joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400227f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14005c010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14005c8f8]
mov edi, ecx
cmp byte [rbx + 0x4a81], 0
jne 0x140022851
cmp byte [rbx + 0x4a82], 0
jne 0x140022851
movsx r9d, word [rbx + 0x5bbe]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140013030
test dil, 2
je 0x14002297f
jmp 0x1400228da
movss xmm1, dword [rbx + 0x3894]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5bbe]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400547c8]
mulss xmm1, dword [0x1400547b0]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xe00]
addss xmm1, dword [rbx + 0xe04]
mov qword [rbx + 0x47d0], rax
mov dword [rbx + 0x47bc], 1
movss dword [rbx + 0x47c8], xmm0
movss dword [rbx + 0x47cc], xmm1
movss xmm0, dword [rbx + 0x38f0]
mulss xmm0, dword [0x140054694]
or dword [rbx + 0x47b8], 0x41
movss dword [rbx + 0x4818], xmm0
call fcn.140013030
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140022930
lea r11, [0x14004e250]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x140022913
cmp byte [r8], r9b
jne 0x140022913
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140022900
not ecx
call fcn.140019910
test rax, rax
je 0x14002297f
cmp byte [rax + 0xb6], 0
je 0x14002297f
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, 0x10
inc word [rbx + 0x5bbe]
movsx r9d, word [rbx + 0x5bbe]
call fcn.140013030
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14001c170
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004a180
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400282e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5ca8], 0
lea rbx, [rcx + 0x5cb0]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140028387
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14002833a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14002a600
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140013c10
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5ca8]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5cb8]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14005c88e]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14002838f
mov rcx, rbx
call fcn.140013c10
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140028830
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x14005c8f8]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140028893
mov qword [rsp], rbx
lea rbx, [0x14004e250]
nop dword [rax]
cmp r9b, 0x23
jne 0x140028873
cmp byte [r8], r9b
jne 0x140028873
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140028860
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5c18]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x1400288c7
mov r10, qword [r10 + 0x5c20]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x1400288ce
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x1400288b4
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x14004a160
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 7
syscall
ret
Function at 0x1400012d7
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1401f0cb0]
mov dword [rax], 1
mov rax, qword [0x1401f0cc0]
mov dword [rax], 1
mov rax, qword [0x1401f0cd0]
mov dword [rax], 1
mov rax, qword [0x1401f0c20]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140001328
mov eax, 0
jmp 0x1400013d5
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140001354
mov eax, 0
jmp 0x1400013d5
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000137a
cmp eax, 0x20b
je 0x1400013a1
jmp 0x1400013d0
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000138d
mov eax, 0
jmp 0x1400013d5
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x1400013d5
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x1400013bc
mov eax, 0
jmp 0x1400013d5
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x1400013d5
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140006de0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rcx
call fcn.140009f59
mov rdx, qword [rsp + 0x40]
xor eax, eax
test rdx, rdx
cmovg rax, rdx
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov eax, dword [0x1401db3c8]
mov ecx, dword [0x1401db3cc]
mov edx, 0xb2bba59a
xor edx, 0x72a7b84
xor ecx, edx
xor edx, edx
div ecx
add eax, 0xd8d65b56
add eax, 0x43e292ae
sub eax, 0xd8d65b56
mov ecx, 0x2de56a9c
xor ecx, 0xd21a9563
mov edx, eax
xor edx, ecx
and edx, 0xbd2bb9c3
mov r8d, 0xffffffff
xor r8d, 0xbd2bb9c3
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xbd2bb9c3
or eax, 0xbd2bb9c3
imul eax, edx
add eax, ecx
and eax, 0x73dbc888
cmp eax, 0xb543cdb9
jae 0x14000702d
mov r8, qword [rsp + 0x48]
mov eax, dword [0x1401db3d0]
mov edx, dword [0x1401db3d4]
xor edx, 0xfdae909d
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
mov r9d, edx
and r9d, ecx
mov ecx, 0x30120944
xor ecx, 0x30120946
imul ecx, r9d
sub ecx, edx
sub eax, ecx
mov ecx, 0xc40b8684
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x30]
and eax, 0xb8d23ccc
mov ecx, eax
and ecx, 0x455c8efd
shl ecx, 1
mov r9d, 0x6a234a38
xor r9d, 0x2f7fc4c5
add eax, r9d
sub eax, ecx
mov ecx, 0x867861ac
xor ecx, 0xf31e54ea
cmp rdx, r8
sete dl
mov byte [rsp + 0x2f], dl
cmp eax, ecx
je 0x140006e8f
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x140007028
jmp 0x140006f24
mov eax, dword [0x1401db3d8]
mov r8d, dword [0x1401db3dc]
xor r8d, 0xf2c42833
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov ecx, 0xe611ab11
xor ecx, 0x19ee54ee
mov r9d, r8d
xor r9d, ecx
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
add eax, 0xb03c5354
and eax, 0x34671908
mov r8d, 0xffffffff
xor r8d, 0x6d16fa83
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x6d16fa83
mov r8d, 0xca6bd617
xor r8d, 0xa77d2c94
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x71ade13e
xor ecx, 0xec6973d2
cmp eax, ecx
ja 0x140007036
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401db3e0]
mov edx, dword [0x1401db3e4]
xor edx, 0x9eff8793
or eax, edx
or eax, 0xdb1428d6
mov r8d, 0xbe9d1b4f
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x38]
and eax, 0x9091813d
mov byte [rdx + rcx], 0
xor edx, edx
sub rdx, rcx
xor ecx, ecx
sub rcx, 1
add rdx, rcx
xor ecx, ecx
sub rcx, rdx
mov qword [rsp + 0x20], rcx
cmp eax, 0xd3e13e89
jae 0x140006fbf
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
jmp 0x140006e0d
add rsp, 0x58
ret
invalid
invalid
Function at 0x1400082a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rcx
mov eax, dword [0x1401db478]
mov r8d, dword [0x1401db47c]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xc174c382
xor edx, edx
div ecx
or eax, 0x703cba01
xor eax, 0x9f7c3956
mov ecx, 0xbc86ebd4
xor ecx, 0x594cc8b5
cmp eax, ecx
jb 0x1400084b7
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov eax, dword [0x1401db480]
mov r8d, dword [0x1401db484]
mov r9d, eax
and r9d, r8d
xor eax, r8d
or r9d, eax
mov r8d, r9d
xor r8d, 0xa7b66584
mov eax, 0xffffffff
xor eax, 0xa7b66584
and r9d, eax
mov eax, 0x90fb70a
xor eax, 0x90fb708
imul eax, r9d
sub eax, r8d
sub eax, 0xea42c790
or eax, 0x7836cee9
mov dword [rsp + 0x3c], eax
call fcn.14000785a
mov rcx, rax
mov eax, dword [rsp + 0x3c]
mov qword [rsp + 0x40], rcx
cmp rcx, 0
sete cl
mov byte [rsp + 0x4f], cl
cmp eax, 0x31c473bb
jb 0x14000830a
mov rax, qword [rsp + 0x40]
mov cl, byte [rsp + 0x4f]
test cl, 1
mov qword [rsp + 0x30], rax
jne 0x1400083a6
jmp 0x140008401
mov rcx, qword [rsp + 0x60]
mov edx, 0x50
call fcn.140007210
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
movabs r8, 0xb7918bdd8c9408a
movabs r9, 0xb7918bdd8c94075
xor r8, r9
mov r9, rcx
xor r9, r8
xor r9, 0xffffffffffffffff
mov r8, rcx
or r8, 0xff
and r8, r9
mov r9, qword [rdx + r8*8]
mov qword [rax], r9
mov qword [rdx + r8*8], rax
mov qword [rax + 8], rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov ecx, dword [0x1401db488]
mov edx, dword [0x1401db48c]
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, edx
xor ecx, 0xffffffff
xor edx, 0xffffffff
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
and eax, 0x49be3328
imul eax, eax, 0x89bd6c05
mov ecx, 0xe4ebb2cf
xor edx, edx
div ecx
cmp eax, 0xe7c99ff0
ja 0x1400084c0
mov eax, dword [0x1401db490]
mov ecx, dword [0x1401db494]
add eax, 0xadec3b24
add eax, ecx
sub eax, 0xadec3b24
mov ecx, 0x759b7e5
xor ecx, 0xe612d36d
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, 0x1c7b221d
xor eax, 0x1c7b221d
mov edx, 0xc66aa3cf
xor edx, 0xa20e3e87
sub eax, edx
add ecx, eax
mov eax, 0x8a34ddfc
xor eax, 0x8a34ddfc
sub eax, ecx
and eax, 0x9df8bd2b
cmp eax, 0x874444ac
ja 0x14000844f
mov rax, qword [rsp + 0x28]
add rsp, 0x68
ret
adc eax, dword [rbx + 0x4ae93a7f]
invalid
stosb byte [rdi], al
invalid

Function at 0x140009f36
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
call fcn.140009f59
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x68
add rsp, 0x28
jmp fcn.140009700
Function at 0x14000b580
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rcx
mov rax, qword [rdx + 8]
mov qword [rsp + 0x30], rax
sar rdx, 0xc
add rcx, 0x20a0
call fcn.14000af4a
mov r8, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov r10, qword [rax + 0x2078]
mov rdx, qword [rax + 0x2070]
mov r9, r10
sub r9, rdx
mov r9, rdx
cmovg r9, r10
mov qword [rax + 0x2078], r9
movabs r9, 0x5fcb5ac4a556ce5a
add rdx, r9
sub rdx, r8
movabs r8, 0x5fcb5ac4a556ce5a
sub rdx, r8
mov qword [rax + 0x2070], rdx
movabs rdx, 0xecbd3e1390cdbfe
movabs rax, 0xecbd3e1390cdbfe
xor rdx, rax
mov r8d, 0xa5697ade
xor r8d, 0xa569fade
call qword [sym.imp.KERNEL32.dll_VirtualFree]
cmp eax, 0
jne 0x14000b755
mov ecx, dword [0x1401db588]
mov edx, dword [0x1401db58c]
mov eax, ecx
xor eax, edx
mov r8d, 0x8ff3117b
xor r8d, 0x700cee84
xor eax, r8d
mov r8d, edx
and r8d, eax
mov eax, 0x4d6b0f52
xor eax, 0x4d6b0f50
imul eax, r8d
sub eax, edx
sub ecx, eax
mov eax, ecx
xor eax, 0xf621b8f6
mov edx, 0x20437543
xor edx, 0xdfbc8abc
xor eax, edx
and eax, 0xf621b8f6
shl eax, 1
sub eax, 0xf621b8f6
sub ecx, eax
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x9ea4659a
or ecx, 0x9ea4659a
xor ecx, 0xffffffff
xor eax, 0xffffffff
mov edx, 0x957fa9a7
xor edx, 0x6a805658
xor ecx, edx
and eax, ecx
mov ecx, 0x4eb47e3a
xor edx, edx
div ecx
cmp eax, 0xf7669e81
jae 0x14000b75a
mov eax, dword [0x1401db590]
mov ecx, dword [0x1401db594]
mov edx, 0xac909fab
xor edx, 0xa73b1d9b
xor ecx, edx
add eax, 0x2440a165
add eax, ecx
mov ecx, 0x78a94b08
xor ecx, 0x5ce9ea6d
sub eax, ecx
mov ecx, 0x844e1825
xor ecx, 0xdf958510
sub eax, ecx
add eax, 0xf7e80ef2
add eax, 0x5bdb9d35
sub eax, 0xe3419240
mov ecx, eax
add ecx, 1
mov edx, 0xefd0ef62
xor edx, 0x102f109d
xor eax, edx
mov edx, 0x5e670d59
xor edx, 0x87ff66cf
or eax, edx
add eax, ecx
mov dword [rsp + 0x2c], eax
mov ecx, 1
call qword [0x1401fc0a8]
mov eax, dword [rsp + 0x2c]
cmp eax, 0xcf068e62
ja 0x14000b6c8
invalid
jmp 0x14000b755
add rsp, 0x48
ret
in eax, 0x24
cmpsd dword [rsi], dword [rdi]
js 0x14000b748
invalid
Function at 0x14000e330
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401db6c8]
xor edx, edx
div dword [0x1401db6cc]
mov ecx, eax
mov eax, ecx
and eax, 0xdda0a916
xor ecx, 0xdda0a916
or eax, ecx
mov ecx, 0x39ade033
xor ecx, 0x31205992
imul eax, ecx
mov ecx, 0x19e3d7a4
xor edx, edx
div ecx
cmp eax, 0xe81de12a
jae 0x14000e405
mov rdx, qword [rsp + 0x28]
mov eax, dword [0x1401db6d0]
and eax, dword [0x1401db6d4]
and eax, 0x2612db1e
mov ecx, 0xba4f30ef
xor ecx, 0xba4f30ef
mov r8d, 0xcddd2b3a
xor r8d, 0x72954d39
sub ecx, r8d
sub eax, ecx
mov ecx, 0xf6bf735d
xor ecx, 0xf4d26792
and eax, ecx
mov dword [rsp + 0x24], eax
movabs rcx, 0x6fa63167937ab246
movabs rax, 0x6fa63167937ab256
xor rcx, rax
call fcn.1400065c0
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
sub rcx, rax
call fcn.14000e284
mov eax, dword [rsp + 0x24]
cmp eax, 0xcb5a72d2
jae 0x14000e37f
add rsp, 0x38
ret
mov bh, 0x4d
rcl dword [rcx + rbp*8 + 0x71], 0xff
invalid
Function at 0x140013040
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1401db948]
xor eax, 0x97ae04c9
mov ecx, dword [0x1401db94c]
xor ecx, 0x57fc7319
add eax, ecx
add eax, 0x9e0b5d7f
and eax, 0xb7a125f5
add eax, 0xb48ebe57
cmp eax, 0x8d328a70
je 0x140013110
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov ecx, dword [0x1401db950]
xor ecx, 0xf5811029
xor ecx, dword [0x1401db954]
add ecx, 0x81eac47d
xor r8d, r8d
sub r8d, 0x72545dc6
sub ecx, r8d
sub ecx, 0x2630487e
mov dword [rsp + 0x30], ecx
mov ecx, 0x72a2e7fc
xor ecx, 0x7922361b
mov dword [rsp + 0x2c], ecx
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov qword [rax], rdx
call fcn.140012ee0
mov ecx, dword [rsp + 0x2c]
mov dl, al
mov eax, dword [rsp + 0x30]
mov byte [rsp + 0x37], dl
cmp eax, ecx
je 0x140013081
ret 0x448b
mov al, byte [rsp + 0x37]
test al, 1
jne 0x140013100
jmp 0x14001310a
mov rcx, qword [rsp + 0x20]
call fcn.14000fd30
nop
add rsp, 0x48
ret
jmp 0x1400130de

Function at 0x140013610
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov ecx, 0x10
call fcn.1400065c0
mov r8, qword [rsp + 0x40]
mov rcx, rax
mov qword [rsp + 0x48], rcx
movabs rax, 0x317aba3760ba4344
mov rdx, rcx
sub rdx, rax
add rdx, r8
movabs rax, 0x104110d3eb6ad54
movabs r9, 0x307eab3a5e0cee10
xor rax, r9
add rdx, rax
mov qword [rsp + 0x50], rdx
mov rax, rdx
xor rax, r8
xor rdx, rcx
mov rcx, rax
add rcx, 1
xor rax, 0xffffffffffffffff
or rax, rdx
add rax, rcx
cmp rax, 0
jge 0x140013695
call fcn.1400067fe
jmp 0x1400137ba
mov rax, qword [rsp + 0x50]
movabs rcx, 0xd3fb3dfe30e97128
movabs rdx, 0xd3fb3dfe30e97128
xor rcx, rdx
cmp rax, rcx
jge 0x14001377c
mov eax, dword [0x1401db988]
xor eax, dword [0x1401db98c]
imul eax, eax, 0x7147cfa2
mov edx, 0xffffffff
xor edx, 0xe46142e2
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0xe46142e2
add eax, edx
sub eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xbd6d6727
mov r8d, 0xffffffff
xor r8d, 0xbd6d6727
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0x5b879ad6
xor r8d, 0xe6eafdf1
mov edx, eax
and edx, r8d
or eax, 0xbd6d6727
imul eax, edx
add eax, ecx
cmp eax, 0xdeb5d319
jae 0x1400137c4
mov eax, dword [0x1401db990]
mov ecx, dword [0x1401db994]
xor ecx, 0x640ba66b
and eax, ecx
mov ecx, 0xd46f22cc
xor ecx, 0x57438c49
and eax, ecx
or eax, 0x71cbb440
sub eax, 0x7aa93ec
mov dword [rsp + 0x34], eax
mov rcx, r8
mov rdx, r8
call fcn.14000c499
mov eax, dword [rsp + 0x34]
cmp eax, 0x5c5a7a8f
jbe 0x14001372e
jmp 0x1400137ba
mov rax, qword [rsp + 0x38]
cmp rax, 0
jge 0x14001379b
mov rcx, r8
mov rdx, r8
call fcn.14000c499
jmp 0x1400137ba
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
call fcn.140010850
mov rcx, rax
mov rax, qword [rsp + 0x48]
add rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rsp, 0x58
ret
js 0x140013838
mov dl, 0xdf
jmp 0x14001372e
and al, ch
sbb esp, dword [rdi - 1]
dec dword [rax - 0x7d]
invalid
Function at 0x1400147c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1401dba08]
mov ecx, 0x4a808b11
xor ecx, 0xb95150cf
xor eax, ecx
mov r8d, dword [0x1401dba0c]
mov edx, r8d
xor edx, 0xffffffff
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
or eax, 0x3008647e
and eax, 0x827dc5e5
mov ecx, 0xffffffff
xor ecx, 0x91d3e335
add eax, ecx
add eax, 1
mov ecx, 0x841f2495
xor ecx, 0x440b7ecc
cmp eax, ecx
je 0x1400148ad
mov eax, dword [0x1401dba10]
sub eax, dword [0x1401dba14]
mov ecx, 0xbd21f5e4
xor ecx, 0x7958c49b
imul eax, ecx
mov ecx, 0xfc1c358
xor ecx, 0x6985ae88
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x38]
mov ecx, eax
mov rax, qword [rsp + 0x40]
add ecx, 0xf1213d00
mov dword [rsp + 0x30], ecx
mov rcx, qword [rax]
mov qword [rsp + 0x28], rcx
mov qword [rax], rdx
call fcn.140012ee0
mov cl, al
mov eax, dword [rsp + 0x30]
mov byte [rsp + 0x37], cl
cmp eax, 0xe77e978f
je 0x140014828
mov al, byte [rsp + 0x37]
test al, 1
jne 0x14001489d
jmp 0x1400148a7
mov rcx, qword [rsp + 0x28]
call fcn.14000fd30
nop
add rsp, 0x48
ret
xor byte [rdx + 0x72e9478d], bl
invalid
Function at 0x140015590
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x20
mov qword [rsp + 8], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
mov r8d, dword [0x1401dba88]
mov edx, dword [0x1401dba8c]
xor edx, 0xd5e22852
mov eax, r8d
xor eax, 0xffffffff
and eax, 0xcb2148b3
mov r9d, 0xffffffff
xor r9d, 0xcb2148b3
and r8d, r9d
mov ecx, edx
xor ecx, 0xffffffff
and ecx, 0xcb2148b3
and edx, r9d
or eax, r8d
or ecx, edx
xor eax, ecx
and eax, eax
mov ecx, 0x75358368
xor ecx, 0x8aca7c97
xor eax, ecx
mov ecx, 0xee356e4d
and ecx, 0xee356e4d
mov edx, 0x426920e6
xor edx, 0xbd96df19
xor ecx, edx
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0x698c4ce7
xor edx, edx
div ecx
mov r11d, eax
mov ecx, r11d
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xeb8bede0
mov r8d, 0xffffffff
xor r8d, 0xf5a64020
mov eax, ecx
and eax, 0xf5a64020
and r11d, r8d
mov r9d, edx
and r9d, 0xf5a64020
mov r10d, 0xf73851ab
xor r10d, 0x1cb3bc4b
and r10d, r8d
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, edx
mov edx, 0x6ea8b159
xor edx, 0x91574ea6
xor ecx, edx
mov edx, 0xe2c0a82e
xor edx, 0x1766e80e
or edx, r8d
and ecx, edx
or eax, ecx
cmp eax, 0xe1767380
jb 0x140015719
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 8]
mov eax, dword [0x1401dba90]
mov edx, dword [0x1401dba94]
xor edx, 0x77e58d07
xor ecx, ecx
sub ecx, edx
add eax, ecx
mov edx, eax
and edx, 0x2e8289bc
mov ecx, 0x40adb514
xor ecx, 0x40adb516
imul ecx, edx
add eax, 0x2e8289bc
sub eax, ecx
and eax, 0x3ce10971
mov ecx, 0xc0a42cfb
xor ecx, 0x6eb11075
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x10]
mov rcx, r9
sub rcx, r8
mov rcx, r8
cmovl rcx, r9
cmp r8, rdx
cmovl rcx, rdx
mov qword [rsp], rcx
cmp eax, 0xe1e505
je 0x140015695
mov rax, qword [rsp]
add rsp, 0x20
ret
test eax, 0xe9f4eabe
jae 0x14001571f
invalid
invalid
Function at 0x1400170f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.140009f59
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.14004ef45
mov rax, qword [rsp + 0x30]
mov al, byte [rax + 0x60]
mov cl, 0x85
xor cl, 0x85
cmp al, cl
jne 0x140017250
mov eax, dword [0x1401dbb78]
mov r8d, dword [0x1401dbb7c]
mov edx, r8d
xor edx, 0xffffffff
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
imul eax, eax, 0xea15b2b9
mov ecx, 0x278bfe48
xor edx, edx
div ecx
mov ecx, eax
mov edx, 0x16658b34
xor edx, 0xe99a74cb
mov eax, ecx
xor eax, edx
mov r8d, 0x27f1622
xor r8d, 0xfd80e9dd
mov edx, ecx
xor edx, r8d
or eax, edx
mov edx, 0xfde76b
xor edx, 0xd2f0d8b1
and eax, edx
xor eax, 0xffffffff
mov edx, 0xd20d3fda
and edx, 0xd20d3fda
mov r8d, 0xd84ade60
xor r8d, 0x27b5219f
xor edx, r8d
mov r8d, 0x125db28f
xor r8d, 0xeda24d70
xor ecx, r8d
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0x36f694e4
xor ecx, 0x5c098ac9
cmp eax, ecx
je 0x140017255
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401dbb80]
mov r8d, dword [0x1401dbb84]
xor r8d, 0xa3630e60
mov edx, eax
add edx, 1
mov r9d, 0x4b9091d2
xor r9d, 0xb46f6e2d
xor eax, r9d
or eax, r8d
add eax, edx
mov edx, 0x6d9d1100
xor edx, 0x22562f94
mov r8d, 0xcd7465d5
xor r8d, 0x328b9a2a
xor edx, r8d
add eax, edx
add eax, 1
and eax, 0x7214e2c6
mov edx, 0x8b1277ed
xor edx, 0x6dc84b37
sub eax, edx
mov dword [rsp + 0x24], eax
call fcn.14004efb8
mov eax, dword [rsp + 0x24]
cmp eax, 0x3ee468bb
jbe 0x1400171ce
jmp 0x140017250
add rsp, 0x38
ret
cld
test byte [rax], 0x9f
jmp 0x1400171ce
Function at 0x140017ca0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov rcx, qword [rcx]
mov rdx, rcx
dec rdx
mov qword [rsp + 0x50], rdx
test rdx, rdx
setns al
or rcx, rdx
sets cl
add al, cl
inc al
test al, 1
jne 0x140017cf1
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
add rcx, 8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
jmp 0x140017cfb
call fcn.1400067fe
jmp 0x140017e97
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov eax, dword [0x1401dbbd8]
mov ecx, 0xb431ad6b
xor ecx, 0x5498e8d7
xor eax, ecx
xor edx, edx
div dword [0x1401dbbdc]
and eax, eax
mov ecx, 0x4f8a25dc
xor ecx, 0xb075da23
xor eax, ecx
mov ecx, 0xb80fb65d
xor ecx, 0x5482179b
mov edx, 0x7e264e8f
xor edx, 0x92abef49
and ecx, edx
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
mov ecx, eax
and ecx, 0x8d19a98c
shl ecx, 1
mov edx, 0x808a5b94
xor edx, 0xd93f218
xor eax, edx
add eax, ecx
imul eax, eax, 0x537c1179
cmp eax, 0x18b0421
jbe 0x140017e9c
mov r8, qword [rsp + 0x40]
mov eax, dword [0x1401dbbe0]
mov edx, dword [0x1401dbbe4]
mov ecx, eax
and ecx, edx
shl ecx, 1
xor eax, edx
add eax, ecx
mov ecx, eax
and ecx, 0x45cecff8
shl ecx, 1
xor eax, 0x45cecff8
add eax, ecx
xor eax, 0x8f7fe1b2
mov ecx, 0xf341fe39
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x28]
mov ecx, 0xc2ab5e30
xor ecx, 0xe2280aed
cmp rdx, r8
setl dl
mov byte [rsp + 0x27], dl
cmp eax, ecx
jae 0x140017d7a
mov al, byte [rsp + 0x27]
test al, 1
jne 0x140017e8a
jmp 0x140017de9
mov rax, qword [rsp + 0x28]
movabs rcx, 0x5ccd92dbfa0b8363
movabs rdx, 0x5ccd92dbfa0b8363
xor rcx, rdx
cmp rax, rcx
jl 0x140017e21
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
cmp rax, qword [rcx]
jl 0x140017e2e
mov rcx, rdx
call fcn.1400137e9
jmp 0x140017e97
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
add rcx, 8
shl rax, 4
add rcx, rax
call fcn.140017c09
mov rcx, qword [rsp + 0x28]
mov rax, rcx
add rax, 0xffffffffffffffff
mov rdx, rax
xor rdx, rcx
cmp rdx, 0
setl dl
cmp rcx, 0
setne cl
and cl, dl
test cl, 1
mov qword [rsp + 0x38], rax
jne 0x140017e80
jmp 0x140017cfb
call fcn.1400067fe
jmp 0x140017e97
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
add rsp, 0x58
ret
movsb byte [rdi], byte [rsi]
invalid