joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140069f00
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401db108]
xor eax, 0x5b3367ed
mov ecx, dword [0x1401db10c]
xor ecx, 0x37046f19
xor eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0x20d3348c
xor edx, 0x382f9ede
and ecx, edx
mov edx, 0x56fce606
xor edx, 0x4e004c54
mov r8d, 0xa6e2382
xor r8d, 0xf591dc7d
xor edx, r8d
and eax, edx
sub eax, ecx
and eax, 0xc0ac5339
mov ecx, eax
xor ecx, 0x529126de
xor ecx, 0xffffffff
and ecx, 0x529126de
shl ecx, 1
sub ecx, 0x529126de
sub eax, ecx
cmp eax, 0xc345ad5c
jae 0x14006a0f2
mov eax, dword [0x1401db110]
mov ecx, dword [0x1401db114]
xor edx, edx
div ecx
mov ecx, 0x81f8ae05
imul rax, rcx
shr rax, 0x3b
or eax, 0x15a7fa12
imul eax, eax, 0x87beb5b6
mov dword [rbp - 0x2c], eax
mov eax, 0x5ddbb142
mov dword [rbp - 0x30], eax
mov eax, 0x10
call fcn.1401d7280
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
sub rsp, 0x20
call fcn.140068a70
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x38], rcx
movabs rcx, 0x28606820a0d0439d
movabs rdx, 0x28606820a0d0439d
xor rcx, rdx
mov qword [rax], rcx
mov qword [rax + 8], 0
mov ecx, 8
sub rsp, 0x20
call fcn.140068c70
mov rdx, qword [rbp - 0x38]
mov ecx, dword [rbp - 0x30]
add rsp, 0x20
mov r8, rax
mov eax, dword [rbp - 0x2c]
mov qword [rbp - 0x28], r8
cmp byte [rdx], 0
sete dl
mov byte [rbp - 0x19], dl
cmp eax, ecx
jae 0x140069f8c
mov cl, byte [rbp - 0x19]
mov al, 1
test cl, 1
mov byte [rbp - 0x41], al
jne 0x14006a057
jmp 0x14006a0b5
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x28]
sub rsp, 0x20
call fcn.140069d40
mov rax, qword [rbp - 0x38]
add rsp, 0x20
mov cl, byte [rax]
mov dl, 0x88
xor dl, 0x88
mov al, 1
cmp cl, dl
mov byte [rbp - 0x41], al
jne 0x14006a0b5
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x28]
mov r8, qword [rax + 0x58]
mov qword [rdx], r8
mov rax, qword [rax + 0x60]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14001850a
mov rax, qword [rbp - 0x38]
add rsp, 0x20
mov al, byte [rax]
mov byte [rbp - 0x41], al
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x28]
mov dl, byte [rbp - 0x41]
mov byte [rbp - 0x42], dl
mov byte [rax], 0
sub rsp, 0x20
call fcn.14006891c
mov rax, qword [rbp - 0x38]
add rsp, 0x20
cmp byte [rax], 0
jne 0x14006a0e9
mov rax, qword [rbp - 0x38]
mov cl, byte [rbp - 0x42]
mov byte [rax], cl
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
push rbp
cmpsb byte [rsi], byte [rdi]
bts ecx, 0x91
invalid
Function at 0x14006a100
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rcx
call fcn.140068a70
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
cmp rdx, 0x20
jge 0x14006a16c
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x14006a34a
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov r8b, 0x6a
xor r8b, 0x95
mov dl, al
xor dl, r8b
xor al, 0xff
or dl, al
mov al, 0xff
xor al, 0xa0
mov r8b, 0xff
xor r8b, 0xa0
or al, r8b
and dl, al
xor dl, 0xff
call fcn.140030915
jmp 0x14006a34a
mov rax, qword [rsp + 0x38]
cmp rax, 0x100
jae 0x14006a1b0
mov rcx, qword [rsp + 0x30]
mov dl, 0xb4
xor dl, 0x6d
call fcn.14003077f
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x14006a34a
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov dl, al
call fcn.140030915
jmp 0x14006a34a
mov rax, qword [rsp + 0x38]
cmp rax, 0x10000
jae 0x14006a31c
mov eax, dword [0x1401db118]
xor eax, 0xbb1e9717
xor edx, edx
div dword [0x1401db11c]
mov r8d, 0xffffffff
xor r8d, 0x20cf1a4f
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0xfbc093b6
xor r8d, 0x43f6c49
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x20cf1a4f
or eax, 0x20cf1a4f
imul eax, edx
add eax, ecx
mov edx, 0xcea51218
xor edx, 0x315aede7
mov ecx, eax
xor ecx, edx
xor eax, 0xffffffff
or ecx, eax
mov eax, 0xe89d722c
xor eax, 0x1bda0ceb
mov edx, 0xe07c7c37
xor edx, 0x1f8383c8
xor eax, edx
mov edx, 0xffffffff
xor edx, 0xf3477ec7
or eax, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
or ecx, eax
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0xeced2d11
or ecx, 0xeced2d11
xor ecx, 0xffffffff
mov edx, 0x108fa73e
xor edx, 0xef7058c1
xor eax, edx
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x7f291b72
xor ecx, 0x20d06622
cmp eax, ecx
jbe 0x14006a350
mov rcx, qword [rsp + 0x30]
mov edx, dword [0x1401db120]
xor edx, dword [0x1401db124]
mov eax, edx
and eax, 0x1dcfe8a5
mov r8d, 0x9fcadcc3
xor r8d, 0x82053466
xor edx, r8d
or eax, edx
imul eax, eax, 0x46ab8453
and eax, 0x2bf6c980
mov dword [rsp + 0x28], eax
mov dl, 0x38
xor dl, 0xe2
call fcn.14003077f
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x28]
mov cl, byte [rcx]
mov dl, 0x8c
xor dl, 0x8c
cmp cl, dl
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x77cd0171
ja 0x14006a28d
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x14006a305
jmp 0x14006a34a
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov dx, ax
call fcn.140068e30
jmp 0x14006a34a
mov rcx, qword [rsp + 0x30]
mov edx, 0xdb
call fcn.14003077f
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x14006a34a
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov edx, eax
call fcn.140069050
nop
add rsp, 0x48
ret
push rbx
outsd dx, dword [rsi]
pop rsp
jmp 0x14006a28d

Function at 0x14006a560
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov qword [rsp + 0x48], rdx
Function at 0x140072e80
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov r8d, dword [0x1401db578]
and r8d, dword [0x1401db57c]
mov ecx, 0xdf518e50
xor ecx, 0x20ae71af
mov eax, r8d
xor eax, ecx
and eax, 0x11a814d7
mov edx, 0xffffffff
xor edx, 0x11a814d7
and r8d, edx
mov ecx, 0x29159185
xor ecx, 0xe24740e4
mov r9d, 0x384c319b
xor r9d, 0xc7b3ce64
xor ecx, r9d
and ecx, 0x11a814d7
and edx, 0xcb52d161
or eax, r8d
or ecx, edx
xor eax, ecx
mov ecx, 0x60d1f8fb
xor edx, edx
div ecx
xor ecx, ecx
sub ecx, 0x12ef3aa8
add eax, ecx
cmp eax, 0x8419e2bf
jb 0x140072f7e
mov eax, dword [0x1401db580]
mov ecx, 0x8e7c2511
xor ecx, 0xc9b76b9d
xor eax, ecx
xor edx, edx
div dword [0x1401db584]
add eax, 0x76bb9628
add eax, 0x42433e88
sub eax, 0x76bb9628
mov ecx, 0x5d77d556
xor ecx, 0x72c34aec
xor edx, edx
div ecx
mov ecx, 0x2e6cb08c
xor ecx, 0xaef4c2e2
imul eax, ecx
mov dword [rsp + 0x24], eax
call fcn.140068a70
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
call fcn.140072b70
mov eax, dword [rsp + 0x24]
cmp eax, 0xf5647799
jae 0x140072f0b
add rsp, 0x38
ret
cmp dword [rax + rcx*2 - 0x7b16f8], 0xf66ffff
invalid
Function at 0x1400733c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov eax, dword [0x1401db5b8]
imul eax, dword [0x1401db5bc]
xor eax, 0xf9e145f5
mov ecx, 0xcc221aee
xor ecx, 0x1bd51e64
xor eax, ecx
mov ecx, 0x7e78eefb
xor edx, edx
div ecx
cmp eax, 0x91069f5c
jae 0x14007360a
mov eax, dword [0x1401db5c0]
imul eax, dword [0x1401db5c4]
mov ecx, 0x536a3349
xor ecx, 0xf13d051c
or eax, ecx
xor eax, 0x88405f7b
mov ecx, 0xdeeb7b3d
xor edx, edx
div ecx
mov dword [rsp + 0x40], eax
call fcn.140068a70
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
call fcn.140030d50
mov rcx, qword [rsp + 0x38]
mov dl, al
mov eax, dword [rsp + 0x40]
mov byte [rsp + 0x46], dl
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x47], cl
cmp eax, 0x8d02c70f
jae 0x140073401
mov al, byte [rsp + 0x47]
test al, 1
jne 0x140073476
jmp 0x140073604
mov al, byte [rsp + 0x46]
cmp al, 0xc0
jne 0x140073491
mov rcx, qword [rsp + 0x50]
call fcn.14006d4a0
jmp 0x140073604
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
cmp rax, 0
mov qword [rsp + 0x30], rax
jne 0x1400735f5
mov eax, dword [str._b__fjF]
mov edx, dword [0x1401db5cc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov r11d, eax
xor r11d, 0xffffffff
mov ecx, 0xb5b90e39
xor ecx, 0x86801258
mov edx, 0xd33abda
xor edx, 0xf2cc5425
xor ecx, edx
and r11d, ecx
or eax, 0x33391c61
mov ecx, 0x23ae2084
xor ecx, 0xdc51df7b
xor eax, ecx
or r11d, eax
xor r11d, 0xffffffff
mov ecx, r11d
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xc2dd4a72
mov r8d, 0xffffffff
xor r8d, 0x37a22ad1
mov eax, ecx
and eax, 0x37a22ad1
and r11d, r8d
mov r10d, 0x52422842
xor r10d, 0x65e00293
mov r9d, edx
and r9d, r10d
mov r10d, r8d
and r10d, 0xc2dd4a72
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, edx
xor ecx, 0xffffffff
mov edx, 0x4d9ed993
xor edx, 0x7a3cf342
or edx, r8d
and ecx, edx
or eax, ecx
mov ecx, 0xf89d08f2
xor ecx, 0x9d856134
and eax, ecx
cmp eax, 0x35db05b4
jb 0x140073613
mov eax, dword [0x1401db5d0]
xor edx, edx
div dword [0x1401db5d4]
add eax, 0xd2587704
sub eax, 0x1202a17c
mov ecx, 0x591c226e
xor ecx, 0x1317b5f8
sub eax, ecx
mov dword [rsp + 0x28], eax
xor eax, eax
mov ecx, eax
call fcn.1400d5670
mov rcx, qword [rsp + 0x38]
mov eax, dword [rsp + 0x28]
mov cl, byte [rcx]
mov dl, 0x45
xor dl, 0x45
cmp cl, dl
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x2baa69e5
je 0x140073572
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1400735d9
jmp 0x140073604
mov ecx, 0x30
mov edx, 8
call fcn.140012010
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x30]
call fcn.14007338e
nop
add rsp, 0x58
ret
mov ebp, 0xe9b36fc7
out dx, al
std
invalid
sbb dword [rdi + 0x56e90caf], 0xffffffff
invalid
Function at 0x140073620
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401db5d8]
xor edx, edx
div dword [0x1401db5dc]
and eax, 0x14667a9d
mov ecx, 0x94ec0041
xor ecx, 0x6f258abe
xor edx, edx
div ecx
imul eax, eax, 0x1f1b49ee
cmp eax, 0x54dee726
ja 0x1400736ce
mov eax, dword [0x1401db5e0]
mov ecx, dword [0x1401db5e4]
mov edx, 0x763e7454
xor edx, 0x461f7b20
xor ecx, edx
add eax, ecx
xor eax, 0xd58ffeab
mov ecx, 0xe3709b7c
xor ecx, 0x936eb3e9
and eax, ecx
or eax, 0x15b8be7e
mov dword [rsp + 0x24], eax
mov eax, 0xda76e91f
xor eax, 0xd929768b
mov dword [rsp + 0x20], eax
call fcn.140068a70
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
call fcn.1400733c0
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
jb 0x140073661
add rsp, 0x38
ret
xlatb
sbb dl, ah
int3

Function at 0x140074b80
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401db688]
mov ecx, dword [0x1401db68c]
sub eax, 0x5cbcdf44
add eax, ecx
add eax, 0x5cbcdf44
xor ecx, ecx
sub ecx, 0xe082654e
sub eax, ecx
and eax, 0x1e68e84a
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xb95cd911
mov ecx, 0xffffffff
xor ecx, 0x9f81f5e2
or eax, edx
or ecx, 0x9f81f5e2
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0x7b65f667
jae 0x140074cdd
mov eax, dword [0x1401db690]
mov ecx, dword [0x1401db694]
xor ecx, 0xdf5752f9
or eax, ecx
mov ecx, 0xb8b91fff
imul rax, rcx
shr rax, 0x3f
or eax, 0xfdf6fffa
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.1401d7280
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.140068a70
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov qword [rbp - 0x20], rax
movabs rdx, 0x3161f418a627711e
movabs rax, 0x3161f418a627711c
xor rdx, rax
sub rsp, 0x20
call fcn.140069200
mov rcx, qword [rbp - 0x20]
mov eax, dword [rbp - 0x18]
add rsp, 0x20
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0x94d84547
je 0x140074bea
mov al, byte [rbp - 0x11]
test al, 1
jne 0x140074c8b
jmp 0x140074cd8
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax]
sub rsp, 0x20
call fcn.140073f88
mov rax, qword [rbp - 0x20]
add rsp, 0x20
cmp byte [rax], 0
jne 0x140074cd8
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax + 8]
mov qword [rdx], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140074700
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
cld
sub edi, ebp
or eax, 0xffff04e9
jmp qword [rsi + 0x2e]
Function at 0x140074e00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
call fcn.140068a70
mov rdx, qword [rsp + 0x28]
cmp rdx, 0
jne 0x140074d21
mov rcx, qword [rsp + 0x20]
call fcn.140068e0f
jmp 0x140074d4f
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax]
mov qword [rsp + 0x30], rdx
mov rdx, qword [rax + 8]
mov qword [rsp + 0x38], rdx
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x30]
call fcn.140074b80
mov eax, dword [0x1401db698]
mov r8d, dword [0x1401db69c]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
mov r9d, 0x5365dce2
xor r9d, 0xac9a231d
xor ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
add eax, 0xdd9b23a1
mov ecx, 0x13c027b9
xor edx, edx
div ecx
mov ecx, 0x5a13bee9
xor ecx, 0x25e1a67f
xor eax, ecx
cmp eax, 0xe9e1ed98
je 0x140074df7
mov ecx, dword [0x1401db6a0]
mov edx, dword [0x1401db6a4]
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
or eax, 0x98e9b781
mov ecx, 0x23bcf731
xor ecx, 0xd511c05e
sub eax, ecx
imul eax, eax, 0xa5aa6e85
mov ecx, 0xb587b7b5
xor ecx, 0xb01a8a4a
cmp eax, ecx
je 0x140074db3
add rsp, 0x48
ret
stc
invalid
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.140068a70
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x140074cf0
Function at 0x140077a30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x50], rdx

Function at 0x140078a1f
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401db868]
xor edx, edx
div dword [0x1401db86c]
mov ecx, eax
mov edx, ecx
xor edx, 0xd98b8bf6
xor edx, 0xffffffff
and edx, 0xd98b8bf6
mov eax, 0xceed34f3
xor eax, 0xceed34f1
imul eax, edx
sub eax, 0xd98b8bf6
sub ecx, eax
mov eax, ecx
or eax, 0xda833c06
xor eax, 0xffffffff
or ecx, 0xda833c06
mov edx, 0x1531398b
xor edx, 0xeacec674
xor ecx, edx
or eax, ecx
mov ecx, 0x448ff950
xor ecx, 0xbb7006af
xor eax, ecx
mov ecx, 0xc18dd47c
xor ecx, 0xa2a1a99e
imul eax, ecx
cmp eax, 0x76cb518a
ja 0x140078a16
mov ecx, dword [str.Q_vEk]
xor ecx, 0xbbdc3cf
mov r8d, dword [0x1401db874]
mov r9d, r8d
not r9d
mov eax, ecx
and eax, r9d
mov edx, ecx
or edx, r9d
not edx
imul edx, eax
mov eax, ecx
and eax, r8d
or ecx, r8d
imul ecx, eax
mov eax, ecx
mov ecx, edx
lea eax, [rax + rcx + 0x29579631]
or eax, 0xa177a225
mov ecx, 0xc5763943
imul rax, rcx
shr rax, 0x3f
mov dword [rbp - 0x18], eax
mov eax, 0x20
call fcn.1401d7280
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
sub rsp, 0x20
call fcn.140068a70
mov rcx, qword [rbp - 0x10]
add rsp, 0x20
mov eax, dword [rbp - 0x18]
cmp rcx, 0
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0x35046484
ja 0x14007892c
mov al, byte [rbp - 0x11]
test al, 1
jne 0x1400789cc
jmp 0x1400789e2
mov rcx, qword [rbp - 8]
sub rsp, 0x20
call fcn.140068e0f
add rsp, 0x20
jmp 0x140078a11
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax]
mov qword [rdx], r8
mov r8, qword [rax + 8]
mov qword [rdx + 8], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 0x10], rax
sub rsp, 0x20
call fcn.140078812
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
scasd eax, dword [rdi]
mov eax, 0xde93018
invalid
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.140068a70
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x1400788a0
Function at 0x1400791dd
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401db898]
mov edx, dword [0x1401db89c]
mov ecx, eax
and ecx, edx
shl ecx, 1
xor eax, edx
add eax, ecx
and eax, 0xee254db
mov ecx, 0x80b3451e
xor edx, edx
div ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xcc6bd70d
mov ecx, 0xffffffff
xor ecx, 0xa386a161
or eax, edx
or ecx, 0xa386a161
mov edx, 0x3d97c3db
xor edx, 0xc2683c24
xor eax, edx
and eax, ecx
mov ecx, 0xced5bc28
xor ecx, 0x48a16395
cmp eax, ecx
ja 0x1400791cb
mov ecx, dword [0x1401db8a0]
mov edx, dword [0x1401db8a4]
not ecx
not edx
mov eax, ecx
or eax, edx
not eax
and ecx, edx
or eax, ecx
xor eax, 0x801900a1
or eax, 0x6ae27e56
add eax, 0xf88b78e1
mov dword [rbp - 0x18], eax
mov eax, 0xc98412b9
mov dword [rbp - 0x1c], eax
mov eax, 0x10
call fcn.1401d7280
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.140068a70
mov rdx, qword [rbp - 0x10]
mov ecx, dword [rbp - 0x1c]
add rsp, 0x20
mov eax, dword [rbp - 0x18]
cmp rdx, 0
sete dl
mov byte [rbp - 0x11], dl
cmp eax, ecx
je 0x14007907a
mov al, byte [rbp - 0x11]
test al, 1
jne 0x1400790fb
jmp 0x140079111
mov rcx, qword [rbp - 8]
sub rsp, 0x20
call fcn.140068e0f
add rsp, 0x20
jmp 0x140079138
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140078f78
add rsp, 0x20
mov eax, dword [0x1401db8a8]
mov ecx, dword [0x1401db8ac]
xor ecx, 0x990de485
xor edx, edx
div ecx
sub eax, 0xd665c756
mov ecx, 0x4180c516
xor edx, edx
div ecx
mov ecx, 0x8a2e874b
xor ecx, 0x376d6eb4
xor edx, edx
div ecx
mov ecx, 0xad9ec67c
xor ecx, 0x4b38f2a3
cmp eax, ecx
ja 0x1400791d4
mov eax, dword [0x1401db8b0]
xor eax, 0x6676c1c0
and eax, dword [0x1401db8b4]
or eax, 0x6162777
mov ecx, 0x70bc42c2
xor ecx, 0x5e39e3d4
add eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x59532c2
mov edx, 0xffffffff
xor edx, 0x59532c2
and eax, edx
sub eax, ecx
cmp eax, 0x85d914b0
je 0x14007917e
mov rsp, rbp
pop rbp
ret
in al, 0xc7
pop rsi
mov edi, 0xfffea6e9
invalid
mov esp, 0xe90cc48a
movabs eax, dword [0x4838ec8348ffffff]
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.140068a70
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x140079000
Function at 0x14007ab50
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401db998]
imul eax, dword [0x1401db99c]
sub eax, 0xade2f267
mov ecx, 0x6456e043
xor ecx, 0xbef4328b
and eax, ecx
xor eax, 0x22a19aa9
cmp eax, 0x39074311
jbe 0x14007acdb
mov eax, dword [0x1401db9a0]
mov ecx, dword [0x1401db9a4]
xor edx, edx
div ecx
xor eax, 0x8ff31405
imul rax, rax, 0x4bb4e073
shr rax, 0x3d
add eax, 0x6a49a7fa
mov dword [rbp - 0x2c], eax
mov eax, 0x10
call fcn.1401d7280
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
sub rsp, 0x20
call fcn.140068a70
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x38], rcx
mov qword [rax], 0
mov qword [rax + 8], 0
mov ecx, 8
sub rsp, 0x20
call fcn.140068c70
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov rdx, rax
mov eax, dword [rbp - 0x2c]
mov qword [rbp - 0x28], rdx
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0x19], cl
cmp eax, 0x8489f92f
je 0x14007ab95
mov cl, byte [rbp - 0x19]
mov al, 1
test cl, 1
mov byte [rbp - 0x41], al
jne 0x14007ac42
jmp 0x14007ac9a
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x28]
sub rsp, 0x20
call fcn.14007ab24
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov al, 1
cmp byte [rcx], 0
mov byte [rbp - 0x41], al
jne 0x14007ac9a
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x28]
mov r8, qword [rax + 0x58]
mov qword [rdx], r8
mov rax, qword [rax + 0x60]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14001850a
mov rax, qword [rbp - 0x38]
add rsp, 0x20
mov al, byte [rax]
mov byte [rbp - 0x41], al
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x28]
mov dl, byte [rbp - 0x41]
mov byte [rbp - 0x42], dl
mov dl, 0xc2
xor dl, 0xc2
mov byte [rax], dl
sub rsp, 0x20
call fcn.14006891c
mov rax, qword [rbp - 0x38]
add rsp, 0x20
cmp byte [rax], 0
jne 0x14007acd2
mov rax, qword [rbp - 0x38]
mov cl, byte [rbp - 0x42]
mov byte [rax], cl
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
mov edi, edx
pop r10
jmp 0x14007ab95
Function at 0x14007b940
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401db9d8]
mov r8d, dword [0x1401db9dc]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, eax
and ecx, 0xc03c6eb3
shl ecx, 1
add eax, 0xc03c6eb3
sub eax, ecx
mov ecx, 0xaaad9a49
xor edx, edx
div ecx
mov ecx, 0x6351de68
xor edx, edx
div ecx
cmp eax, 0x90310f39
ja 0x14007ba4b
mov ecx, dword [0x1401db9e0]
or ecx, dword [0x1401db9e4]
mov edx, 0x171a6c27
xor edx, 0xac6fc931
mov eax, 0xb11b73b2
xor eax, 0x4ee48c4d
xor edx, eax
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0x4a29c94
xor ecx, 0xdf96b003
imul eax, ecx
and eax, 0x4a84f6de
mov dword [rsp + 0x20], eax
call fcn.140068a70
mov rcx, qword [rsp + 0x28]
mov eax, dword [rsp + 0x20]
cmp rcx, 0
sete cl
mov byte [rsp + 0x27], cl
cmp eax, 0xd68616cc
ja 0x14007b9b0
mov al, byte [rsp + 0x27]
test al, 1
jne 0x14007ba25
jmp 0x14007ba34
mov rcx, qword [rsp + 0x30]
call fcn.140068e0f
jmp 0x14007ba45
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov edx, dword [rax]
call fcn.14007b8f4
nop
add rsp, 0x38
ret
in eax, dx
invalid

Function at 0x14007bdd0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401dba08]
or eax, dword [0x1401dba0c]
mov ecx, 0x74229b4d
xor ecx, 0x3a613504
xor edx, edx
div ecx
add eax, 0xf1ea6f7d
and eax, 0x3fa41173
cmp eax, 0xc9f9f139
jae 0x14007becb
mov eax, dword [0x1401dba10]
mov ecx, dword [0x1401dba14]
xor ecx, 0x23d67e61
sub eax, ecx
imul eax, eax, 0x18182801
add eax, 0xb5ec281c
mov dword [rbp - 0x18], eax
mov eax, 0x20
call fcn.1401d7280
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
sub rsp, 0x20
call fcn.140068a70
mov rcx, qword [rbp - 0x10]
add rsp, 0x20
mov eax, dword [rbp - 0x18]
cmp rcx, 0
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0xa184c3f5
jae 0x14007be12
mov al, byte [rbp - 0x11]
test al, 1
jne 0x14007be81
jmp 0x14007be97
mov rcx, qword [rbp - 8]
sub rsp, 0x20
call fcn.140068e0f
add rsp, 0x20
jmp 0x14007bec6
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax]
mov qword [rdx], r8
mov r8, qword [rax + 8]
mov qword [rdx + 8], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 0x10], rax
sub rsp, 0x20
call fcn.14007bc10
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
xchg byte [rbx + rdi*4 - 0x15], dh
jmp 0x14007be12
Function at 0x14007c500
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
call fcn.140068a70
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov edx, 2
call fcn.140069200
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
jne 0x14007c580
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x20]
mov edx, dword [rax]
call fcn.140069a0b
mov rax, qword [rsp + 0x30]
mov al, byte [rax]
mov cl, 0xb9
xor cl, 0xb9
cmp al, cl
jne 0x14007c580
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x20]
mov rdx, qword [rax + 8]
mov qword [rsp + 0x38], rdx
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x38]
call fcn.14007c130
mov eax, dword [0x1401dba48]
xor edx, edx
div dword [0x1401dba4c]
mov ecx, 0x2c101bb6
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
and eax, 0x97682d7
xor ecx, 0x97682d7
or eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0xb26158c0
mov edx, 0xffffffff
xor edx, 0xb26158c0
and eax, edx
sub eax, ecx
cmp eax, 0x2f3fc28a
jb 0x14007c61a
mov ecx, dword [0x1401dba50]
xor ecx, 0x774d8c1
mov edx, dword [0x1401dba54]
xor eax, eax
sub eax, edx
add ecx, eax
xor ecx, 0x6999a570
mov eax, ecx
and eax, 0x102943a7
mov edx, 0xfa167bb4
xor edx, 0xea3f3813
or ecx, edx
add eax, ecx
mov ecx, 0x79fb5a15
xor edx, edx
div ecx
cmp eax, 0x4185a879
jae 0x14007c5cd
invalid
add rsp, 0x48
ret
jb 0x14007c613
add rcx, r13
stosb byte [rdi], al
invalid