joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140170b20
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
call fcn.140178f36
mov rcx, qword [rsp + 0x30]
mov cl, byte [rcx + 8]
mov al, byte [rax + 0x60]
or al, cl
setne al
test al, 1
jne 0x140170cc4
mov eax, dword [0x1401d1758]
xor eax, 0xfed181e9
xor edx, edx
div dword [0x1401d175c]
add eax, 0xed5b8eb6
sub eax, 0x149e85cb
sub eax, 0xed5b8eb6
mov ecx, 0x820d934f
xor ecx, 0xcb63a985
xor edx, edx
div ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x88bf47de
mov edx, 0x482f9e36
xor edx, 0xc090d9e8
mov r8d, 0x6d9113cf
xor r8d, 0x926eec30
xor edx, r8d
and eax, edx
sub eax, ecx
mov ecx, 0x4a6edbd9
xor ecx, 0x1edf2a1e
cmp eax, ecx
jbe 0x140170d64
mov eax, dword [0x1401d1760]
xor edx, edx
div dword [0x1401d1764]
mov ecx, eax
mov eax, ecx
and eax, 0x8eaaad9
shl eax, 1
xor ecx, 0x8eaaad9
add ecx, eax
mov eax, 0xffffffff
xor eax, 0xf4505aaf
add ecx, eax
add ecx, 1
mov eax, ecx
or eax, 0x29b8b975
xor eax, 0xffffffff
mov edx, 0xe0880ee1
xor edx, 0x1f77f11e
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0x29b8b975
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov dword [rsp + 0x2c], eax
mov eax, 0x59eb0ab0
xor eax, 0x392a7642
mov dword [rsp + 0x28], eax
movabs rcx, 0x8d69184c255eee5b
movabs rax, 0x8d69184c255eee1b
xor rcx, rax
movabs rdx, 0xa73debe18ffcdb9a
movabs rax, 0xa73debe18ffcdb92
xor rdx, rax
call fcn.14001217d
mov rcx, rax
mov rax, qword [0x1401dd6f8]
mov qword [rcx], rax
lea rax, [0x1401dd080]
mov qword [rcx + 0x10], rax
mov rax, qword [0x1401dd0c8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1401dd0d0]
mov qword [rcx + 0x20], rax
mov qword [rcx + 8], 0
lea rdx, [0x1401dd080]
lea r8, [0x1401dd08d]
lea r9, [0x1401dd091]
mov qword [rsp + 0x20], 0x106bed02
call fcn.1400120ce
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
je 0x140170bb4
jmp 0x140170cc4
mov eax, dword [0x1401d1768]
mov edx, dword [0x1401d176c]
mov ecx, eax
xor ecx, 0xffffffff
and ecx, edx
xor edx, 0xffffffff
and eax, edx
sub eax, ecx
sub eax, 0x3cd42c9
sub eax, 0x158f72f5
and eax, 0xdc8fe5d7
mov ecx, 0xf27b3518
xor ecx, 0x309354b
cmp eax, ecx
je 0x140170d6d
mov eax, dword [0x1401d1770]
mov ecx, 0xa36d828d
xor ecx, 0x54e0d0f4
xor eax, ecx
and eax, dword [0x1401d1774]
mov ecx, eax
xor ecx, 0x91422744
mov edx, 0xda22c177
xor edx, 0x25dd3e88
xor ecx, edx
mov edx, 0xafd09b3c
xor edx, 0x3e92bc78
or eax, edx
and eax, ecx
or eax, 0xd23bf8d
mov ecx, 0x8e42b9cb
xor ecx, 0xa41a838f
sub eax, ecx
cmp eax, 0x738851e4
je 0x140170d00
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
xor dword [rbp + 0x47e986a2], ebx
invalid
not dword [rsi - 0x7516699d]
invalid
Function at 0x140170d80
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 8], rcx
mov eax, dword [0x1401d1778]
mov ecx, dword [0x1401d177c]
mov edx, 0xd1ce9ee7
xor edx, 0xfba6e10b
xor ecx, edx
add eax, ecx
mov ecx, 0xd39a52f
xor edx, edx
div ecx
mov ecx, 0xe2da3224
xor ecx, 0x431ee96
sub eax, ecx
add eax, 0x16237b88
add eax, 0xe6ebdcb2
or eax, 0x2245e878
mov ecx, 0x3c54c86b
xor ecx, 0x98c96e68
cmp eax, ecx
je 0x140170ea3
mov eax, dword [0x1401d1780]
mov edx, dword [0x1401d1784]
xor edx, 0xf6c3f313
mov ecx, eax
and ecx, edx
add ecx, ecx
add eax, edx
sub eax, ecx
mov ecx, 0x71c53ea7
sub ecx, eax
add eax, 0x8e3ac158
mov edx, eax
and edx, 0x3cee4635
and ecx, 0xc311b9ca
imul ecx, edx
mov edx, eax
and edx, 0xc311b9ca
or eax, 0xc311b9ca
imul eax, edx
add eax, ecx
mov edx, eax
not edx
or edx, 0x9c9b7a66
pushfq
mov ecx, eax
mov eax, edx
lea eax, [rax + rcx + 1]
mov dword [rbp - 0x14], eax
mov eax, 0x10
call fcn.1401c7680
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
sub rsp, 0x20
call fcn.140178f36
mov rcx, qword [rbp - 0x20]
add rsp, 0x20
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.140178f44
add rsp, 0x20
mov rcx, rax
mov eax, dword [rbp - 0x14]
mov qword [rbp - 0x10], rcx
cmp eax, 0x5538d0e6
jb 0x140170de1
mov rax, qword [rbp - 0x10]
mov rsp, rbp
pop rbp
ret
cwde
in al, dx
je 0x140170e35
jmp 0x140170de1
Function at 0x140171090
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rcx
call fcn.140178f36
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
add rax, 0x60
mov rax, qword [rdx]
mov qword [rsp + 0x68], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x68]
call fcn.140178f44
mov rcx, rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rcx
cmp byte [rax + 0x60], 0
jne 0x1401712ab
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
movabs rcx, 0x9696c464d9aca371
movabs rdx, 0x9696c464d9aca373
xor rcx, rdx
cqo
idiv rcx
mov r8, rax
mov rax, qword [rsp + 0x30]
mov rcx, r8
and rcx, 0xffffffffffffffff
movabs r9, 0x9ca9895c76bf9b8b
movabs rdx, 0x635676a389406474
xor r9, rdx
mov rdx, r8
or rdx, r9
add rcx, rdx
mov qword [rsp + 0x38], rcx
mov rdx, rcx
and rdx, r8
shl rdx, 1
add rcx, r8
sub rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 1
setg al
xor al, 0xff
xor cl, 0xff
mov dl, 1
xor dl, 1
or al, cl
mov cl, 1
xor cl, 0
or cl, dl
xor al, 0xff
and al, cl
test al, 1
jne 0x1401711a5
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
xor r8d, r8d
test rax, rax
cmovg r8, rax
call fcn.140099bd0
jmp 0x1401712ab
mov eax, dword [str.P_1]
mov r8d, dword [0x1401d179c]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
mov r9d, 0x47c980ed
xor r9d, 0xb8367f12
xor ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xdff25567
xor ecx, 0x3201263e
mov edx, 0xd1d3b6cd
xor edx, 0x2e2c4932
xor ecx, edx
add eax, ecx
add eax, 1
mov ecx, 0x4b0bc3ba
xor ecx, 0xebcc7923
mov edx, 0xc7e98825
xor edx, 0x381677da
xor ecx, edx
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
and eax, 0xd28f3ee3
mov ecx, 0x88bce1d8
xor ecx, 0xfbcc5b20
cmp eax, ecx
ja 0x1401712b5
mov eax, dword [0x1401d17a0]
mov ecx, 0xc5405de6
xor ecx, 0x7c97a5ae
xor eax, ecx
mov ecx, dword [0x1401d17a4]
xor ecx, 0xce24b361
xor eax, ecx
sub eax, 0x3ec0471d
xor eax, 0x86f77afc
mov ecx, 0x40367c0e
xor ecx, 0x40367c0e
sub ecx, eax
mov eax, 0xf9549ac0
xor eax, 0xf9549ac0
mov edx, 0x6a436060
xor edx, 0x7b5d07e4
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [rsp + 0x2c], eax
call fcn.140008024
mov eax, dword [rsp + 0x2c]
cmp eax, 0x5fffff7a
jb 0x140171239
jmp 0x1401712ab
mov rax, qword [rsp + 0x48]
add rsp, 0x78
ret
xchg esp, eax
mov eax, 0x7be9c320
invalid
Function at 0x140179880
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.1401790e3
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.140179100
test al, 1
jne 0x1401798aa
jmp 0x14017999b
mov rcx, qword [rsp + 0x28]
call fcn.1401796e0
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
jne 0x14017999b
mov ecx, dword [0x1401d1bf8]
mov edx, dword [0x1401d1bfc]
mov eax, ecx
xor eax, 0xffffffff
mov r8d, ecx
xor r8d, 0xffffffff
and eax, r8d
mov r8d, edx
xor r8d, 0xffffffff
mov r9d, edx
xor r9d, 0xffffffff
and r8d, r9d
mov r9d, 0xc6160980
xor r9d, 0x39e9f67f
xor eax, r9d
xor r8d, 0xffffffff
and eax, r8d
xor ecx, 0xffffffff
xor edx, 0xffffffff
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
imul eax, eax, 0xc3480ec
mov ecx, 0x73932dc4
xor ecx, 0x9f65dd31
add eax, ecx
xor eax, 0xfeeba330
cmp eax, 0x4fd7a49c
jb 0x1401799a0
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401d1c00]
mov edx, dword [0x1401d1c04]
mov r8d, 0x28f1776b
xor r8d, 0xac03918
xor edx, r8d
xor eax, edx
add eax, 0x81f5dc48
add eax, 0x8ac82fda
or eax, 0xf0f9d983
mov dword [rsp + 0x24], eax
mov eax, 0x6b81706c
xor eax, 0x9f1a9aa4
mov dword [rsp + 0x20], eax
mov edx, 8
call fcn.14000e6f9
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
je 0x140179938
jmp 0x14017999b
add rsp, 0x38
ret
cwde
outsb dx, byte [rsi]
clc
mov eax, 0xffff8fe9
dec dword [rdi]
invalid
Function at 0x14017d900
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rcx
call fcn.14017df91
mov rdx, qword [rsp + 0x40]
xor eax, eax
test rdx, rdx
cmovg rax, rdx
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov ecx, dword [0x1401d1e10]
mov edx, dword [0x1401d1e14]
mov eax, 0x3ccaf649
xor eax, 0x4db0fd6a
xor edx, eax
xor edx, 0xffffffff
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0xaa8ac98c
xor edx, edx
div ecx
imul eax, eax, 0x214c1de3
mov ecx, eax
xor ecx, 0xe8f39aec
xor ecx, 0xffffffff
mov edx, 0x50c07c56
xor edx, 0xb833e6ba
or eax, edx
and eax, ecx
cmp eax, 0x50efb185
ja 0x14017da4f
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401d1e18]
mov r8d, dword [0x1401d1e1c]
xor r8d, 0x85471177
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x48]
sub eax, 0x7627b895
mov r8d, 0xbffd594d
xor r8d, 0x5828d83c
sub eax, r8d
mov r8d, 0xd89905d8
xor r8d, 0x1fda6809
sub eax, r8d
add eax, 0xe7d58171
mov r8d, eax
xor r8d, 0xfca3b21
mov r9d, 0xf43a67c4
xor r9d, 0xbc5983b
xor r8d, r9d
and r8d, 0xfca3b21
shl r8d, 1
sub r8d, 0xfca3b21
sub eax, r8d
cmp rcx, rdx
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0xc379a730
jbe 0x14017d98c
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x14017da4a
jmp 0x14017da2e
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov byte [rcx + rax], 0
add rax, 1
mov qword [rsp + 0x50], rax
jmp 0x14017d92d
add rsp, 0x58
ret
sub r15b, byte [r15 + r15*8]
jmp 0x14017d98c
Function at 0x14017fc3e
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401ccab0]
xor eax, 0x3425d6fa
mov ecx, dword [0x1401ccab4]
xor ecx, 0xc72ca195
or eax, ecx
mov ecx, 0xef7caa0c
xor ecx, 0x483b4a47
xor edx, edx
div ecx
mov ecx, 0xf7d4e10f
xor ecx, 0xffea3ef2
and eax, ecx
xor eax, 0xffffffff
mov edx, 0x6f72a62c
xor edx, 0x4032001c
mov ecx, 0x3598172f
xor ecx, 0xca67e8d0
xor edx, ecx
mov ecx, 0xffffffff
xor ecx, 0xe90348ac
or eax, edx
or ecx, 0xe90348ac
mov edx, 0xf6147f7d
xor edx, 0x9eb8082
xor eax, edx
and eax, ecx
cmp eax, 0x1cae7263
je 0x1400a5ea5
mov eax, dword [0x1401ccab8]
mov ecx, dword [0x1401ccabc]
xor ecx, 0xf39f2e72
xor edx, edx
div ecx
mov ecx, 0xa01a977c
xor ecx, 0x18e19e54
add eax, ecx
imul eax, eax, 0x3a18b299
mov ecx, 0x5a2d84e6
xor ecx, 0x5fbaf69d
imul eax, ecx
mov dword [rsp + 0x2c], eax
call fcn.1400a5b2a
mov rcx, qword [rsp + 0x30]
call qword [0x1401ed230]
mov eax, dword [rsp + 0x2c]
cmp eax, 0xef983121
ja 0x1400a5e46
add rsp, 0x38
ret
and edx, dword [rdi]
pushfq
invalid
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
call fcn.14017ed44
mov rcx, qword [rsp + 0x20]
add rsp, 0x28
jmp 0x1400a5dc0
Function at 0x140184ea0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x3c0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1d8], rcx
mov eax, 0x10
mov qword [rbp + 0x1b8], rax
call fcn.1401c7680
sub rsp, rax
mov rax, qword [rbp + 0x1b8]
mov rcx, rsp
mov qword [rbp + 0x168], rcx
call fcn.1401c7680
sub rsp, rax
mov rax, qword [rbp + 0x1b8]
mov rcx, rsp
mov qword [rbp + 0x170], rcx

Function at 0x140187500
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x57], al
je 0x1401876c8
mov rax, qword [rsp + 0x48]
mov rcx, 0xffffffffffffffff
xor rcx, 0xfffffffffffffff0
xor edx, edx
sub rdx, 1
sub rcx, rdx
sub rax, rcx
mov qword [rsp + 0x38], rax
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
mov al, 1
cmp rcx, 0x10
mov byte [rsp + 0x57], al
jb 0x1401876c8
mov r8, qword [rsp + 0x40]
mov rax, r8
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x30], rax
mov rcx, rax
or rcx, rcx
movabs rdx, 0x286770574ea06b47
movabs r9, 0xd7988fa8b15f94b8
xor rdx, r9
xor rcx, rdx
mov rdx, r8
xor rdx, 0xffffffffffffffff
mov r9, r8
xor r9, 0xffffffffffffffff
and rdx, r9
or rcx, rdx
xor rcx, 0xffffffffffffffff
mov rdx, rax
or rdx, r8
xor rdx, 0xffffffffffffffff
xor rcx, 0xffffffffffffffff
movabs r8, 0x1067a5a2f1fa69f1
movabs r9, 0xef985a5d0e05960e
xor r8, r9
xor rdx, r8
and rcx, rdx
cmp rcx, 0
setl cl
movabs rdx, 0xa7301048a6628d4c
movabs r8, 0x58cfefb7599d72b3
xor rdx, r8
cmp rax, rdx
setg al
and al, cl
test al, 1
jne 0x1401875f9
jmp 0x1401876b5
mov eax, dword [0x1401d22a8]
xor eax, 0x1af14025
mov ecx, dword [0x1401d22ac]
xor ecx, 0xdfbccdad
imul eax, ecx
add eax, 0xe7c799ff
or eax, 0xca32d30f
mov edx, 0xd64615fb
xor edx, 0x5b874b
mov ecx, eax
xor ecx, edx
mov edx, 0x8f2badf
xor edx, 0xf70d4520
xor ecx, edx
or eax, 0xd61d92b0
and eax, ecx
cmp eax, 0xf5728764
jae 0x1401876d6
mov eax, dword [0x1401d22b0]
or eax, dword [0x1401d22b4]
mov ecx, 0x4bc3e375
xor ecx, 0x891ec7ce
imul eax, ecx
mov ecx, 0x3046e9fa
xor ecx, 0x9b38ff47
xor edx, edx
div ecx
mov ecx, 0x8d572329
xor ecx, 0x4f57d6d0
xor edx, edx
div ecx
mov dword [rsp + 0x2c], eax
mov eax, 0xb0b603fc
xor eax, 0xec436c9e
mov dword [rsp + 0x28], eax
call fcn.140008024
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
jae 0x14018764b
xor eax, eax
mov byte [rsp + 0x57], al
jmp 0x1401876c8
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x57], al
mov al, byte [rsp + 0x57]
and al, 1
movzx eax, al
add rsp, 0x58
ret
movabs eax, dword [0xffffff6ce9b23261]
Function at 0x140187d30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
call fcn.1401873c0
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx]
call fcn.140187500
test al, 1
jne 0x140187d62
jmp 0x140187e4a
mov ecx, dword [0x1401d22e8]
mov edx, dword [0x1401d22ec]
xor eax, eax
sub eax, edx
sub ecx, eax
mov edx, 0x32a9d7e1
xor edx, 0x6e06e736
mov eax, ecx
or eax, edx
mov edx, 0x5b8d5a66
xor edx, 0xa472a599
xor eax, edx
mov edx, 0xbd5391ab
xor edx, 0x42ac6e54
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0x5caf30d7
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
and eax, 0xbbd3c788
xor eax, 0x185eb48c
cmp eax, 0x68aa0520
je 0x140187f1b
mov eax, dword [0x1401d22f0]
mov ecx, dword [0x1401d22f4]
mov edx, 0x245dd3a8
xor edx, 0xacd70ff8
xor ecx, edx
xor edx, edx
div ecx
imul eax, eax, 0xab98b633
mov ecx, 0x48ade48
xor edx, edx
div ecx
mov ecx, eax
mov rax, qword [rsp + 0x38]
xor ecx, 0x67cb571e
mov dword [rsp + 0x28], ecx
mov rcx, qword [rax]
call fcn.1401879b0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x28]
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x69230491
jae 0x140187dc4
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x140187e38
jmp 0x140187f16
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
mov edx, 8
call fcn.14000e6f9
mov eax, dword [0x1401d22f8]
xor edx, edx
div dword [0x1401d22fc]
mov ecx, 0x4a7088c
xor ecx, 0x70a12f9d
add eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x7dcf411
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x7dcf411
or eax, 0x7dcf411
imul eax, edx
add eax, ecx
mov ecx, 0x41edb429
xor ecx, 0xf4643d02
imul eax, ecx
cmp eax, 0xfa251027
jae 0x140187f24
mov r8, qword [rsp + 0x30]
mov eax, dword [0x1401d2300]
imul eax, dword [0x1401d2304]
mov ecx, 0xf5556e85
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x38]
mov ecx, eax
xor ecx, 0xcbfc1dc8
mov r9d, 0x82c14fc6
xor r9d, 0x7d3eb039
xor ecx, r9d
and ecx, 0xcbfc1dc8
shl ecx, 1
sub ecx, 0xcbfc1dc8
sub eax, ecx
and eax, 0x88000cf3
mov ecx, 0x6d240db
xor ecx, 0xc5e02770
mov qword [rdx], r8
cmp eax, ecx
ja 0x140187ead
jmp 0x140187f16
add rsp, 0x48
ret
xlatb
fchs
jmp 0x140187dc4
mov word [rdi + 0x15], es
jmp 0x140187ead
Function at 0x140188290
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.1401873c0
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.140187500
test al, 1
jne 0x1401882ba
jmp 0x1401883d5
mov rcx, qword [rsp + 0x28]
call fcn.140187770
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
jne 0x1401883d5
mov ecx, dword [0x1401d2318]
mov eax, dword [0x1401d231c]
xor eax, 0x750d224
imul ecx, eax
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x5da8c70a
or ecx, 0x5da8c70a
mov edx, 0x99e05934
xor edx, 0x661fa6cb
xor ecx, edx
xor eax, 0xffffffff
mov edx, 0x51f169a6
xor edx, 0xae0e9659
xor ecx, edx
and eax, ecx
mov ecx, 0x4ca4a07c
xor ecx, 0xeb532130
add eax, ecx
xor eax, 0xffffffff
mov edx, 0xcb0973d8
xor edx, 0x9e59907e
mov ecx, 0xe707aaac
xor ecx, 0x18f85553
xor edx, ecx
mov ecx, 0xffffffff
xor ecx, 0xb25a28ec
or eax, edx
or ecx, 0xb25a28ec
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0xc877fce4
je 0x140188481
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401d2320]
add eax, dword [0x1401d2324]
mov edx, eax
add edx, 1
xor eax, 0xffffffff
or eax, 0xeccf08c8
add eax, edx
add eax, 0x45773145
sub eax, 0x5a2f8a28
sub eax, 0x45773145
mov edx, 0xecdf2492
xor edx, 0x486dc23b
xor eax, edx
mov dword [rsp + 0x24], eax
movabs rdx, 0xb019fa36fd20895b
movabs rax, 0xb019fa36fd208953
xor rdx, rax
call fcn.14000e6f9
mov eax, dword [rsp + 0x24]
cmp eax, 0xbbbb6b34
ja 0x140188481
jmp 0x1401883d5
mov ecx, dword [0x1401d2328]
mov eax, dword [0x1401d232c]
and ecx, ecx
xor ecx, 0xffffffff
and eax, eax
xor eax, 0xffffffff
and ecx, eax
mov eax, 0x7f64ef33
xor eax, 0x809b10cc
xor ecx, eax
and ecx, 0xf6075d60
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0xe6a9461e
or ecx, 0xe6a9461e
mov edx, 0x24570b29
xor edx, 0xdba8f4d6
xor ecx, edx
or eax, ecx
mov ecx, 0x33b15883
xor ecx, 0xcc4ea77c
xor eax, ecx
mov ecx, 0xdba2445d
xor edx, edx
div ecx
cmp eax, 0xcd4662ce
jae 0x14018848a
mov eax, dword [0x1401d2330]
add eax, dword [0x1401d2334]
or eax, 0x4bbafccf
add eax, 0x9545431a
add eax, 0x5a954d54
sub eax, 0x9545431a
or eax, 0xdebe0ed0
mov ecx, 0x26e090e8
xor ecx, 0x93a98c21
cmp eax, ecx
jbe 0x140188444
add rsp, 0x38
ret
or byte [rsi - 0x2416d3a3], al
invalid
invalid
Function at 0x1401a01b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov eax, dword [0x1401d2c90]
imul eax, dword [0x1401d2c94]
mov ecx, 0xfc9dc57e
xor ecx, 0xf069e645
and eax, ecx
mov ecx, 0xeac1f63f
xor edx, edx
div ecx
mov ecx, 0x8d34a469
xor edx, edx
div ecx
cmp eax, 0xe86d4a61
jae 0x1401a0330
mov eax, dword [0x1401d2c98]
mov ecx, dword [0x1401d2c9c]
mov edx, 0x130211ae
xor edx, 0x7ed53d9b
xor ecx, edx
imul eax, ecx
mov r8d, 0x22075f19
xor r8d, 0x2ff08d80
mov ecx, 0x753e68e
xor ecx, 0xf8ac1971
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x186d6c9a
xor r8d, 0xe7929365
xor ecx, r8d
imul ecx, edx
mov r8d, 0xb833f352
xor r8d, 0xb5c421cb
mov edx, eax
and edx, r8d
mov r8d, 0xb9c9b2a2
xor r8d, 0xb43e603b
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xfecd17d6
xor ecx, 0x3ffd75c5
xor edx, edx
div ecx
mov ecx, 0x75f0a172
xor edx, edx
div ecx
mov dword [rsp + 0x3c], eax
mov eax, 0xe5900b4b
xor eax, 0xffd06da9
mov dword [rsp + 0x38], eax
call fcn.1401a7c51
mov r8, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x3c]
xor edx, edx
test r8, r8
cmovg rdx, r8
mov qword [rsp + 0x40], rdx
cmp eax, ecx
ja 0x1401a01f5
xor eax, eax
mov qword [rsp + 0x30], rax
jmp 0x1401a02ce
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp rax, rcx
je 0x1401a032b
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov dl, 0x85
xor dl, 0x85
mov byte [rcx + rax], dl
mov rcx, rax
and rcx, 1
movabs rdx, 0xecc3f943ca399931
movabs r8, 0xecc3f943ca399933
xor rdx, r8
imul rcx, rdx
xor rax, 1
add rax, rcx
mov qword [rsp + 0x30], rax
jmp 0x1401a02ce
add rsp, 0x58
ret
invalid
Function at 0x1401ae960
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x418
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x148], r8
mov qword [rbp + 0x150], rdx
mov qword [rbp + 0x158], rcx
Function at 0x1401b86a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x1c8
Function at 0x1401bf2a0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, qword gs:[0x60]
movzx rax, byte [rax + 2]
ret
Function at 0x1401c50aa
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x38
call fcn.140153418
mov qword [rsp + 0x28], rax
movabs rcx, 0x8d20d8bc102bbdc3
movabs rax, 0x8d20d8bc102bbde3
xor rcx, rax
call fcn.1400480be
mov rcx, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rcx
cmp byte [rax + 0x60], 0
jne 0x14015327d
mov rax, qword [rsp + 0x30]
mov qword [0x14024ed08], rax
mov eax, dword [0x1401d0a00]
mov r8d, dword [0x1401d0a04]
xor r8d, 0xdf3cc9cf
mov edx, 0xf4bb82c0
xor edx, 0xb447d3f
mov ecx, eax
xor ecx, edx
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x882c1b30
mov r8d, 0xffffffff
xor r8d, 0x882c1b30
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0xb2d95d97
xor r8d, 0x3af546a7
mov edx, eax
and edx, r8d
or eax, 0x882c1b30
imul eax, edx
add eax, ecx
and eax, 0x4d898c3d
sub eax, 0x9104da31
add eax, 0xbe945b5
add eax, 0x9104da31
mov ecx, 0x3ccc27dc
xor ecx, 0xb2f23432
cmp eax, ecx
je 0x14015340f
mov r11d, dword [0x1401d0a08]
mov r10d, dword [0x1401d0a0c]
xor r10d, 0xaec2ac3
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, r10d
xor r8d, 0xffffffff
mov edx, 0xc0a568bc
xor edx, 0x24a351d1
mov eax, 0xf4a5319d
xor eax, 0xb5ace62
xor edx, eax
mov eax, ecx
and eax, 0xe406396d
and r11d, edx
mov r9d, r8d
and r9d, 0xe406396d
and r10d, edx
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
xor ecx, 0xffffffff
or edx, 0xe406396d
and ecx, edx
or eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x13a77c76
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0xa6a7188f
xor r8d, 0xb50064f9
mov edx, eax
and edx, r8d
mov r8d, 0xd3c1d561
xor r8d, 0xc066a917
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xb786183c
xor ecx, 0x809e07ae
xor edx, edx
div ecx
add eax, 0x1d0fa8bb
sub eax, 0xcae38d7a
mov ecx, 0x606f9343
xor ecx, 0x7d603bf8
sub eax, ecx
mov ecx, 0x5be97189
xor ecx, 0xb82e61ba
cmp eax, ecx
je 0x14015340f
add rsp, 0x38
ret
movabs al, byte [0xffffff0ce9cf26ff]
sub rsp, 0x28
call fcn.14005e1a0
call fcn.14005f54e
call fcn.14005fdd0
call fcn.140064c9c
call fcn.140094430
call fcn.14009c092
call fcn.1400c341e
call fcn.1400fca85
call fcn.1401055b4
call fcn.1401172b7
call fcn.140118390
call fcn.1401423c4
nop
add rsp, 0x28
jmp 0x140153230
sub rsp, 0x28
call fcn.140003525
call fcn.1400037ac
call fcn.140004d13
call fcn.14002f658
mov rax, qword [sym.imp.KERNEL32.dll_TlsAlloc]
call rax
mov ecx, eax
mov rax, qword [0x1401ddaf0]
mov dword [rax], ecx
mov rdx, qword [0x1401ddb00]
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
call fcn.14002f653
call fcn.140096d10
call fcn.140096dc0
call fcn.1401172e0
call fcn.1401bf670
call fcn.1401c0f7d
nop
add rsp, 0x28
jmp 0x1401c5060