joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019530
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rcx
not rdx
mov r8, rdx
shr r8, 0xb
xor r8, rdx
add r8, 0xffffffff9c48430d
mov rcx, r8
rol rcx, 1
xor rcx, r8
movzx ecx, cx
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141dc1ee8]
sub ecx, dword [0x141dc1eec]
xor ecx, 0x752c901
or ecx, 0xd88016fe
add ecx, 0x375e2096
cmp ecx, 0x3c354b31
ja 0x140019560
ret

Function at 0x140019590
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0x6dacef6f
nop word [rax + rax]
mov ecx, dword [0x141dc1ef0]
xor ecx, dword [0x141dc1ef4]
add ecx, 0x51da00fd
xor ecx, 0x60699676
add ecx, 0xa3b2238c
cmp ecx, 0xb1ca6bd7
ja 0x1400195a0
mov rcx, rdx
rol rcx, 4
xor rcx, rdx
mov edx, 0x7e5f762a
sub rdx, rcx
imul rcx, rdx, 0xdbc7650
nop
mov edx, dword [0x141dc1ef8]
add edx, dword [0x141dc1efc]
imul rdx, rdx, 0x19bfe811
shr rdx, 0x3c
add edx, 0x29985111
xor edx, 0x7c4c80b1
cmp edx, 0x8ceb2dc1
ja 0x1400195e0
mov rdx, rcx
rol rdx, 5
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x1400196f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
rol rcx, 2
nop word [rax + rax]
mov r8d, dword [0x141dc1f18]
xor r8d, dword [0x141dc1f1c]
cmp r8d, 0xa59d8252
je 0x140019700
xor rcx, rdx
mov rdx, rcx
rol rdx, 2
xor rdx, rcx
mov rcx, rdx
rol rcx, 4
xor rcx, rdx
mov edx, 0x64137aec
sub rdx, rcx
mov rcx, rdx
rol rcx, 4
xor ecx, edx
movzx ecx, cx
add rax, rcx
ret

Function at 0x140019750
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rdx
shr rax, 0x1c
xor rax, rdx
mov rdx, rax
xor rdx, 0xc48577c
rol rdx, 7
xor rdx, rax
xor rdx, 0xffffffffa853c8e8
mov rax, rdx
rol rax, 3
xor rax, rdx
nop dword [rax]
mov edx, dword [0x141dc1f20]
sub edx, dword [0x141dc1f24]
xor edx, 0xb1987f77
add edx, 0xfa804f95
cmp edx, 0x968a520f
ja 0x140019780
movzx eax, ax
add rcx, rax
nop word cs:[rax + rax]
mov eax, dword [0x141dc1f28]
xor edx, edx
div dword [0x141dc1f2c]
or eax, 0x401
and eax, 0x8a920e01
xor eax, 0xc684c398
cmp eax, 0x6473b57a
jb 0x1400197b0
mov rax, rcx
ret

Function at 0x1400197e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
shr rcx, 1
xor rcx, rdx
xor rcx, 0xfffffffff20369e4
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
mov r8, rdx
shr r8, 0xc
xor r8, rdx
mov rcx, r8
rol rcx, 2
xor rcx, r8
xor edx, edx
nop word cs:[rax + rax]
test dl, dl
jne 0x140019820
movzx ecx, cx
add rax, rcx
nop word [rax + rax]
mov ecx, dword [0x141dc1f30]
imul ecx, dword [0x141dc1f34]
xor ecx, 0x20
and ecx, 0x18640028
cmp ecx, 0x21c3cd6f
ja 0x140019830
ret

Function at 0x1400198c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, 1
sub rcx, rdx
xor rcx, 0xffffffffec02bcb6
mov rdx, rcx
rol rdx, 1
nop dword [rax + rax]
mov r8d, dword [0x141dc1f48]
imul r8d, dword [0x141dc1f4c]
xor r8d, 0x4970002e
or r8d, 0xb40f57d0
cmp r8d, 0x5a483444
je 0x1400198e0
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop
mov ecx, dword [0x141dc1f50]
sub ecx, dword [0x141dc1f54]
and ecx, 0x456e6cec
add ecx, 0x4d989a93
cmp ecx, 0xa816170f
ja 0x140019910
ret
Function at 0x140019a00
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0x30557e17
sub rax, rdx
xor rax, 0xffffffff85b2e85f
mov r8, rax
rol r8, 7
xor r8, rax
mov r9, r8
rol r9, 3
nop
mov eax, dword [0x141dc1f68]
xor edx, edx
div dword [0x141dc1f6c]
imul rdx, rax, 0x34b8f351
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1b
imul eax, eax, 0x9ee5f0fb
cmp eax, 0xbafcd5fc
ja 0x140019a20
xor r9d, r8d
movzx eax, r9w
add rcx, rax
nop dword [rax]
mov eax, dword [0x141dc1f70]
sub eax, dword [0x141dc1f74]
xor eax, 0x1a3461
add eax, 0xde8b053b
and eax, 0x1b678cf7
cmp eax, 0xf807b48e
ja 0x140019a60
mov rax, rcx
ret

Function at 0x140019d80
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, rdx
rol rcx, 4
xor rcx, rdx
mov rdx, rcx
rol rdx, 1
xor rdx, rcx
mov rcx, rdx
rol rcx, 2
xor rcx, rdx
xor edx, edx
nop word cs:[rax + rax]
test dl, dl
jne 0x140019db0
movzx ecx, cx
add rax, rcx
nop word [rax + rax]
mov ecx, dword [0x141dc1fb0]
and ecx, dword [0x141dc1fb4]
and ecx, 0x9022e13b
xor ecx, 0xd066c002
cmp ecx, 0xb2feac2b
jb 0x140019dc0
ret

Function at 0x140019ed0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov r8d, 0xa0c1e92b
mov rcx, 0xffffffffca2aa492
sub rcx, rdx
shr rcx, 0xc
add rdx, 0x35d55b6d
xor rdx, rcx
mov rcx, rdx
rol rcx, 2
nop dword [rax + rax]
mov r9d, dword [0x141dc1fd8]
xor r9d, dword [0x141dc1fdc]
imul r9d, r9d, 0xa0679b24
imul r9, r8
shr r9, 0x3e
imul r9d, r9d, 0x3ec3dd88
cmp r9d, 0xb4094c92
je 0x140019f00
nop dword [rax]
mov r8d, dword [0x141dc1fe0]
and r8d, dword [0x141dc1fe4]
and r8d, 0x9661822
or r8d, 0xd489c51d
imul r8d, r8d, 0xf81c7c02
cmp r8d, 0x8d25cb8
je 0x140019f30
xor ecx, edx
movzx ecx, cx
add rax, rcx
ret

Function at 0x140019f70
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov rcx, 0xffffffff8adfc54d
sub rcx, rdx
imul rcx, rcx, 0x464ed3db
not rcx
mov rdx, rcx
rol rdx, 2
nop
mov r8d, dword [0x141dc1fe8]
imul r8d, dword [0x141dc1fec]
xor r8d, 0x8204001
or r8d, 0x50e2112
and r8d, 0xd7ffd93
cmp r8d, 0xcbede680
ja 0x140019f90
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x14001a090
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x366f1e29
sub rax, rdx
mov r8, rax
shr r8, 0x10
xor r8, rax
xor r8, 0x6109122b
mov eax, dword [0x141dc1ff8]
xor edx, edx
div dword [0x141dc1ffc]
imul rdx, r8, 0xffffffffda2c0f9c
mov rax, rdx
rol rax, 6
nop word cs:[rax + rax]
mov r8d, dword [0x141dc2000]
xor r8d, dword [0x141dc2004]
or r8d, 0x67efdfff
cmp r8d, 0xb7f31aca
je 0x14001a0d0
xor eax, edx
movzx eax, ax
add rcx, rax
nop word cs:[rax + rax]
mov eax, dword [0x141dc2008]
sub eax, dword [0x141dc200c]
add eax, 0x29a7494e
or eax, 0x51dd03e5
cmp eax, 0xb9c93cc8
jb 0x14001a100
mov rax, rcx
ret
Function at 0x14001a130
Capabilities:
Encode data using xor

Disassembly:
add rdx, 0x5e04f423
mov rax, rdx
shr rax, 2
nop
mov r8d, dword [0x141dc2010]
imul r8d, dword [0x141dc2014]
imul r8d, r8d, 0x3f9fab1c
add r8d, 0x2398a950
cmp r8d, 0x66c9a66d
ja 0x14001a140
xor rax, rdx
mov rdx, rax
rol rdx, 1
nop
mov r8d, dword [0x141dc2018]
sub r8d, dword [0x141dc201c]
imul r8d, r8d, 0x6ea0afb1
add r8d, 0x3f78fd38
xor r8d, 0x66003e82
cmp r8d, 0x76f90f47
ja 0x14001a170
xor edx, eax
movzx eax, dx
add rcx, rax
nop word cs:[rax + rax]
mov eax, dword [0x141dc2020]
xor edx, edx
div dword [0x141dc2024]
add eax, 0x979d5a19
or eax, 0x8904c448
and eax, 0xdd05c46e
cmp eax, 0xb67ad0e6
ja 0x14001a1b0
mov rax, rcx
ret

Function at 0x14001a360
Capabilities:
Encode data using xor

Disassembly:
imul rax, rdx, 0x3b3adb0b
movabs rdx, 0xf28f53705f122c19
add rdx, rax
mov rax, rdx
rol rax, 4
xor eax, edx
movzx eax, ax
add rax, rcx
mov ecx, 0xd1c09daf
nop dword [rax + rax]
mov edx, dword [0x141dc2048]
add edx, dword [0x141dc204c]
xor edx, 0x104e4e16
imul rdx, rcx
shr rdx, 0x3f
imul edx, edx, 0xcf19d1d1
cmp edx, 0x11e4a03d
jb 0x14001a390
ret

Function at 0x14001a620
Capabilities:
Encode data using xor

Disassembly:
neg rdx
mov r8, rdx
shr r8, 0xb
xor r8, rdx
mov r9, r8
rol r9, 6
nop word cs:[rax + rax]
mov eax, dword [0x141dc2088]
xor edx, edx
div dword [0x141dc208c]
or eax, 0x4180068
and eax, 0x26d84a68
imul eax, eax, 0x9e39da59
cmp eax, 0xf84f6c45
ja 0x14001a640
nop word cs:[rax + rax]
mov eax, dword [0x141dc2090]
and eax, dword [0x141dc2094]
imul eax, eax, 0x22eaad02
add eax, 0x668950e6
and eax, 0x4c954faa
cmp eax, 0x880ee79f
je 0x14001a670
xor r9d, r8d
movzx edx, r9w
mov eax, 0xa76b9e25
add rcx, rdx
nop word cs:[rax + rax]
mov edx, dword [0x141dc2098]
xor edx, dword [0x141dc209c]
or edx, 0x17d9b7a1
imul edx, edx, 0x60fee0c1
imul rdx, rax
shr rdx, 0x3f
cmp edx, 0x71e1fd9b
ja 0x14001a6b0
mov rax, rcx
ret

Function at 0x14001a6e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, 0x72a0f36c
sub rcx, rdx
nop dword [rax + rax]
mov edx, dword [0x141dc20a0]
imul edx, dword [0x141dc20a4]
and edx, 0x40200800
xor edx, 0x2100c0
cmp edx, 0x1ee7103b
jb 0x14001a6f0
mov r8d, 0xd6fa0821
xor rcx, 0xd86a79a
add rcx, 0xffffffffece11559
mov rdx, rcx
rol rdx, 1
nop dword [rax + rax]
mov r9d, dword [0x141dc20a8]
xor r9d, dword [0x141dc20ac]
imul r9, r8
shr r9, 0x3d
add r9d, 0x931fff61
imul r9, r9, 0x7f4ed071
shr r9, 0x3d
cmp r9d, 0x73756ad6
ja 0x14001a730
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x14001a820
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
xor rdx, 0xffffffff87e6ab0a
mov rcx, rdx
shr rcx, 9
xor rcx, rdx
add rcx, 0xffffffffa94a4a2f
mov rdx, rcx
rol rdx, 6
nop word cs:[rax + rax]
mov r8d, dword [0x141dc20c8]
xor r8d, dword [0x141dc20cc]
imul r8, r8, 0x65bc780f
shr r8, 0x3e
imul r8d, r8d, 0x7878e02a
add r8d, 0x3b98fb52
cmp r8d, 0xfcb4f3b6
ja 0x14001a850
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop dword [rax + rax]
mov ecx, dword [0x141dc20d0]
sub ecx, dword [0x141dc20d4]
and ecx, 0x8992823e
shr ecx, 1
imul rcx, rcx, 0x249d2453
shr rcx, 0x3b
add ecx, 0x83e09883
cmp ecx, 0xc37a8a5c
ja 0x14001a890
ret
Function at 0x14001a8c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rcx
add rdx, 0x148d8bce
xor rdx, 0xffffffffe664e7bc
mov rcx, rdx
shr rcx, 0xc
nop dword [rax + rax]
mov r8d, dword [0x141dc20d8]
imul r8d, dword [0x141dc20dc]
xor r8d, 0x3f99f2bd
imul r9, r8, 0x5ddb6075
shr r9, 0x20
sub r8d, r9d
shr r8d, 1
add r8d, r9d
shr r8d, 0x1d
cmp r8d, 0xb0dc9bed
je 0x14001a8e0
xor rcx, rdx
mov rdx, rcx
rol rdx, 6
xor edx, ecx
movzx ecx, dx
add rax, rcx
ret

Function at 0x14001a960
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x141dc20e0]
xor edx, edx
div dword [0x141dc20e4]
mov edx, 0xe14c74bf
mov eax, 0x5c4125e3
sub rax, r8
xor rax, 0x373f6b78
nop word cs:[rax + rax]
mov r8d, dword [0x141dc20e8]
xor r8d, dword [0x141dc20ec]
imul r8, rdx
shr r8, 0x3f
imul r8d, r8d, 0x3ea79332
cmp r8d, 0x11d74fec
je 0x14001a990
mov rdx, rax
rol rdx, 6
xor edx, eax
movzx eax, dx
add rcx, rax
mov rax, rcx
ret

Function at 0x14001a9d0
Capabilities:
Encode data using xor

Disassembly:
imul rdx, rdx, 0xffffffffba39bf93
movabs rax, 0xe48a6ddf40790e95
add rax, rdx
mov rdx, rax
rol rdx, 2
nop dword [rax + rax]
mov r8d, dword [0x141dc20f0]
and r8d, dword [0x141dc20f4]
or r8d, 0x23014106
and r8d, 0x23c341ee
cmp r8d, 0x887ff8b2
je 0x14001a9f0
xor edx, eax
movzx eax, dx
add rcx, rax
nop dword [rax]
mov eax, dword [0x141dc20f8]
xor edx, edx
div dword [0x141dc20fc]
add eax, 0x63debddd
imul rax, rax, 0xb810391
shr rax, 0x3a
xor eax, 0xdabbecab
cmp eax, 0xfcb9278b
ja 0x14001aa20
mov rax, rcx
ret

Function at 0x14001ab30
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
imul rcx, rdx, 0xffffffffb23bcb98
mov rdx, rcx
shr rdx, 8
xor rdx, rcx
mov ecx, 0x6012ee2c
sub rcx, rdx
mov rdx, rcx
rol rdx, 2
nop word cs:[rax + rax]
mov r8d, dword [0x141dc2110]
xor r8d, dword [0x141dc2114]
cmp r8d, 0x5d3e7515
je 0x14001ab60
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop
mov ecx, dword [0x141dc2118]
add ecx, dword [0x141dc211c]
and ecx, 0xe541c897
add ecx, 0xd13f5261
and ecx, 0x832c1020
cmp ecx, 0x8fc452d5
ja 0x14001ab80
ret

Function at 0x14001ace0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rdx
xor rdx, 0x53f3ec6e
add rdx, 0x763f6713
nop word cs:[rax + rax]
mov ecx, dword [0x141dc2150]
xor ecx, dword [0x141dc2154]
or ecx, 0xdeffffaf
cmp ecx, 0xd08e8e78
jb 0x14001ad00
mov rcx, rdx
rol rcx, 5
xor ecx, edx
movzx ecx, cx
add rax, rcx
ret

Function at 0x14001ad60
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
imul rcx, rdx, 0x4b504a7f
movabs rdx, 0x7615abc6e8feaac
add rdx, rcx
mov rcx, rdx
rol rcx, 3
xor rcx, rdx
nop word cs:[rax + rax]
mov edx, dword [0x141dc2158]
add edx, dword [0x141dc215c]
and edx, 0xd23a100a
imul edx, edx, 0x9b5b7817
xor edx, 0xcee07717
cmp edx, 0x9d6b0052
ja 0x14001ad90
movzx ecx, cx
add rax, rcx
nop dword [rax]
mov ecx, dword [0x141dc2160]
sub ecx, dword [0x141dc2164]
imul ecx, ecx, 0x7f218007
add ecx, 0x71e245b9
cmp ecx, 0xe5a7cc85
ja 0x14001adc0
ret
Function at 0x14001af10
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
rol rax, 1
xor rax, rdx
mov r8, rax
shr r8, 0xe
xor r8, rax
mov r9, r8
rol r9, 6
nop word [rax + rax]
mov eax, dword [0x141dc2188]
xor eax, dword [0x141dc218c]
or eax, 0xae0a2b25
add eax, 0xf9dbff0b
imul rdx, rax, 0x49e1f109
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1d
cmp eax, 0xdba4312a
ja 0x14001af30
mov eax, dword [0x141dc2190]
xor edx, edx
div dword [0x141dc2194]
xor r9, r8
mov rax, 0xffffffff912a2872
sub rax, r9
mov rdx, rax
rol rdx, 1
nop word cs:[rax + rax]
mov r8d, dword [0x141dc2198]
xor r8d, dword [0x141dc219c]
imul r8d, r8d, 0xb63ab680
add r8d, 0x2941ed93
cmp r8d, 0xbbd6483
ja 0x14001af90
xor edx, eax
movzx eax, dx
add rcx, rax
mov rax, rcx
ret

Function at 0x14001afd0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, 0x9d0c85f9
xor rdx, 0x7583b869
add rdx, 0xffffffffebb275dd
nop word cs:[rax + rax]
mov r8d, dword [0x141dc21a0]
and r8d, dword [0x141dc21a4]
xor r8d, 0xfd025e6e
imul r8, rcx
shr r8, 0x3c
cmp r8d, 0xc1a94aad
je 0x14001aff0
mov rcx, rdx
rol rcx, 7
xor ecx, edx
movzx ecx, cx
add rax, rcx
ret

Function at 0x14001b030
Capabilities:
Encode data using xor

Disassembly:
movabs rax, 0xec460a95df698d7c
imul rax, rdx
mov rdx, rax
rol rdx, 4
xor rdx, rax
mov rax, rdx
rol rax, 5
xor eax, edx
movzx eax, ax
add rax, rcx
nop word [rax + rax]
mov ecx, dword [0x141dc21a8]
and ecx, dword [0x141dc21ac]
xor ecx, 0xa0600002
and ecx, 0xe0ee5586
imul ecx, ecx, 0x95f3d91
cmp ecx, 0x340eed45
je 0x14001b060
ret

Function at 0x14001b300
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x45cf8e61
sub rax, rdx
imul rdx, rax, 0xffffffffac9f0bcd
mov rax, rdx
shr rax, 3
xor rax, rdx
not rax
nop dword [rax]
mov edx, dword [0x141dc21f8]
xor edx, dword [0x141dc21fc]
or edx, 0x3145598a
imul edx, edx, 0x1e0c458b
cmp edx, 0xc5b63c0c
je 0x14001b320
mov rdx, rax
rol rdx, 1
xor edx, eax
movzx r8d, dx
mov eax, dword [0x141dc2200]
xor edx, edx
div dword [0x141dc2204]
add rcx, r8
nop dword [rax]
mov eax, dword [0x141dc2208]
and eax, dword [0x141dc220c]
add eax, 0x853b49b
or eax, 0x6cf78d43
cmp eax, 0xb9ba5bf8
je 0x14001b360
mov rax, rcx
ret

Function at 0x14001b390
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov r8d, 0xa4166465
imul rcx, rdx, 0x1e384cf2
mov edx, dword [0x141dc2210]
and edx, dword [str._k_Ly7]
imul edx, edx, 0xf541cd48
add edx, 0xccb55400
imul rdx, r8
shr rdx, 0x3f
cmp edx, 0x1c4421f4
ja 0x14001b3a0
xor rcx, 0x42997f30
mov rdx, rcx
rol rdx, 1
nop word cs:[rax + rax]
mov r8d, dword [0x141dc2218]
and r8d, dword [0x141dc221c]
imul r8, r8, 0x529baa67
shr r8, 0x3e
or r8d, 0xdbdefae4
cmp r8d, 0xedc9438a
je 0x14001b3e0
xor edx, ecx
movzx ecx, dx
add rax, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141dc2220]
or ecx, dword [0x141dc2224]
xor ecx, 0x10081a2
or ecx, 0xbe7f5e11
cmp ecx, 0x1fbd81fd
je 0x14001b420
ret
Function at 0x14001b4c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, 0xffffffffef3c9c68
sub rax, rdx
imul rax, rax, 0xffffffffaecb7df6
mov rdx, rax
rol rdx, 1
xor edx, eax
movzx eax, dx
add rax, rcx
mov ecx, 0xb62612db
nop word cs:[rax + rax]
mov edx, dword [0x141dc2238]
or edx, dword [0x141dc223c]
xor edx, 0x42040208
or edx, 0xbc7be927
imul rdx, rcx
shr rdx, 0x3e
cmp edx, 0x3a612be7
je 0x14001b4f0
ret
Function at 0x140053190
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r9
mov r14, rdx
mov rbx, rcx
mov rdi, qword [rsp + 0x70]
xor eax, eax
nop dword [rax]
test al, al
jne 0x1400531b0
cmp r8d, 0x110000
je 0x1400531f0
nop dword [rax]
mov eax, dword [0x141dc7f48]
imul eax, dword [0x141dc7f4c]
or eax, 0xe82ae5fb
and eax, 0xfeabe7ff
cmp eax, 0xf4792281
je 0x1400531c0
mov rcx, rbx
mov edx, r8d
call qword [r14 + 0x20]
mov ecx, eax
mov al, 1
test cl, cl
jne 0x14005323d
test rsi, rsi
je 0x14005323b
nop word cs:[rax + rax]
mov eax, dword [0x141dc7f50]
xor eax, dword [0x141dc7f54]
add eax, 0x56f37fe2
xor eax, 0x2a809580
and eax, 0x2ba2d5b4
cmp eax, 0x99162ac7
je 0x140053200
mov rax, qword [r14 + 0x18]
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp rax
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140057810
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
lea rax, [rdx + 7]
and rax, 0xfffffffffffffff8
sub rax, rdx
je 0x1400578b9
cmp rax, r8
cmovae rax, r8
test rax, rax
je 0x1400578b9
xor r9d, r9d
xor r10d, r10d
mov r11d, dword [0x141dc8870]
add r11d, dword [0x141dc8874]
xor r11d, 0x61f13bb
imul r11d, r11d, 0xc75401cd
or r11d, 0x4c7c17bf
cmp r11d, 0x1fff5581
jb 0x140057840
cmp byte [rdx + r10], cl
je 0x140057aa6
nop word cs:[rax + rax]
mov r11d, dword [0x141dc8878]
xor r11d, dword [0x141dc887c]
add r11d, 0xc5043623
cmp r11d, 0x4166adbf
jb 0x140057880
inc r10
test r9b, r9b
jne 0x1400578a1
cmp r10, rax
jne 0x140057840
lea r9, [r8 - 0x10]
cmp rax, r9
jbe 0x1400578f1
jmp 0x140057989
lea r9, [r8 - 0x10]
xor eax, eax
nop
mov r10d, dword [0x141dc8838]
imul r10d, dword [0x141dc883c]
xor r10d, 0xca49bf9a
imul r10, r10, 0x3c571f95
shr r10, 0x3d
xor r10d, 0x8483468f
cmp r10d, 0x13ea3d34
jb 0x1400578c0
movabs r10, 0xfefefefefefefeff
movzx esi, cl
movabs r11, 0x101010101010101
imul r11, rsi
movabs rsi, 0x8080808080808080
mov edi, 0x8491d6eb
xor ebx, ebx
nop dword [rax]
mov r14, qword [rdx + rax]
xor r14, r11
lea r15, [r14 + r10]
not r14
and r14, r15
mov r15, qword [rdx + rax + 8]
xor r15, r11
lea r12, [r15 + r10]
not r15
and r15, r12
or r15, r14
test r15, rsi
jne 0x140057989
nop dword [rax + rax]
mov r14d, dword [0x141dc8848]
sub r14d, dword [0x141dc884c]
imul r14, rdi
shr r14, 0x3f
or r14d, 0x53e505e0
cmp r14d, 0xcab93d4a
ja 0x140057950
add rax, 0x10
nop word [rax + rax]
test bl, bl
jne 0x140057980
cmp rax, r9
jbe 0x140057920
mov r10d, 0x93a7b815
add rdx, rax
mov r9, r8
sub r9, rax
nop dword [rax + rax]
mov r11d, dword [0x141dc8840]
mov esi, dword [str.Wxp]
add r11d, esi
add r11d, 0x58e151eb
shr r11d, 1
imul r11, r10
shr r11, 0x3e
or r11d, 0x2e2e1e50
cmp r11d, 0xa5a2d769
ja 0x1400579a0
cmp r8, rax
jne 0x1400579de
xor eax, eax
jmp 0x140057ab0
xor eax, eax
mov r8d, 0xa9659f65
xor r10d, r10d
nop dword [rax]
cmp byte [rdx + r10], cl
je 0x140057a9f
nop word [rax + rax]
mov r11d, dword [0x141dc8850]
sub r11d, dword [0x141dc8854]
imul r11, r8
shr r11, 0x3e
imul r11d, r11d, 0x4ed5689a
imul r11, r11, 0x7b3dfe0d
shr r11, 0x3e
cmp r11d, 0xe7fa8899
ja 0x140057a00
inc r10
mov r11d, dword [str.1M]
add r11d, dword [0x141dc885c]
imul r11d, r11d, 0x28a2ca3e
cmp r11d, 0x9fb0c55a
je 0x140057a34
nop word cs:[rax + rax]
mov r11d, dword [0x141dc8860]
sub r11d, dword [0x141dc8864]
add r11d, 0x25a7176
shr r11d, 2
imul r11, r11, 0x26d00345
shr r11, 0x3b
add r11d, 0x516d3623
cmp r11d, 0x873dd3f4
ja 0x140057a60
cmp r10, r9
jne 0x1400579f0
jmp 0x140057ab0
mov eax, 1
jmp 0x140057ab0
mov eax, 1
nop dword [rax + rax]
mov ecx, dword [0x141dc8868]
imul ecx, dword [0x141dc886c]
xor ecx, 0xbc12f708
shr ecx, 2
imul rcx, rcx, 0x5992ddf
shr rcx, 0x36
cmp ecx, 0x8f6090ef
je 0x140057ab0
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400602a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx]
nop dword [rax]
mov eax, dword [0x141dc9a58]
xor edx, edx
div dword [0x141dc9a5c]
imul eax, eax, 0xc81d7d19
add eax, 0xa97ec78f
and eax, 0xec5bf3cd
cmp eax, 0x418b5dc7
je 0x1400602c0
test rcx, rcx
je 0x140060320
mov eax, dword [0x141dc9a60]
imul eax, dword [0x141dc9a64]
xor eax, 0x4b55f2c1
add eax, 0x85bf6128
and eax, 0xd8c0e855
cmp eax, 0x20a6eea3
jae 0x1400603df
jmp 0x140060423
mov eax, dword [0x141dc9a70]
xor eax, dword [0x141dc9a74]
imul eax, eax, 0x92df6f7e
and eax, 0x39cce578
add eax, 0xf6aaf805
cmp eax, 0x6e77c5f9
ja 0x140060320
nop word cs:[rax + rax]
mov eax, dword [0x141dc9a78]
sub eax, dword [0x141dc9a7c]
add eax, 0x908ad344
or eax, 0xffbfd67f
cmp eax, 0xa1f210da
jb 0x140060350
mov eax, dword [0x141dc9a80]
xor eax, dword [0x141dc9a84]
mov rbx, qword [rsi + 0x20]
xor eax, 0x65ca4001
or eax, 0x9a34ab4a
cmp eax, 0xa9487e91
jne 0x1400603a0
mov rdx, qword [rsi + 0x28]
mov rcx, rbx
mov r8, rdi
call fcn.140060a70
nop dword [rax]
mov eax, dword [0x141dc9a88]
xor eax, dword [0x141dc9a8c]
imul eax, eax, 0x58862fcd
imul rax, rax, 0x4e4d0ab9
shr rax, 0x3d
imul ebp, eax, 0x6e91abb8
mov rdx, qword [rsi + 0x28]
mov rcx, rbx
mov r8, rdi
call fcn.140060a70
cmp ebp, 0x32b5cd45
ja 0x1400603a0
jmp 0x1400609b0
Function at 0x140060a70
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov r14, r8
mov r12, rdx
mov rdi, rcx
mov eax, dword [0x141dc9b60]
sub eax, dword [0x141dc9b64]
and eax, 0xf9218f04
add eax, 0x62c69660
imul rax, rax, 0x408a4e29
shr rax, 0x3c
cmp eax, 0x3230f9b
je 0x140060ae7
mov eax, dword [0x141dc9b68]
imul eax, dword [0x141dc9b6c]
imul ecx, eax, 0x1fac7e7b
add ecx, 0xecf5e3db
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov rbx, rsp
cmp ecx, 0xeda72b04
jbe 0x140060b00
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
jmp 0x140060ab6
mov eax, dword [0x141dc9b70]
or eax, dword [0x141dc9b74]
xor eax, 0x6cd36e11
add eax, 0x392f4313
imul rax, rax, 0x66d51ee9
shr rax, 0x3d
cmp eax, 0x3744541d
je 0x140060b00
mov r8, qword [r14 + 8]
mov eax, 0xe2836473
nop word cs:[rax + rax]
mov ecx, dword [0x141dc9b78]
sub ecx, dword [0x141dc9b7c]
imul ecx, ecx, 0x4dc91434
and ecx, 0xe439a2f8
imul rcx, rax
shr rcx, 0x3c
cmp ecx, 0xe68d8e70
ja 0x140060b40
test r8, r8
je 0x140060bc0
nop dword [rax]
mov eax, dword [0x141dc9b80]
mov ecx, dword [0x141dc9b84]
add eax, ecx
add eax, 0xaa23d8da
and eax, 0xb9a1d3bc
imul eax, eax, 0x2e0d9774
cmp eax, 0x10e6e41d
jb 0x140060b70
mov rdx, qword [r14]
sub rsp, 0x20
mov rcx, rdi
call qword [r12 + 0x18]
add rsp, 0x20
mov ecx, eax
mov al, 1
test cl, cl
jne 0x14006138b
nop word cs:[rax + rax]
mov eax, dword [0x141dc9b88]
mov ecx, dword [0x141dc9b8c]
add eax, ecx
add eax, 0xb7fac664
imul rax, rax, 0x4a161f39
shr rax, 0x38
cmp eax, 0xeb360435
je 0x140060bc0
mov r9, qword [r14 + 0x10]
nop dword [rax]
mov eax, dword [0x141dc9b90]
xor eax, dword [0x141dc9b94]
xor eax, 0x22a2ce66
add eax, 0x5530d475
xor eax, 0xc5483151
cmp eax, 0x7e148045
ja 0x140060bf0
mov rax, qword [r14 + 0x18]
test rax, rax
je 0x140061385
lea rax, [rax + rax*2]
lea rax, [r9 + rax*8]
mov qword [rbp - 8], rax
nop dword [rax + rax]
mov eax, dword [0x141dc9b98]
or eax, dword [0x141dc9b9c]
add eax, 0x5de5aa8c
or eax, 0x42c2186
and eax, 0x353e31fe
cmp eax, 0x82702f17
ja 0x140060c30
lea r14, [0x141db5e53]
xor r13d, r13d
mov qword [rbp], r12