joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140062c90
Capabilities:
Encode data using xor

Disassembly:
push rax
mov qword [rsp], rcx
mov ecx, dword [0x140202f98]
mov edx, dword [0x140202f9c]
mov eax, ecx
and eax, edx
shl eax, 1
add ecx, edx
sub ecx, eax
mov eax, ecx
and eax, eax
mov edx, 0xbd33b5f6
xor edx, 0x42cc4a09
xor eax, edx
mov edx, 0x6f8d58e6
xor edx, 0x66e90a5e
and eax, edx
xor eax, 0xffffffff
mov edx, 0x30f2c679
xor edx, 0x399694c1
mov r8d, 0x7c23c8d5
xor r8d, 0x75479a6d
and edx, r8d
xor edx, 0xffffffff
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
and eax, 0x8aaddc31
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
mov edx, 0xc8cc3625
xor edx, 0xf6d4fcec
or eax, edx
add eax, ecx
cmp eax, 0x210bda56
jae 0x140062d71
mov rcx, qword [rsp]
mov eax, dword [0x140202fa0]
add eax, dword [0x140202fa4]
mov edx, 0xa43acf86
xor edx, 0x775fe393
add eax, edx
mov edx, 0x5eae87e5
xor edx, 0xf368750f
xor eax, edx
add eax, 0xe8b68e3c
mov qword [rcx], 0
mov qword [rcx + 8], 0
mov byte [rcx + 0x10], 0
cmp eax, 0xf40c7fa5
ja 0x140062d22
pop rax
ret
outsd dx, dword [rsi]
sahf
xor dword [rbx], esi
jmp 0x140062d22

Function at 0x140063100
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x140202fc8]
mov edx, dword [0x140202fcc]
mov r8d, 0x25f2390a
xor r8d, 0xda0dc6f5
mov ecx, eax
xor ecx, r8d
and ecx, edx
xor edx, 0xffffffff
and eax, edx
sub eax, ecx
mov ecx, 0x2bfe2e73
xor edx, edx
div ecx
add eax, 0xc02d4143
and eax, 0x2e6f9f12
cmp eax, 0xb8ef0c63
ja 0x1400631f3
mov rcx, qword [rbp - 8]
mov edx, dword [0x140202fd0]
mov r9d, dword [0x140202fd4]
mov r8d, edx
not r8d
mov eax, r9d
and eax, r8d
mov r10d, r9d
not r10d
mov r8d, edx
and r8d, r10d
imul r8d, eax
mov eax, edx
and eax, r9d
or edx, r9d
imul edx, eax
mov eax, edx
mov edx, r8d
lea eax, [rax + rdx - 0xe9daab9]
xor eax, 0x2f794379
mov dword [rbp - 0x14], eax
mov eax, 0x10
call fcn.1401ffc50
sub rsp, rax
mov rax, qword [rbp - 0x10]
mov rdx, rsp
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14001a950
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
mov eax, dword [rbp - 0x14]
add rsp, 0x20
mov dl, byte [rdx + 0x10]
mov byte [rcx + 0x10], dl
cmp eax, 0x7e21ef1b
ja 0x140063157
mov rsp, rbp
pop rbp
ret
sub bh, byte [rbx]
or byte [rcx + rbp*8], 0x5b
invalid
Function at 0x140063990
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x50], rdx
mov rax, rcx
mov qword [rsp + 0x58], rax
mov ecx, dword [rdx]
mov dword [rax], ecx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x60], rcx
movdqu xmm0, xmmword [rdx + 8]
movdqu xmmword [rax + 8], xmm0
call fcn.140063600
test al, 1
jne 0x1400639ca
jmp 0x1400639d4
mov rcx, qword [rsp + 0x60]
call fcn.140010ef0
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rax + 0x20]
mov qword [rsp + 0x48], rcx
movdqu xmm0, xmmword [rdx + 0x18]
movdqu xmmword [rax + 0x18], xmm0
call fcn.140063600
test al, 1
jne 0x140063a03
jmp 0x140063a0d
mov rcx, qword [rsp + 0x48]
call fcn.140010ef0
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x40], rcx
movdqu xmm0, xmmword [rdx + 0x28]
movdqu xmmword [rax + 0x28], xmm0
call fcn.140063600
test al, 1
jne 0x140063a3c
jmp 0x140063a46
mov rcx, qword [rsp + 0x40]
call fcn.140010ef0
mov eax, dword [0x140203008]
mov ecx, 0xac8ccd44
xor ecx, 0xdb114f22
xor eax, ecx
mov edx, dword [0x14020300c]
mov ecx, edx
and ecx, eax
xor ecx, 0xffffffff
add eax, edx
mov edx, 0xd5f5be29
xor edx, 0xd5f5be28
add eax, edx
add eax, ecx
mov ecx, 0xa57f4753
xor edx, edx
div ecx
and eax, 0x6bf642d4
mov edx, 0x6fa8fc0f
xor edx, 0xbcbf5e11
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
or eax, 0xd317a21e
and eax, ecx
cmp eax, 0xeaf89a33
je 0x140063b42
mov eax, dword [0x140203010]
mov ecx, dword [0x140203014]
xor ecx, 0x9f7265fb
or eax, ecx
or eax, 0x6911d356
mov ecx, 0xc21b04dd
xor edx, edx
div ecx
mov ecx, 0xec18491d
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x50]
mov ecx, eax
mov rax, qword [rsp + 0x58]
mov dword [rsp + 0x38], ecx
mov ecx, 0xa973b66
xor ecx, 0x54f8c160
mov dword [rsp + 0x34], ecx
mov rcx, qword [rax + 0x40]
mov qword [rsp + 0x28], rcx
movdqu xmm0, xmmword [rdx + 0x38]
movdqu xmmword [rax + 0x38], xmm0
call fcn.140063600
mov ecx, dword [rsp + 0x34]
mov dl, al
mov eax, dword [rsp + 0x38]
mov byte [rsp + 0x3f], dl
cmp eax, ecx
ja 0x140063aa9
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x140063b32
jmp 0x140063b3c
mov rcx, qword [rsp + 0x28]
call fcn.140010ef0
nop
add rsp, 0x68
ret
movabs dword [0xffffff5ee91be640], eax
Function at 0x140066780
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rcx
xor eax, eax
test r8, r8
cmovg rax, r8
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x10], rax
mov eax, dword [0x140203148]
mov ecx, dword [0x14020314c]
mov edx, 0x6f8d58e6
xor edx, 0xd2beed10
xor ecx, edx
add eax, ecx
mov edx, 0x30f2c679
xor edx, 0xcf0d3986
mov ecx, eax
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0xa6d16ad9
and ecx, edx
or eax, 0xa6d16ad9
xor eax, 0xffffffff
or ecx, eax
xor ecx, 0xffffffff
sub ecx, 0x4f61b92d
mov eax, ecx
or eax, 0x64baba9c
xor eax, 0xffffffff
or ecx, 0x64baba9c
xor ecx, 0xffffffff
mov edx, 0xc8cc3625
xor edx, 0x3733c9da
xor eax, edx
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x63fbaa45
xor ecx, 0x805a9f8b
cmp eax, ecx
jb 0x140066a19
mov r8, qword [rsp + 0x28]
mov eax, dword [0x140203150]
mov ecx, dword [0x140203154]
mov edx, 0x5eae87e5
xor edx, 0xfa944863
xor ecx, edx
imul eax, ecx
xor eax, 0x14a115b
mov ecx, 0xb5e00d91
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x10]
mov ecx, 0xf8624e47
xor ecx, 0xf7b25169
and eax, ecx
mov ecx, 0x73db8ad3
xor ecx, 0xc10d30f7
cmp rdx, r8
sete dl
mov byte [rsp + 0xf], dl
cmp eax, ecx
je 0x14006682f
mov al, byte [rsp + 0xf]
test al, 1
jne 0x140066a14
jmp 0x14006689e
mov ecx, dword [0x140203158]
mov edx, dword [0x14020315c]
mov eax, ecx
xor eax, 0xffffffff
and eax, edx
xor edx, 0xffffffff
and ecx, edx
sub ecx, eax
add ecx, 0x4bf2fc1d
mov edx, 0xd1787c0e
xor edx, 0x2e8783f1
mov eax, ecx
xor eax, edx
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
mov edx, 0x9bd20379
xor edx, 0x127a6318
and eax, edx
mov edx, 0x923ac940
xor edx, 0x6dc536bf
xor eax, edx
mov edx, 0x89a86061
and edx, 0x89a86061
xor edx, 0xffffffff
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0x8b194e09
xor ecx, 0x54e4bc5
add eax, ecx
cmp eax, 0x2cc88cf9
jbe 0x140066a22
mov rcx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r10d, dword [0x140203160]
mov r9d, dword [0x140203164]
mov edx, r10d
xor edx, 0xffffffff
mov eax, 0x8e6a7694
xor eax, 0x41b1e5f4
and eax, edx
mov r11d, 0xffffffff
xor r11d, 0xcfdb9360
and r10d, r11d
mov edx, r9d
xor edx, 0xffffffff
and edx, 0xcfdb9360
and r9d, r11d
or eax, r10d
or edx, r9d
xor eax, edx
mov r9d, 0xb0e54e21
xor edx, edx
div r9d
mov r9d, 0x21c05d3b
xor edx, edx
div r9d
mov rdx, qword [rsp + 0x20]
mov r10d, eax
and r10d, 0xc1afec46
mov r9d, 0xaf93f7ee
xor r9d, 0xaf93f7ec
imul r9d, r10d
mov r10d, 0xb32602a5
xor r10d, 0x7289eee3
add eax, r10d
sub eax, r9d
mov r8b, byte [r8 + rcx]
mov byte [rdx + rcx], r8b
movabs rdx, 0xee605fc10bc89d7b
movabs r8, 0xee605fc10bc89d7b
xor rdx, r8
movabs r8, 0x13f5342d6900a960
movabs r9, 0x13f5342d6900a961
xor r8, r9
sub rdx, r8
sub rcx, rdx
mov qword [rsp], rcx
cmp eax, 0x566bcef9
je 0x140066921
mov rax, qword [rsp]
mov qword [rsp + 0x30], rax
jmp 0x1400667a3
add rsp, 0x38
ret
enter 0x796b, 0x55
jmp 0x14006682f
outsd dx, dword [rsi]
sahf
xor dword [rbx], esi
jmp 0x140066921
Function at 0x140066dd0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov word [rsp + 0x36], cx
call fcn.140065e32
mov cx, word [rsp + 0x36]
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x57], 0
mov rax, qword [0x140226f88]
mov qword [rsp + 0x38], rax
movsx rcx, cx
add rax, 8
shl rcx, 4
add rax, rcx
add rax, 8
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
add rcx, 0xb
call fcn.1400662ae
mov rcx, qword [rsp + 0x48]
mov word [rsp + 0x54], ax
xor eax, eax
cmp byte [rcx], 0
mov byte [rsp + 0x56], al
jne 0x140066fb9
mov ecx, dword [0x140203168]
mov eax, 0x5277f566
xor eax, 0xa418313a
xor ecx, eax
mov edx, dword [0x14020316c]
xor edx, 0xffffffff
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, eax
xor ecx, 0xaba1c68
mov edx, 0x6cc5435
xor edx, 0xf933abca
xor ecx, edx
mov edx, 0x9313b9ea
xor edx, 0x99a9a582
or eax, edx
and eax, ecx
sub eax, 0x481addf1
sub eax, 0x7c003605
add eax, 0x481addf1
mov ecx, eax
xor ecx, 0xaa467897
xor ecx, 0xffffffff
or eax, 0xaa467897
and eax, ecx
cmp eax, 0xd9298de2
je 0x140066fc2
mov r8w, word [rsp + 0x54]
mov eax, dword [0x140203170]
mov ecx, dword [0x140203174]
xor ecx, 0xc160767a
imul eax, ecx
or eax, 0x72443d00
mov ecx, 0x80d9569a
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x40]
mov ecx, 0xa2941633
xor ecx, 0x7f3d8d70
add eax, ecx
mov ecx, 0x8d0f8e6f
xor ecx, 0xc0351268
add eax, ecx
sub eax, 0xdda99b43
mov ecx, 0x982eae1d
xor ecx, 0x26e62200
movsx r8, r8w
mov qword [rsp + 0x28], r8
cmp byte [rdx + 0x10], 0x87
sete dl
mov byte [rsp + 0x35], dl
cmp eax, ecx
jae 0x140066ea7
mov rax, qword [rsp + 0x38]
mov cl, byte [rsp + 0x35]
test cl, 1
mov qword [rsp + 0x20], rax
jne 0x140066f37
jmp 0x140066f81
mov cx, word [rsp + 0x36]
mov rdx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x38]
add rax, 8
shl rdx, 4
add rax, rdx
add rax, 8
mov r8, qword [rax]
add r8, 8
call fcn.140066330
mov rcx, qword [rsp + 0x48]
xor eax, eax
cmp byte [rcx], 0
mov byte [rsp + 0x56], al
jne 0x140066fb9
mov rax, qword [0x140226f88]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x20]
add rax, 8
shl rcx, 4
add rax, rcx
add rax, 8
mov rdx, qword [rax]
add rdx, 8
lea rcx, [rsp + 0x57]
mov r8d, 1
call fcn.140066780
mov al, byte [rsp + 0x57]
mov byte [rsp + 0x56], al
mov al, byte [rsp + 0x56]
add rsp, 0x58
ret
out dx, eax
nop
movabs dword ss:[0x441f0ffffffedce9], eax
add byte [rax], al
Function at 0x140067fc0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x140068032
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
movabs rdx, 0x1071b159fda4aa01
movabs rax, 0x5071b159fda4aa01
xor rdx, rax
movabs rax, 0x7f05c2cd57e6a832
movabs r8, 0x80fa3d32a81957cd
xor rax, r8
xor rdx, rax
mov rax, rcx
xor rax, rdx
and rax, rcx
cmp rax, 0
je 0x140068032
mov rcx, qword [rsp + 0x28]
call fcn.140015b50
mov eax, dword [0x1402031e8]
mov ecx, 0x5e65b181
xor ecx, 0xeaee2640
xor eax, ecx
mov ecx, dword [0x1402031ec]
sub eax, 0xa5561ad2
sub eax, ecx
mov ecx, 0xf50dd9ce
xor ecx, 0x505bc31c
add eax, ecx
xor eax, 0x4ca1df6d
mov ecx, 0xf0fa5574
xor ecx, 0xf05aa8b
mov edx, eax
xor edx, ecx
and edx, 0x76f666e7
mov r8d, 0xffffffff
xor r8d, 0x76f666e7
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x76f666e7
mov r8d, 0xea17372a
xor r8d, 0x9ce151cd
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xd124212b
xor ecx, 0x5ee6a35a
sub eax, ecx
mov ecx, 0xa85ef48d
xor ecx, 0xfa02eb5a
cmp eax, ecx
jae 0x140068131
mov eax, dword [0x1402031f0]
xor eax, 0x36a503e0
mov ecx, dword [0x1402031f4]
xor ecx, 0x3b2338bc
add eax, ecx
mov ecx, 0x4952da1d
xor edx, edx
div ecx
mov ecx, 0xc66012b5
xor ecx, 0xf0bf5264
or eax, ecx
mov ecx, 0x7818b4df
xor ecx, 0x3006aac5
sub eax, ecx
sub eax, 0x8180d9f5
mov ecx, 0xf96238f6
xor ecx, 0xb17c26ec
add eax, ecx
mov ecx, 0xab975858
xor ecx, 0xb807b51a
cmp eax, ecx
jb 0x1400680cb
add rsp, 0x38
ret
push rsp
push rsi
invalid
Function at 0x14006be10
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov dword [rbp - 0xc], edx
mov qword [rbp - 8], rcx
mov eax, dword [0x140203438]
add eax, dword [0x14020343c]
sub eax, 0xfd865ed7
mov ecx, 0xd512c3be
xor ecx, 0x73bc5a01
or eax, ecx
add eax, 0xb22ec006
mov ecx, 0x90f73599
xor ecx, 0x42220915
sub eax, ecx
sub eax, 0xb22ec006
mov ecx, 0xa3318553
xor ecx, 0x5b39afac
cmp eax, ecx
ja 0x14006bf3a
mov ecx, dword [rbp - 0xc]
mov eax, dword [0x140203440]
mov edx, dword [0x140203444]
or eax, edx
mov edx, eax
xor edx, 0x34f09d0c
or eax, 0xcb0f62f3
and eax, edx
add eax, 0xa53d5567
xor eax, 0xa0dbf040
mov dword [rbp - 0x14], eax
mov eax, 0x10
mov qword [rbp - 0x38], rax
call fcn.1401ffc50
sub rsp, rax
mov rax, qword [rbp - 0x38]
mov rdx, rsp
mov qword [rbp - 0x28], rdx
call fcn.1401ffc50
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov rdx, rsp
mov qword [rbp - 0x30], rdx
mov dword [rax], ecx
sub rsp, 0x20
call fcn.14006b577
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov dword [rcx], 0
sub rsp, 0x20
call fcn.14006bf43
mov rcx, qword [rbp - 0x20]
mov eax, dword [rbp - 0x14]
add rsp, 0x20
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0xd], cl
cmp eax, 0x4428fbc4
je 0x14006be69
mov al, byte [rbp - 0xd]
test al, 1
jne 0x14006bf1e
jmp 0x14006bf35
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x30]
mov edx, dword [rax]
sub rsp, 0x20
call fcn.140036f00
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
jp 0x14006bf5b
pop rax
ja 0x14006bf28
invalid
add al, 0
add byte [rax], al
Function at 0x14006bf90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x140203448]
xor edx, edx
div dword [0x14020344c]
mov ecx, eax
mov eax, ecx
and eax, 0x4d3a9c07
or ecx, 0x4d3a9c07
add eax, ecx
mov ecx, 0x745d33b6
xor ecx, 0xfd58a280
add eax, ecx
and eax, 0x191ddc00
mov ecx, 0x6ab7e74e
xor ecx, 0x67fd0e81
cmp eax, ecx
je 0x14006c162
mov edx, dword [0x140203450]
xor edx, 0xf0fb7ed4
mov eax, dword [0x140203454]
xor eax, 0x3dfbe80f
mov ecx, edx
xor ecx, eax
mov r8d, 0x76c26af6
xor r8d, 0x893d9509
xor eax, r8d
and edx, eax
mov eax, 0x3b82a746
xor eax, 0x3b82a744
imul eax, edx
sub eax, ecx
mov ecx, 0x7d75f33e
xor ecx, 0x568bdd4d
xor edx, edx
div ecx
mov ecx, 0x3d31e725
xor ecx, 0xfd1ca666
mov edx, 0x7046e8f5
xor edx, 0x8fb9170a
xor ecx, edx
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
and eax, 0x2e6f9f12
mov dword [rsp + 0x24], eax
call fcn.14006b577
mov rcx, qword [rsp + 0x38]
mov rdx, rax
mov eax, dword [rsp + 0x24]
mov qword [rsp + 0x28], rdx
cmp rcx, 0x10
setl cl
mov byte [rsp + 0x37], cl
cmp eax, 0xb8ef0c63
ja 0x14006bfe2
mov al, byte [rsp + 0x37]
test al, 1
jne 0x14006c094
jmp 0x14006c0cf
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov dl, al
mov al, 0x67
xor al, 0x98
xor dl, al
mov al, 0xff
xor al, 0xf
mov r8b, 0xff
xor r8b, 0x9a
or dl, al
mov al, 0x11
xor al, 0x8b
or al, r8b
xor dl, 0xff
and dl, al
mov al, 0x78
xor al, 0xe8
or dl, al
call fcn.140036dbf
jmp 0x14006c15c
mov rax, qword [rsp + 0x38]
movabs rcx, 0x5105482518b143a8
movabs rdx, 0x5105482518b1bc57
xor rcx, rdx
cmp rax, rcx
ja 0x14006c12e
mov rcx, qword [rsp + 0x40]
mov edx, 0xdc
call fcn.140036dbf
mov rax, qword [rsp + 0x28]
mov al, byte [rax]
mov cl, 0xb6
xor cl, 0xb6
cmp al, cl
jne 0x14006c15c
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov dx, ax
call fcn.14006b9b0
jmp 0x14006c15c
mov rcx, qword [rsp + 0x40]
mov dl, 0x26
xor dl, 0xfb
call fcn.140036dbf
mov rax, qword [rsp + 0x28]
cmp byte [rax], 0
jne 0x14006c15c
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov edx, eax
call fcn.14006be10
nop
add rsp, 0x48
ret
jmp 0x14006bfe2
Function at 0x14006c990
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
mov r11d, dword [0x1402034a8]
xor r11d, 0xf58fa919
mov ecx, dword [0x1402034ac]
mov eax, r11d
xor eax, ecx
xor eax, 0xffffffff
mov edx, ecx
and edx, eax
mov eax, 0x8bc0e91d
xor eax, 0x8bc0e91f
imul eax, edx
sub eax, ecx
sub r11d, eax
or r11d, 0xe2b7dd9d
mov ecx, 0x1f334867
xor ecx, 0xe0ccb798
mov eax, r11d
xor eax, ecx
mov r8d, 0x9e251159
xor r8d, 0xed381125
mov ecx, 0x16b0dd7c
xor ecx, 0xe94f2283
xor r8d, ecx
mov edx, 0xffffffff
xor edx, 0xc617048c
mov ecx, eax
and ecx, 0xc617048c
and r11d, edx
mov r9d, r8d
and r9d, 0xc617048c
mov r10d, edx
and r10d, 0x731d007c
or ecx, r11d
or r9d, r10d
xor ecx, r9d
or eax, r8d
xor eax, 0xffffffff
or edx, 0xc617048c
and eax, edx
or ecx, eax
mov eax, ecx
or eax, eax
mov edx, 0xb8d53c27
xor edx, 0x472ac3d8
xor eax, edx
mov edx, 0xffffffff
xor edx, 0x9e325583
mov r8d, 0xffffffff
xor r8d, 0x9e325583
and edx, r8d
xor eax, 0xffffffff
xor edx, 0xffffffff
and eax, edx
xor ecx, 0xffffffff
mov edx, 0x24aca841
xor edx, 0xba9efdc2
mov r8d, 0x261fdfea
xor r8d, 0xd9e02015
xor edx, r8d
and ecx, edx
xor eax, 0xffffffff
mov edx, 0xe1069f76
xor edx, 0x1ef96089
xor ecx, edx
and eax, ecx
cmp eax, 0x5c5c7f18
jb 0x14006cc16
mov ecx, dword [0x1402034b0]
mov edx, dword [0x1402034b4]
xor edx, 0x130e8cdb
mov eax, ecx
mov ecx, edx
lea eax, [rax + rcx + 0x3f3dd37f]
and eax, 0x9dd95303
mov dword [rbp - 0x2c], eax
mov eax, 0x10
call fcn.1401ffc50
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
sub rsp, 0x20
call fcn.14006b577
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x38], rcx
movabs rcx, 0x1670344abda9829a
movabs rdx, 0x1670344abda9829a
xor rcx, rdx
mov qword [rax], rcx
mov qword [rax + 8], 0
mov ecx, 8
sub rsp, 0x20
call fcn.14006b660
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov rdx, rax
mov eax, dword [rbp - 0x2c]
mov qword [rbp - 0x28], rdx
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0x19], cl
cmp eax, 0x402a7c25
jb 0x14006cabe
mov cl, byte [rbp - 0x19]
mov al, 1
test cl, 1
mov byte [rbp - 0x41], al
jne 0x14006cb7b
jmp 0x14006cbd3
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x28]
sub rsp, 0x20
call fcn.14006c96a
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov al, 1
cmp byte [rcx], 0
mov byte [rbp - 0x41], al
jne 0x14006cbd3
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x28]
mov r8, qword [rax + 0x58]
mov qword [rdx], r8
mov rax, qword [rax + 0x60]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14001a950
mov rax, qword [rbp - 0x38]
add rsp, 0x20
mov al, byte [rax]
mov byte [rbp - 0x41], al
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x28]
mov dl, byte [rbp - 0x41]
mov byte [rbp - 0x42], dl
mov byte [rax], 0
sub rsp, 0x20
call fcn.14006b13c
mov rax, qword [rbp - 0x38]
add rsp, 0x20
mov al, byte [rax]
mov cl, 0x59
xor cl, 0x59
cmp al, cl
jne 0x14006cc0d
mov rax, qword [rbp - 0x38]
mov cl, byte [rbp - 0x42]
mov byte [rax], cl
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
shr word [rbx], 0xc7
jmp 0x14006cabe
Function at 0x140074424
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
call fcn.14006b577
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
call fcn.14003760f
mov cl, al
mov rax, qword [rsp + 0x58]
mov byte [rsp + 0x67], cl
cmp byte [rax], 0
jne 0x14007440c
mov al, byte [rsp + 0x67]
cmp al, 0xc0
jne 0x1400742df
mov eax, dword [0x140203878]
mov edx, dword [0x14020387c]
mov r8d, 0xd244e50f
xor r8d, 0x2dbb1af0
mov ecx, eax
xor ecx, r8d
and ecx, edx
xor edx, 0xffffffff
and eax, edx
sub eax, ecx
or eax, 0x5dc01c70
add eax, 0x507a9f90
mov ecx, 0x6b401184
xor ecx, 0xbe28614e
add eax, ecx
mov ecx, 0x5e4fe9dd
xor ecx, 0x84b6c080
cmp eax, ecx
jae 0x140074412
mov rcx, qword [rsp + 0x50]
mov eax, dword [0x140203880]
sub eax, dword [0x140203884]
add eax, 0xfc8e7f20
mov edx, 0xffffffff
xor edx, 0x2333ea26
add eax, edx
mov edx, 0xdfb6694c
xor edx, 0xdfb6694d
add eax, edx
mov edx, eax
xor edx, 0xffffffff
mov r8d, 0x760921d3
xor r8d, 0x95a470a6
and r8d, edx
mov r9d, 0xffffffff
xor r9d, 0xe3ad5175
mov edx, eax
and edx, r9d
imul edx, r8d
mov r8d, eax
and r8d, 0xe3ad5175
or eax, 0xe3ad5175
imul eax, r8d
add eax, edx
mov dword [rsp + 0x44], eax
mov eax, 0x8577b45d
xor eax, 0x3bd871eb
mov dword [rsp + 0x40], eax
call fcn.14006faf0
mov ecx, dword [rsp + 0x40]
mov eax, dword [rsp + 0x44]
cmp eax, ecx
jae 0x140074412
jmp 0x14007440c
mov eax, dword [0x140203888]
mov edx, dword [0x14020388c]
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, edx
add eax, ecx
mov ecx, 0xb1eb14c8
xor ecx, 0x86e0697c
xor edx, edx
div ecx
mov r8d, eax
mov eax, r8d
xor eax, 0xffffffff
and eax, 0x2351e163
mov edx, 0xffffffff
xor edx, 0x2351e163
and r8d, edx
mov ecx, 0x9c80bef0
xor ecx, 0x7861949f
mov r9d, 0xf9080e23
xor r9d, 0x6f7f1dc
xor ecx, r9d
and ecx, 0x2351e163
and edx, 0xe4e12a6f
or eax, r8d
or ecx, edx
xor eax, ecx
mov ecx, 0x11c40c9b
xor ecx, 0x5bbaa416
sub eax, ecx
cmp eax, 0x630dda9
je 0x14007441b
mov rcx, qword [rsp + 0x48]
mov eax, dword [0x140203890]
or eax, dword [0x140203894]
mov edx, 0xc33ea5c
xor edx, 0x3d1d3069
or eax, edx
xor eax, 0xe5f7cdf7
sub eax, 0x318b55cf
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rcx
cmp rcx, 0
sete cl
mov byte [rsp + 0x3f], cl
cmp eax, 0x7ff1550f
jbe 0x140074368
mov rax, qword [rsp + 0x30]
mov cl, byte [rsp + 0x3f]
test cl, 1
mov qword [rsp + 0x28], rax
jne 0x1400743ca
jmp 0x1400743fd
xor eax, eax
mov ecx, eax
call fcn.1400dbca0
mov rax, qword [rsp + 0x58]
cmp byte [rax], 0
jne 0x14007440c
mov ecx, 0x10
mov edx, 8
call fcn.140014320
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x28]
call fcn.14007417f
nop
add rsp, 0x68
ret
xor eax, ecx
in al, 0xb6
jmp 0x140074243
invalid
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006b577
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x1400741b0
Function at 0x1400746f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
call fcn.14006b577
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
call fcn.14006e02a
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140074961
mov eax, dword [0x1402038a8]
mov ecx, 0x5b39b5d5
xor ecx, 0x92c5d0f8
xor eax, ecx
mov edx, dword [0x1402038ac]
mov r8d, eax
xor r8d, edx
xor r8d, 0xffffffff
mov ecx, edx
and ecx, r8d
shl ecx, 1
sub ecx, edx
sub eax, ecx
mov ecx, 0x45a558ab
xor ecx, 0x7747d4fb
or eax, ecx
and eax, eax
xor eax, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x9fc81425
mov edx, 0xffffffff
xor edx, 0x9fc81425
or ecx, edx
mov edx, 0xfc6e54b3
xor edx, 0x391ab4c
xor eax, edx
xor ecx, 0xffffffff
or eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x4306f081
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0x620bc878
xor r8d, 0x210d38f9
mov edx, eax
and edx, r8d
or eax, 0x4306f081
imul eax, edx
add eax, ecx
mov ecx, 0x943d07bc
xor ecx, 0x4186308c
cmp eax, ecx
je 0x140074967
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov r8d, dword [0x1402038b0]
mov eax, 0x826ec079
xor eax, 0x8ad7f961
xor r8d, eax
mov r9d, dword [0x1402038b4]
mov eax, r8d
and eax, r9d
xor r8d, r9d
or eax, r8d
xor r8d, r8d
sub r8d, 0x3725294d
add eax, r8d
sub eax, 0x7c6a8a64
add eax, 0xb8ab4ac8
mov dword [rsp + 0x28], eax
call fcn.140071277
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x28]
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0xaf9896ef
je 0x1400747d7
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x140074857
jmp 0x140074961
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
add rdx, 0x10
call fcn.140071277
mov rax, qword [rsp + 0x40]
mov al, byte [rax]
mov cl, 0x32
xor cl, 0x32
cmp al, cl
jne 0x140074961
mov eax, dword [0x1402038b8]
mov ecx, dword [0x1402038bc]
mov edx, 0x7069f09
xor edx, 0xeb787561
xor ecx, edx
and eax, ecx
add eax, 0x9527b250
sub eax, 0xaf4052bf
sub eax, 0x9527b250
and eax, eax
xor eax, 0xffffffff
mov ecx, 0x3a5d951d
and ecx, 0x3a5d951d
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x82d42f1a
xor ecx, 0x7d2bd0e5
xor eax, ecx
imul eax, eax, 0xffb58865
cmp eax, 0xa3a66325
ja 0x140074970
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov eax, dword [0x1402038c0]
and eax, dword [0x1402038c4]
mov r8d, 0x6cfd7946
xor r8d, 0x3de26024
imul eax, r8d
xor eax, 0x1d75a0f1
or eax, 0x17d4167
mov dword [rsp + 0x20], eax
add rdx, 0x20
call fcn.14007142b
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x20]
mov cl, byte [rcx]
mov dl, 0x2b
xor dl, 0x2b
cmp cl, dl
sete cl
mov byte [rsp + 0x27], cl
cmp eax, 0x660b4b9e
jb 0x1400748db
mov al, byte [rsp + 0x27]
test al, 1
jne 0x14007494e
jmp 0x140074961
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
push rsp
and al, 0x30
add rdx, 0x28
call fcn.140071277
nop
add rsp, 0x48
ret
pop rbp
jg 0x140074955
invalid
jle 0x140074932
invalid