joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007d750
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
call fcn.1400741ed
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
call fcn.140038c50
mov cl, al
mov rax, qword [rsp + 0x48]
mov byte [rsp + 0x57], cl
cmp byte [rax], 0
jne 0x14007d8b3
mov eax, dword [0x140219fc8]
mov ecx, dword [0x140219fcc]
mov edx, 0x2fc3392d
xor edx, 0xd34684a0
xor ecx, edx
xor edx, edx
div ecx
mov ecx, eax
sub ecx, 0x6cd1bec4
mov edx, 0xed872238
xor edx, 0x9cc7857d
mov eax, 0x6be0c91e
xor eax, 0x941f36e1
xor edx, eax
mov eax, ecx
xor eax, edx
and eax, ecx
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x64dfa768
add ecx, eax
xor eax, eax
sub eax, ecx
cmp eax, 0xcc0a85ba
ja 0x14007d96a
mov cl, byte [rsp + 0x57]
mov eax, dword [0x140219fd0]
xor eax, 0x8e44fe8d
add eax, dword [0x140219fd4]
sub eax, 0xd1029cfc
add eax, 0x97a8316a
add eax, 0xd1029cfc
mov edx, eax
xor edx, 0x4b31306f
xor edx, 0xffffffff
or eax, 0x4b31306f
and eax, edx
mov r8d, 0xb7d7554
xor edx, edx
div r8d
cmp cl, 0xc0
sete cl
mov byte [rsp + 0x37], cl
cmp eax, 0x7e7c0db
je 0x14007d96a
mov al, byte [rsp + 0x37]
test al, 1
jne 0x14007d84b
jmp 0x14007d85a
mov rcx, qword [rsp + 0x40]
call fcn.140078f80
jmp 0x14007d8b3
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
cmp rax, 0
mov qword [rsp + 0x28], rax
jne 0x14007d8a4
xor eax, eax
mov ecx, eax
call fcn.1400ec2e0
mov rax, qword [rsp + 0x48]
cmp byte [rax], 0
jne 0x14007d8b3
mov ecx, 0x28
mov edx, 8
call fcn.140015160
mov rcx, qword [rsp + 0x38]
mov qword [rcx], rax
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
call fcn.14007d720
mov eax, dword [0x140219fd8]
sub eax, dword [0x140219fdc]
sub eax, 0x40385b8b
mov ecx, 0x6715e44e
xor ecx, 0x6715e44e
mov edx, 0xe71868d5
xor edx, 0x5fae48
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, 0xcbc5aa33
xor eax, 0xcbc5aa33
mov edx, 0x6444beee
xor edx, 0xeec6e88c
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, 0x67bacb21
xor ecx, 0x751f7789
cmp eax, ecx
jbe 0x14007d973
mov eax, dword [0x140219fe0]
mov ecx, dword [0x140219fe4]
mov edx, 0xa6772a7a
xor edx, 0xd6790263
xor ecx, edx
xor edx, edx
div ecx
and eax, 0x7b00afbc
mov ecx, 0xe12e37f6
xor ecx, 0x18ad770
sub eax, ecx
mov ecx, eax
add ecx, 1
mov edx, 0x3556227
xor edx, 0xfcaa9dd8
xor eax, edx
or eax, 0xc4e35f0b
add eax, ecx
cmp eax, 0x5039d17f
je 0x14007d912
add rsp, 0x58
ret
out dx, eax
push 0x71e9d537
invalid
retf
Function at 0x14007f540
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x14021a0f8]
mov ecx, dword [0x14021a0fc]
xor ecx, 0x2b7d730d
sub eax, ecx
mov ecx, 0x6ec9a7b3
xor ecx, 0x10ecf24
imul eax, ecx
mov ecx, 0xb970ffd3
xor edx, edx
div ecx
xor eax, 0x96020899
cmp eax, 0xecdde5c1
ja 0x14007f602
mov eax, dword [0x14021a100]
mov ecx, dword [0x14021a104]
sub eax, 0x3c7009de
add eax, ecx
add eax, 0x3c7009de
mov ecx, 0x7f94ea57
xor ecx, 0xf0762900
add eax, ecx
mov ecx, 0x1c48dfae
xor ecx, 0x58dc32fe
sub eax, ecx
sub eax, 0x8fe2c357
mov ecx, 0xdaf795f7
xor ecx, 0xdfb538a2
sub eax, ecx
mov ecx, 0x73cfcfde
xor edx, edx
div ecx
mov dword [rsp + 0x24], eax
call fcn.1400741ed
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
call fcn.14007f220
mov eax, dword [rsp + 0x24]
cmp eax, 0x28ca0de8
je 0x14007f589
add rsp, 0x38
ret
stosb byte [rdi], al
invalid
Function at 0x1400851f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x30], rcx
mov eax, 0x10
call fcn.140215890
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.1400741ed
mov rcx, qword [rbp - 0x20]
add rsp, 0x20
mov qword [rbp - 0x18], rax
movabs rax, 0x54552bc1630bfee2
movabs rdx, 0x54552bc1630bfee2
xor rax, rdx
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov ecx, 8
sub rsp, 0x20
call fcn.1400743d6
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov qword [rbp - 0x10], rax
mov al, 1
cmp byte [rcx], 0
mov byte [rbp - 1], al
jne 0x1400852d1
mov rdx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x10]
sub rsp, 0x20
call fcn.1400851bf
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov al, 1
cmp byte [rcx], 0
mov byte [rbp - 1], al
jne 0x1400852d1
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x10]
mov r8, qword [rax + 0x58]
mov qword [rdx], r8
mov rax, qword [rax + 0x60]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14001c4cf
mov rax, qword [rbp - 0x18]
add rsp, 0x20
mov al, byte [rax]
mov byte [rbp - 1], al
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov dl, byte [rbp - 1]
mov byte [rbp - 0x39], dl
mov dl, 0x18
xor dl, 0x18
mov byte [rax], dl
sub rsp, 0x20
call fcn.140073e50
mov rax, qword [rbp - 0x18]
add rsp, 0x20
mov al, byte [rax]
mov cl, 0xcb
xor cl, 0xcb
cmp al, cl
jne 0x1400853ce
mov eax, dword [0x14021a408]
mov r8d, dword [0x14021a40c]
mov edx, r8d
xor edx, 0xffffffff
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
mov ecx, 0x6ad3573
xor ecx, 0x66e0d273
xor edx, edx
div ecx
mov edx, 0x38be5570
xor edx, 0x38be5571
mov ecx, eax
add ecx, edx
mov edx, 0xe252e0fb
xor edx, 0x1dad1f04
xor eax, edx
or eax, 0x8592b798
add eax, ecx
add eax, 0xca7bfdef
mov ecx, 0xec218f2
xor ecx, 0x6ebbe775
sub eax, ecx
sub eax, 0xca7bfdef
cmp eax, 0x3b730959
jbe 0x1400853d7
mov r8b, byte [rbp - 0x39]
mov eax, dword [0x14021a410]
xor eax, 0xd53535d4
mov ecx, dword [0x14021a414]
xor ecx, 0xcae946e0
imul eax, ecx
mov ecx, 0x8065dc2
xor edx, edx
div ecx
and eax, 0xb974db54
mov ecx, 0x20cf9bbb
xor edx, edx
div ecx
mov rdx, qword [rbp - 0x18]
mov ecx, 0x5ee958ef
xor ecx, 0x1c3b37fb
mov byte [rdx], r8b
cmp eax, ecx
jae 0x14008537a
jmp 0x1400853ce
mov rax, qword [rbp - 0x30]
mov rsp, rbp
pop rbp
ret
mov cl, 0xc3
or eax, 0xff9ae94c
invalid
Function at 0x140085670
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
mov eax, dword [0x14021a438]
mov edx, dword [0x14021a43c]
mov ecx, edx
and ecx, eax
mov r8d, 0x5bd3889
xor r8d, 0xfa42c776
xor ecx, r8d
add eax, edx
mov edx, 0x85cd62a4
xor edx, 0x85cd62a5
add eax, edx
add eax, ecx
and eax, 0x527d999
xor ecx, ecx
sub ecx, 0x5850ae9b
add eax, ecx
add eax, 0x3e1fbf3b
sub eax, 0x3afc821
mov ecx, 0x3b2ae52c
xor ecx, 0x5355a17
sub eax, ecx
cmp eax, 0x5f24f05c
jb 0x140085852
mov ecx, dword [0x14021a440]
mov edx, dword [0x14021a444]
not edx
mov eax, ecx
or eax, edx
and ecx, edx
not eax
or eax, ecx
or eax, 0xfceafd7f
and eax, 0xfeebfdff
mov dword [rbp - 0x2c], eax
mov eax, 0x10
call fcn.140215890
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
sub rsp, 0x20
call fcn.1400741ed
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x38], rcx
movabs rcx, 0x4d980b1191c2f772
movabs rdx, 0x4d980b1191c2f772
xor rcx, rdx
mov qword [rax], rcx
mov qword [rax + 8], 0
movabs rcx, 0x249167793cd5e691
movabs rax, 0x249167793cd5e699
xor rcx, rax
sub rsp, 0x20
call fcn.1400743d6
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov rdx, rax
mov eax, dword [rbp - 0x2c]
mov qword [rbp - 0x28], rdx
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0x19], cl
cmp eax, 0xc5032853
jbe 0x140085852
mov cl, byte [rbp - 0x19]
mov al, 1
test cl, 1
mov byte [rbp - 0x41], al
jne 0x1400857b7
jmp 0x14008580f
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x28]
sub rsp, 0x20
call fcn.140085570
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov al, 1
cmp byte [rcx], 0
mov byte [rbp - 0x41], al
jne 0x14008580f
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x28]
mov r8, qword [rax + 0x58]
mov qword [rdx], r8
mov rax, qword [rax + 0x60]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14001c4cf
mov rax, qword [rbp - 0x38]
add rsp, 0x20
mov al, byte [rax]
mov byte [rbp - 0x41], al
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x28]
mov dl, byte [rbp - 0x41]
mov byte [rbp - 0x42], dl
mov byte [rax], 0
sub rsp, 0x20
call fcn.140073e50
mov rax, qword [rbp - 0x38]
add rsp, 0x20
mov al, byte [rax]
mov cl, 0x60
xor cl, 0x60
cmp al, cl
jne 0x140085849
mov rax, qword [rbp - 0x38]
mov cl, byte [rbp - 0x42]
mov byte [rax], cl
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
push rdi
jmp 0x140085886
dec dword [rax - 0x75]
and al, 0x40
Function at 0x140086070
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
call fcn.1400741ed
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov qword [rcx], 0
mov qword [rcx + 8], 0
mov ecx, 8
call fcn.1400743d6
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov al, 1
cmp byte [rcx], 0
mov byte [rsp + 0x57], al
jne 0x140086118
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
call fcn.140086045
mov rcx, qword [rsp + 0x40]
mov al, 1
cmp byte [rcx], 0
mov byte [rsp + 0x57], al
jne 0x140086118
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0x58]
mov qword [rsp + 0x58], rdx
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x58]
call fcn.14001c4cf
mov rax, qword [rsp + 0x40]
mov al, byte [rax]
mov byte [rsp + 0x57], al
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov dl, byte [rsp + 0x57]
mov byte [rsp + 0x27], dl
mov byte [rax], 0
call fcn.140073e50
mov rax, qword [rsp + 0x40]
mov al, byte [rax]
mov cl, 0x4f
xor cl, 0x4f
cmp al, cl
jne 0x140086151
mov rax, qword [rsp + 0x40]
mov cl, byte [rsp + 0x27]
mov byte [rax], cl
mov eax, dword [0x14021a478]
mov ecx, dword [0x14021a47c]
mov edx, 0x2213a45c
xor edx, 0xfe0eea5c
xor ecx, edx
or eax, ecx
sub eax, 0x9119dc72
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x9fd666e0
mov ecx, 0xffffffff
xor ecx, 0x8c68aac8
or eax, edx
or ecx, 0x8c68aac8
mov edx, 0xc6106315
xor edx, 0x39ef9cea
xor eax, edx
and eax, ecx
imul eax, eax, 0x3bf4ef28
cmp eax, 0xbdac3c99
ja 0x1400861f7
mov eax, dword [0x14021a480]
mov ecx, dword [0x14021a484]
xor ecx, 0xbcd146a1
xor edx, edx
div ecx
add eax, 0xdb5f227b
add eax, 0x4dcfabf1
sub eax, 0xdb5f227b
imul eax, eax, 0x227fe768
and eax, 0xa1b242eb
cmp eax, 0xba8a138
jae 0x1400861b2
mov rax, qword [rsp + 0x30]
add rsp, 0x68
ret
in eax, 4
mov ah, 0xa1
jmp 0x1400861b2
Function at 0x1400874dd
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x2f], dl
call fcn.1400741ed
mov dl, byte [rsp + 0x2f]
mov rcx, qword [rsp + 0x30]
and dl, 1
or dl, 0xc2
add rsp, 0x38
jmp fcn.140038540
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x2f], dl
call fcn.1400741ed
mov dl, byte [rsp + 0x2f]
mov rcx, qword [rsp + 0x30]
and dl, 1
add rsp, 0x38
jmp 0x1400874b3

Function at 0x14008863c
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.1400741ed
mov rdx, qword [rsp + 0x30]
cmp rdx, 0
jne 0x140088571
mov rcx, qword [rsp + 0x28]
call fcn.14007449b
jmp 0x14008862e
mov ecx, dword [0x14021a598]
mov edx, dword [0x14021a59c]
mov r8d, ecx
xor r8d, 0xffffffff
mov eax, edx
and eax, r8d
mov r8d, 0xacd4c7d9
xor r8d, 0x532b3826
xor edx, r8d
and ecx, edx
or eax, ecx
sub eax, 0xdfe30821
mov ecx, 0x88581b63
xor ecx, 0xd0e72d0e
sub eax, ecx
add eax, 0xdfe30821
and eax, 0x8c4f71e4
imul eax, eax, 0xf44eaf7e
cmp eax, 0x3d5b60c6
jb 0x140088633
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
mov edx, dword [0x14021a5a0]
add edx, dword [0x14021a5a4]
add edx, 0x5f1b60da
xor edx, 0x219992b
sub edx, 0x9a4fe01f
sub edx, 0xab498e23
add edx, 0x9a4fe01f
mov dword [rsp + 0x24], edx
mov edx, 0xa458cf16
xor edx, 0xd22e015
mov dword [rsp + 0x20], edx
mov rdx, qword [rax]
call fcn.1400883d0
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
je 0x1400885ca
jmp 0x14008862e
add rsp, 0x38
ret
shl byte [rbp - 0x7116fc34], 1
invalid
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
call fcn.1400741ed
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x140088540
Function at 0x140088d50
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
mov eax, dword [0x14021a5e8]
xor eax, dword [0x14021a5ec]
add eax, 0x2961fe06
xor ecx, ecx
sub ecx, 0xe1704c33
sub eax, ecx
sub eax, 0xc4cecc98
add eax, 0xa8e103b0
add eax, 0xc4cecc98
cmp eax, 0x4d4af130
jbe 0x140088ef1
mov eax, dword [0x14021a5f0]
mov ecx, dword [0x14021a5f4]
xor ecx, 0x6dbc6ac4
xor edx, edx
div ecx
xor eax, 0x8a9aa75a
imul eax, eax, 0xe674f207
xor eax, 0xae54b4f7
mov dword [rbp - 0x2c], eax
mov eax, 0x10
call fcn.140215890
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
sub rsp, 0x20
call fcn.1400741ed
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x38], rcx
movabs rcx, 0x838d873accaf8ad6
movabs rdx, 0x838d873accaf8ad6
xor rcx, rdx
mov qword [rax], rcx
mov qword [rax + 8], 0
mov ecx, 8
sub rsp, 0x20
call fcn.1400743d6
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov rdx, rax
mov eax, dword [rbp - 0x2c]
mov qword [rbp - 0x28], rdx
cmp byte [rcx], 0
sete cl
mov byte [rbp - 0x19], cl
cmp eax, 0x53ff4b9f
ja 0x140088d9b
mov cl, byte [rbp - 0x19]
mov al, 1
test cl, 1
mov byte [rbp - 0x41], al
jne 0x140088e5c
jmp 0x140088eb4
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x28]
sub rsp, 0x20
call fcn.140088b30
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov al, 1
cmp byte [rcx], 0
mov byte [rbp - 0x41], al
jne 0x140088eb4
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x28]
mov r8, qword [rax + 0x58]
fmul dword [r11 + rcx*4 + 0x40]
pop rax
mov qword [rdx], r8
mov rax, qword [rax + 0x60]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14001c4cf
mov rax, qword [rbp - 0x38]
add rsp, 0x20
mov al, byte [rax]
mov byte [rbp - 0x41], al
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x28]
mov dl, byte [rbp - 0x41]
mov byte [rbp - 0x42], dl
mov byte [rax], 0
sub rsp, 0x20
call fcn.140073e50
mov rax, qword [rbp - 0x38]
add rsp, 0x20
cmp byte [rax], 0
jne 0x140088ee8
mov rax, qword [rbp - 0x38]
mov cl, byte [rbp - 0x42]
mov byte [rax], cl
mov rax, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
ja 0x140088e8d
invalid
Function at 0x140088f00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
call fcn.1400741ed
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov edx, 3
call fcn.140074650
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140089077
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax]
call fcn.1400811fa
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x140089077
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov edx, dword [rax + 8]
call fcn.140074d96
mov rax, qword [rsp + 0x40]
mov al, byte [rax]
mov cl, 0x9f
xor cl, 0x9f
cmp al, cl
jne 0x140089077
mov eax, dword [0x14021a5f8]
mov r8d, dword [0x14021a5fc]
xor r8d, 0x92a47c0d
mov ecx, 0xfd50b11b
xor ecx, 0x2af4ee4
mov r9d, r8d
xor r9d, ecx
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0x2c90fb04
xor edx, 0x39714317
and ecx, edx
mov edx, 0xffffffff
xor edx, 0x15e1b813
and eax, edx
sub eax, ecx
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0x6eca9c6b
add eax, ecx
imul eax, eax, 0xabba7c8e
cmp eax, 0x3a3fb015
jbe 0x14008907c
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov edx, dword [0x14021a600]
xor edx, 0xca26f224
and edx, dword [0x14021a604]
mov r8d, 0xf7fc7ec5
xor r8d, 0xecbce40
imul edx, r8d
sub edx, 0x429439cd
sub edx, 0x7b18cdfb
add edx, 0x429439cd
sub edx, 0xd6e5a147
mov dword [rsp + 0x2c], edx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x48], rdx
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
call fcn.140075659
mov eax, dword [rsp + 0x2c]
cmp eax, 0x47c5d770
jb 0x140088ffe
jmp 0x140089077
add rsp, 0x58
ret
mov dword [0x1b9f21be1], ecx
invalid
Function at 0x14008b6b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x14021a728]
mov r8d, dword [0x14021a72c]
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x34b40585
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
add eax, 0x1a1b713b
mov ecx, 0x52bf50c6
xor ecx, 0x23f500aa
xor edx, edx
div ecx
mov ecx, 0x1a6ce4a3
xor ecx, 0x27c2dc79
cmp eax, ecx
ja 0x14008b8c9
mov eax, dword [0x14021a730]
or eax, dword [0x14021a734]
sub eax, 0x10f365d5
sub eax, 0x6f223ac0
mov ecx, 0x31c7f6a4
xor ecx, 0x21349371
add eax, ecx
add eax, 0x9eaf03e8
imul eax, eax, 0xbc68cbae
mov dword [rsp + 0x30], eax
call fcn.1400741ed
mov rcx, qword [rsp + 0x38]
mov eax, dword [rsp + 0x30]
cmp rcx, 0
sete cl
mov byte [rsp + 0x37], cl
cmp eax, 0x34e06f65
jb 0x14008b72a
mov al, byte [rsp + 0x37]
test al, 1
jne 0x14008b791
jmp 0x14008b7a0
mov rcx, qword [rsp + 0x40]
call fcn.14007449b
jmp 0x14008b8c4
mov eax, dword [0x14021a738]
xor edx, edx
div dword [0x14021a73c]
xor eax, 0x251369af
mov ecx, 0x8d8b0fa6
xor ecx, 0x2751e576
add eax, ecx
mov ecx, 0x21b0a16e
xor ecx, 0x41542a92
add eax, ecx
sub eax, 0xaadaead0
mov ecx, 0x5ffc595f
xor ecx, 0x61c12d54
add eax, ecx
cmp eax, 0x2d38877d
jbe 0x14008b8d2
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x14021a740]
sub eax, dword [0x14021a744]
mov r8d, 0x6956e094
xor edx, edx
div r8d
mov edx, eax
mov rax, qword [rsp + 0x38]
mov r9d, edx
xor r9d, 0xffffffff
and r9d, 0x404cb564
mov r10d, 0x340c46de
xor r10d, 0x7440f3ba
mov r8d, 0xd803c12b
xor r8d, 0x27fc3ed4
xor r10d, r8d
mov r8d, edx
and r8d, r10d
imul r8d, r9d
mov r10d, 0xf76573ac
xor r10d, 0xb729c6c8
mov r9d, edx
and r9d, r10d
mov r10d, 0x9052ce88
xor r10d, 0xd01e7bec
or edx, r10d
imul edx, r9d
add edx, r8d
mov r10d, 0xffffffff
xor r10d, 0x3ec7ff6
mov r9d, edx
and r9d, r10d
mov r8d, edx
or r8d, r10d
xor r8d, 0xffffffff
imul r8d, r9d
mov r9d, edx
and r9d, 0x3ec7ff6
or edx, 0x3ec7ff6
imul edx, r9d
add edx, r8d
mov dword [rsp + 0x2c], edx
mov rdx, qword [rax]
call fcn.14008b4e0
mov eax, dword [rsp + 0x2c]
cmp eax, 0x1193cd89
jbe 0x14008b8d2
xchg ebx, eax
adc dword [rdi], ecx
xchg byte [rbx], dl
add byte [rax], al
add cl, ch
add byte [rax], al
add byte [rax], al
jmp 0x14008b8c4
add rsp, 0x48
ret
pop rdi
test al, 0x59
jge 0x14008b8b7
pop rax
invalid
sbb al, 0xd7
push rax
std
jmp 0x14008b7ea
Function at 0x140090f50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
mov rax, qword [0x14022dd30]
mov ecx, dword [rax]
call fcn.140008650
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
call fcn.1400906b0
test al, 1
jne 0x140090f83
jmp 0x140091105
mov ecx, dword [0x14021a988]
mov eax, dword [0x14021a98c]
mov edx, 0xee9e9449
xor edx, 0x78f428da
sub ecx, edx
sub ecx, eax
add ecx, 0x966abc93
add ecx, 0xb5c27fba
sub ecx, 0x41753ac7
sub ecx, 0xa135fc0e
mov eax, 0x3c7d595a
xor eax, 0x7d08639d
add ecx, eax
mov eax, ecx
and eax, 0x3d6cc152
xor eax, 0xffffffff
mov edx, 0x325b55fb
xor edx, 0xcda4aa04
xor ecx, edx
mov edx, 0x2f144b2f
xor edx, 0x12788a7d
mov r8d, 0xd9617d53
xor r8d, 0x269e82ac
xor edx, r8d
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
cmp eax, 0x82f1a1b9
je 0x14009110a
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x14021a990]
mov edx, 0x7147fece
xor edx, 0x894a24a7
xor eax, edx
xor edx, edx
div dword [0x14021a994]
mov edx, 0xebdc97c0
xor edx, 0x4d266d40
xor eax, edx
or eax, 0x8ede930c
and eax, 0xbd69c3d0
mov dword [rsp + 0x30], eax
call fcn.140090a80
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x30]
mov cl, byte [rcx + 0x50]
mov dl, 0x6c
xor dl, 0x6c
cmp cl, dl
sete cl
mov byte [rsp + 0x37], cl
cmp eax, 0x363c6e1a
jb 0x140091006
mov al, byte [rsp + 0x37]
test al, 1
jne 0x14009107c
jmp 0x140091105
mov eax, dword [0x14021a998]
mov ecx, dword [0x14021a99c]
xor ecx, 0x2b0bbd5c
add eax, ecx
sub eax, 0x725fd686
sub eax, 0x5ed9b175
mov ecx, 0x6560ee7a
xor ecx, 0x1e500a71
xor eax, ecx
cmp eax, 0x79e11347
jbe 0x140091113
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x14021a9a0]
mov edx, dword [0x14021a9a4]
xor edx, 0xf31d386c
and eax, edx
mov edx, 0x8f2a4abd
xor edx, 0x64d80d22
xor eax, edx
and eax, 0xec9327dc
imul eax, eax, 0xec922f53
mov dword [rsp + 0x2c], eax
mov edx, 8
call fcn.14001096f
mov eax, dword [rsp + 0x2c]
cmp eax, 0xf4516dfd
ja 0x140091113
jmp 0x140091105
add rsp, 0x48
ret
or ecx, eax
lahf
and ebp, ecx
invalid
jg 0x14009110a
insd dword [rdi], dx
shr ecx, cl
xchg esi, eax
invalid
Function at 0x140096b60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x140096c32
mov rcx, qword [rsp + 0x30]
movabs rax, 0x4000000000000000
and rax, qword [rcx]
movabs rcx, 0xe7f7a86646892465
movabs rdx, 0xe7f7a86646892465
xor rcx, rdx
cmp rax, rcx
je 0x140096c32
mov eax, dword [0x14021ac28]
xor edx, edx
div dword [0x14021ac2c]
or eax, 0xc7a5847e
mov ecx, 0x488c71c3
xor edx, edx
div ecx
mov ecx, 0x9edf654f
xor edx, edx
div ecx
mov ecx, 0x603fb7e4
xor ecx, 0x764c15f9
cmp eax, ecx
je 0x140096c37
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x14021ac30]
sub eax, dword [0x14021ac34]
sub eax, 0xb1f67142
add eax, 0xd0c66954
xor eax, 0xfc06ba42
mov dword [rsp + 0x24], eax
mov eax, 0xd6e0325c
xor eax, 0x8640b2ab
mov dword [rsp + 0x20], eax
call fcn.140016f90
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
je 0x140096be6
jmp 0x140096c32
add rsp, 0x38
ret
cmp eax, 0xa6e984c2
invalid
Function at 0x140097c20
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rcx
mov rcx, qword [rdx + 8]
mov qword [rsp + 0x38], rcx
xor eax, eax
cmp rcx, qword [rdx]
mov byte [rsp + 0x47], al
jne 0x140097cf6
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
test rcx, rcx
setns al
mov rdx, qword [rdx]
mov qword [rsp + 0x28], rdx
sub rcx, rdx
setl cl
and al, cl
test al, 1
jne 0x140097ccb
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x28]
movabs rax, 0xfec9027db96ea34a
movabs r8, 0xe9169b6dd05bdb32
xor rax, r8
sub rdx, rax
movabs rax, 0x35abbb34f704cdbb
movabs r8, 0xca5444cb08fb3244
xor rax, r8
add rdx, rax
movabs rax, 0x7f230fb6bcc5e8aa
movabs r8, 0x68fc96a6d5f090d2
xor rax, r8
add rdx, rax
call fcn.1400153d3
jmp 0x140097cf6
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 8]
mov cl, byte [rax + rcx + 8]
mov al, cl
sub al, 0x5c
sete al
sub cl, 0x2f
sete dl
mov cl, dl
and cl, al
add al, dl
sub al, cl
mov byte [rsp + 0x47], al
mov al, byte [rsp + 0x47]
mov byte [rsp + 0x27], al
mov eax, dword [0x14021ace8]
xor edx, edx
div dword [0x14021acec]
mov ecx, eax
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x9705e774
or ecx, 0x9705e774
mov edx, 0x98479a73
xor edx, 0x67b8658c
xor ecx, edx
or eax, ecx
mov ecx, 0x741f5256
xor ecx, 0x8be0ada9
xor eax, ecx
mov ecx, 0x8c2959ee
xor ecx, 0x2098ca3c
xor edx, edx
div ecx
mov edx, 0x8add1435
xor edx, 0x7d5e519d
mov ecx, 0xebd9fb19
xor ecx, 0x142604e6
xor edx, ecx
mov ecx, eax
and ecx, edx
mov r8d, 0xd14115d2
xor r8d, 0x26c2507a
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
cmp eax, 0xe6cbe6d7
jb 0x140097dfe
mov eax, dword [0x14021acf0]
imul eax, dword [0x14021acf4]
mov ecx, eax
xor ecx, 0xe47f8db2
mov edx, 0xc0772194
xor edx, 0x3f88de6b
xor ecx, edx
or eax, 0xe47f8db2
and eax, ecx
mov ecx, 0x21e5b24e
xor ecx, 0xf5a72277
xor edx, edx
div ecx
mov ecx, eax
and ecx, 0x8ceab8fb
shl ecx, 1
mov edx, 0xb0c8750
xor edx, 0x87e63fab
xor eax, edx
add eax, ecx
mov ecx, 0xc5d5bce6
xor ecx, 0x7cc157ce
cmp eax, ecx
jae 0x140097d8b
mov al, byte [rsp + 0x27]
and al, 1
movzx eax, al
add rsp, 0x48
ret
adc dword [rdi - 0x80], esp
shr cl, 1
test bh, bh
invalid