joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400093d0
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov eax, dword [0x140241718]
mov edx, dword [0x14024171c]
xor edx, 0x8220e778
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
or eax, edx
and eax, ecx
imul r11d, eax, 0x653048ba
mov eax, r11d
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x3dc75da8
mov r8d, 0xffffffff
xor r8d, 0xcfe356e
mov ecx, eax
and ecx, 0xcfe356e
and r11d, r8d
mov r9d, edx
and r9d, 0xcfe356e
mov r10d, 0x1c96e216
xor r10d, 0x2151bfbe
and r10d, r8d
or ecx, r11d
or r9d, r10d
xor ecx, r9d
or eax, edx
mov edx, 0xd10774a0
xor edx, 0x2ef88b5f
xor eax, edx
mov edx, 0x8177ab38
xor edx, 0x8d899e56
or edx, r8d
and eax, edx
or ecx, eax
mov eax, ecx
and eax, 0x211e3776
xor ecx, 0x211e3776
or eax, ecx
mov ecx, 0x2f2c8dd8
xor ecx, 0xf3127188
cmp eax, ecx
jbe 0x14000950b
mov ecx, dword [0x140241720]
xor ecx, 0x381551f7
mov edx, dword [0x140241724]
xor edx, 0xffffffff
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0x30fb1a4e
xor edx, edx
div ecx
mov ecx, eax
and ecx, 0x3833634
shl ecx, 1
add eax, 0x3833634
sub eax, ecx
mov ecx, 0x4459544a
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x30]
mov dword [rsp + 0x24], eax
xor eax, eax
mov ecx, eax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rax
mov eax, dword [rsp + 0x24]
mov qword [rsp + 0x28], rcx
cmp eax, 0x9a1af84a
jae 0x14000948c
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret
push rax
or eax, 0x78e9fd96
invalid
Function at 0x14000b9b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov rax, qword [rcx]
mov rcx, rdx
add rcx, 0x18
mov qword [rsp + 0x38], rcx
mov rcx, qword [rdx + 0x18]
mov qword [rsp + 0x40], rcx
cmp rax, rdx
jne 0x14000ba07
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
cmp rcx, 0
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rax
je 0x14000bb27
jmp 0x14000bb19
mov eax, dword [0x1402417f8]
or eax, dword [0x1402417fc]
or eax, 0x6d0aee3b
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0xc369b3b6
xor edx, 0x498290d3
and edx, ecx
mov r8d, 0xe4e2c00
xor r8d, 0x84a50f65
mov ecx, 0x913cbb07
xor ecx, 0x6ec344f8
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x8aeb2365
or eax, 0x8aeb2365
imul eax, edx
add eax, ecx
mov ecx, 0x34fdb530
xor ecx, 0x937bfbd6
xor edx, edx
div ecx
cmp eax, 0x8a0f92fd
ja 0x14000bbc6
mov rcx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
mov eax, dword [0x140241800]
mov r10d, dword [0x140241804]
mov r9d, r10d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov r9d, eax
xor r9d, r10d
add eax, r9d
sub eax, edx
sub eax, 0x278f711
mov r9d, 0x590b4b0f
xor edx, edx
div r9d
mov rdx, qword [rsp + 0x28]
and eax, 0x1bf5848d
mov r9, rdx
add r9, 0x20
mov qword [rsp], r9
mov rdx, qword [rdx + 0x20]
mov qword [rdx + 0x18], r8
mov rcx, qword [rcx]
mov qword [rsp + 8], rcx
cmp rcx, 0
sete cl
mov byte [rsp + 0x17], cl
cmp eax, 0xea155a6
jae 0x14000ba79
mov al, byte [rsp + 0x17]
test al, 1
jne 0x14000bb27
jmp 0x14000bb03
mov rcx, qword [rsp + 8]
mov rax, qword [rsp]
mov rax, qword [rax]
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x20], rcx
mov eax, dword [0x140241808]
add eax, dword [0x14024180c]
add eax, 0x866775ca
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x14dfac67
or ecx, edx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x14dfac67
or eax, edx
and ecx, eax
xor ecx, 0xffffffff
mov eax, ecx
and eax, 0x1311ad56
or ecx, 0x1311ad56
add eax, ecx
cmp eax, 0xac3c32a2
jae 0x14000bbcf
mov eax, dword [0x140241810]
sub eax, dword [0x140241814]
imul eax, eax, 0xd970f26d
mov ecx, 0xbc603f95
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x28]
sub eax, 0x7c9a528f
mov ecx, 0x252da793
xor ecx, 0x8be34428
mov qword [rdx + 0x18], 0
mov qword [rdx + 0x20], 0
cmp eax, ecx
jae 0x14000bb79
add rsp, 0x48
ret
or al, 0x3b
insb byte [rdi], dx
lodsd eax, dword [rsi]
jmp 0x14000ba79
and eax, 0xe9424daa
movabs eax, dword [0xfffff7c3e9ffffff]

Function at 0x14000bbdd
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
call fcn.14000bc00
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x58
add rsp, 0x28
jmp fcn.14000b3a0
Function at 0x14000d710
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x60
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rcx
cmp r8, 0
jle 0x14000d8ec
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
call fcn.14000b3a0
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
cmp rcx, 0
mov qword [rsp + 0x40], rax
je 0x14000d92d
mov eax, dword [0x1402418d8]
xor eax, 0x558294ac
mov edx, dword [str.MJ]
and eax, eax
xor eax, 0xffffffff
mov ecx, edx
xor ecx, 0xffffffff
mov r8d, 0xacc2694c
xor r8d, 0x533d96b3
xor edx, r8d
or ecx, edx
and eax, ecx
mov ecx, 0x662e219
xor ecx, 0xf99d1de6
xor eax, ecx
mov ecx, 0x32e6ad82
xor ecx, 0xd680daa5
or eax, ecx
mov ecx, 0xd133797
xor ecx, 0x7d97670d
and eax, ecx
mov ecx, 0x3d71ca9f
xor ecx, 0xf7fd7379
mov edx, 0xf661053c
xor edx, 0x99efac3
xor ecx, edx
add eax, ecx
add eax, 1
mov ecx, 0x20d7a8f0
xor ecx, 0xa85db854
cmp eax, ecx
je 0x14000d938
mov rcx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x48]
mov eax, dword [0x1402418e0]
xor eax, 0x33fdca1d
imul eax, dword [0x1402418e4]
xor eax, 0xdcddff9b
mov r9d, 0x9cf57cbd
xor edx, edx
div r9d
mov rdx, qword [rsp + 0x50]
imul eax, eax, 0x78c4362d
mov dword [rsp + 0x34], eax
mov eax, 0x8408a02e
xor eax, 0x588f1f1d
mov dword [rsp + 0x30], eax
movabs r9, 0x3883fdeced879826
movabs rax, 0xc77c021312786826
xor r9, rax
movabs rax, 0x26ee9bf5db701489
movabs r10, 0xd911640a248feb76
xor rax, r10
xor r9, rax
mov rax, rdx
xor rax, r9
and rax, rdx
mov r9, qword [rax + 8]
movabs r10, 0x99b7cb14bf6dc63b
movabs rax, 0x99b7cb14bf6dc98a
xor r10, rax
movabs r11, 0x9dc3764a1ecca55b
movabs rax, 0x9dc3764a1ecca55b
xor r11, rax
sub r11, r9
xor eax, eax
sub rax, 0xffffffffffffffd0
add r11, rax
movabs rax, 0x3af1bb6e9be443a4
movabs rsi, 0x3af1bb6e9be443a4
xor rax, rsi
sub rax, r11
cmp r9, r10
cmovl rax, r9
mov r9, rax
sub r9, r8
cmovl r8, rax
call fcn.140031b4a
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
cmp eax, ecx
ja 0x14000d7dc
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
jmp 0x14000d90a
mov rcx, qword [rsp + 0x50]
xor eax, eax
cmp rcx, 0
mov rcx, rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x40], rax
je 0x14000d92d
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
call fcn.14000d200
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
add rsp, 0x60
pop rsi
ret
test r13d, r11d
mov ch, cl
wait
invalid
Function at 0x14000e9b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov eax, dword [0x140241948]
mov edx, dword [0x14024194c]
mov ecx, eax
and ecx, edx
shl ecx, 1
add eax, edx
sub eax, ecx
xor eax, 0x89dbed62
xor eax, 0xf8b951b8
mov ecx, 0xdba69446
xor ecx, 0x1c0fd7e6
xor edx, edx
div ecx
cmp eax, 0xf5b4168
jae 0x14000ea9c
mov eax, dword [0x140241950]
or eax, dword [0x140241954]
mov ecx, 0xac68a3ab
xor edx, edx
div ecx
mov ecx, 0xb2a9477f
xor edx, edx
div ecx
mov ecx, 0x6bdf2b60
xor ecx, 0x557504be
xor edx, edx
div ecx
mov dword [rsp + 0x2c], eax
call fcn.14000bc00
mov rcx, qword [rsp + 0x48]
mov eax, dword [rsp + 0x2c]
mov rcx, qword [rcx + 0x20]
mov qword [rsp + 0x30], rcx
cmp rcx, 0
sete cl
mov byte [rsp + 0x3f], cl
cmp eax, 0xe05c10
jae 0x14000e9fe
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x14000ea96
jmp 0x14000ea6d
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov r8, 0xffffffffffffffff
xor r8, 0x10
xor r9d, r9d
sub r9, 1
sub r8, r9
sub rcx, r8
call rax
nop
add rsp, 0x58
ret
mov ebp, 0xe9e7b621
pop rcx
invalid
Function at 0x14000f2b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], rdx
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rcx, qword [rax + 8]
mov rax, qword [rax]
cmp rcx, rax
mov qword [rsp + 0x50], rax
jg 0x14000f2f2
mov rcx, qword [rsp + 0x48]
call fcn.14000da6a
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rax, qword [rax + 0x10]
mov r10, rdx
shl r10, 4
mov r8, rax
add r8, r10
mov qword [r8], r9
mov r8, rdx
shl r8, 4
add rax, r8
add rax, 8
mov qword [rax], rcx
movabs rcx, 0x7e98faafa988beb2
movabs rax, 0x7e98faafa988beb3
xor rcx, rax
mov rax, rdx
add rax, rcx
mov qword [rsp + 0x30], rax
mov rcx, rdx
xor rcx, 0xffffffffffffffff
mov r8, rdx
xor r8, 0xffffffffffffffff
or rcx, r8
xor rcx, 0xffffffffffffffff
mov r8, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
or rcx, r8
mov r8, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
mov r9, 0xffffffffffffffff
xor r9, 0xffffffffffffffff
or r8, r9
and rdx, r8
xor rdx, 0xffffffffffffffff
xor rcx, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
or rcx, rdx
xor rax, 0xffffffffffffffff
xor rcx, 0xffffffffffffffff
mov rdx, 0xffffffffffffffff
movabs r8, 0x39c6b5a09c627a1f
xor rdx, r8
or rax, rcx
movabs rcx, 0x908a8b2d08162a7
movabs r8, 0x30ce1d124ce318b8
xor rcx, r8
or rcx, rdx
movabs rdx, 0x781ef8979fd79db2
movabs r8, 0x87e107686028624d
xor rdx, r8
xor rax, rdx
and rax, rcx
cmp rax, 0
jge 0x14000f49c
mov ecx, dword [0x140241968]
mov edx, dword [0x14024196c]
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
add eax, 0x27bb22a2
mov ecx, 0x85f41c48
xor ecx, 0x54d6896b
and eax, ecx
sub eax, 0x79fc21b7
mov ecx, 0x37fed59b
xor ecx, 0x1284d765
add eax, ecx
mov ecx, 0x1cf6d8a2
xor ecx, 0x650af915
add eax, ecx
cmp eax, 0x2066880d
jbe 0x14000f4ae
mov eax, dword [0x140241970]
xor edx, edx
div dword [0x140241974]
mov ecx, 0x25651403
xor edx, edx
div ecx
and eax, 0x519b19d3
mov ecx, 0x8ccc2c7b
xor edx, edx
div ecx
mov dword [rsp + 0x2c], eax
mov eax, 0xa2d12ed7
xor eax, 0x22788292
mov dword [rsp + 0x28], eax
call fcn.140008d37
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
jae 0x14000f44b
jmp 0x14000f4a9
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
add rsp, 0x58
ret
cli
mov cl, 0xbc
mov bh, 0xe9
xchg esp, eax
invalid
Function at 0x14001b860
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 8], rcx
mov eax, dword [0x140241e78]
mov edx, dword [0x140241e7c]
xor edx, 0xfd68be75
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
or eax, edx
and eax, ecx
mov ecx, 0x5e1c0c49
xor ecx, 0x6e21cab1
xor edx, edx
div ecx
mov r8d, 0xffffffff
xor r8d, 0xa2da7222
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xa2da7222
or eax, 0xa2da7222
imul eax, edx
add eax, ecx
mov ecx, 0x883e985a
xor ecx, 0xa8a1addd
mov edx, 0xae4212c7
xor edx, 0x51bded38
xor ecx, edx
add eax, ecx
add eax, 1
cmp eax, 0xa519adc5
jbe 0x14001b9ea
mov eax, dword [0x140241e80]
mov edx, dword [0x140241e84]
mov ecx, eax
xor ecx, edx
not edx
and eax, edx
add eax, eax
sub eax, ecx
add eax, 0xf082df13
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x2e020c2b
and ecx, 0xd1fdf3d4
imul ecx, edx
mov edx, eax
and edx, 0xd1fdf3d4
or eax, 0xd1fdf3d4
imul eax, edx
add eax, ecx
mov ecx, 0xa03e0b83
imul rax, rcx
shr rax, 0x3c
mov dword [rbp - 0x10], eax
mov eax, 0x10
call fcn.14023fff0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
sub rsp, 0x20
call fcn.14000bc00
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov qword [rbp - 0x18], rax
sub rsp, 0x20
call fcn.14001b760
add rsp, 0x20
mov cl, al
mov eax, dword [rbp - 0x10]
mov byte [rbp - 9], cl
cmp eax, 0x77827c62
je 0x14001b8f1
mov al, byte [rbp - 9]
test al, 1
jne 0x14001b99e
jmp 0x14001b9e5
mov rcx, qword [rbp - 0x20]
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.1400d6f66
mov rax, qword [rbp - 0x18]
add rsp, 0x20
cmp byte [rax + 0x50], 0
jne 0x14001b9e5
mov rcx, qword [rbp - 8]
mov edx, 8
sub rsp, 0x20
call fcn.14000f52f
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
invalid
Function at 0x14001cee0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x140241f28]
sub eax, dword [0x140241f2c]
add eax, 0x8e2e3ca2
mov ecx, 0x87bbecd0
xor ecx, 0xce2bee88
sub eax, ecx
add eax, 0xfcf2e2d8
add eax, 0x49900258
and eax, 0x917e8360
mov ecx, 0xefee39d7
xor ecx, 0x7a476dee
cmp eax, ecx
je 0x14001cf98
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x140241f30]
mov edx, dword [0x140241f34]
xor edx, 0x4adb4a7
and eax, edx
mov edx, 0x4eaa9ff3
xor edx, 0xa2c00b16
imul eax, edx
and eax, 0xb1c81730
mov edx, 0x7201bf6e
xor edx, 0x45362ed3
imul eax, edx
mov dword [rsp + 0x24], eax
xor eax, eax
mov edx, eax
call fcn.14001c880
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
call fcn.14001cbe0
mov eax, dword [rsp + 0x24]
cmp eax, 0x1b0aafb1
jb 0x14001cf2e
add rsp, 0x38
ret
invalid
Function at 0x14001d680
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov r8, qword [rcx]
mov rcx, r8
and rcx, 0xffffffffffffffff
shl rcx, 1
mov rax, r8
xor rax, 0xffffffffffffffff
add rax, rcx
mov qword [rsp + 0x50], rax
mov rcx, rax
xor rcx, 0xffffffffffffffff
mov rdx, rax
xor rdx, 0xffffffffffffffff
and rcx, rdx
mov rdx, r8
or rdx, rdx
movabs r9, 0xb51aa2a0e4532086
movabs r10, 0x4ae55d5f1bacdf79
xor r9, r10
xor rdx, r9
xor rcx, 0xffffffffffffffff
movabs r9, 0x11223974464789ad
movabs r10, 0xeeddc68bb9b87652
xor r9, r10
xor rdx, r9
and rcx, rdx
mov rdx, rax
xor rdx, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
and rdx, r8
or rcx, rdx
xor rcx, 0xffffffffffffffff
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x14001d747
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
add rcx, 8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
jmp 0x14001d7e4
mov ecx, dword [0x140241f68]
mov edx, dword [0x140241f6c]
xor edx, 0x77f095f6
mov eax, ecx
and eax, edx
or ecx, edx
add eax, ecx
mov ecx, 0xc70a284f
xor ecx, 0x622aa4b7
and eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x5c355915
add eax, ecx
add eax, 1
or eax, 0x1d9df6ed
cmp eax, 0xe6de4875
jae 0x14001d8af
mov ecx, dword [0x140241f70]
mov edx, dword [0x140241f74]
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
or eax, 0xb11cd90b
mov ecx, 0x658856bb
xor edx, edx
div ecx
sub eax, 0x6974fd3e
sub eax, 0x1c164e07
mov ecx, 0x215f87c7
xor ecx, 0x482b7af9
add eax, ecx
mov dword [rsp + 0x2c], eax
call fcn.140008d37
mov eax, dword [rsp + 0x2c]
cmp eax, 0xbf24d77b
je 0x14001d78e
jmp 0x14001d8aa
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
cmp rax, rcx
jl 0x14001d89d
mov rax, qword [rsp + 0x20]
cmp rax, 0
jl 0x14001d81e
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
cmp rax, qword [rcx]
jl 0x14001d82b
mov rcx, rdx
call fcn.140012b72
jmp 0x14001d8aa
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
add rcx, 8
shl rax, 5
add rcx, rax
call fcn.14001d63d
mov rcx, qword [rsp + 0x20]
movabs rdx, 0x5c05766921c8cd1a
movabs rax, 0xa3fa8996de3732e5
xor rdx, rax
mov rax, rcx
add rax, rdx
mov rdx, rax
xor rdx, rcx
cmp rdx, 0
setl dl
cmp rcx, 0
setne cl
and cl, dl
test cl, 1
mov qword [rsp + 0x38], rax
jne 0x14001d893
jmp 0x14001d7e4
call fcn.140008d37
jmp 0x14001d8aa
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
add rsp, 0x58
ret
xchg byte [rbp - 0x1c], al
in al, 0xe9
invalid

Function at 0x14001f401
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
xor eax, eax
mov edx, eax
call fcn.14001ea70
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp fcn.14001ee10
Function at 0x14001fb70
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 8]
mov rcx, rdx
add rcx, 8
mov qword [rsp + 0x48], rcx
cmp rax, qword [rdx + 8]
mov qword [rsp + 0x50], rax
je 0x14001fbd6
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
mov qword [rsp + 0x58], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x58]
call fcn.14001e220
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov edx, dword [0x140242058]
imul edx, dword [0x14024205c]
add edx, 0x82061aff
mov ecx, edx
xor ecx, 0x9cf11510
mov eax, 0xffffffff
xor eax, 0x9cf11510
and edx, eax
mov eax, 0x54f7ec14
xor eax, 0x54f7ec16
imul eax, edx
sub eax, ecx
sub eax, 0x4b5335ac
cmp eax, 0x880e27da
ja 0x14001fc9e
mov rcx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x30]
mov eax, dword [0x140242060]
xor edx, edx
div dword [0x140242064]
mov rdx, qword [rsp + 0x28]
mov r11d, 0x44e39a2d
xor r11d, 0x3e215d6d
mov r10d, eax
xor r10d, r11d
mov r11d, 0x31d68f8b
xor r11d, 0xce297074
xor r10d, r11d
or eax, 0x7ac2c740
and eax, r10d
add eax, 0xf3c39d58
xor r10d, r10d
sub r10d, 0x6f5d10f4
sub eax, r10d
mov r9, qword [r9]
mov qword [r8], r9
mov qword [rcx], rdx
cmp eax, 0x3417cac5
jbe 0x14001fc26
add rsp, 0x68
ret
push 0x7fe9a714
invalid

Function at 0x140020580
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1402420a8]
mov ecx, 0x23e33ccc
xor ecx, 0x31a85880
xor eax, ecx
mov edx, dword [0x1402420ac]
mov ecx, 0xd74810a8
xor ecx, 0xcf7fd444
xor edx, ecx
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
mov r8d, edx
and r8d, ecx
mov ecx, 0x809f69d
xor ecx, 0x809f69f
imul ecx, r8d
sub ecx, edx
sub eax, ecx
mov r8d, 0xffffffff
xor r8d, 0xffcc6062
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0x188f4ffa
xor r8d, 0xe7432f98
mov edx, eax
and edx, r8d
or eax, 0xffcc6062
imul eax, edx
add eax, ecx
sub eax, 0x900094a6
mov ecx, 0x99da9496
xor edx, edx
div ecx
mov ecx, 0xd5f5ee96
xor ecx, 0x7a48e0ba
cmp eax, ecx
je 0x1400206c5
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x1402420b0]
mov r9d, dword [0x1402420b4]
mov edx, eax
xor edx, 0xffffffff
mov r8d, r9d
and r8d, edx
mov r10d, r9d
xor r10d, 0xffffffff
mov edx, eax
and edx, r10d
imul edx, r8d
mov r8d, eax
and r8d, r9d
or eax, r9d
imul eax, r8d
add eax, edx
and eax, 0x2ce7e789
mov r8d, 0xb73d449c
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x30]
mov r8d, 0x636dbe67
xor r8d, 0x19884794
sub eax, r8d
mov dword [rsp + 0x2c], eax
mov qword [rcx], 0
mov qword [rcx + 8], 0
call fcn.140020460
mov eax, dword [rsp + 0x2c]
cmp eax, 0xaec83bac
ja 0x140020633
mov rax, qword [rsp + 0x40]
mov eax, dword [rsp + 0x40]
add rsp, 0x48
ret
jle 0x1400206bc
invalid

Function at 0x140021ef2
Capabilities:
Encode data using xor

Disassembly:
and qword [rcx], 0
jmp fcn.140021bb0
Function at 0x140021f00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rcx
mov rax, rcx
mov qword [rsp + 0x68], rax
mov qword [rcx], 0
mov rax, rcx
add rax, 8
mov qword [rsp + 0x70], rax
mov qword [rcx + 8], 0
movabs rax, 0xe03ab4056cd3813f
movabs rcx, 0xe03ab4056cd3813f
xor rax, rcx
cmp r8, rax
jge 0x140021f66
mov rcx, r8
mov rdx, r8
call fcn.14000db87
jmp 0x140022169
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
call fcn.140021ef2
mov rax, qword [rsp + 0x50]
mov rcx, rax
add rcx, 0xffffffffffffffff
mov rdx, rcx
xor rdx, rax
xor rdx, 0xffffffffffffffff
mov r8, rax
and r8, rdx
movabs rdx, 0x3ff57abfe14a42e2
movabs r9, 0x3ff57abfe14a42e0
xor rdx, r9
imul rdx, r8
sub rdx, rax
sub rcx, rdx
cmp rcx, 0
setl cl
movabs rdx, 0x430f87c89b4f7772
movabs r8, 0x430f87c89b4f7772
xor rdx, r8
cmp rax, rdx
setne al
and al, cl
test al, 1
jne 0x14002200f
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
xor eax, eax
test rcx, rcx
cmovg rax, rcx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rax
jmp 0x140022019
call fcn.140008d37
jmp 0x140022169
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
cmp rax, rcx
je 0x140022169
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
cmp rax, rcx
jne 0x140022051
mov rcx, rdx
call fcn.140012b72
jmp 0x140022169
mov eax, dword [0x140242148]
mov ecx, dword [0x14024214c]
mov edx, 0x317aaaef
xor edx, 0xb1900108
xor ecx, edx
sub eax, 0x57e0c1f7
add eax, ecx
mov ecx, 0x4841cd91
xor ecx, 0x1fa10c66
add eax, ecx
xor eax, 0x19e0d5e3
mov r8d, 0x2eef33c6
xor r8d, 0xaf02eab2
mov ecx, 0x10c45858
xor ecx, 0xef3ba7a7
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0xf9caa9b3
xor r8d, 0x635564c
xor ecx, r8d
imul ecx, edx
mov r8d, 0x2e6d8530
xor r8d, 0xaf805c44
mov edx, eax
and edx, r8d
or eax, 0x81edd974
imul eax, edx
add eax, ecx
mov ecx, 0x99de4f56
xor ecx, 0x8327b4e8
add eax, ecx
cmp eax, 0x7809ab0
je 0x140022173
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x58]
mov eax, dword [0x140242150]
xor eax, 0x711cb631
xor eax, dword [0x140242154]
mov r9d, 0x42abc160
xor r9d, 0xb00d8e0a
xor eax, r9d
xor r9d, r9d
sub r9d, 0x491985da
sub eax, r9d
mov r9d, 0xc2edf4b5
xor r9d, 0x3caec364
imul eax, r9d
mov r8b, byte [r8 + rcx]
mov byte [rdx + rcx + 8], r8b
add rcx, 1
mov qword [rsp + 0x28], rcx
cmp eax, 0xe4257b4d
ja 0x1400220ef
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
jmp 0x140022019
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
sbb ah, dh
and dword [rbx], edx
jmp 0x1400220ef
Function at 0x140022180
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x140022241
mov rcx, qword [rsp + 0x30]
movabs rax, 0x4000000000000000
and rax, qword [rcx]
cmp rax, 0
jne 0x140022241
mov eax, dword [0x140242158]
sub eax, dword [0x14024215c]
mov edx, 0xe7d3c342
xor edx, 0xaf343a66
mov ecx, eax
and ecx, edx
shl ecx, 1
xor eax, 0x48e7f924
add eax, ecx
and eax, 0xc80a43c9
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0x10ba8407
add eax, ecx
cmp eax, 0xf13f5d16
ja 0x140022246
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x140242160]
sub eax, dword [0x140242164]
mov r8d, 0xf1cd8df7
xor r8d, 0xe311fc7c
xor edx, edx
div r8d
xor eax, 0x77aef7c3
xor eax, 0x448973df
mov dword [rsp + 0x2c], eax
call fcn.14000f4b7
mov eax, dword [rsp + 0x2c]
cmp eax, 0xeef83f84
jae 0x1400221f7
jmp 0x140022241
add rsp, 0x38
ret
in al, 0x39
add al, 0x4a
jmp 0x1400221f7

Function at 0x140024e5e
Capabilities:
Encode data using xor

Disassembly:
and qword [rcx], 0
jmp fcn.140024520
Function at 0x140037980
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xc0
mov dword [rsp + 0xa4], ecx
call fcn.140038c60
mov ecx, dword [rsp + 0xa4]
mov qword [rsp + 0xa8], rax
movabs r8, 0x19e2907b38cd3577
movabs rax, 0x19e2907b38cd35f0