joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ea990
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], rcx
mov ecx, dword [0x14021d0d0]
mov edx, dword [0x14021d0d4]
mov eax, ecx
and eax, edx
or ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, 0x931ac209
add eax, ecx
mov ecx, 0x6bf85950
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
and eax, edx
mov edx, 0xffffffff
xor edx, 0x81db4f64
mov r8d, 0xffffffff
xor r8d, 0x81db4f64
and edx, r8d
xor eax, 0xffffffff
xor edx, 0xffffffff
and eax, edx
or ecx, 0x81db4f64
xor ecx, 0xffffffff
mov edx, 0x8d5d7780
xor edx, 0x72a2887f
xor eax, edx
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x5e5272e7
xor ecx, 0xc2af7d80
cmp eax, ecx
ja 0x1400eabc4
mov ecx, dword [0x14021d0d8]
xor ecx, 0x9417405c
mov eax, dword [0x14021d0dc]
sub ecx, eax
mov edx, ecx
not edx
mov eax, ecx
and eax, 0xe399f67a
and edx, 0x1c660985
imul edx, eax
mov eax, ecx
and eax, 0x1c660985
or ecx, 0x1c660985
imul ecx, eax
mov eax, ecx
mov ecx, edx
lea eax, [rax + rcx - 0x63d92ad0]
mov dword [rbp - 0x10], eax
mov eax, 0x10
call fcn.140215890
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x38], rax
sub rsp, 0x20
call fcn.1400e8ab0
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x28], rax
mov dword [rdx], 0
sub rsp, 0x60
mov rax, rsp
mov qword [rbp - 0x20], rax
mov qword [rax + 0x40], rdx
mov qword [rax + 0x58], 0
mov qword [rax + 0x50], 0
mov qword [rax + 0x48], 0
mov qword [rax + 0x38], 0
mov qword [rax + 0x30], 0
mov qword [rax + 0x28], 0
mov qword [rax + 0x20], 0
xor eax, eax
mov r9d, eax
mov rdx, r9
mov r8, r9
call fcn.1400b0d7e
mov rcx, qword [rbp - 0x18]
add rsp, 0x60
mov edx, eax
mov eax, dword [rbp - 0x10]
mov cl, byte [rcx]
test cl, cl
setne cl
test edx, edx
sete dl
or cl, dl
mov byte [rbp - 9], cl
cmp eax, 0x67caf885
jbe 0x1400eaa24
mov al, byte [rbp - 9]
test al, 1
jne 0x1400eabb9
jmp 0x1400eab35
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 8]
xor edx, edx
mov r9d, edx
sub rsp, 0x60
mov rdx, r9
mov r8, r9
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
call fcn.1400b0d7e
add rsp, 0x60
mov rax, qword [rbp - 0x28]
mov al, byte [rax]
mov cl, 0x5c
xor cl, 0x5c
cmp al, cl
jne 0x1400eabb9
sub rsp, 0x20
call fcn.1400ea7d5
add rsp, 0x20
mov rax, qword [rbp - 0x38]
mov eax, dword [rax]
mov rsp, rbp
pop rbp
ret
call 0x129f0241d
push rdi
invalid
Function at 0x1400eebc0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x28], rcx
call fcn.1400ee855
mov rcx, qword [rsp + 0x28]
mov al, byte [rcx + 0x10]
mov byte [rsp + 0x37], al
sub al, 4
jb 0x1400eec49
jmp 0x1400eebe7
mov al, byte [rsp + 0x37]
sub al, 4
je 0x1400eebfd
jmp 0x1400eebf8
jmp 0x1400eec23
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x48], rcx
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
call fcn.1400ee870
jmp 0x1400eec49
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x38], rcx
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
call fcn.1400ee4e0
jmp 0x1400eec49
mov eax, dword [0x14021d2e0]
xor eax, 0xda4f2a0e
mov ecx, dword [0x14021d2e4]
mov edx, 0xdbfca1a7
xor edx, 0x43921d9f
xor ecx, edx
xor eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xa9e329f3
mov r8d, 0xffffffff
xor r8d, 0xa9e329f3
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xa9e329f3
or eax, 0xa9e329f3
imul eax, edx
add eax, ecx
mov ecx, 0xda964e86
xor ecx, 0x453b6f46
imul eax, ecx
or eax, 0x63995209
mov ecx, 0xf3070c11
xor ecx, 0xd1aca7fd
cmp eax, ecx
je 0x1400eed0a
mov eax, dword [0x14021d2e8]
xor eax, 0x3812aaf8
xor edx, edx
div dword [0x14021d2ec]
add eax, 0x80c52d9f
mov ecx, eax
and ecx, 0x1d12d165
shl ecx, 1
xor eax, 0x1d12d165
add eax, ecx
mov ecx, 0x232b63e0
xor ecx, 0xe77cbd7c
xor edx, edx
div ecx
cmp eax, 0x30e662c4
jae 0x1400eecc1
add rsp, 0x58
ret
invalid
Function at 0x1400ef080
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
call fcn.1400ee855
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
mov rax, rcx
add rax, 0x10
mov qword [rsp + 0x58], rax
movzx eax, byte [rcx + 0x10]
mov qword [rsp + 0x60], rax
sub rax, 5
ja 0x1400ef1a8
mov rax, qword [rsp + 0x60]
lea rcx, [0x1400ef2cc]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov rax, qword [rsp + 0x48]
mov byte [rax + 0x18], 0
jmp case.0x1400ef0dd.0
mov rax, qword [rsp + 0x48]
mov rcx, rax
add rcx, 0x18
mov qword [rsp + 0x38], rcx
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x78], rcx
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x78]
call fcn.1400ee870
mov rax, qword [rsp + 0x50]
mov al, byte [rax]
mov cl, 0x55
xor cl, 0x55
cmp al, cl
jne case.0x1400ef265.0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
mov qword [rcx], 0
mov qword [rax + 0x20], 0
jmp case.0x1400ef0dd.0
mov rax, qword [rsp + 0x48]
mov rcx, rax
add rcx, 0x18
mov qword [rsp + 0x30], rcx
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x68], rcx
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x68]
call fcn.1400ee4e0
mov rax, qword [rsp + 0x50]
cmp byte [rax], 0
jne case.0x1400ef265.0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov qword [rcx], 0
mov qword [rax + 0x20], 0
jmp case.0x1400ef0dd.0
mov eax, dword [0x14021d310]
mov ecx, dword [0x14021d314]
xor ecx, 0xdfd27c19
xor edx, edx
div ecx
mov ecx, 0x9d9df9d6
xor edx, edx
div ecx
mov ecx, 0xd32c2a96
xor ecx, 0x8b56af0d
xor edx, edx
div ecx
mov ecx, 0x6664366c
xor ecx, 0xb50ef597
or eax, ecx
mov ecx, 0x4e8020dd
xor ecx, 0x9e5ed900
cmp eax, ecx
je 0x1400ef2c2
mov eax, dword [0x14021d318]
mov ecx, dword [0x14021d31c]
xor ecx, 0x2540fe04
or eax, ecx
mov ecx, 0x8169bacb
xor ecx, 0xd9733060
imul eax, ecx
mov ecx, 0x233862d9
xor edx, edx
div ecx
mov ecx, 0x5d971f6e
xor ecx, 0x6d5266f7
imul eax, ecx
cmp eax, 0xe23e2ec2
je 0x1400ef1f6
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
mov byte [rax], 0
movzx ecx, byte [rcx + 0x10]
mov qword [rsp + 0x28], rcx
sub byte [rax + 0x448b4808], cl
and al, 0x28
sub byte [rax + 0x448b4808], cl
and al, 0x28
lea rcx, [0x1400ef2e4]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
invalid
jmp rax
enter 0xffffffffffffe0ff, 0x48
mov eax, dword [rsp + 0x48]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov cl, byte [rcx + 0x18]
mov byte [rax + 0x18], cl
jmp case.0x1400ef265.0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
and al, 0x40
and al, 0x40
mov rdx, qword [rcx + 0x18]
mov qword [rax + 0x18], rdx
mov rcx, qword [rcx + 0x20]
mov qword [rax + 0x20], rcx
jmp case.0x1400ef265.0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
and al, 0x40
and al, 0x40
mov rdx, qword [rcx + 0x18]
mov qword [rax + 0x18], rdx
mov rcx, qword [rcx + 0x20]
mov qword [rax + 0x20], rcx
jmp case.0x1400ef265.0
add rsp, 0x88
ret
push rbp
invalid
Function at 0x140104a50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov eax, dword [0x14021dbb0]
mov ecx, 0x40401f78
xor ecx, 0xb763193f
xor eax, ecx
mov ecx, dword [0x14021dbb4]
mov edx, 0x4faa7242
xor edx, 0x8b79dc7e
xor ecx, edx
and eax, ecx
xor ecx, ecx
sub ecx, 0x30dcecb4
add eax, ecx
mov ecx, eax
xor ecx, 0x200e59ec
xor ecx, 0xffffffff
mov edx, 0x5b1fbbaf
xor edx, 0x7b11e243
or eax, edx
and eax, ecx
mov ecx, 0xa6c07011
xor ecx, 0x2abfbcff
sub eax, ecx
cmp eax, 0x9e04ea08
ja 0x140104b22
mov eax, dword [0x14021dbb8]
xor edx, edx
div dword [0x14021dbbc]
xor eax, 0x8c1020c4
mov ecx, 0x51d2da
xor ecx, 0x32197a6f
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
and eax, 0xcdf84c28
xor ecx, 0xcdf84c28
or eax, ecx
mov dword [rsp + 0x2c], eax
mov rax, qword [0x14022dd30]
mov ecx, dword [rax]
call fcn.140008650
mov rcx, rax
mov eax, dword [rsp + 0x2c]
add rcx, 0x50
mov qword [rsp + 0x30], rcx
cmp eax, 0x2f03a9c9
jb 0x140104ab8
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
rol byte [rdi], 1
pushfq
add ch, cl
invalid
Function at 0x140106310
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x14021dcb0]
mov ecx, dword [0x14021dcb4]
xor ecx, 0x5d235385
and eax, ecx
mov ecx, 0x51f18cc0
xor ecx, 0xdd8e402e
sub eax, ecx
mov ecx, 0x62a06673
xor edx, edx
div ecx
mov ecx, eax
add ecx, 1
mov edx, 0x7574512c
xor edx, 0x8a8baed3
xor eax, edx
or eax, 0xfb392cef
add eax, ecx
mov ecx, 0x71ec4fd
xor ecx, 0xd4d821ab
cmp eax, ecx
ja 0x140106505
mov eax, dword [0x14021dcb8]
xor eax, 0x1a4abace
mov ecx, dword [0x14021dcbc]
xor ecx, 0xc5a0cf73
xor edx, edx
div ecx
or eax, 0xcdf84c28
mov ecx, 0xc6ebdf04
xor edx, edx
div ecx
mov ecx, eax
and ecx, 0x1a9f5608
shl ecx, 1
xor eax, 0x1a9f5608
add eax, ecx
mov dword [rsp + 0x30], eax
call fcn.1401060a1
mov rcx, rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax]
call fcn.1401060c0
mov cl, al
mov eax, dword [rsp + 0x30]
mov byte [rsp + 0x37], cl
cmp eax, 0xa2198d8c
ja 0x140106374
mov al, byte [rsp + 0x37]
test al, 1
jne 0x1401063f3
jmp 0x1401064f3
mov ecx, dword [0x14021dcc0]
mov edx, dword [0x14021dcc4]
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
xor ecx, ecx
sub ecx, 0xc636e130
add eax, ecx
or eax, 0x1e0c23e1
mov ecx, 0xd8e6a3dd
xor edx, edx
div ecx
mov ecx, 0x7b436632
xor ecx, 0x6c0474ca
cmp eax, ecx
je 0x14010650e
mov rax, qword [rsp + 0x40]
mov ecx, dword [0x14021dcc8]
xor ecx, dword [0x14021dccc]
add ecx, 0xbdfe00f6
mov r8d, 0x8e550703
xor r8d, 0x71aaf8fc
mov edx, ecx
xor edx, r8d
mov r8d, 0x415ae548
xor r8d, 0xb6400a3c
and r8d, edx
mov r9d, 0xffffffff
xor r9d, 0xf71aef74
mov edx, ecx
and edx, r9d
imul edx, r8d
mov r9d, 0xcc46e0b6
xor r9d, 0x3b5c0fc2
mov r8d, ecx
and r8d, r9d
or ecx, 0xf71aef74
imul ecx, r8d
add ecx, edx
xor ecx, 0xe3065112
mov dword [rsp + 0x20], ecx
mov rcx, qword [rax]
call fcn.140105da0
mov rcx, qword [rsp + 0x28]
mov eax, dword [rsp + 0x20]
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x27], cl
cmp eax, 0x1a617763
jb 0x140106432
mov al, byte [rsp + 0x27]
test al, 1
jne 0x1401064e1
jmp 0x140106500
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
mov edx, 8
call fcn.14001096f
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov qword [rax], rcx
add rsp, 0x48
ret
push r15
xchg ecx, eax
cmp ch, cl
invalid
fcom qword [rbx]
call fcn.1400f80ff
jmp qword [rsi + 0xf]
Function at 0x14011f200
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rcx
mov rax, qword [rdx]
mov qword [rsp + 0x60], rax
movabs rcx, 0x23b5650b04383f52
movabs rdx, 0x23b5650b04383f52
xor rcx, rdx
cmp rax, rcx
jle 0x14011f4bc
mov rcx, qword [rsp + 0x60]
mov rax, rcx
add rax, 1
mov qword [rsp + 0x48], rax
movabs rdx, 0xf3ae7cfd993c2deb
movabs r8, 0xc51830266c3d214
xor rdx, r8
xor rcx, rdx
and rax, rcx
cmp rax, 0
jge 0x14011f278
call fcn.140008bc6
jmp 0x14011f4bc
mov rax, qword [rsp + 0x48]
movabs rcx, 0x69a2f0d7d90b7e22
movabs rdx, 0x69a2f0d7d90b7e22
xor rcx, rdx
cmp rax, rcx
jge 0x14011f2ba
mov rcx, qword [rsp + 0x48]
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
call fcn.14000e6db
jmp 0x14011f4bc
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdx + 8]
add rcx, 8
add rcx, qword [rdx]
mov qword [rsp + 0x30], rcx
mov rax, qword [rax + 8]
add rax, 8
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
cmp rax, rcx
je 0x14011f35c
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov dl, byte [rdx + rax]
mov byte [rcx + rax], dl
movabs rcx, 0x22d724b8279db92d
movabs rdx, 0x22d724b8279db92c
xor rcx, rdx
movabs rdx, 0xa39fab51a5e6365e
movabs r8, 0x5c6054ae5a19c9a1
xor rdx, r8
xor rcx, rdx
xor edx, edx
sub rdx, 1
sub rcx, rdx
sub rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x14011f2e8
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov r8, qword [rcx]
mov rax, qword [rax]
movabs rcx, 0x4dae42f0abd5714d
movabs rdx, 0x4dae42f0abd5714d
xor rcx, rdx
sub rcx, r8
mov rdx, rax
sub rdx, rcx
mov qword [rsp + 0x20], rdx
mov rcx, rdx
xor rcx, r8
xor rdx, rax
mov rax, rcx
and rax, rdx
xor rax, 0xffffffffffffffff
xor rcx, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
or rcx, rdx
and rax, rcx
movabs rcx, 0xb1dee25f60079a44
movabs rdx, 0x4e211da09ff865bb
xor rcx, rdx
xor rax, rcx
cmp rax, 0
jge 0x14011f3e0
call fcn.140008bc6
jmp 0x14011f4bc
mov eax, dword [0x14021e518]
xor eax, dword [0x14021e51c]
sub eax, 0x88b50a63
mov ecx, 0x2387d681
xor edx, edx
div ecx
mov ecx, 0xffffffff
xor ecx, 0x1e476347
add eax, ecx
add eax, 1
cmp eax, 0x833c6cb2
jb 0x14011f4c1
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x20]
mov eax, dword [0x14021e520]
mov r9d, dword [0x14021e524]
mov r8d, 0xc795bf3f
xor r8d, 0x605c1dbb
xor r9d, r8d
mov r8d, 0x72e109e
xor r8d, 0x72e109e
sub r8d, r9d
add eax, r8d
mov r9d, eax
xor r9d, 0x891c874b
xor r9d, 0xffffffff
and r9d, 0x891c874b
mov r8d, 0x4b7145b8
xor r8d, 0x4b7145ba
imul r8d, r9d
sub r8d, 0x891c874b
sub eax, r8d
mov r8d, 0x2b26a4e3
xor r8d, 0x10b836e
xor eax, r8d
add eax, 0xe3066f85
sub eax, 0xcc27a3c2
mov r8d, 0x32c6c9de
xor r8d, 0xd1c0a65b
sub eax, r8d
mov qword [rcx], rdx
cmp eax, 0x77d12e8f
je 0x14011f4c1
jmp 0x14011f4bc
add rsp, 0x68
ret
jbe 0x14011f4c1
or byte [0x1401140b2], ch
dec dword [rax - 0x75]
mov rax, qword [0x14022dd30]

Function at 0x14011f4ca
Capabilities:
Get thread local storage value

Disassembly:
mov rax, qword [0x14022dd30]
mov ecx, dword [rax]
jmp fcn.140008650
Function at 0x140121400
Capabilities:
Encode data using base64
Encode data using xor
Encrypt data using speck
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
sub rsp, 0xba8
call fcn.1401213e1
mov qword [rsp + 0xb98], rax
mov eax, 0xacc10518
mov dword [rsp + 0xba4], eax
Function at 0x140134079
Capabilities:
Get thread local storage value

Disassembly:
mov rax, qword [0x14022dd30]
mov ecx, dword [rax]
jmp fcn.140008650

Function at 0x140135c80
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x14021f000]
sub ecx, dword [0x14021f004]
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xb58d7296
and eax, edx
or ecx, 0xb58d7296
mov edx, 0xe23e2ec2
xor edx, 0x1dc1d13d
xor ecx, edx
or eax, ecx
xor eax, 0xffffffff
and eax, 0x7645c09d
mov ecx, 0xd50ff8fd
xor edx, edx
div ecx
mov ecx, 0x73f05cfc
xor ecx, 0x28a21c04
cmp eax, ecx
jae 0x140135d4c
mov eax, dword [0x14021f008]
mov ecx, dword [0x14021f00c]
xor ecx, 0xd7d7717f
imul eax, ecx
xor eax, 0x9879b125
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0xe2ab4fa5
mov edx, 0xffffffff
xor edx, 0xe2ab4fa5
and eax, edx
sub eax, ecx
imul eax, eax, 0xf56b4ea7
mov dword [rsp + 0x2c], eax
mov rax, qword [0x14022dd30]
mov ecx, dword [rax]
call fcn.140008650
mov rcx, rax
mov eax, dword [rsp + 0x2c]
add rcx, 0x50
mov qword [rsp + 0x30], rcx
cmp eax, 0xe591ef0
je 0x140135cdb
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
add dl, ch
insb byte [rdi], dx
xchg cl, ch
xchg bh, bh
invalid

Function at 0x140136180
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
xor eax, eax
test r8, r8
cmovg rax, r8
mov qword [rsp + 0x20], rax
Function at 0x140149c2c
Capabilities:
Get thread local storage value

Disassembly:
mov rax, qword [0x14022dd30]
mov ecx, dword [rax]
jmp fcn.140008650
Function at 0x14014e6b0
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
push rbp
sub rsp, 0x250
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x120], rdx
mov qword [rbp + 0x140], rcx
mov eax, 0x10
mov qword [rbp + 0x128], rax
call fcn.140215890
sub rsp, rax
mov rax, qword [rbp + 0x128]
mov rcx, rsp
mov qword [rbp + 0x130], rcx
call fcn.140215890
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x138], rax
sub rsp, 0x20
call fcn.14015044e

Function at 0x14015044e
Capabilities:
Get thread local storage value

Disassembly:
mov rax, qword [0x14022dd30]
mov ecx, dword [rax]
jmp fcn.140008650
Function at 0x1401522f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
call fcn.140150f44
mov qword [rsp + 0x30], rax
mov word [rsp + 0x66], 0x32e
lea rcx, [rsp + 0x66]
call fcn.14006cf90
mov rcx, rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rcx
mov al, byte [rax]
mov cl, 0x54
xor cl, 0x54
cmp al, cl
jne 0x14015245b
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
mov qword [rsp + 0x50], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x50]
call fcn.140151ee0
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
jne 0x14015245b
mov ax, 0x725a
xor ax, 0x7730
mov word [rsp + 0x64], ax
lea rcx, [rsp + 0x64]
call fcn.14006cf90
mov rcx, rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
cmp byte [rax], 0
jne 0x14015245b
mov ecx, dword [0x14021fd78]
xor ecx, dword [0x14021fd7c]
mov edx, ecx
xor edx, 0xffffffff
mov eax, 0xa9555740
xor eax, 0xc332f4dd
and eax, edx
mov edx, 0xffffffff
xor edx, 0x6a67a39d
and ecx, edx
or eax, ecx
mov ecx, 0xdef52364
xor edx, edx
div ecx
mov edx, eax
and edx, 0x81705503
mov ecx, 0xac3dd5af
xor ecx, 0xac3dd5ad
imul ecx, edx
add eax, 0x81705503
sub eax, ecx
cmp eax, 0x28be81ef
jb 0x140152460
mov eax, dword [0x14021fd80]
xor eax, 0x9f394944
mov ecx, dword [0x14021fd84]
mov edx, 0xa5ba1c6c
xor edx, 0x333d9eaa
xor ecx, edx
xor edx, edx
div ecx
mov ecx, eax
mov rax, qword [rsp + 0x28]
imul edx, ecx, 0x4b26f32b
mov ecx, edx
and ecx, 0xdeb83a24
xor edx, 0xdeb83a24
or ecx, edx
imul ecx, ecx, 0x242dd86b
mov dword [rsp + 0x24], ecx
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
call fcn.140151ee0
mov eax, dword [rsp + 0x24]
cmp eax, 0x4aadcf1a
jbe 0x1401523e3
jmp 0x14015245b
add rsp, 0x68
ret
adc dword [rdi - 0x80], esp
shr cl, 1
jp 0x140152466
invalid
invalid
Function at 0x140158700
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
xor eax, eax
test r8, r8
cmovg rax, r8
mov qword [rsp + 0x18], rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x18]
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
cmp rax, rcx
je 0x140158766
mov rcx, qword [rsp]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
mov dl, byte [rdx + rcx]
mov byte [rax + rcx], dl
mov rax, rcx
and rax, 1
or rcx, 1
add rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x140158723
mov eax, dword [0x140220028]
mov r8d, dword [0x14022002c]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov ecx, 0xf14a832
xor ecx, 0xf0eb57cd
mov r9d, r8d
xor r9d, ecx
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xb1c0179c
xor edx, edx
div ecx
mov ecx, eax
xor ecx, 0x9323258f
mov edx, 0xffffffff
xor edx, 0x9323258f
and eax, edx
shl eax, 1
sub eax, ecx
mov ecx, 0x2ee7b28d
xor ecx, 0xa5e0f8c7
mov edx, eax
xor edx, ecx
mov ecx, 0xf695bff2
xor ecx, 0x96a400d
xor edx, ecx
mov ecx, 0xbc42e6e4
xor ecx, 0x3745acae
and ecx, edx
shl ecx, 1
sub ecx, 0x8b074a4a
sub eax, ecx
cmp eax, 0xd0213d1
jb 0x14015883d
mov eax, dword [0x140220030]
mov ecx, 0x12fff7fc
xor ecx, 0x17f4d4c6
xor eax, ecx
xor eax, dword [0x140220034]
add eax, 0xc3b08992
and eax, 0xc07d36d3
sub eax, 0xa9bdc367
cmp eax, 0x5c01aafe
ja 0x140158805
add rsp, 0x28
ret
fistp word [rbx]
invalid
Function at 0x14015abf0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x4c8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x2d0], rdx
Function at 0x140161f10
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov ecx, dword [0x1402204a8]
and ecx, dword [0x1402204ac]
mov eax, 0x339d70bd
xor eax, 0xd289dec9
sub ecx, eax
mov eax, ecx
and eax, 0xd6055d4d
xor ecx, 0xd6055d4d
or eax, ecx
mov ecx, 0x19606836
xor ecx, 0xab8ac8fe
mov edx, 0x5d825aa4
xor edx, 0xa27da55b
xor ecx, edx
add eax, ecx
add eax, 1
mov ecx, 0x45c713ab
xor ecx, 0xfc0eb023
cmp eax, ecx
jae 0x140162175
mov ecx, dword [0x1402204b0]
mov eax, dword [0x1402204b4]
imul ecx, eax
mov eax, ecx
not eax
and eax, 0x72c28690
and ecx, 0x8d3d796f
sub ecx, eax
mov eax, ecx
xor eax, 0xd0683d1d
and eax, ecx
add eax, 0x256fbd9
mov dword [rbp - 0x3c], eax
mov eax, 0x10
call fcn.140215890
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x48], rax
sub rsp, 0x20
call fcn.14018af70
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x10]
add rsp, 0x20
mov r8, rax
mov eax, dword [rbp - 0x3c]
mov qword [rbp - 0x38], r8
mov r8, rcx
add r8, 8
mov qword [rbp - 0x30], r8
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x28], rcx
mov r8, rdx
add r8, 8
mov qword [rbp - 0x20], r8
cmp rcx, qword [rdx + 8]
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0x9862b8a
jb 0x140161f79
mov rax, qword [rbp - 0x28]
mov cl, byte [rbp - 0x11]
test cl, 1
mov qword [rbp - 0x50], rax
jne 0x140162157
jmp 0x140162029
mov rcx, qword [rbp - 0x48]
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.140161ad0
mov rax, qword [rbp - 0x38]
add rsp, 0x20
cmp byte [rax + 0x50], 0
jne 0x140162170
mov eax, dword [0x1402204b8]
mov ecx, 0x5927a513
xor ecx, 0xe98d837f
xor eax, ecx
xor eax, dword [0x1402204bc]
mov ecx, 0xc7d9df47
xor ecx, 0x8cb20adc
or eax, ecx
and eax, 0xed2a7598
imul eax, eax, 0xbf0e6845
cmp eax, 0x8833f48a
ja 0x14016217e
mov eax, dword [0x1402204c0]
xor edx, edx
div dword [0x1402204c4]
mov rdx, qword [rbp - 0x20]
mov r8d, 0x290006d1
xor r8d, 0xd6fff92e
mov ecx, eax
xor ecx, r8d
mov r8d, 0x403058c3
xor r8d, 0x87ecb90f
and r8d, ecx
mov r9d, 0xffffffff
xor r9d, 0xc7dce1cc
mov ecx, eax
and ecx, r9d
imul ecx, r8d
mov r9d, 0x41a8aa73
xor r9d, 0x86744bbf
mov r8d, eax
and r8d, r9d
or eax, 0xc7dce1cc
imul eax, r8d
add eax, ecx
mov ecx, eax
and ecx, 0x522b1c95
mov r8d, 0x4f2f425a
xor r8d, 0x4f2f4258
xor eax, 0x4f2f4258
imul ecx, r8d
xor eax, 0x522b1c95
add eax, ecx
mov ecx, eax
and ecx, 0x506ccf6b
shl ecx, 1
add eax, 0x506ccf6b
sub eax, ecx
mov ecx, 0xaaa436ba
xor ecx, 0x118d05f4
mov rdx, qword [rdx]
mov qword [rbp - 0x58], rdx
cmp eax, ecx
jae 0x14016217e
mov rax, qword [rbp - 0x58]
mov qword [rbp - 0x50], rax
jmp 0x140162157
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp - 8]
mov r8, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x50]
mov r8, qword [r8]
mov qword [rdx], r8
mov qword [rax], rcx
mov rsp, rbp
pop rbp
ret
jge 0x14016210d
retf
sbb dil, byte [rax + r8*2 - 0xf017]
jmp qword [rsi + 0xf]
Function at 0x140166c00
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [0x140220648]
mov eax, 0xf992735e
xor eax, 0x916771fc
xor ecx, eax
mov edx, dword [0x14022064c]
mov r8d, ecx
xor r8d, 0xffffffff
mov eax, edx
and eax, r8d
mov r8d, 0x8d524b6
xor r8d, 0xf72adb49
xor edx, r8d
and ecx, edx
or eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xcce7af4e
mov r8d, 0x8c6192b3
xor r8d, 0x40863dfd
mov ecx, 0xe55085f5
xor ecx, 0x1aaf7a0a
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xcce7af4e
or eax, 0xcce7af4e
imul eax, edx
add eax, ecx
mov ecx, 0x4c2109e5
xor ecx, 0x42fc23b1
add eax, ecx
mov ecx, 0x4ec7ef1b
xor ecx, 0x7fb2524b
add eax, ecx
mov ecx, 0x28dde926
xor ecx, 0x2600c372
sub eax, ecx
mov ecx, 0xa0cdfd36
xor ecx, 0x313cc251
xor edx, edx
div ecx
mov ecx, 0xecc8864e
xor ecx, 0xf3a0b4f8
cmp eax, ecx
je 0x140166d13
mov ecx, dword [0x140220650]
xor ecx, 0x301ca271
mov edx, dword [0x140220654]
mov eax, 0xf0f87594
xor eax, 0xf078a6b
xor edx, eax
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0x2cfa95b
xor ecx, 0x3bd375d9
xor eax, ecx
imul eax, eax, 0x9ba04953
sub eax, 0x2daf97a3
add eax, 0x3b36c679
add eax, 0x2daf97a3
cmp eax, 0x8cc632c8
ja 0x140166cc1
ret
cmp eax, 0xe918e1bc
movsd dword [rdi], dword [rsi]
invalid