joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14012c690
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2088
call fcn.14024abd0
sub rsp, rax
mov qword [rsp + 0x70], rcx
call fcn.14012d290
xor eax, eax
mov qword [rsp + 0x78], rax

Function at 0x14012daa0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x30
mov byte [rsp + 0x1f], dl
mov qword [rsp + 0x20], rcx
xor eax, eax
mov qword [rsp + 0x28], rax
jmp 0x14012dab9
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rax
mov eax, dword [0x140253380]
mov ecx, dword [0x140253384]
mov edx, 0xc3a90e64
xor edx, 0xb198746b
xor ecx, edx
xor edx, edx
div ecx
and eax, 0x5df63752
and eax, 0xff236016
mov ecx, 0x8d640ee6
xor ecx, 0x45d32193
and eax, ecx
mov ecx, 0x49159b34
xor ecx, 0xd3bb51c4
cmp eax, ecx
jae 0x14012dc71
mov rcx, qword [rsp + 0x10]
mov eax, dword [0x140253388]
xor eax, 0x14005009
xor eax, dword [0x14025338c]
sub eax, 0x334b993
mov edx, 0x59ed91db
xor edx, 0xde7b3784
add eax, edx
add eax, 0x334b993
mov edx, 0x455328e2
xor edx, 0xc48f5e3a
add eax, edx
and eax, 0x1cf770fc
cmp rcx, 0x13
sete cl
mov byte [rsp + 0xf], cl
cmp eax, 0xc52498bd
jae 0x14012db0a
mov al, byte [rsp + 0xf]
test al, 1
jne 0x14012dc6c
jmp 0x14012db70
mov eax, dword [0x140253390]
xor edx, edx
div dword [0x140253394]
mov ecx, eax
xor ecx, 0x52872e98
xor ecx, 0xffffffff
or eax, 0x52872e98
and eax, ecx
or eax, 0xdab93b11
mov ecx, eax
and ecx, 0x88e11357
shl ecx, 1
xor eax, 0x88e11357
add eax, ecx
mov ecx, 0x2d47417
xor ecx, 0x97207bbf
cmp eax, ecx
jae 0x14012dc7a
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x20]
mov r11b, byte [rsp + 0x1f]
mov eax, dword [0x140253398]
imul eax, dword [0x14025339c]
or eax, eax
xor eax, 0xffffffff
mov ecx, 0x5cca690c
xor ecx, 0xe8b57f16
mov r9d, 0xf2866556
xor r9d, 0xd799aa9
xor ecx, r9d
test eax, 0x440d799a
xor ecx, ecx
mov r9d, 0x5f926d43
xor r9d, 0xebed7b59
mov r10d, 0xe8637936
xor r10d, 0x179c86c9
xor r9d, r10d
and ecx, r9d
or eax, ecx
xor eax, 0xffffffff
imul eax, eax, 0xc4f22e6c
xor ecx, ecx
sub ecx, 0xd2bf72f8
sub eax, ecx
mov ecx, 0xe38b9cd6
xor ecx, 0x3bd01cbd
mov r9b, byte [r8 + rdx]
mov r10b, r9b
and r10b, r11b
shl r10b, 1
add r9b, r11b
pop rcx
jnp 0x14012dbef
jmp 0x14012dc45
add cl, bl
sub r9b, r10b
mov byte [r8 + rdx], r9b
add rdx, 1
mov qword [rsp], rdx
cmp eax, ecx
je 0x14012dbba
mov rax, qword [rsp]
mov qword [rsp + 0x28], rax
jmp 0x14012dab9
add rsp, 0x30
ret
jo 0x14012dbff
div dword [rdi - 0x17]
nop
invalid
invalid
Function at 0x14013ad90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x58], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x60], rax
cmp rax, 0
je 0x14013adf9
mov rcx, qword [rsp + 0x60]
movabs rax, 0x4000000000000000
and rax, qword [rcx]
movabs rcx, 0xde45f0dcd8b42a58
movabs rdx, 0xde45f0dcd8b42a58
xor rcx, rdx
cmp rax, rcx
je 0x14013adf9
mov rcx, qword [rsp + 0x50]
call fcn.140013e60
mov ecx, dword [0x140253908]
mov edx, dword [0x14025390c]
mov eax, ecx
or eax, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
xor edx, 0xffffffff
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0x297f9191
xor ecx, 0x2c7e17e4
xor eax, ecx
add eax, 0xaf737e3a
sub eax, 0x38be37d0
sub eax, 0xaf737e3a
sub eax, 0x221ecf53
sub eax, 0xa766feeb
add eax, 0x221ecf53
cmp eax, 0xca447014
ja 0x14013af88
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
xor eax, eax
mov r9, qword [rcx]
mov qword [rsp + 0x30], r9
mov r8, r9
sub r8, rdx
mov qword [rsp + 0x38], r8
mov rcx, r8
xor rcx, r9
xor r8, rdx
mov rdx, rcx
and rdx, r8
test rcx, rcx
sets cl
test rdx, rdx
setns dl
add cl, dl
inc cl
mov byte [rsp + 0x47], cl
cmp eax, 0x9e0944fd
ja 0x14013ae4f
mov al, byte [rsp + 0x47]
test al, 1
jne 0x14013aead
jmp 0x14013aeb7
call fcn.140008c92
jmp 0x14013af7e
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
cmp rcx, 0xffffffffffffffff
setg al
cmp rcx, rdx
setl cl
and al, cl
test al, 1
jne 0x14013aef5
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
xor eax, eax
sub rax, 0xffffffffffffffff
sub rdx, rax
call fcn.14001284c
jmp 0x14013af7e
mov eax, dword [0x140253918]
add eax, dword [0x14025391c]
or eax, 0xf23bab65
and eax, 0xaed9d12d
mov ecx, 0xb17ebbe1
xor edx, edx
div ecx
cmp eax, 0x746999f6
ja 0x14013af91
mov rcx, qword [rsp + 0x58]
mov eax, dword [0x140253920]
xor eax, 0xa0d46aa4
xor eax, dword [0x140253924]
mov r8d, 0x4cb07c65
xor edx, edx
div r8d
mov r8d, 0x5e1b2e1d
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x38]
or eax, 0xc2e50621
mov rcx, qword [rcx]
add rcx, 8
add rcx, rdx
mov qword [rsp + 0x28], rcx
cmp eax, 0x123047db
jb 0x14013af1f
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
jmp 0x14013af7e
mov rax, qword [rsp + 0x20]
add rsp, 0x68
ret
sahf
movsd dword [rdi], dword [rsi]
add edx, ebx
jmp 0x14013ae4f
or esi, dword [rsi - 0x2a]
jmp 0x14013af1f
Function at 0x14013be82
Capabilities:
Encode data using xor

Disassembly:
rol byte [rcx], 0
add byte [rax], al
add byte [rax], al
add byte [rax - 0x73], cl
invalid
Function at 0x140141300
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov r11d, dword [0x140253be8]
mov r10d, dword [0x140253bec]
xor r10d, 0x54649067
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, r10d
xor r8d, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xd81bea15
mov eax, ecx
and eax, 0xd81bea15
and r11d, edx
mov esi, 0xb5cd75b7
xor esi, 0x6dd69fa2
mov r9d, r8d
and r9d, esi
and r10d, edx
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
mov r8d, 0xab53d232
xor r8d, 0x54ac2dcd
xor ecx, r8d
or edx, 0xd81bea15
and ecx, edx
or eax, ecx
mov ecx, eax
xor ecx, 0x2cdd7550
mov edx, 0xffffffff
xor edx, 0x2cdd7550
and eax, edx
shl eax, 1
sub eax, ecx
mov ecx, 0xaf3500dd
xor ecx, 0xbb28b750
xor edx, edx
div ecx
sub eax, 0xe5e4a24b
cmp eax, 0x9b47803e
je 0x140141424
mov eax, dword [0x140253bf0]
mov edx, dword [0x140253bf4]
xor edx, 0x2185dd7c
mov r8d, 0x31310315
xor r8d, 0xcecefcea
mov ecx, eax
xor ecx, r8d
and ecx, edx
mov r8d, 0x42aad25e
xor r8d, 0xbd552da1
xor edx, r8d
and eax, edx
sub eax, ecx
mov ecx, 0xd2b7c7a3
xor ecx, 0xd2b7c7a3
mov edx, 0x78f72f42
xor edx, 0xa71fa3ca
sub ecx, edx
sub eax, ecx
mov ecx, 0x483e8d6
xor edx, edx
div ecx
mov ecx, 0xcb176a6d
xor ecx, 0x2959bc76
xor edx, edx
div ecx
cmp eax, 0xeeb74461
jae 0x1401413ab
pop rsi
ret
movsb byte [rdi], byte [rsi]
mov ebp, dword [rbx]
stc
jmp 0x1401413ab
Function at 0x140141430
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
call fcn.140140af5
mov qword [rsp + 0x40], rax
add rax, 0x50
mov qword [rsp + 0x38], rax
lea rcx, [0x140278bd8]
mov rax, qword [0x1402645e0]
call qword [rax]
mov rax, qword [rsp + 0x40]
cmp byte [rax + 0x50], 0
jne 0x140141616
lea rcx, [0x140278ba0]
call fcn.14013fe20
mov rax, qword [rsp + 0x38]
cmp byte [rax], 0
jne 0x140141616
mov eax, dword [0x140253bf8]
or eax, dword [0x140253bfc]
xor eax, 0x613c9d56
xor eax, 0xf1a97137
and eax, 0x9b8a08dc
cmp eax, 0x12815e14
je 0x14014161f
mov eax, dword [0x140253c00]
and eax, dword [0x140253c04]
or eax, 0x89f9e775
mov edx, 0xffffffff
xor edx, 0xf72c4f1a
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0xf72c4f1a
add eax, edx
sub eax, ecx
mov ecx, 0xc24ce14
xor ecx, 0x38040870
add eax, ecx
mov ecx, 0xd5ab6038
xor ecx, 0xe77d5bcf
sub eax, ecx
mov ecx, 0x71a16330
xor ecx, 0x4581a554
sub eax, ecx
mov dword [rsp + 0x30], eax
mov eax, 0xf74cbacd
xor eax, 0x1203856f
mov dword [rsp + 0x2c], eax
lea rcx, [0x1402cd410]
mov rax, qword [0x1402645e0]
call qword [rax]
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x30]
mov dl, byte [rdx]
mov r8b, 0xca
xor r8b, 0xca
cmp dl, r8b
sete dl
mov byte [rsp + 0x37], dl
cmp eax, ecx
je 0x14014161f
mov al, byte [rsp + 0x37]
test al, 1
jne 0x140141554
jmp 0x140141616
lea rcx, [0x1402cd438]
mov rax, qword [0x1402645e0]
call qword [rax]
mov rax, qword [rsp + 0x38]
mov al, byte [rax]
mov cl, 0xf5
xor cl, 0xf5
cmp al, cl
jne 0x140141616
mov eax, dword [0x140253c08]
xor eax, 0xc1e7b197
or eax, dword [0x140253c0c]
mov ecx, 0xd6e1fe5e
xor ecx, 0x320ccbfc
sub eax, ecx
xor ecx, ecx
sub ecx, 0x9aa809a5
add eax, ecx
mov ecx, eax
xor ecx, 0x218d98e9
mov edx, 0xffffffff
xor edx, 0x218d98e9
and eax, edx
shl eax, 1
sub eax, ecx
cmp eax, 0xb9857ca6
jae 0x140141628
mov eax, dword [0x140253c10]
mov ecx, 0xd531bb1
xor ecx, 0xb09ba920
xor eax, ecx
and eax, dword [0x140253c14]
and eax, 0x825f0fe4
mov ecx, 0xdff1d2fc
xor edx, edx
div ecx
mov ecx, 0x4c214e04
xor ecx, 0x79316652
xor eax, ecx
mov dword [rsp + 0x28], eax
call fcn.140140fc0
mov eax, dword [rsp + 0x28]
cmp eax, 0xadfacba
jbe 0x1401415c5
jmp 0x140141616
add rsp, 0x48
jmp fcn.140030a10
add byte [r9], r11b
push rcx
jmp 0x1401414a6
add eax, 0xe92b0c7f
xchg esp, eax
invalid
Function at 0x140141640
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rcx
call fcn.14014784e
mov rcx, qword [rsp + 0x38]
add rax, 0x50
mov qword [rsp + 0x40], rax
xor eax, eax
cmp rcx, 0
mov qword [rsp + 0x48], rax
je 0x140141897
mov rcx, qword [rsp + 0x38]
xor eax, eax
cmp word [rcx], 0x5a4d
mov qword [rsp + 0x48], rax
jne 0x140141897
mov cx, 0xee88
xor cx, 0xecda
call fcn.140062760
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x34], eax
xor eax, eax
cmp byte [rcx], 0
mov qword [rsp + 0x48], rax
jne 0x140141897
mov ecx, dword [rsp + 0x34]
mov rax, qword [rsp + 0x38]
mov edx, dword [rax + 0x3c]
mov dword [rsp + 0x30], edx
xor eax, eax
cmp ecx, edx
mov qword [rsp + 0x48], rax
jl 0x140141897
mov eax, dword [0x140253c18]
mov ecx, dword [0x140253c1c]
xor ecx, 0x46a33027
xor eax, ecx
mov ecx, eax
and ecx, 0xa96cedce
shl ecx, 1
add eax, 0xa96cedce
sub eax, ecx
sub eax, 0x9868103b
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0xb8611570
xor edx, 0x53be2adf
and edx, ecx
mov r8d, 0xffffffff
xor r8d, 0xebdf3faf
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xebdf3faf
mov r8d, 0xc8174ab0
xor r8d, 0x23c8751f
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xd8b42a58
xor ecx, 0xf86d94fa
cmp eax, ecx
jb 0x1401418a1
mov eax, dword [rsp + 0x30]
mov ecx, dword [0x140253c20]
mov r8d, dword [0x140253c24]
mov edx, r8d
and edx, ecx
xor edx, 0xffffffff
add ecx, r8d
add ecx, 1
add ecx, edx
add ecx, 0xa6a8eaca
mov r9d, ecx
and r9d, r9d
xor r9d, 0xffffffff
xor r9d, 0xffffffff
mov edx, 0x297f9191
xor edx, 0x7a30de9
mov r8d, 0xbc6a1145
xor r8d, 0x4395eeba
xor edx, r8d
or r9d, edx
mov edx, 0x2edc9c78
and edx, 0x2edc9c78
xor edx, 0xffffffff
and ecx, edx
xor ecx, 0xffffffff
and r9d, ecx
xor r9d, 0xffffffff
mov edx, 0xb33fe2cf
xor edx, 0x4cc01d30
mov ecx, r9d
xor ecx, edx
and ecx, 0x8350f1a8
mov r10d, 0xffffffff
xor r10d, 0x8350f1a8
and r9d, r10d
mov edx, 0xffffffff
xor edx, 0x381c72de
mov r8d, 0x86632a3b
xor r8d, 0x533db93
and edx, r8d
mov r8d, 0x606d66d4
xor r8d, 0x5871140a
and r8d, r10d
or ecx, r9d
or edx, r8d
xor ecx, edx
mov dword [rsp + 0x28], ecx
movsxd rcx, eax
mov edx, 1
lea r8, [rsp + 0x50]
call fcn.1401418aa
mov cl, al
mov eax, dword [rsp + 0x28]
mov byte [rsp + 0x2f], cl
cmp eax, 0x1147b0d
jbe 0x14014174c
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x14014184e
jmp 0x14014185f
call fcn.140008c92
xor eax, eax
mov qword [rsp + 0x48], rax
jmp 0x140141897
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
movabs rdx, 0x572e80ab693d952e
add rcx, rdx
add rcx, rax
movabs rax, 0x572e80ab693d952e
sub rcx, rax
xor eax, eax
cmp dword [rcx], 0x4550
cmove rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
add rsp, 0x58
ret
ret 0x8d5e
Function at 0x1401561b0
Capabilities:
Encode data using xor

Disassembly:
push rax
mov qword [rsp], rcx
mov eax, dword [0x1402544b8]
and eax, dword [0x1402544bc]
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xbb5d8591
mov ecx, 0xffffffff
xor ecx, 0xdfddff58
or eax, edx
or ecx, 0xdfddff58
mov edx, 0xefc58a02
xor edx, 0x103a75fd
xor eax, edx
and eax, ecx
mov ecx, 0x35e8fe53
xor ecx, 0x35e8fe53
mov edx, 0x1f95d55c
xor edx, 0x15c25057
sub ecx, edx
sub eax, ecx
imul eax, eax, 0x41519cf3
cmp eax, 0xa6f77af7
jb 0x140156288
mov rcx, qword [rsp]
mov eax, dword [0x1402544c0]
mov r8d, dword [0x1402544c4]
mov edx, 0x5b0ad555
xor edx, 0x2717c4c2
xor r8d, edx
xor edx, edx
div r8d
mov edx, eax
and edx, 0x455d7046
or eax, 0x455d7046
add edx, eax
mov r8d, 0x1cee7fc
xor r8d, 0x837cad25
mov eax, edx
and eax, r8d
xor edx, 0x82b24ad9
or eax, edx
mov r8d, 0xffcca378
xor edx, edx
div r8d
mov qword [rcx], 0
cmp eax, 0x43bb935c
je 0x14015621c
pop rax
ret
jne 0x1401562d0
pop rdi
and ecx, ebp
mov edi, edi
invalid
and eax, ecx
cmp rax, 0
jne 0x1401562e6
mov rcx, qword [rsp + 0x30]
call fcn.14000eec9
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x48], rcx
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
call fcn.14002d240
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
mov qword [rsp + 0x38], rcx
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
call fcn.14002f0f0
nop
add rsp, 0x58
ret
Function at 0x140173f60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rcx
call fcn.14019ba7e
mov rdx, qword [rsp + 0x40]
mov r8, qword [rdx]
mov qword [rsp + 0x48], r8
mov rcx, qword [rdx + 8]
add rcx, 8
lea rdx, [0x140263dd0]
cmp r8, 0
cmove rcx, rdx
mov qword [rsp + 0x50], rcx
mov al, byte [rax + 0x50]
mov cl, 0x44
xor cl, 0x44
cmp al, cl
jne 0x1401740a7
mov rax, qword [rsp + 0x48]
cmp rax, 0
jge 0x140173fdd
mov rcx, qword [rsp + 0x48]
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
call fcn.14000d792
jmp 0x1401740a7
mov eax, dword [0x1402551b0]
xor edx, edx
div dword [0x1402551b4]
mov ecx, 0x2f407666
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
and eax, 0xedb3418
or ecx, 0xedb3418
add eax, ecx
or eax, 0xb18c88da
mov ecx, 0xea678c8d
xor ecx, 0xc5ee4349
cmp eax, ecx
je 0x14017414f
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1402551b8]
xor eax, dword [0x1402551bc]
xor eax, 0xbab5138a
mov r9d, 0x28ae6f96
xor r9d, 0xd7519069
xor eax, r9d
mov r10d, 0xffffffff
xor r10d, 0xbcf63040
mov r9d, 0xffffffff
xor r9d, 0xe605312b
or eax, r10d
or r9d, 0xe605312b
xor eax, 0xffffffff
and eax, r9d
mov r9d, 0xffffffff
xor r9d, 0xb94eeda8
add eax, r9d
add eax, 1
mov dword [rsp + 0x2c], eax
call fcn.1400a3010
mov eax, dword [rsp + 0x2c]
cmp eax, 0x91c5ef58
jb 0x14017414f
jmp 0x1401740a7
mov ecx, dword [0x1402551c0]
mov edx, dword [0x1402551c4]
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, ecx
and eax, 0xe1778a64
shl eax, 1
xor ecx, 0xe1778a64
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xbf428d79
or eax, edx
and ecx, 0xbf428d79
mov edx, 0x5dc95cd3
xor edx, 0xa236a32c
xor ecx, edx
and eax, ecx
xor eax, 0xffffffff
and eax, 0x3c51c16b
cmp eax, 0x573088db
jae 0x140174158
mov eax, dword [0x1402551c8]
sub eax, dword [0x1402551cc]
mov ecx, 0xfd6f31ee
xor ecx, 0xed8bf6d4
and eax, ecx
mov ecx, 0x17bd2364
xor ecx, 0x4c0b3c40
xor edx, edx
div ecx
xor eax, 0x148e8a0d
mov ecx, 0x3a9bfb20
xor ecx, 0x8097a0ec
cmp eax, ecx
jae 0x140174105
mov rax, qword [rsp + 0x38]
add rsp, 0x58
ret
mov ds, word [rdi - 0x80]
invalid
mov bl, 0xb
add byte [rcx - 0x5b17], dl
jmp qword [rsi + 0x66]
Function at 0x140174480
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
call fcn.14019ba7e
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x58], rax
add rax, 0x50
mov qword [rsp + 0x50], rax
mov rax, qword [rdx]
mov qword [rsp + 0x78], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x78]
call fcn.140174447
mov rcx, rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rcx
cmp byte [rax + 0x50], 0
jne 0x140174627
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax]
mov qword [rsp + 0x68], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x68]
call fcn.140174170
mov rcx, rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rcx
mov al, byte [rax]
mov cl, 0xea
xor cl, 0xea
cmp al, cl
jne 0x140174627
mov rax, qword [rsp + 0x30]
cmp rax, 0
jge 0x14017454b
mov rcx, qword [rsp + 0x30]
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
call fcn.14000d792
jmp 0x140174627
mov eax, dword [0x1402551f0]
mov ecx, dword [0x1402551f4]
add eax, 0x922d7aab
add eax, ecx
sub eax, 0x922d7aab
mov ecx, 0xe23e562b
xor ecx, 0xe23e562b
mov edx, 0x6348e44
xor edx, 0xe8c3818
sub ecx, edx
sub eax, ecx
xor eax, 0x29e73db8
mov ecx, eax
and ecx, 0xe428b03e
shl ecx, 1
mov edx, 0x33e7694
xor edx, 0xe716c6aa
add eax, edx
sub eax, ecx
cmp eax, 0x6a80f099
ja 0x140174634
mov r8, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x1402551f8]
xor edx, edx
div dword [0x1402551fc]
mov rdx, qword [rsp + 0x60]
add eax, 0x2054d48e
add eax, 0xb11b4c41
mov r10d, 0x91f875c4
xor r10d, 0xd41844b
mov r9d, 0xc2aa87c4
xor r9d, 0x3d55783b
xor r10d, r9d
mov r9d, eax
and r9d, r10d
mov r11d, 0x6b126bc0
xor r11d, 0xf7ab9a4f
mov r10d, eax
xor r10d, r11d
add eax, r10d
sub eax, r9d
mov dword [rsp + 0x2c], eax
call fcn.1400a2240
mov eax, dword [rsp + 0x2c]
cmp eax, 0x62df1907
je 0x1401745a7
jmp 0x140174627
mov rax, qword [rsp + 0x40]
add rsp, 0x88
ret
mov esp, dword [0x1ab005d03]
invalid
Function at 0x140174640
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov dword [rsp + 0x4c], edx
mov qword [rsp + 0x50], rcx
mov eax, dword [0x140255200]
mov edx, dword [0x140255204]
mov ecx, eax
xor ecx, edx
mov r8d, 0x10d747fc
xor r8d, 0xef28b803
xor ecx, r8d
or eax, edx
and eax, ecx
mov ecx, 0xaa0b89bd
xor ecx, 0x87cf7144
mov edx, 0xadb7e8ea
xor edx, 0x52481715
xor ecx, edx
mov edx, 0x94cb1a40
xor edx, 0x94cb1a40
mov r8d, 0x3a557bd9
xor r8d, 0x3a557bd8
sub edx, r8d
sub ecx, edx
sub eax, ecx
sub eax, 0x85dc6cbd
mov r8d, 0xffffffff
xor r8d, 0x5191abb2
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x5f1503f2
xor r8d, 0xa0eafc0d
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x5191abb2
or eax, 0x5191abb2
imul eax, edx
add eax, ecx
cmp eax, 0x61a99e90
jbe 0x140174892
mov eax, dword [0x140255208]
sub eax, dword [0x14025520c]
mov ecx, 0xffffffff
xor ecx, 0x54c9947
add eax, ecx
add eax, 1
mov ecx, 0x8b5d7d71
xor ecx, 0x6cd3ad3c
xor edx, edx
div ecx
mov ecx, 0xca6ff060
xor ecx, 0xca6ff060
sub ecx, eax
mov eax, 0xf06dc39a
xor eax, 0xf06dc39a
mov edx, 0x2c404e0d
xor edx, 0x9f092f78
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [rsp + 0x3c], eax
mov eax, 0xb1d05569
xor eax, 0xe6f355e3
mov dword [rsp + 0x38], eax
call fcn.14019ba7e
mov ecx, dword [rsp + 0x38]
mov rdx, rax
mov eax, dword [rsp + 0x3c]
mov r8, rdx
add r8, 0x50
mov qword [rsp + 0x40], r8
cmp byte [rdx + 0x50], 0
sete dl
mov byte [rsp + 0x4b], dl
cmp eax, ecx
jbe 0x140174892
mov al, byte [rsp + 0x4b]
test al, 1
jne 0x14017479b
jmp 0x1401747c7
call fcn.14019ba7e
mov rax, qword [rsp + 0x40]
mov al, byte [rax]
mov cl, 0x12
xor cl, 0x12
cmp al, cl
jne 0x1401747c7
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x4c]
mov eax, eax
add rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov eax, dword [0x140255210]
xor edx, edx
div dword [0x140255214]
sub eax, 0x4412b34f
mov r8d, 0xffffffff
xor r8d, 0xabfeadb9
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x2b905874
xor r8d, 0xd46fa78b
xor ecx, r8d
imul ecx, edx
mov r8d, 0x754414a0
xor r8d, 0xdebab919
mov edx, eax
and edx, r8d
or eax, 0xabfeadb9
imul eax, edx
add eax, ecx
mov ecx, 0xc3ff8f13
xor ecx, 0x239f38ae
add eax, ecx
cmp eax, 0x1b654a7f
ja 0x14017489b
mov ecx, dword [0x140255218]
mov edx, dword [0x14025521c]
xor edx, 0x71f9f30d
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
imul eax, eax, 0xe28c50a3
mov ecx, 0xab1e1757
xor ecx, 0x29c7f5b9
xor eax, ecx
imul eax, eax, 0x7b71459c
mov ecx, 0xdbce6b9c
xor ecx, 0xf8253f5f
cmp eax, ecx
je 0x140174842
mov rax, qword [rsp + 0x28]
add rsp, 0x58
ret
invalid
xchg ebx, eax
shl byte [rcx], 1
popfq
jmp 0x140174842
Function at 0x14019ab60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rcx
call fcn.14019ba7e
mov rcx, qword [rsp + 0x40]
add rax, 0x50
mov qword [rsp + 0x48], rax
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x50], rax
cmp rax, 0
je 0x14019abcb
mov rcx, qword [rsp + 0x50]
movabs rax, 0x4000000000000000
and rax, qword [rcx]
movabs rcx, 0x7b767da1fbda9678
movabs rdx, 0x7b767da1fbda9678
xor rcx, rdx
cmp rax, rcx
jne 0x14019abcb
mov rcx, qword [rsp + 0x50]
call fcn.14000eec9
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x38], rax
cmp rax, 0
je 0x14019ac19
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
movabs rcx, 0x2c2cdfb8fb73f69f
movabs rdx, 0x6c2cdfb8fb73f69f
xor rcx, rdx
and rax, rcx
cmp rax, 0
jne 0x14019ac19
mov rcx, qword [rsp + 0x38]
call fcn.14000eec9
mov rax, qword [rsp + 0x40]
mov rcx, rax
add rcx, 0x30
mov qword [rsp + 0x30], rcx
mov rcx, qword [rax + 0x30]
lea rdx, [0x1402545c8]
call fcn.140164070
test al, 1
jne 0x14019ac47
jmp 0x14019ad64
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call fcn.140164440
mov rax, qword [rsp + 0x48]
cmp byte [rax], 0
jne 0x14019ad64
mov ecx, dword [0x1402561b0]
or ecx, dword [0x1402561b4]
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xe5ceb108
or eax, edx
mov edx, 0x9cf1d4b0
xor edx, 0x630e2b4f
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0xe5ceb108
or ecx, edx
and eax, ecx
mov ecx, 0x35d2be78
xor ecx, 0xca2d4187
xor eax, ecx
mov ecx, 0xf91f62f8
xor ecx, 0xbedb5cc4
xor eax, ecx
mov ecx, 0xd99d6c69
xor edx, edx
div ecx
cmp eax, 0xd2676a16
ja 0x14019ad69
mov eax, dword [0x1402561b8]
xor edx, edx
div dword [0x1402561bc]
mov ecx, eax
mov rax, qword [rsp + 0x30]
and ecx, 0x6582678
mov edx, 0x782a61f2
xor edx, 0xb88f8963
mov r8d, 0x66fd7cda
xor r8d, 0x99028325
xor edx, r8d
add ecx, edx
mov edx, 0xe9cec3bc
xor edx, 0xe9cec3bd
add ecx, edx
mov edx, 0x19142448
xor edx, 0x867b366c
imul ecx, edx
mov dword [rsp + 0x2c], ecx
mov ecx, 0x9b78d05c
xor ecx, 0x9148c4f0
mov dword [rsp + 0x28], ecx
mov rcx, qword [rax]
movabs rdx, 0x17dc180b7585b84a
movabs rax, 0x17dc180b7585b842
xor rdx, rax
call fcn.14000ef30
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
je 0x14019acca
jmp 0x14019ad64
add rsp, 0x58
ret
pop rdi
call 0x1990360ec
invalid