joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d8790
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
xor eax, eax
test r8, r8
cmovg rax, r8
mov qword [rsp + 0x20], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 8], rax
mov eax, dword [0x1401f8f90]
mov ecx, dword [0x1401f8f94]
xor ecx, 0xcfe414f5
xor edx, edx
div ecx
mov edx, 0xcc11a4d4
xor edx, 0xf3b3c729
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
mov edx, 0xc1457ff8
xor edx, 0xfee71c05
or eax, edx
and eax, ecx
mov ecx, 0x6cb74a09
xor ecx, 0xb1fc786
sub eax, ecx
mov ecx, 0xeb8f7b38
xor ecx, 0x6b911207
add eax, ecx
add eax, 0x67a88d8f
sub eax, 0xcc6d980e
mov ecx, 0x2d33984d
xor ecx, 0xcae0bb03
cmp eax, ecx
je 0x1400d8902
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x20]
mov eax, dword [0x1401f8f98]
mov r8d, dword [str.AJn5]
xor r8d, 0xda4bff0d
or eax, r8d
mov r8d, eax
and r8d, 0x13819e13
shl r8d, 1
xor eax, 0x13819e13
add eax, r8d
mov r8d, 0xb65703c4
xor r8d, 0x94003d8f
sub eax, r8d
add eax, 0xf0b7e4d8
cmp rcx, rdx
sete cl
mov byte [rsp + 7], cl
cmp eax, 0x37aca256
jbe 0x1400d882b
mov al, byte [rsp + 7]
test al, 1
jne 0x1400d88fd
jmp 0x1400d889d
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x10]
mov dl, byte [rdx + rax]
mov byte [rcx + rax], dl
movabs rcx, 0xef1d5151d72811c1
movabs rdx, 0xeb5f1339378e8803
xor rcx, rdx
sub rax, rcx
movabs rcx, 0x978a7c19df544d62
movabs rdx, 0x978a7c19df544d63
xor rcx, rdx
add rax, rcx
movabs rcx, 0x4424268e0a699c2
add rax, rcx
mov qword [rsp + 0x28], rax
jmp 0x1400d87b3
add rsp, 0x30
ret
invalid
Function at 0x1400e5f60
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x1d0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x78], rdx
mov qword [rbp + 0x80], rcx
mov eax, 0x10
mov qword [rbp + 0x90], rax
call fcn.1401f2390
Function at 0x1400e7860
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x30], rcx
mov eax, 0x10
call fcn.1401f2390
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.1400d6028
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov cx, 0xcd0a
xor cx, 0x8e2f
mov dx, 0x3f5a
xor dx, 0x97f

Function at 0x1400e7cf0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0xf0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x60], rdx
mov qword [rbp + 0x68], rcx
mov eax, dword [0x1401f94b0]
Function at 0x1400eb7e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.1400eb930
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.1400eba10
test al, 1
jne 0x1400eb80a
jmp 0x1400eb917
mov eax, dword [0x1401f9650]
sub eax, dword [0x1401f9654]
mov ecx, 0xbc78a043
xor ecx, 0xc3b02b4e
add eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0xb8c0ad5a
xor edx, 0x1e838b28
and edx, ecx
mov r8d, 0x704b5a38
xor r8d, 0xd6087c4a
mov ecx, 0x2a9eab19
xor ecx, 0xd56154e6
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xa6432672
or eax, 0xa6432672
imul eax, edx
add eax, ecx
mov ecx, 0x6e13797d
xor ecx, 0x83eb2d95
sub eax, ecx
add eax, 0xc9a5001f
add eax, 0xedf854e8
cmp eax, 0x8b15e6e4
jbe 0x1400eb91d
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401f9658]
xor eax, 0x77e3aeb6
mov r8d, dword [0x1401f965c]
xor r8d, 0x62f019fe
xor edx, edx
div r8d
add eax, 0xa21ff8fa
mov r8d, 0x299170f7
xor edx, edx
div r8d
mov r8d, 0xb1c5ac38
xor edx, edx
div r8d
mov dword [rsp + 0x20], eax
call fcn.1400eb4d0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x20]
mov cl, byte [rcx]
mov dl, 0x77
xor dl, 0x77
cmp cl, dl
sete cl
mov byte [rsp + 0x27], cl
cmp eax, 0x9e2f0c19
je 0x1400eb88c
mov al, byte [rsp + 0x27]
test al, 1
jne 0x1400eb908
jmp 0x1400eb917
mov rcx, qword [rsp + 0x28]
mov edx, 8
call fcn.14000fac0
nop
add rsp, 0x38
ret
sub dword [rdx], eax
retf 0xe98e

Function at 0x1400eb930
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov eax, dword [0x1401f9660]
mov ecx, dword [0x1401f9664]
xor ecx, 0xc8e1f392
sub eax, ecx
mov edx, eax
and edx, 0x85a32e02
mov ecx, 0x38c2559c
xor ecx, 0x38c2559e
imul ecx, edx
add eax, 0x85a32e02
sub eax, ecx
mov ecx, 0xb2349a1f
xor ecx, 0xa963db15
add eax, ecx
mov ecx, 0x7936a398
xor edx, edx
div ecx
mov ecx, 0xbaee9206
xor ecx, 0x97aeb692
cmp eax, ecx
je 0x1400eb9fb
mov eax, dword [0x1401f9668]
xor eax, 0x2b8b92b8
or eax, dword [0x1401f966c]
mov ecx, 0x5be6da59
xor ecx, 0x965c3c8
or eax, ecx
mov ecx, 0xedd82641
xor ecx, 0x7cc9ef80
xor edx, edx
div ecx
mov ecx, 0x185fe032
xor edx, edx
div ecx
mov dword [rsp + 0x2c], eax
mov rax, qword [0x140209370]
mov ecx, dword [rax]
call fcn.140009923
mov rcx, rax
mov eax, dword [rsp + 0x2c]
add rcx, 0x50
mov qword [rsp + 0x30], rcx
cmp eax, 0x2d07c261
ja 0x1400eb98e
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
mov dh, 5
leave
in al, dx
jmp 0x1400eb98e
Function at 0x1400ec950
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
mov ecx, dword [0x1401f96f0]
add ecx, dword [0x1401f96f4]
mov edx, 0xffffffff
xor edx, 0xf15b3417
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0xc7f0f8a8
xor ecx, 0x429078e
or eax, ecx
imul eax, eax, 0x52184897
cmp eax, 0xc9471351
jae 0x1400ecb3b
mov ecx, dword [0x1401f96f8]
imul ecx, dword [0x1401f96fc]
mov eax, ecx
and eax, 0xed160506
or ecx, 0xed160506
add eax, ecx
or eax, 0x90b76bf1
mov ecx, 0x665ad489
xor ecx, 0x26b1ee8c
sub eax, ecx
mov dword [rsp + 0x48], eax
mov eax, 0xd7432ecf
xor eax, 0xc117296c
mov dword [rsp + 0x44], eax
call fcn.1400ec743
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
call fcn.1400ec760
mov ecx, dword [rsp + 0x44]
mov dl, al
mov eax, dword [rsp + 0x48]
mov byte [rsp + 0x4f], dl
cmp eax, ecx
jbe 0x1400ecb3b
mov al, byte [rsp + 0x4f]
test al, 1
jne 0x1400eca0f
jmp 0x1400ecb35
mov ecx, dword [0x1401f9700]
mov edx, dword [0x1401f9704]
xor edx, 0x717cbc4b
mov eax, ecx
and eax, eax
mov r8d, 0x897a35e6
xor r8d, 0x7685ca19
xor eax, r8d
and eax, edx
xor eax, 0xffffffff
and edx, edx
xor edx, 0xffffffff
and ecx, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
mov edx, 0xda722c46
xor edx, 0x258dd3b9
xor ecx, edx
or eax, ecx
mov ecx, 0xe5e76161
xor ecx, 0xe8d5a717
xor edx, edx
div ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xeee45f7f
mov r8d, 0xffffffff
xor r8d, 0xeee45f7f
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xeee45f7f
or eax, 0xeee45f7f
imul eax, edx
add eax, ecx
and eax, 0x8d55334a
cmp eax, 0x8c29c1e9
jae 0x1400ecb44
mov rcx, qword [rsp + 0x50]
mov eax, dword [0x1401f9708]
xor eax, 0x427866aa
add eax, dword [0x1401f970c]
or eax, 0xec3ea98e
mov r8d, 0x7aef1dbf
xor edx, edx
div r8d
mov edx, eax
and edx, 0x203bfd2e
shl edx, 1
add eax, 0x203bfd2e
sub eax, edx
mov dword [rsp + 0x30], eax
mov eax, 0xa26f4600
xor eax, 0x226433d2
mov dword [rsp + 0x2c], eax
call fcn.1400ec440
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x30]
cmp byte [rdx], 0
sete dl
mov byte [rsp + 0x37], dl
cmp eax, ecx
je 0x1400ecaa7
mov al, byte [rsp + 0x37]
test al, 1
jne 0x1400ecb26
jmp 0x1400ecb35
mov rcx, qword [rsp + 0x50]
mov edx, 8
call fcn.14000fac0
nop
add rsp, 0x58
ret
inc dword [rdi + 0x50e947c9]
invalid
invalid
Function at 0x1400ed0b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
call fcn.1400eced6
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1400ecf00
test al, 1
jne 0x1400ed0e2
jmp 0x1400ed10f
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
call fcn.1400ecbd0
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
jne 0x1400ed1c1
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov edx, 8
call fcn.14000fac0
mov ecx, dword [0x1401f9740]
or ecx, dword [0x1401f9744]
mov eax, 0xffffffff
xor eax, 0xf47ddfaf
xor edx, edx
sub edx, 1
sub eax, edx
sub ecx, eax
mov edx, 0xffffffff
xor edx, 0xf15b3417
mov eax, ecx
xor eax, edx
and eax, ecx
or eax, 0xc3d9ff26
cmp eax, 0xa32677f
je 0x1400ed294
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401f9748]
mov r8d, dword [0x1401f974c]
xor r8d, 0x75a7b014
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x20]
mov r8d, eax
mov eax, 0x538204c3
xor eax, 0x9f9be5f7
imul r8d, eax
mov eax, r8d
and eax, 0xed160506
mov r9d, 0x665ad489
xor r9d, 0x8b4cd18f
or r8d, r9d
add eax, r8d
mov r8d, 0x25fc7cd9
xor r8d, 0xb54b1728
or eax, r8d
mov qword [rcx], rdx
cmp eax, 0x78fe7a72
je 0x1400ed294
jmp 0x1400ed1c1
mov ecx, dword [0x1401f9750]
imul ecx, dword [0x1401f9754]
mov eax, ecx
and eax, eax
mov edx, 0xc8dc2001
xor edx, 0x3723dffe
xor eax, edx
and eax, 0x2b8b6bae
xor eax, 0xffffffff
mov edx, 0x7f53e8f9
xor edx, 0x54d88357
mov r8d, 0xf192e167
xor r8d, 0xda198ac9
and edx, r8d
xor edx, 0xffffffff
and ecx, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0xd32c676
xor edx, edx
div ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xeee45f7f
mov r8d, 0xffffffff
xor r8d, 0xeee45f7f
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xeee45f7f
or eax, 0xeee45f7f
imul eax, edx
add eax, ecx
cmp eax, 0x1772e37c
jb 0x1400ed29d
mov eax, dword [0x1401f9758]
xor eax, 0x427866aa
sub eax, dword [0x1401f975c]
add eax, 0x5f389dfe
or eax, 0xec3ea98e
mov ecx, 0x7aef1dbf
xor edx, edx
div ecx
mov ecx, 0x943450c7
xor ecx, 0xbdf4c4b
cmp eax, ecx
je 0x1400ed258
add rsp, 0x38
ret
inc dword [rdi - 0x4d16b837]
invalid
invalid
Function at 0x1400edad0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
mov ecx, dword [0x1401f9780]
add ecx, dword [0x1401f9784]
and ecx, 0x6e822b22
mov edx, 0xd67cd218
xor edx, 0x5e2b779b
mov eax, ecx
and eax, edx
shl eax, 1
mov edx, 0x1c3181f8
xor edx, 0x9466247b
xor ecx, edx
add ecx, eax
mov eax, ecx
or eax, 0x3bd4e403
xor eax, 0xffffffff
or ecx, 0x3bd4e403
mov edx, 0x9bd161f8
xor edx, 0x642e9e07
xor ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
cmp eax, 0xaad27dc1
jb 0x1400edd0f
mov eax, dword [0x1401f9788]
xor eax, 0xb05c6084
mov ecx, dword [0x1401f978c]
xor edx, edx
div ecx
imul eax, eax, 0x1e7dbca3
and eax, 0x80069020
mov dword [rbp - 0x34], eax
mov eax, 0x10
mov qword [rbp - 0x50], rax
call fcn.1401f2390
sub rsp, rax
mov rax, qword [rbp - 0x50]
mov rcx, rsp
mov qword [rbp - 0x58], rcx
call fcn.1401f2390
sub rsp, rax
mov rax, qword [rbp - 0x50]
mov rcx, rsp
mov qword [rbp - 0x48], rcx
call fcn.1401f2390
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
sub rsp, 0x20
call fcn.1400edaaa
mov rdx, qword [rbp - 0x10]
add rsp, 0x20
mov rcx, rax
mov eax, dword [rbp - 0x34]
mov qword [rbp - 0x30], rcx
movabs r8, 0x697209ab0b6c53c5
movabs r9, 0x697209ab0b6c53c5
xor r8, r9
mov qword [rdx], r8
mov qword [rdx + 8], 0
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0x21], cl
cmp eax, 0x77e0659b
ja 0x1400edb53
mov al, byte [rbp - 0x21]
test al, 1
jne 0x1400edc15
jmp 0x1400edd06
mov rax, qword [rbp - 0x18]
mov rcx, qword [rax]
mov rax, qword [rax + 8]
mov qword [rbp - 0x70], rax
xor eax, eax
test rcx, rcx
cmovg rax, rcx
mov qword [rbp - 0x68], rax
xor eax, eax
mov qword [rbp - 0x60], rax
mov rcx, qword [rbp - 0x68]
mov rax, qword [rbp - 0x60]
mov qword [rbp - 0x78], rax
cmp rax, rcx
je 0x1400edd06
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x58]
mov rax, qword [rbp - 0x20]
mov r9, qword [rbp - 0x78]
mov r8, qword [rbp - 0x70]
add r8, 8
shl r9, 5
add r8, r9
mov r9, qword [r8]
mov qword [rcx], r9
mov r8, qword [r8 + 8]
mov qword [rcx + 8], r8
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14003ddc0
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x80], rcx
cmp byte [rax], 0
jne 0x1400edd06
mov rax, qword [rbp - 0x80]
cmp rax, 0
jne 0x1400edcf5
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x10]
mov r8, qword [rbp - 0x78]
mov rax, qword [rbp - 0x70]
add rax, 8
shl r8, 5
add rax, r8
add rax, 0x10
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.1400191eb
add rsp, 0x20
jmp 0x1400edd06
mov rax, qword [rbp - 0x78]
add rax, 1
mov qword [rbp - 0x60], rax
jmp 0x1400edc37
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
jmp 0x1400edcf9
Function at 0x1400eedb0
Capabilities:
Encode data using add xor sub operations

Disassembly:
push rax
mov qword [rsp], rcx
mov ecx, dword [0x1401f97f0]
imul ecx, dword [0x1401f97f4]
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
and eax, edx
mov edx, 0x2b8b6bae
or edx, 0x2b8b6bae
xor edx, 0xffffffff
xor eax, 0xffffffff
mov r8d, 0xf8b5e5c9
xor r8d, 0x74a1a36
xor edx, r8d
and eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x2b8b6bae
and ecx, edx
mov edx, 0x21be8a40
xor edx, 0xde4175bf
xor eax, edx
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x3b153f67
xor ecx, 0x3627f911
xor edx, edx
div ecx
imul eax, eax, 0xeee45f7f
mov ecx, 0xeeeb2147
xor ecx, 0xf999c23b
cmp eax, ecx
jb 0x1400eee88
mov eax, dword [0x1401f97f8]
sub eax, dword [0x1401f97fc]
add eax, 0x5f389dfe
and eax, eax
xor eax, 0xffffffff
mov ecx, 0xec3ea98e
and ecx, 0xec3ea98e
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0xed8e15ec
xor ecx, 0x1271ea13
xor eax, ecx
mov ecx, 0x7aef1dbf
xor edx, edx
div ecx
int1
cmp eax, 0x9feb1c8c
je 0x1400eee3b
mov rax, qword [rsp]
pop rcx
ret
cld
jno 0x1400eee76
stosb byte [rdi], al
invalid
Function at 0x1400f0fb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x2f], dl
mov qword [rsp + 0x30], rcx
movabs rdx, 0xe7be7c07b31ae941
movabs rax, 0xe7be7c07b31ae940
xor rdx, rax
call fcn.14001a700
mov r8b, byte [rsp + 0x2f]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
add rax, 8
mov qword [rsp + 0x38], rax
mov rax, qword [rcx + 8]
mov rdx, qword [rcx]
mov byte [rax + rdx + 8], r8b
mov rdx, qword [rcx]
movabs rcx, 0x93e74b89839b8a66
movabs rax, 0x93e74b89839b8a66
xor rcx, rax
sub rcx, rdx
xor eax, eax
sub rax, 1
add rcx, rax
xor eax, eax
sub rax, rcx
mov qword [rsp + 0x40], rax
xor rdx, 0xffffffffffffffff
mov rcx, rax
xor rcx, rdx
xor rcx, 0xffffffffffffffff
or rax, rdx
and rax, rcx
cmp rax, 0
jge 0x1400f1053
call fcn.140009cc0
jmp 0x1400f110f
mov eax, dword [0x1401f98d0]
xor edx, edx
div dword [0x1401f98d4]
imul ecx, eax, 0xd27fe2d5
mov eax, ecx
and eax, 0x3e14cb98
mov edx, 0x18d2549e
xor edx, 0x18d2549c
imul eax, edx
xor ecx, 0x3e14cb98
add ecx, eax
mov eax, ecx
and eax, 0x4d76e85b
xor ecx, 0x4d76e85b
or eax, ecx
cmp eax, 0x6ca50866
jae 0x1400f1114
mov rcx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x30]
mov eax, dword [0x1401f98d8]
mov edx, 0x10c41bce
xor edx, 0x253c5c7f
xor eax, edx
xor edx, edx
div dword [0x1401f98dc]
mov rdx, qword [rsp + 0x40]
mov r9d, eax
or r9d, 0x2fd63684
mov r10d, 0xf5b3a741
xor r10d, 0x3050baf8
mov eax, r9d
and eax, r10d
xor r9d, 0xc5e31db9
or eax, r9d
xor eax, 0x1899fe8b
mov qword [r8], rdx
mov rcx, qword [rcx]
mov byte [rcx + rdx + 8], 0
cmp eax, 0x5c490d57
jbe 0x1400f109e
jmp 0x1400f110f
add rsp, 0x48
ret
invalid

Function at 0x1400f1a10
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x238
Function at 0x14011d220
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x14011d327
mov rcx, qword [rsp + 0x30]
movabs rax, 0x4000000000000000
and rax, qword [rcx]
movabs rcx, 0x1001a08cbbf5acea
movabs rdx, 0x1001a08cbbf5acea
xor rcx, rdx
cmp rax, rcx
je 0x14011d327
mov ecx, dword [0x1401fa9d8]
sub ecx, dword [0x1401fa9dc]
mov eax, ecx
xor eax, 0xffffffff
and eax, 0xdc8ce9e9
mov edx, 0xffffffff
xor edx, 0xdc8ce9e9
and ecx, edx
sub ecx, eax
mov eax, ecx
or eax, 0xa0589f00
mov edx, 0x56bafe12
xor edx, 0xa94501ed
xor eax, edx
mov edx, 0xd877b358
xor edx, 0x27884ca7
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0xa0589f00
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0x62b2920a
xor edx, edx
div ecx
mov ecx, 0x4d5711ac
xor ecx, 0x1b085af9
cmp eax, ecx
jae 0x14011d32c
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401fa9e0]
and eax, dword [0x1401fa9e4]
mov edx, 0x864433bd
xor edx, 0x47b7db93
or eax, edx
add eax, 0x42f0ce9f
or eax, 0xd6b235a
mov dword [rsp + 0x24], eax
call fcn.140014e3e
mov eax, dword [rsp + 0x24]
cmp eax, 0xaa06233c
je 0x14011d2e2
jmp 0x14011d327
add rsp, 0x38
ret
pop rax
ret 0x3515
Function at 0x14011eeb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x20
mov byte [rsp + 0x17], dl
mov qword [rsp + 0x18], rcx
mov eax, dword [0x1401fadc0]
or eax, dword [0x1401fadc4]
mov ecx, eax
and ecx, 0x1fc8950e
shl ecx, 1
mov edx, 0xcf13946a
xor edx, 0xd0db0164
add eax, edx
sub eax, ecx
mov r8d, 0xdfe3ef21
xor r8d, 0x748c254
mov ecx, 0xfa4b940b
xor ecx, 0x5b46bf4
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x4cc57396
xor r8d, 0xb33a8c69
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xd8ab2d75
or eax, 0xd8ab2d75
imul eax, edx
add eax, ecx
mov ecx, 0xb8c0ad5a
xor ecx, 0x9ca2577c
or eax, ecx
mov ecx, 0x704b5a38
xor ecx, 0x11b90943
cmp eax, ecx
ja 0x14011effb
mov eax, dword [0x1401fadc8]
xor eax, 0xe3088d3e
xor eax, dword [0x1401fadcc]
sub eax, 0x1f448a0b
xor eax, 0xdf5649ce
mov ecx, 0x6e13797d
xor ecx, 0x6e13797d
mov edx, 0xc42dedeb
xor edx, 0x283f413d
sub ecx, edx
sub eax, ecx
cmp eax, 0xd9c0228f
jae 0x14011ef4d
xor eax, eax
mov qword [rsp + 8], rax
jmp 0x14011ef99
mov rax, qword [rsp + 8]
mov qword [rsp], rax
cmp rax, 0x100
je 0x14011eff6
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x18]
mov dl, byte [rsp + 0x17]
xor dl, byte [rcx + rax]
mov byte [rcx + rax], dl
movabs rcx, 0x99234dd7aef732c2
movabs rdx, 0xf9002a8083b71656
xor rcx, rdx
sub rax, rcx
add rax, 1
movabs rcx, 0x602367572d402494
add rax, rcx
mov qword [rsp + 8], rax
jmp 0x14011ef99
add rsp, 0x20
ret
sub dword [rdx], eax
retf 0xe98e
Function at 0x14012ba60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x47], al
je 0x14012bc2b
mov rax, qword [rsp + 0x38]
movabs rcx, 0x25b9d247bf58e1ed
movabs rdx, 0xc199a25443200906
xor rcx, rdx
sub rax, rcx
add rax, 0xfffffffffffffff0
movabs rcx, 0xe4207013fc78e8eb
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
mov al, 1
cmp rcx, 0x10
mov byte [rsp + 0x47], al
jb 0x14012bc2b
mov r8, qword [rsp + 0x30]
xor eax, eax
mov ecx, eax
sub rcx, r8
xor eax, eax
sub rax, 0xfffffffffffffff0
add rcx, rax
movabs rax, 0x5e8d4362b508dce6
movabs rdx, 0x5e8d4362b508dce6
xor rax, rdx
sub rax, rcx
mov qword [rsp + 0x20], rax
mov rcx, rax
xor rcx, 0xffffffffffffffff
movabs rdx, 0x86db7952edf854e8
and rcx, rdx
mov r10, 0xffffffffffffffff
movabs rdx, 0x86db7952edf854e8
xor r10, rdx
mov r9, rax
and r9, r10
movabs r11, 0x1f84612277d8e7f4
movabs rdx, 0xe07b9edd8827180b
xor r11, rdx
mov rdx, r8
xor rdx, r11
movabs r11, 0x86db7952edf854e8
and rdx, r11
and r8, r10
or rcx, r9
or rdx, r8
xor rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x14012bb7b
jmp 0x14012bb8b
call fcn.140009cc0
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x14012bc2b
mov ecx, dword [0x1401fb308]
sub ecx, dword [0x1401fb30c]
or ecx, 0x45ad24f3
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x1fc8950e
mov edx, 0xffffffff
xor edx, 0x1fc8950e
and ecx, edx
or eax, ecx
imul eax, eax, 0xd8ab2d75
cmp eax, 0xfc4c2b3a
je 0x14012bc39
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x20]
mov eax, dword [0x1401fb310]
mov ecx, dword [0x1401fb314]
sub eax, 0x2d402494
sub eax, ecx
add eax, 0x2d402494
xor eax, 0xf748f1fa
mov ecx, 0x12c89c3c
xor ecx, 0x8f077ea2
add eax, ecx
sub eax, 0x1f448a0b
sub eax, 0x9dcfe29e
xor eax, 0xdf5649ce
mov ecx, 0xa984e56b
xor ecx, 0xcd551205
mov qword [rdx], r8
cmp eax, ecx
jbe 0x14012bbc7
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x14012bc2b
mov al, byte [rsp + 0x47]
and al, 1
movzx eax, al
add rsp, 0x48
ret
sub dword [rdx], eax
retf 0xe98e
Function at 0x14012bc50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1401fb318]
xor edx, edx
div dword [0x1401fb31c]
mov ecx, 0x185fe032
xor edx, edx
div ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x67db26f3
mov r8d, 0xffffffff
xor r8d, 0x67db26f3
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0xa7dac145
xor r8d, 0xc001e7b6
mov edx, eax
and edx, r8d
or eax, 0x67db26f3
imul eax, edx
add eax, ecx
mov ecx, 0x3bd6904e
xor ecx, 0x4f5f2b1c
and eax, ecx
cmp eax, 0x252ba63a
jae 0x14012be52
mov eax, dword [0x1401fb320]
mov ecx, 0xa153566b
xor ecx, 0xf8d9ac87
xor eax, ecx
imul eax, dword [0x1401fb324]
mov ecx, 0xc269e9a8
xor ecx, 0x1005a7aa
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x207c1a6d
and eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x207c1a6d
and ecx, edx
or eax, ecx
mov ecx, 0x6a808729
xor ecx, 0x957f78d6
xor eax, ecx
sub eax, 0x75190035
mov dword [rsp + 0x38], eax
call fcn.14012ba3c
mov qword [rsp + 0x30], rax
mov ecx, 0x20
mov edx, 8
call fcn.140013970
mov qword [rsp + 0x28], rax
mov ecx, 0x20
call fcn.14004daa0
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov r8, rax
mov eax, dword [rsp + 0x38]
mov qword [rdx], r8
mov cl, byte [rcx]
mov dl, 0x7c
xor dl, 0x7c
cmp cl, dl
sete cl
mov byte [rsp + 0x3f], cl
cmp eax, 0x773a44b3
je 0x14012be52
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x14012bd91
jmp 0x14012be48
mov eax, dword [0x1401fb328]
mov edx, dword [0x1401fb32c]
xor ecx, ecx
sub ecx, edx
add eax, ecx
sub eax, 0x221c73ac
add eax, 0xb5e62081
mov ecx, 0x2a16ea95
xor ecx, 0x80a9939
add eax, ecx
mov ecx, 0xea45b192
xor edx, edx
div ecx
mov ecx, eax
mov edx, 0x2dcbabd4
xor edx, 0x9258151e
mov eax, ecx
and eax, edx
xor ecx, 0xbf93beca
or eax, ecx
cmp eax, 0x597d2bb0
je 0x14012be5b
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401fb330]
mov edx, dword [0x1401fb334]
mov r8d, 0x8b89e0df
xor r8d, 0xcf704fea
xor edx, r8d
and eax, edx
mov r8d, 0xf429cfb
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x40]
or eax, 0x7ba56e19
xor r8d, r8d
sub r8d, eax
xor eax, eax
sub eax, 0xf39edcd1
add r8d, eax
xor eax, eax
sub eax, r8d
mov qword [rcx + 0x18], rdx
cmp eax, 0x70876eba
jae 0x14012bde7
jmp 0x14012be48
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret
inc dword [rdi + 0x69e947c9]
invalid
invalid
Function at 0x14012c280
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
xor eax, eax
test r8, r8
cmovg rax, r8
mov qword [rsp + 0x18], rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x18]
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
cmp rax, rcx
je 0x14012c2dc
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
mov dl, byte [rdx + rax]
mov byte [rcx + rax], dl
add rax, 1
mov qword [rsp + 0x20], rax
jmp 0x14012c2a3
mov eax, dword [0x1401fb348]
xor eax, 0x93d56ef3
xor eax, dword [0x1401fb34c]
mov edx, 0x5586b860
xor edx, 0xaa79479f
mov ecx, eax
xor ecx, edx
and ecx, 0xc83a7e52
mov edx, 0xffffffff
xor edx, 0xc83a7e52
and eax, edx
sub eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, 0x5555516d
xor eax, 0x5555516d
mov edx, 0x711e81c4
xor edx, 0x4d884a6c
sub eax, edx
add ecx, eax
mov eax, 0xad01ba4b
xor eax, 0xad01ba4b
sub eax, ecx
mov ecx, 0x489e6f82
xor ecx, 0xc86450f6
xor edx, edx
div ecx
cmp eax, 0xe551c2f
ja 0x14012c399
mov ecx, dword [str._tSR]
or ecx, dword [0x1401fb354]
and ecx, 0xf9ef0813
and ecx, 0xf920cc7b
mov edx, 0x3042493
xor edx, 0x8ee57451
mov eax, 0x43cbfb53
xor eax, 0xbc3404ac
xor edx, eax
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0xaf651ad7
je 0x14012c354
add rsp, 0x28
ret
mov al, 0x77
jmp 0x14012c354