joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b3b80
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
mov ecx, dword [0x1401f8138]
add ecx, dword [0x1401f813c]
mov edx, 0xffffffff
xor edx, 0xf15b3417
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0xc7f0f8a8
xor ecx, 0x429078e
or eax, ecx
imul eax, eax, 0x52184897
cmp eax, 0xc9471351
jae 0x1400b3d7b
mov ecx, dword [0x1401f8140]
imul ecx, dword [0x1401f8144]
mov eax, ecx
and eax, 0xed160506
or ecx, 0xed160506
add eax, ecx
or eax, 0x90b76bf1
mov ecx, 0x665ad489
xor ecx, 0x26b1ee8c
sub eax, ecx
mov dword [rsp + 0x48], eax
mov eax, 0xd7432ecf
xor eax, 0xc117296c
mov dword [rsp + 0x44], eax
call fcn.1400b398d
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
call fcn.1400b39b0
mov ecx, dword [rsp + 0x44]
mov dl, al
mov eax, dword [rsp + 0x48]
mov byte [rsp + 0x4f], dl
cmp eax, ecx
jbe 0x1400b3d7b
mov al, byte [rsp + 0x4f]
test al, 1
jne 0x1400b3c3f
jmp 0x1400b3d75
mov ecx, dword [0x1401f8148]
mov edx, dword [0x1401f814c]
xor edx, 0x717cbc4b
mov eax, ecx
and eax, eax
mov r8d, 0x897a35e6
xor r8d, 0x7685ca19
xor eax, r8d
and eax, edx
xor eax, 0xffffffff
and edx, edx
mov r8d, 0x7f53e8f9
xor r8d, 0x80ac1706
xor edx, r8d
and ecx, edx
xor ecx, 0xffffffff
mov edx, 0xda722c46
xor edx, 0x258dd3b9
xor eax, edx
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0xb0c0da59
xor ecx, 0xbdf21c2f
xor edx, edx
div ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xeee45f7f
mov r8d, 0xffffffff
xor r8d, 0xeee45f7f
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xeee45f7f
or eax, 0xeee45f7f
imul eax, edx
add eax, ecx
and eax, 0x8d55334a
mov ecx, 0x12702c08
xor ecx, 0x9e59ede1
cmp eax, ecx
jae 0x1400b3d84
mov rcx, qword [rsp + 0x50]
mov eax, dword [0x1401f8150]
add eax, dword [0x1401f8154]
or eax, 0xec3ea98e
mov r8d, 0x7aef1dbf
xor edx, edx
div r8d
mov edx, eax
and edx, 0x203bfd2e
shl edx, 1
add eax, 0x203bfd2e
sub eax, edx
mov dword [rsp + 0x30], eax
mov eax, 0xa26f4600
xor eax, 0x226433d2
mov dword [rsp + 0x2c], eax
call fcn.1400b3680
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x30]
cmp byte [rdx], 0
sete dl
mov byte [rsp + 0x37], dl
cmp eax, ecx
je 0x1400b3cec
mov al, byte [rsp + 0x37]
test al, 1
jne 0x1400b3d66
jmp 0x1400b3d75
mov rcx, qword [rsp + 0x50]
mov edx, 8
call fcn.14000fac0
nop
add rsp, 0x58
ret
inc dword [rdi + 0x40e947c9]
invalid
invalid
Function at 0x1400b9150
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rcx
mov eax, dword [0x1401f8300]
xor eax, 0xc530a935
mov ecx, dword [0x1401f8304]
xor ecx, 0xacc21729
xor edx, edx
div ecx
xor ecx, ecx
sub ecx, 0xd3a219b8
sub eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xc18044f6
mov r8d, 0xd11e4582
xor r8d, 0x109e0174
mov ecx, 0x4e580b8d
xor ecx, 0xb1a7f472
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xc18044f6
or eax, 0xc18044f6
imul eax, edx
add eax, ecx
mov ecx, 0xde223f6e
xor ecx, 0x504f6703
add eax, ecx
cmp eax, 0x69679d98
je 0x1400b93d4
mov eax, dword [0x1401f8308]
mov edx, dword [0x1401f830c]
xor edx, 0x3f89ac97
xor eax, 0xffffffff
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x5948b696
or eax, edx
or ecx, 0x5948b696
mov edx, 0x94527311
xor edx, 0x6bad8cee
xor eax, edx
and eax, ecx
imul ecx, eax, 0xb7251a
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x5d491447
or eax, edx
and ecx, 0x5d491447
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov r8d, 0xffffffff
xor r8d, 0xb2f80414
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xb2f80414
or eax, 0xb2f80414
imul eax, edx
add eax, ecx
mov dword [rsp + 0x24], eax
call fcn.1400c9303
mov rdx, qword [rsp + 0x40]
mov rcx, rax
mov eax, dword [rsp + 0x24]
mov r9, qword [rdx]
mov qword [rsp + 0x28], r9
mov rdx, qword [rdx + 8]
add rdx, 8
lea r8, [0x1402079e0]
cmp r9, 0
cmove rdx, r8
mov qword [rsp + 0x30], rdx
mov cl, byte [rcx + 0x50]
mov dl, 0xcc
xor dl, 0xcc
cmp cl, dl
sete cl
mov byte [rsp + 0x3f], cl
cmp eax, 0x42b4a07e
jbe 0x1400b93d4
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x1400b92d8
jmp 0x1400b9338
mov rax, qword [rsp + 0x28]
cmp rax, 0
jge 0x1400b9324
mov rcx, qword [rsp + 0x28]
movabs rdx, 0x2d945a23e6f5be43
movabs rax, 0x2d945a23e6f5be43
xor rdx, rax
movabs r8, 0xa3d927cd05f23503
movabs rax, 0xdc26d832fa0dcafc
xor r8, rax
call fcn.14000e57e
jmp 0x1400b9338
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
call fcn.14009d070
mov eax, dword [0x1401f8310]
sub eax, dword [0x1401f8314]
xor ecx, ecx
sub ecx, eax
mov eax, 0x93f658d4
xor eax, 0x93f658d4
mov edx, 0x988cd884
xor edx, 0x39594f8f
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
sub eax, 0xc0ec91a3
mov ecx, 0x230242d1
xor ecx, 0xf141e7f1
and eax, ecx
cmp eax, 0x5975407f
je 0x1400b93dd
mov eax, dword [0x1401f8318]
mov edx, dword [0x1401f831c]
mov ecx, eax
xor ecx, edx
mov r8d, 0xc243c226
xor r8d, 0x3dbc3dd9
xor ecx, r8d
or eax, edx
and eax, ecx
add eax, 0x6bfd457b
mov ecx, 0x808feccc
xor ecx, 0xbdda54c7
xor edx, edx
div ecx
and eax, 0x1d936db9
cmp eax, 0x71fc94bc
je 0x1400b9382
mov rax, qword [rsp + 0x50]
add rsp, 0x58
ret
cdq
cmpsd dword [rsi], dword [rdi]
int1
movabs al, byte [0xb48f5cfffffe03e9]
mov ch, 0xe9
pushfq
invalid
pop rsp
invalid
Function at 0x1400b9ac0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
sub rsp, 0x238
lea rbp, [rsp + 0x80]
mov byte [rbp + 0x67], dl
mov qword [rbp + 0x68], rcx
mov eax, 0x10
mov qword [rbp + 0x98], rax
call fcn.1401f2390
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0xb0], rax
mov eax, 0x30
call fcn.1401f2390
sub rsp, rax
mov rax, qword [rbp + 0x98]
mov rcx, rsp
Function at 0x1400c9800
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
call fcn.1400cd4ec
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
call fcn.1400c9950
test al, 1
jne 0x1400c982a
jmp 0x1400c993e
mov eax, dword [str._fl]
sub eax, dword [0x1401f893c]
mov ecx, 0x89192681
xor ecx, 0xf6d1ad8c
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xa6432672
mov r8d, 0xffffffff
xor r8d, 0xa6432672
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0x4e6deba4
xor r8d, 0xe82ecdd6
mov edx, eax
and edx, r8d
or eax, 0xa6432672
imul eax, edx
add eax, ecx
sub eax, 0xedf854e8
add eax, 0xc9a5001f
add eax, 0xedf854e8
cmp eax, 0x8b15e6e4
jbe 0x1400c9944
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x1401f8940]
mov edx, 0x786c24cc
xor edx, 0x9a2148c7
xor eax, edx
mov r8d, dword [0x1401f8944]
xor r8d, 0x439a817b
xor edx, edx
div r8d
mov edx, 0xe0683700
xor edx, 0x4277cffa
add eax, edx
mov r8d, 0x299170f7
xor edx, edx
div r8d
mov r8d, 0xb1c5ac38
xor edx, edx
div r8d
mov dword [rsp + 0x30], eax
mov eax, 0x8906ce57
xor eax, 0x1729c24e
mov dword [rsp + 0x2c], eax
call fcn.1400c94c0
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x30]
cmp byte [rdx + 0x50], 0
sete dl
mov byte [rsp + 0x37], dl
cmp eax, ecx
je 0x1400c9899
mov al, byte [rsp + 0x37]
test al, 1
jne 0x1400c992f
jmp 0x1400c993e
mov rcx, qword [rsp + 0x38]
mov edx, 8
call fcn.14000fac0
nop
add rsp, 0x48
ret
sub dword [rdx], eax
retf 0xe98e
Function at 0x1400d0060
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x50
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x40], rcx
xor eax, eax
cmp rcx, qword [rdx]
mov byte [rsp + 0x4f], al
jne 0x1400d029e
mov rcx, qword [rsp + 0x40]
mov al, 1
cmp rcx, 0
mov byte [rsp + 0x4f], al
je 0x1400d029e
mov ecx, dword [0x1401f8bb8]
xor ecx, 0xfb499b8d
mov edx, dword [0x1401f8bbc]
mov eax, 0x656dbcd1
xor eax, 0x415ee06c
xor edx, eax
mov eax, ecx
or eax, edx
xor eax, 0xffffffff
or ecx, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
mov edx, 0xbed108fb
xor edx, 0x412ef704
xor ecx, edx
and eax, ecx
mov r11d, eax
xor r11d, 0xffffffff
xor eax, 0xffffffff
or r11d, eax
mov eax, 0x1f0da3c6
and eax, 0x1f0da3c6
xor eax, 0xffffffff
and r11d, eax
xor r11d, 0xffffffff
mov ecx, r11d
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x3974eb20
mov r8d, 0xffffffff
xor r8d, 0x7bceda0a
mov eax, ecx
and eax, 0x7bceda0a
and r11d, r8d
mov r9d, edx
and r9d, 0x7bceda0a
mov r10d, r8d
and r10d, 0x3974eb20
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, edx
xor ecx, 0xffffffff
mov edx, 0x3f79bb9f
xor edx, 0x44b76195
or edx, r8d
and ecx, edx
or eax, ecx
or eax, eax
xor eax, 0xffffffff
mov ecx, 0x4ae46e81
or ecx, 0x4ae46e81
mov edx, 0x2bc76963
xor edx, 0xd438969c
xor ecx, edx
or eax, ecx
xor eax, 0xffffffff
cmp eax, 0x13dd78a2
ja 0x1400d02ac
mov rcx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov edx, dword [0x1401f8bc0]
mov r9d, dword [0x1401f8bc4]
mov eax, 0x648d2787
xor eax, 0x33e191bc
xor r9d, eax
mov eax, edx
and eax, r9d
xor edx, r9d
or eax, edx
mov r9d, 0x8d6f0c6e
xor edx, edx
div r9d
mov r9d, 0x1cc2fc7
xor edx, edx
div r9d
mov rdx, qword [rsp + 0x40]
mov r9d, eax
and r9d, 0xfd079bfe
shl r9d, 1
xor eax, 0xfd079bfe
add eax, r9d
mov r8, qword [r8 + 8]
add r8, 8
mov qword [rsp + 0x18], r8
mov rcx, qword [rcx + 8]
add rcx, 8
mov qword [rsp + 0x20], rcx
xor ecx, ecx
test rdx, rdx
cmovg rcx, rdx
mov qword [rsp + 0x28], rcx
cmp eax, 0xae6a5384
jbe 0x1400d0180
xor eax, eax
mov qword [rsp + 0x10], rax
jmp 0x1400d021e
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], rcx
xor eax, eax
cmp rcx, rdx
mov dword [rsp + 0xc], eax
je 0x1400d0290
mov rcx, qword [rsp]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x18]
movzx eax, byte [rax + rcx]
movzx edx, byte [rdx + rcx]
sub eax, edx
movabs rdx, 0xbc825ac4489cf60b
add rcx, rdx
add rcx, 1
movabs rdx, 0xcce42a1570cdaa23
movabs r8, 0x706670d138515c28
xor rdx, r8
sub rcx, rdx
cmp eax, 0
mov qword [rsp + 0x10], rcx
mov dword [rsp + 0xc], eax
je 0x1400d021e
mov eax, dword [rsp + 0xc]
cmp eax, 0
sete al
mov byte [rsp + 0x4f], al
mov al, byte [rsp + 0x4f]
and al, 1
movzx eax, al
add rsp, 0x50
ret
sub cl, dh
jmp 0x1400d0180
Function at 0x1400d0920
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rcx
call fcn.1400d08f7
mov rdx, qword [rsp + 0x40]
xor eax, eax
test rdx, rdx
cmovg rax, rdx
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov eax, dword [0x1401f8c20]
sub eax, dword [0x1401f8c24]
add eax, 0x7fc88b0d
mov edx, eax
xor edx, 0xffffffff
and edx, 0xa6432672
mov r8d, 0x48b40003
xor r8d, 0xeef72671
mov ecx, 0x6dbf44e8
xor ecx, 0x9240bb17
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xa6432672
or eax, 0xa6432672
imul eax, edx
add eax, ecx
sub eax, 0xedf854e8
add eax, 0xc9a5001f
add eax, 0xedf854e8
cmp eax, 0x8b15e6e4
jbe 0x1400d0a87
mov r8, qword [rsp + 0x48]
mov eax, dword [0x1401f8c28]
xor edx, edx
div dword [0x1401f8c2c]
add eax, 0xa21ff8fa
mov ecx, 0xc21cf8e6
xor ecx, 0xeb8d8811
xor edx, edx
div ecx
mov ecx, 0x6b39ff2c
xor ecx, 0xdafc5314
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x30]
mov ecx, 0xb30db8b9
xor ecx, 0x2d22b4a0
cmp rdx, r8
sete dl
mov byte [rsp + 0x2f], dl
cmp eax, ecx
je 0x1400d09c2
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1400d0a82
jmp 0x1400d0a2b
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov byte [rcx + rax], 0
mov rcx, rax
and rcx, 1
movabs rdx, 0xb42cf909716cb441
movabs r8, 0xb42cf909716cb443
xor rdx, r8
imul rcx, rdx
movabs rdx, 0xf119db82aba3a511
movabs r8, 0xf119db82aba3a510
xor rdx, r8
xor rax, rdx
add rax, rcx
mov qword [rsp + 0x50], rax
jmp 0x1400d094d
add rsp, 0x58
ret
sub dword [rdx], eax
retf 0xe98e
Function at 0x1400d2410
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x58], rcx
call fcn.1400d08f7
mov rcx, qword [rsp + 0x58]
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x67], al
je 0x1400d2620
mov rax, qword [rsp + 0x58]
xor ecx, ecx
sub rcx, rax
movabs rax, 0xba5cf4bb1eef3489
movabs rdx, 0xba5cf4bb1eef3489
xor rax, rdx
movabs rdx, 0xcac11b649006b2be
movabs r8, 0x353ee49b6ff94d4e
xor rdx, r8
sub rax, rdx
add rcx, rax
xor eax, eax
sub rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
movabs rcx, 0xbf4f84672bfb0782
movabs rdx, 0xbf4f84672bfb0792
xor rcx, rdx
cmp rax, rcx
setb cl
mov byte [rsp + 0x56], cl
mov al, 1
test cl, 1
mov byte [rsp + 0x57], al
jne 0x1400d2524
mov rdx, qword [rsp + 0x48]
movabs rcx, 0x30ddfbf3b6515012
mov rax, rdx
sub rax, rcx
add rax, 0xfffffffffffffff0
movabs rcx, 0x30ddfbf3b6515012
add rax, rcx
mov qword [rsp + 0x38], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x1400d2501
jmp 0x1400d2511
call fcn.140009cc0
xor eax, eax
mov byte [rsp + 0x67], al
jmp 0x1400d2620
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x57], al
mov al, byte [rsp + 0x57]
mov byte [rsp + 0x37], al
mov eax, dword [0x1401f8ce0]
add eax, dword [0x1401f8ce4]
mov ecx, 0xebda70ec
xor ecx, 0x8a194bc7
xor eax, ecx
mov ecx, 0x50bb981f
xor edx, edx
div ecx
xor eax, 0xf11cf3ac
cmp eax, 0xd071f887
jb 0x1400d26d6
mov cl, byte [rsp + 0x56]
mov eax, dword [0x1401f8ce8]
xor eax, 0x4a039af7
xor edx, edx
div dword [0x1401f8cec]
mov rdx, qword [rsp + 0x40]
mov r8d, eax
mov rax, qword [rsp + 0x58]
or r8d, 0x6950d99d
sub r8d, 0xc7684261
mov r9d, 0xacb8b7b
xor r9d, 0x1da11779
add r8d, r9d
mov r9d, 0xa130490a
xor r9d, 0x66580b6b
add r8d, r9d
mov r9d, r8d
and r9d, 0x33188b06
mov r10d, 0xecce089e
xor r10d, 0x1331f761
xor r9d, r10d
mov r10d, 0x9e1c2800
xor r10d, 0xad04a306
add r8d, r10d
add r8d, 1
add r8d, r9d
mov dword [rsp + 0x30], r8d
mov r8d, 0xafa4301d
xor r8d, 0x6035ef8a
mov dword [rsp + 0x2c], r8d
mov r8, qword [rax]
and cl, 1
call fcn.140010b90
mov ecx, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x30]
cmp eax, ecx
jae 0x1400d255e
mov al, byte [rsp + 0x37]
mov byte [rsp + 0x67], al
jmp 0x1400d2620
mov al, byte [rsp + 0x67]
mov byte [rsp + 0x2b], al
mov eax, dword [0x1401f8cf0]
xor eax, 0x75fe3dd2
add eax, dword [0x1401f8cf4]
or eax, 0x76224c9c
imul eax, eax, 0x6d5c9ee3
mov ecx, 0xff3ce342
xor edx, edx
div ecx
mov ecx, 0xfa170ff
xor ecx, 0xd2a43192
cmp eax, ecx
ja 0x1400d26df
mov cl, byte [rsp + 0x2b]
mov eax, dword [0x1401f8cf8]
imul eax, dword [0x1401f8cfc]
sub eax, 0x16af8c1e
mov r9d, 0xffffffff
xor r9d, 0x4bc7f93f
mov r8d, eax
and r8d, r9d
mov edx, eax
or edx, r9d
xor edx, 0xffffffff
imul edx, r8d
mov r8d, eax
and r8d, 0x4bc7f93f
or eax, 0x4bc7f93f
imul eax, r8d
add eax, edx
add eax, 0x4bd3a121
mov dl, 0x6c
xor dl, 0x6c
cmp cl, dl
setne cl
mov byte [rsp + 0x2a], cl
cmp eax, 0xb0f94b0e
je 0x1400d26df
mov al, byte [rsp + 0x2a]
and al, 1
movzx eax, al
add rsp, 0x68
ret
jo 0x1400d2723
jp 0x1400d271e
jmp 0x1400d255e
mov eax, 0xe9dd970f
js 0x1400d26e5
invalid
invalid
ret 0xf283
Function at 0x1400d4030
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x47], al
je 0x1400d4236
mov rax, qword [rsp + 0x38]
movabs rcx, 0xe4207013fc78e8eb
sub rax, rcx
add rax, 0xfffffffffffffff0
movabs rcx, 0xe4207013fc78e8eb
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
mov al, 1
cmp rcx, 0x10
mov byte [rsp + 0x47], al
jb 0x1400d4236
mov r8, qword [rsp + 0x30]
xor eax, eax
mov ecx, eax
sub rcx, r8
xor eax, eax
sub rax, 0xfffffffffffffff0
add rcx, rax
movabs rax, 0x8886e8867703e652
movabs rdx, 0x8886e8867703e652
xor rax, rdx
sub rax, rcx
mov qword [rsp + 0x20], rax
mov rdx, rax
xor rdx, 0xffffffffffffffff
movabs rcx, 0xb09f5e86aa2dfff0
movabs r9, 0x364427d447d5ab18
xor rcx, r9
and rcx, rdx
mov r10, 0xffffffffffffffff
movabs rdx, 0x86db7952edf854e8
xor r10, rdx
mov r9, rax
and r9, r10
movabs r11, 0xb73f8637914c56f7
movabs rdx, 0x48c079c86eb3a908
xor r11, rdx
mov rdx, r8
xor rdx, r11
movabs r11, 0x86db7952edf854e8
and rdx, r11
and r8, r10
or rcx, r9
or rdx, r8
xor rcx, rdx
movabs rdx, 0x23338e25edc56d27
movabs r8, 0x23338e25edc56d27
xor rdx, r8
cmp rcx, rdx
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x1400d4161
jmp 0x1400d4171
call fcn.140009cc0
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x1400d4236
mov ecx, dword [0x1401f8d90]
xor ecx, 0x8994212d
mov eax, dword [0x1401f8d94]
mov edx, 0x8c6c03e1
xor edx, 0x7b3b8ddd
xor eax, edx
sub ecx, eax
or ecx, 0x45ad24f3
mov edx, ecx
xor edx, 0xffffffff
mov eax, 0x47bcdac0
xor eax, 0x58744fce
and eax, edx
mov edx, 0xffffffff
xor edx, 0x1fc8950e
and ecx, edx
or eax, ecx
imul eax, eax, 0xd8ab2d75
cmp eax, 0xfc4c2b3a
je 0x1400d4244
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov eax, dword [0x1401f8d98]
xor eax, 0xd67cd218
mov r8d, dword [0x1401f8d9c]
xor r8d, 0x1c3181f8
sub eax, 0x2d402494
sub eax, r8d
add eax, 0x2d402494
mov r8d, 0x9bd161f8
xor r8d, 0x6c999002
xor eax, r8d
add eax, 0x9dcfe29e
sub eax, 0x1f448a0b
sub eax, 0x9dcfe29e
xor eax, 0xdf5649ce
mov qword [rcx], rdx
cmp eax, 0x64d1f76e
jbe 0x1400d41c9
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x1400d4236
mov al, byte [rsp + 0x47]
and al, 1
movzx eax, al
add rsp, 0x48
ret
sub dword [rdx], eax
retf 0xe98e
Function at 0x1400d4250
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov eax, dword [0x1401f8da0]
mov ecx, dword [0x1401f8da4]
xor ecx, 0x99cc8b1d
xor edx, edx
div ecx
mov r8d, 0xffffffff
xor r8d, 0x67db26f3
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0xb6c53c5
xor r8d, 0xf493ac3a
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x67db26f3
or eax, 0x67db26f3
imul eax, edx
add eax, ecx
and eax, 0x7489bb52
mov ecx, 0xb9e1e60b
xor ecx, 0x78b8fd54
xor eax, ecx
cmp eax, 0xe41b6d6a
jae 0x1400d4488
mov eax, dword [0x1401f8da8]
xor edx, edx
div dword [0x1401f8dac]
or eax, 0x207c1a6d
sub eax, 0x75190035
mov ecx, 0x3b38e388
xor edx, edx
div ecx
mov dword [rsp + 0x40], eax
mov eax, 0x75a7b014
xor eax, 0x6b93065b
mov dword [rsp + 0x3c], eax
call fcn.1400d4006
mov rcx, rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rax]
call fcn.1400d4030
mov ecx, dword [rsp + 0x3c]
mov dl, al
mov eax, dword [rsp + 0x40]
mov byte [rsp + 0x47], dl
cmp eax, ecx
ja 0x1400d4488
mov al, byte [rsp + 0x47]
test al, 1
jne 0x1400d4341
jmp 0x1400d4476
mov eax, dword [0x1401f8db0]
mov ecx, 0xd7432ecf
xor ecx, 0xb119fa46
xor eax, ecx
mov edx, dword [0x1401f8db4]
xor edx, 0x25fc7cd9
mov ecx, eax
and ecx, edx
shl ecx, 1
xor eax, edx
add eax, ecx
mov ecx, 0x1f3822cb
xor ecx, 0xf57d9359
xor edx, edx
div ecx
mov ecx, eax
mov eax, 0xc8dc2001
xor eax, 0x774f9ecb
and eax, ecx
xor eax, 0xffffffff
add ecx, 0xbf93beca
mov edx, 0x7f53e8f9
xor edx, 0x7f53e8f8
add ecx, edx
add ecx, eax
mov edx, 0xda722c46
xor edx, 0x258dd3b9
mov eax, ecx
xor eax, edx
mov edx, 0xffffffff
xor edx, 0x4b5bb4ab
and eax, edx
mov edx, 0xe5e76161
xor edx, 0xaebcd5ca
or ecx, edx
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
cmp eax, 0x37685eee
jbe 0x1400d4491
mov eax, dword [0x1401f8db8]
xor edx, edx
div dword [0x1401f8dbc]
mov ecx, eax
mov rax, qword [rsp + 0x50]
mov edx, 0x8fba6d77
xor edx, 0xf41f036e
or ecx, edx
add ecx, 0xf39edcd1
xor edx, edx
sub edx, ecx
mov ecx, 0x12702c08
xor ecx, 0x12702c08
mov r8d, 0x427866aa
xor r8d, 0xd4e28404
sub ecx, r8d
add edx, ecx
xor ecx, ecx
sub ecx, edx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rax]
call fcn.1400d3d80
mov rcx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x28]
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0xd616ebd7
jae 0x1400d43dc
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1400d4464
jmp 0x1400d4483
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
mov edx, 8
call fcn.14000fac0
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
add rsp, 0x58
ret
inc dword [rdi + 0x3ce947c9]
invalid
invalid
Function at 0x1400d5020
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.1400d4c2a
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.1400d4df0
test al, 1
jne 0x1400d504a
jmp 0x1400d5089
mov rcx, qword [rsp + 0x28]
call fcn.1400d4fd6
mov rax, qword [rsp + 0x30]
mov al, byte [rax]
mov cl, pe_nt_image_headers64
xor cl, 0x80
cmp al, cl
jne 0x1400d5089
mov rcx, qword [rsp + 0x28]
movabs rdx, 0x2d26e75da23d0914
movabs rax, 0x2d26e75da23d091c
xor rdx, rax
call fcn.14000fac0
mov eax, dword [0x1401f8e00]
sub eax, dword [0x1401f8e04]
mov ecx, 0x1d9aac9a
xor ecx, 0x98398298
mov edx, eax
and edx, ecx
mov ecx, 0xbd7467be
xor ecx, 0xbd7467bc
imul ecx, edx
add eax, 0x85a32e02
sub eax, ecx
add eax, 0x1b57410a
mov ecx, 0x7936a398
xor edx, edx
div ecx
cmp eax, 0x2d402494
je 0x1400d5114
mov eax, dword [0x1401f8e08]
mov ecx, dword [0x1401f8e0c]
mov edx, 0x4f51c976
xor edx, 0x7dc4abf2
xor ecx, edx
or eax, ecx
or eax, 0x52831991
mov ecx, 0x9111c9c1
xor edx, edx
div ecx
mov ecx, 0x185fe032
xor edx, edx
div ecx
cmp eax, 0x2d07c261
ja 0x1400d50d2
add rsp, 0x38
ret
mov dh, 5
leave
in al, dx
jmp 0x1400d50d2

Function at 0x1400d6c70
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rcx
mov ecx, dword [0x1401f8f00]
xor ecx, 0x3fdc6382
mov edx, dword [0x1401f8f04]
mov eax, ecx
xor eax, edx
xor eax, 0xffffffff
or ecx, edx
and ecx, eax
sub ecx, 0x796a8c55
mov eax, ecx
xor eax, 0xffffffff
mov r8d, 0x4de1d42d
xor r8d, 0xb21e2bd2
mov edx, ecx
xor edx, r8d
or eax, edx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x10053844
or eax, edx
mov edx, 0xffffffff
xor edx, 0x10053844
mov r8d, 0xffffffff
xor r8d, 0x10053844
or edx, r8d
and ecx, edx
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0x348f7ba6
xor ecx, 0x2f23e146
xor edx, edx
div ecx
cmp eax, 0xe74eba0e
ja 0x1400d6e2b
mov r8, qword [rsp + 0x18]
mov eax, dword [0x1401f8f08]
mov r9d, dword [0x1401f8f0c]
mov ecx, 0x795cf7c6
xor ecx, 0x86a30839
mov r10d, r9d
xor r10d, ecx
mov edx, eax
and edx, r10d
mov ecx, eax
or ecx, r10d
mov r10d, 0x6735167f
xor r10d, 0x98cae980
xor ecx, r10d
imul ecx, edx
mov edx, eax
and edx, r9d
or eax, r9d
imul eax, edx
add eax, ecx
xor eax, 0x480ceee9
mov ecx, 0x21423984
xor ecx, 0xeffc9f86
imul eax, ecx
mov edx, 0xccfe0135
xor edx, 0x2c377176
mov ecx, eax
xor ecx, edx
mov edx, 0x83e20709
xor edx, 0x7c1df8f6
xor ecx, edx
and ecx, 0xe0c97043
shl ecx, 1
sub ecx, 0xe0c97043
sub eax, ecx
mov ecx, 0x10275688
xor ecx, 0x29fdf010
xor edx, edx
test r8, r8
cmovg rdx, r8
mov qword [rsp + 0x10], rdx
cmp eax, ecx
jb 0x1400d6d09
xor eax, eax
mov qword [rsp + 8], rax
jmp 0x1400d6dc3
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 8]
mov qword [rsp], rax
cmp rax, rcx
je 0x1400d6e12
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x20]
mov dl, byte [rcx + rax]
cmp dl, 0x20
setb cl
mov r8b, 0xae
xor r8b, 0xd1
cmp dl, r8b
sete dl
or cl, dl
add rax, 1
test cl, 1
mov qword [rsp + 8], rax
jne 0x1400d6e12
jmp 0x1400d6dc3
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x18]
cmp rax, rcx
setl al
and al, 1
movzx eax, al
add rsp, 0x28
ret
test eax, 0xfed5e9c6
invalid