joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140113540
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [0x140168020]
mov rdi, rax
test rax, rax
jne 0x140113582
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1401135c9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140113622
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1401135e0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x140113663
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x140142182]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x140142183]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140113630
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1401147bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140114806
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140114806
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140114806
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140114806
cmp dword [rcx + 0x84], 0xe
jbe 0x140114806
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140114808
xor al, al
add rsp, 0x28
ret
Function at 0x14000d8d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov eax, 0xd481659d
nop word cs:[rax + rax]
mov edx, dword [0x141dc0728]
xor edx, dword [0x141dc072c]
or edx, 0x7962df3f
add edx, 0xee9a605c
imul rdx, rax
shr rdx, 0x3f
cmp edx, 0x2ac7e64a
je 0x14000d8f0
mov rbx, qword [rcx + 8]
test rbx, rbx
je 0x14000db34
mov qword [rsp + 0x20], rcx
mov r14, qword [rcx + 0x18]
test r14, r14
je 0x14000daae
mov rax, qword [rsp + 0x20]
mov r15, qword [rax]
movdqa xmm0, xmmword [r15]
pmovmskb esi, xmm0
not esi
nop word [rax + rax]
mov eax, dword [0x141dc0730]
mov ecx, dword [0x141dc0734]
add eax, ecx
add eax, 0xae139c6e
xor eax, 0xf6f19d4b
cmp eax, 0x503c56d9
jb 0x14000d950
lea r12, [r15 + 0x10]
xor ebp, ebp
mov r13, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
test si, si
jne 0x14000d9d0
nop word cs:[rax + rax]
mov eax, dword [0x141dc0738]
and eax, dword [0x141dc073c]
imul eax, eax, 0xde84ca8a
or eax, 0x104b0d
and eax, 0x61acb8f
cmp eax, 0xcd1c3ec
ja 0x14000d990
add r15, 0xfffffffffffffc80
movdqa xmm0, xmmword [r12]
add r12, 0x10
pmovmskb esi, xmm0
cmp si, 0xffff
je 0x14000d990
not esi
tzcnt eax, esi
neg rax
imul rax, rax, 0x38
lea rdi, [r15 + rax]
cmp qword [r15 + rax - 0x38], 0
je 0x14000da84
mov eax, dword [0x141dc0740]
and eax, dword [0x141dc0744]
add eax, 0x5186b1b0
xor eax, 0x2b8532f2
imul eax, eax, 0xc29d54a2
cmp eax, 0xf5b180a2
jbe 0x14000da20
mov rax, qword [0x141ddb9a0]
nop word cs:[rax + rax]
mov eax, dword [0x141dc0748]
sub eax, dword [0x141dc074c]
imul rax, rax, 0x7cde9961
shr rax, 0x3d
add eax, 0xc44c0f52
mov r8, qword [rdi - 0x30]
mov rcx, qword [0x141ddb9a0]
cmp eax, 0xd4a4ba31
ja 0x14000da20
xor edx, edx
call r13
nop word cs:[rax + rax]
mov eax, dword [0x141dc0750]
mov ecx, dword [0x141dc0754]
add eax, ecx
add eax, 0xfdd5674
xor eax, 0x4412008c
or eax, 0xb3ece721
cmp eax, 0xa114eba6
jb 0x14000da60
lea eax, [rsi - 1]
and eax, esi
mov esi, eax
dec r14
add rdi, 0xffffffffffffffe0
mov rcx, rdi
call fcn.14000f5d0
nop word [rax + rax]
test bpl, bpl
jne case.0x1400029e1.90
test r14, r14
jne 0x14000d980
lea rax, [rbx + 1]
mov ecx, 0x38
mul rcx
add rax, 0xf
and rax, 0xfffffffffffffff0
lea rcx, [rbx + rax]
add rcx, 0x11
nop word [rax + rax]
mov edx, dword [str._rUi4]
xor edx, dword [0x141dc075c]
and edx, 0x30836500
add edx, 0x9364cce6
cmp edx, 0x1afe4e22
jb 0x14000dad0
test rcx, rcx
mov rcx, qword [rsp + 0x20]
je 0x14000db34
mov r8, qword [rcx]
sub r8, rax
mov rcx, qword [0x141ddb9a0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov eax, dword [0x141dc0760]
xor edx, edx
div dword [0x141dc0764]
add eax, 0xd4813869
cmp byte [rcx - 0x53afca2c], al
mov esp, edx
and eax, 0xd4cdafd0
cmp eax, 0xdd030f72
je 0x14000db10
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140017190
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
nop dword [rax + rax]
mov eax, dword [0x141dc1aa0]
imul eax, dword [0x141dc1aa4]
or eax, 0xfbbcf600
shr eax, 3
imul rax, rax, 0xb5c02f3
shr rax, 0x36
or eax, 0x159a6ef4
cmp eax, 0x642a35d7
ja 0x1400171a0
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400171e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x141dc1aa8]
xor edx, edx
div dword [0x141dc1aac]
and eax, 0x56fe5653
imul eax, eax, 0xe59a1fd
and eax, 0xd9c4d65d
cmp eax, 0xf7f60b80
ja 0x1400171e0
cmp rsi, 0xffffffffffffffff
je 0x14001733d
mov rcx, 0xffffffffffffffff
lock xadd qword [rsi + 8], rcx
nop dword [rax]
mov eax, dword [0x141dc1ab0]
imul eax, dword [0x141dc1ab4]
add eax, 0xce54055
imul rax, rax, 0x29f7f2d
shr rax, 0x39
cmp eax, 0x9ecfeada
ja 0x140017220
mov r8d, 0xee83b411
nop word [rax + rax]
mov eax, dword [0x141dc1ab8]
xor edx, edx
div dword [0x141dc1abc]
xor eax, 0xa64396dd
imul rax, r8
shr rax, 0x3e
add eax, 0x569a58ee
cmp eax, 0x4a907d84
jb 0x140017250
cmp rcx, 1
jne 0x14001733d
mov eax, dword [0x141dc1ac0]
add eax, dword [0x141dc1ac4]
xor eax, 0x6352de86
imul eax, eax, 0x74996ee3
shr eax, 4
imul rax, rax, 0x49cd4a3
shr rax, 0x36
cmp eax, 0x507964fa
jbe 0x1400172b0
nop dword [rax]
mov eax, dword [0x141dc1ac8]
mov ecx, dword [0x141dc1acc]
add eax, ecx
add eax, 0xf8edda05
and eax, 0x40a34be9
add eax, 0x6e251f94
cmp eax, 0x36b67725
jb 0x1400172b0
mov eax, dword [0x141dc1ad0]
and eax, dword [0x141dc1ad4]
imul eax, eax, 0x8e0a83bf
add eax, 0x24a14f02
cmp eax, 0x1e1a112b
jae 0x140017300
mov rax, qword [0x141ddb9a0]
nop dword [rax]
mov eax, dword [0x141dc1ad8]
xor edx, edx
div dword [0x141dc1adc]
imul eax, eax, 0xd2dfb98b
add eax, 0xf0a0fa68
or eax, 0x555dfb78
mov rcx, qword [0x141ddb9a0]
cmp eax, 0x39b685ff
jb 0x140017300
xor edx, edx
mov r8, rsi
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
and eax, 0xeaf93
nop
add rsp, 0x20
pop rsi
ret

Function at 0x140017d20
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov r8d, 0x100c56fd
sub r8, rdx
mov rcx, r8
shr rcx, 3
nop word cs:[rax + rax]
mov edx, dword [0x141dc1c40]
xor edx, dword [0x141dc1c44]
add edx, 0x1a0aea5d
xor edx, 0x2403d042
and edx, 0xa527f147
cmp edx, 0xc1aee6a2
je 0x140017d40
xor rcx, r8
mov rdx, rcx
rol rdx, 1
xor rdx, rcx
mov rcx, rdx
rol rcx, 5
xor rcx, rdx
xor edx, edx
nop
test dl, dl
jne 0x140017d80
movzx ecx, cx
add rax, rcx
nop word [rax + rax]
mov ecx, dword [0x141dc1c48]
add ecx, dword [0x141dc1c4c]
and ecx, 0x9012439a
imul ecx, ecx, 0x7458eba6
cmp ecx, 0x7be97f4e
je 0x140017d90
ret
Function at 0x140017dc0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
imul rdx, rdx, 0x443c729f
mov rcx, rdx
shr rcx, 0xd
xor rcx, rdx
add rcx, 0xffffffffb58276f4
nop dword [rax + rax]
mov edx, dword [0x141dc1c50]
sub edx, dword [0x141dc1c54]
shr edx, 1
imul rdx, rdx, 0x131a6d69
shr rdx, 0x3a
xor edx, 0x2634553e
cmp edx, 0x85401927
ja 0x140017de0
mov rdx, rcx
rol rdx, 6
nop
mov r8d, dword [0x141dc1c58]
xor r8d, dword [0x141dc1c5c]
cmp r8d, 0x86e86f7e
je 0x140017e10
xor edx, ecx
movzx ecx, dx
add rax, rcx
mov ecx, 0xbf6e5457
nop word cs:[rax + rax]
mov edx, dword [0x141dc1c60]
and edx, dword [0x141dc1c64]
imul edx, edx, 0x535d45c8
imul rdx, rcx
shr rdx, 0x3e
and edx, 1
cmp edx, 0x4d73bc4c
ja 0x140017e40
ret

Function at 0x140017ed0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov r8, rdx
shr r8, 2
xor r8, rdx
mov ecx, 0x1d6d882b
sub rcx, r8
mov rdx, rcx
rol rdx, 6
xor rdx, rcx
mov rcx, rdx
rol rcx, 6
xor rcx, rdx
nop dword [rax]
mov edx, dword [0x141dc1c70]
xor edx, dword [0x141dc1c74]
add edx, 0xc3935999
shr edx, 2
imul rdx, rdx, 0x288537a7
shr rdx, 0x3a
cmp edx, 0x37e1bf7f
je 0x140017f00
movzx ecx, cx
add rax, rcx
ret

Function at 0x140018010
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0xffffffffedb3fb28
movabs r8, 0xffffffff450be045
add r8, rdx
mov rcx, r8
rol rcx, 1
xor rcx, r8
mov edx, dword [0x141dc1c90]
sub edx, dword [0x141dc1c94]
imul edx, edx, 0x491ccbb5
imul rdx, rdx, 0xb0d310d
shr rdx, 0x3b
or edx, 0xccc992f0
cmp edx, 0x842eb925
jb 0x140018030
movzx ecx, cx
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141dc1c98]
and ecx, dword [0x141dc1c9c]
xor ecx, 0x46f354e0
add ecx, 0x7810a42d
cmp ecx, 0x614d955c
jb 0x140018070
ret

Function at 0x1400180a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
shr rcx, 0x18
xor rcx, rdx
mov rdx, rcx
rol rdx, 2
xor rdx, rcx
xor rdx, 0xffffffffe2bc9ef5
add rdx, 0x7b790a36
mov rcx, rdx
rol rcx, 3
xor rcx, rdx
nop
mov edx, dword [0x141dc1ca0]
xor edx, dword [0x141dc1ca4]
shr edx, 1
imul rdx, rdx, 0x401a89d
shr rdx, 0x38
cmp edx, 0xd004df83
je 0x1400180d0
movzx ecx, cx
add rax, rcx
xor ecx, ecx
nop dword [rax]
test cl, cl
jne 0x140018100
nop word cs:[rax + rax]
mov ecx, dword [0x141dc1ca8]
xor ecx, dword [0x141dc1cac]
imul ecx, ecx, 0x45bfac4c
or ecx, 0x792d1db6
add ecx, 0x705def8b
cmp ecx, 0x285ed7c5
jb 0x140018110
ret

Function at 0x140018190
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov r9, rdx
rol r9, 4
mov eax, dword [0x141dc1cb8]
xor edx, edx
div dword [0x141dc1cbc]
xor r9, r8
mov r8, r9
rol r8, 1
xor r8, r9
nop word cs:[rax + rax]
mov eax, dword [0x141dc1cc0]
xor edx, edx
div dword [0x141dc1cc4]
imul eax, eax, 0xc0a9e6ed
shr eax, 2
imul rax, rax, 0x2017f553
shr rax, 0x36
cmp eax, 0x69323e77
ja 0x1400181c0
mov eax, dword [0x141dc1cc8]
xor edx, edx
div dword [0x141dc1ccc]
mov r9, 0xffffffffbb77fe50
sub r9, r8
mov r8, r9
rol r8, 4
nop dword [rax + rax]
mov eax, dword [0x141dc1cd0]
xor edx, edx
div dword [0x141dc1cd4]
add eax, 0x16fb9b1d
xor eax, 0xf12d6edd
cmp eax, 0x6a7e0009
jb 0x140018210
xor r8d, r9d
movzx eax, r8w
add rcx, rax
mov rax, rcx
ret
Function at 0x140018240
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
shr r8, 0x16
xor r8, rdx
nop word [rax + rax]
mov eax, dword [0x141dc1cd8]
or eax, dword [0x141dc1cdc]
xor eax, 0x992a01da
add eax, 0xcf1e680c
imul rax, rax, 0x2248e089
shr rax, 0x3c
cmp eax, 0xc0761f4e
je 0x140018250
movabs r10, 0xfe22f39a3a56857f
mov eax, dword [0x141dc1ce0]
xor r9d, r9d
xor edx, edx
div dword [0x141dc1ce4]
imul rdx, r8, 0xffffffffefcdbdef
add rdx, r10
mov rax, rdx
rol rax, 2
xor rax, rdx
mov rdx, rax
rol rdx, 7
nop
test r9b, r9b
jne 0x1400182b0
xor edx, eax
movzx eax, dx
add rcx, rax
mov r8d, 0x8e7e223f
nop word cs:[rax + rax]
mov eax, dword [0x141dc1ce8]
xor edx, edx
div dword [0x141dc1cec]
and eax, 0x911e785f
add eax, 0x3105b1b8
imul rax, r8
shr rax, 0x3f
cmp eax, 0x86aa7762
ja 0x1400182d0
mov rax, rcx
ret

Function at 0x140018800
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, 0x5d081d2d
sub rcx, rdx
mov rdx, rcx
shr rdx, 0x14
xor rdx, rcx
imul rcx, rdx, 0xffffffff90b9a0b9
add rcx, 0x11fb624e
mov rdx, rcx
rol rdx, 2
xor r8d, r8d
nop dword [rax]
test r8b, r8b
jne 0x140018830
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop dword [rax]
mov ecx, dword [0x141dc1d70]
sub ecx, dword [0x141dc1d74]
add ecx, 0x419f6733
xor ecx, 0x28e40420
or ecx, 0x93139bdd
cmp ecx, 0xcc23ed37
ja 0x140018840
ret

Function at 0x1400189d0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x141dc1da0]
xor edx, edx
div dword [0x141dc1da4]
mov eax, 0x95cc52bd
imul r8, r8, 0x62b15481
nop dword [rax]
mov edx, dword [0x141dc1da8]
imul edx, dword [0x141dc1dac]
and edx, 0xab284b9c
imul rdx, rax
shr rdx, 0x3e
add edx, 0x6b8ad363
cmp edx, 0x5f0e0443
jb 0x1400189f0
mov eax, dword [0x141dc1db0]
xor edx, edx
div dword [0x141dc1db4]
add r8, 0x5e4ee9e
mov rax, r8
rol rax, 2
nop word cs:[rax + rax]
mov edx, dword [0x141dc1db8]
add edx, dword [0x141dc1dbc]
xor edx, 0x68313c00
and edx, 0x6eb93e0c
add edx, 0x998314dc
cmp edx, 0xed325fc3
ja 0x140018a40
xor eax, r8d
movzx eax, ax
add rcx, rax
mov rax, rcx
ret

Function at 0x140018a80
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0x2b97f889
lea rcx, [rdx + 1]
shr rcx, 8
mov r8, 0xfffffffffffffffe
sub r8, rdx
xor rcx, r8
mov rdx, rcx
rol rdx, 2
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop
mov ecx, dword [0x141dc1dc0]
xor ecx, dword [0x141dc1dc4]
cmp ecx, 0x57b5a220
je 0x140018ab0
ret

Function at 0x140018ad0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
xor rcx, 0xffffffffbe5baa01
rol rcx, 1
xor rcx, rdx
xor rcx, 0x41a455fe
mov r8d, 0x858e8ba1
mov rdx, rcx
rol rdx, 1
nop word cs:[rax + rax]
mov r9d, dword [0x141dc1dc8]
xor r9d, dword [0x141dc1dcc]
or r9d, 0xce37e002
imul r9, r8
shr r9, 0x3d
or r9d, 0x9ef200f2
cmp r9d, 0xe9a6b9a9
ja 0x140018b00
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141dc1dd0]
sub ecx, dword [0x141dc1dd4]
imul rcx, rcx, 0x6164e98d
shr rcx, 0x3e
xor ecx, 0x238525a1
add ecx, 0x2ded6fe5
cmp ecx, 0xfea202b4
ja 0x140018b40
ret
Function at 0x140018b70
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
add rdx, 0x24b61fb0
nop word [rax + rax]
mov ecx, dword [0x141dc1dd8]
sub ecx, dword [0x141dc1ddc]
xor ecx, 0x47a9aca5
add ecx, 0x9de4874f
or ecx, 0xbfa8c13
cmp ecx, 0x142196bb
je 0x140018b80
mov r8d, 0xc0838535
xor rdx, 0xffffffffaa849540
imul rdx, rdx, 0x2c3947c9
mov rcx, rdx
rol rcx, 6
nop word cs:[rax + rax]
mov r9d, dword [0x141dc1de0]
sub r9d, dword [0x141dc1de4]
imul r9, r8
shr r9, 0x3e
or r9d, 0xec7eb278
cmp r9d, 0x27d20198
jb 0x140018bd0
xor ecx, edx
movzx ecx, cx
add rax, rcx
mov ecx, 0xe02e39f5
nop word cs:[rax + rax]
mov edx, dword [0x141dc1de8]
xor edx, dword [0x141dc1dec]
add edx, 0x60ef809
imul rdx, rcx
shr rdx, 0x3a
or edx, 0x141da6da
cmp edx, 0x84264ac9
ja 0x140018c10
ret

Function at 0x140018c40
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0xffffffff91021fe3
mov rax, rdx
shr rax, 3
xor rax, rdx
mov r8, rax
shr r8, 0x1e
xor r8, rax
mov r9, r8
rol r9, 6
nop word cs:[rax + rax]
mov eax, dword [str..j:D]
xor edx, edx
div dword [0x141dc1df4]
xor eax, 0x62d7970d
add eax, 0x3162657
and eax, 0x6e5627df
cmp eax, 0xf64eb6dd
ja 0x140018c70
xor r9d, r8d
movzx eax, r9w
add rcx, rax
xor eax, eax
test al, al
jne 0x140018ca0
mov rax, rcx
ret

Function at 0x140018d30
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
rol r8, 3
xor r8, rdx
add r8, 0xffffffffeb98a398
mov r9, r8
rol r9, 7
nop dword [rax + rax]
mov eax, dword [0x141dc1e08]
xor edx, edx
div dword [0x141dc1e0c]
imul rax, rax, 0x1eef4467
shr rax, 0x3c
imul eax, eax, 0x6b3c96b0
xor eax, 0x6b04bbb
cmp eax, 0x5caf4fe6
ja 0x140018d50
xor r9d, r8d
movzx eax, r9w
add rcx, rax
nop word cs:[rax + rax]
mov eax, dword [0x141dc1e10]
xor eax, dword [0x141dc1e14]
imul eax, eax, 0x751fd119
add eax, 0x7d832fa6
xor eax, 0xfe3a7184
cmp eax, 0xe20240f9
ja 0x140018d90
mov rax, rcx
ret

Function at 0x140018dc0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
shr rax, 0x17
xor rax, rdx
mov rdx, rax
shr rdx, 0x10
xor rdx, rax
imul r8, rdx, 0x702eec05
nop dword [rax + rax]
mov eax, dword [0x141dc1e18]
xor edx, edx
div dword [0x141dc1e1c]
add eax, 0xf8063637
or eax, 0xae761259
imul eax, eax, 0x2f80767c
cmp eax, 0x776eb825
ja 0x140018de0
mov rax, r8
rol rax, 6
xor edx, edx
nop
test dl, dl
jne 0x140018e10
xor eax, r8d
movzx edx, ax
mov eax, 0xf91e0679
add rcx, rdx
nop word cs:[rax + rax]
mov edx, dword [0x141dc1e20]
xor edx, dword [0x141dc1e24]
or edx, 0x9ffff9ff
imul rdx, rax
shr rdx, 0x3c
cmp edx, 0x4d8a6548
je 0x140018e30
mov rax, rcx
ret
Function at 0x140018e60
Capabilities:
Encode data using xor

Disassembly:
neg rdx
mov rax, rdx
shr rax, 0x1b
nop word [rax + rax]
mov r8d, dword [0x141dc1e28]
sub r8d, dword [0x141dc1e2c]
imul r8, r8, 0x5cb25d3
shr r8, 0x39
add r8d, 0xe9f49ab
xor r8d, 0x8504387
cmp r8d, 0x1459e40d
ja 0x140018e70
xor rax, rdx
mov rdx, rax
shr rdx, 0x13
nop word [rax + rax]
mov r8d, dword [0x141dc1e30]
xor r8d, dword [0x141dc1e34]
or r8d, 0xeb7efffe
cmp r8d, 0x87d4f902
jb 0x140018eb0
xor rdx, rax
mov r8, 0xffffffffface4f51
sub r8, rdx
mov r9, r8
rol r9, 5
nop word cs:[rax + rax]
mov eax, dword [0x141dc1e38]
xor edx, edx
div dword [0x141dc1e3c]
xor eax, 0x8482270a
and eax, 0xc6c227cf
cmp eax, 0xc3690208
ja 0x140018ef0
xor r9d, r8d
movzx eax, r9w
add rcx, rax
mov rax, rcx
ret

Function at 0x140018fd0
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0x30fd7dcb
add rdx, 0xfffffffff772f0a4
mov r8, rdx
shr r8, 0x1b
xor r8, rdx
mov r9, r8
rol r9, 3
nop
mov eax, dword [0x141dc1e50]
xor edx, edx
div dword [0x141dc1e54]
or eax, 0xa69734a
xor eax, 0xf0622894
add eax, 0xe24b3c12
cmp eax, 0xec732987
ja 0x140018ff0
xor r9d, r8d
movzx eax, r9w
add rcx, rax
mov rax, rcx
ret

Function at 0x140019030
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rdx
xor ecx, ecx
nop dword [rax + rax]
test cl, cl
jne 0x140019040
xor rdx, 0xffffffffc7cde61c
mov rcx, rdx
shr rcx, 0x12
xor rcx, rdx
nop word cs:[rax + rax]
mov edx, dword [0x141dc1e58]
xor edx, dword [0x141dc1e5c]
imul edx, edx, 0x2538e2f6
or edx, 0x13de513e
imul edx, edx, 0x57dd8730
cmp edx, 0xdee6d3d2
ja 0x140019060
add rcx, 0x1b0eeb36
mov rdx, rcx
rol rdx, 7
nop word cs:[rax + rax]
mov r8d, dword [0x141dc1e60]
xor r8d, dword [0x141dc1e64]
or r8d, 0xffbf6faf
cmp r8d, 0xbba9a56c
je 0x1400190a0
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x140019120
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, 0xffffffffde6555c5
sub rcx, rdx
nop dword [rax]
mov edx, dword [0x141dc1e70]
imul edx, dword [0x141dc1e74]
imul edx, edx, 0x4f12a04a
xor edx, 0x59290ad1
imul edx, edx, 0xeaefab34
cmp edx, 0x2edb29e
je 0x140019130
mov rdx, rcx
shr rdx, 6
xor rdx, rcx
mov rcx, 0xffffffffe0036f85
sub rcx, rdx
mov rdx, rcx
rol rdx, 2
xor rdx, rcx
movzx ecx, dx
add rax, rcx
xor ecx, ecx
nop dword [rax]
test cl, cl
jne 0x140019180
ret

Function at 0x140019190
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
rol rax, 7
xor rax, rdx
add rax, 0x47e95d86
xor rax, 0xffffffffca17153b
mov rdx, rax
rol rdx, 1
xor rdx, rax
mov rax, rdx
rol rax, 4
xor eax, edx
movzx eax, ax
add rax, rcx
nop
mov ecx, dword [0x141dc1e78]
xor ecx, dword [0x141dc1e7c]
imul ecx, ecx, 0x45469dd2
or ecx, 0x34b6883
add ecx, 0xc3da4fa6
cmp ecx, 0x809bb4ca
jb 0x1400191c0
ret
Function at 0x1400191f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, 0xeffa
sub rcx, rdx
mov rdx, rcx
shr rdx, 0x12
xor rdx, rcx
mov rcx, rdx
rol rcx, 4
xor rcx, rdx
nop
mov edx, dword [0x141dc1e80]
add edx, dword [0x141dc1e84]
xor edx, 0x6d3a84e7
add edx, 0xf42a7f32
cmp edx, 0x43e63791
jb 0x140019210
movzx ecx, cx
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141dc1e88]
imul ecx, dword [0x141dc1e8c]
imul ecx, ecx, 0xa24a73
imul rdx, rcx, 0x1096155b
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x14
cmp ecx, 0x374c39ec
je 0x140019240
ret

Function at 0x140019270
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x141dc1e90]
xor edx, edx
div dword [0x141dc1e94]
mov rdx, r8
shr rdx, 7
xor rdx, r8
mov eax, 0x31a5f665
sub rax, rdx
mov rdx, rax
rol rdx, 1
nop dword [rax]
mov r8d, dword [0x141dc1e98]
imul r8d, dword [0x141dc1e9c]
add r8d, 0x72445d1
xor r8d, 0xcdbffb73
add r8d, 0x2881643b
cmp r8d, 0xd7c8e9d2
ja 0x1400192a0
xor edx, eax
movzx eax, dx
add rcx, rax
mov eax, 0x8ec248df
nop word [rax + rax]
mov edx, dword [0x141dc1ea0]
sub edx, dword [0x141dc1ea4]
add edx, 0x4c1f4d88
imul rdx, rax
shr rdx, 0x3f
or edx, 0xb0745108
cmp edx, 0xc71047db
ja 0x1400192e0
mov rax, rcx
ret

Function at 0x140019310
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0x673d1440
mov r8, rdx
rol r8, 3
xor r8, rdx
nop word cs:[rax + rax]
mov eax, dword [0x141dc1ea8]
sub eax, dword [0x141dc1eac]
imul rax, rax, 0x181a9611
shr rax, 0x3a
add eax, 0x662c7bca
cmp eax, 0xb003dc78
ja 0x140019330
neg r8
mov r9, r8
rol r9, 3
nop dword [rax]
mov eax, dword [0x141dc1eb0]
sub eax, dword [0x141dc1eb4]
and eax, 0xa45159b2
add eax, 0x508fff67
imul rdx, rax, 0xf691711
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
cmp eax, 0xacca6c40
je 0x140019360
nop word cs:[rax + rax]
mov eax, dword [str.ADMZ]
xor edx, edx
div dword [0x141dc1ebc]
add eax, 0x1e2f300c
xor eax, 0x330a8560
cmp eax, 0x176f5165
jb 0x1400193a0
xor r9d, r8d
movzx eax, r9w
add rcx, rax
mov rax, rcx
ret

Function at 0x1400193d0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
shr r8, 0x16
xor r8, rdx
xor r8, 0x5225f8f9
mov rax, rcx
add r8, 0xffffffffe101709b
mov rcx, r8
shr rcx, 0xf
xor rcx, r8
mov rdx, rcx
rol rdx, 1
nop dword [rax + rax]
mov r8d, dword [0x141dc1ec0]
xor r8d, dword [0x141dc1ec4]
imul r8d, r8d, 0xa8aea55b
add r8d, 0x304af1a8
cmp r8d, 0x857d785
jb 0x140019400
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x140019430
Capabilities:
Encode data using xor

Disassembly:
mov r8d, 0x9b7cd65
sub r8, rdx
xor r8, 0x10d50ce3
inc r8
nop word cs:[rax + rax]
mov eax, dword [0x141dc1ec8]
xor eax, dword [0x141dc1ecc]
imul eax, eax, 0xf0a8735c
cmp eax, 0x24dc5d63
je 0x140019450
mov eax, dword [0x141dc1ed0]
xor edx, edx
div dword [0x141dc1ed4]
mov r9, r8
rol r9, 1
xor r9, r8
mov eax, dword [0x141dc1ed8]
xor edx, edx
div dword [0x141dc1edc]
imul eax, eax, 0xe7b76bc4
and eax, 0xba25be6c
imul rax, rax, 0x3d9398ab
shr rax, 0x3d
cmp eax, 0xd3c9e3bd
je 0x140019480
movzx eax, r9w
add rcx, rax
mov rax, rcx
ret