joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003f4d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x68], r8
mov byte [rsp + 0x77], dl
mov qword [rsp + 0x78], rcx
cmp r9, 0
mov qword [rsp + 0x80], r9
jge 0x14003f5db
mov eax, dword [0x140242d90]
sub eax, dword [0x140242d94]
sub eax, 0x14d2a10b
mov ecx, 0x5bd44e85
xor edx, edx
div ecx
mov ecx, eax
mov edx, 0x29d99def
xor edx, 0xd6266210
mov eax, ecx
xor eax, edx
mov edx, ecx
xor edx, 0xffffffff
and eax, edx
mov edx, 0xb6bd33de
or edx, 0xb6bd33de
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
or ecx, 0xb6bd33de
mov edx, 0x80a64957
xor edx, 0x7f59b6a8
xor ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
cmp eax, 0xaa17b8d6
jb 0x14003f6be
mov rcx, qword [rsp + 0x78]
mov eax, dword [0x140242d98]
and eax, dword [0x140242d9c]
and eax, 0x1af34377
mov r8d, 0xd412365d
xor r8d, 0x5e384ed0
xor edx, edx
div r8d
mov r8d, 0x100e5703
xor r8d, 0x1da40d0d
xor edx, edx
div r8d
mov rcx, qword [rcx]
movabs rdx, 0x83021876b77003e8
movabs r8, 0x7cfde789488ffc17
xor rdx, r8
add rcx, rdx
mov qword [rsp + 0x60], rcx
cmp eax, 0x43485641
jae 0x14003f562
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x80], rax
jmp 0x14003f5db
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x40], rdx
add rcx, 8
mov qword [rsp + 0x48], rcx
cmp rax, 0xffffffffffffffff
setg cl
mov byte [rsp + 0x57], cl
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x30], rcx
mov rax, 0xffffffffffffffff
cmp rcx, rdx
mov qword [rsp + 0x38], rax
jg 0x14003f6b1
mov al, byte [rsp + 0x57]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x78]
mov rdx, qword [rdx]
mov qword [rsp + 0x28], rdx
sub rcx, rdx
setl cl
and al, cl
test al, 1
jne 0x14003f67e
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
xor eax, eax
sub rax, 0xffffffffffffffff
sub rdx, rax
call fcn.140012b72
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x38], rax
jmp 0x14003f6b1
mov rax, qword [rsp + 0x30]
mov dl, byte [rsp + 0x77]
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
cmp byte [rcx + rax + 8], dl
mov qword [rsp + 0x38], rax
je 0x14003f6b1
mov rax, qword [rsp + 0x30]
add rax, 1
mov qword [rsp + 0x58], rax
jmp 0x14003f60b
mov rax, qword [rsp + 0x38]
add rsp, 0x88
ret
add cl, r15b
invalid
Function at 0x14004a3a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 8], rcx
mov ecx, dword [0x140243200]
xor ecx, 0xb0361c1d
mov edx, dword [0x140243204]
mov eax, ecx
and eax, eax
mov r8d, 0x563ed2a2
xor r8d, 0xa9c12d5d
xor eax, r8d
xor eax, 0xffffffff
mov r8d, edx
xor r8d, 0xffffffff
or eax, r8d
and edx, edx
xor edx, 0xffffffff
xor ecx, 0xffffffff
mov r8d, 0x4dc4ff24
xor r8d, 0xb23b00db
xor edx, r8d
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
imul eax, eax, 0x6a41077e
mov ecx, 0xd63dce0c
xor ecx, 0xecd00b2d
or eax, ecx
mov ecx, 0xdf1e92fa
xor edx, edx
div ecx
cmp eax, 0x87587410
je 0x14004a4c2
mov eax, dword [0x140243208]
mov ecx, dword [0x14024320c]
xor edx, edx
div ecx
mov edx, eax
not edx
and edx, 0x23a6d07f
mov ecx, eax
and ecx, 0xdc592f80
imul ecx, edx
mov edx, eax
and edx, 0x23a6d07f
or eax, 0x23a6d07f
imul eax, edx
add eax, ecx
and eax, 0x9712301b
xor eax, 0x8300100a
mov dword [rbp - 0xc], eax
mov eax, 0x10
call fcn.14023fff0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
sub rsp, 0x20
call fcn.1400476af
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.14004a140
mov eax, dword [rbp - 0xc]
add rsp, 0x20
cmp eax, 0x752918ef
jae 0x14004a427
mov rsp, rbp
pop rbp
ret
ret
Function at 0x14004a710
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.1400476af
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, rcx
add rax, 8
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 8]
mov rcx, rdx
add rcx, 8
mov qword [rsp + 0x48], rcx
cmp rax, qword [rdx + 8]
mov qword [rsp + 0x50], rax
je 0x14004a798
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov qword [rsp + 0x58], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x58]
call fcn.14004a4cb
mov rax, qword [rsp + 0x38]
cmp byte [rax], 0
jne 0x14004a870
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov eax, dword [0x140243210]
mov ecx, dword [0x140243214]
mov edx, 0xe6ec7276
xor edx, 0x108ae30b
xor ecx, edx
add eax, ecx
mov ecx, 0x502ee281
xor ecx, 0xfdeabf4b
xor edx, edx
div ecx
mov edx, 0x2280978
xor edx, 0x2280979
mov ecx, eax
add ecx, edx
mov edx, 0x806a12af
xor edx, 0x7f95ed50
xor eax, edx
or eax, 0xe8463e7d
add eax, ecx
add eax, 0x8788c489
mov ecx, 0x82c9c0fa
xor ecx, 0xbef89ac1
cmp eax, ecx
jbe 0x14004a875
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x40]
mov r10, qword [rsp + 0x20]
mov eax, dword [0x140243218]
xor eax, 0xe771dd27
xor edx, edx
div dword [0x14024321c]
mov rdx, qword [rsp + 0x28]
sub eax, 0x664ce47e
and eax, 0xa4a40fd
sub eax, 0x5595100a
sub eax, 0x2d467e05
add eax, 0x5595100a
mov ecx, 0xa9d65505
xor ecx, 0x4e9e5bae
mov r11, qword [r8]
mov qword [rdx], r11
mov qword [r9], r10
mov r8, qword [r8 + 0x10]
mov qword [rdx + 0x10], r8
cmp eax, ecx
ja 0x14004a807
jmp 0x14004a870
add rsp, 0x68
ret
loope 0x14004a8bf
repne outsb dx, byte [rsi]
jmp 0x14004a807

Function at 0x14004b710
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 8], rcx
mov eax, dword [0x140243280]
xor eax, 0xe9d0cc36
mov ecx, dword [0x140243284]
xor ecx, 0xf967658c
add eax, ecx
sub eax, 0x6baf1c48
mov ecx, 0xa34ab223
xor edx, edx
div ecx
mov ecx, 0x982840e0
xor ecx, 0x1e6d9d15
add eax, ecx
cmp eax, 0x8111ada7
jb 0x14004b7fc
mov ecx, dword [0x140243288]
mov eax, dword [0x14024328c]
imul ecx, eax
mov eax, ecx
not eax
mov edx, ecx
and edx, 0x1ed47a8e
and eax, 0x612b8571
imul eax, edx
mov edx, ecx
and edx, 0x612b8571
or ecx, 0x612b8571
imul ecx, edx
add ecx, eax
or ecx, 0xa8c09c7e
mov eax, ecx
xor eax, 0x9684f52e
and eax, ecx
mov dword [rbp - 0xc], eax
mov eax, 0x10
call fcn.14023fff0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
sub rsp, 0x20
call fcn.1400476af
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.14004b537
mov eax, dword [rbp - 0xc]
add rsp, 0x20
cmp eax, 0x4aa8ea7d
jbe 0x14004b75d
mov rsp, rbp
pop rbp
ret
invalid
Function at 0x1400545b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x140243690]
mov ecx, dword [0x140243694]
mov edx, 0xce848f45
xor edx, 0x2f1db42e
xor ecx, edx
imul eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x3bfab039
mov ecx, 0xffffffff
xor ecx, 0xaa78c84b
or eax, edx
or ecx, 0xaa78c84b
xor eax, 0xffffffff
and eax, ecx
add eax, 0xf969ca7f
mov ecx, 0xe43ed5ae
xor ecx, 0x2b8c86d5
add eax, ecx
sub eax, 0xf969ca7f
mov edx, eax
xor edx, 0xffffffff
and edx, 0x49a8efe4
mov r8d, 0xffffffff
xor r8d, 0x49a8efe4
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x49a8efe4
or eax, 0x49a8efe4
imul eax, edx
add eax, ecx
mov ecx, 0xc60ddc2
xor ecx, 0xf1b662e2
cmp eax, ecx
ja 0x1400546fa
mov ecx, dword [0x140243698]
mov eax, dword [0x14024369c]
add ecx, eax
mov eax, ecx
xor eax, 0x2b6d43ad
xor ecx, 0x1492b442
or eax, 0x88c20c9
or ecx, 0xe0404934
and eax, ecx
not eax
and eax, 0xe8cc69fd
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.14023fff0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
sub rsp, 0x20
call fcn.1400476af
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x20]
add rsp, 0x20
mov rax, qword [rbp - 0x10]
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140054546
add rsp, 0x20
mov cl, al
mov eax, dword [rbp - 0x18]
mov byte [rbp - 0x11], cl
cmp eax, 0x2855f4c1
jbe 0x140054660
mov al, byte [rbp - 0x11]
and al, 1
movzx eax, al
mov rsp, rbp
pop rbp
ret
mov esi, 0xe9751d0d
pop rbp
invalid
Function at 0x1400592e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x14005942d
mov eax, dword [0x140243900]
xor eax, 0x6338b839
mov r8d, dword [0x140243904]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
sub eax, 0x354aab91
add eax, 0xa5872cf1
imul eax, eax, 0x2210f490
cmp eax, 0x843e58f7
jae 0x1400594e0
mov rdx, qword [rsp + 0x30]
mov ecx, dword [0x140243908]
xor ecx, 0x8e7f9c14
mov r8d, dword [0x14024390c]
mov eax, 0xb800d14
xor eax, 0xb800d14
sub eax, r8d
add ecx, eax
mov eax, ecx
and eax, eax
xor eax, 0xffffffff
and eax, 0xbf82ee89
mov r8d, 0x6b7d795d
xor r8d, 0x948286a2
xor eax, r8d
mov r8d, 0x72dc52fa
xor r8d, 0xcd5ebc73
mov r9d, 0x838aad92
xor r9d, 0x3c08431b
and r8d, r9d
xor r8d, 0xffffffff
xor ecx, 0xffffffff
xor r8d, 0xffffffff
or ecx, r8d
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0x5b8c9f87
xor ecx, 0x32f9ecb7
xor eax, ecx
xor eax, 0x68f8f7a5
mov ecx, 0x6e3452d6
xor ecx, 0xe33e96fe
mov rdx, qword [rdx]
movabs r9, 0x4000000000000000
mov r8, rdx
xor r8, r9
xor r8, 0xffffffffffffffff
movabs r9, 0x4000000000000000
or rdx, r9
and rdx, r8
cmp rdx, 0
sete dl
mov byte [rsp + 0x2f], dl
cmp eax, ecx
jbe 0x140059348
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x140059423
jmp 0x14005942d
mov rcx, qword [rsp + 0x30]
call fcn.14000f4df
mov eax, dword [0x140243910]
mov edx, dword [0x140243914]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, 0x72e16a29
xor eax, 0x72e16a29
sub eax, ecx
mov edx, 0x65ec62cf
xor edx, 0xf8f140e1
mov ecx, 0x166022a3
xor ecx, 0xe99fdd5c
xor edx, ecx
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0x9d1d222e
add eax, edx
sub eax, ecx
add eax, 0xb82b2c27
and eax, 0xa3571c17
cmp eax, 0xc2074575
je 0x1400594e9
and bl, byte cs:[0x169d59613]
enter 0x2705, 0x2c
sub edi, dword [rax + 0x571c1725]
movabs dword [0x5d840fc20745753d], eax
add byte [rax], al
add byte [rbx + 0x1ea48605], cl
add byte [0x103d41b64], dh
mov eax, dword [0x140243918]
xor eax, 0xc3ce86cd
sub eax, dword [0x14024391c]
mov ecx, 0x1fb7f1ec
xor ecx, 0x47f9262c
sub eax, ecx
sub eax, 0xa585aa1a
sub eax, 0x281f2141
mov ecx, 0x3a92265
xor ecx, 0xa62c887f
add eax, ecx
sub eax, 0x599f1e9f
sub eax, 0x295a354d
add eax, 0x599f1e9f
cmp eax, 0x4b8a21a9
ja 0x14005948c
add rsp, 0x38
ret
invalid
jbe 0x14005946e
invalid
Function at 0x140059700
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], rcx
mov eax, dword [0x140243930]
mov ecx, dword [0x140243934]
mov edx, 0xb24b1064
xor edx, 0x4130e61d
xor ecx, edx
sub eax, ecx
mov ecx, eax
and ecx, 0xefae9d9a
xor ecx, 0xffffffff
add eax, 0xefae9d9a
add eax, 1
add eax, ecx
add eax, 0x8b5923f9
mov ecx, 0xaaf60cc7
xor ecx, 0xe24e329a
xor edx, edx
div ecx
cmp eax, 0x6574529a
je 0x14005996f
mov eax, dword [0x140243938]
mov ecx, dword [0x14024393c]
xor edx, edx
div ecx
add eax, 0xc0903012
mov ecx, eax
not ecx
mov edx, eax
or edx, 0x3de5469a
mov r8d, edx
and r8d, 0xe095cbea
and ecx, 0x20a3005
imul ecx, r8d
and edx, 0x1f6a3415
or eax, 0x3fef769f
imul eax, edx
add eax, ecx
mov dword [rbp - 0x10], eax
mov eax, 0x1779a628
mov dword [rbp - 0x14], eax
mov eax, 0x20
mov qword [rbp - 0x38], rax
call fcn.14023fff0
sub rsp, rax
mov rax, qword [rbp - 0x38]
mov rcx, rsp
mov qword [rbp - 0x30], rcx
call fcn.14023fff0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.1400476af
add rsp, 0x20
mov qword [rbp - 0x20], rax
xor eax, eax
mov ecx, eax
sub rsp, 0x20
call fcn.140059060
mov rdx, qword [rbp - 0x20]
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x10]
add rsp, 0x20
mov dl, byte [rdx]
mov r8b, 0x48
xor r8b, 0x48
cmp dl, r8b
sete dl
mov byte [rbp - 9], dl
cmp eax, ecx
jbe 0x14005975d
mov cl, byte [rbp - 9]
xor eax, eax
test cl, 1
mov qword [rbp - 0x40], rax
jne 0x140059835
jmp 0x1400598b1
mov ecx, 0x18
mov edx, 8
sub rsp, 0x20
call fcn.1400129fd
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 8]
add rsp, 0x20
mov qword [rbp - 0x48], rax
sub rsp, 0x20
call fcn.140059500
mov rcx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x48]
add rsp, 0x20
cmp byte [rcx], 0
mov qword [rbp - 0x40], rax
jne 0x1400598b1
mov rcx, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x30]
mov r8, qword [rax]
mov qword [rdx], r8
mov r8, qword [rax + 8]
mov qword [rdx + 8], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 0x10], rax
sub rsp, 0x20
call fcn.140059180
mov rax, qword [rbp - 0x48]
add rsp, 0x20
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x50], rax
mov eax, dword [0x140243940]
xor eax, 0x89916ace
mov r8d, dword [0x140243944]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
mov r9d, 0x94179d70
xor r9d, 0x6be8628f
xor ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x48350777
xor edx, edx
div ecx
mov ecx, 0xab6addd6
xor ecx, 0xd8045969
xor edx, edx
div ecx
mov ecx, 0xf4cc24a1
xor edx, edx
div ecx
mov ecx, 0xfbbf99fe
xor ecx, 0x1c8a2bf3
cmp eax, ecx
jae 0x140059978
mov eax, dword [0x140243948]
mov ecx, dword [0x14024394c]
xor ecx, 0x2f7455d3
or eax, ecx
mov ecx, 0x1acc4d67
xor ecx, 0x3f6f44b8
and eax, ecx
add eax, 0xeb63886
sub eax, 0xf41b3c59
cmp eax, 0x51255639
je 0x140059978
mov rax, qword [rbp - 0x50]
mov rsp, rbp
pop rbp
ret
scasd eax, dword [rdi]
push rbp
invalid
fisttp word [rsi + rax*2]
cmc
jmp 0x140059930
Function at 0x140063770
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
call fcn.140064312
mov rcx, qword [rsp + 0x38]
add rax, 0x50
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx]
call fcn.140063a20
test al, 1
jne 0x1400637a1
jmp 0x1400637e0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140063770
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140063973
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
movabs rdx, 0xc060351e71811d6b
movabs rax, 0xc060351e71811d63
xor rdx, rax
call fcn.14000f52f
mov rax, qword [rsp + 0x38]
mov rcx, rax
add rcx, 8
mov qword [rsp + 0x30], rcx
mov rcx, qword [rax + 8]
call fcn.140063a20
test al, 1
jne 0x140063807
jmp 0x14006383a
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call fcn.140063770
mov rax, qword [rsp + 0x40]
mov al, byte [rax]
mov cl, 0x5d
xor cl, 0x5d
cmp al, cl
jne 0x140063973
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
mov edx, 8
call fcn.14000f52f
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x28], rax
cmp rax, 0
je 0x140063973
mov eax, dword [0x140243d88]
mov ecx, dword [0x140243d8c]
xor ecx, 0xffffffff
mov edx, 0xdb97fec6
xor edx, 0xdb97fec6
mov r8d, 0xaa17b8d6
xor r8d, 0xaa17b8d7
sub edx, r8d
sub ecx, edx
sub eax, ecx
mov ecx, 0xf52e80a8
xor ecx, 0xdabedddc
add eax, ecx
xor eax, 0xa3e75b44
imul eax, eax, 0x581b9d24
cmp eax, 0x1b03a5bb
jb 0x140063a0a
mov ecx, dword [0x140243d90]
mov r8d, dword [0x140243d94]
mov eax, ecx
xor eax, 0xffffffff
mov r9d, 0x9f87dd2f
xor r9d, 0x607822d0
mov edx, ecx
xor edx, r9d
or eax, edx
mov edx, 0x34634360
xor edx, 0xcb9cbc9f
xor eax, edx
mov edx, r8d
xor edx, 0xffffffff
or eax, edx
mov edx, r8d
xor edx, 0xffffffff
xor r8d, 0xffffffff
or edx, r8d
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0x85888d20
xor ecx, 0x2ee01bc4
xor edx, edx
div ecx
mov ecx, 0x5986c74b
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x28]
and eax, 0xb1c193cb
mov ecx, 0x4cd871ac
xor ecx, 0x72346101
mov rdx, qword [rdx]
movabs r8, 0x181d9e0b59262475
movabs r9, 0x581d9e0b59262475
xor r8, r9
and rdx, r8
cmp rdx, 0
sete dl
mov byte [rsp + 0x27], dl
cmp eax, ecx
je 0x140063a0a
mov al, byte [rsp + 0x27]
test al, 1
jne 0x140063969
jmp 0x140063973
mov rcx, qword [rsp + 0x28]
call fcn.14000f4df
mov ecx, dword [0x140243d98]
mov edx, dword [0x140243d9c]
xor edx, 0x7dad5a9d
mov eax, ecx
or eax, edx
xor eax, 0xffffffff
or ecx, edx
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
add eax, 0xbc689284
mov ecx, 0xa254b77c
xor ecx, 0x30988120
xor edx, edx
div ecx
mov ecx, 0x3d901fbc
xor edx, edx
div ecx
cmp eax, 0x5c19511c
ja 0x140063a13
mov eax, dword [0x140243da0]
xor eax, 0x4e54a10d
xor edx, edx
div dword [0x140243da4]
sub eax, 0x6b4154ce
mov ecx, 0x998a71c5
xor ecx, 0x117b6aa2
sub eax, ecx
sub eax, 0xd297f742
mov ecx, 0xf6d6db41
xor ecx, 0x7e27c026
add eax, ecx
add eax, 0xeb594508
cmp eax, 0x9d5c1af5
jbe 0x1400639be
add rsp, 0x48
ret
xchg ebx, eax
sub byte [rdi - 0x16f17], bl
call rbx
invalid
rol dword [rdx + 0x27], cl
mov esp, 0xffffa2e9
dec dword [rdi]
invalid
Function at 0x140065120
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 8], rcx
mov eax, dword [0x140243e88]
add eax, dword [0x140243e8c]
mov ecx, 0xf55042ef
xor ecx, 0x392f5dde
sub eax, ecx
sub eax, 0x8a38652b
mov ecx, 0xb7064aa4
xor ecx, 0x5de36766
imul eax, ecx
cmp eax, 0x773eb78f
je 0x1400651f3
mov rdx, qword [rbp - 8]
mov eax, dword [0x140243e90]
mov ecx, dword [0x140243e94]
add eax, ecx
imul eax, eax, 0xa728329a
add eax, 0x1dba28aa
mov ecx, eax
xor ecx, 0x63e740f3
or eax, 0x9c18bf0c
and eax, ecx
mov dword [rbp - 0x10], eax
mov eax, 0x10
call fcn.14023fff0
sub rsp, rax
mov rcx, rsp
mov qword [rbp - 0x18], rcx
mov word [rcx], 0
movabs r8, 0xa6cfd084f03c5541
movabs rax, 0xa6cfd084f03c5543
xor r8, rax
sub rsp, 0x20
call fcn.140065980
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbp - 0x10]
add rsp, 0x20
mov cx, word [rcx]
mov word [rbp - 0xa], cx
cmp eax, 0xc1c5a6f1
jae 0x140065165
mov ax, word [rbp - 0xa]
mov rsp, rbp
pop rbp
ret
invalid
Function at 0x140065c00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov word [rsp + 0x56], cx
call fcn.140064af7
mov cx, word [rsp + 0x56]
mov qword [rsp + 0x68], rax
mov word [rsp + 0x76], 0
mov rax, qword [0x14026bf88]
mov qword [rsp + 0x58], rax
movsx rcx, cx
add rax, 8
shl rcx, 4
add rax, rcx
add rax, 8
mov rcx, qword [rax]
mov qword [rsp + 0x60], rcx
add rcx, 0xa
call fcn.140065120
mov rcx, qword [rsp + 0x68]
mov word [rsp + 0x72], ax
xor eax, eax
cmp byte [rcx], 0
mov word [rsp + 0x74], ax
jne 0x140065e6b
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov dx, word [rsp + 0x72]
movsx rdx, dx
mov qword [rsp + 0x40], rdx
cmp byte [rcx + 0xc], 0x51
mov qword [rsp + 0x48], rax
jne 0x140065cdb
mov cx, word [rsp + 0x56]
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
add rax, 8
shl rdx, 4
add rax, rdx
add rax, 8
mov r8, qword [rax]
add r8, 8
call fcn.140065230
mov rcx, qword [rsp + 0x68]
xor eax, eax
cmp byte [rcx], 0
mov word [rsp + 0x74], ax
jne 0x140065e6b
mov rax, qword [0x14026bf88]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov ecx, dword [0x140243f08]
imul ecx, dword [0x140243f0c]
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0x29a34a2a
xor edx, 0xbe96c23a
and edx, eax
mov r8d, 0x265d90fd
xor r8d, 0xb16818ed
mov eax, 0xa8aeed11
xor eax, 0x575112ee
xor r8d, eax
mov eax, ecx
and eax, r8d
imul eax, edx
mov r8d, 0x12d612a1
xor r8d, 0x85e39ab1
mov edx, ecx
and edx, r8d
mov r8d, 0xee556f24
xor r8d, 0x7960e734
or ecx, r8d
imul ecx, edx
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
and eax, 0x92a574e9
xor eax, 0xffffffff
mov edx, 0xdb83dc54
xor edx, 0x4926a8bd
mov r8d, 0x273e3ef3
xor r8d, 0xb59b4a1a
and edx, r8d
mov r8d, 0x6d3c19db
xor r8d, 0x92c3e624
xor edx, r8d
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
sub eax, 0xf4f98355
cmp eax, 0x15d4b551
jb 0x140065e75
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x140243f10]
mov r8d, dword [0x140243f14]
xor r8d, 0x606cdc38
xor edx, edx
div r8d
mov r8d, eax
mov rax, qword [rsp + 0x38]
mov r9d, 0xd8f797ef
xor r9d, 0xa5f8f2e1
mov edx, r8d
and edx, r9d
xor r8d, 0x7d0f650e
or edx, r8d
xor edx, 0x10f98337
imul edx, edx, 0x68c30e82
mov dword [rsp + 0x30], edx
mov edx, 0x3ff82bf
xor edx, 0xd365468a
mov dword [rsp + 0x2c], edx
add rax, 8
shl rcx, 4
add rax, rcx
add rax, 8
mov rdx, qword [rax]
add rdx, 8
movabs r8, 0x17903b3118c1e398
movabs rax, 0x17903b3118c1e39a
xor r8, rax
lea rcx, [rsp + 0x76]
call fcn.140065980
mov ecx, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x30]
mov dx, word [rsp + 0x76]
mov word [rsp + 0x36], dx
cmp eax, ecx
je 0x140065da9
mov ax, word [rsp + 0x36]
mov word [rsp + 0x74], ax
jmp 0x140065e6b
mov ax, word [rsp + 0x74]
add rsp, 0x78
ret
int3
Function at 0x140067a80
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x140067ac2
mov rcx, qword [rsp + 0x30]
movabs rax, 0x4000000000000000
and rax, qword [rcx]
cmp rax, 0
je 0x140067ac2
mov rcx, qword [rsp + 0x28]
call fcn.140013e10
mov eax, dword [0x140243ff8]
mov ecx, dword [0x140243ffc]
xor ecx, 0x44d1b6ea
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0xb4122a58
mov edx, 0xffffffff
xor edx, 0xb4122a58
and ecx, edx
or eax, ecx
and eax, 0x84271eed
xor eax, 0x1e4d0d9
mov ecx, 0xf5d73fb2
xor ecx, 0xc1b47cd2
cmp eax, ecx
jb 0x140067b4f
mov eax, dword [0x140244000]
xor edx, edx
div dword [0x140244004]
or eax, 0xad8d0e29
mov ecx, 0x66d7b686
xor ecx, 0x5841d1bb
xor edx, edx
div ecx
sub eax, 0xc984ab55
mov ecx, 0x48d2f665
xor ecx, 0x98cd7582
cmp eax, ecx
je 0x140067b10
add rsp, 0x38
ret
mov ebx, 0xe9b0ad89
mov eax, 0x55ffffff
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov word [rbp - 0x32], cx
push 0x10
pop rax
call fcn.14023fff0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
sub rsp, 0x20
call fcn.1400672eb
mov cx, word [rbp - 0x32]
add rsp, 0x20
mov rdx, rax
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x18], rdx
mov qword [rax], 0
mov rax, qword [0x14026bf98]
mov qword [rbp - 0x28], rax
movsx rcx, cx
add rax, 8
shl rcx, 4
add rax, rcx
add rax, 8
mov rcx, qword [rax]
mov qword [rbp - 0x20], rcx
add rcx, 0x11
sub rsp, 0x20
call fcn.140067310
add rsp, 0x20
mov cx, ax
mov rax, qword [rbp - 0x18]
mov word [rbp - 0xa], cx
mov cl, byte [rax]
mov dl, 0x38
xor dl, 0x38
xor eax, eax
cmp cl, dl
mov qword [rbp - 8], rax
jne 0x140067cb1
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
mov dx, word [rbp - 0xa]
movsx rdx, dx
mov qword [rbp - 0x48], rdx
cmp byte [rcx + 0xa], 0x67
mov qword [rbp - 0x40], rax
jne 0x140067c60
mov cx, word [rbp - 0x32]
mov rdx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x28]
add rax, 8
shl rdx, 4
add rax, rdx
add rax, 8
mov r8, qword [rax]
add r8, 8
sub rsp, 0x20
call fcn.1400676e0
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
xor eax, eax
cmp byte [rcx], 0
mov qword [rbp - 8], rax
jne 0x140067cb1
mov rax, qword [0x14026bf98]
mov qword [rbp - 0x40], rax
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x40]
add rax, 8
shl rdx, 4
add rax, rdx
add rax, 8
mov rdx, qword [rax]
add rdx, 8
movabs r8, 0x7cab43a3c63d452
movabs rax, 0x7cab43a3c63d45a
xor r8, rax
sub rsp, 0x20
call fcn.140067480
mov rax, qword [rbp - 0x30]
add rsp, 0x20
mov rax, qword [rax]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret