joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140080e30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.140067614
mov rdx, qword [rsp + 0x30]
cmp rdx, 0
jne 0x140080e61
mov rcx, qword [rsp + 0x28]
call fcn.14006792a
jmp 0x140080e73
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax]
call fcn.140080da9
mov eax, dword [0x14024ec28]
xor eax, 0xd2487cad
mov ecx, dword [0x14024ec2c]
xor ecx, 0x1edd3a73
mov edx, 0xddbc8fa6
xor edx, 0x22437059
xor ecx, edx
add eax, ecx
add eax, 1
mov ecx, 0xeb44da2f
xor ecx, 0x1222135d
add eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x8ab0bb13
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0x2e0f7e7a
xor r8d, 0xa4bfc569
mov edx, eax
and edx, r8d
or eax, 0x8ab0bb13
imul eax, edx
add eax, ecx
or eax, 0xddc257a1
mov ecx, 0x558467d9
xor ecx, 0x5c07b87c
cmp eax, ecx
je 0x140080f3e
mov eax, dword [0x14024ec30]
mov ecx, dword [0x14024ec34]
xor ecx, 0xc44aa83e
imul eax, ecx
mov ecx, 0xdfdae957
xor ecx, 0x2bfdf4ad
xor eax, ecx
xor eax, 0x8a6e7a1b
mov ecx, 0x50a54513
xor ecx, 0x3d9940ea
or eax, ecx
cmp eax, 0x1179e0df
je 0x140080efa
add rsp, 0x38
ret
shl bl, cl
in eax, 0x5e
jmp 0x140080efa

Function at 0x1400814f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.140067614
mov rdx, qword [rsp + 0x30]
cmp rdx, 0
jne 0x140081521
mov rcx, qword [rsp + 0x28]
call fcn.14006792a
jmp 0x140081533
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax]
call fcn.1400813d0
mov eax, dword [0x14024ec68]
mov ecx, dword [0x14024ec6c]
xor ecx, 0xe904a5d3
sub eax, 0x53de82be
sub eax, ecx
mov ecx, 0xe33c4382
xor ecx, 0xb0e2c13c
add eax, ecx
imul ecx, eax, 0x490ed4af
mov edx, 0xa56fe726
xor edx, 0x5a9018d9
mov eax, ecx
xor eax, edx
and eax, 0xaebdce42
mov edx, 0xffffffff
xor edx, 0xaebdce42
and ecx, edx
or eax, ecx
mov edx, eax
and edx, 0x4f65ae42
mov ecx, 0x188dd56a
xor ecx, 0x188dd568
imul ecx, edx
mov edx, 0x1915eabb
xor edx, 0x567044f9
add eax, edx
sub eax, ecx
mov ecx, 0x3d601be6
xor ecx, 0x9d553ce5
cmp eax, ecx
jb 0x140081605
mov eax, dword [0x14024ec70]
sub eax, dword [0x14024ec74]
add eax, 0xe5f85292
mov ecx, 0xd527cd3d
xor ecx, 0x5b9f3ee6
sub eax, ecx
sub eax, 0xe5f85292
mov ecx, eax
and ecx, 0xfed18ba1
shl ecx, 1
add eax, 0xfed18ba1
sub eax, ecx
imul eax, eax, 0xcd5b00c0
cmp eax, 0xfc03fc87
je 0x1400815ba
add rsp, 0x38
ret
and eax, 0xe95bc094
lodsb al, byte [rsi]
invalid
Function at 0x140094f00
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 0x30], r8
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x48], rcx
mov eax, 0x10
call fcn.14024abd0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
sub rsp, 0x20
call fcn.1400942bb
mov rdx, qword [rbp - 0x38]
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x28], rcx
mov r8, qword [rdx]

Function at 0x140095d30
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x50], rcx
mov eax, 0x20
call fcn.14024abd0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x48], rax
sub rsp, 0x20
call fcn.1400942bb
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
add rsp, 0x20
mov qword [rbp - 0x30], rax
movabs rax, 0x3393e09a1b293de5
movabs r8, 0x3393e09a1b293de5
xor rax, r8
Function at 0x1400a1fb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x48], rcx
call fcn.1400a2fd0
mov rcx, qword [rsp + 0x48]
add rax, 0x50
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rcx
xor eax, eax
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x44], eax
mov eax, dword [0x14024fa48]
xor eax, 0xab53d232
or eax, dword [0x14024fa4c]
mov ecx, 0x6d36bcf3
xor ecx, 0x7095c6d1
xor eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x4018a6ac
mov r8d, 0xffffffff
xor r8d, 0x4018a6ac
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0xaf3500dd
xor r8d, 0xef2da671
mov edx, eax
and edx, r8d
or eax, 0x4018a6ac
imul eax, edx
add eax, ecx
mov ecx, 0x2185dd7c
xor ecx, 0xef2781f8
imul eax, ecx
cmp eax, 0x4c18b349
jae 0x1400a2229
mov eax, dword [0x14024fa50]
mov ecx, dword [0x14024fa54]
mov edx, 0x5a88c203
xor edx, 0x77a62954
xor ecx, edx
imul eax, ecx
mov ecx, 0x316ddd29
xor ecx, 0x316ddd29
mov edx, 0xd2b7c7a3
xor edx, 0xcfc95ef7
sub ecx, edx
add eax, ecx
mov ecx, 0x59f811ad
xor edx, edx
div ecx
mov ecx, 0xf6049082
xor edx, edx
div ecx
mov ecx, 0xcb176a6d
xor ecx, 0xb43b6e27
mov rdx, qword [rsp + 0x60]
cmp word [rdx], 0
sete dl
mov byte [rsp + 0x43], dl
cmp eax, ecx
jae 0x1400a2052
mov eax, dword [rsp + 0x44]
mov cl, byte [rsp + 0x43]
test cl, 1
mov dword [rsp + 0x3c], eax
jne 0x1400a215b
jmp 0x1400a20d7
mov eax, dword [rsp + 0x44]
movsxd rcx, eax
mov rax, rcx
inc rax
mov qword [rsp + 0x30], rax
not rax
or rax, rcx
xor rax, 0xffffffffffffffff
sets al
add rcx, 0xffffffff80000001
movabs rdx, 0xffffffff00000000
sub rcx, rdx
setb cl
or al, cl
test al, 1
jne 0x1400a2150
mov rax, qword [rsp + 0x30]
mov dword [rsp + 0x2c], eax
lea rcx, [rsp + 0x60]
mov edx, 1
call fcn.1400a1f25
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x2c]
xor eax, eax
cmp byte [rdx], 0
mov dword [rsp + 0x5c], ecx
mov dword [rsp + 0x3c], eax
je 0x1400a1fd7
jmp 0x1400a215b
call fcn.140008c92
xor eax, eax
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x28], eax
mov eax, dword [0x14024fa58]
mov ecx, dword [0x14024fa5c]
xor ecx, 0xfe8f7a27
xor edx, edx
div ecx
mov ecx, eax
mov edx, 0xffffffff
xor edx, 0xfdc657ff
mov eax, ecx
xor eax, edx
and eax, ecx
and eax, 0x46beff55
mov ecx, 0xf74cbacd
xor ecx, 0x1ac1f301
add eax, ecx
mov ecx, 0x70bdd8e0
xor ecx, 0xfeec4908
cmp eax, ecx
jbe 0x1400a2232
mov ecx, dword [0x14024fa60]
xor ecx, 0x89e09ca
mov edx, dword [0x14024fa64]
mov eax, ecx
xor eax, edx
mov r8d, 0x97a2b6ee
xor r8d, 0x685d4911
xor edx, r8d
and ecx, edx
shl ecx, 1
sub ecx, eax
mov edx, 0xffffffff
xor edx, 0xd356ea19
mov eax, ecx
xor eax, edx
and eax, ecx
mov edx, 0xd6e1fe5e
xor edx, 0x6dbc7bcf
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
mov edx, 0x244b6f90
xor edx, 0x9f16ea01
or eax, edx
and eax, ecx
add eax, 0xa57850b
cmp eax, 0x215f4675
je 0x1400a21b1
mov eax, dword [rsp + 0x28]
add rsp, 0x68
ret
jg 0x1400a2294
lahf
invalid
invalid
add dword ds:[rcx], 0x48c0314c
mov dword [rcx], eax
Function at 0x1400ad6e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov dword [rsp + 0x3c], r9d
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x44], edx
mov qword [rsp + 0x48], rcx
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov r8d, dword [0x14024fe30]
xor r8d, 0xd2a6767c
mov edx, dword [0x14024fe34]
mov ecx, r8d
xor ecx, 0xffffffff
and ecx, 0x3f16f6fd
mov r9d, 0xf08dc962
xor r9d, 0xcf9b3f9f
mov eax, 0xcc27398b
xor eax, 0x33d8c674
xor r9d, eax
and r8d, r9d
mov eax, edx
xor eax, 0xffffffff
and eax, 0x3f16f6fd
and edx, r9d
or ecx, r8d
or eax, edx
xor ecx, eax
mov eax, ecx
and eax, eax
xor eax, 0xffffffff
xor eax, 0xffffffff
mov edx, 0x9d87c890
xor edx, 0x767e5ef
mov r8d, 0xf1f2b5a1
xor r8d, 0xe0d4a5e
xor edx, r8d
or eax, edx
mov edx, 0x852d6f55
xor edx, 0x1fcd422a
mov r8d, 0x5116235a
xor r8d, 0xcbf60e25
and edx, r8d
mov r8d, 0x5623eede
xor r8d, 0xa9dc1121
xor edx, r8d
and ecx, edx
mov edx, 0xdfb4fd19
xor edx, 0x204b02e6
xor ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
and eax, 0x12fe26ca
mov ecx, 0x721bdca2
xor edx, edx
div ecx
cmp eax, 0xd88a7d0d
jae 0x1400ad87e
mov eax, dword [0x14024fe38]
xor eax, 0x9fca97d4
mov edx, dword [0x14024fe3c]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
mov eax, 0xa4709918
xor eax, 0xa4709918
sub eax, ecx
add eax, 0xad159821
mov ecx, 0x2a061649
xor ecx, 0xda7d099a
sub eax, ecx
sub eax, 0x4d1acc8a
add eax, 0xf07b1fd3
mov ecx, 0x697d7f93
xor ecx, 0x6d969d93
sub eax, ecx
sub eax, 0x992d4173
add eax, 0x4ebe200
mov dword [rsp + 0x2c], eax
call fcn.1400ad0a4
mov rcx, qword [rsp + 0x48]
mov edx, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
mov r9d, dword [rsp + 0x3c]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [0x140276208]
mov rcx, rax
mov eax, dword [rsp + 0x2c]
mov qword [rsp + 0x30], rcx
cmp eax, 0x4dcf0e2
jbe 0x1400ad7d7
mov rax, qword [rsp + 0x30]
add rsp, 0x58
ret
std
sal dword [rbx - 0x29], 1
jmp 0x1400ad7d7
Function at 0x1400ada10
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov qword [rsp + 0x48], r9
mov dword [rsp + 0x54], r8d
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rcx
mov eax, dword [rsp + 0xd8]
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x80], rax
mov eax, dword [0x14024fe50]
and eax, dword [0x14024fe54]
and eax, 0xf08ad35d
sub eax, 0xb71632e3
sub eax, 0xb7f5f05f
mov ecx, 0xd00b328e
xor ecx, 0x760008cd
cmp eax, ecx
je 0x1400adb3a
mov rsi, qword [rsp + 0x80]
mov ecx, dword [0x14024fe58]
mov eax, dword [0x14024fe5c]
sub ecx, 0x26949ee3
add ecx, eax
add ecx, 0x26949ee3
mov eax, ecx
and eax, 0xe76a071d
xor ecx, 0xe76a071d
or eax, ecx
add eax, 0x82741317
mov ecx, 0xfea0750b
xor ecx, 0x489aeed6
add eax, ecx
mov dword [rsp + 0x40], eax
call fcn.1400ad0a4
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x54]
mov r9, qword [rsp + 0x48]
mov r11, qword [rsp + 0x78]
mov r10, qword [rsp + 0x70]
mov eax, dword [rsp + 0x6c]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x38], eax
call qword [0x140276188]
mov ecx, eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x44], ecx
cmp eax, 0x684b7884
je 0x1400ada90
mov eax, dword [rsp + 0x44]
add rsp, 0x88
pop rdi
pop rsi
ret
invalid

Function at 0x1400af260
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
call fcn.1400af23e
xor eax, eax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov eax, dword [0x14024fed0]
or eax, dword [0x14024fed4]
imul eax, eax, 0x7071ecd6
add eax, 0x5e2c50a
mov ecx, 0xe98e8213
xor ecx, 0xc4884cd2
and eax, ecx
mov ecx, 0xe50b3138
xor ecx, 0x3cf4a862
cmp eax, ecx
jae 0x1400af363
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x14024fed8]
mov r8d, dword [0x14024fedc]
mov edx, 0x46e8315c
xor edx, 0xe734be85
xor r8d, edx
xor edx, edx
sub edx, r8d
sub eax, edx
imul eax, eax, 0xed198290
xor edx, edx
sub edx, eax
xor eax, eax
sub eax, 0xa49c3e4e
add edx, eax
mov eax, 0x991d33ac
xor eax, 0x991d33ac
sub eax, edx
mov edx, 0x7bce61e8
xor edx, 0x14b7c9b1
or eax, edx
cmp rcx, 0x10
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x81c3221a
je 0x1400af2b6
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1400af35e
jmp 0x1400af330
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov dl, 0xbb
xor dl, 0xbb
mov byte [rcx + rax], dl
mov rcx, rax
and rcx, 1
shl rcx, 1
xor rax, 1
add rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x1400af275
add rsp, 0x48
ret
and eax, 0xe91bc9be
invalid
Function at 0x1400b02a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov ecx, dword [0x14024ff60]
mov edx, dword [0x14024ff64]
mov eax, ecx
xor eax, 0xffffffff
mov r9d, 0x528bf7c8
xor r9d, 0xad740837
mov r8d, ecx
xor r8d, r9d
and eax, r8d
mov r8d, edx
or r8d, r8d
xor r8d, 0xffffffff
or eax, r8d
xor eax, 0xffffffff
xor ecx, 0xffffffff
xor edx, 0xffffffff
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x1a49dc42
xor edx, edx
div ecx
mov ecx, eax
xor ecx, 0x7bc33e33
mov edx, 0x4cce922c
xor edx, 0xb3316dd3
xor ecx, edx
and ecx, 0x7bc33e33
shl ecx, 1
sub ecx, 0x7bc33e33
sub eax, ecx
xor eax, 0x6bcd53d4
mov ecx, 0xc21a2ff7
xor ecx, 0xbdf0f969
cmp eax, ecx
ja 0x1400b04a1
mov eax, dword [0x14024ff68]
xor eax, 0xfc6d54c0
mov r8d, dword [0x14024ff6c]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov ecx, 0xccb650b7
xor ecx, 0x3349af48
mov r9d, r8d
xor r9d, ecx
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x33ac66f
xor ecx, 0xae4a61e0
and eax, ecx
and eax, 0xe131dcad
imul eax, eax, 0xea6a4743
mov dword [rsp + 0x3c], eax
call fcn.1400b15d0
mov rdx, qword [rsp + 0x48]
mov eax, dword [rsp + 0x3c]
xor ecx, ecx
test rdx, rdx
cmovg rcx, rdx
mov qword [rsp + 0x40], rcx
cmp eax, 0x3f3dc5c2
jb 0x1400b033c
xor eax, eax
mov qword [rsp + 0x30], rax
jmp 0x1400b03cd
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp rax, rcx
je 0x1400b0414
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov byte [rcx + rax], 0
mov rcx, 0xffffffffffffffff
xor rcx, 1
xor edx, edx
sub rdx, 1
sub rcx, rdx
sub rax, rcx
mov qword [rsp + 0x30], rax
jmp 0x1400b03cd
mov eax, dword [0x14024ff70]
mov ecx, dword [0x14024ff74]
xor ecx, 0xdb2f240f
imul eax, ecx
imul eax, eax, 0x2658816c
imul eax, eax, 0x339db184
sub eax, 0x7c915c40
cmp eax, 0x4c0d9082
jb 0x1400b04aa
mov ecx, dword [0x14024ff78]
xor ecx, 0x1b5b9dab
mov edx, dword [0x14024ff7c]
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
or eax, 0x1815a10c
imul eax, eax, 0x30a7e8c2
sub eax, 0x7efff546
mov ecx, 0x2d0293da
xor ecx, 0x7cb75270
sub eax, ecx
mov ecx, 0xa3526d6d
xor ecx, 0xddad982b
add eax, ecx
mov ecx, 0x51a22c7e
xor ecx, 0x1a5f7178
cmp eax, ecx
jb 0x1400b0445
add rsp, 0x58
ret
add dword [rsi], edx
mov al, 6
jmp 0x1400b033c
mov ds, word [rax]
shl bh, 1
jmp 0x1400b0445
Function at 0x1400b3ce0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1402500d0]
mov ecx, 0x443d50bb
xor ecx, 0x27c54979
xor eax, ecx
mov ecx, dword [0x1402500d4]
xor ecx, 0xc162c42d
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xbb5d8591
mov edx, 0xffffffff
xor edx, 0xdfddff58
or eax, ecx
mov ecx, 0x4af0eda1
xor ecx, 0x952d12f9
or ecx, edx
mov edx, 0xb7b164ea
xor edx, 0x484e9b15
xor eax, edx
and eax, ecx
xor ecx, ecx
sub ecx, 0xa57850b
sub eax, ecx
imul eax, eax, 0x41519cf3
cmp eax, 0xa6f77af7
jb 0x1400b3de3
mov eax, dword [0x1402500d8]
xor edx, edx
div dword [0x1402500dc]
mov ecx, eax
and ecx, 0x455d7046
or eax, 0x455d7046
add ecx, eax
mov eax, ecx
and eax, 0x82b24ad9
mov edx, 0xbc7017ef
xor edx, 0x3ec25d36
xor ecx, edx
or eax, ecx
mov ecx, 0xffcca378
xor edx, edx
div ecx
mov dword [rsp + 0x30], eax
mov eax, 0xab54ffeb
xor eax, 0xe8ef6cb7
mov dword [rsp + 0x2c], eax
call fcn.1400b3bc8
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
call qword [0x1402763f0]
mov ecx, dword [rsp + 0x2c]
mov edx, eax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x34], edx
cmp eax, ecx
je 0x1400b3d61
mov eax, dword [rsp + 0x34]
add rsp, 0x48
ret
jne 0x1400b3e2b
pop rdi
and ecx, ebp
jne 0x1400b3de9
invalid
invalid
add byte [rax], 0
add byte [rax], al
Function at 0x1400b51a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x80
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rcx
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x78], rax
mov eax, dword [0x140250150]
mov ecx, 0xde6ae143
xor ecx, 0x8ce1168b
xor eax, ecx
imul eax, dword [0x140250154]
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x51b5c1aa
mov edx, 0xffffffff
xor edx, 0x51b5c1aa
and eax, edx
sub eax, ecx
sub eax, 0xc79b5369
imul eax, eax, 0xb3da722a
cmp eax, 0x5bddc978
je 0x1400b52b6
mov eax, dword [0x140250158]
xor eax, 0x4cce922c
imul eax, dword [0x14025015c]
and eax, 0x19ad8ceb
xor ecx, ecx
sub ecx, 0xd3c00b0d
add eax, ecx
imul eax, eax, 0x2c2efe7
mov dword [rsp + 0x3c], eax
call fcn.1400b4eae
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x48]
mov r11, qword [rsp + 0x78]
mov r10, qword [rsp + 0x70]
mov eax, dword [rsp + 0x6c]
mov qword [rsp + 0x20], r11
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x30], eax
call qword [0x140276428]
mov rcx, rax
mov eax, dword [rsp + 0x3c]
mov qword [rsp + 0x40], rcx
cmp eax, 0xa651789e
ja 0x1400b522b
mov rax, qword [rsp + 0x40]
add rsp, 0x80
pop rsi
ret
push rbx
iretd
Function at 0x1400b5cf0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x40
mov qword [rsp + 0x30], rdx
mov r9, rcx
movsxd r8, dword [rdx + 0xc]
mov rcx, r9
sub rcx, r8
mov qword [rsp + 0x38], rcx
mov rax, rcx
or rax, rax
xor rax, 0xffffffffffffffff
mov rdx, r9
or rdx, rdx
xor rdx, 0xffffffffffffffff
xor rax, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
and rax, rdx
mov rdx, rcx
or rdx, r9
movabs r9, 0x4b5c17fb50bff60d
movabs r10, 0xb4a3e804af4009f2
xor r9, r10
xor rdx, r9
or rax, rdx
xor rax, 0xffffffffffffffff
movabs rdx, 0x9a14e901764ce135
movabs r9, 0x9a14e901764ce135
xor rdx, r9
cmp rax, rdx
setl al
mov rdx, rcx
xor rdx, r8
xor rdx, 0xffffffffffffffff
mov r9, r8
and r9, rdx
movabs rdx, 0xd02df2728e8b928b
movabs r10, 0xd02df2728e8b9289
xor rdx, r10
imul rdx, r9
sub rdx, r8
sub rcx, rdx
movabs rdx, 0x1bda2a7e9f0de4a0
movabs r8, 0xe425d58160f21b5f
xor rdx, r8
cmp rcx, rdx
setg cl
and al, cl
test al, 1
jne 0x1400b5dcc
jmp 0x1400b5dd6
call fcn.140008c92
jmp 0x1400b5f6f
mov r9, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
movsxd r8, dword [rax + 0x14]
mov rax, r9
and rax, r8
shl rax, 1
mov rcx, r9
xor rcx, r8
add rcx, rax
mov qword [rsp + 0x28], rcx
mov rax, rcx
xor rax, 0xffffffffffffffff
movabs rdx, 0x55003ac59b3ee1e6
and rax, rdx
mov r11, 0xffffffffffffffff
movabs rdx, 0x55003ac59b3ee1e6
xor r11, rdx
mov r10, rcx
and r10, r11
mov rdx, r9
xor rdx, 0xffffffffffffffff
movabs rsi, 0x55003ac59b3ee1e6
and rdx, rsi
and r9, r11
or rax, r10
or rdx, r9
xor rax, rdx
mov rdx, rcx
and rdx, r8
shl rdx, 1
add rcx, r8
sub rcx, rdx
xor rax, 0xffffffffffffffff
movabs rdx, 0xef16eada8a13de47
movabs r8, 0x10e9152575ec21b8
xor rdx, r8
xor rcx, rdx
mov rdx, 0xffffffffffffffff
movabs r8, 0x609152918350f1a8
xor rdx, r8
or rax, rcx
movabs rcx, 0x98c74de5ab104201
movabs r8, 0xf8561f742840b3a9
xor rcx, r8
or rcx, rdx
xor rax, 0xffffffffffffffff
and rax, rcx
cmp rax, 0
jge 0x1400b5ec4
call fcn.140008c92
jmp 0x1400b5f6f
mov eax, dword [0x1402501a8]
mov ecx, dword [0x1402501ac]
add eax, 0x693d952e
add eax, ecx
mov ecx, 0x483d16d2
xor ecx, 0x210083fc
sub eax, ecx
xor eax, 0xeceda159
xor eax, 0xa96cedce
mov ecx, 0x7d6a6ee9
xor ecx, 0xe5027ed2
mov edx, 0xdde4bc3b
xor edx, 0x221b43c4
xor ecx, edx
add eax, ecx
mov ecx, 0x617693bc
xor ecx, 0x617693bd
add eax, ecx
cmp eax, 0x78ddc18f
jbe 0x1400b5f7a
mov eax, dword [0x1402501b0]
xor eax, 0x6c721f5d
and eax, dword [0x1402501b4]
or eax, 0xcc6e2893
mov ecx, 0xf943d956
xor ecx, 0xf943d956
mov edx, 0x7fafe338
xor edx, 0xd90709f2
sub ecx, edx
sub eax, ecx
xor eax, 0x2edc9c78
cmp eax, 0x47f12789
je 0x1400b5f20
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
jmp 0x1400b5f6f
mov rax, qword [rsp + 0x20]
add rsp, 0x40
pop rsi
ret
ret 0x8d5e
Function at 0x1400bcfb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x4f0
lea rbp, [rsp + 0x80]
mov eax, 0x10
mov qword [rbp + 0x240], rax
call fcn.14024abd0
sub rsp, rax
mov rax, qword [rbp + 0x240]
mov rcx, rsp
Function at 0x1400c1bd0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rcx
mov eax, dword [0x1402505f0]
xor eax, 0x62cf9a91
mov ecx, dword [0x1402505f4]
mov edx, 0x21a79645
xor edx, 0xcee8e6a0
xor ecx, edx
add eax, ecx
sub eax, 0x956cddbc
mov ecx, 0xc513ba4
xor edx, edx
div ecx
mov r8d, 0xffffffff
xor r8d, 0x936e067e
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x65b74a4
xor r8d, 0xf9a48b5b
xor ecx, r8d
imul ecx, edx
mov r8d, 0xf149fae
xor r8d, 0x9c7a99d0
mov edx, eax
and edx, r8d
mov r8d, 0xf65ef086
xor r8d, 0x6530f6f8
or eax, r8d
imul eax, edx
add eax, ecx
cmp eax, 0x13bfde9b
ja 0x1400c1d8f
mov eax, dword [0x1402505f8]
xor eax, 0xff9218c0
or eax, dword [0x1402505fc]
mov ecx, 0x6ffe13d9
xor ecx, 0x28910478
or eax, ecx
add eax, 0x7e82b0
mov ecx, 0x25139037
xor ecx, 0x5f2b9b03
sub eax, ecx
mov ecx, 0x4bfdc6dc
xor ecx, 0x6ed891aa
sub eax, ecx
add eax, 0x7a380b34
mov dword [rsp + 0x24], eax
call fcn.1400d0c60
mov rdx, qword [rsp + 0x40]
mov rcx, rax
mov eax, dword [rsp + 0x24]
mov r9, qword [rdx]
mov qword [rsp + 0x28], r9
mov rdx, qword [rdx + 8]
add rdx, 8
lea r8, [0x140262c80]
cmp r9, 0
cmove rdx, r8
mov qword [rsp + 0x30], rdx
cmp byte [rcx + 0x50], 0
sete cl
mov byte [rsp + 0x3f], cl
cmp eax, 0x1871366d
jb 0x1400c1c6d
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x1400c1d0f
jmp 0x1400c1d85
mov rax, qword [rsp + 0x28]
movabs rcx, 0x5b556ebc5394c9f
movabs rdx, 0x5b556ebc5394c9f
xor rcx, rdx
cmp rax, rcx
jge 0x1400c1d71
mov rcx, qword [rsp + 0x28]
movabs rdx, 0x5191abb20a65a3e7
movabs rax, 0x5191abb20a65a3e7
xor rdx, rax
movabs r8, 0xd79cb033b9a9ec5f
movabs rax, 0xa8634fcc465613a0
xor r8, rax
call fcn.14000d792
jmp 0x1400c1d85
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
call fcn.1400a3010
mov rax, qword [rsp + 0x50]
add rsp, 0x58
ret
or al, 0x29
invalid
Function at 0x1400c4c10
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x530
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x338], rcx
mov byte [rbp + 0x2ef], dl
mov eax, 0x10
mov qword [rbp + 0x320], rax
call fcn.14024abd0
sub rsp, rax
mov rax, qword [rbp + 0x320]
mov rcx, rsp
mov qword [rbp + 0x2f0], rcx
call fcn.14024abd0
sub rsp, rax
mov rax, qword [rbp + 0x320]
Function at 0x1400d84f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x140250e00]
xor eax, 0x2be788e4
and eax, dword [0x140250e04]
mov ecx, 0xb17ebbe1
xor edx, edx
div ecx
mov ecx, 0x7c2d0c3a
xor ecx, 0x2ac792be
imul eax, ecx
mov edx, 0x79cb3640
xor edx, 0x8634c9bf
mov ecx, eax
xor ecx, edx
mov edx, 0xf247b617
xor edx, 0xa02cbca9
and edx, ecx
mov r8d, 0xffffffff
xor r8d, 0x526b0abe
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x526b0abe
mov r8d, 0x48d9e458
xor r8d, 0x1ab2eee6
or eax, r8d
imul eax, edx
add eax, ecx
cmp eax, 0xa4d1fd44
jae 0x1400d8694
mov eax, dword [0x140250e08]
xor edx, edx
div dword [0x140250e0c]
mov ecx, eax
mov eax, ecx
and eax, 0xc2e50621
mov edx, 0x7cf4c318
xor edx, 0xbe11c539
xor ecx, edx
or eax, ecx
xor eax, 0x9a10632d
imul eax, eax, 0x6dd477ea
mov dword [rsp + 0x28], eax
call fcn.1400d7c9c
mov rcx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x28]
cmp rcx, 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x3c260627
je 0x1400d857a
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1400d85ee
jmp 0x1400d85e4
mov rcx, qword [rsp + 0x30]
call fcn.1400a61f4
mov eax, dword [0x140250e10]
or eax, dword [0x140250e14]
mov r8d, 0x8ad0abec
xor r8d, 0xbb459462
mov ecx, 0x5f4e14f0
xor ecx, 0xa0b1eb0f
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x31953f8e
or eax, 0x31953f8e
imul eax, edx
add eax, ecx
or eax, 0x19055d69
mov ecx, 0xb6cff0e
xor ecx, 0x99ee2d4c
or eax, ecx
cmp eax, 0xb1a141ac
je 0x1400d869d
mov eax, dword [0x140250e18]
and eax, dword [0x140250e1c]
imul ecx, eax, 0x26ecb8ce
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x41a17e6f
mov edx, 0xffffffff
xor edx, 0x41a17e6f
and ecx, edx
or eax, ecx
sub eax, 0xb9130eef
cmp eax, 0xb94df5eb
je 0x1400d8654
add rsp, 0x38
ret
mov ds, word [rax]
shl bh, 1
jmp 0x1400d857a
xor byte [rcx + rdx - 0x5116d2], cl
invalid