joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140062c50
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov word [rbp - 2], cx
mov eax, dword [0x1401d7cb8]
mov edx, dword [0x1401d7cbc]
mov ecx, edx
and ecx, eax
xor ecx, 0xffffffff
add eax, edx
mov edx, 0x89ff6b69
xor edx, 0x89ff6b68
add eax, edx
add eax, ecx
mov ecx, 0xd7d3e87e
xor ecx, 0x92b03a2a
imul eax, ecx
mov ecx, 0x8e6613c2
xor ecx, 0x5801bf77
xor edx, edx
div ecx
imul eax, eax, 0xcda600e8
mov ecx, 0x5748625c
xor ecx, 0x3aa6a7c5
cmp eax, ecx
je 0x140062e78
mov ecx, dword [str.h]
xor ecx, 0x3ccb0c8c
mov r8d, dword [0x1401d7cc4]
mov r9d, r8d
not r9d
mov edx, ecx
and edx, r9d
mov eax, ecx
or eax, r9d
not eax
imul eax, edx
mov edx, ecx
and edx, r8d
or ecx, r8d
imul ecx, edx
add ecx, eax
mov eax, ecx
not eax
and eax, 0xb643393
and ecx, 0xf49bcc6c
sub ecx, eax
mov eax, ecx
and eax, 0xece52227
and ecx, 0xe0602007
mov edx, eax
xor edx, 0xc87d2f0
add eax, edx
sub eax, ecx
mov dword [rbp - 0xc], eax
mov eax, 0x10
call fcn.1401d4340
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
sub rsp, 0x20
call fcn.140061f7e
mov cx, word [rbp - 2]
add rsp, 0x20
mov rdx, rax
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x18], rdx
mov dword [rax], 0
mov rax, qword [0x1401faf90]
mov qword [rbp - 0x28], rax
movsx rcx, cx
add rax, 8
shl rcx, 4
add rax, rcx
add rax, 8
mov rcx, qword [rax]
mov qword [rbp - 0x20], rcx
add rcx, 0xb
sub rsp, 0x20
call fcn.140061fa0
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov dx, ax
mov eax, dword [rbp - 0xc]
mov word [rbp - 6], dx
cmp byte [rcx], 0
sete cl
mov byte [rbp - 3], cl
cmp eax, 0xee226167
jae 0x140062cb8
mov cl, byte [rbp - 3]
xor eax, eax
test cl, 1
mov dword [rbp - 0x34], eax
jne 0x140062dbe
jmp 0x140062e70
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
mov dx, word [rbp - 6]
movsx rdx, dx
mov qword [rbp - 0x48], rdx
cmp byte [rcx + 0xd], 0x35
mov qword [rbp - 0x40], rax
jne 0x140062e32
mov cx, word [rbp - 2]
mov rdx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x28]
add rax, 8
shl rdx, 4
add rax, rdx
add rax, 8
mov r8, qword [rax]
add r8, 8
sub rsp, 0x20
call fcn.140062382
mov rax, qword [rbp - 0x18]
add rsp, 0x20
mov cl, byte [rax]
mov dl, 0x5b
xor dl, 0x5b
xor eax, eax
cmp cl, dl
mov dword [rbp - 0x34], eax
jne 0x140062e70
mov rax, qword [0x1401faf90]
mov qword [rbp - 0x40], rax
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x40]
add rax, 8
shl rdx, 4
add rax, rdx
add rax, 8
mov rdx, qword [rax]
add rdx, 8
mov r8d, 4
sub rsp, 0x20
call fcn.1400620e0
mov rax, qword [rbp - 0x30]
add rsp, 0x20
mov eax, dword [rax]
mov dword [rbp - 0x34], eax
mov eax, dword [rbp - 0x34]
mov rsp, rbp
pop rbp
ret
xor al, 2
jno 0x140062e27
jmp 0x140062cb8
Function at 0x1400634e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov word [rsp + 0x34], dx
mov word [rsp + 0x36], cx
mov eax, dword [0x1401d7cf8]
xor eax, 0x30eafd3d
mov ecx, dword [0x1401d7cfc]
xor ecx, 0xfb9c2dae
xor edx, edx
div ecx
xor eax, 0x1a3e884e
mov ecx, 0x5b214331
xor ecx, 0x13a8666d
mov edx, eax
and edx, ecx
or eax, 0x4889255c
add edx, eax
mov ecx, edx
xor ecx, 0x30fc5a3d
mov eax, 0xffffffff
xor eax, 0x30fc5a3d
and edx, eax
mov eax, 0x8fa25776
xor eax, 0x8fa25774
imul eax, edx
sub eax, ecx
cmp eax, 0x8d2bf424
je 0x140063639
mov eax, dword [0x1401d7d00]
mov r8d, dword [0x1401d7d04]
mov ecx, 0xa560c8ac
xor ecx, 0x213c84dc
xor r8d, ecx
mov edx, 0x11e3e097
xor edx, 0xee1c1f68
mov ecx, eax
xor ecx, edx
mov edx, r8d
and edx, ecx
mov ecx, 0x80e49cdc
xor ecx, 0x7f1b6323
mov r9d, r8d
xor r9d, ecx
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
add eax, 0xdd017250
xor eax, 0x1a824213
imul eax, eax, 0xb9a9e164
mov dword [rsp + 0x2c], eax
call fcn.1400634c0
mov r9w, word [rsp + 0x36]
mov r8w, word [rsp + 0x34]
mov eax, dword [rsp + 0x2c]
mov cx, r9w
xor cx, 0xffff
and cx, 0x91a3
mov r10w, 0xffff
xor r10w, 0x91a3
and r9w, r10w
mov r11w, 0x112f
xor r11w, 0xeed0
mov dx, r8w
xor dx, r11w
and dx, 0x91a3
and r8w, r10w
or cx, r9w
or dx, r8w
xor cx, dx
mov dx, 0xa30a
xor dx, 0xe2bf
xor cx, dx
mov word [rsp + 0x32], cx
cmp eax, 0x2c586c8e
je 0x140063552
mov ax, word [rsp + 0x32]
add rsp, 0x38
ret
call qword [rdi - 0x40]
shr cl, 1
adc bh, bh
invalid
Function at 0x140066420
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov word [rbp - 0xa], dx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401d7f58]
xor eax, 0x3ac0b688
and eax, dword [0x1401d7f5c]
mov ecx, 0x678e4fad
xor ecx, 0x76ef933
mov edx, eax
xor edx, ecx
xor edx, 0xffffffff
mov ecx, 0xc89cf9f5
xor ecx, 0xa87c4f6b
and ecx, edx
shl ecx, 1
sub ecx, 0x60e0b69e
sub eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x4c97e49c
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0xb3303021
xor r8d, 0x4ccfcfde
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x4c97e49c
mov r8d, 0x49e01764
xor r8d, 0x577f3f8
or eax, r8d
imul eax, edx
add eax, ecx
imul eax, eax, 0xae695227
cmp eax, 0xa79f22c8
je 0x1400665ca
mov cx, word [rbp - 0xa]
mov eax, dword [0x1401d7f60]
mov edx, dword [0x1401d7f64]
mov r8d, edx
xor r8d, 0x20a0d0
xor edx, 0x480400
and edx, 0xc8442c
and r8d, 0x1030a0d0
and eax, 0x10f8e4fc
or edx, r8d
xor eax, edx
xor eax, 0xc8442c
imul eax, eax, 0x87386429
mov edx, 0xb686900d
imul rax, rdx
shr rax, 0x3f
mov dword [rbp - 0x10], eax
mov eax, 0xe3f61c23
mov dword [rbp - 0x14], eax
mov eax, 0x10
mov qword [rbp - 0x38], rax
call fcn.1401d4340
sub rsp, rax
mov rax, qword [rbp - 0x38]
mov rdx, rsp
mov qword [rbp - 0x28], rdx
call fcn.1401d4340
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov rdx, rsp
mov qword [rbp - 0x30], rdx
mov word [rax], cx
sub rsp, 0x20
call fcn.14006624b
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov ax, 0xa70
xor ax, 0xa70
mov word [rcx], ax
sub rsp, 0x20
call fcn.1400665d3
mov rdx, qword [rbp - 0x20]
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x10]
add rsp, 0x20
cmp byte [rdx], 0
sete dl
mov byte [rbp - 0xb], dl
cmp eax, ecx
ja 0x1400664c5
mov al, byte [rbp - 0xb]
test al, 1
jne 0x1400665ad
jmp 0x1400665c5
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x30]
mov dx, word [rax]
sub rsp, 0x20
call fcn.140034e45
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
pop rax
and bl, byte [r10 - 0x10d17]
dec dword [rax - 0x7d]
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
Function at 0x140066ed0
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x2c], edx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401d7fb8]
xor eax, 0xd772200b
add eax, dword [0x1401d7fbc]
mov ecx, 0x5c7a7579
xor ecx, 0xf739b660
or eax, ecx
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
mov edx, 0x7b4a238a
xor edx, 0xddbb649b
or eax, edx
add eax, ecx
mov ecx, 0x63bf8baa
xor edx, edx
div ecx
cmp eax, 0xcf604892
ja 0x140066fc4
mov eax, dword [0x1401d7fc0]
mov edx, dword [0x1401d7fc4]
mov r8d, eax
and r8d, edx
mov ecx, 0x299f6448
xor ecx, 0x299f644a
imul ecx, r8d
add eax, edx
sub eax, ecx
mov ecx, 0x6c7759b3
xor ecx, 0xf3dab0cf
xor edx, edx
div ecx
mov ecx, eax
mov edx, 0xd77d1869
xor edx, 0x2882e796
mov eax, ecx
xor eax, edx
mov edx, 0x27fef07e
xor edx, 0xd8010f81
xor ecx, edx
or eax, ecx
mov ecx, 0xf3a045e4
and ecx, 0xf3a045e4
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0x87f8c163
xor edx, edx
div ecx
mov dword [rsp + 0x28], eax
call fcn.14006624b
mov rcx, qword [rsp + 0x30]
mov edx, dword [rsp + 0x2c]
call fcn.1400667a0
mov eax, dword [rsp + 0x28]
cmp eax, 0x89bb46b6
ja 0x140066f26
add rsp, 0x38
ret
xor eax, 0xe90902a0
pop rcx
invalid

Function at 0x140067550
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401d7fe8]
xor edx, edx
div dword [0x1401d7fec]
xor ecx, ecx
sub ecx, 0x1548e377
add eax, ecx
mov ecx, 0x29626033
xor ecx, 0x29626033
sub ecx, eax
xor eax, eax
sub eax, 0xd369acdd
add ecx, eax
xor eax, eax
sub eax, ecx
add eax, 0x339d7174
cmp eax, 0x719cd60c
jbe 0x14006766f
mov eax, dword [0x1401d7ff0]
mov ecx, dword [0x1401d7ff4]
or eax, ecx
mov ecx, eax
and ecx, 0xb9297f1b
xor ecx, 0xff62655d
and eax, 0x91a02
add eax, eax
sub eax, ecx
imul eax, eax, 0xea908b4d
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.1401d4340
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.14006624b
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov rdx, rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x20], rdx
mov rdx, qword [rax]
sub rsp, 0x20
call fcn.140067330
mov rcx, qword [rbp - 0x20]
mov eax, dword [rbp - 0x18]
add rsp, 0x20
mov cl, byte [rcx]
mov dl, 0x18
xor dl, 0x18
cmp cl, dl
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0xf7976e92
je 0x1400675a4
mov al, byte [rbp - 0x11]
test al, 1
jne 0x140067643
jmp 0x14006766a
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140034f60
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
cmp dword [rax + 0x15], ebx
mov eax, 0xffff2ce9
dec dword [rax - 0x7d]
sub rsp, 0x48
mov qword [rsp + 0x28], rcx
Function at 0x14006bb20
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401d81c8]
xor eax, 0xe6064a1f
imul eax, dword [0x1401d81cc]
mov ecx, eax
and ecx, 0x9730d081
mov edx, 0x9ffb585f
xor edx, 0x6004a7a0
xor ecx, edx
and eax, 0x9730d081
xor eax, 0xffffffff
xor ecx, 0xffffffff
xor eax, 0xffffffff
or ecx, eax
mov eax, 0xffffffff
xor eax, 0xa463bb5d

Function at 0x14006e000
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov r8d, dword [0x1401d82b8]
mov edx, dword [0x1401d82bc]
mov ecx, r8d
xor ecx, 0xffffffff
mov eax, 0xe8853033
xor eax, 0xe95deacd
and eax, ecx
mov r9d, 0xffffffff
xor r9d, 0x1d8dafe
and r8d, r9d
mov r10d, 0x3248623e
xor r10d, 0xcdb79dc1
mov ecx, edx
xor ecx, r10d
and ecx, 0x1d8dafe
and edx, r9d
or eax, r8d
or ecx, edx
xor eax, ecx
mov ecx, 0xac700211
xor ecx, 0x37c70594
imul eax, ecx
mov ecx, 0x8c785079
xor edx, edx
div ecx
mov ecx, 0xf7d94f0a
xor ecx, 0x2aa0696d
xor eax, ecx
cmp eax, 0xdae2b863
jbe 0x14006e0e1
mov eax, dword [0x1401d82c0]
or eax, dword [0x1401d82c4]
mov ecx, 0xddfd4b03
xor ecx, 0x7a5acf6a
sub eax, ecx
mov ecx, 0xe9782dd5
xor edx, edx
div ecx
sub eax, 0x4dcf3785
mov dword [rsp + 0x24], eax
call fcn.14006624b
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
call fcn.14006de10
mov eax, dword [rsp + 0x24]
cmp eax, 0xfc4da4ca
jae 0x14006e08e
add rsp, 0x38
ret
xchg ebp, eax
add eax, 0xa4e9e035
invalid

Function at 0x14006e98d
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1401d8308]
mov edx, dword [0x1401d830c]
xor ecx, ecx
sub ecx, edx
add eax, ecx
or eax, 0x99b65e07
add eax, 0x14b27a68
mov ecx, 0x6a9dc74f
xor ecx, 0xa0ac3f94
add eax, ecx
cmp eax, 0x18c8d025
jbe 0x14006e984
mov eax, dword [0x1401d8310]
or eax, dword [0x1401d8314]
mov ecx, 0xdd4f9596
xor ecx, 0xa1f003bd
or eax, ecx
mov ecx, 0x874eac49
xor ecx, 0x3826595b
xor edx, edx
div ecx
mov ecx, 0x74dd6be6
xor ecx, 0x980b431
xor edx, edx
div ecx
mov dword [rsp + 0x30], eax
mov eax, 0x1c673591
xor eax, 0xe80a5a2
mov dword [rsp + 0x2c], eax
call fcn.14006624b
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.140068600
mov rdx, qword [rsp + 0x20]
mov ecx, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x30]
cmp byte [rdx], 0
sete dl
mov byte [rsp + 0x37], dl
cmp eax, ecx
ja 0x14006e8e2
mov al, byte [rsp + 0x37]
test al, 1
jne 0x14006e96f
jmp 0x14006e97e
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.14006bb20
nop
add rsp, 0x48
ret
fst dword [rdi - 0x4d]
stc
jmp 0x14006e8e2
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006624b
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x14006e8a0
Function at 0x14006fbd0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401d83c8]
mov ecx, dword [0x1401d83cc]
xor ecx, 0x60319659
or eax, ecx
sub eax, 0x223aae44
add eax, 0xde011dca
mov ecx, 0xdc2e9fdc
xor ecx, 0x25b4a5c2
add eax, ecx
cmp eax, 0xce5cda96
jae 0x14006fda5
mov eax, dword [0x1401d83d0]
mov ecx, dword [0x1401d83d4]
xor eax, ecx
mov ecx, eax
xor ecx, 0x85e00284
xor eax, 0x38001802
and eax, 0x38143c02
and ecx, 0xc7ebc3fd
or eax, ecx
xor eax, 0x2d7984cd
imul eax, eax, 0x3e703a3b
add eax, 0x7b67525c
mov dword [rbp - 0x24], eax
mov eax, 0x10
mov qword [rbp - 0x50], rax
call fcn.1401d4340
sub rsp, rax
mov rax, qword [rbp - 0x50]
mov rcx, rsp
mov qword [rbp - 0x40], rcx
call fcn.1401d4340
sub rsp, rax
mov rax, qword [rbp - 0x50]
mov rcx, rsp
mov qword [rbp - 0x48], rcx
call fcn.1401d4340
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x38], rax
sub rsp, 0x20
call fcn.14006624b
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x40]
add rsp, 0x20
mov r8, rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x30], r8
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14001d024
mov rax, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov rdx, qword [rax]
mov rax, qword [rax + 8]
mov qword [rcx], rdx
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.14006626e
mov rcx, qword [rbp - 0x30]
add rsp, 0x20
mov rdx, rax
mov eax, dword [rbp - 0x24]
mov qword [rbp - 0x20], rdx
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0x24e726a4
jbe 0x14006fc18
mov cl, byte [rbp - 0x11]
mov al, 1
test cl, 1
mov byte [rbp - 0x51], al
jne 0x14006fd27
jmp 0x14006fd6c
mov rcx, qword [rbp - 0x20]
xor eax, eax
mov edx, eax
sub rsp, 0x20
call fcn.140035220
mov rcx, qword [rbp - 0x30]
add rsp, 0x20
mov al, 1
cmp byte [rcx], 0
mov byte [rbp - 0x51], al
jne 0x14006fd6c
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x20]
sub rsp, 0x20
call fcn.14006fba7
mov rax, qword [rbp - 0x30]
add rsp, 0x20
mov al, byte [rax]
mov byte [rbp - 0x51], al
mov rax, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x20]
mov dl, byte [rbp - 0x51]
mov byte [rbp - 0x52], dl
mov byte [rax], 0
sub rsp, 0x20
call fcn.140065ebc
mov rax, qword [rbp - 0x30]
add rsp, 0x20
cmp byte [rax], 0
jne 0x14006fda0
mov rax, qword [rbp - 0x30]
mov cl, byte [rbp - 0x52]
mov byte [rax], cl
mov rsp, rbp
pop rbp
ret
std
push 0xffffffffffffffe9
leave
jmp 0x14006fc18
Function at 0x140072600
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rcx
call fcn.14006624b
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov rdx, qword [rdx]
call fcn.1400666cf
mov rax, qword [rsp + 0x60]
cmp byte [rax], 0
jne 0x1400727e1
mov rax, qword [rsp + 0x50]
mov r8, qword [rax]
mov rax, r8
add rax, 0xffffffffffffffff
mov qword [rsp + 0x48], rax
mov rcx, rax
xor rcx, 0xffffffffffffffff
movabs r9, 0xba5ca00d0eab796a
movabs rdx, 0x45a35ff2f1548695
xor r9, rdx
mov rdx, rax
xor rdx, r9
or rcx, rdx
movabs rdx, 0xd7a0d9d1d8ade0af
movabs r9, 0x285f262e27521f50
xor rdx, r9
xor rcx, rdx
movabs r9, 0x612c641a7d811c91
movabs rdx, 0x9ed39be5827ee36e
xor r9, rdx
mov rdx, r8
xor rdx, r9
or rcx, rdx
and r8, r8
movabs rdx, 0x225d325b85230d1d
movabs r9, 0xdda2cda47adcf2e2
xor rdx, r9
xor r8, rdx
mov rdx, rax
xor rdx, 0xffffffffffffffff
movabs r9, 0x3a6e3e1002e6f250
movabs r10, 0xc591c1effd190daf
xor r9, r10
xor r8, r9
or rdx, r8
xor rcx, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
or rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x14007272b
mov rax, qword [rsp + 0x50]
add rax, 8
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x40], rax
jmp 0x140072735
call fcn.1400077a3
jmp 0x1400727e1
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
cmp rax, rcx
jg 0x1400727e1
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
cmp rax, rcx
jl 0x140072796
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
movabs rax, 0x4554e1aeeed35b7b
movabs r8, 0xbaab1e51112ca484
xor rax, r8
add rdx, rax
call fcn.140013580
jmp 0x1400727e1
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov rdx, qword [rax + rdx*8 + 8]
call fcn.140072591
mov rax, qword [rsp + 0x60]
cmp byte [rax], 0
jne 0x1400727e1
mov rax, qword [rsp + 0x30]
mov rcx, rax
and rcx, 1
shl rcx, 1
xor rax, 1
add rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x140072735
mov r8d, dword [0x1401d8518]
mov eax, dword [0x1401d851c]
xor eax, 0x588afb35
add r8d, 0x3ea688aa
add r8d, eax
mov eax, 0x2b75ca0f
xor eax, 0x15d342a5
sub r8d, eax
mov eax, r8d
xor eax, 0xffffffff
and eax, 0xcf07cb9c
mov r9d, 0xffffffff
xor r9d, 0xcf07cb9c
and r8d, r9d
mov ecx, 0xffffffff
xor ecx, 0x5115119e
mov edx, 0x6882a8e1
xor edx, 0xa785637d
and ecx, edx
mov edx, 0x57c0c525
xor edx, 0x6d5d4bb
and edx, r9d
or eax, r8d
or ecx, edx
xor eax, ecx
mov ecx, eax
xor ecx, 0xba8f2fd8
xor ecx, 0xffffffff
or eax, 0xba8f2fd8
and eax, ecx
mov edx, 0xab9452c5
xor edx, 0xce181470
mov ecx, 0x4bd113d2
xor ecx, 0xb42eec2d
xor edx, ecx
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0x658c46b5
add eax, edx
sub eax, ecx
cmp eax, 0x18c8f722
jb 0x1400728d4
mov eax, dword [0x1401d8520]
xor edx, edx
div dword [0x1401d8524]
mov ecx, 0x4466c3b0
xor ecx, 0x5296dfae
sub eax, ecx
add eax, 0xb6c0c58c
mov ecx, 0x738d218
xor ecx, 0x83665ec7
or eax, ecx
cmp eax, 0xe867eb35
je 0x140072897
add rsp, 0x68
ret
or ah, byte [rbp - 0x12]
invalid
Function at 0x140074b22
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [str.__r_FL]
mov ecx, dword [0x1401d861c]
xor ecx, 0x6c6c17c0
xor edx, edx
div ecx
imul eax, eax, 0x4c443dd6
add eax, 0xe72fa0ce
add eax, 0x39e8ba7b
sub eax, 0xe72fa0ce
and eax, 0x47a35efb
cmp eax, 0x758d8f85
je 0x140074b19
mov ecx, dword [0x1401d8620]
mov eax, ecx
xor eax, 0xfd857bca
mov r8d, dword [0x1401d8624]
xor ecx, 0x27a8435
mov edx, r8d
and edx, ecx
mov r9d, r8d
not r9d
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
imul eax, eax, 0xcaa4ca68
add eax, 0xc325ed90
xor eax, 0x6348a5e7
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.1401d4340
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
sub rsp, 0x20
call fcn.14006624b
mov rcx, qword [rbp - 0x10]
add rsp, 0x20
mov eax, dword [rbp - 0x18]
cmp rcx, 0
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0x413288b3
je 0x140074a3d
mov al, byte [rbp - 0x11]
test al, 1
jne 0x140074ad7
jmp 0x140074aed
mov rcx, qword [rbp - 8]
sub rsp, 0x20
call fcn.1400663f8
add rsp, 0x20
jmp 0x140074b14
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.1400746e0
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
adc dword [rcx], ebp
lodsb al, byte [rsi]
fsubr st(1)
sbb edi, edi
invalid
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006624b
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x1400749f0

Function at 0x140076270
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x38], rcx
shr rdx, 0x20
mov eax, edx
mov dword [rsp + 0x34], eax
call fcn.14006624b
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov edx, 2
call fcn.1400666cf
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x1400762e8
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x28]
and rax, 1
cmp rax, 0
setne dl
and dl, 1
call fcn.1400758f1
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x1400762e8
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
call fcn.140066ed0
mov eax, dword [0x1401d86b8]
sub eax, dword [0x1401d86bc]
sub eax, 0x26fcfe99
sub eax, 0xeebaf197
sub eax, 0x8ea81ad8
add eax, 0xeebaf197
and eax, 0xdd2ed8bd
mov ecx, 0x50be172
xor ecx, 0xbd4bd52f
cmp eax, ecx
jbe 0x140076369
mov eax, dword [0x1401d86c0]
xor edx, edx
div dword [0x1401d86c4]
and eax, 0x440c72bd
mov ecx, eax
and ecx, 0x7012623a
or eax, 0x7012623a
add ecx, eax
mov edx, 0x32fc0711
xor edx, 0xecf277d3
mov eax, ecx
and eax, edx
or ecx, 0xde0e70c2
add eax, ecx
cmp eax, 0x50755298
je 0x140076320
add rsp, 0x48
ret
add dl, bl
or ah, byte [rcx]
jmp 0x140076320
Function at 0x1400765c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401d86d8]
imul eax, dword [0x1401d86dc]
sub eax, 0x5ad002bd
or eax, 0xdbab681f
mov ecx, 0x7b1f2f34
xor edx, edx
div ecx
cmp eax, 0x9c7913f3
jae 0x140076734
mov eax, dword [0x1401d86e0]
mov r9d, dword [0x1401d86e4]
mov r8d, r9d
xor r8d, 0x5f5cd6fa
mov ecx, eax
not ecx
mov edx, r8d
and edx, ecx
xor r9d, 0xa0a32905
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, eax
and ecx, 0x16c52a83
add ecx, ecx
sub eax, ecx
add eax, 0x96c52a83
mov ecx, eax
imul rcx, rcx, 0x50743af
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
not eax
and eax, 0x2444cf27
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.1401d4340
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.14006624b
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov qword [rbp - 0x20], rax
movabs rdx, 0x4c436444aea8f8
movabs rax, 0x4c436444aea8fa
xor rdx, rax
sub rsp, 0x20
call fcn.1400666cf
mov rcx, qword [rbp - 0x20]
mov eax, dword [rbp - 0x18]
add rsp, 0x20
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0x2fde26a6
ja 0x1400765fd
mov al, byte [rbp - 0x11]
test al, 1
jne 0x1400766e2
jmp 0x14007672f
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax]
sub rsp, 0x20
call fcn.1400700d0
mov rax, qword [rbp - 0x20]
add rsp, 0x20
cmp byte [rax], 0
jne 0x14007672f
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax + 8]
mov qword [rdx], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140070ad0
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
outsd dx, dword [rsi]
frstor dword [rdi + 0x57]
jmp 0x1400765fd