joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015b40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov eax, dword [0x140250bf8]
xor eax, 0x3be6ad01
mov ecx, dword [0x140250bfc]
xor ecx, 0xe373bae0
add eax, 0xac27f391
sub eax, ecx
sub eax, 0xac27f391
mov ecx, 0xa39011aa
xor ecx, 0x7b2b5492
and eax, ecx
sub eax, 0x1ef62736
and eax, 0x9062e41a
cmp eax, 0xf6576162
je 0x140015de9
mov rcx, qword [rsp + 0x50]
mov eax, dword [0x140250c00]
xor eax, 0x9be7aa06
mov r8d, dword [0x140250c04]
mov edx, eax
xor edx, r8d
mov r9d, 0x88488474
xor r9d, 0x77b77b8b
xor edx, r9d
or eax, r8d
and eax, edx
sub eax, 0x6b72625d
mov r8d, 0x9cd83e25
xor r8d, 0x7f18cbe9
xor edx, edx
div r8d
and eax, 0x207695f3
mov r8, qword [rcx]
movabs rdx, 0x5cd11f889a28898d
movabs rcx, 0xa32ee07765d77672
xor rdx, rcx
mov rcx, r8
add rcx, rdx
mov qword [rsp + 0x38], rcx
mov rdx, rcx
xor rdx, r8
cmp rdx, 0
setl dl
movabs r8, 0x3fb7ac0f68fba8fe
movabs r9, 0xc04853f097045701
xor r8, r9
cmp rcx, r8
setg cl
and cl, dl
mov byte [rsp + 0x47], cl
cmp eax, 0x47e8c45b
jae 0x140015b93
mov al, byte [rsp + 0x47]
test al, 1
jne 0x140015c6e
jmp 0x140015c51
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
add rcx, 8
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
jmp 0x140015c78
call fcn.140007e9d
jmp 0x140015de4
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
cmp rax, rcx
jl 0x140015dd7
mov rax, qword [rsp + 0x20]
cmp rax, 0
jl 0x140015cb2
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
cmp rax, qword [rcx]
jl 0x140015cbf
mov rcx, rdx
call fcn.140013507
jmp 0x140015de4
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx]
add rcx, 8
imul rax, rax, 0x18
add rcx, rax
call fcn.140015b13
mov rcx, qword [rsp + 0x20]
movabs rdx, 0xa03876174a2976d4
movabs rax, 0x5fc789e8b5d6892b
xor rdx, rax
mov rax, rcx
add rax, rdx
mov rdx, rax
xor rdx, 0xffffffffffffffff
movabs r9, 0x2ea950839d12cde5
movabs r8, 0xd156af7c62ed321a
xor r9, r8
mov r8, rax
xor r8, r9
or rdx, r8
and rdx, rcx
xor rdx, 0xffffffffffffffff
movabs r8, 0x46a69c66adc021b5
movabs r9, 0xb9596399523fde4a
xor r8, r9
mov r9, rcx
xor r9, r8
mov r8, rcx
xor r8, 0xffffffffffffffff
or r9, r8
movabs r10, 0x8fae4f9ae207ad3
movabs r8, 0xf7051b0651df852c
xor r10, r8
mov r8, rax
xor r8, r10
movabs r10, 0xa9f9f451d37d15a5
movabs r11, 0x56060bae2c82ea5a
xor r10, r11
xor r9, r10
or r8, r9
and rdx, r8
xor rdx, 0xffffffffffffffff
movabs r8, 0x85ecabba56d3137c
movabs r9, 0x85ecabba56d3137c
xor r8, r9
cmp rdx, r8
setl dl
cmp rcx, 0
setne cl
and cl, dl
test cl, 1
mov qword [rsp + 0x30], rax
jne 0x140015dcd
jmp 0x140015c78
call fcn.140007e9d
jmp 0x140015de4
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
add rsp, 0x58
ret
sub eax, 0xe93079f3
movabs eax, dword [0x6666666666fffffd]
nop dword cs:[rax + rax]
Function at 0x140021500
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.14000ae7d
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1401041d8
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x50], 0
jne 0x14002153b
mov rax, qword [rsp + 0x28]
mov qword [rax], 0
mov r11d, dword [0x140251108]
mov r10d, dword [0x14025110c]
mov eax, 0x930f9d75
xor eax, 0x94919894
xor r10d, eax
mov ecx, r11d
xor ecx, 0xffffffff
mov eax, 0x1f5ef50e
xor eax, 0xe0a10af1
mov r8d, r10d
xor r8d, eax
mov edx, 0xffffffff
xor edx, 0x39137ec2
mov eax, ecx
and eax, 0x39137ec2
and r11d, edx
mov r9d, r8d
and r9d, 0x39137ec2
and r10d, edx
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
mov r8d, 0xe186ddc5
xor r8d, 0x1e79223a
xor ecx, r8d
or edx, 0x39137ec2
and ecx, edx
or eax, ecx
mov ecx, 0x26ad94c7
xor ecx, 0xb578da93
add eax, ecx
mov r8d, 0xffffffff
xor r8d, 0x1ff3d32d
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x2d7f7880
xor r8d, 0xd280877f
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x1ff3d32d
or eax, 0x1ff3d32d
imul eax, edx
add eax, ecx
mov ecx, 0x5b3190e6
xor ecx, 0x964d0b42
imul eax, ecx
mov ecx, 0x349d2c93
xor ecx, 0x823bacc2
cmp eax, ecx
je 0x1400216e3
mov eax, dword [0x140251110]
mov ecx, 0x8b158c1c
xor ecx, 0x55638855
xor eax, ecx
or eax, dword [0x140251114]
mov ecx, eax
and ecx, ecx
mov edx, 0x480f95a8
xor edx, 0xb7f06a57
xor ecx, edx
mov edx, 0x6a48ac3e
xor edx, 0x9bc52a3
and ecx, edx
xor ecx, 0xffffffff
mov edx, 0xb3a97f9b
xor edx, 0xd05d8106
mov r8d, 0xe8193dfd
xor r8d, 0x17e6c202
xor edx, r8d
mov r8d, 0xffffffff
xor r8d, 0x63f4fe9d
or edx, r8d
mov r8d, 0xec5e140d
xor r8d, 0x13a1ebf2
xor eax, r8d
mov r8d, 0x12953936
xor r8d, 0xed6ac6c9
xor edx, r8d
or eax, edx
and ecx, eax
mov eax, 0x6ff8127f
xor eax, 0x9007ed80
xor ecx, eax
mov eax, ecx
and eax, 0xf4f05069
mov edx, 0x3d3c621f
xor edx, 0xc9cc3276
xor ecx, edx
or eax, ecx
xor ecx, ecx
sub ecx, 0xc3d76579
add eax, ecx
cmp eax, 0x74bf4ae3
je 0x14002161e
add rsp, 0x38
ret
sbb cl, byte [rbp + 0x53]
out 0xe9, eax
xor bh, bh
invalid
Function at 0x140022610
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x140251188]
mov ecx, dword [0x14025118c]
xor ecx, 0x46519a47
sub eax, ecx
xor ecx, ecx
sub ecx, 0x761f1032
sub eax, ecx
xor ecx, ecx
sub ecx, 0x84dc01b5
add eax, ecx
mov edx, 0xde0e6451
xor edx, 0x21f19bae
mov ecx, eax
xor ecx, edx
mov edx, 0x53010ed0
xor edx, 0xc079fda6
and edx, ecx
mov r8d, 0x9fc3aa18
xor r8d, 0xcbb596e
mov ecx, 0xe3542f62
xor ecx, 0x1cabd09d
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x9378f376
mov r8d, 0x2c54b635
xor r8d, 0xbf2c4543
or eax, r8d
imul eax, edx
add eax, ecx
cmp eax, 0x2dbf7ae
jb 0x140022731
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x140251190]
xor edx, edx
div dword [0x140251194]
add eax, 0xd3713415
mov edx, 0x632fb1a2
xor edx, 0xb9c9cd74
sub eax, edx
mov edx, 0x25f37717
xor edx, 0xf6824302
sub eax, edx
mov r8d, 0x46983789
xor r8d, 0x89b1b8c1
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x30]
or eax, 0x27c3a9d3
mov dword [rsp + 0x2c], eax
mov qword [rcx], 0
mov qword [rcx + 8], 0
call fcn.1400225f9
mov eax, dword [rsp + 0x2c]
cmp eax, 0xb5175b3b
je 0x1400226b2
mov rax, qword [rsp + 0x40]
add rsp, 0x48
ret
out 0xa4, eax
sub al, 0xc2
jmp 0x1400226b2
Function at 0x140024153
Capabilities:
Encode data using xor

Disassembly:
and qword [rcx], 0
jmp fcn.140023d60
Function at 0x14002b680
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rcx
add rcx, 8
mov qword [rsp + 0x48], rcx
xor eax, eax
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov qword [rsp + 0x38], rdx
cmp rax, rcx
jge 0x14002b71b
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.140012370
test al, 1
jne 0x14002b6e2
jmp 0x14002b6f9
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.14000ffc0
mov rax, qword [rsp + 0x30]
xor ecx, ecx
sub rcx, rax
xor eax, eax
sub rax, 1
add rcx, rax
xor eax, eax
sub rax, rcx
mov qword [rsp + 0x50], rax
jmp 0x14002b699
mov rax, qword [rsp + 0x38]
cmp rax, 0
je 0x14002b82b
mov ecx, dword [0x1402515d8]
mov edx, dword [0x1402515dc]
xor edx, 0x8cbc0227
mov eax, ecx
or eax, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
xor edx, 0xffffffff
and ecx, edx
mov edx, 0x85d4f702
xor edx, 0x7a2b08fd
xor eax, edx
xor ecx, 0xffffffff
and eax, ecx
sub eax, 0x288e322
mov edx, 0x8cf089f6
xor edx, 0x8cf089f7
mov ecx, eax
add ecx, edx
xor eax, 0xffffffff
or eax, 0xb371db4d
add eax, ecx
mov edx, 0x86d67715
xor edx, 0x86d67714
mov ecx, eax
add ecx, edx
xor eax, 0xffffffff
mov edx, 0x2520e1c6
xor edx, 0x1b51a054
or eax, edx
add eax, ecx
mov ecx, 0xe2a1ce96
xor ecx, 0x37add383
cmp eax, ecx
jae 0x14002b91a
mov rdx, qword [rsp + 0x38]
mov eax, dword [0x1402515e0]
add eax, dword [0x1402515e4]
sub eax, 0xa2555959
mov ecx, 0x9835f758
xor ecx, 0x336af395
or eax, ecx
add eax, 0x8d432b5c
movabs rcx, 0x4000000000000000
and rcx, qword [rdx]
movabs rdx, 0x80e41931517b694
movabs r8, 0x80e41931517b694
xor rdx, r8
cmp rcx, rdx
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0xebcd113b
jae 0x14002b7af
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x14002b821
jmp 0x14002b82b
mov rcx, qword [rsp + 0x38]
call fcn.14000e9ce
mov eax, dword [str.:CLU]
mov edx, dword [0x1402515ec]
xor edx, 0x6ce7288d
mov ecx, eax
and ecx, edx
shl ecx, 1
add eax, edx
sub eax, ecx
mov ecx, 0xaf8d7beb
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x1b917483
or ecx, 0x1b917483
mov edx, 0x8a2eba2c
xor edx, 0x75d145d3
xor ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x6e45de9a
xor edx, edx
div ecx
cmp eax, 0x1a080acc
je 0x14002b923
mov eax, dword [0x1402515f0]
or eax, dword [0x1402515f4]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0x1e505f4a
xor edx, 0xbc45f336
and edx, ecx
mov r8d, 0x6e619c22
xor r8d, 0xcc74305e
mov ecx, 0x4a608c50
xor ecx, 0xb59f73af
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0x1c6e7836
xor r8d, 0xbe7bd44a
mov edx, eax
and edx, r8d
or eax, 0xa215ac7c
imul eax, edx
add eax, ecx
add eax, 0xb48bfe0b
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0x21e6a24e
add eax, ecx
mov ecx, 0x4fcc06bf
xor ecx, 0x44186a03
cmp eax, ecx
jb 0x14002b923
add rsp, 0x58
ret
and eax, 0xe9b1652c
invalid
invalid
Function at 0x14002b930
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.14000ae7d
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx]
call fcn.1401a8f5d
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x50], 0
jne 0x14002b9f7
mov eax, dword [0x1402515f8]
xor eax, 0xd47d3e78
or eax, dword [0x1402515fc]
mov ecx, 0xffffffff
xor ecx, 0x2c2575b1
add eax, ecx
add eax, 1
mov ecx, 0x7986ef11
xor ecx, 0x7d281971
and eax, ecx
and eax, 0xc00cba29
cmp eax, 0x7e7f9372
je 0x14002b9fc
mov rcx, qword [rsp + 0x28]
mov eax, dword [str.c9]
mov edx, 0x8c5cff16
xor edx, 0x992ae0ee
xor eax, edx
mov edx, dword [0x140251604]
xor edx, 0xb5d3a39e
xor eax, edx
or eax, 0x71a2a2df
mov edx, 0xdd6e54bd
xor edx, 0xde45619
xor eax, edx
or eax, 0x414fec60
mov dword [rsp + 0x24], eax
call fcn.1401a8fbb
mov eax, dword [rsp + 0x24]
cmp eax, 0xb6fdab0b
je 0x14002b99d
jmp 0x14002b9f7
add rsp, 0x38
ret
fbld tbyte [rsi]
invalid
Function at 0x140033c00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rcx
call fcn.14000ae7d
mov rcx, qword [rsp + 0x38]
add rax, 0x50
mov qword [rsp + 0x40], rax
add rcx, 8
mov qword [rsp + 0x48], rcx
xor eax, eax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov eax, dword [0x1402519e8]
imul eax, dword [0x1402519ec]
mov ecx, 0x61e3126a
xor edx, edx
div ecx
mov r8d, 0xffffffff
xor r8d, 0x5d6ae0c4
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x5d6ae0c4
mov r8d, 0x8e26d3c9
xor r8d, 0xd34c330d
or eax, r8d
imul eax, edx
add eax, ecx
sub eax, 0xc8ccf8a6
cmp eax, 0x23ba4ca
jb 0x140033dff
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov eax, dword [0x1402519f0]
mov ecx, dword [0x1402519f4]
mov edx, 0x8ecbce79
xor edx, 0x8f0aa23d
xor ecx, edx
or eax, ecx
imul eax, eax, 0xcc2cbb36
xor eax, 0x89f4a369
mov ecx, 0x8ac863a0
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x48]
mov ecx, 0x8d81f7c0
xor ecx, 0xd23f4b8d
cmp r8, qword [r9]
setl r8b
mov byte [rsp + 0x27], r8b
mov rdx, qword [rdx]
mov qword [rsp + 0x28], rdx
cmp eax, ecx
ja 0x140033c96
mov al, byte [rsp + 0x27]
test al, 1
jne 0x140033d0c
jmp 0x140033d9d
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.14001b400
test al, 1
jne 0x140033d2d
jmp 0x140033d80
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.1401581f0
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140033df9
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
movabs rdx, 0x7b7549a08f18df38
movabs rax, 0x7b7549a08f18df30
xor rdx, rax
call fcn.14000ea9a
mov rcx, qword [rsp + 0x30]
mov rax, rcx
and rax, 1
or rcx, 1
add rax, rcx
mov qword [rsp + 0x50], rax
jmp 0x140033c2c
mov rax, qword [rsp + 0x28]
cmp rax, 0
je 0x140033df9
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov rcx, rax
add rcx, 1
movabs rdx, 0xf1bad5bd2f8e52d7
movabs r8, 0xe452a42d071ad28
xor rdx, r8
xor rax, rdx
movabs rdx, 0x4000000000000000
or rax, rdx
add rax, rcx
cmp rax, 0
jne 0x140033df9
mov rcx, qword [rsp + 0x28]
call fcn.14000e9ce
nop
add rsp, 0x58
ret
outsd dx, dword [rsi]
invalid
Function at 0x140036290
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x140251b08]
mov ecx, 0x4ee94781
xor ecx, 0x18b8965
xor eax, ecx
imul eax, dword [0x140251b0c]
mov ecx, 0xb025cb9
xor ecx, 0x5c111a17
xor edx, edx
div ecx
add eax, 0x9a9056b
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0xdafc1070
add ecx, eax
mov eax, 0x7b2b2100
xor eax, 0x7b2b2100
sub eax, ecx
mov ecx, 0x1aad6a1e
xor ecx, 0x2fa25ba8
cmp eax, ecx
je 0x14003638c
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x140251b10]
xor edx, edx
div dword [0x140251b14]
mov r8d, 0xd1c8d86a
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x30]
mov r8d, 0x5f11c66a
xor r8d, 0xba55fc46
mov r9d, 0xee8090b5
xor r9d, 0x117f6f4a
xor r8d, r9d
add eax, r8d
add eax, 1
or eax, 0x7fd08ddc
mov dword [rsp + 0x2c], eax
movabs rax, 0x7e26ada0a41c268f
movabs r8, 0x7e26ada0a41c268f
xor rax, r8
mov qword [rcx], rax
mov qword [rcx + 8], 0
call fcn.14003625e
mov eax, dword [rsp + 0x2c]
cmp eax, 0x4269e236
je 0x1400362fd
mov rax, qword [rsp + 0x40]
add rsp, 0x48
ret
mul dword [rsi + 0x68e989b4]
invalid
Function at 0x140037fe0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
mov eax, dword [0x140251be8]
sub eax, dword [0x140251bec]
or eax, 0xacf9dc29
mov ecx, 0x80084631
xor ecx, 0xcb9790a0
xor edx, edx
div ecx
sub eax, 0x65eeb905
cmp eax, 0x2aafc8a6
jbe 0x14003826c
mov rcx, qword [rsp + 0x50]
mov r8d, dword [0x140251bf0]
mov eax, dword [0x140251bf4]
mov edx, r8d
xor edx, eax
mov r9d, 0xf00ff720
xor r9d, 0xff008df
xor eax, r9d
and r8d, eax
mov eax, 0xf3aea43
xor eax, 0xf3aea41
imul eax, r8d
sub eax, edx
sub eax, 0x3aeb0283
imul eax, eax, 0xf8a5c328
xor edx, edx
sub edx, eax
xor eax, eax
sub eax, 0x5e5c9c57
add edx, eax
mov eax, 0x4b0a0dc
xor eax, 0x4b0a0dc
sub eax, edx
add rcx, 8
mov qword [rsp + 0x48], rcx
cmp eax, 0xd00df53d
jae 0x140038019
xor eax, eax
mov qword [rsp + 0x40], rax
jmp 0x140038097
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov ecx, dword [0x140251bf8]
mov eax, dword [0x140251bfc]
mov edx, 0x6ee52011
xor edx, 0x1b8cbddf
xor eax, edx
and ecx, eax
mov eax, ecx
add eax, 1
mov edx, 0x5f1c11f9
xor edx, 0xa0e3ee06
xor ecx, edx
or ecx, 0xec6008f3
add ecx, eax
mov eax, 0x5a5177d6
xor eax, 0xf8027c62
sub ecx, eax
mov edx, 0xffffffff
xor edx, 0xc69a76ee
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0xa55bc358
je 0x140038275
mov rcx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x50]
mov eax, dword [0x140251c00]
xor edx, edx
div dword [0x140251c04]
mov r9d, 0x9b0ca0b1
xor edx, edx
div r9d
mov rdx, qword [rsp + 0x38]
xor r9d, r9d
sub r9d, 0x24332ddb
add eax, r9d
or eax, eax
xor eax, 0xffffffff
mov r9d, 0x49ea9d92
or r9d, 0x49ea9d92
xor r9d, 0xffffffff
xor eax, 0xffffffff
xor r9d, 0xffffffff
and eax, r9d
cmp rdx, qword [r8]
setl dl
mov byte [rsp + 0x2f], dl
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rcx
cmp eax, 0x2b8cc5d8
jbe 0x1400380fe
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x140038181
jmp 0x1400381e2
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.140012370
test al, 1
jne 0x1400381a2
jmp 0x1400381b9
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.14000ffc0
mov rax, qword [rsp + 0x38]
movabs rcx, 0xdfa7981a1f1df0e6
movabs rdx, 0xdfa7981a1f1df0e7
xor rcx, rdx
add rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x140038097
mov rax, qword [rsp + 0x30]
cmp rax, 0
je 0x140038266
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
xor rax, 0xffffffffffffffff
mov rdx, 0xffffffffffffffff
movabs rcx, 0x4000000000000000
xor rdx, rcx
mov rcx, 0xffffffffffffffff
movabs r8, 0xfdeb3a6cbe842517
xor rcx, r8
or rax, rdx
movabs rdx, 0xfdeb3a6cbe842517
or rcx, rdx
movabs rdx, 0x6a41add585e508aa
movabs r8, 0x95be522a7a1af755
xor rdx, r8
xor rax, rdx
and rax, rcx
cmp rax, 0
jne 0x140038266
mov rcx, qword [rsp + 0x30]
call fcn.14000e9ce
nop
add rsp, 0x58
ret
adc al, byte [rdx - 0x5b1687ad]
std
invalid
cli
adc byte [rsi - 0x17], bh
cmp dh, 0xff
jmp qword [rsi - 0x70]
Function at 0x140039db0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
xor eax, eax
test r8, r8
cmovg rax, r8
mov qword [rsp + 0x20], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 8], rax
mov eax, dword [0x140251d10]
xor eax, 0xdb916f7a
mov edx, dword [0x140251d14]
xor edx, 0x57afd4be
xor ecx, ecx
sub ecx, edx
sub eax, ecx
mov edx, 0x776e9c71
xor edx, 0xa571cbbd
mov ecx, 0x76f61539
xor ecx, 0x8909eac6
xor edx, ecx
mov ecx, eax
and ecx, edx
mov r8d, 0xfbcd3403
xor r8d, 0x29d263cf
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
and eax, 0x70ecbd0a
or eax, 0x9743c11
cmp eax, 0x501ff746
jbe 0x140039ee6
mov rcx, qword [rsp + 8]
mov eax, dword [0x140251d18]
add eax, dword [0x140251d1c]
mov r8d, 0xddc29bdb
xor r8d, 0xe86fe01
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x20]
mov r8d, 0x7ecfdf5c
xor r8d, 0x33a56703
xor eax, r8d
add eax, 0xbbbd4f84
cmp rcx, rdx
sete cl
mov byte [rsp + 7], cl
cmp eax, 0xe62a5d72
je 0x140039e41
mov al, byte [rsp + 7]
test al, 1
jne 0x140039ee1
jmp 0x140039ea4
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x10]
mov dl, byte [rdx + rax]
mov byte [rcx + rax], dl
movabs rcx, 0xf6b7c916697d54eb
sub rax, rcx
add rax, 1
movabs rcx, 0xf6b7c916697d54eb
add rax, rcx
mov qword [rsp + 0x28], rax
jmp 0x140039dd3
add rsp, 0x30
ret
in eax, dx
push r13
insd dword [rdi], dx
jmp 0x140039e41

Function at 0x14003ad10
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 8], rcx
mov eax, dword [0x140251d70]
xor edx, edx
div dword [str.9U6_]
and eax, 0x2a2d9255
sub eax, 0x3b824801
sub eax, 0xc2cc933a
cmp eax, 0x87864f34
jae 0x14003add3
mov eax, dword [0x140251d78]
mov ecx, dword [0x140251d7c]
add eax, ecx
imul eax, eax, 0x2c8a0973
mov ecx, eax
and ecx, 0xedae7919
mov edx, eax
xor edx, 0x125186e6
add eax, edx
sub eax, ecx
and eax, 0xe1ef9526
mov dword [rbp - 0x10], eax
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
sub rsp, 0x20
call fcn.140038fd1
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x18]
add rsp, 0x20
mov word [rdx], 0
sub rsp, 0x20
call fcn.14003ac61
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbp - 0x10]
add rsp, 0x20
mov cx, word [rcx]
mov word [rbp - 0xa], cx
cmp eax, 0x19ede625
jb 0x14003ad46
mov ax, word [rbp - 0xa]
mov rsp, rbp
pop rbp
ret
enter 0x2e56, 0xfffffffffffffffc
jmp 0x14003ad46
Function at 0x14003b200
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rcx
call fcn.140038fd1
mov r8, qword [rsp + 0x40]
movabs rax, 0xf1e3fd1d1783a2cd
movabs rcx, 0xf1e3fd1d1783a2cd
xor rax, rcx
cmp r8, rax
jge 0x14003b25f
mov rcx, qword [rsp + 0x40]
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
call fcn.14000cee2
jmp 0x14003b282
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
call fcn.140019539
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x30]
call fcn.14003ade0
mov eax, dword [0x140251db0]
mov r8d, dword [0x140251db4]
xor r8d, 0x87553fd1
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
mov r9d, 0x617fbe79
xor r9d, 0x9e804186
xor ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
and eax, 0x95a5b482
mov ecx, 0xa8be1a04
xor edx, edx
div ecx
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0x272793ee
add eax, ecx
cmp eax, 0x2bfef977
je 0x14003b335
mov eax, dword [0x140251db8]
mov ecx, dword [0x140251dbc]
xor ecx, 0x629cfb4b
sub eax, 0x6646e7be
add eax, ecx
add eax, 0x6646e7be
and eax, 0x1501eb4e
sub eax, 0xa2307117
mov ecx, 0x74487ec7
xor edx, edx
div ecx
cmp eax, 0x59d74f97
jae 0x14003b2ef
mov rax, qword [rsp + 0x38]
add rsp, 0x48
ret
scasd eax, dword [rdi]
cmp byte [rdx], 0x23
jmp 0x14003b2ef
Function at 0x14003bd10
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x30], rcx
mov eax, 0x10
call fcn.14024f5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.140038fd1
mov r8, qword [rbp - 0x20]
add rsp, 0x20
mov qword [rbp - 0x18], rax
xor eax, eax
test r8, r8
cmovg rax, r8
mov qword [rbp - 0x10], rax
xor eax, eax
mov qword [rbp - 8], rax
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov qword [rbp - 0x40], rax
cmp rax, rcx
je 0x14003bddd
mov r8, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x38]
shl r8, 4
add rax, r8
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14003b655
mov rcx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x40]
add rsp, 0x20
mov cl, byte [rcx]
mov rdx, 0xffffffffffffffff
xor rdx, 1
xor r8d, r8d
sub r8, 1
sub rdx, r8
sub rax, rdx
cmp cl, 0
mov qword [rbp - 8], rax
je 0x14003bd62
jmp 0x14003befe
mov ecx, dword [0x140251e00]
mov edx, dword [0x140251e04]
mov eax, ecx
or eax, eax
xor eax, 0xffffffff
mov r8d, edx
or r8d, r8d
mov r9d, 0x7daf384e
xor r9d, 0x8250c7b1
xor r8d, r9d
mov r9d, 0xd661e89e
xor r9d, 0x299e1761
xor eax, r9d
mov r9d, 0x619e07d0
xor r9d, 0x9e61f82f
xor r8d, r9d
and eax, r8d
xor ecx, 0xffffffff
mov r8d, 0xc7b802ab
xor r8d, 0x3847fd54
xor edx, r8d
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0xd333e5de
xor ecx, 0x4c4c6d13
add eax, ecx
add eax, 0x3260c89c
add eax, 0x17cd2909
mov ecx, 0x883f4405
xor ecx, 0xba5f8c99
sub eax, ecx
mov ecx, eax
xor ecx, 0x3795f117
mov edx, 0x11364e80
xor edx, 0xeec9b17f
xor ecx, edx
or eax, 0x3795f117
and eax, ecx
cmp eax, 0xdee8cac8
je 0x14003bf99
mov rcx, qword [rbp - 0x30]
mov eax, dword [0x140251e08]
mov edx, 0x7cedee44
xor edx, 0x67c353cd
xor eax, edx
imul eax, dword [0x140251e0c]
mov edx, eax
xor edx, 0xffffffff
and edx, 0xf5ed4f47
mov r8d, 0xffffffff
xor r8d, 0xf5ed4f47
and eax, r8d
sub eax, edx
imul eax, eax, 0xe50eaccb
sub eax, 0xcc5b3a38
mov dword [rbp - 0x44], eax
lea rdx, [0x1402604a8]
sub rsp, 0x20
call fcn.14003b655
mov eax, dword [rbp - 0x44]
add rsp, 0x20
cmp eax, 0x525722c2
jbe 0x14003be8e
jmp 0x14003befe
mov eax, dword [0x140251e10]
and eax, dword [0x140251e14]
mov ecx, 0xffffffff
xor ecx, 0x27bfc683
add eax, ecx
add eax, 1
mov ecx, 0x3025461b
xor ecx, 0xf3c158c3
sub eax, ecx
sub eax, 0x1718fcd1
mov ecx, 0xbaf8a1a2
xor ecx, 0x17a4335a
cmp eax, ecx
jae 0x14003bfa2
mov eax, dword [0x140251e18]
mov edx, dword [0x140251e1c]
mov ecx, 0x9e1c8e8a
xor ecx, 0x9e1c8e8a
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, 0xe8f67594
xor ecx, 0xab76b573
and eax, ecx
or eax, 0x71fe14d4
mov ecx, 0xc4d48a1
xor ecx, 0x5966b582
and eax, ecx
mov ecx, 0x12dcbc2e
xor ecx, 0xf37a855e
cmp eax, ecx
jae 0x14003bf3f
mov rsp, rbp
pop rbp
ret
scasd eax, dword [rdi]
mov ebp, 0xece9c5f8
invalid
invalid