joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011d690
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov eax, dword [0x1401dfb58]
mov ecx, 0x9e3ec398
xor ecx, 0x2bfe3e02
xor eax, ecx
mov r8d, dword [0x1401dfb5c]
mov ecx, 0x1b54c94e
xor ecx, 0xe4ab36b1
mov r9d, r8d
xor r9d, ecx
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xe7d59c9d
xor ecx, 0xa1275bc6
or eax, ecx
mov edx, eax
and edx, 0xd7480ac2
mov ecx, 0x55c3a5c3
xor ecx, 0x55c3a5c1
imul ecx, edx
mov edx, 0x728c6d6e
xor edx, 0xa5c467ac
add eax, edx
sub eax, ecx
sub eax, 0xdc8a446
cmp eax, 0x471bf89
jbe 0x14011d882
mov r8, qword [rsp + 0x18]
mov ecx, dword [0x1401dfb60]
xor ecx, 0x6a672bd6
mov edx, dword [0x1401dfb64]
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
sub eax, 0x5ea1939d
or eax, 0x7432565d
xor eax, 0x4318dd53
mov ecx, 0xd2db2459
xor ecx, 0x2faf85e9
xor edx, edx
test r8, r8
cmovg rdx, r8
mov qword [rsp + 0x10], rdx
cmp eax, ecx
ja 0x14011d72d
xor eax, eax
mov qword [rsp + 8], rax
jmp 0x14011d788
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 8]
mov qword [rsp], rax
cmp rax, rcx
je 0x14011d7c1
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov dl, byte [rdx + rax]
mov byte [rcx + rax], dl
add rax, 1
mov qword [rsp + 8], rax
jmp 0x14011d788
mov eax, dword [0x1401dfb68]
xor eax, 0x80b4c24a
mov edx, dword [0x1401dfb6c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
or eax, 0xccd9394
mov ecx, eax
add ecx, 1
mov edx, 0xa165d1b2
xor edx, 0x5e9a2e4d
xor eax, edx
or eax, 0x61ca6d95
add eax, ecx
mov ecx, eax
and ecx, 0x336bc6f
shl ecx, 1
add eax, 0x336bc6f
sub eax, ecx
cmp eax, 0x994e075d
jae 0x14011d88b
mov edx, dword [str.1L__]
mov eax, dword [0x1401dfb74]
mov ecx, 0xf0ccafd5
xor ecx, 0x75af17f
xor eax, ecx
or edx, eax
and edx, 0xf38b12e3
mov eax, 0xa83e3171
xor eax, 0x4ea6d5ab
mov ecx, edx
xor ecx, eax
mov eax, 0xffffffff
xor eax, 0xe698e4da
and edx, eax
mov eax, 0xa3efe318
xor eax, 0xa3efe31a
imul eax, edx
sub eax, ecx
xor eax, 0xd78ef09d
mov ecx, 0x9ca1d9b2
xor ecx, 0x87bbdf47
cmp eax, ecx
jb 0x14011d88b
add rsp, 0x30
ret
xchg esp, eax
invalid
pop rbx
mov edx, 0x87e983cb
invalid
Function at 0x14011e290
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov r11d, dword [0x1401dfbd8]
imul r11d, dword [0x1401dfbdc]
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0xd0b6ee46
mov edx, 0xffffffff
xor edx, 0xa98d6db5
mov eax, ecx
and eax, 0xa98d6db5
and r11d, edx
mov r9d, r8d
and r9d, 0xa98d6db5
mov r10d, edx
and r10d, 0xd0b6ee46
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
xor ecx, 0xffffffff
or edx, 0xa98d6db5
and ecx, edx
or eax, ecx
mov ecx, 0x5dab47d9
xor edx, edx
div ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x1f939cc8
mov r8d, 0xffffffff
xor r8d, 0x1f939cc8
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x1f939cc8
or eax, 0x1f939cc8
imul eax, edx
add eax, ecx
cmp eax, 0x67dada3a
je 0x14011e3f2
mov eax, dword [0x1401dfbe0]
xor edx, edx
div dword [0x1401dfbe4]
mov edx, eax
mov rax, qword [rsp + 0x30]
mov ecx, 0xc22b8d36
xor ecx, 0x63248001
and edx, ecx
or edx, 0x3ed4d1d3
mov ecx, edx
and ecx, 0xe8dacc17
mov r8d, 0xcede003a
xor r8d, 0x2604cc2d
xor edx, r8d
or ecx, edx
mov dword [rsp + 0x20], ecx
mov rcx, qword [rax]
call fcn.14011c8e0
mov cl, al
mov eax, dword [rsp + 0x20]
mov byte [rsp + 0x27], cl
cmp eax, 0x8b151dd5
jb 0x14011e348
mov al, byte [rsp + 0x27]
test al, 1
jne 0x14011e3bc
jmp 0x14011e3e0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
movabs rdx, 0x19399e145c0b8926
movabs rax, 0x19399e145c0b892e
xor rdx, rax
call fcn.14000de70
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
add rsp, 0x38
ret
invalid
Function at 0x140123410
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x30], rcx
call fcn.140123d50
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rax, rcx
add rax, 0x88
mov qword [rsp + 0x38], rax
add rcx, 0x90
mov qword [rsp + 0x40], rcx
mov rax, qword [0x1401ee688]
call qword [rax]
mov rcx, qword [rsp + 0x48]
xor eax, eax
cmp byte [rcx + 0x60], 0
mov qword [rsp + 0x50], rax
jne 0x1401235e0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov eax, dword [0x1401dfe18]
xor eax, 0x68611208
xor edx, edx
div dword [0x1401dfe1c]
mov ecx, eax
mov eax, 0xffffffff
xor eax, 0xbddab727
add ecx, eax
add ecx, 1
and ecx, ecx
xor ecx, 0xffffffff
mov eax, 0x43ab9386
xor eax, 0x859ed8b7
mov edx, 0x8a5a3855
xor edx, 0x4c6f7364
and eax, edx
mov edx, 0xaf162e37
xor edx, 0x50e9d1c8
xor eax, edx
and ecx, eax
xor ecx, 0xffffffff
mov edx, 0xd86fbb74
xor edx, 0x2790448b
mov eax, ecx
xor eax, edx
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x377ca4b3
or eax, edx
mov edx, 0xba0fa655
xor edx, 0x8d7302e6
mov r8d, 0x252d86ef
xor r8d, 0x1251225c
and edx, r8d
xor edx, 0xffffffff
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
cmp eax, 0x84248e80
je 0x140123688
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401dfe20]
xor eax, 0x4dd62bc2
mov edx, dword [0x1401dfe24]
xor edx, 0x68bd5769
or eax, edx
or eax, 0x50ff1731
mov r8d, 0x6357a23e
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x38]
sub eax, 0xfd7bdb86
cmp rcx, qword [rdx]
setl cl
mov byte [rsp + 0x27], cl
cmp eax, 0x717feec6
ja 0x140123519
mov al, byte [rsp + 0x27]
test al, 1
jne 0x140123577
jmp 0x1401235c6
mov rax, qword [rsp + 0x28]
cmp rax, 0x80
jne 0x14012359c
mov ecx, pe_nt_image_headers64
mov edx, 0x7f
call fcn.140012270
jmp 0x1401235e0
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + rcx*8 + 0xf0]
call fcn.1400170b6
mov rax, qword [rsp + 0x28]
add rax, 1
mov qword [rsp + 0x50], rax
jmp 0x140123461
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov qword [rax], 0
mov rax, qword [0x1401ee690]
call qword [rax]
mov eax, dword [0x1401dfe28]
xor edx, edx
div dword [0x1401dfe2c]
mov ecx, 0x530acd86
xor edx, edx
div ecx
mov ecx, 0xa1b41026
xor ecx, 0x3c1468a
mov edx, eax
xor edx, ecx
xor edx, 0xffffffff
mov ecx, 0xfc4eb514
xor ecx, 0x5e3be3b8
and ecx, edx
shl ecx, 1
sub ecx, 0xa27556ac
sub eax, ecx
add eax, 0x77715395
cmp eax, 0x24ae84a7
ja 0x140123691
mov eax, dword [0x1401dfe30]
mov ecx, dword [str.r_]
mov edx, 0xc30f94e7
xor edx, 0x45976420
xor ecx, edx
and eax, ecx
or eax, 0xb4ec9ef4
sub eax, 0x1609420d
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0xa229de9c
mov edx, 0xffffffff
xor edx, 0xa229de9c
and eax, edx
sub eax, ecx
mov ecx, 0xcb263941
xor ecx, 0x105fccf0
cmp eax, ecx
je 0x140123631
add rsp, 0x58
ret
mov dh, 4
mov al, 0x17
jmp 0x140123519
adc eax, 0xe974e97c
xchg edi, eax
invalid
Function at 0x140129500
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
cmp rcx, 0
je 0x14012951d
mov rcx, qword [rsp + 0x20]
call fcn.140129651
mov eax, dword [0x1401e0148]
xor edx, edx
div dword [0x1401e014c]
mov r11d, eax
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0xebf4d541
mov edx, 0xffffffff
xor edx, 0x1443c54d
mov eax, ecx
and eax, 0x1443c54d
and r11d, edx
mov r9d, r8d
and r9d, 0x1443c54d
mov r10d, edx
and r10d, 0xebf4d541
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
mov r8d, 0x5e30d662
xor r8d, 0xa1cf299d
xor ecx, r8d
or edx, 0x1443c54d
and ecx, edx
or eax, ecx
mov ecx, 0xbf989180
xor ecx, 0xeb57ebda
add eax, ecx
mov edx, 0xf3ba392f
xor edx, 0x777b1600
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
or eax, 0x84c12f2f
and eax, ecx
cmp eax, 0xb1741621
je 0x140129648
mov eax, dword [0x1401e0150]
mov edx, dword [0x1401e0154]
xor edx, 0xffffffff
mov ecx, eax
xor ecx, edx
and ecx, eax
mov edx, 0xd67549a3
xor edx, 0x298ab65c
mov eax, ecx
xor eax, edx
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x44509933
mov edx, 0xffffffff
xor edx, 0x44509933
or ecx, edx
and eax, ecx
mov ecx, 0xe1c86ece
xor ecx, 0x1e379131
xor eax, ecx
mov edx, eax
and edx, 0x7d973f78
mov ecx, 0xdb16b3d1
xor ecx, 0xdb16b3d3
imul ecx, edx
add eax, 0x7d973f78
sub eax, ecx
and eax, 0x49330cd2
cmp eax, 0x86e53cc9
jae 0x1401295c1
mov rax, qword [rsp + 0x20]
add rsp, 0x28
ret
ffreep st(7)
and al, al
jmp 0x1401295c1
Function at 0x14012b420
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rcx
call fcn.14014e5aa
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
add rax, 0x60
mov qword [rsp + 0x48], rax
mov rax, qword [rcx]
mov qword [rsp + 0x50], rax
cmp rdx, 0
je 0x14012b4f9
mov eax, dword [0x1401e0208]
and eax, dword [0x1401e020c]
mov ecx, 0x7c1a35b8
xor ecx, 0x8d9f6469
imul eax, ecx
and eax, 0x5038b7c8
and eax, 0x8e23e0f3
mov ecx, 0x812b9ce9
xor ecx, 0x7fec6588
cmp eax, ecx
jae 0x14012b657
mov rcx, qword [rsp + 0x40]
mov edx, dword [0x1401e0210]
sub edx, dword [0x1401e0214]
mov eax, edx
and eax, 0x7d6eacbe
or edx, 0x7d6eacbe
add eax, edx
mov edx, 0x5cd0efd1
xor edx, 0x1cf05983
xor eax, edx
xor edx, edx
sub edx, eax
xor eax, eax
sub eax, 0x2c0091da
add edx, eax
xor eax, eax
sub eax, edx
mov dword [rsp + 0x34], eax
mov eax, 0x3f8a5f71
xor eax, 0x68a967bb
mov dword [rsp + 0x30], eax
call fcn.14012b669
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
cmp eax, ecx
jb 0x14012b48f
jmp 0x14012b4f9
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov qword [rax], rdx
lea rdx, [0x1401dfe98]
call fcn.14012a4d3
test al, 1
jne 0x14012b524
jmp 0x14012b651
mov eax, dword [0x1401e0218]
mov ecx, dword [0x1401e021c]
mov edx, 0xd9f7f334
xor edx, 0x2430d0e5
xor ecx, edx
imul eax, ecx
sub eax, 0xfc06a6a
sub eax, 0x5a7f79ea
add eax, 0xfc06a6a
add eax, 0xc4a2a11
mov ecx, 0xad70f4fe
xor ecx, 0xabadf31c
sub eax, ecx
sub eax, 0xc4a2a11
mov ecx, eax
xor ecx, 0xcca39b6e
xor ecx, 0xffffffff
and ecx, 0xcca39b6e
shl ecx, 1
sub ecx, 0xcca39b6e
sub eax, ecx
mov ecx, 0xcbf7e4f3
xor ecx, 0xd3db0bc
cmp eax, ecx
ja 0x14012b660
mov rcx, qword [rsp + 0x50]
mov eax, dword [0x1401e0220]
xor eax, 0xfb9bfc16
mov r8d, dword [0x1401e0224]
mov edx, 0xe2c26b92
xor edx, 0xf44fd342
xor r8d, edx
xor edx, edx
div r8d
mov r8d, 0xea06ba2
xor edx, edx
div r8d
mov r8d, 0xffffffff
xor r8d, 0x747c101d
mov edx, eax
and edx, r8d
mov r8d, eax
xor r8d, 0x747c101d
add eax, r8d
sub eax, edx
mov edx, 0xc821cbbe
xor edx, 0xed444602
xor eax, edx
mov dword [rsp + 0x28], eax
call fcn.14012a612
mov rcx, qword [rsp + 0x48]
mov eax, dword [rsp + 0x28]
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x26715608
je 0x14012b660
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x14012b630
jmp 0x14012b651
mov rcx, qword [rsp + 0x50]
movabs rdx, 0x26883afea9767d76
movabs rax, 0x26883afea9767d7e
xor rdx, rax
call fcn.14000de70
nop
add rsp, 0x58
ret
push rbx
pop rdi
stosb byte [rdi], al
push 0xfffffffffffe2fe9
inc dword [rsi - 0x16d250db]
sub al, 0xff
invalid
xchg byte [0x16cfbe415], ah
invalid
Function at 0x14012c140
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x48], rax
mov rax, rdx
add rax, 8
mov qword [rsp + 0x50], rax
mov rcx, qword [rdx + 8]
mov qword [rsp + 0x58], rcx
xor eax, eax
cmp rcx, 0
mov qword [rsp + 0x60], rax
je 0x14012c1a0
mov rcx, qword [rsp + 0x58]
call fcn.14012b669
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
mov qword [r8], r9
mov rdx, qword [rdx]
mov qword [rax], rdx
call fcn.14012bf10
test al, 1
jne 0x14012c1d4
jmp 0x14012c2ad
mov ecx, dword [0x1401e0268]
mov r8d, dword [0x1401e026c]
mov edx, 0x15ecf429
xor edx, 0xea130bd6
mov eax, ecx
xor eax, edx
mov edx, r8d
and edx, eax
mov eax, 0xd1abae64
xor eax, 0x2e54519b
mov r9d, r8d
xor r9d, eax
mov eax, ecx
and eax, r9d
imul eax, edx
mov edx, ecx
and edx, r8d
or ecx, r8d
imul ecx, edx
add ecx, eax
mov eax, ecx
and eax, 0x92035e82
xor ecx, 0x92035e82
or eax, ecx
add eax, 0x60bca248
mov ecx, 0xc5eea1ef
xor ecx, 0x2eaf2d82
and eax, ecx
cmp eax, 0xf6cd4e7b
je 0x14012c36c
mov rcx, qword [rsp + 0x48]
mov eax, dword [0x1401e0270]
mov edx, dword [0x1401e0274]
xor edx, 0xb77aafb0
sub eax, edx
mov edx, eax
and edx, 0x7178ed87
shl edx, 1
add eax, 0x7178ed87
sub eax, edx
mov r8d, 0xa15e74f
xor edx, edx
div r8d
and eax, 0xc88fb4b2
mov dword [rsp + 0x2c], eax
mov eax, 0x23358386
xor eax, 0x350a58c6
mov dword [rsp + 0x28], eax
call fcn.14000f914
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
jae 0x14012c246
jmp 0x14012c2ad
mov eax, dword [0x1401e0278]
xor eax, 0x90880a52
xor eax, dword [0x1401e027c]
or eax, 0xdb1cb845
sub eax, 0xb714d466
sub eax, 0x3f2c5efc
mov ecx, 0x5a0653ee
xor ecx, 0xed128788
add eax, ecx
imul eax, eax, 0xa29ffe38
mov ecx, 0xf925a9cf
xor ecx, 0x29bfb503
cmp eax, ecx
ja 0x14012c375
mov eax, dword [0x1401e0280]
xor eax, 0xca4e8475
mov ecx, dword [0x1401e0284]
xor ecx, 0xffffffff
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
mov r8d, 0xffffffff
xor r8d, 0xd7584d59
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xd7584d59
mov r8d, 0xdd26801b
xor r8d, 0xa7ecd42
or eax, r8d
imul eax, edx
add eax, ecx
sub eax, 0x187023c0
mov ecx, 0x3064daa
xor ecx, 0x675c2aa0
add eax, ecx
cmp eax, 0x8505a592
jb 0x14012c375
add rsp, 0x68
ret
iretd
wait
jp 0x14012c3aa
fldl2t
jne 0x14012c37b
invalid
invalid
xchg ebp, eax
push rax
adc dword [rax], eax
add byte [rax - 0x77], cl
lea ecx, [rax - 0x47fffff1]
adc byte [rax], al
add byte [rax], al
Function at 0x1401503d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.14014e89e
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.14014e8b9
test al, 1
jne 0x1401503fa
jmp 0x14015050a
mov rcx, qword [rsp + 0x28]
call fcn.14014f8f0
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
jne 0x14015050a
mov eax, dword [0x1401e0ec8]
add eax, dword [0x1401e0ecc]
mov r8d, 0xffffffff
xor r8d, 0x30b0ea12
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0xb055ec64
xor r8d, 0x80e50676
mov edx, eax
and edx, r8d
or eax, 0x30b0ea12
imul eax, edx
add eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x4442454c
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x4442454c
or eax, 0x4442454c
imul eax, edx
add eax, ecx
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0xa6c197a4
add eax, ecx
cmp eax, 0x4ad3e4dc
ja 0x14015050f
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401e0ed0]
sub eax, dword [0x1401e0ed4]
mov r8d, 0x583f1db8
xor edx, edx
div r8d
sub eax, 0xfe603eb4
imul eax, eax, 0x2557de3b
mov dword [rsp + 0x24], eax
mov eax, 0xf1969184
xor eax, 0xb058e30e
mov dword [rsp + 0x20], eax
movabs rdx, 0x30c290e5bc259713
movabs rax, 0x30c290e5bc25971b
xor rdx, rax
call fcn.14000de70
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
jb 0x1401504a0
jmp 0x14015050a
add rsp, 0x38
ret
loop 0x140150561
rol dword [rcx - 0x17], 0x88
invalid
mov ecx, dword [rsp + 0x28]
Function at 0x1401541f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x238
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x10], r8
mov qword [rbp + 0x40], rdx
mov eax, 0x10
mov qword [rbp + 0x18], rax
call fcn.1401d7280
sub rsp, rax
mov rax, qword [rbp + 0x18]
mov rcx, rsp
mov qword [rbp - 8], rcx
call fcn.1401d7280
sub rsp, rax
mov rax, rsp
mov qword [rbp], rax
mov eax, 0x20
call fcn.1401d7280
sub rsp, rax
mov rax, qword [rbp + 0x18]
mov rcx, rsp
mov qword [rbp + 8], rcx
call fcn.1401d7280
sub rsp, rax
mov rax, qword [rbp + 0x18]
mov rcx, rsp
mov qword [rbp + 0x10], rcx
Function at 0x140167460
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x1648
call fcn.1401d7280
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xa60], rdx
mov qword [rbp + 0xa68], rcx
Function at 0x140173200
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.140172c29
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.140172c44
test al, 1
jne 0x14017322d
jmp 0x140173260
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
call fcn.1400837c7
mov rax, qword [rsp + 0x30]
mov al, byte [rax]
mov cl, 0x8a
xor cl, 0x8a
cmp al, cl
jne 0x140173260
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov edx, 8
call fcn.14000de70
mov ecx, dword [0x1401e1ca0]
mov edx, dword [0x1401e1ca4]
mov eax, ecx
add eax, 1
xor ecx, 0xffffffff
or ecx, edx
add ecx, eax
mov edx, 0x68611208
xor edx, 0xcdce7b85
mov eax, ecx
xor eax, edx
mov edx, 0xffffffff
xor edx, 0xa5af698d
and ecx, edx
shl ecx, 1
sub ecx, eax
add ecx, 0x5c63e426
sub ecx, 0x30187cb3
sub ecx, 0x5c63e426
mov edx, 0x43ab9386
xor edx, 0xdf3a74c1
mov eax, ecx
or eax, edx
mov edx, 0x2a564f00
xor edx, 0xd5a9b0ff
xor eax, edx
or ecx, 0x9c91e747
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
cmp eax, 0x576878c0
je 0x140173324
mov eax, dword [0x1401e1ca8]
add eax, dword [0x1401e1cac]
mov ecx, 0xba0fa655
xor ecx, 0xba0fa655
mov edx, 0x252d86ef
xor edx, 0xae05943b
sub ecx, edx
add eax, ecx
or eax, 0x987f50e1
imul eax, eax, 0xdb0a58fe
cmp eax, 0xaf545f64
jae 0x1401732e3
add rsp, 0x38
ret
bnd jmp 0xf700cf6b
Function at 0x14018a410
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov ecx, dword [0x1401e2710]
and ecx, dword [0x1401e2714]
mov eax, 0x9106ca4f
xor eax, 0xa7617300
and ecx, eax
mov eax, ecx
and eax, 0x39ec67c1
shl eax, 1
mov edx, 0xa3864d3e
xor edx, 0x9a6a2aff
add ecx, edx
sub ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xa5a03c54
xor edx, 0xab99a48f
mov r8d, 0x3925f866
xor r8d, 0xc6da0799
xor edx, r8d
and eax, edx
mov edx, 0x924ddce5
xor edx, 0x9c74443e
or ecx, edx
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0x9313e569
xor ecx, 0x6cec1a96
xor eax, ecx
mov ecx, 0x8fff8d7a
xor ecx, 0xb4c2c41f
cmp eax, ecx
jae 0x14018a53c
mov eax, dword [0x1401e2718]
mov ecx, dword [0x1401e271c]
imul eax, ecx
mov ecx, eax
xor ecx, 0x82a2
xor eax, 0x1450
or ecx, 0x40411454
or eax, 0x9c2082a2
and eax, ecx
and eax, 0xdc6196f6
mov dword [rbp - 0xc], eax
mov eax, 0x10
call fcn.1401d7280
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
sub rsp, 0x20
call fcn.14018aab4
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov qword [rcx], 0
mov rdx, qword [rax + 0x10]
xor eax, eax
mov r8b, al
xor r8b, 0
and r8b, 1
sub rsp, 0x20
call fcn.140011b1f
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbp - 0xc]
add rsp, 0x20
mov rcx, qword [rcx]
mov qword [rbp - 8], rcx
cmp eax, 0x84b5d84
je 0x14018a49f
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
hlt
Function at 0x14018b2a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov rcx, qword [rcx]
call fcn.14018ab99
test al, 1
jne 0x14018b2c3
jmp 0x14018b2e7
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
movabs rdx, 0xe144a8e768611208
movabs rax, 0xe144a8e76861120c
xor rdx, rax
call fcn.14000de70
mov ecx, dword [0x1401e2770]
mov edx, dword [0x1401e2774]
mov eax, ecx
add eax, 1
xor ecx, 0xffffffff
or ecx, edx
add ecx, eax
mov eax, ecx
xor eax, 0xa5af698d
mov edx, 0x43ab9386
xor edx, 0xe604fa0b
mov r8d, 0x8a5a3855
xor r8d, 0x75a5c7aa
xor edx, r8d
and ecx, edx
shl ecx, 1
sub ecx, eax
add ecx, 0x5c63e426
mov eax, 0xd86fbb74
xor eax, 0xe877c7c7
sub ecx, eax
sub ecx, 0x5c63e426
mov eax, ecx
or eax, 0x9c91e747
mov edx, 0xd884f0c1
xor edx, 0x277b0f3e
xor eax, edx
or ecx, 0x9c91e747
mov edx, 0x573a1dea
xor edx, 0xa8c5e215
xor ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
cmp eax, 0x576878c0
je 0x14018b3ce
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov eax, dword [0x1401e2778]
add eax, dword [0x1401e277c]
mov r8d, 0xeb1a5fcc
xor r8d, 0xeb1a5fcc
mov r9d, 0x7cb1f520
xor r9d, 0xf799e7f4
sub r8d, r9d
add eax, r8d
or eax, 0x987f50e1
imul eax, eax, 0xdb0a58fe
mov qword [rcx], rdx
cmp eax, 0xaf545f64
jae 0x14018b37a
add rsp, 0x38
ret
bnd jmp 0xe4025015
Function at 0x14018b3e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401e2780]
xor edx, edx
div dword [0x1401e2784]
mov ecx, eax
or ecx, 0xed02f511
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xbe925c80
xor edx, 0xe407c5e4
mov r8d, 0x267ee45f
xor r8d, 0xd9811ba0
xor edx, r8d
and eax, edx
or ecx, 0x5a959964
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
mov ecx, eax
and ecx, 0x7f1193eb
mov edx, 0x51a6b067
xor edx, 0x51a6b065
imul ecx, edx
mov edx, 0xa1b41026
xor edx, 0xdea583cd
xor eax, edx
add eax, ecx
cmp eax, 0xb3ff323d
je 0x14018b563
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
mov r9d, dword [0x1401e2788]
mov r8d, dword [0x1401e278c]
xor r8d, 0xcf68d355
mov eax, r9d
and eax, r8d
xor r9d, r8d
mov r8d, eax
mov eax, r9d
lea eax, [rax + r8*2]
shr eax, 1
mov r8d, 0x87f70cbd
imul rax, r8
shr rax, 0x39
and eax, 0xffffffe6
imul eax, eax, 0xd7ba1e8a
mov dword [rbp - 0x3c], eax
mov eax, 0x10
call fcn.1401d7280
sub rsp, rax
mov eax, dword [rbp - 0x3c]
mov r8, rsp
mov qword [rbp - 0x38], r8
mov r8, rcx
add r8, 8
mov qword [rbp - 0x30], r8
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x28], rcx
mov r8, rdx
add r8, 8
mov qword [rbp - 0x20], r8
cmp rcx, qword [rdx + 8]
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0x83f29a6b
je 0x14018b468
mov rax, qword [rbp - 0x28]
mov cl, byte [rbp - 0x11]
test cl, 1
mov qword [rbp - 0x48], rax
jne 0x14018b545
jmp 0x14018b517
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.14018aad2
mov rax, qword [rbp - 0x20]
add rsp, 0x20
mov rax, qword [rax]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp - 8]
mov r8, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x48]
mov r8, qword [r8]
mov qword [rdx], r8
mov qword [rax], rcx
mov rsp, rbp
pop rbp
ret
jne 0x14018b58d
add al, 0xd0
jmp 0x14018b468
mov dl, 0x90
invalid