joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140060c30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov ecx, dword [0x1401f4120]
mov eax, 0x2c57cf94
xor eax, 0x957e6a58
xor ecx, eax
mov edx, dword [0x1401f4124]
mov eax, edx
and eax, ecx
xor eax, 0xffffffff
add ecx, edx
mov edx, 0xb139f878
xor edx, 0xb139f879
add ecx, edx
add ecx, eax
mov eax, ecx
and eax, 0xaee5f09d
mov edx, 0x37924c9a
xor edx, 0x9977bc07
xor ecx, edx
or eax, ecx
mov ecx, 0x925a7d81
xor edx, edx
div ecx
mov ecx, 0xda29fe83
xor ecx, 0xc0be0315
xor edx, edx
div ecx
cmp eax, 0xbcf5be84
jae 0x140060d70
mov eax, dword [0x1401f4128]
mov ecx, dword [0x1401f412c]
mov edx, 0xe650a04e
xor edx, 0xb9847799
xor ecx, edx
or eax, ecx
add eax, 0xff5cd59e
xor ecx, ecx
sub ecx, 0x94e31849
add eax, ecx
mov ecx, 0x93390c96
xor ecx, 0x55ea7bba
add eax, ecx
mov dword [rsp + 0x30], eax
mov eax, 0xf94bccd2
xor eax, 0x510f4bec
mov dword [rsp + 0x2c], eax
call fcn.140051260
mov rcx, rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax]
call fcn.140050d20
mov ecx, dword [rsp + 0x2c]
mov dl, al
mov eax, dword [rsp + 0x30]
mov byte [rsp + 0x37], dl
cmp eax, ecx
jae 0x140060ca7
mov al, byte [rsp + 0x37]
test al, 1
jne 0x140060d31
jmp 0x140060d5e
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call fcn.14005359f
mov rax, qword [rsp + 0x20]
cmp byte [rax], 0
jne 0x140060d6b
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
mov edx, 8
call fcn.140011370
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov qword [rax], rcx
add rsp, 0x48
ret
int 0x4d
mov esp, 0xff2ee98c
invalid
Function at 0x1400627c5
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
call fcn.140051260
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x140061d70
Function at 0x140064d50
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov rdx, rcx
mov qword [rbp - 0x30], rdx
mov eax, 0x10
call fcn.1401f0aa0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
mov rcx, qword [rdx]
add rdx, 8
mov qword [rbp - 0x20], rdx
add rax, 8
mov qword [rbp - 0x18], rax
xor eax, eax
test rcx, rcx
cmovg rax, rcx
mov qword [rbp - 0x10], rax
xor eax, eax
mov qword [rbp - 8], rax
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov qword [rbp - 0x38], rax
cmp rax, rcx
je 0x140064ed4
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x30]
mov rcx, qword [rcx]
mov qword [rbp - 0x40], rcx
cmp rax, rcx
jl 0x140064dfa
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x40]
mov rax, 0xffffffffffffffff
xor rax, 0xffffffffffffffff
xor r8d, r8d
sub r8, 1
sub rax, r8
sub rdx, rax
sub rsp, 0x20
call fcn.140016582
add rsp, 0x20
jmp 0x140064ee0
mov r8, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
mov rcx, qword [rcx]
mov r9, rcx
add r9, 8
mov r10, r8
shl r10, 5
add r9, r10
mov qword [r9], 0
add rcx, 8
shl r8, 5
add rcx, r8
add rcx, 8
movabs r8, 0x8c2af22e8e735dba
movabs r9, 0x8c2af22e8e735dba
xor r8, r9
mov qword [rdx], r8
mov qword [rax], 0
sub rsp, 0x20
call fcn.140017ca0
mov rcx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x38]
add rsp, 0x20
mov rcx, qword [rcx]
mov qword [rbp - 0x48], rcx
cmp rax, rcx
jl 0x140064e98
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffff
sub rsp, 0x20
call fcn.140016582
add rsp, 0x20
jmp 0x140064ee0
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x20]
mov rcx, qword [rcx]
add rcx, 8
shl rax, 5
add rcx, rax
add rcx, 0x18
xor eax, eax
mov edx, eax
sub rsp, 0x20
call fcn.14012d6b8
mov rax, qword [rbp - 0x38]
add rsp, 0x20
add rax, 1
mov qword [rbp - 8], rax
jmp 0x140064d9b
mov rax, qword [rbp - 0x30]
mov qword [rax + 0x10], 0
mov eax, dword [0x1401f42c0]
mov ecx, 0x3ee6c9f0
xor ecx, 0xc97ef028
xor eax, ecx
xor edx, edx
div dword [0x1401f42c4]
mov ecx, eax
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0xffffffff
xor ecx, 0xec7a185d
mov edx, 0xffffffff
xor edx, 0xec7a185d
or ecx, edx
xor eax, 0xffffffff
mov edx, 0xb9f07d56
xor edx, 0x460f82a9
xor ecx, edx
or eax, ecx
mov ecx, eax
and ecx, 0x11fbd369
mov edx, 0x2a71838b
xor edx, 0xd58e7c74
xor ecx, edx
mov edx, 0x2b50bc76
xor edx, 0x3aab6f1f
add eax, edx
add eax, 1
add eax, ecx
add eax, 0xd724a2a1
cmp eax, 0xeb06e538
ja 0x140064f9f
mov ecx, dword [0x1401f42c8]
mov edx, dword [0x1401f42cc]
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
mov ecx, 0xb0229a5d
xor edx, edx
div ecx
xor eax, 0xcebbbc7a
add eax, 0xeb082dfd
cmp eax, 0xed1e189c
je 0x140064f68
mov rsp, rbp
pop rbp
ret
mov edx, 0xe996d54f
sar bh, 0xff
invalid
Function at 0x140066f00
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x18], r8
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov ecx, dword [0x1401f4380]
xor ecx, dword [0x1401f4384]
mov edx, ecx
xor edx, 0xffffffff
and edx, 0x20b5377b
mov r8d, 0x1d24f12e
xor r8d, 0x3d91c655
mov eax, 0x90e30038
xor eax, 0x6f1cffc7
xor r8d, eax
mov eax, ecx
and eax, r8d
imul eax, edx
mov edx, ecx
and edx, 0x20b5377b
or ecx, 0x20b5377b
imul ecx, edx
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov r8d, 0x1cbd6313
xor r8d, 0xe3429cec
mov edx, ecx
xor edx, r8d
and eax, edx
mov edx, 0xf048f73f
or edx, 0xf048f73f
xor edx, 0xffffffff
mov r8d, 0x31802134
xor r8d, 0xce7fdecb
xor eax, r8d
mov r8d, 0x3adc5a5
xor r8d, 0xfc523a5a
xor edx, r8d
and eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xf048f73f
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
and eax, 0x89e994b6
cmp eax, 0x5414a1e2
je 0x140067090
mov eax, dword [0x1401f4388]
xor eax, 0xe999d446
mov r8d, dword [0x1401f438c]
mov edx, r8d
not edx
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
mov ecx, eax
and ecx, 0x182b4f7d
mov r8d, ecx
not r8d
and r8d, 0x2fb3b21d
mov edx, eax
and edx, 0x10084d60
imul edx, r8d
and eax, 0x823021d
or ecx, 0x2fb3b21d
imul ecx, eax
mov eax, ecx
mov ecx, edx
lea eax, [rax + rcx + 0x7ab266aa]
mov dword [rbp - 0x1c], eax
mov eax, 0x10
call fcn.1401f0aa0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.140051260
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
add rsp, 0x20
mov rax, qword [rbp - 0x10]
mov r9, qword [rax]
mov qword [rdx], r9
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140066330
mov eax, dword [rbp - 0x1c]
add rsp, 0x20
cmp eax, 0x70e0cbf3
je 0x140066fd0
mov rsp, rbp
pop rbp
ret
invalid
Function at 0x14006afc0
Capabilities:
Check http status code
Encode data using xor

Disassembly:
sub rsp, 0xa8
mov qword [rsp + 0x48], r8
mov word [rsp + 0x56], cx
call fcn.14006ab7f
mov cx, word [rsp + 0x56]
mov qword [rsp + 0x78], rax
mov rax, qword [0x140217f80]
mov qword [rsp + 0x58], rax
movsx rcx, cx
mov qword [rsp + 0x60], rcx
add rax, 8
shl rcx, 4
add rax, rcx
add rax, 8
mov rcx, qword [rax]
mov qword [rsp + 0x68], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x70], rax
add rcx, 0x11
call fcn.14006af75
mov cl, al
mov rax, qword [rsp + 0x78]
mov byte [rsp + 0x87], cl
cmp byte [rax], 0
jne 0x14006b1d4
mov rcx, qword [rsp + 0x68]
add rcx, 0x10
call fcn.14006af75
mov byte [rsp + 0x47], al
cmp al, 0xc8
jne 0x14006b071
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
add rcx, 8
shl rax, 4
add rcx, rax
call fcn.14006b230
jmp 0x14006b1f0
mov rcx, qword [rsp + 0x70]
call fcn.14006af75
mov rdx, qword [rsp + 0x68]
mov r9, qword [rsp + 0x48]
mov r8b, byte [rsp + 0x87]
mov cl, byte [rsp + 0x47]
add rdx, 0x14
mov qword [rsp + 0x88], r9
mov byte [rsp + 0x90], r8b
mov qword [rsp + 0x98], rdx
movzx eax, al
mov dword [rsp + 0xa0], eax
mov rax, qword [0x140208930]
mov rax, qword [rax + 8]
movzx ecx, cl
mov edx, ecx
mov rcx, rax
add rcx, 8
imul r8, rdx, 0x48
add rcx, r8
add rcx, 0x38
add rax, 8
imul rdx, rdx, 0x48
add rax, rdx
add rax, 0x40
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
mov qword [rsp + 0x38], rcx
cmp rax, 0
je 0x14006b11b
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x88]
call rax
jmp 0x14006b1d4
mov eax, dword [0x1401f4578]
xor eax, 0xffd5a038
mov ecx, dword [0x1401f457c]
xor ecx, 0x9dea7f02
and eax, ecx
mov ecx, 0x5402b75
xor ecx, 0xc7f0f82c
sub eax, ecx
mov edx, 0xb116f54a
xor edx, 0x5ab1731d
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
and ecx, 0xeba78657
shl ecx, 1
sub ecx, 0xeba78657
sub eax, ecx
sub eax, 0x32ade2ae
cmp eax, 0x48cc6e43
je 0x14006b21a
mov eax, dword [0x1401f4580]
xor edx, edx
div dword [0x1401f4584]
mov ecx, eax
mov rax, qword [rsp + 0x38]
and ecx, 0x8fbf66d0
and ecx, 0x29580770
mov edx, 0x1308e6a
xor edx, 0x580717c4
or ecx, edx
mov dword [rsp + 0x2c], ecx
mov ecx, 0x2c7c04f
xor ecx, 0x3ba17fa4
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x88]
call rax
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
je 0x14006b174
jmp 0x14006b1d4
mov rax, qword [rsp + 0x60]
mov rcx, qword [0x140217f80]
add rcx, 8
shl rax, 4
add rcx, rax
call fcn.14006b230
mov rcx, qword [rsp + 0x60]
mov rax, qword [0x140217f80]
add rax, 8
shl rcx, 4
add rax, rcx
add rax, 8
mov rax, qword [rax]
mov byte [rax + 0xf], 0x13
add rsp, 0xa8
ret
invalid
Function at 0x14006bb10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov word [rsp + 0x4e], cx
call fcn.14006ab7f
mov cx, word [rsp + 0x4e]
mov qword [rsp + 0x60], rax
mov eax, 0xdc71f22c
xor eax, 0xdc71f22c
mov dword [rsp + 0x74], eax
mov rax, qword [0x140217f80]
mov qword [rsp + 0x50], rax
movsx rcx, cx
add rax, 8
shl rcx, 4
add rax, rcx
add rax, 8
mov rcx, qword [rax]
mov qword [rsp + 0x58], rcx
add rcx, 0x12
call fcn.14006af3c
mov cx, ax
mov rax, qword [rsp + 0x60]
mov word [rsp + 0x6e], cx
mov cl, byte [rax]
mov dl, 0xc8
xor dl, 0xc8
xor eax, eax
cmp cl, dl
mov dword [rsp + 0x70], eax
jne 0x14006bcc7
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov dx, word [rsp + 0x6e]
movsx rdx, dx
mov qword [rsp + 0x38], rdx
mov cl, byte [rcx + 0xf]
mov dl, 0xc3
xor dl, 0xb7
cmp cl, dl
mov qword [rsp + 0x40], rax
jne 0x14006bc05
mov cx, word [rsp + 0x4e]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
add rax, 8
shl rdx, 4
add rax, rdx
add rax, 8
mov r8, qword [rax]
add r8, 8
call fcn.14006afc0
mov rax, qword [rsp + 0x60]
mov cl, byte [rax]
mov dl, 0x12
xor dl, 0x12
xor eax, eax
cmp cl, dl
mov dword [rsp + 0x70], eax
jne 0x14006bcc7
mov rax, qword [0x140217f80]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov eax, dword [0x1401f45e8]
and eax, dword [0x1401f45ec]
or eax, 0x905ac61b
imul eax, eax, 0xb164ad8d
mov ecx, 0x1c39ee99
xor edx, edx
div ecx
cmp eax, 0xde3d2dd6
je 0x14006bd4b
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x1401f45f0]
and eax, dword [0x1401f45f4]
or eax, 0xb1223d9e
add eax, 0xce8d628a
mov edx, 0xcbdb4a13
xor edx, 0x6ae75823
sub eax, edx
sub eax, 0xce8d628a
mov r8d, 0x31fd978e
xor edx, edx
div r8d
mov edx, eax
mov rax, qword [rsp + 0x30]
mov dword [rsp + 0x28], edx
add rax, 8
shl rcx, 4
add rax, rcx
add rax, 8
mov rdx, qword [rax]
add rdx, 8
lea rcx, [rsp + 0x74]
mov r8d, 4
call fcn.14006b7ca
mov eax, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x74]
mov dword [rsp + 0x2c], ecx
cmp eax, 0xad0f1528
jae 0x14006bc3a
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x70], eax
jmp 0x14006bcc7
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x24], eax
mov eax, dword [0x1401f45f8]
and eax, dword [0x1401f45fc]
xor ecx, ecx
sub ecx, 0x870b9f25
sub eax, ecx
mov ecx, 0xdbcb084e
xor ecx, 0xae3537ac
xor edx, edx
div ecx
add eax, 0x906572b7
mov ecx, 0x664bf41f
xor ecx, 0x11856af8
cmp eax, ecx
jb 0x14006bd54
mov eax, dword [0x1401f4600]
sub eax, dword [0x1401f4604]
mov ecx, 0xea8afac8
xor ecx, 0x84e5ac0f
add eax, ecx
add eax, 0x74bd4da7
xor eax, 0xcfcfede2
mov ecx, 0x1112bdcc
xor ecx, 0xa8e09c68
cmp eax, ecx
jb 0x14006bd0c
mov eax, dword [rsp + 0x24]
add rsp, 0x78
ret
pop rsp
push 0xffffffffe6e9020d
invalid
ret 0x5b9f
Function at 0x14006bd60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov word [rsp + 0x46], cx
call fcn.14006ab7f
mov cx, word [rsp + 0x46]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], 0
mov rax, qword [0x140217f80]
mov qword [rsp + 0x48], rax
movsx rcx, cx
add rax, 8
shl rcx, 4
add rax, rcx
add rax, 8
mov rcx, qword [rax]
mov qword [rsp + 0x50], rcx
add rcx, 0x12
call fcn.14006af3c
mov rcx, qword [rsp + 0x58]
mov word [rsp + 0x66], ax
xor eax, eax
cmp byte [rcx], 0
mov qword [rsp + 0x68], rax
jne 0x14006be7d
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov dx, word [rsp + 0x66]
movsx rdx, dx
mov qword [rsp + 0x30], rdx
cmp byte [rcx + 0xf], 0x74
mov qword [rsp + 0x38], rax
jne 0x14006be43
mov cx, word [rsp + 0x46]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
add rax, 8
shl rdx, 4
add rax, rdx
add rax, 8
mov r8, qword [rax]
add r8, 8
call fcn.14006afc0
mov rax, qword [rsp + 0x58]
mov cl, byte [rax]
mov dl, 5
xor dl, 5
xor eax, eax
cmp cl, dl
mov qword [rsp + 0x68], rax
jne 0x14006be7d
mov rax, qword [0x140217f80]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
add rax, 8
shl rcx, 4
add rax, rcx
add rax, 8
mov rdx, qword [rax]
add rdx, 8
lea rcx, [rsp + 0x70]
mov r8d, 8
call fcn.14006b7ca
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov eax, dword [0x1401f4608]
add eax, dword [0x1401f460c]
mov ecx, 0x7201524a
xor ecx, 0x7201524a
mov edx, 0xc486b7e2
xor edx, 0x7dd19fc4
sub ecx, edx
add eax, ecx
or eax, 0x9086e514
sub eax, 0xe8589af7
sub eax, 0x6e630705
mov ecx, 0x2921690
xor ecx, 0xeaca8c67
add eax, ecx
cmp eax, 0x1187179
jb 0x14006bf24
mov eax, dword [0x1401f4610]
xor eax, 0x41a1167a
and eax, dword [0x1401f4614]
sub eax, 0x1582b5f0
add eax, 0x42e1d775
add eax, 0x1582b5f0
mov ecx, 0x8bfae58a
xor ecx, 0xdf60aefd
imul eax, ecx
mov ecx, 0xad96857a
xor ecx, 0xb0800514
or eax, ecx
cmp eax, 0x94e11c96
ja 0x14006bed4
mov rax, qword [rsp + 0x28]
add rsp, 0x78
ret
cmpsb byte [rsi], byte [rdi]
xor byte [rax], dl
mov edx, 0xffffa7e9
dec dword [rdi]
invalid
Function at 0x140071ec0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rcx
call fcn.140071710
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
cmp rdx, 0x10
jge 0x140072046
mov eax, dword [0x1401f4a08]
imul eax, dword [0x1401f4a0c]
mov ecx, 0x7a4dbed6
xor ecx, 0xd941a958
and eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x7296612b
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x7296612b
mov r8d, 0xf133e577
xor r8d, 0x83a5845c
or eax, r8d
imul eax, edx
add eax, ecx
or eax, 0x78e9187f
cmp eax, 0x33174cc8
je 0x14007213d
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401f4a10]
xor eax, 0x79abc8c3
mov edx, dword [0x1401f4a14]
xor edx, 0x70ce5328
mov r9d, eax
and r9d, edx
xor eax, edx
or r9d, eax
mov edx, 0x74eb389d
xor edx, 0x8b14c762
mov eax, r9d
xor eax, edx
and eax, 0x46953545
mov r8d, 0xffffffff
xor r8d, 0x46953545
and r9d, r8d
mov edx, 0xffffffff
xor edx, 0xb8047fc9
mov r10d, 0x8aad9a51
xor r10d, 0xcc38af14
and edx, r10d
and r8d, 0xb8047fc9
or eax, r9d
or edx, r8d
xor eax, edx
mov r8d, 0x4067f665
xor edx, edx
div r8d
mov edx, eax
mov rax, qword [rsp + 0x38]
mov r9d, 0x106c73f5
xor r9d, 0xa78742a3
mov r8d, edx
xor r8d, r9d
xor r8d, 0xffffffff
and r8d, 0xb7eb3156
shl r8d, 1
sub r8d, 0xb7eb3156
sub edx, r8d
mov dword [rsp + 0x2c], edx
mov edx, 0x5758a5cf
xor edx, 0xe8c8c8c
mov dword [rsp + 0x28], edx
mov dl, al
xor dl, 0xff
xor al, 0xff
and dl, al
mov al, 0xf
or al, 0xf
xor al, 0xff
or dl, al
mov al, 0xbb
xor al, 0x44
xor dl, al
or dl, 0x90
call fcn.14003aadb
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
jbe 0x14007213d
jmp 0x140072137
mov rax, qword [rsp + 0x38]
cmp rax, 0xffff
ja 0x140072103
mov rcx, qword [rsp + 0x30]
mov dl, 0xa2
xor dl, 0x7e
call fcn.14003aadb
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140072137
mov ecx, dword [0x1401f4a18]
mov edx, dword [str._A_ae]
xor edx, 0xffffffff
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, eax
xor ecx, 0x11fe0379
xor ecx, 0xffffffff
or eax, 0x11fe0379
and eax, ecx
or eax, 0x313068bc
imul eax, eax, 0x328a2871
cmp eax, 0x41557a8a
jb 0x140072146
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov edx, dword [0x1401f4a20]
or edx, dword [0x1401f4a24]
xor edx, 0x24d1d521
mov r8d, 0x99b2b6f6
xor r8d, 0x33ef8ddd
xor edx, r8d
and edx, 0x24641747
mov dword [rsp + 0x24], edx
mov dx, ax
call fcn.140071b40
mov eax, dword [rsp + 0x24]
cmp eax, 0x6141f0cd
jae 0x1400720b1
jmp 0x140072137
mov rcx, qword [rsp + 0x30]
mov edx, 0xdd
call fcn.14003aadb
mov rax, qword [rsp + 0x40]
cld
dec dword [rax - 0x75]
and al, 0x40
mov al, byte [rax]
mov cl, 0x92
xor cl, 0x92
cmp al, cl
jne 0x140072137
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov edx, eax
call fcn.140071dd5
nop
add rsp, 0x48
ret
imul ebx, dword [rcx], 0xffffffef
nop
jmp 0x140071f4b
je 0x140072110
insb byte [rdi], dx
mov dl, 0xe9
invalid
Function at 0x140072ed0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rcx
call fcn.140071710
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
cmp rdx, 0x20
jge 0x140072f47
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140073119
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov dl, al
and dl, dl
xor dl, 0xff
mov al, 0xd5
xor al, 0x75
mov r8b, 0x94
xor r8b, 0x6b
xor al, r8b
mov r8b, 0x1f
xor r8b, 0xbf
mov r9b, 0x4d
xor r9b, 0xb2
xor r8b, r9b
or al, r8b
and dl, al
xor dl, 0xff
call fcn.14003ab82
jmp 0x140073119
mov rax, qword [rsp + 0x38]
cmp rax, 0x100
jae 0x140072f93
mov rcx, qword [rsp + 0x30]
xor eax, eax
mov dl, al
xor dl, 0xd9
call fcn.14003aadb
mov rax, qword [rsp + 0x40]
mov al, byte [rax]
mov cl, 0xbd
xor cl, 0xbd
cmp al, cl
jne 0x140073119
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov dl, al
call fcn.14003ab82
jmp 0x140073119
mov rax, qword [rsp + 0x38]
movabs rcx, 0x78a9785c52033d04
movabs rdx, 0x78a9785c52023d04
xor rcx, rdx
cmp rax, rcx
jae 0x140072fec
mov rcx, qword [rsp + 0x30]
mov edx, 0xda
call fcn.14003aadb
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140073119
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov dx, ax
call fcn.140071b40
jmp 0x140073119
mov rcx, qword [rsp + 0x30]
mov edx, 0xdb
call fcn.14003aadb
mov rax, qword [rsp + 0x40]
mov al, byte [rax]
mov cl, 0x33
xor cl, 0x33
cmp al, cl
jne 0x140073119
mov eax, dword [0x1401f4ac8]
add eax, dword [0x1401f4acc]
mov ecx, 0x3a8db9e4
xor ecx, 0xefe97725
and eax, ecx
mov r8d, 0xffffffff
xor r8d, 0xd353e07e
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x82643cad
xor r8d, 0x7d9bc352
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xd353e07e
or eax, 0xd353e07e
imul eax, edx
add eax, ecx
mov ecx, 0xf53f9a51
xor edx, edx
div ecx
cmp eax, 0xdee24b09
je 0x14007311e
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov edx, dword [0x1401f4ad0]
mov r8d, 0xc27cb145
xor r8d, 0x3372d4c1
xor edx, r8d
sub edx, dword [0x1401f4ad4]
add edx, 0x4ece2e46
mov r8d, 0xc896f52e
xor r8d, 0x7d16721
xor edx, r8d
mov r8d, 0x9611a860
xor r8d, 0xb7ef08e7
and r8d, edx
mov r9d, 0x2f7ba645
xor r9d, 0xd08459ba
xor r8d, r9d
mov r9d, 0xeaa56b67
xor r9d, 0xcb5bcbe0
add edx, r9d
add edx, 1
add edx, r8d
mov dword [rsp + 0x2c], edx
mov edx, 0x44291c2c
xor edx, 0x42213f1c
mov dword [rsp + 0x28], edx
mov edx, eax
call fcn.140071dd5
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
jb 0x140073078
jmp 0x140073119
add rsp, 0x48
ret
pushfq
popfq
xor eax, 0xff51e97c
invalid
Function at 0x1400741d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rcx
call fcn.140071710
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x54], 0
call fcn.14003af3f
mov ecx, eax
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x48], ecx
mov cl, byte [rax]
mov dl, 0x50
xor dl, 0x50
xor eax, eax
cmp cl, dl
mov dword [rsp + 0x4c], eax
jne 0x1400742e0
mov eax, dword [0x1401f4b58]
xor eax, dword [0x1401f4b5c]
mov ecx, 0x538b3966
xor edx, edx
div ecx
mov ecx, 0x4c0e30c0
xor ecx, 0x4c0e30c0
sub ecx, eax
xor eax, eax
sub eax, 0xea2f4b81
add ecx, eax
xor eax, eax
sub eax, ecx
or eax, 0x15031bd5
cmp eax, 0xbf8dd3dc
jb 0x1400742e9
mov eax, dword [rsp + 0x48]
mov edx, dword [0x1401f4b60]
and edx, dword [0x1401f4b64]
mov r8d, 0xf8747826
xor r8d, 0x229740ab
mov ecx, edx
and ecx, r8d
xor edx, 0xdae3388d
or ecx, edx
xor edx, edx
sub edx, 0x3a854e15
add ecx, edx
mov edx, 0x2d7cdf26
xor edx, 0x5367aeae
push rbx
sub ecx, edx
mov dword [rsp + 0x30], ecx
mov ecx, 0xed5ef6e7
xor ecx, 0x99c2c90f
mov dword [rsp + 0x2c], ecx
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x54]
lea rdx, [rsp + 0x50]
call fcn.140071e67
mov ecx, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x30]
mov edx, dword [rsp + 0x54]
mov dword [rsp + 0x34], edx
cmp eax, ecx
jae 0x140074254
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x4c], eax
jmp 0x1400742e0
mov eax, dword [rsp + 0x4c]
add rsp, 0x58
ret
ja 0x140074291
movsb byte [rdi], byte [rsi]
adc al, 0xe9
invalid
Function at 0x140078661
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
call fcn.140071710
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
call fcn.140074590
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140078653
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call fcn.1400781af
mov rax, qword [rsp + 0x40]
mov al, byte [rax]
mov cl, 0x8b
xor cl, 0x8b
cmp al, cl
jne 0x140078653
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
add rdx, 0x10
call fcn.140077f10
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140078653
mov ecx, dword [0x1401f4d88]
mov r8d, dword [0x1401f4d8c]
mov eax, 0x91b26288
xor eax, 0x19f3fcaa
xor r8d, eax
mov edx, r8d
xor edx, 0xffffffff
mov eax, ecx
and eax, edx
mov edx, ecx
xor edx, r8d
add ecx, edx
sub ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0xbe1439b0
mov edx, 0xffffffff
xor edx, 0xbe1439b0
and ecx, edx
or eax, ecx
mov edx, eax
and edx, 0x4842d8fe
mov ecx, 0x64c8a53a
xor ecx, 0x64c8a538
imul ecx, edx
mov edx, 0x6c95bb79
xor edx, 0x24d76387
add eax, edx
sub eax, ecx
mov ecx, 0x46adf446
xor ecx, 0xd130519e
or eax, ecx
cmp eax, 0x5a2260b1
jbe 0x140078658
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x1401f4d90]
xor eax, 0xc5b996ca
mov r8d, dword [0x1401f4d94]
mov edx, 0x5b268f48
xor edx, 0x5b268f48
sub edx, r8d
add eax, edx
or eax, 0x20b37f5
mov r8d, 0x9e44095e
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x30]
mov r8d, 0x306f3773
xor r8d, 0x6cb97637
add eax, r8d
mov dword [rsp + 0x2c], eax
mov eax, 0xc6169fd0
xor eax, 0xa438a973
mov dword [rsp + 0x28], eax
add rdx, 0x14
call fcn.140077f10
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
je 0x1400785d7
jmp 0x140078653
add rsp, 0x48
ret
invalid
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.140071710
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x1400784e0
Function at 0x14007c749
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.140071710
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x14007bdd0