joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009fe90
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
nop dword [rax]
mov eax, dword [0x141dd24c0]
sub eax, dword [0x141dd24c4]
or eax, 0x21e8a249
imul eax, eax, 0xc30e7217
add eax, 0xc8d49218
cmp eax, 0xd982458d
jb 0x14009fea0
mov rax, qword [rsi + 0x18]
nop word [rax + rax]
mov ecx, dword [0x141dd24c8]
imul ecx, dword [0x141dd24cc]
imul ecx, ecx, 0xdf432197
add ecx, 0x87d81795
imul rdx, rcx, 0x1363d09
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1e
cmp ecx, 0x2a099110
je 0x14009fed0
test rax, rax
je 0x1400a0020
mov eax, dword [0x141dd24d0]
add eax, dword [0x141dd24d4]
or eax, 0xa3fe807b
imul eax, eax, 0x1be099e0
or eax, 0x2de19bd4
cmp eax, 0x456c7edf
jb 0x14009ff59
mov eax, dword [0x141dd24d8]
add eax, dword [0x141dd24dc]
or eax, 0x888e49f5
add eax, 0xbd52d7e0
mov rdi, qword [rsi + 0x20]
mov rbx, qword [0x141ddc4e0]
cmp eax, 0xd7826b81
jbe 0x14009ff62
mov rax, qword [0x141ddc4e0]
jmp 0x14009ff31
mov eax, dword [0x141dd24e0]
and eax, dword [0x141dd24e4]
xor eax, 0xff1bffb4
mov ecx, 0x96841e99
imul rcx, rax
shr rcx, 0x3f
imul eax, ecx, 0xac2ac713
cmp eax, 0xca2ad95c
jbe 0x14009ff9b
mov rcx, rbx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r14, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov ebp, dword [0x141dd24e8]
add ebp, dword [0x141dd24ec]
or ebp, 0x28c80020
xor ebp, 0x48058
and ebp, 0x79ccd078
mov rcx, rbx
xor edx, edx
mov r8, rdi
call r14
cmp ebp, 0x1e8f09fe
je 0x14009ffb0
mov eax, 0xd8e0e459
nop word cs:[rax + rax]
mov ecx, dword [0x141dd24f0]
or ecx, dword [0x141dd24f4]
imul rcx, rax
shr rcx, 0x3d
imul ecx, ecx, 0x65baa1db
add ecx, 0xc550611c
cmp ecx, 0xa0d545fb
jb 0x14009fff0
nop dword [rax + rax]
mov eax, dword [0x141dd24f8]
imul eax, dword [0x141dd24fc]
or eax, 0xb6000008
and eax, 0xb63154ec
cmp eax, 0x46752bf
je 0x1400a0020
cmp rsi, 0xffffffffffffffff
je 0x1400a00cb
lea rax, [rsi + 8]
mov ecx, dword [0x141dd2500]
xor ecx, dword [0x141dd2504]
and ecx, 0x33873ce7
xor ecx, 0xe2de0cba
add ecx, 0xc5a5acc3
cmp ecx, 0xcc7f9c55
jbe 0x1400a0080
lock dec qword [rax]
nop word cs:[rax + rax]
mov ecx, dword [0x141dd2508]
xor ecx, dword [0x141dd250c]
imul edx, ecx, 0x7cf7de35
add edx, 0xb60be101
lock dec qword [rax]
sete cl
cmp edx, 0xd79971e3
ja 0x1400a0080
test cl, cl
je 0x1400a00cb
mov eax, dword [0x141dd2510]
add eax, dword [0x141dd2514]
imul eax, eax, 0x5c9d7deb
add eax, 0x532e2f9d
cmp eax, 0xd50ed845
jbe 0x1400a00d6
jmp 0x1400a0100
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov eax, dword [0x141dd2518]
imul eax, dword [0x141dd251c]
xor eax, 0x3a8872f
add eax, 0x6358f5f9
and eax, 0xa92bfb39
mov rcx, qword [0x141ddc4e0]
cmp eax, 0x1f3be8e3
jae 0x1400a0109
mov rax, qword [0x141ddc4e0]
jmp 0x1400a00d6
xor edx, edx
mov r8, rsi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
Function at 0x1400a2280
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
nop word [rax + rax]
invalid
add byte [rax], r8b
mov ecx, dword [str.YQU_I]
or ecx, dword [0x141dd29b4]
xor ecx, 0x35e8c6ce
imul ecx, ecx, 0x5b75700f
cmp ecx, 0x72b80338
jb 0x1400a2290
test eax, eax
je 0x1400a233d
mov eax, dword [0x141dd29b8]
and eax, dword [0x141dd29bc]
add eax, 0x105ab4f6
shr eax, 1
mov ecx, 0x80661f4d
Function at 0x1400b4200
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
xor eax, eax
nop dword [rax + rax]
test al, al
jne 0x1400b4220
mov rax, qword [rdi + 0x40]
nop dword [rax + rax]
mov ecx, dword [0x141dd4858]
xor ecx, dword [0x141dd485c]
cmp ecx, 0xd0c549cd
je 0x1400b4230
test rax, rax
je 0x1400b42ae
dec rax
nop dword [rax]
mov eax, dword [0x141dd4860]
xor edx, edx
div dword [0x141dd4864]
nop dword [rax]
mov eax, dword [0x141dd4868]
xor eax, dword [0x141dd486c]
and eax, 0xecc1441d
cmp eax, 0xfc119a48
je 0x1400b42c0
mov rax, qword [rdi]
mov ecx, dword [0x141dd4870]
imul ecx, dword [0x141dd4874]
xor ecx, 0x8010440
or ecx, 0x553efb3b
add ecx, 0x210d5850
cmp ecx, 0xb98e9791
jbe 0x1400b4309
mov qword [rdi], 0
mov edx, 0xb2376d89
nop
mov r9d, dword [str._nQ_:]
sub r9d, dword [0x141dd487c]
add r9d, 0xb5543960
or r9d, 0xf1c76064
imul r9, rdx
shr r9, 0x3f
mov rbx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, qword [rdi + 0x18]
mov qword [rdi], 0
cmp r9d, 0xa385d665
ja 0x1400b4310
xor edx, edx
nop word cs:[rax + rax]
add byte [rax], al

Function at 0x1400b4d40
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov rdi, r8
mov r15d, edx
mov eax, dword [0x141dd49d0]
add eax, dword [0x141dd49d4]
imul eax, eax, 0x221d9d5
cmp eax, 0x793ab181
je 0x1400b4dd1

Function at 0x1400b6df0
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
movaps xmmword [rbp - 0x10], xmm6
mov r15, rdx
mov qword [rbp - 0x20], rcx
mov eax, dword [0x141dd4e28]
imul eax, dword [0x141dd4e2c]
imul eax, eax, 0x5d56a965
add eax, 0xb0b09a8e
xor eax, 0xfc601b89
mov dword [rbx], ebx
invalid
cld
cmp eax, 0x48645c58
ja 0x1400b6e71
mov eax, dword [0x141dd4e30]
imul eax, dword [0x141dd4e34]
imul eax, eax, 0xacb74c39
xor eax, 0xd23cb8a8
shr eax, 1
imul rcx, rax, 0x4674ffb1
shr rcx, 0x3d
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov r12, rsp
cmp ecx, 0xc06d4b9e
jbe 0x1400b6e80
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
jmp 0x1400b6e34
mov qword [r12], 0
mov rbx, qword [r15 + 0x10]
nop dword [rax]
mov eax, dword [0x141dd4e38]
sub eax, dword [0x141dd4e3c]
imul eax, eax, 0xc8f4ff11
add eax, 0xf5ecf55e
cmp eax, 0x1a185879
jb 0x1400b6e90
mov rax, rbx
shr rax, 0x20
je 0x1400b6efd
nop word [rax + rax]
mov eax, dword [0x141dd4ec0]
add eax, dword [0x141dd4ec4]
xor eax, 0x510948f8
add eax, 0xdb19818
or eax, 0x86e7c9f6
cmp eax, 0x2f433ccd
jb 0x1400b6ec0
lea rax, [0x141dba9c0]
mov rcx, qword [rbp - 0x20]
mov qword [rcx + 8], rax
mov qword [rcx], 0
jmp 0x1400b796b
mov eax, dword [0x141dd4e40]
sub eax, dword [0x141dd4e44]
imul rax, rax, 0x4d810c5
shr rax, 0x38
add eax, 0xe3b018b
cmp eax, 0x9fa4c149
jbe 0x1400b6f38
sub rsp, 0x20
xor ecx, ecx
mov edx, ebx
xor r8d, r8d
mov r9, r12
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
add rsp, 0x20
mov rsi, qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
nop
Function at 0x1400b7a90
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
nop word cs:[rax + rax]
mov eax, dword [0x141dd4fa8]
sub eax, dword [str._j_Iw]
invalid
rol dword [rcx], 1
imul eax, eax, 0x5c346180
and eax, 0x15300500
cmp eax, 0x3e24ca84
je 0x1400b7ab0
test rdi, rdi
je 0x1400b7b50
mov eax, dword [0x141dd4fb0]

Function at 0x1400b7b80
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
mov rbp, rsp
mov eax, dword [0x141dd4fd0]
and eax, dword [0x141dd4fd4]
add eax, 0x3582d72a
xor eax, 0x490508f9
and eax, 0x490dc9f9
cmp eax, 0xedb4e81f
jbe 0x1400b7bc0
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
nop dword [rax + rax]
Function at 0x1400bbb90
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x141dd5828]
xor edx, edx
div dword [0x141dd582c]
xor eax, 0x41a08
and eax, 0x8b9e9acd
add eax, 0xc8d8a91
cmp eax, 0xf7323a08
ja 0x1400bbc17
Function at 0x1400c0800
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov eax, dword [0x141dd5fa8]
add eax, dword [0x141dd5fac]
or eax, 0x40604100
and eax, 0xce60d907
imul eax, eax, 0x9efcebcd
cmp eax, 0xadad854e
ja 0x1400c086d
mov eax, dword [0x141dd5fb0]
xor eax, dword [0x141dd5fb4]
imul rcx, rax, 0x96e1c1f
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
imul ecx, eax, 0x874360b1
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
mov r14, rsp
cmp ecx, 0x11ac9a65
jne 0x1400c087c
mov eax, 0x10
call fcn.1400f07c0
sub rsp, rax
jmp 0x1400c082f
mov eax, dword [0x141ddc448]
cmp eax, 3
je 0x1400c0962
mov eax, dword [0x141dd5fb8]
xor edx, edx
div dword [0x141dd5fbc]
add eax, 0x6563d339
imul rax, rax, 0x15e1ddbd
shr rax, 0x3b
or eax, 0x3e1ea2b4
cmp eax, 0x80acd9a0
jbe 0x1400c08c0
mov byte [r14], 1
nop dword [rax]
mov eax, dword [0x141dd5fc0]
mov ecx, dword [0x141dd5fc4]
add eax, ecx
add eax, 0x37d49d0c
xor eax, 0x2290ebf1
mov byte [r14], 1
cmp eax, 0xead67199
ja 0x1400c08c0
mov eax, dword [0x141dd5fc8]
xor eax, dword [0x141dd5fcc]
or eax, 0x46f9baea
add eax, 0xc1fc7846
xor eax, 0x5e773bba
cmp eax, 0xb66a0c54
jb 0x1400c096f
lea rsi, [0x141ddc448]
lea rdi, [0x141dba588]
xor r15d, r15d
mov rbx, rbp
mov qword [rbp], r14
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, rbx
mov r9, rdi
call fcn.1400fbc40
add rsp, 0x20
test r15b, r15b
jne 0x1400c0919
nop word [rax + rax]
mov eax, dword [0x141dd5fd0]
xor eax, dword [0x141dd5fd4]
or eax, 0x22848030
xor eax, 0x4480d03a
or eax, 0x18612f05
cmp eax, 0x411a512d
ja 0x1400c0940
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov qword [rbp], r14
sub rsp, 0x20
lea rcx, [0x141ddc448]
lea r9, [0x141dba588]
mov r8, rbp
xor edx, edx
call fcn.1400fbc40
add rsp, 0x20
jmp 0x1400c0905

Function at 0x1400c09a0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov eax, dword [0x141dd5fd8]
and eax, dword [0x141dd5fdc]
mov ecx, 0x8a9ce375
imul rcx, rax
shr rcx, 0x3c
and ecx, 6
cmp ecx, 0xc9af0d8b
ja 0x1400c09d8
xor esi, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1400c0a10
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rdx
mov edi, ecx
mov rbx, qword [0x141ddc4e0]
mov eax, dword [0x141dd5fe8]
xor edx, edx
div dword [0x141dd5fec]
mov eax, 0xcc22e207
nop word [rax + rax]
mov ecx, dword [0x141dd5ff0]
or ecx, dword [0x141dd5ff4]
imul rcx, rcx, 0x64c5e0f9
shr rcx, 0x3d
or ecx, 0xc925d4f8
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x926934d6
je 0x1400c0a40
test rbx, rbx
je 0x1400c0a99
mov eax, dword [0x141dd6010]
or eax, dword [str._Cv]
imul eax, eax, 0xb7450f7e
add eax, 0xe294ed9d
cmp eax, 0xfae3c388
jbe 0x1400c0b1e
jmp 0x1400c0b40
mov eax, dword [0x141dd5ff8]
xor edx, edx
div dword [0x141dd5ffc]
imul eax, eax, 0x78ae3229
add eax, 0x52b4e73b
cmp eax, 0x11476d02
jb 0x1400c0b12
mov ebx, dword [0x141dd6000]
imul ebx, dword [0x141dd6004]
or ebx, 0xc0000042
and ebx, 0xc3e460e2
xor ebx, 0xfdf07fbc
mov ecx, edi
mov rdx, rsi
call fcn.1400fd240
cmp ebx, 0x577832d5
ja 0x1400c0ab9
nop word [rax + rax]
mov ecx, dword [0x141dd6008]
sub ecx, dword [0x141dd600c]
add ecx, 0xa578c9af
xor ecx, 0xd17e0853
cmp ecx, 0x93427e82
jb 0x1400c0af0
jmp 0x1400c0b50
mov ecx, edi
mov rdx, rsi
call fcn.1400fd240
jmp 0x1400c0ab9
mov ebp, dword [0x141dd6018]
add ebp, dword [0x141dd601c]
mov rcx, rbx
mov edx, edi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp ebp, 0xb122cc85
jne 0x1400c0b50
mov rcx, rbx
mov edx, edi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x1400c0b1e
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400c0b60
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rcx, qword [rcx]
mov eax, 0x89157117
nop word cs:[rax + rax]
mov edx, dword [0x141dd6060]
or edx, dword [0x141dd6064]
imul rdx, rdx, 0x6a2efb53
shr rdx, 0x3e
imul edx, edx, 0x4b2f736a
imul rdx, rax
shr rdx, 0x3c
cmp edx, 0x14d80ed9
ja 0x1400c0b80
cmp rcx, 0xffffffffffffffff
je 0x1400c0d25
lea rax, [rcx + 1]
lea rdx, [rcx + rcx]
cmp rdx, rax
cmova rax, rdx
cmp rax, 5
mov edi, 4
cmovae rdi, rax
mov edx, 0x28
mov rax, rdi
mul rdx
mov r8, rax
seto al
movabs rdx, 0x7ffffffffffffff8
nop
mov r9d, dword [0x141dd6068]
add r9d, dword [0x141dd606c]
imul r9d, r9d, 0x2e3954fa
xor r9d, 0xe3a59d39
imul r10, r9, 0x3e5db7af
shr r10, 0x3d
cmp r8, rdx
seta r9b
cmp r10d, 0x40960546
ja 0x1400c0bf0
or al, r9b
jne 0x1400c0d25
test rcx, rcx
je 0x1400c0cac
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x1400c0c40
mov rax, qword [rsi + 8]
shl rcx, 3
lea rcx, [rcx + rcx*4]
mov qword [rsp + 0x28], rax
mov eax, dword [0x141dd6070]
and eax, dword [0x141dd6074]
add eax, 0x81e6002e
or eax, 0x69008004
and eax, 0xfd3b880c
cmp eax, 0xcbd9f089
jbe 0x1400c0c80
mov qword [rsp + 0x38], rcx
nop dword [rax]
mov eax, dword [0x141dd6078]
xor edx, edx
div dword [0x141dd607c]
xor eax, 0x90d61feb
imul eax, eax, 0xdc2cb55c
mov qword [rsp + 0x38], rcx
cmp eax, 0xb2799302
je 0x1400c0c80
mov eax, 8
jmp 0x1400c0cae
xor eax, eax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
lea r9, [rsp + 0x28]
mov edx, 8
call fcn.1400c1ab0
cmp qword [rsp + 0x40], 0
jne 0x1400c0d00
xor eax, eax
test al, al
je 0x1400c0cde
mov rax, qword [rsp + 0x48]
mov qword [rsi + 8], rax
xor eax, eax
mov rcx, qword [rsp + 0x48]
mov qword [rsi + 8], rcx
test al, al
jne 0x1400c0ce0
mov qword [rsi], rdi
add rsp, 0x58
pop rdi
pop rsi
ret
mov eax, dword [0x141dd6080]
xor edx, edx
div dword [0x141dd6084]
add eax, 0x3241967b
xor eax, 0x39de1588
imul eax, eax, 0xd040beb1
cmp eax, 0xa0dc0fa2
je 0x1400c0d00
ud2
Function at 0x1400c5a30
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
mov rbp, rsp
mov eax, dword [0x141dd6b68]
add eax, dword [0x141dd6b6c]
mov rsi, rcx
and eax, 0xf41269ed
add eax, 0xdff76990
cmp eax, 0x58492a86
jbe 0x1400c5a70
mov eax, 0x20
call fcn.1400f07c0
sub rsp, rax
nop word cs:[rax + rax]
mov eax, dword [0x141dd6b70]
and eax, dword [0x141dd6b74]
add eax, 0xb0479bd0
xor eax, 0xc07a7678
imul rcx, rax, 0x229d289b
shr rcx, 0x3c
mov eax, 0x20
call fcn.1400f07c0
sub rsp, rax
mov r9, rsp
cmp ecx, 0xd5f2f1f6
je 0x1400c5a70
mov eax, 0x20
call fcn.1400f07c0
sub rsp, rax
mov rdi, rsp
mov rcx, qword [rsi]
cmp rcx, 0xffffffffffffffff
je 0x1400c5ce8
lea r10, [rcx + 1]
movabs r8, 0x1fffffffffffffff
lea r11, [rcx + rcx]
mov r14d, 4
nop
mov eax, dword [0x141dd6b78]
xor edx, edx
div dword [0x141dd6b7c]
cmp r11, r10
mov rbx, r10
cmova rbx, r11
cmp rbx, 5
cmovb rbx, r14
cmp eax, 0x88e3f1bc
je 0x1400c5ae0
cmp rbx, r8
ja 0x1400c5ce8
lea r8, [rbx*8]
movabs rax, 0x7ffffffffffffff8
cmp r8, rax
ja 0x1400c5ce8
mov r10d, 0xc8d888e9
nop word cs:[rax + rax]
mov eax, dword [0x141dd6b80]
xor edx, edx
div dword [0x141dd6b84]
or eax, 0x641417af
xor eax, 0xcfe3f5c9
imul rax, r10
shr rax, 0x3d
cmp eax, 0x1f6890c9
ja 0x1400c5b40
nop word [rax + rax]
mov eax, dword [0x141dd6b88]
or eax, dword [0x141dd6b8c]
add eax, 0x69a29a3c
xor eax, 0xd2b89536
add eax, 0x867e9a0f
cmp eax, 0x133e27b9
jb 0x1400c5b70
test rcx, rcx
je 0x1400c5c5b
mov eax, dword [0x141dd6b90]
sub eax, dword [0x141dd6b94]
or eax, 0xb5da51b2
imul eax, eax, 0x539c74eb
cmp eax, 0x3a7a254
jne 0x1400c5bc0
mov rax, qword [rsi + 8]
mov qword [r9], rax
shl rcx, 3
nop word cs:[rax + rax]
mov eax, dword [0x141dd6b98]
mov edx, dword [0x141dd6b9c]
add eax, edx
add eax, 0x24a52dcd
xor eax, 0x13d186e2
mov rdx, qword [rsi + 8]
mov qword [r9], rdx
cmp eax, 0x9b503527
ja 0x1400c5bd0
mov eax, dword [0x141dd6ba0]
imul eax, dword [0x141dd6ba4]
imul eax, eax, 0xa01d545a
xor eax, 0x40e02804
and eax, 0x4ee23cac
cmp eax, 0xa4cec00
jne 0x1400c5c20
mov qword [r9 + 0x10], rcx
nop
mov eax, dword [0x141dd6ba8]
and eax, dword [0x141dd6bac]
xor eax, 0x68a69bd
add eax, 0x329ea1cb
or eax, 0xf4aa813c
mov qword [r9 + 0x10], rcx
cmp eax, 0x5ecad4ae
jb 0x1400c5c20
xor eax, eax
nop dword [rax + rax]
test al, al
jne 0x1400c5c50
mov eax, 8
jmp 0x1400c5c5d
xor eax, eax
mov qword [r9 + 8], rax
sub rsp, 0x20
mov edx, 8
mov rcx, rdi
call fcn.1400c1ab0
add rsp, 0x20
cmp qword [rdi], 0
jne 0x1400c5ce8
mov rax, qword [rdi + 8]
mov ecx, dword [0x141dd6bb8]
add ecx, dword [0x141dd6bbc]
or ecx, 0x4599c6e2
imul ecx, ecx, 0xeae044b1
xor ecx, 0xdf0c51f1
cmp ecx, 0xe337ab64
jbe 0x1400c5cb0
mov qword [rsi + 8], rax
mov qword [rsi], rbx
nop dword [rax]
mov ecx, dword [0x141dd6bc0]
imul ecx, dword [0x141dd6bc4]
or ecx, 0xba9ea6b1
imul ecx, ecx, 0x619bccee
add ecx, 0xca68bc
mov qword [rsi + 8], rax
mov qword [rsi], rbx
cmp ecx, 0xf9154b8e
ja 0x1400c5cb0
mov rsp, rbp
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
ud2
Function at 0x1400cb470
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
nop word [rax + rax]
mov eax, dword [0x141dd77b8]
or eax, dword [0x141dd77bc]
or eax, 0xf55af524
add eax, 0x64bd3749
xor eax, 0x48a9d95e
cmp eax, 0x88c10052
ja 0x1400cb480
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400cb532
mov eax, dword [0x141dd77c0]
and eax, dword [0x141dd77c4]
imul eax, eax, 0x90323aad
add eax, 0xf4d15f8b
cmp eax, 0x76991e8b
ja 0x1400cb4f8
mov edi, dword [0x141dd77c8]
sub edi, dword [0x141dd77cc]
and edi, 0x30fe3fdc
add edi, 0x660d8bda
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0xa5642f28
jbe 0x1400cb500
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400cb4d2
mov eax, 0xafb477db
nop word cs:[rax + rax]
mov ecx, dword [0x141dd77d0]
sub ecx, dword [0x141dd77d4]
imul rcx, rax
shr rcx, 0x3b
add ecx, 0x562a54a4
cmp ecx, 0xab0017a
jb 0x1400cb510
cmp rsi, 0xffffffffffffffff
je 0x1400cb610
lock dec qword [rsi + 8]
jne 0x1400cb610
mov eax, dword [0x141dd77d8]
xor edx, edx
div dword [0x141dd77dc]
add eax, 0xdb41508f
mov ecx, 0xa04d8acb
imul rcx, rax
shr rcx, 0x3e
xor ecx, 0xea0a7aa1
cmp ecx, 0x99067424
jb 0x1400cb593
mov eax, dword [0x141dd77e0]
and eax, dword [0x141dd77e4]
imul eax, eax, 0xd89d90e8
or eax, 0x5ff8f022
cmp eax, 0x5b8e1898
jae 0x1400cb595
jmp 0x1400cb575
mov rdi, qword [0x141ddc4e0]
mov eax, dword [0x141dd77e8]
imul eax, dword [0x141dd77ec]
add eax, 0x1bcb070
and eax, 0x81e44720
cmp eax, 0x2049c1fd
ja 0x1400cb5f3
mov eax, dword [0x141dd77f0]
add eax, dword [0x141dd77f4]
imul rax, rax, 0x38161c5
shr rax, 0x36
imul ebx, eax, 0x1109995d
add ebx, 0xe97faae9
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0x348cb9a1
jae 0x1400cb610
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400cb5ba
mov eax, dword [0x141dd77f8]
sub eax, dword [0x141dd77fc]
add eax, 0xe98b4666
xor eax, 0x332ae392
imul rax, rax, 0x70cbc30f
shr rax, 0x3e
cmp eax, 0xde759cd5
ja 0x1400cb610
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400d6270
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov eax, dword [0x141dd8e68]
sub eax, dword [0x141dd8e6c]
imul eax, eax, 0xe70711d2
or eax, 0x84248188
and eax, 0x9cec81ac
cmp eax, 0x827485fb
jne 0x1400d62a4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov eax, dword [0x141dd8e70]
sub eax, dword [0x141dd8e74]
and eax, 0xc9ed659b
imul ebp, eax, 0xa82547da
call rbx
cmp ebp, 0xf985ca7
je 0x1400d62b0
mov rdi, rax
inc rax
cmp rax, 2
jb 0x1400d63ba
mov eax, dword [0x141dd8e78]
and eax, dword [0x141dd8e7c]
xor eax, 0x3abf05f5
imul eax, eax, 0xcbca244b
cmp eax, 0xccdc9a60
jae 0x1400d630d
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov eax, dword [0x141dd8e80]
xor edx, edx
div dword [0x141dd8e84]
imul ebp, eax, 0x8812f7af
xor ebp, 0x5104004
and ebp, 0x879c50c4
mov rcx, rdi
xor edx, edx
mov r8, rsi
call rbx
cmp ebp, 0x73fb9d0a
je 0x1400d6320
nop word cs:[rax + rax]
mov ecx, dword [0x141dd8e88]
or ecx, dword [0x141dd8e8c]
and ecx, 0x99c8a54a
imul ecx, ecx, 0xbb966962
and ecx, 0x9f9fd538
cmp ecx, 0xe223b38d
ja 0x1400d6360
nop word cs:[rax + rax]
mov ecx, dword [0x141dd8e90]
sub ecx, dword [0x141dd8e94]
xor ecx, 0x702cddb
add ecx, 0x1b28b7ce
or ecx, 0xba693093
cmp ecx, 0x74709571
je 0x1400d6390
test eax, eax
jne 0x1400d63f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x141dd8e98]
sub eax, dword [0x141dd8e9c]
imul rax, rax, 0x7753f533
shr rax, 0x3e
imul eax, eax, 0xb705d410
cmp eax, 0x9e7ce90b
je 0x1400d63c0
nop word cs:[rax + rax]
mov eax, dword [0x141dd8ea0]
add eax, dword [0x141dd8ea4]
and eax, 0xd7103261
imul eax, eax, 0x12c4501e
cmp eax, 0xc96fac74
je 0x1400d63f0
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400d6a40
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rbx, r9
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov r13, r9
shr r13, 1
lea rcx, [r13 + 1]
lea r12, [r13*2 + 2]
movabs rdx, 0x7ffffffffffffffe
nop dword [rax + rax]
mov eax, dword [0x141dd8fb8]
sub eax, dword [0x141dd8fbc]
add eax, 0x32c41930
or eax, 0xff89ad19
cmp eax, 0x43ba45a3
jb 0x1400d6a80
test rcx, rcx
js 0x1400d6bfa
cmp r12, rdx
ja 0x1400d6bfa
mov qword [rsp + 0x30], rcx
nop word cs:[rax + rax]
mov eax, dword [0x141dd8fc0]
xor edx, edx
div dword [0x141dd8fc4]
add eax, 0x4a89966f
and eax, 0xea394219
imul rcx, rax, 0x2a63f0fb
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1b
cmp eax, 0xa9a8a33e
ja 0x1400d6ac0
nop word cs:[rax + rax]
mov eax, dword [0x141dd8fc8]
imul eax, dword [0x141dd8fcc]
add eax, 0x16de3b3a
or eax, 0xe9a67563
add eax, 0xa0a8e1a5
cmp eax, 0xeef22e0b
ja 0x1400d6b00
test r12, r12
je 0x1400d6bfc
movzx eax, byte [0x141ddc4f8]
mov eax, dword [0x141dd8fd0]
and eax, dword [0x141dd8fd4]
imul eax, eax, 0x25cdc0c1
add eax, 0xaecaa7a1
and eax, 0x44122b1b
cmp eax, 0xa72666fb
jbe 0x1400d6b60
xor ecx, ecx
mov rdx, r12
call fcn.1400c0a10
mov eax, dword [0x141dd8fd8]
mov ecx, dword [0x141dd8fdc]
lea ebp, [rax + rcx]
add ebp, 0xf68286c4
or ebp, 0xb56e53d4
xor ecx, ecx
mov rdx, r12
call fcn.1400c0a10
cmp ebp, 0x9e3bbc2d
jb 0x1400d6b60
mov rdi, rax
mov r12, qword [rsp + 0x30]
nop word cs:[rax + rax]
mov eax, dword [0x141dd8fe0]
add eax, dword [0x141dd8fe4]
cmp eax, 0x35213044
je 0x1400d6ba0
test rdi, rdi
jne 0x1400d6c04
mov eax, dword [0x141dd8fe8]
add eax, dword [0x141dd8fec]
xor eax, 0xed184be3
imul eax, eax, 0xbe91181
xor eax, 0xdc68bad4
cmp eax, 0xa370cff6
jbe 0x1400d6be0
ud2
mov eax, dword [0x141dd8ff0]
or eax, dword [0x141dd8ff4]
and eax, 0x83d1bcc7
ud2
ud2
mov edi, 2
xor r12d, r12d
mov eax, dword [0x141dd8ff8]
imul eax, dword [0x141dd8ffc]
imul eax, eax, 0x5a9b5a15
imul rax, rax, 0x218924e7
shr rax, 0x39
add eax, 0xf992b981
cmp eax, 0xd728aa4d
jb 0x1400d6c74
Function at 0x1400d7920
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov eax, dword [0x141dd9188]
and eax, dword [0x141dd918c]
imul eax, eax, 0x824c851f
add eax, 0x1b32315d
imul rax, rax, 0x2f3b3009
xor byte [rbx], bh
invalid
shr rax, 0x3b
cmp eax, 0xffcf5ba
jbe 0x1400d796f
mov eax, 0x30
call fcn.1400f07c0
sub rsp, rax
xor edx, edx
nop word cs:[rax + rax]
nop word cs:[rax + rax]