rcx]
mov qword [rax], 0
nop word [rax + rax]
mov eax, dword [0x141dcd4d0]
sub eax, dword [0x141dcd4d4]
and eax, 0xda0e6344
xor eax, 0x44e0513b
imul rdx, rax, 0x271b7d51
shr rdx, 0x3d
mov eax, 0x60
call fcn.1400f07c0
sub rsp, rax
mov rbx, rsp
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov rdi, rsp
mov rax, qword [rcx]
mov r14, qword [rax]
mov qword [rax], 0
cmp edx, 0xe1e58085
je 0x14007a820
test r14, r14
je 0x14007a8a3
mov eax, dword [0x141dcd4e0]
or eax, dword [0x141dcd4e4]
imul eax, eax, 0x6c925aad
add eax, 0xc92ce872
and eax, 0x36c9004b
cmp eax, 0xde325cd
jne 0x14007a8d4
jmp 0x14007a942
ud2
Function at 0x140083590
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rax, qword [rcx]
cmp rax, 3
jne 0x1400836e3
mov eax, dword [0x141dce6a0]
xor edx, edx
div dword [0x141dce6a4]
add rcx, 8
nop dword [rax + rax]
mov eax, dword [0x141dce6a8]
imul eax, dword [0x141dce6ac]
add dword [rcx - 0x40], ebp
xor byte [rbx], ah
invalid
rol dword [0x1ab151a38], cl
or eax, 0xf9bd66f6
cmp eax, 0x9f203883
jb 0x1400835c0
mov eax, dword [0x141dce6b0]
sub eax, dword [0x141dce6b4]
add eax, 0x84fc2853
or eax, 0xb266116f
add eax, 0x9acc79a0
cmp eax, 0xcd2dac84
jbe 0x140083610
mov rax, qword [rcx]
lock dec qword [rax]
nop dword [rax]
mov eax, dword [0x141dce6b8]
imul eax, dword [0x141dce6bc]
imul edx, eax, 0x45e844b0
mov r8, qword [rcx]
mov rax, 0xffffffffffffffff
lock xadd qword [r8], rax
cmp edx, 0x4c27afb8
je 0x140083610
nop word [rax + rax]
mov edx, dword [0x141dce6c0]
and edx, dword [0x141dce6c4]
add edx, 0x53ad1507
xor edx, 0x4040041
or edx, 0xe97bc3ba
cmp edx, 0xfc931c27
ja 0x140083640
cmp rax, 1
jne case.0x14008375e.0
mov eax, dword [0x141dce6c8]
imul eax, dword [0x141dce6cc]
add dword [rcx - 0x40], ebp
adc ecx, dword [rdx + 0x3a054e0a]
movabs dword [0x1733dcb5acd3d85], eax
invalid
jae 0x140083690
cmp eax, 2
jb case.0x14008375e.0
mov rax, qword [rcx + 8]
Function at 0x140084090
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
nop word cs:[rax + rax]
mov eax, dword [0x141dce8a0]
add eax, dword [0x141dce8a4]
imul eax, eax, 0x7ad0cd8a
or eax, 0xe1bc4f1b
xor eax, 0xf352a06c
cmp eax, 0xe119ab
jb 0x1400840b0
mov rax, qword [r8 + 8]
nop word [rax + rax]
mov ecx, dword [0x141dce8a8]
and ecx, dword [0x141dce8ac]
and ecx, 0xc2199b71
cmp ecx, 0xce2c7ac8
je 0x1400840e0
test rax, rax
je 0x1400841ce
mov rbx, qword [r8]
mov rax, qword [r8 + 0x10]
mov ecx, 0xfa8b6c77
nop
mov edx, dword [0x141dce8b0]
imul edx, dword [0x141dce8b4]
add edx, 0x897a6b3a
imul rdx, rcx
shr rdx, 0x3d
cmp edx, 0x4fde39a0
je 0x140084110
test rax, rax
je 0x1400841fb
mov r14, qword [0x141ddc4e0]
mov eax, dword [0x141dce8c8]
or eax, dword [0x141dce8cc]
add eax, 0xc3bfec89
or eax, 0xfea219d3
mov ecx, 0xe477f1d1
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0x532a906b
jne 0x14008417f
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov r15d, 0x82040689
mov r12, qword [sym.imp.KERNEL32.dll_HeapReAlloc]
nop dword [rax]
mov eax, dword [0x141dce8d0]
add eax, dword [0x141dce8d4]
imul r13d, eax, 0xe3ff6199
imul r13, r15
shr r13, 0x3e
add r13d, 0x3f012c67
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9, rsi
call r12
cmp r13d, 0xa3f39fbb
ja 0x140084190
jmp 0x1400842b0
test rsi, rsi
je 0x14008426b
mov eax, dword [0x141dce8d8]
sub eax, dword [0x141dce8dc]
imul eax, eax, 0x835b3770
and eax, 0x6a915db0
cmp eax, 0x21af2af2
je 0x14008429d
jmp 0x140084272
test rsi, rsi
je 0x14008426b
mov eax, dword [0x141dce8b8]
imul eax, dword [0x141dce8bc]
imul rcx, rax, 0x6bf4625
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
or eax, 0x48544a0e
xor eax, 0xe292223a
cmp eax, 0xe126e985
jbe 0x140084240
movzx eax, byte [0x141ddc4f8]
nop dword [rax]
mov eax, dword [0x141dce8c0]
and eax, dword [0x141dce8c4]
or eax, 0xb36002
xor eax, 0x20034833
or eax, 0xd94c86cc
movzx ecx, byte [0x141ddc4f8]
cmp eax, 0x1a79dc1
jb 0x140084240
jmp 0x1400842a6
mov eax, 8
jmp 0x1400842b0
mov eax, dword [0x141dce8e0]
xor edx, edx
div dword [0x141dce8e4]
xor eax, 0xdae9c96f
add eax, 0x8cd218c4
or eax, 0x24e23561
movzx ecx, byte [0x141ddc4f8]
cmp eax, 0xc38d14b8
jbe 0x1400842a6
movzx eax, byte [0x141ddc4f8]
jmp 0x140084272
xor ecx, ecx
mov rdx, rsi
call fcn.1400c0a10
mov ecx, dword [0x141dce8e8]
xor ecx, dword [str.N7z72_]
and ecx, 0x66b7a83
add ecx, 0x2ef3f003
and ecx, 0x1966f880
cmp ecx, 0x72066e17
jbe 0x1400842f2
xor ecx, ecx
test rax, rax
mov edx, 8
cmovne rdx, rax
sete cl
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rsi
mov qword [rdi], rcx
mov ecx, 8
nop word [rax + rax]
mov edx, dword [0x141dce8f0]
sub edx, dword [0x141dce8f4]
add edx, 0x7d13f91c
imul rdx, rdx, 0x4c50b2ed
shr rdx, 0x3e
xor edx, 0x4ce78f0f
xor r8d, r8d
test rax, rax
sete r8b
mov r9, rax
cmove r9, rcx
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], rsi
mov qword [rdi], r8
cmp edx, 0xa600e1ac
ja 0x140084300
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400893a0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov r8, rdx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0
add byte [rax], al
Function at 0x14008c830
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov eax, 0xbb547215
nop dword [rax + rax]
mov r8d, dword [0x141dcfb60]
xor r8d, dword [0x141dcfb64]
or r8d, 0x2e160559
add r8d, 0x869b26a5
imul r8, rax
shr r8, 0x3f
cmp r8d, 0xf6dab8db
ja 0x14008c840
test dl, dl
je 0x14008c8c2
mov eax, dword [0x141dcfb68]
or eax, dword [0x141dcfb6c]
imul eax, eax, 0xda48cb0
add eax, 0x58bb793c
cmp eax, 0xe973ad17
jbe 0x14008c8a0
mov byte [rcx + 0x10], 1
nop word cs:[rax + rax]
mov eax, dword [0x141dcfb70]
imul eax, dword [0x141dcfb74]
add eax, 0x4e22ba39
or eax, 0xe1cd955e
mov byte [rcx + 0x10], 1
cmp eax, 0x67aebc
je 0x14008c8a0
lock dec qword [rcx + 8]
jne 0x14008ca28
mov eax, dword [0x141dcfb78]
xor eax, dword [0x141dcfb7c]
xor eax, 0x40411c05
or eax, 0xbe14e260
cmp eax, 0xbb2acf06
jne 0x14008c900
mov rax, qword [rcx]
mov dl, 1
xchg byte [rax + 0x30], dl
nop word cs:[rax + rax]
mov eax, dword [0x141dcfb80]
or eax, dword [0x141dcfb84]
xor eax, 0x43412fee
imul edx, eax, 0xfabb1210
mov rsi, qword [rcx]
mov al, 1
xchg byte [rsi + 0x30], al
cmp edx, 0x936dc8b
je 0x14008c900
add rsi, 0x30
nop dword [rax + rax]
mov ecx, dword [0x141dcfb88]
and ecx, dword [str.1r_v__]
and ecx, 0x42a59001
or ecx, 0x99106fb6
imul ecx, ecx, 0x7c75007d
cmp ecx, 0xca2edb3d
je 0x14008c930
nop word cs:[rax + rax]
mov ecx, dword [0x141dcfb90]
add ecx, dword [0x141dcfb94]
imul rcx, rcx, 0x7c366d7d
shr rcx, 0x3c
xor ecx, 0xca67b4c4
imul rcx, rcx, 0x3dd4a65b
shr rcx, 0x3d
cmp ecx, 0x967e3b10
je 0x14008c960
cmp al, 0xff
jne 0x14008ca28
mov eax, dword [0x141dcfb98]
or eax, dword [0x141dcfb9c]
imul rax, rax, 0x68913d49
shr rax, 0x39
imul eax, eax, 0xf8b2a9e4
add eax, 0x4f62e92c
cmp eax, 0xc3a46f45
jb 0x14008c9e8
mov eax, dword [0x141dcfba0]
xor edx, edx
div dword [0x141dcfba4]
mov edi, eax
add edi, 0xbc0080ce
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
cmp edi, 0xefc21d8a
jbe 0x14008ca00
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
jmp 0x14008c9c1
mov eax, dword [0x141dcfba8]
xor eax, dword [str..b0_n]
add eax, 0x8430e5c5
xor eax, 0xf9ae4f8b
imul rax, rax, 0x720a9985
shr rax, 0x3a
cmp eax, 0x9705b09a
ja 0x14008ca00
mov eax, 0x8729b44b
nop dword [rax]
mov ecx, dword [0x141dcfbb0]
or ecx, dword [0x141dcfbb4]
imul ecx, ecx, 0x35197f4a
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0x904ea7b2
je 0x14008ca30
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14008cdf0
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rsi
push rdi
mov rbp, rsp
mov eax, dword [0x141dcfc30]
or eax, dword [0x141dcfc34]
imul eax, eax, 0x99cfd3fb
add eax, 0xef932e23
cmp eax, 0x26675187
jb 0x14008ce70
mov eax, dword [0x141dcfc38]
sub eax, dword [0x141dcfc3c]
mov ecx, 0x91a58389
imul rcx, rax
shr rcx, 0x3f
imul edi, ecx, 0xc5b1e714
add edi, 0x688ca73d
mov eax, 0x30
call fcn.1400f07c0
sub rsp, rax
mov rsi, rsp
xorps xmm0, xmm0
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
sub rsp, 0x20
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
add rsp, 0x20
cmp edi, 0xe41eedd8
jbe 0x14008cea1
mov eax, 0x30
call fcn.1400f07c0
sub rsp, rax
mov rcx, rsp
xorps xmm0, xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx], xmm0
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
add rsp, 0x20
jmp 0x14008ce14
lea rcx, [0x141dbab88]
xor r8d, r8d
nop dword [rax + rax]
mov edx, dword [rsi + 0x20]
xor eax, eax
test rdx, rdx
sete r9b
cmove rdx, rcx
test r8b, r8b
jne 0x14008ceb0
mov al, r9b
mov rsp, rbp
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008eb10
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
movzx ebp, byte [rdx + 0x38]
mov r8, rdx
nop word [rax + rax]
mov eax, dword [0x141dd0020]
or eax, dword [0x141dd0024]
add eax, 0x364d91ab
and eax, 0x520a0922
cmp eax, 0x94491c8a
ja 0x14008eb30
cmp bpl, 3
je 0x14008eb7f
movzx ebx, byte [r8 + 0x39]
movzx r9d, byte [r8 + 0x10]
xor edx, edx
cmp r9, 3
setae r10b
mov r11, qword [r8 + 0x30]
lea rax, [r11 + 1]
test r11, r11
cmove rax, r11
cmp bl, 3
jne 0x14008ec14
mov dl, r10b
lea edx, [rdx + rdx*2]
add edx, 7
mov dword [rsp + 0x24], edx
movzx edx, byte [r8 + 0x3a]
mov byte [rsp + 7], dl
mov rdx, qword [r8 + 0x20]
lea r10, [rdx + 4]
lea r11, [rdx + rax + 2]
mov qword [rsp + 0x18], r11
add rax, rdx
add rax, 8
mov qword [rsp + 0x10], rax
mov eax, dword [0x141dd0028]
xor edx, edx
div dword [0x141dd002c]
nop word cs:[rax + rax]
mov eax, dword [0x141dd0030]
or eax, dword [0x141dd0034]
imul eax, eax, 0xd92dfae4
shr eax, 2
imul rax, rax, 0x4137d7bb
shr rax, 0x3a
xor eax, 0x1b0e96d6
cmp eax, 0xc31fc0cd
ja 0x14008ec60
mov qword [rsp + 8], r10
mov rdi, qword [r8 + 8]
mov r10, qword [r8]
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x14008eca0
mov r12d, 0xaf25aabb
xor r13d, r13d
mov esi, 0xa179cba3
mov r11, rdi
cmp bpl, bl
ja 0x14008eb7f
nop

Function at 0x14008f860
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov eax, 0xa7083927
nop dword [rax]
mov ecx, dword [0x141dd01d8]
or ecx, dword [0x141dd01dc]
xor ecx, 0x41609d83
add ecx, 0x3448aad
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x687696db
ja 0x14008f880
movzx ecx, byte [rsi]
lea eax, [rcx - 6]
movzx eax, al
lea r8, [rax + 1]
nop word cs:[rax + rax]
mov edx, dword [0x141dd01e0]
and edx, dword [0x141dd01e4]
imul rdx, rdx, 0x22a7bc81
shr rdx, 0x3c
imul r9d, edx, 0x4936cfc3
cmp al, 4
mov edx, 0
cmovb rdx, r8
cmp r9d, 0xeeabb76d
je 0x14008f8c0
xor eax, eax
nop word cs:[rax + rax]

Function at 0x140090050
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov r8, rdx
nop
mov eax, dword [0x141dd0318]
mov edx, dword [0x141dd031c]
add eax, edx
add eax, 0x55f048ce
or eax, 0xf1cc2b4
cmp eax, 0x39ed41e7
je 0x140090060
movzx r10d, byte [r8 + 0x38]
movzx eax, byte [r8 + 0x3a]
test al, al
setne r9b
nop
mov edx, dword [0x141dd0320]
imul edx, dword [0x141dd0324]
add edx, 0xc610133d
or edx, 0x7b3625a9
xor edx, 0xffc2cc69
cmp edx, 0x23b0de97
ja 0x140090090
cmp r10b, 1
ja 0x1400902be
nop word cs:[rax + rax]
xor r9d, r9d
xor edx, edx
Function at 0x140094360
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov rbp, rsp
mov rbx, rdx
mov rsi, rcx
mov eax, dword [0x141dd0c30]
sub eax, dword [0x141dd0c34]
add dword [rcx - 0x40], ebp
invalid
int 0xd3
out dx, eax
xor eax, 0xea9ca6a5
mov ecx, 0xce8adb6d
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0xa200bab
ja 0x1400943d4
Function at 0x140098fd0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rsi, rcx
mov eax, dword [0x141dd1588]
xor eax, dword [0x141dd158c]
imul eax, eax, 0x30f880b4
xor eax, 0x72598091
imul rax, rax, 0x15a260db
imul eax, eax, 0x15a260db
Function at 0x14009b1c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov rdi, rdx
mov eax, dword [0x141dd19f0]
xor edx, edx
div dword [0x141dd19f4]
nop word cs:[rax + rax]
mov eax, dword [0x141dd19f8]
sub eax, dword [0x141dd19fc]
add eax, 0x5bbc9343
or eax, 0x5dddc414
cmp eax, 0x12b538f2
jb 0x14009b1f0
mov eax, dword [0x141dd1a00]
xor edx, edx
div dword [0x141dd1a04]
mov qword [rsp + 0x28], rcx
mov eax, 0x995ffd2b
nop word cs:[rax + rax]
add byte [rax], al
invalid

Function at 0x14009d880
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rsi, rdx
invalid
mov rdi, rcx
mov eax, dword [0x141dd1f20]
or eax, dword [0x141dd1f24]
imul rax, rax, 0x653e45e9
shr rax, 0x3e
or eax, 0x57fbf6e4
cmp eax, 0x52785ded
jb 0x14009d8f0
mov eax, dword [0x141dd1f28]
sub eax, dword [0x141dd1f2c]
and eax, 0xa032a88d
or eax, 0x48cc5462
imul rbx, rax, 0x3d68aaaf
shr rbx, 0x3d
lea rcx, [rsp + 0x28]
mov rdx, rdi
mov r8, rsi
call fcn.14009e030
cmp ebx, 0x7a700985
jbe 0x14009d902
lea rcx, [rsp + 0x28]
mov rdx, rdi
mov r8, rsi
call fcn.14009e030
jmp 0x14009d8b7
mov eax, dword [0x141dd1f30]
xor edx, edx
div dword [0x141dd1f34]

Function at 0x14009dcd0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
nop word [rax + rax]
invalid

Function at 0x14009e030
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd0
mov rbx, r8
mov r14, rdx
mov rsi, rcx
lea rcx, [rsp + 0x78]
xor r9d, r9d

Function at 0x14009e910
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov r10, r8
mov r14, rdx
mov rsi, rcx
mov eax, dword [0x141dd2188]
xor eax, dword [0x141dd218c]
cmp eax, 0xf3aed950
je 0x14009e9ac

Function at 0x14009f3d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rbx, r8