joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400482e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140048304
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140048347
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x140048347
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, edi
mov byte [rdx], dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x140048478
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14004838a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400483b5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x14004847d
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004842a
sub eax, 1
je 0x14004842a
cmp eax, 2
jne 0x140048478
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x14004847d
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x14004845b
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140048478
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14004847d
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140048850
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140048919
cmp byte [rcx + 0x71], 0
je 0x140048919
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14004890c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400488c8
sub eax, 1
je 0x1400488cc
cmp eax, 2
jne 0x14004890c
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x1400488fa
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14004890c
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x14004a204
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004a24e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004a24e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004a24e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004a24e
cmp dword [rcx + 0x84], 0xe
jbe 0x14004a24e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004a250
xor al, al
add rsp, 0x28
ret
Function at 0x140016dc0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
nop dword [rax + rax]
mov eax, dword [0x141dc1a00]
imul eax, dword [0x141dc1a04]
xor eax, 0xc0aeaa78
shr eax, 2
imul rax, rax, 0x364cef65
shr rax, 0x3a
or eax, 0xa09f09c8
cmp eax, 0x4c5d0c0c
je 0x140016dd0
mov rdi, qword [rsi + 0x10]
xor eax, eax
test al, al
je 0x140016e0f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebp, ebp
nop dword [rax + rax]
mov rcx, rdi
call rbx
test bpl, bpl
jne 0x140016e20
test eax, eax
jne 0x140016e94
mov eax, dword [0x141dc1a08]
imul eax, dword [0x141dc1a0c]
xor eax, 0x1c88733c
add eax, 0xc7e7a4d9
or eax, 0xd6ac83a5
cmp eax, 0x1337f04d
jb 0x140016e77
mov eax, dword [0x141dc1a10]
add eax, dword [0x141dc1a14]
imul edi, eax, 0x22b4042e
or edi, 0xffefff7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0x37873bb
jae 0x140016e7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140016e51
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x140016e90
mov eax, 0xbe69c3f7
nop dword [rax]
mov ecx, dword [0x141dc1a18]
imul ecx, dword [0x141dc1a1c]
shr ecx, 1
imul rcx, rax
shr rcx, 0x3c
cmp ecx, 0xcc6774d8
je 0x140016ea0
cmp rsi, 0xffffffffffffffff
je 0x140017000
mov rcx, 0xffffffffffffffff
lock xadd qword [rsi + 8], rcx
nop word cs:[rax + rax]
mov eax, dword [0x141dc1a20]
sub eax, dword [0x141dc1a24]
and eax, 0xd42c661
add eax, 0x21893195
cmp eax, 0x9bacd4f9
ja 0x140016ee0
nop dword [rax]
mov eax, dword [0x141dc1a28]
xor edx, edx
div dword [0x141dc1a2c]
add eax, 0x849258d6
xor eax, 0x2c483765
add eax, 0x5f9e1e7e
cmp eax, 0x144f9ab7
ja 0x140016f00
cmp rcx, 1
jne 0x140017000
mov eax, dword [0x141dc1a30]
or eax, dword [0x141dc1a34]
imul eax, eax, 0xace5dddd
or eax, 0xe3de0b0e
add eax, 0x81d0e6ca
cmp eax, 0x50ea0b9b
jae 0x140016f60
mov rax, qword [0x141ddb260]
nop dword [rax + rax]
mov eax, dword [0x141dc1a38]
or eax, dword [0x141dc1a3c]
imul eax, eax, 0xaee67f4f
add eax, 0xc7714803
and eax, 0xfc733697
mov rdi, qword [0x141ddb260]
cmp eax, 0x1ec26be9
jb 0x140016f60
mov eax, dword [0x141dc1a40]
sub eax, dword [0x141dc1a44]
add eax, 0xc68167f5
mov ecx, 0xd86cef9f
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0xf75d8bf0
je 0x140016fea
mov eax, dword [0x141dc1a48]
mov ecx, dword [0x141dc1a4c]
add eax, ecx
add eax, 0x88557681
imul rbx, rax, 0x4b7b14d5
shr rbx, 0x3e
xor ebx, 0xedb5396d
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0x1f4e6b62
jae 0x140017000
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140016fb0
mov eax, dword [0x141dc1a50]
xor eax, dword [0x141dc1a54]
and eax, 0x880490
cmp eax, 0x21ad8d93
ja 0x140017000
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140017a50
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rcx
imul rdx, rdx, 0x443c729f
mov rcx, rdx
shr rcx, 0xd
xor rcx, rdx
add rcx, 0xffffffffb58276f4
mov rdx, rcx
rol rdx, 6
nop word cs:[rax + rax]
mov r8d, dword [0x141dc1bc0]
sub r8d, dword [0x141dc1bc4]
add r8d, 0x7ca0189e
xor r8d, 0xb076455c
cmp r8d, 0x8a8aa59b
ja 0x140017a80
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x140017ab0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
shr rax, 0x19
xor rax, rdx
imul rax, rax, 0xffffffff9a950caa
movabs rdx, 0x2393d053da83cb8a
add rdx, rax
mov rax, rdx
rol rax, 1
xor eax, edx
movzx eax, ax
add rax, rcx
nop dword [rax]
mov ecx, dword [0x141dc1bc8]
sub ecx, dword [0x141dc1bcc]
and ecx, 0x2800128
xor ecx, 0x27deefa
cmp ecx, 0xa2e4e0d7
ja 0x140017ae0
ret

Function at 0x140017ba0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0xffffffff8b54ae56
add rdx, 0x65230377
mov rcx, rdx
rol rcx, 1
nop word [rax + rax]
mov r8d, dword [0x141dc1be0]
sub r8d, dword [0x141dc1be4]
xor r8d, 0x4c20011
and r8d, 0x34c28371
cmp r8d, 0x5ab710c6
ja 0x140017bc0
mov r8d, 0xb0793cdd
nop dword [rax + rax]
mov r9d, dword [0x141dc1be8]
or r9d, dword [0x141dc1bec]
imul r9, r9, 0x5a7d0fa5
shr r9, 0x3e
add r9d, 0xfbad38e7
imul r9, r8
shr r9, 0x3f
cmp r9d, 0x47a5f1b6
je 0x140017bf0
xor ecx, edx
movzx ecx, cx
add rax, rcx
ret

Function at 0x140017c90
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0xffffffffedb3fb28
xor ecx, ecx
nop dword [rax]
test cl, cl
jne 0x140017ca0
movabs rcx, 0xffffffff450be045
add rdx, rcx
mov rcx, rdx
rol rcx, 1
xor rcx, rdx
nop word [rax + rax]
mov edx, dword [0x141dc1bf8]
add edx, dword [0x141dc1bfc]
xor edx, 0x208809
or edx, 0xffcf57f6
cmp edx, 0x380f870b
je 0x140017cc0
movzx ecx, cx
add rax, rcx
ret

Function at 0x140017e30
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0x1303053b
mov rcx, rdx
rol rcx, 1
xor rcx, rdx
mov rdx, rcx
rol rdx, 3
xor rdx, rcx
mov rcx, rdx
rol rcx, 1
xor rcx, rdx
xor edx, edx
nop dword [rax + rax]
test dl, dl
jne 0x140017e60
mov rdx, rcx
rol rdx, 2
nop dword [rax + rax]
mov r8d, dword [0x141dc1c08]
xor r8d, dword [str._.__n]
and r8d, 0xb0202000
xor r8d, 0x20413b00
or r8d, 0x4f9444ff
cmp r8d, 0x5179436a
je 0x140017e70
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141dc1c10]
mov edx, dword [0x141dc1c14]
add ecx, edx
add ecx, 0xd53ecc06
imul rcx, rcx, 0x4c6c460f
shr rcx, 0x3d
or ecx, 0x4df61a20
cmp ecx, 0x6886873b
ja 0x140017eb0
ret

Function at 0x140017fd0
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0xffffffffaf6a7303
mov rax, rcx
imul rdx, rdx, 0xffffffff892d7105
add rdx, 0xfffffffffef716c7
mov rcx, rdx
shr rcx, 1
xor rcx, rdx
mov rdx, rcx
rol rdx, 1
xor r8d, r8d
nop word [rax + rax]
test r8b, r8b
jne 0x140018000
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop dword [rax]
mov ecx, dword [0x141dc1c20]
mov edx, dword [0x141dc1c24]
add ecx, edx
add ecx, 0xea595b9b
xor ecx, 0xedb8ddd3
add ecx, 0xd1a7c12d
cmp ecx, 0xb125ac56
jb 0x140018010
ret
Function at 0x140018190
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0x23ee322b
add rdx, 0xb1307b4
mov rcx, rdx
shr rcx, 0x16
xor rcx, rdx
mov r8d, 0x9a378617
mov rdx, rcx
rol rdx, 2
nop dword [rax + rax]
mov r9d, dword [0x141dc1c58]
sub r9d, dword [0x141dc1c5c]
xor r9d, 0x29002101
or r9d, 0x16f7483e
imul r9, r8
shr r9, 0x3d
cmp r9d, 0xbdbb1aae
ja 0x1400181c0
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x140018200
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0x6507d0ab
add rdx, 0x70382c0f
mov r8, rdx
shr r8, 0x14
xor r8, rdx
mov r9, r8
rol r9, 3
nop
mov eax, dword [0x141dc1c60]
xor edx, edx
div dword [0x141dc1c64]
xor eax, 0xdd5d83a
add eax, 0x2a50932e
cmp eax, 0x39bb4252
ja 0x140018220
xor r9d, r8d
movzx eax, r9w
add rcx, rax
mov rax, rcx
ret

Function at 0x140018250
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov r8d, 0xbe7813e9
mov rcx, rdx
shr rcx, 0x16
xor rcx, rdx
xor rcx, 0x40a3e2b7
add rcx, 0x4211439b
nop word cs:[rax + rax]
mov edx, dword [0x141dc1c68]
or edx, dword [0x141dc1c6c]
imul rdx, r8
shr rdx, 0x3f
add edx, 0x1e694b89
cmp edx, 0x1c76faa5
jb 0x140018280
mov r8d, 0xbf13ac9f
mov rdx, rcx
rol rdx, 2
nop
mov r9d, dword [0x141dc1c70]
sub r9d, dword [0x141dc1c74]
and r9d, 0xb79939f2
add r9d, 0x14a48aa0
imul r9, r8
shr r9, 0x3f
cmp r9d, 0x90c22120
je 0x1400182b0
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141dc1c78]
xor ecx, dword [0x141dc1c7c]
xor ecx, 0xe5560d37
imul ecx, ecx, 0xa260f27c
add ecx, 0xe8743c74
cmp ecx, 0x9b733253
ja 0x1400182f0
ret

Function at 0x140018360
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
shr r8, 0xe
xor r8, rdx
mov eax, dword [0x141dc1c80]
xor edx, edx
div dword [0x141dc1c84]
mov rdx, r8
rol rdx, 1
xor rdx, r8
mov rax, 0xffffffffefcedbe3
sub rax, rdx
mov rdx, rax
rol rdx, 5
nop word cs:[rax + rax]
mov r8d, dword [0x141dc1c88]
xor r8d, dword [0x141dc1c8c]
imul r8d, r8d, 0x6537b9ca
add r8d, 0x94b2dcc2
cmp r8d, 0xdb611616
ja 0x1400183a0
xor edx, eax
movzx eax, dx
add rcx, rax
mov rax, rcx
ret

Function at 0x140018420
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x141dc1c90]
xor edx, edx
div dword [0x141dc1c94]
mov r9, r8
shr r9, 0xf
nop dword [rax + rax]
mov eax, dword [0x141dc1c98]
xor edx, edx
div dword [0x141dc1c9c]
xor eax, 0x2b89332
imul eax, eax, 0x288e7236
and eax, 0x5cfddbe2
cmp eax, 0xdb3021e7
ja 0x140018440
xor r9, r8
imul rdx, r9, 0x2b930655
not rdx
mov rax, rdx
rol rax, 4
xor rax, rdx
mov rdx, rax
rol rdx, 1
xor r8d, r8d
nop word cs:[rax + rax]
test r8b, r8b
jne 0x140018490
xor edx, eax
movzx eax, dx
add rcx, rax
mov rax, rcx
ret
Function at 0x1400184b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
imul rcx, rdx, 0x62b15481
nop word [rax + rax]
mov edx, dword [0x141dc1ca0]
or edx, dword [0x141dc1ca4]
xor edx, 0x40000000
or edx, 0x3ffbff7e
cmp edx, 0x7ee40980
jb 0x1400184c0
add rcx, 0x5e4ee9e
mov rdx, rcx
rol rdx, 2
nop
mov r8d, dword [0x141dc1ca8]
imul r8d, dword [0x141dc1cac]
and r8d, 0x12862480
or r8d, 0x60395275
imul r8, r8, 0x294ae649
shr r8, 0x3c
cmp r8d, 0x4c863120
ja 0x1400184f0
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x140018530
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0x2b97f889
lea rcx, [rdx + 1]
shr rcx, 8
mov r8, 0xfffffffffffffffe
sub r8, rdx
xor rcx, r8
mov rdx, rcx
rol rdx, 2
xor rdx, rcx
movzx ecx, dx
add rax, rcx
nop
mov ecx, dword [0x141dc1cb0]
or ecx, dword [0x141dc1cb4]
add ecx, 0xb015c160
xor ecx, 0x359c7f18
add ecx, 0x4f3e3779
cmp ecx, 0xd6069d3f
jb 0x140018560
ret

Function at 0x1400185e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
add rdx, 0x24b61fb0
xor rdx, 0xffffffffaa849540
imul rdx, rdx, 0x2c3947c9
mov rcx, rdx
rol rcx, 6
nop
mov r8d, dword [0x141dc1cc0]
xor r8d, dword [0x141dc1cc4]
and r8d, 0xbea85125
add r8d, 0xc717363
and r8d, 0xce61076e
cmp r8d, 0xd37596c9
ja 0x140018600
xor r8d, r8d
nop
test r8b, r8b
jne 0x140018630
xor ecx, edx
movzx ecx, cx
add rax, rcx
xor ecx, ecx
nop
test cl, cl
jne 0x140018640
ret

Function at 0x140018720
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
rol rcx, 3
xor rcx, rdx
nop dword [rax]
mov edx, dword [0x141dc1cd8]
or edx, dword [0x141dc1cdc]
imul r8, rdx, 0x2c1bf61b
shr r8, 0x20
sub edx, r8d
shr edx, 1
add edx, r8d
shr edx, 0x1e
add edx, 0x689feea
and edx, 0x819e05
cmp edx, 0xae9f1baf
je 0x140018730
add rcx, 0xffffffffeb98a398
mov rdx, rcx
rol rdx, 7
nop word cs:[rax + rax]
mov r8d, dword [0x141dc1ce0]
xor r8d, dword [0x141dc1ce4]
imul r8d, r8d, 0x63116e35
add r8d, 0xff69b51e
or r8d, 0xc5d0597d
cmp r8d, 0x186c370b
jb 0x140018780
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141dc1ce8]
and ecx, dword [0x141dc1cec]
imul ecx, ecx, 0x35e83955
cmp ecx, 0xe97b0929
je 0x1400187c0
ret

Function at 0x140018940
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
neg rdx
xor rdx, 0xffffffffc7cde61c
mov r8, rdx
shr r8, 0x12
xor r8, rdx
nop word cs:[rax + rax]
mov eax, dword [0x141dc1d00]
sub eax, dword [0x141dc1d04]
add eax, 0x92641c22
xor eax, 0xa0a020b4
and eax, 0xa4e0a5b6
cmp eax, 0x99c6a2ba
je 0x140018960
mov eax, dword [0x141dc1d08]
xor edx, edx
div dword [0x141dc1d0c]
mov eax, 0xe9b002c9
add r8, 0x1b0eeb36
mov rdx, r8
rol rdx, 7
xor rdx, r8
nop word cs:[rax + rax]
mov r8d, dword [0x141dc1d10]
and r8d, dword [0x141dc1d14]
xor r8d, 0x267d8ff
imul r8, rax
shr r8, 0x3e
cmp r8d, 0xd546c5a6
je 0x1400189b0
movzx eax, dx
add rcx, rax
mov rax, rcx
ret
Function at 0x1400189e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
rol rax, 1
xor rax, rdx
mov r8, rax
rol r8, 5
xor r8, rax
nop word cs:[rax + rax]
mov eax, dword [0x141dc1d18]
sub eax, dword [0x141dc1d1c]
or eax, 0x4a6cc46f
cmp eax, 0xba3b2dbb
je 0x140018a00
mov eax, dword [0x141dc1d20]
xor edx, edx
div dword [0x141dc1d24]
mov rax, r8
rol rax, 1
nop dword [rax]
mov edx, dword [0x141dc1d28]
and edx, dword [0x141dc1d2c]
xor edx, 0xa4be8c5d
imul rdx, rdx, 0x77ad769
shr rdx, 0x3a
cmp edx, 0x21d3b4a6
je 0x140018a30
nop word cs:[rax + rax]
mov edx, dword [0x141dc1d30]
add edx, dword [0x141dc1d34]
and edx, 0x96c40378
imul rdx, rdx, 0x389a07e1
shr rdx, 0x3c
cmp edx, 0x58772277
je 0x140018a60
xor eax, r8d
movzx eax, ax
add rcx, rax
mov rax, rcx
ret

Function at 0x140018c10
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
shr rax, 7
xor rax, rdx
mov edx, 0x31a5f665
sub rdx, rax
mov rax, rdx
rol rax, 1
xor eax, edx
movzx eax, ax
add rax, rcx
mov ecx, dword [0x141dc1d60]
or ecx, dword [0x141dc1d64]
or ecx, 0x8420020
and ecx, 0x8c42a430
xor ecx, 0xd31d01b9
cmp ecx, 0x292cae17
jb 0x140018c30
ret

Function at 0x140018da0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
not rdx
mov rcx, rdx
shr rcx, 0xe
nop dword [rax]
mov r8d, dword [0x141dc1d90]
xor r8d, dword [0x141dc1d94]
imul r8d, r8d, 0x3f44d300
add r8d, 0x53fd3700
cmp r8d, 0x1ad97706
jb 0x140018db0
xor rcx, rdx
mov rdx, rcx
shr rdx, 6
xor rdx, rcx
imul rcx, rdx, 0xc197ff8
mov rdx, rcx
rol rdx, 5
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x140018e00
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
not rdx
mov rcx, rdx
shr rcx, 0xb
xor rcx, rdx
add rcx, 0xffffffff9c48430d
mov rdx, rcx
rol rdx, 1
nop dword [rax]
mov r8d, dword [0x141dc1d98]
xor r8d, dword [0x141dc1d9c]
add r8d, 0xa517ce42
and r8d, 0x1ce85811
add r8d, 0xf07f80e4
cmp r8d, 0x26a6ba8a
ja 0x140018e20
xor edx, ecx
movzx ecx, dx
add rax, rcx
xor ecx, ecx
nop word cs:[rax + rax]
test cl, cl
jne 0x140018e60
ret

Function at 0x140018eb0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov r8, rdx
shr r8, 0x1a
xor r8, rdx
mov rcx, r8
shr rcx, 0xc
xor rcx, r8
nop word [rax + rax]
mov edx, dword [0x141dc1da0]
xor edx, dword [0x141dc1da4]
imul edx, edx, 0x6025a612
imul rdx, rdx, 0x55f25abf
shr rdx, 0x3e
cmp edx, 0xc83e0ce7
je 0x140018ed0
imul rcx, rcx, 0x557c8f5a
movabs rdx, 0x11729e1949dd8eca
add rdx, rcx
mov rcx, rdx
rol rcx, 1
xor ecx, edx
movzx ecx, cx
add rax, rcx
xor ecx, ecx
nop dword [rax]
test cl, cl
jne 0x140018f20
ret
Function at 0x140018f70
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
shr r8, 0x1c
xor r8, rdx
mov rdx, r8
xor rdx, 0xc48577c
rol rdx, 7
mov rax, rcx
xor rdx, r8
xor rdx, 0xffffffffa853c8e8
mov rcx, rdx
rol rcx, 3
xor rcx, rdx
xor edx, edx
nop word cs:[rax + rax]
test dl, dl
jne 0x140018fb0
movzx ecx, cx
nop word [rax + rax]
mov edx, dword [0x141dc1da8]
or edx, dword [0x141dc1dac]
and edx, 0x334c68dc
xor edx, 0x7528660e
imul edx, edx, 0x177f3e0b
cmp edx, 0x2b45b13d
jb 0x140018fc0
add rax, rcx
nop dword [rax]
mov ecx, dword [0x141dc1db0]
imul ecx, dword [0x141dc1db4]
imul ecx, ecx, 0xcaf2a66
or ecx, 0x4102800
and ecx, 0xa678ac00
cmp ecx, 0x4ee80523
je 0x140018ff0
ret

Function at 0x140019020
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
shr rcx, 1
xor rcx, rdx
xor rcx, 0xfffffffff20369e4
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
mov rcx, rdx
shr rcx, 0xc
xor rcx, rdx
mov rdx, rcx
rol rdx, 2
nop
mov r8d, dword [0x141dc1db8]
xor r8d, dword [0x141dc1dbc]
cmp r8d, 0x54a2aa29
je 0x140019050
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x140019070
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov r9, rdx
rol r9, 7
nop word [rax + rax]
mov eax, dword [0x141dc1dc0]
xor edx, edx
div dword [0x141dc1dc4]
add eax, 0x8cf5e089
and eax, 0x80010cef
cmp eax, 0x20fb412
jb 0x140019080
xor r9, r8
add r9, 0xbd94a6
xor r9, 0x3e637604
mov eax, dword [0x141dc1dc8]
or eax, dword [0x141dc1dcc]
imul eax, eax, 0xbf63ada4
or eax, 0xf3a9b39f
cmp eax, 0x5fbfcb09
je 0x1400190b0
mov rax, r9
rol rax, 4
nop word cs:[rax + rax]
mov edx, dword [0x141dc1dd0]
imul edx, dword [0x141dc1dd4]
xor edx, 0x85e09a
add edx, 0xf7561236
and edx, 0x738ef360
cmp edx, 0xa59f965f
ja 0x1400190e0
xor eax, r9d
movzx eax, ax
add rcx, rax
mov rax, rcx
ret

Function at 0x140019190
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
add rdx, 0xffffffffca28c985
mov rcx, rdx
rol rcx, 6
nop word cs:[rax + rax]
mov r8d, dword [0x141dc1de0]
imul r8d, dword [0x141dc1de4]
imul r8, r8, 0x25d63155
shr r8, 0x3b
imul r8d, r8d, 0xc381ae21
or r8d, 0x5795e0e7
cmp r8d, 0x99349449
je 0x1400191b0
xor ecx, edx
movzx ecx, cx
add rax, rcx
nop dword [rax]
mov ecx, dword [0x141dc1de8]
sub ecx, dword [0x141dc1dec]
and ecx, 0x2241
xor ecx, 0x191e648d
cmp ecx, 0x1756225d
jb 0x1400191f0
ret

Function at 0x140019220
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, 0xdda4bef1
imul rdx, rdx, 0xffffffff85378186
mov r8, rdx
rol r8, 7
xor r8, rdx
mov rdx, r8
rol rdx, 3
xor rdx, r8
nop word cs:[rax + rax]
mov r8d, dword [0x141dc1df0]
and r8d, dword [0x141dc1df4]
add r8d, 0xc1e1d472
imul r8, rcx
shr r8, 0x3f
cmp r8d, 0x5e824c28
je 0x140019250
movzx ecx, dx
add rax, rcx
mov ecx, 0xb18205a5
nop word cs:[rax + rax]
mov edx, dword [0x141dc1df8]
or edx, dword [0x141dc1dfc]
xor edx, 0x6b838a45
imul rdx, rcx
shr rdx, 0x3e
or edx, 0x690fbbd
cmp edx, 0xb38a6fb6
ja 0x140019290
ret
Function at 0x1400193b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, 0xfffffffff3aa2e8d
sub rax, rdx
mov rdx, rax
shr rdx, 0x1e
xor rdx, rax
mov r8, rdx
rol r8, 7
xor r8, rdx
nop
mov eax, dword [0x141dc1e10]
imul eax, dword [0x141dc1e14]
add eax, 0xf9f564a6
and eax, 0xb133669f
cmp eax, 0xf7958ff
jb 0x1400193d0
mov eax, dword [0x141dc1e18]
xor edx, edx
div dword [0x141dc1e1c]
mov rax, r8
rol rax, 2
xor rax, r8
mov rdx, rax
rol rdx, 2
nop dword [rax]
mov r8d, dword [0x141dc1e20]
xor r8d, dword [0x141dc1e24]
and r8d, 0xd042000a
or r8d, 0xfadcc31
imul r8, r8, 0xa9eec0d
shr r8, 0x3a
cmp r8d, 0x1c07d5eb
ja 0x140019410
mov r8d, dword [0x141dc1e28]
xor r8d, dword [0x141dc1e2c]
add r8d, 0xf383b136
or r8d, 0xca83bbfe
cmp r8d, 0x45ecf526
je 0x140019440
xor edx, eax
movzx eax, dx
add rcx, rax
mov rax, rcx
ret

Function at 0x140019480
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
rol rcx, 1
nop dword [rax]
mov r8d, dword [0x141dc1e30]
imul r8d, dword [0x141dc1e34]
add r8d, 0x1531cc1e
xor r8d, 0x4de40c0
or r8d, 0xd321bf35
cmp r8d, 0xc372d77e
je 0x140019490
xor rcx, rdx
imul rdx, rcx, 0x1a4ebab9
mov rcx, rdx
rol rcx, 4
xor rcx, rdx
add rcx, 0x1bf25327
mov rdx, rcx
rol rdx, 3
nop
mov r8d, dword [0x141dc1e38]
imul r8d, dword [0x141dc1e3c]
add r8d, 0x1781a5b6
or r8d, 0x5f238c9e
cmp r8d, 0xb95d3142
jb 0x1400194e0
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x1400197f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, 0xffffffff8adfc54d
sub rcx, rdx
imul rcx, rcx, 0x464ed3db
nop word cs:[rax + rax]
mov edx, dword [str.TZEa]
xor edx, dword [0x141dc1e7c]
imul edx, edx, 0x61a7389a
add edx, 0x9c958bca
cmp edx, 0x51b5761
jb 0x140019810
not rcx
mov rdx, rcx
rol rdx, 2
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x140019880
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
shr rcx, 8
xor rcx, rdx
neg rcx
mov rdx, rcx
shr rdx, 0x18
xor rdx, rcx
mov rcx, rdx
rol rcx, 7
xor rcx, rdx
nop word cs:[rax + rax]
mov edx, dword [0x141dc1e80]
add edx, dword [0x141dc1e84]
and edx, 0x60eb7b07
xor edx, 0xc8ef93a5
add edx, 0xdc99f6a3
cmp edx, 0x9deef74e
jb 0x1400198b0
mov rdx, rcx
rol rdx, 2
xor rdx, rcx
mov ecx, dword [0x141dc1e88]
sub ecx, dword [0x141dc1e8c]
or ecx, 0x84ccbd10
add ecx, 0xcd7328b3
cmp ecx, 0x3ce82694
jb 0x1400198e0
movzx ecx, dx
add rax, rcx
ret

Function at 0x140019970
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rcx
add rdx, 0x5e04f423
mov r8, rdx
shr r8, 2
xor r8, rdx
mov rcx, r8
rol rcx, 1
xor rcx, r8
nop dword [rax]
mov edx, dword [0x141dc1e98]
and edx, dword [0x141dc1e9c]
add edx, 0x759b39a5
cmp edx, 0xd8178a79
ja 0x140019990
movzx ecx, cx
add rax, rcx
mov ecx, dword [0x141dc1ea0]
sub ecx, dword [0x141dc1ea4]
xor ecx, 0xaf178071
add ecx, 0xa7707aba
cmp ecx, 0x81360aed
jb 0x1400199b0
ret