joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400dcfb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov rsi, rcx
mov eax, dword [0x141ddbdd0]
add eax, dword [0x141ddbdd4]
imul rax, rax, 0x3a9d23df
shr rax, 0x3d
or eax, 0xbdfffa5e
cmp eax, 0x3d228d7
jne 0x1400dd000
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
nop word cs:[rax + rax]
mov eax, dword [0x141ddbdd8]
add eax, dword [0x141ddbddc]
imul ecx, eax, 0x3e1ddbdb
xor ecx, 0xd3c135bf
add ecx, 0x15be680a
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov rdi, rsp
cmp ecx, 0xc9ea0ac2
ja 0x1400dd000
mov r9, qword [rsi]
cmp r9, 0xffffffffffffffff
je 0x1400dd26a
lea r10, [r9 + 1]
lea rcx, [r9 + r9]
movabs r11, 0x7ffffffffffffffe
mov eax, dword [0x141ddbde0]
xor edx, edx
div dword [0x141ddbde4]
mov eax, 4
nop dword [rax + rax]
mov r15d, dword [0x141ddbde8]
xor r15d, dword [0x141ddbdec]
or r15d, 0x35a95317
and r15d, 0x37ab5377
cmp rcx, r10
mov rbx, r10
cmova rbx, rcx
cmp rbx, 5
cmovb rbx, rax
lea r8, [rbx + rbx]
test rbx, rbx
sets dl
cmp r8, r11
seta r14b
cmp r15d, 0xa7f6ef4f
ja 0x1400dd070
or dl, r14b
jne 0x1400dd26a
test r9, r9
je 0x1400dd16e
nop word [rax + rax]
mov eax, dword [0x141ddbdf0]
add eax, dword [0x141ddbdf4]
imul eax, eax, 0xaf016309
imul rax, rax, 0x568bc873
shr rax, 0x3b
xor eax, 0xa04afb43
cmp eax, 0xf59b9e45
ja 0x1400dd0d0
mov rax, qword [rsi + 8]
mov qword [rbp - 0x10], rax
mov eax, dword [0x141ddbdf8]
xor edx, edx
div dword [0x141ddbdfc]
imul eax, eax, 0xba2e10f0
add eax, 0x3bb2cd7c
mov edx, 0x80738fff
imul rdx, rax
shr rdx, 0x3f
cmp edx, 0xb8ef254a
jne 0x1400dd140
mov qword [rbp], rcx
nop word cs:[rax + rax]
mov eax, dword [str.W3T]
and eax, dword [0x141ddbe04]
add eax, 0x7ae2b873
imul rax, rax, 0x516a6623
shr rax, 0x3b
mov qword [rbp], rcx
cmp eax, 0x19b85609
je 0x1400dd140
mov eax, 2
jmp 0x1400dd170
xor eax, eax
mov qword [rbp - 8], rax
sub rsp, 0x20
lea r9, [rbp - 0x10]
mov edx, 2
mov rcx, rdi
call fcn.1400c39d0
add rsp, 0x20
cmp qword [rdi], 0
jne 0x1400dd200
mov rcx, qword [rdi + 8]
mov eax, dword [0x141ddbe18]
xor eax, dword [0x141ddbe1c]
cmp eax, 0x84df96aa
jne 0x1400dd1b1
mov qword [rsi + 8], rcx
mov qword [rsi], rbx
mov r8d, 0xc1dc3e4d
nop word [rax + rax]
mov eax, dword [0x141ddbe20]
xor edx, edx
div dword [0x141ddbe24]
xor eax, 0x3d041a64
add eax, 0x5edb7f6b
imul rax, r8
shr rax, 0x3f
mov qword [rsi + 8], rcx
mov qword [rsi], rbx
cmp eax, 0x519786d4
je 0x1400dd1c0
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov eax, dword [0x141ddbe08]
or eax, dword [0x141ddbe0c]
add eax, 0xe4f614b6
imul rcx, rax, 0x9c21ed1
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
imul eax, eax, 0xacc6f66f
cmp eax, 0x65607e71
ja 0x1400dd200
nop word cs:[rax + rax]
mov eax, dword [0x141ddbe10]
imul eax, dword [0x141ddbe14]
imul rax, rax, 0x1392e973
shr rax, 0x3c
imul eax, eax, 0x2188905
add eax, 0x7a7c85b5
cmp eax, 0x20699255
jb 0x1400dd240
ud2
Function at 0x1400deb40
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 0x20]
mov rax, qword [rdx + 0x28]
lea rdx, [0x141dbbedb]
mov r8d, 0x10
call qword [rax + 0x18]
mov ebx, eax
mov eax, dword [0x141ddc330]
or eax, dword [0x141ddc334]
mov qword [rsp + 0x30], rdi
or eax, 0x52aeaecf
and eax, 0xd7ffefff
cmp eax, 0x7429bd83
jne 0x1400debbb
mov byte [rsp + 0x38], bl
mov qword [rsp + 0x28], 0
mov byte [rsp + 0x39], 0
mov qword [rsp + 0x40], rsi
lea r8, [0x1400de720]
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x40]
call fcn.140057510
lea rdi, [0x1400de720]
lea r14, [rsp + 0x28]
lea r15, [rsp + 0x40]
nop dword [rax]
mov eax, dword [0x141ddc338]
mov ecx, dword [0x141ddc33c]
lea ebp, [rax + rcx]
add ebp, 0x90df604
or ebp, 0x93691d5c
and ebp, 0xbbfdddff
mov byte [rsp + 0x38], bl
mov qword [rsp + 0x28], 0
mov byte [rsp + 0x39], 0
mov qword [rsp + 0x40], rsi
mov rcx, r14
mov rdx, r15
mov r8, rdi
call fcn.140057510
cmp ebp, 0xa7518a93
ja 0x1400debd0
mov rax, qword [rsp + 0x28]
movzx ecx, byte [rsp + 0x38]
test rax, rax
je 0x1400ded54
nop word cs:[rax + rax]
mov edx, dword [0x141ddc340]
imul edx, dword [0x141ddc344]
xor edx, 0x33414d41
or edx, 0xccb4328a
cmp edx, 0x42f014b
je 0x1400dec40
xor edx, edx
nop word cs:[rax + rax]
test dl, dl
jne 0x1400dec70
mov bl, 1
test cl, cl
jne 0x1400ded56
mov rsi, qword [rsp + 0x30]
cmp rax, 1
jne 0x1400ded0a
cmp byte [rsp + 0x39], 0
je 0x1400ded0a
mov eax, dword [rsi + 0x34]
nop word [rax + rax]
mov ecx, dword [0x141ddc350]
imul ecx, dword [0x141ddc354]
add ecx, 0xee014005
xor ecx, 0xd93d4e0f
cmp ecx, 0xdef5d9c9
ja 0x1400deca0
nop word cs:[rax + rax]
mov ecx, dword [str.YdUe]
and ecx, dword [0x141ddc35c]
or ecx, 0xf9befd8f
cmp ecx, 0xb6f9b50f
je 0x1400decd0
test al, 4
jne 0x1400ded0a
mov rcx, qword [rsi + 0x20]
mov rax, qword [rsi + 0x28]
lea rdx, [0x141db8186]
mov r8d, 1
call qword [rax + 0x18]
test al, al
jne 0x1400ded56
mov rcx, qword [rsi + 0x20]
mov rax, qword [rsi + 0x28]
lea rdx, [0x141dbb6c0]
mov r8d, 1
call qword [rax + 0x18]
mov ebx, eax
nop word cs:[rax + rax]
mov eax, dword [0x141ddc348]
xor eax, dword [0x141ddc34c]
xor eax, 0x376c433b
add eax, 0x2144d24d
xor eax, 0x8e954a
cmp eax, 0x88915d64
jbe 0x1400ded30
jmp 0x1400ded56
mov ebx, ecx
test bl, bl
setne al
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400e67f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov eax, dword [0x141ddd240]
and eax, dword [0x141ddd244]
mov rsi, rcx
and eax, 0x94a00e8f
imul eax, eax, 0xeadf3f7c
cmp eax, 0x408796ae
jne 0x1400e6840
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
nop dword [rax + rax]

Function at 0x1400e6e10
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
movzx eax, byte [rcx]
nop word cs:[rax + rax]
mov ecx, dword [0x141ddd318]
and ecx, dword [0x141ddd31c]
and ecx, 0x3657d826
xor ecx, 0xe4660ea
int1
invalid
invalid
invalid
invalid
add ecx, 0x383ad1da
cmp ecx, 0x668b20ae
ja 0x1400e6e30
cmp rax, 0xf
ja case.default.0x1400e6e6e
lea rcx, [0x141dbd3e0]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov rsi, qword [rsi + 8]
mov rdi, qword [rsi]
mov eax, dword [0x141ddd320]
or eax, dword [0x141ddd324]
imul eax, eax, 0xc5da97b
cmp eax, 0xb9df4cbd
jne 0x1400e71a1
jmp 0x1400e71d1
mov rax, qword [rsi + 8]
xor ecx, ecx
mov eax, dword [0x141ddd398]
xor edx, edx
Function at 0x1400ed450
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r8, rdx
mov rsi, rcx
nop word cs:[rax + rax]
mov eax, dword [0x141ddde90]
xor eax, dword [0x141ddde94]
add eax, 0x5f8a297d
xor eax, 0x96e49a48
cmp eax, 0x1ef71aba
jb 0x1400ed470
mov rcx, qword [r8]
mov eax, dword [0x141ddde98]
add eax, dword [0x141ddde9c]
or eax, 0x10470525
add eax, 0x8761f9cf
and eax, 0xee507e94
cmp eax, 0x8f6daa31
ja 0x1400ed490
mov r9, qword [r8 + 8]
mov eax, dword [0x141dddea0]
xor edx, edx
div dword [0x141dddea4]
nop word cs:[rax + rax]
mov eax, dword [0x141dddea8]
sub eax, dword [0x141dddeac]
imul eax, eax, 0xb80011d0
or eax, 0x50aeb1e2
cmp eax, 0x4b028eb5
jb 0x1400ed4d0
mov rax, qword [r8 + 0x18]
cmp r9, 1
je 0x1400ed540
test r9, r9
jne 0x1400ed565
nop dword [rax]
mov ecx, dword [0x141dddeb0]
imul ecx, dword [0x141dddeb4]
and ecx, 0x69c11aad
xor ecx, 0x71edb8b7
imul ecx, ecx, 0x25926533
cmp ecx, 0x8cdca131
je 0x1400ed500
test rax, rax
jne 0x1400ed565
mov edi, 1
xor ebx, ebx
mov r14d, 1
jmp 0x1400ed607
mov edx, dword [0x141dddef8]
and edx, dword [0x141dddefc]
add edx, 0xac944f19
xor edx, 0xfc0a7236
cmp edx, 0x352dfe3c
jb 0x1400ed540
test rax, rax
je 0x1400ed575
mov rcx, rsi
mov rdx, r8
call fcn.140039290
jmp 0x1400ed680
mov rdi, qword [rcx]
mov rbx, qword [rcx + 8]
nop dword [rax]
mov eax, dword [0x141dddeb8]
and eax, dword [0x141dddebc]
imul eax, eax, 0xbbfb33fb
and eax, 0x8971e6fb
cmp eax, 0xd3b5a86e
ja 0x1400ed580
test rbx, rbx
js 0x1400ed5db
je 0x1400ed5d1
mov eax, dword [0x141dddec8]
imul eax, dword [0x141dddecc]
or eax, 0x6969108
and eax, 0xf97914c
add eax, 0xd9fe6e61
cmp eax, 0x63e446b1
jae 0x1400ed6b2
jmp 0x1400ed6ea
mov r14d, 1
xor ebx, ebx
jmp 0x1400ed607
ud2
mov eax, dword [0x141dddee8]
add eax, dword [0x141dddeec]
and eax, 0xaf705477
cmp eax, 0xb7337468
je 0x1400ed660
mov eax, dword [0x141dddef0]
xor eax, dword [0x141dddef4]
add eax, 0x7694d26d
mov r15d, 0xaf77ebe9
imul r15, rax
shr r15, 0x3f
mov rcx, r14
mov rdx, rdi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi], rbx
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rbx
cmp r15d, 0x8e0ffa1d
jne 0x1400ed680
mov rcx, r14
mov rdx, rdi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi], rbx
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rbx
jmp 0x1400ed61f
mov eax, dword [0x141dddf00]
xor eax, dword [0x141dddf04]
imul eax, eax, 0xa9bda05e
add eax, 0x107034b2
or eax, 0x47447003
cmp eax, 0xb052120d
jb 0x1400ed680
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov ebp, dword [0x141ddded0]
imul ebp, dword [0x141ddded4]
or ebp, 0x31e2f239
add ebp, 0xb18b5ce9
and ebp, 0x22405062
movzx eax, byte [0x141dde6f8]
xor ecx, ecx
mov rdx, rbx
call fcn.1400c29b0
cmp ebp, 0x950778f2
jbe 0x1400ed6fd
movzx eax, byte [0x141dde6f8]
xor ecx, ecx
mov rdx, rbx
call fcn.1400c29b0
jmp 0x1400ed6b2
mov r14, rax
mov eax, dword [0x141ddded8]
or eax, dword [0x141dddedc]
imul eax, eax, 0x72bde8e
cmp eax, 0x5746aba1
je 0x1400ed700
test r14, r14
jne 0x1400ed607
xor eax, eax
test al, al
je 0x1400ed72a
ud2
mov eax, dword [0x141dddee0]
xor eax, dword [0x141dddee4]
and eax, 0x44245060
ud2
Function at 0x1400f1858
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400f18a2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400f18a2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400f18a2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400f18a2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400f18a2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400f18a4
xor al, al
add rsp, 0x28
ret
Function at 0x1400f2140
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
add rdx, r8
jb 0x1400f23d4
mov r10, r9
mov rsi, rcx
mov rcx, qword [rsp + 0xc0]
mov eax, 0xd2312791
nop dword [rax]
mov r9d, dword [0x141dc4a68]
add r9d, dword [0x141dc4a6c]
and r9d, 0xb3f6267e
imul r9, rax
shr r9, 0x3f
mov r8, qword [rsi]
lea r12, [r8 + r8]
cmp r12, rdx
cmovbe r12, rdx
cmp r9d, 0x52ac4978
je 0x1400f2170
xor eax, eax
cmp rcx, 1
sete al
lea rax, [rax*4 + 4]
cmp rax, r12
cmova r12, rax
lea rdx, [r10 + rcx]
dec rdx
mov rax, r10
neg rax
and rax, rdx
mul r12
jo 0x1400f23d4
mov rbp, rax
movabs rax, 0x8000000000000000
sub rax, r10
cmp rbp, rax
ja 0x1400f23d4
mov eax, dword [0x141dc4a70]
xor edx, edx
div dword [0x141dc4a74]
nop dword [rax]
mov eax, dword [0x141dc4a78]
xor edx, edx
div dword [0x141dc4a7c]
add eax, 0xf9d247ed
xor eax, 0x8828a000
or eax, 0x3602549b
cmp eax, 0xac8094aa
je 0x1400f2200
test r8, r8
je 0x1400f2299
mov rax, qword [rsi + 8]
mov edx, dword [0x141dc4a80]
or edx, dword [0x141dc4a84]
imul rdx, rdx, 0x68ea3fd9
shr rdx, 0x3c
add edx, 0xf96073e7
and edx, 0x6160016e
cmp edx, 0x15514767
jne 0x1400f225d
mov qword [rsp + 0x28], rax
imul r8, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141dc4a88]
xor ecx, dword [0x141dc4a8c]
add ecx, 0x9812e09e
mov qword [rsp + 0x28], rax
cmp ecx, 0x3bca7ee7
jb 0x1400f2270
mov qword [rsp + 0x38], r8
mov r13, r10
jmp 0x1400f229c
xor r13d, r13d
mov eax, dword [0x141dc4a90]
or eax, dword [0x141dc4a94]
xor eax, 0xb2298804
or eax, 0x4cd25538
imul rax, rax, 0x5db74fa3
shr rax, 0x3e
cmp eax, 0x37df001a
jne 0x1400f22e4
mov qword [rsp + 0x30], r13
lea rcx, [rsp + 0x40]
lea r9, [rsp + 0x28]
mov rdx, r10
mov r8, rbp
mov rdi, r10
call fcn.1400c39d0
mov r10, rdi
lea r14, [rsp + 0x40]
lea r15, [rsp + 0x28]
nop
mov edi, dword [0x141dc4a98]
add edi, dword [0x141dc4a9c]
or edi, 0xbdee9e66
mov eax, 0x92653459
imul rdi, rax
shr rdi, 0x3f
or edi, 0x4b65aab6
mov qword [rsp + 0x30], r13
mov rcx, r14
mov rdx, r10
mov r8, rbp
mov r9, r15
mov rbx, r10
call fcn.1400c39d0
mov r10, rbx
cmp edi, 0x4737c091
jb 0x1400f22f0
cmp qword [rsp + 0x40], 0
jne 0x1400f23b8
mov eax, dword [0x141dc4aa8]
imul eax, dword [0x141dc4aac]
add eax, 0x2d5f0a3
or eax, 0xcca15580
and eax, 0xdebd7789
cmp eax, 0x5cc7e76f
nop word cs:[rax + rax]
mov eax, dword [0x141dc4ab0]
xor edx, edx
div dword [str.zEe_c]
imul eax, eax, 0x6c769002
cmp eax, 0x4c25191d
je 0x1400f2370
mov rax, qword [rsp + 0x48]
mov ecx, dword [0x141dc4ab8]
or ecx, dword [0x141dc4abc]
or ecx, 0x2f35931e
add ecx, 0xf5b037b2
or ecx, 0x83ede4e2
cmp ecx, 0xb5d86437
jbe 0x1400f23f7
jmp 0x1400f241c
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x1400f23c0
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400f23d0
xor eax, eax
test al, al
je 0x1400f23e0
ud2
mov eax, dword [str._V_.i]
sub eax, dword [0x141dc4aa4]
ud2
mov ecx, dword [0x141dc4ac0]
imul ecx, dword [0x141dc4ac4]
add ecx, 0x9cb84300
and ecx, 0x4be01040
mov qword [rsi + 8], rax
cmp ecx, 0x5bb68325
jbe 0x1400f2422
mov qword [rsi + 8], rax
jmp 0x1400f23f7
mov qword [rsi], r12
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400f52d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov rbp, rsp
mov rsi, rcx
mov eax, dword [0x141dc7df8]
sub eax, dword [0x141dc7dfc]
imul eax, eax, 0x3a392a0b
imul rax, rax, 0x65bef8ed
shr rax, 0x3e
imul eax, eax, 0x7f0ff329
cmp eax, 0xf2d5b25
jae 0x1400f5330
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
nop word cs:[rax + rax]
mov ecx, dword [0x141dc7e00]
add ecx, dword [0x141dc7e04]
xor ecx, 0x2212ec4
add ecx, 0x6ab00bfd
or ecx, 0xa92ce78b
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov r14, rsp
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov rbx, rsp
cmp ecx, 0x96521e10
je 0x1400f5330
xor eax, eax
nop dword [rax + rax]
mov rcx, rdx
add rcx, r8
setb r9b
test al, al
jne 0x1400f5380
test r9b, r9b
jne 0x1400f5594
mov rax, qword [rsi]
lea rdx, [rax + rax]
cmp rdx, rcx
cmova rcx, rdx
cmp rcx, 9
mov edi, 8
cmovae rdi, rcx
xor ecx, ecx
nop word cs:[rax + rax]
test cl, cl
jne 0x1400f53c0
test rdi, rdi
js 0x1400f5594
nop dword [rax]
mov ecx, dword [0x141dc7e08]
imul ecx, dword [0x141dc7e0c]
or ecx, 0xf56fa844
imul ecx, ecx, 0x837a86c4
cmp ecx, 0xe2c33f21
je 0x1400f53d0
test rax, rax
je 0x1400f5454
mov rcx, qword [rsi + 8]
mov qword [r14], rcx
mov ecx, dword [0x141dc7e10]
sub ecx, dword [0x141dc7e14]
or ecx, 0x8d6efce9
cmp ecx, 0xdbb1f2b9
jne 0x1400f541b
mov qword [r14 + 0x10], rax
mov ecx, 0x95efa83f
mov edx, dword [0x141dc7e18]
sub edx, dword [0x141dc7e1c]
or edx, 0x94a8857d
add edx, 0x68c80efe
imul rdx, rcx
shr rdx, 0x3d
mov qword [r14 + 0x10], rax
cmp edx, 0xf990e07
ja 0x1400f5420
mov r12d, 1
jmp 0x1400f5457
xor r12d, r12d
mov eax, dword [0x141dc7e20]
or eax, dword [0x141dc7e24]
imul eax, eax, 0xeeb7bce4
cmp eax, 0x1edaae70
jae 0x1400f5490
mov qword [r14 + 8], r12
sub rsp, 0x20
mov rcx, rbx
mov rdx, rdi
mov r8, r14
call fcn.140038fb0
add rsp, 0x20
nop word [rax + rax]
mov eax, dword [0x141dc7e28]
xor edx, edx
div dword [0x141dc7e2c]
mov r15d, eax
xor r15d, 0x810046
or r15d, 0x4500800
and r15d, 0x84d30ecf
mov qword [r14 + 8], r12
sub rsp, 0x20
mov rcx, rbx
mov rdx, rdi
mov r8, r14
call fcn.140038fb0
add rsp, 0x20
cmp r15d, 0x1d003a0b
ja 0x1400f5490
cmp qword [rbx], 0
jne 0x1400f5570
mov eax, dword [0x141dc7e30]
xor edx, edx
div dword [0x141dc7e34]
nop word cs:[rax + rax]
mov eax, dword [0x141dc7e38]
xor eax, dword [0x141dc7e3c]
cmp eax, 0xad84a859
je 0x1400f5500
mov rax, qword [rbx + 8]
xor ecx, ecx
test cl, cl
je 0x1400f5530
mov qword [rsi + 8], rax
mov qword [rsi], rdi
nop word cs:[rax + rax]
mov ecx, dword [0x141dc7e40]
or ecx, dword [0x141dc7e44]
or ecx, 0x81c609c1
imul rcx, rcx, 0x1f61b1c5
shr rcx, 0x3b
add ecx, 0xdb52ca8b
mov qword [rsi + 8], rax
mov qword [rsi], rdi
cmp ecx, 0x777b442f
jb 0x1400f5530
mov rsp, rbp
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400f5580
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400f5590
ud2
Function at 0x1400f55a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov eax, dword [0x141dc8920]
add eax, dword [0x141dc8924]
imul eax, eax, 0xafa7822d
add eax, 0x9735f8d8
cmp eax, 0x9bf641b1
ja 0x1400f5624
mov eax, dword [0x141dc8928]
xor eax, dword [0x141dc892c]
add eax, 0x28f3596c
mov ebx, 0xdb98d053
imul rbx, rax
shr rbx, 0x3e
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov rdi, rsp
sub rsp, 0x20
mov rcx, rdi
call fcn.140042f10
mov rcx, rsi
call fcn.140042f80
add rsp, 0x20
cmp ebx, 0x7bd748e2
jne 0x1400f5660
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov rcx, rsp
sub rsp, 0x20
call fcn.140042f10
mov rcx, rsi
call fcn.140042f80
add rsp, 0x20
jmp 0x1400f55c6
mov eax, dword [0x141dc8930]
xor eax, dword [0x141dc8934]
imul eax, eax, 0xc4255ad2
add eax, 0x1ef66bf5
cmp eax, 0xda1656c8
ja 0x1400f5660
mov edi, dword [rdi + 8]
mov eax, edi
and eax, 0xc000000
nop dword [rax + rax]
mov ecx, dword [0x141dc8938]
and ecx, dword [0x141dc893c]
imul ecx, ecx, 0xb3bfa486
xor ecx, 0xa466bf07
imul ecx, ecx, 0xf21583c4
cmp ecx, 0x1b9ff4fa
jb 0x1400f5690
cmp eax, 0xc000000
jne 0x1400f56f8
sub rsp, 0x20
call fcn.140043070
add rsp, 0x20
and eax, 6
nop dword [rax]
mov ecx, dword [0x141dc8940]
sub ecx, dword [0x141dc8944]
imul edx, ecx, 0x1b49f88e
and edx, 0x8ce813ee
cmp eax, 6
sete cl
cmp edx, 0x9c8ed522
ja 0x1400f56d0
jmp 0x1400f56fa
xor ecx, ecx
movzx eax, byte [rsi + 4]
shr al, 5
shr edi, 0x1c
and edi, 1
and dil, cl
and dil, al
mov byte [section..data], dil
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400f7270
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x40
lea rcx, [rsp + 0x20]
call fcn.140042f10
lea rcx, [rsp + 0x30]
call fcn.140042f80
mov esi, dword [rsp + 0x28]
mov eax, esi
and eax, 0xc000000
nop word cs:[rax + rax]
mov ecx, dword [0x141dce090]
and ecx, dword [0x141dce094]
or ecx, 0x20bd9f54
and ecx, 0x33ff9fd4
cmp ecx, 0xc939c5bf
ja 0x1400f72a0
cmp eax, 0xc000000
jne 0x1400f733f
call fcn.140043070
mov rcx, rax
and ecx, 6
nop word cs:[rax + rax]
mov eax, dword [0x141dce098]
xor eax, dword [0x141dce09c]
or eax, 0xc6680002
and eax, 0xee690416
add eax, 0x5c47fa7d
cmp eax, 0xc2bbb66c
ja 0x1400f72e0
mov eax, dword [0x141dce0a0]
xor edx, edx
div dword [0x141dce0a4]
mov eax, dword [0x141dce0a8]
imul eax, dword [0x141dce0ac]
imul edx, eax, 0x6af677c0
add edx, 0x1992463c
and edx, 0x2f174c8c
cmp ecx, 6
sete al
cmp edx, 0x5f1fa17e
je 0x1400f7310
jmp 0x1400f7341
xor eax, eax
movzx ecx, byte [rsp + 0x34]
shr cl, 5
shr esi, 0x1c
and esi, 1
and sil, al
and sil, cl
mov byte [0x141dc2001], sil
mov eax, esi
add rsp, 0x40
pop rsi
ret
Function at 0x1400fcc30
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, r9
mov rbx, r8
mov rsi, rcx
mov eax, dword [0x141dd1288]

Function at 0x1400fd13f
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov rbp, rsp
mov eax, dword [0x141dd16d8]
and eax, dword [0x141dd16dc]
imul eax, eax, 0xf6c14851
xor eax, 0x502a9e76
push 0x10
pop r8
push 0x20
pop r9
cmp eax, 0x1c12d2c0
jae 0x1400fd198
xor eax, eax
call fcn.1400f1350
sub rsp, rax
mov rax, r8
call fcn.1400f1350
sub rsp, rax
mov rax, r9
call fcn.1400f1350
sub rsp, rax
mov eax, dword [0x141dde698]
mov r10d, 0xe330a9e5
mov eax, dword [0x141dd16e0]
xor edx, edx
div dword [0x141dd16e4]
xor edx, edx
div r10d
mov edx, eax
xor eax, eax
call fcn.1400f1350
sub rsp, rax
mov r14, rsp
mov rax, r8
call fcn.1400f1350
sub rsp, rax
mov rsi, rsp
mov rax, r9
call fcn.1400f1350
sub rsp, rax
mov r15, rsp
mov eax, dword [0x141dde698]
cmp edx, 0x28f7371e
je 0x1400fd19e
cmp eax, 3
je 0x1400fd2cd
mov r8d, 0xe4417491
mov eax, dword [0x141dd16e8]
xor edx, edx
div dword [0x141dd16ec]
add eax, 0x397c2ac2
xor edx, edx
div r8d
or eax, 0x9f0b520e
cmp eax, 0xd1a165df
ja 0x1400fd1f9
mov eax, dword [0x141dd16f0]
xor edx, edx
div dword [0x141dd16f4]
or eax, 0xf7ec1600
cmp eax, 0x4961a348
je 0x1400fd263
mov eax, dword [0x141dd16f8]
and eax, dword [0x141dd16fc]
mov r8d, 0xa006bbb7
xor edx, edx
div r8d
mov qword [r15], rcx
lea rdx, [0x141dde660]
mov qword [r15 + 8], rdx
cmp eax, 0xf9251da6
jne 0x1400fd273
mov qword [r15], rcx
lea rax, [0x141dde660]
mov qword [r15 + 8], rax
jmp 0x1400fd237
xor eax, eax
test al, al
jne 0x1400fd301
lea rdi, [0x141dde698]
lea rbx, [0x141dbb738]
mov eax, dword [0x141dd1700]
and eax, dword [0x141dd1704]
imul r12d, eax, 0xc607e355
or r12d, 0x65d5580
mov qword [r15 + 0x10], r14
mov qword [rsi], r15
sub rsp, 0x20
mov rcx, rdi
mov dl, 1
mov r8, rsi
mov r9, rbx
call fcn.1400fcc30
add rsp, 0x20
cmp r12d, 0xe21e6973
ja 0x1400fd28b
mov ecx, 0xe1393bd1
mov eax, dword [0x141dd1708]
add eax, dword [0x141dd170c]
xor edx, edx
div ecx
xor eax, 0x201c0a11
or eax, 0x5fa3b46e
cmp eax, 0xfca75750
ja 0x1400fd2d2
mov rsp, rbp
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov qword [r15 + 0x10], r14
mov qword [rsi], r15
sub rsp, 0x20
lea rcx, [0x141dde698]
lea r9, [0x141dbb738]
mov dl, 1
mov r8, rsi
call fcn.1400fcc30
add rsp, 0x20
jmp 0x1400fd27d
Function at 0x1400fe180
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov edi, ecx
mov eax, dword [0x141dd8608]
xor eax, dword [0x141dd860c]
and eax, 0x29048120
cmp eax, 0xa9e9164
je 0x1400fe1d0
mov eax, dword [0x141dd8610]
imul eax, dword [0x141dd8614]
and eax, 0xb0c12c6c
imul ebx, eax, 0xb5916663
add ebx, 0x41984e51
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp ebx, 0xaf666878
jae 0x1400fe1e0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x1400fe1a4
mov ecx, dword [0x141dd8618]
imul ecx, dword [0x141dd861c]
or ecx, 0x4db967f8
imul ecx, ecx, 0xfe047fc1
add ecx, 0x1bb95dd5
cmp ecx, 0xcc40f6c7
ja 0x1400fe1e0
nop word [rax + rax]
mov ecx, dword [0x141dd8620]
or ecx, dword [0x141dd8624]
and ecx, 0x45873810
or ecx, 0xaa7047e1
xor ecx, 0x449357f
cmp ecx, 0x854a4fc5
jb 0x1400fe210
test rax, rax
je 0x1400fe258
mov qword [0x141dde6e0], rax
mov rcx, rax
mov edx, edi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret