joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401e0da0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x57], al
je 0x1401e0f6f
mov eax, dword [0x14024e288]
mov ecx, dword [0x14024e28c]
xor ecx, 0x1947fed1
sub eax, ecx
mov edx, 0xffffffff
xor edx, 0xf2cdedf5
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0xf2cdedf5
add eax, edx
sub eax, ecx
mov ecx, 0x4a940305
xor ecx, 0x8b4218e8
xor eax, ecx
mov r8d, 0xffffffff
xor r8d, 0xa033a7da
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xa033a7da
or eax, 0xa033a7da
imul eax, edx
add eax, ecx
mov ecx, 0xb39a4b05
xor ecx, 0xaf033229
cmp eax, ecx
jae 0x1401e103a
mov rcx, qword [rsp + 0x48]
mov edx, dword [0x14024e290]
xor edx, 0x2ff819f5
mov eax, dword [0x14024e294]
mov r8d, 0x230c3911
xor r8d, 0xc6700610
xor eax, r8d
or edx, eax
add edx, 0xbb0dc263
mov eax, edx
and eax, 0x5f294758
mov r8d, 0xbdf768ae
xor r8d, 0xe2de2ff6
or edx, r8d
add eax, edx
imul eax, eax, 0xeada64d5
movabs rdx, 0x2c4f2bcb007b920d
movabs r8, 0xd3b0d434ff846dfd
xor rdx, r8
movabs r8, 0x78ec5d262525d1a
movabs r9, 0xf8713a2d9dada2e5
xor r8, r9
xor rdx, r8
xor r8d, r8d
sub r8, 1
sub rdx, r8
sub rcx, rdx
mov qword [rsp + 0x30], rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x38], rcx
cmp rcx, 0x10
setb cl
mov byte [rsp + 0x47], cl
cmp eax, 0x2df281f3
jae 0x1401e0e37
mov cl, byte [rsp + 0x47]
mov al, 1
test cl, 1
mov byte [rsp + 0x57], al
jne 0x1401e0f6f
jmp 0x1401e0efe
mov rdx, qword [rsp + 0x38]
movabs rcx, 0x447e8dd782b1e6ab
mov rax, rdx
sub rax, rcx
add rax, 0xfffffffffffffff0
movabs rcx, 0x447e8dd782b1e6ab
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x1401e0f4c
jmp 0x1401e0f5c
call fcn.140008d37
xor eax, eax
mov byte [rsp + 0x57], al
jmp 0x1401e0f6f
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x57], al
mov al, byte [rsp + 0x57]
mov byte [rsp + 0x27], al
mov ecx, dword [0x14024e298]
mov edx, dword [0x14024e29c]
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
xor eax, 0x799f2cd1
mov ecx, 0x15b88c23
xor ecx, 0x38fc2d19
or eax, ecx
mov ecx, 0x7d6a554
xor ecx, 0x52d84d45
add eax, ecx
mov ecx, 0xdc4d451b
xor ecx, 0x6a6383b6
cmp eax, ecx
je 0x1401e1043
mov eax, dword [0x14024e2a0]
xor edx, edx
div dword [0x14024e2a4]
sub eax, 0x2aa10578
sub eax, 0xa558a48d
mov ecx, 0x172b01d9
xor ecx, 0x3d8a04a1
add eax, ecx
mov ecx, 0xc617324c
xor ecx, 0xc617324c
sub ecx, eax
mov eax, 0x920e39ee
xor eax, 0x920e39ee
mov edx, 0x42ed5203
xor edx, 0xc7cc9234
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, 0x73ea2b2b
xor ecx, 0xe35a19f
and eax, ecx
mov ecx, 0x92f2ed29
xor ecx, 0xf69ebcff
cmp eax, ecx
ja 0x1401e1043
mov al, byte [rsp + 0x27]
and al, 1
movzx eax, al
add rsp, 0x58
ret
invalid
invalid
Function at 0x1401f0fc0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
call fcn.1401f11a0
mov rcx, qword [rsp + 0x40]
cmp rcx, 0
je 0x1401f1189
mov rax, qword [rsp + 0x40]
movabs rcx, 0xb33e93e91aafe376
sub rax, rcx
add rax, 0xfffffffffffffff0
movabs rcx, 0xb33e93e91aafe376
add rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp rax, 0x10
jb 0x1401f109e
mov rdx, qword [rsp + 0x38]
mov rax, rdx
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl dl
movabs rcx, 0x854e0efd60f05eaa
movabs r8, 0x7ab1f1029f0fa155
xor rcx, r8
cmp rax, rcx
setg cl
mov al, cl
and al, dl
xor al, 0xff
and cl, dl
xor cl, 0xff
and al, cl
mov cl, 1
xor cl, 0
xor al, cl
test al, 1
jne 0x1401f1073
jmp 0x1401f107d
call fcn.140008d37
jmp 0x1401f1189
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov r8, qword [rax]
xor ecx, ecx
call fcn.1400107e0
jmp 0x1401f1189
mov eax, dword [0x14024e880]
or eax, dword [0x14024e884]
mov ecx, 0xffffffff
xor ecx, 0x23298b8d
mov r8d, eax
xor r8d, ecx
and r8d, eax
mov ecx, r8d
xor ecx, 0xffffffff
mov eax, 0x2339a3de
xor eax, 0x21410fcd
and eax, ecx
mov edx, 0xffffffff
xor edx, 0x278ac13
and r8d, edx
mov ecx, 0xffffffff
xor ecx, 0x3df23ea9
and ecx, 0x278ac13
and edx, 0x3df23ea9
or eax, r8d
or ecx, edx
xor eax, ecx
or eax, eax
xor eax, 0xffffffff
mov ecx, 0x3cfa5e17
or ecx, 0x3cfa5e17
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
cmp eax, 0xf46038d0
jae 0x1401f118e
mov ecx, dword [0x14024e888]
mov edx, dword [0x14024e88c]
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
mov ecx, 0xea41233f
xor ecx, 0x5b23899e
sub eax, ecx
or eax, 0xfa8f71e7
mov ecx, 0x44a4281a
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x30]
mov ecx, eax
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x24], ecx
mov r8, qword [rax]
mov ecx, 1
call fcn.1400107e0
mov rcx, qword [rsp + 0x40]
call fcn.1400108dc
mov eax, dword [rsp + 0x24]
cmp eax, 0xadf40d1a
je 0x1401f111f
jmp 0x1401f1189
add rsp, 0x48
ret
push rdi
pop rbx
invalid
Function at 0x1401ff750
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x14024ee70]
xor edx, edx
div dword [0x14024ee74]
xor eax, 0x92446f0d
mov ecx, 0xdf6169a3
xor ecx, 0x580463ec
imul eax, ecx
or eax, 0xee275bc4
cmp eax, 0xce1b1612
jbe 0x1401ff82d
mov rax, qword [rsp + 0x40]
mov ecx, dword [0x14024ee78]
mov r8d, dword [0x14024ee7c]
xor r8d, 0xc3a589f9
mov edx, ecx
and edx, r8d
shl edx, 1
add ecx, r8d
sub ecx, edx
xor ecx, 0x8b577daa
sub ecx, 0xe38f4a86
imul ecx, ecx, 0xa3b1864
mov dword [rsp + 0x30], ecx
mov ecx, 0x8eb3c0fc
xor ecx, 0xa03dfebd
mov dword [rsp + 0x2c], ecx
mov rcx, qword [rax]
call fcn.1401fed70
mov ecx, dword [rsp + 0x2c]
mov dl, al
mov eax, dword [rsp + 0x30]
mov byte [rsp + 0x37], dl
cmp eax, ecx
je 0x1401ff78f
mov al, byte [rsp + 0x37]
test al, 1
jne 0x1401ff809
jmp 0x1401ff81b
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
mov edx, 4
call fcn.14000f52f
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov qword [rax], rcx
add rsp, 0x48
ret
or dword [rdx + 0x59e9980b], ebx
invalid

Function at 0x1401ff960
Capabilities:
Encode data using xor

Disassembly:
push rax
mov qword [rsp], rcx
mov eax, dword [0x14024ee80]
mov ecx, dword [0x14024ee84]
xor ecx, 0xad3998e5
add eax, ecx
mov ecx, 0x6c4f8c33
xor edx, edx
div ecx
mov r11d, eax
sub r11d, 0x106afd4b
mov eax, 0x6f69e234
xor eax, 0x90961dcb
mov ecx, r11d
xor ecx, eax
mov r8d, 0xffffffff
xor r8d, 0x3bb5c88f
mov edx, 0xffffffff
xor edx, 0x13c0843e
mov eax, ecx
and eax, 0x13c0843e
and r11d, edx
mov r9d, r8d
and r9d, 0x13c0843e
mov r10d, edx
and r10d, 0x3bb5c88f
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
xor ecx, 0xffffffff
or edx, 0x13c0843e
and ecx, edx
or eax, ecx
mov ecx, 0x843941b3
xor ecx, 0x261c38e1
cmp eax, ecx
jb 0x1401ffa69
mov rcx, qword [rsp]
mov eax, dword [0x14024ee88]
mov r8d, dword [0x14024ee8c]
xor r8d, 0x170aae5
xor edx, edx
div r8d
mov r8d, 0x9b3418c
xor r8d, 0x359ed4d4
mov edx, eax
xor edx, r8d
mov r8d, 0x72d06360
xor r8d, 0x8d2f9c9f
xor edx, r8d
or eax, 0x3c2d9558
and eax, edx
add eax, 0x366874b4
and eax, 0x307d0ddf
mov qword [rcx], 0
mov qword [rcx + 8], 0
cmp eax, 0xb87aaaea
ja 0x1401ff9fd
pop rax
ret
invalid
Function at 0x1401fffc0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.1401fed4b
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
call fcn.1401fed70
test al, 1
jne 0x1401fffea
jmp 0x140200117
mov rcx, qword [rsp + 0x28]
call fcn.1401fff6f
mov rax, qword [rsp + 0x30]
mov al, byte [rax]
mov cl, 0x2a
xor cl, 0x2a
cmp al, cl
jne 0x140200117
mov r11d, dword [0x14024eec0]
mov r10d, dword [0x14024eec4]
mov ecx, r11d
xor ecx, 0xffffffff
mov edx, r10d
xor edx, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0x3ed20da7
mov eax, ecx
and eax, 0x3ed20da7
and r11d, r8d
mov r9d, edx
and r9d, 0x3ed20da7
and r10d, r8d
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, edx
xor ecx, 0xffffffff
mov edx, 0xd94c45ee
xor edx, 0xe79e4849
or edx, r8d
and ecx, edx
or eax, ecx
sub eax, 0xf7ff8b28
mov ecx, 0x520563a
xor edx, edx
div ecx
xor eax, 0xa0d8a527
cmp eax, 0x3908ba40
je 0x1402001fc
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x14024eec8]
mov edx, dword [0x14024eecc]
xor edx, 0x66d7b686
or eax, eax
xor eax, 0xffffffff
or edx, edx
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
add eax, 0xa8f3fd4d
imul eax, eax, 0xe21b45db
mov edx, eax
xor edx, 0xffffffff
mov r8d, 0x4dc31607
xor r8d, 0xe429086b
and r8d, edx
mov r9d, 0xffffffff
xor r9d, 0xa9ea1e6c
mov edx, eax
and edx, r9d
imul edx, r8d
mov r8d, eax
and r8d, 0xa9ea1e6c
or eax, 0xa9ea1e6c
imul eax, r8d
add eax, edx
mov dword [rsp + 0x24], eax
mov edx, 8
call fcn.14000f52f
mov eax, dword [rsp + 0x24]
cmp eax, 0xec7e3727
jae 0x1402001fc
jmp 0x140200117
mov r11d, dword [0x14024eed0]
add r11d, dword [0x14024eed4]
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0xc19a7720
mov edx, 0x44415bd6
xor edx, 0xeb621760
mov eax, 0x3c63d452
xor eax, 0xc39c2bad
xor edx, eax
mov eax, ecx
and eax, 0xaf234cb6
and r11d, edx
mov r9d, r8d
and r9d, 0xaf234cb6
mov r10d, edx
and r10d, 0xc19a7720
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
xor ecx, 0xffffffff
or edx, 0xaf234cb6
and ecx, edx
or eax, ecx
xor ecx, ecx
sub ecx, 0x9dbd9e36
sub eax, ecx
mov ecx, 0x209432c2
xor ecx, 0x426ccbd6
sub eax, ecx
cmp eax, 0xc631b4f9
jae 0x140200205
mov eax, dword [0x14024eed8]
mov ecx, dword [0x14024eedc]
mov edx, 0xf8746d77
xor edx, 0x845a8c1f
xor ecx, edx
xor eax, ecx
add eax, 0xae50a94d
mov ecx, 0xe428c3ec
xor ecx, 0x10d140b9
sub eax, ecx
sub eax, 0xae50a94d
or eax, 0xccc03a36
and eax, 0x4f8c7ab8
mov ecx, 0xb18843f9
xor ecx, 0x79cf441b
cmp eax, ecx
ja 0x1402001a8
add rsp, 0x38
ret
sub eax, dword [rcx + 0x3c]
jmp 0x140200084
mov ebx, 0xe9c50f1b
invalid
Function at 0x140215870
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
call fcn.1402151a9
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx]
call fcn.1402151d0
test al, 1
jne 0x14021589d
jmp 0x140215983
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14008c4e0
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x1402159d4
mov eax, dword [0x14024f7c8]
mov r8d, dword [0x14024f7cc]
mov ecx, 0xa10de41b
xor ecx, 0x5ef21be4
mov r9d, r8d
xor r9d, ecx
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
and eax, 0x56747a71
mov ecx, 0x4ef74202
xor edx, edx
div ecx
add eax, 0xbe0218ff
mov ecx, 0xedb99fef
xor ecx, 0x92011909
add eax, ecx
sub eax, 0xbe0218ff
cmp eax, 0x17222a3
je 0x1402159da
mov rax, qword [rsp + 0x38]
mov ecx, dword [0x14024f7d0]
xor ecx, 0xa112a7e6
add ecx, dword [0x14024f7d4]
xor ecx, 0x6755c060
or ecx, 0x26616c76
xor ecx, 0xfc695ed6
mov dword [rsp + 0x34], ecx
mov rcx, qword [rax]
movabs rdx, 0x41871999437a8d77
movabs rax, 0x41871999437a8d7f
xor rdx, rax
call fcn.14000f52f
mov eax, dword [rsp + 0x34]
cmp eax, 0xead943fc
ja 0x140215923
jmp 0x140215983
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
cmp rax, 0
je 0x1402159d4
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov rdx, 0xffffffffffffffff
movabs rax, 0x4000000000000000
xor rdx, rax
mov rax, rcx
xor rax, rdx
and rax, rcx
cmp rax, 0
jne 0x1402159d4
mov rcx, qword [rsp + 0x28]
call fcn.14000f4df
nop
add rsp, 0x48
ret
sbb al, bh
imul ecx
invalid

Function at 0x140219d30
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov eax, dword [0x14024f9a0]
mov r8d, dword [0x14024f9a4]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xc47b54e
xor edx, edx
div ecx
imul eax, eax, 0x51dd4316
xor eax, 0x1044bd22
cmp eax, 0x17665fdb
jb 0x140219e3f
mov ecx, dword [0x14024f9a8]
xor ecx, 0x6734b339
mov eax, dword [0x14024f9ac]
sub ecx, eax
mov edx, ecx
not edx
mov eax, ecx
and eax, 0x50afaffe
and edx, 0xaf505001
imul edx, eax
mov eax, ecx
and eax, 0xaf505001
or ecx, 0xaf505001
imul ecx, eax
mov eax, ecx
mov ecx, edx
lea eax, [rax + rcx - 0x41b1d9bf]
and eax, 0x87e26904
mov dword [rbp - 0xc], eax
mov eax, 0x10
call fcn.14023fff0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
sub rsp, 0x20
call fcn.14021db64
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov qword [rcx], 0
mov rdx, qword [rax + 0x10]
mov r8b, 1
xor r8b, 1
and r8b, 1
sub rsp, 0x20
call fcn.1400120e0
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbp - 0xc]
add rsp, 0x20
mov rcx, qword [rcx]
mov qword [rbp - 8], rcx
cmp eax, 0xf822bf91
ja 0x140219d8a
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
xchg rsi, rax
invalid
Function at 0x14021e650
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
mov eax, dword [0x14024fb18]
xor eax, dword [0x14024fb1c]
or eax, 0x280757c9
or eax, 0x2f76053
or eax, 0x6b787f84
cmp eax, 0xb077c40f
ja 0x14021e8bf
mov rcx, qword [rsp + 0x50]
mov edx, dword [0x14024fb20]
mov r8d, dword [0x14024fb24]
mov r9d, 0xe06df1cb
xor r9d, 0x1f920e34
mov eax, edx
xor eax, r9d
mov r10d, 0x355b3e01
xor r10d, 0xcaa4c1fe
mov r9d, r8d
xor r9d, r10d
or eax, r9d
mov r9d, 0xb2997246
xor r9d, 0x4d668db9
xor edx, r9d
mov r9d, 0xe60becb2
xor r9d, 0x19f4134d
xor r8d, r9d
or edx, r8d
and eax, edx
xor eax, 0xffffffff
mov r9d, 0x4402d728
xor r9d, 0xc83e2b71
mov edx, 0x8ea52fc3
xor edx, 0x715ad03c
xor r9d, edx
mov r8d, eax
and r8d, r9d
mov edx, eax
or edx, r9d
mov r9d, 0x98ae1cc9
xor r9d, 0x6751e336
xor edx, r9d
imul edx, r8d
mov r8d, eax
and r8d, 0x8c3cfc59
mov r9d, 0x658d9724
xor r9d, 0xe9b16b7d
or eax, r9d
imul eax, r8d
add eax, edx
and eax, 0xd7fff2d7
xor eax, 0xc1d6a8d8
cmp rcx, 0
sete cl
mov byte [rsp + 0x4f], cl
cmp eax, 0x44076a1b
jb 0x14021e67f
mov cl, byte [rsp + 0x4f]
xor eax, eax
test cl, 1
mov byte [rsp + 0x4e], al
jne 0x14021e8b1
jmp 0x14021e773
mov rax, qword [rsp + 0x50]
xor ecx, ecx
sub rcx, 0xfffffffffffffff0
sub rax, rcx
mov qword [rsp + 0x38], rax
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
mov al, 1
cmp rcx, 0x10
mov byte [rsp + 0x4e], al
jb 0x14021e8b1
mov r8, qword [rsp + 0x40]
movabs rcx, 0xa675c9b3684e90df
movabs rax, 0x598a364c97b16f2f
xor rcx, rax
mov rax, r8
add rax, rcx
mov qword [rsp + 0x30], rax
mov rdx, rax
xor rdx, 0xffffffffffffffff
mov rcx, r8
and rcx, rdx
xor r8, 0xffffffffffffffff
mov rdx, rax
and rdx, r8
or rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x14021e7fc
jmp 0x14021e89e
mov eax, dword [0x14024fb28]
mov ecx, dword [0x14024fb2c]
xor ecx, 0xcfccf1b0
xor ecx, 0xffffffff
add eax, ecx
add eax, 1
mov ecx, 0x1adaba9b
xor ecx, 0xc036ad7c
xor eax, ecx
add eax, 0x46918b44
or eax, 0xc294812f
cmp eax, 0xf91d6fb5
ja 0x14021e8c8
mov eax, dword [0x14024fb30]
xor eax, 0xd975e30e
mov edx, dword [0x14024fb34]
xor ecx, ecx
sub ecx, edx
add eax, ecx
sub eax, 0x8528b3ec
sub eax, 0x3e19a0ba
add eax, 0x8528b3ec
imul eax, eax, 0xfce8c4fe
mov ecx, 0x6d4564d
xor ecx, 0x94eaa1c2
sub eax, ecx
sub eax, 0x8fd8742f
add eax, 0x923ef78f
mov dword [rsp + 0x2c], eax
call fcn.140008d37
mov eax, dword [rsp + 0x2c]
cmp eax, 0xc066b46e
jbe 0x14021e838
xor eax, eax
mov byte [rsp + 0x4e], al
jmp 0x14021e8b1
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x4e], al
mov al, byte [rsp + 0x4e]
and al, 1
movzx eax, al
add rsp, 0x58
ret
xor dword fs:[rdi + rdx*8], edx
jmp 0x14021e67f
xchg ebp, eax
insd dword [rdi], dx
mov edi, 0xffff67e9
jmp qword [rsi + 0x66]
Function at 0x140231520
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
call fcn.140231723
mov rcx, qword [rsp + 0x40]
cmp rcx, 0
je 0x140231715
mov rcx, qword [rsp + 0x40]
mov rax, rcx
and rax, 0xfffffffffffffff0
or rcx, 0xfffffffffffffff0
add rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
movabs rcx, 0xb2287eaf951ab59c
movabs rdx, 0xb2287eaf951ab58c
xor rcx, rdx
cmp rax, rcx
jb 0x1402315f0
mov rdx, qword [rsp + 0x38]
mov rcx, rdx
and rcx, 0xfffffffffffffff0
shl rcx, 1
mov rax, rdx
xor rax, 0xfffffffffffffff0
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x1402315bf
jmp 0x1402315c9
call fcn.140008d37
jmp 0x140231715
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov r8, qword [rax]
mov cl, 1
xor cl, 1
and cl, 1
call fcn.1400107e0
jmp 0x140231715
mov eax, dword [0x140250168]
mov edx, dword [0x14025016c]
mov ecx, eax
xor ecx, edx
mov r8d, 0xc3167494
xor r8d, 0x3ce98b6b
xor ecx, r8d
or eax, edx
and eax, ecx
sub eax, 0x4b1eca2c
and eax, 0xe127ff8e
or eax, 0xfa4336ef
cmp eax, 0x78867839
je 0x14023171a
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov ecx, dword [0x140250170]
mov r8d, 0x7330aa3d
xor r8d, 0x36dd6bd7
xor ecx, r8d
and ecx, dword [0x140250174]
mov r10d, 0xffffffff
xor r10d, 0xbf4ce1c3
mov r9d, ecx
and r9d, r10d
mov r8d, ecx
or r8d, r10d
mov r10d, 0xc43b23ce
xor r10d, 0x3bc4dc31
xor r8d, r10d
imul r8d, r9d
mov r9d, ecx
and r9d, 0xbf4ce1c3
or ecx, 0xbf4ce1c3
imul ecx, r9d
add ecx, r8d
sub ecx, 0xd9d70d67
mov r10d, 0xffffffff
xor r10d, 0x68ca913e
mov r9d, ecx
and r9d, r10d
mov r8d, ecx
or r8d, r10d
xor r8d, 0xffffffff
imul r8d, r9d
mov r9d, ecx
and r9d, 0x68ca913e
or ecx, 0x68ca913e
imul ecx, r9d
add ecx, r8d
mov dword [rsp + 0x24], ecx
mov ecx, 0x9d4a1e0f
xor ecx, 0xce512acc
mov dword [rsp + 0x20], ecx
mov r8, qword [rax]
mov ecx, 1
call fcn.1400107e0
mov rcx, qword [rsp + 0x40]
call fcn.1400108dc
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
je 0x14023171a
jmp 0x140231715
add rsp, 0x48
ret
lodsd eax, dword [rsi]
xchg byte [rax + rax*8 - 0xf417], dl
dec dword [rax - 0x75]
mov rax, qword [0x14025a9f0]
mov ecx, dword [rax]
jmp fcn.140008963
Function at 0x140234940
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, qword gs:[0x60]
movzx rax, byte [rax + 2]
ret

Function at 0x140234a90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov eax, dword [0x140250308]
mov ecx, dword [0x14025030c]
xor ecx, 0xffffffff
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
add eax, 0x2f905d74
xor eax, 0xa3e75b44
mov ecx, 0xdc3efc50
xor ecx, 0x84256174
imul eax, ecx
mov ecx, 0x9016b836
xor ecx, 0x8b151d8d
cmp eax, ecx
jb 0x140234bc8
xor eax, eax
mov dword [rsp + 0x40], eax
mov eax, 0x3eec10ad
mov dword [rsp + 0x3c], eax
call fcn.140234be0
mov qword [rsp + 0x30], rax
call fcn.140234940
mov r8, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x3c]
mov dl, al
mov eax, dword [rsp + 0x40]
mov r8b, byte [r8]
test r8b, r8b
setne r8b
or r8b, dl
mov byte [rsp + 0x46], r8b
mov byte [rsp + 0x47], dl
cmp eax, ecx
je 0x140234bc8
mov al, byte [rsp + 0x47]
mov cl, byte [rsp + 0x46]
test cl, 1
mov byte [rsp + 0x2f], al
jne 0x140234b45
jmp 0x140234b3c
call fcn.14023494f
mov byte [rsp + 0x2f], al
mov al, byte [rsp + 0x2f]
mov byte [rsp + 0x2e], al
mov ecx, dword [0x140250318]
or ecx, dword [0x14025031c]
mov eax, ecx
and eax, 0xbc689284
or ecx, 0xbc689284
add eax, ecx
mov ecx, 0x92cc365c
xor edx, edx
div ecx
mov ecx, 0x3d901fbc
xor edx, edx
div ecx
cmp eax, 0x5c19511c
ja 0x140234bd1
mov eax, dword [0x140250320]
xor eax, 0x4c819452
xor edx, edx
div dword [0x140250324]
sub eax, 0x6b4154ce
sub eax, 0xd297f742
add eax, 0xeb594508
mov ecx, 0x17222a3
xor ecx, 0x9c2e3856
cmp eax, ecx
jbe 0x140234b85
mov al, byte [rsp + 0x2e]
and al, 1
movzx eax, al
add rsp, 0x48
ret
xchg ebx, eax
sub byte [rdi - 0xf917], bl
call rbx
invalid
rol dword [rdx + 0x27], cl
mov esp, 0xffffabe9
jmp qword [rsi + 0xf]
Function at 0x140234be0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov r11d, dword [0x140250328]
mov r10d, dword [0x14025032c]
mov eax, 0x8e0b6e28
xor eax, 0x71f491d7
mov ecx, r11d
xor ecx, eax
mov r8d, r10d
xor r8d, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x61d02356
mov eax, ecx
and eax, 0x61d02356
and r11d, edx
mov r9d, r8d
and r9d, 0x61d02356
and r10d, edx
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
xor ecx, 0xffffffff
or edx, 0x61d02356
and ecx, edx
or eax, ecx
add eax, 0x550ee811
mov edx, 0xbe0218ff
xor edx, 0x8f8698f3
mov ecx, eax
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0x3184800c
and eax, edx
shl eax, 1
sub eax, ecx
imul eax, eax, 0x19e09969
mov ecx, 0x773eb78f
xor ecx, 0xffcface8
cmp eax, ecx
ja 0x140234d17
mov eax, dword [0x140250330]
mov ecx, dword [0x140250334]
mov edx, 0xef999d6
xor edx, 0xd66721cd
xor ecx, edx
mov edx, 0x782bada6
xor edx, 0x87d45259
xor ecx, edx
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
mov ecx, eax
add ecx, 1
mov edx, 0xa962b850
xor edx, 0x569d47af
xor eax, edx
mov edx, 0xf42f95d7
xor edx, 0x89f01f63
or eax, edx
add eax, ecx
mov ecx, 0x71582aea
xor edx, edx
div ecx
sub eax, 0x706cc824
mov dword [rsp + 0x2c], eax
mov rax, qword [0x14025a9f0]
mov ecx, dword [rax]
call fcn.140008963
mov rcx, rax
mov eax, dword [rsp + 0x2c]
add rcx, 0x50
mov qword [rsp + 0x30], rcx
cmp eax, 0xb365acec
jae 0x140234c82
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
xor dword fs:[rdi + rdx*8], edx
jmp 0x140234c82
Function at 0x140234f00
Capabilities:
Get thread local storage value

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x28], rcx
mov eax, 0x10
call fcn.14023fff0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
sub rsp, 0x20
call fcn.140235117
call fcn.140235117
add rsp, 0x20
xor eax, eax
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x30], rax
movabs rcx, 0x7ddf8ab496454459
movabs rdx, 0x7ddf8ab496454451
xor rcx, rdx
cmp rax, rcx
je 0x140234f7b
mov rax, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x20]
mov byte [rcx + rax], 0
add rax, 1
mov qword [rbp - 0x18], rax
jmp 0x140234f3a
mov rcx, qword [rbp - 0x28]
movabs rdx, 0xa91f3c7ee13150e5
movabs rax, 0xa91f3c7ee13177f5
xor rdx, rax
lea r8, [rbp - 8]
sub rsp, 0x20
call fcn.140235130
add rsp, 0x20
test al, 1
jne 0x140234fb4
jmp 0x140234fc6
sub rsp, 0x20
call fcn.140008d37
add rsp, 0x20
jmp 0x140235109
mov rcx, qword [rbp - 8]
mov rdx, 0xffffffffffffffff
lea r8, [rbp - 0x10]
sub rsp, 0x20
call fcn.140235130
add rsp, 0x20
test al, 1
jne 0x140234fef
jmp 0x140235001
sub rsp, 0x20
call fcn.140008d37
add rsp, 0x20
jmp 0x140235109
mov eax, dword [0x140250348]
and eax, dword [0x14025034c]
mov ecx, 0x5894f30e
xor ecx, 0x5cedc014
xor edx, edx
div ecx
xor ecx, ecx
sub ecx, eax
mov eax, 0x52d435c7
xor eax, 0x52d435c7
mov edx, 0x2304280
xor edx, 0x223a7f8e
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, 0x989cad38
xor ecx, 0x989cad38
mov edx, 0x2aa10578
xor edx, 0x531580c
sub ecx, edx
sub eax, ecx
cmp eax, 0xfc585150
jae 0x14023510e
mov r8d, dword [0x140250350]
xor r8d, 0x40c5eef9
xor r8d, dword [0x140250354]
xor r8d, 0x6a7dc9f7
mov eax, r8d
xor eax, 0xffffffff
and eax, 0x478ba6a6
mov edx, 0xffffffff
xor edx, 0x478ba6a6
and r8d, edx
mov ecx, 0xffffffff
xor ecx, 0xbebef223
mov r9d, 0x2710a6fd
xor r9d, 0x609b005b
and ecx, r9d
and edx, 0xbebef223
or eax, r8d
or ecx, edx
xor eax, ecx
mov ecx, 0xab6896e4
xor edx, edx
div ecx
mov rdx, qword [rbp - 0x20]
mov dword [rbp - 0x34], eax
mov eax, 0xdb4b1d4f
xor eax, 0xd6e507b6
mov dword [rbp - 0x38], eax
mov rax, qword [rbp - 0x10]
mov qword [rdx], rax
xor ecx, ecx
mov rax, qword [0x14025a7d0]
sub rsp, 0x20
call qword [rax]
mov ecx, dword [rbp - 0x38]
add rsp, 0x20
mov eax, dword [rbp - 0x34]
cmp eax, ecx
ja 0x14023510e
jmp 0x140235109
mov rsp, rbp
pop rbp
ret
xchg ebx, eax
sub byte [rdi - 0xb417], bl
dec dword [rax - 0x75]
mov rax, qword [0x14025a9f0]