joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140086140
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
call fcn.14006d36b
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov edx, 2
call fcn.14006df20
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x1400863ae
mov eax, dword [0x140254168]
mov edx, dword [0x14025416c]
xor eax, 0xffffffff
mov ecx, 0xefcb8023
xor ecx, 0x10347fdc
xor edx, ecx
mov ecx, 0xffffffff
xor ecx, 0x578429e2
or eax, edx
or ecx, 0x578429e2
xor eax, 0xffffffff
and eax, ecx
mov ecx, 0x710cb3f6
xor ecx, 0xfa179a8f
xor edx, edx
div ecx
mov ecx, 0x2e42e03
xor edx, edx
div ecx
mov ecx, 0x923b433
xor ecx, 0x1de7c837
or eax, ecx
cmp eax, 0x868f65e6
jae 0x1400863b3
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x140254170]
xor edx, edx
div dword [0x140254174]
mov edx, eax
mov rax, qword [rsp + 0x30]
mov r8d, 0x4f0de891
xor r8d, 0x83b511a9
xor edx, r8d
or edx, 0xc9b7457b
mov r8d, 0x4dbc0657
xor r8d, 0x7e559a4c
xor edx, r8d
mov dword [rsp + 0x28], edx
mov edx, 0xded8c9bd
xor edx, 0xefb5540c
mov dword [rsp + 0x24], edx
mov rdx, qword [rax]
call fcn.14007aa50
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x24]
mov eax, dword [rsp + 0x28]
cmp byte [rdx], 0
sete dl
mov byte [rsp + 0x2f], dl
cmp eax, ecx
je 0x1400861d9
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x140086264
jmp 0x1400863ae
mov eax, dword [0x140254178]
xor edx, edx
div dword [0x14025417c]
and eax, 0xf306585b
mov edx, eax
xor edx, 0xffffffff
and edx, 0x903d9c8
mov r8d, 0xffffffff
xor r8d, 0x903d9c8
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x903d9c8
or eax, 0x903d9c8
imul eax, edx
add eax, ecx
xor eax, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x5c42956d
mov edx, 0xffffffff
xor edx, 0x9c63bd29
or eax, ecx
mov ecx, 0x394206b6
xor ecx, 0xa521bb9f
or ecx, edx
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0x7f737437
ja 0x1400863bc
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov r8d, dword [0x140254180]
mov edx, 0x5646c2e8
xor edx, 0x96866698
xor r8d, edx
mov r10d, dword [0x140254184]
mov edx, r8d
xor edx, 0xffffffff
mov r9d, r10d
and r9d, edx
mov r11d, r10d
xor r11d, 0xffffffff
mov edx, r8d
and edx, r11d
imul edx, r9d
mov r9d, r8d
and r9d, r10d
or r8d, r10d
imul r8d, r9d
add r8d, edx
mov edx, r8d
and edx, 0x8eef6aa
xor edx, 0xffffffff
xor r8d, 0xffffffff
mov r9d, 0x7111b5cf
xor r9d, 0x79ff4365
mov r10d, 0x522724dc
xor r10d, 0xadd8db23
xor r9d, r10d
or r8d, r9d
xor edx, 0xffffffff
xor r8d, 0xffffffff
or edx, r8d
sub edx, 0x1ee9dfe2
and edx, 0x45cc203
mov dword [rsp + 0x20], edx
mov rdx, qword [rax + 8]
mov qword [rsp + 0x48], rdx
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
call fcn.14007bb20
mov eax, dword [rsp + 0x20]
cmp eax, 0x7437b6d1
ja 0x1400862e1
jmp 0x1400863ae
add rsp, 0x58
ret
xor edx, edi
or al, al
jmp 0x1400861d9
scasb al, byte [rdi]
psrad mm4, qword [rbp - 0x17]
sbb al, 0xff
invalid
Function at 0x140086890
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006d36b
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov edx, 1
call fcn.14006df20
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
jne 0x1400868d4
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
call fcn.14007aa50
mov ecx, dword [0x1402541a8]
mov eax, dword [0x1402541ac]
xor eax, 0xabe88597
add ecx, eax
mov edx, ecx
xor edx, 0xffffffff
and edx, 0x56623fbf
mov r8d, 0xffffffff
xor r8d, 0x56623fbf
mov eax, ecx
and eax, r8d
imul eax, edx
mov edx, ecx
and edx, 0x56623fbf
or ecx, 0x56623fbf
imul ecx, edx
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0x4e734ec0
xor edx, 0xcadaf753
mov r8d, 0xba069c7c
xor r8d, 0x45f96383
xor edx, r8d
or eax, edx
and ecx, 0x84a9b993
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x98c6c823
xor ecx, 0x673937dc
xor eax, ecx
sub eax, 0xcfa98108
sub eax, 0x3babd921
add eax, 0xcfa98108
cmp eax, 0xe5db9e13
je 0x1400869a3
mov eax, dword [0x1402541b0]
xor edx, edx
div dword [0x1402541b4]
mov ecx, 0xfd2abd65
xor ecx, 0xf7054842
or eax, ecx
add eax, 0x987381a8
and eax, 0x452d1b30
cmp eax, 0x14c60644
ja 0x14008696e
add rsp, 0x38
ret
mov al, 1
seta cl
ret 0xffff
Function at 0x140087980
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov ecx, dword [0x140254268]
mov r8d, dword [0x14025426c]
mov eax, ecx
xor eax, 0xffffffff
mov edx, r8d
and edx, eax
mov eax, 0x24ab766d
xor eax, 0xdb548992
mov r9d, r8d
xor r9d, eax
mov eax, ecx
and eax, r9d
imul eax, edx
mov edx, ecx
and edx, r8d
or ecx, r8d
imul ecx, edx
add ecx, eax
xor ecx, 0x8140e9a
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x970d72f9
mov edx, 0x6f1ce0d7
xor edx, 0xf811922e
mov r8d, 0xdef8368f
xor r8d, 0x2107c970
xor edx, r8d
and ecx, edx
or eax, ecx
sub eax, 0x13f4c3ae
mov ecx, 0xfe1b0440
xor ecx, 0x4d6d6ba7
cmp eax, ecx
jb 0x140087b96
mov eax, dword [0x140254270]
mov ecx, dword [0x140254274]
xor eax, ecx
imul eax, eax, 0xd105ad9c
add eax, 0xc1add976
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xcff4c1cc
and ecx, 0x300b3e31
imul ecx, edx
mov edx, eax
and edx, 0x300b3e32
or eax, 0x300b3e33
imul eax, edx
add eax, ecx
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.14006d36b
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov edx, 1
sub rsp, 0x20
call fcn.14006df20
mov rcx, qword [rbp - 0x20]
mov eax, dword [rbp - 0x18]
add rsp, 0x20
mov cl, byte [rcx]
mov dl, 0x62
xor dl, 0x62
cmp cl, dl
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0x628b0fde
je 0x140087a15
mov al, byte [rbp - 0x11]
test al, 1
jne 0x140087ac4
jmp 0x140087aeb
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14007bb20
add rsp, 0x20
mov eax, dword [0x140254278]
mov ecx, dword [0x14025427c]
xor ecx, 0xffffffff
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
add eax, 0x82db5e2d
mov ecx, 0x8a845b87
xor ecx, 0xa2e89cad
imul eax, ecx
mov ecx, 0x5f734b12
xor ecx, 0xfdd81c43
xor edx, edx
div ecx
mov ecx, 0x20f6dc75
xor ecx, 0x7120369a
cmp eax, ecx
ja 0x140087b9f
mov ecx, dword [0x140254280]
xor ecx, 0x8bc76d3d
or ecx, dword [0x140254284]
mov eax, ecx
and eax, 0x9ae0ae60
mov edx, 0x34aed88d
xor edx, 0xae4e76ed
or ecx, edx
add eax, ecx
mov ecx, 0xa859b49a
xor ecx, 0x9c198b59
xor edx, edx
div ecx
mov ecx, 0xecc4eff3
xor ecx, 0x1b4448bc
xor edx, edx
div ecx
sbb esi, dword [rcx]
sal bh, cl
int1
mov ecx, 0xeaa4835c
xor ecx, 0x191e6f46
cmp eax, ecx
je 0x140087b38
mov rsp, rbp
pop rbp
ret
invalid
loop 0x140087b79
invalid
Function at 0x14008f530
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.14008f267
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.14008f290
test al, 1
jne 0x14008f55a
jmp 0x14008f581
mov rcx, qword [rsp + 0x28]
call fcn.14008f0e0
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
jne 0x14008f581
mov rcx, qword [rsp + 0x28]
mov edx, 8
call fcn.14000ea9a
mov eax, dword [0x140254618]
xor edx, edx
div dword [0x14025461c]
mov ecx, eax
mov eax, ecx
and eax, eax
xor eax, 0xffffffff
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x9e9bffd1
or eax, edx
mov edx, 0xa6a583e9
xor edx, 0x383e7c38
mov r8d, 0x1bc66f4b
xor r8d, 0xe43990b4
xor edx, r8d
mov r8d, 0xdc70b0bd
xor r8d, 0x42eb4f6c
mov r9d, 0xcdf15fc5
xor r9d, 0x320ea03a
xor r8d, r9d
or edx, r8d
and ecx, edx
mov edx, 0x15c446e5
xor edx, 0xea3bb91a
xor ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov r8d, 0xabe70c81
xor r8d, 0xb7e6bc59
mov ecx, 0x2d593130
xor ecx, 0xd2a6cecf
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0xd9bf7a3c
xor r8d, 0xc5becae4
mov edx, eax
and edx, r8d
or eax, 0x1c01b0d8
imul eax, edx
add eax, ecx
mov edx, 0x4ce315c
xor edx, 0xf89aaf7e
mov ecx, 0x35cfda8b
xor ecx, 0xca302574
xor edx, ecx
mov ecx, eax
and ecx, edx
mov r8d, 0xd97911fa
xor r8d, 0x252d8fd8
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
cmp eax, 0x366d58f7
je 0x14008f6ba
mov eax, dword [0x140254620]
xor eax, 0x2d421da5
xor eax, dword [0x140254624]
imul eax, eax, 0x5efe9260
imul eax, eax, 0x17975def
mov ecx, 0x810c5e7d
xor ecx, 0x358226ed
xor edx, edx
div ecx
cmp eax, 0xdcb7e885
je 0x14008f67e
add rsp, 0x38
ret
and byte [0xfbf2cf1e], ch
invalid
Function at 0x14009cfe0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], rcx
mov byte [rbp - 1], r8b
mov eax, dword [0x140254c08]
mov ecx, 0xa9d4664e
xor ecx, 0x741f08aa
xor eax, ecx
mov ecx, dword [0x140254c0c]
mov edx, 0x28324f23
xor edx, 0xcb70b821
add eax, edx
add eax, ecx
sub eax, 0xe342f702
mov ecx, 0xc0b51c4f
xor edx, edx
div ecx
mov ecx, 0xe22d4971
xor ecx, 0x71d163b6
sub eax, ecx
mov ecx, 0x47cb53b2
xor ecx, 0x9958f0ac
xor eax, ecx
mov ecx, 0xbd3ffa73
xor ecx, 0x300e29e
cmp eax, ecx
jae 0x14009d125
mov eax, dword [0x140254c10]
xor eax, 0xbae0dc2f
mov ecx, dword [0x140254c14]
xor ecx, 0x9cb7dc00
sub eax, ecx
mov edx, eax
and edx, 0x4b9bb097
or eax, 0x4b9bb097
add edx, eax
mov eax, edx
and eax, 0x67c747f1
xor edx, 0x67c747f1
mov ecx, eax
mov eax, edx
lea eax, [rax + rcx*2 + 0x2a1e1dc7]
mov dword [rbp - 0x24], eax
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
sub rsp, 0x20
call fcn.14009b3db
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov rax, qword [rbp - 0x20]
mov qword [rcx], 0
mov qword [rcx + 8], 0
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140019410
mov dl, byte [rbp - 1]
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
and dl, 1
sub rsp, 0x20
call fcn.140099770
mov eax, dword [rbp - 0x24]
add rsp, 0x20
cmp eax, 0xfe058647
jae 0x14009d05d
mov rax, qword [rbp - 0x10]
mov rsp, rbp
pop rbp
ret
mov ebp, 0xe9d32e44
invalid
Function at 0x14009ff50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
call fcn.14009e034
mov rcx, qword [rsp + 0x40]
cmp rcx, 0
je 0x1400a012b
mov rax, qword [rsp + 0x40]
movabs rcx, 0x717b270971ee64fa
movabs rdx, 0x8e84d8f68e119b0a
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp rax, 0x10
jb 0x1400a0107
mov rdx, qword [rsp + 0x38]
movabs rax, 0x89210ee41c676b2f
movabs rcx, 0x76def11be39894df
xor rax, rcx
mov rcx, rdx
and rcx, rax
shl rcx, 1
mov rax, rdx
xor rax, 0xfffffffffffffff0
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, rdx
movabs rdx, 0xb72fdbf7f7d28ef2
movabs r8, 0xb72fdbf7f7d28ef2
xor rdx, r8
cmp rcx, rdx
setl dl
cmp rax, 0xffffffffffffffff
setg al
mov cl, al
xor cl, dl
xor cl, 0xff
or al, dl
and al, cl
test al, 1
jne 0x1400a001a
jmp 0x1400a00e0
mov eax, dword [0x140254d08]
mov ecx, 0xbfcf8cda
xor ecx, 0xdad140f8
xor eax, ecx
sub eax, dword [0x140254d0c]
mov r8d, 0xd19b0d27
xor r8d, 0xb62a60e5
mov ecx, 0xfd7bc118
xor ecx, 0x2843ee7
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x67b16dc2
or eax, 0x67b16dc2
imul eax, edx
add eax, ecx
and eax, 0x29dbd017
mov ecx, 0x9cc91cb0
xor ecx, 0x67782ab
or eax, ecx
cmp eax, 0x90c08e2a
jb 0x1400a0131
mov eax, dword [0x140254d10]
mov ecx, dword [0x140254d14]
mov edx, 0x729975c2
xor edx, 0x815713be
xor ecx, edx
add eax, ecx
mov ecx, 0x8b2fa062
xor ecx, 0x27656cdd
xor eax, ecx
and eax, 0x882982d5
mov ecx, 0x3c6b8446
xor edx, edx
div ecx
mov dword [rsp + 0x24], eax
call fcn.140007e9d
mov eax, dword [rsp + 0x24]
cmp eax, 0xb86bd1ff
jae 0x1400a008d
jmp 0x1400a012b
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov r8, qword [rax]
mov cl, 1
xor cl, 1
and cl, 1
call fcn.14000fec7
jmp 0x1400a012b
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rax]
mov cl, 1
xor cl, 0
and cl, 1
call fcn.14000fec7
mov rcx, qword [rsp + 0x40]
call fcn.14000ffc0
nop
add rsp, 0x48
ret
jrcxz 0x1400a0157
xchg esp, eax
sbb eax, 0xffff53e9
jmp qword [rsi + 0xf]
and al, 0x48
Function at 0x1400acff0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x10], rdx
mov dword [rbp - 4], ecx
mov r8d, dword [0x140255190]
mov edx, dword [str.e_z]
xor edx, 0x70a5e140
mov eax, r8d
xor eax, 0xffffffff
and eax, 0x21609ec0
mov r9d, 0xffffffff
xor r9d, 0x21609ec0
and r8d, r9d
mov ecx, edx
xor ecx, 0xffffffff
and ecx, 0x21609ec0
and edx, r9d
or eax, r8d
or ecx, edx
xor eax, ecx
mov ecx, 0xffffffff
xor ecx, 0xfcb3e19e
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
add eax, 0x200bedd1
mov edx, 0x23ac2469
xor edx, 0xdc53db96
mov ecx, eax
xor ecx, edx
and ecx, 0xdf95d761
mov edx, 0xffffffff
xor edx, 0xdf95d761
and eax, edx
sub eax, ecx
cmp eax, 0xdc364590
jae 0x1400ad27a
mov eax, dword [0x140255198]
mov ecx, dword [0x14025519c]
xor ecx, 0xaa4ac0fd
sub eax, ecx
mov edx, eax
not edx
or edx, 0x7d98e869
mov ecx, eax
mov eax, edx
lea eax, [rax + rcx + 1]
or eax, 0xb7fffcdf
mov dword [rbp - 0x24], eax
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
sub rsp, 0x20
call fcn.1400acb00
mov ecx, dword [rbp - 4]
add rsp, 0x20
mov rdx, rax
mov eax, dword [rbp - 0x24]
mov qword [rbp - 0x20], rdx
cmp ecx, 0
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0xc9cd6f56
jae 0x1400ad08c
mov al, byte [rbp - 0x11]
test al, 1
jne 0x1400ad275
jmp 0x1400ad10c
mov eax, dword [0x1402551a0]
xor edx, edx
div dword [0x1402551a4]
or eax, 0x618e802f
mov ecx, eax
add ecx, 1
mov edx, 0x6fbd0a
xor edx, 0xff9042f5
xor eax, edx
mov edx, 0x152c8b31
xor edx, 0x62122892
or eax, edx
add eax, ecx
mov ecx, 0x41734e84
xor ecx, 0x92778558
xor edx, edx
div ecx
cmp eax, 0x60ceb8d1
je 0x1400ad283
mov ecx, dword [rbp - 4]
mov eax, dword [0x1402551a8]
mov r8d, dword [0x1402551ac]
xor r8d, 0x376ddf8e
xor edx, edx
div r8d
mov rdx, qword [rbp - 0x30]
mov r8d, eax
mov rax, qword [rbp - 0x10]
and r8d, r8d
xor r8d, 0xffffffff
mov r9d, 0x2783c30f
and r9d, 0x2783c30f
xor r9d, 0xffffffff
and r8d, r9d
xor r8d, 0xffffffff
mov r9d, r8d
and r9d, 0xaa839f07
shl r9d, 1
xor r8d, 0xaa839f07
add r8d, r9d
mov r9d, 0x8b16dc0b
xor r9d, 0x8391738d
sub r8d, r9d
mov dword [rbp - 0x44], r8d
mov r8d, 0x4a4022ee
xor r8d, 0x24fd517b
mov dword [rbp - 0x48], r8d
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.1400ac87a
mov rdx, qword [rbp - 0x20]
mov ecx, dword [rbp - 0x48]
add rsp, 0x20
mov r8, rax
mov eax, dword [rbp - 0x44]
mov qword [rbp - 0x40], r8
mov dl, byte [rdx]
mov r8b, 0x19
xor r8b, 0x19
cmp dl, r8b
sete dl
mov byte [rbp - 0x31], dl
cmp eax, ecx
je 0x1400ad15a
mov al, byte [rbp - 0x31]
test al, 1
jne 0x1400ad233
jmp 0x1400ad275
mov rcx, qword [rbp - 0x40]
movabs rax, 0xd3ab6f1b8efac137
movabs rdx, 0xd3ab6f1ba32a1824
xor rax, rdx
lea rdx, [0x140267920]
lea r8, [0x14026792f]
lea r9, [0x14026793c]
sub rsp, 0x30
mov qword [rsp + 0x20], rax
call fcn.1400127b0
add rsp, 0x30
mov rsp, rbp
pop rbp
ret
xchg ebp, eax
iretd
sub dword [0x10ef42b12], esp
invalid
Function at 0x1400b8ad0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x58], r8
mov dword [rsp + 0x64], edx
mov qword [rsp + 0x68], rcx
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0xe8]
mov dword [rsp + 0x7c], eax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x80], rax
mov eax, dword [rsp + 0xd8]
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0xd0]
mov dword [rsp + 0x8c], eax
mov eax, dword [0x140255560]
xor eax, 0xa4dbddc0
mov ecx, dword [0x140255564]
xor ecx, 0x41734e84
xor edx, edx
div ecx
mov r11d, eax
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, 0x376ddf8e
xor r8d, 0x80882baa
mov eax, 0x32f4788c
xor eax, 0xcd0b8773
xor r8d, eax
mov edx, 0xcebd4dd1
xor edx, 0xd92e97b1
mov eax, 0x71ffa20c
xor eax, 0x8e005df3
xor edx, eax
mov eax, ecx
and eax, 0x1793da60
and r11d, edx
mov r9d, r8d
and r9d, 0x1793da60
mov r10d, edx
and r10d, 0xb7e5f424
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
mov r8d, 0x2dca0f64
xor r8d, 0xd235f09b
xor ecx, r8d
or edx, 0x1793da60
and ecx, edx
or eax, ecx
mov ecx, 0x4e3dafcc
xor edx, edx
div ecx
mov ecx, 0x88fcef21
xor edx, edx
div ecx
mov ecx, 0xd1c30119
xor ecx, 0xb28118d4
cmp eax, ecx
jae 0x1400b8c8f
mov esi, dword [rsp + 0x88]
mov edi, dword [rsp + 0x8c]
mov eax, dword [0x140255568]
mov ecx, dword [0x14025556c]
xor ecx, 0x8efac137
add eax, ecx
or eax, 0xd8cc2e
xor eax, 0xfabb84e5
and eax, 0xfa2c3c66
mov dword [rsp + 0x48], eax
call fcn.1400b88f0
mov rcx, qword [rsp + 0x68]
mov edx, dword [rsp + 0x64]
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x50]
mov r11, qword [rsp + 0x80]
mov r10d, dword [rsp + 0x7c]
mov rax, qword [rsp + 0x70]
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x38], r10d
mov qword [rsp + 0x40], rax
call qword [0x14027b398]
mov ecx, eax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x4c], ecx
cmp eax, 0x5f10cac3
je 0x1400b8bef
mov eax, dword [rsp + 0x4c]
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
jns 0x1400b8ce0
add dword [rcx + rbp*8 - 0xa9], eax
nop dword [rax + rax]
add byte [rcx - 0x6069e20e], 0xfb
Function at 0x1400c4d90
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x40], rcx
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x38], rax
sub rsp, 0x20
call fcn.1400dcc05
mov rdx, qword [rbp - 0x30]
add rsp, 0x20
mov qword [rbp - 0x20], rax
add rax, 0x50
mov qword [rbp - 0x28], rax
mov rax, qword [rdx]
mov qword [rbp - 0x10], rax
mov rax, qword [rdx + 8]
mov qword [rbp - 8], rax
lea rcx, [rbp - 0x10]
sub rsp, 0x20
call fcn.1400c8b01
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x18], rcx
cmp byte [rax + 0x50], 0
jne 0x1400c4ff9
mov eax, dword [0x140255a20]
mov r8d, dword [0x140255a24]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x2497c153
xor ecx, 0x1906c12b
and eax, ecx
or eax, 0xe850e5f5
and eax, 0xaa13b9f9
cmp eax, 0x6482cfd3
je 0x1400c5002
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x30]
mov edx, dword [0x140255a28]
mov r9d, dword [str._M_]
xor r9d, 0x1a2b1f1a
mov r8d, edx
and r8d, r9d
shl r8d, 1
xor edx, r9d
add edx, r8d
mov r8d, 0xd15cc8a0
xor r8d, 0xe45a92ee
xor edx, r8d
or edx, 0xcc31ae40
xor r8d, r8d
sub r8d, edx
xor edx, edx
sub edx, 0xd199ecef
add r8d, edx
mov edx, 0x71728019
xor edx, 0x71728019
sub edx, r8d
mov dword [rbp - 0x5c], edx
mov edx, 0xec3b720b
xor edx, 0xafbee029
mov dword [rbp - 0x60], edx
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.1400c8995
mov rdx, qword [rbp - 0x28]
mov ecx, dword [rbp - 0x60]
add rsp, 0x20
mov r8, rax
mov eax, dword [rbp - 0x5c]
mov qword [rbp - 0x58], r8
cmp byte [rdx], 0
sete dl
mov byte [rbp - 0x49], dl
cmp eax, ecx
je 0x1400c4e5f
mov al, byte [rbp - 0x49]
test al, 1
jne 0x1400c4f1e
jmp 0x1400c4ff9
mov rax, qword [rbp - 0x58]
cmp rax, 0
jge 0x1400c4fe0
mov eax, dword [0x140255a30]
xor eax, 0x9c30537f
mov ecx, dword [0x140255a34]
xor ecx, 0x649a28b
and eax, ecx
xor eax, 0x5a1128b7
mov ecx, 0x548a0a9c
xor ecx, 0x69fa8781
xor eax, ecx
imul eax, eax, 0x7680a60f
cmp eax, 0x33f45d7c
je 0x1400c500b
mov rcx, qword [rbp - 0x58]
mov eax, dword [0x140255a38]
and eax, dword [0x140255a3c]
sub eax, 0x96bfed95
mov edx, 0x62f4558
xor edx, 0x51d76b39
xor eax, edx
sub eax, 0x521a8f91
mov dword [rbp - 0x64], eax
movabs rdx, 0x961721f11655503c
movabs rax, 0x961721f11655503c
xor rdx, rax
movabs r8, 0x542456f56857e12
movabs rax, 0x7abdba90a97a81ed
xor r8, rax
sub rsp, 0x20
call fcn.14000cee2
mov eax, dword [rbp - 0x64]
add rsp, 0x20
cmp eax, 0x51a36d26
jb 0x1400c500b
jmp 0x1400c4ff9
mov r8, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x48]
sub rsp, 0x20
call fcn.1400a7a10
add rsp, 0x20
mov rax, qword [rbp - 0x40]
mov rsp, rbp
pop rbp
ret
fnsave dword [rbx]
retf
or dword [rax + 0x3b], eax
invalid
Function at 0x1400e0170
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1402566f8]
mov edx, dword [0x1402566fc]
xor edx, 0x217ce146
mov eax, 0xf11800d4
xor eax, 0xee7ff2b
mov r8d, ecx
xor r8d, eax
mov eax, edx
and eax, r8d
xor edx, 0xffffffff
and ecx, edx
or eax, ecx
mov ecx, 0x2572e5a4
xor edx, edx
div ecx
mov ecx, 0x2d35eae9
xor edx, edx
div ecx
mov ecx, eax
and ecx, 0xcf41cd4b
xor ecx, 0xffffffff
mov edx, 0x6021e1a7
xor edx, 0xaf602cec
add eax, edx
add eax, 1
add eax, ecx
cmp eax, 0xaee073c7
je 0x1400e0269
mov ecx, dword [0x140256700]
mov edx, dword [0x140256704]
mov eax, 0x850a230
xor eax, 0xf7af5dcf
xor edx, eax
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, eax
and ecx, 0x5e675ab8
shl ecx, 1
mov edx, 0x221ce791
xor edx, 0x7c7bbd29
xor eax, edx
add eax, ecx
mov ecx, 0xaccc2b84
xor edx, edx
div ecx
mov ecx, 0x88940032
xor edx, edx
div ecx
mov dword [rsp + 0x24], eax
mov eax, 0xf340afc4
xor eax, 0x99745f3d
mov dword [rsp + 0x20], eax
call fcn.1400e118c
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor r8d, r8d
call fcn.1400121c0
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
jae 0x1400e01dc
add rsp, 0x28
ret
invalid