joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c4040
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword gs:[0x58]
movaps xmmword [rsp + 0x60], xmm6
movaps xmm6, xmm1
movaps xmmword [rsp + 0x50], xmm7
movaps xmm7, xmm0
mov edx, 4
mov rcx, qword [rax]
movaps xmmword [rsp + 0x40], xmm8
movss xmm8, dword [0x1404dcd08]
mov eax, dword [rdx + rcx]
cmp dword [0x1404e1d84], eax
jle 0x1400c40b9
lea rcx, [0x1404e1d84]
call fcn.1401f6548
cmp dword [0x1404e1d84], 0xffffffff
jne 0x1400c40b9
mov eax, dword [0x1404dccd8]
lea rcx, [0x1404e1d84]
mov dword [0x1404e1d14], eax
call fcn.1401f64dc
subss xmm6, dword [0x1404dccf0]
mov edi, dword [0x1404e1d14]
mulss xmm6, xmm8
lea esi, [rdi - 1]
movaps xmm0, xmm6
call fcn.14022b9c8
subss xmm7, dword [0x1404dccd4]
cvttss2si ebp, xmm0
mulss xmm7, xmm8
movaps xmm0, xmm7
call fcn.14022b9c8
cvttss2si eax, xmm0
xor ebx, ebx
cmp eax, esi
jg 0x1400c4101
test eax, eax
mov esi, eax
cmovs esi, ebx
mov eax, dword [0x1404dcce0]
dec eax
cmp ebp, eax
jg 0x1400c4114
test ebp, ebp
mov eax, ebp
cmovs eax, ebx
imul edi, eax
add edi, esi
shl edi, 4
movsxd rdx, edi
add rdx, qword [0x1404dcce8]
je 0x1400c4265
cmp dword [0x1404dedcc], ebx
je 0x1400c4163
cmp byte [0x1404dcc79], bl
lea r8, [rsp + 0x30]
mov rcx, qword [0x1404dded0]
mov r9d, 0x10
mov qword [rsp + 0x20], rbx
mov rcx, qword [rcx]
jne 0x1400c415d
call fcn.1401f46d0
jmp 0x1400c4163
push rsi
call 0x140c9a47b
mov rdi, qword [rsp + 0x30]
xor bpl, bpl
mov rsi, qword [rsp + 0x38]
mov qword [rsp + 0xa8], rdi
test rdi, rdi
je 0x1400c41ea
lea rdx, [rdi + 6]
mov bpl, 1
test rdx, rdx
jne 0x1400c4191
movzx eax, bx
movzx ecx, al
jmp 0x1400c41ef
cmp byte [0x1404dcc79], bl
lea r8, [rsp + 0xa0]
mov rcx, qword [0x1404dded0]
mov r9d, 2
mov qword [rsp + 0x20], rbx
mov rcx, qword [rcx]
jne 0x1400c41cc
call fcn.1401f46d0
test eax, eax
js 0x1400c41e3
movzx eax, word [rsp + 0xa0]
movzx ecx, al
jmp 0x1400c41ef
push rsi
call 0x1409c5458
test eax, eax
je 0x1400c41e3
movzx eax, word [rsp + 0xa0]
movzx ecx, al
jmp 0x1400c41ef
mov eax, ebx
movzx ecx, al
jmp 0x1400c41ef
movzx eax, si
xor cl, cl
and eax, 0xc00
je 0x1400c4203
cmp bx, ax
sete byte [rsp + 0xa8]
jmp 0x1400c426c
test rdi, rdi
je 0x1400c42a6
test bpl, bpl
jne 0x1400c4298
lea rdx, [rdi + 6]
test rdx, rdx
je 0x1400c4260
cmp byte [0x1404dcc79], bl
lea r8, [rsp + 0x90]
mov rcx, qword [0x1404dded0]
mov r9d, 2
mov qword [rsp + 0x20], rbx
mov rcx, qword [rcx]
jne 0x1400c424e
call fcn.1401f46d0
test eax, eax
js 0x1400c4260
jmp 0x1400c4258
call 0x14053bc93
int3
movzx ebx, word [rsp + 0x90]
not bl
and bl, 1
mov byte [rsp + 0xa8], bl
cmp qword [rsp + 0xa8], 0
mov rbx, qword [rsp + 0x98]
movaps xmm6, xmmword [rsp + 0x60]
setne al
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm8, xmmword [rsp + 0x40]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
not cl
and cl, 1
mov byte [rsp + 0xa8], cl
jmp 0x1400c426c
movzx eax, sil
not eax
and eax, 1
mov qword [rsp + 0xa8], rax
jmp 0x1400c426c
Function at 0x1400c42e0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword gs:[0x58]
movaps xmmword [rsp + 0x60], xmm6
movaps xmm6, xmm1
movaps xmmword [rsp + 0x50], xmm7
movaps xmm7, xmm0
mov edx, 4
mov rcx, qword [rax]
movaps xmmword [rsp + 0x40], xmm8
movss xmm8, dword [0x1404dcd08]
mov eax, dword [rdx + rcx]
cmp dword [0x1404e08ec], eax
jle 0x1400c4359
lea rcx, [0x1404e08ec]
call fcn.1401f6548
cmp dword [0x1404e08ec], 0xffffffff
jne 0x1400c4359
mov eax, dword [0x1404dccd8]
lea rcx, [0x1404e08ec]
mov dword [0x1404e08d8], eax
call fcn.1401f64dc
subss xmm6, dword [0x1404dccf0]
mov edi, dword [0x1404e08d8]
mulss xmm6, xmm8
lea esi, [rdi - 1]
movaps xmm0, xmm6
call fcn.14022b9c8
subss xmm7, dword [0x1404dccd4]
cvttss2si ebp, xmm0
mulss xmm7, xmm8
movaps xmm0, xmm7
call fcn.14022b9c8
cvttss2si eax, xmm0
xor ebx, ebx
cmp eax, esi
jg 0x1400c43a1
test eax, eax
mov esi, eax
cmovs esi, ebx
mov eax, dword [0x1404dcce0]
dec eax
cmp ebp, eax
jg 0x1400c43b4
test ebp, ebp
mov eax, ebp
cmovs eax, ebx
imul edi, eax
add edi, esi
shl edi, 4
movsxd rdx, edi
add rdx, qword [0x1404dcce8]
je 0x1400c4508
cmp dword [0x1404dedcc], ebx
je 0x1400c4403
cmp byte [0x1404dcc79], bl
lea r8, [rsp + 0x30]
mov rcx, qword [0x1404dded0]
mov r9d, 0x10
mov qword [rsp + 0x20], rbx
mov rcx, qword [rcx]
jne 0x1400c43fd
call fcn.1401f46d0
jmp 0x1400c4403
call 0x14095b870
int3
mov rdi, qword [rsp + 0x30]
xor bpl, bpl
mov rsi, qword [rsp + 0x38]
mov qword [rsp + 0xa8], rdi
test rdi, rdi
je 0x1400c448a
lea rdx, [rdi + 6]
mov bpl, 1
test rdx, rdx
jne 0x1400c4431
movzx ecx, bx
movzx eax, cl
jmp 0x1400c448f
cmp byte [0x1404dcc79], bl
lea r8, [rsp + 0xa0]
mov rcx, qword [0x1404dded0]
mov r9d, 2
mov qword [rsp + 0x20], rbx
mov rcx, qword [rcx]
jne 0x1400c446c
call fcn.1401f46d0
test eax, eax
js 0x1400c4483
movzx ecx, word [rsp + 0xa0]
movzx eax, cl
jmp 0x1400c448f
push rdi
call 0x14098d3f9
test eax, eax
je 0x1400c4483
movzx ecx, word [rsp + 0xa0]
movzx eax, cl
jmp 0x1400c448f
mov ecx, ebx
movzx eax, cl
jmp 0x1400c448f
movzx ecx, si
xor al, al
and ecx, 0xc00
je 0x1400c44a4
cmp bx, cx
sete byte [rsp + 0xa8]
jmp 0x1400c450f
test rdi, rdi
je 0x1400c454a
test bpl, bpl
jne 0x1400c453b
lea rdx, [rdi + 6]
test rdx, rdx
je 0x1400c4501
cmp byte [0x1404dcc79], bl
lea r8, [rsp + 0x90]
mov rcx, qword [0x1404dded0]
mov r9d, 2
mov qword [rsp + 0x20], rbx
mov rcx, qword [rcx]
jne 0x1400c44ef
call fcn.1401f46d0
test eax, eax
js 0x1400c4501
jmp 0x1400c44f9
push rax
call 0x140c5ece0
test eax, eax
je 0x1400c4501
movzx ebx, word [rsp + 0x90]
shr bl, 1
not bl
and bl, 1
mov byte [rsp + 0xa8], bl
cmp qword [rsp + 0xa8], 0
mov rbx, qword [rsp + 0x98]
movaps xmm6, xmmword [rsp + 0x60]
setne al
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm8, xmmword [rsp + 0x40]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
shr al, 1
not al
and al, 1
mov byte [rsp + 0xa8], al
jmp 0x1400c450f
movzx eax, sil
shr eax, 1
not eax
and eax, 1
mov qword [rsp + 0xa8], rax
jmp 0x1400c450f
Function at 0x1400d2eb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
lea rsi, [0x1404e0900]
mov ebx, 0x270
mov eax, dword [rcx + rax]
cmp dword [0x1404e1df4], eax
jle 0x1400d2f4f
lea rcx, [0x1404e1df4]
call fcn.1401f6548
cmp dword [0x1404e1df4], 0xffffffff
jne 0x1400d2f4f
call fcn.1401f5a48
mov dword [0x1404e1c84], 0xffffffff
mov dword [0x1404e0904], eax
mov r8d, 1
nop dword [rax]
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, r8d
mov dword [rsi + r8*4 + 4], eax
inc r8
cmp r8, rbx
jb 0x1400d2f20
mov dword [0x1404e0900], ebx
lea rcx, [0x1404e1df4]
call fcn.1401f64dc
lea eax, [rdi - 1]
cmp eax, 0x80000000
jb 0x1400d30f3
cmp eax, 0xffffffff
jne 0x1400d30f3
mov eax, dword [0x1404e0900]
cmp eax, ebx
jne 0x1400d2fc4
lea r8, [0x1404e0908]
nop word [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, dword [r8 - 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x630]
shr edx, 1
xor ecx, edx
mov dword [r8 + 0x9bc], ecx
lea r8, [r8 + 4]
sub rbx, 1
jne 0x1400d2f80
mov eax, dword [0x1404e0900]
jmp 0x1400d30ab
cmp eax, 0x4e0
jb 0x1400d30ab
mov r9d, 0x9c4
lea r10, [0x1404e0904]
lea r11, [0x1404e0f34]
mov r8d, 0xd50
nop dword [rax]
mov edx, dword [r9 + rsi]
xor edx, dword [r10 + r9]
btr edx, 0x1f
xor edx, dword [r9 + rsi]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and ecx, 0x9908b0df
xor ecx, dword [r11 + r9]
shr edx, 1
xor ecx, edx
mov dword [rsi + r9 - 0x9c0], ecx
add r9, 4
cmp r9, r8
jb 0x1400d2ff0
nop word [rax + rax]
mov edx, dword [r8 + rsi]
xor edx, dword [r10 + r8]
btr edx, 0x1f
xor edx, dword [r8 + rsi]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and ecx, 0x9908b0df
xor ecx, dword [r8 + rsi - 0xd4c]
shr edx, 1
xor ecx, edx
mov dword [rsi + r8 - 0x9c0], ecx
add r8, 4
cmp r8, 0x1380
jb 0x1400d3030
mov edx, dword [0x1404e1c80]
xor edx, dword [0x1404e0904]
btr edx, 0x1f
xor edx, dword [0x1404e1c80]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and ecx, 0x9908b0df
shr edx, 1
xor ecx, edx
xor ecx, dword [0x1404e0f34]
mov dword [0x1404e12c0], ecx
xor eax, eax
mov dword [0x1404e0900], eax
mov ecx, dword [rsi + rax*4 + 4]
inc eax
mov dword [0x1404e0900], eax
mov eax, ecx
shr eax, 0xb
and eax, dword [0x1404e1c84]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rsi
call fcn.1401ca4d0
mov rbx, rdi
mov ecx, eax
imul rcx, rdi
cmp ecx, edi
jae 0x1400d3128
mov eax, edi
neg eax
xor edx, edx
div edi
mov edi, edx
cmp ecx, edx
jae 0x1400d3128
mov rcx, rsi
call fcn.1401ca4d0
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jb 0x1400d3116
shr rcx, 0x20
mov eax, ecx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400dd8b0
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
je 0x1400dda5e
push rsi
sub rsp, 0x30
mov qword [rsp + 0x40], rbx
mov rsi, rdx
mov qword [rsp + 0x48], rbp
xor ebx, ebx
mov rbp, qword [0x1404df818]
mov qword [rsp + 0x50], rdi
mov rcx, rbp
mov rdi, qword [0x1404df810]
sub rcx, rdi
mov qword [rsp + 0x58], r12
movabs r12, 0x2d82d82d82d82d83
mov rax, r12
imul rcx
sar rdx, 6
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1400dda45
mov qword [rsp + 0x28], r14
mov r11d, ebx
mov qword [rsp + 0x20], r15
movabs r14, 0xfffffe539f
movabs r15, 0xabc29ce444222325
lea rax, [rdi + 0xb8]
add rax, r11
cmp qword [rax + 0x18], 0xf
jbe 0x1400dd944
mov rax, qword [rax]
mov r10, r15
nop word [rax + rax]
movzx r9d, byte [rax]
lea rax, [rax + 1]
lea ecx, [r9 + 0x20]
movzx edx, cl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova edx, r9d
movsx rcx, dl
xor r10, rcx
imul r10, r14
test r9b, r9b
jne 0x1400dd950
cmp r10, rsi
je 0x1400dd9ae
mov rcx, rbp
mov rax, r12
sub rcx, rdi
inc rbx
imul rcx
add r11, 0x168
sar rdx, 6
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rbx, rdx
jb 0x1400dd930
jmp 0x1400dda3b
lea rcx, [0x1404def00]
call fcn.1401f5a84
test eax, eax
jne 0x1400dda74
cmp dword [0x1404def4c], 0x7fffffff
je 0x1400dda5f
mov rsi, qword [0x1404df818]
imul rdi, rbx, 0x168
add rdi, qword [0x1404df810]
lea rbx, [rdi + 0x168]
cmp rbx, rsi
je 0x1400dda18
mov rdx, rbx
mov rcx, rdi
call fcn.1401a4530
add rdi, 0x168
add rbx, 0x168
cmp rbx, rsi
jne 0x1400dd9f3
mov rsi, qword [0x1404df818]
lea rcx, [rsi - 0x168]
call fcn.14007fc60
sub qword [0x1404df818], 0x168
lea rcx, [0x1404def00]
call fcn.1401f5a8c
mov r14, qword [rsp + 0x28]
mov r15, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov ecx, 6
mov dword [0x1404def4c], 0x7ffffffe
call fcn.1401f5784
int3
mov ecx, 5
call fcn.1401f5784
int3
Function at 0x1400e2290
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x70
lea r10, [rdx + 0xe0]
movq xmm1, r8
cmp qword [r10 + 0x18], 0xf
mov rbx, rdx
movsd qword [rsp + 0x20], xmm1
jbe 0x1400e22b9
mov r10, qword [r10]
movabs r9, 0xabc29ce444222325
movabs r11, 0xfffffe539f
nop dword [rax]
movzx r8d, byte [r10]
lea r10, [r10 + 1]
lea eax, [r8 + 0x20]
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
movsx rax, cl
xor r9, rax
imul r9, r11
test r8b, r8b
jne 0x1400e22d0
movabs rax, 0x361f05ecc49bf5ef
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm7
cmp r9, rax
je 0x1400e2443
movabs rax, 0x3cd86ab6ba085c80
cmp r9, rax
je 0x1400e236c
movabs rax, 0x9054a81504fa1048
cmp r9, rax
je 0x1400e2443
movabs rax, 0xf8dd3ab84ddfd2cd
cmp r9, rax
je 0x1400e2443
mov rcx, rbx
call fcn.14007fc60
movss xmm0, dword [0x14030f800]
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
ret
cmp byte [rbx + 0x12f], 0
je 0x1400e23cb
movsd xmm0, qword [rbx + 0x58]
lea rcx, [rsp + 0x80]
movq rdx, xmm1
movsd qword [rsp + 0x80], xmm0
call fcn.1401f3990
mulss xmm0, dword [0x14030f660]
xorps xmm6, xmm6
mov rcx, rbx
cvtss2sd xmm0, xmm0
divsd xmm0, qword [rbx + 0x88]
cvtsd2ss xmm6, xmm0
call fcn.14007fc60
movaps xmm0, xmm6
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
ret
movsd xmm0, qword [rbx + 0x88]
ucomisd xmm0, qword [0x14030f7e0]
jp 0x1400e23f1
jne 0x1400e23f1
movsd xmm7, qword [rbx + 0xd8]
addsd xmm7, qword [rbx + 0x98]
jmp 0x1400e2453
xorps xmm2, xmm2
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1401f3d00
lea rcx, [rbx + 0x60]
lea rdx, [rsp + 0x30]
movsd xmm0, qword [rax]
mov eax, dword [rax + 8]
movsd qword [rsp + 0x30], xmm0
mov dword [rsp + 0x38], eax
call fcn.1401f4220
xorps xmm7, xmm7
cvtss2sd xmm7, xmm0
divsd xmm7, qword [rbx + 0x88]
addsd xmm7, qword [rbx + 0xd8]
addsd xmm7, qword [rbx + 0x98]
jmp 0x1400e2453
movsd xmm7, qword [rbx + 0x98]
addsd xmm7, qword [rbx + 0xd8]
call fcn.140082ee0
xorps xmm1, xmm1
cvtss2sd xmm1, xmm0
subsd xmm7, xmm1
call fcn.1400c3a00
mov rcx, rbx
movaps xmm6, xmm0
call fcn.14007fc60
xorps xmm0, xmm0
xorps xmm1, xmm1
cvtss2sd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x60]
subsd xmm7, xmm0
maxsd xmm7, xmm1
mulsd xmm7, qword [0x14030f3b8]
cvtpd2ps xmm0, xmm7
movaps xmm7, xmmword [rsp + 0x50]
add rsp, 0x70
pop rbx
ret
Function at 0x14010e5f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
call fcn.14008e7c0
mov r8, rax
mov dword [rsp + 0x20], 0x888996b1
xor edx, edx
mov dword [rsp + 0x24], 0x9b8d8989
mov dword [rsp + 0x28], 0x998586b9
mov word [rsp + 0x2c], 0x8b
nop
movsxd rcx, edx
lea eax, [rdx - 0x1e]
inc edx
xor byte [rsp + rcx + 0x20], al
cmp edx, 0xd
jb 0x14010e620
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x2d], 0
mov rcx, r8
call fcn.14008cd80
mov ebx, eax
call fcn.14008e7c0
add rax, 0x3108
lea ecx, [rbx*8]
movsxd rcx, ecx
add rcx, rax
call fcn.140082c90
mov rcx, rax
call fcn.140081c20
movabs rcx, 0x81f6d308b3292056
cmp rax, rcx
je 0x14010e6c2
movabs rcx, 0x45325ddc8a0099c3
cmp rax, rcx
je 0x14010e6c2
movabs rcx, 0xf355db45a23a5979
cmp rax, rcx
je 0x14010e6c2
movabs rcx, 0xdd99c4dafcc858fd
cmp rax, rcx
jne 0x14010e6b4
movss xmm0, dword [0x14030f650]
add rsp, 0x30
pop rbx
ret
movss xmm0, dword [0x14030f600]
add rsp, 0x30
pop rbx
ret
movss xmm0, dword [0x14030f678]
add rsp, 0x30
pop rbx
ret
Function at 0x140141a00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x50
mov rbx, rdx
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14008b160
mov r9, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140141a27
mov r9, qword [rax]
movabs r10, 0xabc29ce444222325
movabs r11, 0xfffffe539f
nop dword [rax + rax]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
lea eax, [r8 + 0x20]
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
movsx rax, cl
xor r10, rax
imul r10, r11
test r8b, r8b
jne 0x140141a40
movabs rax, 0xfc500863b43aa828
cmp r10, rax
jne 0x140141afd
lea rdx, [rbx + 0x370]
test rdx, rdx
je 0x140141ad3
cmp byte [0x1404dcc79], 0
lea r8, [rsp + 0x60]
mov rcx, qword [0x1404dded0]
mov r9d, 4
mov qword [rsp + 0x20], 0
mov rcx, qword [rcx]
jne 0x140141ac1
call fcn.1401f46d0
test eax, eax
js 0x140141ad3
movss xmm0, dword [rsp + 0x60]
jmp 0x140141ad6
push rdx
call 0x1409f4982
test eax, eax
je 0x140141ad3
movss xmm0, dword [rsp + 0x60]
jmp 0x140141ad6
xorps xmm0, xmm0
call fcn.1401fd5f8
movss xmm1, dword [0x14030f42c]
comiss xmm1, xmm0
jae 0x140141afd
xor bl, bl
lea rcx, [rsp + 0x30]
call fcn.1400166a0
movzx eax, bl
add rsp, 0x50
pop rbx
ret
lea rcx, [rsp + 0x30]
mov bl, 1
call fcn.1400166a0
movzx eax, bl
add rsp, 0x50
pop rbx
ret
Function at 0x140186650
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0xa0
xor ebx, ebx
mov rsi, qword [rcx + 0xa8]
mov qword [rsp + 0xd8], rsi
lea rdx, [0x14030cee8]
mov rcx, rsi
call fcn.140055450
mov qword [rsp + 0x48], rsi
mov rcx, rsi
call fcn.140057970
movsxd r14, eax
mov dword [rsp + 0x50], r14d
mov r8, r14
mov edx, 0xfff0b9d8
mov rcx, rsi
call fcn.140055680
lea edx, [rbx - 1]
mov rcx, rsi
call fcn.140054b60
mov edi, eax
lea edx, [rbx - 2]
mov rcx, rsi
call fcn.140054950
nop
test edi, edi
jne 0x140186731
mov dword [rsp + 0x30], 0x918d8dab
mov dword [rsp + 0x34], 0xc99b8ec6
mov dword [rsp + 0x38], 0x808284
nop dword [rax]
movsxd rax, ebx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rbx - 0x1e]
xor byte [rcx], al
inc ebx
cmp ebx, 0xb
jb 0x1401866e0
mov byte [rsp + 0x3b], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x14045c340]
call fcn.140025ce0
mov rcx, rax
call fcn.14019cd90
nop
mov r8d, r14d
mov rcx, rsi
call fcn.140057a60
nop
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov r8, r14
mov edx, 0xfff0b9d8
mov rcx, rsi
call fcn.140055680
mov edx, 0xffffffff
mov rcx, rsi
call fcn.140054b60
mov edi, eax
mov edx, 0xfffffffe
mov rcx, rsi
call fcn.140054950
nop
cmp edi, 6
je 0x1401867d1
movdqa xmm0, xmmword [0x140315880]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x979d87
nop dword [rax]
movsxd rax, ebx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rbx - 0x1e]
xor byte [rcx], al
inc ebx
cmp ebx, 0x13
jb 0x140186780
mov byte [rsp + 0x43], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x14045c340]
call fcn.140025ce0
mov rcx, rax
call fcn.14019cd90
nop
mov r8d, r14d
mov rcx, rsi
call fcn.140057a60
nop
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov r8, r14
mov edx, 0xfff0b9d8
mov rcx, rsi
call fcn.140055680
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
mov rcx, rsi
call fcn.140055df0
test eax, eax
jne 0x14018683f
mov rcx, rsi
call fcn.140057970
nop
mov r8d, eax
mov rcx, rsi
call fcn.140057a60
nop
jmp 0x140186824
mov r8d, r14d
mov rcx, rsi
call fcn.140057a60
nop
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.14007d510
mov rcx, rax
call fcn.14019ca30
int3
Function at 0x140186860
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0xa8
mov r13, rcx
xor edi, edi
mov rsi, qword [rcx + 0xa8]
mov qword [rsp + 0xf0], rsi
lea rdx, [0x14030cee0]
mov rcx, rsi
call fcn.140055450
mov qword [rsp + 0x48], rsi
mov rcx, rsi
call fcn.140057970
movsxd r14, eax
mov dword [rsp + 0x50], r14d
mov r8, r14
mov edx, 0xfff0b9d8
mov rcx, rsi
call fcn.140055680
lea edx, [rdi - 1]
mov rcx, rsi
call fcn.140054b60
mov ebx, eax
lea edx, [rdi - 2]
mov rcx, rsi
call fcn.140054950
nop
test ebx, ebx
jne 0x14018694d
mov dword [rsp + 0x30], 0x8e878ab6
mov dword [rsp + 0x34], 0xc99b8ec6
mov dword [rsp + 0x38], 0x808284
nop dword [rax]
nop word [rax + rax]
movsxd rcx, edi
lea eax, [rdi - 0x1e]
xor byte [rsp + rcx + 0x30], al
inc edi
cmp edi, 0xb
jb 0x140186900
mov byte [rsp + 0x3b], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x14045c340]
call fcn.140025ce0
mov rcx, rax
call fcn.14019cd90
nop
mov r8d, r14d
mov rcx, rsi
call fcn.140057a60
nop
add rsp, 0xa8
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
ret
mov r8, r14
mov edx, 0xfff0b9d8
mov rcx, rsi
call fcn.140055680
mov edx, 0xffffffff
mov rcx, rsi
call fcn.140054b60
mov ebx, eax
mov edx, 0xfffffffe
mov rcx, rsi
call fcn.140054950
nop
cmp ebx, 6
je 0x1401869ed
movdqa xmm0, xmmword [0x140315870]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x979d87
nop word [rax + rax]
movsxd rcx, edi
lea eax, [rdi - 0x1e]
xor byte [rsp + rcx + 0x30], al
inc edi
cmp edi, 0x13
jb 0x1401869a0
mov byte [rsp + 0x43], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x14045c340]
call fcn.140025ce0
mov rcx, rax
call fcn.14019cd90
nop
mov r8d, r14d
mov rcx, rsi
call fcn.140057a60
nop
add rsp, 0xa8
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
ret
lea rcx, [rsp + 0xe8]
call fcn.14007a650
mov r8, r14
mov edx, 0xfff0b9d8
mov rcx, rsi
call fcn.140055680
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
mov rcx, rsi
call fcn.140055df0
test eax, eax
jne 0x140186a9b
mov rcx, rsi
call fcn.140057970
nop
mov r8d, eax
mov rcx, rsi
call fcn.140057a60
nop
lea rcx, [rsp + 0xf8]
call fcn.14007a650
mov rcx, qword [rax]
sub rcx, qword [rsp + 0xe8]
xorps xmm0, xmm0
cvtsi2ss xmm0, rcx
divss xmm0, dword [0x14030f7f8]
movss dword [r13 + 0xa0], xmm0
jmp 0x140186a7e
mov r8d, r14d
mov rcx, rsi
call fcn.140057a60
nop
add rsp, 0xa8
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
ret
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.14007d510
mov rcx, rax
call fcn.14019ca30
int3
Function at 0x140186ac0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0xa0
xor ebx, ebx
mov rsi, qword [rcx + 0xa8]
mov qword [rsp + 0xd8], rsi
lea rdx, [0x14030cc54]
mov rcx, rsi
call fcn.140055450
mov qword [rsp + 0x48], rsi
mov rcx, rsi
call fcn.140057970
movsxd r14, eax
mov dword [rsp + 0x50], r14d
mov r8, r14
mov edx, 0xfff0b9d8
mov rcx, rsi
call fcn.140055680
lea edx, [rbx - 1]
mov rcx, rsi
call fcn.140054b60
mov edi, eax
lea edx, [rbx - 2]
mov rcx, rsi
call fcn.140054950
nop
test edi, edi
jne 0x140186ba1
mov dword [rsp + 0x30], 0x928591a6
mov dword [rsp + 0x34], 0xc99b8ec6
mov dword [rsp + 0x38], 0x808284
nop dword [rax]
movsxd rax, ebx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rbx - 0x1e]
xor byte [rcx], al
inc ebx
cmp ebx, 0xb
jb 0x140186b50
mov byte [rsp + 0x3b], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x14045c340]
call fcn.140025ce0
mov rcx, rax
call fcn.14019cd90
nop
mov r8d, r14d
mov rcx, rsi
call fcn.140057a60
nop
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov r8, r14
mov edx, 0xfff0b9d8
mov rcx, rsi
call fcn.140055680
mov edx, 0xffffffff
mov rcx, rsi
call fcn.140054b60
mov edi, eax
mov edx, 0xfffffffe
mov rcx, rsi
call fcn.140054950
nop
cmp edi, 6
je 0x140186c41
movdqa xmm0, xmmword [0x140315890]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x979d87
nop dword [rax]
movsxd rax, ebx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rbx - 0x1e]
xor byte [rcx], al
inc ebx
cmp ebx, 0x13
jb 0x140186bf0
mov byte [rsp + 0x43], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x14045c340]
call fcn.140025ce0
mov rcx, rax
call fcn.14019cd90
nop
mov r8d, r14d
mov rcx, rsi
call fcn.140057a60
nop
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov r8, r14
mov edx, 0xfff0b9d8
mov rcx, rsi
call fcn.140055680
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
mov rcx, rsi
call fcn.140055df0
test eax, eax
jne 0x140186caf
mov rcx, rsi
call fcn.140057970
nop
mov r8d, eax
mov rcx, rsi
call fcn.140057a60
nop
jmp 0x140186c94
mov r8d, r14d
mov rcx, rsi
call fcn.140057a60
nop
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.14007d510
mov rcx, rax
call fcn.14019ca30
int3
Function at 0x140187140
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov dword [rax - 0x28], 0x968591a1
mov dword [rax - 0x24], 0x8e87ab8e
mov dword [rax - 0x20], 0x8280c599
mov word [rax - 0x1c], 0x89
xor ebp, ebp
mov eax, ebp
movsxd rcx, eax
lea rdx, [rsp + 0x20]
add rdx, rcx
lea ecx, [rax - 0x1e]
xor byte [rdx], cl
inc eax
cmp eax, 0xd
jb 0x140187180
mov byte [rsp + 0x2d], bpl
lea rdx, [0x14030d008]
lea rcx, [rsp + 0x20]
call fcn.1402037a4
mov r14, rax
mov r8, qword [rbx + 0x10]
test r8, r8
je 0x14018721e
mov rsi, rbp
mov rax, rbp
nop
xor edx, edx
div qword [rdi + 0x10]
cmp qword [rdi + 0x10], rdx
jbe 0x140187251
mov rax, rdi
cmp qword [rdi + 0x18], 7
jbe 0x1401871dd
mov rax, qword [rdi]
lea rcx, [rax + rdx*2]
cmp r8, rsi
jbe 0x140187251
mov rax, rbx
cmp qword [rbx + 0x18], 7
jbe 0x1401871f3
mov rax, qword [rbx]
movzx r8d, word [rax + rsi*2]
movzx eax, word [rcx]
xor r8d, eax
lea rdx, [0x14030d00c]
mov rcx, r14
call fcn.140056730
inc ebp
inc rsi
movsxd rax, ebp
mov r8, qword [rbx + 0x10]
cmp rax, r8
jb 0x1401871c0
lea rdx, [0x140307bdc]
mov rcx, r14
call fcn.140056730
nop
mov rcx, rbx
call fcn.14019a460
nop
mov rcx, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
jmp fcn.14019a460
call fcn.140016f80
nop
int3