joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140073e90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rcx
call fcn.140067645
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov rdx, qword [rdx]
call fcn.140067ce0
mov rax, qword [rsp + 0x60]
cmp byte [rax], 0
jne 0x140074103
mov rax, qword [rsp + 0x50]
mov r8, qword [rax]
xor eax, eax
mov ecx, eax
sub rcx, 0xffffffffffffffff
mov rax, r8
sub rax, rcx
mov qword [rsp + 0x48], rax
mov rcx, rax
or rcx, rcx
xor rcx, 0xffffffffffffffff
mov rdx, r8
xor rdx, 0xffffffffffffffff
mov r9, r8
xor r9, 0xffffffffffffffff
and rdx, r9
xor rcx, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
and rcx, rdx
mov rdx, rax
or rdx, r8
movabs r8, 0x7ccaa1ce7c98b9eb
movabs r9, 0x83355e3183674614
xor r8, r9
xor rdx, r8
xor rcx, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
and rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x140073f66
mov rax, qword [rsp + 0x50]
add rax, 8
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x40], rax
jmp 0x140073f70
call fcn.140009cc0
jmp 0x140074103
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
cmp rax, rcx
jg 0x140074103
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
cmp rax, rcx
jl 0x140073fc9
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rax, rdx
and rax, 0xffffffffffffffff
shl rax, 1
xor rdx, 0xffffffffffffffff
add rdx, rax
call fcn.140013c92
jmp 0x140074103
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov rdx, qword [rax + rdx*8 + 8]
call fcn.140073e44
mov rax, qword [rsp + 0x60]
cmp byte [rax], 0
jne 0x140074103
mov r11d, dword [0x1401f66c8]
mov ecx, dword [0x1401f66cc]
xor ecx, 0xc1fe0944
mov eax, 0xbf5a4458
xor eax, 0xbf5a4458
sub eax, ecx
sub r11d, eax
mov eax, r11d
add eax, 1
xor r11d, 0xffffffff
mov ecx, 0xf2ad2524
xor ecx, 0x729fb219
or r11d, ecx
add r11d, eax
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, 0xffffffff
xor r8d, 0x2278691b
mov edx, 0xffffffff
xor edx, 0x19f0ae6d
mov r9d, 0xeb63debf
xor r9d, 0xf29370d2
mov eax, ecx
and eax, r9d
and r11d, edx
mov r9d, r8d
and r9d, 0x19f0ae6d
mov r10d, edx
and r10d, 0x2278691b
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
xor ecx, 0xffffffff
or edx, 0x19f0ae6d
and ecx, edx
or eax, ecx
imul eax, eax, 0x18141981
cmp eax, 0x1f48f66
je 0x140074108
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401f66d0]
xor eax, dword [0x1401f66d4]
mov edx, 0x6b7fa974
xor edx, 0xb6677d16
imul eax, edx
add eax, 0x4d9075e9
sub eax, 0x28176415
movabs rdx, 0xb7210f3b4b828e55
movabs r8, 0xb7210f3b4b828e54
xor rdx, r8
add rcx, rdx
mov qword [rsp + 0x20], rcx
cmp eax, 0x181c082b
jbe 0x1400740a1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
jmp 0x140073f70
add rsp, 0x68
ret
and byte [rax], ch
cmp r9b, r13b
nop
invalid
Function at 0x140076640
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
call fcn.140067645
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov edx, 1
call fcn.140067ce0
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140076710
mov eax, dword [0x1401f67e8]
imul eax, dword [0x1401f67ec]
mov ecx, 0x4314000
xor ecx, 0x6b5ba0be
and eax, ecx
mov ecx, 0x3ed243ba
xor edx, edx
div ecx
mov ecx, 0x3dd86f87
xor edx, edx
div ecx
cmp eax, 0xcb667351
jae 0x140076715
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x1401f67f0]
mov edx, 0x7db3c0d0
xor edx, 0x38948fa1
xor eax, edx
mov edx, dword [0x1401f67f4]
xor edx, 0x63f41db0
imul eax, edx
mov r8d, 0x2e9dc1f0
xor edx, edx
div r8d
and eax, 0x3f43f83e
mov r8d, 0x8d195103
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x30]
mov dword [rsp + 0x2c], eax
call fcn.140072852
mov eax, dword [rsp + 0x2c]
cmp eax, 0x761ff9d0
ja 0x1400766ac
jmp 0x140076710
add rsp, 0x48
ret
cli
jae 0x140076734
jmp 0x1400766ac
mov edx, dword [rsp + 0x30]
cmp rdx, 0
jne 0x14007681e
mov eax, dword [0x1401f67f8]
xor edx, edx
div dword [0x1401f67fc]
mov ecx, 0x46d1bc52
xor ecx, 0x79a2a506
or eax, ecx
mov ecx, 0x5c77cd98
xor ecx, 0xd2816ed7
or eax, ecx
mov edx, 0x2e1645b3
xor edx, 0xdd49e211
mov ecx, eax
and ecx, edx
shl ecx, 1
add eax, 0xf35fa7a2
sub eax, ecx
mov ecx, 0xe3028df3
xor ecx, 0x8923c3cf
cmp eax, ecx
ja 0x140076836
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401f6800]
mov edx, dword [0x1401f6804]
xor edx, 0x49169540
or eax, edx
mov r9d, 0xffffffff
xor r9d, 0x23aeebc6
mov r8d, eax
and r8d, r9d
mov edx, eax
or edx, r9d
xor edx, 0xffffffff
imul edx, r8d
mov r8d, eax
and r8d, 0x23aeebc6
mov r9d, 0x5c232173
xor r9d, 0x7f8dcab5
or eax, r9d
imul eax, r8d
add eax, edx
imul eax, eax, 0x53d361d3
mov edx, 0xc1229168
xor edx, 0x1eb26786
or eax, edx
mov dword [rsp + 0x24], eax
call fcn.140067a3f
mov eax, dword [rsp + 0x24]
cmp eax, 0x81fd186
je 0x140076836
jmp 0x140076830
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax]
call fcn.140076640
nop
add rsp, 0x38
ret
retf
Function at 0x140076a30
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov ecx, dword [0x1401f6818]
xor ecx, 0xc4f9005d
mov edx, dword [0x1401f681c]
xor edx, 0x5a54c706
mov eax, ecx
xor eax, edx
xor eax, 0xffffffff
mov r8d, edx
and r8d, eax
mov eax, 0x500a93c0
xor eax, 0x500a93c2
imul eax, r8d
sub eax, edx
sub ecx, eax
mov eax, 0xde2a3ae9
xor eax, 0xcc7996c0
mov edx, 0x3a32c386
xor edx, 0xc5cd3c79
xor eax, edx
add ecx, eax
add ecx, 1
mov edx, ecx
xor edx, 0xba70b869
xor edx, 0xffffffff
and edx, 0xba70b869
mov eax, 0x7a1fc0c7
xor eax, 0x7a1fc0c5
imul eax, edx
sub eax, 0xba70b869
sub ecx, eax
mov edx, 0xffffffff
xor edx, 0x62dec529
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0xfad4bd3d
ja 0x140076beb
mov edx, dword [0x1401f6820]
mov ecx, dword [0x1401f6824]
mov eax, edx
and eax, ecx
xor edx, ecx
mov ecx, eax
mov eax, edx
lea ecx, [rax + rcx*2]
mov eax, ecx
not eax
and eax, 0x761f38e8
mov edx, ecx
and edx, 0x89e0c717
imul edx, eax
mov eax, ecx
and eax, 0x761f38e8
or ecx, 0x761f38e8
imul ecx, eax
mov eax, ecx
mov ecx, edx
lea eax, [rax + rcx - 0x4f377d19]
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.1401f2390
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.140067645
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov qword [rbp - 0x20], rax
movabs rdx, 0xcec06e933ee41816
movabs rax, 0xcec06e933ee41814
xor rdx, rax
sub rsp, 0x20
call fcn.140067ce0
mov rcx, qword [rbp - 0x20]
mov eax, dword [rbp - 0x18]
add rsp, 0x20
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0xd76fcc6d
jb 0x140076ad6
mov al, byte [rbp - 0x11]
test al, 1
jne 0x140076b99
jmp 0x140076be6
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax]
sub rsp, 0x20
call fcn.140072852
mov rax, qword [rbp - 0x20]
add rsp, 0x20
cmp byte [rax], 0
jne 0x140076be6
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax + 8]
mov qword [rdx], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.140072eb0
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
invalid

Function at 0x14007863f
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x2f], dl
call fcn.140067645
mov dl, byte [rsp + 0x2f]
mov rcx, qword [rsp + 0x30]
and dl, 1
or dl, 0xc2
add rsp, 0x38
jmp fcn.1400322e0
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x2f], dl
call fcn.140067645
mov dl, byte [rsp + 0x2f]
mov rcx, qword [rsp + 0x30]
and dl, 1
add rsp, 0x38
jmp 0x140078615
Function at 0x1400793c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x30], rcx
mov eax, 0x10
call fcn.1401f2390
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.140067645
mov rcx, qword [rbp - 0x20]
add rsp, 0x20
mov qword [rbp - 0x18], rax
movabs rax, 0x6a5b830b8fab4657
movabs rdx, 0x6a5b830b8fab4657
xor rax, rdx
mov qword [rcx], rax
mov qword [rcx + 8], 0
movabs rcx, 0xac36594b39f9560e
movabs rax, 0xac36594b39f95606
xor rcx, rax
sub rsp, 0x20
call fcn.140067770
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov qword [rbp - 0x10], rax
mov al, 1
cmp byte [rcx], 0
mov byte [rbp - 1], al
jne 0x140079561
mov eax, dword [0x1401f6928]
mov r8d, dword [0x1401f692c]
mov ecx, 0x572e5a3d
xor ecx, 0x3510726b
xor r8d, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
and eax, 0x1a1c846c
xor eax, 0xf5fc1081
add eax, 0x694b0f4b
cmp eax, 0x16ee8c89
jbe 0x1400795a4
mov rcx, qword [rbp - 0x10]
mov eax, dword [0x1401f6930]
xor edx, edx
div dword [0x1401f6934]
mov rdx, qword [rbp - 0x38]
mov r8d, 0x785d2939
xor r8d, 0x3a5459a2
and eax, r8d
mov r8d, 0xbea38c25
xor r8d, 0xccac332b
and eax, r8d
xor eax, 0x14b61062
mov dword [rbp - 0x40], eax
sub rsp, 0x20
call fcn.140079396
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbp - 0x40]
add rsp, 0x20
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0x39], cl
cmp eax, 0x4a510551
jae 0x1400794b4
mov cl, byte [rbp - 0x39]
mov al, 1
test cl, 1
mov byte [rbp - 1], al
jne 0x140079530
jmp 0x140079561
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax + 0x58]
mov qword [rdx], r8
mov rax, qword [rax + 0x60]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.1400191eb
mov rax, qword [rbp - 0x18]
add rsp, 0x20
mov al, byte [rax]
mov byte [rbp - 1], al
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov dl, byte [rbp - 1]
mov byte [rbp - 0x41], dl
mov byte [rax], 0
sub rsp, 0x20
call fcn.140067370
mov rax, qword [rbp - 0x18]
add rsp, 0x20
mov al, byte [rax]
mov cl, 0x40
xor cl, 0x40
cmp al, cl
jne 0x14007959b
mov rax, qword [rbp - 0x18]
mov cl, byte [rbp - 0x41]
mov byte [rax], cl
mov rax, qword [rbp - 0x30]
mov rsp, rbp
pop rbp
ret
cmpsb byte [rsi], byte [rdi]
invalid

Function at 0x14007a7e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], rcx
mov eax, dword [0x1401f69b8]
xor eax, 0xfef76c15
add eax, dword [0x1401f69bc]
mov ecx, 0x24e8af01
xor ecx, 0x7e8ca1d7
and eax, ecx
xor eax, 0x8671da0b
or eax, 0x5397b6ca
mov ecx, 0xffa97ed4
xor ecx, 0x52faebc6
cmp eax, ecx
jbe 0x14007abad
xor eax, 0xe93178fa
xor ecx, ebp
jae 0x14007abb0
invalid
Function at 0x140081dc0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov ecx, dword [0x1401f6d18]
add ecx, dword [0x1401f6d1c]
mov edx, 0x538204c3
xor edx, 0xa2d930d4
mov eax, 0x30370272
xor eax, 0xcfc8fd8d
xor edx, eax
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0x25fc7cd9
xor ecx, 0xe62583ff
or eax, ecx
imul eax, eax, 0x52184897
mov ecx, 0x33c91bbf
xor ecx, 0xfa8e08ee
cmp eax, ecx
jae 0x140081fc9
mov ecx, dword [0x1401f6d20]
imul ecx, dword [0x1401f6d24]
mov edx, 0x897a35e6
xor edx, 0x646c30e0
mov eax, ecx
and eax, edx
or ecx, 0xed160506
add eax, ecx
mov ecx, 0x7f53e8f9
xor ecx, 0xefe48308
or eax, ecx
sub eax, 0x40eb3a05
mov dword [rsp + 0x38], eax
call fcn.140081bc6
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
call fcn.140081bf0
mov cl, al
mov eax, dword [rsp + 0x38]
mov byte [rsp + 0x3f], cl
cmp eax, 0x165407a3
jbe 0x140081fc9
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x140081e8c
jmp 0x140081fc3
mov ecx, dword [0x1401f6d28]
xor ecx, 0xe5e76161
mov edx, dword [0x1401f6d2c]
mov eax, ecx
and eax, eax
xor eax, 0xffffffff
and eax, edx
xor eax, 0xffffffff
and edx, edx
xor edx, 0xffffffff
and ecx, edx
mov edx, 0x8fba6d77
xor edx, 0x70459288
xor ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0xd32c676
xor edx, edx
div ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xeee45f7f
mov r8d, 0xbf279dc7
xor r8d, 0x51c3c2b8
mov ecx, 0x3a955fd9
xor ecx, 0xc56aa026
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xeee45f7f
or eax, 0xeee45f7f
imul eax, edx
add eax, ecx
and eax, 0x8d55334a
cmp eax, 0x8c29c1e9
jae 0x140081fd2
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x1401f6d30]
mov edx, 0x4c4b74c
xor edx, 0x4cca8e49
xor eax, edx
mov edx, dword [0x1401f6d34]
xor edx, 0xdce6f10
add eax, edx
or eax, 0xec3ea98e
mov r8d, 0x7aef1dbf
xor edx, edx
div r8d
mov r8d, 0x35601720
xor r8d, 0x155bea0e
mov edx, eax
and edx, r8d
shl edx, 1
mov r8d, 0xa461ed62
xor r8d, 0x845a104c
add eax, r8d
sub eax, edx
mov dword [rsp + 0x28], eax
call fcn.140081850
mov rcx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x28]
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x800b75d2
je 0x140081f1f
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x140081fb4
jmp 0x140081fc3
mov rcx, qword [rsp + 0x40]
mov edx, 8
call fcn.14000fac0
nop
add rsp, 0x48
ret
inc dword [rdi + 0x46e947c9]
invalid
invalid
Function at 0x140088830
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov eax, dword [0x1401f7018]
mov edx, dword [0x1401f701c]
mov ecx, 0x55ba9bdb
xor ecx, 0x55ba9bdb
sub ecx, edx
sub eax, ecx
mov ecx, 0xea45b192
xor edx, edx
div ecx
mov ecx, 0xaba3a511
xor ecx, 0x14301bdb
or eax, ecx
or eax, 0x4b5bb4ab
mov ecx, 0xa3fac78
xor ecx, 0x3d57f296
cmp eax, ecx
jbe 0x14008893a
mov eax, dword [0x1401f7020]
mov ecx, dword [0x1401f7024]
xor ecx, 0x4321f541
xor edx, edx
div ecx
or eax, 0x7ba56e19
mov ecx, 0x4610ff62
xor ecx, 0xb58e23b3
add eax, ecx
mov ecx, 0x26981571
xor ecx, 0xb002f7df
add eax, ecx
mov dword [rsp + 0x3c], eax
call fcn.140088815
mov rdx, qword [rsp + 0x48]
mov eax, dword [rsp + 0x3c]
xor ecx, ecx
test rdx, rdx
cmovg rcx, rdx
mov qword [rsp + 0x40], rcx
cmp eax, 0xd616ebd7
jae 0x140088887
xor eax, eax
mov qword [rsp + 0x30], rax
jmp 0x1400888f3
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp rax, rcx
je 0x140088935
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov byte [rcx + rax], 0
mov rcx, rax
and rcx, 1
shl rcx, 1
xor rax, 1
add rax, rcx
mov qword [rsp + 0x30], rax
jmp 0x1400888f3
add rsp, 0x58
ret
cld
jno 0x140088928
invalid
Function at 0x1400a02f0
Capabilities:
Encode data using add xor sub operations

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x50], r8
mov dword [rsp + 0x5c], edx
mov qword [rsp + 0x60], rcx
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x80], rax
mov eax, dword [0x1401f7a38]
mov edx, dword [0x1401f7a3c]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
or eax, 0xb250963b
mov ecx, 0x11eea044
xor ecx, 0x1d8f7ea9
imul eax, ecx
mov ecx, 0x78239f6f
xor ecx, 0xec833a98
imul eax, ecx
mov ecx, 0x77713a2c
xor ecx, 0x5f0c1c53
cmp eax, ecx
jbe 0x1400a0485
mov rsi, qword [rsp + 0x80]
mov edx, dword [0x1401f7a40]
mov ecx, dword [0x1401f7a44]
xor ecx, 0x19534d73
mov eax, edx
xor eax, ecx
mov r8d, 0xe65b557d
xor r8d, 0x19a4aa82
xor eax, r8d
or edx, ecx
and edx, eax
mov ecx, edx
xor ecx, 0xf87ae1f8
mov eax, 0xffffffff
xor eax, 0xf87ae1f8
and edx, eax
mov eax, 0x4c708ca2
xor eax, 0x4c708ca0
imul eax, edx
sub eax, ecx
or eax, 0x8a6c762
mov r8d, 0xffffffff
xor r8d, 0x7b10704c
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x7b10704c
mov r8d, 0xb3f1c09b
xor r8d, 0xc8e1b0d7
or eax, r8d
imul eax, edx
add eax, ecx
mov dword [rsp + 0x40], eax
call fcn.14009fff9
mov rcx, qword [rsp + 0x60]
mov edx, dword [rsp + 0x5c]
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x48]
mov r11, qword [rsp + 0x78]
mov r10, qword [rsp + 0x70]
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x38], rax
call qword [0x140219058]
mov ecx, eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x44], ecx
cmp eax, 0x7b3aef30
jae 0x1400a0389
mov eax, dword [rsp + 0x44]
add rsp, 0x88
pop rdi
pop rsi
ret
xlatb
push rsi
nop
ret 0xfbe9
Function at 0x1400a07d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov rax, qword [0x140209370]
mov ecx, dword [rax]
call fcn.140009923
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx]
call fcn.1400a0570
mov rcx, rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rcx
cmp byte [rax + 0x50], 0
jne 0x1400a08f3
mov eax, dword [0x1401f7a68]
mov edx, dword [0x1401f7a6c]
xor edx, 0x7a9a1c9
mov ecx, eax
xor ecx, 0xffffffff
and ecx, edx
xor edx, 0xffffffff
and eax, edx
sub eax, ecx
or eax, 0x45ad24f3
mov edx, 0xac625b36
xor edx, 0xb3aace38
mov ecx, eax
and ecx, edx
shl ecx, 1
add eax, 0x1fc8950e
sub eax, ecx
mov r8d, 0xd31551b4
xor r8d, 0xbbe7cc1
mov ecx, 0xab08a6f6
xor ecx, 0x54f75909
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xd8ab2d75
mov r8d, 0x5e82c93c
xor r8d, 0x8629e449
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xa63ef200
xor ecx, 0x5a72d93a
cmp eax, ecx
je 0x1400a08f8
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x40]
mov eax, dword [0x1401f7a70]
sub eax, dword [0x1401f7a74]
xor eax, 0xf748f1fa
sub eax, 0x1f448a0b
xor eax, 0xdf5649ce
mov ecx, 0x921a6171
xor ecx, 0xf6cb961f
mov qword [rdx], r8
cmp eax, ecx
jbe 0x1400a08b3
jmp 0x1400a08f3
add rsp, 0x48
ret
sub dword [rdx], eax
retf 0xe98e
Function at 0x1400a1c50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, rcx
mov rcx, qword [rax]
mov qword [rsp + 0x10], rcx
add rax, 8
mov qword [rsp + 0x18], rax
mov rax, qword [0x140219078]
mov qword [rsp + 0x20], rax
xor eax, eax
test rcx, rcx
cmovg rax, rcx
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
mov eax, dword [0x1401f7b40]
mov ecx, 0x35601720
xor ecx, 0xba3eeb09
xor eax, ecx
sub eax, dword [0x1401f7b44]
add eax, 0x7fc88b0d
mov edx, eax
xor edx, 0xffffffff
and edx, 0xa6432672
mov r8d, 0xffffffff
xor r8d, 0xa6432672
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xa6432672
or eax, 0xa6432672
imul eax, edx
add eax, ecx
sub eax, 0xedf854e8
mov ecx, 0x7f0cb531
xor ecx, 0xb6a9b52e
add eax, ecx
add eax, 0xedf854e8
mov ecx, 0x5a02fe9d
xor ecx, 0xd1171879
cmp eax, ecx
jbe 0x1400a1dd4
mov rcx, qword [rsp + 8]
mov eax, dword [0x1401f7b48]
xor edx, edx
div dword [0x1401f7b4c]
add eax, 0xa21ff8fa
mov r8d, 0x4cc57396
xor r8d, 0x65540361
xor edx, edx
div r8d
mov r8d, 0xb1c5ac38
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x28]
cmp rcx, rdx
sete cl
mov byte [rsp + 7], cl
cmp eax, 0x9e2f0c19
je 0x1400a1d0d
mov al, byte [rsp + 7]
test al, 1
jne 0x1400a1dba
jmp 0x1400a1d6d
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x18]
mov rdx, qword [rdx]
mov cl, byte [rcx]
mov dl, byte [rdx + rax + 8]
mov r8, rax
and r8, 1
shl r8, 1
movabs r9, 0x1e7129f9e3088d3e
movabs r10, 0x1e7129f9e3088d3f
xor r9, r10
xor rax, r9
add rax, r8
cmp cl, dl
mov qword [rsp + 0x30], rax
jne 0x1400a1c89
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x10]
cmp rax, rcx
setl al
and al, 1
movzx eax, al
add rsp, 0x38
ret
sub dword [rdx], eax
retf 0xe98e
Function at 0x1400a7220
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x3c], edx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1401f7c70]
xor eax, 0x93471998
mov ecx, dword [0x1401f7c74]
xor ecx, 0xffffffff
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
mov ecx, eax
add ecx, 1
mov edx, 0xc095e3e9
xor edx, 0x3f6a1c16
xor eax, edx
or eax, 0xb60201d3
add eax, ecx
mov ecx, 0x1eef3489
xor ecx, 0xf2f2945f
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
and eax, 0x2f5b1e63
xor ecx, 0x2f5b1e63
or eax, ecx
mov ecx, 0x1a251d88
xor ecx, 0xd53689e2
cmp eax, ecx
ja 0x1400a732b
mov eax, dword [0x1401f7c78]
mov ecx, dword [0x1401f7c7c]
xor ecx, 0x3be62203
xor edx, edx
div ecx
sub eax, 0x792f8506
mov ecx, 0x568494fc
xor ecx, 0x82dd37d9
add eax, ecx
add eax, 0x792f8506
mov ecx, 0x772429ab
xor ecx, 0xa14e6957
sub eax, ecx
mov ecx, 0x9c6e29c2
xor edx, edx
div ecx
mov dword [rsp + 0x24], eax
mov eax, 0x17f8241e
xor eax, 0x1bed6646
mov dword [rsp + 0x20], eax
call fcn.1400a6f74
mov rcx, qword [rsp + 0x40]
mov edx, dword [rsp + 0x3c]
mov r8, qword [rsp + 0x30]
call qword [0x140219170]
mov ecx, dword [rsp + 0x20]
mov rdx, rax
mov eax, dword [rsp + 0x24]
mov qword [rsp + 0x28], rdx
cmp eax, ecx
je 0x1400a729b
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret
or dl, byte [rbx - 0x69]
stc
jmp 0x1400a729b

Function at 0x1400a7790
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov dword [rsp + 0x34], r8d
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1401f7ca0]
xor edx, edx
div dword [0x1401f7ca4]
sub eax, 0xd2fd0ce
sub eax, 0xa6d6eb14
mov ecx, 0xd5f307d1
xor ecx, 0xd8dcd71f
add eax, ecx
add eax, 0x2380889f
mov ecx, 0xb9004869
xor ecx, 0xd8c37342
xor eax, ecx
cmp eax, 0x80393f36
je 0x1400a7856
mov eax, dword [0x1401f7ca8]
xor eax, 0xa3a5fd19
imul eax, dword [0x1401f7cac]
sub eax, 0xafd612b7
sub eax, 0x31e49091
add eax, 0xafd612b7
mov ecx, 0x5d71abed
xor ecx, 0x7d1c318d
xor edx, edx
div ecx
or eax, 0x6950d99d
mov dword [rsp + 0x2c], eax
call fcn.1400a6f74
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov r8d, dword [rsp + 0x34]
call qword [0x140219148]
mov ecx, eax
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x30], ecx
cmp eax, 0xc05d4de0
je 0x1400a77e5
mov eax, dword [rsp + 0x30]
add rsp, 0x48
ret
jo fcn.1400a78a3
jp 0x1400a789e
jmp 0x1400a77e5
invalid
Function at 0x1400ac1f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov ecx, dword [0x1401f7e60]
add ecx, dword [0x1401f7e64]
mov edx, 0xffffffff
xor edx, 0xf15b3417
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0x62f019fe
xor ecx, 0xa129e6d8
or eax, ecx
imul eax, eax, 0x52184897
mov ecx, 0xaef732c2
xor ecx, 0x67b02193
cmp eax, ecx
jae 0x1400ac3e0
mov ecx, dword [0x1401f7e68]
imul ecx, dword [0x1401f7e6c]
mov eax, ecx
and eax, 0xed160506
mov edx, 0xbe2d4b77
xor edx, 0x533b4e71
or ecx, edx
add eax, ecx
or eax, 0x90b76bf1
sub eax, 0x40eb3a05
mov dword [rsp + 0x3c], eax
call fcn.1400ac1cc
mov eax, dword [rsp + 0x3c]
cmp eax, 0x165407a3
jbe 0x1400ac3e0
xor eax, eax
mov qword [rsp + 0x30], rax
jmp 0x1400ac28d
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov ecx, dword [0x1401f7e70]
mov edx, dword [0x1401f7e74]
mov eax, ecx
and eax, eax
xor eax, 0xffffffff
and eax, edx
mov r8d, 0x2ff47bbb
xor r8d, 0xd00b8444
xor eax, r8d
and edx, edx
xor edx, 0xffffffff
and ecx, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
mov edx, 0xbaee9206
xor edx, 0x45116df9
xor ecx, edx
or eax, ecx
mov ecx, 0xd32c676
xor edx, edx
div ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xeee45f7f
mov r8d, 0xffffffff
xor r8d, 0xeee45f7f
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0xedd82641
xor r8d, 0x33c793e
mov edx, eax
and edx, r8d
or eax, 0xeee45f7f
imul eax, edx
add eax, ecx
mov ecx, 0x11eea044
xor ecx, 0x9cbb930e
and eax, ecx
mov ecx, 0x78239f6f
xor ecx, 0xf40a5e86
cmp eax, ecx
jae 0x1400ac3e9
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401f7e78]
mov edx, dword [0x1401f7e7c]
mov r8d, 0x19534d73
xor r8d, 0xe9f6d1f8
xor edx, r8d
add eax, edx
mov edx, 0x53ef1339
xor edx, 0xbfd1bab7
or eax, edx
mov r8d, 0x7aef1dbf
xor edx, edx
div r8d
mov r8d, eax
and r8d, 0x203bfd2e
mov edx, 0x1341c045
xor edx, 0x1341c047
imul edx, r8d
add eax, 0x203bfd2e
sub eax, edx
cmp rcx, 0x10
sete cl
mov byte [rsp + 0x27], cl
cmp eax, 0x800b75d2
je 0x1400ac33d
mov al, byte [rsp + 0x27]
test al, 1
jne 0x1400ac3db
jmp 0x1400ac3bf
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
mov byte [rcx + rax], 0
add rax, 1
mov qword [rsp + 0x30], rax
jmp 0x1400ac28d
add rsp, 0x48
ret
inc dword [rdi + 0x53e947c9]
invalid
invalid