joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14017d670
Capabilities:
Encode data using xor

Disassembly:
push rax
mov word [rsp + 6], cx
mov ax, 0xe93b
xor ax, 0xe83b
cmp cx, ax
jae 0x14017d6a4
mov ax, word [rsp + 6]
movzx eax, ax
mov ecx, eax
lea rax, [0x14028ab20]
mov al, byte [rax + rcx]
mov byte [rsp + 5], al
jmp 0x14017d7ef
mov ax, word [rsp + 6]
mov cx, 0xbb20
xor cx, 0x44df
cmp ax, cx
jle 0x14017d6e8
mov ax, word [rsp + 6]
shr ax, 7
movzx eax, ax
mov ecx, eax
lea rax, [0x14028ab20]
mov al, byte [rax + rcx]
mov cl, al
and cl, 0xe
shl cl, 1
xor al, 0xe
add al, cl
mov byte [rsp + 5], al
jmp 0x14017d7ef
mov eax, dword [0x14027c700]
mov r8d, dword [0x14027c704]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
mov r9d, 0xc4ed07c3
xor r9d, 0x3b12f83c
xor ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x89348df9
xor edx, edx
div ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x79becb5
mov ecx, 0xffffffff
xor ecx, 0x87066a33
or eax, edx
or ecx, 0x87066a33
xor eax, 0xffffffff
and eax, ecx
and eax, 0xee8c47e8
cmp eax, 0x684f89ea
ja 0x14017d8de
mov ecx, dword [0x14027c708]
mov eax, dword [0x14027c70c]
xor eax, 0x4f993889
xor ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x3ca371f6
mov edx, 0xffffffff
xor edx, 0x3ca371f6
and ecx, edx
or eax, ecx
mov ecx, 0x5cee090d
xor edx, edx
div ecx
mov ecx, 0xd56abd92
xor edx, edx
div ecx
mov dx, word [rsp + 6]
mov cx, 0x4a45
xor cx, 0x4a4b
shr dx, cl
mov cx, dx
movzx ecx, cx
mov edx, ecx
lea rcx, [0x14028ab20]
mov cl, byte [rcx + rdx]
mov dl, cl
and dl, 0x1c
shl dl, 1
xor cl, 0x1c
add cl, dl
mov byte [rsp + 4], cl
cmp eax, 0xb6d8c1d1
je 0x14017d8de
mov al, byte [rsp + 4]
mov byte [rsp + 5], al
jmp 0x14017d7ef
mov al, byte [rsp + 5]
mov byte [rsp + 3], al
mov r8d, dword [0x14027c710]
and r8d, dword [0x14027c714]
add r8d, 0x2f9adc8d
mov eax, r8d
add eax, 1
mov ecx, 0x273f06aa
xor ecx, 0xd8c0f955
xor r8d, ecx
or r8d, 0x2700ab6e
add r8d, eax
mov eax, 0xa5771cf3
xor eax, 0x5a88e30c
mov ecx, r8d
xor ecx, eax
mov eax, 0xfea9feec
xor eax, 0xf5dd6391
and eax, ecx
mov edx, 0x529e6be4
xor edx, 0x59eaf699
mov ecx, 0x2514923b
xor ecx, 0xdaeb6dc4
xor edx, ecx
and r8d, edx
mov ecx, 0xffffffff
xor ecx, 0x190bbbff
or ebx, dword [rcx]
and ecx, 0xb749d7d
and edx, 0x190bbbff
or eax, r8d
or ecx, edx
xor eax, ecx
mov ecx, 0xc33022e3
xor ecx, 0xb079249e
cmp eax, ecx
jae 0x14017d8e7
mov cl, byte [rsp + 3]
mov eax, dword [0x14027c718]
imul eax, dword [0x14027c71c]
mov r8d, 0x34c064f1
xor edx, edx
div r8d
mov r8d, 0x17ce77e1
xor edx, edx
div r8d
mov edx, 0x20152b69
xor edx, 0x627af6db
imul eax, edx
movzx ecx, cl
mov word [rsp], cx
cmp eax, 0xf3646ca1
jae 0x14017d891
mov ax, word [rsp]
pop rcx
ret
je 0x14017d869
sub dword [rbx - 0x18117], esi
invalid
in al, dx
add al, 0xd3
jmp 0x14017d891
Function at 0x14017d8f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x70
mov qword [rsp + 0x38], r9
mov dword [rsp + 0x44], r8d
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rdx, qword [rsp + 0x48]
mov rcx, rax
mov rax, qword [rsp + 0x50]
add rcx, 0x60
mov qword [rsp + 0x58], rcx
mov rcx, qword [rdx]
mov qword [rsp + 0x60], rcx
mov rax, qword [rax]
xor edx, edx
mov r8d, edx
sub r8, 8
mov rdx, rax
sub rdx, r8
cmp rcx, rdx
mov qword [rsp + 0x68], rax
jge 0x14017d985
mov rcx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x60]
mov rax, r8
shl rax, 1
mov edx, 8
cmp r8, 3
cmovg rdx, rax
call fcn.14002bfc0
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x30], rcx
mov al, byte [rax]
mov cl, 0x72
xor cl, 0x72
cmp al, cl
jne 0x14017db0c
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov r8d, dword [rsp + 0x44]
mov r9, qword [rsp + 0x48]
mov r9, qword [r9 + 8]
mov qword [rsp + 0x28], r9
mov r9d, dword [r9 + rdx + 8]
mov r8d, r8d
mov r10d, r8d
mov r8, 0xffffffffffffffff
shl r8, cl
mov rcx, qword [rsp + 0x50]
xor r8, 0xffffffffffffffff
and r8, r10
mov r9d, r9d
mov r10, rcx
add r10, 8
mov qword [rsp + 0x20], r10
mov rcx, qword [rcx + 8]
shl r8, cl
mov rcx, qword [rsp + 0x28]
or r8, r9
mov qword [rcx + rdx + 8], r8
cmp byte [rax], 0
jne 0x14017db0c
mov eax, dword [0x14027c720]
imul eax, dword [0x14027c724]
mov ecx, 0x89348df9
xor edx, edx
div ecx
mov ecx, eax
and ecx, 0x79becb5
mov edx, 0xffffffff
xor edx, 0xee8c47e8
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0x684f89ea
ja 0x14017db83
mov rcx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x50]
mov edx, dword [0x14027c728]
xor edx, dword [0x14027c72c]
mov eax, edx
xor eax, 0xffffffff
and eax, 0x3ca371f6
mov r9d, 0xffffffff
xor r9d, 0x3ca371f6
and edx, r9d
or eax, edx
mov r9d, 0xf948146b
xor r9d, 0xa5a61d66
xor edx, edx
div r9d
mov r9d, 0xd56abd92
xor edx, edx
div r9d
mov rdx, qword [rsp + 0x38]
add rdx, qword [rcx]
movabs rcx, 0x72e9d2e73c503548
movabs r9, 0x72e9d2e73c50354b
xor rcx, r9
mov r9, rdx
sar r9, cl
mov rcx, qword [rsp + 0x20]
mov r10, qword [r8]
movabs r11, 0xe87fdec3d1bd07b4
movabs rsi, 0xc24015cb18974517
xor r11, rsi
add r9, r11
add r9, r10
movabs r10, 0x2a3fcb08c92a42a3
sub r9, r10
mov qword [r8], r9
and rdx, 7
mov qword [rcx], rdx
cmp eax, 0xb6d8c1d1
je 0x14017db83
jmp 0x14017db0c
mov eax, dword [0x14027c730]
xor eax, 0xadd28dd0
and eax, dword [str.meED]
add eax, 0x2f9adc8d
mov ecx, 0xf5601527
xor ecx, 0xd260be49
and eax, ecx
mov ecx, 0xcec88b91
xor ecx, 0xd7c3306e
xor eax, ecx
cmp eax, 0x7349067d
jae 0x14017db8c
invalid
mov eax, dword [0x14027c738]
imul eax, dword [0x14027c73c]
mov ecx, 0x131c5fcb
xor ecx, 0x27dc3b3a
xor edx, edx
div ecx
mov ecx, 0x17ce77e1
xor edx, edx
div ecx
imul eax, eax, 0x426fddb2
cmp eax, 0xf3646ca1
jae 0x14017db47
add rsp, 0x70
pop rsi
ret
je 0x14017db0e
sub dword [rbx - 0x13f17], esi
invalid
in al, dx
add al, 0xd3
jmp 0x14017db47
Function at 0x14017dba0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov eax, dword [0x14027c740]
mov ecx, dword [0x14027c744]
xor ecx, 0xddd3870c
or eax, ecx
or eax, 0x9b9bf5c4
and eax, 0x7e1b1917
mov edx, 0xb07e822a
xor edx, 0xb07e822b
mov ecx, eax
add ecx, edx
xor eax, 0xffffffff
or eax, 0x40d22219
add eax, ecx
mov ecx, 0x8df2d28b
xor ecx, 0x97e71b98
cmp eax, ecx
jae 0x14017dca4
mov eax, dword [0x14027c748]
xor eax, 0xd947ed5c
sub eax, dword [0x14027c74c]
or eax, 0x21e5f36d
mov ecx, eax
and ecx, 0x905e44e1
mov edx, 0xc76b386d
xor edx, 0x3894c792
xor ecx, edx
add eax, 0x905e44e1
add eax, 1
add eax, ecx
mov ecx, 0xdd46fe19
xor ecx, 0xf2ad901e
sub eax, ecx
mov dword [rsp + 0x2c], eax
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x2c]
mov rdx, rcx
add rdx, 8
mov qword [rsp + 0x30], rdx
cmp qword [rcx + 8], 0
setg cl
mov byte [rsp + 0x3f], cl
cmp eax, 0x30d023b
jbe 0x14017dbf3
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x14017dc84
jmp 0x14017dc9f
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
add rdx, 1
mov qword [rcx], rdx
mov qword [rax], 0
add rsp, 0x48
ret
ror cl, 1
xor edi, dword [rbx - 0x17]
invalid
Function at 0x140185cc0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, qword [rsp + 0x40]
cmp rcx, 0
je 0x140185eb5
mov rax, qword [rsp + 0x40]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x30], rcx
mov rax, qword [rax - 0x10]
mov qword [rsp + 0x38], rax
movabs rcx, 0xaaff4190ef652d2f
movabs rdx, 0xaaff4190ef652d3f
xor rcx, rdx
cmp rax, rcx
jb 0x140185e94
mov rdx, qword [rsp + 0x38]
movabs rcx, 0x79fafc58f195c41c
movabs rax, 0x79fafc58f195c41c
xor rcx, rax
movabs rax, 0x4c632dad345866fe
movabs r8, 0xb39cd252cba7990e
xor rax, r8
sub rcx, rax
mov rax, rdx
sub rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, rdx
movabs rdx, 0x97b5204f3a5bf441
movabs r8, 0x97b5204f3a5bf441
xor rdx, r8
cmp rcx, rdx
setl dl
cmp rax, 0xffffffffffffffff
setg al
xor al, 0xff
xor dl, 0xff
mov cl, 1
xor cl, 1
or al, dl
or cl, 1
xor edx, edx
xor dl, 1
xor al, dl
and al, cl
test al, 1
jne 0x140185db0
jmp 0x140185dba
call fcn.14000f24b
jmp 0x140185eb5
mov eax, dword [0x14027cb68]
imul eax, dword [0x14027cb6c]
mov ecx, 0xd1e69557
xor ecx, 0xd1e69557
mov edx, 0xe92e9b2c
xor edx, 0xde8b2df3
sub ecx, edx
add eax, ecx
mov ecx, 0x8dfb82b6
xor edx, edx
div ecx
imul eax, eax, 0x82144f08
cmp eax, 0xd7440a5d
je 0x140185ebb
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x14027cb70]
xor edx, edx
div dword [0x14027cb74]
mov rdx, qword [rsp + 0x30]
mov r8d, eax
mov rax, qword [rsp + 0x40]
imul r8d, r8d, 0xf4ef2fcf
add r8d, 0x124094f6
xor r9d, r9d
sub r9d, r8d
mov r8d, 0xd838bc22
xor r8d, 0xd838bc22
mov r10d, 0x1468db94
xor r10d, 0xd2ca849f
sub r8d, r10d
add r9d, r8d
xor r8d, r8d
sub r8d, r9d
mov dword [rsp + 0x24], r8d
mov r8d, 0x8ba611a
xor r8d, 0xe025cc4c
mov dword [rsp + 0x20], r8d
mov qword [rdx], rcx
mov r8, qword [rax]
mov cl, 1
xor cl, 1
and cl, 1
call fcn.1400200e0
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
ja 0x140185dfb
jmp 0x140185eb5
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rax]
mov ecx, 1
call fcn.1400200e0
mov rcx, qword [rsp + 0x40]
call fcn.140020296
nop
add rsp, 0x48
ret
sti
cwde
sub bl, byte [rsi]
jmp 0x140185dfb
Function at 0x1401874f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x12a8
call fcn.140271bb0
sub rsp, rax
Function at 0x14019bbc3
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
and r8b, 1
add rsp, 0x28
jmp fcn.140028560
Function at 0x1401df1ad
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140028560

Function at 0x1401fba5c
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
and r8b, 1
add rsp, 0x28
jmp fcn.140028560

Function at 0x1401fd8f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
mov eax, dword [0x14027edc0]
mov ecx, 0x90fa6735
xor ecx, 0xbffd34a4
xor eax, ecx
mov edx, dword [0x14027edc4]
mov ecx, 0x570e7c26
xor ecx, 0xb842cd46
xor edx, ecx
mov ecx, 0x1db41fd8
xor ecx, 0x1db41fd8
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov edx, 0xffffffff
xor edx, 0xd830980b
mov ecx, eax
xor ecx, edx
and ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0xa1b8e819
mov edx, 0xffffffff
xor edx, 0xa1b8e819
and ecx, edx
or eax, ecx
mov edx, 0xffffffff
xor edx, 0x4f2a9df4
mov ecx, eax
and ecx, edx
mov r8d, 0xdffadd89
xor r8d, 0x90d0407d
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
mov ecx, 0x779708cf
xor ecx, 0x7d5bb5d0
cmp eax, ecx
jbe 0x1401fdb21
mov r8d, dword [0x14027edc8]
xor r8d, 0xd4555aaa
mov edx, dword [0x14027edcc]
mov eax, 0xfaebf4d3
xor eax, 0x5140b2c
mov ecx, r8d
xor ecx, eax
mov eax, 0x40ceda71
xor eax, 0x3e33f0ac
and eax, ecx
mov r9d, 0xe34c8b78
xor r9d, 0x9db1a1a5
mov ecx, 0x5d61401c
xor ecx, 0xa29ebfe3
xor r9d, ecx
and r8d, r9d
mov r10d, 0xa807379a
xor r10d, 0x57f8c865
mov ecx, edx
xor ecx, r10d
and ecx, 0x7efd2add
and edx, r9d
or eax, r8d
or ecx, edx
xor eax, ecx
xor eax, 0xa15c1db3
xor eax, 0xeadaff61
mov ecx, 0xdb2cc23
xor ecx, 0x1b8ef15d
xor eax, ecx
mov dword [rsp + 0x3c], eax
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, qword [rsp + 0x50]
mov rdx, rax
mov eax, dword [rsp + 0x3c]
add rdx, 0x60
mov qword [rsp + 0x40], rdx
cmp rcx, 0
sete cl
mov byte [rsp + 0x4f], cl
cmp eax, 0xae0d10ad
jbe 0x1401fd998
mov al, byte [rsp + 0x4f]
test al, 1
jne 0x1401fdb1b
jmp 0x1401fda6c
mov rax, qword [rsp + 0x50]
xor ecx, ecx
sub rcx, rax
xor eax, eax
sub rax, 0xfffffffffffffff0
add rcx, rax
xor eax, eax
sub rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
cmp rax, 0x10
jb 0x1401fdaf4
mov rdx, qword [rsp + 0x30]
mov rax, rdx
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x20], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl dl
cmp rax, 0xffffffffffffffff
setg al
mov cl, al
xor cl, dl
xor cl, 0xff
or al, dl
and al, cl
test al, 1
jne 0x1401fdad8
jmp 0x1401fdae2
call fcn.14000f24b
jmp 0x1401fdb1b
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
jmp 0x1401fdb1b
mov rcx, qword [rsp + 0x50]
call fcn.1401fd6a0
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x1401fdb1b
mov rcx, qword [rsp + 0x50]
mov edx, 8
call fcn.14001d294
nop
add rsp, 0x58
ret
ret 0x8d18
Function at 0x14020e49f
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140028560

Function at 0x140216802
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140028560
Function at 0x140223680
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov r8d, dword [0x14027f368]
mov edx, dword [0x14027f36c]
mov eax, r8d
xor eax, 0xffffffff
and eax, 0x121e226a
mov r9d, 0xffffffff
xor r9d, 0x121e226a
and r8d, r9d
mov ecx, edx
xor ecx, 0xffffffff
and ecx, 0x121e226a
and edx, r9d
or eax, r8d
or ecx, edx
xor eax, ecx
sub eax, 0xe7730723
mov ecx, 0x26a151ff
xor ecx, 0x6b65a06c
xor edx, edx
div ecx
mov r8d, 0xffffffff
xor r8d, 0x2abc8334
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x2abc8334
or eax, 0x2abc8334
imul eax, edx
add eax, ecx
cmp eax, 0x7947f802
ja 0x140223794
mov eax, dword [0x14027f370]
xor eax, dword [0x14027f374]
mov ecx, 0xa279d4c4
xor ecx, 0xf63890c1
or eax, ecx
add eax, 0x557904ef
sub eax, 0x8fdfdfcf
mov ecx, 0xad53639
xor ecx, 0x5fac32d6
sub eax, ecx
mov ecx, 0x376dc538
xor edx, edx
div ecx
mov dword [rsp + 0x24], eax
mov eax, 0x814e33d9
xor eax, 0xcc2a2453
mov dword [rsp + 0x20], eax
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor r8d, r8d
call fcn.140028560
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
jae 0x14022370f
add rsp, 0x28
ret
jae 0x1402237ef
adc esp, dword [0x14021aa85]
dec dword [rdi]
invalid
invalid
Function at 0x1402302b0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140028560
Function at 0x140234540
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x90
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x20], rcx
mov eax, 0x10
mov qword [rbp - 0x40], rax
call fcn.140271bb0
sub rsp, rax
mov rax, qword [rbp - 0x40]
mov rcx, rsp
mov qword [rbp - 0x38], rcx
call fcn.140271bb0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
Function at 0x1402371d6
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140028560
Function at 0x14023ccc3
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rcx
mov rax, qword [rdx]
mov qword [rsp + 0x60], rax
cmp rax, 0
jle 0x14023cf95
mov rcx, qword [rsp + 0x60]
movabs rax, 0xb54d5776d5ac1e44
movabs rdx, 0xb54d5776d5ac1e45
xor rax, rdx
mov rdx, rcx
add rdx, rax
mov qword [rsp + 0x48], rdx
movabs r8, 0xc9df9f1c9c1571e
movabs rax, 0xf362060e363ea8e1
xor r8, rax
mov rax, rcx
xor rax, r8
movabs r8, 0x6316d9bc42c94b92
movabs r9, 0x9ce92643bd36b46d
xor r8, r9
xor rax, r8
and rax, 0xffffffffffffffff
shl rax, 1
movabs r8, 0xa4b7ffb824c2d9ed
movabs r9, 0x5b480047db3d2612
xor r8, r9
sub rax, r8
sub rcx, rax
mov rax, rdx
xor rax, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
and rax, rdx
or rcx, rcx
xor rcx, 0xffffffffffffffff
xor rax, 0xffffffffffffffff
movabs rdx, 0xd4693c692abf1075
movabs r8, 0x2b96c396d540ef8a
xor rdx, r8
xor rcx, rdx
and rax, rcx
movabs rcx, 0x1f06557694487ec4
movabs rdx, 0x1f06557694487ec4
xor rcx, rdx
cmp rax, rcx
jge 0x14023cdc6
call fcn.14000f24b
jmp 0x14023cf95
mov rax, qword [rsp + 0x48]
cmp rax, 0
jge 0x14023cdf2
mov rcx, qword [rsp + 0x48]
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
call fcn.14001a720
jmp 0x14023cf95
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdx + 8]
add rcx, 8
add rcx, qword [rdx]
mov qword [rsp + 0x30], rcx
mov rax, qword [rax + 8]
add rax, 8
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov r8b, byte [r8 + rcx]
mov byte [rax + rcx], r8b
mov r8, rcx
and r8, 1
shl r8, 1
movabs r9, 0xaed6b428a9360b17
movabs rax, 0xaed6b428a9360b16
xor r9, rax
mov rax, rcx
xor rax, r9
add rax, r8
cmp rcx, rdx
mov qword [rsp + 0x40], rax
jne 0x14023ce20
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov r8, qword [rcx]
mov r9, qword [rax]
mov rdx, r9
add rdx, r8
mov qword [rsp + 0x28], rdx
mov rax, rdx
xor rax, 0xffffffffffffffff
mov rcx, rdx
xor rcx, 0xffffffffffffffff
and rax, rcx
movabs r10, 0x923a91c0bc45edfa
movabs rcx, 0x6dc56e3f43ba1205
xor r10, rcx
mov rcx, r8
xor rcx, r10
mov r10, r8
xor r10, 0xffffffffffffffff
and rcx, r10
or rax, rcx
xor rax, 0xffffffffffffffff
mov rcx, rdx
or rcx, r8
xor rcx, 0xffffffffffffffff
xor rax, 0xffffffffffffffff
movabs r8, 0x70d81a9e63a604cd
movabs r10, 0x8f27e5619c59fb32
xor r8, r10
xor rcx, r8
and rax, rcx
mov rcx, rdx
and rcx, rcx
xor rcx, 0xffffffffffffffff
and rcx, r9
xor rcx, 0xffffffffffffffff
mov r8, r9
xor r8, 0xffffffffffffffff
xor r9, 0xffffffffffffffff
or r8, r9
movabs r9, 0xb7b831a247430ee6
movabs r10, 0x4847ce5db8bcf119
xor r9, r10
xor rdx, r9
movabs r9, 0xc5e6df52c03c5c81
movabs r10, 0x3a1920ad3fc3a37e
xor r9, r10
xor r8, r9
or rdx, r8
xor rcx, 0xffffffffffffffff
movabs r8, 0xba505fa001a70f5a
movabs r9, 0x45afa05ffe58f0a5
xor r8, r9
xor rdx, r8
or rcx, rdx
and rax, rcx
cmp rax, 0
jge 0x14023cf88
call fcn.14000f24b
jmp 0x14023cf95
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
add rsp, 0x68
ret
Function at 0x14023d780
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rcx
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, qword [rsp + 0x48]
add rax, 0x60
mov qword [rsp + 0x50], rax
cmp rcx, 0
je 0x14023d960
mov rax, qword [rsp + 0x48]
mov rcx, 0xffffffffffffffff
xor rcx, 0xfffffffffffffff0
xor edx, edx
sub rdx, 1
sub rcx, rdx
sub rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
cmp rax, 0x10
jb 0x14023d933
mov r8, qword [rsp + 0x40]
movabs rcx, 0x2de2d06697cc2534
mov rax, r8
add rax, rcx
add rax, 0xfffffffffffffff0
movabs rcx, 0x2de2d06697cc2534
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rdx, rax
xor rdx, 0xffffffffffffffff
mov rcx, r8
and rcx, rdx
xor r8, 0xffffffffffffffff
mov rdx, rax
and rdx, r8
or rcx, rdx
cmp rcx, 0
setl dl
movabs rcx, 0xdb40d80dfdbca51d
movabs r8, 0x24bf27f202435ae2
xor rcx, r8
cmp rax, rcx
setg cl
xor dl, 0xff
mov al, cl
xor al, dl
and al, cl
test al, 1
jne 0x14023d861
jmp 0x14023d921
mov eax, dword [0x14027f998]
mov edx, dword [0x14027f99c]
xor edx, 0x77056fe9
mov ecx, eax
and ecx, edx
shl ecx, 1
add eax, edx
sub eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x876474da
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0xf1239a75
xor r8d, 0xedc658a
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x876474da
or eax, 0x876474da
imul eax, edx
add eax, ecx
imul eax, eax, 0x18ba8595
xor eax, 0x51cd9510
cmp eax, 0xcbe93f75
jb 0x14023d966
mov eax, dword [0x14027f9a0]
sub eax, dword [0x14027f9a4]
mov ecx, 0x854f6f0c
xor ecx, 0x7d53d34d
and eax, ecx
mov ecx, eax
and ecx, 0x9ff13692
shl ecx, 1
add eax, 0x9ff13692
sub eax, ecx
mov ecx, 0xb0d3b5b5
xor edx, edx
div ecx
mov dword [rsp + 0x2c], eax
call fcn.14000f24b
mov eax, dword [rsp + 0x2c]
cmp eax, 0xf2dbc591
jae 0x14023d8d0
jmp 0x14023d960
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
jmp 0x14023d960
mov rcx, qword [rsp + 0x48]
call fcn.14023d5b0
mov rax, qword [rsp + 0x50]
mov al, byte [rax]
mov cl, 0xb3
xor cl, 0xb3
cmp al, cl
jne 0x14023d960
mov rcx, qword [rsp + 0x48]
mov edx, 8
call fcn.14001d294
nop
add rsp, 0x58
ret
ret 0x8d18
Function at 0x140240b30
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140028560
Function at 0x1402507b0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [0x1402801c8]
sub ecx, dword [0x1402801cc]
mov eax, 0xffffffff
xor eax, 0xb1c96533
add ecx, eax
mov eax, 0xd4555aaa
xor eax, 0xd4555aab
add ecx, eax
mov eax, ecx
and eax, 0x95052921
mov edx, 0xfaebf4d3
xor edx, 0x5140b2c
xor eax, edx
mov edx, 0x40ceda71
xor edx, 0xbf31258e
xor ecx, edx
mov edx, 0xe34c8b78
xor edx, 0x7649a259
mov r8d, 0x5d61401c
xor r8d, 0xa29ebfe3
xor edx, r8d
or ecx, edx
and eax, ecx
mov ecx, 0x6519403
xor ecx, 0xf9ae6bfc
xor eax, ecx
imul eax, eax, 0xe2c0ffc1
cmp eax, 0xa2ee3ac9
ja 0x140250883
mov edx, dword [0x1402801d0]
mov eax, dword [0x1402801d4]
mov ecx, edx
xor ecx, eax
mov r8d, 0x62444241
xor r8d, 0x9dbbbdbe
xor eax, r8d
and edx, eax
mov eax, 0x5284c41a
xor eax, 0x5284c418
imul eax, edx
sub eax, ecx
sub eax, 0x62cbdb86
xor ecx, ecx
sub ecx, 0x7daf3f6
add eax, ecx
add eax, 0x5cd27396
cmp eax, 0xaf231fb1
jb 0x140250832
xchg bl, bl
retf
ret
ja 0x140250864
invalid