joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a970
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0xffffffffaf6a7303
imul rdx, rdx, 0xffffffff892d7105
add rdx, 0xfffffffffef716c7
mov rcx, rdx
shr rcx, 1
xor rcx, rdx
mov rdx, rcx
rol rdx, 1
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop
mov ecx, dword [0x141dc3020]
imul ecx, dword [0x141dc3024]
and ecx, 0x418829
xor ecx, 0x41658223
or ecx, 0xbe1275d4
cmp ecx, 0xbf9ff887
jb 0x14001a9a0
ret

Function at 0x14001a9d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
add rdx, 0xffffffffc05102f5
xor rdx, 0xffffffff944ed57a
nop word cs:[rax + rax]
mov ecx, dword [0x141dc3028]
sub ecx, dword [0x141dc302c]
xor ecx, 0x9b721442
imul ecx, ecx, 0xd5d2fa8
imul rcx, rcx, 0x3e11bb7
shr rcx, 0x39
cmp ecx, 0xf75ec17a
je 0x14001a9f0
movabs rcx, 0xffffffff4c78fddd
add rdx, rcx
mov rcx, rdx
rol rcx, 2
nop
mov r8d, dword [0x141dc3030]
and r8d, dword [0x141dc3034]
add r8d, 0x9c7519ea
xor r8d, 0x3ea6af75
cmp r8d, 0xb214be62
ja 0x14001aa30
xor ecx, edx
movzx ecx, cx
add rax, rcx
mov ecx, 0xbb389999
nop word cs:[rax + rax]
mov edx, dword [0x141dc3038]
and edx, dword [0x141dc303c]
imul rdx, rcx
shr rdx, 0x3e
imul edx, edx, 0x70f9d754
cmp edx, 0x1f5addbc
je 0x14001aa70
ret

Function at 0x14001aaa0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
shr rax, 6
movabs r8, 0xffffffff35683bdd
xor rax, rdx
sub r8, rax
mov r9, r8
rol r9, 1
xor eax, eax
nop
test al, al
jne 0x14001aac0
nop word cs:[rax + rax]
mov eax, dword [0x141dc3040]
xor edx, edx
div dword [0x141dc3044]
xor eax, 0x44a00414
or eax, 0x3b1d93a3
add eax, 0x751f3625
cmp eax, 0xf94bb7de
ja 0x14001aad0
xor r9d, r8d
movzx eax, r9w
add rcx, rax
mov rax, rcx
ret

Function at 0x14001ab70
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, 0xfffffffff4594856
sub rcx, rdx
imul rcx, rcx, 0x6e31692a
xor rcx, 0xffffffff95e70c76
mov rdx, rcx
rol rdx, 1
nop word cs:[rax + rax]
mov r8d, dword [0x141dc3048]
imul r8d, dword [0x141dc304c]
cmp r8d, 0xd4996107
je 0x14001aba0
xor edx, ecx
movzx ecx, dx
add rax, rcx
mov ecx, dword [0x141dc3050]
xor ecx, dword [0x141dc3054]
xor ecx, 0x1d802215
or ecx, 0xa27b41ea
add ecx, 0x87811904
cmp ecx, 0x5cc0b3ec
jb 0x14001abc0
ret
Function at 0x140039be0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
nop dword [rax]
mov eax, dword [0x141dc5e98]
or eax, dword [0x141dc5e9c]
or eax, 0xbab85643
imul eax, eax, 0x66fd5582
add eax, 0xa9d94722
cmp eax, 0xb537ee9f
ja 0x140039bf0
nop word cs:[rax + rax]
mov eax, dword [0x141dc5ea0]
xor eax, dword [0x141dc5ea4]
or eax, 0x3cdfdfff
cmp eax, 0x6a6832de
je 0x140039c20
cmp rdx, 0x11
jb 0x140039c91
nop
mov eax, dword [0x141dc5ea8]
xor edx, edx
div dword [str.jq21_]
imul rax, rax, 0x2a4419d1
shr rax, 0x3d
or eax, 0x14f95cce
xor eax, 0x64d94d8
cmp eax, 0x6f452f4e
ja 0x140039c40
nop word [rax + rax]
mov eax, dword [0x141dc5eb0]
or eax, dword [0x141dc5eb4]
and eax, 0x62a02241
add eax, 0x3370b81c
cmp eax, 0x5f30bf75
ja 0x140039c70
mov rsi, qword [rsi - 8]
mov eax, dword [0x141dc5eb8]
xor edx, edx
div dword [0x141dc5ebc]
xor eax, 0xf14685e2
imul eax, eax, 0xa697acc8
cmp eax, 0xf4d4350d
ja 0x140039ced
mov eax, dword [0x141dc5ec0]
xor edx, edx
div dword [0x141dc5ec4]
mov edi, eax
add edi, 0x383f0042
or edi, 0x80200410
and edi, 0xc5e4d430
mov rcx, qword [0x141ddc4e0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp edi, 0xc9e9f80c
jbe 0x140039d01
mov rcx, qword [0x141ddc4e0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140039cb1
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14003add0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rcx, qword [rcx]
xor eax, eax
nop
test al, al
jne 0x14003ade0
nop word cs:[rax + rax]
mov eax, dword [0x141dc6180]
imul eax, dword [0x141dc6184]
and eax, 0x21a784df
add eax, 0x3d4cb680
or eax, 0xb7970afe
cmp eax, 0xf50d3ee
jb 0x14003adf0
cmp rcx, 0xffffffffffffffff
je 0x14003b07f
lea r8, [rcx + 1]
nop word cs:[rax + rax]
mov eax, dword [0x141dc6188]
xor eax, dword [0x141dc618c]
imul rax, rax, 0x1c5d813d
shr rax, 0x3c
cmp eax, 0x29e24807
je 0x14003ae30
lea r9, [rcx + rcx]
mov r10d, 8
nop dword [rax + rax]
mov eax, dword [0x141dc6190]
xor edx, edx
div dword [0x141dc6194]
imul eax, eax, 0xae04d28
add eax, 0x48207413
and eax, 0xb7180b70
cmp r9, r8
mov rdi, r8
cmova rdi, r9
cmp rdi, 9
cmovb rdi, r10
cmp eax, 0x20e7246c
ja 0x14003ae60
test rdi, rdi
js 0x14003b07f
mov eax, dword [0x141dc6198]
or eax, dword [0x141dc619c]
xor eax, 0x91075d33
imul eax, eax, 0x57122cbe
cmp eax, 0x14bdf469
jb 0x14003aea0
nop
mov eax, dword [0x141dc61a0]
and eax, dword [0x141dc61a4]
cmp eax, 0xe5a331d5
je 0x14003aec0
nop word cs:[rax + rax]
mov eax, dword [0x141dc61a8]
sub eax, dword [0x141dc61ac]
imul eax, eax, 0x3bb809c7
and eax, 0xd1c88d4d
add eax, 0xa8f544de
cmp eax, 0xd15d60b3
ja 0x14003aee0
test rcx, rcx
je 0x14003af7f
mov rax, qword [rsi + 8]
mov qword [rsp + 0x28], rax
mov eax, dword [0x141dc61b0]
add eax, dword [0x141dc61b4]
imul eax, eax, 0x19d48ad4
cmp eax, 0x3fe6172d
jne 0x14003af2f
mov qword [rsp + 0x38], rcx
xor eax, eax
nop word cs:[rax + rax]
mov qword [rsp + 0x38], rcx
test al, al
jne 0x14003af40
mov eax, 0xd17a21c7
nop
mov ecx, dword [0x141dc61b8]
sub ecx, dword [0x141dc61bc]
add ecx, 0xe1b85951
imul rcx, rax
shr rcx, 0x3e
imul ecx, ecx, 0x1ccef849
cmp ecx, 0x78d08f64
ja 0x14003af50
mov eax, 1
jmp 0x14003af81
xor eax, eax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x28]
mov rdx, rdi
call fcn.140039d10
cmp qword [rsp + 0x40], 0
jne 0x14003b040
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x14003afb0
mov rcx, qword [rsp + 0x48]
mov eax, dword [0x141dc61d0]
imul eax, dword [0x141dc61d4]
imul rax, rax, 0x1dd14771
shr rax, 0x3c
or eax, 0xfae5b58e
imul rdx, rax, 0x2dc1e85
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1c
cmp eax, 0x432fed5d
jne 0x14003aff5
mov qword [rsi + 8], rcx
mov r8d, 0x9b669f55
nop dword [rax + rax]
mov eax, dword [0x141dc61d8]
xor edx, edx
div dword [0x141dc61dc]
imul eax, eax, 0x9cba36c9
imul rax, r8
shr rax, 0x3d
and eax, 0xfffffffe
mov qword [rsi + 8], rcx
cmp eax, 0xd4a92278
je 0x14003b000
mov qword [rsi], rdi
add rsp, 0x58
pop rdi
pop rsi
ret
mov eax, dword [0x141dc61c0]
xor eax, dword [0x141dc61c4]
imul eax, eax, 0x9f847d7
xor eax, 0x59448155
cmp eax, 0xbaddfc45
ja 0x14003b040
nop
mov eax, dword [0x141dc61c8]
mov ecx, dword [0x141dc61cc]
add eax, ecx
add eax, 0x5ee0b0b9
or eax, 0x1c656064
cmp eax, 0x8e0e5833
jb 0x14003b060
ud2
Function at 0x140055760
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r9
mov r14, rdx
mov rbx, rcx
mov rdi, qword [rsp + 0x70]
nop word [rax + rax]
mov eax, dword [0x141dc8d88]
and eax, dword [0x141dc8d8c]
or eax, 0x753352f
xor eax, 0xc0a806
add eax, 0xdcd2f50e
cmp eax, 0xcf3eff94
jb 0x140055780
nop word cs:[rax + rax]
mov eax, dword [0x141dc8d90]
add eax, dword [0x141dc8d94]
imul eax, eax, 0x6d27e793
and eax, 0xf1085c0
cmp eax, 0x87ba6d8d
je 0x1400557b0
cmp r8d, 0x110000
je 0x1400557e9
mov rcx, rbx
mov edx, r8d
call qword [r14 + 0x20]
mov ecx, eax
mov al, 1
test cl, cl
jne 0x140055809
test rsi, rsi
je 0x140055807
mov rax, qword [r14 + 0x18]
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp rax
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14005ece0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
mov r9, rdx
nop word [rax + rax]
mov eax, dword [0x141dca0f0]
or eax, dword [0x141dca0f4]
imul eax, eax, 0xed541bd9
add eax, 0xd6ea47
imul rax, rax, 0x6ec8ee49
shr rax, 0x3e
cmp eax, 0x60103057
ja 0x14005ecf0
test r8, r8
je 0x14005ed83
cmp r8, 1
jne 0x14005ed8a
nop word cs:[rax + rax]
mov eax, dword [0x141dca0f8]
add eax, dword [0x141dca0fc]
and eax, 0x4a3e20e1
or eax, 0x91408c0c
xor eax, 0xcb294a14
cmp eax, 0x33e6c26d
jb 0x14005ed30
movzx eax, byte [r9]
xor edx, edx
nop dword [rax + rax]
test dl, dl
jne 0x14005ed60
mov dl, 1
cmp eax, 0x2b
je 0x14005ef4e
mov r8d, 1
cmp eax, 0x2d
je 0x14005ef4e
jmp 0x14005eef4
xor edx, edx
jmp 0x14005ef4e
cmp byte [r9], 0x2b
jne 0x14005eeea
inc r9
lea rax, [r8 - 1]
nop dword [rax + rax]
mov edx, dword [str.Mv]
imul edx, dword [0x141dca104]
imul edx, edx, 0x2195adc3
xor edx, 0x80c2200
and edx, 0x9c6f2a6b
cmp edx, 0x6a5123bd
ja 0x14005eda0
cmp r8, 0x12
mov r8, rax
jb 0x14005eef4
xor r11d, r11d
mov esi, 0xa
mov edi, 0xefeaaf1f
xor r10d, r10d
nop word cs:[rax + rax]
mov eax, dword [0x141dca108]
and eax, dword [0x141dca10c]
add eax, 0x2c7199b7
or eax, 0x77d7ffe3
cmp eax, 0x486d891
jb 0x14005edf0
test r8, r8
je 0x14005ef44
nop word cs:[rax + rax]
mov ebx, dword [0x141dca110]
or ebx, dword [0x141dca114]
xor ebx, 0x80040014
or ebx, 0x19a9df6b
and ebx, 0x9badff7f
mov rax, r10
mul rsi
seto bpl
cmp ebx, 0x819ab99a
je 0x14005ee20
lea rbx, [r9 + 1]
dec r8
mov edx, dword [0x141dca118]
add edx, dword [0x141dca11c]
xor edx, 0xc8b4e92
add edx, 0x7218e5cc
or edx, 0x570eab7f
cmp edx, 0x4769658b
je 0x14005ee57
movzx r9d, byte [r9]
add r9d, 0xffffffd0
cmp r9d, 9
ja 0x14005ef4c
nop
test r11b, r11b
jne 0x14005ee90
mov dl, 2
test bpl, bpl
jne 0x14005ef4e
mov r9d, r9d
mov r10, rax
add r10, r9
setb al
nop dword [rax]
mov r9d, dword [0x141dca120]
add r9d, dword [0x141dca124]
imul r9, rdi
shr r9, 0x3c
xor r9d, 0x60084
and r9d, 0x6008c
cmp r9d, 0x1252bfae
ja 0x14005eeb0
mov r9, rbx
test al, al
je 0x14005edf0
jmp 0x14005ef4e
cmp r8, 0x11
jae 0x14005edd4
xor r11d, r11d
mov esi, 0xbadfbf9b
xor r10d, r10d
nop
movzx edi, byte [r9 + r11]
add edi, 0xffffffd0
cmp edi, 9
ja 0x14005ef4c
add r10, r10
lea r10, [r10 + r10*4]
mov eax, dword [0x141dca128]
xor edx, edx
div dword [0x141dca12c]
imul eax, eax, 0x224a4e8c
imul rax, rsi
shr rax, 0x3c
cmp eax, 0x20d6b7d6
je 0x14005ef14
mov eax, edi
add r10, rax
inc r11
cmp r8, r11
jne 0x14005ef00
mov qword [rcx + 8], r10
xor eax, eax
jmp 0x14005ef53
mov dl, 1
mov byte [rcx + 1], dl
mov al, 1
mov edx, dword [0x141dca130]
imul edx, dword [0x141dca134]
imul rdx, rdx, 0x3110e72f
shr rdx, 0x3a
or edx, 0xae79f78b
cmp edx, 0x19a82493
je 0x14005ef9b
mov edx, dword [0x141dca138]
or edx, dword [0x141dca13c]
add edx, 0x7a1647d1
or edx, 0x7ef0df2
mov byte [rcx], al
cmp edx, 0x7d6e9d66
jae 0x14005ef9f
mov byte [rcx], al
jmp 0x14005ef79
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14005efb0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r9b, 1
test rdx, rdx
je 0x14005efe2
cmp rdx, 1
jne 0x14005efea
movzx edx, byte [rcx]
mov r8b, 1
cmp edx, 0x2b
je 0x14005f2bd
mov eax, 1
cmp edx, 0x2d
je 0x14005f2bd
jmp 0x14005f070
xor r8d, r8d
jmp 0x14005f2bd
cmp byte [rcx], 0x2b
jne 0x14005f040
inc rcx
nop word cs:[rax + rax]
mov eax, dword [0x141dca158]
imul eax, dword [0x141dca15c]
or eax, 0xa7436b0d
imul eax, eax, 0xbe4abe57
and eax, 0xccdbee2d
cmp eax, 0x14da91cf
je 0x14005f000
lea rax, [rdx - 1]
cmp rdx, 4
mov rdx, rax
jb 0x14005f070
jmp 0x14005f1ad
mov eax, dword [0x141dca150]
and eax, dword [0x141dca154]
or eax, 0x8015a4ae
xor eax, 0x19fcc3b3
cmp eax, 0x83311b14
jb 0x14005f040
mov eax, 2
cmp rdx, 3
jae 0x14005f1ad
nop dword [rax]
mov edx, dword [0x141dca148]
and edx, dword [0x141dca14c]
shr edx, 5
imul rdx, rdx, 0x8b9cd85
shr rdx, 0x36
or edx, 0x38db0dbc
imul edx, edx, 0xf05b6852
cmp edx, 0x8432048a
ja 0x14005f070
xor r8d, r8d
mov edx, 0x806333f5
nop word cs:[rax + rax]
mov r9d, dword [0x141dca178]
mov r10d, dword [0x141dca17c]
lea r11d, [r9 + r10]
add r11d, 0x3d99acf0
and r11d, 0xbc63af84
movzx r10d, byte [rcx]
add r10d, 0xffffffd0
cmp r10d, 0xa
setae r9b
cmp r11d, 0x16e55b9b
ja 0x14005f0b0
cmp r10d, 9
ja 0x14005f2ba
nop word cs:[rax + rax]
mov r11d, dword [0x141dca180]
xor r11d, dword [0x141dca184]
and r11d, 0x4ded346d
imul r11d, r11d, 0x4de37d0c
cmp r11d, 0x4f028b39
je 0x14005f100
movzx r8d, r8b
add r8d, r8d
dec rax
lea r8d, [r8 + r8*4]
nop word cs:[rax + rax]
mov r11d, dword [str.QDs]
and r11d, dword [0x141dca18c]
xor r11d, 0x2dc7cd66
imul r11d, r11d, 0xd6d2fe01
add r11d, 0x48a79078
cmp r11d, 0x59aa1428
jb 0x14005f140
inc rcx
mov r11d, dword [0x141dca190]
and r11d, dword [0x141dca194]
imul r11d, r11d, 0x545ea17d
xor r11d, 0x211ac378
imul r11, rdx
shr r11, 0x3f
cmp r11d, 0x12521788
ja 0x14005f16f
add r8b, r10b
test rax, rax
jne 0x14005f0b0
jmp 0x14005f2bd
xor r8d, r8d
mov r10b, 0xa
nop word cs:[rax + rax]
add rdx, 0xffffffffffffffff
setb r11b
jae 0x14005f279
nop
mov eax, dword [0x141dca160]
add eax, dword [0x141dca164]
imul esi, eax, 0x7dfa8e3d
add esi, 0xfedbd8dc
and esi, 0xb5689257
mov eax, r8d
mul r10b
seto bl
cmp esi, 0xd77911d6
ja 0x14005f1d0
movzx r8d, byte [rcx]
mov esi, dword [0x141dca168]
xor esi, dword [0x141dca16c]
xor esi, 0x4ee3ce0
add esi, 0x6a31b7ff
or esi, 0xddbc1118
cmp esi, 0x91e86c66
je 0x14005f203
add r8d, 0xffffffd0
cmp r8d, 0xa
setae sil
or sil, bl
jne 0x14005f280
inc rcx
mov ebx, eax
add bl, r8b
setb bl
mov esi, dword [0x141dca170]
xor esi, dword [0x141dca174]
add esi, 0xda378305
xor esi, 0x6b572bfb
add esi, 0x199db14c
cmp esi, 0x9ecda1f0
ja 0x14005f245
add r8b, al
test bl, bl
je 0x14005f1c0
mov r8b, 2
mov r9d, r11d
jmp 0x14005f2bd
mov eax, dword [0x141dca140]
and eax, dword [0x141dca144]
add eax, 0x35d4378
imul rcx, rax, 0x44688809
shr rcx, 0x3e
add ecx, 0x823642e7
cmp r8d, 0xa
mov eax, 0
adc al, 1
cmp ecx, 0xf90ca164
ja 0x14005f280
mov r8d, eax
jmp 0x14005f2bd
mov r8b, 1
mov eax, r9d
mov edx, r8d
pop rbx
pop rsi
ret
Function at 0x140062a80
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov rbx, rdx
mov eax, dword [0x141dca800]
imul eax, dword [0x141dca804]
mov rsi, rcx
or eax, 0xd3b4723b
add eax, 0x96492713
cmp eax, 0x49aee7bb
jb 0x140062ae3
mov eax, dword [0x141dca808]
add eax, dword [0x141dca80c]
imul ecx, eax, 0xa178d64a
mov eax, 0x20
call fcn.1400f07c0
sub rsp, rax
mov rdi, rsp
cmp ecx, 0xe9b648f4
jne 0x140062af2
mov eax, 0x20
call fcn.1400f07c0
sub rsp, rax
jmp 0x140062ab9
cmp qword [rsi], 0
je 0x140062ba0
mov r12, qword [rsi + 8]
mov r8, qword [rbx]
mov r14, qword [rbx + 8]
mov r15, qword [rbx + 0x10]
mov r13, qword [rbx + 0x18]
mov qword [rdi], r8
mov qword [rdi + 8], r14
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r13
mov ebx, dword [rsi + 0x30]
movzx ecx, byte [rsi + 0x38]
test byte [rsi + 0x34], 8
mov dword [rbp - 0xc], ebx
mov byte [rbp + 7], cl
je 0x140062c0d
mov rcx, qword [rsi + 0x20]
mov eax, dword [0x141dca820]
xor r9d, r9d
xor edx, edx
div dword [0x141dca824]
nop word [rax + rax]
test r9b, r9b
jne 0x140062b50
mov rax, qword [rsi + 0x28]
sub rsp, 0x20
mov rdx, r8
mov r8, r14
call qword [rax + 0x18]
add rsp, 0x20
test al, al
jne 0x140063060
mov qword [rdi], 1
mov qword [rdi + 8], 0
xor eax, eax
mov rcx, r12
sub rcx, r14
mov r12d, 0
cmovae r12, rcx
mov dword [rsi + 0x30], 0x30
test al, al
je 0x140062bcf
jmp 0x140062c00
mov rdi, qword [rsi + 0x20]
mov eax, dword [0x141dca810]
add eax, dword [0x141dca814]
mov rsi, qword [rsi + 0x28]
imul eax, eax, 0xb2d1b11a
add eax, 0x5e43bf5f
cmp eax, 0x529ee3a3
jae 0x1400631ea
jmp 0x140063227
mov eax, dword [0x141dca880]
xor edx, edx
div dword [0x141dca884]
xor r14d, r14d
xor eax, 0x60b3b096
imul rax, rax, 0x660e569
shr rax, 0x3a
add eax, 0x65db4737
mov byte [rsi + 0x38], 1
cmp eax, 0xab98d7c1
jb 0x140062c06
mov byte [rsi + 0x38], 1
jmp 0x140062bcf
mov cl, 1
mov ebx, 0x30
test r13, r13
je 0x140062e6e
lea rax, [r13*2]
add rax, r13
lea r8, [r15 + rax*8]
mov r9d, 0xb871e837
jmp 0x140062c40
mov eax, dword [0x141dca8f0]
xor eax, dword [0x141dca8f4]
or eax, 0x22f125b
add eax, 0x428f654b
imul rax, rax, 0x24f6933b
shr rax, 0x38
cmp eax, 0x809b9e4d
je 0x140063060
nop dword [rax + rax]
mov eax, dword [0x141dca8f8]
sub eax, dword [0x141dca8fc]
add eax, 0x915bc15d
or eax, 0x60481200
and eax, 0xfacd5a44
cmp eax, 0xe21bd75b
ja 0x140063090
mov al, 1
jmp 0x140063240
mov eax, dword [0x141dca818]
xor eax, dword [0x141dca81c]
imul r14, rax, 0x4650594f
shr r14, 0x3e
or r14d, 0x54ad12d8
sub rsp, 0x20
mov rcx, rdi
mov rdx, rsi
mov r8, rbx
call fcn.140063280
add rsp, 0x20
cmp r14d, 0x59df22f1
jbe 0x140063240
sub rsp, 0x20
mov rcx, rdi
mov rdx, rsi
mov r8, rbx
call fcn.140063280
add rsp, 0x20
jmp 0x1400631ea
Function at 0x14006f630
Capabilities:
Encode data using xor

Disassembly:
vmovq xmm0, r9
vmovq xmm1, qword [rsp + 0x28]
vpunpcklqdq xmm0, xmm1, xmm0
nop
mov eax, dword [0x141dcbab0]
add eax, dword [0x141dcbab4]
xor eax, 0x67094e77
add eax, 0xe188027b
xor eax, 0xe8347b2e
cmp eax, 0x51cf7892
jb 0x14006f640
vextractf128 xmm1, ymm0, 1
vpinsrq xmm1, xmm1, r8, 0
vinsertf128 ymm0, ymm0, xmm1, 1
nop word cs:[rax + rax]
mov eax, dword [0x141dcbab8]
or eax, dword [0x141dcbabc]
add eax, 0xf3a1b61d
cmp eax, 0x32a4733b
jb 0x14006f680
mov eax, dword [0x141dcbac0]
xor eax, dword [0x141dcbac4]
xor eax, 0xac0d351a
imul eax, eax, 0xbaffcc31
add eax, 0xc6207c22
vextractf128 xmm1, ymm0, 1
cmp eax, 0x40b9d095
jb 0x14006f6f9
mov eax, dword [0x141dcbac8]
and eax, dword [0x141dcbacc]
mov r8d, 0xc4781949
imul r8, rax
shr r8, 0x3d
vpinsrq xmm2, xmm1, rdx, 1
imul eax, r8d, 0x6064ce43
vinsertf128 ymm2, ymm0, xmm2, 1
vmovaps ymmword [rcx], ymm2
cmp eax, 0x61e28622
jbe 0x14006f70b
vpinsrq xmm2, xmm1, rdx, 1
vinsertf128 ymm2, ymm0, xmm2, 1
vmovaps ymmword [rcx], ymm2
jmp 0x14006f6c1
vzeroupper
ret

Function at 0x14006f750
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x141dcbad8]
xor edx, edx
div dword [0x141dcbadc]
nop word cs:[rax + rax]
mov eax, dword [0x141dcbae0]
xor eax, dword [0x141dcbae4]
or eax, 0x16ebcc51
add eax, 0xe131b396
cmp eax, 0x47d82db5
jb 0x14006f770
vmovaps ymm0, ymmword [r8]
mov eax, dword [0x141dcbae8]
sub eax, dword [0x141dcbaec]
xor eax, 0x375b343b
imul eax, eax, 0x25b42340
add eax, 0x37b8c5bd
cmp eax, 0x2b1f74b2
jbe 0x14006f7c0
vmovaps xmmword [rcx], xmm0
nop dword [rax]
mov eax, dword [0x141dcbaf0]
and eax, dword [0x141dcbaf4]
imul eax, eax, 0x1f28ecdb
imul rax, rax, 0x5a703073
shr rax, 0x3e
or eax, 0x495ea9c8
vmovaps xmmword [rcx], xmm0
cmp eax, 0x82eb37fb
ja 0x14006f7c0
mov eax, 0xde588621
nop word cs:[rax + rax]
mov ecx, dword [0x141dcbaf8]
or ecx, dword [0x141dcbafc]
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0xf87c9ee6
je 0x14006f800
vzeroupper
ret

Function at 0x14006f820
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x141dcbb00]
or eax, dword [0x141dcbb04]
imul eax, eax, 0x3c56b83b
imul rax, rax, 0x63eafac3
shr rax, 0x3e
imul eax, eax, 0x40135a0d
vbroadcastss ymm0, dword [rdx]
cmp eax, 0x2101ddcb
jae 0x14006f853
vmovaps ymmword [rcx], ymm0
mov eax, 0x83d14a43
nop dword [rax + rax]
mov edx, dword [0x141dcbb08]
xor edx, dword [0x141dcbb0c]
imul edx, edx, 0x318f9dcc
imul rdx, rax
shr rdx, 0x3f
or edx, 0xa55a571c
vmovaps ymmword [rcx], ymm0
cmp edx, 0x4cfa7a9e
jb 0x14006f860
nop dword [rax]
mov eax, dword [0x141dcbb10]
xor eax, dword [0x141dcbb14]
add eax, 0x47a16165
and eax, 0x9fe7b935
add eax, 0x52cea9cd
cmp eax, 0xdd8d3fd8
ja 0x14006f890
vzeroupper
ret
Function at 0x14006f8c0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x14006f8d0
vmovdqa ymm0, ymmword [rdx]
nop dword [rax + rax]
mov eax, dword [0x141dcbb18]
and eax, dword [0x141dcbb1c]
and eax, 0x6d75f9d1
imul eax, eax, 0x5bafcadc
xor eax, 0x40f24758
cmp eax, 0x6fd25bee
ja 0x14006f8e0
mov eax, dword [0x141dcbb20]
imul eax, dword [0x141dcbb24]
or eax, 0x3a7414e4
vpaddq ymm0, ymm0, ymmword [r8]
cmp eax, 0xd58a665a
jne 0x14006f930
vmovdqa ymmword [rcx], ymm0
nop word cs:[rax + rax]
mov eax, dword [0x141dcbb28]
xor eax, dword [0x141dcbb2c]
shr eax, 3
imul rax, rax, 0x2976cdc5
shr rax, 0x37
or eax, 0xdfcc652e
imul rax, rax, 0x5f79b059
shr rax, 0x3a
vmovdqa ymmword [rcx], ymm0
cmp eax, 0x32cab82c
je 0x14006f930
vzeroupper
ret

Function at 0x14006f9f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x141dcbb40]
and eax, dword [0x141dcbb44]
and eax, 0x885ef527
vpermpd ymm0, ymmword [rdx], 0x29
cmp eax, 0x36ff8b25
jne 0x14006fa20
vmovaps ymmword [rcx], ymm0
nop word cs:[rax + rax]
mov eax, dword [0x141dcbb48]
xor eax, dword [0x141dcbb4c]
xor eax, 0x50baeff
imul eax, eax, 0x8d0e3508
xor eax, 0xd8dc3b3b
vmovaps ymmword [rcx], ymm0
cmp eax, 0x4c6372e8
jb 0x14006fa20
nop word [rax + rax]
mov eax, dword [0x141dcbb50]
mov ecx, dword [0x141dcbb54]
add eax, ecx
add eax, 0x75b413d1
and eax, 0x984d3d32
cmp eax, 0xe8e29b89
je 0x14006fa50
vzeroupper
ret

Function at 0x14006faf0
Capabilities:
Encode data using xor

Disassembly:
vpermpd ymm0, ymmword [rdx], 1
vmovaps ymmword [rcx], ymm0
nop word [rax + rax]
mov eax, dword [0x141dcbb68]
xor eax, dword [0x141dcbb6c]
and eax, 0x91401080
add eax, 0x5863b226
cmp eax, 0x1ffe9d5c
jb 0x14006fb00
vzeroupper
ret
Function at 0x140071360
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x90
lea rbp, [rsp + 0x80]
and rsp, 0xffffffffffffffe0
mov r8, rdx
mov r9, qword [rcx + 0x220]
mov eax, 0xedf7b751
nop word cs:[rax + rax]
mov edx, dword [0x141dcbca8]
xor edx, dword [0x141dcbcac]
imul rdx, rax
shr rdx, 0x3e
or edx, 0xcf5008b8
cmp edx, 0x64371b7e
je 0x140071390
cmp r9, 3
ja 0x14007157e
lea r10, [rcx + 0x1e0]
mov eax, dword [0x141dcbcb0]
xor edx, edx
div dword [0x141dcbcb4]
or eax, 0x23802fc0
shr eax, 6
imul rax, rax, 0x5120845
shr rax, 0x34
cmp eax, 0x1c7d8025
jne 0x1400713fd
mov rax, r9
shl rax, 4
vmovups xmm0, xmmword [r8]
vmovups xmmword [r10 + rax], xmm0
shl r9, 4
nop word cs:[rax + rax]
mov eax, dword [0x141dcbcb8]
xor eax, dword [str.I__kT_b_]
and eax, 0x9081081
add eax, 0x3a49ce65
vmovups xmm0, xmmword [r8]
vmovups xmmword [r10 + r9], xmm0
cmp eax, 0xaaf90b68
ja 0x140071410
mov rax, qword [rcx + 0x220]
cmp rax, 3
jae 0x140071486
inc rax
xor edx, edx
nop word [rax + rax]
test dl, dl
jne 0x140071450
mov qword [rcx + 0x220], rax
nop dword [rax + rax]
mov eax, dword [0x141dcbcd8]
add eax, dword [0x141dcbcdc]
or eax, 0x68
xor eax, 0x40204000
and eax, 0x762340e8
cmp eax, 0x7bed96e0
ja 0x140071460
lea rsp, [rbp + 0x10]
pop rbp
ret
mov eax, dword [0x141dcbcc8]
xor edx, edx
div dword [0x141dcbccc]
imul eax, eax, 0x3cc44dda
add eax, 0xd70074a2
cmp eax, 0xbbbf8640
jae 0x1400714b1
mov qword [rcx + 0x220], 0
mov eax, 0xcf139163
nop word cs:[rax + rax]
mov edx, dword [0x141dcbcd0]
sub edx, dword [0x141dcbcd4]
add edx, 0x32f0b28c
imul rdx, rax
shr rdx, 0x3f
mov qword [rcx + 0x220], 0
cmp edx, 0x949d29f9
je 0x1400714c0
vmovdqa ymm0, ymmword [rcx + 0x1e0]
vmovdqa ymm1, ymmword [rcx + 0x200]
vpunpckhqdq ymm2, ymm0, ymm1
vpermq ymm2, ymm2, 0xd8
vpunpcklqdq ymm0, ymm0, ymm1
vpermq ymm0, ymm0, 0xd8
vpbroadcastd ymm1, dword [0x140103c80]
vpsrlq ymm3, ymm2, 0x28
vpor ymm1, ymm3, ymm1
vpsrlq ymm3, ymm0, 0x2e
vpsllq ymm2, ymm2, 0x12
vpor ymm3, ymm2, ymm3
vpsrlq ymm4, ymm0, 0x1a
vpbroadcastq ymm5, qword [0x140103c88]
vpblendd ymm2, ymm4, ymm2, 0xaa
vpand ymm2, ymm2, ymm5
vpsllq ymm3, ymm3, 0x1a
vpblendd ymm0, ymm0, ymm3, 0xaa
vpand ymm0, ymm0, ymm5
vmovdqa ymmword [rsp + 0x20], ymm0
vmovdqa ymmword [rsp + 0x40], ymm2
vmovdqa ymmword [rsp + 0x60], ymm1
lea rdx, [rsp + 0x20]
vzeroupper
call fcn.1400715b0
nop
lea rsp, [rbp + 0x10]
pop rbp
ret
ud2