joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140055b60
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x140055c39
mov eax, dword [0x140274af8]
or eax, dword [0x140274afc]
imul eax, eax, 0x1fca14a5
mov edx, 0x763260c0
xor edx, 0x9afe199
mov ecx, eax
and ecx, edx
shl ecx, 1
add eax, 0x7f9d8159
sub eax, ecx
mov ecx, 0x837cfc72
xor ecx, 0xd99f5a3f
xor edx, edx
div ecx
cmp eax, 0x467acbf4
ja 0x140055c3e
mov eax, dword [0x140274b00]
mov ecx, dword [0x140274b04]
mov edx, 0x9a7379dc
xor edx, 0xc95ffeb
xor ecx, edx
sub eax, ecx
mov ecx, 0x7ee9b068
xor ecx, 0x72ed9f7b
xor edx, edx
div ecx
or eax, 0xe8d8392
xor ecx, ecx
sub ecx, 0x93eb431b
add eax, ecx
mov dword [rsp + 0x2c], eax
mov eax, 0xfe4f8621
xor eax, 0xfcb3fe4b
mov dword [rsp + 0x28], eax
mov ecx, dword [0x1402980b0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rcx, 0x68
call fcn.1400190f0
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
je 0x140055bbc
jmp 0x140055c39
add rsp, 0x38
ret
invalid
Function at 0x140059c40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov word [rsp + 0x36], cx
mov eax, dword [0x140274cb0]
mov edx, dword [0x140274cb4]
and eax, eax
mov ecx, 0xe154d733
xor ecx, 0x1eab28cc
xor eax, ecx
mov ecx, edx
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
xor eax, 0xffffffff
mov edx, 0x4f993889
xor edx, 0xb066c776
xor ecx, edx
or eax, ecx
sub eax, 0x87066a33
add eax, 0xeeb24e96
add eax, 0x87066a33
mov ecx, 0x6064d46e
xor edx, edx
div ecx
mov ecx, 0x26929c0e
xor ecx, 0x739fef80
xor edx, edx
div ecx
cmp eax, 0xa1dbedb3
jae 0x140059f12
mov eax, dword [0x140274cb8]
mov edx, dword [0x140274cbc]
xor edx, 0x46e54a45
xor ecx, ecx
sub ecx, edx
add eax, ecx
and eax, 0x95052921
mov edx, eax
xor edx, 0xffffffff
and edx, 0xe2c0ffc1
mov r8d, 0xffffffff
xor r8d, 0xe2c0ffc1
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xe2c0ffc1
or eax, 0xe2c0ffc1
imul eax, edx
add eax, ecx
mov ecx, eax
and ecx, 0xf76d8764
shl ecx, 1
mov edx, 0x32df83ae
xor edx, 0xc5b204ca
xor eax, edx
add eax, ecx
mov dword [rsp + 0x30], eax
mov eax, 0xfea9feec
xor eax, 0xbc984b2a
mov dword [rsp + 0x2c], eax
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov ecx, dword [rsp + 0x2c]
mov rdx, rax
mov eax, dword [rsp + 0x30]
cmp byte [rdx + 0x60], 0
sete dl
mov byte [rsp + 0x35], dl
cmp eax, ecx
je 0x140059f12
mov ax, word [rsp + 0x36]
mov cl, byte [rsp + 0x35]
test cl, 1
mov word [rsp + 0x2a], ax
jne 0x140059d75
jmp 0x140059f08
mov eax, dword [0x140274cc0]
mov ecx, dword [0x140274cc4]
xor ecx, 0x2efe431e
sub eax, ecx
mov ecx, 0xc33022e3
xor ecx, 0xc4ead115
sub eax, ecx
add eax, 0xc92a42a3
add eax, 0x5cd27396
sub eax, 0xc92a42a3
or eax, 0xaa610b81
cmp eax, 0x4438f8ae
je 0x140059f1b
mov cx, word [rsp + 0x36]
mov eax, dword [0x140274cc8]
sub eax, dword [0x140274ccc]
add eax, 0xef8deb71
sub eax, 0xe5c74482
xor eax, 0xb77f759a
mov r8w, cx
shl r8w, 1
mov dx, r8w
xor dx, 0xffff
xor r8w, 0xffff
and dx, r8w
mov r8w, 0xaaaa
or r8w, 0xaaaa
xor r8w, 0xffff
or dx, r8w
xor dx, 0xffff
shr cx, 1
mov r8w, cx
add r8w, 1
mov r9w, 0x2ebf
xor r9w, 0xd140
xor cx, r9w
or cx, 0x5555
add cx, r8w
or dx, cx
mov r8w, dx
shl r8w, 2
and r8w, 0xcccc
shr dx, 2
xor dx, 0xffff
mov r9w, 0xffff
xor r9w, 0x3333
mov cx, 0xffff
xor cx, 0x7c90
or dx, r9w
or cx, 0x7c90
mov r9w, 0x383e
xor r9w, 0xc7c1
xor dx, r9w
and dx, cx
mov cx, dx
and cx, r8w
xor cx, 0xffff
add r8w, dx
add r8w, 1
add r8w, cx
mov dx, r8w
shl dx, 4
xor dx, 0xffff
mov r9w, 0xffff
xor r9w, 0xf0f0
mov cx, 0x4ca0
xor cx, 0x4e9b
mov r10w, 0xddb4
xor r10w, 0x224b
xor cx, r10w
or dx, r9w
or cx, 0x23b
xor dx, 0xffff
and dx, cx
shr r8w, 4
and r8w, 0xf0f
mov cx, dx
and cx, r8w
xor dx, r8w
or cx, dx
rol cx, 8
mov word [rsp + 0x28], cx
cmp eax, 0x11a5dd4c
jbe 0x140059db5
jmp qword [rsi + 0x41]
mov ax, word [rsp + 0x28]
mov word [rsp + 0x2a], ax
jmp 0x140059f08
mov ax, word [rsp + 0x2a]
add rsp, 0x38
ret
je 0x140059e9d
sub dword [rbx - 0x26817], esi
invalid
in al, dx
add al, 0xd3
jmp 0x140059db5
Function at 0x140064750
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov byte [rbp - 9], dl
mov qword [rbp - 8], rcx
mov r11d, dword [0x140275170]
mov eax, dword [0x140275174]
xor eax, 0xffffffff
add r11d, eax
add r11d, 1
add r11d, 0x5cd27396
mov ecx, r11d
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xaa610b81
mov r8d, 0x94342128
xor r8d, 0x13324b1b
mov eax, 0xc23461cf
xor eax, 0x3dcb9e30
xor r8d, eax
mov eax, ecx
and eax, 0x87066a33
and r11d, r8d
mov r10d, 0xf0658a4a
xor r10d, 0x7763e079
mov r9d, edx
and r9d, r10d
mov r10d, 0x15f1537a
xor r10d, 0xbf9058fb
and r10d, r8d
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, edx
mov edx, 0xe7980351
xor edx, 0x1867fcae
xor ecx, edx
mov edx, 0x602e2648
xor edx, 0xe7284c7b
or edx, r8d
and ecx, edx
or eax, ecx
mov ecx, 0xfede779b
xor ecx, 0xb7ce1cdf
xor edx, edx
div ecx
cmp eax, 0xce89f1e5
je 0x140064917
mov edx, dword [0x140275178]
xor edx, 0xbcb47621
mov eax, dword [str.Z_bW_M_jp]
xor eax, 0xd4dae32b
mov ecx, eax
mov eax, edx
lea eax, [rax + rcx + 0x1a38bb7e]
xor eax, 0xb77f759a
add eax, 0x72d2aa32
mov dword [rbp - 0x10], eax
mov eax, 0x20
call fcn.140271bb0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov rax, qword [0x14028d330]
mov qword [rbp - 0x28], rax
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000efc9
add rsp, 0x20
mov rax, qword [rbp - 0x28]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000efc9
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x20
mov al, byte [rbp - 9]
xorps xmm0, xmm0
movaps xmmword [rcx], xmm0
movaps xmmword [rcx + 0x10], xmm0
mov r8b, 0xfb
xor r8b, 4
mov cl, al
xor cl, r8b
mov r8b, 0xbb
xor r8b, 0xbc
mov r9b, 0x44
xor r9b, 0xbb
xor r8b, r9b
or cl, r8b
mov r8b, al
xor r8b, 0xff
mov r9b, 0xff
xor r9b, 7
or r8b, r9b
and cl, r8b
xor cl, 0xff
mov r8b, 1
shl r8b, cl
mov cl, 0x41
xor cl, 0x42
shr al, cl
mov rcx, qword [rbp - 8]
movzx eax, al
or r8b, byte [rdx + rax]
mov byte [rdx + rax], r8b
sub rsp, 0x20
call fcn.1400644a0
mov eax, dword [rbp - 0x10]
add rsp, 0x20
cmp eax, 0xf368e88e
jbe 0x14006481b
mov rsp, rbp
pop rbp
ret
scasb al, byte [rdi]
clc
cmp byte [rcx + rbp*8 - 5], al
invalid
Function at 0x140068230
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbx
sub rsp, 0x60
mov qword [rsp + 0x30], rcx
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
movabs rax, 0x24fcba16ed58492c
movabs rdx, 0x24fcba16ed58492c
xor rax, rdx
mov qword [rsp + 0x58], rax
mov rax, qword [rcx]
mov qword [rsp + 0x48], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x58]
xor eax, eax
mov r8d, eax
call fcn.14005c4df
mov rcx, rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rcx
mov al, byte [rax + 0x60]
mov cl, 0x36
xor cl, 0x36
cmp al, cl
jne 0x14006845e
mov eax, dword [0x1402752d0]
mov ecx, dword [0x1402752d4]
xor ecx, 0xee38691f
and eax, ecx
mov ecx, 0x81b55898
xor ecx, 0xae71f338
imul eax, ecx
xor ecx, ecx
sub ecx, 0x8396d796
sub eax, ecx
imul eax, eax, 0x6f52b166
mov ecx, 0x501e51aa
xor ecx, 0xc55adb3b
cmp eax, ecx
ja 0x140068469
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x1402752d8]
xor edx, edx
div dword [0x1402752dc]
mov rdx, qword [rsp + 0x30]
mov r8d, eax
mov r10d, 0xffffffff
xor r10d, 0x82144f08
mov r9d, r8d
and r9d, r10d
mov eax, r8d
or eax, r10d
xor eax, 0xffffffff
imul eax, r9d
mov r10d, 0x9f7feb08
xor r10d, 0x1d6ba400
mov r9d, r8d
and r9d, r10d
or r8d, 0x82144f08
imul r8d, r9d
add r8d, eax
mov eax, r8d
and eax, 0x2ad4de38
xor r8d, 0x2ad4de38
or eax, r8d
and eax, 0x7359b6ea
cmp rcx, qword [rdx]
setne r11b
movabs rdx, 0xd03e81b477cadf65
movabs r8, 0xd03e81b477cadf65
xor rdx, r8
cmp rcx, rdx
sete bl
mov dl, bl
xor dl, 0xff
mov r9b, r11b
xor r9b, 0xff
mov r8b, 1
xor r8b, 1
mov r10b, 1
xor r10b, 0
mov cl, dl
and cl, r10b
and bl, r8b
mov r10b, r9b
and r10b, 0xff
and r11b, r8b
or cl, bl
or r10b, r11b
xor cl, r10b
or dl, r9b
xor r9d, r9d
xor r9b, 1
xor dl, r9b
or r8b, 1
and dl, r8b
or cl, dl
mov byte [rsp + 0x2f], cl
cmp eax, 0xb90dbd0a
ja 0x1400682f5
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1400683f6
jmp 0x14006845e
mov ecx, 0x40
mov edx, 8
call fcn.140029060
mov rcx, rax
mov rax, qword [0x14028d010]
mov qword [rcx], rax
lea rax, [0x140284b10]
mov qword [rcx + 0x10], rax
mov rax, qword [0x140284b48]
mov qword [rcx + 0x18], rax
mov rax, qword [str.XK__]
mov qword [rcx + 0x20], rax
mov qword [rcx + 8], 0
lea rdx, [0x140284b10]
lea r8, [0x140284b1b]
lea r9, [0x140284b24]
mov qword [rsp + 0x20], 0x7ed6097a
call fcn.140028fa8
mov rax, qword [rsp + 0x58]
add rsp, 0x60
pop rbx
ret
mov edi, 0xe970e57b
cmp esi, 0xffffffff
jmp qword [rsi + 0x66]

Function at 0x1400691b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x358
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1e8], r9
mov qword [rbp + 0x240], r8
mov qword [rbp + 0x1f0], rdx
mov qword [rbp + 0x238], rcx
Function at 0x1400748e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x68], rcx
mov rax, qword [rcx]
mov qword [rsp + 0x70], rax
cmp rax, 0
jle 0x1400749f6
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x68]
add rax, 8
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx]
add rcx, 8
shl rdx, 5
add rcx, rdx
add rcx, 0x10
mov rcx, qword [rcx]
mov qword [rsp + 0x40], rcx
cmp rcx, 0
mov qword [rsp + 0x48], rax
je 0x1400749d5
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
movabs r8, 0x4000000000000000
mov rcx, rdx
and rcx, r8
xor rcx, 0xffffffffffffffff
movabs r8, 0x4000000000000000
and rdx, r8
xor rdx, 0xffffffffffffffff
movabs r8, 0x5a541c3ba5002f99
movabs r9, 0xa5abe3c45affd066
xor r8, r9
xor rcx, r8
xor rdx, 0xffffffffffffffff
or rcx, rdx
cmp rcx, 0
mov qword [rsp + 0x48], rax
jne 0x1400749d5
mov rcx, qword [rsp + 0x40]
call fcn.14001d1d6
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
add rax, 1
cmp rax, rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
jl 0x14007491a
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp rax, 0
je 0x140074a1d
mov rcx, qword [rsp + 0x28]
mov edx, 8
call fcn.14001d203
mov r8d, dword [0x140275750]
sub r8d, dword [0x140275754]
mov eax, 0x9aada945
xor eax, 0x655256ba
mov ecx, r8d
xor ecx, eax
and ecx, 0x7fe3c5db
mov edx, 0xffffffff
xor edx, 0x7fe3c5db
and r8d, edx
mov eax, 0xcd1fe11d
xor eax, 0xb8bc7d8f
mov r9d, 0xfa420dd6
xor r9d, 0x5bdf229
xor eax, r9d
and eax, 0x7fe3c5db
and edx, 0x75a39c92
or ecx, r8d
or eax, edx
xor ecx, eax
mov eax, ecx
and eax, 0x8324c914
xor ecx, 0x8324c914
or eax, ecx
sub eax, 0x95c2359
cmp eax, 0x47fcd202
jbe 0x140074aeb
mov eax, dword [0x140275758]
mov ecx, dword [0x14027575c]
xor ecx, 0x262afb04
xor edx, edx
div ecx
mov ecx, 0xa298e2a0
xor ecx, 0x9bd01a51
add eax, ecx
xor ecx, ecx
sub ecx, 0x182b72a3
add eax, ecx
mov ecx, 0x1e3f1409
xor ecx, 0xf917d8af
or eax, ecx
mov ecx, 0x7b51c2f2
xor ecx, 0x4a0b0792
cmp eax, ecx
jbe 0x140074a99
add rsp, 0x78
ret
cmp dword [rbp - 0x5a16b78c], ebp
invalid
Function at 0x140084180
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x218
mov qword [rsp + 0x1b8], r8
mov qword [rsp + 0x1c0], rdx
mov qword [rsp + 0x1c8], rcx
mov rax, qword [0x14028d330]
Function at 0x14008a4f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov word [rbp - 0xa], dx
mov qword [rbp - 8], rcx
mov eax, dword [0x140276080]
or eax, dword [0x140276084]
mov r8d, 0xffffffff
xor r8d, 0x1348015a
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0x60a29772
xor r8d, 0x73ea9628
mov edx, eax
and edx, r8d
mov r8d, 0x9810806f
xor r8d, 0x8b588135
or eax, r8d
imul eax, edx
add eax, ecx
or eax, 0xf87a19d7
mov edx, eax
and edx, 0x48764eb5
mov ecx, 0xc7e6de50
xor ecx, 0xc7e6de52
imul ecx, edx
add eax, 0x48764eb5
sub eax, ecx
cmp eax, 0xa0d97672
jbe 0x14008a64b
mov ecx, dword [0x140276088]
mov eax, dword [0x14027608c]
xor eax, ecx
xor eax, 0xafa568e6
and eax, ecx
mov ecx, eax
xor ecx, 0x128054c
or eax, 0xfed7fab3
and eax, ecx
mov ecx, eax
xor ecx, 0x1f26181a
and eax, 0xd9e7e5
add eax, eax
sub eax, ecx
or eax, 0xecaaf6ef
mov dword [rbp - 0x10], eax
mov eax, 0x20
call fcn.140271bb0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000efc9
add rsp, 0x20
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.14000efc9
mov rcx, qword [rbp - 0x18]
mov dx, word [rbp - 0xa]
add rsp, 0x20
mov rax, qword [rbp - 8]
mov r8, qword [rax]
mov qword [rcx], r8
mov r8, qword [rax + 8]
mov qword [rcx + 8], r8
mov rax, qword [rax + 0x10]
mov qword [rcx + 0x10], rax
sub rsp, 0x20
call fcn.14008a070
add rsp, 0x20
mov cl, al
mov eax, dword [rbp - 0x10]
mov byte [rbp - 0xb], cl
cmp eax, 0x13b72cc0
jb 0x14008a57f
mov al, byte [rbp - 0xb]
and al, 1
movzx eax, al
mov rsp, rbp
pop rbp
ret
cld
invalid
Function at 0x1400913d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x140091589
mov eax, dword [0x140276358]
xor eax, dword [0x14027635c]
imul eax, eax, 0x41e5eb97
xor eax, 0x22a2f494
mov ecx, 0xd54dfa53
xor edx, edx
div ecx
cmp eax, 0x6c9d84df
jae 0x14009158e
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x140276360]
xor edx, edx
div dword [0x140276364]
mov r8d, 0x3025e363
xor edx, edx
div r8d
mov r8d, 0xcb46ea27
xor r8d, 0x2463a1ab
xor edx, edx
div r8d
mov r8d, 0x832ebbd7
xor edx, edx
div r8d
mov rcx, qword [rcx]
xor rcx, 0xffffffffffffffff
movabs r8, 0x6530ba04e2bc71c6
movabs rdx, 0x2530ba04e2bc71c6
xor r8, rdx
movabs rdx, 0x7bb754c850b929a2
movabs r9, 0x8448ab37af46d65d
xor rdx, r9
xor r8, rdx
mov rdx, 0xffffffffffffffff
movabs r9, 0x60db7b194585ca54
xor rdx, r9
or rcx, r8
movabs r8, 0x60db7b194585ca54
or rdx, r8
xor rcx, 0xffffffffffffffff
and rcx, rdx
movabs rdx, 0xadecc93931e39217
movabs r8, 0xadecc93931e39217
xor rdx, r8
cmp rcx, rdx
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0xe267e488
jae 0x140091412
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x1400914ed
jmp 0x140091589
mov eax, dword [0x140276368]
add eax, dword [0x14027636c]
mov ecx, 0x4444d68c
xor edx, edx
div ecx
mov ecx, 0x56186ea8
xor ecx, 0x37cada3e
sub eax, ecx
mov ecx, 0xffffffff
xor ecx, 0xa56c4c7f
add eax, ecx
add eax, 1
cmp eax, 0xecb6fd1a
jb 0x140091597
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x140276370]
mov edx, 0xf79faf83
xor edx, 0xb96a652a
xor eax, edx
and eax, dword [0x140276374]
and eax, 0xc70bc0c5
sub eax, 0x7dc8488a
mov r8d, 0x9667c455
xor edx, edx
div r8d
mov dword [rsp + 0x28], eax
mov eax, 0xd512a1f1
xor eax, 0xab45aeed
mov dword [rsp + 0x24], eax
call fcn.14001d1d6
mov ecx, dword [rsp + 0x24]
mov eax, dword [rsp + 0x28]
cmp eax, ecx
jae 0x14009152a
jmp 0x140091589
add rsp, 0x38
ret
cmp byte [rbx - 0x7e], bh
jmp 0x140091412
sbb dword [rbx], edx
invalid
Function at 0x140091770
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
mov rax, qword [rcx + 8]
mov qword [rsp + 0x40], rax
cmp rax, 0
je 0x140091818
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
mov rax, rcx
xor rax, 0xffffffffffffffff
xor rcx, 0xffffffffffffffff
and rax, rcx
mov rcx, 0xffffffffffffffff
movabs rdx, 0x4000000000000000
xor rcx, rdx
mov rdx, 0xffffffffffffffff
movabs r8, 0x4000000000000000
xor rdx, r8
and rcx, rdx
xor rax, 0xffffffffffffffff
movabs rdx, 0x7636029b88c68d51
movabs r8, 0x89c9fd64773972ae
xor rdx, r8
xor rcx, rdx
and rax, rcx
movabs rcx, 0x76a4c0b5390b87a9
movabs rdx, 0x76a4c0b5390b87a9
xor rcx, rdx
cmp rax, rcx
jne 0x140091818
mov rcx, qword [rsp + 0x40]
call fcn.14001d1d6
mov eax, dword [0x140276388]
and eax, dword [0x14027638c]
add eax, 0x6a2b05d9
add eax, 0x5e06b32d
sub eax, 0x4216422b
sub eax, 0x5e06b32d
mov ecx, 0x725e91e2
xor edx, edx
div ecx
cmp eax, 0x974a822e
je 0x1400918f1
mov rdx, qword [rsp + 0x38]
mov eax, dword [0x140276390]
imul eax, dword [0x140276394]
and eax, 0x748c942b
mov ecx, 0x69ece9e2
xor ecx, 0x60d7094f
sub eax, ecx
mov ecx, eax
and ecx, 0x66c2b0ff
shl ecx, 1
mov r8d, 0x37db5c12
xor r8d, 0x5119eced
add eax, r8d
sub eax, ecx
mov ecx, 0x301c3141
xor ecx, 0x6198e549
mov rdx, qword [rdx + 0x18]
mov qword [rsp + 0x28], rdx
cmp rdx, 0
sete dl
mov byte [rsp + 0x37], dl
cmp eax, ecx
ja 0x14009184c
mov al, byte [rsp + 0x37]
test al, 1
jne 0x1400918eb
jmp 0x1400918c5
mov rcx, qword [rsp + 0x28]
movabs rax, 0x4000000000000000
and rax, qword [rcx]
cmp rax, 0
jne 0x1400918eb
mov rcx, qword [rsp + 0x28]
call fcn.14001d1d6
nop
add rsp, 0x48
ret
movabs dword [0xffffff52e95c0fd6], eax

Function at 0x140092080
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x18], rcx
mov eax, 0x10
call fcn.140271bb0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
mov rdx, qword [rdx]
sub rsp, 0x20
call fcn.14003c04b
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
cmp qword [rcx], 0
jle 0x1400921c3
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x18]
add rcx, 8
mov qword [rbp - 0x40], rcx
add rax, 8
mov qword [rbp - 0x38], rax
xor eax, eax
mov qword [rbp - 0x30], rax
Function at 0x1400921d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x60], rcx
cmp qword [rcx], 0
jle 0x14009230e
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x30], rdx
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov rcx, rax
add rcx, 8
shl rdx, 5
add rcx, rdx
add rcx, 8
mov rcx, qword [rcx]
mov qword [rsp + 0x40], rcx
cmp rcx, 0
mov qword [rsp + 0x48], rax
je 0x140092275
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
movabs rcx, 0x4000000000000000
and rcx, qword [rdx]
cmp rcx, 0
mov qword [rsp + 0x48], rax
jne 0x140092275
mov rcx, qword [rsp + 0x40]
call fcn.14001d1d6
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
add rax, 8
shl rcx, 5
add rax, rcx
add rax, 0x18
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
cmp rax, 0
je 0x1400922f2
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
movabs rdx, 0x4000000000000000
mov rax, rcx
and rax, rdx
xor rax, 0xffffffffffffffff
xor rcx, 0xffffffffffffffff
mov rdx, 0xffffffffffffffff
movabs r8, 0x4000000000000000
xor rdx, r8
or rcx, rdx
and rax, rcx
xor rax, 0xffffffffffffffff
cmp rax, 0
jne 0x1400922f2
mov rcx, qword [rsp + 0x28]
call fcn.14001d1d6
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x30]
add rax, 1
cmp rax, qword [rcx]
mov qword [rsp + 0x58], rax
jl 0x1400921f8
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp rax, 0
je 0x140092335
mov rcx, qword [rsp + 0x20]
mov edx, 8
call fcn.14001d203
mov eax, dword [0x1402763a8]
mov ecx, dword [0x1402763ac]
xor ecx, 0xffffffff
add eax, ecx
add eax, 1
mov ecx, eax
xor ecx, 0xb1c96533
mov edx, 0xffffffff
xor edx, 0xb1c96533
and eax, edx
shl eax, 1
sub eax, ecx
and eax, 0x95052921
mov edx, eax
xor edx, 0xffffffff
and edx, 0xe2c0ffc1
mov r8d, 0xffffffff
xor r8d, 0xe2c0ffc1
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xe2c0ffc1
or eax, 0xe2c0ffc1
imul eax, edx
add eax, ecx
cmp eax, 0xa2ee3ac9
ja 0x140092404
mov eax, dword [0x1402763b0]
sub eax, dword [0x1402763b4]
mov ecx, 0x32df83ae
xor ecx, 0x50145828
mov edx, 0x89828f77
xor edx, 0x767d7088
xor ecx, edx
add eax, ecx
mov ecx, 0xfea9feec
xor ecx, 0xfea9feed
add eax, ecx
sub eax, 0x7daf3f6
sub eax, 0x87066a33
add eax, 0x5cd27396
add eax, 0x87066a33
mov ecx, 0x2efe431e
rcr byte [rbp + rax + 0x33], cl
push 6
xchg dword [rcx + 0x2efe431e], edi
xor ecx, 0x81dd5caf
cmp eax, ecx
jb 0x1400923a5
add rsp, 0x68
ret
ja 0x1400923e5
invalid
Function at 0x14009f540
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
add rax, 0x60
mov qword [rsp + 0x48], rax
mov qword [rcx], 0
mov qword [rcx + 8], 0
mov ecx, 8
call fcn.14009ced4
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov al, 1
cmp byte [rcx + 0x60], 0
mov byte [rsp + 0x67], al
jne 0x14009f609
mov rax, qword [0x14028d330]
mov ecx, dword [rax]
call fcn.14000efc9
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x30]
call fcn.14009f4ae
mov rcx, qword [rsp + 0x48]
mov al, 1
cmp byte [rcx], 0
mov byte [rsp + 0x67], al
jne 0x14009f609
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax + 0x58]
mov qword [rsp + 0x68], rdx
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x68]
call fcn.1400344e0
mov rax, qword [rsp + 0x48]
mov al, byte [rax]
mov byte [rsp + 0x67], al
mov al, byte [rsp + 0x67]
mov byte [rsp + 0x2f], al
mov eax, dword [0x140276a48]
xor edx, edx
div dword [0x140276a4c]
mov ecx, 0x3de88f57
xor edx, edx
div ecx
mov r8d, eax
mov eax, r8d
xor eax, 0xffffffff
and eax, 0xf4eb52f4
mov r9d, 0xffffffff
xor r9d, 0xf4eb52f4
and r8d, r9d
mov ecx, 0x54a724a
xor ecx, 0x48b7b164
mov edx, 0x576fdfbf
xor edx, 0xa8902040
xor ecx, edx
and ecx, 0xf4eb52f4
mov edx, 0x18052e64
xor edx, 0x55f8ed4a
and edx, r9d
or eax, r8d
or ecx, edx
xor eax, ecx
mov ecx, 0x4c033fbc
xor edx, edx
div ecx
cmp eax, 0x5ee4ac8d
jae 0x14009f756
mov rcx, qword [rsp + 0x58]
mov eax, dword [0x140276a50]
xor edx, edx
div dword [0x140276a54]
mov r8d, eax
mov rax, qword [rsp + 0x48]
mov edx, r8d
and edx, 0xc587a00b
shl edx, 1
mov r9d, 0xe7f29063
xor r9d, 0x22753068
add r8d, r9d
sub r8d, edx
mov edx, r8d
and edx, 0x2cedf80
mov r9d, 0x8c24bbba
xor r9d, 0x8eea643a
or r8d, r9d
add edx, r8d
sub edx, 0xd9767015
mov dword [rsp + 0x28], edx
mov edx, 0xd69ec313
xor edx, 0x7e28c44b
mov dword [rsp + 0x24], edx
mov dl, 0xcf
xor dl, 0xcf
mov byte [rax], dl
call fcn.14009c9a0
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x24]
mov eax, dword [rsp + 0x28]
mov dl, byte [rdx]
mov r8b, 0x36
xor r8b, 0x36
cmp dl, r8b
sete dl
mov byte [rsp + 0x2e], dl
cmp eax, ecx
jb 0x14009f68d
mov al, byte [rsp + 0x2e]
test al, 1
jne 0x14009f741
jmp 0x14009f74c
mov rax, qword [rsp + 0x48]
mov cl, byte [rsp + 0x2f]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
add rsp, 0x78
ret
test eax, esp
cmp bl, byte [rbx - 0xd117]
dec dword [rax - 0x7d]
sub rsp, 0x38
mov qword [rsp + 0x28], rcx