joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007c860
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401dba58]
sub eax, dword [0x1401dba5c]
mov edx, 0xffffffff
xor edx, 0x7b40099d
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0x7b40099d
add eax, edx
sub eax, ecx
mov ecx, 0x3797b5f0
xor ecx, 0x19a7f5da
and eax, ecx
mov ecx, 0xe9457779
xor ecx, 0xb933c686
imul eax, ecx
mov ecx, 0xf9523ba1
xor ecx, 0x9d487e7f
cmp eax, ecx
jb 0x14007cac3
mov eax, dword [0x1401dba60]
mov ecx, dword [0x1401dba64]
xor eax, ecx
add eax, 0xaf0486e0
imul rax, rax, 0x2ad73a37
shr rax, 0x3b
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.1401d7280
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.140068a70
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov edx, 3
sub rsp, 0x20
call fcn.140069200
mov rcx, qword [rbp - 0x20]
mov eax, dword [rbp - 0x18]
add rsp, 0x20
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0x638a424f
jae 0x14007c8c7
mov al, byte [rbp - 0x11]
test al, 1
jne 0x14007c94e
jmp 0x14007cabe
mov ecx, dword [0x1401dba68]
mov edx, dword [0x1401dba6c]
mov eax, 0x79840732
xor eax, 0xbd96359c
xor edx, eax
mov eax, ecx
xor eax, 0xffffffff
mov r8d, 0x7b554ce6
xor r8d, 0x84aab319
xor ecx, r8d
or eax, ecx
mov r8d, 0x4ce060e
xor r8d, 0xfb31f9f1
mov ecx, edx
xor ecx, r8d
mov r8d, 0x81aafeb8
xor r8d, 0x7e550147
xor edx, r8d
or ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
sub eax, 0xbe496dd8
mov ecx, 0x1b3ebab9
xor ecx, 0xd430a4f0
sub eax, ecx
mov ecx, 0xeb9c67c6
xor ecx, 0xf72ccc17
add eax, ecx
add eax, 0xcf0e1e49
xor ecx, ecx
sub ecx, 0x9edce8b8
sub eax, ecx
mov ecx, 0x23fe616b
xor ecx, 0x5d9da671
cmp eax, ecx
jb 0x14007cacc
mov rcx, qword [rbp - 8]
mov eax, dword [0x1401dba70]
mov r8d, dword [0x1401dba74]
xor edx, edx
sub edx, r8d
sub eax, edx
add eax, 0x9aadafd3
mov edx, 0x6921730e
xor edx, 0xbbb87222
and eax, edx
mov r8d, 0xe1286c2f
xor edx, edx
div r8d
mov edx, eax
mov rax, qword [rbp - 0x10]
mov dword [rbp - 0x30], edx
mov edx, 0x93466391
xor edx, 0x8b097bd4
mov dword [rbp - 0x34], edx
mov rdx, qword [rax]
sub rsp, 0x20
call fcn.140073f88
mov rdx, qword [rbp - 0x20]
mov ecx, dword [rbp - 0x34]
mov eax, dword [rbp - 0x30]
add rsp, 0x20
cmp byte [rdx], 0
sete dl
mov byte [rbp - 0x29], dl
cmp eax, ecx
je 0x14007c9ea
mov al, byte [rbp - 0x29]
test al, 1
jne 0x14007ca71
jmp 0x14007cabe
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov edx, dword [rax + 8]
sub rsp, 0x20
call fcn.140069a0b
mov rax, qword [rbp - 0x20]
add rsp, 0x20
cmp byte [rax], 0
jne 0x14007cabe
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax + 0x10]
mov qword [rdx], r8
mov rax, qword [rax + 0x18]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14007c688
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
int 0xce
in al, 0xe9
sti
std
invalid
shr ebx, 0x4a
jmp 0x14007c9ea
Function at 0x140082ba0
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x10
mov qword [rsp], rcx
mov qword [rsp + 8], rcx
mov eax, dword [0x1401dbd88]
mov edx, dword [0x1401dbd8c]
xor edx, 0xef9a279e
mov ecx, edx
and ecx, eax
mov r8d, 0x59f264ac
xor r8d, 0xa60d9b53
xor ecx, r8d
add eax, edx
add eax, 1
add eax, ecx
mov edx, 0xffffffff
xor edx, 0x101a3d04
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0x101a3d04
add eax, edx
sub eax, ecx
xor eax, 0xd2fb381f
and eax, 0xbaea6e0b
cmp eax, 0x9359175b
jae 0x140082c9c
mov rcx, qword [rsp]
mov eax, dword [0x1401dbd90]
xor eax, dword [0x1401dbd94]
xor eax, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0x44fe2a8e
mov edx, 0x6ab89103
xor edx, 0xdad226a0
mov r9d, 0xa32527cd
xor r9d, 0x5cdad832
xor edx, r9d
or eax, r8d
or edx, 0xb06ab7a3
xor eax, 0xffffffff
and eax, edx
add eax, 0xc5fdba27
mov edx, 0x6f220b43
xor edx, 0x8275941f
sub eax, edx
movabs rdx, 0xad1a53dda4fb7275
movabs r8, 0xad1a53dda4fb7275
xor rdx, r8
mov qword [rcx], rdx
mov qword [rcx + 8], 0
cmp eax, 0xf8a21f36
ja 0x140082c0a
mov rax, qword [rsp + 8]
add rsp, 0x10
ret
mov dword [rbx + rdi - 0x9a1610], eax
invalid

Function at 0x140082cb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401dbd98]
mov ecx, dword [0x1401dbd9c]
mov edx, 0x23b9acfd
xor edx, 0x77f079c5
xor ecx, edx
xor edx, edx
div ecx
xor eax, 0xdff551cf
mov ecx, 0xed7048c4
xor ecx, 0x427e742e
add eax, ecx
add eax, 0xa18fa50a
cmp eax, 0x8bd87a4e
jae 0x140082d7a
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401dbda0]
or eax, dword [0x1401dbda4]
add eax, 0x349324df
mov edx, 0xd1c78b6f
xor edx, 0x6bed3023
add eax, edx
mov edx, 0x86ba5512
xor edx, 0xb22971cd
sub eax, edx
mov edx, 0x6070b608
xor edx, 0x9a0bda58
imul eax, edx
imul eax, eax, 0x61e84fe1
mov dword [rsp + 0x24], eax
movabs rdx, 0x375d7b1ad8f666c8
movabs rax, 0x375d7b1ad8f666d8
xor rdx, rax
call fcn.140082990
mov eax, dword [rsp + 0x24]
cmp eax, 0xb6d42c42
jae 0x140082cfd
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
ret 0x8ec1
Function at 0x1400845a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov rax, qword [0x1401eeb10]
mov ecx, dword [rax]
call fcn.140007a23
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.140083f31
test al, 1
jne 0x1400845d3
jmp 0x1400846e8
mov rcx, qword [rsp + 0x28]
call fcn.140084010
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x1400846e8
mov ecx, dword [0x1401dbe28]
mov r8d, dword [0x1401dbe2c]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, ecx
and edx, r9d
mov eax, ecx
or eax, r9d
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, r8d
or ecx, r8d
imul ecx, edx
add ecx, eax
mov edx, 0x2a564f00
xor edx, 0xd5a9b0ff
mov eax, ecx
xor eax, edx
mov edx, 0xffffffff
xor edx, 0xd659ccb5
or eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xd659ccb5
or ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov edx, 0xffffffff
xor edx, 0x188c84d2
mov ecx, eax
and ecx, edx
mov r8d, 0xba0fa655
xor r8d, 0xa2832287
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
mov ecx, 0xffffffff
xor ecx, 0xe7414aeb
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
cmp eax, 0x8f37cec5
je 0x1400847b5
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401dbe30]
xor eax, 0x4dd62bc2
and eax, dword [0x1401dbe34]
mov r8d, 0x9c7fd605
xor edx, edx
div r8d
mov r8d, 0xf6e61f36
xor edx, edx
div r8d
or eax, 0xed02f511
mov dword [rsp + 0x24], eax
mov edx, 8
call fcn.14000de70
mov eax, dword [rsp + 0x24]
cmp eax, 0xd0042875
jbe 0x1400847b5
jmp 0x1400846e8
mov eax, dword [0x1401dbe38]
mov edx, dword [0x1401dbe3c]
xor edx, 0xd9d2982c
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov ecx, 0xbe925c80
xor ecx, 0xc02a9d7b
or eax, ecx
xor ecx, ecx
sub ecx, 0xc4781d86
sub eax, ecx
mov ecx, 0x788066a
xor edx, edx
div ecx
cmp eax, 0x637c5dd6
ja 0x1400847be
mov eax, dword [0x1401dbe40]
sub eax, dword [0x1401dbe44]
xor eax, 0x79cb764
mov ecx, 0xa1b41026
xor ecx, 0x5e4befd9
mov edx, eax
xor edx, ecx
and edx, 0x1fc90f3
mov r8d, 0xfc4eb514
xor r8d, 0xfdb225e7
mov ecx, 0x1fefdb90
xor ecx, 0xe010246f
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0xcf68d355
xor r8d, 0xce9443a6
mov edx, eax
and edx, r8d
or eax, 0x1fc90f3
imul eax, edx
add eax, ecx
mov ecx, 0x8698f0c7
xor ecx, 0xadf70fa
and eax, ecx
mov ecx, 0xc30f94e7
xor ecx, 0xe2d64821
cmp eax, ecx
ja 0x14008472b
add rsp, 0x38
ret
shl byte [rcx + 0x38], cl
insb byte [rdi], dx
jmp 0x140084695
in al, 0x63
pop rsp
jmp 0x14008472b
Function at 0x14008f5a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
call fcn.14008f580
xor eax, eax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov eax, dword [0x1401dc2a8]
mov r8d, dword [0x1401dc2ac]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
mov r9d, 0xa75ae215
xor r9d, 0x58a51dea
xor ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
imul eax, eax, 0x3a1e0a07
mov ecx, 0xa1663afa
xor ecx, 0x92af3a51
and eax, ecx
sub eax, 0xd5adc6af
cmp eax, 0x606787ce
je 0x14008f6d0
mov eax, dword [0x1401dc2b0]
mov ecx, dword [0x1401dc2b4]
mov edx, 0xd5d8a6ae
xor edx, 0xa215a7df
sub eax, edx
sub eax, ecx
add eax, 0x77cd0171
and eax, 0x2469cad5
mov ecx, 0x5a70a99a
xor ecx, 0x896de105
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x30]
mov ecx, 0xdd4b940c
xor ecx, 0x6619a66b
sub eax, ecx
mov ecx, 0x5fa35919
xor ecx, 0x404c8289
cmp rdx, 0x20
sete dl
mov byte [rsp + 0x2f], dl
cmp eax, ecx
jbe 0x14008f620
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x14008f6cb
jmp 0x14008f695
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov byte [rcx + rax], 0
movabs rcx, 0x46ab8452a8e08009
sub rax, rcx
add rax, 1
movabs rcx, 0x46ab8452a8e08009
add rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x14008f5b5
add rsp, 0x48
ret
pop rdi
in al, 0x7e
jmp 0x14008f620
Function at 0x14009a5a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401dc5c8]
xor edx, edx
div dword [0x1401dc5cc]
imul ecx, eax, 0x32aa19ed
mov eax, 0xa21b9873
xor eax, 0x10220f75
or ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x826647e4
mov edx, 0xffffffff
xor edx, 0x826647e4
and ecx, edx
or eax, ecx
cmp eax, 0x39331617
jbe 0x14009a7bb
mov eax, dword [0x1401dc5d0]
xor eax, 0xc003da7d
mov ecx, dword [0x1401dc5d4]
sub eax, ecx
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xee85f422
and ecx, 0x117a0bdd
imul ecx, edx
mov edx, eax
and edx, 0x117a0bdd
or eax, 0x117a0bdd
imul eax, edx
add eax, ecx
mov ecx, eax
not ecx
or eax, 0x44191002
or ecx, 0x8b440064
and eax, ecx
not eax
and eax, 0xcf5d1066
mov dword [rbp - 0x3c], eax
mov eax, 0x10
call fcn.1401d7280
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x48], rax
sub rsp, 0x20
call fcn.1400994ac
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x10]
add rsp, 0x20
mov r8, rax
mov eax, dword [rbp - 0x3c]
mov qword [rbp - 0x38], r8
mov r8, rcx
add r8, 8
mov qword [rbp - 0x30], r8
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x28], rcx
mov r8, rdx
add r8, 8
mov qword [rbp - 0x20], r8
cmp rcx, qword [rdx + 8]
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0xb05e3458
je 0x14009a5f6
mov rax, qword [rbp - 0x28]
mov cl, byte [rbp - 0x11]
test cl, 1
mov qword [rbp - 0x50], rax
jne 0x14009a79d
jmp 0x14009a6ca
mov rcx, qword [rbp - 0x48]
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.1400990c0
mov rax, qword [rbp - 0x38]
add rsp, 0x20
cmp byte [rax], 0
jne 0x14009a7b6
mov ecx, dword [0x1401dc5d8]
xor ecx, 0xcb50ce5b
and ecx, dword [0x1401dc5dc]
mov eax, 0x37f788d1
xor eax, 0x2f1f1cd
xor ecx, eax
mov eax, ecx
and eax, 0xf99ee7bf
mov edx, 0x1c7407f6
xor edx, 0xe5eae049
xor ecx, edx
or eax, ecx
mov ecx, 0xe48c4956
xor ecx, 0x2875db8d
xor edx, edx
div ecx
cmp eax, 0x489dcba7
ja 0x14009a7c4
mov rcx, qword [rbp - 0x20]
mov eax, dword [0x1401dc5e0]
mov edx, dword [0x1401dc5e4]
xor edx, 0x1ccfc92e
imul eax, edx
mov r8d, 0x3bc05a27
xor edx, edx
div r8d
or eax, 0x16ba9ea2
mov edx, 0xaf342fcd
xor edx, 0x4b159474
or eax, edx
mov rcx, qword [rcx]
mov qword [rbp - 0x58], rcx
cmp eax, 0xf2a76ec
jb 0x14009a7c4
mov rax, qword [rbp - 0x58]
mov qword [rbp - 0x50], rax
jmp 0x14009a79d
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp - 8]
mov r8, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x50]
mov r8, qword [r8]
mov qword [rdx], r8
mov qword [rax], rcx
mov rsp, rbp
pop rbp
ret
xor byte [rdi + 0x32e9957a], ch
invalid
sahf
or byte [r15 - 0x8417], bl
dec dword [rax - 0x39]
add dword [rax], eax
add byte [rax], al
add byte [rax - 0x39], cl
or byte [r8], al
add byte [rax], al
add bl, al
nop dword [rax]
Function at 0x14009dc30
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
mov r8d, dword [0x1401dc778]
mov edx, dword [0x1401dc77c]
mov eax, r8d
xor eax, 0xffffffff
and eax, 0x924dd509
mov r9d, 0xffffffff
xor r9d, 0x924dd509
and r8d, r9d
mov ecx, edx
xor ecx, 0xffffffff
and ecx, 0x924dd509
and edx, r9d
or eax, r8d
or ecx, edx
xor eax, ecx
mov ecx, 0xe11815de
xor ecx, 0x71370605
add eax, ecx
imul eax, eax, 0xb503914c
or eax, eax
xor eax, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x11977db7
mov edx, 0xe9729ca0
xor edx, 0xf8e5e117
mov r8d, 0xe89b42c3
xor r8d, 0x1764bd3c
xor edx, r8d
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
cmp eax, 0x98b090da
je 0x14009ddee
mov ecx, dword [0x1401dc780]
mov eax, dword [0x1401dc784]
xor eax, ecx
xor eax, 0xfc54ec99
add eax, 0x40b980cc
mov dword [rbp - 0x2c], eax
mov eax, 0x10
call fcn.1401d7280
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x38], rax
sub rsp, 0x20
call fcn.14009d3cb
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov r8, rax
mov eax, dword [rbp - 0x2c]
add r8, 0x60
mov qword [rbp - 0x28], r8
mov qword [rdx], 0
mov qword [rdx + 8], 0
cmp rcx, 0
sete cl
mov byte [rbp - 0x19], cl
cmp eax, 0x698029d7
jae 0x14009dcd3
mov al, byte [rbp - 0x19]
test al, 1
jne 0x14009dde5
jmp 0x14009dd59
mov rax, qword [rbp - 0x18]
mov ax, word [rax]
mov cx, 0x68b1
xor cx, 0x68b0
shr ax, cl
mov rcx, qword [rbp - 0x10]
movzx eax, ax
mov edx, eax
sub rsp, 0x20
call fcn.14009b650
mov rax, qword [rbp - 0x28]
add rsp, 0x20
cmp byte [rax], 0
jne 0x14009dde5
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.14009d3d9
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x40], rcx
cmp byte [rax], 0
jne 0x14009dde5
mov rcx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x18]
mov rdx, qword [rax + 8]
movzx eax, word [rax]
mov r8d, eax
sub rsp, 0x20
call fcn.14009dbb7
add rsp, 0x20
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
pushfq
xchg r15d, eax
fsub st(1), st(0)
fdiv st(6), st(0)
invalid
Function at 0x14009ea80
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov rax, qword [rcx]
mov qword [rsp + 0x38], rax
movabs rcx, 0x1c5d259b627b518a
movabs rdx, 0x1c5d259b627b5188
xor rcx, rdx
cqo
idiv rcx
mov r8, rax
mov rax, qword [rsp + 0x38]
movabs rcx, 0xf3a063571b6f9c1a
movabs rdx, 0xc5f9ca8e49063e5
xor rcx, rdx
movabs rdx, 0x8098726e5a4ca6ee
movabs r9, 0x7f678d91a5b35911
xor rdx, r9
xor rcx, rdx
xor edx, edx
sub rdx, 1
sub rcx, rdx
mov rdx, r8
sub rdx, rcx
mov qword [rsp + 0x40], rdx
mov rcx, rdx
xor rcx, 0xffffffffffffffff
movabs r10, 0x116f943fd7571e73
movabs r9, 0xee906bc028a8e18c
xor r10, r9
mov r9, rdx
xor r9, r10
or rcx, r9
and rcx, r8
movabs r9, 0x4cb97e7583f96f98
movabs r10, 0xb346818a7c069067
xor r9, r10
xor rcx, r9
and r8, r8
xor r8, 0xffffffffffffffff
and rdx, r8
xor rdx, 0xffffffffffffffff
movabs r8, 0xa5af6db3d57afabb
movabs r9, 0x5a50924c2a850544
xor r8, r9
xor rcx, r8
xor rdx, 0xffffffffffffffff
or rcx, rdx
movabs rdx, 0x543549eb9c9df318
movabs r8, 0x543549eb9c9df318
xor rdx, r8
cmp rcx, rdx
setl dl
movabs rcx, 0x46d3e513515153ad
movabs r8, 0x46d3e513515153ac
xor rcx, r8
cmp rax, rcx
setg cl
xor dl, 0xff
mov al, cl
xor al, dl
and al, cl
test al, 1
jne 0x14009ebb8
jmp 0x14009ebc2
call fcn.140007bb8
jmp 0x14009ecf2
mov eax, dword [0x1401dc7f8]
xor eax, 0xa6edf463
xor edx, edx
div dword [0x1401dc7fc]
mov edx, 0x395d99fc
xor edx, 0xc6a26603
mov ecx, eax
xor ecx, edx
mov edx, 0x93a222c4
xor edx, 0x2d100519
and edx, ecx
mov r8d, 0xffffffff
xor r8d, 0xbeb227dd
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xbeb227dd
or eax, 0xbeb227dd
imul eax, edx
add eax, ecx
mov edx, 0xffffffff
xor edx, 0x16a3228a
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0x16a3228a
add eax, edx
sub eax, ecx
sub eax, 0xe2a04465
mov ecx, 0xe0d7b33
xor ecx, 0x3942e77d
sub eax, ecx
mov ecx, 0x1dcb49c0
xor ecx, 0xff6b0da5
add eax, ecx
mov ecx, 0x8c4351c0
xor ecx, 0x2312fa5
cmp eax, ecx
je 0x14009ecfc
mov rdx, qword [rsp + 0x40]
mov ecx, dword [0x1401dc800]
mov r8d, dword [0x1401dc804]
mov r9d, 0x87d1f6c1
xor r9d, 0x87d1f6c0
mov eax, ecx
add eax, r9d
mov r9d, 0x8e8ca321
xor r9d, 0x71735cde
xor ecx, r9d
or ecx, r8d
add ecx, eax
sub ecx, 0x779d01a2
mov r8d, 0xef884c6a
xor r8d, 0x7d9b05b2
mov eax, 0xaa628b41
xor eax, 0x559d74be
xor r8d, eax
mov eax, ecx
xor eax, r8d
and eax, ecx
add eax, 0xd6d5012
xor ecx, ecx
test rdx, rdx
cmovg rcx, rdx
mov qword [rsp + 0x30], rcx
cmp eax, 0x1e55e7af
jae 0x14009ec65
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
jmp 0x14009ecf2
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret
xor al, 0xe8
add r9, r13
invalid
Function at 0x14009ed10
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov ecx, dword [0x1401dc808]
mov eax, dword [0x1401dc80c]
xor eax, 0x84de1a20
or ecx, eax
mov edx, 0x8d90ece0
xor edx, 0x726f131f
mov eax, ecx
xor eax, edx
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0xb172f02f
or ecx, 0xb172f02f
xor ecx, 0xffffffff
mov edx, 0x59ac0661
xor edx, 0xa653f99e
xor eax, edx
xor ecx, 0xffffffff
and eax, ecx
imul ecx, eax, 0xda82fb42
mov edx, ecx
xor edx, 0xffffffff
mov eax, 0x3dc956fe
xor eax, 0x5372e023
and eax, edx
mov edx, 0xffffffff
xor edx, 0x6ebbb6dd
and ecx, edx
or eax, ecx
cmp eax, 0x60aee25f
je 0x14009ef69
mov rcx, qword [rbp - 0x10]
mov eax, dword [0x1401dc810]
mov r8d, dword [0x1401dc814]
xor r8d, 0xddc9d9ed
xor edx, edx
div r8d
imul eax, eax, 0x7a7f4462
add eax, 0xfc869bec
shr eax, 4
imul rax, rax, 0x4c8ed3d
shr rax, 0x35
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.1401d7280
sub rsp, rax
mov r8, rsp
mov qword [rbp - 0x20], r8
mov edx, 1
sub rsp, 0x20
call fcn.14009ba10
add rsp, 0x20
mov cl, al
mov eax, dword [rbp - 0x18]
mov byte [rbp - 0x11], cl
cmp eax, 0x39e60acb
ja 0x14009ed9a
mov al, byte [rbp - 0x11]
test al, 1
jne 0x14009ee1c
jmp 0x14009ee2e
sub rsp, 0x20
call fcn.140007bb8
add rsp, 0x20
jmp 0x14009ef64
mov ecx, dword [0x1401dc818]
mov r8d, dword [0x1401dc81c]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, ecx
and edx, r9d
mov eax, ecx
or eax, r9d
mov r9d, 0x4850eb75
xor r9d, 0xb7af148a
xor eax, r9d
imul eax, edx
mov edx, ecx
and edx, r8d
or ecx, r8d
imul ecx, edx
add ecx, eax
mov eax, 0x3c1da2dd
xor eax, 0x4c4d9d10
sub ecx, eax
mov eax, ecx
xor eax, 0xc8ace537
mov edx, 0xf58f7eec
xor edx, 0xa708113
xor eax, edx
and eax, 0xc8ace537
shl eax, 1
mov edx, 0x62a26020
xor edx, 0xaa0e8517
sub eax, edx
sub ecx, eax
mov eax, ecx
or eax, 0x7983effb
xor eax, 0xffffffff
or ecx, 0x7983effb
mov edx, 0x65f6e7f8
xor edx, 0x9a091807
xor ecx, edx
or eax, ecx
xor eax, 0xffffffff
cmp eax, 0x36c89530
je 0x14009ef72
mov rcx, qword [rbp - 8]
mov eax, dword [0x1401dc820]
xor edx, edx
div dword [0x1401dc824]
mov edx, 0x9b89f9a7
xor edx, 0xf08bde78
sub eax, edx
mov r8d, 0x89498238
xor edx, edx
div r8d
mov rdx, qword [rbp - 0x20]
mov r9d, 0xffffffff
xor r9d, 0x7aeac2ec
mov r8d, eax
and r8d, r9d
mov r9d, eax
xor r9d, 0x7aeac2ec
add eax, r9d
sub eax, r8d
mov r8, qword [rcx]
mov rdx, qword [rdx]
movabs r9, 0x2131b074119712e1
movabs r10, 0x7a8d7b09030426f8
xor r9, r10
add rdx, r9
add rdx, r8
movabs r8, 0x5bbccb7d12933419
sub rdx, r8
mov qword [rcx], rdx
cmp eax, 0xc634e5c5
jae 0x14009ef72
jmp 0x14009ef64
mov rsp, rbp
pop rbp
ret
mov esi, 0xe94baa75
sub dh, bh
invalid
sti
in al, dx
sbb esp, dword [rdx]
jmp 0x14009eed0
Function at 0x1400a7a90
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x48
mov dword [rsp + 0x34], r8d
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1401dcad0]
mov ecx, 0x2f8ea437
xor ecx, 0xd723396d
xor eax, ecx
mov edx, dword [0x1401dcad4]
mov r8d, eax
xor r8d, edx
xor r8d, 0xffffffff
mov ecx, edx
and ecx, r8d
shl ecx, 1
sub ecx, edx
sub eax, ecx
mov edx, 0x81d96c14
xor edx, 0x7e2693eb
mov ecx, eax
xor ecx, edx
and ecx, 0xac6b1ec7
mov edx, 0xffffffff
xor edx, 0xac6b1ec7
and eax, edx
sub eax, ecx
or eax, eax
xor eax, 0xffffffff
mov ecx, 0x6ecff8f0
or ecx, 0x6ecff8f0
xor ecx, 0xffffffff
mov edx, 0x54e0f67a
xor edx, 0xab1f0985
xor eax, edx
xor ecx, 0xffffffff
and eax, ecx
sub eax, 0x4e371476
mov ecx, 0x1a9e871c
xor ecx, 0xe293d853
add eax, ecx
mov ecx, 0x6adb40d3
xor ecx, 0x24ec54a5
add eax, ecx
cmp eax, 0x82f82db7
je 0x1400a7bc6
mov eax, dword [0x1401dcad8]
or eax, dword [0x1401dcadc]
sub eax, 0x1a803701
mov r8d, 0xffffffff
xor r8d, 0xefe667a8
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xefe667a8
or eax, 0xefe667a8
imul eax, edx
add eax, ecx
xor eax, 0x564f8e6e
mov dword [rsp + 0x2c], eax
call fcn.1400a7692
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov r8d, dword [rsp + 0x34]
call qword [0x1401fe108]
mov ecx, eax
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x30], ecx
cmp eax, 0x4117af9
je 0x1400a7b45
mov eax, dword [rsp + 0x30]
add rsp, 0x48
ret
setbe byte [rcx]
push rsi
jmp 0x1400a7b45
Function at 0x1400a7bd0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov dword [rsp + 0x44], r9d
mov qword [rsp + 0x48], r8
mov dword [rsp + 0x54], edx
mov dword [rsp + 0x58], ecx
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x5c], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rax
mov r11d, dword [0x1401dcae0]
mov ecx, dword [0x1401dcae4]
xor r11d, 0xffffffff
mov eax, 0x8eca1752
xor eax, 0x7135e8ad
xor ecx, eax
mov eax, 0xffffffff
xor eax, 0x8516fc79
or r11d, ecx
or eax, 0x8516fc79
xor r11d, 0xffffffff
and r11d, eax
mov eax, 0x5b6424a3
xor eax, 0xa49bdb5c
mov ecx, r11d
xor ecx, eax
mov r8d, 0xffffffff
xor r8d, 0x46cd6206
mov edx, 0xffffffff
xor edx, 0xf237ab06
mov eax, ecx
and eax, 0xf237ab06
and r11d, edx
mov r9d, r8d
and r9d, 0xf237ab06
mov r10d, edx
and r10d, 0x46cd6206
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
xor ecx, 0xffffffff
or edx, 0xf237ab06
and ecx, edx
or eax, ecx
add eax, 0x7405544b
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0x39a1630e
xor edx, 0x6a7e7454
and edx, ecx
mov r8d, 0xffffffff
xor r8d, 0x53df175a
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x53df175a
mov r8d, 0x15e9b2d1
xor r8d, 0x4636a58b
or eax, r8d
imul eax, edx
add eax, ecx
cmp eax, 0x7fc87b62
jbe 0x1400a7d91
mov eax, dword [0x1401dcae8]
mov ecx, dword [0x1401dcaec]
xor ecx, 0xbae43920
add eax, 0xd62db3f0
add eax, ecx
sub eax, 0xd62db3f0
add eax, 0xf963f934
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x9139c68f
add ecx, eax
xor eax, eax
sub eax, ecx
add eax, 0x1e45e3a8
mov ecx, 0xa7bb1924
xor ecx, 0x4b4ebc10
sub eax, ecx
sub eax, 0x1e45e3a8
mov dword [rsp + 0x3c], eax
mov eax, 0xfa8ffab5
xor eax, 0x7c54531f
mov dword [rsp + 0x38], eax
call fcn.1400a7692
mov ecx, dword [rsp + 0x58]
mov edx, dword [rsp + 0x54]
mov r8, qword [rsp + 0x48]
mov r9d, dword [rsp + 0x44]
mov r10, qword [rsp + 0x60]
mov eax, dword [rsp + 0x5c]
mov qword [rsp + 0x20], r10
mov dword [rsp + 0x28], eax
call qword [0x1401fe148]
mov ecx, dword [rsp + 0x38]
mov edx, eax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x40], edx
cmp eax, ecx
je 0x1400a7ce6
mov eax, dword [rsp + 0x40]
add rsp, 0x68
ret
ret