joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f0de0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
add rdx, r8
setb al
mov rsi, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141dc1ed0]
mov r8d, dword [0x141dc1ed4]
add ecx, r8d
add ecx, 0x8b009156
or ecx, 0xc40d52e1
cmp ecx, 0x65f83df9
je 0x1400f0e00
test al, al
jne 0x1400f10c2
mov rax, qword [rsi]
lea rcx, [rax + rax]
mov r8d, 8
xor r9d, r9d
nop dword [rax]
cmp rcx, rdx
mov rdi, rdx
cmova rdi, rcx
cmp rdi, 9
cmovb rdi, r8
test r9b, r9b
jne 0x1400f0e40
test rdi, rdi
js 0x1400f10c2
mov ecx, dword [0x141dc1ed8]
imul ecx, dword [0x141dc1edc]
and ecx, 0xe533b06a
add ecx, 0x97295790
xor ecx, 0x9e56b347
cmp ecx, 0x39bf32fd
jb 0x1400f0e60
nop word [rax + rax]
mov ecx, dword [0x141dc1ee0]
and ecx, dword [0x141dc1ee4]
add ecx, 0x1568a822
xor ecx, 0x280dc003
or ecx, 0x86f007ec
cmp ecx, 0x2f0d331e
jb 0x1400f0e90
nop word cs:[rax + rax]
mov ecx, dword [str.mdW]
and ecx, dword [0x141dc1eec]
or ecx, 0xc2c62000
xor ecx, 0x26842020
or ecx, 0x19395edd
cmp ecx, 0xedc8ef31
jb 0x1400f0ec0
test rax, rax
je 0x1400f0f98
mov ecx, dword [0x141dc1ef0]
or ecx, dword [0x141dc1ef4]
and ecx, 0xc4f7af18
imul ecx, ecx, 0xeaff9885
xor ecx, 0x595f9756
cmp ecx, 0xe75ad9ca
jbe 0x1400f0f1e
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x28], rcx
mov ecx, 0xa04b6487
nop word cs:[rax + rax]
mov rdx, qword [rsi + 8]
mov qword [rsp + 0x28], rdx
mov edx, dword [0x141dc1ef8]
and edx, dword [0x141dc1efc]
xor edx, 0xdaff1a18
imul rdx, rcx
shr rdx, 0x3d
and edx, 1
cmp edx, 0xd8212225
ja 0x1400f0f30
nop
mov ecx, dword [0x141dc1f00]
xor ecx, dword [0x141dc1f04]
and ecx, 0x40a72aef
imul rcx, rcx, 0x12fa4a1
shr rcx, 0x36
or ecx, 0xb6532ae6
cmp ecx, 0x886a0d1
jb 0x1400f0f60
mov qword [rsp + 0x38], rax
mov r15d, 1
jmp 0x1400f0f9b
xor r15d, r15d
mov eax, dword [0x141dc1f08]
xor eax, dword [0x141dc1f0c]
add eax, 0x49743279
or eax, 0x40de86a
xor eax, 0xb42a7fd3
cmp eax, 0x72be75d
jae 0x1400f0fd4
mov qword [rsp + 0x30], r15
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x28]
mov rdx, rdi
call fcn.1400375f0
lea rbx, [rsp + 0x40]
lea r14, [rsp + 0x28]
xor ebp, ebp
mov qword [rsp + 0x30], r15
mov rcx, rbx
mov rdx, rdi
mov r8, r14
call fcn.1400375f0
test bpl, bpl
jne 0x1400f0fe0
cmp qword [rsp + 0x40], 0
jne 0x1400f10a0
nop word cs:[rax + rax]
mov eax, dword [0x141dc1f20]
imul eax, dword [0x141dc1f24]
imul rax, rax, 0xdfd1839
shr rax, 0x3b
imul eax, eax, 0x5a005df7
xor eax, 0x156c526f
cmp eax, 0x5b5e8359
ja 0x1400f1010
mov eax, dword [0x141dc1f28]
add eax, dword [0x141dc1f2c]
xor eax, 0x50101901
or eax, 0xaf6ba4b6
cmp eax, 0x50482648
nop word cs:[rax + rax]
mov eax, dword [0x141dc1f30]
and eax, dword [0x141dc1f34]
xor eax, 0xbc467ffe
imul eax, eax, 0x84d570e3
cmp eax, 0x7d81cdb1
je 0x1400f1060
mov rax, qword [rsp + 0x48]
mov qword [rsi + 8], rax
mov qword [rsi], rdi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov eax, dword [0x141dc1f10]
sub eax, dword [0x141dc1f14]
xor eax, 0x2000000
or eax, 0xa41a4009
and eax, 0xa63a400b
cmp eax, 0x4ae1e454
jb 0x1400f10a0
ud2
Function at 0x1400f1100
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x48
lea rcx, [rsp + 0x28]
call fcn.140041420
lea rcx, [rsp + 0x38]
call fcn.140041520
mov esi, dword [rsp + 0x30]
mov eax, esi
not eax
test eax, 0xc000000
jne 0x1400f1195
mov eax, dword [0x141dc2980]
xor eax, dword [0x141dc2984]
imul rax, rax, 0x79a1f1dd
shr rax, 0x3e
or eax, 0x146ac954
imul eax, eax, 0x7943b16a
cmp eax, 0xcbfb7c30
jbe 0x1400f1160
call fcn.140041640
nop word [rax + rax]
mov edi, dword [0x141dc2988]
imul edi, dword [0x141dc298c]
add edi, 0x9b38d966
xor edi, 0x320508
or edi, 0x5ec9ea97
call fcn.140041640
cmp edi, 0xb9b39787
ja 0x1400f1160
not eax
test al, 6
sete al
jmp 0x1400f1197
xor eax, eax
movzx ecx, byte [rsp + 0x3c]
shr cl, 5
and cl, al
shr esi, 0x1c
and esi, 1
and sil, cl
mov byte [section..data], sil
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x1400f2a70
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov eax, dword [0x141dc74c8]
sub eax, dword [0x141dc74cc]
xor eax, 0x4bd5303c
imul eax, eax, 0x4f1cd46e
cmp eax, 0xcdf081a8
jne 0x1400f2ad0
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov rax, rsp
lea rcx, [0x141dd7f20]
mov qword [rax], rcx
mov eax, dword [0x141dd7f28]
lea rcx, [0x141dd7f20]
nop word [rax + rax]
mov eax, dword [0x141dc74d0]
xor eax, dword [0x141dc74d4]
imul r8d, eax, 0xe55ea86c
add r8d, 0x29807947
or r8d, 0x13361208
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov rdi, rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov rax, rsp
mov qword [rax], rcx
mov edx, dword [0x141dd7f28]
cmp r8d, 0xb69c7b64
je 0x1400f2ae0
cmp edx, 3
je 0x1400f2c49
mov ecx, dword [0x141dc74d8]
or ecx, dword [0x141dc74dc]
xor ecx, 0x40080001
and ecx, 0x50188001
cmp ecx, 0xd239f4ce
ja 0x1400f2b75
mov qword [rdi], rax
xor ecx, ecx
test cl, cl
je 0x1400f2b7a
mov qword [rdi], rax
jmp 0x1400f2b6c
mov eax, dword [0x141dc74e0]
xor edx, edx
div dword [0x141dc74e4]
imul eax, eax, 0x52501606
or eax, 0x2020a80
and eax, 0x61a0ab2
cmp eax, 0x25618320
ja 0x1400f2be8
mov ebx, dword [0x141dc74e8]
sub ebx, dword [0x141dc74ec]
and ebx, 0x3ed0f4bf
add ebx, 0xf090be24
or ebx, 0x787cb85d
mov qword [rsi], rdi
sub rsp, 0x20
lea rcx, [0x141dd7f28]
lea r9, [0x141db6228]
xor edx, edx
mov r8, rsi
call fcn.1400f7ed0
add rsp, 0x20
cmp ebx, 0x11d9357d
jae 0x1400f2c0d
mov qword [rsi], rdi
sub rsp, 0x20
lea rcx, [0x141dd7f28]
lea r9, [0x141db6228]
xor edx, edx
mov r8, rsi
call fcn.1400f7ed0
add rsp, 0x20
jmp 0x1400f2b9f
mov eax, 0xd49d63df
nop word cs:[rax + rax]
mov ecx, dword [0x141dc74f0]
imul ecx, dword [0x141dc74f4]
and ecx, 0xd08aa725
imul ecx, ecx, 0x78802733
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0x27f177f
ja 0x1400f2c20
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400f2c60
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
mov rbp, rsp
mov eax, dword [0x141dc7d50]
xor eax, dword [0x141dc7d54]
imul eax, eax, 0xdd57852
add eax, 0xf05db932
cmp eax, 0x7abc174f
jb 0x1400f2cc2
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov rdi, rsp
sub rsp, 0x20
mov rcx, rdi
call fcn.140041420
mov rcx, rsi
call fcn.140041520
add rsp, 0x20
xor eax, eax
test al, al
je 0x1400f2cf9
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov rcx, rsp
sub rsp, 0x20
call fcn.140041420
mov rcx, rsi
call fcn.140041520
add rsp, 0x20
jmp 0x1400f2c84
mov edi, dword [rdi + 8]
mov eax, edi
not eax
test eax, 0xc000000
jne 0x1400f2d4a
sub rsp, 0x20
call fcn.140041640
add rsp, 0x20
not eax
test al, 6
sete al
mov ecx, 0x9b7e0aa7
mov edx, dword [0x141dc7d58]
and edx, dword [0x141dc7d5c]
imul edx, edx, 0x315b4d57
xor edx, 0x2f775dcd
imul rdx, rcx
shr rdx, 0x3d
cmp edx, 0xff8a3714
ja 0x1400f2d20
jmp 0x1400f2d4c
xor eax, eax
movzx ecx, byte [rsi + 4]
shr cl, 5
shr edi, 0x1c
and edi, 1
and dil, al
and dil, cl
mov byte [0x141dbc001], dil
mov eax, edi
mov rsp, rbp
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400f7ce0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rsi, rcx
mov eax, dword [0x141dca5b8]
xor eax, dword [0x141dca5bc]
and eax, 0xb1c1820
cmp eax, 0xb78cd843
je 0x1400f7d42
mov eax, dword [0x141dca5c0]
sub eax, dword [0x141dca5c4]
and eax, 0x8d37a768
imul ecx, eax, 0xe19184b4
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov r9, rsp
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov rdi, rsp
cmp ecx, 0x128828bf
jae 0x1400f7d5e
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
jmp 0x1400f7d03
mov rcx, qword [rsi]
lea rax, [rcx + rcx]
cmp rax, rdx
cmova rdx, rax
cmp rdx, 5
mov ebx, 4
cmovae rbx, rdx
lea rax, [r8 + 7]
and rax, 0xfffffffffffffff8
mul rbx
jo 0x1400f7eca
movabs rdx, 0x7ffffffffffffff8
cmp rax, rdx
ja 0x1400f7eca
nop dword [rax]
mov edx, dword [0x141dca5c8]
or edx, dword [0x141dca5cc]
xor edx, 0x48004008
or edx, 0x33628cf5
cmp edx, 0x44bd3a1
je 0x1400f7da0
mov edx, 0xdcfb8027
nop word cs:[rax + rax]
mov r10d, dword [0x141dca5d0]
imul r10d, dword [0x141dca5d4]
imul r10, rdx
shr r10, 0x3e
imul r10d, r10d, 0x80002b3f
or r10d, 0x38e8c358
cmp r10d, 0x54cd922
je 0x1400f7dd0
test rcx, rcx
je 0x1400f7e19
mov rdx, qword [rsi + 8]
imul rcx, r8
mov qword [r9], rdx
mov qword [r9 + 0x10], rcx
mov ecx, 8
jmp 0x1400f7e1b
xor ecx, ecx
mov qword [r9 + 8], rcx
sub rsp, 0x20
mov rcx, rdi
mov rdx, rax
mov r8, r9
call fcn.140080640
add rsp, 0x20
cmp qword [rdi], 0
jne 0x1400f7e80
mov rax, qword [rdi + 8]
mov qword [rsi + 8], rax
mov qword [rsi], rbx
nop word cs:[rax + rax]
mov eax, dword [0x141dca5e8]
or eax, dword [0x141dca5ec]
xor eax, 0xccbe839
add eax, 0x6d04fa6
and eax, 0x7015595a
cmp eax, 0x9597ebc3
je 0x1400f7e50
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [0x141dca5d8]
xor eax, dword [0x141dca5dc]
or eax, 0xbe22a881
cmp eax, 0x7a34dcbd
je 0x1400f7e80
mov eax, 0x81fc46b3
nop dword [rax]
mov ecx, dword [0x141dca5e0]
or ecx, dword [0x141dca5e4]
shr ecx, 1
imul rcx, rax
shr rcx, 0x3e
imul ecx, ecx, 0x3edebbb3
or ecx, 0xe3467c15
cmp ecx, 0x7e7a6156
jb 0x1400f7ea0
ud2

Function at 0x1400f7ed0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov qword [rbp], r9
mov rdi, r8
mov rsi, rcx
mov eax, dword [0x141dcabb8]
xor eax, dword [0x141dcabbc]
or eax, 0x867b8bf4
xor eax, 0xc9a6e00
imul eax, eax, 0xdd6047ab
cmp eax, 0xaba6a14
jb 0x1400f7f33
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov r15, rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov r14, rsp
xor eax, eax
test al, al
je 0x1400f7f4f
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
jmp 0x1400f7f0d
mov eax, dword [0x141dcabc0]
mov ecx, dword [0x141dcabc4]
add eax, ecx
add eax, 0x5d5b395c
and eax, 0x40489649
cmp eax, 0x80d72203
jne 0x1400f7f70
mov eax, dword [rsi]
xor eax, eax
nop word cs:[rax + rax]
mov ecx, dword [rsi]
test al, al
jne 0x1400f7f80
nop word cs:[rax + rax]
Function at 0x1400f86c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rax
mov rbp, rsp
mov eax, dword [0x141dcb018]
or eax, dword [0x141dcb01c]
imul eax, eax, 0xc5dbd33b
mov ecx, 0xaf61e70b
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x4f885eb9
jne 0x1400f8710
mov eax, 0x30
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
nop word [rax + rax]
mov r8d, dword [0x141dcb020]
xor r8d, dword [0x141dcb024]
or r8d, 0x292f6a86
add r8d, 0x78e063e5
or r8d, 0x3dbe3d5f
mov eax, 0x30
call fcn.1400ed360
sub rsp, rax
mov rdx, rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov rcx, rsp
cmp r8d, 0x5d3c9072
ja 0x1400f8710
mov eax, dword [0x141dd7ffc]
mov r8, qword gs:[0x58]
mov rax, qword [r8 + rax*8]
cmp qword [rax + 0x40], 0
jne 0x1400f87c4
mov eax, dword [0x141dd7ffc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x40], 0xffffffffffffffff
mov eax, dword [0x141dcb028]
xor edx, edx
div dword [0x141dcb02c]
imul eax, eax, 0xb0dd7684
add eax, 0xc802f24a
imul rax, rax, 0x1ef15c01
shr rax, 0x3c
cmp eax, 0xf82220e9
jne 0x1400f880c
jmp 0x1400f8830
mov dword [rcx], 0
mov byte [rcx + 4], 0
lea rax, [0x141db6ac0]
mov qword [rdx], rax
mov qword [rdx + 8], 1
mov rax, rbp
mov qword [rdx + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rdx + 0x18], xmm0
sub rsp, 0x20
call fcn.140086dc0
mov rcx, rax
call fcn.140087240
add rsp, 0x20
mov ecx, 7
int 0x29
ud2
mov eax, dword [0x141dcb030]
xor eax, dword [0x141dcb034]
xor eax, 0xdc5001db
add eax, 0x8c38a33f
mov rcx, qword [0x1400ff600]
cmp eax, 0x47ca5f65
jae 0x1400f8839
mov rax, qword [0x1400ff600]
jmp 0x1400f880c
mov eax, dword [0x141dd7ffc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rsi, qword [rax + 0x58]
cmp rsi, qword [rax + 0x48]
jne 0x1400f88bc
sub rsp, 0x20
call fcn.140089320
add rsp, 0x20
mov eax, dword [0x141dd7ffc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x40]
inc rcx
nop word cs:[rax + rax]
mov eax, dword [0x141dcb038]
xor edx, edx
div dword [0x141dcb03c]
add eax, 0xb8484eb0
and eax, 0xdfe166f9
imul rax, rax, 0x6dcf66db
shr rax, 0x3e
cmp eax, 0xc641e4ae
ja 0x1400f8890
jmp 0x1400f88be
xor ecx, ecx
mov eax, dword [0x141dcb040]
or eax, dword [0x141dcb044]
xor eax, 0x11341424
and eax, 0x51f697a4
cmp eax, 0x68d3e0b4
je 0x1400f894b
mov eax, dword [0x141dcb048]
xor eax, dword [0x141dcb04c]
add eax, 0xde04398c
xor eax, 0xfd7743d7
mov rdx, rsi
shl rdx, 4
mov r8d, dword [0x141dd7ffc]
mov r9, qword gs:[0x58]
mov r8, qword [r9 + r8*8]
mov r9, qword [r8 + 0x50]
lea r10, [r8 + 0x90]
mov qword [r9 + rdx], r10
lea r10, [0x140089620]
mov qword [r9 + rdx + 8], r10
lea rdx, [rsi + 1]
mov qword [r8 + 0x58], rdx
mov qword [r8 + 0x40], rcx
mov byte [r8 + 0x98], 1
cmp eax, 0xe12f72a8
jbe 0x1400f89a1
mov eax, dword [0x141dd7ffc]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
mov rdx, qword [rax + 0x50]
mov r8, rsi
shl r8, 4
lea r9, [rax + 0x90]
mov qword [rdx + r8], r9
lea r9, [0x140089620]
mov qword [rdx + r8 + 8], r9
lea rdx, [rsi + 1]
mov qword [rax + 0x58], rdx
mov qword [rax + 0x40], rcx
mov byte [rax + 0x98], 1
jmp 0x1400f88db
lea rsp, [rbp + 8]
pop rsi
pop rbp
ret
Function at 0x1400f9850
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov edi, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop word cs:[rax + rax]
mov ecx, dword [0x141dd1f30]
or ecx, dword [0x141dd1f34]
and ecx, 0x1a77ed03
cmp ecx, 0x25424842
je 0x1400f9870
test rax, rax
je 0x1400f98a6
mov qword [0x141dd7fe0], rax
mov rcx, rax
mov edx, edi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x1400f98b0
xor eax, eax
nop dword [rax + rax]
mov ecx, dword [0x141dd1f38]
mov edx, dword [0x141dd1f3c]
add ecx, edx
add ecx, 0xd024bcce
xor ecx, 0x36080428
and ecx, 0xf77e8c69
cmp ecx, 0xde5453d3
ja 0x1400f98b0
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400faca0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rbp + 0x60]
xor eax, eax
test al, al
jne 0x1400facd2
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov r10, rsp
xor eax, eax
test al, al
je 0x1400face1
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
jmp 0x1400facbc
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov rbx, rsp
add rsi, r8
jb 0x1400faeb8
mov r8, qword [rdi]
lea rax, [r8 + r8]
cmp rax, rsi
cmova rsi, rax
xor eax, eax
cmp rcx, 1
sete al
lea rax, [rax*4 + 4]
cmp rax, rsi
cmova rsi, rax
movabs r11, 0x8000000000000000
sub r11, r9
nop dword [rax]
mov eax, dword [0x141dd2300]
add eax, dword [0x141dd2304]
or eax, 0x46a48c00
and eax, 0x76efdc96
imul r15, rax, 0x267c9a7f
shr r15, 0x3b
lea rdx, [r9 + rcx]
dec rdx
mov rax, r9
neg rax
and rax, rdx
mul rsi
seto dl
cmp rax, r11
seta r14b
cmp r15d, 0x12289721
ja 0x1400fad30
or dl, r14b
jne 0x1400faeb8
mov edx, dword [0x141dd2308]
imul edx, dword [0x141dd230c]
add edx, 0x2ddf341
or edx, 0xe263ed1e
add edx, 0x2288e339
cmp edx, 0xaf2f6a08
ja 0x1400fad80
nop word [rax + rax]
mov edx, dword [0x141dd2310]
or edx, dword [0x141dd2314]
add edx, 0x8b30a8bb
xor edx, 0x70bdd4a0
add edx, 0xaed21fdb
cmp edx, 0x5059b827
jb 0x1400fadb0
test r8, r8
je 0x1400fae35
imul r8, rcx
nop
mov ecx, dword [0x141dd2318]
add ecx, dword [0x141dd231c]
or ecx, 0x9dbe6eaf
imul ecx, ecx, 0x81b07385
add ecx, 0xec452a78
cmp ecx, 0x409e70d7
jb 0x1400fade0
mov rcx, qword [rdi + 8]
mov qword [r10], rcx
mov ecx, dword [0x141dd2320]
sub ecx, dword [0x141dd2324]
add ecx, 0x8a04ea3b
xor ecx, 0xb372de99
add ecx, 0x53f64916
cmp ecx, 0xa71ada19
jbe 0x1400fae39
jmp 0x1400fae46
xor ecx, ecx
jmp 0x1400fae4c
mov qword [r10 + 0x10], r8
xor edx, edx
mov rcx, r9
test dl, dl
je 0x1400fae4c
mov qword [r10 + 0x10], r8
jmp 0x1400fae39
mov qword [r10 + 8], rcx
sub rsp, 0x20
mov rcx, rbx
mov rdx, r9
mov r8, rax
mov r9, r10
call fcn.1400bff80
add rsp, 0x20
cmp qword [rbx], 0
jne 0x1400faeb8
nop
mov eax, dword [0x141dd2328]
or eax, dword [0x141dd232c]
xor eax, 0x65d621d8
add eax, 0x111d0eb7
or eax, 0x51ca5466
cmp eax, 0x37896efa
jb 0x1400fae70
mov eax, dword [0x141dd2330]
xor edx, edx
div dword [str.k7_M]
add eax, 0x6a78c94e
xor eax, 0x97291048
and eax, 0xd739144d
cmp eax, 0x64999732
jne 0x1400faec6
jmp 0x1400faed7
ud2
mov rax, qword [rbx + 8]
mov qword [rdi + 8], rax
mov qword [rdi], rsi
xor eax, eax
test al, al
je 0x1400faee4
mov rax, qword [rbx + 8]
mov qword [rdi + 8], rax
mov qword [rdi], rsi
jmp 0x1400faec6
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x1400fd26e
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x10
lea rbp, [rsp + 0x10]
mov eax, dword [0x141dd4d88]
mov ecx, dword [0x141dd4d8c]
add eax, ecx
add eax, 0xb17d43d7
xor eax, 0x4918014
and eax, 0x1595c634
push 0x10
pop rcx
cmp eax, 0xe26f805
jbe 0x1400fd2b3
mov rax, rcx
call fcn.1400ed360
sub rsp, rax
mov eax, dword [0x141dd4d90]
or eax, dword [0x141dd4d94]
imul edx, eax, 0x1cae960b
add edx, 0xdb0184c8
or edx, 0x993db339
mov rax, rcx
call fcn.1400ed360
sub rsp, rax
mov r14, rsp
cmp edx, 0x2e60cba8
je 0x1400fd2b3
mov eax, dword [0x141dd7ff0]
cmp eax, 3
je 0x1400fd382
lea rax, [0x141dd7ff4]
mov qword [r14], rax
mov eax, dword [0x141dd4d98]
xor edx, edx
div dword [0x141dd4d9c]
mov ecx, 0x2b0eeb73
xor edx, edx
div ecx
mov ecx, 0xb091c279
xor edx, edx
div ecx
lea r15, [rbp - 1]
cmp eax, 0xd157b35c
ja 0x1400fd390
lea rsi, [0x141dd7ff0]
lea rdi, [0x141db6ad0]
lea rbx, [rbp - 0x10]
mov r12d, dword [0x141dd4da0]
xor r12d, dword [0x141dd4da4]
add r12d, 0xace7ad8b
or r12d, 0xf9a0fe33
mov qword [r14 + 8], r15
mov qword [rbp - 0x10], r14
sub rsp, 0x20
mov rcx, rsi
mov dl, 1
mov r8, rbx
mov r9, rdi
call fcn.1400f7ed0
add rsp, 0x20
cmp r12d, 0xc12b8671
jb 0x1400fd33d
mov rsp, rbp
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov qword [r14 + 8], r15
lea r8, [rbp - 0x10]
mov qword [r8], r14
sub rsp, 0x20
lea rcx, [0x141dd7ff0]
lea r9, [0x141db6ad0]
mov dl, 1
call fcn.1400f7ed0
add rsp, 0x20
jmp 0x1400fd32b
Function at 0x10000bae0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x100011df8], rdi
je 0x10000bb40
cmp rax, rdi
jne 0x10000bb33
mov r12d, 1
jmp 0x10000bb40
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10000bb19
mov eax, dword [0x100011df0]
cmp eax, 1
jne 0x10000bb55
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x10000bbbc
mov eax, dword [0x100011df0]
cmp eax, ebx
jne 0x10000bbb2
mov dword [0x100011df0], 1
lea r13, [0x100001448]
lea rdi, [0x100001430]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x10000bba4
cmp eax, ebx
jne 0x10000bba4
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x10000bb99
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x10000bb82
cmp eax, ebx
je 0x10000bbbc
mov eax, 0xff
jmp 0x10000bd04
mov dword [0x1000115d4], 1
mov eax, dword [0x100011df0]
cmp eax, 1
jne 0x10000bbe4
lea rdx, [0x100001428]
lea rcx, [0x1000013f0]
call sub.msvcrt.dll__initterm
mov dword [0x100011df0], 2
cmp r12d, ebx
jne 0x10000bbf3
mov rax, rbx
xchg qword [0x100011df8], rax
cmp qword [0x100011e10], rbx
je 0x10000bc1b
lea rcx, [0x100011e10]
call fcn.10000c0cc
cmp eax, ebx
je 0x10000bc1b
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100011e10]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x10000bc31
mov eax, 0xff
jmp 0x10000bd04
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x10000bcb6
cmp word [rcx], bx
je 0x10000bc4c
cmp edx, ebx
jne 0x10000bcb6
cmp word [rcx], bx
je 0x10000bc62
cmp word [rcx], 0x20
ja 0x10000bc62
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x10000bc4c
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x100000000]
call fcn.100002d14
mov dword [0x1000115d0], eax
cmp dword [0x1000115b4], ebx
jne 0x10000bca0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1000115d4], ebx
jne 0x10000bcb4
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1000115d0]
jmp 0x10000bd04
cmp word [rcx], 0x22
jne 0x10000bcc9
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x10000bc3d
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.1000a2000
add rsp, 0x28
jmp 0x10000bae0
Function at 0x140001c14
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140001ca5
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x140001ca5
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001ca5
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140001c89
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140001c83
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140001c8b
add rdx, 0x28
jmp 0x140001c68
xor edx, edx
test rdx, rdx
jne 0x140001c94
xor al, al
jmp 0x140001cab
test dword [rdx + 0x24], 0x80000000
je 0x140001ca1
xor al, al
jmp 0x140001cab
mov al, 1
jmp 0x140001cab
xor al, al
jmp 0x140001cab
add rsp, 0x18
ret

Function at 0x140002154
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x140003e54
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.140006a04
test al, al
je 0x140003e8c
mov rax, qword gs:[0x60]
mov edx, dword [rax + 0xbc]
shr edx, 8
test dl, 1
jne 0x140003e8c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.140003ea0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]