joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023b90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov rdx, qword [rcx]
mov rax, rdx
add rax, 0xffffffffffffffff
mov qword [rsp + 0x50], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
movabs rdx, 0x655c4c6fe6968e4f
movabs r8, 0x9aa3b390196971b0
xor rdx, r8
cmp rax, rdx
setg al
and al, cl
test al, 1
jne 0x140023bfe
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
add rcx, 8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
jmp 0x140023c08
call fcn.1400077a3
jmp 0x140023d2b
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
cmp rax, rcx
jl 0x140023d1e
mov rax, qword [rsp + 0x28]
movabs rcx, 0xb965efa0f19b4813
movabs rdx, 0xb965efa0f19b4813
xor rcx, rdx
cmp rax, rcx
jl 0x140023c58
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
cmp rax, qword [rcx]
jl 0x140023c65
mov rcx, rdx
call fcn.140013580
jmp 0x140023d2b
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
add rcx, 8
shl rax, 3
add rcx, rax
call fcn.140023ab0
mov rcx, qword [rsp + 0x28]
movabs rdx, 0x63a954fd4d3b22d4
mov rax, rcx
sub rax, rdx
movabs rdx, 0x3c11b48064ac336e
movabs r8, 0xc3ee4b7f9b53cc91
xor rdx, r8
add rax, rdx
movabs rdx, 0x63a954fd4d3b22d4
add rax, rdx
mov rdx, rax
xor rdx, rcx
movabs r8, 0x5becf6d657f6b440
movabs r9, 0x5becf6d657f6b440
xor r8, r9
cmp rdx, r8
setl dl
cmp rcx, 0
setne cl
or cl, cl
xor cl, 0xff
or dl, dl
xor dl, 0xff
xor cl, 0xff
xor r8d, r8d
xor r8b, 1
xor dl, r8b
and cl, dl
test cl, 1
mov qword [rsp + 0x38], rax
jne 0x140023d14
jmp 0x140023c08
call fcn.1400077a3
jmp 0x140023d2b
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov ecx, dword [0x1401d6288]
sub ecx, dword [0x1401d628c]
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0x904031fb
xor edx, 0x9867b8a5
mov r8d, 0x75517ed7
xor r8d, 0x8aae8128
xor edx, r8d
and eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x827895e
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0xe711316f
xor ecx, 0x3108bd62
xor edx, edx
div ecx
mov ecx, 0x15def19f
xor edx, edx
div ecx
mov ecx, 0xca66b403
xor ecx, 0xc7f19451
cmp eax, ecx
jae 0x140023e2b
mov eax, dword [0x1401d6290]
mov ecx, dword [0x1401d6294]
xor ecx, 0x4cce8422
imul eax, ecx
mov ecx, eax
xor ecx, 0x42a5ba97
xor ecx, 0xffffffff
and ecx, 0x42a5ba97
shl ecx, 1
mov edx, 0x54cb3fbb
xor edx, 0x166e852c
sub ecx, edx
sub eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x6d3eba1f
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0xf8ac30ca
xor r8d, 0x95928ad5
mov edx, eax
and edx, r8d
mov r8d, 0xfb42cc41
xor r8d, 0x967c765e
or eax, r8d
imul eax, edx
add eax, ecx
imul eax, eax, 0x7a5c8788
cmp eax, 0x2e22091c
jbe 0x140023d99
add rsp, 0x58
ret
invalid
Function at 0x140025b50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x140025c34
mov eax, dword [0x1401d6388]
mov ecx, dword [0x1401d638c]
add eax, 0xf045b18a
sub eax, ecx
sub eax, 0xf045b18a
mov ecx, 0xaf41fff5
xor edx, edx
div ecx
imul eax, eax, 0xb60fa8e5
mov ecx, eax
xor ecx, 0xbf115670
mov edx, 0xc28da3d1
xor edx, 0x7d9cf5a1
mov r8d, 0xc500baae
xor r8d, 0x3aff4551
xor edx, r8d
and eax, edx
shl eax, 1
sub eax, ecx
cmp eax, 0xa33c5a50
ja 0x140025ced
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401d6390]
or eax, dword [0x1401d6394]
mov r8d, 0xd3acf339
xor edx, edx
div r8d
mov r8d, 0x92d11c9b
xor r8d, 0x89488f1e
mov edx, eax
xor edx, r8d
mov r8d, 0xc3578d6a
xor r8d, 0x3ca87295
xor edx, r8d
and edx, 0x1b999385
shl edx, 1
sub edx, 0x1b999385
sub eax, edx
or eax, 0x399b8a77
mov dword [rsp + 0x2c], eax
call fcn.14000eb06
mov eax, dword [rsp + 0x2c]
cmp eax, 0x8690b19c
ja 0x140025bc3
jmp 0x140025c34
mov eax, dword [0x1401d6398]
xor eax, 0x6328d79b
sub eax, dword [0x1401d639c]
mov ecx, 0x6f2b0c4a
xor ecx, 0x4a27a8d4
mov edx, 0xb29ef531
xor edx, 0x4d610ace
xor ecx, edx
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
mov ecx, 0xab1aec13
xor edx, edx
div ecx
mov ecx, eax
mov eax, 0x88e7aaa5
xor eax, 0x7718555a
mov edx, ecx
xor edx, eax
mov eax, 0xe3a32a5d
xor eax, 0x503a99e8
and eax, edx
mov edx, 0xffffffff
xor edx, 0xb399b3b5
and ecx, edx
or eax, ecx
cmp eax, 0xda47a251
jae 0x140025cf6
mov eax, dword [0x1401d63a0]
add eax, dword [0x1401d63a4]
mov ecx, eax
and ecx, 0xa1638387
shl ecx, 1
mov edx, 0x577f581a
xor edx, 0xf61cdb9d
add eax, edx
sub eax, ecx
mov ecx, 0x11676501
xor ecx, 0x8fa196ee
sub eax, ecx
and eax, 0x814aa568
cmp eax, 0xf50eba3b
je 0x140025ca5
add rsp, 0x38
ret
cmpsd dword [rsi], dword [rdi]
xor eax, 0xcde9e669
invalid
invalid
Function at 0x140027a50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401d6458]
imul eax, dword [0x1401d645c]
mov ecx, 0xa7bda792
xor ecx, 0x5842586d
mov r11d, eax
xor r11d, ecx
mov ecx, eax
xor ecx, 0xffffffff
or r11d, ecx
and r11d, 0xaa917d4d
xor r11d, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xaa917d4d
mov edx, 0xffffffff
xor edx, 0xaa917d4d
or ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
and r11d, eax
xor r11d, 0xffffffff
mov eax, 0x84a513ef
xor eax, 0x7b5aec10
mov ecx, r11d
xor ecx, eax
and ecx, 0x5f2bb65d
mov edx, 0xffffffff
xor edx, 0x5f2bb65d
mov eax, r11d
and eax, edx
imul eax, ecx
mov ecx, r11d
and ecx, 0x5f2bb65d
or r11d, 0x5f2bb65d
imul r11d, ecx
add r11d, eax
mov eax, 0x1fe08d51
xor eax, 0xe01f72ae
mov ecx, r11d
xor ecx, eax
mov r8d, 0xffffffff
xor r8d, 0x4b26f755
mov edx, 0xffffffff
xor edx, 0xf4c4b773
mov eax, ecx
and eax, 0xf4c4b773
and r11d, edx
mov r10d, 0x8cbca40a
xor r10d, 0x78781379
mov r9d, r8d
and r9d, r10d
mov r10d, edx
and r10d, 0x4b26f755
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
mov r8d, 0x223c3d38
xor r8d, 0xddc3c2c7
xor ecx, r8d
or edx, 0xf4c4b773
and ecx, edx
or eax, ecx
cmp eax, 0x6d2eba28
jb 0x140027c05
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401d6460]
xor eax, 0x848a4e56
mov edx, dword [0x1401d6464]
mov r8d, 0x75bbac20
xor r8d, 0x494265d1
xor edx, r8d
or eax, edx
or eax, 0xba3b932a
mov r8d, 0x22975459
xor edx, edx
div r8d
mov r8d, 0x8af1c836
xor r8d, 0x8af1c837
mov edx, eax
add edx, r8d
mov r8d, 0x41751f67
xor r8d, 0xbe8ae098
xor eax, r8d
or eax, 0xbfe60f25
add eax, edx
mov dword [rsp + 0x24], eax
xor eax, eax
mov edx, eax
call fcn.140027220
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
call fcn.140027610
mov eax, dword [rsp + 0x24]
cmp eax, 0x1a8060ac
jae 0x140027b74
add rsp, 0x38
ret
pop rbx
invalid
Function at 0x140030480
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x40], rcx
add rcx, 8
mov qword [rsp + 0x48], rcx
xor eax, eax
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov qword [rsp + 0x38], rdx
cmp rax, rcx
jge 0x1400305c4
mov eax, dword [0x1401d6888]
imul eax, dword [0x1401d688c]
xor ecx, ecx
sub ecx, 0x6f3e5c9a
add eax, ecx
mov ecx, 0xadae134c
xor edx, edx
div ecx
mov ecx, 0xec76b848
xor edx, edx
div ecx
mov ecx, 0xc519b3b5
xor ecx, 0x2f7c8aab
cmp eax, ecx
ja 0x1400305e3
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov edx, dword [0x1401d6890]
sub edx, dword [0x1401d6894]
and edx, 0x725743c2
mov r9d, edx
xor r9d, 0xe778d956
mov r8d, 0xf1aeba7d
xor r8d, 0xe514582
xor r9d, r8d
and r9d, 0xe778d956
mov r8d, 0x710eb45e
xor r8d, 0x710eb45c
imul r8d, r9d
mov r9d, 0xc97605af
xor r9d, 0x2e0edcf9
sub r8d, r9d
sub edx, r8d
and edx, 0xbb22fe3
mov dword [rsp + 0x24], edx
add rax, 8
shl rcx, 4
add rax, rcx
mov rcx, qword [rax]
mov qword [rsp + 0x58], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x58]
call fcn.14002d750
mov rdx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x24]
mov rcx, rdx
and rcx, 1
or rdx, 1
add rcx, rdx
mov qword [rsp + 0x28], rcx
cmp eax, 0xfe35891f
ja 0x1400304fd
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
jmp 0x140030499
mov rax, qword [rsp + 0x38]
cmp rax, 0
je 0x1400305dd
mov rcx, qword [rsp + 0x38]
call fcn.14000eb06
nop
add rsp, 0x68
ret
lahf
add dword [rcx], 0xff11e931
invalid
Function at 0x140035470
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
call fcn.140033278
mov r8, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
xor eax, eax
test r8, r8
cmovg rax, r8
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
cmp rax, rcx
je 0x140035513
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
shl rdx, 4
add rax, rdx
mov rdx, qword [rax]
mov qword [rsp + 0x58], rdx
mov rax, qword [rax + 8]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x58]
call fcn.140034f60
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x20]
mov cl, byte [rcx]
add rax, 1
cmp cl, 0
mov qword [rsp + 0x50], rax
je 0x1400354a7
jmp 0x140035524
mov rcx, qword [rsp + 0x30]
lea rdx, [0x1401e25a0]
call fcn.140034f60
mov r8d, dword [0x1401d6b20]
mov eax, dword [0x1401d6b24]
mov ecx, 0x409f4581
xor ecx, 0x1196747c
xor eax, ecx
sub r8d, eax
mov eax, r8d
xor eax, 0xffffffff
and eax, 0x1436a609
mov edx, 0xf38e630e
xor edx, 0xe7b8c507
mov ecx, 0x9cb50bc0
xor ecx, 0x634af43f
xor edx, ecx
and r8d, edx
mov ecx, 0xffffffff
xor ecx, 0x1756aa0e
mov r9d, 0xb6a6e996
xor r9d, 0xa2904f9f
and ecx, r9d
and edx, 0x1756aa0e
or eax, r8d
or ecx, edx
xor eax, ecx
imul eax, eax, 0x8cc97985
sub eax, 0x96a03efb
mov ecx, 0x769c023e
xor ecx, 0x2098ba61
cmp eax, ecx
jbe 0x1400355f8
mov eax, dword [0x1401d6b28]
mov edx, dword [0x1401d6b2c]
mov ecx, 0x772c95ff
xor ecx, 0xcc0d2359
xor edx, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
imul eax, eax, 0x2e70a3c1
mov ecx, 0x24240c7e
xor ecx, 0xc267a159
and eax, ecx
mov ecx, 0x158d5fed
xor edx, edx
div ecx
cmp eax, 0xb4ab477a
ja 0x1400355ad
add rsp, 0x68
ret
add byte [rbx + rbp - 0x47], dh
jmp 0x1400355ad
Function at 0x1400455d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0xb0
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x48], r8
mov qword [rbp - 0x10], rdx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rcx
mov eax, 0x10
mov qword [rbp - 0x28], rax
call fcn.1401d4340
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov rcx, rsp
mov qword [rbp - 0x30], rcx
call fcn.1401d4340
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov rcx, rsp
mov qword [rbp - 0x20], rcx
call fcn.1401d4340
sub rsp, rax
Function at 0x14004a390
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
call fcn.1400476b5
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
movdqu xmm0, xmmword [rdx]
movdqu xmmword [rcx], xmm0
mov rax, rcx
add rax, 0x10
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx + 0x10]
call fcn.140046fb0
test al, 1
jne 0x14004a3dc
jmp 0x14004a41b
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call fcn.140049c4c
mov rax, qword [rsp + 0x38]
cmp byte [rax], 0
jne 0x14004a42c
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
movabs rdx, 0x15b36c6a3a95860f
movabs rax, 0x15b36c6a3a958607
xor rdx, rax
call fcn.14000eb78
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
mov qword [rax], rcx
mov ecx, dword [0x1401d7300]
mov edx, dword [0x1401d7304]
xor ecx, 0xffffffff
xor edx, 0xffffffff
mov eax, 0xffffffff
xor eax, 0x1d21b03e
or ecx, edx
or eax, 0x1d21b03e
xor ecx, 0xffffffff
and ecx, eax
mov eax, ecx
and eax, 0xe9e5ffe
xor ecx, 0xe9e5ffe
or eax, ecx
mov r8d, 0xffffffff
xor r8d, 0xc3c459d0
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xc3c459d0
or eax, 0xc3c459d0
imul eax, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0xc3cdcfde
add ecx, eax
xor eax, eax
sub eax, ecx
cmp eax, 0xb5f87a8b
jae 0x14004a4e9
mov eax, dword [0x1401d7308]
and eax, dword [0x1401d730c]
and eax, 0xa7fdac78
mov ecx, 0xe07e02be
xor edx, edx
div ecx
mov ecx, 0xbf9b6596
xor edx, edx
div ecx
mov ecx, 0xc8acbe89
xor ecx, 0x7d0e846a
cmp eax, ecx
jae 0x14004a4ae
add rsp, 0x48
ret
mov eax, 0xe98ddc7f
mov esp, 0x66ffffff
nop word cs:[rax + rax]
Function at 0x14004ec00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
call fcn.1400476b5
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
call fcn.1400476d0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0
jge 0x14004ec73
mov rcx, qword [rsp + 0x50]
movabs rdx, 0x2d7db97a17d31a12
movabs rax, 0x2d7db97a17d31a12
xor rdx, rax
movabs r8, 0x756c02060670b068
movabs rax, 0xa93fdf9f98f4f97
xor r8, rax
call fcn.14000d167
jmp 0x14004ed7f
mov rcx, qword [rsp + 0x50]
call fcn.140047738
mov rcx, rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rcx
cmp byte [rax], 0
jne 0x14004ed7f
mov eax, dword [0x1401d74c0]
sub eax, dword [0x1401d74c4]
mov ecx, 0xffffffff
xor ecx, 0xf1e24ebf
add eax, ecx
add eax, 1
imul eax, eax, 0x93510187
and eax, 0xb5d501b7
cmp eax, 0xe9ff7ba2
je 0x14004ee76
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401d74c8]
xor eax, 0x825bab37
mov r9d, dword [0x1401d74cc]
mov r10d, r9d
xor r10d, 0xffffffff
mov r8d, eax
and r8d, r10d
mov edx, eax
or edx, r10d
xor edx, 0xffffffff
imul edx, r8d
mov r8d, eax
and r8d, r9d
or eax, r9d
imul eax, r8d
add eax, edx
mov r8d, 0xfed101b2
xor edx, edx
div r8d
or eax, 0xc0d3d64e
mov r8d, 0xb321e6d5
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x40]
mov qword [rdx + 0x10], 0
cmp rcx, 0
setl cl
mov byte [rsp + 0x2f], cl
cmp eax, 0xb1bc7ba4
je 0x14004ecc5
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x14004ed53
jmp 0x14004ed70
mov rcx, qword [rsp + 0x30]
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
call fcn.14000d167
jmp 0x14004ed7f
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call fcn.140023547
mov eax, dword [0x1401d74d0]
xor edx, edx
div dword [0x1401d74d4]
mov ecx, 0x8823bf94
xor ecx, 0x9b09cd88
imul eax, ecx
mov edx, 0x43d05ddc
xor edx, 0xbc2fa223
mov ecx, eax
xor ecx, edx
mov edx, eax
xor edx, 0xffffffff
and ecx, edx
mov edx, 0xffffffff
xor edx, 0xb61d2faf
mov r8d, 0xffffffff
xor r8d, 0xb61d2faf
and edx, r8d
or ecx, edx
xor ecx, 0xffffffff
mov edx, 0xdcfb189d
xor edx, 0x6ae63732
or eax, edx
mov edx, 0x68ca05d9
xor edx, 0x9735fa26
xor eax, edx
or ecx, eax
xor ecx, 0xffffffff
mov edx, 0xa383082d
xor edx, 0x2aa3b11b
mov eax, ecx
and eax, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0x1c742e5c
xor edx, 0x9554976a
mov r8d, 0xa23c3312
xor r8d, 0x5dc3cced
xor edx, r8d
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
cmp eax, 0xd31ce83e
je 0x14004ee7f
mov eax, dword [0x1401d74d8]
xor edx, edx
div dword [0x1401d74dc]
mov ecx, 0x8cdc0b36
xor ecx, 0xb446de52
xor edx, edx
div ecx
sub eax, 0xe5b1b4df
or eax, 0x88c52c3e
mov ecx, 0x55d2a64c
xor ecx, 0x58354977
cmp eax, ecx
jbe 0x14004ee32
mov rax, qword [rsp + 0x38]
add rsp, 0x58
ret
invalid
popfq
jmp 0x13fafd7fb
Function at 0x140056880
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x38], rcx
mov eax, 0x20
call fcn.1401d4340
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
sub rsp, 0x20
call fcn.1400476b5
add rsp, 0x20
mov qword [rbp - 0x28], rax
xor eax, eax
mov ecx, eax
sub rsp, 0x20
call fcn.1400564de
mov rcx, qword [rbp - 0x28]
add rsp, 0x20
xor eax, eax
cmp byte [rcx], 0
mov qword [rbp - 0x20], rax
jne 0x140056954
mov ecx, 0x18
mov edx, 8
sub rsp, 0x20
call fcn.1400133d1
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x38]
add rsp, 0x20
mov qword [rbp - 0x40], rax
sub rsp, 0x20
call fcn.14005677d
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x40]
add rsp, 0x20
cmp byte [rcx], 0
mov qword [rbp - 0x20], rax
jne 0x140056954
mov rcx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x30]
mov rdx, qword [rax]
mov qword [rbp - 0x18], rdx
mov rdx, qword [rax + 8]
mov qword [rbp - 0x10], rdx
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
lea rdx, [rbp - 0x18]
sub rsp, 0x20
call fcn.140056535
mov rax, qword [rbp - 0x40]
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x48], rax
mov eax, dword [0x1401d7770]
mov ecx, dword [0x1401d7774]
xor ecx, 0x4762f949
sub eax, 0x71440bdd
add eax, ecx
add eax, 0x71440bdd
mov ecx, 0x82f65472
xor edx, edx
div ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xcee6eaa4
mov r8d, 0xffffffff
xor r8d, 0xcee6eaa4
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xcee6eaa4
mov r8d, 0x6c05b9bb
xor r8d, 0xa2e3531f
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x9271112
mov edx, 0xffffffff
xor edx, 0x9271112
and eax, edx
sub eax, ecx
mov ecx, 0x185e8463
xor ecx, 0xd0f7d97d
cmp eax, ecx
je 0x140056a33
mov eax, dword [0x1401d7778]
mov ecx, dword [0x1401d777c]
xor ecx, 0xea475ca1
imul eax, ecx
mov ecx, 0x75bf97e9
xor edx, edx
div ecx
mov ecx, 0x638cd20
xor ecx, 0xee983062
xor edx, edx
div ecx
add eax, 0x1e06d33b
cmp eax, 0x89490576
jae 0x1400569ed
mov rax, qword [rbp - 0x48]
mov rsp, rbp
pop rbp
ret
int 0xb5
invalid
Function at 0x14005ace0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x18], r8
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401d78c0]
xor edx, edx
div dword [0x1401d78c4]
mov ecx, 0x65169a96
xor ecx, 0xb1ea4b03
xor edx, edx
div ecx
mov ecx, 0xc010058f
xor ecx, 0xaab13bcc
imul eax, ecx
mov ecx, 0x5bcb0416
xor ecx, 0x80c25fa9
add eax, ecx
mov ecx, 0x3ece2494
xor ecx, 0xe2df955b
cmp eax, ecx
jae 0x14005ae25
mov eax, dword [0x1401d78c8]
xor eax, 0x3a8872f2
mov r9d, dword [0x1401d78cc]
mov r8d, r9d
xor r8d, 0xa419c5b9
xor r9d, 0x5be63a46
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
not ecx
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
xor eax, 0x202108
and eax, 0x8022630a
mov dword [rbp - 0x24], eax
mov eax, 0x20
call fcn.1401d4340
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x38], rax
mov eax, 0x10
call fcn.1401d4340
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
sub rsp, 0x20
call fcn.1400476b5
mov r9, qword [rbp - 8]
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x18]
add rsp, 0x20
mov rax, qword [rbp - 0x10]
mov r10, qword [r9]
mov qword [rcx], r10
mov r10, qword [r9 + 8]
mov qword [rcx + 8], r10
mov r9, qword [r9 + 0x10]
mov qword [rcx + 0x10], r9
mov r9, qword [rax]
mov qword [rdx], r9
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14005a743
add rsp, 0x20
mov rcx, rax
mov eax, dword [rbp - 0x24]
mov qword [rbp - 0x20], rcx
cmp eax, 0xed831c9d
je 0x14005ad41
mov rax, qword [rbp - 0x20]
mov rsp, rbp
pop rbp
ret
jbe 0x14005ae8a
fld st(5)
jmp 0x14005ad41
invalid
Function at 0x14005c780
Capabilities:
Encode data using xor

Disassembly:
invalid
sub rsp, 0x50
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x40], rcx
xor eax, eax
cmp rcx, qword [rdx]
mov byte [rsp + 0x4f], al
jne 0x14005c956
mov rcx, qword [rsp + 0x40]
mov al, 1
cmp rcx, 0
mov byte [rsp + 0x4f], al
je 0x14005c956
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rdx, qword [rdx + 8]
add rdx, 8
mov qword [rsp + 0x10], rdx
mov rax, qword [rax + 8]
add rax, 8
mov qword [rsp + 0x18], rax
xor eax, eax
test rcx, rcx
cmovg rax, rcx
mov qword [rsp + 0x20], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 8], rax
mov ecx, dword [0x1401d7940]
imul ecx, dword [0x1401d7944]
mov eax, 0x321b9a97
xor eax, 0x23cb2a88
xor ecx, eax
mov edx, 0xa7838439
xor edx, 0xd161f11b
mov eax, ecx
and eax, edx
mov edx, 0xe9a19cc7
xor edx, 0x165e6338
xor eax, edx
mov edx, 0x95c40b91
xor edx, 0x6a3bf46e
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0x76e27522
or ecx, edx
xor eax, 0xffffffff
mov edx, 0x2a55cc11
xor edx, 0xd5aa33ee
xor ecx, edx
or eax, ecx
mov r8d, 0x5b24cc39
xor r8d, 0xb820c3d2
mov ecx, 0x2eb1910c
xor ecx, 0xd14e6ef3
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xe3040feb
or eax, 0xe3040feb
imul eax, edx
add eax, ecx
mov ecx, 0x2a041fe5
xor ecx, 0xc942fe9d
cmp eax, ecx
je 0x14005c964
mov rdx, qword [rsp + 8]
mov r8, qword [rsp + 0x20]
mov eax, dword [0x1401d7948]
or eax, dword [0x1401d794c]
or eax, 0xa8f2ca87
xor eax, 0x8b40c8fb
sub eax, 0x7a4fa660
mov ecx, 0xbdfdf295
xor ecx, 0x64059f5b
cmp rdx, r8
sete dl
mov byte [rsp + 7], dl
cmp eax, ecx
jae 0x14005c8b3
mov cl, byte [rsp + 7]
xor eax, eax
test cl, 1
mov dword [rsp], eax
jne 0x14005c949
jmp 0x14005c90c
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x18]
mov rax, qword [rsp + 0x10]
movzx eax, byte [rax + rcx]
movzx r8d, byte [rdx + rcx]
mov edx, 0xf75c6388
xor edx, 0xf75c6388
sub edx, r8d
add eax, edx
add rcx, 1
cmp eax, 0
mov qword [rsp + 0x28], rcx
mov dword [rsp], eax
je 0x14005c7f8
mov eax, dword [rsp]
cmp eax, 0
sete al
mov byte [rsp + 0x4f], al
mov al, byte [rsp + 0x4f]
and al, 1
movzx eax, al
add rsp, 0x50
ret
jrcxz 0x14005c967
wait
jmp 0x140051055
Function at 0x14005e720
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
mov rax, rcx
add rax, 0x10
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx + 0x10]
call fcn.14005e8e0
test al, 1
jne 0x14005e74b
jmp 0x14005e758
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call fcn.140010050
mov rax, qword [rsp + 0x38]
mov rcx, rax
add rcx, 0x20
mov qword [rsp + 0x30], rcx
mov rcx, qword [rax + 0x20]
call fcn.14005e8e0
test al, 1
jne 0x14005e77f
jmp 0x14005e78c
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call fcn.140010050
mov rax, qword [rsp + 0x38]
mov rcx, rax
add rcx, 0x30
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax + 0x30]
call fcn.14005e8e0
test al, 1
jne 0x14005e7b3
jmp 0x14005e7c0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
call fcn.140010050
mov rax, qword [rsp + 0x38]
mov rcx, rax
add rcx, 0x40
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax + 0x40]
call fcn.14005e8e0
test al, 1
jne 0x14005e7e7
jmp 0x14005e7f4
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax]
call fcn.140010050
mov eax, dword [0x1401d7a88]
mov ecx, dword [0x1401d7a8c]
mov edx, 0x7af79a9
xor edx, 0xbd617d7a
xor ecx, edx
xor edx, edx
div ecx
xor eax, 0x1a3e884e
mov ecx, 0x5b214331
xor ecx, 0x13a8666d
mov edx, eax
and edx, ecx
or eax, 0x4889255c
add edx, eax
mov ecx, edx
xor ecx, 0x30fc5a3d
mov eax, 0xffffffff
xor eax, 0x30fc5a3d
and edx, eax
mov eax, 0x8fa25776
xor eax, 0x8fa25774
imul eax, edx
sub eax, ecx
cmp eax, 0x8d2bf424
je 0x14005e8cf
mov eax, dword [0x1401d7a90]
mov r8d, dword [0x1401d7a94]
mov ecx, 0xa560c8ac
xor ecx, 0x213c84dc
xor r8d, ecx
mov edx, 0x11e3e097
xor edx, 0xee1c1f68
mov ecx, eax
xor ecx, edx
mov edx, r8d
and edx, ecx
mov ecx, 0x80e49cdc
xor ecx, 0x7f1b6323
mov r9d, r8d
xor r9d, ecx
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
add eax, 0xdd017250
xor eax, 0x1a824213
imul eax, eax, 0xb9a9e164
cmp eax, 0x2c586c8e
je 0x14005e85a
add rsp, 0x48
ret
call qword [rdi - 0x40]
shr cl, 1
invalid