joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400697f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov eax, dword [0x1402530f8]
xor eax, 0x685c3e16
xor edx, edx
div dword [0x1402530fc]
mov r11d, eax
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0xb7e5f424
mov edx, 0xe7e433a1
xor edx, 0xf077e9c1
mov eax, 0xe7b4e7e0
xor eax, 0x184b181f
xor edx, eax
mov r9d, 0x2d7f2044
xor r9d, 0x3aecfa24
mov eax, ecx
and eax, r9d
and r11d, edx
mov r9d, r8d
and r9d, 0x1793da60
mov r10d, edx
and r10d, 0xb7e5f424
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
xor ecx, 0xffffffff
or edx, 0x1793da60
and ecx, edx
or eax, ecx
mov ecx, 0x4e3dafcc
xor edx, edx
div ecx
mov ecx, 0x88fcef21
xor edx, edx
div ecx
cmp eax, 0x634219cd
jae 0x1400698fc
mov eax, dword [0x140253100]
add eax, dword [0x140253104]
mov ecx, 0xfc46df24
xor ecx, 0xfc9e130a
or eax, ecx
xor eax, 0xfabb84e5
and eax, 0xfa2c3c66
mov dword [rsp + 0x2c], eax
mov eax, 0x84619ff8
xor eax, 0xdb71553b
mov dword [rsp + 0x28], eax
mov rax, qword [0x140269990]
mov ecx, dword [rax]
call fcn.140007b33
mov ecx, dword [rsp + 0x28]
mov rdx, rax
mov eax, dword [rsp + 0x2c]
add rdx, 0x50
mov qword [rsp + 0x30], rdx
cmp eax, ecx
je 0x140069893
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
jns 0x14006994d
add dword [rcx + rbp*8 - 0x72], eax
nop word cs:[rax + rax]
jns 0x1400699bd
invalid

Function at 0x140069910
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 8], rcx
mov eax, dword [0x140253108]
mov edx, dword [0x14025310c]
mov ecx, eax
and ecx, edx
shl ecx, 1
xor eax, edx
add eax, ecx
mov ecx, 0xc9c3fe3e
xor ecx, 0x5b940481
sub eax, ecx
xor eax, 0xffffffff
mov ecx, 0xaee073c7
xor ecx, 0xd56e795c
mov edx, 0x86c5634
xor edx, 0xf793a9cb
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0x314c42b3
or eax, ecx
mov ecx, 0xc4f0cd0c
xor ecx, 0xf5bc8fbf
or ecx, edx
mov edx, 0xe882727
xor edx, 0xf177d8d8
xor eax, edx
and eax, ecx
mov ecx, 0x6a34f0f9
xor ecx, 0xd5635af4
and ecx, eax
xor ecx, 0xffffffff
mov edx, 0x9b9e18c7
xor edx, 0x24c9b2ca
add eax, edx
add eax, 1
add eax, ecx
cmp eax, 0x8f31eb49
jb 0x140069a4a
mov rdx, qword [rbp - 8]
mov ecx, dword [0x140253110]
mov eax, dword [0x140253114]
xor eax, ecx
not eax
and eax, ecx
imul ecx, eax, 0xd5874094
mov r8d, ecx
not r8d
or r8d, 0x92e99db
mov eax, ecx
mov ecx, r8d
lea eax, [rax + rcx + 0x70499773]
mov dword [rbp - 0x10], eax
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rcx, rsp
mov qword [rbp - 0x18], rcx
mov word [rcx], 0
movabs r8, 0xf4c95f53c0837b15
movabs rax, 0xf4c95f53c0837b17
xor r8, rax
sub rsp, 0x20
call fcn.140069a53
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbp - 0x10]
add rsp, 0x20
mov cx, word [rcx]
mov word [rbp - 0xa], cx
cmp eax, 0x6e264e11
jbe 0x1400699b3
invalid
mov ax, word [rbp - 0xa]
mov rsp, rbp
pop rbp
ret
ja 0x140069a3f
retf
Function at 0x14006d950
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov word [rbp - 0xa], dx
mov qword [rbp - 8], rcx
mov eax, dword [0x140253378]
imul eax, dword [0x14025337c]
mov ecx, 0x6046e7b0
xor ecx, 0x1b000a66
imul eax, ecx
mov ecx, 0xbfdb786
xor ecx, 0xd28de19f
sub eax, ecx
and eax, 0xd513ce8a
cmp eax, 0x7a02cb39
jbe 0x14006db85
mov cx, word [rbp - 0xa]
mov eax, 0x8e2bc0de
mov dword [rbp - 0x10], eax
mov eax, 0x10
mov qword [rbp - 0x30], rax
call fcn.14024f5c0
sub rsp, rax
mov rax, qword [rbp - 0x30]
mov rdx, rsp
mov qword [rbp - 0x20], rdx
call fcn.14024f5c0
sub rsp, rax
mov rax, qword [rbp - 0x20]
mov rdx, rsp
mov qword [rbp - 0x28], rdx
mov word [rax], cx
sub rsp, 0x20
call fcn.14006d36b
mov rcx, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x20]
add rsp, 0x20
mov qword [rbp - 0x18], rax
mov ax, 0xf3c3
xor ax, 0xf3c3
mov word [rcx], ax
sub rsp, 0x20
call fcn.14006dba0
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbp - 0x10]
add rsp, 0x20
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0xb], cl
cmp eax, 0x8142d870
jb 0x14006d99a
mov al, byte [rbp - 0xb]
test al, 1
jne 0x14006da34
jmp 0x14006db80
mov ecx, dword [0x140253388]
sub ecx, dword [0x14025338c]
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0x5193fe86
xor edx, 0x43ac7d35
and edx, eax
mov r8d, 0xaa8c7264
xor r8d, 0xb8b3f1d7
mov eax, 0x96a4b65c
xor eax, 0x695b49a3
xor r8d, eax
mov eax, ecx
and eax, r8d
imul eax, edx
mov edx, ecx
and edx, 0x123f83b3
mov r8d, 0xacfa5ce0
xor r8d, 0xbec5df53
or ecx, r8d
imul ecx, edx
add ecx, eax
mov eax, ecx
and eax, 0x6898d093
xor ecx, 0x6898d093
or eax, ecx
mov ecx, 0xe53e9e3
xor ecx, 0x6f869b6c
add eax, ecx
sub eax, 0xff9ed08d
sub eax, 0x61d5728f
cmp eax, 0x314c42b3
jb 0x14006db8e
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x28]
mov r8d, dword [0x140253390]
mov edx, 0x2dfd21c9
xor edx, 0xb06cf07e
xor r8d, edx
xor r8d, dword [0x140253394]
and r8d, 0xcd105c7e
mov edx, r8d
and edx, 0x9e73a06d
mov r9d, 0xaab20b5d
xor r9d, 0x554df4a2
xor edx, r9d
xor r8d, 0xffffffff
mov r9d, 0x5f9120d8
xor r9d, 0xc1e280b5
mov r10d, 0x36700cfa
xor r10d, 0xc98ff305
xor r9d, r10d
or r8d, r9d
xor edx, 0xffffffff
mov r9d, 0xf3ca83d0
xor r9d, 0xc357c2f
xor r8d, r9d
or edx, r8d
mov r8d, edx
and r8d, 0x19abb409
xor r8d, 0xffffffff
add edx, 0x19abb409
add edx, 1
add edx, r8d
mov dword [rbp - 0x34], edx
mov dx, word [rax]
sub rsp, 0x20
call fcn.14003b512
mov eax, dword [rbp - 0x34]
add rsp, 0x20
cmp eax, 0xee7b28fd
jae 0x14006dac2
invalid
jmp 0x14006db80
mov rsp, rbp
pop rbp
ret
ja 0x14006db7a
retf
jg 0x14006dbdb
mov ebp, edx
jmp 0x14006dac2
and edx, eax
Function at 0x14006dd00
Capabilities:
Encode data using add xor sub operations

Disassembly:
push rbp
push rsi
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x20], rcx
mov eax, 0x10
mov qword [rbp - 0x18], rax
call fcn.14024f5c0
sub rsp, rax
mov rax, qword [rbp - 0x18]
mov rcx, rsp
mov qword [rbp - 8], rcx
call fcn.14024f5c0
sub rsp, rax
mov rax, qword [rbp - 8]
mov rcx, rsp
mov qword [rbp - 0x10], rcx
mov dword [rax], edx
sub rsp, 0x20
call fcn.14006d36b
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 8]
add rsp, 0x20
mov qword [rbp], rax
mov dword [rcx], 0
sub rsp, 0x20
call fcn.14006deb5
mov rax, qword [rbp]
add rsp, 0x20
mov al, byte [rax]
mov cl, 0xae
xor cl, 0xae
cmp al, cl
jne 0x14006dea5
mov eax, dword [0x1402533a8]
mov ecx, 0xd380410a
xor ecx, 0xc8e246bf
xor eax, ecx
add eax, dword [0x1402533ac]
and eax, 0xbfa6a13c
add eax, 0xc2d9aaf9
add eax, 0x6d5549ed
add eax, 0x8a6c711
sub eax, 0x6d5549ed
cmp eax, 0xd3b3c5c7
ja 0x14006deac
mov rcx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x10]
mov r10d, dword [0x1402533b0]
mov r9d, dword [0x1402533b4]
mov edx, r10d
xor edx, 0xffffffff
and edx, 0x91f1ed5a
mov r11d, 0xffffffff
xor r11d, 0x91f1ed5a
and r10d, r11d
mov r8d, r9d
xor r8d, 0xffffffff
mov esi, 0x9e82f8fb
xor esi, 0xf7315a1
and r8d, esi
and r9d, r11d
or edx, r10d
or r8d, r9d
xor edx, r8d
mov r8d, edx
xor r8d, 0xffffffff
and r8d, 0xdbc68746
mov r9d, 0xffffffff
xor r9d, 0xdbc68746
and edx, r9d
or r8d, edx
mov r9d, 0xa3301859
xor r9d, 0x5ccfe7a6
mov edx, r8d
xor edx, r9d
and edx, 0x23b9730c
mov r9d, 0x8b82a502
xor r9d, 0xa83bd60e
mov r10d, 0x7aa67245
xor r10d, 0x85598dba
xor r9d, r10d
and r8d, r9d
or edx, r8d
imul edx, edx, 0x5bd61e1b
mov dword [rbp - 0x24], edx
mov edx, 0xc6d68a34
xor edx, 0xf31950bf
mov dword [rbp - 0x28], edx
mov edx, dword [rax]
sub rsp, 0x20
call fcn.14003b540
mov ecx, dword [rbp - 0x28]
mov eax, dword [rbp - 0x24]
add rsp, 0x20
cmp eax, ecx
je 0x14006ddbc
jmp 0x14006dea5
lea rsp, [rbp + 8]
pop rsi
pop rbp
ret
xor byte [rcx], dh
pop rcx
sub eax, 0xffff07e9
dec dword [rax - 0x7d]
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
Function at 0x14006f080
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 0x20], rcx
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
mov qword [rbp - 8], rdx
sub rsp, 0x20
call fcn.14006d36b
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov qword [rbp - 0x10], rax
movabs rax, 0xd0f02dae95627f79
movabs rdx, 0xd0f02dae95627f79
xor rax, rdx
mov qword [rcx], rax
lea rdx, [rbp - 8]
sub rsp, 0x20
call fcn.14006f1c0
mov rax, qword [rbp - 0x10]
add rsp, 0x20
mov al, byte [rax]
mov cl, 0xe0
xor cl, 0xe0
cmp al, cl
jne 0x14006f111
mov rcx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x18]
mov rdx, qword [rax]
sub rsp, 0x20
call fcn.14003b6b0
add rsp, 0x20
mov eax, dword [0x140253458]
mov ecx, 0x2c386a91
xor ecx, 0x8ea7b91
xor eax, ecx
xor edx, edx
div dword [0x14025345c]
mov ecx, 0xdf1d7f27
xor edx, edx
div ecx
mov ecx, 0xffffffff
xor ecx, 0x57db6c08
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
mov ecx, 0x7a4c6466
xor ecx, 0xac30028b
xor edx, edx
div ecx
mov ecx, 0xa152cb64
xor ecx, 0xe4330ff1
cmp eax, ecx
je 0x14006f1ab
mov eax, dword [0x140253460]
mov ecx, dword [0x140253464]
mov edx, 0xf8a53123
xor edx, 0x87f59b09
sub eax, edx
sub eax, ecx
add eax, 0x7f50aa2a
imul eax, eax, 0x2ccce23e
add eax, 0x50a06ec9
and eax, 0x91c9336
cmp eax, 0x2218db7f
je 0x14006f16b
mov rsp, rbp
pop rbp
ret
call [rsi - 0x3f]
add ebp, ecx
mov bh, 0xff
invalid
Function at 0x14006fb20
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006d36b
mov rdx, qword [rsp + 0x30]
cmp rdx, 0
jne 0x14006fb51
mov rcx, qword [rsp + 0x28]
call fcn.14006d926
jmp 0x14006fb60
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call fcn.14006f860
mov eax, dword [0x1402534b8]
xor eax, 0x90da638f
mov r8d, dword [0x1402534bc]
mov ecx, 0xa8c117c8
xor ecx, 0x573ee837
mov r9d, r8d
xor r9d, ecx
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x8d002be4
mov r8d, 0xffffffff
xor r8d, 0x8d002be4
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x8d002be4
or eax, 0x8d002be4
imul eax, edx
add eax, ecx
mov ecx, 0xe5b30b98
xor ecx, 0xeac57394
sub eax, ecx
mov edx, 0x621e2e38
xor edx, 0xb2a7444
mov ecx, 0x5d0af2e5
xor ecx, 0xa2f50d1a
xor edx, ecx
mov ecx, eax
and ecx, edx
mov r8d, 0x5cab2e2a
xor r8d, 0x359f7456
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
cmp eax, 0x2f423dbb
jbe 0x14006fcb3
mov r11d, dword [0x1402534c0]
mov eax, dword [0x1402534c4]
xor eax, 0x802685b2
sub r11d, eax
mov ecx, r11d
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xa2110a53
mov r8d, 0xffffffff
xor r8d, 0x2f7dfb42
mov eax, ecx
and eax, 0x2f7dfb42
and r11d, r8d
mov r9d, edx
and r9d, 0x2f7dfb42
mov r10d, r8d
and r10d, 0xa2110a53
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, edx
xor ecx, 0xffffffff
mov edx, 0x48efbd90
xor edx, 0x679246d2
or edx, r8d
and ecx, edx
or eax, ecx
add eax, 0xc0a54ae8
mov ecx, 0x2a8c8dcf
xor edx, edx
div ecx
mov ecx, 0xbcbc14bc
xor ecx, 0x8b9523ad
cmp eax, ecx
ja 0x14006fc1c
add rsp, 0x38
ret
invalid
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006d36b
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x14006fb20
Function at 0x140070010
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x20], rcx
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.14006d36b
mov rcx, qword [rbp - 0x20]
add rsp, 0x20
mov qword [rbp - 0x18], rax
mov eax, 0x7fa945af
xor eax, 0x7fa945af
mov dword [rbp - 4], eax
sub rsp, 0x20
call fcn.14003b894
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov dword [rbp - 0xc], eax
xor eax, eax
cmp byte [rcx], 0
mov dword [rbp - 8], eax
jne 0x140070161
mov eax, dword [0x1402534e8]
imul eax, dword [0x1402534ec]
mov ecx, 0xd3a74d13
xor ecx, 0xe1df0ab8
xor edx, edx
div ecx
or eax, 0x179ad94c
mov r8d, 0xffffffff
xor r8d, 0x3f675322
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x19dd1ecf
xor r8d, 0xe622e130
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x3f675322
mov r8d, 0x967f799e
xor r8d, 0xa9182abc
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x32a05ebd
xor ecx, 0xca8b0eed
cmp eax, ecx
jae 0x140070169
mov eax, dword [0x1402534f0]
xor edx, edx
div dword [0x1402534f4]
mov ecx, 0x7baf6126
xor edx, edx
div ecx
mov rdx, qword [rbp - 0x28]
mov r8d, eax
mov eax, dword [rbp - 0xc]
xor r8d, 0x7da521a9
mov ecx, r8d
and ecx, 0x6da3cf5a
or r8d, 0x6da3cf5a
add ecx, r8d
mov dword [rbp - 0x30], ecx
mov dword [rdx], eax
lea rcx, [rbp - 4]
sub rsp, 0x20
call fcn.14006deb5
mov eax, dword [rbp - 0x30]
add rsp, 0x20
mov ecx, dword [rbp - 4]
mov dword [rbp - 0x2c], ecx
cmp eax, 0x1784c630
jb 0x1400700f1
mov eax, dword [rbp - 0x2c]
mov dword [rbp - 8], eax
jmp 0x140070161
invalid
mov eax, dword [rbp - 8]
mov rsp, rbp
pop rbp
ret
add dh, bh
jrcxz 0x140070157
jg 0x14007016f
invalid
invalid
Function at 0x1400771e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1402538c8]
mov ecx, dword [0x1402538cc]
mov edx, 0xbfa3134b
xor edx, 0xab58511a
xor ecx, edx
xor eax, ecx
xor eax, 0x59176a1d
sub eax, 0xb1482aff
add eax, 0x50cc7c1e
mov ecx, 0x1d34c973
xor ecx, 0x1432ddb2
add eax, ecx
sub eax, 0x50cc7c1e
mov ecx, 0x1dd13116
xor ecx, 0xe7e99816
cmp eax, ecx
je 0x1400772f5
mov eax, dword [0x1402538d0]
xor eax, 0x7a936295
mov r8d, dword [0x1402538d4]
mov ecx, 0x22b1f0ae
xor ecx, 0xdd4e0f51
mov edx, r8d
xor edx, ecx
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
mov ecx, 0x899d532a
xor ecx, 0x4ef2f363
xor eax, ecx
imul eax, eax, 0x901e889f
mov ecx, 0xa807ddcb
xor ecx, 0x57f82234
mov edx, eax
xor edx, ecx
and edx, 0x1e59cf6c
mov r8d, 0x1bd59663
xor r8d, 0x58c590f
mov ecx, 0xbb9b87b8
xor ecx, 0x44647847
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x1e59cf6c
or eax, 0x1e59cf6c
imul eax, edx
add eax, ecx
mov dword [rsp + 0x24], eax
call fcn.14006d36b
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
call fcn.140077060
mov eax, dword [rsp + 0x24]
cmp eax, 0xd7ec175f
je 0x14007723d
add rsp, 0x38
ret
cwde
invalid

Function at 0x140077724
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
call fcn.14006d36b
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
call fcn.140070431
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140077716
mov eax, dword [0x1402538f8]
xor edx, edx
div dword [0x1402538fc]
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
mov edx, 0x432435ce
xor edx, 0xd3ecc61f
or eax, edx
add eax, ecx
mov ecx, 0x915419cb
xor ecx, 0x1ea180ca
xor eax, ecx
mov ecx, 0x316e318c
xor ecx, 0xc49ffc5c
or eax, ecx
cmp eax, 0x53ca1dfb
jb 0x14007771b
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x140253900]
mov edx, dword [0x140253904]
xor edx, 0x5da29b5b
add eax, edx
mov r8d, 0x6cd57a84
xor edx, edx
div r8d
xor eax, 0x96f66bfd
mov r8d, 0xb9ae2705
xor r8d, 0xb45ed866
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x30]
mov dword [rsp + 0x2c], eax
mov eax, 0x6da7d109
xor eax, 0x4498515a
mov dword [rsp + 0x28], eax
call fcn.140073a61
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
jae 0x1400776aa
jmp 0x140077716
add rsp, 0x48
ret
test edx, edx
mov bl, 0xb6
jmp 0x1400776aa
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006d36b
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x140077630
Function at 0x140079170
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rcx
call fcn.14006d36b
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov qword [rcx], 0
mov qword [rcx + 8], 0
movabs rcx, 0x1e07c3f05916b777
movabs rax, 0x1e07c3f05916b77f
xor rcx, rax
call fcn.14006d7d0
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov al, 1
cmp byte [rcx], 0
mov byte [rsp + 0x67], al
jne 0x1400792f2
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x58]
call fcn.140079148
mov rcx, qword [rsp + 0x50]
mov al, 1
cmp byte [rcx], 0
mov byte [rsp + 0x67], al
jne 0x1400792f2
mov eax, dword [0x1402539e8]
xor eax, 0xf36f5a29
mov ecx, dword [0x1402539ec]
sub eax, 0x7699be57
sub eax, ecx
mov ecx, 0x26cdcd84
xor ecx, 0x505473d3
add eax, ecx
and eax, 0x943d42e4
imul eax, eax, 0x86c7c46
mov ecx, 0x7f8474a3
xor edx, edx
div ecx
mov ecx, 0xc3bb8dee
xor ecx, 0x417c870c
cmp eax, ecx
jae 0x14007932f
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x58]
mov edx, dword [0x1402539f0]
mov r9d, dword [0x1402539f4]
mov r8d, 0xbef3ff2f
xor r8d, 0xe50efa7d
xor r9d, r8d
xor r8d, r8d
sub r8d, r9d
add edx, r8d
imul edx, edx, 0x5adb93ff
mov r8d, edx
and r8d, 0xbf8f8fba
or edx, 0xbf8f8fba
add r8d, edx
mov r9d, 0x8ef31a0a
xor r9d, 0x76bfac17
mov edx, r8d
and edx, r9d
xor r8d, 0xf84cb61d
or edx, r8d
mov dword [rsp + 0x30], edx
mov rdx, qword [rax + 0x58]
mov qword [rsp + 0x68], rdx
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x68]
call fcn.140019410
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x30]
mov cl, byte [rcx]
mov byte [rsp + 0x37], cl
cmp eax, 0x38d090f
jbe 0x140079245
mov al, byte [rsp + 0x37]
mov byte [rsp + 0x67], al
jmp 0x1400792f2
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov dl, byte [rsp + 0x67]
mov byte [rsp + 0x2f], dl
mov byte [rax], 0
call fcn.14006d09c
mov rax, qword [rsp + 0x50]
cmp byte [rax], 0
jne 0x140079325
mov rax, qword [rsp + 0x50]
mov cl, byte [rsp + 0x2f]
mov byte [rax], cl
mov rax, qword [rsp + 0x40]
add rsp, 0x78
ret
fmul dword [rax + 0xde95dce]
invalid
Function at 0x14007a360
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x140253aa8]
mov ecx, 0xe187b2ca
xor ecx, 0xb7b9d6bf
xor eax, ecx
xor edx, edx
div dword [0x140253aac]
xor ecx, ecx
sub ecx, 0x8596083
sub eax, ecx
mov ecx, 0x83699d33
xor ecx, 0x457f3f1b
sub eax, ecx
sub eax, 0x60afba3d
add eax, 0xc616a228
mov ecx, eax
and ecx, 0xa72416bf
xor ecx, 0xffffffff
add eax, 0xa72416bf
mov edx, 0xc54f393f
xor edx, 0xc54f393e
add eax, edx
add eax, ecx
cmp eax, 0xc746769f
je 0x14007a5bb
mov eax, dword [0x140253ab0]
mov ecx, dword [str.P_tqi]
xor ecx, 0x8a921c25
xor edx, edx
div ecx
add eax, 0xe8145fe7
mov ecx, eax
imul rcx, rcx, 0x266d3e9d
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.14006d36b
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov edx, 2
sub rsp, 0x20
call fcn.14006df20
mov rcx, qword [rbp - 0x20]
mov eax, dword [rbp - 0x18]
add rsp, 0x20
mov cl, byte [rcx]
mov dl, 0xec
xor dl, 0xec
cmp cl, dl
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0xd772d8df
je 0x14007a3d8
mov al, byte [rbp - 0x11]
test al, 1
jne 0x14007a478
jmp 0x14007a5b6
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov edx, dword [rax]
sub rsp, 0x20
call fcn.14006e775
mov rax, qword [rbp - 0x20]
add rsp, 0x20
mov al, byte [rax]
mov cl, 0xeb
xor cl, 0xeb
cmp al, cl
jne 0x14007a5b6
mov eax, dword [0x140253ab8]
xor edx, edx
div dword [0x140253abc]
mov ecx, eax
and ecx, 0x12410985
or eax, 0x12410985
add ecx, eax
mov edx, 0xac0bfc8e
xor edx, 0x66499ecd
mov eax, ecx
or eax, edx
mov edx, 0xb9840186
xor edx, 0x467bfe79
xor eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xca426243
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
xor ecx, ecx
sub ecx, 0x7c4040ef
add eax, ecx
cmp eax, 0x6eea447c
je 0x14007a5c4
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r9d, dword [0x140253ac0]
mov r10d, dword [0x140253ac4]
mov r11d, 0xcc8567c4
xor r11d, 0x337a983b
mov r8d, r9d
xor r8d, r11d
mov r11d, r10d
xor r11d, 0xffffffff
or r8d, r11d
and r9d, r10d
xor r9d, 0xffffffff
mov r10d, 0xd41031f3
xor r10d, 0x2befce0c
xor r8d, r10d
xor r9d, 0xffffffff
or r8d, r9d
imul r8d, r8d, 0x925f0926
imul r8d, r8d, 0x6de33dc4
imul r8d, r8d, 0x9d06c34e
mov dword [rbp - 0x2c], r8d
mov r8d, 0x8fca2708
xor r8d, 0xfa4eae04
mov dword [rbp - 0x30], r8d
mov r8, qword [rax + 8]
mov qword [rdx], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14006ef20
mov ecx, dword [rbp - 0x30]
mov eax, dword [rbp - 0x2c]
add rsp, 0x20
cmp eax, ecx
jb 0x14007a508
jmp 0x14007a5b6
mov rsp, rbp
pop rbp
ret
invalid
test dword [rcx + 0x55], ecx
ret
Function at 0x14007d190
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006d36b
mov rdx, qword [rsp + 0x30]
cmp rdx, 0
jne 0x14007d2bb
mov eax, dword [0x140253c68]
or eax, dword [0x140253c6c]
add eax, 0x8c7f797
add eax, 0x4d4d3e81
sub eax, 0x8c7f797
mov ecx, 0xec122687
xor ecx, 0x99734581
and eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x30d16a8a
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x460b510f
xor r8d, 0xb9f4aef0
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x30d16a8a
or eax, 0x30d16a8a
imul eax, edx
add eax, ecx
cmp eax, 0x434bdb19
jbe 0x14007d3a4
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x140253c70]
xor eax, 0x6ce360b4
mov r9d, dword [0x140253c74]
mov r10d, r9d
xor r10d, 0xffffffff
mov r8d, eax
and r8d, r10d
mov edx, eax
or edx, r10d
xor edx, 0xffffffff
imul edx, r8d
mov r8d, eax
and r8d, r9d
or eax, r9d
imul eax, r8d
add eax, edx
imul eax, eax, 0x3f9be881
mov r8d, 0x958c0004
xor r8d, 0xcb9f211f
mov edx, eax
and edx, r8d
shl edx, 1
add eax, 0x5e13211b
sub eax, edx
mov r8d, 0x6867bb0d
xor r8d, 0xe93fcc67
mov edx, eax
xor edx, r8d
xor edx, 0xffffffff
or eax, 0x8158776a
and eax, edx
mov dword [rsp + 0x24], eax
call fcn.14006d926
mov eax, dword [rsp + 0x24]
cmp eax, 0x47b52300
ja 0x14007d221
jmp 0x14007d2ca
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call fcn.14007ce90
mov eax, dword [0x140253c78]
xor eax, dword [0x140253c7c]
mov ecx, eax
and ecx, 0x9df2f003
mov edx, 0x90957589
xor edx, 0x9095758b
imul ecx, edx
xor eax, 0x9df2f003
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xf434bb
mov r8d, 0x776deb88
xor r8d, 0x7799df33
mov ecx, 0xb342ac6a
xor ecx, 0x4cbd5395
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xf434bb
mov r8d, 0xa3dfe0c4
xor r8d, 0xa32bd47f
or eax, r8d
imul eax, edx
add eax, ecx
imul eax, eax, 0xa79c07bb
cmp eax, 0xfe73adb7
jae 0x14007d3ad
mov eax, dword [0x140253c80]
xor edx, edx
div dword [0x140253c84]
mov ecx, eax
and ecx, 0x7220891f
mov edx, 0xbc098e9f
xor edx, 0x43f67160
xor ecx, edx
add eax, 0x7220891f
add eax, 1
add eax, ecx
mov ecx, eax
and ecx, 0x199e243f
shl ecx, 1
add eax, 0x199e243f
sub eax, ecx
imul eax, eax, 0x285f47c4
cmp eax, 0x276e4e43
jb 0x14007d34f
add rsp, 0x38
ret
movabs rdx, 0x4b60fffffe74e9db
int3
invalid