joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005dff0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov ecx, dword [0x1401cab98]
and ecx, dword [0x1401cab9c]
mov r8d, 0xffffffff
xor r8d, 0x7986eefe
mov edx, ecx
and edx, r8d
mov eax, ecx
or eax, r8d
xor eax, 0xffffffff
imul eax, edx
mov r8d, 0xb591df01
xor r8d, 0xcc1731ff
mov edx, ecx
and edx, r8d
or ecx, 0x7986eefe
imul ecx, edx
add ecx, eax
mov eax, 0x300ac6f1
xor eax, 0x300ac6f1
mov edx, 0x6c3536fd
xor edx, 0x23c59322
sub eax, edx
sub ecx, eax
mov eax, ecx
and eax, 0x9cd29567
or ecx, 0x9cd29567
add eax, ecx
cmp eax, 0x384e8e81
jb 0x14005e132
mov rcx, qword [rbp - 8]
mov eax, dword [0x1401caba0]
mov edx, dword [0x1401caba4]
xor eax, edx
add eax, 0xb921a5b9
or eax, 0xad3f3934
and eax, 0xfdff3fb7
mov dword [rbp - 0x14], eax
mov eax, 0x10
mov qword [rbp - 0x28], rax
call fcn.1401c7680
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov rdx, rsp
call fcn.1401c7680
sub rsp, rax
mov rax, qword [rbp - 0x10]
mov r8, rsp
mov qword [rbp - 0x20], r8
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140018d5d
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
add rsp, 0x20
add rcx, 0x10
mov r8, qword [rax + 0x10]
mov qword [rdx], r8
mov rax, qword [rax + 0x18]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140018d5d
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
mov eax, dword [rbp - 0x14]
add rsp, 0x20
mov dl, byte [rdx + 0x20]
mov byte [rcx + 0x20], dl
cmp eax, 0x4b213f70
je 0x14005e07b
mov rsp, rbp
pop rbp
ret
mov ch, 0x8a
invalid
Function at 0x140065b20
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx + 8]
call fcn.1400654f0
test al, 1
jne 0x140065b4b
jmp 0x140065b58
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call fcn.14000f700
mov eax, dword [0x1401caf90]
mov edx, dword [0x1401caf94]
mov ecx, eax
xor ecx, 0xffffffff
and ecx, edx
mov r8d, 0xebf4e59c
xor r8d, 0x140b1a63
xor edx, r8d
and eax, edx
sub eax, ecx
sub eax, 0x55a01629
mov ecx, 0xc6a292a3
xor edx, edx
div ecx
mov ecx, 0xe3a427ed
xor edx, edx
div ecx
cmp eax, 0xf1f1ae0e
jae 0x140065c8c
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x1401caf98]
mov edx, dword [0x1401caf9c]
xor edx, 0x4a7088c
sub eax, 0x6aa02d1b
add eax, edx
add eax, 0x6aa02d1b
and eax, 0xd29eecad
sub eax, 0xae4569da
mov edx, 0x94c9f6f5
xor edx, 0x3a7e2c1a
and eax, edx
mov rcx, qword [rcx + 0x20]
mov qword [rsp + 0x28], rcx
cmp rcx, 0
sete cl
mov byte [rsp + 0x37], cl
cmp eax, 0xe8c4e280
jae 0x140065ba1
mov al, byte [rsp + 0x37]
test al, 1
jne 0x140065c31
jmp 0x140065c0b
mov rcx, qword [rsp + 0x28]
movabs rax, 0x4000000000000000
and rax, qword [rcx]
cmp rax, 0
jne 0x140065c31
mov rcx, qword [rsp + 0x28]
call fcn.14000e572
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x28]
mov qword [rsp + 0x48], rcx
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
call fcn.14000f88b
mov rax, qword [rsp + 0x38]
mov rcx, rax
add rcx, 0x38
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax + 0x38]
call fcn.1400654f0
test al, 1
jne 0x140065c79
jmp 0x140065c86
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax]
call fcn.14000f700
nop
add rsp, 0x58
ret
and edx, dword [rdi]
pushfq
invalid
Function at 0x1400677c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401cb0d8]
imul eax, dword [0x1401cb0dc]
mov edx, eax
xor edx, 0xffffffff
and edx, 0x608a2edb
mov r8d, 0xffffffff
xor r8d, 0x608a2edb
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x608a2edb
mov r8d, 0xd6efc66d
xor r8d, 0xb665e8b6
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x930e91bd
xor edx, edx
div ecx
imul eax, eax, 0x90d14530
cmp eax, 0x4d734d1a
je 0x140067a0c
mov rcx, qword [rbp - 0x10]
mov edx, dword [0x1401cb0e0]
mov eax, dword [0x1401cb0e4]
or edx, eax
mov eax, edx
xor eax, 0x8c7cd0c3
and eax, edx
imul rax, rax, 0x46039b7f
shr rax, 0x3e
or eax, 0xd246adf4
mov dword [rbp - 0x18], eax
mov eax, 0x10
mov qword [rbp - 0x38], rax
call fcn.1401c7680
sub rsp, rax
mov rax, qword [rbp - 0x38]
mov rdx, rsp
mov qword [rbp - 0x28], rdx
call fcn.1401c7680
sub rsp, rax
mov rax, qword [rbp - 0x28]
mov rdx, rsp
mov qword [rbp - 0x30], rdx
mov qword [rax], rcx
sub rsp, 0x20
call fcn.14006611a
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
add rsp, 0x20
mov qword [rbp - 0x20], rax
movabs rax, 0x7009b629311ad0ca
movabs r8, 0x7009b629311ad0ca
xor rax, r8
mov qword [rcx], rax
sub rsp, 0x20
call fcn.140067a1e
mov rcx, qword [rbp - 0x20]
mov eax, dword [rbp - 0x18]
add rsp, 0x20
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0x3fb82444
jb 0x140067836
mov al, byte [rbp - 0x11]
test al, 1
jne 0x140067901
jmp 0x140067a07
mov eax, dword [0x1401cb0e8]
xor edx, edx
div dword [0x1401cb0ec]
xor eax, 0xa4b4aee3
or eax, eax
xor eax, 0xffffffff
mov ecx, 0x6bf50443
or ecx, 0x6bf50443
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov edx, eax
and edx, 0xd4ab7681
mov ecx, 0x5c530f5a
xor ecx, 0x5c530f58
imul ecx, edx
add eax, 0xd4ab7681
sub eax, ecx
cmp eax, 0x347c4608
je 0x140067a15
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x30]
mov edx, dword [0x1401cb0f0]
and edx, dword [0x1401cb0f4]
sub edx, 0xed32045f
mov r8d, 0x23b25f0
xor r8d, 0x6fd9924a
sub edx, r8d
add edx, 0xed32045f
mov r8d, 0x3b526f3
xor r8d, 0x6bb30924
mov r9d, 0xd5f58cfe
xor r9d, 0x2a0a7301
xor r8d, r9d
xor r9d, r9d
sub r9d, 1
sub r8d, r9d
sub edx, r8d
mov r8d, edx
xor r8d, 0xc8271cf7
mov r9d, 0xf85a3e52
xor r9d, 0x307d22a5
mov r10d, 0xe029b7d1
xor r10d, 0x1fd6482e
xor r9d, r10d
and edx, r9d
shl edx, 1
sub edx, r8d
mov dword [rbp - 0x3c], edx
mov rdx, qword [rax]
sub rsp, 0x20
call fcn.140031c30
mov eax, dword [rbp - 0x3c]
add rsp, 0x20
cmp eax, 0x73932dc4
jbe 0x140067957
jmp 0x140067a07
add byte [rax], al
add byte [rax], al
mov rsp, rbp
pop rbp
ret
jle 0x140067a03
movabs al, byte [0xe51ffffffe21e951]
cdq
imul cl
cmp edi, edi
invalid
invalid
Function at 0x140070111
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
call fcn.14006611a
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
call fcn.140032271
mov cl, al
mov rax, qword [rsp + 0x58]
mov byte [rsp + 0x67], cl
cmp byte [rax], 0
jne 0x1400700f9
mov eax, dword [0x1401cb508]
xor eax, 0x4f44efda
mov edx, dword [0x1401cb50c]
xor edx, 0x13d4711b
mov ecx, eax
xor ecx, 0xffffffff
and ecx, edx
mov r8d, 0xebca5a3d
xor r8d, 0x1435a5c2
xor edx, r8d
and eax, edx
sub eax, ecx
mov ecx, 0xf4349ab6
xor edx, edx
div ecx
add eax, 0x54cb1080
mov ecx, 0x4db12278
xor ecx, 0x979dd3ab
xor edx, edx
div ecx
cmp eax, 0xd67d1cb4
ja 0x1400700ff
mov cl, byte [rsp + 0x67]
mov r8d, dword [0x1401cb510]
mov edx, dword [0x1401cb514]
mov eax, r8d
xor eax, 0xffffffff
xor r8d, 0xffffffff
or eax, r8d
and edx, edx
mov r8d, 0x69e4ec45
xor r8d, 0x961b13ba
xor edx, r8d
and eax, edx
xor eax, 0xffffffff
mov r8d, 0x7bc97787
xor edx, edx
div r8d
sub eax, 0x731f143b
mov edx, 0xe91d4c3b
xor edx, 0x5c324a81
add eax, edx
cmp cl, 0xc0
sete cl
mov byte [rsp + 0x47], cl
cmp eax, 0x2a662271
je 0x14006ff60
mov al, byte [rsp + 0x47]
test al, 1
jne 0x14006ffd8
jmp 0x14006ffe7
mov rcx, qword [rsp + 0x50]
call fcn.14006a3e0
jmp 0x1400700f9
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
cmp rax, 0
mov qword [rsp + 0x38], rax
jne 0x1400700ea
xor eax, eax
mov ecx, eax
call fcn.1400ce640
mov rax, qword [rsp + 0x58]
cmp byte [rax], 0
jne 0x1400700f9
mov eax, dword [0x1401cb518]
mov ecx, dword [0x1401cb51c]
mov edx, 0xd1e60c20
xor edx, 0xbfe945ee
xor ecx, edx
xor ecx, 0xffffffff
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
mov ecx, 0x197de26b
xor ecx, 0xf3798cf5
add eax, ecx
mov ecx, 0xc99f4e68
xor edx, edx
div ecx
mov ecx, 0x5a15a813
xor ecx, 0x5a15a813
mov edx, 0x3ad7263d
xor edx, 0xc66b6574
sub ecx, edx
add eax, ecx
cmp eax, 0xb7dd2d24
ja 0x140070108
mov eax, dword [0x1401cb520]
xor edx, edx
div dword [0x1401cb524]
mov ecx, 0x4fa7d62c
xor edx, edx
div ecx
mov ecx, 0x8c276012
xor edx, edx
div ecx
or eax, 0x5493eb2e
mov dword [rsp + 0x2c], eax
mov eax, 0x681bbd03
xor eax, 0xfea43e99
mov dword [rsp + 0x28], eax
mov ecx, 0x10
mov edx, 8
call fcn.14001217d
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x28]
mov r8, rax
mov eax, dword [rsp + 0x2c]
mov qword [rsp + 0x30], r8
mov qword [rdx], r8
cmp eax, ecx
jae 0x140070075
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
jmp 0x1400700ea
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x38]
call fcn.14006fea9
nop
add rsp, 0x68
ret
and ecx, ebp
int3
jrcxz 0x14007010d
xchg r15d, eax
jmp 0x140070075
invalid
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006611a
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x14006fed0
Function at 0x1400757a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401cb828]
mov edx, dword [0x1401cb82c]
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
or eax, edx
and eax, ecx
xor eax, 0xb90b1d88
add eax, 0x37e4d16b
and eax, 0x3cbc1cde
cmp eax, 0xb154bd24
jae 0x14007590d
mov eax, dword [0x1401cb830]
mov ecx, dword [0x1401cb834]
xor ecx, 0xa4b75fa5
xor edx, edx
div ecx
add eax, 0x97630c70
mov ecx, eax
xor ecx, 0x2fac47a8
mov edx, 0x11735aca
xor edx, 0xee8ca535
xor ecx, edx
and ecx, 0x2fac47a8
shl ecx, 1
sub ecx, 0x2fac47a8
sub eax, ecx
mov ecx, 0x4842214e
xor ecx, 0x38728fef
xor edx, edx
div ecx
mov dword [rsp + 0x20], eax
call fcn.14006611a
mov rcx, qword [rsp + 0x28]
mov eax, dword [rsp + 0x20]
cmp rcx, 0
sete cl
mov byte [rsp + 0x27], cl
cmp eax, 0xa6dcdbfa
jae 0x1400757df
mov al, byte [rsp + 0x27]
test al, 1
jne 0x140075868
jmp 0x140075877
mov rcx, qword [rsp + 0x30]
call fcn.140066298
jmp 0x140075886
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call fcn.140075000
mov ecx, dword [0x1401cb838]
mov edx, dword [0x1401cb83c]
mov eax, 0xed06625f
xor eax, 0x51e956dd
xor edx, eax
xor edx, 0xffffffff
mov eax, ecx
xor eax, edx
and eax, ecx
add eax, 0xbbe2fed9
imul eax, eax, 0x47d69017
sub eax, 0xecdadfab
mov ecx, 0xfcb8b0fe
xor ecx, 0xa438aca0
cmp eax, ecx
jbe 0x140075916
mov eax, dword [0x1401cb840]
xor eax, 0x2ef1c8cb
mov edx, dword [0x1401cb844]
mov ecx, edx
and ecx, eax
xor ecx, 0xffffffff
add eax, edx
add eax, 1
add eax, ecx
imul eax, eax, 0xe662fd8a
and eax, 0x1a9c66ea
mov ecx, 0x35a737c
xor edx, edx
div ecx
cmp eax, 0xc71398ad
je 0x1400758ca
add rsp, 0x38
ret
xor al, 0x80
invalid
jl 0x1400758e9
invalid
Function at 0x140076bc0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
call fcn.14006611a
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov qword [rcx], 0
mov qword [rcx + 8], 0
mov ecx, 8
call fcn.140066202
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov al, 1
cmp byte [rcx], 0
mov byte [rsp + 0x57], al
jne 0x140076c68
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
call fcn.140076b98
mov rcx, qword [rsp + 0x40]
mov al, 1
cmp byte [rcx], 0
mov byte [rsp + 0x57], al
jne 0x140076c68
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0x58]
mov qword [rsp + 0x58], rdx
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x58]
call fcn.140018d5d
mov rax, qword [rsp + 0x40]
mov al, byte [rax]
mov byte [rsp + 0x57], al
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov dl, byte [rsp + 0x57]
mov byte [rsp + 0x27], dl
mov byte [rax], 0
call fcn.140065cc0
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140076c9b
mov rax, qword [rsp + 0x40]
mov cl, byte [rsp + 0x27]
mov byte [rax], cl
mov eax, dword [0x1401cb8d8]
xor eax, 0xfb1c8544
mov edx, dword [0x1401cb8dc]
xor ecx, ecx
sub ecx, eax
mov eax, 0xbca669f2
xor eax, 0xbca669f2
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
or eax, 0x40e32d8f
mov ecx, eax
xor ecx, 0xefcd3ff2
xor ecx, 0xffffffff
and ecx, 0xefcd3ff2
shl ecx, 1
sub ecx, 0xefcd3ff2
sub eax, ecx
mov ecx, 0x9e5e0994
xor ecx, 0x20b977a6
sub eax, ecx
cmp eax, 0x1b279057
jbe 0x140076d4f
mov eax, dword [0x1401cb8e0]
xor edx, edx
div dword [0x1401cb8e4]
and eax, 0x1d35c21
mov ecx, 0x793a2189
xor ecx, 0x84042d7d
sub eax, ecx
mov ecx, 0x32d4aeee
xor ecx, 0xb53e6632
add eax, ecx
add eax, 0xfd3e0cf4
and eax, 0xf3119b7a
mov ecx, 0xfa582e92
xor ecx, 0xa285207b
cmp eax, ecx
jb 0x140076cfb
mov rax, qword [rsp + 0x30]
add rsp, 0x68
ret
mov al, 0x4e
invalid
Function at 0x14007a870
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov r8d, dword [0x1401cbab8]
sub r8d, dword [0x1401cbabc]
mov eax, 0x181fe882
xor eax, 0xfa7e9f5b
and r8d, eax
mov edx, 0xffffffff
xor edx, 0x1f37777c
mov ecx, r8d
and ecx, edx
mov eax, r8d
or eax, edx
xor eax, 0xffffffff
imul eax, ecx
mov ecx, r8d
and ecx, 0x1f37777c
mov edx, 0xc1770515
xor edx, 0xde407269
or r8d, edx
imul r8d, ecx
add r8d, eax
mov ecx, 0x616a7e40
xor ecx, 0x9e9581bf
mov eax, r8d
xor eax, ecx
and eax, 0x493b0e68
mov edx, 0xffffffff
xor edx, 0x493b0e68
and r8d, edx
mov ecx, 0xffffffff
xor ecx, 0x3553d5db
mov r9d, 0x8f655684
xor r9d, 0xc65e58ec
and ecx, r9d
and edx, 0x3553d5db
or eax, r8d
or ecx, edx
xor eax, ecx
mov ecx, 0x7f13a5c8
xor ecx, 0xc8490dc4
cmp eax, ecx
jb 0x14007aa18
mov eax, dword [0x1401cbac0]
xor eax, 0x8dfd53c8
xor edx, edx
div dword [0x1401cbac4]
sub eax, 0xdaff567
add eax, 0x477a82b2
mov ecx, 0x3516d926
xor ecx, 0x9b7ee985
sub eax, ecx
sub eax, 0x477a82b2
mov ecx, 0x338aaf6b
xor ecx, 0x6dc82d17
xor eax, ecx
mov dword [rsp + 0x30], eax
call fcn.14006611a
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov edx, 3
call fcn.140066610
mov rcx, qword [rsp + 0x28]
mov eax, dword [rsp + 0x30]
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x37], cl
cmp eax, 0xc1c4aa47
je 0x14007a930
mov al, byte [rsp + 0x37]
test al, 1
jne 0x14007a9b8
jmp 0x14007aa12
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
call fcn.140071950
mov rax, qword [rsp + 0x28]
cmp byte [rax], 0
jne 0x14007aa12
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax + 8]
call fcn.14007a5a0
mov rax, qword [rsp + 0x28]
mov al, byte [rax]
mov cl, 0x89
xor cl, 0x89
cmp al, cl
jne 0x14007aa12
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax + 0x10]
call fcn.14007a813
nop
add rsp, 0x48
ret
hlt
Function at 0x14007abc9
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401cbac8]
mov ecx, dword [0x1401cbacc]
mov edx, 0x9132b695
xor edx, 0xe575c0ed
xor ecx, edx
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
or eax, 0xa02c74ae
xor eax, 0xffffffff
mov edx, 0x595fc325
xor edx, 0xa6a03cda
xor ecx, edx
mov edx, 0x61a3340a
xor edx, 0xc18f40a4
mov r8d, 0x3c99f1fc
xor r8d, 0xc3660e03
xor edx, r8d
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
sub eax, 0x1c45e9b2
mov edx, 0xa83d90e4
xor edx, 0xc21c984
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
mov edx, 0xdb6f8b34
xor edx, 0x7f73d254
and edx, ecx
mov ecx, 0xf5648f21
xor ecx, 0xf5648f23
imul ecx, edx
sub ecx, 0xa41c5960
sub eax, ecx
mov ecx, 0x14e88169
xor ecx, 0xf35c17
cmp eax, ecx
jbe 0x14007abc0
mov eax, dword [0x1401cbad0]
mov ecx, dword [0x1401cbad4]
xor ecx, 0xb1af6fd5
xor edx, edx
div ecx
mov edx, eax
mov eax, edx
and eax, 0x2ba940eb
xor edx, 0xaba940eb
mov ecx, eax
mov eax, edx
lea eax, [rax + rcx*2]
imul eax, eax, 0x792f7063
add eax, 0xed6a836e
mov dword [rbp - 0x18], eax
mov eax, 0xa4b0631b
mov dword [rbp - 0x1c], eax
mov eax, 0x20
call fcn.1401c7680
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.14006611a
mov rdx, qword [rbp - 0x10]
mov ecx, dword [rbp - 0x1c]
add rsp, 0x20
mov eax, dword [rbp - 0x18]
cmp rdx, 0
sete dl
mov byte [rbp - 0x11], dl
cmp eax, ecx
je 0x14007aae7
mov al, byte [rbp - 0x11]
test al, 1
jne 0x14007ab76
jmp 0x14007ab8c
mov rcx, qword [rbp - 8]
sub rsp, 0x20
call fcn.140066298
add rsp, 0x20
jmp 0x14007abbb
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax]
mov qword [rdx], r8
mov r8, qword [rax + 8]
mov qword [rdx + 8], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 0x10], rax
sub rsp, 0x20
call fcn.14007a870
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
or ebp, dword [rcx + 0x1ee9b6a4]
invalid
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006611a
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x14007aa30
Function at 0x14007b6e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401cbb28]
xor eax, 0xeb8e53c
mov r8d, dword [0x1401cbb2c]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
or eax, 0xb3a2127e
mov edx, eax
xor edx, 0xffffffff
and edx, 0x1072fa5d
mov r8d, 0xffffffff
xor r8d, 0x1072fa5d
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x1072fa5d
or eax, 0x1072fa5d
imul eax, edx
add eax, ecx
mov ecx, 0x86e31179
xor ecx, 0x86e31179
mov edx, 0xa1efc965
xor edx, 0xf9cebb3c
sub ecx, edx
add eax, ecx
cmp eax, 0xa1f19e61
jbe 0x14007b7d2
mov eax, dword [0x1401cbb30]
imul eax, dword [0x1401cbb34]
mov ecx, 0x39077e1a
xor ecx, 0xc7ca9458
sub eax, ecx
add eax, 0x18ba6f0b
and eax, 0xf4d1f559
mov dword [rsp + 0x24], eax
call fcn.14006611a
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
call fcn.14007b691
mov eax, dword [rsp + 0x24]
cmp eax, 0x19763c90
jb 0x14007b782
add rsp, 0x38
ret
lahf
adc ebx, dword [rax + 0x10]
jmp 0x14007b782
Function at 0x140082230
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401cbe18]
mov r8d, dword [0x1401cbe1c]
mov ecx, 0xfed05ec5
xor ecx, 0xf4c662a7
xor r8d, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xbbbb6b34
xor ecx, 0xe42cb881
xor edx, edx
div ecx
mov ecx, 0x85743175
xor edx, edx
div ecx
mov r8d, 0x6384e648
xor r8d, 0xaa3a4a0e
mov ecx, 0x75e1d974
xor ecx, 0x8a1e268b
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x5edc3611
xor r8d, 0xa123c9ee
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xc9beac46
or eax, 0xc9beac46
imul eax, edx
add eax, ecx
cmp eax, 0x81d69e32
ja 0x1400823a6
mov ecx, dword [0x1401cbe20]
mov edx, dword [0x1401cbe24]
mov eax, ecx
and eax, edx
or ecx, edx
add eax, ecx
mov ecx, 0xa7fe1a7f
xor ecx, 0x9cfe21a5
xor edx, edx
div ecx
mov ecx, 0x168adab5
xor ecx, 0x168adab5
mov edx, 0x2c132a0c
xor edx, 0xef18e0df
sub ecx, edx
sub eax, ecx
sub eax, 0x35bfc792
add eax, 0x41d5f70e
add eax, 0x35bfc792
mov dword [rsp + 0x28], eax
mov rax, qword [0x1401ddaf0]
mov ecx, dword [rax]
call fcn.140007f33
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140081c60
mov cl, al
mov eax, dword [rsp + 0x28]
mov byte [rsp + 0x2f], cl
cmp eax, 0xa54d5e8f
je 0x1400822e5
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x140082378
jmp 0x1400823a0
mov rcx, qword [rsp + 0x30]
call fcn.140081ec0
mov rax, qword [rsp + 0x20]
cmp byte [rax + 0x60], 0
jne 0x1400823a0
mov rcx, qword [rsp + 0x30]
mov edx, 8
call fcn.14000e6f9
nop
add rsp, 0x38
ret
xchg ecx, eax
invalid
Function at 0x14008d0e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rcx
mov rax, qword [rdx]
mov qword [rsp + 0x70], rax
cmp rax, 0
jle 0x14008d390
mov rcx, qword [rsp + 0x70]
mov rax, rcx
add rax, 1
mov qword [rsp + 0x58], rax
xor rcx, 0xffffffffffffffff
and rax, rcx
cmp rax, 0
jge 0x14008d12c
call fcn.140008024
jmp 0x14008d390
mov eax, dword [0x1401cc298]
mov edx, dword [0x1401cc29c]
xor eax, 0xffffffff
xor edx, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xe66105a1
or eax, edx
or ecx, 0xe66105a1
xor eax, 0xffffffff
and eax, ecx
mov ecx, eax
and ecx, 0x9a945d57
shl ecx, 1
add eax, 0x9a945d57
sub eax, ecx
mov ecx, 0x207143cf
xor edx, edx
div ecx
or eax, 0x4fb8fa8a
cmp eax, 0x64f57daf
jae 0x14008d395
mov rdx, qword [rsp + 0x58]
mov eax, dword [0x1401cc2a0]
mov r8d, dword [0x1401cc2a4]
xor r8d, 0x1817372b
xor ecx, ecx
sub ecx, r8d
add eax, ecx
xor ecx, ecx
sub ecx, 0x58c9e121
add eax, ecx
and eax, 0x1cf426d0
xor eax, 0xf95c00b1
mov ecx, 0x49d9d86f
xor ecx, 0x9fc90d6c
cmp rdx, 0
setl dl
mov byte [rsp + 0x57], dl
cmp eax, ecx
jb 0x14008d181
mov al, byte [rsp + 0x57]
test al, 1
jne 0x14008d1e4
jmp 0x14008d201
mov rcx, qword [rsp + 0x58]
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
call fcn.14000c8ac
jmp 0x14008d390
mov rax, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rdx + 8]
add rcx, 8
add rcx, qword [rdx]
mov qword [rsp + 0x38], rcx
mov rax, qword [rax + 8]
add rax, 8
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
cmp rax, rcx
je 0x14008d26a
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov dl, byte [rdx + rax]
mov byte [rcx + rax], dl
add rax, 1
mov qword [rsp + 0x48], rax
jmp 0x14008d22f
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx]
mov r8, qword [rax]
mov rcx, r8
add rcx, rdx
mov qword [rsp + 0x28], rcx
mov rax, rcx
xor rax, rdx
mov rdx, rcx
xor rdx, 0xffffffffffffffff
movabs r10, 0x7b68dfc06cc23cb8
movabs r9, 0x8497203f933dc347
xor r10, r9
mov r9, rcx
xor r9, r10
and rdx, r9
mov r9, r8
xor r9, 0xffffffffffffffff
mov r10, r8
xor r10, 0xffffffffffffffff
and r9, r10
xor rdx, 0xffffffffffffffff
xor r9, 0xffffffffffffffff
and rdx, r9
movabs r9, 0xa03722518a24e0bf
movabs r10, 0x5fc8ddae75db1f40
xor r9, r10
xor rcx, r9
xor r8, 0xffffffffffffffff
and rcx, r8
xor rdx, 0xffffffffffffffff
movabs r8, 0xc646907684cc9c46
movabs r9, 0x39b96f897b3363b9
xor r8, r9
xor rcx, r8
and rdx, rcx
xor rax, 0xffffffffffffffff
movabs rcx, 0xa290d23afa4e3345
movabs r8, 0x5d6f2dc505b1ccba
xor rcx, r8
xor rdx, rcx
mov rcx, 0xffffffffffffffff
movabs r8, 0x654ed69de13322f6
xor rcx, r8
or rax, rdx
movabs rdx, 0x654ed69de13322f6
or rcx, rdx
xor rax, 0xffffffffffffffff
and rax, rcx
movabs rcx, 0x30ee3fe0b05a055
movabs rdx, 0x30ee3fe0b05a055
xor rcx, rdx
cmp rax, rcx
jge 0x14008d383
call fcn.140008024
jmp 0x14008d390
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
add rsp, 0x78
ret
movabs al, byte [0xfffffde3e95bd341]
nop