joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001ca00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov edx, dword [0x140200fe8]
add edx, dword [0x140200fec]
mov r8d, edx
xor r8d, 0xffffffff
and r8d, 0x6d453dd3
mov ecx, 0xffffffff
xor ecx, 0x6d453dd3
and edx, ecx
mov eax, 0xffffffff
xor eax, 0x5a0242b1
mov r9d, 0x496e959d
xor r9d, 0x242ba84e
and eax, r9d
and ecx, 0x5a0242b1
or r8d, edx
or eax, ecx
xor r8d, eax
or r8d, 0xbd88b692
mov eax, r8d
xor eax, 0xffffffff
and eax, 0xee7e9c79
mov edx, 0x3a3b5ff
xor edx, 0xeddd2986
mov ecx, 0x31bf56d0
xor ecx, 0xce40a92f
xor edx, ecx
and r8d, edx
mov ecx, 0xffffffff
xor ecx, 0xd30fa132
and ecx, 0xee7e9c79
and edx, 0xd30fa132
or eax, r8d
or ecx, edx
xor eax, ecx
cmp eax, 0x6ab84739
jbe 0x14001cc8c
mov eax, dword [0x140200ff0]
mov r8d, dword [0x140200ff4]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
mov r9d, 0x567b15a9
xor r9d, 0xa984ea56
xor ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov edx, eax
xor edx, 0xaa1177e0
xor edx, 0xffffffff
mov ecx, 0xdb13a55c
xor ecx, 0x7102d2bc
and ecx, edx
shl ecx, 1
sub ecx, 0xaa1177e0
sub eax, ecx
sub eax, 0x562038ba
mov ecx, 0xffffffff
xor ecx, 0x80ed78bc
mov edx, 0x6aa821ef
xor edx, 0x6aa821ef
mov r8d, 0xed5386a8
xor r8d, 0xed5386a9
sub edx, r8d
sub ecx, edx
sub eax, ecx
mov dword [rsp + 0x28], eax
call fcn.14000b9ba
mov rcx, rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax]
call fcn.1400d1c00
mov rcx, qword [rsp + 0x20]
mov eax, dword [rsp + 0x28]
cmp byte [rcx + 0x50], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x7d029fc0
jb 0x14001cc8c
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x14001cb8c
jmp 0x14001cb98
mov rax, qword [rsp + 0x30]
mov qword [rax], 0
mov r11d, dword [0x140200ff8]
xor r11d, dword [0x140200ffc]
mov edx, 0xffffffff
xor edx, 0xe645a738
mov ecx, r11d
and ecx, edx
mov eax, r11d
or eax, edx
xor eax, 0xffffffff
imul eax, ecx
mov ecx, r11d
and ecx, 0xe645a738
or r11d, 0xe645a738
imul r11d, ecx
add r11d, eax
mov eax, r11d
xor eax, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0x8e3153cc
mov edx, 0xffffffff
xor edx, 0xf29c82bc
mov ecx, eax
and ecx, 0xf29c82bc
and r11d, edx
mov r9d, r8d
and r9d, 0xf29c82bc
mov r10d, 0xe0c3389c
xor r10d, 0x6ef26b50
and r10d, edx
or ecx, r11d
or r9d, r10d
xor ecx, r9d
or eax, r8d
xor eax, 0xffffffff
or edx, 0xf29c82bc
and eax, edx
or ecx, eax
mov edx, 0xffffffff
xor edx, 0x1ebecd6c
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0xa9d6fc96
ja 0x14001cc95
mov eax, dword [0x140201000]
imul eax, dword [0x140201004]
mov ecx, 0xe0c4224f
xor ecx, 0x7e92dfd
and eax, ecx
xor eax, 0x4f54819
xor eax, 0x48d43e41
mov ecx, 0x1b3df910
xor ecx, 0x25855293
cmp eax, ecx
jae 0x14001cc50
add rsp, 0x38
ret
mov eax, 0xe9a83e93
sbb esi, edi
invalid
notrack jmp 0x14001ccb0
push rsp
invalid
Function at 0x14001d4c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
call fcn.14000b9ba
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx]
call fcn.14001d610
test al, 1
jne 0x14001d4f2
jmp 0x14001d5f4
mov eax, dword [0x140201038]
or eax, dword [0x14020103c]
sub eax, 0xb096eed2
mov edx, eax
xor edx, 0xffffffff
and edx, 0x34295d45
mov r8d, 0xffffffff
xor r8d, 0x34295d45
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0x5eb620ad
xor r8d, 0x6a9f7de8
mov edx, eax
and edx, r8d
or eax, 0x34295d45
imul eax, edx
add eax, ecx
or eax, 0x47fb2afb
cmp eax, 0xf29367fd
jbe 0x14001d606
mov eax, dword [0x140201040]
xor edx, edx
div dword [str.OjC]
mov ecx, eax
mov rax, qword [rsp + 0x38]
add ecx, 0x2a102b3
add ecx, 0x74de1057
mov edx, 0x41d5041b
xor edx, 0x437406a8
sub ecx, edx
mov edx, 0xf150fe7e
xor edx, 0x6f7d484b
and ecx, edx
or ecx, 0x8d617160
mov dword [rsp + 0x28], ecx
mov rax, qword [rax]
mov rcx, qword [rax]
mov qword [rsp + 0x48], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
call fcn.1400d2abe
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x28]
cmp byte [rcx + 0x50], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x5163994b
jb 0x14001d54f
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x14001d5e2
jmp 0x14001d601
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
mov edx, 8
call fcn.14000fb9a
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
add rsp, 0x58
ret
cmpsd dword [rsi], dword [rdi]
movabs eax, dword [0x90ffffff40e9cde4]

Function at 0x14001d840
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rcx
call fcn.14000b9ba
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.14001d610
test al, 1
jne 0x14001d86a
jmp 0x14001d8a8
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov qword [rsp + 0x38], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
call fcn.1400d2abe
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x50], 0
jne 0x14001d8a8
mov rcx, qword [rsp + 0x28]
mov edx, 8
call fcn.14000fb9a
mov ecx, dword [0x140201058]
imul ecx, dword [0x14020105c]
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
and eax, edx
mov edx, 0x1ed23059
xor edx, 0x1064f377
mov r8d, 0x13370f6a
xor r8d, 0x1d81cc44
or edx, r8d
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0xa4155b9f
xor edx, 0xaaa398b1
mov r8d, 0xca69a5e7
xor r8d, 0x35965a18
xor edx, r8d
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
sub eax, 0x8a809cf3
xor eax, 0x7e18090f
cmp eax, 0x18718e22
jbe 0x14001d96b
mov eax, dword [0x140201060]
mov ecx, 0x57e0aec7
xor ecx, 0xbf0bd26a
xor eax, ecx
sub eax, dword [0x140201064]
add eax, 0x8983c1d0
add eax, 0x31931731
mov ecx, 0xaa22c004
xor ecx, 0xaa22c004
mov edx, 0x2a87a794
xor edx, 0x9e064756
sub ecx, edx
add eax, ecx
cmp eax, 0x9df8774e
je 0x14001d91e
add rsp, 0x48
ret
invalid
Function at 0x14001f290
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov r8, qword [rcx]
mov qword [rsp + 0x40], r8
mov rax, rcx
add rax, 8
mov qword [rsp + 0x48], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x50], rax
mov rcx, r8
add rcx, 1
mov qword [rsp + 0x58], rcx
movabs rdx, 0x33162fc587354a72
movabs r9, 0xcce9d03a78cab58d
xor rdx, r9
xor r8, rdx
xor rcx, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
mov rdx, 0xffffffffffffffff
movabs r9, 0x22ee229476747923
xor rdx, r9
or rcx, r8
movabs r8, 0x22ee229476747923
or rdx, r8
xor rcx, 0xffffffffffffffff
and rcx, rdx
mov qword [rsp + 0x60], rcx
cmp rax, 0
je 0x14001f366
mov rax, qword [rsp + 0x60]
cmp rax, 0
jl 0x14001f35c
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
movabs rcx, 0xbfffffffffffffff
and rcx, qword [rax]
cmp rcx, rdx
mov qword [rsp + 0x28], rax
jl 0x14001f366
jmp 0x14001f3b0
call fcn.140007f57
jmp 0x14001f3e2
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov r8d, 1
mov r9d, 0x38
mov qword [rsp + 0x20], 8
call fcn.140011d90
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x60]
mov qword [rdx], rax
cmp rcx, 0
mov qword [rsp + 0x28], rax
jge 0x14001f3b0
call fcn.140007f57
jmp 0x14001f3e2
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
mov qword [r8], r9
add rcx, 8
imul rax, rax, 0x38
add rcx, rax
mov r8d, 0x38
call sub.msvcrt.dll_memcpy
mov ecx, dword [0x140201128]
mov r8d, dword [0x14020112c]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, ecx
and edx, r9d
mov eax, ecx
or eax, r9d
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, r8d
or ecx, r8d
imul ecx, edx
add ecx, eax
xor ecx, 0x36b4d85f
mov edx, 0x2049c72b
xor edx, 0xdfb638d4
mov eax, ecx
xor eax, edx
mov edx, ecx
xor edx, 0xffffffff
and eax, edx
mov edx, 0x896015c3
or edx, 0x896015c3
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
mov edx, 0x2ac1dbbb
xor edx, 0xa3a1ce78
or ecx, edx
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
or eax, 0x4da0c3f2
cmp eax, 0x4af9153b
jbe 0x14001f4d0
mov eax, dword [0x140201130]
mov ecx, dword [0x140201134]
mov edx, 0x6bfc7c60
xor edx, 0x9d01e5bc
xor ecx, edx
xor edx, edx
div ecx
mov ecx, eax
sub ecx, 0xe7d50ff6
add ecx, 0x5e6cd86c
mov eax, 0xdc31a5c9
xor eax, 0x3be4aa3f
add ecx, eax
mov eax, 0x56b4c8c5
xor eax, 0xf008e1da
or ecx, eax
mov eax, ecx
and eax, 0xf39aac44
mov edx, 0xa3b2b285
xor edx, 0x50281ec1
or ecx, edx
add eax, ecx
cmp eax, 0x1faa8bcd
je 0x14001f467
add rsp, 0x68
ret
and qword [r14 - 0x7116d0], r10
invalid
Function at 0x140020080
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov r8, qword [rcx]
mov qword [rsp + 0x50], r8
mov rax, rcx
add rax, 8
mov qword [rsp + 0x58], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x60], rax
mov rdx, r8
and rdx, 1
mov rcx, r8
or rcx, 1
add rdx, rcx
mov qword [rsp + 0x68], rdx
xor r8, 0xffffffffffffffff
mov rcx, rdx
and rcx, r8
xor rcx, 0xffffffffffffffff
and rdx, r8
movabs r8, 0xc5c9804b9599baa
movabs r9, 0xf3a367fb46a66455
xor r8, r9
xor rdx, r8
and rcx, rdx
xor rcx, 0xffffffffffffffff
mov qword [rsp + 0x70], rcx
cmp rax, 0
je 0x1400201ef
mov rax, qword [rsp + 0x70]
cmp rax, 0
jl 0x1400201e5
mov ecx, dword [0x140201188]
mov edx, dword [0x14020118c]
mov eax, ecx
xor eax, 0xffffffff
mov r8d, ecx
xor r8d, 0xffffffff
or eax, r8d
and eax, edx
xor eax, 0xffffffff
and edx, edx
mov r8d, 0x7c13e4af
xor r8d, 0x83ec1b50
xor edx, r8d
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
imul eax, eax, 0x942df27
mov ecx, 0x40f775b5
xor edx, edx
div ecx
sub eax, 0xd42f183c
cmp eax, 0x24e3a131
jbe 0x140020283
mov r8, qword [rsp + 0x60]
mov eax, dword [0x140201190]
xor eax, 0x5ea64f
xor eax, dword [0x140201194]
add eax, 0xdba5b69c
sub eax, 0xaf8d5397
sub eax, 0xdba5b69c
add eax, 0xec1ac955
mov ecx, 0x55789f9d
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x68]
movabs rcx, 0xbfffffffffffffff
and rcx, qword [r8]
cmp rcx, rdx
setl cl
mov byte [rsp + 0x3f], cl
cmp eax, 0x859efaee
ja 0x14002016f
mov rax, qword [rsp + 0x60]
mov cl, byte [rsp + 0x3f]
test cl, 1
mov qword [rsp + 0x30], rax
jne 0x1400201ef
jmp 0x140020239
call fcn.140007f57
jmp 0x14002027e
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
mov r8d, 1
mov r9d, 0x20
mov qword [rsp + 0x20], 8
call fcn.140011d90
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
mov qword [rdx], rax
cmp rcx, 0
mov qword [rsp + 0x30], rax
jge 0x140020239
call fcn.140007f57
jmp 0x14002027e
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
mov r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x30]
mov qword [r8], r9
add rax, 8
shl rdx, 5
add rax, rdx
mov rdx, qword [rcx]
mov qword [rax], rdx
mov rdx, qword [rcx + 8]
mov qword [rax + 8], rdx
mov rdx, qword [rcx + 0x10]
mov qword [rax + 0x10], rdx
mov rcx, qword [rcx + 0x18]
mov qword [rax + 0x18], rcx
add rsp, 0x78
ret
pop rcx
fadd dword [r10 - 0x11c17]
invalid
Function at 0x140020870
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1402011c8]
mov ecx, dword [0x1402011cc]
xor ecx, 0xa064a2b2
or eax, ecx
mov ecx, 0x7d47e561
xor ecx, 0xe966ab30
xor edx, edx
div ecx
mov ecx, 0x962f5797
xor ecx, 0x9040da28
imul eax, ecx
mov ecx, 0x27c10aff
xor ecx, 0xe7b9bf93
sub eax, ecx
mov ecx, 0x2158ebf1
xor ecx, 0xf99ed57c
cmp eax, ecx
ja 0x1400209ba
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
mov r8d, dword [0x1402011d0]
mov eax, dword [0x1402011d4]
xor eax, r8d
mov r8d, eax
xor r8d, 0x5d46117e
xor eax, 0xa469a736
and eax, r8d
imul eax, eax, 0xe1050d1d
and eax, 0x80f23567
mov dword [rbp - 0x3c], eax
mov eax, 0x10
call fcn.1401ffc50
sub rsp, rax
mov eax, dword [rbp - 0x3c]
mov r8, rsp
mov qword [rbp - 0x38], r8
mov r8, rcx
add r8, 8
mov qword [rbp - 0x30], r8
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x28], rcx
mov r8, rdx
add r8, 8
mov qword [rbp - 0x20], r8
cmp rcx, qword [rdx + 8]
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0x6dd6591e
je 0x1400208d3
mov rax, qword [rbp - 0x28]
mov cl, byte [rbp - 0x11]
test cl, 1
mov qword [rbp - 0x48], rax
jne 0x14002099c
jmp 0x14002096e
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.1400203b1
mov rax, qword [rbp - 0x20]
add rsp, 0x20
mov rax, qword [rax]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp - 8]
mov r8, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x48]
mov r8, qword [r8]
mov qword [rdx], r8
mov qword [rax], rcx
mov rsp, rbp
pop rbp
ret
mov eax, 0xe94d225b
adc bh, bh
invalid

Function at 0x140022205
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
xor eax, eax
mov edx, eax
call fcn.1400217e0
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp fcn.140021c50
Function at 0x140022260
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1402012a8]
xor eax, 0x9be45469
imul eax, dword [0x1402012ac]
mov edx, 0x6af37568
xor edx, 0x950c8a97
mov ecx, eax
xor ecx, edx
mov edx, 0x5b3c436
xor edx, 0xdda39fa9
and edx, ecx
mov r8d, 0xffffffff
xor r8d, 0xd8105b9f
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xd8105b9f
or eax, 0xd8105b9f
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x29b13e04
mov edx, 0xc5926dc0
xor edx, 0xec2353c4
mov r8d, 0x575a01d1
xor r8d, 0xa8a5fe2e
xor edx, r8d
and eax, edx
sub eax, ecx
mov edx, eax
xor edx, 0x687523df
mov ecx, 0x40b159db
xor ecx, 0xbf4ea624
xor edx, ecx
and edx, 0x687523df
mov ecx, 0x2e69e2e1
xor ecx, 0x2e69e2e3
imul ecx, edx
mov edx, 0x4eca263d
xor edx, 0x26bf05e2
sub ecx, edx
sub eax, ecx
mov ecx, 0x74dcc11d
xor ecx, 0xea6ed421
cmp eax, ecx
jbe 0x140022483
mov eax, dword [0x1402012b0]
mov edx, dword [0x1402012b4]
mov ecx, eax
xor ecx, 0xffffffff
and ecx, edx
xor edx, 0xffffffff
and eax, edx
sub eax, ecx
or eax, 0x6a1997a8
mov ecx, 0xffffffff
xor ecx, 0x777a6cce
add eax, ecx
add eax, 1
sub eax, 0xf6bbb84
mov dword [rsp + 0x28], eax
call fcn.14000b9ba
mov rcx, rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax]
call fcn.1400dc266
mov rcx, qword [rsp + 0x20]
mov eax, dword [rsp + 0x28]
mov cl, byte [rcx + 0x50]
mov dl, 0x25
xor dl, 0x25
cmp cl, dl
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x21f86698
je 0x140022483
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1400223bb
jmp 0x14002247e
mov eax, dword [0x1402012b8]
xor eax, 0x9309bf02
mov ecx, dword [0x1402012bc]
add eax, 0xc6e4eb73
sub eax, ecx
sub eax, 0xc6e4eb73
mov edx, eax
xor edx, 0xffffffff
and edx, 0x21dfc56d
mov r8d, 0xffffffff
xor r8d, 0x21dfc56d
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0xe84f3f68
xor r8d, 0xc990fa05
mov edx, eax
and edx, r8d
or eax, 0x21dfc56d
imul eax, edx
add eax, ecx
mov ecx, 0x67697766
xor edx, edx
div ecx
imul eax, eax, 0xaf1598d
mov ecx, 0x6ef0f2c5
xor ecx, 0x5c4abd6
cmp eax, ecx
jae 0x14002248c
mov eax, dword [0x1402012c0]
add eax, dword [0x1402012c4]
mov ecx, 0x21add4b0
xor edx, edx
div ecx
mov ecx, 0x606cb55f
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x30]
imul eax, eax, 0x678c12fa
mov ecx, 0x89e3016c
xor ecx, 0x73eb77db
mov qword [rdx], 0
cmp eax, ecx
ja 0x140022436
jmp 0x14002247e
add rsp, 0x38
ret
invalid
invalid
Function at 0x140023040
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov r8, qword [rcx]
movabs rcx, 0x7ffaa4ed61f8739a
movabs rax, 0x80055b129e078c65
xor rcx, rax
mov rax, r8
and rax, rcx
mov rcx, r8
or rcx, 0xffffffffffffffff
add rax, rcx
mov qword [rsp + 0x50], rax
mov rcx, rax
and rcx, rcx
xor rcx, 0xffffffffffffffff
and rcx, r8
xor rcx, 0xffffffffffffffff
and r8, r8
movabs rdx, 0x4f6f16b323eb8b0a
movabs r9, 0xb090e94cdc1474f5
xor rdx, r9
xor r8, rdx
movabs r9, 0x1c4a1869534570ad
movabs rdx, 0xe3b5e796acba8f52
xor r9, rdx
mov rdx, rax
xor rdx, r9
xor r8, 0xffffffffffffffff
or rdx, r8
and rcx, rdx
xor rcx, 0xffffffffffffffff
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x14002310b
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
add rcx, 8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
jmp 0x1400231d8
mov eax, dword [0x140201338]
mov ecx, dword [0x14020133c]
add eax, 0x95b68c73
sub eax, ecx
sub eax, 0x95b68c73
sub eax, 0x53d65bf1
mov ecx, 0x4d392a32
xor ecx, 0xc7d8d6c2
sub eax, ecx
add eax, 0x53d65bf1
sub eax, 0xa6ff0ac2
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0x250e9dfa
xor edx, 0x75775518
and ecx, edx
mov edx, 0x66a40990
xor edx, 0x36ddc172
mov r8d, 0x9d824992
xor r8d, 0x627db66d
xor edx, r8d
and eax, edx
sub eax, ecx
cmp eax, 0x25b47dd5
je 0x1400232dd
mov eax, dword [0x140201340]
mov ecx, 0xda344441
xor ecx, 0x87a0033f
xor eax, ecx
xor eax, dword [str.oOOr]
mov ecx, 0xb341c117
xor ecx, 0xe1f357f9
add eax, ecx
imul eax, eax, 0x9b1e1df5
xor eax, 0x4c796a53
mov dword [rsp + 0x2c], eax
mov eax, 0x7f3d5799
xor eax, 0x2e44c807
mov dword [rsp + 0x28], eax
call fcn.140007f57
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
jb 0x14002317b
jmp 0x1400232d8
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
cmp rax, rcx
jl 0x1400232cb
mov rax, qword [rsp + 0x20]
movabs rcx, 0x2c09d30600964c2e
movabs rdx, 0x2c09d30600964c2e
xor rcx, rdx
cmp rax, rcx
jl 0x140023228
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
cmp rax, qword [rcx]
jl 0x140023235
mov rcx, rdx
call fcn.140014583
jmp 0x1400232d8
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
add rcx, 8
shl rax, 3
add rcx, rax
call fcn.140022f30
mov rcx, qword [rsp + 0x20]
movabs rdx, 0x110799b43e6db1aa
mov rax, rcx
add rax, rdx
add rax, 0xffffffffffffffff
movabs rdx, 0x2d94c0fc31ef8841
movabs r8, 0x3c9359480f8239eb
xor rdx, r8
sub rax, rdx
mov rdx, rax
xor rdx, rcx
cmp rdx, 0
setl r8b
cmp rcx, 0
setne cl
mov dl, cl
xor dl, r8b
xor r9d, r9d
xor r9b, 1
xor dl, r9b
or cl, r8b
and cl, dl
test cl, 1
mov qword [rsp + 0x38], rax
jne 0x1400232c1
jmp 0x1400231d8
call fcn.140007f57
jmp 0x1400232d8
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
add rsp, 0x58
ret
xchg byte [rcx + 0x7f], bh
push rax
jmp 0x14002317b
Function at 0x140028990
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.14000b9ba
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.14012eee6
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x50], 0
jne 0x1400289c9
mov rcx, qword [rsp + 0x28]
call fcn.14012eede
mov eax, dword [0x1402015d8]
mov ecx, dword [0x1402015dc]
xor ecx, 0x407d3fc7
xor edx, edx
div ecx
mov ecx, 0x7490132e
xor edx, edx
div ecx
mov ecx, eax
mov edx, 0xf32d9ec4
xor edx, 0xd33b5624
mov eax, ecx
xor eax, edx
mov edx, 0xffffffff
xor edx, 0x2016c8e0
and ecx, edx
shl ecx, 1
sub ecx, eax
mov eax, ecx
and eax, 0x44b6028d
mov edx, 0xf622cd22
xor edx, 0x9dd32dd
xor eax, edx
mov edx, 0x77f654ad
xor edx, 0x8809ab52
xor ecx, edx
mov edx, 0x7fbbb3eb
xor edx, 0x3b0db166
mov r8d, 0x14fef671
xor r8d, 0xeb01098e
xor edx, r8d
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
cmp eax, 0xad42e9ec
ja 0x140028ab5
mov eax, dword [0x1402015e0]
sub eax, dword [0x1402015e4]
and eax, 0xda28ac51
mov ecx, eax
xor ecx, 0x67e81019
mov edx, 0xf9c4ba93
xor edx, 0x63b456c
xor ecx, edx
or eax, 0x67e81019
and eax, ecx
mov ecx, 0x465628a7
xor ecx, 0x32007ce6
sub eax, ecx
add eax, 0x18482921
mov ecx, 0x37842506
xor ecx, 0x43d27147
add eax, ecx
cmp eax, 0x5cabf33d
je 0x140028a59
add rsp, 0x38
ret
adc al, 0xab
sbb esp, dword [rsi - 0x17]
wait
invalid
Function at 0x1400296e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov eax, dword [0x140201638]
mov ecx, dword [0x14020163c]
xor ecx, 0x2ba93e28
xor edx, edx
div ecx
mov ecx, 0xffffffff
xor ecx, 0x7e95b228
add eax, ecx
add eax, 1
imul eax, eax, 0x3112dbd5
xor eax, 0xc23eb8a2
cmp eax, 0x2f7e1efd
je 0x140029853
mov eax, dword [0x140201640]
xor eax, 0x36771c9b
mov ecx, dword [0x140201644]
mov edx, 0x64da5ead
xor edx, 0x9b25a152
xor ecx, edx
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
sub eax, 0xb1e86a1a
imul eax, eax, 0xefb30084
and eax, 0x388d7142
mov dword [rsp + 0x38], eax
call fcn.14000b9ba
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
call fcn.14005a630
mov rcx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x38]
cmp byte [rcx + 0x50], 0
sete cl
mov byte [rsp + 0x3f], cl
cmp eax, 0xe7bbd49d
je 0x140029725
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x1400297a4
jmp 0x14002984e
mov eax, dword [0x140201648]
xor eax, dword [0x14020164c]
mov ecx, 0xb6e0bebf
xor ecx, 0x593fb0bd
sub eax, ecx
or eax, 0x60b39f5f
or eax, 0xc2c8a476
cmp eax, 0x44beb3c0
je 0x14002985c
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x140201650]
mov edx, dword [0x140201654]
xor edx, 0xcd65dc23
sub eax, edx
sub eax, 0x8557700a
mov edx, 0x5ccf2a88
xor edx, 0xd74111f9
sub eax, edx
add eax, 0x8557700a
mov edx, 0xf21db1bc
xor edx, 0x24629cdb
add eax, edx
mov edx, 0x8b047ebf
xor edx, 0x8b047ebf
mov r8d, 0xb94637ac
xor r8d, 0x56fb2c65
sub edx, r8d
add eax, edx
mov dword [rsp + 0x2c], eax
mov edx, 0x20
call fcn.1400083d0
mov eax, dword [rsp + 0x2c]
cmp eax, 0x9dd38edd
ja 0x14002985c
jmp 0x14002984e
add rsp, 0x48
ret
add al, 0xb2
sub dword [rcx + rbp*8 - 0x37], esp
invalid
invalid
Function at 0x140030230
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x140201a18]
imul eax, dword [0x140201a1c]
and eax, 0x15c2fdcd
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x95d2e408
mov edx, 0xffffffff
xor edx, 0x95d2e408
and eax, edx
sub eax, ecx
or eax, 0x9fbb6ac6
cmp eax, 0x7cf2baf
jb 0x14003044e
mov eax, dword [0x140201a20]
xor eax, 0x41057bb3
or eax, dword [0x140201a24]
mov ecx, 0xd39cd889
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
and eax, 0x203ec71e
xor ecx, 0x203ec71e
or eax, ecx
add eax, 0x5914e506
mov dword [rsp + 0x28], eax
call fcn.14000b9ba
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.1401de4a5
mov rcx, qword [rsp + 0x20]
mov eax, dword [rsp + 0x28]
mov cl, byte [rcx + 0x50]
mov dl, 0xa2
xor dl, 0xa2
cmp cl, dl
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x7688aeea
je 0x140030275
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1400302f3
jmp 0x1400302fd
mov rcx, qword [rsp + 0x30]
call fcn.1401de4ca
mov eax, dword [0x140201a28]
mov ecx, dword [0x140201a2c]
and eax, eax
xor eax, 0xffffffff
and ecx, ecx
mov edx, 0x93b42e4f
xor edx, 0x6c4bd1b0
xor ecx, edx
and eax, ecx
xor eax, 0xffffffff
sub eax, 0xe189f7b9
mov ecx, 0xffffffff
xor ecx, 0xa486c5f1
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0x7c69dd68
xor edx, 0x66838760
and edx, ecx
mov r8d, 0xffffffff
xor r8d, 0x1aea5a08
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x1aea5a08
or eax, 0x1aea5a08
imul eax, edx
add eax, ecx
cmp eax, 0x96780bd9
jbe 0x140030457
mov ecx, dword [0x140201a30]
xor ecx, dword [0x140201a34]
xor ecx, 0xf1c0562c
or ecx, ecx
xor ecx, 0xffffffff
mov eax, 0xd5102f24
xor eax, 0x55cf492a
mov edx, 0xb4ddc2f2
xor edx, 0x4b223d0d
xor eax, edx
mov edx, 0xffffffff
xor edx, 0x80df660e
and eax, edx
or ecx, eax
xor ecx, 0xffffffff
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
and eax, edx
mov edx, 0x24798088
xor edx, 0x230a6513
mov r8d, 0x5696ac30
xor r8d, 0x51e549ab
or edx, r8d
xor edx, 0xffffffff
or eax, edx
mov edx, 0x888f74d
xor edx, 0xf77708b2
xor eax, edx
mov edx, 0x5dea0853
xor edx, 0xa215f7ac
xor ecx, edx
mov edx, 0x41e448b3
xor edx, 0x4697ad28
mov r8d, 0x4049b31b
xor r8d, 0xbfb64ce4
xor edx, r8d
and ecx, edx
mov edx, 0x7a001e50
xor edx, 0x85ffe1af
xor eax, edx
mov edx, 0xd4286ee0
xor edx, 0x2bd7911f
xor ecx, edx
and eax, ecx
cmp eax, 0xf31dba37
ja 0x140030457
add rsp, 0x38
ret
adc eax, 0xe97e059c
invalid
invalid