joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019ab0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov r8, 0xffffffffdf6819da
sub r8, rdx
mov rcx, r8
shr rcx, 6
xor rcx, r8
add rcx, 0xffffffffd3868f39
mov rdx, rcx
rol rdx, 4
nop word cs:[rax + rax]
mov r8d, dword [0x141dc1ec0]
or r8d, dword [0x141dc1ec4]
cmp r8d, 0x9f53a08d
je 0x140019ae0
nop word [rax + rax]
mov r8d, dword [0x141dc1ec8]
or r8d, dword [0x141dc1ecc]
xor r8d, 0x3f2134
imul r8d, r8d, 0xcc647aa3
or r8d, 0x2526ee4
cmp r8d, 0xc549c00c
je 0x140019b00
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x140019c90
Capabilities:
Encode data using xor

Disassembly:
inc rdx
mov rax, rdx
rol rax, 1
xor rax, rdx
add rax, 0xffffffff98682c96
mov rdx, rax
rol rdx, 5
xor edx, eax
movzx r8d, dx
mov eax, dword [0x141dc1ee8]
xor edx, edx
div dword [0x141dc1eec]
add rcx, r8
mov eax, dword [str.Q7Y_]
xor eax, dword [0x141dc1ef4]
add eax, 0x7ffd3786
and eax, 0x47e8a6a7
imul eax, eax, 0xe5dfc083
cmp eax, 0x74ab15c1
jb 0x140019cc0
mov rax, rcx
ret

Function at 0x140019cf0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov r8, rdx
not r8
rol r8, 4
xor r8, rdx
mov rcx, r8
rol rcx, 5
xor rcx, r8
mov rdx, rcx
rol rdx, 2
nop word cs:[rax + rax]
mov r8d, dword [0x141dc1ef8]
xor r8d, dword [0x141dc1efc]
xor r8d, 0x5eb4883c
imul r8, r8, 0x3972771b
shr r8, 0x3c
imul r8d, r8d, 0xbf5297
cmp r8d, 0x1cc2a38f
ja 0x140019d20
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop dword [rax + rax]
mov ecx, dword [0x141dc1f00]
sub ecx, dword [0x141dc1f04]
add ecx, 0xe527ed45
cmp ecx, 0xf465351a
ja 0x140019d60
ret

Function at 0x14001a040
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, 0x5c4125e3
sub rcx, rdx
xor rcx, 0x373f6b78
nop word cs:[rax + rax]
mov edx, dword [0x141dc1f48]
imul edx, dword [0x141dc1f4c]
imul edx, edx, 0xd1cce4fb
or edx, 0xeeaf041a
cmp edx, 0x7592f778
jb 0x14001a060
mov rdx, rcx
rol rdx, 6
nop dword [rax + rax]
mov r8d, dword [0x141dc1f50]
add r8d, dword [0x141dc1f54]
and r8d, 0xa0b97a59
xor r8d, 0x9fd8403d
add r8d, 0x868b448c
cmp r8d, 0x8d5113bc
ja 0x14001a090
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x14001a190
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
imul rcx, rdx, 0xffffffffb23bcb98
mov rdx, rcx
shr rdx, 8
xor rdx, rcx
mov ecx, 0x6012ee2c
sub rcx, rdx
mov rdx, rcx
rol rdx, 2
nop word cs:[rax + rax]
mov r8d, dword [0x141dc1f68]
xor r8d, dword [0x141dc1f6c]
add r8d, 0xb71e60b9
and r8d, 0xf71a75ff
cmp r8d, 0xdc904347
je 0x14001a1c0
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x14001a1f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rdx
shr rax, 9
xor rax, rdx
imul rax, rax, 0x67fcfa6f
movabs rdx, 0x33c9f48c6c6988ec
add rdx, rax
mov rax, rdx
shr rax, 0x1c
xor rax, rdx
mov r8, rax
rol r8, 1
xor r8, rax
mov eax, dword [0x141dc1f70]
xor edx, edx
div dword [0x141dc1f74]
movzx eax, r8w
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141dc1f78]
sub ecx, dword [0x141dc1f7c]
add ecx, 0xd93e4c6e
xor ecx, 0x18e4a566
cmp ecx, 0x4036ea73
jb 0x14001a240
ret
Function at 0x14001a450
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
add r8, 0xffffffffdc3d715b
nop word [rax + rax]
mov eax, dword [0x141dc1fb0]
and eax, dword [0x141dc1fb4]
imul rax, rax, 0x4903c0fd
shr rax, 0x3e
imul eax, eax, 0xed4044dd
and eax, 0x59fb5add
cmp eax, 0x12358d54
je 0x14001a460
mov r9d, 0xa9778505
xor r8, 0xffffffff821c43dc
nop word cs:[rax + rax]
mov eax, dword [0x141dc1fb8]
xor edx, edx
div dword [0x141dc1fbc]
imul rax, r9
shr rax, 0x3f
or eax, 0xeeecaca4
cmp eax, 0xa0dab065
jb 0x14001a4a0
mov rax, r8
rol rax, 2
nop dword [rax]
mov edx, dword [0x141dc1fc0]
xor edx, dword [0x141dc1fc4]
imul edx, edx, 0xf466bab4
add edx, 0x7e04b1f7
or edx, 0x4a89e16c
cmp edx, 0xd22d1faa
je 0x14001a4d0
xor eax, r8d
movzx eax, ax
add rcx, rax
mov rax, rcx
ret

Function at 0x14001a6a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
movabs rcx, 0xec460a95df698d7c
mov r9d, 0xa599c003
imul rdx, rcx
mov r8, rdx
rol r8, 4
xor r8, rdx
mov rcx, r8
rol rcx, 5
nop dword [rax + rax]
mov edx, dword [0x141dc1ff0]
add edx, dword [0x141dc1ff4]
imul rdx, rdx, 0x624d524f
shr rdx, 0x3e
imul edx, edx, 0xf9e400a2
mov r10, rdx
imul r10, r9
shr r10, 0x20
sub edx, r10d
shr edx, 1
add edx, r10d
shr edx, 0x1d
cmp edx, 0x1adc8450
ja 0x14001a6d0
xor rcx, r8
nop
mov edx, dword [0x141dc1ff8]
and edx, dword [0x141dc1ffc]
add edx, 0xe81af303
imul rdx, rdx, 0x3b79af89
shr rdx, 0x3d
or edx, 0x7cc96ca4
cmp edx, 0x1f9e050d
jb 0x14001a710
movzx ecx, cx
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141dc2000]
or ecx, dword [0x141dc2004]
xor ecx, 0x4f47a0cf
imul rcx, rcx, 0x6e42b4f9
shr rcx, 0x3e
imul ecx, ecx, 0xcde1a8c2
cmp ecx, 0x73da0c3d
je 0x14001a750
ret

Function at 0x14001a780
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
rol rcx, 5
xor rcx, rdx
nop dword [rax]
mov edx, dword [0x141dc2008]
and edx, dword [0x141dc200c]
xor edx, 0x1a5d268a
imul edx, edx, 0x5e1311b2
cmp edx, 0x654ee9cb
je 0x14001a790
mov rdx, rcx
rol rdx, 3
xor rdx, rcx
mov ecx, 0x5955ab6c
sub rcx, rdx
mov rdx, rcx
rol rdx, 1
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x14001a7e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
shr rcx, 2
xor rcx, rdx
imul rcx, rcx, 0x73c5c8e8
nop word cs:[rax + rax]
mov edx, dword [0x141dc2010]
and edx, dword [0x141dc2014]
and edx, 0x3c4f426f
imul edx, edx, 0xe6cacab
add edx, 0x7230baf7
cmp edx, 0x2e435492
jb 0x14001a800
add rcx, 0x1f3e11f8
mov rdx, rcx
rol rdx, 1
nop word cs:[rax + rax]
mov r8d, dword [0x141dc2018]
xor r8d, dword [0x141dc201c]
imul r8d, r8d, 0x705cd5d0
cmp r8d, 0x7e81bd09
je 0x14001a840
xor edx, ecx
and edx, 0xfff9
add rax, rdx
ret

Function at 0x14001a870
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0xffffffffe1e26758
mov r8, rdx
shr r8, 0x12
xor r8, rdx
mov rcx, r8
shr rcx, 0x14
xor rcx, r8
nop
mov edx, dword [0x141dc2020]
sub edx, dword [0x141dc2024]
add edx, 0xd1c1dee2
xor edx, 0x4214704
and edx, 0xc6d4764
cmp edx, 0x9d21085d
ja 0x14001a890
mov rdx, rcx
rol rdx, 5
xor rdx, rcx
mov rcx, rdx
rol rcx, 2
xor ecx, edx
movzx ecx, cx
add rax, rcx
ret
Function at 0x14001a900
Capabilities:
Encode data using xor

Disassembly:
movabs r8, 0xfc8671e7a54d19d8
mov rax, rcx
imul rcx, rdx, 0xffffffffd93052dd
add rcx, r8
xor rcx, 0xffffffffb7eadb00
mov rdx, rcx
rol rdx, 2
nop word cs:[rax + rax]
mov r8d, dword [0x141dc2028]
or r8d, dword [0x141dc202c]
imul r8d, r8d, 0x711b4dc7
imul r8, r8, 0x4365da63
shr r8, 0x3e
imul r8d, r8d, 0xc64ada52
cmp r8d, 0x3c253d81
je 0x14001a930
mov r8d, dword [0x141dc2030]
imul r8d, dword [0x141dc2034]
add r8d, 0x26a9dab5
xor r8d, 0x1418ff62
add r8d, 0x6268e
cmp r8d, 0x5153ea54
ja 0x14001a960
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x14001aaa0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
imul rdx, rdx, 0xffffffffb361bc45
add rdx, 0x4c9e43bb
mov rcx, rdx
rol rcx, 7
xor rcx, rdx
mov rdx, rcx
rol rdx, 5
nop word cs:[rax + rax]
mov r8d, dword [0x141dc2058]
xor r8d, dword [0x141dc205c]
or r8d, 0xce2be420
xor r8d, 0x4e900518
cmp r8d, 0x71dddcb2
jb 0x14001aad0
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x14001ab90
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
not rdx
imul rdx, rdx, 0xffffffffd8aacb23
xor rdx, 0xffffffffd5764a6d
mov rcx, rdx
rol rcx, 5
xor rcx, rdx
mov rdx, rcx
rol rdx, 1
nop word cs:[rax + rax]
mov r8d, dword [0x141dc2070]
xor r8d, dword [0x141dc2074]
imul r8, r8, 0x71729279
shr r8, 0x3d
add r8d, 0x3dd8d353
cmp r8d, 0x17d819aa
jb 0x14001abc0
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x14001ac20
Capabilities:
Encode data using xor

Disassembly:
movabs r8, 0x2dcc28dadfa5e889
imul rax, rdx, 0x7bf43e37
add rax, r8
nop word cs:[rax + rax]
mov edx, dword [0x141dc2078]
or edx, dword [0x141dc207c]
or edx, 0x71a91b54
imul edx, edx, 0x73fefd3e
cmp edx, 0xc0414a75
ja 0x14001ac40
mov r8, rax
rol r8, 3
xor r8, rax
nop word [rax + rax]
mov eax, dword [0x141dc2080]
xor edx, edx
div dword [0x141dc2084]
and eax, 0xb1da9b8
xor eax, 0x303aab83
add eax, 0xf76b7526
cmp eax, 0xef9d58d3
ja 0x14001ac70
movzx eax, r8w
add rcx, rax
mov rax, rcx
ret
Function at 0x14001aca0
Capabilities:
Encode data using xor
Set registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov r13, r9
mov rsi, r8
mov r12, rdx
mov eax, dword [0x141dc2088]
imul eax, dword [0x141dc208c]
mov rdi, rcx
and eax, 0x3e80c80
imul eax, eax, 0xfff204c6
cmp eax, 0x8b2ba530
je 0x14001ad15
mov eax, dword [0x141dc2090]
xor eax, dword [0x141dc2094]
imul ecx, eax, 0x7be89186
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov r14, rsp
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov r15, rsp
cmp ecx, 0x29d14368
jne 0x14001ad31
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
jmp 0x14001acdb
mov eax, dword [0x141dc2098]
xor eax, dword [0x141dc209c]
or eax, 0x12fed4b9
add eax, 0x49ae3521
cmp eax, 0x61f753ea
jbe 0x14001ad55
movzx eax, byte [0x141ddb278]
xor eax, eax
nop word [rax + rax]
movzx ecx, byte [0x141ddb278]
test al, al
jne 0x14001ad60
sub rsp, 0x20
mov edx, 4
xor ecx, ecx
call fcn.1400c0180
add rsp, 0x20
test rax, rax
je 0x14001af3f
mov rbx, rax
mov eax, dword [r13]
mov dword [rbx], eax
add rsi, r12
mov eax, dword [0x141dc20a0]
and eax, dword [0x141dc20a4]
mov qword [r14], r12
add eax, 0x6418cbb1
or eax, 0x2dd7a10d
cmp eax, 0xec34e1e5
jbe 0x14001ae05
mov qword [r14 + 8], rsi
mov word [r14 + 0x10], 0
mov dword [r14 + 0x18], 1
sub rsp, 0x20
mov rcx, r15
mov rdx, r14
call fcn.140083250
add rsp, 0x20
mov rdx, qword [r15 + 8]
sub rsp, 0x30
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 4
mov rcx, rdi
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x30
mov qword [rbp], rdi
mov rdi, rbx
mov rbx, rsi
nop
mov eax, dword [0x141dc20a8]
imul eax, dword [0x141dc20ac]
imul esi, eax, 0x404d5c38
add esi, 0xb5b1d4f5
mov qword [r14 + 8], rbx
mov word [r14 + 0x10], 0
mov dword [r14 + 0x18], 1
sub rsp, 0x20
mov rcx, r15
mov rdx, r14
call fcn.140083250
add rsp, 0x20
mov r13, qword [r15 + 8]
sub rsp, 0x30
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 4
mov rcx, qword [rbp]
mov rdx, r13
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x30
cmp esi, 0xee7a2327
ja 0x14001ae10
mov r12d, eax
cmp qword [r15], 0
je 0x14001aefd
mov eax, dword [0x141dc20b0]
xor edx, edx
div dword [0x141dc20b4]
or eax, 0xb6fd7b9b
xor eax, 0xa84ef1d1
cmp eax, 0x8a810357
jbe 0x14001aec0
mov rax, qword [0x141ddb260]
nop word cs:[rax + rax]
mov eax, dword [0x141dc20b8]
and eax, dword [0x141dc20bc]
imul eax, eax, 0xd90e2cdb
add eax, 0xc047a0da
xor eax, 0x98f90da4
mov rcx, qword [0x141ddb260]
cmp eax, 0xcf763ede
ja 0x14001aec0
sub rsp, 0x20
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov rcx, qword [0x141ddb260]
sub rsp, 0x20
xor esi, esi
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov rax, r12
shl rax, 0x20
or rax, 2
test r12d, r12d
cmovne rsi, rax
mov rax, rsi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
ud2
Function at 0x140038140
Capabilities:
Encode data using xor

Disassembly:
mov r8, rcx
nop word cs:[rax + rax]
mov eax, dword [0x141dc4b90]
add eax, dword [0x141dc4b94]
xor eax, 0xb6ac192f
imul eax, eax, 0x74065878
cmp eax, 0x56e50c54
jb 0x140038150
xor eax, eax
test al, al
jne 0x140038170
cmp rdx, 0x11
jb 0x1400381ae
mov eax, 0x836750bd
nop
mov ecx, dword [0x141dc4b98]
mov edx, dword [0x141dc4b9c]
add ecx, edx
add ecx, 0x82d2607c
imul rcx, rax
shr rcx, 0x3f
or ecx, 0xca95ca18
cmp ecx, 0xab2c64e9
jb 0x140038180
mov r8, qword [r8 - 8]
mov rcx, qword [0x141ddb260]
xor edx, edx
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
Function at 0x1400420e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x141dc5770]
sub eax, dword [0x141dc5774]
mov r8, rcx
imul eax, eax, 0x7ced14bf
or eax, 0xd9b23f18
cmp eax, 0x77c159c7
jne 0x140042110
mov eax, 1
xor ecx, ecx
mov r9, rbx
cpuid
xchg rbx, r9
mov r10d, dword [0x141dc5778]
and r10d, dword [0x141dc577c]
mov eax, 1
mov ecx, 0
mov r9, rbx
cpuid
xchg rbx, r9
or r10d, 0x42883228
and r10d, 0x438f33ae
cmp r10d, 0x8c233057
je 0x140042110
nop word [rax + rax]
mov r10d, dword [0x141dc5780]
add r10d, dword [0x141dc5784]
xor r10d, 0x6a39284e
add r10d, 0xca1bd4af
or r10d, 0xa71a435a
cmp r10d, 0x8b40fa7e
je 0x140042150
mov dword [r8], eax
mov dword [r8 + 4], r9d
mov dword [r8 + 8], ecx
mov dword [r8 + 0xc], edx
ret
Function at 0x1400538b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, r9
mov ebp, r8d
mov rsi, rdx
mov r14, rcx
mov rbx, qword [rsp + 0x80]
mov eax, dword [0x141dc7a98]
xor edx, edx
div dword [0x141dc7a9c]
and eax, 0xddc7de99
cmp eax, 0x9dc1d60a
je 0x1400538d0
cmp ebp, 0x110000
je 0x140053960
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x140053900
xor eax, eax
test al, al
je 0x140053920
mov rcx, r14
mov edx, ebp
call qword [rsi + 0x20]
nop word cs:[rax + rax]
mov eax, dword [0x141dc7aa0]
add eax, dword [0x141dc7aa4]
imul r15d, eax, 0x65fe87e2
or r15d, 0xde638699
and r15d, 0xffeb87f9
mov rcx, r14
mov edx, ebp
call qword [rsi + 0x20]
cmp r15d, 0x35f5b5ec
jb 0x140053920
mov cl, 1
test al, al
jne 0x140053a00
nop dword [rax]
mov eax, dword [0x141dc7aa8]
xor eax, dword [0x141dc7aac]
or eax, 0x12491a5f
xor eax, 0xf992ca68
imul eax, eax, 0x2b2232ad
cmp eax, 0xb2f636f9
jb 0x140053960
test rdi, rdi
je 0x1400539f3
nop dword [rax + rax]
mov eax, dword [0x141dc7ab8]
or eax, dword [0x141dc7abc]
or eax, 0xd6d4879a
xor eax, 0xeb710bf5
imul rax, rax, 0x24713f3b
shr rax, 0x3a
cmp eax, 0x7ea2aaba
ja 0x140053990
nop dword [rax + rax]
mov eax, dword [0x141dc7ac0]
imul eax, dword [0x141dc7ac4]
or eax, 0x3709f3bf
add eax, 0xeba18f13
or eax, 0xbae04748
cmp eax, 0x56e1e684
jb 0x1400539c0
mov rcx, r14
mov rdx, rdi
mov r8, rbx
call qword [rsi + 0x18]
mov ecx, eax
jmp 0x140053a00
xor ecx, ecx
nop word cs:[rax + rax]
mov eax, dword [0x141dc7ab0]
xor edx, edx
div dword [0x141dc7ab4]
imul eax, eax, 0xfab8bca9
add eax, 0x88567b47
and eax, 0x977dc151
cmp eax, 0xc7742378
je 0x140053a00
mov eax, ecx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14005d440
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov r8b, 1
test rdx, rdx
je 0x14005d477
mov r9, rdx
cmp rdx, 1
jne 0x14005d47f
movzx eax, byte [rcx]
mov r10b, 1
cmp eax, 0x2b
je 0x14005d75b
mov r11d, 1
cmp eax, 0x2d
je 0x14005d75b
jmp 0x14005d550
xor r10d, r10d
jmp 0x14005d75b
movzx eax, byte [rcx]
nop word cs:[rax + rax]
mov edx, dword [0x141dc8ef8]
and edx, dword [0x141dc8efc]
imul edx, edx, 0xfd2ae4e5
or edx, 0xcfc3d75c
imul rdx, rdx, 0x8af6603
shr rdx, 0x3b
cmp edx, 0xc735181d
je 0x14005d490
nop dword [rax + rax]
mov edx, dword [str.KCxN]
and edx, dword [0x141dc8f04]
add edx, 0x892dda6
or edx, 0x64a4c130
and edx, 0xf4a5d772
cmp edx, 0x5f643e4c
jb 0x14005d4c0
cmp al, 0x2b
jne 0x14005d4ff
inc rcx
lea r11, [r9 - 1]
cmp r9, 4
mov r9, r11
jb 0x14005d550
jmp 0x14005d60d
mov eax, 0x830a5ba3
nop word cs:[rax + rax]
mov edx, dword [0x141dc8ef0]
or edx, dword [0x141dc8ef4]
imul edx, edx, 0x728716cc
imul rdx, rax
shr rdx, 0x3f
cmp edx, 0xeb128ef7
ja 0x14005d510
mov r11d, 2
cmp r9, 3
jae 0x14005d60d
nop word cs:[rax + rax]
mov eax, dword [0x141dc8ee8]
add eax, dword [str.G_76_7AA]
or eax, 0xfffeaff3
and eax, 0xfffeaff7
cmp eax, 0xc11c728b
jb 0x14005d550
xor r10d, r10d
movzx r9d, byte [rcx]
add r9d, 0xffffffd0
cmp r9d, 0xa
setae r8b
jae 0x14005d709
mov eax, dword [0x141dc8f28]
xor edx, edx
div dword [0x141dc8f2c]
nop word cs:[rax + rax]
mov eax, dword [0x141dc8f30]
mov edx, dword [0x141dc8f34]
add eax, edx
add eax, 0xd3447607
or eax, 0xa9922250
and eax, 0xb996e659
cmp eax, 0xe92d3be
jb 0x14005d5a0
movzx eax, r10b
add eax, eax
dec r11
lea r10d, [rax + rax*4]
nop word cs:[rax + rax]
mov eax, dword [0x141dc8f38]
and eax, dword [0x141dc8f3c]
imul eax, eax, 0x1f220c25
cmp eax, 0xd54cc86b
je 0x14005d5e0
inc rcx
add r10b, r9b
test r11, r11
jne 0x14005d570
jmp 0x14005d75b
xor r10d, r10d
mov bl, 0xa
nop word cs:[rax + rax]
add r9, 0xffffffffffffffff
setb sil
jae 0x14005d70e
nop
mov edx, dword [0x141dc8f08]
or edx, dword [0x141dc8f0c]
xor edx, 0x6f102d16
add edx, 0x53d5e63
and edx, 0xf83067b9
mov eax, r10d
mul bl
mov r11d, eax
seto al
cmp edx, 0x10e11ebd
je 0x14005d630
nop word cs:[rax + rax]
mov edx, dword [0x141dc8f10]
sub edx, dword [0x141dc8f14]
or edx, 0x46155fb6
imul r10d, edx, 0x5f0d4a72
add r10d, 0x9f466908
movzx edi, byte [rcx]
add edi, 0xffffffd0
cmp edi, 0xa
setae dl
cmp r10d, 0x3cfb436
jb 0x14005d670
or dl, al
nop word [rax + rax]
mov eax, dword [0x141dc8f18]
imul eax, dword [0x141dc8f1c]
imul eax, eax, 0x3ed5addf
add eax, 0x5b50d01a
cmp eax, 0x21a3c79e
jb 0x14005d6b0
test dl, dl
jne 0x14005d713
inc rcx
mov eax, dword [0x141dc8f20]
xor edx, edx
div dword [0x141dc8f24]
or eax, 0xffffbdbb
mov r10d, r11d
add r10b, dil
setb dl
cmp eax, 0x26d12ee6
je 0x14005d6d6
test dl, dl
je 0x14005d620
mov r10b, 2
mov r8d, esi
jmp 0x14005d75b
mov r10b, 1
jmp 0x14005d75b
mov r8d, esi
jmp 0x14005d75b
mov eax, dword [0x141dc8ed8]
xor edx, edx
div dword [0x141dc8edc]
nop word cs:[rax + rax]
mov eax, dword [0x141dc8ee0]
add eax, dword [0x141dc8ee4]
imul eax, eax, 0xbec6033a
xor eax, 0x7e2d42d0
cmp edi, 0xa
mov r10d, 0
adc r10b, 1
cmp eax, 0x10ba50c2
jb 0x14005d730
mov eax, r8d
mov edx, r10d
pop rbx
pop rdi
pop rsi
ret
Function at 0x14005d770
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov r10d, 1
test rdx, rdx
je 0x14005d7ac
mov r8, rdx
cmp rdx, 1
jne 0x14005d7b3
movzx edx, byte [rcx]
mov eax, 0x100
cmp edx, 0x2b
je 0x14005da11
mov r8d, 1
cmp edx, 0x2d
je 0x14005da11
jmp 0x14005d8a0
xor eax, eax
jmp 0x14005da11
movzx eax, byte [rcx]
nop word cs:[rax + rax]
mov edx, dword [0x141dc8f50]
mov r9d, dword [0x141dc8f54]
add edx, r9d
add edx, 0xa78768d0
or edx, 0xf9f28b0
cmp edx, 0x4ecaca1a
je 0x14005d7c0
cmp al, 0x2b
jne 0x14005d860
inc rcx
nop dword [rax + rax]
mov eax, dword [0x141dc8f58]
xor eax, dword [0x141dc8f5c]
and eax, 0x6f0b3854
add eax, 0x17bf4024
and eax, 0xd0dd5040
cmp eax, 0x8f1cbc4d
je 0x14005d7f0
lea rax, [r8 - 1]
nop word cs:[rax + rax]
mov edx, dword [0x141dc8f60]
or edx, dword [0x141dc8f64]
or edx, 0x2f6cbe95
add edx, 0xa5aa95e1
and edx, 0x30a29148
cmp edx, 0xbe009887
je 0x14005d820
cmp r8, 6
mov r8, rax
jb 0x14005d8a0
jmp 0x14005d920
mov eax, dword [0x141dc8f48]
xor edx, edx
div dword [0x141dc8f4c]
imul rax, rax, 0x67d13165
shr rax, 0x38
imul eax, eax, 0x74da7555
add eax, 0xb9da18ed
cmp eax, 0x87df1d
jb 0x14005d860
cmp r8, 5
jae 0x14005d920
nop word cs:[rax + rax]
mov eax, dword [0x141dc8f40]
add eax, dword [0x141dc8f44]
imul eax, eax, 0x3832f95c
and eax, 0x7034beb0
cmp eax, 0x40a22917
je 0x14005d8a0
xor r9d, r9d
nop word cs:[rax + rax]
mov eax, dword [0x141dc8f88]
xor eax, dword [0x141dc8f8c]
imul eax, eax, 0x3af4b46f
add eax, 0x9570213a
and eax, 0x3755bb6c
cmp eax, 0x9abab8ec
ja 0x14005d8d0
movzx eax, byte [rcx]
add eax, 0xffffffd0
cmp eax, 9
ja 0x14005da0c
add r9d, r9d
lea r9d, [r9 + r9*4]
inc rcx
add r9d, eax
dec r8
jne 0x14005d8d0
xor eax, eax
xor r10d, r10d
jmp 0x14005da11
mov eax, dword [0x141dc8f68]
mov edx, dword [0x141dc8f6c]
add eax, edx
add eax, 0xfa98158d
imul rax, rax, 0x50133169
shr rax, 0x3e
cmp eax, 0x1c057dde
ja 0x14005d920
xor edx, edx
mov r11w, 0xa
mov esi, 0x9ef363df
nop word cs:[rax + rax]
mov r9d, edx
mov eax, dword [0x141dc8f70]
and eax, dword [0x141dc8f74]
or eax, 0x18028
and eax, 0x1a038
cmp eax, 0xd9bc507e
ja 0x14005d963
sub r8, 1
jb 0x14005d914
mov eax, r9d
mul r11w
seto bl
movzx edx, byte [rcx]
add edx, 0xffffffd0
cmp edx, 9
ja 0x14005da22
test bl, bl
jne 0x14005da22
inc rcx
nop word cs:[rax + rax]
mov edi, dword [0x141dc8f78]
xor edi, dword [0x141dc8f7c]
mov ebx, eax
add bx, dx
setb bl
cmp edi, 0x7edd39ba
je 0x14005d9b0
nop dword [rax]
mov edi, dword [0x141dc8f80]
sub edi, dword [0x141dc8f84]
xor edi, 0x80081a41
or edi, 0x3ad7e5a6
imul rdi, rsi
shr rdi, 0x3f
cmp edi, 0x9bbbfd4d
ja 0x14005d9d0
movsx edx, dx
add edx, eax
test bl, bl
je 0x14005d960
mov eax, 0x200
jmp 0x14005da11
mov eax, 0x100
shl r9d, 0x10
or r9d, eax
or r9d, r10d
mov eax, r9d
pop rbx
pop rdi
pop rsi
ret
xor eax, eax
cmp edx, 0xa
setb al
shl eax, 8
add eax, 0x100
jmp 0x14005da11
Function at 0x140068500
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
vmovdqa xmmword [rsp + 0x40], xmm10
vmovaps xmmword [rsp + 0x30], xmm9
vmovaps xmmword [rsp + 0x20], xmm8
vmovaps xmmword [rsp + 0x10], xmm7
vmovaps xmmword [rsp], xmm6
nop word cs:[rax + rax]
mov eax, dword [0x141dca510]
sub eax, dword [0x141dca514]
add eax, 0x89082016
xor eax, 0x18020800
or eax, 0x65bc678b
cmp eax, 0xd413ba3c
je 0x140068530
vmovdqu xmm1, xmmword [rcx]
vmovdqu xmm0, xmmword [rcx + 0x10]
vmovdqa ymm2, ymmword [0x140102820]
vinserti128 ymm0, ymm0, xmm0, 1
vinserti128 ymm1, ymm1, xmm1, 1
nop
mov eax, dword [0x141dca518]
and eax, dword [0x141dca51c]
add eax, 0x69b0672d
imul rax, rax, 0x56e9a5ad
shr rax, 0x3e
cmp eax, 0xcf2fafb
je 0x140068570
vbroadcasti128 ymm4, xmmword [rcx + 0x30]
vbroadcasti128 ymm3, xmmword [rcx + 0x20]
vpaddd ymm2, ymm4, ymm2
xor eax, eax
vbroadcasti128 ymm4, xmmword [0x140102900]
vmovdqa ymm5, ymmword [0x140102860]
vmovdqa ymm6, ymm2
vmovdqa ymm9, ymm1
vmovdqa ymm7, ymm0
vmovdqa ymm8, ymm3
nop word cs:[rax + rax]
mov r8d, dword [0x141dca520]
xor r8d, dword [0x141dca524]
and r8d, 0x1cd8ee1d
imul r8d, r8d, 0xf87fd3d5
or r8d, 0xe599f6d4
cmp r8d, 0x1941fc77
je 0x1400685d0
inc rax
vpaddd ymm9, ymm9, ymm7
vpxor ymm6, ymm9, ymm6
vpshuflw ymm6, ymm6, 0xb1
vpshufhw ymm6, ymm6, 0xb1
vpaddd ymm8, ymm8, ymm6
vpxor ymm7, ymm8, ymm7
vpsrld ymm10, ymm7, 0x14
vpslld ymm7, ymm7, 0xc
vpor ymm7, ymm10, ymm7
vpaddd ymm9, ymm9, ymm7
vpshufb ymm10, ymm9, ymm4
vpshufb ymm6, ymm6, ymm4
vpxor ymm6, ymm10, ymm6
vpaddd ymm8, ymm8, ymm6
vpxor ymm7, ymm8, ymm7
vpsrld ymm10, ymm7, 0x19
vpslld ymm7, ymm7, 7
vpor ymm7, ymm10, ymm7
vpshufd ymm8, ymm8, 0x39
vpshufd ymm9, ymm9, 0x93
vpaddd ymm9, ymm9, ymm7
vpshuflw ymm10, ymm9, 0xb1
vpshufhw ymm10, ymm10, 0xb1
vpshufb ymm6, ymm6, ymm5
vpxor ymm6, ymm10, ymm6
vpaddd ymm8, ymm8, ymm6
vpxor ymm7, ymm8, ymm7
vpsrld ymm10, ymm7, 0x14
vpslld ymm7, ymm7, 0xc
vpor ymm7, ymm10, ymm7
vpaddd ymm9, ymm9, ymm7
vpxor ymm6, ymm9, ymm6
vpshufb ymm6, ymm6, ymm4
vpaddd ymm8, ymm8, ymm6
vpxor ymm7, ymm8, ymm7
vpsrld ymm10, ymm7, 0x19
vpslld ymm7, ymm7, 7
vpor ymm7, ymm10, ymm7
vpshufd ymm8, ymm8, 0x93
vpshufd ymm6, ymm6, 0x4e
vpshufd ymm9, ymm9, 0x39
cmp rax, 0xa
jne 0x1400685d0
vpaddd ymm1, ymm9, ymm1
vpaddd ymm3, ymm8, ymm3
vpaddd xmm0, xmm7, xmm0
vinserti128 ymm0, ymm1, xmm0, 1
vmovdqu ymmword [rdx], ymm0
vpaddd xmm0, xmm6, xmm2
vinserti128 ymm0, ymm3, xmm0, 1
vmovdqu ymmword [rdx + 0x20], ymm0
vmovd eax, xmm2
inc eax
mov dword [rcx + 0x30], eax
vmovaps xmm6, xmmword [rsp]
vmovaps xmm7, xmmword [rsp + 0x10]
vmovaps xmm8, xmmword [rsp + 0x20]
vmovaps xmm9, xmmword [rsp + 0x30]
vmovaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
vzeroupper
ret