joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140034680
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov rdx, qword [rcx]
xor eax, eax
mov ecx, eax
sub rcx, rdx
xor eax, eax
sub rax, 0xffffffffffffffff
add rcx, rax
movabs rax, 0x834230f205997716
movabs r8, 0x834230f205997716

Function at 0x140035660
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rcx
add rcx, 8
mov qword [rsp + 0x48], rcx
xor eax, eax
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov qword [rsp + 0x38], rdx
cmp rax, rcx
jge 0x14003579b
mov eax, dword [0x140217b38]
imul eax, dword [0x140217b3c]
mov ecx, 0x542ab97c
xor ecx, 0xc6317aec
imul eax, ecx
mov ecx, 0xfc5e0e
xor edx, edx
div ecx
mov ecx, eax
mov edx, 0xffffffff
xor edx, 0x558a9d66
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0xb5b92b5
je 0x14003581b
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x140217b40]
or eax, dword [0x140217b44]
mov r8d, 0x5821e3ef
xor r8d, 0x87f6333f
xor edx, edx
div r8d
mov r8d, 0x7070ccc2
xor edx, edx
div r8d
mov edx, eax
mov rax, qword [rsp + 0x38]
mov r8d, 0x5f92c17f
xor r8d, 0xf433dd50
xor edx, r8d
mov dword [rsp + 0x28], edx
mov edx, 0xa510952d
xor edx, 0x6c4e6a74
mov dword [rsp + 0x24], edx
mov rcx, qword [rax + rcx*8 + 8]
call fcn.140014480
mov ecx, dword [rsp + 0x24]
mov dl, al
mov eax, dword [rsp + 0x28]
mov byte [rsp + 0x2f], dl
cmp eax, ecx
jae 0x1400356e3
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x14003576c
jmp 0x140035783
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.140011df0
mov rax, qword [rsp + 0x30]
xor ecx, ecx
sub rcx, 1
sub rax, rcx
mov qword [rsp + 0x50], rax
jmp 0x140035679
mov rax, qword [rsp + 0x38]
cmp rax, 0
je 0x140035815
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
or rax, rax
xor rax, 0xffffffffffffffff
mov rcx, 0xffffffffffffffff
movabs rdx, 0x4000000000000000
xor rcx, rdx
mov rdx, 0xffffffffffffffff
movabs r8, 0x4000000000000000
xor rdx, r8
and rcx, rdx
or rax, rcx
xor rax, 0xffffffffffffffff
movabs rcx, 0xef570b91c7eccfd5
movabs rdx, 0xef570b91c7eccfd5
xor rcx, rdx
cmp rax, rcx
jne 0x140035815
mov rcx, qword [rsp + 0x38]
call fcn.1400108f0
nop
add rsp, 0x58
ret
movabs eax, dword [0xfffffebfe955cadd]
nop word cs:[rax + rax]
Function at 0x140035f30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov ecx, dword [0x140217b78]
mov edx, dword [0x140217b7c]
xor edx, 0x112ed534
mov eax, edx
and eax, ecx
xor eax, 0xffffffff
add ecx, edx
add ecx, 1
add ecx, eax
mov eax, ecx
and eax, eax
xor eax, 0xffffffff
mov edx, 0x70100bc0
xor edx, 0xf18a8cea
and eax, edx
mov edx, 0x708578a
xor edx, 0xf8f7a875
xor eax, edx
mov edx, 0x819a872a
and edx, 0x819a872a
xor edx, 0xffffffff
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
add eax, 0x33edb355
mov ecx, 0x4b403277
xor ecx, 0x20c50ca5
add eax, ecx
sub eax, 0x33edb355
imul eax, eax, 0x832e47c5
cmp eax, 0xadeecb85
ja 0x14003608b
mov r8, qword [rsp + 0x18]
mov eax, dword [0x140217b80]
and eax, dword [0x140217b84]
xor ecx, ecx
sub ecx, 0x9251a45e
add eax, ecx
mov ecx, eax
and ecx, 0x8c0a5256
mov edx, 0xf52a2597
xor edx, 0xad5da68
xor ecx, edx
add eax, 0x8c0a5256
add eax, 1
add eax, ecx
add eax, 0x92cec02b
mov ecx, 0xf0ad4049
xor ecx, 0x9ec52de
xor edx, edx
test r8, r8
cmovg rdx, r8
mov qword [rsp + 0x10], rdx
cmp eax, ecx
ja 0x140035fc7
xor eax, eax
mov qword [rsp + 8], rax
jmp 0x140036033
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 8]
mov qword [rsp], rax
cmp rax, rcx
je 0x140036086
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov dl, byte [rdx + rax]
mov byte [rcx + rax], dl
movabs rcx, 0xa388a363085f5a7a
sub rax, rcx
add rax, 1
movabs rcx, 0xa388a363085f5a7a
add rax, rcx
mov qword [rsp + 8], rax
jmp 0x140036033
add rsp, 0x30
ret
invalid
Function at 0x1400383d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov ecx, dword [0x140217cb0]
or ecx, dword [0x140217cb4]
mov r8d, 0xffffffff
xor r8d, 0xc18717d5
mov edx, ecx
and edx, r8d
mov eax, ecx
or eax, r8d
mov r8d, 0xed06b2db
xor r8d, 0x12f94d24
xor eax, r8d
imul eax, edx
mov r8d, 0xce3d4470
xor r8d, 0xfba53a5
mov edx, ecx
and edx, r8d
mov r8d, 0xf641adfc
xor r8d, 0x37c6ba29
or ecx, r8d
imul ecx, edx
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xbb2336dd
xor edx, 0x85862bcb
and edx, eax
mov r8d, 0xffffffff
xor r8d, 0x3ea51d16
mov eax, ecx
and eax, r8d
imul eax, edx
mov edx, ecx
and edx, 0x3ea51d16
or ecx, 0x3ea51d16
imul ecx, edx
add ecx, eax
mov eax, ecx
or eax, eax
xor eax, 0xffffffff
mov edx, 0x8f512ad0
or edx, 0x8f512ad0
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x8f512ad0
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
cmp eax, 0x6171a470
jbe 0x140038529
mov eax, dword [0x140217cb8]
xor eax, dword [0x140217cbc]
imul eax, eax, 0x7f3283c3
mov ecx, 0xefbfec12
xor ecx, 0x6a8f60b
mov edx, 0x82edd3ea
xor edx, 0x7d122c15
xor ecx, edx
add eax, ecx
add eax, 1
sub eax, 0x28084166
mov dword [rsp + 0x2c], eax
mov eax, 0xb2ffeac5
xor eax, 0xe0bf7b2a
mov dword [rsp + 0x28], eax
call fcn.140036445
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, rax
call qword [rax + 0x48]
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
jbe 0x1400384b4
add rsp, 0x48
ret
in eax, 0x16
add cl, byte [rcx + rbp*8 - 0x7e]
nop word cs:[rax + rax]
Function at 0x14003b860
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov eax, dword [0x140217e60]
mov edx, dword [0x140217e64]
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
or eax, edx
and eax, ecx
mov edx, 0xffffffff
xor edx, 0x8c390f53
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0x8c390f53
add eax, edx
sub eax, ecx
mov ecx, 0x1dd28651
xor ecx, 0x49e15584
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
and eax, eax
xor eax, 0xffffffff
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xff2315c8
or eax, edx
mov edx, 0xff2315c8
and edx, 0xff2315c8
xor edx, 0xffffffff
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
mov ecx, 0x8851ee7
xor ecx, 0xf77ae118
xor eax, ecx
cmp eax, 0xcd53ae08
jb 0x14003b9e1
mov ecx, dword [0x140217e68]
xor ecx, 0x4b885ce0
mov r8d, dword [0x140217e6c]
mov eax, 0xcc0428ed
xor eax, 0x33fbd712
mov r9d, r8d
xor r9d, eax
mov edx, ecx
and edx, r9d
mov eax, ecx
or eax, r9d
mov r9d, 0x10c2581
xor r9d, 0xfef3da7e
xor eax, r9d
imul eax, edx
mov edx, ecx
and edx, r8d
or ecx, r8d
imul ecx, edx
add ecx, eax
add ecx, 0x74f2d15a
add ecx, 0x9b7d902f
sub ecx, 0x74f2d15a
mov eax, ecx
and eax, 0xd62e1813
xor ecx, 0xd62e1813
or eax, ecx
or eax, 0xb9f80fe0
mov dword [rsp + 0x34], eax
mov ecx, 0x40
mov edx, 8
call fcn.140015160
mov rcx, rax
mov rax, qword [0x14022daf0]
mov qword [rcx], rax
lea rax, [0x140225500]
mov qword [rcx + 0x10], rax
mov rax, qword [0x140225510]
mov qword [rcx + 0x18], rax
mov rax, qword [str.HU__]
mov qword [rcx + 0x20], rax
mov qword [rcx + 8], 0
lea rdx, [0x140225500]
lea r8, [0x140225520]
lea r9, [0x140225537]
mov qword [rsp + 0x20], 0xffffffffbba70d21
call fcn.140014c00
mov eax, dword [rsp + 0x34]
cmp eax, 0xd5db774d
jb 0x14003b8ee
add rsp, 0x38
ret
invalid
Function at 0x14003c5f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
call fcn.14003b720
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov qword [rsp + 0x50], rax
mov rcx, rdx
or rcx, rcx
movabs r8, 0x962a897f59cfec01
movabs r9, 0x69d57680a63013fe
xor r8, r9
xor rcx, r8
mov r8, 0xffffffffffffffff
or r8, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
or rcx, r8
movabs r8, 0x35b79659cef1c032
movabs r9, 0xca4869a6310e3fcd
xor r8, r9
xor rcx, r8
xor rdx, 0xffffffffffffffff
mov r8, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
and rdx, r8
movabs r8, 0x50a736d0cf07c862
movabs r9, 0xaf58c92f30f8379d
xor r8, r9
xor rcx, r8
xor rdx, 0xffffffffffffffff
and rcx, rdx
add rax, rcx
cmp rax, 0xffffffffffffffff
je 0x14003c7ff
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
test r8, r8
sets al
mov rdx, rcx
sub rdx, r8
setle dl
or al, dl
test rcx, rcx
setle cl
or al, cl
test al, 1
jne 0x14003c6d6
jmp 0x14003c7ff
mov eax, dword [0x140217ed0]
mov r8d, dword [0x140217ed4]
mov edx, 0x995fc20e
xor edx, 0x66a03df1
mov ecx, eax
xor ecx, edx
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x6b7a2f59
xor ecx, 0xeea35572
or eax, ecx
mov ecx, 0xd1fd9567
xor ecx, 0xd1fd9567
mov edx, 0xd4315b5b
xor edx, 0xfe17300e
sub ecx, edx
add eax, ecx
sub eax, 0xa2586b36
mov ecx, 0xc675a421
xor ecx, 0xd110ea38
cmp eax, ecx
je 0x14003c85c
mov r8, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov eax, dword [0x140217ed8]
xor eax, 0x1cdcb6ae
mov edx, dword [0x140217edc]
xor edx, 0x10049745
xor eax, edx
or eax, 0xf68b65aa
mov r9d, 0xd71f1839
xor r9d, 0xdf22076a
xor edx, edx
div r9d
mov r9d, 0xe774c88c
xor r9d, 0xe4101a8b
xor edx, edx
div r9d
mov dword [rsp + 0x34], eax
movabs rax, 0x5ea0233363dde6ec
mov rdx, r8
add rdx, rax
movabs rax, 0xdf064be21cce78c0
movabs r9, 0x20f9b41de331873f
xor rax, r9
add rdx, rax
movabs rax, 0xc48d2f637f55ad4e
movabs r9, 0x9a2d0c501c884ba2
xor rax, r9
sub rdx, rax
call fcn.14002180c
mov eax, dword [rsp + 0x34]
cmp eax, 0x8d01906b
je 0x14003c752
jmp 0x14003c852
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x50]
mov r9, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov r10, qword [rax + 8]
mov rcx, r10
add rcx, 8
add rcx, r9
xor eax, eax
cmp r10, 0
cmove rcx, rax
movabs rax, 0x60b269e305ea485d
movabs r10, 0x60b269e305ea485d
xor rax, r10
sub rax, r9
add rdx, rax
call fcn.14003c578
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rsp, 0x58
ret
invalid

Function at 0x14003d270
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xb8
mov dword [rsp + 0x9c], ecx
call fcn.14003e193
mov ecx, dword [rsp + 0x9c]
mov qword [rsp + 0xa0], rax
lea rdx, [0x1402255a0]
mov r8d, 0x87
mov r9d, 0x2d
mov qword [rsp + 0x20], 3
Function at 0x140042ca0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1402181c0]
mov ecx, dword [0x1402181c4]
xor ecx, 0xc81b2e18
and eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0xd5d5550c
xor edx, 0xd110a089
and ecx, edx
mov edx, 0xffffffff
xor edx, 0x4c5f585
and eax, edx
sub eax, ecx
or eax, 0x4a09c2d7
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x44829be4
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, 0x1d5c1781
xor ecx, 0x61a1fc61
cmp eax, ecx
jb 0x140042f44
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x1402181c8]
mov edx, dword [0x1402181cc]
xor edx, 0xe77a60f3
sub eax, 0x1f9bc980
sub eax, edx
add eax, 0x1f9bc980
mov r8d, 0xfd60a077
xor edx, edx
div r8d
mov edx, eax
and edx, 0xb1763363
shl edx, 1
mov r8d, 0x2ee4fcdd
xor r8d, 0x9f92cfbe
add eax, r8d
sub eax, edx
and eax, 0x3b5cf27d
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x30], rcx
cmp rcx, 0
sete cl
mov byte [rsp + 0x3f], cl
cmp eax, 0x5f405fad
ja 0x140042d07
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x140042f3f
jmp 0x140042d87
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
movabs rcx, 0xd5d865e09f37b6e3
movabs rdx, 0x2a279a1f60c8491c
xor rcx, rdx
xor rax, rcx
mov rdx, 0xffffffffffffffff
movabs rcx, 0x4000000000000000
xor rdx, rcx
mov rcx, 0xffffffffffffffff
movabs r8, 0x3ae91e8e7770caaf
xor rcx, r8
or rax, rdx
movabs rdx, 0x3ae91e8e7770caaf
or rcx, rdx
xor rax, 0xffffffffffffffff
and rax, rcx
cmp rax, 0
je 0x140042f3f
mov ecx, dword [0x1402181d0]
xor ecx, 0x21fade66
mov edx, dword [0x1402181d4]
mov eax, ecx
xor eax, 0xffffffff
and eax, edx
xor edx, 0xffffffff
and ecx, edx
sub ecx, eax
mov eax, ecx
xor eax, 0xc7728e0b
xor eax, 0xffffffff
mov edx, 0xf17f5d03
xor edx, 0x360dd308
or ecx, edx
and ecx, eax
add ecx, 0xdff013a0
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x91a6bec0
and eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x91a6bec0
and ecx, edx
xor eax, 0xffffffff
mov edx, 0x8ad81729
xor edx, 0x7527e8d6
xor ecx, edx
and eax, ecx
cmp eax, 0x327570fb
je 0x140042f4d
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x1402181d8]
xor eax, 0x890be599
mov edx, dword [str.JO4Ei]
xor edx, 0xcca4d9ec
xor eax, edx
or eax, 0xaecc01c9
mov edx, eax
xor edx, 0xffffffff
xor eax, 0xffffffff
and edx, eax
mov eax, 0xffffffff
xor eax, 0x3fc5a23a
mov r8d, 0xffffffff
xor r8d, 0x3fc5a23a
and eax, r8d
or edx, eax
mov eax, 0x33ea58ce
xor eax, 0xcc15a731
xor edx, eax
mov eax, edx
xor eax, 0xffffffff
mov r8d, edx
xor r8d, 0xffffffff
and eax, r8d
mov r8d, 0x9aabfa7d
xor r8d, 0xa195b878
mov r9d, 0xa6af277a
xor r9d, 0x5950d885
xor r8d, r9d
mov r9d, 0xffffffff
xor r9d, 0x3b3e4205
and r8d, r9d
or eax, r8d
xor eax, 0xffffffff
mov r8d, 0xad2f46a4
xor r8d, 0x961104a1
or edx, r8d
xor edx, 0xffffffff
xor eax, 0xffffffff
xor edx, 0xffffffff
and eax, edx
mov dword [rsp + 0x2c], eax
call fcn.140016f90
mov eax, dword [rsp + 0x2c]
cmp eax, 0x15f862c4
jbe 0x140042e70
jmp 0x140042f3f
add rsp, 0x48
ret
imul ebp, dword [rdx + 8], 0xfdbae976
invalid
invalid
Function at 0x1400490f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], rcx
cmp r9, 0
mov qword [rsp + 0x80], r9
jge 0x140049146
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
movabs rcx, 0x5e40c95aaa3f5691
sub rax, rcx
add rax, 0xffffffffffffffff
movabs rcx, 0x5e40c95aaa3f5691
add rax, rcx
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x48], rdx
add rcx, 8
mov qword [rsp + 0x50], rcx
cmp rax, 0xffffffffffffffff
setg cl
mov byte [rsp + 0x5f], cl
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rcx
mov rax, 0xffffffffffffffff
cmp rcx, rdx
mov qword [rsp + 0x40], rax
jg 0x140049390
mov al, byte [rsp + 0x5f]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x78]
mov rdx, qword [rdx]
mov qword [rsp + 0x30], rdx
sub rcx, rdx
setl cl
and al, cl
test al, 1
jne 0x1400491f3
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
xor eax, eax
sub rax, rdx
xor edx, edx
sub rdx, 0xffffffffffffffff
add rax, rdx
xor edx, edx
sub rdx, rax
call fcn.1400153d3
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x40], rax
jmp 0x140049390
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x50]
mov rdx, qword [rdx]
mov r8b, byte [rdx + rax + 8]
mov dl, r8b
shr dl, 3
movzx edx, dl
movzx edx, byte [rcx + rdx]
mov cl, r8b
and cl, 7
xor cl, 0xff
xor r8b, 0xff
mov r9b, 0xff
xor r9b, 7
or r8b, r9b
and cl, r8b
xor cl, 0xff
movzx ecx, cl
mov r8d, 1
shl r8d, cl
mov ecx, r8d
and ecx, edx
cmp ecx, 0
mov qword [rsp + 0x40], rax
jne 0x140049390
mov ecx, dword [0x1402184f0]
mov r8d, dword [0x1402184f4]
xor r8d, 0xafa0c14d
mov edx, r8d
xor edx, 0xffffffff
mov eax, ecx
and eax, edx
mov edx, ecx
xor edx, r8d
add ecx, edx
sub ecx, eax
and ecx, 0x7c087b8a
mov eax, 0x514c5f39
xor eax, 0x980b06cd
mov edx, 0x318774bc
xor edx, 0xce788b43
xor eax, edx
mov edx, 0xa2a282af
xor edx, 0xa2a282af
mov r8d, 0x7d4cdac8
xor r8d, 0x7d4cdac9
sub edx, r8d
sub eax, edx
sub ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
mov edx, 0x3e245cf6
xor edx, 0xc1dba309
xor eax, edx
mov edx, 0x7f93f0f8
xor edx, 0xf603665e
mov r8d, 0x40cb9d1c
xor r8d, 0xbf3462e3
xor edx, r8d
or eax, edx
mov edx, 0xffffffff
xor edx, 0x899096a6
mov r8d, 0xffffffff
xor r8d, 0x899096a6
or edx, r8d
and ecx, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
cmp eax, 0x71b30f93
jb 0x14004939d
mov eax, dword [0x1402184f8]
sub eax, dword [0x1402184fc]
mov ecx, 0xb07954c2
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x38]
mov ecx, 0x127ad22c
xor ecx, 0xfa77acdb
and ecx, eax
mov r8d, 0x179239e3
xor r8d, 0xe86dc61c
xor ecx, r8d
add eax, 0xe80d7ef7
add eax, 1
add eax, ecx
xor eax, 0x8745de1d
mov ecx, 0x264493e7
xor ecx, 0xac2585bc
add rdx, 1
mov qword [rsp + 0x28], rdx
cmp eax, ecx
je 0x14004931f
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x60], rax
jmp 0x140049176
mov rax, qword [rsp + 0x40]
add rsp, 0x88
ret
movabs al, byte [0xffffff79e958a3aa]
nop word cs:[rax + rax]
Function at 0x14004c430
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov qword [rbp], r8
mov qword [rbp + 8], rdx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rcx
Function at 0x140051c00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rcx
add rcx, 8
mov qword [rsp + 0x48], rcx
xor eax, eax
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov qword [rsp + 0x38], rdx
cmp rax, rcx
jge 0x140051ceb
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
add rax, 8
shl rcx, 5
add rax, rcx
add rax, 0x10
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
cmp rax, 0
je 0x140051cd8
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
movabs rdx, 0x36d8df4cbbde825e
movabs rax, 0x76d8df4cbbde825e
xor rdx, rax
movabs rax, 0x8b3d58dce9d53f1d
movabs r8, 0x74c2a723162ac0e2
xor rax, r8
xor rdx, rax
mov rax, rcx
xor rax, rdx
and rax, rcx
movabs rcx, 0x2976085d6ddabcb5
movabs rdx, 0x2976085d6ddabcb5
xor rcx, rdx
cmp rax, rcx
jne 0x140051cd8
mov rcx, qword [rsp + 0x28]
call fcn.140010918
mov rax, qword [rsp + 0x30]
add rax, 1
mov qword [rsp + 0x50], rax
jmp 0x140051c19
mov ecx, dword [0x1402188c0]
add ecx, dword [0x1402188c4]
mov edx, 0xffffffff
xor edx, 0xbf842d7f
mov eax, ecx
and eax, edx
mov r8d, 0x1a02f79
xor r8d, 0xbe240206
mov edx, ecx
xor edx, r8d
add ecx, edx
sub ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
mov edx, 0x4699d64a
xor edx, 0xb96629b5
xor eax, edx
mov edx, 0xffffffff
xor edx, 0xb44c6837
or eax, edx
mov edx, 0xffffffff
xor edx, 0xb44c6837
mov r8d, 0xffffffff
xor r8d, 0xb44c6837
or edx, r8d
xor ecx, 0xffffffff
mov r8d, 0xaf4d161f
xor r8d, 0x50b2e9e0
xor edx, r8d
or ecx, edx
and eax, ecx
mov ecx, 0x3f531656
xor ecx, 0xc0ace9a9
xor eax, ecx
mov ecx, 0xfc37c4c3
xor ecx, 0x7be88fb4
xor edx, edx
div ecx
cmp eax, 0x1d4b6be0
ja 0x140051e82
mov rdx, qword [rsp + 0x38]
mov eax, dword [0x1402188c8]
xor eax, dword [0x1402188cc]
mov ecx, 0xd31b5b26
xor ecx, 0xf2a431eb
add eax, ecx
mov ecx, 0xe33ef20f
xor ecx, 0xe6b6b2b8
mov r8d, 0x7a80f262
xor r8d, 0x857f0d9d
xor ecx, r8d
mov r8d, 0xbccadf5d
xor r8d, 0xbccadf5d
mov r9d, 0xcf47de8f
xor r9d, 0xcf47de8e
sub r8d, r9d
sub ecx, r8d
sub eax, ecx
imul eax, eax, 0xc424e8a6
mov ecx, 0x16b1e7dc
xor ecx, 0xcfcd9945
cmp rdx, 0
sete dl
mov byte [rsp + 0x27], dl
cmp eax, ecx
je 0x140051d9b
mov al, byte [rsp + 0x27]
test al, 1
jne 0x140051e7c
jmp 0x140051e2b
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
movabs rcx, 0x9cfdfd45d3e3002c
movabs rdx, 0xdcfdfd45d3e3002c
xor rcx, rdx
and rax, rcx
movabs rcx, 0x9e9aee9511d8d73e
movabs rdx, 0x9e9aee9511d8d73e
xor rcx, rdx
cmp rax, rcx
jne 0x140051e7c
mov rcx, qword [rsp + 0x38]
mov edx, 8
call fcn.14001091d
nop
add rsp, 0x58
ret
adc dword [r10 + rdx*8 - 0xef17], ebp
invalid
Function at 0x1400535b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
call fcn.14004e61c
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
call fcn.14004e637
mov rdx, qword [rsp + 0x50]
cmp rdx, 0
jge 0x140053603
mov rcx, qword [rsp + 0x50]
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
call fcn.14000e6db
jmp 0x140053748
mov rcx, qword [rsp + 0x50]
call fcn.14004e6a0
mov rcx, rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rcx
cmp byte [rax], 0
jne 0x140053748
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
movabs rdx, 0xf0deddddad88931b
movabs r8, 0xf0deddddad88931b
xor rdx, r8
mov qword [rcx + 0x10], rdx
cmp rax, 0
jge 0x14005366f
mov rcx, qword [rsp + 0x30]
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
call fcn.14000e6db
jmp 0x140053748
mov eax, dword [0x1402189b0]
and eax, dword [0x1402189b4]
mov edx, 0xffffffff
xor edx, 0x5eeba3ab
mov ecx, eax
xor ecx, edx
and ecx, eax
mov edx, ecx
xor edx, 0xffffffff
and edx, 0x750d5f9
mov r8d, 0xffffffff
xor r8d, 0x750d5f9
mov eax, ecx
and eax, r8d
imul eax, edx
mov edx, ecx
and edx, 0x750d5f9
or ecx, 0x750d5f9
imul ecx, edx
add ecx, eax
mov eax, ecx
or eax, 0xcf44f11a
xor eax, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xcf44f11a
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
cmp eax, 0x75502018
jb 0x140053752
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x1402189b8]
xor edx, edx
div dword [0x1402189bc]
and eax, 0x59591741
mov edx, 0xc491fbdc
xor edx, 0x6d75dcfe
sub eax, edx
sub eax, 0x56e60c42
add eax, 0xa9e42722
mov r8d, 0x6fbff950
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x30]
mov dword [rsp + 0x2c], eax
call fcn.1400209dc
mov eax, dword [rsp + 0x2c]
cmp eax, 0x2daf97a3
ja 0x1400536ec
jmp 0x140053748
mov rax, qword [rsp + 0x38]
add rsp, 0x58
ret
lodsb al, byte [rsi]
add al, 0xe3
pop rbx
jmp 0x1400536ec
Function at 0x1400548f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x1a0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x108], r8
mov qword [rbp + 0x110], rdx
mov qword [rbp + 0x118], rcx
mov eax, dword [0x140218a40]
xor eax, 0x44d6821
add eax, dword [0x140218a44]
Function at 0x14005cd10
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov ecx, dword [0x140218e50]
mov edx, dword [0x140218e54]
mov r8d, ecx
xor r8d, 0xffffffff
mov eax, edx
and eax, r8d
xor edx, 0xffffffff
and ecx, edx
or eax, ecx
mov ecx, eax
and ecx, 0x751391e2
xor eax, 0x751391e2
or ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0x83eb8dfe
xor edx, 0xf580757a
mov r8d, 0xf2f2a4bf
xor r8d, 0xd0d5b40
xor edx, r8d
and eax, edx
xor ecx, 0xffffffff
mov edx, 0x2d004ca5
xor edx, 0x5b6bb421
mov r8d, 0x6555344b
xor r8d, 0x9aaacbb4
xor edx, r8d
and ecx, edx
or eax, ecx
mov ecx, 0x839c21b1
xor ecx, 0x7c63de4e
xor eax, ecx
mov ecx, 0x11ea440f
xor edx, edx
div ecx
cmp eax, 0xa3480d6d
je 0x14005ce6e
mov eax, dword [0x140218e58]
xor eax, 0xfd11048b
mov ecx, dword [0x140218e5c]
xor edx, edx
div ecx
imul eax, eax, 0xb3a855cf
add eax, 0xa5af3944
mov dword [rbp - 0x18], eax
mov eax, 0x20
call fcn.140215890
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
mov eax, 0x10
call fcn.140215890
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
sub rsp, 0x20
call fcn.14004e61c
mov r8, qword [rbp - 8]
mov rcx, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x20]
add rsp, 0x20
mov rax, qword [rbp - 0x10]
mov r9, qword [r8]
mov qword [rcx], r9
mov r9, qword [r8 + 8]
mov qword [rcx + 8], r9
mov r8, qword [r8 + 0x10]
mov qword [rcx + 0x10], r8
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14005c4ea
add rsp, 0x20
mov cl, al
mov eax, dword [rbp - 0x18]
mov byte [rbp - 0x11], cl
cmp eax, 0xbcd9d8b3
jae 0x14005cdb5
mov al, byte [rbp - 0x11]
and al, 1
movzx eax, al
mov rsp, rbp
pop rbp
ret
push 0xffffffffe9d897fe
invalid