joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140049820
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.140045cde
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.1400454e0
test al, 1
jne 0x14004984a
jmp 0x1400499a4
mov rcx, qword [rsp + 0x28]
call fcn.1400497de
mov rax, qword [rsp + 0x30]
mov al, byte [rax]
mov cl, 0x3f
xor cl, 0x3f
cmp al, cl
jne 0x1400499a4
mov eax, dword [0x1401f5210]
mov edx, dword [0x1401f5214]
xor edx, 0x56eb7cc7
mov r8d, eax
xor r8d, edx
xor r8d, 0xffffffff
mov ecx, edx
and ecx, r8d
shl ecx, 1
sub ecx, edx
sub eax, ecx
mov edx, 0xcea8a872
xor edx, 0x682bee4
mov ecx, 0x52d31dae
xor ecx, 0xad2ce251
xor edx, ecx
mov ecx, eax
xor ecx, edx
and ecx, eax
mov edx, 0xf148c659
xor edx, 0xeb739a6
mov eax, ecx
xor eax, edx
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xab663b06
or eax, edx
mov edx, 0xffffffff
xor edx, 0xab663b06
mov r8d, 0xffffffff
xor r8d, 0xab663b06
or edx, r8d
mov r8d, 0x48ba640c
xor r8d, 0xb7459bf3
xor ecx, r8d
xor edx, 0xffffffff
or ecx, edx
xor eax, 0xffffffff
mov edx, 0x1c2cb42d
xor edx, 0xe3d34bd2
xor ecx, edx
or eax, ecx
mov edx, 0x71307691
xor edx, 0x30dfe1f8
mov ecx, 0xd79f6e55
xor ecx, 0x286091aa
xor edx, ecx
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0x41ef9769
add eax, edx
sub eax, ecx
cmp eax, 0xe1be18a6
jae 0x1400499a9
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401f5218]
xor edx, edx
div dword [0x1401f521c]
mov edx, eax
mov eax, 0xad919a48
xor eax, 0xcd423db7
add edx, eax
xor eax, eax
sub eax, 0xc198c386
add edx, eax
mov eax, edx
and eax, 0xad22eb2f
or edx, 0xad22eb2f
add eax, edx
mov dword [rsp + 0x24], eax
mov edx, 8
call fcn.14000fac0
mov eax, dword [rsp + 0x24]
cmp eax, 0x92f8813
jb 0x140049949
jmp 0x1400499a4
add rsp, 0x38
ret
xchg ebx, eax
invalid
Function at 0x14004a3c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.140045cde
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, rcx
add rax, 8
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 8]
mov rcx, rdx
add rcx, 8
mov qword [rsp + 0x48], rcx
cmp rax, qword [rdx + 8]
mov qword [rsp + 0x50], rax
je 0x14004a4ee
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov qword [rsp + 0x58], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x58]
call fcn.140049e60
mov rax, qword [rsp + 0x38]
cmp byte [rax], 0
jne 0x14004a513
mov eax, dword [0x1401f5270]
mov r8d, dword [0x1401f5274]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x9838578a
xor edx, edx
div ecx
or eax, 0xc2949555
imul eax, eax, 0x84d723cd
mov ecx, 0x767a0fe8
xor ecx, 0x4471822d
cmp eax, ecx
je 0x14004a518
mov rcx, qword [rsp + 0x48]
mov eax, dword [0x1401f5278]
xor eax, dword [0x1401f527c]
mov edx, 0x84c157a5
xor edx, 0x86db54c0
sub eax, edx
mov edx, 0x7832ba5b
xor edx, 0x19b77d1f
imul eax, edx
mov r8d, 0x3d2239ca
xor edx, edx
div r8d
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rcx
cmp eax, 0x3ef7be0f
ja 0x14004a495
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
jmp 0x14004a4ee
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
mov r9, qword [rcx]
mov qword [rax], r9
mov qword [rdx], r8
mov rcx, qword [rcx + 0x10]
mov qword [rax + 0x10], rcx
add rsp, 0x68
ret
fild word [rax]
je 0x14004a54e
jmp 0x14004a495
add dword [rax - 0x7d], ecx
clc
add byte [rdi], cl
test dword [rdx], ecx
add byte [rax], al
add byte [rax - 0x75], cl
and al, 0x30
call fcn.14000f935
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x14004a5e7
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
movabs rdx, 0x4000000000000000
mov rcx, rax
xor rcx, rdx
movabs rdx, 0xfec8ed0d40a4c448
movabs r8, 0x13712f2bf5b3bb7
xor rdx, r8
xor rcx, rdx
movabs rdx, 0x4000000000000000
or rax, rdx
and rax, rcx
movabs rcx, 0xa5b65e0eaa6898eb
movabs rdx, 0xa5b65e0eaa6898eb
xor rcx, rdx
cmp rax, rcx
jne 0x14004a5e7
mov rcx, qword [rsp + 0x20]
call fcn.14000f935
nop
add rsp, 0x38
ret
Function at 0x14004fcb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x188
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], r8
mov qword [rbp + 0xf8], rdx
mov qword [rbp + 0x100], rcx
mov eax, dword [0x1401f5520]
xor eax, 0xffc71f72
mov r8d, dword [0x1401f5524]
Function at 0x140053290
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0xf8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x70], rcx
mov eax, dword [0x1401f5660]
mov ecx, dword [0x1401f5664]
mov r8d, eax
xor r8d, 0xffffffff
mov edx, eax
xor edx, 0xffffffff
or r8d, edx
xor r8d, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
or r8d, edx
and ecx, ecx
xor ecx, 0xffffffff
mov edx, 0x2c2918fb
xor edx, 0xd3d6e704
xor eax, edx
mov edx, 0x21629667
xor edx, 0xde9d6998
xor ecx, edx
or eax, ecx
and r8d, eax
Function at 0x14005af40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x10
mov qword [rsp + 8], rcx
mov eax, dword [0x1401f59e0]
mov ecx, dword [0x1401f59e4]
xor ecx, 0x78c8c13e
xor edx, edx
div ecx
mov ecx, eax
mov edx, ecx
xor edx, 0xffffffff
and edx, 0x7411c44f
mov r8d, 0xffffffff
xor r8d, 0x7411c44f
mov eax, ecx
and eax, r8d
imul eax, edx
mov edx, ecx
and edx, 0x7411c44f
mov r8d, 0xbdea03d2
xor r8d, 0xc9fbc79d
or ecx, r8d
imul ecx, edx
add ecx, eax
mov edx, ecx
xor edx, 0xffffffff
and edx, 0x754e6b71
mov r8d, 0xffffffff
xor r8d, 0x754e6b71
mov eax, ecx
and eax, r8d
imul eax, edx
mov edx, ecx
and edx, 0x754e6b71
or ecx, 0x754e6b71
imul ecx, edx
add ecx, eax
mov eax, ecx
and eax, eax
mov edx, 0x1d651bbc
xor edx, 0xe29ae443
xor eax, edx
and eax, 0xbf74141e
xor eax, 0xffffffff
mov edx, 0xbf74141e
and edx, 0xbf74141e
xor edx, 0xffffffff
and ecx, edx
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0xc1a7f4a2
xor ecx, 0x54e33e74
cmp eax, ecx
je 0x14005b065
mov rcx, qword [rsp + 8]
mov eax, dword [0x1401f59e8]
xor eax, 0xf093c5d0
xor edx, edx
div dword [0x1401f59ec]
and eax, 0xb5d19bbc
xor edx, edx
sub edx, 0x6aaaee99
sub eax, edx
mov edx, 0xc868459
xor edx, 0x6b65a977
or eax, edx
mov rcx, qword [rcx + 0x10]
mov qword [rsp], rcx
cmp eax, 0x7c0a0e4a
jae 0x14005b015
mov rax, qword [rsp]
add rsp, 0x10
ret
invalid
Function at 0x14005bba0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x38]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp - 8], rax
mov eax, dword [0x1401f5a50]
xor eax, 0x777926f4
mov ecx, dword [0x1401f5a54]
xor ecx, 0xba21c4a5
imul eax, ecx
mov ecx, 0x3dd24d17
xor edx, edx
div ecx
add eax, 0x173779c6
mov ecx, 0xf8a801c6
xor ecx, 0x240a89ea
or eax, ecx
cmp eax, 0x95e20d04
jbe 0x14005bd79
mov r8, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
mov eax, dword [0x1401f5a58]
xor eax, 0x63937478
mov ecx, dword [0x1401f5a5c]
xor ecx, 0xcf88c0c3
mov r10d, eax
xor r10d, ecx
not r10d
mov r9d, ecx
and r9d, r10d
add r9d, r9d
sub ecx, r9d
add eax, ecx
xor eax, 0xe22a99d8
imul eax, eax, 0x236f4824
xor eax, 0x64eebead
mov dword [rbp - 0x44], eax
mov eax, 0x10
call fcn.1401f2390
sub rsp, rax
mov eax, dword [rbp - 0x44]
mov rcx, rsp
mov qword [rbp - 0x40], rcx
test r8, r8
setns cl
mov rdx, qword [rdx]
mov qword [rbp - 0x38], rdx
sub rdx, r8
setg dl
and cl, dl
mov byte [rbp - 0x29], cl
cmp eax, 0x2f8d2c74
je 0x14005bc06
mov al, byte [rbp - 0x29]
test al, 1
jne 0x14005bcb7
jmp 0x14005bc99
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffff
sub rsp, 0x20
call fcn.140013c92
add rsp, 0x20
jmp 0x14005bd74
mov r8, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x20]
mov r9, rcx
add r9, 8
mov qword [rbp - 0x58], r9
mov rcx, qword [rcx + 8]
add rcx, 8
shl r8, 5
add rcx, r8
add rcx, 8
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.1400191eb
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
add rsp, 0x20
mov rax, qword [rax]
mov qword [rbp - 0x50], rax
cmp rax, rcx
jg 0x14005bd3b
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x50]
xor eax, eax
sub rax, 0xffffffffffffffff
sub rdx, rax
sub rsp, 0x20
call fcn.140013c92
add rsp, 0x20
jmp 0x14005bd74
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x10]
mov r9, qword [rbp - 0x28]
mov rax, qword [rbp - 0x58]
mov rax, qword [rax]
mov r8, rax
add r8, 8
mov r10, rdx
shl r10, 5
add r8, r10
add r8, 0x18
mov qword [r8], r9
add rax, 8
shl rdx, 5
add rax, rdx
mov qword [rax], rcx
mov rsp, rbp
pop rbp
ret
xor eax, 0x84e99c60
invalid
Function at 0x14005eb50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rcx
mov rax, qword [0x140209370]
mov ecx, dword [rax]
call fcn.140009923
mov rcx, qword [rsp + 0x48]
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x57], al
je 0x14005ed5c
mov rax, qword [rsp + 0x48]
movabs rcx, 0x9f478a589659f9d0
movabs rdx, 0x7b67fa4b6a21113b
xor rcx, rdx
sub rax, rcx
add rax, 0xfffffffffffffff0
movabs rcx, 0xe4207013fc78e8eb
add rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp rax, 0x10
setb cl
mov byte [rsp + 0x46], cl
mov al, 1
test cl, 1
mov byte [rsp + 0x47], al
jne 0x14005ec80
mov r8, qword [rsp + 0x38]
xor eax, eax
mov ecx, eax
sub rcx, r8
xor eax, eax
sub rax, 0xfffffffffffffff0
add rcx, rax
xor eax, eax
sub rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, 0xffffffffffffffff
movabs rdx, 0x86db7952edf854e8
and rcx, rdx
mov r10, 0xffffffffffffffff
movabs rdx, 0x86db7952edf854e8
xor r10, rdx
mov r9, rax
and r9, r10
mov rdx, r8
xor rdx, 0xffffffffffffffff
movabs r11, 0x86db7952edf854e8
and rdx, r11
and r8, r10
or rcx, r9
or rdx, r8
xor rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x14005ec5d
jmp 0x14005ec6d
call fcn.140009cc0
xor eax, eax
mov byte [rsp + 0x57], al
jmp 0x14005ed5c
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x47], al
mov al, byte [rsp + 0x47]
mov byte [rsp + 0x27], al
mov ecx, dword [0x1401f5bc8]
sub ecx, dword [0x1401f5bcc]
or ecx, 0x45ad24f3
mov edx, 0xb6c53c5
xor edx, 0xf493ac3a
mov eax, ecx
xor eax, edx
and eax, 0x1fc8950e
mov edx, 0xffffffff
xor edx, 0x1fc8950e
and ecx, edx
or eax, ecx
imul eax, eax, 0xd8ab2d75
cmp eax, 0xfc4c2b3a
je 0x14005ed74
mov rdx, qword [rsp + 0x30]
mov cl, byte [rsp + 0x46]
mov rax, qword [rsp + 0x48]
mov r8d, dword [0x1401f5bd0]
mov r9d, dword [0x1401f5bd4]
mov r10d, 0xc7f0f8a8
xor r10d, 0xeab0dc3c
sub r8d, r10d
sub r8d, r9d
add r8d, 0x2d402494
xor r8d, 0xf748f1fa
add r8d, 0x9dcfe29e
mov r9d, 0x75a7b014
xor r9d, 0x6ae33a1f
sub r8d, r9d
sub r8d, 0x9dcfe29e
xor r8d, 0xdf5649ce
mov dword [rsp + 0x20], r8d
mov r8, qword [rax]
and cl, 1
call fcn.140010b90
mov eax, dword [rsp + 0x20]
cmp eax, 0x64d1f76e
jbe 0x14005ecce
mov al, byte [rsp + 0x27]
mov byte [rsp + 0x57], al
jmp 0x14005ed5c
mov al, byte [rsp + 0x57]
mov cl, 0xd9
xor cl, 0xd9
cmp al, cl
setne al
and al, 1
movzx eax, al
add rsp, 0x58
ret
sub dword [rdx], eax
retf 0xe98e
Function at 0x14005f6a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 0x50], rdx
mov qword [rbp - 0x48], rcx
mov eax, 0x10
call fcn.1401f2390
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
mov rax, qword [0x140209370]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.140009923
add rsp, 0x20
xor eax, eax
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x58], rax
movabs rcx, 0x7825694f504a7959
movabs rdx, 0x7825694f504a7979
xor rcx, rdx
cmp rax, rcx
je 0x14005f753
mov rax, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x50]
mov byte [rcx + rax], 0
movabs rcx, 0x1fc8950e3cec077c
sub rax, rcx
movabs rcx, 0x891483ca35cd91ed
movabs rdx, 0x891483ca35cd91ec
xor rcx, rdx
add rax, rcx
movabs rcx, 0x1fc8950e3cec077c
add rax, rcx
mov qword [rbp - 0x38], rax
jmp 0x14005f6e2
mov eax, dword [0x1401f5c18]
mov ecx, dword [0x1401f5c1c]
xor ecx, 0x658d63df
and eax, ecx
xor eax, 0xa347a075
xor eax, 0xa2f286f2
mov ecx, eax
and ecx, 0xe86fd2c5
xor ecx, 0xffffffff
mov edx, 0x94df4ff1
xor edx, 0x7cb09d34
add eax, edx
add eax, 1
add eax, ecx
mov ecx, 0x21c42a93
xor ecx, 0x1db7c420
cmp eax, ecx
jbe 0x14005f878
mov eax, dword [0x1401f5c20]
xor edx, edx
div dword [0x1401f5c24]
mov ecx, eax
mov rax, qword [rbp - 0x48]
mov edx, ecx
xor edx, 0x755e473c
mov r8d, 0xe7829402
xor r8d, 0x187d6bfd
xor edx, r8d
or ecx, 0x755e473c
and ecx, edx
and ecx, 0x79ea2dfd
and ecx, 0x3cee9841
mov dword [rbp - 0x5c], ecx
mov ecx, 0x46943c02
xor ecx, 0x31abb513
mov dword [rbp - 0x60], ecx
mov rcx, qword [rax]
mov qword [rbp - 0x20], rcx
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x10]
lea rdx, [rbp - 0x20]
sub rsp, 0x20
call fcn.14001c672
mov rax, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x50]
add rsp, 0x20
mov r8, qword [rbp - 0x10]
mov qword [rcx], r8
mov r8, qword [rbp - 8]
mov qword [rcx + 8], r8
mov rcx, qword [rax + 0x10]
mov qword [rdx], rcx
mov rax, qword [rax + 0x18]
mov qword [rdx + 8], rax
lea rcx, [rbp - 0x30]
sub rsp, 0x20
call fcn.14001c672
mov rdx, qword [rbp - 0x50]
mov ecx, dword [rbp - 0x60]
mov eax, dword [rbp - 0x5c]
add rsp, 0x20
mov r8, qword [rbp - 0x30]
mov qword [rdx + 0x10], r8
mov r8, qword [rbp - 0x28]
mov qword [rdx + 0x18], r8
cmp eax, ecx
je 0x14005f7a1
mov rsp, rbp
pop rbp
ret
invalid
Function at 0x140066940
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x58], rcx
call fcn.140066b1f
mov rcx, qword [rsp + 0x58]
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x67], al
je 0x140066b03
mov eax, dword [0x1401f5ff0]
mov edx, dword [0x1401f5ff4]
xor edx, 0x8fba6d77
mov r8d, eax
and r8d, edx
mov ecx, 0x12702c08
xor ecx, 0x12702c0a
imul ecx, r8d
add eax, edx
sub eax, ecx
mov ecx, 0xbf279dc7
xor ecx, 0x678cb0b2
imul eax, ecx
or eax, 0x2462fa26
and eax, 0x7191a5a8
mov ecx, 0x943450c7
xor ecx, 0xde46ff24
cmp eax, ecx
je 0x140066b16
mov eax, dword [0x1401f5ff8]
mov ecx, dword [0x1401f5ffc]
xor ecx, 0xa26f4600
sub eax, ecx
xor eax, 0xdf5649ce
xor ecx, ecx
sub ecx, 0xec12acd6
sub eax, ecx
mov ecx, 0x4c4b74c
xor ecx, 0x95818bcd
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x58]
mov ecx, 0xdce6f10
xor ecx, 0xc0a82970
movabs r8, 0x602367572d402494
sub rdx, r8
movabs r8, 0x836375728f5efc29
movabs r9, 0x7c9c8a8d70a103d9
xor r8, r9
add rdx, r8
movabs r8, 0x99be6e3535601720
movabs r9, 0xf99d0962182033b4
xor r8, r9
add rdx, r8
mov qword [rsp + 0x40], rdx
mov rdx, qword [rdx]
mov qword [rsp + 0x48], rdx
cmp rdx, 0x10
setb dl
mov byte [rsp + 0x57], dl
cmp eax, ecx
je 0x1400669b9
mov cl, byte [rsp + 0x57]
mov al, 1
test cl, 1
mov byte [rsp + 0x3f], al
jne 0x140066ad8
jmp 0x140066a74
mov r8, qword [rsp + 0x48]
mov rax, r8
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x30], rax
mov rdx, rax
and rdx, r8
shl rdx, 1
mov rcx, rax
add rcx, r8
sub rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x140066ab5
jmp 0x140066ac5
call fcn.140009cc0
xor eax, eax
mov byte [rsp + 0x67], al
jmp 0x140066b03
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x3f], al
mov rdx, qword [rsp + 0x40]
mov cl, byte [rsp + 0x57]
mov rax, qword [rsp + 0x58]
mov r8b, byte [rsp + 0x3f]
mov byte [rsp + 0x2f], r8b
mov r8, qword [rax]
and cl, 1
call fcn.140010b90
mov al, byte [rsp + 0x2f]
mov byte [rsp + 0x67], al
mov al, byte [rsp + 0x67]
cmp al, 0
setne al
and al, 1
movzx eax, al
add rsp, 0x68
ret
sub dword [rdx], eax
retf 0xe98e
Function at 0x140067b30
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov dword [rbp - 0xc], edx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401f60b8]
xor eax, dword [0x1401f60bc]
mov ecx, 0xd32c676
xor edx, edx
div ecx
mov r8d, 0xb8424da
xor r8d, 0xe5607ba5
mov ecx, 0xda7c6368
xor ecx, 0x25839c97
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xeee45f7f
or eax, 0xeee45f7f
imul eax, edx
add eax, ecx
and eax, 0x8d55334a
cmp eax, 0x8c29c1e9
jae 0x140067c80
mov ecx, dword [rbp - 0xc]
mov eax, dword [0x1401f60c0]
mov edx, dword [0x1401f60c4]
xor edx, 0x6342003
add eax, edx
or eax, 0xec3ea98e
mov edx, 0x854653a3
imul rax, rdx
shr rax, 0x3e
xor eax, 0x203bfd2e
mov dword [rbp - 0x14], eax
mov eax, 0x800b75d2
mov dword [rbp - 0x18], eax
mov eax, 0x10
mov qword [rbp - 0x38], rax
call fcn.1401f2390
sub rsp, rax
mov rax, qword [rbp - 0x38]
mov rdx, rsp
mov qword [rbp - 0x28], rdx
call fcn.1401f2390
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov rdx, rsp
mov qword [rbp - 0x30], rdx
mov dword [rax], ecx
sub rsp, 0x20
call fcn.140067645
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov dword [rcx], 0
sub rsp, 0x20
call fcn.140067c89
mov rdx, qword [rbp - 0x20]
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0x14]
add rsp, 0x20
cmp byte [rdx], 0
sete dl
mov byte [rbp - 0xd], dl
cmp eax, ecx
je 0x140067ba3
mov al, byte [rbp - 0xd]
test al, 1
jne 0x140067c64
jmp 0x140067c7b
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x30]
mov edx, dword [rax]
sub rsp, 0x20
call fcn.14003240f
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
cld
jno 0x140067c6e
sbb bh, bh
invalid
Function at 0x140072180
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov ecx, dword [0x1401f65f8]
mov edx, dword [0x1401f65fc]
mov eax, ecx
and eax, eax
xor eax, 0xffffffff
mov r8d, 0xeeb1d987
xor r8d, 0x114e2678
xor eax, r8d
mov r8d, edx
xor r8d, 0xffffffff
or eax, r8d
and edx, edx
xor edx, 0xffffffff
xor ecx, 0xffffffff
mov r8d, 0xe3271cff
xor r8d, 0x1cd8e300
xor edx, r8d
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
xor eax, 0x9e5dc9d0
sub eax, 0x812c03b9
mov ecx, 0x5ac2d719
xor ecx, 0x36b7c722
imul eax, ecx
cmp eax, 0xde9f9e8d
ja 0x1400723a5
mov eax, dword [0x1401f6600]
mov ecx, dword [0x1401f6604]
xor ecx, 0x95d1d2c
sub eax, ecx
mov edx, eax
not edx
and edx, 0x22dc2e49
mov ecx, eax
and ecx, 0x5d23d1b6
imul ecx, edx
mov edx, eax
and edx, 0x22dc2e49
or eax, 0x22dc2e49
imul eax, edx
add eax, ecx
and eax, 0x676d53ee
xor eax, 0x234d5000
mov dword [rbp - 0x24], eax
mov eax, 0x10
mov qword [rbp - 0x50], rax
call fcn.1401f2390
sub rsp, rax
mov rax, qword [rbp - 0x50]
mov rcx, rsp
mov qword [rbp - 0x40], rcx
call fcn.1401f2390
sub rsp, rax
mov rax, qword [rbp - 0x50]
mov rcx, rsp
mov qword [rbp - 0x48], rcx
call fcn.1401f2390
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x38], rax
sub rsp, 0x20
call fcn.140067645
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x40]
add rsp, 0x20
mov r8, rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x30], r8
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14001c672
mov rax, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov rdx, qword [rax]
mov rax, qword [rax + 8]
mov qword [rcx], rdx
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.140067668
mov rcx, qword [rbp - 0x30]
add rsp, 0x20
mov rdx, rax
mov eax, dword [rbp - 0x24]
mov qword [rbp - 0x20], rdx
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0xa0b74ce1
ja 0x140072201
mov cl, byte [rbp - 0x11]
mov al, 1
test cl, 1
mov byte [rbp - 0x51], al
jne 0x14007231d
jmp 0x140072362
mov rcx, qword [rbp - 0x20]
xor eax, eax
mov edx, eax
sub rsp, 0x20
call fcn.140032bca
mov rcx, qword [rbp - 0x30]
add rsp, 0x20
mov al, 1
cmp byte [rcx], 0
mov byte [rbp - 0x51], al
jne 0x140072362
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x20]
sub rsp, 0x20
call fcn.140072155
mov rax, qword [rbp - 0x30]
add rsp, 0x20
mov al, byte [rax]
mov byte [rbp - 0x51], al
mov rax, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x20]
mov dl, byte [rbp - 0x51]
mov byte [rbp - 0x52], dl
mov dl, 0x4b
xor dl, 0x4b
mov byte [rax], dl
sub rsp, 0x20
call fcn.140067370
mov rax, qword [rbp - 0x30]
add rsp, 0x20
mov al, byte [rax]
mov cl, 0xcf
xor cl, 0xcf
cmp al, cl
jne 0x1400723a0
mov rax, qword [rbp - 0x30]
mov cl, byte [rbp - 0x52]
mov byte [rax], cl
mov rsp, rbp
pop rbp
ret
jmp 0x1295fa132
Function at 0x140072dd0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.140067645
mov rdx, qword [rsp + 0x30]
cmp rdx, 0
jne 0x140072e01
mov rcx, qword [rsp + 0x28]
call fcn.140067a3f
jmp 0x140072e10
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call fcn.140072c85
mov eax, dword [0x1401f6648]
xor eax, 0x34b17a79
mov ecx, dword [0x1401f664c]
xor ecx, 0xd1c3e054
mov edx, 0x7bc9b24e
xor edx, 0x84364db1
xor ecx, edx
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
mov ecx, 0x91415c84
xor edx, edx
div ecx
and eax, 0x443f33ac
mov ecx, 0xf4f75005
xor ecx, 0xe53842f9
xor edx, edx
div ecx
mov ecx, 0x92500662
xor ecx, 0xe1ff1111
cmp eax, ecx
ja 0x140072ea5
mov eax, dword [0x1401f6650]
or eax, dword [0x1401f6654]
mov ecx, 0x79f64ed2
xor ecx, 0x43bb62fe
imul eax, ecx
mov ecx, 0xb8339869
xor edx, edx
div ecx
xor eax, 0x9d5acb35
cmp eax, 0x6db2707e
je 0x140072e6d
add rsp, 0x38
ret
adc ebx, dword [rcx - 0x1a]
and cl, ch
mov edi, 0x66ffffff
nop

Function at 0x1400736d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401f6698]
mov ecx, dword [0x1401f669c]
xor ecx, 0xbe32b438
add eax, ecx
mov ecx, 0xb81b1f21
xor edx, edx
div ecx
mov ecx, 0xcbb7cdd3
xor ecx, 0x5c13d99
add eax, ecx
mov ecx, 0x3977c62d
xor edx, edx
div ecx
mov ecx, 0x7ff6a533
xor ecx, 0xf218a6ff
cmp eax, ecx
je 0x14007382a
mov eax, dword [0x1401f66a0]
mov ecx, dword [0x1401f66a4]
xor eax, ecx
or eax, 0x5259147b
add eax, 0xb3bf0c99
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x8aa62c18
and ecx, 0x3541c3c4
imul ecx, edx
mov edx, eax
and edx, 0x3519c384
or eax, 0x3559c3c4
imul eax, edx
add eax, ecx
mov dword [rbp - 0x18], eax
mov eax, 0x26353858
mov dword [rbp - 0x1c], eax
mov eax, 0x10
call fcn.1401f2390
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
sub rsp, 0x20
call fcn.140067645
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov qword [rbp - 0x28], rax
mov edx, 2
sub rsp, 0x20
call fcn.140067ce0
mov rdx, qword [rbp - 0x28]
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x18]
add rsp, 0x20
cmp byte [rdx], 0
sete dl
mov byte [rbp - 0x11], dl
cmp eax, ecx
jb 0x140073728
mov al, byte [rbp - 0x11]
test al, 1
jne 0x1400737d8
jmp 0x140073825
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax]
sub rsp, 0x20
call fcn.140072852
mov rax, qword [rbp - 0x28]
add rsp, 0x20
cmp byte [rax], 0
jne 0x140073825
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax + 8]
mov qword [rdx], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140068bc0
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
and al, 0x7e
pop rsp
jmp 0x140073728