joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140017910
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdx, qword [rsi]
cmp rdx, 0
je 0x140017937
mov rcx, qword [rsi + 8]
mov r8d, 1
call fcn.140063a00
mov rbx, rsi
add rbx, 0x20
mov rdi, qword [rsi + 0x28]
mov r14, qword [rsi + 0x30]
cmp r14, 0
je 0x140017985
xor r15d, r15d
jmp 0x140017951
mov rax, r15
add r15, 1
imul rcx, rax, 0x28
mov rax, rdi
add rax, rcx
add rax, 8
mov rdx, qword [rax]
cmp rdx, 0
je 0x14001797e
mov rcx, qword [rax + 8]
mov r8d, 1
call fcn.140063a00
cmp r15, r14
jne 0x140017951
jmp 0x140017985
mov rbx, qword [rbx]
cmp rbx, 0
je 0x1400179f8
mov eax, dword [0x1400e4a78]
imul eax, dword [0x1400e4a7c]
imul eax, eax, 0x78aa0fd6
mov ecx, 0x38cd72bd
xor edx, edx
div ecx
or eax, 0x86dad304
cmp eax, 0xd709d74a
ja 0x140017afe
mov ebp, dword [0x1400e4a80]
sub ebp, dword [0x1400e4a84]
or ebp, 0xc1e7a6eb
and ebp, 0x1732fe80
add ebp, 0x981c57b4
imul rdx, rbx, 0x28
mov rcx, rdi
mov r8d, 8
call fcn.140063a00
cmp ebp, 0x1a927ac7
jb 0x140017afe
jmp 0x1400179f8
mov eax, dword [0x1400e4a88]
and eax, dword [0x1400e4a8c]
mov ecx, 0xeff289e2
xor edx, edx
div ecx
xor eax, 0xf12777d3
sub eax, 0xef2e301f
cmp eax, 0x18e49c6b
jae 0x140017b1d
jmp 0x140017a24
mov eax, dword [0x1400e4a90]
xor edx, edx
div dword [0x1400e4a94]
xor eax, 0x5ea35369
imul edi, eax, 0x5380681d
add edi, 0xe6fc325e
mov rcx, rsi
add rcx, 0x88
call fcn.14004e8a0
mov rdx, qword [rsi + 0x38]
movabs rax, 0x8000000000000000
cmp rdx, rax
sete al
cmp edi, 0x657ad079
jbe 0x140017a24
test al, 1
jne 0x140017a89
jmp 0x140017a74
cmp rdx, 0
je 0x140017a89
mov rcx, qword [rsi + 0x40]
mov r8d, 1
call fcn.140063a00
mov eax, dword [rsi + 0x58]
mov ecx, eax
sub ecx, 4
jb 0x140017aa6
jmp 0x140017a95
sub eax, 6
je 0x140017aa6
jmp 0x140017a9c
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [rsi + 0x68]
mov ecx, eax
sub ecx, 4
jb 0x140017ac3
jmp 0x140017ab2
sub eax, 6
je 0x140017ac3
jmp 0x140017ab9
mov rcx, qword [rsi + 0x70]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [rsi + 0x78]
mov ecx, eax
sub ecx, 4
jb 0x140017ae3
jmp 0x140017acf
sub eax, 6
je 0x140017ae3
jmp 0x140017ad6
mov rcx, qword [rsi + 0x80]
call qword [sym.imp.kernel32.dll_CloseHandle]
add rsi, 0xa8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.14004e310
xor byte [rcx - 0x2c], ch
invalid
mov r8d, 8
call fcn.140063a00
jmp 0x1400179ba
movabs eax, dword [0x6fdcb41684a36d54]
push rax
jne 0x140017b0d
mov rcx, rsi
add rcx, 0x88
call fcn.14004e8a0
jmp 0x140017a22

Function at 0x140018cc0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov eax, dword [0x1400e4ba8]
add eax, dword [0x1400e4bac]
imul eax, eax, 0x6495505a
sub eax, 0xf8cc1390
imul eax, eax, 0x3b6e2260
cmp eax, 0xd0de15
jbe 0x140019107
jmp 0x140018cfd
invalid
Function at 0x14001a8c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
movzx eax, byte [rcx + 0x40]
test eax, eax
je 0x14001a8e8
cmp eax, 3
jne 0x14001a944
add rsi, 0x10
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140017b40
mov rdi, qword [rsi + 8]
test rdi, rdi
je 0x14001a934
mov rcx, rdi
call fcn.140081e00
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14001a90a
mov rcx, rdi
call fcn.14004cc20
mov rax, qword [rdi + 8]
lock dec qword [rax]
jne 0x14001a920
add rdi, 8
mov rcx, rdi
call fcn.14004d7d0
mov rcx, qword [rsi + 8]
mov edx, 0x20
mov r8d, 8
call fcn.140063a00
mov rcx, qword [rsi]
add rsp, 0x28
pop rdi
pop rsi
jmp qword [sym.imp.ws2_32.dll_closesocket]
nop
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14002e090
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
movzx eax, byte [rsi + 0x10]
mov ecx, eax
sub ecx, 3
je 0x14002e0b6
jmp 0x14002e0a7
sub eax, 4
je 0x14002e0d9
jmp case.0x14002e18b.0
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
cmp word [rsi + 0x18], 3
jne case.0x14002e18b.0
mov rsi, qword [rsi + 0x20]
mov rcx, rsi
call fcn.14006dfc0
test al, 1
jne 0x14002e0cf
jmp case.0x14002e18b.0
mov rcx, rsi
call fcn.14006efe0
jmp case.0x14002e18b.0
mov eax, dword [0x1400e5860]
add eax, dword [0x1400e5864]
sub eax, 0xd783e83a
imul eax, eax, 0xbb08f09d
imul eax, eax, 0x6be891b2
cmp eax, 0xfb6ac475
ja 0x14002e1dd
jmp 0x14002e103
mov eax, dword [0x1400e5868]
and eax, dword [0x1400e586c]
mov ecx, 0xcd3ae35e
xor edx, edx
div ecx
xor eax, 0xa76c7b4a
imul ecx, eax, 0xb2bc8e9a
cmp byte [rsi + 0xb0], 3
sete al
cmp ecx, 0x86f14766
jb 0x14002e103
test al, 1
jne 0x14002e13b
jmp 0x14002e147
mov rcx, rsi
add rcx, 0x68
call fcn.14002f240
cmp dword [rsi + 0x20], 0
je 0x14002e16a
mov rdx, qword [rsi + 0x38]
cmp rdx, 0
je 0x14002e16a
mov rcx, qword [rsi + 0x28]
shl rdx, 5
mov r8d, 4
call fcn.140063a00
mov rax, qword [rsi + 0x18]
cmp rax, 0
je case.0x14002e18b.0
mov ecx, eax
and ecx, 3
lea rdx, [0x1400c4b18]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov dh, 0x17
cmp ch, byte [rdi]
cmpsb byte [rsi], byte [rdi]
and edx, edx
xor ecx, ebp
invalid
Function at 0x14002e610
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, rsi
add rdi, 0x78
movzx ecx, byte [rsi + 0xc9]
mov eax, 0x30
add ecx, 0xfffffffd
mov edx, ecx
sub edx, 4
ja 0x14002e6bb
lea rdx, [0x1400c4b48]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov rdx, qword [rsi + 0x90]
cmp rdx, 0
je 0x14002e6bb
mov rcx, qword [rsi + 0x98]
mov r8d, 1
call fcn.140063a00
mov rcx, rsi
call fcn.14006ee90
mov rax, qword [rsi]
mov rdi, rsi
add rdi, 8
cmp rax, 0
jne 0x14002e6f2
mov rax, qword [rdi]
lock dec qword [rax]
sete al
test al, 1
je 0x14002e7a3
mov rcx, rdi
call fcn.14004d610
jmp 0x14002e7a3
mov eax, dword [0x1400e5890]
xor edx, edx
div dword [0x1400e5894]
or eax, 0x89d2e375
imul eax, eax, 0x4324c126
xor eax, 0x8d5e60ff
cmp eax, 0xa79165c6
je 0x14002e7c4
jmp 0x14002e71d
mov eax, dword [0x1400e5898]
or eax, dword [0x1400e589c]
add eax, 0xa8b10862
mov ecx, 0xe46b4dde
xor edx, edx
div ecx
xor eax, 0x801d4266
mov rcx, qword [rdi]
lock dec qword [rcx]
sete cl
cmp eax, 0x9e6aa155
ja 0x14002e71d
test cl, 1
jne 0x14002e754
jmp 0x14002e7a3
mov eax, dword [0x1400e58a0]
add eax, dword [0x1400e58a4]
and eax, 0x9a72663
sub eax, 0xf80cad11
sub eax, 0x18b9f0ab
cmp eax, 0xa5b3a8cc
je 0x14002e7df
jmp 0x14002e778
mov eax, dword [0x1400e58a8]
mov ecx, dword [0x1400e58ac]
and eax, ecx
or eax, 0xe7ddfa1f
imul ebx, eax, 0x71afff7a
mov rcx, rdi
call fcn.14004d980
cmp ebx, 0xdbb1fa62
jbe 0x14002e778
jmp 0x14002e7a3
cmp qword [rsi + 0x20], 0
je 0x14002e7bb
mov rax, qword [rsi + 0x48]
cmp rax, 0
je 0x14002e7bb
mov rcx, qword [rsi + 0x50]
call qword [rax + 0x18]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
loop 0x14002e77e
mov ah, 0xec
sub byte [rsp + rsi*4 - 0xe], ch
xor esp, edx
mov ebp, dword [rbx]
mov rax, qword [rdi]
lock dec qword [rax]
sete al
jmp 0x14002e71b
movabs byte [0xfc0bcdf7767a1961], al
loopne 0x14002e7e2
jp 0x14002e85a
test ebp, 0xe04dfc0b
test dword [rax - 0x77], 0xf18de8f9
add dword [rax], eax
mov rcx, rdi
call fcn.14004d980
jmp 0x14002e776
ror byte [rax - 1], 1
invalid

Function at 0x14002e9e0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rcx, rsi
call fcn.140062da0
Function at 0x14002ef50
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
movzx eax, byte [rsi + 0x5c]
test eax, eax
jne 0x14002ef68
jmp 0x14002ef7c
mov ecx, eax
sub ecx, 3
je 0x14002efeb
jmp 0x14002ef71
sub eax, 4
je 0x14002f051
jmp 0x14002efde
mov rdi, rsi
add rdi, 8
mov rbx, qword [rsi + 8]
mov r14, qword [rsi + 0x10]
cmp r14, 0
je 0x14002efc3
xor r15d, r15d
jmp 0x14002ef96
imul rcx, r15, 0x18
mov rax, rbx
add rax, rcx
add r15, 1
mov rdx, qword [rax]
cmp rdx, 0
je 0x14002efbc
mov rcx, qword [rax + 8]
mov r8d, 1
call fcn.140063a00
cmp r15, r14
jne 0x14002ef96
jmp 0x14002efc3
mov rax, qword [rsi]
cmp rax, 0
je 0x14002efde
mov rcx, qword [rdi]
imul rdx, rax, 0x18
mov r8d, 8
call fcn.140063a00
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov eax, dword [0x1400e5920]
or eax, dword [0x1400e5924]
mov ecx, 0xe3db274a
xor edx, edx
div ecx
sub eax, 0x993df63c
and eax, 0x1626513b
cmp eax, 0xf88e0eb2
jae 0x14002f1e0
jmp 0x14002f017
mov eax, dword [0x1400e5928]
xor eax, dword [0x1400e592c]
mov ecx, 0xd350fed5
xor edx, edx
div ecx
imul edi, eax, 0x28774994
or edi, 0x85333152
mov rcx, rsi
add rcx, 0x70
call fcn.14002e090
cmp edi, 0x7a75fc3a
jbe 0x14002f017
jmp 0x14002f1d7
mov rdi, rsi
add rdi, 0x78
movzx ecx, byte [rsi + 0xc9]
mov eax, 0x30
add ecx, 0xfffffffd
mov edx, ecx
sub edx, 4
ja 0x14002f0f2
lea rdx, [0x1400c4b7c]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov eax, dword [0x1400e5930]
xor eax, dword [0x1400e5934]
sub eax, 0x8c09b69f
xor eax, 0x6e43f89a
imul eax, eax, 0x9e8dfcfe
cmp eax, 0xab6349ef
je 0x14002f1fd
jmp 0x14002f11b
mov eax, dword [0x1400e5938]
xor edx, edx
div dword [0x1400e593c]
xor eax, 0x76ace8ee
mov ecx, 0x4bd1849d
xor edx, edx
div ecx
imul edx, eax, 0x4d395320
mov rcx, rsi
add rcx, 0x60
mov rax, qword [rsi + 0x60]
lock dec qword [rax]
sete al
cmp edx, 0xe993a414
je 0x14002f11b
test al, 1
jne 0x14002f15d
jmp 0x14002f162
call fcn.14004c7d0
mov eax, dword [0x1400e5940]
and eax, dword [0x1400e5944]
xor eax, 0x4dac72c5
add eax, 0x23c72b3e
imul eax, eax, 0x65e426ff
cmp eax, 0xa4b2e0ff
je 0x14002f215
mov eax, dword [0x1400e5948]
sub eax, dword [0x1400e594c]
imul ebx, eax, 0x3e48c6f9
and ebx, 0x1f98a1ea
xor ebx, 0xa8cfdaad
mov rdi, rsi
add rdi, 0x68
mov rcx, rdi
call fcn.1400716c0
mov rax, qword [rsi + 0x68]
lock dec qword [rax]
sete al
cmp ebx, 0xdc9cef88
xchg esp, eax
rol byte [rcx - 0x63107705], 0xdc
je 0x14002f215
test al, 1
jne 0x14002f1cf
jmp 0x14002f1d7
mov rcx, rdi
call fcn.14004c7d0
add rsi, 0x18
jmp 0x14002ef7c
mov ebx, 0xc11ddec7
xchg esi, eax
jle 0x14002f1bf
cqo
invalid
stosb byte [rdi], al
outsd dx, dword [rsi]
lahf
push 0x67e8eec7
mov rax, qword [rsi + 0x60]
lock dec qword [rax]
sete al
jmp 0x14002f119
rcr dword [0x1b7f90991], 0x67
invalid
Function at 0x14002f240
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
movzx eax, byte [rsi + 0x40]
test eax, eax
je 0x14002f263
jmp 0x14002f254
sub eax, 3
je 0x14002f2cb
jmp 0x14002f25b
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rbx, rsi
add rbx, 8
mov rdi, qword [rsi + 8]
cmp rdi, 0
je 0x14002f2c0
mov rcx, rdi
call fcn.140081e00
mov rax, qword [rdi]
lock dec qword [rax]
sete al
test al, 1
je 0x14002f292
mov rcx, rdi
call fcn.14004cc20
mov rcx, rdi
add rcx, 8
mov rax, qword [rdi + 8]
lock dec qword [rax]
sete al
test al, 1
je 0x14002f2ad
call fcn.14004d7d0
mov rcx, qword [rbx]
mov edx, 0x20
mov r8d, 8
call fcn.140063a00
add al, ch
add r8d, dword [r8]
mov rcx, qword [rsi]
call qword [sym.imp.ws2_32.dll_closesocket]
jmp 0x14002f25b
mov eax, dword [0x1400e5950]
or eax, dword [0x1400e5954]
imul eax, eax, 0x14f2d670
xor eax, 0x1a6dbe9b
xor eax, 0x1fb01b35
cmp eax, 0x4fbd2647
je 0x14002f327
jmp 0x14002f2f0
mov edi, dword [0x1400e5958]
xor edi, dword [0x1400e595c]
sub edi, 0xd4026de
sub edi, 0x71c9fcac
and edi, 0x2f2c739c
mov rcx, rsi
add rcx, 0x10
call fcn.14002e9e0
cmp edi, 0x84287a51
je 0x14002f2f0
jmp 0x14002f25b
jle 0x14002f2ba
shr dword [rcx], 0xfd
push rbp
invalid

Function at 0x14002fd10
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1788
call fcn.1400aded0
sub rsp, rax
mov r14, rdx
mov rsi, rcx
mov rcx, rsi
call fcn.140071860
mov rdi, rax
mov r13, rdx
cmp rdi, 0
sete bl
test bl, 1
jne 0x140030960
mov qword [rsp + 0x618], rsi
mov byte [rsp + 0x47], bl
mov eax, dword [0x1400e59b0]
add eax, dword [str._r_9]
imul eax, eax, 0x21f52183
sub eax, 0x63e0e67
add eax, 0x894db39d
cmp eax, 0x51970534
jae 0x14003472b
mov rcx, r14
call fcn.14002eba0
jmp 0x140034711
and eax, 0x8ff075fb
push rsp
retf 0x468e
Function at 0x140034d30
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rcx, rsi
call fcn.140062da0
mov r14, rsi
add r14, 0x18
mov rdi, qword [rsi + 0x18]
cmp rdi, 0xffffffffffffffff
je 0x140034e15
mov r15, rsi
add r15, 0x20
mov rbx, qword [rsi + 0x20]
cmp rbx, 0
je 0x140034dbb
mov rcx, rbx
call fcn.140081e00
mov rax, qword [rbx]
lock dec qword [rax]
sete al
test al, 1
je 0x140034d8a
mov rcx, rbx
call fcn.14004cc20
mov rcx, rbx
add rcx, 8
mov rax, qword [rbx + 8]
lock dec qword [rax]
sete al
test al, 1
je 0x140034da5
call fcn.14004d7d0
mov rcx, qword [r15]
mov edx, 0x20
mov r8d, 8
call fcn.140063a00
mov rdi, qword [r14]
mov eax, dword [0x1400e5bf0]
add eax, dword [0x1400e5bf4]
and eax, 0xc844abc7
sub eax, 0x699f4d1e
imul eax, eax, 0xc17e615e
cmp eax, 0xdab1d0b4
je 0x140034ed2
jmp 0x140034de4
mov ebx, dword [0x1400e5bf8]
add ebx, dword [0x1400e5bfc]
xor ebx, 0x10d642d2
sub ebx, 0xb1f3e51a
and ebx, 0xdd3d02bc
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
cmp ebx, 0xde01efa7
jae 0x140034de4
jmp 0x140034e15
mov rcx, rsi
call fcn.14006dd80
mov rax, qword [rsi]
mov rcx, rsi
add rcx, 8
cmp rax, 0
jne 0x140034e97
mov eax, dword [0x1400e5c00]
xor eax, dword [0x1400e5c04]
or eax, 0xd7a4582f
and eax, 0x81cfb671
mov r8d, 0xa7125276
xor edx, edx
div r8d
cmp eax, 0x92f97df7
jae 0x140034ee8
mov edx, dword [0x1400e5c08]
imul edx, dword [0x1400e5c0c]
xor edx, 0xd8cff4fa
and edx, 0x89e0eedf
or edx, 0x2b846302
mov rax, qword [rcx]
lock dec qword [rax]
sete al
cmp edx, 0x702e9af0
je 0x140034ee8
test al, 1
jne 0x140034e90
jmp 0x140034eaa
call fcn.14004d610
jmp 0x140034eaa
mov rax, qword [rcx]
lock dec qword [rax]
sete al
test al, 1
je 0x140034eaa
call fcn.14004d980
mov rcx, rsi
add rcx, 0x10
mov rax, qword [rsi + 0x10]
lock dec qword [rax]
sete al
test al, 1
je 0x140034ec5
call fcn.14004d330
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lodsb al, byte [esi]
invalid
cmpsb byte [rsi], byte [rdi]
movabs al, byte [0x2abc8b364cbca0f1]
jbe 0x140034f6f
mov rax, qword [rcx]
lock dec qword [rax]
sete al
jmp 0x140034e59
sahf
Function at 0x140040f50
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov eax, dword [0x1400e6420]
sub eax, dword [0x1400e6424]
or eax, 0xcc98fec0
imul eax, eax, 0x3e29166d
or eax, 0xf4fb47f0
cmp eax, 0xf24fcef1
jbe 0x14004104c
jmp 0x140040f80
mov edx, dword [0x1400e6428]
sub edx, dword [0x1400e642c]
and edx, 0x3bfca9b6
xor edx, 0x99744939
xor edx, 0xa8971d50
cmp byte [rcx + 0x68], 3
sete al
cmp edx, 0x61e9aeea
jae 0x140040f80
test al, 1
jne 0x140040fbb
jmp 0x140040fb3
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rdi, rcx
add rdi, 0x20
movzx eax, byte [rcx + 0x60]
test eax, eax
je 0x140040fd3
jmp 0x140040fcc
sub eax, 3
je 0x14004103e
jmp 0x140040fb3
mov rbx, rcx
add rbx, 0x28
mov rsi, qword [rcx + 0x28]
cmp rsi, 0
je 0x140041030
mov rcx, rsi
call fcn.140081e00
mov rax, qword [rsi]
lock dec qword [rax]
sete al
test al, 1
je 0x140041002
mov rcx, rsi
call fcn.14004cc20
mov rcx, rsi
add rcx, 8
mov rax, qword [rsi + 8]
lock dec qword [rax]
sete al
test al, 1
je 0x14004101d
call fcn.14004d7d0
mov rcx, qword [rbx]
mov edx, 0x20
mov r8d, 8
call fcn.140063a00
mov rcx, qword [rdi]
call qword [sym.imp.ws2_32.dll_closesocket]
jmp 0x140040fb3
add rcx, 0x30
call fcn.140040e80
jmp 0x140040fb3
int 0x49
mov r9b, 0x8f
in eax, dx
sbb bl, byte [rbx - 0x16e75433]
and edi, edi
invalid

Function at 0x140042950
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov r8, rdx
mov rsi, rcx
mov rax, qword [r8]
mov rcx, r8
add rcx, 8
mov r9, qword [r8 + 8]
cmp r9, 3
jae 0x140042980
mov rcx, rsi
mov rdx, r8
call fcn.140042c20
jmp 0x140042a70
mov r10, rax
add r10, 1
mov r11b, byte [rax]
cmp r11b, 0xfb
jb 0x1400429ae
add r11b, 5
movzx edx, r11b
sub r11b, 3
ja 0x140042a0e
lea r11, [0x1400c5478]
movsxd rdx, dword [r11 + rdx*4]
add rdx, r11
jmp rdx
mov eax, dword [0x1400e6580]
add eax, dword [0x1400e6584]
mov edi, 0xb5f32944
xor edx, edx
div edi
sub eax, 0xfe25c19a
sub eax, 0x9184c504
cmp eax, 0x14d4505b
jb 0x140042abf
jmp 0x1400429da
mov eax, dword [0x1400e6588]
imul eax, dword [0x1400e658c]
sub eax, 0x4bfefc05
xor eax, 0xa6bcf62a
mov edi, 0xb9228e05
xor edx, edx
div edi
movzx edx, r11b
cmp eax, 0x7eb5d37d
ja 0x1400429da
mov r11, 0xffffffffffffffff
jmp 0x140042a60
mov rcx, rsi
mov edx, 0xc
call fcn.1400bed50
jmp 0x140042a70
mov rcx, rsi
mov edx, 2
call fcn.1400bed50
jmp 0x140042a70
mov rcx, rsi
mov edx, 3
call fcn.1400bed50
jmp 0x140042a70
mov rcx, rsi
mov edx, 4
call fcn.1400bed50
jmp 0x140042a70
mov dx, word [r10]
rol dx, 8
add rax, 3
mov r11, 0xfffffffffffffffd
mov r10, rax
add r11, r9
mov qword [r8], r10
mov qword [rcx], r11
mov word [rsi + 2], dx
mov byte [rsi], 0x11
mov eax, dword [0x1400e6590]
xor eax, dword [0x1400e6594]
add eax, 0xd75da4ae
imul eax, eax, 0x15a631cd
add eax, 0x73944032
cmp eax, 0xa73ed8e3
je 0x140042ad0
mov eax, dword [0x1400e6598]
and eax, dword [0x1400e659c]
and eax, 0x9d9f26d1
xor eax, 0xfa4c17dc
and eax, 0xf47593b6
cmp eax, 0xb9d9e19e
jbe 0x140042ad0
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
and eax, 0x38cc11ed
movabs al, byte [0x8e90a3e4118cbf3]
invalid
invalid
Function at 0x140042ae0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r8, rdx
mov rsi, rcx
mov r9, qword [r8]
mov rcx, r8
add rcx, 8
mov r10, qword [r8 + 8]
cmp r10, 5
jae 0x140042b11
mov rcx, rsi
mov rdx, r8
call fcn.140042e30
jmp 0x140042bf7
mov r11, r9
add r11, 1
mov bl, byte [r9]
cmp bl, 0xfb
jb 0x140042b90
mov eax, dword [0x1400e65a0]
imul eax, dword [0x1400e65a4]
and eax, 0xce64754f
xor eax, 0xba58611a
or eax, 0x4532502d
cmp eax, 0xdf6daca2
ja 0x140042c02
jmp 0x140042b49
mov eax, dword [0x1400e65a8]
xor edx, edx
div dword [0x1400e65ac]
xor eax, 0xac1025ee
mov edi, 0x1c6c87f7
xor edx, edx
div edi
mov edi, 0xfd2267a5
xor edx, edx
div edi
cmp eax, 0xb9c4a32b
jae 0x140042b49
add bl, 5
movzx eax, bl
sub bl, 3
ja 0x140042b9a
lea rdx, [0x1400c5488]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
movzx eax, bl
mov edx, 1
jmp 0x140042bd7
mov rcx, rsi
mov edx, 0xc
call fcn.1400bed70
jmp 0x140042bf7
mov rcx, rsi
mov edx, 3
call fcn.1400bed70
jmp 0x140042bf7
mov rcx, rsi
mov edx, 4
call fcn.1400bed70
jmp 0x140042bf7
mov ax, word [r11]
rol ax, 8
movzx eax, ax
mov edx, 3
add r9, rdx
sub r10, rdx
mov qword [r8], r9
mov qword [rcx], r10
mov dword [rsi + 4], eax
mov byte [rsi], 0x11
jmp 0x140042bf7
mov eax, dword [r11]
bswap eax
mov edx, 5
jmp 0x140042bd7
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
adc ebx, dword [rcx]
cdq
bswap edi
xchg ebp, eax
in eax, 0xcd
invalid
Function at 0x1400463e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov eax, dword [0x1400e6840]
xor eax, dword [0x1400e6844]
xor eax, 0xc8fb7b25
xor eax, 0x2aebf0ff
xor eax, 0xd0d6ddf5
cmp eax, 0xc0196c32
jae 0x14004664f
mov edx, dword [0x1400e6848]
and edx, dword [0x1400e684c]
sub edx, 0x26dc1a3
add edx, 0x253b9399
sub edx, 0x1200b711
cmp qword [rcx], 0
sete al
mov r14, rcx
add r14, 8
cmp edx, 0xedc7d809
ja 0x14004664f
test al, 1
jne 0x14004645b
jmp 0x140046528
mov r12, qword [r14]
mov eax, 1
lock xadd qword [r12], rax
cmp rax, 0
jl 0x140046516
mov al, byte [0x1400e8bf0]
mov ecx, 0xc80
mov edx, 0x80
call fcn.1400639f0
mov rbx, rax
cmp rbx, 0
jne 0x1400464a0
mov ecx, 0x80
mov edx, 0xc80
call fcn.14006f020
mov r15, r12
add r15, 0x58
mov qword [rbx], 0xcc
mov qword [rbx + 8], 0
lea rax, [0x1400c3fd0]
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], r12
mov qword [rbx + 0x28], rdi
mov rcx, rbx
add rcx, 0x30
mov rdx, rsi
mov r8d, 0xbd0
call fcn.1400be120
mov rcx, rbx
add rcx, 0xc00
xor edx, edx
mov r8d, 0x18
call fcn.1400be7c0
mov rcx, r15
mov rdx, rbx
mov r8, rbx
call fcn.140041060
cmp rax, 0
jne 0x140046518
jmp 0x14004663d
ud2
mov rcx, r14
mov rdx, rax
call fcn.140073e30
jmp 0x14004663d
mov r12, qword [r14]
mov eax, 1
lock xadd qword [r12], rax
cmp rax, 0
jl 0x140046569
mov al, byte [0x1400e8bf0]
mov ecx, 0xc80
mov edx, 0x80
call fcn.1400639f0
mov rbx, rax
cmp rbx, 0
jne 0x14004656b
mov ecx, 0x80
mov edx, 0xc80
call fcn.14006f020
ud2
mov eax, dword [0x1400e6850]
add eax, dword [0x1400e6854]
imul eax, eax, 0x71b729da
add eax, 0x6d21473b
and eax, 0x4d2ad06e
cmp eax, 0x9851b71
jae 0x14004665c
jmp 0x140046594
mov ebp, dword [0x1400e6858]
sub ebp, dword [0x1400e685c]
xor ebp, 0x148fccee
add ebp, 0x2e1bb753
sub ebp, 0x24f9de7f
mov r15, r12
add r15, 0x68
mov r14, r12
add r14, 0x10
mov qword [rbx], 0xcc
mov qword [rbx + 8], 0
lea rax, [0x1400c4020]
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], r12
mov qword [rbx + 0x28], rdi
mov rcx, rbx
add rcx, 0x30
mov rdx, rsi
mov r8d, 0xbd0
call fcn.1400be120
mov rcx, rbx
add rcx, 0xc00
xor edx, edx
mov r8d, 0x18
call fcn.1400be7c0
mov rcx, r15
mov rdx, rbx
mov r8, rbx
call fcn.140041060
mov rcx, r14
mov rdx, rax
call fcn.140080010
cmp ebp, 0xbd7d3261
je 0x140046594
jmp 0x14004663d
mov rax, rbx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
movntps xmmword [rbx + 0x932948b], xmm0
mov dh, 0xe9
mov esi, 0x87fffffd
xor ebx, esi
mov edx, 0xd4f21249
xchg dword [rbx], esi
fidivr word [rdx - 0x2b0dedb7]
mov r15, r12
add r15, 0x68
mov r14, r12
add r14, 0x10
mov qword [rbx], 0xcc
mov qword [rbx + 8], 0
lea rax, [0x1400c4020]
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], r12
mov qword [rbx + 0x28], rdi
mov rcx, rbx
add rcx, 0x30
mov rdx, rsi
mov r8d, 0xbd0
call fcn.1400be120
mov rcx, rbx
add rcx, 0xc00
xor edx, edx
mov r8d, 0x18
call fcn.1400be7c0
mov rcx, r15
mov rdx, rbx
mov r8, rbx
call fcn.140041060
mov rcx, r14
mov rdx, rax
call fcn.140080010
jmp 0x140046592
Function at 0x1400466f0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
mov rdi, r8
mov rbx, rdx
mov r12, rcx
mov r13, r12
mov r14, rbx
add r14, 0x78
call fcn.140072730
mov r15, rax
mov rsi, r15
add rsi, 0x50
movzx eax, byte [r15 + 0x50]
xor ebp, ebp
test rax, rax
je 0x140046740
jmp 0x140046733
sub rax, 1
je 0x140046752
jmp 0x14004673b
jmp 0x140046817
lea rdx, [0x140043b90]
mov rcx, r15
call fcn.140088930
mov byte [rsi], 1
mov eax, dword [0x1400e6860]
xor edx, edx
div dword [0x1400e6864]
or eax, 0xf9ed12c0
xor eax, 0xe3a2308c
and eax, 0x6def8f99
cmp eax, 0xbbeea2a1
Function at 0x140048ee0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
movzx eax, byte [rsi]
mov rcx, rax
sub rcx, 0xf
ja 0x140048f05
lea rcx, [0x1400c5a80]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov eax, dword [0x1400e6a40]
xor eax, dword [0x1400e6a44]
sub eax, 0x5311669a
or eax, 0xa0465a19
and eax, 0xf6e9f3ae
cmp eax, 0x7c9d3128
je 0x140048fbc
jmp 0x140048f2d
mov edi, dword [0x1400e6a48]
or edi, dword [0x1400e6a4c]
xor edi, 0xf9bb0c27
or edi, 0x7b8fb007
xor edi, 0x56f12ba9
mov rcx, rsi
add rcx, 8
call fcn.140068980
cmp edi, 0x8e90bf10
jb 0x140048f2d
jmp 0x140048f61
add rsp, 0x28
pop rdi
pop rsi
ret
movabs byte [0x2735f20e8dadaca7], al
invalid