joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001aa90
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.14000b1d6
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1400c38b9
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14001aacb
mov rax, qword [rsp + 0x28]
mov qword [rax], 0
mov eax, dword [0x1401c8d88]
mov ecx, dword [0x1401c8d8c]
add eax, 0x6175e3ac
add eax, ecx
sub eax, 0x6175e3ac
mov edx, 0x82cedd9d
xor edx, 0x7d312262
mov ecx, eax
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0x97adeb4d
or ecx, edx
mov edx, 0x20110110
xor edx, 0xb7bcea5d
and eax, edx
mov edx, 0xf710cd2b
xor edx, 0x8ef32d4
xor eax, edx
and ecx, eax
xor ecx, 0xffffffff
add ecx, 0x4fb4a9ff
sub ecx, 0x7ac7e045
mov eax, 0xe5eabadd
xor eax, 0xaa5e1322
sub ecx, eax
mov edx, 0xaebe7d33
xor edx, 0x514182cc
mov eax, ecx
xor eax, edx
mov edx, 0xffffffff
xor edx, 0x1b480ca0
and eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x1b480ca0
and ecx, edx
mov edx, 0x19c5743d
xor edx, 0xe63a8bc2
xor eax, edx
mov edx, 0x3d99
xor edx, 0xffffc266
xor ecx, edx
and eax, ecx
cmp eax, 0x3e5b27f4
jb 0x14001abc9
mov eax, dword [0x1401c8d90]
and eax, dword [0x1401c8d94]
or eax, 0x4e83c9ab
mov ecx, eax
and ecx, 0x57970f79
shl ecx, 1
add eax, 0x57970f79
sub eax, ecx
mov ecx, 0x2e6357a6
xor ecx, 0x2bdd5ad0
or eax, ecx
cmp eax, 0x679e141c
je 0x14001ab89
add rsp, 0x38
ret
idiv dword [rbp - 0x4816d2f7]
invalid
Function at 0x14001be40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
movabs rcx, 0xd55696f618f75069
movabs rax, 0xd55696f618f75079
xor rcx, rax
call fcn.140007f3d
mov rdx, rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rdx
mov rcx, rdx
add rcx, rax
mov qword [rsp + 0x50], rcx
mov r9, rcx
xor r9, rax
xor r9, 0xffffffffffffffff
mov r8, rax
and r8, r9
shl r8, 1
sub r8, rax
mov rax, rcx
sub rax, r8
xor rcx, rdx
and rax, rcx
cmp rax, 0
jge 0x14001beb9
call fcn.140008024
jmp 0x14001c05f
mov eax, dword [0x1401c8e18]
mov edx, dword [0x1401c8e1c]
mov r8d, eax
xor r8d, edx
mov ecx, 0x53549021
xor ecx, 0xacab6fde
xor r8d, ecx
mov ecx, edx
and ecx, r8d
shl ecx, 1
sub ecx, edx
sub eax, ecx
mov edx, 0xe68d87c2
xor edx, 0x1972783d
mov ecx, eax
xor ecx, edx
mov edx, eax
xor edx, 0xffffffff
or ecx, edx
mov edx, 0x359313c
xor edx, 0xfca6cec3
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0xaddd0888
or ecx, edx
mov edx, 0xffffffff
xor edx, 0xaddd0888
mov r8d, 0xffffffff
xor r8d, 0xaddd0888
or edx, r8d
and eax, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
xor eax, 0xffffffff
or ecx, eax
mov edx, 0xce31d983
xor edx, 0x618edc9d
mov eax, ecx
and eax, edx
mov edx, 0xb6a71ab4
xor edx, 0x19181faa
or ecx, edx
add eax, ecx
mov ecx, 0x37331035
xor ecx, 0x5a0c129b
sub eax, ecx
cmp eax, 0xb77254da
ja 0x14001c069
mov rcx, qword [rsp + 0x50]
mov eax, dword [0x1401c8e20]
mov r8d, dword [0x1401c8e24]
xor r8d, 0x64c95d6c
xor edx, edx
sub edx, eax
xor eax, eax
sub eax, r8d
add edx, eax
xor eax, eax
sub eax, edx
add eax, 0x9331500b
add eax, 0x2730ad7
sub eax, 0xb29ad032
cmp rcx, 0
setl cl
mov byte [rsp + 0x37], cl
cmp eax, 0xb1834c19
je 0x14001bf73
mov al, byte [rsp + 0x37]
test al, 1
jne 0x14001bfd1
jmp 0x14001bfe1
mov rcx, r8
mov rdx, r8
call fcn.14000c8ac
jmp 0x14001c05f
mov rax, qword [rsp + 0x38]
movabs rcx, 0xc5fd64cef0a06cc2
movabs rdx, 0xc5fd64cef0a06cc2
xor rcx, rdx
cmp rax, rcx
jge 0x14001c016
mov rcx, r8
mov rdx, r8
call fcn.14000c8ac
jmp 0x14001c05f
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
call fcn.140010280
mov rdx, rax
mov rax, qword [rsp + 0x48]
movabs rcx, 0x9ce5044c83445426
movabs r8, 0x9ce5044c83445426
xor rcx, r8
sub rcx, rdx
sub rax, rcx
mov qword [rax - 0x10], 0
mov qword [rax - 8], 0
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rsp, 0x58
ret
mov ch, 6
test cl, dl
jmp 0x14001bf73
Function at 0x14001d8f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.14000b1d6
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.14005e3c0
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14001da58
mov eax, dword [0x1401c8ec8]
mov r8d, dword [0x1401c8ecc]
mov ecx, 0xaca73ffa
xor ecx, 0xad625cc
xor r8d, ecx
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov ecx, 0xb1d1ce8f
xor ecx, 0x4e2e3170
mov r9d, r8d
xor r9d, ecx
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xfcba3fc4
xor ecx, 0xdf7cb3f9
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
or eax, 0xa02c74ae
xor eax, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xa02c74ae
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
sub eax, 0x1c45e9b2
cmp eax, 0x6b1ebd7f
jb 0x14001da5d
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401c8ed0]
mov r9d, dword [0x1401c8ed4]
mov r8d, 0x9a6338f4
xor r8d, 0x659cc70b
mov edx, eax
xor edx, r8d
mov r8d, r9d
and r8d, edx
mov edx, 0x8b6610c7
xor edx, 0x7499ef38
mov r10d, r9d
xor r10d, edx
mov edx, eax
and edx, r10d
imul edx, r8d
mov r8d, eax
and r8d, r9d
or eax, r9d
imul eax, r8d
add eax, edx
mov r8d, 0x64df2eff
xor edx, edx
div r8d
mov edx, eax
and edx, 0xaba940eb
mov r8d, 0x9de7463e
xor r8d, 0x9de7463c
imul edx, r8d
mov r8d, 0xf1a50f46
xor r8d, 0x5a0c4fad
xor eax, r8d
add eax, edx
imul eax, eax, 0x792f7063
mov dword [rsp + 0x24], eax
mov edx, 0x20
call fcn.140008640
mov eax, dword [rsp + 0x24]
cmp eax, 0xe87b202a
ja 0x14001d9a7
jmp 0x14001da58
add rsp, 0x38
ret
or ebp, dword [rcx + 0x41e9b6a4]
invalid

Function at 0x14001e730
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
call fcn.140011df7
test al, 1
jne 0x14001e74b
jmp 0x14001e755
mov rcx, qword [rsp + 0x20]
call fcn.14000f700
mov eax, dword [0x1401c8f58]
mov ecx, 0x29e6ac6b
xor ecx, 0x150f81bc
xor eax, ecx
or eax, dword [0x1401c8f5c]
xor ecx, ecx
sub ecx, 0x35e0c04d
sub eax, ecx
mov edx, 0x5fa69f98
xor edx, 0xc97417ba
mov ecx, eax
xor ecx, edx
mov edx, 0x71acfca8
xor edx, 0x8e530357
xor ecx, edx
and ecx, 0x96d28822
shl ecx, 1
sub ecx, 0x96d28822
sub eax, ecx
mov edx, 0x95aa438f
xor edx, 0x14801ff8
mov ecx, eax
and ecx, edx
shl ecx, 1
add eax, 0x812a5c77
sub eax, ecx
cmp eax, 0xc4fbf256
je 0x14001e808
mov eax, dword [0x1401c8f60]
sub eax, dword [0x1401c8f64]
mov ecx, eax
add ecx, 1
mov edx, 0xa0faafbe
xor edx, 0x5f055041
xor eax, edx
or eax, 0x9d7573ff
add eax, ecx
and eax, 0x43f5e686
and eax, 0x774618c9
cmp eax, 0x440b6184
ja 0x14001e7c9
add rsp, 0x28
ret
and dh, dh
mov dh, 0x48
jmp 0x14001e7c9
Function at 0x1400224f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rcx
call fcn.14000b1d6
mov rcx, qword [rsp + 0x38]
add rax, 0x60
mov qword [rsp + 0x40], rax
add rcx, 8
mov qword [rsp + 0x48], rcx
xor eax, eax
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov qword [rsp + 0x30], rdx
cmp rax, rcx
jge 0x140022726
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.14001ba10
test al, 1
jne 0x140022565
jmp 0x1400225be
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.1401871b0
mov rax, qword [rsp + 0x40]
mov al, byte [rax]
mov cl, 0xa6
xor cl, 0xa6
cmp al, cl
jne 0x14002273f
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
movabs rdx, 0x50b4c4d33f72ace9
movabs rax, 0x50b4c4d33f72ace1
xor rdx, rax
call fcn.14000e6f9
mov eax, dword [0x1401c9138]
mov r8d, dword [0x1401c913c]
mov ecx, 0x56fa4d11
xor ecx, 0xf107840f
xor r8d, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
mov r9d, 0xc6cd5f81
xor r9d, 0x3932a07e
xor ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x11c94cec
xor ecx, 0x227dba13
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0x698265fb
xor edx, 0xdfb47da9
and eax, edx
mov edx, 0xffffffff
xor edx, 0xb6361852
and ecx, edx
sub ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
mov edx, 0x100c0e73
xor edx, 0x299bf9a6
mov r8d, 0xb170e8f
xor r8d, 0xf4e8f170
xor edx, r8d
or eax, edx
mov edx, 0x3997f7d5
and edx, 0x3997f7d5
mov r8d, 0xfc62212a
xor r8d, 0x39dded5
xor edx, r8d
mov r8d, 0xb9e6b6eb
xor r8d, 0x46194914
xor ecx, r8d
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
mov ecx, 0x6cd6d471
xor ecx, 0x93292b8e
xor eax, ecx
cmp eax, 0x1bb49f9c
jbe 0x140022745
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401c9140]
mov r8d, dword [0x1401c9144]
xor r8d, 0xddaf6d86
mov edx, 0xb6c9ea34
xor edx, 0xb6c9ea34
sub edx, r8d
sub eax, edx
imul eax, eax, 0x7009b629
mov r8d, 0x1df9fd8a
xor edx, edx
div r8d
sub eax, 0xa4936fb6
mov edx, 0xae48f49b
xor edx, 0xde3888d5
sub eax, edx
add eax, 0xa4936fb6
add rcx, 1
mov qword [rsp + 0x20], rcx
cmp eax, 0xff8f21b9
jae 0x1400226b2
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
jmp 0x14002251c
mov rax, qword [rsp + 0x30]
cmp rax, 0
je 0x14002273f
mov rcx, qword [rsp + 0x30]
call fcn.14000e54a
nop
add rsp, 0x58
ret
push 0xffffffffe95a2e43
invalid
Function at 0x140026540
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov rdx, qword [rcx]
mov qword [rsp + 0x50], rdx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x58], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x60], rax
movabs r8, 0xfd982528469101e7
mov rcx, rdx
sub rcx, r8
add rcx, 1
movabs r8, 0xfd982528469101e7
add rcx, r8
mov qword [rsp + 0x68], rcx
mov r8, rdx
xor r8, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
and r8, 0xffffffffffffffff
shl r8, 1
movabs r9, 0x143fecd23470a91d
movabs r10, 0xebc0132dcb8f56e2
xor r9, r10
sub r8, r9
sub rdx, r8
and rcx, rdx
mov qword [rsp + 0x70], rcx
cmp rax, 0
je 0x140026708
mov eax, dword [0x1401c92d8]
mov r8d, dword [0x1401c92dc]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x916dc41f
mov edx, 0x6b6ebd82
xor edx, 0xfa03799d
mov r8d, 0x1686e522
xor r8d, 0xe9791add
xor edx, r8d
and eax, edx
sub eax, ecx
add eax, 0xd1f070fc
mov ecx, 0xf239444d
xor edx, edx
div ecx
cmp eax, 0xf15d4579
jae 0x140026778
mov rcx, qword [rsp + 0x70]
mov eax, dword [0x1401c92e0]
mov edx, 0xa618596e
xor edx, 0x9e2a47c2
xor eax, edx
mov edx, dword [0x1401c92e4]
mov r8d, 0x563cb985
xor r8d, 0xa9846c88
sub eax, r8d
add eax, edx
mov edx, 0x60ded384
xor edx, 0x9f660689
add eax, edx
xor eax, 0x251bd198
sub eax, 0x7d4e0958
mov edx, 0xbc421374
xor edx, 0xa4f3197e
add eax, edx
add eax, 0x7d4e0958
mov r8d, 0xbd65fc9a
xor edx, edx
div r8d
cmp rcx, 0
setl cl
mov byte [rsp + 0x3f], cl
cmp eax, 0x3d946148
je 0x140026649
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x1400266fe
jmp 0x1400266d4
mov rax, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
movabs rcx, 0xbfffffffffffffff
and rcx, qword [rax]
cmp rcx, rdx
mov qword [rsp + 0x30], rax
jl 0x140026708
jmp 0x140026752
call fcn.140008024
jmp 0x140026773
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
mov r8d, 1
mov r9d, 8
mov qword [rsp + 0x20], 8
call fcn.140010bb0
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
mov qword [rdx], rax
cmp rcx, 0
mov qword [rsp + 0x30], rax
jge 0x140026752
call fcn.140008024
jmp 0x140026773
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x30]
mov qword [r8], r9
mov qword [rax + rcx*8 + 8], rdx
add rsp, 0x78
ret
mov r10b, 0xfb
mov ah, 0xe9
enter 0xfffffffffffffffe, 0xffffffffffffffff
Function at 0x1400279a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov rdx, qword [rcx]
movabs rcx, 0xaf2fb52e2ee56971
mov rax, rdx
sub rax, rcx
add rax, 0xffffffffffffffff
movabs rcx, 0xaf2fb52e2ee56971
add rax, rcx
mov qword [rsp + 0x50], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
movabs rdx, 0xc4dcd6ea6ec54382
movabs r8, 0x3b232915913abc7d
xor rdx, r8
cmp rax, rdx
setg al
and al, cl
test al, 1
jne 0x140027a28
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
add rcx, 8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
jmp 0x140027a32
call fcn.140008024
jmp 0x140027bfc
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
cmp rax, rcx
jl 0x140027bef
mov rax, qword [rsp + 0x28]
cmp rax, 0
jl 0x140027b60
mov eax, dword [0x1401c9358]
mov ecx, dword [0x1401c935c]
xor ecx, 0x4c2bb7f7
xor edx, edx
div ecx
and eax, 0x9117a930
sub eax, 0x5a7d1db2
mov edx, eax
and edx, 0x453cbc74
mov ecx, 0x27d2ce9e
xor ecx, 0x27d2ce9c
imul ecx, edx
add eax, 0x453cbc74
sub eax, ecx
mov ecx, 0xbd8c40a3
xor ecx, 0x631864d3
cmp eax, ecx
jb 0x140027c01
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x48]
mov eax, dword [str._a_bi]
or eax, dword [0x1401c9364]
mov ecx, 0x3bee8164
xor ecx, 0xb360ce0
sub eax, ecx
mov r10d, 0xd5a2faca
xor r10d, 0xa7725cdf
mov ecx, 0x4ffb53b
xor ecx, 0xfb004ac4
xor r10d, ecx
mov r9d, eax
and r9d, r10d
mov ecx, eax
or ecx, r10d
mov r10d, 0x64c6677e
xor r10d, 0x9b399881
xor ecx, r10d
imul ecx, r9d
mov r10d, 0x12ec6a49
xor r10d, 0x603ccc5c
mov r9d, eax
and r9d, r10d
or eax, 0x72d0a615
imul eax, r9d
add eax, ecx
mov ecx, 0xfa918c4e
xor ecx, 0xfc19a612
imul eax, ecx
mov ecx, 0x734d576f
xor ecx, 0x56ffe7ed
cmp rdx, qword [r8]
setl dl
mov byte [rsp + 0x27], dl
cmp eax, ecx
jae 0x140027aa9
mov al, byte [rsp + 0x27]
test al, 1
jne 0x140027b6d
jmp 0x140027b60
mov rcx, rdx
call fcn.1400122ad
jmp 0x140027bfc
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
lea rcx, [rax + rcx*8 + 8]
call fcn.140027960
mov rcx, qword [rsp + 0x28]
mov rax, rcx
dec rax
mov rdx, rcx
neg rdx
movabs r9, 0x4f89e26d6a6aa4df
and rdx, r9
movabs r10, 0xb0761d9295955b20
mov r8, rax
and r8, r10
or rdx, r8
mov r8, rcx
xor r8, r9
xor rdx, r8
sets r8b
test rcx, rcx
setne cl
sete dl
or dl, r8b
add cl, dl
inc cl
test cl, 1
mov qword [rsp + 0x38], rax
jne 0x140027be5
jmp 0x140027a32
call fcn.140008024
jmp 0x140027bfc
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
add rsp, 0x58
ret
sub byte [rax], dh
cwde
jmp 0x140027aa9
Function at 0x140034ea0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x38], r8
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x28], rcx
mov eax, 0x10
call fcn.1401c7680
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x30], rax
sub rsp, 0x20
call fcn.1400342c0
mov rcx, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x18]
add rsp, 0x20
mov qword [rbp - 0x10], rax
mov qword [r8], 0
sub rsp, 0x20
call fcn.140034e29
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x10]
mov rdx, rcx
mov qword [rbp - 8], rdx
mov al, byte [rax]
test al, al
setne al
test rcx, rcx
sete cl
or al, cl
test al, 1
jne 0x140034fef
mov eax, dword [0x1401c9920]
mov ecx, dword [0x1401c9924]
and eax, eax
xor eax, 0xffffffff
and ecx, ecx
mov edx, 0xe862491e
xor edx, 0x179db6e1
xor ecx, edx
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0x71e9411c
xor edx, edx
div ecx
mov r8d, 0xffffffff
xor r8d, 0x621d47a0
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0x7684edf5
xor r8d, 0x1499aa55
mov edx, eax
and edx, r8d
or eax, 0x621d47a0
imul eax, edx
add eax, ecx
mov ecx, 0xecdf2492
xor ecx, 0x3709c161
sub eax, ecx
cmp eax, 0x8debaa43
jbe 0x140034ff8
mov rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x30]
mov ecx, dword [0x1401c9928]
mov r9d, dword [0x1401c992c]
mov eax, ecx
and eax, r9d
xor ecx, r9d
or eax, ecx
and eax, 0x9ef72bd8
and eax, 0x7f21cc52
or eax, 0x3faae4c1
mov ecx, 0x168ac4ce
xor ecx, 0x2c7a0214
mov r8, qword [r8]
mov qword [rdx], r8
cmp eax, ecx
jb 0x140034fa3
jmp 0x140034fef
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
pop rax
mov al, byte [rbx - 0x5d16dd]
invalid
Function at 0x140043b40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1401c9e70]
xor eax, 0x151883ce
mov r8d, dword [0x1401c9e74]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x66711527
mov edx, 0xffffffff
xor edx, 0x66711527
and eax, edx
sub eax, ecx
or eax, 0xe2f216af
mov edx, 0xffffffff
xor edx, 0x1670cde9
mov ecx, eax
and ecx, edx
mov r8d, 0xc24c868c
xor r8d, 0xd43c4b65
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
cmp eax, 0xd14c77e3
jb 0x140043c7c
mov eax, dword [0x1401c9e78]
sub eax, dword [0x1401c9e7c]
or eax, 0x9778ea5a
add eax, 0x9dffa842
mov ecx, eax
and ecx, 0xacb325f6
shl ecx, 1
mov edx, 0x23b25f0
xor edx, 0xae880006
add eax, edx
sub eax, ecx
mov dword [rsp + 0x3c], eax
mov eax, 0x3b526f3
xor eax, 0xcabf4082
mov dword [rsp + 0x38], eax
call fcn.140043b19
mov ecx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x3c]
cmp eax, ecx
je 0x140043bce
xor eax, eax
mov qword [rsp + 0x30], rax
jmp 0x140043c31
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp rax, 0x18
je 0x140043c77
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
mov byte [rcx + rax], 0
movabs rcx, 0xbfd66356f85a3e52
movabs rdx, 0xbfd66356f85a3e53
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x30], rax
jmp 0x140043c31
clc
push rsi
invalid
add rsp, 0x48
ret
jl 0x140043c58
inc byte [rsi]
jmp 0x140043bce
Function at 0x140043c90
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rcx
mov eax, 0x10
call fcn.1401c7680
sub rsp, rax
mov rax, rsp
mov qword [rbp - 8], rax
sub rsp, 0x20
call fcn.140043b19
mov rcx, qword [rbp - 0x10]
mov r8, qword [rbp - 8]
add rsp, 0x20
movabs rdx, 0xec4b9bb5c84a1a75
movabs rax, 0xec4b9bb5c84a1a76
xor rdx, rax
sub rsp, 0x20
call fcn.140044820
add rsp, 0x20
test al, 1
jne 0x140043cf8
jmp 0x140043d0a
sub rsp, 0x20
call fcn.140008024
add rsp, 0x20
jmp 0x140043df2
mov rax, qword [rbp - 8]
mov rax, qword [rax]
mov ecx, 2
cqo
idiv rcx
mov rdx, rax
and rdx, 4
shl rdx, 1
mov rcx, rax
xor rcx, 4
add rcx, rdx
mov qword [rbp - 0x18], rcx
mov rdx, rax
xor rdx, 0xffffffffffffffff
mov r8, rax
xor r8, 0xffffffffffffffff
and rdx, r8
mov r8, 0xffffffffffffffff
or r8, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
and rdx, r8
or rax, 0xffffffffffffffff
movabs r8, 0x67c70c84dbdceaa1
movabs r9, 0x9838f37b2423155e
xor r8, r9
xor rax, r8
xor rdx, 0xffffffffffffffff
xor rax, 0xffffffffffffffff
and rdx, rax
movabs rax, 0xe97b274de0711161
movabs r8, 0x1684d8b21f8eee9e
xor rax, r8
xor rdx, rax
mov rax, rcx
xor rax, rdx
and rax, rcx
movabs rcx, 0xfa4fb2650689e929
movabs rdx, 0xfa4fb2650689e929
xor rcx, rdx
cmp rax, rcx
jge 0x140043ddd
sub rsp, 0x20
call fcn.140008024
add rsp, 0x20
jmp 0x140043df2
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call fcn.140032cac
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x28], rax
mov ecx, dword [0x1401c9e80]
mov edx, dword [0x1401c9e84]
mov eax, ecx
and eax, edx
or ecx, edx
add eax, ecx
imul eax, eax, 0x7b93fa59
add eax, 0x365bc086
mov ecx, 0x1c9aacbe
xor ecx, 0x1d2a3a4f
add eax, ecx
mov ecx, 0xe2064f85
xor ecx, 0x6d8890a8
cmp eax, ecx
jbe 0x140043e76
mov eax, dword [0x1401c9e88]
add eax, dword [0x1401c9e8c]
add eax, 0x9cd29567
mov ecx, 0xbd8ebffa
xor edx, edx
div ecx
mov ecx, 0x2b0e3ced
xor ecx, 0x3a14dfa6
xor edx, edx
div ecx
cmp eax, 0x333807d6
jae 0x140043e39
mov rax, qword [rbp - 0x28]
mov rsp, rbp
pop rbp
ret
xlatb
fchs
jmp 0x140043e39
Function at 0x140044820
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rcx
mov eax, dword [0x1401c9ed0]
mov edx, dword [0x1401c9ed4]
mov ecx, eax
and ecx, edx
shl ecx, 1
xor eax, edx
add eax, ecx
xor eax, 0x99c7a891
mov ecx, 0xbb6bcc85
xor edx, edx
div ecx
mov ecx, 0x68fd5c49
xor ecx, 0x8c0e3305
or eax, ecx
cmp eax, 0x3e438094
jb 0x140044963
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov ecx, dword [0x1401c9ed8]
mov r9d, dword [0x1401c9edc]
mov eax, ecx
and eax, r9d
xor ecx, r9d
or eax, ecx
sub eax, 0xbfe63d49
and eax, 0x9c56e9a3
xor eax, 0x3c3fe3d8
mov rcx, rdx
imul rcx, r8
mov qword [rsp + 0x30], rcx
cvtsi2sd xmm0, r8
cvtsi2sd xmm1, rdx
mulsd xmm0, xmm1
movsd qword [rsp + 0x38], xmm0
cvtsi2sd xmm1, rcx
movsd qword [rsp + 0x40], xmm1
ucomisd xmm0, xmm1
sete cl
setnp dl
and cl, dl
mov byte [rsp + 0x4f], cl
cmp eax, 0x61f8a26e
je 0x140044870
mov al, byte [rsp + 0x4f]
test al, 1
jne 0x140044942
jmp 0x1400448f7
movsd xmm1, qword [rsp + 0x38]
movsd xmm0, qword [rsp + 0x40]
subsd xmm0, xmm1
call fcn.1401c7730
movaps xmm1, xmm0
movsd xmm0, qword [rsp + 0x38]
movsd qword [rsp + 0x20], xmm1
call fcn.1401c7730
movsd xmm1, qword [rsp + 0x20]
movsd xmm2, qword [0x1401d71a0]
mulsd xmm1, xmm2
mov al, 1
ucomisd xmm0, xmm1
mov byte [rsp + 0x2f], al
jb 0x140044955
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x2f], al
mov al, byte [rsp + 0x2f]
and al, 1
movzx eax, al
add rsp, 0x68
ret
movabs eax, dword [0xffffff04e9e66105]
nop dword [rax]
Function at 0x140055e40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x30], rcx
call fcn.140043b19
mov qword [rsp + 0x38], rax
xor eax, eax
mov ecx, eax
call fcn.140055710
mov rcx, qword [rsp + 0x38]
xor eax, eax
cmp byte [rcx], 0
mov qword [rsp + 0x40], rax
jne 0x140055faf
mov eax, dword [0x1401ca7c0]
xor edx, edx
div dword [0x1401ca7c4]
mov edx, eax
or edx, 0x1bc9be64
mov ecx, 0x37e3af3
xor ecx, 0xfc362762
mov eax, edx
xor eax, ecx
mov ecx, 0xffffffff
xor ecx, 0xff481d91
and edx, ecx
mov ecx, 0xa4aa12e4
xor ecx, 0xa4aa12e6
imul ecx, edx
sub ecx, eax
mov edx, 0xffffffff
xor edx, 0x38e8d0e2
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0xcb7212fa
jae 0x140055fb9
mov eax, dword [0x1401ca7c8]
mov ecx, dword [0x1401ca7cc]
mov edx, 0xba91fb7c
xor edx, 0xcc6dc0d3
xor ecx, edx
sub eax, ecx
mov ecx, 0xb9866ff0
xor ecx, 0xd1d15cf
xor edx, edx
div ecx
xor eax, 0x3211144f
mov edx, 0xb38b934a
xor edx, 0x212d4353
mov ecx, eax
and ecx, edx
shl ecx, 1
add eax, 0x92a6d019
sub eax, ecx
mov dword [rsp + 0x28], eax
mov ecx, 0x18
mov edx, 8
call fcn.14001217d
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x60]
call fcn.140055ca0
mov rcx, qword [rsp + 0x38]
mov eax, dword [rsp + 0x28]
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0xbe9750b5
je 0x140055ecf
mov rax, qword [rsp + 0x20]
mov cl, byte [rsp + 0x2f]
test cl, 1
mov qword [rsp + 0x40], rax
jne 0x140055f78
jmp 0x140055faf
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x48]
call fcn.140055946
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
add rsp, 0x78
ret
invalid