joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401078e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rcx
call fcn.14010672d
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rax, qword [rcx]
mov qword [rsp + 0x48], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
call fcn.1400646a0
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140107a09
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x14010796f
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
movabs rcx, 0xa7973c814cd58f04
movabs rdx, 0xe7973c814cd58f04
xor rcx, rdx
and rax, rcx
cmp rax, 0
jne 0x14010796f
mov rcx, qword [rsp + 0x30]
call fcn.14000fb44
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x28], rax
cmp rax, 0
je 0x140107a09
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
movabs rcx, 0xcc6555d71bd1ed57
movabs rdx, 0x339aaa28e42e12a8
xor rcx, rdx
xor rax, rcx
mov rcx, 0xffffffffffffffff
movabs rdx, 0x4000000000000000
xor rcx, rdx
mov rdx, 0xffffffffffffffff
movabs r8, 0x5a26f7d447ad9b0c
xor rdx, r8
or rax, rcx
movabs rcx, 0x579523e6e61921b4
movabs r8, 0xdb3d432a1b4bab8
xor rcx, r8
or rcx, rdx
xor rax, 0xffffffffffffffff
and rax, rcx
cmp rax, 0
jne 0x140107a09
mov rcx, qword [rsp + 0x28]
call fcn.14000fb44
mov eax, dword [0x1402076b8]
xor eax, 0x19e3f425
xor edx, edx
div dword [0x1402076bc]
imul eax, eax, 0x98558f2d
and eax, eax
xor eax, 0xffffffff
mov ecx, 0x8ed953c2
and ecx, 0x8ed953c2
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
add eax, 0xf9a3caa3
cmp eax, 0x11fb088
jb 0x140107aa3
mov eax, dword [0x1402076c0]
xor eax, dword [0x1402076c4]
add eax, 0x44130c8a
mov ecx, eax
add ecx, 1
mov edx, 0x4d178a5
xor edx, 0xfb2e875a
xor eax, edx
or eax, 0x8b1eb3
add eax, ecx
add eax, 0x8b15ba04
sub eax, 0x72a94b90
mov ecx, 0x51eb0d35
xor ecx, 0xdafeb731
sub eax, ecx
mov ecx, 0x5183ab6c
xor ecx, 0x892a7f74
cmp eax, ecx
je 0x140107a4a
add rsp, 0x58
ret
mov word [rdi + rdx], es
invalid
Function at 0x140110670
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rcx
xor eax, eax
cmp rcx, qword [rdx]
mov byte [rsp + 0x57], al
jne 0x14011080c
mov rcx, qword [rsp + 0x48]
mov al, 1
cmp rcx, 0
mov byte [rsp + 0x57], al
je 0x14011080c
mov eax, dword [0x140207908]
xor eax, 0x1b961416
mov ecx, dword [0x14020790c]
xor ecx, 0xdcbea95b
xor edx, edx
div ecx
mov ecx, 0x565a9d5e
Function at 0x140127260
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x140208270]
xor edx, edx
div dword [0x140208274]
and eax, 0x6bf642d4
mov ecx, eax
xor ecx, 0xd317a21e
xor ecx, 0xffffffff
or eax, 0xd317a21e
and eax, ecx
mov ecx, 0x54e8b318
xor edx, edx
div ecx
mov ecx, 0xd7a58874
xor ecx, 0x41dc97b3
cmp eax, ecx
ja 0x1401273d6
mov eax, dword [0x140208278]
or eax, dword [0x14020827c]
mov ecx, 0xc21b04dd
xor edx, edx
div ecx
mov ecx, 0x822563ef
xor ecx, 0x6e3d2af2
xor edx, edx
div ecx
add eax, 0xee7653f0
mov dword [rsp + 0x24], eax
call fcn.140127214
mov rcx, qword [rsp + 0x38]
mov rdx, rax
mov eax, dword [rsp + 0x24]
mov qword [rsp + 0x28], rdx
cmp rcx, 0
setg cl
mov byte [rsp + 0x37], cl
cmp eax, 0xe975c4ef
jbe 0x1401272af
mov cl, byte [rsp + 0x37]
xor eax, eax
test cl, 1
mov dword [rsp + 0x20], eax
jne 0x140127320
jmp 0x1401273cd
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov r8d, 0xffffffff
call fcn.140126d72
mov rcx, qword [rsp + 0x28]
mov dl, byte [rcx]
mov ecx, eax
and ecx, ecx
xor ecx, 0xffffffff
mov r8d, 0xdfdecdbb
xor r8d, 0x20213244
xor ecx, r8d
mov r8d, 0x8d6f832
xor r8d, 0xf72907cd
mov r9d, 0xbdfc3370
xor r9d, 0x4203cc8f
xor r8d, r9d
or ecx, r8d
mov r8d, 0x2ae9eb59
xor r8d, 0xd51614a6
mov r9d, 0xb472c759
xor r9d, 0x4b8d38a6
and r8d, r9d
xor r8d, 0xffffffff
mov r9d, 0xba4a5989
xor r9d, 0x45b5a676
xor eax, r9d
xor r8d, 0xffffffff
or eax, r8d
and ecx, eax
mov eax, 0xa23cb075
xor eax, 0x5dc34f8a
xor ecx, eax
mov eax, 0xbe346e82
xor eax, 0xbe346e82
cmp dl, 0
cmove eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x48
ret
cdq
invalid
Function at 0x14012ecc0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14012da70
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rcx]
mov qword [rsp + 0x40], rax
cmp rdx, 0
je 0x14012edf1
mov eax, dword [0x140208988]
mov edx, dword [0x14020898c]
mov ecx, 0x684bdcb
xor ecx, 0x41dbc479
xor edx, ecx
and eax, eax
mov ecx, 0x85b51d4a
xor ecx, 0x7a4ae2b5
xor eax, ecx
mov r8d, 0x4d1da8a7
xor r8d, 0xb2e25758
mov ecx, edx
xor ecx, r8d
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
xor ecx, ecx
sub ecx, eax
mov eax, 0xf86617a7
xor eax, 0xf86617a7
mov edx, 0x99490778
xor edx, 0x60eacddb
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, 0xd69f6ee3
xor ecx, 0x1e66b67d
add eax, ecx
sub eax, 0x9a4b8dc7
cmp eax, 0x50cfc8f6
jb 0x14012ee54
mov rcx, qword [rsp + 0x30]
mov eax, dword [str._fte_n]
mov edx, dword [0x140208994]
xor edx, 0x40d9adb9
and eax, edx
sub eax, 0xcf1c087
mov edx, 0x87bff211
xor edx, 0xf516b981
sub eax, edx
add eax, 0xcf1c087
mov r8d, 0xf6282b3c
xor r8d, 0xf6f076fa
xor edx, edx
div r8d
mov edx, 0xd0bdbe54
xor edx, 0xcc0477fc
or eax, edx
mov dword [rsp + 0x24], eax
mov eax, 0x8561a995
xor eax, 0xf178bf15
mov dword [rsp + 0x20], eax
call fcn.14012e8d0
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
ja 0x14012ed76
jmp 0x14012edf1
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov qword [rax], rdx
call fcn.14012eb31
test al, 1
jne 0x14012ee15
jmp 0x14012ee4e
mov rcx, qword [rsp + 0x40]
call fcn.14012ea6a
mov rax, qword [rsp + 0x38]
cmp byte [rax], 0
jne 0x14012ee4e
mov rcx, qword [rsp + 0x40]
movabs rdx, 0x1f04933460350c9d
movabs rax, 0x1f04933460350c95
xor rdx, rax
call fcn.14000fb9a
nop
add rsp, 0x48
ret
mov word [rdi + rdx], es
invalid
Function at 0x140139e80
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x140208df8]
or eax, dword [0x140208dfc]
mov ecx, eax
xor ecx, 0x554ca953
xor ecx, 0xffffffff
or eax, 0x554ca953
and eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xdf38843e
mov r8d, 0xffffffff
xor r8d, 0xdf38843e
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0x33679a48
xor r8d, 0xec5f1e76
mov edx, eax
and edx, r8d
or eax, 0xdf38843e
imul eax, edx
add eax, ecx
imul eax, eax, 0x44c93074
cmp eax, 0x1bcd09c1
jbe 0x14013a09e
mov edx, dword [0x140208e00]
mov eax, dword [0x140208e04]
imul edx, eax
mov eax, edx
and eax, 0x88ce1562
mov ecx, eax
not ecx
mov r8d, edx
and r8d, 0x800c0120
and ecx, 0x58c2fcd2
imul ecx, r8d
and edx, 0x8c21442
or eax, 0x58c2fcd2
imul eax, edx
add eax, ecx
mov ecx, eax
not ecx
or eax, 0x4cb45f9a
or ecx, 0xb34ba065
and eax, ecx
not eax
mov dword [rbp - 0x2c], eax
mov eax, 0x10
call fcn.1401ffc50
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x38], rax
sub rsp, 0x20
call fcn.140136725
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov rdx, rax
mov eax, dword [rbp - 0x2c]
mov qword [rbp - 0x28], rdx
mov rdx, qword [rcx]
mov rcx, rdx
add rcx, 4
mov qword [rbp - 0x20], rcx
movabs r8, 0xd2b597bcbf06fec3
movabs r9, 0x2d4a684340f9013c
xor r8, r9
xor rdx, r8
and rcx, rdx
cmp rcx, 0
setl cl
mov byte [rbp - 0x11], cl
cmp eax, 0x94a72b41
ja 0x140139efd
mov al, byte [rbp - 0x11]
test al, 1
jne 0x140139fd0
jmp 0x140139fe2
sub rsp, 0x20
call fcn.140007f57
add rsp, 0x20
jmp 0x14013a099
mov rax, qword [rbp - 0x20]
cmp rax, 0
jge 0x14013a034
mov rcx, qword [rbp - 0x20]
movabs rdx, 0x1a3a8b16c7860de7
movabs rax, 0x1a3a8b16c7860de7
xor rdx, rax
movabs r8, 0x57153995ff272b0a
movabs rax, 0x28eac66a00d8d4f5
xor r8, rax
sub rsp, 0x20
call fcn.14000dc65
add rsp, 0x20
jmp 0x14013a099
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x20]
sub rsp, 0x20
call fcn.140016100
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov qword [rax], rdx
mov edx, 4
sub rsp, 0x20
call fcn.140136f50
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x40], rcx
cmp byte [rax], 0
jne 0x14013a099
mov rdx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x40]
mov r8d, 4
sub rsp, 0x20
call fcn.1401374b0
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
push rdi
mov ebx, 0xfe56e934
invalid
Function at 0x14013ccb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x30], rcx
call fcn.14013d509
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rax, rcx
add rax, 0x88
mov qword [rsp + 0x38], rax
add rcx, 0x90
mov qword [rsp + 0x40], rcx
mov rax, qword [str.P0__]
call qword [rax]
mov rax, qword [rsp + 0x48]
mov cl, byte [rax + 0x50]
mov dl, 0xef
xor dl, 0xef
xor eax, eax
cmp cl, dl
mov qword [rsp + 0x50], rax
jne 0x14013ce8a
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
cmp rax, qword [rcx]
jge 0x14013ce5d
mov eax, dword [0x140208f78]
xor eax, 0xee435f64
mov r8d, dword [0x140208f7c]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
xor eax, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xc6629029
mov edx, 0xffffffff
xor edx, 0xef6e822f
or eax, ecx
mov ecx, 0x941bd2a8
xor ecx, 0x7b755087
or ecx, edx
xor eax, 0xffffffff
and eax, ecx
mov edx, eax
and edx, 0x64e3af34
mov ecx, 0xbe346e82
xor ecx, 0xbe346e80
imul ecx, edx
add eax, 0x64e3af34
sub eax, ecx
or eax, 0x384ba140
cmp eax, 0x9bff8baf
jb 0x14013ce90
mov eax, dword [0x140208f80]
mov ecx, dword [0x140208f84]
xor ecx, 0xd262fb0e
or eax, ecx
mov ecx, 0x126060dc
xor ecx, 0xf9831521
add eax, ecx
mov ecx, 0xd49f91e7
xor ecx, 0x7c3b3707
and eax, ecx
mov ecx, 0x7be1023d
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x28]
mov ecx, 0xd09412be
xor ecx, 0xa1f73b03
cmp rdx, 0x80
sete dl
mov byte [rsp + 0x27], dl
cmp eax, ecx
jae 0x14013cdb1
mov al, byte [rsp + 0x27]
test al, 1
jne 0x14013ce1f
jmp 0x14013ce33
mov ecx, pe_nt_image_headers64
mov edx, 0x7f
call fcn.140014583
jmp 0x14013ce8a
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + rcx*8 + 0xf0]
call fcn.14001959a
mov rax, qword [rsp + 0x28]
add rax, 1
mov qword [rsp + 0x50], rax
jmp 0x14013cd07
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
movabs rdx, 0xaf46a9c082f27597
movabs r8, 0xaf46a9c082f27597
xor rdx, r8
mov qword [rax], rdx
mov rax, qword [str.X0__]
call qword [rax]
nop
add rsp, 0x58
ret
cmp esp, 0x3d
enter 0x18e9, 0xffffffffffffffff
invalid
Function at 0x140146d50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14017583a
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, rcx
add rax, 8
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 8]
mov rcx, rdx
add rcx, 8
mov qword [rsp + 0x48], rcx
cmp rax, qword [rdx + 8]
mov qword [rsp + 0x50], rax
je 0x140146e6e
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
mov qword [rsp + 0x58], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x58]
call fcn.140146830
mov rax, qword [rsp + 0x38]
mov al, byte [rax + 0x50]
mov cl, 0x98
xor cl, 0x98
cmp al, cl
jne 0x140146e8b
mov eax, dword [0x1402094a8]
mov ecx, dword [0x1402094ac]
xor ecx, 0x3621e5cf
and eax, ecx
or eax, 0x30f0401b
or eax, 0xb8f15d6
or eax, 0x529ecd90
cmp eax, 0xa0e66919
ja 0x140146f1f
mov rcx, qword [rsp + 0x48]
mov eax, dword [0x1402094b0]
mov edx, dword [0x1402094b4]
sub eax, 0x7702df54
sub eax, edx
add eax, 0x7702df54
sub eax, 0xd7c97000
or eax, eax
xor eax, 0xffffffff
mov edx, 0x48222e28
or edx, 0x48222e28
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
mov r8d, 0x49f38f5b
xor r8d, 0xc1ed3a0f
xor edx, edx
div r8d
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rcx
cmp eax, 0x1dd855c3
je 0x140146f1f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
jmp 0x140146e6e
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov r8, qword [r8]
mov qword [rdx], r8
mov qword [rax], rcx
mov eax, dword [0x1402094b8]
imul eax, dword [0x1402094bc]
mov ecx, 0x18125f19
xor ecx, 0xd1a20adb
add eax, ecx
mov ecx, 0x4dad2764
xor ecx, 0xacebea3f
add eax, ecx
add eax, 0x18499ce1
mov ecx, 0xb981e3d0
xor ecx, 0x58c72e8b
sub eax, ecx
mov ecx, 0x798aa602
xor ecx, 0xa189457a
xor edx, edx
div ecx
cmp eax, 0x16e36023
jae 0x140146f28
mov ecx, dword [0x1402094c0]
mov edx, dword [0x1402094c4]
xor edx, 0x1773124e
mov eax, ecx
and eax, edx
or ecx, edx
add eax, ecx
mov ecx, 0x94a97b55
xor ecx, 0x46c73565
or eax, ecx
sub eax, 0x97dcb86f
xor eax, 0xe96f0251
cmp eax, 0x9e097e5f
je 0x140146ede
add rsp, 0x68
ret
invalid
invalid
Function at 0x14015d450
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
mov rcx, qword [rdx]
mov qword [rsp + 0x48], rcx
mov rdx, rcx
dec rdx
mov qword [rsp + 0x50], rdx
test rdx, rdx
setns al
or rcx, rdx
sets cl
add al, cl
inc al
test al, 1
jne 0x14015d493
jmp 0x14015d51b
mov eax, dword [0x140209df8]
xor eax, 0x986a533c
xor edx, edx
div dword [0x140209dfc]
xor eax, 0xa5a2c7ee
xor ecx, ecx
sub ecx, 0xed9f4d02
add eax, ecx
xor eax, 0xa174f6b1
cmp eax, 0x80621696
jae 0x14015d662
mov eax, dword [0x140209e00]
mov ecx, dword [0x140209e04]
xor ecx, 0x8b487637
xor edx, edx
div ecx
mov ecx, 0x4da35b09
xor ecx, 0x364c13d0
xor edx, edx
div ecx
mov ecx, 0xb88b0ef3
xor ecx, 0xbfcc3df0
xor edx, edx
div ecx
and eax, 0x9640aab5
mov dword [rsp + 0x2c], eax
call fcn.140007f57
mov eax, dword [rsp + 0x2c]
cmp eax, 0x9f6858c5
je 0x14015d662
jmp 0x14015d57c
mov rax, qword [rsp + 0x48]
cmp rax, 0
jg 0x14015d53c
mov rdx, qword [rsp + 0x50]
mov rcx, rdx
call fcn.140014583
jmp 0x14015d57c
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rcx + 8]
add rcx, 8
shl rdx, 4
add rcx, rdx
mov rdx, qword [rcx]
mov qword [rax], rdx
mov rdx, qword [rcx + 8]
mov qword [rax + 8], rdx
call fcn.140011160
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x50]
call fcn.140018130
mov r11d, dword [0x140209e08]
mov eax, dword [0x140209e0c]
xor eax, 0x73a6ca8b
xor r11d, eax
sub r11d, 0x6c930402
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0x7809659a
mov edx, 0xffffffff
xor edx, 0x26db0ecb
mov eax, ecx
and eax, 0x26db0ecb
and r11d, edx
mov r9d, r8d
and r9d, 0x26db0ecb
mov r10d, edx
and r10d, 0x7809659a
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
mov r8d, 0x2e930a7f
xor r8d, 0xd16cf580
xor ecx, r8d
or edx, 0x26db0ecb
and ecx, edx
or eax, ecx
sub eax, 0x8a31e6b4
cmp eax, 0x57d1ba90
je 0x14015d66b
mov eax, dword [0x140209e10]
xor eax, 0x2d3088d1
mov edx, dword [0x140209e14]
mov ecx, eax
xor ecx, edx
mov r8d, 0x60f61cb2
xor r8d, 0x9f09e34d
xor edx, r8d
and eax, edx
shl eax, 1
sub eax, ecx
xor eax, 0x4bcfad33
mov ecx, 0xaf0a42e
xor ecx, 0xcb95f1e3
sub eax, ecx
and eax, 0x4f01cb93
cmp eax, 0x7493ad0c
je 0x14015d60a
mov rax, qword [rsp + 0x40]
add rsp, 0x58
ret
mov ch, byte [rsi - 0xd]
mov bh, 0xe9
pop rdx
invalid
push 0xffffffff96e91093
invalid
Function at 0x140175330
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x140175388
mov rcx, qword [rsp + 0x30]
movabs rax, 0x4000000000000000
and rax, qword [rcx]
movabs rcx, 0x63ef0a0d4711fed6
movabs rdx, 0x63ef0a0d4711fed6
xor rcx, rdx
cmp rax, rcx
jne 0x140175388
mov rcx, qword [rsp + 0x30]
call fcn.14000fb44
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x1401753d7
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, rax
add rcx, 1
xor rax, 0xffffffffffffffff
movabs rdx, 0x4000000000000000
or rax, rdx
add rax, rcx
cmp rax, 0
jne 0x1401753d7
mov rcx, qword [rsp + 0x20]
call fcn.14000fb44
mov eax, dword [0x14020a7f8]
mov edx, dword [0x14020a7fc]
or eax, eax
xor eax, 0xffffffff
mov r8d, 0x999354f3
xor r8d, 0x666cab0c
mov ecx, edx
xor ecx, r8d
xor edx, 0xffffffff
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
imul eax, eax, 0x7916694
mov ecx, 0x5f81846c
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
and eax, eax
mov edx, 0x255bbecf
xor edx, 0xdaa44130
xor eax, edx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x18e4531
or eax, edx
mov edx, 0xffffffff
xor edx, 0x18e4531
mov r8d, 0xffffffff
xor r8d, 0x18e4531
or edx, r8d
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
cmp eax, 0x10ecca73
ja 0x1401754c0
mov eax, dword [0x14020a800]
xor eax, 0xc919825f
mov ecx, dword [0x14020a804]
sub eax, 0x75ae5996
sub eax, ecx
mov ecx, 0xf826b966
xor ecx, 0x8d88e0f0
add eax, ecx
add eax, 0x6049f3ed
mov ecx, 0x9be005b
xor edx, edx
div ecx
imul eax, eax, 0x38f52092
mov ecx, 0x407d2053
xor ecx, 0xf73a023c
cmp eax, ecx
ja 0x14017546f
add rsp, 0x38
ret
lahf
mov ecx, 0xa6e9ce76
invalid
Function at 0x14018bd50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
call fcn.140197626
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
call fcn.14018b350
test al, 1
jne 0x14018bd7a
jmp 0x14018be8d
mov eax, dword [0x14020b158]
mov ecx, 0xb1ce3d88
xor ecx, 0xffb8ef32
xor eax, ecx
mov ecx, dword [str.s446_f5__r_JF]
mov edx, 0x4c81270d
xor edx, 0x1aeae9f4
sub eax, edx
sub eax, ecx
add eax, 0x566bcef9
imul eax, eax, 0x1a65986c
xor eax, 0x14a115b
mov ecx, 0xb5e00d91
xor edx, edx
div ecx
mov ecx, 0x95a709e3
xor ecx, 0xf51251c2
cmp eax, ecx
je 0x14018be93
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x14020b160]
add eax, dword [0x14020b164]
mov edx, 0xbde90393
xor edx, 0x51e0c584
sub eax, edx
mov edx, eax
and edx, 0x4bf2fc1d
mov r8d, 0x6bbee458
xor r8d, 0x6bbee45a
imul edx, r8d
mov r8d, 0xcd0e0ab0
xor r8d, 0x86fcf6ad
xor eax, r8d
add eax, edx
mov edx, 0xedcabfe1
xor edx, 0x6462df80
xor eax, edx
mov dword [rsp + 0x30], eax
mov eax, 0x9ff928c0
xor eax, 0xd7dc0ad8
mov dword [rsp + 0x2c], eax
call fcn.14018b6c0
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x30]
cmp byte [rdx + 0x50], 0
sete dl
mov byte [rsp + 0x37], dl
cmp eax, ecx
jb 0x14018bdce
mov al, byte [rsp + 0x37]
test al, 1
jne 0x14018be6c
jmp 0x14018be8d
mov rcx, qword [rsp + 0x38]
movabs rdx, 0x3a5d951d4a9e1aa7
movabs rax, 0x3a5d951d4a9e1aaf
xor rdx, rax
call fcn.14000fb9a
nop
add rsp, 0x48
ret
invalid
Function at 0x140196f50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14020b4d8]
xor edx, edx
div dword [0x14020b4dc]
sub eax, 0xc59b0578
mov ecx, 0x17c9cbe6
xor ecx, 0x8471ef56
or eax, ecx
sub eax, 0x4bfae8a1
add eax, 0x9b82e905
add eax, 0x4bfae8a1
mov ecx, 0x14d76420
xor ecx, 0x6e78c4f1
cmp eax, ecx
jae 0x14019702f
mov eax, dword [0x14020b4e0]
xor eax, 0xe43d098b
xor eax, dword [0x14020b4e4]
mov ecx, 0x7fa31b73
xor edx, edx
div ecx
mov edx, eax
sub edx, 0x8bf13070
mov eax, 0x391cc199
xor eax, 0xbe99da5b
mov ecx, edx
xor ecx, eax
mov eax, 0x4a647bbb
xor eax, 0xcde16079
mov r8d, 0xf2a524c8
xor r8d, 0xd5adb37
xor eax, r8d
and edx, eax
mov eax, 0x91a660c2
xor eax, 0x91a660c0
imul eax, edx
sub eax, ecx
mov dword [rsp + 0x24], eax
call fcn.140197626
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x38]
xor eax, eax
mov r8b, al
xor r8b, 0
and r8b, 1
call fcn.1400130d0
mov eax, dword [rsp + 0x24]
cmp eax, 0x440db637
jbe 0x140196f96
add rsp, 0x28
ret
sub byte [rax + 0x21], 0x25
jmp 0x140196f96
Function at 0x1401b3140
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x60
mov qword [rsp + 0x58], rcx
mov eax, dword [0x14020c280]
mov edx, dword [0x14020c284]
mov ecx, eax
add ecx, 1
mov r8d, 0xe2420c40
xor r8d, 0x1dbdf3bf
xor eax, r8d
or eax, edx
add eax, ecx
mov ecx, 0x881eb554
xor edx, edx
div ecx
mov ecx, eax
and ecx, 0x421ac156
mov edx, 0x8a05f37d
xor edx, 0x75fa0c82
xor ecx, edx
mov edx, 0x314c77e0
xor edx, 0x7356b6b6
add eax, edx
add eax, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0xa68720e8
add ecx, eax
xor eax, eax
sub eax, ecx
cmp eax, 0xa07e3dec
jb 0x1401b3640
mov eax, dword [0x14020c288]
xor eax, 0xf657507b
add eax, dword [0x14020c28c]
mov ecx, 0xd803e378
xor edx, edx
div ecx
mov ecx, 0xa909844c
xor ecx, 0x38f3bab9
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
and eax, 0x93d9a816
mov edx, 0xce7482ba
xor edx, 0x5dad2aac
or ecx, edx
add eax, ecx
mov dword [rsp + 0x50], eax
call fcn.1401b3664
mov rcx, qword [rsp + 0x58]
mov eax, dword [rsp + 0x50]
cmp rcx, 0
sete cl
mov byte [rsp + 0x57], cl
cmp eax, 0xa6b5a845
je 0x1401b31bb
mov al, byte [rsp + 0x57]
test al, 1
jne 0x1401b34f5
jmp 0x1401b3235
mov rax, qword [rsp + 0x58]
invalid
Function at 0x1401bae90
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x3f0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1d0], rcx
mov eax, 0x10
Function at 0x1401d6870
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x190
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], rcx
mov eax, 0x10
mov qword [rbp + 0x60], rax
call fcn.1401ffc50
sub rsp, rax
mov rax, qword [rbp + 0x60]
mov rcx, rsp
mov qword [rbp + 0x78], rcx
call fcn.1401ffc50
sub rsp, rax
mov rax, qword [rbp + 0x60]
mov rcx, rsp
mov qword [rbp + 0x28], rcx
call fcn.1401ffc50
sub rsp, rax
Function at 0x1401de0e0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [0x14020d408]
mov eax, dword [0x14020d40c]
mov edx, 0x2efb2699
xor edx, 0x4b0582ef
xor eax, edx
sub ecx, eax
mov eax, 0x525c1fd7
xor eax, 0xe64b8c5
or ecx, eax
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0xb22ec006
xor ecx, 0x73691dbd
mov edx, 0x49d9aa7f
xor edx, 0xb6265580
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0xc147ddbb
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0x550594bb
xor ecx, 0xf2358403
xor edx, edx
div ecx
mov ecx, 0xbef83d4a
xor ecx, 0xeef10f59
cmp eax, ecx
jae 0x1401de193
mov eax, dword [0x14020d410]
xor edx, edx
div dword [0x14020d414]
xor eax, 0x62f0b236
xor ecx, ecx
sub ecx, 0x950bb925
sub eax, ecx
xor eax, 0xa4a96dc3
mov ecx, 0x9d718875
xor ecx, 0x3894518e
cmp eax, ecx
ja 0x1401de15d
ret
lahf
fld xword [rbx]
mov esi, 0xffffc1e9
invalid
Function at 0x1401f3e30
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x60], rcx
Function at 0x1401f7870
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, qword gs:[0x60]
movzx rax, byte [rax + 2]
ret
Function at 0x1401fda20
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov eax, dword [0x14020e080]
mov edx, dword [0x14020e084]
mov ecx, eax
xor ecx, edx
xor edx, 0xffffffff
and eax, edx
shl eax, 1
sub eax, ecx
sub eax, 0x754bb511
mov ecx, eax
and ecx, 0xdceba50f
xor ecx, 0xffffffff
add eax, 0xdceba50f
add eax, 1
add eax, ecx
mov ecx, 0x6bd4841
xor ecx, 0xc478e881
mov edx, 0xd25bfe6a
xor edx, 0x2da40195
xor ecx, edx
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
cmp eax, 0x6afb8874
je 0x1401fdb25
mov eax, dword [0x14020e088]
mov ecx, dword [0x14020e08c]
xor ecx, 0x3200028
and eax, ecx
or eax, 0xe0dafcc6
xor eax, 0x3d8a18bd
imul eax, eax, 0xf604c7ee
mov dword [rbp - 0xc], eax
mov eax, 0x946ec3f5
mov dword [rbp - 0x10], eax
mov eax, 0x10
call fcn.1401ffc50
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
sub rsp, 0x20
call fcn.1401fdb58
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov qword [rcx], 0
mov rdx, qword [rax + 0x10]
xor eax, eax
mov r8b, al
xor r8b, 0
and r8b, 1
sub rsp, 0x20
call fcn.1400130d0
mov rdx, qword [rbp - 0x18]
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0xc]
add rsp, 0x20
mov rdx, qword [rdx]
mov qword [rbp - 8], rdx
cmp eax, ecx
jae 0x1401fda8a
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
xor eax, 0xe9d9b29c
pop rsp
invalid