joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c47b0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rsi, rcx
nop dword [rax]
mov eax, dword [0x141dd6050]
xor edx, edx
div dword [0x141dd6054]
add eax, 0xcdfc952a
or eax, 0xc0fadae0
add eax, 0x2d40513c
cmp eax, 0x35653151
jb 0x1400c47c0
mov rcx, qword [rsi]
cmp rcx, 0xffffffffffffffff
je 0x1400c49bd
lea r8, [rcx + 1]
lea rax, [rcx + rcx]
cmp rax, r8
cmova r8, rax
movabs r9, 0x7ffffffffffffff8
movabs r10, 0x1fffffffffffffff
nop word cs:[rax + rax]
mov eax, dword [0x141dd6058]
xor edx, edx
div dword [0x141dd605c]
and eax, 0x8000
cmp r8, 5
mov ebx, 4
cmovae rbx, r8
lea rdi, [rbx*8]
cmp rbx, r10
seta dl
cmp rdi, r9
seta r11b
cmp eax, 0xa2918aff
ja 0x1400c4820
or dl, r11b
jne 0x1400c49bd
mov eax, dword [0x141dd6060]
xor edx, edx
div dword [0x141dd6064]
nop word cs:[rax + rax]
mov eax, dword [0x141dd6068]
xor edx, edx
div dword [0x141dd606c]
and eax, 0xc0e76dda
imul eax, eax, 0xf893d8e3
or eax, 0x47609ea
cmp eax, 0xae5f8e34
ja 0x1400c4880
test rcx, rcx
je 0x1400c48e6
mov rax, qword [rsi + 8]
shl rcx, 3
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rcx
nop dword [rax]
mov eax, dword [0x141dd6070]
imul eax, dword [0x141dd6074]
or eax, 0x7d6fd7f4
xor eax, 0x3daf35b2
cmp eax, 0x47adc5bb
jb 0x1400c48c0
mov r14d, 8
jmp 0x1400c48e9
xor r14d, r14d
mov eax, dword [0x141dd6078]
imul eax, dword [0x141dd607c]
imul eax, eax, 0x7964e423
add eax, 0x64de327b
imul rax, rax, 0x2e0a622d
shr rax, 0x3d
cmp eax, 0x7adb7a0e
je 0x1400c4943
mov ebp, dword [0x141dd6080]
sub ebp, dword [0x141dd6084]
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x38]
lea r9, [rsp + 0x20]
mov edx, 8
mov r8, rdi
call fcn.1400c0b80
cmp ebp, 0x4e8147b7
jne 0x1400c4961
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x38]
lea r9, [rsp + 0x20]
mov edx, 8
mov r8, rdi
call fcn.1400c0b80
jmp 0x1400c4913
cmp qword [rsp + 0x38], 0
jne 0x1400c49a0
mov rax, qword [rsp + 0x40]
mov qword [rsi + 8], rax
mov eax, dword [0x141dd60a8]
xor edx, edx
div dword [0x141dd60ac]
or eax, 0xcae4094d
add eax, 0xfd321a38
xor eax, 0xdb41c6d6
cmp eax, 0x207cc3e1
jbe 0x1400c4a35
jmp 0x1400c4a52
mov eax, dword [0x141dd6088]
add eax, dword [0x141dd608c]
xor eax, 0x400f1515
or eax, 0xbe40e2ca
cmp eax, 0xe788b7d2
je 0x1400c49a0
mov eax, dword [0x141dd6090]
xor eax, dword [0x141dd6094]
add eax, 0xc992bc0
and eax, 0xf60d1112
imul eax, eax, 0xb28b0cc8
cmp eax, 0xe92c21be
jne 0x1400c49f0
ud2
mov eax, dword [0x141dd6098]
sub eax, dword [0x141dd609c]
imul rax, rax, 0x364a55f7
shr rax, 0x3d
add eax, 0x5c3e5c05
ud2
mov eax, dword [0x141dd60b0]
xor edx, edx
div dword [0x141dd60b4]
or eax, 0x71ece377
mov qword [rsi], rbx
cmp eax, 0xc381c125
jne 0x1400c4a57
mov qword [rsi], rbx
jmp 0x1400c4a35
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1400d4e90
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov eax, dword [0x141dd8458]
mov ecx, dword [0x141dd845c]
add eax, ecx
add eax, 0x27eaae6a
xor eax, 0x808313b5
or eax, 0x1a5c2c08
cmp eax, 0x72f41442
jb 0x1400d4ece
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rdi, rax
xor eax, eax
test al, al
je 0x1400d4ed6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x1400d4ebf
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400d4f4e
mov eax, dword [0x141dd8460]
xor edx, edx
div dword [0x141dd8464]
add eax, 0xf4c324ca
xor eax, 0x8dce460c
imul eax, eax, 0x6b48947b
cmp eax, 0x4cf7a955
jae 0x1400d4f13
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word [rax + rax]
mov ebp, dword [str.Ui_bt]
xor ebp, dword [0x141dd846c]
xor ebp, 0x274c621a
add ebp, 0xd81f74b5
mov rcx, rdi
xor edx, edx
mov r8, rsi
call rbx
cmp ebp, 0xf5a0811a
ja 0x1400d4f20
test eax, eax
jne 0x1400d4f60
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop word cs:[rax + rax]
mov eax, dword [0x141dd8470]
and eax, dword [0x141dd8474]
imul eax, eax, 0x2c6e2ca0
cmp eax, 0x24b09fd6
je 0x1400d4f60
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400d6370
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov eax, dword [0x141dd8728]
add eax, 0x1d023aa
xor eax, dword [0x141dd872c]
mov rsi, rcx
add eax, 0x45193636
or eax, 0x600106fa
cmp eax, 0xb026f55b
mov al, 0x72
invalid
mov eax, dword [0x141dd8730]
and eax, dword [0x141dd8734]
add eax, 0xa842e111
mov ecx, 0xe90cd629
imul rcx, rax
shr rcx, 0x3c
and ecx, 6
mov eax, 0x20
call fcn.1400ef3b0
pop qword [rcx]
add byte [rax + 0x29], cl
invalid
mov r9, rsp
loope 0x1400d6382
and byte [rax], al
add byte [rax], al
call fcn.1400ef3b0
sub rsp, rax
sub esp, eax
mov rdi, rsp
cmp ecx, 0xc2e7ec14
stc
adc al, 0xec
out 0xc2, eax
jne 0x1400d63fd
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x20
add byte [rax], al
call fcn.1400ef3b0
sub rsp, rax
jmp 0x1400d6398
mov rcx, qword [rsi]
mov eax, dword [0x141dd8738]
sub eax, dword [0x141dd873c]
xor eax, 0xaaa57c1
add eax, 0x699dbe12
or eax, 0xe1c01869
cmp eax, 0x622d3a16
jb case.0x140097d2b.292
cmp rcx, 0xffffffffffffffff
je 0x1400d65aa
lea rax, [rcx + 1]
lea rdx, [rcx + rcx]
nop word cs:[rax + rax]
mov r8d, dword [0x141dd8740]
sub r8d, dword [0x141dd8744]
rol byte [rcx], 1
add r8d, 0x862ecf2d
cmp r8d, 0x4b06fa0e
jb 0x1400d6440
cmp rdx, rax
cmova rax, rdx
cmp rax, 5
mov ebx, 4
cmovae rbx, rax
mov rax, rbx
shr rax, 0x3b
jne 0x1400d65aa
mov r8, rbx
shl r8, 5
loopne 0x1400d648b
movabs rax, 0x7ffffffffffffff8
cmp r8, rax
ja 0x1400d65aa
xor eax, eax
nop dword [rax + rax]
test al, al
jne 0x1400d64a0
nop word cs:[rax + rax]
mov eax, dword [0x141dd8748]
and eax, dword [0x141dd874c]
imul eax, eax, 0xc20b5a28
and eax, 0x112db220
cmp eax, 0xbc8d3e45
ja 0x1400d64b0
test rcx, rcx
je 0x1400d64fe
mov r10, qword [rsi + 8]
mov eax, dword [0x141dd8750]
xor edx, edx
div dword [0x141dd8754]
and eax, 0x12e240b3
imul eax, eax, 0xfbec4960
add eax, 0x72dd6800
cmp eax, 0x1c6d9be9
jae 0x1400d6502
jmp 0x1400d6522
xor eax, eax
jmp 0x1400d6577
mov eax, dword [0x141dd8758]
and eax, dword [0x141dd875c]
xor eax, 0xc800000
and eax, 0x1d800405
mov qword [r9], r10
cmp eax, 0xab45f168
jbe 0x1400d6527
mov qword [r9], r10
jmp 0x1400d6502
shl rcx, 5
mov eax, dword [0x141dd8760]
xor edx, edx
div dword [0x141dd8764]
imul eax, eax, 0xacfd70
add eax, 0x150c2f52
cmp eax, 0xd7d8cf2b
ja 0x1400d656c
mov eax, dword [0x141dd8768]
and eax, dword [0x141dd876c]
add eax, 0xbbefcb29
xor eax, 0xbeadfd15
adc eax, 0x49beadfd
mov dword [rcx + 0x10], ecx
cmp eax, 0x6740a3b1
jae 0x1400d6572
mov qword [r9 + 0x10], rcx
jmp 0x1400d654b
mov eax, 8
mov qword [r9 + 8], rax
sub rsp, 0x20
mov edx, 8
mov rcx, rdi
call fcn.1400c0b80
add rsp, 0x20
cmp qword [rdi], 0
jne 0x1400d65aa
mov rax, qword [rdi + 8]
mov qword [rsi + 8], rax
mov qword [rsi], rbx
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret
ud2
Function at 0x1400d65f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov eax, dword [0x141dd8778]
xor edx, edx
div dword [0x141dd877c]
imul eax, eax, 0x30100892
or eax, 0xa1893196
and eax, 0xefc9b5b6
cmp eax, 0x130dc3b3
mov bl, 0xc3
invalid
adc esi, dword [rdx + 0x34]
Function at 0x1400da110
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rcx, qword [rcx]
nop dword [rax]
mov eax, dword [0x141dd8ee8]
xor edx, edx
div dword [0x141dd8eec]
xor eax, 0x10164880
and eax, 0xd017c886
imul rdx, rax, 0x20276efd
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1e
cmp eax, 0xbab48dbe
ja 0x1400da120
nop word cs:[rax + rax]
mov eax, dword [0x141dd8ef0]
imul eax, dword [0x141dd8ef4]
add eax, 0xfd252920
xor eax, 0x26216e68
imul eax, eax, 0x467e268b
cmp eax, 0x6469a38f
jb 0x1400da160
cmp rcx, 0xffffffffffffffff
je 0x1400da372
lea rdx, [rcx + 1]
lea rax, [rcx + rcx]
cmp rax, rdx
cmova rdx, rax
cmp rdx, 5
mov edi, 4
cmovae rdi, rdx
lea r8, [rdi + rdi]
movabs rdx, 0x7ffffffffffffffe
cmp r8, rdx
seta r9b
test rdi, rdi
sets dl
or dl, r9b
nop dword [rax + rax]
mov r9d, dword [0x141dd8ef8]
add r9d, dword [0x141dd8efc]
imul r9d, r9d, 0xedee2fa0
add r9d, 0xe9425cae
cmp r9d, 0xb4a81536
ja 0x1400da1d0
test dl, dl
jne 0x1400da372
test rcx, rcx
je 0x1400da2cf
nop word cs:[rax + rax]
mov ecx, dword [0x141dd8f00]
or ecx, dword [0x141dd8f04]
imul ecx, ecx, 0x28060277
imul rcx, rcx, 0x4f16ad2d
shr rcx, 0x3e
cmp ecx, 0x16d2d4e9
ja 0x1400da210
mov rcx, qword [rsi + 8]
mov edx, dword [0x141dd8f08]
sub edx, dword [0x141dd8f0c]
add edx, 0x766e6707
xor edx, 0xd0841008
or edx, 0x2c6ba9e2
cmp edx, 0x3a3b5fe9
jae 0x1400da270
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x38], rax
nop dword [rax]
mov edx, dword [0x141dd8f10]
or edx, dword [0x141dd8f14]
add edx, 0x48ecb850
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x38], rax
cmp edx, 0x5457549
jb 0x1400da270
mov eax, 0x89a1d597
nop dword [rax]
mov ecx, dword [0x141dd8f18]
and ecx, dword [0x141dd8f1c]
imul ecx, ecx, 0x544026b4
imul rcx, rax
shr rcx, 0x3c
imul ecx, ecx, 0xc0193973
cmp ecx, 0x837252a
je 0x1400da2a0
mov eax, 2
jmp 0x1400da2d1
xor eax, eax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
lea r9, [rsp + 0x28]
mov edx, 2
call fcn.1400c0b80
cmp qword [rsp + 0x40], 0
jne 0x1400da350
mov eax, dword [0x141dd8f28]
xor edx, edx
div dword [0x141dd8f2c]
add eax, 0xe12aeb3a
and eax, 0x87803598
cmp eax, 0x21a7f501
nop
mov eax, dword [0x141dd8f30]
imul eax, dword [0x141dd8f34]
imul eax, eax, 0x67334000
imul rax, rax, 0x26628cff
shr rax, 0x3c
cmp eax, 0x601878a0
ja 0x1400da310
mov rax, qword [rsp + 0x48]
mov qword [rsi + 8], rax
mov qword [rsi], rdi
add rsp, 0x58
pop rdi
pop rsi
ret
mov eax, dword [0x141dd8f20]
sub eax, dword [0x141dd8f24]
and eax, 0x162fec41
add eax, 0xdbbd4190
or eax, 0xa011d4a1
cmp eax, 0x683dc9c2
jb 0x1400da350
ud2
Function at 0x1400e3ed0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov r8, rdx
mov eax, dword [0x141dda360]
mov edx, dword [0x141dda364]
add eax, edx
add eax, 0xe97200bd
xor eax, 0x58f79f79
imul eax, eax, 0xaa3a0f5
cmp eax, 0x43bda19b
ja 0x1400e3f55
Function at 0x1400ead20
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rdx + 8]
mov rcx, qword [rdx + 0x18]
cmp rax, 1
je 0x1400ead99
test rax, rax
jne 0x1400eadc9
xor eax, eax
nop dword [rax]
test al, al
jne 0x1400ead50
nop word cs:[rax + rax]
mov eax, dword [0x141ddaff8]
and eax, dword [0x141ddaffc]
or eax, 0x6eadf4f
add eax, 0x8bf35926
and eax, 0xa0678b4
cmp eax, 0xf0b939e
ja 0x1400ead60
test rcx, rcx
jne 0x1400eadc9
mov ebx, 1
xor edi, edi
mov r14d, 1
jmp 0x1400eaec7
mov r8, qword [rdi]
nop dword [rax]
mov eax, dword [0x141ddb058]
xor edx, edx
div dword [0x141ddb05c]
or eax, 0xa4891200
and eax, 0xa48d1fd3
add eax, 0xc49a0603
cmp eax, 0xfe1cddce
ja 0x1400eada0
test rcx, rcx
je 0x1400eade5
mov eax, dword [0x141ddb000]
xor eax, dword [0x141ddb004]
cmp eax, 0xf46ca138
jne 0x1400eaeeb
jmp 0x1400eaefc
mov rbx, qword [r8]
mov rdi, qword [r8 + 8]
nop dword [rax]
mov eax, dword [0x141ddb008]
imul eax, dword [0x141ddb00c]
xor eax, 0x2ae1e0d1
cmp eax, 0xff4153ba
ja 0x1400eadf0
nop dword [rax]
mov eax, dword [0x141ddb010]
xor eax, dword [0x141ddb014]
or eax, 0xbfcef1dd
imul eax, eax, 0xeae9e58f
cmp eax, 0xff28bf40
ja 0x1400eae10
test rdi, rdi
js 0x1400eafc7
mov eax, 0xfc3b6de7
nop dword [rax]
mov ecx, dword [0x141ddb018]
sub ecx, dword [0x141ddb01c]
xor ecx, 0x4eb8de23
imul rcx, rax
shr rcx, 0x3a
and ecx, 3
cmp ecx, 0x59f6aeb6
ja 0x1400eae40
nop word cs:[rax + rax]
mov eax, dword [0x141ddb020]
xor edx, edx
div dword [0x141ddb024]
and eax, 0x88ab8c40
add eax, 0xd4b171df
or eax, 0x2f93dbbd
cmp eax, 0xaf0a19d5
jb 0x1400eae70
test rdi, rdi
je 0x1400eaebf
movzx eax, byte [0x141ddb9b8]
mov eax, dword [0x141ddb028]
or eax, dword [0x141ddb02c]
add eax, 0x16b09d0c
or eax, 0xdfe1ef8d
cmp eax, 0x1254ac28
jae 0x1400eaf09
jmp 0x1400eaf37
mov r14d, 1
xor edi, edi
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi], rdi
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov rcx, rsi
mov rdx, rdi
call fcn.140037760
mov al, 1
test al, al
jne 0x1400eaee0
mov rcx, rsi
mov rdx, rdi
call fcn.140037760
jmp 0x1400eaeeb
mov eax, dword [0x141ddb030]
sub eax, dword [0x141ddb034]
or eax, 0xd93a860c
xor eax, 0xbc58149c
imul ebp, eax, 0x9f4f097e
xor ecx, ecx
mov rdx, rdi
call fcn.1400bf820
cmp ebp, 0xcc49d6de
jne 0x1400eaf43
xor ecx, ecx
mov rdx, rdi
call fcn.1400bf820
jmp 0x1400eaf09
mov r14, rax
nop word cs:[rax + rax]
mov eax, dword [0x141ddb038]
add eax, dword [0x141ddb03c]
cmp eax, 0x7aec78ff
je 0x1400eaf50
test r14, r14
jne 0x1400eaec7
mov eax, dword [0x141ddb040]
imul eax, dword [0x141ddb044]
or eax, 0x5f5f81e5
cmp eax, 0xd3a58047
je 0x1400eafaa
mov eax, dword [0x141ddb048]
and eax, dword [0x141ddb04c]
add eax, 0x9961f372
xor eax, 0x9803f6a5
imul eax, eax, 0xe13f7197
ud2
ud2
ud2
Function at 0x1400eee70
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rsi, rcx
mov eax, dword [0x141ddb7d0]
xor eax, dword [0x141ddb7d4]
mov ecx, 0xbcdfa759
imul rcx, rax
shr rcx, 0x3e
imul eax, ecx, 0xba16198
cmp eax, 0x3a074e5e
ja 0x1400eeee6
mov eax, dword [0x141ddb7d8]
sub eax, dword [0x141ddb7dc]
imul eax, eax, 0xc1512dd4
or eax, 0xa5a9a95f
imul ecx, eax, 0xf7f9c444
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov r9, rsp
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov rdi, rsp
cmp ecx, 0xf3034fbe
jae 0x1400eef02
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
jmp 0x1400eeea1
mov rcx, qword [rsi]
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x1400eef10
cmp rcx, 0xffffffffffffffff
je 0x1400ef0c3
mov eax, dword [0x141ddb7e0]
xor edx, edx
div dword [0x141ddb7e4]
lea rax, [rcx + 1]
mov edx, dword [0x141ddb7e8]
add edx, dword [0x141ddb7ec]
imul edx, edx, 0xe1093815
add edx, 0xbfd96336
cmp edx, 0xe2ac7fa1
ja 0x1400eef30
lea rdx, [rcx + rcx]
cmp rdx, rax
cmova rax, rdx
cmp rax, 9
mov ebx, 8
cmovae rbx, rax
test rbx, rbx
js 0x1400ef0c3
nop word cs:[rax + rax]
mov eax, dword [0x141ddb7f0]
imul eax, dword [0x141ddb7f4]
imul eax, eax, 0xc822f52
add eax, 0xae64f0d1
or eax, 0xc0b2a4cc
cmp eax, 0x28ac6ff5
jb 0x1400eef80
nop word cs:[rax + rax]
mov eax, dword [0x141ddb7f8]
and eax, dword [0x141ddb7fc]
imul eax, eax, 0xa8f073dc
add eax, 0x1fe1c77c
and eax, 0x4e388808
cmp eax, 0x435db21d
je 0x1400eefb0
test rcx, rcx
je 0x1400ef019
mov rax, qword [rsi + 8]
mov qword [r9], rax
mov qword [r9 + 0x10], rcx
nop word cs:[rax + rax]
mov eax, dword [0x141ddb800]
sub eax, dword [0x141ddb804]
add eax, 0x8d6ba3d8
or eax, 0x34088041
and eax, 0x3daf854d
cmp eax, 0xed8caddd
ja 0x1400eeff0
mov eax, 1
jmp 0x1400ef01b
xor eax, eax
mov qword [r9 + 8], rax
sub rsp, 0x20
mov edx, 1
mov rcx, rdi
mov r8, rbx
call fcn.1400c0b80
add rsp, 0x20
cmp qword [rdi], 0
jne 0x1400ef0a0
nop dword [rax]
mov eax, dword [0x141ddb820]
xor edx, edx
div dword [0x141ddb824]
or eax, 0x2d239d31
imul eax, eax, 0xfb5dac27
cmp eax, 0xbe140f20
je 0x1400ef040
mov rax, qword [rdi + 8]
mov qword [rsi + 8], rax
mov qword [rsi], rbx
nop dword [rax + rax]
mov eax, dword [0x141ddb828]
xor eax, dword [0x141ddb82c]
add eax, 0x1d226b90
and eax, 0x2beb5f06
cmp eax, 0x40ca36d1
ja 0x1400ef070
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [0x141ddb808]
add eax, dword [0x141ddb80c]
xor eax, 0x366fca55
imul eax, eax, 0xa101cb1b
add eax, 0x5a76c096
cmp eax, 0x90ed758a
ja 0x1400ef0a0
mov eax, dword [0x141ddb810]
imul eax, dword [0x141ddb814]
add eax, 0xcc945fb2
cmp eax, 0xff706667
ja 0x1400ef0f6
mov eax, dword [0x141ddb818]
and eax, dword [0x141ddb81c]
or eax, 0x45b7673b
ud2
ud2
Function at 0x1400ef8b8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400ef902
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400ef902
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400ef902
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400ef902
cmp dword [rcx + 0x84], 0xe
jbe 0x1400ef902
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400ef904
xor al, al
add rsp, 0x28
ret
Function at 0x1400f3150
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
add rdx, r8
jb 0x1400f326d
mov rsi, rcx
mov rcx, qword [rcx]
lea rax, [rcx + rcx]
cmp rax, rdx
cmova rdx, rax
cmp rdx, 9
mov edi, 8
cmovae rdi, rdx
test rdi, rdi
js 0x1400f326d
mov r8d, 0xb7b82925
nop dword [rax]
mov eax, dword [0x141dc4eb0]
xor edx, edx
div dword [0x141dc4eb4]
imul rax, r8
shr rax, 0x3f
add eax, 0xc521ae87
and eax, 0x8001aa06
cmp eax, 0xa4a51194
je 0x1400f3190
test rcx, rcx
je 0x1400f31cd
mov rax, qword [rsi + 8]
mov qword [rsp + 0x28], rax
xor eax, eax
test al, al
je 0x1400f31d1
jmp 0x1400f3204
xor eax, eax
jmp 0x1400f3210
mov eax, dword [0x141dc4eb8]
xor edx, edx
div dword [0x141dc4ebc]
imul eax, eax, 0xcc795486
add eax, 0x1419936e
mov edx, 0xdc4b890b
imul rdx, rax
shr rdx, 0x3c
mov qword [rsp + 0x38], rcx
cmp edx, 0x5128662a
jbe 0x1400f320b
mov qword [rsp + 0x38], rcx
jmp 0x1400f31d1
mov eax, 1
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x28]
mov rdx, rdi
call fcn.1400374d0
cmp qword [rsp + 0x40], 0
jne 0x1400f3250
mov rax, qword [rsp + 0x48]
mov qword [rsi + 8], rax
mov qword [rsi], rdi
add rsp, 0x58
pop rdi
pop rsi
ret
mov eax, dword [0x141dc4ec0]
add eax, dword [0x141dc4ec4]
xor eax, 0x60449002
and eax, 0x7354d103
cmp eax, 0xb07fd248
ja 0x1400f3250
mov eax, dword [0x141dc4ec8]
sub eax, dword [0x141dc4ecc]
imul eax, eax, 0x8c4f3b34
add eax, 0x20400ac5
cmp eax, 0x6fd8d692
jae 0x1400f3290
ud2
mov eax, dword [0x141dc4ed0]
xor edx, edx
div dword [0x141dc4ed4]
ud2

Function at 0x1400f32b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x48
lea rcx, [rsp + 0x38]
call fcn.1400415f0
lea rcx, [rsp + 0x28]
call fcn.140041620
mov esi, dword [rsp + 0x40]
mov eax, esi
not eax
test eax, 0xc000000
jne 0x1400f330a
mov eax, dword [0x141dc59c0]
add eax, dword [str.eurA]
imul rcx, rax, 0x604e3c19
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1d
or eax, 0xdf2ffcc0
cmp eax, 0x7e6458d2
jae 0x1400f3372
jmp 0x1400f339e
xor ecx, ecx
mov eax, dword [0x141dc59b8]
add eax, dword [0x141dc59bc]
imul eax, eax, 0xbc3ad8c
or eax, 0x3e87c548
xor eax, 0x4b975092
cmp eax, 0xf3035df4
ja 0x1400f334f
movzx eax, byte [rsp + 0x2c]
shr al, 5
and al, cl
mov edx, esi
shr edx, 0x1c
and edx, 1
and dl, al
mov byte [section..data], dl
xor eax, eax
test al, al
je 0x1400f336b
movzx eax, byte [rsp + 0x2c]
shr al, 5
and al, cl
mov edx, esi
shr edx, 0x1c
and edx, 1
and dl, al
mov byte [section..data], dl
jmp 0x1400f332f
add rsp, 0x48
pop rdi
pop rsi
ret
mov eax, dword [0x141dc59c8]
imul eax, dword [0x141dc59cc]
xor eax, 0x5ad441cc
mov edi, 0xc053bcc9
imul rdi, rax
shr rdi, 0x3e
call fcn.1400416e0
cmp edi, 0x64a87a95
jne 0x1400f33a5
call fcn.1400416e0
jmp 0x1400f3372
and eax, 6
nop dword [rax + rax]
mov ecx, dword [0x141dc59d0]
imul ecx, dword [0x141dc59d4]
imul ecx, ecx, 0x4943d499
add ecx, 0xa18cea6b
cmp ecx, 0x3eb76e18
jb 0x1400f33b0
nop word cs:[rax + rax]
mov edx, dword [0x141dc59d8]
or edx, dword [0x141dc59dc]
and edx, 0xa30422f9
xor edx, 0x8e46a13e
cmp eax, 6
sete cl
cmp edx, 0x80cd7883
jae 0x1400f33e0
jmp 0x1400f330c
Function at 0x1400f4d40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
lea rax, [0x141ddb8e0]
mov qword [rsp + 0x20], rax
mov eax, dword [0x141ddb8e8]
cmp eax, 3
jne 0x1400f4d60
add rsp, 0x38
ret
lea rax, [rsp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rcx, [0x141ddb8e8]
lea r9, [0x141db9028]
lea r8, [rsp + 0x30]
xor edx, edx
call fcn.1400fa840
mov ecx, 0x8bafd9ad
nop word cs:[rax + rax]
mov eax, dword [str.A1__b]
xor edx, edx
div dword [0x141dca734]
shr eax, 1
imul rax, rcx
shr rax, 0x3c
imul eax, eax, 0xb05f9c5
or eax, 0xce3c0ebd
cmp eax, 0x16d6f82a
jb 0x1400f4da0
nop word [rax + rax]
mov eax, dword [0x141dca738]
and eax, dword [0x141dca73c]
xor eax, 0x25ca7182
imul rax, rax, 0x531643bf
shr rax, 0x3e
or eax, 0x69007de8
cmp eax, 0x5acedf36
je 0x1400f4dd0
jmp 0x1400f4d5b
Function at 0x1400fa630
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov r9, qword [rcx]
lea rax, [r9 + r9]
cmp rax, rdx
cmova rdx, rax
cmp rdx, 5
mov edi, 4
cmovae rdi, rdx
lea rcx, [r8 + 7]
and rcx, 0xfffffffffffffff8
nop dword [rax]

Function at 0x1400fa840
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov qword [rbp - 8], r9
mov qword [rbp], r8
mov eax, dword [0x141dce288]
xor eax, dword [0x141dce28c]
mov rsi, rcx
xor eax, 0x510c0180
and eax, 0x79ee07a0
cmp eax, 0x5b78fd89
ja 0x1400fa8bc
mov eax, dword [0x141dce290]
sub eax, dword [0x141dce294]
xor eax, 0xdce37a35
imul ecx, eax, 0x4f579627
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov r15, rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov r14, rsp
cmp ecx, 0xce80e6e2
jne 0x1400fa8d8
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
jmp 0x1400fa87d
mov ecx, dword [rsi]
test dl, dl
je 0x1400fabde
mov r13d, 0xddbd26a3
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
xor edi, edi
lea rbx, [0x141dba320]
mov r12, qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitOnAddress]
mov r13d, 0x988e50cd
jmp 0x1400fac11

Function at 0x1400faf9e
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov eax, dword [0x141ddb958]
cmp eax, 3
je 0x1400fb0e1
mov eax, dword [0x141dce790]
xor eax, dword [0x141dce794]
and eax, 0x3660350c
cmp eax, 0x45f91d5e
je 0x1400fafe9
mov eax, dword [0x141dce798]
xor edx, edx
div dword [0x141dce79c]
and eax, 0x8804008
mov qword [rsp + 0x30], rcx
cmp eax, 0x6ab47146
jne 0x1400faff0
mov qword [rsp + 0x30], rcx
jmp 0x1400fafca
mov eax, dword [0x141dce7a0]
sub eax, dword [0x141dce7a4]
imul edx, eax, 0x178506b4
add edx, 0x6aa4693a
lea rax, [0x141ddb920]
lea rcx, [rsp + 0x2f]
cmp edx, 0xecc93b43
jbe 0x1400fb026
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rcx
mov edx, dword [0x141dce7a8]
xor edx, dword [0x141dce7ac]
and edx, 0xff076e4a
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rcx
cmp edx, 0x3d1333f5
je 0x1400fb026
mov eax, dword [0x141dce7b0]
imul eax, dword [0x141dce7b4]
xor eax, 0x61808a
and eax, 0x661bbdb
mov ecx, 0x7683ace9
xor edx, edx
div ecx
cmp eax, 0x6fc98568
je 0x1400fb0bd
mov eax, dword [0x141dce7b8]
or eax, dword [0x141dce7bc]
or eax, 0x93751d3
imul eax, eax, 0x2828e4b
mov ecx, 0x180ff28c
xor edx, edx
div ecx
mov esi, eax
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x48]
mov qword [r8], rax
lea rcx, [0x141ddb958]
lea r9, [0x141db9338]
mov dl, 1
call fcn.1400fa840
cmp esi, 0xed8884cf
jbe 0x1400fb0e1
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x48]
mov qword [r8], rax
lea rcx, [0x141ddb958]
lea r9, [0x141db9338]
mov dl, 1
call fcn.1400fa840
jmp 0x1400fb071
mov ecx, 0xfef0a307
mov r8d, 0xa3f1d528
mov eax, dword [0x141dce7c0]
imul eax, dword [0x141dce7c4]
and eax, 0xb1280fbd
xor edx, edx
div ecx
xor edx, edx
div r8d
cmp eax, 0x1ac00a70
je 0x1400fb0ec
add rsp, 0x50
pop rsi
ret