joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002050
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rdi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov r9, rcx
movabs rbp, 0xc2b2ae3d27d4eb4f
movabs rsi, 0x9e3779b185ebca87
movabs r14, 0x27d4eb2f165667c5
movabs r15, 0x7a1435883d4d519d
cmp rdi, 0x20
jb 0x140002149
mov r8, qword [r9 + 0x18]
mov rdx, qword [rcx + 8]
mov rax, r8
mov r9, qword [r9 + 0x20]
mov rcx, qword [rcx + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rcx
rol rax, 7
add r10, rax
mov rax, rdx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rdx, rbp
imul rcx, rbp
imul r8, rbp
imul r9, rbp
rol rdx, 0x1f
imul rdx, rsi
rol rcx, 0x1f
xor r10, rdx
rol r8, 0x1f
imul r10, rsi
imul rcx, rsi
imul r8, rsi
sub r10, r15
rol r9, 0x1f
xor r10, rcx
imul r10, rsi
imul r9, rsi
sub r10, r15
xor r10, r8
imul r10, rsi
sub r10, r15
xor r10, r9
imul r10, rsi
add rax, r10
add rax, rdi
jmp 0x140002151
lea rax, [rdi + r14]
add rax, qword [rcx + 0x18]
lea rdx, [r11 + 8]
cmp rdx, rbx
ja 0x14000218a
nop word [rax + rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, rbp
add r11, 8
rol rcx, 0x1f
imul rcx, rsi
xor rax, rcx
rol rax, 0x1b
imul rax, rsi
sub rax, r15
cmp rdx, rbx
jbe 0x140002160
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x1400021b5
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rsi
xor rax, rcx
rol rax, 0x17
imul rax, rbp
add rax, r8
cmp r11, rbx
jae 0x1400021db
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r14
xor rax, rcx
rol rax, 0xb
imul rax, rsi
cmp r11, rbx
jb 0x1400021c0
mov rbx, qword [rsp + 0x18]
mov rcx, rax
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
shr rcx, 0x21
xor rcx, rax
imul rcx, rbp
mov rbp, qword [rsp + 0x20]
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
ret

Function at 0x14000a4a0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x14000a551
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.1400101d0
cmp rax, 1
jne 0x14000a587
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x14000a52d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x14000a520
cmp rcx, 1
jb 0x14000a587
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14000a4f0
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000c6d0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.14000fe8c
int3
Function at 0x14000a610
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a655
xor al, al
jmp 0x14000a6a2
cmp word [rbx], 0
je 0x14000a66d
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a660
cmp word [rsp + 0x30], 0
je 0x14000a69b
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a6c3
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a680
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000c6d0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000fe8c
int3
Function at 0x14000b6c0
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x140030d18]
test rcx, rcx
je 0x14000b6fb
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000b6ee
mov rcx, qword [0x140030d18]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x140030d18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x140030d28], 0
je 0x14000b7ee
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x14002aa28]
mov qword [rsp + 0x80], rsi
lea rsi, [0x140043550]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b7cf
test al, 0x10
je 0x14000b7cf
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000b775
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x14000cf90
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000cfda
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000cfda
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000cfda
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000cfda
cmp dword [rcx + 0x84], 0xe
jbe 0x14000cfda
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000cfdc
xor al, al
add rsp, 0x28
ret

Function at 0x14000fc98
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000fd07
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fd07
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000fd07
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000fd07
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000fd07
cmp dword [rcx + 0x84], 0xe
jbe 0x14000fd07
cmp dword [rcx + 0xf8], 0
je 0x14000fd07
mov ecx, ebx
call fcn.14000fdac
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000fba0
nop
cmp dword [rbp + 0x20], 0
jne 0x14000fd68
call fcn.14001497c
cmp eax, 1
jne 0x14000fd58
xor dl, dl
jmp 0x14000fd62
call fcn.140014948
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x14000fd73
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000fd7c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000fc98

Function at 0x14000fe80
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000fd07
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fd07
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000fd07
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000fd07
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000fd07
cmp dword [rcx + 0x84], 0xe
jbe 0x14000fd07
cmp dword [rcx + 0xf8], 0
je 0x14000fd07
mov ecx, ebx
call fcn.14000fdac
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000fba0
nop
cmp dword [rbp + 0x20], 0
jne 0x14000fd68
call fcn.14001497c
cmp eax, 1
jne 0x14000fd58
xor dl, dl
jmp 0x14000fd62
call fcn.140014948
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x14000fd73
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000fd7c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000fc98
Function at 0x140019678
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400196ff
mov rsi, rbx
cmp word [rax], bp
je 0x1400196be
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400196a8
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400196a4
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140016bb0
mov rdi, rax
test rax, rax
je 0x1400196ec
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140020890
mov rbp, rdi
xor ecx, ecx
call fcn.140015b90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001bc20
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001bc36
mov al, 1
jmp 0x14001bca2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001bc47
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001bca0
mov ecx, dword [rcx + 0x18]
nop
call fcn.140019e1c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001bca0
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov r9d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001bca0
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001bca0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001bca2
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400200e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140020108
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140020108
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140002810
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
nop word cs:[rax + rax]
mov eax, dword [0x141dc2358]
mov edx, dword [0x141dc235c]
add eax, edx
add eax, 0x3bbcfbad
imul rax, rax, 0x1f079eb9
shr rax, 0x3b
cmp eax, 0x9540c9c5
ja 0x140002830
test rsi, rsi
je 0x140003257
nop
mov eax, dword [0x141dc2360]
or eax, dword [0x141dc2364]
add eax, 0xc145e337
imul rax, rax, 0x10424d13
shr rax, 0x39
or eax, 0xd656c3aa
cmp eax, 0x2f0d68c3
jb 0x140002860
mov rbx, qword [rcx]
xor r12d, r12d
mov ebp, 0x99a93319
lea r15, [0x141dbc194]
lea r13, [0x141dbc248]
nop word cs:[rax + rax]
test r12b, r12b
je 0x1400028d0
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.14008a8b0
nop word cs:[rax + rax]
mov eax, dword [0x141dc2368]
xor edx, edx
div dword [0x141dc236c]
mov r14d, eax
xor r14d, 0x84200124
or r14d, 0x5bcbead9
imul r14, rbp
shr r14, 0x3f
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.14008a8b0
cmp r14d, 0xf1c35172
ja 0x1400028d0
mov rcx, rdx
test rax, rax
je 0x140002990
mov r8d, ecx
and r8d, 3
nop dword [rax]
mov eax, dword [0x141dc2380]
xor eax, dword [0x141dc2384]
and eax, 0x172a11cf
add eax, 0xf2ffbf5e
imul rdx, rax, 0x82e5dbd
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
cmp eax, 0x3088fa51
ja 0x140002920
movsxd rax, dword [r15 + r8*4]
add rax, r15
jmp rax
mov eax, dword [0x141dc2370]
add eax, dword [0x141dc2374]
xor eax, 0x7bff328f
add eax, 0xfea17171
and eax, 0xa8b0cd4b
cmp eax, 0x6b7fca75
je 0x140002990
nop word cs:[rax + rax]
mov eax, dword [0x141dc2378]
xor edx, edx
div dword [0x141dc237c]
or eax, 0xf79afd3
add eax, 0xbe91e7da
cmp eax, 0x5c62cad2
jb 0x1400029c0
test rcx, rcx
je 0x140003278
nop dword [rax + rax]
test r12b, r12b
jne 0x1400029f0
sub rsi, rcx
jb 0x140003255
mov eax, dword [0x141dc2440]
xor edx, edx
div dword [0x141dc2444]
mov eax, dword [0x141dc2448]
xor edx, edx
div dword [0x141dc244c]
and eax, 0xb295cf62
imul eax, eax, 0xfe013221
add eax, 0x8d30c7
cmp eax, 0x6b246818
ja 0x140002a0c
add rdi, rcx
jmp 0x140002ce0
mov eax, dword [0x141dc24d0]
imul eax, dword [0x141dc24d4]
add eax, 0x4c9a4b15
and eax, 0x5697a439
cmp eax, 0x5784082e
je 0x140002ce0
test rsi, rsi
jne 0x1400028b0
jmp 0x140003257
ud2
xor ecx, ecx
xor eax, eax
nop dword [rax + rax]
test al, al
jne 0x140003260
mov rax, rcx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x141dbb6e0]
jmp 0x140003259
Function at 0x140017320
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
nop dword [rax + rax]
mov eax, dword [0x141dc4a00]
or eax, dword [0x141dc4a04]
imul eax, eax, 0x14dacaca
or eax, 0xc244c623
cmp eax, 0x90d76cd5
jb 0x140017330
xor eax, eax
test al, al
jne 0x140017350
mov eax, dword [0x141dc4a08]
imul eax, dword [0x141dc4a0c]
mov rdi, qword [rsi + 0x10]
imul eax, eax, 0xc5aec360
add eax, 0x23cea220
cmp eax, 0x4a050e73
jae 0x140017380
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word [rax + rax]
mov eax, dword [0x141dc4a10]
sub eax, dword [0x141dc4a14]
or eax, 0xab5bbdf3
imul ebp, eax, 0x5ce454b0
mov rcx, rdi
call rbx
cmp ebp, 0x4750bc22
jb 0x140017390
test eax, eax
jne 0x140017420
xor eax, eax
test al, al
jne 0x1400173e9
mov eax, dword [0x141dc4a18]
add eax, dword [0x141dc4a1c]
xor eax, 0x9efa2b97
imul edi, eax, 0xc07f8974
add edi, 0xd550ffa0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0xaff341ad
jbe 0x140017400
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400173be
mov eax, dword [0x141dc4a20]
or eax, dword [0x141dc4a24]
add eax, 0x4a727c44
cmp eax, 0x383bd715
ja 0x140017400
nop dword [rax + rax]
mov eax, dword [0x141dc4a28]
and eax, dword [0x141dc4a2c]
add eax, 0xcc626caf
imul rax, rax, 0x4e293645
shr rax, 0x3e
cmp eax, 0x4b30249
je 0x140017420
nop word cs:[rax + rax]
mov eax, dword [0x141dc4a30]
sub eax, dword [0x141dc4a34]
add eax, 0xca27a161
or eax, 0x41110b0
and eax, 0x345d1bf1
cmp eax, 0x856cf370
ja 0x140017450
cmp rsi, 0xffffffffffffffff
je 0x14001759f
lea rax, [rsi + 8]
mov ecx, dword [0x141dc4a38]
imul ecx, dword [0x141dc4a3c]
imul rcx, rcx, 0x322ae89f
shr rcx, 0x3a
or ecx, 0x9b441769
xor ecx, 0x9565a157
cmp ecx, 0x43a36785
ja 0x140017480
lock dec qword [rax]
jne 0x14001759f
mov eax, dword [0x141dc4a40]
or eax, dword [0x141dc4a44]
or eax, 0x61ecc21f
add eax, 0x3e85c982
and eax, 0xbad4ecc1
cmp eax, 0xaf9d69ac
je 0x1400174de
xor eax, eax
test al, al
je 0x1400174e0
jmp 0x1400174d8
mov eax, dword [0x141dc4a48]
xor eax, dword [0x141dc4a4c]
or eax, 0x80a5a1dd
and eax, 0x93a5ebdd
cmp eax, 0xb7007c32
jne 0x140017510
mov rax, qword [0x141dde6e0]
nop word cs:[rax + rax]
mov eax, dword [0x141dc4a50]
xor eax, dword [0x141dc4a54]
xor eax, 0x20105000
or eax, 0x9008404
and eax, 0x2b10f436
mov rdi, qword [0x141dde6e0]
cmp eax, 0xa4490089
ja 0x140017510
mov eax, dword [0x141dc4a58]
xor eax, dword [0x141dc4a5c]
imul eax, eax, 0xcaf46e7b
add eax, 0x7365ec51
and eax, 0x76601f06
cmp eax, 0x96990e7c
ja 0x14001758f
mov eax, dword [0x141dc4a60]
imul eax, dword [0x141dc4a64]
add eax, 0xecd00382
or eax, 0x115262d
imul ebx, eax, 0x9adefc93
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0xc7046d72
jbe 0x14001759f
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14001755c
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140017ec0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
imul rdx, rdx, 0x443c729f
mov rcx, rdx
shr rcx, 0xd
nop word cs:[rax + rax]
mov r8d, dword [0x141dc4c18]
or r8d, dword [0x141dc4c1c]
xor r8d, 0x402000
or r8d, 0xe0004001
and r8d, 0xf0c06001
cmp r8d, 0x7063dcd1
jb 0x140017ee0
xor rcx, rdx
add rcx, 0xffffffffb58276f4
mov rdx, rcx
rol rdx, 6
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x140017f30
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rcx
mov r8, rdx
rol r8, 3
xor r8, rdx
add r8, 0xffffffffeb98a398
mov rcx, r8
rol rcx, 7
xor rcx, r8
nop
mov edx, dword [0x141dc4c20]
xor edx, dword [0x141dc4c24]
xor edx, 0x132846e6
or edx, 0xe8c52111
imul r8, rdx, 0x214ec7b7
shr r8, 0x20
sub edx, r8d
shr edx, 1
add edx, r8d
shr edx, 0x1c
cmp edx, 0x792b3986
ja 0x140017f50
movzx ecx, cx
add rax, rcx
nop dword [rax]
mov ecx, dword [0x141dc4c28]
xor ecx, dword [0x141dc4c2c]
add ecx, 0xfe0b4f79
xor ecx, 0x7f17f2fa
cmp ecx, 0xedb776de
ja 0x140017f90
ret

Function at 0x140017fc0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, 0xffffffffdd256472
sub rcx, rdx
xor rcx, 0x44198fa
imul rcx, rcx, 0xffffffffe86799cc
add rcx, 0xffffffffe86799cc
mov r8d, 0x999b4eb7
mov rdx, rcx
rol rdx, 4
nop
mov r9d, dword [0x141dc4c30]
or r9d, dword [0x141dc4c34]
imul r9, r8
shr r9, 0x3e
or r9d, 0x774be7e2
xor r9d, 0x52d748a8
cmp r9d, 0xcf84fa99
ja 0x140017ff0
xor edx, ecx
movzx edx, dx
mov ecx, 0x8c32118d
add rax, rdx
nop word [rax + rax]
mov edx, dword [0x141dc4c38]
and edx, dword [0x141dc4c3c]
shr edx, 1
imul rdx, rcx
shr rdx, 0x3e
add edx, 0xa5d18641
cmp edx, 0xd2b38a2c
ja 0x140018030
ret

Function at 0x140018160
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x5c4125e3
sub rax, rdx
xor rax, 0x373f6b78
mov rdx, rax
rol rdx, 6
xor edx, eax
movzx eax, dx
add rax, rcx
nop dword [rax]
mov ecx, dword [0x141dc4c58]
and ecx, dword [0x141dc4c5c]
xor ecx, 0x14806008
or ecx, 0x6b768ff5
cmp ecx, 0x75886224
je 0x140018180
mov ecx, dword [0x141dc4c60]
sub ecx, dword [0x141dc4c64]
imul ecx, ecx, 0xddebea82
and ecx, 0x9f7d9652
add ecx, 0x44d970f1
cmp ecx, 0xdd963087
ja 0x1400181a0
ret

Function at 0x140018280
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0x30fd7dcb
add rdx, 0xfffffffff772f0a4
mov rcx, rdx
shr rcx, 0x1b
xor rcx, rdx
mov rdx, rcx
rol rdx, 3
nop word cs:[rax + rax]
mov r8d, dword [0x141dc4c80]
imul r8d, dword [0x141dc4c84]
xor r8d, 0x14440000
and r8d, 0x14c41011
cmp r8d, 0xe163e2a8
je 0x1400182b0
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop
mov ecx, dword [0x141dc4c88]
sub ecx, dword [0x141dc4c8c]
and ecx, 0xee4da7a5
xor ecx, 0x79803cea
cmp ecx, 0xa1b90d9
jb 0x1400182e0
ret

Function at 0x140018310
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
not rdx
imul rdx, rdx, 0xffffffffd8aacb23
xor rdx, 0xffffffffd5764a6d
mov rcx, rdx
rol rcx, 5
nop dword [rax + rax]
mov r8d, dword [0x141dc4c90]
xor r8d, dword [0x141dc4c94]
xor r8d, 0x80ef8f91
add r8d, 0x2de9da85
cmp r8d, 0xad301646
ja 0x140018330
xor rcx, rdx
mov rdx, rcx
rol rdx, 1
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret
Function at 0x140018370
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
movabs r8, 0xec460a95df698d7c
imul r8, rdx
mov rcx, r8
rol rcx, 4
xor rcx, r8
mov rdx, rcx
rol rdx, 5
nop word cs:[rax + rax]
mov r8d, dword [0x141dc4c98]
add r8d, dword [0x141dc4c9c]
xor r8d, 0x7e59df0
imul r8d, r8d, 0x8b505bd3
add r8d, 0x50fb364f
cmp r8d, 0x26343b42
jb 0x1400183a0
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x140018470
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
rol rax, 1
xor rax, rdx
mov r8, rax
shr r8, 0xe
xor r8, rax
nop word cs:[rax + rax]
mov eax, dword [0x141dc4ca8]
xor edx, edx
div dword [0x141dc4cac]
imul eax, eax, 0xca8da3d3
imul rdx, rax, 0xb508413
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1e
cmp eax, 0x92e29ecd
je 0x140018490
mov rdx, r8
rol rdx, 6
xor rdx, r8
mov rax, 0xffffffff912a2872
sub rax, rdx
mov rdx, rax
rol rdx, 1
nop dword [rax]
mov r8d, dword [0x141dc4cb0]
and r8d, dword [0x141dc4cb4]
and r8d, 0x12c55e0d
imul r8d, r8d, 0xf1de004a
add r8d, 0x4fbd0838
cmp r8d, 0xd351269a
ja 0x1400184e0
nop dword [rax]
mov r8d, dword [0x141dc4cb8]
imul r8d, dword [0x141dc4cbc]
xor r8d, 0xe05bd4dc
imul r9, r8, 0x1939afd5
shr r9, 0x20
sub r8d, r9d
shr r8d, 1
add r8d, r9d
shr r8d, 0x1d
cmp r8d, 0x36a4adde
je 0x140018510
xor edx, eax
movzx eax, dx
add rcx, rax
mov rax, rcx
ret

Function at 0x1400185f0
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0xffffffffedb3fb28
mov rax, rcx
movabs rcx, 0xffffffff450be045
add rdx, rcx
mov rcx, rdx
rol rcx, 1
xor ecx, edx
movzx ecx, cx
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141dc4cc8]
xor ecx, dword [0x141dc4ccc]
xor ecx, 0x268c2ba8
add ecx, 0xe316e30e
imul rcx, rcx, 0x4c400c39
shr rcx, 0x3d
cmp ecx, 0x17fcefdf
ja 0x140018620
ret

Function at 0x140018650
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rcx
mov r8d, 0x366f1e29
sub r8, rdx
nop dword [rax]
mov ecx, dword [str.FmEN_]
imul ecx, dword [0x141dc4cd4]
add ecx, 0xc204824e
or ecx, 0x32d3dadf
and ecx, 0x7bf7fbff
cmp ecx, 0x9c469adf
je 0x140018660
mov rdx, r8
shr rdx, 0x10
mov ecx, 0xb8e1d2db
xor rdx, r8
xor rdx, 0x6109122b
imul r8, rdx, 0xffffffffda2c0f9c
mov rdx, r8
rol rdx, 6
nop dword [rax + rax]
mov r9d, dword [0x141dc4cd8]
sub r9d, dword [0x141dc4cdc]
add r9d, 0xb6ad4687
xor r9d, 0xec209e7a
imul r9, rcx
shr r9, 0x3f
cmp r9d, 0x385aaafd
ja 0x1400186b0
xor edx, r8d
movzx ecx, dx
add rax, rcx
ret

Function at 0x140018790
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rcx
imul rcx, rdx, 0xe1321f8
nop word [rax + rax]
mov edx, dword [0x141dc4cf8]
xor edx, dword [0x141dc4cfc]
xor edx, 0x57b8b3e6
imul r8, rdx, 0x290a79d1
shr r8, 0x20
sub edx, r8d
shr edx, 1
add edx, r8d
shr edx, 0x1e
cmp edx, 0xedee2da0
je 0x1400187a0
xor rcx, 0x686e0085
add rcx, 0xe98cf1d
mov rdx, rcx
rol rdx, 6
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret