joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a4e40
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov rax, qword [0x140217170]
mov ecx, dword [rax]
call fcn.140007b73
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx]
call fcn.1400a4c30
mov rcx, rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rcx
cmp byte [rax + 0x50], 0
jne 0x1400a4e97
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov eax, dword [0x140204e78]
mov edx, dword [0x140204e7c]
xor edx, 0x4a25ae02
xor eax, 0xffffffff
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xef6e822f
or eax, edx
or ecx, 0xef6e822f
mov edx, 0x5bcbfe38
xor edx, 0xa43401c7
xor eax, edx
and eax, ecx
mov ecx, 0xefe595e7
xor ecx, 0x8b063ad3
mov edx, eax
and edx, ecx
mov ecx, 0xaed58740
xor ecx, 0xaed58742
imul ecx, edx
add eax, 0x64e3af34
sub eax, ecx
or eax, 0x384ba140
add eax, 0xc33a38aa
mov ecx, 0xc1072e51
xor ecx, 0x71c6e145
cmp eax, ecx
je 0x1400a4f49
mov eax, dword [0x140204e80]
add eax, dword [0x140204e84]
and eax, 0xa8a4a6e0
mov ecx, 0x7be1023d
xor edx, edx
div ecx
mov ecx, 0xea3d5c43
xor ecx, 0x38812a27
sub eax, ecx
cmp eax, 0xed984de3
je 0x1400a4f12
add rsp, 0x48
ret
scasd eax, dword [rdi]
mov edi, edi
wait
jmp 0x1400a4f12
Function at 0x1400ad020
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1402050a0]
mov edx, dword [0x1402050a4]
mov ecx, edx
and ecx, eax
xor ecx, 0xffffffff
add eax, edx
add eax, 1
add eax, ecx
mov ecx, 0xa57f4753
xor edx, edx
div ecx
and eax, 0x6bf642d4
mov edx, 0xd824cd0f
xor edx, 0xb336f11
mov ecx, eax
xor ecx, edx
mov edx, 0x4d0f4a04
xor edx, 0xb2f0b5fb
xor ecx, edx
or eax, 0xd317a21e
and eax, ecx
mov ecx, 0xea8097a
xor ecx, 0xe4509349
cmp eax, ecx
je 0x1400ad0f8
mov eax, dword [0x1402050a8]
or eax, dword [0x1402050ac]
mov ecx, 0xcb4e0823
xor ecx, 0xa25fdb75
or eax, ecx
mov ecx, 0xc21b04dd
xor edx, edx
div ecx
mov ecx, 0xec18491d
xor edx, edx
div ecx
mov dword [rsp + 0x28], eax
call fcn.1400aceab
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x30]
call qword [0x140227238]
mov ecx, eax
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x2c], ecx
cmp eax, 0x5e6ffa06
ja 0x1400ad091
mov eax, dword [rsp + 0x2c]
add rsp, 0x48
ret
cdq
invalid
Function at 0x1400af780
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
call fcn.1400af765
xor eax, eax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
cmp rax, 0x10
je 0x1400af913
mov eax, dword [0x1402051d0]
mov r8d, dword [0x1402051d4]
xor r8d, 0xbc55f475
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
mov r9d, 0x110545d5
xor r9d, 0xeefaba2a
xor ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
sub eax, 0x5cfe4d35
mov edx, eax
xor edx, 0xffffffff
xor eax, 0xffffffff
and edx, eax
mov eax, 0xffffffff
xor eax, 0x1edab31d
mov ecx, 0xcf1c5292
xor ecx, 0xd1c6e18f
mov r8d, 0xf45565f7
xor r8d, 0xbaa9a08
xor ecx, r8d
and eax, ecx
or edx, eax
xor edx, 0xffffffff
mov ecx, edx
xor ecx, 0xc366a1ae
mov eax, 0xffffffff
xor eax, 0xc366a1ae
and edx, eax
mov eax, 0xf7cb36e0
xor eax, 0xf7cb36e2
imul eax, edx
sub eax, ecx
cmp eax, 0xbafe3a1c
ja 0x1400afa1d
mov rcx, qword [rsp + 0x30]
mov r9d, dword [0x1402051d8]
xor r9d, 0x23f5cf3
mov r8d, dword [0x1402051dc]
mov edx, r9d
xor edx, 0xffffffff
mov eax, 0x1fe812ba
xor eax, 0x5c4b3c78
and eax, edx
mov r10d, 0xd8b1611a
xor r10d, 0x9b124fd8
mov edx, 0x5a1ea027
xor edx, 0xa5e15fd8
xor r10d, edx
and r9d, r10d
mov edx, r8d
xor edx, 0xffffffff
and edx, 0x43a32ec2
and r8d, r10d
or eax, r9d
or edx, r8d
xor eax, edx
mov edx, eax
and edx, 0xe224a006
shl edx, 1
add eax, 0xe224a006
sub eax, edx
mov r8d, 0x813abc9a
xor edx, edx
div r8d
mov r8d, 0x4a25ae02
xor r8d, 0x9cf46df2
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x38]
mov byte [rdx + rcx], 0
add rcx, 1
mov qword [rsp + 0x28], rcx
cmp eax, 0xa9b4515
ja 0x1400af857
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
jmp 0x1400af795
mov r8d, dword [0x1402051e0]
mov edx, dword [0x1402051e4]
xor edx, 0x5bcbfe38
mov eax, r8d
xor eax, 0xffffffff
mov ecx, 0xefe595e7
xor ecx, 0xbcd188cf
and ecx, eax
mov r9d, 0xaed58740
xor r9d, 0xfde19a68
mov eax, 0x29708d03
xor eax, 0xd68f72fc
xor r9d, eax
and r8d, r9d
mov r10d, 0xa78506e5
xor r10d, 0x587af91a
mov eax, edx
xor eax, r10d
and eax, 0x53341d28
and edx, r9d
or ecx, r8d
or eax, edx
xor ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xae572650
xor edx, 0x51a8d9af
xor ecx, edx
or eax, ecx
mov ecx, 0xea3d5c43
xor ecx, 0x5840015d
mov edx, 0x55796bc8
xor edx, 0xe70436d6
and ecx, edx
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0x9b326fce
xor edx, edx
div ecx
xor eax, 0x3a1c90be
cmp eax, 0x4c8c9c96
jae 0x1400afa26
mov eax, dword [0x1402051e8]
mov ecx, dword [0x1402051ec]
xor ecx, 0x8dd375df
sub eax, ecx
mov ecx, 0x171332f8
xor ecx, 0x171332f8
sub ecx, eax
xor eax, eax
sub eax, 0x8f16e95b
add ecx, eax
mov eax, 0x473ff99f
xor eax, 0x473ff99f
sub eax, ecx
mov ecx, 0x26aff6c9
xor ecx, 0x3fd66f6d
or eax, ecx
imul eax, eax, 0x7bc76a1b
cmp eax, 0xe38b5029
jb 0x1400af9c4
add rsp, 0x48
ret
call 0x129f6036c
xor esi, edi
invalid
rcl ebp, 1
mov bl, 0xac
jmp 0x1400af9c4
Function at 0x1400b0a10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140205250]
mov ecx, dword [0x140205254]
xor ecx, 0x76d483a0
imul eax, ecx
sub eax, 0x36343473
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0xc7c8a335
xor edx, 0xddad3b59
and edx, ecx
mov r8d, 0xffffffff
xor r8d, 0x1a65986c
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0xd5de0e4f
xor r8d, 0xcfbb9623
mov edx, eax
and edx, r8d
mov r8d, 0x2041edc1
xor r8d, 0x3a2475ad
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xd807ea4c
xor ecx, 0xd94dfb17
xor eax, ecx
cmp eax, 0xc9a0fd07
jae 0x1400b0af1
mov eax, dword [0x140205258]
mov ecx, 0x1e77c52c
xor ecx, 0x5e7516a8
xor eax, ecx
sub eax, dword [0x14020525c]
add eax, 0x4a207260
sub eax, 0xec09c617
mov ecx, 0xdaed3e62
xor ecx, 0x911fc27f
add eax, ecx
mov dword [rsp + 0x20], eax
call fcn.1400b0750
call qword [0x140227320]
mov ecx, eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], ecx
cmp eax, 0xc527b416
jae 0x1400b0a94
mov eax, dword [rsp + 0x24]
add rsp, 0x28
ret
invalid
Function at 0x1400b45d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rdx
mov rax, rcx
movabs rcx, 0xf41ad6f85dc9181d
movabs rdx, 0xf41ad6f85dc9181f
xor rcx, rdx
mov rdx, rax
shl rdx, cl
mov qword [rsp + 0x40], rdx
mov rcx, rdx
cvtsi2sd xmm0, rax
movsd xmm1, qword [0x1402155c8]
mulsd xmm0, xmm1
movsd qword [rsp + 0x48], xmm0
cvtsi2sd xmm1, rcx
movsd qword [rsp + 0x50], xmm1
ucomisd xmm0, xmm1
jne 0x1400b4638
jp 0x1400b4638
jmp 0x1400b4683
movsd xmm1, qword [rsp + 0x48]
movsd xmm0, qword [rsp + 0x50]
subsd xmm0, xmm1
call fcn.1401ffc90
movaps xmm1, xmm0
movsd xmm0, qword [rsp + 0x48]
movsd qword [rsp + 0x28], xmm1
call fcn.1401ffc90
movsd xmm1, qword [rsp + 0x28]
movsd xmm2, qword [0x1402155d0]
mulsd xmm1, xmm2
mov al, 1
ucomisd xmm0, xmm1
mov byte [rsp + 0x37], al
jb 0x1400b470c
mov eax, dword [0x140205378]
sub eax, dword [0x14020537c]
add eax, 0xee1ac106
or eax, 0x37e309f6
mov ecx, 0x34673d9a
xor ecx, 0xbe606be0
add eax, ecx
mov ecx, 0xd980226d
xor ecx, 0x2734304c
cmp eax, ecx
je 0x1400b471a
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
mov eax, dword [0x140205380]
mov ecx, 0xb02b119d
xor ecx, 0x127b4e3b
xor eax, ecx
or eax, dword [0x140205384]
or eax, 0x92c58f59
and eax, 0xa2331719
or eax, 0xa3759965
mov ecx, 0x602f181f
xor ecx, 0x979c9673
mov qword [rdx], r8
cmp eax, ecx
ja 0x1400b46b9
xor eax, eax
mov byte [rsp + 0x37], al
jmp 0x1400b470c
mov al, byte [rsp + 0x37]
and al, 1
movzx eax, al
add rsp, 0x58
ret
mov esi, 0xe9a9084c
xchg esi, eax
invalid
Function at 0x1400bad60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
call fcn.1400d0c99
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x58], rax
add rax, 0x50
mov qword [rsp + 0x50], rax
mov rax, qword [rdx]
mov qword [rsp + 0x78], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x78]
call fcn.1400be28b
mov rcx, rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rcx
mov al, byte [rax + 0x50]
mov cl, 0xea
xor cl, 0xea
cmp al, cl
jne 0x1400baf9e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax]
mov qword [rsp + 0x68], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x68]
call fcn.1400bded0
mov rcx, rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rcx
mov al, byte [rax]
mov cl, 0x82
xor cl, 0x82
cmp al, cl
jne 0x1400baf9e
mov rax, qword [rsp + 0x30]
cmp rax, 0
jge 0x1400baf8a
mov eax, dword [0x1402055d0]
mov ecx, 0xf908fe08
xor ecx, 0x9978e0b2
xor eax, ecx
mov r8d, dword [0x1402055d4]
xor r8d, 0x8f8d3bbd
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov ecx, 0xac2d2653
xor ecx, 0x53d2d9ac
mov r9d, r8d
xor r9d, ecx
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
and eax, eax
xor eax, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x4fd8aa0c
mov edx, 0x83551a7e
xor edx, 0xcc8db072
mov r8d, 0x8fb7eaaf
xor r8d, 0x70481550
xor edx, r8d
or ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
and eax, eax
xor eax, 0xffffffff
mov ecx, 0x952d9661
xor ecx, 0x5a75b13e
mov edx, 0x643fa9a6
xor edx, 0xab678ef9
and ecx, edx
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0xb216a59d
xor ecx, 0x4de95a62
xor eax, ecx
mov ecx, eax
xor ecx, 0xf033428e
mov edx, 0xffffffff
xor edx, 0xf033428e
and eax, edx
shl eax, 1
sub eax, ecx
cmp eax, 0x6ad3b430
jb 0x1400bafab
mov rcx, qword [rsp + 0x30]
mov edx, dword [0x1402055d8]
mov r8d, dword [0x1402055dc]
mov eax, 0xe4378b46
xor eax, 0x1bc874b9
mov r9d, edx
xor r9d, eax
mov eax, r8d
and eax, r9d
mov r9d, 0x9863d36b
xor r9d, 0x679c2c94
xor r8d, r9d
and edx, r8d
or eax, edx
mov r8d, 0x802f49a
xor edx, edx
div r8d
mov edx, 0x539b5847
xor edx, 0x44005b54
sub eax, edx
mov edx, 0x24e3a131
xor edx, 0x465f499e
and eax, edx
mov dword [rsp + 0x2c], eax
mov eax, 0xf87766b7
xor eax, 0x341e49fa
mov dword [rsp + 0x28], eax
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
call fcn.14000dc65
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
ja 0x1400baeee
jmp 0x1400baf9e
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
call fcn.1400a179e
mov rax, qword [rsp + 0x40]
add rsp, 0x88
ret
sbb al, byte [rax + 0x3ae93399]
invalid
Function at 0x1400d2330
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x58], rcx
call fcn.1400d3edd
mov rcx, qword [rsp + 0x58]
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x67], al
je 0x1400d254e
mov eax, dword [0x140205fc8]
mov edx, dword [0x140205fcc]
mov ecx, edx
and ecx, eax
mov r8d, 0x34401592
xor r8d, 0xcbbfea6d
xor ecx, r8d
add eax, edx
add eax, 1
add eax, ecx
mov ecx, 0x80d9569a
xor edx, edx
div ecx
mov ecx, eax
mov edx, 0x497d7145
xor edx, 0x447ed42
mov eax, ecx
and eax, edx
or ecx, 0x4d3a9c07
add eax, ecx
mov ecx, 0xafc123c4
xor ecx, 0x26c4b2f2
add eax, ecx
cmp eax, 0xae90f7e8
je 0x1400d2561
mov edx, dword [0x140205fd0]
xor edx, 0x3396a7c9
mov eax, dword [0x140205fd4]
xor eax, 0x6a8231fa
or edx, eax
mov eax, 0xc6a3a048
xor eax, 0x9fb9acee
mov ecx, edx
xor ecx, eax
mov eax, 0x86b0e88b
xor eax, 0xdfaae42d
mov r8d, 0x33dd79f7
xor r8d, 0xcc228608
xor eax, r8d
and edx, eax
mov eax, 0x402b0014
xor eax, 0x402b0016
imul eax, edx
sub eax, ecx
mov ecx, 0x2bfe2e73
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x58]
mov ecx, 0x162528f
xor ecx, 0xc14f13cc
mov r8d, 0xdde51f85
xor r8d, 0x221ae07a
xor ecx, r8d
xor r8d, r8d
sub r8d, 1
sub ecx, r8d
sub eax, ecx
mov ecx, 0xa4688561
xor ecx, 0xa8e8be4b
mov r8, rdx
add r8, 0xfffffffffffffff0
mov qword [rsp + 0x40], r8
mov rdx, qword [rdx - 0x10]
mov qword [rsp + 0x48], rdx
movabs r8, 0xe97d294c34374043
movabs r9, 0xe97d294c34374053
xor r8, r9
cmp rdx, r8
setb dl
mov byte [rsp + 0x57], dl
cmp eax, ecx
je 0x1400d23b4
mov cl, byte [rsp + 0x57]
mov al, 1
test cl, 1
mov byte [rsp + 0x3f], al
jne 0x1400d2523
jmp 0x1400d249c
mov rdx, qword [rsp + 0x48]
movabs rcx, 0x21171e17f9c7409a
mov rax, rdx
sub rax, rcx
add rax, 0xfffffffffffffff0
movabs rcx, 0x21171e17f9c7409a
add rax, rcx
mov qword [rsp + 0x30], rax
mov rcx, rax
xor rcx, rdx
movabs rdx, 0xdcd0d548e70b5c26
movabs r8, 0xdcd0d548e70b5c26
xor rdx, r8
cmp rcx, rdx
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x1400d2500
jmp 0x1400d2510
call fcn.140007f57
xor eax, eax
mov byte [rsp + 0x67], al
jmp 0x1400d254e
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x3f], al
mov rdx, qword [rsp + 0x40]
mov cl, byte [rsp + 0x57]
mov rax, qword [rsp + 0x58]
mov r8b, byte [rsp + 0x3f]
mov byte [rsp + 0x2f], r8b
mov r8, qword [rax]
and cl, 1
call fcn.140010de9
mov al, byte [rsp + 0x2f]
mov byte [rsp + 0x67], al
mov al, byte [rsp + 0x67]
cmp al, 0
setne al
and al, 1
movzx eax, al
add rsp, 0x68
ret
jmp 0x1400d23b4
Function at 0x1400db000
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x57], al
je 0x1400db29c
mov eax, dword [0x140206330]
sub eax, dword [0x140206334]
imul r8d, eax, 0xcd4ea86d
mov eax, r8d
xor eax, 0xc6629029
xor eax, 0xffffffff
mov ecx, 0x5bcbfe38
xor ecx, 0x9da96e11
or r8d, ecx
and r8d, eax
mov eax, 0xefe595e7
xor eax, 0x101a6a18
mov ecx, r8d
xor ecx, eax
mov eax, 0xaed58740
xor eax, 0x41bb056f
and eax, ecx
mov r9d, 0xffffffff
xor r9d, 0xef6e822f
and r8d, r9d
mov ecx, 0xa78506e5
xor ecx, 0xc366a9d1
mov edx, 0xaafd0dbd
xor edx, 0x5502f242
xor ecx, edx
and ecx, 0xef6e822f
mov edx, 0xc1072e51
xor edx, 0xa5e48165
and edx, r9d
or eax, r8d
or ecx, edx
xor eax, ecx
cmp eax, 0x3937051
je 0x1400db2aa
mov rcx, qword [rsp + 0x48]
mov eax, dword [0x140206338]
xor eax, 0x55796bc8
mov edx, dword [0x14020633c]
xor edx, 0x440d521a
add eax, 0xf62e9268
sub eax, edx
sub eax, 0xf62e9268
or eax, 0x45f9a928
mov edx, 0x8dd375df
xor edx, 0x66300022
add eax, edx
and eax, 0xa8a4a6e0
movabs rdx, 0xab482af231ea69fc
sub rcx, rdx
add rcx, 0xfffffffffffffff0
movabs rdx, 0xab482af231ea69fc
add rcx, rdx
mov qword [rsp + 0x30], rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x38], rcx
movabs rdx, 0xadc6f2eb26aff6c9
movabs r8, 0xadc6f2eb26aff6d9
xor rdx, r8
cmp rcx, rdx
setb cl
mov byte [rsp + 0x47], cl
cmp eax, 0x9484b24d
jbe 0x1400db0b1
mov cl, byte [rsp + 0x47]
mov al, 1
test cl, 1
mov byte [rsp + 0x57], al
jne 0x1400db29c
jmp 0x1400db15f
mov r8, qword [rsp + 0x38]
movabs rcx, 0x5a282ac948252218
movabs rax, 0x5a282ac948252218
xor rcx, rax
sub rcx, r8
movabs rax, 0x4a2072602cc88cf9
movabs rdx, 0x4a2072602cc88cf9
xor rax, rdx
movabs rdx, 0x1ee609bab3818a6b
movabs r9, 0xe119f6454c7e759b
xor rdx, r9
sub rax, rdx
add rcx, rax
movabs rax, 0x4bf2fc1d018ec43a
movabs rdx, 0x4bf2fc1d018ec43a
xor rax, rdx
sub rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, 0xffffffffffffffff
movabs rdx, 0xe330a6fa5003d45d
and rcx, rdx
movabs r10, 0x7ed5fa58088d2db8
movabs rdx, 0x9de55ca2588ef9e5
xor r10, rdx
movabs rdx, 0xbea67e0a566bcef9
movabs r9, 0x415981f5a9943106
xor rdx, r9
xor r10, rdx
mov r9, rax
and r9, r10
mov rdx, r8
xor rdx, 0xffffffffffffffff
movabs r11, 0xe330a6fa5003d45d
and rdx, r11
and r8, r10
or rcx, r9
or rdx, r8
xor rcx, rdx
cmp rcx, 0
setl dl
movabs rcx, 0xccd62d13dfd474cd
movabs r8, 0x3329d2ec202b8b32
xor rcx, r8
cmp rax, rcx
setg cl
xor eax, eax
xor al, 1
xor dl, al
mov al, cl
xor al, dl
and al, cl
test al, 1
jne 0x1400db279
jmp 0x1400db289
call fcn.140007f57
xor eax, eax
mov byte [rsp + 0x57], al
jmp 0x1400db29c
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x57], al
mov al, byte [rsp + 0x57]
and al, 1
movzx eax, al
add rsp, 0x58
ret
call 0x12a021f2b
invalid
Function at 0x1400dcdb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x140206440]
sub eax, dword [0x140206444]
imul eax, eax, 0xe190f0cb
mov ecx, 0x99e43614
xor ecx, 0x74664296
mov edx, 0x1c06816c
xor edx, 0xe3f97e93
xor ecx, edx
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
xor eax, 0xefd58b89
cmp eax, 0x18fdf10c
jb 0x1400dcf49
mov rcx, qword [rsp + 0x30]
mov r9d, dword [0x140206448]
mov r8d, dword [0x14020644c]
mov eax, r9d
xor eax, 0xffffffff
mov edx, r8d
and edx, eax
mov r10d, r8d
xor r10d, 0xffffffff
mov eax, r9d
and eax, r10d
imul eax, edx
mov edx, r9d
and edx, r8d
or r9d, r8d
imul r9d, edx
add r9d, eax
sub r9d, 0xd90172b7
and r9d, 0xc383b41c
mov eax, r9d
xor eax, 0xffffffff
and eax, 0xf65329e4
mov r8d, 0xffffffff
xor r8d, 0xf65329e4
and r9d, r8d
mov edx, 0xffffffff
xor edx, 0xbe99ce0d
mov r10d, 0xb10308fc
xor r10d, 0x47502118
and edx, r10d
and r8d, 0xbe99ce0d
or eax, r9d
or edx, r8d
xor eax, edx
cmp rcx, 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0xd7b57553
je 0x1400dcdfc
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1400dcebe
jmp 0x1400dceb4
mov rcx, qword [rsp + 0x30]
call fcn.1400dc9f0
mov eax, dword [0x140206450]
sub eax, dword [0x140206454]
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
mov edx, 0x1d7d7a0a
xor edx, 0xe862a4fd
or eax, edx
add eax, ecx
xor eax, 0xcc3ce37b
mov ecx, 0xe358eb12
xor edx, edx
div ecx
mov ecx, 0x7805324b
xor ecx, 0x35f8c152
cmp eax, ecx
ja 0x1400dcf52
mov eax, dword [0x140206458]
xor edx, edx
div dword [0x14020645c]
mov ecx, 0xf167ceee
xor ecx, 0xd67f9e49
xor eax, ecx
mov ecx, eax
and ecx, 0x3314d58d
shl ecx, 1
xor eax, 0x3314d58d
add eax, ecx
add eax, 0x5ed24de7
cmp eax, 0xfe0baf97
jae 0x1400dcf02
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
int 0xbf
mov r8b, 0xe9
stosb byte [rdi], al
invalid
cmp rax, 0xffffffffa7e9fcaa
invalid
Function at 0x1400dfc60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
xor eax, eax
test r8, r8
cmovg rax, r8
mov qword [rsp + 0x20], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 8], rax
cmp rax, rcx
je 0x1400dfd8f
mov eax, dword [0x140206580]
mov edx, dword [0x140206584]
mov ecx, eax
and ecx, edx
shl ecx, 1
xor eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0xcbc7be1a
mov edx, 0x55a37b76
xor edx, 0x9e64c56c
mov r8d, 0xee7e9c79
xor r8d, 0x11816386
xor edx, r8d
and eax, edx
sub eax, ecx
mov edx, 0xffffffff
xor edx, 0x23ca68fa
mov ecx, eax
and ecx, edx
mov r8d, 0x2eebdc11
xor r8d, 0xd21b4eb
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
mov ecx, 0xe6327168
xor ecx, 0x10b4aba0
xor edx, edx
div ecx
mov ecx, 0xb71894ec
xor ecx, 0xbb69981e
cmp eax, ecx
ja 0x1400dfd94
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x18]
mov r8, qword [rsp + 0x10]
mov r9d, dword [0x140206588]
mov r10d, dword [0x14020658c]
mov eax, r9d
and eax, r10d
xor r9d, r10d
or eax, r9d
mov r9d, 0x3fd91181
xor r9d, 0x63e40d9f
xor eax, r9d
xor eax, 0x29cd6aab
sub eax, 0x16c4f9b1
mov r8b, byte [r8 + rcx]
mov byte [rdx + rcx], r8b
add rcx, 1
mov qword [rsp], rcx
cmp eax, 0xa673f5ba
jae 0x1400dfd23
mov rax, qword [rsp]
mov qword [rsp + 0x28], rax
jmp 0x1400dfc83
add rsp, 0x30
ret
cwde
rcr dword ds:[rdx - 0x7917], 0xff
nop dword [rax]
Function at 0x1400e6930
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rax, rdx
add rax, 0xffffffffffffffff
mov qword [rsp + 0x40], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl dl
cmp rax, 0xffffffffffffffff
setg cl
mov al, cl
xor al, 0xff
mov r8b, dl
xor r8b, 0xff
or al, r8b
xor r8d, r8d
xor r8b, 1
xor cl, r8b
xor dl, 0xff
or cl, dl
and al, cl
mov cl, 1
xor cl, 0
xor al, cl
test al, 1
jne 0x1400e6991
jmp 0x1400e699b
call fcn.140007f57
jmp 0x1400e6a75
mov eax, dword [0x1402067b0]
xor edx, edx
div dword [str.vaqXt]
mov ecx, 0xde7eb225
xor ecx, 0xdd5f235a
xor edx, edx
div ecx
mov ecx, 0x40116e40
xor ecx, 0xd638448
xor edx, edx
div ecx
add eax, 0xffac9d09
mov ecx, 0x8e32e6da
xor ecx, 0x2411e507
sub eax, ecx
sub eax, 0xffac9d09
mov ecx, 0xbb223bb2
xor ecx, 0x781cadf3
cmp eax, ecx
je 0x1400e6a7f
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1402067b8]
mov edx, dword [0x1402067bc]
xor edx, 0x8d3d3903
xor eax, edx
add eax, 0x9fa15871
mov r8d, 0x7b08efd
xor r8d, 0x99a1e852
xor edx, edx
div r8d
xor eax, 0x9d2a4afa
cmp rcx, 0
setg cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x7227ae51
je 0x1400e69f1
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1400e6a5f
jmp 0x1400e6a4d
mov rdx, qword [rsp + 0x40]
mov rcx, rdx
call fcn.140014583
jmp 0x1400e6a75
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
imul rcx, rcx, 0x38
add rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
add rsp, 0x48
ret
iretd
Function at 0x1400f27c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
call fcn.1400dd554
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
cmp rcx, 0
jne 0x1400f2850
mov word [rsp + 0x66], 0x522
lea rcx, [rsp + 0x66]
call fcn.140065e50
mov rcx, rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rcx
mov al, byte [rax]
mov cl, 0xa7
xor cl, 0xa7
cmp al, cl
jne 0x1400f284b
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax]
call fcn.14001c110
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rax]
mov qword [rsp + 0x50], rdx
mov rax, qword [rax + 8]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
call fcn.1400eb850
jmp 0x1400f2955
mov ecx, dword [0x140206c90]
or ecx, dword [0x140206c94]
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x2cd9f0e7
mov edx, 0x97ec4881
xor edx, 0xbb35b866
mov r8d, 0xc5265b9d
xor r8d, 0x3ad9a462
xor edx, r8d
or ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
add eax, 0x4aed4b2b
mov edx, 0xffffffff
xor edx, 0x32d91482
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0x32d91482
add eax, edx
sub eax, ecx
cmp eax, 0xe4d81659
jae 0x1400f295a
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x140206c98]
xor eax, 0x276291cd
xor eax, dword [0x140206c9c]
mov r8d, 0x28ada5bb
xor r8d, 0x28ada5bb
sub r8d, eax
xor eax, eax
sub eax, 0xf20d8de0
add r8d, eax
mov eax, 0x88e25841
xor eax, 0x88e25841
sub eax, r8d
sub eax, 0x6aaa90c7
mov r8d, 0x46e7f581
xor r8d, 0xf83f9da0
add eax, r8d
mov r8d, 0xa8f120f9
xor r8d, 0xc25bb03e
add eax, r8d
mov r8d, 0x2def554d
xor r8d, 0x6259a847
xor eax, r8d
mov dword [rsp + 0x2c], eax
call fcn.1400f18e0
mov eax, dword [rsp + 0x2c]
cmp eax, 0x4af3d379
jbe 0x1400f28c1
jmp 0x1400f2955
add rsp, 0x68
ret
jo 0x1400f298f
invalid
or byte [rax], al
add byte [rax], al
add al, ch
invalid
Function at 0x1400f57b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x80
mov qword [rsp + 0x68], rcx