joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421150
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x42115d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x42116d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x421155
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x421185
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x421172
sub eax, 3
jb 0x42119f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x4211d6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x4211c6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x4211c4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x4211b3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.00421112
jmp 0x42115d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xba00
mov dl, 2
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x421222
cmp rsi, rcx
jae 0x42122a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x421209
cmp al, 0x8f
ja 0x421209
cmp byte [rsi - 2], 0xf
je 0x42120f
sub al, 0xe8
cmp al, 1
ja 0x4211f3
cmp rsi, rcx
jae 0x42122a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x4211f9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x42122a
lodsb al, byte [rsi]
jmp 0x421209
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1f000]
mov eax, dword [rdi]
or eax, eax
je 0x421287
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x21000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x421237
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x421281
mov qword [rbx], rax
add rbx, 8
jmp 0x421257
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.0042130a], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.0042130a
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x4212fa
sub rsp, 0xffffffffffffff80
jmp 0x4014e0
Function at 0x1400048a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
cmp rdx, 0
mov qword [rsp + 0x50], rdx
jge 0x140004ac6
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
xor eax, eax
movabs r8, 0x45bd7033a5561ad2
sub rax, r8
sub rax, rdx
movabs rdx, 0x693239b955635945
movabs r8, 0x2c8f498af0354397
xor rdx, r8
add rax, rdx
mov qword [rsp + 0x28], rax
mov edx, 1
call fcn.14001c110
mov rax, qword [rsp + 0x48]
mov rcx, rax
add rcx, 8
mov qword [rsp + 0x30], rcx
mov rcx, qword [rax + 8]
mov rdx, qword [rax]
mov byte [rcx + rdx + 8], 0x2d
mov rcx, qword [rax]
mov rax, rcx
add rax, 1
mov qword [rsp + 0x38], rax
mov rdx, rcx
and rdx, 0xffffffffffffffff
shl rdx, 1
add rcx, 0xffffffffffffffff
sub rcx, rdx
and rax, rcx
cmp rax, 0
jge 0x140004a9b
mov eax, dword [0x1402003a0]
mov ecx, dword [0x1402003a4]
mov edx, 0xb32602a5
xor edx, 0x1cb5f54b
xor ecx, edx
xor eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x76f666e7
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x76f666e7
mov r8d, 0x35170897
xor r8d, 0x43e16e70
or eax, r8d
imul eax, edx
add eax, ecx
sub eax, 0x481e1e1a
mov ecx, 0xc0a615b
xor ecx, 0x83c8e32a
sub eax, ecx
mov ecx, 0x58557182
xor ecx, 0x104b6f98
add eax, ecx
mov ecx, 0xb341dda9
xor ecx, 0x720484a9
add eax, ecx
cmp eax, 0x23b47bb9
je 0x140004ad9
mov eax, dword [0x1402003a8]
xor edx, edx
div dword [0x1402003ac]
mov r11d, eax
mov ecx, r11d
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x36df40d1
mov r8d, 0xffffffff
xor r8d, 0x39323f22
mov eax, ecx
and eax, 0x39323f22
and r11d, r8d
mov r9d, edx
and r9d, 0x39323f22
mov r10d, 0xf4ea9a06
xor r10d, 0xc235dad7
and r10d, r8d
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, edx
xor ecx, 0xffffffff
mov edx, 0x87cd4644
xor edx, 0xbeff7966
or edx, r8d
and ecx, edx
or eax, ecx
sub eax, 0x1153245a
sub eax, 0x8180d9f5
add eax, 0x1153245a
mov ecx, eax
add ecx, 1
mov edx, 0xcbc8db3e
xor edx, 0x343724c1
xor eax, edx
or eax, 0xa71c3f9d
add eax, ecx
mov dword [rsp + 0x24], eax
call fcn.140007f57
mov eax, dword [rsp + 0x24]
cmp eax, 0xa33690ef
je 0x1400049d9
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
jmp 0x140004ac6
mov rax, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x48]
mov qword [r8], rdx
mov rcx, qword [rcx]
mov r8b, 0xff
xor r8b, 0xff
mov byte [rcx + rdx + 8], r8b
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
add rsp, 0x58
jmp fcn.140003a00
push rsp
push rsi
invalid
Function at 0x14000c080
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], rcx
mov eax, dword [0x1402007f8]
add eax, dword [0x1402007fc]
mov ecx, 0x7ffe97d3
xor ecx, 0xb39bc205
imul eax, ecx
mov ecx, 0xf2a5cdaf
xor ecx, 0x6b16b2da
add eax, ecx
and eax, 0x1d48b499
cmp eax, 0xcd8a6137
jae 0x14000c21d
mov ecx, dword [0x140200800]
mov edx, dword [0x140200804]
mov eax, ecx
or eax, edx
not ecx
not edx
and ecx, edx
not ecx
and eax, ecx
imul rax, rax, 0x169bf4af
shr rax, 0x3c
mov ecx, eax
add ecx, 0xe872032d
mov eax, ecx
and eax, 0x48000307
xor eax, 0xb5610cf1
and ecx, 0x120009
or eax, ecx
mov dword [rbp - 0x1c], eax
mov eax, 0x10
call fcn.1401ffc50
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.14000b9ba
add rsp, 0x20
mov ecx, 0x40
mov edx, 8
sub rsp, 0x20
call fcn.140014320
mov rdx, qword [rbp - 8]
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x28]
mov r8, qword [0x140216e98]
mov qword [rcx], r8
lea r8, [0x14020f408]
mov qword [rcx + 0x10], r8
mov r8, qword [rdx]
mov qword [rax], r8
mov r8, qword [rdx + 8]
mov qword [rax + 8], r8
mov qword [rdx], 0
mov qword [rdx + 8], 0
mov rdx, qword [rax]
mov qword [rcx + 0x18], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 0x20], rax
lea rdx, [0x14020f408]
lea r8, [0x14020f414]
lea r9, [0x14020f41d]
sub rsp, 0x30
mov qword [rsp + 0x20], 0x5c35bb46
call fcn.1400139e0
mov rcx, qword [rbp - 8]
mov eax, dword [rbp - 0x1c]
add rsp, 0x30
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x18], rcx
cmp rcx, 0
sete cl
mov byte [rbp - 9], cl
cmp eax, 0xa29e260f
jb 0x14000c0c5
mov al, byte [rbp - 9]
test al, 1
jne 0x14000c218
jmp 0x14000c1ec
mov rcx, qword [rbp - 0x18]
movabs rax, 0x4000000000000000
and rax, qword [rcx]
cmp rax, 0
jne 0x14000c218
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call fcn.14000fb1c
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
loopne 0x14000c292
xchg ecx, eax
psubsw mm3, qword [rdi + 0x48fffffe]
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov rax, rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rax], 0
mov qword [rax + 8], rcx
mov edx, 0x10
lea r8, [rsp + 0x40]
call fcn.14000c2b0
test al, 1
jne 0x14000c263
jmp 0x14000c26d
call fcn.140007f57
jmp 0x14000c2a1
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
cmp rax, 0
jge 0x14000c28b
call fcn.14000c049
jmp 0x14000c2a1
mov rcx, qword [rsp + 0x28]
call fcn.14000b997
mov rcx, rax
mov rax, qword [rsp + 0x38]
idiv edi
dec dword [rax - 0x77]
ror dword [rax - 0x75], 0x44
and al, 0x38
mov qword [rax + 0x10], rcx
add rsp, 0x48
ret
Function at 0x14000de50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rcx
mov rdx, qword [rdx]
mov rax, rdx
and rax, 0xffffffffffffffff
mov rcx, rdx
or rcx, 0xffffffffffffffff
add rax, rcx
mov qword [rsp + 0x40], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
movabs rdx, 0x1fcfd5ebad540a52
movabs r8, 0xe0302a1452abf5ad
xor rdx, r8
cmp rax, rdx
setg dl
xor eax, eax
mov r8b, al
xor r8b, 1
mov al, dl
xor al, r8b
xor dl, 0xff
and al, dl
or cl, cl
xor cl, 0xff
xor al, 0xff
mov dl, 1
xor dl, 0
xor cl, dl
and al, cl
test al, 1
jne 0x14000ded6
jmp 0x14000df9c
mov eax, dword [0x1402008e8]
or eax, dword [0x1402008ec]
mov ecx, 0xe0cb5c14
xor edx, edx
div ecx
mov ecx, 0xffddf44f
xor ecx, 0xfe287c3e
xor edx, edx
div ecx
mov ecx, eax
mov edx, 0xd613045c
xor edx, 0xeee76326
mov eax, ecx
and eax, edx
xor ecx, 0x38f4677a
or eax, ecx
mov ecx, 0xb43bef7a
xor ecx, 0x46c93bfb
cmp eax, ecx
ja 0x14000e08e
mov eax, dword [0x1402008f0]
mov ecx, 0x5c95b02f
xor ecx, 0x5ff1a33
xor eax, ecx
add eax, dword [0x1402008f4]
mov edx, 0x7bfea2fa
xor edx, 0xdd8a64c0
mov ecx, eax
and ecx, edx
shl ecx, 1
xor eax, 0xa674c63a
add eax, ecx
mov ecx, 0xf44c2f84
xor edx, edx
div ecx
sub eax, 0xa056292f
add eax, 0x5aa7ef66
add eax, 0xa056292f
mov dword [rsp + 0x24], eax
mov eax, 0x25a4d9ae
xor eax, 0xb6021a1d
mov dword [rsp + 0x20], eax
call fcn.140007f57
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
ja 0x14000df26
jmp 0x14000e084
mov eax, dword [0x1402008f8]
xor edx, edx
div dword [0x1402008fc]
mov ecx, 0x3e7f787f
xor ecx, 0x74c16a99
xor edx, edx
div ecx
add eax, 0x47424bbf
and eax, 0x1d13867b
mov ecx, 0x71acf686
xor ecx, 0x6fe8e700
cmp eax, ecx
jae 0x14000e097
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x40]
mov r9, qword [rsp + 0x30]
mov eax, dword [0x140200900]
sub eax, dword [0x140200904]
mov ecx, eax
and ecx, 0x7ca272fc
mov r10d, 0xe8ee7578
xor r10d, 0x17118a87
xor ecx, r10d
add eax, 0x7ca272fc
add eax, 1
add eax, ecx
mov ecx, 0xffffffff
xor ecx, 0xe373bdda
mov r10d, 0x70df0683
xor r10d, 0x70df0683
mov r11d, 0x803d4172
xor r11d, 0x803d4173
sub r10d, r11d
sub ecx, r10d
sub eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x4c791ceb
add eax, ecx
add eax, 1
mov ecx, 0x20de6316
xor ecx, 0xb1304b67
mov r10, r8
shl r10, 4
add r10, qword [rdx + 0x10]
mov r11, qword [r10]
mov qword [r9], r11
mov r10, qword [r10 + 8]
mov qword [r9 + 8], r10
mov qword [rdx], r8
cmp eax, ecx
jae 0x14000dfd6
jmp 0x14000e084
mov rax, qword [rsp + 0x38]
add rsp, 0x48
ret
stc
in eax, 0xe8
sub ecx, ebp
invalid
sbb bl, byte gs:[rdx + 0x24]
jmp 0x14000dfd6
Function at 0x140010ef0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rcx
call fcn.14000b9ba
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rcx]
mov rcx, qword [rax]
mov qword [rsp + 0x38], rcx
cmp rcx, 0
mov qword [rsp + 0x40], rax
je 0x140010f4a
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call rax
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x50], 0
jne 0x140010f5e
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x40]
movsx rdx, word [rax + 0x10]
call fcn.14000fb9a
mov ecx, dword [0x140200a28]
mov edx, dword [0x140200a2c]
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
mov edx, 0xb5cf66a4
xor edx, 0x107f8739
mov ecx, 0xebeda274
xor ecx, 0x14125d8b
xor edx, ecx
mov ecx, eax
and ecx, edx
mov r8d, 0x268d189
xor r8d, 0xa7d83014
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
mov ecx, 0x9906ed9e
xor edx, edx
div ecx
mov ecx, 0xae37e992
xor edx, edx
div ecx
cmp eax, 0xb32c10e9
jae 0x140011028
mov eax, dword [0x140200a30]
xor eax, 0x7325f12a
mov ecx, dword [0x140200a34]
xor ecx, 0x2258f516
sub eax, ecx
mov ecx, 0x231d937f
xor ecx, 0x80f367ca
or eax, ecx
mov ecx, 0xf3521554
xor ecx, 0x84f8e904
mov edx, eax
and edx, ecx
mov ecx, 0x2fbcb5d5
xor ecx, 0x2fbcb5d7
imul ecx, edx
add eax, 0x77aafc50
sub eax, ecx
sub eax, 0xbef4039b
mov ecx, 0xddebb59d
xor ecx, 0xc7002500
cmp eax, ecx
jb 0x140010fc1
add rsp, 0x48
ret
mov edx, 0xe9d1a41c
nop
invalid
Function at 0x140012c40
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x20], rcx
mov eax, 0x10
call fcn.1401ffc50
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
mov eax, 4
cmp rcx, 1
mov qword [rbp - 0x10], rax
jl 0x140012e1e
mov rax, qword [rbp - 0x20]
cmp rax, 0x8000
jae 0x140012db9
mov r8, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
mov edx, 2
sub rsp, 0x20
call fcn.14000c2b0
add rsp, 0x20
test al, 1
jne 0x140012cac
jmp 0x140012cbe
sub rsp, 0x20
call fcn.140007f57
add rsp, 0x20
jmp 0x140012dac
mov r8d, dword [0x140200b28]
xor r8d, 0x139f92e3
mov eax, dword [0x140200b2c]
xor eax, 0xc44d5c9
add r8d, 0x358488a9
add r8d, eax
sub r8d, 0x358488a9
mov eax, r8d
xor eax, 0xffffffff
and eax, 0x372b8a45
mov edx, 0xffffffff
xor edx, 0x372b8a45
and r8d, edx
mov ecx, 0xffffffff
xor ecx, 0x20d687ad
mov r9d, 0x5389749b
xor r9d, 0x64a2fede
and ecx, r9d
and edx, 0x20d687ad
or eax, r8d
or ecx, edx
xor eax, ecx
xor ecx, ecx
sub ecx, 0x2a088de4
sub eax, ecx
mov ecx, 0x40c6508e
xor edx, edx
div ecx
cmp eax, 0xf6d26bc8
je 0x140012e27
mov rcx, qword [rbp - 0x18]
mov eax, dword [0x140200b30]
xor edx, edx
div dword [0x140200b34]
mov r8d, 0xbebe7b42
xor r8d, 0x3711ba12
xor edx, edx
div r8d
mov edx, eax
sub edx, 0xc8332b77
mov r8d, 0x716567d4
xor r8d, 0x18073f6a
mov eax, edx
and eax, r8d
xor edx, 0x696258be
or eax, edx
mov rcx, qword [rcx]
mov qword [rbp - 0x28], rcx
cmp eax, 0xaffba3a4
ja 0x140012d47
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x30], rax
jmp 0x140012dac
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x10], rax
jmp 0x140012e1e
mov rcx, qword [rbp - 0x20]
mov edx, 3
lea r8, [rbp - 8]
sub rsp, 0x20
call fcn.14000c2b0
add rsp, 0x20
test al, 1
jne 0x140012de0
jmp 0x140012df2
sub rsp, 0x20
call fcn.140007f57
add rsp, 0x20
jmp 0x140012e16
mov rax, qword [rbp - 8]
movabs rcx, 0x81a8cb9d8d586bf3
movabs rdx, 0x81a8cb9d8d586bf1
xor rcx, rdx
cqo
idiv rcx
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov rsp, rbp
pop rbp
ret
cwde
mov dword [rdi - 0xe8166a], edi
invalid
Function at 0x1400136a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x140200b78]
xor eax, 0xfbd38f1c
mov r8d, dword [0x140200b7c]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x518644d2
xor ecx, 0xb04839c2
and eax, ecx
mov ecx, eax
and ecx, 0x8a68476b
xor ecx, 0xffffffff
add eax, 0x8a68476b
mov edx, 0xf90c67c1
xor edx, 0xf90c67c0
add eax, edx
add eax, ecx
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
mov edx, 0x21287945
xor edx, 0x8a8acce
or eax, edx
add eax, ecx
cmp eax, 0x71db2607
jae 0x1400137c4
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov ecx, dword [0x140200b80]
and ecx, dword [0x140200b84]
mov r8d, 0x15d81eb9
xor r8d, 0x9003e699
sub ecx, r8d
add ecx, 0x60402c1d
mov r8d, 0xdc410976
xor r8d, 0x35a2c8e3
add ecx, r8d
sub ecx, 0x60402c1d
and ecx, 0xae057d23
mov dword [rsp + 0x30], ecx
mov rcx, qword [rax]
mov qword [rsp + 0x28], rcx
mov qword [rax], rdx
call fcn.140013310
mov cl, al
mov eax, dword [rsp + 0x30]
mov byte [rsp + 0x37], cl
cmp eax, 0xe5d157e3
je 0x140013732
mov al, byte [rsp + 0x37]
test al, 1
jne 0x1400137b4
jmp 0x1400137be
mov rcx, qword [rsp + 0x28]
call fcn.140010ef0
nop
add rsp, 0x48
ret
invalid
Function at 0x140014710
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov rdx, qword [rcx]
movabs rcx, 0x6180f8c23e1917e9
movabs rax, 0x9e7f073dc1e6e816
xor rcx, rax
mov rax, rdx
add rax, rcx
mov qword [rsp + 0x50], rax
mov rcx, rax
and rcx, rcx
xor rcx, 0xffffffffffffffff
and rcx, rdx
xor rcx, 0xffffffffffffffff
mov r8, rdx
xor r8, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
or r8, rdx
mov rdx, rax
and rdx, r8
xor rdx, 0xffffffffffffffff
xor rcx, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
or rcx, rdx
movabs rdx, 0x648a1f4a247550a7
movabs r8, 0x648a1f4a247550a7
xor rdx, r8
cmp rcx, rdx
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x1400147c2
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
add rcx, 8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
jmp 0x1400147cc
call fcn.140007f57
jmp 0x1400149a6
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov eax, dword [0x140200bf8]
xor eax, 0xc4cdf687
mov ecx, dword [0x140200bfc]
xor ecx, 0xfa338b74
or eax, ecx
mov ecx, 0xbe532ccb
xor edx, edx
div ecx
mov ecx, eax
and ecx, 0x80418dd3
or eax, 0x80418dd3
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0xffffffff
xor ecx, 0xee6f0161
mov edx, 0xffffffff
xor edx, 0xee6f0161
and ecx, edx
mov edx, 0x57a1d0ba
xor edx, 0xa85e2f45
xor eax, edx
mov edx, 0x4a150359
xor edx, 0xb5eafca6
xor ecx, edx
and eax, ecx
cmp eax, 0x2adcafcb
je 0x1400149ab
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x140200c00]
xor edx, edx
div dword [0x140200c04]
add eax, 0xb4fdfcd0
mov edx, 0xf3fd38d
xor edx, 0xeaaefc8e
add eax, edx
mov edx, 0x1f39bdef
xor edx, 0xabc4413f
sub eax, edx
add eax, 0xfb928ba
mov r8d, 0x8f1ef9b1
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x40]
cmp rcx, rdx
setl cl
mov byte [rsp + 0x27], cl
cmp eax, 0x6a076388
jae 0x140014850
mov al, byte [rsp + 0x27]
test al, 1
jne 0x140014999
jmp 0x1400148bd
mov rax, qword [rsp + 0x28]
cmp rax, 0
jl 0x1400148df
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
cmp rax, qword [rcx]
jl 0x1400148ec
mov rcx, rdx
call fcn.140014583
jmp 0x1400149a6
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
add rcx, 8
imul rax, rax, 0x48
add rcx, rax
call fcn.140014562
mov rcx, qword [rsp + 0x28]
movabs rdx, 0x4daac043a16ed9a5
movabs rax, 0x4daac043a16ed9a5
xor rdx, rax
movabs rax, 0x31e560bdc790caa
movabs r8, 0xfce1a9f42386f355
xor rax, r8
sub rdx, rax
mov rax, rcx
sub rax, rdx
mov rdx, rax
xor rdx, rcx
cmp rdx, 0
setl dl
cmp rcx, 0
setne cl
xor r8d, r8d
xor r8b, 1
xor cl, r8b
xor dl, 0xff
mov r8b, 1
xor r8b, 0
or cl, dl
mov dl, 1
xor dl, 1
or dl, r8b
xor cl, 0xff
and cl, dl
test cl, 1
mov qword [rsp + 0x38], rax
jne 0x14001498f
jmp 0x1400147cc
call fcn.140007f57
jmp 0x1400149a6
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
add rsp, 0x58
ret
ret
Function at 0x140015fb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov eax, dword [0x140200ca8]
mov ecx, 0xad5eaef3
xor ecx, 0x23b3b062
xor eax, ecx
mov edx, dword [0x140200cac]
or eax, eax
xor eax, 0xffffffff
mov ecx, edx
xor ecx, 0xffffffff
xor edx, 0xffffffff
and ecx, edx
mov edx, 0xf87539f6
xor edx, 0x78ac609
xor eax, edx
xor ecx, 0xffffffff
and eax, ecx
add eax, 0x2d25b2a3
sub eax, 0xfb80f852
mov ecx, 0x7b390c71
xor ecx, 0x561cbed2
sub eax, ecx
mov ecx, 0x147a7da5
xor edx, edx
div ecx
mov ecx, eax
and ecx, 0x8352b551
shl ecx, 1
xor eax, 0x8352b551
add eax, ecx
cmp eax, 0x3066e122
jbe 0x1400160ec
mov eax, dword [0x140200cb0]
mov ecx, dword [0x140200cb4]
xor ecx, 0xf22f661e
xor edx, edx
div ecx
xor ecx, ecx
sub ecx, 0x3acbeb09
sub eax, ecx
mov ecx, 0x4f58c3c3
xor ecx, 0x4793663
add eax, ecx
imul eax, eax, 0xe8bc6901
mov dword [rsp + 0x2c], eax
call fcn.14000b9ba
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x40]
mov rcx, rax
add rcx, 0x58
call fcn.14000d6b0
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov r8, rax
mov eax, dword [rsp + 0x2c]
mov qword [rsp + 0x30], r8
cmp rcx, rdx
setg cl
mov byte [rsp + 0x3f], cl
cmp eax, 0x749673f4
je 0x14001603a
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x1400160c8
jmp 0x1400160e2
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
add rcx, rax
sub rdx, rax
call fcn.1400083d0
mov rax, qword [rsp + 0x30]
add rsp, 0x58
ret
mov al, 0xcc
xor al, 0xe9
invalid
Function at 0x140016fe0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov r8, qword [rcx]
mov rcx, r8
dec rcx
mov qword [rsp + 0x50], rcx
mov rdx, rcx
and rdx, r8
mov rax, rcx
or rax, r8
not rdx
and rdx, rax
test rcx, rcx
setns al
or rcx, rdx
sets cl
add al, cl
inc al
test al, 1
jne 0x140017043
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
add rcx, 8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
jmp 0x14001704d
call fcn.140007f57
jmp 0x14001714c
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
cmp rax, rcx
jl 0x14001713f
mov rax, qword [rsp + 0x28]
movabs rcx, 0xcef841ee560add00
movabs rdx, 0xcef841ee560add00
xor rcx, rdx
cmp rax, rcx
jl 0x14001709d
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
cmp rax, qword [rcx]
jl 0x1400170aa
mov rcx, rdx
call fcn.140014583
jmp 0x14001714c
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
add rcx, 8
imul rax, rax, 0x18
add rcx, rax
call fcn.140016e70
mov rcx, qword [rsp + 0x28]
movabs rdx, 0x8ef1d6c61a3efb6
movabs rax, 0xf710e2939e5c1049
xor rdx, rax
mov rax, rcx
add rax, rdx
mov r8, rax
and r8, rcx
shl r8, 1
mov rdx, rax
add rdx, rcx
sub rdx, r8
movabs r8, 0xb1f3d8d45efdeff1
movabs r9, 0xb1f3d8d45efdeff1
xor r8, r9
cmp rdx, r8
setl dl
cmp rcx, 0
setne cl
and cl, dl
test cl, 1
mov qword [rsp + 0x38], rax
jne 0x140017135
jmp 0x14001704d
call fcn.140007f57
jmp 0x14001714c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov eax, dword [0x140200d28]
mov ecx, dword [0x140200d2c]
xor ecx, 0x594584f4
xor eax, ecx
mov ecx, 0x93479822
xor ecx, 0x9140ce3b
xor edx, edx
div ecx
mov ecx, eax
mov edx, 0x48bccdfb
xor edx, 0x6937f7c2
mov eax, ecx
or eax, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x218b3a39
and ecx, edx
mov edx, 0x53677b4d
xor edx, 0xac9884b2
xor eax, edx
xor ecx, 0xffffffff
and eax, ecx
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0x9411453f
add eax, ecx
cmp eax, 0xe175b7bd
jae 0x140017208
mov eax, dword [0x140200d30]
or eax, dword [0x140200d34]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0xb6cfaf36
add ecx, eax
mov eax, 0x644f87b5
xor eax, 0x644f87b5
sub eax, ecx
mov ecx, 0xb8c9f791
xor ecx, 0xa1ea73ed
imul eax, ecx
imul eax, eax, 0x74a66a13
cmp eax, 0x602f9615
jbe 0x1400171bf
add rsp, 0x58
ret
mov edx, 0xe911b6da
scasb al, byte [rdi]
invalid