joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140018c00
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov r8, rdx
shr r8, 0x16
xor r8, rdx
xor r8, 0x40a3e2b7
add r8, 0x4211439b
mov rcx, r8
rol rcx, 2
xor rcx, r8
movzx ecx, cx
nop dword [rax + rax]
mov edx, dword [0x141f2ef10]
or edx, dword [0x141f2ef14]
xor edx, 0x1001a42
or edx, 0xeeffe5b5
cmp edx, 0x73220b1c
jb 0x140018c30
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [str.wwSG_]
xor ecx, dword [0x141f2ef1c]
imul rcx, rcx, 0x696df18b
shr rcx, 0x3e
add ecx, 0xa4148fc3
cmp ecx, 0xd7b104f0
ja 0x140018c60
ret

Function at 0x140018c90
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0x2b97f889
lea rcx, [rdx + 1]
nop
mov r8d, dword [0x141f2ef20]
imul r8d, dword [0x141f2ef24]
add r8d, 0x8097d083
xor r8d, 0x2f000f39
cmp r8d, 0xcd90d1
jb 0x140018ca0
shr rcx, 8
mov r8, 0xfffffffffffffffe
sub r8, rdx
xor r8, rcx
mov rcx, r8
rol rcx, 2
xor ecx, r8d
movzx ecx, cx
add rax, rcx
nop word [rax + rax]
mov ecx, dword [0x141f2ef28]
and ecx, dword [0x141f2ef2c]
add ecx, 0x380b0d1d
xor ecx, 0x69855643
imul rcx, rcx, 0x1b9f85ab
shr rcx, 0x3c
cmp ecx, 0x4c52568e
ja 0x140018cf0
ret

Function at 0x140018d20
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x141f2ef30]
xor edx, edx
div dword [0x141f2ef34]
mov r9, 0xffffffffdff01324
sub r9, r8
mov r8, r9
rol r8, 4
nop word cs:[rax + rax]
mov eax, dword [0x141f2ef38]
imul eax, dword [0x141f2ef3c]
add eax, 0x7ab17980
xor eax, 0x72eae6e7
cmp eax, 0x3f72cd31
jb 0x140018d50
mov r10d, 0xc9b7da4d
nop word cs:[rax + rax]
mov eax, dword [0x141f2ef40]
xor edx, edx
div dword [0x141f2ef44]
and eax, 0xa3e40f00
imul eax, eax, 0x3c4357bb
mov rdx, rax
imul rdx, r10
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1c
cmp eax, 0x32e2500
ja 0x140018d80
xor r8d, r9d
movzx r8d, r8w
mov eax, dword [0x141f2ef48]
xor edx, edx
div dword [0x141f2ef4c]
add rcx, r8
nop dword [rax]
mov eax, dword [0x141f2ef50]
and eax, dword [0x141f2ef54]
imul eax, eax, 0x2167a3a
and eax, 0x32024422
cmp eax, 0xcaa86824
ja 0x140018dd0
mov rax, rcx
ret

Function at 0x140018e00
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
shr rax, 1
xor rax, rdx
xor rax, 0xffffffffa3b1e981
movabs r9, 0xd14ef8204f56cfc0
imul r9, rax
mov r8, r9
rol r8, 5
mov eax, dword [0x141f2ef58]
xor edx, edx
div dword [0x141f2ef5c]
nop word cs:[rax + rax]
mov eax, dword [0x141f2ef60]
or eax, dword [0x141f2ef64]
cmp eax, 0x9448df62
je 0x140018e40
xor r8d, r9d
and r8d, 0xffdf
add rcx, r8
mov eax, dword [0x141f2ef68]
xor eax, dword [str._o_k]
or eax, 0x404100
and eax, 0x30404d00
cmp eax, 0xa3a71f73
ja 0x140018e60
mov rax, rcx
ret
Function at 0x140018f70
Capabilities:
Encode data using xor

Disassembly:
not rdx
imul rdx, rdx, 0xffffffffbc8e8fdb
mov rax, rdx
shr rax, 0xd
xor rax, rdx
not rax
mov rdx, rax
rol rdx, 1
nop dword [rax]
mov r8d, dword [0x141f2ef88]
or r8d, dword [0x141f2ef8c]
imul r8d, r8d, 0x29d7b132
add r8d, 0xe8c218ea
cmp r8d, 0x1d44872e
jb 0x140018f90
xor edx, eax
movzx r9d, dx
mov eax, dword [0x141f2ef90]
xor edx, edx
div dword [0x141f2ef94]
mov r8d, 0xd50c871b
add rcx, r9
nop word cs:[rax + rax]
mov eax, dword [0x141f2ef98]
xor edx, edx
div dword [0x141f2ef9c]
xor eax, 0xc532b832
imul rax, r8
shr rax, 0x3f
add eax, 0x7d9975f1
cmp eax, 0x980b9c
jb 0x140018fe0
mov rax, rcx
ret

Function at 0x140019010
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
rol r8, 5
mov rax, rcx
xor r8, rdx
mov ecx, 0x9f9e7a91
add r8, 0x50c75ec5
mov rdx, r8
rol rdx, 1
xor rdx, r8
nop word cs:[rax + rax]
mov r8d, dword [0x141f2efa0]
or r8d, dword [0x141f2efa4]
add r8d, 0x59bedd8f
xor r8d, 0x52ecae1a
imul r8, rcx
shr r8, 0x3e
cmp r8d, 0xdf87d12c
ja 0x140019040
movzx ecx, dx
add rax, rcx
ret

Function at 0x140019080
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
xor r8, 0xffffffffab29cb00
nop word [rax + rax]
mov eax, dword [0x141f2efa8]
imul eax, dword [0x141f2efac]
add eax, 0x350af7fb
xor eax, 0x810862
or eax, 0xcb3e3119
cmp eax, 0xef8bdc93
je 0x140019090
mov eax, dword [0x141f2efb0]
xor edx, edx
div dword [0x141f2efb4]
add r8, 0x2f103cc3
nop dword [rax + rax]
mov eax, dword [0x141f2efb8]
add eax, dword [0x141f2efbc]
imul eax, eax, 0x57c2c025
cmp eax, 0xa7bf1b51
je 0x1400190d0
mov rax, r8
rol rax, 5
mov edx, dword [str.fvW0]
add edx, dword [0x141f2efc4]
or edx, 0xab5a49f2
xor edx, 0x90ef444d
add edx, 0xa063e173
cmp edx, 0x4bddafe9
ja 0x1400190f0
xor eax, r8d
movzx eax, ax
add rcx, rax
mov rax, rcx
ret

Function at 0x140019190
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
imul rcx, rdx, 0xffffffffd49b886d
mov rdx, rcx
rol rdx, 1
xor rdx, rcx
imul rcx, rdx, 0x6f7a6c34
xor edx, edx
nop dword [rax]
test dl, dl
jne 0x1400191b0
not rcx
mov rdx, rcx
rol rdx, 7
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141f2efc8]
xor ecx, dword [0x141f2efcc]
imul ecx, ecx, 0x60c95dfc
xor ecx, 0xca00a128
and ecx, 0xeadde938
cmp ecx, 0xd0ab0cdc
je 0x1400191d0
ret

Function at 0x140019200
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x141f2efd0]
xor edx, edx
div dword [0x141f2efd4]
mov rax, 0xffffffffdd256472
sub rax, r8
xor rax, 0x44198fa
imul rax, rax, 0xffffffffe86799cc
add rax, 0xffffffffe86799cc
nop
mov edx, dword [0x141f2efd8]
or edx, dword [0x141f2efdc]
xor edx, 0x8218c000
and edx, 0x8318c000
cmp edx, 0x26401432
jb 0x140019230
mov rdx, rax
rol rdx, 4
xor edx, eax
movzx eax, dx
add rcx, rax
nop
mov eax, dword [0x141f2efe0]
xor edx, edx
div dword [0x141f2efe4]
imul eax, eax, 0xe99c6696
add eax, 0xaa08504
cmp eax, 0x3deec660
ja 0x140019260
mov rax, rcx
ret
Function at 0x1400193d0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov r9, rdx
rol r9, 4
nop word [rax + rax]
mov eax, dword [0x141f2f000]
xor edx, edx
div dword [0x141f2f004]
or eax, 0x8e6b00a
imul eax, eax, 0x14267d58
and eax, 0x8543fd78
cmp eax, 0x1a508332
jb 0x1400193e0
xor r9, r8
mov rax, r9
rol rax, 1
xor rax, r9
mov r8, 0xffffffffbb77fe50
sub r8, rax
mov r9, r8
rol r9, 4
nop word cs:[rax + rax]
mov eax, dword [0x141f2f008]
xor edx, edx
div dword [0x141f2f00c]
xor eax, 0xb0538cf7
imul eax, eax, 0xbfc1c9a5
xor eax, 0xc47223c2
cmp eax, 0xf0e62f91
ja 0x140019430
xor r9d, r8d
movzx eax, r9w
add rcx, rax
mov rax, rcx
ret

Function at 0x140019560
Capabilities:
Encode data using xor

Disassembly:
dec rdx
mov rax, rdx
rol rax, 5
xor eax, edx
movzx eax, ax
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141f2f020]
xor ecx, dword [0x141f2f024]
or ecx, 0xa54b159b
and ecx, 0xa54bd79b
cmp ecx, 0x600464dc
jb 0x140019580
ret

Function at 0x1400195b0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
shr r8, 5
xor r8, rdx
nop word [rax + rax]
mov eax, dword [0x141f2f028]
xor edx, edx
div dword [0x141f2f02c]
and eax, 0x3d9e6ad3
cmp eax, 0xdc700ab6
je 0x1400195c0
neg r8
mov rax, r8
rol rax, 1
nop word cs:[rax + rax]
mov edx, dword [0x141f2f030]
add edx, dword [0x141f2f034]
imul edx, edx, 0x6cd5d3fe
imul rdx, rdx, 0x34437e3f
shr rdx, 0x3d
cmp edx, 0x2062e807
ja 0x1400195f0
xor eax, r8d
movzx eax, ax
add rcx, rax
nop
mov eax, dword [0x141f2f038]
sub eax, dword [0x141f2f03c]
imul eax, eax, 0x2e4964a6
xor eax, 0xafe0757b
imul rax, rax, 0x7737a9ad
shr rax, 0x3e
cmp eax, 0x1c11a27
ja 0x140019620
mov rax, rcx
ret

Function at 0x140019650
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
rol rcx, 1
xor rcx, rdx
add rcx, 0xffffffffd08089a1
mov rdx, rcx
shr rdx, 8
nop word [rax + rax]
mov r8d, dword [0x141f2f040]
xor r8d, dword [0x141f2f044]
or r8d, 0xa1cb2011
and r8d, 0xa1ef2c51
cmp r8d, 0x1eb09e27
je 0x140019670
xor rdx, rcx
mov rcx, rdx
rol rcx, 3
xor rcx, rdx
mov rdx, rcx
rol rdx, 6
nop dword [rax]
mov r8d, dword [0x141f2f048]
sub r8d, dword [0x141f2f04c]
imul r9, r8, 0x7977a47
shr r9, 0x20
sub r8d, r9d
shr r8d, 1
add r8d, r9d
shr r8d, 0x1e
imul r8d, r8d, 0x13cabb71
add r8d, 0x49e1c977
cmp r8d, 0x673ce606
ja 0x1400196b0
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141f2f050]
add ecx, dword [0x141f2f054]
or ecx, 0x110008a
and ecx, 0xb15594aa
xor ecx, 0x5fa19a27
cmp ecx, 0x1ef5d76a
jb 0x140019700
ret

Function at 0x1400198f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
shr rcx, 0x1c
xor r8d, r8d
nop dword [rax]
test r8b, r8b
jne 0x140019900
xor rcx, rdx
mov rdx, rcx
xor rdx, 0xc48577c
rol rdx, 7
nop word cs:[rax + rax]
mov r8d, dword [0x141f2f088]
xor r8d, dword [0x141f2f08c]
add r8d, 0x25b00296
or r8d, 0xa6ef2091
add r8d, 0x1e7f0e08
cmp r8d, 0x2b9b4a30
jb 0x140019920
xor rcx, rdx
xor rcx, 0xffffffffa853c8e8
mov rdx, rcx
rol rdx, 3
nop dword [rax]
mov r8d, dword [0x141f2f090]
and r8d, dword [0x141f2f094]
add r8d, 0x47c23f0
cmp r8d, 0xaed5db27
ja 0x140019960
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret
Function at 0x140019990
Capabilities:
Encode data using xor

Disassembly:
add rdx, 0xfffffffff5800b0a
mov rax, rdx
rol rax, 1
xor eax, edx
movzx eax, ax
add rax, rcx
mov ecx, 0x996d6841
nop word [rax + rax]
mov edx, dword [0x141f2f098]
xor edx, dword [0x141f2f09c]
add edx, 0x1edb690
mov r8, rdx
imul r8, rcx
shr r8, 0x20
sub edx, r8d
shr edx, 1
add edx, r8d
shr edx, 0x1d
cmp edx, 0x86e9076c
je 0x1400199b0
ret

Function at 0x1400199f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, 0x9b7cd65
sub rcx, rdx
xor rcx, 0x10d50ce3
nop word cs:[rax + rax]
mov edx, dword [0x141f2f0a0]
and edx, dword [0x141f2f0a4]
imul rdx, rdx, 0x1f2490e7
shr rdx, 0x3c
add edx, 0x1a1a12eb
cmp edx, 0xf6086db3
ja 0x140019a10
inc rcx
nop dword [rax + rax]
mov edx, dword [0x141f2f0a8]
or edx, dword [0x141f2f0ac]
or edx, 0x947a0004
and edx, 0xfe7e81c4
xor edx, 0x5450e6a0
cmp edx, 0xd07f321a
ja 0x140019a40
mov rdx, rcx
rol rdx, 1
nop dword [rax]
mov r8d, dword [0x141f2f0b0]
imul r8d, dword [0x141f2f0b4]
xor r8d, 0x254a002f
or r8d, 0x90a1f3d0
add r8d, 0x2a569b85
cmp r8d, 0x7cf4ed7b
jb 0x140019a70
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x140019b10
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
movabs r8, 0x8374e49e7ce09cb6
imul r8, rdx
movabs rcx, 0xca77056831ad7e3a
add rcx, r8
mov rdx, rcx
rol rdx, 3
nop word cs:[rax + rax]
mov r8d, dword [0x141f2f0c0]
imul r8d, dword [0x141f2f0c4]
xor r8d, 0x53dc8344
and r8d, 0x57df9f45
cmp r8d, 0xb79d7e28
ja 0x140019b40
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x140019b70
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0xffffffff84c3cabd
mov rax, rcx
add rdx, 0x497e8e31
mov rcx, rdx
rol rcx, 4
xor rcx, rdx
nop dword [rax + rax]
mov edx, dword [0x141f2f0c8]
or edx, dword [0x141f2f0cc]
and edx, 0x204140
or edx, 0xdf5fb6a7
xor edx, 0x1f2ae150
cmp edx, 0xce33224b
ja 0x140019b90
movzx ecx, cx
add rax, rcx
ret

Function at 0x140019cb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x65f74598
sub rax, rdx
imul rax, rax, 0x48a9ee26
add rax, 0x4c4f2400
mov rdx, rax
rol rdx, 2
xor edx, eax
movzx eax, dx
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141f2f0e0]
xor ecx, dword [0x141f2f0e4]
add ecx, 0xcc738c03
xor ecx, 0x30089
and ecx, 0x81538a99
cmp ecx, 0xc36d1790
ja 0x140019ce0
ret

Function at 0x140019e10
Capabilities:
Encode data using xor

Disassembly:
add rdx, 0x1c7176cb
mov r8, rdx
rol r8, 6
xor r8, rdx
mov eax, dword [0x141f2f108]
xor edx, edx
div dword [0x141f2f10c]
movzx eax, r8w
nop word cs:[rax + rax]
mov edx, dword [0x141f2f110]
xor edx, dword [0x141f2f114]
add edx, 0x23b7e2c3
or edx, 0x2606362b
add edx, 0x42ade44c
cmp edx, 0x700968ca
ja 0x140019e40
add rcx, rax
nop dword [rax]
mov eax, dword [0x141f2f118]
xor edx, edx
div dword [0x141f2f11c]
add eax, 0xf97bef5e
or eax, 0xfbff6dff
cmp eax, 0xad707676
jb 0x140019e70
mov rax, rcx
ret
Function at 0x140019f20
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
shr rcx, 2
nop word [rax + rax]
mov r8d, dword [0x141f2f130]
imul r8d, dword [0x141f2f134]
add r8d, 0x572d9c9d
and r8d, 0x905b3ec7
add r8d, 0x44028d6c
cmp r8d, 0x1cb07dec
jb 0x140019f30
xor rcx, rdx
imul rcx, rcx, 0x73c5c8e8
add rcx, 0x1f3e11f8
mov rdx, rcx
rol rdx, 1
xor edx, ecx
and edx, 0xfff9
add rax, rdx
nop
mov ecx, dword [0x141f2f138]
sub ecx, dword [0x141f2f13c]
xor ecx, 0x5e7cf135
add ecx, 0xc5568861
cmp ecx, 0x8ee78661
jb 0x140019f80
ret

Function at 0x14001a030
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
shr rax, 0xf
xor rax, rdx
imul rax, rax, 0x2b930655
not rax
mov r8, rax
rol r8, 4
xor r8, rax
mov r9, r8
rol r9, 1
nop word cs:[rax + rax]
mov eax, dword [0x141f2f148]
xor edx, edx
div dword [0x141f2f14c]
xor eax, 0x86083552
add eax, 0x89a6112b
cmp eax, 0xbdd399d7
ja 0x14001a060
xor r9d, r8d
movzx eax, r9w
add rcx, rax
mov rax, rcx
ret

Function at 0x14001a0c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
imul rcx, rdx, 0xffffffffca74b4ca
add rcx, 0xffffffffba3a17cc
nop word cs:[rax + rax]
mov edx, dword [0x141f2f150]
xor edx, dword [0x141f2f154]
imul edx, edx, 0x2af0a9d4
cmp edx, 0xaf8c9b9b
je 0x14001a0e0
mov rdx, rcx
rol rdx, 1
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x14001a110
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0x6507d0ab
add rdx, 0x70382c0f
mov rax, rdx
shr rax, 0x14
xor rax, rdx
mov rdx, rax
rol rdx, 3
xor edx, eax
movzx eax, dx
add rax, rcx
nop word [rax + rax]
mov ecx, dword [0x141f2f158]
sub ecx, dword [0x141f2f15c]
imul ecx, ecx, 0xa8dcec3a
xor ecx, 0x4329228c
imul ecx, ecx, 0x9201c014
cmp ecx, 0x843a972
jb 0x14001a140
ret

Function at 0x14001a220
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
not rdx
mov rcx, rdx
shr rcx, 0xe
xor rcx, rdx
mov rdx, rcx
shr rdx, 6
xor rdx, rcx
imul rdx, rdx, 0xc197ff8
mov rcx, rdx
rol rcx, 5
nop dword [rax + rax]
mov r8d, dword [0x141f2f178]
add r8d, dword [0x141f2f17c]
xor r8d, 0xc0b902b0
and r8d, 0xe0bf3ab5
xor r8d, 0x7e585a8b
cmp r8d, 0x9263c016
ja 0x14001a250
mov r8d, 0xbb4efe87
xor rcx, rdx
nop word cs:[rax + rax]
mov edx, dword [0x141f2f180]
imul edx, dword [0x141f2f184]
or edx, 0x9ff16f7a
imul rdx, r8
shr rdx, 0x3e
cmp edx, 0x5cba6394
ja 0x14001a290
movzx ecx, cx
add rax, rcx
ret

Function at 0x14001a390
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
shr rax, 1
xor rax, rdx
mov rdx, rax
rol rdx, 1
xor rdx, rax
mov rax, rdx
rol rax, 7
xor rax, rdx
xor edx, edx
nop
test dl, dl
jne 0x14001a3b0
neg rax
mov rdx, rax
rol rdx, 1
xor edx, eax
movzx eax, dx
add rcx, rax
nop word cs:[rax + rax]
mov eax, dword [0x141f2f198]
xor edx, edx
div dword [0x141f2f19c]
or eax, 0x810104
xor eax, 0x141001
and eax, 0x6955d05
cmp eax, 0xa6ddc494
ja 0x14001a3d0
mov rax, rcx
ret
Function at 0x14001a400
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
add rdx, 0x148d8bce
xor rdx, 0xffffffffe664e7bc
mov rcx, rdx
shr rcx, 0xc
xor rcx, rdx
mov rdx, rcx
rol rdx, 6
nop word cs:[rax + rax]
mov r8d, dword [0x141f2f1a0]
xor r8d, dword [0x141f2f1a4]
add r8d, 0xb6c308f
or r8d, 0x126759
add r8d, 0xd583fee8
cmp r8d, 0x4b2312ee
jb 0x14001a430
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x14001a470
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov r8d, 0xd665906b
imul rcx, rdx, 0x453ae6f4
mov edx, dword [0x141f2f1a8]
sub edx, dword [0x141f2f1ac]
imul rdx, r8
shr rdx, 0x3e
cmp edx, 0xa5b7c5f0
je 0x14001a480
movabs rdx, 0xfb965f3898a3b320
add rcx, rdx
mov rdx, rcx
shr rdx, 0x14
xor rdx, rcx
mov rcx, rdx
rol rcx, 2
xor ecx, edx
movzx ecx, cx
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141f2f1b0]
sub ecx, dword [str.rY1_b]
xor ecx, 0x1888404
and ecx, 0x81c8e42c
cmp ecx, 0xc62f56d5
ja 0x14001a4d0
ret

Function at 0x14001a5b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
add rdx, 0x18a4af63
mov r8, rdx
shr r8, 0x1b
xor r8, rdx
mov rcx, 0xffffffffb04652f4
sub rcx, r8
mov rdx, rcx
rol rdx, 4
nop word cs:[rax + rax]
mov r8d, dword [0x141f2f1c0]
and r8d, dword [0x141f2f1c4]
add r8d, 0x8cb59e69
or r8d, 0xbb5fafcd
cmp r8d, 0xd62dc3ad
je 0x14001a5e0
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop dword [rax]
mov ecx, dword [0x141f2f1c8]
xor ecx, dword [0x141f2f1cc]
add ecx, 0x6e3116a
cmp ecx, 0xc4ce4bed
ja 0x14001a610
nop word [rax + rax]
mov ecx, dword [0x141f2f1d0]
sub ecx, dword [0x141f2f1d4]
add ecx, 0xef5342c4
imul rcx, rcx, 0x5940f08f
shr rcx, 0x3e
cmp ecx, 0xdff8b99
je 0x14001a630
ret

Function at 0x14001a7c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
not rcx
mov r8, rcx
rol r8, 1
xor rcx, r8
shr rcx, 5
xor rcx, rdx
xor rcx, r8
mov rdx, rcx
rol rdx, 5
nop word cs:[rax + rax]
mov r8d, dword [0x141f2f1f8]
imul r8d, dword [0x141f2f1fc]
xor r8d, 0x2100
or r8d, 0xeedddefd
cmp r8d, 0x5f626741
jb 0x14001a7f0
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop
mov ecx, dword [0x141f2f200]
xor ecx, dword [str.PeE]
and ecx, 0x9dafd186
imul ecx, ecx, 0x476a0ca0
add ecx, 0xec69ed07
cmp ecx, 0xe7d9bb86
ja 0x14001a820
ret

Function at 0x14001a850
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
not rax
rol rax, 4
xor rax, rdx
mov rdx, rax
shr rdx, 1
xor rdx, rax
mov rax, rdx
rol rax, 7
xor rax, rdx
mov edx, dword [0x141f2f208]
xor edx, dword [0x141f2f20c]
add edx, 0x26338f58
imul rdx, rdx, 0x5b3b8469
shr rdx, 0x3d
add edx, 0x80df5f35
cmp edx, 0xc4e5c69f
ja 0x14001a870
movzx eax, ax
add rcx, rax
nop word cs:[rax + rax]
mov eax, dword [0x141f2f210]
xor edx, edx
div dword [0x141f2f214]
imul eax, eax, 0xd714a588
add eax, 0x61d0f938
cmp eax, 0x9a5e5b2a
ja 0x14001a8b0
mov rax, rcx
ret
Function at 0x14001a9c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, 0xffffffff8adfc54d
sub rax, rdx
nop word [rax + rax]
mov edx, dword [0x141f2f230]
or edx, dword [0x141f2f234]
imul edx, edx, 0xed759b60
add edx, 0x9b1da9c0
xor edx, 0x93bd9ddd
cmp edx, 0x94f66871
ja 0x14001a9d0
imul r8, rax, 0x464ed3db
nop dword [rax]
mov eax, dword [0x141f2f238]
xor edx, edx
div dword [0x141f2f23c]
imul rdx, rax, 0xea56a8f
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
or eax, 0xc7840352
cmp eax, 0x480b377d
jb 0x14001aa00
not r8
mov rax, r8
rol rax, 2
xor eax, r8d
movzx eax, ax
add rcx, rax
mov rax, rcx
ret

Function at 0x14001aa50
Capabilities:
Encode data using xor

Disassembly:
neg rdx
xor rdx, 0x2c13b64f
mov rax, rdx
rol rax, 1
xor eax, edx
movzx eax, ax
add rax, rcx
nop dword [rax + rax]
mov ecx, dword [0x141f2f240]
xor ecx, dword [0x141f2f244]
add ecx, 0xa24ca163
xor ecx, 0xa0ba433e
imul ecx, ecx, 0x9868876e
cmp ecx, 0x981fec11
jb 0x14001aa70
ret

Function at 0x14001aad0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, 0x5d081d2d
sub rcx, rdx
mov rdx, rcx
shr rdx, 0x14
xor rdx, rcx
imul rcx, rdx, 0xffffffff90b9a0b9
add rcx, 0x11fb624e
mov rdx, rcx
rol rdx, 2
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141f2f248]
xor ecx, dword [0x141f2f24c]
imul ecx, ecx, 0x901e3a40
cmp ecx, 0x4844111e
jb 0x14001ab10
ret

Function at 0x14001ab30
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
shr r8, 7
xor r8, rdx
mov rdx, r8
rol rdx, 5
mov rax, rcx
xor rdx, r8
mov ecx, 0x5a84158
sub rcx, rdx
imul rdx, rcx, 0x2ac3b780
mov rcx, rdx
rol rcx, 1
nop dword [rax]
mov r8d, dword [0x141f2f250]
add r8d, dword [0x141f2f254]
or r8d, 0x22e2cc5
imul r8d, r8d, 0xf618624
xor r8d, 0x541b0e2f
cmp r8d, 0xf5ece087
ja 0x14001ab60
xor ecx, edx
and ecx, 0xff81
add rax, rcx
ret

Function at 0x14001ae40
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, 0x69874d36
sub rcx, rdx
mov rdx, rcx
shr rdx, 4
xor rdx, rcx
mov r8, rdx
shr r8, 0x18
xor r8, rdx
mov rcx, r8
rol rcx, 5
xor rcx, r8
nop dword [rax]
mov edx, dword [0x141f2f290]
add edx, dword [0x141f2f294]
and edx, 0x2ba5b022
add edx, 0x3a0d7bac
xor edx, 0x399f1f6
cmp edx, 0xc2126fef
ja 0x14001ae70
movzx ecx, cx
add rax, rcx
nop dword [rax]
mov ecx, dword [0x141f2f298]
sub ecx, dword [0x141f2f29c]
xor ecx, 0x63b62181
add ecx, 0x5d551448
cmp ecx, 0x4c9dc7e2
jb 0x14001aea0
ret
Function at 0x14003b1f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov eax, 0x90eb9147
nop
mov ecx, dword [0x141f32168]
imul ecx, dword [0x141f3216c]
or ecx, 0x462e207e
xor ecx, 0x25f13398
shr ecx, 1
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0x2a67cef5
ja 0x14003b200
cmp rdx, 0x11
jb 0x14003b294
mov eax, dword [0x141f32170]
xor edx, edx
div dword [0x141f32174]
nop
mov eax, dword [0x141f32178]
and eax, dword [0x141f3217c]
and eax, 0x20222286
imul eax, eax, 0x610b4454
cmp eax, 0xddb22579
ja 0x14003b240
mov rsi, qword [rsi - 8]
nop word cs:[rax + rax]
mov eax, dword [0x141f32180]
xor edx, edx
div dword [0x141f32184]
add eax, 0xf7728163
and eax, 0x266dba92
add eax, 0x803a7a00
cmp eax, 0x92a34780
jb 0x14003b270
mov eax, dword [0x141f32188]
imul eax, dword [0x141f3218c]
add eax, 0x1e4ee228
imul rax, rax, 0x3a1c28c3
shr rax, 0x3c
cmp eax, 0xb999f730
je 0x14003b2e4
mov edi, dword [0x141f32190]
and edi, dword [0x141f32194]
and edi, 0x60000422
mov rcx, qword [0x141f49060]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp edi, 0xf36b9b0d
jne 0x14003b2f8
mov rcx, qword [0x141f49060]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14003b2b8
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14003b300
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rax, r8
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [r8 + 8]
xor edx, edx
nop word cs:[rax + rax]
test dl, dl
jne 0x14003b320
test rcx, rcx
je 0x14003b401
nop dword [rax]
mov ecx, dword [0x141f321f8]
or ecx, dword [0x141f321fc]
and ecx, 0xb4148eee
imul rcx, rcx, 0x2b1594e9
shr rcx, 0x39
or ecx, 0x821800ce
cmp ecx, 0x24de7a5c
jb 0x14003b330
mov r8, qword [rax]
mov rax, qword [rax + 0x10]
nop word cs:[rax + rax]
mov ecx, dword [0x141f32200]
sub ecx, dword [0x141f32204]
xor ecx, 0x2ca16084
and ecx, 0x3ce362c4
cmp ecx, 0x735c7975
ja 0x14003b370
test rax, rax
je 0x14003b45d
mov eax, dword [0x141f32208]
xor eax, dword [0x141f3220c]
and eax, 0xdf623704
imul rax, rax, 0x4bc643b
shr rax, 0x36
and eax, 0xd
cmp eax, 0xcdabca92
jne 0x14003b3d0
mov rax, qword [0x141f49060]
nop word cs:[rax + rax]
mov eax, dword [str.R_Ie]
and eax, dword [0x141f32214]
and eax, 0x8400105
add eax, 0xfcd74b32
mov rcx, qword [0x141f49060]
cmp eax, 0xbb9abfcc
jb 0x14003b3d0
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x14003b46e
xor eax, eax
test al, al
je 0x14003b40e
movzx eax, byte [0x141f49078]
xor eax, eax
movzx ecx, byte [0x141f49078]
test al, al
jne 0x14003b410
xor ecx, ecx
mov rdx, rsi
call fcn.1400c6170
nop word cs:[rax + rax]
mov ecx, dword [0x141f32218]
sub ecx, dword [0x141f3221c]
imul ecx, ecx, 0x39d40b3f
add ecx, 0x29e3e21e
imul rcx, rcx, 0x1c72e687
shr rcx, 0x3c
cmp ecx, 0x513a0e18
ja 0x14003b430
jmp 0x14003b46e
movzx eax, byte [0x141f49078]
xor ecx, ecx
mov rdx, rsi
call fcn.1400c6170
mov ecx, dword [0x141f32220]
sub ecx, dword [0x141f32224]
add ecx, 0xe7fd3c52
imul rdx, rcx, 0x2d3535c1
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1f
imul ecx, ecx, 0xf3c32da6
cmp ecx, 0xe555c813
jbe 0x14003b4be
xor ecx, ecx
test rax, rax
mov edx, 1
cmovne rdx, rax
sete cl
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rsi
mov qword [rdi], rcx
mov ecx, 1
nop word cs:[rax + rax]
mov edx, dword [0x141f32228]
add edx, dword [0x141f3222c]
xor edx, 0xc62ec3fc
add edx, 0x3451b098
imul rdx, rdx, 0x1fdbb05d
shr rdx, 0x3a
xor r8d, r8d
test rax, rax
sete r8b
mov r9, rax
cmove r9, rcx
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], rsi
mov qword [rdi], r8
cmp edx, 0x5401027
ja 0x14003b4d0
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140045550
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test al, al
je 0x14004555b
xor ecx, ecx
xgetbv
xor ecx, ecx
nop dword [rax]
mov eax, dword [0x141f32da8]
or eax, dword [0x141f32dac]
xor eax, 0x27c58c25
imul r8d, eax, 0x1dbd9475
or r8d, 0x136c6bff
xgetbv
cmp r8d, 0x74384de9
je 0x140045560
shl rdx, 0x20
or rax, rdx
nop word cs:[rax + rax]
mov ecx, dword [0x141f32db0]
imul ecx, dword [0x141f32db4]
imul ecx, ecx, 0xf3565b11
and ecx, 0x344b377b
add ecx, 0xd4320e96
cmp ecx, 0xfa989d3e
ja 0x1400455a0
ret