joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a9b50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
add rax, 0x60
mov qword [rsp + 0x38], rax
mov edx, 5
call fcn.14009d240
mov rax, qword [rsp + 0x40]
mov al, byte [rax + 0x60]
mov cl, 0xa8
xor cl, 0xa8
cmp al, cl
jne 0x1400a9c84
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax]
call fcn.1400a96c9
mov rax, qword [rsp + 0x38]
cmp byte [rax], 0
jne 0x1400a9c84
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 8]
mov dword [rsp + 0x24], eax
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, qword [rsp + 0x30]
mov edx, dword [rsp + 0x24]
call fcn.14009d420
mov rax, qword [rsp + 0x38]
cmp byte [rax], 0
jne 0x1400a9c84
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x20], eax
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, qword [rsp + 0x30]
mov edx, dword [rsp + 0x20]
call fcn.14009d420
mov rax, qword [rsp + 0x38]
cmp byte [rax], 0
jne 0x1400a9c84
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x58], rdx
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x58]
call fcn.14009e925
mov rax, qword [rsp + 0x38]
cmp byte [rax], 0
jne 0x1400a9c84
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x20]
mov qword [rsp + 0x48], rdx
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
call fcn.14009e925
mov eax, dword [0x140276f68]
sub eax, dword [0x140276f6c]
mov ecx, 0x1a528fd2
xor ecx, 0x550049be
xor edx, edx
div ecx
mov ecx, 0xaec254d7
xor edx, edx
div ecx
xor eax, 0x45003572
cmp eax, 0xf5b7e82d
ja 0x1400a9ceb
mov eax, dword [0x140276f70]
add eax, dword [0x140276f74]
sub eax, 0xb280c9c5
mov ecx, 0x57f3bba
xor ecx, 0x94c685e0
xor eax, ecx
sub eax, 0xba4a4d21
cmp eax, 0x374de54
je 0x1400a9cb8
add rsp, 0x68
ret
in al, dx
out dx, eax
mov ecx, ebp
invalid
Function at 0x1400ad460
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rdx, qword [rsp + 0x30]
cmp rdx, 0
jne 0x1400ad4ad
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, qword [rsp + 0x28]
mov edx, 0xc0
call fcn.1400592d9
jmp 0x1400ad5ad
mov ecx, dword [0x140277128]
mov eax, dword [0x14027712c]
add ecx, 0x8ff46ced
sub ecx, eax
sub ecx, 0x8ff46ced
sub ecx, 0x6fc33bf8
xor ecx, 0x1d00b6cc
mov eax, ecx
xor eax, 0xffffffff
mov r8d, 0x367540b4
xor r8d, 0xc98abf4b
mov edx, ecx
xor edx, r8d
or eax, edx
mov edx, 0x40a082c0
xor edx, 0x8c5ddc15
and eax, edx
xor eax, 0xffffffff
mov edx, 0xcedc7afc
xor edx, 0x2212429
mov r8d, 0x3b3d8191
xor r8d, 0xf7c0df44
and edx, r8d
xor edx, 0xffffffff
and ecx, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
cmp eax, 0xa295aba0
jae 0x1400ad5b2
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x140277130]
mov r8d, dword [0x140277134]
mov r9d, 0xa429d1c6
xor r9d, 0x93e8f05c
xor r8d, r9d
xor eax, r8d
and eax, 0x9cfc52d5
mov r8d, 0x89188a28
xor r8d, 0x26317aa3
or eax, r8d
mov r8d, 0xc54e29c7
xor r8d, 0x1607462a
xor eax, r8d
mov dword [rsp + 0x24], eax
mov eax, 0xb12d3c4b
xor eax, 0x3b2fd42c
mov dword [rsp + 0x20], eax
call fcn.1400ad240
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
je 0x1400ad532
jmp 0x1400ad5ad
add rsp, 0x38
ret
mov ebx, 0xe9cae789
ja 0x1400ad5b8
invalid
invalid
Function at 0x1400ae330
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
add rax, 0x60
mov qword [rsp + 0x48], rax
movabs rax, 0xf489f64022cadcad
movabs rdx, 0xf489f64022cadcad
xor rax, rdx
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov ecx, 8
call fcn.14009ced4
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov al, 1
cmp byte [rcx + 0x60], 0
mov byte [rsp + 0x67], al
jne 0x1400ae412
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x30]
call fcn.1400ae080
mov rax, qword [rsp + 0x48]
mov cl, byte [rax]
mov dl, 0x85
xor dl, 0x85
mov al, 1
cmp cl, dl
mov byte [rsp + 0x67], al
jne 0x1400ae412
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax + 0x58]
mov qword [rsp + 0x68], rdx
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x68]
call fcn.1400344e0
mov rax, qword [rsp + 0x48]
mov al, byte [rax]
mov byte [rsp + 0x67], al
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov dl, byte [rsp + 0x67]
mov byte [rsp + 0x2f], dl
mov dl, 0x40
xor dl, 0x40
mov byte [rax], dl
call fcn.14009c9a0
mov rax, qword [rsp + 0x48]
mov al, byte [rax]
mov cl, 0x7e
xor cl, 0x7e
cmp al, cl
jne 0x1400ae44f
mov rax, qword [rsp + 0x48]
mov cl, byte [rsp + 0x2f]
mov byte [rax], cl
mov ecx, dword [0x1402771b8]
mov edx, dword [0x1402771bc]
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
xor ecx, ecx
sub ecx, 0x73325757
sub eax, ecx
sub eax, 0x27953b1b
and eax, 0xa5ed41e0
mov ecx, 0xe9443e3
xor ecx, 0x2113a9cf
cmp eax, ecx
je 0x1400ae4e7
mov ecx, dword [0x1402771c0]
sub ecx, dword [0x1402771c4]
mov eax, 0xd4854fed
xor eax, 0xd4854fed
mov edx, 0x6ece5f7
xor edx, 0x40b1c5d6
sub eax, edx
sub ecx, eax
mov eax, ecx
xor eax, 0x6fc57de1
xor eax, 0xffffffff
or ecx, 0x6fc57de1
and ecx, eax
mov edx, 0xffffffff
xor edx, 0xe334ef4
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0xe9c0ad58
jae 0x1400ae48a
mov rax, qword [rsp + 0x38]
add rsp, 0x78
ret
xor ebp, esp
xor byte [rcx + rbp*8], dl
invalid
Function at 0x1400b1060
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov eax, dword [0x140277348]
mov edx, dword [0x14027734c]
mov r8d, eax
xor r8d, edx
mov ecx, 0x8483ae1
xor ecx, 0xf7b7c51e
xor r8d, ecx
mov ecx, edx
and ecx, r8d
shl ecx, 1
sub ecx, edx
sub eax, ecx
imul ecx, eax, 0x421af773
mov edx, 0x9439b566
xor edx, 0x6bc64a99
mov eax, ecx
xor eax, edx
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x83469d31
mov edx, 0xffffffff
xor edx, 0x83469d31
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0xd077ac2
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xd077ac2
mov r8d, 0xd1574268
xor r8d, 0xdc5038aa
or eax, r8d
imul eax, edx
add eax, ecx
cmp eax, 0xec9b258c
jae 0x1400b12d7
mov eax, dword [0x140277350]
mov edx, dword [0x140277354]
mov ecx, 0x7c08a5de
xor ecx, 0xf70099a5
xor edx, ecx
xor ecx, ecx
sub ecx, edx
sub eax, ecx
or eax, 0x96965fee
add eax, 0x6b915d23
mov ecx, 0x8ad56aa9
xor edx, edx
div ecx
mov ecx, eax
mov rax, qword [rsp + 0x48]
mov dword [rsp + 0x40], ecx
movabs rcx, 0x7c3a913eb76c2767
movabs rdx, 0x7c3a913eb76c2747
xor rcx, rdx
shr rax, cl
mov dword [rsp + 0x2c], eax
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
add rax, 0x60
mov qword [rsp + 0x30], rax
movabs rdx, 0x90b51684c84226ce
movabs rax, 0x90b51684c84226cc
xor rdx, rax
call fcn.14009d240
mov rcx, qword [rsp + 0x38]
mov eax, dword [rsp + 0x40]
mov cl, byte [rcx + 0x60]
mov dl, 0xeb
xor dl, 0xeb
cmp cl, dl
sete cl
mov byte [rsp + 0x47], cl
cmp eax, 0xfa9f0ace
jae 0x1400b1116
mov al, byte [rsp + 0x47]
test al, 1
jne 0x1400b11e4
jmp 0x1400b12d1
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
movabs r8, 0xfc550ebafdbda038
movabs rax, 0x3aaf14502425fc7
xor r8, rax
mov rax, rdx
xor rax, r8
xor rdx, 0xffffffffffffffff
and rax, rdx
movabs rdx, 0x7d420f408eacb455
movabs r8, 0x7d420f408eacb454
xor rdx, r8
movabs r8, 0xce4de985f1488a15
movabs r9, 0x31b2167a0eb775ea
xor r8, r9
xor rdx, r8
movabs r8, 0x80481c866e8ca31e
movabs r9, 0x80481c866e8ca31f
xor r8, r9
movabs r9, 0x6d3cc9d5bbab2d06
movabs r10, 0x92c3362a4454d2f9
xor r9, r10
xor r8, r9
and rdx, r8
xor rax, 0xffffffffffffffff
movabs r8, 0x3efe55815263f372
movabs r9, 0xc101aa7ead9c0c8d
xor r8, r9
xor rdx, r8
and rax, rdx
cmp rax, 0
setne dl
and dl, 1
call fcn.1400b0a68
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
jne 0x1400b12d1
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, qword [rsp + 0x50]
mov edx, dword [rsp + 0x2c]
call fcn.14009d420
nop
add rsp, 0x58
ret
and byte [rcx + 0x70], dl
xchg edi, eax
jmp 0x1400b1116
Function at 0x1400b32a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x140277468]
xor eax, 0xe612c9f1
mov ecx, dword [0x14027746c]
mov edx, 0xb77e626a
xor edx, 0xaac10bc4
xor ecx, edx
add eax, ecx
mov ecx, 0xf9492c80
xor edx, edx
div ecx
mov ecx, eax
mov edx, 0xfe73ae5c
xor edx, 0xcc76d1cf
mov eax, 0xc5e7533d
xor eax, 0x3a18acc2
xor edx, eax
mov eax, ecx
xor eax, edx
and eax, ecx
and eax, 0xace56b56
mov ecx, 0x93b06aa3
xor ecx, 0x5a0d5204
cmp eax, ecx
ja 0x1400b3490
mov eax, dword [0x140277470]
mov ecx, dword [0x140277474]
mov edx, 0x18af5324
xor edx, 0x8eed0ee4
xor ecx, edx
xor eax, ecx
mov ecx, 0x32845e67
xor ecx, 0x6d262c93
xor edx, edx
div ecx
mov ecx, 0x4abbdff8
xor ecx, 0x7359c978
add eax, ecx
mov ecx, 0x9e68e430
xor ecx, 0x88b7c55e
and eax, ecx
mov dword [rsp + 0x30], eax
mov eax, 0xd1d54994
xor eax, 0x6540b0a3
mov dword [rsp + 0x2c], eax
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x30]
cmp rdx, 0
sete dl
mov byte [rsp + 0x37], dl
cmp eax, ecx
je 0x1400b330e
mov al, byte [rsp + 0x37]
test al, 1
jne 0x1400b33a3
jmp 0x1400b33c5
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, qword [rsp + 0x40]
mov dl, 0x77
xor dl, 0xb7
call fcn.1400592d9
jmp 0x1400b33d6
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov edx, dword [rax]
call fcn.1400b2fa0
mov eax, dword [0x140277478]
mov r8d, dword [0x14027747c]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xb229c478
xor ecx, 0x1df1d604
and eax, ecx
or eax, 0xc2828254
sub eax, 0x868604f3
sub eax, 0x3a5956ba
add eax, 0x868604f3
cmp eax, 0xf947624c
je 0x1400b3499
mov eax, dword [0x140277480]
mov ecx, 0xa56505c6
xor ecx, 0x80a1a0e0
xor eax, ecx
mov edx, dword [0x140277484]
mov ecx, eax
and ecx, edx
shl dword [rcx], 0xd1
mov r8d, 0x7b2cd6fe
xor r8d, 0x7b2cd6fc
imul ecx, r8d
xor eax, edx
add eax, ecx
imul eax, eax, 0xc3e72dfe
and eax, 0xed1b089c
imul eax, eax, 0x3a515d97
mov ecx, 0x534363e4
xor ecx, 0x348be1d2
cmp eax, ecx
ja 0x1400b3435
add rsp, 0x48
ret
mov bl, 0x9f
loop 0x1400b344f
jmp 0x1400b330e
mov dword [rax + rsi*4 - 0x6b], edx
jmp 0x1400b3435
Function at 0x1400ba3e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1402777f8]
mov edx, dword [0x1402777fc]
mov ecx, eax
xor ecx, 0xffffffff
and ecx, edx
mov r8d, 0x26929c0e
xor r8d, 0xd96d63f1
xor edx, r8d
and eax, edx
sub eax, ecx
mov ecx, 0x46e54a45
xor ecx, 0x46e54a45
mov edx, 0x8b6a58bf
xor edx, 0x64e7b3ce
sub ecx, edx
sub eax, ecx
mov ecx, 0xffffffff
xor ecx, 0xe5c74482
add eax, ecx
add eax, 1
xor eax, 0xb77f759a
cmp eax, 0x11a5dd4c
jbe 0x1400ba4ad
mov eax, dword [0x140277800]
mov ecx, dword [str.c_bpc]
xor edx, edx
div ecx
mov ecx, eax
mov edx, ecx
not edx
or edx, 0x7940625f
mov eax, ecx
mov ecx, edx
lea eax, [rax + rcx + 1]
xor eax, 0x2090022
or eax, 0xa4b6f3d9
mov dword [rsp + 0x2c], eax
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x2c]
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
cmp eax, 0xb6ac1a46
je 0x1400ba44a
add rsp, 0x38
ret
pushfq
cdq
mov bl, 0x97
jmp 0x1400ba44a
Function at 0x1400bb4a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, qword [rsp + 0x38]
add rax, 0x60
mov qword [rsp + 0x40], rax
cmp rcx, 0
je 0x1400bb612
mov rax, qword [rsp + 0x38]
mov rcx, rax
and rcx, 0xfffffffffffffff0
shl rcx, 1
movabs rdx, 0xf6082e1a4550fb72
movabs r8, 0x9f7d1e5baaf0482
xor rdx, r8
xor rax, rdx
add rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
cmp rax, 0x10
jb 0x1400bb5eb
mov r8, qword [rsp + 0x30]
movabs rcx, 0x930c9181c0611181
movabs rax, 0x6cf36e7e3f9eee71
xor rcx, rax
mov rax, r8
add rax, rcx
mov qword [rsp + 0x20], rax
mov rdx, rax
xor rdx, 0xffffffffffffffff
movabs rcx, 0x6031b0a070ac4b0f
movabs r9, 0xcb4899d3f7aa213c
xor rcx, r9
and rcx, rdx
movabs r10, 0xf01e65d9ec1387e9
movabs rdx, 0x5b674caa6b15edda
xor r10, rdx
movabs rdx, 0xbc2a2308449b9e5b
movabs r9, 0x43d5dcf7bb6461a4
xor rdx, r9
xor r10, rdx
mov r9, rax
and r9, r10
mov rdx, r8
xor rdx, 0xffffffffffffffff
movabs r11, 0xab79297387066a33
and rdx, r11
and r8, r10
or rcx, r9
or rdx, r8
xor rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x1400bb5cf
jmp 0x1400bb5d9
call fcn.14000f24b
jmp 0x1400bb612
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
jmp 0x1400bb612
mov rcx, qword [rsp + 0x38]
call fcn.1400bb2e0
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x1400bb612
mov rcx, qword [rsp + 0x38]
mov edx, 8
call fcn.14001d294
mov eax, dword [0x140277838]
sub eax, dword [0x14027783c]
xor ecx, ecx
sub ecx, eax
mov eax, 0x2b72f2e
xor eax, 0x2b72f2e
mov edx, 0x3c503548
xor edx, 0x608246de
sub eax, edx
add ecx, eax
mov eax, 0xd1bd07b4
xor eax, 0xd1bd07b4
sub eax, ecx
or eax, 0xaa610b81
mov ecx, 0x49106b44
xor edx, edx
div ecx
cmp eax, 0xce89f1e5
je 0x1400bb6ae
mov eax, dword [0x140277840]
mov edx, dword [0x140277844]
mov ecx, 0xadd28dd0
xor ecx, 0xae2d926f
xor edx, ecx
xor ecx, ecx
sub ecx, edx
sub eax, ecx
sub eax, 0xe5c74482
mov ecx, 0xf5601527
xor ecx, 0x421f60bd
xor eax, ecx
mov ecx, 0xcec88b91
xor ecx, 0xbc1a21a3
add eax, ecx
cmp eax, 0xf368e88e
jbe 0x1400bb660
add rsp, 0x48
ret
scasb al, byte [rdi]
clc
cmp byte [rcx + rbp*8 - 0x57], al
invalid
Function at 0x1400cf170
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov eax, dword [0x140278128]
Function at 0x1400ea3b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x10
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov eax, dword [0x140278b58]
xor eax, 0x47fcd202
or eax, dword [0x140278b5c]
mov ecx, eax
xor ecx, 0xa8d9abfb
xor ecx, 0xffffffff
or eax, 0xa8d9abfb
and eax, ecx
mov ecx, eax
xor ecx, 0x8e19625c
xor ecx, 0xffffffff
and ecx, 0x8e19625c
shl ecx, 1
sub ecx, 0x8e19625c
sub eax, ecx
xor eax, 0x6e4c6a1b
cmp eax, 0xcea8873c
ja 0x1400ea478
mov rcx, qword [rsp]
mov eax, dword [0x140278b60]
and eax, dword [0x140278b64]
mov edx, 0x3f91fb81
xor edx, 0xa1372be0
or eax, edx
mov r8d, 0x46fb38f
xor edx, edx
div r8d
mov rdx, qword [rsp + 8]
mov r8d, eax
and r8d, 0x32027716
shl r8d, 1
mov r9d, 0xa9af0ac8
xor r9d, 0x9bad7dde
xor eax, r9d
add eax, r8d
mov qword [0x14029c018], rdx
mov qword [0x14029c020], rcx
cmp eax, 0xcd85cf84
jae 0x1400ea40c
add rsp, 0x10
ret
mov dword [rcx - 0x46], edi
jmp 0x1400ea40c
Function at 0x1400ed290
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xe0
mov qword [rsp + 0xc0], r9
mov qword [rsp + 0xc8], r8
mov qword [rsp + 0xd0], rdx
mov qword [rsp + 0xd8], rcx
mov eax, dword [0x140278ca8]
mov ecx, dword [0x140278cac]
add eax, 0x4cbfa151
Function at 0x1400eed50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x140278d78]
xor eax, 0x97330dbd
mov ecx, dword [0x140278d7c]
xor ecx, 0xc666af26
and eax, ecx
mov ecx, 0xab4017d7
xor ecx, 0xd597362d
xor eax, ecx
xor eax, 0xede24ead
sub eax, 0x96f2e46f
mov ecx, 0xe28e9c55
xor ecx, 0xde753bf0
cmp eax, ecx
jae 0x1400eee32
mov eax, dword [0x140278d80]
mov ecx, dword [0x140278d84]
xor ecx, 0x2d10537e
xor edx, edx
div ecx
add eax, 0xa190c3cf
mov ecx, eax
and ecx, 0x19f93da1
mov edx, 0x8b28b455
xor edx, 0x74d74baa
xor ecx, edx
add eax, 0x19f93da1
add eax, 1
add eax, ecx
add eax, 0xd830364d
mov ecx, 0xea663408
xor ecx, 0x17170653
sub eax, ecx
sub eax, 0xd830364d
mov dword [rsp + 0x20], eax
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
call qword [0x14029c030]
mov ecx, eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], ecx
cmp eax, 0x621dddb4
jbe 0x1400eeda1
mov eax, dword [rsp + 0x24]
add rsp, 0x38
ret
cmp byte [rbx - 0x7e], bh
jmp 0x1400eeda1
Function at 0x1400f1b90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x50], rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x58], rcx
movabs rdx, 0xf01e65d9ec1387e9
movabs rax, 0xf01e65d9ec1387e9
xor rdx, rax
xor eax, eax
cmp rcx, rdx
mov byte [rsp + 0x67], al
jle 0x1400f1db4
mov rcx, qword [rsp + 0x50]
mov rax, qword [0x14029c078]
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x38], rcx
mov al, byte [rax]
mov byte [rsp + 0x46], al
mov cl, 1
xor eax, eax
mov byte [rsp + 0x47], cl
mov qword [rsp + 0x48], rax
mov al, byte [rsp + 0x47]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov byte [rsp + 0x37], al
mov ecx, dword [0x140278f20]
and ecx, dword [0x140278f24]
mov r8d, 0xffffffff
xor r8d, 0xe2c0ffc1
mov edx, ecx
and edx, r8d
mov eax, ecx
or eax, r8d
mov r8d, 0x331724be
xor r8d, 0xcce8db41
xor eax, r8d
imul eax, edx
mov edx, ecx
and edx, 0xe2c0ffc1
or ecx, 0xe2c0ffc1
imul ecx, edx
add ecx, eax
mov eax, ecx
and eax, 0xf76d8764
mov edx, 0xbb814ca0
xor edx, 0xbb814ca2
imul eax, edx
mov edx, 0xf948146b
xor edx, 0xe25930f
xor ecx, edx
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0x2b72f2e
xor edx, 0xfd48d0d1
xor ecx, edx
and eax, ecx
mov ecx, 0x2c59c263
or ecx, 0x2c59c263
mov edx, 0xd1bd07b4
xor edx, 0x2e42f84b
xor ecx, edx
or eax, ecx
xor eax, 0xffffffff
cmp eax, 0xf1f85cae
je 0x1400f1dc2
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x140278f28]
mov edx, dword [0x140278f2c]
mov r8d, 0xadd28dd0
xor r8d, 0xae2d926f
xor edx, r8d
sub eax, edx
mov edx, eax
and edx, 0x5cd27396
mov r8d, 0xdd5619b7
xor r8d, 0xdd5619b5
imul edx, r8d
mov r8d, 0xf5601527
xor r8d, 0xa9b266b1
xor eax, r8d
add eax, edx
or eax, 0xaa610b81
mov r8d, 0x49106b44
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x58]
cmp rcx, rdx
sete cl
mov byte [rsp + 0x27], cl
cmp eax, 0xce89f1e5
je 0x1400f1caa
mov al, byte [rsp + 0x27]
test al, 1
jne 0x1400f1d33
jmp 0x1400f1d51
mov rcx, qword [rsp + 0x58]
mov rdx, rcx
add rdx, 0xffffffffffffffff
call fcn.1400292ad
mov al, byte [rsp + 0x37]
mov byte [rsp + 0x67], al
jmp 0x1400f1db4
mov al, byte [rsp + 0x37]
mov cl, byte [rsp + 0x46]
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x28]
cmp cl, byte [rdx + r8 + 8]
mov byte [rsp + 0x67], al
je 0x1400f1db4
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
movabs rax, 0xbb77a80843285b9e
movabs r8, 0xbb77a80843285b9f
xor rax, r8
add rcx, rax
cmp rcx, rdx
setl al
cmp rcx, rdx
mov dl, al
mov byte [rsp + 0x47], dl
and al, 0x47
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x67], al
jne 0x1400f1bef
mov al, byte [rsp + 0x67]
and al, 1
movzx eax, al
add rsp, 0x68
ret
ja 0x1400f1da3
invalid
Function at 0x14010ca60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x34], ecx
sub ecx, 0xc0000034
je 0x14010ca8d
jmp 0x14010ca79
mov eax, dword [rsp + 0x34]
sub eax, 0xc000003a
jne 0x14010cc2e
jmp 0x14010ca8d
mov eax, dword [0x140279770]
xor edx, edx
div dword [0x140279774]
mov ecx, 0xffffffff
xor ecx, 0xc0cd9e56
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x52b07f77
mov r8d, 0xe234be9e
xor r8d, 0xb084c1e9
mov ecx, 0x9d9c3e88
xor ecx, 0x6263c177
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0x272160f9
xor r8d, 0x75911f8e
mov edx, eax
and edx, r8d
or eax, 0x52b07f77
imul eax, edx
add eax, ecx
add eax, 0x966fe8a7
add eax, 0xac24e783
sub eax, 0x966fe8a7
cmp eax, 0x2315b9bf
jb 0x14010ccf4
mov ecx, dword [0x140279778]
mov edx, dword [0x14027977c]
mov eax, ecx
xor eax, edx
mov r8d, 0xfaa0249
xor r8d, 0xf055fdb6
xor eax, r8d
or ecx, edx
and ecx, eax
xor ecx, 0x6d5fb923
mov edx, 0x28d29e78
xor edx, 0x3dd05051
mov eax, 0xacc4d50a
xor eax, 0x533b2af5
xor edx, eax
mov eax, ecx
xor eax, edx
and eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xe9f0e678
mov ecx, 0xffffffff
xor ecx, 0x991cccb
or eax, edx
or ecx, 0x991cccb
mov edx, 0xa2f060d8
xor edx, 0x5d0f9f27
xor eax, edx
and eax, ecx
mov dword [rsp + 0x30], eax
movabs rcx, 0x208ff437ad878229
movabs rax, 0x208ff437ad878261
xor rcx, rax
movabs rdx, 0xcdb35b5f3805dcdc
movabs rax, 0xcdb35b5f3805dcd4
xor rdx, rax
call fcn.140029060
mov rcx, rax
mov rax, qword [0x14028cff8]
mov qword [rcx], rax
lea rax, [0x14028a0ed]
mov qword [rcx + 0x10], rax
mov rax, qword [0x14028a308]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14028a310]
mov qword [rcx + 0x20], rax
mov qword [rcx + 8], 0
lea rdx, [0x14028a0ed]
lea r8, [0x14028a106]
lea r9, [0x14028a0c3]
mov qword [rsp + 0x20], 0xfffffffff383ba92
call fcn.140028fa8
mov eax, dword [rsp + 0x30]
cmp eax, 0x58629976
je 0x14010ccf4
jmp 0x14010cc2e
mov eax, dword [str._f_C]
sub eax, dword [0x140279784]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x29ee4ae6
and ecx, edx
mov edx, 0x5044055e
xor edx, 0x79aa4fb8
or eax, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
xor eax, 0xffffffff
and ecx, eax
mov eax, ecx
xor eax, 0x568be9b
xor eax, 0xffffffff
mov edx, 0x128cea78
xor edx, 0x17e454e3
or ecx, edx
and ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0xa0913ee4
mov edx, 0xffffffff
xor edx, 0xa0913ee4
and ecx, edx
or eax, ecx
cmp eax, 0x8a55d666
jb 0x14010ccfd
add byte [rbx + 0x16cae105], cl
add byte [rbx + 0x16cadf0d], cl
add byte [rdx + 0x37f604b3], bh
mov eax, dword [0x140279788]
mov ecx, dword [0x14027978c]
mov edx, 0x37f604b3
xor edx, 0xa9ef3b0e
xor ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, 0xc1871aa8
sub eax, ecx
mov ecx, 0x98184d32
xor ecx, 0xb8d2e033
sub eax, ecx
mov ecx, 0x5ce1c383
xor edx, edx
div ecx
mov ecx, 0x948981f6
xor ecx, 0x9dc830ba
cmp eax, ecx
jae 0x14010cca1
add rsp, 0x38
ret
ret
jl 0x14010cca0
sbb cl, r13b
wait
invalid