joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401160a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov eax, dword [0x140227108]
sub eax, dword [0x14022710c]
and eax, 0x2fedacad
add eax, 0x2e812549
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x49ca81a0
and ecx, 0xb6257c1f
imul ecx, edx
mov edx, eax
and edx, 0x36257c5f
or eax, 0xb6257c5f
imul eax, edx
add eax, ecx
cmp eax, 0x595e1b3b
je 0x140116118
mov eax, dword [0x140227110]
mov ecx, eax
not ecx
or ecx, dword [0x140227114]
lea edi, [rax + rcx]
add edi, 0x7277ef4b
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xdf04afda
jbe 0x140116124
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401160ed
xor ecx, ecx
nop word cs:[rax + rax]
test cl, cl
jne 0x140116130
xor ecx, ecx
nop word cs:[rax + rax]
test cl, cl
jne 0x140116140
test eax, eax
jne 0x14011614d
call fcn.14014f250
mov ecx, 0xb60cebad
nop word cs:[rax + rax]
mov eax, dword [0x140227118]
xor edx, edx
div dword [0x14022711c]
xor eax, 0xfb4b25dd
imul rax, rcx
shr rax, 0x3d
cmp eax, 0x471678d0
je 0x140116160
cmp rsi, 0xffffffffffffffff
je 0x1401162d0
lea rax, [rsi + 8]
mov edx, dword [0x140227120]
mov r8d, dword [0x140227124]
mov ecx, edx
not ecx
mov r9d, r8d
not r9d
mov r10d, ecx
and r10d, 0x8040836
and edx, 0xf7e20000
or edx, r10d
or ecx, r9d
and r9d, 0x8040836
and r8d, 0xf7e20000
or r8d, r9d
xor r8d, edx
not ecx
or ecx, r8d
mov edx, ecx
or edx, 0x19f7c9
not ecx
and ecx, 0x6d000010
mov r8d, edx
and r8d, 0x92e60d26
or r8d, ecx
xor r8d, 0x5f418098
and edx, 0x32587241
or edx, r8d
mov ecx, edx
not ecx
and ecx, 0xd7a20026
mov r8d, edx
and r8d, 0x285dda51
imul r8d, ecx
mov ecx, edx
and ecx, 0xd7a225ae
or edx, 0xd7a225ae
imul edx, ecx
add edx, r8d
cmp edx, 0x47ef54c0
je 0x140116190
lock dec qword [rax]
jne 0x1401162d0
mov eax, dword [0x140227128]
mov ecx, dword [0x14022712c]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
mov ecx, 0xfb486937
imul rcx, rax
shr rcx, 0x3e
imul eax, ecx, 0x91aab24c
or eax, 0xa9245628
cmp eax, 0x57462316
jne 0x140116290
mov eax, dword [0x140227130]
xor edx, edx
div dword [0x140227134]
imul eax, eax, 0xd0b9115d
mov ecx, eax
and ecx, 0x70299edc
or eax, 0x70299edc
add eax, ecx
and eax, 0xef582ea4
cmp eax, 0x4d258f06
ja 0x140116290
mov rcx, qword [0x14022cb48]
xor edx, edx
mov r8, rsi
call fcn.14014eed0
mov eax, dword [0x140227138]
mov ecx, dword [0x14022713c]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
or eax, 0xba902cce
mov ecx, eax
and ecx, 0xf4c05ff4
mov edx, ecx
not edx
mov r8d, eax
and r8d, 0xd0005920
and edx, 0xc788213
imul edx, r8d
and eax, 0x24c006d4
or ecx, 0x2cf886d7
imul ecx, eax
add ecx, edx
cmp ecx, 0x6c41ff98
ja 0x1401162d0
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1401278c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
inc rcx
nop word cs:[rax + rax]
mov edx, dword [0x140228c60]
or edx, dword [0x140228c64]
imul edx, edx, 0xc1d5ebd8
add edx, 0x82633398
mov r8d, edx
xor r8d, 0x5cbbb840
and r8d, edx
cmp r8d, 0x13d1ff12
jb 0x1401278e0
nop
mov edx, dword [0x140228c68]
mov r8d, edx
not r8d
or r8d, dword [0x140228c6c]
add r8d, edx
imul edx, r8d, 0x5119dd8a
add edx, 0x5119dd8a
mov r8d, edx
not r8d
and r8d, 0x5088667b
mov r9d, edx
and r9d, 0xaf779984
imul r9d, r8d
mov r8d, edx
and r8d, 0x5088667a
or edx, 0x5088667b
imul edx, r8d
add edx, r9d
cmp edx, 0x390a5e58
je 0x140127910
cmp rcx, 2
jb 0x1401279a2
mov rcx, rax
xor edx, edx
mov r8, rsi
call fcn.14014eed0
mov ecx, dword [0x140228c70]
xor ecx, dword [0x140228c74]
imul ecx, ecx, 0x72ecc5c1
cmp ecx, 0xfdfb543
je 0x140127980
test eax, eax
jne 0x140127a4d
mov eax, dword [0x140228c7c]
mov ecx, eax
xor ecx, eax
not ecx
and ecx, dword [0x140228c78]
xor ecx, eax
mov eax, ecx
not eax
or ecx, 0xa539a775
or eax, 0x5ac6588a
and eax, ecx
mov ecx, eax
and ecx, 0x7036606a
xor eax, 0xf036606a
lea eax, [rax + rcx*2]
add eax, 0x14a0269b
cmp eax, 0x6a4160d2
jb 0x140127a45
mov eax, dword [0x140228c80]
mov esi, dword [0x140228c84]
mov ecx, eax
xor ecx, esi
not esi
and esi, eax
add esi, esi
sub esi, ecx
mov eax, esi
not eax
and eax, 0x42f84fa9
mov ecx, esi
and ecx, 0xbd07b056
imul ecx, eax
mov eax, esi
and eax, 0x42f84fa9
or esi, 0x42f84fa9
imul esi, eax
add esi, ecx
mov eax, esi
and eax, 0x9016336
add eax, eax
sub esi, eax
add esi, 0xc9016336
and esi, 0x6389eaf7
call fcn.14014f250
cmp esi, 0x9dd009c6
jbe 0x140127a4d
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1401279e3
add rsp, 0x20
pop rsi
ret
Function at 0x1401298c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rsi, rcx
mov eax, dword [0x140228f90]
xor eax, dword [0x140228f94]
mov ecx, eax
xor ecx, 0x86f570d7
xor eax, 0xb1f9b2a6
and eax, ecx
add eax, 0xe7dea9d0
cmp eax, 0xa3f9ed29
jb 0x140129933
mov eax, dword [0x140228f98]
imul eax, dword [0x140228f9c]
or eax, 0x3ea73805
imul rcx, rax, 0x48de9e11
shr rcx, 0x3d
not ecx
and ecx, 0x93ba8aa7
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov r9, rsp
cmp ecx, 0xe1987e14
jne 0x140129942
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
jmp 0x1401298f6
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov rdi, rsp
mov rax, qword [rsi]
nop word cs:[rax + rax]

Function at 0x140129c80
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rsi, r9
mov rdi, r8
mov rbx, rdx
nop word cs:[rax + rax]
Function at 0x14013d8a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r8, rdx

Function at 0x14013e0f0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
Function at 0x14014f260
Capabilities:
Get hostname

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
nop
add rsp, 0x28
ret

Function at 0x1401502c0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop
add rsp, 0x28
ret

Function at 0x140150580
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
nop
add rsp, 0x28
ret

Function at 0x140150820
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop
add rsp, 0x28
ret

Function at 0x140150910
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
nop
add rsp, 0x28
ret

Function at 0x140150b00
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov eax, dword [rsp + 0x60]
mov r10, qword [rsp + 0x68]
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
add rsp, 0x38
ret

Function at 0x140150be0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140151230
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
nop
add rsp, 0x28
ret

Function at 0x140151be8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140151c32
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140151c32
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140151c32
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140151c32
cmp dword [rcx + 0x84], 0xe
jbe 0x140151c32
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140151c34
xor al, al
add rsp, 0x28
ret
Function at 0x1401586c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
mov rbp, rsp
mov eax, dword [0x140213618]
and eax, dword [0x14021361c]
xor eax, 0xdc4dd046
add eax, 0xaa2165b1
cmp eax, 0xd7f6c5cd
ja 0x14015872f
mov eax, dword [0x140213620]
mov ecx, dword [0x140213624]
mov edx, ecx
not edx
and edx, eax
xor ecx, eax
add ecx, eax
sub ecx, edx
or ecx, 0x7d036027
mov eax, ecx
and eax, 0x39431bc
xor ecx, 0x79431bc
lea ecx, [rcx + rax*2]
and ecx, 0x6be1a58
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov rsi, rsp
cmp ecx, 0x5a2464d7
jne 0x14015873e
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
jmp 0x1401586e3
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov rdi, rsp
sub rsp, 0x20
mov rcx, rdi
call fcn.140051f50
mov rcx, rsi
call fcn.14014fba0
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x140213628]
or eax, dword [0x14021362c]
add eax, 0xc4503096
imul rax, rax, 0x1bdb6643
shr rax, 0x3c
imul eax, eax, 0x661d9f33
cmp eax, 0xb0cb0468
ja 0x140158770
mov edi, dword [rdi + 8]
mov eax, edi
and eax, 0xc000000
cmp eax, 0xc000000
jne 0x1401587e3
sub rsp, 0x20
call fcn.14014fbc0
add rsp, 0x20
mov rcx, rax
mov eax, dword [0x140213638]
xor r8d, r8d
xor edx, edx
div dword [0x14021363c]
and ecx, 6
nop
test r8b, r8b
jne 0x1401587d0
cmp ecx, 6
sete al
xor ecx, ecx
test cl, cl
jne 0x1401587eb
jmp 0x140158837
xor eax, eax
xor ecx, ecx
test cl, cl
je 0x140158837
mov ecx, dword [rsi + 4]
mov edx, ecx
not edx
or edx, 0x20
add edx, ecx
inc edx
sete cl
setne dl
mov r8d, eax
xor r8b, 1
or r8b, cl
and dl, al
xor r8b, 1
or r8b, dl
mov ecx, edi
not ecx
or ecx, 0xefffffff
cmp ecx, 0xffffffff
setne cl
mov edx, r8d
not dl
or dl, cl
add dl, r8b
inc dl
and dl, 1
mov byte [section..data], dl
shr edi, 0x1c
and edi, 1
nop dword [rax]
mov ecx, dword [0x140213630]
mov edx, dword [0x140213634]
mov r8d, ecx
xor r8d, edx
not r8d
or ecx, edx
and ecx, r8d
add ecx, 0xad5071e
xor ecx, 0xd575b718
add ecx, 0x2f1a1f57
movzx edx, byte [rsi + 4]
shr dl, 5
mov r8d, eax
and r8b, dil
and r8b, dl
mov byte [section..data], r8b
cmp ecx, 0xe5a046f7
jb 0x140158840
mov rsp, rbp
pop rdi
pop rsi
pop rbp
ret
Function at 0x14015b300
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
xor eax, eax
test al, al
jne 0x14015b39a
mov ecx, dword [0x140218c58]
or ecx, dword [0x140218c5c]
mov eax, ecx
xor eax, 0x514050
xor ecx, 0xdda49727
mov edx, ecx
and edx, 0xeaaaafa8
and eax, 0x15555057
imul eax, edx
mov edx, ecx
and edx, 0x15555057
or ecx, 0x15555057
imul ecx, edx
add ecx, eax
or ecx, 0x6ff3ebe0
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov rdi, rsp
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov rbx, rsp
lea rax, [0x14022caa0]
mov qword [rbx], rax
cmp ecx, 0xb007749b
jbe 0x14015b3d3
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov rax, rsp
lea rcx, [0x14022caa0]
mov qword [rax], rcx
jmp 0x14015b316
mov eax, dword [0x140218c60]
sub eax, dword [0x140218c64]
mov ecx, eax
not ecx
and ecx, 0x92406f2f
mov edx, eax
and edx, 0x6dbf90d0
imul edx, ecx
mov ecx, eax
and ecx, 0x92406f2f
or eax, 0x92406f2f
imul eax, ecx
add eax, edx
mov ecx, 0x840119fd
imul rcx, rax
shr rcx, 0x3f
imul eax, ecx, 0x726eac0e
cmp eax, 0x6c4baced
jne 0x14015b430
mov eax, dword [0x14022caa8]
nop word cs:[rax + rax]
mov eax, dword [0x140218c68]
mov ecx, dword [0x140218c6c]
mov edx, eax
xor edx, ecx
not edx
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
add ecx, 0xde276947
or ecx, 0xb7bd6fad
mov eax, dword [0x14022caa8]
cmp ecx, 0x320ef69
jb 0x14015b430
cmp eax, 4
je 0x14015b550
nop dword [rax]
mov eax, dword [0x140218c74]
add eax, dword [0x140218c70]
or eax, 0xc0810849
and eax, 0xe0c1896d
xor eax, 0x3a57bcdb
cmp eax, 0x89ca9b5d
jb 0x14015b470
mov eax, dword [0x140218c78]
mov ecx, dword [0x140218c7c]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
add eax, 0xa15c4916
or eax, 0x62e2d150
and eax, 0x6eeef9dd
cmp eax, 0x8599bded
ja 0x14015b58b
mov qword [rdi], rbx
mov qword [rsi], rdi
sub rsp, 0x20

Function at 0x14015b5b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
nop word cs:[rax + rax]
mov eax, dword [0x140218c98]
xor eax, dword [0x140218c9c]
imul rax, rax, 0x4a85361f
shr rax, 0x3e
imul eax, eax, 0x1828fa09
or eax, 0x4e15c385
cmp eax, 0x582c67ac
je 0x14015b5d0
lea r15, [0x140207ed8]
mov ebp, 2
mov r12d, 3
Function at 0x14015c260
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov eax, dword [0x140219540]
add eax, dword [0x140219544]
imul rcx, rax, 0x2d051f27
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1d
imul eax, eax, 0xc10a57a
not eax
and eax, 0xe89ed566
cmp eax, 0xbdc14375
jb 0x14015c326
mov eax, dword [0x140219548]
mov ecx, dword [0x14021954c]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
imul rax, rax, 0x247774c3
shr rax, 0x3d
imul eax, eax, 0x685c5dda
mov ebx, eax
xor ebx, 0xc5327088
add ebx, eax
and eax, 0x3acd8f76
sub ebx, eax
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov rdi, rsp
sub rsp, 0x20
mov rcx, rdi
call fcn.140150050
add rsp, 0x20
cmp ebx, 0xb8e202c9
jne 0x14015c355
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov rcx, rsp
sub rsp, 0x20
call fcn.140051f50
add rsp, 0x20
jmp 0x14015c2a0
mov eax, dword [str.Y6B]
mov ecx, dword [0x140219554]
not eax
not ecx
or ecx, eax
not ecx
or ecx, 0xed1eebee
imul eax, ecx, 0xee299d61
add eax, 0xda9f8353
cmp eax, 0x3a04e2ec
jb 0x14015c3a9
mov eax, dword [0x140219558]
xor edx, edx
div dword [0x14021955c]
mov ebx, eax
sub rsp, 0x20
mov rcx, rsi
call fcn.140052010
add rsp, 0x20
cmp ebx, 0xec856ebf
jne 0x14015c3bb
sub rsp, 0x20
mov rcx, rsi
call fcn.140052010
add rsp, 0x20
jmp 0x14015c381
mov edi, dword [rdi + 8]
mov eax, edi
and eax, 0xc000000
cmp eax, 0xc000000
jne 0x14015c3f4
mov eax, dword [0x140219560]
sub eax, dword [0x140219564]
xor eax, 0x22af714
imul rax, rax, 0x5f5dbfa1
shr rax, 0x3e
cmp eax, 0x46ed61b8
jbe 0x14015c429
jmp 0x14015c476
xor eax, eax
mov ecx, dword [rsi + 4]
mov edx, ecx
xor edx, 0xffffffdf
or ecx, 0x20
test ecx, edx
sete cl
xor al, 1
or al, cl
shr edi, 0x1c
or dil, al
sub dil, al
and dil, 1
mov byte [0x14020d001], dil
mov eax, edi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [0x140219568]
mov ecx, dword [0x14021956c]
mov edx, eax
xor edx, ecx
not edx
or eax, ecx
and eax, edx
mov ecx, eax
not ecx
and ecx, 0xb76635ee
and eax, 0x4899ca11
sub eax, ecx
imul rax, rax, 0x2ae0b121
shr rax, 0x3d
imul ebx, eax, 0x5b4815a3
sub rsp, 0x20
call fcn.14014fbc0
add rsp, 0x20
cmp ebx, 0x23c6f508
jne 0x14015c485
sub rsp, 0x20
call fcn.140052160
add rsp, 0x20
jmp 0x14015c429
and eax, 6
cmp eax, 6
sete al
nop
mov ecx, dword [0x140219570]
sub ecx, dword [0x140219574]
mov edx, ecx
xor edx, 0x1503e6aa
xor ecx, 0x60541104
and ecx, 0x7556f126
mov r8d, edx
and r8d, 0x8aa90ed9
or r8d, ecx
xor r8d, 0x71f61bee
and edx, 0x4a0eac8
or edx, r8d
cmp edx, 0x5d917378
je 0x14015c490
jmp 0x14015c3f6
Function at 0x140164370
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
movaps xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x28], rcx
mov eax, dword [0x14021b068]
mov ecx, dword [0x14021b06c]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
xor eax, 0xd23e726a
mov ecx, 0x911b2d9f
imul rcx, rax
shr rcx, 0x3f
or ecx, 0xc469cfd6
cmp ecx, 0x382a0356
jae 0x140164400
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov eax, 0x60
call fcn.1401516e0
sub rsp, rax
mov ecx, dword [0x14021b070]
mov eax, dword [0x14021b074]
mov edx, eax
and edx, ecx
add ecx, eax
sub ecx, edx
add ecx, 0xaf70b392
mov eax, ecx
and eax, 0x5f7b8678
add eax, eax
sub ecx, eax
add ecx, 0xdf7b8678
xor ecx, 0x66d915a9
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov r13, rsp
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov rdx, rsp
mov eax, 0x60
call fcn.1401516e0
sub rsp, rax
mov r12, rsp
cmp ecx, 0x42732d0e
ja 0x140164400
mov qword [rbp - 0x20], rdx
mov eax, dword [0x14021b078]
mov ecx, dword [0x14021b07c]
mov edx, eax
ret 0xca21
or eax, ecx
add eax, edx
add eax, 0xdd08c226
cmp eax, 0xbba9d3b7
jae 0x1401644b0
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov eax, 0x60
call fcn.1401516e0
sub rsp, rax
nop word [rax + rax]
Function at 0x140166b70
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov qword [rbp], rcx
mov eax, dword [0x14021ce78]
or eax, dword [0x14021ce7c]
cmp eax, 0x9751026e
je 0x140166bd9
Function at 0x14016aae0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
movzx eax, byte [0x14022cb78]
mov edx, 0x38
xor ecx, ecx
call fcn.14014ee50
mov rcx, rax
nop word [rax + rax]
mov eax, dword [0x14021d4c8]
mov edx, eax
not edx
or edx, dword [0x14021d4cc]
add eax, edx
add eax, 0xaeb46cd7
mov edx, eax
and edx, 0x659ef5c
or eax, 0x659ef5c
add eax, edx
cmp eax, 0x15654224
je 0x14016ab00
test rcx, rcx
je 0x14016af9e
mov qword [rcx], 1
mov eax, dword [0x14021d4d0]
xor eax, dword [0x14021d4d4]
shr eax, 2
imul rax, rax, 0x126b422d
shr rax, 0x3a
not eax
and eax, 0x5eb232a7
mov edx, 0x50800393
sub edx, eax
cmp edx, 0x2657cf33
jae 0x14016ab80
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], 2
nop dword [rax]
mov eax, dword [0x14021d4d8]
xor edx, edx
div dword [0x14021d4dc]
and eax, 0xe863287e
add eax, 0xf25702b8
mov edx, eax
xor edx, 0x82d3f3ff
or eax, 0x782c0800
and eax, edx
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], 2
cmp eax, 0xa92a10f0
je 0x14016ab80
mov eax, dword [0x14021d4e0]
imul eax, dword [0x14021d4e4]
xor eax, 0x42ac6601
add eax, 0xecd20774
or eax, 0x6d424f22
cmp eax, 0xf40cf35a
jbe 0x14016abf0
mov rax, qword [0x14022cb40]
nop dword [rax + rax]
mov eax, dword [0x14021d4e8]
mov edx, dword [0x14021d4ec]
add eax, edx
add eax, 0x166a59cc
mov r8, qword [0x14022cb40]
cmp eax, 0x2c4fcd92
jb 0x14016abf0
nop word cs:[rax + rax]
mov eax, dword [0x14021d4f0]
add eax, dword [0x14021d4f4]
mov edx, eax
not edx
and edx, 0x7a4c5f79
mov r9d, eax
and r9d, 0x5b3a086
imul r9d, edx
mov edx, eax
and edx, 0x7a4c5f79
or eax, 0x7a4c5f79
imul eax, edx
add eax, r9d
and eax, 0x7f1b4d8b
add eax, 0x1b797d0f
cmp eax, 0xcf1cdd6b
ja 0x14016ac20
cmp r8, 0xffffffffffffffff
je 0x14016aeb8
mov eax, dword [0x14021d4f8]
xor edx, edx
div dword [0x14021d4fc]
lea r9, [r8 + 1]
mov edx, eax
or edx, 0xf9c99aac
not eax
and eax, 0x2166512
mov r10d, edx
and r10d, 0xd210261
or r10d, eax
xor r10d, 0x220a694c
and edx, 0xd0d494d2
or edx, r10d
mov eax, edx
not eax
mov r10d, edx
and r10d, 0xa873fc2a
and eax, 0x6040151
imul eax, r10d
mov r10d, edx
and r10d, 0x578c03d5
or edx, 0x578c03d5
imul edx, r10d
add edx, eax
cmp edx, 0x8d16c94c
jbe 0x14016ad00
mov rax, r8
lock cmpxchg qword [0x14022cb40], r9
nop word cs:[rax + rax]
mov eax, dword [0x14021d500]
xor edx, edx
div dword [0x14021d504]
imul r10, rax, 0x8bce575
shr r10, 0x3b
xor r10d, 0xbf19b7e9
mov rax, r8
lock cmpxchg qword [0x14022cb40], r9
sete dl
cmp r10d, 0xb211138c
jb 0x14016ad00
mov r8, rax
test dl, dl
je 0x14016ac20
mov eax, dword [0x14021d520]
imul eax, dword [0x14021d524]
or eax, 0xffffefbe
cmp eax, 0xcb61e6a8
jae 0x14016ad7e
mov qword [rcx + 0x28], r9
mov byte [rcx + 0x30], 0
mov eax, dword [0x14022cb7c]
add byte [rbp + 0x48], ah
mov edx, dword [0x58]
mov eax, dword [0x14021d508]
xor eax, dword [0x14021d50c]
add eax, 0xf15ced0e
imul rax, rax, 0x2d6a8e2d
shr rax, 0x39
cmp eax, 0x3d54602d
jbe 0x14016af2c
jmp 0x14016af6a
mov eax, dword [0x14021d510]
xor edx, edx
div dword [0x14021d514]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x31a59e30
and ecx, 0xce5a61cf
imul ecx, edx
mov edx, eax
and edx, 0xce5a61cf
or eax, 0xce5a61cf
imul eax, edx
add eax, ecx
ud2
ud2
ud2
Function at 0x14016b020
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov r9, rcx
mov eax, dword [0x14021e038]
and eax, dword [0x14021e03c]
add eax, 0xb852037e
xor eax, 0x10c0a20e
or eax, 0x621e4df1
cmp eax, 0x61d19667
je 0x14016b09b
mov eax, dword [0x14021e040]
mov ecx, dword [0x14021e044]
mov edx, eax
and edx, ecx
or eax, ecx
not eax
or eax, edx
not eax
imul rcx, rax, 0x50e102b1
shr rcx, 0x3e
or ecx, 0x903e2c98
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
mov rdi, rsp
cmp ecx, 0x9c05227f
jne 0x14016b0aa
mov eax, 0x10
call fcn.1401516e0
sub rsp, rax
jmp 0x14016b05a
mov eax, dword [0x14021e048]
xor edx, edx
div dword [0x14021e04c]
mov ecx, 0x9a818765
imul rcx, rax
shr rcx, 0x3f
add ecx, 0x9e530349
cmp ecx, 0x9c86578d
jae 0x14016b0f0
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
nop dword [rax]
mov eax, dword [0x14021e050]
mov ecx, dword [0x14021e054]
mov edx, eax
and edx, ecx
xor eax, ecx
lea eax, [rax + rdx*2]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x72ca2bd9
and ecx, 0x8d35d426
imul ecx, edx
mov edx, eax
and edx, 0x8d35d426
or eax, 0x8d35d426
imul eax, edx
add eax, ecx
mov ecx, eax
and ecx, 0x505a6e14
mov edx, ecx
not edx
mov r8d, eax
and r8d, 0x522a14
and edx, 0x5b085460
imul edx, r8d
and eax, 0x50084400
or ecx, 0x5b085460
imul ecx, eax
add ecx, edx
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov r15, rsp
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov r14, rsp
cmp ecx, 0x50f06500
je 0x14016b0f0
nop dword [rax + rax]
Function at 0x14016d130
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov edi, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov eax, dword [0x140225628]
xor edx, edx
div dword [0x14022562c]
mov eax, 0xa72e7913
nop word [rax + rax]
mov edx, dword [str.k6]
or edx, dword [0x140225634]
mov r8d, edx
xor r8d, 0x81610258
xor edx, 0x8900181
and edx, 0xe921985
and r8d, 0xf16de67a
or r8d, edx
imul r8, rax
shr r8, 0x3f
cmp r8d, 0xe307a7a8
je 0x14016d160
nop dword [rax]
mov eax, dword [0x140225638]
mov edx, dword [0x14022563c]
mov r8d, edx
not r8d
mov r9d, eax
and r9d, r8d
or r8d, eax
not r8d
imul r8d, r9d
mov r9d, eax
and r9d, edx
or eax, edx
imul eax, r9d
add eax, r8d
imul eax, eax, 0x31e4a220
imul rdx, rax, 0x43b3eb
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1c
imul eax, eax, 0x8c213e28
cmp eax, 0xf4c901fc
je 0x14016d1a0
test rcx, rcx
je 0x14016d22a
mov eax, dword [0x140225640]
mov edx, dword [0x140225644]
xor edx, eax
not edx
and edx, eax
not edx
mov eax, edx
or eax, 0x3054e3f9
or edx, 0xfd5febfb
sub edx, eax
cmp edx, 0x2f8ff2bd
jne 0x14016d231
jmp 0x14016d25f
xor ecx, ecx
jmp 0x14016d2c0
mov eax, dword [0x140225648]
sub eax, dword [0x14022564c]
imul rdx, rax, 0x61d9721
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
mov qword [0x14022cb48], rcx
cmp eax, 0x2712ad46
jne 0x14016d268
mov qword [0x14022cb48], rcx
jmp 0x14016d231
mov edx, edi
mov r8, rsi
call fcn.140150c10
mov rcx, rax
nop word cs:[rax + rax]
mov eax, dword [0x140225650]
add eax, dword [0x140225654]
mov edx, eax
not edx
and edx, 0x4c92daa2
and eax, 0xb36d255d
sub eax, edx
mov edx, 0x95611c9d
sub edx, eax
add eax, 0x6a9ee362
or eax, 0xd762539
or edx, 0xf289dac6
and edx, eax
cmp edx, 0xf2f8988f
ja 0x14016d280
nop
mov eax, dword [0x140225658]
xor edx, edx
div dword [0x14022565c]
add eax, 0x775839fa
xor eax, 0xd693b7ab
imul rax, rax, 0x7bae95a5
shr rax, 0x3c
cmp eax, 0x6e76b038
je 0x14016d2c0
mov rax, rcx
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140173f90
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov r14, rdx
mov eax, dword [0x1402277f0]
add eax, dword [0x1402277f4]
mov rsi, rcx
xor eax, 0xa8f7dac4
shr eax, 1
mov ecx, 0x8d104795
imul rcx, rax
shr rcx, 0x3d
imul eax, ecx, 0x43e0dc59
cmp eax, 0xd012c047
jbe 0x140173fe5
mov eax, 0xb0
call fcn.1401516e0
sub rsp, rax
lea r13, [r8 + 0x110]

Function at 0x140174530
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov eax, dword [0x14022cb70]
add eax, 0xb8636