joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d5b3
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14000bd1e
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov rcx, rax
add rcx, 0x58
add rsp, 0x38
jmp fcn.14000d3e0

Function at 0x14000d7c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x18], rdx
mov rax, rcx
mov rcx, qword [rbp - 0x18]
mov qword [rbp - 0x10], rax
mov eax, 0x10
call fcn.14024abd0
sub rsp, rax
mov rax, qword [rbp - 0x10]
mov r8, rsp
mov qword [rbp - 8], r8
mov qword [rax], 0
mov qword [rax + 8], rcx
mov edx, 0x10
sub rsp, 0x20
call fcn.14000c39e
add rsp, 0x20
test al, 1
jne 0x14000d81b
jmp 0x14000d82d
sub rsp, 0x20
call fcn.140008c92
add rsp, 0x20
jmp 0x14000d904
mov rax, qword [rbp - 8]
mov rax, qword [rax]
mov qword [rbp - 0x20], rax
cmp rax, 0
jge 0x14000d854
sub rsp, 0x20
call fcn.14000c131
add rsp, 0x20
jmp 0x14000d904
mov ecx, dword [0x14024b838]
imul ecx, dword [0x14024b83c]
mov eax, ecx
and eax, 0xabf981f5
or ecx, 0xabf981f5
add eax, ecx
mov ecx, 0xffffffff
xor ecx, 0xa04a3b0e
add eax, ecx
mov ecx, 0xc9118e32
xor ecx, 0xc9118e33
add eax, ecx
and eax, 0xc5d2bd6e
mov ecx, 0x1ae445eb
xor ecx, 0x6b556bcc
cmp eax, ecx
je 0x14000d909
mov rcx, qword [rbp - 0x20]
mov eax, dword [0x14024b840]
mov r8d, dword [0x14024b844]
xor r8d, 0xa59c63
mov edx, eax
and edx, r8d
shl edx, 1
add eax, r8d
sub eax, edx
and eax, 0x21970d70
xor eax, 0x517fe73
sub eax, 0x652e70de
mov dword [rbp - 0x24], eax
sub rsp, 0x20
call fcn.14000bcfb
mov rcx, qword [rbp - 0x10]
add rsp, 0x20
mov rdx, rax
mov eax, dword [rbp - 0x24]
mov qword [rcx + 0x10], rdx
cmp eax, 0x89e09ca
jb 0x14000d8a2
jmp 0x14000d904
mov rsp, rbp
pop rbp
ret
xchg ecx, eax
retf
Function at 0x14000ef30
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x14024b8a8]
mov ecx, 0x5bbedc2c
xor ecx, 0x9932b855
xor eax, ecx
mov edx, dword [0x14024b8ac]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov r8d, 0x87dfddd3
xor r8d, 0x6faea396
mov ecx, 0xc93d72
xor ecx, 0xff36c28d
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0xded4b5b5
xor r8d, 0x36a5cbf0
mov edx, eax
and edx, r8d
or eax, 0xe8717e45
imul eax, edx
add eax, ecx
mov edx, 0xa8cff6ce
xor edx, 0x57300931
mov ecx, eax
xor ecx, edx
and ecx, 0x3c178ef3
mov edx, 0xffffffff
xor edx, 0x3c178ef3
and eax, edx
sub eax, ecx
mov ecx, 0x94b6275b
xor ecx, 0x212f0f14
xor edx, edx
div ecx
cmp eax, 0xcc1364d0
jae 0x14000f059
mov eax, dword [0x14024b8b0]
mov ecx, 0xde6d0b0b
xor ecx, 0xa94c36e2
xor eax, ecx
add eax, dword [0x14024b8b4]
xor eax, 0xf8107db9
xor eax, 0x5040e7b1
mov ecx, 0x43e491f4
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x28]
mov dword [rsp + 0x24], eax
movabs rcx, 0x27ba0adc45fcbcdf
movabs rax, 0x27ba0adc45fcbccf
xor rcx, rax
call fcn.140008b04
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
sub rcx, rax
call fcn.14000eece
mov eax, dword [rsp + 0x24]
cmp eax, 0x4a434e0a
ja 0x14000efe2
add rsp, 0x38
ret
push 0xffffffffe9c386f6
cmp bh, 0xff
dec dword [rax - 0x7d]
sub rsp, 0x38
mov qword [rsp + 0x20], rcx
mov rax, rcx
add rax, 0x10
mov qword [rsp + 0x28], rax
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x14000f0a0
mov rcx, qword [rsp + 0x30]
call fcn.14000eea1
mov rax, qword [rsp + 0x28]
mov qword [rax], 0
mov rax, qword [rsp + 0x20]
movabs rcx, 0x4ab11cebc0c897ab
movabs rdx, 0x4ab11cebc0c897ab
xor rcx, rdx
mov qword [rax], rcx
movabs rcx, 0x8b7fe7a1c2ea8bea
movabs rdx, 0x8b7fe7a1c2ea8bea
xor rcx, rdx
mov qword [rax + 8], rcx
add rsp, 0x38
ret
Function at 0x140012890
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], rcx
mov eax, dword [0x14024b998]
xor edx, edx
div dword [0x14024b99c]
mov ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x298e57c1
mov edx, 0xffffffff
xor edx, 0x298e57c1
and ecx, edx
or eax, ecx
sub eax, 0xba824a9
mov ecx, 0xaed7fa43
xor edx, edx
div ecx
mov ecx, 0x6075d5d1
xor ecx, 0xcdd690e9
cmp eax, ecx
ja 0x140012a8e
mov eax, dword [0x14024b9a0]
mov r8d, dword [0x14024b9a4]
mov edx, r8d
not edx
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
add eax, 0x96b0e547
mov ecx, eax
not ecx
or eax, 0x54a9bc93
or ecx, 0xab56436c
and eax, ecx
not eax
imul eax, eax, 0x13e67777
mov dword [rbp - 0x1c], eax
mov eax, 0xf5b510b1
mov dword [rbp - 0x20], eax
mov eax, 0x10
call fcn.14024abd0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.14000bd1e
add rsp, 0x20
movabs rcx, 0x721964f970d9b009
movabs rax, 0x721964f970d9b049
xor rcx, rax
movabs rdx, 0xaf6cb7067d7b9da2
movabs rax, 0xaf6cb7067d7b9daa
xor rdx, rax
sub rsp, 0x20
call fcn.140012610
mov rdx, qword [rbp - 8]
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x28]
mov r8, qword [0x1402646d8]
mov qword [rcx], r8
lea r8, [0x14025b436]
mov qword [rcx + 0x10], r8
mov r8, qword [rdx]
mov qword [rax], r8
mov r8, qword [rdx + 8]
mov qword [rax + 8], r8
mov qword [rdx], 0
mov qword [rdx + 8], 0
mov rdx, qword [rax]
mov qword [rcx + 0x18], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 0x20], rax
movabs rax, 0x97b7ec817f23197e
movabs rdx, 0x97b7ec813d3f8c34
xor rax, rdx
lea rdx, [0x14025b436]
lea r8, [0x14025b414]
lea r9, [0x14025b41d]
sub rsp, 0x30
mov qword [rsp + 0x20], rax
call fcn.14001203f
mov rdx, qword [rbp - 8]
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0x1c]
add rsp, 0x30
mov rdx, qword [rdx + 8]
mov qword [rbp - 0x18], rdx
cmp rdx, 0
sete dl
mov byte [rbp - 9], dl
cmp eax, ecx
ja 0x1400128e8
mov al, byte [rbp - 9]
test al, 1
jne 0x140012a89
jmp 0x140012a4a
mov rax, qword [rbp - 0x18]
mov rcx, qword [rax]
mov rdx, 0xffffffffffffffff
movabs rax, 0x4000000000000000
xor rdx, rax
mov rax, rcx
xor rax, rdx
and rax, rcx
cmp rax, 0
jne 0x140012a89
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call fcn.14000eea1
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
invalid
Function at 0x140013e60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x48], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x58], rax
mov rdx, qword [rcx]
mov qword [rsp + 0x60], rdx
mov rax, rdx
add rax, 1
mov rcx, rdx
and rcx, 0xffffffffffffffff
shl rcx, 1
movabs r8, 0x8543b5a91fb6e543
movabs r9, 0x7abc4a56e0491abc
xor r8, r9
add rdx, r8
sub rdx, rcx
mov rcx, rax
add rcx, 1
xor rax, 0xffffffffffffffff
or rax, rdx
add rax, rcx
cmp rax, 0
jge 0x140013eda
call fcn.140008c92
jmp 0x140014101
mov rax, qword [rsp + 0x60]
mov rdx, rax
and rdx, 9
shl rdx, 1
mov rcx, rax
xor rcx, 9
add rcx, rdx
mov qword [rsp + 0x40], rcx
xor edx, edx
sub rdx, rax
add rdx, 0xfffffffffffffffe
movabs rax, 0x2bf0860f3fcead9a
movabs r8, 0xd40f79f0c0315265
xor rax, r8
xor rdx, rax
mov rax, rcx
xor rax, rdx
and rax, rcx
movabs rcx, 0xd9b2d2c2ba5d265d
movabs rdx, 0xd9b2d2c2ba5d265d
xor rcx, rdx
cmp rax, rcx
jge 0x140013f4f
call fcn.140008c92
jmp 0x140014101
mov rax, qword [rsp + 0x40]
movabs rcx, 0x57fc1480574685fd
movabs rdx, 0x57fc1480574685fd
xor rcx, rdx
cmp rax, rcx
jge 0x140013f84
mov rcx, r8
mov rdx, r8
call fcn.14000d792
jmp 0x140014101
mov eax, dword [0x14024ba38]
xor edx, edx
div dword [0x14024ba3c]
add eax, 0x8b3f987e
mov ecx, eax
xor ecx, 0x4be74e03
xor ecx, 0xffffffff
or eax, 0x4be74e03
and eax, ecx
mov ecx, 0x9a1c8b20
xor ecx, 0xcdac0b27
xor edx, edx
div ecx
cmp eax, 0xaddd2b16
ja 0x140014107
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x14024ba40]
mov r8d, dword [0x14024ba44]
mov r9d, eax
and r9d, r8d
mov edx, 0xa25e5a10
xor edx, 0xa25e5a12
imul edx, r9d
add eax, r8d
sub eax, edx
xor eax, 0x3465ebe4
xor eax, 0x5ee1bb2b
mov r8d, 0x5ce7547c
xor edx, edx
div r8d
mov dword [rsp + 0x24], eax
call fcn.14000bcfb
mov r8, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov rdx, rax
mov eax, dword [rsp + 0x24]
mov qword [rsp + 0x28], rdx
mov qword [r8], rdx
mov r8, qword [rcx]
mov qword [rdx], r8
mov rdx, qword [rcx]
movabs r8, 0xa313e3d46be748e5
mov rcx, rdx
sub rcx, r8
movabs r8, 0x5bdff58132f2f1d1
movabs r9, 0x5bdff58132f2f1d0
xor r8, r9
add rcx, r8
movabs r8, 0x4c9b5ddc87997438
movabs r9, 0xef88be08ec7e3cdd
xor r8, r9
add rcx, r8
mov qword [rsp + 0x30], rcx
movabs r8, 0x61da318054e20ec4
movabs r9, 0x9e25ce7fab1df13b
xor r8, r9
xor rdx, r8
and rcx, rdx
cmp rcx, 0
setl cl
mov byte [rsp + 0x3f], cl
cmp eax, 0xcc30bbb2
je 0x140013fc3
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x1400140bc
jmp 0x1400140c6
call fcn.140008c92
jmp 0x140014101
mov rax, qword [rsp + 0x30]
cmp rax, 0
jge 0x1400140e5
mov rcx, r8
mov rdx, r8
call fcn.14000d792
jmp 0x140014101
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
add rcx, 8
add rdx, 8
call fcn.14003139f
nop
add rsp, 0x68
ret
invalid
Function at 0x140016abf
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
xor eax, eax
mov edx, eax
call fcn.140016210
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp fcn.140016530
Function at 0x14001b160
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x57], al
je 0x14001b28a
mov rax, qword [rsp + 0x48]
xor ecx, ecx
sub rcx, rax
xor eax, eax
sub rax, 0xfffffffffffffff0
add rcx, rax
xor eax, eax
sub rax, rcx
mov qword [rsp + 0x38], rax
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
mov al, 1
cmp rcx, 0x10
mov byte [rsp + 0x57], al
jb 0x14001b28a
mov eax, dword [0x14024bd18]
xor eax, 0xdb7dde20
mov edx, dword [0x14024bd1c]
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, edx
add eax, ecx
mov ecx, eax
and ecx, 0xa108a447
xor ecx, 0xffffffff
mov edx, 0x4fa07770
xor edx, 0xeea8d337
add eax, edx
add eax, 1
add eax, ecx
mov ecx, 0x467a094
xor ecx, 0xe2c23be
xor edx, edx
div ecx
and eax, 0xf9322819
cmp eax, 0x3ce2e08a
ja 0x14001b298
mov rdx, qword [rsp + 0x40]
mov eax, dword [str.__t_v]
xor eax, 0x5a2b85de
mov ecx, dword [0x14024bd24]
xor ecx, 0xc2f34820
imul eax, ecx
add eax, 0xe63f9313
mov r8, rdx
add r8, 0xfffffffffffffff0
mov qword [rsp + 0x28], r8
test r8, r8
setns cl
or rdx, r8
sets dl
add cl, dl
inc cl
mov byte [rsp + 0x37], cl
cmp eax, 0x9cb2f202
ja 0x14001b207
mov al, byte [rsp + 0x37]
test al, 1
jne 0x14001b267
jmp 0x14001b277
call fcn.140008c92
xor eax, eax
mov byte [rsp + 0x57], al
jmp 0x14001b28a
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x57], al
mov al, byte [rsp + 0x57]
and al, 1
movzx eax, al
add rsp, 0x58
ret
invalid
Function at 0x14001b2b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rcx
call fcn.14000bd1e
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.14001b160
test al, 1
jne 0x14001b2da
jmp 0x14001b3b3
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov qword [rsp + 0x38], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
call fcn.1400d2088
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x50], 0
jne 0x14001b3b3
mov eax, dword [0x14024bd28]
mov edx, dword [0x14024bd2c]
mov ecx, 0x64f5995c
xor ecx, 0xa9ed4068
xor edx, ecx
mov ecx, 0xa15c16cd
xor ecx, 0xa15c16cd
sub ecx, edx
sub eax, ecx
imul eax, eax, 0x5927ab0
add eax, 0x18cad211
or eax, 0xa344a771
cmp eax, 0x70d63a16
jb 0x14001b465
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x14024bd30]
and eax, dword [0x14024bd34]
mov edx, 0xf0402aab
xor edx, 0x56a09716
imul eax, edx
or eax, 0x60fde457
mov r8d, 0x38c7f934
xor r8d, 0x95eb0038
xor edx, edx
div r8d
mov dword [rsp + 0x24], eax
mov eax, 0x6f8db11c
xor eax, 0x9ba607cf
mov dword [rsp + 0x20], eax
mov edx, 8
call fcn.14000ef30
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
je 0x14001b34c
jmp 0x14001b3b3
mov eax, dword [0x14024bd38]
mov ecx, dword [str.6__2_L]
xor ecx, 0x3531414b
sub eax, ecx
xor ecx, ecx
sub ecx, 0x800abef
add eax, ecx
and eax, 0x2c327859
and eax, eax
mov ecx, 0x94506d5d
xor ecx, 0x6baf92a2
xor eax, ecx
mov ecx, 0xe066e58d
and ecx, 0xe066e58d
mov edx, 0x811bac6d
xor edx, 0x7ee45392
xor ecx, edx
xor eax, 0xffffffff
mov edx, 0x45ad44e5
xor edx, 0xba52bb1a
xor ecx, edx
or eax, ecx
mov ecx, 0xf7d47738
xor ecx, 0xf68a85df
cmp eax, ecx
je 0x14001b46e
mov eax, dword [0x14024bd40]
xor eax, 0xfc70bfb
xor edx, edx
div dword [0x14024bd44]
mov ecx, 0x421e69b8
xor edx, edx
div ecx
xor eax, 0x4429dd9
mov ecx, eax
and ecx, 0xafca41db
shl ecx, 1
xor eax, 0xafca41db
add eax, ecx
cmp eax, 0xea4d538f
ja 0x14001b422
add rsp, 0x48
ret
pop rsi
invalid
call 0x12972ae04
stosd dword [rdi], eax
invalid
Function at 0x14001df50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov rdx, qword [rcx]
xor eax, eax
mov ecx, eax
sub rcx, rdx
xor eax, eax
sub rax, 0xffffffffffffffff
add rcx, rax
movabs rax, 0xaa2fbc695f6c9557
movabs r8, 0xaa2fbc695f6c9557
xor rax, r8
sub rax, rcx
mov qword [rsp + 0x50], rax
mov rcx, rax
xor rcx, rdx
movabs rdx, 0x96d960cc3b77b981
movabs r8, 0x96d960cc3b77b981
xor rdx, r8
cmp rcx, rdx
setl dl
cmp rax, 0xffffffffffffffff
setg al
xor al, 0xff
xor dl, 0xff
mov cl, 1
xor cl, 0
or al, dl
or cl, 0
xor al, 0xff
and al, cl
test al, 1
jne 0x14001dff2
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
add rcx, 8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
jmp 0x14001dffc
call fcn.140008c92
jmp 0x14001e174
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
cmp rax, rcx
jl 0x14001e0ca
mov rax, qword [rsp + 0x28]
movabs rcx, 0x38feaace6f341469
movabs rdx, 0x38feaace6f341469
xor rcx, rdx
cmp rax, rcx
jl 0x14001e04c
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
cmp rax, qword [rcx]
jl 0x14001e059
mov rcx, rdx
call fcn.14001284c
jmp 0x14001e174
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
lea rcx, [rax + rcx*8 + 8]
call fcn.14001ddb0
mov rcx, qword [rsp + 0x28]
mov rax, rcx
dec rax
mov r8, rcx
not r8
mov rdx, rax
or rdx, r8
mov r8, rcx
neg r8
or r8, rcx
not rdx
not r8
or rdx, r8
sets r8b
test rcx, rcx
setne cl
sete dl
or dl, r8b
add cl, dl
inc cl
test cl, 1
mov qword [rsp + 0x38], rax
jne 0x14001e0c0
jmp 0x14001dffc
call fcn.140008c92
jmp 0x14001e174
mov ecx, dword [0x14024be38]
mov r8d, dword [0x14024be3c]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, ecx
and edx, r9d
mov eax, ecx
or eax, r9d
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, r8d
or ecx, r8d
imul ecx, edx
add ecx, eax
mov eax, 0x5e0b7e9b
xor eax, 0x8e875ea8
and ecx, eax
or ecx, 0x1f5a7b70
mov edx, 0xde191eb3
xor edx, 0x21e6e14c
mov eax, ecx
xor eax, edx
and eax, 0xb30a7479
mov edx, 0xffffffff
xor edx, 0xb30a7479
and ecx, edx
or eax, ecx
cmp eax, 0x9a62bf9b
jbe 0x14001e179
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov eax, dword [str._trk]
imul eax, dword [0x14024be44]
xor eax, 0x5bae387a
and eax, 0x57bdeef4
or eax, 0x62410c9a
mov qword [rcx], rdx
cmp eax, 0xb212aef4
ja 0x14001e13b
jmp 0x14001e174
add rsp, 0x58
ret
invalid
Function at 0x140024c70
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov rax, rcx
mov qword [rsp + 0x30], rax
mov qword [rcx], 0
mov qword [rcx + 8], 0
mov rdx, qword [rdx]
call fcn.140021120
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
add rdx, 8
mov qword [rsp + 0x48], rdx
mov rax, qword [rax + 8]
mov qword [rsp + 0x50], rax
xor eax, eax
test rcx, rcx
cmovg rax, rcx
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
cmp rax, rcx
je 0x140024dea
mov eax, dword [0x14024c118]
mov ecx, dword [0x14024c11c]
xor ecx, 0x30220783
and eax, ecx
mov edx, eax
xor edx, 0x246a0969
mov ecx, 0x817ebeed
xor ecx, 0x7e814112
xor edx, ecx
and edx, 0x246a0969
mov ecx, 0x309bcd46
xor ecx, 0x309bcd44
imul ecx, edx
sub ecx, 0x246a0969
sub eax, ecx
add eax, 0xba4119de
sub eax, 0xec95ddeb
sub eax, 0xba4119de
mov ecx, 0x7e6e082e
xor edx, edx
div ecx
mov ecx, 0x92b43f2b
xor ecx, 0x9f2504e5
cmp eax, ecx
ja 0x140024df4
mov rcx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x48]
mov eax, dword [0x14024c120]
xor eax, 0xaddf7087
add eax, dword [0x14024c124]
add eax, 0x170841eb
mov edx, 0xf67d9692
xor edx, 0xaf34a435
add eax, edx
mov edx, 0xea025ba
xor edx, 0x19a86451
sub eax, edx
add eax, 0x3b082e43
mov edx, 0xb5a18a2b
xor edx, 0x16b658bc
sub eax, edx
sub eax, 0x3b082e43
mov r9d, 0x3de3efc7
xor edx, edx
div r9d
mov rdx, qword [rsp + 0x50]
mov r8, qword [r8]
mov r8b, byte [r8 + rcx + 8]
mov byte [rdx + rcx + 8], r8b
add rcx, 1
mov qword [rsp + 0x20], rcx
cmp eax, 0x85dcb513
jae 0x140024d59
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x60], rax
jmp 0x140024cd1
mov rax, qword [rsp + 0x30]
add rsp, 0x68
ret
sbb al, 0x28
test dword [rcx + rbp*8], ebp
pop rsp
invalid

Function at 0x140025e00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
call fcn.140011dc0
test al, 1
jne 0x140025e1b
jmp 0x140025e25
mov rcx, qword [rsp + 0x20]
call fcn.14000ff4b
mov eax, dword [0x14024c178]
xor eax, 0x8057e5a9
add eax, dword [0x14024c17c]
mov ecx, 0xb6f731c0
xor edx, edx
div ecx
mov ecx, 0xffffffff
xor ecx, 0x148afcc0
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
mov ecx, 0xe8088074
xor edx, edx
div ecx
mov ecx, 0x677580b0
xor ecx, 0x6420754
cmp eax, ecx
ja 0x140025ebc
mov eax, dword [0x14024c180]
mov ecx, 0xb64ee8bf
xor ecx, 0xf169d6bd
xor eax, ecx
imul eax, dword [0x14024c184]
xor eax, 0x29bf72f8
mov ecx, 0x60cbdfdf
xor edx, edx
div ecx
mov ecx, 0xb195bca4
xor ecx, 0x46fe2f95
add eax, ecx
mov ecx, 0xe4d3b5a
xor ecx, 0xfdcd7bae
cmp eax, ecx
je 0x140025e6f
invalid
add rsp, 0x28
ret
jp 0x140025ea8
sbb eax, 0xffaae99d
invalid
Function at 0x140027b00
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x80
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov r8, qword [rcx]
mov qword [rsp + 0x58], r8
mov rax, rcx
add rax, 8
mov qword [rsp + 0x60], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x68], rax
mov rdx, r8
add rdx, 1
mov qword [rsp + 0x70], rdx
xor r8, 0xffffffffffffffff
mov rcx, rdx
xor rcx, 0xffffffffffffffff
mov r9, r8
xor r9, 0xffffffffffffffff
or rcx, r9
and rdx, r8
xor rdx, 0xffffffffffffffff
and rcx, rdx
movabs rdx, 0xda161ff497303b2b
movabs r8, 0x25e9e00b68cfc4d4
xor rdx, r8
xor rcx, rdx
mov qword [rsp + 0x78], rcx
cmp rax, 0
je 0x140027bd7
mov rax, qword [rsp + 0x78]
cmp rax, 0
jl 0x140027bcd
mov rax, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rax]
mov r8, rcx
add r8, 1
xor rcx, 0xffffffffffffffff
movabs r9, 0xbfffffffffffffff
or rcx, r9
add rcx, r8
cmp rcx, rdx
mov qword [rsp + 0x40], rax
jl 0x140027bd7
jmp 0x140027cc8
call fcn.140008c92
jmp 0x140027db3
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov r8d, 1
mov r9d, 8
mov qword [rsp + 0x20], 8
call fcn.140010b50
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
mov qword [rdx], rax
cmp rcx, 0
mov qword [rsp + 0x40], rax
jge 0x140027cc8
mov eax, dword [0x14024c238]
xor edx, edx
div dword [0x14024c23c]
or eax, 0x446751fd
or eax, eax
xor eax, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xe2d01bfe
mov edx, 0xffffffff
xor edx, 0xe2d01bfe
and ecx, edx
or eax, ecx
mov ecx, 0x94b9a499
xor ecx, 0x6b465b66
xor eax, ecx
mov ecx, 0xc5e6e182
xor ecx, 0xefea1068
imul eax, ecx
cmp eax, 0xa0a8af8d
jae 0x140027dbc
mov eax, dword [0x14024c240]
xor edx, edx
div dword [0x14024c244]
mov ecx, 0x961a3787
xor ecx, 0x8661c02c
add eax, ecx
mov ecx, 0xff8c541d
xor edx, edx
div ecx
mov ecx, 0xe28fa87c
xor edx, edx
div ecx
mov dword [rsp + 0x3c], eax
mov eax, 0x9905694
xor eax, 0x9e289c47
mov dword [rsp + 0x38], eax
call fcn.140008c92
mov ecx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x3c]
cmp eax, ecx
ja 0x140027c6f
jmp 0x140027db3
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov eax, dword [0x14024c248]
imul eax, dword [0x14024c24c]
or eax, 0xd7b84af6
mov r8d, 0x4d21a7a2
xor r8d, 0x6afbcd17
mov ecx, 0x258e23a1
xor ecx, 0xda71dc5e
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x27da6ab5
or eax, 0x27da6ab5
imul eax, edx
add eax, ecx
mov ecx, 0xebae2615
xor ecx, 0x673598b0
add eax, ecx
add eax, 0x661cd54c
sub eax, 0x8c9bbea5
cmp eax, 0x46180cad
jae 0x140027dc5
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x48]
mov r9, qword [rsp + 0x50]
mov r10, qword [rsp + 0x70]
mov eax, dword [0x14024c250]
xor eax, 0x4cbce743
mov r11d, dword [0x14024c254]
mov esi, 0xdaf10348
xor esi, 0xede0a223
xor r11d, esi
imul eax, r11d
imul eax, eax, 0xbc59ebd8
sub eax, 0x3aa55444
mov r11d, 0x27e227db
xor r11d, 0x9c3f0c3e
xor eax, r11d
mov qword [r9], r10
mov qword [rcx + rdx*8 + 8], r8
cmp eax, 0x956b58ce
jb 0x140027d43
jmp 0x140027db3
add rsp, 0x80
pop rsi
ret
or byte [rcx + 0x5a], dl
invalid
invalid
Function at 0x1400287f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x14024c2a8]
mov ecx, dword [0x14024c2ac]
xor ecx, 0xa260e83a
xor eax, ecx
mov ecx, 0xb7491dec
xor edx, edx
div ecx
mov edx, 0x21501ec9
xor edx, 0xe65d36c3
mov ecx, eax
and ecx, edx
mov edx, 0x45d00985
xor edx, 0x82dd218f
xor eax, edx
or ecx, eax
mov edx, 0xffffffff
xor edx, 0x5bcbee70
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0x8580a739
xor ecx, 0x78e41bbf
cmp eax, ecx
je 0x1400288f3
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x14024c2b0]
xor eax, 0x100c432c
xor edx, edx
div dword [0x14024c2b4]
mov rdx, qword [rsp + 0x30]
mov r8d, 0xe0e00e05
xor r8d, 0xeabb3a04
imul eax, r8d
add eax, 0x3419f8f2
sub eax, 0x6a40e31e
mov r8d, 0x96accdc7
xor r8d, 0xa2b53535
sub eax, r8d
and eax, 0x891e0bd4
mov dword [rsp + 0x2c], eax
movabs rax, 0x453ebf396ecd61c4
movabs r8, 0x453ebf396ecd61c4
xor rax, r8
mov qword [rcx], rax
mov qword [rcx + 8], 0
call fcn.1400287b8
mov eax, dword [rsp + 0x2c]
cmp eax, 0x6b0d6ea0
jb 0x140028862
mov rax, qword [rsp + 0x40]
add rsp, 0x48
ret
cmpsb byte [rsi], byte [rdi]
mov bh, 0x36
jmp 0x140028862
Function at 0x14002d6c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.14000bd1e
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.140155d30
mov rax, qword [rsp + 0x30]
mov al, byte [rax + 0x50]
mov cl, 0x9d
xor cl, 0x9d
cmp al, cl
jne 0x14002d6ff
mov rcx, qword [rsp + 0x28]
call fcn.140156146
mov ecx, dword [0x14024c468]
mov edx, dword [0x14024c46c]
mov eax, ecx
xor eax, 0xffffffff
and eax, edx
mov r8d, 0x2fac375c
xor r8d, 0xd053c8a3
xor edx, r8d
and ecx, edx
sub ecx, eax
add ecx, 0x6ff69a2b
add ecx, 0x3102cb8
sub ecx, 0x6ff69a2b
sub ecx, 0xaa47421
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x5a5d48b9
mov edx, 0x8510ca18
xor edx, 0xdf4d82a1
mov r8d, 0x5ebfeae4
xor r8d, 0xa140151b
xor edx, r8d
and ecx, edx
or eax, ecx
cmp eax, 0xbc6ee162
jae 0x14002d7cf
mov eax, dword [0x14024c470]
or eax, dword [0x14024c474]
mov ecx, 0xf5c1afa7
xor edx, edx
div ecx
sub eax, 0x49271618
mov ecx, 0x6bc3b9fe
xor ecx, 0xa54752f2
sub eax, ecx
add eax, 0x49271618
mov ecx, eax
add ecx, 1
mov edx, 0xe4c5ce26
xor edx, 0x1b3a31d9
xor eax, edx
or eax, 0x193821f
add eax, ecx
mov ecx, 0x49dc8a0f
xor ecx, 0x6af9e337
cmp eax, ecx
je 0x14002d772
add rsp, 0x38
ret
hlt