joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400aa3e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14022bc60]
mov qword [rsp + 0x58], rax
mov rax, qword [0x14022bc68]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x58]
call fcn.140008c50
mov qword [0x14023e018], rax
cmp rax, 0
mov qword [rsp + 0x40], rax
jne 0x1400aa5af
mov eax, dword [0x14021b528]
mov edx, dword [0x14021b52c]
mov ecx, 0x79f14482
xor ecx, 0xb4e6d8c3
xor edx, ecx
xor ecx, ecx
sub ecx, eax
mov eax, 0xb3146888
xor eax, 0xb3146888
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
imul eax, eax, 0x654ee9f8
mov ecx, 0xa676d1f2
xor ecx, 0x18f68be5
or eax, ecx
mov ecx, eax
and ecx, 0xea050181
xor ecx, 0xffffffff
mov edx, 0x9323e0f5
xor edx, 0x7926e174
add eax, edx
add eax, 1
add eax, ecx
mov ecx, 0x23f603b3
xor ecx, 0x1b681ce4
cmp eax, ecx
je 0x1400aa680
mov r11d, dword [0x14021b530]
mov ecx, dword [0x14021b534]
mov edx, 0x2519d3c3
xor edx, 0xdae62c3c
mov eax, r11d
xor eax, edx
and eax, ecx
mov edx, 0xe42935f4
xor edx, 0x1bd6ca0b
xor ecx, edx
and r11d, ecx
sub r11d, eax
mov eax, r11d
xor eax, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0x265511a6
mov edx, 0xffffffff
xor edx, 0x866cd502
mov ecx, eax
and ecx, 0x866cd502
and r11d, edx
mov r9d, r8d
and r9d, 0x866cd502
mov r10d, edx
and r10d, 0x265511a6
or ecx, r11d
or r9d, r10d
xor ecx, r9d
or eax, r8d
mov r8d, 0xb05bc73f
xor r8d, 0x4fa438c0
xor eax, r8d
or edx, 0x866cd502
and eax, edx
or ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xbe2fc9c2
xor edx, 0x136b653d
mov r8d, 0x7606387e
xor r8d, 0x89f9c781
xor edx, r8d
or eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xad44acff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
add eax, 0x8ddcd619
mov dword [rsp + 0x34], eax
mov rax, qword [0x14022bc70]
mov qword [rsp + 0x48], rax
mov rax, qword [0x14022bc78]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
call fcn.140008da8
mov eax, dword [rsp + 0x34]
mov rcx, qword [0x14023e018]
mov qword [rsp + 0x38], rcx
cmp eax, 0x17c7da05
je 0x1400aa680
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
jmp 0x1400aa5af
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov eax, dword [0x14021b538]
mov edx, dword [0x14021b53c]
mov ecx, edx
and ecx, eax
xor ecx, 0xffffffff
add eax, edx
add eax, 1
add eax, ecx
mov ecx, 0x5e94981d
xor edx, edx
div ecx
or eax, 0x213ededd
and eax, 0x3bf14d47
cmp eax, 0xab850498
jae 0x1400aa689
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x14021b540]
and eax, dword [0x14021b544]
mov edx, 0x29c07d0
xor edx, 0xc2597b0c
add eax, edx
mov edx, 0x9e04ea08
xor edx, 0x6c3e5b7d
add eax, edx
mov edx, 0xe3ebb042
xor edx, 0x7e13c7c2
sub eax, edx
mov dword [rsp + 0x24], eax
mov eax, 0xd3c6e556
xor eax, 0x57bbb89f
mov dword [rsp + 0x20], eax
lea rdx, str.SysAllocStringByteLen
call fcn.140008e60
mov qword [0x14023e020], rax
mov rcx, qword [0x14023e018]
lea rdx, str.SysStringByteLen
call fcn.140008e60
mov ecx, dword [rsp + 0x20]
mov rdx, rax
mov eax, dword [rsp + 0x24]
mov qword [0x14023e028], rdx
cmp eax, ecx
je 0x1400aa5f1
add rsp, 0x68
ret
lodsd eax, dword [rsi]
xchg edx, eax
jmp 0x1400aa48e
add ecx, 0x77
cmp cl, ch
pop rdi
invalid
Function at 0x1400ad6bd
Capabilities:
Get thread local storage value

Disassembly:
mov rax, qword [0x14022dd30]
mov ecx, dword [rax]
jmp fcn.140008650
Function at 0x1400bc07e
Capabilities:
Get thread local storage value

Disassembly:
mov rax, qword [0x14022dd30]
mov ecx, dword [rax]
jmp fcn.140008650

Function at 0x1400bccb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14021bb70]
mov ecx, dword [0x14021bb74]
xor ecx, 0x8f37984c
xor eax, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x1d1808af
or eax, ecx
mov ecx, 0xf5f307cb
xor ecx, 0xe8eb0f64
or ecx, edx
xor eax, 0xffffffff
and eax, ecx
or eax, 0xe002afd3
add eax, 0x4b7cf4aa
mov ecx, 0x429e871e
xor ecx, 0xec44ce3f
sub eax, ecx
sub eax, 0x4b7cf4aa
mov r8d, 0xffffffff
xor r8d, 0xfaacf1ee
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x400f8c01
xor r8d, 0xbff073fe
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xfaacf1ee
or eax, 0xfaacf1ee
imul eax, edx
add eax, ecx
cmp eax, 0x3fe9b5f5
jbe 0x1400bcdb4
mov eax, dword [0x14021bb78]
add eax, dword [0x14021bb7c]
mov ecx, 0xe2612ff0
xor ecx, 0x879da578
mov edx, 0x7954a378
xor edx, 0x86ab5c87
xor ecx, edx
add eax, ecx
add eax, 1
sub eax, 0xd046a3f5
imul eax, eax, 0x8a7bc09b
mov dword [rsp + 0x24], eax
mov eax, 0x4dc06aa2
xor eax, 0xef973cb2
mov dword [rsp + 0x20], eax
call fcn.1400bca41
call qword [0x14023e388]
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
je 0x1400bcd4e
add rsp, 0x28
ret
invalid
Function at 0x1400be400
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov eax, dword [0x14021bc00]
mov ecx, dword [str.Q_L_]
xor ecx, 0xffffffff
add eax, ecx
add eax, 1
sub eax, 0x84181de1
mov ecx, 0x73d53084
xor edx, edx
div ecx
mov ecx, 0xd99ec672
xor ecx, 0x4ff47ae1
sub eax, ecx
sub eax, 0x31c32f19
add eax, 0x966abc93
mov ecx, 0x3fc90e8d
xor ecx, 0x66619208
cmp eax, ecx
jbe 0x1400be65a
mov eax, dword [0x14021bc08]
mov ecx, dword [0x14021bc0c]
mov edx, 0x2f144b2f
xor edx, 0x1d4f1ed4
xor ecx, edx
add eax, ecx
mov ecx, 0x9c4efbd5
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
or eax, eax
xor eax, 0xffffffff
mov edx, 0x8c809e8b
xor edx, 0xa6b67d4c
mov r8d, 0xaa1205d7
xor r8d, 0x55edfa28
xor edx, r8d
mov r8d, 0x6ad0c038
xor r8d, 0x40e623ff
mov r9d, 0xf80dda69
xor r9d, 0x7f22596
xor r8d, r9d
and edx, r8d
or eax, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0xebdc97c0
xor edx, 0xc1ea7407
mov r8d, 0x631e9b76
xor r8d, 0x9ce16489
xor edx, r8d
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0xdbd016c
xor ecx, 0x559acb53
and eax, ecx
mov dword [rsp + 0x3c], eax
mov eax, 0x5023c367
xor eax, 0xdcca7208
mov dword [rsp + 0x38], eax
call fcn.1400be3e4
mov ecx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x3c]
cmp eax, ecx
je 0x1400be65a
xor eax, eax
mov qword [rsp + 0x30], rax
jmp 0x1400be527
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov eax, dword [0x14021bc10]
mov ecx, dword [0x14021bc14]
xor ecx, 0x1b3fe51f
and eax, ecx
mov ecx, 0x11d63120
xor ecx, 0xd8b614dc
xor edx, edx
div ecx
sub eax, 0x2a06849d
add eax, 0xb5c27fba
cmp eax, 0xa290ccd
jb 0x1400be663
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x14021bc18]
add eax, dword [0x14021bc1c]
sub eax, 0x7d2446e0
mov r8d, 0xb5e38f3c
xor edx, edx
div r8d
xor eax, 0xa6fafa80
cmp rcx, 0x10
sete cl
mov byte [rsp + 0x27], cl
cmp eax, 0x54c0c6ca
jb 0x1400be569
mov al, byte [rsp + 0x27]
test al, 1
jne 0x1400be5d6
jmp 0x1400be5b6
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
mov dl, 0x36
xor dl, 0x36
mov byte [rcx + rax], dl
add rax, 1
mov qword [rsp + 0x30], rax
jmp 0x1400be527
mov eax, dword [0x14021bc20]
xor eax, 0x68695624
mov ecx, dword [0x14021bc24]
xor ecx, 0x581af195
xor eax, ecx
mov ecx, 0x50ead3
xor ecx, 0xb44abd64
and eax, ecx
xor ecx, ecx
sub ecx, 0x1b2524ec
sub eax, ecx
sub eax, 0x725fd686
cmp eax, 0x66db7276
ja 0x1400be66c
mov eax, dword [0x14021bc28]
xor eax, 0x90f48297
xor edx, edx
div dword [0x14021bc2c]
mov ecx, 0x960b6e7
xor ecx, 0xee331262
xor edx, edx
div ecx
and eax, 0x7789ac1b
mov ecx, 0x13b97082
xor ecx, 0xf84b371d
xor eax, ecx
cmp eax, 0xd445802d
jbe 0x1400be66c
add rsp, 0x48
ret
push rbp
test al, 0x23
enter 0xfffffffffffff2e9, 0xfffffffffffffffd
invalid
mov ch, 0x31
cmp al, 0xe9
std
invalid
xchg dword [rbx - 0x5e167e9f], eax
invalid
Function at 0x1400c10f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14022be88]
mov qword [rsp + 0x58], rax
mov rax, qword [0x14022be90]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x58]
call fcn.140008c50
mov qword [0x14023e490], rax
cmp rax, 0
mov qword [rsp + 0x40], rax
jne 0x1400c1234
mov eax, dword [0x14021bd90]
sub eax, dword [0x14021bd94]
add eax, 0x3c28aae7
or eax, 0x5894ce88
and eax, 0x47c67523
mov ecx, 0xf9359ac5
xor ecx, 0x9fb64ca5
cmp eax, ecx
ja 0x1400c133a
mov eax, dword [0x14021bd98]
or eax, dword [0x14021bd9c]
sub eax, 0xaeda4921
mov ecx, 0x5d235385
xor ecx, 0xa2dcac7a
mov edx, eax
xor edx, ecx
and edx, 0xfaacf1ee
mov r8d, 0xffffffff
xor r8d, 0xfaacf1ee
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xfaacf1ee
or eax, 0xfaacf1ee
imul eax, edx
add eax, ecx
mov r8d, 0x75ee0b53
xor r8d, 0x4b1dc39
mov ecx, 0xbb88d0f9
xor ecx, 0x44772f06
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x715fd76a
or eax, 0x715fd76a
imul eax, edx
add eax, ecx
mov dword [rsp + 0x34], eax
mov rax, qword [0x14022be98]
mov qword [rsp + 0x48], rax
mov rax, qword [0x14022bea0]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
call fcn.140008da8
mov eax, dword [rsp + 0x34]
mov rcx, qword [0x14023e490]
mov qword [rsp + 0x38], rcx
cmp eax, 0xe231ec7a
ja 0x1400c115a
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
jmp 0x1400c1234
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov eax, dword [0x14021bda0]
mov ecx, dword [0x14021bda4]
add eax, 0x2b1f3b02
sub eax, ecx
sub eax, 0x2b1f3b02
mov ecx, 0x8295fc86
xor ecx, 0x8295fc86
mov edx, 0xa93f6d69
xor edx, 0x7979ce9c
sub ecx, edx
add eax, ecx
mov ecx, 0xb08d616e
xor ecx, 0x4f729e91
mov edx, eax
xor edx, ecx
and edx, 0x8a7bc09b
mov r8d, 0x21893151
xor r8d, 0xabf2f1ca
mov ecx, 0x393558c9
xor ecx, 0xc6caa736
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x8a7bc09b
mov r8d, 0x7b436632
xor r8d, 0xf138a6a9
or eax, r8d
imul eax, edx
add eax, ecx
add eax, 0x2f4cb9e4
cmp eax, 0x8768077c
jae 0x1400c1343
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x14021bda8]
mov edx, dword [0x14021bdac]
xor edx, 0x415ae548
sub eax, edx
add eax, 0xa767bd49
mov edx, 0xcc46e0b6
xor edx, 0x51a8e37e
imul eax, edx
mov r8d, 0x1f6ae8e1
xor edx, edx
div r8d
mov dword [rsp + 0x24], eax
lea rdx, str.ShellExecuteW
call fcn.140008e60
mov rcx, rax
mov eax, dword [rsp + 0x24]
mov qword [0x14023e498], rcx
cmp eax, 0x1d1808af
jae 0x1400c12d5
add rsp, 0x68
ret
push r15
xchg ecx, eax
cmp ch, cl
invalid
fcom qword [rbx]
call 0x1400b9d34
dec dword [rdi]
invalid
Function at 0x1400c9ca0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov eax, dword [0x14021c110]
mov ecx, 0x61d91f18
xor ecx, 0x99f0cbee
xor eax, ecx
mov r8d, dword [0x14021c114]
mov ecx, 0xa68af301
xor ecx, 0x59750cfe
mov r9d, r8d
xor r9d, ecx
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
sub eax, 0xbe359582
mov ecx, 0xba338b69
xor ecx, 0xe411e355
sub eax, ecx
add eax, 0xbe359582
mov ecx, eax
xor ecx, 0xffffffff
xor eax, 0xffffffff
or ecx, eax
mov eax, 0xffffffff
xor eax, 0xdc2311cd
mov edx, 0xffffffff
xor edx, 0xdc2311cd
or eax, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
or ecx, eax
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0xf7e4f1f
and ecx, 0xf7e4f1f
mov edx, 0xb3eacced
xor edx, 0x4c153312
xor ecx, edx
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0xf68c0769
xor ecx, 0xb5a5236
cmp eax, ecx
ja 0x1400c9f0f
mov ecx, dword [0x14021c118]
mov edx, dword [0x14021c11c]
xor edx, 0xa9a5cfbe
xor eax, eax
sub eax, ecx
mov ecx, 0x6608afc3
xor ecx, 0x6608afc3
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
add ecx, 0x27f06bcb
or ecx, 0x52ab2a25
mov eax, ecx
and eax, 0x5dfe8686
mov edx, 0xb68e7e49
xor edx, 0xeb70f8cf
xor ecx, edx
or eax, ecx
mov dword [rsp + 0x3c], eax
call fcn.1400e0976
mov rdx, qword [rsp + 0x48]
mov eax, dword [rsp + 0x3c]
xor ecx, ecx
test rdx, rdx
cmovg rcx, rdx
mov qword [rsp + 0x40], rcx
cmp eax, 0x676e6025
jb 0x1400c9d70
xor eax, eax
mov qword [rsp + 0x30], rax
jmp 0x1400c9df2
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp rax, rcx
je 0x1400c9e75
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov byte [rcx + rax], 0
xor ecx, ecx
sub rcx, rax
movabs rax, 0xce56d91c09f59b42
movabs rdx, 0xce56d91c09f59b42
xor rax, rdx
movabs rdx, 0x2c15152fb1cc3bab
movabs r8, 0x2c15152fb1cc3baa
xor rdx, r8
sub rax, rdx
add rcx, rax
movabs rax, 0xdcd2b951e4488a1e
movabs rdx, 0xdcd2b951e4488a1e
xor rax, rdx
sub rax, rcx
mov qword [rsp + 0x30], rax
jmp 0x1400c9df2
mov eax, dword [0x14021c120]
xor eax, 0x8d653770
xor eax, dword [0x14021c124]
sub eax, 0x6d97b748
mov ecx, 0xc2a9dcee
xor edx, edx
div ecx
mov ecx, 0xbeb9843e
xor ecx, 0x35396303
add eax, ecx
cmp eax, 0x911b02a6
ja 0x1400c9f18
mov ecx, dword [0x14021c128]
mov eax, dword [0x14021c12c]
mov edx, 0xa1a1400d
xor edx, 0x175272a4
add ecx, edx
add ecx, eax
sub ecx, 0xb6f332a9
mov eax, ecx
and eax, 0x45dedee0
mov edx, 0xe8e89ee3
xor edx, 0xad364003
or ecx, edx
add eax, ecx
sub eax, 0x7f7a8570
mov ecx, 0x4bd00de9
xor ecx, 0x20ecc612
add eax, ecx
add eax, 0x7f7a8570
xor eax, 0x27064d52
cmp eax, 0xc8183f27
jae 0x1400c9eac
add rsp, 0x58
ret
pushfq
sbb dword [rcx - 5], ebp
jmp 0x1400c9d70
xchg edx, eax
and ebx, eax
jmp 0x1400c9eac
Function at 0x1400cdac0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov eax, dword [0x14021c2d0]
xor edx, edx
div dword [0x14021c2d4]
or eax, eax
mov ecx, 0x73008701
xor ecx, 0x8cff78fe
xor eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x1a86bb08
mov edx, 0xffffffff
xor edx, 0x1a86bb08
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0xe6ce1343
xor ecx, 0x66499402
xor edx, edx
div ecx
sub eax, 0x9103abe3
cmp eax, 0xff941175
je 0x1400cdc80
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x14021c2d8]
xor eax, 0xcbf4417a
mov r8d, dword [0x14021c2dc]
xor r8d, 0x79ba0bd0
xor edx, edx
div r8d
mov edx, eax
mov eax, 0x643a4638
xor eax, 0xee6a9f1b
xor edx, eax
xor eax, eax
sub eax, 0x927ec8a2
add edx, eax
mov r8d, 0x5423c680
xor r8d, 0x5e6cd010
mov eax, edx
and eax, r8d
or edx, 0xa4f1690
add eax, edx
cmp rcx, 0
sete cl
mov byte [rsp + 0x3f], cl
cmp eax, 0x76757bb0
ja 0x1400cdb25
mov cl, byte [rsp + 0x3f]
xor eax, eax
test cl, 1
mov byte [rsp + 0x3e], al
jne 0x1400cdc72
jmp 0x1400cdba7
mov rax, qword [rsp + 0x40]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax - 0x10]
mov qword [rsp + 0x30], rcx
mov al, 1
cmp rcx, 0x10
mov byte [rsp + 0x3e], al
jb 0x1400cdc72
mov rcx, qword [rsp + 0x30]
xor eax, eax
mov edx, eax
sub rdx, 0xfffffffffffffff0
mov rax, rcx
sub rax, rdx
mov qword [rsp + 0x20], rax
mov r8, rax
xor r8, rcx
xor r8, 0xffffffffffffffff
mov rdx, rcx
and rdx, r8
shl rdx, 1
sub rdx, rcx
mov rcx, rax
sub rcx, rdx
cmp rcx, 0
setl dl
movabs rcx, 0x79ea56d53f7e1152
movabs r8, 0x8615a92ac081eead
xor rcx, r8
cmp rax, rcx
setg al
xor ecx, ecx
xor cl, 1
xor al, cl
xor dl, 0xff
mov cl, 1
xor cl, 0
or al, dl
or cl, 0
xor al, 0xff
and al, cl
test al, 1
jne 0x1400cdc4f
jmp 0x1400cdc5f
call fcn.140008bc6
xor eax, eax
mov byte [rsp + 0x3e], al
jmp 0x1400cdc72
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x3e], al
mov al, byte [rsp + 0x3e]
and al, 1
movzx eax, al
add rsp, 0x48
ret
or al, 0x75
pop rcx
jmp 0x1400cdb25
Function at 0x1400dbf60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov r11d, dword [0x14021c990]
xor r11d, 0xd4c62f1d
mov ecx, dword [0x14021c994]
mov eax, r11d
and eax, ecx
shl eax, 1
add r11d, ecx
sub r11d, eax
mov ecx, 0x682c1899
xor ecx, 0x97d3e766
mov eax, r11d
xor eax, ecx
mov r8d, 0x1d8f5940
xor r8d, 0x6e2c4e74
mov ecx, 0x1de7a28f
xor ecx, 0xe2185d70
xor r8d, ecx
mov edx, 0xffffffff
xor edx, 0x287d996a
mov ecx, eax
and ecx, 0x287d996a
and r11d, edx
mov r9d, r8d
and r9d, 0x287d996a
mov r10d, edx
and r10d, 0x73a31734
or ecx, r11d
or r9d, r10d
xor ecx, r9d
or eax, r8d
xor eax, 0xffffffff
or edx, 0x287d996a
and eax, edx
or ecx, eax
xor ecx, 0x9f4ef6bf
mov eax, ecx
and eax, eax
xor eax, 0xffffffff
and eax, 0xeb1282d9
mov edx, 0xd3bea9ab
xor edx, 0x2c415654
xor eax, edx
mov edx, 0xd6efca7a
xor edx, 0x3dfd48a3
mov r8d, 0x8ab271c6
xor r8d, 0x61a0f31f
and edx, r8d
mov r8d, 0xedb0acae
xor r8d, 0x124f5351
xor edx, r8d
and ecx, edx
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
cmp eax, 0x382b4453
ja 0x1400dc207
mov eax, dword [0x14021c998]
mov ecx, dword [0x14021c99c]
xor ecx, 0x4d6b45d6
mov edx, 0x67f7ead0
xor edx, 0x9808152f
xor ecx, edx
add eax, ecx
add eax, 1
mov ecx, 0xfd788cfe
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x20]
mov ecx, 0x3f82db40
xor ecx, 0x94540089
and eax, ecx
mov ecx, 0x74d1f91e
xor ecx, 0xc22962a8
imul eax, ecx
xor ecx, ecx
test rdx, rdx
cmovg rcx, rdx
mov qword [rsp + 0x18], rcx
cmp eax, 0x2d5d5907
jae 0x1400dc062
xor eax, eax
mov qword [rsp + 0x10], rax
jmp 0x1400dc0d4
mov rcx, qword [rsp + 0x18]
mov rax, qword [rsp + 0x10]
mov qword [rsp + 8], rax
cmp rax, rcx
je 0x1400dc202
mov eax, dword [0x14021c9a0]
xor eax, 0xdf9739a
imul eax, dword [0x14021c9a4]
sub eax, 0x7c870ecc
add eax, 0x895e224
mov r8d, 0xffffffff
xor r8d, 0x3ba348cb
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0xca98537f
xor r8d, 0xf13b1bb4
mov edx, eax
and edx, r8d
or eax, 0x3ba348cb
imul eax, edx
add eax, ecx
cmp eax, 0x59e891e4
jb 0x1400dc210
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x28]
mov eax, dword [0x14021c9a8]
mov r9d, dword [0x14021c9ac]
mov r10d, 0xe1e15e30
xor r10d, 0x218d7638
xor r9d, r10d
and eax, r9d
mov r9d, 0x28c89e01
xor r9d, 0xa72f0eae
add eax, r9d
add eax, 0xc26566d4
add eax, 0xdd6c9b17
sub eax, 0xc26566d4
sub eax, 0x11e54e7b
mov r8b, byte [r8 + rcx]
mov byte [rdx + rcx], r8b
movabs rdx, 0x5260a24322a4e5e6
movabs r8, 0x5260a24322a4e5e7
xor rdx, r8
movabs r8, 0xeff9f2123883c831
movabs r9, 0x10060dedc77c37ce
xor r8, r9
xor rdx, r8
xor r8d, r8d
sub r8, 1
sub rdx, r8
sub rcx, rdx
mov qword [rsp], rcx
cmp eax, 0xe0104672
je 0x1400dc210
mov rax, qword [rsp]
mov qword [rsp + 0x10], rax
jmp 0x1400dc0d4
add rsp, 0x38
ret
test al, 0x2f
sub byte [rcx - 0x1ad17], bh
dec ebp
xchg ebp, eax
int 0x95
sbb dword [rsi - 0xcc17], esp
dec dword [rdi]
invalid
Function at 0x1400dc330
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
call fcn.1400e0976
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1400cdac0
test al, 1
jne 0x1400dc362
jmp 0x1400dc390
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
call fcn.1400cd630
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x50], 0
jne 0x1400dc39d
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov edx, 8
call fcn.14001096f
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
mov eax, dword [0x14021c9c0]
xor edx, edx
div dword [0x14021c9c4]
xor eax, 0x70db3ce7
mov ecx, 0x97197329
xor ecx, 0xcc5bf53d
xor edx, edx
div ecx
or eax, 0x3c77afd1
mov ecx, 0x7a5087e7
xor ecx, 0xd8f20548
cmp eax, ecx
je 0x1400dc414
mov eax, dword [0x14021c9c8]
xor edx, edx
div dword [0x14021c9cc]
mov ecx, 0xfab24f30
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
and eax, 0x800e73ac
xor ecx, 0x800e73ac
or eax, ecx
or eax, 0xf0ee95ce
cmp eax, 0x7f93f0f8
jbe 0x1400dc3d7
add rsp, 0x38
ret
mov esp, 0xe9318774
mov edx, 0x48ffffff
sub rsp, 0x48
Function at 0x1400e0976
Capabilities:
Get thread local storage value

Disassembly:
mov rax, qword [0x14022dd30]
mov ecx, dword [rax]
jmp fcn.140008650
Function at 0x1400e17f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rcx
call fcn.1400e4e80
mov rcx, qword [rsp + 0x48]
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x57], al
je 0x1400e1a70
mov rax, qword [rsp + 0x48]
xor ecx, ecx
sub rcx, rax
movabs rax, 0xbf40ab6f237c796e
movabs rdx, 0xbf40ab6f237c796e
xor rax, rdx
movabs rdx, 0x44505e5438b008c1
movabs r8, 0xbbafa1abc74ff731
xor rdx, r8
sub rax, rdx
add rcx, rax
movabs rax, 0xe4d9ab8fe6ac6358
movabs rdx, 0xe4d9ab8fe6ac6358
xor rax, rdx
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp rax, 0x10
setb cl
mov byte [rsp + 0x46], cl
mov al, 1
test cl, 1
mov byte [rsp + 0x47], al
jne 0x1400e1a45
mov r8, qword [rsp + 0x38]
movabs rcx, 0x15326f70cefa353b
movabs rax, 0xe1494e2dc1a95498
xor rcx, rax
mov rax, r8
add rax, rcx
add rax, 0xfffffffffffffff0
movabs rcx, 0xf47b215d0f5361a3
sub rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
and rcx, rcx
xor rcx, 0xffffffffffffffff
xor rcx, 0xffffffffffffffff
mov rdx, r8
xor rdx, 0xffffffffffffffff
or rcx, rdx
and r8, r8
movabs rdx, 0xd7d75bce8da187fd
movabs r9, 0x2828a431725e7802
xor rdx, r9
xor r8, rdx
mov rdx, rax
and rdx, r8
xor rdx, 0xffffffffffffffff
xor rcx, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
or rcx, rdx
cmp rcx, 0
setl dl
cmp rax, 0xffffffffffffffff
setg al
mov cl, al
xor cl, dl
xor cl, 0xff
or al, dl
and al, cl
test al, 1
jne 0x1400e193a
jmp 0x1400e194a
call fcn.140008bc6
xor eax, eax
mov byte [rsp + 0x57], al
jmp 0x1400e1a70
mov eax, dword [0x14021cc78]
mov r8d, dword [0x14021cc7c]
mov ecx, 0x8add1435
xor ecx, 0x6f44ddb
xor r8d, ecx
mov edx, r8d
xor edx, 0xffffffff
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
mov ecx, 0x5433d3d5
xor edx, edx
div ecx
xor eax, 0xff2315c8
mov ecx, 0x95aa228b
xor ecx, 0x6a55dd74
mov edx, eax
xor edx, ecx
and edx, 0x97b9ad26
mov r8d, 0xffffffff
xor r8d, 0x97b9ad26
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x97b9ad26
or eax, 0x97b9ad26
imul eax, edx
add eax, ecx
cmp eax, 0x6089e4c4
jbe 0x1400e1a83
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov r8d, dword [0x14021cc80]
mov r9d, dword [0x14021cc84]
xor r9d, 0xb0c8750
mov eax, r8d
and eax, r9d
shl eax, 1
xor r8d, r9d
add r8d, eax
mov eax, r8d
and eax, 0xd62e1813
xor r8d, 0xd62e1813
or eax, r8d
mov r8d, 0x3d1681ad
xor r8d, 0x84ee8e4d
or eax, r8d
sub eax, 0xbf13e136
add eax, 0xaee82141
add eax, 0xbf13e136
mov qword [rcx], rdx
cmp eax, 0x1accafae
je 0x1400e19cd
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x1400e1a45
mov rdx, qword [rsp + 0x30]
mov cl, byte [rsp + 0x46]
mov rax, qword [rsp + 0x48]
mov r8b, byte [rsp + 0x47]
mov byte [rsp + 0x27], r8b
mov r8, qword [rax]
and cl, 1
call fcn.140011d2a
mov al, byte [rsp + 0x27]
mov byte [rsp + 0x57], al
mov al, byte [rsp + 0x57]
cmp al, 0
setne al
and al, 1
movzx eax, al
add rsp, 0x58
ret
invalid