joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b3640
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rax, qword [rdx + 0x40]
mov rdi, rdx
mov rsi, rcx
mov ecx, 0xd5feefe1
nop
mov edx, dword [0x141dd3708]
sub edx, dword [0x141dd370c]
imul rdx, rcx
shr rdx, 0x3c
xor edx, 0x86b8a5ab
add edx, 0x7753a362
cmp edx, 0x4dbbe48f
jb 0x1400b3660
test rax, rax
je 0x1400b36bc
mov ecx, dword [0x141dd3740]
and ecx, dword [0x141dd3744]
and ecx, 0xad0fba89
imul ecx, ecx, 0x8d77e409
xor ecx, 0x4e0a8163
cmp ecx, 0xa131b21b
jb 0x1400b3954
jmp 0x1400b3926
mov r9, qword [rdi]
mov eax, dword [0x141dd3710]
xor edx, edx
div dword [0x141dd3714]
mov ecx, 0xaccb968d
imul rcx, rax
shr rcx, 0x3e
and ecx, 1
cmp ecx, 0x5ccc9cdd
invalid
pushfq
int3
pop rsp
jbe 0x1400b36f0
mov qword [rdi], 0
mov ecx, dword [0x141dd3748]
and ecx, dword [0x141dd374c]
imul ecx, ecx, 0x8d32db38
add ecx, 0xcc364c50
or ecx, 0xe3a6989
lea rdx, [rax - 1]
mov qword [rdi + 0x40], rdx
cmp ecx, 0xc37e68ef
jbe 0x1400b395e
lea rcx, [rax - 1]
mov qword [rdi + 0x40], rcx
jmp 0x1400b3926
cmp qword [rdi], 0
je 0x1400b409c
nop dword [rax + rax]
mov eax, dword [0x141dd3750]
imul eax, dword [str.m_Jk]
xor eax, 0x40a446d0
or eax, 0x3d4a390f
cmp eax, 0x8d5dad32
ja 0x1400b3970
mov rbx, qword [rdi + 8]
lea rcx, [rdi + 0x10]
nop word cs:[rax + rax]
mov eax, dword [0x141dd3758]
mov edx, dword [0x141dd375c]
add eax, edx
add eax, 0x5084e919
or eax, 0xf3fdff8e
cmp eax, 0xdb3f055e
jb 0x1400b39a0
mov r14, qword [rdi + 0x18]
test rbx, rbx
je 0x1400b39d0
mov r15, qword [rcx]
jmp 0x1400b3cb6
mov eax, dword [0x141dd3760]
ud2
Function at 0x1400b6d90
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov eax, dword [0x141dd3e20]
or eax, dword [0x141dd3e24]
mov rsi, rcx
or eax, 0x77c402c4
imul eax, eax, 0xb98e927
cmp eax, 0xd7ec80bf
jne 0x1400b6dc9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov ebx, 0x8e2a659f
mov r14, qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
nop word cs:[rax + rax]
invalid

Function at 0x1400b6f50
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rsi, rax
mov eax, dword [0x141dd3e60]
or eax, dword [0x141dd3e64]
add eax, 0x9a0258d6
xor eax, 0x10049daf
imul eax, eax, 0x48b68170
cmp eax, 0x371c0f71
ja 0x1400b6f60
test rsi, rsi
je 0x1400b7022
cmp rsi, 0xffffffffffffffff
jne 0x1400b6fd0
mov eax, dword [0x141dd3e68]
xor eax, dword [0x141dd3e6c]
imul rcx, rax, 0x2794bf73
mov eax, dword [0x141dd3e80]
add eax, dword [0x141dd3e84]
or eax, 0x787cc59d
add eax, 0x514847b9
cmp eax, 0x738815d8
jb 0x1400b6fd0
mov qword [rsp + 0x38], 0
mov eax, dword [0x141dd3e88]
sub eax, dword [0x141dd3e8c]
or eax, 0xaeb02e1c
imul rax, rax, 0x3738ae3
shr rax, 0x39
cmp eax, 0x7ffe42f3
jne 0x1400b72c2
jmp 0x1400b7319
movabs rsi, 0x600000002
mov edi, dword [0x141dd3e90]
and edi, dword [0x141dd3e94]
or edi, 0x739a4309
add edi, 0x1fa0e9b2
xor edi, 0xbbfd71a0
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
mov rcx, rax
mov rdx, rsi
mov r8, rax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp edi, 0x7a2fb0f3
jbe 0x1400b734f
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
mov rcx, rax
mov rdx, rsi
mov r8, rax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
jmp 0x1400b72c2
test eax, eax
je 0x1400b73a8
mov rdx, qword [rsp + 0x38]
nop dword [rax + rax]
mov eax, dword [0x141dd3e98]
sub eax, dword [0x141dd3e9c]
and eax, 0x6238e976
add eax, 0xaf8ee4f3
or eax, 0x73f7f929
cmp eax, 0x169eb87
jb 0x1400b7360
xor ecx, ecx
nop word cs:[rax + rax]
mov eax, dword [0x141dd3ea0]
add eax, dword [0x141dd3ea4]
cmp eax, 0xf25dcb98
je 0x1400b7390
jmp 0x1400b7485
mov eax, dword [0x141dd3ea8]
add eax, dword [0x141dd3eac]
and eax, 0xf29d89b6
xor eax, 0x829713e3
cmp eax, 0x55ec65ac
jbe 0x1400b73cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop word cs:[rax + rax]
mov eax, dword [0x141dd3eb0]
imul eax, dword [0x141dd3eb4]
and eax, 0xebbc05a5
xor eax, 0xc7d6e4be
imul rdi, rax, 0x129f5bb3
shr rdi, 0x3b
call rsi
cmp edi, 0x21ac317a
je 0x1400b73e0
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov al, 1
nop dword [rax + rax]
test al, al
je 0x1400b7420
mov ecx, 1
jmp 0x1400b7485
Function at 0x1400baa90
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x141dd45e8]
xor eax, dword [0x141dd45ec]
add eax, 0xe85ccdcd
mov ecx, 0xaf7352bf
imul rcx, rax
Function at 0x1400bffb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
mov rbp, rsp
mov eax, dword [0x141dd4e58]
xor eax, dword [0x141dd4e5c]
xor eax, 0xa8148408
and eax, 0xbc5c9648
add eax, 0x2c0602b5
cmp eax, 0x5e73366a
jbe 0x1400c0000
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, dword [0x141ddb1c8]
nop dword [rax + rax]
mov eax, dword [0x141dd4e60]
sub eax, dword [0x141dd4e64]
imul edx, eax, 0x21c15e79
add edx, 0xb8360794
xor edx, 0x909fa1c5
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov rax, rsp
mov ecx, dword [0x141ddb1c8]
cmp edx, 0xc0e9d3cf
ja 0x1400c0000
nop dword [rax]
mov edx, dword [0x141dd4e68]
add edx, dword [0x141dd4e6c]
xor edx, 0x6712f3a3
imul edx, edx, 0xdca5d2f8
add edx, 0xcb9014d2
cmp edx, 0x1752a90c
jb 0x1400c0050
cmp ecx, 3
je 0x1400c0114
mov byte [rax], 1
mov qword [rsi], rax
mov eax, dword [0x141dd4e70]
and eax, dword [0x141dd4e74]
imul eax, eax, 0x697e726d
add eax, 0x847e2123
and eax, 0x7fe69ec3
cmp eax, 0x717d8db4
ja 0x1400c00f2
mov eax, dword [0x141dd4e78]
xor edx, edx
div dword [0x141dd4e7c]
mov edi, eax
add edi, 0x63bb58b7
and edi, 0x7f5263e7
add edi, 0x8b865dc7
sub rsp, 0x20
lea rcx, [0x141ddb1c8]
lea r9, [0x141db9168]
xor edx, edx
mov r8, rsi
call fcn.1400fb0a0
add rsp, 0x20
cmp edi, 0xb370f668
jae 0x1400c0114
sub rsp, 0x20
lea rcx, [0x141ddb1c8]
lea r9, [0x141db9168]
xor edx, edx
mov r8, rsi
call fcn.1400fb0a0
add rsp, 0x20
jmp 0x1400c00a8
mov rsp, rbp
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400c0120
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
xor eax, eax
test al, al
jne 0x1400c014d
mov eax, dword [0x141dd4e80]
add eax, dword [0x141dd4e84]
imul esi, eax, 0xedd4940f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1400c0180
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov eax, dword [0x141dd4e90]
imul eax, dword [0x141dd4e94]
mov edi, ecx
imul eax, eax, 0x971988dd
or eax, 0x7a309d20
cmp eax, 0x8334b6d0
jne 0x1400c01c0
mov rax, qword [0x141ddb260]
nop dword [rax + rax]
mov eax, dword [0x141dd4e98]
and eax, dword [0x141dd4e9c]
add eax, 0xf8a39a42
xor eax, 0x14365a47
imul rcx, rax, 0x8ed4817
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
mov rbx, qword [0x141ddb260]
cmp eax, 0x1f85e5c4
ja 0x1400c01c0
nop dword [rax + rax]
mov eax, dword [0x141dd4ea0]
add eax, dword [0x141dd4ea4]
and eax, 0xc4805108
add eax, 0xa8386a5e
cmp eax, 0xe6179ca3
ja 0x1400c0200
test rbx, rbx
je 0x1400c0305
mov eax, dword [0x141dd4ea8]
imul eax, dword [0x141dd4eac]
xor eax, 0x10a00040
or eax, 0xcf4fffbf
cmp eax, 0x5c7ec177
jae 0x1400c0252
mov rcx, rbx
mov edx, edi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14d, 0xb73db3ff
mov r15, qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop
mov eax, dword [0x141dd4eb0]
xor eax, dword [0x141dd4eb4]
imul r12d, eax, 0x50ca3ecf
add r12d, 0xe42778fc
imul r12, r14
shr r12, 0x3f
mov rcx, rbx
mov edx, edi
mov r8, rsi
call r15
cmp r12d, 0x44581435
ja 0x1400c0260
nop word cs:[rax + rax]
mov ecx, dword [0x141dd4eb8]
or ecx, dword [0x141dd4ebc]
xor ecx, 0xfe8906f7
imul ecx, ecx, 0xe7a524d0
or ecx, 0x1e09f052
cmp ecx, 0x43f908df
jb 0x1400c02a0
nop word cs:[rax + rax]
mov ecx, dword [0x141dd4ec0]
imul ecx, dword [0x141dd4ec4]
add ecx, 0x7e3464b8
or ecx, 0x57524502
and ecx, 0x7fdecd43
cmp ecx, 0x2b8ebea3
jb 0x1400c02d0
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, edi
mov rdx, rsi
call fcn.1400fc870
jmp 0x1400c02d0
Function at 0x1400c0320
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rcx, qword [rcx]
nop
mov eax, dword [0x141dd4ef0]
xor eax, dword [0x141dd4ef4]
add eax, 0x1fbda12
xor eax, 0x74c62efa
cmp eax, 0xf3b46e22
ja 0x1400c0330
cmp rcx, 0xffffffffffffffff
je 0x1400c05e2
lea r9, [rcx + 1]
lea r10, [rcx + rcx]
mov r11d, 4
mov ebx, 0x28
nop word [rax + rax]
mov ebp, dword [0x141dd4ef8]
sub ebp, dword [0x141dd4efc]
or ebp, 0xa6760e1c
add ebp, 0xe8083285
cmp r10, r9
mov rdi, r9
cmova rdi, r10
cmp rdi, 5
cmovb rdi, r11
mov rax, rdi
mul rbx
mov r8, rax
seto al
cmp ebp, 0x3c370d11
jb 0x1400c0370
movabs rdx, 0x7ffffffffffffff8
mov r9d, 0xa3711717
nop
mov r11d, dword [0x141dd4f00]
imul r11d, dword [0x141dd4f04]
xor r11d, 0x88e753fa
imul r11, r9
shr r11, 0x3e
add r11d, 0x97f7d0d9
cmp r8, rdx
seta r10b
cmp r11d, 0xf418c824
ja 0x1400c03c0
or al, r10b
jne 0x1400c05e2
nop
mov eax, dword [0x141dd4f08]
xor edx, edx
div dword [0x141dd4f0c]
imul eax, eax, 0x44d2da0e
cmp eax, 0x42e1b39e
je 0x1400c0400
test rcx, rcx
je 0x1400c04f2
mov eax, dword [0x141dd4f10]
sub eax, dword [0x141dd4f14]
xor eax, 0xfd17d693
imul rax, rax, 0x1e998121
shr rax, 0x3c
add eax, 0x84529953
cmp eax, 0x70c146ea
jae 0x1400c0455
mov rax, qword [rsi + 8]
mov qword [rsp + 0x28], rax
shl rcx, 3
lea rax, [rcx + rcx*4]
nop dword [rax]
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x141dd4f18]
imul ecx, dword [0x141dd4f1c]
or ecx, 0x8c032004
and ecx, 0xadeb2526
add ecx, 0xf0fba159
cmp ecx, 0xa1e96964
ja 0x1400c0460
mov ecx, dword [0x141dd4f20]
and ecx, dword [0x141dd4f24]
imul rcx, rcx, 0x39c15a77
shr rcx, 0x3d
imul ecx, ecx, 0x5d7e2652
xor ecx, 0x3e5a2f40
cmp ecx, 0x4997e90e
jbe 0x1400c04c0
mov qword [rsp + 0x38], rax
mov ecx, dword [str.e1__j]
add ecx, dword [0x141dd4f2c]
or ecx, 0x30e5afa4
imul ecx, ecx, 0xa408d85e
or ecx, 0x9c316197
mov qword [rsp + 0x38], rax
cmp ecx, 0x49e60e47
jb 0x1400c04c0
mov eax, 8
jmp 0x1400c04f4
xor eax, eax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
lea r9, [rsp + 0x28]
mov edx, 8
call fcn.1400c1320
cmp qword [rsp + 0x40], 0
jne 0x1400c0590
mov ecx, dword [0x141dd4f40]
or ecx, dword [0x141dd4f44]
mov rax, qword [rsp + 0x48]
add ecx, 0xe4b8534
or ecx, 0x203791bc
cmp ecx, 0xe0d5a921
jne 0x1400c0550
mov qword [rsi + 8], rax
mov qword [rsi], rdi
nop word cs:[rax + rax]
mov ecx, dword [0x141dd4f48]
imul ecx, dword [0x141dd4f4c]
add ecx, 0xfbb6cf13
xor ecx, 0x6fe00a12
imul ecx, ecx, 0x9b832734
mov qword [rsi + 8], rax
mov qword [rsi], rdi
cmp ecx, 0x2a245491
je 0x1400c0550
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov eax, dword [0x141dd4f30]
and eax, dword [0x141dd4f34]
imul rax, rax, 0x226a8f7b
shr rax, 0x3d
add eax, 0xd512371
cmp eax, 0x76d6ed01
ja 0x1400c0590
mov eax, 0xfa7b3cdf
nop dword [rax + rax]
mov ecx, dword [0x141dd4f38]
sub ecx, dword [0x141dd4f3c]
xor ecx, 0xfd3d793a
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0xe251ed30
je 0x1400c05c0
ud2
Function at 0x1400ca250
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
nop word [rax + rax]
mov eax, dword [0x141dd6560]
xor edx, edx
div dword [str.Bhr]
add eax, 0xe3b14479
xor eax, 0x202a0070
or eax, 0x9545fb87
cmp eax, 0xd522e0c0
jb 0x1400ca260
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ecx, dword [0x141dd6568]
or ecx, dword [0x141dd656c]
or ecx, 0x57c92bf4
add ecx, 0x2c7faa9a
xor ecx, 0xde0084d1
cmp ecx, 0x44cf824f
jb 0x1400ca290
test eax, eax
jne 0x1400ca2c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x141dd6570]
xor edx, edx
div dword [0x141dd6574]
add eax, 0x65e0fe7
and eax, 0x722db542
cmp eax, 0x4b183939
je 0x1400ca2c0
nop
mov eax, dword [0x141dd6578]
sub eax, dword [0x141dd657c]
xor eax, 0xe39c30ed
add eax, 0x3a30b0b2
imul rax, rax, 0x57b228ab
shr rax, 0x3d
cmp eax, 0x4127c1f3
ja 0x1400ca2e0
cmp rsi, 0xffffffffffffffff
je 0x1400ca41d
lea rax, [rsi + 8]
nop word cs:[rax + rax]
mov ecx, dword [0x141dd6580]
sub ecx, dword [0x141dd6584]
add ecx, 0x35417198
or ecx, 0x58080212
and ecx, 0x5e0c1b3a
cmp ecx, 0x5cf9f27f
je 0x1400ca320
lock dec qword [rax]
jne 0x1400ca41d
mov eax, dword [str.wye]
mov ecx, dword [0x141dd658c]
add eax, ecx
add eax, 0x9fd345af
and eax, 0x150e92b
add eax, 0xa214aa3c
cmp eax, 0xed53004b
ja 0x1400ca394
mov eax, dword [0x141dd6590]
imul eax, dword [0x141dd6594]
or eax, 0x10f0ecf7
mov rdi, qword [0x141ddb260]
cmp eax, 0xa01bf071
jne 0x1400ca39d
mov rax, qword [0x141ddb260]
jmp 0x1400ca374
mov eax, dword [0x141dd6598]
xor edx, edx
div dword [0x141dd659c]
add eax, 0x69a7557f
or eax, 0xca1ae4aa
and eax, 0xebdbecbf
cmp eax, 0x3ea9ab1f
jb 0x1400ca3e9
mov eax, dword [0x141dd65a0]
xor eax, dword [0x141dd65a4]
imul ebx, eax, 0x34dd6fa7
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0xe29c2cac
jne 0x1400ca400
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400ca3c1
mov eax, dword [0x141dd65a8]
xor eax, dword [0x141dd65ac]
xor eax, 0x110e3e10
and eax, 0x31cf3e10
cmp eax, 0xafc5a29d
je 0x1400ca400
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400d5300
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
inc rcx
nop word cs:[rax + rax]
mov edx, dword [0x141dd7c18]
xor edx, dword [0x141dd7c1c]
cmp edx, 0x5cef4a68
je 0x1400d5320
cmp rcx, 2
jb 0x1400d537a
mov rcx, rax
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ecx, dword [0x141dd7c20]
xor ecx, dword [0x141dd7c24]
add ecx, 0x6e7f99e8
and ecx, 0x5637cccc
cmp ecx, 0xa96390
je 0x1400d5350
test eax, eax
je 0x1400d537a
add rsp, 0x20
pop rsi
ret
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x1400d5eb0
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov rbx, rdx
mov rsi, rcx
mov eax, dword [0x141dd7de8]
sub eax, dword [0x141dd7dec]
and eax, 0xcf697e1e
imul rax, rax, 0x5a0dfa01
shr rax, 0x3e
add eax, 0xe515d62f
cmp eax, 0xaed60dd6
jb 0x1400d5f24
mov eax, dword [0x141dd7df0]
imul eax, dword [0x141dd7df4]
imul ecx, eax, 0xf403fc5e
add ecx, 0xfb586515
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r14, rsp
cmp ecx, 0x6afc7829
jbe 0x1400d5f33
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
jmp 0x1400d5ef3
mov eax, dword [str.uCY:3]
add eax, dword [0x141dd7dfc]
cmp eax, 0x3e77cbc1
jne 0x1400d5f5a
sub rsp, 0x20
mov rcx, rbx
mov rdx, r14
call qword [sym.imp.shell32.dll_CommandLineToArgvW]
add rsp, 0x20
mov r15, qword [sym.imp.shell32.dll_CommandLineToArgvW]
nop word cs:[rax + rax]
mov eax, dword [0x141dd7e00]
xor edx, edx
div dword [0x141dd7e04]
and eax, 0x94a4a5a
imul r12d, eax, 0x395d6a1b
or r12d, 0xf23710e6
sub rsp, 0x20
mov rcx, rbx
mov rdx, r14
call r15
add rsp, 0x20
cmp r12d, 0x85c275ef
je 0x1400d5f70
mov rdi, rax
test rax, rax
je 0x1400d629c
mov eax, dword [0x141dd7e18]
add eax, dword [0x141dd7e1c]
mov ecx, 0xafc47f5b
imul rcx, rax
shr rcx, 0x3f
imul eax, ecx, 0x76eecb56
cmp eax, 0xf622c042
jne 0x1400d5fe5
mov qword [rbp - 0x10], 0
xor ecx, ecx
nop word [rax + rax]
movsxd rax, dword [r14]
mov qword [rbp - 0x10], 0
test cl, cl
jne 0x1400d5ff0
mov ecx, dword [0x141dd7e20]
sub ecx, dword [0x141dd7e24]
and ecx, 0x9c2a9af5
imul ecx, ecx, 0x38a6df99
add ecx, 0x6f254bba
cmp ecx, 0xc25461cc
jae 0x1400d6035
mov qword [rbp - 8], 8
mov qword [rbp], 0
lea rcx, [rdi + rax*8]
mov qword [rbp - 0x18], rcx
nop dword [rax]
mov ecx, dword [0x141dd7e28]
xor ecx, dword [0x141dd7e2c]
xor ecx, 0x20344182
or ecx, 0x57c38a48
imul rcx, rcx, 0x667afd03
shr rcx, 0x3e
mov qword [rbp - 8], 8
mov qword [rbp], 0
cmp ecx, 0x5b5ed4
je 0x1400d6040
nop dword [rax + rax]
mov ecx, dword [0x141dd7e30]
xor ecx, dword [0x141dd7e34]
xor ecx, 0x510520bc
and ecx, 0x7b9df0bc
cmp ecx, 0xc5579f3d
je 0x1400d6080
test eax, eax
je 0x1400d627a
mov r12d, 8
xor r13d, r13d
lea r14, [rbp - 0x10]
mov rbx, rdi
jmp 0x1400d60cd
mov qword [rsi], 0
mov qword [rsi + 8], 8
mov eax, dword [0x141dd7e08]
and eax, dword [0x141dd7e0c]
or eax, 0x98caa5
and eax, 0x89d8feb7
xor eax, 0xa3b151fc
cmp eax, 0xe766010
jae 0x1400d62e0
mov qword [rsi + 0x10], 0
nop word cs:[rax + rax]
mov eax, dword [0x141dd7e10]
imul eax, dword [0x141dd7e14]
imul eax, eax, 0x4d98b762
mov qword [rsi + 0x10], 0
cmp eax, 0x89b9a561
je 0x1400d62e0
jmp 0x1400d636d
Function at 0x1400d6980
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rsi, rcx
nop word cs:[rax + rax]
mov eax, dword [0x141dd7f28]
add eax, dword [0x141dd7f2c]
imul eax, eax, 0xc17234f1
cmp eax, 0x9a59ece7
je 0x1400d69a0
mov rcx, qword [rsi]
nop dword [rax]
mov eax, dword [0x141dd7f30]
xor eax, dword [0x141dd7f34]
add eax, 0xcf2cf0a9
or eax, 0x4402
and eax, 0x16c4402
cmp eax, 0x9f439ab
ja 0x1400d69c0

Function at 0x1400d6c80
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rsi, r9
mov rdi, r8
mov rbx, rdx
xor eax, eax
test al, al
je 0x1400d6cb1
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r8d, 0xc3cf5205
nop word [rax + rax]
mov eax, dword [0x141dd7f88]
xor edx, edx
div dword [0x141dd7f8c]
mov edx, eax
add edx, 0x2384b7da
imul rdx, r8
shr rdx, 0x3e
xor edx, 0x901eef
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r12, rsp
cmp edx, 0xf539a73
ja 0x1400d6cc0
nop dword [rax]
mov eax, dword [0x141dd7f90]
sub eax, dword [0x141dd7f94]
add eax, 0xd172929b
or eax, 0x46cf2821
cmp eax, 0x6fc18e85
je 0x1400d6d00
test cl, cl
je 0x1400d7630
movzx eax, cl
cmp eax, 1
je 0x1400d6dc9
mov eax, dword [0x141dd7f98]
xor edx, edx
div dword [0x141dd7f9c]
nop
Function at 0x1400d7f30
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x1400d8152
movabs r9, 0xfffffffffffffff
lea r8, [rcx + 1]
lea r10, [rcx + rcx]
mov r11d, 4
nop
mov eax, dword [0x141dd8228]
xor edx, edx
div dword [0x141dd822c]
xor eax, 0x840914
or eax, 0xd371a46a
cmp r10, r8
mov rdi, r8
cmova rdi, r10
cmp rdi, 5
cmovb rdi, r11
cmp eax, 0xdebb79bb
je 0x1400d7f60
mov r8, rdi
shl r8, 4
cmp rdi, r9
seta dl
movabs rax, 0x7ffffffffffffffc
cmp r8, rax
seta al
or al, dl
mov edx, dword [0x141dd8230]
and edx, dword [0x141dd8234]
add edx, 0x584fbf03
xor edx, 0x9ec9ec3c
cmp edx, 0x6335e793
jb 0x1400d7fb0
test al, al
jne 0x1400d8152
nop dword [rax + rax]
mov eax, dword [0x141dd8238]
sub eax, dword [0x141dd823c]
and eax, 0x628d8b6d
add eax, 0x4385d04a
cmp eax, 0xb317d73e
ja 0x1400d7fe0
nop dword [rax]
mov eax, dword [0x141dd8240]
or eax, dword [0x141dd8244]
imul eax, eax, 0xefe7ca06
and eax, 0x6cb58412
cmp eax, 0xf49028e7
je 0x1400d8000
test rcx, rcx
je 0x1400d808e
mov edx, dword [0x141dd8248]
imul edx, dword [0x141dd824c]
mov rax, qword [rsi + 8]
imul edx, edx, 0xc7c7a0bd
and edx, 0x30f06720
cmp edx, 0xb34020c1
jne 0x1400d804d
mov qword [rsp + 0x28], rax
shl rcx, 4
nop word cs:[rax + rax]
mov edx, dword [0x141dd8250]
imul edx, dword [0x141dd8254]
xor edx, 0x2221401
or edx, 0x814cc9f2
mov qword [rsp + 0x28], rax
cmp edx, 0x34269cdf
jb 0x1400d8060
xor eax, eax
test al, al
je 0x1400d8092
jmp 0x1400d80bc
xor eax, eax
jmp 0x1400d80c8
mov eax, dword [0x141dd8258]
xor edx, edx
div dword [0x141dd825c]
and eax, 0xb72df5a5
imul eax, eax, 0xe8a0dab
add eax, 0x873e368f
mov qword [rsp + 0x38], rcx
cmp eax, 0xf5e33bd8
jbe 0x1400d80c3
mov qword [rsp + 0x38], rcx
jmp 0x1400d8092
mov eax, 4
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
lea r9, [rsp + 0x28]
mov edx, 4
call fcn.1400c1320
cmp qword [rsp + 0x40], 0
jne 0x1400d8130
nop dword [rax]
mov eax, dword [0x141dd8278]
xor edx, edx
div dword [0x141dd827c]
or eax, 0x442c71
and eax, 0xef67ae7f
cmp eax, 0x5640ddbc
je 0x1400d80f0
mov rax, qword [rsp + 0x48]
mov qword [rsi + 8], rax
mov qword [rsi], rdi
add rsp, 0x58
pop rdi
pop rsi
ret
mov eax, dword [0x141dd8260]
add eax, dword [0x141dd8264]
xor eax, 0x44de81be
add eax, 0x6a55c8be
or eax, 0xa3ffc306
cmp eax, 0xe951ea5f
jb 0x1400d8130
mov eax, dword [0x141dd8268]
imul eax, dword [0x141dd826c]
xor eax, 0x89162402
or eax, 0x72e98330
add eax, 0xf3f98985
cmp eax, 0x30b7f274
jb 0x1400d819b
mov eax, dword [0x141dd8270]
xor edx, edx
div dword [0x141dd8274]
add eax, 0xb6bc3dba
and eax, 0xa46b7570
add eax, 0xd7a28bb2
ud2
ud2
Function at 0x1400dac30
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov rsi, rcx
xor eax, eax
test al, al
je 0x1400dac60
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
nop dword [rax + rax]
mov eax, dword [0x141dd8808]
mov ecx, dword [0x141dd880c]
add ecx, eax
add ecx, 0xcc3c729b
and ecx, 0xa58e823a
add ecx, 0x51b10d42
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov rdi, rsp
cmp ecx, 0xddc92a05
ja 0x1400dac60
mov rax, qword [rsi]
cmp rax, 0xffffffffffffffff
je 0x1400dae80
lea rdx, [rax + 1]
lea rcx, [rax + rax]
mov r8d, 4
nop word cs:[rax + rax]
mov r9d, dword [0x141dd8810]
imul r9d, dword [0x141dd8814]
or r9d, 0x5171b9f
add r9d, 0xaf0ceabb
or r9d, 0xf25a4db1
cmp rcx, rdx
mov r15, rdx
cmova r15, rcx
cmp r15, 5
cmovb r15, r8
cmp r9d, 0x90d02919
jb 0x1400dacc0
test r15, r15
js 0x1400dae80
lea rbx, [r15 + r15]
movabs rdx, 0x7ffffffffffffffe
cmp rbx, rdx
ja 0x1400dae80
nop
mov edx, dword [0x141dd8818]
or edx, dword [0x141dd881c]
imul edx, edx, 0xdaa82e2c
cmp edx, 0x55ccd45
je 0x1400dad20
test rax, rax
je 0x1400dae6e
mov rax, qword [rsi + 8]
mov qword [rbp - 0x10], rax
mov qword [rbp], rcx
mov r12d, 2
xor eax, eax
test al, al
je 0x1400dad7b
mov qword [rbp - 8], r12
sub rsp, 0x20
lea r9, [rbp - 0x10]
mov edx, 2
mov rcx, rdi
mov r8, rbx
call fcn.1400c1320
add rsp, 0x20
lea r14, [rbp - 0x10]
nop
mov r13d, dword [0x141dd8820]
xor r13d, dword [0x141dd8824]
or r13d, 0xe1059461
xor r13d, 0x5071863
or r13d, 0x1a78638c
mov qword [rbp - 8], r12
sub rsp, 0x20
mov edx, 2
mov rcx, rdi
mov r8, rbx
mov r9, r14
call fcn.1400c1320
add rsp, 0x20
cmp r13d, 0xbea41418
je 0x1400dad80
cmp qword [rdi], 0
jne 0x1400dae80
nop word cs:[rax + rax]
mov eax, dword [0x141dd8838]
and eax, dword [0x141dd883c]
add eax, 0xab2ecd99
or eax, 0xfbefdfef
cmp eax, 0x4481358a
je 0x1400dade0
mov ecx, dword [0x141dd8840]
and ecx, dword [0x141dd8844]
mov rax, qword [rdi + 8]
or ecx, 0x91570c33
add ecx, 0x34af3910
cmp ecx, 0x65c97d22
jbe 0x1400dae30
mov qword [rsi + 8], rax
mov qword [rsi], r15
nop dword [rax + rax]
mov ecx, dword [0x141dd8848]
or ecx, dword [0x141dd884c]
add ecx, 0x3299ece
and ecx, 0x83628a9d
xor ecx, 0x910064cb
mov qword [rsi + 8], rax
mov qword [rsi], r15
cmp ecx, 0xfa5e7dd
jb 0x1400dae30
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor r12d, r12d
xor eax, eax
test al, al
jne 0x1400dad5b
jmp 0x1400dad7b
mov eax, dword [0x141dd8828]
sub eax, dword [0x141dd882c]
shr eax, 2
imul rax, rax, 0x4499897f
shr rax, 0x38
and eax, 8
add eax, 0xcb0c1938
cmp eax, 0x62274fe4
jae 0x1400daeab
ud2
xor eax, eax
nop dword [rax]
ud2
Function at 0x1400e45c0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x141dd9dd8]
xor edx, edx
div dword [0x141dd9ddc]
nop dword [rax + rax]

Function at 0x1400e4930
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x278
lea rbp, [rsp + 0x80]
movapd xmmword [rbp + 0x1e0], xmm6
mov qword [rbp + 0x1c0], r8
mov qword [rbp + 0x1c8], rdx
enter 1, 0
mov eax, dword [0x141dd9e58]
or eax, dword [0x141dd9e5c]
mov qword [rbp + 0x1d0], rcx
imul eax, eax, 0x8188b16e
add eax, 0xc967368
cmp eax, 0xc1d4b31
jb 0x1400e4ebb