joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140179f70
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x40], rcx
mov eax, 0x10
call fcn.140215890
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
sub rsp, 0x20
call fcn.14018af70
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov qword [rbp - 0x18], rax
add rax, 0x50
mov qword [rbp - 0x30], rax
mov edx, 0x10
sub rsp, 0x20
call fcn.14015f9d2
add rsp, 0x20
lea rcx, [rbp - 0x10]
mov edx, 0x30
sub rsp, 0x20
call fcn.14015f9d2
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
add rsp, 0x20
mov rax, qword [rdx]
mov qword [rcx], rax
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
lea rdx, [rbp - 0x10]
sub rsp, 0x20
call fcn.1400def60
mov rax, qword [rbp - 0x18]
add rsp, 0x20
cmp byte [rax + 0x50], 0
jne 0x14017a15d
mov eax, dword [0x140220c38]
mov ecx, dword [0x140220c3c]
xor ecx, 0x34a512f5
imul eax, ecx
add eax, 0x76fdd30
sub eax, 0xc616689c
sub eax, 0x76fdd30
mov ecx, 0xc48e4208
xor edx, edx
div ecx
mov ecx, 0xc34b7111
xor edx, edx
div ecx
mov ecx, 0x6a30c459
xor ecx, 0x202687c7
cmp eax, ecx
ja 0x14017a1f8
mov edx, dword [0x140220c40]
mov ecx, dword [0x140220c44]
mov eax, ecx
xor eax, edx
xor eax, 0xc05daeab
xor ecx, 0x3fa25154
and edx, ecx
add edx, edx
sub edx, eax
mov eax, edx
and eax, 0x1f7390b2
mov ecx, eax
not ecx
mov r8d, edx
and r8d, 0x9310030
and ecx, 0xd64ad48e
imul ecx, r8d
and edx, 0x16429082
or eax, 0xd64ad48e
imul eax, edx
add eax, ecx
mov ecx, eax
and ecx, 0x337c3de4
add ecx, ecx
sub eax, ecx
add eax, 0xb37c3de4
mov cl, byte [rbp - 0x10]
test cl, cl
sete cl
lea rdx, [rbp - 8]
mov qword [rbp - 0x58], rdx
mov rdx, qword [rbp - 8]
mov qword [rbp - 0x50], rdx
test rdx, rdx
setle dl
or cl, dl
mov byte [rbp - 0x41], cl
cmp eax, 0xa8be9050
je 0x14017a063
mov rcx, qword [rbp - 0x50]
mov dl, byte [rbp - 0x41]
xor eax, eax
test dl, 1
mov qword [rbp - 0x68], rcx
mov byte [rbp - 0x59], al
jne 0x14017a14c
jmp 0x14017a110
mov rcx, qword [rbp - 0x50]
sub rsp, 0x20
call fcn.1400a6522
add rsp, 0x20
mov cl, al
mov rax, qword [rbp - 0x30]
mov byte [rbp - 0x69], cl
mov al, byte [rax]
mov cl, 0x78
xor cl, 0x78
cmp al, cl
jne 0x14017a15d
mov rcx, qword [rbp - 0x58]
mov al, byte [rbp - 0x69]
and al, 1
mov rcx, qword [rcx]
mov qword [rbp - 0x68], rcx
mov byte [rbp - 0x59], al
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x68]
mov dl, byte [rbp - 0x59]
mov byte [rax], dl
mov qword [rax + 8], rcx
mov rax, qword [rbp - 0x28]
mov rax, qword [rax + 8]
mov qword [rbp - 0x78], rax
cmp rax, 0
je 0x14017a1ee
mov rax, qword [rbp - 0x78]
mov rax, qword [rax]
xor rax, 0xffffffffffffffff
mov rdx, 0xffffffffffffffff
movabs rcx, 0x4000000000000000
xor rdx, rcx
mov rcx, 0xffffffffffffffff
movabs r8, 0x12336671a56dba69
xor rcx, r8
or rax, rdx
movabs rdx, 0x12336671a56dba69
or rcx, rdx
xor rax, 0xffffffffffffffff
and rax, rcx
movabs rcx, 0x9c217fe01e5eb240
movabs rdx, 0x9c217fe01e5eb240
xor rcx, rdx
cmp rax, rcx
jne 0x14017a1ee
mov rcx, qword [rbp - 0x78]
sub rsp, 0x20
call fcn.140010918
add rsp, 0x20
mov rax, qword [rbp - 0x40]
lea rsp, [rbp + 0x20]
pop rbp
ret
xchg ecx, eax
invalid
Function at 0x140189aa0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rcx
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rcx], 0
mov rax, rcx
add rax, 8
mov qword [rsp + 0x58], rax
mov qword [rcx + 8], 0
mov rdx, qword [rdx]
call fcn.140023c40
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
add rdx, 8
mov qword [rsp + 0x70], rdx
mov rcx, qword [rcx]
xor eax, eax
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
cmp rax, rcx
jge 0x140189c31
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x58]
mov r9, qword [rcx]
mov r9, qword [r9 + rdx*8 + 8]
mov r8, qword [r8]
mov qword [r8 + rdx*8 + 8], r9
mov rcx, qword [rcx]
mov rcx, qword [rcx + rdx*8 + 8]
mov qword [rsp + 0x30], rcx
cmp rcx, 0
mov qword [rsp + 0x38], rax
je 0x140189c11
mov eax, dword [0x140221158]
mov edx, dword [0x14022115c]
mov ecx, eax
and ecx, edx
shl ecx, 1
add eax, edx
sub eax, ecx
mov ecx, 0x9929d9f3
xor ecx, 0x8612cdb8
imul eax, ecx
mov ecx, 0x2a2c48a0
xor edx, edx
div ecx
or eax, 0x3e1e06ce
mov ecx, 0x8faac7b3
xor ecx, 0x26b6aa18
cmp eax, ecx
jae 0x140189c3e
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x140221160]
xor eax, dword [0x140221164]
imul eax, eax, 0x75d08e60
mov r8d, 0x44e4a163
xor r8d, 0xd2e77f78
xor edx, edx
div r8d
mov edx, 0x5a9ecc1
xor edx, 0xa671706d
add eax, edx
mov dword [rsp + 0x24], eax
call fcn.140166d43
mov rcx, qword [rsp + 0x68]
mov eax, dword [rsp + 0x24]
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
cmp eax, 0xa99b521f
jae 0x140189ba7
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
jmp 0x140189c11
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
add rax, 1
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
jmp 0x140189b01
mov rax, qword [rsp + 0x50]
add rsp, 0x88
ret
invalid
Function at 0x14018bed0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rcx
call fcn.14018b689
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
add rcx, 8
mov qword [rsp + 0x48], rcx
xor eax, eax
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov qword [rsp + 0x30], rdx
cmp rax, rcx
jge 0x14018c029
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.14018b6b0
test al, 1
jne 0x14018bf41
jmp 0x14018c016
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.14018bbd0
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x14018c063
mov eax, dword [0x140221258]
mov ecx, 0xc81b6f1
xor ecx, 0x9775d651
xor eax, ecx
or eax, dword [0x14022125c]
mov ecx, 0x736a96bd
xor ecx, 0xfd235e6e
imul eax, ecx
mov ecx, 0x803e67a8
xor ecx, 0xeb45d0ea
xor eax, ecx
mov ecx, 0x19acdbd
xor ecx, 0xb5809a0a
and eax, ecx
cmp eax, 0x1096a511
je 0x14018c186
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x140221260]
and eax, dword [0x140221264]
or eax, 0x3b2a6e2c
mov r8d, 0x660d45c8
xor r8d, 0xcdc52cf6
xor edx, edx
div r8d
mov r8d, 0xe753a485
xor edx, edx
div r8d
mov edx, eax
mov rax, qword [rsp + 0x48]
mov dword [rsp + 0x24], edx
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
mov edx, 8
call fcn.14001096f
mov eax, dword [rsp + 0x24]
cmp eax, 0x663f0f77
ja 0x14018bfb2
jmp 0x14018c016
mov rax, qword [rsp + 0x28]
add rax, 1
mov qword [rsp + 0x50], rax
jmp 0x14018bef8
mov rax, qword [rsp + 0x30]
cmp rax, 0
je 0x14018c063
mov rcx, qword [rsp + 0x30]
movabs rax, 0x4000000000000000
and rax, qword [rcx]
cmp rax, 0
jne 0x14018c063
mov rcx, qword [rsp + 0x30]
mov edx, 8
call fcn.14001091d
mov eax, dword [0x140221268]
xor edx, edx
div dword [0x14022126c]
mov ecx, 0x587a859b
xor edx, edx
div ecx
or eax, 0xd36ac3fb
or eax, 0x90614
cmp eax, 0x41cea670
jbe 0x14018c18f
mov eax, dword [0x140221270]
xor eax, 0x44dd381d
mov r8d, dword [0x140221274]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
mov r9d, 0xbd47c50a
xor r9d, 0x42b83af5
xor ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x233862d9
xor edx, edx
div ecx
mov ecx, eax
mov r8d, 0xffffffff
xor r8d, 0x30c57999
mov edx, ecx
and edx, r8d
mov eax, ecx
or eax, r8d
mov r8d, 0x5be678de
xor r8d, 0xa4198721
xor eax, r8d
imul eax, edx
mov edx, ecx
and edx, 0x30c57999
or ecx, 0x30c57999
imul ecx, edx
add ecx, eax
mov eax, ecx
and eax, eax
mov edx, 0xf25c87
xor edx, 0xff0da378
xor eax, edx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xd517449
or eax, edx
mov edx, 0x854f7cdf
xor edx, 0x881e0896
mov r8d, 0x4b5667f2
xor r8d, 0x460713bb
and edx, r8d
xor edx, 0xffffffff
xor ecx, 0xffffffff
mov r8d, 0x966168ae
xor r8d, 0x699e9751
xor edx, r8d
or ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
cmp eax, 0x4331dd66
ja 0x14018c18f
add rsp, 0x58
ret
invalid
jne 0x14018c183
jmp 0x14018bfb2
fnsave dword [0x138023250]
invalid
Function at 0x14018e700
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14019fd7e
mov rdx, qword [rsp + 0x30]
xor eax, eax
test rdx, rdx
cmovg rax, rdx
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
cmp rax, rcx
je 0x14018e777
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov byte [rcx + rax], 0
movabs rcx, 0x71fc6631f2f41c8c
movabs rdx, 0x71fc6631f2f41c8d
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x14018e72d
mov ecx, dword [0x1402213b0]
mov edx, dword [0x1402213b4]
mov eax, ecx
and eax, edx
shl eax, 1
xor ecx, edx
add ecx, eax
mov eax, ecx
and eax, 0xd425595b
xor eax, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0x494858cf
xor edx, 0x9d6d0194
mov r8d, 0xea3aa2ea
xor r8d, 0x15c55d15
xor edx, r8d
or ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0x842b5863
xor ecx, 0x3c2c00c
add eax, ecx
mov ecx, 0xb1e4a52c
xor ecx, 0xa26fad13
or eax, ecx
cmp eax, 0x7c489d6
jbe 0x14018e826
mov eax, dword [0x1402213b8]
mov ecx, dword [0x1402213bc]
xor ecx, 0xae988867
sub eax, ecx
imul eax, eax, 0x251890f2
sub eax, 0x1f4c6380
mov ecx, eax
and ecx, 0xfa85cee4
shl ecx, 1
xor eax, 0xfa85cee4
add eax, ecx
cmp eax, 0xbc1637a4
je 0x14018e7e5
add rsp, 0x48
ret
insb byte [rdi], dx
stc
pop rax
jmp 0x14018e7e5
Function at 0x14019fb70
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
call fcn.14019fd7e
mov rcx, qword [rsp + 0x40]
cmp rcx, 0
je 0x14019fd2b
mov rax, qword [rsp + 0x40]
movabs rcx, 0xdd868bab53461d3a
movabs rdx, 0xf599d62e3f0715c6
xor rcx, rdx
add rax, rcx
add rax, 0xfffffffffffffff0
movabs rcx, 0x281f5d856c4108fc
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp rax, 0x10
jb 0x14019fd07
mov r8, qword [rsp + 0x38]
mov rcx, r8
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x28], rcx
mov edx, 0xf
sub rdx, r8
mov rax, rcx
xor rdx, rax
and rdx, r8
xor rdx, rax
test rcx, rcx
setns al
or rcx, rdx
sets cl
add al, cl
inc al
test al, 1
jne 0x14019fc16
jmp 0x14019fce6
mov eax, dword [0x140221980]
mov edx, dword [0x140221984]
mov r8d, 0xf861b459
xor r8d, 0xf861b458
mov ecx, eax
add ecx, r8d
xor eax, 0xffffffff
or eax, edx
add eax, ecx
sub eax, 0x9a192df5
mov ecx, eax
and ecx, 0xc578e329
shl ecx, 1
add eax, 0xc578e329
sub eax, ecx
mov edx, 0xe6b5ae65
xor edx, 0x52849b29
mov ecx, eax
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0xb431354c
and eax, edx
shl eax, 1
sub eax, ecx
mov ecx, 0xc4a4313b
xor ecx, 0x77011391
cmp eax, ecx
je 0x14019fd31
mov eax, dword [0x140221988]
add eax, dword [0x14022198c]
mov ecx, 0xc34f83a9
xor ecx, 0x622146c1
add eax, ecx
mov ecx, 0x330631e
xor ecx, 0x3ffd050f
add eax, ecx
mov ecx, 0xe67b0070
xor ecx, 0xf22afe7f
mov edx, 0x49666221
xor edx, 0xb6999dde
xor ecx, edx
add eax, ecx
add eax, 1
mov dword [rsp + 0x24], eax
call fcn.140008bc6
mov eax, dword [rsp + 0x24]
cmp eax, 0x934d2678
je 0x14019fc86
jmp 0x14019fd2b
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov r8, qword [rax]
xor ecx, ecx
call fcn.140011d2a
jmp 0x14019fd2b
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rax]
mov cl, 1
xor cl, 0
and cl, 1
call fcn.140011d2a
mov rcx, qword [rsp + 0x40]
call fcn.140011df0
nop
add rsp, 0x48
ret
and esp, dword [rdi - 0xb3167b]
invalid

Function at 0x14019fd7e
Capabilities:
Get thread local storage value

Disassembly:
mov rax, qword [0x14022dd30]
mov ecx, dword [rax]
jmp fcn.140008650
Function at 0x1401a0e10
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], rcx
mov ecx, dword [0x140221a10]
xor ecx, dword [0x140221a14]
mov r8d, 0x9e96bea3
xor r8d, 0x92f1385
mov eax, 0xa40b13ae
xor eax, 0x5bf4ec51
xor r8d, eax
mov edx, ecx
and edx, r8d
mov eax, ecx
or eax, r8d
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, 0x97b9ad26
mov r8d, 0xf25c87
xor r8d, 0x974bf1a1
or ecx, r8d
imul ecx, edx
add ecx, eax
mov eax, ecx
and eax, 0xfaafdbaa
or ecx, 0xfaafdbaa
add eax, ecx
mov ecx, 0x966168ae
xor ecx, 0x4c890c49
mov edx, eax
and edx, ecx
mov ecx, 0x382d5601
xor ecx, 0x382d5603
imul ecx, edx
add eax, 0xdae864e7
sub eax, ecx
cmp eax, 0x252c5578
je 0x1401a1019
mov rcx, qword [rbp - 8]
mov edx, dword [0x140221a18]
mov eax, dword [0x140221a1c]
or edx, eax
add edx, 0xaee82141
mov eax, edx
xor eax, 0xbec55dd9
and eax, edx
add eax, 0xd50760ad
mov dword [rbp - 0x24], eax
mov eax, 0x10
call fcn.140215890
sub rsp, rax
mov eax, dword [rbp - 0x24]
mov rdx, rsp
mov qword [rbp - 0x20], rdx
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x18], rcx
cmp rcx, 0
sete cl
mov byte [rbp - 9], cl
cmp eax, 0xec5c14ef
je 0x1401a0eaf
mov al, byte [rbp - 9]
test al, 1
jne 0x1401a0f5b
jmp 0x1401a0f1c
mov rax, qword [rbp - 0x18]
mov rcx, qword [rax]
mov rdx, 0xffffffffffffffff
movabs rax, 0x4000000000000000
xor rdx, rax
mov rax, rcx
xor rax, rdx
and rax, rcx
cmp rax, 0
jne 0x1401a0f5b
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call fcn.140010918
add rsp, 0x20
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x18]
mov qword [rbp - 0x30], rax
cmp rax, 0
je 0x1401a0ff3
mov rax, qword [rbp - 0x30]
mov rcx, qword [rax]
movabs rdx, 0x134f6b2e12bcbe41
movabs rax, 0x534f6b2e12bcbe41
xor rdx, rax
mov rax, rcx
and rax, rdx
xor rax, 0xffffffffffffffff
movabs rdx, 0x27064d5176dfc075
movabs r8, 0x67064d5176dfc075
xor rdx, r8
and rcx, rdx
xor rcx, 0xffffffffffffffff
xor rax, 0xffffffffffffffff
movabs rdx, 0xd3aca67d6c37c6e3
movabs r8, 0x2c53598293c8391c
xor rdx, r8
xor rcx, rdx
or rax, rcx
cmp rax, 0
jne 0x1401a0ff3
mov rcx, qword [rbp - 0x30]
sub rsp, 0x20
call fcn.140010918
add rsp, 0x20
mov rcx, qword [rbp - 0x20]
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 0x20]
mov qword [rcx], rdx
mov rax, qword [rax + 0x28]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.140027b90
nop
mov rsp, rbp
pop rbp
ret
invalid
Function at 0x1401ace11
Capabilities:
Get thread local storage value

Disassembly:
mov rax, qword [0x14022dd30]
mov ecx, dword [rax]
jmp fcn.140008650
Function at 0x1401af15c
Capabilities:
Get thread local storage value

Disassembly:
mov rax, qword [0x14022dd30]
mov ecx, dword [rax]
jmp fcn.140008650

Function at 0x1401afb70
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.1401af350
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.1401af460
test al, 1
jne 0x1401afb9a
jmp 0x1401afbc1
mov rcx, qword [rsp + 0x28]
call fcn.1401afa50
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
jne 0x1401afbc1
mov rcx, qword [rsp + 0x28]
mov edx, 8
call fcn.14001096f
mov ecx, dword [0x140221f40]
mov edx, dword [0x140221f44]
xor edx, 0xe6678256
mov eax, ecx
xor eax, edx
mov r8d, 0x8c0216e5
xor r8d, 0x73fde91a
xor eax, r8d
or ecx, edx
and ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x87921ac
and eax, edx
xor ecx, 0xffffffff
mov edx, 0xdbe3cf67
xor edx, 0xd39aeecb
mov r8d, 0xb0b777e
xor r8d, 0xf4f48881
xor edx, r8d
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, eax
and ecx, 0x3a5615d0
shl ecx, 1
add eax, 0x3a5615d0
sub eax, ecx
xor eax, 0xe1825380
cmp eax, 0x35d788a0
jb 0x1401afc9e
mov eax, dword [0x140221f48]
mov ecx, dword [0x140221f4c]
mov edx, 0x2354da7a
xor edx, 0x59de136
xor ecx, edx
and eax, ecx
mov ecx, 0xa2bd74e3
xor ecx, 0x393ec2df
xor eax, ecx
mov ecx, eax
and ecx, 0x5f8287fd
shl ecx, 1
xor eax, 0x5f8287fd
add eax, ecx
or eax, 0x57d8ef6
mov ecx, 0x6c07c93a
xor ecx, 0xed3035a0
cmp eax, ecx
je 0x1401afc47
add rsp, 0x38
ret
invalid
jne 0x1401afc9b
jmp 0x1401afc47
Function at 0x1401c3a4a
Capabilities:
Get thread local storage value

Disassembly:
mov rax, qword [0x14022dd30]
mov ecx, dword [rax]
jmp fcn.140008650

Function at 0x1401c3a90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rcx
call fcn.1401c3c8e
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx]
call fcn.1401c3ca9
test al, 1
jne 0x1401c3abd
jmp 0x1401c3c55
mov eax, dword [0x140222848]
imul eax, dword [0x14022284c]
mov ecx, 0x30e662c4
xor ecx, 0x8e6638d3
or eax, ecx
mov ecx, eax
and ecx, 0xea050181
mov edx, 0x2b1f3b02
xor edx, 0xd4e0c4fd
xor ecx, edx
add eax, 0xea050181
mov edx, 0x61dd5612
xor edx, 0x61dd5613
add eax, edx
add eax, ecx
mov ecx, 0xbb11b8
xor edx, edx
div ecx
cmp eax, 0x5c886def
jae 0x1401c3c7c
mov rax, qword [rsp + 0x38]
mov edx, dword [0x140222850]
xor edx, 0x6c89a69b
or edx, dword [0x140222854]
xor edx, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0xad44acff
mov ecx, 0xffffffff
xor ecx, 0x866cd502
or edx, r8d
or ecx, 0x866cd502
xor edx, 0xffffffff
and edx, ecx
mov ecx, edx
and ecx, 0x8ddcd619
or edx, 0x8ddcd619
add ecx, edx
xor ecx, 0x3494ec69
mov dword [rsp + 0x30], ecx
mov rcx, qword [rax]
call fcn.14008fbef
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x30]
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x37], cl
cmp eax, 0xfb56a70f
jae 0x1401c3c7c
mov al, byte [rsp + 0x37]
test al, 1
jne 0x1401c3ba5
jmp 0x1401c3c76
mov eax, dword [0x140222858]
xor edx, edx
div dword [0x14022285c]
mov ecx, eax
mov eax, ecx
or eax, 0x213ededd
xor eax, 0xffffffff
or ecx, 0x213ededd
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0x390b27c
xor ecx, 0xfc6f4d83
xor eax, ecx
and eax, 0x3bf14d47
mov ecx, 0xa12df7e5
xor ecx, 0x71123d5f
imul eax, ecx
cmp eax, 0x775637e8
je 0x1401c3c85
mov rax, qword [rsp + 0x38]
mov ecx, dword [0x140222860]
xor ecx, 0x1ab1becc
mov edx, dword [0x140222864]
mov r8d, 0xc47fee75
xor r8d, 0x258ef79c
xor edx, r8d
add ecx, edx
add ecx, 0xf23ab175
sub ecx, 0x9df87780
sub ecx, 0x2589e7c3
mov dword [rsp + 0x2c], ecx
mov rcx, qword [rax]
mov edx, 8
call fcn.14001096f
mov eax, dword [rsp + 0x2c]
cmp eax, 0x444a64ed
je 0x1401c3bf5
jmp 0x1401c3c55
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x48], rcx
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
call fcn.14018b330
nop
add rsp, 0x58
ret
lodsd eax, dword [rsi]
xchg edx, eax
jmp 0x1401c3b14
add ecx, 0x77
cmp cl, ch
invalid
Function at 0x1401c6e90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rcx
call fcn.1401c7764
mov rdx, qword [rsp + 0x40]
xor eax, eax
test rdx, rdx
cmovg rax, rdx
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
cmp rax, rcx
je 0x1401c6f70
mov eax, dword [0x140222960]
mov ecx, dword [0x140222964]
xor ecx, 0x5e1840a3
xor edx, edx
div ecx
sub eax, 0x6f57a4d
imul eax, eax, 0xe026d412
or eax, 0xc013e748
cmp eax, 0x175504a7
je 0x1401c6f75
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x140222968]
xor edx, edx
div dword [0x14022296c]
or eax, 0x2b3a2aa2
mov r8d, 0xcef223ce
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x38]
and eax, 0xecd53140
mov r8b, 0xe7
xor r8b, 0xe7
mov byte [rdx + rcx], r8b
xor edx, edx
sub rdx, rcx
xor ecx, ecx
sub rcx, 1
add rdx, rcx
xor ecx, ecx
sub rcx, rdx
mov qword [rsp + 0x28], rcx
cmp eax, 0x7971bccb
je 0x1401c6f06
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
jmp 0x1401c6ebd
add rsp, 0x58
ret
mov dh, 0xa8
loop 0x1401c6f9b
jmp 0x1401c6f06
and al, 0x20
add byte [rax], al
add byte [rax], al
mov rdx, qword [rax + 0x10]
mov r8b, 1
xor r8b, 1
and r8b, 1
lea rcx, [rsp + 0x20]
call fcn.140014240
mov rax, qword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x1401c7764
Capabilities:
Get thread local storage value

Disassembly:
mov rax, qword [0x14022dd30]
mov ecx, dword [rax]
jmp fcn.140008650
Function at 0x1401cd780
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.1401d22f3
mov rdx, qword [rsp + 0x30]
xor eax, eax
test rdx, rdx
cmovg rax, rdx
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
cmp rax, rcx
je 0x1401cd7e1
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov byte [rcx + rax], 0
add rax, 1
mov qword [rsp + 0x40], rax
jmp 0x1401cd7ad
mov eax, dword [0x140222cf8]
xor edx, edx
div dword [0x140222cfc]
and eax, 0x489839db
mov ecx, 0x2274739d
xor edx, edx
div ecx
xor eax, 0xcd06c95d
cmp eax, 0xb38f1923
je 0x1401cd871
mov eax, dword [0x140222d00]
mov edx, dword [0x140222d04]
mov ecx, eax
add ecx, 1
mov r8d, 0x412de783
xor r8d, 0xbed2187c
xor eax, r8d
or eax, edx
add eax, ecx
add eax, 0x16403e51
xor eax, 0xe90a32fe
mov edx, eax
and edx, 0xd42cdb0b
mov ecx, 0x39540147
xor ecx, 0x39540145
imul ecx, edx
add eax, 0xd42cdb0b
sub eax, ecx
mov ecx, 0x33ff63c2
xor ecx, 0x68e0d86d
cmp eax, ecx
jae 0x1401cd80d
add rsp, 0x48
ret
cmp byte [0x13fb0c1a3], r15b
invalid
Function at 0x1401ce4a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x20
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
mov eax, dword [0x140222d68]
xor eax, dword [0x140222d6c]
mov ecx, 0x65841be5
xor ecx, 0x65841be5
mov edx, 0xebcf6ce8
xor edx, 0xcb360d3a
sub ecx, edx
sub eax, ecx
mov ecx, 0x8ce5cba5
xor ecx, 0x3a43e33d
sub eax, ecx
add eax, 0x11c374eb
add eax, 0xb6a62898
mov ecx, 0xb41ff837
xor edx, edx
div ecx
mov ecx, 0xd0bdfb0b
xor ecx, 0x9b3c5c67
cmp eax, ecx
jae 0x1401ce645
mov eax, dword [0x140222d70]
xor eax, 0x34754e2f
mov ecx, dword [0x140222d74]
xor ecx, 0x6d15740e
and eax, ecx
mov ecx, 0x5abffd01
xor edx, edx
div ecx
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0xce5bce1d
add ecx, eax
xor eax, eax
sub eax, ecx
add eax, 0x6962af67
cmp eax, 0x336977b9
jbe 0x1401ce507
xor eax, eax
mov qword [rsp + 8], rax
jmp 0x1401ce556
mov rax, qword [rsp + 8]
mov qword [rsp], rax
cmp rax, 0x10
je 0x1401ce590
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x10]
mov dl, byte [rdx + rax]
mov byte [rcx + rax], dl
xor ecx, ecx
sub rcx, 1
sub rax, rcx
mov qword [rsp + 8], rax
jmp 0x1401ce556
mov ecx, dword [0x140222d78]
mov edx, dword [0x140222d7c]
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov r8d, 0xe2e7556c
xor r8d, 0x1d18aa93
mov ecx, edx
xor ecx, r8d
mov r8d, 0x17ddae3e
xor r8d, 0xe82251c1
xor edx, r8d
or ecx, edx
xor eax, 0xffffffff
mov edx, 0xeca22eef
xor edx, 0x135dd110
xor ecx, edx
or eax, ecx
mov ecx, 0x6b4be26d
xor ecx, 0x43852ca0
and eax, ecx
xor ecx, ecx
sub ecx, 0x97b2a75e
add eax, ecx
xor eax, 0xa0cf272
cmp eax, 0x780c5469
je 0x1401ce64e
mov eax, dword [0x140222d80]
mov ecx, dword [0x140222d84]
xor ecx, 0x2f1db5cc
or eax, ecx
add eax, 0x1eee2e23
add eax, 0x54d7ea3e
sub eax, 0x1eee2e23
imul eax, eax, 0x9632be75
mov ecx, 0xed9a1b4b
xor edx, edx
div ecx
cmp eax, 0x495aeb0
jae 0x1401ce64e
add rsp, 0x20
ret
add r13d, dword es:[r9 - 0x17]
mov ecx, 0x23fffffe
mov ebx, 0xace95b09
and edi, dword [rbx - 0x5316a4f7]
invalid
Function at 0x1401d22f3
Capabilities:
Get thread local storage value

Disassembly:
mov rax, qword [0x14022dd30]
mov ecx, dword [rax]
jmp fcn.140008650