joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140148a80
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x28], rcx
call fcn.140147982
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call fcn.140147b60
mov cl, al
mov rax, qword [rsp + 0x38]
mov al, byte [rax]
test al, al
setne al
or al, cl
test al, 1
jne 0x140148be8
mov eax, dword [0x14024a3d8]
sub eax, dword [0x14024a3dc]
mov ecx, 0x94630f84
xor edx, edx
div ecx
mov ecx, eax
mov edx, 0x55a6f884
xor edx, 0xaa59077b
mov eax, ecx
xor eax, edx
mov edx, 0xffffffff
xor edx, 0x3c2d9558
or eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x3c2d9558
or ecx, edx
mov edx, 0x5764f03
xor edx, 0xfa89b0fc
xor eax, edx
mov edx, 0x53f74bc8
xor edx, 0xac08b437
xor ecx, edx
or eax, ecx
mov ecx, 0x65e7bae8
xor ecx, 0x65e7bae8
mov edx, 0x556c0c03
xor edx, 0x630478b7
sub ecx, edx
sub eax, ecx
cmp eax, 0x536152c
je 0x140148bee
mov rax, qword [rsp + 0x28]
mov ecx, dword [0x14024a3e0]
xor ecx, dword [0x14024a3e4]
and ecx, 0xb8879540
sub ecx, 0x300b4d52
add ecx, 0xa21f2931
add ecx, 0x300b4d52
add ecx, 0x629a2bc1
mov dword [rsp + 0x20], ecx
mov rcx, qword [rax]
mov qword [rsp + 0x50], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x50]
call fcn.1401482e0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x20]
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x27], cl
cmp eax, 0xb8a99265
je 0x140148b4b
mov al, byte [rsp + 0x27]
test al, 1
jne 0x140148bc8
jmp 0x140148be8
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
call fcn.140147b60
nop
add rsp, 0x78
ret
add cl, r15b
invalid
Function at 0x140155a10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rcx
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x140155b6c
mov eax, dword [0x14024a9a8]
xor eax, dword [0x14024a9ac]
xor eax, 0xbebef223
mov ecx, 0xab6896e4
xor edx, edx
div ecx
mov ecx, 0x5986c74b
xor edx, edx
div ecx
cmp eax, 0x81ee8476
jae 0x140155b93
mov eax, dword [0x14024a9b0]
sub eax, dword [0x14024a9b4]
or eax, 0x1d2c5d3b
add eax, 0xbc689284
mov ecx, 0xcca50bf2
xor ecx, 0x5e693dae
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x30]
movabs rcx, 0x4000000000000000
and rcx, qword [rdx]
cmp rcx, 0
sete cl
mov byte [rsp + 0x27], cl
cmp eax, 0x5d8d1989
je 0x140155a5a
mov al, byte [rsp + 0x27]
test al, 1
jne 0x140155ab8
jmp 0x140155b6c
mov eax, dword [0x14024a9b8]
mov edx, dword [0x14024a9bc]
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, edx
add eax, ecx
mov ecx, 0xe16c071
xor edx, edx
div ecx
sub eax, 0x6b4154ce
sub eax, 0xd297f742
cmp eax, 0x26c29b15
jbe 0x140155b9c
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x14024a9c0]
xor eax, dword [0x14024a9c4]
mov r9d, 0xffffffff
xor r9d, 0xc823234a
mov r8d, eax
and r8d, r9d
mov edx, eax
or edx, r9d
xor edx, 0xffffffff
imul edx, r8d
mov r8d, eax
and r8d, 0xc823234a
or eax, 0xc823234a
imul eax, r8d
add eax, edx
mov edx, 0x142413ac
xor edx, 0x9cd508cb
sub eax, edx
sub eax, 0x94d79fca
add eax, 0x88f11b67
or eax, 0xf2cdedf5
mov dword [rsp + 0x20], eax
call fcn.14000f4df
mov eax, dword [rsp + 0x20]
cmp eax, 0xf435c356
jae 0x140155b9c
jmp 0x140155b6c
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x38], rcx
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x40], rax
and al, 0x40
lea rcx, [rsp + 0x38]
call fcn.14002e2a0
nop
add rsp, 0x48
ret
fcom dword [rcx + 0x33]
js 0x140155b81
mov esi, 0x7cfffffe
cmp ebx, dword [rbp + 0x13]
jmp 0x140155aee
jl 0x140155bd9
pop rbp
adc ebp, ecx
invalid
invalid
Function at 0x140156040
Capabilities:
Encode data using xor

Disassembly:
push rax
mov qword [rsp], rcx
mov ecx, dword [0x14024a9e8]
mov eax, 0xa369e188
xor eax, 0x2dcbf41f
xor ecx, eax
mov edx, dword [0x14024a9ec]
xor edx, 0xa975be80
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, ecx
add eax, 1
xor ecx, 0xffffffff
or ecx, 0x8fcc7a7e
add ecx, eax
mov eax, 0xa112a7e6
xor eax, 0x3cc804fa
sub ecx, eax
add ecx, 0x9881feb1
add ecx, 0x9ddaa31c
mov eax, ecx
and eax, 0x49b734f3
xor eax, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0xd9523579
xor edx, 0x90e5018a
mov r8d, 0x437a8d77
xor r8d, 0xbc857288
xor edx, r8d
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
cmp eax, 0xa3d86ac2
je 0x140156164
mov rdx, qword [rsp]
mov eax, dword [0x14024a9f0]
mov ecx, dword [0x14024a9f4]
xor ecx, 0x89a7394a
sub eax, ecx
mov r8d, 0x3fd2bcba
xor r8d, 0xc02d4345
mov ecx, eax
xor ecx, r8d
mov r8d, 0x4d5f5bac
xor r8d, 0xac8a577e
and r8d, ecx
mov r9d, 0xdb7679be
xor r9d, 0x3aa3756c
mov ecx, 0xf2fc3ef
xor ecx, 0xf0d03c10
xor r9d, ecx
mov ecx, eax
and ecx, r9d
imul ecx, r8d
mov r8d, eax
and r8d, 0xe1d50cd2
or eax, 0xe1d50cd2
imul eax, r8d
add eax, ecx
sub eax, 0xe69bc3e
and eax, 0x87964538
mov ecx, 0xd3c0d431
xor ecx, 0xb62c9fc7
mov qword [rdx], 0
cmp eax, ecx
jb 0x1401560cb
pop rax
ret
jp 0x140156179
xor r9d, ebp
pop rsi
invalid
invalid
Function at 0x140163dc0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
mov eax, dword [0x14024b000]
xor eax, 0x691f660f
sub eax, dword [0x14024b004]
or eax, 0x8dcd62fa
mov ecx, 0xd0e03fef
xor edx, edx
div ecx
mov ecx, eax
xor ecx, 0xc3c38d66
mov edx, 0x11837dae
xor edx, 0xee7c8251
xor ecx, edx
or eax, 0xc3c38d66
and eax, ecx
cmp eax, 0xf9e5a11b
je 0x140164045
mov eax, dword [0x14024b008]
xor eax, 0x7eb2230f
add eax, dword [0x14024b00c]
sub eax, 0xf0a9d9
mov ecx, 0xfbab5521
xor ecx, 0x454aade
mov edx, eax
xor edx, ecx
and edx, 0xf9bfdc7c
mov r8d, 0xf2cf45ca
xor r8d, 0xb7099b6
mov ecx, 0xa5ca0a2e
xor ecx, 0x5a35f5d1
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xf9bfdc7c
or eax, 0xf9bfdc7c
imul eax, edx
add eax, ecx
add eax, 0x58aa9b63
mov dword [rsp + 0x48], eax
call fcn.140193b2f
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x48]
cmp rcx, 0
sete cl
mov byte [rsp + 0x4f], cl
cmp eax, 0xe21ed7bf
ja 0x140163e0f
mov cl, byte [rsp + 0x4f]
xor eax, eax
test cl, 1
mov byte [rsp + 0x47], al
jne 0x140164032
jmp 0x140163eb4
mov rax, qword [rsp + 0x50]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x30], rcx
mov rax, qword [rax - 0x10]
mov qword [rsp + 0x38], rax
cmp rax, 0x10
setb cl
mov byte [rsp + 0x45], cl
mov al, 1
test cl, 1
mov byte [rsp + 0x46], al
jne 0x140164007
mov r8, qword [rsp + 0x38]
movabs rcx, 0x2f13c26259e006df
mov rax, r8
sub rax, rcx
movabs rcx, 0xc678867852b340e2
movabs rdx, 0x39877987ad4cbf12
xor rcx, rdx
add rax, rcx
movabs rcx, 0x2f13c26259e006df
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, 0xffffffffffffffff
movabs rdx, 0xf283eef1dbb32c40
and rcx, rdx
movabs r10, 0xb42938a7751a18fa
movabs rdx, 0x46aad656aea934ba
xor r10, rdx
movabs rdx, 0xce4f7200bbfdaef7
movabs r9, 0x31b08dff44025108
xor rdx, r9
xor r10, rdx
mov r9, rax
and r9, r10
movabs r11, 0xb4df783df7407c42
movabs rdx, 0x4b2087c208bf83bd
xor r11, rdx
mov rdx, r8
xor rdx, r11
movabs r11, 0xf283eef1dbb32c40
and rdx, r11
and r8, r10
or rcx, r9
or rdx, r8
xor rcx, rdx
cmp rcx, 0
setl dl
movabs rcx, 0x7704b2451255448c
movabs r8, 0x88fb4dbaedaabb73
xor rcx, r8
cmp rax, rcx
setg cl
xor dl, 0xff
mov al, cl
xor al, dl
and al, cl
test al, 1
jne 0x140163fe4
jmp 0x140163ff4
call fcn.140008d37
xor eax, eax
mov byte [rsp + 0x47], al
jmp 0x140164032
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x46], al
mov rdx, qword [rsp + 0x30]
mov cl, byte [rsp + 0x45]
mov rax, qword [rsp + 0x50]
mov r8b, byte [rsp + 0x46]
mov byte [rsp + 0x27], r8b
mov r8, qword [rax]
and cl, 1
call fcn.1400107e0
mov al, byte [rsp + 0x27]
mov byte [rsp + 0x47], al
mov al, byte [rsp + 0x47]
cmp al, 0
setne al
and al, 1
movzx eax, al
add rsp, 0x58
ret
adc byte [rdi], dl
cwde
popfq
jmp 0x140163e0f
Function at 0x14016fdc0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rcx
call fcn.140193b2f
mov rdx, qword [rsp + 0x40]
mov r8, qword [rdx]
mov qword [rsp + 0x48], r8
mov rcx, qword [rdx + 8]
add rcx, 8
lea rdx, [0x140259e10]
cmp r8, 0
cmove rcx, rdx
mov qword [rsp + 0x50], rcx
cmp byte [rax + 0x50], 0
jne 0x14016ff0e
mov rax, qword [rsp + 0x48]
cmp rax, 0
jge 0x14016fe37
mov rcx, qword [rsp + 0x48]
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
call fcn.14000db87
jmp 0x14016ff0e
mov eax, dword [0x14024b280]
and eax, dword [0x14024b284]
add eax, 0x52677e29
mov ecx, 0xe4ae0ee9
xor ecx, 0x1372c91b
add eax, ecx
mov ecx, 0x8f6fb7aa
xor ecx, 0xdd08c983
sub eax, ecx
or eax, 0xd05f5682
or eax, eax
xor eax, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xcc106fb
mov edx, 0xd540baa3
xor edx, 0xd981bc58
mov r8d, 0xe4e7703b
xor r8d, 0x1b188fc4
xor edx, r8d
and ecx, edx
mov edx, 0xcf8e9a8e
xor edx, 0x30716571
xor eax, edx
xor ecx, 0xffffffff
and eax, ecx
cmp eax, 0x98b75b6f
ja 0x14016ff18
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x14024b288]
imul eax, dword [0x14024b28c]
sub eax, 0xdce653ef
sub eax, 0x25d6d599
mov r9d, 0x984bad9c
xor r9d, 0x17f5e18f
add eax, r9d
add eax, 0x25d6d599
or eax, 0x8b929307
mov dword [rsp + 0x2c], eax
call fcn.1400a70d0
mov eax, dword [rsp + 0x2c]
cmp eax, 0xd7e4775e
ja 0x14016feb1
jmp 0x14016ff0e
mov rax, qword [rsp + 0x38]
add rsp, 0x58
ret
xchg ecx, eax
add dword [rax - 0x6f16a8], edi
invalid

Function at 0x140170230
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x14024b2a0]
xor edx, edx
div dword [0x14024b2a4]
mov edx, 0x1175599e
xor edx, 0xc9fbc8ba
mov ecx, eax
and ecx, edx
shl ecx, 1
xor eax, 0xd88e9124
add eax, ecx
mov ecx, 0x51fb787f
xor ecx, 0x61cf307d
xor edx, edx
div ecx
and eax, 0x9a4756bd
cmp eax, 0x2639426b
je 0x14017031d
mov eax, dword [0x14024b2a8]
mov edx, dword [0x14024b2ac]
mov ecx, eax
and ecx, edx
mov r8d, 0x6eddd9
xor r8d, 0x6edddb
imul ecx, r8d
xor eax, edx
add eax, ecx
mov ecx, 0xd57876ae
xor ecx, 0x28e80683
xor edx, edx
div ecx
xor eax, 0xed424a44
mov ecx, 0xd8eb2bc3
xor edx, edx
div ecx
mov dword [rsp + 0x24], eax
call fcn.140193b2f
mov rcx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x24]
mov r8, qword [rcx]
mov rcx, qword [rcx + 8]
movabs r9, 0x245db9f9d406506f
movabs rdx, 0x245db9f9d406506f
xor r9, rdx
add rcx, 8
lea rdx, [0x140259e10]
cmp r8, r9
cmove rcx, rdx
mov qword [rsp + 0x28], rcx
cmp eax, 0xc64cc056
je 0x14017027f
invalid
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret
sbb ah, ch
push rsp
jge 0x14017030b
pop rcx
invalid
Function at 0x140170330
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
mov eax, dword [0x14024b2b0]
xor edx, edx
div dword [0x14024b2b4]
mov edx, eax
xor edx, 0xffffffff
and edx, 0x5c1b8ab4
mov r8d, 0xffffffff
xor r8d, 0x5c1b8ab4
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0x902df45a
xor r8d, 0xcc367eee
mov edx, eax
and edx, r8d
or eax, 0x5c1b8ab4
imul eax, edx
add eax, ecx
add eax, 0x533f6f38
sub eax, 0x81678bc9
sub eax, 0x533f6f38
and eax, 0x22090803
cmp eax, 0xcfc91ada
je 0x140170513
mov ecx, dword [0x14024b2b8]
xor ecx, 0xec98e266
mov eax, dword [0x14024b2bc]
xor eax, 0xbec85203
and ecx, eax
add ecx, 0xc3701e9d
mov eax, ecx
xor eax, 0x360ead90
and eax, ecx
imul rax, rax, 0x6f670e29
shr rax, 0x3e
mov dword [rbp - 0x2c], eax
mov eax, 0x10
mov qword [rbp - 0x58], rax
call fcn.14023fff0
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov rcx, rsp
mov qword [rbp - 0x48], rcx
call fcn.14023fff0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x50], rax
sub rsp, 0x20
call fcn.140193b2f
mov rcx, qword [rbp - 0x48]
add rsp, 0x20
mov rdx, rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rdx
add rdx, 0x50
mov qword [rbp - 0x40], rdx
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.140170230
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov rdx, rax
mov eax, dword [rbp - 0x2c]
mov qword [rbp - 0x28], rdx
mov cl, byte [rcx + 0x50]
mov dl, 0x4f
xor dl, 0x4f
cmp cl, dl
sete cl
mov byte [rbp - 0x19], cl
cmp eax, 0x32d1b770
jae 0x1401703af
mov al, byte [rbp - 0x19]
test al, 1
jne 0x140170488
jmp 0x14017050a
mov rcx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x18]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.14016ff30
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x60], rcx
cmp byte [rax], 0
jne 0x14017050a
mov rax, qword [rbp - 0x60]
cmp rax, 0
jge 0x1401704f1
mov rcx, qword [rbp - 0x60]
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
sub rsp, 0x20
call fcn.14000db87
add rsp, 0x20
jmp 0x14017050a
mov r8, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x10]
sub rsp, 0x20
call fcn.1400a5f20
add rsp, 0x20
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
mov ch, byte [rdi]
mov ds, word [rbx]
jmp 0x1401703af
Function at 0x140192790
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rcx
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rcx], 0
mov rax, rcx
add rax, 8
mov qword [rsp + 0x58], rax
mov qword [rcx + 8], 0
mov rdx, qword [rdx]
call fcn.14001f650
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
add rdx, 8
mov qword [rsp + 0x70], rdx
mov rcx, qword [rcx]
xor eax, eax
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
cmp rax, rcx
jge 0x140192936
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x58]
mov r9, qword [rcx]
mov r9, qword [r9 + rdx*8 + 8]
mov r8, qword [r8]
mov qword [r8 + rdx*8 + 8], r9
mov rcx, qword [rcx]
mov rcx, qword [rcx + rdx*8 + 8]
mov qword [rsp + 0x30], rcx
cmp rcx, 0
mov qword [rsp + 0x38], rax
je 0x140192868
mov rcx, qword [rsp + 0x30]
call fcn.14015fff8
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov ecx, dword [0x14024bdd0]
mov eax, dword [0x14024bdd4]
xor eax, 0xffffffff
xor edx, edx
sub edx, 1
sub eax, edx
sub ecx, eax
mov eax, 0xd3dd16b0
xor eax, 0x3e7f274
and ecx, eax
and ecx, 0xa9c39c1b
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x3baf2edf
mov edx, 0xd0caa1c3
xor edx, 0xeb658f1c
mov r8d, 0x599e49bb
xor r8d, 0xa661b644
xor edx, r8d
and ecx, edx
or eax, ecx
cmp eax, 0x4564f8cb
jb 0x140192943
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x14024bdd8]
mov edx, dword [0x14024bddc]
xor edx, 0x3f22d8ed
xor eax, edx
imul eax, eax, 0xb32065b3
mov edx, 0x27098ab4
xor edx, 0xe75e048d
and eax, edx
and eax, 0xa019e45f
xor edx, edx
sub rdx, 1
sub rcx, rdx
mov qword [rsp + 0x20], rcx
cmp eax, 0xbc14b2ab
je 0x1401928d0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
jmp 0x1401927f1
mov rax, qword [rsp + 0x50]
add rsp, 0x88
ret
mov al, 0xa1
sbb eax, 0xff84e9e7
invalid
Function at 0x140199ff0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x658
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x2b0], r9
mov qword [rbp + 0x2b8], r8
mov qword [rbp + 0x2c0], rdx
mov qword [rbp + 0x2c8], rcx
mov rax, qword [rbp + 0x620]
mov qword [rbp + 0x2d0], rax
mov eax, 0x10

Function at 0x14019ca00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x14024c218]
xor ecx, 0xd1e05dff
mov eax, dword [0x14024c21c]
xor eax, 0xb14df5b1
add ecx, eax
or ecx, 0x4c8f27ea
add ecx, 0x27bb22a2
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0x4b7588f3
xor edx, 0x9a571dd0
mov r8d, 0x84e7c869
xor r8d, 0x7b183796
xor edx, r8d
or eax, edx
mov edx, 0x7f0f5448
xor edx, 0x80f0abb7
xor ecx, edx
mov edx, 0x7d2150b6
xor edx, 0xac03c595
mov r8d, 0x9940a0f4
xor r8d, 0x66bf5f0b
xor edx, r8d
or ecx, edx
mov edx, 0xc7847639
xor edx, 0x387b89c6
xor eax, edx
mov edx, 0x6502f038
xor edx, 0x9afd0fc7
xor ecx, edx
or eax, ecx
mov ecx, 0x80ecd1fe
xor ecx, 0x6d07af1f
cmp eax, ecx
je 0x14019cb11
mov eax, dword [0x14024c220]
xor eax, 0x82bdb3af
xor edx, edx
div dword [0x14024c224]
mov ecx, 0xfa34ac35
xor edx, edx
div ecx
mov ecx, 0x78967aaf
xor ecx, 0x5df36eac
xor edx, edx
div ecx
and eax, 0x519b19d3
mov dword [rsp + 0x2c], eax
mov eax, 0x5fce2361
xor eax, 0x2c284889
mov dword [rsp + 0x28], eax
call fcn.1401aa983
mov ecx, dword [rsp + 0x28]
mov rdx, rax
mov eax, dword [rsp + 0x2c]
mov rdx, qword [rdx + 0x10]
mov qword [rsp + 0x30], rdx
cmp eax, ecx
jae 0x14019caa4
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
cli
mov cl, 0xbc
mov bh, 0xe9
mov bh, bh
invalid
Function at 0x1401ac430
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
call fcn.1401aaa87
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1401aaab0
test al, 1
jne 0x1401ac462
jmp 0x1401ac48f
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
call fcn.1401ac336
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
jne 0x1401ac57e
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov edx, 8
call fcn.14000f52f
mov eax, dword [0x14024c8d8]
mov r8d, dword [0x14024c8dc]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x8a3e8bb8
mov r8d, 0xffffffff
xor r8d, 0x8a3e8bb8
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0x551f87f8
xor r8d, 0xdf210c40
mov edx, eax
and edx, r8d
or eax, 0x8a3e8bb8
imul eax, edx
add eax, ecx
sub eax, 0x7343b4ae
mov ecx, 0x3ba663f3
xor ecx, 0xb827f62a
xor edx, edx
div ecx
mov ecx, 0x93d8af7
xor ecx, 0x1901bf35
cmp eax, ecx
ja 0x1401ac6c6
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov r8d, dword [0x14024c8e0]
mov r9d, dword [0x14024c8e4]
mov eax, r8d
and eax, r9d
xor r8d, r9d
or eax, r8d
sub eax, 0xfb7a3c36
add eax, 0x9c43edea
add eax, 0xfb7a3c36
sub eax, 0x311d2795
mov r8d, 0xff116d45
xor r8d, 0xb8ace54b
add eax, r8d
mov qword [rcx], rdx
cmp eax, 0x31fc17de
jbe 0x1401ac523
jmp 0x1401ac57e
mov eax, dword [0x14024c8e8]
and eax, dword [0x14024c8ec]
mov ecx, 0x3da7f01c
xor ecx, 0x3743bf36
xor edx, edx
div ecx
mov ecx, eax
mov edx, 0x5e54896b
xor edx, 0xa66cabfe
mov eax, 0x9e5a9022
xor eax, 0x61a56fdd
xor edx, eax
mov eax, ecx
xor eax, edx
and eax, ecx
or eax, 0x20712d6a
cmp eax, 0x1561ff43
je 0x1401ac6cf
mov eax, dword [0x14024c8f0]
mov edx, dword [0x14024c8f4]
xor edx, 0x26254e07
xor ecx, ecx
sub ecx, eax
mov eax, 0xa175e068
xor eax, 0xa175e068
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, 0xfd8fafe5
xor edx, edx
div ecx
mov r11d, eax
mov eax, r11d
xor eax, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0xb20faf75
mov edx, 0xffffffff
xor edx, 0xdc7131e6
mov ecx, eax
and ecx, 0xdc7131e6
and r11d, edx
mov r10d, 0x2cd568e
xor r10d, 0xdebc6768
mov r9d, r8d
and r9d, r10d
mov r10d, edx
and r10d, 0xb20faf75
or ecx, r11d
or r9d, r10d
xor ecx, r9d
or eax, r8d
xor eax, 0xffffffff
or edx, 0xdc7131e6
and eax, edx
or ecx, eax
mov eax, ecx
and eax, eax
mov edx, 0xc4a6403f
xor edx, 0x3b59bfc0
xor eax, edx
mov edx, 0x2cfe7ff2
xor edx, 0x5a7449b9
and eax, edx
mov edx, 0x9c072ea
xor edx, 0xf63f8d15
xor eax, edx
mov edx, 0xffffffff
xor edx, 0x768a364b
mov r8d, 0xffffffff
xor r8d, 0x768a364b
or edx, r8d
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0xf01381a6
xor ecx, 0xbd4cda0a
cmp eax, ecx
jb 0x1401ac6cf
add rsp, 0x38
ret
rcl dword [rsp + rdi*4]
xchg ebp, eax
jmp 0x1401ac523
jae 0x1401ac72e
and eax, 0xfef0e9cc
invalid
or byte [rax], al
add byte [rax], al
Function at 0x1401acaf0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
mov eax, dword [0x14024c960]
xor eax, dword [0x14024c964]
or eax, 0x280757c9
or eax, 0x2f76053
or eax, 0x6b787f84
cmp eax, 0xb077c40f
ja 0x1401acd44
mov rcx, qword [rsp + 0x50]
mov edx, dword [0x14024c968]
mov r8d, dword [0x14024c96c]
mov eax, edx
xor eax, 0xffffffff
mov r9d, r8d
xor r9d, 0xffffffff
or eax, r9d
xor edx, 0xffffffff
mov r9d, 0x920411ff
xor r9d, 0x6dfbee00
xor r8d, r9d
or edx, r8d
and eax, edx
xor eax, 0xffffffff
mov r9d, 0x7b685e48
xor r9d, 0xf754a211
mov edx, 0xe852fdc5
xor edx, 0x17ad023a
xor r9d, edx
mov r8d, eax
and r8d, r9d
mov edx, eax
or edx, r9d
mov r9d, 0x8a720fdc
xor r9d, 0x758df023
xor edx, r9d
imul edx, r8d
mov r8d, eax
and r8d, 0x8c3cfc59
or eax, 0x8c3cfc59
imul eax, r8d
add eax, edx
mov edx, 0x46956891
xor edx, 0x916a9a46
and eax, edx
xor eax, 0xc1d6a8d8
cmp rcx, 0
sete cl
mov byte [rsp + 0x4f], cl
cmp eax, 0x44076a1b
jb 0x1401acb1f
mov cl, byte [rsp + 0x4f]
xor eax, eax
test cl, 1
mov byte [rsp + 0x4e], al
jne 0x1401acd36
jmp 0x1401acbea
mov rax, qword [rsp + 0x50]
xor ecx, ecx
sub rcx, 0xfffffffffffffff0
sub rax, rcx
mov qword [rsp + 0x38], rax
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
movabs rdx, 0xa29224aff3f926a4
movabs rax, 0xa29224aff3f926b4
xor rdx, rax
mov al, 1
cmp rcx, rdx
mov byte [rsp + 0x4e], al
jb 0x1401acd36
mov r8, qword [rsp + 0x40]
mov rax, r8
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x30], rax
mov rdx, rax
xor rdx, 0xffffffffffffffff
mov rcx, r8
and rcx, rdx
xor r8, 0xffffffffffffffff
mov rdx, rax
and rdx, r8
or rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x1401acc73
jmp 0x1401acd23
mov eax, dword [0x14024c970]
mov ecx, dword [0x14024c974]
xor ecx, 0xa98c9cf4
xor ecx, 0xffffffff
add eax, ecx
add eax, 1
xor eax, 0xdaec17e7
add eax, 0x46918b44
or eax, 0xc294812f
cmp eax, 0xf91d6fb5
ja 0x1401acd4d
mov eax, dword [0x14024c978]
xor eax, 0x65eead46
mov edx, dword [0x14024c97c]
mov ecx, 0xe838d7c4
xor ecx, 0x126b307
xor edx, ecx
mov ecx, 0xd7865bcb
xor ecx, 0xd7865bcb
sub ecx, edx
add eax, ecx
sub eax, 0x8528b3ec
sub eax, 0x3e19a0ba
mov ecx, 0x900e16ff
xor ecx, 0x1526a513
add eax, ecx
imul eax, eax, 0xfce8c4fe
sub eax, 0x923ef78f
sub eax, 0x8fd8742f
add eax, 0x923ef78f
mov dword [rsp + 0x2c], eax
call fcn.140008d37
mov eax, dword [rsp + 0x2c]
cmp eax, 0xc066b46e
jbe 0x1401acca7
xor eax, eax
mov byte [rsp + 0x4e], al
jmp 0x1401acd36
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x4e], al
mov al, byte [rsp + 0x4e]
and al, 1
movzx eax, al
add rsp, 0x58
ret
xor dword fs:[rdi + rdx*8], edx
jmp 0x1401acb1f
xchg ebp, eax
insd dword [rdi], dx
mov edi, 0xffff51e9
jmp qword [rsi + 0x2e]
Function at 0x1401af6a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x240
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x138], r8
mov qword [rbp + 0xe8], rdx
mov qword [rbp + 0x128], rcx
mov qword [rbp + 0xf0], rcx
mov eax, 0x10
mov qword [rbp + 0x110], rax
call fcn.14023fff0
sub rsp, rax
mov rax, qword [rbp + 0x110]
mov rcx, rsp