joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001b530
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
add rdx, 0xffffffffca28c985
mov rcx, rdx
rol rcx, 6
nop word cs:[rax + rax]
mov r8d, dword [0x141dc12b8]
add r8d, dword [0x141dc12bc]
or r8d, 0x565dd315
imul r8d, r8d, 0x99e7dd14
add r8d, 0x349911a0
cmp r8d, 0x911a34fb
ja 0x14001b550
xor ecx, edx
movzx ecx, cx
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141dc12c0]
sub ecx, dword [0x141dc12c4]
xor ecx, 0xf960bca4
imul ecx, ecx, 0xe9f1b006
and ecx, 0xc2ee718a
cmp ecx, 0x6d0ee186
jb 0x14001b590
nop word cs:[rax + rax]
mov ecx, dword [str.fC_nK]
imul ecx, dword [0x141dc12cc]
or ecx, 0xdfff240
imul ecx, ecx, 0x662e947d
add ecx, 0xb9dc6b2c
cmp ecx, 0x2b5fac66
jb 0x14001b5c0
ret

Function at 0x14001b630
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rcx
imul rdx, rdx, 0xffffffff85378186
mov rcx, rdx
rol rcx, 7
xor rcx, rdx
mov rdx, rcx
rol rdx, 3
nop dword [rax + rax]
mov r8d, dword [0x141dc12d0]
or r8d, dword [str.PpF]
imul r9, r8, 0x118dfb67
shr r9, 0x20
sub r8d, r9d
shr r8d, 1
add r8d, r9d
shr r8d, 0x1f
imul r8d, r8d, 0xe9ea34d8
xor r8d, 0x4b14893e
cmp r8d, 0x75b44983
ja 0x14001b650
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x14001b720
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rdx
mov rcx, rdx
shr rcx, 0x1b
xor rcx, rdx
mov rdx, rcx
shr rdx, 0x13
nop word [rax + rax]
mov r8d, dword [0x141dc12e0]
imul r8d, dword [0x141dc12e4]
imul r8d, r8d, 0x4d56c516
and r8d, 0xbb38f78c
cmp r8d, 0xe925aac7
ja 0x14001b740
xor rdx, rcx
mov rcx, 0xffffffffface4f51
sub rcx, rdx
mov rdx, rcx
rol rdx, 5
nop word [rax + rax]
mov r8d, dword [0x141dc12e8]
xor r8d, dword [0x141dc12ec]
add r8d, 0xe914261
and r8d, 0x40ca3744
add r8d, 0xf022b851
cmp r8d, 0xb31a35b0
ja 0x14001b780
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x14001b7c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0x7583b869
add rdx, 0xffffffffebb275dd
mov rcx, rdx
rol rcx, 7
xor rcx, rdx
nop dword [rax + rax]
mov edx, dword [0x141dc12f0]
xor edx, dword [0x141dc12f4]
imul edx, edx, 0x3abdafa1
add edx, 0x72ed5e56
and edx, 0x3fc56929
cmp edx, 0x58db031b
ja 0x14001b7e0
movzx ecx, cx
add rax, rcx
nop dword [rax]
mov ecx, dword [0x141dc12f8]
or ecx, dword [0x141dc12fc]
and ecx, 0x10b6827e
add ecx, 0x3396edc
xor ecx, 0x4b922d52
cmp ecx, 0x43714528
jb 0x14001b810
ret

Function at 0x14001b8c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, 0x90efc609
add rdx, 0xffffffffc05102f5
nop
mov r8d, dword [0x141dc1310]
and r8d, dword [0x141dc1314]
and r8d, 0xd011288a
imul r8d, r8d, 0xb681d180
imul r8, rcx
shr r8, 0x3f
cmp r8d, 0x4588132f
ja 0x14001b8d0
xor rdx, 0xffffffff944ed57a
movabs rcx, 0xffffffff4c78fddd
add rcx, rdx
mov rdx, rcx
rol rdx, 2
nop dword [rax + rax]
mov r8d, dword [0x141dc1318]
xor r8d, dword [0x141dc131c]
imul r8d, r8d, 0x54607e20
add r8d, 0xa60fa240
imul r8, r8, 0x2c2d337
shr r8, 0x38
cmp r8d, 0x7a4cb583
ja 0x14001b920
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret
Function at 0x14001b960
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
shr rax, 7
xor rax, rdx
mov r8d, 0x31a5f665
sub r8, rax
mov r9, r8
rol r9, 1
nop dword [rax]
mov eax, dword [0x141dc1320]
mov edx, dword [0x141dc1324]
add eax, edx
add eax, 0x5052c24e
and eax, 0xbab5a493
cmp eax, 0xaa26b584
je 0x14001b980
nop
mov eax, dword [0x141dc1328]
xor edx, edx
div dword [0x141dc132c]
or eax, 0xcd072fae
imul eax, eax, 0x362616e4
add eax, 0x682100a8
cmp eax, 0xd5ebd234
ja 0x14001b9a0
xor r9d, r8d
movzx r8d, r9w
mov eax, dword [0x141dc1330]
xor edx, edx
div dword [0x141dc1334]
add rcx, r8
nop dword [rax]
mov eax, dword [0x141dc1338]
xor eax, dword [0x141dc133c]
and eax, 0xcae1279c
add eax, 0x9c7395ae
cmp eax, 0xe201abf3
ja 0x14001b9e0
mov rax, rcx
ret

Function at 0x14001ba10
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x141dc1340]
xor edx, edx
div dword [0x141dc1344]
mov r9d, 0xa5334ea3
mov rax, r8
not rax
rol rax, 4
xor rax, r8
mov r8, rax
rol r8, 5
xor r8, rax
nop
mov eax, dword [0x141dc1348]
xor edx, edx
div dword [0x141dc134c]
imul eax, eax, 0xa73b66a9
add eax, 0x6bbb91de
imul rax, r9
shr rax, 0x3f
cmp eax, 0xa8973b93
ja 0x14001ba40
mov rax, r8
rol rax, 2
xor rax, r8
nop word cs:[rax + rax]
mov edx, dword [0x141dc1350]
and edx, dword [0x141dc1354]
or edx, 0x9c3960d2
xor edx, 0x3db3b018
cmp edx, 0xc7f5697b
ja 0x14001ba80
movzx eax, ax
add rcx, rax
mov rax, rcx
ret
Function at 0x140038b00
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov eax, dword [str._x_n_]
or eax, dword [0x141dc3e4c]
xor eax, 0x6ee37984
imul eax, eax, 0x690618d3
cmp eax, 0xa758ce73
je 0x140038b10
cmp qword [r8 + 8], 0
je 0x140038bed
nop dword [rax]
mov eax, dword [0x141dc3e50]
add eax, dword [0x141dc3e54]
or eax, 0x822bf1d
and eax, 0xabffffbf
cmp eax, 0xd9cfe5e2
je 0x140038b40
mov rbx, qword [r8]
mov rax, qword [r8 + 0x10]
nop word cs:[rax + rax]
mov ecx, dword [0x141dc3e58]
sub ecx, dword [0x141dc3e5c]
cmp ecx, 0xe5d630cd
je 0x140038b70
test rax, rax
je 0x140038c18
nop dword [rax]
mov eax, dword [0x141dc3e68]
xor edx, edx
div dword [0x141dc3e6c]
xor eax, 0xeb912b63
add eax, 0x9c9e725a
xor eax, 0x68737a20
cmp eax, 0x9e5bce3c
jb 0x140038b90
mov r14, qword [0x141dda6a0]
mov eax, dword [0x141dc3e70]
sub eax, dword [0x141dc3e74]
imul rcx, rax, 0x22028801
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1d
imul eax, eax, 0xbfea7aa4
cmp eax, 0xf0b97d1d
jbe 0x140038c5b
jmp 0x140038c93
mov eax, dword [0x141dc3e80]
and eax, dword [0x141dc3e84]
xor eax, 0x1c00424
or eax, 0xf80fbbc1
add eax, 0xec7dd715
cmp eax, 0xe1ff698a
jae 0x140038ca6
jmp 0x140038cc5
movzx eax, byte [0x141dda6b8]
xor ecx, ecx
mov rdx, rsi
call fcn.1400bf230
nop dword [rax]
mov ecx, dword [0x141dc3e60]
and ecx, dword [0x141dc3e64]
xor ecx, 0x76d129d
add ecx, 0x93a89707
and ecx, 0x7cfe3dc6
cmp ecx, 0x331f03e8
jbe 0x140038c30
jmp 0x140038d08
mov eax, dword [0x141dc3e78]
imul eax, dword [0x141dc3e7c]
imul ebp, eax, 0x705ec10c
add ebp, 0xb1f0adec
or ebp, 0xa612bf13
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
cmp ebp, 0xf01a8392
jne 0x140038d08
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
jmp 0x140038c5b
mov eax, dword [0x141dc3e88]
or eax, dword [0x141dc3e8c]
add eax, 0xc7150db2
movzx ecx, byte [0x141dda6b8]
cmp eax, 0xcf477afe
jbe 0x140038cce
movzx eax, byte [0x141dda6b8]
jmp 0x140038ca6
xor ecx, ecx
mov rdx, rsi
call fcn.1400bf230
mov ecx, 0xaed0e805
nop dword [rax]
mov edx, dword [0x141dc3e90]
xor edx, dword [0x141dc3e94]
imul edx, edx, 0xd67e13d3
imul rdx, rcx
shr rdx, 0x3c
or edx, 0xc8b10bc3
cmp edx, 0x66dc6776
jb 0x140038ce0
mov ecx, dword [0x141dc3e98]
add ecx, dword [0x141dc3e9c]
imul rcx, rcx, 0x4e41be2b
shr rcx, 0x3e
or ecx, 0x8f695cb8
cmp ecx, 0x53736f6a
jb 0x140038d6c
mov ecx, dword [0x141dc3ea0]
mov edx, dword [0x141dc3ea4]
add ecx, edx
add ecx, 0xec776808
xor ecx, 0x6c7f42fb
xor edx, edx
test rax, rax
sete dl
mov r8d, 1
cmovne r8, rax
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], rsi
mov qword [rdi], rdx
cmp ecx, 0x32ae8a09
jae 0x140038d8a
xor ecx, ecx
test rax, rax
mov edx, 1
cmovne rdx, rax
sete cl
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rsi
mov qword [rdi], rcx
jmp 0x140038d2d
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140039d70
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax]
mov ecx, dword [0x141dc40c8]
and ecx, dword [0x141dc40cc]
add ecx, 0xc52475ec
or ecx, 0xa2e370dc
add ecx, 0xb6acef8d
cmp ecx, 0x576debfa
jb 0x140039d80
cmp rax, 0xffffffffffffffff
je 0x140039fa8
lea rdx, [rax + 1]
lea r8, [rax + rax]
nop dword [rax + rax]
mov ecx, dword [0x141dc40d0]
sub ecx, dword [0x141dc40d4]
imul r9d, ecx, 0x71e380be
add r9d, 0x46c1a8b8
cmp r8, rdx
mov rcx, rdx
cmova rcx, r8
cmp r9d, 0x97b223b7
jb 0x140039dc0
nop dword [rax]
mov edx, dword [0x141dc40d8]
add edx, dword [0x141dc40dc]
and edx, 0x12b1bed0
add edx, 0xcc3c51ae
and edx, 0x885fe9d2
cmp rcx, 9
mov edi, 8
cmovae rdi, rcx
cmp edx, 0xb54cbc3c
ja 0x140039df0
test rdi, rdi
js 0x140039fa8
nop dword [rax]
mov ecx, dword [0x141dc40e0]
add ecx, dword [0x141dc40e4]
and ecx, 0xd4d2fbf4
imul ecx, ecx, 0x8cbfa6e2
and ecx, 0x802f79b8
cmp ecx, 0x7f4e1757
je 0x140039e30
test rax, rax
je 0x140039f21
mov ecx, dword [0x141dc40e8]
add ecx, dword [0x141dc40ec]
and ecx, 0xa148241c
cmp ecx, 0x720832ae
jne 0x140039e90
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x28], rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141dc40f0]
sub ecx, dword [0x141dc40f4]
or ecx, 0x54fa3d44
add ecx, 0xc6e10d8e
mov rdx, qword [rsi + 8]
mov qword [rsp + 0x28], rdx
cmp ecx, 0x5886277d
jb 0x140039e90
mov ecx, dword [0x141dc40f8]
xor ecx, dword [0x141dc40fc]
and ecx, 0xf20e008
add ecx, 0x1a5e538b
cmp ecx, 0xb002860d
jbe 0x140039ede
mov qword [rsp + 0x38], rax
mov ecx, 0x9d364153
nop word cs:[rax + rax]
mov edx, dword [0x141dc4100]
sub edx, dword [0x141dc4104]
add edx, 0x2bc222cf
imul rdx, rcx
shr rdx, 0x3b
and edx, 0xfffffff5
mov qword [rsp + 0x38], rax
cmp edx, 0x5d28d546
je 0x140039ef0
mov eax, 1
jmp 0x140039f23
xor eax, eax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x28]
mov rdx, rdi
call fcn.140038b00
cmp qword [rsp + 0x40], 0
jne 0x140039f80
mov rax, qword [rsp + 0x48]
mov ecx, dword [0x141dc4118]
sub ecx, dword [0x141dc411c]
imul ecx, ecx, 0x85915c00
xor ecx, 0x100001c4
and ecx, 0x508081c4
cmp ecx, 0x5443c424
jne 0x140039fda
jmp 0x14003a004
mov eax, dword [0x141dc4108]
xor eax, dword [0x141dc410c]
add eax, 0xf4149915
xor eax, 0x93a11277
imul rax, rax, 0x41a169b
shr rax, 0x39
cmp eax, 0x7ffc8d4
je 0x140039f80
ud2
mov ecx, dword [0x141dc4120]
and ecx, dword [0x141dc4124]
imul ecx, ecx, 0x16e6c2d1
add ecx, 0xe4fb16ea
and ecx, 0xc4e8d38d
mov qword [rsi + 8], rax
cmp ecx, 0x755453ae
jne 0x14003a00a
mov qword [rsi + 8], rax
jmp 0x140039fda
mov qword [rsi], rdi
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x140042a20
Capabilities:
Encode data using xor

Disassembly:
mov r8, rcx
mov eax, dword [0x141dc49b0]
xor edx, edx
div dword [0x141dc49b4]
or eax, 0x50110010
and eax, 0x50332011
cmp eax, 0x7c8136a6
jbe 0x140042a60
xor ecx, ecx
mov eax, 7
mov r9, rbx
cpuid
xchg rbx, r9
mov dword [r8], eax
nop word cs:[rax + rax]
mov r10d, dword [0x141dc49b8]
or r10d, dword [0x141dc49bc]
mov eax, 7
mov ecx, 0
mov r9, rbx
cpuid
xchg rbx, r9
mov dword [r8], eax
xor r10d, 0x361e609
add r10d, 0xb96eae55
and r10d, 0x2561a80
cmp r10d, 0x28fdf6b6
ja 0x140042a60
nop word cs:[rax + rax]
mov eax, dword [0x141dc49c0]
add eax, dword [0x141dc49c4]
imul rax, rax, 0x10d350e9
shr rax, 0x3c
add eax, 0xa282d60f
xor eax, 0x72415d22
cmp eax, 0xd3c31b8e
ja 0x140042ab0
mov dword [r8 + 4], r9d
mov dword [r8 + 8], ecx
mov dword [r8 + 0xc], edx
ret
Function at 0x140054580
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, r9
mov ebp, r8d
mov rdi, rdx
mov rbx, rcx
mov r14, qword [rsp + 0x80]
nop word cs:[rax + rax]
mov eax, dword [0x141dc6d88]
sub eax, dword [0x141dc6d8c]
xor eax, 0x83b28d89
imul rcx, rax, 0xf054cc5
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1d
add eax, 0xb23e8c3e
cmp eax, 0x10be6de4
jb 0x1400545b0
cmp ebp, 0x110000
je 0x14005466c
nop dword [rax]
mov eax, dword [0x141dc6d90]
or eax, dword [0x141dc6d94]
imul eax, eax, 0x63f69737
add eax, 0x66e2bdea
cmp eax, 0xabad3aa5
ja 0x1400545f0
mov eax, dword [0x141dc6d98]
add eax, dword [0x141dc6d9c]
mov r15, qword [rdi + 0x20]
or eax, 0x9eebe7f7
and eax, 0x9eeffff7
cmp eax, 0xb73f9146
je 0x14005465a
mov eax, dword [0x141dc6da0]
sub eax, dword [0x141dc6da4]
shr eax, 2
imul r12, rax, 0x251aa863
shr r12, 0x3b
mov rcx, rbx
mov edx, ebp
call r15
cmp r12d, 0xacfcdab8
jbe 0x140054664
mov rcx, rbx
mov edx, ebp
call r15
jmp 0x14005462f
mov ecx, eax
mov al, 1
test cl, cl
jne 0x1400546c6
test rsi, rsi
je 0x1400546c4
nop word cs:[rax + rax]
mov eax, dword [0x141dc6da8]
add eax, dword [0x141dc6dac]
or eax, 0x34dbe801
imul eax, eax, 0x74eee2ce
add eax, 0xb4c0a594
cmp eax, 0x7fdae6e9
jb 0x140054680
mov eax, dword [0x141dc6db0]
mov ecx, dword [0x141dc6db4]
add eax, ecx
add eax, 0x2f1229b0
and eax, 0x69c54499
cmp eax, 0x6abbc2b3
jbe 0x1400546d5
jmp 0x14005470d
xor eax, eax
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov eax, dword [0x141dc6db8]
add eax, dword [0x141dc6dbc]
xor eax, 0xe825a8ba
imul r15, rax, 0x6d9509b5
shr r15, 0x3e
xor r15d, 0x20122b9b
mov rcx, rbx
mov rdx, rsi
mov r8, r14
call qword [rdi + 0x18]
cmp r15d, 0x4ec50d3b
jbe 0x1400546c6
mov rcx, rbx
mov rdx, rsi
mov r8, r14
call qword [rdi + 0x18]
jmp 0x1400546d5
Function at 0x14005e960
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov r8b, 1
test rdx, rdx
je 0x14005e99b
mov r9, rdx
cmp rdx, 1
jne 0x14005e9a2
movzx r9d, byte [rcx]
mov dl, 1
cmp r9d, 0x2b
je 0x14005ec18
mov eax, 1
cmp r9d, 0x2d
je 0x14005ec18
jmp 0x14005eae4
xor edx, edx
jmp 0x14005ec18
mov eax, dword [0x141dc8348]
xor edx, edx
div dword [0x141dc834c]
mov eax, dword [0x141dc8350]
add eax, dword [0x141dc8354]
and eax, 0x2dc5b805
add eax, 0xeb2992cd
xor eax, 0x4f16619e
cmp eax, 0xccdb05ea
ja 0x14005e9b0
movzx r10d, byte [rcx]
nop word cs:[rax + rax]
mov eax, dword [0x141dc8358]
xor edx, edx
div dword [0x141dc835c]
xor eax, 0xce943907
imul eax, eax, 0x3c5b6a4a
or eax, 0x2f437fb3
cmp eax, 0x8692b316
ja 0x14005e9e0
cmp r10b, 0x2b
jne 0x14005eab0
inc rcx
lea rax, [r9 - 1]
nop word cs:[rax + rax]
mov edx, dword [0x141dc8360]
or edx, dword [0x141dc8364]
imul edx, edx, 0xb6226f56
or edx, 0x1f4dfcb4
xor edx, 0xbfbd206e
cmp edx, 0x684295c4
ja 0x14005ea20
nop word cs:[rax + rax]
mov edx, dword [0x141dc8368]
xor edx, dword [0x141dc836c]
add edx, 0x7d0328d3
xor edx, 0x626a808a
cmp edx, 0x8a2ff702
jb 0x14005ea50
mov edx, dword [0x141dc8370]
imul edx, dword [0x141dc8374]
imul edx, edx, 0x70fa5208
add edx, 0x811a55b7
or edx, 0xfb122211
cmp edx, 0xf37d2b31
jb 0x14005ea70
cmp r9, 4
mov r9, rax
jae 0x14005eb50
jmp 0x14005eae4
mov eax, dword [0x141dc8340]
add eax, dword [0x141dc8344]
imul eax, eax, 0xec2a2ff8
add eax, 0x8106c4e1
imul rax, rax, 0x514fed11
shr rax, 0x3e
cmp eax, 0x3a646a78
je 0x14005eab0
mov eax, 2
cmp r9, 3
jae 0x14005eb50
xor r9d, r9d
xor r10d, r10d
nop word [rax + rax]
mov r11d, dword [0x141dc8390]
xor r11d, dword [0x141dc8394]
and r11d, 0x1f9c6252
movzx edx, byte [rcx + r9]
add edx, 0xffffffd0
cmp edx, 0xa
setae r8b
cmp r11d, 0x9bf5fb2c
je 0x14005eaf0
cmp edx, 9
ja 0x14005ec07
movzx r10d, r10b
add r10d, r10d
lea r10d, [r10 + r10*4]
add dl, r10b
inc r9
mov r10d, edx
cmp rax, r9
jne 0x14005eaf0
jmp 0x14005ec18
mov eax, dword [0x141dc8378]
xor eax, dword [0x141dc837c]
add eax, 0x593138b8
or eax, 0x515ba05
cmp eax, 0x6bb3f080
jb 0x14005eb50
xor r10d, r10d
mov r11d, 0x9e9c6ff9
mov bl, 0xa
xor esi, esi
xor edx, edx
nop dword [rax]
mov eax, dword [0x141dc8380]
xor eax, dword [0x141dc8384]
and eax, 0x2449810
or eax, 0xe08a61ef
imul rax, r11
shr rax, 0x3b
cmp r9, rsi
setne dil
cmp eax, 0x887fe06
ja 0x14005eb80
cmp r9, rsi
je 0x14005ec0b
mov eax, edx
mul bl
seto bpl
mov edx, eax
test r10b, r10b
jne 0x14005ebbb
movzx eax, byte [rcx + rsi]
add eax, 0xffffffd0
cmp eax, 0xa
setae r14b
or r14b, bpl
jne 0x14005ec10
mov ebp, dword [0x141dc8388]
or ebp, dword [0x141dc838c]
xor ebp, 0x3cc0daf0
imul ebp, ebp, 0xf3f5776e
or ebp, 0x6736b2e0
cmp ebp, 0x46089c86
jb 0x14005ebd3
inc rsi
add dl, al
jae 0x14005eb80
mov dl, 2
mov r8d, edi
jmp 0x14005ec18
mov dl, 1
jmp 0x14005ec18
mov r8d, edi
jmp 0x14005ec18
xor edx, edx
cmp eax, 0xa
adc dl, 1
mov eax, r8d
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14005efb0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
mov r8, rdx
test rdx, rdx
je 0x14005efe6
cmp r8, 1
jne 0x14005efee
movzx eax, byte [rcx]
mov r10d, 0x100
mov r8d, 1
cmp eax, 0x2b
je 0x14005f26b
cmp eax, 0x2d
je 0x14005f26b
jmp 0x14005f147
mov r10, r8
jmp 0x14005f265
movzx eax, byte [rcx]
nop word cs:[rax + rax]
mov edx, dword [0x141dc8420]
imul edx, dword [0x141dc8424]
imul edx, edx, 0x451b34c7
cmp edx, 0xbeee501d
je 0x14005f000
xor edx, edx
nop dword [rax]
test dl, dl
jne 0x14005f020
cmp al, 0x2b
jne 0x14005f13d
inc rcx
lea rax, [r8 - 1]
cmp r8, 0xa
mov r8, rax
jb 0x14005f147
xor r10d, r10d
mov r11d, 0xa
xor eax, eax
nop dword [rax + rax]
mov r9d, eax
test r8, r8
je 0x14005f23b
mov eax, dword [0x141dc8428]
xor edx, edx
div dword [str.A__]
add eax, 0x3a37272c
shr eax, 1
imul rax, rax, 0x4f1aa01d
shr rax, 0x3c
cmp eax, 0x99ef2c3f
ja 0x14005f05c
lea rsi, [rcx + 1]
mov edi, dword [0x141dc8430]
sub edi, dword [0x141dc8434]
add edi, 0x360bff19
or edi, 0xcd2c398b
mov eax, r9d
mul r11d
seto dl
cmp edi, 0xdf795ad5
je 0x14005f087
dec r8
movzx ecx, byte [rcx]
add ecx, 0xffffffd0
mov edi, dword [0x141dc8438]
add edi, dword [0x141dc843c]
imul edi, edi, 0x66a1ed65
xor edi, 0x2d7919cf
add edi, 0xc490f0a
cmp edi, 0x1f3f43cc
jb 0x14005f0b9
test dl, dl
jne 0x14005f248
cmp ecx, 0xa
jae 0x14005f25f
add eax, ecx
setb dl
nop word cs:[rax + rax]
mov ecx, dword [0x141dc8440]
imul ecx, dword [0x141dc8444]
or ecx, 0x67c9bcf0
add ecx, 0x170195ac
and ecx, 0xc3868084
cmp ecx, 0xd7b0b89f
ja 0x14005f100
mov rcx, rsi
test dl, dl
je 0x14005f050
mov r10d, 0x200
jmp 0x14005f265
cmp r8, 9
jae 0x14005f040
xor r10d, r10d
mov r11d, 0x884dcd91
xor r9d, r9d
nop word cs:[rax + rax]
mov eax, dword [0x141dc8448]
add eax, dword [0x141dc844c]
and eax, 0x7bd55269
add eax, 0x37fe5706
imul rax, rax, 0x6a8b535
shr rax, 0x39
cmp eax, 0xf249593e
je 0x14005f160
movzx esi, byte [rcx]
add esi, 0xffffffd0
cmp esi, 9
ja 0x14005f240
mov eax, dword [0x141dc8450]
xor edx, edx
div dword [0x141dc8454]
mov eax, dword [0x141dc8458]
xor edx, edx
div dword [0x141dc845c]
imul eax, eax, 0xdbc8bd22
and eax, 0x906690
cmp eax, 0x7f65a552
je 0x14005f1a5
add r9d, r9d
dec r8
inc rcx
lea eax, [r9 + r9*4]
nop word cs:[rax + rax]
mov edx, dword [0x141dc8460]
sub edx, dword [0x141dc8464]
or edx, 0xcc5bd41c
shr edx, 1
imul rdx, r11
shr rdx, 0x3d
or edx, 0x1ab9a520
cmp edx, 0xbd1282c2
ja 0x14005f1e0
mov r9d, esi
add r9d, eax
mov eax, dword [0x141dc8468]
sub eax, dword [0x141dc846c]
xor eax, 0xa1404056
and eax, 0xf1666377
add eax, 0x9f17f28b
cmp eax, 0xe442f44
jb 0x14005f210
test r8, r8
jne 0x14005f160
xor r8d, r8d
jmp 0x14005f26b
mov r10d, 0x100
jmp 0x14005f265
xor r10d, r10d
cmp ecx, 0xa
setb r10b
shl r10, 8
add r10, 0x100
jmp 0x14005f265
mov r10d, 0x100
mov r8d, 1
or r10, r8
shl r9, 0x20
or r9, r10
mov rax, r9
pop rdi
pop rsi
ret
Function at 0x140069c90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
vmovdqa xmmword [rsp + 0x40], xmm10
vmovaps xmmword [rsp + 0x30], xmm9
vmovaps xmmword [rsp + 0x20], xmm8
vmovaps xmmword [rsp + 0x10], xmm7
vmovaps xmmword [rsp], xmm6
mov r8, rdx
vmovdqu xmm2, xmmword [rcx]
vmovdqu xmm0, xmmword [rcx + 0x10]
mov eax, dword [0x141dc9968]
xor edx, edx
div dword [0x141dc996c]
mov eax, 0xa295f82b
vmovdqa ymm1, ymmword [0x140101820]
vinserti128 ymm0, ymm0, xmm0, 1
vinserti128 ymm2, ymm2, xmm2, 1
nop word cs:[rax + rax]
mov edx, dword [str.rF_]
sub edx, dword [0x141dc9974]
imul rdx, rax
shr rdx, 0x3f
xor edx, 0xf54648bd
cmp edx, 0x32e68c6e
jb 0x140069cf0
vbroadcasti128 ymm3, xmmword [rcx + 0x30]
vbroadcasti128 ymm5, xmmword [rcx + 0x20]
vpaddd ymm1, ymm3, ymm1
mov eax, 0xa
vbroadcasti128 ymm6, xmmword [0x140101900]
vmovdqa ymm7, ymmword [0x140101860]
vmovdqa ymm4, ymm1
vmovdqa ymm9, ymm2
vmovdqa ymm3, ymm0
vmovdqa ymm8, ymm5
nop dword [rax + rax]
vpaddd ymm9, ymm9, ymm3
vpxor ymm4, ymm9, ymm4
vpshuflw ymm4, ymm4, 0xb1
vpshufhw ymm4, ymm4, 0xb1
vpaddd ymm8, ymm8, ymm4
vpxor ymm3, ymm8, ymm3
vpsrld ymm10, ymm3, 0x14
vpslld ymm3, ymm3, 0xc
vpor ymm3, ymm10, ymm3
vpaddd ymm9, ymm9, ymm3
vpshufb ymm10, ymm9, ymm6
vpshufb ymm4, ymm4, ymm6
vpxor ymm4, ymm10, ymm4
vpaddd ymm8, ymm8, ymm4
vpxor ymm3, ymm8, ymm3
vpsrld ymm10, ymm3, 0x19
vpslld ymm3, ymm3, 7
vpor ymm3, ymm10, ymm3
vpshufd ymm8, ymm8, 0x39
vpshufd ymm9, ymm9, 0x93
vpaddd ymm9, ymm9, ymm3
vpshuflw ymm10, ymm9, 0xb1
vpshufhw ymm10, ymm10, 0xb1
vpshufb ymm4, ymm4, ymm7
vpxor ymm4, ymm10, ymm4
vpaddd ymm8, ymm8, ymm4
vpxor ymm3, ymm8, ymm3
vpsrld ymm10, ymm3, 0x14
vpslld ymm3, ymm3, 0xc
vpor ymm3, ymm10, ymm3
vpaddd ymm9, ymm9, ymm3
vpxor ymm4, ymm9, ymm4
vpshufb ymm4, ymm4, ymm6
vpaddd ymm8, ymm8, ymm4
vpxor ymm3, ymm8, ymm3
vpsrld ymm10, ymm3, 0x19
vpslld ymm3, ymm3, 7
vpor ymm3, ymm10, ymm3
vpshufd ymm8, ymm8, 0x93
vpshufd ymm4, ymm4, 0x4e
vpshufd ymm9, ymm9, 0x39
dec rax
jne 0x140069d50
mov eax, dword [0x141dc9978]
imul eax, dword [0x141dc997c]
xor eax, 0xef0246a5
add eax, 0x1406d2b4
vpaddd ymm2, ymm9, ymm2
vpaddd ymm5, ymm8, ymm5
cmp eax, 0xd344b5fc
ja 0x140069e93
mov eax, dword [0x141dc9980]
and eax, dword [0x141dc9984]
mov edx, 0xb1992d1f
imul rdx, rax
shr rdx, 0x3d
add edx, 0xdd9f656e
and edx, 0x19154427
vmovd eax, xmm1
inc eax
vpaddd xmm6, xmm3, xmm0
vinserti128 ymm6, ymm2, xmm6, 1
vmovdqu ymmword [r8], ymm6
vpaddd xmm6, xmm4, xmm1
vinserti128 ymm6, ymm5, xmm6, 1
vmovdqu ymmword [r8 + 0x20], ymm6
mov dword [rcx + 0x30], eax
cmp edx, 0xdcbf254b
jbe 0x140069ebd
vpaddd xmm6, xmm3, xmm0
vinserti128 ymm6, ymm2, xmm6, 1
vmovdqu ymmword [r8], ymm6
vpaddd xmm6, xmm4, xmm1
vinserti128 ymm6, ymm5, xmm6, 1
vmovdqu ymmword [r8 + 0x20], ymm6
vmovd eax, xmm1
inc eax
mov dword [rcx + 0x30], eax
jmp 0x140069e3e
vmovaps xmm6, xmmword [rsp]
vmovaps xmm7, xmmword [rsp + 0x10]
vmovaps xmm8, xmmword [rsp + 0x20]
vmovaps xmm9, xmmword [rsp + 0x30]
vmovaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
vzeroupper
ret
Function at 0x14006dbf0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
nop word cs:[rax + rax]
mov eax, dword [0x141dc9cc8]
xor edx, edx
div dword [0x141dc9ccc]
and eax, 0x2080018
cmp eax, 0x70b53aaf
ja 0x14006dc00
vpermpd ymm0, ymmword [r8], 1
mov eax, dword [0x141dc9cd0]
imul eax, dword [0x141dc9cd4]
or eax, 0x8a6c326
add eax, 0x8c8381bd
and eax, 0x123af414
cmp eax, 0x5429de19
jne 0x14006dc50
vmovaps ymmword [rcx], ymm0
nop word [rax + rax]
mov eax, dword [0x141dc9cd8]
xor eax, dword [0x141dc9cdc]
or eax, 0xd0323bcd
and eax, 0xd2333bdd
vmovaps ymmword [rcx], ymm0
cmp eax, 0x9309902d
je 0x14006dc50
vzeroupper
ret