joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140039390
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], rcx
mov eax, dword [0x1401dcd30]
mov edx, dword [0x1401dcd34]
xor edx, 0x211b6708
mov ecx, edx
and ecx, eax
mov r8d, 0x187b6804
xor r8d, 0xe78497fb
xor ecx, r8d
add eax, edx
add eax, 1
add eax, ecx
xor eax, 0x4f98047
sub eax, 0x100f4ff0
sub eax, 0x8bff63ee
mov ecx, 0x268d90b5
xor ecx, 0x3c940454
sub eax, ecx
add eax, 0x8bff63ee
cmp eax, 0x93ce8b0b
ja 0x140039560
mov ecx, dword [0x1401dcd38]
xor ecx, 0x1b3abe0a
mov eax, dword [0x1401dcd3c]
and ecx, eax
mov edx, ecx
and edx, 0x135f13c6
add edx, edx
mov eax, ecx
neg edx
mov ecx, edx
lea eax, [rax + rcx + 0x135f13c6]
or eax, 0x4b4aab9f
xor eax, 0x7088d1fb
mov dword [rbp - 0x10], eax
mov eax, 0x10
call fcn.1401da3e0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
sub rsp, 0x20
call fcn.1400379be
add rsp, 0x20
mov qword [rbp - 0x18], rax
sub rsp, 0x20
call fcn.1400379be
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov eax, dword [rbp - 0x10]
cmp byte [rcx], 0
sete cl
mov byte [rbp - 9], cl
cmp eax, 0x3e62b545
je 0x1400393f7
mov cl, byte [rbp - 9]
xor eax, eax
test cl, 1
mov qword [rbp - 0x28], rax
jne 0x140039493
jmp 0x140039557
mov ecx, 0x70
mov edx, 8
sub rsp, 0x20
call fcn.140013610
mov rdx, qword [rbp - 0x20]
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x30], rcx
lea r8, [0x1401dcc28]
mov qword [rcx], r8
add rcx, 0x58
mov qword [rbp - 0x38], rcx
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140014e50
mov rcx, qword [rbp - 0x38]
call fcn.1400384e0
mov rax, qword [rbp - 0x30]
add rsp, 0x20
mov qword [rax + 0x68], 0
lea rcx, [0x140037ab0]
mov qword [rax + 8], rcx
lea rcx, [0x140037bf9]
mov qword [rax + 0x10], rcx
lea rcx, [0x140037c0a]
mov qword [rax + 0x18], rcx
lea rcx, [0x140037c5a]
mov qword [rax + 0x20], rcx
lea rcx, [0x140037c60]
mov qword [rax + 0x28], rcx
lea rcx, [0x140038890]
mov qword [rax + 0x38], rcx
lea rcx, [0x140038d9a]
mov qword [rax + 0x40], rcx
lea rcx, [0x140038f20]
mov qword [rax + 0x48], rcx
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rsp, rbp
pop rbp
ret
mov r15b, dl
pop rcx
jmp 0x1400393f7
Function at 0x140039b60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rcx
call fcn.1400379be
mov r8, qword [rsp + 0x40]
cmp r8, 0
jge 0x140039ba9
mov rcx, qword [rsp + 0x40]
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
call fcn.14000c499
jmp 0x140039c9c
mov eax, dword [0x1401dcd70]
mov edx, dword [0x1401dcd74]
xor edx, 0xede83d4e
mov ecx, eax
xor ecx, 0xffffffff
mov r8d, edx
xor r8d, 0xffffffff
and ecx, r8d
or eax, edx
xor eax, 0xffffffff
or ecx, eax
xor ecx, 0xffffffff
mov eax, ecx
and eax, eax
xor eax, 0xffffffff
and eax, 0x8bace623
xor eax, 0xffffffff
mov edx, 0x8bace623
and edx, 0x8bace623
xor edx, 0xffffffff
and ecx, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0xf5b35290
xor edx, edx
div ecx
add eax, 0xbf0a2f19
sub eax, 0x1894faf2
mov ecx, 0x36ea1371
xor ecx, 0x89e03c68
sub eax, ecx
cmp eax, 0x10541c31
je 0x140039ca6
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401dcd78]
mov edx, dword [0x1401dcd7c]
xor edx, 0xdb66d84e
add eax, edx
or eax, 0xf5428276
sub eax, 0x58741e05
mov r8d, 0x3a1a0196
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x40]
mov dword [rsp + 0x24], eax
mov eax, 0xb6e2b46f
xor eax, 0x1aa633f8
mov dword [rsp + 0x20], eax
call fcn.14001a310
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x30]
call fcn.1400399f7
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
jae 0x140039c29
jmp 0x140039c9c
mov rax, qword [rsp + 0x38]
add rsp, 0x48
ret
lodsb al, byte [rsi]
jnp 0x140039ced
jmp 0x140039c29
xor bh, bh
rcl byte [rax + 0x38c48348]
ret

Function at 0x140039e10
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov dword [rbp - 0xc], edx
mov qword [rbp - 8], rcx
mov ecx, dword [0x1401dcd80]
or ecx, dword [0x1401dcd84]
mov eax, 0x389bef14
xor eax, 0xc74c3386
or ecx, eax
mov eax, ecx
and eax, 0x827fff97
xor eax, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x827fff97
or ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
sub eax, 0xc041dd60
cmp eax, 0x7e130e76
jbe 0x140039f19
mov ecx, dword [rbp - 0xc]
mov eax, dword [0x1401dcd88]
mov r8d, dword [0x1401dcd8c]
mov edx, eax
not edx
mov r9d, r8d
not r9d
or eax, r9d
or edx, r8d
not eax
not edx
or eax, edx
mov edx, eax
imul rdx, rdx, 0x1bd83cb9
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1e
xor eax, 0x1ac6c9d1
mov dword [rbp - 0x10], eax
mov eax, 0xb6a219f9
mov dword [rbp - 0x14], eax
mov eax, 0x10
call fcn.1401da3e0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
mov dword [rax], ecx
sub rsp, 0x20
call fcn.1400379be
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x20]
add rsp, 0x20
movabs r8, 0xe50f6075e032a28d
movabs rax, 0xe50f6075e032a289
xor r8, rax
sub rsp, 0x20
call fcn.140039cf6
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x10]
add rsp, 0x20
cmp eax, ecx
je 0x140039e6b
mov rsp, rbp
pop rbp
ret
pop rsp
test eax, 0x49e98b0a
invalid
Function at 0x140042c30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x68], r8
mov byte [rsp + 0x77], dl
mov qword [rsp + 0x78], rcx
cmp r9, 0
mov qword [rsp + 0x80], r9
jge 0x140042c6b
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
add rax, 0xffffffffffffffff
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x48], rdx
add rcx, 8
mov qword [rsp + 0x50], rcx
cmp rax, 0xffffffffffffffff
setg cl
mov byte [rsp + 0x5f], cl
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rcx
mov rax, 0xffffffffffffffff
cmp rcx, rdx
mov qword [rsp + 0x40], rax
jg 0x140042e78
mov eax, dword [0x1401dd060]
xor eax, 0xfe01dd33
mov r8d, dword [0x1401dd064]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x876f7d4b
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0xfe349bad
xor r8d, 0x795be6e6
mov edx, eax
and edx, r8d
or eax, 0x876f7d4b
imul eax, edx
add eax, ecx
add eax, 0xc4bbca04
sub eax, 0xaae2a5b1
mov ecx, 0x8c027d10
xor ecx, 0xe7fc9b61
add eax, ecx
add eax, 0xaae2a5b1
cmp eax, 0xcb7c6ca2
jae 0x140042e85
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x78]
mov eax, dword [0x1401dd068]
mov ecx, dword [0x1401dd06c]
xor ecx, 0x53278ff9
xor edx, edx
div ecx
mov dl, byte [rsp + 0x5f]
mov r10d, eax
not r10d
and r10d, 0x80cafc22
mov ecx, eax
and ecx, 0x7f3503dd
imul ecx, r10d
mov r10d, eax
and r10d, 0x80cafc22
or eax, 0x80cafc22
imul eax, r10d
add eax, ecx
imul eax, eax, 0xb7a275a8
add eax, 0x16360548
mov ecx, 0xf1590a26
mov r9, qword [r9]
mov qword [rsp + 0x28], r9
sub r8, r9
setl r8b
and dl, r8b
mov byte [rsp + 0x37], dl
cmp eax, ecx
je 0x140042d55
mov al, byte [rsp + 0x37]
test al, 1
jne 0x140042e1e
jmp 0x140042de6
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x28]
mov rax, 0xffffffffffffffff
xor rax, 0xffffffffffffffff
xor r8d, r8d
sub r8, 1
sub rax, r8
sub rdx, rax
call fcn.1400137e9
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x40], rax
jmp 0x140042e78
mov rax, qword [rsp + 0x38]
mov dl, byte [rsp + 0x77]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
cmp byte [rcx + rax + 8], dl
mov qword [rsp + 0x40], rax
je 0x140042e78
mov rax, qword [rsp + 0x38]
movabs rcx, 0x7b22a9ec628efb27
add rax, rcx
add rax, 1
movabs rcx, 0xaebc62ff3beb0c43
movabs rdx, 0xd59ecb135965f764
xor rcx, rdx
sub rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x140042c9b
mov rax, qword [rsp + 0x40]
add rsp, 0x88
ret
push rbx
and eax, 0xfec7e9b1
invalid
Function at 0x140045b70
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], rcx
mov eax, dword [0x1401dd190]
or eax, dword [0x1401dd194]
mov ecx, 0xefd471d5
xor ecx, 0xefd471d5
sub ecx, eax
mov eax, 0xbf95eef9
xor eax, 0xbf95eef9
mov edx, 0xdc744f75
xor edx, 0x357a263
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov edx, eax
and edx, 0x39dfd409
mov ecx, 0xb545c633
xor ecx, 0xb545c631
imul ecx, edx
mov edx, 0x29a42142
xor edx, 0x107bf54b
add eax, edx
sub eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xeb6ac188
mov ecx, 0xffffffff
xor ecx, 0xc2497f18
or eax, edx
or ecx, 0xc2497f18
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0x66230c00
je 0x140045da3
mov eax, dword [0x1401dd198]
mov ecx, dword [0x1401dd19c]
xor ecx, 0x8132e1f6
imul eax, ecx
imul eax, eax, 0xbf895e0b
add eax, 0x5d8407a5
or eax, 0x19221f22
mov dword [rbp - 0x1c], eax
mov eax, 0x10
mov qword [rbp - 0x40], rax
call fcn.1401da3e0
sub rsp, rax
mov rax, qword [rbp - 0x40]
mov rcx, rsp
mov qword [rbp - 0x30], rcx
call fcn.1401da3e0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x38], rax
sub rsp, 0x20
call fcn.140041c41
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
add rsp, 0x20
mov r8, rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x28], r8
mov qword [rdx], 0
mov r8, qword [rax]
mov qword [rcx], r8
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
movabs r8, 0x91841ad4d19d2663
movabs rax, 0x91841ad4d19d2663
xor r8, rax
sub rsp, 0x20
call fcn.14003c4fd
mov rcx, qword [rbp - 0x28]
add rsp, 0x20
mov rdx, rax
mov eax, dword [rbp - 0x1c]
mov qword [rbp - 0x18], rdx
cmp byte [rcx], 0
sete cl
mov byte [rbp - 9], cl
cmp eax, 0x45ffed50
je 0x140045c0a
mov al, byte [rbp - 9]
test al, 1
jne 0x140045ce8
jmp 0x140045d97
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 8]
cmp rax, qword [rcx]
setne cl
cmp rax, 0
sete al
or al, cl
test al, 1
jne 0x140045d0c
jmp 0x140045d97
mov ecx, 0x40
mov edx, 8
sub rsp, 0x20
call fcn.140013610
add rsp, 0x20
mov rcx, rax
mov rax, qword [0x1401f0b40]
mov qword [rcx], rax
lea rax, [0x1401ea110]
mov qword [rcx + 0x10], rax
mov rax, qword [0x1401ea148]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1401ea150]
mov qword [rcx + 0x20], rax
mov qword [rcx + 8], 0
movabs rax, 0xdcd8399937b003e7
movabs rdx, 0xdcd83999547d3fb4
xor rax, rdx
lea rdx, [0x1401ea110]
lea r8, [0x1401ea11b]
lea r9, [0x1401ea124]
sub rsp, 0x30
mov qword [rsp + 0x20], rax
call fcn.14001355a
add rsp, 0x30
mov rax, qword [rbp - 0x30]
mov rax, qword [rax]
mov rsp, rbp
pop rbp
ret
rcl eax, 0x97
movsb byte [rdi], byte [rsi]
jmp 0x140045c0a
Function at 0x140055380
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
call fcn.14004c253
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
call fcn.14004c26e
mov rdx, qword [rsp + 0x50]
cmp rdx, 0
jge 0x1400553d3
mov rcx, qword [rsp + 0x50]
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
call fcn.14000c499
jmp 0x1400555b4
mov rcx, qword [rsp + 0x50]
call fcn.14004c2ce
mov rcx, rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rcx
cmp byte [rax], 0
jne 0x1400555b4
mov eax, dword [0x1401dd830]
mov edx, dword [0x1401dd834]
xor edx, 0x13eb08d4
xor ecx, ecx
sub ecx, edx
sub eax, ecx
or eax, 0x60cfd689
imul eax, eax, 0xde0766bb
add eax, 0x4294d70
sub eax, 0xdab71aa7
sub eax, 0x4294d70
mov ecx, 0xf9a23a1
xor ecx, 0xac842715
cmp eax, ecx
jbe 0x1400555be
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401dd838]
xor eax, 0x4b7c6c39
imul eax, dword [0x1401dd83c]
mov edx, eax
xor edx, 0x71d6ddc
mov r8d, 0x89c8ea7e
xor r8d, 0x8ed587a2
mov r9d, 0x3480a9b0
xor r9d, 0xcb7f564f
xor r8d, r9d
and eax, r8d
shl eax, 1
sub eax, edx
mov edx, 0x9dfad66e
xor edx, 0x42ae26ee
imul eax, edx
mov r8d, 0xad18966f
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x40]
mov qword [rdx + 0x10], 0
cmp rcx, 0
setl cl
mov byte [rsp + 0x2f], cl
cmp eax, 0xb2536673
jae 0x1400555be
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1400554c9
jmp 0x1400555a5
mov eax, dword [0x1401dd840]
mov ecx, dword [0x1401dd844]
xor ecx, 0x5f4968a
and eax, ecx
xor eax, 0x82679fb5
xor eax, 0xdac4fd68
mov ecx, 0xffffffff
xor ecx, 0x440d7879
mov edx, 0xf90d01da
xor edx, 0xf90d01da
mov r8d, 0x2ccb8676
xor r8d, 0x2ccb8677
sub edx, r8d
sub ecx, edx
sub eax, ecx
cmp eax, 0xfcb8fad6
je 0x1400555c7
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401dd848]
xor eax, 0xa577e9d
or eax, dword [0x1401dd84c]
mov r8d, 0xc6586ddf
xor edx, edx
div r8d
mov r8d, 0xa6f82236
xor r8d, 0xf9d9e9a1
xor edx, edx
div r8d
mov r8d, 0x1bbea542
xor edx, edx
div r8d
mov dword [rsp + 0x28], eax
movabs rdx, 0xdd3b50de3458372f
movabs rax, 0xdd3b50de3458372f
xor rdx, rax
movabs r8, 0x15e1e1a3ec8a09c9
movabs rax, 0x6a1e1e5c1375f636
xor r8, rax
call fcn.14000c499
mov eax, dword [rsp + 0x28]
cmp eax, 0x1d2e57ce
je 0x14005551c
jmp 0x1400555b4
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call fcn.14002830d
mov rax, qword [rsp + 0x38]
add rsp, 0x58
ret
xchg edx, eax
cmc
pop rdx
imul ecx
jno 0x1400555c3
invalid
scasd eax, dword [rdi]
or eax, esp
test al, 0xe9
invalid
Function at 0x1400573d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 0x50], rdx
mov qword [rbp - 0x60], rcx
mov eax, 0x10
call fcn.1401da3e0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x58], rax
sub rsp, 0x20
call fcn.14004c253
mov rcx, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
add rsp, 0x20
mov r8, rax
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x48], r8
mov qword [rbp - 8], 0
mov qword [rbp - 0x10], 0
mov r8, qword [rcx + 0x10]
mov qword [rbp - 0x20], r8
movups xmm0, xmmword [rcx]
movaps xmmword [rbp - 0x30], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
sub rsp, 0x20
lea rcx, [rbp - 0x30]
lea r8, [rbp - 0x10]
call fcn.140056d50
mov rcx, qword [rbp - 0x48]
add rsp, 0x20
mov rdx, rax
mov qword [rbp - 0x40], rdx
mov cl, byte [rcx]
test cl, cl
sete cl
test rax, rax
setns al
and cl, al
xor eax, eax
test cl, 1
mov qword [rbp - 0x38], rax
jne 0x14005747e
jmp 0x1400574f4
mov rax, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x60]
mov rcx, qword [rcx]
mov qword [rbp - 0x68], rcx
cmp rax, rcx
jl 0x1400574ba
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffff
sub rsp, 0x20
call fcn.1400137e9
add rsp, 0x20
xor eax, eax
mov qword [rbp - 0x38], rax
jmp 0x1400574f4
mov rcx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x60]
mov rax, qword [rax + 8]
add rax, 8
shl rcx, 5
add rax, rcx
add rax, 0x18
mov rdx, qword [rax]
lea rcx, [rbp - 8]
xor r8d, r8d
sub rsp, 0x20
call fcn.140137d60
add rsp, 0x20
mov rax, qword [rbp - 8]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x70], rax
mov ecx, dword [0x1401dd8e0]
imul ecx, dword [0x1401dd8e4]
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0x6453e69c
xor edx, 0x5a9f7fb9
and eax, edx
mov edx, 0xffffffff
xor edx, 0x3ecc9925
and ecx, edx
sub ecx, eax
add ecx, 0x548b91a3
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x4a8e3113
and eax, edx
mov edx, 0x860bda5c
xor edx, 0xcc85eb4f
or ecx, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
mov edx, 0xc6827476
xor edx, 0x397d8b89
xor ecx, edx
and eax, ecx
mov ecx, 0xaed39fd2
xor ecx, 0x2cc40752
cmp eax, ecx
ja 0x1400575b4
mov eax, dword [0x1401dd8e8]
xor edx, edx
div dword [0x1401dd8ec]
mov ecx, 0xfe9340f0
xor edx, edx
div ecx
mov ecx, 0xfde123f0
xor ecx, 0xc6d415f7
add eax, ecx
or eax, 0xadaf35fd
cmp eax, 0x71d171a3
je 0x140057577
mov rax, qword [rbp - 0x70]
mov rsp, rbp
pop rbp
ret
adc byte [rdx - 0x4516d6ba], dl
invalid
Function at 0x140059e00
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x198
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x80], r8
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0xb0], rcx
mov eax, 0x10
Function at 0x140060f60
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x18], r8
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401ddcc0]
mov edx, dword [0x1401ddcc4]
mov ecx, eax
and ecx, edx
shl ecx, 1
xor eax, edx
add eax, ecx
mov ecx, 0x99876cd3
xor edx, edx
div ecx
mov ecx, eax
mov r8d, 0xffffffff
xor r8d, 0x5408eedf
mov edx, ecx
and edx, r8d
mov eax, ecx
or eax, r8d
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, 0x5408eedf
or ecx, 0x5408eedf
imul ecx, edx
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x488d4bf2
and eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x488d4bf2
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
cmp eax, 0x58859521
jae 0x1400610c2
mov eax, dword [0x1401ddcc8]
mov ecx, dword [0x1401ddccc]
xor eax, ecx
xor eax, 0xa24f8401
or eax, 0x58906954
xor eax, 0xc3d04a82
add eax, 0x51a62c34
mov dword [rbp - 0x24], eax
mov eax, 0x3c17acd
mov dword [rbp - 0x28], eax
mov eax, 0x20
call fcn.1401da3e0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x38], rax
mov eax, 0x10
call fcn.1401da3e0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
loopne 0x140061097
mov dword [rbp - 0x30], eax
sub rsp, 0x20
call fcn.14004c253
mov r9, qword [rbp - 8]
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x18]
add rsp, 0x20
mov rax, qword [rbp - 0x10]
mov r10, qword [r9]
mov qword [rcx], r10
mov r10, qword [r9 + 8]
mov qword [rcx + 8], r10
mov r9, qword [r9 + 0x10]
mov qword [rcx + 0x10], r9
mov r9, qword [rax]
mov qword [rdx], r9
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140060840
mov ecx, dword [rbp - 0x28]
add rsp, 0x20
mov rdx, rax
mov eax, dword [rbp - 0x24]
mov qword [rbp - 0x20], rdx
cmp eax, ecx
jbe 0x140060ffd
mov rax, qword [rbp - 0x20]
mov rsp, rbp
pop rbp
ret
loop 0x14006104d
mov bl, 0xed
jmp 0x140060ffd
Function at 0x140063f50
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401dde28]
xor edx, edx
div dword [0x1401dde2c]
mov ecx, eax
mov eax, ecx
or eax, eax
xor eax, 0xffffffff
mov edx, 0xb83c982b
or edx, 0xb83c982b
xor edx, 0xffffffff
mov r8d, 0x22a0114e
xor r8d, 0xdd5feeb1
xor eax, r8d
xor edx, 0xffffffff
and eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xb83c982b
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
imul eax, eax, 0x59211326
and eax, 0xb3285b32
cmp eax, 0x80820c4c
jbe 0x140064116
mov eax, dword [0x1401dde30]
xor eax, 0x9be6ce5a
mov ecx, dword [0x1401dde34]
sub eax, ecx
and eax, 0x811000b0
xor eax, 0x81000000
mov dword [rbp - 0x14], eax
mov eax, 0x10
mov qword [rbp - 0x30], rax
call fcn.1401da3e0
sub rsp, rax
mov rax, qword [rbp - 0x30]
mov rcx, rsp
mov qword [rbp - 0x40], rcx
call fcn.1401da3e0
sub rsp, rax
mov rax, qword [rbp - 0x30]
mov rcx, rsp
mov qword [rbp - 0x38], rcx
call fcn.1401da3e0
sub rsp, rax
mov rax, qword [rbp - 0x30]
mov rcx, rsp
mov qword [rbp - 0x28], rcx
call fcn.1401da3e0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
mov rax, qword [0x1401f0e70]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.1400065b3
add rsp, 0x20
mov eax, dword [rbp - 0x14]
cmp eax, 0xc12a62a
je 0x140063fca
xor eax, eax
mov qword [rbp - 0x48], rax
jmp 0x14006406a
mov rax, qword [rbp - 0x48]
mov qword [rbp - 0x50], rax
cmp rax, 0x20
je 0x140064095
mov rax, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x10]
mov byte [rcx + rax], 0
add rax, 1
mov qword [rbp - 0x48], rax
jmp 0x14006406a
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14001e153
mov r9, qword [rbp - 0x40]
mov rax, qword [rbp - 8]
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x10]
add rsp, 0x20
mov r10, qword [r9]
mov qword [r8], r10
mov r9, qword [r9 + 8]
mov qword [r8 + 8], r9
mov r8, qword [rax + 0x10]
mov qword [rdx], r8
mov rax, qword [rax + 0x18]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14001e153
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x10]
add rsp, 0x20
mov rdx, qword [rcx]
mov qword [rax + 0x10], rdx
mov rcx, qword [rcx + 8]
mov qword [rax + 0x18], rcx
mov rsp, rbp
pop rbp
ret
sbb esp, ebp
rol byte [0x14004ed08], 0xff
nop
Function at 0x140064eb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov eax, dword [0x1401dde48]
and eax, dword [0x1401dde4c]
or eax, 0x7a50be04
mov r8d, 0xffffffff
xor r8d, 0xa8caa760
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xa8caa760
mov r8d, 0x2348f207
xor r8d, 0x8b825567
or eax, r8d
imul eax, edx
add eax, ecx
add eax, 0xc0d69843
cmp eax, 0x64054b1c
je 0x140064f96
mov eax, dword [0x1401dde50]
mov ecx, 0xec7f6df3
xor ecx, 0xdfbf4ee6
xor eax, ecx
mov ecx, dword [0x1401dde54]
xor ecx, 0x735d423d
sub eax, ecx
mov ecx, 0xb5010b52
xor ecx, 0xfde82198
xor eax, ecx
add eax, 0xcff7f419
add eax, 0x227a18c0
sub eax, 0xcff7f419
mov ecx, 0xd1030871
xor ecx, 0x45d03ae6
add eax, ecx
add eax, 0xc57b9c4d
sub eax, 0x94d33297
mov dword [rsp + 0x2c], eax
mov rax, qword [0x1401f0e70]
mov ecx, dword [rax]
call fcn.1400065b3
mov rcx, rax
mov eax, dword [rsp + 0x2c]
mov qword [rsp + 0x30], rcx
cmp eax, 0xd67449c9
je 0x140064f0f
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, 0xe987023d
jo 0x140064f9c
invalid
invalid
Function at 0x140068fa0
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x150
mov rax, rdx
mov qword [rsp + 0x120], rax