joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c7030
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x98
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rcx
mov al, byte [rdx]
mov byte [rcx], al
mov rax, rcx
add rax, 8
mov qword [rsp + 0x60], rax
mov rax, rcx
add rax, 0x10
mov qword [rsp + 0x68], rax
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x70], rcx
mov rax, rdx
add rax, 8
mov qword [rsp + 0x78], rax
mov rax, rdx
add rax, 0x10
mov qword [rsp + 0x80], rax
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x88], rax
cmp rcx, rax
sete dl
cmp rcx, 0
sete cl
or cl, dl
test cl, 1
mov qword [rsp + 0x90], rax
jne 0x1400c70f6
mov rax, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x70]
movabs rcx, 0x4000000000000000
and rcx, qword [rdx]
cmp rcx, 0
mov qword [rsp + 0x90], rax
jne 0x1400c70f6
mov rcx, qword [rsp + 0x70]
call fcn.14000f4df
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov r9, qword [rsp + 0x60]
mov r10, qword [rsp + 0x78]
mov r8, qword [rsp + 0x90]
mov r10, qword [r10]
mov qword [r9], r10
mov qword [rdx], r8
mov rdx, rcx
add rdx, 0x20
mov qword [rsp + 0x28], rdx
mov rcx, qword [rcx + 0x20]
mov qword [rsp + 0x30], rcx
mov rdx, rax
add rdx, 0x20
mov qword [rsp + 0x38], rdx
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x40], rax
mov rdx, rcx
sub rdx, rax
sete r8b
test rcx, rcx
sete cl
mov dl, r8b
and dl, cl
add cl, r8b
sub cl, dl
test cl, 1
mov qword [rsp + 0x48], rax
jne 0x1400c7287
mov r11d, dword [0x140246b20]
mov ecx, dword [0x140246b24]
xor eax, eax
sub eax, ecx
add r11d, eax
xor r11d, 0xca16ee54
mov eax, r11d
xor eax, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0xef74a454
mov edx, 0xffffffff
xor edx, 0xe7b621bd
mov ecx, eax
and ecx, 0xe7b621bd
and r11d, edx
mov r9d, r8d
and r9d, 0xe7b621bd
mov r10d, edx
and r10d, 0xef74a454
or ecx, r11d
or r9d, r10d
xor ecx, r9d
or eax, r8d
xor eax, 0xffffffff
or edx, 0xe7b621bd
and eax, edx
or ecx, eax
mov eax, ecx
and eax, 0xcfb61c65
or ecx, 0xcfb61c65
add eax, ecx
cmp eax, 0xfd11ec82
jae 0x1400c72b6
mov rdx, qword [rsp + 0x30]
mov eax, dword [0x140246b28]
mov ecx, dword [0x140246b2c]
xor ecx, 0xfdc1a6e7
and eax, ecx
add eax, 0x21dab60c
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x7ff72e10
add ecx, eax
xor eax, eax
sub eax, ecx
xor eax, 0xedb1c872
movabs rcx, 0x4000000000000000
and rcx, qword [rdx]
cmp rcx, 0
sete cl
mov byte [rsp + 0x27], cl
cmp eax, 0x369845ae
je 0x1400c71fd
mov rax, qword [rsp + 0x40]
mov cl, byte [rsp + 0x27]
test cl, 1
mov qword [rsp + 0x48], rax
jne 0x1400c7270
jmp 0x1400c7287
mov rcx, qword [rsp + 0x30]
call fcn.14000f4df
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x48]
mov r9, qword [rcx + 0x18]
mov qword [rax + 0x18], r9
mov qword [rdx], r8
mov rcx, qword [rcx + 0x28]
mov qword [rax + 0x28], rcx
add rsp, 0x98
ret
push rbp
or dword [rdx - 0xc1163a], esi
invalid
Function at 0x1400e1c30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
call fcn.1400e1db4
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
call fcn.1400e1dd0
test al, 1
jne 0x1400e1c5a
jmp 0x1400e1d1d
mov eax, dword [0x1402476e0]
xor eax, dword [0x1402476e4]
xor eax, 0xbebef223
mov ecx, 0xab6896e4
xor edx, edx
div ecx
mov ecx, 0x5986c74b
xor edx, edx
div ecx
cmp eax, 0x81ee8476
jae 0x1400e1da2
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x1402476e8]
sub eax, dword [0x1402476ec]
or eax, 0x1d2c5d3b
add eax, 0xbc689284
mov r8d, 0xe2c590f7
xor r8d, 0x7009a6ab
xor edx, edx
div r8d
mov dword [rsp + 0x30], eax
mov eax, 0x24b177de
xor eax, 0x793c6e57
mov dword [rsp + 0x2c], eax
call fcn.1400e1a80
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x30]
cmp byte [rdx], 0
sete dl
mov byte [rsp + 0x37], dl
cmp eax, ecx
je 0x1400e1c88
mov al, byte [rsp + 0x37]
test al, 1
jne 0x1400e1cfc
jmp 0x1400e1d1d
mov rcx, qword [rsp + 0x38]
movabs rdx, 0xbdc2b8dd017222a3
movabs rax, 0xbdc2b8dd017222ab
xor rdx, rax
call fcn.14000f52f
mov eax, dword [0x1402476f0]
xor eax, 0xf115388a
and eax, dword [0x1402476f4]
mov ecx, 0xe16c071
xor edx, edx
div ecx
xor ecx, ecx
sub ecx, 0x6b4154ce
add eax, ecx
sub eax, 0xd297f742
cmp eax, 0x26c29b15
jbe 0x1400e1dab
mov eax, dword [0x1402476f8]
xor eax, dword [0x1402476fc]
imul eax, eax, 0xc823234a
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x94d79fca
mov edx, 0xffffffff
xor edx, 0x94d79fca
and eax, edx
sub eax, ecx
mov ecx, eax
and ecx, 0xf2cdedf5
xor ecx, 0xffffffff
add eax, 0xf2cdedf5
add eax, 1
add eax, ecx
cmp eax, 0xf435c356
jae 0x1400e1d51
add rsp, 0x48
ret
fcom dword [rcx + 0x33]
js 0x1400e1d90
invalid
stc
sbb ch, byte [rsi - 0x6216f3]
invalid
Function at 0x1400f0200
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov dword [rbp - 4], ecx
mov eax, dword [0x140247b40]
mov ecx, 0x731156fe
xor ecx, 0x3aff17f8
xor eax, ecx
mov ecx, dword [0x140247b44]
mov edx, 0x82de147
xor edx, 0x50e1b498
xor ecx, edx
xor edx, edx
div ecx
mov ecx, 0xd34c0b8d
xor ecx, 0xd0f6f76
add eax, ecx
xor eax, 0xb4d19da4
mov ecx, 0x2b50a2e3
xor ecx, 0xd8184df9
xor edx, edx
div ecx
cmp eax, 0x23be3975
ja 0x1400f02e6
mov edx, dword [0x140247b48]
xor edx, 0xc7fbfdaa
mov eax, dword [0x140247b4c]
mov ecx, eax
mov eax, edx
lea eax, [rax + rcx - 0x108dba2c]
mov dword [rbp - 0x14], eax
mov eax, 0x10
call fcn.14023fff0
sub rsp, rax
mov rcx, rsp
mov qword [rbp - 0x20], rcx
movabs rdx, 0x520a5b7e419a0fa4
movabs rax, 0x520a5b7e419a0fac
xor rdx, rax
sub rsp, 0x20
call fcn.1400e7169
mov edx, dword [rbp - 4]
mov rcx, qword [rbp - 0x20]
mov eax, dword [rbp - 0x14]
add rsp, 0x20
mov byte [rcx + 4], 1
mov dword [rcx], edx
mov rcx, qword [rcx]
mov qword [rbp - 0x10], rcx
cmp eax, 0xd12b491d
jae 0x1400f0263
mov rax, qword [rbp - 0x10]
mov rsp, rbp
pop rbp
ret
or al, 0xa3
popfq
jmp 0x1400f0263
Function at 0x1400f6f70
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x140247d70]
xor eax, 0xb31dd81
mov edx, dword [0x140247d74]
xor ecx, ecx
sub ecx, edx
add eax, ecx
mov ecx, 0xa1a26235
xor ecx, 0xd6cc0191
and eax, ecx
or eax, 0xf95be5e6
mov ecx, 0xffffffff
xor ecx, 0x4cd3f421
add eax, ecx
mov ecx, 0xdd8f7e7e
xor ecx, 0xdd8f7e7f
add eax, ecx
cmp eax, 0x1b707529
jb 0x1400f71aa
mov eax, dword [0x140247d78]
mov ecx, dword [0x140247d7c]
xor edx, edx
div ecx
xor eax, 0x3028e4d9
add eax, 0x3e3d4e6d
mov dword [rbp - 0x24], eax
mov eax, 0x4d9b368c
mov dword [rbp - 0x28], eax
mov eax, 0x10
mov qword [rbp - 0x40], rax
call fcn.14023fff0
sub rsp, rax
mov rax, qword [rbp - 0x40]
mov rcx, rsp
mov qword [rbp - 0x38], rcx
call fcn.14023fff0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
sub rsp, 0x20
call fcn.1400e33a2
mov rdx, qword [rbp - 8]
mov ecx, dword [rbp - 0x28]
add rsp, 0x20
mov r8, rax
mov eax, dword [rbp - 0x24]
mov qword [rbp - 0x20], r8
cmp rdx, 0
sete dl
mov byte [rbp - 0x11], dl
cmp eax, ecx
je 0x1400f6fd0
mov al, byte [rbp - 0x11]
test al, 1
jne 0x1400f7060
jmp 0x1400f70d4
mov rcx, qword [rbp - 0x38]
mov ax, 0xcdfb
xor ax, 0xcecb
mov word [rcx], ax
sub rsp, 0x20
call fcn.140064b20
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x48], rcx
cmp byte [rax], 0
jne 0x1400f70cf
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x48]
mov rdx, qword [rax]
sub rsp, 0x20
call fcn.14001a160
mov rax, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x30]
add rsp, 0x20
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.1400ef6f0
add rsp, 0x20
jmp 0x1400f70e9
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
sub rsp, 0x20
call fcn.1400f5f60
add rsp, 0x20
mov eax, dword [0x140247d80]
xor eax, 0xf3d74f3e
mov edx, dword [0x140247d84]
xor ecx, ecx
sub ecx, edx
add eax, ecx
mov ecx, eax
and ecx, 0x82b16c9d
shl ecx, 1
xor eax, 0x82b16c9d
add eax, ecx
add eax, 0xd7e006f4
xor eax, 0xff7081cf
mov ecx, 0x7c66784c
xor ecx, 0x1e8df148
cmp eax, ecx
jb 0x1400f71b3
mov eax, dword [0x140247d88]
sub eax, dword [0x140247d8c]
mov ecx, 0xd9ed4e54
xor edx, edx
div ecx
and eax, 0x2e96e639
mov r8d, 0xffffffff
xor r8d, 0xbd9582a8
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0xc366ad9e
xor r8d, 0x3c995261
xor ecx, r8d
imul ecx, edx
mov r8d, 0x61c3c8fd
xor r8d, 0xdc564a55
mov edx, eax
and edx, r8d
mov r8d, 0x44cc139f
xor r8d, 0xf9599137
or eax, r8d
imul eax, edx
add eax, ecx
cmp eax, 0xe06eea77
je 0x1400f71b3
ret
invalid
mov rsp, rbp
pop rbp
ret
jrcxz 0x1400f71a1
mov word [rcx - 0x17], ds
sbb eax, 0xd5fffffe
jge 0x1400f7177
invalid
pop rsi
jmp 0x1400f712f
Function at 0x1400f7580
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rax, qword [rcx]
mov qword [rsp + 0x40], rax
cmp rax, 0
jle 0x1400f76fa
mov eax, dword [0x140247db0]
mov ecx, dword [0x140247db4]
mov edx, 0x6656fb9
xor edx, 0xf5371ce5
xor ecx, edx
or eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x8523ab42
add eax, ecx
add eax, 1
mov ecx, 0x71d4cca3
xor ecx, 0x79b90719
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
and eax, 0x69cf8634
mov edx, 0xc351159e
xor edx, 0xaa9e93aa
xor ecx, edx
or eax, ecx
cmp eax, 0x4f7a0dde
jbe 0x1400f77bd
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x140247db8]
mov edx, dword [0x140247dbc]
mov r8d, 0xda28a6ea
xor r8d, 0xed917bdd
sub eax, r8d
sub eax, edx
add eax, 0x37b9dd37
mov edx, 0x1a8b5312
xor edx, 0x9fe2bb57
sub eax, edx
mov edx, 0xa13e0fec
xor edx, 0xb9a11d8a
sub eax, edx
mov edx, 0x92266ab5
xor edx, 0x174f82f0
add eax, edx
mov edx, eax
xor edx, 0xbe321ff8
mov r8d, 0xeb0bdc67
xor r8d, 0x14f42398
xor edx, r8d
and edx, 0xbe321ff8
shl edx, 1
mov r8d, 0x367f74b3
xor r8d, 0x884d6b4b
sub edx, r8d
sub eax, edx
mov r8d, 0x573a1f99
xor r8d, 0x86c9a382
xor edx, edx
div r8d
mov edx, eax
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x2c], edx
mov edx, 0x532b50a7
xor edx, 0x25b53e
mov dword [rsp + 0x28], edx
mov rdx, qword [rcx]
mov qword [rsp + 0x20], rdx
add rdx, rax
call fcn.140014570
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rcx + 8]
add rcx, 8
add rcx, rdx
mov rdx, qword [rax + 8]
add rdx, 8
mov r8, qword [rax]
call fcn.1400e5210
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
ja 0x1400f75fd
jmp 0x1400f76fa
mov ecx, dword [0x140247dc0]
mov eax, 0x964a3c3a
xor eax, 0xdb71a7a8
xor ecx, eax
and ecx, dword [0x140247dc4]
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0x9477a2d3
xor edx, 0x279995f9
mov r8d, 0x1b3c5c4f
xor r8d, 0xe4c3a3b0
xor edx, r8d
and eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xb3ee372a
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
or eax, 0x4fdb582f
mov ecx, 0xa5bf24cf
xor ecx, 0xb646bd54
or eax, ecx
mov ecx, 0x70e9d650
xor ecx, 0x1a24f8ff
cmp eax, ecx
je 0x1400f77c6
mov eax, dword [0x140247dc8]
xor eax, 0x36025d1d
mov ecx, dword [0x140247dcc]
xor ecx, 0xb526d36e
xor edx, edx
div ecx
mov ecx, 0x8626c3b
xor ecx, 0xf2b7d207
xor edx, edx
div ecx
xor eax, 0xcaacf706
and eax, 0x38a17208
mov ecx, 0x95612010
xor ecx, 0x440e5b9f
cmp eax, ecx
je 0x1400f77c6
add rsp, 0x48
ret
push rbx
invalid
or byte [rdi - 0xe], 0xd7
jmp 0x1400f7771
Function at 0x14012b580
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x238
mov qword [rsp + 0x220], rdx
mov qword [rsp + 0x228], rcx
mov qword [rsp + 0x230], rcx
mov eax, dword [0x140249418]
mov ecx, 0x7b5e94d
Function at 0x14012e590
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x140249570]
mov r8d, dword [0x140249574]
xor r8d, 0x622b9eab
mov edx, 0x3e102b97
xor edx, 0xc1efd468
mov ecx, eax
xor ecx, edx
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xd90047c6
xor edx, edx
div ecx
mov ecx, 0x388477de
xor ecx, 0x79112b5b
add eax, ecx
mov ecx, eax
xor ecx, 0x29ff9f8a
mov edx, 0xafa85fc2
xor edx, 0x5057a03d
xor ecx, edx
mov edx, 0xb316ec81
xor edx, 0x9ae9730b
or eax, edx
and eax, ecx
cmp eax, 0xdb4b1d4f
jae 0x14012e6f1
mov rdx, qword [rbp - 8]
mov ecx, dword [0x140249578]
mov r10d, dword [0x14024957c]
mov r9d, r10d
xor r9d, 0x7862fd40
xor r10d, 0x879d02bf
mov eax, ecx
and eax, r10d
mov r8d, ecx
or r8d, r10d
not r8d
imul r8d, eax
mov eax, ecx
and eax, r9d
or ecx, r9d
imul ecx, eax
mov eax, ecx
mov ecx, r8d
lea eax, [rax + rcx - 0x509381be]
and eax, 0x68940810
or eax, 0x866a072a
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.14023fff0
sub rsp, rax
mov rax, qword [rbp - 0x10]
mov rcx, rsp
mov qword [rbp - 0x20], rcx
mov r8d, 0xec7e3727
xor r8d, 0xec7e3727
mov dword [rcx], r8d
add rdx, rax
movabs r8, 0x9379fa185d19cb82
movabs rax, 0x9379fa185d19cb86
xor r8, rax
sub rsp, 0x20
call fcn.14012e1de
mov rcx, qword [rbp - 0x20]
mov eax, dword [rbp - 0x18]
add rsp, 0x20
mov ecx, dword [rcx]
mov dword [rbp - 0x14], ecx
cmp eax, 0x22b1166e
jbe 0x14012e62b
mov eax, dword [rbp - 0x14]
mov rsp, rbp
pop rbp
ret
xchg ebx, eax
invalid
Function at 0x14012f930
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x50], rax
call fcn.14012f8c6
mov rcx, qword [rsp + 0x58]
mov rax, rcx
add rax, 8
mov qword [rsp + 0x60], rax
cmp qword [rcx + 8], 0
je 0x14012f9f6
mov ecx, 0x40
mov edx, 8
call fcn.1400129fd
mov rcx, rax
mov rax, qword [0x14025a6d8]
mov qword [rcx], rax
lea rax, [0x140259370]
mov qword [rcx + 0x10], rax
mov rax, qword [0x140259380]
mov qword [rcx + 0x18], rax
mov rax, qword [0x140259388]
mov qword [rcx + 0x20], rax
mov qword [rcx + 8], 0
movabs rax, 0x8bb9f42024b177de
movabs rdx, 0x8bb9f4201c53ec81
xor rax, rdx
lea rdx, [0x140259370]
lea r8, [0x140259390]
lea r9, [0x140259399]
mov qword [rsp + 0x20], rax
call fcn.140012522
jmp 0x14012faa6
mov r8, qword [rsp + 0x50]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
mov rax, qword [rax]
mov rdx, rax
add rdx, r8
mov qword [rsp + 0x28], rdx
cmp rcx, rdx
mov qword [rsp + 0x30], rax
jge 0x14012fa40
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
call fcn.140014570
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov r8, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov r9, qword [rsp + 0x30]
mov rcx, qword [rcx + 8]
add rcx, 8
add rcx, r9
add rdx, rax
call fcn.14012fb20
mov r10, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x60]
shl r10, 3
mov rcx, qword [rax]
mov r9, rcx
and r9, r10
shl r9, 1
mov r8, rcx
xor r8, r10
add r8, r9
sar r8, 3
add r8, qword [rdx]
mov qword [rdx], r8
and rcx, 7
mov qword [rax], rcx
mov eax, dword [0x140249900]
xor eax, dword [0x140249904]
sub eax, 0xddc96c09
mov ecx, 0xe2b4ced3
xor edx, edx
div ecx
and eax, 0xb62ba131
cmp eax, 0xee830792
je 0x14012fb17
mov eax, dword [str.1LCd]
xor eax, 0xbe0218ff
imul eax, dword [0x14024990c]
mov ecx, 0x48913997
xor edx, edx
div ecx
mov ecx, 0x296a88ea
xor ecx, 0x298d89e6
xor edx, edx
div ecx
xor eax, 0x75eae528
mov ecx, 0x773eb78f
xor ecx, 0x96374dc7
cmp eax, ecx
jae 0x14012fad0
add rsp, 0x68
ret
movabs byte [0x48ffffffb0e99331], al
sub esp, 0x30
Function at 0x14012fb20
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov eax, dword [0x140249910]
mov ecx, 0x782bada6
xor ecx, 0x76d23470
xor eax, ecx
mov r8d, dword [0x140249914]
mov ecx, 0xc1c5a6f1
xor ecx, 0x3e3a590e
mov edx, r8d
xor edx, ecx
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
mov ecx, eax
and ecx, 0x550ee811
shl ecx, 1
xor eax, 0x550ee811
add eax, ecx
sub eax, 0x3184800c
imul eax, eax, 0x19e09969
cmp eax, 0x88f11b67
ja 0x14012fce0
mov eax, dword [0x140249918]
mov edx, dword [0x14024991c]
mov ecx, eax
and ecx, edx
mov r8d, 0xdb528ab2
xor r8d, 0xdb528ab0
imul ecx, r8d
xor eax, edx
add eax, ecx
and eax, 0x7ddf8ab4
mov ecx, 0x71582aea
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x18]
sub eax, 0x706cc824
xor ecx, ecx
test rdx, rdx
cmovg rcx, rdx
mov qword [rsp + 0x10], rcx
cmp eax, 0xb365acec
jae 0x14012fce0
xor eax, eax
mov qword [rsp + 8], rax
jmp 0x14012fbf4
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 8]
mov qword [rsp], rax
cmp rax, rcx
je 0x14012fc2d
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov dl, byte [rdx + rax]
mov byte [rcx + rax], dl
add rax, 1
mov qword [rsp + 8], rax
jmp 0x14012fbf4
mov ecx, dword [0x140249920]
xor ecx, 0x980b9a09
mov r8d, dword [0x140249924]
mov eax, 0x437f659e
xor eax, 0x44c445c8
xor r8d, eax
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, ecx
and edx, r9d
mov eax, ecx
or eax, r9d
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, r8d
or ecx, r8d
imul ecx, edx
add ecx, eax
mov eax, 0x94060d29
xor eax, 0xc2fc9448
imul ecx, eax
or ecx, 0xac9681c5
mov eax, ecx
and eax, 0xb511f99e
xor ecx, 0xb511f99e
or eax, ecx
cmp eax, 0x94e6c8eb
jbe 0x14012fce9
mov eax, dword [0x140249928]
xor eax, 0x76b685f
sub eax, dword [0x14024992c]
mov ecx, 0x57229746
xor ecx, 0x5c389d67
imul eax, ecx
mov ecx, 0x8439c8b7
xor edx, edx
div ecx
xor ecx, ecx
sub ecx, 0xd1c54faa
add eax, ecx
cmp eax, 0x82b1e6ab
ja 0x14012fc9e
add rsp, 0x30
ret
test byte [rbp - 0x5616c802], dh
invalid
xor dword fs:[rdi + rdx*8], edx
jmp 0x14012fc9e
Function at 0x14013bf20
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
xor eax, eax
test r8, r8
cmovg rax, r8
mov qword [rsp + 0x20], rax
xor eax, eax
mov qword [rsp + 0x28], rax
Function at 0x140141bb0
Capabilities:
Parse pe header

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x18], rcx
mov eax, 0x10
call fcn.14023fff0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
sub rsp, 0x20
call fcn.140146f5b
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
add rax, 0x50
mov qword [rbp - 0x10], rax
xor eax, eax
cmp rcx, 0
mov qword [rbp - 8], rax
je 0x140141cec
mov rcx, qword [rbp - 0x18]
xor eax, eax
cmp word [rcx], 0x5a4d
mov qword [rbp - 8], rax
jne 0x140141cec
mov cx, 0x97e3
xor cx, 0x904b
sub rsp, 0x20
call fcn.140065e7e
mov rcx, qword [rbp - 0x10]
add rsp, 0x20
mov dword [rbp - 0x24], eax
xor eax, eax
cmp byte [rcx], 0
mov qword [rbp - 8], rax
jne 0x140141cec
mov ecx, dword [rbp - 0x24]
mov rax, qword [rbp - 0x18]
mov edx, dword [rax + 0x3c]
mov dword [rbp - 0x28], edx
xor eax, eax
cmp ecx, edx
mov qword [rbp - 8], rax
jl 0x140141cec
mov r8, qword [rbp - 0x20]
mov eax, dword [rbp - 0x28]
movsxd rcx, eax
movabs rdx, 0x2d82f550e1daa18c
movabs rax, 0x2d82f550e1daa18d
xor rdx, rax
sub rsp, 0x20
call fcn.140141e10
add rsp, 0x20
test al, 1
jne 0x140141c92
jmp 0x140141caa
sub rsp, 0x20
call fcn.140008d37
add rsp, 0x20
xor eax, eax
mov qword [rbp - 8], rax
jmp 0x140141cec
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
mov rax, rcx
and rax, rdx
movabs r8, 0xe05a2bdc83ed45e2
movabs r9, 0xe05a2bdc83ed45e0
xor r8, r9
imul rax, r8
xor rcx, rdx
add rcx, rax
xor eax, eax
cmp dword [rcx], 0x4550
cmove rax, rcx
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x30], rax
mov eax, dword [0x14024a0f8]
xor eax, 0xd8f797ef
xor edx, edx
div dword [0x14024a0fc]
xor ecx, ecx
sub ecx, 0x4d72d34c
sub eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, 0x18c1e398
xor eax, 0x18c1e398
mov edx, 0xb71fe5b6
xor edx, 0x4b33c75e
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0xfd75162
mov edx, 0xffffffff
xor edx, 0xfd75162
and eax, edx
sub eax, ecx
cmp eax, 0x888651a8
je 0x140141e07
mov eax, dword [0x14024a100]
mov ecx, dword [0x14024a104]
mov edx, 0x21f4b733
xor edx, 0x359d6479
xor ecx, edx
imul eax, ecx
xor eax, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xa2f43ae1
mov edx, 0xffffffff
xor edx, 0x478ba6a6
or eax, ecx
mov ecx, 0x77b7d1c2
xor ecx, 0x303c7764
or ecx, edx
xor eax, 0xffffffff
and eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x9aa3859d
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x554d2328
xor r8d, 0xaab2dcd7
xor ecx, r8d
imul ecx, edx
mov r8d, 0x8bd70609
xor r8d, 0x11748394
mov edx, eax
and edx, r8d
or eax, 0x9aa3859d
imul eax, edx
add eax, ecx
mov ecx, 0x64590f1
xor ecx, 0xb7b8aa95
xor eax, ecx
cmp eax, 0x135d3b7c
jbe 0x140141e07
mov rax, qword [rbp - 0x30]
mov rsp, rbp
pop rbp
ret
xchg ebx, eax
sub byte [rdi - 0xb817], bl
dec dword [rax - 0x7d]
sub rsp, 0x58
Function at 0x1401445e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov rax, qword [rdx]
mov qword [rsp + 0x50], rax
cmp rax, 0
jle 0x140144849
mov rcx, qword [rsp + 0x50]
mov rax, rcx
add rax, 1
mov qword [rsp + 0x38], rax
mov rdx, rcx
or rdx, rdx
movabs r8, 0x8efea0cee5910d5a
movabs r9, 0x71015f311a6ef2a5
xor r8, r9
xor rdx, r8
movabs r8, 0x4413278fd0e937de
movabs r9, 0xbbecd8702f16c821
xor r8, r9
movabs r9, 0xbece2dfdf7069d62
movabs r10, 0x4131d20208f9629d
xor r9, r10
xor r8, r9
mov r9, 0xffffffffffffffff
xor r9, 0xffffffffffffffff
and r8, r9
or rdx, r8
xor rdx, 0xffffffffffffffff
xor rcx, 0xffffffffffffffff
mov r8, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
and rcx, r8
or rdx, rcx
xor rdx, 0xffffffffffffffff
movabs r8, 0x5ef114449b9e3de7
movabs rcx, 0x5ef114449b9e3de6
xor r8, rcx
mov rcx, rax
add rcx, r8
xor rax, 0xffffffffffffffff
or rax, rdx
add rax, rcx
cmp rax, 0
jge 0x1401446cb
call fcn.140008d37
jmp 0x140144849
mov rax, qword [rsp + 0x38]
cmp rax, 0
jge 0x1401447b4
mov eax, dword [0x14024a238]
mov ecx, dword [0x14024a23c]
xor ecx, 0xa6f5c7c5
or eax, ecx
xor ecx, ecx
sub ecx, 0x7c577100
sub eax, ecx
mov edx, eax
xor edx, 0x80ab716c
xor edx, 0xffffffff
and edx, 0x80ab716c
mov ecx, 0x5ae2b1b0
xor ecx, 0x5ae2b1b2
imul ecx, edx
sub ecx, 0x80ab716c
sub eax, ecx
add eax, 0x680905b0
mov ecx, 0xbe3d8793
xor ecx, 0x9419123b
cmp eax, ecx
jae 0x14014484e
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x14024a240]
mov r8d, dword [0x14024a244]
mov edx, eax
and edx, r8d
shl edx, 1
add eax, r8d
sub eax, edx
mov r8d, 0xb5a8570d
xor edx, edx
div r8d
mov edx, eax
mov r8d, 0x71ce7399
xor r8d, 0xc690a661
mov eax, 0x831b9eb0
xor eax, 0x7ce4614f
xor r8d, eax
mov eax, edx
xor eax, r8d
and eax, edx
add eax, 0x604b44e7
mov dword [rsp + 0x34], eax
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
call fcn.14000db87
mov eax, dword [rsp + 0x34]
cmp eax, 0xace08e2
je 0x140144737
jmp 0x140144849
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdx + 8]
add rcx, 8
add rcx, qword [rdx]
mov rdx, qword [rax + 8]
add rdx, 8
call fcn.140142aa8
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov r8, qword [rcx]
mov rdx, qword [rax]
movabs rcx, 0xf77977b7df1aa81a
movabs rax, 0x886884820e557e5
xor rcx, rax
mov rax, r8
xor rax, rcx
xor ecx, ecx
sub rcx, 1
sub rax, rcx
mov rcx, rdx
sub rcx, rax
mov qword [rsp + 0x28], rcx
mov rax, rcx
xor rax, r8
xor rcx, rdx
and rax, rcx
cmp rax, 0
jge 0x14014483c
call fcn.140008d37
jmp 0x140144849
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
add rsp, 0x58
ret
loop 0x140144883
xchg ebx, eax
push rbp
jmp 0x140144737
popfq
invalid