joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400784d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
mov eax, dword [0x14024e758]
xor eax, 0xdc86f1fd
mov edx, dword [0x14024e75c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
xor eax, 0x116207ca
and eax, 0x39929a59
xor eax, 0xab888c6b
cmp eax, 0x8bfacda9
je 0x1400786ae
mov eax, dword [0x14024e760]
xor eax, 0xb9fabda9
mov ecx, dword [0x14024e764]
sub eax, ecx
mov ecx, 0xc510f30b
imul rax, rcx
shr rax, 0x3d
mov ecx, eax
or ecx, 0x7f719020
mov eax, ecx
not eax
mov edx, eax
and edx, 0x8a02cb
and ecx, 0x36300004
imul ecx, edx
mov edx, eax
and edx, 0x80046d14
or eax, 0xb6346d14
imul eax, edx
add eax, ecx
mov dword [rbp - 0x2c], eax
mov eax, 0x10
call fcn.14024abd0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
sub rsp, 0x20
call fcn.140067614
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x38], rcx
movabs rcx, 0x82838372503f0fb
movabs rdx, 0x82838372503f0fb
xor rcx, rdx
mov qword [rax], rcx
mov qword [rax + 8], 0
movabs rcx, 0xd12a895e661b2cf2
movabs rax, 0xd12a895e661b2cfa
xor rcx, rax
sub rsp, 0x20
call fcn.1400678b4
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov rdx, rax
mov eax, dword [rbp - 0x2c]
mov qword [rbp - 0x28], rdx
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0x19], cl
cmp eax, 0xc448c262
jae 0x140078517
mov cl, byte [rbp - 0x19]
mov al, 1
test cl, 1
mov byte [rbp - 0x41], al
jne 0x140078613
jmp 0x140078671
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x28]
sub rsp, 0x20
call fcn.1400784a2
mov rax, qword [rbp - 0x38]
add rsp, 0x20
mov cl, byte [rax]
mov dl, 1
xor dl, 1
mov al, 1
cmp cl, dl
mov byte [rbp - 0x41], al
jne 0x140078671
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x28]
mov r8, qword [rax + 0x58]
mov qword [rdx], r8
mov rax, qword [rax + 0x60]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140018a3d
mov rax, qword [rbp - 0x38]
add rsp, 0x20
mov al, byte [rax]
mov byte [rbp - 0x41], al
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x28]
mov dl, byte [rbp - 0x41]
mov byte [rbp - 0x42], dl
mov byte [rax], 0
sub rsp, 0x20
call fcn.1400672e0
mov rax, qword [rbp - 0x38]
add rsp, 0x20
cmp byte [rax], 0
jne 0x1400786a5
mov rax, qword [rbp - 0x38]
mov cl, byte [rbp - 0x42]
mov byte [rax], cl
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
xchg dword [rdx + 0x60e95dd2], esi
invalid
Function at 0x140078850
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
mov eax, dword [0x14024e778]
xor edx, edx
div dword [0x14024e77c]
and eax, 0xd80692a8
mov ecx, 0x894cc129
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
or eax, 0xce40acdf
xor eax, 0xffffffff
mov edx, 0x996b49de
xor edx, 0x6694b621
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0xce40acdf
and ecx, edx
mov edx, 0x38ead242
xor edx, 0xc7152dbd
xor eax, edx
xor ecx, 0xffffffff
and eax, ecx
cmp eax, 0xb744ca40
jb 0x140078a2f
mov eax, dword [0x14024e780]
xor eax, 0x3783c6ed
mov edx, dword [0x14024e784]
xor edx, 0x1b501b2b
mov ecx, eax
and ecx, edx
add ecx, ecx
add eax, edx
sub eax, ecx
imul rax, rax, 0x44c62935
shr rax, 0x3e
or eax, 0xaf038054
xor eax, 0xe7e1fad
imul rax, rax, 0xe152f87
shr rax, 0x39
mov dword [rbp - 0x2c], eax
mov eax, 0x10
call fcn.14024abd0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
sub rsp, 0x20
call fcn.140067614
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x38], rcx
mov qword [rax], 0
mov qword [rax + 8], 0
mov ecx, 8
sub rsp, 0x20
call fcn.1400678b4
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov rdx, rax
mov eax, dword [rbp - 0x2c]
mov qword [rbp - 0x28], rdx
mov cl, byte [rcx]
mov dl, 0xd5
xor dl, 0xd5
cmp cl, dl
sete cl
mov byte [rbp - 0x19], cl
cmp eax, 0xa3c6846c
jae 0x1400788c5
mov cl, byte [rbp - 0x19]
mov al, 1
test cl, 1
mov byte [rbp - 0x41], al
jne 0x140078994
jmp 0x1400789f2
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x28]
sub rsp, 0x20
call fcn.140078821
mov rax, qword [rbp - 0x38]
add rsp, 0x20
mov cl, byte [rax]
mov dl, 0x75
xor dl, 0x75
mov al, 1
cmp cl, dl
mov byte [rbp - 0x41], al
jne 0x1400789f2
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x28]
mov r8, qword [rax + 0x58]
mov qword [rdx], r8
mov rax, qword [rax + 0x60]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140018a3d
mov rax, qword [rbp - 0x38]
add rsp, 0x20
mov al, byte [rax]
mov byte [rbp - 0x41], al
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x28]
mov dl, byte [rbp - 0x41]
mov byte [rbp - 0x42], dl
mov byte [rax], 0
sub rsp, 0x20
call fcn.1400672e0
mov rax, qword [rbp - 0x38]
add rsp, 0x20
cmp byte [rax], 0
jne 0x140078a26
mov rax, qword [rbp - 0x38]
mov cl, byte [rbp - 0x42]
mov byte [rax], cl
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
cmp ebx, 0x6f
sub ebp, ecx
invalid
Function at 0x1400795b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x14024e7c8]
or eax, dword [0x14024e7cc]
and eax, 0x9bcdc186
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x770fa5fd
add ecx, eax
xor eax, eax
sub eax, ecx
and eax, 0xdf51cee9
mov ecx, 0x5fd581a2
xor ecx, 0x94ca3188
cmp eax, ecx
je 0x1400797da
mov ecx, dword [0x14024e7d0]
mov eax, dword [0x14024e7d4]
xor eax, ecx
xor eax, 0x6e3e626
and eax, ecx
add eax, 0xdeee3328
mov edx, eax
not edx
and edx, 0x6b1464b1
mov ecx, eax
and ecx, 0x94eb9b4e
imul ecx, edx
mov edx, eax
and edx, 0x6b1464b1
or eax, 0x6b1464b1
imul eax, edx
add eax, ecx
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xb65c6505
and ecx, 0x49a39afa
imul ecx, edx
mov edx, eax
and edx, 0x49a39afa
or eax, 0x49a39afa
imul eax, edx
add eax, ecx
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.14024abd0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.140067614
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov qword [rbp - 0x20], rax
movabs rdx, 0x26957c50832e5428
movabs rax, 0x26957c50832e542a
xor rdx, rax
sub rsp, 0x20
call fcn.140067bb0
mov rcx, qword [rbp - 0x20]
mov eax, dword [rbp - 0x18]
add rsp, 0x20
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0x5330c855
jae 0x1400795fc
mov al, byte [rbp - 0x11]
test al, 1
jne 0x1400796df
jmp 0x14007972c
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax]
sub rsp, 0x20
call fcn.140073750
mov rax, qword [rbp - 0x20]
add rsp, 0x20
cmp byte [rax], 0
jne 0x14007972c
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax + 8]
mov qword [rdx], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140073fa0
add rsp, 0x20
mov eax, dword [0x14024e7d8]
mov ecx, dword [0x14024e7dc]
xor ecx, 0x376a1d7f
add eax, ecx
imul ecx, eax, 0x337c3a44
mov eax, ecx
and eax, 0x5349214e
or ecx, 0x5349214e
add eax, ecx
mov ecx, 0x2a70fc2c
xor ecx, 0x22cc8725
sub eax, ecx
mov ecx, 0xe066fed9
xor ecx, 0xf2651c09
cmp eax, ecx
jb 0x1400797e3
mov ecx, dword [0x14024e7e0]
mov eax, dword [0x14024e7e4]
xor eax, 0xf3f12f00
add ecx, 0x88c5bc40
sub ecx, eax
mov esp, 0xc12988c5
sub ecx, 0x88c5bc40
mov edx, ecx
xor edx, 0xffffffff
mov eax, 0x8f9f7d0
xor eax, 0x6a8b5af9
and eax, edx
mov edx, 0xffffffff
xor edx, 0x6272ad29
and ecx, edx
or eax, ecx
and eax, 0x537df5e4
mov ecx, 0xc8beb5aa
xor edx, edx
div ecx
mov ecx, 0xeb28cd64
xor ecx, 0xefa36747
cmp eax, ecx
ja 0x1400797e3
mov rsp, rbp
pop rbp
ret
jge 0x140079788
out dx, eax
jmp 0x1400795fc
rcl dword [rax + 0x74]
shr ecx, 0x89
invalid
Function at 0x1400798a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
mov ecx, dword [0x14024e7e8]
mov eax, dword [0x14024e7ec]
add ecx, 0x69381c17
sub ecx, eax
mov eax, 0xeb94fed
xor eax, 0x678153fa
sub ecx, eax
mov eax, ecx
and eax, 0x207a2635
or ecx, 0x207a2635
add eax, ecx
add eax, 0xf1528c9
sub eax, 0x353acf75
mov ecx, 0xadc04d37
xor ecx, 0xd8ba2693
cmp eax, ecx
jb 0x140079a70
mov eax, dword [0x14024e7f0]
mov ecx, dword [0x14024e7f4]
and eax, ecx
add eax, 0xb647b1fc
not eax
or eax, 0xc090af94
mov ecx, eax
not ecx
and eax, 0xc603c877
mov edx, ecx
and edx, 0x396c1008
or eax, edx
xor eax, 0x4297f7b5
and ecx, 0x4041042
or eax, ecx
mov dword [rbp - 0x2c], eax
mov eax, 0x10
call fcn.14024abd0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
sub rsp, 0x20
call fcn.140067614
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x38], rcx
movabs rcx, 0xce08ba9c8615e02b
movabs rdx, 0xce08ba9c8615e02b
xor rcx, rdx
mov qword [rax], rcx
mov qword [rax + 8], 0
mov ecx, 8
sub rsp, 0x20
call fcn.1400678b4
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov rdx, rax
mov eax, dword [rbp - 0x2c]
mov qword [rbp - 0x28], rdx
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0x19], cl
cmp eax, 0x8fd6e066
jae 0x140079902
mov cl, byte [rbp - 0x19]
mov al, 1
test cl, 1
mov byte [rbp - 0x41], al
jne 0x1400799d7
jmp 0x140079a2f
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x28]
sub rsp, 0x20
call fcn.140079875
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov al, 1
cmp byte [rcx], 0
mov byte [rbp - 0x41], al
jne 0x140079a2f
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x28]
mov r8, qword [rax + 0x58]
mov qword [rdx], r8
mov rax, qword [rax + 0x60]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140018a3d
mov rax, qword [rbp - 0x38]
add rsp, 0x20
mov al, byte [rax]
mov byte [rbp - 0x41], al
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x28]
mov dl, byte [rbp - 0x41]
mov byte [rbp - 0x42], dl
mov dl, 0x58
xor dl, 0x58
mov byte [rax], dl
sub rsp, 0x20
call fcn.1400672e0
mov rax, qword [rbp - 0x38]
add rsp, 0x20
cmp byte [rax], 0
jne 0x140079a67
mov rax, qword [rbp - 0x38]
mov cl, byte [rbp - 0x42]
mov byte [rax], cl
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
pop rbp
call 0xc9f133df
invalid
Function at 0x14007b0cc
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x14024e8a8]
mov ecx, 0xb94bd42b
xor ecx, 0x74621830
xor eax, ecx
mov edx, dword [0x14024e8ac]
xor edx, 0xdf9e8f36
mov r8d, eax
xor r8d, edx
xor r8d, 0xffffffff
mov ecx, edx
and ecx, r8d
shl ecx, 1
sub ecx, edx
sub eax, ecx
imul eax, eax, 0xc4c2dd29
or eax, 0x368f8c8
mov ecx, 0x3777e01a
xor ecx, 0x6e5d8c7f
xor eax, ecx
cmp eax, 0x48956d89
jbe 0x14007b0c3
mov eax, dword [0x14024e8b0]
xor eax, 0xdeba729e
mov ecx, dword [0x14024e8b4]
xor ecx, 0xb687025f
sub eax, ecx
imul eax, eax, 0x96608d32
mov ecx, 0xc6b04665
xor ecx, 0xbd7a6cab
xor eax, ecx
mov ecx, eax
and ecx, 0x2c9bd8e4
mov edx, 0x19c141b
xor edx, 0xfe63ebe4
xor ecx, edx
mov edx, 0x136c920f
xor edx, 0x3ff74aeb
add eax, edx
mov edx, 0x3b1aefde
xor edx, 0x3b1aefdf
add eax, edx
add eax, ecx
mov dword [rsp + 0x20], eax
call fcn.140067614
mov rcx, qword [rsp + 0x28]
mov eax, dword [rsp + 0x20]
cmp rcx, 0
sete cl
mov byte [rsp + 0x27], cl
cmp eax, 0x3b4d3f0a
jbe 0x14007b006
mov al, byte [rsp + 0x27]
test al, 1
jne 0x14007b09c
jmp 0x14007b0ab
mov rcx, qword [rsp + 0x30]
call fcn.14006792a
jmp 0x14007b0bd
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax]
call fcn.14007aee3
nop
add rsp, 0x38
ret
add bl, ch
push 0x6a
jmp 0x14007b006
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.140067614
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x14007afa0
Function at 0x14007b490
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x30
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
call fcn.140067614
mov rdx, qword [rsp + 0x28]
cmp rdx, 0
jne 0x14007b4c2
mov rcx, qword [rsp + 0x20]
call fcn.14006792a
jmp 0x14007b4d4
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax]
call fcn.14007b1e0
mov r11d, dword [0x14024e8d8]
mov eax, 0x259eefa6
xor eax, 0xc30df67e
xor r11d, eax
mov r10d, dword [0x14024e8dc]
xor r10d, 0xe3573f5a
mov ecx, r11d
xor ecx, 0xffffffff
mov eax, 0x919f02b
xor eax, 0xf6e60fd4
mov r8d, r10d
xor r8d, eax
mov edx, 0xf534e093
xor edx, 0x66dc711a
mov eax, 0xbd33765f
xor eax, 0x42cc89a0
xor edx, eax
mov r9d, 0xadc71f3
xor r9d, 0x9934e07a
mov eax, ecx
and eax, r9d
and r11d, edx
mov esi, 0x1c923d49
xor esi, 0x8f7aacc0
mov r9d, r8d
and r9d, esi
and r10d, edx
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
xor ecx, 0xffffffff
or edx, 0x93e89189
and ecx, edx
or eax, ecx
mov ecx, 0xdd80660d
xor edx, edx
div ecx
mov ecx, eax
add ecx, 0x3bc0aed1
mov edx, 0x4cd643d8
xor edx, 0xb329bc27
mov eax, ecx
xor eax, edx
mov edx, 0xffffffff
xor edx, 0x84e391c5
and eax, edx
mov edx, 0xfe01e5eb
xor edx, 0x1fe1a14
xor ecx, edx
mov edx, 0x37ca35df
xor edx, 0xb329a41a
mov r8d, 0xd090b925
xor r8d, 0x2f6f46da
xor edx, r8d
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0xbdb98cc6
xor ecx, 0x298d2957
cmp eax, ecx
jbe 0x14007b62a
mov eax, dword [0x14024e8e0]
or eax, dword [0x14024e8e4]
mov edx, eax
and edx, 0x9e0b3dff
mov ecx, 0xad9072a0
xor ecx, 0xad9072a2
imul ecx, edx
add eax, 0x9e0b3dff
sub eax, ecx
mov ecx, 0xb97ad23b
xor ecx, 0x61e49347
xor edx, edx
div ecx
xor eax, 0x3b00159b
mov ecx, 0xdf993549
xor ecx, 0xa16f9d3e
cmp eax, ecx
jae 0x14007b5d4
add rsp, 0x30
pop rsi
ret
xor al, 0x76
out 0xeb, eax
jmp 0x14007b5d4
Function at 0x14007caa0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x14024e9b8]
xor eax, 0x43bb23e9
mov ecx, dword [0x14024e9bc]
mov edx, 0xc208678c
xor edx, 0x55b61e78
xor ecx, edx
and eax, eax
xor eax, 0xffffffff
and ecx, ecx
xor ecx, 0xffffffff
mov edx, 0xca271fd8
xor edx, 0x35d8e027
xor eax, edx
xor ecx, 0xffffffff
or eax, ecx
sub eax, 0x385048b5
mov ecx, 0xe0e13292
xor ecx, 0x2092e53d
imul eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x497eee4a
add eax, ecx
mov ecx, 0x776027a6
xor ecx, 0x776027a7
add eax, ecx
cmp eax, 0x74dfffb1
je 0x14007cc7d
mov eax, dword [0x14024e9c0]
mov ecx, dword [0x14024e9c4]
xor eax, ecx
xor eax, 0x4af9702b
add eax, 0x5a67920b
and eax, 0x8e726801
xor eax, 0x33e113ff
mov dword [rbp - 0x18], eax
mov eax, 0x4bfdc6dc
mov dword [rbp - 0x1c], eax
mov eax, 0x10
call fcn.14024abd0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.140067614
mov rdx, qword [rbp - 0x10]
mov ecx, dword [rbp - 0x1c]
add rsp, 0x20
mov eax, dword [rbp - 0x18]
cmp rdx, 0
sete dl
mov byte [rbp - 0x11], dl
cmp eax, ecx
jae 0x14007cb24
mov al, byte [rbp - 0x11]
test al, 1
jne 0x14007cb9e
jmp 0x14007cbb4
mov rcx, qword [rbp - 8]
sub rsp, 0x20
call fcn.14006792a
add rsp, 0x20
jmp 0x14007cbdb
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14007c890
add rsp, 0x20
mov eax, dword [0x14024e9c8]
add eax, dword [0x14024e9cc]
sub eax, 0x85dc6cbd
imul eax, eax, 0x5191abb2
and eax, 0xea5ef637
cmp eax, 0x6b6b3e9b
jbe 0x14007cc86
mov eax, dword [0x14024e9d0]
mov edx, dword [0x14024e9d4]
mov ecx, eax
xor ecx, edx
xor edx, 0xffffffff
and eax, edx
shl eax, 1
sub eax, ecx
mov ecx, 0xe78ed04d
xor edx, edx
div ecx
mov ecx, eax
mov eax, 0x6812f92c
xor eax, 0x6812f92c
sub eax, ecx
xor ecx, ecx
sub ecx, 0xb3496175
add eax, ecx
mov edx, 0x6b3155aa
xor edx, 0x6b3155aa
sub edx, eax
mov ecx, edx
xor ecx, 0xf0db7fc9
mov eax, 0xffffffff
xor eax, 0xf0db7fc9
and edx, eax
mov eax, 0xb377e3da
xor eax, 0xb377e3d8
imul eax, edx
sub eax, ecx
cmp eax, 0x5a797e7e
jb 0x14007cc02
mov rsp, rbp
pop rbp
ret
scasb al, byte [rdi]
lahf
adc al, 0xf
jmp 0x14007cb24
popfq
sar ebp, 1
int1
jmp 0x14007cc02
Function at 0x14007cde0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rcx
call fcn.140067614
mov rdx, qword [rsp + 0x38]
cmp rdx, 0
jne 0x14007ce11
mov rcx, qword [rsp + 0x30]
call fcn.14006792a
jmp 0x14007ced5
mov eax, dword [0x14024e9e8]
add eax, dword [0x14024e9ec]
add eax, 0x78508c3f
sub eax, 0xdeeddc99
mov ecx, 0xd73fc706
xor ecx, 0x6bb356bf
xor edx, edx
div ecx
mov ecx, 0xbb16f6f0
xor ecx, 0x988e9b37
cmp eax, ecx
je 0x14007ceda
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov edx, dword [0x14024e9f0]
mov r8d, 0x725180c9
xor r8d, 0x646c62b6
xor edx, r8d
sub edx, dword [0x14024e9f4]
imul r8d, edx, 0xa498a92c
mov r9d, 0x7b9e2f99
xor r9d, 0x47491610
mov edx, r8d
and edx, r9d
xor r8d, 0x3cd73989
or edx, r8d
and edx, 0x9b22d3cf
mov dword [rsp + 0x2c], edx
mov rdx, qword [rax]
mov qword [rsp + 0x40], rdx
mov rdx, qword [rax + 8]
mov qword [rsp + 0x48], rdx
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x40]
call fcn.14007cc90
mov eax, dword [rsp + 0x2c]
cmp eax, 0x6bd6c5ca
jae 0x14007ce49
jmp 0x14007ced5
add rsp, 0x58
ret
invalid
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.140067614
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x14007cde0
Function at 0x14007d030
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x14024e9f8]
mov edx, dword [0x14024e9fc]
xor ecx, ecx
sub ecx, edx
add eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x60fd2861
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x60fd2861
or eax, 0x60fd2861
imul eax, edx
add eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x1e68dac7
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x833db57
xor r8d, 0xf7cc24a8
xor ecx, r8d
imul ecx, edx
mov r8d, 0xd4dfbfa3
xor r8d, 0xcab76564
mov edx, eax
and edx, r8d
or eax, 0x1e68dac7
imul eax, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x28594c51
add ecx, eax
xor eax, eax
sub eax, ecx
cmp eax, 0x923d03a
jb 0x14007d1b4
xor eax, eax
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.14024abd0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.140067614
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov qword [rbp - 0x20], rax
movabs rdx, 0x10d0dcca93cbbf4f
movabs rax, 0x10d0dcca93cbbf4d
xor rdx, rax
sub rsp, 0x20
call fcn.140067bb0
mov rcx, qword [rbp - 0x20]
mov eax, dword [rbp - 0x18]
add rsp, 0x20
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0x5877222a
je 0x14007d0e5
mov al, byte [rbp - 0x11]
test al, 1
jne 0x14007d162
jmp 0x14007d1af
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax]
sub rsp, 0x20
call fcn.140073750
mov rax, qword [rbp - 0x20]
add rsp, 0x20
cmp byte [rax], 0
jne 0x14007d1af
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax + 8]
mov qword [rdx], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140068b60
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
xchg byte [0x13f30bbb8], cl
invalid
Function at 0x14007f71d
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 8], rdx
mov qword [rbp - 0x18], rcx
mov eax, 0x10
call fcn.14024abd0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x10], rax
sub rsp, 0x20
call fcn.140067614
mov rdx, qword [rbp - 8]
add rsp, 0x20
cmp rdx, 0
jne 0x14007f607
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call fcn.14006792a
add rsp, 0x20
jmp 0x14007f62e
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
mov rax, qword [rbp - 8]
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14007f54f
add rsp, 0x20
mov eax, dword [0x14024eb38]
sub eax, dword [0x14024eb3c]
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
mov edx, 0x494f12f
xor edx, 0x5bf12dc3
or eax, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, 0xd2720d4a
xor eax, 0xd2720d4a
mov edx, 0x4a4b2fd1
xor edx, 0xa4aa732c
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0xb2e4f6c0
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, 0xaf10d469
xor ecx, 0x7a026fc4
cmp eax, ecx
jb 0x14007f714
mov eax, dword [0x14024eb40]
mov ecx, dword [0x14024eb44]
mov edx, 0x9fea0ee5
xor edx, 0xf8eae868
xor ecx, edx
add eax, ecx
mov ecx, 0x4d1cbaa6
xor ecx, 0x616c4003
mov edx, 0x282ecf58
xor edx, 0xd7d130a7
xor ecx, edx
mov edx, 0x377955c3
xor edx, 0x377955c3
mov r8d, 0x5eb28a90
xor r8d, 0x5eb28a91
sub edx, r8d
sub ecx, edx
sub eax, ecx
and eax, 0xe56bf3aa
mov ecx, 0x824dd716
xor ecx, 0x195411ce
xor edx, edx
div ecx
mov ecx, 0xec59a8d8
xor ecx, 0xe747fae8
cmp eax, ecx
jae 0x14007f696
mov rsp, rbp
pop rbp
ret
xchg al, dil
push rax
jmp 0x14007f696
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.140067614
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x14007f5b0
Function at 0x14007fbd0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], rdx
mov qword [rbp], rcx
mov eax, dword [0x14024eb68]
mov ecx, dword [0x14024eb6c]
xor ecx, 0xe8e465bf
add eax, ecx
mov ecx, 0x3a815a05
xor ecx, 0x5dd6a199
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x34ac675a
or eax, edx
xor ecx, 0xffffffff
mov edx, 0xe7adbe60
xor edx, 0xd301d93a
mov r8d, 0x94362d64
xor r8d, 0x6bc9d29b
xor edx, r8d
or ecx, edx
mov edx, 0xdeb26809
xor edx, 0x214d97f6
xor eax, edx
xor ecx, 0xffffffff
or eax, ecx
add eax, 0x824904c8
add eax, 0x6650f510
mov ecx, 0x497c2cf2
xor ecx, 0xcb35283a
sub eax, ecx
cmp eax, 0xbfbc7b3c
ja 0x14007fe56
mov eax, dword [0x14024eb70]
mov edx, dword [0x14024eb74]
xor edx, eax
mov eax, edx
xor eax, 0x450000
xor edx, 0x4002000
and edx, 0x4400a128
and eax, 0xc50000
mov ecx, eax
mov eax, edx
lea eax, [rax + rcx - 0x44c5a129]
mov dword [rbp - 0x10], eax
mov eax, 0x10
call fcn.14024abd0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
sub rsp, 0x20
call fcn.140067614
mov rcx, qword [rbp]
add rsp, 0x20
mov qword [rbp - 0x18], rax
mov edx, 2
sub rsp, 0x20
call fcn.140067bb0
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbp - 0x10]
add rsp, 0x20
cmp byte [rcx], 0
sete cl
mov byte [rbp - 9], cl
cmp eax, 0x9dd4f88c
jbe 0x14007fc6e
mov al, byte [rbp - 9]
test al, 1
jne 0x14007fd08
jmp 0x14007fe4f
mov rcx, qword [rbp]
mov rax, qword [rbp - 8]
mov edx, dword [rax]
sub rsp, 0x20
call fcn.1400683a1
mov rax, qword [rbp - 0x18]
add rsp, 0x20
mov al, byte [rax]
mov cl, 0xc9
xor cl, 0xc9
cmp al, cl
jne 0x14007fe4f
mov eax, dword [0x14024eb78]
mov edx, dword [0x14024eb7c]
mov ecx, eax
and ecx, edx
shl ecx, 1
add eax, edx
sub eax, ecx
sub eax, 0x66d9cb51
mov ecx, 0x53b51ae8
xor edx, edx
div ecx
mov ecx, 0xb1b60423
xor edx, edx
div ecx
cmp eax, 0xd006bc05
jae 0x14007fe5f
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp]
mov rax, qword [rbp - 8]
mov r9d, dword [0x14024eb80]
xor r9d, 0x85cc9a22
mov r10d, dword [0x14024eb84]
xor r10d, 0x277ac0d3
mov r8d, r9d
xor r8d, 0xffffffff
mov esi, 0x6d00737d
xor esi, 0x92ff8c82
mov r11d, r9d
xor r11d, esi
and r8d, r11d
mov esi, 0xa19706e2
xor esi, 0x5e68f91d
mov r11d, r10d
xor r11d, esi
mov esi, r10d
xor esi, 0xffffffff
and r11d, esi
mov esi, 0x2464caf3
xor esi, 0xdb9b350c
xor r8d, esi
xor r11d, 0xffffffff
and r8d, r11d
or r9d, r10d
mov r10d, 0xce4710b0
xor r10d, 0x31b8ef4f
xor r9d, r10d
xor r8d, 0xffffffff
mov r10d, 0x90dc8e4b
xor r10d, 0x6f2371b4
xor r9d, r10d
and r8d, r9d
add r8d, 0x29cacb0f
imul r8d, r8d, 0xd5dfdb07
imul r8d, r8d, 0x99e1d42f
mov dword [rbp - 0x24], r8d
mov r8, qword [rax + 8]
mov qword [rdx], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14007f860
mov eax, dword [rbp - 0x24]
add rsp, 0x20
cmp eax, 0xb1a525fa
jae 0x14007fd6b
jmp 0x14007fe4f
lea rsp, [rbp + 8]
pop rsi
pop rbp
ret
xchg eax, edi
invalid
sub ecx, dword [rsi + 0x1e]
int 0xe9
add edi, edi
invalid