joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006f470
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push rbp
push rbx
push rax
mov rbp, rsp
and rsp, 0xffffffffffffffe0
mov rbx, rsp
mov eax, dword [0x141dc9df8]
and eax, dword [0x141dc9dfc]
xor eax, 0xe0f1bf1e
add eax, 0x86924df0
cmp eax, 0x92b9e2a6
jbe 0x14006f4b1
mov eax, 0x60
call fcn.1400eeec0
sub rsp, rax
mov rax, rsp
and rax, 0xffffffffffffffe0
mov rsp, rax
mov r9d, 0x9abece57
nop word [rax + rax]
mov eax, dword [0x141dc9e00]
xor eax, dword [0x141dc9e04]
imul r10d, eax, 0xce92a956
and r10d, 0xf1a38ef0
imul r10, r9
shr r10, 0x3e
mov eax, 0x60
call fcn.1400eeec0
sub rsp, rax
mov r8, rsp
and r8, 0xffffffffffffffe0
mov rsp, r8
cmp r10d, 0x75d245d
je 0x14006f4c0
nop word cs:[rax + rax]
mov eax, dword [0x141dc9e08]
add eax, dword [0x141dc9e0c]
or eax, 0xbebffdef
imul rax, rax, 0x668ea589
shr rax, 0x3d
cmp eax, 0x9050e7c8
je 0x14006f510
mov rax, qword [rcx + 0x220]
cmp rax, 3
ja 0x14006f5bf
shl rax, 4
vmovdqu xmm0, xmmword [rdx]
vmovdqu xmmword [rcx + rax + 0x1e0], xmm0
nop word cs:[rax + rax]
mov eax, dword [0x141dc9e10]
mov edx, dword [0x141dc9e14]
add eax, edx
add eax, 0xae23e84e
or eax, 0xdfbe7eff
cmp eax, 0x1daacf6f
jb 0x14006f560
mov r9, qword [rcx + 0x220]
cmp r9, 3
jae 0x14006f5b7
inc r9
nop
mov eax, dword [0x141dc9e30]
xor edx, edx
div dword [0x141dc9e34]
imul eax, eax, 0xe9d5f038
cmp eax, 0xa6b4a0b
je 0x14006f590
mov qword [rcx + 0x220], r9
jmp 0x14006f6e2
xor eax, eax
test al, al
je 0x14006f5ef
jmp 0x14006f619
ud2
mov eax, dword [0x141dc9e20]
xor edx, edx
div dword [str.nA0G]
or eax, 0x812002ca
and eax, 0x832002ca
mov qword [rcx + 0x220], 0
cmp eax, 0x4a6d8db7
jne 0x14006f626
mov qword [rcx + 0x220], 0
jmp 0x14006f5ef
vmovdqa ymm0, ymmword [rcx + 0x200]
vmovdqa ymm1, ymmword [rcx + 0x1e0]
vpunpckhqdq ymm2, ymm1, ymm0
vpermq ymm2, ymm2, 0xd8
vpunpcklqdq ymm0, ymm1, ymm0
vpermq ymm0, ymm0, 0xd8
vpbroadcastd ymm1, dword [0x140101c60]
vpsrlq ymm3, ymm2, 0x28
vpor ymm1, ymm3, ymm1
vpsrlq ymm3, ymm0, 0x2e
vpsllq ymm2, ymm2, 0x12
vpor ymm3, ymm2, ymm3
vpsrlq ymm4, ymm0, 0x1a
vpbroadcastq ymm5, qword [0x140101c68]
vpblendd ymm2, ymm4, ymm2, 0xaa
vpand ymm2, ymm2, ymm5
vpsllq ymm3, ymm3, 0x1a
vpblendd ymm0, ymm0, ymm3, 0xaa
vpand ymm0, ymm0, ymm5
vmovdqa ymmword [r8], ymm0
vmovdqa ymmword [r8 + 0x20], ymm2
vmovdqa ymmword [r8 + 0x40], ymm1
sub rsp, 0x20
mov rdx, r8
vzeroupper
call fcn.14006f6f0
add rsp, 0x20
mov eax, 0xa169c7af
nop word [rax + rax]
mov ecx, dword [0x141dc9e28]
add ecx, dword [0x141dc9e2c]
imul ecx, ecx, 0xef96b040
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0xae6281a
ja 0x14006f6c0
lea rsp, [rbp + 8]
pop rbx
pop rbp
ret
Function at 0x1400707d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x141dca148]
and eax, dword [0x141dca14c]
imul eax, eax, 0x3e6ff18
or eax, 0x12ce2ba8
imul eax, eax, 0x56b68313
cmp eax, 0x6f820cce
jae 0x140070800
vmovups xmm0, xmmword [rdx]
vmovaps xmmword [rcx], xmm0
nop dword [rax]
mov eax, dword [0x141dca150]
xor eax, dword [0x141dca154]
add eax, 0xf06b087a
and eax, 0x95dafca2
vmovups xmm1, xmmword [rdx]
vmovups xmm0, xmmword [rdx + 0x10]
vmovaps xmmword [rcx], xmm1
cmp eax, 0xc28cac5a
ja 0x140070800
mov eax, dword [0x141dca158]
xor edx, edx
div dword [0x141dca15c]
imul eax, eax, 0x46d1611f
xor eax, 0x9fc77647
mov edx, 0xc1c1310b
imul rdx, rax
shr rdx, 0x3f
cmp edx, 0x8caaeb00
ja 0x140070888
mov eax, dword [0x141dca160]
xor edx, edx
div dword [0x141dca164]
or eax, 0x8010002
xor eax, 0x25a00
and eax, 0x880fda06
vmovaps xmmword [rcx + 0x10], xmm0
mov dword [rcx + 0x20], 0
cmp eax, 0x5b17c905
jbe 0x140070896
vmovaps xmmword [rcx + 0x10], xmm0
mov dword [rcx + 0x20], 0
jmp 0x140070858
xor eax, eax
test al, al
je 0x1400708aa
mov dword [rcx + 0x24], 0
mov rax, qword [r8]
mov qword [rcx + 0x28], rax
mov r9d, 0x8fa690f7
mov eax, dword [str._vg_n_]
xor edx, edx
div dword [0x141dca16c]
add eax, 0x33a4ce82
imul rax, r9
shr rax, 0x3f
xor eax, 0xd166f719
mov dword [rcx + 0x24], 0
mov rdx, qword [r8]
mov qword [rcx + 0x28], rdx
cmp eax, 0x23395d15
jb 0x1400708b0
ret
Function at 0x140076660
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
nop dword [rax]
mov eax, dword [0x141dcb1a8]
xor eax, dword [0x141dcb1ac]
xor eax, 0x13008004
or eax, 0xc4f77feb
cmp eax, 0x16a056da
jb 0x140076670
mov rcx, qword [rsi]
mov rax, qword [rcx + 0x10]
lock dec qword [rax]
jne 0x14007671f
mov eax, dword [0x141dcb1b0]
and eax, dword [0x141dcb1b4]
imul rdx, rax, 0x13c50e2b
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1b
imul eax, eax, 0xb55b79e1
or eax, 0x7b1908fd
cmp eax, 0x22c9f029
je 0x1400766fb
mov eax, dword [0x141dcb1b8]
xor edx, edx
div dword [0x141dcb1bc]
imul eax, eax, 0xe1dadeab
or eax, 0xab119ae6
imul rax, rax, 0x25538f2d
shr rax, 0x3b
cmp eax, 0x17a557c2
jne 0x1400766fd
jmp 0x1400766d0
mov rdi, qword [rcx + 0x10]
xor eax, eax
test al, al
jne 0x140076715
mov rcx, rdi
call fcn.140076300
xor eax, eax
test al, al
je 0x14007671f
mov rcx, rdi
call fcn.140076300
jmp 0x140076707
mov r8, qword [rsi]
cmp r8, 0xffffffffffffffff
je 0x1400767d7
lock dec qword [r8 + 8]
jne 0x1400767d7
mov eax, dword [0x141dcb1c0]
or eax, dword [0x141dcb1c4]
imul eax, eax, 0xe89fc7c4
or eax, 0x3d2d33b4
cmp eax, 0x5c3f1dbd
je 0x140076773
mov eax, dword [str.V5__]
sub eax, dword [0x141dcb1cc]
imul eax, eax, 0xad1651d6
and eax, 0x58024590
cmp eax, 0x389d386b
jbe 0x140076775
jmp 0x140076755
mov eax, dword [0x141dcb1d0]
sub eax, dword [0x141dcb1d4]
imul eax, eax, 0xae7a1aac
imul rcx, rax, 0x25022f1d
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
cmp eax, 0xbf00f851
je 0x1400767c6
mov eax, dword [0x141dcb1d8]
xor eax, dword [0x141dcb1dc]
xor eax, 0x4800
or eax, 0x7affb7ef
mov rcx, qword [0x141dda6a0]
cmp eax, 0x74dc9da7
jae 0x1400767cf
mov rax, qword [0x141dda6a0]
jmp 0x1400767a2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0x98e707b5
nop dword [rax]
mov ecx, dword [0x141dcb1e0]
and ecx, dword [0x141dcb1e4]
imul ecx, ecx, 0x6d50d28c
add ecx, 0x2dd72f80
imul rcx, rax
shr rcx, 0x38
cmp ecx, 0xd1037489
ja 0x1400767e0
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140078280
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov eax, dword [0x141dcb5a8]
xor eax, dword [0x141dcb5ac]
or eax, 0xbb7ff77f
xor eax, 0x29305fa0
cmp eax, 0x8295c5f4
jae 0x1400782d0
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
nop word [rax + rax]
mov eax, dword [0x141dcb5b0]
add eax, dword [0x141dcb5b4]
shr eax, 2
imul rcx, rax, 0x40b1cc53
shr rcx, 0x3c
add ecx, 0x552b6c91
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov r15, rsp
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov r14, rsp
cmp ecx, 0x620617a8
ja 0x1400782d0
xor eax, eax
test al, al
je 0x140078330
mov qword [r14], 0
mov eax, dword [0x141dda5f8]
nop dword [rax + rax]
mov ecx, dword [0x141dcb5b8]
xor ecx, dword [0x141dcb5bc]
and ecx, 0xc108c01a
add ecx, 0x4311dda6
mov qword [r14], 0
mov eax, dword [0x141dda5f8]
cmp ecx, 0x6b2ebe17
ja 0x140078330
cmp eax, 3
je 0x14007843d
nop word cs:[rax + rax]
mov eax, dword [0x141dcb5c0]
add eax, dword [0x141dcb5c4]
imul eax, eax, 0x97f3cb5c
add eax, 0x5b0653db
cmp eax, 0xac2b2c3
jb 0x140078370
mov eax, dword [0x141dcb5c8]
sub eax, dword [0x141dcb5cc]
or eax, 0xbda12e0
xor eax, 0x26f0b72f
imul eax, eax, 0x25d4fb1
cmp eax, 0xbf571d9d
je 0x14007867b
mov r12d, 0x9c35c1c5
lea rsi, [0x141dda5f8]
lea rdi, [0x141db8288]
mov rbx, rbp
mov r13d, dword [0x141dcb5d0]
or r13d, dword [0x141dcb5d4]
add r13d, 0x6f66bb8c
or r13d, 0x7b92a846
imul r13, r12
shr r13, 0x3b
mov qword [r15], r14
mov qword [rbp], r15
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, rbx
mov r9, rdi
call fcn.1400fa280
add rsp, 0x20
cmp r13d, 0xaaba5627
ja 0x1400783cc
nop dword [rax + rax]
mov eax, dword [0x141dcb5d8]
or eax, dword [0x141dcb5dc]
and eax, 0x14038090
add eax, 0x151d9613
cmp eax, 0x575ee386
ja 0x140078420
mov r8, qword [r14]
mov rcx, qword [r14 + 8]
mov eax, dword [0x141dcb5e0]
xor edx, edx
div dword [0x141dcb5e4]
xchg edx, eax
xor ebp, edx
add dword [rsi + 0x66], esp
nop word cs:[rax + rax]
mov qword [r15], r14
mov qword [rbp], r15
sub rsp, 0x20
lea rcx, [0x141dda5f8]
lea r9, [0x141db8288]
mov r8, rbp
xor edx, edx
call fcn.1400fa280
add rsp, 0x20
jmp 0x1400783b5
Function at 0x140078900
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
movaps xmmword [rbp - 0x10], xmm6
mov eax, dword [0x141dcb690]
imul eax, dword [0x141dcb694]
imul eax, eax, 0x8c569ce5
xor eax, 0xd71f912d
imul rax, rax, 0x23ce741d
shr rax, 0x3d
cmp eax, 0x1b93838a
ja 0x140078989
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov rsi, rsp
mov eax, 0x60
call fcn.1400eeec0
sub rsp, rax
mov r15, rsp
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov r8, rsp
mov eax, 0x60
call fcn.1400eeec0
sub rsp, rax
mov rbx, rsp
xor eax, eax
test al, al
je 0x1400789bf
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x60
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x60
call fcn.1400eeec0
sub rsp, rax
jmp 0x140078943
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov r14, rsp
mov rax, qword [rcx]
xor ecx, ecx
test cl, cl
jne 0x140078a0c
mov ecx, dword [0x141dcb698]
and ecx, dword [0x141dcb69c]
imul ecx, ecx, 0x63270d00
mov edx, 0xb352f6b5
imul rdx, rcx
shr rdx, 0x3b
and edx, 3
mov r12, qword [rax]
mov qword [rax], 0
cmp edx, 0x6522595b
jne 0x140078a15
mov qword [rax], 0
jmp 0x1400789d8
test r12, r12
je 0x140079442
mov qword [rbp - 0x18], r8
mov eax, dword [0x141dcb6b8]
xor edx, edx
div dword [0x141dcb6bc]
imul eax, eax, 0xda6250f2
add eax, 0x93252d58
cmp eax, 0xb332769d
jbe 0x140078a49
mov qword [r15], 0
mov r13, r15
add r13, 0x10
mov eax, dword [0x141dcb6c0]
sub eax, dword [0x141dcb6c4]
or eax, 0xf6c00
and eax, 0x522f6c12
imul eax, eax, 0xcd7b7d6a
mov qword [r15], 0
cmp eax, 0x55b5c0b8
je 0x140078a50
nop word [rax + rax]
mov eax, dword [0x141dcb6c8]
sub eax, dword [0x141dcb6cc]
add eax, 0xdb06e1ae
or eax, 0xc22ff6ae
cmp eax, 0x7dcc1668
je 0x140078a80
mov eax, dword [0x141dcb6d0]
and eax, dword [0x141dcb6d4]
imul eax, eax, 0xa413ae27
add eax, 0x8f37bc01
mov ecx, 0xdc28f015
imul rcx, rax
shr rcx, 0x3b
cmp ecx, 0xff338759
jbe 0x140078b03
mov qword [r15 + 0x28], 0
mov qword [r15 + 0x38], 0
mov qword [r15 + 0x48], 0
mov eax, dword [0x141dcb6a0]
sub eax, dword [0x141dcb6a4]
imul eax, eax, 0xe3652916
xor eax, 0xc5c7d6f4
imul eax, eax, 0xa93112f6
cmp eax, 0xf69891e2
jbe 0x140079470
ud2
mov eax, dword [0x141dcb6a8]
xor edx, edx
div dword [0x141dcb6ac]
add eax, 0x745e277
shr eax, 2
imul rax, rax, 0x44ec095f
imul eax, eax, 0x44ec095f
Function at 0x140081230
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
nop dword [rax]
mov eax, dword [0x141dcc788]
or eax, dword [0x141dcc78c]
and eax, 0xf36e50c9
add eax, 0x260509c3
or eax, 0x6cb6d9ab
cmp eax, 0x908b7643
ja 0x140081240
mov rax, qword [rsi]
nop word cs:[rax + rax]
mov ecx, dword [0x141dcc790]
add ecx, dword [0x141dcc794]
imul ecx, ecx, 0x694dfa6d
or ecx, 0x9b7def6f
cmp ecx, 0xc60664ca
ja 0x140081270
xor ecx, ecx
nop word cs:[rax + rax]
test cl, cl
jne 0x1400812a0
cmp eax, 3
jne 0x140081351
mov rax, qword [rsi + 8]
add rsi, 8
lock dec qword [rax]
sete al
nop dword [rax]
mov ecx, dword [0x141dcc798]
or ecx, dword [0x141dcc79c]
imul ecx, ecx, 0xc672dfc3
imul rcx, rcx, 0x2cc5a4c7
shr rcx, 0x3d
imul ecx, ecx, 0x2cbc1dd6
cmp ecx, 0xa965f1c8
ja 0x1400812c0
test al, al
je 0x140081690
mov eax, dword [0x141dcc7a0]
sub eax, dword [0x141dcc7a4]
add eax, 0x1902ce3b
and eax, 0xf8772ce6
cmp eax, 0x13f5ec96
jae 0x140081320
mov rcx, rsi
call fcn.1400bf680
nop dword [rax + rax]
xor ecx, ecx
nop word cs:[rax + rax]
test cl, cl
jne 0x140081360
cmp eax, 2
jb 0x140081690
mov rcx, qword [rsi + 8]
nop word cs:[rax + rax]
mov eax, dword [0x141dcc7b0]
xor eax, dword [0x141dcc7b4]
imul rax, rax, 0xb57db49
shr rax, 0x3b
or eax, 0x88b81586
cmp eax, 0xee696989
ja 0x140081380
nop word cs:[rax + rax]
mov eax, dword [0x141dcc7b8]
imul eax, dword [0x141dcc7bc]
cmp eax, 0x2a463241
je 0x1400813b0
nop word cs:[rax + rax]
Function at 0x140081ba0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov eax, 0xbd1759a7
nop word cs:[rax + rax]
mov ecx, dword [0x141dcc948]
xor ecx, dword [0x141dcc94c]
imul ecx, ecx, 0x86666e56
imul rcx, rax
shr rcx, 0x38
xor ecx, 0xe23e430d
cmp ecx, 0xc3e5959a
jb 0x140081bc0
mov rax, qword [r8 + 8]
nop dword [rax]
mov ecx, dword [0x141dcc950]
sub ecx, dword [0x141dcc954]
cmp ecx, 0xe1f82998
je 0x140081bf0
test rax, rax
je 0x140081cf7
mov rbx, qword [r8]
mov eax, dword [0x141dcc958]
sub eax, dword [0x141dcc95c]
cmp eax, 0x737035c2
je 0x140081c10
mov rcx, qword [r8 + 0x10]
mov eax, dword [0x141dcc960]
xor edx, edx
div dword [0x141dcc964]
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x140081c40
test rcx, rcx
je 0x140081d3c
nop dword [rax]
mov eax, dword [0x141dcc978]
and eax, dword [0x141dcc97c]
add eax, 0x1fd67e
and eax, 0x74b26776
xor eax, 0xe5f2b644
cmp eax, 0x393efb1c
jb 0x140081c50
mov eax, dword [0x141dcc980]
xor eax, dword [0x141dcc984]
imul eax, eax, 0xf0bcd242
cmp eax, 0x23e90b98
jne 0x140081ca0
mov rax, qword [0x141dda6a0]
nop word cs:[rax + rax]
mov eax, dword [0x141dcc988]
xor edx, edx
div dword [0x141dcc98c]
add eax, 0xb1b276c8
or eax, 0x4022630a
and eax, 0xc8aa7bea
mov r14, qword [0x141dda6a0]
cmp eax, 0x5c878547
jb 0x140081ca0
mov eax, dword [0x141dcc990]
add eax, dword [0x141dcc994]
xor eax, 0x80e858d0
and eax, 0xd8eb5cd4
imul eax, eax, 0xc4692b18
cmp eax, 0xeb409887
ja 0x140081da8
jmp 0x140081d79
test rdi, rdi
je 0x140081d72
movzx eax, byte [0x141dda6b8]
xor ecx, ecx
mov rdx, rdi
call fcn.1400bf230
nop dword [rax]
mov ecx, dword [0x141dcc9a0]
imul ecx, dword [0x141dcc9a4]
xor ecx, 0x6618000
and ecx, 0x36618230
imul ecx, ecx, 0xb2097581
cmp ecx, 0x5239b7e3
je 0x140081d10
jmp 0x140081df7
test rdi, rdi
je 0x140081d72
movzx eax, byte [0x141dda6b8]
mov eax, dword [0x141dcc968]
xor eax, dword [0x141dcc96c]
add eax, 0x696d0e66
or eax, 0xb68a04ae
imul rax, rax, 0x2fa52ec9
shr rax, 0x3d
cmp eax, 0x6957a56c
ja 0x140081deb
jmp 0x140081dbb
mov eax, 8
jmp 0x140081df7
mov eax, dword [0x141dcc998]
xor edx, edx
div dword [0x141dcc99c]
mov ebp, eax
and ebp, 0x3002012
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
cmp ebp, 0x89ffc99d
jne 0x140081df7
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x140081d79
mov ebx, dword [0x141dcc970]
xor ebx, dword [0x141dcc974]
or ebx, 0x2ac0400
and ebx, 0x12ad44d2
add ebx, 0x3ac3910f
xor ecx, ecx
mov rdx, rdi
call fcn.1400bf230
cmp ebx, 0x5445de12
jb 0x140081df7
xor ecx, ecx
mov rdx, rdi
call fcn.1400bf230
jmp 0x140081dbb
xor ecx, ecx
test rax, rax
mov edx, 8
cmovne rdx, rax
sete cl
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rdi
mov qword [rsi], rcx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140089d20
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
Function at 0x14008b6b0
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
movaps xmmword [rbp - 0x10], xmm6
mov eax, dword [0x141dcde58]
xor edx, edx
div dword [0x141dcde5c]
xor eax, 0x704624c0
and eax, 0x705777d4
add eax, 0x5fad8e63
cmp eax, 0x8cfa68ff
jb 0x14008b719
mov eax, dword [0x141dcde60]
and eax, dword [0x141dcde64]
add eax, 0xb6166bfa
imul rcx, rax, 0x3c43e51b
shr rcx, 0x3c
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov rsi, rsp
cmp ecx, 0x8360581e
jne 0x14008b728
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
jmp 0x14008b6e5
mov eax, dword [0x141dcde68]
imul eax, dword [0x141dcde6c]
or eax, 0x400000
xor eax, 0x8000231
and eax, 0x8410231
cmp eax, 0x8eab0636
jbe 0x14008b76a
xorps xmm0, xmm0
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
sub rsp, 0x20
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
add rsp, 0x20
xorps xmm6, xmm6
mov rdi, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop word cs:[rax + rax]
mov ebx, dword [0x141dcde70]
imul ebx, dword [0x141dcde74]
add ebx, 0xbbc140b6
movups xmmword [rsi + 0x20], xmm6
movups xmmword [rsi + 0x10], xmm6
movups xmmword [rsi], xmm6
sub rsp, 0x20
mov rcx, rsi
call rdi
add rsp, 0x20
cmp ebx, 0xa77ba8b7
ja 0x14008b780
mov ecx, dword [rsi + 0x20]
xor eax, eax
test rcx, rcx
sete al
lea rdx, [0x141db8968]
cmovne rdx, rcx
movaps xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008d330
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
movzx esi, byte [rdx + 0x38]
cmp sil, 3
je 0x14008d3a2
mov r8, rdx
movzx ebx, byte [rdx + 0x39]
movzx r10d, byte [rdx + 0x10]
push rdx
adc byte [rcx], dh
ror byte [rcx - 0x7d], 0xfa
add ecx, dword [rdi]
xchg ebx, eax
ror byte [rbp - 0x3f7cbffc], 7

Function at 0x14008e130
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
movzx r8d, byte [rcx]
lea eax, [r8 - 6]
movzx ecx, al
inc rcx
mov rdi, rdx
xlatb

Function at 0x14008ea20
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov r8, rdx
movzx r11d, byte [rdx + 0x38]
mov eax, dword [0x141dce5b0]
xor edx, edx
div dword [0x141dce5b4]
nop dword [rax]
mov eax, dword [0x141dce5b8]
and eax, dword [0x141dce5bc]
add eax, 0x937a4715
or eax, 0xa8c77392
imul edx, eax, 0x8102c0d3
movzx eax, byte [r8 + 0x3a]
test al, al
setne r9b
cmp edx, 0x44bf0335
je 0x14008ea40
cmp r11b, 1
ja 0x14008eaac
nop word cs:[rax + rax]
mov edx, dword [0x141dce5c0]
sub edx, dword [0x141dce5c4]
add edx, 0x621ef32c
or edx, 0xffefabee
cmp edx, 0x6def6423
jb 0x14008ea80
test al, al
je 0x14008eab7
xor r10d, r10d
jmp 0x14008ebe0
xor r9d, r9d
xor r10d, r10d
jmp 0x14008ec92
mov eax, dword [0x141dce5c8]
xor edx, edx
div dword [0x141dce5cc]
nop word cs:[rax + rax]
mov eax, dword [0x141dce5d0]
xor eax, dword [0x141dce5d4]
add eax, 0x352fae1c
and eax, 0x5607c0d5
imul rax, rax, 0x2b67e15b
shr rax, 0x3b
cmp eax, 0xa2ceb1fe
je 0x14008ead0
movzx r10d, byte [r8 + 0x10]
lea eax, [r10 - 5]
cmp al, 1
ja 0x14008ebd4
xchg ebx, ecx
add byte [rax], al
invalid
nop dword [rax]
mov eax, dword [0x141dce5d8]
imul eax, dword [0x141dce5dc]
xor eax, 0x22459d9f
add eax, 0x615a26ba
xor eax, 0x34ac7693
cmp eax, 0x7a3bfae9
ja 0x14008eb10
mov rax, qword [r8]
xor r10d, r10d
nop word [rax + rax]
nop dword [rax + rax]

Function at 0x14008f490
Capabilities:
Encode data using base64
Encode data using xor
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov rsi, r8
mov rdi, rdx
mov qword [rbp - 0x20], rcx
mov eax, dword [0x141dce7c8]
add eax, dword [0x141dce7cc]
xor eax, 0x300430
or eax, 0xf0ccf88c
shr eax, 2
imul rax, rax, 0x406e8331
shr rax, 0x3a
cmp eax, 0x52f5974
jne 0x14008f530
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x400
add byte [rax + rax], al
add al, ch
iretd
stc
add eax, 0xc4294800
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov rcx, rsp
sub rsp, 0x20
mov rdx, rdi
mov r8, rsi
call fcn.140090680
add rsp, 0x20
nop word cs:[rax + rax]
Function at 0x140093670
Capabilities:
Encode data using xor

Disassembly:
mov al, 1
cmp ecx, 0x3e2
loop 0x140093679
add byte [rax], al
Function at 0x140097a20
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
nop dword [rax]
add byte [rax], al
invalid

Function at 0x140097cc0
Capabilities:
Create directory
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.140090680
mov edi, edi
dec dword [rbx + rcx*4 + 0x74]
and al, 0x40

Function at 0x140098010
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov eax, dword [0x141dcf8f0]
imul eax, dword [0x141dcf8f4]
or eax, 0x1c4723a8
and eax, 0x1c472fe9
cmp eax, 0x10b75f42
jne 0x140098050
mov eax, 0x70
call fcn.1400eeec0
sub rsp, rax
mov eax, dword [0x141dcf8f8]
mov r8d, dword [0x141dcf8fc]
add r8d, eax
add r8d, 0xf9d58cd4
or r8d, 0xc726a1e9
add r8d, 0x57738b5d
mov eax, 0x70
call fcn.1400eeec0
sub rsp, rax
mov r9, rsp
cmp r8d, 0x55be912b
ja 0x140098050
mov eax, dword [0x141dcf900]
or eax, dword [0x141dcf904]
and eax, 0xe9aedfc
add eax, 0x5d0c10e3
or eax, 0x91fa0986
cmp eax, 0xea9aced8
jae 0x140098118
mov eax, 0x40
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x40
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x40
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x40
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
invalid
mov eax, 0x40
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov qword [rbp - 0x30], r9
mov qword [rbp], rcx
mov qword [rbp - 0x10], rdx
nop word cs:[rax + rax]
mov ecx, dword [0x141dcf908]
or ecx, dword [0x141dcf90c]
or ecx, 0x3d9810b4
and ecx, 0x3d9c91b4
xor ecx, 0xddd11eb1
mov eax, 0x40
call fcn.1400eeec0
sub rsp, rax
mov r8, rsp
mov eax, 0x40
call fcn.1400eeec0
sub rsp, rax
mov r9, rsp
mov eax, 0x40
call fcn.1400eeec0
sub rsp, rax
mov rdx, rsp
mov eax, 0x40
call fcn.1400eeec0
sub rsp, rax
mov r15, rsp
mov eax, 0x30
add byte [rax], al
add al, ch
sub byte [rbp + 5], ch
add byte [rax + 0x29], cl
invalid
mov r14, rsp
mov eax, 0x40
call fcn.1400eeec0
sub rsp, rax
mov r10, rsp
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov rsi, rsp
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov rbx, rsp
cmp ecx, 0xaa44aba1
jb 0x140098130
mov qword [rbp - 0x18], r10
mov qword [rbp - 0x20], r9
mov qword [rbp - 8], r8
clc

Function at 0x14009c200
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov eax, dword [0x141dd01d8]
xor edx, edx