joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e46f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rcx
mov eax, dword [0x1402568e8]
or eax, dword [0x1402568ec]
mov ecx, eax
xor ecx, 0x1eff76d2
mov edx, 0x717b3355
xor edx, 0x8e84ccaa
xor ecx, edx
or eax, 0x1eff76d2
and eax, ecx
mov ecx, 0x88bd2619
xor ecx, 0x88bd2619
sub ecx, eax
mov eax, 0xc03e9b5c
xor eax, 0xc03e9b5c
mov edx, 0xc001bc02
xor edx, 0x9e66e6ba
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, 0xaccc2b84
xor edx, edx
div ecx
cmp eax, 0x4a2ee6b2
jae 0x1400e496e
mov eax, dword [0x1402568f0]
add eax, dword [0x1402568f4]
mov ecx, 0x39ba28b1
xor ecx, 0xaefbd4f0
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x60]
mov ecx, 0xbe4552e8
xor ecx, 0x982a7b82
or eax, ecx
mov ecx, 0xe8f3b888
xor ecx, 0xe8f3b888
sub ecx, eax
xor eax, eax
sub eax, 0x5ceb64be
add ecx, eax
xor eax, eax
sub eax, ecx
mov rcx, rdx
shl rcx, 1
mov qword [rsp + 0x38], rcx
cvtsi2sd xmm0, rdx
movsd xmm1, qword [0x140267e80]
mulsd xmm0, xmm1
movsd qword [rsp + 0x40], xmm0
cvtsi2sd xmm1, rcx
movsd qword [rsp + 0x48], xmm1
ucomisd xmm0, xmm1
sete cl
setnp dl
and cl, dl
mov byte [rsp + 0x57], cl
cmp eax, 0xd8b9996f
ja 0x1400e4764
mov al, byte [rsp + 0x57]
test al, 1
jne 0x1400e4850
jmp 0x1400e4805
movsd xmm1, qword [rsp + 0x40]
movsd xmm0, qword [rsp + 0x48]
subsd xmm0, xmm1
call fcn.14024f600
movaps xmm1, xmm0
movsd xmm0, qword [rsp + 0x40]
movsd qword [rsp + 0x28], xmm1
call fcn.14024f600
movsd xmm1, qword [rsp + 0x28]
movsd xmm2, qword [0x140267e88]
mulsd xmm1, xmm2
mov al, 1
ucomisd xmm0, xmm1
mov byte [rsp + 0x37], al
jb 0x1400e4960
mov ecx, dword [0x1402568f8]
mov eax, 0xb1368ec1
xor eax, 0x67302c99
xor ecx, eax
mov r8d, dword [0x1402568fc]
mov eax, ecx
xor eax, 0xffffffff
mov edx, r8d
and edx, eax
mov eax, 0x4cf77d
xor eax, 0xffb30882
mov r9d, r8d
xor r9d, eax
mov eax, ecx
and eax, r9d
imul eax, edx
mov edx, ecx
and edx, r8d
or ecx, r8d
imul ecx, edx
add ecx, eax
mov edx, 0xe5abdc2c
xor edx, 0x1a5423d3
mov eax, ecx
xor eax, edx
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x4ee72cac
xor ecx, 0x10c473cc
mov edx, 0x3a48942a
xor edx, 0x646bcb4a
or ecx, edx
mov edx, 0xd4d2b56
xor edx, 0xf2b2d4a9
xor ecx, edx
or eax, ecx
mov ecx, 0x3f0ef37f
xor ecx, 0xc0f10c80
xor eax, ecx
mov edx, 0xffffffff
xor edx, 0x814166ad
mov ecx, eax
and ecx, edx
mov r8d, 0xa2ba1616
xor r8d, 0x23fb70bb
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
xor ecx, ecx
sub ecx, 0x5a17647b
add eax, ecx
mov ecx, 0xa734a734
xor ecx, 0x52c25bec
cmp eax, ecx
ja 0x1400e4977
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x38]
mov eax, dword [0x140256900]
xor eax, dword [0x140256904]
or eax, 0xa3fb218a
add eax, 0xa5eaced0
sub eax, 0x906c82bc
mov qword [rcx], rdx
cmp eax, 0x4f34d45f
jb 0x1400e4977
xor eax, eax
mov byte [rsp + 0x37], al
jmp 0x1400e4960
mov al, byte [rsp + 0x37]
and al, 1
movzx eax, al
add rsp, 0x68
ret
xor al, 0x56
insb byte [rdi], dx
or cl, ch
in eax, dx
std
invalid
out 0x14, al
iretd
Function at 0x1400eaa30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov ecx, dword [0x140256c10]
mov eax, dword [0x140256c14]
xor eax, 0x80119c86
sub ecx, eax
xor ecx, 0x293cbcdf
mov edx, ecx
xor edx, 0xffffffff
and edx, 0x93e85768
mov r8d, 0xffffffff
xor r8d, 0x93e85768
mov eax, ecx
and eax, r8d
imul eax, edx
mov r8d, 0x1aea6883
xor r8d, 0x89023feb
mov edx, ecx
and edx, r8d
or ecx, 0x93e85768
imul ecx, edx
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x6386b2cc
mov edx, 0xffffffff
xor edx, 0x6386b2cc
and ecx, edx
or eax, ecx
cmp eax, 0x2263f92a
jbe 0x1400eac2e
mov eax, dword [0x140256c18]
mov ecx, dword [0x140256c1c]
xor ecx, 0xe393af94
xor edx, edx
div ecx
mov ecx, 0xcd146995
xor ecx, 0x403715a2
xor edx, edx
div ecx
sub eax, 0xc735c6de
mov ecx, 0xd2f7145c
xor ecx, 0xc7a32eae
or eax, ecx
mov dword [rsp + 0x24], eax
call fcn.1400ea0eb
mov rcx, qword [rsp + 0x38]
mov rdx, rax
mov eax, dword [rsp + 0x24]
mov qword [rsp + 0x28], rdx
cmp rcx, 0
sete cl
mov byte [rsp + 0x37], cl
cmp eax, 0xbfede671
jae 0x1400eaab8
mov al, byte [rsp + 0x37]
test al, 1
jne 0x1400eab3a
jmp 0x1400eab30
mov rcx, qword [rsp + 0x38]
call fcn.1400eac40
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call fcn.1400ea34b
test al, 1
jne 0x1400eab54
jmp 0x1400eab93
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call fcn.1400e9fe0
mov rax, qword [rsp + 0x28]
cmp byte [rax], 0
jne 0x1400eaba0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
movabs rdx, 0x46db76c3795bba1
movabs rax, 0x46db76c3795bba9
xor rdx, rax
call fcn.14000ea9a
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov qword [rax], rcx
mov eax, dword [0x140256c20]
mov edx, dword [0x140256c24]
xor edx, 0xa14e5e1a
mov ecx, eax
xor ecx, 0xffffffff
and ecx, edx
xor edx, 0xffffffff
and eax, edx
sub eax, ecx
add eax, 0x6fb74d50
and eax, 0x1d90aafa
or eax, 0x54f4d91b
cmp eax, 0xe8e9901
jb 0x1400eac37
mov ecx, dword [0x140256c28]
mov eax, dword [0x140256c2c]
mov edx, 0x277fb546
xor edx, 0x2131239e
xor eax, edx
xor ecx, eax
mov eax, ecx
and eax, 0xc2ebed68
or ecx, 0xc2ebed68
add eax, ecx
mov ecx, 0x6a816599
xor ecx, 0x1e81e0a4
add eax, ecx
sub eax, 0x7fdb5f7c
mov ecx, 0x2218db7f
xor ecx, 0x3f295118
cmp eax, ecx
jb 0x1400eabda
add rsp, 0x48
ret
invalid
out 0xd3, al
add al, byte [rax]
jmp 0x1400eabda
Function at 0x1400ef380
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov eax, dword [0x140256d60]
mov edx, dword [0x140256d64]
xor edx, 0x170b7a3a
mov r8d, eax
xor r8d, edx
xor r8d, 0xffffffff
mov ecx, edx
and ecx, r8d
shl ecx, 1
sub ecx, edx
sub eax, ecx
mov ecx, 0xc1d4c8b4
xor edx, edx
div ecx
mov ecx, 0x3fa227e2
xor edx, edx
div ecx
mov r8d, 0x88a52141
xor r8d, 0x4493a017
mov ecx, 0xd45a6c06
xor ecx, 0x2ba593f9
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xcc368156
or eax, 0xcc368156
imul eax, edx
add eax, ecx
mov ecx, 0xd55a1591
xor ecx, 0x2de2a705
cmp eax, ecx
je 0x1400ef5ab
mov r8d, dword [0x140256d68]
mov edx, dword [0x140256d6c]
mov eax, r8d
xor eax, 0xffffffff
and eax, 0x2f7dfb42
mov r9d, 0xffffffff
xor r9d, 0x2f7dfb42
and r8d, r9d
mov r10d, 0x368127dd
xor r10d, 0xc97ed822
mov ecx, edx
xor ecx, r10d
and ecx, 0x2f7dfb42
and edx, r9d
or eax, r8d
or ecx, edx
xor eax, ecx
sub eax, 0x4d6d5d8b
imul eax, eax, 0x4526fcab
mov edx, 0x4cd00f09
xor edx, 0x9875d3e
mov ecx, eax
and ecx, edx
shl ecx, 1
xor eax, 0x45575237
add eax, ecx
mov dword [rsp + 0x3c], eax
mov eax, 0x18d71c9a
xor eax, 0x5f67eea0
mov dword [rsp + 0x38], eax
call fcn.1400eb12e
mov r8, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x3c]
xor edx, edx
test r8, r8
cmovg rdx, r8
mov qword [rsp + 0x40], rdx
cmp eax, ecx
je 0x1400ef5ab
xor eax, eax
mov qword [rsp + 0x30], rax
jmp 0x1400ef4cc
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp rax, rcx
je 0x1400ef5a6
mov eax, dword [0x140256d70]
mov ecx, dword [0x140256d74]
xor ecx, 0x708379a0
imul eax, ecx
sub eax, 0xf76780c
mov edx, 0xffffffff
xor edx, 0x69345a7c
mov ecx, eax
and ecx, edx
mov r8d, 0xfa213c61
xor r8d, 0x9315661d
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
and eax, 0x78b85487
cmp eax, 0xcf438968
ja 0x1400ef5b4
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x140256d78]
mov edx, dword [0x140256d7c]
mov r8d, 0x66ab8bf8
xor r8d, 0x1391530
xor edx, r8d
or eax, edx
mov edx, 0x91c49cff
xor edx, 0x5161d617
add eax, edx
mov r8d, 0x2a8c8dcf
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x50]
and eax, 0xecd66725
mov r8b, 0xb9
xor r8b, 0xb9
mov byte [rdx + rcx], r8b
add rcx, 1
mov qword [rsp + 0x20], rcx
cmp eax, 0x53bf1763
jae 0x1400ef533
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
jmp 0x1400ef4cc
add rsp, 0x58
ret
or esi, dword [rcx + 0x64e91901]
invalid
fnsave dword [rbx]
retf
Function at 0x1401346c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov r11d, dword [0x140258700]
xor r11d, 0x3815e2ad
mov r10d, dword [0x140258704]
mov ecx, r11d
xor ecx, 0xffffffff
mov eax, 0xcc93f2f9
xor eax, 0x336c0d06
mov edx, r10d
xor edx, eax
mov r8d, 0x8d0de946
xor r8d, 0x344a2751
mov eax, 0x575b3140
xor eax, 0xa8a4cebf
xor r8d, eax
mov eax, ecx
and eax, 0xb947ce17
and r11d, r8d
mov r9d, edx
and r9d, 0xb947ce17
and r10d, r8d
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, edx
mov edx, 0x9e9af0d9
xor edx, 0x61650f26
xor ecx, edx
mov edx, 0x917827bf
xor edx, 0x283fe9a8
or edx, r8d
and ecx, edx
or eax, ecx
sub eax, 0xcccfc37e
mov ecx, 0x4d0a2abb
xor ecx, 0x52c9ca2b
xor edx, edx
div ecx
mov ecx, 0x8e5afa06
xor ecx, 0x58e0848d
xor eax, ecx
cmp eax, 0x365dba86
jbe 0x140134810
mov eax, dword [0x140258708]
xor eax, 0xad1a3d42
mov ecx, dword [0x14025870c]
xor ecx, 0x5f0338b6
xor edx, edx
div ecx
mov rdx, qword [rbp - 8]
imul eax, eax, 0xf753e8f9
add eax, 0x808ce2b7
and eax, 0xc6e8d6f5
mov dword [rbp - 0x18], eax
mov eax, 0x235d922a
mov dword [rbp - 0x1c], eax
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, qword [rbp - 0x10]
mov rcx, rsp
mov qword [rbp - 0x28], rcx
mov dword [rcx], 0
add rdx, rax
mov r8d, 4
sub rsp, 0x20
call fcn.140134819
mov rdx, qword [rbp - 0x28]
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x18]
add rsp, 0x20
mov edx, dword [rdx]
mov dword [rbp - 0x14], edx
cmp eax, ecx
je 0x140134783
mov eax, dword [rbp - 0x14]
mov rsp, rbp
pop rbp
ret
jns 0x140134878
mov cl, 0xe9
push 0xffffffffffffffff
invalid
sub bl, al
nop word [rax + rax]

Function at 0x140134880
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x140258710]
or eax, dword [0x140258714]
mov ecx, 0xb8d0c8dc
xor ecx, 0x106c1d77
xor edx, edx
div ecx
mov r11d, eax
mov eax, 0xb0215eec
xor eax, 0x4fdea113
mov ecx, r11d
xor ecx, eax
mov r8d, 0xffffffff
xor r8d, 0x352dc140
mov edx, 0x78c3c4c
xor edx, 0xefa42e5c
mov eax, 0x2996b28e
xor eax, 0xd6694d71
xor edx, eax
mov r9d, 0xb1c5c5ef
xor r9d, 0x59edd7ff
mov eax, ecx
and eax, r9d
and r11d, edx
mov r9d, r8d
and r9d, 0xe8281210
mov r10d, edx
and r10d, 0x352dc140
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
mov r8d, 0xd22dd47
xor r8d, 0xf2dd22b8
xor ecx, r8d
or edx, 0xe8281210
and ecx, edx
or eax, ecx
add eax, 0x7f03f579
cmp eax, 0x43c2b628
jb 0x1401349b5
mov rdx, qword [rbp - 8]
xor eax, eax
mov dword [rbp - 0x1c], eax
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, qword [rbp - 0x10]
mov rcx, rsp
mov qword [rbp - 0x28], rcx
movabs r8, 0x3609930590c51076
movabs r9, 0x3609930590c51076
xor r8, r9
mov qword [rcx], r8
add rdx, rax
mov r8d, 8
sub rsp, 0x20
call fcn.140134819
mov rcx, qword [rbp - 0x28]
mov eax, dword [rbp - 0x1c]
add rsp, 0x20
mov rcx, qword [rcx]
mov qword [rbp - 0x18], rcx
cmp eax, 0xb7517b69
ja 0x140134942
mov rax, qword [rbp - 0x18]
mov rsp, rbp
pop rbp
ret
invalid
Function at 0x1401378b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 8], rcx
mov eax, dword [0x140258958]
mov edx, dword [0x14025895c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
and eax, 0x9328ee17
add eax, 0xd483264a
xor eax, 0xc840be25
cmp eax, 0xc067e096
ja 0x140137997
mov eax, dword [0x140258960]
mov ecx, dword [0x140258964]
xor ecx, 0x8952f367
xor edx, edx
div ecx
xor eax, 0x3808d0c6
and eax, 0xbd29d9f6
add eax, 0x4e9e3ecf
mov dword [rbp - 0xc], eax
mov eax, 0x10
mov qword [rbp - 0x20], rax
call fcn.14024f5c0
sub rsp, rax
mov rax, qword [rbp - 0x20]
mov rcx, rsp
call fcn.14024f5c0
sub rsp, rax
mov rax, qword [rbp - 8]
mov rdx, rsp
mov qword [rbp - 0x18], rdx
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.1400284c2
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov rdx, qword [rax + 0x10]
mov qword [rcx], rdx
mov rax, qword [rax + 0x18]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.140024546
mov eax, dword [rbp - 0xc]
add rsp, 0x20
cmp eax, 0x22f43cec
jbe 0x1401378f2
mov rsp, rbp
pop rbp
ret
xchg ebp, eax
iretd
Function at 0x140142660
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
call fcn.14013f3e7
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rdx, qword [rcx]
movabs rcx, 0xf5b92ac9a97ec23e
mov rax, rdx
sub rax, rcx
movabs rcx, 0x8a9744f49e8818f1
movabs r8, 0x8a9744f49e8818f5
xor rcx, r8
add rax, rcx
movabs rcx, 0x54d0d578dd592411
movabs r8, 0xa169ffb17427e62f
xor rcx, r8
add rax, rcx
mov qword [rsp + 0x48], rax
movabs rcx, 0xe3747ef65a16c12
movabs r8, 0xf1c8b8109a5e93ed
xor rcx, r8
xor rdx, rcx
xor rax, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
mov rcx, 0xffffffffffffffff
movabs r8, 0x83a6e706bece6c45
xor rcx, r8
or rax, rdx
movabs rdx, 0x83a6e706bece6c45
or rcx, rdx
xor rax, 0xffffffffffffffff
and rax, rcx
cmp rax, 0
jge 0x14014272a
call fcn.140007e9d
jmp 0x1401428b5
mov eax, dword [0x140258d28]
add eax, dword [0x140258d2c]
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0x91c9336
add eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x8f9b7ee
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0xe71074d6
xor r8d, 0xefe9c338
mov edx, eax
and edx, r8d
or eax, 0x8f9b7ee
imul eax, edx
add eax, ecx
and eax, 0x95a5b482
cmp eax, 0x20cd3c70
jae 0x1401428bb
mov rcx, qword [rsp + 0x48]
mov eax, dword [0x140258d30]
sub eax, dword [0x140258d34]
mov r8d, 0xa3d4b893
xor edx, edx
div r8d
mov edx, eax
mov r8d, 0x69679f5
xor r8d, 0xb1051bef
mov eax, edx
and eax, r8d
or edx, 0xb793621a
add eax, edx
mov edx, eax
add edx, 1
mov r8d, 0xcadbd466
xor r8d, 0x35242b99
xor eax, r8d
mov r8d, 0x54c1c08
xor r8d, 0x104df746
or eax, r8d
add eax, edx
cmp rcx, 0
setl cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x7c47b10b
jae 0x14014278e
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x140142814
jmp 0x140142851
mov rcx, qword [rsp + 0x48]
movabs rdx, 0xbfd9e0aa81354bd8
movabs rax, 0xbfd9e0aa81354bd8
xor rdx, rax
movabs r8, 0xa9242cf0b663020d
movabs rax, 0xd6dbd30f499cfdf2
xor r8, rax
call fcn.14000cee2
jmp 0x1401428b5
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
call fcn.140014c40
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov edx, 4
call fcn.14013f860
mov rcx, rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rcx
cmp byte [rax], 0
jne 0x1401428b5
mov rcx, qword [rsp + 0x20]
movabs r8, 0x2d820fec3b629524
movabs rax, 0x2d820fec3b629520
xor r8, rax
lea rdx, [rsp + 0x50]
call fcn.14013fbe0
nop
add rsp, 0x58
ret
in eax, 0xe7
and al, 0xee
jmp 0x14014278e
Function at 0x140144e60
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rcx
call fcn.140149380
mov rcx, qword [rsp + 0x28]
add rax, 0x50
mov qword [rsp + 0x30], rax
xor eax, eax
cmp rcx, 0
mov qword [rsp + 0x38], rax
je 0x140144f72
mov rcx, qword [rsp + 0x28]
xor eax, eax
cmp word [rcx], 0x5a4d
mov qword [rsp + 0x38], rax
jne 0x140144f72
mov cx, 0x90b7
xor cx, 0x9a72
call fcn.140068928
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x24], eax
xor eax, eax
cmp byte [rcx], 0
mov qword [rsp + 0x38], rax
jne 0x140144f72
mov ecx, dword [rsp + 0x24]
mov rax, qword [rsp + 0x28]
mov edx, dword [rax + 0x3c]
mov dword [rsp + 0x20], edx
xor eax, eax
cmp ecx, edx
mov qword [rsp + 0x38], rax
jl 0x140144f72
mov eax, dword [rsp + 0x20]
movsxd rcx, eax
movabs rdx, 0x51c175ba2607a8c6
movabs rax, 0x51c175ba2607a8c7
xor rdx, rax
lea r8, [rsp + 0x40]
call fcn.140144f7c
test al, 1
jne 0x140144f1f
jmp 0x140144f30
call fcn.140007e9d
xor eax, eax
mov qword [rsp + 0x38], rax
jmp 0x140144f72
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
and rax, rdx
movabs r8, 0x6aee892437e3d617
movabs r9, 0x6aee892437e3d615
xor r8, r9
imul rax, r8
xor rcx, rdx
add rcx, rax
xor eax, eax
cmp dword [rcx], 0x4550
cmove rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
add rsp, 0x48
ret
Function at 0x140145349
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xb8
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rcx
call fcn.140149380
mov qword [rsp + 0x78], rax
add rax, 0x50
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0xa8]
add rax, 8
mov qword [rsp + 0x68], rax
mov qword [rsp + 0xa8], 2
mov ecx, 2
mov r8d, 1
mov rdx, r8
call fcn.140019c70
mov qword [rsp + 0x70], rax
mov qword [rsp + 0xb0], rax
mov ecx, 0x40b
call fcn.140068bb0
mov cl, al
mov rax, qword [rsp + 0x78]
mov byte [rsp + 0x87], cl
cmp byte [rax + 0x50], 0
jne 0x140145541
mov rax, qword [rsp + 0x70]
mov cl, byte [rsp + 0x87]
mov byte [rax + 8], cl
mov ecx, 0x1a8
call fcn.140068bb0
mov cl, al
mov rax, qword [rsp + 0x60]
mov byte [rsp + 0x4f], cl
mov al, byte [rax]
mov cl, 0xb3
xor cl, 0xb3
cmp al, cl
jne 0x140145541
mov cl, byte [rsp + 0x4f]
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov byte [rax + 9], cl
call fcn.140149380
xor eax, eax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
cmp rax, 8
je 0x14014544d
mov rax, qword [rsp + 0x38]
mov cl, 0x2c
xor cl, 0x2c
mov byte [rsp + rax + 0xa0], cl
add rax, 1
mov qword [rsp + 0x40], rax
jmp 0x14014541a
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x98], rax
movabs r8, 0xae7db78364843ead
movabs rax, 0xae7db78364843ea5
xor r8, rax
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x98]
call fcn.140145580
xor eax, eax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dl, byte [rsp + rax + 0xa0]
lea rcx, [rsp + 0xa8]
call fcn.1400245b0
mov rax, qword [rsp + 0x28]
mov rcx, rax
and rcx, 1
shl rcx, 1
movabs rdx, 0x6348b129c554d41f
movabs r8, 0x6348b129c554d41e
xor rdx, r8
xor rax, rdx
add rax, rcx
cmp rax, 8
mov qword [rsp + 0x30], rax
jne 0x14014548d
mov ecx, 0x4d1
call fcn.140068bb0
mov cl, al
mov rax, qword [rsp + 0x60]
mov byte [rsp + 0x27], cl
cmp byte [rax], 0
jne 0x140145541
mov dl, byte [rsp + 0x27]
lea rcx, [rsp + 0xa8]
call fcn.1400245b0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov r8, qword [rax]
mov rdx, r8
add rdx, 8
xor eax, eax
cmp r8, 0
cmove rdx, rax
mov r8, qword [rsp + 0xa8]
call fcn.140145244
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x88]
call fcn.140024546
nop
add rsp, 0xb8
ret
Function at 0x14014c9c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x10
lea rbp, [rsp + 0x10]
mov eax, dword [0x140259058]
mov ecx, dword [0x14025905c]
xor ecx, 0xa4ee46ce
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
or eax, 0x7ab108ee
xor eax, 0xffffffff
or ecx, 0x7ab108ee
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
and eax, 0x296bf463
mov edx, eax
xor edx, 0xffffffff
and edx, 0xc254bcc3
mov r8d, 0xffffffff
xor r8d, 0xc254bcc3
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xc254bcc3
or eax, 0xc254bcc3
imul eax, edx
add eax, ecx
cmp eax, 0x79581fc8
jb 0x14014cc2e
mov eax, dword [0x140259060]
mov ecx, dword [0x140259064]
mov r8d, eax
xor r8d, ecx
not r8d
mov edx, ecx
and edx, r8d
add edx, edx
sub ecx, edx
add eax, ecx
mov ecx, eax
imul rcx, rcx, 0x2e4e7a27
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
or eax, 0xe0f042
imul eax, eax, 0xdae0f1b2
mov dword [rbp - 8], eax
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x10], rax
sub rsp, 0x20
call fcn.140149d50
add rsp, 0x20
mov eax, dword [rbp - 8]
mov rcx, qword [0x140269940]
mov rcx, qword [rcx]
movabs rdx, 0x21834c119162b143
movabs r8, 0x21834c119162b143
xor rdx, r8
cmp rcx, rdx
sete cl
mov byte [rbp - 1], cl
cmp eax, 0xd8c257b8
ja 0x14014ca3c
mov al, byte [rbp - 1]
test al, 1
jne 0x14014cae9
jmp 0x14014cb66
mov ecx, 0x40
mov edx, 8
sub rsp, 0x20
call fcn.1400132f0
add rsp, 0x20
mov rcx, rax
mov rax, qword [0x1402696e8]
mov qword [rcx], rax
lea rax, [0x1402689d8]
mov qword [rcx + 0x10], rax
mov rax, qword [0x140268a88]
mov qword [rcx + 0x18], rax
mov rax, qword [0x140268a90]
mov qword [rcx + 0x20], rax
mov qword [rcx + 8], 0
lea rdx, [0x1402689d8]
lea r8, [0x140268a98]
lea r9, [0x1402689f2]
sub rsp, 0x30
mov qword [rsp + 0x20], 0x394e668f
call fcn.1400127b0
add rsp, 0x30
jmp 0x14014cb8c
mov rcx, qword [rbp - 0x10]
mov rax, qword [0x140269940]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.14014c1d0
add rsp, 0x20
mov eax, dword [0x140259068]
xor eax, 0xcb3d7e71
xor edx, edx
div dword [0x14025906c]
mov ecx, 0xd8f3f2db
xor edx, edx
div ecx
xor eax, 0x796f5f46
mov ecx, 0x2b37d428
xor ecx, 0x2f7a1777
xor edx, edx
div ecx
cmp eax, 0x8b994654
je 0x14014cc37
mov eax, dword [0x140259070]
mov r8d, dword [0x140259074]
mov edx, 0x815a6ed7
xor edx, 0x7ea59128
mov ecx, eax
xor ecx, edx
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x40fccb2e
xor ecx, 0xbda8edcb
xor edx, edx
div ecx
and eax, 0xfa23ceb5
imul eax, eax, 0x14d559c1
cmp eax, 0x64e96d8
ja 0x14014cc37
mov rsp, rbp
pop rbp
ret
lodsb al, byte [rsi]
xor dword [rbx + 0xc], ebx
jmp 0x14014ca3c
mov edi, 0xe906ce34
xchg edi, edi
invalid
Function at 0x1401590b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x20
mov qword [rsp + 0x18], rcx
mov eax, dword [0x1402595d8]
mov ecx, 0x62bb5cf0
xor ecx, 0xa28aac51
xor eax, ecx
mov edx, dword [0x1402595dc]
mov ecx, 0x29a1d98b
xor ecx, 0x29a1d98b
sub ecx, edx
sub eax, ecx
mov edx, 0xb7f8d798
xor edx, 0x65e78054
mov ecx, 0x311455fe
xor ecx, 0xceebaa01
xor edx, ecx
mov ecx, eax
and ecx, edx
mov r8d, 0x7efbd30b
xor r8d, 0xace484c7
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
mov ecx, 0x6362642c
xor ecx, 0x138ed926
and eax, ecx
mov ecx, 0x1f1b5af4
xor ecx, 0x166f66e5
or eax, ecx
cmp eax, 0x501ff746
jbe 0x1401591bc
mov rcx, qword [rsp + 0x18]
mov eax, dword [0x1402595e0]
add eax, dword [0x1402595e4]
mov r8d, 0xd34465da
xor edx, edx
div r8d
xor eax, 0x4d6ab85f
mov edx, 0x3a64e973
xor edx, 0x81d9a6f7
add eax, edx
mov rcx, qword [rcx]
mov qword [rsp + 8], rcx
cmp qword [rcx + 0x10], 0
sete cl
mov byte [rsp + 0x17], cl
cmp eax, 0xe62a5d72
je 0x140159138
mov cl, byte [rsp + 0x17]
xor eax, eax
test cl, 1
mov byte [rsp + 7], al
jne 0x14015919d
jmp 0x1401591ae
mov rax, qword [rsp + 8]
cmp qword [rax + 0x20], 0
sete al
mov byte [rsp + 7], al
mov al, byte [rsp + 7]
and al, 1
movzx eax, al
add rsp, 0x20
ret
in eax, dx
push r13
insd dword [rdi], dx
jmp 0x140159138
Function at 0x140168640
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
add rcx, 8
mov qword [rsp + 0x48], rcx
xor eax, eax
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
cmp rax, qword [rcx]
jge 0x1401687a3
mov ecx, dword [0x140259e20]
mov eax, dword [0x140259e24]
mov edx, 0xad6f79f3
xor edx, 0xfeb7edcd
xor eax, edx
and ecx, eax
xor ecx, 0x8b57742b
mov eax, ecx
and eax, eax
xor eax, 0xffffffff
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x28e0b444
or eax, edx
mov edx, 0xffffffff
xor edx, 0x28e0b444
mov r8d, 0xffffffff
xor r8d, 0x28e0b444
or edx, r8d
and ecx, edx
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
mov ecx, eax
xor ecx, 0xc86e4440
mov edx, 0xfabf600c
xor edx, 0x32d1244c
mov r8d, 0x301aec8c
xor r8d, 0xcfe51373
xor edx, r8d
and eax, edx
shl eax, 1
sub eax, ecx
cmp eax, 0xba28aaf7
jbe 0x1401687a8
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
mov eax, dword [0x140259e28]
xor edx, edx
div dword [0x140259e2c]
mov edx, eax
mov rax, qword [rsp + 0x30]
mov r9d, 0xb4ca7036
xor r9d, 0xaa41ef41
sub edx, r9d
sub edx, 0x8999fa48
xor edx, 0xff15ec75
mov dword [rsp + 0x24], edx
mov rcx, qword [rcx]
add rcx, 8
shl rax, 3
add rcx, rax
lea rdx, [0x1402596c8]
call fcn.1401687c0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x24]
and al, 0x24
movabs rdx, 0xb54b625e802abedf
movabs r8, 0xb54b625e802abede
xor rdx, r8
add rcx, rdx
mov qword [rsp + 0x28], rcx
cmp eax, 0x89d6acf9
jbe 0x140168708
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
jmp 0x14016865e
add rsp, 0x58
ret
jae 0x140168767
cwde
notrack jmp 0x140168708