joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140074a80
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
call fcn.14006b577
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
call fcn.14003760f
mov cl, al
mov rax, qword [rsp + 0x48]
mov byte [rsp + 0x57], cl
cmp byte [rax], 0
jne 0x140074c10
mov al, byte [rsp + 0x57]
xor ecx, ecx
xor cl, 0xc0
cmp al, cl
jne 0x140074ad6
mov rcx, qword [rsp + 0x40]
call fcn.14006faf0
jmp 0x140074c10
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
cmp rax, 0
mov qword [rsp + 0x30], rax
jne 0x140074c01
mov eax, dword [0x1402038d8]
xor eax, 0xdfb0015e
xor eax, dword [0x1402038dc]
imul ecx, eax, 0x91cc7b9e
mov eax, 0xe7ac4647
xor eax, 0x4290b3d6
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x64bb57a5
or eax, edx
mov edx, 0x6638aa8e
xor edx, 0x99c75571
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0x64bb57a5
or ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
cmp eax, 0x31c608cd
ja 0x140074c16
mov eax, dword [0x1402038e0]
xor eax, 0x413ee36d
add eax, dword [0x1402038e4]
mov edx, 0xf705b381
xor edx, 0xb30edf61
mov ecx, 0x2dd6506
xor ecx, 0xfd229af9
xor edx, ecx
mov ecx, eax
xor ecx, edx
and ecx, eax
add ecx, 0x7001794b
mov eax, ecx
and eax, 0xf6dae89a
mov edx, 0x33e7418a
xor edx, 0xc53da910
or ecx, edx
add eax, ecx
mov dword [rsp + 0x28], eax
mov eax, 0x8a12bffe
xor eax, 0x302fc715
mov dword [rsp + 0x24], eax
xor eax, eax
mov ecx, eax
call fcn.1400f3a70
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x24]
mov eax, dword [rsp + 0x28]
cmp byte [rdx], 0
sete dl
mov byte [rsp + 0x2f], dl
cmp eax, ecx
je 0x140074b4f
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x140074be5
jmp 0x140074c10
mov ecx, 0x38
mov edx, 8
call fcn.140014320
mov rcx, qword [rsp + 0x38]
mov qword [rcx], rax
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
call fcn.140074980
nop
add rsp, 0x58
ret
cwde
or eax, 0x30e94f9d
invalid
Function at 0x140075af7
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
call fcn.14006b577
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
call fcn.14003760f
mov cl, al
mov rax, qword [rsp + 0x48]
mov byte [rsp + 0x57], cl
cmp byte [rax], 0
jne 0x140075ae8
mov al, byte [rsp + 0x57]
cmp al, 0xc0
jne 0x140075991
mov rcx, qword [rsp + 0x40]
call fcn.14006faf0
jmp 0x140075ae8
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
cmp rax, 0
mov qword [rsp + 0x30], rax
jne 0x140075ad9
mov r11d, dword [0x140203958]
mov eax, dword [0x14020395c]
xor eax, 0x4a76c33b
imul r11d, eax
mov eax, 0x5e9a49e4
xor eax, 0xa165b61b
mov ecx, r11d
xor ecx, eax
mov edx, 0x4d8f8e69
xor edx, 0x6c3e81e9
mov eax, 0xd2c1381e
xor eax, 0x2d3ec7e1
xor edx, eax
mov r8d, 0xffffffff
xor r8d, 0xbe94c887
mov r9d, 0x24201e3e
xor r9d, 0x9ab4d6b9
mov eax, ecx
and eax, r9d
and r11d, r8d
mov r9d, edx
and r9d, 0xbe94c887
mov r10d, r8d
and r10d, 0x21b10f80
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, edx
xor ecx, 0xffffffff
mov edx, 0x307384b6
xor edx, 0x8ee74c31
or edx, r8d
and ecx, edx
or eax, ecx
mov ecx, 0x8db013f8
xor edx, edx
div ecx
mov ecx, 0x8bf388c2
xor edx, edx
div ecx
cmp eax, 0xd56cd270
jae 0x140075aee
mov eax, dword [0x140203960]
imul eax, dword [0x140203964]
add eax, 0xad54fd62
add eax, 0x2f753e4
sub eax, 0xad54fd62
xor eax, 0x8e4df160
mov ecx, 0xa7a6bdfe
xor edx, edx
div ecx
mov dword [rsp + 0x28], eax
xor eax, eax
mov ecx, eax
call fcn.1400f4d7f
mov rcx, qword [rsp + 0x48]
mov eax, dword [rsp + 0x28]
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0x546c6b8
jae 0x140075a57
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x140075abd
jmp 0x140075ae8
mov ecx, 0x10
mov edx, 8
call fcn.140014320
mov rcx, qword [rsp + 0x38]
mov qword [rcx], rax
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
call fcn.14007590d
nop
add rsp, 0x58
ret
fldenv [rcx + 0x60e94858]
invalid
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006b577
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x140075940
Function at 0x140076b50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
call fcn.14006b577
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov edx, 3
call fcn.14006bf90
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140076cbc
mov ecx, dword [0x140203a08]
xor ecx, 0x982a6f56
mov edx, dword [0x140203a0c]
mov eax, edx
and eax, ecx
mov r8d, 0xdc068ba4
xor r8d, 0x23f9745b
xor eax, r8d
add ecx, edx
add ecx, 1
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x2980d58b
or ecx, 0x2980d58b
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
imul eax, eax, 0x9998f397
mov ecx, 0xde036c11
xor ecx, 0x7396d721
add eax, ecx
cmp eax, 0xbf4b2a46
ja 0x140076cc2
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x140203a10]
mov r8d, dword [0x140203a14]
xor edx, edx
sub edx, r8d
sub eax, edx
and eax, 0xae057d23
add eax, 0x47b44e14
mov r8d, 0xed61b189
xor edx, edx
div r8d
mov edx, eax
mov rax, qword [rsp + 0x30]
mov dword [rsp + 0x28], edx
mov edx, 0xf0fa3506
xor edx, 0x96004b82
mov dword [rsp + 0x24], edx
mov rdx, qword [rax]
call fcn.140076a10
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x24]
mov eax, dword [rsp + 0x28]
mov dl, byte [rdx]
mov r8b, 0x50
xor r8b, 0x50
cmp dl, r8b
sete dl
mov byte [rsp + 0x2f], dl
cmp eax, ecx
je 0x140076bed
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x140076c76
jmp 0x140076cbc
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax + 8]
mov qword [rsp + 0x48], rdx
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
call fcn.14006cfd9
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140076cbc
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov edx, dword [rax + 0x18]
call fcn.14006c75a
nop
add rsp, 0x58
ret
iretd
Function at 0x1400777b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x140203a78]
mov r8d, dword [0x140203a7c]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov ecx, 0x17e8378f
xor ecx, 0xe817c870
mov r9d, r8d
xor r9d, ecx
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x4d2763ca
xor ecx, 0xc13ddc47
or eax, ecx
sub eax, 0x5f02ef2
add eax, 0x76314064
mov ecx, 0x4446b748
xor ecx, 0x41b699ba
add eax, ecx
mov ecx, 0xde6ffddc
xor ecx, 0x886740e0
xor eax, ecx
cmp eax, 0xbca08e6f
je 0x140077916
mov edx, dword [0x140203a80]
mov eax, dword [0x140203a84]
or edx, eax
mov eax, edx
and eax, 0x3d84c9b3
xor edx, 0xbd84c9b3
mov ecx, eax
mov eax, edx
lea eax, [rax + rcx*2]
imul eax, eax, 0xf90fe554
mov ecx, eax
xor ecx, 0x120baf12
and eax, 0x6df450ec
add eax, eax
sub eax, ecx
mov dword [rbp - 0x18], eax
mov eax, 0x48722126
mov dword [rbp - 0x1c], eax
mov eax, 0x20
call fcn.1401ffc50
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.14006b577
mov rdx, qword [rbp - 0x10]
mov ecx, dword [rbp - 0x1c]
add rsp, 0x20
mov eax, dword [rbp - 0x18]
cmp rdx, 0
sete dl
mov byte [rbp - 0x11], dl
cmp eax, ecx
je 0x14007783b
mov al, byte [rbp - 0x11]
test al, 1
jne 0x1400778cc
jmp 0x1400778e2
mov rcx, qword [rbp - 8]
sub rsp, 0x20
call fcn.14006b98c
add rsp, 0x20
jmp 0x140077911
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax]
mov qword [rdx], r8
mov r8, qword [rax + 8]
mov qword [rdx + 8], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 0x10], rax
sub rsp, 0x20
call fcn.140077630
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
movabs byte [0xffffff1ce912301c], al
nop

Function at 0x140077920
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov ecx, dword [0x140203a88]
xor ecx, dword [0x140203a8c]
mov eax, ecx
and eax, 0x8541e20
xor ecx, 0x8541e20
or eax, ecx
and eax, 0xea42ef3b
sub eax, 0x64cdb4f8
sub eax, 0xdede929a
add eax, 0x64cdb4f8
cmp eax, 0xf66ccf21
je 0x1400779f6
mov eax, dword [0x140203a90]
xor edx, edx
div dword [0x140203a94]
mov ecx, 0x336cf261
xor edx, edx
div ecx
or eax, 0x6051f3be
mov ecx, 0x782cb184
xor ecx, 0x15f4d881
mov edx, 0xe16113bb
xor edx, 0x1e9eec44
xor ecx, edx
mov edx, 0x277d3ea4
xor edx, 0x277d3ea4
mov r8d, 0xd2d507c1
xor r8d, 0xd2d507c0
sub edx, r8d
sub ecx, edx
sub eax, ecx
mov dword [rsp + 0x24], eax
mov eax, 0x27358f16
xor eax, 0x9304ef4e
mov dword [rsp + 0x20], eax
call fcn.14006b577
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
call fcn.1400777b0
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
jbe 0x140077968
add rsp, 0x38
ret
rcl dword [rcx + 0x12], cl
cmc
jmp 0x140077968
Function at 0x1400799d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x140203bd8]
mov ecx, dword [0x140203bdc]
xor ecx, 0x9ecf932d
xor edx, edx
div ecx
mov ecx, 0x6309d043
xor ecx, 0x9f7a99dc
mov edx, 0x675fb40
xor edx, 0xf98a04bf
xor ecx, edx
add eax, ecx
mov ecx, 0x209fcfc8
xor ecx, 0x209fcfc9
add eax, ecx
add eax, 0x1ca11ab7
mov ecx, eax
and ecx, 0x92f5061f
shl ecx, 1
add eax, 0x92f5061f
sub eax, ecx
mov ecx, 0xc4577746
xor ecx, 0x5c28ee24
cmp eax, ecx
jbe 0x140079b27
mov eax, dword [0x140203be0]
mov ecx, dword [0x140203be4]
add eax, ecx
or eax, 0x221000
xor eax, 0xa080a040
and eax, 0xf6a2b140
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.1401ffc50
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.14006b577
mov rcx, qword [rbp - 8]
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov edx, 2
sub rsp, 0x20
call fcn.14006bf90
mov rcx, qword [rbp - 0x20]
mov eax, dword [rbp - 0x18]
add rsp, 0x20
mov cl, byte [rcx]
mov dl, 0xa5
xor dl, 0xa5
cmp cl, dl
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0x57d43372
jbe 0x140079a49
mov al, byte [rbp - 0x11]
test al, 1
jne 0x140079ad5
jmp 0x140079b22
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax]
sub rsp, 0x20
call fcn.140076a10
mov rax, qword [rbp - 0x20]
add rsp, 0x20
cmp byte [rax], 0
jne 0x140079b22
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax + 8]
mov qword [rdx], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14006cfd9
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
retf 0x1007
Function at 0x14007b680
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x20], rcx
mov eax, 0x10
call fcn.1401ffc50
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax

Function at 0x14007b9b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x140203d08]
mov ecx, dword [0x140203d0c]
xor ecx, 0x6a621c0f
xor edx, edx
div ecx
mov ecx, 0x960f6c3b
xor ecx, 0xe818b6b3
xor edx, edx
div ecx
and eax, 0x6cb135cf
mov ecx, eax
xor ecx, 0x441236c
xor ecx, 0xffffffff
or eax, 0x441236c
and eax, ecx
cmp eax, 0xb2f8f621
je 0x14007ba79
mov eax, dword [0x140203d10]
mov edx, dword [0x140203d14]
mov ecx, edx
and ecx, eax
mov r8d, 0xc831a899
xor r8d, 0x37ce5766
xor ecx, r8d
add eax, edx
mov edx, 0x8cbe107c
xor edx, 0x8cbe107d
add eax, edx
add eax, ecx
sub eax, 0x1fd6406c
add eax, 0xe6113728
mov ecx, 0xe6e19fe5
xor ecx, 0x62449002
xor eax, ecx
mov dword [rsp + 0x24], eax
call fcn.14006b577
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
call fcn.14007b890
mov eax, dword [rsp + 0x24]
cmp eax, 0xffe39335
ja 0x14007ba05
add rsp, 0x38
ret
mov esp, 0xe90d65e3
cmp edi, 0xffffffff
dec dword [rax - 0x7d]
sub rsp, 0x68
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
call fcn.14006b577
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov qword [rcx], 0
mov qword [rcx + 8], 0
mov ecx, 8
call fcn.14006b660
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov al, 1
cmp byte [rcx], 0
mov byte [rsp + 0x57], al
jne 0x14007bb30
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
call fcn.14007b9b0
mov rax, qword [rsp + 0x40]
mov cl, byte [rax]
mov dl, 0x5b
xor dl, 0x5b
mov al, 1
cmp cl, dl
mov byte [rsp + 0x57], al
jne 0x14007bb30
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0x58]
mov qword [rsp + 0x58], rdx
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x58]
call fcn.14001a950
mov rax, qword [rsp + 0x40]
mov al, byte [rax]
mov byte [rsp + 0x57], al
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov dl, byte [rsp + 0x57]
mov byte [rsp + 0x27], dl
mov byte [rax], 0
call fcn.14006b13c
mov rax, qword [rsp + 0x40]
mov al, byte [rax]
mov cl, 0x38
xor cl, 0x38
cmp al, cl
jne 0x14007bb69
mov rax, qword [rsp + 0x40]
mov cl, byte [rsp + 0x27]
mov byte [rax], cl
mov rax, qword [rsp + 0x30]
add rsp, 0x68
ret
Function at 0x14007c460
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
call fcn.14006b577
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov edx, 2
call fcn.14006bf90
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x14007c684
mov eax, dword [0x140203d68]
imul eax, dword [0x140203d6c]
mov edx, 0xffffffff
xor edx, 0x5130f50d
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0x5130f50d
add eax, edx
sub eax, ecx
mov ecx, 0x51868b9a
xor ecx, 0xcaeee1e0
sub eax, ecx
xor eax, 0x25ce9cf2
cmp eax, 0x64de0057
jbe 0x14007c689
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov r8d, dword [0x140203d70]
mov r9d, dword [0x140203d74]
mov edx, 0x31d9cbaa
xor edx, 0xce263455
xor r9d, edx
mov edx, r8d
xor edx, r9d
and edx, r8d
mov r8d, 0xa01fc393
xor r8d, 0xeb871f10
imul edx, r8d
mov r8d, 0xffffffff
xor r8d, 0x3c84ba55
add edx, r8d
mov r8d, 0xd851e0d5
xor r8d, 0xd851e0d4
add edx, r8d
mov r8d, 0xe21feac
xor r8d, 0xf1de0153
mov r9d, edx
xor r9d, r8d
and r9d, 0x273f1853
mov r10d, 0xffffffff
xor r10d, 0x273f1853
mov r8d, edx
and r8d, r10d
imul r8d, r9d
mov r9d, edx
and r9d, 0x273f1853
or edx, 0x273f1853
imul edx, r9d
add edx, r8d
mov dword [rsp + 0x28], edx
mov rdx, qword [rax]
call fcn.140076a10
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x28]
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x2f], cl
cmp eax, 0xef002ac6
ja 0x14007c689
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x14007c5bd
jmp 0x14007c684
mov ecx, dword [0x140203d78]
mov edx, dword [0x140203d7c]
mov eax, ecx
and eax, edx
or ecx, edx
add eax, ecx
mov ecx, 0x98425a43
xor ecx, 0x35714b71
sub eax, ecx
add eax, 0xc5cc2908
sub eax, 0x67ae5c1f
cmp eax, 0x24c2577c
je 0x14007c692
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x140203d80]
imul eax, dword [0x140203d84]
mov r8d, 0x6bfde707
xor r8d, 0xe5cca185
xor edx, edx
div r8d
mov edx, eax
mov rax, qword [rsp + 0x30]
imul edx, edx, 0x6db5914f
mov r8d, 0x60b7536b
xor r8d, 0xc91833ee
and r8d, edx
mov r9d, 0xc1baaa0c
xor r9d, 0x3e4555f3
xor r8d, r9d
add edx, 0xa9af6085
add edx, 1
add edx, r8d
mov dword [rsp + 0x24], edx
mov rdx, qword [rax + 8]
mov qword [rsp + 0x48], rdx
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
call fcn.140077130
mov eax, dword [rsp + 0x24]
cmp eax, 0x418f35fd
je 0x14007c5f3
jmp 0x14007c684
add rsp, 0x58
ret
in eax, dx
mov ebp, 0xfe48e9ed
invalid
adc eax, 0xe9f45329
pop rax
invalid
Function at 0x14007c8c7
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rcx
call fcn.14006b577
mov rdx, qword [rsp + 0x38]
cmp rdx, 0
jne 0x14007c796
mov eax, dword [0x140203d88]
xor edx, edx
div dword [0x140203d8c]
mov ecx, 0x597678a2
xor edx, edx
div ecx
mov ecx, eax
mov eax, 0xffffffff
xor eax, 0x30cd6543
xor edx, edx
sub edx, 1
sub eax, edx
sub ecx, eax
mov eax, ecx
and eax, 0x22330792
xor eax, 0xffffffff
mov edx, 0xdcf0585a
xor edx, 0x230fa7a5
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0x22330792
or ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, 0xfd5bca60
xor ecx, 0xb87016b2
cmp eax, ecx
jae 0x14007c8b5
mov rcx, qword [rsp + 0x30]
mov edx, dword [0x140203d90]
xor edx, dword [0x140203d94]
mov eax, 0xb37ec364
xor eax, 0x8ed63d57
imul edx, eax
mov r8d, 0xc6579add
xor r8d, 0x7c3e803a
mov eax, edx
and eax, r8d
xor edx, 0xba691ae7
or eax, edx
and eax, 0x3a2f7e62
mov dword [rsp + 0x2c], eax
mov eax, 0x4316792c
xor eax, 0xd700c220
mov dword [rsp + 0x28], eax
call fcn.14006b98c
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
ja 0x14007c72d
jmp 0x14007c7c4
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov qword [rsp + 0x40], rdx
mov rdx, qword [rax + 8]
mov qword [rsp + 0x48], rdx
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x40]
call fcn.14007c460
mov ecx, dword [0x140203d98]
sub ecx, dword [0x140203d9c]
add ecx, 0xea1f2b45
mov edx, 0xffffffff
xor edx, 0x6ef4c0
mov eax, ecx
xor eax, edx
and eax, ecx
mov r8d, 0x430c841c
xor r8d, 0xa29ee481
mov ecx, 0xac0e695e
xor ecx, 0x53f196a1
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xe192609d
or eax, 0xe192609d
imul eax, edx
add eax, ecx
cmp eax, 0x6d2d4fa4
je 0x14007c8be
mov eax, dword [0x140203da0]
mov edx, dword [0x140203da4]
mov ecx, 0x951bc440
xor ecx, 0x6ae43bbf
xor edx, ecx
mov ecx, eax
xor ecx, edx
and ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
and eax, 0x98107f19
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x98107f19
mov r8d, 0xffffffff
xor r8d, 0x98107f19
or edx, r8d
and ecx, edx
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x612902f2
xor ecx, 0x9ed6fd0d
xor eax, ecx
xor eax, 0x5607a401
sub eax, 0xa4b4e4ab
sub eax, 0xb4707589
add eax, 0xa4b4e4ab
cmp eax, 0x3e4df34f
je 0x14007c8be
add rsp, 0x58
ret
lea ecx, cs:[rsi]
sub al, 0xe9
outsd dx, dword [rsi]
invalid
push rdx
add eax, 0x68e9f323
invalid
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006b577
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x14007c6a0
Function at 0x140080440
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.14006b577
mov rdx, qword [rsp + 0x30]
cmp rdx, 0
jne 0x140080471
mov rcx, qword [rsp + 0x28]
call fcn.14006b98c
jmp 0x140080480
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call fcn.14008038f
mov eax, dword [0x140203ff8]
and eax, dword [0x140203ffc]
mov edx, eax
xor edx, 0xffffffff
and edx, 0x6f3402f9
mov r8d, 0x1f85681c
xor r8d, 0x70b16ae5
mov ecx, 0x98f193a3
xor ecx, 0x670e6c5c
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0x125ccd02
xor r8d, 0x7d68cffb
mov edx, eax
and edx, r8d
or eax, 0x6f3402f9
imul eax, edx
add eax, ecx
sub eax, 0xa8bf33fe
mov ecx, 0xcea81fb3
xor edx, edx
div ecx
mov ecx, 0xeb9739da
xor ecx, 0x618cbca0
cmp eax, ecx
jae 0x140080550
mov ecx, dword [0x140204000]
mov edx, dword [0x140204004]
mov eax, ecx
and eax, edx
or ecx, edx
add eax, ecx
add eax, 0x120ac514
xor ecx, ecx
sub ecx, eax
mov eax, 0x74eb99c8
xor eax, 0x74eb99c8
mov edx, 0x3a0e466f
xor edx, 0xbdfa4da3
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, 0xb0b436da
xor ecx, 0x7ebaba30
xor edx, edx
div ecx
cmp eax, 0x3aa83555
je 0x1400804f7
add rsp, 0x38
ret
jmp 0x14008055a
invalid

Function at 0x140080e60
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x140204058]
mov ecx, 0xd3df83f7
xor ecx, 0xc95dd259
xor eax, ecx
and eax, dword [0x14020405c]
mov edx, eax
and edx, 0x4f1c327d
mov ecx, 0xf38a3a67
xor ecx, 0xf38a3a65
imul ecx, edx
mov edx, 0xc9d0e1f2
xor edx, 0x86ccd38f
add eax, edx
sub eax, ecx
mov ecx, 0xeae50fcb
xor ecx, 0x544673ed
or eax, ecx
sub eax, 0xf086364f
sub eax, 0xfcd741aa
mov ecx, 0xf6d810c4
xor ecx, 0x65e268b
add eax, ecx
cmp eax, 0xb18ad3a1
jae 0x140080fa1
mov eax, dword [0x140204060]
xor eax, 0x6d327140
mov ecx, dword [0x140204064]
add eax, ecx
and eax, 0xa2891fb8
imul rax, rax, 0x366f85d1
shr rax, 0x3d
or eax, 0xaf5033a2
mov dword [rbp - 0x18], eax
mov eax, 0x20
call fcn.1401ffc50
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
sub rsp, 0x20
call fcn.14006b577
mov rcx, qword [rbp - 0x10]
add rsp, 0x20
mov eax, dword [rbp - 0x18]
cmp rcx, 0
sete cl
mov byte [rbp - 0x11], cl
cmp eax, 0x3adeba94
je 0x140080edf
mov al, byte [rbp - 0x11]
test al, 1
jne 0x140080f57
jmp 0x140080f6d
mov rcx, qword [rbp - 8]
sub rsp, 0x20
call fcn.14006b98c
add rsp, 0x20
jmp 0x140080f9c
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax]
mov qword [rdx], r8
mov r8, qword [rax + 8]
mov qword [rdx + 8], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 0x10], rax
sub rsp, 0x20
call fcn.140080ca0
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
movsb byte [rdi], byte [rsi]
invalid
Function at 0x1400a2a00
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x38], r8
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x30], rcx
mov eax, 0x10
call fcn.1401ffc50
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.1400a22e5
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x20
add rax, 0x50
mov qword [rbp - 0x10], rax
mov qword [rcx], 0
mov qword [rcx + 8], 0
cmp rdx, 0
je 0x1400a2bc6
mov rdx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x20]
sub rsp, 0x20
call fcn.1400a1210
mov rax, qword [rbp - 0x10]
add rsp, 0x20
cmp byte [rax], 0
jne 0x1400a2bc6
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x20]
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.1400a22f3
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x40], rcx
cmp byte [rax], 0
jne 0x1400a2bc6
mov rcx, qword [rbp - 0x38]
mov edx, 2
lea r8, [rbp - 8]
sub rsp, 0x20
call fcn.1400a14e3
add rsp, 0x20
test al, 1
jne 0x1400a2ae4
jmp 0x1400a2af6
sub rsp, 0x20
call fcn.140007f57
add rsp, 0x20
jmp 0x1400a2bc6
mov rax, qword [rbp - 8]
mov qword [rbp - 0x48], rax
cmp rax, 0
jge 0x1400a2b2c
mov rcx, qword [rbp - 0x48]
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
sub rsp, 0x20
call fcn.14000dc65
add rsp, 0x20
jmp 0x1400a2bc6
mov eax, dword [0x140204d98]
mov ecx, dword [0x140204d9c]
sub eax, 0x282a9e15
sub eax, ecx
add eax, 0x282a9e15
add eax, 0xee1ac106
or eax, 0x37e309f6
mov ecx, 0x4d178a5
xor ecx, 0x8ed62edf
add eax, ecx
cmp eax, 0xfeb41221
je 0x1400a2bcf
mov r8, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x40]
mov eax, dword [0x140204da0]
or eax, dword [0x140204da4]
mov r9d, 0x51eb0d35
xor r9d, 0xc32e826c
or eax, r9d
and eax, 0xa2331719
mov r9d, 0x5183ab6c
xor r9d, 0xf2f63209
or eax, r9d
mov dword [rbp - 0x4c], eax
sub rsp, 0x20
call fcn.1400a2bd8
mov eax, dword [rbp - 0x4c]
add rsp, 0x20
cmp eax, 0xf7b38e6c
ja 0x1400a2b66
jmp 0x1400a2bc6
mov rax, qword [rbp - 0x30]
mov rsp, rbp
pop rbp
ret
mov esi, 0xe9a9084c
invalid