joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003b300
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rax, r8
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [r8 + 8]
xor edx, edx
nop word cs:[rax + rax]
test dl, dl
jne 0x14003b320
test rcx, rcx
je 0x14003b401
nop dword [rax]
mov ecx, dword [0x141f321f8]
or ecx, dword [0x141f321fc]
and ecx, 0xb4148eee
imul rcx, rcx, 0x2b1594e9
shr rcx, 0x39
or ecx, 0x821800ce
cmp ecx, 0x24de7a5c
jb 0x14003b330
mov r8, qword [rax]
mov rax, qword [rax + 0x10]
nop word cs:[rax + rax]
mov ecx, dword [0x141f32200]
sub ecx, dword [0x141f32204]
xor ecx, 0x2ca16084
and ecx, 0x3ce362c4
cmp ecx, 0x735c7975
ja 0x14003b370
test rax, rax
je 0x14003b45d
mov eax, dword [0x141f32208]
xor eax, dword [0x141f3220c]
and eax, 0xdf623704
imul rax, rax, 0x4bc643b
shr rax, 0x36
and eax, 0xd
cmp eax, 0xcdabca92
jne 0x14003b3d0
mov rax, qword [0x141f49060]
nop word cs:[rax + rax]
mov eax, dword [0x141f32210]
and eax, dword [0x141f32214]
and eax, 0x8400105
add eax, 0xfcd74b32
mov rcx, qword [0x141f49060]
cmp eax, 0xbb9abfcc
jb 0x14003b3d0
xor edx, edx
mov r9, rsi
call qword [0x1401082c8]
jmp 0x14003b46e
xor eax, eax
test al, al
je 0x14003b40e
movzx eax, byte [0x141f49078]
xor eax, eax
movzx ecx, byte [0x141f49078]
test al, al
jne 0x14003b410
xor ecx, ecx
mov rdx, rsi
call fcn.1400c6170
nop word cs:[rax + rax]
mov ecx, dword [0x141f32218]
sub ecx, dword [0x141f3221c]
imul ecx, ecx, 0x39d40b3f
add ecx, 0x29e3e21e
imul rcx, rcx, 0x1c72e687
shr rcx, 0x3c
cmp ecx, 0x513a0e18
ja 0x14003b430
jmp 0x14003b46e
movzx eax, byte [0x141f49078]
xor ecx, ecx
mov rdx, rsi
call fcn.1400c6170
mov ecx, dword [0x141f32220]
sub ecx, dword [0x141f32224]
add ecx, 0xe7fd3c52
imul rdx, rcx, 0x2d3535c1
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1f
imul ecx, ecx, 0xf3c32da6
cmp ecx, 0xe555c813
jbe 0x14003b4be
xor ecx, ecx
test rax, rax
mov edx, 1
cmovne rdx, rax
sete cl
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rsi
mov qword [rdi], rcx
mov ecx, 1
nop word cs:[rax + rax]
mov edx, dword [0x141f32228]
add edx, dword [0x141f3222c]
xor edx, 0xc62ec3fc
add edx, 0x3451b098
imul rdx, rdx, 0x1fdbb05d
shr rdx, 0x3a
xor r8d, r8d
test rax, rax
sete r8b
mov r9, rax
cmove r9, rcx
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], rsi
mov qword [rdi], r8
cmp edx, 0x5401027
ja 0x14003b4d0
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14008e020
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov r8, rdx
mov eax, dword [0x141f3be40]
imul eax, dword [0x141f3be44]
imul eax, eax, 0xc60a385
add eax, 0x33384a24
and eax, 0xa89b1c8d
cmp eax, 0xa22afa35
jae 0x14008e05c
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
xor edx, edx
nop
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rsi, rsp
test dl, dl
jne 0x14008e060
mov qword [rsi], rcx
mov qword [rsi + 8], 0
sub rsp, 0x20
lea rdx, [0x141f255c0]
mov rcx, rsi
call fcn.140055bc0
add rsp, 0x20
mov rsi, qword [rsi + 8]
nop word [rax + rax]
mov ecx, dword [0x141f3be48]
and ecx, dword [0x141f3be4c]
xor ecx, 0x30000051
or ecx, 0x462c35a4
cmp ecx, 0xef3fedcd
ja 0x14008e0a0
test al, al
je 0x14008e100
nop word cs:[rax + rax]
mov eax, dword [0x141f3bec8]
xor eax, dword [0x141f3becc]
and eax, 0x6e9b4024
imul eax, eax, 0x1834546a
or eax, 0xbee20120
cmp eax, 0xb391b9ea
jb 0x14008e0d0
test rsi, rsi
jne 0x14008e19f
ud2
mov eax, dword [0x141f3be50]
sub eax, dword [0x141f3be54]
imul eax, eax, 0x7d6c448b
add eax, 0x665d7f1f
cmp eax, 0x86aa4326
jb 0x14008e100
test rsi, rsi
je 0x14008e19d
nop word cs:[rax + rax]
mov eax, dword [0x141f3be58]
xor eax, dword [0x141f3be5c]
add eax, 0xe2435929
xor eax, 0x5394740d
cmp eax, 0x29fb4616
jb 0x14008e130
mov eax, 0x953dc96f
nop word cs:[rax + rax]
mov ecx, dword [0x141f3be60]
or ecx, dword [0x141f3be64]
xor ecx, 0x6a2f7e08
imul rcx, rax
shr rcx, 0x3d
or ecx, 0xcaff8e4
cmp ecx, 0xb8f9d899
ja 0x14008e160
mov eax, esi
and eax, 3
lea rcx, [0x141f268f4]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
xor esi, esi
mov eax, 0x9ccee03d
nop word cs:[rax + rax]
mov ecx, dword [0x141f3bed0]
xor ecx, dword [0x141f3bed4]
and ecx, 0xc0c3b2d6
imul rcx, rax
shr rcx, 0x3c
cmp ecx, 0xd256abf3
je 0x14008e1b0
mov rax, rsi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret

Function at 0x14008e440
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov eax, 0xb3891d47
nop
mov edx, dword [0x141f3bed8]
xor edx, dword [0x141f3bedc]
add edx, 0x1df97ee0
shr edx, 1
imul rdx, rax
shr rdx, 0x3d
imul edx, edx, 0x2af2f2ef
cmp edx, 0x2dede1a5
ja 0x14008e450
test rcx, rcx
je 0x14008e740
nop word cs:[rax + rax]
mov eax, dword [0x141f3bee8]
or eax, dword [0x141f3beec]
add eax, 0x705b3f56
and eax, 0x22e9b6d9
imul eax, eax, 0x705e8976
cmp eax, 0xcd00f304
je 0x14008e490
nop word cs:[rax + rax]
mov eax, dword [0x141f3bef0]
xor edx, edx
div dword [0x141f3bef4]
cmp eax, 0x8ed6adb5
je 0x14008e4c0
mov r8d, ecx
and r8d, 3
nop dword [rax]
mov eax, dword [0x141f3bef8]
xor edx, edx
div dword [0x141f3befc]
imul eax, eax, 0x8157e29a
add eax, 0xe14d49e3
cmp eax, 0x5ae7513f
jb 0x14008e4e0
lea rax, [0x141f26904]
movsxd rdx, dword [rax + r8*4]
add rdx, rax
jmp rdx
mov eax, dword [0x141f3bee0]
xor eax, dword [0x141f3bee4]
add eax, 0x291068ba
or eax, 0xfc3c967
xor eax, 0x7853d1fc
cmp eax, 0x86ad2348
ja 0x14008e740
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1400a5600
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
nop dword [rax + rax]
mov eax, dword [0x141f3f060]
xor edx, edx
div dword [0x141f3f064]
and eax, 0xa88beac7
imul rax, rax, 0x14c973d9
shr rax, 0x39
cmp eax, 0xb8655e8d
je 0x1400a5610
mov eax, dword [0x141f3f068]
xor edx, edx
div dword [0x141f3f06c]
nop word cs:[rax + rax]
mov eax, dword [0x141f3f070]
xor eax, dword [0x141f3f074]
xor eax, 0x41404c
and eax, 0xa57f06c
imul rax, rax, 0x6858837
shr rax, 0x34
cmp eax, 0x521c46a9
je 0x1400a5650
cmp qword [rsi + 0x18], 0
je 0x1400a5730
mov rdi, qword [rsi + 0x20]
mov rbx, qword [0x141f49060]
mov eax, dword [0x141f3f078]
and eax, dword [0x141f3f07c]
xor eax, 0x384c0ee5
imul eax, eax, 0x2470d381
or eax, 0xcfd83073
cmp eax, 0x23f93bb2
jb 0x1400a56e4
mov eax, dword [0x141f3f080]
add eax, dword [0x141f3f084]
xor eax, 0xdc011564
imul ebp, eax, 0xf76dbdf9
or ebp, 0x7b5ecbe8
mov rcx, rbx
xor edx, edx
mov r8, rdi
call qword [0x1401082d0]
cmp ebp, 0x1b698a38
jae 0x1400a56f4
mov rcx, rbx
xor edx, edx
mov r8, rdi
call qword [0x1401082d0]
jmp 0x1400a56b1
mov eax, 0xa53b3dd1
nop dword [rax]
mov ecx, dword [0x141f3f088]
and ecx, dword [0x141f3f08c]
imul ecx, ecx, 0xd8b369f6
add ecx, 0x37e28f26
imul rcx, rax
shr rcx, 0x3c
cmp ecx, 0x7275845e
ja 0x1400a5700
nop dword [rax + rax]
mov eax, dword [0x141f3f090]
xor edx, edx
div dword [0x141f3f094]
and eax, 0x4df085a
cmp eax, 0xd818e34f
je 0x1400a5730
cmp rsi, 0xffffffffffffffff
je 0x1400a5793
lock dec qword [rsi + 8]
jne 0x1400a5793
mov rcx, qword [0x141f49060]
xor edx, edx
mov r8, rsi
call qword [0x1401082d0]
nop dword [rax]
mov eax, dword [0x141f3f098]
and eax, dword [0x141f3f09c]
imul eax, eax, 0xc74e6856
add eax, 0x1da74bac
or eax, 0x268b58e8
cmp eax, 0xf583ccab
je 0x1400a5770
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400a79a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov eax, dword [0x141f3f540]
add eax, dword [0x141f3f544]
xor eax, 0x2030301
or eax, 0xcc6cd0ae
imul eax, eax, 0x27dae70a
cmp eax, 0x6d793dbc
ja 0x1400a79ef
mov esi, dword [0x141f3f548]
imul esi, dword [0x141f3f54c]
add esi, 0x94a89955
or esi, 0x18942213
call qword [0x140108150]
cmp esi, 0xc8a9f533
jae 0x1400a7a00
call qword [0x140108150]
jmp 0x1400a79c8
mov ecx, dword [0x141f3f550]
add ecx, dword [0x141f3f554]
imul ecx, ecx, 0xfc27ee12
or ecx, 0x4cecdcd2
xor ecx, 0x76a17651
cmp ecx, 0xd38d2768
ja 0x1400a7a00
nop word cs:[rax + rax]
mov ecx, dword [0x141f3f558]
sub ecx, dword [0x141f3f55c]
xor ecx, 0xf7930b69
imul ecx, ecx, 0x52c4f7b2
cmp ecx, 0x56dde3a7
jb 0x1400a7a30
test eax, eax
je 0x1400a7a55
int3
add rsp, 0x20
pop rsi
ret

Function at 0x1400c6170
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov edi, ecx
mov eax, dword [0x141f42ba0]
xor eax, dword [0x141f42ba4]
xor eax, 0x10081420
or eax, 0xe7c5631f
add eax, 0x67d4321c
cmp eax, 0x13495b46
jae 0x1400c61b0
mov rax, qword [0x141f49060]
nop dword [rax]
mov eax, dword [0x141f42ba8]
add eax, dword [0x141f42bac]
or eax, 0x97f097b5
imul eax, eax, 0xa711b235
add eax, 0x93e8fb4d
mov rbx, qword [0x141f49060]
cmp eax, 0x80a164ba
ja 0x1400c61b0
nop word [rax + rax]
mov eax, dword [0x141f42bb0]
xor eax, dword [0x141f42bb4]
imul eax, eax, 0xee9a24db
and eax, 0xb4ebac4d
add eax, 0xca50cfab
cmp eax, 0x51548c62
jb 0x1400c61e0
mov eax, 0xdf1f99d9
nop dword [rax + rax]
mov ecx, dword [0x141f42bb8]
add ecx, dword [0x141f42bbc]
imul rcx, rax
shr rcx, 0x3d
imul ecx, ecx, 0x53f3de5
xor ecx, 0x109485e8
cmp ecx, 0xec98a27
ja 0x1400c6210
test rbx, rbx
je 0x1400c62b3
mov eax, dword [0x141f42bd0]
xor edx, edx
div dword [0x141f42bd4]
or eax, 0x2e3a95a6
add eax, 0xbda72c50
and eax, 0x32e10a12
cmp eax, 0xf01312b4
jbe 0x1400c626f
mov rcx, rbx
mov edx, edi
mov r8, rsi
call qword [0x1401082b8]
mov r14, qword [0x1401082b8]
nop word cs:[rax + rax]
mov eax, dword [0x141f42bd8]
imul eax, dword [0x141f42bdc]
xor eax, 0x95906f1c
imul r15, rax, 0x1a40bcb
shr r15, 0x38
mov rcx, rbx
mov edx, edi
mov r8, rsi
call r14
cmp r15d, 0xc3895e99
je 0x1400c6280
jmp 0x1400c6305
mov eax, dword [0x141f42bc0]
add eax, dword [0x141f42bc4]
or eax, 0xc1dabea7
add eax, 0x6e9ae0b1
xor eax, 0x65cf7363
cmp eax, 0xbc56f8e7
ja 0x1400c6346
mov ebx, dword [0x141f42bc8]
and ebx, dword [0x141f42bcc]
or ebx, 0x60a40c0
xor ebx, 0x40028080
or ebx, 0xb8d43f1e
mov ecx, edi
mov rdx, rsi
call fcn.140101e60
cmp ebx, 0x27f537e4
je 0x1400c62d5
mov ecx, 0x97f53155
nop word [rax + rax]
mov edx, dword [0x141f42be0]
and edx, dword [0x141f42be4]
imul edx, edx, 0xb01c8d2e
shr edx, 1
imul rdx, rcx
shr rdx, 0x3c
add edx, 0x6a1402ea
cmp edx, 0x19558232
jb 0x1400c6310
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, edi
mov rdx, rsi
call fcn.140101e60
jmp 0x1400c62d5
Function at 0x1400d0730
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov eax, dword [0x141f44398]
xor eax, dword [0x141f4439c]
mov rdi, qword [rcx + 0x10]
add eax, 0x8b2dc4fd
and eax, 0x2508a200
cmp eax, 0x1cb824e3
jbe 0x1400d0765
mov rcx, rdi
call qword [0x1401082b0]
mov rbx, qword [0x1401082b0]
xor ebp, ebp
nop
mov rcx, rdi
call rbx
test bpl, bpl
jne 0x1400d0770
test eax, eax
jne 0x1400d07e0
mov eax, dword [0x141f443a0]
add eax, dword [0x141f443a4]
xor eax, 0xab45620
and eax, 0x4eb65637
cmp eax, 0xf20f3e1d
jne 0x1400d07a1
call qword [0x1401082a8]
mov rdi, qword [0x1401082a8]
nop dword [rax + rax]
mov eax, dword [0x141f443a8]
xor edx, edx
div dword [0x141f443ac]
and eax, 0xab324d95
imul ebx, eax, 0xd24ae379
call rdi
cmp ebx, 0x25c1793e
je 0x1400d07b0
nop word cs:[rax + rax]
mov eax, dword [0x141f443b0]
and eax, dword [0x141f443b4]
imul rax, rax, 0x255aaf1
shr rax, 0x39
imul eax, eax, 0x7a7e53ca
add eax, 0x76aabfc9
cmp eax, 0x94ff873b
jb 0x1400d07e0
cmp rsi, 0xffffffffffffffff
je 0x1400d08e0
mov rcx, 0xffffffffffffffff
lock xadd qword [rsi + 8], rcx
mov eax, dword [0x141f443b8]
xor edx, edx
div dword [0x141f443bc]
or eax, 0x18e80de3
imul eax, eax, 0xc228a314
cmp eax, 0xc76015cf
je 0x1400d0820
cmp rcx, 1
jne 0x1400d08e0
mov eax, dword [0x141f443c0]
or eax, dword [0x141f443c4]
and eax, 0xe53cf1f3
cmp eax, 0xf1262d41
je 0x1400d089b
mov eax, dword [0x141f443c8]
imul eax, dword [0x141f443cc]
imul edi, eax, 0x3a431037
and edi, 0x1702957b
add edi, 0x585c5707
mov rcx, qword [0x141f49060]
xor edx, edx
mov r8, rsi
call qword [0x1401082d0]
cmp edi, 0x1ff0c480
jae 0x1400d08b0
mov rcx, qword [0x141f49060]
xor edx, edx
mov r8, rsi
call qword [0x1401082d0]
jmp 0x1400d0862
mov eax, dword [0x141f443d0]
and eax, dword [0x141f443d4]
or eax, 0xdf254208
add eax, 0x56b7f5bf
xor eax, 0x7dafd7a8
cmp eax, 0x30cb9f47
jb 0x1400d08b0
nop word cs:[rax + rax]
mov eax, dword [0x141f443d8]
imul eax, dword [0x141f443dc]
add eax, 0x535fb34b
or eax, 0x891
and eax, 0x21c5a9f
cmp eax, 0xdc7e599f
ja 0x1400d08e0
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400dc190
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
call qword [0x1401082c0]
mov rdi, rax
inc rax
cmp rax, 2
jb 0x1400dc298
mov eax, dword [0x141f45c20]
xor edx, edx
div dword [0x141f45c24]
shr eax, 2
imul rax, rax, 0x2a577243
shr rax, 0x38
add eax, 0x52039414
or eax, 0x4e0284ad
cmp eax, 0xe5217f4c
ja 0x1400dc211
mov eax, dword [0x141f45c28]
xor edx, edx
div dword [0x141f45c2c]
or eax, 0xc100b108
and eax, 0xd382b10d
imul ebx, eax, 0x724f840a
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [0x1401082d0]
cmp ebx, 0x85e6df2a
jne 0x1400dc221
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [0x1401082d0]
jmp 0x1400dc1dd
mov ecx, eax
nop word cs:[rax + rax]
mov eax, dword [0x141f45c30]
xor edx, edx
div dword [0x141f45c34]
imul rdx, rax, 0x4998ce93
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1d
add eax, 0x17fd5d2d
xor eax, 0xa6ad0407
cmp eax, 0x4a83214f
jb 0x1400dc230
nop word cs:[rax + rax]
mov eax, dword [0x141f45c38]
add eax, dword [0x141f45c3c]
imul rax, rax, 0x63f5f8f
shr rax, 0x38
imul eax, eax, 0xe4c9a79c
cmp eax, 0x831493b9
je 0x1400dc270
test ecx, ecx
jne 0x1400dc2f8
mov eax, dword [0x141f45c40]
or eax, dword [0x141f45c44]
and eax, 0xe61a5358
add eax, 0xb2e719d4
or eax, 0x775433ab
cmp eax, 0x517e4623
jae 0x1400dc2c0
call qword [0x1401082a8]
mov rsi, qword [0x1401082a8]
nop word [rax + rax]
mov eax, dword [0x141f45c48]
xor eax, dword [0x141f45c4c]
imul edi, eax, 0x9ad5e17d
add edi, 0xe5dfddd
and edi, 0xe6310bb
call rsi
cmp edi, 0x83d138b0
je 0x1400dc2d0
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400dd4a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
test cl, cl
je 0x1400ddc70
mov rsi, r9
mov rdi, r8
mov rbx, rdx
movzx eax, cl
cmp eax, 1
je 0x1400dd55f
cmp eax, 2
jne 0x1400dd600
nop word cs:[rax + rax]
mov eax, dword [0x141f45ea8]
add eax, dword [0x141f45eac]
or eax, 0x7b9ada2b
imul eax, eax, 0x360f78ec
cmp eax, 0x66e1a951
jb 0x1400dd4e0
mov rax, qword [rsi]
movabs rcx, 0x8000000000000000
nop dword [rax + rax]
mov edx, dword [0x141f45eb0]
and edx, dword [0x141f45eb4]
add edx, 0x8a47f7c9
and edx, 0x79414cd9
cmp edx, 0xf01775ac
ja 0x1400dd510
mov edx, dword [0x141f45eb8]
add edx, dword [0x141f45ebc]
xor edx, 0x75cd903
add edx, 0x2926b742
and edx, 0x92858359
cmp edx, 0xa97ab228
je 0x1400dd530
cmp rax, rcx
jne 0x1400ddc70
lea rcx, [rsp + 0x20]
mov rdx, rbx
mov r8, rdi
call fcn.140092290
movzx ecx, byte [rsp + 0x20]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x40]
nop
mov eax, dword [0x141f45ec0]
add eax, dword [0x141f45ec4]
xor eax, 0x42024040
and eax, 0xd2434040
imul eax, eax, 0x82481d43
cmp eax, 0x6a43a59e
jb 0x1400dd580
cmp ecx, 6
ja 0x1400ddacd
mov eax, ecx
lea rdx, [0x141f274f4]
movsxd r10, dword [rdx + rax*4]
add r10, rdx
mov rdx, rdi
mov rax, rbx
jmp r10
mov eax, dword [0x141f45ea0]
or eax, dword [0x141f45ea4]
xor eax, 0x99032d11
imul eax, eax, 0xfcfed0e2
or eax, 0x4aaec4ce
cmp eax, 0x375b1afd
je 0x1400dd600
jmp 0x1400dda17
ud2
xor eax, eax
nop
test al, al
jne 0x1400ddad0
jmp 0x1400dda17
mov eax, dword [0x141f45f08]
imul eax, dword [0x141f45f0c]
xor eax, 0xc0810048
or eax, 0x7a4e97
add eax, 0xcf3c1115
cmp eax, 0xb387b1
jb 0x1400ddc70
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400de000
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov edi, edx
mov rsi, rcx
nop word cs:[rax + rax]
mov eax, dword [0x141f46020]
xor eax, dword [0x141f46024]
add eax, 0xa16d759e
or eax, 0x10610400
and eax, 0x11750784
cmp eax, 0x54d7f7b1
je 0x1400de020
mov r14d, edi
shr r14d, 8
mov ebp, edi
shr ebp, 0x10
mov rbx, qword [rsi + 0x10]
nop word cs:[rax + rax]
mov eax, dword [0x141f46028]
imul eax, dword [0x141f4602c]
imul eax, eax, 0x978711ae
cmp eax, 0xf6797ae4
je 0x1400de060
mov rcx, qword [rsi]
cmp rbx, rcx
jne 0x1400de0bc
mov rcx, rsi
call fcn.1400f4700
nop word [rax + rax]
mov eax, dword [0x141f46030]
imul eax, dword [0x141f46034]
or eax, 0x5c4a1576
add eax, 0x8b404750
imul rax, rax, 0x9d2e47f
shr rax, 0x3b
cmp eax, 0x9ef8615d
ja 0x1400de090
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
mov byte [rax + rbx], dil
lea rdx, [rbx + 1]
mov qword [rsi + 0x10], rdx
cmp rdx, rcx
jne 0x1400de149
xor eax, eax
test al, al
je 0x1400de0e0
mov rcx, rsi
call fcn.1400f4700
nop
mov r15d, dword [0x141f46038]
or r15d, dword [0x141f4603c]
or r15d, 0xc4531e0
add r15d, 0xb91faa43
and r15d, 0x3058640a
mov rcx, rsi
call fcn.1400f4700
cmp r15d, 0x72063cf1
ja 0x1400de0e0
mov rax, qword [rsi + 8]
nop dword [rax + rax]
mov ecx, dword [0x141f46040]
sub ecx, dword [0x141f46044]
or ecx, 0x440000d2
and ecx, 0x46838eda
add ecx, 0x410186b
cmp ecx, 0xc1485b53
ja 0x1400de120
mov rcx, qword [rsi]
mov byte [rax + rbx + 1], r14b
lea rdx, [rbx + 2]
mov qword [rsi + 0x10], rdx
cmp rdx, rcx
jne 0x1400de1c6
xor eax, eax
test al, al
jne 0x1400de195
mov eax, dword [0x141f46048]
imul eax, dword [0x141f4604c]
imul eax, eax, 0xda067a5d
xor eax, 0x399f6844
imul r14, rax, 0x2e36c7a9
shr r14, 0x3c
mov rcx, rsi
call fcn.1400f4700
cmp r14d, 0x80f6836a
jbe 0x1400de1a0
mov rcx, rsi
call fcn.1400f4700
jmp 0x1400de161
mov eax, dword [0x141f46050]
or eax, dword [0x141f46054]
or eax, 0x6e6493ba
xor eax, 0x6bb52e3c
add eax, 0x6f1e5e48
cmp eax, 0x5e4e69f0
jb 0x1400de1a0
mov rax, qword [rsi + 8]
mov ecx, dword [0x141f46058]
and ecx, dword [0x141f4605c]
and ecx, 0x5e5cb85d
imul ecx, ecx, 0xeb23d55c
add ecx, 0x683da80c
cmp ecx, 0x44559ec5
jae 0x1400de1f9
mov byte [rax + rbx + 2], bpl
lea rcx, [rbx + 3]
mov qword [rsi + 0x10], rcx
lea rcx, [rbx + 3]
nop dword [rax]
mov edx, dword [0x141f46060]
or edx, dword [0x141f46064]
and edx, 0x3e7f58ef
imul edx, edx, 0xa8863e6e
add edx, 0xfac8724
mov byte [rax + rbx + 2], bpl
mov qword [rsi + 0x10], rcx
cmp edx, 0x7cb083e1
ja 0x1400de200
cmp rcx, qword [rsi]
jne 0x1400de23c
mov rcx, rsi
call fcn.1400f4700
shr edi, 0x18
mov rax, qword [rsi + 8]
mov byte [rax + rbx + 3], dil
add rbx, 4
mov qword [rsi + 0x10], rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400e37d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [r8 + 8]
mov rax, r8
mov rdi, rdx
nop word cs:[rax + rax]
mov edx, dword [0x141f46d88]
imul edx, dword [0x141f46d8c]
imul edx, edx, 0xfb0398a5
and edx, 0xd56a912e
cmp edx, 0x91e38d47
je 0x1400e37f0
test rcx, rcx
je 0x1400e3890
mov r8, qword [rax]
mov rcx, qword [rax + 0x10]
nop dword [rax]
mov eax, dword [0x141f46d90]
xor edx, edx
div dword [0x141f46d94]
imul eax, eax, 0x7e84ef56
or eax, 0xb0eb4511
cmp eax, 0x84508dba
je 0x1400e3820
test rcx, rcx
je 0x1400e38e0
mov rcx, qword [0x141f49060]
xor edx, edx
mov r9, rdi
call qword [0x1401082c8]
nop dword [rax + rax]
mov ecx, dword [0x141f46db0]
sub ecx, dword [0x141f46db4]
add ecx, 0x2b6e3220
xor ecx, 0x17ebdc83
cmp ecx, 0x8d186006
ja 0x1400e3860
jmp 0x1400e3a08
mov eax, dword [0x141f46db8]
and eax, dword [0x141f46dbc]
add eax, 0xdc94491f
or eax, 0x2fcc44c
cmp eax, 0x1c90c28a
jb 0x1400e3890
test rdi, rdi
je 0x1400e394b
movzx eax, byte [0x141f49078]
mov eax, dword [0x141f46dc0]
or eax, dword [0x141f46dc4]
add eax, 0xcad92f82
cmp eax, 0x82cc9272
jb 0x1400e3985
jmp 0x1400e3955
mov eax, dword [0x141f46d98]
or eax, dword [0x141f46d9c]
add eax, 0xb344e072
and eax, 0x71864591
imul rax, rax, 0xdd76bbd
shr rax, 0x3a
cmp eax, 0xce83848f
ja 0x1400e38e0
nop dword [rax + rax]
mov eax, dword [0x141f46da0]
xor eax, dword [0x141f46da4]
imul eax, eax, 0xafd28455
and eax, 0x2cf29b1e
add eax, 0x181d24b5
cmp eax, 0xc4fd12bd
ja 0x1400e3910
test rdi, rdi
je 0x1400e394b
movzx eax, byte [0x141f49078]
xor eax, eax
test al, al
jne 0x1400e39fc
jmp 0x1400e39c8
mov eax, 2
jmp 0x1400e3a08
mov ebx, dword [0x141f46dc8]
or ebx, dword [0x141f46dcc]
and ebx, 0x8b211018
or ebx, 0x409eada7
xor ebx, 0xae2472a2
xor ecx, ecx
mov rdx, rdi
call fcn.1400c6170
cmp ebx, 0xdc51bef6
jbe 0x1400e39a0
xor ecx, ecx
mov rdx, rdi
call fcn.1400c6170
jmp 0x1400e3955
mov ecx, dword [0x141f46dd0]
add ecx, dword [0x141f46dd4]
imul ecx, ecx, 0x1d496298
add ecx, 0xc6704468
or ecx, 0xcb712d75
cmp ecx, 0x4bea4bb6
jb 0x1400e39a0
jmp 0x1400e3a08
mov eax, dword [0x141f46da8]
xor edx, edx
div dword [0x141f46dac]
shr eax, 6
imul rbx, rax, 0x42cdcb1
shr rbx, 0x31
add ebx, 0xf338b42
xor ecx, ecx
mov rdx, rdi
call fcn.1400c6170
cmp ebx, 0x4980a53a
jbe 0x1400e3a08
xor ecx, ecx
mov rdx, rdi
call fcn.1400c6170
jmp 0x1400e39c8
xor ecx, ecx
test rax, rax
mov edx, 2
cmovne rdx, rax
sete cl
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rdi
mov qword [rsi], rcx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400f5218
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x1401082e0]
test rax, rax
je 0x1400f5262
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400f5262
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400f5262
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400f5262
cmp dword [rcx + 0x84], 0xe
jbe 0x1400f5262
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400f5264
xor al, al
add rsp, 0x28
ret
Function at 0x140101e60
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov edi, ecx
call qword [0x1401082c0]
mov ecx, 0xcc4cfe09
nop word cs:[rax + rax]
mov edx, dword [0x141f42be8]
add edx, dword [0x141f42bec]
imul rdx, rcx
shr rdx, 0x38
imul edx, edx, 0x3f73d856
add edx, 0xb14c799c
cmp edx, 0xae295437
ja 0x140101e80
mov ecx, 0xc67e647d
nop dword [rax]
mov edx, dword [0x141f42bf0]
or edx, dword [0x141f42bf4]
and edx, 0x99bec08f
xor edx, 0x453b69b5
imul rdx, rcx
shr rdx, 0x3c
cmp edx, 0x55af13f2
ja 0x140101eb0
test rax, rax
je 0x140101f67
mov ecx, dword [0x141f42bf8]
and ecx, dword [0x141f42bfc]
xor ecx, 0x4a9116f2
imul ecx, ecx, 0x32426ee8
or ecx, 0xb3bbfb16
cmp ecx, 0xadd9c1a7
jae 0x140101f10
mov qword [0x141f49060], rax
nop
mov ecx, dword [0x141f42c00]
imul ecx, dword [0x141f42c04]
imul ecx, ecx, 0x78025f7
mov qword [0x141f49060], rax
cmp ecx, 0x63834bc7
je 0x140101f10
mov rcx, rax
mov edx, edi
mov r8, rsi
call qword [0x1401082b8]
mov rcx, rax
nop word cs:[rax + rax]
mov eax, dword [0x141f42c08]
xor edx, edx
div dword [0x141f42c0c]
cmp eax, 0x16aeddd6
je 0x140101f50
jmp 0x140101f70
xor ecx, ecx
nop dword [rax]
mov eax, dword [0x141f42c10]
sub eax, dword [0x141f42c14]
xor eax, 0x3ba7ec64
add eax, 0xe82fa8d4
and eax, 0x3536db45
cmp eax, 0x41194c63
ja 0x140101f70
mov rax, rcx
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140105f54
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov eax, dword [0x141f45ce8]
or eax, dword [0x141f45cec]
add eax, 0xa269fbb2
or eax, 0x93629c1a
mov ecx, 0xdd06e74f
xor edx, edx
div ecx
cmp eax, 0xce86d437
je 0x140105fa3
mov eax, dword [0x141f45cf0]
xor edx, edx
div dword [0x141f45cf4]
add eax, 0x1714bcb5
xor eax, 0x1d13307
mov ecx, dword [0x141f49070]
cmp eax, 0xc8ee6dad
jbe 0x140105fab
mov eax, dword [0x141f49070]
jmp 0x140105f7e
cmp ecx, 3
jne 0x140105fb5
add rsp, 0x48
ret
mov eax, dword [0x141f45cf8]
xor edx, edx
div dword [0x141f45cfc]
mov ecx, 0x439f74a2
xor edx, edx
div ecx
add eax, 0xac7530dd
mov ecx, 0x62250106
xor edx, edx
div ecx
cmp eax, 0xc6b80f31
ja 0x14010601b
mov eax, dword [0x141f45d00]
mov ecx, dword [0x141f45d04]
add eax, ecx
add eax, 0x561bf91b
and eax, 0x41839ce1
or eax, 0x2874010e
lea rcx, [0x141f49074]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x2f]
mov qword [rsp + 0x38], rcx
cmp eax, 0xc9178d32
jbe 0x140106033
lea rax, [0x141f49074]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2f]
mov qword [rsp + 0x38], rax
jmp 0x140105fe1
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x40]
mov qword [r8], rax
lea rcx, [0x141f49070]
lea r9, [0x141f25da0]
mov dl, 1
call fcn.1401005d0
mov eax, dword [0x141f45d08]
add eax, dword [0x141f45d0c]
xor eax, 0x585bdf9f
imul eax, eax, 0xae5d1dfb
or eax, 0x7da514f3
cmp eax, 0xda25262d
jb 0x140106055
jmp 0x140105fb0