joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e1460
Capabilities:
Get memory capacity

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, rcx
mov eax, dword [str.k_b_B]
sub eax, dword [0x141f468cc]
imul eax, eax, 0x160298fe
add eax, 0x52e30c26
or eax, 0xccc9cc67
cmp eax, 0x108cd76
je 0x1400e14c0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor ecx, ecx
test cl, cl
je 0x1400e14ec
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
jmp 0x1400e1490
test eax, eax
jne 0x1400e1504
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
nop dword [rax + rax]
test al, al
jne 0x1400e1500
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsi + 0x70], xmm0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x20]
mov edx, 0x68
call qword [sym.imp.KERNEL32.dll_K32GetPerformanceInfo]
nop word [rax + rax]
mov ecx, dword [0x141f468d0]
imul ecx, dword [0x141f468d4]
add ecx, 0xd5f473b6
or ecx, 0x9c9115ab
imul ecx, ecx, 0x8e021a4f
cmp ecx, 0x54cf7e0d
ja 0x1400e1550
test eax, eax
je 0x1400e164a
mov rcx, qword [rsp + 0x70]
mov r10, qword [rsp + 0x30]
mov r11, qword [rsp + 0x40]
mov eax, dword [0x141f468d8]
xor edx, edx
div dword [0x141f468dc]
and eax, 0x34a85c
cmp eax, 0xd3f7d823
jne 0x1400e15cc
xor edx, edx
mov rax, r10
sub rax, r11
cmovae rdx, rax
mov rax, rcx
mul rdx
mov rdx, 0xffffffffffffffff
cmovno rdx, rax
mov qword [rsi + 0x80], rdx
xor edi, edi
mov rbx, 0xffffffffffffffff
nop word cs:[rax + rax]
mov eax, dword [0x141f468e0]
xor edx, edx
div dword [0x141f468e4]
mov r8d, eax
or r8d, 0x1091588
and r8d, 0x139f58e
add r8d, 0x57527ed8
mov rdx, r10
sub rdx, r11
cmovb rdx, rdi
mov rax, rcx
mul rdx
mov r9, rax
cmovo r9, rbx
mov rdx, qword [rsp + 0x28]
sub rdx, r11
cmovb rdx, rdi
mov rax, rcx
mul rdx
cmovo rax, rbx
mov qword [rsi + 0x80], r9
cmp r8d, 0x1fc126b7
jb 0x1400e15e0
mov qword [rsi + 0x88], rax
mov rcx, rsi
mov dl, 1
call fcn.1400c78a0
mov byte [rsp + 0x20], 1
movabs rax, 0x202020202020101
mov qword [rsp + 0x21], rax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400c8a10
nop
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400e37d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [r8 + 8]
mov rax, r8
mov rdi, rdx
nop word cs:[rax + rax]
mov edx, dword [0x141f46d88]
imul edx, dword [0x141f46d8c]
imul edx, edx, 0xfb0398a5
and edx, 0xd56a912e
cmp edx, 0x91e38d47
je 0x1400e37f0
test rcx, rcx
je 0x1400e3890
mov r8, qword [rax]
mov rcx, qword [rax + 0x10]
nop dword [rax]
mov eax, dword [0x141f46d90]
xor edx, edx
div dword [0x141f46d94]
imul eax, eax, 0x7e84ef56
or eax, 0xb0eb4511
cmp eax, 0x84508dba
je 0x1400e3820
test rcx, rcx
je 0x1400e38e0
mov rcx, qword [0x141f49060]
xor edx, edx
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
nop dword [rax + rax]
mov ecx, dword [0x141f46db0]
sub ecx, dword [0x141f46db4]
add ecx, 0x2b6e3220
xor ecx, 0x17ebdc83
cmp ecx, 0x8d186006
ja 0x1400e3860
jmp 0x1400e3a08
mov eax, dword [0x141f46db8]
and eax, dword [0x141f46dbc]
add eax, 0xdc94491f
or eax, 0x2fcc44c
cmp eax, 0x1c90c28a
jb 0x1400e3890
test rdi, rdi
je 0x1400e394b
movzx eax, byte [0x141f49078]
mov eax, dword [0x141f46dc0]
or eax, dword [0x141f46dc4]
add eax, 0xcad92f82
cmp eax, 0x82cc9272
jb 0x1400e3985
jmp 0x1400e3955
mov eax, dword [0x141f46d98]
or eax, dword [0x141f46d9c]
add eax, 0xb344e072
and eax, 0x71864591
imul rax, rax, 0xdd76bbd
shr rax, 0x3a
cmp eax, 0xce83848f
ja 0x1400e38e0
nop dword [rax + rax]
mov eax, dword [0x141f46da0]
xor eax, dword [0x141f46da4]
imul eax, eax, 0xafd28455
and eax, 0x2cf29b1e
add eax, 0x181d24b5
cmp eax, 0xc4fd12bd
ja 0x1400e3910
test rdi, rdi
je 0x1400e394b
movzx eax, byte [0x141f49078]
xor eax, eax
test al, al
jne 0x1400e39fc
jmp 0x1400e39c8
mov eax, 2
jmp 0x1400e3a08
mov ebx, dword [0x141f46dc8]
or ebx, dword [0x141f46dcc]
and ebx, 0x8b211018
or ebx, 0x409eada7
xor ebx, 0xae2472a2
xor ecx, ecx
mov rdx, rdi
call fcn.1400c6170
cmp ebx, 0xdc51bef6
jbe 0x1400e39a0
xor ecx, ecx
mov rdx, rdi
call fcn.1400c6170
jmp 0x1400e3955
mov ecx, dword [0x141f46dd0]
add ecx, dword [0x141f46dd4]
imul ecx, ecx, 0x1d496298
add ecx, 0xc6704468
or ecx, 0xcb712d75
cmp ecx, 0x4bea4bb6
jb 0x1400e39a0
jmp 0x1400e3a08
mov eax, dword [0x141f46da8]
xor edx, edx
div dword [0x141f46dac]
shr eax, 6
imul rbx, rax, 0x42cdcb1
shr rbx, 0x31
add ebx, 0xf338b42
xor ecx, ecx
mov rdx, rdi
call fcn.1400c6170
cmp ebx, 0x4980a53a
jbe 0x1400e3a08
xor ecx, ecx
mov rdx, rdi
call fcn.1400c6170
jmp 0x1400e39c8
xor ecx, ecx
test rax, rax
mov edx, 2
cmovne rdx, rax
sete cl
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rdi
mov qword [rsi], rcx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400ea2d0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
Function at 0x1400f0220
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400f0240
mov rcx, qword [rdx + 8]
mov rax, qword [rdx + 0x18]
cmp rcx, 1
je 0x1400f026e
test rcx, rcx
jne 0x1400f02aa
test rax, rax
jne 0x1400f02aa
mov ebx, 1
xor edi, edi
mov r14d, 1
jmp 0x1400f044c
mov rcx, qword [rdx]
nop word cs:[rax + rax]
mov r8d, dword [0x141f48678]
or r8d, dword [0x141f4867c]
or r8d, 0xefaffcda
xor r8d, 0x5fa3ded4
cmp r8d, 0xe8cb0736
ja 0x1400f0280
test rax, rax
je 0x1400f02e8
mov rcx, rsi
call fcn.14003b520
nop word cs:[rax + rax]
mov eax, dword [0x141f48620]
sub eax, dword [0x141f48624]
add eax, 0xceb3ca43
xor eax, 0xecff1985
imul eax, eax, 0x86e10b9a
cmp eax, 0xb868aa29
je 0x1400f02c0
jmp 0x1400f04c3
mov rdi, qword [rcx + 8]
test rdi, rdi
js 0x1400f04d0
mov rbx, qword [rcx]
nop dword [rax + rax]
mov eax, dword [0x141f48630]
and eax, dword [0x141f48634]
add eax, 0xc7b4c680
and eax, 0x9d1b664c
add eax, 0x94a15384
cmp eax, 0x746eb907
jb 0x1400f0300
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400f0330
test rdi, rdi
je 0x1400f0444
mov eax, dword [0x141f48638]
add eax, dword [0x141f4863c]
xor eax, 0xd697d97f
imul eax, eax, 0xb4012341
cmp eax, 0xb720ec66
jne 0x1400f036c
movzx eax, byte [0x141f49078]
xor ecx, ecx
mov rdx, rdi
call fcn.1400c6170
mov r15d, 0xd16fe68d
nop word cs:[rax + rax]
mov eax, dword [0x141f48640]
xor eax, dword [0x141f48644]
add eax, 0xe43d7102
imul rax, r15
shr rax, 0x3d
imul ebp, eax, 0x71bf046
movzx eax, byte [0x141f49078]
xor ecx, ecx
mov rdx, rdi
call fcn.1400c6170
cmp ebp, 0x991500fb
ja 0x1400f0380
mov r14, rax
nop dword [rax + rax]
mov eax, dword [0x141f48648]
sub eax, dword [0x141f4864c]
and eax, 0x230cce9a
imul eax, eax, 0x5ac9afc7
add eax, 0x24e5c1fd
cmp eax, 0xa38371bb
ja 0x1400f03c0
nop word cs:[rax + rax]
mov eax, dword [0x141f48650]
and eax, dword [0x141f48654]
add eax, 0xc7818d13
or eax, 0x22dad9aa
imul rax, rax, 0x323185af
shr rax, 0x3d
cmp eax, 0x17bf81cc
ja 0x1400f03f0
test r14, r14
jne 0x1400f044c
mov eax, dword [0x141f48658]
or eax, dword [0x141f4865c]
and eax, 0x179cbe66
imul eax, eax, 0x496946df
cmp eax, 0x88fdac0
jne 0x1400f0507
jmp 0x1400f053a
mov r14d, 1
xor edi, edi
mov eax, dword [0x141f48668]
add eax, dword [0x141f4866c]
imul eax, eax, 0xd877cda
xor eax, 0xb0022d1
add eax, 0xae52708e
cmp eax, 0xb38adffe
jbe 0x1400f0490
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi], rdi
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
nop dword [rax + rax]
mov ebp, dword [0x141f48670]
add ebp, dword [0x141f48674]
or ebp, 0xf45ffeff
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi], rdi
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
cmp ebp, 0xbbe5b997
je 0x1400f0490
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
ud2
mov eax, dword [0x141f48660]
and eax, dword [0x141f48664]
or eax, 0x22902d8
imul rcx, rax, 0x5bcee59
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
add eax, 0x4c0727eb
ud2
ud2
Function at 0x1400f5218
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400f5262
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400f5262
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400f5262
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400f5262
cmp dword [rcx + 0x84], 0xe
jbe 0x1400f5262
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400f5264
xor al, al
add rsp, 0x28
ret
Function at 0x1400f8980
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r9, rdx
mov rsi, rcx
add r9, r8
setb al
nop dword [rax + rax]
mov ecx, dword [0x141f32198]
sub ecx, dword [0x141f3219c]
and ecx, 0x31484000
or ecx, 0x282b7d5
xor ecx, 0x11643697
cmp ecx, 0x5e942274
ja 0x1400f89a0
test al, al
jne 0x1400f8ba8
mov r8d, 8
nop word cs:[rax + rax]
mov eax, dword [0x141f321a0]
xor edx, edx
div dword [0x141f321a4]
or eax, 0x6cc1afae
and eax, 0xfff9afff
mov rcx, qword [rsi]
lea rdi, [rcx + rcx]
cmp rdi, r9
cmovbe rdi, r9
cmp rdi, 9
cmovb rdi, r8
cmp eax, 0x10dd52c2
je 0x1400f89e0
test rdi, rdi
js 0x1400f8ba8
nop
mov eax, dword [0x141f321a8]
or eax, dword [0x141f321ac]
imul rax, rax, 0x7c9020b9
shr rax, 0x3b
xor eax, 0xc5f0f59e
add eax, 0x3b429f5c
cmp eax, 0x67825373
ja 0x1400f8a20
nop dword [rax + rax]
mov eax, dword [0x141f321b0]
xor eax, dword [0x141f321b4]
imul rdx, rax, 0x164b3ff1
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1e
or eax, 0xb3fe5664
cmp eax, 0x641192a4
je 0x1400f8a50
test rcx, rcx
je 0x1400f8aac
mov rax, qword [rsi + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rcx
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400f8aa0
mov r15d, 1
jmp 0x1400f8aaf
xor r15d, r15d
mov eax, dword [0x141f321b8]
or eax, dword [0x141f321bc]
add eax, 0x77b1f4b0
xor eax, 0x13c0def3
imul eax, eax, 0xe56f2307
cmp eax, 0x832a26ed
jne 0x1400f8ae9
mov qword [rsp + 0x30], r15
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x28]
mov rdx, rdi
call fcn.14003b300
lea rbx, [rsp + 0x40]
lea r14, [rsp + 0x28]
nop word cs:[rax + rax]
mov eax, dword [0x141f321c0]
imul eax, dword [0x141f321c4]
imul ebp, eax, 0xa37b8390
mov qword [rsp + 0x30], r15
mov rcx, rbx
mov rdx, rdi
mov r8, r14
call fcn.14003b300
cmp ebp, 0xce25bcd1
je 0x1400f8b00
cmp qword [rsp + 0x40], 0
jne 0x1400f8b70
mov rax, qword [rsp + 0x48]
mov qword [rsi + 8], rax
mov eax, dword [0x141f321e8]
imul eax, dword [0x141f321ec]
imul eax, eax, 0xedea1c77
add eax, 0x14c15de
xor eax, 0x4f79f49c
cmp eax, 0xa3fb312b
jae 0x1400f8bf1
jmp 0x1400f8c26
mov eax, dword [0x141f321c8]
add eax, dword [0x141f321cc]
xor eax, 0x61004008
or eax, 0x98dc2fa7
cmp eax, 0xd31fbae6
ja 0x1400f8b70
nop dword [rax]
mov eax, dword [0x141f321d0]
xor eax, dword [0x141f321d4]
add eax, 0xebb9ec15
cmp eax, 0x6f67f4d2
ja 0x1400f8b90
mov eax, dword [0x141f321d8]
sub eax, dword [0x141f321dc]
and eax, 0x6d491b25
imul eax, eax, 0xeb522d53
add eax, 0x58e9a8fd
cmp eax, 0x4d07e78c
jae 0x1400f8bd0
ud2
mov eax, dword [0x141f321e0]
and eax, dword [0x141f321e4]
add eax, 0x6ed1dddf
or eax, 0xbef8c49f
ud2
mov eax, dword [0x141f321f0]
add eax, dword [0x141f321f4]
imul rcx, rax, 0x2fc8bf8b
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
imul eax, eax, 0xbb3c905
add eax, 0x1e8be18e
mov qword [rsi], rdi
cmp eax, 0xfd7a05d6
jbe 0x1400f8c2b
mov qword [rsi], rdi
jmp 0x1400f8bf1
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400f8c40
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov eax, dword [0x141f32d60]
imul eax, dword [0x141f32d64]
add eax, 0xad7f04f4
xor eax, 0xb47af9b6
add eax, 0xbb17f662
cmp eax, 0x10ee020a
jae 0x1400f8ca0
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rcx, rsp
sub rsp, 0x20
call fcn.140045440
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141f32d68]
sub eax, dword [0x141f32d6c]
imul ebx, eax, 0x8d0b0e53
and ebx, 0x58040804
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rdi, rsp
sub rsp, 0x20
mov rcx, rdi
call fcn.140045440
add rsp, 0x20
cmp ebx, 0x5d305303
ja 0x1400f8ca0
xor eax, eax
test al, al
jne 0x1400f8d2c
mov ebx, dword [0x141f32d70]
xor ebx, dword [0x141f32d74]
add ebx, 0x8f65425a
or ebx, 0x82400848
and ebx, 0xf661cc4e
sub rsp, 0x20
mov rcx, rsi
call fcn.140045470
add rsp, 0x20
cmp ebx, 0x2cbbc00
jne 0x1400f8d3e
sub rsp, 0x20
mov rcx, rsi
call fcn.140045470
add rsp, 0x20
jmp 0x1400f8cf6
mov edi, dword [rdi + 8]
mov eax, edi
not eax
test eax, 0xc000000
jne 0x1400f8dba
sub rsp, 0x20
call fcn.140045550
add rsp, 0x20
and eax, 6
nop dword [rax]
mov ecx, dword [0x141f32d78]
mov edx, dword [0x141f32d7c]
add edx, ecx
add edx, 0x97b3663
xor edx, 0xf37c2aee
add edx, 0xecccd59c
cmp eax, 6
sete cl
cmp edx, 0x6a5daab3
jb 0x1400f8d60
nop
mov eax, dword [0x141f32d80]
sub eax, dword [0x141f32d84]
or eax, 0x8c9a8d23
imul rax, rax, 0x48c1fae5
shr rax, 0x3d
or eax, 0xf0e8f0e4
cmp eax, 0x81b8c05d
je 0x1400f8d90
jmp 0x1400f8dbc
xor ecx, ecx
movzx eax, byte [rsi + 4]
shr al, 5
shr edi, 0x1c
and edi, 1
and dil, cl
and dil, al
mov byte [section..data], dil
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400faac0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
mov rbp, rsp
mov eax, dword [0x141f379a8]
imul eax, dword [0x141f379ac]
or eax, 0x41202004
and eax, 0x7529a2a6
cmp eax, 0xdec75008
je 0x1400fab3d
mov edx, dword [0x141f379b0]
and edx, dword [0x141f379b4]
add edx, 0x4840fe09
xor edx, 0xc40b040
or edx, 0xf2bf49ab
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rcx, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r8, rsp
cmp edx, 0x531faf2a
jne 0x1400fab70
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
jmp 0x1400faae7
mov eax, dword [0x141f379b8]
xor eax, dword [0x141f379bc]
add eax, 0x47511548
imul rax, rax, 0x2cb05cd
shr rax, 0x35
cmp eax, 0x77cb7771
je 0x1400fab70
mov eax, dword [0x141f379c0]
xor edx, edx
div dword [0x141f379c4]
and eax, 0xaa821a11
cmp eax, 0xa89e6eb
jne 0x1400fabbd
lea rax, [0x141f48fa0]
mov qword [r8], rax
mov eax, dword [0x141f48fa8]
lea rax, [0x141f48fa0]
xor edx, edx
nop word cs:[rax + rax]
mov qword [r8], rax
mov r9d, dword [0x141f48fa8]
test dl, dl
jne 0x1400fabd0
cmp r9d, 3
je 0x1400faca0
mov qword [rcx], r8
mov qword [rsi], rcx
mov eax, dword [0x141f379c8]
add eax, dword [0x141f379cc]
mov ecx, 0xa64bcb19
imul rcx, rax
shr rcx, 0x3e
or ecx, 0xe70d4cc4
cmp ecx, 0xff1d021d
je 0x1400face8
lea rdi, [0x141f48fa8]
lea rbx, [0x141f254f0]
mov r14d, dword [0x141f379d0]
sub r14d, dword [0x141f379d4]
add r14d, 0x99a00964
xor r14d, 0x9f0f29d0
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, rsi
mov r9, rbx
call fcn.1401005d0
add rsp, 0x20
cmp r14d, 0x873d680c
jb 0x1400fac27
nop word cs:[rax + rax]
mov eax, dword [0x141f379d8]
or eax, dword [0x141f379dc]
imul eax, eax, 0x93886e99
and eax, 0xe2d922c3
xor eax, 0xfbb5d4e3
cmp eax, 0xc1b2c7d4
jb 0x1400fac70
nop word cs:[rax + rax]
mov eax, dword [0x141f379e0]
and eax, dword [0x141f379e4]
and eax, 0x64a18642
imul eax, eax, 0xab58f3d2
cmp eax, 0x5030c1f5
je 0x1400faca0
nop
mov eax, dword [0x141f379e8]
and eax, dword [0x141f379ec]
imul eax, eax, 0x45213517
add eax, 0x1709a81a
cmp eax, 0x3d9c9426
jb 0x1400facc0
mov rsp, rbp
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
sub rsp, 0x20
lea rcx, [0x141f48fa8]
lea r9, [0x141f254f0]
xor edx, edx
mov r8, rsi
call fcn.1401005d0
add rsp, 0x20
jmp 0x1400fac19
Function at 0x1401002f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r9, rdx
mov rsi, rcx
mov r10, qword [rcx]
lea r11, [r10 + r10]
mov ebx, 4
lea rcx, [r8 + 7]
and rcx, 0xfffffffffffffff8
nop word cs:[rax + rax]
mov eax, dword [0x141f3aed0]
xor edx, edx
div dword [0x141f3aed4]
or eax, 0xca70b866
imul eax, eax, 0xd559d676
or eax, 0x46ed10ab
cmp r11, r9
mov rdi, r9
cmova rdi, r11
cmp rdi, 5
cmovb rdi, rbx
cmp eax, 0x9fc24a64
je 0x140100320
movabs r11, 0x7ffffffffffffff8
nop word cs:[rax + rax]
mov eax, dword [0x141f3aed8]
add eax, dword [0x141f3aedc]
imul ebx, eax, 0x10982513
add ebx, 0x9ddd2b11
mov rax, rcx
mul rdi
mov r9, rax
seto al
cmp r9, r11
seta dl
cmp ebx, 0x590b3a88
jb 0x140100370
or al, dl
jne 0x140100561
mov ecx, 0xc4f0f631
nop
mov eax, dword [0x141f3aee0]
xor edx, edx
div dword [0x141f3aee4]
imul eax, eax, 0xa42134a0
imul rax, rcx
shr rax, 0x3e
add eax, 0x4fb5b49b
cmp eax, 0x718b65cd
ja 0x1401003b0
nop dword [rax + rax]
mov eax, dword [0x141f3aee8]
xor eax, dword [0x141f3aeec]
xor eax, 0x60884
and eax, 0xd24689a4
imul rax, rax, 0x1a4907ef
shr rax, 0x3c
cmp eax, 0x41001560
ja 0x1401003e0
test r10, r10
je 0x1401004a9
mov eax, dword [0x141f3aef0]
imul eax, dword [0x141f3aef4]
or eax, 0xafbf6b98
xor eax, 0xd46ffcbb
imul eax, eax, 0xdd61dd47
cmp eax, 0xd915ba1a
jne 0x14010043e
mov rax, qword [rsi + 8]
mov qword [rsp + 0x20], rax
imul r10, r8
nop word cs:[rax + rax]
mov eax, dword [0x141f3aef8]
add eax, dword [0x141f3aefc]
and eax, 0x4fd5f8b3
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x20], rcx
cmp eax, 0x913d46c0
je 0x140100450
nop word cs:[rax + rax]
mov eax, dword [0x141f3af00]
or eax, dword [0x141f3af04]
add eax, 0xb1e63266
and eax, 0x911bb5e4
cmp eax, 0x2e7983ed
je 0x140100480
mov qword [rsp + 0x30], r10
mov eax, 8
jmp 0x1401004ab
xor eax, eax
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x38]
lea r8, [rsp + 0x20]
mov rdx, r9
call fcn.140087a20
cmp qword [rsp + 0x38], 0
jne 0x140100523
xor eax, eax
test al, al
xor eax, eax
test al, al
jne 0x1401004d0
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x141f3af20]
xor edx, edx
div dword [0x141f3af24]
imul rax, rax, 0x765eb357
shr rax, 0x3e
imul eax, eax, 0x2ebafc04
add eax, 0x15f73214
cmp eax, 0x71be6240
jbe 0x14010050b
mov qword [rsi + 8], rcx
mov qword [rsi], rdi
xor eax, eax
nop dword [rax]
mov qword [rsi + 8], rcx
mov qword [rsi], rdi
test al, al
jne 0x140100510
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
mov eax, 0x8fbfb893
nop dword [rax + rax]
mov ecx, dword [0x141f3af08]
sub ecx, dword [0x141f3af0c]
mov rdx, rcx
imul rdx, rax
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1e
and ecx, 0xfffffffe
imul ecx, ecx, 0x8d2afa82
cmp ecx, 0xcf131170
ja 0x140100530
mov eax, dword [0x141f3af10]
xor edx, edx
div dword [0x141f3af14]
mov ecx, 0xe0204699
imul rcx, rax
shr rcx, 0x3d
imul eax, ecx, 0x1780700f
cmp eax, 0xd256c14e
jne 0x140100590
ud2
mov eax, dword [0x141f3af18]
and eax, dword [0x141f3af1c]
imul eax, eax, 0xec686154
and eax, 0xb4e6b618
ud2
Function at 0x140100d30
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x60
mov eax, dword [0x141f4907c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x40], 0
jne 0x140100efc
mov eax, dword [0x141f4907c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x40], 0xffffffffffffffff
mov rax, qword [0x140108608]
nop dword [rax + rax]
mov eax, dword [0x141f3ba60]
xor eax, dword [0x141f3ba64]
and eax, 0xfe602304
cmp eax, 0x6529efe8
je 0x140100d80
mov eax, dword [0x141f4907c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rsi, qword [rax + 0x58]
mov eax, dword [0x141f4907c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp rsi, qword [rax + 0x48]
jne 0x140100e0b
call fcn.1400907b0
mov eax, dword [0x141f4907c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x40]
inc rcx
mov eax, dword [0x141f3ba80]
sub eax, dword [0x141f3ba84]
imul eax, eax, 0x99db296f
cmp eax, 0x8f3cd7c7
je 0x140100df0
jmp 0x140100e0d
xor ecx, ecx
mov eax, dword [0x141f3ba88]
xor edx, edx
div dword [0x141f3ba8c]
or eax, 0xb68dceec
cmp eax, 0xe5fb95f3
jne 0x140100e78
mov eax, dword [0x141f4907c]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
mov rdx, qword [rax + 0x50]
mov r8, rsi
shl r8, 4
lea r9, [rax + 0x90]
mov qword [rdx + r8], r9
lea r9, [0x140090a40]
mov qword [rdx + r8 + 8], r9
lea rdx, [rsi + 1]
mov qword [rax + 0x58], rdx
mov qword [rax + 0x40], rcx
mov byte [rax + 0x98], 1
mov rax, rsi
shl rax, 4
inc rsi
lea rdx, [0x140090a40]
nop dword [rax]
mov r8d, dword [0x141f3ba90]
xor r8d, dword [0x141f3ba94]
mov r9d, dword [0x141f4907c]
mov r10, qword gs:[0x58]
mov r9, qword [r10 + r9*8]
mov r10, qword [r9 + 0x50]
lea r11, [r9 + 0x90]
mov qword [r10 + rax], r11
or r8d, 0xf0fdcbbe
and r8d, 0xf4fdefbe
mov qword [r10 + rax + 8], rdx
mov qword [r9 + 0x58], rsi
mov qword [r9 + 0x40], rcx
mov byte [r9 + 0x98], 1
cmp r8d, 0xe5691ae8
je 0x140100e90
add rsp, 0x60
pop rsi
ret
mov eax, dword [0x141f3ba68]
or eax, dword [0x141f3ba6c]
imul eax, eax, 0x12d78ebc
add eax, 0x4b8c25d0
cmp eax, 0xf06c5139
ja 0x140100f69
mov eax, dword [0x141f3ba70]
mov ecx, dword [0x141f3ba74]
add eax, ecx
add eax, 0x8030d305
and eax, 0x2d67fbcc
add eax, 0xfe3c4d6a
mov dword [rsp + 0x28], 0
mov byte [rsp + 0x2c], 0
lea rcx, [0x141f25d90]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x50], 0
cmp eax, 0xef83dab9
jbe 0x140100f96
mov dword [rsp + 0x28], 0
mov byte [rsp + 0x2c], 0
lea rax, [0x141f25d90]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x50], 0
jmp 0x140100f1a
xor eax, eax
test al, al
jne 0x140100fec
mov eax, dword [0x141f3ba78]
sub eax, dword [0x141f3ba7c]
or eax, 0xbb343dff
imul esi, eax, 0x8491872a
lea rax, [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.14008e020
mov rcx, rax
call fcn.14008e440
mov ecx, 7
int 0x29
cmp esi, 0x3e3ed75
jae 0x140101022
lea rax, [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.14008e020
mov rcx, rax
call fcn.14008e440
mov ecx, 7
int 0x29
jmp 0x140100f9c
ud2
Function at 0x140101e60
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov edi, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ecx, 0xcc4cfe09
nop word cs:[rax + rax]
mov edx, dword [0x141f42be8]
add edx, dword [0x141f42bec]
imul rdx, rcx
shr rdx, 0x38
imul edx, edx, 0x3f73d856
add edx, 0xb14c799c
cmp edx, 0xae295437
ja 0x140101e80
mov ecx, 0xc67e647d
nop dword [rax]
mov edx, dword [0x141f42bf0]
or edx, dword [0x141f42bf4]
and edx, 0x99bec08f
xor edx, 0x453b69b5
imul rdx, rcx
shr rdx, 0x3c
cmp edx, 0x55af13f2
ja 0x140101eb0
test rax, rax
je 0x140101f67
mov ecx, dword [0x141f42bf8]
and ecx, dword [0x141f42bfc]
xor ecx, 0x4a9116f2
imul ecx, ecx, 0x32426ee8
or ecx, 0xb3bbfb16
cmp ecx, 0xadd9c1a7
jae 0x140101f10
mov qword [0x141f49060], rax
nop
mov ecx, dword [0x141f42c00]
imul ecx, dword [0x141f42c04]
imul ecx, ecx, 0x78025f7
mov qword [0x141f49060], rax
cmp ecx, 0x63834bc7
je 0x140101f10
mov rcx, rax
mov edx, edi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, rax
nop word cs:[rax + rax]
mov eax, dword [0x141f42c08]
xor edx, edx
div dword [0x141f42c0c]
cmp eax, 0x16aeddd6
je 0x140101f50
jmp 0x140101f70
xor ecx, ecx
nop dword [rax]
mov eax, dword [0x141f42c10]
sub eax, dword [0x141f42c14]
xor eax, 0x3ba7ec64
add eax, 0xe82fa8d4
and eax, 0x3536db45
cmp eax, 0x41194c63
ja 0x140101f70
mov rax, rcx
add rsp, 0x28
pop rdi
pop rsi
ret