joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e5b80
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rcx
mov rax, qword [rcx]
mov qword [rsp + 0x60], rax
cmp rax, 0
je 0x1400e5d4e
mov ecx, dword [0x1401de438]
sub ecx, dword [0x1401de43c]
sub ecx, 0xaf29d813
mov eax, 0xa3d17556
xor eax, 0xffb4398e
imul ecx, eax
mov eax, ecx
and eax, 0x4845ab71
mov edx, 0x65fae3c8
xor edx, 0x2dbf48b9
xor ecx, edx
or eax, ecx
mov ecx, 0x81808fa5
xor ecx, 0x88a6d81
cmp eax, ecx
je 0x1400e5d53
mov rcx, qword [rsp + 0x60]
mov eax, dword [0x1401de440]
xor edx, edx
div dword [0x1401de444]
mov r8d, 0x48b833ec
xor edx, edx
div r8d
mov edx, 0x53155528
xor edx, 0x91873c0
add eax, edx
mov r8d, 0x8b151dd5
xor r8d, 0x3e24c007
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rdx + 8]
mov rdx, qword [rdx]
mov qword [rsp + 0x40], rdx
cmp rcx, rdx
setg cl
mov byte [rsp + 0x4f], cl
cmp eax, 0x9bd8232a
je 0x1400e5be8
mov rax, qword [rsp + 0x40]
mov cl, byte [rsp + 0x4f]
test cl, 1
mov qword [rsp + 0x30], rax
jne 0x1400e5c86
jmp 0x1400e5c6f
mov rcx, qword [rsp + 0x50]
call fcn.14000f9b0
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x38]
mov r9, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rax + 0x10]
mov r10, rcx
shl r10, 4
mov r8, rax
add r8, r10
mov qword [r8], r9
mov r8, rcx
shl r8, 4
add rax, r8
add rax, 8
mov qword [rax], rdx
mov rdx, 0xffffffffffffffff
xor rdx, 1
xor eax, eax
sub rax, 1
sub rdx, rax
mov rax, rcx
sub rax, rdx
mov qword [rsp + 0x28], rax
mov rdx, rcx
xor rdx, 0xffffffffffffffff
and rdx, 0xffffffffffffffff
mov r8, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
and rcx, r8
or rdx, rcx
xor rax, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
mov rcx, 0xffffffffffffffff
movabs r8, 0x44fe2a8dcc3e4243
xor rcx, r8
or rax, rdx
movabs rdx, 0x44fe2a8dcc3e4243
or rcx, rdx
xor rax, 0xffffffffffffffff
and rax, rcx
cmp rax, 0
jge 0x1400e5d41
call fcn.140007bb8
jmp 0x1400e5d4e
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
add rsp, 0x68
ret
adc eax, 0xe974e97c
invalid
Function at 0x1401050b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov r8d, dword [0x1401df048]
mov edx, dword [0x1401df04c]
xor edx, 0xff04e61f
mov eax, r8d
xor eax, 0xffffffff
mov ecx, 0x4e70233e
xor ecx, 0x4770fd02
and ecx, eax
mov r9d, 0xffffffff
xor r9d, 0x900de3c
and r8d, r9d
mov eax, edx
xor eax, 0xffffffff
and eax, 0x900de3c
and edx, r9d
or ecx, r8d
or eax, edx
xor ecx, eax
mov eax, 0x8850a50e
xor eax, 0x98c91c1a
or ecx, eax
mov edx, 0x30f01fc9
xor edx, 0xcf0fe036
mov eax, ecx
xor eax, edx
mov edx, 0xffffffff
xor edx, 0x4d7b1c41
or eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x4d7b1c41
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
add eax, 0x305ff4c0
mov ecx, 0x14c9807f
xor ecx, 0x67a6e88
cmp eax, ecx
jbe 0x140105379
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x1401df050]
mov r8d, dword [0x1401df054]
xor r8d, 0x1bb5801
xor edx, edx
div r8d
mov edx, eax
mov eax, 0x43138fcf
xor eax, 0x2be37fbd
xor edx, eax
mov eax, edx
and eax, 0xd6bc8213
xor edx, 0xd6bc8213
or eax, edx
mov r8d, 0x6f469bdf
xor r8d, 0x25d15e2f
mov edx, eax
xor edx, r8d
mov r8d, 0xf147246a
xor r8d, 0xeb8db95
xor edx, r8d
mov r8d, 0xecda6d12
xor r8d, 0xa64da8e2
or eax, r8d
and eax, edx
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x30], rcx
cmp rcx, 0
sete cl
mov byte [rsp + 0x3f], cl
cmp eax, 0x5a85f31b
jae 0x140105158
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x140105373
jmp 0x1401051f7
mov eax, dword [0x1401df058]
sub eax, dword [0x1401df05c]
add eax, 0x43b27c80
mov edx, 0xffffffff
xor edx, 0xd9f7e7ea
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0xd9f7e7ea
add eax, edx
sub eax, ecx
mov ecx, 0xec1cbaf4
xor edx, edx
div ecx
mov ecx, 0xb687daff
xor ecx, 0xae501a75
cmp eax, ecx
ja 0x140105382
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401df060]
or eax, dword [0x1401df064]
mov r8d, 0xb9642682
xor r8d, 0xe07af07a
xor edx, edx
div r8d
imul eax, eax, 0xd398d644
mov edx, eax
xor edx, 0xffffffff
mov r8d, 0xa871704b
xor r8d, 0xf3f5e8
and r8d, edx
mov r9d, 0xffffffff
xor r9d, 0xa88285a3
mov edx, eax
and edx, r9d
imul edx, r8d
mov r8d, eax
and r8d, 0xa88285a3
mov r9d, 0xd1ed0595
xor r9d, 0x796f8036
or eax, r9d
imul eax, r8d
add eax, edx
mov rcx, qword [rcx]
movabs rdx, 0xc72e0b3591c133b3
movabs r8, 0x38d1f4ca6e3ecc4c
xor rdx, r8
xor rcx, rdx
mov r8, 0xffffffffffffffff
movabs rdx, 0x4000000000000000
xor r8, rdx
movabs rdx, 0xef280c6046856272
movabs r9, 0xa4df9123a0e1865b
xor rdx, r9
movabs r9, 0x552945cb04f66a67
movabs r10, 0xaad6ba34fb099598
xor r9, r10
xor rdx, r9
or rcx, r8
movabs r8, 0x4bf79d43e664e429
or rdx, r8
movabs r8, 0x83caabcbb6002b19
movabs r9, 0x7c35543449ffd4e6
xor r8, r9
xor rcx, r8
and rcx, rdx
cmp rcx, 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x117619c
jbe 0x140105382
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x140105373
jmp 0x140105369
mov rcx, qword [rsp + 0x40]
call fcn.140013c70
nop
add rsp, 0x48
ret
mov edx, 0xe95a3630
invalid
int1
push rdi
retf 0xe9fd
Function at 0x14010ec20
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rcx
mov rax, qword [rcx]
mov qword [rsp + 0x60], rax
cmp rax, 0
je 0x14010ee69
mov ecx, dword [0x1401df530]
mov eax, 0xde3b68e5
xor eax, 0xa94822c7
xor ecx, eax
sub ecx, dword [0x1401df534]
sub ecx, 0xaf29d813
mov eax, 0xf767bff3
xor eax, 0xab02f32b
imul ecx, eax
mov eax, ecx
and eax, 0x4845ab71
xor ecx, 0x4845ab71
or eax, ecx
cmp eax, 0x890ae224
je 0x14010ee6e
mov rcx, qword [rsp + 0x60]
mov eax, dword [0x1401df538]
xor eax, 0x37f6f2cd
xor edx, edx
div dword [0x1401df53c]
mov r8d, 0x48b833ec
xor edx, edx
div r8d
add eax, 0x5a0d26e8
mov r8d, 0xae117566
xor r8d, 0x1b20a8b4
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rdx + 8]
mov rdx, qword [rdx]
mov qword [rsp + 0x40], rdx
cmp rcx, rdx
setg cl
mov byte [rsp + 0x4f], cl
cmp eax, 0x9bd8232a
je 0x14010ec85
mov rax, qword [rsp + 0x40]
mov cl, byte [rsp + 0x4f]
test cl, 1
mov qword [rsp + 0x30], rax
jne 0x14010ed20
jmp 0x14010ed09
mov rcx, qword [rsp + 0x50]
call fcn.14000f9b0
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x38]
mov r9, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rax + 0x10]
mov r10, rdx
shl r10, 4
mov r8, rax
add r8, r10
mov qword [r8], r9
mov r8, rdx
shl r8, 4
add rax, r8
add rax, 8
mov qword [rax], rcx
mov rcx, 0xffffffffffffffff
xor rcx, 1
movabs rax, 0xcd0e810c633e32fb
movabs r8, 0xcd0e810c633e32fb
xor rax, r8
movabs r8, 0xd1b9fcac1170294a
movabs r9, 0xd1b9fcac1170294b
xor r8, r9
sub rax, r8
sub rcx, rax
mov rax, rdx
sub rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rdx
xor rcx, 0xffffffffffffffff
and rcx, 0xffffffffffffffff
mov r8, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
and rdx, r8
or rcx, rdx
movabs rdx, 0xb3ee0839220b607e
movabs r8, 0x4c11f7c6ddf49f81
xor rdx, r8
xor rax, rdx
xor rcx, 0xffffffffffffffff
movabs rdx, 0x7055dc30ef9a279e
movabs r8, 0x34abf6bd23a465dd
xor rdx, r8
movabs r8, 0xc037757b44fd2f95
movabs r9, 0x3fc88a84bb02d06a
xor r8, r9
xor rdx, r8
or rax, rcx
movabs rcx, 0xd1be41af59f264ac
movabs r8, 0x95406b2295cc26ef
xor rcx, r8
or rcx, rdx
xor rax, 0xffffffffffffffff
and rax, rcx
movabs rcx, 0x4568f2f3008b262d
movabs rdx, 0x4568f2f3008b262d
xor rcx, rdx
cmp rax, rcx
jge 0x14010ee5c
call fcn.140007bb8
jmp 0x14010ee69
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
add rsp, 0x68
ret
adc eax, 0xe974e97c
invalid
Function at 0x14010fb90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov eax, dword [0x1401df570]
xor eax, 0x4d0dc923
add eax, dword [0x1401df574]
and eax, 0x2b4a8fcd
mov ecx, 0xd4790cb7
xor ecx, 0x61ebeca2
xor edx, edx
div ecx
mov ecx, 0xb1a2f918
xor ecx, 0xaf8853dc
xor edx, edx
div ecx
cmp eax, 0x9f4b9971
ja 0x14010fd8e
mov eax, dword [0x1401df578]
and eax, dword [0x1401df57c]
and eax, 0x1cf55a91
mov ecx, 0x1b5c4685
xor ecx, 0x9d1a169d
xor eax, ecx
add eax, 0xe14d4982
mov ecx, 0x201cee19
xor ecx, 0x3486fa47
sub eax, ecx
mov ecx, 0x4861d972
xor ecx, 0xa92c90f0
sub eax, ecx
mov dword [rsp + 0x34], eax
call fcn.14010fa40
mov rcx, qword [rsp + 0x48]
mov rdx, rax
mov eax, dword [rsp + 0x34]
mov qword [rsp + 0x38], rdx
cmp rcx, 0
setg cl
mov byte [rsp + 0x47], cl
cmp eax, 0x639fb713
jb 0x14010fbdd
mov cl, byte [rsp + 0x47]
xor eax, eax
test cl, 1
mov dword [rsp + 0x30], eax
jne 0x14010fc62
jmp 0x14010fc9e
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov r8d, 0xd23baee5
xor r8d, 0x2dc4511a
call fcn.14010f340
mov ecx, eax
mov rax, qword [rsp + 0x38]
mov dl, byte [rax]
xor ecx, 0xffffffff
mov eax, 0xaf27f74e
xor eax, 0xaf27f74e
cmp dl, 0
cmove eax, ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x2c], eax
mov eax, dword [0x1401df580]
xor edx, edx
div dword [0x1401df584]
add eax, 0x855c0f7c
mov ecx, 0x7630938a
xor ecx, 0x903facd6
sub eax, ecx
sub eax, 0x855c0f7c
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0x60cb093c
xor edx, 0xadc58837
and edx, ecx
mov r8d, 0xffffffff
xor r8d, 0xcd0e810b
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0x3ac03084
xor r8d, 0xf7ceb18f
mov edx, eax
and edx, r8d
or eax, 0xcd0e810b
imul eax, edx
add eax, ecx
or eax, 0x89a07fcb
cmp eax, 0xc49e18fa
ja 0x14010fd97
mov eax, dword [0x1401df588]
mov r8d, dword [0x1401df58c]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
xor eax, 0x8397b641
xor eax, 0x46a3d46d
sub eax, 0xa570bda1
mov ecx, 0x52eaaf44
xor ecx, 0xb9bc147d
sub eax, ecx
add eax, 0xa570bda1
mov ecx, 0xf13a3f11
xor ecx, 0x98741c8d
cmp eax, ecx
ja 0x14010fd97
mov eax, dword [rsp + 0x2c]
add rsp, 0x58
ret
adc esp, dword [rdi + 0x46e9f8d0]
invalid
invalid
Function at 0x1401100c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.14011009f
mov rcx, qword [rsp + 0x28]
mov rax, rcx
add rax, 8
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 8]
movabs rcx, 0x79cb76319ea2476
movabs rdx, 0x79cb76319ea2476
xor rcx, rdx
cmp rax, rcx
jle 0x1401101f3
mov eax, dword [0x1401df590]
xor eax, 0xde3b68e5
xor edx, edx
div dword [0x1401df594]
mov ecx, 0xf767bff3
xor ecx, 0xd0645cf8
add eax, ecx
sub eax, 0x6c5ad461
mov edx, eax
xor edx, 0xffffffff
and edx, 0x6e25a4a3
mov r8d, 0xffffffff
xor r8d, 0x6e25a4a3
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0x37f6f2cd
xor r8d, 0x59d3566e
mov edx, eax
and edx, r8d
or eax, 0x6e25a4a3
imul eax, edx
add eax, ecx
cmp eax, 0x9a524e2b
jae 0x1401101f8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov eax, dword [str.M__n]
xor eax, 0x4216fe9b
mov r8d, dword [0x1401df59c]
xor r8d, 0x6074810a
or eax, r8d
mov r9d, 0xb5f8c605
xor r9d, 0x4b407bce
mov r8d, 0x88e23f85
xor r8d, 0x771dc07a
xor r9d, r8d
mov r8d, eax
and r8d, r9d
mov r9d, eax
xor r9d, 0xfeb8bdcb
add eax, r9d
sub eax, r8d
and eax, 0x3e37b307
xor eax, 0xeca3651d
mov r8, qword [rdx]
add r8, 1
mov qword [rdx], r8
mov qword [rcx], 0
cmp eax, 0xb584cb27
jb 0x14011016f
jmp 0x1401101f3
add rsp, 0x38
ret
invalid
Function at 0x140112cc0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rax, qword [rcx]
mov qword [rsp + 0x40], rax
cmp rax, rdx
jg 0x140112d11
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
movabs rax, 0x6517bc196c3861d2
add rdx, rax
add rdx, 0xffffffffffffffff
movabs rax, 0x6517bc196c3861d2
sub rdx, rax
call fcn.140012270
jmp 0x140112d2f
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 8]
add rax, 8
shl rcx, 3
add rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
mov eax, dword [0x1401df670]
and eax, dword [0x1401df674]
add eax, 0x5c63e426
sub eax, 0xa5af698d
sub eax, 0x5c63e426
mov ecx, eax
xor ecx, 0x30187cb3
mov edx, 0xffffffff
xor edx, 0x30187cb3
and eax, edx
shl eax, 1
sub eax, ecx
mov edx, 0xffffffff
xor edx, 0x9c91e747
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0x9c91e747
add eax, edx
sub eax, ecx
cmp eax, 0x576878c0
je 0x140112ddc
mov ecx, dword [0x1401df678]
mov eax, 0x374273bc
xor eax, 0xdea136c8
xor ecx, eax
add ecx, dword [0x1401df67c]
sub ecx, 0x8b2812d4
mov eax, ecx
and eax, 0x987f50e1
xor ecx, 0x987f50e1
or eax, ecx
imul eax, eax, 0xdb0a58fe
cmp eax, 0xaf545f64
jae 0x140112d94
mov rax, qword [rsp + 0x20]
add rsp, 0x48
ret
bnd jmp 0xeffaca23
Function at 0x140112e20
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov eax, dword [0x1401df680]
mov edx, dword [0x1401df684]
mov ecx, eax
xor ecx, 0xffffffff
mov r8d, edx
xor r8d, 0xffffffff
and ecx, r8d
or eax, edx
xor eax, 0xffffffff
or ecx, eax
xor ecx, 0xffffffff
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x5a959964
mov edx, 0xffffffff
xor edx, 0x5a959964
or ecx, edx
xor eax, 0xffffffff
mov edx, 0xbed68cd0
xor edx, 0x4129732f
xor ecx, edx
or eax, ecx
add eax, 0x7f1193eb
mov ecx, 0x6d917cb3
xor ecx, 0x750d91c6
or eax, ecx
cmp eax, 0xbdb0ebce
ja 0x140112fed
mov eax, dword [0x1401df688]
xor eax, 0x684dd76
xor edx, edx
div dword [0x1401df68c]
mov edx, 0x96f8c557
xor edx, 0x96f8c556
mov ecx, eax
add ecx, edx
xor eax, 0xffffffff
or eax, 0xf1395d66
add eax, ecx
imul eax, eax, 0xd7ba1e8a
add eax, 0x36984d4e
mov dword [rsp + 0x40], eax
mov eax, 0x1f78de46
xor eax, 0xa6b8e68
mov dword [rsp + 0x3c], eax
call fcn.140112ca4
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
call fcn.140023894
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x3c]
mov eax, dword [rsp + 0x40]
mov dl, byte [rdx]
mov r8b, 0x73
xor r8b, 0x73
cmp dl, r8b
sete dl
mov byte [rsp + 0x47], dl
cmp eax, ecx
jb 0x140112ea4
mov al, byte [rsp + 0x47]
test al, 1
jne 0x140112f3f
jmp 0x140112fe7
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax]
movabs rax, 0xab2ca7df40c31f2b
movabs rcx, 0x54d35820bf3ce0d4
xor rax, rcx
mov rcx, rdx
and rcx, rax
shl rcx, 1
movabs r8, 0xb503914c99c0abbd
movabs rax, 0x4afc6eb3663f5442
xor r8, rax
mov rax, rdx
xor rax, r8
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl dl
cmp rax, 0xffffffffffffffff
setg cl
xor dl, 0xff
mov al, cl
xor al, dl
and al, cl
test al, 1
jne 0x140112fb7
jmp 0x140112fc1
call fcn.140007bb8
jmp 0x140112fe7
mov r8, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
movabs rdx, 0xa96c574489ac11bf
movabs rax, 0xa96c574489ac11bf
xor rdx, rax
call fcn.140112440
nop
add rsp, 0x58
ret
jne 0x140113017
add al, 0xd0
jmp 0x140112ea4
mov eax, 0x10
Function at 0x140114680
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x38
mov eax, dword [0x1401df7b8]
xor edx, edx
div dword [0x1401df7bc]
mov ecx, eax
mov edx, 0x2ab6486c
xor edx, 0x976cff4b
mov eax, ecx
xor eax, edx
mov edx, 0xc07f69c1
xor edx, 0x7da5dee6
mov r8d, 0xa19b42d1
xor r8d, 0x5e64bd2e
xor edx, r8d
and ecx, edx
shl ecx, 1
sub ecx, eax
mov eax, 0x93ddc272
xor eax, 0x55e88943
or ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x377ca4b3
or eax, edx
mov edx, 0x6f93104f
xor edx, 0x58efb4fc
mov r8d, 0x6d4d45af
xor r8d, 0x5a31e11c
and edx, r8d
xor edx, 0xffffffff
and ecx, edx
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x98048303
xor ecx, 0x67fb7cfc
xor eax, ecx
cmp eax, 0x84248e80
je 0x1401147a8
mov eax, dword [0x1401df7c0]
or eax, dword [0x1401df7c4]
mov ecx, 0x35b24f3d
xor ecx, 0x654d580c
or eax, ecx
mov ecx, 0x6357a23e
xor edx, edx
div ecx
mov edx, eax
mov ecx, edx
xor ecx, 0xfd7bdb86
mov eax, 0xffffffff
xor eax, 0xfd7bdb86
and edx, eax
mov eax, 0x9bf5d074
xor eax, 0x9bf5d076
imul eax, edx
sub eax, ecx
mov dword [rsp + 0x2c], eax
mov rax, qword [0x1401eeb10]
mov ecx, dword [rax]
call fcn.140007a23
mov rcx, rax
mov eax, dword [rsp + 0x2c]
add rcx, 0x60
mov qword [rsp + 0x30], rcx
cmp eax, 0x717feec6
ja 0x14011472a
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
adc eax, 0xe974e97c
jns 0x1401147ae
invalid
invalid
Function at 0x140114820
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401df7c8]
xor eax, 0x4aede0d4
mov ecx, dword [str.VBGH]
mov edx, 0x700061c8
xor edx, 0x325f6445
xor ecx, edx
xor edx, edx
div ecx
mov ecx, 0x46197fb4
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x1e35df45
mov edx, 0xffffffff
xor edx, 0x1e35df45
or ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x143c6cce
mov edx, 0xffffffff
xor edx, 0x143c6cce
and eax, edx
sub eax, ecx
mov ecx, 0xee7581f4
xor ecx, 0xb072de4d
cmp eax, ecx
ja 0x1401149d3
mov rcx, qword [rbp - 0x10]
mov eax, dword [0x1401df7d0]
mov edx, dword [0x1401df7d4]
xor eax, edx
imul eax, eax, 0x1ed19e6c
add eax, 0x3094d39e
imul rax, rax, 0x98b0113
shr rax, 0x3b
mov dword [rbp - 0x14], eax
mov eax, 0x10
mov qword [rbp - 0x40], rax
call fcn.1401d7280
sub rsp, rax
mov rax, qword [rbp - 0x40]
mov rdx, rsp
mov qword [rbp - 0x30], rdx
call fcn.1401d7280
sub rsp, rax
mov rax, qword [rbp - 0x40]
mov rdx, rsp
mov qword [rbp - 0x38], rdx
call fcn.1401d7280
sub rsp, rax
mov rax, qword [rbp - 0x40]
mov rdx, rsp
mov qword [rbp - 0x20], rdx
call fcn.1401d7280
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
mov edx, 0x20
sub rsp, 0x20
call fcn.1401149e0
mov rdx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x30]
mov rax, qword [rbp - 8]
add rsp, 0x20
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14002331e
mov r9, qword [rbp - 0x30]
mov rax, qword [rbp - 8]
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
add rsp, 0x20
mov r10, qword [r9]
mov qword [r8], r10
mov r9, qword [r9 + 8]
mov qword [r8 + 8], r9
mov r8, qword [rax + 0x10]
mov qword [rdx], r8
mov rax, qword [rax + 0x18]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.1400237b6
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x10]
mov eax, dword [rbp - 0x14]
add rsp, 0x20
mov r8, qword [rdx]
mov qword [rcx + 0x10], r8
mov rdx, qword [rdx + 8]
mov qword [rcx + 0x18], rdx
cmp eax, 0xb37dc5b7
je 0x1401148b6
mov rsp, rbp
pop rbp
ret
add edx, 0xdae994d2
invalid
Function at 0x140115a00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rcx
call fcn.140114680
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov rax, qword [rcx]
mov qword [rsp + 0x50], rax
cmp rdx, 0
je 0x140115a3e
mov rcx, qword [rsp + 0x40]
call fcn.140114f80
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov qword [rax], rdx
call fcn.140115580
test al, 1
jne 0x140115a62
jmp 0x140115b75
mov eax, dword [0x1401df878]
mov ecx, 0x1102b03c
xor ecx, 0x23f6cd9d
xor eax, ecx
mov r8d, dword [0x1401df87c]
mov ecx, 0x336378bd
xor ecx, 0xcc9c8742
mov r9d, r8d
xor r9d, ecx
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
imul eax, eax, 0x3a1e0a07
and eax, 0x33c900ab
mov ecx, 0xc1e2910
xor ecx, 0xd9b3efbf
sub eax, ecx
cmp eax, 0x606787ce
je 0x140115b7b
mov rcx, qword [rsp + 0x50]
mov eax, dword [0x1401df880]
mov edx, 0x64c71d60
xor edx, 0x120a29ef
xor eax, edx
mov edx, dword [0x1401df884]
mov r8d, 0xbd8a7720
xor r8d, 0xca477651
sub eax, r8d
sub eax, edx
mov edx, 0x91c521d2
xor edx, 0xe60820a3
add eax, edx
and eax, 0x2469cad5
mov r8d, 0xd31d489f
xor edx, edx
div r8d
sub eax, 0xbb523267
mov dword [rsp + 0x30], eax
mov eax, 0x52c1efbb
xor eax, 0x4d2e342b
mov dword [rsp + 0x2c], eax
call fcn.140115330
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x30]
cmp byte [rdx], 0
sete dl
mov byte [rsp + 0x37], dl
cmp eax, ecx
jbe 0x140115acd
mov al, byte [rsp + 0x37]
test al, 1
jne 0x140115b66
jmp 0x140115b75
mov rcx, qword [rsp + 0x50]
mov edx, 8
call fcn.14000de70
nop
add rsp, 0x58
ret
pop rdi
in al, 0x7e
jmp 0x140115acd
Function at 0x140115b90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov eax, dword [0x1401df888]
sub eax, dword [0x1401df88c]
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
mov edx, 0x4b72e3b
xor edx, 0xbb87b36f
or eax, edx
add eax, ecx
imul eax, eax, 0xd68bdf56
mov ecx, 0xcab9cbf1
xor edx, edx
div ecx
cmp eax, 0xd1b12bc1
ja 0x140115d31
mov eax, dword [str.qf_m]
mov ecx, 0x402a48a4
xor ecx, 0xa958d404
xor eax, ecx
or eax, dword [0x1401df894]
and eax, 0xe0feb894
mov ecx, 0x201b33cc
xor edx, edx
div ecx
xor eax, 0xeffde62f
mov dword [rsp + 0x40], eax
call fcn.140114680
mov rdx, qword [rsp + 0x48]
mov rcx, rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rax]
mov qword [rsp + 0x38], rcx
mov qword [rax], rdx
call fcn.140115580
mov cl, al
mov eax, dword [rsp + 0x40]
mov byte [rsp + 0x47], cl
cmp eax, 0x4254e66d
jb 0x140115d31
mov al, byte [rsp + 0x47]
test al, 1
jne 0x140115c58
jmp 0x140115d2b
mov eax, dword [0x1401df898]
mov ecx, 0x4f969fd7
xor ecx, 0x5d9394f3
xor eax, ecx
xor edx, edx
div dword [0x1401df89c]
add eax, 0xecb9616
xor eax, 0x721dda22
and eax, eax
xor eax, 0xffffffff
mov ecx, 0x2e5cc994
and ecx, 0x2e5cc994
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
cmp eax, 0x3498fa94
je 0x140115d3a
mov rcx, qword [rsp + 0x38]
mov edx, dword [0x1401df8a0]
xor edx, 0x929cd814
and edx, dword [0x1401df8a4]
mov eax, 0xb774848c
xor eax, 0x4f68abb4
sub edx, eax
sub edx, 0xa8899a20
add edx, 0xf81c2f38
or edx, 0x5a249576
mov eax, edx
and eax, 0x3440cd53
xor edx, 0x3440cd53
or eax, edx
mov dword [rsp + 0x28], eax
call fcn.140115330
mov rcx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x28]
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0xa34528cc
je 0x140115ca0
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x140115d1c
jmp 0x140115d2b
mov rcx, qword [rsp + 0x38]
mov edx, 8
call fcn.14000de70
nop
add rsp, 0x58
ret
or dword [rax - 0x5e165720], eax
invalid
xor al, 0xba
shl byte [rcx - 0x17], 0x5d
invalid