joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400643e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x18], r8
mov word [rbp - 0xa], dx
mov qword [rbp - 8], rcx
mov eax, dword [0x1402191b0]
xor eax, 0x50266c2b
mov ecx, dword [0x1402191b4]
or eax, eax
xor eax, 0xffffffff
or ecx, ecx
mov edx, 0x8e09158e
xor edx, 0x71f6ea71
xor ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x2f944d6e
xor edx, edx
div ecx
or eax, 0x26b3f7c3
mov ecx, 0x789e209d
xor edx, edx
div ecx
cmp eax, 0xb17747e0
ja 0x140064512
mov eax, dword [0x1402191b8]
mov ecx, dword [0x1402191bc]
and eax, ecx
mov ecx, eax
xor ecx, 0x655a8bd7
or eax, 0x9aa57428
and eax, ecx
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x8d0587b7
and ecx, 0x72fa7848
imul ecx, edx
mov edx, eax
and edx, 0x72fa7848
or eax, 0x72fa7848
imul eax, edx
add eax, ecx
mov edx, eax
not edx
and edx, 0x744e89b7
mov ecx, eax
and ecx, 0x8bb17648
imul ecx, edx
mov edx, eax
and edx, 0x744e89b0
or eax, 0x744e89b7
imul eax, edx
add eax, ecx
mov dword [rbp - 0x1c], eax
mov eax, 0x10
call fcn.140215890
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.14004e61c
mov rcx, qword [rbp - 8]
mov dx, word [rbp - 0xa]
mov r8, qword [rbp - 0x28]
add rsp, 0x20
mov rax, qword [rbp - 0x18]
mov r9, qword [rax]
mov qword [r8], r9
mov rax, qword [rax + 8]
mov qword [r8 + 8], rax
sub rsp, 0x20
call fcn.1400634b0
mov eax, dword [rbp - 0x1c]
add rsp, 0x20
cmp eax, 0x58f74e90
ja 0x140064445
mov rsp, rbp
pop rbp
ret
mov al, 0x44
sbb ch, byte [rdx]
jmp 0x140064445
Function at 0x140067e90
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x18], r8
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1402193b0]
add eax, dword [0x1402193b4]
mov ecx, eax
and ecx, 0xde0bff54
shl ecx, 1
mov edx, 0x7703a10e
xor edx, 0xa9085e5a
xor eax, edx
add eax, ecx
and eax, 0x8b1b7f83
mov ecx, 0x1c984833
xor ecx, 0x4eeb0f0c
or eax, ecx
cmp eax, 0x507a166c
jb 0x140067f88
mov eax, dword [0x1402193b8]
xor eax, 0x8573386c
mov ecx, dword [0x1402193bc]
xor edx, edx
div ecx
add eax, 0x8ce17e03
or eax, 0x53c75457
mov ecx, eax
imul rcx, rcx, 0x4a3a6dab
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
mov dword [rbp - 0x1c], eax
mov eax, 0x12fb5354
mov dword [rbp - 0x20], eax
mov eax, 0x10
call fcn.140215890
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.14004e61c
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
add rsp, 0x20
mov rax, qword [rbp - 0x10]
mov r9, qword [rax]
mov qword [rdx], r9
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140066c70
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0x1c]
add rsp, 0x20
cmp eax, ecx
jae 0x140067ee9
mov rsp, rbp
pop rbp
ret
lahf
invalid
Function at 0x140068440
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x50
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x40], rcx
xor eax, eax
cmp rcx, qword [rdx]
mov byte [rsp + 0x4f], al
jne 0x1400685e3
mov rcx, qword [rsp + 0x40]
movabs rdx, 0xca5a32e3d6308c
movabs rax, 0xca5a32e3d6308c
xor rdx, rax
mov al, 1
cmp rcx, rdx
mov byte [rsp + 0x4f], al
je 0x1400685e3
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rdx, qword [rdx + 8]
add rdx, 8
mov qword [rsp + 0x10], rdx
mov rax, qword [rax + 8]
add rax, 8
mov qword [rsp + 0x18], rax
xor eax, eax
test rcx, rcx
cmovg rax, rcx
mov qword [rsp + 0x20], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 8], rax
mov eax, dword [0x1402193e0]
xor eax, 0xd7f86814
imul eax, dword [0x1402193e4]
sub eax, 0x764c7afd
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0x239e461
add eax, ecx
mov ecx, 0x94ae3e0
xor ecx, 0x3f0c7e74
or eax, ecx
cmp eax, 0x4126e166
ja 0x1400685f1
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x20]
mov eax, dword [0x1402193e8]
mov r9d, dword [0x1402193ec]
mov r8d, eax
and r8d, r9d
shl r8d, 1
xor eax, r9d
add eax, r8d
and eax, 0x44ce27a4
imul eax, eax, 0x427eb7fb
add eax, 0x9c6ccf74
cmp rcx, rdx
sete cl
mov byte [rsp + 7], cl
cmp eax, 0xef7147df
jae 0x140068516
mov cl, byte [rsp + 7]
xor eax, eax
test cl, 1
mov dword [rsp], eax
jne 0x1400685d6
jmp 0x140068579
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x18]
mov rax, qword [rsp + 0x10]
movzx eax, byte [rax + rcx]
movzx edx, byte [rdx + rcx]
sub eax, edx
mov edx, 0x92a232f6
xor edx, 0x92a232f6
mov r8, rcx
and r8, 1
movabs r9, 0x10f3fcb0c969f651
movabs r10, 0x10f3fcb0c969f653
xor r9, r10
imul r8, r9
xor rcx, 1
add rcx, r8
cmp eax, edx
mov qword [rsp + 0x28], rcx
mov dword [rsp], eax
je 0x1400684ce
mov eax, dword [rsp]
cmp eax, 0
sete al
mov byte [rsp + 0x4f], al
mov al, byte [rsp + 0x4f]
and al, 1
movzx eax, al
add rsp, 0x50
ret
and al, 0x60
rcl dword [rdx - 0x17], cl
sbb al, 0xff
invalid
Function at 0x140069760
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x48], rcx
mov rax, rdx
add rax, 8
mov qword [rsp + 0x50], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x58], rax
cmp rcx, rax
sete r8b
cmp rcx, 0
sete cl
and cl, cl
xor cl, 0xff
mov dl, r8b
xor dl, 0xff
xor r9d, r9d
xor r9b, 1
xor r8b, r9b
or dl, r8b
and cl, dl
xor cl, 0xff
test cl, 1
mov qword [rsp + 0x60], rax
jne 0x140069880
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x48]
movabs rcx, 0x4000000000000000
and rcx, qword [rdx]
cmp rcx, 0
mov qword [rsp + 0x60], rax
jne 0x140069880
mov eax, dword [0x1402194d8]
imul eax, dword [0x1402194dc]
or eax, 0x5fd433bc
add eax, 0x17df9911
or eax, 0x71910d3b
cmp eax, 0xf2499317
je 0x1400698a8
mov rcx, qword [rsp + 0x48]
mov eax, dword [0x1402194e0]
sub eax, dword [0x1402194e4]
mov edx, 0xd8bdec11
xor edx, 0x126e319
add eax, edx
mov r8d, 0x3aecb735
xor edx, edx
div r8d
and eax, 0xf72224f
mov dword [rsp + 0x24], eax
call fcn.140010918
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x24]
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
cmp eax, 0x7574512c
jae 0x14006981e
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x60], rax
jmp 0x140069880
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x60]
mov r9, qword [rcx]
mov qword [rax], r9
mov qword [rdx], r8
mov cl, byte [rcx + 0x10]
mov byte [rax + 0x10], cl
add rsp, 0x68
ret
insb byte [rdi], dx
stc
pop rax
jmp 0x14006981e
Function at 0x14006a190
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x14006a3b6
mov edx, dword [0x140219528]
mov eax, 0x79f14482
xor eax, 0xb4e6d8c3
xor edx, eax
mov ecx, dword [0x14021952c]
mov r8d, 0xb3146888
xor r8d, 0x4ceb9777
mov eax, edx
xor eax, r8d
xor edx, 0xffffffff
and eax, edx
or ecx, ecx
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0xd121a87b
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xd121a87b
mov r8d, 0x23f603b3
xor r8d, 0xf2d7abc8
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x2519d3c3
xor ecx, 0xaf6d7b06
xor edx, edx
div ecx
add eax, 0x7a840dd6
mov ecx, 0xe42935f4
xor ecx, 0x6e4d8c4a
cmp eax, ecx
ja 0x14006a3bb
mov rdx, qword [rsp + 0x30]
mov ecx, dword [0x140219530]
sub ecx, dword [0x140219534]
mov eax, ecx
xor eax, 0xffffffff
mov r8d, ecx
xor r8d, 0xffffffff
or eax, r8d
mov r8d, 0x6d84d9fe
xor r8d, 0x927b2601
xor eax, r8d
mov r8d, 0xffffffff
xor r8d, 0x6ffd479b
or eax, r8d
mov r8d, 0x6ffd479b
and r8d, 0x6ffd479b
xor r8d, 0xffffffff
xor ecx, 0xffffffff
mov r9d, 0xb05bc73f
xor r9d, 0x4fa438c0
xor r8d, r9d
or ecx, r8d
and eax, ecx
xor eax, 0xffffffff
mov ecx, eax
and ecx, 0x53ee7df3
mov r8d, 0xbe2fc9c2
xor r8d, 0x41d0363d
xor ecx, r8d
add eax, 0x53ee7df3
mov r8d, 0x28773ab9
xor r8d, 0x28773ab8
add eax, r8d
add eax, ecx
sub eax, 0x3224ef6
movabs rcx, 0x4000000000000000
and rcx, qword [rdx]
cmp rcx, 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x8014628d
jae 0x14006a3bb
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x14006a315
jmp 0x14006a3b6
mov eax, dword [0x140219538]
and eax, dword [0x14021953c]
add eax, 0xdeafd10d
sub eax, 0x742612ee
imul eax, eax, 0x4dac481d
cmp eax, 0xdd8df9ee
jae 0x14006a3c4
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x140219540]
mov edx, dword [0x140219544]
xor edx, 0xb7e453d7
imul eax, edx
mov r8d, 0x171e43be
xor edx, edx
div r8d
mov edx, 0xa5ac9e09
xor edx, 0xbff656ca
xor eax, edx
sub eax, 0x2aa7efb3
mov dword [rsp + 0x28], eax
mov eax, 0xc1154ab7
xor eax, 0x4ed709b4
mov dword [rsp + 0x24], eax
movabs rdx, 0x148c39e6e80053dc
movabs rax, 0x148c39e6e80053d4
xor rdx, rax
call fcn.14001091d
mov ecx, dword [rsp + 0x24]
mov eax, dword [rsp + 0x28]
cmp eax, ecx
je 0x14006a33c
jmp 0x14006a3b6
add rsp, 0x38
ret
lodsd eax, dword [rsi]
xchg edx, eax
jmp 0x14006a241
add ecx, 0x77
cmp cl, ch
outsd dx, dword [rsi]
invalid
Function at 0x14006c3b4
Capabilities:
Get thread local storage value

Disassembly:
mov rax, qword [0x14022dd30]
mov ecx, dword [rax]
jmp fcn.140008650
Function at 0x14006e400
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov word [rbp - 2], cx
mov eax, dword [0x140219748]
xor eax, 0x56cb6d0e
mov ecx, dword [0x14021974c]
xor ecx, 0x86f2716a
add eax, ecx
mov ecx, 0xce664d44
xor edx, edx
div ecx
mov ecx, 0xf98367fc
xor ecx, 0xd01621f3
xor eax, ecx
mov ecx, 0xd7b0f54c
xor ecx, 0xf3bf959f
and eax, ecx
cmp eax, 0xcd01248a
ja 0x14006e622
mov edx, dword [0x140219750]
mov ecx, dword [0x140219754]
mov eax, ecx
xor eax, edx
xor eax, 0xfa8b48c7
xor ecx, 0x574b738
and edx, ecx
add edx, edx
sub edx, eax
mov eax, edx
not eax
or edx, 0xca923dd4
or eax, 0x356dc22b
and edx, eax
mov eax, edx
not eax
mov ecx, eax
and ecx, 0x1f8f141e
xor edx, 0x1f8f141e
add eax, edx
sub eax, ecx
and eax, 0xf901f9b3
mov dword [rbp - 0xc], eax
mov eax, 0x10
call fcn.140215890
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
sub rsp, 0x20
call fcn.14006cf69
mov cx, word [rbp - 2]
add rsp, 0x20
mov rdx, rax
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x18], rdx
movabs rdx, 0xebfd61a5e81b22c
movabs r8, 0xebfd61a5e81b22c
xor rdx, r8
mov qword [rax], rdx
mov rax, qword [0x14023df88]
mov qword [rbp - 0x28], rax
movsx rcx, cx
add rax, 8
shl rcx, 4
add rax, rcx
add rax, 8
mov rcx, qword [rax]
mov qword [rbp - 0x20], rcx
add rcx, 9
sub rsp, 0x20
call fcn.14006d495
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov dx, ax
mov eax, dword [rbp - 0xc]
mov word [rbp - 6], dx
mov cl, byte [rcx]
mov dl, 0x12
xor dl, 0x12
cmp cl, dl
sete cl
mov byte [rbp - 3], cl
cmp eax, 0x1d366824
jbe 0x14006e455
mov cl, byte [rbp - 3]
xor eax, eax
test cl, 1
mov qword [rbp - 0x38], rax
jne 0x14006e564
jmp 0x14006e619
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
mov dx, word [rbp - 6]
movsx rdx, dx
mov qword [rbp - 0x48], rdx
cmp byte [rcx + 8], 0x27
mov qword [rbp - 0x40], rax
jne 0x14006e5d9
mov cx, word [rbp - 2]
mov rdx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x28]
add rax, 8
shl rdx, 4
add rax, rdx
add rax, 8
mov r8, qword [rax]
add r8, 8
sub rsp, 0x20
call fcn.14006d510
mov rax, qword [rbp - 0x18]
add rsp, 0x20
mov cl, byte [rax]
mov dl, 0xc9
xor dl, 0xc9
xor eax, eax
cmp cl, dl
mov qword [rbp - 0x38], rax
jne 0x14006e619
mov rax, qword [0x14023df88]
mov qword [rbp - 0x40], rax
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x40]
add rax, 8
shl rdx, 4
add rax, rdx
add rax, 8
mov rdx, qword [rax]
add rdx, 8
mov r8d, 8
sub rsp, 0x20
call fcn.14006dd6f
mov rax, qword [rbp - 0x30]
add rsp, 0x20
mov rax, qword [rax]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x38]
mov rsp, rbp
pop rbp
ret
fld dword [rax]
mov edi, dword [rsi - 0x1d517]
dec dword [rdi]
invalid
Function at 0x14006fb90
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 0x10], r8
mov word [rbp - 2], cx
mov eax, dword [0x140219818]
and eax, dword [0x14021981c]
mov ecx, 0xfda8c752
xor edx, edx
div ecx
imul eax, eax, 0x13210df9
mov ecx, 0xd4c53ae1
xor ecx, 0xf2925fb3
and eax, ecx
cmp eax, 0xe5ded380
ja 0x14006fdf5
mov ecx, dword [0x140219820]
mov edx, dword [str.1A]
xor ecx, 0xa442e91c
xor edx, 0x282b796d
mov eax, ecx
or eax, edx
not eax
and ecx, edx
or eax, ecx
xor eax, 0x95985c62
mov ecx, 0x92f83c19
imul rax, rcx
shr rax, 0x3f
mov ecx, eax
mov edx, ecx
add edx, edx
mov eax, ecx
neg edx
mov ecx, edx
lea eax, [rax + rcx - 0x7e8faafd]
mov dword [rbp - 0x18], eax
mov eax, 0x20
call fcn.140215890
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
sub rsp, 0x20
call fcn.14006f83d
mov cx, word [rbp - 2]
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov rax, qword [0x14023df98]
mov qword [rbp - 0x38], rax
movsx rcx, cx
mov qword [rbp - 0x30], rcx
add rax, 8
shl rcx, 4
add rax, rcx
add rax, 8
mov rcx, qword [rax]
mov qword [rbp - 0x28], rcx
add rcx, 0xa
sub rsp, 0x20
call fcn.14006fb61
mov rcx, qword [rbp - 0x20]
add rsp, 0x20
mov dl, al
mov eax, dword [rbp - 0x18]
mov byte [rbp - 0x12], dl
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0x28be81ef
jb 0x14006fbd5
mov al, byte [rbp - 0x11]
test al, 1
jne 0x14006fcb2
jmp 0x14006fdac
mov rcx, qword [rbp - 0x28]
add rcx, 0x12
sub rsp, 0x20
call fcn.14006fb61
add rsp, 0x20
mov byte [rbp - 0x41], al
cmp al, 0xe0
jne 0x14006fcf7
mov rax, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x38]
add rcx, 8
shl rax, 4
add rcx, rax
sub rsp, 0x20
call fcn.14006fdfe
add rsp, 0x20
jmp 0x14006fdcf
mov rcx, qword [rbp - 0x28]
add rcx, 0x11
sub rsp, 0x20
call fcn.14006fb61
mov r8, qword [rbp - 0x28]
mov r10, qword [rbp - 0x10]
mov r9b, byte [rbp - 0x12]
mov cl, byte [rbp - 0x41]
add rsp, 0x20
mov dl, al
mov rax, qword [rbp - 0x40]
add r8, 0x13
mov qword [rax], r10
mov byte [rax + 8], r9b
mov qword [rax + 0x10], r8
movzx edx, dl
mov dword [rax + 0x18], edx
mov rax, qword [0x14022dd08]
mov rax, qword [rax + 8]
movzx ecx, cl
mov edx, ecx
mov rcx, rax
add rcx, 8
imul r8, rdx, 0x48
add rcx, r8
add rcx, 0x38
add rax, 8
imul rdx, rdx, 0x48
add rax, rdx
add rax, 0x40
mov rax, qword [rax]
mov qword [rbp - 0x58], rax
mov rcx, qword [rcx]
mov qword [rbp - 0x50], rcx
cmp rax, 0
je 0x14006fd9a
mov rax, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x40]
sub rsp, 0x20
call rax
add rsp, 0x20
jmp 0x14006fdac
mov rax, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x40]
sub rsp, 0x20
call rax
add rsp, 0x20
mov rax, qword [rbp - 0x30]
mov rcx, qword [0x14023df98]
add rcx, 8
shl rax, 4
add rcx, rax
sub rsp, 0x20
call fcn.14006fdfe
add rsp, 0x20
mov rcx, qword [rbp - 0x30]
mov rax, qword [0x14023df98]
add rax, 8
shl rcx, 4
add rax, rcx
add rax, 8
mov rax, qword [rax]
mov byte [rax + 0x10], 0x2c
mov rsp, rbp
pop rbp
ret
mov edx, 0xe90ae0e3
xlatb
std
invalid
Function at 0x14007353a
Capabilities:
Get thread local storage value

Disassembly:
mov rax, qword [0x14022dd30]
mov ecx, dword [rax]
jmp fcn.140008650
Function at 0x1400756c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x140219bb8]
mov ecx, dword [0x140219bbc]
xor ecx, 0xed0ddef1
add eax, ecx
xor eax, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x49c99cd5
mov edx, 0xffffffff
xor edx, 0xfa2b4ab8
or eax, ecx
mov ecx, 0xa39cc69d
xor ecx, 0x59b78c25
or ecx, edx
xor eax, 0xffffffff
and eax, ecx
mov ecx, 0x59c7e346
xor ecx, 0x28a16a3
add eax, ecx
mov edx, eax
xor edx, 0xb21d7727
xor edx, 0xffffffff
mov ecx, 0x81b605d9
xor ecx, 0x33ab72fe
and ecx, edx
shl ecx, 1
sub ecx, 0xb21d7727
sub eax, ecx
cmp eax, 0xd36ce649
jb 0x140075827
mov rcx, qword [rbp - 0x10]
mov eax, dword [0x140219bc0]
xor eax, 0x2c75e305
mov edx, dword [0x140219bc4]
add eax, edx
imul eax, eax, 0x89c5ade2
add eax, 0xf848772a
or eax, 0xb49872e0
mov dword [rbp - 0x18], eax
mov eax, 0xad64f719
mov dword [rbp - 0x1c], eax
mov eax, 0x10
mov qword [rbp - 0x40], rax
call fcn.140215890
sub rsp, rax
mov rax, qword [rbp - 0x40]
mov rdx, rsp
mov qword [rbp - 0x30], rdx
call fcn.140215890
sub rsp, rax
mov rax, qword [rbp - 0x30]
mov rdx, rsp
mov qword [rbp - 0x38], rdx
mov qword [rax], rcx
sub rsp, 0x20
call fcn.1400741ed
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
add rsp, 0x20
mov qword [rbp - 0x28], rax
mov qword [rcx], 0
sub rsp, 0x20
call fcn.140075830
mov rdx, qword [rbp - 0x28]
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x18]
add rsp, 0x20
cmp byte [rdx], 0
sete dl
mov byte [rbp - 0x11], dl
cmp eax, ecx
jbe 0x14007574e
mov al, byte [rbp - 0x11]
test al, 1
jne 0x14007580a
jmp 0x140075822
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x38]
mov rdx, qword [rax]
sub rsp, 0x20
call fcn.140038880
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
fisubr word [rbp + 8]
jmp 0x14007574e
Function at 0x140076960
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], rcx
mov ecx, dword [0x140219c68]
mov eax, dword [0x140219c6c]
add ecx, 0xaa1252cd
add ecx, eax
sub ecx, 0xaa1252cd
and ecx, 0xb43be478
mov edx, 0x57456335
xor edx, 0xf05e6b0f
mov eax, ecx
and eax, edx
or ecx, 0xa71b083a
add eax, ecx
sub eax, 0xb5c9c12c
mov ecx, 0xe5fd1e43
xor ecx, 0x8a6d713d
cmp eax, ecx
je 0x140076ad7
mov edx, dword [0x140219c70]
mov eax, dword [0x140219c74]
sub edx, eax
mov ecx, edx
xor ecx, 0x5411ad7e
xor edx, 0x820a5081
and edx, 0xd21b7191
mov eax, ecx
and eax, 0x2de48e6e
imul eax, edx
mov edx, ecx
and edx, 0xd21b7191
or ecx, 0xd21b7191
imul ecx, edx
add ecx, eax
mov eax, ecx
and eax, 0x1dbaca09
or ecx, 0x1dbaca09
add eax, ecx
mov dword [rbp - 0x10], eax
mov eax, 0x10
mov qword [rbp - 0x30], rax
call fcn.140215890
sub rsp, rax
mov rax, qword [rbp - 0x30]
mov rcx, rsp
mov qword [rbp - 0x20], rcx
call fcn.140215890
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.1400741ed
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov rdx, rax
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x18], rdx
mov dx, 0x16cf
xor dx, 0x16cf
mov word [rax], dx
sub rsp, 0x20
call fcn.140037f80
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov dx, ax
mov eax, dword [rbp - 0x10]
mov word [rbp - 0xc], dx
cmp byte [rcx], 0
sete cl
mov byte [rbp - 9], cl
cmp eax, 0x8b0a152
jb 0x1400769bd
mov cl, byte [rbp - 9]
xor eax, eax
test cl, 1
mov word [rbp - 0x32], ax
jne 0x140076aa7
jmp 0x140076ace
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x28]
mov ax, word [rbp - 0xc]
mov word [rdx], ax
sub rsp, 0x20
call fcn.140074510
mov rax, qword [rbp - 0x20]
add rsp, 0x20
mov ax, word [rax]
mov word [rbp - 0x32], ax
mov ax, word [rbp - 0x32]
mov rsp, rbp
pop rbp
ret
clc
out 0x4f, eax
call fcn.1400648c8
call qword [rbp + 0x48]
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x20], rcx
push 0x10
pop rax
mov qword [rbp - 0x30], rax
call fcn.140215890
sub rsp, rax
mov rax, qword [rbp - 0x30]
mov rcx, rsp
mov qword [rbp - 0x18], rcx
call fcn.140215890
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.1400741ed
mov rcx, qword [rbp - 0x20]
add rsp, 0x20
mov rdx, rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x10], rdx
mov edx, 0xe8309c1e
xor edx, 0xe8309c1e
mov dword [rax], edx
sub rsp, 0x20
call fcn.140038ab2
add rsp, 0x20
mov ecx, eax
mov rax, qword [rbp - 0x10]
mov dword [rbp - 8], ecx
mov cl, byte [rax]
mov dl, 0xfa
xor dl, 0xfa
xor eax, eax
cmp cl, dl
mov dword [rbp - 4], eax
jne 0x140076b8d
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x28]
mov eax, dword [rbp - 8]
mov dword [rdx], eax
sub rsp, 0x20
call fcn.1400745ed
mov rax, qword [rbp - 0x18]
add rsp, 0x20
mov eax, dword [rax]
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
mov rsp, rbp
pop rbp
ret
Function at 0x14007bb3c
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x140219ed8]
mov ecx, dword [0x140219edc]
mov edx, 0xcac81df
xor edx, 0x2c1e4396
xor ecx, edx
and eax, ecx
add eax, 0x4413d573
xor eax, 0x488761e1
mov ecx, 0x7e3103e7
xor ecx, 0xab473a57
add eax, ecx
cmp eax, 0x462198bb
jb 0x14007bb33
mov eax, dword [0x140219ee0]
sub eax, dword [0x140219ee4]
mov edx, 0xc3363a17
xor edx, 0x258fce1c
mov ecx, eax
and ecx, edx
shl ecx, 1
xor eax, 0xe6b9f40b
add eax, ecx
imul eax, eax, 0x1a27824d
add eax, 0xd70421d
add eax, 0xaffbda5e
sub eax, 0xd70421d
mov dword [rsp + 0x30], eax
call fcn.1400741ed
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
call fcn.140077002
mov rcx, qword [rsp + 0x28]
mov eax, dword [rsp + 0x30]
mov cl, byte [rcx]
mov dl, 0x55
xor dl, 0x55
cmp cl, dl
sete cl
mov byte [rsp + 0x37], cl
cmp eax, 0xeac1d370
ja 0x14007b9bb
mov al, byte [rsp + 0x37]
test al, 1
jne 0x14007ba42
jmp 0x14007bb2d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.14007a47e
mov rax, qword [rsp + 0x28]
cmp byte [rax], 0
jne 0x14007bb2d
mov rcx, qword [rsp + 0x40]
call fcn.14007ad40
mov cl, al
mov rax, qword [rsp + 0x28]
mov byte [rsp + 0x27], cl
mov al, byte [rax]
mov cl, 0x22
xor cl, 0x22
cmp al, cl
jne 0x14007bb2d
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov al, byte [rsp + 0x27]
mov byte [rdx + 4], al
add rdx, 8
call fcn.14007a47e
mov rax, qword [rsp + 0x28]
cmp byte [rax], 0
jne 0x14007bb2d
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
add rdx, 0xc
call fcn.14007a47e
mov rax, qword [rsp + 0x28]
cmp byte [rax], 0
jne 0x14007bb2d
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
add rdx, 0x10
call fcn.14007aaec
mov rax, qword [rsp + 0x28]
mov al, byte [rax]
mov cl, 0x42
xor cl, 0x42
cmp al, cl
jne 0x14007bb2d
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
add rdx, 0x20
call fcn.14007aaec
mov rax, qword [rsp + 0x28]
mov al, byte [rax]
mov cl, 0xfa
xor cl, 0xfa
cmp al, cl
jne 0x14007bb2d
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
add rdx, 0x30
call fcn.14007b860
nop
add rsp, 0x48
ret
mov dword [rdx + 0x7fe9f69b], edi
invalid
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.1400741ed
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x14007b970

Function at 0x14007c5a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx