joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14013e0fd
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x18], r8
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401f3500]
mov edx, dword [0x1401f3504]
mov ecx, 0x717cbc4b
xor ecx, 0x42b5a7f4
xor edx, ecx
xor ecx, ecx
sub ecx, eax
mov eax, 0x1f3822cb
xor eax, 0x1f3822cb
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov r8d, 0xffffffff
xor r8d, 0xa6432672
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0xda722c46
xor r8d, 0x7c310a34
mov edx, eax
and edx, r8d
or eax, 0xa6432672
imul eax, edx
add eax, ecx
add eax, 0xc9a5001f
or eax, 0x78a07c73
cmp eax, 0x163e7244
je 0x140006092
mov eax, 0x1a817a58
mov dword [rbp - 0x2c], eax
mov eax, 0x10
call fcn.1401f2390
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
sub rsp, 0x20
call fcn.140005df8
add rsp, 0x20
mov qword [rbp - 0x38], rax
mov ecx, 0x3e88
sub rsp, 0x20
call fcn.140005a20
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov rdx, rax
mov eax, dword [rbp - 0x2c]
mov qword [rbp - 0x28], rdx
mov cl, byte [rcx]
mov dl, 0x8f
xor dl, 0x8f
cmp cl, dl
sete cl
mov byte [rbp - 0x19], cl
cmp eax, 0x10f5c389
jbe 0x140005f03
mov al, byte [rbp - 0x19]
test al, 1
jne 0x140005f7a
jmp 0x14000608d
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x28]
mov qword [rcx], rax
add rcx, 0x18
sub rsp, 0x20
call fcn.1400d4860
mov rax, qword [rbp - 0x38]
add rsp, 0x20
mov al, byte [rax]
mov cl, 0x4c
xor cl, 0x4c
cmp al, cl
jne 0x14000608d
mov r9, qword [rbp - 8]
mov r10, qword [rbp - 0x40]
mov rax, qword [rbp - 0x10]
mov qword [r9 + 0x10], rax
mov dword [r10], 0
mov rax, qword [str.pP__]
mov rax, qword [rax]
mov edx, 0x8f5efc29
xor edx, 0x8f410c29
mov r11d, 0xede41e2d
xor r11d, 0xede41e2d
xor ecx, ecx
lea r8, [0x140005e13]
sub rsp, 0x30
mov dword [rsp + 0x20], r11d
mov qword [rsp + 0x28], r10
call rax
mov rcx, qword [rbp - 8]
add rsp, 0x30
mov qword [rcx + 8], rax
cmp rax, 1
jge 0x14000608d
mov ecx, 0x40
mov edx, 8
sub rsp, 0x20
call fcn.140013970
add rsp, 0x20
mov rcx, rax
mov rax, qword [0x140209158]
mov qword [rcx], rax
lea rax, str.neFJ_
mov qword [rcx + 0x10], rax
mov rax, qword [0x140201320]
mov qword [rcx + 0x18], rax
mov rax, qword [0x140201328]
mov qword [rcx + 0x20], rax
mov qword [rcx + 8], 0
lea rdx, str.neFJ_
lea r8, str._rG__nQ__
lea r9, str.HyWL6K__
sub rsp, 0x30
mov qword [rsp + 0x20], 0x6b9296b2
call fcn.14001302b
add rsp, 0x30
mov rsp, rbp
pop rbp
ret
sub dword [rdx], eax
retf 0xe98e
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
call fcn.14016c2bc
mov r8, qword [rsp + 0x20]
lea rcx, [0x14027acf0]
lea rdx, [0x14013de70]
add rsp, 0x28
jmp 0x140005e70
Function at 0x140156de0
Capabilities:
Check for software breakpoints

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rcx
mov r11d, dword [0x1401fc588]
mov r10d, dword [0x1401fc58c]
xor r10d, 0xc49dc518
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, r10d
xor r8d, 0xffffffff
mov edx, 0xdb0a5dd0
xor edx, 0x98562617
mov eax, 0x2c2cbddc
xor eax, 0xd3d34223
xor edx, eax
mov eax, ecx
and eax, 0x435c7bc7
and r11d, edx
mov r9d, r8d
and r9d, 0x435c7bc7
and r10d, edx
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
xor ecx, 0xffffffff
or edx, 0x435c7bc7
and ecx, edx
or eax, ecx
mov ecx, 0xb3e7b3ba
xor ecx, 0x4591934b
xor edx, edx
div ecx
xor ecx, ecx
sub ecx, eax
mov eax, 0xf1653ed0
xor eax, 0xf1653ed0
mov edx, 0xcf590cc2
xor edx, 0xbddb547d
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
add eax, 0xc22ccbe8
cmp eax, 0xaf400fc6
je 0x140156fa9
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401fc590]
mov r8d, dword [0x1401fc594]
and eax, eax
mov edx, 0x53d10f55
xor edx, 0xac2ef0aa
xor eax, edx
mov edx, r8d
xor edx, 0xffffffff
xor r8d, 0xffffffff
or edx, r8d
and eax, edx
xor eax, 0xffffffff
and eax, 0x6e123f12
mov edx, eax
or edx, edx
mov r8d, 0x14967df4
xor r8d, 0xeb69820b
xor edx, r8d
mov r8d, 0x7fa3de0d
or r8d, 0x7fa3de0d
xor r8d, 0xffffffff
or edx, r8d
xor edx, 0xffffffff
or eax, 0x7fa3de0d
mov r8d, 0xc67ec30f
xor r8d, 0x39813cf0
xor eax, r8d
mov r8d, 0x4daa11f0
xor r8d, 0xb255ee0f
xor edx, r8d
xor eax, 0xffffffff
and edx, eax
mov eax, edx
xor eax, 0xffffffff
mov r8d, 0xa363f7c2
xor r8d, 0xf126eb49
mov r9d, 0xb5f8be9
xor r9d, 0xf4a07416
xor r8d, r9d
or eax, r8d
and edx, 0x52451c8b
xor edx, 0xffffffff
and eax, edx
mov edx, 0xd8a305be
xor edx, 0x275cfa41
xor eax, edx
mov dword [rsp + 0x24], eax
mov eax, 0x8de96d67
xor eax, 0xbddfb87
mov dword [rsp + 0x20], eax
movabs rdx, 0x1f0739775a2d9a27
movabs rax, 0x1f0739775a2d9a3f
xor rdx, rax
call fcn.140139340
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
jae 0x140156fa9
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
out dx, eax
cmp al, 0xcc
xchg ebp, eax
jmp 0x140156e97
Function at 0x14016e260
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x57], al
je 0x14016e41d
mov rax, qword [rsp + 0x48]
movabs rcx, 0xb101cddc0e24f22a
movabs rdx, 0x4efe3223f1db0dda
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x38], rax
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
mov al, 1
cmp rcx, 0x10
mov byte [rsp + 0x57], al
jb 0x14016e41d
mov r8d, dword [0x1401fcfe0]
mov edx, dword [0x1401fcfe4]
xor edx, 0xc4368eb
mov ecx, edx
xor ecx, 0xffffffff
mov eax, r8d
and eax, ecx
mov ecx, r8d
xor ecx, edx
add r8d, ecx
sub r8d, eax
mov eax, r8d
xor eax, 0xffffffff
and eax, 0xedf854e8
mov r9d, 0xffffffff
xor r9d, 0xedf854e8
and r8d, r9d
mov ecx, 0xffffffff
xor ecx, 0x1fc8950e
mov edx, 0x6e47dfb2
xor edx, 0x83bf8b5a
and ecx, edx
mov edx, 0xb313a396
xor edx, 0xacdb3698
and edx, r9d
or eax, r8d
or ecx, edx
xor eax, ecx
imul eax, eax, 0xd8ab2d75
mov ecx, 0xee6c0d48
xor ecx, 0xca0ef76e
or eax, ecx
cmp eax, 0x61f2537b
ja 0x14016e42b
mov r9, qword [rsp + 0x40]
mov eax, dword [0x1401fcfe8]
mov ecx, 0xcd5066d
xor ecx, 0xd217f38e
xor eax, ecx
xor eax, dword [0x1401fcfec]
xor ecx, ecx
sub ecx, 0x1f448a0b
add eax, ecx
xor eax, 0xdf5649ce
sub eax, 0x2d402494
add eax, 0xec12acd6
add eax, 0x2d402494
mov rcx, r9
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x28], rcx
mov r8, rcx
and r8, r9
shl r8, 1
mov rdx, rcx
add rdx, r9
sub rdx, r8
movabs r8, 0xa948a606750f975b
movabs r9, 0xa948a606750f975b
xor r8, r9
cmp rdx, r8
setl dl
movabs r8, 0xca9102d0e80ec6e2
movabs r9, 0x356efd2f17f1391d
xor r8, r9
cmp rcx, r8
setg cl
and cl, dl
mov byte [rsp + 0x37], cl
cmp eax, 0xd9c0228f
jae 0x14016e343
mov al, byte [rsp + 0x37]
test al, 1
jne 0x14016e3fa
jmp 0x14016e40a
call fcn.140009cc0
xor eax, eax
mov byte [rsp + 0x57], al
jmp 0x14016e41d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x57], al
mov al, byte [rsp + 0x57]
and al, 1
movzx eax, al
add rsp, 0x58
ret
sub dword [rdx], eax
retf 0xe98e
Function at 0x1401810a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
mov eax, dword [0x1401fd740]
xor eax, 0xc0ce5dd8
and eax, dword [0x1401fd744]
mov ecx, 0xee0e5877
xor ecx, 0xbc3988f0
xor edx, edx
div ecx
or eax, 0x45091321
mov ecx, eax
and ecx, 0x66bb2c67
shl ecx, 1
xor eax, 0x66bb2c67
add eax, ecx
cmp eax, 0x2d5b4356
jb 0x14018130d
cld
add eax, 0xd5e9e553
std
invalid
Function at 0x140191270
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x57], al
je 0x140191446
mov rax, qword [rsp + 0x48]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x38], rcx
mov rcx, qword [rax - 0x10]
mov qword [rsp + 0x40], rcx
movabs rdx, 0x19aad38b19534d73
movabs rax, 0x19aad38b19534d63
xor rdx, rax
mov al, 1
cmp rcx, rdx
mov byte [rsp + 0x57], al
jb 0x140191446
mov r8d, dword [0x1401fddb0]
xor r8d, 0x53ef1339
mov edx, dword [0x1401fddb4]
mov eax, 0x1341c045
xor eax, 0xecbe3fba
mov ecx, edx
xor ecx, eax
mov eax, r8d
and eax, ecx
mov ecx, r8d
xor ecx, edx
add r8d, ecx
sub r8d, eax
mov ecx, 0xf0e95e02
xor ecx, 0xf16a1fd
mov eax, r8d
xor eax, ecx
and eax, 0xedf854e8
mov edx, 0xffffffff
xor edx, 0xedf854e8
and r8d, edx
mov ecx, 0xffffffff
xor ecx, 0x1fc8950e
and ecx, 0xedf854e8
and edx, 0x1fc8950e
or eax, r8d
or ecx, edx
xor eax, ecx
imul eax, eax, 0xd8ab2d75
mov ecx, 0x40c7badf
xor ecx, 0x64a540f9
or eax, ecx
cmp eax, 0x61f2537b
ja 0x140191454
mov r9, qword [rsp + 0x40]
mov eax, dword [0x1401fddb8]
mov ecx, dword [0x1401fddbc]
mov edx, 0x71a21bbb
xor edx, 0x7620bc41
xor ecx, edx
xor eax, ecx
xor ecx, ecx
sub ecx, 0x1f448a0b
add eax, ecx
xor eax, 0xdf5649ce
sub eax, 0x2d402494
mov ecx, 0x9366c01b
xor ecx, 0x7f746ccd
add eax, ecx
mov ecx, 0x99c1e15
xor ecx, 0x24dc3a81
add eax, ecx
movabs rdx, 0x8a3bfde0ab8f857
movabs rcx, 0xf75c4021f54707a7
xor rdx, rcx
mov rcx, r9
add rcx, rdx
mov qword [rsp + 0x28], rcx
mov r8, rcx
and r8, r9
shl r8, 1
mov rdx, rcx
add rdx, r9
sub rdx, r8
cmp rdx, 0
setl dl
movabs r8, 0x76224c9c26e4a322
movabs r9, 0x89ddb363d91b5cdd
xor r8, r9
cmp rcx, r8
setg cl
and cl, dl
mov byte [rsp + 0x37], cl
cmp eax, 0xd9c0228f
jae 0x14019135a
mov al, byte [rsp + 0x37]
test al, 1
jne 0x140191423
jmp 0x140191433
call fcn.140009cc0
xor eax, eax
mov byte [rsp + 0x57], al
jmp 0x140191446
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x57], al
mov al, byte [rsp + 0x57]
and al, 1
movzx eax, al
add rsp, 0x58
ret
sub dword [rdx], eax
retf 0xe98e
Function at 0x1401a98f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov qword [rsp + 0x40], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x4f], al
je 0x1401a9b15
mov rax, qword [rsp + 0x40]
movabs rcx, 0x836375728f5efc29
movabs rdx, 0x67430561732614c2
xor rcx, rdx
sub rax, rcx
movabs rcx, 0x99be6e3535601720
movabs rdx, 0x664191caca9fe8d0
xor rcx, rdx
add rax, rcx
movabs rcx, 0xe4207013fc78e8eb
add rax, rcx
mov qword [rsp + 0x30], rax
mov rcx, qword [rax]
mov qword [rsp + 0x38], rcx
movabs rdx, 0xe4042155bcac9f36
movabs rax, 0xe4042155bcac9f26
xor rdx, rax
mov al, 1
cmp rcx, rdx
mov byte [rsp + 0x4f], al
jb 0x1401a9b15
mov r8, qword [rsp + 0x38]
xor eax, eax
mov ecx, eax
sub rcx, r8
xor eax, eax
sub rax, 0xfffffffffffffff0
add rcx, rax
xor eax, eax
sub rax, rcx
mov qword [rsp + 0x28], rax
mov rdx, rax
xor rdx, 0xffffffffffffffff
movabs rcx, 0xd8566cfd7f0cb531
movabs r9, 0x5e8d15af92f4e1d9
xor rcx, r9
and rcx, rdx
mov r10, 0xffffffffffffffff
movabs rdx, 0x86db7952edf854e8
xor r10, rdx
mov r9, rax
and r9, r10
mov rdx, r8
xor rdx, 0xffffffffffffffff
movabs r11, 0x856f8e295a02fe9d
movabs rsi, 0x3b4f77bb7faaa75
xor r11, rsi
and rdx, r11
and r8, r10
or rcx, r9
or rdx, r8
xor rcx, rdx
movabs rdx, 0x784656004cc57396
movabs r8, 0x784656004cc57396
xor rdx, r8
cmp rcx, rdx
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x1401a9a3d
jmp 0x1401a9a4d
call fcn.140009cc0
xor eax, eax
mov byte [rsp + 0x4f], al
jmp 0x1401a9b15
mov ecx, dword [0x1401fe810]
mov eax, dword [0x1401fe814]
mov edx, 0x704b5a38
xor edx, 0xc88bf762
xor eax, edx
sub ecx, eax
mov eax, 0xe3088d3e
xor eax, 0xa6a5a9cd
or ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x1fc8950e
mov edx, 0xffffffff
xor edx, 0x1fc8950e
and ecx, edx
or eax, ecx
imul eax, eax, 0xd8ab2d75
cmp eax, 0xfc4c2b3a
je 0x1401a9b24
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x28]
mov eax, dword [0x1401fe818]
mov ecx, dword [0x1401fe81c]
mov r9d, 0x77e3aeb6
xor r9d, 0x5aa38a22
sub eax, r9d
sub eax, ecx
mov ecx, 0x62f019fe
xor ecx, 0x4fb03d6a
add eax, ecx
mov ecx, 0xaef732c2
xor ecx, 0x59bfc338
xor eax, ecx
add eax, 0x9dcfe29e
sub eax, 0x1f448a0b
sub eax, 0x9dcfe29e
xor eax, 0xdf5649ce
mov ecx, 0xbe2d4b77
xor ecx, 0xdafcbc19
mov qword [rdx], r8
cmp eax, ecx
jbe 0x1401a9a9e
xor eax, eax
mov byte [rsp + 0x4f], al
jmp 0x1401a9b15
mov al, byte [rsp + 0x4f]
and al, 1
movzx eax, al
add rsp, 0x50
pop rsi
ret
sub dword [rdx], eax
retf 0xe98e
Function at 0x1401b3730
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x57], al
je 0x1401b38f3
mov rax, qword [rsp + 0x48]
movabs rcx, 0xca8df111817767d9
movabs rdx, 0x35720eee7e889829
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x38], rax
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
movabs rdx, 0xe85c9c6db2746101
movabs rax, 0xe85c9c6db2746111
xor rdx, rax
mov al, 1
cmp rcx, rdx
mov byte [rsp + 0x57], al
jb 0x1401b38f3
mov r8d, dword [0x1401fece0]
mov edx, dword [0x1401fece4]
mov ecx, edx
xor ecx, 0xffffffff
mov eax, r8d
and eax, ecx
mov ecx, r8d
xor ecx, edx
add r8d, ecx
sub r8d, eax
mov eax, r8d
xor eax, 0xffffffff
and eax, 0xedf854e8
mov edx, 0xb2ec35c7
xor edx, 0x5f14612f
mov ecx, 0x34750e63
xor ecx, 0xcb8af19c
xor edx, ecx
and r8d, edx
mov ecx, 0xffffffff
xor ecx, 0x1fc8950e
and ecx, 0xedf854e8
and edx, 0x1fc8950e
or eax, r8d
or ecx, edx
xor eax, ecx
imul eax, eax, 0xd8ab2d75
or eax, 0x2462fa26
cmp eax, 0x61f2537b
ja 0x1401b3901
mov r9, qword [rsp + 0x40]
mov eax, dword [0x1401fece8]
mov ecx, 0xdee22f57
xor ecx, 0x8ec1cbe9
xor eax, ecx
xor eax, dword [0x1401fecec]
xor ecx, ecx
sub ecx, 0x1f448a0b
add eax, ecx
mov ecx, 0xfef57e62
xor ecx, 0x21a337ac
xor eax, ecx
mov ecx, 0xe836dee3
xor ecx, 0xc576fa77
sub eax, ecx
mov ecx, 0xd2866f60
xor ecx, 0x3e94c3b6
add eax, ecx
add eax, 0x2d402494
mov rcx, r9
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x28], rcx
mov r8, rcx
and r8, r9
shl r8, 1
mov rdx, rcx
add rdx, r9
sub rdx, r8
cmp rdx, 0
setl dl
movabs r8, 0xb9ac30ed1e1e1233
movabs r9, 0x4653cf12e1e1edcc
xor r8, r9
cmp rcx, r8
setg cl
and cl, dl
mov byte [rsp + 0x37], cl
cmp eax, 0xd9c0228f
jae 0x1401b3817
mov al, byte [rsp + 0x37]
test al, 1
jne 0x1401b38d0
jmp 0x1401b38e0
call fcn.140009cc0
xor eax, eax
mov byte [rsp + 0x57], al
jmp 0x1401b38f3
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x57], al
mov al, byte [rsp + 0x57]
and al, 1
movzx eax, al
add rsp, 0x58
ret
sub dword [rdx], eax
retf 0xe98e
Function at 0x1401bcb80
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
call fcn.1401bcdc9
mov rcx, qword [rsp + 0x40]
cmp rcx, 0
je 0x1401bcdba
mov rax, qword [rsp + 0x40]
movabs rdx, 0x24754c283d2f25d1
movabs rcx, 0xdb8ab3d7c2d0da21
xor rdx, rcx
mov rcx, rax
and rcx, rdx
movabs rdx, 0xc16ac3811a91f1d5
movabs r8, 0xc16ac3811a91f1d7
xor rdx, r8
imul rcx, rdx
xor rax, 0xfffffffffffffff0
add rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp rax, 0x10
jb 0x1401bcd99
mov rdx, qword [rsp + 0x38]
mov rax, rdx
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, rdx
movabs rdx, 0x4fc119b9ce1a385f
movabs r8, 0x4fc119b9ce1a385f
xor rdx, r8
cmp rcx, rdx
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x1401bcc42
jmp 0x1401bcc4c
call fcn.140009cc0
jmp 0x1401bcdba
mov eax, dword [0x1401ff060]
mov ecx, dword [0x1401ff064]
xor ecx, 0xffffffff
mov edx, 0x44238335
xor edx, 0x44238335
mov r8d, 0x84eca551
xor r8d, 0x84eca550
sub edx, r8d
sub ecx, edx
sub eax, ecx
and eax, eax
xor eax, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x828694db
mov edx, 0xffffffff
xor edx, 0x828694db
or ecx, edx
and eax, ecx
mov ecx, 0xef242d2a
xor ecx, 0x10dbd2d5
xor eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
xor eax, 0xffffffff
and ecx, eax
mov eax, 0xffffffff
xor eax, 0x4f37d46d
mov edx, 0xffffffff
xor edx, 0x4f37d46d
and eax, edx
xor ecx, 0xffffffff
mov edx, 0xd25cc13a
xor edx, 0x2da33ec5
xor eax, edx
and ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
mov edx, 0xa986ca8e
xor edx, 0x56793571
xor eax, edx
mov edx, 0xffffffff
xor edx, 0xabbecb34
or eax, edx
mov edx, 0xabbecb34
and edx, 0xabbecb34
xor edx, 0xffffffff
and ecx, edx
mov edx, 0xc4d3da02
xor edx, 0x3b2c25fd
xor ecx, edx
and eax, ecx
xor eax, 0xffffffff
cmp eax, 0xdd15ca30
jb 0x1401bcdc0
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401ff068]
mov edx, dword [0x1401ff06c]
mov r8d, 0x712a26ed
xor r8d, 0x47aaad63
xor edx, r8d
add eax, edx
and eax, 0xbade6d0e
mov r8d, 0x3ed78b3
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x30]
mov r8d, eax
mov rax, qword [rsp + 0x40]
xor r8d, 0xa0063e18
mov dword [rsp + 0x24], r8d
mov qword [rdx], rcx
mov r8, qword [rax]
xor ecx, ecx
call fcn.140010b90
mov eax, dword [rsp + 0x24]
cmp eax, 0x34ca1b9a
jb 0x1401bcd2c
jmp 0x1401bcdba
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rax]
mov ecx, 1
call fcn.140010b90
mov rcx, qword [rsp + 0x40]
call fcn.140010f87
nop
add rsp, 0x48
ret
int 0xf0
invalid
Function at 0x1401bd6c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.1401bce61
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.1401bce80
test al, 1
jne 0x1401bd6ea
jmp 0x1401bd82f
mov rcx, qword [rsp + 0x28]
call fcn.1401bd659
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
jne 0x1401bd82f
mov eax, dword [0x1401ff0c0]
xor edx, edx
div dword [0x1401ff0c4]
mov ecx, 0xf007a786
xor ecx, 0x423597bc
xor edx, edx
div ecx
mov ecx, eax
or ecx, 0x12ee6cda
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x1c3bcb5d
mov edx, 0xab8f857
xor edx, 0x1683330a
mov r8d, 0xf3a9e252
xor r8d, 0xc561dad
xor edx, r8d
and ecx, edx
or eax, ecx
cmp eax, 0x7d1598cf
ja 0x1401bd834
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401ff0c8]
xor eax, 0x26e4a322
sub eax, dword [0x1401ff0cc]
mov edx, eax
and edx, 0xe129992b
shl edx, 1
xor eax, 0xe129992b
add eax, edx
mov edx, eax
and edx, 0x89958330
mov r8d, 0xa23d0914
xor r8d, 0xa23d0916
imul edx, r8d
xor eax, 0x89958330
add eax, edx
mov r8d, 0xed6d5cfa
xor r8d, 0x1292a305
mov edx, eax
xor edx, r8d
mov r8d, 0x36f3f128
xor r8d, 0x7c93a8af
and r8d, edx
mov r9d, 0xf39cff5d
xor r9d, 0xb9fca6da
mov edx, 0xb6515012
xor edx, 0x49aeafed
xor r9d, edx
mov edx, eax
and edx, r9d
imul edx, r8d
mov r8d, eax
and r8d, 0x4a605987
or eax, 0x4a605987
imul eax, r8d
add eax, edx
mov dword [rsp + 0x24], eax
mov eax, 0x4f51c976
xor eax, 0x2862fb44
mov dword [rsp + 0x20], eax
mov edx, 8
call fcn.14000fac0
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
je 0x1401bd75b
jmp 0x1401bd82f
add rsp, 0x38
ret
pop rbp
fcmovbe st(0), st(6)
mov ebp, ecx
invalid
Function at 0x1401bf540
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
mov ecx, dword [0x1401ff1e8]
mov edx, dword [0x1401ff1ec]
mov eax, 0xa3e6bedd
xor eax, 0x5c194122
mov r8d, ecx
xor r8d, eax
mov eax, edx
and eax, r8d
xor edx, 0xffffffff
and ecx, edx
or eax, ecx
imul eax, eax, 0x921443e7
sub eax, 0xc0ae9a14
sub eax, 0x574c22c4
cmp eax, 0xe65b557d
je 0x1401bf676
mov eax, dword [0x1401ff1f0]
mov ecx, dword [0x1401ff1f4]
xor eax, ecx
mov edx, eax
not edx
and edx, 0xf0ae0a65
mov ecx, eax
and ecx, 0xf51f59a
imul ecx, edx
mov edx, eax
and edx, 0xf0ae0a65
or eax, 0xf0ae0a65
imul eax, edx
add eax, ecx
mov edx, eax
not edx
or edx, 0x1d937851
mov ecx, eax
mov eax, edx
lea eax, [rax + rcx - 0xf51ae43]
mov dword [rbp - 0x24], eax
mov eax, 0x10
mov qword [rbp - 0x40], rax
call fcn.1401f2390
sub rsp, rax
mov rax, qword [rbp - 0x40]
mov rcx, rsp
mov qword [rbp - 0x38], rcx
call fcn.1401f2390
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
sub rsp, 0x20
call fcn.1401c4499
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x30]
add rsp, 0x20
mov rax, qword [rbp - 0x20]
mov r10, qword [r9]
mov qword [rdx], r10
mov r9, qword [r9 + 8]
mov qword [rdx + 8], r9
mov r9, qword [rax]
mov qword [r8], r9
mov rax, qword [rax + 8]
mov qword [r8 + 8], rax
sub rsp, 0x20
call fcn.14008e47d
mov eax, dword [rbp - 0x24]
add rsp, 0x20
cmp eax, 0x7e313b65
je 0x1401bf59d
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
invalid
Function at 0x1401c85b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x330
lea rbp, [rsp + 0x80]
Function at 0x1401d81c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x450
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x170], r8
mov qword [rbp + 0x178], rdx
mov qword [rbp + 0x180], rcx
mov eax, 0x20
Function at 0x1401ea1a0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, qword gs:[0x60]
movzx rax, byte [rax + 2]
ret
Function at 0x1401f00c0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402003b0]
or ecx, dword [0x1402003b4]
mov edx, 0x27fb2788
xor edx, 0xd804d877
mov eax, ecx
xor eax, edx
mov edx, 0xffffffff
xor edx, 0x7be13dc4
or eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x7be13dc4
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
mov ecx, eax
xor ecx, 0xffffffff
mov r8d, 0x28cdafe3
xor r8d, 0xd732501c
mov edx, eax
xor edx, r8d
or ecx, edx
mov edx, 0x884a23fd
xor edx, 0x204ae8f1
and ecx, edx
xor ecx, 0xffffffff
mov edx, 0xa800cb0c
and edx, 0xa800cb0c
mov r8d, 0x9abe23ff
xor r8d, 0x6541dc00
xor edx, r8d
and eax, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
xor eax, 0xffffffff
or ecx, eax
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0xffffffff
xor ecx, 0xf5298daf
mov edx, 0xffffffff
xor edx, 0xf5298daf
or ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
cmp eax, 0x679169f8
jbe 0x1401f024e
mov r11d, dword [0x1402003b8]
mov eax, dword [0x1402003bc]
xor eax, 0xb283d154
imul r11d, eax
xor r11d, 0x81c8632a
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, 0x8c3a58d0
xor r8d, 0x595d8ada
mov eax, 0x88c52bb7
xor eax, 0x773ad448
xor r8d, eax
mov edx, 0xffffffff
xor edx, 0x60a5ca92
mov eax, ecx
and eax, 0x60a5ca92
and r11d, edx
mov r9d, r8d
and r9d, 0x60a5ca92
mov r10d, edx
and r10d, 0xd567d20a
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
xor ecx, 0xffffffff
or edx, 0x60a5ca92
and ecx, edx
or eax, ecx
and eax, 0xd6830ce0
mov dword [rsp + 0x24], eax
mov eax, 0xcdee9deb
xor eax, 0x4b6f44f6
mov dword [rsp + 0x20], eax
call fcn.1401f0257
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor r8d, r8d
call fcn.140012b7a
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
jb 0x1401f0187
add rsp, 0x28
ret
cmpsd dword [rsi], dword [rdi]
adc byte [rax - 0xcf17], dl
dec dword [rax - 0x75]
mov rax, qword [0x140209370]

Function at 0x1401f044a
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
sub rsp, 0x38
call fcn.140181363
mov qword [rsp + 0x28], rax
mov ecx, 0x20
call fcn.140049c60
mov rcx, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rcx
cmp byte [rax + 0x50], 0
jne 0x14018135a
mov rax, qword [rsp + 0x30]
mov qword [0x14027ad38], rax
add rsp, 0x38
jmp fcn.14002f127
sub rsp, 0x28
call fcn.14005e85c
call fcn.14005f1ec
call fcn.140060a46
call fcn.14006655c
call fcn.140095c70
call fcn.14009f530
call fcn.1400c91b0
call fcn.14011d335
call fcn.14011eba1
call fcn.140130870
call fcn.140131962
call fcn.14016c26e
nop
add rsp, 0x28
jmp 0x14018131f
sub rsp, 0x28
call fcn.1400042b5
call fcn.1400048d0
call fcn.1400065d0
call fcn.14002f953
mov rax, qword [sym.imp.KERNEL32.dll_TlsAlloc]
call rax
mov ecx, eax
mov rax, qword [0x140209370]
mov dword [rax], ecx
mov rdx, qword [0x140209388]
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
call fcn.14002f932
call fcn.140098744
call fcn.1400987cc
call fcn.1400ae1c8
call fcn.14013094c
call fcn.1401ea45b
call fcn.1401ebec9
nop
add rsp, 0x28
jmp 0x1401f0400