joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007fc60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov dword [rsp + 0x34], edx
mov qword [rsp + 0x38], rcx
call fcn.14006a8ef
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov edx, 1
call fcn.14006afd9
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x14007fda4
mov eax, dword [0x1401ded38]
mov edx, dword [0x1401ded3c]
mov ecx, eax
xor ecx, edx
mov r8d, 0xf59564dd
xor r8d, 0xa6a9b22
xor ecx, r8d
mov r8d, edx
and r8d, ecx
mov ecx, 0xbb858832
xor ecx, 0xbb858830
imul ecx, r8d
sub ecx, edx
sub eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x7ad8fecf
mov r8d, 0xcc01b57b
xor r8d, 0xb6d94bb4
mov ecx, 0x597b698
xor ecx, 0xfa684967
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x7ad8fecf
or eax, 0x7ad8fecf
imul eax, edx
add eax, ecx
xor eax, 0x39b1f7e9
mov ecx, 0x588888ef
xor ecx, 0x974ac998
sub eax, ecx
add eax, 0x7d263cb
add eax, 0xcfc24177
cmp eax, 0x3c93bb8e
je 0x14007fda9
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x1401ded40]
mov edx, 0x3f855f7f
xor edx, 0x6d7e6e7d
xor eax, edx
xor edx, edx
div dword [0x1401ded44]
mov edx, dword [rsp + 0x34]
add eax, 0xa5daf1b
or eax, 0xfc0492c9
mov r8d, eax
and r8d, 0x38e27f07
shl r8d, 1
xor eax, 0x38e27f07
add eax, r8d
mov dword [rsp + 0x30], eax
mov eax, 0x751df4c9
xor eax, 0x15eb0b4
mov dword [rsp + 0x2c], eax
call fcn.14006b5a2
mov ecx, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x30]
cmp eax, ecx
je 0x14007fd34
jmp 0x14007fda4
add rsp, 0x48
ret
invalid
Function at 0x14007fdc0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1401ded48]
mov ecx, 0x24861b8
xor ecx, 0xb7134227
xor eax, ecx
xor edx, edx
div dword [0x1401ded4c]
mov ecx, eax
or ecx, 0x91ca9a92
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xe9d58b42
xor edx, 0x83b9a243
and edx, eax
mov r8d, 0xffffffff
xor r8d, 0x6a6c2901
mov eax, ecx
and eax, r8d
imul eax, edx
mov edx, ecx
and edx, 0x6a6c2901
or ecx, 0x6a6c2901
imul ecx, edx
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0x7ba7cc5d
xor edx, 0x845833a2
xor ecx, edx
and eax, ecx
mov ecx, 0x29d6b514
or ecx, 0x29d6b514
mov edx, 0xc8733ba4
xor edx, 0x378cc45b
xor ecx, edx
or eax, ecx
xor eax, 0xffffffff
cmp eax, 0x607f082e
je 0x14007ffdc
mov ecx, dword [0x1401ded50]
mov edx, dword [0x1401ded54]
xor edx, 0xffffffff
mov eax, ecx
xor eax, edx
and eax, ecx
imul eax, eax, 0x6580084e
mov edx, 0xefffe4ba
xor edx, 0xefffe4bb
mov ecx, eax
add ecx, edx
xor eax, 0xffffffff
or eax, 0x5adafa8d
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x1ba50ec4
mov r8d, 0xffffffff
xor r8d, 0x1ba50ec4
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x1ba50ec4
or eax, 0x1ba50ec4
imul eax, edx
add eax, ecx
mov dword [rsp + 0x30], eax
mov eax, 0x9ddfcbe8
xor eax, 0x8f76c436
mov dword [rsp + 0x2c], eax
call fcn.14006a8ef
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x30]
cmp rdx, 0
sete dl
mov byte [rsp + 0x37], dl
cmp eax, ecx
jbe 0x14007fe67
mov al, byte [rsp + 0x37]
test al, 1
jne 0x14007ff15
jmp 0x14007ff24
mov rcx, qword [rsp + 0x40]
call fcn.14006accd
jmp 0x14007ffd7
mov eax, dword [0x1401ded58]
mov ecx, dword [0x1401ded5c]
sub eax, 0x82f423db
sub eax, ecx
add eax, 0x82f423db
mov ecx, 0xad9e3056
xor ecx, 0x738e800f
xor edx, edx
div ecx
and eax, 0x56da3caf
or eax, 0x8629a78f
cmp eax, 0x49dc4c5c
jb 0x14007ffe5
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x1401ded60]
mov r8d, dword [0x1401ded64]
xor r8d, 0x52ab6e8d
xor edx, edx
div r8d
mov edx, 0x7278435
xor edx, 0x7278435
mov r8d, 0x89e75ec6
xor r8d, 0x6cac7169
sub edx, r8d
add eax, edx
mov r8d, 0x920762c
xor edx, edx
div r8d
mov r8d, 0x9b8d7547
xor edx, edx
div r8d
mov edx, eax
mov rax, qword [rsp + 0x38]
mov dword [rsp + 0x28], edx
mov edx, dword [rax]
call fcn.14007fc60
mov eax, dword [rsp + 0x28]
cmp eax, 0xc5dce464
ja 0x14007ff60
jmp 0x14007ffd7
add rsp, 0x48
ret
jns 0x14007ffdf
pushfq
adc cl, ch
invalid
popfq
mov edx, 0x72e95f03
invalid
Function at 0x140080390
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 0x10], rdx
Function at 0x140081110
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rcx
call fcn.14006a8ef
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov rdx, qword [rdx]
call fcn.14006afd9
mov rax, qword [rsp + 0x60]
cmp byte [rax], 0
jne 0x140081356
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax]
mov rax, rdx
add rax, 0xffffffffffffffff
mov qword [rsp + 0x48], rax
mov rcx, rax
xor rcx, rdx
movabs rdx, 0x5177ff4906ea0665
movabs r8, 0x5177ff4906ea0665
xor rdx, r8
cmp rcx, rdx
setl cl
movabs rdx, 0x95c2e0d6111e3619
movabs r8, 0x6a3d1f29eee1c9e6
xor rdx, r8
cmp rax, rdx
setg al
and al, cl
test al, 1
jne 0x14008127e
mov eax, dword [0x1401dee28]
sub eax, dword [0x1401dee2c]
mov r8d, 0xffffffff
xor r8d, 0x101c9d30
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x101c9d30
or eax, 0x101c9d30
imul eax, edx
add eax, ecx
mov ecx, 0x62d21b9b
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
or eax, 0x4bad1e88
xor eax, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0x883b2912
xor edx, 0xc396379a
mov r8d, 0x79bb7394
xor r8d, 0x86448c6b
xor edx, r8d
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
cmp eax, 0x40ee9642
jb 0x14008135b
mov eax, dword [0x1401dee30]
mov ecx, dword [0x1401dee34]
sub eax, 0xea586d4e
sub eax, ecx
add eax, 0xea586d4e
mov ecx, 0x5d6a735f
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x50]
and eax, 0x8c8fb03c
sub eax, 0x4dcf710e
mov ecx, 0x41bff3b3
xor ecx, 0x64ef469b
add rdx, 8
mov qword [rsp + 0x40], rdx
cmp eax, ecx
jbe 0x140081226
xor eax, eax
mov qword [rsp + 0x38], rax
jmp 0x140081288
call fcn.1400067fe
jmp 0x140081356
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
cmp rax, rcx
jg 0x140081356
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
cmp rax, rcx
jl 0x140081303
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
movabs rax, 0xb695479e8b833480
sub rdx, rax
movabs rax, 0x4175652489ceaba7
movabs r8, 0xbe8a9adb76315458
xor rax, r8
add rdx, rax
movabs rax, 0xb695479e8b833480
add rdx, rax
call fcn.1400137e9
jmp 0x140081356
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rdx, qword [rax + rdx*8 + 8]
call fcn.1400810ab
mov rax, qword [rsp + 0x60]
cmp byte [rax], 0
jne 0x140081356
mov rax, qword [rsp + 0x30]
movabs rcx, 0x120b35c0441a2ab
movabs rdx, 0x120b35c0441a2aa
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x38], rax
jmp 0x140081288
add rsp, 0x68
ret
cmpsb byte [rsi], byte [rdi]
pop rsp
lahf
jmp 0x140081226
Function at 0x140086dc0
Capabilities:
Encode data using xor

Disassembly:
push rax
mov qword [rsp], rcx
mov eax, dword [0x1401df058]
xor eax, 0x5caf0739
and eax, dword [0x1401df05c]
or eax, 0x7a50be04
mov r8d, 0xffffffff
xor r8d, 0xa8caa760
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x82b1937f
xor r8d, 0x7d4e6c80
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xa8caa760
or eax, 0xa8caa760
imul eax, edx
add eax, ecx
add eax, 0xc0d69843
cmp eax, 0x64054b1c
je 0x140086e7e
mov rdx, qword [rsp]
mov eax, dword [0x1401df060]
sub eax, dword [0x1401df064]
xor eax, 0x48e92aca
add eax, 0xcff7f419
add eax, 0x227a18c0
mov ecx, 0x2348f207
xor ecx, 0xecbf061e
sub eax, ecx
add eax, 0x94d33297
add eax, 0xc57b9c4d
sub eax, 0x94d33297
mov ecx, 0x33c02315
xor ecx, 0xe5b46adc
mov qword [rdx], 0
cmp eax, ecx
je 0x140086e27
pop rax
ret
mov eax, 0xe987023d
movabs al, byte [0x4838ec8348ffffff]
sub rsp, 0x38
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
call fcn.140086b97
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.140086bb2
test al, 1
jne 0x140086eb9
jmp 0x140086efe
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
call fcn.140086a50
mov rax, qword [rsp + 0x30]
mov al, byte [rax]
mov cl, 0x71
xor cl, 0x71
cmp al, cl
jne 0x140086f0b
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
movabs rdx, 0xe87bc756213ff388
movabs rax, 0xe87bc756213ff380
xor rdx, rax
call fcn.14000e330
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
add rsp, 0x38
ret
Function at 0x140090cb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x50
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x40], rcx
xor eax, eax
cmp rcx, qword [rdx]
mov byte [rsp + 0x4f], al
jne 0x140090e5c
mov rcx, qword [rsp + 0x40]
movabs rdx, 0x2c30173cf5acf916
movabs rax, 0x2c30173cf5acf916
xor rdx, rax
mov al, 1
cmp rcx, rdx
mov byte [rsp + 0x4f], al
je 0x140090e5c
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rdx, qword [rdx + 8]
add rdx, 8
mov qword [rsp + 0x10], rdx
mov rax, qword [rax + 8]
add rax, 8
mov qword [rsp + 0x18], rax
xor eax, eax
test rcx, rcx
cmovg rax, rcx
mov qword [rsp + 0x20], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 8], rax
mov eax, dword [0x1401df3e8]
mov ecx, dword [0x1401df3ec]
xor ecx, 0xb1ff37c9
and eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x9d4f62af
add eax, ecx
add eax, 1
mov ecx, 0x58089517
xor ecx, 0x99961f26
or eax, ecx
and eax, eax
xor eax, 0xffffffff
mov ecx, 0x4fd19b6a
and ecx, 0x4fd19b6a
mov edx, 0x26fa7885
xor edx, 0xd905877a
xor ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
cmp eax, 0xf3dc21d5
ja 0x140090e6a
mov r8, qword [rsp + 0x20]
mov eax, dword [0x1401df3f0]
xor edx, edx
div dword [0x1401df3f4]
mov ecx, 0x42b29718
xor edx, edx
div ecx
mov rdx, qword [rsp + 8]
add eax, 0xd68ffa4b
mov ecx, 0xd3eecc3
xor ecx, 0x1edb5675
imul eax, ecx
mov ecx, 0xab454b4b
xor ecx, 0x467fb275
cmp rdx, r8
sete dl
mov byte [rsp + 7], dl
cmp eax, ecx
je 0x140090da9
mov cl, byte [rsp + 7]
xor eax, eax
test cl, 1
mov dword [rsp], eax
jne 0x140090e4f
jmp 0x140090e11
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x18]
mov rax, qword [rsp + 0x10]
movzx eax, byte [rax + rcx]
movzx r8d, byte [rdx + rcx]
mov edx, eax
xor edx, r8d
xor r8d, 0xffffffff
and eax, r8d
shl eax, 1
sub eax, edx
add rcx, 1
cmp eax, 0
mov qword [rsp + 0x28], rcx
mov dword [rsp], eax
je 0x140090d3e
mov eax, dword [rsp]
cmp eax, 0
sete al
mov byte [rsp + 0x4f], al
mov al, byte [rsp + 0x4f]
and al, 1
movzx eax, al
add rsp, 0x50
ret
leave
pop rdx
invalid
Function at 0x14009d700
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401df838]
mov edx, dword [0x1401df83c]
mov ecx, 0x7fe90df
xor ecx, 0x7fe90df
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, 0xf39f2763
xor eax, 0xf39f2763
sub eax, ecx
mov ecx, eax
and ecx, 0xbc1808b
shl ecx, 1
add eax, 0xbc1808b
sub eax, ecx
mov ecx, 0xc2ef6ffd
xor ecx, 0xabf3b391
imul eax, ecx
sub eax, 0x25505e72
cmp eax, 0x6d3c1d9
jb 0x14009d8c6
mov rcx, qword [rbp - 0x10]
mov eax, dword [0x1401df840]
xor eax, 0xed7133d7
mov edx, dword [0x1401df844]
add eax, edx
imul eax, eax, 0x2093c483
add eax, 0x7a12e9fd
mov edx, eax
and edx, 0x76feb817
add edx, edx
sub eax, edx
add eax, 0xf6feb817
mov dword [rbp - 0x18], eax
mov eax, 0xbccafb88
mov dword [rbp - 0x1c], eax
mov eax, 0x10
call fcn.1401da3e0
sub rsp, rax
mov r8, rsp
mov qword [rbp - 0x28], r8
mov edx, 2
sub rsp, 0x20
call fcn.14009d601
mov ecx, dword [rbp - 0x1c]
add rsp, 0x20
mov dl, al
mov eax, dword [rbp - 0x18]
mov byte [rbp - 0x11], dl
cmp eax, ecx
ja 0x14009d76d
mov al, byte [rbp - 0x11]
test al, 1
jne 0x14009d7f4
jmp 0x14009d8b0
mov eax, dword [0x1401df848]
xor eax, dword [0x1401df84c]
and eax, 0x3624616b
mov edx, 0x1b709ebd
xor edx, 0xb657d054
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
or eax, 0xad274ee9
and eax, ecx
mov ecx, 0xe4606062
xor edx, edx
div ecx
cmp eax, 0xd0ab580b
ja 0x14009d8cf
mov eax, dword [0x1401df850]
mov edx, dword [0x1401df854]
xor eax, 0xffffffff
mov ecx, 0x21a32176
xor ecx, 0xde5cde89
xor edx, ecx
mov ecx, 0xdf5250a6
xor ecx, 0xa0469480
mov r8d, 0xd8e43bee
xor r8d, 0x271bc411
xor ecx, r8d
or eax, edx
or ecx, 0x7f14c426
xor eax, 0xffffffff
and eax, ecx
mov ecx, 0x257680f4
xor edx, edx
div ecx
mov ecx, 0x66dbebc4
xor edx, edx
div ecx
or eax, 0x834c6ee
mov dword [rbp - 0x2c], eax
sub rsp, 0x20
call fcn.1400067fe
mov eax, dword [rbp - 0x2c]
add rsp, 0x20
cmp eax, 0x1119552a
je 0x14009d832
jmp 0x14009d8c1
mov rax, qword [rbp - 8]
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rax]
add rcx, qword [rdx]
mov qword [rax], rcx
mov rsp, rbp
pop rbp
ret
mov eax, 0xe987023d
sahf
invalid
pop rsp
retf 0xa59d
Function at 0x1400a2ab0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov rax, rcx
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
add rax, 8
mov qword [rsp + 0x48], rax
mov rax, qword [0x140200080]
mov qword [rsp + 0x50], rax
xor eax, eax
test rcx, rcx
cmovg rax, rcx
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
cmp rcx, rax
setl al
mov byte [rsp + 0x3e], al
cmp rcx, rdx
mov byte [rsp + 0x3f], al
je 0x1400a2b9f
mov al, byte [rsp + 0x3e]
test al, 1
jne 0x1400a2b43
jmp 0x1400a2b25
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffff
call fcn.1400137e9
xor eax, eax
mov byte [rsp + 0x3f], al
jmp 0x1400a2b9f
mov r8, qword [rsp + 0x30]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rcx]
mov cl, byte [rax]
mov al, 1
cmp cl, byte [rdx + r8 + 8]
mov byte [rsp + 0x3f], al
je 0x1400a2b9f
mov rax, qword [rsp + 0x30]
movabs rcx, 0xbd2bb9c3f2792249
movabs rdx, 0xbd2bb9c3f2792249
xor rcx, rdx
sub rcx, rax
xor eax, eax
sub rax, 1
add rcx, rax
xor eax, eax
sub rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x1400a2ae9
mov al, byte [rsp + 0x3f]
mov byte [rsp + 0x2f], al
mov eax, dword [0x1401dfa40]
mov r8d, dword [0x1401dfa44]
xor r8d, 0x4cfe7c1a
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
sub eax, 0xca42a9c0
mov ecx, 0x554cca5
xor ecx, 0xfaab335a
mov edx, eax
xor edx, ecx
and edx, 0xfea73f26
mov r8d, 0xffffffff
xor r8d, 0xfea73f26
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xfea73f26
or eax, 0xfea73f26
imul eax, edx
add eax, ecx
and eax, 0xaea06d1c
cmp eax, 0x40a7e701
jae 0x1400a2c7b
mov eax, dword [0x1401dfa48]
imul eax, dword [0x1401dfa4c]
mov ecx, 0x8471cec7
xor edx, edx
div ecx
mov ecx, 0x2348f207
xor ecx, 0x1e031818
xor eax, ecx
mov ecx, 0x4a19741
xor ecx, 0xa352877e
xor eax, ecx
cmp eax, 0x5a90c1e9
jbe 0x1400a2c32
mov al, byte [rsp + 0x2f]
and al, 1
movzx eax, al
add rsp, 0x68
ret
sbb esp, ebp
rol byte [0x14009db6d], 0xff
Function at 0x1400a2d90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov eax, dword [0x1401dfa50]
and eax, dword [0x1401dfa54]
mov ecx, 0x611e0436
xor ecx, 0x1b4eba32
or eax, ecx
mov r8d, 0xffffffff
xor r8d, 0xa8caa760
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0x993a7882
xor r8d, 0x31f0dfe2
mov edx, eax
and edx, r8d
or eax, 0xa8caa760
imul eax, edx
add eax, ecx
mov ecx, 0xbe029864
xor ecx, 0x7ed40027
add eax, ecx
mov ecx, 0x76ef9b30
xor ecx, 0x12ead02c
cmp eax, ecx
je 0x1400a2e8c
mov eax, dword [0x1401dfa58]
sub eax, dword [0x1401dfa5c]
xor eax, 0x48e92aca
mov ecx, 0x545437c6
xor ecx, 0x9ba3c3df
add eax, ecx
add eax, 0x227a18c0
sub eax, 0xcff7f419
mov ecx, 0x3cd366da
xor ecx, 0xa800544d
add eax, ecx
mov ecx, 0xd349e42f
xor ecx, 0x16327862
add eax, ecx
mov ecx, 0x9382cc6f
xor ecx, 0x751fef8
sub eax, ecx
mov dword [rsp + 0x2c], eax
mov rax, qword [0x1401f0e70]
mov ecx, dword [rax]
call fcn.1400065b3
mov rcx, rax
mov eax, dword [rsp + 0x2c]
add rcx, 0x60
mov qword [rsp + 0x30], rcx
cmp eax, 0xd67449c9
je 0x1400a2e06
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, 0xe987023d
jno 0x1400a2e92
invalid
invalid
Function at 0x1400a7b20
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401dfad0]
mov edx, dword [0x1401dfad4]
xor edx, 0xfbf41832
mov ecx, eax
xor ecx, edx
mov r8d, 0x21a32176
xor r8d, 0xde5cde89
xor ecx, r8d
or eax, edx
and eax, ecx
mov ecx, 0x18dce043
xor ecx, 0xeefaf4eb
xor edx, edx
div ecx
add eax, 0x44793229
imul eax, eax, 0x5c49b2c2
cmp eax, 0xa6cd78a0
jae 0x1400a7be2
mov eax, dword [0x1401dfad8]
add eax, dword [0x1401dfadc]
mov ecx, 0x78aa4a64
xor ecx, 0x60f6de2d
and eax, ecx
mov ecx, 0xe102505c
xor ecx, 0x2d2e09ed
sub eax, ecx
sub eax, 0x15a05722
add eax, 0xcc2c59b1
or eax, 0x500e2840
mov dword [rsp + 0x24], eax
call fcn.1400a7340
mov rcx, qword [rsp + 0x30]
call qword [0x1402001b0]
mov rcx, rax
mov eax, dword [rsp + 0x24]
mov qword [rsp + 0x28], rcx
cmp eax, 0xeabfd764
jb 0x1400a7b78
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret
push rdx
movabs dword [0xfffffff8de98c0b], eax
invalid
Function at 0x1400b5ac0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rcx
call fcn.1400cac70
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
call fcn.14009d8d8
mov ecx, eax
mov rax, qword [rsp + 0x48]
mov dword [rsp + 0x54], ecx
cmp byte [rax + 0x60], 0
jne 0x1400b5c28
mov eax, dword [rsp + 0x54]
movsxd rcx, eax
mov qword [rsp + 0x28], rcx
mov ecx, 0x1f6116d2
xor ecx, 0x1f6116d2
cmp eax, ecx
jge 0x1400b5c14
mov ecx, dword [0x1401dff60]
xor ecx, 0xd1d26c93
mov edx, dword [0x1401dff64]
mov r8d, ecx
xor r8d, 0xffffffff
mov eax, edx
and eax, r8d
xor edx, 0xffffffff
and ecx, edx
or eax, ecx
mov ecx, 0xc32a6108
xor edx, edx
div ecx
mov r8d, 0x1fb9f7c8
xor r8d, 0xa209cf57
mov ecx, 0xf5512c9c
xor ecx, 0xaaed363
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x6859012
xor r8d, 0xf97a6fed
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xbdb0389f
or eax, 0xbdb0389f
imul eax, edx
add eax, ecx
and eax, 0x5012b72
cmp eax, 0x7edaf8de
je 0x1400b5c32
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401dff68]
add eax, dword [0x1401dff6c]
add eax, 0x1a6980bb
or eax, 0xaf27b095
mov r8d, 0xc83546c5
xor edx, edx
div r8d
mov dword [rsp + 0x24], eax
movabs rdx, 0x374520b4b88f9b7c
movabs rax, 0x374520b4b88f9b7c
xor rdx, rax
movabs r8, 0xf158ff614a64defe
movabs rax, 0x8ea7009eb59b2101
xor r8, rax
call fcn.14000c499
mov eax, dword [rsp + 0x24]
cmp eax, 0x3501ab3d
je 0x1400b5ba3
jmp 0x1400b5c28
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call fcn.14009da70
mov rax, qword [rsp + 0x38]
add rsp, 0x58
ret
cmp al, 9
adc dword [rsi - 0x9717], esp
dec dword [rdi]
invalid
Function at 0x1400b8f00
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov qword [rsp + 0x40], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x4f], al
je 0x1400b911a
mov rax, qword [rsp + 0x40]
xor ecx, ecx
sub rcx, rax
xor eax, eax
sub rax, 0xfffffffffffffff0
add rcx, rax
movabs rax, 0x5ef0b8bcb0a2b46
movabs rdx, 0x5ef0b8bcb0a2b46
xor rax, rdx
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rcx, qword [rax]
mov qword [rsp + 0x38], rcx
mov al, 1
cmp rcx, 0x10
mov byte [rsp + 0x4f], al
jb 0x1400b911a
mov eax, dword [0x1401e00a0]
xor eax, dword [0x1401e00a4]
sub eax, 0xe7e99869
mov ecx, 0x81926e8d
xor ecx, 0x33feeae9
xor eax, ecx
mov ecx, 0x5d95059a
xor ecx, 0x4b67be20
xor edx, edx
div ecx
mov ecx, 0x2d0370f6
xor ecx, 0x5ee39aa5
cmp eax, ecx
jae 0x1400b9129
mov r10, qword [rsp + 0x38]
mov eax, dword [0x1401e00a8]
mov ecx, 0x3aa8c080
xor ecx, 0x45332ae6
xor eax, ecx
mov ecx, dword [0x1401e00ac]
mov edx, 0x218436b
xor edx, 0x3957b39b
xor ecx, edx
or eax, ecx
mov ecx, 0x5310fcf3
xor ecx, 0xdbe04f80
and eax, ecx
mov ecx, 0x71d9731e
xor ecx, 0xcdc4e6e0
add eax, ecx
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0xe992597b
add ecx, eax
mov eax, 0x4831a9b5
xor eax, 0x4831a9b5
sub eax, ecx
mov ecx, 0x78775b1
xor ecx, 0x3e3f5da1
mov rdx, r10
add rdx, 0xfffffffffffffff0
mov qword [rsp + 0x20], rdx
mov r8, rdx
xor r8, 0xffffffffffffffff
mov r9, rdx
xor r9, 0xffffffffffffffff
or r8, r9
movabs r9, 0x883b5c8f6d4203ca
movabs r11, 0x77c4a37092bdfc35
xor r9, r11
xor r8, r9
mov r9, r10
xor r9, 0xffffffffffffffff
or r8, r9
and r10, r10
movabs r9, 0x24d6f1060227e98d
movabs r11, 0xdb290ef9fdd81672
xor r9, r11
xor r10, r9
mov r9, rdx
xor r9, 0xffffffffffffffff
movabs r11, 0xd5223fd24140750d
movabs rsi, 0x2addc02dbebf8af2
xor r11, rsi
xor r10, r11
or r9, r10
xor r8, 0xffffffffffffffff
movabs r10, 0xbc4ea566b29ad578
movabs r11, 0x43b15a994d652a87
xor r10, r11
xor r9, r10
or r8, r9
cmp r8, 0
setl r8b
movabs r9, 0x9792b7a390bfd12e
movabs r10, 0x686d485c6f402ed1
xor r9, r10
cmp rdx, r9
setg dl
and dl, r8b
mov byte [rsp + 0x2f], dl
cmp eax, ecx
je 0x1400b9129
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1400b90f7
jmp 0x1400b9107
call fcn.1400067fe
xor eax, eax
mov byte [rsp + 0x4f], al
jmp 0x1400b911a
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x4f], al
mov al, byte [rsp + 0x4f]
and al, 1
movzx eax, al
add rsp, 0x50
pop rsi
ret
lahf
int1
movabs al, byte [0x6666fffffe72e9c0]
nop word cs:[rax + rax]
Function at 0x1400cac70
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x1401e0800]
mov eax, 0x5152efdb
xor eax, 0xe0684bff
xor ecx, eax
mov r8d, dword [0x1401e0804]
xor r8d, 0x8e733880
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, ecx
and edx, r9d
mov eax, ecx
or eax, r9d
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, r8d
or ecx, r8d
imul ecx, edx
add ecx, eax
mov eax, ecx
and eax, 0x3f08e0d1
mov edx, 0xe8f4e9da
xor edx, 0x170b1625
xor eax, edx
and ecx, 0x3f08e0d1
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
mov edx, eax
xor edx, 0xffffffff
and edx, 0x6b85146e
mov r8d, 0xffffffff
xor r8d, 0x6b85146e
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x6b85146e
or eax, 0x6b85146e
imul eax, edx
add eax, ecx
mov ecx, 0x777623c5
xor ecx, 0xbc84baf4
imul eax, ecx
cmp eax, 0x83bba941
jbe 0x1400cadba
mov eax, dword [0x1401e0808]
mov edx, dword [0x1401e080c]
mov ecx, 0xa3ab0a68
xor ecx, 0x5c54f597
xor eax, ecx
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xa7d03ed0
or eax, edx
or ecx, 0xa7d03ed0
mov edx, 0xae92c6e6
xor edx, 0x516d3919
xor eax, edx
and eax, ecx
or eax, 0x80748b5f
xor eax, 0x1aca0663
mov ecx, 0xb0f4179d
xor ecx, 0xb0f4179d
mov edx, 0x7dbcb71b
xor edx, 0x8ecfd080
sub ecx, edx
add eax, ecx
mov dword [rsp + 0x2c], eax
mov rax, qword [0x1401f0e70]
mov ecx, dword [rax]
call fcn.1400065b3
mov rcx, rax
mov eax, dword [rsp + 0x2c]
mov qword [rsp + 0x30], rcx
cmp eax, 0x306f35cc
jbe 0x1400cad25
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
cmp ebx, ebp
mov edx, 0xff62e965
invalid