joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d14d0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x14013b040]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x14014cac0], 0
jne 0x1400d1590
mov rdi, qword [0x14014cac8]
test rdi, rdi
je 0x1400d15ad
cmp byte [rdi + 0x17], 0
jns 0x1400d1516
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14014cac0], rax
inc rax
cmp rax, 1
ja 0x1400d1590
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400d0e60
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x1400d1671
xor esi, esi
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.14009f1f0
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov ecx, 0x18
call fcn.14009d274
mov rdi, rax
lea rbx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.1400d0e60
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x14011c0c0]
movups xmmword [rdi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdi + 0x10], rax
mov rcx, rdi
mov rdx, rbx
call fcn.1400e8ed0
movsx rax, byte [rdi + 0x17]
mov rcx, rdi
test rax, rax
jns 0x1400d1617
mov rax, qword [rdi + 8]
mov rcx, qword [rdi]
test rax, rax
jne 0x1400d163d
lea rdx, str.debug.log
mov r8d, 9
mov rcx, rdi
call fcn.140093610
mov qword [0x14014cac8], rdi
jmp 0x1400d150d
add rax, rax
test rax, rax
je 0x1400d161c
lea rdx, [rax - 2]
cmp word [rcx + rax - 2], 0x5c
mov rax, rdx
jne 0x1400d1640
cmp rdx, 0xfffffffffffffffe
je 0x1400d161c
sar rdx, 1
inc rdx
mov rcx, rdi
mov r8, 0xffffffffffffffff
call fcn.140097250
jmp 0x1400d161c
mov rcx, qword [0x14014cac8]
lea rdx, [rsp + 0x40]
call fcn.140018a70
mov rcx, qword [0x14014cac8]
call fcn.1400eaec0
cmp word [rax], 0x5c
je 0x1400d16ad
mov rcx, qword [0x14014cac8]
lea rdx, [0x14011e67a]
mov r8d, 1
call fcn.140093610
mov rcx, qword [0x14014cac8]
lea rdx, str.debug.log
mov r8d, 9
call fcn.140093610
mov rcx, qword [0x14014cac8]
cmp byte [rcx + 0x17], 0
jns 0x1400d16d6
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14014cac0], rax
inc rax
cmp rax, 1
ja 0x1400d1590
mov qword [0x14014cac0], 0
jmp 0x1400d158e
Function at 0x140106980
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test ecx, ecx
sets al
test rdx, rdx
sete cl
or cl, al
je 0x14010699c
add rsp, 0x28
pop rdi
pop rsi
ret
mov rsi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdi, eax
mov rcx, rsi
mov rdx, rdi
call 0x1401069e0
test edi, edi
je 0x140106995
cmp byte [rsi + rdi - 1], 0xa
je 0x140106995
lea rcx, [0x14011c518]
mov edx, 1
add rsp, 0x28
pop rdi
pop rsi
jmp 0x1401069e0
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14013b040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
lea r14, [rsp + 0x34]
mov r15, qword [sym.imp.KERNEL32.dll_WriteFile]
cmp rdi, rsi
jae 0x140106a57
mov dword [rsp + 0x34], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r15
mov ecx, dword [rsp + 0x34]
test eax, eax
cmovne eax, ecx
je 0x140106a57
add rdi, rax
test ecx, ecx
jne 0x140106a1d
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14009f1f0
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1401069e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test ecx, ecx
sets al
test rdx, rdx
sete cl
or cl, al
je 0x14010699c
add rsp, 0x28
pop rdi
pop rsi
ret
mov rsi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdi, eax
mov rcx, rsi
mov rdx, rdi
call 0x1401069e0
test edi, edi
je 0x140106995
cmp byte [rsi + rdi - 1], 0xa
je 0x140106995
lea rcx, [0x14011c518]
mov edx, 1
add rsp, 0x28
pop rdi
pop rsi
jmp 0x1401069e0
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14013b040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
lea r14, [rsp + 0x34]
mov r15, qword [sym.imp.KERNEL32.dll_WriteFile]
cmp rdi, rsi
jae 0x140106a57
mov dword [rsp + 0x34], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r15
mov ecx, dword [rsp + 0x34]
test eax, eax
cmovne eax, ecx
je 0x140106a57
add rdi, rax
test ecx, ecx
jne 0x140106a1d
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14009f1f0
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400018e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000192e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000192e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000192e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000192e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000192e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001930
xor al, al
add rsp, 0x28
ret
Function at 0x14000d910
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140016c60], rbx
je 0x14000d977
cmp rax, rbx
jne 0x14000d96a
mov ebx, 1
mov esi, ebx
jmp 0x14000d97c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000d94f
mov ebx, 1
mov eax, dword [0x140016c68]
cmp eax, ebx
jne 0x14000d994
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14000da00
mov eax, dword [0x140016c68]
test eax, eax
jne 0x14000d9f5
mov dword [0x140016c68], ebx
lea r15, [0x140010bb8]
lea rdi, [0x140010ba0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000d9e7
test eax, eax
jne 0x14000d9eb
cmp qword [rdi], r14
je 0x14000d9dc
mov rax, qword [rdi]
mov rcx, qword [0x140010b58]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000d9be
test eax, eax
je 0x14000d9fb
mov eax, 0xff
jmp 0x14000db56
mov dword [0x1400163e4], ebx
mov edi, 0x1f
mov eax, dword [0x140016c68]
cmp eax, ebx
jne 0x14000da27
lea rdx, [0x140010b98]
lea rcx, [0x140010b60]
call sub.msvcrt.dll__initterm
mov dword [0x140016c68], 2
test esi, esi
jne 0x14000da35
mov rax, r14
xchg qword [0x140016c60], rax
cmp qword [0x140016c80], r14
je 0x14000da68
lea rcx, [0x140016c80]
call fcn.14000dfd0
test eax, eax
je 0x14000da68
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140016c80]
mov r9, qword [0x140010b58]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000da81
mov eax, 0xff
jmp 0x14000db56
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000db07
test ax, ax
je 0x14000da9c
test edx, edx
jne 0x14000db07
sub ax, bx
cmp ax, di
ja 0x14000dab2
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000da9c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400019fc
mov dword [0x1400163e0], eax
cmp dword [0x140016400], r14d
jne 0x14000daf0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400163e4], r14d
jne 0x14000db05
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400163e0]
jmp 0x14000db56
cmp ax, 0x22
jne 0x14000db1b
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000da8a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14000e064
add rsp, 0x28
jmp 0x14000d910
Function at 0x14000d820
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rbx, qword [rcx + 8]
test rbx, rbx
je 0x14000dae9
mov r8d, 0xc7daf7c1
nop word cs:[rax + rax]
mov eax, dword [0x141f2d7e8]
xor edx, edx
div dword [0x141f2d7ec]
add eax, 0x550b4b75
imul rax, r8
shr rax, 0x3f
or eax, 0xe31b1220
cmp eax, 0xe627a514
ja 0x14000d850
mov qword [rsp + 0x20], rcx
mov r14, qword [rcx + 0x18]
test r14, r14
je 0x14000d9fc
mov rax, qword [rsp + 0x20]
mov r15, qword [rax]
movdqa xmm0, xmmword [r15]
pmovmskb r13d, xmm0
not r13d
lea r12, [r15 + 0x10]
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x14000d8b0
xor ebp, ebp
mov rsi, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
test r13w, r13w
jne 0x14000d920
nop word cs:[rax + rax]
movdqa xmm0, xmmword [r12]
pmovmskb r13d, xmm0
add r15, 0xfffffffffffffc80
add r12, 0x10
cmp r13d, 0xffff
je 0x14000d8d0
nop
mov eax, dword [0x141f2d7f0]
sub eax, dword [0x141f2d7f4]
and eax, 0x7e8913b9
imul eax, eax, 0xe9fc61d1
add eax, 0x46146dfe
cmp eax, 0x89362681
jae 0x14000d8f0
not r13d
nop word cs:[rax + rax]
mov eax, dword [0x141f2d7f8]
or eax, dword [0x141f2d7fc]
shr eax, 2
imul rax, rax, 0x13ac97dd
shr rax, 0x35
imul eax, eax, 0xe64da28
cmp eax, 0xa1d3224b
ja 0x14000d920
tzcnt eax, r13d
neg rax
imul rax, rax, 0x38
lea rdi, [r15 + rax]
cmp qword [r15 + rax - 0x38], 0
je 0x14000d9b4
nop
test bpl, bpl
jne 0x14000d960
mov r8, qword [rdi - 0x30]
test bpl, bpl
jne 0x14000d99a
nop
mov eax, dword [0x141f2d800]
or eax, dword [0x141f2d804]
imul eax, eax, 0x1671863b
add eax, 0x9f036dae
or eax, 0xe0d433b8
mov rcx, qword [0x141f49060]
cmp eax, 0xa4ea5e7b
jae 0x14000d9b0
mov rax, qword [0x141f49060]
jmp 0x14000d970
xor edx, edx
call rsi
lea eax, [r13 - 1]
and eax, r13d
dec r14
mov r13d, eax
add rdi, 0xffffffffffffffe0
mov rcx, rdi
call fcn.14000f5c0
nop dword [rax]
mov eax, dword [0x141f2d808]
sub eax, dword [0x141f2d80c]
add eax, 0xd0aa5c21
xor eax, 0xd8b24769
imul eax, eax, 0x32f9bfb0
cmp eax, 0xa62ba0aa
je 0x14000d9d0
test r14, r14
jne 0x14000d8c0
lea rcx, [rbx + 1]
mov r8d, 0x38
nop word cs:[rax + rax]
mov r9d, dword [0x141f2d810]
and r9d, dword [0x141f2d814]
add r9d, 0xdd5db5be
xor r9d, 0x519ac304
add r9d, 0x8033c11e
mov rax, rcx
mul r8
cmp r9d, 0xa37af964
ja 0x14000da10
add rax, 0xf
and rax, 0xfffffffffffffff0
lea rcx, [rbx + rax]
add rcx, 0x11
nop word cs:[rax + rax]
mov edx, dword [0x141f2d818]
xor edx, dword [0x141f2d81c]
or edx, 0xf8fa45e4
and edx, 0xf8fbcfec
cmp edx, 0x4cf90902
je 0x14000da60
xor edx, edx
mov r8, qword [rsp + 0x20]
nop word [rax + rax]
test dl, dl
jne 0x14000da90
test rcx, rcx
je 0x14000dae9
mov r8, qword [r8]
sub r8, rax
mov rcx, qword [0x141f49060]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xc5de5a4f
nop word cs:[rax + rax]
mov ecx, dword [0x141f2d820]
imul ecx, dword [0x141f2d824]
imul ecx, ecx, 0x9c18b449
add ecx, 0xd66a66ec
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x5b2122f4
ja 0x14000dac0
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140016900
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
nop dword [rax + rax]
mov eax, dword [0x141f2eae0]
xor edx, edx
div dword [0x141f2eae4]
add eax, 0x20bf630d
cmp eax, 0xfaa2fc07
ja 0x140016910
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140016940
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov eax, dword [0x141f2eae8]
xor eax, dword [0x141f2eaec]
or eax, 0x8220004
and eax, 0x9226026
cmp eax, 0xe1c1d7e
je 0x140016940
cmp rsi, 0xffffffffffffffff
je 0x140016a80
nop word [rax + rax]
mov eax, dword [0x141f2eaf0]
xor edx, edx
div dword [0x141f2eaf4]
and eax, 0xf5dc3b67
cmp eax, 0xb0e64e1e
je 0x140016970
mov eax, dword [0x141f2eaf8]
and eax, dword [0x141f2eafc]
xor eax, 0x1f35c9a
imul rcx, rax, 0xb8858f7
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
cmp eax, 0xb60d827c
jne 0x1400169c0
lock dec qword [rsi + 8]
nop dword [rax + rax]
mov ecx, dword [0x141f2eb00]
or ecx, dword [0x141f2eb04]
and ecx, 0x2233884
mov rax, 0xffffffffffffffff
lock xadd qword [rsi + 8], rax
cmp ecx, 0x2d5fb836
je 0x1400169c0
nop word [rax + rax]
mov ecx, dword [0x141f2eb08]
or ecx, dword [0x141f2eb0c]
or ecx, 0xb6a80106
imul ecx, ecx, 0x7c5c56ab
add ecx, 0xe80607ee
cmp ecx, 0x788b9fc0
jb 0x1400169f0
cmp rax, 1
jne 0x140016a80
mov eax, dword [0x141f2eb10]
sub eax, dword [0x141f2eb14]
add eax, 0xdebf0cde
mov ecx, 0xb55f0af7
imul rcx, rax
shr rcx, 0x3e
or ecx, 0xed1520c0
cmp ecx, 0x69a41872
jb 0x140016a6b
mov eax, dword [0x141f2eb18]
imul eax, dword [0x141f2eb1c]
and eax, 0x1cfeec52
add eax, 0x4a560bbe
or eax, 0xe4abac1b
cmp eax, 0xf9ef6d78
jbe 0x140016a6d
jmp 0x140016a48
mov rcx, qword [0x141f49060]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov eax, dword [0x141f2eb20]
or eax, dword [0x141f2eb24]
add eax, 0x3002a9fb
or eax, 0x6c437826
imul eax, eax, 0x1f499173
cmp eax, 0x5a713c2b
jb 0x140016a80
add rsp, 0x20
pop rsi
ret
Function at 0x1400178a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, 0xfffffffffce18e10
sub rax, rdx
mov rdx, rax
rol rdx, 3
xor edx, eax
movzx eax, dx
add rax, rcx
nop dword [rax]
mov ecx, dword [0x141f2ed28]
add ecx, dword [0x141f2ed2c]
xor ecx, 0x40008012
and ecx, 0x6010c092
cmp ecx, 0x7b1fb60d
je 0x1400178c0
ret

Function at 0x1400179b0
Capabilities:
Encode data using xor

Disassembly:
inc rdx
nop word cs:[rax + rax]
mov eax, dword [0x141f2ed40]
xor eax, dword [0x141f2ed44]
and eax, 0x28563db8
xor eax, 0x98bcfb8a
imul rax, rax, 0x27478d4d
shr rax, 0x3c
cmp eax, 0xed5603fe
ja 0x1400179c0
mov rax, rdx
rol rax, 2
nop
mov r8d, dword [0x141f2ed48]
xor r8d, dword [0x141f2ed4c]
imul r8d, r8d, 0xce31055c
add r8d, 0x27aba758
cmp r8d, 0xad635a42
ja 0x1400179f0
xor eax, edx
movzx eax, ax
add rcx, rax
nop dword [rax]
mov eax, dword [0x141f2ed50]
xor edx, edx
div dword [0x141f2ed54]
imul eax, eax, 0x78e0b9f7
add eax, 0xed2b642e
xor eax, 0x166fb7c3
cmp eax, 0x690e1e2f
jb 0x140017a20
mov rax, rcx
ret

Function at 0x140017a50
Capabilities:
Encode data using xor

Disassembly:
movabs r9, 0xffffffff68a8408a
add r9, rdx
mov rax, rcx
mov r8d, 0x852c1627
mov rcx, r9
rol rcx, 5
xor rcx, r9
mov rdx, rcx
rol rdx, 7
nop word [rax + rax]
mov r9d, dword [0x141f2ed58]
xor r9d, dword [0x141f2ed5c]
imul r9d, r9d, 0x2856be5e
shr r9d, 1
imul r9, r8
shr r9, 0x3c
xor r9d, 0xb45c760f
cmp r9d, 0x53bfbead
jb 0x140017a80
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop dword [rax + rax]
mov ecx, dword [0x141f2ed60]
sub ecx, dword [0x141f2ed64]
add ecx, 0xbf07dd11
xor ecx, 0xe3a69b33
add ecx, 0x5849ee34
cmp ecx, 0x1a5ae865
jb 0x140017ac0
ret

Function at 0x140017b80
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov r8, rdx
rol r8, 4
xor r8, rdx
mov rcx, r8
rol rcx, 1
xor rcx, r8
mov rdx, rcx
rol rdx, 2
nop dword [rax]
mov r8d, dword [0x141f2ed70]
xor r8d, dword [0x141f2ed74]
xor r8d, 0xcc994abb
add r8d, 0x72f999c9
or r8d, 0xe868b50
cmp r8d, 0x3af1d00
je 0x140017ba0
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x140017ca0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, 0xffffffff81e527ce
sub rcx, rdx
nop dword [rax]
mov edx, dword [0x141f2ed90]
xor edx, dword [0x141f2ed94]
or edx, 0xb32c7022
and edx, 0xff2cf423
cmp edx, 0x5c0ed7da
jb 0x140017cb0
xor rcx, 0x40482dee
mov rdx, rcx
rol rdx, 1
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x140017da0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
add rdx, 0x266caab
mov rcx, rdx
shr rcx, 0xb
xor rcx, rdx
imul rcx, rcx, 0x1842a10
add rcx, 0xffffffffca9574aa
mov rdx, rcx
rol rdx, 1
nop dword [rax + rax]
mov r8d, dword [0x141f2eda8]
imul r8d, dword [0x141f2edac]
add r8d, 0x10067213
imul r9, r8, 0x601f583
shr r9, 0x20
sub r8d, r9d
shr r8d, 1
add r8d, r9d
shr r8d, 0x1c
or r8d, 0x569b8b6
cmp r8d, 0xf08f4f06
ja 0x140017dd0
nop
mov r8d, dword [0x141f2edb0]
or r8d, dword [0x141f2edb4]
imul r8d, r8d, 0x50b8247e
xor r8d, 0x6e2a2bb2
add r8d, 0xc6e9ee02
cmp r8d, 0x98f39888
jb 0x140017e10
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret
Function at 0x140017ef0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x141f2edd0]
xor edx, edx
div dword [0x141f2edd4]
imul rdx, r8, 0xffffffffdc90e7bb
mov rax, rdx
rol rax, 2
nop
mov r8d, dword [0x141f2edd8]
sub r8d, dword [0x141f2eddc]
add r8d, 0x510f4ab2
xor r8d, 0x6d113900
add r8d, 0x9a857526
cmp r8d, 0x8fb8d3ab
jb 0x140017f10
xor eax, edx
movzx eax, ax
add rcx, rax
nop word cs:[rax + rax]
mov eax, dword [0x141f2ede0]
sub eax, dword [0x141f2ede4]
or eax, 0xc0481b0
and eax, 0xe85abf8
xor eax, 0x2f07a2c6
cmp eax, 0x7413919d
ja 0x140017f50
nop word cs:[rax + rax]
mov eax, dword [0x141f2ede8]
sub eax, dword [0x141f2edec]
or eax, 0xe4855009
and eax, 0xf5cd7a9d
xor eax, 0xa39963ba
cmp eax, 0xd9eb77d3
ja 0x140017f80
mov rax, rcx
ret

Function at 0x140018190
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
rol rcx, 1
xor rcx, rdx
nop dword [rax]
mov edx, dword [0x141f2ee08]
xor edx, dword [0x141f2ee0c]
imul rdx, rdx, 0x23dd07fd
shr rdx, 0x3c
add edx, 0x699f220e
and edx, 0x408a2010
cmp edx, 0xc568a819
je 0x1400181a0
mov r8d, 0xc60ffc03
mov rdx, rcx
rol rdx, 5
xor rdx, rcx
mov rcx, rdx
rol rcx, 1
nop word cs:[rax + rax]
mov r9d, dword [0x141f2ee10]
sub r9d, dword [0x141f2ee14]
or r9d, 0xcb2eb039
imul r9d, r9d, 0xf6b01cff
imul r9, r8
shr r9, 0x3e
cmp r9d, 0xb66dd365
ja 0x1400181f0
xor ecx, edx
movzx ecx, cx
add rax, rcx
ret

Function at 0x1400182a0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
shr r8, 0x18
xor r8, rdx
mov rdx, r8
rol rdx, 2
mov rax, rcx
xor rdx, r8
mov r8d, 0x7562e3e1
sub r8, rdx
mov rcx, r8
rol rcx, 4
xor rcx, r8
nop word [rax + rax]
mov edx, dword [0x141f2ee18]
mov r8d, dword [0x141f2ee1c]
add edx, r8d
add edx, 0xf1f92912
or edx, 0xffa77bee
cmp edx, 0xe09ff3a0
je 0x1400182d0
mov rdx, rcx
rol rdx, 1
nop word [rax + rax]
mov r8d, dword [0x141f2ee20]
or r8d, dword [0x141f2ee24]
add r8d, 0x41843df9
xor r8d, 0x3d0cb0c1
cmp r8d, 0x54766330
ja 0x140018300
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop dword [rax]
mov ecx, dword [0x141f2ee28]
xor ecx, dword [0x141f2ee2c]
add ecx, 0xd7da7bda
and ecx, 0x8e92f5a7
cmp ecx, 0xb02f7628
ja 0x140018330
ret

Function at 0x140018360
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov r8d, 0xb7a3ac15
not rdx
mov rcx, rdx
shr rcx, 0xd
xor rcx, rdx
nop word cs:[rax + rax]
mov edx, dword [0x141f2ee30]
xor edx, dword [0x141f2ee34]
imul rdx, r8
shr rdx, 0x3c
or edx, 0xb1bf729d
add edx, 0x1f67873f
cmp edx, 0x5bb41adf
jb 0x140018380
mov rdx, 0xffffffffef28fb01
sub rdx, rcx
mov rcx, rdx
rol rcx, 6
nop dword [rax]
mov r8d, dword [0x141f2ee38]
xor r8d, dword [str.S3_]
imul r8d, r8d, 0xedf977f6
xor r8d, 0xf70d5a9f
add r8d, 0x91a933cc
cmp r8d, 0xaf46f086
jb 0x1400183c0
xor ecx, edx
movzx ecx, cx
add rax, rcx
ret
Function at 0x140018400
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0xffffffffc62df719
nop word [rax + rax]
mov ecx, dword [0x141f2ee40]
or ecx, dword [0x141f2ee44]
and ecx, 0xc806600a
or ecx, 0x3e19d75
imul ecx, ecx, 0x94649817
cmp ecx, 0x655694c3
jb 0x140018410
mov r8d, 0x9649fcf5
mov rcx, rdx
rol rcx, 3
nop word cs:[rax + rax]
mov r9d, dword [0x141f2ee48]
and r9d, dword [0x141f2ee4c]
imul r9d, r9d, 0x4e246877
add r9d, 0x5ed0f7d4
imul r9, r8
shr r9, 0x3f
cmp r9d, 0x6657f218
ja 0x140018450
xor rcx, rdx
imul rcx, rcx, 0xffffffffd7a89f85
add rcx, 0xfffffffffd7310af
mov rdx, rcx
rol rdx, 7
nop word cs:[rax + rax]
mov r8d, dword [0x141f2ee50]
xor r8d, dword [0x141f2ee54]
cmp r8d, 0x6a3e4c58
je 0x1400184a0
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x1400184c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
rol rcx, 3
xor rcx, rdx
nop dword [rax]
mov edx, dword [0x141f2ee58]
and edx, dword [0x141f2ee5c]
or edx, 0x31ab5f27
add edx, 0xe7df5b66
and edx, 0xba116380
cmp edx, 0x988b8562
ja 0x1400184d0
add rcx, 0xffffffffeb98a398
mov rdx, rcx
rol rdx, 7
nop word cs:[rax + rax]
mov r8d, dword [0x141f2ee60]
or r8d, dword [0x141f2ee64]
imul r8d, r8d, 0x84cc33e
and r8d, 0x9188c4f0
xor r8d, 0x82df759e
cmp r8d, 0x122f412d
jb 0x140018510
nop dword [rax]
mov r8d, dword [0x141f2ee68]
sub r8d, dword [0x141f2ee6c]
add r8d, 0xc4f327f
xor r8d, 0x5b02eda3
add r8d, 0x5fa9e752
cmp r8d, 0xcd6aa3af
ja 0x140018540
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x1400187f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
not rdx
imul rdx, rdx, 0x22d8496
mov rcx, rdx
rol rcx, 5
xor ecx, edx
movzx ecx, cx
add rax, rcx
nop dword [rax]
mov ecx, dword [0x141f2eea8]
or ecx, dword [0x141f2eeac]
and ecx, 0x7410579
add ecx, 0x8cb010a7
xor ecx, 0x68fc7da1
cmp ecx, 0xc2726a8d
jb 0x140018810
ret

Function at 0x140018a90
Capabilities:
Encode data using xor

Disassembly:
add rdx, 0xffffffffaf530b0f
mov r8d, 0xfd8c3eef
mov rax, rdx
rol rax, 5
xor rax, rdx
mov rdx, rax
rol rdx, 7
xor rdx, rax
mov r9, rdx
shr r9, 1
xor r9, rdx
nop word [rax + rax]
mov eax, dword [0x141f2eef0]
xor edx, edx
div dword [0x141f2eef4]
xor eax, 0xa8509c7
imul rax, r8
shr rax, 0x3d
or eax, 0x3a618108
cmp eax, 0xb43e9c57
ja 0x140018ac0
mov rax, r9
rol rax, 5
xor eax, r9d
movzx eax, ax
add rcx, rax
mov rax, rcx
ret

Function at 0x140018b90
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, 0xffffffff9766b922
sub rcx, rdx
mov rdx, rcx
rol rdx, 1
xor rdx, rcx
mov rcx, 0xffffffffc32d8512
sub rcx, rdx
mov rdx, rcx
rol rdx, 2
nop word [rax + rax]
mov r8d, dword [0x141f2ef08]
imul r8d, dword [0x141f2ef0c]
imul r8, r8, 0x4b4b2479
shr r8, 0x3d
xor r8d, 0xeeec33fe
imul r8d, r8d, 0x95fc55e9
cmp r8d, 0xb37f01d7
jb 0x140018bc0
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret