joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d89c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov edi, edx
mov rsi, rcx
mov r14d, edx
shr r14d, 8
mov ebp, edx
shr ebp, 0x10
mov rcx, qword [rcx]
mov rbx, qword [rsi + 0x10]
nop word cs:[rax + rax]
mov eax, dword [0x141dd93f8]
and eax, dword [0x141dd93fc]
imul eax, eax, 0x810fe5d6
cmp eax, 0x292ef127
je 0x1400d89f0
cmp rbx, rcx
jne 0x1400d8a19
mov rcx, rsi
call fcn.1400f02c0
mov rcx, qword [rsi]
mov eax, dword [0x141dd9400]
imul eax, dword [0x141dd9404]
imul eax, eax, 0x8e110bc2
or eax, 0xf0073c93
imul rax, rax, 0x75143bdb
shr rax, 0x3e
cmp eax, 0x53c9378d
ja 0x1400d8a5b
mov rax, qword [rsi + 8]
mov byte [rax + rbx], dil
lea rdx, [rbx + 1]
mov qword [rsi + 0x10], rdx
xor r8d, r8d
test r8b, r8b
je 0x1400d8a6d
mov rax, qword [rsi + 8]
mov byte [rax + rbx], dil
lea rax, [rbx + 1]
mov qword [rsi + 0x10], rax
jmp 0x1400d8a43
cmp rdx, rcx
jne 0x1400d8ad6
mov eax, dword [0x141dd9408]
xor eax, dword [0x141dd940c]
and eax, 0x84a2c20
or eax, 0xf19592cd
imul eax, eax, 0x902abd9e
cmp eax, 0xb29f568a
je 0x1400d8ac5
mov eax, dword [0x141dd9410]
or eax, dword [0x141dd9414]
and eax, 0xddb182ba
imul r15d, eax, 0xac291af7
add r15d, 0xd53f5c6d
mov rcx, rsi
call fcn.1400f02c0
cmp r15d, 0xad7d968
jae 0x1400d8acf
mov rcx, rsi
call fcn.1400f02c0
jmp 0x1400d8a95
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
mov byte [rax + rbx + 1], r14b
lea rdx, [rbx + 2]
mov qword [rsi + 0x10], rdx
cmp rdx, rcx
jne 0x1400d8ba6
mov eax, dword [0x141dd9418]
sub eax, dword [0x141dd941c]
or eax, 0x10de5625
add eax, 0x15e17a1b
cmp eax, 0xbcc98d6f
ja 0x1400d8b36
mov r14d, dword [0x141dd9420]
xor r14d, dword [0x141dd9424]
xor r14d, 0xf8ed1c4d
add r14d, 0x43e47a2b
mov rcx, rsi
call fcn.1400f02c0
cmp r14d, 0x7d7978a5
jbe 0x1400d8b40
mov rcx, rsi
call fcn.1400f02c0
jmp 0x1400d8b09
mov eax, dword [0x141dd9428]
sub eax, dword [0x141dd942c]
xor eax, 0xc10d5559
imul rcx, rax, 0xfb79ab9
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
or eax, 0xfccbe3bc
cmp eax, 0xe88b1dd1
je 0x1400d8b40
mov rax, qword [rsi + 8]
nop word cs:[rax + rax]
mov ecx, dword [0x141dd9430]
add ecx, dword [0x141dd9434]
imul ecx, ecx, 0x38f746b1
add ecx, 0x976fcd66
xor ecx, 0x1cf4a3cf
cmp ecx, 0x9eca13ba
ja 0x1400d8b80
mov ecx, dword [0x141dd9438]
and ecx, dword [0x141dd943c]
add ecx, 0x4e07b751
xor ecx, 0x183e3cb5
imul rcx, rcx, 0x25c0670f
shr rcx, 0x3d
cmp ecx, 0x3f2fcf1f
jne 0x1400d8bde
mov byte [rax + rbx + 2], bpl
lea rcx, [rbx + 3]
mov qword [rsi + 0x10], rcx
lea rcx, [rbx + 3]
nop word cs:[rax + rax]
mov edx, dword [0x141dd9440]
imul edx, dword [0x141dd9444]
imul edx, edx, 0x83a3c5e9
mov byte [rax + rbx + 2], bpl
mov qword [rsi + 0x10], rcx
cmp edx, 0x5f47701e
je 0x1400d8bf0
cmp rcx, qword [rsi]
jne 0x1400d8c21
mov rcx, rsi
call fcn.1400f02c0
shr edi, 0x18
mov rax, qword [rsi + 8]
mov byte [rax + rbx + 3], dil
add rbx, 4
mov qword [rsi + 0x10], rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400dbaf0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov r9, qword [rcx]
nop dword [rax]
mov eax, dword [0x141dd9a48]
or eax, dword [0x141dd9a4c]
and eax, 0xdb27cce1
imul eax, eax, 0xf17c565
cmp eax, 0x84c2359c
ja 0x1400dbb00
cmp r9, 0xffffffffffffffff
je 0x1400dbc6c
lea rax, [r9 + 1]
lea rcx, [r9 + r9]
cmp rcx, rax
cmova rax, rcx
cmp rax, 5
mov edi, 4
cmovae rdi, rax
movabs r10, 0x7ffffffffffffffe
mov eax, dword [0x141dd9a50]
xor edx, edx
div dword [0x141dd9a54]
lea r8, [rdi + rdi]
mov r11d, dword [0x141dd9a58]
xor r11d, dword [0x141dd9a5c]
xor r11d, 0xc57e98fa
add r11d, 0x21a00d90
test rdi, rdi
sets al
cmp r8, r10
seta dl
cmp r11d, 0x81d169c9
ja 0x1400dbb60
or al, dl
jne 0x1400dbc6c
nop dword [rax]
mov eax, dword [0x141dd9a60]
xor edx, edx
div dword [0x141dd9a64]
and eax, 0xcc9e8ffe
add eax, 0x73bf581e
imul rdx, rax, 0x439c7c21
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1c
cmp eax, 0x8bb8904d
je 0x1400dbba0
test r9, r9
je 0x1400dbc06
mov rax, qword [rsi + 8]
mov qword [rsp + 0x28], rax
mov eax, dword [0x141dd9a68]
or eax, dword [0x141dd9a6c]
add eax, 0x239c6879
and eax, 0xe04d9a53
imul eax, eax, 0x1ccca332
cmp eax, 0x8b8ad9a6
jae 0x1400dbc0a
jmp 0x1400dbc2c
xor eax, eax
jmp 0x1400dbc38
mov eax, dword [0x141dd9a70]
or eax, dword [0x141dd9a74]
add eax, 0x4bfc7ae4
or eax, 0xfff7deaa
mov qword [rsp + 0x38], rcx
cmp eax, 0xc4acecd7
jae 0x1400dbc33
mov qword [rsp + 0x38], rcx
jmp 0x1400dbc0a
mov eax, 2
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
lea r9, [rsp + 0x28]
mov edx, 2
call fcn.1400c1ab0
cmp qword [rsp + 0x40], 0
jne 0x1400dbc6c
mov rax, qword [rsp + 0x48]
mov qword [rsi + 8], rax
mov qword [rsi], rdi
add rsp, 0x58
pop rdi
pop rsi
ret
ud2
Function at 0x1400deb40
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
nop dword [rax]
mov eax, dword [0x141dda2a0]
or eax, dword [0x141dda2a4]
imul eax, eax, 0x5e7affa1
xor eax, 0x2cda0163
add eax, 0x503bf349
cmp eax, 0xff77dea6
ja 0x1400deb50
mov eax, 0x81657eb9
nop dword [rax + rax]
mov ecx, dword [0x141dda2a8]
and ecx, dword [0x141dda2ac]
or ecx, 0xf7f40c61
imul rcx, rax
shr rcx, 0x3f
or ecx, 0xd8ca884
cmp ecx, 0x7c068525
ja 0x1400deb80
cmp qword [r8 + 8], 0
je 0x1400dec48
mov rax, qword [r8]
mov rcx, qword [r8 + 0x10]
nop word [rax + rax]
mov edx, dword [0x141dda2b0]
and edx, dword [0x141dda2b4]
xor edx, 0x521088d1
add edx, 0xf5c6a8e
cmp edx, 0xb2069887
jb 0x1400debc0
test rcx, rcx
je 0x1400dec00
mov rcx, qword [0x141ddc4e0]
xor edx, edx
mov r8, rax
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x1400ded43
mov eax, dword [0x141dda2b8]
mov ecx, dword [0x141dda2bc]
add eax, ecx
add eax, 0xf4190eb6
or eax, 0x60b47a87
cmp eax, 0xdfa61fd2
je 0x1400dec00
test rdi, rdi
je 0x1400dec7c
mov eax, dword [0x141dda2c0]
and eax, dword [0x141dda2c4]
add eax, 0xf10fdc78
or eax, 0x66b9c1ac
and eax, 0xf7b9d7af
cmp eax, 0xb108cdff
je 0x1400decb5
jmp 0x1400dec86
test rdi, rdi
je 0x1400dec7c
movzx eax, byte [0x141ddc4f8]
mov eax, dword [0x141dda2d8]
imul eax, dword [0x141dda2dc]
xor eax, 0x906e01a0
imul eax, eax, 0xf6ecb740
cmp eax, 0x5e95d0f4
je 0x1400ded37
jmp 0x1400ded06
mov eax, 2
jmp 0x1400ded43
mov eax, dword [0x141dda2c8]
and eax, dword [0x141dda2cc]
add eax, 0x256b097
or eax, 0xf19cc5f4
imul rax, rax, 0x1b719021
shr rax, 0x3c
movzx ecx, byte [0x141ddc4f8]
cmp eax, 0xc9b6e3d3
jne 0x1400decbe
movzx eax, byte [0x141ddc4f8]
jmp 0x1400dec86
mov eax, dword [0x141dda2d0]
imul eax, dword [0x141dda2d4]
xor eax, 0xfc503814
add eax, 0xeefed029
cmp eax, 0x8fc33e10
jbe 0x1400dece6
xor ecx, ecx
mov rdx, rdi
call fcn.1400c0a10
xor ebx, ebx
nop dword [rax + rax]
xor ecx, ecx
mov rdx, rdi
call fcn.1400c0a10
test bl, bl
jne 0x1400decf0
mov cl, 1
test cl, cl
je 0x1400ded00
jmp 0x1400ded43
mov eax, dword [0x141dda2e0]
or eax, dword [0x141dda2e4]
mov ebx, 0x83731fcb
imul rbx, rax
shr rbx, 0x3e
or ebx, 0x75ddee7c
xor ecx, ecx
mov rdx, rdi
call fcn.1400c0a10
cmp ebx, 0xd6af4f14
jbe 0x1400ded43
xor ecx, ecx
mov rdx, rdi
call fcn.1400c0a10
jmp 0x1400ded06
xor ecx, ecx
test rax, rax
mov edx, 2
cmovne rdx, rax
sete cl
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rdi
mov qword [rsi], rcx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400f02c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rcx, qword [rcx]
mov eax, dword [0x141ddc320]
xor edx, edx
div dword [0x141ddc324]
nop word [rax + rax]
mov eax, dword [0x141ddc328]
xor eax, dword [0x141ddc32c]
add eax, 0xeb0a94f6
xor eax, 0x1d2374f7
imul eax, eax, 0x675fe947
cmp eax, 0x67605826
jb 0x1400f02e0
cmp rcx, 0xffffffffffffffff
je 0x1400f04af
lea rax, [rcx + 1]
lea rdx, [rcx + rcx]
xor r9d, r9d
nop dword [rax + rax]
cmp rdx, rax
mov r8, rax
cmova r8, rdx
test r9b, r9b
jne 0x1400f0320
cmp r8, 9
mov edi, 8
cmovae rdi, r8
test rdi, rdi
js 0x1400f04af
nop word cs:[rax + rax]
mov eax, dword [0x141ddc330]
xor edx, edx
div dword [0x141ddc334]
or eax, 0xdffffde7
cmp eax, 0xee8982c6
je 0x1400f0350
mov eax, dword [0x141ddc338]
xor edx, edx
div dword [0x141ddc33c]
nop dword [rax + rax]
mov eax, dword [0x141ddc340]
imul eax, dword [0x141ddc344]
imul eax, eax, 0x5aa8ac54
cmp eax, 0xfeea5ffa
je 0x1400f0380
test rcx, rcx
je 0x1400f03a7
xor eax, eax
test al, al
je 0x1400f03ae
jmp 0x1400f03db
xor eax, eax
jmp 0x1400f0447
mov eax, dword [0x141ddc348]
mov edx, dword [0x141ddc34c]
add eax, edx
add eax, 0x9ae76017
or eax, 0x6f630a53
add eax, 0x5c3be711
mov rdx, qword [rsi + 8]
mov qword [rsp + 0x28], rdx
cmp eax, 0x331e6c45
jae 0x1400f03e6
mov rax, qword [rsi + 8]
mov qword [rsp + 0x28], rax
jmp 0x1400f03ae
mov eax, dword [0x141ddc350]
mov edx, dword [0x141ddc354]
add eax, edx
add eax, 0x17012b8b
and eax, 0x341baeb4
add eax, 0x7b35046
cmp eax, 0x411eeb5e
ja 0x1400f043b
mov eax, dword [0x141ddc358]
add eax, dword [0x141ddc35c]
xor eax, 0x92c7038c
imul rdx, rax, 0x49b6ac33
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1c
mov qword [rsp + 0x38], rcx
cmp eax, 0x39a37508
jne 0x1400f0442
mov qword [rsp + 0x38], rcx
jmp 0x1400f040a
mov eax, 1
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
lea r9, [rsp + 0x28]
mov edx, 1
mov r8, rdi
call fcn.1400c1ab0
cmp qword [rsp + 0x40], 0
jne 0x1400f04af
mov rax, qword [rsp + 0x48]
mov qword [rsi + 8], rax
mov qword [rsi], rdi
mov eax, 0x9927eae7
nop dword [rax]
mov ecx, dword [0x141ddc370]
xor ecx, dword [0x141ddc374]
add ecx, 0x1f7811db
imul rcx, rax
shr rcx, 0x3e
or ecx, 0xc2675d3c
cmp ecx, 0x2e25bd9a
je 0x1400f0480
add rsp, 0x58
pop rdi
pop rsi
ret
mov eax, dword [0x141ddc360]
xor edx, edx
div dword [0x141ddc364]
and eax, 0x8db8578e
add eax, 0xdf7d9a92
or eax, 0x34a70a75
cmp eax, 0xc878a56
jne 0x1400f04e0
ud2
mov eax, dword [0x141ddc368]
or eax, dword [0x141ddc36c]
or eax, 0x50885002
and eax, 0x509c7026
imul eax, eax, 0xcf824998
ud2

Function at 0x1400f0cc8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400f0d12
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400f0d12
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400f0d12
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400f0d12
cmp dword [rcx + 0x84], 0xe
jbe 0x1400f0d12
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400f0d14
xor al, al
add rsp, 0x28
ret
Function at 0x1400f4ae0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov eax, dword [0x141dc69b0]
or eax, dword [0x141dc69b4]
imul eax, eax, 0xc0dde0fa
and eax, 0xc6d875a0
cmp eax, 0xc0db569f
jbe 0x1400f4b40
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov rcx, rsp
sub rsp, 0x20
call fcn.140044020
mov rcx, rsi
call fcn.140044050
add rsp, 0x20
nop dword [rax + rax]
mov eax, dword [str._Jv]
or eax, dword [0x141dc69bc]
imul eax, eax, 0xb57e8e8a
and eax, 0x6bb9cfc8
imul ebx, eax, 0x25d7df5a
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov rdi, rsp
sub rsp, 0x20
mov rcx, rdi
call fcn.140044020
mov rcx, rsi
call fcn.140044050
add rsp, 0x20
cmp ebx, 0xe2c1d543
je 0x1400f4b40
mov edi, dword [rdi + 8]
mov eax, edi
not eax
test eax, 0xc000000
jne 0x1400f4bc1
sub rsp, 0x20
call fcn.1400440b0
add rsp, 0x20
not eax
test al, 6
sete al
jmp 0x1400f4bc3
xor eax, eax
mov ecx, dword [0x141dc69c0]
and ecx, dword [0x141dc69c4]
and ecx, 0x32a399be
add ecx, 0xe18f2264
and ecx, 0xc223881e
cmp ecx, 0xa621b6a6
jae 0x1400f4c02
movzx ecx, byte [rsi + 4]
shr cl, 5
and cl, al
mov edx, edi
shr edx, 0x1c
and edx, 1
and dl, cl
mov byte [section..data], dl
shr edi, 0x1c
and edi, 1
nop dword [rax + rax]
mov ecx, dword [0x141dc69c8]
imul ecx, dword [0x141dc69cc]
or ecx, 0x565574aa
xor ecx, 0x2fe3bf0c
shr ecx, 1
imul rcx, rcx, 0x27dccbb1
shr rcx, 0x3c
movzx edx, byte [rsi + 4]
shr dl, 5
mov r8d, eax
and r8b, dil
and r8b, dl
mov byte [section..data], r8b
cmp ecx, 0xbd757332
ja 0x1400f4c10
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400f6610
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov eax, dword [0x141dcb480]
and eax, dword [0x141dcb484]
imul eax, eax, 0xb52bfda2
and eax, 0xa9f52fa0
add eax, 0x936bfa03
cmp eax, 0x35d2d66
jb 0x1400f6683
mov eax, dword [0x141dcb488]
add eax, dword [0x141dcb48c]
and eax, 0xe49742d5
add eax, 0x2011c061
shr eax, 2
imul rdx, rax, 0x113c77eb
shr rdx, 0x39
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov r8, rsp
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov rcx, rsp
cmp edx, 0x7cc00b82
jbe 0x1400f669f
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
jmp 0x1400f6637
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov rax, rsp
mov edx, dword [0x141dcb490]
xor edx, dword [0x141dcb494]
add edx, 0x86187be3
and edx, 0x84609bc8
cmp edx, 0xd305d3fb
jbe 0x1400f66df
lea rdx, [0x141ddc420]
mov qword [rax], rdx
mov edx, dword [0x141ddc428]
lea rdx, [0x141ddc420]
nop word cs:[rax + rax]
mov r10d, dword [0x141dcb498]
add r10d, dword [0x141dcb49c]
xor r10d, 0x6c051506
and r10d, 0xec4d1527
xor r10d, 0x10399b74
mov qword [rax], rdx
mov r9d, dword [0x141ddc428]
cmp r10d, 0x5811d8ee
ja 0x1400f66f0
cmp r9d, 3
jne 0x1400f678a
nop dword [rax]
mov eax, dword [0x141dcb4a0]
and eax, dword [0x141dcb4a4]
add eax, 0xf6605bdd
or eax, 0xc40a0b18
and eax, 0xde3e8b18
cmp eax, 0x3dada9b3
jb 0x1400f6730
nop word cs:[rax + rax]
mov eax, dword [0x141dcb4a8]
xor edx, edx
div dword [0x141dcb4ac]
add eax, 0xefc6797e
imul rax, rax, 0x131a5bd5
shr rax, 0x3b
cmp eax, 0xcacb9a3c
ja 0x1400f6760
mov rsp, rbp
pop rbp
ret
mov qword [rcx], rax
mov qword [r8], rcx
sub rsp, 0x20
lea rcx, [0x141ddc428]
lea r9, [0x141dba428]
xor edx, edx
call fcn.1400fbc40
add rsp, 0x20
jmp 0x1400f6730

Function at 0x1400f67b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x40
lea rcx, [rsp + 0x20]
call fcn.140044020
lea rcx, [rsp + 0x30]
call fcn.140044050
mov esi, dword [rsp + 0x28]
mov eax, esi
not eax
test eax, 0xc000000
jne 0x1400f6857
call fcn.1400440b0
mov rcx, rax
and ecx, 6
mov eax, dword [0x141dcbd70]
xor edx, edx
div dword [0x141dcbd74]
nop word cs:[rax + rax]
mov eax, dword [0x141dcbd78]
xor eax, dword [0x141dcbd7c]
and eax, 0x27009058
add eax, 0xe10518e
cmp ecx, 6
sete r8b
cmp eax, 0x24ec4721
ja 0x1400f6800
nop word cs:[rax + rax]
mov eax, dword [0x141dcbd80]
xor edx, edx
div dword [0x141dcbd84]
xor eax, 0x153cab96
imul eax, eax, 0xb16149c3
add eax, 0x63552a4f
cmp eax, 0x4f171953
ja 0x1400f6830
jmp 0x1400f685a
xor r8d, r8d
movzx eax, byte [rsp + 0x34]
shr al, 5
and al, r8b
shr esi, 0x1c
and esi, 1
and sil, al
mov byte [0x141dc0001], sil
mov eax, esi
add rsp, 0x40
pop rsi
ret
Function at 0x1400fb990
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov r9, rdx
mov rsi, rcx
mov eax, dword [0x141dce778]
and eax, dword [0x141dce77c]
add eax, 0x54bade04
imul rax, rax, 0x6de20593
shr rax, 0x3b
cmp eax, 0xe13dd064
jbe 0x1400fb9e0
mov eax, 0x20
call fcn.1400f07c0
sub rsp, rax
nop word cs:[rax + rax]
mov eax, dword [0x141dce780]
xor edx, edx
div dword [0x141dce784]
mov ecx, eax
xor ecx, 0x8afcb12
add ecx, 0x74afb8a5
xor ecx, 0x6f3ee3a1
mov eax, 0x20
call fcn.1400f07c0
sub rsp, rax
mov rbx, rsp
cmp ecx, 0x3465a463
ja 0x1400fb9e0
mov eax, 0x20
call fcn.1400f07c0
sub rsp, rax
mov rdi, rsp
mov rcx, qword [rsi]
lea rax, [rcx + rcx]
cmp rax, r9
cmova r9, rax
cmp r9, 5
mov r12d, 4
cmovae r12, r9
lea rax, [r8 + 7]
and rax, 0xfffffffffffffff8
mul r12
jo 0x1400fbbe5
mov r14, rax
movabs rax, 0x7ffffffffffffff8
cmp r14, rax
ja 0x1400fbbe5
test rcx, rcx
je 0x1400fbacc
mov rax, qword [rsi + 8]
imul rcx, r8
mov qword [rbx], rax
mov qword [rbx + 0x10], rcx
mov eax, 0x8fc31885
nop word cs:[rax + rax]
mov ecx, dword [0x141dce788]
xor ecx, dword [0x141dce78c]
add ecx, 0x34430aeb
mov rdx, rcx
imul rdx, rax
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1b
xor ecx, 0x82fffb22
cmp ecx, 0x6c297ae3
jb 0x1400fba90
mov r13d, 8
jmp 0x1400fbacf
xor r13d, r13d
mov eax, dword [0x141dce790]
add eax, dword [0x141dce794]
imul eax, eax, 0xa15e7875
add eax, 0xb726c38f
or eax, 0x2aacb7d9
cmp eax, 0xb1b189fe
jne 0x1400fbb10
mov qword [rbx + 8], r13
sub rsp, 0x20
mov rcx, rdi
mov rdx, r14
mov r8, rbx
call fcn.140084090
add rsp, 0x20
nop dword [rax]
mov eax, dword [0x141dce798]
xor edx, edx
div dword [0x141dce79c]
mov r15d, eax
xor r15d, 0x4080000
or r15d, 0x42210444
and r15d, 0xde392644
mov qword [rbx + 8], r13
sub rsp, 0x20
mov rcx, rdi
mov rdx, r14
mov r8, rbx
call fcn.140084090
add rsp, 0x20
cmp r15d, 0xfebc4e29
ja 0x1400fbb10
cmp qword [rdi], 0
jne 0x1400fbbc0
mov eax, dword [0x141dce7a0]
imul eax, dword [0x141dce7a4]
imul eax, eax, 0x8cebea06
or eax, 0x1137eff4
imul eax, eax, 0xcfaf1078
cmp eax, 0x744c7278
ja 0x1400fbbc0
mov eax, dword [0x141dce7a8]
add eax, dword [0x141dce7ac]
imul eax, eax, 0xa39fe2b1
add eax, 0xaccc965b
cmp eax, 0x93413186
jae 0x1400fbc10
ud2
mov eax, dword [0x141dce7b0]
imul eax, dword [0x141dce7b4]
or eax, 0x2ef8e37
xor eax, 0xb07dac58
imul eax, eax, 0x4a702f71
ud2
Function at 0x1400fd240
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rdx
mov edi, ecx
mov eax, dword [0x141dd6020]
xor eax, dword [0x141dd6024]
add eax, 0x4cac0cfb
or eax, 0x2bff4d9
imul eax, eax, 0x9cecebe8
cmp eax, 0x44b49026
ja 0x1400fd29d
mov eax, dword [0x141dd6028]
or eax, dword [0x141dd602c]
add eax, 0x36d62f07
imul r14, rax, 0x6e4e593
shr r14, 0x3a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp r14d, 0xed6bfc1c
jbe 0x1400fd2a5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x1400fd272
mov rbx, rax
nop dword [rax + rax]
mov eax, dword [0x141dd6030]
sub eax, dword [0x141dd6034]
xor eax, 0x38b5d88c
add eax, 0xc39235ae
or eax, 0xb159d45d
cmp eax, 0x7a2aedb1
je 0x1400fd2b0
test rbx, rbx
je 0x1400fd330
mov eax, dword [0x141dd6038]
imul eax, dword [0x141dd603c]
add eax, 0xbade9216
and eax, 0x87093f65
cmp eax, 0xbeb0674d
jne 0x1400fd2fc
mov qword [0x141ddc4e0], rbx
xor eax, eax
nop
mov qword [0x141ddc4e0], rbx
test al, al
jne 0x1400fd300
mov eax, dword [0x141dd6040]
sub eax, dword [0x141dd6044]
add eax, 0xea4ac1e3
and eax, 0xc82d6a52
imul eax, eax, 0x6a131891
cmp eax, 0x6bcc210d
jae 0x1400fd334
jmp 0x1400fd362
xor ecx, ecx
jmp 0x1400fd3b0
mov ebp, dword [0x141dd6048]
add ebp, dword [0x141dd604c]
or ebp, 0xad9b4ec
xor ebp, 0x534e0eee
mov rcx, rbx
mov edx, edi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp ebp, 0x9f823b63
jae 0x1400fd372
mov rcx, rbx
mov edx, edi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x1400fd334
mov rcx, rax
nop word cs:[rax + rax]
mov eax, dword [0x141dd6050]
xor edx, edx
div dword [0x141dd6054]
add eax, 0x950b6c85
or eax, 0xd7a04bf2
imul eax, eax, 0xa9e4c50
cmp eax, 0xbc36f1c2
ja 0x1400fd380
nop word cs:[rax + rax]
mov eax, dword [0x141dd6058]
xor edx, edx
div dword [0x141dd605c]
cmp eax, 0x3933581a
je 0x1400fd3b0
mov rax, rcx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140100b6f
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x10
lea rbp, [rsp + 0x10]
mov eax, dword [0x141dd8f98]
add eax, dword [0x141dd8f9c]
or eax, 0x1bd7a52
and eax, 0x95bd7a7e
push 0x10
pop rcx
cmp eax, 0xe09ad1d4
ja 0x140100bd9
mov eax, dword [0x141dd8fa0]
or eax, dword [0x141dd8fa4]
xor eax, 0x4ab0a160
or eax, 0x50e1e8f
mov r8d, 0xaac5ec83
xor edx, edx
div r8d
mov edx, eax
mov rax, rcx
call fcn.1400f07c0
sub rsp, rax
mov r9, rsp
mov r8d, dword [0x141ddc4f0]
cmp edx, 0x17d27b6
jne 0x140100bec
mov rax, rcx
call fcn.1400f07c0
sub rsp, rax
mov eax, dword [0x141ddc4f0]
jmp 0x140100b99
mov ecx, 0x55653d9f
mov eax, dword [0x141dd8fa8]
xor edx, edx
div dword [0x141dd8fac]
xor edx, edx
div ecx
cmp eax, 0xdcd60f87
je 0x140100bf1
cmp r8d, 3
jne 0x140100c15
mov rsp, rbp
pop rbp
ret
lea rax, [0x141ddc4f4]
mov qword [r9], rax
lea rcx, [0x141ddc4f0]
lea rax, [rbp - 1]
mov qword [r9 + 8], rax
lea r8, [rbp - 0x10]
mov qword [r8], r9
sub rsp, 0x20
lea r9, [0x141dbacd0]
mov dl, 1
call fcn.1400fbc40
add rsp, 0x20
mov eax, dword [0x141dd8fb0]
imul eax, dword [0x141dd8fb4]
xor eax, 0xd00278
and eax, 0x5cf922f8
cmp eax, 0xae9894b9
je 0x140100c4b
jmp 0x140100c10
Function at 0x140102250
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov r9, rdx
mov rsi, rcx
add r9, r8
setb al
mov ecx, 0x8a00e31b
nop word [rax + rax]
mov edx, dword [0x141dda250]
add edx, dword [0x141dda254]
imul edx, edx, 0x974188e3
imul rdx, rcx
shr rdx, 0x3f
imul edx, edx, 0x9b1d0c27
cmp edx, 0x647c73d2
ja 0x140102270
test al, al
jne 0x140102448
mov eax, dword [0x141dda258]
xor edx, edx
div dword [0x141dda25c]
mov edx, 4
nop word cs:[rax + rax]
mov eax, dword [0x141dda260]
add eax, dword [0x141dda264]
imul r8d, eax, 0xb37c30a2
add r8d, 0xcc8ba572
mov rax, qword [rsi]
lea rcx, [rax + rax]
cmp rcx, r9
mov rdi, r9
cmova rdi, rcx
cmp rdi, 5
cmovb rdi, rdx
cmp r8d, 0x939dbe47
ja 0x1401022c0
test rdi, rdi
js 0x140102448
lea r9, [rdi + rdi]
movabs rdx, 0x7ffffffffffffffe
cmp r9, rdx
ja 0x140102448
nop dword [rax]
mov edx, dword [0x141dda268]
add edx, dword [str.5_ast]
or edx, 0x918b0024
and edx, 0x91bf02a4
add edx, 0x66c7b8b5
cmp edx, 0xaa2d7ed5
jb 0x140102320
test rax, rax
je 0x14010237a
mov rax, qword [rsi + 8]
mov qword [rsp + 0x28], rax
mov eax, dword [0x141dda270]
xor edx, edx
div dword [0x141dda274]
and eax, 0xa8fe0aec
add eax, 0x67629e1e
and eax, 0xb4d0274a
cmp eax, 0xb9aadd58
jbe 0x14010237e
jmp 0x14010239c
xor eax, eax
jmp 0x1401023a8
mov eax, dword [0x141dda278]
or eax, dword [0x141dda27c]
imul eax, eax, 0x87ee0f4
mov qword [rsp + 0x38], rcx
cmp eax, 0xf58b948d
jne 0x1401023a3
mov qword [rsp + 0x38], rcx
jmp 0x14010237e
mov eax, 2
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x28]
mov rdx, r9
call fcn.1400deb40
cmp qword [rsp + 0x40], 0
jne 0x140102430
mov eax, 0xc78153e9
nop dword [rax]
mov ecx, dword [0x141dda288]
xor ecx, dword [0x141dda28c]
imul rcx, rax
shr rcx, 0x3e
imul ecx, ecx, 0xfe7b4e96
add ecx, 0x67436cd9
cmp ecx, 0x510fa8e2
jb 0x1401023d0
mov rcx, qword [rsp + 0x48]
mov eax, dword [str._E_9]
xor edx, edx
div dword [0x141dda294]
mov edx, 0xc1126955
imul rdx, rax
shr rdx, 0x38
or edx, 0xf164fc7f
cmp edx, 0xe7c9fd59
jae 0x14010244a
jmp 0x14010246e
mov eax, dword [0x141dda280]
xor eax, dword [0x141dda284]
add eax, 0x408d0099
cmp eax, 0xb588db18
ja 0x140102430
ud2
mov eax, dword [0x141dda298]
and eax, dword [0x141dda29c]
add eax, 0xb2b6d885
or eax, 0xd11cc3f8
mov qword [rsi + 8], rcx
mov qword [rsi], rdi
cmp eax, 0xb990ff5b
jne 0x140102477
mov qword [rsi + 8], rcx
mov qword [rsi], rdi
jmp 0x14010244a
add rsp, 0x58
pop rdi
pop rsi
ret