joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003e060
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x140251ef0]
xor ecx, 0x9af54b76
sub ecx, dword [0x140251ef4]
xor ecx, 0x293cbcdf
mov eax, 0xe7e433a1
xor eax, 0x181bcc5e
mov edx, ecx
xor edx, eax
and edx, 0x93e85768
mov r8d, 0x2d7f2044
xor r8d, 0xbe97772c
mov eax, 0xa91ec843
xor eax, 0x56e137bc
xor r8d, eax
mov eax, ecx
and eax, r8d
imul eax, edx
mov r8d, 0xb396bed7
xor r8d, 0x207ee9bf
mov edx, ecx
and edx, r8d
mov r8d, 0xb267d39
xor r8d, 0x98ce2a51
or ecx, r8d
imul ecx, edx
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x6386b2cc
mov edx, 0xffffffff
xor edx, 0x6386b2cc
and ecx, edx
or eax, ecx
cmp eax, 0x2263f92a
jbe 0x14003e18e
mov eax, dword [0x140251ef8]
xor eax, 0x3951ceb0
xor edx, edx
div dword [0x140251efc]
mov ecx, 0x84619ff8
xor ecx, 0x942e3cf
xor edx, edx
div ecx
mov edx, 0x4861ce60
xor edx, 0xb79e319f
mov ecx, eax
xor ecx, edx
and ecx, 0xc735c6de
mov edx, 0xffffffff
xor edx, 0xc735c6de
and eax, edx
sub eax, ecx
or eax, 0x15543af2
mov dword [rsp + 0x2c], eax
mov eax, 0x3545a982
xor eax, 0x8aa84ff3
mov dword [rsp + 0x28], eax
mov rax, qword [0x140269990]
mov ecx, dword [rax]
call fcn.140007b33
mov ecx, dword [rsp + 0x28]
mov rdx, rax
mov eax, dword [rsp + 0x2c]
add rdx, 0x50
mov qword [rsp + 0x30], rdx
cmp eax, ecx
jae 0x14003e0fd
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
out 0xd3, al
add al, byte [rax]
jmp 0x14003e0fd
Function at 0x14004ed50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x48], r9
mov dword [rsp + 0x54], r8d
mov rcx, rdx
mov qword [rsp + 0x58], rcx
mov rdx, qword [rsp + 0xa8]
mov qword [rsp + 0x60], rdx
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x68], rax
test rdx, rdx
setns al
mov rcx, qword [rcx]
mov qword [rsp + 0x70], rcx
sub rcx, rdx
setg cl
and al, cl
test al, 1
jne 0x14004edcc
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x70]
movabs rax, 0xd0e1ac110debfebc
movabs r8, 0x2f1e53eef2140143
xor rax, r8
add rdx, rax
call fcn.140013507
jmp 0x14004ef59
mov ecx, dword [0x1402525d0]
xor ecx, 0x3c761b78
mov edx, dword [0x1402525d4]
mov eax, 0x22574bed
xor eax, 0xdda8b412
xor edx, eax
mov eax, ecx
xor eax, edx
and eax, ecx
or eax, 0xe1b127e4
mov ecx, 0xeaf2964b
xor ecx, 0x9c5145
imul eax, ecx
or eax, 0xb30053b8
cmp eax, 0x18ae8b31
jbe 0x14004ef5e
mov rcx, qword [rsp + 0x58]
mov r9d, dword [rsp + 0x54]
mov eax, dword [0x1402525d8]
xor edx, edx
div dword [0x1402525dc]
mov r8d, 0xaca93daf
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x48]
mov r8d, eax
mov rax, qword [rsp + 0x60]
mov r10d, r8d
and r10d, 0x63ff9f63
mov r11d, 0xa4b7e85d
xor r11d, 0xa4b7e85f
imul r10d, r11d
mov r11d, 0x8b67da88
xor r11d, 0xe89845eb
xor r8d, r11d
add r8d, r10d
mov r10d, 0x3aea5d47
xor r10d, 0x3aea5d47
sub r10d, r8d
xor r8d, r8d
sub r8d, 0x86587b12
add r10d, r8d
xor r8d, r8d
sub r8d, r10d
mov dword [rsp + 0x34], r8d
mov r8d, 0x8dd49617
xor r8d, 0x19de7aed
mov dword [rsp + 0x30], r8d
mov r8, rcx
add r8, 8
mov qword [rsp + 0x28], r8
mov rcx, qword [rcx + 8]
mov r8, rcx
add r8, 8
imul r10, rax, 0x18
add r8, r10
add r8, 8
mov dword [r8], r9d
add rcx, 8
imul rax, rax, 0x18
add rcx, rax
add rcx, 0x10
call fcn.14009fd40
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
mov rdx, qword [rdx]
mov qword [rsp + 0x38], rdx
cmp rdx, r8
setg dl
mov byte [rsp + 0x47], dl
cmp eax, ecx
jb 0x14004ee13
mov al, byte [rsp + 0x47]
test al, 1
jne 0x14004ef39
jmp 0x14004ef21
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffff
call fcn.140013507
jmp 0x14004ef59
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
add rax, 8
imul rdx, rdx, 0x18
add rax, rdx
mov qword [rax], rcx
add rsp, 0x78
ret
jns 0x14004efaf
add dword [rcx + rbp*8 - 0x154], eax
nop word [rax + rax]
add byte [rax], al
add byte [rax], al
Function at 0x140052400
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 8], rcx
mov ecx, dword [0x140252740]
mov eax, dword [0x140252744]
xor eax, 0x7ab5ba67
sub ecx, eax
mov eax, 0x5fb51f9d
xor eax, 0xfbc6f97a
add ecx, eax
mov eax, ecx
add eax, 1
xor ecx, 0xffffffff
or ecx, 0x356af5ff
add ecx, eax
mov edx, 0xc3a0f9c9
xor edx, 0x3c5f0636
mov eax, ecx
xor eax, edx
mov edx, 0xffffffff
xor edx, 0x4a8e04eb
and eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x4a8e04eb
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
cmp eax, 0xb0215eec
ja 0x140052521
mov edx, dword [0x140252748]
mov eax, dword [0x14025274c]
add edx, eax
xor edx, 0x2a200820
mov eax, edx
and eax, 0x2eea3d32
mov ecx, eax
not ecx
mov r8d, edx
and r8d, 0x8e83422
and ecx, 0x27124b1d
imul ecx, r8d
and edx, 0x26020910
or eax, 0x27124b1d
imul eax, edx
add eax, ecx
mov dword [rbp - 0xc], eax
mov eax, 0xb7336684
mov dword [rbp - 0x10], eax
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
sub rsp, 0x20
call fcn.14004e8b3
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.140051dd0
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0xc]
add rsp, 0x20
cmp eax, ecx
ja 0x14005247c
mov rsp, rbp
pop rbp
ret
fmul st(0), st(0)
sar byte [rax - 0xad17], 1
dec dword [rax - 0x7d]
sub rsp, 0x38
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
call fcn.14004e8b3
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.14004e400
test al, 1
jne 0x14005255c
jmp 0x1400525a1
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
call fcn.140052400
mov rax, qword [rsp + 0x30]
mov al, byte [rax]
mov cl, 0xc1
xor cl, 0xc1
cmp al, cl
jne 0x1400525ae
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
movabs rdx, 0x246ebea10113d749
movabs rax, 0x246ebea10113d741
xor rdx, rax
call fcn.14000ea9a
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
add rsp, 0x38
ret
Function at 0x140052c30
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], rcx
mov ecx, dword [0x140252780]
xor ecx, dword [0x140252784]
mov eax, 0xb5d8d45f
xor eax, 0x54b0e4ba
sub ecx, eax
add ecx, 0x11691665
add ecx, 0xe16830e5
mov eax, ecx
or eax, eax
xor eax, 0xffffffff
mov edx, 0x1b2b2a61
or edx, 0x1b2b2a61
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x1b2b2a61
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
or eax, 0x3d6be253
cmp eax, 0x3981b3d8
jbe 0x140052e04
mov ecx, dword [0x140252788]
mov r9d, dword [0x14025278c]
mov r8d, r9d
xor r8d, 0xfec12c92
xor r9d, 0x13ed36d
mov eax, ecx
and eax, r9d
mov edx, ecx
or edx, r9d
not edx
imul edx, eax
mov eax, ecx
and eax, r8d
or ecx, r8d
imul ecx, eax
mov eax, ecx
mov ecx, edx
lea eax, [rax + rcx - 0x4d5a30d]
imul rax, rax, 0x4832092b
shr rax, 0x3e
or eax, 0xc95274ec
mov ecx, eax
not ecx
and eax, ecx
mov dword [rbp - 0x10], eax
mov eax, 0x20
mov qword [rbp - 0x30], rax
call fcn.14024f5c0
sub rsp, rax
mov rax, qword [rbp - 0x30]
mov rcx, rsp
mov qword [rbp - 0x28], rcx
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
sub rsp, 0x20
call fcn.14004e8b3
add rsp, 0x20
mov qword [rbp - 0x18], rax
xor eax, eax
mov ecx, eax
sub rsp, 0x20
call fcn.1400525c0
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbp - 0x10]
add rsp, 0x20
cmp byte [rcx], 0
sete cl
mov byte [rbp - 9], cl
cmp eax, 0x7ae933c8
je 0x140052ca4
mov cl, byte [rbp - 9]
xor eax, eax
test cl, 1
mov qword [rbp - 0x38], rax
jne 0x140052d7f
jmp 0x140052dfb
mov ecx, 0x18
mov edx, 8
sub rsp, 0x20
call fcn.1400132f0
mov rcx, qword [rbp - 0x28]
mov rdx, qword [rbp - 8]
add rsp, 0x20
mov qword [rbp - 0x40], rax
sub rsp, 0x20
call fcn.140052b64
mov rcx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x40]
add rsp, 0x20
cmp byte [rcx], 0
mov qword [rbp - 0x38], rax
jne 0x140052dfb
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x28]
mov r8, qword [rax]
mov qword [rdx], r8
mov r8, qword [rax + 8]
mov qword [rdx + 8], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 0x10], rax
sub rsp, 0x20
call fcn.140052790
mov rax, qword [rbp - 0x40]
add rsp, 0x20
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x38]
mov rsp, rbp
pop rbp
ret
movsb byte [rdi], byte [rsi]
out dx, al
shr dword [rbx - 0x17], cl
xchg edi, eax
invalid
Function at 0x140055360
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.14004e8b3
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.14004e400
test al, 1
jne 0x14005538a
jmp 0x140055480
mov rcx, qword [rsp + 0x28]
call fcn.14005530c
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
jne 0x140055480
mov eax, dword [0x140252880]
xor eax, 0xf817863e
mov ecx, dword [0x140252884]
xor ecx, 0x7f531afb
xor eax, ecx
mov ecx, 0xb39bfad5
xor ecx, 0xc6f0dbdd
sub eax, ecx
mov ecx, eax
xor ecx, 0x92bd34e9
xor ecx, 0xffffffff
or eax, 0x92bd34e9
and eax, ecx
or eax, 0xc9255baf
cmp eax, 0x1dffeea5
jb 0x140055485
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x140252888]
xor eax, 0x910a94cb
xor edx, edx
div dword [0x14025288c]
and eax, 0xdbfae2af
mov r9d, 0xffffffff
xor r9d, 0xe42b7d3c
mov r8d, eax
and r8d, r9d
mov edx, eax
or edx, r9d
xor edx, 0xffffffff
imul edx, r8d
mov r8d, eax
and r8d, 0xe42b7d3c
mov r9d, 0x7c9fdfd1
xor r9d, 0x98b4a2ed
or eax, r9d
imul eax, r8d
add eax, edx
imul eax, eax, 0xb2e9c6f3
mov dword [rsp + 0x24], eax
movabs rdx, 0x4a3a88dd838720c3
movabs rax, 0x4a3a88dd838720cb
xor rdx, rax
call fcn.14000ea9a
mov eax, dword [rsp + 0x24]
cmp eax, 0x73570f2e
jae 0x1400553ea
jmp 0x140055480
add rsp, 0x38
ret
jge 0x1400554f5
sbb al, 0xd5
jmp 0x1400553ea
or eax, 0xa0f2b9a4
sub byte [rbp - 0x7f], bh
int1
invalid
Function at 0x140059490
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x150
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x40], rcx
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x38], rax
sub rsp, 0x20
call fcn.14004e8b3
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
add rsp, 0x20
mov qword [rbp + 0x50], rax
cmp rcx, 0
sete al
cmp rdx, 0
sete r8b
mov cl, al
or cl, r8b
or al, al
xor edx, edx

Function at 0x14005a270
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x140252af0]
mov ecx, dword [0x140252af4]
xor ecx, 0x74526ab7
xor eax, ecx
mov ecx, 0xca07a20e
xor edx, edx
div ecx
add eax, 0x60fb27c8
sub eax, 0x420af4f7
cmp eax, 0xe89ec69f
jae 0x14005a3b0
mov ecx, dword [0x140252af8]
mov eax, ecx
xor eax, 0xc6ea9879
mov r9d, dword [0x140252afc]
mov r8d, r9d
xor r8d, 0x54c5cf01
xor ecx, 0x39156786
mov edx, r8d
and edx, ecx
xor r9d, 0xab3a30fe
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
imul rax, rax, 0x5476d84f
shr rax, 0x3e
imul eax, eax, 0xec053204
add eax, 0x9ed4e3db
mov dword [rbp - 0x18], eax
mov eax, 0xc04eae5f
mov dword [rbp - 0x1c], eax
mov eax, 0x20
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.14004e8b3
mov r8, qword [rbp - 8]
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
add rsp, 0x20
mov rax, qword [rbp - 0x10]
mov r9, qword [r8]
mov qword [rcx], r9
mov r9, qword [r8 + 8]
mov qword [rcx + 8], r9
mov r8, qword [r8 + 0x10]
mov qword [rcx + 0x10], r8
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.1400590d3
mov ecx, dword [rbp - 0x1c]
add rsp, 0x20
mov dl, al
mov eax, dword [rbp - 0x18]
mov byte [rbp - 0x11], dl
cmp eax, ecx
ja 0x14005a2b4
mov al, byte [rbp - 0x11]
and al, 1
movzx eax, al
mov rsp, rbp
pop rbp
ret
enter 0x50c8, 0xffffffffffffff9b
jmp 0x14005a2b4
Function at 0x14005be00
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x1d0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb0], r8
mov qword [rbp + 0xb8], rdx
mov qword [rbp + 0xd8], rcx
mov eax, 0x10
Function at 0x14005d9a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x30], rcx
call fcn.14004e8b3
mov qword [rsp + 0x38], rax
xor eax, eax
mov ecx, eax
call fcn.14005d664
mov rax, qword [rsp + 0x38]
mov cl, byte [rax]
mov dl, 0x3a
xor dl, 0x3a
xor eax, eax
cmp cl, dl
mov qword [rsp + 0x40], rax
jne 0x14005da49
mov ecx, 0x18
mov edx, 8
call fcn.1400132f0
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x60]
call fcn.14005d89a
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x28]
cmp byte [rcx], 0
mov qword [rsp + 0x40], rax
jne 0x14005da49
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x48]
call fcn.14005d6bb
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov ecx, dword [0x140252c10]
xor ecx, 0x7f34a3a7
mov eax, dword [0x140252c14]
xor eax, 0x62b2e993
xor ecx, eax
mov edx, 0x7f33c00b
xor edx, 0xd3a73c72
mov eax, 0x276fa736
xor eax, 0xd89058c9
xor edx, eax
mov eax, ecx
and eax, edx
mov edx, ecx
xor edx, 0xac94fc79
add ecx, edx
sub ecx, eax
mov edx, 0x869cce3f
xor edx, 0x796331c0
mov eax, ecx
xor eax, edx
and eax, 0xedd21279
mov edx, 0x38b07d30
xor edx, 0xd5626f49
mov r8d, 0xf44d39a7
xor r8d, 0xbb2c658
xor edx, r8d
and ecx, edx
or eax, ecx
sub eax, 0x9aef4ea0
cmp eax, 0x8fc0eb0a
jbe 0x14005db3e
mov eax, dword [0x140252c18]
imul eax, dword [0x140252c1c]
add eax, 0x694ee1a5
add eax, 0x656542b8
sub eax, 0x694ee1a5
mov edx, 0xb86ebc1f
xor edx, 0x88e71f01
mov ecx, 0x24afbb3
xor ecx, 0xfdb5044c
xor edx, ecx
mov ecx, eax
and ecx, edx
mov r8d, 0xbab71dde
xor r8d, 0x8a3ebec0
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
and eax, 0x4e39b9c1
cmp eax, 0xe33a18d9
je 0x14005dad6
mov rax, qword [rsp + 0x20]
add rsp, 0x78
ret
sub eax, 0xe93079f3
invalid
Function at 0x14005f170
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov word [rbp - 0xa], dx
mov qword [rbp - 8], rcx
mov r8d, dword [0x140252c90]
mov edx, dword [0x140252c94]
mov eax, r8d
xor eax, 0xffffffff
and eax, 0x4d9d5188
mov r9d, 0x66f846b6
xor r9d, 0x2b65173e
mov ecx, 0xeec170e4
xor ecx, 0x113e8f1b
xor r9d, ecx
and r8d, r9d
mov ecx, edx
xor ecx, 0xffffffff
and ecx, 0x4d9d5188
and edx, r9d
or eax, r8d
or ecx, edx
xor eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x56c0e2a6
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0x3a20d670
xor r8d, 0x6ce034d6
mov edx, eax
and edx, r8d
mov r8d, 0xc226fd0
xor r8d, 0x5ae28d76
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xcd5ae494
xor ecx, 0x6c148eff
sub eax, ecx
mov edx, 0x9d3622ed
xor edx, 0x9c9b3e7f
mov ecx, eax
xor ecx, edx
mov edx, 0x8042a1
xor edx, 0xff7fbd5e
xor ecx, edx
and ecx, 0x1ad1c92
shl ecx, 1
sub ecx, 0x1ad1c92
sub eax, ecx
mov ecx, 0x26a5085
xor ecx, 0x6d4b1e8c
cmp eax, ecx
ja 0x14005f32d
mov eax, dword [0x140252c98]
xor eax, 0x2b8bf12d
mov ecx, dword [0x140252c9c]
xor edx, edx
div ecx
imul ecx, eax, 0x11117798
mov edx, ecx
xor edx, 0xb400802
and edx, 0x4b400cda
xor ecx, 0x442027f8
mov eax, ecx
mov ecx, edx
lea eax, [rax + rcx*2]
mov dword [rbp - 0x10], eax
mov eax, 0x7e115922
mov dword [rbp - 0x14], eax
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
mov eax, 0x20
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.14004e8b3
mov rcx, qword [rbp - 0x28]
mov dx, word [rbp - 0xa]
mov r8, qword [rbp - 0x20]
add rsp, 0x20
mov rax, qword [rbp - 8]
mov qword [r8], 0
mov r9, qword [rax + 0x10]
mov qword [rcx + 0x10], r9
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
sub rsp, 0x20
call fcn.14005f340
mov ecx, dword [rbp - 0x14]
add rsp, 0x20
mov rdx, rax
mov eax, dword [rbp - 0x10]
test rdx, rdx
setns dl
mov byte [rbp - 0xb], dl
cmp eax, ecx
ja 0x14005f25e
mov al, byte [rbp - 0xb]
and al, 1
movzx eax, al
mov rsp, rbp
pop rbp
ret
getsec
lea ebx, [0x140051c1e]
jmp qword [rsi + 0x2e]
Function at 0x14005fc30
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 0x28], r9
mov word [rbp - 0x1a], r8w
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x38]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp - 8], rax
mov eax, dword [0x140252ce0]
mov edx, dword [0x140252ce4]
mov r8d, 0xffbad53e
xor r8d, 0x452ac1
mov ecx, eax
xor ecx, r8d
and ecx, edx
xor edx, 0xffffffff
and eax, edx
sub eax, ecx
sub eax, 0xebcfdfb5
sub eax, 0xf9c1acaa
mov ecx, 0xc512d964
xor ecx, 0x2edd06d1
add eax, ecx
mov ecx, 0x821cc0ed
xor edx, edx
div ecx
xor eax, 0xffffffff
mov edx, 0x71b96874
xor edx, 0x360efec0
mov ecx, 0x254f66fd
xor ecx, 0xdab09902
xor edx, ecx
mov ecx, 0xffffffff
xor ecx, 0xb2172b2d
or eax, edx
or ecx, 0xb2172b2d
mov edx, 0x9909c24f
xor edx, 0x66f63db0
xor eax, edx
and eax, ecx
cmp eax, 0x46b30c12
jae 0x14005fe60
mov r9, qword [rbp - 0x10]
mov r8, qword [rbp - 0x18]
mov eax, dword [0x140252ce8]
mov ecx, dword [0x140252cec]
xor edx, edx
div ecx
xor eax, 0xfb48044c
mov ecx, eax
imul rcx, rcx, 0x16ceaadf
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
or eax, 0x99244fe6
mov dword [rbp - 0x44], eax
mov ecx, 0x6622ffe3
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov eax, dword [rbp - 0x44]
mov rdx, rsp
mov qword [rbp - 0x40], rdx
test r9, r9
setns dl
mov r8, qword [r8]
mov qword [rbp - 0x38], r8
sub r8, r9
setg r8b
and dl, r8b
mov byte [rbp - 0x29], dl
cmp eax, ecx
jb 0x14005fce6
mov al, byte [rbp - 0x29]
test al, 1
jne 0x14005fd8d
jmp 0x14005fd6f
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffff
sub rsp, 0x20
call fcn.140013507
add rsp, 0x20
jmp 0x14005fe5b
mov r8, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x28]
mov r10w, word [rbp - 0x1a]
mov r9, rcx
add r9, 8
mov qword [rbp - 0x58], r9
mov rcx, qword [rcx + 8]
mov r9, rcx
add r9, 8
mov r11, r8
shl r11, 5
add r9, r11
add r9, 8
mov word [r9], r10w
add rcx, 8
shl r8, 5
add rcx, r8
add rcx, 0x10
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140014570
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
add rsp, 0x20
mov rax, qword [rax]
mov qword [rbp - 0x50], rax
cmp rax, rcx
jg 0x14005fe3e
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x50]
mov rax, 0xffffffffffffffff
xor rax, 0xffffffffffffffff
xor r8d, r8d
sub r8, 1
sub rax, r8
sub rdx, rax
sub rsp, 0x20
call fcn.140013507
add rsp, 0x20
jmp 0x14005fe5b
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x58]
mov rax, qword [rax]
add rax, 8
shl rdx, 5
add rax, rdx
mov qword [rax], rcx
mov rsp, rbp
pop rbp
ret
pop rax
sub ah, bh
stc
jmp 0x14005fce6
Function at 0x140065080
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x57], al
je 0x140065190
mov rax, qword [rsp + 0x48]
movabs rcx, 0x5fc432d09af54b76
movabs rdx, 0xa03bcd2f650ab486
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x38], rax
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
mov al, 1
cmp rcx, 0x10
mov byte [rsp + 0x57], al
jb 0x140065190
mov rdx, qword [rsp + 0x40]
movabs rcx, 0x6fd8ff5e7e433a1
movabs rax, 0xf902700a181bcc51
xor rcx, rax
movabs rax, 0x95c5a252e7b4e7e0
movabs r8, 0x6a3a5dad184b181f
xor rax, r8
xor rcx, rax
movabs rax, 0xe86daa42d7f2044
movabs r8, 0xe86daa42d7f2044
xor rax, r8
movabs r8, 0x8b20f06aa91ec843
movabs r9, 0x8b20f06aa91ec842
xor r8, r9
sub rax, r8
sub rcx, rax
mov rax, rdx
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x14006516d
jmp 0x14006517d
call fcn.140007e9d
xor eax, eax
mov byte [rsp + 0x57], al
jmp 0x140065190
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x57], al
mov al, byte [rsp + 0x57]
mov byte [rsp + 0x2f], al
mov eax, dword [0x140252f38]
mov edx, dword [0x140252f3c]
mov ecx, eax
or ecx, ecx
xor ecx, 0xffffffff
mov r9d, 0x3951ceb0
xor r9d, 0xc6ae314f
mov r8d, edx
xor r8d, r9d
mov r9d, edx
xor r9d, 0xffffffff
and r8d, r9d
or ecx, r8d
mov r8d, 0x84619ff8
xor r8d, 0x7b9e6007
xor ecx, r8d
mov r8d, 0x4861ce60
xor r8d, 0xb79e319f
xor eax, r8d
xor edx, 0xffffffff
and eax, edx
mov edx, 0x3ed3f90a
xor edx, 0xc12c06f5
xor ecx, edx
xor eax, 0xffffffff
and ecx, eax
add ecx, 0x62822770
mov edx, ecx
xor edx, 0x2658dcda
xor edx, 0xffffffff
and edx, 0x2658dcda
mov eax, 0xc9c3fe3e
xor eax, 0xc9c3fe3c
imul eax, edx
sub eax, 0x2658dcda
sub ecx, eax
mov edx, 0xffffffff
xor edx, 0x2c329a9e
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0xe882727
xor ecx, 0x1b4c61c2
cmp eax, ecx
jb 0x1400652b8
mov eax, dword [0x140252f40]
mov ecx, dword [0x140252f44]
xor ecx, 0x6a34f0f9
imul eax, ecx
mov ecx, 0x86c1b7c4
xor ecx, 0xe47aed5c
imul eax, ecx
mov ecx, 0x44d33bf7
xor ecx, 0x44d33bf7
mov edx, 0xe8a528d7
xor edx, 0xcb7c66f2
sub ecx, edx
sub eax, ecx
mov ecx, 0x2480121e
xor edx, edx
div ecx
mov ecx, 0x837098cb
xor ecx, 0xa5acd966
cmp eax, ecx
ja 0x140065251
mov al, byte [rsp + 0x2f]
and al, 1
movzx eax, al
add rsp, 0x58
ret
invalid
Function at 0x1400652d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x140252f48]
mov ecx, dword [0x140252f4c]
xor ecx, 0xd478d997
and eax, ecx
mov ecx, 0xad9b2092
xor edx, edx
div ecx
add eax, 0xea41a7c0
mov ecx, 0xd34465da
xor edx, edx
div ecx
cmp eax, 0x1d26bc77
je 0x140065395
mov rcx, qword [rbp - 8]
mov r8d, dword [0x140252f50]
mov edx, dword [0x140252f54]
mov eax, r8d
and eax, edx
xor r8d, edx
mov edx, eax
mov eax, r8d
lea eax, [rax + rdx*2 - 0x9ef9d70]
or eax, 0x9324cb57
mov dword [rbp - 0x14], eax
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, qword [rbp - 0x10]
mov rdx, rsp
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140019410
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
mov eax, dword [rbp - 0x14]
add rsp, 0x20
mov dl, byte [rdx + 0x10]
mov byte [rcx + 0x10], dl
cmp eax, 0xb2ce3e22
jbe 0x140065318
mov rsp, rbp
pop rbp
ret
sbb ebx, ecx
add dword [rcx + rbp*8], eax
jp 0x14006539b
invalid
invalid