joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013a00
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x20], rcx
mov eax, 0x10
call fcn.140215890
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
mov eax, 4
cmp rcx, 1
mov qword [rbp - 0x10], rax
jl 0x140013ca6
mov rax, qword [rbp - 0x20]
cmp rax, 0x8000
jae 0x140013aa5
mov rcx, qword [rbp - 0x20]
movabs rdx, 0xf4a333bbe8ba6785
movabs rax, 0xf4a333bbe8ba6787
xor rdx, rax
lea r8, [rbp - 8]
sub rsp, 0x20
call fcn.14000c790
add rsp, 0x20
test al, 1
jne 0x140013a7e
jmp 0x140013a90
sub rsp, 0x20
call fcn.140008bc6
add rsp, 0x20
jmp 0x140013a98
mov rax, qword [rbp - 8]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x10], rax
jmp 0x140013ca6
mov eax, dword [0x140216b88]
mov ecx, dword [0x140216b8c]
xor ecx, 0x34a512f5
xor edx, edx
div ecx
mov ecx, 0x24bcb08f
xor edx, edx
div ecx
mov ecx, eax
add ecx, 0xc7bdf2df
sub ecx, 0x7bb261c3
sub ecx, 0xc7bdf2df
mov eax, ecx
and eax, 0xd35c0082
mov edx, 0x6a30c459
xor edx, 0xb96cc4db
or ecx, edx
add eax, ecx
mov ecx, 0xc05daeab
xor ecx, 0x534ba1d0
cmp eax, ecx
jae 0x140013caf
mov r8, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
mov edx, dword [0x140216b90]
mov eax, dword [0x140216b94]
mov r9d, 0xe4032a47
xor r9d, 0x1bfcd5b8
xor edx, r9d
xor eax, 0xffffffff
mov r9d, 0xcd2ec0a9
xor r9d, 0x6ac4ad59
mov r10d, 0xbb33436a
xor r10d, 0x44ccbc95
xor r9d, r10d
or edx, eax
mov eax, 0xb18400df
xor eax, 0x166e6d2f
or eax, r9d
xor edx, 0xffffffff
and edx, eax
mov r9d, 0x9c957819
xor r9d, 0xa62967b5
mov eax, edx
and eax, r9d
xor eax, 0xffffffff
and edx, 0x3abc1fac
xor edx, 0xffffffff
xor eax, 0xffffffff
xor edx, 0xffffffff
or eax, edx
imul eax, eax, 0x491f1577
mov r9d, 0x12dc409f
xor r9d, 0x1f662fda
xor edx, edx
div r9d
mov dword [rbp - 0x30], eax
mov edx, 3
sub rsp, 0x20
call fcn.14000c790
add rsp, 0x20
mov cl, al
mov eax, dword [rbp - 0x30]
mov byte [rbp - 0x29], cl
cmp eax, 0xed985cd5
ja 0x140013b01
mov al, byte [rbp - 0x29]
test al, 1
jne 0x140013bcf
jmp 0x140013c89
mov ecx, dword [0x140216b98]
mov eax, 0x4639c238
xor eax, 0xe77ddb44
xor ecx, eax
mov edx, dword [0x140216b9c]
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
mov ecx, 0xd64c774a
xor ecx, 0x7d318626
xor edx, edx
div ecx
mov ecx, 0xeaac69c5
xor ecx, 0x7db677db
add eax, ecx
mov ecx, 0x592f1b40
xor edx, edx
div ecx
cmp eax, 0xe6244360
jae 0x140013cb8
mov eax, dword [0x140216ba0]
xor eax, 0xcc0a147e
mov ecx, dword [0x140216ba4]
sub eax, 0x71a27a4
add eax, ecx
add eax, 0x71a27a4
imul eax, eax, 0x68a58903
or eax, 0x8d67f7d6
mov ecx, eax
and ecx, 0x4f33b86c
mov edx, 0x1e5eb240
xor edx, 0xe1a14dbf
xor ecx, edx
add eax, 0x4f33b86c
add eax, 1
add eax, ecx
mov dword [rbp - 0x34], eax
sub rsp, 0x20
call fcn.140008bc6
mov eax, dword [rbp - 0x34]
add rsp, 0x20
cmp eax, 0xb5d9c0e8
jbe 0x140013c1f
jmp 0x140013c9e
mov rax, qword [rbp - 0x18]
mov rax, qword [rax]
mov ecx, 2
cqo
idiv rcx
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov rsp, rbp
pop rbp
ret
invalid
invalid
Function at 0x140016280
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x140216cd8]
and eax, dword [0x140216cdc]
mov ecx, 0x2685c58e
xor ecx, 0xd97a3a71
xor eax, ecx
mov edx, 0xffffffff
xor edx, 0x34d68f62
mov ecx, 0xffffffff
xor ecx, 0xc676846a
or eax, edx
or ecx, 0xc676846a
xor eax, 0xffffffff
and eax, ecx
mov ecx, eax
xor ecx, 0xf16da6b0
xor ecx, 0xffffffff
and ecx, 0xf16da6b0
shl ecx, 1
sub ecx, 0xf16da6b0
sub eax, ecx
or eax, 0x5fb9a329
cmp eax, 0x2eab8ac9
jb 0x140016372
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x140216ce0]
xor eax, 0x41f829e
mov r8d, dword [0x140216ce4]
mov edx, eax
and edx, r8d
shl edx, 1
add eax, r8d
sub eax, edx
mov r8d, 0xa0d38939
xor edx, edx
div r8d
mov r8d, 0xac10d112
xor r8d, 0x487a03a6
xor edx, edx
div r8d
mov r8d, 0x38ccd73e
xor edx, edx
div r8d
mov dword [rsp + 0x24], eax
xor eax, eax
mov edx, eax
call fcn.140015500
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
call fcn.140015930
mov eax, dword [rsp + 0x24]
cmp eax, 0x88872374
jae 0x1400162f6
add rsp, 0x38
ret
mov bl, 0x86
invalid
Function at 0x14001a9e0
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x140216ef8]
mov edx, dword [0x140216efc]
xor eax, 0xffffffff
xor edx, 0xffffffff
mov ecx, 0xd7b07106
xor ecx, 0xb1198604
mov r8d, 0x8c2d9357
xor r8d, 0x73d26ca8
xor ecx, r8d
or eax, edx
or ecx, 0x66a9f702
xor eax, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
mov edx, 0xcb1acb55
xor edx, 0x2c6cccb
mov ecx, 0xeba2fe4e
xor ecx, 0x145d01b1
xor edx, ecx
mov ecx, 0xffffffff
xor ecx, 0x90d47e6
or eax, edx
or ecx, 0x90d47e6
mov edx, 0x9bf797a2
xor edx, 0x6408685d
xor eax, edx
and eax, ecx
or eax, 0x8b6869a3
mov ecx, 0x25ff253f
xor edx, edx
div ecx
cmp eax, 0x1e58e87f
je 0x14001ab3a
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x140216f00]
mov r9d, dword [0x140216f04]
mov r8d, eax
xor r8d, r9d
mov r10d, 0x27255be
xor r10d, 0xfd8daa41
xor r9d, r10d
and eax, r9d
shl eax, 1
sub eax, r8d
xor eax, 0x8cd1b35b
mov r8d, 0x4bb28e47
xor r8d, 0x4be787af
or eax, r8d
mov r9d, eax
xor r9d, 0xffffffff
and r9d, 0xb8cdd133
mov r10d, 0xffffffff
xor r10d, 0xb8cdd133
mov r8d, eax
and r8d, r10d
imul r8d, r9d
mov r9d, eax
and r9d, 0xb8cdd133
or eax, 0xb8cdd133
imul eax, r9d
add eax, r8d
mov dword [rsp + 0x2c], eax
mov qword [rcx], 0
mov qword [rcx + 8], 0
call fcn.14001a9d6
mov eax, dword [rsp + 0x2c]
cmp eax, 0xc2ee750f
ja 0x14001aa83
mov rax, qword [rsp + 0x40]
add rsp, 0x48
ret
cmpsd dword [rsi], dword [rdi]
jmp 0x180eb106c
Function at 0x14001ab80
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov r11d, dword [0x140216f08]
mov r10d, dword [0x140216f0c]
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, r10d
xor r8d, 0xffffffff
mov edx, 0xf7eafda4
xor edx, 0x268083a3
mov eax, 0xda25a560
xor eax, 0x25da5a9f
xor edx, eax
mov r9d, 0x5130adcb
xor r9d, 0x805ad3cc
mov eax, ecx
and eax, r9d
and r11d, edx
mov r9d, r8d
and r9d, 0xd16a7e07
and r10d, edx
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
xor ecx, 0xffffffff
or edx, 0xd16a7e07
and ecx, edx
or eax, ecx
mov ecx, eax
xor ecx, 0x6e999cb9
xor ecx, 0xffffffff
or eax, 0x6e999cb9
and eax, ecx
mov ecx, 0x12ad95e9
xor ecx, 0xa7bbfac6
xor edx, edx
div ecx
or eax, 0x86df6098
cmp eax, 0x8006da68
jbe 0x14001ad05
mov eax, dword [0x140216f10]
xor edx, edx
div dword [0x140216f14]
mov ecx, 0x7ffc26e
xor ecx, 0x9e545e95
xor eax, ecx
and eax, 0x726588d4
or eax, 0x58375d0f
mov dword [rsp + 0x3c], eax
call fcn.14000c113
mov qword [rsp + 0x30], rax
call fcn.14000c113
mov rcx, qword [rsp + 0x30]
mov rdx, rax
mov eax, dword [rsp + 0x3c]
add rdx, 0x50
mov qword [rsp + 0x40], rdx
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x48], rcx
cmp rcx, 0
sete cl
mov byte [rsp + 0x57], cl
cmp eax, 0x3170c2bf
je 0x14001ac22
mov al, byte [rsp + 0x57]
test al, 1
jne 0x14001acc1
jmp 0x14001ac9f
mov rax, qword [0x14023a098]
mov qword [rsp + 0x28], rax
cmp rax, 0
je 0x14001acc1
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
call rax
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
je 0x14001acf4
mov rax, qword [rsp + 0x40]
mov cl, 0x2f
xor cl, 0x2f
mov byte [rax], cl
call fcn.14001ad0e
mov rax, qword [rsp + 0x40]
mov al, byte [rax]
mov cl, 0x44
xor cl, 0x44
cmp al, cl
jne 0x14001acff
mov ecx, 1
call qword [0x14023a0a8]
nop
add rsp, 0x58
ret
imul edx, esi, 0x14e9017b
invalid

Function at 0x14001fd70
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.14000c113
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.1400533a0
mov rax, qword [rsp + 0x30]
mov al, byte [rax + 0x50]
mov cl, 0xaa
xor cl, 0xaa
cmp al, cl
jne 0x14001fdac
mov rcx, qword [rsp + 0x28]
call fcn.140053582
mov eax, dword [0x140217138]
mov edx, dword [0x14021713c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
imul eax, eax, 0x32bbcaec
mov ecx, 0x8f0f8efb
xor ecx, 0xefe6bee0
xor edx, edx
div ecx
mov ecx, 0xe3f7bf16
xor ecx, 0xf13e4c3a
xor edx, edx
div ecx
cmp eax, 0x94d4fb2f
ja 0x14001fe79
mov eax, dword [0x140217140]
xor eax, 0x36414b4d
mov ecx, dword [0x140217144]
xor ecx, 0x63648098
imul eax, ecx
xor eax, 0x1e5368e7
mov edx, 0x4a2cd28c
xor edx, 0x9ebf6a13
mov ecx, eax
xor ecx, edx
mov edx, 0xdf02b7cf
xor edx, 0x20fd4830
xor ecx, edx
mov edx, 0x22a10a16
xor edx, 0xf632b289
or eax, edx
and eax, ecx
mov ecx, 0x55b114ab
xor ecx, 0x55b114ab
sub ecx, eax
mov eax, 0x25848186
xor eax, 0x25848186
mov edx, 0x67025769
xor edx, 0xad3fcd43
sub eax, edx
add ecx, eax
mov eax, 0x7d7878a
xor eax, 0x7d7878a
sub eax, ecx
cmp eax, 0x5412362b
jae 0x14001fded
add rsp, 0x38
ret
test eax, 0xe9d04ac0
imul edi, edi, 0xffffffff
jmp qword [rsi + 0x66]
Function at 0x140022ca0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 8]
mov rcx, rdx
add rcx, 8
mov qword [rsp + 0x48], rcx
cmp rax, qword [rdx + 8]
mov qword [rsp + 0x50], rax
je 0x140022d06
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
mov qword [rsp + 0x58], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x58]
call fcn.1400225c0
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov eax, dword [0x140217288]
imul eax, dword [0x14021728c]
mov r8d, 0xffffffff
xor r8d, 0x7bb4b8fd
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0x9b9cea47
xor r8d, 0xe02852ba
mov edx, eax
and edx, r8d
mov r8d, 0x3a4ee282
xor r8d, 0x41fa5a7f
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0xf790ff45
mov edx, 0xffffffff
xor edx, 0xf790ff45
and eax, edx
sub eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x52e27e8e
add eax, ecx
add eax, 1
mov ecx, 0x6250eb63
xor ecx, 0x39a15e36
cmp eax, ecx
jb 0x140022dfe
mov r8, qword [rsp + 0x28]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x30]
mov eax, dword [0x140217290]
or eax, dword [0x140217294]
mov ecx, 0xdc99fe8e
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x40]
mov ecx, eax
mov eax, ecx
and eax, 0xea8135c2
or ecx, 0xea8135c2
add eax, ecx
or eax, 0x68b81335
mov ecx, 0xa3d9cbf9
xor ecx, 0xad04efde
mov r10, qword [r10]
mov qword [r9], r10
mov qword [rdx], r8
cmp eax, ecx
jb 0x140022d9e
add rsp, 0x68
ret
invalid
Function at 0x140026582
Capabilities:
Encode data using xor

Disassembly:
and qword [rcx], 0
jmp fcn.1400261d0

Function at 0x140026b10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov byte [rsp + 0x47], dl
mov qword [rsp + 0x48], rcx
mov rdx, qword [rcx]
mov qword [rsp + 0x50], rdx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x58], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x60], rax
mov r8, rdx
and r8, 1
movabs rcx, 0xa83c59e34b204449
movabs r9, 0xa83c59e34b20444b
xor rcx, r9
imul r8, rcx
mov rcx, rdx
xor rcx, 1
add rcx, r8
mov qword [rsp + 0x68], rcx
xor rdx, 0xffffffffffffffff
and rcx, rdx
mov qword [rsp + 0x70], rcx
cmp rax, 0
je 0x140026c2f
mov rax, qword [rsp + 0x70]
cmp rax, 0
jl 0x140026bba
mov rax, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
movabs rcx, 0xbfffffffffffffff
and rcx, qword [rax]
cmp rcx, rdx
mov qword [rsp + 0x38], rax
jl 0x140026c2f
jmp 0x140026c8c
mov eax, dword [0x140217448]
xor edx, edx
div dword [0x14021744c]
add eax, 0x6f639020
or eax, 0x971134fb
mov ecx, 0x97df6aae
xor edx, edx
div ecx
cmp eax, 0xb5738dc2
je 0x140026cb0
mov eax, dword [0x140217450]
xor eax, 0x5066588d
and eax, dword [0x140217454]
sub eax, 0xaa588c9
mov ecx, 0xc039827e
xor edx, edx
div ecx
mov ecx, 0x63b0160d
xor ecx, 0x19d6ed3
xor eax, ecx
mov dword [rsp + 0x34], eax
call fcn.140008bc6
mov eax, dword [rsp + 0x34]
cmp eax, 0x112b0d0a
jb 0x140026be6
jmp 0x140026cab
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
mov r9d, 1
mov r8, r9
mov qword [rsp + 0x20], 1
call fcn.140013020
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
mov qword [rdx], rax
movabs rdx, 0x3c58f4c451055b5
movabs r8, 0x3c58f4c451055b5
xor rdx, r8
cmp rcx, rdx
mov qword [rsp + 0x38], rax
jge 0x140026c8c
call fcn.140008bc6
jmp 0x140026cab
mov rcx, qword [rsp + 0x50]
mov dl, byte [rsp + 0x47]
mov r8, qword [rsp + 0x48]
mov r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x38]
mov qword [r8], r9
mov byte [rax + rcx + 8], dl
add rsp, 0x78
ret
mov ebp, 0xe903bc6d
sub eax, 0xfffffff
invalid
Function at 0x140026f90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rcx
call fcn.14000c113
mov rcx, qword [rsp + 0x38]
add rax, 0x50
mov qword [rsp + 0x40], rax
add rcx, 8
mov qword [rsp + 0x48], rcx
xor eax, eax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov eax, dword [0x140217468]
xor edx, edx
div dword [0x14021746c]
mov ecx, 0x8d02c41b
xor ecx, 0x78e6d981
add eax, ecx
and eax, 0xa7a4e74d
mov ecx, eax
xor ecx, 0xef069bc7
mov edx, 0x5386b98d
xor edx, 0xac794672
xor ecx, edx
and ecx, 0xef069bc7
shl ecx, 1
sub ecx, 0xef069bc7
sub eax, ecx
cmp eax, 0x254f5aa7
jbe 0x140027168
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov eax, dword [0x140217470]
xor eax, 0xebb45f80
imul eax, dword [0x140217474]
mov r9d, 0x22e9d52f
xor r9d, 0x11c823c6
add eax, r9d
mov r9d, 0x2e79871a
xor r9d, 0x5279daef
imul eax, r9d
mov r9d, eax
add r9d, 1
mov r10d, 0xb8f29fc0
xor r10d, 0x470d603f
xor eax, r10d
or eax, 0xcc09c87d
add eax, r9d
cmp rdx, qword [r8]
setl dl
mov byte [rsp + 0x27], dl
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
cmp eax, 0xa420f5e
jbe 0x140027017
mov al, byte [rsp + 0x27]
test al, 1
jne 0x1400270a6
jmp 0x14002712d
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.14001e6c5
test al, 1
jne 0x1400270c7
jmp 0x14002711a
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.1401d2310
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140027162
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
movabs rdx, 0x8a47f81b9057b584
movabs rax, 0x8a47f81b9057b58c
xor rdx, rax
call fcn.14001096f
mov rax, qword [rsp + 0x30]
add rax, 1
mov qword [rsp + 0x50], rax
jmp 0x140026fbc
mov rax, qword [rsp + 0x28]
cmp rax, 0
je 0x140027162
mov rcx, qword [rsp + 0x28]
movabs rax, 0x4000000000000000
and rax, qword [rcx]
cmp rax, 0
jne 0x140027162
mov rcx, qword [rsp + 0x28]
call fcn.1400108f0
nop
add rsp, 0x58
ret
push 0xffffffffe947b2e2
cmpsb byte [rsi], byte [rdi]
invalid
Function at 0x140027a90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1402174c8]
xor eax, 0xf6a4040d
mov ecx, dword [0x1402174cc]
xor ecx, 0x9eac4a90
xor edx, edx
div ecx
mov ecx, 0xa0e54ef3
xor ecx, 0xd5b4aad
and eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0x1f5cbce
xor edx, 0x2f6c7797
and edx, ecx
mov r8d, 0xffffffff
xor r8d, 0x2e99bc59
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0x47c9541
xor r8d, 0x2ae52918
mov edx, eax
and edx, r8d
or eax, 0x2e99bc59
imul eax, edx
add eax, ecx
xor eax, 0x540cfb6c
cmp eax, 0xefd110b8
jae 0x140027b82
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1402174d0]
xor eax, dword [str._t_4]
mov edx, 0xdd3d244a
xor edx, 0xcee38bd9
imul eax, edx
mov edx, 0xcc883558
xor edx, 0xc2284c0c
add eax, edx
mov edx, 0x42cb8013
xor edx, 0x4beb0115
and eax, edx
mov dword [rsp + 0x24], eax
xor eax, eax
mov edx, eax
call fcn.1400272b0
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
call fcn.140027550
mov eax, dword [rsp + 0x24]
cmp eax, 0xcc5f87d
jae 0x140027b19
add rsp, 0x38
ret
sbb byte [rcx + 0x51], dh
and ch, cl
invalid
Function at 0x14002abb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov eax, dword [0x140217648]
xor eax, 0xad8e6b43
add eax, dword [0x14021764c]
add eax, 0xdc7a7633
sub eax, 0xf2b81d9d
sub eax, 0xdc7a7633
add eax, 0xce153887
sub eax, 0x11e37f96
sub eax, 0xce153887
mov ecx, 0xffffffff
xor ecx, 0x2bc1c4bf
mov edx, 0xe1b068d2
xor edx, 0xe1b068d2
mov r8d, 0x7cb2ddd7
xor r8d, 0x7cb2ddd6
sub edx, r8d
sub ecx, edx
sub eax, ecx
mov ecx, 0x242244e4
xor ecx, 0xc68ce14b
cmp eax, ecx
jb 0x14002acd8
mov eax, dword [0x140217650]
mov edx, dword [0x140217654]
mov ecx, eax
and ecx, edx
mov r8d, 0xc63ae018
xor r8d, 0xc63ae01a
imul ecx, r8d
xor eax, edx
add eax, ecx
mov ecx, 0x5d6e8d07
xor ecx, 0xaa68e55b
or eax, ecx
mov ecx, 0x44d3572d
xor ecx, 0x687913ce
xor edx, edx
div ecx
add eax, 0x89558d10
mov dword [rsp + 0x38], eax
mov eax, 0xb166d01c
xor eax, 0xef148f6
mov cl, 0x35
test byte [rax - 0xf], 0xe
mov dword [rsp + 0x34], eax
call fcn.14000c113
mov rcx, rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax]
call fcn.14013c008
mov rdx, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x34]
mov eax, dword [rsp + 0x38]
cmp byte [rdx + 0x50], 0
sete dl
mov byte [rsp + 0x3f], dl
cmp eax, ecx
jae 0x14002ac25
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x14002acc8
jmp 0x14002acd2
mov rcx, qword [rsp + 0x40]
call fcn.14013bf20
nop
add rsp, 0x48
ret
loop 0x14002ac73
push rsp
jmp 0x14002ac25
Function at 0x14002d2c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov rdx, qword [rcx]
mov qword [rsp + 0x50], rdx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x58], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x60], rax
movabs r8, 0x59930f023989fb
movabs rcx, 0x59930f023989fa
xor r8, rcx
mov rcx, rdx
add rcx, r8
mov qword [rsp + 0x68], rcx
movabs r8, 0xd7f3aad9ced4eae8
movabs r9, 0x280c5526312b1517
xor r8, r9
mov r9, rdx
xor r9, r8
movabs r8, 0x82a2674d4c632ece
movabs r10, 0x7d5d98b2b39cd131
xor r8, r10
xor r9, r8
movabs r8, 0xf27f501534dfb116
movabs r10, 0xd80afeacb204ee9
xor r8, r10
and r8, r9
shl r8, 1
sub r8, 0xffffffffffffffff
sub rdx, r8
and rcx, rdx
mov qword [rsp + 0x70], rcx
cmp rax, 0
je 0x14002d47c
mov rax, qword [rsp + 0x70]
cmp rax, 0
jl 0x14002d472
mov eax, dword [0x140217798]
xor edx, edx
div dword [0x14021779c]
imul eax, eax, 0xd06c7052
xor eax, 0x998724fd
mov r8d, 0xffffffff
xor r8d, 0x96b966a3
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x348c9e7e
xor r8d, 0xcb736181
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x96b966a3
mov r8d, 0x73998ac1
xor r8d, 0xe520ec62
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x7cc7e148
xor ecx, 0x869760f7
cmp eax, ecx
jae 0x14002d4ec
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x60]
mov eax, dword [0x1402177a0]
and eax, dword [0x1402177a4]
xor eax, 0x88bace1
sub eax, 0x1d11c74b
mov ecx, 0xb0aa4452
xor ecx, 0x9cb09985
xor edx, edx
div ecx
mov ecx, 0xc65461c4
xor ecx, 0xba3b786c
movabs rdx, 0xbfffffffffffffff
and rdx, qword [r9]
cmp rdx, r8
setl dl
mov byte [rsp + 0x3f], dl
cmp eax, ecx
ja 0x14002d3fd
mov rax, qword [rsp + 0x60]
mov cl, byte [rsp + 0x3f]
test cl, 1
mov qword [rsp + 0x30], rax
jne 0x14002d47c
jmp 0x14002d4c6
call fcn.140008bc6
jmp 0x14002d4e7
mov rdx, qword [rsp + 0x60]
and al, 0x60
mov rcx, qword [rsp + 0x50]
mov r8d, 1
mov r9d, 8
mov qword [rsp + 0x20], 8
call fcn.140013020
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
mov qword [rdx], rax
cmp rcx, 0
mov qword [rsp + 0x30], rax
jge 0x14002d4c6
call fcn.140008bc6
jmp 0x14002d4e7
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x30]
mov qword [r8], r9
mov qword [rax + rcx*8 + 8], rdx
add rsp, 0x78
ret
jne 0x14002d47f
push 0xffffffffff08e9bb
invalid
Function at 0x14002f210
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.14000c113
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1401a23a0
mov rax, qword [rsp + 0x30]
mov al, byte [rax + 0x50]
mov cl, 0x98
xor cl, 0x98
cmp al, cl
jne 0x14002f343
mov ecx, dword [0x140217858]
xor ecx, dword [0x14021785c]
and ecx, 0x90523f5e
mov eax, ecx
xor eax, 0xffffffff
and eax, 0xc26fad25
mov edx, 0xffffffff
xor edx, 0xc26fad25
and ecx, edx
sub ecx, eax
mov edx, 0xa210bb4c
xor edx, 0x773844fc
mov eax, ecx
and eax, edx
or ecx, 0xd528ffb0
add eax, ecx
mov ecx, 0xd8ba43f6
xor ecx, 0xe560c840
cmp eax, ecx
jb 0x14002f348
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x140217860]
xor eax, 0x8dab3f7b
mov edx, dword [0x140217864]
mov r8d, 0xabb5c2a8
xor r8d, 0x76081e15
xor edx, r8d
xor eax, edx
imul eax, eax, 0x34d66aec
mov r9d, 0x422df129
xor r9d, 0x1987058c
mov edx, 0x88a792b1
xor edx, 0x77586d4e
xor r9d, edx
mov r8d, eax
and r8d, r9d
mov edx, eax
or edx, r9d
mov r9d, 0xe823f54
xor r9d, 0xf17dc0ab
xor edx, r9d
imul edx, r8d
mov r9d, 0x7ce4b24f
xor r9d, 0x274e46ea
mov r8d, eax
and r8d, r9d
or eax, 0x5baaf4a5
imul eax, r8d
add eax, edx
imul eax, eax, 0x6eb52aa8
mov dword [rsp + 0x24], eax
call fcn.1401a2561
mov eax, dword [rsp + 0x24]
cmp eax, 0xbdbfd652
ja 0x14002f29a
jmp 0x14002f343
add rsp, 0x38
ret
jns 0x14002f3c3
jmp 0x14002f29a
ror byte [rcx - 0x7d], 0xf0
dec dword [rax - 0x77]
ret 0x214c
Function at 0x140030000
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov rdx, qword [rcx]
mov rax, rdx
and rax, 0xffffffffffffffff
mov rcx, rdx
or rcx, 0xffffffffffffffff
add rax, rcx
mov qword [rsp + 0x50], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl dl
cmp rax, 0xffffffffffffffff
setg al
mov cl, al
xor cl, dl
xor cl, 0xff
or al, dl
and al, cl
test al, 1
jne 0x14003006b
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
add rcx, 8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
jmp 0x140030075
call fcn.140008bc6
jmp 0x140030205
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
cmp rax, rcx
jl 0x1400301f8
mov rax, qword [rsp + 0x28]
cmp rax, 0
jl 0x1400300af
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
cmp rax, qword [rcx]
jl 0x1400300bc
mov rcx, rdx
call fcn.1400153d3
jmp 0x140030205
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
add rcx, 8
shl rax, 3
add rcx, rax
call fcn.14002fec0
mov rcx, qword [rsp + 0x28]
xor eax, eax
mov edx, eax
sub rdx, 0xffffffffffffffff
mov rax, rcx
sub rax, rdx
mov r8, rax
and r8, rcx
shl r8, 1
mov rdx, rax
add rdx, rcx
sub rdx, r8
cmp rdx, 0
setl r8b
cmp rcx, 0
setne cl
mov dl, cl
xor dl, r8b
xor dl, 0xff
or cl, r8b
and cl, dl
test cl, 1
mov qword [rsp + 0x38], rax
jne 0x14003012e
jmp 0x140030075
mov eax, dword [0x1402178c8]
mov ecx, 0xc5dd500b
xor ecx, 0x715962af
xor eax, ecx
mov ecx, dword [0x1402178cc]
xor ecx, 0xa68e1299
sub eax, ecx
add eax, 0xa3945a2f
mov ecx, 0xe627564a
xor ecx, 0xe1fa2567
add eax, ecx
mov ecx, 0xd76189f1
xor ecx, 0x74f5d3de
sub eax, ecx
mov ecx, 0x4eeab932
xor ecx, 0x6bb34cc1
or eax, ecx
or eax, 0xedca8c51
cmp eax, 0xeed225be
ja 0x14003020a
mov eax, dword [0x1402178d0]
mov ecx, dword [0x1402178d4]
xor ecx, 0x62810e31
sub eax, 0xbec1aea8
add eax, ecx
add eax, 0xbec1aea8
mov edx, 0x3f383b31
xor edx, 0x913319d
mov ecx, 0x699c48e2
xor ecx, 0x9663b71d
xor edx, ecx
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0x362b0aac
add eax, edx
sub eax, ecx
or eax, 0x844dadc3
or eax, 0xbaa2ca67
mov dword [rsp + 0x24], eax
call fcn.140008bc6
mov eax, dword [rsp + 0x24]
cmp eax, 0xb79a9a3
jb 0x14003018b
jmp 0x140030205
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
add rsp, 0x58
ret
invalid