joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010d380
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1401dc258]
xor eax, 0xa2b7c890
mov ecx, dword [0x1401dc25c]
xor ecx, 0x63057967
xor eax, ecx
mov ecx, 0x108cd0a3
xor ecx, 0xef732f5c
mov edx, eax
xor edx, ecx
and edx, 0x51d3a77
mov r8d, 0x6bb66c4a
xor r8d, 0x6eab563d
mov ecx, 0xa8abae0d
xor ecx, 0x575451f2
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x51d3a77
mov r8d, 0xe9ff7ba2
xor r8d, 0xece241d5
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x9f913603
xor ecx, 0xf6428f29
imul eax, ecx
sub eax, 0xbe00c07c
cmp eax, 0x17fe328d
jb 0x14010d58b
mov eax, dword [0x1401dc260]
mov ecx, 0x4f8442b6
xor ecx, 0xfe383912
xor eax, ecx
mov r8d, dword [0x1401dc264]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
xor eax, 0xd9448807
or eax, eax
xor eax, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x327a58da
mov edx, 0xffffffff
xor edx, 0x327a58da
and ecx, edx
xor eax, 0xffffffff
mov edx, 0xde7ef3b
xor edx, 0xf21810c4
xor ecx, edx
and eax, ecx
mov ecx, 0xac0db3cb
xor ecx, 0xc5c9ea89
sub eax, ecx
mov dword [rsp + 0x38], eax
call fcn.14010c6d1
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
call fcn.14010cd90
mov cl, al
mov eax, dword [rsp + 0x38]
mov byte [rsp + 0x3f], cl
cmp eax, 0x26aa541b
je 0x14010d58b
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x14010d4d4
jmp 0x14010d586
mov rcx, qword [rsp + 0x40]
call fcn.14010ccb2
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
jne 0x14010d586
mov eax, dword [0x1401dc268]
mov ecx, dword [0x1401dc26c]
xor ecx, 0x47547bac
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
and eax, 0xd5a341df
or ecx, 0xd5a341df
add eax, ecx
imul eax, eax, 0x6b1fc76d
sub eax, 0x33648569
cmp eax, 0xf81621a8
je 0x14010d594
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x1401dc270]
mov edx, dword [0x1401dc274]
xor edx, 0xea3bb8da
or eax, edx
mov r8d, 0x5c9b31fb
xor edx, edx
div r8d
mov r8d, 0x7d75bcbc
xor r8d, 0xfa083571
xor edx, edx
div r8d
xor eax, 0xfed3e02e
mov dword [rsp + 0x2c], eax
mov edx, 8
call fcn.14000eb78
mov eax, dword [rsp + 0x2c]
cmp eax, 0xbc046c0b
jb 0x14010d529
jmp 0x14010d586
add rsp, 0x48
ret
invalid
xchg ecx, eax
movabs dword [0x48ffffff8ce94bc5], eax
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
cmp rcx, 0
je 0x14010d5ba
mov rcx, qword [rsp + 0x20]
call fcn.14010cb60
mov rax, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x140116d10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
cmp rdx, 0
je 0x140116f6d
mov rax, qword [rsp + 0x38]
movabs rcx, 0xc85231e3ad8902e2
sub rax, rcx
movabs rcx, 0x23673db82a88adf9
movabs rdx, 0xdc98c247d5775209
xor rcx, rdx
add rax, rcx
movabs rcx, 0xc85231e3ad8902e2
add rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rax]
mov rdx, 0xffffffffffffffff
xor rdx, 0x10
xor ecx, ecx
sub rcx, 1
sub rdx, rcx
mov rcx, rax
sub rcx, rdx
mov qword [rsp + 0x30], rcx
movabs r8, 0x792a1d60973557bf
movabs rdx, 0x86d5e29f68caa840
xor r8, rdx
mov rdx, rax
xor rdx, r8
mov r8, rax
xor r8, 0xffffffffffffffff
and rdx, r8
movabs r8, 0xd69a1c2eb1134c00
movabs r9, 0x2965e3d14eecb3ff
xor r8, r9
movabs r9, 0x5d4fc012280cf1ff
movabs r10, 0xa2b03fedd7f30e00
xor r9, r10
xor r8, r9
mov r9, 0xffffffffffffffff
xor r9, 0xffffffffffffffff
and r8, r9
or rdx, r8
movabs r8, 0x91124379d8ec0ee1
movabs r9, 0x6eedbc862713f11e
xor r8, r9
xor rdx, r8
xor rax, 0xffffffffffffffff
mov r8, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
and rax, r8
or rdx, rax
movabs rax, 0x61fa02e330f2c693
movabs r8, 0x9e05fd1ccf0d396c
xor rax, r8
xor rdx, rax
movabs r8, 0xd83baa2398292728
movabs rax, 0x27c455dc67d6d8d7
xor r8, rax
mov rax, rcx
xor rax, r8
mov r8, rdx
xor r8, 0xffffffffffffffff
or rax, r8
xor rcx, 0xffffffffffffffff
movabs r8, 0x94d85adf7650c7f9
movabs r9, 0x6b27a52089af3806
xor r8, r9
xor rdx, r8
or rcx, rdx
xor rax, 0xffffffffffffffff
xor rcx, 0xffffffffffffffff
or rax, rcx
movabs rcx, 0x1d93fe832255e6e8
movabs rdx, 0x1d93fe832255e6e8
xor rcx, rdx
cmp rax, rcx
jge 0x140116eb7
call fcn.1400077a3
jmp 0x140116f6d
mov eax, dword [0x1401dc598]
xor eax, 0xbed51932
add eax, dword [0x1401dc59c]
xor eax, 0x4df30956
mov ecx, 0x88de982d
xor ecx, 0x772167d2
mov edx, eax
xor edx, ecx
and edx, 0x2230f14
mov r8d, 0xffffffff
xor r8d, 0x2230f14
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x2230f14
or eax, 0x2230f14
imul eax, edx
add eax, ecx
mov ecx, 0x8ff6a2ce
xor ecx, 0xb6e961b2
xor edx, edx
div ecx
cmp eax, 0x4f3a70e0
ja 0x140116fab
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401dc5a0]
xor edx, edx
div dword [0x1401dc5a4]
mov edx, 0x9b4d8c9b
xor edx, 0x325242f3
imul eax, edx
mov r8d, 0x4cf1aa42
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x30]
imul eax, eax, 0x66afe9a6
mov qword [rcx], rdx
cmp eax, 0x7f9f60fa
jbe 0x140116f23
jmp 0x140116f6d
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call fcn.1401139c0
test al, 1
jne 0x140116f87
jmp 0x140116f99
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
mov edx, 8
call fcn.14000eb78
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov qword [rax], rcx
add rsp, 0x48
ret
invalid
Function at 0x140118ef0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 8], rcx
mov eax, dword [0x1401dc688]
mov r8d, dword [0x1401dc68c]
mov ecx, 0xbcd95d6a
xor ecx, 0x4326a295
mov edx, r8d
xor edx, ecx
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
xor eax, 0x2d0c0169
mov ecx, 0xe3c0494c
xor ecx, 0x876193cf
sub eax, ecx
mov ecx, 0xd6da70ef
xor ecx, 0xf0ecc1b9
xor eax, ecx
cmp eax, 0xb7103aa8
ja 0x14011903f
mov ecx, dword [0x1401dc690]
mov eax, dword [0x1401dc694]
or ecx, eax
mov eax, ecx
xor eax, 0x808407d
xor ecx, 0x6200e80
and ecx, 0x37603f80
and eax, 0xc89fc07f
or ecx, eax
mov eax, ecx
xor eax, 0x30f7615d
xor ecx, 0x10924159
and ecx, 0x1792dff9
add ecx, ecx
sub eax, ecx
add eax, 0x1792dff9
mov dword [rbp - 0x10], eax
mov eax, 0x10
call fcn.1401d4340
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
sub rsp, 0x20
call fcn.14011399d
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x18], rcx
mov rax, qword [rax]
mov rcx, qword [rax]
sub rsp, 0x20
call fcn.14005a490
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbp - 0x10]
add rsp, 0x20
mov cl, byte [rcx]
mov dl, 0x8f
xor dl, 0x8f
cmp cl, dl
sete cl
mov byte [rbp - 9], cl
cmp eax, 0xe0a1f4a4
je 0x140118f52
mov al, byte [rbp - 9]
test al, 1
jne 0x140119009
jmp 0x14011903a
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 8]
mov rcx, qword [rax]
add rcx, 8
mov rax, qword [0x1401eaba0]
mov qword [rdx], rax
mov rax, qword [0x1401eaba8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140014bff
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
push 0x49
cli
jmp 0x140118f52
Function at 0x140119390
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rcx
call fcn.140119bff
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
add rax, 0x60
mov qword [rsp + 0x40], rax
add rcx, 8
mov qword [rsp + 0x48], rcx
mov rax, qword [0x1401eb4c8]
call qword [rax]
mov rax, qword [rsp + 0x50]
mov al, byte [rax + 0x60]
mov cl, 0xb2
xor cl, 0xb2
cmp al, cl
jne 0x14011951e
mov rax, qword [rsp + 0x38]
add rax, 0x30
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
movabs rcx, 0x5383ef595e2ea948
movabs rdx, 0x5383ef595e2ea949
xor rcx, rdx
cmp rax, rcx
jge 0x1401194e9
mov ecx, dword [0x1401dc6b8]
xor ecx, 0x38ddd5a1
mov r8d, dword [0x1401dc6bc]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, ecx
and edx, r9d
mov eax, ecx
or eax, r9d
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, r8d
or ecx, r8d
imul ecx, edx
add ecx, eax
mov eax, ecx
and eax, 0xda992c36
xor ecx, 0xda992c36
or eax, ecx
mov ecx, 0x5077e263
xor ecx, 0xd8463c38
xor edx, edx
div ecx
add eax, 0xc779a636
cmp eax, 0x79b2235b
je 0x140119524
mov eax, dword [0x1401dc6c0]
xor eax, 0x76b89cfd
xor edx, edx
div dword [0x1401dc6c4]
sub eax, 0x6200e69
imul eax, eax, 0x3c12a243
imul eax, eax, 0xbe091810
mov dword [rsp + 0x20], eax
call fcn.140119bff
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
call fcn.140002be0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x20]
mov cl, byte [rcx]
xor edx, edx
xor dl, 0
cmp cl, dl
sete cl
mov byte [rsp + 0x27], cl
cmp eax, 0x6f42907f
ja 0x140119478
mov al, byte [rsp + 0x27]
test al, 1
jne 0x1401193e6
jmp 0x14011951e
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
movabs r8, 0xc7a8330c8f92aa82
movabs r9, 0x3857ccf3706d557d
xor r8, r9
add rdx, r8
mov qword [rax], rdx
mov rax, qword [0x1401eb4d0]
call qword [rax]
nop
add rsp, 0x58
ret
invalid
Function at 0x14011bda0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov eax, dword [0x1401dc8f8]
mov r8d, dword [0x1401dc8fc]
mov ecx, 0x8a604ffd
xor ecx, 0x759fb002
mov r9d, r8d
xor r9d, ecx
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
mov r9d, 0xe07a233d
xor r9d, 0x1f85dcc2
xor ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, eax
and ecx, 0x9b454ba7
xor ecx, 0xffffffff
mov edx, 0x9115da72
xor edx, 0xa5091d5
add eax, edx
mov edx, 0x23ead3ed
xor edx, 0x23ead3ec
add eax, edx
add eax, ecx
imul eax, eax, 0x4563d254
mov ecx, 0x8a536cec
xor ecx, 0x5c34c059
xor edx, edx
div ecx
cmp eax, 0x37aa65b6
jae 0x14011befb
mov eax, dword [0x1401dc900]
mov ecx, dword [0x1401dc904]
xor ecx, 0x8b387f0c
xor edx, edx
div ecx
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xc1350c79
and ecx, 0x3ecaf386
imul ecx, edx
mov edx, eax
and edx, 0x3ecaf386
or eax, 0x3ecaf386
imul eax, edx
add eax, ecx
mov ecx, eax
not ecx
and ecx, 0xb643393
and eax, 0xf49bcc6c
sub eax, ecx
and eax, 0xece52227
mov dword [rbp - 0xc], eax
mov eax, 0x10
call fcn.1401d4340
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
sub rsp, 0x20
call fcn.14014b160
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov qword [rcx], 0
mov rdx, qword [rax + 0x10]
xor eax, eax
mov r8b, al
xor r8b, 0
and r8b, 1
sub rsp, 0x20
call fcn.140012c00
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbp - 0xc]
add rsp, 0x20
mov rcx, qword [rcx]
mov qword [rbp - 8], rcx
cmp eax, 0x39cf58cc
je 0x14011be39
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
nop
pop rsi
sbb al, 0xac
jmp 0x14011be39
Function at 0x140122060
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1401dcba8]
mov edx, dword [0x1401dcbac]
mov ecx, 0x9e18fa2c
xor ecx, 0x9e18fa2c
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, eax
xor ecx, 0xb69273a3
mov edx, 0xffffffff
xor edx, 0xb69273a3
and eax, edx
shl eax, 1
sub eax, ecx
sub eax, 0x603f72de
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x1ffa995c
add ecx, eax
xor eax, eax
sub eax, ecx
cmp eax, 0x8d3b9cc3
ja 0x1401221b9
mov eax, dword [0x1401dcbb0]
add eax, dword [0x1401dcbb4]
add eax, 0xfecf73d6
sub eax, 0x88741156
sub eax, 0xfecf73d6
mov ecx, 0x1d49c9cb
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x40]
imul eax, eax, 0xc0c278f8
mov ecx, 0xe354f0bd
xor ecx, 0x6d6ff22
add rdx, 8
mov qword [rsp + 0x30], rdx
cmp eax, ecx
jae 0x1401220cc
xor eax, eax
mov qword [rsp + 0x28], rax
jmp 0x140122123
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
cmp rax, qword [rcx]
jge 0x1401221b4
mov rax, qword [rsp + 0x20]
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
add rcx, 8
shl rax, 3
add rcx, rax
lea rdx, [0x1401dc768]
call fcn.1401221c2
mov rax, qword [rsp + 0x20]
movabs rcx, 0x71dbbd4fc1411158
add rax, rcx
movabs rcx, 0x9059ca35016856af
movabs rdx, 0x9059ca35016856ae
xor rcx, rdx
add rax, rcx
movabs rcx, 0x58b37782773d4d15
movabs rdx, 0x2968cacdb67c5c4d
xor rcx, rdx
sub rax, rcx
mov qword [rsp + 0x28], rax
jmp 0x140122123
add rsp, 0x48
ret
invalid
Function at 0x1401238b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x48], rax
mov rax, rdx
add rax, 8
mov qword [rsp + 0x50], rax
mov rcx, qword [rdx + 8]
mov qword [rsp + 0x58], rcx
xor eax, eax
cmp rcx, 0
mov qword [rsp + 0x60], rax
je 0x140123910
mov rcx, qword [rsp + 0x58]
call fcn.140122c50
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
mov qword [r8], r9
mov rdx, qword [rdx]
mov qword [rax], rdx
call fcn.140123570
test al, 1
jne 0x140123944
jmp 0x1401239e6
mov ecx, dword [0x1401dcc58]
mov edx, dword [0x1401dcc5c]
mov eax, ecx
or eax, edx
xor eax, 0xffffffff
or ecx, edx
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0x8ec86208
xor ecx, 0x71379df7
xor eax, ecx
add eax, 0x14b27a68
mov ecx, 0x2063385f
xor ecx, 0xea52c084
add eax, ecx
mov ecx, 0x74211ea1
xor ecx, 0x843cbc51
and eax, ecx
cmp eax, 0xe4f2b97b
je 0x140123a95
mov rcx, qword [rsp + 0x48]
mov eax, dword [0x1401dcc60]
or eax, dword [0x1401dcc64]
mov r8d, 0xbf68f512
xor edx, edx
div r8d
mov r8d, 0x7d5ddfd7
xor edx, edx
div r8d
mov edx, 0xaa30aaad
xor edx, 0xc559e554
and eax, edx
mov dword [rsp + 0x2c], eax
call fcn.140010050
mov eax, dword [rsp + 0x2c]
cmp eax, 0x379b68e7
je 0x140123995
jmp 0x1401239e6
mov eax, dword [0x1401dcc68]
mov r8d, dword [0x1401dcc6c]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
and eax, 0xf454a232
and eax, 0x5fc3e2c5
sub eax, 0x42987f68
mov ecx, 0xa8cbcc90
xor ecx, 0xe8fe5751
add eax, ecx
mov ecx, 0x1eb94e49
xor ecx, 0x5c213121
add eax, ecx
cmp eax, 0x2ad1c61a
je 0x140123a9e
mov eax, dword [0x1401dcc70]
mov ecx, dword [0x1401dcc74]
sub eax, 0x85919caa
sub eax, ecx
add eax, 0x85919caa
mov ecx, 0x3bab841b
xor ecx, 0x6952c0f5
xor eax, ecx
xor ecx, ecx
sub ecx, 0x92c1c7d4
add eax, ecx
mov ecx, 0x13f7f828
xor edx, edx
div ecx
cmp eax, 0x8a0cf519
jae 0x140123a4d
add rsp, 0x68
ret
fst dword [rdi - 0x4d]
stc
jmp 0x140123995
and eax, 0xe918c8d0
cmpsb byte [rsi], byte [rdi]
invalid
Function at 0x140131eb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov rax, qword [rcx]
mov qword [rsp + 0x38], rax
movabs rcx, 0xa1e35fd616b228cc
movabs rdx, 0xa1e35fd616b228ce
xor rcx, rdx
cqo
idiv rcx
mov r8, rax
mov rax, qword [rsp + 0x38]
movabs rcx, 0xf8fe844bd0a0013b
mov rdx, r8
sub rdx, rcx
add rdx, 0xffffffffffffffff
movabs rcx, 0xf8f13b2ed253eb98
movabs r9, 0xfbf6502f3eaa3
xor rcx, r9
add rdx, rcx
mov qword [rsp + 0x40], rdx
movabs rcx, 0xee7927565ef2c609
movabs r9, 0x1186d8a9a10d39f6
xor rcx, r9
mov r9, rdx
xor r9, rcx
mov rcx, r8
and rcx, r9
xor r8, 0xffffffffffffffff
and rdx, r8
or rcx, rdx
movabs rdx, 0xf56c3f63fba655ec
movabs r8, 0xf56c3f63fba655ec
xor rdx, r8
cmp rcx, rdx
setl cl
movabs rdx, 0x5f97b294a926181
movabs r8, 0x5f97b294a926180
xor rdx, r8
cmp rax, rdx
setg dl
xor eax, eax
mov r8b, al
xor r8b, 1
mov al, dl
xor al, r8b
xor r8d, r8d
xor r8b, 1
xor dl, r8b
and al, dl
or cl, cl
xor edx, edx
xor dl, 1
xor cl, dl
mov dl, 1
xor dl, 0
xor al, dl
xor cl, 0xff
and al, cl
test al, 1
jne 0x140131fb6
jmp 0x140132065
mov eax, dword [0x1401dd248]
mov ecx, 0xd496d6f1
xor ecx, 0x61865e89
xor eax, ecx
mov edx, dword [0x1401dd24c]
xor edx, 0x6a09a376
mov ecx, eax
and ecx, edx
shl ecx, 1
xor eax, edx
add eax, ecx
mov ecx, 0xe59ac3d1
xor ecx, 0xd35167b8
and eax, ecx
mov ecx, 0x6ced50a7
xor ecx, 0x87e428ce
xor eax, ecx
add eax, 0x48ff5be0
cmp eax, 0x6628ac7e
ja 0x14013214a
mov eax, dword [0x1401dd250]
xor edx, edx
div dword [0x1401dd254]
xor eax, 0x8c50dde2
mov ecx, 0xbfe79ef3
xor ecx, 0x796472fc
xor eax, ecx
mov ecx, 0x53147439
xor ecx, 0x2a3c5877
xor edx, edx
div ecx
mov dword [rsp + 0x34], eax
mov eax, 0x7b4d815e
xor eax, 0xa4c667f4
mov dword [rsp + 0x30], eax
call fcn.1400077a3
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
cmp eax, ecx
jae 0x14013200a
jmp 0x140132078
mov rcx, qword [rsp + 0x40]
xor eax, eax
test rcx, rcx
cmovg rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
mov eax, dword [0x1401dd258]
sub eax, dword [0x1401dd25c]
mov ecx, 0x8063f092
xor ecx, 0x452a2d7f
and eax, ecx
or eax, 0x5bf7f77e
mov ecx, 0xd7e6bcfd
xor ecx, 0x25e4a2eb
and eax, ecx
cmp eax, 0x8c164ef8
je 0x140132153
mov eax, dword [0x1401dd260]
xor edx, edx
div dword [0x1401dd264]
mov r11d, eax
mov eax, r11d
xor eax, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0x9bc0fb6e
mov edx, 0xffffffff
xor edx, 0x23609811
mov ecx, eax
and ecx, 0x23609811
and r11d, edx
mov r9d, r8d
and r9d, 0x23609811
mov r10d, edx
and r10d, 0x9bc0fb6e
or ecx, r11d
or r9d, r10d
xor ecx, r9d
or eax, r8d
xor eax, 0xffffffff
or edx, 0x23609811
and eax, edx
or ecx, eax
mov edx, 0xffffffff
xor edx, 0x3bfe2854
mov eax, ecx
xor eax, edx
and eax, ecx
and eax, 0x9a9d1aad
cmp eax, 0xcb60441
jbe 0x140132153
mov rax, qword [rsp + 0x20]
add rsp, 0x48
ret
xchg ebp, eax
or eax, 0xb7e96923
invalid
pop rdi
movsxd rbp, ecx
pop rsp
invalid
Function at 0x140132370
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401dd278]
xor eax, 0x681453fd
or eax, dword [0x1401dd27c]
mov ecx, 0x2513ebb4
xor ecx, 0x88f29a95
add eax, ecx
add eax, 0x635dc0b3
sub eax, 0xade17121
or eax, 0xf67216bf
imul eax, eax, 0x13f7deba
cmp eax, 0x53a1f89d
je 0x140132440
mov eax, dword [0x1401dd280]
xor edx, edx
div dword [0x1401dd284]
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0xc97c55a5
mov edx, 0xac9c90e1
xor edx, 0x65e0c544
mov r8d, 0x6de654c1
xor r8d, 0x9219ab3e
xor edx, r8d
and eax, edx
sub eax, ecx
imul eax, eax, 0x3f06ec1
xor eax, 0x53804f1
mov dword [rsp + 0x24], eax
call fcn.14014b160
mov rcx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x24]
mov r8, qword [rcx]
mov rcx, qword [rcx + 8]
add rcx, 8
lea rdx, [0x1401eadb8]
cmp r8, 0
cmove rcx, rdx
mov qword [rsp + 0x28], rcx
cmp eax, 0xcbcc24dd
jae 0x1401323b7
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret
cmp eax, 0xe98190c2
outsb dx, byte [rsi]
invalid

Function at 0x140132450
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
call fcn.14014b160
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x58], rax
add rax, 0x60
mov qword [rsp + 0x50], rax
mov rax, qword [rdx]
mov qword [rsp + 0x78], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x78]
call fcn.140132370
mov rcx, rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rcx
cmp byte [rax + 0x60], 0
jne 0x1401325ca
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax]
mov qword [rsp + 0x68], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x68]
call fcn.140131eb0
mov rcx, rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rcx
cmp byte [rax], 0
jne 0x1401325ca
mov rax, qword [rsp + 0x30]
cmp rax, 0
jge 0x1401325b6
mov eax, dword [0x1401dd288]
mov ecx, dword [0x1401dd28c]
mov edx, 0xa31543f2
xor edx, 0x213853c3
xor ecx, edx
xor eax, ecx
and eax, 0x71ca503a
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0x43b148ee
add eax, ecx
add eax, 0x66f515b2
cmp eax, 0x9d85f6d4
jae 0x1401325d7
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401dd290]
mov edx, 0x6d791985
xor edx, 0x5cf14ef2
xor eax, edx
mov edx, dword [0x1401dd294]
mov r8d, 0xdb10dddf
xor r8d, 0x82edf932
xor edx, r8d
add eax, edx
mov r8d, 0x4b7ef84c
xor edx, edx
div r8d
sub eax, 0x7f4c4d7b
sub eax, 0x37b4d87a
mov dword [rsp + 0x2c], eax
mov eax, 0x525d50a
xor eax, 0x6a8b47d3
mov dword [rsp + 0x28], eax
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
call fcn.14000d167
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
ja 0x140132537
jmp 0x1401325ca
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
call fcn.140097445
mov rax, qword [rsp + 0x40]
add rsp, 0x88
ret
invalid
Function at 0x140134a30
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov dword [rbp - 0x14], r8d
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401dd3d8]
add eax, dword [0x1401dd3dc]
sub eax, 0xe4d046f4
xor eax, 0x9c3c7e82
mov ecx, 0x259be614
xor edx, edx
div ecx
cmp eax, 0x8a8bcdc4
ja 0x140134c7b
mov eax, dword [0x1401dd3e0]
mov ecx, dword [0x1401dd3e4]
xor eax, ecx
xor eax, 0x3001000
or eax, 0xfc6faefb
imul eax, eax, 0xa57175b0
mov dword [rbp - 0x1c], eax
mov eax, 0x10
mov qword [rbp - 0x58], rax
call fcn.1401d4340
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov rcx, rsp
mov qword [rbp - 0x60], rcx
call fcn.1401d4340
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov rcx, rsp
mov qword [rbp - 0x38], rcx
call fcn.1401d4340
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov rcx, rsp
mov qword [rbp - 0x40], rcx
call fcn.1401d4340
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x50], rax
sub rsp, 0x20
call fcn.14014b160
add rsp, 0x20
mov qword [rbp - 0x28], rax
add rax, 0x60
mov qword [rbp - 0x48], rax
mov ecx, 0x68
mov edx, 8
sub rsp, 0x20
call fcn.1400133d1
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov r8, rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x30], r8
mov r9b, 2
xor r9b, 3
mov byte [r8], r9b
mov qword [r8 + 0x38], 0
mov qword [r8 + 0x40], 0
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140120cd0
mov r8, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
mov eax, dword [rbp - 0x1c]
add rsp, 0x20
mov r9, qword [r8]
mov qword [rdx + 0x48], r9
mov r8, qword [r8 + 8]
mov qword [rdx + 0x50], r8
cmp byte [rcx + 0x60], 0
sete cl
mov byte [rbp - 0x15], cl
cmp eax, 0xa7011d73
jae 0x140134a76
mov dl, byte [rbp - 0x15]
mov cl, 1
xor eax, eax
test dl, 1
mov byte [rbp - 0x69], cl
mov qword [rbp - 0x68], rax
jne 0x140134baf
jmp 0x140134c1b
mov rax, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x48]
mov edx, dword [rbp - 0x14]
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x10]
mov r10, qword [r9]
mov qword [r8], r10
mov r10, qword [r9 + 8]
mov qword [r8 + 8], r10
movabs r10, 0x8114e3321aa71399
movabs r11, 0x8114e3321aa71399
xor r10, r11
mov qword [r9], r10
mov qword [r9 + 8], 0
mov r9, qword [r8]
mov qword [rax + 0x58], r9
mov r8, qword [r8 + 8]
mov qword [rax + 0x60], r8
mov dword [rax + 0x24], edx
mov edx, 0x28c233bc
xor edx, 0xd73dcc43
mov dword [rax + 0x20], edx
mov cl, byte [rcx]
mov byte [rbp - 0x69], cl
mov qword [rbp - 0x68], rax
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x10]
mov r8b, byte [rbp - 0x69]
mov r9, qword [rbp - 0x68]
mov qword [rbp - 0x78], r9
mov byte [rbp - 0x6a], r8b
mov r8b, 0xc7
xor r8b, 0xc7
mov byte [rdx], r8b
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.14011db90
mov rax, qword [rbp - 0x48]
add rsp, 0x20
cmp byte [rax], 0
jne 0x140134c72
mov rax, qword [rbp - 0x48]
mov cl, byte [rbp - 0x6a]
mov byte [rax], cl
mov rax, qword [rbp - 0x78]
mov rsp, rbp
pop rbp
ret
sub dl, byte [rcx - 0xd168ae5]
std
invalid