joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140188be0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov qword [rsp + 0x58], rax
add rax, 0x60
mov qword [rsp + 0x50], rax
call fcn.140187a10
mov rcx, rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rcx
cmp byte [rax + 0x60], 0
jne 0x140188e95
mov rcx, qword [rsp + 0x60]
mov rax, rcx
sub rax, 0x100
mov eax, 0x100
cmovl rax, rcx
mov qword [0x1402d7ac0], rax
lea rax, [0x1402d7b40]
mov qword [0x1402d7ac8], rax
xor eax, eax
cmp rcx, 0
mov qword [rsp + 0x48], rax
jg 0x140188d92
jmp 0x140188e95
mov eax, dword [0x1402b2108]
xor edx, edx
div dword [0x1402b210c]
mov ecx, eax
mov edx, 0x86428d4a
xor edx, 0xad9a768
mov eax, 0xcf825e80
xor eax, 0x307da17f
xor edx, eax
mov eax, ecx
xor eax, edx
and eax, ecx
add eax, 0x2471aa0d
mov ecx, 0xea9d00fa
xor ecx, 0xd82f9d04
add eax, ecx
sub eax, 0x2471aa0d
add eax, 0x813c738d
mov ecx, 0x5efe81ba
xor ecx, 0x26ef65e8
cmp eax, ecx
je 0x140188e9a
mov eax, dword [0x1402b2110]
xor edx, edx
div dword [0x1402b2114]
mov rdx, qword [rsp + 0x30]
mov ecx, eax
mov eax, ecx
xor eax, 0xe8179984
xor eax, 0xffffffff
or ecx, 0xe8179984
and ecx, eax
mov eax, ecx
and eax, 0x18543848
mov r8d, 0x77f75ee6
xor r8d, 0x8808a119
xor eax, r8d
mov r8d, 0x3dda600d
xor r8d, 0xc2259ff2
xor ecx, r8d
mov r8d, 0x4adceea2
xor r8d, 0x5288d6ea
mov r9d, 0xf209ee47
xor r9d, 0xdf611b8
xor r8d, r9d
or ecx, r8d
and eax, ecx
xor eax, 0xffffffff
and eax, 0x42798b6d
mov ecx, 0x207ee52a
xor ecx, 0x3283268
movabs r8, 0x7e682d22a65d9d62
sub rdx, r8
add rdx, 1
movabs r8, 0x7e682d22a65d9d62
add rdx, r8
mov qword [rsp + 0x38], rdx
cmp rdx, qword [0x1402d7ac0]
setl dl
mov byte [rsp + 0x47], dl
cmp eax, ecx
ja 0x140188cba
mov rax, qword [rsp + 0x38]
mov cl, byte [rsp + 0x47]
test cl, 1
mov qword [rsp + 0x48], rax
jne 0x140188d92
jmp 0x140188e95
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov eax, dword [0x1402b2118]
mov ecx, dword [0x1402b211c]
xor ecx, 0xff19e0a9
xor eax, ecx
mov ecx, 0x25030570
xor ecx, 0xdf570d72
mov edx, 0x3c9042b3
xor edx, 0xc36fbd4c
xor ecx, edx
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x16fef370
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
and eax, 0x7a83bc0a
mov ecx, 0x650efe8
xor ecx, 0xa2858161
cmp eax, ecx
je 0x140188ea3
mov rcx, qword [rsp + 0x30]
mov edx, dword [0x1402b2120]
mov r8d, dword [0x1402b2124]
xor r8d, 0xd932e210
mov eax, 0xf12d9de9
xor eax, 0xf12d9de9
sub eax, r8d
sub edx, eax
mov r8d, 0x812fe20
xor r8d, 0x3830bbe4
mov eax, 0x11fbcd7d
xor eax, 0xee043282
xor r8d, eax
mov eax, edx
xor eax, r8d
and eax, edx
xor eax, 0xe952cf9c
mov r8d, 0xfe8a9843
xor r8d, 0x2b79e1a
xor edx, edx
div r8d
mov dword [rsp + 0x28], eax
call fcn.1401889b0
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x28]
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x641f9896
jae 0x140188dfd
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x140188c5e
jmp 0x140188e95
add rsp, 0x68
ret
push rbx
leave
jmp 0x140188cba
retf 0xe984
Function at 0x14018f10d
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140024f90
Function at 0x1401962b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1402b2818]
xor eax, 0x8baaac8b
mov ecx, dword [0x1402b281c]
xor ecx, 0xb6b6f09a
xor eax, ecx
add eax, 0x52dedad
sub eax, 0x6fd556c6
sub eax, 0x52dedad
mov ecx, 0xdf5e9207
xor edx, edx
div ecx
mov ecx, 0x65c1cfd
xor ecx, 0xebaf1e7f
xor edx, edx
div ecx
cmp eax, 0xbc0005e9
ja 0x1401964df
mov eax, dword [0x1402b2820]
mov ecx, 0xb8f5e4df
xor ecx, 0xb3a3df54
xor eax, ecx
and eax, dword [0x1402b2824]
mov ecx, 0xa773cad2
xor edx, edx
div ecx
mov ecx, 0xe733b50f
xor ecx, 0xdb8ea2d7
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x40]
sub eax, 0xbc6ccbe2
mov ecx, 0xefc8aaa7
xor ecx, 0x86d763bc
cmp rdx, 0
sete dl
mov byte [rsp + 0x3f], dl
cmp eax, ecx
ja 0x140196304
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x1401964d5
jmp 0x14019636e
mov eax, dword [0x1402b2828]
add eax, dword [0x1402b282c]
mov ecx, 0x7b8cc786
xor ecx, 0x775cc9d9
imul eax, ecx
add eax, 0x38b29d14
mov edx, eax
xor edx, 0xe572f7f7
xor edx, 0xffffffff
and edx, 0xe572f7f7
mov ecx, 0x63b5523b
xor ecx, 0x63b55239
imul ecx, edx
sub ecx, 0xe572f7f7
sub eax, ecx
mov ecx, 0x54a304b5
xor ecx, 0x4ec34de8
cmp eax, ecx
jb 0x1401964e8
mov rcx, qword [rsp + 0x40]
mov edx, dword [0x1402b2830]
add edx, dword [0x1402b2834]
mov r8d, 0xa4912ce1
xor r8d, 0xb9095d75
mov eax, 0x7eee5ff0
xor eax, 0x8111a00f
xor r8d, eax
mov eax, edx
xor eax, r8d
and eax, edx
or eax, 0xf31c87be
mov r8d, eax
xor r8d, 0xffffffff
and r8d, 0x2b14a8ff
mov r9d, 0xffffffff
xor r9d, 0x2b14a8ff
mov edx, eax
and edx, r9d
imul edx, r8d
mov r8d, eax
and r8d, 0x2b14a8ff
mov r9d, 0x587edc9c
xor r9d, 0x736a7463
or eax, r9d
imul eax, r8d
add eax, edx
movabs rdx, 0x2a59bed7dcf38077
sub rcx, rdx
add rcx, 0xfffffffffffffff0
movabs rdx, 0x2a59bed7dcf38077
add rcx, rdx
mov qword [rsp + 0x28], rcx
mov rdx, qword [rcx]
mov r8, rdx
and r8, 0x10
shl r8, 1
mov rcx, rdx
xor rcx, 0x10
add rcx, r8
mov qword [rsp + 0x30], rcx
mov r8, rdx
and r8, 0xffffffffffffffff
shl r8, 1
add rdx, 0xffffffffffffffff
sub rdx, r8
and rcx, rdx
cmp rcx, 0
setl cl
mov byte [rsp + 0x3e], cl
cmp eax, 0xef2f7c48
je 0x1401963c7
mov al, byte [rsp + 0x3e]
test al, 1
jne 0x1401964be
jmp 0x1401964c8
call fcn.14000ee80
jmp 0x1401964d5
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rax, qword [rsp + 0x40]
add rsp, 0x48
ret
sar dword [rdx + 0x74], 0x7b
jmp 0x140196304
call 0x1170351d3
invalid
Function at 0x1401981b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
mov r8d, dword [0x1402b28d8]
add r8d, dword [0x1402b28dc]
mov eax, r8d
and eax, 0xcdbcc396
xor eax, 0xffffffff
add r8d, 0xcdbcc396
mov ecx, 0x296ab512
xor ecx, 0x296ab513
add r8d, ecx
add r8d, eax
mov eax, 0x95ce1562
xor eax, 0x4fb8625d
xor r8d, eax
mov eax, r8d
xor eax, 0xffffffff
and eax, 0x6957d3e0
mov edx, 0xffffffff
xor edx, 0x6957d3e0
and r8d, edx
mov ecx, 0xece267ae
xor ecx, 0x75093b79
mov r9d, 0xf4631795
xor r9d, 0xb9ce86a
xor ecx, r9d
and ecx, 0x6957d3e0
and edx, 0x99eb5cd7
or eax, r8d
or ecx, edx
xor eax, ecx
cmp eax, 0xfde05d10
je 0x1401983d0
mov ecx, dword [0x1402b28e0]
or ecx, dword [0x1402b28e4]
mov eax, ecx
and eax, 0xd22dfcfa
xor ecx, 0xd22dfcfa
or eax, ecx
mov ecx, 0x72bbd9a9
xor ecx, 0xc5678257
add eax, ecx
mov ecx, 0x5c95e8e9
xor ecx, 0xf6a5d05c
sub eax, ecx
sub eax, 0xb7dc5bfe
mov ecx, 0x4fc5c282
xor edx, edx
div ecx
mov dword [rsp + 0x48], eax
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
add rax, 0x60
mov qword [rsp + 0x40], rax
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x48]
cmp rcx, 0
sete cl
mov byte [rsp + 0x4f], cl
cmp eax, 0x328c0f27
jae 0x140198249
mov al, byte [rsp + 0x4f]
test al, 1
jne 0x1401983ca
jmp 0x1401982e5
mov rax, qword [rsp + 0x50]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x30], rcx
mov rax, qword [rax - 0x10]
mov qword [rsp + 0x38], rax
cmp rax, 0x10
jb 0x14019838d
mov rdx, qword [rsp + 0x38]
mov rax, rdx
and rax, 0xfffffffffffffff0
mov rcx, rdx
or rcx, 0xfffffffffffffff0
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, rdx
movabs rdx, 0x8cf7a7dc7a303869
movabs r8, 0x8cf7a7dc7a303869
xor rdx, r8
cmp rcx, rdx
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x14019835d
jmp 0x140198367
call fcn.14000ee80
jmp 0x1401983ca
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov qword [rdx], rax
mov cl, 1
xor cl, 1
and cl, 1
lea r8, [0x1402b2158]
call fcn.14001d8a6
jmp 0x1401983ca
mov rdx, qword [rsp + 0x30]
mov ecx, 1
lea r8, [0x1402b2158]
call fcn.14001d8a6
mov rcx, qword [rsp + 0x50]
call fcn.1401974b0
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x1401983ca
mov rcx, qword [rsp + 0x50]
mov edx, 8
call fcn.14001ab40
nop
add rsp, 0x58
ret
xchg ebp, eax
sub byte [rbx - 0x18f16a1], ah
invalid
Function at 0x140199320
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
cmp rcx, 0
je 0x140199471
mov rax, qword [rsp + 0x30]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax - 0x10]
mov rax, rcx
and rax, 0x10
mov rdx, rcx
or rdx, 0x10
add rax, rdx
mov qword [rsp + 0x28], rax
xor rcx, 0xffffffffffffffff
and rax, rcx
movabs rcx, 0xfbc16391e63fe31f
movabs rdx, 0xfbc16391e63fe31f
xor rcx, rdx
cmp rax, rcx
jge 0x14019938f
call fcn.14000ee80
jmp 0x140199471
mov eax, dword [0x1402b2938]
xor edx, edx
div dword [0x1402b293c]
mov edx, 0x6d89a3ae
xor edx, 0x79e3db00
mov ecx, eax
and ecx, edx
shl ecx, 1
mov edx, 0xb16cae39
xor edx, 0xa506d697
add eax, edx
sub eax, ecx
mov ecx, 0xffffffff
xor ecx, 0xefc774a6
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
mov ecx, 0x92b1888c
xor ecx, 0x6c75996c
xor eax, ecx
mov ecx, 0x9c5a9f67
xor ecx, 0x4970ca7c
cmp eax, ecx
je 0x14019947b
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov eax, dword [0x1402b2940]
or eax, dword [0x1402b2944]
mov r8d, 0x13b89b4c
xor r8d, 0xf5f50212
or eax, r8d
sub eax, 0x7d501bb6
mov r9d, eax
xor r9d, 0x5944c407
mov r8d, 0x5762aac5
xor r8d, 0xa89d553a
xor r9d, r8d
mov r8d, 0x73e42da2
xor r8d, 0x2aa0e9a5
and r8d, r9d
shl r8d, 1
mov r9d, 0xb5ad8fc5
xor r9d, 0xece94bc2
sub r8d, r9d
sub eax, r8d
mov qword [rcx], rdx
cmp eax, 0xd579ab18
jae 0x1401993f2
jmp 0x140199471
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
invalid
Function at 0x1401cca60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov rcx, qword [rsp + 0x38]
add rax, 0x60
mov qword [rsp + 0x40], rax
cmp rcx, 0
je 0x1401ccb95
mov rax, qword [rsp + 0x38]
xor ecx, ecx
sub rcx, rax
xor eax, eax
sub rax, 0xfffffffffffffff0
add rcx, rax
movabs rax, 0x944f393dccbf954e
movabs rdx, 0x944f393dccbf954e
xor rax, rdx
sub rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
cmp rax, 0x10
jb 0x1401ccb6e
mov r8, qword [rsp + 0x30]
mov rax, r8
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x20], rax
mov rcx, rax
xor rcx, 0xffffffffffffffff
mov rdx, rax
xor rdx, 0xffffffffffffffff
or rcx, rdx
xor rcx, 0xffffffffffffffff
mov rdx, r8
xor rdx, 0xffffffffffffffff
or rcx, rdx
and r8, r8
xor r8, 0xffffffffffffffff
mov rdx, rax
xor rdx, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
or rdx, r8
and rcx, rdx
xor rcx, 0xffffffffffffffff
movabs rdx, 0x296627c059c42fd
movabs r8, 0x296627c059c42fd
xor rdx, r8
cmp rcx, rdx
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x1401ccb52
jmp 0x1401ccb5c
call fcn.14000ee80
jmp 0x1401ccb95
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
jmp 0x1401ccb95
mov rcx, qword [rsp + 0x38]
call fcn.1401cc4c0
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x1401ccb95
mov rcx, qword [rsp + 0x38]
mov edx, 8
call fcn.14001ab40
mov ecx, dword [0x1402b3e38]
add ecx, dword [0x1402b3e3c]
add ecx, 0x29b11a90
sub ecx, 0x474159a0
sub ecx, 0x29b11a90
mov eax, ecx
add eax, 1
xor ecx, 0xffffffff
or ecx, 0x9c25b27b
add ecx, eax
mov edx, 0xffffffff
xor edx, 0x66fb43e0
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0x60256e64
xor ecx, 0x65918567
cmp eax, ecx
jae 0x1401ccc16
mov eax, dword [0x1402b3e40]
xor eax, dword [0x1402b3e44]
add eax, 0xefb69a89
mov ecx, 0xb6c321f5
xor edx, edx
div ecx
xor eax, 0x2ce32b58
cmp eax, 0x17d6a0ba
je 0x1401ccbe7
add rsp, 0x48
ret
outsd dx, dword [rsi]
push 0xffffffffffffffe9
enter 0xffffffffffffffff, 0xffffffffffffffff
nop
Function at 0x1401ce050
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov rcx, qword [rsp + 0x38]
add rax, 0x60
mov qword [rsp + 0x40], rax
cmp rcx, 0
je 0x1401ce1f9
mov rax, qword [rsp + 0x38]
movabs rcx, 0xadeda7eaafbb773d
movabs rdx, 0x11c961ecd4badf4f
xor rcx, rdx
sub rax, rcx
add rax, 0xfffffffffffffff0
movabs rcx, 0x9d59dbc3d52e685c
movabs rdx, 0x217d1dc5ae2fc02e
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
cmp rax, 0x10
jb 0x1401ce1d2
mov rdx, qword [rsp + 0x30]
mov rax, rdx
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x20], rax
mov rcx, rax
xor rcx, rdx
movabs rdx, 0xbf2c5cb9d1faad21
movabs r8, 0xbf2c5cb9d1faad21
xor rdx, r8
cmp rcx, rdx
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x1401ce11d
jmp 0x1401ce127
call fcn.14000ee80
jmp 0x1401ce1f9
mov eax, dword [0x1402b3ee8]
mov edx, dword [0x1402b3eec]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
or eax, 0xc845e2bd
mov ecx, eax
xor ecx, 0x595c4ece
mov edx, 0x6ec322e5
xor edx, 0x913cdd1a
xor ecx, edx
or eax, 0x595c4ece
and eax, ecx
mov ecx, 0xbbf65ff0
xor ecx, 0xbc7d5f57
add eax, ecx
cmp eax, 0xbd1b2ce8
ja 0x1401ce1ff
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x20]
mov eax, dword [0x1402b3ef0]
mov ecx, dword [0x1402b3ef4]
xor ecx, 0x32028dfc
sub eax, ecx
and eax, 0x3e0bfe87
xor eax, 0x444887dd
mov ecx, eax
and ecx, 0x312f72ba
shl ecx, 1
mov r9d, 0xdeef8448
xor r9d, 0xefc0f6f2
add eax, r9d
sub eax, ecx
mov ecx, 0xf92ac816
xor ecx, 0xf30407a4
mov qword [rdx], r8
cmp eax, ecx
jbe 0x1401ce172
jmp 0x1401ce1f9
mov rcx, qword [rsp + 0x38]
call fcn.1401cdfac
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x1401ce1f9
mov rcx, qword [rsp + 0x38]
mov edx, 8
call fcn.14001ab40
nop
add rsp, 0x48
ret
mov dl, 8
int3
Function at 0x1401d0ac0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
mov eax, dword [0x1402b4060]
mov ecx, 0x515f68a4
xor ecx, 0xc4c2f35b
xor eax, ecx
mov edx, dword [0x1402b4064]
mov r8d, 0x974eb14a
xor r8d, 0x974eb14b
mov ecx, eax
add ecx, r8d
xor eax, 0xffffffff
or eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0xa9c0e717
xor ecx, 0xffffffff
or eax, 0xa9c0e717
and eax, ecx
mov ecx, 0x8c4f1dc7
xor edx, edx
div ecx
or eax, eax
xor eax, 0xffffffff
mov ecx, 0x60bdbb15
xor ecx, 0x88aa2291
mov edx, 0x5ef7ade0
xor edx, 0xb6e03464
or ecx, edx
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0x845b1a55
xor ecx, 0x7ba4e5aa
xor eax, ecx
cmp eax, 0xf0fa48ea
je 0x1401d0c7c
mov eax, dword [0x1402b4068]
xor edx, edx
div dword [0x1402b406c]
xor eax, 0x2f734ba0
xor eax, 0xdc40277
mov ecx, 0x4f04ae3c
xor ecx, 0xb550a63e
add eax, ecx
mov dword [rsp + 0x3c], eax
mov eax, 0xf840eb88
xor eax, 0xf3d0de09
mov dword [rsp + 0x38], eax
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x38]
mov r8, rax
mov eax, dword [rsp + 0x3c]
add r8, 0x60
mov qword [rsp + 0x40], r8
cmp rdx, 0
sete dl
mov byte [rsp + 0x4f], dl
cmp eax, ecx
je 0x1401d0b50
mov al, byte [rsp + 0x4f]
test al, 1
jne 0x1401d0c76
jmp 0x1401d0bd2
mov rax, qword [rsp + 0x50]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x28], rcx
mov rax, qword [rax - 0x10]
mov qword [rsp + 0x30], rax
cmp rax, 0x10
jb 0x1401d0c4f
mov rdx, qword [rsp + 0x30]
mov rcx, rdx
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x20], rcx
mov rax, rdx
xor rdx, rax
not rdx
and rdx, rcx
xor rdx, rax
test rcx, rcx
setns al
or rcx, rdx
sets cl
add al, cl
inc al
test al, 1
jne 0x1401d0c33
jmp 0x1401d0c3d
call fcn.14000ee80
jmp 0x1401d0c76
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
jmp 0x1401d0c76
mov rcx, qword [rsp + 0x50]
call fcn.1401d04b0
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x1401d0c76
mov rcx, qword [rsp + 0x50]
mov edx, 8
call fcn.14001ab40
nop
add rsp, 0x58
ret
ret
Function at 0x1401d9237
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140024f90
Function at 0x1401dd8a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov eax, dword [0x1402b4570]
xor eax, 0xf64bbcc9
sub eax, dword [0x1402b4574]
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x649ba5cf
mov edx, 0xffffffff
xor edx, 0x649ba5cf
and eax, edx
sub eax, ecx
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x86d8a593
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, eax
xor ecx, 0xef179441
xor ecx, 0xffffffff
and ecx, 0xef179441
shl ecx, 1
mov edx, 0x490599b9
xor edx, 0xa6120df8
sub ecx, edx
sub eax, ecx
mov ecx, 0x803bda28
xor ecx, 0xb6c33ee3
cmp eax, ecx
jb 0x1401dd9da
mov eax, dword [0x1402b4578]
mov ecx, dword [0x1402b457c]
xor edx, edx
div ecx
mov edx, eax
mov r8d, edx
add r8d, 0x19f77ea2
mov ecx, r8d
and ecx, 0x25dcd66e
xor r8d, 0xda232991
mov eax, edx
mov edx, r8d
lea eax, [rax + rdx + 0x19f77ea2]
sub eax, ecx
mov ecx, eax
imul rcx, rcx, 0x27934fd3
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
mov dword [rbp - 0xc], eax
mov eax, 0x10
call fcn.1402a7dd0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000eaf8
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov qword [rcx], 0
mov rdx, qword [rax + 0x10]
xor r8d, r8d
sub rsp, 0x20
call fcn.140024f90
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbp - 0xc]
add rsp, 0x20
mov rcx, qword [rcx]
mov qword [rbp - 8], rcx
cmp eax, 0x5c852c40
je 0x1401dd91c
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
imul ebp, ebx, 0x39e94529
invalid
Function at 0x1401f1fc0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x960
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x8d0], xmm8
movaps xmmword [rbp + 0x8c0], xmm7
movaps xmmword [rbp + 0x8b0], xmm6
Function at 0x14020877b
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
and r8b, 1
add rsp, 0x28
jmp fcn.140024f90
Function at 0x14022a289
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140024f90
Function at 0x1402387b2
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140024f90
Function at 0x14023f880
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rcx
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x80], rax
add rax, 0x60
mov qword [rsp + 0x60], rax
mov rax, qword [rdx]
mov qword [rsp + 0x68], rax
mov rax, rdx
add rax, 8
mov qword [rsp + 0x70], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x78], rax
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov rax, qword [rsp + 0x80]
cmp byte [rax + 0x60], 0
jne 0x14023fa9c
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
add rcx, 8
lea rax, [0x1402c5209]
cmp rdx, 0
cmove rcx, rax
call fcn.1400dbd90
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov dword [rsp + 0x44], ecx
cmp byte [rax], 0
jne 0x14023fa9c
mov eax, dword [rsp + 0x44]
movsxd rcx, eax
mov qword [rsp + 0x38], rcx
cmp eax, 0
jge 0x14023f95f
mov rcx, qword [rsp + 0x38]
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
call fcn.140018506
jmp 0x14023fa9c
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call fcn.1400db850
mov rax, qword [rsp + 0x60]
cmp byte [rax], 0
jne 0x14023fa9c
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov rax, qword [rsp + 0x60]
cmp byte [rax], 0
jne 0x14023fa9c
mov eax, dword [0x1402b6ea8]
xor edx, edx
div dword [0x1402b6eac]
mov ecx, 0xa3f203b
xor ecx, 0x5f54a255
add eax, ecx
add eax, 0x49e9ed5
sub eax, 0x4fff7434
sub eax, 0x49e9ed5
mov ecx, 0x66ccd18f
xor edx, edx
div ecx
mov ecx, 0x9159a0fd
xor ecx, 0x186cccaa
cmp eax, ecx
je 0x14023faa9
mov rcx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x28]
mov eax, dword [0x1402b6eb0]
xor edx, edx
div dword [0x1402b6eb4]
mov rdx, qword [rsp + 0x30]
add eax, 0x2415051f
or eax, 0x7855751
mov r9d, 0x86de8e0d
xor r9d, 0xe7856190
sub eax, r9d
mov dword [rsp + 0x24], eax
mov eax, 0xd4398ed4
xor eax, 0xb874cc53
mov dword [rsp + 0x20], eax
add rdx, 8
lea rax, [0x1402c5209]
cmp r8, 0
cmove rdx, rax
movabs r8, 0xab3fcba07dd9f423
movabs rax, 0xd4c0345f82260bdc
xor r8, rax
movabs r9, 0x4378ed420542573d
movabs rax, 0x4378ed420542573d
xor r9, rax
call fcn.1400dd960
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
jb 0x14023f9f8
jmp 0x14023fa9c
mov rax, qword [rsp + 0x50]
add rsp, 0x88
ret
cmp esi, ebp
scasb al, byte [rdi]
ret
Function at 0x140240d36
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov qword [rsp + 0x28], rax
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
xor eax, eax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
xorps xmm0, xmm0
movups xmmword [rsp + rax + 0x38], xmm0
movabs rcx, 0x45ddeb1b9914bfd3
add rax, rcx
add rax, 0x10
movabs rcx, 0x45ddeb1b9914bfd3
sub rax, rcx
movabs rcx, 0x5c32a7e36482bcbd
movabs rdx, 0x5c32a7e36482bcfd
xor rcx, rdx
cmp rax, rcx
mov qword [rsp + 0x30], rax
jne 0x140240d62
mov dword [rsp + 0x38], 0x40
lea rcx, [rsp + 0x38]
call fcn.1400e73f7
mov rcx, qword [rsp + 0x28]
mov cl, byte [rcx + 0x60]
test cl, cl
sete dl
sub eax, 1
sete al
and dl, al
mov rcx, qword [rsp + 0x40]
movabs rax, 0x7cc206ec74df2aa5
movabs r8, 0x833df9138b20d55a
xor rax, r8
test dl, 1
cmovne rax, rcx
add rsp, 0x78
ret
Function at 0x140245b97
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140024f90
Function at 0x1402542e5
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140024f90
Function at 0x14025c6f7
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
and r8b, 1
add rsp, 0x28
jmp fcn.140024f90
Function at 0x14026a8b4
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140024f90
Function at 0x140282db9
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1402c6150]
mov ecx, dword [rax]
call fcn.14000eaf8
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
add rsp, 0x28
jmp fcn.140024f90
Function at 0x1402927d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x230
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x58], rcx
mov eax, 0x10
mov qword [rbp + 0x70], rax
call fcn.1402a7dd0
Function at 0x14029f380
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, qword gs:[0x60]
movzx rax, byte [rax + 2]
ret