joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021d20
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r8, rdx
mov rsi, rcx
mov eax, 0xa7eafef5
nop word cs:[rax + rax]
mov ecx, dword [0x140210148]
mov edx, dword [0x14021014c]
mov r9d, edx
not r9d
mov r10d, ecx
and r10d, r9d
or r9d, ecx
not r9d
imul r9d, r10d
mov r10d, ecx
and r10d, edx
or ecx, edx
imul ecx, r10d
add ecx, r9d
mov edx, ecx
and edx, 0x8c1ef1c
add edx, edx
sub ecx, edx
add ecx, 0x8c1ef1c
or ecx, 0x7bfb75f
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x77d51d2a
je 0x140021d40
movzx ecx, byte [rsi]
movzx r9d, byte [r8]
mov eax, dword [0x140210150]
xor edx, edx
div dword [0x140210154]
nop
mov eax, dword [0x140210158]
mov edx, dword [0x14021015c]
add eax, edx
add eax, 0xcb005a41
mov edx, eax
and edx, 0xc15904fa
mov r10d, edx
not r10d
and r10d, 0xb0e0a6ee
mov r11d, eax
and r11d, 0x41190010
imul r11d, r10d
and eax, 0x804004ea
or edx, 0xb0e0a6ee
imul edx, eax
add edx, r11d
cmp edx, 0x695bf663
jb 0x140021db0
nop

Function at 0x140022c40
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r8d, edx
mov eax, edx
not eax
and eax, 0x34a972e5
and edx, 0xcb568d1a
imul edx, eax
mov eax, r8d
and eax, 0x34a972e5
or r8d, 0x34a972e5
imul r8d, eax
add r8d, edx
nop dword [rax + rax]
mov eax, dword [0x1402102c0]
xor eax, dword [0x1402102c4]
imul rdx, rax, 0x349f0d57
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
or eax, 0xdf9f77f6
cmp eax, 0x1b93c7d3
je 0x140022c70
mov eax, dword [str._oWl]
xor edx, edx
div dword [0x1402102cc]
mov eax, r8d
shr eax, 1
xor eax, r8d
mov edx, eax
not edx
mov r8d, eax
and r8d, 0xffffe01e
and edx, 0x1fe1
imul edx, r8d
mov r8d, eax
and r8d, 0x1fe1
or eax, 0x1fe1
imul eax, r8d
add eax, edx
mov edx, eax
and edx, 0x9db9
xor eax, 0x9db9
lea eax, [rax + rdx*2]
nop
mov edx, dword [0x1402102d0]
or edx, dword [0x1402102d4]
mov r8d, edx
and r8d, 0x4859df1a
add r8d, r8d
neg r8d
add edx, r8d
add edx, 0xe7e992e5
cmp edx, 0xd0326fd2
ja 0x140022cf0
movzx eax, ax
add rcx, rax
mov rax, rcx
ret
Function at 0x140022d30
Capabilities:
Encode data using xor

Disassembly:
mov r8d, edx
mov eax, dword [0x1402102d8]
xor edx, edx
div dword [0x1402102dc]
mov eax, r8d
not eax
or r8d, 0x79452a6e
or eax, 0x86bad591
and eax, r8d
mov edx, eax
not edx
mov r8d, edx
and r8d, 0x494f909d
and eax, 0xb6b06f62
imul eax, r8d
mov r8d, edx
and r8d, 0xb6b06f62
or edx, 0xb6b06f62
imul edx, r8d
lea r8d, [rdx + rax]
add eax, edx
add eax, 0xa94265bc
shr eax, 0x1f
add eax, r8d
add eax, 0xa94265bc
mov edx, eax
rol edx, 5
mov r8d, edx
xor r8d, eax
not r8d
and r8d, eax
add r8d, r8d
sub eax, r8d
add eax, edx
nop
mov edx, dword [0x1402102e0]
mov r8d, dword [0x1402102e4]
mov r9d, r8d
not r9d
and r9d, edx
xor r8d, edx
add r8d, edx
sub r8d, r9d
mov edx, r8d
and edx, 0x602ad703
mov r9d, edx
not r9d
and r9d, 0x1acfca3c
mov r10d, r8d
and r10d, 0x60201503
imul r10d, r9d
and r8d, 0xac200
or edx, 0x1acfca3c
imul edx, r8d
add edx, r10d
imul edx, edx, 0x1cb4a42d
cmp edx, 0xd2145261
ja 0x140022db0
movzx eax, ax
mov eax, eax
add rcx, rax
nop dword [rax]
mov eax, dword [0x1402102e8]
add eax, dword [0x1402102ec]
imul eax, eax, 0x13711cd5
mov edx, eax
and edx, 0x5c0e6c32
and eax, 0x50040812
add eax, eax
sub edx, eax
add edx, 0xf3648bda
cmp edx, 0xa69a2ae5
jb 0x140022e20
mov rax, rcx
ret

Function at 0x140022e60
Capabilities:
Encode data using xor

Disassembly:
mov r8d, edx
rol r8d, 5
xor r8d, edx
mov r9d, 0xa3113abb
mov eax, r8d
xor eax, 0xcb0586f0
not r8d
and r8d, 0x4b0586f0
add r8d, r8d
sub r8d, eax
mov eax, r8d
shr eax, 0xa
mov edx, eax
xor edx, r8d
not edx
and edx, r8d
add edx, edx
sub r8d, edx
add r8d, eax
mov eax, r8d
not eax
and eax, 0x7c06
mov edx, r8d
and edx, 0xffff83f9
imul edx, eax
mov eax, r8d
and eax, 0x7c06
or r8d, 0x7c06
imul r8d, eax
add r8d, edx
nop dword [rax]
mov eax, dword [0x1402102f0]
xor edx, edx
div dword [0x1402102f4]
mov edx, eax
xor edx, 0xb3e32f69
and edx, eax
imul rdx, r9
shr rdx, 0x3e
cmp edx, 0x71b22cc4
je 0x140022ed0
and r8d, 0xfffe
add rcx, r8
mov rax, rcx
ret

Function at 0x140023130
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, edx
rol ecx, 2
nop dword [rax + rax]
mov r8d, dword [0x140210318]
or r8d, dword [0x14021031c]
mov r9d, r8d
and r9d, 0xae066734
mov r10d, r9d
not r10d
and r8d, 0x2a040400
and r10d, 0x947b7bf5
or r10d, r8d
xor r10d, 0x6a34ad07
or r9d, 0x6a04a506
and r9d, r10d
cmp r9d, 0x4c04a8c
je 0x140023140
xor ecx, edx
imul ecx, ecx, 0xed20
nop word cs:[rax + rax]
mov edx, dword [0x140210320]
or edx, dword [0x140210324]
or edx, 0x36d8f965
add edx, 0x908c4994
mov r8d, edx
and r8d, 0x17e746e0
add r8d, r8d
sub edx, r8d
add edx, 0x37f7c6e4
cmp edx, 0x44a66efe
jb 0x1400231a0
mov edx, ecx
and edx, 0x8799
add edx, edx
neg edx
add ecx, edx
add ecx, 0x8799
mov edx, ecx
and edx, 0x7b55
xor ecx, 0xfb55
lea ecx, [rcx + rdx*2]
and ecx, 0xffee
add rax, rcx
ret
Function at 0x140023210
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x3b897bc6
sub eax, edx
mov edx, eax
not edx
mov r8d, eax
and r8d, 0xa9d136a9
and edx, 0x562ec956
imul edx, r8d
mov r8d, eax
and r8d, 0x562ec956
or eax, 0x562ec956
imul eax, r8d
add eax, edx
mov r8d, eax
shr r8d, 5
xor r8d, eax
nop
mov eax, dword [0x140210328]
xor edx, edx
div dword [0x14021032c]
add eax, 0xdcfdcc7a
cmp eax, 0x27615056
jb 0x140023250
movzx eax, r8w
nop
mov edx, dword [0x140210330]
mov r8d, dword [0x140210334]
mov r9d, edx
xor r9d, r8d
not r9d
or edx, r8d
and edx, r9d
or edx, 0x4557ef3
add edx, 0xe1e78a26
imul rdx, rdx, 0x34638aa7
shr rdx, 0x3b
cmp edx, 0xa47e8cb2
ja 0x140023270
add rcx, rax
mov rax, rcx
ret

Function at 0x1400232c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xb9050a8e
sub eax, edx
mov edx, eax
rol edx, 2
mov r8d, eax
xor r8d, eax
not r8d
and r8d, edx
xor r8d, eax
mov eax, 0xc368
sub eax, r8d
mov r8d, eax
xor r8d, 0xffff0000
and r8d, eax
mov eax, dword [0x140210338]
xor edx, edx
div dword [0x14021033c]
mov eax, 0x80b0dd6f
add r8, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x140210340]
and ecx, dword [0x140210344]
imul rcx, rax
shr rcx, 0x3d
and ecx, 3
xor ecx, 0x50404f1
cmp ecx, 0xbeecb0c5
ja 0x140023310
nop word cs:[rax + rax]
mov eax, dword [0x140210348]
mov ecx, dword [0x14021034c]
mov edx, eax
not edx
and edx, ecx
mov r9d, ecx
not r9d
and r9d, eax
imul r9d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r9d
xor eax, 0x509fa836
add eax, 0x9b69b37b
imul rax, rax, 0x698eb487
shr rax, 0x3e
cmp eax, 0x965f4d8b
ja 0x140023340
mov rax, r8
ret

Function at 0x140023530
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, edx
rol ecx, 5
xor ecx, edx
mov edx, ecx
rol edx, 6
not edx
mov r8d, edx
and r8d, ecx
not r8d
or edx, ecx
and edx, r8d
not edx
mov ecx, edx
rol ecx, 1
xor ecx, edx
imul ecx, ecx, 0x8c4b
not ecx
movzx ecx, cx
mov ecx, ecx
add rax, rcx
nop word [rax + rax]
mov ecx, dword [0x140210370]
xor ecx, dword [0x140210374]
not ecx
or ecx, 0x968ff7c4
mov edx, ecx
not edx
mov r8d, edx
and r8d, 0x61500819
and ecx, 0x18aa8666
imul ecx, r8d
mov r8d, edx
and r8d, 0x8200022
or edx, 0x18aa8666
imul edx, r8d
add edx, ecx
or edx, 0x5c67c527
cmp edx, 0xe6d5ccf8
je 0x140023570
ret
Function at 0x1400235d0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, edx
rol r8d, 6
xor r8d, edx
mov eax, dword [0x140210378]
xor edx, edx
div dword [0x14021037c]
mov eax, r8d
rol eax, 3
nop
mov edx, dword [0x140210384]
mov r9d, edx
xor r9d, edx
not r9d
and r9d, dword [0x140210380]
xor r9d, edx
mov edx, r9d
or edx, 0x3cc26d01
mov r10d, r9d
not r10d
and r10d, 0x403180e2
mov r11d, edx
and r11d, 0x9f4e331d
imul r11d, r10d
and edx, 0x60b1cce2
or r9d, 0x7cf3ede3
imul r9d, edx
add r9d, r11d
and r9d, 0x8c2c1bf8
cmp r9d, 0xf60d46b9
ja 0x1400235f0
xor eax, r8d
mov edx, eax
shr edx, 0x1d
xor edx, eax
mov eax, edx
not eax
mov r8d, eax
rol r8d, 5
and edx, 0x3471594
and eax, 0xfcb8ea6b
or eax, edx
xor eax, r8d
mov edx, eax
xor edx, 0x3470000
xor eax, 0xfcb81594
or edx, 0xffff
and edx, eax
add rcx, rdx
nop
mov eax, dword [0x140210388]
add eax, dword [0x14021038c]
imul eax, eax, 0xa2d06454
add eax, 0x8091f02e
cmp eax, 0x251bebbb
jb 0x140023690
mov rax, rcx
ret

Function at 0x140023770
Capabilities:
Encode data using xor

Disassembly:
imul r8d, edx, 0x670e7d1d
add r8d, 0xed08ff90
mov edx, r8d
rol edx, 7
mov rax, rcx
xor edx, r8d
mov ecx, edx
shr ecx, 0x16
nop
mov r8d, dword [0x1402103a8]
sub r8d, dword [0x1402103ac]
imul r8d, r8d, 0xd5bf51be
imul r9, r8, 0x815fa95
shr r9, 0x20
sub r8d, r9d
shr r8d, 1
add r8d, r9d
mov r9d, r8d
shr r9d, 0x1e
xor r9d, 0x42c8efb1
shr r8d, 0x1f
shl r8d, 2
sub r8d, r9d
cmp r8d, 0xfd5b688e
je 0x140023790
movzx edx, dx
xor ecx, edx
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x1402103b0]
mov edx, dword [0x1402103b4]
mov r8d, ecx
xor r8d, edx
not r8d
and r8d, edx
add r8d, r8d
sub edx, r8d
add ecx, edx
add ecx, 0xb65160d4
shr ecx, 1
imul rcx, rcx, 0x23a3983b
shr rcx, 0x3c
or ecx, 0x9682530c
cmp ecx, 0x954ea996
jb 0x1400237f0
ret

Function at 0x140023840
Capabilities:
Encode data using xor

Disassembly:
mov r8d, edx
mov eax, dword [0x1402103b8]
xor edx, edx
div dword [0x1402103bc]
mov r9d, r8d
shr r9d, 3
xor r9d, r8d
mov r8d, r9d
rol r8d, 4
nop word cs:[rax + rax]
mov eax, dword [0x1402103c0]
xor edx, edx
div dword [0x1402103c4]
mov edx, eax
xor edx, 0xf06a078d
and eax, 0xf95f872
add eax, eax
sub eax, edx
imul eax, eax, 0x785a5405
add eax, 0x9a18971d
cmp eax, 0xf5ddade2
ja 0x140023870
xor r8d, r9d
mov eax, r8d
shr eax, 0x1e
mov edx, r8d
xor edx, r8d
not edx
and edx, eax
xor edx, r8d
mov eax, 0xcc5b
sub eax, edx
movzx r8d, ax
mov eax, dword [0x1402103c8]
xor edx, edx
div dword [0x1402103cc]
add rcx, r8
nop word cs:[rax + rax]
mov eax, dword [0x1402103d0]
imul eax, dword [0x1402103d4]
imul eax, eax, 0x5dd4282d
mov edx, eax
xor edx, 0xab3ef895
and edx, eax
mov eax, edx
not eax
and eax, 0xff2a6116
and edx, 0xd59ee9
sub edx, eax
cmp edx, 0x9a975db5
je 0x1400238e0
mov rax, rcx
ret
Function at 0x140023990
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
imul ecx, edx, 0xcc04
add ecx, 0xe417
nop
mov edx, dword [0x1402103d8]
xor edx, dword [0x1402103dc]
mov r8d, edx
xor r8d, 0xfa064d14
add r8d, edx
and edx, 0x5f9b2eb
sub r8d, edx
mov edx, r8d
xor edx, 0x9c5274c5
xor r8d, 0x2058102
and r8d, 0x657d5c6
mov r9d, edx
and r9d, 0xf9a82a39
imul r9d, r8d
mov r8d, edx
and r8d, 0x657d5c6
or edx, 0x657d5c6
imul edx, r8d
add edx, r9d
cmp edx, 0x778d116b
jb 0x1400239a0
movzx ecx, cx
add rax, rcx
ret

Function at 0x140023a10
Capabilities:
Encode data using xor

Disassembly:
neg edx
mov eax, edx
shr eax, 0x19
nop word [rax + rax]
mov r8d, dword [0x1402103e0]
sub r8d, dword [0x1402103e4]
mov r9d, r8d
and r9d, 0x5bfaaee9
add r9d, r9d
sub r8d, r9d
imul r8d, r8d, 0x646b37
add r8d, 0x5cfaf70f
imul r8, r8, 0x418a7d21
shr r8, 0x3c
cmp r8d, 0x1cf7d1ca
ja 0x140023a20
mov r8d, eax
xor r8d, edx
not r8d
and r8d, edx
add r8d, r8d
sub edx, r8d
add eax, edx
add eax, 0xced8
movzx eax, ax
nop dword [rax]
mov edx, dword [0x1402103e8]
mov r8d, dword [0x1402103ec]
mov r9d, edx
not r9d
and r9d, r8d
not r8d
and r8d, edx
sub r8d, r9d
xor r8d, 0xe766e2e1
imul edx, r8d, 0x4a9b2c81
add edx, 0xd5490c4c
cmp edx, 0xead21d30
ja 0x140023a80
mov eax, eax
add rcx, rax
mov eax, dword [0x1402103f0]
xor edx, edx
div dword [0x1402103f4]
add eax, 0xec0dc08b
mov edx, eax
not edx
and edx, 0x44d72cb0
mov r8d, eax
and r8d, 0xbb28d34f
imul r8d, edx
mov edx, eax
and edx, 0x44d72cb0
or eax, 0x44d72cb0
imul eax, edx
add eax, r8d
mov edx, eax
and edx, 0x5d43e2b0
xor eax, 0x5d43e2bc
lea eax, [rax + rdx*2]
cmp eax, 0xc330ff0b
ja 0x140023ac0
mov rax, rcx
ret

Function at 0x140023b20
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
imul ecx, edx, 0x5238d1c3
nop dword [rax]
mov edx, dword [0x1402103f8]
mov r8d, dword [0x1402103fc]
mov r9d, r8d
not r9d
mov r10d, edx
and r10d, r9d
or r9d, edx
not r9d
imul r9d, r10d
mov r10d, edx
and r10d, r8d
or edx, r8d
imul edx, r10d
add edx, r9d
imul edx, edx, 0x4c81072b
add edx, 0x65003bce
or edx, 0xbf8f59d2
cmp edx, 0xcce3ad6b
ja 0x140023b30
lea edx, [rcx + 0xc751d31]
shr edx, 0x18
mov r8d, 0xf38ae2ce
sub r8d, ecx
mov r9d, edx
or r9d, r8d
and r8d, edx
not r9d
or r9d, r8d
mov ecx, r9d
not ecx
mov edx, r9d
and edx, 0xffff7a9c
and ecx, 0x8563
imul ecx, edx
mov edx, r9d
and edx, 0x8563
or r9d, 0x8563
imul r9d, edx
add r9d, ecx
mov ecx, r9d
xor ecx, 0xffff0000
and ecx, r9d
nop dword [rax + rax]
mov edx, dword [str..j_s]
imul edx, dword [0x140210404]
imul edx, edx, 0xccaf4482
imul r8, rdx, 0x6a867bd1
shr r8, 0x20
sub edx, r8d
shr edx, 1
add edx, r8d
shr edx, 0x1c
mov r8d, edx
xor r8d, 8
and r8d, edx
cmp r8d, 0xeb0bff8d
ja 0x140023be0
mov ecx, ecx
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x140210408]
mov edx, dword [0x14021040c]
not ecx
mov r8d, ecx
and r8d, edx
not r8d
or ecx, edx
and ecx, r8d
not ecx
imul ecx, ecx, 0xa9cdf926
add ecx, 0xc9eb84e
or ecx, 0x9c08ab0b
cmp ecx, 0x9226b849
jb 0x140023c30
ret
Function at 0x140023d30
Capabilities:
Encode data using xor

Disassembly:
mov r8d, edx
rol r8d, 1
nop word cs:[rax + rax]
mov eax, dword [0x140210428]
mov r9d, dword [0x14021042c]
not eax
not r9d
or r9d, eax
not r9d
add r9d, 0xde8a12d9
mov eax, r9d
xor eax, 0xbdf5e114
and eax, r9d
cmp eax, 0xa3ddc6c3
je 0x140023d40
mov eax, r8d
and eax, edx
add eax, eax
add r8d, edx
sub r8d, eax
mov eax, r8d
not eax
or eax, 0x5801db6f
or r8d, 0xa7fe2490
and r8d, eax
mov eax, r8d
not eax
and eax, 0x625bb3e7
mov edx, r8d
and edx, 0x9da44c18
imul edx, eax
mov eax, r8d
and eax, 0x625bb3e7
or r8d, 0x625bb3e7
imul r8d, eax
add r8d, edx
nop
mov eax, dword [0x140210430]
xor edx, edx
div dword [0x140210434]
xor eax, 0x290404d8
mov edx, eax
and edx, 0xc1905b26
or eax, 0xc1905b26
add eax, edx
mov edx, eax
and edx, 0x125772fa
add edx, edx
sub eax, edx
cmp eax, 0x23c16bd4
je 0x140023dc0
add r8d, 0x2d8cb418
mov eax, r8d
rol eax, 3
mov edx, eax
not edx
and eax, r8d
not r8d
and r8d, edx
not eax
not r8d
and r8d, eax
movzx eax, r8w
add rcx, rax
nop
mov eax, dword [0x140210438]
sub eax, dword [0x14021043c]
imul rdx, rax, 0x26c652f
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1e
cmp eax, 0xd2fc631a
je 0x140023e20
mov rax, rcx
ret

Function at 0x140023fb0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
add edx, 0x74e2c2e
mov ecx, edx
shr ecx, 0x1d
xor r8d, r8d
nop word cs:[rax + rax]
test r8b, r8b
jne 0x140023fd0
not ecx
and ecx, 0xcd6a7667
xor edx, ecx
mov ecx, edx
xor ecx, 0xcd6a7667
xor edx, 0x188
and edx, 0x5cb
mov r8d, ecx
and r8d, 0xfffffa34
imul r8d, edx
mov edx, ecx
and edx, 0x5cb
or ecx, 0x5cb
imul ecx, edx
add ecx, r8d
add ecx, 0x5495
xor edx, edx
nop dword [rax]
test dl, dl
jne 0x140024020
mov edx, ecx
not edx
or edx, 0xffff
add ecx, edx
inc ecx
xor ecx, 0x1aca
add rax, rcx
nop dword [rax + rax]
mov ecx, dword [str.lL4O_]
sub ecx, dword [0x140210454]
xor ecx, 0x3600e12
or ecx, 0xec14e1ec
xor ecx, 0x851143a3
cmp ecx, 0x267da2a1
jb 0x140024040
ret

Function at 0x140024070
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x13ae
sub eax, edx
xor eax, 0xc60b
imul r8d, eax, 0x4bb0
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x140024090
add r8d, 0xd4f2
mov eax, r8d
xor eax, 0xffff000d
or r8d, 0xfff2
and r8d, eax
nop dword [rax]
mov eax, dword [0x140210458]
xor edx, edx
div dword [0x14021045c]
xor eax, 0x618bebc1
imul rax, rax, 0x1dc053c3
shr rax, 0x3c
or eax, 0xcdab1786
cmp eax, 0x3c49e6a9
jb 0x1400240b0
add rcx, r8
mov rax, rcx
ret

Function at 0x1400240f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xff674f3
sub eax, edx
mov edx, eax
rol edx, 4
xor edx, eax
not edx
or edx, 0xffff0000
xor edx, 0xffff6647
mov r8d, edx
nop
mov eax, dword [0x140210460]
xor edx, edx
div dword [0x140210464]
xor eax, 0x6341bec0
imul eax, eax, 0x180eabfe
add eax, 0x50f5e8ac
cmp eax, 0xf762ed7c
ja 0x140024110
add rcx, r8
nop dword [rax + rax]
mov eax, dword [0x140210468]
mov edx, dword [0x14021046c]
mov r8d, eax
not r8d
and r8d, edx
mov r9d, edx
not r9d
and r9d, eax
imul r9d, r8d
mov r8d, eax
and r8d, edx
or eax, edx
imul eax, r8d
add eax, r9d
or eax, 0xff5bfbb9
xor eax, 0xa0939175
cmp eax, 0xd2155eb3
ja 0x140024140
mov rax, rcx
ret
Function at 0x1400242b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov r8d, edx
shr r8d, 0x11
xor r8d, edx
mov ecx, r8d
shr ecx, 1
mov edx, ecx
and edx, r8d
add edx, edx
add ecx, r8d
sub ecx, edx
nop
mov edx, dword [0x140210480]
or edx, dword [0x140210484]
mov r8d, edx
and r8d, 0x2bf4294d
xor edx, 0xabf4294d
lea edx, [rdx + r8*2]
mov r8d, edx
xor r8d, 0x290fc4de
xor edx, 0xd6902821
and edx, 0xde93e83f
mov r9d, r8d
and r9d, 0x216c17c0
imul r9d, edx
mov edx, r8d
and edx, 0xde93e83f
or r8d, 0xde93e83f
imul r8d, edx
add r8d, r9d
cmp r8d, 0xedc473b5
ja 0x1400242d0
mov edx, ecx
rol edx, 7
mov r8d, edx
not r8d
or edx, ecx
not ecx
or ecx, r8d
and ecx, edx
mov edx, ecx
not edx
and edx, 0xa3ea
mov r8d, ecx
and r8d, 0x5c15
imul r8d, edx
mov edx, ecx
and edx, 0xa3ea
or ecx, 0xa3ea
imul ecx, edx
add ecx, r8d
add ecx, 0x2d8e
movzx ecx, cx
xor edx, edx
nop
test dl, dl
jne 0x140024380
add rax, rcx
ret

Function at 0x140024640
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, edx
rol ecx, 3
nop dword [rax + rax]
mov r8d, dword [str.a__a]
mov r9d, dword [0x1402104bc]
mov r10d, r9d
not r10d
mov r11d, r8d
and r11d, r10d
or r10d, r8d
not r10d
imul r10d, r11d
mov r11d, r8d
and r11d, r9d
or r8d, r9d
imul r8d, r11d
add r8d, r10d
mov r9d, r8d
not r9d
and r9d, 0x5559dcb
and r8d, 0xfaaa6234
sub r8d, r9d
imul r8d, r8d, 0xfd4607ed
imul r8, r8, 0x3975d5f
shr r8, 0x36
cmp r8d, 0x9dd9bbe0
ja 0x140024650
mov r8d, edx
xor r8d, r8d
not r8d
and r8d, ecx
xor r8d, edx
mov ecx, r8d
not ecx
mov edx, r8d
and edx, 0xffff0d23
and ecx, 0xf2dc
imul ecx, edx
mov edx, r8d
and edx, 0xf2dc
or r8d, 0xf2dc
imul r8d, edx
add r8d, ecx
add r8d, 0xc888
xor ecx, ecx
nop dword [rax]
test cl, cl
jne 0x140024700
and r8d, 0xfffc
add rax, r8
nop
mov ecx, dword [0x1402104c0]
mov edx, dword [0x1402104c4]
mov r8d, edx
not r8d
and r8d, ecx
xor edx, ecx
add edx, ecx
sub edx, r8d
mov ecx, edx
xor ecx, 0x3e452b18
and edx, 0x41bad4e7
add edx, edx
sub edx, ecx
mov ecx, edx
xor ecx, 0x1295c969
add ecx, edx
and edx, 0xd6a3696
sub ecx, edx
not ecx
or ecx, 0xed7e04c3
add ecx, 0xb1788ea
jb 0x140024710
ret
Function at 0x140052010
Capabilities:
Encode data using xor

Disassembly:
mov r8, rcx
mov eax, dword [0x140213650]
mov ecx, dword [0x140213654]
xor ecx, eax
not ecx
and ecx, eax
xor ecx, 0x6dd49e60
add ecx, 0x86bc3b2b
mov eax, ecx
not eax
mov edx, ecx
and edx, 0x10e50a32
and eax, 0xef1af5cd
imul eax, edx
mov edx, ecx
and edx, 0xef1af5cd
or ecx, 0xef1af5cd
imul ecx, edx
add ecx, eax
cmp ecx, 0x4b58c207
jb 0x1400520a0
mov r10d, dword [0x14021365c]
mov r11d, r10d
xor r11d, r11d
not r11d
and r11d, dword [0x140213658]
mov ecx, 0
mov eax, 7
mov r9, rbx
cpuid
xchg rbx, r9
xor r11d, r10d
imul r10, r11, 0x568d2899
shr r10, 0x3e
cmp r10d, 0x7a6f66a2
jne 0x1400520b1
mov eax, 7
xor ecx, ecx
mov r9, rbx
cpuid
xchg rbx, r9
jmp 0x140052060
mov r10d, dword [0x140213660]
and r10d, dword [0x140213664]
mov r11d, 0x8eca23f1
imul r11, r10
shr r11, 0x3d
mov r10d, r11d
and r10d, 1
xor r11d, 0x7de4ff39
lea r10d, [r11 + r10*2]
or r10d, 0xab1959bc
cmp r10d, 0x9a6657e2
jne 0x140052100
mov dword [r8], eax
nop word cs:[rax + rax]
mov r10d, dword [0x140213668]
xor r10d, dword [0x14021366c]
mov r11d, r10d
and r11d, 0x3010e2d4
or r10d, 0x3010e2d4
add r10d, r11d
or r10d, 0xb989dcce
mov r11d, r10d
not r11d
and r11d, 0xa70bf414
and r10d, 0x58f40beb
sub r10d, r11d
mov dword [r8], eax
cmp r10d, 0x486cc8c2
je 0x140052100
mov dword [r8 + 4], r9d
mov dword [r8 + 8], ecx
mov dword [r8 + 0xc], edx
ret
Function at 0x140083a90
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov byte [rbp - 0x18], r8b
mov qword [rbp - 8], rcx
mov eax, dword [0x140218038]
xor edx, edx
div dword [0x14021803c]
add eax, 0x47cfddd2
xor eax, 0x8259595
cmp eax, 0x39e83a2f
jb 0x140083b32
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov rdx, rsp
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov rcx, rsp
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov r12, rsp
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov rdi, rsp
mov eax, 0x60
call fcn.1401516e0
sub rsp, rax
mov rbx, rsp
mov eax, 0x400
call fcn.1401516e0
sub rsp, rax
mov r8, rsp
xor eax, eax
test al, al
je 0x140083b85
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov eax, 0x60
call fcn.1401516e0
sub rsp, rax
mov eax, 0x400
call fcn.1401516e0
sub rsp, rax
jmp 0x140083acc
mov qword [rbp - 0x28], r8
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x20], rcx
mov qword [rbp], r9
nop word cs:[rax + rax]
mov eax, dword [0x140218040]
mov ecx, dword [0x140218044]
not eax
not ecx
and ecx, eax
cmp ecx, 0xaff6f5ec
je 0x140083ba0

Function at 0x1400852d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov byte [rbp - 8], r8b
mov qword [rbp], rcx
movabs r10, 0x1ffffffffffffe
movabs r8, 0x10000000000000
mov eax, dword [0x140218298]
xor edx, edx
div dword [0x14021829c]
mov ecx, eax
not ecx
and ecx, 0x34f1a949
and eax, 0xb0e56b6
sub eax, ecx
or eax, 0xcf3fee66
mov ecx, eax
xor ecx, 0x84ef850f
add ecx, eax
and eax, 0x7b107af0
sub ecx, eax
cmp ecx, 0xc3ab6004
jae 0x14008538c
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
mov eax, 0x60
call fcn.1401516e0
sub rsp, rax
mov eax, 0x20
call fcn.1401516e0
sub rsp, rax
movq rcx, xmm1
mov rdx, rcx
shr rdx, 0x34
lea rax, [rcx + rcx]
not rax
not r10
or r10, rax
lea r9, [r8 - 1]
and r9, rcx
mov rax, r8
not rax
and rax, r9
mov r11, r9
xor r11, r8
mov rdi, r9
add r11, r9
sub r11, rax
not r10
nop word [rax + rax]

Function at 0x1400863d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov eax, dword [0x1402183f0]
imul eax, dword [0x1402183f4]
mov qword [rbp - 0x10], rcx
add eax, 0xb1ee8e53
xor eax, 0xf17c59c0
cmp eax, 0xbe736b39
ja 0x1400864a4