joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d59e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rbp, r9
shr rbp, 1
mov r14, rbp
inc r14
js 0x1400d5a85
lea r12, [rbp*2 + 2]
movabs r13, 0x8000000000000000
lea rax, [r13 - 2]
cmp r12, rax
ja 0x1400d5a85
mov rbx, r9
mov rsi, rcx
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400d5a30
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400d5a40
test r12, r12
je 0x1400d5a7b
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], r8
movzx eax, byte [0x141dda6b8]
mov eax, dword [0x141dd7288]
add eax, dword [0x141dd728c]
and eax, 0x47a302b9
cmp eax, 0x7a5cd0e2
jne 0x1400d5c85
jmp 0x1400d5cb7
mov edi, 2
xor r12d, r12d
jmp 0x1400d5acf
mov eax, dword [0x141dd7278]
xor edx, edx
div dword [0x141dd727c]
or eax, 0xbe7dfffd
add eax, 0xd6f99454
cmp eax, 0xca543b64
ja 0x1400d5ac9
mov eax, dword [0x141dd7280]
or eax, dword [0x141dd7284]
xor eax, 0xacbd2e4a
imul eax, eax, 0x6858f500
add eax, 0x2ce2d200
ud2
ud2
mov eax, dword [0x141dd7290]
sub eax, dword [0x141dd7294]
invalid
rol byte [rcx], 1
xor eax, 0x5d06a936
mov r15d, 0xbcd9ae43
imul r15, rax
shr r15, 0x3f
xor ecx, ecx
mov rdx, r12
call fcn.1400bf230
cmp r15d, 0x89139c03
jne 0x1400d5cc3
xor ecx, ecx
mov rdx, r12
call fcn.1400bf230
jmp 0x1400d5c85
mov rdi, rax
mov r8, qword [rsp + 0x40]
nop dword [rax + rax]

Function at 0x1400d5d30
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
insb byte [rdi], dx
and al, 0x10
Function at 0x1400d67f0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
test cl, cl
je 0x1400d6ec0
mov rsi, r9
mov rdi, r8
mov rbx, rdx
movzx eax, cl
cmp eax, 1
je 0x1400d68bf
invalid
movsb byte [rdi], byte [rsi]
add byte [rax], al
invalid
cmp eax, 2
jne 0x1400d69d0
mov rax, qword [rsi]
movabs rcx, 0x8000000000000000
mov edx, 0x8a5dfb67
nop word cs:[rax + rax]
test byte [rax], al
add byte [rax], al
add byte [rax], al
Function at 0x1400d7a00
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rsi, rcx
nop word cs:[rax + rax]
mov eax, dword [0x141dd76b8]
add eax, dword [0x141dd76bc]
xor eax, 0xf58415a8
imul eax, eax, 0x50c372b1
cmp eax, 0xa48ec16a
je 0x1400d7a20
mov rax, qword [rsi]
cmp rax, 0xffffffffffffffff
je 0x1400d7c5a
lea rcx, [rax + 1]
lea rdx, [rax + rax]
cmp rdx, rcx
cmova rcx, rdx
cmp rcx, 5
mov r15d, 4
cmovae r15, rcx
mov rcx, r15
shr rcx, 0x3c
jne 0x1400d7c5a
mov rdi, r15
shl rdi, 4
movabs rcx, 0x7ffffffffffffffc
cmp rdi, rcx
ja 0x1400d7c5a
nop
mov ecx, dword [0x141dd76c0]
or ecx, dword [0x141dd76c4]
and ecx, 0x41044260
add ecx, 0xb89951a0
cmp ecx, 0x65d042fa
jb 0x1400d7a90
mov ecx, dword [0x141dd76c8]
imul ecx, dword [0x141dd76cc]
or ecx, 0x62200204
xor ecx, 0x25400a08
or ecx, 0x988755e2
cmp ecx, 0x6f22d761
jb 0x1400d7ab0
nop word [rax + rax]
mov ecx, dword [0x141dd76d0]
imul ecx, dword [0x141dd76d4]
or ecx, 0xfd7fc2ec
add ecx, 0x7b5b4146
cmp ecx, 0xee6a6b10
ja 0x1400d7ae0
test rax, rax
je 0x1400d7b55
mov rcx, qword [rsi + 8]
shl rax, 4
mov qword [rsp + 0x20], rcx
mov ecx, 0xf6569c73
nop dword [rax + rax]
mov edx, dword [0x141dd76d8]
and edx, dword [0x141dd76dc]
imul edx, edx, 0x3237bde8
imul rdx, rcx
shr rdx, 0x3d
xor edx, 0x82f13906
cmp edx, 0xad76cbec
ja 0x1400d7b20
mov qword [rsp + 0x30], rax
mov r12d, 4
jmp 0x1400d7b58
xor r12d, r12d
mov eax, dword [0x141dd76e0]
xor edx, edx
div dword [0x141dd76e4]
imul eax, eax, 0xdbc187aa
and eax, 0x91c78af6
cmp eax, 0xbf04f7d5
jne 0x1400d7b94
mov qword [rsp + 0x28], r12
lea rcx, [rsp + 0x38]
lea r9, [rsp + 0x20]
mov edx, 4
mov r8, rdi
call fcn.1400c0610
lea rbx, [rsp + 0x38]
lea r14, [rsp + 0x20]
xor ebp, ebp
mov qword [rsp + 0x28], r12
mov edx, 4
mov rcx, rbx
mov r8, rdi
mov r9, r14
call fcn.1400c0610
test bpl, bpl
jne 0x1400d7ba0
cmp qword [rsp + 0x38], 0
jne 0x1400d7c5a
nop dword [rax]
mov eax, dword [0x141dd76f0]
sub eax, dword [0x141dd76f4]
xor eax, 0x2c000136
and eax, 0xbe8183fe
cmp eax, 0xadd13b25
ja 0x1400d7bd0
mov rax, qword [rsp + 0x40]
mov ecx, dword [0x141dd76f8]
imul ecx, dword [0x141dd76fc]
xor ecx, 0x60960024
or ecx, 0x9e287b42
imul rdx, rcx, 0x763d5cf
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1b
cmp ecx, 0x56f9bd82
jne 0x1400d7c30
mov qword [rsi + 8], rax
mov qword [rsi], r15
nop
mov ecx, dword [str.c_.EV]
and ecx, dword [0x141dd7704]
mov qword [rsi + 8], rax
mov qword [rsi], r15
cmp ecx, 0xccd1b0f6
je 0x1400d7c30
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
ud2
Function at 0x1400dd4b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
cmp qword [r8 + 8], 0
je 0x1400dd500
cmp qword [r8 + 0x10], 0
je 0x1400dd560
mov eax, dword [0x141dd8448]
or eax, dword [0x141dd844c]
mov rbx, qword [r8]
or eax, 0x94961afb
add eax, 0xe6453f48
cmp eax, 0x4492106f
jb 0x1400dd5fe
jmp 0x1400dd5c5
mov eax, dword [0x141dd8460]
add eax, dword [0x141dd8464]
and eax, 0x28008000
cmp eax, 0x5b93583b
je 0x1400dd500
test rdi, rdi
je 0x1400dd5bb
movzx eax, byte [0x141dda6b8]
mov eax, dword [0x141dd8468]
sub eax, dword [0x141dd846c]
imul rax, rax, 0x12918d09
shr rax, 0x3c
or eax, 0x1b509c18
cmp eax, 0x867daba7
ja 0x1400dd663
jmp 0x1400dd639
mov eax, dword [0x141dd8418]
xor eax, dword [0x141dd841c]
imul rcx, rax, 0x50e230e3
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1d
and eax, 2
add eax, 0xc23b7e62
cmp eax, 0xd25ed15d
ja 0x1400dd560
test rdi, rdi
je 0x1400dd5bb
mov eax, dword [0x141dd8420]
add eax, dword [0x141dd8424]
imul rax, rax, 0x6f8a0a1f
shr rax, 0x3e
cmp eax, 0xa50d1524
ja 0x1400dd6c9
jmp 0x1400dd69c
mov eax, 2
jmp 0x1400dd75d
mov eax, dword [0x141dd8450]
and eax, dword [0x141dd8454]
and eax, 0x180d8c00
or eax, 0xe79023e9
imul ebp, eax, 0xc142635a
mov rcx, qword [0x141dda6a0]
xor edx, edx
mov r8, rbx
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
cmp ebp, 0x92798b31
jbe 0x1400dd620
mov rcx, qword [0x141dda6a0]
xor edx, edx
mov r8, rbx
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x1400dd5c5
mov ecx, dword [0x141dd8458]
sub ecx, dword [0x141dd845c]
cmp ecx, 0xb5b67edf
je 0x1400dd620
jmp 0x1400dd75d
mov ebx, dword [0x141dd8470]
or ebx, dword [0x141dd8474]
and ebx, 0x9461431
xor ebx, 0xc2eba94b
xor ecx, ecx
mov rdx, rdi
call fcn.1400bf230
cmp ebx, 0x611acb7c
jae 0x1400dd670
xor ecx, ecx
mov rdx, rdi
call fcn.1400bf230
jmp 0x1400dd639
mov ecx, dword [0x141dd8478]
imul ecx, dword [0x141dd847c]
xor ecx, 0x13a3804
and ecx, 0x973aba54
add ecx, 0x3c7c4a16
cmp ecx, 0x7b21e7c5
ja 0x1400dd670
jmp 0x1400dd75d
mov eax, dword [0x141dd8428]
or eax, dword [0x141dd842c]
mov ecx, 0xa80d6ff7
imul rcx, rax
shr rcx, 0x3f
imul eax, ecx, 0x7e1ab389
movzx ecx, byte [0x141dda6b8]
cmp eax, 0x4ed08d8d
jne 0x1400dd6d2
movzx eax, byte [0x141dda6b8]
jmp 0x1400dd69c
mov eax, dword [0x141dd8430]
and eax, dword [0x141dd8434]
xor eax, 0x38049a43
or eax, 0x87f34538
cmp eax, 0x6861f380
je 0x1400dd721
mov eax, dword [0x141dd8438]
add eax, dword [0x141dd843c]
or eax, 0x9716b520
shr eax, 1
mov ebx, 0x803fb0b7
imul rbx, rax
shr rbx, 0x3e
xor ecx, ecx
mov rdx, rdi
call fcn.1400bf230
cmp ebx, 0x3863a33b
jne 0x1400dd730
xor ecx, ecx
mov rdx, rdi
call fcn.1400bf230
jmp 0x1400dd6ef
mov ecx, dword [0x141dd8440]
mov edx, dword [0x141dd8444]
add ecx, edx
add ecx, 0x5f24bcd6
xor ecx, 0xd1bfe1b3
imul rcx, rcx, 0x17e2ff81
shr rcx, 0x3c
cmp ecx, 0x7b3904d7
ja 0x1400dd730
xor ecx, ecx
test rax, rax
mov edx, 2
cmovne rdx, rax
sete cl
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rdi
mov qword [rsi], rcx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400ea4d0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov eax, 0xa23e23f3
nop word cs:[rax + rax]
mov ecx, dword [0x141dd9c68]
add ecx, dword [0x141dd9c6c]
or ecx, 0xd0a9f717
imul rcx, rax
shr rcx, 0x3e
or ecx, 0xc5e04634
cmp ecx, 0x90fa44c
jb 0x1400ea4f0
mov rcx, qword [rdi]
nop dword [rax + rax]
mov eax, dword [0x141dd9c70]
imul eax, dword [0x141dd9c74]
imul eax, eax, 0x2098c63b
add eax, 0x6e0e5e5e
or eax, 0x8a32f4d6
cmp eax, 0xe1b3e28c
ja 0x1400ea520
mov r8, qword [rdi + 8]
nop dword [rax + rax]
mov eax, dword [0x141dd9c78]
xor edx, edx
div dword [0x141dd9c7c]
add eax, 0xf916589
or eax, 0x2cec78fe
imul rax, rax, 0x7722b88d
shr rax, 0x3d
cmp eax, 0xa6b86a3c
ja 0x1400ea550
mov rax, qword [rdi + 0x18]
cmp r8, 1
je 0x1400ea5d0
test r8, r8
jne 0x1400ea5fb
nop dword [rax]
mov ecx, dword [0x141dd9c80]
xor ecx, dword [0x141dd9c84]
add ecx, 0xe3d25421
or ecx, 0x35dc47e8
cmp ecx, 0x1dbf776
jb 0x1400ea590
test rax, rax
jne 0x1400ea5fb
mov edi, 1
xor ebx, ebx
mov r14d, 1
jmp 0x1400ea708
mov edx, dword [0x141dd9cb8]
sub edx, dword [0x141dd9cbc]
imul edx, edx, 0x55a00c7b
add edx, 0x7d0823a
or edx, 0xc63d2dcc
cmp edx, 0x7d3d5fa8
je 0x1400ea5d0
test rax, rax
je 0x1400ea650
xor eax, eax
test al, al
je 0x1400ea610
mov rcx, rsi
mov rdx, rdi
call fcn.140038da0
nop dword [rax]
mov ebx, dword [0x141dd9c88]
imul ebx, dword [0x141dd9c8c]
or ebx, 0x8060b800
xor ebx, 0x9004a863
or ebx, 0x279b439c
mov rcx, rsi
mov rdx, rdi
call fcn.140038da0
cmp ebx, 0x1b7c4705
je 0x1400ea610
jmp 0x1400ea78e
mov eax, dword [0x141dd9c90]
and eax, dword [0x141dd9c94]
and eax, 0x80a46064
or eax, 0x765a8b09
imul eax, eax, 0x87c4c037
cmp eax, 0x4bd8b01e
je 0x1400ea650
mov rdi, qword [rcx]
xor eax, eax
nop dword [rax + rax]
test al, al
jne 0x1400ea680
mov rbx, qword [rcx + 8]
test rbx, rbx
js 0x1400ea6fe
nop dword [rax]
mov eax, dword [0x141dd9c98]
xor eax, dword [0x141dd9c9c]
imul eax, eax, 0xad22955b
cmp eax, 0x1fbd232d
je 0x1400ea690
test rbx, rbx
je 0x1400ea700
movzx eax, byte [0x141dda6b8]
xor ecx, ecx
mov rdx, rbx
call fcn.1400bf230
mov r14, rax
nop word cs:[rax + rax]
mov eax, dword [0x141dd9ca0]
sub eax, dword [0x141dd9ca4]
imul rax, rax, 0x53e33bb9
shr rax, 0x3e
or eax, 0xd4154b0e
imul eax, eax, 0x9fd57ec
cmp eax, 0x36a7ec26
je 0x1400ea6d0
test r14, r14
jne 0x1400ea708
ud2
mov r14d, 1
xor ebx, ebx
mov eax, dword [0x141dd9ca8]
xor edx, edx
div dword [0x141dd9cac]
imul eax, eax, 0x160b03a5
or eax, 0xef75766c
cmp eax, 0xfa43d20
jne 0x1400ea750
mov rcx, r14
mov rdx, rdi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi], rbx
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rbx
nop word cs:[rax + rax]
mov eax, dword [0x141dd9cb0]
xor eax, dword [0x141dd9cb4]
xor eax, 0xacaa5598
imul ebp, eax, 0x5bfa3317
xor ebp, 0xefdc7bd5
mov rcx, r14
mov rdx, rdi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi], rbx
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rbx
cmp ebp, 0x8f2d0fda
jbe 0x1400ea750
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1400ef3c8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400ef412
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400ef412
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400ef412
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400ef412
cmp dword [rcx + 0x84], 0xe
jbe 0x1400ef412
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400ef414
xor al, al
add rsp, 0x28
ret
Function at 0x1400f2fa0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x48
lea rcx, [rsp + 0x38]
call fcn.1400429c0
mov eax, dword [0x141dc4968]
imul eax, dword [0x141dc496c]
cmp eax, 0x38e30a0d
je 0x1400f2ffb
mov eax, dword [0x141dc4970]
or eax, dword [0x141dc4974]
mov esi, 0x9f10c523
imul rsi, rax
shr rsi, 0x3d
add esi, 0x6db71819
or esi, 0xbe9feb9a
lea rcx, [rsp + 0x28]
call fcn.140042a20
cmp esi, 0xef8cea09
jne 0x1400f3007
lea rcx, [rsp + 0x28]
call fcn.140042a20
jmp 0x1400f2fc4
mov esi, dword [rsp + 0x40]
mov eax, esi
and eax, 0xc000000
nop word cs:[rax + rax]
mov ecx, dword [0x141dc4978]
imul ecx, dword [str._H_5]
or ecx, 0xcc238004
and ecx, 0xde3ba546
imul rcx, rcx, 0x755f55fd
shr rcx, 0x3e
cmp ecx, 0x75951712
ja 0x1400f3020
cmp eax, 0xc000000
jne 0x1400f3114
mov eax, dword [0x141dc4980]
or eax, dword [0x141dc4984]
or eax, 0x2d3507aa
cmp eax, 0x50355e93
jne 0x1400f3080
call fcn.140042af0
nop word cs:[rax + rax]
mov eax, dword [0x141dc4988]
sub eax, dword [0x141dc498c]
imul eax, eax, 0xa41ac74e
or eax, 0x17f4f5c0
imul rdi, rax, 0x4a4b2653
shr rdi, 0x3d
call fcn.140042af0
cmp edi, 0x1eb53d52
je 0x1400f3080
and eax, 6
nop word cs:[rax + rax]
mov ecx, dword [0x141dc4990]
imul ecx, dword [0x141dc4994]
imul rdx, rcx, 0x3f35b647
shr rdx, 0x3d
or edx, 0xd4c23c46
cmp eax, 6
sete cl
cmp edx, 0x8aa86d36
jb 0x1400f30c0
nop dword [rax]
mov eax, dword [0x141dc4998]
and eax, dword [0x141dc499c]
xor eax, 0xf7c60616
add eax, 0x11a92e76
and eax, 0xa55bf448
cmp eax, 0x62c7fa40
je 0x1400f30f0
jmp 0x1400f3116
xor ecx, ecx
movzx eax, byte [rsp + 0x2c]
shr al, 5
shr esi, 0x1c
and esi, 1
and sil, cl
and sil, al
mov byte [section..data], sil
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x1400f4870
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov eax, dword [0x141dc95c0]
imul eax, dword [0x141dc95c4]
xor eax, 0x635eb4c5
imul eax, eax, 0xddb863c0
or eax, 0xba79aeb5
cmp eax, 0xb6cf09fd
jb 0x1400f48c2
mov ecx, dword [0x141dc95c8]
add ecx, dword [0x141dc95cc]
or ecx, 0x7dda5edb
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov r8, rsp
cmp ecx, 0x3f1bf6c6
jne 0x1400f48d1
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
jmp 0x1400f4898
mov eax, dword [0x141dc95d0]
and eax, dword [0x141dc95d4]
xor eax, 0xead939b1
add eax, 0x11fb352b
mov ecx, 0xb94fa125
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0xbe930a79
ja 0x1400f4939
mov eax, dword [0x141dc95d8]
mov ecx, dword [0x141dc95dc]
lea edx, [rax + rcx]
add edx, 0xf90e291c
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov rcx, rsp
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov rax, rsp
cmp edx, 0x32349f52
jae 0x1400f4955
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
jmp 0x1400f48fc
lea rdx, [0x141dda5e0]
mov qword [rax], rdx
mov edx, dword [0x141dda5e8]
cmp edx, 3
jne 0x1400f4997
nop word [rax + rax]
mov eax, dword [0x141dc95f0]
xor eax, dword [0x141dc95f4]
add eax, 0x91c3715f
xor eax, 0x335390
and eax, 0x48335391
cmp eax, 0xb8f35881
ja 0x1400f4970
mov rsp, rbp
pop rbp
ret
mov edx, dword [0x141dc95e0]
imul edx, dword [0x141dc95e4]
imul edx, edx, 0x5b06bb6c
or edx, 0x8ff70942
add edx, 0x6e486a01
cmp edx, 0x13791ba5
jae 0x1400f49d0
mov qword [rcx], rax
nop word cs:[rax + rax]
mov edx, dword [0x141dc95e8]
imul edx, dword [0x141dc95ec]
add edx, 0x319ae292
mov qword [rcx], rax
cmp edx, 0xff20450a
ja 0x1400f49d0
mov qword [r8], rcx
sub rsp, 0x20
lea rcx, [0x141dda5e8]
lea r9, [0x141db8208]
xor edx, edx
call fcn.1400fa280
add rsp, 0x20
jmp 0x1400f4970
Function at 0x1400f4a20
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x48
lea rcx, [rsp + 0x38]
call fcn.1400429c0
mov eax, dword [0x141dc9ec8]
sub eax, dword [0x141dc9ecc]
imul rax, rax, 0x5a613b9f
shr rax, 0x3d
imul eax, eax, 0x542f8e78
and eax, 0x9b81b100
cmp eax, 0xb010cff6
ja 0x1400f4a89
mov esi, dword [0x141dc9ed0]
or esi, dword [0x141dc9ed4]
xor esi, 0x4300108
or esi, 0x6bc3f2e3
and esi, 0xeffbf7ef
lea rcx, [rsp + 0x28]
call fcn.140042a20
cmp esi, 0x1c35cc90
jne 0x1400f4a95
lea rcx, [rsp + 0x28]
call fcn.140042a20
jmp 0x1400f4a59
mov esi, dword [rsp + 0x40]
mov eax, esi
and eax, 0xc000000
cmp eax, 0xc000000
jne 0x1400f4b3c
mov eax, dword [0x141dc9ed8]
imul eax, dword [0x141dc9edc]
and eax, 0xf51b16cf
imul rcx, rax, 0x6e2d6d1
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1c
xor eax, 0xf38c5633
cmp eax, 0xdbc3a166
jae 0x1400f4af0
call fcn.140042af0
nop word cs:[rax + rax]
mov edi, dword [0x141dc9ee0]
add edi, dword [0x141dc9ee4]
xor edi, 0x6efec67
add edi, 0x190ddd9b
call fcn.140042af0
cmp edi, 0xe7972c33
ja 0x1400f4af0
not eax
test al, 6
sete al
nop dword [rax]
mov ecx, dword [str._kbD]
xor ecx, dword [0x141dc9eec]
imul ecx, ecx, 0x4cbdb3c7
cmp ecx, 0xf44400f6
je 0x1400f4b20
jmp 0x1400f4b3e
xor eax, eax
movzx ecx, byte [rsp + 0x2c]
shr cl, 5
shr esi, 0x1c
and esi, 1
and sil, al
and sil, cl
mov byte [0x141dbe001], sil
mov eax, esi
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x1400f7a40
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov esi, edx
mov rdi, rcx
nop word cs:[rax + rax]
mov eax, dword [0x141dca808]
xor eax, dword [0x141dca80c]
xor eax, 0x87f6ef77
add eax, 0x32d52e58
and eax, 0xc8ffd677
cmp eax, 0xdc904f08
je 0x1400f7a60
test esi, esi
je 0x1400f7cef
mov r15, qword [rdi + 0x10]
nop
mov eax, dword [0x141dca810]
or eax, dword [0x141dca814]
or eax, 0xbedb357b
and eax, 0xbeff75fb
cmp eax, 0xd95221a8
ja 0x1400f7a90
test r15, r15
je 0x1400f7cef
mov eax, 0xbc4a5de5
nop dword [rax + rax]
mov ecx, dword [0x141dca818]
xor ecx, dword [0x141dca81c]
and ecx, 0x890014d
or ecx, 0xe74fec02
imul rcx, rax
shr rcx, 0x3a
cmp ecx, 0x88847e44
ja 0x1400f7ac0
mov ebp, 0xb43b5ac1
xor ecx, ecx
jmp 0x1400f7b0c
mov rcx, r13
cmp r13, r15
je 0x1400f7cef
cmp qword [rdi + 0x10], rcx
jbe 0x1400f7d00
lea r13, [rcx + 1]
mov rdx, qword [rdi + 8]
shl rcx, 7
xor eax, eax
mov r8b, 1
lock cmpxchg byte [rdx + rcx + 4], r8b
lea r14, [rdx + rcx]
lea rbx, [rdx + rcx + 4]
sete al
mov ecx, dword [0x141dca820]
or ecx, dword [0x141dca824]
add ecx, 0x484dfed9
or ecx, 0x23d4f1ca
imul rcx, rcx, 0x7d8f08a1
shr rcx, 0x3e
cmp ecx, 0x91f6207
ja 0x1400f7b3a
test al, al
jne 0x1400f7bf3
mov eax, dword [0x141dca828]
sub eax, dword [0x141dca82c]
imul rax, rax, 0x23db621f
shr rax, 0x3c
or eax, 0x5a8f1f3e
cmp eax, 0x5ce9edf6
ja 0x1400f7ce2
mov r12d, dword [0x141dca830]
xor r12d, dword [str._Vv1]
or r12d, 0x97d846c5
imul r12, rbp
shr r12, 0x3f
or r12d, 0xc52f3402
mov rcx, rbx
call fcn.1400fb1a0
cmp r12d, 0x85fc9194
jb 0x1400f7b94
nop dword [rax]
mov eax, dword [0x141dca838]
sub eax, dword [0x141dca83c]
and eax, 0xa7051fa2
imul eax, eax, 0x6ba0c0d6
and eax, 0x8566e170
cmp eax, 0xe413a97b
je 0x1400f7bd0
mov eax, dword [0x141dca840]
and eax, dword [0x141dca844]
imul eax, eax, 0xc7cd36f5
add eax, 0xb6d5c763
xor eax, 0xc152cadf
cmp eax, 0xf5e62c74
ja 0x1400f7bf3
movzx r12d, byte [r14 + 5]
nop dword [rax + rax]
mov eax, dword [0x141dca848]
or eax, dword [0x141dca84c]
imul eax, eax, 0xde825ae4
add eax, 0x127c6234
cmp eax, 0x9c953549
ja 0x1400f7c20
test r12b, r12b
je 0x1400f7c5a
mov byte [r14 + 5], 0
lock inc dword [r14]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
lock dec qword [rdi + 0x18]
xor eax, eax
xchg byte [rbx], al
nop
mov ecx, dword [0x141dca858]
or ecx, dword [0x141dca85c]
add ecx, 0x820fe912
or ecx, 0xe492cfae
shr ecx, 1
imul rcx, rcx, 0x42d296d9
shr rcx, 0x3d
cmp ecx, 0x6ddac32
ja 0x1400f7c60
cmp al, 2
jne 0x1400f7c9a
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
test r12b, r12b
je 0x1400f7b00
xor eax, eax
test al, al
jne 0x1400f7ca3
nop dword [rax]
mov eax, dword [0x141dca860]
and eax, dword [0x141dca864]
add eax, 0xe0ad384
and eax, 0x91d6ad25
add eax, 0x2646bbb7
cmp eax, 0xeacf7649
ja 0x1400f7cb0
cmp esi, 1
mov esi, 1
jne 0x1400f7b00
jmp 0x1400f7cef
mov rcx, rbx
call fcn.1400fb1a0
jmp 0x1400f7b94
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x1400fa280
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov r10d, edx
mov rsi, rcx
mov eax, dword [0x141dccf90]
imul eax, dword [0x141dccf94]
xor eax, 0x40800
or eax, 0x64711121
and eax, 0x67759d29
cmp eax, 0xef98c941
ja 0x1400fa2e8
mov eax, dword [0x141dccf98]
or eax, dword [0x141dccf9c]
imul ecx, eax, 0xfa0babe7
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov r14, rsp
cmp ecx, 0xe92962a3
jbe 0x1400fa2f7
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
jmp 0x1400fa2be
mov eax, dword [0x141dccfa0]
add eax, dword [str.GYu]
xor eax, 0x22164ada
add eax, 0x285d92cc
or eax, 0xd197d32b
cmp eax, 0x744532b7
jne 0x1400fa330
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov eax, dword [rsi]
nop dword [rax + rax]
mov eax, dword [0x141dccfa8]
xor edx, edx
div dword [0x141dccfac]
xor eax, 0x6b5bb514
imul ecx, eax, 0x8cc72da9
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov rax, rsp
mov r15d, dword [rsi]
cmp ecx, 0xcfc8d20f
je 0x1400fa330
mov qword [rbp], rax
mov qword [rbp - 8], r8
test r10b, r10b
mov qword [rbp - 0x10], r9
je 0x1400fa617
xor edi, edi
mov ebx, 0xc3964285
mov r8d, 0xed0b2153
mov r12, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitOnAddress]
nop dword [rax]
lea r13, [0x141db9500]
mov rdi, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitOnAddress]
mov ebx, 0xedac1dbf
jmp 0x1400fa63b

Function at 0x1400faa09
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x10
lea rbp, [rsp + 0x10]
mov eax, dword [0x141dcd400]
imul eax, dword [0x141dcd404]
and eax, 0x9b237c0
add eax, 0xaa628e5f
and eax, 0xd629cd6
push 0x10
pop rdx
push 0x20
pop r9
cmp eax, 0xffe5ab75
je 0x1400faa70
mov r11d, dword [0x141dcd408]
or r11d, dword [0x141dcd40c]
mov rax, rdx
call fcn.1400eeec0
sub rsp, rax
mov r8, rsp
mov rax, r9
call fcn.1400eeec0
sub rsp, rax
mov r10, rsp
cmp r11d, 0x9dc7124b
jne 0x1400faa88
mov rax, rdx
call fcn.1400eeec0
sub rsp, rax
mov rax, r9
call fcn.1400eeec0
sub rsp, rax
jmp 0x1400faa3d
mov eax, dword [0x141dcd410]
add eax, dword [0x141dcd414]
mov r9d, 0x47cad19f
xor edx, edx
div r9d
and eax, 2
or eax, 0x377baf54
cmp eax, 0xc948972a
jbe 0x1400faab4
mov eax, dword [0x141dda658]
mov r9d, 0x7301943e
mov eax, dword [0x141dcd418]
and eax, dword [0x141dcd41c]
add eax, 0xf5c4720f
xor eax, 0xa7446dfd
xor edx, edx
div r9d
mov edx, dword [0x141dda658]
cmp eax, 0x59bb0ff5
ja 0x1400faaba
cmp edx, 3
jne 0x1400fab0f
mov ecx, 0xe230bc5
mov eax, dword [0x141dcd428]
xor edx, edx
div dword [0x141dcd42c]
and eax, 0x940481
xor edx, edx
div ecx
cmp eax, 0xb8ed1121
je 0x1400faaec
mov rsp, rbp
pop rbp
ret
mov qword [r10], rcx
lea rax, [0x141dda620]
mov qword [r10 + 8], rax
lea rax, [rbp - 1]
mov qword [r10 + 0x10], rax
mov qword [r8], r10
sub rsp, 0x20
lea rcx, [0x141dda658]
lea r9, [0x141db8518]
mov dl, 1
call fcn.1400fa280
add rsp, 0x20
mov eax, dword [0x141dcd420]
add eax, dword [0x141dcd424]
or eax, 0x6d840040
and eax, 0x6dc75d48
add eax, 0x466c7468
cmp eax, 0x821fd7ae
jb 0x1400fab45
jmp 0x1400faae7