joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401bbb50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rcx
add rcx, 8
mov qword [rsp + 0x48], rcx
xor eax, eax
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov qword [rsp + 0x38], rdx
cmp rax, rcx
jge 0x1401bbc43
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.1401bbdc0
test al, 1
jne 0x1401bbbb2
jmp 0x1401bbbf7
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.1401bbb20
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
movabs rdx, 0xa3b1863bddc593c
movabs rax, 0xa3b1863bddc5934
xor rdx, rax
call fcn.14000f52f
mov rax, qword [rsp + 0x30]
movabs rcx, 0x307b7f1df3ec8002
movabs rdx, 0x307b7f1df3ec8003
xor rcx, rdx
movabs rdx, 0xdadd725e076b685f
movabs r8, 0x25228da1f89497a0
xor rdx, r8
xor rcx, rdx
xor edx, edx
sub rdx, 1
sub rcx, rdx
sub rax, rcx
mov qword [rsp + 0x50], rax
jmp 0x1401bbb69
mov rax, qword [rsp + 0x38]
cmp rax, 0
je 0x1401bbd25
mov eax, dword [0x14024cfe0]
add eax, dword [0x14024cfe4]
add eax, 0x2f905d74
xor eax, 0xa3e75b44
mov r8d, 0xffffffff
xor r8d, 0x581b9d24
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x581b9d24
or eax, 0x581b9d24
imul eax, edx
add eax, ecx
cmp eax, 0x1b03a5bb
jb 0x1401bbda2
mov eax, dword [0x14024cfe8]
xor eax, dword [0x14024cfec]
mov ecx, 0xe996a10f
xor ecx, 0x42fe37eb
xor edx, edx
div ecx
mov ecx, 0x5986c74b
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x38]
and eax, 0xb1c193cb
movabs rcx, 0x4000000000000000
and rcx, qword [rdx]
cmp rcx, 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x3eec10ad
je 0x1401bbda2
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1401bbd04
jmp 0x1401bbd25
mov rcx, qword [rsp + 0x38]
movabs rdx, 0x14d2a10aff473dba
movabs rax, 0x14d2a10aff473db2
xor rdx, rax
call fcn.14000f4e4
mov eax, dword [0x14024cff0]
or eax, dword [0x14024cff4]
add eax, 0xbc689284
mov ecx, 0x92cc365c
xor edx, edx
div ecx
mov ecx, 0x3d901fbc
xor edx, edx
div ecx
cmp eax, 0x5c19511c
ja 0x1401bbdab
mov eax, dword [0x14024cff8]
mov ecx, dword [0x14024cffc]
xor ecx, 0x193c0c24
xor edx, edx
div ecx
mov ecx, 0xcf820cf8
xor ecx, 0xa4c35836
sub eax, ecx
sub eax, 0x37feb584
sub eax, 0xd297f742
add eax, 0x37feb584
mov ecx, 0xb4b114b7
xor ecx, 0x5fe851bf
add eax, ecx
cmp eax, 0x9d5c1af5
jbe 0x1401bbd53
add rsp, 0x58
ret
xchg ebx, eax
sub byte [rdi - 0x10817], bl
call rbx
invalid
rol dword [rdx + 0x27], cl
mov esp, 0xffff9fe9
jmp qword [rsi + 0x66]
Function at 0x1401bc280
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov eax, dword [0x14024d050]
mov ecx, 0xde51cc68
xor ecx, 0xd05420b4
xor eax, ecx
mov ecx, dword [0x14024d054]
xor ecx, 0x61f99689
xor edx, edx
div ecx
mov ecx, 0xae50a94d
xor ecx, 0xfd04009f
xor eax, ecx
mov ecx, 0xae908d9c
xor edx, edx
div ecx
and eax, 0x812f4fd4
cmp eax, 0xe3c6dd68
jae 0x1401bc352
mov eax, dword [0x14024d058]
xor edx, edx
div dword [0x14024d05c]
mov ecx, eax
mov eax, 0x49a2d9b4
xor eax, 0x61100281
add ecx, eax
sub ecx, 0x6d08c85f
mov edx, 0x5d989f1a
xor edx, 0x92935ce8
mov eax, 0xad9e9ea8
xor eax, 0x52616157
xor edx, eax
mov eax, ecx
xor eax, edx
and eax, ecx
mov dword [rsp + 0x2c], eax
mov eax, 0x58a2f3b5
xor eax, 0xd83dd0d2
mov dword [rsp + 0x28], eax
mov rax, qword [0x14025a9f0]
mov ecx, dword [rax]
call fcn.140008963
mov ecx, dword [rsp + 0x28]
mov rdx, rax
mov eax, dword [rsp + 0x2c]
add rdx, 0x50
mov qword [rsp + 0x30], rdx
cmp eax, ecx
jb 0x1401bc2cd
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
fadd qword [rax + 0x6a]
xor ebp, ecx
jb 0x1401bc358
invalid
invalid
Function at 0x1401bc700
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x57], al
je 0x1401bc8c1
mov eax, dword [0x14024d0b8]
sub eax, dword [0x14024d0bc]
mov edx, 0xffffffff
xor edx, 0xf2cdedf5
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0xf2cdedf5
add eax, edx
sub eax, ecx
xor eax, 0xc1d61bed
mov r8d, 0xffffffff
xor r8d, 0xa033a7da
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xa033a7da
or eax, 0xa033a7da
imul eax, edx
add eax, ecx
cmp eax, 0x1c99792c
jae 0x1401bc97c
mov rcx, qword [rsp + 0x48]
mov edx, dword [0x14024d0c0]
xor edx, 0xaf8143e0
or edx, dword [0x14024d0c4]
mov eax, 0x622b9eab
xor eax, 0xd9265cc8
add edx, eax
mov eax, edx
and eax, 0x5f294758
mov r8d, 0x3e102b97
xor r8d, 0x61396ccf
or edx, r8d
add eax, edx
imul eax, eax, 0xeada64d5
movabs rdx, 0x4012b07e5f9aeff6
movabs r8, 0xbfed4f81a0651006
xor rdx, r8
movabs r8, 0x370c75e7f220074b
movabs r9, 0xc8f38a180ddff8b4
xor r8, r9
xor rdx, r8
xor r8d, r8d
sub r8, 1
sub rdx, r8
sub rcx, rdx
mov qword [rsp + 0x30], rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x38], rcx
cmp rcx, 0x10
setb cl
mov byte [rsp + 0x47], cl
cmp eax, 0x2df281f3
jae 0x1401bc77f
mov cl, byte [rsp + 0x47]
mov al, 1
test cl, 1
mov byte [rsp + 0x57], al
jne 0x1401bc8c1
jmp 0x1401bc83a
mov rdx, qword [rsp + 0x38]
movabs rcx, 0x447e8dd782b1e6ab
mov rax, rdx
sub rax, rcx
add rax, 0xfffffffffffffff0
movabs rcx, 0x447e8dd782b1e6ab
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
movabs rdx, 0xd096a8281464880d
movabs r8, 0x2f6957d7eb9b77f2
xor rdx, r8
cmp rax, rdx
setg al
and al, cl
test al, 1
jne 0x1401bc89e
jmp 0x1401bc8ae
call fcn.140008d37
xor eax, eax
mov byte [rsp + 0x57], al
jmp 0x1401bc8c1
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x57], al
mov al, byte [rsp + 0x57]
mov byte [rsp + 0x27], al
mov ecx, dword [0x14024d0c8]
mov edx, dword [0x14024d0cc]
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
xor eax, 0x799f2cd1
mov ecx, 0xae2940ee
xor ecx, 0x836de1d4
or eax, ecx
add eax, 0x550ee811
mov ecx, 0x3908ba40
xor ecx, 0x8f267ced
cmp eax, ecx
je 0x1401bc985
mov eax, dword [0x14024d0d0]
xor edx, edx
div dword [0x14024d0d4]
mov ecx, 0x3f94adfe
xor ecx, 0x1535a886
sub eax, ecx
sub eax, 0xa558a48d
add eax, 0x2aa10578
mov ecx, 0xec7e3727
xor ecx, 0xec7e3727
sub ecx, eax
mov eax, 0x5d19cb82
xor eax, 0x5d19cb82
mov edx, 0x850af3c1
xor edx, 0x2b33f6
sub eax, edx
add ecx, eax
mov eax, 0x1f76ea0
xor eax, 0x1f76ea0
sub eax, ecx
and eax, 0x7ddf8ab4
cmp eax, 0x646c51d6
ja 0x1401bc985
mov al, byte [rsp + 0x27]
and al, 1
movzx eax, al
add rsp, 0x58
ret
invalid
invalid
Function at 0x1401be810
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
mov eax, dword [0x14024d220]
xor eax, dword [0x14024d224]
or eax, 0x280757c9
or eax, 0x2f76053
or eax, 0x6b787f84
cmp eax, 0xb077c40f
ja 0x1401bea57
mov rcx, qword [rsp + 0x50]
mov edx, dword [0x14024d228]
mov r8d, dword [0x14024d22c]
mov eax, edx
xor eax, 0xffffffff
mov r9d, r8d
xor r9d, 0xffffffff
or eax, r9d
xor edx, 0xffffffff
xor r8d, 0xffffffff
or edx, r8d
and eax, edx
xor eax, 0xffffffff
mov r9d, 0xffffffff
xor r9d, 0x8c3cfc59
mov r8d, eax
and r8d, r9d
mov edx, eax
or edx, r9d
mov r9d, 0xf33ecedc
xor r9d, 0xcc13123
xor edx, r9d
imul edx, r8d
mov r8d, eax
and r8d, 0x8c3cfc59
or eax, 0x8c3cfc59
imul eax, r8d
add eax, edx
and eax, 0xd7fff2d7
xor eax, 0xc1d6a8d8
cmp rcx, 0
sete cl
mov byte [rsp + 0x4f], cl
cmp eax, 0x44076a1b
jb 0x1401be83f
mov cl, byte [rsp + 0x4f]
xor eax, eax
test cl, 1
mov byte [rsp + 0x4e], al
jne 0x1401bea49
jmp 0x1401be8e8
mov rax, qword [rsp + 0x50]
xor ecx, ecx
sub rcx, 0xfffffffffffffff0
sub rax, rcx
mov qword [rsp + 0x38], rax
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
movabs rdx, 0xb9829cdc5f24b59
movabs rax, 0xb9829cdc5f24b49
xor rdx, rax
mov al, 1
cmp rcx, rdx
mov byte [rsp + 0x4e], al
jb 0x1401bea49
mov r8, qword [rsp + 0x40]
mov rax, r8
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x30], rax
mov rdx, rax
xor rdx, 0xffffffffffffffff
mov rcx, r8
and rcx, rdx
xor r8, 0xffffffffffffffff
mov rdx, rax
and rdx, r8
or rcx, rdx
movabs rdx, 0x53dbb22f4472629b
movabs r8, 0x53dbb22f4472629b
xor rdx, r8
cmp rcx, rdx
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x1401be987
jmp 0x1401bea36
mov eax, dword [0x14024d230]
mov ecx, dword [0x14024d234]
xor ecx, 0xffffffff
add eax, ecx
add eax, 1
mov ecx, 0x977df9c5
xor ecx, 0x4d91ee22
xor eax, ecx
add eax, 0x46918b44
or eax, 0xc294812f
cmp eax, 0xf91d6fb5
ja 0x1401bea60
mov eax, dword [0x14024d238]
mov edx, dword [0x14024d23c]
xor ecx, ecx
sub ecx, edx
add eax, ecx
sub eax, 0x8528b3ec
sub eax, 0x3e19a0ba
mov ecx, 0xbfd6eb4c
xor ecx, 0x3afe58a0
add eax, ecx
mov ecx, 0xb17e4585
xor ecx, 0x4d96817b
imul eax, ecx
mov ecx, 0x7a272716
xor ecx, 0xe819d099
sub eax, ecx
mov ecx, 0x87b55013
xor ecx, 0x86d243c
sub eax, ecx
add eax, 0x923ef78f
mov dword [rsp + 0x2c], eax
call fcn.140008d37
mov eax, dword [rsp + 0x2c]
cmp eax, 0xc066b46e
jbe 0x1401be9bd
xor eax, eax
mov byte [rsp + 0x4e], al
jmp 0x1401bea49
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x4e], al
mov al, byte [rsp + 0x4e]
and al, 1
movzx eax, al
add rsp, 0x58
ret
xor dword fs:[rdi + rdx*8], edx
jmp 0x1401be83f
xchg ebp, eax
insd dword [rdi], dx
mov edi, 0xffff54e9
dec dword [rdi]
invalid
Function at 0x1401d0410
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
call fcn.1401d06d8
mov rcx, qword [rsp + 0x50]
cmp rcx, 0
je 0x1401d06c1
mov rax, qword [rsp + 0x50]
mov rcx, rax
and rcx, 0xfffffffffffffff0
shl rcx, 1
xor rax, 0xfffffffffffffff0
add rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
movabs rcx, 0x1c98465afaca6187
movabs rdx, 0x1c98465afaca6197
xor rcx, rdx
cmp rax, rcx
jb 0x1401d0611
mov rdx, qword [rsp + 0x48]
mov rax, rdx
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x38], rax
mov rcx, rax
xor rcx, 0xffffffffffffffff
mov r8, rax
xor r8, 0xffffffffffffffff
or rcx, r8
and rcx, rdx
movabs r8, 0xcfb5c79c2f4471fd
movabs r9, 0x304a3863d0bb8e02
xor r8, r9
xor rcx, r8
movabs r9, 0xed41140527be72ca
movabs r8, 0x12beebfad8418d35
xor r9, r8
mov r8, rdx
xor r8, r9
movabs r9, 0xb93a05f3846987f2
movabs r10, 0x46c5fa0c7b96780d
xor r9, r10
xor rdx, r9
or r8, rdx
movabs r9, 0x971281b9e3c76d6a
movabs rdx, 0x68ed7e461c389295
xor r9, rdx
mov rdx, rax
xor rdx, r9
movabs r9, 0x391304c2ed675f88
movabs r10, 0xc6ecfb3d1298a077
xor r9, r10
xor r8, r9
or rdx, r8
xor rcx, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
or rcx, rdx
cmp rcx, 0
setl cl
movabs rdx, 0x9dc217a85e7baa22
movabs r8, 0x623de857a18455dd
xor rdx, r8
cmp rax, rdx
setg al
and al, cl
test al, 1
jne 0x1401d0562
jmp 0x1401d05f0
mov eax, dword [0x14024da10]
or eax, dword [0x14024da14]
imul eax, eax, 0x66679699
add eax, 0x3e7cba91
sub eax, 0xc42b3498
mov ecx, 0xf7746ba7
xor ecx, 0xc908d136
sub eax, ecx
imul eax, eax, 0xefe0f731
cmp eax, 0xafd88532
je 0x1401d06c6
mov eax, dword [0x14024da18]
xor eax, 0x9f207430
xor eax, dword [0x14024da1c]
mov ecx, 0x20b3d5ce
xor edx, edx
div ecx
mov ecx, 0x573897f3
xor edx, edx
div ecx
or eax, 0xec5eff9f
mov dword [rsp + 0x34], eax
mov eax, 0xd94d97c0
xor eax, 0x26e8c6af
mov dword [rsp + 0x30], eax
call fcn.140008d37
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
cmp eax, ecx
je 0x1401d059c
jmp 0x1401d06c1
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
mov qword [rdx], rcx
mov r8, qword [rax]
xor ecx, ecx
call fcn.1400107e0
jmp 0x1401d06c1
mov eax, dword [0x14024da20]
and eax, dword [0x14024da24]
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0xa087fe2f
add eax, ecx
xor eax, 0x393068e2
mov ecx, 0x8084ac8e
xor ecx, 0x9efc8881
add eax, ecx
mov ecx, 0xed1b2d96
xor ecx, 0x589992a1
cmp eax, ecx
jae 0x1401d06cf
mov eax, dword [0x14024da28]
xor edx, edx
div dword [0x14024da2c]
mov rdx, qword [rsp + 0x40]
mov ecx, eax
mov rax, qword [rsp + 0x50]
xor ecx, 0x88b64f8a
and ecx, 0x2b26351d
imul ecx, ecx, 0xef3d61a8
mov dword [rsp + 0x2c], ecx
mov ecx, 0xa134ea00
xor ecx, 0xd917126d
mov dword [rsp + 0x28], ecx
mov r8, qword [rax]
xor eax, eax
mov cl, al
xor cl, 1
and cl, 1
call fcn.1400107e0
mov rcx, qword [rsp + 0x50]
call fcn.1400108dc
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
ja 0x1401d0651
jmp 0x1401d06c1
add rsp, 0x58
ret
push rdx
pop r8
cwde
jmp 0x1401d059c
insd dword [rdi], dx
add ecx, ebx
in al, 0xe9
jns 0x1401d06d5
invalid
invalid
Function at 0x1401d1450
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x57], al
je 0x1401d166e
mov eax, dword [0x14024daf8]
sub eax, dword [0x14024dafc]
mov edx, 0xffffffff
xor edx, 0xf2cdedf5
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0xf2cdedf5
add eax, edx
sub eax, ecx
xor eax, 0xc1d61bed
mov r8d, 0xffffffff
xor r8d, 0xa033a7da
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xa033a7da
mov r8d, 0x5f3d1b30
xor r8d, 0xff0ebcea
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x74bb4404
xor ecx, 0x68223d28
cmp eax, ecx
jae 0x1401d1710
mov rcx, qword [rsp + 0x48]
mov edx, dword [0x14024db00]
mov eax, 0x9411c7c4
xor eax, 0xc1a19f2a
xor edx, eax
mov eax, dword [0x14024db04]
xor eax, 0xef0348af
or edx, eax
add edx, 0xbb0dc263
mov eax, edx
and eax, 0x5f294758
or edx, 0x5f294758
add eax, edx
imul eax, eax, 0xeada64d5
movabs rdx, 0xd43f8ec842b359df
movabs r8, 0x2bc07137bd4ca62f
xor rdx, r8
movabs r8, 0xb20cf3ed811e2e8e
movabs r9, 0x4df30c127ee1d171
xor r8, r9
xor rdx, r8
movabs r8, 0xf4de0b2330dab314
movabs r9, 0xf4de0b2330dab314
xor r8, r9
movabs r9, 0xcea16c911762ab61
movabs r10, 0xcea16c911762ab60
xor r9, r10
sub r8, r9
sub rdx, r8
sub rcx, rdx
mov qword [rsp + 0x30], rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x38], rcx
movabs rdx, 0x10f028c1df6169a3
movabs r8, 0x10f028c1df6169b3
xor rdx, r8
cmp rcx, rdx
setb cl
mov byte [rsp + 0x47], cl
cmp eax, 0x2df281f3
jae 0x1401d14e2
mov cl, byte [rsp + 0x47]
mov al, 1
test cl, 1
mov byte [rsp + 0x57], al
jne 0x1401d166e
jmp 0x1401d15da
mov rdx, qword [rsp + 0x38]
movabs rcx, 0x447e8dd782b1e6ab
mov rax, rdx
sub rax, rcx
add rax, 0xfffffffffffffff0
movabs rcx, 0x58a57776c3a589f9
movabs r8, 0x1cdbfaa141146f52
xor rcx, r8
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
movabs rdx, 0xd3cd15fb6c4f5626
movabs r8, 0x2c32ea0493b0a9d9
xor rdx, r8
cmp rax, rdx
setg al
and al, cl
test al, 1
jne 0x1401d164b
jmp 0x1401d165b
call fcn.140008d37
xor eax, eax
mov byte [rsp + 0x57], al
jmp 0x1401d166e
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x57], al
mov al, byte [rsp + 0x57]
mov byte [rsp + 0x27], al
mov ecx, dword [0x14024db08]
mov edx, dword [0x14024db0c]
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
mov ecx, 0xe12ee8ea
xor ecx, 0x98b1c43b
xor eax, ecx
or eax, 0x2d44a13a
add eax, 0x550ee811
cmp eax, 0xb62ec6ad
je 0x1401d1719
mov eax, dword [0x14024db10]
xor edx, edx
div dword [0x14024db14]
sub eax, 0x2aa10578
mov ecx, 0x8fe3d2c2
xor ecx, 0x2abb764f
sub eax, ecx
add eax, 0x2aa10578
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x8521c037
add ecx, eax
mov eax, 0xa76e08c3
xor eax, 0xa76e08c3
sub eax, ecx
mov ecx, 0xd503c87e
xor ecx, 0xa8dc42ca
and eax, ecx
cmp eax, 0x646c51d6
ja 0x1401d1719
mov al, byte [rsp + 0x27]
and al, 1
movzx eax, al
add rsp, 0x58
ret
invalid
invalid
Function at 0x1401d5ab0
Capabilities:
Encode data using add xor sub operations

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x28], rcx
mov eax, 0x10
call fcn.14023fff0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
mov rax, rcx
add rax, 8
mov qword [rbp - 0x18], rax
mov rax, qword [rcx + 8]
mov rcx, rdx
add rcx, 8
mov qword [rbp - 0x10], rcx
cmp rax, qword [rdx + 8]
mov qword [rbp - 8], rax
je 0x1401d5b2c
mov rcx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x28]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.1401d4ff0
mov rax, qword [rbp - 0x10]
add rsp, 0x20
mov rax, qword [rax]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x38], rax
mov eax, dword [0x14024dc58]
mov edx, dword [0x14024dc5c]
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
or eax, edx
and eax, ecx
imul r11d, eax, 0x653048ba
mov eax, r11d
xor eax, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0x3dc75da8
mov edx, 0xffffffff
xor edx, 0xcfe356e
mov ecx, eax
and ecx, 0xcfe356e
and r11d, edx
mov r10d, 0xc18e853a
xor r10d, 0xcd70b054
mov r9d, r8d
and r9d, r10d
mov r10d, edx
and r10d, 0x3dc75da8
or ecx, r11d
or r9d, r10d
xor ecx, r9d
or eax, r8d
mov r8d, 0x2df79e8f
xor r8d, 0xd2086170
xor eax, r8d
or edx, 0xcfe356e
and eax, edx
or ecx, eax
mov edx, 0xe05ecdc
xor edx, 0x2f1bdbaa
mov eax, ecx
and eax, edx
mov edx, 0xde51cc68
xor edx, 0xff4ffb1e
xor ecx, edx
or eax, ecx
cmp eax, 0xdc3efc50
jbe 0x1401d5c6b
mov rcx, qword [rbp - 0x18]
mov r8, qword [rbp - 0x28]
mov r9, qword [rbp - 0x30]
mov edx, dword [0x14024dc60]
xor edx, 0xae50a94d
mov r10d, dword [0x14024dc64]
xor r10d, 0xffffffff
mov eax, edx
xor eax, r10d
and eax, edx
mov r10d, 0x30fb1a4e
xor edx, edx
div r10d
mov r10d, 0x49a2d9b4
xor r10d, 0x4a21ef80
mov edx, eax
and edx, r10d
shl edx, 1
mov r10d, 0x5d989f1a
xor r10d, 0x5e1ba92e
add eax, r10d
sub eax, edx
mov r10d, 0x4459544a
xor edx, edx
div r10d
mov rdx, qword [rbp - 0x38]
mov r9, qword [r9]
mov qword [r8], r9
mov qword [rcx], rdx
cmp eax, 0x9a1af84a
jae 0x1401d5be7
mov rsp, rbp
pop rbp
ret
push rax
or eax, 0x73e9fd96
invalid
Function at 0x1401df6c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
call fcn.1401df930
mov rcx, qword [rsp + 0x40]
cmp rcx, 0
je 0x1401df86e
mov eax, dword [0x14024e160]
mov ecx, dword [0x14024e164]
xor ecx, 0x1fc1c8d1
and eax, ecx
or eax, 0x55cc045b
mov ecx, eax
add ecx, 1
mov edx, 0x3e9784fd
xor edx, 0xc1687b02
xor eax, edx
mov edx, 0xaeb0fe4a
xor edx, 0x6dd67223
or eax, edx
add eax, ecx
add eax, 0x22f89bb
cmp eax, 0x99c64c57
je 0x1401df910
mov rcx, qword [rsp + 0x40]
mov edx, dword [0x14024e168]
sub edx, dword [0x14024e16c]
or edx, 0xbb6fcedf
mov r8d, 0xffffffff
xor r8d, 0x62a85642
mov eax, edx
xor eax, r8d
and eax, edx
or eax, 0xb93b5541
mov rdx, 0xffffffffffffffff
xor rdx, 0xfffffffffffffff0
xor r8d, r8d
sub r8, 1
sub rdx, r8
sub rcx, rdx
mov qword [rsp + 0x28], rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rcx
cmp rcx, 0x10
setb cl
mov byte [rsp + 0x3f], cl
cmp eax, 0x1c8565e6
je 0x1401df910
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x1401df84d
jmp 0x1401df7a3
mov rdx, qword [rsp + 0x30]
mov rcx, rdx
and rcx, 0xfffffffffffffff0
shl rcx, 1
mov rax, rdx
xor rax, 0xfffffffffffffff0
add rax, rcx
mov qword [rsp + 0x20], rax
mov rcx, rax
xor rcx, rdx
movabs rdx, 0xf42db40305c24708
movabs r8, 0xf42db40305c24708
xor rdx, r8
cmp rcx, rdx
setl dl
cmp rax, 0xffffffffffffffff
setg al
xor al, 0xff
mov cl, 1
xor cl, 0
xor dl, cl
xor ecx, ecx
xor cl, 1
xor r8d, r8d
xor r8b, 1
xor cl, r8b
or al, dl
or cl, 1
xor al, 0xff
and al, cl
test al, 1
jne 0x1401df81a
jmp 0x1401df824
call fcn.140008d37
jmp 0x1401df86e
mov rdx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rdx], rcx
mov r8, qword [rax]
xor eax, eax
mov cl, al
xor cl, 0
and cl, 1
call fcn.1400107e0
jmp 0x1401df86e
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
mov r8, qword [rax]
mov ecx, 1
call fcn.1400107e0
mov rcx, qword [rsp + 0x40]
call fcn.1400108dc
mov ecx, dword [0x14024e170]
xor ecx, 0x91f1d1de
mov edx, dword [0x14024e174]
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
xor ecx, ecx
sub ecx, 0x2c38e21e
sub eax, ecx
sub eax, 0xcbefac5f
mov ecx, 0xe26aa72f
xor ecx, 0xa176d103
add eax, ecx
add eax, 0xcbefac5f
mov edx, 0xffffffff
xor edx, 0xf7a6c4c7
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0xf7a6c4c7
add eax, edx
sub eax, ecx
mov ecx, 0x66770af1
xor ecx, 0xf015805d
cmp eax, ecx
je 0x1401df919
mov ecx, dword [0x14024e178]
and ecx, dword [0x14024e17c]
mov eax, ecx
and eax, 0x252c0cd
xor ecx, 0x252c0cd
or eax, ecx
sub eax, 0x2dcbe7ed
mov ecx, 0x70dbe506
xor edx, edx
div ecx
cmp eax, 0x7e954b31
ja 0x1401df8d7
add rsp, 0x48
ret
invalid
mov cl, 0xec
jmp 0x1401df8d7
Function at 0x1401dfb40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x57], al
je 0x1401dfcb8
mov rax, qword [rsp + 0x48]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x38], rcx
mov rcx, qword [rax - 0x10]
mov qword [rsp + 0x40], rcx
mov al, 1
cmp rcx, 0x10
mov byte [rsp + 0x57], al
jb 0x1401dfcb8
mov rdx, qword [rsp + 0x40]
mov rax, rdx
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x30], rax
mov rcx, rax
xor rcx, rdx
movabs rdx, 0xa4f9da11231e48e5
movabs r8, 0xa4f9da11231e48e5
xor rdx, r8
cmp rcx, rdx
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x1401dfbcd
jmp 0x1401dfca5
mov eax, dword [0x14024e190]
xor eax, 0x709e7101
xor eax, dword [0x14024e194]
mov ecx, 0x4a53e442
xor ecx, 0xf4ed1661
xor eax, ecx
mov ecx, 0x3e102b97
xor ecx, 0x9578bd73
xor edx, edx
div ecx
mov ecx, 0x5986c74b
xor edx, edx
div ecx
cmp eax, 0x81ee8476
jae 0x1401dfda0
mov eax, dword [0x14024e198]
mov ecx, dword [0x14024e19c]
mov edx, 0xf220074b
xor edx, 0x29441809
xor ecx, edx
sub eax, ecx
mov ecx, eax
and ecx, 0x1d2c5d3b
mov edx, 0x388477de
xor edx, 0xc77b8821
xor ecx, edx
add eax, 0x1d2c5d3b
mov edx, 0xafa85fc2
xor edx, 0xafa85fc3
add eax, edx
add eax, ecx
mov ecx, eax
and ecx, 0xbc689284
shl ecx, 1
xor eax, 0xbc689284
add eax, ecx
mov ecx, 0x7862fd40
xor ecx, 0xeaaecb1c
xor edx, edx
div ecx
mov dword [rsp + 0x2c], eax
mov eax, 0x1464880d
xor eax, 0x49e99184
mov dword [rsp + 0x28], eax
call fcn.140008d37
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
je 0x1401dfc0e
xor eax, eax
mov byte [rsp + 0x57], al
jmp 0x1401dfcb8
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x57], al
mov al, byte [rsp + 0x57]
mov byte [rsp + 0x27], al
mov eax, dword [0x14024e1a0]
and eax, dword [0x14024e1a4]
mov ecx, 0xe16c071
xor edx, edx
div ecx
mov ecx, 0x3a30c3de
xor ecx, 0x51719710
sub eax, ecx
sub eax, 0x88f11b67
sub eax, 0xd297f742
mov ecx, 0xae2940ee
xor ecx, 0x26d85b89
add eax, ecx
mov ecx, 0x3908ba40
xor ecx, 0x1fca2155
cmp eax, ecx
jbe 0x1401dfda9
mov eax, dword [0x14024e1a8]
xor eax, dword [0x14024e1ac]
mov r8d, 0x3f94adfe
xor r8d, 0xf7b78eb4
mov ecx, 0x798738c1
xor ecx, 0x8678c73e
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0xec7e3727
xor r8d, 0x1381c8d8
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xc823234a
or eax, 0xc823234a
imul eax, edx
add eax, ecx
xor ecx, ecx
sub ecx, 0x94d79fca
add eax, ecx
mov edx, 0xffffffff
xor edx, 0xf2cdedf5
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0xf2cdedf5
add eax, edx
sub eax, ecx
cmp eax, 0xf435c356
jae 0x1401dfd0c
jp 0x1401dfd8f
invalid
invalid
mov al, byte [rsp + 0x27]
and al, 1
movzx eax, al
add rsp, 0x58
ret
fcom dword [rcx + 0x33]
js 0x1401dfd8e
invalid
stc
sbb ch, byte [rsi - 0xa516f3]
invalid