joyce8/EMBER2024-capa huggingface dataset:
Function at 0x141b64058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x141b641df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141b64089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b6406f
add dl, dl
jne 0x141b64096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b640f6
xor eax, eax
add dl, dl
jne 0x141b640a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b641ad
add dl, dl
jne 0x141b640b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b640c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b640d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b640dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141b640ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141b6407e
mov eax, 1
add dl, dl
jne 0x141b64106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b64113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b640fb
sub eax, ebx
mov ebx, 1
jne 0x141b6414c
mov ecx, 1
add dl, dl
jne 0x141b6412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141b6413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b64123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b6407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141b64168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141b64175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b6415d
cmp eax, 0x7d00
jae 0x141b6419b
cmp eax, 0x500
jb 0x141b64196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b6407e
cmp eax, 0x7f
ja 0x141b6419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b6407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141b641d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141b6407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20

Function at 0x1415fbaa1
Capabilities:
Encode data using xor

Disassembly:
push 0x6f5300f1
call fcn.142b47fd1
stc
nop
sbb byte [r8 - 0x65f3950], r12b
test al, 0x4d
sub byte [rax - 0x6ff3990], ah
xor byte [rbp + 0x10], cl
movabs al, byte [0xa0404d80f978c698]
pop rax
invalid
Function at 0x140004064
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140004194

Function at 0x14003ca00
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14003ca0d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003ca1d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14003ca05
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14003ca35
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14003ca22
sub eax, 3
jb 0x14003ca4f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14003ca86
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14003ca76
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14003ca74
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14003ca63
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14003c9c2
jmp 0x14003ca0d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x23e00
mov dl, reloc.COMCTL32.dll_InitCommonControls
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14003cad2
cmp rsi, rcx
jae 0x14003cada
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14003cab9
cmp al, 0x8f
ja 0x14003cab9
cmp byte [rsi - 2], 0xf
je 0x14003cabf
sub al, 0xe8
cmp al, 1
ja 0x14003caa3
cmp rsi, rcx
jae 0x14003cada
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14003caa9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14003cada
lodsb al, byte [rsi]
jmp 0x14003cab9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x39000]
mov eax, dword [rdi]
or eax, eax
je 0x14003cb43
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x40f88]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14003cae7
jns 0x14003cb1c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14003cb26
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14003cb3d
mov qword [rbx], rax
add rbx, 8
jmp 0x14003cb07
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14003cb9b
sub rsp, 0xffffffffffffff80
jmp 0x1400242ac
Function at 0x14000d820
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rbx, qword [rcx + 8]
test rbx, rbx
je 0x14000dae9
mov r8d, 0xc7daf7c1
nop word cs:[rax + rax]
mov eax, dword [0x141f2d7e8]
xor edx, edx
div dword [0x141f2d7ec]
add eax, 0x550b4b75
imul rax, r8
shr rax, 0x3f
or eax, 0xe31b1220
cmp eax, 0xe627a514
ja 0x14000d850
mov qword [rsp + 0x20], rcx
mov r14, qword [rcx + 0x18]
test r14, r14
je 0x14000d9fc
mov rax, qword [rsp + 0x20]
mov r15, qword [rax]
movdqa xmm0, xmmword [r15]
pmovmskb r13d, xmm0
not r13d
lea r12, [r15 + 0x10]
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x14000d8b0
xor ebp, ebp
mov rsi, qword [0x1401082d0]
nop dword [rax]
test r13w, r13w
jne 0x14000d920
nop word cs:[rax + rax]
movdqa xmm0, xmmword [r12]
pmovmskb r13d, xmm0
add r15, 0xfffffffffffffc80
add r12, 0x10
cmp r13d, 0xffff
je 0x14000d8d0
nop
mov eax, dword [0x141f2d7f0]
sub eax, dword [0x141f2d7f4]
and eax, 0x7e8913b9
imul eax, eax, 0xe9fc61d1
add eax, 0x46146dfe
cmp eax, 0x89362681
jae 0x14000d8f0
not r13d
nop word cs:[rax + rax]
mov eax, dword [0x141f2d7f8]
or eax, dword [0x141f2d7fc]
shr eax, 2
imul rax, rax, 0x13ac97dd
shr rax, 0x35
imul eax, eax, 0xe64da28
cmp eax, 0xa1d3224b
ja 0x14000d920
tzcnt eax, r13d
neg rax
imul rax, rax, 0x38
lea rdi, [r15 + rax]
cmp qword [r15 + rax - 0x38], 0
je 0x14000d9b4
nop
test bpl, bpl
jne 0x14000d960
mov r8, qword [rdi - 0x30]
test bpl, bpl
jne 0x14000d99a
nop
mov eax, dword [0x141f2d800]
or eax, dword [0x141f2d804]
imul eax, eax, 0x1671863b
add eax, 0x9f036dae
or eax, 0xe0d433b8
mov rcx, qword [0x141f49060]
cmp eax, 0xa4ea5e7b
jae 0x14000d9b0
mov rax, qword [0x141f49060]
jmp 0x14000d970
xor edx, edx
call rsi
lea eax, [r13 - 1]
and eax, r13d
dec r14
mov r13d, eax
add rdi, 0xffffffffffffffe0
mov rcx, rdi
call fcn.14000f5c0
nop dword [rax]
mov eax, dword [0x141f2d808]
sub eax, dword [0x141f2d80c]
add eax, 0xd0aa5c21
xor eax, 0xd8b24769
imul eax, eax, 0x32f9bfb0
cmp eax, 0xa62ba0aa
je 0x14000d9d0
test r14, r14
jne 0x14000d8c0
lea rcx, [rbx + 1]
mov r8d, 0x38
nop word cs:[rax + rax]
mov r9d, dword [0x141f2d810]
and r9d, dword [0x141f2d814]
add r9d, 0xdd5db5be
xor r9d, 0x519ac304
add r9d, 0x8033c11e
mov rax, rcx
mul r8
cmp r9d, 0xa37af964
ja 0x14000da10
add rax, 0xf
and rax, 0xfffffffffffffff0
lea rcx, [rbx + rax]
add rcx, 0x11
nop word cs:[rax + rax]
mov edx, dword [0x141f2d818]
xor edx, dword [0x141f2d81c]
or edx, 0xf8fa45e4
and edx, 0xf8fbcfec
cmp edx, 0x4cf90902
je 0x14000da60
xor edx, edx
mov r8, qword [rsp + 0x20]
nop word [rax + rax]
test dl, dl
jne 0x14000da90
test rcx, rcx
je 0x14000dae9
mov r8, qword [r8]
sub r8, rax
mov rcx, qword [0x141f49060]
xor edx, edx
call qword [0x1401082d0]
mov eax, 0xc5de5a4f
nop word cs:[rax + rax]
mov ecx, dword [0x141f2d820]
imul ecx, dword [0x141f2d824]
imul ecx, ecx, 0x9c18b449
add ecx, 0xd66a66ec
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x5b2122f4
ja 0x14000dac0
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000db00
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
movzx eax, byte [rcx]
cmp eax, 0x12
je 0x14000dbc0
cmp eax, 0x13
je 0x14000dc70
nop dword [rax]
mov edx, dword [0x141f2d850]
add edx, dword [0x141f2d854]
xor edx, 0xfe3e457d
add edx, 0x71fec1df
and edx, 0x9d59a229
cmp edx, 0x157ffafe
jb 0x14000db20
cmp rax, 0x10
ja 0x14000dd59
lea rdx, [0x141f263c4]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov eax, dword [0x141f2d830]
or eax, dword [0x141f2d834]
and eax, 0xff0281f2
xor eax, 0x7197f79e
shr eax, 1
imul rax, rax, 0x219b0973
shr rax, 0x3b
cmp eax, 0xfca60537
ja 0x14000dbc0
nop word [rax + rax]
mov eax, dword [0x141f2d838]
and eax, dword [0x141f2d83c]
xor eax, 0x2164300
and eax, 0x9297d343
imul rdx, rax, 0x24f5dec3
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1e
cmp eax, 0x932cdc8e
ja 0x14000dbf0
mov rsi, qword [rcx + 8]
mov eax, dword [0x141f2d840]
or eax, dword [0x141f2d844]
mov rdi, qword [rsi]
and eax, 0x5c551779
add eax, 0x100b4eb9
cmp eax, 0x595a0659
jae 0x14000dc50
mov rcx, rsi
call qword [rdi + 0x10]
nop dword [rax + rax]
mov eax, dword [0x141f2d848]
or eax, dword [0x141f2d84c]
imul ebx, eax, 0xfd648476
mov rcx, rsi
call qword [rdi + 0x10]
cmp ebx, 0x6275ffdd
je 0x14000dc50
mov eax, dword [0x141f2d828]
imul eax, dword [0x141f2d82c]
add eax, 0x2427df22
and eax, 0x2ecb06fb
cmp eax, 0x11fa8017
ja 0x14000dc70
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rdx, qword [rcx + 8]
nop dword [rax]
mov eax, dword [0x141f2d858]
or eax, dword [0x141f2d85c]
xor eax, 0x6bfca80c
add eax, 0xe68d0cc5
and eax, 0x5f7a2ad0
cmp eax, 0x472d3636
ja 0x14000dd60
jmp 0x14000de04
mov eax, 0x10
test rdx, rdx
je 0x14000dc70
mov r8, qword [rcx + rax]
mov rcx, qword [0x141f49060]
xor edx, edx
call qword [0x1401082d0]
jmp 0x14000dc70
Function at 0x140016900
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
nop dword [rax + rax]
mov eax, dword [0x141f2eae0]
xor edx, edx
div dword [0x141f2eae4]
add eax, 0x20bf630d
cmp eax, 0xfaa2fc07
ja 0x140016910
mov rcx, qword [rsi + 0x10]
call qword [0x1401082b0]
test eax, eax
jne 0x140016940
call qword [0x1401082a8]
nop
mov eax, dword [0x141f2eae8]
xor eax, dword [0x141f2eaec]
or eax, 0x8220004
and eax, 0x9226026
cmp eax, 0xe1c1d7e
je 0x140016940
cmp rsi, 0xffffffffffffffff
je 0x140016a80
nop word [rax + rax]
mov eax, dword [0x141f2eaf0]
xor edx, edx
div dword [0x141f2eaf4]
and eax, 0xf5dc3b67
cmp eax, 0xb0e64e1e
je 0x140016970
mov eax, dword [0x141f2eaf8]
and eax, dword [0x141f2eafc]
xor eax, 0x1f35c9a
imul rcx, rax, 0xb8858f7
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
cmp eax, 0xb60d827c
jne 0x1400169c0
lock dec qword [rsi + 8]
nop dword [rax + rax]
mov ecx, dword [0x141f2eb00]
or ecx, dword [0x141f2eb04]
and ecx, 0x2233884
mov rax, 0xffffffffffffffff
lock xadd qword [rsi + 8], rax
cmp ecx, 0x2d5fb836
je 0x1400169c0
nop word [rax + rax]
mov ecx, dword [0x141f2eb08]
or ecx, dword [0x141f2eb0c]
or ecx, 0xb6a80106
imul ecx, ecx, 0x7c5c56ab
add ecx, 0xe80607ee
cmp ecx, 0x788b9fc0
jb 0x1400169f0
cmp rax, 1
jne 0x140016a80
mov eax, dword [0x141f2eb10]
sub eax, dword [0x141f2eb14]
add eax, 0xdebf0cde
mov ecx, 0xb55f0af7
imul rcx, rax
shr rcx, 0x3e
or ecx, 0xed1520c0
cmp ecx, 0x69a41872
jb 0x140016a6b
mov eax, dword [0x141f2eb18]
imul eax, dword [0x141f2eb1c]
and eax, 0x1cfeec52
add eax, 0x4a560bbe
or eax, 0xe4abac1b
cmp eax, 0xf9ef6d78
jbe 0x140016a6d
jmp 0x140016a48
mov rcx, qword [0x141f49060]
xor edx, edx
mov r8, rsi
call qword [0x1401082d0]
nop
mov eax, dword [0x141f2eb20]
or eax, dword [0x141f2eb24]
add eax, 0x3002a9fb
or eax, 0x6c437826
imul eax, eax, 0x1f499173
cmp eax, 0x5a713c2b
jb 0x140016a80
add rsp, 0x20
pop rsi
ret
Function at 0x1400179b0
Capabilities:
Encode data using xor

Disassembly:
inc rdx
nop word cs:[rax + rax]
mov eax, dword [0x141f2ed40]
xor eax, dword [0x141f2ed44]
and eax, 0x28563db8
xor eax, 0x98bcfb8a
imul rax, rax, 0x27478d4d
shr rax, 0x3c
cmp eax, 0xed5603fe
ja 0x1400179c0
mov rax, rdx
rol rax, 2
nop
mov r8d, dword [0x141f2ed48]
xor r8d, dword [0x141f2ed4c]
imul r8d, r8d, 0xce31055c
add r8d, 0x27aba758
cmp r8d, 0xad635a42
ja 0x1400179f0
xor eax, edx
movzx eax, ax
add rcx, rax
nop dword [rax]
mov eax, dword [0x141f2ed50]
xor edx, edx
div dword [0x141f2ed54]
imul eax, eax, 0x78e0b9f7
add eax, 0xed2b642e
xor eax, 0x166fb7c3
cmp eax, 0x690e1e2f
jb 0x140017a20
mov rax, rcx
ret

Function at 0x140017a50
Capabilities:
Encode data using xor

Disassembly:
movabs r9, 0xffffffff68a8408a
add r9, rdx
mov rax, rcx
mov r8d, 0x852c1627
mov rcx, r9
rol rcx, 5
xor rcx, r9
mov rdx, rcx
rol rdx, 7
nop word [rax + rax]
mov r9d, dword [0x141f2ed58]
xor r9d, dword [0x141f2ed5c]
imul r9d, r9d, 0x2856be5e
shr r9d, 1
imul r9, r8
shr r9, 0x3c
xor r9d, 0xb45c760f
cmp r9d, 0x53bfbead
jb 0x140017a80
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop dword [rax + rax]
mov ecx, dword [0x141f2ed60]
sub ecx, dword [0x141f2ed64]
add ecx, 0xbf07dd11
xor ecx, 0xe3a69b33
add ecx, 0x5849ee34
cmp ecx, 0x1a5ae865
jb 0x140017ac0
ret

Function at 0x140017b80
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov r8, rdx
rol r8, 4
xor r8, rdx
mov rcx, r8
rol rcx, 1
xor rcx, r8
mov rdx, rcx
rol rdx, 2
nop dword [rax]
mov r8d, dword [0x141f2ed70]
xor r8d, dword [0x141f2ed74]
xor r8d, 0xcc994abb
add r8d, 0x72f999c9
or r8d, 0xe868b50
cmp r8d, 0x3af1d00
je 0x140017ba0
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x140018190
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
rol rcx, 1
xor rcx, rdx
nop dword [rax]
mov edx, dword [0x141f2ee08]
xor edx, dword [0x141f2ee0c]
imul rdx, rdx, 0x23dd07fd
shr rdx, 0x3c
add edx, 0x699f220e
and edx, 0x408a2010
cmp edx, 0xc568a819
je 0x1400181a0
mov r8d, 0xc60ffc03
mov rdx, rcx
rol rdx, 5
xor rdx, rcx
mov rcx, rdx
rol rcx, 1
nop word cs:[rax + rax]
mov r9d, dword [0x141f2ee10]
sub r9d, dword [0x141f2ee14]
or r9d, 0xcb2eb039
imul r9d, r9d, 0xf6b01cff
imul r9, r8
shr r9, 0x3e
cmp r9d, 0xb66dd365
ja 0x1400181f0
xor ecx, edx
movzx ecx, cx
add rax, rcx
ret

Function at 0x1400184c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
rol rcx, 3
xor rcx, rdx
nop dword [rax]
mov edx, dword [0x141f2ee58]
and edx, dword [0x141f2ee5c]
or edx, 0x31ab5f27
add edx, 0xe7df5b66
and edx, 0xba116380
cmp edx, 0x988b8562
ja 0x1400184d0
add rcx, 0xffffffffeb98a398
mov rdx, rcx
rol rdx, 7
nop word cs:[rax + rax]
mov r8d, dword [0x141f2ee60]
or r8d, dword [0x141f2ee64]
imul r8d, r8d, 0x84cc33e
and r8d, 0x9188c4f0
xor r8d, 0x82df759e
cmp r8d, 0x122f412d
jb 0x140018510
nop dword [rax]
mov r8d, dword [0x141f2ee68]
sub r8d, dword [0x141f2ee6c]
add r8d, 0xc4f327f
xor r8d, 0x5b02eda3
add r8d, 0x5fa9e752
cmp r8d, 0xcd6aa3af
ja 0x140018540
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret
Function at 0x140018c00
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov r8, rdx
shr r8, 0x16
xor r8, rdx
xor r8, 0x40a3e2b7
add r8, 0x4211439b
mov rcx, r8
rol rcx, 2
xor rcx, r8
movzx ecx, cx
nop dword [rax + rax]
mov edx, dword [0x141f2ef10]
or edx, dword [0x141f2ef14]
xor edx, 0x1001a42
or edx, 0xeeffe5b5
cmp edx, 0x73220b1c
jb 0x140018c30
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141f2ef18]
xor ecx, dword [0x141f2ef1c]
imul rcx, rcx, 0x696df18b
shr rcx, 0x3e
add ecx, 0xa4148fc3
cmp ecx, 0xd7b104f0
ja 0x140018c60
ret

Function at 0x140018c90
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0x2b97f889
lea rcx, [rdx + 1]
nop
mov r8d, dword [0x141f2ef20]
imul r8d, dword [0x141f2ef24]
add r8d, 0x8097d083
xor r8d, 0x2f000f39
cmp r8d, 0xcd90d1
jb 0x140018ca0
shr rcx, 8
mov r8, 0xfffffffffffffffe
sub r8, rdx
xor r8, rcx
mov rcx, r8
rol rcx, 2
xor ecx, r8d
movzx ecx, cx
add rax, rcx
nop word [rax + rax]
mov ecx, dword [0x141f2ef28]
and ecx, dword [0x141f2ef2c]
add ecx, 0x380b0d1d
xor ecx, 0x69855643
imul rcx, rcx, 0x1b9f85ab
shr rcx, 0x3c
cmp ecx, 0x4c52568e
ja 0x140018cf0
ret

Function at 0x140019010
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
rol r8, 5
mov rax, rcx
xor r8, rdx
mov ecx, 0x9f9e7a91
add r8, 0x50c75ec5
mov rdx, r8
rol rdx, 1
xor rdx, r8
nop word cs:[rax + rax]
mov r8d, dword [0x141f2efa0]
or r8d, dword [0x141f2efa4]
add r8d, 0x59bedd8f
xor r8d, 0x52ecae1a
imul r8, rcx
shr r8, 0x3e
cmp r8d, 0xdf87d12c
ja 0x140019040
movzx ecx, dx
add rax, rcx
ret

Function at 0x140019200
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x141f2efd0]
xor edx, edx
div dword [0x141f2efd4]
mov rax, 0xffffffffdd256472
sub rax, r8
xor rax, 0x44198fa
imul rax, rax, 0xffffffffe86799cc
add rax, 0xffffffffe86799cc
nop
mov edx, dword [0x141f2efd8]
or edx, dword [0x141f2efdc]
xor edx, 0x8218c000
and edx, 0x8318c000
cmp edx, 0x26401432
jb 0x140019230
mov rdx, rax
rol rdx, 4
xor edx, eax
movzx eax, dx
add rcx, rax
nop
mov eax, dword [0x141f2efe0]
xor edx, edx
div dword [0x141f2efe4]
imul eax, eax, 0xe99c6696
add eax, 0xaa08504
cmp eax, 0x3deec660
ja 0x140019260
mov rax, rcx
ret

Function at 0x1400193d0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov r9, rdx
rol r9, 4
nop word [rax + rax]
mov eax, dword [0x141f2f000]
xor edx, edx
div dword [0x141f2f004]
or eax, 0x8e6b00a
imul eax, eax, 0x14267d58
and eax, 0x8543fd78
cmp eax, 0x1a508332
jb 0x1400193e0
xor r9, r8
mov rax, r9
rol rax, 1
xor rax, r9
mov r8, 0xffffffffbb77fe50
sub r8, rax
mov r9, r8
rol r9, 4
nop word cs:[rax + rax]
mov eax, dword [0x141f2f008]
xor edx, edx
div dword [0x141f2f00c]
xor eax, 0xb0538cf7
imul eax, eax, 0xbfc1c9a5
xor eax, 0xc47223c2
cmp eax, 0xf0e62f91
ja 0x140019430
xor r9d, r8d
movzx eax, r9w
add rcx, rax
mov rax, rcx
ret
Function at 0x1400198f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
shr rcx, 0x1c
xor r8d, r8d
nop dword [rax]
test r8b, r8b
jne 0x140019900
xor rcx, rdx
mov rdx, rcx
xor rdx, 0xc48577c
rol rdx, 7
nop word cs:[rax + rax]
mov r8d, dword [0x141f2f088]
xor r8d, dword [0x141f2f08c]
add r8d, 0x25b00296
or r8d, 0xa6ef2091
add r8d, 0x1e7f0e08
cmp r8d, 0x2b9b4a30
jb 0x140019920
xor rcx, rdx
xor rcx, 0xffffffffa853c8e8
mov rdx, rcx
rol rdx, 3
nop dword [rax]
mov r8d, dword [0x141f2f090]
and r8d, dword [0x141f2f094]
add r8d, 0x47c23f0
cmp r8d, 0xaed5db27
ja 0x140019960
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x14001a030
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
shr rax, 0xf
xor rax, rdx
imul rax, rax, 0x2b930655
not rax
mov r8, rax
rol r8, 4
xor r8, rax
mov r9, r8
rol r9, 1
nop word cs:[rax + rax]
mov eax, dword [0x141f2f148]
xor edx, edx
div dword [0x141f2f14c]
xor eax, 0x86083552
add eax, 0x89a6112b
cmp eax, 0xbdd399d7
ja 0x14001a060
xor r9d, r8d
movzx eax, r9w
add rcx, rax
mov rax, rcx
ret

Function at 0x14001a110
Capabilities:
Encode data using xor

Disassembly:
xor rdx, 0x6507d0ab
add rdx, 0x70382c0f
mov rax, rdx
shr rax, 0x14
xor rax, rdx
mov rdx, rax
rol rdx, 3
xor edx, eax
movzx eax, dx
add rax, rcx
nop word [rax + rax]
mov ecx, dword [0x141f2f158]
sub ecx, dword [0x141f2f15c]
imul ecx, ecx, 0xa8dcec3a
xor ecx, 0x4329228c
imul ecx, ecx, 0x9201c014
cmp ecx, 0x843a972
jb 0x14001a140
ret

Function at 0x14001a220
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
not rdx
mov rcx, rdx
shr rcx, 0xe
xor rcx, rdx
mov rdx, rcx
shr rdx, 6
xor rdx, rcx
imul rdx, rdx, 0xc197ff8
mov rcx, rdx
rol rcx, 5
nop dword [rax + rax]
mov r8d, dword [0x141f2f178]
add r8d, dword [0x141f2f17c]
xor r8d, 0xc0b902b0
and r8d, 0xe0bf3ab5
xor r8d, 0x7e585a8b
cmp r8d, 0x9263c016
ja 0x14001a250
mov r8d, 0xbb4efe87
xor rcx, rdx
nop word cs:[rax + rax]
mov edx, dword [0x141f2f180]
imul edx, dword [0x141f2f184]
or edx, 0x9ff16f7a
imul rdx, r8
shr rdx, 0x3e
cmp edx, 0x5cba6394
ja 0x14001a290
movzx ecx, cx
add rax, rcx
ret

Function at 0x14001a390
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
shr rax, 1
xor rax, rdx
mov rdx, rax
rol rdx, 1
xor rdx, rax
mov rax, rdx
rol rax, 7
xor rax, rdx
xor edx, edx
nop
test dl, dl
jne 0x14001a3b0
neg rax
mov rdx, rax
rol rdx, 1
xor edx, eax
movzx eax, dx
add rcx, rax
nop word cs:[rax + rax]
mov eax, dword [0x141f2f198]
xor edx, edx
div dword [0x141f2f19c]
or eax, 0x810104
xor eax, 0x141001
and eax, 0x6955d05
cmp eax, 0xa6ddc494
ja 0x14001a3d0
mov rax, rcx
ret

Function at 0x14001a400
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
add rdx, 0x148d8bce
xor rdx, 0xffffffffe664e7bc
mov rcx, rdx
shr rcx, 0xc
xor rcx, rdx
mov rdx, rcx
rol rdx, 6
nop word cs:[rax + rax]
mov r8d, dword [0x141f2f1a0]
xor r8d, dword [0x141f2f1a4]
add r8d, 0xb6c308f
or r8d, 0x126759
add r8d, 0xd583fee8
cmp r8d, 0x4b2312ee
jb 0x14001a430
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret
Function at 0x14001a9c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, 0xffffffff8adfc54d
sub rax, rdx
nop word [rax + rax]
mov edx, dword [0x141f2f230]
or edx, dword [0x141f2f234]
imul edx, edx, 0xed759b60
add edx, 0x9b1da9c0
xor edx, 0x93bd9ddd
cmp edx, 0x94f66871
ja 0x14001a9d0
imul r8, rax, 0x464ed3db
nop dword [rax]
mov eax, dword [0x141f2f238]
xor edx, edx
div dword [0x141f2f23c]
imul rdx, rax, 0xea56a8f
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
or eax, 0xc7840352
cmp eax, 0x480b377d
jb 0x14001aa00
not r8
mov rax, r8
rol rax, 2
xor eax, r8d
movzx eax, ax
add rcx, rax
mov rax, rcx
ret

Function at 0x14001aad0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, 0x5d081d2d
sub rcx, rdx
mov rdx, rcx
shr rdx, 0x14
xor rdx, rcx
imul rcx, rdx, 0xffffffff90b9a0b9
add rcx, 0x11fb624e
mov rdx, rcx
rol rdx, 2
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141f2f248]
xor ecx, dword [0x141f2f24c]
imul ecx, ecx, 0x901e3a40
cmp ecx, 0x4844111e
jb 0x14001ab10
ret

Function at 0x14001ae40
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, 0x69874d36
sub rcx, rdx
mov rdx, rcx
shr rdx, 4
xor rdx, rcx
mov r8, rdx
shr r8, 0x18
xor r8, rdx
mov rcx, r8
rol rcx, 5
xor rcx, r8
nop dword [rax]
mov edx, dword [0x141f2f290]
add edx, dword [0x141f2f294]
and edx, 0x2ba5b022
add edx, 0x3a0d7bac
xor edx, 0x399f1f6
cmp edx, 0xc2126fef
ja 0x14001ae70
movzx ecx, cx
add rax, rcx
nop dword [rax]
mov ecx, dword [0x141f2f298]
sub ecx, dword [0x141f2f29c]
xor ecx, 0x63b62181
add ecx, 0x5d551448
cmp ecx, 0x4c9dc7e2
jb 0x14001aea0
ret