joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14013f8f0
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401dd828]
mov r8d, dword [0x1401dd82c]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
mov r9d, 0x7755cec5
xor r9d, 0x88aa313a
xor ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xb9244748
xor ecx, 0xb9244748
mov edx, 0x1cc01d75
xor edx, 0x6f32a8c6
sub ecx, edx
add eax, ecx
and eax, 0x208a639d
imul eax, eax, 0x9afe7a1d
cmp eax, 0xf7d94f0a
ja 0x14013fa2b
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401dd830]
xor eax, 0x46212c0e
mov r8d, dword [0x1401dd834]
mov edx, 0x1fca5d44
xor edx, 0x25bd61e6
xor r8d, edx
xor edx, edx
div r8d
mov edx, eax
and edx, 0xff06c9a
xor edx, 0xffffffff
and eax, 0xff06c9a
xor eax, 0xffffffff
mov r8d, 0xc706bc0b
xor r8d, 0x38f943f4
xor edx, r8d
mov r8d, 0xac0c980c
xor r8d, 0x53f367f3
xor eax, r8d
or edx, eax
mov r8d, 0xffffffff
xor r8d, 0xa6a91291
mov eax, edx
xor eax, r8d
and eax, edx
mov edx, 0x87f3e03b
xor edx, 0x87f3e03b
mov r8d, 0xbcdf5d65
xor r8d, 0xfdf655fc
sub edx, r8d
add eax, edx
mov dword [rsp + 0x2c], eax
movabs rdx, 0x66882fb7f72b66d7
movabs rax, 0x66882fb7f72b66ff
xor rdx, rax
call fcn.14011bd00
mov eax, dword [rsp + 0x2c]
cmp eax, 0x27819af6
jb 0x14013f967
add rsp, 0x38
ret
mov ebx, dword [0x173fd9e88]
invalid
Function at 0x14014b280
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x14014b2f2
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
movabs rdx, 0xc61349bdd990ccb
movabs rax, 0x4c61349bdd990ccb
xor rdx, rax
movabs rax, 0x17a6d6b078cabc78
movabs r8, 0xe859294f87354387
xor rax, r8
xor rdx, rax
mov rax, rcx
xor rax, rdx
and rax, rcx
cmp rax, 0
je 0x14014b2f2
mov rcx, qword [rsp + 0x28]
call fcn.140014d00
mov eax, dword [0x1401ddd88]
mov edx, dword [0x1401ddd8c]
mov ecx, 0xe2bd1e4b
xor ecx, 0xe2bd1e4b
sub ecx, edx
sub eax, ecx
imul eax, eax, 0xfbd48959
mov ecx, 0x56d15323
xor ecx, 0xe213c9f6
imul eax, ecx
xor eax, 0x8c732217
mov ecx, 0x78719486
xor ecx, 0xd4b44038
cmp eax, ecx
je 0x14014b384
mov eax, dword [0x1401ddd90]
imul eax, dword [0x1401ddd94]
sub eax, 0xafe3cad4
sub eax, 0x1b4e5dad
mov ecx, 0xc05fde32
xor ecx, 0x6fbc14e6
add eax, ecx
add eax, 0xb1ff4687
xor ecx, ecx
sub ecx, 0x158741d2
sub eax, ecx
mov ecx, 0xa684b264
xor ecx, 0x83c4e519
cmp eax, ecx
jbe 0x14014b339
add rsp, 0x38
ret
invalid
Function at 0x14014c5b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
call fcn.14014b560
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx]
call fcn.14014b680
test al, 1
jne 0x14014c5e2
jmp 0x14014c712
mov eax, dword [0x1401dde28]
xor eax, dword [0x1401dde2c]
mov ecx, 0x699e8be2
xor ecx, 0x9661741d
mov edx, eax
xor edx, ecx
and edx, 0x51d3a77
mov r8d, 0xffffffff
xor r8d, 0x51d3a77
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x51d3a77
or eax, 0x51d3a77
imul eax, edx
add eax, ecx
mov ecx, 0x9d2ae255
xor ecx, 0xf4f95b7f
imul eax, ecx
sub eax, 0xbe00c07c
cmp eax, 0x17fe328d
jb 0x14014c7aa
mov rax, qword [rsp + 0x38]
mov ecx, dword [0x1401dde30]
xor ecx, 0x9c18d482
mov r9d, dword [0x1401dde34]
mov edx, ecx
xor edx, 0xffffffff
mov r8d, r9d
and r8d, edx
mov r10d, r9d
xor r10d, 0xffffffff
mov edx, ecx
and edx, r10d
imul edx, r8d
mov r8d, ecx
and r8d, r9d
or ecx, r9d
imul ecx, r8d
add ecx, edx
mov edx, 0x88163709
xor edx, 0x5152bf0e
xor ecx, edx
or ecx, ecx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x327a58da
mov r8d, 0xffffffff
xor r8d, 0x327a58da
and edx, r8d
xor ecx, 0xffffffff
xor edx, 0xffffffff
and ecx, edx
sub ecx, 0x69c45942
mov dword [rsp + 0x28], ecx
mov rcx, qword [rax]
call fcn.14014c2d0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x28]
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x26aa541b
je 0x14014c7aa
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x14014c700
jmp 0x14014c7a5
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
mov edx, 8
call fcn.14000eb78
mov eax, dword [0x1401dde38]
xor edx, edx
div dword [0x1401dde3c]
mov ecx, eax
mov eax, ecx
and eax, 0xd5a341df
or ecx, 0xd5a341df
add eax, ecx
mov ecx, 0xc22f4ef3
xor ecx, 0xa930899e
imul eax, ecx
sub eax, 0x33648569
cmp eax, 0xf81621a8
je 0x14014c7b3
mov r8, qword [rsp + 0x30]
mov eax, dword [0x1401dde40]
mov ecx, dword [0x1401dde44]
xor ecx, 0xfc8299f4
or eax, ecx
mov ecx, 0xba9f098b
xor ecx, 0xe6043870
xor edx, edx
div ecx
mov ecx, 0x877d89cd
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x38]
xor eax, 0xfed3e02e
mov ecx, 0xf79290ca
xor ecx, 0x4b96fcc1
mov qword [rdx], r8
cmp eax, ecx
jb 0x14014c74f
jmp 0x14014c7a5
add rsp, 0x48
ret
invalid
xchg ecx, eax
movabs dword [0xfffffff93e94bc5], eax
invalid
Function at 0x140163800
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x1178
call fcn.1401d4340
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10e8], rdx
mov qword [rbp + 0x10f0], rcx
mov eax, dword [0x1401de828]
imul eax, dword [0x1401de82c]
mov ecx, eax
xor ecx, 0xb0d85250
mov edx, 0x593d9866
xor edx, 0xa6c26799
xor ecx, edx
and ecx, 0xb0d85250
shl ecx, 1
mov edx, 0x852d6ba3

Function at 0x14016f730
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x1401ded68]
add ecx, dword [0x1401ded6c]
mov edx, 0xffffffff
xor edx, 0xb60a8cca
mov eax, ecx
and eax, edx
mov edx, ecx
xor edx, 0xb60a8cca
add ecx, edx
sub ecx, eax
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x12e04cf6
mov edx, 0xffffffff
xor edx, 0x12e04cf6
or ecx, edx
mov edx, 0x51c99493
xor edx, 0xae366b6c
xor eax, edx
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0x15bd7caf
cmp eax, 0x91274378
jbe 0x14016f7f0
mov eax, dword [0x1401ded70]
xor eax, 0xd9237eb6
xor edx, edx
div dword [0x1401ded74]
and eax, 0x25786ea6
sub eax, 0x1eb6ab27
imul eax, eax, 0x6e4d4e8
mov dword [rsp + 0x2c], eax
call fcn.14016fee6
mov rcx, rax
mov eax, dword [rsp + 0x2c]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x30], rcx
cmp eax, 0x79667e38
jbe 0x14016f79f
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
insb byte [rdi], dx
cmp byte [rdi - 0x5916a1], ah
invalid
Function at 0x14016ff60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rcx
add rcx, 8
mov qword [rsp + 0x48], rcx
xor eax, eax
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov qword [rsp + 0x38], rdx
cmp rax, rcx
jge 0x1401700bd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.1401701d0
test al, 1
jne 0x14016ffc2
jmp 0x14016fff5
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.14016ff2c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
mov edx, 8
call fcn.14000eb78
mov eax, dword [0x1401dedb8]
mov edx, dword [0x1401dedbc]
xor ecx, ecx
sub ecx, edx
add eax, ecx
or eax, 0x914e4c0
mov ecx, 0xca49ddc8
xor ecx, 0x23e87514
sub eax, ecx
mov ecx, 0xc7eb3d7a
xor edx, edx
div ecx
cmp eax, 0xfc018bde
je 0x1401701ba
mov r8, qword [rsp + 0x30]
mov eax, dword [0x1401dedc0]
mov r9d, dword [0x1401dedc4]
mov r10d, r9d
xor r10d, 0xffffffff
mov edx, eax
and edx, r10d
mov ecx, eax
or ecx, r10d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r9d
or eax, r9d
imul eax, edx
add eax, ecx
imul eax, eax, 0x33c8c91c
sub eax, 0xfe9d637e
mov ecx, 0x323936ea
xor ecx, 0x323936ea
sub ecx, eax
xor eax, eax
sub eax, 0xc8a0d06b
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, 0x9730294c
xor ecx, 0xbc17c339
mov rdx, r8
and rdx, 1
or r8, 1
add rdx, r8
mov qword [rsp + 0x28], rdx
cmp eax, ecx
jb 0x14017002d
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
jmp 0x14016ff79
mov rax, qword [rsp + 0x38]
cmp rax, 0
je 0x1401701b5
mov eax, dword [0x1401dedc8]
mov ecx, 0x66fdb4aa
xor ecx, 0x96b0da3
xor eax, ecx
xor edx, edx
div dword [0x1401dedcc]
mov ecx, eax
or ecx, 0x8e067a41
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 0x861c1d9e
add eax, ecx
mov ecx, 0x4e539f46
xor ecx, 0x4e539f46
sub ecx, eax
mov eax, ecx
and eax, 0x9223d9ff
mov edx, 0x31c23f2b
xor edx, 0xa3e1e6d4
or ecx, edx
add eax, ecx
cmp eax, 0xf3efc802
ja 0x1401701c3
mov rcx, qword [rsp + 0x38]
mov edx, dword [0x1401dedd0]
mov eax, 0x2a1d46ab
xor eax, 0xdc87fd3c
xor edx, eax
sub edx, dword [0x1401dedd4]
mov eax, 0x1c6ea1ed
xor eax, 0xcae9a6ff
add edx, eax
add edx, 0x15daa0b7
mov eax, 0xea2f9121
xor eax, 0xb06d966f
add edx, eax
mov eax, 0xe57813ff
xor eax, 0xf0a2b348
sub edx, eax
mov r8d, 0x215efa69
xor r8d, 0x214a9bc2
mov eax, 0x1a2f41a4
xor eax, 0xe5d0be5b
xor r8d, eax
mov eax, edx
xor eax, r8d
and eax, edx
mov dword [rsp + 0x24], eax
mov edx, 8
call fcn.14000eb33
mov eax, dword [rsp + 0x24]
cmp eax, 0x81c50afe
jae 0x14017012b
jmp 0x1401701b5
add rsp, 0x58
ret
call qword [rdi - 0x40]
shr cl, 1
push 0xfffffffffffffffe
invalid
adc al, 0xfe
cmp eax, 0xff5fe9da
invalid
Function at 0x140171f40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.1401719d5
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.1401719f0
test al, 1
jne 0x140171f6a
jmp 0x140172074
mov ecx, dword [0x1401deee0]
xor ecx, 0xf4aa1b23
sub ecx, dword [0x1401deee4]
mov eax, ecx
and eax, 0xdfbeca1e
xor ecx, 0xdfbeca1e
or eax, ecx
mov ecx, 0xcc9e6c91
xor ecx, 0x40c4bb7
add eax, ecx
mov ecx, 0xe4d7df63
xor ecx, 0x5d8dd053
sub eax, ecx
mov ecx, 0xa8d8ebca
xor ecx, 0xeaf613f
cmp eax, ecx
ja 0x14017207a
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401deee8]
mov edx, dword [0x1401deeec]
mov r8d, 0x735213f7
xor r8d, 0x8cadec08
xor edx, r8d
mov r8d, 0xc02da179
xor r8d, 0xc02da179
mov r9d, 0x261a3f8e
xor r9d, 0x261a3f8f
sub r8d, r9d
sub edx, r8d
sub eax, edx
mov edx, 0x5bf80142
xor edx, 0x7b70b80f
add eax, edx
mov edx, 0xda24e403
xor edx, 0x590c3982
sub eax, edx
sub eax, 0x2088b94d
mov edx, 0xdce6de8d
xor edx, 0xf0c4ddcf
imul eax, edx
or eax, 0xd9dfd5d1
mov dword [rsp + 0x20], eax
call fcn.140171dc0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x20]
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x27], cl
cmp eax, 0x9d7e8bd2
jb 0x140171fb8
mov al, byte [rsp + 0x27]
test al, 1
jne 0x140172065
jmp 0x140172074
mov rcx, qword [rsp + 0x28]
mov edx, 8
call fcn.14000eb78
nop
add rsp, 0x38
ret
invalid
Function at 0x14018b170
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov ecx, dword [0x1401df948]
xor ecx, 0x6bb66c4a
mov edx, dword [0x1401df94c]
xor edx, 0xa4937032
mov eax, ecx
or eax, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
xor edx, 0xffffffff
and ecx, edx
xor eax, 0xffffffff
mov edx, 0x9f913603
xor edx, 0x606ec9fc
xor ecx, edx
and eax, ecx
xor eax, 0xc6e4492b
mov edx, 0xb1bc7ba4
xor edx, 0x4e43845b
mov ecx, eax
xor ecx, edx
mov edx, 0x4f8442b6
xor edx, 0x9d62c33e
and edx, ecx
mov r8d, 0xffffffff
xor r8d, 0xd2e68188
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xd2e68188
or eax, 0xd2e68188
imul eax, edx
add eax, ecx
mov ecx, 0x9df5f45
xor ecx, 0xa5218e38
sub eax, ecx
cmp eax, 0x59380dbf
jbe 0x14018b3a7
mov rax, qword [rsp + 0x40]
mov ecx, dword [0x1401df950]
xor ecx, dword [0x1401df954]
imul ecx, ecx, 0x96ae3ef0
imul ecx, ecx, 0xf9c55255
mov edx, 0xde7ef3b
xor edx, 0x34c82a7
and ecx, edx
mov dword [rsp + 0x2c], ecx
mov rcx, qword [rax]
mov r8d, 2
mov rax, rcx
cqo
idiv r8
mov r8, rax
mov eax, dword [rsp + 0x2c]
movabs r9, 0xe92c8fadac0db3cb
movabs rdx, 0x16d3705253f24c34
xor r9, rdx
mov rdx, r8
add rdx, r9
mov qword [rsp + 0x30], rdx
xor rdx, r8
movabs r8, 0x88c52c3e2ba48de3
movabs r9, 0x88c52c3e2ba48de3
xor r8, r9
cmp rdx, r8
setl r8b
cmp rcx, 1
setg dl
mov cl, dl
and cl, r8b
xor cl, 0xff
and dl, r8b
xor dl, 0xff
xor cl, 0xff
xor dl, 0xff
or cl, dl
mov byte [rsp + 0x3f], cl
cmp eax, 0x10de06cc
jae 0x14018b212
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x14018b2d8
jmp 0x14018b38a
mov eax, dword [0x1401df958]
xor edx, edx
div dword [0x1401df95c]
mov ecx, eax
xor ecx, 0xc0b87093
xor ecx, 0xffffffff
and ecx, 0xc0b87093
shl ecx, 1
sub ecx, 0xc0b87093
sub eax, ecx
and eax, 0x91886dae
mov ecx, 0x18b6c319
xor ecx, 0xf6224e6b
and ecx, eax
mov edx, 0x7d75bcbc
xor edx, 0x828a4343
xor ecx, edx
add eax, 0xee948d72
add eax, 1
add eax, ecx
cmp eax, 0x9ce16748
jbe 0x14018b3b0
mov ecx, dword [0x1401df960]
imul ecx, dword [0x1401df964]
mov eax, ecx
and eax, 0x6e1b8b60
mov edx, 0x586195c2
xor edx, 0x367a1ea2
or ecx, edx
add eax, ecx
mov ecx, 0xad5742aa
xor ecx, 0x5302a2fc
xor edx, edx
div ecx
and eax, 0x351730bf
mov dword [rsp + 0x28], eax
call fcn.1400077a3
mov eax, dword [rsp + 0x28]
cmp eax, 0xd232fd7a
jae 0x14018b3b0
jmp 0x14018b39d
mov rcx, qword [rsp + 0x30]
xor eax, eax
test rcx, rcx
cmovg rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
add rsp, 0x48
ret
lea esi, [rdx]
invalid
cmpsb byte [rsi], byte [rdi]
add eax, 0xff7de971
invalid
Function at 0x1401970e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov eax, dword [0x1401dfe20]
sub eax, dword [0x1401dfe24]
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0xe8a6e5e3
mov edx, 0xffffffff
xor edx, 0xe8a6e5e3
and eax, edx
sub eax, ecx
xor eax, 0x2cae3d9f
sub eax, 0xfa47ede6
mov ecx, 0x43a20f52
xor ecx, 0x2d1ca23
cmp eax, ecx
jbe 0x1401971dd
mov eax, dword [0x1401dfe28]
mov ecx, dword [0x1401dfe2c]
mov edx, eax
or edx, ecx
not edx
not eax
not ecx
and eax, ecx
or edx, eax
mov ecx, edx
not ecx
mov eax, ecx
and eax, 0xee0fd6d7
xor edx, 0xee0fd6d7
add ecx, edx
sub ecx, eax
mov eax, ecx
xor eax, 0x65f4734c
xor ecx, 0x24304244
and ecx, 0x2c334e65
add ecx, ecx
sub eax, ecx
add eax, 0xac334e65
mov dword [rbp - 0xc], eax
mov eax, 0x10
call fcn.1401d4340
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
sub rsp, 0x20
call fcn.140199b10
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov qword [rcx], 0
mov rdx, qword [rax + 0x10]
xor r8d, r8d
sub rsp, 0x20
call fcn.140012c00
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbp - 0xc]
add rsp, 0x20
mov rcx, qword [rcx]
mov qword [rbp - 8], rcx
cmp eax, 0x5540850d
ja 0x14019712d
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
test al, 0x5c
sbb ebp, dword [rcx + rbp*8 + 0x47]
invalid
Function at 0x1401a54d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x2a8
Function at 0x1401b13e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 8], rcx
mov ecx, dword [0x1401e0868]
xor ecx, 0xba9f098b
mov edx, dword [0x1401e086c]
mov eax, ecx
and eax, edx
or ecx, edx
add eax, ecx
mov ecx, 0xd3251e3a
xor ecx, 0x8fa4c8ac
xor eax, ecx
imul eax, eax, 0x90f98d95
mov ecx, 0x70afb473
xor ecx, 0x3ce8d38a
xor edx, edx
div ecx
cmp eax, 0xcc9e6c91
je 0x1401b14f4
mov ecx, dword [0x1401e0870]
mov r8d, dword [0x1401e0874]
mov edx, ecx
not edx
mov eax, r8d
and eax, edx
mov r9d, r8d
not r9d
mov edx, ecx
and edx, r9d
imul edx, eax
mov eax, ecx
and eax, r8d
or ecx, r8d
imul ecx, eax
mov eax, ecx
mov ecx, edx
lea eax, [rax + rcx - 0x3779284a]
xor eax, 0xa0c3e58a
mov dword [rbp - 0xc], eax
mov eax, 0x10
mov qword [rbp - 0x20], rax
call fcn.1401d4340
sub rsp, rax
mov rax, qword [rbp - 0x20]
mov rcx, rsp
call fcn.1401d4340
sub rsp, rax
mov rax, qword [rbp - 8]
mov rdx, rsp
mov qword [rbp - 0x18], rdx
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.140030480
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov rdx, qword [rax + 0x10]
mov qword [rcx], rdx
mov rax, qword [rax + 0x18]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.140030480
mov eax, dword [rbp - 0xc]
add rsp, 0x20
cmp eax, 0xc02da179
jae 0x1401b1435
mov rsp, rbp
pop rbp
ret
mov bl, 0x8b
cmp dword [rax - 0xc717], edx
dec dword [rax - 0x7d]
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.1401aff47
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.1401aff70
test al, 1
jne 0x1401b1527
jmp 0x1401b1554
mov rcx, qword [rsp + 0x28]
call fcn.1401b13e0
mov rax, qword [rsp + 0x30]
mov al, byte [rax]
mov cl, 0x37
xor cl, 0x37
cmp al, cl
jne 0x1401b1554
mov rcx, qword [rsp + 0x28]
mov edx, 8
call fcn.14000eb78
nop
add rsp, 0x38
ret
Function at 0x1401b4760
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rcx
call fcn.1401c69c0
mov rdx, qword [rsp + 0x40]
xor eax, eax
test rdx, rdx
cmovg rax, rdx
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
cmp rax, rcx
je 0x1401b490c
mov ecx, dword [0x1401e09d0]
mov edx, dword [0x1401e09d4]
mov eax, ecx
xor eax, 0xffffffff
mov r9d, 0x4be5f828
xor r9d, 0xb41a07d7
mov r8d, edx
xor r8d, r9d
and eax, r8d
or ecx, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
mov edx, 0x793ff1a1
xor edx, 0x86c00e5e
xor ecx, edx
and eax, ecx
mov ecx, 0xf6fa5763
xor ecx, 0x491f3a8f
xor edx, edx
div ecx
mov r11d, eax
mov eax, 0xd932c8a0
xor eax, 0x6a6f5082
add r11d, eax
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0x26d12432
mov edx, 0x871902da
xor edx, 0x5da19257
mov eax, 0xa670a2c7
xor eax, 0x598f5d38
xor edx, eax
mov eax, ecx
and eax, 0xdab8908d
and r11d, edx
mov r9d, r8d
and r9d, 0xdab8908d
mov r10d, edx
and r10d, 0x26d12432
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
xor ecx, 0xffffffff
or edx, 0xdab8908d
and ecx, edx
or eax, ecx
cmp eax, 0x84a60da8
jb 0x1401b4911
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401e09d8]
xor edx, edx
div dword [0x1401e09dc]
mov edx, 0xa1b8e29f
xor edx, 0x8edf7d3
add eax, edx
sub eax, 0x582cc75
sub eax, 0xa955154c
mov r8d, 0x93ca0cef
xor r8d, 0xa0316c14
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x38]
imul eax, eax, 0x92d1777b
mov byte [rdx + rcx], 0
movabs rdx, 0x1998102c0f38f187
add rcx, rdx
movabs rdx, 0x3bfba568410a2210
movabs r8, 0x3bfba568410a2211
xor rdx, r8
add rcx, rdx
movabs rdx, 0x1998102c0f38f187
sub rcx, rdx
mov qword [rsp + 0x28], rcx
cmp eax, 0xbbd41a4a
je 0x1401b486e
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
jmp 0x1401b478d
add rsp, 0x58
ret
sub byte [rbx], cl
cmp ebx, dword [0x1401a9e02]
jmp qword [rsi + 0xf]
Function at 0x1401cab60
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, qword gs:[0x60]
movzx rax, byte [rax + 2]
ret
Function at 0x1401d3ca2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14025ce68]
test eax, eax
je 0x1401d3d3a
lea rax, [0x14025ce40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14025ce70]
mov qword [rbp - 8], rax
jmp 0x1401d3d1e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1401d3d12
cmp qword [rbp - 0x10], 0
je 0x1401d3d12
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1401d3cd8
lea rax, [0x14025ce40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1401d3d3b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1401d3e40
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1401d3e68
mov eax, 0
jmp 0x1401d3eb6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1401d3e91
mov eax, 0
jmp 0x1401d3eb6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1401d3eb1
mov eax, 0
jmp 0x1401d3eb6
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x1401d3ebc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1401d3f3a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1401d3f31
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1401d3f31
mov rax, qword [rbp - 8]
jmp 0x1401d3f4f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1401d3f04
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1826b0058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1826b01df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1826b0089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1826b006f
add dl, dl
jne 0x1826b0096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1826b00f6
xor eax, eax
add dl, dl
jne 0x1826b00a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1826b01ad
add dl, dl
jne 0x1826b00b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1826b00c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1826b00d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1826b00dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1826b00ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1826b007e
mov eax, 1
add dl, dl
jne 0x1826b0106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1826b0113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1826b00fb
sub eax, ebx
mov ebx, 1
jne 0x1826b014c
mov ecx, 1
add dl, dl
jne 0x1826b012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1826b013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1826b0123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1826b007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1826b0168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1826b0175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1826b015d
cmp eax, 0x7d00
jae 0x1826b019b
cmp eax, 0x500
jb 0x1826b0196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1826b007e
cmp eax, 0x7f
ja 0x1826b019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1826b007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1826b01d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1826b007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20