joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140070140
Capabilities:
Encode data using xor

Disassembly:
vmovdqa ymm0, ymmword [rdx]
vpmuludq ymm0, ymm0, ymmword [r8]
nop dword [rax]
mov eax, dword [0x141dcddf0]
xor eax, dword [0x141dcddf4]
and eax, 0x808800
cmp eax, 0x678a09f4
je 0x140070150
mov eax, dword [0x141dcddf8]
or eax, dword [str.dPciOQ]
xor eax, 0x665ca88d
imul eax, eax, 0x97972cd
add eax, 0x8cb0dfde
cmp eax, 0x953ca295
ja 0x1400701b2
mov eax, dword [0x141dcde00]
xor eax, dword [0x141dcde04]
add eax, 0x462e97b0
and eax, 0xcfaea95
imul eax, eax, 0x180ac124
vmovdqa ymmword [rcx], ymm0
cmp eax, 0x2c2be92d
jae 0x1400701b8
vmovdqa ymmword [rcx], ymm0
jmp 0x14007018b
vzeroupper
ret

Function at 0x140070200
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x141dcde10]
sub eax, dword [0x141dcde14]
xor eax, 0x5c6202f0
or eax, 0xa3903501
imul eax, eax, 0xc301c82
cmp eax, 0xbad99351
ja fcn.140070200
vmovdqa ymm0, ymmword [r8]
vpaddq ymm0, ymm0, ymmword [rdx]
vmovdqa ymmword [rcx], ymm0
mov eax, dword [0x141dcde18]
xor eax, dword [0x141dcde1c]
imul eax, eax, 0x44818254
add eax, 0xb98edd72
cmp eax, 0xb56c6ce9
ja 0x140070230
vzeroupper
ret

Function at 0x140070360
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x141dcde48]
and eax, dword [0x141dcde4c]
and eax, 0xb08e8518
imul eax, eax, 0xdec44bf8
cmp eax, 0x239bfa1f
je fcn.140070360
vpermpd ymm0, ymmword [rdx], 0x4e
nop word cs:[rax + rax]
mov eax, dword [0x141dcde50]
xor eax, dword [0x141dcde54]
and eax, 0x88608083
or eax, 0x661b3640
imul eax, eax, 0xa7445377
cmp eax, 0xc485e7a6
ja 0x140070390
mov eax, dword [0x141dcde58]
or eax, dword [0x141dcde5c]
add eax, 0x31b70a6d
xor eax, 0x50d1ca96
mov edx, 0xea842935
imul rdx, rax
shr rdx, 0x3e
cmp edx, 0xd248f86e
jbe 0x1400703f0
vmovaps ymmword [rcx], ymm0
nop word cs:[rax + rax]
mov eax, dword [0x141dcde60]
or eax, dword [0x141dcde64]
add eax, 0x79be590
or eax, 0x481cac30
vmovaps ymmword [rcx], ymm0
cmp eax, 0x23c7c0c7
je 0x1400703f0
vzeroupper
ret

Function at 0x1400704e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x141dcde88]
and eax, dword [0x141dcde8c]
and eax, 0x688caca1
add eax, 0x3c517569
or eax, 0x5a81280b
vpermpd ymm0, ymmword [rdx], 2
cmp eax, 0xff4e1b22
jne 0x140070510
vmovaps ymmword [rcx], ymm0
nop dword [rax]
mov eax, dword [0x141dcde90]
imul eax, dword [0x141dcde94]
xor eax, 0x50003aa8
and eax, 0x53c4beb8
imul eax, eax, 0x6eee51a9
vmovaps ymmword [rcx], ymm0
cmp eax, 0xde8cf279
ja 0x140070510
vzeroupper
ret
Function at 0x140072610
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xc0
lea rbp, [rsp + 0x80]
and rsp, 0xffffffffffffffe0
mov r8, rdx
mov rsi, rcx
nop dword [rax]
mov eax, dword [0x141dce048]
and eax, dword [0x141dce04c]
xor eax, 0xec3e0439
add eax, 0x7bb5acf0
and eax, 0xfaa4542a
cmp eax, 0x74f4910a
jb 0x140072630
cmp byte [rsi + 0x228], 0
jne 0x14007274c
mov eax, dword [0x141dce050]
xor ecx, ecx
xor edx, edx
div dword [0x141dce054]
nop
test cl, cl
jne 0x140072670
mov rax, qword [rsi + 0x220]
nop dword [rax + rax]
mov ecx, dword [0x141dce058]
or ecx, dword [0x141dce05c]
xor ecx, 0x4b907cc4
imul ecx, ecx, 0x406fe
add ecx, 0xba761212
cmp ecx, 0x99e511d3
jb 0x140072680
test rax, rax
jne 0x14007274c
vmovdqu ymm0, ymmword [r8]
vmovdqu ymm1, ymmword [r8 + 0x20]
vpunpckhqdq ymm2, ymm0, ymm1
vpermq ymm2, ymm2, 0xd8
vpunpcklqdq ymm0, ymm0, ymm1
vpermq ymm0, ymm0, 0xd8
vpsrlq ymm1, ymm2, 0x28
vpbroadcastd ymm3, dword [0x140104c80]
vpor ymm1, ymm1, ymm3
vmovdqa ymmword [rsp + 0x40], ymm1
vpsrlq ymm1, ymm0, 0x2e
vpsllq ymm2, ymm2, 0x12
vpor ymm1, ymm2, ymm1
vpsrlq ymm3, ymm0, 0x1a
vpblendd ymm2, ymm3, ymm2, 0xaa
vpbroadcastq ymm3, qword [0x140104c88]
vpand ymm2, ymm2, ymm3
vmovdqa ymmword [rsp + 0x20], ymm2
vpsllq ymm1, ymm1, 0x1a
vpblendd ymm0, ymm0, ymm1, 0xaa
vpand ymm0, ymm0, ymm3
vmovdqa ymmword [rsp + 0x60], ymm0
mov eax, dword [0x141dce060]
or eax, dword [0x141dce064]
imul rax, rax, 0xa74a3cf
shr rax, 0x3b
xor eax, 0x7929165
cmp eax, 0xed5eb5e6
jbe 0x14007274e
jmp 0x1400727a3
ud2
mov eax, dword [0x141dce068]
or eax, dword [0x141dce06c]
imul eax, eax, 0xdade6fc6
mov edi, 0xaf384dab
imul rdi, rax
shr rdi, 0x3f
vmovaps ymm0, ymmword [rsp + 0x20]
vmovaps ymmword [rsp + 0x80], ymm0
vmovdqa ymm0, ymmword [rsp + 0x40]
vmovdqa ymmword [rsp + 0xa0], ymm0
lea rdx, [rsp + 0x60]
mov rcx, rsi
vzeroupper
call fcn.140071ed0
cmp edi, 0x90f9b561
jbe 0x1400727d6
vmovaps ymm0, ymmword [rsp + 0x20]
vmovaps ymmword [rsp + 0x80], ymm0
vmovdqa ymm0, ymmword [rsp + 0x40]
vmovdqa ymmword [rsp + 0xa0], ymm0
lea rdx, [rsp + 0x60]
mov rcx, rsi
vzeroupper
call fcn.140071ed0
jmp 0x14007274e
lea rsp, [rbp + 0x40]
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400730e0
Capabilities:
Encode data using xor

Disassembly:
mov r9, rdx
vmovups xmm0, xmmword [rdx]
mov eax, dword [0x141dce2b0]
xor edx, edx
div dword [0x141dce2b4]
nop word cs:[rax + rax]
mov eax, dword [0x141dce2b8]
imul eax, dword [0x141dce2bc]
xor eax, 0x1583e594
imul eax, eax, 0x2f925d87
or eax, 0xc84d3b93
cmp eax, 0x6cdeb70e
je 0x140073100
mov eax, dword [0x141dce2c0]
xor edx, edx
div dword [0x141dce2c4]
and eax, 0x424a3204
add eax, 0xadbc2459
cmp eax, 0x7af210ef
jae 0x140073170
vmovups xmm1, xmmword [r9 + 0x10]
vmovaps xmmword [rcx], xmm0
vmovaps xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], 0
mov rax, qword [r8]
mov qword [rcx + 0x28], rax
nop word cs:[rax + rax]
vmovups xmm1, xmmword [r9 + 0x10]
vmovaps xmmword [rcx], xmm0
vmovaps xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], 0
mov rax, qword [r8]
mov qword [rcx + 0x28], rax
mov eax, dword [0x141dce2c8]
and eax, dword [0x141dce2cc]
add eax, 0x32482b8b
xor eax, 0xe924fe9d
add eax, 0x7bad5623
cmp eax, 0xc4c0e604
jb 0x140073170
ret
Function at 0x140078470
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
nop dword [rax + rax]
mov eax, dword [0x141dcf1d0]
mov edx, dword [0x141dcf1d4]
add eax, edx
add eax, 0xf34a86d4
xor eax, 0x6ed802c8
add eax, 0xef7bf7c0
cmp eax, 0xa8f3ef3f
ja 0x140078480
mov rbx, qword [rcx]
xor eax, eax
test al, al
je 0x1400784c0
mov rax, qword [rbx + 0x80]
nop word cs:[rax + rax]
mov eax, dword [0x141dcf1d8]
or eax, dword [str.x_afbX_]
imul eax, eax, 0x1deec3b7
or eax, 0x5446541e
imul rax, rax, 0x51c92d31
shr rax, 0x3e
mov rsi, qword [rbx + 0x80]
cmp eax, 0x8517125e
je 0x1400784c0
and rsi, 0xfffffffffffffff8
cmp qword [rsi + 8], 0
je 0x14007850d
mov r8, qword [rsi]
mov rcx, qword [0x141dde6e0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x141dcf1e0]
add eax, dword [0x141dcf1e4]
or eax, 0x254b70ed
mov ecx, 0x84e0227f
imul rcx, rax
shr rcx, 0x3b
or ecx, 0x8e701063
cmp ecx, 0x6ab61623
jae 0x140078540
mov rax, qword [0x141dde6e0]
mov eax, 0xc0348253
nop word cs:[rax + rax]
mov ecx, dword [0x141dcf1e8]
imul ecx, dword [0x141dcf1ec]
or ecx, 0xca59bfe1
imul rcx, rax
shr rcx, 0x3f
or ecx, 0x97101074
mov rdi, qword [0x141dde6e0]
cmp ecx, 0x9db0f7a1
ja 0x140078550
mov eax, dword [0x141dcf1f0]
mov ecx, dword [0x141dcf1f4]
add eax, ecx
add eax, 0x4cf6c50e
and eax, 0x868302bd
imul rax, rax, 0x18461793
shr rax, 0x3a
cmp eax, 0x1337b5f6
ja 0x1400785d7
mov eax, dword [0x141dcf1f8]
xor eax, dword [0x141dcf1fc]
and eax, 0xe5639b4b
imul ebp, eax, 0xc3636562
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebp, 0x3db6b072
jne 0x1400785e7
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400785aa
cmp rbx, 0xffffffffffffffff
je 0x140078677
lea rax, [rbx + 8]
nop word cs:[rax + rax]
mov ecx, dword [0x141dcf200]
sub ecx, dword [0x141dcf204]
or ecx, 0x8000c5f6
xor ecx, 0x85f646dd
imul ecx, ecx, 0x6bb27d23
cmp ecx, 0x53f61926
jb 0x140078600
lock dec qword [rax]
sete al
nop dword [rax]
mov ecx, dword [0x141dcf208]
imul ecx, dword [0x141dcf20c]
or ecx, 0x7532b
add ecx, 0xb77a1566
and ecx, 0xbcd01
cmp ecx, 0x4a0f08e8
ja 0x140078630
test al, al
je 0x140078677
mov r8, qword [rbx - 8]
mov rcx, qword [0x141dde6e0]
xor edx, edx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140078ff0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
xor eax, eax
nop dword [rax]
test al, al
jne 0x140079000
mov eax, dword [0x141dcf388]
xor edx, edx
div dword [0x141dcf38c]
mov eax, 0xe6281279
nop word [rax + rax]
mov ecx, dword [str.hZ9Q]
and ecx, dword [0x141dcf394]
imul rcx, rax
shr rcx, 0x3d
xor ecx, 0x45e5c48e
imul rcx, rcx, 0x4659cd3f
shr rcx, 0x3c
cmp ecx, 0x4398aeb8
ja 0x140079020
mov rax, qword [rsi + 0x10]
cmp eax, 1
jne 0x14007914a
nop word [rax + rax]
mov eax, dword [0x141dcf398]
add eax, dword [0x141dcf39c]
and eax, 0xf4997fbf
cmp eax, 0xbe39abd1
je 0x140079060
mov rdi, qword [rsi + 0x18]
nop dword [rax]
mov eax, dword [0x141dcf3a0]
xor edx, edx
div dword [0x141dcf3a4]
imul eax, eax, 0x2ae0d80c
and eax, 0xf8c50844
add eax, 0x7d182f09
cmp eax, 0x205ad012
jb 0x140079080
mov rax, qword [rsi + 0x20]
mov byte [rdi], 0
test rax, rax
je 0x14007914a
mov eax, dword [0x141dcf3a8]
and eax, dword [0x141dcf3ac]
and eax, 0xe002500a
add eax, 0x40ba1188
cmp eax, 0x864061f1
jbe 0x1400790e0
mov rax, qword [0x141dde6e0]
nop dword [rax]
mov eax, dword [0x141dcf3b0]
sub eax, dword [0x141dcf3b4]
and eax, 0x800304
mov rbx, qword [0x141dde6e0]
cmp eax, 0x3cb41468
ja 0x1400790e0
mov eax, dword [0x141dcf3b8]
or eax, dword [0x141dcf3bc]
cmp eax, 0xe7de3b89
je 0x14007913a
mov eax, dword [0x141dcf3c0]
sub eax, dword [0x141dcf3c4]
imul ebp, eax, 0x37377e60
mov rcx, rbx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebp, 0xd70aaf27
jne 0x14007914a
mov rcx, rbx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140079112
cmp rsi, 0xffffffffffffffff
je 0x1400791e6
mov rcx, 0xffffffffffffffff
lock xadd qword [rsi + 8], rcx
mov eax, dword [0x141dcf3c8]
xor edx, edx
div dword [0x141dcf3cc]
nop
mov eax, dword [0x141dcf3d0]
xor edx, edx
div dword [0x141dcf3d4]
and eax, 0xa2940001
cmp eax, 0x9bea2c7c
je 0x140079170
cmp rcx, 1
jne 0x1400791e6
mov eax, dword [0x141dcf3d8]
and eax, dword [0x141dcf3dc]
cmp eax, 0x649d5177
jne 0x1400791b0
nop word cs:[rax + rax]
mov eax, dword [0x141dcf3e0]
xor edx, edx
div dword [0x141dcf3e4]
imul eax, eax, 0x93eee10b
cmp eax, 0x8b3d5072
je 0x1400791b0
mov rcx, qword [0x141dde6e0]
xor edx, edx
mov r8, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400791f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rax, qword [rcx]
mov ecx, dword [0x141dcf3e8]
or ecx, dword [0x141dcf3ec]
or ecx, 0xeef45237
cmp ecx, 0x628845fa
je 0x14007924e
mov ecx, dword [0x141dcf3f0]
imul ecx, dword [0x141dcf3f4]
imul edx, ecx, 0x2ca895fb
and edx, 0x7e3fb6cd
add edx, 0x1dd19308
mov r8, qword [rax + 0x10]
mov rcx, 0xffffffffffffffff
lock xadd qword [r8], rcx
cmp edx, 0xd070b034
jbe 0x140079260
mov rcx, qword [rax + 0x10]
lock dec qword [rcx]
jmp 0x140079217
mov edx, dword [0x141dcf3f8]
sub edx, dword [0x141dcf3fc]
and edx, 0x304811ee
xor edx, 0xcde624de
imul edx, edx, 0x5a0dad42
cmp edx, 0xb5265aff
ja 0x140079260
cmp rcx, 1
jne 0x1400792f0
nop dword [rax]
mov ecx, dword [0x141dcf400]
xor ecx, dword [0x141dcf404]
add ecx, 0xd94502ae
and ecx, 0xa1767408
cmp ecx, 0x19bd0023
jb 0x140079290
mov rdi, qword [rax + 0x10]
xor eax, eax
test al, al
jne 0x1400792e2
mov eax, dword [0x141dcf408]
and eax, dword [0x141dcf40c]
imul ebx, eax, 0x34a440dc
or ebx, 0x466001ff
mov rcx, rdi
call fcn.140078ff0
cmp ebx, 0xc4a3b82f
jbe 0x1400792f0
mov rcx, rdi
call fcn.140078ff0
jmp 0x1400792ba
mov eax, dword [0x141dcf410]
xor eax, dword [0x141dcf414]
imul rax, rax, 0x384d1993
shr rax, 0x3d
or eax, 0xe1181440
xor eax, 0x6ce172da
cmp eax, 0xe3eb4cbd
ja 0x1400792f0
mov rsi, qword [rsi]
nop dword [rax + rax]
mov eax, dword [0x141dcf418]
add eax, dword [0x141dcf41c]
imul rax, rax, 0x3dfa35ff
shr rax, 0x3d
imul eax, eax, 0x9d225668
add eax, 0xca8d50df
cmp eax, 0x36948f46
jb 0x140079320
nop dword [rax]
mov eax, dword [0x141dcf420]
xor edx, edx
div dword [0x141dcf424]
add eax, 0xc388328c
and eax, 0x3d659eaf
cmp eax, 0xa790b419
ja 0x140079350
cmp rsi, 0xffffffffffffffff
je 0x140079441
lea rax, [rsi + 8]
mov ecx, dword [0x141dcf428]
sub ecx, dword [0x141dcf42c]
imul rcx, rcx, 0x30514137
shr rcx, 0x3d
or ecx, 0x55bb4264
cmp ecx, 0x23032468
jb 0x1400793cf
mov edx, dword [0x141dcf430]
sub edx, dword [0x141dcf434]
or edx, 0x62010282
xor edx, 0x620540b2
or edx, 0x9db89905
lock dec qword [rax]
sete cl
cmp edx, 0xd023bc2c
jne 0x1400793d5
lock dec qword [rax]
jmp 0x1400793a2
test cl, cl
je 0x140079441
mov rdi, qword [0x141dde6e0]
mov eax, dword [0x141dcf438]
xor eax, dword [0x141dcf43c]
or eax, 0xde522d73
and eax, 0xdff77f77
cmp eax, 0x67ba188f
je 0x140079431
mov ebx, dword [0x141dcf440]
and ebx, dword [0x141dcf444]
add ebx, 0x49a1ec61
or ebx, 0x8850024
and ebx, 0x88d2a24
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0xdc04126d
jbe 0x140079441
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400793fd
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x14007b050
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x10
lea rbp, [rsp + 0x10]
mov eax, dword [0x141dcf828]
and eax, dword [0x141dcf82c]
imul eax, eax, 0xa3a2cb61
and eax, 0x61d43f62
add eax, 0x2f2b2226
cmp eax, 0x8b17e105
jae 0x14007b09d
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov rax, rsp
mov qword [rax], 0
xor ecx, ecx
nop
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov rsi, rsp
mov qword [rsi], 0
test cl, cl
jne 0x14007b0a0
mov eax, dword [0x141dcf830]
xor eax, dword [0x141dcf834]
imul eax, eax, 0x8f83d6b7
xor eax, 0xc4800298
and eax, 0xcfc582b9
cmp eax, 0xad8de264
jbe 0x14007b0f0
mov eax, dword [0x141dde638]
nop word cs:[rax + rax]
mov eax, dword [0x141dcf838]
and eax, dword [0x141dcf83c]
add eax, 0x81e31343
imul rcx, rax, 0x7cb7684b
shr rcx, 0x3e
mov eax, dword [0x141dde638]
cmp ecx, 0x60e77dda
je 0x14007b0f0
cmp eax, 3
jne case.0x140046c71.64
nop word cs:[rax + rax]

Function at 0x14007b7f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x80]
mov eax, dword [0x141dcf948]
add eax, dword [0x141dcf94c]
xor eax, 0xf4d6d45f
add eax, 0xbdeb7bb
cmp eax, 0xdcc253b6
ja 0x14007b84b
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov rsi, rsp
mov rax, qword [rcx]
mov r14, qword [rax]
mov qword [rax], 0
xor eax, eax
test al, al
je 0x14007b864
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov rax, qword [rcx]
mov qword [rax], 0
jmp 0x14007b828
test r14, r14
je 0x14007b88e
mov eax, dword [0x141dcf958]
add eax, dword [0x141dcf95c]
add eax, 0x1d540e7
ud2
Function at 0x140083f80
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r8, qword [rcx]
mov eax, dword [0x141dd0a80]
xor edx, edx
div dword [0x141dd0a84]
nop word [rax + rax]
mov eax, dword [0x141dd0a88]
xor eax, dword [0x141dd0a8c]
imul eax, eax, 0x9fef086b
add eax, 0x421f9886
cmp eax, 0xc1918be4
ja 0x140083fa0
cmp r8d, 3
jne 0x1400840bd
mov rax, qword [rcx + 8]
mov edx, dword [0x141dd0a90]
imul edx, dword [0x141dd0a94]
or edx, 0x99110274
and edx, 0x9b111274
imul edx, edx, 0xe217a25a
cmp edx, 0x596c074a
jbe 0x140083ff7
lock dec qword [rax]
add rcx, 8
nop dword [rax + rax]
mov edx, dword [0x141dd0a98]
imul edx, dword [0x141dd0a9c]
shr edx, 4
imul rdx, rdx, 0x126b6a51
shr rdx, 0x38
imul r8d, edx, 0x3010d87c
add r8d, 0x937f169e
lock dec qword [rax]
sete dl
cmp r8d, 0xbf14dbd0
ja 0x140084000
test dl, dl
je case.0x140084185.0
mov eax, dword [0x141dd0aa0]
sub eax, dword [0x141dd0aa4]
xor eax, 0x4e12032d
or eax, 0xb1a1a0d0
imul eax, eax, 0x9ecee8b7
cmp eax, 0xe78b8182
jbe 0x140084070
invalid
nop word cs:[rax + rax]
mov rax, qword [rcx + 8]
nop word cs:[rax + rax]
mov ecx, dword [0x141dd0ab8]
and ecx, dword [0x141dd0abc]
cmp ecx, 0x60580aec
je 0x1400840d0
cmp r8d, 2
jb case.0x140084185.0
nop
mov ecx, dword [0x141dd0ac0]
or ecx, dword [0x141dd0ac4]
or ecx, 0xdf912d6
cmp ecx, 0xbb11ba48
je 0x1400840f0
nop word [rax + rax]
mov ecx, dword [0x141dd0ac8]
mov edx, dword [0x141dd0acc]
add ecx, edx
add ecx, 0x39c64d3d
cmp ecx, 0xfd45e53a
ja 0x140084110
mov ecx, eax
and ecx, 3
mov edx, 0x913a577b
nop word cs:[rax + rax]
mov r8d, dword [0x141dd0ad0]
and r8d, dword [0x141dd0ad4]
or r8d, 0xb6ca1c00
and r8d, 0xb6eb9e01
imul r8, rdx
shr r8, 0x3e
cmp r8d, 0x3df79f9f
je 0x140084140
cmp rcx, 3
ja case.default.0x140084185
lea rdx, [0x141dbc6e0]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
lea rsi, [rax - 1]
mov rdi, qword [rax - 1]
mov edi, dword [rax - 1]
mov eax, dword [0x141dd0ae0]
or eax, dword [0x141dd0ae4]
or eax, 0xeffdffff
cmp eax, 0x287ac990
je case.0x140084185.3
mov eax, 0xb9c233a9
nop dword [rax]
mov ecx, dword [0x141dd0ae8]
imul ecx, dword [0x141dd0aec]
imul ecx, ecx, 0x6508810d
add ecx, 0x6d5294a3
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0xf7f8ddeb
je 0x140084390
nop dword [rax]
mov eax, dword [0x141dd0ad8]
xor edx, edx
div dword [0x141dd0adc]
add eax, 0x5f496a6e
imul rcx, rax, 0x5601127
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1d
cmp eax, 0xff3f05a9
je case.default.0x140084185
ud2
Function at 0x1400848d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
nop dword [rax]
mov eax, dword [0x141dd0c58]
and eax, dword [0x141dd0c5c]
and eax, 0x7ac58331
imul rax, rax, 0x1a0e55cb
shr rax, 0x36
add eax, 0x2f3d36f0
cmp eax, 0xbe9003fa
ja 0x1400848e0
cmp qword [r8 + 8], 0
je 0x140084949
cmp qword [r8 + 0x10], 0
je 0x1400849db
mov r8, qword [r8]
mov eax, dword [0x141dd0c78]
xor eax, dword [0x141dd0c7c]
imul eax, eax, 0x9eb2abdb
xor eax, 0xa0e26c61
add eax, 0x7acf4e85
cmp eax, 0xfd38796d
ja 0x140084aa9
jmp 0x140084a83
test rdi, rdi
je 0x140084a79
mov eax, dword [0x141dd0c88]
xor edx, edx
div dword [0x141dd0c8c]
imul eax, eax, 0xebfddff1
or eax, 0xb6511fe9
cmp eax, 0xdf5de711
jae 0x140084980
movzx eax, byte [0x141dde6f8]
nop dword [rax]
mov eax, dword [0x141dd0c90]
or eax, dword [0x141dd0c94]
and eax, 0x81224298
add eax, 0xaa769464
movzx ecx, byte [0x141dde6f8]
cmp eax, 0xcf85df2c
ja 0x140084980
mov eax, dword [0x141dd0c98]
xor eax, dword [0x141dd0c9c]
xor eax, 0xfd0df127
imul eax, eax, 0x2e67b72b
shr eax, 1
mov ecx, 0x8f240373
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0x1b141507
ja 0x140084afd
jmp 0x140084abf
mov eax, 0x806c424b
mov ecx, dword [str._a_V_]
xor ecx, dword [0x141dd0c64]
imul rcx, rax
shr rcx, 0x3b
or ecx, 0xb9a2357c
and ecx, 0xb9a2357d
cmp ecx, 0xdce33860
ja 0x1400849e0
test rdi, rdi
je 0x140084a79
movzx eax, byte [0x141dde6f8]
mov eax, dword [0x141dd0c68]
xor edx, edx
div dword [0x141dd0c6c]
add eax, 0xeda06ce1
cmp eax, 0xa352bf25
jae 0x140084a40
xor ecx, ecx
mov rdx, rdi
call fcn.1400c29b0
nop dword [rax + rax]
mov eax, dword [0x141dd0c70]
and eax, dword [0x141dd0c74]
imul ebx, eax, 0x69f7fa61
or ebx, 0xd2d855dc
xor ecx, ecx
mov rdx, rdi
call fcn.1400c29b0
cmp ebx, 0x62338802
je 0x140084a40
mov cl, 1
nop dword [rax]
test cl, cl
je 0x140084a70
jmp 0x140084b14
mov eax, 8
jmp 0x140084b14
mov eax, dword [0x141dd0c80]
xor edx, edx
div dword [0x141dd0c84]
xor eax, 0x128a0
and eax, 0xe2132ae0
mov rcx, qword [0x141dde6e0]
cmp eax, 0x6b21c4ac
jne 0x140084ab2
mov rax, qword [0x141dde6e0]
jmp 0x140084a83
xor edx, edx
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x140084b14
mov ebx, dword [0x141dd0ca0]
and ebx, dword [0x141dd0ca4]
imul rax, rbx, 0x51fcb83
shr rax, 0x20
sub ebx, eax
shr ebx, 1
add ebx, eax
shr ebx, 0x1f
add ebx, 0xeea7b879
or ebx, 0x18c0a7b0
xor ecx, ecx
mov rdx, rdi
call fcn.1400c29b0
cmp ebx, 0xf1c47ad7
jae 0x140084b09
xor ecx, ecx
mov rdx, rdi
call fcn.1400c29b0
jmp 0x140084abf
xor ecx, ecx
nop dword [rax + rax]
test cl, cl
jne 0x140084b10
xor ecx, ecx
test rax, rax
mov edx, 8
cmovne rdx, rax
sete cl
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rdi
mov qword [rsi], rcx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x14008b390
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x141dd1ae0]
and eax, dword [0x141dd1ae4]
add eax, 0x2c019be0
and eax, 0xbf95804d
xor eax, 0x6e25d7d7
xlatb
and eax, 0x71f83d6e
invalid
xchg byte [rdi + 0x5a], dh

Function at 0x14008b7b0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rcx, rcx
je case.0x14008b814.0
nop word cs:[rax + rax]

Function at 0x14008cef0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov eax, dword [0x141dd1ed8]
xor edx, edx
div dword [0x141dd1edc]
nop word [rax + rax]
mov eax, dword [str._FgS]
and eax, dword [0x141dd1ee4]
xor eax, 0x4c00060
or eax, 0xab1e7f8a
cmp eax, 0xebcff2d0
iretd
jmp 0x14008cfae
invalid
test rsi, rsi
je 0x14008d872
mov r13d, 0xe9d6ac09
lea r15, [0x141dbc834]
mov r12d, 0xe023db2f
mov qword [rsp + 0x20], rbx
jmp 0x14008cf69
Function at 0x14008e5a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
test dl, dl
je 0x14008e5d0
mov eax, dword [str.Rfhe:i]
xor edx, edx
div dword [0x141dd21f4]
xor eax, 0x1a3180a5
and eax, 0xba318fad
cmp eax, 0x82cc0a3a
jne 0x14008e6e3
jmp 0x14008e6ed
mov eax, dword [0x141dd21e8]
xor edx, edx
div dword [0x141dd21ec]
lea rax, [rcx + 8]
xor edx, edx
nop word cs:[rax + rax]
test dl, dl
jne 0x14008e5f0
lock dec qword [rax]
jne 0x14008e69f
mov eax, dword [0x141dd2200]
and eax, dword [0x141dd2204]
xor eax, 0x45000430
or eax, 0xb8ae90cf
imul eax, eax, 0x70a405ab
cmp eax, 0x4144038c
jb 0x14008e65a
mov eax, dword [0x141dd2208]
and eax, dword [0x141dd220c]
shr eax, 2
imul rax, rax, 0x459c620d
shr rax, 0x3b
imul r8d, eax, 0xaa01b191
add r8d, 0x7aca44e0
mov rax, qword [rcx]
mov dl, 1
xchg byte [rax + 0x30], dl
cmp r8d, 0x1161eac
jae 0x14008e664
mov rax, qword [rcx]
mov dl, 1
xchg byte [rax + 0x30], dl
jmp 0x14008e621
add rax, 0x30
nop dword [rax + rax]
mov ecx, dword [0x141dd2210]
imul ecx, dword [0x141dd2214]
xor ecx, 0x6010082
or ecx, 0xe158d765
cmp ecx, 0x218b9313
je 0x14008e670
cmp dl, 0xff
jne 0x14008e69f
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
mov eax, 0x9a3d6dfd
nop word cs:[rax + rax]
mov ecx, dword [0x141dd2218]
sub ecx, dword [0x141dd221c]
add ecx, 0x4c198330
mov rdx, rcx
imul rdx, rax
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1c
cmp ecx, 0xd2904ddd
je 0x14008e6b0
add rsp, 0x28
ret
mov byte [rcx + 0x10], 1
xor eax, eax
test al, al
je 0x14008e6f3
mov byte [rcx + 0x10], 1
jmp 0x14008e6e3
mov eax, 0xc2f56de3
nop dword [rax + rax]
mov edx, dword [0x141dd21f8]
xor edx, dword [0x141dd21fc]
imul rdx, rdx, 0xb8e1295
shr rdx, 0x3b
imul edx, edx, 0xd2289f30
imul rdx, rax
shr rdx, 0x3d
cmp edx, 0x9e9dd289
ja 0x14008e700
jmp 0x14008e5d0