joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002e2d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov rcx, qword [rcx]
xor eax, eax
mov edx, eax
sub rdx, rcx
xor eax, eax
sub rax, 0xffffffffffffffff
add rdx, rax
xor eax, eax
sub rax, rdx
mov qword [rsp + 0x50], rax
mov r8, rax
xor r8, rcx
movabs rdx, 0x7bf78ef7b3009267
movabs r9, 0x840871084cff6d98
xor rdx, r9
xor r8, rdx
mov rdx, rcx
and rdx, r8
shl rdx, 1
sub rdx, rcx
mov rcx, rax
sub rcx, rdx
movabs rdx, 0x41023f59e2682c47
movabs r8, 0x41023f59e2682c47
xor rdx, r8
cmp rcx, rdx
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x14002e379
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
add rcx, 8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
jmp 0x14002e383
call fcn.140008c92
jmp 0x14002e541
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov eax, dword [0x14024c4d8]
mov r8d, dword [0x14024c4dc]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x8230cde6
xor edx, edx
div ecx
and eax, 0xf499b513
mov ecx, eax
add ecx, 1
mov edx, 0xdee65fd3
xor edx, 0x2119a02c
xor eax, edx
mov edx, 0x7d46f1b9
xor edx, 0x1f8790dd
or eax, edx
add eax, ecx
mov ecx, 0x289e31c5
xor ecx, 0x3255d230
cmp eax, ecx
ja 0x14002e546
mov r8, qword [rsp + 0x40]
mov eax, dword [0x14024c4e0]
mov ecx, 0x125ee567
xor ecx, 0xf05e6139
xor eax, ecx
mov edx, dword [0x14024c4e4]
xor edx, 0x858cc91c
mov ecx, eax
and ecx, edx
shl ecx, 1
add eax, edx
sub eax, ecx
sub eax, 0xa3d5a7bf
and eax, 0x24566681
mov ecx, 0xb874a7e0
xor ecx, 0x2d0e9040
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x28]
mov ecx, 0xe20a7ab9
xor ecx, 0xc2d0ec90
cmp rdx, r8
setl dl
mov byte [rsp + 0x27], dl
cmp eax, ecx
je 0x14002e402
mov al, byte [rsp + 0x27]
test al, 1
jne 0x14002e534
jmp 0x14002e47d
mov rax, qword [rsp + 0x28]
movabs rcx, 0xbd85904673a608e6
movabs rdx, 0xbd85904673a608e6
xor rcx, rdx
cmp rax, rcx
jl 0x14002e4b5
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
cmp rax, qword [rcx]
jl 0x14002e4c2
mov rcx, rdx
call fcn.14001284c
jmp 0x14002e541
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
add rcx, 8
shl rax, 3
add rcx, rax
call fcn.14002e150
mov rcx, qword [rsp + 0x28]
mov rax, rcx
add rax, 0xffffffffffffffff
mov rdx, rax
xor rdx, rcx
cmp rdx, 0
setl r8b
cmp rcx, 0
setne cl
xor cl, 0xff
xor r8b, 0xff
mov dl, 1
xor dl, 1
or cl, r8b
or dl, 1
xor cl, 0xff
and cl, dl
test cl, 1
mov qword [rsp + 0x38], rax
jne 0x14002e52a
jmp 0x14002e383
call fcn.140008c92
jmp 0x14002e541
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
add rsp, 0x58
ret
jg 0x14002e568
xchg edx, eax
mov al, 0xe9
mov bl, 0xfe
invalid
ror byte [rdi], 1
mov ss, word [rax + rax]
add byte [rax], al
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call fcn.14002e2d0
jmp 0x14002ea0d
nop
add rsp, 0x78
ret
Function at 0x14002ea80
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov r8, qword [rcx]
mov qword [rsp + 0x48], r8
mov rax, rcx
add rax, 8
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x58], rax
mov rdx, r8
add rdx, 1
mov qword [rsp + 0x60], rdx
xor r8, 0xffffffffffffffff
mov rcx, rdx
and rcx, r8
xor rcx, 0xffffffffffffffff
and rdx, r8
xor rdx, 0xffffffffffffffff
xor rcx, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
or rcx, rdx
mov qword [rsp + 0x68], rcx
cmp rax, 0
je 0x14002eb3c
mov rax, qword [rsp + 0x68]
cmp rax, 0
jl 0x14002eb32
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rax]
movabs r8, 0xfbcec39468981a33
movabs r9, 0x44313c6b9767e5cc
xor r8, r9
and rcx, r8
cmp rcx, rdx
mov qword [rsp + 0x30], rax
jl 0x14002eb3c
jmp 0x14002eb86
call fcn.140008c92
jmp 0x14002ed0b
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
mov r8d, 1
mov r9d, 8
mov qword [rsp + 0x20], 8
call fcn.140010b50
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
mov qword [rdx], rax
cmp rcx, 0
mov qword [rsp + 0x30], rax
jge 0x14002eb86
call fcn.140008c92
jmp 0x14002ed0b
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov eax, dword [0x14024c508]
mov ecx, 0xd8503bd9
xor ecx, 0xe07f0a02
xor eax, ecx
sub eax, dword [0x14024c50c]
mov ecx, 0x1d8317d9
xor ecx, 0xe27ce826
xor eax, ecx
mov edx, 0xffffffff
xor edx, 0x1d0fbc00
mov ecx, 0xffffffff
xor ecx, 0x2a427a9d
or eax, edx
or ecx, 0x2a427a9d
xor eax, 0xffffffff
and eax, ecx
mov ecx, eax
and ecx, 0x8fcc67e8
mov edx, 0xdfadce3c
xor edx, 0xdfadce3e
imul ecx, edx
xor eax, 0x8fcc67e8
add eax, ecx
mov r8d, 0xb43a5704
xor r8d, 0x8a7a299
mov ecx, 0x2f1b0b8e
xor ecx, 0xd0e4f471
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x337c851d
xor r8d, 0xcc837ae2
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xbc9df59d
or eax, 0xbc9df59d
imul eax, edx
add eax, ecx
cmp eax, 0x75559b69
jbe 0x14002ed13
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x48]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x60]
mov esi, dword [0x14024c510]
mov edi, dword [0x14024c514]
mov ecx, 0x3344f9ba
xor ecx, 0xccbb0645
mov eax, esi
xor eax, ecx
mov ecx, edi
and ecx, eax
mov eax, 0xaeb4e54d
xor eax, 0x514b1ab2
mov ebx, edi
xor ebx, eax
mov eax, esi
and eax, ebx
imul eax, ecx
mov ecx, esi
and ecx, edi
or esi, edi
imul esi, ecx
add esi, eax
mov eax, 0xc5a4615c
xor eax, 0x626d34f1
mov ecx, esi
xor ecx, eax
mov eax, 0x359aca28
xor eax, 0x92539f85
mov edi, 0x74f9d926
xor edi, 0x8b0626d9
xor eax, edi
and esi, eax
mov eax, 0x94c283ea
xor eax, 0x94c283e8
imul eax, esi
sub eax, ecx
xor eax, 0x8b5c1f21
mov ecx, 0x22553676
xor ecx, 0x8d10a957
xor eax, ecx
mov ecx, 0xd6eacf90
xor ecx, 0xc94e5cc1
mov qword [r10], r11
mov qword [rdx + r8*8 + 8], r9
cmp eax, ecx
je 0x14002ec4b
jmp 0x14002ed0b
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
invalid
Function at 0x140038af0
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x370
mov qword [rsp + 0x350], r8
mov qword [rsp + 0x338], rdx
mov qword [rsp + 0x340], rcx
mov qword [rsp + 0x348], rcx
call fcn.140038ad0
mov r8, qword [rsp + 0x350]
Function at 0x1400446b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
Function at 0x140047d30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov eax, dword [0x14024cff0]
mov edx, dword [0x14024cff4]
and eax, eax
xor eax, 0xffffffff
mov ecx, edx
xor ecx, 0xffffffff
mov r8d, 0x8017d881
xor r8d, 0x7fe8277e
xor edx, r8d
or ecx, edx
mov edx, 0x9a83d369
xor edx, 0x657c2c96
xor eax, edx
xor ecx, 0xffffffff
or eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x6dec3534
mov edx, 0xffffffff
xor edx, 0x6dec3534
and eax, edx
sub eax, ecx
imul ecx, eax, 0xd584188d
mov eax, ecx
or eax, 0x93ded011
xor eax, 0xffffffff
mov edx, 0x17cf07d1
xor edx, 0xe830f82e
xor ecx, edx
mov edx, 0x9bf57334
xor edx, 0x82ba325
mov r8d, 0x2e6507db
xor r8d, 0xd19af824
xor edx, r8d
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0x4c1eef4a
xor ecx, 0xc93e6bfe
cmp eax, ecx
jbe 0x140047f79
mov eax, dword [0x14024cff8]
sub eax, dword [0x14024cffc]
add eax, 0xaf737e3a
mov ecx, 0x38b654b
xor ecx, 0xa4ed9ba0
sub eax, ecx
mov ecx, 0x3f75c078
xor ecx, 0x9006be42
sub eax, ecx
mov ecx, 0x1c77503d
xor ecx, 0x3e699f6e
sub eax, ecx
add eax, 0xf2425d1c
mov ecx, 0xe6260bba
xor ecx, 0xc438c4e9
add eax, ecx
xor ecx, ecx
sub ecx, 0x39ff5d9f
sub eax, ecx
mov dword [rsp + 0x3c], eax
mov eax, 0xee47c113
xor eax, 0x2bfb6548
mov dword [rsp + 0x38], eax
call fcn.140047d06
mov ecx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x3c]
cmp eax, ecx
jbe 0x140047ddf
xor eax, eax
mov qword [rsp + 0x30], rax
jmp 0x140047e66
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp rax, 0x18
je 0x140047f74
mov eax, dword [0x14024d000]
and eax, dword [0x14024d004]
or eax, eax
xor eax, 0xffffffff
mov ecx, 0xeb5c5dcc
xor ecx, 0x9494ef2e
mov edx, 0x4fe36f60
xor edx, 0x302bdd82
or ecx, edx
mov edx, 0xd30513a6
xor edx, 0x2cfaec59
xor ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x94ef595
xor ecx, 0xe3e14ebb
mov edx, 0x9b1ee083
xor edx, 0x64e11f7c
xor ecx, edx
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
xor eax, 0x9d1e347f
mov ecx, 0x70f53409
xor ecx, 0xf2fc25b
cmp eax, ecx
je 0x140047f82
mov rcx, qword [rsp + 0x28]
mov edx, dword [0x14024d008]
mov r8d, dword [0x14024d00c]
mov eax, 0x3b2a9de0
xor eax, 0xc4d5621f
xor r8d, eax
mov eax, edx
xor eax, r8d
and eax, edx
mov r8d, 0xb17ebbe1
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x40]
imul eax, eax, 0x56ea9e84
imul eax, eax, 0x526b0abe
mov byte [rdx + rcx], 0
movabs rdx, 0xd3c00b0dcc05ab6a
add rcx, rdx
add rcx, 1
movabs rdx, 0xd3c00b0dcc05ab6a
sub rcx, rdx
mov qword [rsp + 0x20], rcx
cmp eax, 0xa4d1fd44
jae 0x140047ef1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
jmp 0x140047e66
add rsp, 0x48
ret
nop
add al, 0xd8
jmp 0x140047ddf
sahf
movsd dword [rdi], dword [rsi]
add edx, ebx
jmp 0x140047ef1
Function at 0x14004b590
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x14024d1a0]
xor eax, 0x272fcee3
xor eax, dword [0x14024d1a4]
mov edx, 0xfe5ce4ed
xor edx, 0x3915b48
mov ecx, eax
and ecx, edx
shl ecx, 1
mov edx, 0x379c7cda
xor edx, 0xca51c37f
add eax, edx
sub eax, ecx
mov ecx, eax
and ecx, 0xe85d28bd
mov edx, 0x43df1994
xor edx, 0x43df1996
imul ecx, edx
xor eax, 0xe85d28bd
add eax, ecx
imul eax, eax, 0x92e6f8db
cmp eax, 0x537a4ef7
jbe 0x14004b70e
mov ecx, dword [0x14024d1a8]
mov eax, dword [0x14024d1ac]
xor eax, 0x74b1393d
sub ecx, eax
mov eax, ecx
and eax, 0x48184861
and ecx, 0x8084821
add ecx, ecx
sub eax, ecx
add eax, 0x9aaf6f37
mov dword [rbp - 0x3c], eax
mov eax, 0x10
call fcn.14024abd0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x48], rax
sub rsp, 0x20
call fcn.140047d06
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x10]
add rsp, 0x20
mov r8, rax
mov eax, dword [rbp - 0x3c]
mov qword [rbp - 0x38], r8
mov r8, rcx
add r8, 8
mov qword [rbp - 0x30], r8
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x28], rcx
mov r8, rdx
add r8, 8
mov qword [rbp - 0x20], r8
cmp rcx, qword [rdx + 8]
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0x99df571e
jae 0x14004b602
mov rax, qword [rbp - 0x28]
mov cl, byte [rbp - 0x11]
test cl, 1
mov qword [rbp - 0x50], rax
jne 0x14004b6e8
jmp 0x14004b6ad
mov rcx, qword [rbp - 0x48]
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.14004b2f3
mov rax, qword [rbp - 0x38]
add rsp, 0x20
cmp byte [rax], 0
jne 0x14004b709
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x50]
mov r9, qword [rcx]
mov qword [rax], r9
mov qword [rdx], r8
mov rcx, qword [rcx + 0x10]
mov qword [rax + 0x10], rcx
mov rsp, rbp
pop rbp
ret
invalid
Function at 0x140050840
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x38]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp - 8], rax
mov eax, dword [0x14024d3f0]
mov ecx, dword [0x14024d3f4]
mov edx, 0x6c0433ef
xor edx, 0x311f1f4a
add eax, edx
add eax, ecx
sub eax, 0x5d1b2ca5
mov ecx, 0xf1d87c43
xor ecx, 0x2d1eead0
and eax, ecx
mov ecx, 0x4d2967cd
xor ecx, 0x931be7d8
xor edx, edx
div ecx
mov ecx, eax
xor ecx, 0xe6dec188
xor ecx, 0xffffffff
or eax, 0xe6dec188
and eax, ecx
cmp eax, 0x5edae055
ja 0x140050abb
mov eax, dword [0x14024d3f8]
mov ecx, dword [0x14024d3fc]
xor ecx, 0x4fd09b18
sub eax, ecx
xor eax, 0xf9df3d57
add eax, 0x824f0e53
mov dword [rbp - 0x44], eax
mov eax, 0xc72ce34b
mov dword [rbp - 0x48], eax
mov eax, 0x10
call fcn.14024abd0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x50], rax
sub rsp, 0x20
call fcn.140047d06
mov r8, qword [rbp - 0x18]
mov r9, qword [rbp - 0x10]
mov ecx, dword [rbp - 0x48]
add rsp, 0x20
mov rdx, rax
mov eax, dword [rbp - 0x44]
mov qword [rbp - 0x40], rdx
test r9, r9
setns dl
mov r8, qword [r8]
mov qword [rbp - 0x38], r8
sub r8, r9
setg r8b
and dl, r8b
mov byte [rbp - 0x29], dl
cmp eax, ecx
ja 0x1400508bf
mov al, byte [rbp - 0x29]
test al, 1
jne 0x14005096e
jmp 0x140050950
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffff
sub rsp, 0x20
call fcn.14001284c
add rsp, 0x20
jmp 0x140050ab6
mov r8, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x20]
mov r9, rcx
add r9, 8
mov qword [rbp - 0x60], r9
mov rcx, qword [rcx + 8]
add rcx, 8
shl r8, 5
add rcx, r8
add rcx, 8
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140018a3d
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
add rsp, 0x20
mov rax, qword [rax]
mov qword [rbp - 0x58], rax
cmp rax, rcx
jg 0x140050a11
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x58]
movabs rax, 0xdc09766752a37a6e
movabs r8, 0xdc09766752a37a6e
xor rax, r8
sub rax, rdx
xor edx, edx
sub rdx, 0xffffffffffffffff
add rax, rdx
xor edx, edx
sub rdx, rax
sub rsp, 0x20
call fcn.14001284c
add rsp, 0x20
jmp 0x140050ab6
mov rdx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x60]
mov rcx, qword [rcx]
add rcx, 8
shl rax, 5
add rcx, rax
add rcx, 0x18
sub rsp, 0x20
call fcn.140164e70
mov rax, qword [rbp - 0x40]
add rsp, 0x20
cmp byte [rax], 0
jne 0x140050ab6
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x18]
mov rax, qword [rax]
mov qword [rbp - 0x68], rax
cmp rax, rcx
jg 0x140050a99
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x68]
movabs rax, 0xa67ccc82c9a4fa6b
add rdx, rax
add rdx, 0xffffffffffffffff
movabs rax, 0xa67ccc82c9a4fa6b
sub rdx, rax
sub rsp, 0x20
call fcn.14001284c
add rsp, 0x20
jmp 0x140050ab6
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x60]
mov rax, qword [rax]
add rax, 8
shl rdx, 5
add rax, rdx
mov qword [rax], rcx
mov rsp, rbp
pop rbp
ret
movsb byte [rdi], byte [rsi]
invalid
Function at 0x14005f0b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x14024da08]
mov r8d, dword [0x14024da0c]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
add eax, 0xe7fe7a12
or eax, 0x4839a97d
add eax, 0x1b2d07bf
cmp eax, 0x4fa7039a
jb 0x14005f1da
mov rcx, qword [rbp - 8]
mov eax, dword [0x14024da10]
mov edx, dword [0x14024da14]
xor edx, 0x23841d83
add eax, edx
imul edx, eax, 0x160c19d1
mov r8d, edx
not r8d
or r8d, 0x70fa193
mov eax, edx
mov edx, r8d
lea eax, [rax + rdx + 0x1127356b]
mov dword [rbp - 0x14], eax
mov eax, 0x10
mov qword [rbp - 0x28], rax
call fcn.14024abd0
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov rdx, rsp
call fcn.14024abd0
sub rsp, rax
mov rax, qword [rbp - 0x10]
mov r8, rsp
mov qword [rbp - 0x20], r8
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140018a3d
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
add rsp, 0x20
add rcx, 0x10
mov r8, qword [rax + 0x10]
mov qword [rdx], r8
mov rax, qword [rax + 0x18]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140018a3d
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
mov eax, dword [rbp - 0x14]
add rsp, 0x20
mov dl, byte [rdx + 0x20]
mov byte [rcx + 0x20], dl
cmp eax, 0x912ce48
jb 0x14005f10d
mov rsp, rbp
pop rbp
ret
add dword [rbx - 0x5e], eax
push rsi
jmp 0x14005f10d

Function at 0x140060c30
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x30], rcx
mov eax, 0x10
call fcn.14024abd0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x38], rax
mov rax, qword [0x1402649d0]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.140008923
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov rax, rcx
add rax, 8
mov qword [rbp - 0x18], rax
mov rax, qword [rcx + 8]
mov rcx, rdx
add rcx, 8
mov qword [rbp - 0x10], rcx
cmp rax, qword [rdx + 8]
mov qword [rbp - 8], rax
je 0x140060d6d
Function at 0x140062180
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x14024db68]
xor eax, 0x6eeb5d3c
mov edx, dword [0x14024db6c]
and eax, eax
mov ecx, 0x224cb5ca
xor ecx, 0xddb34a35
xor eax, ecx
mov r8d, 0x4b924a38
xor r8d, 0xb46db5c7
mov ecx, edx
xor ecx, r8d
xor edx, 0xffffffff
or ecx, edx
mov edx, 0x9840a955
xor edx, 0x67bf56aa
xor eax, edx
xor ecx, 0xffffffff
or eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0xdeb04a7e
xor edx, 0xb35c7f4a
and ecx, edx
mov edx, 0xffffffff
xor edx, 0x6dec3534
and eax, edx
sub eax, ecx
imul ecx, eax, 0xd584188d
mov eax, ecx
or eax, 0x93ded011
xor eax, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x93ded011
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
cmp eax, 0x852084b4
jbe 0x1400623d5
mov rdx, qword [rsp + 0x30]
mov eax, dword [0x14024db70]
mov ecx, 0xe7fd6b2c
xor ecx, 0x4df59a96
xor eax, ecx
sub eax, dword [0x14024db74]
add eax, 0xaf737e3a
sub eax, 0xa766feeb
mov ecx, 0xc116a648
xor ecx, 0x6e65d872
sub eax, ecx
mov ecx, 0xa60b3a43
xor ecx, 0x8415f510
sub eax, ecx
mov ecx, 0x3e50031c
xor ecx, 0xcc125e00
add eax, ecx
add eax, 0x221ecf53
xor ecx, ecx
sub ecx, 0x39ff5d9f
sub eax, ecx
mov ecx, 0xd44686c8
xor ecx, 0x11fa2293
mov rdx, qword [rdx + 8]
mov qword [rsp + 0x20], rdx
cmp rdx, 0
sete dl
mov byte [rsp + 0x2f], dl
cmp eax, ecx
jbe 0x140062223
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1400622df
jmp 0x1400622b9
mov rcx, qword [rsp + 0x20]
movabs rax, 0x4000000000000000
and rax, qword [rcx]
cmp rax, 0
je 0x1400622df
mov rcx, qword [rsp + 0x30]
call fcn.140013e60
mov ecx, dword [0x14024db78]
xor ecx, 0xc8e42d5a
mov eax, dword [0x14024db7c]
or ecx, ecx
xor ecx, 0xffffffff
or eax, eax
xor eax, 0xffffffff
mov edx, 0x31ca092b
xor edx, 0xce35f6d4
xor ecx, edx
xor eax, 0xffffffff
and ecx, eax
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x7fc8b2e2
or ecx, 0x7fc8b2e2
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
add eax, 0xeaafbb2e
xor eax, 0x9d1e347f
cmp eax, 0x7fdaf652
je 0x1400623de
mov eax, dword [0x14024db80]
mov ecx, dword [0x14024db84]
xor ecx, 0x1fe4a3d7
and eax, ecx
mov ecx, 0xb17ebbe1
xor edx, edx
div ecx
mov r8d, 0xffffffff
xor r8d, 0x56ea9e84
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x56ea9e84
or eax, 0x56ea9e84
imul eax, edx
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x526b0abe
mov r8d, 0xffffffff
xor r8d, 0x526b0abe
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x526b0abe
or eax, 0x526b0abe
imul eax, edx
add eax, ecx
mov ecx, 0x1035f70b
xor ecx, 0xb4e40a4f
cmp eax, ecx
jae 0x1400623de
add rsp, 0x38
ret
nop
add al, 0xd8
jmp 0x140062223
mov bl, 0xfa
fldl2t
pop rax
invalid
Function at 0x1400644d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov word [rbp - 2], cx
mov ecx, dword [0x14024dc68]
xor ecx, 0x316ddd29
mov eax, dword [0x14024dc6c]
xor eax, 0xf0016ccd
xor ecx, eax
mov edx, 0xcb176a6d
xor edx, 0x34e89592
mov eax, ecx
xor eax, edx
mov edx, ecx
xor edx, 0xffffffff
and eax, edx
mov edx, 0xc013fb25
or edx, 0xc013fb25
mov r8d, 0xe4287b45
xor r8d, 0x1bd784ba
xor edx, r8d
mov r8d, 0x78d72155
xor r8d, 0x8728deaa
xor eax, r8d
xor edx, 0xffffffff
and eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xc013fb25
and ecx, edx
or eax, ecx
mov ecx, 0x57c53dcd
xor ecx, 0xa83ac232
xor eax, ecx
sub eax, 0x8d126209
add eax, 0xd5d67868
cmp eax, 0xae444501
jb 0x140064700
mov edx, dword [0x14024dc70]
mov eax, dword [0x14024dc74]
mov ecx, eax
mov eax, edx
lea eax, [rax + rcx + 0x70d566e6]
or eax, 0x516c5a9b
and eax, 0x7fee7abb
mov dword [rbp - 0xc], eax
mov eax, 0x5d0ce13b
mov dword [rbp - 0x10], eax
mov eax, 0x10
call fcn.14024abd0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
sub rsp, 0x20
call fcn.14006369a
mov cx, word [rbp - 2]
add rsp, 0x20
mov rdx, rax
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x18], rdx
mov dword [rax], 0
mov rax, qword [0x140275f98]
mov qword [rbp - 0x28], rax
movsx rcx, cx
add rax, 8
shl rcx, 4
add rax, rcx
add rax, 8
mov rcx, qword [rax]
mov qword [rbp - 0x20], rcx
add rcx, 0x10
sub rsp, 0x20
call fcn.1400636b5
mov rdx, qword [rbp - 0x18]
mov ecx, dword [rbp - 0x10]
add rsp, 0x20
mov r8w, ax
mov eax, dword [rbp - 0xc]
mov word [rbp - 6], r8w
mov dl, byte [rdx]
mov r8b, 0xcd
xor r8b, 0xcd
cmp dl, r8b
sete dl
mov byte [rbp - 3], dl
cmp eax, ecx
jbe 0x140064571
mov cl, byte [rbp - 3]
xor eax, eax
test cl, 1
mov dword [rbp - 0x34], eax
jne 0x14006464c
jmp 0x1400646f8
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
mov dx, word [rbp - 6]
movsx rdx, dx
mov qword [rbp - 0x48], rdx
cmp byte [rcx + 0x12], 0xb6
mov qword [rbp - 0x40], rax
jne 0x1400646ba
mov cx, word [rbp - 2]
mov rdx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x28]
add rax, 8
shl rdx, 4
add rax, rdx
add rax, 8
mov r8, qword [rax]
add r8, 8
sub rsp, 0x20
call fcn.140063860
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
xor eax, eax
cmp byte [rcx], 0
mov dword [rbp - 0x34], eax
jne 0x1400646f8
mov rax, qword [0x140275f98]
mov qword [rbp - 0x40], rax
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x40]
add rax, 8
shl rdx, 4
add rax, rdx
add rax, 8
mov rdx, qword [rax]
add rdx, 8
mov r8d, 4
sub rsp, 0x20
call fcn.140063700
mov rax, qword [rbp - 0x30]
add rsp, 0x20
mov eax, dword [rax]
mov dword [rbp - 0x34], eax
mov eax, dword [rbp - 0x34]
mov rsp, rbp
pop rbp
ret
pop rbp
outsb dx, byte [rsi]
pushfq
hlt
Function at 0x140067950
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov word [rbp - 0xa], dx
mov qword [rbp - 8], rcx
mov eax, dword [0x14024dea8]
xor edx, edx
div dword [0x14024deac]
and eax, 0x52872e98
mov ecx, 0x1ac6a645
xor ecx, 0xc07f9d54
or eax, ecx
mov ecx, 0x93b83693
xor ecx, 0x1b5925c4
add eax, ecx
cmp eax, 0x95f40fa8
jae 0x140067a7f
mov cx, word [rbp - 0xa]
mov eax, dword [0x14024deb0]
xor eax, 0x4abf5510
mov edx, dword [0x14024deb4]
imul eax, edx
mov edx, eax
not edx
or edx, 0xb47f161a
add eax, edx
imul eax, eax, 0xc4f22e6c
add eax, 0x97b1a164
mov dword [rbp - 0x10], eax
mov eax, 0xd85b806b
mov dword [rbp - 0x14], eax
mov eax, 0x10
mov qword [rbp - 0x38], rax
call fcn.14024abd0
sub rsp, rax
mov rax, qword [rbp - 0x38]
mov rdx, rsp
mov qword [rbp - 0x28], rdx
call fcn.14024abd0
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov rdx, rsp
mov qword [rbp - 0x30], rdx
mov word [rax], cx
sub rsp, 0x20
call fcn.140067614
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov ax, 0x1496
xor ax, 0x1496
mov word [rcx], ax
sub rsp, 0x20
call fcn.140067a88
mov rdx, qword [rbp - 0x20]
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x10]
add rsp, 0x20
cmp byte [rdx], 0
sete dl
mov byte [rbp - 0xb], dl
cmp eax, ecx
je 0x14006799a
mov al, byte [rbp - 0xb]
test al, 1
jne 0x140067a62
jmp 0x140067a7a
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x30]
mov dx, word [rax]
sub rsp, 0x20
call fcn.140033c8a
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
jg 0x140067aea
lahf
invalid
in al, dx
cmp byte [rax - 0x77], cl
and al, 0x20
mov dword [rsp + 0x34], edx
call fcn.140067614
mov qword [rsp + 0x28], rax
mov eax, 0xdc6b8f70
xor eax, 0xdc6b8f70
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x34]
call fcn.140067b44
mov rax, qword [rsp + 0x28]
mov al, byte [rax]
mov cl, 0x3e
xor cl, 0x3e
cmp al, cl
jne 0x140067b3e
mov rcx, qword [rsp + 0x20]
mov edx, dword [rsp + 0x30]
call fcn.140033cb8
nop
add rsp, 0x38
ret