joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140097e10
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x30], rcx
mov eax, 0x10
call fcn.1401c7680
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x38], rax
sub rsp, 0x20
call fcn.1400972f2
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov rax, rcx
add rax, 8
mov qword [rbp - 0x18], rax
mov rax, qword [rcx + 8]
mov rcx, rdx
add rcx, 8
mov qword [rbp - 0x10], rcx
cmp rax, qword [rdx + 8]
mov qword [rbp - 8], rax
je 0x140097f9a
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x30]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.140096f80
mov rax, qword [rbp - 0x20]
add rsp, 0x20
cmp byte [rax], 0
jne 0x140097fb3
mov eax, dword [0x1401cc598]
mov ecx, dword [0x1401cc59c]
mov edx, 0x168ac4ce
xor edx, 0x127b382f
add eax, edx
sub eax, ecx
mov ecx, 0x85c980bd
xor ecx, 0x81387c5c
sub eax, ecx
xor eax, 0xffffffff
mov ecx, 0x5f0d9c64
xor ecx, 0xe3f2b527
mov edx, 0xab251e17
xor edx, 0x54dae1e8
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0x10818d32
or eax, ecx
mov ecx, 0x33b15883
xor ecx, 0x2330d5b1
or ecx, edx
xor eax, 0xffffffff
and eax, ecx
mov ecx, 0x121d41ca
xor ecx, 0x26b19b4b
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
and eax, 0x7a4078df
mov edx, 0x753d4846
xor edx, 0xf7d3099
or ecx, edx
add eax, ecx
cmp eax, 0x9738046e
jae 0x140097fb8
mov rcx, qword [rbp - 0x10]
mov eax, dword [0x1401cc5a0]
mov r8d, dword [0x1401cc5a4]
mov edx, 0xff3c2a4f
xor edx, 0xd9dcbaa7
xor r8d, edx
xor edx, edx
div r8d
xor eax, 0x43f9f7f0
mov edx, eax
and edx, 0x7fc534ec
shl edx, 1
add eax, 0x7fc534ec
sub eax, edx
xor eax, 0x9da94ce
mov rcx, qword [rcx]
mov qword [rbp - 0x40], rcx
cmp eax, 0x2a260bfb
jb 0x140097f3b
mov rax, qword [rbp - 0x40]
mov qword [rbp - 8], rax
clc
jmp 0x140097f9a
mov rax, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov r8, qword [r8]
mov qword [rdx], r8
mov qword [rax], rcx
mov rsp, rbp
pop rbp
ret
jl 0x140097f94
inc byte [rsi]
jmp 0x140097f3b
Function at 0x14009c8b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401cc788]
imul eax, dword [0x1401cc78c]
xor ecx, ecx
sub ecx, 0x7e92e046
add eax, ecx
mov ecx, 0x54dad01a
xor edx, edx
div ecx
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x5fe6a966
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, 0xb3084511
xor ecx, 0xc56b5ed0
cmp eax, ecx
jae 0x14009c964
mov eax, dword [0x1401cc790]
xor eax, 0x59449bc2
xor edx, edx
div dword [0x1401cc794]
imul eax, eax, 0xf6eacf6d
sub eax, 0x2b182665
sub eax, 0x3949c9ff
add eax, 0x2b182665
mov ecx, 0xb587014
xor ecx, 0x63d279e4
and eax, ecx
mov dword [rsp + 0x28], eax
call fcn.14009c7cc
mov rcx, qword [rsp + 0x30]
call qword [0x1401ed040]
mov ecx, eax
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x2c], ecx
cmp eax, 0x5e30bd31
jae 0x14009c8fd
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
ret
or ecx, ebx
and dl, byte [rbp - 0x17]
nop
invalid
Function at 0x1400b5220
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov eax, ecx
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0xfffffff7
add eax, ecx
cmp eax, 0xc0000033
jne 0x1400b52a6
mov ecx, 0x48
mov edx, 8
call fcn.14001217d
mov rcx, rax
mov rax, qword [0x1401dd700]
mov qword [rcx], rax
lea rax, [0x1401dbdd4]
mov qword [rcx + 0x10], rax
mov rax, qword [0x1401dc058]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1401dc060]
mov qword [rcx + 0x20], rax
mov qword [rcx + 8], 0
lea rdx, [0x1401dbdd4]
lea r8, [0x1401dbe18]
lea r9, [0x1401dbdeb]
mov qword [rsp + 0x20], 0x37270126
call fcn.1400120ce
mov eax, dword [0x1401ccfd0]
xor eax, 0x7e9916be
mov ecx, dword [0x1401ccfd4]
xor ecx, 0x296a511e
imul eax, ecx
mov ecx, eax
or ecx, 0x50e8e132
xor ecx, 0xffffffff
mov edx, 0x959a094f
xor edx, 0xc572e87d
or eax, edx
xor eax, 0xffffffff
mov edx, 0xe6a79891
xor edx, 0x1958676e
xor ecx, edx
xor eax, 0xffffffff
and ecx, eax
mov eax, 0x3c0e907c
xor eax, 0xc3f16f83
xor ecx, eax
mov edx, 0x542c069b
xor edx, 0x84e4290b
mov eax, 0xb54010a3
xor eax, 0x4abfef5c
xor edx, eax
mov eax, 0xffffffff
xor eax, 0x223f62aa
or ecx, edx
or eax, 0x223f62aa
xor ecx, 0xffffffff
and ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0xf9746266
mov edx, 0xb78dfbfe
xor edx, 0x4ef99998
mov r8d, 0x3b785bf0
xor r8d, 0xc487a40f
xor edx, r8d
and ecx, edx
or eax, ecx
cmp eax, 0x52435042
jae 0x1400b539b
mov ecx, dword [0x1401ccfd8]
and ecx, dword [0x1401ccfdc]
mov edx, 0x152a5e28
xor edx, 0x5ac9a9c
mov eax, ecx
and eax, edx
or ecx, 0x1086c4b4
add eax, ecx
sub eax, 0xe2bd178b
mov ecx, 0x6e1eb0e2
xor edx, edx
div ecx
cmp eax, 0x21f32fcb
je 0x1400b535a
add rsp, 0x28
ret
sub dword [rbx], ecx
sub ecx, 0xffffffb6

Function at 0x1400ba430
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x770
Function at 0x1400c3600
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x1400c3799
mov eax, dword [0x1401cd530]
xor eax, 0x6225702d
or eax, dword [0x1401cd534]
mov ecx, 0x93e45f13
xor edx, edx
div ecx
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x96a49210
add ecx, eax
xor eax, eax
sub eax, ecx
xor eax, 0xdf624c6e
cmp eax, 0xdd437652
je 0x1400c379e
mov rdx, qword [rsp + 0x30]
mov ecx, dword [0x1401cd538]
mov eax, 0xc8fff1d2
xor eax, 0xf55c09b5
xor ecx, eax
and ecx, dword [0x1401cd53c]
mov eax, ecx
and eax, 0xaa3245b6
or ecx, 0xaa3245b6
add eax, ecx
add eax, 0xb55cd8aa
mov ecx, 0x6cd61aba
xor ecx, 0x6cd61aba
mov r8d, 0x1efa25a6
xor r8d, 0xe2fc39f1
sub ecx, r8d
sub eax, ecx
movabs rcx, 0x4000000000000000
and rcx, qword [rdx]
cmp rcx, 0
sete cl
mov byte [rsp + 0x27], cl
cmp eax, 0xc72cc9e
jb 0x1400c3657
mov al, byte [rsp + 0x27]
test al, 1
jne 0x1400c3799
jmp 0x1400c36d9
mov eax, dword [0x1401cd540]
mov ecx, dword [0x1401cd544]
xor ecx, 0x9eb0451e
sub eax, ecx
mov ecx, 0xb562a32
xor ecx, 0x9429ab27
xor edx, edx
div ecx
mov ecx, 0xb33875cf
xor ecx, 0x6c028f66
imul eax, ecx
and eax, 0xbe294fd
mov ecx, 0x2577b62
xor ecx, 0xe73dbfbb
cmp eax, ecx
je 0x1400c37a7
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401cd548]
mov r8d, dword [0x1401cd54c]
xor eax, 0xffffffff
xor r8d, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xa6aab8d3
or eax, r8d
or edx, 0xa6aab8d3
mov r8d, 0x7eefa89a
xor r8d, 0x81105765
xor eax, r8d
and eax, edx
and eax, 0xbbfe05e3
mov r8d, 0x2a1bae07
xor edx, edx
div r8d
mov r8d, 0xb43deefd
xor edx, edx
div r8d
mov dword [rsp + 0x20], eax
call fcn.140013d10
mov eax, dword [rsp + 0x20]
cmp eax, 0x64dab5c9
je 0x1400c3722
jmp 0x1400c3799
add rsp, 0x38
ret
movsb byte [rdi], byte [rsi]
in al, dx
add ebx, esp
jmp 0x1400c3657
sti
pop rcx
cmp dword [rbp - 0x17], esi
jb 0x1400c37ad
invalid
invalid
Function at 0x1400c9770
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x50
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x40], rcx
xor eax, eax
cmp rcx, qword [rdx]
mov byte [rsp + 0x4f], al
jne 0x1400c993a
mov rcx, qword [rsp + 0x40]
mov al, 1
cmp rcx, 0
mov byte [rsp + 0x4f], al
je 0x1400c993a
mov eax, dword [0x1401cd7a8]
mov ecx, dword [0x1401cd7ac]
xor ecx, 0x174cea69
sub eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x86df4e91
mov edx, 0x7de7ca66
xor edx, 0xfb3884f7
mov r8d, 0xdced7dfc
xor r8d, 0x23128203
xor edx, r8d
and eax, edx
or ecx, eax
or ecx, 0x6cea93ce
mov edx, 0xe2ae197f
xor edx, 0x990aa076
mov eax, ecx
and eax, edx
mov edx, 0x1a0567b4
xor edx, 0x61a1debd
or ecx, edx
add eax, ecx
cmp eax, 0x3687bfb7
jb 0x1400c9948
mov rcx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov eax, dword [0x1401cd7b0]
xor eax, 0x6ee747b
xor edx, edx
div dword [0x1401cd7b4]
and eax, 0x2aecfcb5
mov r9d, 0xcdcb99b
xor edx, edx
div r9d
mov rdx, qword [rsp + 0x40]
mov r9d, 0xe8bb3a20
xor r9d, 0xaa028432
sub eax, r9d
mov r8, qword [r8 + 8]
add r8, 8
mov qword [rsp + 0x18], r8
mov rcx, qword [rcx + 8]
add rcx, 8
mov qword [rsp + 0x20], rcx
xor ecx, ecx
test rdx, rdx
cmovg rcx, rdx
mov qword [rsp + 0x28], rcx
cmp eax, 0x5c53a97f
je 0x1400c9817
xor eax, eax
mov qword [rsp + 0x10], rax
jmp 0x1400c9898
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x10]
mov qword [rsp], rcx
xor eax, eax
cmp rcx, rdx
mov dword [rsp + 0xc], eax
je 0x1400c992c
mov rcx, qword [rsp]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x18]
movzx eax, byte [rax + rcx]
movzx r8d, byte [rdx + rcx]
mov edx, 0xe4616e44
xor edx, 0xe4616e44
sub edx, r8d
add eax, edx
movabs rdx, 0x323b61ecde58b832
movabs r8, 0x323b61ecde58b833
xor rdx, r8
movabs r8, 0x3368d41165afd42c
movabs r9, 0xcc972bee9a502bd3
xor r8, r9
xor rdx, r8
xor r8d, r8d
sub r8, 1
sub rdx, r8
sub rcx, rdx
cmp eax, 0
mov qword [rsp + 0x10], rcx
mov dword [rsp + 0xc], eax
je 0x1400c9898
mov eax, dword [rsp + 0xc]
cmp eax, 0
sete al
mov byte [rsp + 0x4f], al
mov al, byte [rsp + 0x4f]
and al, 1
movzx eax, al
add rsp, 0x50
ret
invalid
Function at 0x1400cb620
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x98
mov qword [rsp + 0x70], rcx
call fcn.1400c9d2a
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x94], 0
mov rax, rsp
mov qword [rsp + 0x80], rax
lea rdx, [rsp + 0x94]
mov qword [rax + 0x40], rdx
mov qword [rax + 0x58], 0
mov qword [rax + 0x50], 0
mov qword [rax + 0x48], 0
mov qword [rax + 0x38], 0
mov qword [rax + 0x30], 0
mov qword [rax + 0x28], 0
mov qword [rax + 0x20], 0
xor eax, eax
mov r9d, eax
mov rdx, r9
mov r8, r9
call fcn.14009c96d
mov ecx, eax
mov rax, qword [rsp + 0x88]
mov al, byte [rax]
test al, al
setne al
test ecx, ecx
sete cl
or al, cl
test al, 1
jne 0x1400cb741
mov rcx, qword [rsp + 0x70]
xor eax, eax
mov r9d, eax
lea rax, [rsp + 0x94]
mov rdx, r9
mov r8, r9
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
call fcn.14009c96d
mov rax, qword [rsp + 0x78]
cmp byte [rax], 0
jne 0x1400cb741
call fcn.1400cb48d
mov eax, dword [0x1401cd850]
xor eax, 0xc4763288
xor edx, edx
div dword [0x1401cd854]
mov ecx, 0x6043ad76
xor edx, edx
div ecx
xor eax, 0x7131415a
imul eax, eax, 0x10bd7bbd
mov ecx, 0x156f982e
xor ecx, 0x8e21a552
cmp eax, ecx
jae 0x1400cb7da
mov eax, dword [0x1401cd858]
xor eax, 0x694d56d0
imul eax, dword [0x1401cd85c]
xor eax, 0x70715a27
xor ecx, ecx
sub ecx, eax
mov eax, 0x15126535
xor eax, 0x15126535
mov edx, 0x4781f89c
xor edx, 0xad5b0689
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
sub eax, 0x65019fd5
mov ecx, dword [rsp + 0x94]
mov dword [rsp + 0x6c], ecx
cmp eax, 0x26969fc
jbe 0x1400cb77b
mov eax, dword [rsp + 0x6c]
add rsp, 0x98
ret
shl ebp, cl
shr cl, 0x98
invalid
Function at 0x1400ce0d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rcx
mov rax, qword [0x1401ddaf0]
mov ecx, dword [rax]
call fcn.140007f33
mov rcx, qword [rsp + 0x48]
add rax, 0x60
mov qword [rsp + 0x50], rax
cmp rcx, 0
je 0x1400ce2f0
mov rax, qword [rsp + 0x48]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x38], rcx
mov rax, qword [rax - 0x10]
mov qword [rsp + 0x40], rax
cmp rax, 0x10
jb 0x1400ce1e5
mov r8, qword [rsp + 0x40]
mov rax, r8
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x30], rax
movabs rcx, 0xe778b9b1a8b41532
movabs rdx, 0x1887464e574beacd
xor rcx, rdx
mov rdx, rax
xor rdx, rcx
movabs rcx, 0x4c8a0d7caae807fe
movabs r9, 0xecf096c450bbcaf5
xor rcx, r9
and rcx, rdx
mov r10, 0xffffffffffffffff
movabs rdx, 0xa07a9bb8fa53cd0b
xor r10, rdx
mov r9, rax
and r9, r10
mov rdx, r8
xor rdx, 0xffffffffffffffff
movabs r11, 0xa07a9bb8fa53cd0b
and rdx, r11
and r8, r10
or rcx, r9
or rdx, r8
xor rcx, rdx
cmp rcx, 0
setl dl
cmp rax, 0xffffffffffffffff
setg cl
xor dl, 0xff
mov al, cl
xor al, dl
and al, cl
test al, 1
jne 0x1400ce1c9
jmp 0x1400ce1d3
call fcn.140008024
jmp 0x1400ce2f0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
jmp 0x1400ce2f0
mov rcx, qword [rsp + 0x48]
call fcn.1400cdfa0
mov rax, qword [rsp + 0x50]
mov al, byte [rax]
mov cl, 0xa
xor cl, 0xa
cmp al, cl
jne 0x1400ce2f0
mov eax, dword [0x1401cd960]
xor edx, edx
div dword [0x1401cd964]
mov ecx, eax
mov r8d, 0xffffffff
xor r8d, 0xca9e0ed1
mov edx, ecx
and edx, r8d
mov eax, ecx
or eax, r8d
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, 0xca9e0ed1
or ecx, 0xca9e0ed1
imul ecx, edx
add ecx, eax
mov eax, ecx
and eax, 0xec91d3e6
xor ecx, 0xec91d3e6
or eax, ecx
add eax, 0x95a636c5
cmp eax, 0x94822d1c
jae 0x1400ce2f5
mov rcx, qword [rsp + 0x48]
mov eax, dword [0x1401cd968]
mov edx, 0x340fd17d
xor edx, 0xd6d0c2ab
xor eax, edx
imul eax, dword [0x1401cd96c]
mov r8d, 0x5ba8a490
xor r8d, 0xa4575b6f
mov edx, eax
xor edx, r8d
and edx, 0x3f9064dc
mov r8d, 0x5d01ce5b
xor r8d, 0x6291aa87
mov r9d, 0xc6edd35e
xor r9d, 0x39122ca1
xor r8d, r9d
and eax, r8d
sub eax, edx
mov edx, 0x941fd805
xor edx, 0x904e1a67
add eax, edx
imul eax, eax, 0xc66965e6
mov dword [rsp + 0x2c], eax
mov edx, 8
call fcn.14000e6f9
mov eax, dword [rsp + 0x2c]
cmp eax, 0x8b9f4c58
je 0x1400ce262
jmp 0x1400ce2f0
add rsp, 0x58
ret
mov ecx, 0xe9a77d3d
invalid
Function at 0x1400dd840
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
mov ecx, dword [0x1401cdec0]
mov eax, dword [0x1401cdec4]
xor eax, 0x6ab05437
add ecx, 0x3129aa48
sub ecx, eax
sub ecx, 0x3129aa48
mov edx, 0x95eabe67
xor edx, 0x6a154198
mov eax, ecx
xor eax, edx
mov edx, 0xe89a9f8f
xor edx, 0x17656070
xor ecx, edx
or eax, ecx
mov ecx, 0x29dc829a
and ecx, 0x29dc829a
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x6d54b382
add ecx, eax
xor eax, eax
sub eax, ecx
add eax, 0x6a7ed8f6
cmp eax, 0x22c04893
ja 0x1400dd979
mov eax, dword [0x1401cdec8]
mov r9d, dword [0x1401cdecc]
mov r8d, r9d
xor r8d, 0x276eb3d1
mov ecx, eax
not ecx
mov edx, r8d
and edx, ecx
xor r9d, 0xd8914c2e
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
imul eax, eax, 0x29e1249c
mov ecx, 0x9ddd116b
imul rax, rcx
shr rax, 0x3e
mov dword [rbp - 0x1c], eax
mov eax, 0x10
call fcn.1401c7680
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.1400d2faf
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x28]
add rsp, 0x20
mov rax, qword [rbp - 0x18]
mov r8, qword [rax + 0x70]
mov qword [rdx], r8
mov rax, qword [rax + 0x78]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.1400d19d0
mov eax, dword [rbp - 0x1c]
add rsp, 0x20
cmp eax, 0x276d87ec
je 0x1400dd8c7
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
mov dl, byte [rbp + 0x45e95a5e]
invalid
Function at 0x1400e7980
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x1401ce148]
or ecx, dword [0x1401ce14c]
mov edx, 0xffffffff
xor edx, 0xa07a9bb8
mov eax, ecx
xor eax, edx
and eax, ecx
or eax, 0x1cc7dcfd
mov edx, eax
xor edx, 0xffffffff
and edx, 0x6401e0f7
mov r8d, 0xffffffff
xor r8d, 0x6401e0f7
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x6401e0f7
or eax, 0x6401e0f7
imul eax, edx
add eax, ecx
cmp eax, 0xbbd01489
jbe 0x1400e7a46
mov eax, dword [0x1401ce150]
mov ecx, dword [0x1401ce154]
xor ecx, 0xf2208898
add eax, ecx
mov ecx, 0x5c56783b
xor ecx, 0xdeeaa6ab
xor eax, ecx
imul eax, eax, 0xc8541d91
sub eax, 0x7e92e046
mov dword [rsp + 0x2c], eax
mov rax, qword [0x1401ddaf0]
mov ecx, dword [rax]
call fcn.140007f33
mov rcx, rax
mov eax, dword [rsp + 0x2c]
add rcx, 0x60
mov qword [rsp + 0x30], rcx
cmp eax, 0x9a4196f7
je 0x1400e79e3
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
stosd dword [rdi], eax
cli
sub al, 0x61
jmp 0x1400e79e3
Function at 0x1400fd880
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov ecx, dword [0x1401cea08]
xor ecx, dword [0x1401cea0c]
add ecx, 0xb921a5b9
and ecx, 0xf4d81f87
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xad3f3934
and eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xad3f3934
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x5500c699
xor ecx, 0x1e21f9e9
cmp eax, ecx
je 0x1400fd9fe
mov eax, dword [0x1401cea10]
mov edx, dword [0x1401cea14]
mov ecx, edx
and ecx, eax
mov r8d, 0x5ba84cdd
xor r8d, 0xa457b322
xor ecx, r8d
add eax, edx
add eax, 1
add eax, ecx
add eax, 0x1ff8d6f4
mov ecx, 0x6366404b
xor ecx, 0xafcdc4ac
xor eax, ecx
imul eax, eax, 0xcd7f528d
mov dword [rsp + 0x3c], eax
call fcn.1400fcc3e
mov rdx, qword [rsp + 0x48]
mov eax, dword [rsp + 0x3c]
xor ecx, ecx
test rdx, rdx
cmovg rcx, rdx
mov qword [rsp + 0x40], rcx
cmp eax, 0x71120e6c
jae 0x1400fd8e3
xor eax, eax
mov qword [rsp + 0x30], rax
jmp 0x1400fd959
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp rax, rcx
je 0x1400fd98d
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov byte [rcx + rax], 0
add rax, 1
mov qword [rsp + 0x30], rax
jmp 0x1400fd959
mov eax, dword [0x1401cea18]
xor edx, edx
div dword [0x1401cea1c]
mov ecx, 0x77b7cafb
xor ecx, 0x8effac7d
imul eax, ecx
or eax, 0x92e12c99
and eax, 0x6bc08dd5
mov ecx, 0x680abfc2
xor ecx, 0x9bb7ebca
cmp eax, ecx
ja 0x1400fda07
mov eax, dword [0x1401cea20]
xor eax, 0x7c07b8f8
or eax, dword [0x1401cea24]
sub eax, 0xe4e07b8b
mov ecx, 0xf236b0d5
xor edx, edx
div ecx
mov ecx, 0x69a756c6
xor edx, edx
div ecx
cmp eax, 0xd2cb2d69
je 0x1400fda07
add rsp, 0x58
ret
xchg edi, eax
xchg edi, eax
cmp al, 0x7f
jmp 0x1400fd8e3
cmpsd dword [rsi], dword [rdi]
not esp
push rsi
jmp 0x1400fd9c6

Function at 0x1400fda10
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov dword [rbp - 4], ecx
mov eax, dword [0x1401cea28]
mov ecx, 0xdcacce04
xor ecx, 0x23f773f1
xor eax, ecx
mov ecx, dword [0x1401cea2c]
xor ecx, 0x2eaee36c
xor edx, edx
div ecx
mov ecx, 0x6043ad76
xor edx, edx
div ecx
xor eax, 0x7131415a
imul eax, eax, 0x10bd7bbd
mov ecx, 0xf8b42e7
xor ecx, 0x94c57f9b
cmp eax, ecx
jae 0x1400fdada
mov eax, dword [0x1401cea30]
mov ecx, dword [0x1401cea34]
xor ecx, 0xc1d1c419
imul eax, ecx
xor eax, 0x70715a27
add eax, 0x85d95e40
mov dword [rbp - 0x14], eax
mov eax, 0x10
call fcn.1401c7680
sub rsp, rax
mov rcx, rsp
mov qword [rbp - 0x20], rcx
mov edx, 8
sub rsp, 0x20
call fcn.1400fd880
mov edx, dword [rbp - 4]
mov rcx, qword [rbp - 0x20]
mov eax, dword [rbp - 0x14]
add rsp, 0x20
mov byte [rcx + 4], 1
mov dword [rcx], edx
mov rcx, qword [rcx]
mov qword [rbp - 0x10], rcx
cmp eax, 0x26969fc
jbe 0x1400fda67
mov rax, qword [rbp - 0x10]
mov rsp, rbp
pop rbp
ret
shl ebp, cl
shr cl, 0x84
invalid
Function at 0x14010a250
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 8], rcx
mov eax, dword [0x1401cefd8]
mov r8d, dword [0x1401cefdc]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
mov r9d, 0x7740962f
xor r9d, 0x88bf69d0
xor ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x3949c9ff
add eax, ecx
add eax, 1
xor eax, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x688a09f0
mov edx, 0xe6688aa2
xor edx, 0xba9de5c0
mov r8d, 0xef9bd91f
xor r8d, 0x106426e0
xor edx, r8d
or eax, ecx
mov ecx, 0x92ac8bb4
xor ecx, 0xce59e4d6
or ecx, edx
xor eax, 0xffffffff
and eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xce1ff7ab
mov r8d, 0xffffffff
xor r8d, 0xce1ff7ab
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xce1ff7ab
or eax, 0xce1ff7ab
imul eax, edx
add eax, ecx
cmp eax, 0x93d738ca
ja 0x14010a3e0
mov eax, dword [0x1401cefe0]
mov edx, dword [0x1401cefe4]
mov ecx, edx
xor ecx, eax
xor ecx, 0x2375143b
xor edx, 0x1c8aebc4
and eax, edx
add eax, eax
sub eax, ecx
xor eax, 0x48140813
and eax, 0x6c1c4b1b
imul eax, eax, 0x1d06fc58
mov dword [rbp - 0xc], eax
mov eax, 0x91519844
mov dword [rbp - 0x10], eax
mov eax, 0x10
mov qword [rbp - 0x20], rax
call fcn.1401c7680
sub rsp, rax
mov rax, qword [rbp - 0x20]
mov rcx, rsp
call fcn.1401c7680
sub rsp, rax
mov rax, qword [rbp - 8]
mov rdx, rsp
mov qword [rbp - 0x18], rdx
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.140024b00
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov rdx, qword [rax + 0x10]
mov qword [rcx], rdx
mov rax, qword [rax + 0x18]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.140024c06
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0xc]
add rsp, 0x20
cmp eax, ecx
jbe 0x14010a326
mov rsp, rbp
pop rbp
ret
xor dword [rbp + 0x3de95e30], edi
invalid
Function at 0x14010ad40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rcx
call fcn.14010a235
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, rcx
add rax, 0x10
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx + 0x10]
call fcn.14010ae96
test al, 1
jne 0x14010ad7a
jmp 0x14010ada7
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call fcn.14010ad40
mov rax, qword [rsp + 0x38]
cmp byte [rax], 0
jne 0x14010adfb
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
mov edx, 8
call fcn.14000e6f9
mov rax, qword [rsp + 0x30]
mov rcx, rax
add rcx, 0x18
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax + 0x18]
call fcn.14010ae96
test al, 1
jne 0x14010adce
jmp 0x14010adfb
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
call fcn.14010ad40
mov rax, qword [rsp + 0x38]
cmp byte [rax], 0
jne 0x14010adfb
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov edx, 8
call fcn.14000e6f9
mov eax, dword [0x1401cf048]
mov ecx, dword [0x1401cf04c]
xor ecx, 0xe9a397bb
or eax, ecx
mov ecx, 0xa747e04b
xor edx, edx
div ecx
mov ecx, 0x9ee2c7b6
xor ecx, 0x96dc184b
and eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x2f40a630
mov ecx, 0xffffffff
xor ecx, 0xe90348ac
or eax, edx
or ecx, 0xe90348ac
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0x1cae7263
je 0x14010ae8d
mov eax, dword [0x1401cf050]
xor edx, edx
div dword [0x1401cf054]
add eax, 0xb8fb0928
mov ecx, 0x66f8c4b7
xor ecx, 0x5ce0762e
imul eax, ecx
imul eax, eax, 0x597727b
cmp eax, 0xef983121
ja 0x14010ae56
add rsp, 0x48
ret
and edx, dword [rdi]
pushfq
invalid