joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001af00
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
shr r8, 7
nop word [rax + rax]
mov eax, dword [0x141dc5130]
imul eax, dword [0x141dc5134]
xor eax, 0x9390c088
or eax, 0x44692104
imul eax, eax, 0x60ac8a25
cmp eax, 0x38ee60a7
jb 0x14001af10
xor r8, rdx
mov eax, dword [0x141dc5138]
xor edx, edx
div dword [0x141dc513c]
mov eax, 0x31a5f665
sub rax, r8
mov rdx, rax
rol rdx, 1
nop word cs:[rax + rax]
mov r8d, dword [0x141dc5140]
and r8d, dword [0x141dc5144]
xor r8d, 0x97eafe17
add r8d, 0x13b6dae1
cmp r8d, 0x5fac7f6
jb 0x14001af60
xor edx, eax
movzx eax, dx
add rcx, rax
mov rax, rcx
ret

Function at 0x14001b100
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
rol rcx, 4
nop word [rax + rax]
mov r8d, dword [0x141dc5160]
xor r8d, dword [0x141dc5164]
and r8d, 0x62112f21
imul r8d, r8d, 0x523701b4
add r8d, 0x18a2033b
cmp r8d, 0x77a7761a
jb 0x14001b110
xor rcx, rdx
nop
mov edx, dword [0x141dc5168]
xor edx, dword [0x141dc516c]
imul rdx, rdx, 0x7d5fb
shr rdx, 0x32
imul edx, edx, 0xbbd8feb8
cmp edx, 0xca312f35
je 0x14001b140
mov rdx, rcx
rol rdx, 1
xor rdx, rcx
mov rcx, rdx
rol rcx, 2
nop word cs:[rax + rax]
mov r8d, dword [0x141dc5170]
imul r8d, dword [0x141dc5174]
add r8d, 0xd7f0a31b
and r8d, 0xe82464b3
cmp r8d, 0x9ebcdfff
je 0x14001b180
xor ecx, edx
movzx ecx, cx
add rax, rcx
ret

Function at 0x14001b1b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0x1303053b
mov rcx, rdx
rol rcx, 1
xor rcx, rdx
mov rdx, rcx
rol rdx, 3
xor rdx, rcx
nop dword [rax]
mov ecx, dword [0x141dc5178]
imul ecx, dword [0x141dc517c]
and ecx, 0x2d072352
xor ecx, 0x873883d9
imul ecx, ecx, 0xdd366344
cmp ecx, 0xe9905bf5
je 0x14001b1d0
mov rcx, rdx
rol rcx, 1
xor rcx, rdx
mov rdx, rcx
rol rdx, 2
nop word [rax + rax]
mov r8d, dword [0x141dc5180]
or r8d, dword [0x141dc5184]
xor r8d, 0x1c63b1df
add r8d, 0x97abad5a
cmp r8d, 0x8f6b6259
ja 0x14001b210
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop dword [rax]
mov ecx, dword [0x141dc5188]
imul ecx, dword [0x141dc518c]
imul ecx, ecx, 0x6844a3a3
shr ecx, 2
imul rcx, rcx, 0x45dc097d
shr rcx, 0x3c
imul ecx, ecx, 0xf9139862
cmp ecx, 0x9b4dccc
ja 0x14001b240
ret

Function at 0x14001b270
Capabilities:
Encode data using xor

Disassembly:
movabs rax, 0xf28f53705f122c19
imul r9, rdx, 0x3b3adb0b
add r9, rax
mov r8, r9
rol r8, 4
nop dword [rax + rax]
mov eax, dword [0x141dc5190]
xor edx, edx
div dword [0x141dc5194]
imul eax, eax, 0x3a0872c5
add eax, 0x67d251c1
imul rax, rax, 0x5fca8f83
shr rax, 0x3e
cmp eax, 0x3dc72fdf
ja 0x14001b290
xor r8, r9
nop
mov eax, dword [0x141dc5198]
xor eax, dword [0x141dc519c]
or eax, 0xe6b05a78
add eax, 0xfbf41619
cmp eax, 0x1e2f0bf8
jb 0x14001b2c0
movzx eax, r8w
add rcx, rax
mov rax, rcx
ret

Function at 0x14001b420
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rdx
nop word cs:[rax + rax]
mov ecx, dword [0x141dc51c0]
or ecx, dword [0x141dc51c4]
xor ecx, 0x2034802
and ecx, 0xc7675932
cmp ecx, 0x6096452a
je 0x14001b430
xor rdx, 0xffffffffce1e6f9b
add rdx, 0x6a41186a
mov rcx, rdx
rol rcx, 5
xor ecx, edx
movzx ecx, cx
add rax, rcx
ret
Function at 0x14001b4a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov r8, rdx
rol r8, 1
xor r8, rdx
mov rcx, 0xffffffffeebb51d1
sub rcx, r8
shr rcx, 0x1f
add r8, 0x1144ae2e
xor rcx, r8
mov rdx, rcx
rol rdx, 3
nop dword [rax + rax]
mov r8d, dword [0x141dc51c8]
or r8d, dword [0x141dc51cc]
add r8d, 0xa27141f5
and r8d, 0x21d42d7f
xor r8d, 0xe7cd70
cmp r8d, 0x46d09ed6
ja 0x14001b4d0
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x14001b510
Capabilities:
Encode data using xor

Disassembly:
movabs r8, 0xe48a6ddf40790e95
mov rax, rcx
imul rcx, rdx, 0xffffffffba39bf93
add rcx, r8
mov rdx, rcx
rol rdx, 2
nop
mov r8d, dword [0x141dc51d0]
xor r8d, dword [0x141dc51d4]
xor r8d, 0x200820
or r8d, 0x2010c384
and r8d, 0x31b5ebec
cmp r8d, 0xa6babb53
je 0x14001b530
nop dword [rax]
mov r8d, dword [0x141dc51d8]
xor r8d, dword [0x141dc51dc]
or r8d, 0xae1915ee
cmp r8d, 0xe3ee94bf
je 0x14001b560
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret
Function at 0x14003a4d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x14003a67f
lea r8, [rcx + 1]
lea r9, [rcx + rcx]
mov r10d, 8
nop word [rax + rax]
mov eax, dword [0x141dc8118]
xor edx, edx
div dword [0x141dc811c]
add eax, 0xb3ba0fb3
imul rax, rax, 0x5f972c03
shr rax, 0x3d
imul eax, eax, 0xaed2b835
cmp r9, r8
mov rdi, r8
cmova rdi, r9
cmp rdi, 9
cmovb rdi, r10
cmp eax, 0x96bd7533
je 0x14003a500
test rdi, rdi
js 0x14003a67f
nop word cs:[rax + rax]
mov eax, dword [0x141dc8120]
and eax, dword [0x141dc8124]
add eax, 0x5414d0b7
xor eax, 0x96ddf978
cmp eax, 0xba16a96f
ja 0x14003a550
test rcx, rcx
je 0x14003a588
mov rax, qword [rsi + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rcx
mov r15d, 1
jmp 0x14003a58b
xor r15d, r15d
mov eax, dword [0x141dc8128]
add eax, dword [0x141dc812c]
xor eax, 0xa8a662d5
add eax, 0x917d715d
imul rcx, rax, 0x25666325
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
cmp eax, 0xfc7cf213
jbe 0x14003a5d3
mov qword [rsp + 0x30], r15
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x28]
mov rdx, rdi
call fcn.140038fb0
lea rbx, [rsp + 0x40]
lea r14, [rsp + 0x28]
nop dword [rax]
mov eax, dword [str.9_u__AI_]
add eax, dword [0x141dc8134]
imul ebp, eax, 0xdbb65b80
add ebp, 0xca961ad3
mov qword [rsp + 0x30], r15
mov rcx, rbx
mov rdx, rdi
mov r8, r14
call fcn.140038fb0
cmp ebp, 0xdf274f4d
ja 0x14003a5e0
cmp qword [rsp + 0x40], 0
jne 0x14003a660
mov rax, qword [rsp + 0x48]
mov qword [rsi + 8], rax
mov qword [rsi], rdi
nop word [rax + rax]
mov eax, dword [0x141dc8158]
xor eax, dword [0x141dc815c]
imul eax, eax, 0x85b4dddb
add eax, 0x66e99876
or eax, 0xed681889
cmp eax, 0xc32249ed
je 0x14003a630
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov eax, dword [0x141dc8138]
sub eax, dword [0x141dc813c]
not eax
or eax, 0x82082059
and eax, 0x86282879
cmp eax, 0x63c0a92a
je 0x14003a660
mov eax, dword [0x141dc8140]
add eax, dword [0x141dc8144]
or eax, 0x7308160
xor eax, 0x73eb2022
cmp eax, 0x79137f5e
jbe 0x14003a6a0
ud2
mov eax, dword [0x141dc8148]
xor edx, edx
div dword [0x141dc814c]
add eax, 0x4eee5188
imul rax, rax, 0x465d50d3
shr rax, 0x3e
imul eax, eax, 0x8fa3c404
ud2
Function at 0x140043070
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, dword [0x141dc8978]
xor edx, edx
div dword [0x141dc897c]
imul eax, eax, 0x3407e877
or eax, 0x7ae1a85c
xor eax, 0x806dad35
cmp eax, 0x751e75ad
jae 0x14004309a
xor ecx, ecx
xgetbv
xor ecx, ecx
nop dword [rax]
mov r8d, dword [0x141dc8980]
xor r8d, dword [0x141dc8984]
or r8d, 0x4471c0e5
xor r8d, 0x39cb4921
imul rax, r8, 0x59ab13bb
shr rax, 0x20
sub r8d, eax
shr r8d, 1
add r8d, eax
shr r8d, 0x1d
xgetbv
cmp r8d, 0x943b802f
ja 0x1400430a0
shl rdx, 0x20
or rax, rdx
ret
Function at 0x140055470
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r9
mov r14, rdx
mov rbx, rcx
mov rdi, qword [rsp + 0x70]
cmp r8d, 0x110000
je 0x1400554c0
mov eax, dword [0x141dcae90]
or eax, dword [0x141dcae94]
xor eax, 0xedff4f7e
add eax, 0xc58b30b1
cmp eax, 0x628dfaec
jb 0x140055490
mov rcx, rbx
mov edx, r8d
call qword [r14 + 0x20]
mov ecx, eax
mov al, 1
test cl, cl
jne 0x140055533
nop
mov eax, dword [0x141dcae98]
xor edx, edx
div dword [0x141dcae9c]
imul eax, eax, 0xb9017fe1
add eax, 0xeb5e3afb
or eax, 0xd1ed110b
cmp eax, 0xf933cac1
ja 0x1400554c0
test rsi, rsi
je 0x140055531
mov eax, 0x866d4ad7
nop
mov ecx, dword [0x141dcaea0]
and ecx, dword [0x141dcaea4]
xor ecx, 0x6a336d9f
imul rcx, rax
shr rcx, 0x3f
or ecx, 0xfb1a8e6c
cmp ecx, 0x2993ad72
jb 0x1400554f0
mov rax, qword [r14 + 0x18]
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp rax
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400599b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
lea rax, [rdx + 7]
and rax, 0xfffffffffffffff8
sub rax, rdx
je 0x140059ab6
cmp rax, r8
cmovae rax, r8
test rax, rax
je 0x140059ab6
xor r9d, r9d
nop dword [rax + rax]
mov r10d, dword [0x141dcb780]
sub r10d, dword [0x141dcb784]
add r10d, 0xbd815f0b
and r10d, 0x7a84e404
add r10d, 0x28b7f05f
cmp r10d, 0x68946b5d
jb 0x1400599e0
cmp byte [rdx + r9], cl
je 0x140059c80
mov r10d, dword [0x141dcb788]
imul r10d, dword [0x141dcb78c]
imul r10d, r10d, 0xf163a50b
add r10d, 0x57a3ceec
or r10d, 0x8368c1ca
cmp r10d, 0xb649b530
je 0x140059a16
inc r9
cmp rax, r9
jne 0x1400599e0
lea r9, [r8 - 0x10]
nop
mov r10d, dword [0x141dcb740]
and r10d, dword [0x141dcb744]
imul r10d, r10d, 0x178f9dd7
xor r10d, 0xac108424
or r10d, 0x432f7389
cmp r10d, 0x62d761ed
je 0x140059a50
nop dword [rax]
mov r10d, dword [0x141dcb748]
and r10d, dword [str.k_.U]
or r10d, 0x3894d7e
add r10d, 0x8688e5ff
or r10d, 0xfa69f72f
cmp r10d, 0xf9f11942
jb 0x140059a80
cmp rax, r9
jbe 0x140059af6
jmp 0x140059bb7
mov r10d, 0xe5a94bf3
lea r9, [r8 - 0x10]
xor eax, eax
nop word cs:[rax + rax]
mov r11d, dword [0x141dcb738]
and r11d, dword [0x141dcb73c]
imul r11, r10
shr r11, 0x3f
or r11d, 0x5296e48
cmp r11d, 0x92486967
je 0x140059ad0
movabs r11, 0x101010101010101
movzx r10d, cl
imul r10, r11
nop dword [rax + rax]
mov r11d, dword [0x141dcb750]
and r11d, dword [0x141dcb754]
or r11d, 0x26674a00
shr r11d, 5
imul r11, r11, 0x9ffe33
shr r11, 0x2f
add r11d, 0x872fc257
cmp r11d, 0x5b2264be
jb 0x140059b10
movabs r11, 0xfefefefefefefeff
movabs rsi, 0x8080808080808080
mov edi, 0xa603b43d
nop dword [rax]
mov rbx, qword [rdx + rax]
xor rbx, r10
lea r14, [rbx + r11]
not rbx
and rbx, r14
mov r14, qword [rdx + rax + 8]
xor r14, r10
lea r15, [r14 + r11]
not r14
and r14, r15
or r14, rbx
test r14, rsi
jne 0x140059bb7
add rax, 0x10
nop
mov ebx, dword [0x141dcb760]
add ebx, dword [0x141dcb764]
imul rbx, rdi
shr rbx, 0x3e
or ebx, 0x4fdf64ca
cmp ebx, 0xe0d18832
ja 0x140059b90
cmp rax, r9
jbe 0x140059b60
add rdx, rax
mov r9, r8
sub r9, rax
mov r10d, dword [0x141dcb758]
and r10d, dword [0x141dcb75c]
and r10d, 0x965abbf1
cmp r10d, 0x7e368156
je 0x140059bc0
cmp r8, rax
jne 0x140059bea
xor eax, eax
jmp 0x140059c85
xor eax, eax
xor r8d, r8d
nop
mov r10d, dword [0x141dcb768]
and r10d, dword [0x141dcb76c]
add r10d, 0xb0fe120f
and r10d, 0x3d961733
cmp r10d, 0x154e10a9
jb 0x140059bf0
cmp byte [rdx + r8], cl
je 0x140059c80
inc r8
nop
mov r10d, dword [0x141dcb770]
add r10d, dword [0x141dcb774]
imul r10d, r10d, 0x3c1f25a4
xor r10d, 0xc6831272
cmp r10d, 0xcb666bab
ja 0x140059c20
nop word cs:[rax + rax]
mov r10d, dword [0x141dcb778]
and r10d, dword [0x141dcb77c]
and r10d, 0x8411c038
imul r10d, r10d, 0xf887e67e
cmp r10d, 0x67528272
ja 0x140059c50
cmp r8, r9
jne 0x140059bf0
jmp 0x140059c85
mov eax, 1
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14005eab0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov r9, rdx
nop dword [rax]
mov eax, dword [0x141dcc1e0]
imul eax, dword [0x141dcc1e4]
and eax, 0xe4449a
xor eax, 0x48c49092
cmp eax, 0x2c6862e7
jb 0x14005eac0
test r8, r8
je 0x14005ec95
cmp r8, 1
jne 0x14005eb40
xor eax, eax
nop
test al, al
jne 0x14005eaf0
movzx eax, byte [r9]
nop dword [rax + rax]
mov edx, dword [0x141dcc1e8]
sub edx, dword [0x141dcc1ec]
xor edx, 0x1605f3b2
add edx, 0xf7b2d5b5
cmp edx, 0x9cd81b16
jb 0x14005eb00
mov r10b, 1
cmp eax, 0x2b
je 0x14005ed1d
mov r8d, 1
cmp eax, 0x2d
je 0x14005ed1d
jmp 0x14005eca7
mov eax, dword [0x141dcc1f0]
and eax, dword [0x141dcc1f4]
imul eax, eax, 0x1f242d5
add eax, 0x14f4de70
xor eax, 0x75e04c8b
cmp eax, 0xfeb559f8
ja 0x14005eb40
movzx eax, byte [r9]
xor edx, edx
nop dword [rax]
test dl, dl
jne 0x14005eb70
nop word cs:[rax + rax]
mov edx, dword [0x141dcc1f8]
add edx, dword [0x141dcc1fc]
and edx, 0x15b87a02
cmp edx, 0xe7e1ccaa
je 0x14005eb80
cmp al, 0x2b
jne 0x14005ec9d
inc r9
lea r10, [r8 - 1]
mov eax, dword [0x141dcc200]
xor edx, edx
div dword [0x141dcc204]
nop word [rax + rax]
mov eax, dword [0x141dcc208]
xor edx, edx
div dword [0x141dcc20c]
or eax, 0xec245ef4
cmp eax, 0x937061c2
je 0x14005ebc0
nop word [rax + rax]
mov eax, dword [0x141dcc210]
xor edx, edx
div dword [0x141dcc214]
xor eax, 0x50af022c
imul eax, eax, 0x7121b04c
add eax, 0x33726f28
cmp eax, 0x55e62b04
ja 0x14005ebe0
cmp r8, 0x12
mov r8, r10
jb 0x14005eca7
xor r11d, r11d
mov esi, 0xa
xor edi, edi
xor eax, eax
nop
cmp r8, rdi
je 0x14005ed12
mul rsi
mov rdx, rax
seto al
movzx ebx, byte [r9 + rdi]
add ebx, 0xffffffd0
cmp ebx, 9
ja 0x14005ed1a
test r11b, r11b
jne 0x14005ec43
mov r10b, 2
test al, al
jne 0x14005ed1d
mov r14d, dword [0x141dcc218]
xor r14d, dword [0x141dcc21c]
xor r14d, 0xebb86577
add r14d, 0xe9393232
xor r14d, 0xeaceea09
mov eax, ebx
add rax, rdx
setb bpl
cmp r14d, 0xcae4a2d4
ja 0x14005ec53
inc rdi
test bpl, bpl
je 0x14005ec20
jmp 0x14005ed1d
xor r10d, r10d
jmp 0x14005ed1d
cmp r8, 0x11
jae 0x14005ec12
xor edx, edx
xor eax, eax
nop dword [rax + rax]
movzx r10d, byte [r9]
add r10d, 0xffffffd0
cmp r10d, 9
ja 0x14005ed1a
test dl, dl
jne 0x14005ecbe
lea rax, [rax + rax*4]
dec r8
inc r9
mov r10d, r10d
lea rax, [r10 + rax*2]
nop word cs:[rax + rax]
mov r10d, dword [0x141dcc220]
imul r10d, dword [0x141dcc224]
add r10d, 0x6f57049b
or r10d, 0x511e0203
and r10d, 0x731e2a1b
cmp r10d, 0x1147725d
jb 0x14005ece0
test r8, r8
jne 0x14005ecb0
mov qword [rcx + 8], rax
xor eax, eax
jmp 0x14005ed7e
mov r10b, 1
mov eax, dword [0x141dcc228]
or eax, dword [0x141dcc22c]
imul eax, eax, 0xfccda9a0
add eax, 0x88b6fee0
or eax, 0x81db3a15
cmp eax, 0x5731a6df
jne 0x14005ed44
mov byte [rcx + 1], r10b
mov eax, 0x890a8b35
nop dword [rax]
mov edx, dword [0x141dcc230]
xor edx, dword [0x141dcc234]
imul rdx, rax
shr rdx, 0x3f
imul edx, edx, 0xfea80e75
or edx, 0xad31f42a
mov byte [rcx + 1], r10b
cmp edx, 0x97fa83ff
jb 0x14005ed50
mov al, 1
mov byte [rcx], al
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14005ed90
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov r8b, 1
test rdx, rdx
je 0x14005edf1
mov r9, rdx
cmp rdx, 1
jne 0x14005edf8
movzx r9d, byte [rcx]
nop dword [rax + rax]
mov eax, dword [0x141dcc240]
imul eax, dword [0x141dcc244]
xor eax, 0x60c0400a
and eax, 0xeac3416e
cmp eax, 0xa4ca2c77
je 0x14005edb0
mov dl, 1
cmp r9d, 0x2b
je 0x14005f043
mov eax, 1
mov r8b, 1
cmp r9d, 0x2d
je 0x14005f046
jmp 0x14005efd2
xor edx, edx
jmp 0x14005f046
cmp byte [rcx], 0x2b
jne 0x14005efb0
mov eax, dword [str.fFb]
xor edx, edx
div dword [0x141dcc254]
inc rcx
lea rax, [r9 - 1]
nop word cs:[rax + rax]
mov edx, dword [0x141dcc258]
imul edx, dword [0x141dcc25c]
imul edx, edx, 0xf1b497bf
xor edx, 0x625700e
cmp edx, 0xb736cf3b
ja 0x14005ee20
nop word cs:[rax + rax]
mov edx, dword [0x141dcc260]
xor edx, dword [0x141dcc264]
imul edx, edx, 0xbebfb140
add edx, 0xeef252bb
or edx, 0xff069ae5
cmp edx, 0x93af4294
jb 0x14005ee50
nop word cs:[rax + rax]
mov edx, dword [0x141dcc268]
sub edx, dword [0x141dcc26c]
xor edx, 0x8001c490
or edx, 0x6e583803
imul edx, edx, 0xa85b8b2a
cmp edx, 0x2a61b899
jb 0x14005ee80
cmp r9, 4
mov r9, rax
jb 0x14005efd2
xor r10d, r10d
mov r11b, 0xa
mov esi, 0x83985df7
xor edx, edx
test r9, r9
setne bl
je 0x14005ef9b
nop dword [rax]
mov eax, edx
mul r11b
seto bpl
test r10b, r10b
jne 0x14005eed0
movzx edi, byte [rcx]
add edi, 0xffffffd0
mov r14d, dword [0x141dcc270]
and r14d, dword [0x141dcc274]
or r14d, 0x5d6cd918
imul r14, rsi
shr r14, 0x3e
or r14d, 0x6a8716a0
cmp edi, 0xa
setae dl
cmp r14d, 0xabd83f54
ja 0x14005eee4
or dl, bpl
jne 0x14005f010
mov edx, dword [0x141dcc278]
imul edx, dword [0x141dcc27c]
imul r14, rdx, 0xa0ffee1
shr r14, 0x20
sub edx, r14d
shr edx, 1
add edx, r14d
shr edx, 0x1f
xor edx, 0xcd921f33
add edx, 0xd572603d
cmp edx, 0x6659b8b8
jb 0x14005ef20
dec r9
inc rcx
nop dword [rax]
mov edx, dword [0x141dcc280]
imul edx, dword [str.Kdx_lq]
xor edx, 0xca1c020f
imul r14, rdx, 0x109135c9
shr r14, 0x3c
mov edx, eax
add dl, dil
setb bpl
cmp r14d, 0xddd0206b
ja 0x14005ef60
test bpl, bpl
je 0x14005eec0
mov dl, 2
mov r8d, ebx
jmp 0x14005f046
mov eax, dword [0x141dcc248]
add eax, dword [0x141dcc24c]
cmp eax, 0x8ba75011
je 0x14005efb0
mov eax, 2
cmp r9, 3
jae 0x14005eeb3
xor r9d, r9d
xor r10d, r10d
nop dword [rax + rax]
movzx edx, byte [rcx + r9]
add edx, 0xffffffd0
cmp edx, 0xa
setae r8b
jae 0x14005f03f
movzx r10d, r10b
add r10d, r10d
lea r10d, [r10 + r10*4]
add dl, r10b
inc r9
mov r10d, edx
cmp rax, r9
jne 0x14005efe0
jmp 0x14005f046
mov eax, dword [0x141dcc238]
xor eax, dword [0x141dcc23c]
add eax, 0xf4dc89be
xor eax, 0x20034824
or eax, 0x1b943749
cmp edi, 0xa
mov edx, 0
adc dl, 1
cmp eax, 0x619ca32f
je 0x14005f010
jmp 0x14005f046
mov dl, 1
jmp 0x14005f046
mov r8b, 1
mov eax, r8d
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140063f40
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov byte [rbp - 0x10], r8b
mov rbx, rcx
mov eax, dword [0x141dccc98]
add eax, dword [0x141dccc9c]
and eax, 0x81888008
cmp eax, 0x699f4dac
je 0x140063fca
mov ecx, dword [0x141dccca0]
xor ecx, dword [0x141dccca4]
add ecx, 0xa942346b
or ecx, 0x277ca847
mov eax, 0x8d8e1197
imul rax, rcx
shr rax, 0x20
sub ecx, eax
shr ecx, 1
add ecx, eax
shr ecx, 0x1e
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov r8, rsp
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov rdx, rsp
cmp ecx, 0xc88ad771
jbe 0x140063fe6
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
jmp 0x140063f74
mov qword [rbp - 0x18], r9
mov eax, dword [0x141dccca8]
xor eax, dword [0x141dcccac]
add eax, 0xc773160d
xor eax, 0x48dc97d8
add eax, 0xc8813978
cmp eax, 0x8de03bad
jbe 0x140064040
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x60
call fcn.1400f1350
sub rsp, rax
mov eax, 0x400
call fcn.1400f1350
sub rsp, rax
mov qword [rbp - 0x40], rdx
mov edx, 0x8a35a837
movq r14, xmm1
nop
mov eax, dword [0x141dcccb0]
sub eax, dword [0x141dcccb4]
imul r9d, eax, 0x61080521
add r9d, 0xeb0bb61b
imul r9, rdx
shr r9, 0x3f
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov r12, rsp
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov rdi, rsp
mov eax, 0x60
call fcn.1400f1350
sub rsp, rax
mov r15, rsp
mov eax, 0x400
call fcn.1400f1350
sub rsp, rax
mov r13, rsp
cmp r9d, 0xee526eee
ja 0x140064050
movabs rax, 0x1ffffffffffffe
movabs r9, 0xfffffffffffff
mov r10, r14
shr r10, 0x34
and r10d, 0x7ff
lea rdx, [r14 + r14]
and rdx, rax
mov rax, r14
and rax, r9
inc r9
mov r11, rax
or r11, r9
lea ecx, [r10 - 0x433]
lea ecx, [rdx - 0x433]

Function at 0x140065070
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp - 8], rcx
mov eax, dword [0x141dccea8]
or eax, dword [0x141dcceac]
and eax, 0x32eb49b8
add eax, 0xce7eaf09
and eax, 0x54e26e50
cmp eax, 0x3a15cc10
jne 0x1400650f0
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x60
call fcn.1400f1350
sub rsp, rax
nop dword [rax]
mov ecx, dword [0x141dcceb0]
and ecx, dword [0x141dcceb4]
and ecx, 0x10020d10
add ecx, 0x28b264c0
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov r14, rsp
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov rbx, rsp
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov r15, rsp
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov rdx, rsp
mov eax, 0x60
call fcn.1400f1350
sub rsp, rax
mov rax, rsp
cmp ecx, 0xf9eedbf6
ja 0x1400650f0
mov qword [rbp], rax
mov eax, dword [0x141dcceb8]
or eax, dword [0x141dccebc]
shr eax, 2
imul rax, rax, 0x20adb793
shr rax, 0x3a
xor eax, 0xf0a962f5
add eax, 0x42498b94
cmp eax, 0x95b970c6
jbe 0x14006519c
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov qword [rbp - 0x18], rdx
Function at 0x140065b10
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov eax, dword [0x141dccfc0]
and eax, dword [0x141dccfc4]
mov r12, rcx
imul eax, eax, 0xbbceafb1
add eax, 0x621c5192
cmp eax, 0x4fe1868a
jb 0x140065bd4
mov eax, dword [0x141dccfc8]
xor eax, dword [0x141dccfcc]
imul eax, eax, 0x993f6bb4
add eax, 0xaa765f73
imul rcx, rax, 0x22adc207
shr rcx, 0x39
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov r15, rsp
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov rbx, rsp
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov r14, rsp
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov r13, rsp
mov eax, 0x90
call fcn.1400f1350
sub rsp, rax
mov rdx, rsp
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov rax, rsp
cmp ecx, 0x8eec6825
jbe 0x140065c27
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x90
call fcn.1400f1350
sub rsp, rax
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
jmp 0x140065b4a
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
movabs rdx, 0x1ffffffffffffe
movabs r9, 0x10000000000000
movq rcx, xmm1
mov r11, rcx
shr r11, 0x34
and r11d, 0x7ff
lea rax, [rcx + rcx]
and rax, rdx
lea rdi, [r9 - 1]
and rdi, rcx
mov rdx, rdi
or rdx, r9
lea r10d, [r11 - 0x433]
nop word cs:[rax + rax]
Function at 0x14006ee20
Capabilities:
Encode data using xor

Disassembly:
vmovdqa ymm0, ymmword [rdx]
vpslld ymm0, ymm0, 2
mov eax, dword [0x141dcdd80]
add eax, dword [0x141dcdd84]
or eax, 0x5d399bfa
imul eax, eax, 0xa00a3e15
add eax, 0x354dc9af
cmp eax, 0xa06c4efc
jbe 0x14006ee50
vmovdqa ymmword [rcx], ymm0
mov eax, dword [0x141dcdd88]
xor eax, dword [0x141dcdd8c]
or eax, 0x9868acc4
imul eax, eax, 0x6cf0c154
and eax, 0xcb869b24
vmovdqa ymmword [rcx], ymm0
cmp eax, 0x566710d0
jb 0x14006ee50
vzeroupper
ret

Function at 0x14006ee80
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rsp + 0x28]
vmovd xmm0, dword [rsp + 0x48]
vpinsrd xmm0, xmm0, dword [rsp + 0x40], 1
vpinsrd xmm0, xmm0, dword [rsp + 0x38], 2
vpinsrd xmm0, xmm0, dword [rsp + 0x30], 3
vextractf128 xmm1, ymm0, 1
vpinsrd xmm1, xmm1, eax, 0
vinsertf128 ymm0, ymm0, xmm1, 1
mov eax, dword [0x141dcdd90]
sub eax, dword [0x141dcdd94]
imul eax, eax, 0x3be9fc31
and eax, 0x2095640
vextractf128 xmm1, ymm0, 1
cmp eax, 0x30cd9e2f
jbe 0x14006eef4
vpinsrd xmm2, xmm1, r9d, 1
vpinsrd xmm2, xmm2, r8d, 2
vpinsrd xmm2, xmm2, edx, 3
vinsertf128 ymm2, ymm0, xmm2, 1
vmovaps ymmword [rcx], ymm2
vpinsrd xmm1, xmm1, r9d, 1
vpinsrd xmm1, xmm1, r8d, 2
mov eax, 0x9ba37fe1
vpinsrd xmm1, xmm1, edx, 3
vinsertf128 ymm0, ymm0, xmm1, 1
nop word cs:[rax + rax]
mov edx, dword [0x141dcdd98]
and edx, dword [0x141dcdd9c]
xor edx, 0xce9cc11c
imul rdx, rax
shr rdx, 0x3f
add edx, 0xa8d4a745
vmovaps ymmword [rcx], ymm0
cmp edx, 0x9c0010a7
jb 0x14006ef20
vzeroupper
ret

Function at 0x140070060
Capabilities:
Encode data using xor

Disassembly:
mov r10, rdx
mov r11, qword [rsp + 0x28]
mov eax, dword [0x141dcddc8]
xor edx, edx
div dword [0x141dcddcc]
vmovq xmm0, r9
vmovq xmm1, r11
vpunpcklqdq xmm0, xmm1, xmm0
vmovq xmm1, r8
vinsertf128 ymm0, ymm0, xmm1, 1
nop
mov eax, dword [0x141dcddd0]
or eax, dword [0x141dcddd4]
xor eax, 0xe24a0e0d
imul eax, eax, 0xc68cb72b
cmp eax, 0x5ab3ab2c
je 0x140070090
vextractf128 xmm1, ymm0, 1
vpinsrq xmm1, xmm1, r10, 1
vinsertf128 ymm0, ymm0, xmm1, 1
mov eax, dword [0x141dcddd8]
xor edx, edx
div dword [0x141dcdddc]
add eax, 0xabf6f549
cmp eax, 0xb0067be5
ja 0x1400700c0
mov eax, dword [0x141dcdde0]
xor edx, edx
div dword [0x141dcdde4]
mov edx, 0xc6be1acd
imul rdx, rax
shr rdx, 0x3f
xor edx, 0xeec4ad73
imul eax, edx, 0x7e120024
cmp eax, 0xa98dc4a9
je 0x140070130
mov eax, dword [0x141dcdde8]
imul eax, dword [0x141dcddec]
imul eax, eax, 0x87b359f0
or eax, 0x8287e55a
and eax, 0xba9ff7fa
vmovaps ymmword [rcx], ymm0
cmp eax, 0xedd1f5c3
jne 0x140070136
vmovaps ymmword [rcx], ymm0
jmp 0x140070108
vzeroupper
ret