joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012510
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
call fcn.14000c8dc
mov qword [rsp + 0x40], rax
call fcn.14000c8dc
mov rax, qword [rsp + 0x40]
mov rcx, rax
add rcx, 0x20
mov qword [rsp + 0x48], rcx
mov rdx, qword [rax + 0x20]
xor eax, eax
sub rax, rdx
movabs rcx, 0x400a245389ea5df
movabs r8, 0x400a245389ea5df
xor rcx, r8
movabs r8, 0x37f0e63d1be52d91
movabs r9, 0x37f0e63d1be52d90
xor r8, r9
sub rcx, r8
add rax, rcx
xor ecx, ecx
sub rcx, rax
mov qword [rsp + 0x50], rcx
xor rdx, 0xffffffffffffffff
movabs rax, 0x99f8ef92bc49b5ea
movabs r8, 0x6607106d43b64a15
xor rax, r8
xor rdx, rax
mov rax, rcx
xor rax, rdx
and rax, rcx
cmp rax, 0
jge 0x1400125c0
call fcn.1400091c0
jmp 0x14001276b
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x50]
mov qword [rcx + 8], rdx
cmp qword [rax + 0x30], 0
jne 0x1400125ed
mov rcx, qword [rsp + 0x48]
mov edx, 0x400
call fcn.14000d3d0
mov rcx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
call fcn.1400110a0
mov rax, qword [rsp + 0x48]
mov r8, qword [rax]
movabs rcx, 0x747b8e119bca18f8
movabs rax, 0x8b8471ee6435e778
xor rcx, rax
mov rax, r8
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
or rcx, rcx
xor rcx, 0xffffffffffffffff
mov rdx, r8
or rdx, rdx
movabs r9, 0x544cdcc3bb512097
movabs r10, 0xabb3233c44aedf68
xor r9, r10
xor rdx, r9
xor rcx, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
and rcx, rdx
mov rdx, rax
or rdx, r8
xor rdx, 0xffffffffffffffff
movabs r8, 0xe5a74ba99444a24f
movabs r9, 0x1a58b4566bbb5db0
xor r8, r9
xor rcx, r8
movabs r8, 0x77e6f9821d4833af
movabs r9, 0x8819067de2b7cc50
xor r8, r9
xor rdx, r8
and rcx, rdx
cmp rcx, 0
setl dl
cmp rax, 0xffffffffffffffff
setg al
xor al, 0xff
xor dl, 0xff
mov cl, 1
xor cl, 0
or al, dl
or cl, 0
mov dl, 1
xor dl, 0
xor al, dl
and al, cl
test al, 1
jne 0x1400126d4
jmp 0x1400126de
call fcn.1400091c0
jmp 0x14001276b
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
cmp qword [rax + 0x38], rcx
jg 0x14001276b
mov eax, dword [0x1401f1ab8]
imul eax, dword [0x1401f1abc]
or eax, 0x827f85dc
mov ecx, eax
xor ecx, 0xdda98b22
xor ecx, 0xffffffff
or eax, 0xdda98b22
and eax, ecx
xor eax, 0x3785373d
cmp eax, 0xd9d3f77
jbe 0x140012770
mov eax, dword [0x1401f1ac0]
and eax, dword [0x1401f1ac4]
and eax, 0x8e25d3e2
mov ecx, 0x5510fea3
xor ecx, 0x6440df5e
imul eax, ecx
mov ecx, 0x8b0cd1fd
xor edx, edx
div ecx
mov dword [rsp + 0x24], eax
call fcn.1400121c0
mov eax, dword [rsp + 0x24]
cmp eax, 0x61d130de
je 0x140012726
jmp 0x14001276b
add rsp, 0x58
ret
pop rbx
leave
ret
Function at 0x140012780
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rdx
mov byte [rsp + 0x3f], cl
call fcn.14000c8dc
mov rdx, qword [rsp + 0x30]
mov cl, byte [rsp + 0x3f]
mov rax, qword [rdx + 8]
mov qword [rsp + 0x40], rax
test cl, 1
jne 0x1400127b7
jmp 0x1400128cd
mov r11d, dword [0x1401f1ac8]
imul r11d, dword [0x1401f1acc]
mov eax, 0xc66a3516
xor eax, 0x4ead2291
add r11d, eax
mov ecx, 0x2454dc5e
xor ecx, 0x2a72e4a
mov eax, r11d
xor eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x26f3f214
and r11d, ecx
shl r11d, 1
sub r11d, eax
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0x957e97af
mov edx, 0xffffffff
xor edx, 0xf3ca9f30
mov eax, ecx
and eax, 0xf3ca9f30
and r11d, edx
mov r9d, r8d
and r9d, 0xf3ca9f30
mov r10d, edx
and r10d, 0x957e97af
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
mov r8d, 0x957994a0
xor r8d, 0x6a866b5f
xor ecx, r8d
or edx, 0xf3ca9f30
and ecx, edx
or eax, ecx
mov ecx, 0x3494c2de
xor ecx, 0xcbf7b99b
cmp eax, ecx
ja 0x14001299c
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x1401f1ad0]
imul eax, dword [0x1401f1ad4]
imul eax, eax, 0x23ea48f7
sub eax, 0xb4a363a6
mov edx, 0x8eb0e45c
xor edx, 0x4adab622
add eax, edx
cmp rcx, 0
setg cl
mov byte [rsp + 0x27], cl
cmp eax, 0x2f195057
je 0x14001286d
mov al, byte [rsp + 0x27]
test al, 1
jne 0x1400128be
jmp 0x140012996
mov rcx, qword [rsp + 0x30]
call fcn.14000ca40
jmp 0x140012996
mov rax, qword [rsp + 0x40]
movabs rcx, 0xa0d759adf3b9f10b
movabs rdx, 0xa0d759adf3b9f10b
xor rcx, rdx
cmp rax, rcx
jne 0x140012996
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x30]
mov rcx, rax
add rcx, 1
xor rax, 0xffffffffffffffff
movabs rdx, 0x1245d140b3b1e8ed
movabs r8, 0x1245d140b3b1e8ec
xor rdx, r8
or rax, rdx
add rax, rcx
cmp rax, 0
jne 0x140012996
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov r8, qword [rcx]
movabs r9, 0x3854a67e7985ae1
movabs rax, 0xfc7ab5981867a51e
xor r9, rax
mov rax, r8
xor rax, r9
xor r8, 0xffffffffffffffff
and rax, r8
mov r8, 0xfffffffffffffffc
or r8, 0xfffffffffffffffc
xor r8, 0xffffffffffffffff
movabs r9, 0xb3f8b876baf1ca8c
movabs r10, 0x4c074789450e3573
xor r9, r10
xor rax, r9
xor r8, 0xffffffffffffffff
and rax, r8
mov qword [rcx], rax
call fcn.140012510
nop
add rsp, 0x48
ret
test byte [rax - 0x20], dl
pop rcx
jmp 0x14001286d
Function at 0x140015ea0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, rcx
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov qword [rax], rdx
call fcn.140015bd0
test al, 1
jne 0x140015ec4
jmp 0x140015ece
mov rcx, qword [rsp + 0x20]
call fcn.1400129a5
mov eax, dword [0x1401f1c78]
mov ecx, dword [0x1401f1c7c]
xor ecx, 0xcc06c1a6
sub eax, ecx
mov edx, 0xb0895f
xor edx, 0xff4f76a0
mov ecx, eax
xor ecx, edx
mov r11d, 0x76f33948
xor r11d, 0x2408251d
and r11d, ecx
mov ecx, 0xffffffff
xor ecx, 0x52fb1c55
and eax, ecx
or r11d, eax
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0xce90facd
mov edx, 0xffffffff
xor edx, 0xab362919
mov eax, ecx
and eax, 0xab362919
and r11d, edx
mov r9d, r8d
and r9d, 0xab362919
mov r10d, edx
and r10d, 0xce90facd
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
xor ecx, 0xffffffff
or edx, 0xab362919
and ecx, edx
or eax, ecx
mov ecx, 0x3d23ce8c
xor ecx, 0x9abca9d8
xor edx, edx
div ecx
mov ecx, 0xb88ff36d
xor ecx, 0x4ff55dff
cmp eax, ecx
je 0x140015fc6
mov eax, dword [0x1401f1c80]
mov edx, dword [0x1401f1c84]
mov ecx, eax
and ecx, edx
shl ecx, 1
add eax, edx
sub eax, ecx
mov ecx, 0x2071bdc4
xor ecx, 0x6b54544e
or eax, ecx
sub eax, 0x6b02cb10
and eax, 0x76fe5823
cmp eax, 0x92c778d6
jae 0x140015f88
add rsp, 0x28
ret
invalid
Function at 0x140017df0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x48], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x58], rax
mov rcx, qword [rcx]
mov qword [rsp + 0x60], rcx
xor eax, eax
mov edx, eax
sub rdx, 1
mov rax, rcx
sub rax, rdx
xor rcx, 0xffffffffffffffff
and rax, rcx
movabs rcx, 0xdd3239c6868d2202
movabs rdx, 0xdd3239c6868d2202
xor rcx, rdx
cmp rax, rcx
jge 0x140017e55
call fcn.1400091c0
jmp 0x14001801d
mov rax, qword [rsp + 0x60]
mov rcx, rax
add rcx, 9
mov qword [rsp + 0x40], rcx
movabs rdx, 0xdbd38096d56dee52
movabs r8, 0x242c7f692a9211ac
xor rdx, r8
sub rdx, rax
mov rax, rcx
xor rax, 0xffffffffffffffff
mov r8, rdx
xor r8, 0xffffffffffffffff
or rax, r8
xor rcx, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
or rcx, rdx
and rax, rcx
xor rax, 0xffffffffffffffff
cmp rax, 0
jge 0x140017eb7
call fcn.1400091c0
jmp 0x14001801d
mov rax, qword [rsp + 0x40]
cmp rax, 0
jge 0x140017f4c
mov eax, dword [0x1401f1d68]
add eax, dword [0x1401f1d6c]
mov ecx, 0xa0c6cd22
xor ecx, 0x68f20657
xor edx, edx
div ecx
mov ecx, 0x181b04bc
xor edx, edx
div ecx
imul eax, eax, 0x1bde66a4
cmp eax, 0x5ddb38d3
je 0x140018023
mov eax, dword [0x1401f1d70]
mov edx, dword [0x1401f1d74]
mov ecx, eax
and ecx, edx
shl ecx, 1
add eax, edx
sub eax, ecx
mov ecx, 0xf21b9a5a
xor ecx, 0x1ad9686e
sub eax, ecx
and eax, 0x6062c9c3
and eax, 0x8168f3be
mov dword [rsp + 0x3c], eax
mov rcx, r8
mov rdx, r8
call fcn.14000f6ec
mov eax, dword [rsp + 0x3c]
cmp eax, 0x7a3c7f02
jae 0x140017efb
jmp 0x14001801d
mov rcx, qword [rsp + 0x40]
call fcn.14000c8b9
mov rdx, qword [rsp + 0x50]
mov rcx, rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov qword [rdx], rcx
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rdx, qword [rax]
movabs rax, 0xa767d38d0313ce95
movabs rcx, 0xbfc21481b6dee17
xor rax, rcx
mov rcx, rdx
sub rcx, rax
add rcx, 1
movabs rax, 0xac9bf2c5187e2082
add rcx, rax
mov qword [rsp + 0x30], rcx
movabs rax, 0x3073969c0e074948
movabs r8, 0xcf8c6963f1f8b6b7
xor rax, r8
xor rdx, rax
xor rdx, 0xffffffffffffffff
mov rax, rcx
xor rax, rdx
and rax, rcx
cmp rax, 0
jge 0x140017fe2
call fcn.1400091c0
jmp 0x14001801d
mov rax, qword [rsp + 0x30]
cmp rax, 0
jge 0x140018001
mov rcx, r8
mov rdx, r8
call fcn.14000f6ec
jmp 0x14001801d
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
add rcx, 8
add rdx, 8
call fcn.140037805
nop
add rsp, 0x68
ret
iretd
Function at 0x14001aff8
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
xor eax, eax
mov edx, eax
call fcn.14001a990
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp fcn.14001ac70
Function at 0x140020190
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
mov r11d, dword [0x1401f2188]
imul r11d, dword [0x1401f218c]
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, 0x82a54c67
xor r8d, 0x3374b24c
mov eax, 0xaa8c0283
xor eax, 0x5573fd7c
xor r8d, eax
mov edx, 0xffffffff
xor edx, 0xe932c902
mov r9d, 0xd3e1e938
xor r9d, 0x3ad3203a
mov eax, ecx
and eax, r9d
and r11d, edx
mov r9d, r8d
and r9d, 0xe932c902
mov r10d, edx
and r10d, 0xb1d1fe2b
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
xor ecx, 0xffffffff
or edx, 0xe932c902
and ecx, edx
or eax, ecx
mov ecx, 0xed333df5
xor edx, edx
div ecx
mov ecx, 0xc65702a7
xor ecx, 0xaa0d9a2
xor eax, ecx
cmp eax, 0x8bcc55af
jb 0x1400202f1
mov rcx, qword [rbp - 0x10]
mov eax, dword [0x1401f2190]
mov r9d, dword [0x1401f2194]
mov edx, eax
not edx
mov r8d, r9d
and r8d, edx
mov r10d, r9d
not r10d
mov edx, eax
and edx, r10d
imul edx, r8d
mov r8d, eax
and r8d, r9d
or eax, r9d
imul eax, r8d
add eax, edx
or eax, 0x7210c3cc
and eax, 0x7a34e3cd
mov dword [rbp - 0x1c], eax
mov eax, 0x10
call fcn.1401f0aa0
sub rsp, rax
mov rax, qword [rbp - 0x18]
mov rdx, rsp
movabs r8, 0xccfd700e3473c725
movabs r9, 0xccfd700e3473c725
xor r8, r9
mov qword [rcx], r8
mov qword [rcx + 8], 0
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14001d110
mov eax, dword [rbp - 0x1c]
add rsp, 0x20
cmp eax, 0x6757aa7c
jbe 0x140020243
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
mov eax, 0xe9048320
invalid
Function at 0x140024820
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov rdx, qword [rcx]
mov rax, rdx
add rax, 0xffffffffffffffff
mov qword [rsp + 0x50], rax
mov rcx, rax
xor rcx, rdx
movabs rdx, 0x871cd680f8675271
movabs r8, 0x871cd680f8675271
xor rdx, r8
cmp rcx, rdx
setl cl
movabs rdx, 0xb0b85032bec51309
movabs r8, 0x4f47afcd413aecf6
xor rdx, r8
cmp rax, rdx
setg al
or al, al
xor al, 0xff
or cl, cl
xor edx, edx
xor dl, 1
xor cl, dl
xor al, 0xff
xor cl, 0xff
and al, cl
test al, 1
jne 0x1400248b6
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
add rcx, 8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
jmp 0x1400248c0
call fcn.1400091c0
jmp 0x140024aca
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
cmp rax, rcx
jl 0x140024abd
mov eax, dword [0x1401f23c8]
mov r8d, dword [0x1401f23cc]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
add eax, 0xfbd22f1e
sub eax, 0x2aa79389
sub eax, 0x4848b471
add eax, 0x2aa79389
mov ecx, 0x9468eb3e
xor ecx, 0xafa7e926
or eax, ecx
cmp eax, 0xa6694999
jbe 0x140024acf
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401f23d0]
mov r9d, dword [0x1401f23d4]
mov edx, 0xeb630183
xor edx, 0x149cfe7c
mov r10d, r9d
xor r10d, edx
mov r8d, eax
and r8d, r10d
mov edx, eax
or edx, r10d
xor edx, 0xffffffff
imul edx, r8d
mov r8d, eax
and r8d, r9d
or eax, r9d
imul eax, r8d
add eax, edx
add eax, 0x1eb2f107
sub eax, 0xda26dd96
mov edx, 0x64df4dc1
xor edx, 0x7a6dbcc6
sub eax, edx
mov edx, 0x4e92689e
xor edx, 0xebfaa2eb
add eax, edx
and eax, 0xcccb7e59
cmp rcx, 0
setl cl
mov byte [rsp + 0x27], cl
cmp eax, 0xd7159ad0
je 0x140024937
mov al, byte [rsp + 0x27]
test al, 1
jne 0x1400249de
jmp 0x1400249cb
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
cmp rax, qword [rcx]
jl 0x140024a61
mov eax, dword [0x1401f23d8]
add eax, dword [0x1401f23dc]
imul eax, eax, 0x2707a01c
mov ecx, 0xd71b9b91
xor edx, edx
div ecx
mov ecx, 0x8a792b8c
xor ecx, 0x37f6c9f1
and eax, ecx
cmp eax, 0xc8294d43
je 0x140024ad8
mov eax, dword [0x1401f23e0]
xor eax, 0x55b07ca0
mov ecx, dword [str.t_l]
xor ecx, 0xe65bb5c9
sub eax, ecx
mov ecx, 0x994a49aa
xor edx, edx
div ecx
add eax, 0xbd62ba26
mov ecx, 0xb2a133fc
xor edx, edx
div ecx
mov dword [rsp + 0x20], eax
mov rcx, rdx
call fcn.140016582
mov eax, dword [rsp + 0x20]
cmp eax, 0x1d711e9b
je 0x140024a11
jmp 0x140024aca
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
add rcx, 8
shl rax, 3
add rcx, rax
call fcn.1400246e0
mov rcx, qword [rsp + 0x28]
mov rax, rcx
add rax, 0xffffffffffffffff
mov rdx, rax
xor rdx, rcx
cmp rdx, 0
setl dl
cmp rcx, 0
setne cl
and cl, dl
test cl, 1
mov qword [rsp + 0x38], rax
jne 0x140024ab3
jmp 0x1400248c0
call fcn.1400091c0
jmp 0x140024aca
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
add rsp, 0x58
ret
stc
adc ebx, dword [rdx - 0x1a0161b]
invalid
out 0xb8, eax
xchg esi, eax
mov ebp, ecx
xor bh, bh
invalid
Function at 0x140028be0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401f2638]
mov r8d, dword [0x1401f263c]
mov ecx, 0xb76c108b
xor ecx, 0x4893ef74
mov r9d, r8d
xor r9d, ecx
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x5cfd4c11
xor ecx, 0xe89a87e6
add eax, ecx
or eax, 0xec8f316f
add eax, 0x94098021
cmp eax, 0x1c7ded7
jbe 0x140028d09
mov eax, dword [0x1401f2640]
xor eax, 0xaa1cebc9
xor eax, dword [0x1401f2644]
and eax, 0x8a93c26d
add eax, 0xc28b39d2
mov r8d, 0x3c7e5580
xor r8d, 0x611400e7
mov ecx, 0xecc6e624
xor ecx, 0x133919db
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0xc23c8438
xor r8d, 0x3dc37bc7
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x5d6a5567
or eax, 0x5d6a5567
imul eax, edx
add eax, ecx
mov dword [rsp + 0x28], eax
call fcn.14000c8dc
mov rcx, rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax]
call fcn.14013ce00
mov rcx, qword [rsp + 0x20]
mov eax, dword [rsp + 0x28]
cmp byte [rcx + 0x60], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x24ab0c89
jb 0x140028c46
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x140028cf9
jmp 0x140028d03
mov rcx, qword [rsp + 0x30]
call fcn.14013d081
nop
add rsp, 0x38
ret
adc dword [rax + 0xa], 0xff34e9c7
invalid

Function at 0x14002a2c0
Capabilities:
Encode data using xor

Disassembly:
and qword [rcx], 0
jmp fcn.140029870

Function at 0x14002ad6f
Capabilities:
Encode data using xor

Disassembly:
and qword [rcx], 0
jmp fcn.14002a4a0

Function at 0x14002be40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401f2818]
mov ecx, dword [0x1401f281c]
xor ecx, 0x753a02d5
add eax, ecx
mov ecx, 0x545d000e
xor edx, edx
div ecx
mov ecx, 0x9e86c83f
xor edx, edx
div ecx
mov ecx, eax
and ecx, 0x47353990
xor ecx, 0xffffffff
add eax, 0x47353990
mov edx, 0x19ca6921
xor edx, 0x19ca6920
add eax, edx
add eax, ecx
cmp eax, 0x42c7bb5
je 0x14002bef8
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401f2820]
xor eax, 0x763182f8
sub eax, dword [0x1401f2824]
mov r8d, 0x15b6cc74
xor edx, edx
div r8d
mov r8d, 0x48a7bfff
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x28]
or eax, 0x2a766ff1
mov dword [rsp + 0x24], eax
mov qword [rcx], 0
call fcn.14002ba90
mov eax, dword [rsp + 0x24]
cmp eax, 0x17257f69
jb 0x14002be9e
add rsp, 0x38
ret
mov bl, 0x7c
and al, 0xb0
jmp 0x14002be9e
Function at 0x14002ceb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov edx, dword [0x1401f2888]
mov ecx, dword [0x1401f288c]
mov eax, edx
xor eax, 0xffffffff
mov r8d, 0x12935a9d
xor r8d, 0xed6ca562
xor edx, r8d
or eax, edx
and ecx, ecx
mov edx, 0x668e08ec
xor edx, 0x9971f713
xor ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov r8d, 0xffffffff
xor r8d, 0xae31f38f
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0xbed7cc6a
xor r8d, 0x41283395
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xae31f38f
or eax, 0xae31f38f
imul eax, edx
add eax, ecx
mov edx, 0xffffffff
xor edx, 0x2df3155f
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0x2df3155f
add eax, edx
sub eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x80a317d3
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0x3e7ec708
xor r8d, 0xbeddd0db
mov edx, eax
and edx, r8d
or eax, 0x80a317d3
imul eax, edx
add eax, ecx
cmp eax, 0x2ab7aec2
jb 0x14002d028
mov eax, dword [0x1401f2890]
or eax, dword [0x1401f2894]
mov ecx, 0x271306b3
xor ecx, 0x3d573c7a
add eax, ecx
sub eax, 0x75126868
sub eax, 0xb8440e9
add eax, 0x75126868
xor eax, 0x8d23de
mov dword [rsp + 0x38], eax
mov eax, 0xe4f7808e
xor eax, 0xe868b072
mov dword [rsp + 0x34], eax
call fcn.14000c8dc
mov rcx, rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax]
call fcn.1400d10ac
mov rdx, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x34]
mov eax, dword [rsp + 0x38]
cmp byte [rdx + 0x60], 0
sete dl
mov byte [rsp + 0x3f], dl
cmp eax, ecx
jb 0x14002cf8e
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x14002d018
jmp 0x14002d022
mov rcx, qword [rsp + 0x40]
call fcn.1400d11d2
nop
add rsp, 0x48
ret
xchg ecx, eax
in eax, 0x3d
enter 0x5de9, 0xffffffffffffffff
invalid
Function at 0x14002ead0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rcx
add rcx, 8
mov qword [rsp + 0x48], rcx
xor eax, eax
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov qword [rsp + 0x38], rdx
cmp rax, rcx
jge 0x14002ec2b
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.140015bd0
test al, 1
jne 0x14002eb32
jmp 0x14002eb49
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.1400129a5
mov eax, dword [0x1401f29a8]
mov edx, dword [0x1401f29ac]
xor edx, 0xfac6b739
xor ecx, ecx
sub ecx, edx
add eax, ecx
mov ecx, 0xf73a76fa
xor edx, edx
div ecx
mov ecx, 0xb29f6649
xor edx, edx
div ecx
mov ecx, 0xab32e60e
xor ecx, 0x54cd19f1
mov edx, eax
xor edx, ecx
and edx, 0xf442e03b
mov r8d, 0x90b2ccf5
xor r8d, 0x64f02cce
mov ecx, 0x102595d5
xor ecx, 0xefda6a2a
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xf442e03b
or eax, 0xf442e03b
imul eax, edx
add eax, ecx
cmp eax, 0x24af3a43
je 0x14002ec4a
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401f29b0]
xor eax, 0xf0d891c3
xor edx, edx
div dword [0x1401f29b4]
mov r8d, 0xab750b50
xor edx, edx
div r8d
imul eax, eax, 0x154c6040
mov edx, 0x7d216e5e
xor edx, 0x9158eb36
add eax, edx
sub eax, 0x86c59a8e
sub eax, 0xec798568
add rcx, 1
mov qword [rsp + 0x28], rcx
cmp eax, 0x8039289e
jae 0x14002ebc8
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
jmp 0x14002eae9
mov rax, qword [rsp + 0x38]
cmp rax, 0
je 0x14002ec44
mov rcx, qword [rsp + 0x38]
call fcn.1400112dd
nop
add rsp, 0x58
ret
invalid
Function at 0x14002f8e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov r8, qword [rcx]
movabs rcx, 0x5b8263f4dcc51bec
movabs rax, 0xa47d9c0b233ae413
xor rcx, rax
mov rax, r8
add rax, rcx
mov qword [rsp + 0x50], rax
mov rcx, rax
xor rcx, 0xffffffffffffffff
mov rdx, rax
xor rdx, 0xffffffffffffffff
and rcx, rdx
mov rdx, r8
or rdx, rdx
xor rdx, 0xffffffffffffffff
xor rcx, 0xffffffffffffffff
movabs r9, 0x8752e7f9e1df5d9e
movabs r10, 0x78ad18061e20a261
xor r9, r10
xor rdx, r9
and rcx, rdx
mov rdx, rax
or rdx, r8
xor rdx, 0xffffffffffffffff
or rcx, rdx
xor rcx, 0xffffffffffffffff
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x14002f995
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
add rcx, 8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
jmp 0x14002f99f
call fcn.1400091c0
jmp 0x14002fb96
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov eax, dword [0x1401f2a08]
sub eax, dword [0x1401f2a0c]
mov ecx, 0x69818507
xor edx, edx
div ecx
mov ecx, 0x60f2aa3c
xor edx, edx
div ecx
or eax, 0xb2155e19
cmp eax, 0x85eac40d
jb 0x14002fb9b
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov eax, dword [0x1401f2a10]
or eax, dword [0x1401f2a14]
imul eax, eax, 0xda6f9238
mov r8d, 0x64e2e173
xor r8d, 0xd7b468c6
and eax, r8d
xor eax, 0x3f506862
cmp rcx, rdx
setl cl
mov byte [rsp + 0x27], cl
cmp eax, 0x3d7b6f1d
jb 0x14002f9d7
mov al, byte [rsp + 0x27]
test al, 1
jne 0x14002fab6
jmp 0x14002fa2e
mov rax, qword [rsp + 0x28]
cmp rax, 0
jl 0x14002fa50
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
cmp rax, qword [rcx]
jl 0x14002fa5d
mov rcx, rdx
call fcn.140016582
jmp 0x14002fb96
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
lea rcx, [rax + rcx*8 + 8]
call fcn.14002f7c0
mov rcx, qword [rsp + 0x28]
mov rax, rcx
dec rax
mov rdx, rax
xor rdx, rcx
sets r8b
test rcx, rcx
setne cl
sete dl
or dl, r8b
add cl, dl
inc cl
test cl, 1
mov qword [rsp + 0x38], rax
jne 0x14002faac
jmp 0x14002f99f
call fcn.1400091c0
jmp 0x14002fb96
mov ecx, dword [0x1401f2a18]
mov edx, dword [0x1401f2a1c]
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, 0xe6e4d4da
xor eax, 0x45b5088d
imul ecx, eax
mov edx, 0x4d33865c
xor edx, 0xb2cc79a3
mov eax, ecx
xor eax, edx
mov edx, 0x2b21145e
xor edx, 0xd4deeba1
xor ecx, edx
or eax, ecx
mov ecx, 0x460170ac
and ecx, 0x460170ac
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0x4b60c50e
xor edx, edx
div ecx
cmp eax, 0xfe69232
jae 0x14002fba4
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov eax, dword [0x1401f2a20]
mov r8d, dword [0x1401f2a24]
xor r8d, 0x5a4127e9
sub eax, r8d
add eax, 0xb2762dec
mov r8d, 0x5c215ee
xor r8d, 0x67ee1042
add eax, r8d
mov r9d, 0x48a350ad
xor r9d, 0x8865b293
mov r8d, 0xd74194f7
xor r8d, 0x28be6b08
xor r9d, r8d
mov r8d, eax
and r8d, r9d
mov r9d, eax
xor r9d, 0xc0c6e23e
add eax, r9d
sub eax, r8d
mov qword [rcx], rdx
cmp eax, 0xcfa56ac2
je 0x14002fba4
jmp 0x14002fb96
add rsp, 0x58
ret
lodsb al, byte [rsi]
ret 0x3f8c
pop r8
ret