joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006b000
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rcx
mov eax, dword [0x140244220]
or eax, dword [0x140244224]
add eax, 0xf74c9162
add eax, 0x63ada329
imul eax, eax, 0xa728329a
cmp eax, 0x3ceda305
jae 0x14006b278
mov rcx, qword [rsp + 0x60]
mov eax, dword [0x140244228]
mov edx, 0x4460aa62
xor edx, 0x44be2c89
xor eax, edx
or eax, dword [0x14024422c]
or eax, 0xf996b4b8
mov r8d, 0xef25c166
xor edx, edx
div r8d
mov edx, 0x2c38f57c
xor edx, 0xb22b01ea
sub eax, edx
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rcx
cmp rcx, 0
sete cl
mov byte [rsp + 0x57], cl
cmp eax, 0xa1d3c551
je 0x14006b035
mov al, byte [rsp + 0x57]
test al, 1
jne 0x14006b273
jmp 0x14006b09f
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rax + 8]
mov rax, qword [rax]
cmp rcx, rax
mov qword [rsp + 0x40], rax
jg 0x14006b0dd
mov rcx, qword [rsp + 0x58]
call fcn.1400109c0
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x38]
mov r9, qword [rsp + 0x60]
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov r10, rdx
shl r10, 4
mov r8, rax
add r8, r10
mov qword [r8], r9
mov r8, rdx
shl r8, 4
add rax, r8
add rax, 8
mov qword [rax], rcx
mov rcx, rdx
add rcx, 1
mov qword [rsp + 0x30], rcx
xor rdx, 0xffffffffffffffff
movabs r8, 0x51264f46a7e46118
movabs rax, 0xaed9b0b9581b9ee7
xor r8, rax
mov rax, rcx
xor rax, r8
mov r8, rdx
xor r8, 0xffffffffffffffff
or rax, r8
xor rcx, 0xffffffffffffffff
movabs r8, 0xe3081d897b9cc6e7
movabs r9, 0x1cf7e27684633918
xor r8, r9
xor rdx, r8
or rcx, rdx
xor rax, 0xffffffffffffffff
movabs rdx, 0x4787bd083d9f1628
movabs r8, 0xb87842f7c260e9d7
xor rdx, r8
xor rcx, rdx
or rax, rcx
movabs rcx, 0x3d2ec7b9e2cfb1f
movabs rdx, 0x3d2ec7b9e2cfb1f
xor rcx, rdx
cmp rax, rcx
jge 0x14006b266
mov eax, dword [0x140244230]
xor edx, edx
div dword [0x140244234]
mov ecx, eax
mov edx, 0xffffffff
xor edx, 0xec163e66
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0x4535b412
xor ecx, 0x93a93708
sub eax, ecx
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0xfbf4dc70
add ecx, eax
mov eax, 0x2c1430fa
xor eax, 0x2c1430fa
sub eax, ecx
cmp eax, 0x2256f34b
je 0x14006b281
mov eax, dword [0x140244238]
sub eax, dword [0x14024423c]
and eax, 0x97220d0
sub eax, 0x7bc81d6e
mov ecx, 0x4e54825e
xor ecx, 0x4e54825e
sub ecx, eax
mov eax, 0xf9e70891
xor eax, 0xf9e70891
mov edx, 0x8a0f92fd
xor edx, 0xd1c78755
sub eax, edx
add ecx, eax
mov eax, 0x123135a6
xor eax, 0x123135a6
sub eax, ecx
mov dword [rsp + 0x2c], eax
call fcn.140008d37
mov eax, dword [rsp + 0x2c]
cmp eax, 0x19f534cc
jbe 0x14006b281
jmp 0x14006b273
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
add rsp, 0x68
ret
invalid
invalid
Function at 0x14006bc70
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x38
mov eax, dword [0x1402442c8]
mov ecx, dword [0x1402442cc]
xor ecx, 0x64cf0d4b
xor eax, ecx
or eax, 0x6580f169
mov ecx, 0x7995acb2
xor ecx, 0x866a534d
mov edx, eax
xor edx, ecx
and edx, 0xb74e78a3
mov r8d, 0xffffffff
xor r8d, 0xb74e78a3
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xb74e78a3
or eax, 0xb74e78a3
imul eax, edx
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x56fa9961
mov r8d, 0x9f0315f6
xor r8d, 0xc9f98c97
mov ecx, 0xdfe70eb5
xor ecx, 0x2018f14a
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0xc6469a83
xor r8d, 0x90bc03e2
mov edx, eax
and edx, r8d
mov r8d, 0x407e6b91
xor r8d, 0x1684f2f0
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xee4880cc
xor ecx, 0x5d050282
cmp eax, ecx
jae 0x14006bdb3
mov ecx, dword [0x1402442d0]
mov edx, dword [0x1402442d4]
mov r8d, 0x2ae3de91
xor r8d, 0xd51c216e
mov eax, ecx
xor eax, r8d
xor ecx, 0xffffffff
or eax, ecx
mov ecx, edx
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0xe78ff3bf
xor ecx, 0xa3f17e68
imul eax, ecx
sub eax, 0x96fdd27c
imul eax, eax, 0xb1a0a21
mov dword [rsp + 0x2c], eax
mov rax, qword [0x14025a9f0]
mov ecx, dword [rax]
call fcn.140008963
mov rcx, rax
mov eax, dword [rsp + 0x2c]
add rcx, 0x50
mov qword [rsp + 0x30], rcx
cmp eax, 0x7bbaae8b
jb 0x14006bd31
mov rax, qword [rsp + 0x30]
add rsp, 0x38
ret
invalid

Function at 0x14006c090
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1402442e8]
mov edx, dword [0x1402442ec]
xor edx, 0x43582d55
mov ecx, eax
xor ecx, edx
mov r8d, 0xea84c129
xor r8d, 0x157b3ed6
xor ecx, r8d
or eax, edx
and eax, ecx
imul r11d, eax, 0x653048ba
mov eax, r11d
xor eax, 0xffffffff
mov edx, 0xe99022a0
xor edx, 0xd4577f08
mov ecx, 0x6eb9739f
xor ecx, 0x91468c60
xor edx, ecx
mov r8d, 0xffffffff
xor r8d, 0xcfe356e
mov ecx, eax
and ecx, 0xcfe356e
and r11d, r8d
mov r9d, edx
and r9d, 0xcfe356e
mov r10d, r8d
and r10d, 0x3dc75da8
or ecx, r11d
or r9d, r10d
xor ecx, r9d
or eax, edx
mov edx, 0x4f9144b7
xor edx, 0xb06ebb48
xor eax, edx
mov edx, 0x73fb98a5
xor edx, 0x7f05adcb
or edx, r8d
and eax, edx
or ecx, eax
mov eax, ecx
and eax, 0x211e3776
xor ecx, 0x211e3776
or eax, ecx
cmp eax, 0xdc3efc50
jbe 0x14006c1e7
mov ecx, dword [0x1402442f0]
mov edx, dword [0x1402442f4]
mov eax, 0x3ea29b67
xor eax, 0x7fc72a17
xor edx, eax
mov eax, 0xb82dd1e6
xor eax, 0x47d22e19
xor edx, eax
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0x30fb1a4e
xor edx, edx
div ecx
mov ecx, eax
and ecx, 0x3833634
shl ecx, 1
add eax, 0x3833634
sub eax, ecx
mov ecx, 0xc8116158
xor ecx, 0x8c483512
xor edx, edx
div ecx
mov dword [rsp + 0x2c], eax
mov eax, 0xda78458e
xor eax, 0x4062bdc4
mov dword [rsp + 0x28], eax
call fcn.14006bc70
mov rcx, qword [rsp + 0x30]
mov dl, 0x8c
xor dl, 0x4c
call fcn.140034075
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
jae 0x14006c158
add rsp, 0x38
ret
push rax
or eax, 0x68e9fd96
invalid
Function at 0x14006df90
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x140244418]
imul eax, dword [0x14024441c]
or eax, 0xfe8cd350
mov ecx, 0x981481fc
xor ecx, 0x67eb7e03
mov edx, eax
xor edx, ecx
and edx, 0x364e0ff3
mov r8d, 0xe225ebd5
xor r8d, 0xd46be426
mov ecx, 0xcaebb7a6
xor ecx, 0x35144859
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x364e0ff3
or eax, 0x364e0ff3
imul eax, edx
add eax, ecx
imul eax, eax, 0xcb5f0c83
mov ecx, 0xf919a2cf
xor ecx, 0xd7e8cb2
cmp eax, ecx
je 0x14006e0fb
mov eax, dword [0x140244420]
xor eax, 0x1b9cf3fe
mov ecx, dword [0x140244424]
xor ecx, 0x64ab35ba
sub eax, ecx
add eax, 0xa073ddb4
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x2806a0cc
and ecx, 0xd7f95f33
imul ecx, edx
mov edx, eax
and edx, 0xd7f95f33
or eax, 0xd7f95f33
imul eax, edx
add eax, ecx
and eax, 0xdad6ee13
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.14023fff0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.14006bc70
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov rdx, rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x20], rdx
mov rdx, qword [rax]
sub rsp, 0x20
call fcn.14006d600
mov rcx, qword [rbp - 0x20]
mov eax, dword [rbp - 0x18]
add rsp, 0x20
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0xcac6f02f
ja 0x14006e017
mov al, byte [rbp - 0x11]
test al, 1
jne 0x14006e0cf
jmp 0x14006e0f6
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.1400342ea
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
cli
and byte [rdx], cl
jmp 0x14006e017
Function at 0x14006ecd0
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006bc70
mov rdx, qword [rsp + 0x30]
cmp rdx, 0
jne 0x14006edeb
mov eax, dword [0x140244498]
mov ecx, dword [0x14024449c]
xor ecx, 0xe66bd3d4
xor edx, edx
div ecx
mov ecx, eax
mov eax, 0xc6cec652
xor eax, 0xa253b664
or ecx, eax
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0x19476176
and ecx, 0x19476176
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0x3aecabd
xor edx, edx
div ecx
mov ecx, 0x4f2f3455
xor ecx, 0x6e888509
cmp eax, ecx
ja 0x14006ee00
mov rcx, qword [rsp + 0x28]
mov edx, dword [0x1402444a0]
add edx, dword [0x1402444a4]
mov eax, edx
xor eax, 0xffffffff
mov r8d, 0x45b17ef2
xor r8d, 0x149e165a
and eax, r8d
mov r8d, 0xffffffff
xor r8d, 0x512f68a8
and edx, r8d
sub edx, eax
mov eax, edx
xor eax, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0x27403dcf
and eax, r8d
mov r8d, 0xbdebc56f
xor r8d, 0x42143a90
xor edx, r8d
mov r8d, 0xffffffff
xor r8d, 0x27403dcf
and edx, r8d
or eax, edx
xor eax, 0xffffffff
mov edx, 0x1838dfb4
xor edx, 0xfe335be0
xor eax, edx
mov dword [rsp + 0x24], eax
call fcn.14006c090
mov eax, dword [rsp + 0x24]
cmp eax, 0x195b573d
je 0x14006ed4f
jmp 0x14006edfa
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call fcn.14006e9f0
nop
add rsp, 0x38
ret
push rbp
movabs al, byte [0x8348ffffff46e96c]
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006bc70
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x14006ecd0
Function at 0x1400749b4
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006bc70
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x140074700
Function at 0x140077310
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x140244948]
xor edx, edx
div dword [0x14024494c]
sub eax, 0x42259b52
add eax, 0xf2c4bf2d
add eax, 0x42259b52
add eax, 0x4225fa2f
or eax, 0xe2f31b60
mov ecx, 0x37142e64
xor ecx, 0xed947c40
cmp eax, ecx
jbe 0x140077408
mov eax, dword [0x140244950]
xor eax, 0x860bd8f2
imul eax, dword [0x140244954]
mov ecx, 0x557ea42d
xor ecx, 0xc1814db2
xor edx, edx
div ecx
mov r8d, 0x7114556e
xor r8d, 0x8597a32e
mov ecx, 0xa6768f64
xor ecx, 0x5989709b
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0x754555a0
xor r8d, 0x81c6a3e0
mov edx, eax
and edx, r8d
or eax, 0xf483f640
imul eax, edx
add eax, ecx
mov ecx, 0xaa16eb6a
xor ecx, 0x77df6a6b
sub eax, ecx
mov dword [rsp + 0x24], eax
mov eax, 0xce25eb88
xor eax, 0xd5b698fa
mov dword [rsp + 0x20], eax
call fcn.14006bc70
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
call fcn.1400772bb
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
je 0x140077358
add rsp, 0x38
ret
lodsb al, byte [rsi]
xchg esi, eax
cmp edi, dword [rdi - 0x17]
invalid

Function at 0x140077d50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x140244998]
mov ecx, dword [0x14024499c]
mov edx, 0x8cb9547c
xor edx, 0x83b52f18
add eax, edx
add eax, ecx
mov ecx, 0x8e2c87f9
xor ecx, 0x8120fc9d
sub eax, ecx
xor eax, 0xb7c9d883
mov r8d, 0x19aa1646
xor r8d, 0xc6df6dcc
mov ecx, 0x9efe59d7
xor ecx, 0x6101a628
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xdf757b8a
or eax, 0xdf757b8a
imul eax, edx
add eax, ecx
mov edx, 0xf96c42f6
xor edx, 0xf96c42f7
mov ecx, eax
add ecx, edx
xor eax, 0xffffffff
or eax, 0x50c0df49
add eax, ecx
cmp eax, 0xfe3967a
jbe 0x140077e5f
mov ecx, dword [0x1402449a0]
mov eax, dword [0x1402449a4]
mov edx, 0xd71cabd3
xor edx, 0x53c20595
xor eax, edx
add ecx, eax
xor ecx, 0x91853e6e
mov eax, ecx
and eax, 0xac08df75
xor ecx, 0xac08df75
or eax, ecx
mov ecx, 0xb8ee627b
xor ecx, 0x1f73d5a
sub eax, ecx
add eax, 0x17114a1e
add eax, 0xb9195f21
mov dword [rsp + 0x24], eax
call fcn.14006bc70
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
call fcn.140077d0a
mov eax, dword [rsp + 0x24]
cmp eax, 0x6aa23308
jae 0x140077dec
add rsp, 0x38
ret
invalid
Function at 0x1400793b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx

Function at 0x140079b40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
call fcn.14006bc70
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov edx, 2
call fcn.14006c623
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140079cf3
mov eax, dword [0x140244ad8]
xor eax, 0xa615de07
mov r8d, dword [0x140244adc]
mov edx, 0x47441e0f
xor edx, 0xb8bbe1f0
mov ecx, eax
xor ecx, edx
mov edx, r8d
and edx, ecx
mov ecx, 0x520dd387
xor ecx, 0xadf22c78
mov r9d, r8d
xor r9d, ecx
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
and eax, 0x904e8cb0
mov edx, eax
xor edx, 0xffffffff
and edx, 0x6e094b21
mov r8d, 0x7d23dbee
xor r8d, 0x132a90cf
mov ecx, 0xcfc2fdb2
xor ecx, 0x303d024d
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x6e094b21
mov r8d, 0xe5f885ab
xor r8d, 0x8bf1ce8a
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x11ff9348
xor ecx, 0x11ff9348
mov edx, 0x7c508996
xor edx, 0x977abfea
sub ecx, edx
sub eax, ecx
cmp eax, 0x189ad33f
jbe 0x140079d61
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov r8d, dword [0x140244ae0]
mov r9d, dword [0x140244ae4]
xor r9d, 0x48184325
mov r10d, r8d
xor r10d, 0xffffffff
mov edx, r9d
and edx, r10d
xor r9d, 0xffffffff
and r8d, r9d
or edx, r8d
and edx, 0x53a9ed46
mov r8d, 0x8da2adb7
xor r8d, 0x61f244f
xor edx, r8d
mov r8d, 0x85dd01de
xor r8d, 0x61258d33
imul edx, r8d
mov dword [rsp + 0x28], edx
mov edx, dword [rax]
call fcn.14006cf40
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x28]
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x6e719460
jae 0x140079c36
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x140079ccd
jmp 0x140079cf3
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax + 8]
mov qword [rsp + 0x48], rdx
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
call fcn.14006df90
mov ecx, dword [0x140244ae8]
imul ecx, dword [0x140244aec]
mov eax, ecx
and eax, 0xcdf201af
xor ecx, 0xcdf201af
or eax, ecx
mov ecx, 0xa2f6e583
xor edx, edx
div ecx
or eax, 0x9eb113c6
cmp eax, 0x7b34ef94
jbe 0x140079d6a
mov eax, dword [0x140244af0]
mov ecx, dword [0x140244af4]
xor ecx, 0x46c8a645
xor edx, edx
div ecx
mov ecx, 0xd43525e3
xor edx, edx
div ecx
xor eax, 0xc3f04541
and eax, 0x510b4a03
cmp eax, 0xd94f4a39
jae 0x140079d28
add rsp, 0x58
ret
xchg edx, eax
xor spl, r13b
jmp 0x140079c36
sbb dh, dh
int1
adc al, 0xe9
mov ch, 0xff
invalid
Function at 0x14007a80a
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x140244b58]
mov ecx, dword [0x140244b5c]
mov edx, 0x720dc1d
xor edx, 0x807103a
xor ecx, edx
xor edx, edx
div ecx
and eax, 0xe68fdb77
mov edx, eax
xor edx, 0xffffffff
and edx, 0xf3872855
mov r8d, 0x249dac63
xor r8d, 0xd71a8436
mov ecx, 0x5afce991
xor ecx, 0xa503166e
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xf3872855
mov r8d, 0x2cc6373c
xor r8d, 0xdf411f69
or eax, r8d
imul eax, edx
add eax, ecx
xor eax, 0x9177a8fe
cmp eax, 0x731acd2e
jbe 0x14007a7f8
mov eax, dword [0x140244b60]
mov ecx, dword [0x140244b64]
xor ecx, 0xcf811497
mov edx, 0x448fb0f2
xor edx, 0xc3fc6de0
add eax, edx
add eax, ecx
sub eax, 0x8773dd12
mov ecx, 0xefa02b73
xor ecx, 0x4768f92a
add eax, ecx
mov ecx, 0x92300184
xor ecx, 0x80b80738
add eax, ecx
mov ecx, 0x9df9c166
xor ecx, 0x5bc88215
xor eax, ecx
mov dword [rsp + 0x30], eax
mov eax, 0x6cf672d
xor eax, 0x15a5c76b
mov dword [rsp + 0x2c], eax
call fcn.14006bc70
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x30]
cmp rdx, 0
sete dl
mov byte [rsp + 0x37], dl
cmp eax, ecx
jb 0x14007a69b
mov al, byte [rsp + 0x37]
test al, 1
jne 0x14007a730
jmp 0x14007a7e3
mov eax, dword [0x140244b68]
mov ecx, dword [0x140244b6c]
xor ecx, 0x306510a5
xor eax, ecx
mov ecx, 0x9e12aa92
xor ecx, 0xd4b85a47
xor edx, edx
div ecx
mov ecx, 0xdb80b85a
xor edx, edx
div ecx
sub eax, 0x31dab159
cmp eax, 0x8d4aa16c
jb 0x14007a801
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x140244b70]
mov r9d, dword [0x140244b74]
mov edx, eax
xor edx, 0xffffffff
mov r8d, r9d
and r8d, edx
mov r10d, r9d
xor r10d, 0xffffffff
mov edx, eax
and edx, r10d
imul edx, r8d
mov r8d, eax
and r8d, r9d
or eax, r9d
imul eax, r8d
add eax, edx
mov edx, 0xddd6ba05
xor edx, 0x40f950b3
imul eax, edx
add eax, 0x23c43069
mov r8d, 0xc89c7aca
xor edx, edx
div r8d
mov dword [rsp + 0x28], eax
call fcn.14006c090
mov eax, dword [rsp + 0x28]
cmp eax, 0x11fa448a
jae 0x14007a76c
jmp 0x14007a7f2
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.14007a470
nop
add rsp, 0x48
ret
cmpsd dword [rsi], dword [rdi]
movsb byte [rdi], byte [rsi]
sbb edi, dword [rbx - 0x16517]
call qword [rbx]
mov ebp, 0x62e90a4f
adc edi, dword [rbp + 0x62e90a4f]
invalid
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006bc70
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x14007a610
Function at 0x14007cb30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006bc70
mov rdx, qword [rsp + 0x30]
cmp rdx, 0
jne 0x14007cc00
mov eax, dword [0x140244cb8]
xor eax, dword [0x140244cbc]
sub eax, 0x2a198293
mov ecx, 0x3eed8911
xor ecx, 0xc76a1c9c
sub eax, ecx
mov ecx, 0x2357e8be
xor edx, edx
div ecx
mov ecx, 0x41da8498
xor ecx, 0x9444ffd3
cmp eax, ecx
jae 0x14007cc15
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x140244cc0]
mov r8d, dword [0x140244cc4]
mov edx, eax
and edx, r8d
shl edx, 1
xor eax, r8d
add eax, edx
add eax, 0x46c67c6f
sub eax, 0xc52713aa
mov edx, 0x742bfbdf
xor edx, 0xa51c6998
add eax, edx
mov edx, 0x5f60e789
xor edx, 0x9a47f423
add eax, edx
add eax, 0xd6413329
mov dword [rsp + 0x24], eax
mov eax, 0x5f596385
xor eax, 0xbb362721
mov dword [rsp + 0x20], eax
call fcn.14006c090
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
je 0x14007cb8c
jmp 0x14007cc0f
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call fcn.14007c830
nop
add rsp, 0x38
ret
invalid
Function at 0x14007e140
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x140244d68]
xor eax, 0x1d710dc8
xor edx, edx
div dword [0x140244d6c]
mov ecx, 0x3a7b9ae2
xor ecx, 0xf4f63b86
sub eax, ecx
mov ecx, 0x973ac9b7
xor ecx, 0xefd6697
imul eax, ecx
mov ecx, 0x46f3c2a0

Function at 0x14007e940
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x140244da8]
imul eax, dword [0x140244dac]
add eax, 0xee1ab77f
mov ecx, 0xcc8f410d
xor ecx, 0x3370bef2
xor eax, ecx
mov edx, 0x1d76175f
xor edx, 0x396cbc2f
mov ecx, 0x46e822aa
xor ecx, 0xb917dd55
xor edx, ecx
mov ecx, 0xffffffff
xor ecx, 0x748038eb
or eax, edx
or ecx, 0x748038eb
xor eax, 0xffffffff
and eax, ecx
xor eax, 0x63124f78
mov ecx, 0x4af1a6c0
xor ecx, 0x2e34047e
cmp eax, ecx
je 0x14007ea26
mov eax, dword [0x140244db0]
mov ecx, dword [0x140244db4]
xor ecx, 0x5c8ef633
sub eax, 0xcf6631c1
sub eax, ecx
mov ecx, 0xc099d7ac
xor ecx, 0xfffe66d
add eax, ecx
add eax, 0x1c27e67a
imul eax, eax, 0x71d5d3b0
sub eax, 0xf63f83a5
mov dword [rsp + 0x24], eax
mov eax, 0xfc2e1bc9
xor eax, 0x9a044754
mov dword [rsp + 0x20], eax
call fcn.14006bc70
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
call fcn.14007e8f1
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
jbe 0x14007e9b5
add rsp, 0x38
ret
and dword [rbx], eax
jne 0x14007ea68
jmp 0x14007e9b5
invalid

Function at 0x140080260
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x30], rcx
mov eax, 0x10
call fcn.14023fff0
sub rsp, rax
mov rax, rsp
Function at 0x140080ec0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x140244f28]
mov ecx, 0xeb97502a
xor ecx, 0x39baff86
xor eax, ecx
xor edx, edx
div dword [0x140244f2c]
sub eax, 0xb9652281
mov ecx, 0x476a8026
xor ecx, 0xaebf96df
sub eax, ecx
xor eax, 0x4c6612b7
cmp eax, 0xbae45cc9
jae 0x1400810c1
mov eax, dword [0x140244f30]
mov ecx, dword [0x140244f34]
and eax, ecx
mov ecx, eax
xor ecx, 0x772fa6b2
and eax, 0x8d0594d
add eax, eax
sub eax, ecx
imul eax, eax, 0x4644bc21
or eax, 0x2c1b22e9
mov dword [rbp - 0x18], eax
mov eax, 0x82f254c2
mov dword [rbp - 0x1c], eax
mov eax, 0x10
call fcn.14023fff0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
sub rsp, 0x20
call fcn.14006bc70
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov qword [rbp - 0x28], rax
mov edx, 2
sub rsp, 0x20
call fcn.14006c623
mov rdx, qword [rbp - 0x28]
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x18]
add rsp, 0x20
cmp byte [rdx], 0
sete dl
mov byte [rbp - 0x11], dl
cmp eax, ecx
jb 0x140080f0f
mov al, byte [rbp - 0x11]
test al, 1
jne 0x140080faa
jmp 0x1400810bc
mov ecx, dword [0x140244f38]
mov r8d, dword [0x140244f3c]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, ecx
and edx, r9d
mov eax, ecx
or eax, r9d
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, r8d
or ecx, r8d
imul ecx, edx
add ecx, eax
mov eax, 0x830b65e8
xor eax, 0x7877f559
and ecx, eax
or ecx, 0xf629bd33
mov edx, 0xb3865ae2
xor edx, 0x9631713f
mov eax, ecx
and eax, edx
xor ecx, 0x25b72bdd
or eax, ecx
mov ecx, 0x3d4d1889
xor ecx, 0x442278e1
cmp eax, ecx
jbe 0x1400810ca
mov rcx, qword [rbp - 8]
mov eax, dword [str.O7_r_3_]
mov edx, dword [0x140244f44]
add eax, 0xa8a54f0c
sub eax, edx
sub eax, 0xa8a54f0c
mov r8d, 0xe800d5bc
xor edx, edx
div r8d
mov edx, eax
mov rax, qword [rbp - 0x10]
sub edx, 0xa5f6fe68
sub edx, 0xc8f15796
mov dword [rbp - 0x38], edx
enter 0x5589, 0xffffffffffffffc8
mov rdx, qword [rax]
sub rsp, 0x20
call fcn.14007a3e6
mov rcx, qword [rbp - 0x28]
mov eax, dword [rbp - 0x38]
add rsp, 0x20
mov cl, byte [rcx]
mov dl, 0xd3
xor dl, 0xd3
cmp cl, dl
sete cl
mov byte [rbp - 0x31], cl
cmp eax, 0x8749a147
je 0x140081017
mov al, byte [rbp - 0x31]
test al, 1
jne 0x140081094
jmp 0x1400810bc
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax + 8]
mov qword [rdx], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14007ae40
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
jmp 0x14008104f
xor qword [r14 - 0x2b], 0xffffffffffff44e9
jmp qword [rsi + 0x66]
Function at 0x1400811f9
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rcx
call fcn.14006bc70
mov rdx, qword [rsp + 0x38]
cmp rdx, 0
jne 0x1400811bc
mov eax, dword [0x140244f48]
xor eax, 0x6ca0ba23
mov r8d, dword [0x140244f4c]
mov edx, 0xb9c8b5fb
xor edx, 0x46374a04
mov ecx, eax
xor ecx, edx
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
and eax, 0xbdad1372
mov ecx, 0x70649ec6
xor ecx, 0x2aca1d32
imul eax, ecx
sub eax, 0x53c2f7af
mov ecx, 0xa8b4b6b0
xor ecx, 0xe3a0a829
cmp eax, ecx
jae 0x1400811f0
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x140244f50]
imul eax, dword [0x140244f54]
xor eax, 0xc831bc9a
and eax, 0xefe37ae4
sub eax, 0x40641994
mov dword [rsp + 0x2c], eax
mov eax, 0xa274c73f
xor eax, 0x39b58609
mov dword [rsp + 0x28], eax
call fcn.14006c090
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
jae 0x14008116f
jmp 0x1400811ea
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov qword [rsp + 0x40], rdx
mov rdx, qword [rax + 8]
mov qword [rsp + 0x48], rdx
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x40]
call fcn.140080ec0
nop
add rsp, 0x58
ret
push qword [rdx + rdi]
cmp ch, cl
jbe 0x1400811f6
invalid
invalid
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006bc70
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x1400810e0