joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008e740
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
mov eax, dword [0x141dd2220]
add eax, dword [0x141dd2224]
imul eax, eax, 0x4b3333f9
add eax, 0x4dea695a
or eax, 0xe7aeda25
cmp eax, 0x68b7a647
jne 0x14008e784
xor ecx, ecx
xor edx, edx
mov r8d, 2
mov r9d, 0x1f0003
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerExW]
mov rbx, qword [sym.imp.KERNEL32.dll_CreateWaitableTimerExW]
nop dword [rax + rax]
mov ebp, dword [0x141dd2228]
add ebp, dword [str.eN8_os7]
xor ebp, 0x5cdc3cc2
xor ecx, ecx
xor edx, edx
mov r8d, 2
mov r9d, 0x1f0003
call rbx
cmp ebp, 0x468d7462
jb 0x14008e790
mov rdi, rax
test rax, rax
je 0x14008e8ac
imul rax, rsi, 0xffffffffff676980
nop
mov ecx, dword [0x141dd2230]
or ecx, dword [0x141dd2234]
xor ecx, 0xb8c63665
imul ecx, ecx, 0x89da3725
add ecx, 0x5daa1cf2
cmp ecx, 0x4deae024
jb 0x14008e7d0
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
mov rcx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
test eax, eax
je 0x14008e848
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0xffffffff
jne 0x14008e8fe
jmp 0x14008e8ac
mov eax, dword [0x141dd2238]
imul eax, dword [0x141dd223c]
add eax, 0x8a2b8df8
or eax, 0x72a15b0e
cmp eax, 0xdc399f45
jne 0x14008e86f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word cs:[rax + rax]
mov eax, dword [0x141dd2240]
xor edx, edx
div dword [0x141dd2244]
xor eax, 0x9cd7524f
imul ebp, eax, 0x384b27c8
add ebp, 0x4ca74683
mov rcx, rdi
call rbx
cmp ebp, 0x40c1feb3
jae 0x14008e880
imul rax, rsi, 0x3e8
mov edx, 0xffffffff
nop dword [rax + rax]
mov r8d, dword [0x141dd2248]
add r8d, dword [0x141dd224c]
or r8d, 0x5a5a7729
add r8d, 0xc277e4bb
and r8d, 0x5f80ac82
cmp rax, rdx
mov ecx, 0xffffffff
cmovb rcx, rax
cmp r8d, 0x78281065
ja 0x14008e8c0
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14008e910
Capabilities:
Encode data using xor
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov eax, dword [0x141dd2250]
xor eax, dword [0x141dd2254]
imul eax, eax, 0x1fb2892c
cmp eax, 0x3ba1b9a1
jne 0x14008e952
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xorps xmm6, xmm6
lea rsi, [rsp + 0x20]
mov rdi, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop word cs:[rax + rax]
mov eax, dword [0x141dd2258]
add eax, dword [0x141dd225c]
xor eax, 0xd984a78b
imul ebx, eax, 0xfe0981ba
movaps xmmword [rsp + 0x20], xmm6
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x40], xmm6
mov rcx, rsi
call rdi
cmp ebx, 0x1ec01653
je 0x14008e970
mov eax, dword [0x141dd2260]
xor edx, edx
div dword [0x141dd2264]
imul eax, eax, 0xd9634b4c
cmp eax, 0x74da2284
nop dword [rax]
mov eax, dword [0x141dd2268]
sub eax, dword [0x141dd226c]
imul rax, rax, 0xbe14a75
shr rax, 0x3a
imul r8d, eax, 0xd81d1674
add r8d, 0x8682a738
mov r9d, dword [rsp + 0x40]
xor eax, eax
test r9, r9
sete cl
lea rdx, [0x141dbbb88]
cmovne rdx, r9
cmp r8d, 0x49649086
jb 0x14008e9c0
mov al, cl
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x140091310
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
xor eax, eax
nop word cs:[rax + rax]
Function at 0x140095e70
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rdi, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
sub dword [rsp + 0x50], eax
Function at 0x1400977f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x80]
mov rdi, r8
mov qword [rbp], rdx
mov qword [rbp + 0x38], rcx
mov eax, dword [0x141dd3528]
rol dword [rcx], cl

Function at 0x14009acb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rsi, rcx
mov eax, dword [0x141dd3bc0]
or eax, dword [0x141dd3bc4]
add eax, 0x928fc77f
xor eax, 0x47e486e2
add eax, 0xb8f46181
cmp eax, 0x311dea36
invalid
invalid
xor dword [rdi + 0x38], esi
Function at 0x14009cd50
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov rdi, rdx

Function at 0x14009f3f0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.14009fc00
mov rax, qword [rsp + 0x20]
mov ecx, 0xade9ac6f
nop word cs:[rax + rax]
mov edx, dword [0x141dd4518]
sub edx, dword [0x141dd451c]
and edx, 0x99a8672e
add edx, 0x7fe7b890
imul rdx, rcx
shr rdx, 0x3f
cmp edx, 0x3d69c92f
ja 0x14009f420
nop dword [rax + rax]
mov ecx, dword [0x141dd4520]
imul ecx, dword [0x141dd4524]
add ecx, 0x2a62aa0
xor ecx, 0x20a00208
or ecx, 0xd04f1d71
cmp ecx, 0x123af97d
jb 0x14009f450
cmp eax, 2
jne 0x14009f63f
mov edi, dword [rsp + 0x6c]
mov eax, dword [0x141dd4528]
or eax, dword [0x141dd452c]
or eax, 0xee7d8e09
cmp eax, 0x26f9a135
nop dword [rax]
mov eax, dword [0x141dd4530]
xor edx, edx
div dword [0x141dd4534]
add eax, 0x2fd9123e
or eax, 0xc4c2b615
cmp eax, 0xbed83cd9
jb 0x14009f660
test dword [rsp + 0x70], 0x20000000
sete al
xchg esp, eax
sal bh, 0xc7
add byte [rax + rax], al
add byte [rdi], cl
xchg esp, eax
ror dword [rax], 0xc1
Function at 0x14009fc00
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov eax, dword [0x141dd4668]
and eax, dword [0x141dd466c]
add eax, 0x7550747b
imul rax, rax, 0x63f695fd
shr rax, 0x3d
cmp eax, 0x3dc803ac
ja 0x14009fc81
mov eax, dword [0x141dd4670]
sub eax, dword [0x141dd4674]
xor eax, 0xfd093150
imul ecx, eax, 0xed2ac227
add ecx, 0x62d46a96
mov eax, 0x60
call fcn.1400f1350
sub rsp, rax
mov rbx, rsp
mov eax, 0x60
call fcn.1400f1350
sub rsp, rax
mov r12, rsp
cmp ecx, 0x72b958e9
jae 0x14009fc9d
mov eax, 0x60
call fcn.1400f1350
sub rsp, rax
mov eax, 0x60
call fcn.1400f1350
sub rsp, rax
jmp 0x14009fc3c
mov eax, dword [0x141dd4678]
imul eax, dword [0x141dd467c]
or eax, 0xbd2949bf
and eax, 0xbd29dbff
cmp eax, 0xaa0f51ad
jb 0x14009fcf4
mov edi, dword [0x141dd4680]
xor edi, dword [0x141dd4684]
xor edi, 0x85c4dde1
add edi, 0xe17dafa5
sub rsp, 0x20
mov rcx, r12
mov rdx, r15
mov r8, r14
xor r9d, r9d
call fcn.1400a0320
add rsp, 0x20
cmp edi, 0x2ea89455
jae 0x14009fd0f
sub rsp, 0x20
mov rcx, r12
mov rdx, r15
mov r8, r14
xor r9d, r9d
call fcn.1400a0320
add rsp, 0x20
jmp 0x14009fcbb
mov rax, qword [r12]
xor ecx, ecx
nop word cs:[rax + rax]
test cl, cl
jne 0x14009fd20
cmp eax, 2
jne 0x1400a01f3
mov rdi, qword [r12 + 8]
mov eax, edi
and eax, 3
cmp rax, 2
jb 0x1400a01f3
cmp eax, 2
jne 0x1400a016d
movabs rcx, 0xffffffff00000000
and rcx, rdi
nop word [rax + rax]
mov eax, dword [0x141dd46b0]
xor edx, edx
div dword [0x141dd46b4]
imul eax, eax, 0x534a8993
or eax, 0xf3970f51
xor eax, 0x732c819e
cmp eax, 0x564dd3ab
jb 0x14009fd60
movabs rax, 0x78000000000
nop
mov edx, dword [0x141dd46b8]
xor edx, dword [0x141dd46bc]
add edx, 0x825b37cd
or edx, 0x86040328
and edx, 0x9604172c
cmp edx, 0x60904205
jb 0x14009fd90
nop word cs:[rax + rax]
cmp eax, 3
jne 0x1400a0288
mov eax, dword [0x141dd4688]
xor edx, edx
div dword [0x141dd468c]
nop word cs:[rax + rax]
mov eax, dword [0x141dd4690]
sub eax, dword [0x141dd4694]
cmp eax, 0x119d7e25
je 0x1400a0190
nop word cs:[rax + rax]
mov eax, dword [0x141dd4698]
xor edx, edx
div dword [0x141dd469c]
xor eax, 0x5506e880
or eax, 0x8ab9037e
cmp eax, 0xb7738940
jb 0x1400a01b0
nop
mov eax, dword [0x141dd46a0]
sub eax, dword [0x141dd46a4]
imul eax, eax, 0x717b6d66
xor eax, 0x15a2e647
add eax, 0xa0446086
cmp eax, 0x3c561f13
jb 0x1400a01d0
xor eax, eax
test al, al
jne 0x1400a028a
Function at 0x1400a3b40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
nop word [rax + rax]
Function at 0x1400b4410
Capabilities:
Check if file exists
Encode data using xor
Get file attributes

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov rbp, rsp
mov rsi, rcx
mov eax, dword [0x141dd6a48]
xor eax, dword [0x141dd6a4c]
add eax, 0x5107c323
imul rax, rax, 0x33495f09
shr rax, 0x3b
or eax, 0x47d87509
cmp eax, 0x8713315b
jne 0x1400b4470
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
nop word cs:[rax + rax]
add byte [rax], al
add byte [rax], al
invalid
Function at 0x1400b8550
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
movaps xmmword [rbp - 0x10], xmm6
mov r15, rdx
mov eax, dword [str.Of]
add eax, dword [0x141dd7314]
mov rsi, rcx
imul eax, eax, 0x42f48e1e
and eax, 0xc5ee2ec2
cmp eax, 0x652f6b80
je 0x1400b85c5

Function at 0x1400b9060
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov edi, edx

Function at 0x1400b91a0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rsi, rax
nop word cs:[rax + rax]
mov eax, dword [0x141dd7498]
mov ecx, dword [0x141dd749c]
add eax, ecx
add eax, 0xeb0acd13
or eax, 0x45910abf
imul eax, eax, 0x3d8f0b6f
cmp eax, 0x349d8e51
je 0x1400b91c0
nop word cs:[rax + rax]
mov eax, dword [0x141dd74a0]
xor edx, edx
div dword [0x141dd74a4]
or eax, 0x667fbeaa
imul rax, rax, 0x38825b5b
shr rax, 0x3d
cmp eax, 0x4bc9248
je 0x1400b91f0
test rsi, rsi
je 0x1400b9236
cmp rsi, 0xffffffffffffffff
jne 0x1400b92c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
shl rsi, 0x20
or rsi, 2
jmp 0x1400b9240
movabs rsi, 0x600000002
mov eax, dword [0x141dd74d8]
imul eax, dword [0x141dd74dc]
imul rax, rax, 0x663be58d
shr rax, 0x3b
xor eax, 0x28b2885
and eax, 0x28b288d
cmp eax, 0x628dfd89
ja 0x1400b9240
mov eax, esi
and eax, 3
xor edi, edi
lea rcx, [0x141dbd300]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
xor edx, edx
jmp rax
mov qword [rsp + 0x38], 0
mov eax, dword [0x141dd74a8]
xor edx, edx
div dword [0x141dd74ac]
add eax, 0x5fcec1e8
imul rax, rax, 0x25b029fb
shr rax, 0x3d
add eax, 0x35ce6ab3
cmp eax, 0xe78accde
jbe 0x1400b9309
jmp 0x1400b934e
Function at 0x1400bd550
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rax, rcx
lea r8, [rdx - 1]
lea rcx, [rsp + 0x20]
mov rdx, rax
call fcn.140055780
cmp qword [rsp + 0x20], 0
jne 0x1400bdb33
mov rsi, qword [rsp + 0x28]
mov eax, dword [0x141dd7d88]
or eax, dword [0x141dd7d8c]
or eax, 0xb190da83
imul eax, eax, 0x81d46734
add eax, 0x40286665
cmp eax, 0xfec5d6db
jbe 0x1400bd5b4
mov r8, qword [rsp + 0x30]
lea rcx, [rsp + 0x38]
mov rdx, rsi
call fcn.140093550
lea rdi, [rsp + 0x38]
nop dword [rax]
mov ebx, dword [0x141dd7d90]
and ebx, dword [0x141dd7d94]
or ebx, 0x652583dd
add ebx, 0x55f41fd7
mov r8, qword [rsp + 0x30]
mov rcx, rdi
mov rdx, rsi
call fcn.140093550
cmp ebx, 0xd3a41eb2
ja 0x1400bd5c0
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
movabs rax, 0x8000000000000000
cmp rsi, rax
jne 0x1400bd74a
nop dword [rax]
mov eax, dword [0x141dd7dc8]
and eax, dword [0x141dd7dcc]
imul eax, eax, 0x462ae4bf
xor eax, 0x2986c040
and eax, 0x2ba6f87b
cmp eax, 0x8331f0c8
ja 0x1400bd610
nop word cs:[rax + rax]
mov eax, dword [0x141dd7dd0]
mov ecx, dword [0x141dd7dd4]
add eax, ecx
add eax, 0x150cf44d
cmp eax, 0x3c5ec78e
jb 0x1400bd640
mov eax, ebx
and eax, 3
mov eax, dword [0x141dd7d98]
imul eax, dword [0x141dd7d9c]
imul eax, eax, 0x11d44210
imul rax, rax, 0x3fe6877b
shr rax, 0x3d
cmp eax, 0x9df6053e
jbe 0x1400bd785
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r8, qword [0x141dc2008]
mov rcx, rax
mov rdx, rbx
call r8
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor ebp, ebp
nop
call rdi
mov r8, qword [0x141dc2008]
mov rcx, rax
mov rdx, rbx
call r8
test bpl, bpl
jne 0x1400bd790
mov eax, dword [0x141dd7da0]
xor edx, edx
div dword [0x141dd7da4]
nop word cs:[rax + rax]
mov eax, dword [0x141dd7da8]
sub eax, dword [0x141dd7dac]
or eax, 0x1f30eeac
add eax, 0x3e5f4fb1
or eax, 0x23260d00
cmp eax, 0xd221326c
ja 0x1400bd7c0
mov eax, 0xe577835d
nop word [rax + rax]
mov ecx, dword [0x141dd7db0]
xor ecx, dword [0x141dd7db4]
imul rcx, rax
shr rcx, 0x3d
or ecx, 0xbd6fa68e
add ecx, 0x6f56abe4
cmp ecx, 0x1d856013
jb 0x1400bd7f0
test rsi, rsi
je 0x1400bdaf0
mov rsi, qword [0x141dde6e0]
mov eax, dword [0x141dd7db8]
xor edx, edx
div dword [0x141dd7dbc]
or eax, 0x49fd3f44
add eax, 0x6d91de0a
Function at 0x1400c2820
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov eax, dword [0x141dde648]
mov ecx, 0xc74fe9b3
nop
mov edx, dword [0x141dd85a0]
or edx, dword [0x141dd85a4]
imul rdx, rdx, 0x461d3cd9
shr rdx, 0x3e
imul edx, edx, 0xad2e8e99
imul rdx, rcx
shr rdx, 0x3d
cmp edx, 0x8705d631
ja 0x1400c2830
cmp eax, 3
jne 0x1400c2879
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400c2870
add rsp, 0x38
ret
mov byte [rsp + 0x2f], 1
lea rax, [rsp + 0x2f]
mov qword [rsp + 0x30], rax
lea rcx, [0x141dde648]
lea r9, [0x141dbb588]
lea r8, [rsp + 0x30]
xor edx, edx
call fcn.1400fcc30
nop word cs:[rax + rax]
mov eax, dword [0x141dd85a8]
and eax, dword [0x141dd85ac]
xor eax, 0x5554daca
imul rax, rax, 0x4e76a5ef
shr rax, 0x3c
imul eax, eax, 0x213bbd3c
cmp eax, 0xd68de499
ja 0x1400c28b0
nop dword [rax]
mov eax, dword [0x141dd85b0]
or eax, dword [0x141dd85b4]
add eax, 0xca329dca
xor eax, 0xbda52283
imul eax, eax, 0x8ab3a6fa
cmp eax, 0xfd4cb63e
ja 0x1400c28e0
jmp 0x1400c2862

Function at 0x1400c2910
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov eax, dword [0x141dd85b8]
and eax, dword [0x141dd85bc]
or eax, 0xe47379f4
imul eax, eax, 0x223cc42
cmp eax, 0xfee71a4f
jbe 0x1400c293c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rsi, qword [sym.imp.KERNEL32.dll_ExitProcess]
nop word cs:[rax + rax]
mov edi, dword [0x141dd85c0]
sub edi, dword [0x141dd85c4]
add edi, 0x60c7f533
and edi, 0xc1082c00
xor ecx, ecx
call rsi
cmp edi, 0x769f3f42
je 0x1400c2950
nop word cs:[rax + rax]
mov eax, dword [0x141dd85c8]
xor edx, edx
div dword [0x141dd85cc]
and eax, 0xd2b35e6e
add eax, 0x621b4dc7
cmp eax, 0x8d31646d
ja 0x1400c2980
ud2
Function at 0x1400c2b30
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x1400c2d1c
lea rax, [rcx + 1]
lea rdx, [rcx + rcx]
cmp rdx, rax
cmova rax, rdx
cmp rax, 5
mov edi, 4
cmovae rdi, rax
movabs r8, 0x7ffffffffffffff8
mov r9d, 0x28
nop word cs:[rax + rax]
mov eax, dword [0x141dd8628]
xor eax, dword [0x141dd862c]
imul rax, rax, 0x5bba8e55
shr rax, 0x3e
xor eax, 0xedfb2353
imul r10, rax, 0x60cc397
shr r10, 0x3a
mov rax, rdi
mul r9
mov rbx, rax
seto al
cmp rbx, r8
seta dl
cmp r10d, 0x1d81e277
ja 0x1400c2b80
or al, dl
jne 0x1400c2d1c
nop word [rax + rax]
mov eax, dword [0x141dd8630]
and eax, dword [0x141dd8634]
add eax, 0x2d370901
xor eax, 0x423a9200
or eax, 0x25c14cbe
cmp eax, 0x5e30449
je 0x1400c2bd0
test rcx, rcx
je 0x1400c2c15
mov rax, qword [rsi + 8]
shl rcx, 3
lea rcx, [rcx + rcx*4]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rcx
mov r14d, 8
jmp 0x1400c2c18
xor r14d, r14d
mov eax, dword [0x141dd8638]
or eax, dword [0x141dd863c]
add eax, 0x444ee1b5
cmp eax, 0x2b79947f
jb 0x1400c2c6d
mov eax, dword [0x141dd8640]
xor edx, edx
div dword [0x141dd8644]
and eax, 0xe00280
imul ebp, eax, 0x49cd3037
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x38]
lea r9, [rsp + 0x20]
mov edx, 8
mov r8, rbx
call fcn.1400c39d0
cmp ebp, 0x33b6bdea
jne 0x1400c2c8b
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x38]
lea r9, [rsp + 0x20]
mov edx, 8
mov r8, rbx
call fcn.1400c39d0
jmp 0x1400c2c30
cmp qword [rsp + 0x38], 0
jne 0x1400c2d1c
nop word [rax + rax]
mov eax, dword [0x141dd8648]
add eax, dword [0x141dd864c]
or eax, 0x14c240c7
imul eax, eax, 0x4a8f7889
add eax, 0xf9adb88a
cmp eax, 0x90c8a273
jb 0x1400c2ca0
mov rax, qword [rsp + 0x40]
mov qword [rsi + 8], rax
mov eax, dword [0x141dd8650]
xor edx, edx
div dword [0x141dd8654]
xor eax, 0x530ff64b
cmp eax, 0x75316b48
jbe 0x1400c2cf0
mov qword [rsi], rdi
nop dword [rax]
mov eax, dword [0x141dd8658]
or eax, dword [0x141dd865c]
imul eax, eax, 0x56cfed0c
add eax, 0xb5a216b5
mov qword [rsi], rdi
cmp eax, 0x727aa9d3
ja 0x1400c2cf0
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
ud2
Function at 0x1400cd0e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov eax, 0xad175151
nop word cs:[rax + rax]
mov ecx, dword [0x141dd9d48]
xor ecx, dword [0x141dd9d4c]
imul ecx, ecx, 0xd1c68e8d
imul rcx, rax
shr rcx, 0x3f
imul ecx, ecx, 0x825e8f2f
cmp ecx, 0x3040dc82
ja 0x1400cd100
mov rdi, qword [rsi + 0x10]
mov eax, dword [0x141dd9d50]
and eax, dword [0x141dd9d54]
imul eax, eax, 0x26458cd6
add eax, 0xa3edb354
imul rax, rax, 0x784bc9b3
shr rax, 0x3e
cmp eax, 0x7dbe06dc
jbe 0x1400cd15e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0xd71accf3
mov r14, qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word [rax + rax]
mov r15d, dword [0x141dd9d58]
imul r15d, dword [str.WMi]
imul r15, rbx
shr r15, 0x3d
xor r15d, 0x1ceb21ce
add r15d, 0xc35d55c3
mov rcx, rdi
call r14
cmp r15d, 0xfd41878c
ja 0x1400cd170
test eax, eax
jne 0x1400cd1cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov eax, dword [0x141dd9d60]
imul eax, dword [0x141dd9d64]
xor eax, 0x2534389d
imul eax, eax, 0x2d183386
cmp eax, 0x156357ea
je 0x1400cd1b0
cmp rsi, 0xffffffffffffffff
je 0x1400cd20c
lock dec qword [rsi + 8]
sete al
nop dword [rax]
mov ecx, dword [0x141dd9d68]
sub ecx, dword [0x141dd9d6c]
add ecx, 0xd1b085e2
xor ecx, 0x1e614051
cmp ecx, 0x640b4e3e
jb 0x1400cd1e0
test al, al
je 0x1400cd20c
xor eax, eax
test al, al
je 0x1400cd218
jmp 0x1400cd23a
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov eax, dword [0x141dd9d70]
sub eax, dword [0x141dd9d74]
add eax, 0x80ca832a
xor eax, 0x80020289
and eax, 0x900e839d
cmp eax, 0xa2aa9f05
jbe 0x1400cd23c
jmp 0x1400cd218
xor eax, eax
test al, al
je 0x1400cd250
mov rax, qword [0x141dde6e0]
nop dword [rax]
mov eax, dword [0x141dd9d78]
add eax, dword [0x141dd9d7c]
imul eax, eax, 0xf58965d8
add eax, 0xe9ba0d1a
mov rcx, qword [0x141dde6e0]
cmp eax, 0xf448efb9
ja 0x1400cd250
xor edx, edx
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
Function at 0x1400d7e00
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov eax, dword [0x141ddb320]
xor edx, edx
div dword [0x141ddb324]
mov rax, rcx
inc rax
nop word cs:[rax + rax]
mov edx, dword [0x141ddb328]
xor edx, dword [0x141ddb32c]
cmp edx, 0xeb80c880
je 0x1400d7e30
cmp rax, 2
jb 0x1400d7e5f
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x1400d7e5f
add rsp, 0x20
pop rsi
ret
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x1400da2c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rsi, rcx
mov eax, dword [0x141ddb800]
and eax, dword [0x141ddb804]
imul eax, eax, 0x65ddf35b
add eax, 0x82df943b
imul rax, rax, 0x674b0d79
shr rax, 0x3d
cmp eax, 0x83c1f171
jne 0x1400da310
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
nop word cs:[rax + rax]
mov ecx, dword [0x141ddb808]
imul ecx, dword [0x141ddb80c]
xor ecx, 0x404860
and ecx, 0x20754c70
xor ecx, 0x94ad3b95
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov r9, rsp
cmp ecx, 0xaf3b72c3
jb 0x1400da310
mov eax, dword [0x141ddb810]
add eax, dword [0x141ddb814]
imul eax, eax, 0xf7c8f1f8
add eax, 0xff97c7f0
cmp eax, 0xf9bf4b8e
jbe 0x1400da380
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
nop word cs:[rax + rax]
mov eax, dword [0x141ddb818]
imul eax, dword [0x141ddb81c]
xor eax, 0xb94daafd
imul ecx, eax, 0xd7595a92
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov rdi, rsp
cmp ecx, 0xf0da04db
ja 0x1400da380
mov rax, qword [rsi]
nop word cs:[rax + rax]
mov ecx, dword [0x141ddb820]
or ecx, dword [0x141ddb824]
or ecx, 0x9096612
add ecx, 0x2018d5f6
imul rcx, rcx, 0x29c93b51
shr rcx, 0x3d
cmp ecx, 0x8ef54816
ja 0x1400da3c0
cmp rax, 0xffffffffffffffff
je 0x1400da552
lea rcx, [rax + 1]
lea rdx, [rax + rax]
cmp rdx, rcx
cmova rcx, rdx
cmp rcx, 5
mov ebx, 4
cmovae rbx, rcx
mov rcx, rbx
shr rcx, 0x3c
jne 0x1400da552
mov r8, rbx
shl r8, 4
movabs rcx, 0x7ffffffffffffffc
cmp r8, rcx
ja 0x1400da552
nop dword [rax + rax]
mov ecx, dword [0x141ddb828]
imul ecx, dword [0x141ddb82c]
add ecx, 0xb3eed293
and ecx, 0xd0b51de
cmp ecx, 0x87476fe8
ja 0x1400da440
test rax, rax
je 0x1400da499
mov rcx, qword [rsi + 8]
shl rax, 4
mov qword [r9], rcx
mov ecx, dword [0x141ddb830]
or ecx, dword [0x141ddb834]
imul ecx, ecx, 0xf3fb4253
xor ecx, 0x9000150b
or ecx, 0x4f2788b0
cmp ecx, 0xd0fe5d40
jbe 0x1400da49d
jmp 0x1400da4c1
xor eax, eax
jmp 0x1400da4cc
mov ecx, dword [0x141ddb838]
or ecx, dword [0x141ddb83c]
add ecx, 0x47322610
or ecx, 0x71ba6d60
mov qword [r9 + 0x10], rax
cmp ecx, 0xdbdc9162
jbe 0x1400da4c7
mov qword [r9 + 0x10], rax
jmp 0x1400da49d
mov eax, 4
mov qword [r9 + 8], rax
sub rsp, 0x20
mov edx, 4
mov rcx, rdi
call fcn.1400c39d0
add rsp, 0x20
cmp qword [rdi], 0
jne 0x1400da500
mov rax, qword [rdi + 8]
mov qword [rsi + 8], rax
mov qword [rsi], rbx
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [0x141ddb840]
imul eax, dword [0x141ddb844]
imul eax, eax, 0x4feafa8b
or eax, 0x283f6de4
imul rax, rax, 0x34c88993
shr rax, 0x3b
cmp eax, 0xe6905ee1
je 0x1400da500
nop word [rax + rax]
mov eax, dword [0x141ddb848]
add eax, dword [0x141ddb84c]
and eax, 0x180fee77
add eax, 0xfcc6b261
xor eax, 0xbbde16cb
cmp eax, 0xf8940864
ja 0x1400da530
mov eax, dword [0x141ddb850]
xor eax, dword [0x141ddb854]
xor eax, 0x22421244
or eax, 0x5cace43a
add eax, 0x7ecac343
cmp eax, 0x85ca4a5f
jbe 0x1400da580
ud2
mov eax, dword [0x141ddb858]
and eax, dword [0x141ddb85c]
imul eax, eax, 0xa879027d
ud2