joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a7020
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], r8
mov r9, rcx
xor r9, 0xffffffffffffffff
mov rax, rdx
and rax, r9
mov r8, rdx
or r8, r9
movabs r9, 0x41ae4f7f01308e6a
movabs r10, 0xbe51b080fecf7195
xor r9, r10
xor r8, r9
imul r8, rax
mov r9, rdx
and r9, rcx
mov rax, rdx
or rax, rcx
imul rax, r9
add rax, r8
mov qword [rsp + 0x40], rax
cvtsi2sd xmm0, rcx
cvtsi2sd xmm1, rdx
mulsd xmm0, xmm1
movsd qword [rsp + 0x48], xmm0
cvtsi2sd xmm1, rax
movsd qword [rsp + 0x50], xmm1
ucomisd xmm0, xmm1
jne 0x1400a70a6
jp 0x1400a70a6
jmp 0x1400a71e3
mov ecx, dword [0x1401f6318]
mov edx, dword [0x1401f631c]
xor edx, 0x35c34d57
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, ecx
and eax, 0xd2f1f66
mov edx, 0x41096824
xor edx, 0xbef697db
xor eax, edx
and ecx, 0xd2f1f66
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0x5981c811
xor ecx, 0xa67e37ee
mov edx, eax
xor edx, ecx
and edx, 0x27e82f01
mov r8d, 0xffffffff
xor r8d, 0x27e82f01
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x27e82f01
or eax, 0x27e82f01
imul eax, edx
add eax, ecx
mov ecx, 0x8d5c8ad4
xor edx, edx
div ecx
cmp eax, 0x73efdd42
je 0x1400a7204
movsd xmm1, qword [rsp + 0x48]
movsd xmm0, qword [rsp + 0x50]
mov eax, dword [0x1401f6320]
mov ecx, dword [0x1401f6324]
mov edx, 0x770f88ac
xor edx, 0xc2acc030
xor ecx, edx
xor edx, edx
div ecx
mov ecx, 0xa3a27299
xor ecx, 0xd22d5457
xor edx, edx
div ecx
mov ecx, 0xe3099e65
xor ecx, 0xd558ca52
imul eax, ecx
add eax, 0x2ec7d3ba
mov dword [rsp + 0x30], eax
subsd xmm0, xmm1
call fcn.1401f0b50
movaps xmm1, xmm0
movsd xmm0, qword [rsp + 0x48]
movsd qword [rsp + 0x28], xmm1
call fcn.1401f0b50
movsd xmm1, qword [rsp + 0x28]
mov eax, dword [rsp + 0x30]
movsd xmm2, qword [0x140206a20]
mulsd xmm1, xmm2
ucomisd xmm0, xmm1
setb cl
mov byte [rsp + 0x37], cl
cmp eax, 0xcaf7f5e0
jae 0x1400a7133
mov cl, byte [rsp + 0x37]
mov al, 1
test cl, 1
mov byte [rsp + 0x27], al
jne 0x1400a71f6
jmp 0x1400a71e3
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x27], al
mov al, byte [rsp + 0x27]
and al, 1
movzx eax, al
add rsp, 0x58
ret
mov ebp, ss
and dword [rsi - 0xd917], edi
dec dword [rdi]
invalid
Function at 0x1400a7210
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov ecx, dword [0x1401f6328]
mov edx, dword [0x1401f632c]
mov eax, ecx
and eax, edx
shl eax, 1
add ecx, edx
sub ecx, eax
sub ecx, 0x9f2eb3b1
mov eax, ecx
or eax, 0x2e418de7
xor eax, 0xffffffff
mov edx, 0xda6e69da
xor edx, 0x25919625
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0x2e418de7
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0x505ea9cb
xor ecx, 0xb814114
add eax, ecx
cmp eax, 0xe8e73e73
ja 0x1400a734a
mov rcx, qword [rbp - 0x10]
mov eax, dword [0x1401f6330]
xor eax, 0xf0bd3d44
mov r9d, dword [0x1401f6334]
mov r8d, r9d
xor r8d, eax
xor r9d, 0x682e6035
mov edx, eax
and edx, r9d
xor r8d, 0x97d19fca
add eax, r8d
sub eax, edx
imul rax, rax, 0x75479ee9
shr rax, 0x3e
imul eax, eax, 0xec62ba27
xor eax, 0x9719f801
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.1401f0aa0
sub rsp, rax
mov r8, rsp
mov qword [rbp - 0x20], r8
mov edx, 2
sub rsp, 0x20
call fcn.1400a7020
add rsp, 0x20
mov cl, al
mov eax, dword [rbp - 0x18]
mov byte [rbp - 0x11], cl
cmp eax, 0xd2c806cd
ja 0x1400a7280
mov al, byte [rbp - 0x11]
test al, 1
jne 0x1400a7316
jmp 0x1400a7328
sub rsp, 0x20
call fcn.1400091c0
add rsp, 0x20
jmp 0x1400a7345
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 0x20]
mov r8, qword [rax]
mov rdx, qword [rcx]
mov rcx, rdx
and rcx, r8
or rdx, r8
add rcx, rdx
mov qword [rax], rcx
mov rsp, rbp
pop rbp
ret
invalid
Function at 0x1400abec0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x10], rdx
mov dword [rbp - 4], ecx
mov ecx, dword [0x1401f6560]
add ecx, dword [0x1401f6564]
mov edx, 0x9653b966
xor edx, 0x958f88af
mov eax, ecx
and eax, edx
xor ecx, 0x3dc31c9
or eax, ecx
mov edx, eax
xor edx, 0x24d1d521
xor edx, 0xffffffff
mov ecx, 0x26e3542a
xor ecx, 0x232810b
and ecx, edx
shl ecx, 1
sub ecx, 0x24d1d521
sub eax, ecx
xor eax, 0xaa5d3b2b
mov ecx, 0xbabb4073
xor ecx, 0xf93a8c2b
cmp eax, ecx
je 0x1400ac04d
mov ecx, dword [0x1401f6568]
mov eax, dword [str._cV]
xor eax, 0xbd05f73e
imul ecx, eax
mov eax, ecx
not eax
and eax, 0x43da8665
mov edx, ecx
and edx, 0xbc25799a
imul edx, eax
mov eax, ecx
and eax, 0x43da8665
or ecx, 0x43da8665
imul ecx, eax
mov eax, ecx
mov ecx, edx
lea eax, [rax + rcx - 0x319b8593]
or eax, 0x260a56e7
mov dword [rbp - 0x24], eax
mov eax, 0x10
call fcn.1401f0aa0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
sub rsp, 0x20
call fcn.1400aba77
mov ecx, dword [rbp - 4]
add rsp, 0x20
mov rdx, rax
mov eax, dword [rbp - 0x24]
mov qword [rbp - 0x20], rdx
cmp ecx, 0
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0xbe85afe1
jae 0x1400abf2f
mov al, byte [rbp - 0x11]
test al, 1
jne 0x1400ac048
jmp 0x1400abfcc
mov rdx, qword [rbp - 0x30]
mov ecx, dword [rbp - 4]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.1400aadf0
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x38], rcx
cmp byte [rax], 0
jne 0x1400ac048
mov rcx, qword [rbp - 0x38]
movabs rax, 0xfd1968c1848f14ef
movabs rdx, 0x2e6973e6796c1d8
xor rax, rdx
lea rdx, [0x140206b00]
lea r8, [0x140206b0f]
lea r9, [0x140206b1c]
sub rsp, 0x30
mov qword [rsp + 0x20], rax
call fcn.140016090
add rsp, 0x30
mov rsp, rbp
pop rbp
ret
invalid
Function at 0x1400bfb20
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x4c0
lea rbp, [rsp + 0x80]
mov eax, 0x10
mov qword [rbp + 0x2a0], rax
call fcn.1401f0aa0
Function at 0x1400e1750
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
call fcn.1400e0de8
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx]
call fcn.1400e11d0
test al, 1
jne 0x1400e1782
jmp 0x1400e1862
mov eax, dword [0x1401f7ab0]
imul eax, dword [0x1401f7ab4]
mov ecx, 0x255d1ec0
xor ecx, 0x10ab45ec
xor edx, edx
div ecx
mov ecx, 0xaa310dac
xor ecx, 0x1824ce34
mov edx, 0xf7b73e53
xor edx, 0x848c1ac
xor ecx, edx
add eax, ecx
mov ecx, 0x4e79201b
xor ecx, 0x4e79201a
add eax, ecx
mov ecx, 0xcff9323f
xor ecx, 0xf9433d46
sub eax, ecx
cmp eax, 0xcbd3d172
jae 0x1400e1874
mov rax, qword [rsp + 0x38]
mov ecx, dword [0x1401f7ab8]
mov edx, dword [0x1401f7abc]
xor edx, 0x2d214853
or ecx, edx
mov edx, 0xb1f70bc8
xor edx, 0xec4658c7
sub ecx, edx
and ecx, 0x599114e6
add ecx, 0x8dfeca2f
mov dword [rsp + 0x28], ecx
mov rcx, qword [rax]
call fcn.1400e0e10
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x28]
mov cl, byte [rcx]
mov dl, 0x3a
xor dl, 0x3a
cmp cl, dl
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x55cfb5d4
jb 0x1400e17dd
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1400e1850
jmp 0x1400e186f
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
mov edx, 8
call fcn.140011370
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
add rsp, 0x48
ret
invalid
Function at 0x1400e2a90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x57], al
je 0x1400e2bfe
mov rax, qword [rsp + 0x48]
movabs rcx, 0x786f254bebb253b5
movabs rdx, 0x8790dab4144dac45
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x38], rax
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
mov al, 1
cmp rcx, 0x10
mov byte [rsp + 0x57], al
jb 0x1400e2bfe
mov rdx, qword [rsp + 0x40]
mov rax, rdx
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x30], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl dl
cmp rax, 0xffffffffffffffff
setg al
mov cl, 1
xor cl, 0
xor al, cl
xor dl, 0xff
mov cl, 1
xor cl, 1
or al, dl
or cl, 1
xor al, 0xff
and al, cl
test al, 1
jne 0x1400e2b2f
jmp 0x1400e2beb
mov eax, dword [0x1401f7b80]
imul eax, dword [0x1401f7b84]
mov ecx, 0x9092c7a2
xor ecx, 0xec6fc4f1
xor edx, edx
div ecx
sub eax, 0xf7e61d4e
mov ecx, 0xb2fa2788
xor edx, edx
div ecx
cmp eax, 0x1346b486
ja 0x1400e2c7c
mov eax, dword [0x1401f7b88]
imul eax, dword [0x1401f7b8c]
or eax, 0x9830907e
and eax, eax
mov ecx, 0xd4ac4f16
xor ecx, 0x2b53b0e9
xor eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x6d85508e
mov edx, 0xffffffff
xor edx, 0x6d85508e
or ecx, edx
and eax, ecx
mov ecx, 0x34bd52c8
xor ecx, 0xcb42ad37
xor eax, ecx
mov ecx, 0x3b80d54c
xor ecx, 0x5f651dd9
and eax, ecx
mov dword [rsp + 0x2c], eax
mov eax, 0xf36f58f9
xor eax, 0x68e6e2cf
mov dword [rsp + 0x28], eax
call fcn.1400091c0
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
je 0x1400e2c7c
xor eax, eax
mov byte [rsp + 0x57], al
jmp 0x1400e2bfe
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x57], al
mov al, byte [rsp + 0x57]
mov byte [rsp + 0x27], al
mov eax, dword [0x1401f7b90]
add eax, dword [0x1401f7b94]
mov ecx, 0xc785d488
xor ecx, 0x864f95fb
xor eax, ecx
or eax, 0x9b30eb74
xor eax, 0xe70db51c
cmp eax, 0xdd32a165
ja 0x1400e2c85
mov eax, dword [0x1401f7b98]
xor eax, 0xd3fe7847
and eax, dword [0x1401f7b9c]
mov ecx, 0x348a2f5a
xor edx, edx
div ecx
mov ecx, 0x1451c1d8
xor ecx, 0x21749bb9
xor edx, edx
div ecx
imul eax, eax, 0xed0f387
cmp eax, 0x6b76dbe6
ja 0x1400e2c34
mov al, byte [rsp + 0x27]
and al, 1
movzx eax, al
add rsp, 0x58
ret
scasb al, byte [rdi]
adc al, 0x2e
ret 0xdfe9
sbb eax, 0xe94ac451
cmpsb byte [rsi], byte [rdi]
invalid
Function at 0x1400fbed0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x50
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x40], rcx
xor eax, eax
cmp rcx, qword [rdx]
mov byte [rsp + 0x4f], al
jne 0x1400fc095
mov rcx, qword [rsp + 0x40]
mov al, 1
cmp rcx, 0
mov byte [rsp + 0x4f], al
je 0x1400fc095
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rdx, qword [rdx + 8]
add rdx, 8
mov qword [rsp + 0x10], rdx
mov rax, qword [rax + 8]
add rax, 8
mov qword [rsp + 0x18], rax
xor eax, eax
test rcx, rcx
cmovg rax, rcx
mov qword [rsp + 0x20], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 8], rax
mov edx, dword [0x1401f83f8]
mov ecx, dword [0x1401f83fc]
xor ecx, 0x3da38a21
mov eax, edx
xor eax, 0xffffffff
xor edx, 0xffffffff
and eax, edx
or ecx, ecx
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
xor ecx, ecx
sub ecx, 0x39c66155
add eax, ecx
sub eax, 0x70515895
mov ecx, 0xda844a7c
xor ecx, 0x46dc508f
or eax, ecx
cmp eax, 0xe32a8f9b
ja 0x1400fc0a3
mov rcx, qword [rsp + 8]
mov edx, dword [0x1401f8400]
mov r8d, dword [0x1401f8404]
mov eax, edx
and eax, r8d
xor edx, r8d
or eax, edx
mov r8d, 0x2f4fcc04
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x20]
mov r8d, 0x503914fe
xor r8d, 0x7475bfd6
or eax, r8d
mov r8d, eax
and r8d, 0x1957a259
shl r8d, 1
add eax, 0x1957a259
sub eax, r8d
cmp rcx, rdx
sete cl
mov byte [rsp + 7], cl
cmp eax, 0x80a630b
je 0x1400fbf9f
mov cl, byte [rsp + 7]
xor eax, eax
test cl, 1
mov dword [rsp], eax
jne 0x1400fc088
jmp 0x1400fc01d
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x10]
movzx r8d, byte [rdx + rcx]
movzx eax, byte [rax + rcx]
mov edx, r8d
xor edx, eax
mov r9d, 0x4d8c66ce
xor r9d, 0xb2739931
xor eax, r9d
and r8d, eax
mov eax, 0xb4c3c1f5
xor eax, 0xb4c3c1f7
imul eax, r8d
sub eax, edx
movabs rdx, 0x91defb80e425d92d
movabs r8, 0x91defb80e425d92c
xor rdx, r8
add rcx, rdx
cmp eax, 0
mov qword [rsp + 0x28], rcx
mov dword [rsp], eax
je 0x1400fbf48
mov eax, dword [rsp]
cmp eax, 0
sete al
mov byte [rsp + 0x4f], al
mov al, byte [rsp + 0x4f]
and al, 1
movzx eax, al
add rsp, 0x50
ret
xor cl, byte [rbx - 0xc16c6fa]
invalid

Function at 0x1400fe870
Capabilities:
Encode data using base64
Encode data using xor
Encrypt data using speck
Parse credit card information

Disassembly:
push rsi
push rdi
sub rsp, 0xd78
call fcn.1400fe850
mov qword [rsp + 0xd68], rax
mov eax, 0xd26da440
mov dword [rsp + 0xd74], eax
Function at 0x140116e50
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov dword [rbp - 4], ecx
mov eax, dword [0x1401f90e8]
sub eax, dword [0x1401f90ec]
mov ecx, 0x4a75bd30
xor ecx, 0x773400c
add eax, ecx
mov ecx, 0xe614ce33
xor ecx, 0xf6d75d8e
xor edx, edx
div ecx
mov ecx, 0xf7942750
xor ecx, 0xefae2d39
xor edx, edx
div ecx
cmp eax, 0xe32897b9
je 0x140116f3d
and byte [rcx], dh
or eax, 0xff59e931
invalid
Function at 0x14011da70
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
call fcn.140115c90
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
cmp rcx, 0
jne 0x14011dbba
mov word [rsp + 0x56], 0x73
lea rcx, [rsp + 0x56]
call fcn.14006aba0
mov rcx, rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rcx
cmp byte [rax], 0
jne 0x14011daf5
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x20]
mov rdx, qword [rax]
call fcn.14001e600
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rax]
mov qword [rsp + 0x40], rdx
mov rax, qword [rax + 8]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
call fcn.140115de4
mov ecx, dword [0x1401f9408]
mov eax, dword [0x1401f940c]
mov edx, 0xa168ab1f
xor edx, 0x5e9754e0
xor eax, edx
add ecx, eax
add ecx, 1
mov edx, ecx
xor edx, 0xffffffff
and edx, 0x34476827
mov r8d, 0xffffffff
xor r8d, 0x34476827
mov eax, ecx
and eax, r8d
imul eax, edx
mov edx, ecx
and edx, 0x34476827
or ecx, 0x34476827
imul ecx, edx
add ecx, eax
mov eax, ecx
and eax, 0xb0fa8a1a
mov edx, 0x2f001d17
xor edx, 0x9ffa970d
or ecx, edx
add eax, ecx
mov ecx, 0xf0e2a6b4
xor edx, edx
div ecx
cmp eax, 0x706d8152
ja 0x14011dbcf
mov eax, dword [0x1401f9410]
xor edx, edx
div dword [0x1401f9414]
mov ecx, eax
and ecx, 0x7ec7082
mov edx, 0xe3f35061
xor edx, 0x3d19c673
mov eax, ecx
and eax, edx
or ecx, 0xdeea9612
add eax, ecx
or eax, 0x5113f68e
mov ecx, 0x1a50c0b5
xor ecx, 0x8cda8e31
cmp eax, ecx
je 0x14011db70
jmp 0x14011dbc9
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call fcn.14011ced0
nop
add rsp, 0x58
ret
test eax, 0xe98f0839
cwde
invalid
Function at 0x1401233d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rcx
call fcn.14012322f
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
call fcn.14002adb0
mov rax, qword [rsp + 0x40]
mov al, byte [rax]
mov cl, 2
xor cl, 2
cmp al, cl
jne 0x1401234a0
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax]
movabs rcx, 0x86ac63bdbc908ffd
mov rax, rdx
sub rax, rcx
add rax, 0xffffffffffffffff
movabs rcx, 0xc3764d0e2d1c9de4
movabs r8, 0x45da2eb3918c1219
xor rcx, r8
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl dl
cmp rax, 0xffffffffffffffff
setg cl
xor dl, 0xff
mov al, cl
xor al, dl
and al, cl
test al, 1
jne 0x140123470
jmp 0x14012347a
call fcn.1400091c0
jmp 0x1401234a0
mov r8, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
movabs rdx, 0x426b51064a484c10
movabs rax, 0x426b51064a484c10
xor rdx, rax
call fcn.140122630
mov eax, dword [0x1401f9670]
mov r8d, dword [0x1401f9674]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
sub eax, 0x938bbb33
add eax, 0x32a80db
add eax, 0x36aec100
sub eax, 0x91d31ca1
sub eax, 0x36aec100
cmp eax, 0x75e366bf
jae 0x140123577
mov ecx, dword [0x1401f9678]
xor ecx, 0xf766fcfe
mov edx, dword [0x1401f967c]
mov eax, 0xda6e69da
xor eax, 0x25919625
xor edx, eax
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0x923012ef
xor edx, edx
div ecx
mov edx, eax
mov ecx, edx
xor ecx, 0xd55bf6f6
mov eax, 0x505ea9cb
xor eax, 0x85055f3d
mov r8d, 0xb3a2c03b
xor r8d, 0x4c5d3fc4
xor eax, r8d
and edx, eax
mov eax, 0xf0bd3d44
xor eax, 0xf0bd3d46
imul eax, edx
sub eax, ecx
imul eax, eax, 0xd93b14d7
mov ecx, 0x1fa8bbac
xor ecx, 0x6c32beac
cmp eax, ecx
je 0x1401234f7
add rsp, 0x48
ret
invalid
Function at 0x14012b490
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], rdx
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rcx, qword [rax + 8]
mov rax, qword [rax]
cmp rcx, rax
mov qword [rsp + 0x50], rax
jg 0x14012b5cc
mov eax, dword [0x1401f99f8]
xor eax, 0x1767c476
mov edx, dword [0x1401f99fc]
mov r8d, 0x7a80deb8
xor r8d, 0x857f2147
mov ecx, eax
xor ecx, r8d
and ecx, edx
mov r8d, 0x319d71d
xor r8d, 0xfce628e2
xor edx, r8d
and eax, edx
sub eax, ecx
mov ecx, 0xb751d8f1
xor ecx, 0xb751d8f1
mov edx, 0x99b019b8
xor edx, 0x4ad832cb
sub ecx, edx
sub eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x6c44aaf1
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0x804d53a5
xor r8d, 0xec09f954
mov edx, eax
and edx, r8d
or eax, 0x6c44aaf1
imul eax, edx
add eax, ecx
imul eax, eax, 0x7d6ee580
cmp eax, 0xdcc179d1
je 0x14012b691
mov rcx, qword [rsp + 0x48]
mov eax, dword [0x1401f9a00]
mov edx, dword [0x1401f9a04]
xor edx, 0xcda700b2
xor eax, edx
mov edx, 0xa4e45d1d
xor edx, 0xc00a558a
imul eax, edx
add eax, 0x9af97d08
and eax, 0xf1f51686
mov dword [rsp + 0x2c], eax
mov eax, 0xb7d46c0a
xor eax, 0x7c0df093
mov dword [rsp + 0x28], eax
call fcn.140012c20
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
mov rdx, qword [rdx]
mov qword [rsp + 0x30], rdx
cmp eax, ecx
je 0x14012b558
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
jmp 0x14012b5cc
mov rcx, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rax, qword [rax + 0x10]
mov r10, rdx
shl r10, 4
mov r8, rax
add r8, r10
mov qword [r8], r9
mov r8, rdx
shl r8, 4
add rax, r8
add rax, 8
mov qword [rax], rcx
mov rax, rdx
and rax, 1
mov rcx, rdx
or rcx, 1
add rax, rcx
mov qword [rsp + 0x20], rax
movabs rcx, 0x4246f193a0fe9d32
movabs r8, 0xbdb90e6c5f0162cd
xor rcx, r8
xor rdx, rcx
or rax, rax
xor rax, 0xffffffffffffffff
mov rcx, rdx
xor rcx, 0xffffffffffffffff
movabs r8, 0x8f48250c80f36c79
movabs r9, 0x70b7daf37f0c9386
xor r8, r9
xor rdx, r8
and rcx, rdx
xor rax, 0xffffffffffffffff
xor rcx, 0xffffffffffffffff
and rax, rcx
cmp rax, 0
jge 0x14012b67f
call fcn.1400091c0
jmp 0x14012b68c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
add rsp, 0x58
ret
invalid
Function at 0x14012bc70
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401f9a28]
xor eax, 0x484f1203
xor edx, edx
div dword [0x1401f9a2c]
mov r11d, eax
sub r11d, 0xed1681e3
mov eax, 0x601f83ba
xor eax, 0xbeee4b77
add r11d, eax
add r11d, 0xed1681e3
xor r11d, 0x41ca4173
mov eax, 0xf561df53
xor eax, 0xa9e20ac
mov ecx, r11d
xor ecx, eax
mov r8d, 0xffffffff
xor r8d, 0x9b30eb74
mov edx, 0xffffffff
xor edx, 0xe1eacc03
mov r9d, 0xad5d4479
xor r9d, 0x4cb7887a
mov eax, ecx
and eax, r9d
and r11d, edx
mov r9d, r8d
and r9d, 0xe1eacc03
mov r10d, edx
and r10d, 0x9b30eb74
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
mov r8d, 0x9092c7a2
xor r8d, 0x6f6d385d
xor ecx, r8d
or edx, 0xe1eacc03
and ecx, edx
or eax, ecx
cmp eax, 0xaa557732
ja 0x14012bdd2
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401f9a30]
or eax, dword [0x1401f9a34]
mov edx, 0x35ec4265
xor edx, 0x74fe49c0
and eax, edx
mov r8d, 0x348a2f5a
xor edx, edx
div r8d
mov r8d, 0x35255a61
xor edx, edx
div r8d
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x20], rcx
cmp rcx, 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x8c8247b3
je 0x14012bd32
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x14012bdcc
jmp 0x14012bd96
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
movabs rcx, 0xa0a8f59f36f58f9
movabs rdx, 0x4a0a8f59f36f58f9
xor rcx, rdx
and rax, rcx
cmp rax, 0
je 0x14012bdcc
mov rcx, qword [rsp + 0x30]
call fcn.140017df0
nop
add rsp, 0x38
ret
out 0xcb, al
jrcxz 0x14012be01
jmp 0x14012bd32
ror byte [rax], 0x48
mov dword [rsp + 0x38], eax
mov rax, qword [rcx + 8]
mov rdx, qword [rcx]
mov byte [rax + rdx + 8], r8b
mov rdx, qword [rcx]
mov rax, rdx
add rax, 1
mov qword [rsp + 0x40], rax
mov rcx, rdx
xor rcx, 0xffffffffffffffff
movabs r9, 0xef9676dfd3fe7847
movabs r8, 0x106989202c0187b8
xor r9, r8
mov r8, rdx
xor r8, r9
or rcx, r8
xor rcx, 0xffffffffffffffff
mov r8, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
or rcx, r8
movabs r8, 0xefa539301451c1d8
movabs r9, 0x105ac6cfebae3e27
xor r8, r9
movabs r9, 0x4d4ce9c27913f889
movabs r10, 0xb2b3163d86ec0776
xor r9, r10
xor r8, r9
mov r9, 0xffffffffffffffff
xor r9, 0xffffffffffffffff
or r8, r9
xor rdx, 0xffffffffffffffff
movabs r9, 0x469e5a74a2058759
movabs r10, 0xb961a58b5dfa78a6
xor r9, r10
xor r8, r9
or rdx, r8
xor rcx, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
or rcx, rdx
and rax, rcx
movabs rcx, 0x683b5b8c466e9943
movabs rdx, 0x683b5b8c466e9943
xor rcx, rdx
cmp rax, rcx
jge 0x14012bef4
call fcn.1400091c0
jmp 0x14012bf0e
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov qword [rdx], rcx
mov rax, qword [rax]
mov byte [rax + rcx + 8], 0
add rsp, 0x48
ret
Function at 0x140134aa0
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov eax, dword [0x1401f9ed8]
mov ecx, 0xddc571ea
xor ecx, 0x4c435fa8
xor eax, ecx
imul eax, dword [0x1401f9edc]
mov ecx, 0x1c39ee99
xor edx, edx
div ecx
mov edx, 0xf519c93d
xor edx, 0xfd497c15
mov ecx, eax
and ecx, edx
mov edx, 0xe6aea88e
xor edx, 0xe6aea88c
imul ecx, edx
xor eax, 0x850b528
add eax, ecx
add eax, 0x5dba6
cmp eax, 0xe7a456d1
ja 0x140134b8c
mov eax, dword [str.BR_0]
mov edx, dword [0x1401f9ee4]
mov r8d, 0x796079de
xor r8d, 0x869f8621
mov ecx, eax
xor ecx, r8d
and ecx, edx
xor edx, 0xffffffff
and eax, edx
sub eax, ecx
mov ecx, 0x31fd978e
xor edx, edx
div ecx
mov ecx, eax
mov edx, 0xffffffff
xor edx, 0x8bb545d3
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0x7f593640
xor ecx, 0x80a6c9bf
mov edx, eax
xor edx, ecx
and edx, 0x4ee3440b
mov r8d, 0xffffffff
xor r8d, 0x4ee3440b
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0x541a737
xor r8d, 0x4ba2e33c
mov edx, eax
and edx, r8d
or eax, 0x4ee3440b
imul eax, edx
add eax, ecx
cmp eax, 0xd2f4bf16
ja 0x140134af7
ret
sbb al, 0x48
mov ebx, 0xff62e9b8
invalid
Function at 0x140139160
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov ecx, dword [0x1401fa218]
mov edx, dword [0x1401fa21c]
mov eax, ecx
and eax, edx
or ecx, edx
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
mov ecx, 0x9a057d29
xor ecx, 0xa2d4c5ed
and ecx, edx
mov edx, 0xffffffff
xor edx, 0x38d1b8c4
and eax, edx
or ecx, eax
mov eax, ecx
and eax, 0x94460b6b
or ecx, 0x94460b6b
add eax, ecx
mov ecx, 0xe095852a
xor edx, edx
div ecx
cmp eax, 0x886b0db
jae 0x1401392d1
mov eax, dword [0x1401fa220]
mov edx, dword [0x1401fa224]
xor edx, 0xfa3dd568
mov ecx, eax
not ecx
or ecx, edx
add eax, ecx
imul eax, eax, 0x855fdde2
add eax, 0xbe582f31
mov dword [rbp - 0x3c], eax
mov eax, 0x10
call fcn.1401f0aa0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x48], rax
sub rsp, 0x20
call fcn.140167250
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x10]
add rsp, 0x20
mov r8, rax
mov eax, dword [rbp - 0x3c]
mov qword [rbp - 0x38], r8
mov r8, rcx
add r8, 8
mov qword [rbp - 0x30], r8
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x28], rcx
mov r8, rdx
add r8, 8
mov qword [rbp - 0x20], r8
cmp rcx, qword [rdx + 8]
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0x70fa8448
je 0x1401391ca
mov rax, qword [rbp - 0x28]
mov cl, byte [rbp - 0x11]
test cl, 1
mov qword [rbp - 0x50], rax
jne 0x1401392b3
jmp 0x140139271
mov rcx, qword [rbp - 0x48]
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.140138b00
mov rax, qword [rbp - 0x38]
add rsp, 0x20
mov al, byte [rax + 0x60]
mov cl, 0x74
xor cl, 0x74
cmp al, cl
jne 0x1401392cc
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp - 8]
mov r8, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x50]
mov r8, qword [r8]
mov qword [rdx], r8
mov qword [rax], rcx
mov rsp, rbp
pop rbp
ret
push rcx
invalid