joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14019db30
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x20], rcx
mov eax, 0x10
call fcn.14024abd0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.14019c02a
mov rcx, qword [rbp - 0x20]
add rsp, 0x20
mov qword [rbp - 0x18], rax
mov rcx, qword [rcx]
sub rsp, 0x20
call fcn.14019c050
add rsp, 0x20
test al, 1
jne 0x14019db84
jmp 0x14019dbc4
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
sub rsp, 0x20
call fcn.1400874eb
mov rax, qword [rbp - 0x18]
add rsp, 0x20
mov al, byte [rax]
mov cl, 0x8e
xor cl, 0x8e
cmp al, cl
jne 0x14019dcd7
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
mov edx, 8
sub rsp, 0x20
call fcn.14000ef30
add rsp, 0x20
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax + 8]
mov qword [rbp - 0x10], rcx
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
lea rcx, [rbp - 0x10]
sub rsp, 0x20
call fcn.14019c390
mov rax, qword [rbp - 0x18]
add rsp, 0x20
mov al, byte [rax]
mov cl, 0xdf
xor cl, 0xdf
cmp al, cl
jne 0x14019dcd7
mov ecx, dword [0x140256310]
mov edx, dword [0x140256314]
mov eax, ecx
and eax, edx
xor eax, 0xffffffff
and ecx, edx
mov edx, 0x841d6f70
xor edx, 0x7be2908f
xor ecx, edx
and eax, ecx
xor eax, 0xffffffff
sub eax, 0x49a0ecc2
sub eax, 0x234d4601
add eax, 0x49a0ecc2
imul eax, eax, 0x3eda1c2b
mov edx, 0x5ebc67fa
xor edx, 0x952e45c8
mov ecx, 0xa5a48c3e
xor ecx, 0x5a5b73c1
xor edx, ecx
mov ecx, eax
and ecx, edx
mov r8d, 0xf06a15b8
xor r8d, 0x3bf8378a
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
cmp eax, 0x206f2c19
jb 0x14019ddd2
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x20]
mov edx, dword [0x140256318]
or edx, dword [0x14025631c]
or edx, 0xc56adfbd
and edx, 0x2baee9ad
mov r8d, 0x495cee88
xor r8d, 0x5ccaeb33
xor edx, r8d
mov dword [rbp - 0x2c], edx
mov rdx, qword [rax + 0x18]
mov qword [rcx], rdx
mov rax, qword [rax + 0x20]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.14019d9c9
mov eax, dword [rbp - 0x2c]
add rsp, 0x20
cmp eax, 0x87b3e094
ja 0x14019dc75
jmp 0x14019dcd7
mov edx, dword [0x140256320]
mov ecx, dword [0x140256324]
mov eax, edx
xor eax, 0xffffffff
mov r8d, 0x46a33027
xor r8d, 0xb95ccfd8
xor edx, r8d
and eax, edx
or ecx, ecx
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
add eax, 0x42c2e8c3
mov r8d, eax
and r8d, 0xfea3c7c8
xor eax, 0xfea3c7c8
or r8d, eax
mov eax, r8d
xor eax, 0xffffffff
and eax, 0x437833ae
mov r9d, 0xffffffff
xor r9d, 0x437833ae
and r8d, r9d
mov ecx, 0xc8174ab0
xor ecx, 0xad6bf1d0
mov edx, 0x558fed
xor edx, 0xffaa7012
xor ecx, edx
mov edx, 0xa6c84c93
xor edx, 0xe5b07f3d
and ecx, edx
mov edx, 0xd8b42a58
xor edx, 0xbdc89138
and edx, r9d
or eax, r8d
or ecx, edx
xor eax, ecx
cmp eax, 0xa871c332
ja 0x14019dddb
mov eax, dword [0x140256328]
mov r8d, dword [0x14025632c]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
imul eax, eax, 0x79e7e1b7
mov ecx, 0x1c9db1ac
xor edx, edx
div ecx
xor eax, 0x5cf9c6a3
cmp eax, 0x2bc6fc2c
jb 0x14019dddb
mov rsp, rbp
pop rbp
ret
invalid
xchg byte [rdi + 0x2e], bh
pop rsp
jmp 0x14019dd7b
Function at 0x14019ddf0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov r8d, dword [0x140256330]
mov edx, dword [0x140256334]
mov eax, 0x86632a3b
xor eax, 0x799cd5c4
mov ecx, r8d
xor ecx, eax
mov eax, 0x606d66d4
xor eax, 0xb8213656
and eax, ecx
mov r9d, 0xffffffff
xor r9d, 0xd84c5082
and r8d, r9d
mov r10d, 0x2df3b3aa
xor r10d, 0xd20c4c55
mov ecx, edx
xor ecx, r10d
and ecx, 0xd84c5082
and edx, r9d
or eax, r8d
or ecx, edx
xor eax, ecx
mov ecx, 0x91673c51
xor ecx, 0xf43bcd0
sub eax, ecx
mov ecx, 0xaa5a52f2
xor ecx, 0x2ec4137c
sub eax, ecx
add eax, 0x9f77cf37
add eax, 0x4cbc694a
sub eax, 0x9f77cf37
cmp eax, 0x9c1796cf
jb 0x14019e000
mov eax, dword [0x140256338]
or eax, dword [0x14025633c]
and eax, 0xa4be1752
or eax, 0x9f79177c
mov ecx, 0x6ad5d9bd
xor ecx, 0x2112a399
or eax, ecx
mov dword [rsp + 0x30], eax
call fcn.14019c02a
mov rcx, rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax]
call fcn.14019c050
mov cl, al
mov eax, dword [rsp + 0x30]
mov byte [rsp + 0x37], cl
cmp eax, 0x61d675c5
jb 0x14019de8c
mov al, byte [rsp + 0x37]
test al, 1
jne 0x14019def3
jmp 0x14019df20
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call fcn.14019db30
mov rax, qword [rsp + 0x28]
cmp byte [rax], 0
jne 0x14019dffb
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
mov edx, 8
call fcn.14000ef30
mov ecx, dword [0x140256340]
mov edx, dword [0x140256344]
xor edx, 0xffffffff
mov eax, ecx
xor eax, edx
and eax, ecx
xor eax, 0x8aadfe07
mov ecx, eax
and ecx, 0x2569c04d
shl ecx, 1
add eax, 0x2569c04d
sub eax, ecx
mov ecx, 0x2a0ca5d6
xor edx, edx
div ecx
cmp eax, 0x3db1b7d4
ja 0x14019e009
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov eax, dword [0x140256348]
or eax, dword [0x14025634c]
mov r8d, 0x9a2cd7dd
xor r8d, 0xc2b80e8f
and r8d, eax
xor r8d, 0xffffffff
mov r9d, 0x71965039
xor r9d, 0x2902896b
add eax, r9d
add eax, 1
add eax, r8d
mov r10d, 0xffffffff
xor r10d, 0xb8dc87f
mov r9d, eax
and r9d, r10d
mov r8d, eax
or r8d, r10d
mov r10d, 0xf018adf
xor r10d, 0xf0fe7520
xor r8d, r10d
imul r8d, r9d
mov r9d, eax
and r9d, 0xb8dc87f
or eax, 0xb8dc87f
imul eax, r9d
add eax, r8d
sub eax, 0xc35bc8a
mov qword [rcx], rdx
cmp eax, 0x3aa5ecb4
je 0x14019e009
jmp 0x14019dffb
add rsp, 0x48
ret
cdq
invalid
stosd dword [rdi], eax
imul edx, dword [rax], 0xffff4ee9
dec dword [rax - 0x7d]
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
Function at 0x14019e4f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x47], al
je 0x14019e6bd
mov rax, qword [rsp + 0x38]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax - 0x10]
mov qword [rsp + 0x30], rcx
mov al, 1
cmp rcx, 0x10
mov byte [rsp + 0x47], al
jb 0x14019e6bd
mov rdx, qword [rsp + 0x30]
movabs rcx, 0xb5224bc76609e804
movabs rax, 0x4addb43899f617f4
xor rcx, rax
mov rax, rdx
add rax, rcx
mov qword [rsp + 0x20], rax
mov rcx, rax
xor rcx, rdx
movabs rdx, 0x3c80cbd1bcaf196b
movabs r8, 0x3c80cbd1bcaf196b
xor rdx, r8
cmp rcx, rdx
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x14019e593
jmp 0x14019e5a3
call fcn.140008c92
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x14019e6bd
mov ecx, dword [0x1402563b8]
mov edx, dword [0x1402563bc]
mov eax, ecx
xor eax, edx
mov r8d, 0xc05bdbdc
xor r8d, 0x3fa42423
xor edx, r8d
and ecx, edx
shl ecx, 1
sub ecx, eax
mov eax, ecx
and eax, eax
xor eax, 0xffffffff
and eax, 0x2a58263d
mov edx, 0xeadc113d
xor edx, 0x1523eec2
xor eax, edx
mov edx, 0x10b8a97b
xor edx, 0x3ae08f46
mov r8d, 0x263fb12b
xor r8d, 0xd9c04ed4
xor edx, r8d
mov r8d, 0xffffffff
xor r8d, 0x2a58263d
or edx, r8d
mov r8d, 0xf6ebc61
xor r8d, 0xf091439e
xor ecx, r8d
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
or eax, eax
xor eax, 0xffffffff
mov ecx, 0x3824f1f9
xor ecx, 0x12107bcb
mov edx, 0x247f846a
xor edx, 0xe4b0e58
or ecx, edx
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0x6c8cf48f
xor edx, edx
div ecx
cmp eax, 0xe99b8f92
jae 0x14019e6cb
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1402563c0]
mov r8d, dword [0x1402563c4]
xor r8d, 0x6e1ec2f8
xor edx, edx
sub edx, eax
xor eax, eax
sub eax, r8d
add edx, eax
xor eax, eax
sub eax, edx
xor eax, 0xf24baeab
imul eax, eax, 0x8c8307d5
mov r8d, 0x742c80b9
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x20]
mov qword [rcx], rdx
cmp eax, 0x51c38e6f
jae 0x14019e661
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x14019e6bd
mov al, byte [rsp + 0x47]
and al, 1
movzx eax, al
add rsp, 0x48
ret
movabs eax, dword [0xffffff8de9a03b7c]
nop word cs:[rax + rax]
Function at 0x1401a19d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x270
lea rbp, [rsp + 0x80]
mov qword [rbp + 8], r8
mov qword [rbp + 0x58], rdx
Function at 0x1401a6d50
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x1718
call fcn.14024abd0
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xa80], rdx

Function at 0x1401b3970
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x47], al
je 0x1401b3b10
mov rax, qword [rsp + 0x38]
movabs rcx, 0xb2ec6d40c8288489
movabs rdx, 0x4d1392bf37d77b79
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
mov al, 1
cmp rcx, 0x10
mov byte [rsp + 0x47], al
jb 0x1401b3b10
mov rdx, qword [rsp + 0x30]
mov rax, rdx
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x20], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x1401b39f9
jmp 0x1401b3a09
call fcn.140008c92
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x1401b3b10
mov ecx, dword [0x140256c40]
mov edx, dword [0x140256c44]
mov eax, ecx
xor eax, edx
xor edx, 0xffffffff
and ecx, edx
shl ecx, 1
sub ecx, eax
mov eax, ecx
and eax, eax
xor eax, 0xffffffff
and eax, 0x2a58263d
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x2a58263d
mov r8d, 0xffffffff
xor r8d, 0x2a58263d
or edx, r8d
xor ecx, 0xffffffff
mov r8d, 0x16b930dd
xor r8d, 0xe946cf22
xor edx, r8d
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
or eax, eax
xor eax, 0xffffffff
mov ecx, 0x2a348a32
or ecx, 0x2a348a32
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0x6c8cf48f
xor edx, edx
div ecx
mov ecx, 0x26666bd2
xor ecx, 0xcffde440
cmp eax, ecx
jae 0x1401b3b1e
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x140256c48]
mov r8d, dword [0x140256c4c]
mov edx, 0xc01f2d0e
xor edx, 0xc01f2d0e
sub edx, eax
mov eax, 0x68236156
xor eax, 0x68236156
sub eax, r8d
add edx, eax
xor eax, eax
sub eax, edx
xor eax, 0xf24baeab
mov edx, 0x6aaff67
xor edx, 0x8a29f8b2
imul eax, edx
mov r8d, 0x2ed94160
xor r8d, 0x5af5c1d9
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x20]
mov qword [rcx], rdx
cmp eax, 0x51c38e6f
jae 0x1401b3a9b
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x1401b3b10
mov al, byte [rsp + 0x47]
and al, 1
movzx eax, al
add rsp, 0x48
ret
movabs eax, dword [0xffffff74e9a03b7c]
nop word [rax + rax]
Function at 0x1401c28b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x47], al
je 0x1401c2a77
mov rax, qword [rsp + 0x38]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax - 0x10]
mov qword [rsp + 0x30], rcx
movabs rdx, 0x86c40a1f194c2e1b
movabs rax, 0x86c40a1f194c2e0b
xor rdx, rax
mov al, 1
cmp rcx, rdx
mov byte [rsp + 0x47], al
jb 0x1401c2a77
mov rdx, qword [rsp + 0x30]
mov rax, rdx
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x20], rax
mov rcx, rax
xor rcx, rdx
movabs rdx, 0xda0740ba514a65e3
movabs r8, 0xda0740ba514a65e3
xor rdx, r8
cmp rcx, rdx
setl cl
movabs rdx, 0x749be54e455328e2
movabs r8, 0x8b641ab1baacd71d
xor rdx, r8
cmp rax, rdx
setg al
and al, cl
test al, 1
jne 0x1401c2969
jmp 0x1401c2979
call fcn.140008c92
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x1401c2a77
mov ecx, dword [0x1402572a8]
mov edx, dword [0x1402572ac]
mov eax, ecx
xor eax, edx
xor edx, 0xffffffff
and ecx, edx
shl ecx, 1
sub ecx, eax
mov eax, ecx
and eax, eax
xor eax, 0xffffffff
and eax, 0x2a58263d
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x2a58263d
mov r8d, 0xffffffff
xor r8d, 0x2a58263d
or edx, r8d
xor ecx, 0xffffffff
mov r8d, 0x2d47417
xor r8d, 0xfd2b8be8
xor edx, r8d
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
or eax, eax
xor eax, 0xffffffff
mov ecx, 0x5cca690c
xor ecx, 0x76fee33e
mov edx, 0xf2866556
xor edx, 0xd8b2ef64
or ecx, edx
mov edx, 0x5f926d43
xor edx, 0xa06d92bc
xor ecx, edx
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0x6c8cf48f
xor edx, edx
div ecx
cmp eax, 0xe99b8f92
jae 0x1401c2a85
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1402572b0]
mov r8d, dword [0x1402572b4]
xor edx, edx
sub edx, eax
mov eax, 0xe38b9cd6
xor eax, 0xe38b9cd6
sub eax, r8d
add edx, eax
xor eax, eax
sub eax, edx
xor eax, 0xf24baeab
imul eax, eax, 0x8c8307d5
mov r8d, 0x742c80b9
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x20]
mov qword [rcx], rdx
cmp eax, 0x51c38e6f
jae 0x1401c2a1a
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x1401c2a77
mov al, byte [rsp + 0x47]
and al, 1
movzx eax, al
add rsp, 0x48
ret
movabs eax, dword [0xffffff8ce9a03b7c]
nop
Function at 0x1401c4340
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov ecx, dword [0x140257358]
mov edx, dword [0x14025735c]
xor edx, 0x67f0733f
and ecx, ecx
xor ecx, 0xffffffff
mov eax, edx
xor eax, 0xffffffff
xor edx, 0xffffffff
or eax, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
or ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xbc7017ef
xor edx, 0xd19c22db
and eax, edx
mov edx, 0xffffffff
xor edx, 0x6dec3534
and ecx, edx
sub ecx, eax
mov eax, 0x921388b1
xor eax, 0x4797903c
imul ecx, eax
mov edx, 0x82041dcd
xor edx, 0x11dacddc
mov eax, ecx
or eax, edx
xor eax, 0xffffffff
mov edx, 0x5267adc7
xor edx, 0xad985238
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0x93ded011
and ecx, edx
or eax, ecx
mov ecx, 0x39992e0d
xor ecx, 0xc666d1f2
xor eax, ecx
cmp eax, 0x852084b4
jbe 0x1401c4562
mov eax, dword [0x140257360]
mov ecx, 0x9c2bb77f
xor ecx, 0x239bbb3d
xor eax, ecx
sub eax, dword [0x140257364]
add eax, 0xaf737e3a
sub eax, 0xa766feeb
sub eax, 0xaf737e3a
sub eax, 0x221ecf53
mov ecx, 0x44288528
xor ecx, 0xb66ad834
add eax, ecx
add eax, 0x221ecf53
mov ecx, 0x269bebe2
xor ecx, 0x269bebe2
mov edx, 0x39c4fdcf
xor edx, 0x3ba050
sub ecx, edx
sub eax, ecx
mov dword [rsp + 0x38], eax
call fcn.1401c3d02
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
call fcn.1401c3d1d
mov cl, al
mov eax, dword [rsp + 0x38]
mov byte [rsp + 0x3f], cl
cmp eax, 0xc5bca45b
jbe 0x1401c43e6
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x1401c447d
jmp 0x1401c455d
mov rcx, qword [rsp + 0x40]
call fcn.1401c4220
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
jne 0x1401c455d
mov eax, dword [0x140257368]
and eax, dword [0x14025736c]
or eax, eax
xor eax, 0xffffffff
mov ecx, 0x7fc8b2e2
or ecx, 0x7fc8b2e2
mov edx, 0x58eeb6a4
xor edx, 0xa711495b
xor ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0xffffffff
xor ecx, 0xeaafbb2e
mov edx, 0xafe6b662
xor edx, 0xafe6b662
mov r8d, 0x597e74c7
xor r8d, 0x597e74c6
sub edx, r8d
sub ecx, edx
sub eax, ecx
xor eax, 0x9d1e347f
cmp eax, 0x7fdaf652
je 0x1401c456b
mov rcx, qword [rsp + 0x40]
mov edx, dword [0x140257370]
mov r8d, dword [0x140257374]
xor r8d, 0xefc58a02
xor r8d, 0xffffffff
mov eax, edx
xor eax, r8d
and eax, edx
mov r8d, 0xb17ebbe1
xor edx, edx
div r8d
imul eax, eax, 0x56ea9e84
imul eax, eax, 0x526b0abe
mov dword [rsp + 0x2c], eax
mov edx, 8
call fcn.14000ef30
mov eax, dword [rsp + 0x2c]
cmp eax, 0xa4d1fd44
jae 0x1401c4500
jmp 0x1401c455d
add rsp, 0x48
ret
nop
add al, 0xd8
jmp 0x1401c43e6
sahf
movsd dword [rdi], dword [rsi]
add edx, ebx
jmp 0x1401c4500
Function at 0x1401c48b0
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x47], al
je 0x1401c4a95
mov rax, qword [rsp + 0x38]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax - 0x10]
mov qword [rsp + 0x30], rcx
movabs rdx, 0x408b29c0051e6247
movabs rax, 0x408b29c0051e6257
xor rdx, rax
mov al, 1
cmp rcx, rdx
mov byte [rsp + 0x47], al
jb 0x1401c4a95
mov rdx, qword [rsp + 0x30]
movabs rcx, 0xc740bfcc4bc8db86
movabs rax, 0x38bf4033b4372476
xor rcx, rax
mov rax, rdx
add rax, rcx
mov qword [rsp + 0x20], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x1401c4953
jmp 0x1401c4963
call fcn.140008c92
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x1401c4a95
mov ecx, dword [str.oE_fT]
mov edx, dword [0x1402573d4]
mov eax, 0x50f87406
xor eax, 0x854be9dd
xor edx, eax
mov eax, ecx
xor eax, edx
xor edx, 0xffffffff
and ecx, edx
shl ecx, 1
sub ecx, eax
mov eax, ecx
and eax, eax
mov edx, 0x62d3db41
xor edx, 0x9d2c24be
xor eax, edx
and eax, 0x2a58263d
mov edx, 0x8e24ba53
xor edx, 0x71db45ac
xor eax, edx
mov edx, 0xffffffff
xor edx, 0x2a58263d
mov r8d, 0xffffffff
xor r8d, 0x2a58263d
or edx, r8d
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
or eax, eax
xor eax, 0xffffffff
mov ecx, 0x2a348a32
or ecx, 0x2a348a32
mov edx, 0xff7c0176
xor edx, 0x83fe89
xor ecx, edx
or eax, ecx
mov ecx, 0x5330c855
xor ecx, 0xaccf37aa
xor eax, ecx
mov ecx, 0xe08cd0a6
xor ecx, 0x8c002429
xor edx, edx
div ecx
mov ecx, 0xf793f84
xor ecx, 0xe6e2b016
cmp eax, ecx
jae 0x1401c4aa3
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1402573d8]
mov r8d, dword [0x1402573dc]
xor r8d, 0x53791c1e
xor edx, edx
sub edx, eax
xor eax, eax
sub eax, r8d
add edx, eax
mov eax, 0xd46aa11d
xor eax, 0xd46aa11d
sub eax, edx
xor eax, 0xf24baeab
mov edx, 0x780c134d
xor edx, 0xf48f1498
imul eax, edx
mov r8d, 0x6bd7cadc
xor r8d, 0x1ffb4a65
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x20]
mov qword [rcx], rdx
cmp eax, 0x51c38e6f
jae 0x1401c4a22
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x1401c4a95
mov al, byte [rsp + 0x47]
and al, 1
movzx eax, al
add rsp, 0x48
ret
movabs eax, dword [0xffffff76e9a03b7c]
nop dword [rax]
Function at 0x1401d7c40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
call fcn.1401d7e87
mov rcx, qword [rsp + 0x40]
cmp rcx, 0
je 0x1401d7dd8
mov rax, qword [rsp + 0x40]
xor ecx, ecx
sub rcx, rax
movabs rax, 0x37fba2ef315acda1
movabs rdx, 0x37fba2ef315acda1
xor rax, rdx
movabs rdx, 0x75a357d842a1ee41
movabs r8, 0x8a5ca827bd5e11b1
xor rdx, r8
sub rax, rdx
add rcx, rax
xor eax, eax
sub rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
movabs rcx, 0xf4826e85a7f0453b
movabs rdx, 0xf4826e85a7f0452b
xor rcx, rdx
cmp rax, rcx
jb 0x1401d7db2
mov r8, qword [rsp + 0x38]
xor eax, eax
mov ecx, eax
sub rcx, r8
xor eax, eax
sub rax, 0xfffffffffffffff0
add rcx, rax
xor eax, eax
sub rax, rcx
mov qword [rsp + 0x28], rax
mov rdx, rax
xor rdx, 0xffffffffffffffff
movabs rcx, 0x38af087574e9dac1
movabs r9, 0x2bf71e1143cb9b88
xor rcx, r9
and rcx, rdx
mov r10, 0xffffffffffffffff
movabs rdx, 0x1358166437224149
xor r10, rdx
mov r9, rax
and r9, r10
movabs r11, 0x5ccf2333e391c7c6
movabs rdx, 0xa330dccc1c6e3839
xor r11, rdx
mov rdx, r8
xor rdx, r11
movabs r11, 0x1358166437224149
and rdx, r11
and r8, r10
or rcx, r9
or rdx, r8
xor rcx, rdx
cmp rcx, 0
setl dl
cmp rax, 0xffffffffffffffff
setg cl
mov al, cl
and al, dl
xor al, 0xff
and cl, dl
xor cl, 0xff
and al, cl
xor al, 0xff
test al, 1
jne 0x1401d7d87
jmp 0x1401d7d91
call fcn.140008c92
jmp 0x1401d7dd8
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov r8, qword [rax]
xor ecx, ecx
call fcn.14000fe77
jmp 0x1401d7dd8
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rax]
xor eax, eax
mov cl, al
xor cl, 1
and cl, 1
call fcn.14000fe77
mov rcx, qword [rsp + 0x40]
call fcn.14000ff4b
mov eax, dword [0x140257cc0]
xor eax, 0x5bbedc2c
mov edx, dword [0x140257cc4]
mov ecx, eax
and ecx, edx
shl ecx, 1
add eax, edx
sub eax, ecx
and eax, 0x2c9d8829
sub eax, 0xd2cb477b
mov ecx, 0xffffffff
xor ecx, 0xa4671380
add eax, ecx
mov ecx, 0xded4b5b5
xor ecx, 0xded4b5b4
add eax, ecx
cmp eax, 0x8def4ddd
jbe 0x1401d7e7e
mov eax, dword [0x140257cc8]
mov ecx, dword [0x140257ccc]
xor ecx, 0xa8cff6ce
sub eax, 0xb3d8fc82
sub eax, ecx
add eax, 0xb3d8fc82
mov ecx, 0x94b6275b
xor ecx, 0xc3f13698
imul eax, ecx
mov ecx, 0xbc1c9249
xor edx, edx
div ecx
mov ecx, 0xeede0f95
xor ecx, 0x65129397
imul eax, ecx
mov ecx, 0x28a71ba4
xor ecx, 0xac1b15c4
cmp eax, ecx
jbe 0x1401d7e23
add rsp, 0x48
ret
sbb byte [rcx - 0x6316f395], 0xff
invalid
Function at 0x1401d8420
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x140257d00]
mov ecx, dword [0x140257d04]
xor ecx, 0x445f20c3
and eax, ecx
imul eax, eax, 0x63b08334
mov ecx, 0x2c5fd2d
xor ecx, 0x8f11a974
or eax, ecx
xor eax, 0x1da37a22
cmp eax, 0xebf53dc4
je 0x1401d8521
mov eax, dword [0x140257d08]
mov edx, dword [0x140257d0c]
mov ecx, eax
xor ecx, edx
mov r8d, 0xbd7ffbc6
xor r8d, 0x42800439
xor ecx, r8d
mov r8d, edx
and r8d, ecx
mov ecx, 0x76a715b5
xor ecx, 0x76a715b7
imul ecx, r8d
sub ecx, edx
sub eax, ecx
imul eax, eax, 0x61b6bf2f
imul eax, eax, 0xd728d7f3
sub eax, 0x1d7e9954
mov dword [rsp + 0x28], eax
call fcn.1401d80a0
mov rcx, rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax]
call fcn.1401d80bb
mov cl, al
mov eax, dword [rsp + 0x28]
mov byte [rsp + 0x2f], cl
cmp eax, 0xc856a844
jbe 0x1401d8460
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1401d84ee
jmp 0x1401d851b
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call fcn.1400874eb
mov rax, qword [rsp + 0x20]
cmp byte [rax], 0
jne 0x1401d851b
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
mov edx, 8
call fcn.14000ef30
nop
add rsp, 0x38
ret
jg 0x1401d858c
lahf
invalid
invalid
Function at 0x1401d88f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x47], al
je 0x1401d8aa8
mov rax, qword [rsp + 0x38]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax - 0x10]
mov qword [rsp + 0x30], rcx
movabs rdx, 0xb63a9bddd5a483e6
movabs rax, 0xb63a9bddd5a483f6
xor rdx, rax
mov al, 1
cmp rcx, rdx
mov byte [rsp + 0x47], al
jb 0x1401d8aa8
mov rdx, qword [rsp + 0x30]
movabs rcx, 0xcf1602bdc8e42d5a
movabs rax, 0x30e9fd42371bd2aa
xor rcx, rax
mov rax, rdx
add rax, rcx
mov qword [rsp + 0x20], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x1401d8993
jmp 0x1401d89a3
call fcn.140008c92
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x1401d8aa8
mov ecx, dword [0x140257d68]
xor ecx, 0x3c0ec043
mov edx, dword [0x140257d6c]
mov eax, ecx
xor eax, edx
xor edx, 0xffffffff
and ecx, edx
shl ecx, 1
sub ecx, eax
mov eax, ecx
and eax, eax
mov edx, 0xde6ae143
xor edx, 0x21951ebc
xor eax, edx
and eax, 0x2a58263d
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x2a58263d
mov r8d, 0xffffffff
xor r8d, 0x2a58263d
or edx, r8d
mov r8d, 0x1fe4a3d7
xor r8d, 0xe01b5c28
xor ecx, r8d
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
or eax, eax
xor eax, 0xffffffff
mov ecx, 0x2a348a32
or ecx, 0x2a348a32
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0x6c8cf48f
xor edx, edx
div ecx
cmp eax, 0xe99b8f92
jae 0x1401d8ab6
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x140257d70]
mov r8d, dword [0x140257d74]
xor r8d, 0xfc6d54c0
xor edx, edx
sub edx, eax
xor eax, eax
sub eax, r8d
add edx, eax
mov eax, 0xccb650b7
xor eax, 0xccb650b7
sub eax, edx
xor eax, 0xf24baeab
imul eax, eax, 0x8c8307d5
mov r8d, 0xc7d9d8fb
xor r8d, 0xb3f55842
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x20]
mov qword [rcx], rdx
cmp eax, 0x51c38e6f
jae 0x1401d8a3d
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x1401d8aa8
mov al, byte [rsp + 0x47]
and al, 1
movzx eax, al
add rsp, 0x48
ret
movabs eax, dword [0xffffff7ee9a03b7c]
nop