joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001d940
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rcx
call fcn.140009f59
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.14001d790
test al, 1
jne 0x14001d96a
jmp 0x14001dab3
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov qword [rsp + 0x38], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
call fcn.1400cbfe0
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14001dab3
mov eax, dword [0x1401dbec8]
mov edx, dword [0x1401dbecc]
xor edx, 0x717cc27e
mov ecx, edx
and ecx, eax
mov r8d, 0xbd01a8b0
xor r8d, 0x42fe574f
xor ecx, r8d
add eax, edx
mov edx, 0x6ded6868
xor edx, 0x6ded6869
add eax, edx
add eax, ecx
xor eax, 0xcacfb2f7
mov edx, eax
xor edx, 0xffffffff
and edx, 0xf3230b99
mov r8d, 0x28c2de2f
xor r8d, 0xdbe1d5b6
mov ecx, 0xc5e65a94
xor ecx, 0x3a19a56b
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0x9eb8deb
xor r8d, 0xfac88672
mov edx, eax
and edx, r8d
or eax, 0xf3230b99
imul eax, edx
add eax, ecx
add eax, 0x1c138ee2
sub eax, 0xa0c7e94e
sub eax, 0x1c138ee2
mov ecx, 0xaa4a14f7
xor ecx, 0x914dbb24
cmp eax, ecx
je 0x14001dbad
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401dbed0]
xor edx, edx
div dword [0x1401dbed4]
xor eax, 0x172c7221
mov edx, 0xa9c9ac96
xor edx, 0x4808a84e
add eax, edx
sub eax, 0x39537b8c
sub eax, 0xe1c104d8
mov r8d, 0xc807d762
xor r8d, 0x62234d6
xor edx, edx
div r8d
mov dword [rsp + 0x24], eax
mov eax, 0xb8d693bb
xor eax, 0x365e05a6
mov dword [rsp + 0x20], eax
mov edx, 8
call fcn.14000e330
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
ja 0x14001da41
jmp 0x14001dab3
mov r8d, dword [0x1401dbed8]
mov edx, dword [0x1401dbedc]
mov ecx, 0x32342ed3
xor ecx, 0xcdcbd12c
mov eax, r8d
xor eax, ecx
and eax, 0x8db0cb10
mov r9d, 0xffffffff
xor r9d, 0x8db0cb10
and r8d, r9d
mov ecx, edx
xor ecx, 0xffffffff
mov r10d, 0xaabae1c3
xor r10d, 0x270a2ad3
and ecx, r10d
and edx, r9d
or eax, r8d
or ecx, edx
xor eax, ecx
or eax, 0xd5297945
mov ecx, 0x3437cfe
xor edx, edx
div ecx
mov ecx, 0x74909f8b
xor ecx, 0xaf0848fb
or eax, ecx
mov ecx, 0xc5284b1f
xor ecx, 0xac8772ae
cmp eax, ecx
jbe 0x14001dbb6
mov eax, dword [0x1401dbee0]
mov ecx, dword [0x1401dbee4]
xor ecx, 0x57db097
imul eax, ecx
mov ecx, 0x7f96a792
xor ecx, 0xadfb6ef5
or eax, ecx
mov ecx, 0xbc95c25f
xor ecx, 0x406b6087
xor edx, edx
div ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x4ff33731
mov r8d, 0xffffffff
xor r8d, 0x4ff33731
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x4ff33731
or eax, 0x4ff33731
imul eax, edx
add eax, ecx
mov ecx, 0xbef8a9d
xor ecx, 0xe332af13
cmp eax, ecx
ja 0x14001dbb6
add rsp, 0x48
ret
mov ah, 0xbf
jmp 0x14001da41
scasb al, byte [rdi]
invalid
Function at 0x14001fc20
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x10
lea rbp, [rsp + 0x10]
mov eax, dword [0x1401dbfd8]
xor eax, 0x5ce23009
mov edx, dword [0x1401dbfdc]
mov ecx, 0x74d93728
xor ecx, 0x6df5d6bf
xor edx, ecx
mov ecx, edx
and ecx, eax
xor ecx, 0xffffffff
add eax, edx
add eax, 1
add eax, ecx
mov ecx, 0xf21aaa2a
xor edx, edx
div ecx
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x53b1a5b8
add ecx, eax
mov eax, 0x717ca3bd
xor eax, 0x717ca3bd
sub eax, ecx
mov ecx, 0xdf766a21
xor edx, edx
div ecx
cmp eax, 0x766f6069
ja 0x14001fcfd
mov ecx, dword [0x1401dbfe0]
mov eax, dword [0x1401dbfe4]
xor eax, ecx
xor eax, 0x12ff13c2
imul rax, rax, 0x21b1b6eb
shr rax, 0x3d
imul eax, eax, 0xb25235e7
xor eax, 0xdf86038e
mov dword [rbp - 4], eax
mov eax, 0x10
call fcn.1401da3e0
sub rsp, rax
mov rcx, rsp
mov rax, qword [0x1401e74d0]
mov qword [rcx], rax
mov rax, qword [0x1401e74d8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.140013815
mov eax, dword [rbp - 4]
add rsp, 0x20
cmp eax, 0x7b081611
jb 0x14001fc8c
mov rsp, rbp
pop rbp
ret
std
sbb ebx, ebp
out dx, al
jmp 0x14001fc8c
Function at 0x140020c90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rcx
call fcn.140009f59
mov rcx, qword [rsp + 0x38]
add rax, 0x60
mov qword [rsp + 0x40], rax
add rcx, 8
mov qword [rsp + 0x48], rcx
xor eax, eax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov eax, dword [0x1401dc048]
mov ecx, dword [str._a3_e__]
xor ecx, 0xbad68ef9
sub eax, ecx
add eax, 0x6ae05320
or eax, 0xadc0bd0b
sub eax, 0x8a224835
mov ecx, 0xb8eb252c
xor ecx, 0xb563c55
sub eax, ecx
mov ecx, 0xa8658f5f
xor ecx, 0x2247c76a
add eax, ecx
cmp eax, 0x5670cff6
jb 0x140020e26
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov eax, dword [0x1401dc050]
imul eax, dword [0x1401dc054]
sub eax, 0x17802999
add eax, 0x4c36cdb8
mov r9d, 0xb3283563
xor r9d, 0xa4a81cfa
add eax, r9d
and eax, 0xa80d9e94
add eax, 0x69ecf41d
cmp rdx, qword [r8]
setl dl
mov byte [rsp + 0x27], dl
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
cmp eax, 0xa0036d56
je 0x140020d0e
mov al, byte [rsp + 0x27]
test al, 1
jne 0x140020d7c
jmp 0x140020e07
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.14001d790
test al, 1
jne 0x140020d9d
jmp 0x140020dde
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.1400d4f2c
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140020e20
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
mov edx, 8
call fcn.14000e330
mov rax, qword [rsp + 0x30]
movabs rcx, 0x45bbaef9512a44c7
movabs rdx, 0x45bbaef9512a44c6
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x50], rax
jmp 0x140020cbc
mov rax, qword [rsp + 0x28]
cmp rax, 0
je 0x140020e20
mov rcx, qword [rsp + 0x28]
call fcn.14000e0f0
nop
add rsp, 0x58
ret
pushfq
push rsi
fldl2t
invalid
Function at 0x140023ab0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1401dc1a8]
mov r8d, dword [0x1401dc1ac]
xor r8d, 0xe6b90f2c
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xe2359db7
xor ecx, 0xae1c4650
xor edx, edx
div ecx
mov ecx, 0x18e35d26
xor ecx, 0xc0bcc2f9
add eax, ecx
mov ecx, 0x6a5bf678
xor ecx, 0x3bce5cb3
sub eax, ecx
cmp eax, 0x555d4af2
jbe 0x140023bf9
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x1401dc1b0]
xor eax, 0x95b112a1
xor edx, edx
div dword [0x1401dc1b4]
mov edx, 0x53b74dee
xor edx, 0x68935cb2
or eax, edx
mov edx, 0x41f57354
xor edx, 0xbe0a8cab
mov r8d, eax
xor r8d, edx
and r8d, 0x23a3e86
mov r9d, 0x2e3f3281
xor r9d, 0x2c050c07
mov edx, 0x73d6909c
xor edx, 0x8c296f63
xor r9d, edx
mov edx, eax
and edx, r9d
imul edx, r8d
mov r8d, eax
and r8d, 0x23a3e86
or eax, 0x23a3e86
imul eax, r8d
add eax, edx
mov r8d, 0x85b787d0
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x30]
mov dword [rsp + 0x2c], eax
movabs rax, 0xe369267a46dece52
movabs r8, 0xe369267a46dece52
xor rax, r8
mov qword [rcx], rax
mov qword [rcx + 8], 0
call fcn.140023a82
mov eax, dword [rsp + 0x2c]
cmp eax, 0x332b0f9e
jae 0x140023b2f
mov rax, qword [rsp + 0x40]
add rsp, 0x48
ret
sub dword [rcx], ebp
out dx, al
sub ecx, 0xffffff2d
nop word cs:[rax + rax]
Function at 0x1400268d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rcx
call fcn.140009f59
mov rcx, qword [rsp + 0x38]
add rax, 0x60
mov qword [rsp + 0x40], rax
add rcx, 8
mov qword [rsp + 0x48], rcx
xor eax, eax
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov qword [rsp + 0x30], rdx
cmp rax, rcx
jge 0x140026a87
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.14001d790
test al, 1
jne 0x140026945
jmp 0x140026a6f
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.140086a50
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140026aa0
mov eax, dword [0x1401dc308]
mov ecx, dword [0x1401dc30c]
mov edx, 0x1631480f
xor edx, 0xb6bd3dd4
add eax, edx
add eax, ecx
sub eax, 0xa08c75db
mov ecx, 0x7bbcb34a
xor ecx, 0xfa158cf9
xor edx, edx
div ecx
mov ecx, 0xa5455897
xor ecx, 0x86757f17
and eax, ecx
mov r8d, 0xb257a201
xor r8d, 0x82c81e33
mov ecx, 0x62f9a60a
xor ecx, 0x9d0659f5
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x309fbc32
or eax, 0x309fbc32
imul eax, edx
add eax, ecx
mov ecx, 0x2a6f7210
xor ecx, 0x3b1a8445
cmp eax, ecx
je 0x140026aa6
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x48]
mov edx, dword [0x1401dc310]
imul edx, dword [0x1401dc314]
sub edx, 0x37ac1812
mov r8d, 0xb200722f
xor r8d, 0x774ab26
add edx, r8d
sub edx, 0xacca3da4
add edx, 0xc0350e2f
add edx, 0xacca3da4
mov dword [rsp + 0x24], edx
mov edx, 0x8ad91367
xor edx, 0x64822b8
mov dword [rsp + 0x20], edx
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
mov edx, 8
call fcn.14000e330
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
jae 0x1400269f6
jmp 0x140026a6f
mov rax, qword [rsp + 0x28]
xor ecx, ecx
sub rcx, 1
sub rax, rcx
mov qword [rsp + 0x50], rax
jmp 0x1400268fc
mov rax, qword [rsp + 0x30]
cmp rax, 0
je 0x140026aa0
mov rcx, qword [rsp + 0x30]
call fcn.14000e0f0
nop
add rsp, 0x58
ret
or al, dh
invalid
Function at 0x14002b470
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], rcx
mov eax, dword [0x1401dc588]
xor eax, 0xe7eea43f
xor eax, dword [0x1401dc58c]
mov ecx, 0x5e9dcd1c
xor ecx, 0x9cd2cec7
add eax, ecx
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0x29736604
add eax, ecx
mov ecx, 0xf63cef60
xor ecx, 0xa5745e2
xor edx, edx
div ecx
mov ecx, 0xec4230fc
xor ecx, 0xd6826b8a
cmp eax, ecx
ja 0x14002b75c
mov rcx, qword [rsp + 0x70]
mov eax, dword [0x1401dc590]
mov edx, 0x17d3a3b6
xor edx, 0x9d9b577d
xor eax, edx
mov r8d, dword [0x1401dc594]
mov edx, 0x5f55a875
xor edx, 0x5f55a875
sub edx, r8d
sub eax, edx
sub eax, 0x31c031b2
xor eax, 0x23976cdb
sub eax, 0x396ee79f
mov rdx, qword [rcx]
mov qword [rsp + 0x38], rdx
mov r8, rcx
add r8, 8
mov qword [rsp + 0x40], r8
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x48], rcx
cmp rcx, 0
sete cl
mov byte [rsp + 0x57], cl
movabs r8, 0x958d8e2cb218dd13
movabs rcx, 0x958d8e2cb218dd12
xor r8, rcx
mov rcx, rdx
add rcx, r8
mov qword [rsp + 0x58], rcx
movabs r9, 0x4380ea6f91f43de3
movabs r8, 0xbc7f15906e0bc21c
xor r9, r8
mov r8, rdx
and r8, r9
shl r8, 1
add rdx, 0xffffffffffffffff
sub rdx, r8
and rcx, rdx
mov qword [rsp + 0x60], rcx
cmp eax, 0x1ceefb5
jbe 0x14002b4cd
mov al, byte [rsp + 0x57]
test al, 1
jne 0x14002b663
jmp 0x14002b5a1
mov rax, qword [rsp + 0x60]
cmp rax, 0
jl 0x14002b659
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rax]
or rcx, rcx
movabs r8, 0xf63fa19c4ccd91fa
movabs r9, 0x9c05e63b3326e05
xor r8, r9
xor rcx, r8
movabs r8, 0x4d3571a1ae5714df
movabs r9, 0xf2ca8e5e51a8eb20
xor r8, r9
movabs r9, 0x5de7f7737f0b3a10
movabs r10, 0xa218088c80f4c5ef
xor r9, r10
xor r8, r9
movabs r9, 0x31e094e45585edbc
movabs r10, 0x8e1f6b1baa7a1243
xor r9, r10
movabs r10, 0xf2017aa372a3f5b0
movabs r11, 0xdfe855c8d5c0a4f
xor r10, r11
xor r9, r10
and r8, r9
or rcx, r8
xor rcx, 0xffffffffffffffff
cmp rcx, rdx
mov qword [rsp + 0x30], rax
jl 0x14002b663
jmp 0x14002b6ad
call fcn.1400067fe
jmp 0x14002b757
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
mov r8d, 1
mov r9d, 8
mov qword [rsp + 0x20], 8
call fcn.140011560
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
mov qword [rdx], rax
cmp rcx, 0
mov qword [rsp + 0x30], rax
jge 0x14002b6ad
call fcn.1400067fe
jmp 0x14002b757
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov ecx, dword [0x1401dc598]
xor ecx, 0xf25038bc
mov edx, dword [0x1401dc59c]
mov r8d, ecx
xor r8d, 0xffffffff
mov eax, edx
and eax, r8d
xor edx, 0xffffffff
and ecx, edx
or eax, ecx
or eax, 0x8f7fd457
add eax, 0x39fb4056
xor eax, 0x6915bf8
mov ecx, 0x47dd8206
xor ecx, 0x4edf7b37
cmp eax, ecx
je 0x14002b765
mov rcx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x70]
mov r10, qword [rsp + 0x58]
mov eax, dword [0x1401dc5a0]
xor edx, edx
div dword [0x1401dc5a4]
mov rdx, qword [rsp + 0x38]
or eax, 0x4a1c0715
mov r11d, 0x972495cf
xor r11d, 0x4009ebee
xor eax, r11d
xor eax, 0x1084889d
mov qword [r9], r10
mov qword [rcx + rdx*8 + 8], r8
cmp eax, 0x5be2ae04
jbe 0x14002b6fe
jmp 0x14002b757
add rsp, 0x78
ret
iretd
test dword [rsi + 0x55], ecx
invalid
Function at 0x14002cd60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rcx
add rcx, 8
mov qword [rsp + 0x48], rcx
xor eax, eax
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov qword [rsp + 0x38], rdx
cmp rax, rcx
jge 0x14002cefe
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.140012ee0
test al, 1
jne 0x14002cdc2
jmp 0x14002ceeb
mov eax, dword [0x1401dc658]
xor eax, dword [0x1401dc65c]
and eax, 0x999f4353
mov ecx, 0x7bc3318c
xor ecx, 0x763fed0f
imul eax, ecx
mov r8d, 0xc0c7a7e4
xor r8d, 0xea92539
mov ecx, 0x10fa0ca0
xor ecx, 0xef05f35f
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xce6e82dd
or eax, 0xce6e82dd
imul eax, edx
add eax, ecx
mov ecx, 0xef25ded1
xor ecx, 0x70fba25d
cmp eax, ecx
jae 0x14002d00f
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov r8d, dword [0x1401dc660]
mov edx, dword [0x1401dc664]
mov r9d, 0x673d222b
xor r9d, 0x98c2ddd4
xor edx, r9d
xor r9d, r9d
sub r9d, 1
sub edx, r9d
sub r8d, edx
mov r9d, 0x9d5585ab
xor r9d, 0x62aa7a54
mov edx, r8d
xor edx, r9d
xor r8d, 0xffffffff
and edx, r8d
mov r8d, 0xa7437e96
xor r8d, 0x3b9be7fc
mov r9d, 0x892a6f65
xor r9d, 0x15f2f60f
or r8d, r9d
xor r8d, 0xffffffff
xor edx, 0xffffffff
xor r8d, 0xffffffff
and edx, r8d
add edx, 0x4da83da6
and edx, 0xe9f112cd
mov dword [rsp + 0x2c], edx
mov edx, 0xc96d20b5
xor edx, 0xb9413973
mov dword [rsp + 0x28], edx
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.14000fd30
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
je 0x14002d00f
jmp 0x14002ceeb
mov rax, qword [rsp + 0x30]
add rax, 1
mov qword [rsp + 0x50], rax
jmp 0x14002cd79
mov rax, qword [rsp + 0x38]
cmp rax, 0
je 0x14002cf17
mov rcx, qword [rsp + 0x38]
call fcn.14000e0f0
mov eax, dword [0x1401dc668]
mov edx, dword [0x1401dc66c]
xor eax, 0xffffffff
mov ecx, 0xc6e2338c
xor ecx, 0x391dcc73
xor edx, ecx
mov ecx, 0x5dc1de4c
xor ecx, 0x647b48ca
mov r8d, 0x339d8410
xor r8d, 0xcc627bef
xor ecx, r8d
or eax, edx
or ecx, 0x39ba9686
xor eax, 0xffffffff
and eax, ecx
mov ecx, eax
and ecx, 0x6eddc89f
shl ecx, 1
xor eax, 0x6eddc89f
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x72733e19
mov r8d, 0x6dcb0a0a
xor r8d, 0x1fb83413
mov ecx, 0xe38ee5e7
xor ecx, 0x1c711a18
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x72733e19
or eax, 0x72733e19
imul eax, edx
add eax, ecx
and eax, 0x8c7ae3b
cmp eax, 0xaab13955
ja 0x14002d018
mov eax, dword [0x1401dc670]
mov ecx, dword [0x1401dc674]
xor ecx, 0x25067a9d
mov edx, 0x5562131d
xor edx, 0x18d9c3eb
sub eax, edx
sub eax, ecx
mov ecx, 0x34ae7d55
xor ecx, 0x7915ada3
add eax, ecx
imul eax, eax, 0x61990188
add eax, 0xf3146fe4
mov ecx, 0xbb4040cf
xor edx, edx
div ecx
cmp eax, 0xa735e049
ja 0x14002cfbd
add rsp, 0x58
ret
xchg esi, eax
imul esp, dword [rdi], 0x10
jmp 0x14002ce31
invalid
Function at 0x1400347f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401dca38]
mov ecx, dword [0x1401dca3c]
sub eax, 0x8cc9b3c
sub eax, ecx
add eax, 0x8cc9b3c
xor eax, 0x2e8d5c73
sub eax, 0x16d1346
sub eax, 0x6b62364d
cmp eax, 0x7c21e4da
je 0x140034a30
mov ecx, dword [0x1401dca40]
and ecx, dword [0x1401dca44]
and ecx, 0x53797456
mov edx, 0x5d51f90
xor edx, 0xfa2ae06f
mov eax, ecx
xor eax, edx
and eax, 0xd40edd17
mov edx, 0x3d7c17cd
xor edx, 0xe972cada
mov r8d, 0xd59941e8
xor r8d, 0x2a66be17
xor edx, r8d
and ecx, edx
or eax, ecx
add eax, 0x9db5ad0a
mov ecx, 0x1ca5958b
xor ecx, 0x17326106
sub eax, ecx
sub eax, 0x9db5ad0a
mov dword [rsp + 0x28], eax
call fcn.140009f59
mov rcx, rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax]
call fcn.14019dc60
mov rcx, qword [rsp + 0x20]
mov eax, dword [rsp + 0x28]
cmp byte [rcx + 0x60], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x4070bb6
jbe 0x14003482b
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1400348d5
jmp 0x1400348df
mov rcx, qword [rsp + 0x30]
call fcn.14019dcc9
mov r11d, dword [0x1401dca48]
mov r10d, dword [0x1401dca4c]
mov eax, r11d
xor eax, 0xffffffff
mov ecx, 0x5cc05e5c
xor ecx, 0xa33fa1a3
mov r8d, r10d
xor r8d, ecx
mov edx, 0xffffffff
xor edx, 0xbf73e6b
mov ecx, eax
and ecx, 0xbf73e6b
and r11d, edx
mov r9d, r8d
and r9d, 0xbf73e6b
and r10d, edx
or ecx, r11d
or r9d, r10d
xor ecx, r9d
or eax, r8d
xor eax, 0xffffffff
or edx, 0xbf73e6b
and eax, edx
or ecx, eax
or ecx, 0xf64721ae
mov eax, ecx
and eax, 0x3f5d5525
mov edx, 0xd11151b1
xor edx, 0xee4c0494
or ecx, edx
add eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x4ce2825
add eax, ecx
mov ecx, 0x4ae3b586
xor ecx, 0x4ae3b587
add eax, ecx
mov ecx, 0x4628ab16
xor ecx, 0xc6af3148
cmp eax, ecx
je 0x140034a39
mov eax, dword [0x1401dca50]
mov ecx, dword [0x1401dca54]
mov edx, 0x4f4009f6
xor edx, 0x3bfe18c8
add eax, edx
sub eax, ecx
sub eax, 0x74be113e
mov edx, 0xd0874cde
xor edx, 0x6823362e
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
and ecx, 0xb8a47af0
shl ecx, 1
mov edx, 0x6572bf3d
xor edx, 0xddd6c5cd
sub ecx, edx
sub eax, ecx
mov ecx, 0x5f6a6d8d
xor ecx, 0xa0959272
mov edx, eax
xor edx, ecx
and edx, 0xf77fd486
mov r8d, 0xffffffff
xor r8d, 0xf77fd486
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xf77fd486
mov r8d, 0x5705a19e
xor r8d, 0xa07a7518
or eax, r8d
imul eax, edx
add eax, ecx
imul eax, eax, 0x9ccb5278
cmp eax, 0x8278dbc5
je 0x140034a39
add rsp, 0x38
ret
mov ebp, cs
test byte [rbx], ch
jmp 0x14003482b
sub al, 0x37
scasb al, byte [rdi]
jmp 0x140034989
Function at 0x1400362b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
call fcn.140009f59
mov qword [rsp + 0x48], rax
mov al, byte [rax + 0x60]
mov cl, 0x4a
xor cl, 0x4a
cmp al, cl
je 0x140036563
mov rax, qword [rsp + 0x48]
mov rcx, rax
add rcx, 0x10
mov qword [rsp + 0x38], rcx
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x40], rax
cmp rax, 0
je 0x140036563
mov rax, qword [0x1401fc098]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x140036423
mov eax, dword [0x1401dcb48]
mov ecx, dword [0x1401dcb4c]
sub eax, 0xa5ade8f3
sub eax, ecx
add eax, 0xa5ade8f3
mov ecx, eax
xor ecx, 0x414281f8
xor ecx, 0xffffffff
or eax, 0x414281f8
and eax, ecx
or eax, 0x4accb290
mov ecx, 0xbbfc0253
xor ecx, 0x5aedb24d
add eax, ecx
mov ecx, 0x5a192e3e
xor ecx, 0xfe13485e
cmp eax, ecx
jae 0x140036569
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov r8d, dword [0x1401dcb50]
xor r8d, 0x517a27b6
mov edx, dword [0x1401dcb54]
mov r9d, 0x501afec0
xor r9d, 0xafe5013f
xor edx, r9d
xor r9d, r9d
sub r9d, 1
sub edx, r9d
sub r8d, edx
mov edx, r8d
xor edx, 0xffffffff
xor r8d, 0xffffffff
or edx, r8d
mov r8d, 0x54b979aa
xor r8d, 0xdea2d094
mov r9d, 0x85edbec0
xor r9d, 0xff617fe
and r8d, r9d
mov r9d, 0x84679cca
xor r9d, 0x7b986335
xor r8d, r9d
xor edx, 0xffffffff
mov r9d, 0x20cf9edf
xor r9d, 0xdf306120
xor r8d, r9d
or edx, r8d
xor edx, 0x23083ca9
mov r8d, edx
xor r8d, 0x7b7703a
mov r9d, 0xffffffff
xor r9d, 0x7b7703a
and edx, r9d
shl edx, 1
sub edx, r8d
mov dword [rsp + 0x2c], edx
call rax
mov eax, dword [rsp + 0x2c]
cmp eax, 0x77277168
je 0x140036358
jmp 0x140036423
mov r11d, dword [0x1401dcb58]
mov r10d, dword [0x1401dcb5c]
mov eax, 0xab3c939f
xor eax, 0x54c36c60
mov ecx, r11d
xor ecx, eax
mov eax, 0xbaa38df1
xor eax, 0x455c720e
mov r8d, r10d
xor r8d, eax
mov edx, 0xffffffff
xor edx, 0x7c39552
mov eax, ecx
and eax, 0x7c39552
and r11d, edx
mov esi, 0xa4b2d9cc
xor esi, 0xa3714c9e
mov r9d, r8d
and r9d, esi
and r10d, edx
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
xor ecx, 0xffffffff
or edx, 0x7c39552
and ecx, edx
or eax, ecx
mov ecx, 0xe4ea59d3
xor ecx, 0x5cac88de
sub eax, ecx
mov ecx, eax
and ecx, 0xab6856f5
mov edx, 0x87950e3b
xor edx, 0x786af1c4
xor ecx, edx
mov edx, 0xf3fb7c54
xor edx, 0x58932aa1
add eax, edx
add eax, 1
add eax, ecx
and eax, 0x1525c1e8
cmp eax, 0x7cce456a
ja 0x140036572
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x1401dcb60]
imul eax, dword [0x1401dcb64]
mov r8d, 0xa5b08ef3
xor edx, edx
div r8d
mov edx, 0x891bd605
xor edx, 0x891bd605
mov r8d, 0xa5802981
xor r8d, 0x940f5d82
sub edx, r8d
sub eax, edx
add eax, 0x751e8708
sub eax, 0x7c460f5e
sub eax, 0x751e8708
mov dword [rsp + 0x28], eax
mov eax, 0xdba0ec2f
xor eax, 0x5697c678
mov dword [rsp + 0x24], eax
xor eax, eax
mov edx, eax
call fcn.140013040
mov rax, qword [0x1401fc0a8]
mov ecx, 0x1aac97bb
xor ecx, 0x1aac97ba
call rax
mov ecx, dword [rsp + 0x24]
mov eax, dword [rsp + 0x28]
cmp eax, ecx
jbe 0x1400364d6
jmp 0x140036563
add rsp, 0x50
pop rsi
ret
mov ch, 0x98
xor ch, cl
out 0xfd, al
invalid
invalid
Function at 0x140038760
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
xor eax, eax
test r8, r8
cmovg rax, r8
mov qword [rsp + 0x20], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 8], rax
mov eax, dword [0x1401dcce0]
xor edx, edx
div dword [0x1401dcce4]
add eax, 0xc7d7dc71
mov edx, eax
xor edx, 0xffffffff
and edx, 0x50ee88fc
mov r8d, 0xffffffff
xor r8d, 0x50ee88fc
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x50ee88fc
mov r8d, 0x6d769164
xor r8d, 0x3d981998
or eax, r8d
imul eax, edx
add eax, ecx
sub eax, 0x5cf51953
mov ecx, 0xc795a753
xor ecx, 0x79b52ae7
cmp eax, ecx
ja 0x140038885
mov r8, qword [rsp + 0x20]
mov eax, dword [0x1401dcce8]
imul eax, dword [0x1401dccec]
mov ecx, 0x33849360
xor ecx, 0x151eaff3
xor edx, edx
div ecx
mov ecx, 0x721c0d97
xor ecx, 0xcb3d96a9
xor edx, edx
div ecx
mov rdx, qword [rsp + 8]
xor eax, 0xfebeeee
mov ecx, 0x6c54aa0f
xor ecx, 0x2419cd18
cmp rdx, r8
sete dl
mov byte [rsp + 7], dl
cmp eax, ecx
je 0x1400387f5
mov al, byte [rsp + 7]
test al, 1
jne 0x140038880
jmp 0x14003885d
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x10]
mov dl, byte [rdx + rax]
mov byte [rcx + rax], dl
add rax, 1
mov qword [rsp + 0x28], rax
jmp 0x140038783
add rsp, 0x30
ret
xor bl, dl
sal dword [rcx + rbp*8 + 0x67], 0xff
invalid