joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400821d0
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x38], rcx
shr rdx, 0x20
mov eax, edx
mov dword [rsp + 0x34], eax
call fcn.14006bc70
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov edx, 2
call fcn.14006c623
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x14008237f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x28]
movabs rdx, 0x49da623be035c2b3
movabs r8, 0x49da623be035c2b2
xor rdx, r8
and rax, rdx
cmp rax, 0
setne dl
and dl, 1
call fcn.1400813fd
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x14008237f
mov eax, dword [0x140244fd8]
imul eax, dword [0x140244fdc]
mov ecx, 0xffffffff
xor ecx, 0xa3bc18c8
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
sub eax, 0x9caa66d
mov edx, eax
xor edx, 0xffffffff
and edx, 0x92ec3de1
mov r8d, 0x97801dc5
xor r8d, 0x56c2024
mov ecx, 0x605f7fa1
xor ecx, 0x9fa0805e
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x92ec3de1
or eax, 0x92ec3de1
imul eax, edx
add eax, ecx
mov ecx, 0xf2abd2f
xor ecx, 0xfb38cb9f
cmp eax, ecx
ja 0x140082384
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x140244fe0]
xor eax, 0xa5349ee8
xor edx, edx
div dword [0x140244fe4]
mov edx, dword [rsp + 0x34]
xor r8d, r8d
sub r8d, 0xd41db475
add eax, r8d
imul r8d, eax, 0x790de74b
mov eax, r8d
and eax, eax
xor eax, 0xffffffff
xor eax, 0xffffffff
mov r9d, 0xffffffff
xor r9d, 0xfc34fa6
or eax, r9d
mov r9d, 0xffffffff
xor r9d, 0xfc34fa6
mov r10d, 0xf86de1f
xor r10d, 0x4591b9
mov r11d, 0x6d57ece8
xor r11d, 0x92a81317
xor r10d, r11d
or r9d, r10d
xor r8d, 0xffffffff
mov r10d, 0xfa34e7b0
xor r10d, 0x5cb184f
xor r9d, r10d
or r8d, r9d
xor eax, 0xffffffff
xor r8d, 0xffffffff
or eax, r8d
mov dword [rsp + 0x24], eax
call fcn.14006cf40
mov eax, dword [rsp + 0x24]
cmp eax, 0x5d9cb8fb
je 0x1400822c9
jmp 0x14008237f
add rsp, 0x48
ret
invalid
Function at 0x140082400
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
mov eax, dword [0x140244fe8]
or eax, dword [0x140244fec]
mov ecx, 0xc7527baf
xor ecx, 0xc7527baf
mov edx, 0xe369a6e6
xor edx, 0x84ac58b6
sub ecx, edx
add eax, ecx
mov ecx, 0x37fa401f
xor ecx, 0xfd67a3ba
xor edx, edx
div ecx
mov ecx, 0x193be29
xor ecx, 0x193be29
mov edx, 0x7137cb1c
xor edx, 0xd01b0857
sub ecx, edx
sub eax, ecx
mov ecx, 0x6992c36c
xor ecx, 0xb234add9
cmp eax, ecx
je 0x140082613
mov eax, dword [0x140244ff0]
mov ecx, dword [0x140244ff4]
xor ecx, 0x6ea15669
and eax, ecx
mov ecx, 0x83028893
imul rax, rcx
shr rax, 0x3d
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xfffffffd
and ecx, 0xdc771cd2
imul ecx, edx
mov edx, eax
and edx, 2
or eax, 0xdc771cd2
imul eax, edx
add eax, ecx
mov edx, eax
not edx
and edx, 0xa7743a7c
mov ecx, eax
and ecx, 0x588bc582
imul ecx, edx
mov edx, eax
and edx, 0xa7743a7c
or eax, 0xa7743a7c
imul eax, edx
add eax, ecx
mov dword [rbp - 0x2c], eax
mov eax, 0x5381cd54
mov dword [rbp - 0x30], eax
mov eax, 0x10
call fcn.14023fff0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
sub rsp, 0x20
call fcn.14006bc70
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x38], rcx
mov qword [rax], 0
mov qword [rax + 8], 0
mov ecx, 8
sub rsp, 0x20
call fcn.14006be90
mov rdx, qword [rbp - 0x38]
mov ecx, dword [rbp - 0x30]
add rsp, 0x20
mov r8, rax
mov eax, dword [rbp - 0x2c]
mov qword [rbp - 0x28], r8
mov dl, byte [rdx]
mov r8b, 0xed
xor r8b, 0xed
cmp dl, r8b
sete dl
mov byte [rbp - 0x19], dl
cmp eax, ecx
ja 0x140082478
mov cl, byte [rbp - 0x19]
mov al, 1
test cl, 1
mov byte [rbp - 0x41], al
jne 0x14008257a
jmp 0x1400825d2
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x28]
sub rsp, 0x20
call fcn.1400823d6
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov al, 1
cmp byte [rcx], 0
mov byte [rbp - 0x41], al
jne 0x1400825d2
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x28]
mov r8, qword [rax + 0x58]
mov qword [rdx], r8
mov rax, qword [rax + 0x60]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140018beb
mov rax, qword [rbp - 0x38]
add rsp, 0x20
mov al, byte [rax]
mov byte [rbp - 0x41], al
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x28]
mov dl, byte [rbp - 0x41]
mov byte [rbp - 0x42], dl
mov dl, 0xd0
xor dl, 0xd0
mov byte [rax], dl
sub rsp, 0x20
call fcn.14006b7a0
mov rax, qword [rbp - 0x38]
add rsp, 0x20
cmp byte [rax], 0
jne 0x14008260a
mov rax, qword [rbp - 0x38]
mov cl, byte [rbp - 0x42]
mov byte [rax], cl
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
push 0xffffffffe9e1e494
pop rsp
invalid
Function at 0x140083480
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
call fcn.14006bc70
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov edx, 2
call fcn.14006c623
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140083681
mov eax, dword [0x140245078]
mov ecx, 0x1df077f8
xor ecx, 0xd97d5693
xor eax, ecx
mov ecx, dword [0x14024507c]
add eax, 0x24605610
add eax, ecx
sub eax, 0x24605610
mov ecx, 0xffc86aed
xor edx, edx
div ecx
or eax, 0xc4ac816e
or eax, 0xd817cfc8
cmp eax, 0xe09e6a29
ja 0x140083686
mov rcx, qword [rsp + 0x38]
mov edx, dword [0x140245080]
mov r8d, dword [0x140245084]
mov eax, 0x4ed73cbe
xor eax, 0xb128c341
xor r8d, eax
mov eax, edx
xor eax, r8d
and eax, edx
mov r8d, 0x1309184
xor r8d, 0xa47bfb3f
xor edx, edx
div r8d
mov edx, eax
mov rax, qword [rsp + 0x30]
xor r8d, r8d
sub r8d, 0xca748e8f
add edx, r8d
mov r9d, 0x313a7b7f
xor r9d, 0xcec58480
mov r8d, edx
xor r8d, r9d
and r8d, 0x868178a5
mov r9d, 0xffffffff
xor r9d, 0x868178a5
and edx, r9d
sub edx, r8d
mov dword [rsp + 0x28], edx
mov rdx, qword [rax]
call fcn.14007a3e6
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x28]
mov cl, byte [rcx]
mov dl, 0x57
xor dl, 0x57
cmp cl, dl
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x6cf329ed
je 0x140083686
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1400835b2
jmp 0x140083681
mov eax, dword [0x140245088]
mov ecx, dword [0x14024508c]
xor ecx, 0xcf5abafd
sub eax, 0x1edb537
sub eax, ecx
add eax, 0x1edb537
mov ecx, 0x9f04f1a5
xor edx, edx
div ecx
mov edx, 0x78bdbf75
xor edx, 0x8742408a
mov ecx, eax
xor ecx, edx
mov edx, 0x4375de70
xor edx, 0xb5e54def
and ecx, edx
mov edx, 0xffffffff
xor edx, 0xf690939f
and eax, edx
sub eax, ecx
sub eax, 0x576a4514
cmp eax, 0x729f36fa
jb 0x14008368f
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x140245090]
xor edx, edx
div dword [0x140245094]
mov edx, eax
mov rax, qword [rsp + 0x30]
mov r8d, 0x6f330151
xor r8d, 0x5d1db12b
imul edx, r8d
mov r8d, 0xec017c11
xor r8d, 0x1ae0cf12
imul edx, r8d
mov r8d, 0xc731ad
xor r8d, 0xb18dec42
xor edx, r8d
mov dword [rsp + 0x24], edx
mov dword [rax], 0x42f08141
in al, dx
lea esi, [rcx - 0x763dcebc]
push rsp
and al, 0x24
mov rdx, qword [rax + 8]
call fcn.140083370
mov eax, dword [rsp + 0x24]
cmp eax, 0xf9c82408
je 0x140083614
jmp 0x140083681
add rsp, 0x48
ret
jle 0x140083654
mov ch, 0xe9
imul edi, esi, 0x1d75ffff
jne 0x1400836ae
mov dh, 0x69
jmp 0x140083614
leave
sbb eax, dword [rax]
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x10], rax
sub rsp, 0x20
call fcn.14006bc70
mov rdx, qword [rbp - 8]
add rsp, 0x20
cmp rdx, 0
jne 0x1400836ed
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call fcn.14006c090
add rsp, 0x20
jmp 0x140083714
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
mov rax, qword [rbp - 8]
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140083480
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
Function at 0x140083bb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x140245098]
mov edx, dword [0x14024509c]
mov ecx, eax
and ecx, edx
shl ecx, 1
add eax, edx
sub eax, ecx
xor eax, 0x12ba8f98
or eax, 0x33f89bec
sub eax, 0xd476ed5
sub eax, 0x2f4c9dc1
add eax, 0xd476ed5
cmp eax, 0xf7c4a4d8
jae 0x140083b9e
mov eax, dword [0x1402450a0]
mov ecx, dword [str._TSe]
xor ecx, 0x4eaaeea6
and eax, ecx
add eax, 0x54ff4f50
xor eax, 0xe1840281
or eax, 0x1473ed3e
mov dword [rbp - 0x18], eax
mov eax, 0x20
call fcn.14023fff0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
sub rsp, 0x20
call fcn.14006bc70
mov rcx, qword [rbp - 0x10]
add rsp, 0x20
mov eax, dword [rbp - 0x18]
cmp rcx, 0
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0x60c4aee3
je 0x140083b9e
mov al, byte [rbp - 0x11]
test al, 1
jne 0x140083a80
jmp 0x140083a96
mov rcx, qword [rbp - 8]
sub rsp, 0x20
call fcn.14006c090
add rsp, 0x20
jmp 0x140083ac5
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax]
mov qword [rdx], r8
mov r8, qword [rax + 8]
mov qword [rdx + 8], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 0x10], rax
sub rsp, 0x20
call fcn.140083939
add rsp, 0x20
mov ecx, dword [0x1402450a8]
mov eax, dword [0x1402450ac]
and ecx, ecx
mov edx, 0x16daaa29
xor edx, 0xe92555d6
xor ecx, edx
and eax, eax
xor eax, 0xffffffff
and ecx, eax
xor ecx, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0xf6b6ad06
mov edx, ecx
and edx, r8d
mov eax, ecx
or eax, r8d
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, 0xf6b6ad06
mov r8d, 0x21c8cd1a
xor r8d, 0xd77e601c
or ecx, r8d
imul ecx, edx
add ecx, eax
mov edx, 0xffffffff
xor edx, 0xf58458a7
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0x58b819ec
xor ecx, 0xba27cb37
imul eax, ecx
mov ecx, 0x7e73eb4
xor ecx, 0x6f3d1abb
cmp eax, ecx
je 0x140083ba7
mov eax, dword [0x1402450b0]
xor eax, 0xa7c82a41
mov ecx, dword [0x1402450b4]
xor ecx, 0x6f1e7916
sub eax, ecx
mov ecx, 0xca92ed7a
xor edx, edx
div ecx
and eax, 0xbd91b92c
mov ecx, 0x80a8010a
xor edx, edx
div ecx
mov ecx, 0xe3dcb0b5
xor ecx, 0xd924b17
cmp eax, ecx
ja 0x140083b56
mov rsp, rbp
pop rbp
ret
xchg edi, eax
jae 0x140083ba1
jmp 0x140083a0d
pop rbp
invalid
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006bc70
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x1400839c0
Function at 0x140084a00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x140245128]
xor eax, dword [0x14024512c]
xor ecx, ecx
sub ecx, 0xde43894e
add eax, ecx
imul eax, eax, 0xf9f73e80
xor eax, 0xb2ad61b1
mov ecx, 0x5d3fd877
xor ecx, 0x6818aec0
cmp eax, ecx
jbe 0x140084aa4
mov ecx, dword [0x140245130]
mov edx, dword [0x140245134]
xor edx, 0x396accbc
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
mov ecx, 0x145ffef4
xor edx, edx
div ecx
mov ecx, 0x18dc135f
xor ecx, 0xdce9504c
and eax, ecx
imul eax, eax, 0xe7a41227
mov dword [rsp + 0x24], eax
call fcn.14006bc70
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
call fcn.140084870
mov eax, dword [rsp + 0x24]
cmp eax, 0xdcf70ae7
ja 0x140084a42
add rsp, 0x38
ret
xor byte [rcx - 0x1a], dl
mov ch, cl
xchg ebp, eax
invalid

Function at 0x140086590
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov ecx, dword [0x140245208]
mov edx, dword [0x14024520c]
mov eax, ecx
xor eax, 0xffffffff
mov r8d, ecx
xor r8d, 0xffffffff
and eax, r8d
mov r9d, 0x5f1fdbb7
xor r9d, 0xa0e02448
mov r8d, edx
xor r8d, r9d
mov r10d, 0xbc04fa7b
xor r10d, 0x43fb0584
mov r9d, edx
xor r9d, r10d
and r8d, r9d
or eax, r8d
xor eax, 0xffffffff
mov r8d, 0x5e7fc87c
xor r8d, 0xa1803783
xor ecx, r8d
xor edx, 0xffffffff
and ecx, edx
xor eax, 0xffffffff
mov edx, 0x7e2f92a9
xor edx, 0x81d06d56
xor ecx, edx
and eax, ecx
mov ecx, 0xdb1521f8
xor ecx, 0x930b2acd
or eax, ecx
mov ecx, 0x96a41f47
xor ecx, 0x96a41f47
mov edx, 0x984093f6
xor edx, 0xdd9f65d3
sub ecx, edx
add eax, ecx
mov ecx, 0x5e12c62c
xor ecx, 0x8802ba23
imul eax, ecx
cmp eax, 0x5a571304
jae 0x1400866bc
mov eax, dword [0x140245210]
mov edx, dword [0x140245214]
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor eax, 0x3d04b027
mov ecx, 0x124b644c
xor ecx, 0xba2dc4cb
sub eax, ecx
mov ecx, 0x23e33ccc
xor ecx, 0xe8768550
imul eax, ecx
mov dword [rsp + 0x24], eax
mov eax, 0x1837c4ec
xor eax, 0x7cd447f5
mov dword [rsp + 0x20], eax
call fcn.14006bc70
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
call fcn.1400864a0
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
je 0x14008664f
add rsp, 0x38
ret
lea ecx, [rax]
sub al, 0xe9
mov bh, bh
invalid
Function at 0x140087460
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006bc70
mov rdx, qword [rsp + 0x30]
cmp rdx, 0
jne 0x14008758a
mov ecx, dword [0x140245298]
xor ecx, 0x621de9e9
mov edx, dword [0x14024529c]
mov eax, ecx
xor eax, 0xffffffff
mov r8d, ecx
xor r8d, 0xffffffff
and eax, r8d
mov r8d, edx
xor r8d, 0xffffffff
mov r10d, 0xc53413f0
xor r10d, 0x3acbec0f
mov r9d, edx
xor r9d, r10d
and r8d, r9d
or eax, r8d
xor eax, 0xffffffff
xor ecx, 0xffffffff
xor edx, 0xffffffff
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
sub eax, 0x25d9c72f
imul eax, eax, 0xcf8c2e13
mov edx, 0xcb941e02
xor edx, 0x3d355586
mov ecx, eax
xor ecx, edx
mov edx, 0x9c6fa425
xor edx, 0x63905bda
xor ecx, edx
or eax, 0xf6a14b84
and eax, ecx
cmp eax, 0xd8eb64dc
je 0x140087676
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1402452a0]
xor edx, edx
div dword [0x1402452a4]
mov r8d, 0x359d39c0
xor edx, edx
div r8d
xor edx, edx
sub edx, 0xdf949867
sub eax, edx
mov edx, 0x2a4b30ea
xor edx, 0x64b58e9d
mov r8d, 0x991ce7e1
xor r8d, 0x66e3181e
xor edx, r8d
xor r8d, r8d
sub r8d, 1
sub edx, r8d
sub eax, edx
mov dword [rsp + 0x24], eax
mov eax, 0x4e3ca554
xor eax, 0x1f6290ce
mov dword [rsp + 0x20], eax
call fcn.14006c090
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
ja 0x14008750f
jmp 0x14008759c
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax]
call fcn.1400872d0
mov eax, dword [0x1402452a8]
xor eax, 0x6110e583
mov edx, dword [0x1402452ac]
mov ecx, 0x24b79318
xor ecx, 0x24b79318
sub ecx, edx
sub eax, ecx
mov ecx, 0x7aa9ee87
xor ecx, 0xe9e9ff90
and ecx, eax
xor ecx, 0xffffffff
add eax, 0x93401117
add eax, 1
add eax, ecx
mov ecx, eax
and ecx, 0xc5318ec
shl ecx, 1
mov edx, 0x2cf27147
xor edx, 0x20a169ab
add eax, edx
sub eax, ecx
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
mov edx, 0xc2cfab8d
xor edx, 0x59ce55c5
or eax, edx
add eax, ecx
cmp eax, 0x1d690995
je 0x14008767f
mov eax, dword [0x1402452b0]
mov ecx, 0x249510b
xor ecx, 0x3f002f59
xor eax, ecx
and eax, dword [0x1402452b4]
mov ecx, 0xcf75002b
xor edx, edx
div ecx
mov edx, 0xffffffff
xor edx, 0xcbd7ceda
mov ecx, eax
and ecx, edx
mov r8d, 0x3e6b8988
xor r8d, 0xf5bc4752
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
mov ecx, 0x66362aa7
xor ecx, 0x937890a
xor eax, ecx
cmp eax, 0x8c161961
je 0x140087612
add rsp, 0x38
ret
sub dh, 0x6f
jp 0x140087664
nop
invalid
invalid
Function at 0x1400a24e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rcx
add rcx, 8
mov qword [rsp + 0x48], rcx
xor eax, eax
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov qword [rsp + 0x38], rdx
cmp rax, rcx
jge 0x1400a25f1
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
add rax, 8
shl rcx, 4
add rax, rcx
add rax, 8
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
cmp rax, 0
je 0x1400a25de
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
movabs rcx, 0x39c341b6c989de7f
movabs rdx, 0xc63cbe4936762180
xor rcx, rdx
xor rax, rcx
movabs rdx, 0xb744643c00bc0519
movabs rcx, 0xf744643c00bc0519
xor rdx, rcx
movabs rcx, 0x32b177a4c05d052e
movabs r8, 0xcd4e885b3fa2fad1
xor rcx, r8
xor rdx, rcx
mov rcx, 0xffffffffffffffff
movabs r8, 0xc823234b1c99792c
xor rcx, r8
or rax, rdx
movabs rdx, 0xc823234b1c99792c
or rcx, rdx
xor rax, 0xffffffffffffffff
and rax, rcx
cmp rax, 0
jne 0x1400a25de
mov rcx, qword [rsp + 0x28]
call fcn.14000f4df
mov rax, qword [rsp + 0x30]
add rax, 1
mov qword [rsp + 0x50], rax
jmp 0x1400a24f9
mov rax, qword [rsp + 0x38]
cmp rax, 0
je 0x1400a26b4
mov eax, dword [0x140245d28]
add eax, dword [0x140245d2c]
mov ecx, eax
and ecx, 0x2f905d74
shl ecx, 1
xor eax, 0x2f905d74
add eax, ecx
xor eax, 0xa3e75b44
imul eax, eax, 0x581b9d24
cmp eax, 0x1b03a5bb
jb 0x1400a2729
mov eax, dword [0x140245d30]
mov ecx, dword [0x140245d34]
mov edx, 0x11473c2b
xor edx, 0x47dbd23b
xor ecx, edx
xor eax, ecx
mov ecx, 0xab6896e4
xor edx, edx
div ecx
mov ecx, 0x61583f39
xor ecx, 0x38def872
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x38]
and eax, 0xb1c193cb
movabs rcx, 0x4000000000000000
and rcx, qword [rdx]
cmp rcx, 0
sete cl
mov byte [rsp + 0x27], cl
cmp eax, 0x3eec10ad
je 0x1400a2729
mov al, byte [rsp + 0x27]
test al, 1
jne 0x1400a26a5
jmp 0x1400a26b4
mov rcx, qword [rsp + 0x38]
mov edx, 8
call fcn.14000f4e4
mov eax, dword [0x140245d38]
mov ecx, 0xc19219c7
xor ecx, 0x976dff83
xor eax, ecx
or eax, dword [0x140245d3c]
add eax, 0xbc689284
mov ecx, 0x92cc365c
xor edx, edx
div ecx
mov ecx, 0x3d901fbc
xor edx, edx
div ecx
cmp eax, 0x5c19511c
ja 0x1400a2732
mov eax, dword [0x140245d40]
xor edx, edx
div dword [0x140245d44]
xor ecx, ecx
sub ecx, 0x6b4154ce
add eax, ecx
sub eax, 0xd297f742
add eax, 0xeb594508
mov ecx, 0x872336cd
xor ecx, 0x1a7f2c38
cmp eax, ecx
jbe 0x1400a26ef
add rsp, 0x58
ret
xchg ebx, eax
sub byte [rdi - 0xfd17], bl
call rbx
invalid
rol dword [rdx + 0x27], cl
mov esp, 0xffffb4e9
dec dword [rdi]
invalid
Function at 0x1400ac980
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x57], al
je 0x1400acb28
mov rax, qword [rsp + 0x48]
movabs rcx, 0x6755c06010327bc9
movabs rdx, 0x98aa3f9fefcd8439
xor rcx, rdx
movabs rdx, 0xaec81f18336a40dc
movabs r8, 0x5137e0e7cc95bf23
xor rdx, r8
xor rcx, rdx
movabs rdx, 0x91f61056e3c6dd68
movabs r8, 0x91f61056e3c6dd68
xor rdx, r8
movabs r8, 0xfc695ed7e8f5d591
movabs r9, 0xfc695ed7e8f5d590
xor r8, r9
sub rdx, r8
sub rcx, rdx
sub rax, rcx
mov qword [rsp + 0x38], rax
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
mov al, 1
cmp rcx, 0x10
mov byte [rsp + 0x57], al
jb 0x1400acb28
mov rdx, qword [rsp + 0x40]
movabs rcx, 0xc13b1d58be0218ff
movabs rax, 0x3ec4e2a741fde70f
xor rcx, rax
mov rax, rdx
add rax, rcx
mov qword [rsp + 0x30], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x1400aca6d
jmp 0x1400acb15
mov eax, dword [0x1402462a0]
mov ecx, 0x773eb78f
xor ecx, 0xd112eb48
xor eax, ecx
mov edx, dword [0x1402462a4]
mov ecx, eax
and ecx, edx
mov r8d, 0xd89eb81b
xor r8d, 0xd89eb819
imul ecx, r8d
xor eax, edx
add eax, ecx
add eax, 0x2f905d74
xor eax, 0xa3e75b44
mov ecx, 0xc1c5a6f1
xor ecx, 0x99de3bd5
imul eax, ecx
cmp eax, 0x1b03a5bb
jb 0x1400acbcc
mov eax, dword [0x1402462a8]
mov ecx, 0xf42f95d7
xor ecx, 0x5d4d2d87
xor eax, ecx
xor eax, dword [0x1402462ac]
mov ecx, 0xab6896e4
xor edx, edx
div ecx
mov ecx, 0x5986c74b
xor edx, edx
div ecx
and eax, 0xb1c193cb
mov dword [rsp + 0x2c], eax
call fcn.140008d37
mov eax, dword [rsp + 0x2c]
cmp eax, 0x3eec10ad
je 0x1400acbcc
xor eax, eax
mov byte [rsp + 0x57], al
jmp 0x1400acb28
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x57], al
mov al, byte [rsp + 0x57]
mov byte [rsp + 0x2b], al
mov eax, dword [0x1402462b0]
xor eax, 0xdb528ab2
mov ecx, dword [0x1402462b4]
xor ecx, 0xdd7da5f6
or eax, ecx
add eax, 0xbc689284
mov ecx, 0x92cc365c
xor edx, edx
div ecx
mov ecx, 0xc81962af
xor ecx, 0xf5897d13
xor edx, edx
div ecx
mov ecx, 0x98065d1e
xor ecx, 0xc41f0c02
cmp eax, ecx
ja 0x1400acbd5
mov eax, dword [0x1402462b8]
xor edx, edx
div dword [0x1402462bc]
mov ecx, 0x980b9a09
xor ecx, 0x980b9a09
mov edx, 0xc0c342cc
xor edx, 0xab821602
sub ecx, edx
add eax, ecx
mov ecx, 0x437f659e
xor ecx, 0x91e892dc
sub eax, ecx
add eax, 0xeb594508
cmp eax, 0x9d5c1af5
jbe 0x1400acb79
mov al, byte [rsp + 0x2b]
and al, 1
movzx eax, al
add rsp, 0x58
ret
xchg ebx, eax
sub byte [rdi - 0x11217], bl
call rbx
invalid
rol dword [rdx + 0x27], cl
mov esp, 0xffff9be9
jmp qword [rsi - 0x70]
Function at 0x1400b4230
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1402464b0]
xor edx, edx
div dword [0x1402464b4]
mov ecx, 0x8ca295cc
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x92446f0d
or eax, edx
mov edx, 0x92446f0d
and edx, 0x92446f0d
mov r8d, 0x70ec4bf6
xor r8d, 0x8f13b409
xor edx, r8d
and ecx, edx
mov edx, 0x3cab756e
xor edx, 0xc3548a91
xor ecx, edx
mov edx, 0x5f3d1b30
xor edx, 0xa0c2e4cf
xor eax, edx
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0x74bb4404
xor ecx, 0xf3de4e4b
imul eax, ecx
mov ecx, 0x2ac2536f
xor ecx, 0x75f8c0e9
cmp eax, ecx
jbe 0x1400b434c
mov eax, dword [0x1402464b8]
mov ecx, 0xef0348af
xor ecx, 0x7b128f6b
xor eax, ecx
add eax, dword [0x1402464bc]
xor eax, 0xef440f1f
xor eax, 0x8b577daa
mov ecx, eax
xor ecx, 0xe38f4a86
mov edx, 0xffffffff
xor edx, 0xe38f4a86
and eax, edx
shl eax, 1
sub eax, ecx
mov dword [rsp + 0x24], eax
mov eax, 0x44663591
xor eax, 0x4b292cd8
mov dword [rsp + 0x20], eax
call fcn.1400b3ee9
mov rcx, qword [rsp + 0x30]
call qword [0x14026c2c8]
mov ecx, dword [rsp + 0x20]
mov rdx, rax
mov eax, dword [rsp + 0x24]
mov qword [rsp + 0x28], rdx
cmp eax, ecx
je 0x1400b42cb
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret
or dword [rdx + 0x76e9980b], ebx
invalid
Function at 0x1400b70e0
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x3c], edx
mov qword [rsp + 0x40], rcx
mov r11d, dword [0x1402465e0]
mov ecx, dword [0x1402465e4]
xor ecx, 0xa112a7e6
mov eax, r11d
xor eax, ecx
mov edx, 0xda078578
xor edx, 0x25f87a87
xor eax, edx
or r11d, ecx
and r11d, eax
mov eax, 0xd9523579
xor eax, 0xbc627dc3
imul r11d, eax
mov ecx, 0xf1b24aec
xor ecx, 0xe4db513
mov eax, r11d
xor eax, ecx
mov edx, 0xc6efe857
xor edx, 0xfb28b5ff
mov ecx, 0x1561ff43
xor ecx, 0xea9e00bc
xor edx, ecx
mov r8d, 0xffffffff
xor r8d, 0xcfe356e
mov ecx, eax
and ecx, 0xcfe356e
and r11d, r8d
mov r10d, 0x89a7394a
xor r10d, 0x85590c24
mov r9d, edx
and r9d, r10d
mov r10d, r8d
and r10d, 0x3dc75da8
or ecx, r11d
or r9d, r10d
xor ecx, r9d
or eax, edx
xor eax, 0xffffffff
mov edx, 0xdb7679be
xor edx, 0xd7884cd0
or edx, r8d
and eax, edx
or ecx, eax
mov eax, ecx
and eax, 0x211e3776
xor ecx, 0x211e3776
or eax, ecx
cmp eax, 0xdc3efc50
jbe 0x1400b7242
mov ecx, dword [0x1402465e8]
mov edx, dword [0x1402465ec]
xor edx, 0xd3c0d431
xor edx, 0xffffffff
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0x30fb1a4e
xor edx, edx
div ecx
mov ecx, eax
and ecx, 0x3833634
shl ecx, 1
add eax, 0x3833634
sub eax, ecx
mov ecx, 0x16dbe3f
xor ecx, 0x4534ea75
xor edx, edx
div ecx
mov dword [rsp + 0x28], eax
call fcn.1400b6d87
mov rcx, qword [rsp + 0x40]
mov edx, dword [rsp + 0x3c]
mov r8, qword [rsp + 0x30]
call qword [0x14026c360]
mov ecx, eax
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x2c], ecx
cmp eax, 0x9a1af84a
jae 0x1400b71c2
mov eax, dword [rsp + 0x2c]
add rsp, 0x48
ret
push rax
or eax, 0x77e9fd96
invalid

Function at 0x1400b73a0
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x140246600]
xor edx, edx
div dword [0x140246604]
xor eax, 0x5354a9d2
mov ecx, 0xae908d9c
xor edx, edx
div ecx
and eax, 0x812f4fd4
cmp eax, 0xe3c6dd68
jae 0x1400b7457
mov eax, dword [0x140246608]
xor eax, 0x1b8354bb
xor edx, edx
div dword [0x14024660c]
mov ecx, eax
add ecx, 0x28b2db35
sub ecx, 0x6d08c85f
mov edx, 0xffffffff
xor edx, 0xcf0bc3f2
mov eax, ecx
xor eax, edx
and eax, ecx
mov dword [rsp + 0x20], eax
call fcn.1400b6d87
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x28]
call qword [0x14026c370]
mov ecx, eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], ecx
cmp eax, 0x809f2367
jb 0x1400b73e4
mov eax, dword [rsp + 0x24]
add rsp, 0x48
ret
fadd qword [rax + 0x6a]
xor ebp, ecx
test bh, bh
invalid