joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006aa10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x40], rcx
call fcn.14006a8ef
mov rcx, qword [rsp + 0x40]
cmp rcx, 0
jge 0x14006ab93
mov ecx, dword [0x1401de138]
xor ecx, 0x7b56fb7
or ecx, dword [0x1401de13c]
mov r8d, 0xffffffff
xor r8d, 0xa8caa760
mov edx, ecx
and edx, r8d
mov eax, ecx
or eax, r8d
mov r8d, 0x996b64d9
xor r8d, 0x66949b26
xor eax, r8d
imul eax, edx
mov edx, ecx
and edx, 0xa8caa760
or ecx, 0xa8caa760
imul ecx, edx
add ecx, eax
mov eax, 0x70303263
xor eax, 0x70303263
sub eax, ecx
xor ecx, ecx
sub ecx, 0xc0d69843
add eax, ecx
mov ecx, 0xa980564
xor ecx, 0xa980564
sub ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0xbc1808b
mov edx, 0xffffffff
xor edx, 0xbc1808b
and ecx, edx
or eax, ecx
cmp eax, 0xa59dca5c
jbe 0x14006acbb
mov rcx, qword [rsp + 0x40]
mov edx, dword [0x1401de140]
xor edx, 0xe89f1e19
mov r9d, dword [0x1401de144]
mov eax, edx
xor eax, 0xffffffff
mov r8d, edx
xor r8d, 0xffffffff
or eax, r8d
xor eax, 0xffffffff
mov r8d, r9d
xor r8d, 0xffffffff
or eax, r8d
mov r8d, r9d
xor r8d, 0xffffffff
xor r9d, 0xffffffff
or r8d, r9d
and edx, r8d
xor edx, 0xffffffff
xor eax, 0xffffffff
xor edx, 0xffffffff
or eax, edx
mov edx, 0x7d72bfb8
xor edx, 0x8765fef8
add eax, edx
add eax, 0x227a18c0
sub eax, 0xfa174140
add eax, 0xc57b9c4d
mov r8d, eax
xor r8d, 0xffffffff
and r8d, 0x2093c483
mov r9d, 0xffffffff
xor r9d, 0x2093c483
mov edx, eax
and edx, r9d
imul edx, r8d
mov r8d, eax
and r8d, 0x2093c483
or eax, 0x2093c483
imul eax, r8d
add eax, edx
mov dword [rsp + 0x3c], eax
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
call fcn.14000c499
mov eax, dword [rsp + 0x3c]
cmp eax, 0xf64200de
jae 0x14006aac3
jmp 0x14006acb1
mov eax, dword [0x1401de148]
xor edx, edx
div dword [0x1401de14c]
mov ecx, eax
mov edx, 0xaab28f85
xor edx, 0x554d707a
mov eax, ecx
xor eax, edx
and eax, 0xd1d65679
mov edx, 0xf4e50b64
xor edx, 0x25335d1d
mov r8d, 0xeecd5842
xor r8d, 0x1132a7bd
xor edx, r8d
and ecx, edx
sub ecx, eax
mov edx, 0x8ac00546
xor edx, 0xd978ef8f
mov eax, ecx
xor eax, edx
mov edx, 0x11a5730f
xor edx, 0xee5a8cf0
xor eax, edx
and eax, 0x53b8eac9
shl eax, 1
sub eax, 0x53b8eac9
sub ecx, eax
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x3624616b
or ecx, 0x3624616b
mov edx, 0xe4a92a22
xor edx, 0x1b56d5dd
xor ecx, edx
or eax, ecx
xor eax, 0xffffffff
cmp eax, 0x20c9dcb7
jb 0x14006acc4
mov eax, dword [0x1401de150]
xor edx, edx
div dword [0x1401de154]
sub eax, 0x685bc508
and eax, 0x2a34404f
mov ecx, 0x9d322c1f
xor ecx, 0xb844aceb
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x40]
mov dword [rsp + 0x2c], eax
lea rcx, [rsp + 0x58]
call fcn.14001b230
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
call fcn.14006a912
mov rcx, rax
mov eax, dword [rsp + 0x2c]
mov qword [rsp + 0x30], rcx
cmp eax, 0x91239c43
ja 0x14006ac33
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
jmp 0x14006acb1
mov rax, qword [rsp + 0x20]
add rsp, 0x68
ret
push rsi
invalid
int1
add dword [rsi + 0x14], esp
jmp 0x14006ac33
Function at 0x14006ae70
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x34], edx
call fcn.14006a8ef
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x34]
call fcn.14006af93
mov rax, qword [rsp + 0x28]
cmp byte [rax], 0
jne 0x14006aeba
mov rcx, qword [rsp + 0x20]
mov edx, dword [rsp + 0x30]
call fcn.140039db3
mov eax, dword [0x1401de168]
xor eax, 0xe2211a9e
mov r8d, dword [0x1401de16c]
xor r8d, 0x16de8ad2
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
imul eax, eax, 0x6a1ed703
imul eax, eax, 0xc8c01f48
add eax, 0x3e66489a
add eax, 0x58524fa8
sub eax, 0x3e66489a
cmp eax, 0x13ecb592
jbe 0x14006af8a
mov eax, dword [0x1401de170]
xor eax, dword [0x1401de174]
or eax, 0xd98ed4c6
mov r8d, 0xee97f50c
xor r8d, 0xd319da5c
mov ecx, 0x4c92ed24
xor ecx, 0xb36d12db
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x3d8e2f50
or eax, 0x3d8e2f50
imul eax, edx
add eax, ecx
sub eax, 0x6e7cabb7
mov ecx, 0xa710e3ca
xor ecx, 0x521669a8
cmp eax, ecx
ja 0x14006af1f
add rsp, 0x38
ret
rcr cl, 0x9f
invalid
Function at 0x14006c030
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401de218]
mov ecx, dword [0x1401de21c]
mov edx, 0xa0136cf1
xor edx, 0x9c94582
xor ecx, edx
add eax, ecx
or eax, 0x6bc19d9d
mov ecx, eax
or ecx, ecx
mov edx, 0x199903d5
xor edx, 0xe666fc2a
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0xb77f7787
mov r8d, 0xffffffff
xor r8d, 0xb77f7787
and edx, r8d
xor ecx, 0xffffffff
xor edx, 0xffffffff
and ecx, edx
mov edx, 0xaa3c207b
xor edx, 0x1d4357fc
or eax, edx
xor eax, 0xffffffff
or ecx, eax
mov eax, 0x8f4a8b20
xor eax, 0x70b574df
xor ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xd3b42146
xor edx, 0x2c4bdeb9
xor ecx, edx
or eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x3cf14bc1
mov edx, 0xc23949a
xor edx, 0x30d2df5b
mov r8d, 0x4e78cb0d
xor r8d, 0xb18734f2
xor edx, r8d
or ecx, edx
mov edx, 0xa99dd6af
xor edx, 0x56622950
xor eax, edx
xor ecx, 0xffffffff
or eax, ecx
cmp eax, 0x4c52c97c
jbe 0x14006c1ff
mov rcx, qword [rbp - 0x10]
mov edx, dword [0x1401de220]
xor edx, 0x5b58f297
mov eax, dword [0x1401de224]
add edx, eax
xor edx, 0xe288c821
or edx, 0x157035e
mov r8d, edx
and r8d, 0x164f9730
add r8d, r8d
mov eax, edx
neg r8d
mov edx, r8d
lea eax, [rax + rdx - 0x69b068d0]
mov dword [rbp - 0x18], eax
mov eax, 0xcfee92bf
mov dword [rbp - 0x1c], eax
mov eax, 0x10
mov qword [rbp - 0x40], rax
call fcn.1401da3e0
sub rsp, rax
mov rax, qword [rbp - 0x40]
mov rdx, rsp
mov qword [rbp - 0x30], rdx
call fcn.1401da3e0
sub rsp, rax
mov rax, qword [rbp - 0x30]
mov rdx, rsp
mov qword [rbp - 0x38], rdx
mov qword [rax], rcx
sub rsp, 0x20
call fcn.14006a8ef
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
add rsp, 0x20
mov qword [rbp - 0x28], rax
mov qword [rcx], 0
sub rsp, 0x20
call fcn.14006c208
mov rdx, qword [rbp - 0x28]
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x18]
add rsp, 0x20
cmp byte [rdx], 0
sete dl
mov byte [rbp - 0x11], dl
cmp eax, ecx
je 0x14006c10d
mov al, byte [rbp - 0x11]
test al, 1
jne 0x14006c1e2
jmp 0x14006c1fa
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x38]
mov rdx, qword [rax]
sub rsp, 0x20
call fcn.140039fd1
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
loopne 0x14006c24a
jno 0x14006c209
jmp 0x14006c10d
Function at 0x14006ccb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
mov r11d, dword [0x1401de288]
mov eax, 0x4cc8e15f
xor eax, 0x5c6007ae
xor r11d, eax
mov r10d, dword [0x1401de28c]
mov eax, 0xd0c24ec0
xor eax, 0x2f3db13f
mov ecx, r11d
xor ecx, eax
mov r8d, r10d
xor r8d, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x9b41161c
mov eax, ecx
and eax, 0x9b41161c
and r11d, edx
mov r9d, r8d
and r9d, 0x9b41161c
and r10d, edx
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
xor ecx, 0xffffffff
or edx, 0x9b41161c
and ecx, edx
or eax, ecx
mov ecx, 0x432700a1
xor ecx, 0x8b610e49
xor edx, edx
div ecx
and eax, 0x825132f1
mov ecx, 0xf041f25f
xor edx, edx
div ecx
cmp eax, 0x729936f7
ja 0x14006ceb3
mov eax, dword [0x1401de290]
xor eax, 0x7d9d6fb8
mov ecx, dword [0x1401de294]
imul eax, ecx
imul eax, eax, 0x9a59f8c
mov ecx, eax
xor ecx, 0x302040aa
or eax, 0x8003b044
and eax, ecx
or eax, 0x4fdc0f11
mov dword [rbp - 0x2c], eax
mov eax, 0x2c2598e0
mov dword [rbp - 0x30], eax
mov eax, 0x10
call fcn.1401da3e0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
sub rsp, 0x20
call fcn.14006a8ef
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x38], rcx
mov qword [rax], 0
mov qword [rax + 8], 0
mov ecx, 8
sub rsp, 0x20
call fcn.14006aa10
mov rdx, qword [rbp - 0x38]
mov ecx, dword [rbp - 0x30]
add rsp, 0x20
mov r8, rax
mov eax, dword [rbp - 0x2c]
mov qword [rbp - 0x28], r8
cmp byte [rdx], 0
sete dl
mov byte [rbp - 0x19], dl
cmp eax, ecx
jbe 0x14006cd5a
mov cl, byte [rbp - 0x19]
mov al, 1
test cl, 1
mov byte [rbp - 0x41], al
jne 0x14006ce18
jmp 0x14006ce76
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x28]
sub rsp, 0x20
call fcn.14006cc7c
mov rax, qword [rbp - 0x38]
add rsp, 0x20
mov cl, byte [rax]
mov dl, 0x24
xor dl, 0x24
mov al, 1
cmp cl, dl
mov byte [rbp - 0x41], al
jne 0x14006ce76
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x28]
mov r8, qword [rax + 0x58]
mov qword [rdx], r8
mov rax, qword [rax + 0x60]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14001a2c4
mov rax, qword [rbp - 0x38]
add rsp, 0x20
mov al, byte [rax]
mov byte [rbp - 0x41], al
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x28]
mov dl, byte [rbp - 0x41]
mov byte [rbp - 0x42], dl
mov byte [rax], 0
sub rsp, 0x20
call fcn.14006a5ec
mov rax, qword [rbp - 0x38]
add rsp, 0x20
cmp byte [rax], 0
jne 0x14006ceaa
mov rax, qword [rbp - 0x38]
mov cl, byte [rbp - 0x42]
mov byte [rax], cl
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
nop
fisttp word [rcx]
jmp 0x14006cd5a
Function at 0x14006f0a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x58], rcx
call fcn.14006a8ef
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
call fcn.14003a1f2
mov rcx, qword [rsp + 0x60]
mov byte [rsp + 0x6f], al
xor eax, eax
cmp byte [rcx], 0
mov qword [rsp + 0x70], rax
jne 0x14006f482
mov al, byte [rsp + 0x6f]
mov cl, 0x71
xor cl, 0x8e
cmp al, cl
jle 0x14006f0f8
mov al, byte [rsp + 0x6f]
movzx eax, al
mov qword [rsp + 0x70], rax
jmp 0x14006f482
mov ecx, dword [0x1401de3e8]
xor ecx, 0x524161ff
mov edx, dword [0x1401de3ec]
xor edx, 0x27343610
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov r8d, 0xc601d15f
xor r8d, 0x39fe2ea0
mov ecx, edx
xor ecx, r8d
xor edx, 0xffffffff
and ecx, edx
mov edx, 0xc66e0883
xor edx, 0x3991f77c
xor eax, edx
mov edx, 0x68f01eb9
xor edx, 0x970fe146
xor ecx, edx
and eax, ecx
imul eax, eax, 0x2af905d9
or eax, eax
xor eax, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xf1030b13
mov edx, 0xc9f692a8
xor edx, 0x38f599bb
mov r8d, 0x294dce32
xor r8d, 0xd6b231cd
xor edx, r8d
and ecx, edx
mov edx, 0xd5b2935b
xor edx, 0x2a4d6ca4
xor eax, edx
mov edx, 0xb5fa4e0
xor edx, 0xf4a05b1f
xor ecx, edx
and eax, ecx
add eax, 0x992bf5e0
cmp eax, 0x2f3943f4
je 0x14006f535
mov ecx, dword [0x1401de3f0]
mov edx, dword [0x1401de3f4]
mov eax, 0xbd92cec
xor eax, 0xe5a01334
xor edx, eax
mov eax, 0x76cb526f
xor eax, 0x8934ad90
xor edx, eax
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0xcfeef2c1
xor edx, edx
div ecx
sub eax, 0x8650d12c
mov ecx, 0xf0a71d0b
xor edx, edx
div ecx
cmp eax, 0x3f3e4899
ja 0x14006f1ac
mov al, byte [rsp + 0x6f]
add al, 0x34
movzx ecx, al
mov qword [rsp + 0x50], rcx
sub al, 3
ja 0x14006f41a
mov rax, qword [rsp + 0x50]
lea rcx, [0x14006f550]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
lea rcx, [0x1401ee8e8]
call fcn.14006de95
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
xor eax, eax
cmp byte [rcx], 0
mov qword [rsp + 0x70], rax
jne 0x14006f482
mov rcx, qword [rsp + 0x38]
movabs rax, 0xa6a5f5050322ec8f
movabs rdx, 0xa6a5f5052a933ebe
xor rax, rdx
lea rdx, [0x1401ee835]
lea r8, [0x1401ee862]
lea r9, [0x1401ee825]
mov qword [rsp + 0x20], rax
call fcn.14001355a
xor eax, eax
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov eax, dword [0x1401de408]
sub eax, dword [0x1401de40c]
mov ecx, 0x2b93c1a3
xor ecx, 0x8f341984
sub eax, ecx
mov edx, 0x11ef8523
xor edx, 0x94b70e0e
mov ecx, eax
and ecx, edx
shl ecx, 1
add eax, 0x85588b2d
sub eax, ecx
or eax, 0xf602dfe5
cmp eax, 0xfe7dcbf7
jae 0x14006f547
mov eax, dword [0x1401de410]
and eax, dword [0x1401de414]
xor ecx, ecx
sub ecx, 0xccf3bcd6
sub eax, ecx
sub eax, 0x21e26e72
mov r8d, 0xffffffff
xor r8d, 0x1082aacc
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x1082aacc
or eax, 0x1082aacc
imul eax, edx
add eax, ecx
mov ecx, 0xa95f97b8
xor ecx, 0x4d3f0f03
cmp eax, ecx
je 0x14006f4ce
mov rax, qword [rsp + 0x30]
add rsp, 0x78
ret
invalid
out dx, eax
invalid
Function at 0x140077290
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
call fcn.14006a8ef
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov edx, 5
call fcn.14006afd9
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140077503
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax]
call fcn.140076b00
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140077503
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov edx, dword [rax + 8]
call fcn.14006b5a2
mov rax, qword [rsp + 0x40]
mov al, byte [rax]
mov cl, 0xb2
xor cl, 0xb2
cmp al, cl
jne 0x140077503
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov edx, dword [rax + 0xc]
call fcn.14006b5a2
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140077503
mov eax, dword [0x1401de848]
sub eax, dword [0x1401de84c]
or eax, eax
xor eax, 0xffffffff
mov ecx, 0x3ab601e9
or ecx, 0x3ab601e9
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
add eax, 0x109fa6f9
and eax, 0xeae7505b
cmp eax, 0x7eaceda9
ja 0x140077508
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x1401de850]
xor eax, 0x29bbc3f7
xor edx, edx
div dword [0x1401de854]
mov edx, eax
mov rax, qword [rsp + 0x30]
and edx, 0x3ea968dd
or edx, 0x94303880
mov r8d, edx
and r8d, 0xa8a71b6
shl r8d, 1
mov r9d, 0x38bc3f15
xor r9d, 0x32364ea3
add edx, r9d
sub edx, r8d
mov dword [rsp + 0x28], edx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x58], rdx
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x58]
call fcn.14006bfbf
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x28]
mov cl, byte [rcx]
mov dl, 0x9e
xor dl, 0x9e
cmp cl, dl
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0xeb2baed6
jae 0x140077367
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x140077408
jmp 0x140077503
mov eax, dword [0x1401de858]
xor edx, edx
div dword [0x1401de85c]
mov ecx, eax
mov eax, ecx
and eax, eax
xor eax, 0xffffffff
and eax, 0xb06aa965
xor eax, 0xffffffff
mov edx, 0x6b93803
xor edx, 0xb6d39166
mov r8d, 0xd03cec18
xor r8d, 0x2fc313e7
xor edx, r8d
mov r8d, 0xffffffff
xor r8d, 0xb06aa965
or edx, r8d
and ecx, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0xbf7822ee
xor edx, edx
div ecx
mov ecx, 0xffffffff
xor ecx, 0xac16ae3b
add eax, ecx
mov ecx, 0x50a2f907
xor ecx, 0x50a2f906
add eax, ecx
cmp eax, 0x48477499
jb 0x140077511
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov edx, dword [0x1401de860]
xor edx, 0x6071b4c8
mov r8d, dword [0x1401de864]
mov r9d, 0x4fec8f52
xor r9d, 0xf76b9919
xor r8d, r9d
xor edx, r8d
and edx, 0x60a4a48f
imul edx, edx, 0x3a83732e
xor edx, 0x5a82a157
mov dword [rsp + 0x24], edx
mov rdx, qword [rax + 0x20]
mov qword [rsp + 0x48], rdx
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
call fcn.14006bfbf
mov eax, dword [rsp + 0x24]
cmp eax, 0xb5d86175
je 0x14007748d
jmp 0x140077503
add rsp, 0x68
ret
sti
test byte [rdi - 0x1a917], ah
jmp [0x129bd1a1e]
sub eax, 0xe9b5a508
jae 0x140077517
invalid
invalid
Function at 0x140077d10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rcx
call fcn.14006a8ef
mov rdx, qword [rsp + 0x38]
cmp rdx, 0
jne 0x140077cd3
mov eax, dword [0x1401de8a8]
mov ecx, 0x76daffd6
xor ecx, 0xc6763e33
xor eax, ecx
add eax, dword [0x1401de8ac]
mov ecx, 0x56c4fe11
xor ecx, 0xa93b01ee
mov edx, eax
xor edx, ecx
and edx, 0xa3cdf562
mov r8d, 0xffffffff
xor r8d, 0xa3cdf562
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xa3cdf562
mov r8d, 0x62a21c9e
xor r8d, 0xc16fe9fc
or eax, r8d
imul eax, edx
add eax, ecx
mov r8d, eax
and r8d, r8d
xor r8d, 0xffffffff
and r8d, 0x6dbf80ab
xor r8d, 0xffffffff
mov ecx, 0xe1573195
xor ecx, 0x8ce8b13e
mov edx, 0x9a89a61c
xor edx, 0xf73626b7
and ecx, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
xor r8d, 0xffffffff
mov ecx, 0x1d7e0fef
xor ecx, 0xe281f010
xor eax, ecx
or r8d, eax
mov eax, r8d
xor eax, 0xffffffff
and eax, 0xebbfa653
mov r9d, 0xffffffff
xor r9d, 0xebbfa653
and r8d, r9d
mov ecx, 0x8b87e175
xor ecx, 0x71fc7e35
mov edx, 0x33e1e74c
xor edx, 0xcc1e18b3
xor ecx, edx
and ecx, 0xebbfa653
mov edx, 0x70950c33
xor edx, 0x8aee9373
and edx, r9d
or eax, r8d
or ecx, edx
xor eax, ecx
cmp eax, 0xa9f35c80
ja 0x140077d07
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401de8b0]
imul eax, dword [0x1401de8b4]
xor eax, 0x49f7578b
mov r8d, 0x57309056
xor edx, edx
div r8d
mov edx, 0xb24782f3
xor edx, 0x72193343
and eax, edx
mov dword [rsp + 0x2c], eax
call fcn.14006accd
mov eax, dword [rsp + 0x2c]
cmp eax, 0xc2d7cd8b
jae 0x140077c87
jmp 0x140077d01
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov qword [rsp + 0x40], rdx
mov rdx, qword [rax + 8]
mov qword [rsp + 0x48], rdx
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x40]
call fcn.140077a00
nop
add rsp, 0x58
ret
cdq
and ecx, dword [rbp - 0x88166b]
invalid
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006a8ef
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x140077b60
Function at 0x14007ea50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006a8ef
mov rdx, qword [rsp + 0x30]
cmp rdx, 0
jne 0x14007ea81
mov rcx, qword [rsp + 0x28]
call fcn.14006accd
jmp 0x14007ea93
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax]
call fcn.14007e860
mov eax, dword [0x1401dec78]
add eax, dword [0x1401dec7c]
add eax, 0x778d35c1
mov ecx, 0x81d09b14
xor ecx, 0xb2366ffb
add eax, ecx
mov ecx, 0xeb358364
xor ecx, 0x6a92f9ad
sub eax, ecx
cmp eax, 0xefcc12eb
ja 0x14007eafc
mov eax, dword [0x1401dec80]
and eax, dword [0x1401dec84]
sub eax, 0x84742f4f
sub eax, 0xabdb1849
mov ecx, 0xc23b7cb5
xor ecx, 0x556b228b
sub eax, ecx
cmp eax, 0x24e135ca
je 0x14007eac9
add rsp, 0x38
ret
invalid
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006a8ef
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x14007ea50
Function at 0x14007ece0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401dec98]
sub eax, dword [0x1401dec9c]
mov ecx, 0xd5e8875b
xor ecx, 0x2ecc3660
mov edx, eax
and edx, ecx
mov ecx, 0xe4e3c848
xor ecx, 0xe4e3c84a
imul ecx, edx
add eax, 0xfb24b13b
sub eax, ecx
mov ecx, 0x7ef1b197
xor ecx, 0x345c6944
or eax, ecx
sub eax, 0xe47dd8db
cmp eax, 0x60ac5a6e
jb 0x14007ef7a
mov ecx, dword [0x1401deca0]
mov eax, dword [0x1401deca4]
and ecx, eax
mov edx, ecx
and edx, 0x1968405e
add edx, edx
mov eax, ecx
neg edx
mov ecx, edx
lea eax, [rax + rcx - 0x2d0be3]
xor eax, 0x7643ee7d
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.1401da3e0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.14006a8ef
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov edx, 2
sub rsp, 0x20
call fcn.14006afd9
mov rcx, qword [rbp - 0x20]
mov eax, dword [rbp - 0x18]
add rsp, 0x20
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0x7f9e2581
jb 0x14007ed3f
mov al, byte [rbp - 0x11]
test al, 1
jne 0x14007edd2
jmp 0x14007ef75
mov ecx, dword [0x1401deca8]
xor ecx, 0x919882d8
mov edx, dword [0x1401decac]
mov eax, ecx
or eax, eax
mov r8d, 0x3f19ce64
xor r8d, 0xc0e6319b
xor eax, r8d
mov r8d, edx
or r8d, r8d
xor r8d, 0xffffffff
xor eax, 0xffffffff
xor r8d, 0xffffffff
and eax, r8d
or ecx, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
sub eax, 0x753ae97f
mov ecx, 0xda6e9df5
xor ecx, 0x2591620a
mov edx, eax
xor edx, ecx
and edx, 0xc14b73ae
mov r8d, 0xffffffff
xor r8d, 0xc14b73ae
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xc14b73ae
mov r8d, 0xaeda999f
xor r8d, 0x6f91ea31
or eax, r8d
imul eax, edx
add eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xd4f89a82
mov ecx, 0xffffffff
xor ecx, 0x9158aa2b
or eax, edx
or ecx, 0x9158aa2b
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0x346a6f71
ja 0x14007ef83
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov edx, dword [0x1401decb0]
xor edx, 0xdbd2e2dd
xor edx, dword [0x1401decb4]
mov r10d, 0xffffffff
xor r10d, 0xb6d56c30
mov r9d, edx
and r9d, r10d
mov r8d, edx
or r8d, r10d
xor r8d, 0xffffffff
imul r8d, r9d
mov r9d, edx
and r9d, 0xb6d56c30
or edx, 0xb6d56c30
imul edx, r9d
add edx, r8d
mov r8d, edx
xor r8d, 0xffffffff
and r8d, 0x69f37640
mov r9d, 0xffffffff
xor r9d, 0x69f37640
and edx, r9d
sub edx, r8d
imul edx, edx, 0x3a5eb20b
mov dword [rbp - 0x30], edx
mov rdx, qword [rax]
sub rsp, 0x20
call fcn.140076b00
mov rcx, qword [rbp - 0x20]
mov eax, dword [rbp - 0x30]
add rsp, 0x20
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0x29], cl
cmp eax, 0x63bcbf21
je 0x14007ef83
mov al, byte [rbp - 0x29]
test al, 1
jne 0x14007ef4d
jmp 0x14007ef75
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax + 8]
mov qword [rdx], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.1400777b0
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
sub al, dil
jmp 0x14007ed3f
mov bl, byte [rdi + 0xae96854]
invalid
Function at 0x14007f700
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401ded08]
imul eax, dword [0x1401ded0c]
add eax, 0xde6f4e13
add eax, 0x1fdf967f
mov ecx, 0x71bfd779
xor ecx, 0xbbf61de4
sub eax, ecx
cmp eax, 0x459b1db3
jae 0x14007f8e2
mov eax, dword [0x1401ded10]
or eax, dword [0x1401ded14]
mov ecx, 0x6062318a
xor ecx, 0x9576790f
imul eax, ecx
mov edx, 0x8d9ae3ef
xor edx, 0x6c11a23f
mov ecx, eax
and ecx, edx
shl ecx, 1
add eax, 0xe18b41d0
sub eax, ecx
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0xfa68799f
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [rsp + 0x20], eax
call fcn.14006a8ef
mov rcx, qword [rsp + 0x28]
mov eax, dword [rsp + 0x20]
cmp rcx, 0
sete cl
mov byte [rsp + 0x27], cl
cmp eax, 0x4f5ed17d
je 0x14007f73d
mov al, byte [rsp + 0x27]
test al, 1
jne 0x14007f7ba
jmp 0x14007f7c9
mov rcx, qword [rsp + 0x30]
call fcn.14006accd
jmp 0x14007f7d8
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call fcn.14007f4f0
mov r11d, dword [0x1401ded18]
mov eax, dword [0x1401ded1c]
xor eax, 0x33596b95
imul r11d, eax
mov ecx, r11d
xor ecx, 0xffffffff
mov edx, 0xd480ed40
xor edx, 0x8d781d76
mov eax, 0x9ba96ae4
xor eax, 0x6456951b
xor edx, eax
mov r8d, 0xc473a9d4
xor r8d, 0xfddf56e2
mov eax, 0xb03e4237
xor eax, 0x4fc1bdc8
xor r8d, eax
mov eax, ecx
and eax, 0x39acff36
and r11d, r8d
mov r9d, edx
and r9d, 0x39acff36
mov r10d, r8d
and r10d, 0x59f8f036
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, edx
xor ecx, 0xffffffff
mov edx, 0x5596e35d
xor edx, 0x6c3a1c6b
or edx, r8d
and ecx, edx
or eax, ecx
add eax, 0x91b94a66
mov ecx, 0xcadbada7
xor edx, edx
div ecx
cmp eax, 0x451088d5
jae 0x14007f8eb
mov eax, dword [0x1401ded20]
mov edx, dword [0x1401ded24]
mov ecx, 0x7dc1787
xor ecx, 0xb4dc6f2f
xor edx, ecx
mov ecx, eax
xor ecx, edx
xor edx, 0xffffffff
and eax, edx
shl eax, 1
sub eax, ecx
xor eax, 0xfca4ffe0
mov edx, eax
and edx, 0xc59c007f
mov ecx, 0x96ae3c49
xor ecx, 0x96ae3c4b
imul ecx, edx
add eax, 0xc59c007f
sub eax, ecx
mov ecx, 0x16b815a
xor ecx, 0x9d79f980
and eax, ecx
cmp eax, 0x9c6f3e20
jae 0x14007f87c
invalid
add rsp, 0x38
ret
jns 0x14007f88c
mov ecx, 0xfe52e957
invalid
invalid