joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023660
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rcx
call fcn.14000c827
mov rcx, qword [rsp + 0x38]
add rax, 0x50
mov qword [rsp + 0x40], rax
add rcx, 8
mov qword [rsp + 0x48], rcx
xor eax, eax
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov qword [rsp + 0x30], rdx
cmp rax, rcx
jge 0x1400237dc
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.14001bd80
test al, 1
jne 0x1400236d5
jmp 0x1400237c9
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.1401b2310
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140023827
mov ecx, dword [0x1401f4178]
mov edx, dword [0x1401f417c]
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
mov ecx, 0x1cf0b0ce
xor ecx, 0x8e8d61e3
and eax, ecx
and eax, 0x44917a9
sub eax, 0x3c63d36b
cmp eax, 0xdbf3306d
ja 0x14002382d
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x48]
mov edx, dword [0x1401f4180]
mov r8d, 0xf15201c3
xor r8d, 0xe414266e
xor edx, r8d
mov r8d, dword [0x1401f4184]
add edx, 0x5a9bb9ac
sub edx, r8d
mov r8d, 0x27d5d0c
xor r8d, 0x58e6e4a0
sub edx, r8d
mov r8d, 0x37d134c3
xor r8d, 0x2b9d5053
imul edx, r8d
sub edx, 0x80c48fe8
imul edx, edx, 0x9996502b
mov dword [rsp + 0x24], edx
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
movabs rdx, 0x87d361cc48f307fc
movabs rax, 0x87d361cc48f307f4
xor rdx, rax
call fcn.14000fac0
mov eax, dword [rsp + 0x24]
cmp eax, 0x1f64ec0a
jbe 0x140023730
jmp 0x1400237c9
mov rax, qword [rsp + 0x28]
add rax, 1
mov qword [rsp + 0x50], rax
jmp 0x14002368c
mov rax, qword [rsp + 0x30]
cmp rax, 0
je 0x140023827
mov rcx, qword [rsp + 0x30]
movabs rax, 0x4000000000000000
and rax, qword [rcx]
movabs rcx, 0x440da17b8ef4dd82
movabs rdx, 0x440da17b8ef4dd82
xor rcx, rdx
cmp rax, rcx
jne 0x140023827
mov rcx, qword [rsp + 0x30]
call fcn.14000f90d
nop
add rsp, 0x58
ret
scasd eax, dword [rdi]
pop rcx
xor byte [rbp - 0x10517], al
jmp qword [rsi + 0x2e]
Function at 0x140023840
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401f4188]
mov ecx, 0x308273d7
xor ecx, 0xbe7d9266
xor eax, ecx
xor edx, edx
div dword [0x1401f418c]
mov ecx, eax
add ecx, 0x72dd5199
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xc957e57c
xor edx, 0x27ca17a9
mov r8d, 0xc5c931b6
xor r8d, 0x3a36ce49
xor edx, r8d
or eax, edx
mov edx, 0xdd3009cd
xor edx, 0x33adfb18
and ecx, edx
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0xfd435630
xor ecx, 0x4b210cd4
mov edx, 0x288196ed
xor edx, 0xd77e6912
xor ecx, edx
add eax, ecx
add eax, 1
mov ecx, 0x79c7bd60
xor ecx, 0x27dd082a
cmp eax, ecx
jb 0x140023958
mov eax, dword [0x1401f4190]
and eax, dword [0x1401f4194]
mov ecx, 0xe1e40c11
xor ecx, 0x1aa54979
or eax, ecx
mov ecx, 0x4a8fa028
xor edx, edx
div ecx
xor eax, 0x8de89836
mov dword [rsp + 0x28], eax
call fcn.14000c827
mov rcx, rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax]
call fcn.140081dc0
mov rcx, qword [rsp + 0x20]
mov eax, dword [rsp + 0x28]
cmp byte [rcx + 0x50], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x961010c6
ja 0x1400238d3
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x140023948
jmp 0x140023952
add byte [rax], al
mov rcx, qword [rsp + 0x30]
call fcn.140081fdb
nop
add rsp, 0x38
ret
insb byte [rdi], dx
jl 0x140023946
jb 0x14002395e
invalid
invalid

Function at 0x140025333
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
xor eax, eax
mov edx, eax
call fcn.140024b40
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x140024e30
Function at 0x140028ec0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
mov ecx, dword [0x1401f43e8]
mov edx, dword [0x1401f43ec]
xor edx, 0xc6e0bace
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, edx
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
Function at 0x14002f1b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x14002f2dd
mov eax, dword [0x1401f4638]
mov ecx, dword [0x1401f463c]
mov edx, 0xf251e5f2
xor edx, 0xbf4f1b69
xor ecx, edx
sub eax, ecx
mov ecx, 0xdafcc881
xor ecx, 0x8b86c119
add eax, ecx
sub eax, 0xec0c2051
sub eax, 0x517a0998
mov ecx, 0x5c04183f
xor ecx, 0x5820d0f0
or eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xfbd3ca8b
mov r8d, 0xffffffff
xor r8d, 0xfbd3ca8b
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xfbd3ca8b
or eax, 0xfbd3ca8b
imul eax, edx
add eax, ecx
cmp eax, 0xcd2deb5c
ja 0x14002f2e3
mov ecx, dword [0x1401f4640]
mov eax, dword [0x1401f4644]
mov edx, 0xa8d84f2f
xor edx, 0x149eb291
xor eax, edx
xor ecx, eax
sub ecx, 0x284b0871
mov edx, 0x15de31c
xor edx, 0xaff7c0c0
mov eax, ecx
and eax, edx
xor ecx, 0xaeaa23dc
or eax, ecx
mov ecx, 0x6fc661af
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x30]
movabs rcx, 0x4000000000000000
and rcx, qword [rdx]
movabs rdx, 0x911fd7a8eb135e8e
movabs r8, 0x911fd7a8eb135e8e
xor rdx, r8
cmp rcx, rdx
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0xdc0f5527
ja 0x14002f243
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x14002f2d3
jmp 0x14002f2dd
mov rcx, qword [rsp + 0x30]
call fcn.14000f90d
nop
add rsp, 0x38
ret
push rdi
sbb byte [rbp - 0xa81699], 0xff
dec dword [rax - 0x7d]
sub rsp, 0x48
mov qword [rsp + 0x30], rcx
add rcx, 8
mov qword [rsp + 0x38], rcx
xor eax, eax
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov qword [rsp + 0x28], rdx
cmp rax, rcx
jge 0x14002f378
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.140012cd3
test al, 1
jne 0x14002f34e
jmp 0x14002f365
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.140010f87
mov rax, qword [rsp + 0x20]
add rax, 1
mov qword [rsp + 0x40], rax
jmp 0x14002f305
mov rax, qword [rsp + 0x28]
cmp rax, 0
je 0x14002f3ad
mov rcx, qword [rsp + 0x28]
movabs rax, 0x4000000000000000
and rax, qword [rcx]
cmp rax, 0
jne 0x14002f3ad
mov rcx, qword [rsp + 0x28]
call fcn.14000f90d
nop
add rsp, 0x48
ret
Function at 0x14002fa10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
xor eax, eax
test r8, r8
cmovg rax, r8
mov qword [rsp + 0x18], rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x18]
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
cmp rax, rcx
je 0x14002fa6c
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
mov dl, byte [rdx + rax]
mov byte [rcx + rax], dl
add rax, 1
mov qword [rsp + 0x20], rax
jmp 0x14002fa33
mov ecx, dword [str.3l___]
xor ecx, dword [0x1401f467c]
mov eax, 0xbddbcb3c
xor eax, 0xb4e48bcd
sub ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xbbf9f6dc
xor edx, 0xd85fa49a
and eax, edx
mov edx, 0xffffffff
xor edx, 0x63a65246
and ecx, edx
sub ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
and eax, edx
mov edx, 0x750fd728
xor edx, 0xa866d30c
mov r8d, 0x3901a443
xor r8d, 0xc6fe5bbc
xor edx, r8d
mov r8d, 0xffffffff
xor r8d, 0xdd690424
and edx, r8d
or eax, edx
mov edx, 0x831bbbf6
xor edx, 0x7ce44409
xor eax, edx
or ecx, 0xdd690424
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
cmp eax, 0xf3f41b0f
ja 0x14002fb6e
mov eax, dword [0x1401f4680]
mov edx, dword [0x1401f4684]
mov r8d, 0x828ab407
xor r8d, 0x828ab406
mov ecx, eax
add ecx, r8d
mov r8d, 0x4b685839
xor r8d, 0xb497a7c6
xor eax, r8d
or eax, edx
add eax, ecx
imul eax, eax, 0x14f62f8a
xor eax, 0xddcef8f
mov ecx, eax
and ecx, 0x6f1690ac
shl ecx, 1
mov edx, 0x18103d15
xor edx, 0x7706adb9
add eax, edx
sub eax, ecx
cmp eax, 0x69a0c400
jb 0x14002fb07
add rsp, 0x28
ret
mov es, word [rbx - 0x64]
pushfq
jmp 0x14002fb07
Function at 0x140031ad0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 8], rcx
mov ecx, dword [0x1401f47a0]
and ecx, dword [0x1401f47a4]
mov edx, 0x8b66c43a
xor edx, 0x74993bc5
mov eax, ecx
xor eax, edx
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0x6385bbde
and ecx, 0x6385bbde
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0x5a2072b2
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
and eax, 0xc9938e3a
mov edx, 0x3e9252a9
xor edx, 0xf701dc93
or ecx, edx
add eax, ecx
mov ecx, 0xca6d5dc1
xor ecx, 0x574a8631
cmp eax, ecx
je 0x140031c07
mov edx, dword [0x1401f47a8]
mov ecx, dword [0x1401f47ac]
xor ecx, 0x19f5639e
mov eax, edx
and eax, ecx
xor edx, ecx
mov ecx, eax
mov eax, edx
lea eax, [rax + rcx*2]
and eax, 0xb68d3e24
add eax, 0xa9a88416
mov dword [rbp - 0xc], eax
mov eax, 0x10
call fcn.1401f2390
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
xor eax, eax
mov ecx, eax
sub rsp, 0x20
call fcn.140018a50
add rsp, 0x20
mov ecx, 0x40
mov edx, 8
sub rsp, 0x20
call fcn.140013970
mov rdx, qword [rbp - 0x20]
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x18], rcx
mov r8, qword [0x1402090b8]
mov qword [rcx], r8
lea r8, [0x14020147c]
mov qword [rcx + 0x10], r8
add rcx, 0x18
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.1400191eb
mov eax, dword [rbp - 0xc]
add rsp, 0x20
cmp eax, 0xbae0a11d
jae 0x140031b45
mov rax, qword [rbp - 0x18]
mov rsp, rbp
pop rbp
ret
mov r14b, 0x8b
sub ecx, 0x35
invalid

Function at 0x140031c10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rcx
call fcn.14002fe52
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov r8d, 2
call fcn.140031a94
mov rcx, rax
mov rax, qword [rsp + 0x50]
mov al, byte [rax]
test al, al
setne al
sub rcx, 2
sete cl
or al, cl
test al, 1
jne 0x140031cbf
lea rcx, [0x140201498]
call fcn.140031ad0
mov rcx, rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rcx
cmp byte [rax], 0
jne 0x140031cbf
mov rcx, qword [rsp + 0x30]
movabs rax, 0x441033739176f1ea
movabs rdx, 0x44103373e98e8731
xor rax, rdx
lea rdx, [0x14020147c]
lea r8, [0x140201484]
lea r9, str.OtRU_
mov qword [rsp + 0x20], rax
call fcn.14001302b
mov eax, dword [0x1401f47b0]
xor eax, 0x321bbcbb
xor edx, edx
div dword [0x1401f47b4]
mov ecx, eax
xor ecx, 0xb72ca4ec
xor ecx, 0xffffffff
or eax, 0xb72ca4ec
and eax, ecx
add eax, 0x79bc7ddc
mov r8d, 0xffffffff
xor r8d, 0x5a664106
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0x3884c72d
xor r8d, 0x62e2862b
mov edx, eax
and edx, r8d
or eax, 0x5a664106
imul eax, edx
add eax, ecx
cmp eax, 0xcdb6d15f
ja 0x140031d72
mov eax, dword [0x1401f47b8]
or eax, dword [0x1401f47bc]
sub eax, 0x9d0eb4b2
mov ecx, 0x8689106
xor ecx, 0x14ed517e
and eax, ecx
sub eax, 0x1de621ab
mov ecx, 0x9c0d3f1b
xor ecx, 0x97a70bbe
add eax, ecx
add eax, 0x1de621ab
cmp eax, 0x62e22584
jae 0x140031d2d
add rsp, 0x58
ret
invalid
Function at 0x140032770
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rcx
call fcn.14002fe52
mov rdx, qword [rsp + 0x38]
mov rax, qword [rdx]
mov qword [rsp + 0x40], rax
cmp rax, 0
jle 0x1400328c0
mov eax, dword [0x1401f4820]
and eax, dword [0x1401f4824]
sub eax, 0x4ec53b5a
mov edx, eax
xor edx, 0xffffffff
and edx, 0xb9facf4a
mov r8d, 0xffffffff
xor r8d, 0xb9facf4a
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0x1e1e1233
xor r8d, 0xa7e4dd79
mov edx, eax
and edx, r8d
or eax, 0xb9facf4a
imul eax, edx
add eax, ecx
sub eax, 0xc79a880b
cmp eax, 0xa0774880
jb 0x1400328c5
mov r8, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401f4828]
xor eax, 0xdc182e88
xor edx, edx
div dword [0x1401f482c]
mov r9d, eax
mov rax, qword [rsp + 0x38]
or r9d, 0x5f22d6a7
mov r10d, r9d
xor r10d, 0xffffffff
mov edx, 0x773dbcb4
xor edx, 0xd1a09b38
and edx, r10d
mov r10d, 0x34bfa90f
xor r10d, 0x92228e83
mov r11d, 0xce5108b6
xor r11d, 0x31aef749
xor r10d, r11d
and r9d, r10d
or edx, r9d
mov r9d, edx
xor r9d, 0xa3b43143
mov r10d, 0xefff91de
xor r10d, 0x4c4ba09d
mov r11d, 0x83020d70
xor r11d, 0x7cfdf28f
xor r10d, r11d
and edx, r10d
shl edx, 1
sub edx, r9d
mov dword [rsp + 0x2c], edx
mov edx, 0x1c0b079b
xor edx, 0xd9bb3d97
mov dword [rsp + 0x28], edx
mov rdx, qword [rax + 8]
add rdx, 8
call fcn.1400322a6
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
je 0x1400327f7
jmp 0x1400328c0
add rsp, 0x48
ret
cmp eax, 0xe917a2df
sub edi, edi
invalid
Function at 0x1400333d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], r8
mov rax, rdx
mov rdx, rax
imul rdx, rcx
mov qword [rsp + 0x40], rdx
cvtsi2sd xmm0, rcx
cvtsi2sd xmm1, rax
mulsd xmm0, xmm1
movsd qword [rsp + 0x48], xmm0
cvtsi2sd xmm1, rdx
movsd qword [rsp + 0x50], xmm1
ucomisd xmm0, xmm1
jne 0x14003341c
jp 0x14003341c
jmp 0x140033467
movsd xmm1, qword [rsp + 0x48]
movsd xmm0, qword [rsp + 0x50]
subsd xmm0, xmm1
call fcn.1401f23d0
movaps xmm1, xmm0
movsd xmm0, qword [rsp + 0x48]
movsd qword [rsp + 0x28], xmm1
call fcn.1401f23d0
movsd xmm1, qword [rsp + 0x28]
movsd xmm2, qword [0x1402014e0]
mulsd xmm1, xmm2
mov al, 1
ucomisd xmm0, xmm1
mov byte [rsp + 0x37], al
jb 0x14003347a
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x37], al
mov al, byte [rsp + 0x37]
mov byte [rsp + 0x27], al
mov eax, dword [0x1401f4890]
xor eax, 0x75a7b014
mov edx, dword [0x1401f4894]
xor edx, 0xb441c48c
mov ecx, eax
xor ecx, edx
mov r8d, 0x665ad489
xor r8d, 0x99a52b76
xor ecx, r8d
or eax, edx
and eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x37fa8b83
mov edx, 0x33c91bbf
xor edx, 0x433903c
mov r8d, 0x7294ae54
xor r8d, 0x8d6b51ab
xor edx, r8d
and eax, edx
sub eax, ecx
mov ecx, 0xc8dc2001
xor ecx, 0xb714ab0c
add eax, ecx
imul eax, eax, 0xa6432672
cmp eax, 0xe405df81
jae 0x14003354d
mov eax, dword [0x1401f4898]
xor eax, 0xf192e167
mov ecx, dword [0x1401f489c]
xor ecx, 0xda722c46
and eax, ecx
mov ecx, 0xe5e76161
xor ecx, 0xa0ead831
xor edx, edx
div ecx
xor ecx, ecx
sub ecx, 0xa21ff8fa
sub eax, ecx
mov ecx, 0x299170f7
xor edx, edx
div ecx
cmp eax, 0x6dc9829
jae 0x1400334f9
mov al, byte [rsp + 0x27]
and al, 1
movzx eax, al
add rsp, 0x58
ret
sub dword [rdx], eax
retf 0xe98e
Function at 0x140036340
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
call fcn.1400354a1
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov qword [rsp + 0x50], rax
mov rcx, rdx
xor rcx, 0xffffffffffffffff
movabs r9, 0x3720bf1e9aeff43d
movabs r8, 0xc8df40e165100bc2
xor r9, r8
mov r8, rdx
xor r8, r9
and rcx, r8
mov r8, 0xffffffffffffffff
or r8, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
xor rcx, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
and rcx, r8
xor rdx, 0xffffffffffffffff
mov r8, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
and rdx, r8
xor rcx, 0xffffffffffffffff
movabs r8, 0x37b6a2de953588f6
movabs r9, 0xc8495d216aca7709
xor r8, r9
xor rdx, r8
and rcx, rdx
add rax, rcx
cmp rax, 0xffffffffffffffff
je 0x140036559
mov ecx, dword [0x1401f49e0]
mov eax, dword [0x1401f49e4]
mov edx, 0x8493ebd9
xor edx, 0x7cd6ce23
sub ecx, edx
sub ecx, eax
mov eax, 0x8bd7fcc7
xor eax, 0x7392d93d
add ecx, eax
mov edx, 0xf9047df5
xor edx, 0x6fb820a
mov eax, ecx
xor eax, edx
mov r8d, 0xc0d7b743
xor r8d, 0x3f2848bc
mov edx, ecx
xor edx, r8d
and eax, edx
mov edx, 0x238ddfb1
xor edx, 0xee71113b
mov r8d, 0x8660beb3
xor r8d, 0x799f414c
xor edx, r8d
mov r8d, 0xffffffff
xor r8d, 0xcdfcce8a
and edx, r8d
xor eax, 0xffffffff
xor edx, 0xffffffff
and eax, edx
mov edx, 0x41e8332d
xor edx, 0xbe17ccd2
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0xcdfcce8a
and ecx, edx
mov edx, 0x9c20f382
xor edx, 0x63df0c7d
xor eax, edx
mov edx, 0xfd24604
xor edx, 0xf02db9fb
xor ecx, edx
and eax, ecx
mov ecx, 0x20e0dbef
xor ecx, 0xc66b23fa
or eax, ecx
xor eax, 0x1971c9f2
mov ecx, 0xb67de381
xor ecx, 0x6d56542c
cmp eax, ecx
je 0x14003659d
mov rdx, qword [rsp + 0x50]
mov r9, qword [rsp + 0x48]
mov r8d, dword [0x1401f49e8]
mov eax, dword [0x1401f49ec]
mov ecx, eax
mov eax, r8d
lea r8d, [rax + rcx - 0x448de4b2]
mov eax, r8d
and eax, 0x7842c114
xor r8d, 0x7842c114
mov ecx, eax
mov eax, r8d
lea eax, [rax + rcx*2]
xor eax, 0x19aad38b
test r9, r9
sets cl
mov r8, rdx
sub r8, r9
setle r8b
or cl, r8b
test rdx, rdx
setle dl
or cl, dl
mov byte [rsp + 0x37], cl
cmp eax, 0x11eea044
je 0x1400364c3
mov al, byte [rsp + 0x37]
test al, 1
jne 0x14003653e
jmp 0x140036559
mov r8, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov rdx, r8
add rdx, 0xffffffffffffffff
call fcn.14001d83e
jmp 0x140036593
mov r8, qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov r10, qword [rcx + 8]
mov rcx, r10
add rcx, 8
add rcx, rax
xor r9d, r9d
cmp r10, 0
cmove rcx, r9
sub rdx, rax
call fcn.140036170
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rsp, 0x58
ret
test dword [rdi], esi
retf
Function at 0x140037910
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov eax, dword [0x1401f4a80]
and eax, dword [0x1401f4a84]
add eax, 0xbb8ef47
mov ecx, 0x45de111f
xor edx, edx
div ecx
mov ecx, 0xb268a5
xor ecx, 0x9c2bae59
imul eax, ecx
cmp eax, 0x33c91bbf
je 0x1400379b2
mov eax, dword [0x1401f4a88]
mov ecx, dword [0x1401f4a8c]
mov edx, 0x5b2ef875
xor edx, 0xca58099f
xor ecx, edx
add eax, ecx
imul eax, eax, 0x82ab65a0
xor ecx, ecx
sub ecx, 0xf61a48f8
sub eax, ecx
mov ecx, 0x23b2133f
xor edx, edx
div ecx
mov dword [rsp + 0x2c], eax
mov rax, qword [0x140209370]
mov ecx, dword [rax]
call fcn.140009923
mov rcx, rax
mov eax, dword [rsp + 0x2c]
add rcx, 0x50
mov qword [rsp + 0x30], rcx
cmp eax, 0x7f53e8f9
ja 0x140037947
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
lea eax, [rdi - 0x73162ca1]
invalid
Function at 0x140042220
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x40
mov qword [rsp + 0x18], rdx
mov rax, rcx
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
add rax, 8
mov qword [rsp + 0x28], rax
xor eax, eax
test rcx, rcx
cmovg rax, rcx

Function at 0x140042530
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 8], rcx
mov eax, dword [0x1401f4ea0]
mov ecx, dword [0x1401f4ea4]
mov edx, 0x39e1c827
xor edx, 0x11843ee5
add eax, edx
sub eax, ecx
mov ecx, 0x6e682404
xor ecx, 0x460dd2c6
sub eax, ecx
imul eax, eax, 0x765ef782
imul r8d, eax, 0x41e517f0
mov eax, r8d
xor eax, 0xffffffff
and eax, 0xcdf1407d
mov edx, 0x5a70e478
xor edx, 0x9781a405
mov ecx, 0xd8e4741b
xor ecx, 0x271b8be4
xor edx, ecx
and r8d, edx
mov ecx, 0x665df103
xor ecx, 0x40978a8d
mov r9d, 0x3178fa35
xor r9d, 0xce8705ca
xor ecx, r9d
mov r9d, 0x702471dd
xor r9d, 0xbdd531a0
and ecx, r9d
and edx, 0x26ca7b8e
or eax, r8d
or ecx, edx
xor eax, ecx
cmp eax, 0xcea7a7d5
ja 0x1400426b4
mov eax, dword [0x1401f4ea8]
mov r8d, dword [0x1401f4eac]
mov r9d, r8d
not r9d
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
not ecx
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0xab523a48
or eax, 0x54adc5b7
and eax, ecx
add eax, 0x12ce9c61
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x4f9a3c6e
and ecx, 0xb065c391
imul ecx, edx
mov edx, eax
and edx, 0xb065c391
or eax, 0xb065c391
imul eax, edx
add eax, ecx
mov dword [rbp - 0x10], eax
mov eax, 0x10
call fcn.1401f2390
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
sub rsp, 0x20
call fcn.14003be71
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
lea rdx, [0x140202b40]
sub rsp, 0x20
call fcn.140042220
add rsp, 0x20
mov cl, al
mov eax, dword [rbp - 0x10]
mov byte [rbp - 9], cl
cmp eax, 0x15a1e75f
je 0x1400425dc
mov al, byte [rbp - 9]
and al, 1
movzx eax, al
mov rsp, rbp
pop rbp
ret
push rdx
stc
push 0xffffffffffffff96
jmp 0x1400425dc
Function at 0x1400431c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov byte [rbp - 9], dl
mov qword [rbp - 8], rcx
mov edx, dword [0x1401f4ef0]
mov ecx, dword [0x1401f4ef4]
xor ecx, 0x76ed28ab
mov eax, edx
xor eax, ecx
mov r8d, 0x44238335
xor r8d, 0xbbdc7cca
xor eax, r8d
mov r8d, ecx
and r8d, eax
mov eax, 0x7342e852
xor eax, 0x7342e850
imul eax, r8d
sub eax, ecx
sub edx, eax
mov ecx, edx
xor ecx, 0xffffffff
and ecx, 0x9070c0fa
mov r8d, 0xffffffff
xor r8d, 0x9070c0fa
mov eax, edx
and eax, r8d
imul eax, ecx
mov ecx, edx
and ecx, 0x9070c0fa
or edx, 0x9070c0fa
imul edx, ecx
add edx, eax
sub edx, 0xd9992bd0
mov ecx, edx
xor ecx, 0x5fda62d1
mov eax, 0xffffffff
xor eax, 0x5fda62d1
and edx, eax
mov eax, 0xd25cc13a
xor eax, 0xd25cc138
imul eax, edx
sub eax, ecx
cmp eax, 0xaea33e47
jae 0x140043321
mov eax, dword [0x1401f4ef8]
xor eax, 0x65b017ac
mov ecx, dword [0x1401f4efc]
xor ecx, 0x2dfd4901
add eax, ecx
imul rax, rax, 0x627d185b
shr rax, 0x3e
add eax, 0x634d4709
mov dword [rbp - 0x10], eax
mov eax, 0x20
call fcn.1401f2390
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
sub rsp, 0x20
call fcn.14003be71
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov edx, 0x20
sub rsp, 0x20
call fcn.14003be8c
mov al, byte [rbp - 9]
mov rdx, qword [rbp - 0x18]
add rsp, 0x20
mov cl, al
and cl, 7
mov r8b, 1
shl r8b, cl
mov cl, 0x5d
xor cl, 0x5e
shr al, cl
mov rcx, qword [rbp - 8]
movzx eax, al
or r8b, byte [rdx + rax]
mov byte [rdx + rax], r8b
sub rsp, 0x20
call fcn.14004308d
mov eax, dword [rbp - 0x10]
add rsp, 0x20
cmp eax, 0xdcb8011b
ja 0x140043276
mov rsp, rbp
pop rbp
ret
clc
jmp 0x140043379
add byte [rax], al
add byte [rcx - 0x39], cl
sar edi, 0xff
invalid
Function at 0x140045d00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
call fcn.140045cde
xor eax, eax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov eax, dword [0x1401f5020]
xor eax, 0x836da37e
mov r8d, dword [0x1401f5024]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
add eax, 0xea25e6c0
sub eax, 0xd70aa6e1
mov ecx, 0x8425b067
xor ecx, 0x6e0056a7
sub eax, ecx
and eax, 0x1feea3b6
mov r8d, 0xaa58a621
xor r8d, 0x384e5b9b
mov ecx, 0xa9731eef
xor ecx, 0x568ce110
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x9216fdba
mov r8d, 0x18279ce2
xor r8d, 0x8a316158
or eax, r8d
imul eax, edx
add eax, ecx
cmp eax, 0x7f054f59
je 0x140045e6c
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401f5028]
mov r8d, dword [0x1401f502c]
xor r8d, 0x65feb91b
mov edx, 0x53b33292
xor edx, 0x53b33292
sub edx, r8d
add eax, edx
imul edx, eax, 0x8886e886
mov eax, 0x1bedeb21
xor eax, 0x9c3b9443
add edx, eax
mov r8d, 0xe129e152
xor r8d, 0x51b6bfd4
mov eax, 0x582da246
xor eax, 0xa7d25db9
xor r8d, eax
mov eax, edx
xor eax, r8d
and eax, edx
cmp rcx, 0x18
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x5bea23a1
jb 0x140045dc4
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x140045e67
jmp 0x140045e47
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov dl, 0x91
xor dl, 0x91
mov byte [rcx + rax], dl
add rax, 1
mov qword [rsp + 0x40], rax
jmp 0x140045d15
add rsp, 0x48
ret
invalid