joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401dbb40
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
call fcn.1401dbd66
mov rcx, qword [rsp + 0x40]
cmp rcx, 0
je 0x1401dbd57
mov rax, qword [rsp + 0x40]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x30], rcx
mov rax, qword [rax - 0x10]
mov qword [rsp + 0x38], rax
cmp rax, 0x10
jb 0x1401dbd36
mov ecx, dword [0x140257e48]
mov edx, dword [0x140257e4c]
xor edx, 0x80556863
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
mov ecx, eax
and ecx, 0xc50db177
shl ecx, 1
xor eax, 0xc50db177
add eax, ecx
mov ecx, 0xbe7dbc8f
xor edx, edx
div ecx
mov r11d, eax
mov ecx, r11d
xor ecx, 0xffffffff
mov edx, 0x13dd4899
xor edx, 0x3ef617cf
mov eax, 0x82f7ecd9
xor eax, 0x7d081326
xor edx, eax
mov r8d, 0xffffffff
xor r8d, 0x19fccc62
mov eax, ecx
and eax, 0x19fccc62
and r11d, r8d
mov r9d, edx
and r9d, 0x19fccc62
mov r10d, 0xcc24f326
xor r10d, 0xe10fac70
and r10d, r8d
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, edx
mov edx, 0xf8cd6cd0
xor edx, 0x732932f
xor ecx, edx
mov edx, 0x574535f
xor edx, 0x1c889f3d
or edx, r8d
and ecx, edx
or eax, ecx
cmp eax, 0xaa131cc2
jae 0x1401dbd5d
mov r8, qword [rsp + 0x38]
mov eax, dword [0x140257e50]
xor eax, 0xc1331c47
xor eax, dword [0x140257e54]
mov ecx, 0x8b104f81
xor ecx, 0x1661e7ad
sub eax, ecx
mov ecx, 0x68b67e53
xor ecx, 0x380dd95e
xor edx, edx
div ecx
xor eax, 0x45a5c1cc
movabs rdx, 0x3ff988a240ec5fee
movabs rcx, 0xc006775dbf13a01e
xor rdx, rcx
mov rcx, r8
add rcx, rdx
mov qword [rsp + 0x20], rcx
mov rdx, rcx
xor rdx, r8
movabs r8, 0x7b0564e7a89c6a3b
movabs r9, 0x7b0564e7a89c6a3b
xor r8, r9
cmp rdx, r8
setl r8b
cmp rcx, 0xffffffffffffffff
setg cl
xor cl, 0xff
mov dl, 1
xor dl, 0
xor r8b, dl
mov dl, 1
xor dl, 0
xor r9d, r9d
xor r9b, 1
xor dl, r9b
or cl, r8b
or dl, 1
xor cl, 0xff
and cl, dl
mov byte [rsp + 0x2f], cl
cmp eax, 0xf4431922
je 0x1401dbc3c
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1401dbd05
jmp 0x1401dbd0f
call fcn.140008c92
jmp 0x1401dbd57
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rdx], rcx
mov r8, qword [rax]
mov cl, 1
xor cl, 1
and cl, 1
call fcn.14000fe77
jmp 0x1401dbd57
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rax]
mov ecx, 1
call fcn.14000fe77
mov rcx, qword [rsp + 0x40]
call fcn.14000ff4b
nop
add rsp, 0x48
ret
out 0x63, eax
imul ebp, ecx, 0xfffffed6
Function at 0x1401dc170
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x57], al
je 0x1401dc302
mov rax, qword [rsp + 0x48]
mov rcx, rax
and rcx, 0xfffffffffffffff0
shl rcx, 1
xor rax, 0xfffffffffffffff0
add rax, rcx
mov qword [rsp + 0x38], rax
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
mov al, 1
cmp rcx, 0x10
mov byte [rsp + 0x57], al
jb 0x1401dc302
mov r8, qword [rsp + 0x40]
mov rax, r8
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x30], rax
movabs rcx, 0x8a973a978d640ee6
movabs rdx, 0x7568c568729bf119
xor rcx, rdx
mov rdx, rax
xor rdx, rcx
mov rcx, r8
and rcx, rdx
movabs rdx, 0x601f3dc073ce39f0
movabs r9, 0x9fe0c23f8c31c60f
xor rdx, r9
xor r8, rdx
mov rdx, rax
and rdx, r8
or rcx, rdx
cmp rcx, 0
setl cl
movabs rdx, 0x86c40a1f194c2e1b
movabs r8, 0x793bf5e0e6b3d1e4
xor rdx, r8
cmp rax, rdx
setg al
and al, cl
test al, 1
jne 0x1401dc247
jmp 0x1401dc2ef
mov eax, dword [0x140257e78]
mov edx, dword [0x140257e7c]
mov ecx, 0x455328e2
xor ecx, 0x14194d01
xor edx, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
mov ecx, eax
and ecx, 0x92e5247c
shl ecx, 1
xor eax, 0x92e5247c
add eax, ecx
mov ecx, eax
and ecx, 0xf24baeab
shl ecx, 1
add eax, 0xf24baeab
sub eax, ecx
imul eax, eax, 0x8c8307d5
cmp eax, 0x8c6e9dd4
ja 0x1401dc310
mov eax, dword [0x140257e80]
xor eax, dword [0x140257e84]
mov ecx, 0x2d47417
xor ecx, 0xac535e3f
imul eax, ecx
mov ecx, 0xb9857ca6
xor ecx, 0xfd4464c7
imul eax, ecx
mov ecx, 0x1565521b
xor edx, edx
div ecx
mov dword [rsp + 0x2c], eax
call fcn.140008c92
mov eax, dword [rsp + 0x2c]
cmp eax, 0x444335bc
je 0x1401dc29b
xor eax, eax
mov byte [rsp + 0x57], al
jmp 0x1401dc302
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x57], al
mov al, byte [rsp + 0x57]
and al, 1
movzx eax, al
add rsp, 0x58
ret
movabs byte [0xffffff82e931299f], al
ret
Function at 0x1401df920
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x47], al
je 0x1401dfadf
mov rax, qword [rsp + 0x38]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax - 0x10]
mov qword [rsp + 0x30], rcx
mov al, 1
cmp rcx, 0x10
mov byte [rsp + 0x47], al
jb 0x1401dfadf
mov rdx, qword [rsp + 0x30]
mov rax, rdx
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x20], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
movabs rdx, 0x6a7bc500b33fe2cf
movabs r8, 0x95843aff4cc01d30
xor rdx, r8
cmp rax, rdx
setg al
and al, cl
test al, 1
jne 0x1401df9ad
jmp 0x1401df9bd
call fcn.140008c92
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x1401dfadf
mov ecx, dword [0x140258050]
mov eax, 0x606d66d4
xor eax, 0xe60e4cef
xor ecx, eax
mov edx, dword [0x140258054]
mov eax, ecx
xor eax, edx
mov r8d, 0x2df3b3aa
xor r8d, 0xd20c4c55
xor edx, r8d
and ecx, edx
shl ecx, 1
sub ecx, eax
mov eax, ecx
and eax, eax
xor eax, 0xffffffff
mov edx, 0x91673c51
xor edx, 0xbb3f1a6c
and eax, edx
mov edx, 0xaa5a52f2
xor edx, 0x55a5ad0d
xor eax, edx
mov edx, 0xffffffff
xor edx, 0x2a58263d
mov r8d, 0xffffffff
xor r8d, 0x2a58263d
or edx, r8d
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
or eax, eax
xor eax, 0xffffffff
mov ecx, 0x6ad5d9bd
xor ecx, 0x40e1538f
mov edx, 0xb67fcc99
xor edx, 0x9c4b46ab
or ecx, edx
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0x3b1dac8e
xor ecx, 0xc4e25371
xor eax, ecx
mov ecx, 0x3a05b8ec
xor ecx, 0x56894c63
xor edx, edx
div ecx
mov ecx, 0x7b2d2122
xor ecx, 0x92b6aeb0
cmp eax, ecx
jae 0x1401dfaed
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x140258058]
mov r8d, dword [0x14025805c]
xor edx, edx
sub edx, eax
xor eax, eax
sub eax, r8d
add edx, eax
xor eax, eax
sub eax, edx
xor eax, 0xf24baeab
imul eax, eax, 0x8c8307d5
mov r8d, 0x742c80b9
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x20]
mov qword [rcx], rdx
cmp eax, 0x51c38e6f
jae 0x1401dfa8a
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x1401dfadf
mov al, byte [rsp + 0x47]
and al, 1
movzx eax, al
add rsp, 0x48
ret
movabs eax, dword [0xffffff94e9a03b7c]
nop word cs:[rax + rax]
Function at 0x1401e66b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x140258310]
xor eax, 0x1f95d55c
or eax, dword [str.YTl.]
xor eax, 0x1da37a22
mov edx, eax
xor edx, 0xffffffff
and edx, 0x4018a6ac
mov r8d, 0x7c1d1197
xor r8d, 0x3c05b73b
mov ecx, 0x7f674f0e
xor ecx, 0x8098b0f1
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x4018a6ac
or eax, 0x4018a6ac
imul eax, edx
add eax, ecx
imul eax, eax, 0xcea25c84
mov ecx, 0x56a0e817
xor ecx, 0x1ab85b5e
cmp eax, ecx
jae 0x1401e68a9
mov eax, dword [0x140258318]
imul eax, dword [0x14025831c]
xor ecx, ecx
sub ecx, 0x1d7e9954
add eax, ecx
mov ecx, 0x59f811ad
xor edx, edx
div ecx
mov ecx, 0xf6049082
xor edx, edx
div ecx
mov dword [rsp + 0x30], eax
call fcn.1401e6179
mov rcx, rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax]
call fcn.1401e61a0
mov cl, al
mov eax, dword [rsp + 0x30]
mov byte [rsp + 0x37], cl
cmp eax, 0x7f2c044a
jae 0x1401e672d
mov al, byte [rsp + 0x37]
test al, 1
jne 0x1401e679a
jmp 0x1401e67d9
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call fcn.1401e6599
mov rax, qword [rsp + 0x28]
cmp byte [rax], 0
jne 0x1401e67e6
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
movabs rdx, 0xfea3c7c9a3684c96
movabs rax, 0xfea3c7c9a3684c9e
xor rdx, rax
call fcn.14000ef30
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov qword [rax], rcx
mov eax, dword [0x140258320]
mov ecx, dword [0x140258324]
mov edx, 0xc1177191
xor edx, 0xbb7a5f5e
xor ecx, edx
xor edx, edx
div ecx
and eax, 0xfdc657ff
mov ecx, 0xcc558f30
xor ecx, 0x33aa70cf
xor eax, ecx
mov edx, 0xffffffff
xor edx, 0x46beff55
mov ecx, 0xffffffff
xor ecx, 0xe005c942
or eax, edx
or ecx, 0xe005c942
xor eax, 0xffffffff
and eax, ecx
mov ecx, 0xbd518967
xor ecx, 0x50dcc0ab
add eax, ecx
mov ecx, 0x9daee912
xor ecx, 0x13ff78fa
cmp eax, ecx
jbe 0x1401e68b2
mov ecx, dword [0x140258328]
xor ecx, 0x69c0e347
sub ecx, dword [0x14025832c]
mov edx, 0x407c4a4e
xor edx, 0x932aa057
mov eax, 0x9ec521b8
xor eax, 0x613ade47
xor edx, eax
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0xf30a658b
xor ecx, 0x4857e01a
and eax, ecx
add eax, 0xa57850b
cmp eax, 0x215f4675
je 0x1401e6858
add rsp, 0x48
ret
jg 0x1401e6914
lahf
invalid
invalid
sbb al, byte [rdi]
add byte [rbx + 0x71a1715], cl
add byte [rcx], dh
leave
Function at 0x1401e6a30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
call fcn.1401e6179
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx]
call fcn.1401e61a0
test al, 1
jne 0x1401e6a62
jmp 0x1401e6b7e
mov eax, dword [0x140258340]
mov ecx, 0xc1c9f75a
xor ecx, 0x63e21359
xor eax, ecx
mov ecx, dword [0x140258344]
xor ecx, 0xbd25ea59
xor eax, ecx
and eax, 0xf0e5a30b
mov edx, 0x69a3f28b
xor edx, 0x69a3f28a
mov ecx, eax
add ecx, edx
xor eax, 0xffffffff
or eax, 0xbee1a03b
add eax, ecx
xor eax, 0xd34409ab
mov ecx, 0x375f1bfa
xor ecx, 0xc281b00b
cmp eax, ecx
je 0x1401e6c13
mov rax, qword [rsp + 0x38]
mov ecx, dword [0x140258348]
mov r9d, dword [0x14025834c]
mov edx, ecx
xor edx, 0xffffffff
mov r8d, r9d
and r8d, edx
mov edx, 0x2190f7b1
xor edx, 0xde6f084e
mov r10d, r9d
xor r10d, edx
mov edx, ecx
and edx, r10d
imul edx, r8d
mov r8d, ecx
and r8d, r9d
or ecx, r9d
imul ecx, r8d
add ecx, edx
mov edx, 0x626b93ea
xor edx, 0xe2eb6409
xor ecx, edx
or ecx, 0x9864e2e5
mov edx, 0x4b924a38
xor edx, 0x99f99f7e
sub ecx, edx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rax]
call fcn.1401e6310
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x28]
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x95b19a0a
jae 0x1401e6ab9
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1401e6b5a
jmp 0x1401e6c0e
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
movabs rdx, 0xd808dae5deb04a7e
movabs rax, 0xd808dae5deb04a76
xor rdx, rax
call fcn.14000ef30
mov eax, dword [0x140258350]
mov edx, dword [0x140258354]
xor edx, 0xfae4f486
mov ecx, eax
xor ecx, 0xffffffff
and ecx, edx
xor edx, 0xffffffff
and eax, edx
sub eax, ecx
add eax, 0xba965616
xor eax, 0x70d74aa5
add eax, 0x7fd58bdc
cmp eax, 0x124998e9
jb 0x1401e6c1c
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x30]
mov eax, dword [0x140258358]
mov ecx, dword [0x14025835c]
xor ecx, 0xe7fd6b2c
sub eax, ecx
xor ecx, ecx
sub ecx, 0xc79b5369
add eax, ecx
imul eax, eax, 0xb3da722a
mov ecx, 0xa60b3a43
xor ecx, 0xe7d02464
add eax, ecx
mov ecx, 0x3e50031c
xor ecx, 0x5cb91d90
mov qword [rdx], r8
cmp eax, ecx
jb 0x1401e6bb8
jmp 0x1401e6c0e
add rsp, 0x48
ret
mov ds, word [rax]
shl bh, 1
jmp 0x1401e6ab9
xor byte [rcx + rdx - 0x6c16d2], cl
invalid
Function at 0x1401e73a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x47], al
je 0x1401e758c
mov rax, qword [rsp + 0x38]
movabs rcx, 0x75125472950bd751
movabs rdx, 0x8aedab8d6af428a1
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
movabs rdx, 0x27c9354eb3a034e0
movabs rax, 0x27c9354eb3a034f0
xor rdx, rax
mov al, 1
cmp rcx, rdx
mov byte [rsp + 0x47], al
jb 0x1401e758c
mov rdx, qword [rsp + 0x30]
mov rax, rdx
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x20], rax
mov rcx, rax
xor rcx, rdx
movabs rdx, 0x2fa3b235571540a5
movabs r8, 0x2fa3b235571540a5
xor rdx, r8
cmp rcx, rdx
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x1401e7455
jmp 0x1401e7465
call fcn.140008c92
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x1401e758c
mov ecx, dword [0x1402583e8]
mov edx, dword [0x1402583ec]
mov eax, 0xd5d3026f
xor eax, 0xaa94057d
xor edx, eax
mov eax, ecx
xor eax, edx
xor edx, 0xffffffff
and ecx, edx
shl ecx, 1
sub ecx, eax
mov eax, ecx
and eax, eax
xor eax, 0xffffffff
mov edx, 0x11ee6fd0
xor edx, 0x3bb649ed
and eax, edx
mov edx, 0x31db42a9
xor edx, 0xce24bd56
xor eax, edx
mov edx, 0x94b2ff64
xor edx, 0xbeead959
mov r8d, 0x497d73b8
xor r8d, 0xb6828c47
xor edx, r8d
mov r8d, 0xbc60b4e2
xor r8d, 0x963892df
mov r9d, 0x7dd77ee
xor r9d, 0xf8228811
xor r8d, r9d
or edx, r8d
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
mov ecx, 0x30aae7dc
xor ecx, 0xcf551823
xor eax, ecx
or eax, eax
xor eax, 0xffffffff
mov ecx, 0x2a348a32
or ecx, 0x2a348a32
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0x60a1abc1
xor ecx, 0xc2d5f4e
xor edx, edx
div ecx
cmp eax, 0xe99b8f92
jae 0x1401e759a
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1402583f0]
mov r8d, dword [0x1402583f4]
xor edx, edx
sub edx, eax
xor eax, eax
sub eax, r8d
add edx, eax
xor eax, eax
sub eax, edx
xor eax, 0xf24baeab
imul eax, eax, 0x8c8307d5
mov r8d, 0xbb9dcb45
xor r8d, 0xcfb14bfc
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x20]
mov qword [rcx], rdx
cmp eax, 0x51c38e6f
jae 0x1401e7530
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x1401e758c
mov al, byte [rsp + 0x47]
and al, 1
movzx eax, al
add rsp, 0x48
ret
movabs eax, dword [0xffffff8de9a03b7c]
nop word cs:[rax + rax]
Function at 0x1401f00c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xb8
mov qword [rsp + 0x68], rcx
call fcn.1401f07ad
mov qword [rsp + 0x70], rax
add rax, 0x50
mov qword [rsp + 0x60], rax
mov ecx, 0x18
mov edx, 8
call fcn.140012610
mov rcx, qword [rsp + 0x68]
Function at 0x1401f0fe0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov ecx, dword [0x140258788]
mov edx, dword [0x14025878c]
and ecx, ecx
xor ecx, 0xffffffff
mov eax, edx
xor eax, 0xffffffff
xor edx, 0xffffffff
or eax, edx
xor ecx, 0xffffffff
mov edx, 0xe18491e0
xor edx, 0x1e7b6e1f
xor eax, edx
or ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x6dec3534
mov edx, 0xffffffff
xor edx, 0x6dec3534
and ecx, edx
sub ecx, eax
mov eax, 0x921388b1
xor eax, 0x4797903c
imul ecx, eax
mov edx, 0x82041dcd
xor edx, 0x11dacddc
mov eax, ecx
or eax, edx
xor eax, 0xffffffff
mov edx, 0x5267adc7
xor edx, 0xad985238
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0x93ded011
and ecx, edx
or eax, ecx
mov ecx, 0x39992e0d
xor ecx, 0xc666d1f2
xor eax, ecx
cmp eax, 0x852084b4
jbe 0x1401f11ef
mov eax, dword [0x140258790]
mov ecx, 0x9c2bb77f
xor ecx, 0x239bbb3d
xor eax, ecx
sub eax, dword [0x140258794]
add eax, 0xaf737e3a
sub eax, 0xa766feeb
sub eax, 0xaf737e3a
sub eax, 0x221ecf53
mov ecx, 0x44288528
xor ecx, 0xb66ad834
add eax, ecx
add eax, 0x221ecf53
xor ecx, ecx
sub ecx, 0x39ff5d9f
sub eax, ecx
mov dword [rsp + 0x38], eax
mov eax, 0x8462c
xor eax, 0xc5b4e277
mov dword [rsp + 0x34], eax
call fcn.1401f0992
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
call fcn.1401f09ad
mov ecx, dword [rsp + 0x34]
mov dl, al
mov eax, dword [rsp + 0x38]
mov byte [rsp + 0x3f], dl
cmp eax, ecx
jbe 0x1401f1082
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x1401f1118
jmp 0x1401f11ea
mov rcx, qword [rsp + 0x40]
call 0x1401f0ec0
mov rax, qword [rsp + 0x28]
cmp byte [rax], 0
jne 0x1401f11ea
mov eax, dword [0x140258798]
and eax, dword [0x14025879c]
or eax, eax
xor eax, 0xffffffff
mov ecx, 0x7fc8b2e2
or ecx, 0x7fc8b2e2
xor ecx, 0xffffffff
mov edx, 0x58eeb6a4
xor edx, 0xa711495b
xor eax, edx
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0xffffffff
xor ecx, 0xeaafbb2e
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
xor eax, 0x9d1e347f
cmp eax, 0x7fdaf652
je 0x1401f11f8
mov rcx, qword [rsp + 0x40]
mov edx, dword [0x1402587a0]
mov r8d, dword [0x1402587a4]
xor r8d, 0xffffffff
mov eax, edx
xor eax, r8d
and eax, edx
mov r8d, 0xb17ebbe1
xor edx, edx
div r8d
imul eax, eax, 0x56ea9e84
imul eax, eax, 0x526b0abe
mov dword [rsp + 0x24], eax
mov eax, 0x1f95d55c
xor eax, 0xbb442818
mov dword [rsp + 0x20], eax
mov edx, 8
call fcn.14000ef30
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
jae 0x1401f1185
jmp 0x1401f11ea
add rsp, 0x48
ret
nop
add al, 0xd8
jmp 0x1401f1082
sahf
movsd dword [rdi], dword [rsi]
add edx, ebx
jmp 0x1401f1185
Function at 0x1401f1550
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x47], al
je 0x1401f172c
mov rax, qword [rsp + 0x38]
movabs rcx, 0x7736c8163b7734fb
movabs rdx, 0x88c937e9c488cb0b
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
mov al, 1
cmp rcx, 0x10
mov byte [rsp + 0x47], al
jb 0x1401f172c
mov rdx, qword [rsp + 0x30]
mov rax, rdx
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x20], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x1401f15d9
jmp 0x1401f15e9
call fcn.140008c92
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x1401f172c
mov edx, dword [0x140258800]
xor edx, 0xede7b11f
mov ecx, dword [0x140258804]
mov eax, edx
xor eax, ecx
mov r8d, 0xbdb81f36
xor r8d, 0x4247e0c9
xor ecx, r8d
and edx, ecx
mov ecx, 0x5bef7b36
xor ecx, 0x5bef7b34
imul ecx, edx
sub ecx, eax
mov eax, ecx
and eax, eax
xor eax, 0xffffffff
and eax, 0x2a58263d
mov edx, 0xad8eb11d
xor edx, 0x52714ee2
xor eax, edx
mov edx, 0x9f3c5ce
xor edx, 0x23abe3f3
mov r8d, 0x6501080f
xor r8d, 0x9afef7f0
xor edx, r8d
mov r8d, 0xffffffff
xor r8d, 0x2a58263d
or edx, r8d
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
or eax, eax
xor eax, 0xffffffff
mov ecx, 0x22e17cdb
xor ecx, 0x8d5f6e9
mov edx, 0xc33c88ec
xor edx, 0xe90802de
or ecx, edx
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0x6c8cf48f
xor edx, edx
div ecx
cmp eax, 0xe99b8f92
jae 0x1401f173a
mov r8, qword [rsp + 0x20]
mov eax, dword [0x140258808]
mov ecx, 0x12ebbab7
xor ecx, 0xb7c6cd32
xor eax, ecx
mov edx, dword [0x14025880c]
mov ecx, 0x202ceb9
xor ecx, 0x1407b916
xor edx, ecx
xor ecx, ecx
sub ecx, eax
mov eax, 0xbd18897c
xor eax, 0xbd18897c
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
xor eax, 0xf24baeab
imul eax, eax, 0x8c8307d5
mov ecx, 0x596d080b
xor ecx, 0x2d4188b2
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x28]
mov ecx, 0xe3fa6c74
xor ecx, 0xb239e21b
mov qword [rdx], r8
cmp eax, ecx
jae 0x1401f16ab
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x1401f172c
mov al, byte [rsp + 0x47]
and al, 1
movzx eax, al
add rsp, 0x48
ret
movabs eax, dword [0xffffff68e9a03b7c]
nop word cs:[rax + rax]
Function at 0x1401f8150
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x47], al
je 0x1401f82fb
mov rax, qword [rsp + 0x38]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax - 0x10]
mov qword [rsp + 0x30], rcx
mov al, 1
cmp rcx, 0x10
mov byte [rsp + 0x47], al
jb 0x1401f82fb
mov rdx, qword [rsp + 0x30]
mov rax, rdx
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x20], rax
mov rcx, rax
xor rcx, rdx
movabs rdx, 0xa00672ab37d3c415
movabs r8, 0xa00672ab37d3c415
xor rdx, r8
cmp rcx, rdx
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x1401f81dd
jmp 0x1401f81ed
call fcn.140008c92
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x1401f82fb
mov ecx, dword [0x140258ab8]
xor ecx, 0x14ee971a
mov edx, dword [0x140258abc]
mov eax, ecx
xor eax, edx
xor edx, 0xffffffff
and ecx, edx
shl ecx, 1
sub ecx, eax
mov eax, ecx
and eax, eax
mov edx, 0x19f1df76
xor edx, 0xe60e2089
xor eax, edx
and eax, 0x2a58263d
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x2a58263d
mov r8d, 0xffffffff
xor r8d, 0x2a58263d
or edx, r8d
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
mov ecx, 0x1d635103
xor ecx, 0xe29caefc
xor eax, ecx
or eax, eax
xor eax, 0xffffffff
mov ecx, 0x519335bc
xor ecx, 0x7ba7bf8e
mov edx, 0xf2966470
xor edx, 0xd8a2ee42
or ecx, edx
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0x21a48919
xor ecx, 0x4d287d96
xor edx, edx
div ecx
cmp eax, 0xe99b8f92
jae 0x1401f8309
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x140258ac0]
mov r8d, dword [0x140258ac4]
xor r8d, 0xe13ce47f
xor edx, edx
sub edx, eax
xor eax, eax
sub eax, r8d
add edx, eax
xor eax, eax
sub eax, edx
xor eax, 0xf24baeab
mov edx, 0xe543fc36
xor edx, 0x69c0fbe3
imul eax, edx
mov r8d, 0x742c80b9
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x20]
mov qword [rcx], rdx
cmp eax, 0x51c38e6f
jae 0x1401f8297
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x1401f82fb
mov al, byte [rsp + 0x47]
and al, 1
movzx eax, al
add rsp, 0x48
ret
movabs eax, dword [0xffffff85e9a03b7c]
nop word cs:[rax + rax]
Function at 0x1401fde90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov eax, dword [0x140258c98]
and eax, dword [0x140258c9c]
mov ecx, 0x4b5aa36
xor ecx, 0x69c3135f
xor edx, edx
div ecx
mov ecx, eax
mov eax, 0xadc987d3
xor eax, 0x101bad3f
or ecx, eax
mov eax, ecx
and eax, 0xb6e4e326
xor ecx, 0xb6e4e326
or eax, ecx
cmp eax, 0x8331f5c0
jb 0x1401fdf92
mov eax, dword [0x140258ca0]
sub eax, dword [0x140258ca4]
add eax, 0xe428e7c3
sub eax, 0xd2fbcd53
mov ecx, 0x4eeb6acb
xor ecx, 0x84664892
xor eax, ecx
mov dword [rsp + 0x3c], eax
call fcn.140207877
mov rdx, qword [rsp + 0x48]
mov eax, dword [rsp + 0x3c]
xor ecx, ecx
test rdx, rdx
cmovg rcx, rdx
mov qword [rsp + 0x40], rcx
cmp eax, 0xdaf9f039
je 0x1401fdee1
xor eax, eax
mov qword [rsp + 0x30], rax
jmp 0x1401fdf3b
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp rax, rcx
je 0x1401fdf8d
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov dl, 0x97
xor dl, 0x97
mov byte [rcx + rax], dl
movabs rcx, 0x517fe72f211acd1
add rax, rcx
add rax, 1
movabs rcx, 0x517fe72f211acd1
sub rax, rcx
mov qword [rsp + 0x30], rax
jmp 0x1401fdf3b
add rsp, 0x58
ret
mov edi, 0xe94fa60a
invalid
Function at 0x140204a70
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0xe0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], rcx
mov eax, 0x10
mov qword [rbp + 8], rax
call fcn.14024abd0
sub rsp, rax
mov rax, qword [rbp + 8]
mov rcx, rsp
mov qword [rbp + 0x10], rcx
call fcn.14024abd0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x18], rax
sub rsp, 0x20
call fcn.140207877
mov rcx, qword [rbp + 0x20]
add rsp, 0x20
mov qword [rbp + 0x30], rax