joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400936a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r8, rdx
nop word cs:[rax + rax]
mov eax, dword [0x141f3ca20]
or eax, dword [0x141f3ca24]
or eax, 0xa80f0
xor eax, 4
and eax, 0x103a80f4
cmp eax, 0xd9217c18
ja 0x1400936c0
movzx ebp, byte [r8 + 0x38]
nop word cs:[rax + rax]
mov eax, dword [0x141f3ca28]
and eax, dword [0x141f3ca2c]
or eax, 0x48585544
and eax, 0x68db5566
imul eax, eax, 0x7f87cf62
cmp eax, 0x52b3fd8
jb 0x1400936f0
cmp bpl, 3
je 0x1400937e7
movzx ebx, byte [r8 + 0x39]
movzx r10d, byte [r8 + 0x10]
xor eax, eax
cmp r10, 3
setae al
lea eax, [rax + rax*2 + 7]
mov dword [rsp + 0x1c], eax
movzx eax, byte [r8 + 0x3a]
mov byte [rsp + 7], al
mov r11, qword [r8 + 0x20]
mov rax, qword [r8 + 0x30]
lea rdi, [r11 + 2]
lea rdx, [rax + 1]
nop word cs:[rax + rax]
mov r9d, dword [0x141f3ca30]
or r9d, dword [0x141f3ca34]
add r9d, 0x34c61d5b
or r9d, 0x30fcd9fe
imul esi, r9d, 0x3574b575
test rax, rax
mov r9, rdx
cmove r9, rax
cmp esi, 0xdc1d119f
je 0x140093760
mov eax, dword [0x141f3ca38]
xor edx, edx
div dword [0x141f3ca3c]
cdq
xchg edx, eax
invalid
invalid

Function at 0x140094440
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov eax, dword [0x141f3cc08]
xor edx, edx
div dword [0x141f3cc0c]
mov rsi, rcx
mov ecx, 0xab51fef3
xor r8d, r8d
nop word cs:[rax + rax]
mov r9d, dword [0x141f3cc10]
xor r9d, dword [0x141f3cc14]
and r9d, 0xde6c3fef
imul r9, rcx
shr r9, 0x3f
movzx eax, byte [rsi]
lea edx, [rax - 6]
movzx r10d, dl
lea rdx, [r10 + 1]
cmp r10b, 4
cmovae rdx, r8
cmp r9d, 0xfa069158
je 0x140094470
movzx r8d, byte [rdi]
lea ecx, [r8 - 6]
movzx r9d, cl
nop dword [rax + rax]
mov ecx, dword [0x141f3cc18]
and ecx, dword [0x141f3cc1c]
and ecx, 0xf420732
add ecx, 0xc9a4ea7b
cmp ecx, 0xede5964a
ja 0x1400944c0
lea rcx, [r9 + 1]
xor r10d, r10d
nop word [rax + rax]
mov ebx, dword [0x141f3cc20]
xor ebx, dword [0x141f3cc24]
or ebx, 0x40193019
and ebx, 0x78793019
xor ebx, 0xfa9d4ad1
cmp r9b, 4
mov r11, rcx
cmovae r11, r10
cmp ebx, 0xe475955e
ja 0x1400944f0
cmp rdx, r11

Function at 0x140094b30
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov r8, rdx
xor eax, eax
nop dword [rax + rax]
test al, al
jne 0x140094b40
movzx r11d, byte [r8 + 0x38]
movzx r10d, byte [r8 + 0x3a]
test r10b, r10b
setne r9b
cmp r11b, 1
ja 0x140094dc8
nop
mov eax, dword [0x141f3cd08]
xor edx, edx
div dword [0x141f3cd0c]
and eax, 0x20041620
xor eax, 0x3c441080
cmp eax, 0x419a7b20
ja 0x140094b60
test r10b, r10b
jne 0x140094c7a
nop dword [rax + rax]
mov eax, dword [0x141f3cd10]
xor edx, edx
div dword [0x141f3cd14]
add eax, 0x3eb011c9
xor eax, 0x41dd0999
or eax, 0x3622c406
cmp eax, 0xb60de90c
ja 0x140094b90
movzx edx, byte [r8 + 0x10]
lea eax, [rdx - 5]
nop dword [rax]
mov r10d, dword [0x141f3cd18]
xor r10d, dword [0x141f3cd1c]
imul r10d, r10d, 0x13e6f43a
add r10d, 0x5c408a5e
cmp r10d, 0x30056a47
jb 0x140094bc0
cmp al, 1
ja 0x140094c7a
invalid
mov rsi, qword [r8]
mov r10, qword [r8 + 8]
xor eax, eax
test r11b, r11b
xor r9d, r9d
xor r10d, r10d
Function at 0x14009ef90
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
Function at 0x14009f6f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x138
lea rbp, [rsp + 0x80]
mov rdi, rdx

Function at 0x1400a0f40
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
add byte [rax], al

Function at 0x1400a3450
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x141f3eb10]
xor edx, edx
div dword [0x141f3eb14]
imul eax, eax, 0x843e925e
add eax, 0x3043f604
cmp eax, 0x62536b5a
ja 0x1400a3460
mov eax, dword [0x141f3eb18]
xor eax, dword [0x141f3eb1c]
add eax, 0x5420d453
or eax, 0xecc2c1af
add eax, 0x41098e4f
cmp eax, 0x2b393aee
jb 0x1400a34d2
Function at 0x1400a5600
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
nop dword [rax + rax]
mov eax, dword [0x141f3f060]
xor edx, edx
div dword [0x141f3f064]
and eax, 0xa88beac7
imul rax, rax, 0x14c973d9
shr rax, 0x39
cmp eax, 0xb8655e8d
je 0x1400a5610
mov eax, dword [0x141f3f068]
xor edx, edx
div dword [0x141f3f06c]
nop word cs:[rax + rax]
mov eax, dword [0x141f3f070]
xor eax, dword [0x141f3f074]
xor eax, 0x41404c
and eax, 0xa57f06c
imul rax, rax, 0x6858837
shr rax, 0x34
cmp eax, 0x521c46a9
je 0x1400a5650
cmp qword [rsi + 0x18], 0
je 0x1400a5730
mov rdi, qword [rsi + 0x20]
mov rbx, qword [0x141f49060]
mov eax, dword [0x141f3f078]
and eax, dword [0x141f3f07c]
xor eax, 0x384c0ee5
imul eax, eax, 0x2470d381
or eax, 0xcfd83073
cmp eax, 0x23f93bb2
jb 0x1400a56e4
mov eax, dword [0x141f3f080]
add eax, dword [0x141f3f084]
xor eax, 0xdc011564
imul ebp, eax, 0xf76dbdf9
or ebp, 0x7b5ecbe8
mov rcx, rbx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebp, 0x1b698a38
jae 0x1400a56f4
mov rcx, rbx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400a56b1
mov eax, 0xa53b3dd1
nop dword [rax]
mov ecx, dword [0x141f3f088]
and ecx, dword [0x141f3f08c]
imul ecx, ecx, 0xd8b369f6
add ecx, 0x37e28f26
imul rcx, rax
shr rcx, 0x3c
cmp ecx, 0x7275845e
ja 0x1400a5700
nop dword [rax + rax]
mov eax, dword [0x141f3f090]
xor edx, edx
div dword [0x141f3f094]
and eax, 0x4df085a
cmp eax, 0xd818e34f
je 0x1400a5730
cmp rsi, 0xffffffffffffffff
je 0x1400a5793
lock dec qword [rsi + 8]
jne 0x1400a5793
mov rcx, qword [0x141f49060]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov eax, dword [0x141f3f098]
and eax, dword [0x141f3f09c]
imul eax, eax, 0xc74e6856
add eax, 0x1da74bac
or eax, 0x268b58e8
cmp eax, 0xf583ccab
je 0x1400a5770
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400a7a60
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
Function at 0x1400b9b40
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
xor eax, eax
nop dword [rax + rax]
test al, al
jne 0x1400b9b60
nop word cs:[rax + rax]
mov eax, dword [0x141f41488]
xor edx, edx
div dword [0x141f4148c]
xor eax, 0x2110a603
and eax, 0xa111e7a7
add eax, 0x42bdea51
cmp eax, 0xfcecd554
ja 0x1400b9b70
mov rax, qword [rdi + 0x40]
test rax, rax
je 0x1400b9c30
dec rax
mov qword [rdi + 0x40], rax
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x1400b9bb0
cmp qword [rdi], 0
je 0x1400ba281
nop
mov eax, dword [0x141f414f8]
or eax, dword [0x141f414fc]
add eax, 0xcdc2cc6
or eax, 0x30d6977d
cmp eax, 0xac0c2f85
je 0x1400b9bc0
mov rbx, qword [rdi + 8]
mov r15, qword [rdi + 0x18]
lea rcx, [rdi + 0x10]
test rbx, rbx
je 0x1400b9cd0
nop word cs:[rax + rax]
mov eax, dword [0x141f41500]
xor eax, dword [0x141f41504]
and eax, 0x92360624
xor eax, 0x37b503e4
cmp eax, 0x2dab9ee0
ja 0x1400b9c00
mov r12, qword [rcx]
jmp 0x1400b9eb0
mov eax, dword [0x141f41490]
mov ecx, dword [0x141f41494]
add eax, ecx
add eax, 0x19d371cc
or eax, 0x5b202862
imul eax, eax, 0x7e6e28a4
cmp eax, 0xc1664fc1
jb 0x1400b9c30
mov r10, qword [rdi]
mov eax, dword [0x141f41498]
xor edx, edx
div dword [0x141f4149c]
nop word cs:[rax + rax]
mov eax, dword [0x141f414a0]
and eax, dword [0x141f414a4]
or eax, 0x1010050
and eax, 0xa3e50874
imul rax, rax, 0x5ef97def
shr rax, 0x3c
cmp eax, 0x334c3800
ja 0x1400b9c70
mov r8, qword [rdi + 8]
mov eax, dword [0x141f414a8]
or eax, dword [0x141f414ac]
add eax, 0xe9ca22f3
and eax, 0x1d31307b
imul eax, eax, 0x6921a570
cmp eax, 0xa7c4141a
mov eax, dword [0x141f41508]
imul eax, dword [0x141f4150c]
and eax, 0xed8dcec5
add eax, 0x955cae5
cmp eax, 0x71744e94
jb 0x1400b9cd0
mov rbx, qword [rcx]
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400b9d00
test r15, r15
je 0x1400b9db8
nop dword [rax]
mov eax, dword [0x141f41510]
xor edx, edx
div dword [0x141f41514]
xor eax, 0x7f6deae1
imul eax, eax, 0x8d0ca123
imul rax, rax, 0x18e01ee1
shr rax, 0x3c
cmp eax, 0x3b0f6883
ja 0x1400b9d10
mov r9d, r15d
and r9d, 7
nop word cs:[rax + rax]
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rdi], 1
mov qword [rdi + 8], rbx
xor r15d, r15d
nop dword [rax]
mov eax, dword [0x141f41530]
sub eax, dword [0x141f41534]
xor eax, 0x1aa50520
or eax, 0x651208ce
imul eax, eax, 0xd3ba170a
cmp eax, 0x337b2109
je 0x1400b9dd0
jmp 0x1400b9ea7
mov eax, dword [0x141f41560]
xor edx, edx
div dword [0x141f41564]
add eax, 0x994e8e37
and eax, 0x30f44384
add eax, 0xb5354d32
cmp eax, 0x816e4d29
jae 0x1400ba2a7
ud2
mov eax, 0xbce7c667
nop dword [rax]
mov ecx, dword [0x141f41568]
xor ecx, dword [0x141f4156c]
imul rcx, rax
shr rcx, 0x3e
or ecx, 0x4284a074
and ecx, 0x4284a076
ud2

Function at 0x1400ba5f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsp
Function at 0x1400bd4a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
in eax, 0x89
retf
mov eax, dword [0x141f41c08]
add eax, dword [0x141f41c0c]
xor eax, 0x1032269
and eax, 0x8b9b3369
imul eax, eax, 0xa5fab3e0
cmp eax, 0x2403fe85
test esi, edi
add esp, dword [rdx + rsi*2]
invalid
Function at 0x1400c1510
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov r8, rdx
mov rdx, rcx
nop word cs:[rax + rax]
Function at 0x1400c6100
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov eax, dword [0x141f42b90]
and eax, dword [0x141f42b94]
and eax, 0xe86babc8
imul eax, eax, 0xaaa16a6
add eax, 0xe1a2adaa
cmp eax, 0x66c0f9d5
ja 0x1400c615a
mov eax, dword [0x141f42b98]
imul eax, dword [0x141f42b9c]
xor eax, 0xd76523d4
mov esi, 0xd03fd343
imul rsi, rax
shr rsi, 0x3e
and esi, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1400c6170
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov edi, ecx
mov eax, dword [0x141f42ba0]
xor eax, dword [0x141f42ba4]
xor eax, 0x10081420
or eax, 0xe7c5631f
add eax, 0x67d4321c
cmp eax, 0x13495b46
jae 0x1400c61b0
mov rax, qword [0x141f49060]
nop dword [rax]
mov eax, dword [0x141f42ba8]
add eax, dword [str.__H]
or eax, 0x97f097b5
imul eax, eax, 0xa711b235
add eax, 0x93e8fb4d
mov rbx, qword [0x141f49060]
cmp eax, 0x80a164ba
ja 0x1400c61b0
nop word [rax + rax]
mov eax, dword [0x141f42bb0]
xor eax, dword [0x141f42bb4]
imul eax, eax, 0xee9a24db
and eax, 0xb4ebac4d
add eax, 0xca50cfab
cmp eax, 0x51548c62
jb 0x1400c61e0
mov eax, 0xdf1f99d9
nop dword [rax + rax]
mov ecx, dword [0x141f42bb8]
add ecx, dword [0x141f42bbc]
imul rcx, rax
shr rcx, 0x3d
imul ecx, ecx, 0x53f3de5
xor ecx, 0x109485e8
cmp ecx, 0xec98a27
ja 0x1400c6210
test rbx, rbx
je 0x1400c62b3
mov eax, dword [0x141f42bd0]
xor edx, edx
div dword [0x141f42bd4]
or eax, 0x2e3a95a6
add eax, 0xbda72c50
and eax, 0x32e10a12
cmp eax, 0xf01312b4
jbe 0x1400c626f
mov rcx, rbx
mov edx, edi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop word cs:[rax + rax]
mov eax, dword [0x141f42bd8]
imul eax, dword [0x141f42bdc]
xor eax, 0x95906f1c
imul r15, rax, 0x1a40bcb
shr r15, 0x38
mov rcx, rbx
mov edx, edi
mov r8, rsi
call r14
cmp r15d, 0xc3895e99
je 0x1400c6280
jmp 0x1400c6305
mov eax, dword [0x141f42bc0]
add eax, dword [0x141f42bc4]
or eax, 0xc1dabea7
add eax, 0x6e9ae0b1
xor eax, 0x65cf7363
cmp eax, 0xbc56f8e7
ja 0x1400c6346
mov ebx, dword [0x141f42bc8]
and ebx, dword [0x141f42bcc]
or ebx, 0x60a40c0
xor ebx, 0x40028080
or ebx, 0xb8d43f1e
mov ecx, edi
mov rdx, rsi
call fcn.140101e60
cmp ebx, 0x27f537e4
je 0x1400c62d5
mov ecx, 0x97f53155
nop word [rax + rax]
mov edx, dword [0x141f42be0]
and edx, dword [0x141f42be4]
imul edx, edx, 0xb01c8d2e
shr edx, 1
imul rdx, rcx
shr rdx, 0x3c
add edx, 0x6a1402ea
cmp edx, 0x19558232
jb 0x1400c6310
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, edi
mov rdx, rsi
call fcn.140101e60
jmp 0x1400c62d5
Function at 0x1400c6360
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x1400c6542
lea r8, [rcx + 1]
lea r9, [rcx + rcx]
movabs r10, 0x7ffffffffffffff8
mov eax, dword [0x141f42c18]
xor edx, edx
div dword [0x141f42c1c]
mov r11d, 4
mov ebx, 0x28
nop word cs:[rax + rax]
mov eax, dword [0x141f42c20]
add eax, dword [0x141f42c24]
xor eax, 0x7ec5e393
imul r14d, eax, 0x41a7f8c2
and r14d, 0xda7bc080
cmp r9, r8
mov rdi, r8
cmova rdi, r9
cmp rdi, 5
cmovb rdi, r11
mov rax, rdi
mul rbx
seto dl
cmp rax, r10
seta bpl
cmp r14d, 0xbe715c5
jb 0x1400c63b0
or dl, bpl
jne 0x1400c6542
nop word cs:[rax + rax]
mov edx, dword [0x141f42c28]
imul edx, dword [0x141f42c2c]
or edx, 0x3cc73573
add edx, 0x38a87cb2
shr edx, 1
imul rdx, rdx, 0x4dfe35ef
shr rdx, 0x3d
cmp edx, 0x1c9c3ecd
ja 0x1400c6410
nop
mov edx, dword [0x141f42c30]
and edx, dword [str.ez]
or edx, 0x5ff777ef
cmp edx, 0x6b8c0ca3
jb 0x1400c6440
test rcx, rcx
je 0x1400c64ae
mov edx, 0x8ae1072f
shl rcx, 3
lea rcx, [rcx + rcx*4]
nop dword [rax]
mov r8d, dword [0x141f42c38]
and r8d, dword [0x141f42c3c]
or r8d, 0x4bd6a43e
shr r8d, 1
imul r8, rdx
shr r8, 0x3c
cmp r8d, 0x4bbc2b6d
je 0x1400c6470
mov rdx, qword [rsi + 8]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x30], rcx
mov ecx, 8
jmp 0x1400c64b0
xor ecx, ecx
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x38]
lea r9, [rsp + 0x20]
mov edx, 8
mov r8, rax
call fcn.1400c7170
cmp qword [rsp + 0x38], 0
jne 0x1400c6520
mov rax, qword [rsp + 0x40]
mov qword [rsi + 8], rax
mov qword [rsi], rdi
mov eax, dword [0x141f42c50]
add eax, dword [0x141f42c54]
imul eax, eax, 0x6edfd8cc
or eax, 0x13aaeb4c
imul rcx, rax, 0x6d6cab89
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1d
cmp eax, 0xa8a7e946
ja 0x1400c64e0
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov eax, dword [0x141f42c40]
and eax, dword [0x141f42c44]
add eax, 0x4ead16e3
or eax, 0xe654a617
and eax, 0xeff7b777
cmp eax, 0x25563fc7
jb 0x1400c6520
ud2
Function at 0x1400d0730
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov eax, dword [0x141f44398]
xor eax, dword [0x141f4439c]
mov rdi, qword [rcx + 0x10]
add eax, 0x8b2dc4fd
and eax, 0x2508a200
cmp eax, 0x1cb824e3
jbe 0x1400d0765
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebp, ebp
nop
mov rcx, rdi
call rbx
test bpl, bpl
jne 0x1400d0770
test eax, eax
jne 0x1400d07e0
mov eax, dword [0x141f443a0]
add eax, dword [0x141f443a4]
xor eax, 0xab45620
and eax, 0x4eb65637
cmp eax, 0xf20f3e1d
jne 0x1400d07a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov eax, dword [0x141f443a8]
xor edx, edx
div dword [0x141f443ac]
and eax, 0xab324d95
imul ebx, eax, 0xd24ae379
call rdi
cmp ebx, 0x25c1793e
je 0x1400d07b0
nop word cs:[rax + rax]
mov eax, dword [0x141f443b0]
and eax, dword [0x141f443b4]
imul rax, rax, 0x255aaf1
shr rax, 0x39
imul eax, eax, 0x7a7e53ca
add eax, 0x76aabfc9
cmp eax, 0x94ff873b
jb 0x1400d07e0
cmp rsi, 0xffffffffffffffff
je 0x1400d08e0
mov rcx, 0xffffffffffffffff
lock xadd qword [rsi + 8], rcx
mov eax, dword [0x141f443b8]
xor edx, edx
div dword [0x141f443bc]
or eax, 0x18e80de3
imul eax, eax, 0xc228a314
cmp eax, 0xc76015cf
je 0x1400d0820
cmp rcx, 1
jne 0x1400d08e0
mov eax, dword [0x141f443c0]
or eax, dword [0x141f443c4]
and eax, 0xe53cf1f3
cmp eax, 0xf1262d41
je 0x1400d089b
mov eax, dword [0x141f443c8]
imul eax, dword [0x141f443cc]
imul edi, eax, 0x3a431037
and edi, 0x1702957b
add edi, 0x585c5707
mov rcx, qword [0x141f49060]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp edi, 0x1ff0c480
jae 0x1400d08b0
mov rcx, qword [0x141f49060]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400d0862
mov eax, dword [0x141f443d0]
and eax, dword [0x141f443d4]
or eax, 0xdf254208
add eax, 0x56b7f5bf
xor eax, 0x7dafd7a8
cmp eax, 0x30cb9f47
jb 0x1400d08b0
nop word cs:[rax + rax]
mov eax, dword [0x141f443d8]
imul eax, dword [0x141f443dc]
add eax, 0x535fb34b
or eax, 0x891
and eax, 0x21c5a9f
cmp eax, 0xdc7e599f
ja 0x1400d08e0
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400dc190
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rdi, rax
inc rax
cmp rax, 2
jb 0x1400dc298
mov eax, dword [0x141f45c20]
xor edx, edx
div dword [0x141f45c24]
shr eax, 2
imul rax, rax, 0x2a577243
shr rax, 0x38
add eax, 0x52039414
or eax, 0x4e0284ad
cmp eax, 0xe5217f4c
ja 0x1400dc211
mov eax, dword [0x141f45c28]
xor edx, edx
div dword [0x141f45c2c]
or eax, 0xc100b108
and eax, 0xd382b10d
imul ebx, eax, 0x724f840a
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0x85e6df2a
jne 0x1400dc221
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400dc1dd
mov ecx, eax
nop word cs:[rax + rax]
mov eax, dword [0x141f45c30]
xor edx, edx
div dword [0x141f45c34]
imul rdx, rax, 0x4998ce93
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1d
add eax, 0x17fd5d2d
xor eax, 0xa6ad0407
cmp eax, 0x4a83214f
jb 0x1400dc230
nop word cs:[rax + rax]
mov eax, dword [0x141f45c38]
add eax, dword [0x141f45c3c]
imul rax, rax, 0x63f5f8f
shr rax, 0x38
imul eax, eax, 0xe4c9a79c
cmp eax, 0x831493b9
je 0x1400dc270
test ecx, ecx
jne 0x1400dc2f8
mov eax, dword [0x141f45c40]
or eax, dword [0x141f45c44]
and eax, 0xe61a5358
add eax, 0xb2e719d4
or eax, 0x775433ab
cmp eax, 0x517e4623
jae 0x1400dc2c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop word [rax + rax]
mov eax, dword [0x141f45c48]
xor eax, dword [0x141f45c4c]
imul edi, eax, 0x9ad5e17d
add edi, 0xe5dfddd
and edi, 0xe6310bb
call rsi
cmp edi, 0x83d138b0
je 0x1400dc2d0
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400dc790
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rdi, r9
movabs rbx, 0x7ffffffffffffffe
mov r13, r9
shr r13, 1
lea rbp, [r13 + 1]
lea r15, [r13*2 + 2]
mov r9, rdx
mov rsi, rcx
nop word cs:[rax + rax]
cmp r15, rbx
seta al
test rbp, rbp
sets cl
mov edx, dword [0x141f45d10]
xor edx, dword [0x141f45d14]
or edx, 0x25c46a90
shr edx, 3
imul rdx, rdx, 0xceb78b3
shr rdx, 0x37
xor edx, 0xc25923e5
cmp edx, 0x7b4123d4
jb 0x1400dc7d0
or cl, al
jne 0x1400dc8c2
mov eax, dword [0x141f45d28]
xor edx, edx
div dword [0x141f45d2c]
mov eax, dword [0x141f45d30]
xor eax, dword [0x141f45d34]
or eax, 0x4196ebcb
add eax, 0x5d9a3745
imul rax, rax, 0x15c56757
shr rax, 0x3b
cmp eax, 0x9b9ffcce
je 0x1400dc820
nop dword [rax + rax]
mov eax, dword [0x141f45d38]
sub eax, dword [0x141f45d3c]
add eax, 0x97d48169
shr eax, 8
imul rax, rax, 0x109063
shr rax, 0x2b
cmp eax, 0x1c916527
ja 0x1400dc850
test r15, r15
je 0x1400dc8b7
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r8
mov eax, dword [0x141f45d40]
imul eax, dword [0x141f45d44]
xor eax, 0xd534d8f8
add eax, 0xd3e6d493
imul rax, rax, 0x41747bb5
shr rax, 0x3d
cmp eax, 0x7d492675
jbe 0x1400dca19
jmp 0x1400dca3e
mov r12d, 2
xor r15d, r15d
jmp 0x1400dc914
mov eax, dword [0x141f45d18]
imul eax, dword [0x141f45d1c]
and eax, 0x8b8101d
xor eax, 0x28145116
or eax, 0x9743a4e0
cmp eax, 0xcf7a1852
jbe 0x1400dc8f0
ud2
mov eax, dword [0x141f45d20]
xor edx, edx
div dword [0x141f45d24]
imul eax, eax, 0xcc0b541e
or eax, 0x7f55e6d7
ud2

Function at 0x1400dcb00
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, rdx
mov rsi, rcx
lea rdx, [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.shell32.dll_CommandLineToArgvW]
test rax, rax
je 0x1400dcce1
mov rdi, rax
movsxd r12, dword [rsp + 0x44]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], 0
and al, 0x38
add byte [rax], al
add byte [rax], al
invalid
mov qword [rsi], 0
mov eax, dword [0x141f45d78]
mov ecx, dword [0x141f45d7c]
add eax, ecx
add eax, 0xfa8d560a
xor eax, 0xa0963223
cmp eax, 0x410cf6e
ja 0x1400dcd44
mov eax, dword [0x141f45d80]
or eax, dword [0x141f45d84]
mov ecx, 0xa70b07ff
imul rcx, rax
shr rcx, 0x3e
or ecx, 0x3de49c1d
add ecx, 0x1a339f06
mov qword [rsi + 8], 8
mov qword [rsi + 0x10], 0
cmp ecx, 0x80a27a3f
jbe 0x1400dcd60
mov qword [rsi + 8], 8
mov qword [rsi + 0x10], 0
jmp 0x1400dcd07
mov eax, dword [0x141f45d88]
or eax, dword [0x141f45d8c]
and eax, 0x1b456cc6
xor eax, 0xf0582244
add eax, 0xc1b581a3
cmp eax, 0xca8bcdf2
ja 0x1400dcd60
nop word cs:[rax + rax]
Function at 0x1400dd4a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
test cl, cl

Function at 0x1400de000
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov edi, edx
mov rsi, rcx
nop word cs:[rax + rax]
mov eax, dword [0x141f46020]
xor eax, dword [0x141f46024]
add eax, 0xa16d759e
or eax, 0x10610400
and eax, 0x11750784
cmp eax, 0x54d7f7b1
je 0x1400de020
mov r14d, edi
shr r14d, 8
mov ebp, edi
shr ebp, 0x10
mov rbx, qword [rsi + 0x10]
nop word cs:[rax + rax]
mov eax, dword [0x141f46028]
imul eax, dword [0x141f4602c]
imul eax, eax, 0x978711ae
cmp eax, 0xf6797ae4
je 0x1400de060
mov rcx, qword [rsi]
cmp rbx, rcx
jne 0x1400de0bc
mov rcx, rsi
call fcn.1400f4700
nop word [rax + rax]
mov eax, dword [0x141f46030]
imul eax, dword [0x141f46034]
or eax, 0x5c4a1576
add eax, 0x8b404750
imul rax, rax, 0x9d2e47f
shr rax, 0x3b
cmp eax, 0x9ef8615d
ja 0x1400de090
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
mov byte [rax + rbx], dil
lea rdx, [rbx + 1]
mov qword [rsi + 0x10], rdx
cmp rdx, rcx
jne 0x1400de149
xor eax, eax
test al, al
je 0x1400de0e0
mov rcx, rsi
call fcn.1400f4700
nop
mov r15d, dword [0x141f46038]
or r15d, dword [0x141f4603c]
or r15d, 0xc4531e0
add r15d, 0xb91faa43
and r15d, 0x3058640a
mov rcx, rsi
call fcn.1400f4700
cmp r15d, 0x72063cf1
ja 0x1400de0e0
mov rax, qword [rsi + 8]
nop dword [rax + rax]
mov ecx, dword [0x141f46040]
sub ecx, dword [0x141f46044]
or ecx, 0x440000d2
and ecx, 0x46838eda
add ecx, 0x410186b
cmp ecx, 0xc1485b53
ja 0x1400de120
mov rcx, qword [rsi]
mov byte [rax + rbx + 1], r14b
lea rdx, [rbx + 2]
mov qword [rsi + 0x10], rdx
cmp rdx, rcx
jne 0x1400de1c6
xor eax, eax
test al, al
jne 0x1400de195
mov eax, dword [0x141f46048]
imul eax, dword [0x141f4604c]
imul eax, eax, 0xda067a5d
xor eax, 0x399f6844
imul r14, rax, 0x2e36c7a9
shr r14, 0x3c
mov rcx, rsi
call fcn.1400f4700
cmp r14d, 0x80f6836a
jbe 0x1400de1a0
mov rcx, rsi
call fcn.1400f4700
jmp 0x1400de161
mov eax, dword [0x141f46050]
or eax, dword [0x141f46054]
or eax, 0x6e6493ba
xor eax, 0x6bb52e3c
add eax, 0x6f1e5e48
cmp eax, 0x5e4e69f0
jb 0x1400de1a0
mov rax, qword [rsi + 8]
mov ecx, dword [0x141f46058]
and ecx, dword [0x141f4605c]
and ecx, 0x5e5cb85d
imul ecx, ecx, 0xeb23d55c
add ecx, 0x683da80c
cmp ecx, 0x44559ec5
jae 0x1400de1f9
mov byte [rax + rbx + 2], bpl
lea rcx, [rbx + 3]
mov qword [rsi + 0x10], rcx
lea rcx, [rbx + 3]
nop dword [rax]
mov edx, dword [0x141f46060]
or edx, dword [0x141f46064]
and edx, 0x3e7f58ef
imul edx, edx, 0xa8863e6e
add edx, 0xfac8724
mov byte [rax + rbx + 2], bpl
mov qword [rsi + 0x10], rcx
cmp edx, 0x7cb083e1
ja 0x1400de200
cmp rcx, qword [rsi]
jne 0x1400de23c
mov rcx, rsi
call fcn.1400f4700
shr edi, 0x18
mov rax, qword [rsi + 8]
mov byte [rax + rbx + 3], dil
add rbx, 4
mov qword [rsi + 0x10], rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret