joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400315e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
mov ecx, dword [0x140201ab8]
mov eax, dword [0x140201abc]
mov edx, 0x1b1c3539
xor edx, 0xa68e353
xor eax, edx
xor ecx, eax
mov eax, ecx
or eax, 0x6378c394
xor eax, 0xffffffff
mov edx, 0x97566978
xor edx, 0x68a99687
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0x6378c394
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0x15eb5643
add eax, 0xe4246853
cmp eax, 0xb9438074
jb 0x1400316d1
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x140201ac0]
imul eax, dword [0x140201ac4]
mov edx, eax
xor edx, 0xf0c08630
mov r8d, 0x2ee1cbcf
xor r8d, 0xd11e3430
xor edx, r8d
or eax, 0xf0c08630
and eax, edx
mov r8d, 0x9b3b2673
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x30]
mov r8d, 0xa36f1ca3
xor r8d, 0xffd3e6b4
add eax, r8d
mov dword [rsp + 0x2c], eax
mov qword [rcx], 0
mov qword [rcx + 8], 0
call fcn.1400315ad
mov eax, dword [rsp + 0x2c]
cmp eax, 0x4ca37ac6
jbe 0x14003164f
mov rax, qword [rsp + 0x40]
add rsp, 0x48
ret
jae 0x14003173a
invalid
and al, 0x60

Function at 0x140036df0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov word [rbp - 0xa], dx
mov qword [rbp - 8], rcx
mov eax, dword [0x140201d60]
mov ecx, 0xc9450074
xor ecx, 0x7b409665
xor eax, ecx
mov edx, dword [0x140201d64]
xor edx, 0x69aa8d37
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
or eax, edx
and eax, ecx
imul eax, eax, 0x75e69f8f
mov ecx, 0x8556fb55
xor edx, edx
div ecx
mov ecx, 0xfcdee80b
xor ecx, 0xbcbfd4d9
xor eax, ecx
cmp eax, 0x98b0a06d
jae 0x140036eef
mov cx, word [rbp - 0xa]
mov r8d, dword [0x140201d68]
mov eax, dword [0x140201d6c]
xor eax, 0x8f6137f2
add r8d, eax
mov eax, r8d
and eax, 0x7cec047c
xor r8d, 0xfcec047c
mov edx, eax
mov eax, r8d
lea edx, [rax + rdx*2]
mov eax, edx
xor eax, 0xb97d3154
and eax, edx
shr eax, 2
imul rax, rax, 0x13358ac3
shr rax, 0x39
mov dword [rbp - 0x10], eax
mov eax, 0x10
call fcn.1401ffc50
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
mov word [rax], cx
sub rsp, 0x20
call fcn.14003491d
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x18]
add rsp, 0x20
mov r8d, 2
sub rsp, 0x20
call fcn.140036c40
mov eax, dword [rbp - 0x10]
add rsp, 0x20
cmp eax, 0x8bdb63d9
je 0x140036e53
mov rsp, rbp
pop rbp
ret
add dl, dl
jae 0x140036f53
jmp 0x140036e53
mov ecx, dword [rbp - 0xc]
mov eax, dword [str.Ls_]
xor eax, 0x65885b73
mov edx, dword [0x140201d7c]
pop rbx
mov byte [rbp - 0x75], ah
adc eax, 0x1cae20
or eax, edx
imul rax, rax, 0x5116b86b
shr rax, 0x3c
or eax, 0x59372bbb
add eax, 0xd15fa9cd
mov dword [rbp - 0x10], eax
mov eax, 0x10
call fcn.1401ffc50
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
mov dword [rax], ecx
sub rsp, 0x20
call fcn.14003491d
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x18]
add rsp, 0x20
movabs r8, 0x39caf5d570a1a3ff
movabs rax, 0x39caf5d570a1a3fb
xor r8, rax
sub rsp, 0x20
call fcn.140036c40
mov eax, dword [rbp - 0x10]
add rsp, 0x20
cmp eax, 0xe011ae46
jae 0x140036f48
mov rsp, rbp
pop rbp
ret
Function at 0x140036f00
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov dword [rbp - 0xc], edx
mov qword [rbp - 8], rcx
mov ecx, dword [0x140201d70]
mov edx, dword [0x140201d74]
xor edx, 0xffffffff
mov eax, ecx
xor eax, edx
and eax, ecx
or eax, 0x8030bf94
mov ecx, 0x6060d136
xor ecx, 0x9e3e9661
or eax, ecx
xor eax, 0x5c3d1c1e
cmp eax, 0xb341dda9
je 0x140036fd8
cmp ebx, edi
invalid
test cl, ch
invalid
invalid
invalid
invalid

Function at 0x140037110
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rcx
call fcn.14003491d
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rax
mov r8d, 4
call fcn.140036433
mov rcx, rax
mov rax, qword [rsp + 0x60]
mov al, byte [rax]
test al, al
setne al
sub rcx, 4
sete cl
or al, cl
test al, 1
jne 0x1400372ca
mov ecx, dword [0x140201d80]
mov eax, 0x3ef7262c
xor eax, 0xe6577779
xor ecx, eax
mov edx, dword [0x140201d84]
xor edx, 0xffac9d09
mov eax, ecx
xor eax, 0xffffffff
mov r8d, 0xad3bb05c
xor r8d, 0x52c44fa3
xor ecx, r8d
and eax, ecx
mov ecx, edx
xor ecx, 0xffffffff
xor edx, 0xffffffff
and ecx, edx
mov edx, 0xfb8619eb
xor edx, 0x479e614
xor eax, edx
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0xdb6559ee
xor ecx, 0xbb42e6d0
add eax, ecx
mov ecx, eax
and ecx, 0x7e48c067
shl ecx, 1
xor eax, 0x7e48c067
add eax, ecx
mov r8d, 0x1a0b475f
xor r8d, 0xf284199d
mov ecx, 0x50a8c1f1
xor ecx, 0xaf573e0e
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x234f257f
xor r8d, 0xdcb0da80
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xe88f5ec2
or eax, 0xe88f5ec2
imul eax, edx
add eax, ecx
mov ecx, 0xf4974a4a
xor ecx, 0x6a28304b
cmp eax, ecx
jae 0x140037335
mov eax, dword [0x140201d88]
sub eax, dword [0x140201d8c]
or eax, 0x8e8146cf
mov ecx, 0x9c77597
xor ecx, 0xcabbafb0
imul eax, ecx
mov ecx, 0xddcd46cc
xor ecx, 0x1734babb
or eax, ecx
mov dword [rsp + 0x34], eax
lea rcx, [0x14020f498]
call fcn.140036465
mov rcx, qword [rsp + 0x58]
mov rdx, rax
mov eax, dword [rsp + 0x34]
mov qword [rsp + 0x38], rdx
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x47], cl
cmp eax, 0x3441174a
jbe 0x140037335
mov al, byte [rsp + 0x47]
test al, 1
jne 0x1400372a2
jmp 0x1400372ca
mov rcx, qword [rsp + 0x38]
lea rdx, [0x14020f47c]
lea r8, [0x14020f484]
lea r9, [0x14020f489]
mov qword [rsp + 0x20], 0x34f255f7
call fcn.1400139e0
mov eax, dword [0x140201d90]
add eax, dword [0x140201d94]
or eax, 0xf0e70b18
imul eax, eax, 0xc55b69e7
xor eax, 0x6643408f
cmp eax, 0x5fde65e6
jbe 0x14003733e
mov eax, dword [0x140201d98]
xor eax, 0x8e7739e1
or eax, dword [0x140201d9c]
mov ecx, 0xdf2d7275
xor edx, edx
div ecx
mov ecx, 0xf3f9667c
xor ecx, 0x505d2672
pop rbp
push rax
add eax, ecx
sub eax, 0xf9c81c32
mov ecx, 0x5bf1df60
xor ecx, 0x8994d694
cmp eax, ecx
jae 0x1400372f1
sar edi, 0xff
dec dword [rax - 0x7d]
invalid
add rsp, 0x68
ret
ja 0x14003732c
jl 0x140037313
jmp 0x14003722f
xchg esi, eax
cmpsb byte [rsi], byte [rdi]
add esi, 0xffffaae9
jmp qword [rsi + 0xf]
Function at 0x140041bf0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x68], r8
mov byte [rsp + 0x77], dl
mov qword [rsp + 0x78], rcx
cmp r9, 0
mov qword [rsp + 0x80], r9
jge 0x140041c3e
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
mov rcx, 0xffffffffffffffff
xor rcx, 0xffffffffffffffff
xor edx, edx
sub rdx, 1
sub rcx, rdx
sub rax, rcx
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x48], rdx
add rcx, 8
mov qword [rsp + 0x50], rcx
movabs rcx, 0x9f0d38bf2333ced
movabs rdx, 0xf60f2c740dccc312
xor rcx, rdx
cmp rax, rcx
setg cl
mov byte [rsp + 0x5f], cl
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rcx
mov rax, 0xffffffffffffffff
cmp rcx, rdx
mov qword [rsp + 0x40], rax
jg 0x140041e52
mov al, byte [rsp + 0x5f]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x78]
mov rdx, qword [rdx]
mov qword [rsp + 0x30], rdx
sub rcx, rdx
setl cl
and al, cl
test al, 1
jne 0x140041d12
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
movabs r8, 0x32beee7d7e6a8d3a
movabs rdx, 0xcd411182819572c5
xor r8, rdx
mov rdx, rax
and rdx, r8
or rax, 0xffffffffffffffff
add rdx, rax
call fcn.140014583
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x40], rax
jmp 0x140041e52
mov rax, qword [rsp + 0x38]
mov dl, byte [rsp + 0x77]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
cmp byte [rcx + rax + 8], dl
mov qword [rsp + 0x40], rax
je 0x140041e52
mov r8d, dword [0x140202180]
mov edx, dword [0x140202184]
mov eax, r8d
xor eax, 0xffffffff
mov ecx, edx
and ecx, eax
mov eax, 0x4cc2c750
xor eax, 0xb33d38af
mov r9d, edx
xor r9d, eax
mov eax, r8d
and eax, r9d
imul eax, ecx
mov ecx, r8d
and ecx, edx
or r8d, edx
imul r8d, ecx
add r8d, eax
sub r8d, 0x715bb6cb
mov ecx, r8d
xor ecx, 0xffffffff
and ecx, 0xc617048c
mov r9d, 0xffffffff
xor r9d, 0xc617048c
and r8d, r9d
mov eax, 0xffffffff
xor eax, 0xb699d9fd
and eax, 0xc617048c
mov edx, 0x8f0b4e29
xor edx, 0x399297d4
and edx, r9d
or ecx, r8d
or eax, edx
xor ecx, eax
mov eax, ecx
or eax, 0xe2b7dd9d
xor eax, 0xffffffff
mov edx, 0x46662dad
xor edx, 0xb999d252
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0xe2b7dd9d
and ecx, edx
mov edx, 0x76372477
xor edx, 0x89c8db88
xor eax, edx
xor ecx, 0xffffffff
and eax, ecx
cmp eax, 0xaf890af7
jbe 0x140041e5f
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x140202188]
mov edx, dword [0x14020218c]
xor edx, 0x110c1e23
or eax, edx
mov r8d, 0x47625a75
xor edx, edx
div r8d
add eax, 0x7a3d1b24
mov edx, 0x22605f48
xor edx, 0xa431b09
sub eax, edx
add rcx, 1
mov qword [rsp + 0x28], rcx
cmp eax, 0x3ba0386e
jb 0x140041df9
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x60], rax
jmp 0x140041c84
mov rax, qword [rsp + 0x40]
add rsp, 0x88
ret
shr word [rbx], 0xc7
jmp 0x140041df9
Function at 0x14004ee90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x14004ef96
mov rcx, qword [rsp + 0x30]
movabs rax, 0x4000000000000000
and rax, qword [rcx]
cmp rax, 0
jne 0x14004ef96
mov eax, dword [0x140202760]
mov ecx, dword [0x140202764]
mov edx, 0x5fc585da
xor edx, 0x901716c0
add eax, edx
add eax, ecx
mov ecx, 0x11c2f7a9
xor ecx, 0xde1064b3
sub eax, ecx
mov ecx, 0x83864ced
xor ecx, 0x9d07043f
imul eax, ecx
mov ecx, eax
and ecx, 0x9d243fa0
mov edx, 0x2bfb2db8
xor edx, 0x2bfb2dba
imul ecx, edx
xor eax, 0x9d243fa0
add eax, ecx
mov ecx, 0x8bc24056
xor ecx, 0xb2cf3dd9
mov edx, 0xd200efc1
xor edx, 0x2dff103e
xor ecx, edx
add eax, ecx
add eax, 1
cmp eax, 0xcf8aef15
je 0x14004ef9b
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x140202768]
mov edx, 0x35a2fb60
xor edx, 0x18f9f94e
xor eax, edx
sub eax, dword [0x14020276c]
mov edx, 0xe94997c6
xor edx, 0x60d2f901
xor eax, edx
mov r8d, 0x8b2f4d1f
xor edx, edx
div r8d
or eax, 0x72543085
mov dword [rsp + 0x2c], eax
call fcn.14000fb44
mov eax, dword [rsp + 0x2c]
cmp eax, 0x731d3881
je 0x14004ef3e
jmp 0x14004ef96
add rsp, 0x38
ret
xor dword [rdx - 0x3e], ebx
and al, 0xe9
invalid

Function at 0x14004f870
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 8], rcx
mov eax, dword [0x1402027c0]
or eax, dword [0x1402027c4]
sub eax, 0xc511d3e7
mov ecx, 0x7cd618ad
xor ecx, 0xb76ece89
sub eax, ecx
add eax, 0xc511d3e7
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0xea1c32b3
xor edx, 0x9c5d03a
and ecx, edx
mov edx, 0xffffffff
xor edx, 0xe3d9e289
and eax, edx
sub eax, ecx
add eax, 0xdce644c4
sub eax, 0xa8c9d8df
mov ecx, 0x4333511c
xor ecx, 0x9fd515d8
sub eax, ecx
mov ecx, 0x8dd84c31
xor ecx, 0xb7e98ff6
cmp eax, ecx
jb 0x14004f96c
mov eax, dword [0x1402027c8]
mov ecx, dword [0x1402027cc]
xor eax, ecx
and eax, 0x2a000620
or eax, 0x940dd9c0
shr eax, 5
imul rax, rax, 0x40302e9
shr rax, 0x33
mov dword [rbp - 0xc], eax
mov eax, 0x10
call fcn.1401ffc50
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
sub rsp, 0x20
call fcn.14004b700
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.14004f3f0
mov eax, dword [rbp - 0xc]
add rsp, 0x20
cmp eax, 0x3e0c5b5e
ja 0x14004f8ec
mov rsp, rbp
pop rbp
ret
stosb byte [rdi], al
sub al, 0xdb
jmp 0x14004f8ec
Function at 0x14004ff40
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x38], rcx
mov eax, 0x20
call fcn.1401ffc50
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
sub rsp, 0x20
call fcn.14004b700
add rsp, 0x20
mov qword [rbp - 0x28], rax
xor eax, eax
mov ecx, eax
sub rsp, 0x20
call fcn.14004f9e6
mov rax, qword [rbp - 0x28]
add rsp, 0x20
mov cl, byte [rax]
mov dl, 0xe3
xor dl, 0xe3
xor eax, eax
cmp cl, dl
mov qword [rbp - 0x20], rax
jne 0x1400500cb
mov ecx, dword [0x1402027f0]
xor ecx, 0x174590d5
imul ecx, dword [0x1402027f4]
mov eax, 0x75901cd4
xor eax, 0xa1a9c4fe
or ecx, eax
mov eax, 0xc08ab24c
xor eax, 0xd07701e5
or ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0xd0ff6114
mov edx, 0xffffffff
xor edx, 0xd0ff6114
and ecx, edx
or eax, ecx
cmp eax, 0xd4b2ee2f
jae 0x1400500d4
mov eax, dword [0x1402027f8]
xor edx, edx
div dword [0x1402027fc]
imul ecx, eax, 0x97be9624
mov eax, ecx
and eax, 0x77f6ec46
or ecx, 0x77f6ec46
add eax, ecx
mov ecx, eax
add ecx, 1
mov edx, 0x6d9a33ea
xor edx, 0x9265cc15
xor eax, edx
mov edx, 0x2bf12a00
xor edx, 0x9ed2dc80
or eax, edx
add eax, ecx
mov dword [rbp - 0x40], eax
mov ecx, 0x18
mov edx, 8
sub rsp, 0x20
call fcn.140014320
mov rdx, qword [rbp - 0x38]
add rsp, 0x20
mov qword [rbp - 0x48], rax
lea rcx, [rbp - 0x18]
sub rsp, 0x20
call fcn.14004fe39
mov rcx, qword [rbp - 0x28]
mov eax, dword [rbp - 0x40]
add rsp, 0x20
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0x39], cl
cmp eax, 0xea656dcb
jae 0x14004ffec
mov rax, qword [rbp - 0x48]
mov cl, byte [rbp - 0x39]
test cl, 1
mov qword [rbp - 0x20], rax
jne 0x140050097
jmp 0x1400500cb
mov rcx, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x18]
mov qword [rdx], rax
mov rax, qword [rbp - 0x10]
mov qword [rdx + 8], rax
mov rax, qword [rbp - 8]
mov qword [rdx + 0x10], rax
sub rsp, 0x20
call fcn.14004fa3d
mov rax, qword [rbp - 0x48]
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov rsp, rbp
pop rbp
ret
mov gs, word [rax + 0xfe9c1fe]
invalid
Function at 0x140052b40
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x140202900]
sub eax, dword [0x140202904]
mov ecx, 0x1dc4ef3c
xor ecx, 0x9bd93519
mov edx, eax
xor edx, ecx
xor edx, 0xffffffff
mov ecx, 0xdd3329d2
xor ecx, 0x5b2ef3f7
and ecx, edx
shl ecx, 1
mov edx, 0x7710bcd0
xor edx, 0xf10d66f5
sub ecx, edx
sub eax, ecx
mov ecx, 0xe24492da
xor ecx, 0x2e8b5905
imul eax, ecx
sub eax, 0xe0388160
cmp eax, 0x20fd57bb
je 0x140052d35
mov r10d, dword [0x140202908]
mov r9d, dword [0x14020290c]
mov ecx, r10d
not ecx
mov edx, r9d
not edx
mov eax, ecx
and eax, 0xfc8265f1
and r10d, 0x37d9a0e
mov r8d, edx
and r8d, 0xfc8265f1
and r9d, 0x37d9a0e
or eax, r10d
or r8d, r9d
xor eax, r8d
or ecx, edx
not ecx
or eax, ecx
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x55c8c2d4
and ecx, 0xaa373d2b
imul ecx, edx
mov edx, eax
and edx, 0xaa373d2b
or eax, 0xaa373d2b
imul eax, edx
add eax, ecx
mov edx, eax
not edx
and edx, 0x71676fc1
mov ecx, eax
and ecx, 0x8e98903e
imul ecx, edx
mov edx, eax
and edx, 0x71676fc1
or eax, 0x71676fc1
imul eax, edx
add eax, ecx
mov ecx, eax
not ecx
and ecx, 0x4685a3a4
and eax, 0xb97a5c5b
sub eax, ecx
mov dword [rbp - 0x3c], eax
mov eax, 0x10
call fcn.1401ffc50
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x48], rax
sub rsp, 0x20
call fcn.14004b700
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x10]
add rsp, 0x20
mov r8, rax
mov eax, dword [rbp - 0x3c]
mov qword [rbp - 0x38], r8
mov r8, rcx
add r8, 8
mov qword [rbp - 0x30], r8
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x28], rcx
mov r8, rdx
add r8, 8
mov qword [rbp - 0x20], r8
cmp rcx, qword [rdx + 8]
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0xedcd795e
je 0x140052bad
mov rax, qword [rbp - 0x28]
mov cl, byte [rbp - 0x11]
test cl, 1
mov qword [rbp - 0x50], rax
jne 0x140052d0f
jmp 0x140052cd4
mov rcx, qword [rbp - 0x48]
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.1400526c0
mov rax, qword [rbp - 0x38]
add rsp, 0x20
cmp byte [rax], 0
jne 0x140052d30
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x50]
mov r9, qword [rcx]
mov qword [rax], r9
mov qword [rdx], r8
mov rcx, qword [rcx + 0x10]
mov qword [rax + 0x10], rcx
mov rsp, rbp
pop rbp
ret
sub eax, 0xe9193ba4
outsd dx, dword [rsi]
invalid
Function at 0x140053ee0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1402029a0]
or eax, dword [0x1402029a4]
mov ecx, 0x8b219368
xor ecx, 0xa30f6c18
xor edx, edx
div ecx
add eax, 0xa28e5793
mov ecx, 0x2c0d9cd3
xor ecx, 0x25ad418f
or eax, ecx
mov ecx, 0x16c9fbd7
xor ecx, 0x3ae28b60
cmp eax, ecx
je 0x14005404b
mov ecx, dword [0x1402029a8]
mov eax, dword [0x1402029ac]
or ecx, eax
mov eax, ecx
xor eax, 0xfea25511
and eax, ecx
mov ecx, eax
imul rcx, rcx, 0x141e79cb
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
and eax, 0xfffffffe
mov dword [rbp - 0x3c], eax
mov eax, 0x10
call fcn.1401ffc50
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x48], rax
sub rsp, 0x20
call fcn.14004b700
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x10]
add rsp, 0x20
mov r8, rax
mov eax, dword [rbp - 0x3c]
mov qword [rbp - 0x38], r8
mov r8, rcx
add r8, 8
mov qword [rbp - 0x30], r8
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x28], rcx
mov r8, rdx
add r8, 8
mov qword [rbp - 0x20], r8
cmp rcx, qword [rdx + 8]
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0x27e156c7
ja 0x140053f32
mov rax, qword [rbp - 0x28]
mov cl, byte [rbp - 0x11]
test cl, 1
mov qword [rbp - 0x50], rax
jne 0x140054025
jmp 0x140053fe4
mov rcx, qword [rbp - 0x48]
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.140053300
mov rax, qword [rbp - 0x38]
add rsp, 0x20
mov al, byte [rax]
mov cl, 0x4e
xor cl, 0x4e
cmp al, cl
jne 0x140054046
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x50]
mov r9, qword [rcx]
mov qword [rax], r9
mov qword [rdx], r8
mov rcx, qword [rcx + 0x10]
mov qword [rax + 0x10], rcx
mov rsp, rbp
pop rbp
ret
and cl, byte [rbx + 0x57]
push rsi
jmp 0x140053f32
Function at 0x14005a630
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov ecx, dword [0x140202bc0]
xor ecx, 0x307384b6
mov eax, dword [0x140202bc4]
xor eax, 0xffffffff
mov edx, 0x48efd1a9
xor edx, 0x48efd1a9
mov r8d, 0x552a5546
xor r8d, 0x552a5547
sub edx, r8d
sub eax, edx
sub ecx, eax
mov edx, 0x2680387c
xor edx, 0xf315b440
mov eax, ecx
and eax, edx
shl eax, 1
xor ecx, 0xd5958c3c
add ecx, eax
add ecx, 0x869a36a7
add ecx, 0xd38a3dc3
mov eax, 0x7dcb090c
xor eax, 0xfb513fab
sub ecx, eax
mov eax, ecx
and eax, eax
xor eax, 0xffffffff
and eax, 0xcd863ca7
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xcd863ca7
mov r8d, 0xffffffff
xor r8d, 0xcd863ca7
or edx, r8d
and ecx, edx
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
cmp eax, 0xce3fba23
ja 0x14005a7ae
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x140202bc8]
xor eax, 0x92267acf
mov edx, dword [0x140202bcc]
mov r8d, 0xd8a32158
xor r8d, 0xa8274226
xor edx, r8d
and eax, edx
mov edx, 0x4ffe6548
xor edx, 0xf8cd78cd
xor eax, edx
mov edx, 0xd0060d17
xor edx, 0x2bea8ea3
and eax, edx
mov r8d, 0x7c7d5a37
xor edx, edx
div r8d
mov rcx, qword [rcx + 0x18]
mov qword [rsp + 0x20], rcx
cmp rcx, 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x9a73de6
ja 0x14005a6de
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x14005a7a8
jmp 0x14005a75b
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, rax
add rcx, 1
xor rax, 0xffffffffffffffff
movabs rdx, 0x4000000000000000
or rax, rdx
add rax, rcx
movabs rcx, 0x37510d5a947a8068
movabs rdx, 0x37510d5a947a8068
xor rcx, rdx
cmp rax, rcx
jne 0x14005a7a8
mov rcx, qword [rsp + 0x20]
call fcn.14000fb44
nop
add rsp, 0x38
ret
ret
Function at 0x14005c720
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
cmp rcx, 0
je 0x14005c863
mov ecx, dword [0x140202ca0]
mov edx, dword [0x140202ca4]
mov eax, 0xf181a0aa
xor eax, 0xf181a0aa
sub eax, ecx
mov ecx, 0xcafcd8d0
xor ecx, 0xcafcd8d0
sub ecx, edx
add eax, ecx
xor r8d, r8d
sub r8d, eax
mov eax, 0x48804572
xor eax, 0x48804572
mov ecx, 0x6957e473
xor ecx, 0xb216e5dd
sub eax, ecx
sub r8d, eax
mov eax, r8d
xor eax, 0xffffffff
mov ecx, 0xde6ffddc
xor ecx, 0xb67d1304
and ecx, eax
mov edx, 0xffffffff
xor edx, 0x6812eed8
mov eax, r8d
and eax, edx
imul eax, ecx
mov ecx, r8d
and ecx, 0x6812eed8
mov edx, 0x7b59b1db
xor edx, 0x134b5f03
or r8d, edx
imul r8d, ecx
add r8d, eax
mov ecx, r8d
xor ecx, 0xffffffff
mov eax, 0xa53d1298
xor eax, 0x77743456
and eax, ecx
mov edx, 0xffffffff
xor edx, 0xd24926ce
and r8d, edx
mov ecx, 0xffffffff
xor ecx, 0x4f70d65e
and ecx, 0xd24926ce
and edx, 0x4f70d65e
or eax, r8d
or ecx, edx
xor eax, ecx
cmp eax, 0x9613dfa6
ja 0x14005c86d
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x140202ca8]
mov edx, dword [0x140202cac]
mov r8d, 0x2ef8b491
xor r8d, 0xf93fa74e
xor edx, r8d
sub eax, edx
mov r8d, 0x25137e2f
xor r8d, 0xdd745e0f
xor edx, edx
div r8d
add eax, 0x293bfeef
xor eax, 0xa09f743
mov dword [rsp + 0x2c], eax
call fcn.140059f20
mov eax, dword [rsp + 0x2c]
cmp eax, 0xfbab6c76
jae 0x14005c807
jmp 0x14005c863
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
pop rax
sub edx, dword [rcx + rbp*8 - 0x6f]
nop word cs:[rax + rax]
Function at 0x14005c880
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov word [rbp - 0xa], dx
mov qword [rbp - 8], rcx
mov eax, dword [0x140202cb0]
xor eax, dword [0x140202cb4]
mov ecx, 0x4383bd4f
xor edx, edx
div ecx
mov r11d, eax
mov edx, 0xdac02178
xor edx, 0x96f37db7
mov eax, 0x6e0da957
xor eax, 0x91f256a8
xor edx, eax
mov ecx, r11d
and ecx, edx
mov eax, r11d
or eax, edx
xor eax, 0xffffffff
imul eax, ecx
mov ecx, r11d
and ecx, 0x4c335ccf
or r11d, 0x4c335ccf
imul r11d, ecx
add r11d, eax
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0x926242ff
mov edx, 0xffffffff
xor edx, 0x9c650009
mov r9d, 0x93f1bf71
xor r9d, 0xf94bf78
mov eax, ecx
and eax, r9d
and r11d, edx
mov r9d, r8d
and r9d, 0x9c650009
mov r10d, edx
and r10d, 0x926242ff
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
mov r8d, 0xac5d1222
xor r8d, 0x53a2eddd
xor ecx, r8d
or edx, 0x9c650009
and ecx, edx
or eax, ecx
mov ecx, 0xc906ac4
xor ecx, 0xebf5ced7
cmp eax, ecx
je 0x14005ca5a
mov ecx, dword [0x140202cb8]
xor ecx, 0xf6291aa8
mov eax, dword [0x140202cbc]
add ecx, eax
mov eax, ecx
xor eax, 0x2daa8001
or ecx, 0xd2557ffe
and ecx, eax
mov edx, ecx
and edx, 0x7d4a6622
add edx, edx
mov eax, ecx
neg edx
mov ecx, edx
lea eax, [rax + rcx - 0x2b599de]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xf660bfaa
and ecx, 0x99f4055
imul ecx, edx
mov edx, eax
and edx, 0x99f4055
or eax, 0x99f4055
imul eax, edx
add eax, ecx
mov dword [rbp - 0x10], eax
mov eax, 0x10
call fcn.1401ffc50
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
mov eax, 0x20
call fcn.1401ffc50
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
sub rsp, 0x20
call fcn.14004b700
mov rcx, qword [rbp - 0x20]
mov dx, word [rbp - 0xa]
mov r8, qword [rbp - 0x18]
add rsp, 0x20
mov rax, qword [rbp - 8]
mov qword [r8], 0
mov r9, qword [rax + 0x10]
mov qword [rcx + 0x10], r9
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
sub rsp, 0x20
call fcn.14005ca70
add rsp, 0x20
mov rcx, rax
mov eax, dword [rbp - 0x10]
test rcx, rcx
setns cl
mov byte [rbp - 0xb], cl
cmp eax, 0x792162eb
jb 0x14005c968
mov al, byte [rbp - 0xb]
and al, 1
movzx eax, al
mov rsp, rbp
pop rbp
ret
mov ah, 0x20
or dword [rsi - 0xfa17], eax
jmp qword [rsi + 0x66]