joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010e500
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x34], ecx
sub ecx, 0xc0000034
je 0x14010e52d
jmp 0x14010e519
mov eax, dword [rsp + 0x34]
sub eax, 0xc000003a
jne 0x14010e5cc
jmp 0x14010e52d
movabs rcx, 0x49b3434216230033
movabs rax, 0x49b343421623007b
xor rcx, rax
movabs rdx, 0x1b83aba083a9ad9c
movabs rax, 0x1b83aba083a9ad94
xor rdx, rax
call fcn.140029060
mov rcx, rax
mov rax, qword [0x14028cfa0]
mov qword [rcx], rax
lea rax, [0x14028a157]
mov qword [rcx + 0x10], rax
mov rax, qword [0x14028a308]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14028a310]
mov qword [rcx + 0x20], rax
mov qword [rcx + 8], 0
movabs rax, 0x3ecb17fc1b0b1399
movabs rdx, 0x3ecb17fc60e8c0e6
xor rax, rdx
lea rdx, [0x14028a157]
lea r8, [0x14028a16b]
lea r9, [0x14028a0c3]
mov qword [rsp + 0x20], rax
call fcn.140028fa8
mov eax, dword [0x140279850]
mov edx, dword [0x140279854]
mov ecx, eax
xor ecx, 0xffffffff
mov r9d, 0xcff23b91
xor r9d, 0x300dc46e
mov r8d, edx
xor r8d, r9d
and ecx, r8d
or eax, edx
xor eax, 0xffffffff
or ecx, eax
mov eax, 0xc7dd006c
xor eax, 0x3822ff93
xor ecx, eax
and ecx, 0x45206c8c
mov eax, ecx
xor eax, 0xffffffff
and eax, 0xc44b5d0a
mov edx, 0xffffffff
xor edx, 0xc44b5d0a
and ecx, edx
or eax, ecx
mov r8d, 0x51b9efdf
xor r8d, 0x8dd95596
mov ecx, 0xf720ce56
xor ecx, 0x8df31a9
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xdc60ba49
mov r8d, 0x8fca7807
xor r8d, 0x53aac24e
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x3a48c28d
xor ecx, 0x77c16a08
cmp eax, ecx
jb 0x14010e6c7
mov eax, dword [0x140279858]
xor edx, edx
div dword [0x14027985c]
mov ecx, 0xe0c2768
xor ecx, 0xc41b4a0d
add eax, ecx
sub eax, 0xf30928a8
add eax, 0x7b73fda8
add eax, 0xf30928a8
mov ecx, 0xe13ec24e
xor ecx, 0x34e55561
xor eax, ecx
cmp eax, 0x52e12e54
je 0x14010e680
add rsp, 0x38
ret
sahf
imul edi, dword [rbx], 0xffb0e917
invalid
Function at 0x140113e7d
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140028560
Function at 0x14011b840
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], rcx
mov eax, dword [0x140279df0]
xor eax, 0xdb2a7e41
mov r8d, dword [0x140279df4]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x4e05bc71
xor ecx, 0x476cddd
xor edx, edx
div ecx
mov ecx, 0x5ae36781
xor ecx, 0x3c109473
xor edx, edx
div ecx
mov ecx, 0x2efce5bc
xor ecx, 0x12fd6aa4
xor edx, edx
div ecx
cmp eax, 0xb583cabf
je 0x14011ba0e
mov ecx, dword [0x140279df8]
mov eax, ecx
xor eax, 0x69cc2832
mov r8d, dword [0x140279dfc]
xor ecx, 0x9633d7cd
mov edx, r8d
and edx, ecx
mov r9d, r8d
not r9d
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x981c2e65
imul rax, rcx
shr rax, 0x3d
imul ecx, eax, 0x31466f9c
mov eax, ecx
xor eax, 0x35442648
and eax, ecx
mov dword [rbp - 0x20], eax
mov eax, 0x10
call fcn.140271bb0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000efc9
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov rax, qword [rbp - 0x28]
mov rdx, qword [rcx]
mov qword [rax], rdx
mov rdx, qword [rcx + 8]
mov qword [rax + 8], rdx
sub rsp, 0x20
call fcn.140020530
mov rcx, qword [rbp - 0x28]
add rsp, 0x20
xor edx, edx
sub rsp, 0x20
call fcn.140109660
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov dl, al
mov eax, dword [rbp - 0x20]
mov byte [rbp - 0x19], dl
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x18], rcx
cmp rcx, 0
sete cl
mov byte [rbp - 9], cl
cmp eax, 0x525e2679
je 0x14011b8bc
mov al, byte [rbp - 9]
test al, 1
jne 0x14011ba01
jmp 0x14011b9ae
mov rax, qword [rbp - 0x18]
mov rax, qword [rax]
movabs rdx, 0xace2607bd0de92a4
movabs rcx, 0xace2607bd0de92a5
xor rdx, rcx
mov rcx, rax
add rcx, rdx
xor rax, 0xffffffffffffffff
movabs rdx, 0x4000000000000000
or rax, rdx
add rax, rcx
cmp rax, 0
jne 0x14011ba01
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call fcn.14001d1d6
add rsp, 0x20
mov al, byte [rbp - 0x19]
and al, 1
movzx eax, al
mov rsp, rbp
pop rbp
ret
xchg dword [rsi + rbp - 0x15a1657], edx
invalid
Function at 0x14011be70
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov qword [rsp + 0x48], rcx
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, qword [rsp + 0x48]
cmp rcx, 0
je 0x14011c102
mov rax, qword [rsp + 0x48]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x38], rcx
mov rax, qword [rax - 0x10]
mov qword [rsp + 0x40], rax
cmp rax, 0x10
jb 0x14011c036
mov eax, dword [0x140279e20]
xor eax, 0xd51fbf6c
sub eax, dword [0x140279e24]
xor eax, 0xb9bd3512
mov ecx, 0x1615a922
xor ecx, 0xa256b48e
add eax, ecx
add eax, 0xd34f3610
cmp eax, 0xfccc159
je 0x14011c108
mov r9, qword [rsp + 0x40]
mov ecx, dword [0x140279e28]
mov eax, dword [0x140279e2c]
mov edx, 0x6126eb29
xor edx, 0x98fd1f7f
xor eax, edx
add ecx, eax
and ecx, 0x887bc23f
mov eax, ecx
and eax, 0x36f6a5ef
shl eax, 1
xor ecx, 0x36f6a5ef
add ecx, eax
mov edx, ecx
xor edx, 0xffffffff
mov eax, 0x98266997
xor eax, 0xf098cd82
and eax, edx
mov edx, 0xffffffff
xor edx, 0x68bea415
and ecx, edx
or eax, ecx
mov rcx, r9
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x28], rcx
movabs r8, 0xb14ebb4a49632c6
movabs rdx, 0xf4eb144b5b69cd39
xor r8, rdx
mov rdx, rcx
xor rdx, r8
movabs r8, 0xc31b402f69ad582a
and rdx, r8
movabs r11, 0x4b2e93c81d8b5da7
movabs r8, 0x8835d3e77426058d
xor r11, r8
movabs r8, 0xd98a3d11c6f6729a
movabs r10, 0x2675c2ee39098d65
xor r8, r10
xor r11, r8
mov r10, rcx
and r10, r11
mov r8, r9
xor r8, 0xffffffffffffffff
movabs rsi, 0xc31b402f69ad582a
and r8, rsi
and r9, r11
or rdx, r10
or r8, r9
xor rdx, r8
cmp rdx, 0
setl dl
cmp rcx, 0xffffffffffffffff
setg cl
and cl, dl
mov byte [rsp + 0x37], cl
cmp eax, 0xbae82486
ja 0x14011c108
mov al, byte [rsp + 0x37]
test al, 1
jne 0x14011c003
jmp 0x14011c00d
call fcn.14000f24b
jmp 0x14011c102
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov r8, qword [rax]
xor eax, eax
mov cl, al
xor cl, 0
and cl, 1
call fcn.1400200e0
jmp 0x14011c102
mov eax, dword [0x140279e30]
xor eax, 0x5aa46014
mov ecx, dword [0x140279e34]
xor ecx, 0x2bc3ba45
xor edx, edx
div ecx
mov ecx, eax
sub ecx, 0x8d630a7e
sub ecx, 0x89284c61
mov eax, 0x1a18aa6e
xor eax, 0x977ba010
add ecx, eax
mov edx, 0xecbd37f1
xor edx, 0x98de6aaf
mov eax, ecx
and eax, edx
xor ecx, 0x74635d5e
or eax, ecx
and eax, 0xc1f05194
mov ecx, 0xac75431a
xor ecx, 0x1ca138c1
cmp eax, ecx
je 0x14011c111
mov eax, dword [0x140279e38]
mov ecx, dword [0x140279e3c]
xor ecx, 0x16a0b79
sub eax, ecx
and eax, 0x57b40a3d
sub eax, 0xec410d52
mov ecx, 0xb6d7987a
xor ecx, 0x4a958129
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x38]
mov ecx, eax
mov rax, qword [rsp + 0x48]
mov dword [rsp + 0x24], ecx
mov r8, qword [rax]
mov ecx, 1
call fcn.1400200e0
mov rcx, qword [rsp + 0x48]
call fcn.140020296
mov eax, dword [rsp + 0x24]
cmp eax, 0x331fbba9
je 0x14011c09a
jmp 0x14011c102
add rsp, 0x50
pop rsi
ret
invalid
invalid
Function at 0x14011c120
Capabilities:
Encode data using xor

Disassembly:
push rax
mov qword [rsp], rcx
mov ecx, dword [0x140279e40]
add ecx, dword [0x140279e44]
mov eax, ecx
and eax, 0x3190a410
shl eax, 1
mov edx, 0xd19e6234
xor edx, 0xe00ec624
xor ecx, edx
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xb0c6a7b6
xor edx, 0x4f395849
xor ecx, edx
or eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x7883ef26
mov edx, 0xffffffff
xor edx, 0x7883ef26
or ecx, edx
xor eax, 0xffffffff
mov edx, 0x6bf63d7d
xor edx, 0x9409c282
xor ecx, edx
or eax, ecx
mov ecx, 0x66ed055e
xor ecx, 0x7f4e669f
add eax, ecx
cmp eax, 0x4132697
jb 0x14011c219
mov eax, dword [0x140279e48]
mov ecx, dword [0x140279e4c]
xor ecx, 0xf471b01a
mov edx, 0x7e80299a
xor edx, 0x817fd665
xor ecx, edx
add eax, ecx
add eax, 1
xor eax, 0x9a4d37c6
mov ecx, eax
and ecx, 0x32e96470
mov edx, 0x86043804
xor edx, 0x79fbc7fb
xor ecx, edx
mov edx, 0x9686b45d
xor edx, 0xa46fd02d
add eax, edx
add eax, 1
add eax, ecx
mov ecx, 0xceaa4472
xor edx, edx
div ecx
mov rdx, qword [rsp]
mov ecx, 0xfc5005c9
xor ecx, 0x65355e95
mov qword [rdx], 0
cmp eax, ecx
je 0x14011c1a0
pop rax
ret
and al, 0x14
or byte [rdx - 0x8117], bh
jmp qword [rsi + 0x66]
Function at 0x140120030
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov byte [rsp + 0x2f], r8b
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x34], ecx
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov ecx, dword [rsp + 0x34]
add rax, 0x60
mov qword [rsp + 0x38], rax
xor eax, eax
mov byte [rsp + 0x46], al
sub ecx, 0xc0000034
mov byte [rsp + 0x47], al
je 0x140120232
jmp 0x140120077
mov al, byte [rsp + 0x46]
mov ecx, dword [rsp + 0x34]
sub ecx, 0xc000003a
mov byte [rsp + 0x47], al
je 0x140120232
jmp 0x140120094
mov ecx, dword [rsp + 0x34]
mov rax, qword [0x14028a200]
mov qword [rsp + 0x48], rax
mov rax, qword [0x14028a208]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
call fcn.1400f0ce0
mov rcx, qword [rsp + 0x38]
xor eax, eax
cmp byte [rcx], 0
mov byte [rsp + 0x47], al
jne 0x140120232
mov al, byte [rsp + 0x2f]
xor ecx, ecx
mov byte [rsp + 0x2e], cl
test al, al
je 0x1401200ff
jmp 0x1401200e5
mov al, byte [rsp + 0x2e]
mov cl, byte [rsp + 0x2f]
sub cl, 1
mov byte [rsp + 0x47], al
je 0x1401201ba
jmp 0x140120232
mov eax, dword [0x14027a010]
mov ecx, 0x9ef45506
xor ecx, 0xc1044499
xor eax, ecx
mov edx, dword [0x14027a014]
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
or eax, edx
and eax, ecx
sub eax, 0x5e0589d2
sub eax, 0xcd2d96cd
mov ecx, 0xeb359a08
xor ecx, 0xb53013da
add eax, ecx
mov ecx, 0xbba35700
xor ecx, 0x974f131
sub eax, ecx
mov ecx, 0xd881971c
xor edx, edx
div ecx
mov ecx, 0x6f488102
xor ecx, 0xf8dbe3d3
cmp eax, ecx
jae 0x140120240
mov ecx, dword [rsp + 0x30]
mov eax, dword [0x14027a018]
mov edx, dword [0x14027a01c]
imul eax, edx
add eax, 0x275258c7
mov dword [rsp + 0x28], eax
and ecx, 0x10
call fcn.1400e7c9c
mov rcx, qword [rsp + 0x38]
mov dl, al
mov eax, dword [rsp + 0x28]
mov cl, byte [rcx]
test cl, cl
sete cl
xor dl, 1
and cl, dl
mov byte [rsp + 0x2d], cl
cmp eax, 0x90833b37
ja 0x140120163
mov al, byte [rsp + 0x2d]
mov byte [rsp + 0x47], al
jmp 0x140120232
mov ecx, dword [rsp + 0x30]
and ecx, 0x10
call fcn.1400e7c9c
mov dl, al
mov rax, qword [rsp + 0x38]
mov al, byte [rax]
mov cl, dl
xor cl, 1
movzx r8d, cl
shl r8d, 3
test al, al
sete cl
mov eax, 4
cmove eax, r8d
mov dword [rsp + 0x20], eax
and cl, dl
mov byte [rsp + 0x27], cl
sub eax, 4
je 0x140120227
jmp 0x140120202
mov al, byte [rsp + 0x27]
mov ecx, dword [rsp + 0x20]
sub ecx, 8
mov byte [rsp + 0x47], al
jne 0x140120232
jmp 0x14012021c
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x140120232
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x140120232
mov al, byte [rsp + 0x47]
and al, 1
movzx eax, al
add rsp, 0x58
ret
or eax, 0xe977af6b
sbb bh, bh
invalid
Function at 0x140122980
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x48], rcx
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, qword [rsp + 0x48]
Function at 0x140124f00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x68], rcx
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, qword [rsp + 0x68]
add rax, 0x60
mov qword [rsp + 0x70], rax
mov rax, qword [rcx]
movabs rcx, 0xc8eb7d42bd2b21d8
movabs rdx, 0xc8eb7d42bd2b21d8
xor rcx, rdx
cmp rax, rcx
jle 0x140125168
mov eax, dword [0x14027a218]
xor edx, edx
div dword [0x14027a21c]
mov ecx, 0x9e89f4f4
xor ecx, 0xbd7672fd
imul eax, ecx
mov ecx, 0x1d3f22f1
xor edx, edx
div ecx
mov ecx, 0x49218068
xor ecx, 0x15320ed3
xor edx, edx
div ecx
cmp eax, 0x8784190e
je 0x140125195
mov rcx, qword [rsp + 0x68]
mov eax, dword [0x14027a220]
xor eax, 0xeab7f8dc
mov r9d, dword [0x14027a224]
xor r9d, 0x742ee268
mov r8d, 0x5778ade5
xor r8d, 0xa887521a
mov edx, eax
xor edx, r8d
mov r8d, r9d
and r8d, edx
mov edx, 0x43156802
xor edx, 0xbcea97fd
mov r10d, r9d
xor r10d, edx
mov edx, eax
and edx, r10d
imul edx, r8d
mov r8d, eax
and r8d, r9d
or eax, r9d
imul eax, r8d
add eax, edx
add eax, 0x6cb1462c
sub eax, 0x8306c1fe
sub eax, 0x6cb1462c
add eax, 0xed568faa
mov edx, 0x36329c82
xor edx, 0xfaad0dab
add eax, edx
add rcx, 8
mov qword [rsp + 0x60], rcx
cmp eax, 0x1c586f6c
jbe 0x140124f87
xor eax, eax
mov qword [rsp + 0x58], rax
jmp 0x140125027
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x48], rcx
mov rax, qword [rax]
mov rax, qword [rax + rcx*8 + 8]
mov qword [rsp + 0x50], rax
cmp rax, 0
je 0x140125132
mov rax, qword [rsp + 0x50]
xor ecx, ecx
sub rcx, 0xfffffffffffffff0
sub rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
movabs rcx, 0x800d64fdbed9e3a8
movabs rdx, 0x800d64fdbed9e3b8
xor rcx, rdx
cmp rax, rcx
jb 0x1401250ec
mov r8, qword [rsp + 0x40]
mov rax, r8
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x30], rax
mov rdx, rax
xor rdx, 0xffffffffffffffff
mov rcx, r8
and rcx, rdx
xor r8, 0xffffffffffffffff
mov rdx, rax
and rdx, r8
or rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x1401250d0
jmp 0x1401250da
call fcn.14000f24b
jmp 0x140125132
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
jmp 0x140125132
mov rcx, qword [rsp + 0x50]
call fcn.140124140
mov rax, qword [rsp + 0x70]
cmp byte [rax], 0
jne 0x14012518f
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
movabs rdx, 0x97e6f9641af3594b
movabs rax, 0x97e6f9641af35943
xor rdx, rax
call fcn.14001d294
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
movabs rdx, 0x13a19371d64067de
add rax, rdx
add rax, 1
movabs rdx, 0x13a19371d64067de
sub rax, rdx
cmp rax, qword [rcx]
mov qword [rsp + 0x58], rax
jl 0x140125027
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp rax, 0
je 0x14012518f
mov rcx, qword [rsp + 0x28]
mov edx, 8
call fcn.14001d203
nop
add rsp, 0x78
ret
sub byte [rdx - 0x161665ab], bh
std
invalid
Function at 0x1401369d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
cmp rcx, 0
je 0x140136ae6
mov rax, qword [rsp + 0x30]
movabs rcx, 0xa9a62432a433096f
movabs rdx, 0x5659dbcd5bccf69f
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x20], rax
mov rdx, qword [rax]
movabs rax, 0xace2f6145a945a0b
mov rcx, rdx
sub rcx, rax
add rcx, 0x10
movabs rax, 0xace2f6145a945a0b
add rcx, rax
mov qword [rsp + 0x28], rcx
movabs rax, 0xfe90bcc54bd367a4
movabs r8, 0x16f433ab42c985b
xor rax, r8
xor rdx, rax
movabs r8, 0x41f3343b383e17b5
movabs rax, 0xbe0ccbc4c7c1e84a
xor r8, rax
mov rax, rcx
xor rax, r8
mov r8, rdx
xor r8, 0xffffffffffffffff
or rax, r8
xor rcx, 0xffffffffffffffff
movabs r8, 0x1b41eee73f02ac3b
movabs r9, 0xe4be1118c0fd53c4
xor r8, r9
xor rdx, r8
or rcx, rdx
and rax, rcx
movabs rcx, 0xa116f4d3a84f7f67
movabs rdx, 0x5ee90b2c57b08098
xor rcx, rdx
xor rax, rcx
movabs rcx, 0xf55d75091148ab0b
movabs rdx, 0xf55d75091148ab0b
xor rcx, rdx
cmp rax, rcx
jge 0x140136ad9
call fcn.14000f24b
jmp 0x140136ae6
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
mov eax, dword [0x14027aa90]
mov edx, dword [0x14027aa94]
mov ecx, edx
and ecx, eax
xor ecx, 0xffffffff
add eax, edx
mov edx, 0xebe58a6a
xor edx, 0xebe58a6b
add eax, edx
add eax, ecx
xor eax, 0x851bc2f9
xor ecx, ecx
sub ecx, 0xf29da541
sub eax, ecx
mov ecx, 0xb0c94a87
xor edx, edx
div ecx
cmp eax, 0x355a61c8
jae 0x140136ba9
mov eax, dword [0x14027aa98]
mov ecx, dword [0x14027aa9c]
xor ecx, 0x5756b2c2
add eax, 0xa3870a75
sub eax, ecx
mov ecx, 0x4cbfa151
xor ecx, 0xef38ab24
sub eax, ecx
mov ecx, eax
and ecx, 0xe00ea5bc
mov edx, 0x448e9eac
xor edx, 0x448e9eae
imul ecx, edx
xor eax, 0xe00ea5bc
add eax, ecx
sub eax, 0xd64248b9
add eax, 0x99afe710
add eax, 0xd64248b9
mov ecx, 0x2c872217
xor ecx, 0x95c64a6c
add eax, ecx
mov ecx, 0x5d810da0
xor ecx, 0xae5fb8ce
cmp eax, ecx
jae 0x140136b2d
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
rol byte [rax + 0x66], 0x73
jmp 0x140136b2d
Function at 0x14013fac0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x368
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1b0], rdx
Function at 0x1401496b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x160
mov qword [rsp + 0x100], rdx
mov qword [rsp + 0xf8], rcx
mov qword [rsp + 0xf0], rcx
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, qword [rsp + 0xf8]
mov rdx, qword [rsp + 0x100]
add rax, 0x60
mov qword [rsp + 0x108], rax
mov qword [rcx], 0

Function at 0x14014a670
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
mov eax, dword [0x14027b290]
imul eax, dword [0x14027b294]
add eax, 0x4010f466
mov ecx, 0x2250b682
xor ecx, 0x6811436c
xor edx, edx
div ecx
mov ecx, 0xffffffff
xor ecx, 0x8aa27577
add eax, ecx
add eax, 1
mov ecx, 0x29ef2780
xor ecx, 0x7203deef
cmp eax, ecx
jbe 0x14014a7a7
mov eax, dword [0x14027b298]
mov r8d, dword [0x14027b29c]
xor r8d, eax
mov eax, r8d
xor eax, 0x12023080
mov edx, eax
or edx, 0xe13d075c
xor r8d, 0x400803
and r8d, 0x421803
mov ecx, edx
and ecx, 0x9f81e0f8
imul ecx, r8d
and edx, 0x607e1f07
or eax, 0xe17f1f5f
imul eax, edx
add eax, ecx
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x7c470aa4
and ecx, 0x83b8f55b
imul ecx, edx
mov edx, eax
and edx, 0x83b8f55b
or eax, 0x83b8f55b
imul eax, edx
add eax, ecx
mov dword [rbp - 0x1c], eax
mov eax, 0x10
call fcn.140271bb0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000efc9
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x28]
add rsp, 0x20
mov rax, qword [rbp - 0x18]
mov r8, qword [rax + 0x70]
mov qword [rdx], r8
mov rax, qword [rax + 0x78]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14013acc0
mov eax, dword [rbp - 0x1c]
add rsp, 0x20
cmp eax, 0x153cc6e2
jbe 0x14014a6ca
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
mov al, 0xe8
xchg ebx, eax
mov ecx, gs
sbb bh, bh
invalid
Function at 0x140154780
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov eax, dword [0x14027b568]
mov r8d, dword [0x14027b56c]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xcd88c3fe
xor ecx, 0x4534c7a1
add eax, ecx
mov ecx, 0x5e5b5ee1
xor edx, edx
div ecx
mov ecx, 0xd1189b74
xor edx, edx
div ecx
mov ecx, 0xb4f0f71c
xor ecx, 0x5d43abb0
cmp eax, ecx
je 0x1401548b0
mov eax, dword [0x14027b570]
xor eax, 0x9bca9013
mov ecx, dword [0x14027b574]
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
not eax
and eax, 0x7b9ccd87
mov edx, ecx
and edx, 0x84633278
imul edx, eax
mov eax, ecx
and eax, 0x7b9ccd87
or ecx, 0x7b9ccd87
imul ecx, eax
mov eax, ecx
mov ecx, edx
lea eax, [rax + rcx - 0xd194273]
and eax, 0x8ea09bcd
mov dword [rbp - 0xc], eax
mov eax, 0x675ecc0b
mov dword [rbp - 0x10], eax
mov eax, 0x10
call fcn.140271bb0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000efc9
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov qword [rcx], 0
mov rdx, qword [rax + 0x10]
xor r8d, r8d
sub rsp, 0x20
call fcn.140028560
mov rdx, qword [rbp - 0x18]
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0xc]
add rsp, 0x20
mov rdx, qword [rdx]
mov qword [rbp - 8], rdx
cmp eax, ecx
je 0x1401547ef
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
sahf
cmp dword [rbx], edx
mov edx, 0xffff36e9
invalid

Function at 0x1401548b9
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14028d330]
Function at 0x140154d20
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
movss dword [rbp - 0x6c], xmm3
mov qword [rbp - 0x68], r8
mov qword [rbp - 0x60], rdx
mov qword [rbp - 0x58], rcx
mov eax, pe_nt_image_headers64
call fcn.140271bb0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x50], rax
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000efc9
add rsp, 0x20
mov qword [rbp - 0x48], rax
movabs rcx, 0xecaedaaad08d18c2
movabs rax, 0xecaedaaad08d187a
xor rcx, rax
movabs rdx, 0x7a653e97383535dc
movabs rax, 0x7a653e97383535d4
xor rdx, rax
sub rsp, 0x20
call fcn.140029060
add rsp, 0x20
mov qword [rbp - 0x40], rax
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000efc9
add rsp, 0x20
xor eax, eax
mov qword [rbp - 0x38], rax
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x50]
xorps xmm0, xmm0
movups xmmword [rax + rcx], xmm0
mov rax, rcx
and rax, 0x10
movabs rdx, 0x6734a57726929c0e
movabs r8, 0x6734a57726929c1e
xor rdx, r8
or rcx, rdx
add rax, rcx
cmp rax, 0x80
mov qword [rbp - 0x38], rax
jne 0x140154dca
mov rcx, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x58]
add rcx, 0x60
mov qword [rbp - 0x78], rcx
mov rcx, qword [rax]
mov qword [rbp - 0x10], rcx
mov rax, qword [rax + 8]
mov qword [rbp - 8], rax
lea rcx, [rbp - 0x10]
sub rsp, 0x20
call fcn.140141df0
mov rax, qword [rbp - 0x48]
add rsp, 0x20
cmp byte [rax + 0x60], 0
jne 0x140154ee0
mov rdx, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x40]
sub rsp, 0x20
call fcn.14013da60
mov rax, qword [rbp - 0x78]
add rsp, 0x20
cmp byte [rax], 0
jne 0x140154ee0
mov rcx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x60]
add rcx, 0x98
mov rdx, qword [rax]
mov qword [rbp - 0x20], rdx
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
sub rsp, 0x20
call fcn.1400344e0
mov rax, qword [rbp - 0x68]
mov rcx, qword [rbp - 0x40]
add rsp, 0x20
add rcx, 0x80
mov rdx, qword [rax]
mov qword [rbp - 0x30], rdx
mov rax, qword [rax + 8]
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x30]
sub rsp, 0x20
call fcn.140092080
movss xmm0, dword [rbp - 0x6c]
mov rax, qword [rbp - 0x40]
add rsp, 0x20
movss dword [rax + 0x90], xmm0
mov rax, qword [rbp - 0x40]
mov rsp, rbp
pop rbp
ret
Function at 0x140172df0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x188
mov qword [rsp + 0x138], rdx
mov qword [rsp + 0x140], rcx
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov qword [rsp + 0x150], rax
add rax, 0x60
mov qword [rsp + 0x148], rax
mov ecx, 0xcce1