joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140111d20
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1401cf298]
mov ecx, dword [0x1401cf29c]
xor ecx, 0xe62e18ad
add eax, ecx
xor eax, 0x82bcde90
mov edx, eax
xor edx, 0xffffffff
and edx, 0xc8541d91
mov r8d, 0xffffffff
xor r8d, 0xc8541d91
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xc8541d91
or eax, 0xc8541d91
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0x7e92e046
mov edx, 0x616f9834
xor edx, 0x1ffd7872
mov r8d, 0x46bd5a0d
xor r8d, 0xb942a5f2
xor edx, r8d
and eax, edx
shl eax, 1
sub eax, ecx
cmp eax, 0x9a4196f7
je 0x140111fda
mov eax, dword [0x1401cf2a0]
imul eax, dword [0x1401cf2a4]
and eax, 0xff8790d
mov ecx, 0x6bb3fa65
xor ecx, 0xf90e960c
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x40]
mov ecx, 0x4f36b12f
xor ecx, 0xb9dc7e42
imul eax, ecx
mov ecx, 0xf0796c8f
xor ecx, 0x8e5d53aa
cmp rdx, 0
sete dl
mov byte [rsp + 0x3f], dl
cmp eax, ecx
je 0x140111da9
mov cl, byte [rsp + 0x3f]
xor eax, eax
test cl, 1
mov byte [rsp + 0x3e], al
jne 0x140111fcc
jmp 0x140111e13
mov rax, qword [rsp + 0x40]
mov rcx, rax
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax - 0x10]
mov qword [rsp + 0x30], rcx
mov al, 1
cmp rcx, 0x10
mov byte [rsp + 0x3e], al
jb 0x140111fcc
mov r8, qword [rsp + 0x30]
movabs rcx, 0x10ab380608bed2d5
movabs rax, 0xef54c7f9f7412d25
xor rcx, rax
mov rax, r8
add rax, rcx
mov qword [rsp + 0x20], rax
movabs rdx, 0x3d5571e678d2a2f
movabs rcx, 0xfc2aa8e19872d5d0
xor rdx, rcx
mov rcx, rax
xor rcx, rdx
movabs rdx, 0xc0f15d7b4f4dd5a8
and rcx, rdx
mov r10, 0xffffffffffffffff
movabs rdx, 0xc0f15d7b4f4dd5a8
xor r10, rdx
mov r9, rax
and r9, r10
mov rdx, r8
xor rdx, 0xffffffffffffffff
movabs r11, 0xc0f15d7b4f4dd5a8
and rdx, r11
and r8, r10
or rcx, r9
or rdx, r8
xor rcx, rdx
cmp rcx, 0
setl dl
cmp rax, 0xffffffffffffffff
setg al
or al, al
mov cl, 1
xor cl, 0
xor al, cl
mov cl, dl
xor cl, 0xff
xor dl, 0xff
and cl, dl
or al, cl
xor al, 0xff
test al, 1
jne 0x140111efa
jmp 0x140111f0a
call fcn.140008024
xor eax, eax
mov byte [rsp + 0x3e], al
jmp 0x140111fcc
mov eax, dword [0x1401cf2a8]
mov r8d, dword [0x1401cf2ac]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
or eax, 0xcf53bfdb
sub eax, 0x2906867d
sub eax, 0xa0ab5a
cmp eax, 0x1a265c39
jbe 0x140111fe3
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401cf2b0]
add eax, dword [0x1401cf2b4]
mov r8d, 0xda886348
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x20]
mov r10d, 0xffffffff
xor r10d, 0x23949aa7
mov r9d, eax
and r9d, r10d
mov r8d, eax
or r8d, r10d
xor r8d, 0xffffffff
imul r8d, r9d
mov r9d, eax
and r9d, 0x23949aa7
or eax, 0x23949aa7
imul eax, r9d
add eax, r8d
imul eax, eax, 0x770f42c3
mov qword [rcx], rdx
cmp eax, 0x89f32bc5
je 0x140111fe3
xor eax, eax
mov byte [rsp + 0x3e], al
jmp 0x140111fcc
mov al, byte [rsp + 0x3e]
and al, 1
movzx eax, al
add rsp, 0x48
ret
lodsb al, byte [rsi]
frstor dword [rbp - 0x239169a]
invalid
mov ch, ch
std
jmp 0x140111f55
Function at 0x140118390
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
call fcn.140117f61
mov qword [rsp + 0x30], rax
add rax, 0x60
mov qword [rsp + 0x28], rax
lea rcx, [0x1401efb08]
mov rax, qword [0x1401dd660]
call qword [rax]
mov rax, qword [rsp + 0x30]
mov al, byte [rax + 0x60]
mov cl, 0x5a
xor cl, 0x5a
cmp al, cl
jne 0x1401184bb
lea rcx, [0x1401efad0]
call fcn.140117410
mov rax, qword [rsp + 0x28]
cmp byte [rax], 0
jne 0x1401184bb
lea rcx, [0x140244340]
mov rax, qword [0x1401dd660]
call qword [rax]
mov rax, qword [rsp + 0x28]
cmp byte [rax], 0
jne 0x1401184bb
lea rcx, [0x140244368]
mov rax, qword [0x1401dd660]
call qword [rax]
mov rax, qword [rsp + 0x28]
cmp byte [rax], 0
jne 0x1401184bb
mov eax, dword [0x1401cf548]
and eax, dword [0x1401cf54c]
mov ecx, 0x32a9d7e1
xor ecx, 0xed21edb5
add eax, ecx
mov ecx, 0x5b8d5a66
xor ecx, 0x84d8bcea
xor eax, ecx
mov ecx, 0xbd5391ab
xor ecx, 0x7a082af0
sub eax, ecx
cmp eax, 0x669878fc
jae 0x1401184c0
mov ecx, dword [0x1401cf550]
sub ecx, dword [0x1401cf554]
mov eax, ecx
and eax, 0x744c92ae
xor ecx, 0x744c92ae
or eax, ecx
xor eax, 0xd9fc0fef
mov ecx, 0x888adc50
xor ecx, 0x3669c002
xor edx, edx
div ecx
mov dword [rsp + 0x24], eax
mov eax, 0x245dd3a8
xor eax, 0x2ebe4f84
mov dword [rsp + 0x20], eax
call fcn.1401182e7
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
jae 0x140118460
jmp 0x1401184bb
add rsp, 0x38
ret
xor al, byte [rbx - 0x68160b14]
invalid
Function at 0x14011de10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rcx
call fcn.140142430
mov rcx, qword [rsp + 0x38]
add rax, 0x60
mov qword [rsp + 0x40], rax
add rcx, 8
mov qword [rsp + 0x48], rcx
xor eax, eax
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov qword [rsp + 0x30], rdx
cmp rax, rcx
jge 0x14011dee0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rax + rcx*8 + 8]
lea rdx, [0x1401cf558]
call fcn.14011df9b
test al, 1
jne 0x14011de8c
jmp 0x14011decd
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.14011e110
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x14011df8d
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
mov edx, 8
call fcn.14000e6f9
mov rax, qword [rsp + 0x28]
add rax, 1
mov qword [rsp + 0x50], rax
jmp 0x14011de3c
mov rax, qword [rsp + 0x30]
cmp rax, 0
je 0x14011df8d
mov eax, dword [0x1401cf7f8]
xor eax, dword [0x1401cf7fc]
or eax, 0xc0b48783
mov ecx, 0xbf8cba8
xor edx, edx
div ecx
mov ecx, 0x5e61ce1c
xor edx, edx
div ecx
cmp eax, 0x64d63e99
je 0x14011df92
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401cf800]
xor eax, 0x804fa3d4
mov r8d, dword [0x1401cf804]
xor r8d, 0x8433fefc
xor edx, edx
div r8d
add eax, 0x9e0c9f08
mov r8d, 0xa4705611
xor r8d, 0x5b53a507
xor edx, edx
div r8d
xor eax, 0x42874881
mov dword [rsp + 0x24], eax
mov eax, 0x1c5f2e4
xor eax, 0xf74ab1e3
mov dword [rsp + 0x20], eax
mov edx, 8
call fcn.14000e580
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
je 0x14011df1d
invalid
jmp 0x14011df8d
add rsp, 0x58
ret
jne 0x14011df38
out 7, eax
jmp 0x14011df1d
Function at 0x14011e820
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.140142430
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rdx, [0x1401cf558]
call fcn.14011df9b
test al, 1
jne 0x14011e851
jmp 0x14011e986
mov rcx, qword [rsp + 0x28]
call fcn.14011e110
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14011e986
mov eax, dword [0x1401cf838]
add eax, dword [0x1401cf83c]
mov ecx, 0xe9ca0492
xor ecx, 0x2648fbda
and eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0x4fc87145
xor edx, 0xc893938b
and edx, ecx
mov r8d, 0xf33af1ad
xor r8d, 0x74611363
mov ecx, 0xee15b261
xor ecx, 0x11ea4d9e
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0x1e9c3734
xor r8d, 0x99c7d5fa
mov edx, eax
and edx, r8d
mov r8d, 0x90262544
xor r8d, 0x177dc78a
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xf8b41d34
xor ecx, 0xa5613a46
sub eax, ecx
sub eax, 0x26ec31b5
add eax, 0x5dd52772
cmp eax, 0x964f30bd
ja 0x14011e98b
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401cf840]
xor eax, 0x96ac97e4
mov r8d, dword [0x1401cf844]
xor r8d, 0x946f1669
xor edx, edx
div r8d
imul eax, eax, 0xfb4c4eaf
mov edx, 0xc77cd64e
xor edx, 0x9c8a3751
imul eax, edx
mov r8d, 0x253e68b2
xor edx, edx
div r8d
mov dword [rsp + 0x24], eax
mov eax, 0x28158f06
xor eax, 0x74832dfc
mov dword [rsp + 0x20], eax
movabs rdx, 0x652f029434290eec
movabs rax, 0x652f029434290ee4
xor rdx, rax
call fcn.14000e6f9
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
jae 0x14011e901
jmp 0x14011e986
add rsp, 0x38
ret
invalid
Function at 0x14013ed40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov rax, rcx
mov rcx, qword [rax + 0x20]
mov qword [rsp + 0x40], rcx
mov rdx, rax
add rdx, 0x28
mov qword [rsp + 0x48], rdx
add rax, 0x38
mov qword [rsp + 0x50], rax
xor eax, eax
test rcx, rcx
cmovg rax, rcx
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov ecx, dword [0x1401d02a8]
mov edx, dword [0x1401d02ac]
xor edx, 0xebcf5595
xor edx, 0xffffffff
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0xa1f03d2c
xor ecx, 0xb3df2106
imul eax, ecx
xor eax, 0xaed6d356
mov edx, eax
xor edx, 0xffffffff
and edx, 0xd329e012
mov r8d, 0xffffffff
xor r8d, 0xd329e012
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0x5e773386
xor r8d, 0x8d5ed394
mov edx, eax
and edx, r8d
or eax, 0xd329e012
imul eax, edx
add eax, ecx
cmp eax, 0xdce43fa3
jae 0x14013ef0b
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x58]
mov r8d, dword [0x1401d02b0]
mov eax, dword [0x1401d02b4]
sub r8d, 0x7dc34b6b
add r8d, eax
add r8d, 0x7dc34b6b
add r8d, 0xf294af16
xor r8d, 0xbace6ae7
mov eax, r8d
and eax, 0xcc60763f
mov r9d, 0xf71a1c0b
xor r9d, 0x3b7a6a34
or r8d, r9d
add eax, r8d
cmp rcx, rdx
sete cl
mov byte [rsp + 0x37], cl
cmp eax, 0x4e19597
jb 0x14013edf9
mov cl, byte [rsp + 0x37]
mov rax, 0xffffffffffffffff
test cl, 1
mov qword [rsp + 0x28], rax
jne 0x14013ef01
jmp 0x14013ee7d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
cmp rax, rcx
jl 0x14013eec3
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
xor eax, eax
sub rax, rdx
xor edx, edx
sub rdx, 0xffffffffffffffff
add rax, rdx
xor edx, edx
sub rdx, rax
call fcn.1400122ad
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x28], rax
jmp 0x14013ef01
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
mov rcx, qword [rcx + rax*8 + 8]
mov ecx, dword [rcx + 0x20]
mov rdx, qword [rdx]
cmp ecx, dword [rdx + 8]
mov qword [rsp + 0x28], rax
je 0x14013ef01
mov rax, qword [rsp + 0x38]
add rax, 1
mov qword [rsp + 0x60], rax
jmp 0x14013ed7a
mov rax, qword [rsp + 0x28]
add rsp, 0x68
ret
out dx, eax
mov ds, word [rcx - 0x11a16ee]
invalid
Function at 0x140142bb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rcx
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x57], al
je 0x140142d55
mov rax, qword [rsp + 0x48]
mov rcx, 0xffffffffffffffff
xor rcx, 0xfffffffffffffff0
xor edx, edx
sub rdx, 1
sub rcx, rdx
sub rax, rcx
mov qword [rsp + 0x38], rax
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
mov al, 1
cmp rcx, 0x10
mov byte [rsp + 0x57], al
jb 0x140142d55
mov r8, qword [rsp + 0x40]
movabs rcx, 0x998c4f48e7cdd8c1
movabs rax, 0x6673b0b718322731
xor rcx, rax
mov rax, r8
add rax, rcx
mov qword [rsp + 0x30], rax
mov rcx, rax
or rcx, rcx
xor rcx, 0xffffffffffffffff
movabs r9, 0x8c39846232ccbdd0
movabs rdx, 0x73c67b9dcd33422f
xor r9, rdx
mov rdx, r8
xor rdx, r9
mov r9, r8
xor r9, 0xffffffffffffffff
and rdx, r9
or rcx, rdx
movabs rdx, 0x58bedc5e5138a20
movabs r9, 0xfa74123a1aec75df
xor rdx, r9
xor rcx, rdx
mov rdx, rax
or rdx, r8
xor rdx, 0xffffffffffffffff
xor rcx, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
and rcx, rdx
movabs rdx, 0xcecf26c6c3536fd
movabs r8, 0xcecf26c6c3536fd
xor rdx, r8
cmp rcx, rdx
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x140142cbf
jmp 0x140142d42
mov eax, dword [0x1401d0418]
imul eax, dword [0x1401d041c]
add eax, 0xe7c799ff
or eax, 0xca32d30f
mov ecx, eax
xor ecx, 0xd61d92b0
xor ecx, 0xffffffff
or eax, 0xd61d92b0
and eax, ecx
cmp eax, 0xf5728764
jae 0x140142d63
mov eax, dword [0x1401d0420]
or eax, dword [0x1401d0424]
mov ecx, 0x95773f4b
xor ecx, 0x57aa1bf0
imul eax, ecx
mov ecx, 0xab7e16bd
xor edx, edx
div ecx
mov ecx, 0xc200f5f9
xor edx, edx
div ecx
mov dword [rsp + 0x2c], eax
call fcn.140008024
mov eax, dword [rsp + 0x2c]
cmp eax, 0x5cf56f62
jae 0x140142cf3
xor eax, eax
mov byte [rsp + 0x57], al
jmp 0x140142d55
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x57], al
mov al, byte [rsp + 0x57]
and al, 1
movzx eax, al
add rsp, 0x58
ret
movabs eax, dword [0xffffff87e9b23261]
Function at 0x140147650
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov rax, rcx
mov qword [rsp + 0x48], rax
mov qword [rcx], 0
mov qword [rcx + 8], 0
movabs rax, 0x7b06064efdaa9c51
movabs rcx, 0x7b06064efdaa9c51
xor rax, rcx
sub rax, r9
mov rcx, r8
add rcx, rax
mov qword [rsp + 0x50], rcx
mov rax, rcx
xor rax, r8
cmp rax, 0
setl al
xor rcx, r9
movabs rdx, 0x5f3e0ee38e1e30d3
movabs r8, 0xa0c1f11c71e1cf2c
xor rdx, r8
cmp rcx, rdx
setg dl
mov cl, al
xor cl, dl
xor cl, 0xff
or al, dl
and al, cl
test al, 1
jne 0x1401476e4
jmp 0x1401476ee
call fcn.140008024
jmp 0x14014781b
mov eax, dword [0x1401d0660]
imul eax, dword [0x1401d0664]
sub eax, 0xea267381
sub eax, 0xb9ac240f
sub eax, 0x7bf1d48c
mov ecx, 0x4c495bec
xor ecx, 0xf5e57fe3
add eax, ecx
mov ecx, 0xc72cc9e
xor ecx, 0x36e7ae18
add eax, ecx
cmp eax, 0xd110803e
je 0x140147825
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x30]
mov ecx, dword [0x1401d0668]
add ecx, dword [0x1401d066c]
mov eax, ecx
and eax, 0x28f647b0
mov r9d, 0xe020af09
xor r9d, 0xc8d6e8b9
xor ecx, r9d
or eax, ecx
and eax, 0x800bd3d
add eax, 0x4c6cfc6e
movabs rcx, 0x9f7f81158bdbc12e
movabs r9, 0x60807eea74243ed1
xor rcx, r9
cmp rdx, rcx
setg cl
cmp rdx, r8
setl dl
and cl, dl
mov byte [rsp + 0x2f], cl
cmp eax, 0xa85607a5
je 0x14014772f
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1401477ea
jmp 0x1401477ad
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x30]
mov rax, rdx
and rax, 0xffffffffffffffff
movabs r8, 0x69e1085a64dab5c9
movabs r9, 0x69e1085a64dab5cb
xor r8, r9
imul rax, r8
xor rdx, 0xffffffffffffffff
add rdx, rax
call fcn.1400122ad
jmp 0x14014781b
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x50]
shl rdx, 4
add rax, rdx
mov rdx, qword [rax]
mov qword [rsp + 0x58], rdx
mov rax, qword [rax + 8]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x58]
call fcn.140018d5d
mov rax, qword [rsp + 0x48]
add rsp, 0x68
ret
retf
Function at 0x14014b410
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov eax, dword [0x1401d07b0]
xor eax, 0xc45ac38d
mov edx, dword [0x1401d07b4]
xor edx, 0xe8ee1a58
mov ecx, 0x92b564f8
xor ecx, 0x92b564f8
sub ecx, edx
add eax, ecx
or eax, 0xa0372251
imul eax, eax, 0xb5ad30ea
imul eax, eax, 0x2c96d799
cmp eax, 0x557cd85b
jae 0x14014b4e4
mov eax, dword [0x1401d07b8]
mov ecx, 0xa6f99e55
xor ecx, 0x5597e8e9
xor eax, ecx
xor eax, dword [0x1401d07bc]
mov ecx, 0xcc0ccab3
xor ecx, 0xcc0ccab3
mov edx, 0x4477d701
xor edx, 0x8b0720cc
sub ecx, edx
add eax, ecx
xor eax, 0x7fd1501e
mov ecx, eax
add ecx, 1
mov edx, 0x2555d7a
xor edx, 0xfdaaa285
xor eax, edx
or eax, 0xcb7fd9e7
add eax, ecx
mov dword [rsp + 0x2c], eax
mov eax, 0xbd9aae7a
xor eax, 0x19f88273
mov dword [rsp + 0x28], eax
call fcn.140153418
mov ecx, dword [rsp + 0x28]
mov rdx, rax
mov eax, dword [rsp + 0x2c]
mov rdx, qword [rdx + 0x10]
mov qword [rsp + 0x30], rdx
cmp eax, ecx
je 0x14014b456
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
scasd eax, dword [rdi]
pcmpeqw mm4, qword [rbp - 0x9617]
invalid
Function at 0x140153230
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
call fcn.140153418
mov qword [rsp + 0x28], rax
movabs rcx, 0x8d20d8bc102bbdc3
movabs rax, 0x8d20d8bc102bbde3
xor rcx, rax
call fcn.1400480be
mov rcx, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rcx
cmp byte [rax + 0x60], 0
jne 0x14015327d
mov rax, qword [rsp + 0x30]
mov qword [0x14024ed08], rax
mov eax, dword [0x1401d0a00]
mov r8d, dword [0x1401d0a04]
xor r8d, 0xdf3cc9cf
mov edx, 0xf4bb82c0
xor edx, 0xb447d3f
mov ecx, eax
xor ecx, edx
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x882c1b30
mov r8d, 0xffffffff
xor r8d, 0x882c1b30
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0xb2d95d97
xor r8d, 0x3af546a7
mov edx, eax
and edx, r8d
or eax, 0x882c1b30
imul eax, edx
add eax, ecx
and eax, 0x4d898c3d
sub eax, 0x9104da31
add eax, 0xbe945b5
add eax, 0x9104da31
mov ecx, 0x3ccc27dc
xor ecx, 0xb2f23432
cmp eax, ecx
je 0x14015340f
mov r11d, dword [0x1401d0a08]
mov r10d, dword [0x1401d0a0c]
xor r10d, 0xaec2ac3
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, r10d
xor r8d, 0xffffffff
mov edx, 0xc0a568bc
xor edx, 0x24a351d1
mov eax, 0xf4a5319d
xor eax, 0xb5ace62
xor edx, eax
mov eax, ecx
and eax, 0xe406396d
and r11d, edx
mov r9d, r8d
and r9d, 0xe406396d
and r10d, edx
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
xor ecx, 0xffffffff
or edx, 0xe406396d
and ecx, edx
or eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x13a77c76
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0xa6a7188f
xor r8d, 0xb50064f9
mov edx, eax
and edx, r8d
mov r8d, 0xd3c1d561
xor r8d, 0xc066a917
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xb786183c
xor ecx, 0x809e07ae
xor edx, edx
div ecx
add eax, 0x1d0fa8bb
sub eax, 0xcae38d7a
mov ecx, 0x606f9343
xor ecx, 0x7d603bf8
sub eax, ecx
mov ecx, 0x5be97189
xor ecx, 0xb82e61ba
cmp eax, ecx
je 0x14015340f
add rsp, 0x38
ret
movabs al, byte [0xffffff0ce9cf26ff]
sub rsp, 0x28
call fcn.14005e1a0
call fcn.14005f54e
call fcn.14005fdd0
call fcn.140064c9c
call fcn.140094430
call fcn.14009c092
call fcn.1400c341e
call fcn.1400fca85
call fcn.1401055b4
call fcn.1401172b7
call fcn.140118390
call fcn.1401423c4
nop
add rsp, 0x28
jmp 0x140153230
sub rsp, 0x28
call fcn.140003525
call fcn.1400037ac
call fcn.140004d13
call fcn.14002f658
mov rax, qword [sym.imp.KERNEL32.dll_TlsAlloc]
call rax
mov ecx, eax
mov rax, qword [0x1401ddaf0]
mov dword [rax], ecx
mov rdx, qword [0x1401ddb00]
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
call fcn.14002f653
call fcn.140096d10
call fcn.140096dc0
call fcn.1401172e0
call fcn.1401bf670
call fcn.1401c0f7d
nop
add rsp, 0x28
jmp 0x1401c5060
Function at 0x140154890
Capabilities:
Encode data using xor

Disassembly:
push rax
mov qword [rsp], rcx
mov eax, dword [0x1401d0aa0]
mov ecx, dword [0x1401d0aa4]
mov edx, 0x168ac4ce
xor edx, 0x2a92f3d6
xor ecx, edx
xor edx, edx
div ecx
and eax, eax
xor eax, 0xffffffff
mov ecx, 0x821c4599
and ecx, 0x821c4599
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
and eax, 0xe9181b75
mov ecx, 0x33b15883
xor ecx, 0xfd41f3e6
xor edx, edx
div ecx
cmp eax, 0x2c132a0c
je 0x140154936
mov rdx, qword [rsp]
mov ecx, dword [0x1401d0aa8]
mov eax, dword [0x1401d0aac]
xor eax, 0x121d41ca
xor ecx, eax
xor ecx, 0x7f9715af
mov eax, ecx
and eax, 0x519d5446
xor ecx, 0x519d5446
or eax, ecx
sub eax, 0x5df89802
mov ecx, 0x26e090e8
xor ecx, 0x9c6925da
mov qword [rdx], 0
cmp eax, ecx
jae 0x1401548e9
pop rax
ret
pop rax
mov al, byte [rbx - 0x5516dd]
invalid
Function at 0x140155810
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
call fcn.140163bef
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.140154e78
test al, 1
jne 0x140155842
jmp 0x140155882
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
call fcn.140154f30
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x14015588f
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
movabs rdx, 0xeebab6e13637ad8f
movabs rax, 0xeebab6e13637ad87
xor rdx, rax
call fcn.14000e6f9
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
mov eax, dword [0x1401d0b68]
xor eax, 0x10fca754
xor edx, edx
div dword [0x1401d0b6c]
imul eax, eax, 0xe888350a
mov edx, 0x763e145e
xor edx, 0x89c1eba1
mov ecx, eax
xor ecx, edx
mov edx, 0xec31178
xor edx, 0x7bd1c9e
and ecx, edx
mov edx, 0xffffffff
xor edx, 0x97e0de6
and eax, edx
sub eax, ecx
add eax, 0xc5a919aa
cmp eax, 0x103c5adb
jb 0x140155921
mov eax, dword [0x1401d0b70]
mov ecx, dword [0x1401d0b74]
mov edx, 0xf1c080a5
xor edx, 0xab807818
xor ecx, edx
xor eax, ecx
or eax, 0x5df0c06b
or eax, 0x4c1a248d
mov ecx, 0xfa6f9114
xor edx, edx
div ecx
cmp eax, 0x2ecda895
jae 0x1401558e3
add rsp, 0x38
ret
cld
sbb eax, 0xb9e9a954
invalid
Function at 0x140157ce0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x228
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x110], r8

Function at 0x140159150
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x15d8
call fcn.1401c7680
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xa70], rdx
mov qword [rbp + 0xa78], rcx
mov eax, 0x10
mov qword [rbp + 0xc60], rax
Function at 0x140170a00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.140178f36
mov rdx, qword [rsp + 0x30]
xor eax, eax
test rdx, rdx
cmovg rax, rdx
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
cmp rax, rcx
je 0x140170a61
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov byte [rcx + rax], 0
add rax, 1
mov qword [rsp + 0x40], rax
jmp 0x140170a2d
mov eax, dword [0x1401d1748]
mov ecx, dword [0x1401d174c]
xor ecx, 0x5e3917e9
xor ecx, 0xffffffff
add eax, ecx
mov ecx, 0xd9e20603
xor ecx, 0xd9e20602
add eax, ecx
imul eax, eax, 0x5ab0c0d7
mov ecx, 0x4ea05dfa
xor ecx, 0xd8834996
xor edx, edx
div ecx
imul eax, eax, 0x13db2a28
mov ecx, 0x26122aeb
xor ecx, 0xbdcd2ff3
cmp eax, ecx
je 0x140170b0c
mov eax, dword [0x1401d1750]
xor eax, 0x7a5059a1
xor edx, edx
div dword [0x1401d1754]
and eax, 0x401f9564
mov ecx, 0x30db9b0b
xor ecx, 0xdf1cc5cc
imul eax, ecx
mov edx, 0x299dda65
xor edx, 0x299dda64
mov ecx, eax
add ecx, edx
mov edx, 0x9640a3b3
xor edx, 0x69bf5c4c
xor eax, edx
or eax, 0x76c1aed8
add eax, ecx
cmp eax, 0xd89905d8
ja 0x140170ab3
add rsp, 0x48
ret
push rsi
retfq 0xffffffffffff9ee9