joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ba3b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r8, rdx
nop word cs:[rax + rax]
mov eax, dword [0x14021e5f8]
xor edx, edx
div dword [0x14021e5fc]
mov edx, eax
not edx
and eax, 0x829005c
or edx, 0x41620
and edx, 0x240437a0
or edx, eax
not edx
mov eax, edx
and eax, 0x50c3a112
add eax, eax
neg eax
add eax, edx
add eax, 0xd0c3b512
cmp eax, 0xefc01211
ja 0x1400ba3d0
movzx ebp, byte [r8 + 0x38]
nop word cs:[rax + rax]
mov edx, dword [0x14021e600]
mov r9d, dword [0x14021e604]
mov eax, edx
not eax
mov r10d, r9d
not r10d
mov r11d, eax
and r11d, 0xbbcc9355
and edx, 0x44336caa
or edx, r11d
or eax, r10d
and r10d, 0xbbcc9355
and r9d, 0x44336caa
or r9d, r10d
xor r9d, edx
not eax
or eax, r9d
mov edx, eax
and edx, 0x6fa73e
add edx, edx
neg edx
add eax, edx
add eax, 0x806fa73e
and eax, 0xbbc5d009
add eax, 0xe9e56cd6
cmp eax, 0x8dbf9f5d
ja 0x1400ba420
nop word [rax + rax]
mov eax, dword [0x14021e608]
or eax, dword [0x14021e60c]
mov edx, eax
not edx
mov r9d, eax
and r9d, 0xfb966feb
and edx, 0x4699014
imul edx, r9d
mov r9d, eax
and r9d, 0x4699014
or eax, 0x4699014
imul eax, r9d
add eax, edx
or eax, 0x3bb1e75c
add eax, 0x2596c8c0
cmp eax, 0x55e3745c
jb 0x1400ba490
cmp bpl, 3
je 0x1400ba5f8
movzx eax, byte [r8 + 0x39]
mov byte [rsp + 6], al
nop dword [rax]
mov eax, dword [0x14021e610]
mov r10d, dword [0x14021e614]
not eax
not r10d
or r10d, eax
not r10d
add r10d, 0x95c5ac08
or r10d, 0x4359fb82
movzx r9d, byte [r8 + 0x10]
xor eax, eax
cmp r9, 3
setae dl
cmp r10d, 0x946cbe5e
je 0x1400ba4f0
mov al, dl
lea eax, [rax + rax*2]
add eax, 7
mov dword [rsp + 0x24], eax
movzx eax, byte [r8 + 0x3a]
mov byte [rsp + 7], al
mov rax, qword [r8 + 0x20]
mov rdx, rax
or rdx, 4
nop dword [rax]
mov r10d, dword [0x14021e618]
sub r10d, dword [0x14021e61c]
mov r11d, r10d
not r11d
mov esi, r10d
and esi, 0x5584bc30
and r11d, 0xaa7b43cf
imul r11d, esi
mov esi, r10d
and esi, 0xaa7b43cf
or r10d, 0xaa7b43cf
imul r10d, esi
add r10d, r11d
mov r11d, r10d
not r11d
mov esi, r10d
and esi, 0xe77d711e
and r11d, 0x18828ee1
imul r11d, esi
mov esi, r10d
and esi, 0x18828ee1
or r10d, 0x18828ee1
imul r10d, esi
add r10d, r11d
imul r11d, r10d, 0x35420141
mov rsi, qword [r8 + 0x30]
mov r10d, esi
and r10d, 1
mov rdi, rsi
xor rdi, 1
test rsi, rsi
lea r10, [rdi + r10*2]
cmove r10, rsi
cmp r11d, 0xca1f9e62
jb 0x1400ba550
cmp byte [rsp + 6], 3
jne 0x1400ba668
mov r11d, eax
and r11d, 4
add r11, rdx
mov qword [rsp + 8], r11
lea rdx, [rax + r10]
add rdx, 2
mov qword [rsp + 0x18], rdx
add rax, r10
add rax, 8
mov qword [rsp + 0x10], rax
mov r10, qword [r8]
mov rbx, qword [r8 + 8]
nop word [rax + rax]
mov eax, dword [0x14021e620]
mov edx, eax
not edx
or edx, dword [0x14021e624]
add edx, eax
imul eax, edx, 0xa14f5dc6
add eax, 0x59904766
cmp eax, 0xf7543310
ja 0x1400ba6a0
mov r15d, 0xc6f0d2f1
mov esi, 0x887d1fdf
mov edi, 0xbe0d8287
mov rax, rbx
nop word [rax + rax]
Function at 0x1400bcea0
Capabilities:
Encode data using base64
Encode data using xor
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov r9, rdx
mov r12, rcx
mov eax, dword [0x14021eb40]
mov ecx, dword [0x14021eb44]
mov edx, eax
not edx
and edx, ecx
retf 0x8941
retf 0xf741
rol byte [rcx + 0x21], cl
ret 0xf44
scasd eax, dword [rdi]
ror byte [rcx + 0x9ca21c2], cl
enter 0xffffffffffffaf0f, 0xffffffffffffffc2
add eax, r10d
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x8608afc8
and ecx, 0x79f75037
imul ecx, edx
mov edx, eax
and edx, 0x79f75037
or eax, 0x79f75037
imul eax, edx
add eax, ecx
add eax, 0xef5caeb2
xor eax, 0xdfa4f0f8
cmp eax, 0x7987ac48
ja 0x1400bcf56
mov eax, dword [0x14021eb48]
xor edx, edx
div dword [0x14021eb4c]
mov ecx, eax
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov r15, rsp
mov eax, 0x400
call fcn.1401516e0
sub rsp, rax
mov rdi, rsp
cmp ecx, 0xb297d57d
jne 0x1400bcf72
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov eax, 0x400
call fcn.1401516e0
sub rsp, rax
jmp 0x1400bcf1e
movabs r13, 0x8000000000000000
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov qword [rbp - 0x20], rsp
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov rsi, rsp
sub rsp, 0x20
mov rcx, rsi
mov rdx, r9
call fcn.1400be980
add rsp, 0x20
mov rax, qword [rsi]
mov r9, qword [rsi + 8]
cmp rax, r13
jne 0x1400bd0be
mov eax, dword [0x14021ecb8]
add eax, dword [0x14021ecbc]
mov ecx, eax
or ecx, 0x51e6ffcb
mov edx, ecx
not edx
mov r8d, ecx
and r8d, 0xd8bd717
and edx, 0xf27428e8
imul edx, r8d
and ecx, 0xf27428e8
or eax, 0xf3f6ffeb
imul eax, ecx
add eax, edx
mov ecx, eax
not ecx
or eax, 0x18fb59c7
or ecx, 0xe704a638
and ecx, eax
cmp ecx, 0xd7e268af
je 0x1400bcfc0
mov eax, r9d
and eax, 3
xor ecx, ecx
nop dword [rax]
test cl, cl
jne 0x1400bd020
lea rcx, [0x1402082b4]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov qword [rbp - 0x38], rax
mov qword [r15], 0
mov qword [r15 + 8], 2
mov eax, dword [0x14021eb50]
xor edx, edx
div dword [0x14021eb54]
imul eax, eax, 0xef748edd
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xda309221
and ecx, 0x25cf6dde
imul ecx, edx
mov edx, eax
and edx, 0x25cf6dde
or eax, 0x25cf6dde
imul eax, edx
add eax, ecx
imul eax, eax, 0xa1c4e3dc
cmp eax, 0x9c679755
jae 0x1400bd121
mov qword [r15 + 0x10], 0
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x10], r9
mov qword [rbp - 0x18], r12
nop dword [rax]
mov eax, dword [0x14021eb58]
xor eax, dword [0x14021eb5c]
shr eax, 1
imul rax, rax, 0x22cf119b
shr rax, 0x3c
not eax
and eax, 0xcb76dcb5
mov ecx, eax
not ecx
or eax, 0x4812102
or ecx, 0x730a5e79
and ecx, eax
mov qword [r15 + 0x10], 0
cmp ecx, 0x1c506d2
jb 0x1400bd130
mov r13d, 0x200
mov eax, 2
mov qword [rbp], rax
xor eax, eax
mov qword [rbp - 8], rax
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov qword [rbp - 0x30], rax
xor r12d, r12d
nop word cs:[rax + rax]
Function at 0x1400c0130
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov eax, dword [0x14021f048]
mov ecx, dword [0x14021f04c]
not eax
not ecx
or ecx, eax
mov eax, ecx
not eax
mov edx, eax
or edx, 0xbf580014
mov r8d, edx
and r8d, 0xaee60809
and ecx, 0x4001f7e2
imul ecx, r8d
and edx, 0x5119f7f6
or eax, 0xff59f7f6
imul eax, edx
add eax, ecx
or eax, 0x7b0cb6ee
cmp eax, 0x2160a106
jb 0x1400c01d9
mov eax, dword [0x14021f050]
xor edx, edx
div dword [0x14021f054]
not eax
or eax, 0x9253feed
mov ecx, eax
not ecx
and eax, 0xcd6e9bdd
mov edx, ecx
and edx, 0x20800002
imul edx, eax
mov eax, ecx
and eax, 0x4d2c0110
or ecx, 0xcd6e9bdd
imul ecx, eax
add ecx, edx
mov esi, 0xb3767ac7
imul rsi, rcx
shr rsi, 0x3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x65e9fc97
jne 0x1400c01f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400c0183
mov eax, dword [0x14021f058]
mov ecx, dword [0x14021f05c]
lea edx, [rax + rcx]
add eax, ecx
add eax, 0x905c1e9d
mov ecx, eax
and ecx, 0x39ca73a8
xor eax, 0x6358c57
add eax, edx
add eax, 0x905c1e9d
sub eax, ecx
or eax, 0xc0014805
cmp eax, 0x84f936d0
jb 0x1400c01f0
add rsp, 0x20
pop rsi
ret
Function at 0x1400c62c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
mov rdi, rdx
mov rbx, rcx
mov eax, dword [0x14021f970]
xor eax, dword [0x14021f974]
add eax, 0xfc457425
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x139da1cd
and ecx, 0xec625e32
imul ecx, edx
mov edx, eax
and edx, 0xec625e32
or eax, 0xec625e32
imul eax, edx
add eax, ecx
mov ecx, eax
not ecx
or ecx, 0x5d637c94
or eax, 0xa29c836b
and eax, ecx
cmp eax, 0x2a4ec752
jb 0x1400c63d6
Function at 0x1400cb410
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov rdi, rdx
mov qword [rbp - 0x10], rcx
mov eax, dword [0x1402201b0]
mov ecx, dword [0x1402201b4]
mov edx, eax
not edx
mov r8d, ecx
not r8d
mov r9d, edx
and r9d, 0x2db0883e
and eax, 0xd24f77c1
or eax, r9d
or edx, r8d
and r8d, 0x2db0883e
and ecx, 0xd24f77c1
or ecx, r8d
xor ecx, eax
not edx
or edx, ecx
imul eax, edx, 0xb7e12f5c
xor eax, 0x8c79d993
mov ecx, 0xc766daeb
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0xf428e158
ja 0x1400cb4b3
mov eax, 0x40
call fcn.1401516e0
sub rsp, rax
mov r13, rsp
mov eax, 0x40
call fcn.1401516e0
sub rsp, rax
mov r15, rsp
xor eax, eax
test al, al
je 0x1400cb4cf
mov eax, 0x40
call fcn.1401516e0
sub rsp, rax
mov eax, 0x40
call fcn.1401516e0
sub rsp, rax
jmp 0x1400cb48d
movzx eax, byte [rdi + 0x38]
mov byte [rbp + 6], al
cmp al, 3
jne 0x1400cb510
mov eax, dword [0x1402201b8]
mov ecx, dword [0x1402201bc]
mov edx, eax
and edx, ecx
or eax, ecx
not edx
and edx, eax
mov eax, edx
not eax
mov ecx, edx
and ecx, 0x5d9807f3
and eax, 0xa267f80c
imul eax, ecx
mov ecx, edx
and ecx, 0xa267f80c
or edx, 0xa267f80c
imul edx, ecx
add edx, eax
xor edx, 0xa6351895
cmp edx, 0x718e9615
ja 0x1400cb510
movzx r11d, byte [rdi + 0x10]
movzx r14d, byte [rdi + 0x3a]
test r14b, r14b
setne byte [rbp + 7]
movzx eax, r11b
mov qword [rbp - 0x30], rax
movzx esi, byte [rbp + 6]
mov rbx, r13
add rbx, 9
nop
cmp r11b, 5
setb cl
test r14b, r14b
setne al
test sil, sil
setne r12b
mov edx, dword [0x1402201c0]
sub edx, dword [0x1402201c4]
mov r8d, edx
and r8d, 0x4db1ea2
or edx, 0x4db1ea2
add edx, r8d
imul r9, rdx, 0x85f72f5
shr r9, 0x3b
add r9d, 0x89110217
cmp r11b, 6
sete r8b
mov r10, qword [rdi + 0x30]
lea rdx, [r10 + 1]
test r10, r10
cmove rdx, r10
cmp r9d, 0x70119ccf
jb 0x1400cb580
mov byte [rbp + 3], r14b
mov byte [rbp + 5], r11b
or r12b, r8b
mov r10, qword [rdi + 0x20]
mov r8d, r10d
and r8d, 2
mov r9, r10
xor r9, 2
lea r8, [r9 + r8*2]
movabs r9, 0x3ad84a4996d2aab6
add r8, r9
add r8, rdx
sub r8, r9
mov qword [rbp - 0x40], r8
or al, cl
mov byte [rbp + 4], al
mov rax, qword [rdi]
mov qword [rbp - 0x20], rax
mov rcx, qword [rdi + 8]
lea rax, [r10 + rdx]
add rax, 8
mov qword [rbp - 0x38], rax
add r10, 4
mov qword [rbp - 0x18], r10
movzx eax, byte [rdi + 0x39]
xor esi, esi
mov r14d, 0x9b11b1e5
mov qword [rbp - 0x28], rcx
mov qword [rbp - 8], rcx
mov dword [rbp - 8], ecx
Function at 0x1400d1130
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rbx, r8
mov r14, rdx
mov rsi, rcx
nop word [rax + rax]
mov eax, dword [0x140220a38]
mov ecx, dword [0x140220a3c]
mov edx, eax
and edx, ecx
not ecx
not eax
and eax, ecx
not edx
not eax
and eax, edx
add eax, 0x23ce5b3f
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x43052f7f
and ecx, 0xbcfad080
imul ecx, edx
mov edx, eax
and edx, 0xbcfad080
or eax, 0xbcfad080
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0xd7e57
or eax, 0xfff28180
and eax, ecx
cmp eax, 0x25552be9
je 0x1400d1150
mov rax, qword [rsi]
mov r15, qword [rax]
nop word cs:[rax + rax]
mov eax, dword [0x140220a44]
mov ecx, eax
xor ecx, eax
not ecx
and ecx, dword [0x140220a40]
xor ecx, eax
mov eax, ecx
or eax, 0xb3a1db9f
mov edx, ecx
not edx
and edx, 0x485c0000
mov r8d, eax
and r8d, 0x583fff7
imul r8d, edx
and eax, 0xfa7c0008
or ecx, 0xfbfddb9f
imul ecx, eax
add ecx, r8d
or ecx, 0x74dd21de
cmp ecx, 0x89110bd0
jb 0x1400d11c0
mov rax, qword [r15 + 0x10]
nop word cs:[rax + rax]
mov ecx, dword [0x140220a48]
mov edx, dword [0x140220a4c]
xor edx, ecx
not edx
and edx, ecx
imul rcx, rdx, 0x7332916d
shr rcx, 0x3c
mov edx, ecx
not edx
or edx, 0xa903f3e4
add ecx, edx
add ecx, 0x298a94c
cmp ecx, 0x212c6228
ja 0x1400d1220
test rax, rax
jne 0x1400d1300
mov eax, dword [0x140220a58]
and eax, dword [0x140220a5c]
add eax, 0x6949af2f
mov ecx, eax
xor ecx, 0xd1041375
or eax, 0x2efbec8a
and eax, ecx
imul eax, eax, 0xe7d07850
cmp eax, 0x10e91313
jae 0x1400d12a0
mov qword [r15 + 0x10], 0xffffffffffffffff
nop word cs:[rax + rax]
mov eax, dword [0x140220a60]
or eax, dword [0x140220a64]
mov ecx, eax
not ecx
and ecx, 0x5c9572a7
mov edx, eax
and edx, 0x236a8d58
imul edx, ecx
mov ecx, eax
and ecx, 0x5c9572a7
or eax, 0x5c9572a7
imul eax, ecx
add eax, edx
and eax, 0x6a35818c
mov ecx, eax
not ecx
or ecx, 0x4ce97557
add eax, ecx
inc eax
mov qword [r15 + 0x10], 0xffffffffffffffff
cmp eax, 0x2afb479d
ja 0x1400d12a0
xor eax, eax
test al, al
je 0x1400d1346
jmp 0x1400d1390
xor eax, eax
test al, al
je 0x1400d1310
ud2
mov eax, dword [0x140220a50]
and eax, dword [0x140220a54]
or eax, 0xfa64b8d7
add eax, 0x178ada94
mov ecx, eax
and ecx, 0x17ffcff8
xor ecx, 0x686747ca
and eax, 0x6757c9
or eax, ecx
ud2
Function at 0x1400d3210
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rsi, rcx
mov eax, dword [0x140220e40]
mov ecx, dword [0x140220e44]
xor ecx, eax
not ecx
and ecx, eax
mov eax, 0x989bd5e7
imul rax, rcx
shr rax, 0x3f
xor eax, 0xf0c927f5
neg eax
xor eax, 0xb2682399
cmp eax, 0x651e4aa8
jb 0x1400d32ce
mov eax, dword [0x140220e48]
xor edx, edx
div dword [0x140220e4c]
imul ecx, eax, 0x82732e7f
add ecx, 0xa54d9fb0
mov eax, ecx
not eax
mov edx, ecx
and edx, 0x22166c28
and eax, 0xdde993d7
imul eax, edx
mov edx, ecx
and edx, 0xdde993d7
or ecx, 0xdde993d7
imul ecx, edx
add ecx, eax
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov rdi, rsp
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov r14, rsp
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov rbx, rsp
cmp ecx, 0xd5cea149
jbe 0x1400d32fa
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
jmp 0x1400d3255
movzx eax, byte [0x14022cad8]
test al, al
je 0x1400d34a0
mov eax, dword [0x14022cb7c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x50]
test rax, rax
je 0x1400d3336
cmp eax, 1
je 0x1400d33d0
jmp 0x1400d34a0
xor eax, eax
test al, al
je 0x1400d3350
sub rsp, 0x20
call fcn.140150290
add rsp, 0x20
nop dword [rax]
mov eax, dword [0x140220e50]
xor edx, edx
div dword [0x140220e54]
or eax, 0xa9271f0d
mov ecx, eax
and ecx, 0x33339e84
xor eax, 0x33339e84
lea r15d, [rax + rcx*2]
or r15d, 0x9f0230d0
sub rsp, 0x20
call fcn.14016c850
add rsp, 0x20
cmp r15d, 0x75b4f76d
jb 0x1400d3350
nop word cs:[rax + rax]
mov eax, dword [0x140220e58]
mov ecx, dword [0x140220e5c]
not eax
not ecx
and ecx, eax
xor ecx, 0x1b21f3a7
imul rax, rcx, 0x7b534753
shr rax, 0x3e
imul eax, eax, 0xbb0172fa
cmp eax, 0xcd4e6803
ja 0x1400d33a0
mov eax, dword [0x140220e60]
imul eax, dword [0x140220e64]
add eax, 0x6a9dcf19
mov ecx, eax
or ecx, 0x29c0a81
not eax
and eax, 0x48001538
and ecx, 0xb2ff2a85
or ecx, eax
cmp ecx, 0x9ec09ea3
ja 0x1400d33d0
mov eax, dword [0x14022cb7c]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov r15, qword [rax + 0x58]
mov ecx, dword [0x140220e68]
mov edx, dword [0x140220e6c]
mov eax, ecx
not eax
mov r8d, edx
not r8d
mov r9d, eax
and r9d, 0x323acba
and ecx, 0xfcdc5345
or ecx, r9d
or eax, r8d
and r8d, 0x323acba
and edx, 0xfcdc5345
or edx, r8d
xor edx, ecx
not eax
or eax, edx
mov ecx, eax
and ecx, 0x7f1b3cf0
or eax, 0x7f1b3cf0
add eax, ecx
mov ecx, eax
xor ecx, 0x537f3257
add ecx, eax
and eax, 0xac80cda8
sub ecx, eax
add ecx, 0xfcf2e5f1
cmp ecx, 0x2dc485af
jae 0x1400d3c42
jmp 0x1400d3c86

Function at 0x1400d5520
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
Function at 0x1400f0210
Capabilities:
Check if file exists
Encode data using xor
Get file attributes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rdi, r8
mov r12, rdx
mov rsi, rcx
mov eax, dword [0x140223508]
xor edx, edx
div dword [0x14022350c]
mov ecx, eax
and ecx, 0x2cf8c0c9
or eax, 0x2cf8c0c9
add eax, ecx
add eax, 0x23180324
cmp eax, 0x609fb043
ja 0x1400f02b8
mov eax, dword [0x140223510]
and eax, dword [0x140223514]
imul rcx, rax, 0x18d63e2f
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
imul ecx, eax, 0xf8757f9e
not ecx
or ecx, 0xc9a3d09a
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov r14, rsp
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov r15, rsp
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov rbx, rsp
cmp ecx, 0x4dc4b87d
jne 0x1400f02e4
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
jmp 0x1400f0252
mov eax, dword [0x140223518]
mov ecx, dword [0x14022351c]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
mov ecx, eax
not ecx
and ecx, 0xe24603d5
mov edx, eax
and edx, 0x1db9fc2a
imul edx, ecx
mov ecx, eax
and ecx, 0xe24603d5
or eax, 0xe24603d5
imul eax, ecx
add eax, edx
mov ecx, eax
xor ecx, 0x853f702a
xor eax, 0x99adc242
and ecx, 0x636d4d97
add ecx, ecx
sub ecx, eax
cmp ecx, 0x699a7fc6
jne 0x1400f0370
sub rsp, 0x20
mov rcx, r15
mov rdx, r12
loop 0x1400f03aa
mov eax, edi
Function at 0x1400f89d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov eax, dword [0x140224218]
and eax, dword [0x14022421c]
mov ecx, eax
and ecx, 0xaba873a1
mov edx, ecx
not edx
and edx, 0xdde3a0a6
mov r8d, eax
and r8d, 0x22085301
imul r8d, edx
and eax, 0x89a020a0
or ecx, 0xdde3a0a6
imul ecx, eax
lea eax, [rcx + r8]
add eax, 0x6c4efaf1
cmp eax, 0xa501bef6
ja 0x1400f8a5f
Function at 0x1400ff9f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rbx, rdx
mov eax, dword [0x140224ce0]
Function at 0x140107510
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
xor eax, eax
test al, al
je 0x140107520
call fcn.140107660
mov eax, dword [0x140225590]
mov ecx, dword [0x140225594]
mov edx, eax
not edx
and edx, ecx
not ecx
and ecx, eax
sub ecx, edx
mov eax, ecx
xor eax, 0xac73a255
add eax, ecx
and ecx, 0x538c5daa
sub eax, ecx
mov ecx, eax
not ecx
and ecx, 0xcd8ad942
mov edx, eax
and edx, 0x327526bd
imul edx, ecx
mov ecx, eax
and ecx, 0xcd8ad942
or eax, 0xcd8ad942
imul eax, ecx
add eax, edx
mov esi, eax
xor esi, 0x8bca6dd8
and esi, eax
call fcn.140107660
cmp esi, 0x2462bc86
je 0x140107520
mov eax, dword [0x140225598]
mov ecx, dword [0x14022559c]
add eax, ecx
add eax, 0x5a8f04bf
mov ecx, eax
and ecx, 0x3128e679
add ecx, ecx
sub eax, ecx
add eax, 0x3128e679
mov ecx, eax
xor ecx, 0x30e95dea
or eax, 0xcf16a215
and eax, ecx
cmp eax, 0x2b61254f
ja 0x14010760c
mov esi, dword [str._v_Hs]
xor esi, dword [0x1402255a4]
mov eax, esi
or eax, 0x4f1a86b4
mov ecx, eax
not ecx
and ecx, 0xd91deee1
mov edx, eax
and edx, 0x26e2111e
imul edx, ecx
and eax, 0xd91deee1
or esi, 0xdf1feef5
imul esi, eax
add esi, edx
or esi, 0x65eb7ac8
call fcn.140150bd0
cmp esi, 0x2e967452
jae 0x140107620
call fcn.140107870
jmp 0x1401075c1
mov eax, dword [0x1402255a8]
and eax, dword [0x1402255ac]
mov ecx, eax
not ecx
or ecx, 0x60005400
and ecx, 0x64005400
and eax, 0x10080000
or eax, ecx
xor eax, 0x74021001
or eax, 0x8bf5a9de
cmp eax, 0xb0cd949e
ja 0x140107620
ud2
Function at 0x140107660
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rax
mov rbp, rsp
mov eax, dword [0x1402255b0]
sub eax, dword [0x1402255b4]
not eax
or eax, 0x20300015
and eax, 0x24348015
cmp eax, 0x649d2a7
jae 0x1401076b0
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov eax, dword [0x14022cac8]
nop word cs:[rax + rax]
mov eax, dword [0x1402255b8]
sub eax, dword [0x1402255bc]
mov ecx, eax
xor ecx, 0x4e1d708b
or eax, 0xb1e28f74
and eax, ecx
mov ecx, eax
and ecx, 0x376bd5d0
add ecx, ecx
neg ecx
lea r8d, [rax + rcx]
add r8d, 0xb76bd5d0
or r8d, 0x5934eb36
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov rcx, rsp
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov rax, rsp
mov edx, dword [0x14022cac8]
cmp r8d, 0xab107753
ja 0x1401076b0
mov r8d, 0x8b6d6385
nop
mov r9d, dword [0x1402255c0]
mov r10d, dword [0x1402255c4]
mov r11d, r10d
not r11d
mov esi, r9d
and esi, r11d
or r11d, r9d
not r11d
imul r11d, esi
mov esi, r9d
and esi, r10d
or r9d, r10d
imul r9d, esi
add r9d, r11d
add r9d, 0xbc104ec2
imul r9, r8
shr r9, 0x3f
or r9d, 0xe6071d30
cmp r9d, 0x2a9231cc
jb 0x140107720
cmp edx, 4
je 0x140107826
mov edx, dword [0x1402255c8]
add edx, dword [0x1402255cc]
imul edx, edx, 0xc1467fae
cmp edx, 0x2586352f
jne 0x1401077a0
mov byte [rax], 1
nop dword [rax]
mov edx, dword [0x1402255d0]
mov r8d, dword [0x1402255d4]
xor r8d, edx
not r8d
and r8d, edx
add r8d, 0xbb237822
mov edx, r8d
xor edx, 0x5c8a8201
and edx, r8d
and edx, 0x7cbb8203
mov byte [rax], 1
cmp edx, 0xbcaf8187
ja 0x1401077a0
mov qword [rcx], rax
sub rsp, 0x20
call fcn.14014f9f0
add rsp, 0x20
nop word [rax + rax]
mov eax, dword [0x1402255d8]
mov ecx, dword [0x1402255dc]
mov edx, eax
not edx
or edx, ecx
not ecx
or ecx, eax
not ecx
not edx
or edx, ecx
or edx, 0xecea0770
add edx, 0xe196c59a
xor edx, 0x568adfde
cmp edx, 0xcd58666f
ja 0x1401077f0
mov ecx, 0xdf4b8f57
nop dword [rax + rax]
mov eax, dword [0x1402255e0]
xor edx, edx
div dword [0x1402255e4]
mov edx, eax
not edx
or edx, 0x4ad47cc9
add eax, edx
inc eax
xor eax, 0x59ba45b9
imul rax, rcx
shr rax, 0x3e
cmp eax, 0xb9c1b028
ja 0x140107830
lea rsp, [rbp + 8]
pop rsi
pop rbp
ret

Function at 0x140107870
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov eax, dword [0x1402255e8]
xor eax, dword [0x1402255ec]
and eax, 0x84000504
mov ecx, eax
not ecx
or ecx, 0x5c347246
add eax, ecx
inc eax
cmp eax, 0x7e63f628
ja 0x1401078d4
mov eax, dword [str.__r]
xor eax, dword [0x1402255f4]
mov ecx, 0xa0bfea6f
imul rcx, rax
shr rcx, 0x3d
add ecx, 0xd402fb87
imul rsi, rcx, 0x39f4bb29
shr rsi, 0x3d
xor ecx, ecx
call fcn.140150bf0
cmp esi, 0xdd6bd35f
jbe 0x1401078e0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x1402255f8]
mov ecx, dword [0x1402255fc]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
mov ecx, eax
and ecx, 0x6cea5b21
add ecx, ecx
sub eax, ecx
add eax, 0x6cea5b21
mov ecx, eax
not ecx
or eax, 0x252ab182
and ecx, 0x8900468
and eax, 0xb52efb87
or eax, ecx
xor eax, 0x7207f84a
cmp eax, 0x2397d88e
jb 0x1401078e0
ud2
Function at 0x140107940
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov r8, rdx
mov edx, ecx
mov eax, dword [0x140225600]
mov ecx, dword [0x140225604]
mov r9d, eax
not r9d
and r9d, ecx
mov r10d, ecx
not r10d
and r10d, eax
imul r10d, r9d
mov r9d, eax
and r9d, ecx
or eax, ecx
imul eax, r9d
add eax, r10d
imul eax, eax, 0x60a36e07
and eax, 0x859c1779
add eax, 0x9f249dfd
cmp eax, 0x6c19f039
jbe 0x1401079a0
mov rax, qword [0x14022cb48]
nop dword [rax + rax]
mov eax, dword [0x140225608]
and eax, dword [0x14022560c]
or eax, 0x3043d69
add eax, 0x10ae749d
or eax, 0xcc340b86
mov rcx, qword [0x14022cb48]
cmp eax, 0x8f5b9404
jb 0x1401079a0
test rcx, rcx
je 0x140107a61
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, rax
nop dword [rax + rax]
mov eax, dword [0x140225618]
xor edx, edx
div dword [0x14022561c]
mov edx, eax
not edx
and edx, 0x9793ffa7
mov r8d, eax
and r8d, 0x686c0058
imul r8d, edx
mov edx, eax
and edx, 0x9793ffa7
or eax, 0x9793ffa7
imul eax, edx
add eax, r8d
imul eax, eax, 0xd87ae79
xor eax, 0xd3ca7480
cmp eax, 0x6098f820
je 0x1401079e0
nop dword [rax + rax]
mov eax, dword [0x140225620]
add eax, dword [0x140225624]
or eax, 0x2656e540
imul eax, eax, 0xe42f3e2b
imul rax, rax, 0x68459f7
shr rax, 0x39
cmp eax, 0xdaad29d7
ja 0x140107a30
mov rax, rcx
add rsp, 0x28
ret
mov ecx, edx
mov rdx, r8
call fcn.14016d130
mov rcx, rax
mov eax, 0xbd6b9813
nop word cs:[rax + rax]
mov edx, dword [0x140225610]
mov r8d, dword [0x140225614]
mov r9d, r8d
and r9d, edx
add edx, r8d
sub edx, r9d
mov r8d, edx
not r8d
mov r9d, edx
and r9d, 0xef54d57a
and r8d, 0x10ab2a85
imul r8d, r9d
mov r9d, edx
and r9d, 0x10ab2a85
or edx, 0x10ab2a85
imul edx, r9d
add edx, r8d
imul rdx, rax
shr rdx, 0x3f
or edx, 0x9d1a6c20
cmp edx, 0x5bc479bd
jbe 0x140107a80
jmp 0x140107a30