joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007ff10
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
mov ecx, dword [0x140253db8]
mov r8d, dword [0x140253dbc]
mov eax, ecx
xor eax, 0xffffffff
mov edx, r8d
and edx, eax
mov r9d, r8d
xor r9d, 0xffffffff
mov eax, ecx
and eax, r9d
imul eax, edx
mov edx, ecx
and edx, r8d
or ecx, r8d
imul ecx, edx
add ecx, eax
mov edx, 0xff7010d9
xor edx, 0xd791cb9f
mov eax, ecx
and eax, edx
xor ecx, 0x28e1db46
or eax, ecx
xor eax, 0xa2c7957a
mov ecx, 0xa7c0d4d
xor edx, edx
div ecx
cmp eax, 0x3c075736
je 0x14008012b
mov eax, dword [0x140253dc0]
xor eax, 0xcb8bf813
mov r9d, dword [0x140253dc4]
mov r8d, r9d
xor r8d, 0x7b4bb509
xor r9d, 0x84b44af6
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
not ecx
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
imul eax, eax, 0x700b59d0
mov ecx, eax
not ecx
and ecx, 0x256ae5cf
and eax, 0xda951a30
sub eax, ecx
mov edx, eax
not edx
and edx, 0x2c1bdfda
mov ecx, eax
and ecx, 0xd3e42021
imul ecx, edx
mov edx, eax
and edx, 0x2c1bdfd0
or eax, 0x2c1bdfda
imul eax, edx
add eax, ecx
mov dword [rbp - 0x2c], eax
mov eax, 0xc7ba38b
mov dword [rbp - 0x30], eax
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
sub rsp, 0x20
call fcn.14006d36b
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x38], rcx
mov qword [rax], 0
mov qword [rax + 8], 0
mov ecx, 8
sub rsp, 0x20
call fcn.14006d7d0
mov rdx, qword [rbp - 0x38]
mov ecx, dword [rbp - 0x30]
add rsp, 0x20
mov r8, rax
mov eax, dword [rbp - 0x2c]
mov qword [rbp - 0x28], r8
cmp byte [rdx], 0
sete dl
mov byte [rbp - 0x19], dl
cmp eax, ecx
jb 0x14007ff89
mov cl, byte [rbp - 0x19]
mov al, 1
test cl, 1
mov byte [rbp - 0x41], al
jne 0x140080096
jmp 0x1400800ee
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x28]
sub rsp, 0x20
call fcn.14007fedc
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov al, 1
cmp byte [rcx], 0
mov byte [rbp - 0x41], al
jne 0x1400800ee
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x28]
mov r8, qword [rax + 0x58]
mov qword [rdx], r8
mov rax, qword [rax + 0x60]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140019410
mov rax, qword [rbp - 0x38]
add rsp, 0x20
mov al, byte [rax]
mov byte [rbp - 0x41], al
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x28]
mov dl, byte [rbp - 0x41]
mov byte [rbp - 0x42], dl
mov byte [rax], 0
sub rsp, 0x20
call fcn.14006d09c
mov rax, qword [rbp - 0x38]
add rsp, 0x20
cmp byte [rax], 0
jne 0x140080122
mov rax, qword [rbp - 0x38]
mov cl, byte [rbp - 0x42]
mov byte [rax], cl
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
xchg edi, eax
clc
jo 0x1400801a7
jmp 0x14007ff89
loopne 0x1400801f1
mov edx, dword [rax]
xor dword [rdi], eax
add esp, dword [rsi + 0x31]
sar dword [rdx - 1], 1
Function at 0x1400804e2
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov ecx, dword [0x140253dd8]
mov edx, dword [0x140253ddc]
xor edx, 0x8a1715b1
mov eax, ecx
xor eax, 0xffffffff
and eax, edx
xor edx, 0xffffffff
and ecx, edx
sub ecx, eax
mov edx, 0x5fcbe590
xor edx, 0xa0341a6f
mov eax, ecx
xor eax, edx
mov edx, 0xffffffff
xor edx, 0x7e83fd60
and eax, edx
xor ecx, 0xffffffff
mov edx, 0x272a4e63
xor edx, 0x59a9b303
mov r8d, 0xdaec183b
xor r8d, 0x2513e7c4
xor edx, r8d
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov edx, 0x40cb7ffe
xor edx, 0xbf348001
mov ecx, eax
xor ecx, edx
xor eax, 0xffffffff
and ecx, eax
mov eax, 0x52470e5b
xor eax, 0xaf715322
mov edx, 0x944157a4
xor edx, 0x6bbea85b
xor eax, edx
mov edx, 0xffffffff
xor edx, 0xfd365d79
and eax, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
and ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0x72ebc856
xor edx, 0x8d1437a9
xor ecx, edx
and eax, ecx
mov ecx, 0xa95c40ad
or ecx, 0xa95c40ad
xor ecx, 0xffffffff
xor eax, 0xffffffff
mov edx, 0xdd698575
xor edx, 0x22967a8a
xor ecx, edx
and eax, ecx
cmp eax, 0x156edc9e
je 0x1400804d9
mov eax, dword [0x140253de0]
mov ecx, dword [0x140253de4]
not eax
xor ecx, 0x2c517d02
and eax, ecx
not eax
mov ecx, eax
or ecx, 0xacd13557
xor ecx, 0x23b9c010
or eax, 0xdc463fef
and eax, ecx
add eax, 0x99bf4b67
mov dword [rbp - 0x18], eax
mov eax, 0x94226b4c
mov dword [rbp - 0x1c], eax
mov eax, 0x20
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.14006d36b
mov rdx, qword [rbp - 0x10]
mov ecx, dword [rbp - 0x1c]
add rsp, 0x20
mov eax, dword [rbp - 0x18]
cmp rdx, 0
sete dl
mov byte [rbp - 0x11], dl
cmp eax, ecx
ja 0x140080405
mov al, byte [rbp - 0x11]
test al, 1
jne 0x14008048f
jmp 0x1400804a5
mov rcx, qword [rbp - 8]
sub rsp, 0x20
call fcn.14006d926
add rsp, 0x20
jmp 0x1400804d4
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax]
mov qword [rdx], r8
mov r8, qword [rax + 8]
mov qword [rdx + 8], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 0x10], rax
sub rsp, 0x20
call fcn.140080140
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
out dx, eax
push 0x23e9eeaa
invalid
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006d36b
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x140080310
Function at 0x140080510
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rcx
call fcn.14006d36b
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
movabs rax, 0x179c8a623ce78d1c
movabs rdx, 0x179c8a623ce78d1c
xor rax, rdx
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov ecx, 8
call fcn.14006d7d0
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov al, 1
cmp byte [rcx], 0
mov byte [rsp + 0x67], al
jne 0x1400806a0
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x58]
call fcn.1400804e2
mov rcx, qword [rsp + 0x50]
mov al, 1
cmp byte [rcx], 0
mov byte [rsp + 0x67], al
jne 0x1400806a0
mov ecx, dword [0x140253de8]
mov eax, dword [0x140253dec]
mov edx, 0x316483a3
xor edx, 0x7e4e133d
add ecx, edx
sub ecx, eax
sub ecx, 0x4f2a909e
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x47ddfe23
mov edx, 0xffffffff
xor edx, 0x47ddfe23
and ecx, edx
or eax, ecx
mov ecx, 0x61dc4435
xor edx, edx
div ecx
mov edx, eax
mov eax, 0xb3448725
xor eax, 0x452d97b3
mov ecx, edx
xor ecx, eax
mov eax, 0xffffffff
xor eax, 0xf6691096
and edx, eax
mov eax, 0x11bec0bb
xor eax, 0x11bec0b9
imul eax, edx
sub eax, ecx
cmp eax, 0x93a8528e
jae 0x1400806e3
mov rcx, qword [rsp + 0x48]
mov eax, dword [0x140253df0]
xor eax, 0xb58b16a7
mov edx, dword [0x140253df4]
add eax, 0xff84708b
add eax, edx
mov edx, 0x294c5d51
xor edx, 0xd6c82dda
sub eax, edx
or eax, 0x74a7dfea
xor eax, 0xed7df01c
mov r8d, 0x972cf1b3
xor edx, edx
div r8d
mov edx, eax
mov rax, qword [rsp + 0x58]
mov dword [rsp + 0x30], edx
mov rdx, qword [rax + 0x58]
mov qword [rsp + 0x68], rdx
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x68]
call fcn.140019410
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x30]
mov cl, byte [rcx]
mov byte [rsp + 0x37], cl
cmp eax, 0x5fa52931
ja 0x140080613
mov al, byte [rsp + 0x37]
mov byte [rsp + 0x67], al
jmp 0x1400806a0
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov dl, byte [rsp + 0x67]
mov byte [rsp + 0x2f], dl
mov byte [rax], 0
call fcn.14006d09c
mov rax, qword [rsp + 0x50]
mov al, byte [rax]
mov cl, 0x73
xor cl, 0x73
cmp al, cl
jne 0x1400806d9
mov rax, qword [rsp + 0x50]
mov cl, byte [rsp + 0x2f]
mov byte [rax], cl
mov rax, qword [rsp + 0x40]
add rsp, 0x78
ret
rcr byte [rdi + rbx], cl
int 0xe9
invalid
Function at 0x1400808c6
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x140253df8]
or eax, dword [0x140253dfc]
mov ecx, 0x9ad0dcfd
xor edx, edx
div ecx
sub eax, 0xdbc01747
add eax, 0xe1cd1a6c
mov ecx, 0x8231294e
xor ecx, 0x59f13e09
add eax, ecx
mov ecx, 0x5e6c34fe
xor edx, edx
div ecx
mov ecx, 0x4f276715
xor ecx, 0xdc790387
cmp eax, ecx
je 0x1400808bd
mov eax, dword [0x140253e00]
mov r9d, dword [0x140253e04]
mov r8d, r9d
xor r8d, 0xf885f6e6
xor r9d, 0x77a0919
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
not ecx
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
imul rax, rax, 0xd5a1d9b
shr rax, 0x3a
add eax, 0xe9d89c31
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x69981814
and ecx, 0x1422604b
imul ecx, edx
mov edx, eax
and edx, 0x80408423
or eax, 0x9462e46b
imul eax, edx
add eax, ecx
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
sub rsp, 0x20
call fcn.14006d36b
mov rcx, qword [rbp - 0x10]
add rsp, 0x20
mov eax, dword [rbp - 0x18]
cmp rcx, 0
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0x309da6df
jbe 0x1400807ba
mov al, byte [rbp - 0x11]
test al, 1
jne 0x14008087b
jmp 0x140080891
mov rcx, qword [rbp - 8]
sub rsp, 0x20
call fcn.14006d926
add rsp, 0x20
jmp 0x1400808b8
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.1400806ec
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
adc eax, edx
call 0x13efcf1db
invalid
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006d36b
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x140080760
Function at 0x140081ab0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x140253eb8]
mov edx, dword [0x140253ebc]
mov ecx, eax
xor ecx, edx
mov r8d, 0xb304420
xor r8d, 0xf4cfbbdf
xor ecx, r8d
or eax, edx
and eax, ecx
mov ecx, 0x350e5273
xor edx, edx
div ecx
mov ecx, eax
and ecx, 0xe549d4ed
mov edx, 0x522b560
xor edx, 0xe06b618d
xor eax, edx
or ecx, eax
mov eax, ecx
and eax, 0xee53883f
xor eax, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0x2ef7f19a
xor edx, 0xc0a479a5
mov r8d, 0x57352d08
xor r8d, 0xa8cad2f7
xor edx, r8d
or ecx, edx
xor eax, 0xffffffff
mov edx, 0xea56c5b4
xor edx, 0x15a93a4b
xor ecx, edx
or eax, ecx
mov ecx, 0xe61a560f
xor ecx, 0x1a4a1878
cmp eax, ecx
ja 0x140081c5c
mov eax, dword [0x140253ec0]
mov ecx, dword [0x140253ec4]
imul eax, ecx
xor eax, 0x845233ca
add eax, 0x5d515c6b
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x38be9eb8
and ecx, 0xc7416147
imul ecx, edx
mov edx, eax
and edx, 0xc7416147
or eax, 0xc7416147
imul eax, edx
add eax, ecx
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.14006d36b
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov edx, 2
sub rsp, 0x20
call fcn.14006df20
mov rcx, qword [rbp - 0x20]
mov eax, dword [rbp - 0x18]
add rsp, 0x20
mov cl, byte [rcx]
mov dl, 0x4c
xor dl, 0x4c
cmp cl, dl
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0xe4a1e34a
je 0x140081b55
mov al, byte [rbp - 0x11]
test al, 1
jne 0x140081c04
jmp 0x140081c57
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax]
sub rsp, 0x20
call fcn.14007aa50
mov rax, qword [rbp - 0x20]
add rsp, 0x20
mov al, byte [rax]
mov cl, 0xb4
xor cl, 0xb4
cmp al, cl
jne 0x140081c57
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax + 8]
mov qword [rdx], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14007bb20
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
fadd dword [rax + 0x11]
or ebp, ecx
invalid
Function at 0x140082930
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x140253f38]
mov edx, dword [0x140253f3c]
xor edx, 0x762219f2
mov ecx, edx
and ecx, eax
mov r8d, 0xf6cefd9a
xor r8d, 0x9310265
xor ecx, r8d
add eax, edx
mov edx, 0x8df11ab8
xor edx, 0x8df11ab9
add eax, edx
add eax, ecx
mov ecx, 0xbabad937
xor ecx, 0x814dbb8d
or eax, ecx
mov ecx, 0xe52f1c66
xor ecx, 0xd6998974
or eax, ecx
add eax, 0x4c6e5b8e
mov ecx, 0x9a607bf
xor ecx, 0x1a13edeb
add eax, ecx
sub eax, 0x4c6e5b8e
cmp eax, 0x1ff6292
jbe 0x140082ad8
mov rax, qword [rsp + 0x38]
mov ecx, dword [0x140253f40]
mov r8d, dword [0x140253f44]
mov edx, ecx
xor edx, r8d
mov r9d, 0x56856c1d
xor r9d, 0xa97a93e2
xor edx, r9d
or ecx, r8d
and ecx, edx
and ecx, 0x9ed801a5
add ecx, 0x22e7b8d6
xor edx, edx
sub edx, 0xf4b0fe37
add ecx, edx
mov dword [rsp + 0x30], ecx
shr rax, 0x20
mov dword [rsp + 0x24], eax
call fcn.14006d36b
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov edx, 2
call fcn.14006df20
mov rcx, qword [rsp + 0x28]
mov eax, dword [rsp + 0x30]
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x37], cl
cmp eax, 0x526c4e67
jae 0x1400829b1
mov al, byte [rsp + 0x37]
test al, 1
jne 0x140082a47
jmp 0x140082ad2
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rax, rdx
xor rax, 0xffffffffffffffff
mov r8, 0xffffffffffffffff
xor r8, 1
or rax, r8
movabs r8, 0x5cfc11b36537502b
movabs r9, 0x5cfc11b36537502a
xor r8, r9
and rdx, r8
movabs r8, 0xf20a90cd067f8d32
movabs r9, 0xdf56f32f98072cd
xor r8, r9
xor rdx, r8
and rax, rdx
xor rax, 0xffffffffffffffff
cmp rax, 0
setne dl
and dl, 1
call fcn.1400820aa
mov rax, qword [rsp + 0x28]
mov al, byte [rax]
mov cl, 0x47
xor cl, 0x47
cmp al, cl
jne 0x140082ad2
mov edx, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x40]
call fcn.14006e775
nop
add rsp, 0x48
ret
jne 0x140082b4a
mov esp, 0xfed0e907
invalid
mov bh, 0x4a
xor edx, 0xac489c7c
add eax, edx
sub eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x547327b4
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0x6d4d8212
xor r8d, 0x393ea5a6
mov edx, eax
and edx, r8d
or eax, 0x547327b4
imul eax, edx
add eax, ecx
cmp eax, 0xad01789a
jae 0x140082bf8
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x140253f50]
sub eax, dword [0x140253f54]
mov r8d, 0x70cc9642
xor edx, edx
div r8d
mov edx, eax
mov rax, qword [rsp + 0x30]
mov r8d, 0x31dadff9
xor r8d, 0xb745adbc
and edx, r8d
add edx, 0x3bc9bfb
mov dword [rsp + 0x24], edx
mov rdx, qword [rax]
call fcn.140082930
mov eax, dword [rsp + 0x24]
cmp eax, 0x956a2328
jae 0x140082bf8
jmp 0x140082bf3
add rsp, 0x38
ret
std
lfs esp, [rdi]
jmp 0x140082b9a
Function at 0x14008359e
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006d36b
mov rdx, qword [rsp + 0x30]
cmp rdx, 0
jne 0x1400834ba
mov eax, dword [0x140253fa8]
mov r8d, dword [0x140253fac]
mov ecx, 0xad2a163c
xor ecx, 0x52d5e9c3
mov edx, r8d
xor edx, ecx
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
mov ecx, 0xb581621d
xor edx, edx
div ecx
mov ecx, eax
add ecx, 0x26604ca6
mov edx, 0x6c6026dc
xor edx, 0x39d32598
mov eax, 0x9f954df1
xor eax, 0x606ab20e
xor edx, eax
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0xcd2a353
xor ecx, 0x7fa2ba24
cmp eax, ecx
ja 0x14008358c
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x140253fb0]
xor eax, dword [0x140253fb4]
mov r8d, 0x9c85e9d0
xor edx, edx
div r8d
mov edx, 0x1b285d4f
xor edx, 0x45afb002
mov r8d, eax
xor r8d, edx
mov edx, 0xcb005fa7
xor edx, 0x34ffa058
xor r8d, edx
and r8d, 0x5e87ed4d
mov edx, 0x1ded88bc
xor edx, 0x1ded88be
imul edx, r8d
sub edx, 0x5e87ed4d
sub eax, edx
mov edx, eax
xor edx, 0xffffffff
mov r8d, 0x9713d0c0
xor r8d, 0x5450e098
and edx, r8d
mov r8d, 0x2818d50a
xor r8d, 0xeb5be552
mov r9d, 0xb9104f4b
xor r9d, 0x46efb0b4
xor r8d, r9d
and eax, r8d
sub eax, edx
mov dword [rsp + 0x24], eax
call fcn.14006d926
mov eax, dword [rsp + 0x24]
cmp eax, 0x419d131d
jbe 0x14008340d
jmp 0x1400834cc
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax]
call fcn.1400830c0
mov eax, dword [0x140253fb8]
mov edx, dword [0x140253fbc]
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
mov r8d, edx
and r8d, ecx
mov ecx, 0xcff0af08
xor ecx, 0xcff0af0a
imul ecx, r8d
sub ecx, edx
sub eax, ecx
xor eax, 0x8be93652
imul eax, eax, 0x360cff00
mov r8d, 0xffffffff
xor r8d, 0x3706895b
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x3706895b
mov r8d, 0x604318cb
xor r8d, 0x57459190
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x1a6f0a36
xor ecx, 0x63c286b0
cmp eax, ecx
jb 0x140083595
mov eax, dword [0x140253fc0]
mov ecx, 0xa46731a2
xor ecx, 0x138fc275
xor eax, ecx
xor eax, dword [0x140253fc4]
or eax, 0x5524a25c
mov ecx, 0x3f8c8dbe
xor edx, edx
div ecx
and eax, 0xa38a6777
cmp eax, 0x1dd6e1c7
jae 0x140083550
add rsp, 0x38
ret
retf 0xb818
lahf
push rdx
mov dword [rdi], ebp
jmp 0x140083550
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006d36b
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x140083380
Function at 0x140084094
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006d36b
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x140083f30

Function at 0x140084ab0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov ecx, dword [0x140254098]
mov edx, dword [0x14025409c]
xor edx, 0x172251c1
mov eax, ecx
xor eax, edx
mov r8d, 0xda79e2f6
xor r8d, 0x25861d09
xor eax, r8d
or ecx, edx
and ecx, eax
sub ecx, 0xf38e77db
and ecx, ecx
mov eax, 0x32d1b2fd
xor eax, 0xcd2e4d02
xor ecx, eax
mov eax, 0xffffffff
xor eax, 0xee2a3ce0
mov edx, 0x3ee579b0
xor edx, 0xd0cf4550
mov r8d, 0x41196e52
xor r8d, 0xbee691ad
xor edx, r8d
or eax, edx
and ecx, eax
mov eax, 0xe1eebe22
xor eax, 0x1e1141dd
xor ecx, eax
mov eax, ecx
and eax, eax
mov edx, 0x9f1a6d17
xor edx, 0x60e592e8
xor eax, edx
and eax, 0xbadbb645
mov edx, 0x4c230f2c
xor edx, 0xb3dcf0d3
xor eax, edx
mov edx, 0xffffffff
xor edx, 0xbadbb645
mov r8d, 0xecad004b
xor r8d, 0x5676b60e
mov r9d, 0x66700780
xor r9d, 0x998ff87f
xor r8d, r9d
or edx, r8d
and ecx, edx
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
cmp eax, 0x333389ee
jbe 0x140084c8b
mov eax, dword [0x1402540a0]
mov edx, dword [0x1402540a4]
mov ecx, edx
and ecx, eax
add eax, edx
sub eax, ecx
or eax, 0x5ee8bab
mov ecx, eax
xor ecx, 0x6010
xor eax, 0x92011044
and eax, 0x968194cd
and ecx, 0x68186b10
or eax, ecx
xor eax, 0x3e398381
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.14006d36b
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov edx, 2
sub rsp, 0x20
call fcn.14006df20
mov rcx, qword [rbp - 0x20]
mov eax, dword [rbp - 0x18]
add rsp, 0x20
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0xc3f671a3
jae 0x140084b98
mov al, byte [rbp - 0x11]
test al, 1
jne 0x140084c39
jmp 0x140084c86
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax]
sub rsp, 0x20
call fcn.14007aa50
mov rax, qword [rbp - 0x20]
add rsp, 0x20
cmp byte [rax], 0
jne 0x140084c86
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax + 8]
mov qword [rdx], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.1400848c0
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
and bl, byte [rdi - 0x7c]
mov edi, 0xffff04e9
dec dword [rax - 0x7d]
sub rsp, 0x48
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
call fcn.14006d36b
mov rdx, qword [rsp + 0x28]
cmp rdx, 0
jne 0x140084cc5
mov rcx, qword [rsp + 0x20]
call fcn.14006d926
jmp 0x140084cf3
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax]
mov qword [rsp + 0x30], rdx
mov rdx, qword [rax + 8]
mov qword [rsp + 0x38], rdx
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x30]
call fcn.140084ab0
nop
add rsp, 0x48
ret
Function at 0x140085bd0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], rdx
mov qword [rbp], rcx
mov r11d, dword [0x140254138]
mov r10d, dword [0x14025413c]
xor r10d, 0xfe9483fe
mov ecx, r11d
xor ecx, 0xffffffff
mov eax, 0x3dbb91ad
xor eax, 0xc2446e52
mov edx, r10d
xor edx, eax
mov r8d, 0xffffffff
xor r8d, 0x9f62b7a9
mov r9d, 0x70f4009a
xor r9d, 0xef96b733
mov eax, ecx
and eax, r9d
and r11d, r8d
mov esi, 0xf0dda40b
xor esi, 0x6fbf13a2
mov r9d, edx
and r9d, esi
and r10d, r8d
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, edx
xor ecx, 0xffffffff
mov edx, 0x5cdb089b
xor edx, 0xc3b9bf32
or edx, r8d
and ecx, edx
or eax, ecx
mov ecx, eax
xor ecx, 0x7f723b0e
xor ecx, 0xffffffff
and ecx, 0x7f723b0e
shl ecx, 1
sub ecx, 0x7f723b0e
sub eax, ecx
mov ecx, 0xf3138d28
xor ecx, 0xb51ca2ba
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
and eax, 0x2df54b85
xor ecx, 0x2df54b85
or eax, ecx
cmp eax, 0xf2a17eb1
jae 0x140085e61
mov eax, dword [0x140254140]
mov ecx, dword [0x140254144]
xor ecx, 0x645e74e0
xor edx, edx
div ecx
or eax, 0xd93a160
xor eax, 0x64a2ecd4
add eax, 0x840c96dc
mov dword [rbp - 0x10], eax
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
sub rsp, 0x20
call fcn.14006d36b
mov rcx, qword [rbp]
add rsp, 0x20
mov qword [rbp - 0x18], rax
mov edx, 2
sub rsp, 0x20
call fcn.14006df20
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbp - 0x10]
add rsp, 0x20
cmp byte [rcx], 0
sete cl
mov byte [rbp - 9], cl
cmp eax, 0x9af182c2
jbe 0x140085caa
mov al, byte [rbp - 9]
test al, 1
jne 0x140085d38
jmp 0x140085e5a
mov rcx, qword [rbp]
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
sub rsp, 0x20
call fcn.14007aa50
mov rax, qword [rbp - 0x18]
add rsp, 0x20
cmp byte [rax], 0
jne 0x140085e5a
mov eax, dword [0x140254148]
xor edx, edx
div dword [0x14025414c]
mov ecx, 0x6711c9b1
xor ecx, 0xff5c6f50
xor eax, ecx
mov ecx, 0xc640af32
xor ecx, 0x39bf50cd
mov edx, eax
xor edx, ecx
and edx, 0xa2b356bc
mov r8d, 0xffffffff
xor r8d, 0xa2b356bc
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xa2b356bc
mov r8d, 0x913faf00
xor r8d, 0x338cf9bc
or eax, r8d
imul eax, edx
add eax, ecx
imul eax, eax, 0x85d9081d
cmp eax, 0xf3d3ad7d
ja 0x140085e6a
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp]
mov rax, qword [rbp - 8]
mov r8d, dword [0x140254150]
add r8d, dword [0x140254154]
or r8d, 0xfd168b45
mov r9d, 0xf70d2ae9
xor r9d, 0xad59da52
sub r8d, r9d
add r8d, 0x5c7b45de
add r8d, 0x5a54f0bb
and r8d, 0xc45a6db0
mov dword [rbp - 0x24], r8d
mov r8d, 0x13047179
xor r8d, 0x3c7bd69c
mov dword [rbp - 0x28], r8d
mov r8, qword [rax + 8]
mov qword [rdx], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14006ef20
mov ecx, dword [rbp - 0x28]
mov eax, dword [rbp - 0x24]
add rsp, 0x20
cmp eax, ecx
jb 0x140085dd0
jmp 0x140085e5a
lea rsp, [rbp + 8]
pop rsi
pop rbp
ret
mov ecx, 0xe93d4826
invalid
and dl, byte ds:[rbx + 0x3d]
jmp 0x140085dd0