joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140169f50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x140259ef0]
mov ecx, dword [0x140259ef4]
add eax, 0x88893cce
sub eax, ecx
sub eax, 0x88893cce
and eax, eax
mov ecx, 0x17a9b55e
xor ecx, 0xe8564aa1
xor eax, ecx
mov ecx, 0xe4dbadc2
and ecx, 0xe4dbadc2
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
xor eax, 0x7b14dcd2
mov edx, 0xfb37f571
xor edx, 0xa51a2a7a
mov ecx, eax
and ecx, edx
shl ecx, 1
add eax, 0x5e2ddf0b
sub eax, ecx
cmp eax, 0x34224124
jb 0x14016a0fe
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x140259ef8]
xor edx, edx
div dword [0x140259efc]
imul eax, eax, 0x6b26fbe
mov r8d, 0xb3b06759
xor edx, edx
div r8d
mov edx, eax
xor edx, 0xd76963b8
xor edx, 0xffffffff
and edx, 0xd76963b8
shl edx, 1
mov r8d, 0x881ff045
xor r8d, 0x5f7693fd
sub edx, r8d
sub eax, edx
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
cmp rcx, 0
sete cl
mov byte [rsp + 0x37], cl
cmp eax, 0xfdbcab9a
je 0x14016a0fe
mov al, byte [rsp + 0x37]
test al, 1
jne 0x14016a051
jmp 0x14016a03a
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
call fcn.1401a68f0
mov eax, dword [0x140259f00]
xor edx, edx
div dword [0x140259f04]
mov ecx, 0xe3692713
xor edx, edx
div ecx
sub eax, 0xd646fbf1
mov edx, 0x2566e8c7
xor edx, 0x2566e8c6
mov ecx, eax
add ecx, edx
xor eax, 0xffffffff
or eax, 0x1a72a50
add eax, ecx
mov ecx, 0x69f7ff7d
xor ecx, 0x7240b6a2
cmp eax, ecx
ja 0x14016a107
mov eax, dword [0x140259f08]
or eax, dword [0x140259f0c]
mov edx, eax
and edx, 0x967a4a4a
mov ecx, 0x9f261b69
xor ecx, 0x9f261b6b
imul ecx, edx
mov edx, 0x790c236e
xor edx, 0xef766924
add eax, edx
sub eax, ecx
mov ecx, 0x4859a3c
xor ecx, 0x86803d3f
xor edx, edx
div ecx
mov ecx, 0x79e05e1
xor ecx, 0xaa2b9d55
xor eax, ecx
mov ecx, 0x930f9d75
xor ecx, 0xfe4293ac
cmp eax, ecx
je 0x14016a099
add rsp, 0x48
ret
rcl byte [rdi], 0x2a
movsd dword [rdi], dword [rsi]
jmp 0x140169fc1
mov eax, dword [rax - 0x76163dba]
invalid
Function at 0x14017e600
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xbc8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x680], r8
mov qword [rbp + 0x5e8], rdx
mov qword [rbp + 0x690], rcx
mov eax, 0x10
mov qword [rbp + 0x668], rax
call fcn.14024f5c0
sub rsp, rax
mov rax, qword [rbp + 0x668]
Function at 0x1401a67d0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
sub rsp, 0x10
lea rbp, [rsp + 0x10]
mov ecx, dword [0x14025bb50]
mov edx, dword [0x14025bb54]
xor edx, 0x61d12102
mov eax, ecx
and eax, edx
shl eax, 1
add ecx, edx
sub ecx, eax
or ecx, 0xb1440176
and ecx, 0xcfef2db6
mov edx, 0x5aa832bd
xor edx, 0xfad4230a
mov eax, ecx
and eax, edx
or ecx, 0xa07c11b7
add eax, ecx
cmp eax, 0xeb3cb798
jae 0x1401a68d5
mov eax, dword [0x14025bb58]
xor eax, 0x440ba5ef
mov ecx, dword [0x14025bb5c]
and eax, ecx
mov ecx, eax
not ecx
and ecx, 0x153c61dd
and eax, 0x6ac39e22
sub eax, ecx
or eax, 0xab4847fa
add eax, 0x55ffd9a5
mov dword [rbp - 4], eax
mov eax, 0x8224216b
mov dword [rbp - 8], eax
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, 0x28
mov edx, 8
sub rsp, 0x20
call fcn.1400132f0
mov rdx, qword [rbp - 0x10]
add rsp, 0x20
mov rcx, rax
mov qword [0x1402dcdf8], rcx
add rcx, 8
mov rax, qword [0x140268d58]
mov qword [rdx], rax
mov rax, qword [0x140268d60]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140014570
call fcn.140037d85
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 4]
add rsp, 0x20
cmp eax, ecx
jae 0x1401a68d5
mov rsp, rbp
pop rbp
ret
pop rbp
mov byte [rsi - 0xb8166e], 0xff
dec dword [rax - 0x75]
mov rax, qword [0x140269990]
Function at 0x1401a81d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x28], rcx
call fcn.1401a6dca
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1401a6df0
test al, 1
jne 0x1401a81fd
jmp 0x1401a822a
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
call fcn.14008f099
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
jne 0x1401a83aa
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov edx, 8
call fcn.14000ea9a
mov eax, dword [0x14025bc10]
mov edx, dword [0x14025bc14]
xor edx, 0xc2ea6c8f
and eax, eax
xor eax, 0xffffffff
mov ecx, edx
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0x269dfdb3
xor ecx, 0x269dfdb3
sub ecx, eax
xor eax, eax
sub eax, 0x7f03f579
add ecx, eax
mov eax, 0x40e6979b
xor eax, 0x40e6979b
sub eax, ecx
mov ecx, 0xa0b5b535
xor ecx, 0x22d0a2ea
xor edx, edx
div ecx
mov r11d, eax
mov eax, 0xd2be28e2
xor eax, 0x2d41d71d
mov ecx, r11d
xor ecx, eax
mov r8d, 0xaf7e0e04
xor r8d, 0xa9aa5e59
mov eax, 0x44178399
xor eax, 0xbbe87c66
xor r8d, eax
mov edx, 0xffffffff
xor edx, 0xd7936b16
mov eax, ecx
and eax, 0xd7936b16
and r11d, edx
mov r9d, r8d
and r9d, 0xd7936b16
mov r10d, edx
and r10d, 0x6d4505d
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
xor ecx, 0xffffffff
or edx, 0xd7936b16
and ecx, edx
or eax, ecx
cmp eax, 0x793b1859
je 0x1401a83b0
mov eax, dword [0x14025bc18]
xor edx, edx
div dword [0x14025bc1c]
mov ecx, 0xb1dcb02f
xor edx, edx
div ecx
mov ecx, 0xd5e21dd5
xor edx, edx
div ecx
mov ecx, eax
mov rax, qword [rsp + 0x28]
sub ecx, 0x3570ef7a
sub ecx, 0x977e1c12
mov edx, 0x5a7ee856
xor edx, 0x6f0e072c
add ecx, edx
mov dword [rsp + 0x20], ecx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x48], rcx
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
call fcn.1401a70b0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x20]
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x27], cl
cmp eax, 0xcafee1b4
jae 0x1401a82fa
mov al, byte [rsp + 0x27]
test al, 1
jne 0x1401a8389
jmp 0x1401a83aa
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x38], rcx
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
call fcn.1401a8036
nop
add rsp, 0x58
ret
sub byte [rsi + 0x41e943c2], dh
invalid
Function at 0x1401a8490
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.1401a6dca
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.1401a6df0
test al, 1
jne 0x1401a84ba
jmp 0x1401a84e1
mov rcx, qword [rsp + 0x28]
call fcn.1401a7440
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
jne 0x1401a84e1
mov rcx, qword [rsp + 0x28]
mov edx, 8
call fcn.14000ea9a
mov ecx, dword [0x14025bc20]
mov edx, dword [0x14025bc24]
mov r8d, ecx
xor r8d, 0xffffffff
mov eax, edx
and eax, r8d
xor edx, 0xffffffff
and ecx, edx
or eax, ecx
add eax, 0x2c954495
mov ecx, 0x955e6654
xor edx, edx
div ecx
xor ecx, ecx
sub ecx, 0x31aeffaa
add eax, ecx
mov ecx, 0x5073b849
xor ecx, 0xebfca767
cmp eax, ecx
jb 0x1401a858f
mov eax, dword [0x14025bc28]
xor eax, 0x2420e3ab
mov edx, dword [0x14025bc2c]
mov ecx, eax
add ecx, 1
mov r8d, 0x65d74ab9
xor r8d, 0x9a28b546
xor eax, r8d
or eax, edx
add eax, ecx
imul eax, eax, 0x18058c0b
or eax, 0xf0756973
sub eax, 0xa0e77db5
mov ecx, 0x4ed22bd6
xor ecx, 0x7b0aafa
sub eax, ecx
add eax, 0xa0e77db5
mov ecx, 0x7f6684e4
xor ecx, 0x53a0f712
cmp eax, ecx
je 0x1401a852b
add rsp, 0x38
ret
invalid

Function at 0x1401a99f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x14025bcd8]
mov edx, dword [0x14025bcdc]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov ecx, 0x82c98b70
xor ecx, 0x82c98b70
mov edx, 0x3da215c7
xor edx, 0x2f3227d2
sub ecx, edx
sub eax, ecx
mov edx, 0xffffffff
xor edx, 0xd21f57cc
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0xd21f57cc
add eax, edx
sub eax, ecx
and eax, 0x70ecbd0a
cmp eax, 0x810c5e7d
je 0x1401a9aca
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x14025bce0]
mov edx, 0xa179ceff
xor edx, 0x71569949
xor eax, edx
xor edx, edx
div dword [0x14025bce4]
add eax, 0xea41a7c0
mov r8d, 0xb2db7df6
xor r8d, 0x619f182c
xor edx, edx
div r8d
xor eax, 0x4d6ab85f
mov dword [rsp + 0x24], eax
movabs rdx, 0x7f4baee6540c38c7
movabs rax, 0x7f4baee6540c38df
xor rdx, rax
call fcn.1401a98f7
mov eax, dword [rsp + 0x24]
cmp eax, 0x5f0cb1e6
jae 0x1401a9a55
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
in eax, dx
push r13
insd dword [rdi], dx
jmp 0x1401a9a55
Function at 0x1401bea70
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
call fcn.1401bd52a
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1401bd550
test al, 1
jne 0x1401beaa2
jmp 0x1401bead5
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
call fcn.1401be9a6
mov rax, qword [rsp + 0x30]
mov al, byte [rax]
mov cl, 0x3e
xor cl, 0x3e
cmp al, cl
jne 0x1401bebb8
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov edx, 8
call fcn.14000ea9a
mov eax, dword [0x14025c448]
mov ecx, dword [0x14025c44c]
xor ecx, 0xc2ea6c8f
xor eax, ecx
xor eax, 0xde87403f
imul eax, eax, 0xf57642cc
mov ecx, eax
xor ecx, 0xe326e9e5
xor ecx, 0xffffffff
and ecx, 0xe326e9e5
shl ecx, 1
mov edx, 0x9d18377c
xor edx, 0x7e3ede99
sub ecx, edx
sub eax, ecx
mov ecx, 0x1eec8746
xor ecx, 0xbeea06d2
cmp eax, ecx
je 0x1401bebbd
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x20]
mov eax, dword [0x14025c450]
mov ecx, 0xa0b5b535
xor ecx, 0x6b3b6de
xor eax, ecx
mov r9d, dword [0x14025c454]
mov ecx, 0xaf7e0e04
xor ecx, 0x7dc026e6
xor r9d, ecx
mov ecx, 0x64843ead
xor ecx, 0x64843ead
sub ecx, eax
xor eax, eax
sub eax, r9d
add ecx, eax
xor eax, eax
sub eax, ecx
add eax, 0x8db6ee3f
mov ecx, 0xc554d41f
xor ecx, 0x6ef73257
sub eax, ecx
sub eax, 0x8db6ee3f
sub eax, 0x4a1e998a
mov ecx, 0x4ab3c1e1
xor ecx, 0x9dbc6196
add eax, ecx
mov ecx, 0xf4b07049
xor ecx, 0x4f686fb7
mov qword [rdx], r8
cmp eax, ecx
jb 0x1401beb2a
jmp 0x1401bebb8
add rsp, 0x38
ret
imul edi, dword [rbx + 0x51], 0xff64e9b7
invalid
Function at 0x1401d8d50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov eax, dword [0x14025cf00]
xor eax, 0xa295d9f3
mov ecx, dword [0x14025cf04]
xor ecx, 0xd6f11bd8
and eax, ecx
mov ecx, 0x7afd0b37
xor edx, edx
div ecx
mov edx, 0x161b35d
xor edx, 0xfe648f7d
mov ecx, eax
and ecx, edx
shl ecx, 1
add eax, 0xff053c20
sub eax, ecx
mov ecx, 0x56cd9292
xor edx, edx
div ecx
mov ecx, 0x200bfb11
xor ecx, 0xc26c8c58
cmp eax, ecx
jae 0x1401d8f34
mov eax, dword [0x14025cf08]
xor eax, 0x48d2adb5
mov r8d, dword [0x14025cf0c]
mov r9d, r8d
not r9d
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
not ecx
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0x4193373b
or eax, 0xbe6cc8c4
and eax, ecx
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xd924dc5d
and ecx, 0x26db23a2
imul ecx, edx
mov edx, eax
and edx, 0x26db23a2
or eax, 0x26db23a2
imul eax, edx
add eax, ecx
mov edx, eax
not edx
and edx, 0x11709977
mov ecx, eax
and ecx, 0xee8f6688
imul ecx, edx
mov edx, eax
and edx, 0x11709976
or eax, 0x11709977
imul eax, edx
add eax, ecx
mov dword [rsp + 0x38], eax
call fcn.1401e07a7
mov rdx, qword [rsp + 0x40]
mov rcx, rax
mov eax, dword [rsp + 0x38]
mov dl, byte [rdx + 8]
mov cl, byte [rcx + 0x50]
test cl, cl
setne r8b
mov byte [rsp + 0x3e], r8b
or cl, dl
setne cl
mov byte [rsp + 0x3f], cl
cmp eax, 0xbd0b5d3e
ja 0x1401d8db0
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x1401d8f13
jmp 0x1401d8e8c
mov ecx, 0x40
mov edx, 8
call fcn.1400132f0
mov rcx, rax
mov rax, qword [0x140269650]
mov qword [rcx], rax
lea rax, [0x140268f00]
mov qword [rcx + 0x10], rax
mov rax, qword [0x140268f48]
mov qword [rcx + 0x18], rax
mov rax, qword [0x140268f50]
mov qword [rcx + 0x20], rax
mov qword [rcx + 8], 0
movabs rax, 0x2fa8a3d9f6039418
movabs rdx, 0xd0575c2657cde6b9
xor rax, rdx
lea rdx, [0x140268f00]
lea r8, [0x140268f0d]
lea r9, [0x140268f11]
mov qword [rsp + 0x20], rax
call fcn.1400127b0
xor eax, eax
mov qword [rsp + 0x30], rax
jmp 0x1401d8f2a
mov rax, qword [rsp + 0x40]
mov dl, byte [rsp + 0x3e]
xor ecx, ecx
test dl, 1
cmovne rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret
popfq
ret 0xe986
Function at 0x1401e5fb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov rcx, qword [rcx]
call fcn.1401e5951
test al, 1
jne 0x1401e5fd3
jmp 0x1401e5fe5
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
mov edx, 4
call fcn.14000ea9a
mov eax, dword [0x14025d548]
xor edx, edx
div dword [0x14025d54c]
mov ecx, eax
mov eax, ecx
and eax, eax
xor eax, 0xffffffff
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x9e9bffd1
or eax, edx
mov edx, 0x18ff2d44
xor edx, 0x8664d295
mov r8d, 0x757fc994
xor r8d, 0x8a80366b
xor edx, r8d
mov r8d, 0xffffffff
xor r8d, 0x9e9bffd1
or edx, r8d
and ecx, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x1c01b0d8
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x1c01b0d8
or eax, 0x1c01b0d8
imul eax, edx
add eax, ecx
mov edx, 0x79a76716
xor edx, 0x85f3f934
mov ecx, 0xd0107740
xor ecx, 0x2fef88bf
xor edx, ecx
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0xfc549e22
add eax, edx
sub eax, ecx
mov ecx, 0x229a2c8d
xor ecx, 0x14f7747a
cmp eax, ecx
je 0x1401e6102
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x14025d550]
xor eax, 0x2e231b75
xor eax, dword [0x14025d554]
mov edx, 0x51a67aa8
xor edx, 0xf58e8c8
imul eax, edx
imul eax, eax, 0x17975def
mov r8d, 0x3d26d4ed
xor r8d, 0x89a8ac7d
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x28]
mov qword [rcx], rdx
cmp eax, 0xdcb7e885
je 0x1401e60ae
add rsp, 0x38
ret
and byte [0xe4083966], ch
invalid
Function at 0x1401ea860
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0xe0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x58], rcx
mov eax, dword [0x14025d780]
mov edx, dword [0x14025d784]
mov ecx, eax
xor ecx, 0xffffffff
mov r9d, 0xc2e8bdd7
xor r9d, 0x3d174228
mov r8d, eax
xor r8d, r9d
or ecx, r8d
and ecx, edx
xor ecx, 0xffffffff
and edx, edx
xor edx, 0xffffffff
xor eax, 0xffffffff
xor edx, 0xffffffff
or eax, edx
xor ecx, 0xffffffff

Function at 0x1401eaf10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
xor eax, eax
mov qword [rsp + 0x20], rax
jmp 0x1401eaf2a
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movabs rcx, 0xcdb7e5afbac86c42
movabs rdx, 0xcdb7e5afbac86c52
xor rcx, rdx
cmp rax, rcx
je 0x1401eb014
mov eax, dword [str.D_nj:_]
xor eax, dword [0x14025d7a4]
mov ecx, 0xb189be89
xor ecx, 0xe89528e3
add eax, ecx
mov ecx, 0xfdbb315b
xor ecx, 0x27cb0e61
or eax, ecx
xor eax, 0xe8e600cf
mov ecx, 0x901f0945
xor ecx, 0x77c03aa2
cmp eax, ecx
ja 0x1401eb019
mov rcx, qword [rsp + 8]
mov r8, qword [rsp + 0x10]
mov eax, dword [0x14025d7a8]
mov edx, dword [0x14025d7ac]
xor edx, 0xdc331048
add eax, edx
xor eax, 0x348ae3d0
mov r9d, 0x919f53f5
xor edx, edx
div r9d
mov rdx, qword [rsp + 0x18]
mov r9d, eax
mov r10d, 0xd5e182b0
xor r10d, 0x5111d70a
mov eax, 0x94c49b43
xor eax, 0x6b3b64bc
xor r10d, eax
mov eax, r9d
xor eax, r10d
and eax, r9d
mov r8b, byte [r8 + rcx]
mov byte [rdx + rcx], r8b
add rcx, 1
mov qword [rsp], rcx
cmp eax, 0xa1e22154
je 0x1401eaf92
mov rax, qword [rsp]
mov qword [rsp + 0x20], rax
jmp 0x1401eaf2a
add rsp, 0x28
ret
and ebp, dword [rdi + 0x5c]
and ecx, ebp
jo 0x1401eb01f
invalid
invalid
Function at 0x1401eea40
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], rcx
mov ecx, dword [0x14025d8c0]
xor ecx, 0x65f4a16b
mov eax, dword [0x14025d8c4]
xor eax, 0xfb6b036c
xor ecx, eax
sub ecx, 0xd9dd530e
mov edx, ecx
xor edx, 0xffffffff
and edx, 0xa32d80da
mov r8d, 0xffffffff
xor r8d, 0xa32d80da
mov eax, ecx
and eax, r8d
imul eax, edx
mov edx, ecx
and edx, 0xa32d80da
mov r8d, 0x58c88e16
xor r8d, 0xfbe50ecc
or ecx, r8d
imul ecx, edx
add ecx, eax
mov eax, ecx
and eax, 0x96a9ebb8
or ecx, 0x96a9ebb8
add eax, ecx
cmp eax, 0x3cf92165
jb 0x1401eebe8
mov eax, dword [0x14025d8c8]
mov r8d, dword [0x14025d8cc]
mov r9d, r8d
not r9d
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
not ecx
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
or eax, 0xba66b1c8
imul eax, eax, 0x880a43a7
xor eax, 0x5f799cbd
mov dword [rbp - 0x10], eax
mov eax, 0x46054087
mov dword [rbp - 0x14], eax
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.1401ee93c
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x20], rcx
mov rcx, qword [rax]
sub rsp, 0x20
call fcn.1401ee957
mov ecx, dword [rbp - 0x14]
add rsp, 0x20
mov dl, al
mov eax, dword [rbp - 0x10]
mov byte [rbp - 9], dl
cmp eax, ecx
jb 0x1401eeac4
mov al, byte [rbp - 9]
test al, 1
jne 0x1401eeb6d
jmp 0x1401eebbf
mov rax, qword [rbp - 8]
mov rcx, qword [rax]
sub rsp, 0x20
call fcn.14008f099
mov rax, qword [rbp - 0x20]
add rsp, 0x20
add esp, 0x20
mov al, byte [rax]
mov cl, 0x5c
xor cl, 0x5c
cmp al, cl
jne 0x1401eebe3
mov rax, qword [rbp - 8]
mov rcx, qword [rax]
movabs rdx, 0x9ec5694fd97911fa
movabs rax, 0x9ec5694fd97911f2
xor rdx, rax
sub rsp, 0x20
call fcn.14000ea9a
add rsp, 0x20
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov qword [rcx], rdx
mov rax, qword [rax + 0x10]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.140025900
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
insd dword [rdi], dx
je 0x1401eeb82
invalid

Function at 0x1401ef2d0
Capabilities:
Encode data using xor

Disassembly:
push rax
mov qword [rsp], rcx
mov ecx, dword [0x14025d8f0]
mov r8d, dword [0x14025d8f4]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, ecx
and edx, r9d
mov eax, ecx
or eax, r9d
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, r8d
or ecx, r8d
imul ecx, edx
add ecx, eax
and ecx, 0x7615f958
mov eax, ecx
and eax, 0xe1b127e4
xor ecx, 0xe1b127e4
or eax, ecx
imul eax, eax, 0xea6ec70e
cmp eax, 0xbf3d4756
jae 0x1401ef377
mov rcx, qword [rsp]
mov eax, dword [0x14025d8f8]
add eax, dword [0x14025d8fc]
mov r8d, 0x23ac2469
xor r8d, 0xaa92e31e
xor edx, edx
div r8d
mov r8d, 0xaca93daf
xor edx, edx
div r8d
xor edx, edx
sub edx, 0x63ff9f63
sub eax, edx
mov qword [rcx], 0
cmp eax, 0xf262b301
jae 0x1401ef32c
pop rax
ret
pop rbx
sbb byte [rax + 0x64], ah
jmp 0x1401ef32c
Function at 0x1401f6da0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov eax, dword [0x14025dc68]
mov ecx, dword [0x14025dc6c]
xor ecx, 0xf1e0a3d5
add eax, 0x4670636e
sub eax, ecx
mov ecx, 0x33fc9b2
xor ecx, 0x454faadc
sub eax, ecx
or eax, eax
xor eax, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x92bd34e9
mov edx, 0xd8287f35
xor edx, 0x4a954bdc
mov r8d, 0xa0f281d9
xor r8d, 0x5f0d7e26
xor edx, r8d
and ecx, edx
xor eax, 0xffffffff
mov edx, 0x39143d20
xor edx, 0xc6ebc2df
xor ecx, edx
and eax, ecx
mov edx, 0xffffffff
xor edx, 0xc9255baf
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0xc9255baf
add eax, edx
sub eax, ecx
mov ecx, 0xf9ccc03f
xor ecx, 0x737b0dc0
or eax, ecx
cmp eax, 0x24323ae9
jbe 0x1401f6ef6
mov eax, dword [0x14025dc70]
mov edx, dword [0x14025dc74]
xor edx, 0x6c72577a
mov ecx, eax
xor ecx, edx
not ecx
or eax, edx
and eax, ecx
imul eax, eax, 0xe42b7d3c
mov edx, eax
not edx
and edx, 0xb2e9c6f3
mov ecx, eax
and ecx, 0x4d16390c
imul ecx, edx
mov edx, eax
and edx, 0xb2e9c6f0
or eax, 0xb2e9c6f3
imul eax, edx
add eax, ecx
imul eax, eax, 0x83f65d31
mov dword [rbp - 0xc], eax
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
sub rsp, 0x20
call fcn.1401fa89c
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov qword [rcx], 0
mov rdx, qword [rax + 0x10]
xor r8d, r8d
sub rsp, 0x20
call fcn.1400121c0
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbp - 0xc]
add rsp, 0x20
mov rcx, qword [rcx]
mov qword [rbp - 8], rcx
cmp eax, 0xe34181ce
jae 0x1401f6e42
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
movsd dword [rdi], dword [rsi]
out dx, al
call [fcn.1401eb2e7]
invalid
Function at 0x1401fce50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14025df40]
mov r8d, dword [0x14025df44]
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
mov r9d, 0x54ea4f19
xor r9d, 0xab15b0e6
mov edx, r8d
xor edx, r9d
or eax, edx
mov edx, r8d
xor edx, 0xffffffff
xor r8d, 0xffffffff
or edx, r8d
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov edx, 0xae1a8e26
xor edx, 0xae1a8e27
mov ecx, eax
add ecx, edx
mov edx, 0x55492b23
xor edx, 0xaab6d4dc
xor eax, edx
or eax, 0x9dfefe21
add eax, ecx
mov r8d, 0x9d0d4515
xor r8d, 0x9641a99f
mov ecx, 0x7b94fb73
xor ecx, 0x846b048c
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0xd6f6ea01
xor r8d, 0xddba068b
mov edx, eax
and edx, r8d
or eax, 0xb4cec8a
imul eax, edx
add eax, ecx
mov ecx, 0x707ff791
xor edx, edx
div ecx
mov ecx, 0xa62b344c
xor ecx, 0x146344ed
cmp eax, ecx
jae 0x1401fcf99
mov eax, dword [0x14025df48]
and eax, dword [0x14025df4c]
mov ecx, 0x1fe07caf
xor ecx, 0x9bec649c
sub eax, ecx
sub eax, 0x1c45cff4
mov ecx, 0xd7c84d9c
xor ecx, 0x53c455af
add eax, ecx
or eax, 0xb532d87b
mov ecx, 0x66774aed
xor ecx, 0x8be8de99
or eax, ecx
mov dword [rsp + 0x24], eax
call fcn.140202a60
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor r8d, r8d
call fcn.1400121c0
mov eax, dword [rsp + 0x24]
cmp eax, 0xd3607eae
jbe 0x1401fcf28
add rsp, 0x28
ret
and ebp, dword [rdi + 0x5c]
and ecx, ebp
xchg bh, bh
invalid
Function at 0x1402111a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x14025e720]
sub eax, dword [0x14025e724]
mov ecx, 0x685c3e16
xor ecx, 0x2eaaea09
add eax, ecx
mov r8d, 0xffffffff
xor r8d, 0xae5dad54
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0xe7e433a1
xor r8d, 0x49b99ef5
mov edx, eax
and edx, r8d
or eax, 0xae5dad54
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0xb6017c7d
xor ecx, 0xffffffff
and ecx, 0xb6017c7d
shl ecx, 1
mov edx, 0xb267d39
xor edx, 0xbd270144
sub ecx, edx
sub eax, ecx
cmp eax, 0x7882a6fc
je 0x1402112bd
mov eax, dword [0x14025e728]
xor eax, dword [0x14025e72c]
sub eax, 0x9243a0c1
add eax, 0xea0f4a4c
add eax, 0x9243a0c1
mov ecx, 0xd1817581
xor edx, edx
div ecx
mov ecx, eax
mov rax, qword [rsp + 0x30]
mov edx, 0xfc46df24
xor edx, 0x56d75576
imul ecx, edx
mov dword [rsp + 0x20], ecx
mov rcx, qword [rax]
call fcn.140210840
mov cl, al
mov eax, dword [rsp + 0x20]
mov byte [rsp + 0x27], cl
cmp eax, 0xd9204f8
je 0x14021122e
mov al, byte [rsp + 0x27]
test al, 1
jne 0x140211299
jmp 0x1402112ab
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
mov edx, 4
call fcn.14000ea9a
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
add rsp, 0x38
ret
test rax, 0x68e98c4b
invalid