joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400519b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov ecx, dword [0x1401da3f0]
mov eax, dword [0x1401da3f4]
xor eax, 0x453114
and ecx, eax
mov r8d, 0xffffffff
xor r8d, 0xb4a5b93b
mov edx, ecx
and edx, r8d
mov eax, ecx
or eax, r8d
mov r8d, 0x101e9a0c
xor r8d, 0xefe165f3
xor eax, r8d
imul eax, edx
mov edx, ecx
and edx, 0xb4a5b93b
or ecx, 0xb4a5b93b
imul ecx, edx
add ecx, eax
mov edx, 0x9f5b7aba
xor edx, 0x60a48545
mov eax, ecx
xor eax, edx
mov edx, 0xffffffff
xor edx, 0x79d2ce6b
or eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x79d2ce6b
or ecx, edx
mov edx, 0x6456e043
xor edx, 0x9ba91fbc
xor eax, edx
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0x1ec222a5
xor ecx, 0x4be861a3
imul eax, ecx
mov ecx, 0x889ef2cf
xor ecx, 0xf1f558e3
cmp eax, ecx
je 0x140051b05
mov eax, dword [0x1401da3f8]
xor eax, 0x6656577c
mov ecx, dword [0x1401da3fc]
sub eax, ecx
imul eax, eax, 0xebe6507
imul rax, rax, 0x7b921611
shr rax, 0x3e
or eax, 0xf1fe1ee4
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.1401d7280
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
sub rsp, 0x20
call fcn.140043a70
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x20]
add rsp, 0x20
mov rax, qword [rbp - 0x10]
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140051945
add rsp, 0x20
mov cl, al
mov eax, dword [rbp - 0x18]
mov byte [rbp - 0x11], cl
cmp eax, 0xb794594c
jbe 0x140051a71
mov al, byte [rbp - 0x11]
and al, 1
movzx eax, al
mov rsp, rbp
pop rbp
ret
sar dword [rcx], 1
nop
adc ch, cl
invalid
Function at 0x140057300
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rax, qword [rdx]
mov qword [rcx], rax
mov ax, word [rdx + 8]
mov word [rcx + 8], ax
mov rax, rcx
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx + 0x18]
mov qword [rsp + 0x48], rcx
mov rax, rdx
add rax, 0x18
mov qword [rsp + 0x50], rax
mov rax, qword [rdx + 0x18]
mov qword [rsp + 0x58], rax
cmp rcx, rax
sete r8b
cmp rcx, 0
sete dl
mov cl, dl
xor cl, 0xff
mov r9b, r8b
xor r9b, 0xff
and cl, r9b
xor dl, 0xff
xor r8b, 0xff
and dl, r8b
xor cl, 0xff
xor dl, 0xff
and cl, dl
test cl, 1
mov qword [rsp + 0x60], rax
jne 0x1400574c5
mov eax, dword [0x1401da710]
mov r8d, dword [0x1401da714]
xor r8d, 0xa1a42584
mov edx, r8d
xor edx, 0xffffffff
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
sub eax, 0xd5a51949
add eax, 0xf58911d9
add eax, 0xd5a51949
and eax, 0xdf8539ba
mov r8d, 0xffffffff
xor r8d, 0x6e31a565
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0xafaba6c4
xor r8d, 0x5054593b
xor ecx, r8d
imul ecx, edx
mov r8d, 0x730470e4
xor r8d, 0x1d35d581
mov edx, eax
and edx, r8d
or eax, 0x6e31a565
imul eax, edx
add eax, ecx
mov ecx, 0xa8ceaa12
xor ecx, 0x7f2e008
cmp eax, ecx
je 0x1400574e9
mov eax, dword [0x1401da718]
xor eax, 0x9c9d14a6
mov ecx, dword [0x1401da71c]
mov edx, 0xa2eac1f2
xor edx, 0x952831e4
xor ecx, edx
or eax, ecx
mov ecx, 0x43105475
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x48]
and eax, 0xe362588f
sub eax, 0x3928fa1a
sub eax, 0xabadefca
add eax, 0x3928fa1a
movabs rcx, 0x4000000000000000
and rcx, qword [rdx]
movabs rdx, 0x5e1c41b763a663bc
movabs r8, 0x5e1c41b763a663bc
xor rdx, r8
cmp rcx, rdx
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x1a1b9041
je 0x140057417
mov rax, qword [rsp + 0x58]
mov cl, byte [rsp + 0x2f]
test cl, 1
mov qword [rsp + 0x60], rax
jne 0x1400574ae
jmp 0x1400574c5
mov rcx, qword [rsp + 0x48]
call fcn.14000de03
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
mov r8, qword [r8 + 0x10]
mov qword [rdx + 0x10], r8
mov qword [rax], rcx
add rsp, 0x68
ret
fcos
jmp 0x140057417
Function at 0x140057500
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
call fcn.140043a70
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
call fcn.140043a90
mov rdx, qword [rsp + 0x50]
cmp rdx, 0
jge 0x140057573
mov rcx, qword [rsp + 0x50]
movabs rdx, 0x957a03fa3db565
movabs rax, 0x957a03fa3db565
xor rdx, rax
movabs r8, 0x1970bac96f5742eb
movabs rax, 0x668f453690a8bd14
xor r8, rax
call fcn.14000c4b0
jmp 0x140057741
mov rcx, qword [rsp + 0x50]
call fcn.140043c00
mov rcx, rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rcx
mov al, byte [rax]
mov cl, 0xf6
xor cl, 0xf6
cmp al, cl
jne 0x140057741
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x10], 0
cmp rax, 0
jge 0x140057732
mov eax, dword [0x1401da720]
mov ecx, dword [0x1401da724]
mov edx, 0x55b212ff
xor edx, 0x94899e36
xor ecx, edx
mov edx, 0xf0d6e739
xor edx, 0xf2918c6
mov r11d, eax
xor r11d, edx
mov r8d, 0x459322ee
xor r8d, 0xba6cdd11
mov edx, eax
xor edx, r8d
and r11d, edx
mov edx, ecx
xor edx, 0xffffffff
mov r8d, ecx
xor r8d, 0xffffffff
and edx, r8d
mov r8d, 0xacf3c849
xor r8d, 0x530c37b6
xor r11d, r8d
xor edx, 0xffffffff
and r11d, edx
xor eax, 0xffffffff
mov edx, 0xf669f88e
xor edx, 0x9960771
xor ecx, edx
and eax, ecx
xor r11d, 0xffffffff
xor eax, 0xffffffff
and r11d, eax
mov eax, 0xc6adb271
xor eax, 0x51154d67
imul r11d, eax
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0x531594b9
mov edx, 0xffffffff
xor edx, 0xa158688f
mov eax, ecx
and eax, 0xa158688f
and r11d, edx
mov r9d, r8d
and r9d, 0xa158688f
mov r10d, 0x8e83967d
xor r10d, 0xdd9602c4
and r10d, edx
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
mov r8d, 0x26556cd6
xor r8d, 0xd9aa9329
xor ecx, r8d
or edx, 0xa158688f
and ecx, edx
or eax, ecx
xor ecx, ecx
sub ecx, 0xbe91608b
sub eax, ecx
mov ecx, 0x7add7d22
xor ecx, 0xce28e31a
cmp eax, ecx
jae 0x14005774b
mov rcx, qword [rsp + 0x30]
mov eax, dword [str.mhfC]
mov edx, 0x578e3ad4
xor edx, 0xc7c85fbe
xor eax, edx
xor edx, edx
div dword [0x1401da72c]
xor eax, 0x27da61f9
mov edx, 0x5594365b
xor edx, 0xb1581ccc
add eax, edx
mov edx, 0x50b27aa
xor edx, 0xfa913ea0
or eax, edx
mov dword [rsp + 0x2c], eax
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
call fcn.14000c4b0
mov eax, dword [rsp + 0x2c]
cmp eax, 0xb1cb41b8
jb 0x1400576c8
jmp 0x140057741
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call fcn.140024dfb
mov rax, qword [rsp + 0x38]
add rsp, 0x58
ret
invalid
Function at 0x140059c70
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1401da880]
xor eax, 0x6b906ecd
mov ecx, dword [0x1401da884]
mov edx, 0xc2d1cb71
xor edx, 0x40dd97a0
xor ecx, edx
xor edx, edx
div ecx
xor eax, 0xfc01b3f5
and eax, 0x405bb4b6
mov ecx, eax
xor ecx, 0x332b2dbf
mov edx, 0x20981c87
xor edx, 0xdf67e378
xor ecx, edx
mov edx, 0xf9d1d5b0
xor edx, 0xcafaf80f
or eax, edx
and eax, ecx
cmp eax, 0x5832b918
je 0x140059d2a
mov eax, dword [0x1401da888]
xor eax, dword [0x1401da88c]
add eax, 0x1130fe7f
sub eax, 0xee418a42
sub eax, 0xd28ecc78
mov dword [rsp + 0x2c], eax
call fcn.140043a70
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x30]
call fcn.140058be0
mov eax, dword [rsp + 0x2c]
cmp eax, 0xa6cae978
jae 0x140059cde
add rsp, 0x48
ret
invalid
Function at 0x14005a6f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 0x28], r9
mov word [rbp - 0x1a], r8w
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x38]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp - 8], rax
mov eax, dword [0x1401da8c0]
xor eax, dword [0x1401da8c4]
mov ecx, 0xa6797279
xor ecx, 0x79774d40
xor edx, edx
div ecx
mov edx, 0xffffffff
xor edx, 0x7f869081
mov ecx, eax
and ecx, edx
mov r8d, 0x5b1594f3
xor r8d, 0x24930472
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
add eax, 0x753b4778
cmp eax, 0x9377ced4
jbe 0x14005a938
mov r9, qword [rbp - 0x10]
mov r8, qword [rbp - 0x18]
mov ecx, dword [0x1401da8c8]
mov eax, dword [0x1401da8cc]
xor ecx, 0x8c929f3b
not eax
or ecx, eax
mov eax, ecx
not eax
mov edx, eax
and edx, 0x2835c2eb
and ecx, 0xd7ca3d14
imul ecx, edx
mov edx, eax
and edx, 0xd7ca3d14
or eax, 0xd7ca3d14
imul eax, edx
add eax, ecx
imul rax, rax, 0x3a64f433
shr rax, 0x3d
or eax, 0xcced21f6
mov dword [rbp - 0x44], eax
mov ecx, 0xfbba0587
mov eax, 0x10
call fcn.1401d7280
sub rsp, rax
mov eax, dword [rbp - 0x44]
mov rdx, rsp
mov qword [rbp - 0x40], rdx
test r9, r9
setns dl
mov r8, qword [r8]
mov qword [rbp - 0x38], r8
sub r8, r9
setg r8b
and dl, r8b
mov byte [rbp - 0x29], dl
cmp eax, ecx
jae 0x14005a767
mov al, byte [rbp - 0x29]
test al, 1
jne 0x14005a865
jmp 0x14005a80d
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x38]
xor eax, eax
sub rax, rdx
movabs rdx, 0x76ab151f462d879
movabs r8, 0x76ab151f462d879
xor rdx, r8
movabs r8, 0x5233bad2c2c848dd
movabs r9, 0xadcc452d3d37b722
xor r8, r9
sub rdx, r8
add rax, rdx
xor edx, edx
sub rdx, rax
sub rsp, 0x20
call fcn.140012270
add rsp, 0x20
jmp 0x14005a933
mov r8, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x28]
mov r10w, word [rbp - 0x1a]
mov r9, rcx
add r9, 8
mov qword [rbp - 0x58], r9
mov rcx, qword [rcx + 8]
mov r9, rcx
add r9, 8
mov r11, r8
shl r11, 5
add r9, r11
add r9, 8
mov word [r9], r10w
add rcx, 8
shl r8, 5
add rcx, r8
add rcx, 0x10
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140013af0
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
add rsp, 0x20
mov rax, qword [rax]
mov qword [rbp - 0x50], rax
cmp rax, rcx
jg 0x14005a916
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x50]
mov rax, 0xffffffffffffffff
xor rax, 0xffffffffffffffff
xor r8d, r8d
sub r8, 1
sub rax, r8
sub rdx, rax
sub rsp, 0x20
call fcn.140012270
add rsp, 0x20
jmp 0x14005a933
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x58]
mov rax, qword [rax]
add rax, 8
shl rdx, 5
add rax, rdx
mov qword [rax], rcx
mov rsp, rbp
pop rbp
ret
movsb byte [rdi], byte [rsi]
xchg esi, eax
lodsd eax, dword [rsi]
jmp 0x14005a767
Function at 0x14005ef70
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
mov eax, dword [0x1401daa90]
mov ecx, dword [0x1401daa94]
xor ecx, 0x8662f563
add eax, ecx
mov ecx, 0x1f06b331
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
and eax, 0x94b69b53
mov edx, 0x872bd258
xor edx, 0x78d42da7
xor eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x94b69b53
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0x673e4727
xor ecx, 0x98c1b8d8
mov edx, eax
xor edx, ecx
and edx, 0x4bbb0ddf
mov r8d, 0x3667e54a
xor r8d, 0x7ddce895
mov ecx, 0xaa735a2
xor ecx, 0xf558ca5d
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x4bbb0ddf
mov r8d, 0x7c7bba1a
xor r8d, 0x37c0b7c5
or eax, r8d
imul eax, edx
add eax, ecx
cmp eax, 0xa16f83ed
ja 0x14005f12a
mov edx, dword [0x1401daa98]
mov eax, dword [0x1401daa9c]
or edx, eax
or edx, 0xfc20d23c
add edx, 0x6481fc83
mov eax, edx
and eax, 0x41fc223e
xor edx, 0x49fc223e
mov ecx, eax
mov eax, edx
lea eax, [rax + rcx*2]
mov dword [rsp + 0x3c], eax
call fcn.140043a70
mov rcx, rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rcx
movabs rcx, 0xe7037ed1a0b428db
xor rax, rcx
movabs rcx, 0xa0761d6478bd642f
mul rcx
mov rcx, rdx
mov rdx, qword [rsp + 0x20]
mov r8b, byte [rdx]
xor edx, edx
mov r9b, dl
xor rcx, rax
mov qword [rsp + 0x28], rcx
mov rax, rcx
not rax
movabs rdx, 0x14bb53354baa2e92
and rcx, rdx
movabs rdx, 0xeb44accab455d16d
mov qword [rsp + 0x30], rdx
and rax, rdx
mul rcx
mov r11, rax
mov rax, qword [rsp + 0x28]
mov rcx, rdx
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x40], rcx
mov rcx, rax
and rcx, rdx
or rax, rdx
mul rcx
mov r10, rax
mov eax, dword [rsp + 0x3c]
mov rcx, rdx
mov rdx, qword [rsp + 0x40]
add r10, r11
adc rcx, rdx
not r10
mov rdx, rcx
or rdx, r10
and rcx, r10
not rdx
or rdx, rcx
xor ecx, ecx
cmp r8b, r9b
cmove rcx, rdx
mov qword [rsp + 0x48], rcx
cmp eax, 0x6e9d6bd3
jbe 0x14005f021
mov rax, qword [rsp + 0x48]
add rsp, 0x58
ret
loope 0x14005f19e
int 0xe9
out dx, al
invalid
rol byte [rcx], 1
ror dword [rcx - 0xf7c38], 0xba
pop rsi
or ecx, dword [rsi - 0x5e0d7ea5]
hlt
Function at 0x140060910
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401dab98]
imul eax, dword [0x1401dab9c]
mov edx, 0xd0042875
xor edx, 0xd0042874
mov ecx, eax
add ecx, edx
mov edx, 0x2db88beb
xor edx, 0xd2477414
xor eax, edx
or eax, 0x3bc6fbd
add eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x800648d7
add eax, ecx
add eax, 1
sub eax, 0xaad29273
cmp eax, 0xe15cd348
je 0x140060a41
mov rcx, qword [rbp - 8]
mov eax, dword [0x1401daba0]
xor eax, 0x48fcee40
mov r9d, dword [0x1401daba4]
mov r10d, r9d
not r10d
mov r8d, eax
and r8d, r10d
mov edx, eax
or edx, r10d
not edx
imul edx, r8d
mov r8d, eax
and r8d, r9d
or eax, r9d
imul eax, r8d
add eax, edx
imul eax, eax, 0x5c654cd8
add eax, 0x742f6028
mov dword [rbp - 0x14], eax
mov eax, 0x10
mov qword [rbp - 0x28], rax
call fcn.1401d7280
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov rdx, rsp
call fcn.1401d7280
sub rsp, rax
mov rax, qword [rbp - 0x10]
mov r8, rsp
mov qword [rbp - 0x20], r8
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14001850a
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x20]
add rsp, 0x20
add rcx, 0x10
mov r8, qword [rax + 0x10]
mov qword [rdx], r8
mov rax, qword [rax + 0x18]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14001850a
mov eax, dword [rbp - 0x14]
add rsp, 0x20
cmp eax, 0xac26990d
je 0x140060972
mov rsp, rbp
pop rbp
ret
mov dh, 4
mov al, 0x17
jmp 0x140060972
Function at 0x140061060
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x30], rcx
mov eax, 0x10
call fcn.1401d7280
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x38], rax
mov rax, qword [0x1401eeb10]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.140007a23
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov rax, rcx
add rax, 8
mov qword [rbp - 0x18], rax
mov rax, qword [rcx + 8]
mov rcx, rdx
add rcx, 8
mov qword [rbp - 0x10], rcx
cmp rax, qword [rdx + 8]
mov qword [rbp - 8], rax
je 0x14006119d
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x30]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.140060dd0
mov rax, qword [rbp - 0x20]
add rsp, 0x20
cmp byte [rax + 0x60], 0
jne 0x1400611b6
mov eax, dword [0x1401dabb8]
mov edx, dword [0x1401dabbc]
mov r8d, 0x48fcee40
xor r8d, 0x48fcee41
mov ecx, eax
add ecx, r8d
xor eax, 0xffffffff
or eax, edx
add eax, ecx
mov ecx, 0xf947114d
xor ecx, 0x7941599a
sub eax, ecx
sub eax, 0xaad29273
mov ecx, 0x3fad37cb
xor edx, edx
div ecx
cmp eax, 0x7df009b5
jae 0x1400611bb
mov rcx, qword [rbp - 0x10]
mov eax, dword [0x1401dabc0]
xor eax, 0x19ea2476
mov edx, dword [0x1401dabc4]
xor edx, 0xde3b68e5
sub eax, edx
xor edx, edx
sub edx, 0xaf29d813
add eax, edx
imul eax, eax, 0x5c654cd8
or eax, 0x4845ab71
mov rcx, qword [rcx]
mov qword [rbp - 0x40], rcx
cmp eax, 0x890ae224
je 0x14006114c
mov rax, qword [rbp - 0x40]
mov qword [rbp - 8], rax
jmp 0x14006119d
mov rax, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov r8, qword [r8]
mov qword [rdx], r8
mov qword [rax], rcx
mov rsp, rbp
pop rbp
ret
mov dh, 4
mov al, 0x17
jmp 0x14006114c
Function at 0x140063560
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 8], rcx
mov ecx, dword [0x1401dad28]
mov eax, dword [0x1401dad2c]
sub ecx, 0x9626acd6
sub ecx, eax
mov eax, 0x61962c59
xor eax, 0xf7b0808f
add ecx, eax
mov eax, 0xd6499bde
xor eax, 0xbe3fe1f1
sub ecx, eax
mov eax, 0x9b214ebc
xor eax, 0xec440166
add ecx, eax
mov eax, 0xb30c3261
xor eax, 0xdb7a484e
add ecx, eax
mov eax, 0x22309002
xor eax, 0x68edd603
sub ecx, eax
mov eax, 0xccd650ae
xor eax, 0xd0aff664
sub ecx, eax
add ecx, 0x4add4601
mov eax, ecx
or eax, eax
xor eax, 0xffffffff
mov edx, 0x6247068f
xor edx, 0x4820fbe3
mov r8d, 0x16907316
xor r8d, 0xe96f8ce9
xor edx, r8d
mov r8d, 0xffffffff
xor r8d, 0x2a67fd6c
and edx, r8d
or eax, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x2a67fd6c
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
cmp eax, 0xc52fb6d7
je 0x1400636cd
mov rdx, qword [rbp - 8]
mov r8d, dword [0x1401dad30]
mov eax, dword [0x1401dad34]
sub r8d, eax
add r8d, 0x375d7b1b
mov eax, r8d
xor eax, 0x19ac17ab
xor r8d, 0xe6514010
and r8d, 0xf75942b0
mov ecx, eax
and ecx, 0x8a6bd4f
imul ecx, r8d
mov r8d, eax
and r8d, 0xf75942b0
or eax, 0xf75942b0
imul eax, r8d
add eax, ecx
mov dword [rbp - 0x10], eax
mov eax, 0x10
call fcn.1401d7280
sub rsp, rax
mov rcx, rsp
mov qword [rbp - 0x18], rcx
mov word [rcx], 0
mov r8d, 2
sub rsp, 0x20
call fcn.140063c89
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbp - 0x10]
add rsp, 0x20
mov cx, word [rcx]
mov word [rbp - 0xa], cx
cmp eax, 0x6070b608
je 0x14006362a
mov ax, word [rbp - 0xa]
mov rsp, rbp
pop rbp
ret
fbld tbyte [rsi - 0x32]
movsd dword [rdi], dword [rsi]
jmp 0x14006362a
Function at 0x140064ce0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov r8d, dword [0x1401dadb8]
mov edx, dword [0x1401dadbc]
mov ecx, r8d
xor ecx, 0xffffffff
mov eax, 0x73e6e5f0
xor eax, 0x25c6a275
and eax, ecx
mov r9d, 0xffffffff
xor r9d, 0x56204785
and r8d, r9d
mov ecx, edx
xor ecx, 0xffffffff
and ecx, 0x56204785
and edx, r9d
or eax, r8d
or ecx, edx
xor eax, ecx
and eax, 0x6c64994
mov r8d, 0xffffffff
xor r8d, 0x6517bc19
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0x684dd76
xor r8d, 0x6393616f
mov edx, eax
and edx, r8d
or eax, 0x6517bc19
imul eax, edx
add eax, ecx
sub eax, 0x21145b29
cmp eax, 0x864d5a3e
jbe 0x140064e57
mov r8, qword [rsp + 0x18]
mov eax, dword [0x1401dadc0]
sub eax, dword [0x1401dadc4]
mov ecx, 0x1f78de46
xor ecx, 0xa3d410fd
imul eax, ecx
add eax, 0x560cb50e
mov ecx, 0xf2afad5
xor ecx, 0x9e1c9695
xor edx, edx
div ecx
mov ecx, 0xe2b22773
xor ecx, 0xa673cfa4
xor edx, edx
test r8, r8
cmovg rdx, r8
mov qword [rsp + 0x10], rdx
cmp eax, ecx
je 0x140064d85
xor eax, eax
mov qword [rsp + 8], rax
jmp 0x140064de5
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 8]
mov qword [rsp], rax
cmp rax, rcx
je 0x140064e52
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov dl, byte [rdx + rax]
mov byte [rcx + rax], dl
movabs rcx, 0xb503914c99c0abbd
movabs rdx, 0xca1202a7687a64ad
xor rcx, rdx
sub rax, rcx
add rax, 1
movabs rcx, 0x699843090488a4a7
movabs rdx, 0x1689d0e2f5326bb7
xor rcx, rdx
add rax, rcx
mov qword [rsp + 8], rax
jmp 0x140064de5
add rsp, 0x30
ret
fnsave dword [rdx + rcx*4 - 0x6f]
jmp 0x140064d85
Function at 0x140064e60
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 8], rcx
mov eax, dword [0x1401dadc8]
xor edx, edx
div dword [0x1401dadcc]
mov ecx, eax
xor ecx, 0xf1395d66
mov edx, 0x89ac11bf
xor edx, 0x7653ee40
xor ecx, edx
mov edx, 0x974edfc8
xor edx, 0x667782ae
or eax, edx
and eax, ecx
mov r8d, 0xffffffff
xor r8d, 0xd7ba1e8a
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x6cc4f1f2
xor r8d, 0x933b0e0d
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xd7ba1e8a
or eax, 0xd7ba1e8a
imul eax, edx
add eax, ecx
add eax, 0x36984d4e
mov ecx, 0xd1846b0f
xor ecx, 0xc4973b21
cmp eax, ecx
jb 0x140064f99
mov rdx, qword [rbp - 8]
mov ecx, dword [0x1401dadd0]
mov r8d, dword [0x1401dadd4]
mov eax, ecx
not eax
mov r9d, r8d
not r9d
or eax, r9d
and ecx, r8d
not ecx
and eax, ecx
not eax
add eax, 0x75066a36
mov ecx, eax
or ecx, 0xd88d480b
not eax
and eax, 0x23208280
and ecx, 0xd8cf486f
or eax, ecx
xor eax, 0xce56e102
mov dword [rbp - 0x10], eax
mov eax, 0x10
call fcn.1401d7280
sub rsp, rax
mov rcx, rsp
mov qword [rbp - 0x18], rcx
mov byte [rcx], 0
movabs r8, 0xb8681a3af59f7e1d
movabs rax, 0xb8681a3af59f7e1c
xor r8, rax
sub rsp, 0x20
call fcn.140064ce0
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbp - 0x10]
add rsp, 0x20
mov cl, byte [rcx]
mov byte [rbp - 9], cl
cmp eax, 0x86c4c162
jae 0x140064ef4
mov al, byte [rbp - 9]
mov rsp, rbp
pop rbp
ret
imul ebx, dword [rdx + 0x52e983f2], 0xffffffff
invalid
Function at 0x140068c70
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], rcx
mov edx, dword [0x1401db058]
mov eax, 0x8a84c37a
xor eax, 0xf24a3c2d
xor edx, eax
mov eax, dword [0x1401db05c]
mov r8d, 0xabdd9411
xor r8d, 0x54226bee
mov ecx, edx
xor ecx, r8d
xor edx, 0xffffffff
or ecx, edx
and eax, eax
xor eax, 0xffffffff
xor ecx, 0xffffffff
xor eax, 0xffffffff
or ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x33ab02e5
mov edx, 0x8cda7168
xor edx, 0xbf71738d
mov r8d, 0xd626ad09
xor r8d, 0x29d952f6
xor edx, r8d
and ecx, edx
or eax, ecx
mov ecx, 0x6c419d0c
xor ecx, 0x5539d575
sub eax, ecx
imul eax, eax, 0xe4fb2a2b
cmp eax, 0x72b4614f
je 0x140068e06
mov ecx, dword [0x1401db060]
mov edx, dword [0x1401db064]
xor edx, 0x5566dfa4
mov eax, ecx
or eax, edx
and ecx, edx
not ecx
and eax, ecx
not eax
and eax, 0x508db59
add eax, 0x442727ac
and eax, 0xd2c7b6c
mov dword [rbp - 0x10], eax
mov eax, 0xdc268fd8
mov dword [rbp - 0x14], eax
mov eax, 0x10
mov qword [rbp - 0x30], rax
call fcn.1401d7280
sub rsp, rax
mov rax, qword [rbp - 0x30]
mov rcx, rsp
mov qword [rbp - 0x28], rcx
call fcn.1401d7280
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
sub rsp, 0x20
call fcn.140068a70
mov rdx, qword [rbp - 8]
mov ecx, dword [rbp - 0x14]
add rsp, 0x20
mov eax, dword [rbp - 0x10]
cmp rdx, 0
setl dl
mov byte [rbp - 9], dl
cmp eax, ecx
ja 0x140068d01
mov al, byte [rbp - 9]
test al, 1
jne 0x140068d9d
jmp 0x140068dc1
mov rcx, qword [rbp - 8]
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
sub rsp, 0x20
call fcn.14000c4b0
add rsp, 0x20
jmp 0x140068dfd
mov rcx, qword [rbp - 0x28]
mov rdx, qword [rbp - 8]
sub rsp, 0x20
call fcn.140018c10
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
add rsp, 0x20
mov rdx, qword [rax]
mov rax, qword [rax + 8]
mov qword [rcx], rdx
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.140068b6e
add rsp, 0x20
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x38]
mov rsp, rbp
pop rbp
ret
mov dh, 4
mov al, 0x17
jmp 0x140068d01
Function at 0x140069050
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov dword [rbp - 0xc], edx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401db078]
mov edx, dword [0x1401db07c]
xor edx, 0x59eca88f
mov ecx, eax
and ecx, edx
shl ecx, 1
add eax, edx
sub eax, ecx
mov ecx, 0x645ffd40
xor ecx, 0xaf2170fb
sub eax, ecx
xor eax, 0x68623c68
mov edx, eax
xor edx, 0xffffffff
and edx, 0x85650c72
mov r8d, 0xffffffff
xor r8d, 0x85650c72
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0xa599ba2b
xor r8d, 0x20fcb659
mov edx, eax
and edx, r8d
or eax, 0x85650c72
imul eax, edx
add eax, ecx
cmp eax, 0xa34e1ab5
ja 0x1400691a4
mov ecx, dword [rbp - 0xc]
mov eax, dword [0x1401db080]
xor eax, 0x6b6f36a1
mov edx, dword [0x1401db084]
or eax, edx
imul eax, eax, 0x42ac65f1
add eax, 0xb299458e
xor eax, 0x5ed65b7f
mov dword [rbp - 0x14], eax
mov eax, 0x10
mov qword [rbp - 0x38], rax
call fcn.1401d7280
sub rsp, rax
mov rax, qword [rbp - 0x38]
mov rdx, rsp
mov qword [rbp - 0x28], rdx
call fcn.1401d7280
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov rdx, rsp
mov qword [rbp - 0x30], rdx
mov dword [rax], ecx
sub rsp, 0x20
call fcn.140068a70
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov dword [rcx], 0
sub rsp, 0x20
call fcn.1400691ad
mov rcx, qword [rbp - 0x20]
mov eax, dword [rbp - 0x14]
add rsp, 0x20
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0xd], cl
cmp eax, 0x639935c9
je 0x1400690d7
mov al, byte [rbp - 0xd]
test al, 1
jne 0x140069188
jmp 0x14006919f
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x30]
mov edx, dword [rax]
sub rsp, 0x20
call fcn.1400308c9
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
cli
je 0x1400691c4
mov ecx, ebp
sub bh, bh
invalid
mov eax, 4