joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004bb34
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rcx
mov rax, qword [rcx]
movabs rcx, 0x787cde711da681ab
movabs rdx, 0x787cde711da681ab
xor rcx, rdx
cmp rax, rcx
jle 0x14004bbc9
mov rax, qword [rsp + 0x40]
add rax, 8
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov rax, qword [rax]
add rax, 8
shl rcx, 4
add rax, rcx
mov rcx, qword [rax]
mov qword [rsp + 0x48], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
call fcn.140048070
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
add rax, 1
cmp rax, qword [rcx]
mov qword [rsp + 0x38], rax
jl 0x14004bb75
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x14004bbfe
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.140017ba0
nop
add rsp, 0x58
ret

Function at 0x14004bc04
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rcx
cmp qword [rcx], 0
jle 0x14004bc84
mov rax, qword [rsp + 0x40]
add rax, 8
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov rax, qword [rax]
add rax, 8
imul rcx, rcx, 0x18
add rax, rcx
add rax, 8
mov rcx, qword [rax]
mov qword [rsp + 0x48], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
call fcn.140048070
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
add rax, 1
cmp rax, qword [rcx]
mov qword [rsp + 0x38], rax
jl 0x14004bc2c
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x14004bcb9
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.140017ba0
nop
add rsp, 0x58
ret

Function at 0x14004bcbf
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1402476a0
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14004bcff
mov rcx, qword [rsp + 0x28]
call fcn.140247b86
nop
add rsp, 0x38
ret
Function at 0x14004cce0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x40]
cmp rcx, 0
je 0x14004cf0d
mov rax, qword [rsp + 0x40]
xor ecx, ecx
sub rcx, rax
xor eax, eax
sub rax, 0xfffffffffffffff0
add rcx, rax
xor eax, eax
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp rax, 0x10
jb 0x14004ceec
mov r8, qword [rsp + 0x38]
movabs rcx, 0x63e9c2760012d026
movabs rax, 0x9c163d89ffed2fd6
xor rcx, rax
mov rax, r8
and rax, rcx
mov rcx, r8
or rcx, 0xfffffffffffffff0
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, 0xffffffffffffffff
movabs rdx, 0x79560cff860c17c0
and rcx, rdx
mov r10, 0xffffffffffffffff
movabs rdx, 0x79560cff860c17c0
xor r10, rdx
mov r9, rax
and r9, r10
movabs r11, 0x2678ffb1fbebc90d
movabs rdx, 0xd987004e041436f2
xor r11, rdx
mov rdx, r8
xor rdx, r11
movabs r11, 0x79560cff860c17c0
and rdx, r11
and r8, r10
or rcx, r9
or rdx, r8
xor rcx, rdx
cmp rcx, 0
setl dl
cmp rax, 0xffffffffffffffff
setg cl
mov al, 1
xor al, 0
xor dl, al
mov al, cl
xor al, dl
and al, cl
test al, 1
jne 0x14004cdef
jmp 0x14004cecb
mov eax, dword [0x1402aa0f8]
mov ecx, dword [0x1402aa0fc]
mov edx, 0x7039b9af
xor edx, 0x1f3ae35
xor ecx, edx
add eax, ecx
mov ecx, 0x75301013
xor ecx, 0x45e82343
xor edx, edx
div ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xdd7d41d9
mov r8d, 0xffffffff
xor r8d, 0xdd7d41d9
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0x56d09c6b
xor r8d, 0x8badddb2
mov edx, eax
and edx, r8d
mov r8d, 0xa5f4c414
xor r8d, 0x788985cd
or eax, r8d
imul eax, edx
add eax, ecx
add eax, 0xfa3de168
mov ecx, 0x43eb9b3a
xor ecx, 0x760d058e
sub eax, ecx
sub eax, 0xfa3de168
cmp eax, 0x57b29109
jb 0x14004cf13
mov ecx, dword [0x1402aa100]
mov edx, dword [0x1402aa104]
xor edx, 0xffffffff
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0xc451ef58
xor ecx, 0x1086e88b
sub eax, ecx
and eax, 0x7c9b9ea5
sub eax, 0x9355e833
mov dword [rsp + 0x24], eax
call fcn.14000ee80
mov eax, dword [rsp + 0x24]
cmp eax, 0x6cf27509
jbe 0x14004ce82
jmp 0x14004cf0d
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov r8, qword [rax]
xor ecx, ecx
call fcn.14001d8a6
jmp 0x14004cf0d
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rax]
mov ecx, 1
call fcn.14001d8a6
mov rcx, qword [rsp + 0x40]
call fcn.14001d970
nop
add rsp, 0x48
ret
ret
Function at 0x14004cf20
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x58
mov eax, dword [0x1402aa108]
and eax, dword [0x1402aa10c]
mov ecx, 0xfdf18626
xor edx, edx
div ecx
mov ecx, eax
mov edx, 0xffffffff
xor edx, 0xbd82fc03
mov eax, ecx
xor eax, edx
and eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xf4c803d6
mov r8d, 0xffffffff
xor r8d, 0xf4c803d6
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0x13d82d92
xor r8d, 0xe7102e44
mov edx, eax
and edx, r8d
or eax, 0xf4c803d6
imul eax, edx
add eax, ecx
cmp eax, 0x2bcff028
jae 0x14004d13f
mov eax, dword [0x1402aa110]
mov edx, dword [0x1402aa114]
mov r8d, eax
xor r8d, edx
xor r8d, 0xffffffff
mov ecx, edx
and ecx, r8d
shl ecx, 1
sub ecx, edx
sub eax, ecx
mov ecx, 0xbe1f1370
xor ecx, 0x290090d2
imul eax, ecx
mov ecx, 0x75d59bf5
xor edx, edx
div ecx
mov ecx, 0xdbe8857d
xor edx, edx
div ecx
mov dword [rsp + 0x44], eax
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
mov eax, dword [rsp + 0x44]
mov qword [rsp + 0x48], rcx
cmp byte [rcx + 0x60], 0
sete cl
mov byte [rsp + 0x57], cl
cmp eax, 0x53b00020
ja 0x14004cf93
mov al, byte [rsp + 0x57]
test al, 1
jne 0x14004d077
jmp 0x14004d018
mov rax, qword [rsp + 0x48]
mov rcx, rax
add rcx, 0x10
mov qword [rsp + 0x30], rcx
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x38], rax
cmp rax, 0
je 0x14004d077
mov rax, qword [0x1402d1090]
mov qword [rsp + 0x28], rax
cmp rax, 0
je 0x14004d05e
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
call rax
mov rcx, qword [rsp + 0x30]
xor eax, eax
mov edx, eax
call fcn.1400255e0
mov ecx, 1
call qword [0x1402d10a0]
mov eax, dword [0x1402aa118]
sub eax, dword [0x1402aa11c]
mov ecx, 0x287121c1
xor ecx, 0xfed8c37
add eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0x2fa19fe
xor edx, 0xfd05e601
xor eax, edx
and ecx, eax
mov eax, 0xffffffff
xor eax, 0xd4195bb9
mov edx, 0xffffffff
xor edx, 0xd4195bb9
and eax, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
and ecx, eax
mov edx, 0x998288db
xor edx, 0x667d7724
mov eax, ecx
xor eax, edx
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0xffffffff
xor ecx, 0xd9dfc1e
mov edx, 0xffffffff
xor edx, 0xd9dfc1e
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
cmp eax, 0x863f1016
je 0x14004d148
mov eax, dword [0x1402aa120]
add eax, dword [0x1402aa124]
mov ecx, eax
xor ecx, 0xc989d408
xor ecx, 0xffffffff
mov edx, 0x4664f702
xor edx, 0x8fed230a
or eax, edx
and eax, ecx
or eax, 0x2581d749
xor eax, 0xe8d4506e
cmp eax, 0xd8023546
je 0x14004d0ff
add rsp, 0x58
ret
fild word [rdx - 0x1b4168d]
invalid
pop rsi
adc eax, 0xaee9f59c
invalid

Function at 0x14004d151
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x14004d185
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
call fcn.140017ba0
nop
add rsp, 0x28
ret
Function at 0x14004e2e0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402aa1c8]
add ecx, dword [0x1402aa1cc]
mov edx, 0x1a553853
xor edx, 0xcdf914e9
mov eax, 0xc03997ae
xor eax, 0x3fc66851
xor edx, eax
mov eax, ecx
and eax, edx
mov edx, ecx
xor edx, 0xd7ac2cba
add ecx, edx
sub ecx, eax
mov eax, 0xf2c80f79
xor eax, 0xea767e6
or ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
and eax, edx
mov edx, 0xffffffff
xor edx, 0x7f8e6ad0
mov r8d, 0xffffffff
xor r8d, 0x7f8e6ad0
and edx, r8d
or eax, edx
xor eax, 0xffffffff
mov edx, 0x13e2e27a
xor edx, 0x6c6c88aa
or ecx, edx
mov edx, 0x23584c59
xor edx, 0xdca7b3a6
xor ecx, edx
or eax, ecx
xor eax, 0xffffffff
cmp eax, 0x8fa77ae4
ja 0x14004e3ff
mov ecx, dword [0x1402aa1d0]
mov edx, dword [str._a5NQ]
mov eax, ecx
xor eax, 0xffffffff
mov r9d, 0xd8b28f8a
xor r9d, 0x274d7075
mov r8d, edx
xor r8d, r9d
and eax, r8d
xor ecx, 0xffffffff
mov r8d, 0x16fec913
xor r8d, 0xe90136ec
xor edx, r8d
and ecx, edx
mov edx, 0x7a5a4f2
xor edx, 0xf85a5b0d
xor eax, edx
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x70bee66
xor edx, edx
div ecx
and eax, 0xd1feb8bb
imul eax, eax, 0xe779fb70
mov dword [rsp + 0x24], eax
mov ecx, dword [0x1402d10b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [rsp + 0x24]
cmp eax, 0x18372587
jb 0x14004e379
add rsp, 0x28
ret
or esi, edx
iretd
Function at 0x14004e410
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov eax, dword [0x1402aa1d8]
mov ecx, dword [0x1402aa1dc]
xor ecx, 0x6538103a
xor edx, edx
div ecx
mov ecx, 0x3fc4e73
xor edx, edx
div ecx
xor eax, 0x32951345
mov ecx, 0xbab8b2b
xor ecx, 0xc8e87dfd
sub eax, ecx
mov ecx, 0xc61cb440
xor ecx, 0xcb45a274
cmp eax, ecx
je 0x14004e5ec
mov eax, dword [0x1402aa1e0]
mov ecx, dword [0x1402aa1e4]
mov edx, 0x94432ad8
xor edx, 0xb17fd263
xor ecx, edx
xor eax, ecx
mov ecx, 0x2748360a
xor ecx, 0xdd72fac8
or eax, ecx
add eax, 0x6a209f11
mov edx, eax
and edx, 0x4c3c321d
mov ecx, 0xfa476e68
xor ecx, 0xfa476e6a
imul ecx, edx
mov edx, 0x3c6dd470
xor edx, 0x7051e66d
add eax, edx
sub eax, ecx
mov dword [rsp + 0x44], eax
lea rcx, [0x1402baf10]
add rcx, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
mov eax, dword [rsp + 0x44]
mov qword [rsp + 0x48], rcx
mov qword [0x1402d1098], rcx
cmp rcx, 0
sete cl
mov byte [rsp + 0x57], cl
cmp eax, 0x3eb80721
jae 0x14004e458
mov rax, qword [rsp + 0x48]
mov cl, byte [rsp + 0x57]
test cl, 1
mov qword [rsp + 0x38], rax
jne 0x14004e504
jmp 0x14004e5cf
mov eax, dword [0x1402aa1e8]
imul eax, dword [0x1402aa1ec]
mov ecx, 0x7f161da2
xor ecx, 0x8c37e128
add eax, ecx
mov ecx, 0x630eb6c5
xor ecx, 0xc21aaefc
xor eax, ecx
add eax, 0xe50469c7
cmp eax, 0xcef13087
jae 0x14004e5f5
mov ecx, dword [0x1402aa1f0]
xor ecx, 0xe77f57a7
mov edx, dword [0x1402aa1f4]
mov eax, edx
and eax, ecx
xor eax, 0xffffffff
add ecx, edx
add ecx, 1
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0xb927d843
mov edx, 0xd050194c
xor edx, 0x6977c10f
mov r8d, 0xdcdbb826
xor r8d, 0x232447d9
xor edx, r8d
and ecx, edx
or eax, ecx
xor eax, 0xf1bb1463
mov ecx, 0x70cb8334
xor ecx, 0x77374845
sub eax, ecx
mov dword [rsp + 0x2c], eax
mov ecx, 1
call qword [0x1402d10a0]
mov eax, dword [rsp + 0x2c]
mov rcx, qword [0x1402d1098]
mov qword [rsp + 0x30], rcx
cmp eax, 0xa304eef7
jbe 0x14004e53b
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
jmp 0x14004e5cf
mov rcx, qword [rsp + 0x38]
lea rdx, str.ExitProcess
call fcn.14000f160
mov qword [0x1402d10a0], rax
add rsp, 0x58
ret
sub esp, esp
push rbp
iretd
mov edi, 0xe9ac9958
cmp eax, 0x66ffffff
nop
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx + 0x60]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x14004e655
mov rcx, qword [rsp + 0x30]
movabs rax, 0x4000000000000000
and rax, qword [rcx]
cmp rax, 0
jne 0x14004e655
mov rcx, qword [rsp + 0x30]
call fcn.14001a7c0
nop
add rsp, 0x38
ret
Function at 0x1400518f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rcx
mov eax, dword [0x1402aa350]
mov ecx, dword [0x1402aa354]
xor ecx, 0x890ab5d8
xor edx, edx
div ecx
mov ecx, eax
mov eax, 0xdca96d47
xor eax, 0xd48cdcaf
imul ecx, eax
mov edx, 0xca6d2281
xor edx, 0xbe92b020
mov eax, ecx
and eax, edx
xor ecx, 0x74ff92a1
or eax, ecx
mov ecx, 0x85753516
xor edx, edx
div ecx
cmp eax, 0xb3faa829
je 0x140051a5e
mov ecx, dword [0x1402aa358]
mov eax, dword [0x1402aa35c]
xor eax, ecx
xor eax, 0x466fcc43
and eax, ecx
mov edx, eax
and edx, 0xe4ddd393
or eax, 0xe4ddd393
mov ecx, eax
mov eax, edx
lea eax, [rax + rcx - 0x48828254]
mov dword [rsp + 0x50], eax
mov eax, 0xa7105a3e
mov dword [rsp + 0x4c], eax
mov rax, qword [0x1402c6150]
mov qword [rsp + 0x30], rax
mov ecx, dword [rax]
call fcn.14000eaf8
mov rcx, rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rcx
add rcx, 0x60
mov qword [rsp + 0x38], rcx
mov ecx, dword [rax]
call fcn.14000eaf8
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rax, qword [rcx + 0x38]
mov r8d, 8
call rax
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x4c]
mov r8, rax
mov eax, dword [rsp + 0x50]
mov dl, byte [rdx + 0x60]
test dl, dl
setne dl
sub r8, 8
sete r8b
or dl, r8b
mov byte [rsp + 0x57], dl
cmp eax, ecx
jb 0x14005194e
mov al, byte [rsp + 0x57]
test al, 1
jne 0x140051a58
jmp 0x140051a0e
lea rcx, [0x1402baf50]
call fcn.14005090f
mov rcx, rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rcx
cmp byte [rax], 0
jne 0x140051a58
mov rcx, qword [rsp + 0x28]
lea rdx, [0x1402baf34]
lea r8, [0x1402baf3c]
lea r9, [0x1402baf41]
mov qword [rsp + 0x20], 0x1fea25c7
call fcn.140025a43
nop
add rsp, 0x68
ret
jae 0x140051a94
pop rsi
sbb cl, ch
out 0xfe, eax
invalid
invalid
Function at 0x14006b210
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x30], rcx
mov eax, 0x10
call fcn.1402a7dd0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x38], rax
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000eaf8
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov rax, rcx
add rax, 8
mov qword [rbp - 0x18], rax
mov rax, qword [rcx + 8]
mov rcx, rdx
add rcx, 8
mov qword [rbp - 0x10], rcx
cmp rax, qword [rdx + 8]
mov qword [rbp - 8], rax
je 0x14006b2bc
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x30]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.14006aaf0
mov rax, qword [rbp - 0x20]
add rsp, 0x20
cmp byte [rax + 0x60], 0
jne 0x14006b392
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x40], rax
mov eax, dword [0x1402aacb0]
mov edx, dword [0x1402aacb4]
xor edx, 0x71bef41f
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, edx
add eax, ecx
sub eax, 0xa79a746e
or eax, 0x7bf8f04d
mov edx, eax
xor edx, 0xffffffff
and edx, 0xfb48cb7e
mov r8d, 0xffffffff
xor r8d, 0xfb48cb7e
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0xe6db8b11
xor r8d, 0x1d93406f
mov edx, eax
and edx, r8d
or eax, 0xfb48cb7e
imul eax, edx
add eax, ecx
mov ecx, 0x9f79de06
xor ecx, 0xc02c5f29
cmp eax, ecx
jae 0x14006b397
mov rcx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x18]
mov r9, qword [rbp - 0x40]
mov eax, dword [0x1402aacb8]
xor eax, 0xe2803fa5
or eax, dword [0x1402aacbc]
xor eax, 0x475f9167
mov r10d, 0x3459f129
xor edx, edx
div r10d
mov rdx, qword [rbp - 0x28]
sub eax, 0x8312795c
mov r10, qword [rdx]
mov qword [rcx], r10
mov qword [r8], r9
mov rdx, qword [rdx + 0x10]
mov qword [rcx + 0x10], rdx
cmp eax, 0x3aa18e81
jbe 0x14006b33b
jmp 0x14006b392
mov rsp, rbp
pop rbp
ret
xor eax, 0xe922dd47
wait
invalid
Function at 0x14006db00
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], rcx
mov r8d, dword [0x1402aadb0]
mov eax, 0x610663a3
xor eax, 0x3e9f7fea
xor r8d, eax
mov edx, dword [0x1402aadb4]
xor edx, 0xd13e5378
mov ecx, 0xb511788f
xor ecx, 0x4aee8770
mov eax, r8d
xor eax, ecx
and eax, 0x1db91bcb
mov r9d, 0xe9793dd2
xor r9d, 0xf4c02619
mov ecx, 0xf929dc36
xor ecx, 0x6d623c9
xor r9d, ecx
and r8d, r9d
mov ecx, edx
xor ecx, 0xffffffff
and ecx, 0x1db91bcb
and edx, r9d
or eax, r8d
or ecx, edx
xor eax, ecx
imul eax, eax, 0x53df93da
mov ecx, 0xbe9a09cb
xor ecx, 0x325c536a
xor edx, edx
div ecx
mov edx, 0xbe6d9327
xor edx, 0x41926cd8
mov ecx, eax
xor ecx, edx
and ecx, 0x3d6d0d4
mov edx, 0xffffffff
xor edx, 0x3d6d0d4
and eax, edx
sub eax, ecx
mov ecx, 0xe6e2c238
xor ecx, 0x42579089
cmp eax, ecx
jbe 0x14006dd0f
mov ecx, dword [0x1402aadb8]
mov eax, dword [0x1402aadbc]
and ecx, eax
mov eax, ecx
xor eax, 0x24003c98
and eax, ecx
xor eax, 0x3840081c
and eax, 0x3c403cbc
mov dword [rbp - 0x10], eax
mov eax, 0x5a69923
mov dword [rbp - 0x14], eax
mov eax, 0x20
mov qword [rbp - 0x40], rax
call fcn.1402a7dd0
sub rsp, rax
mov rax, qword [rbp - 0x40]
mov rcx, rsp
mov qword [rbp - 0x38], rcx
call fcn.1402a7dd0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000eaf8
add rsp, 0x20
mov qword [rbp - 0x20], rax
add rax, 0x60
mov qword [rbp - 0x28], rax
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000eaf8
mov rdx, qword [rbp - 0x20]
mov ecx, dword [rbp - 0x14]
add rsp, 0x20
mov eax, dword [rbp - 0x10]
cmp byte [rdx + 0x60], 0
sete dl
mov byte [rbp - 9], dl
cmp eax, ecx
jb 0x14006dbc2
mov cl, byte [rbp - 9]
xor eax, eax
test cl, 1
mov qword [rbp - 0x48], rax
jne 0x14006dc84
jmp 0x14006dd06
mov ecx, 0x18
mov edx, 8
sub rsp, 0x20
call fcn.140025b10
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 8]
add rsp, 0x20
mov qword [rbp - 0x50], rax
sub rsp, 0x20
call fcn.14006d3e0
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x50]
add rsp, 0x20
mov cl, byte [rcx]
mov dl, 0xa0
xor dl, 0xa0
cmp cl, dl
mov qword [rbp - 0x48], rax
jne 0x14006dd06
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x38]
mov r8, qword [rax]
mov qword [rdx], r8
mov r8, qword [rax + 8]
mov qword [rdx + 8], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 0x10], rax
sub rsp, 0x20
call fcn.14006cc50
mov rax, qword [rbp - 0x50]
add rsp, 0x20
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x48]
mov rsp, rbp
pop rbp
ret
stc
and al, 0xb2
invalid
Function at 0x1400843d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x98
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rcx
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x90], 0
mov rax, qword [rcx]
mov qword [rsp + 0x78], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x80], rax
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x88], rax
mov rax, qword [rdx]
mov qword [rsp + 0x68], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x78]
lea rdx, [rsp + 0x68]
lea r8, [rsp + 0x90]
call fcn.140084590
mov rcx, rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rcx
cmp byte [rax + 0x60], 0
jne 0x1400844f5
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
cmp rcx, 0xffffffffffffffff
mov qword [rsp + 0x38], rax
jle 0x1400844f5
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rcx
cmp rax, rcx
jl 0x1400844d0
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x30]
movabs rax, 0x28f443af165727b6
movabs r8, 0xd70bbc50e9a8d849
xor rax, r8
add rdx, rax
call fcn.140025e55
jmp 0x1400844f5
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 8]
add rax, 8
shl rcx, 5
add rax, rcx
add rax, 0x18
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov eax, dword [0x1402ab660]
imul eax, dword [0x1402ab664]
mov ecx, 0xd7e89f28
xor ecx, 0x66b0f551
add eax, ecx
mov ecx, 0x85025733
xor ecx, 0xcd00c34
xor edx, edx
div ecx
mov ecx, 0xb6845e8a
xor edx, edx
div ecx
cmp eax, 0x9e55fc31
jae 0x14008457a
mov eax, dword [0x1402ab668]
mov ecx, dword [0x1402ab66c]
xor ecx, 0x4a0a8e1f
xor edx, edx
div ecx
imul eax, eax, 0xbe95fdb3
sub eax, 0xdbd61996
add eax, 0xb9e701a0
cmp eax, 0xe7df2a4a
jae 0x14008453c
mov rax, qword [rsp + 0x28]
add rsp, 0x98
ret
scasb al, byte [rdi]
add al, 0xf6
xchg ecx, eax
jmp 0x14008453c
Function at 0x14008a9d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov eax, dword [0x1402ab928]
add eax, dword [0x1402ab92c]
mov ecx, 0x20a2fd9e
xor ecx, 0x5db3cb8f
or eax, ecx
add eax, 0x425bdfe4
mov ecx, 0xe66a627f
xor ecx, 0x452144f7
or eax, ecx
cmp eax, 0x5cf49c3d
jb 0x14008ab40
mov eax, dword [0x1402ab930]
mov ecx, 0xa2cc402
xor ecx, 0x5187f849
xor eax, ecx
xor eax, dword [0x1402ab934]
mov ecx, 0x1ca150c2
xor ecx, 0x7478f615
xor edx, edx
div ecx
mov ecx, eax
and ecx, 0xb1eba31e
mov edx, 0x79809610
xor edx, 0x79809612
imul ecx, edx
xor eax, 0xb1eba31e
add eax, ecx
mov ecx, eax
and ecx, 0x4045308c
mov edx, 0x53c4cedb
xor edx, 0xac3b3124
xor ecx, edx
mov edx, 0x39ea8c94
xor edx, 0x79afbc18
add eax, edx
mov edx, 0x40461ea9
xor edx, 0x40461ea8
add eax, edx
add eax, ecx
mov dword [rsp + 0x40], eax
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov qword [rsp + 0x28], rax
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov rcx, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rcx
mov rcx, rax
add rcx, 0x2b38
mov qword [rsp + 0x30], rcx
mov rcx, qword [rax + 0x2b38]
call fcn.14008a7a0
mov rcx, qword [rsp + 0x38]
mov eax, dword [rsp + 0x40]
cmp byte [rcx + 0x60], 0
sete cl
mov byte [rsp + 0x47], cl
cmp eax, 0x7dc739ad
jbe 0x14008aa0a
mov al, byte [rsp + 0x47]
test al, 1
jne 0x14008aafd
jmp 0x14008ab3b
movabs rcx, 0x425693af7f8a417d
movabs rax, 0x425693af7f8a4155
xor rcx, rax
movabs rdx, 0x704764c98e630e3f
movabs rax, 0x704764c98e630e37
xor rdx, rax
call fcn.140025b10
mov rcx, rax
mov rax, qword [rsp + 0x30]
mov qword [rax], rcx
add rsp, 0x48
ret
mov bl, 0x70
or eax, 0xfec1e976
invalid
Function at 0x140094ea0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x38], rcx
mov eax, 0x10
call fcn.1402a7dd0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000eaf8
mov rcx, qword [rbp - 0x28]
add rsp, 0x20
mov qword [rbp - 0x18], rax
add rax, 0x60
mov qword [rbp - 0x20], rax
mov qword [rcx], 0
mov qword [rcx + 8], 0
mov ecx, 8
sub rsp, 0x20
call fcn.140094410
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov qword [rbp - 0x10], rax
mov al, 1
cmp byte [rcx + 0x60], 0
mov byte [rbp - 1], al
jne 0x140094f8e
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000eaf8
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x40]
call fcn.140094cbc
mov rcx, qword [rbp - 0x20]
add rsp, 0x20
mov al, 1
cmp byte [rcx], 0
mov byte [rbp - 1], al
jne 0x140094f8e
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax + 0x58]
mov qword [rdx], r8
mov rax, qword [rax + 0x60]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140030ffb
mov rax, qword [rbp - 0x20]
add rsp, 0x20
mov al, byte [rax]
mov byte [rbp - 1], al
mov rax, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x10]
mov dl, byte [rbp - 1]
mov byte [rbp - 0x41], dl
mov byte [rax], 0
sub rsp, 0x20
call fcn.140093eeb
mov rax, qword [rbp - 0x20]
add rsp, 0x20
mov al, byte [rax]
mov cl, 8
xor cl, 8
cmp al, cl
jne 0x140094fc8
mov rax, qword [rbp - 0x20]
mov cl, byte [rbp - 0x41]
mov byte [rax], cl
mov eax, dword [0x1402abe28]
xor edx, edx
div dword [0x1402abe2c]
or eax, eax
mov ecx, 0xe148beb9
xor ecx, 0x1eb74146
xor eax, ecx
mov ecx, 0x182945c4
xor ecx, 0xf03edc40
mov edx, 0xe804bd2a
xor edx, 0x1324ae
or ecx, edx
mov edx, 0x9a1a08a8
xor edx, 0x65e5f757
xor ecx, edx
or eax, ecx
xor eax, 0xffffffff
and eax, 0x18543848
and eax, 0x42798b6d
cmp eax, 0x2356d742
ja 0x14009505b
mov eax, dword [0x1402abe30]
xor eax, dword [0x1402abe34]
add eax, 0xfa540802
mov ecx, 0x1e4f7f0
xor ecx, 0x171a0480
add eax, ecx
and eax, 0x7a83bc0a
cmp eax, 0xa4d56e89
je 0x140095024
mov rax, qword [rbp - 0x38]
mov rsp, rbp
pop rbp
ret
cmp esi, ebp
scasb al, byte [rdi]
ret