joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400767d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x30], rcx
mov eax, 0x10
call fcn.1401d4340
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.14006624b
mov rcx, qword [rbp - 0x20]
add rsp, 0x20
mov qword [rbp - 0x18], rax
movabs rax, 0x8fe6ac42a40d2e33
movabs rdx, 0x8fe6ac42a40d2e33
xor rax, rdx
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov ecx, 8
sub rsp, 0x20
call fcn.140066362
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov qword [rbp - 0x10], rax
mov al, 1
cmp byte [rcx], 0
mov byte [rbp - 1], al
jne 0x1400769b1
mov eax, dword [0x1401d86e8]
mov edx, dword [0x1401d86ec]
mov ecx, eax
xor ecx, 0xffffffff
and ecx, edx
mov r8d, 0x18d94df9
xor r8d, 0xe726b206
xor edx, r8d
and eax, edx
sub eax, ecx
imul eax, eax, 0xa14ac3e0
mov ecx, 0x70b95e4f
xor ecx, 0x2a5f12ef
xor edx, edx
div ecx
mov ecx, 0xa7ef400c
xor ecx, 0xa7ef400c
mov edx, 0xeba47b3c
xor edx, 0x1b31ad79
sub ecx, edx
add eax, ecx
cmp eax, 0x660b50b
jb 0x1400769ee
mov rcx, qword [rbp - 0x10]
mov eax, dword [0x1401d86f0]
xor eax, 0xde197e6e
xor edx, edx
div dword [0x1401d86f4]
mov rdx, qword [rbp - 0x38]
mov r8d, 0x1b5551dd
xor r8d, 0x7c2245b9
add eax, r8d
sub eax, 0xa8d5566c
mov r8d, 0x45495f0b
xor r8d, 0x223e4b6f
sub eax, r8d
mov r8d, 0xd3b242d4
xor r8d, 0x60c73149
mov r9d, 0xdfdba52d
xor r9d, 0x20245ad2
xor r8d, r9d
xor r9d, r9d
sub r9d, 1
sub r8d, r9d
sub eax, r8d
xor r8d, r8d
sub r8d, eax
xor eax, eax
sub eax, 0x10adee83
add r8d, eax
xor eax, eax
sub eax, r8d
mov dword [rbp - 0x40], eax
sub rsp, 0x20
call fcn.1400767a2
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbp - 0x40]
add rsp, 0x20
mov cl, byte [rcx]
mov dl, 0x64
xor dl, 0x64
cmp cl, dl
sete cl
mov byte [rbp - 0x39], cl
cmp eax, 0x1ea11b70
jae 0x1400768ba
mov cl, byte [rbp - 0x39]
mov al, 1
test cl, 1
mov byte [rbp - 1], al
jne 0x140076980
jmp 0x1400769b1
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax + 0x58]
mov qword [rdx], r8
mov rax, qword [rax + 0x60]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14001976a
mov rax, qword [rbp - 0x18]
add rsp, 0x20
mov al, byte [rax]
mov byte [rbp - 1], al
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov dl, byte [rbp - 1]
mov byte [rbp - 0x41], dl
mov byte [rax], 0
sub rsp, 0x20
call fcn.140065ebc
mov rax, qword [rbp - 0x18]
add rsp, 0x20
cmp byte [rax], 0
jne 0x1400769e5
mov rax, qword [rbp - 0x18]
mov cl, byte [rbp - 0x41]
mov byte [rax], cl
mov rax, qword [rbp - 0x30]
mov rsp, rbp
pop rbp
ret
and byte [rsi], al
stosd dword [rdi], eax
cmp ch, cl
ret
Function at 0x140077580
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x30], rcx
mov eax, 0x10
call fcn.1401d4340
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.14006624b
mov rcx, qword [rbp - 0x20]
add rsp, 0x20
mov qword [rbp - 0x18], rax
mov qword [rcx], 0
mov qword [rcx + 8], 0
movabs rcx, 0xed8294cfec4b3ce1
movabs rax, 0xed8294cfec4b3ce9
xor rcx, rax
sub rsp, 0x20
call fcn.140066362
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov qword [rbp - 0x10], rax
mov al, 1
cmp byte [rcx], 0
mov byte [rbp - 1], al
jne 0x140077660
mov rdx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x10]
sub rsp, 0x20
call fcn.140077553
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov al, 1
cmp byte [rcx], 0
mov byte [rbp - 1], al
jne 0x140077660
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax + 0x58]
mov qword [rdx], r8
mov rax, qword [rax + 0x60]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14001976a
mov rax, qword [rbp - 0x18]
add rsp, 0x20
mov al, byte [rax]
mov byte [rbp - 1], al
mov al, byte [rbp - 1]
mov byte [rbp - 0x39], al
mov eax, dword [0x1401d8748]
xor eax, 0xbc9260c
mov ecx, dword [str.ew3]
xor ecx, 0xf5f05893
add eax, ecx
mov ecx, 0x65ee2a73
xor edx, edx
div ecx
mov ecx, 0x7615efb9
xor edx, edx
div ecx
imul eax, eax, 0xc5c4a321
mov ecx, 0xaf66b934
xor ecx, 0xaea03c75
cmp eax, ecx
ja 0x14007777a
mov rcx, qword [rbp - 0x10]
mov eax, dword [0x1401d8750]
xor eax, 0x6bc2786b
mov edx, dword [0x1401d8754]
xor edx, 0xa5e0db1b
imul eax, edx
mov r8d, 0xe6a912b4
xor r8d, 0xcb1a177c
xor edx, edx
div r8d
mov edx, eax
mov rax, qword [rbp - 0x18]
mov r8d, edx
and r8d, 0x456b8b8d
shl r8d, 1
xor edx, 0x456b8b8d
add edx, r8d
mov r8d, edx
and r8d, 0xce9d842f
shl r8d, 1
mov r9d, 0x3b91a383
xor r9d, 0xf50c27ac
add edx, r9d
sub edx, r8d
mov dword [rbp - 0x40], edx
mov edx, 0x708a29d8
xor edx, 0xb322bbbf
mov dword [rbp - 0x44], edx
mov dl, 0x7c
xor dl, 0x7c
mov byte [rax], dl
sub rsp, 0x20
call fcn.140065ebc
mov rdx, qword [rbp - 0x18]
mov ecx, dword [rbp - 0x44]
mov eax, dword [rbp - 0x40]
add rsp, 0x20
cmp byte [rdx], 0
sete dl
mov byte [rbp - 0x3a], dl
cmp eax, ecx
jae 0x1400776aa
mov al, byte [rbp - 0x3a]
test al, 1
jne 0x140077768
jmp 0x140077771
mov rax, qword [rbp - 0x18]
mov cl, byte [rbp - 0x39]
mov byte [rax], cl
mov rax, qword [rbp - 0x30]
mov rsp, rbp
pop rbp
ret
cmp ah, ch
invalid
Function at 0x14007cab0
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401d8968]
mov ecx, dword [0x1401d896c]
xor ecx, 0x11e3e097
add eax, ecx
mov ecx, 0x2cc43cf9
xor ecx, 0xd33bc306
mov edx, eax
xor edx, ecx
and edx, 0xabc191a9
mov r8d, 0xffffffff
xor r8d, 0xabc191a9
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xabc191a9
mov r8d, 0xc9976b80
xor r8d, 0x6256fa29
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x3f155836
xor ecx, 0xe58c7400
or eax, ecx
mov ecx, 0x8831de5b
xor edx, edx
div ecx
cmp eax, 0x666fb91d
jae 0x14007cbd9
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401d8970]
xor eax, 0x78b6112f
mov r9d, dword [0x1401d8974]
mov edx, eax
xor edx, 0xffffffff
mov r8d, r9d
and r8d, edx
mov r10d, r9d
xor r10d, 0xffffffff
mov edx, eax
and edx, r10d
imul edx, r8d
mov r8d, eax
and r8d, r9d
or eax, r9d
imul eax, r8d
add eax, edx
mov r8d, 0xfbe6bf7b
xor edx, edx
div r8d
sub eax, 0x6200e69
imul eax, eax, 0x3c12a243
mov dword [rsp + 0x24], eax
mov eax, 0x4427baba
xor eax, 0xf864ee8c
mov dword [rsp + 0x20], eax
movabs rdx, 0xdb2728166dc66641
movabs rax, 0xdb2728166dc66651
xor rdx, rax
call fcn.14007c84b
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
jae 0x14007cb3a
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
invalid
Function at 0x14007d990
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
call fcn.14007db80
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx]
call fcn.14007dc90
test al, 1
jne 0x14007d9bd
jmp 0x14007d9ea
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14007d890
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x14007db6a
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
mov edx, 8
call fcn.14000eb78
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x14007da28
mov rcx, qword [rsp + 0x30]
movabs rax, 0x4000000000000000
and rax, qword [rcx]
cmp rax, 0
jne 0x14007da28
mov rcx, qword [rsp + 0x30]
call fcn.14000eb2e
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x28], rax
cmp rax, 0
je 0x14007db6a
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
or rax, rax
movabs rcx, 0xb1706ec5b214331
movabs rdx, 0xf4e8f913a4debcce
xor rcx, rdx
xor rax, rcx
mov rcx, 0xffffffffffffffff
movabs rdx, 0x4000000000000000
xor rcx, rdx
mov rdx, 0xffffffffffffffff
movabs r8, 0x4000000000000000
xor rdx, r8
and rcx, rdx
or rax, rcx
xor rax, 0xffffffffffffffff
movabs rcx, 0x3934da5e8fa25776
movabs rdx, 0x3934da5e8fa25776
xor rcx, rdx
cmp rax, rcx
jne 0x14007db6a
mov ecx, dword [0x1401d89e8]
mov edx, dword [0x1401d89ec]
mov eax, ecx
and eax, edx
or ecx, edx
add eax, ecx
mov ecx, 0xa560c8ac
xor ecx, 0xb070990
sub eax, ecx
mov ecx, 0x11e3e097
xor ecx, 0x32ec1777
sub eax, ecx
sub eax, 0x59e391a3
mov ecx, 0x80e49cdc
xor ecx, 0xc0e74ff8
add eax, ecx
add eax, 0x59e391a3
cmp eax, 0xe0b158ad
ja 0x14007db6f
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401d89f0]
xor edx, edx
div dword [0x1401d89f4]
add eax, 0x81c50afe
add eax, 0xf283265
sub eax, 0x81c50afe
imul eax, eax, 0xace3a9c3
add eax, 0x46e22bbe
sub eax, 0xd0a6863e
sub eax, 0x46e22bbe
mov dword [rsp + 0x24], eax
mov eax, 0x78b6112f
xor eax, 0x1ce03444
mov dword [rsp + 0x20], eax
call fcn.14000eb2e
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
jb 0x14007db07
jmp 0x14007db6a
add rsp, 0x48
ret
call qword [rdi - 0x40]
shr cl, 1
invalid
Function at 0x1400849e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x140084ae7
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
movabs rcx, 0x8485d75b103a815e
movabs rdx, 0xc485d75b103a815e
xor rcx, rdx
and rax, rcx
cmp rax, 0
je 0x140084ae7
mov ecx, dword [0x1401d8d58]
and ecx, dword [0x1401d8d5c]
mov eax, ecx
and eax, 0xccb4e4a6
shl eax, 1
mov edx, 0x728b9c28
xor edx, 0xbe3f788e
add ecx, edx
sub ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x381deca0
mov edx, 0xffffffff
xor edx, 0x381deca0
and ecx, edx
or eax, ecx
mov ecx, 0xcb00fbec
xor ecx, 0xcb00fbec
sub ecx, eax
xor eax, eax
sub eax, 0x212edf7b
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, 0x9ec0de96
xor ecx, 0x86a2df33
cmp eax, ecx
jb 0x140084b92
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401d8d60]
xor eax, 0x2192692
imul eax, dword [0x1401d8d64]
imul eax, eax, 0x5e63f71f
mov edx, 0x3e287ad0
xor edx, 0xc502e80e
or eax, edx
mov edx, 0xd3326a24
xor edx, 0x8a32f306
and eax, edx
mov dword [rsp + 0x24], eax
call fcn.140014d00
mov eax, dword [rsp + 0x24]
cmp eax, 0x28697c05
jb 0x140084a93
jmp 0x140084ae7
mov eax, dword [0x1401d8d68]
mov ecx, dword [0x1401d8d6c]
xor ecx, 0xdb17a52d
add eax, ecx
add eax, 0x25d85cc3
mov ecx, 0xbbc189fe
xor ecx, 0xd20d9836
sub eax, ecx
mov ecx, 0xd5a2fc71
xor ecx, 0x7fed65fb
xor edx, edx
div ecx
cmp eax, 0xfbe9f482
jae 0x140084b9b
mov eax, dword [0x1401d8d70]
mov ecx, dword [0x1401d8d74]
xor ecx, 0x6554ce92
add eax, ecx
mov ecx, 0xe5cda4dc
xor edx, edx
div ecx
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0xb6a126cf
xor edx, 0x2acbcd40
and edx, ecx
mov r8d, 0xffffffff
xor r8d, 0x9c6aeb8f
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x9c6aeb8f
or eax, 0x9c6aeb8f
imul eax, edx
add eax, ecx
add eax, 0xc7c85b0a
cmp eax, 0x792ad190
jb 0x140084b9b
add rsp, 0x38
ret
sub dword [rax], 0xf8e979a2
invalid
lodsb al, byte [rsi]
or dword [rcx + rbp*4 - 0x7c17], ebp
jmp qword [rsi + 0x2e]
Function at 0x14008fb00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14008d2e5
mov rdx, qword [rsp + 0x30]
xor eax, eax
test rdx, rdx
cmovg rax, rdx
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
cmp rax, rcx
je 0x14008fb61
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov byte [rcx + rax], 0
add rax, 1
mov qword [rsp + 0x40], rax
jmp 0x14008fb2d
mov eax, dword [0x1401d91a8]
mov r8d, dword [0x1401d91ac]
xor r8d, 0xbb520ef2
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x391fc37c
xor edx, edx
div ecx
mov r11d, eax
mov eax, 0xcea205f2
xor eax, 0x22f4a8ad
and r11d, eax
mov ecx, r11d
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x9ac3a5d9
mov r8d, 0x71cc25ce
xor r8d, 0x8d5752e9
mov eax, 0x312da514
xor eax, 0xced25aeb
xor r8d, eax
mov eax, ecx
and eax, 0xfc9b7727
and r11d, r8d
mov r9d, edx
and r9d, 0xfc9b7727
mov r10d, r8d
and r10d, 0x9ac3a5d9
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, edx
mov edx, 0x9338718
xor edx, 0xf6cc78e7
xor ecx, edx
mov edx, 0x2f3a6fb6
xor edx, 0xd3a11891
or edx, r8d
and ecx, edx
or eax, ecx
mov ecx, 0x405c2db3
xor ecx, 0xc4b5609f
cmp eax, ecx
jbe 0x14008fc7b
mov eax, dword [0x1401d91b0]
xor eax, 0xa455e281
mov ecx, dword [0x1401d91b4]
mov edx, 0xd88e155
xor edx, 0xcbefc006
xor ecx, edx
xor edx, edx
div ecx
imul eax, eax, 0x66afe9a6
and eax, 0xfeab51c7
imul eax, eax, 0x7e973ef7
cmp eax, 0xf1f0843
ja 0x14008fc38
add rsp, 0x48
ret
movabs byte [0x66ffffffb4e9ffa9], al
nop word cs:[rax + rax]
Function at 0x140098540
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rcx
call fcn.1400980b5
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
add rax, 0x60
mov qword [rsp + 0x58], rax
mov qword [rcx], 0
mov qword [rcx + 8], 0
cmp rdx, 0
je 0x14009870d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call fcn.140096f70
mov rax, qword [rsp + 0x58]
cmp byte [rax], 0
jne 0x14009870d
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax]
mov qword [rsp + 0x60], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x60]
call fcn.1400980c3
mov rcx, rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rcx
cmp byte [rax], 0
jne 0x14009870d
mov rcx, qword [rsp + 0x38]
mov edx, 2
lea r8, [rsp + 0x70]
call fcn.140097169
test al, 1
jne 0x1400985fd
jmp 0x140098607
call fcn.1400077a3
jmp 0x14009870d
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
cmp rax, 0
jge 0x140098658
mov rcx, qword [rsp + 0x28]
movabs rdx, 0xaeb7245cc45e874e
movabs rax, 0xaeb7245cc45e874e
xor rdx, rax
movabs r8, 0xce849b10255b3008
movabs rax, 0xb17b64efdaa4cff7
xor r8, rax
call fcn.14000d167
jmp 0x14009870d
mov ecx, dword [0x1401d93f8]
mov edx, dword [0x1401d93fc]
mov eax, ecx
xor eax, 0xffffffff
mov r8d, ecx
xor r8d, 0xffffffff
and eax, r8d
mov r8d, edx
xor r8d, 0xffffffff
mov r9d, edx
xor r9d, 0xffffffff
and r8d, r9d
or eax, r8d
xor eax, 0xffffffff
or ecx, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
and eax, 0x91886dae
or eax, 0xee948d72
mov ecx, 0xe60e0976
xor edx, edx
div ecx
cmp eax, 0x60d85af3
jae 0x140098717
mov r8, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401d9400]
add eax, dword [0x1401d9404]
mov r9d, 0xfe55e056
xor edx, edx
div r9d
mov rdx, qword [rsp + 0x50]
and eax, 0x351730bf
mov r9d, 0xa35ee556
xor r9d, 0x6dd46554
and eax, r9d
mov dword [rsp + 0x24], eax
call fcn.140098720
mov eax, dword [rsp + 0x24]
cmp eax, 0x5ece09af
jae 0x1400986b5
jmp 0x14009870d
mov rax, qword [rsp + 0x40]
add rsp, 0x78
ret
mov al, 0x5f
xchg ebx, eax
invalid
Function at 0x140098720
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
xor eax, eax
test r8, r8
cmovg rax, r8
mov qword [rsp + 0x20], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 8], rax
cmp rax, rcx
je 0x140098828
mov eax, dword [0x1401d9408]
imul eax, dword [0x1401d940c]
mov ecx, 0x6a45f70d
xor edx, edx
div ecx
mov ecx, 0xb6a6e996
xor ecx, 0xf45b92c3
or eax, ecx
mov ecx, 0xffffffff
xor ecx, 0xe700c169
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
cmp eax, 0x16265280
je 0x14009892e
mov rdx, qword [rsp + 8]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x10]
mov ecx, dword [0x1401d9410]
xor ecx, 0x769c023e
mov r10d, dword [0x1401d9414]
mov eax, ecx
and eax, r10d
or ecx, r10d
add eax, ecx
add eax, 0xdb0dd188
xor eax, 0x5c81d696
mov ecx, 0x29123cfe
xor ecx, 0xb9ebb16b
imul eax, ecx
mov ecx, 0x24240c7e
xor ecx, 0xb41d87cd
mov r9b, byte [r9 + rdx]
mov byte [r8 + rdx], r9b
movabs r8, 0x5c27c071f21ae4bc
movabs r9, 0x5c27c071f21ae4bd
xor r8, r9
add rdx, r8
mov qword [rsp], rdx
cmp eax, ecx
je 0x14009879d
mov rax, qword [rsp]
mov qword [rsp + 0x28], rax
jmp 0x140098743
mov eax, dword [0x1401d9418]
mov r8d, dword [0x1401d941c]
mov ecx, 0x679cac81
xor ecx, 0x9863537e
mov r9d, r8d
xor r9d, ecx
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
mov r9d, 0xcaf1348
xor r9d, 0xf350ecb7
xor ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
imul eax, eax, 0x51036c7e
xor ecx, ecx
sub ecx, eax
mov eax, 0x582a604f
xor eax, 0x582a604f
mov edx, 0xcd1e3ab8
xor edx, 0x8d24eefa
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
sub eax, 0x77b3fc8c
cmp eax, 0x735213f7
jb 0x140098937
mov edx, dword [0x1401d9420]
mov r8d, dword [0x1401d9424]
mov eax, edx
xor eax, 0xffffffff
mov ecx, r8d
and ecx, eax
mov r9d, r8d
xor r9d, 0xffffffff
mov eax, edx
and eax, r9d
imul eax, ecx
mov ecx, edx
and ecx, r8d
or edx, r8d
imul edx, ecx
add edx, eax
mov eax, 0x7c813c8f
xor eax, 0xdeabcb3f
xor edx, eax
mov ecx, edx
xor ecx, 0xf0118900
mov eax, 0x4a348dfd
xor eax, 0xba2504fd
mov r8d, 0x1549be73
xor r8d, 0xeab6418c
xor eax, r8d
and edx, eax
mov eax, 0xb2f24fec
xor eax, 0xb2f24fee
imul eax, edx
sub eax, ecx
add eax, 0x7ad915f9
cmp eax, 0x8710b26c
ja 0x1400988a7
fnstcw word [rdx + 0x3d]
insb byte [rdi], dx
mov dl, 0x10
xchg dword [rdi], ecx
xchg dword [rsi - 1], edi
invalid
add rsp, 0x30
ret
jle 0x14009891c
push 0xfffffffffffe66e9
call qword [rbx + 0x3f]
ret 0xe96a
push rbx
invalid
Function at 0x14009a9e0
Capabilities:
Encode data using add xor sub operations

Disassembly:
push rsi
push rdi
sub rsp, 0x98
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x60], r8
mov dword [rsp + 0x6c], edx
mov qword [rsp + 0x70], rcx
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x90], rax
mov r11d, dword [0x1401d94f8]
mov r10d, dword [0x1401d94fc]
mov eax, 0xa9f621d8
xor eax, 0x5609de27
mov ecx, r11d
xor ecx, eax
mov r8d, r10d
xor r8d, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x3c464490
mov eax, ecx
and eax, 0x3c464490
and r11d, edx
mov r9d, r8d
and r9d, 0x3c464490
and r10d, edx
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
mov r8d, 0xb28cc127
xor r8d, 0x4d733ed8
xor ecx, r8d
or edx, 0x3c464490
and ecx, edx
or eax, ecx
xor ecx, ecx
sub ecx, 0x1aa5a305
add eax, ecx
or eax, 0xdfbeca1e
add eax, 0xc8922726
cmp eax, 0xe04a810f
jae 0x14009aba5
mov rsi, qword [rsp + 0x90]
mov eax, dword [0x1401d9500]
mov ecx, 0x8668fa4
xor ecx, 0x64ae19dd
xor eax, ecx
mov edx, dword [0x1401d9504]
xor eax, 0xffffffff
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x381e726e
or eax, edx
or ecx, 0x381e726e
xor eax, 0xffffffff
and eax, ecx
mov ecx, eax
and ecx, 0x83a8fc7
shl ecx, 1
mov edx, 0xce44116c
xor edx, 0xc67e9eab
xor eax, edx
add eax, ecx
sub eax, 0x8328dd81
imul eax, eax, 0x2c220342
mov dword [rsp + 0x50], eax
mov eax, 0xb60d51a2
xor eax, 0x70a7bc8f
mov dword [rsp + 0x4c], eax
call fcn.14009a855
mov rcx, qword [rsp + 0x70]
mov edx, dword [rsp + 0x6c]
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x58]
mov r11, qword [rsp + 0x88]
mov r10, qword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x38], rax
call qword [0x1401fb058]
mov ecx, dword [rsp + 0x4c]
mov edx, eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x54], edx
cmp eax, ecx
ja 0x14009aac4
mov eax, dword [rsp + 0x54]
add rsp, 0x98
pop rdi
pop rsi
ret
invalid
Function at 0x14009baf0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], rcx
mov eax, dword [0x1401d95c0]
xor eax, 0x70245d21
imul eax, dword [0x1401d95c4]
sub eax, 0xaed2393a
add eax, 0xfdf2b4c7
add eax, 0xaed2393a
xor eax, 0xcebfaee2
or eax, 0x56a8c2a5
mov ecx, 0xc0d189e2
xor ecx, 0xf8cffb8c
cmp eax, ecx
jb 0x14009bd91
mov rcx, qword [rsp + 0x68]
mov eax, dword [0x1401d95c8]
xor eax, 0x49e4fbc6
xor edx, edx
div dword [0x1401d95cc]
xor eax, 0xfcd67633
sub eax, 0x145d4c7b
imul eax, eax, 0x78452638
mov rcx, qword [rcx]
mov qword [rsp + 0x58], rcx
cmp rcx, 0
setg cl
mov byte [rsp + 0x67], cl
cmp eax, 0x486b3870
jbe 0x14009bb3c
mov al, byte [rsp + 0x67]
test al, 1
jne 0x14009bb93
jmp 0x14009bd8c
mov rcx, qword [rsp + 0x58]
mov rax, rcx
add rax, 1
mov qword [rsp + 0x50], rax
xor rcx, 0xffffffffffffffff
and rax, rcx
cmp rax, 0
jge 0x14009bbbf
call fcn.1400077a3
jmp 0x14009bd8c
mov rax, qword [rsp + 0x50]
cmp rax, 0
jge 0x14009bbeb
mov rcx, qword [rsp + 0x50]
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
call fcn.14000d167
jmp 0x14009bd8c
mov rax, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rdx + 8]
add rcx, 8
add rcx, qword [rdx]
mov qword [rsp + 0x38], rcx
mov rax, qword [rax + 8]
add rax, 8
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
cmp rax, rcx
je 0x14009bc54
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov dl, byte [rdx + rax]
mov byte [rcx + rax], dl
add rax, 1
mov qword [rsp + 0x48], rax
jmp 0x14009bc19
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov r8, qword [rcx]
mov rdx, qword [rax]
xor eax, eax
sub rax, rdx
xor ecx, ecx
sub rcx, r8
add rax, rcx
xor ecx, ecx
sub rcx, rax
mov qword [rsp + 0x28], rcx
mov rax, rcx
xor rax, r8
xor rcx, rdx
and rax, rcx
cmp rax, 0
jge 0x14009bc9b
call fcn.1400077a3
jmp 0x14009bd8c
mov eax, dword [0x1401d95d0]
xor eax, 0xbd028d1f
mov r8d, dword [0x1401d95d4]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, eax
and ecx, 0x4adededb
xor ecx, 0xffffffff
add eax, 0x4adededb
mov edx, 0x154b8c94
xor edx, 0x154b8c95
add eax, edx
add eax, ecx
sub eax, 0xc9369081
mov ecx, 0xa4e59af7
xor edx, edx
div ecx
mov ecx, 0x8c5aa0e9
xor ecx, 0x64016a64
cmp eax, ecx
je 0x14009bd9a
mov rcx, qword [rsp + 0x70]
mov eax, dword [0x1401d95d8]
sub eax, dword [0x1401d95dc]
mov edx, 0x3c9a6ad2
xor edx, 0x59fa93b9
xor eax, edx
mov r8d, 0x35dc386c
mov eax, 0x35dc386c
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x28]
and eax, eax
xor eax, 0xffffffff
mov r8d, 0x997dbe6f
xor r8d, 0x548fc602
mov r9d, 0x6ea6ae68
xor r9d, 0x91595197
xor r8d, r9d
mov r9d, 0xffffffff
xor r9d, 0xcdf2786d
or r8d, r9d
and eax, r8d
xor eax, 0xffffffff
mov qword [rcx], rdx
cmp eax, 0xc7a9eec7
jb 0x14009bd13
jmp 0x14009bd8c
add rsp, 0x78
ret
xor al, 0xe6
mov al, 0x74
jmp 0x14009bb3c
jge 0x14009bd32
out dx, al
imul ecx
jo 0x14009bda0
invalid
invalid
Function at 0x1400a9c20
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x38
mov eax, dword [0x1401d9a08]
mov ecx, 0xec18a02f
xor ecx, 0x139bd0c8
xor eax, ecx
sub eax, dword [0x1401d9a0c]
mov ecx, 0x8466f1ed
xor edx, edx
div ecx
sub eax, 0x1548e377
xor ecx, ecx
sub ecx, 0xd369acdd
sub eax, ecx
cmp eax, 0xf4aa1b23
je 0x1400a9ce1
mov eax, dword [0x1401d9a10]
mov edx, dword [0x1401d9a14]
mov ecx, 0x14e121a6
xor ecx, 0x5395e125
xor edx, ecx
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
or eax, edx
and eax, ecx
mov ecx, 0x391bd404
xor ecx, 0xa647ed17
or eax, ecx
and eax, 0xb9297f1b
sub eax, 0xff62655d
mov dword [rsp + 0x2c], eax
mov eax, 0x4fc8ce50
xor eax, 0x1fa33896
mov dword [rsp + 0x28], eax
mov rax, qword [0x1401eb950]
mov ecx, dword [rax]
call fcn.140007543
mov ecx, dword [rsp + 0x28]
mov rdx, rax
mov eax, dword [rsp + 0x2c]
add rdx, 0x60
mov qword [rsp + 0x30], rdx
cmp eax, ecx
jbe 0x1400a9c60
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
cmp dword [rax + 0x15], ebx
mov eax, 0xffff76e9
jmp qword [rsi + 0xf]