joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140075e60
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8, rdx
mov eax, dword [0x1402a9d4c]
mov edx, dword [0x1402a9d50]
shrd edx, eax, 9
xor edx, 0x596c8620
cmp dword [0x1402c0344], edx
je 0x140075f1f
lea r10, [r8 + 0x14]
xor eax, eax
nop dword [rax]
movsxd r11, eax
movzx ebx, byte [r10 + r11]
mov eax, dword [0x1402a9d54]
mov edx, dword [0x1402a9d58]
shrd edx, eax, 0x1f
mov esi, edx
xor esi, 0x7cbea99a
mov r9d, r11d
mov eax, r11d
xor edx, edx
div esi
movsxd rax, edx
xor bl, byte [r8 + rax]
mov byte [rcx + r11], bl
mov eax, dword [0x1402a9d5c]
mov edx, dword [0x1402a9d60]
shrd edx, eax, 0x17
xor edx, 0xa63412e4
add edx, r11d
mov eax, dword [0x1402a9d64]
mov r9d, dword [0x1402a9d68]
shrd r9d, eax, 0xc
xor r9d, 0x53458a41
cmp edx, r9d
mov eax, edx
jne 0x140075e90
imul eax, dword [0x1402a9d6c], 0x8bbb92f2
imul ecx, dword [0x1402a9d70], 0x378131d5
lea eax, [rax + rcx - 0x16052ba5]
mov dword [0x1402c0344], eax
imul eax, dword [0x1402a9d74], 0xfe65308
imul ecx, dword [0x1402a9d78], 0xa7d118d
lea eax, [rax + rcx + 0x2d277062]
pop rbx
pop rsi
ret

Function at 0x140075f40
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8, rdx
imul eax, dword [0x1402a9d7c], 0xa2a8112a
imul edx, dword [0x1402a9d80], 0x6492abad
lea eax, [rax + rdx - 0x11a40e2a]
cmp dword [0x1402c0358], eax
je 0x140076012
lea r10, [r8 + 0x12]
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax]
movsxd r11, eax
movzx ebx, byte [r10 + r11]
imul eax, dword [0x1402a9d84], 0xb42976f6
imul edx, dword [0x1402a9d88], 0x15ba6b1e
lea esi, [rax + rdx + 0x3307f302]
mov r9d, r11d
mov eax, r11d
xor edx, edx
div esi
movsxd rax, edx
xor bl, byte [r8 + rax]
mov byte [rcx + r11], bl
mov eax, dword [0x1402a9d8c]
mov edx, dword [0x1402a9d90]
shrd edx, eax, 0x17
xor edx, 0xe314a7a2
add edx, r11d
mov eax, dword [0x1402a9d94]
mov r9d, dword [0x1402a9d98]
shrd r9d, eax, 0xc
xor r9d, 0x8fb0d4eb
cmp edx, r9d
mov eax, edx
jne 0x140075f80
imul eax, dword [0x1402a9d9c], 0x4522853f
imul ecx, dword [0x1402a9da0], 0x6dfff577
lea eax, [rax + rcx + 0x5823c2e7]
mov dword [0x1402c0358], eax
imul eax, dword [0x1402a9da4], 0xa14d7104
imul ecx, dword [0x1402a9da8], 0x4414dcb7
lea eax, [rax + rcx + 0x5aa43a89]
pop rbx
pop rsi
ret
Function at 0x140076030
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8, rdx
mov eax, dword [0x1402a9dac]
mov edx, dword [0x1402a9db0]
shrd edx, eax, 0x1f
xor edx, 0xe53951d
cmp dword [0x1402c036c], edx
je 0x1400760f7
lea r10, [r8 + 0x1b]
xor eax, eax
nop dword [rax]
movsxd r11, eax
movzx ebx, byte [r10 + r11]
imul eax, dword [0x1402a9db4], 0xe918d76c
imul edx, dword [0x1402a9db8], 0x49a4575
lea esi, [rax + rdx - 0x55e66bb9]
mov r9d, r11d
mov eax, r11d
xor edx, edx
div esi
movsxd rax, edx
xor bl, byte [r8 + rax]
mov byte [rcx + r11], bl
imul eax, dword [0x1402a9dbc], 0x7521ab38
imul edx, dword [0x1402a9dc0], 0x2fdfc3cc
add edx, eax
mov eax, r11d
lea eax, [rax + rdx + 0x2d06d955]
mov edx, dword [0x1402a9dc4]
mov r9d, dword [0x1402a9dc8]
shrd r9d, edx, 7
xor r9d, 0x3817767c
cmp eax, r9d
jne 0x140076060
imul eax, dword [0x1402a9dcc], 0x306da08e
imul ecx, dword [0x1402a9dd0], 0x5fb22632
lea eax, [rax + rcx + 0x6ad1bcf1]
mov dword [0x1402c036c], eax
mov eax, dword [0x1402a9dd4]
mov ecx, dword [0x1402a9dd8]
shrd ecx, eax, 0xc
mov eax, ecx
xor eax, 0x1003ad80
pop rbx
pop rsi
ret

Function at 0x140076120
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8, rdx
imul eax, dword [0x1402a9ddc], 0xfafe795b
imul edx, dword [0x1402a9de0], 0x9fb9bf65
lea eax, [rax + rdx - 0x7082523d]
cmp dword [0x1402c0374], eax
je 0x1400761f7
lea r10, [r8 + 0x19]
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax]
movsxd r11, eax
movzx ebx, byte [r10 + r11]
imul eax, dword [0x1402a9de4], 0xe8a89bea
imul edx, dword [0x1402a9de8], 0x504e7894
lea esi, [rax + rdx - 0x2e66a8c3]
mov r9d, r11d
mov eax, r11d
xor edx, edx
div esi
movsxd rax, edx
xor bl, byte [r8 + rax]
mov byte [rcx + r11], bl
imul eax, dword [0x1402a9dec], 0xc9565871
imul edx, dword [0x1402a9df0], 0x5973114b
add edx, eax
mov eax, r11d
lea eax, [rax + rdx - 0x7309b3d4]
mov edx, dword [0x1402a9df4]
mov r9d, dword [0x1402a9df8]
shrd r9d, edx, 0x12
xor r9d, 0xf8814adc
cmp eax, r9d
jne 0x140076160
imul eax, dword [0x1402a9dfc], 0x891a41c9
imul ecx, dword [0x1402a9e00], 0xb29b0492
lea eax, [rax + rcx - 0x55e7a88f]
mov dword [0x1402c0374], eax
imul eax, dword [0x1402a9e04], 0x1c87718
imul ecx, dword [0x1402a9e08], 0x199e041b
lea eax, [rax + rcx - 0x186fa7fa]
pop rbx
pop rsi
ret
Function at 0x140076220
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8, rdx
mov eax, dword [0x1402a9e0c]
mov edx, dword [0x1402a9e10]
shrd edx, eax, 8
xor edx, 0x4216a3ac
cmp dword [0x1402c037c], edx
je 0x1400762e0
lea r10, [r8 + 0x19]
xor eax, eax
nop dword [rax]
movsxd r11, eax
movzx ebx, byte [r10 + r11]
imul eax, dword [0x1402a9e14], 0x81ed2295
imul edx, dword [0x1402a9e18], 0xcf92b31b
lea esi, [rax + rdx - 0x41d9d6f1]
mov r9d, r11d
mov eax, r11d
xor edx, edx
div esi
movsxd rax, edx
xor bl, byte [r8 + rax]
mov byte [rcx + r11], bl
mov eax, dword [0x1402a9e1c]
mov edx, dword [0x1402a9e20]
shrd edx, eax, 0x11
xor edx, 0x61e6e732
add edx, r11d
imul eax, dword [0x1402a9e24], 0xfb6b75be
imul r9d, dword [0x1402a9e28], 0x195da45c
lea eax, [rax + r9 + 0xaedf410]
cmp edx, eax
mov eax, edx
jne 0x140076250
mov eax, dword [0x1402a9e2c]
mov ecx, dword [0x1402a9e30]
shrd ecx, eax, 0x17
xor ecx, 0x43635996
mov dword [0x1402c037c], ecx
imul eax, dword [0x1402a9e34], 0xd020b172
imul ecx, dword [0x1402a9e38], 0xebd126c7
lea eax, [rax + rcx - 0x614d5b63]
pop rbx
pop rsi
ret

Function at 0x140076300
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8, rdx
imul eax, dword [0x1402a9e3c], 0x623eb1cc
imul edx, dword [0x1402a9e40], 0x4990bbd7
lea eax, [rax + rdx + 0x14516730]
cmp dword [0x1402c0384], eax
je 0x1400763ca
lea r10, [r8 + 0x1f]
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax]
movsxd r11, eax
movzx ebx, byte [r10 + r11]
mov eax, dword [0x1402a9e44]
mov edx, dword [0x1402a9e48]
shrd edx, eax, 0x17
mov esi, edx
xor esi, 0xfc726e30
mov r9d, r11d
mov eax, r11d
xor edx, edx
div esi
movsxd rax, edx
xor bl, byte [r8 + rax]
mov byte [rcx + r11], bl
mov eax, dword [0x1402a9e4c]
mov edx, dword [0x1402a9e50]
shrd edx, eax, 0x1c
xor edx, 0x5faf26dd
add edx, r11d
mov eax, dword [0x1402a9e54]
mov r9d, dword [0x1402a9e58]
shrd r9d, eax, 0x1d
xor r9d, 0x6ca97d8d
cmp edx, r9d
mov eax, edx
jne 0x140076340
mov eax, dword [0x1402a9e5c]
mov ecx, dword [0x1402a9e60]
shrd ecx, eax, 0x14
xor ecx, 0xea59b619
mov dword [0x1402c0384], ecx
mov eax, dword [0x1402a9e64]
mov ecx, dword [0x1402a9e68]
shrd ecx, eax, 0x1e
mov eax, ecx
xor eax, 0xd20cb261
pop rbx
pop rsi
ret
Function at 0x1400763f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8, rdx
mov eax, dword [0x1402a9e6c]
mov edx, dword [0x1402a9e70]
shrd edx, eax, 0x10
xor edx, 0x97d9fb2a
cmp dword [0x1402c038c], edx
je 0x1400764b5
lea r10, [r8 + 0x11]
xor eax, eax
nop dword [rax]
movsxd r11, eax
movzx ebx, byte [r10 + r11]
imul eax, dword [0x1402a9e74], 0xbc99ca2c
imul edx, dword [0x1402a9e78], 0xb60d097f
lea esi, [rax + rdx + 0x47c59964]
mov r9d, r11d
mov eax, r11d
xor edx, edx
div esi
movsxd rax, edx
xor bl, byte [r8 + rax]
mov byte [rcx + r11], bl
mov eax, dword [0x1402a9e7c]
mov edx, dword [0x1402a9e80]
shrd edx, eax, 0x1e
xor edx, 0x51db2a79
add edx, r11d
imul eax, dword [0x1402a9e84], 0xcbadf739
imul r9d, dword [0x1402a9e88], 0x65f856e5
lea eax, [rax + r9 - 0x276ffa53]
cmp edx, eax
mov eax, edx
jne 0x140076420
imul eax, dword [0x1402a9e8c], 0xc1561012
imul ecx, dword [0x1402a9e90], 0x3d715298
lea eax, [rax + rcx - 0x75057a13]
mov dword [0x1402c038c], eax
mov eax, dword [0x1402a9e94]
mov ecx, dword [0x1402a9e98]
shrd ecx, eax, 0x16
mov eax, ecx
xor eax, 0x9a1c55fa
pop rbx
pop rsi
ret

Function at 0x1400764d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8, rdx
imul eax, dword [0x1402a9e9c], 0xf6e17f2e
imul edx, dword [0x1402a9ea0], 0xabd87c95
lea eax, [rax + rdx - 0x3eaec51b]
cmp dword [0x1402c0394], eax
je 0x1400765a5
lea r10, [r8 + 0x1f]
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax]
movsxd r11, eax
movzx ebx, byte [r10 + r11]
imul eax, dword [0x1402a9ea4], 0x8a1a7735
imul edx, dword [0x1402a9ea8], 0x2777842e
lea esi, [rax + rdx - 0x5b20050b]
mov r9d, r11d
mov eax, r11d
xor edx, edx
div esi
movsxd rax, edx
xor bl, byte [r8 + rax]
mov byte [rcx + r11], bl
imul eax, dword [0x1402a9eac], 0xb860284e
imul edx, dword [0x1402a9eb0], 0x68718bb8
add edx, eax
mov eax, r11d
lea eax, [rax + rdx - 0x1fb44b69]
imul edx, dword [0x1402a9eb4], 0x81beb5d5
imul r9d, dword [str.__GrxpO_], 0xaa886bf
lea edx, [rdx + r9 - 0x190d9555]
cmp eax, edx
jne 0x140076510
mov eax, dword [0x1402a9ebc]
mov ecx, dword [0x1402a9ec0]
shrd ecx, eax, 0xd
xor ecx, 0x83c360a0
mov dword [0x1402c0394], ecx
imul eax, dword [0x1402a9ec4], 0x6f171cad
imul ecx, dword [0x1402a9ec8], 0xfd10e75b
lea eax, [rax + rcx - 0x62de3d27]
pop rbx
pop rsi
ret
Function at 0x1400765d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8, rdx
mov eax, dword [0x1402a9ecc]
mov edx, dword [0x1402a9ed0]
shrd edx, eax, 0xe
xor edx, 0x9524f03f
cmp dword [0x1402c039c], edx
je 0x140076694
lea r10, [r8 + 0x18]
xor eax, eax
nop dword [rax]
movsxd r11, eax
movzx ebx, byte [r10 + r11]
mov eax, dword [0x1402a9ed4]
mov edx, dword [0x1402a9ed8]
shrd edx, eax, 0x14
mov esi, edx
xor esi, 0xdf263968
mov r9d, r11d
mov eax, r11d
xor edx, edx
div esi
movsxd rax, edx
xor bl, byte [r8 + rax]
mov byte [rcx + r11], bl
imul eax, dword [0x1402a9edc], 0x161bf29f
imul edx, dword [0x1402a9ee0], 0x90c368bb
add edx, eax
mov eax, r11d
lea eax, [rax + rdx - 0x6ca09ec5]
mov edx, dword [0x1402a9ee4]
mov r9d, dword [0x1402a9ee8]
shrd r9d, edx, 0xd
xor r9d, 0xe5f2deb4
cmp eax, r9d
jne 0x140076600
imul eax, dword [0x1402a9eec], 0x2148050
imul ecx, dword [0x1402a9ef0], 0x3b30efce
lea eax, [rax + rcx - 0x6276bfbf]
mov dword [0x1402c039c], eax
mov eax, dword [0x1402a9ef4]
mov ecx, dword [0x1402a9ef8]
shrd ecx, eax, 0x15
mov eax, ecx
xor eax, 0x2d654297
pop rbx
pop rsi
ret

Function at 0x1400766b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8, rdx
imul eax, dword [0x1402a9efc], 0xd197b795
imul edx, dword [0x1402a9f00], 0x595a9bdd
lea eax, [rax + rdx + 0x6a2f48ab]
cmp dword [0x1402c03b0], eax
je 0x140076782
lea r10, [r8 + 0x1f]
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax]
movsxd r11, eax
movzx ebx, byte [r10 + r11]
imul eax, dword [0x1402a9f04], 0xbd7baae4
imul edx, dword [0x1402a9f08], 0xb721af1f
lea esi, [rax + rdx + 0x45aeff3b]
mov r9d, r11d
mov eax, r11d
xor edx, edx
div esi
movsxd rax, edx
xor bl, byte [r8 + rax]
mov byte [rcx + r11], bl
imul eax, dword [0x1402a9f0c], 0x70fb712d
imul edx, dword [0x1402a9f10], 0xcc2dfcc
add edx, eax
mov eax, r11d
lea eax, [rax + rdx - 0x105b29e2]
mov edx, dword [0x1402a9f14]
mov r9d, dword [0x1402a9f18]
shrd r9d, edx, 0x12
xor r9d, 0x2f22f831
cmp eax, r9d
jne 0x1400766f0
mov eax, dword [0x1402a9f1c]
mov ecx, dword [0x1402a9f20]
shrd ecx, eax, 0x10
xor ecx, 0x43160d60
mov dword [0x1402c03b0], ecx
mov eax, dword [0x1402a9f24]
mov ecx, dword [0x1402a9f28]
shrd ecx, eax, 6
mov eax, ecx
xor eax, 0x6f829ef3
pop rbx
pop rsi
ret
Function at 0x1400767a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8, rdx
mov eax, dword [0x1402a9f2c]
mov edx, dword [0x1402a9f30]
shrd edx, eax, 0x10
xor edx, 0x76f43edb
cmp dword [0x1402c03c4], edx
je 0x140076865
lea r10, [r8 + 0x12]
xor eax, eax
nop dword [rax]
movsxd r11, eax
movzx ebx, byte [r10 + r11]
imul eax, dword [0x1402a9f34], 0x3d38162e
imul edx, dword [0x1402a9f38], 0xd43a8aa
lea esi, [rax + rdx - 0x181e5f42]
mov r9d, r11d
mov eax, r11d
xor edx, edx
div esi
movsxd rax, edx
xor bl, byte [r8 + rax]
mov byte [rcx + r11], bl
imul eax, dword [0x1402a9f3c], 0xb23181f5
imul edx, dword [0x1402a9f40], 0x3244046c
add edx, eax
mov eax, r11d
lea eax, [rax + rdx + 0x203f6513]
imul edx, dword [0x1402a9f44], 0xaf06fb8b
imul r9d, dword [0x1402a9f48], 0xd377b379
lea edx, [rdx + r9 - 0x52ebf42a]
cmp eax, edx
jne 0x1400767d0
mov eax, dword [0x1402a9f4c]
mov ecx, dword [str.__vG]
shrd ecx, eax, 0x12
xor ecx, 0xba5fabf3
mov dword [0x1402c03c4], ecx
mov eax, dword [0x1402a9f54]
mov ecx, dword [0x1402a9f58]
shrd ecx, eax, 0xd
mov eax, ecx
xor eax, 0xe1e44fa1
pop rbx
pop rsi
ret

Function at 0x140076880
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8, rdx
imul eax, dword [0x1402a9f5c], 0x3ba13cc7
imul edx, dword [0x1402a9f60], 0xaf9c73ba
lea eax, [rax + rdx - 0x4c45ec2]
cmp dword [0x1402c03e0], eax
je 0x14007695a
lea r10, [r8 + 0x1c]
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax]
movsxd r11, eax
movzx ebx, byte [r10 + r11]
imul eax, dword [0x1402a9f64], 0x5ff3f53b
imul edx, dword [0x1402a9f68], 0x8ccac602
lea esi, [rax + rdx - 0x14a8cd99]
mov r9d, r11d
mov eax, r11d
xor edx, edx
div esi
movsxd rax, edx
xor bl, byte [r8 + rax]
mov byte [rcx + r11], bl
imul eax, dword [0x1402a9f6c], 0xbf222d16
imul edx, dword [0x1402a9f70], 0xdbbbc603
add edx, eax
mov eax, r11d
lea eax, [rax + rdx - 0x7576339c]
imul edx, dword [0x1402a9f74], 0x2309fdb0
imul r9d, dword [0x1402a9f78], 0x18543f97
lea edx, [rdx + r9 - 0x580e6dd8]
cmp eax, edx
jne 0x1400768c0
imul eax, dword [0x1402a9f7c], 0xa8c3cdb5
imul ecx, dword [0x1402a9f80], 0x6d78cf2
lea eax, [rax + rcx + 0x436dd5fd]
mov dword [0x1402c03e0], eax
imul eax, dword [0x1402a9f84], 0x2334c968
imul ecx, dword [0x1402a9f88], 0x898172d1
lea eax, [rax + rcx + 0x3d05fe19]
pop rbx
pop rsi
ret
Function at 0x140076980
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8, rdx
mov eax, dword [0x1402a9f8c]
mov edx, dword [0x1402a9f90]
shrd edx, eax, 0x1f
xor edx, 0x40685fa1
cmp dword [0x1402c03f4], edx
je 0x140076a47
lea r10, [r8 + 0x14]
xor eax, eax
nop dword [rax]
movsxd r11, eax
movzx ebx, byte [r10 + r11]
mov eax, dword [0x1402a9f94]
mov edx, dword [0x1402a9f98]
shrd edx, eax, 0x1c
mov esi, edx
xor esi, 0xb2b20a35
mov r9d, r11d
mov eax, r11d
xor edx, edx
div esi
movsxd rax, edx
xor bl, byte [r8 + rax]
mov byte [rcx + r11], bl
imul eax, dword [0x1402a9f9c], 0xf4b5f4
imul edx, dword [0x1402a9fa0], 0x3beb8cbe
add edx, eax
mov eax, r11d
lea eax, [rax + rdx - 0x2edbdd01]
imul edx, dword [0x1402a9fa4], 0x8d752558
imul r9d, dword [0x1402a9fa8], 0xded88eb8
lea edx, [rdx + r9 + 0x7185f686]
cmp eax, edx
jne 0x1400769b0
imul eax, dword [0x1402a9fac], 0xca4465e7
imul ecx, dword [0x1402a9fb0], 0x57cdf3e
lea eax, [rax + rcx - 0x2880c06e]
mov dword [0x1402c03f4], eax
mov eax, dword [0x1402a9fb4]
mov ecx, dword [0x1402a9fb8]
shrd ecx, eax, 0x18
mov eax, ecx
xor eax, 0x7d51ce3d
pop rbx
pop rsi
ret

Function at 0x140076a70
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8, rdx
imul eax, dword [0x1402a9fbc], 0x9ed2ad1b
imul edx, dword [0x1402a9fc0], 0x204d6beb
lea eax, [rax + rdx - 0x495be11f]
cmp dword [0x1402c0404], eax
je 0x140076b42
lea r10, [r8 + 0x1d]
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax]
movsxd r11, eax
movzx ebx, byte [r10 + r11]
mov eax, dword [0x1402a9fc4]
mov edx, dword [0x1402a9fc8]
shrd edx, eax, 0xc
mov esi, edx
xor esi, 0x6a55b0f3
mov r9d, r11d
mov eax, r11d
xor edx, edx
div esi
movsxd rax, edx
xor bl, byte [r8 + rax]
mov byte [rcx + r11], bl
imul eax, dword [0x1402a9fcc], 0xaf0a3789
imul edx, dword [0x1402a9fd0], 0xe38cf366
add edx, eax
mov eax, r11d
lea eax, [rax + rdx - 0x477207b3]
imul edx, dword [0x1402a9fd4], 0x560bf239
imul r9d, dword [0x1402a9fd8], 0x986a73a8
lea edx, [rdx + r9 + 0x6ccb5751]
cmp eax, edx
jne 0x140076ab0
mov eax, dword [0x1402a9fdc]
mov ecx, dword [0x1402a9fe0]
shrd ecx, eax, 0xc
xor ecx, 0x2f2f7fc4
mov dword [0x1402c0404], ecx
mov eax, dword [0x1402a9fe4]
mov ecx, dword [0x1402a9fe8]
shrd ecx, eax, 0x1b
mov eax, ecx
xor eax, 0xb6f2a964
pop rbx
pop rsi
ret
Function at 0x140076b60
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8, rdx
imul eax, dword [0x1402a9fec], 0x52d98761
imul edx, dword [0x1402a9ff0], 0x110908a9
lea eax, [rax + rdx + 0x57b9f1d6]
cmp dword [0x1402c0420], eax
je 0x140076c32
lea r10, [r8 + 0x14]
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax]
movsxd r11, eax
movzx ebx, byte [r10 + r11]
imul eax, dword [0x1402a9ff4], 0x8b99b247
imul edx, dword [0x1402a9ff8], 0x36318322
lea esi, [rax + rdx - 0x5c47a829]
mov r9d, r11d
mov eax, r11d
xor edx, edx
div esi
movsxd rax, edx
xor bl, byte [r8 + rax]
mov byte [rcx + r11], bl
imul eax, dword [0x1402a9ffc], 0x8638ceca
imul edx, dword [0x1402aa000], 0x9678e4ec
add edx, eax
mov eax, r11d
lea eax, [rax + rdx - 0x519717ed]
mov edx, dword [0x1402aa004]
mov r9d, dword [0x1402aa008]
shrd r9d, edx, 1
xor r9d, 0xc54e834d
cmp eax, r9d
jne 0x140076ba0
mov eax, dword [0x1402aa00c]
mov ecx, dword [0x1402aa010]
shrd ecx, eax, 0x1f
xor ecx, 0x1aa38615
mov dword [0x1402c0420], ecx
imul eax, dword [0x1402aa014], 0x75cf342
imul ecx, dword [0x1402aa018], 0xca5e3997
lea eax, [rax + rcx - 0x35976e4e]
pop rbx
pop rsi
ret

Function at 0x140076c50
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8, rdx
imul eax, dword [0x1402aa01c], 0x1604c220
imul edx, dword [0x1402aa020], 0x7a80c7ba
lea eax, [rax + rdx - 0x1de86fff]
cmp dword [0x1402c0430], eax
je 0x140076d24
lea r10, [r8 + 0x1a]
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax]
movsxd r11, eax
movzx ebx, byte [r10 + r11]
mov eax, dword [0x1402aa024]
mov edx, dword [0x1402aa028]
shrd edx, eax, 0x19
mov esi, edx
xor esi, 0x8c729831
mov r9d, r11d
mov eax, r11d
xor edx, edx
div esi
movsxd rax, edx
xor bl, byte [r8 + rax]
mov byte [rcx + r11], bl
imul eax, dword [0x1402aa02c], 0x4c6a9ad
imul edx, dword [0x1402aa030], 0xaea6418d
add edx, eax
mov eax, r11d
lea eax, [rax + rdx + 0x28102874]
mov edx, dword [0x1402aa034]
mov r9d, dword [0x1402aa038]
shrd r9d, edx, 0x1f
xor r9d, 0xbb9fc31
cmp eax, r9d
jne 0x140076c90
imul eax, dword [0x1402aa03c], 0x9bdf5a3
imul ecx, dword [0x1402aa040], 0x3fdbb358
lea eax, [rax + rcx + 0x204c0994]
mov dword [0x1402c0430], eax
mov eax, dword [0x1402aa044]
mov ecx, dword [0x1402aa048]
shrd ecx, eax, 7
mov eax, ecx
xor eax, 0x152d3c19
pop rbx
pop rsi
ret
Function at 0x140076d40
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8, rdx
mov eax, dword [0x1402aa04c]
mov edx, dword [0x1402aa050]
shrd edx, eax, 0xa
xor edx, 0xea27f3a7
cmp dword [0x1402c043c], edx
je 0x140076e02
lea r10, [r8 + 0x1a]
xor eax, eax
nop dword [rax]
movsxd r11, eax
movzx ebx, byte [r10 + r11]
mov eax, dword [0x1402aa054]
mov edx, dword [0x1402aa058]
shrd edx, eax, 0xe
mov esi, edx
xor esi, 0xdaacca9f
mov r9d, r11d
mov eax, r11d
xor edx, edx
div esi
movsxd rax, edx
xor bl, byte [r8 + rax]
mov byte [rcx + r11], bl
mov eax, dword [0x1402aa05c]
mov edx, dword [0x1402aa060]
shrd edx, eax, 0x1d
xor edx, 0x540ccaa0
add edx, r11d
imul eax, dword [0x1402aa064], 0x51915d9b
imul r9d, dword [0x1402aa068], 0xa8269b81
lea eax, [rax + r9 + 0xf62b4bd]
cmp edx, eax
mov eax, edx
jne 0x140076d70
imul eax, dword [0x1402aa06c], 0xe9f6bac4
imul ecx, dword [0x1402aa070], 0xe1656905
lea eax, [rax + rcx - 0x74d7275b]
mov dword [0x1402c043c], eax
imul eax, dword [0x1402aa074], 0x231e0c05
imul ecx, dword [0x1402aa078], 0xd6594df4
lea eax, [rax + rcx - 0x31b7f016]
pop rbx
pop rsi
ret

Function at 0x140076e20
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8, rdx
imul eax, dword [0x1402aa07c], 0x4f0ed25c
imul edx, dword [0x1402aa080], 0x120dc61d
lea eax, [rax + rdx + 0x1742db91]
cmp dword [0x1402c0454], eax
je 0x140076ef0
lea r10, [r8 + 0x15]
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax]
movsxd r11, eax
movzx ebx, byte [r10 + r11]
imul eax, dword [0x1402aa084], 0xaa323123
imul edx, dword [0x1402aa088], 0xb000ea00
lea esi, [rax + rdx - 0x3845be4f]
mov r9d, r11d
mov eax, r11d
xor edx, edx
div esi
movsxd rax, edx
xor bl, byte [r8 + rax]
mov byte [rcx + r11], bl
mov eax, dword [0x1402aa08c]
mov edx, dword [0x1402aa090]
shrd edx, eax, 0x16
xor edx, 0x4e8d9829
add edx, r11d
imul eax, dword [0x1402aa094], 0xb77f8b4e
imul r9d, dword [0x1402aa098], 0xe9c832a8
lea eax, [rax + r9 - 0x4d87f5b0]
cmp edx, eax
mov eax, edx
jne 0x140076e60
mov eax, dword [0x1402aa09c]
mov ecx, dword [0x1402aa0a0]
shrd ecx, eax, 0xc
xor ecx, 0x9419dffe
mov dword [0x1402c0454], ecx
imul eax, dword [0x1402aa0a4], 0x79a6972e
imul ecx, dword [0x1402aa0a8], 0x7e68d6bb
lea eax, [rax + rcx + 0x64708c8a]
pop rbx
pop rsi
ret
Function at 0x140076f10
Capabilities:
Get session user name

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rsi, rcx
mov eax, dword [0x1402aa0ac]
mov ecx, dword [0x1402aa0b0]
shrd ecx, eax, 6
xor ecx, 0x8e1b839c
mov eax, ecx
shl rax, 9
call fcn.1400fe1d0
sub rsp, rax
mov r14, rsp
imul eax, dword [0x1402aa0b4], 0x15eba038
imul ecx, dword [0x1402aa0b8], 0x8a7ca417
add eax, ecx
add eax, 0xaa884ee8
lea rax, [rax*4 + 0xf]
and rax, 0xfffffffffffffff0
call fcn.1400fe1d0
sub rsp, rax
mov rbx, rsp
movabs rax, 0x32af86954797fb90
imul rax, qword [0x1402aa0c0]
movabs rcx, 0x5dbca27c1a917ac4
imul rcx, qword [0x1402aa0c8]
add rcx, rax
movabs rdx, 0xaf3c0c9024de4df
add rdx, rcx
mov rax, rsi
cmp qword [rsi + 0x18], rdx
jbe 0x140076fb8
mov rax, qword [rsi]
mov rcx, qword [0x1402aa0d0]
mov rdx, qword [0x1402aa0d8]
shrd rdx, rcx, 0x3f
movabs rcx, 0xe15dd83a155a12bd
xor rcx, rdx
mov qword [rsi + 0x10], rcx
movzx ecx, word [0x1402aa0e0]
movzx edx, word [0x1402aa0e2]
imul ecx, ecx, 0x14cc
imul edx, edx, 0xffff97e5
add ecx, edx
add ecx, 0xffff87b4
mov word [rax], cx
mov eax, dword [0x1402aa0e4]
mov ecx, dword [0x1402aa0e8]
shrd ecx, eax, 0xa
xor ecx, 0xac0b2b11
mov dword [rbx], ecx
sub rsp, 0x20
mov rcx, r14
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
add rsp, 0x20
imul ecx, dword [0x1402aa0ec], 0x157790ed
imul edx, dword [0x1402aa0f0], 0xfd720f0b
add ecx, edx
add ecx, 0xb2a64e47
cmp eax, ecx
sete al
imul ecx, dword [0x1402aa0f4], 0xc2e25b87
imul edx, dword [0x1402aa0f8], 0xbced6338
add ecx, edx
add ecx, 0x4c7f9ea5
cmp dword [rbx], ecx
setne bl
and bl, al
cmp bl, 1
jne 0x140077146
sub rsp, 0x20
mov rcx, r14
call fcn.1401b72e8
add rsp, 0x20
mov rdi, rax
mov rcx, qword [rsi + 0x18]
cmp rcx, rax
jae 0x1400770b1
sub rsp, 0x20
mov rcx, rsi
mov rdx, rdi
mov r9, r14
call fcn.14000eada
add rsp, 0x20
jmp 0x140077146
movabs rdx, 0x1d2648373af9b77a
imul rdx, qword [0x1402aa100]
movabs r8, 0x86b44ce6e823a196
imul r8, qword [0x1402aa108]
add r8, rdx
movabs rdx, 0xe8b398e0dda0cec7
add rdx, r8
mov r15, rsi
cmp rcx, rdx
jbe 0x1400770f0
mov r15, qword [rsi]
mov qword [rsi + 0x10], rdi
mov ecx, dword [0x1402aa110]
imul edx, dword [0x1402aa118], 0xd54b36ea
shl ecx, 7
sub edx, ecx
mov ecx, edx
add cl, 0x8b
mov r8, rax
shl r8, cl
sub rsp, 0x20
mov rcx, r15
mov rdx, r14
call fcn.1401a0ad0
add rsp, 0x20
movzx eax, word [0x1402aa120]
movzx ecx, word [0x1402aa122]
shrd cx, ax, 6
mov eax, ecx
xor eax, 0xa72c
mov word [r15 + rdi*2], ax
mov eax, ebx
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret