joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d5d40
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x20], rcx
mov eax, 0x10
call fcn.1401da3e0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.1400d5a65
mov rcx, qword [rbp - 0x20]
add rsp, 0x20
mov al, byte [rcx + 0x10]
mov byte [rbp - 0x11], al
sub al, 4
je 0x1400d5d96
jmp 0x1400d5d86
mov al, byte [rbp - 0x11]
sub al, 5
je 0x1400d5dc0
jmp 0x1400d5de4
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax + 0x18]
mov qword [rbp - 0x10], rcx
mov rax, qword [rax + 0x20]
mov qword [rbp - 8], rax
lea rcx, [rbp - 0x10]
sub rsp, 0x20
call fcn.1400d5a80
add rsp, 0x20
jmp 0x1400d5de4
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x20]
mov rdx, qword [rax + 0x18]
mov qword [rcx], rdx
mov rax, qword [rax + 0x20]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.1400d5917
add rsp, 0x20
mov eax, dword [0x1401e0c40]
mov ecx, dword [0x1401e0c44]
mov edx, 0xdd04b118
xor edx, 0xc35a1fce
xor ecx, edx
and eax, ecx
or eax, 0x7a50be04
mov r8d, 0xffffffff
xor r8d, 0xa8caa760
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov r8d, 0x23da619
xor r8d, 0xaaf70179
mov edx, eax
and edx, r8d
or eax, 0xa8caa760
imul eax, edx
add eax, ecx
add eax, 0xc0d69843
mov ecx, 0x885c5918
xor ecx, 0xec591204
cmp eax, ecx
je 0x1400d5eb1
mov eax, dword [0x1401e0c48]
mov ecx, 0xf454f53b
xor ecx, 0xd139aa92
xor eax, ecx
sub eax, dword [0x1401e0c4c]
xor eax, 0x48e92aca
mov ecx, 0xa6d8b40d
xor ecx, 0x692f4014
add eax, ecx
add eax, 0x227a18c0
mov ecx, 0xef5822c
xor ecx, 0xc1027635
sub eax, ecx
add eax, 0x94d33297
add eax, 0xc57b9c4d
sub eax, 0x94d33297
cmp eax, 0xd67449c9
je 0x1400d5e55
mov rsp, rbp
pop rbp
ret
mov eax, 0xe987023d
wait
invalid
Function at 0x1400e4e10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov r8b, dl
mov qword [rsp + 0x30], rcx
mov rax, rcx
add rax, 8
mov qword [rsp + 0x38], rax
mov rax, qword [rcx + 8]
mov rdx, qword [rcx]
mov byte [rax + rdx + 8], r8b
mov rax, qword [rcx]
mov rdx, 0xffffffffffffffff
xor rdx, 1
xor ecx, ecx
sub rcx, 1
sub rdx, rcx
mov rcx, rax
sub rcx, rdx
mov qword [rsp + 0x40], rcx
mov rdx, rax
xor rdx, 0xffffffffffffffff
mov r8, rax
xor r8, 0xffffffffffffffff
or rdx, r8
xor rdx, 0xffffffffffffffff
mov r8, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
or rdx, r8
movabs r8, 0x1680d786e2d7519c
movabs r9, 0xe97f28791d28ae63
xor r8, r9
movabs r9, 0x99349fd63b7552c6
movabs r10, 0x66cb6029c48aad39
xor r9, r10
xor r8, r9
movabs r9, 0xc65fd9505e57034a
movabs r10, 0x39a026afa1a8fcb5
xor r9, r10
movabs r10, 0x66a24d7d40d3727d
movabs r11, 0x995db282bf2c8d82
xor r10, r11
xor r9, r10
or r8, r9
movabs r9, 0xa293f1a7ac83b835
movabs r10, 0x5d6c0e58537c47ca
xor r9, r10
xor rax, r9
xor r8, 0xffffffffffffffff
or rax, r8
xor rdx, 0xffffffffffffffff
movabs r8, 0x359a18342df18763
movabs r9, 0xca65e7cbd20e789c
xor r8, r9
xor rax, r8
or rdx, rax
mov rax, rcx
xor rax, 0xffffffffffffffff
xor rcx, 0xffffffffffffffff
and rax, rcx
movabs r8, 0x33818a2bae0e27b
movabs rcx, 0xfcc7e75d451f1d84
xor r8, rcx
mov rcx, rdx
xor rcx, r8
movabs r8, 0x39a9af26d8781f29
movabs r9, 0xc65650d92787e0d6
xor r8, r9
xor rdx, r8
and rcx, rdx
movabs rdx, 0x6e208399651ef85d
movabs r8, 0x91df7c669ae107a2
xor rdx, r8
xor rax, rdx
xor rcx, 0xffffffffffffffff
and rax, rcx
cmp rax, 0
jge 0x1400e5072
mov ecx, dword [0x1401e11a0]
xor ecx, dword [0x1401e11a4]
mov eax, 0xe9f2d14f
xor eax, 0x160d2eb0
mov edx, ecx
xor edx, eax
and edx, 0x32090719
mov r8d, 0xffffffff
xor r8d, 0x32090719
mov eax, ecx
and eax, r8d
imul eax, edx
mov edx, ecx
and edx, 0x32090719
mov r8d, 0x91b626b8
xor r8d, 0xa3bf21a1
or ecx, r8d
imul ecx, edx
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x4f95f114
or ecx, 0x4f95f114
xor ecx, 0xffffffff
mov edx, 0xb663c488
xor edx, 0x499c3b77
xor eax, edx
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0xedba50c1
xor edx, edx
div ecx
mov ecx, 0x38683e6b
xor ecx, 0x554079d0
cmp eax, ecx
je 0x1400e5091
mov eax, dword [0x1401e11a8]
xor edx, edx
div dword [0x1401e11ac]
xor eax, 0x18018754
xor ecx, ecx
sub ecx, 0x5be29ad
sub eax, ecx
mov ecx, 0xac3277de
xor ecx, 0xfd462f16
sub eax, ecx
mov dword [rsp + 0x2c], eax
call fcn.1400067fe
mov eax, dword [rsp + 0x2c]
cmp eax, 0x3b1d0fd1
je 0x1400e502b
jmp 0x1400e508c
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov qword [rdx], rcx
mov rax, qword [rax]
mov byte [rax + rcx + 8], 0
add rsp, 0x48
ret
xchg ebx, eax
shr byte [rbp - 0x6e1613], 1
invalid
Function at 0x140116480
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov eax, dword [0x1401e2338]
mov ecx, dword [0x1401e233c]
mov edx, 0x63dc8b26
xor edx, 0x3df373d8
xor ecx, edx
imul eax, ecx
mov ecx, eax
xor ecx, 0x4737d7a3
mov edx, 0x948bf0f2
xor edx, 0x6b740f0d
xor ecx, edx
and ecx, 0x4737d7a3
shl ecx, 1
sub ecx, 0x4737d7a3
sub eax, ecx
or eax, 0xee356e4d
mov ecx, 0x698c4ce7
xor edx, edx
div ecx
cmp eax, 0xf4eabea9
ja 0x1401165dd
mov edx, dword [0x1401e2340]
xor edx, 0x2cf352a1
mov ecx, dword [0x1401e2344]
mov eax, edx
and eax, ecx
xor edx, ecx
mov ecx, eax
mov eax, edx
lea eax, [rax + rcx*2 + 0x382d8dfd]
mov ecx, eax
and ecx, 0xe8289bc
add ecx, ecx
sub eax, ecx
add eax, 0x2e8289bc
and eax, 0x3ce10971
mov dword [rbp - 4], eax
mov eax, 0x10
mov qword [rbp - 0x20], rax
call fcn.1401da3e0
sub rsp, rax
mov rax, qword [rbp - 0x20]
mov rcx, rsp
mov qword [rbp - 0x18], rcx
call fcn.1401da3e0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x10], rax
movabs rdx, 0xaf367ec16ccaf470
movabs rax, 0xaf367ec16ccaf430
xor rdx, rax
sub rsp, 0x20
call fcn.140018850
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
add rsp, 0x20
mov rdx, qword [rax]
mov qword [0x140200ac0], rdx
mov rax, qword [rax + 8]
mov qword [0x140200ac8], rax
movabs rdx, 0xef8ab801719858de
movabs rax, 0xef8ab8017198589e
xor rdx, rax
sub rsp, 0x20
call fcn.140018850
mov rcx, qword [rbp - 0x10]
mov eax, dword [rbp - 4]
add rsp, 0x20
mov rdx, qword [rcx]
mov qword [0x1402009b0], rdx
mov rcx, qword [rcx + 8]
mov qword [0x1402009b8], rcx
cmp eax, 0x7fbb9b63
jae 0x1401164e5
mov rsp, rbp
pop rbp
ret
invalid
Function at 0x140117080
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401e23b0]
xor eax, 0xff07b111
mov ecx, dword [0x1401e23b4]
mov edx, 0x4fb8dc4a
xor edx, 0x73e68e28
xor ecx, edx
xor edx, edx
div ecx
mov ecx, 0xfe555897
xor ecx, 0x16979f63
sub eax, ecx
mov ecx, 0xe180d765
xor ecx, 0x3056811c
sub eax, ecx
add eax, 0xe8c2c7f4
xor eax, 0x53b8eac9
and eax, 0x3624616b
cmp eax, 0x20c9dcb7
jb 0x1401172ac
mov eax, dword [0x1401e23b8]
xor edx, edx
div dword [0x1401e23bc]
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x685bc508
mov edx, 0xffffffff
xor edx, 0x685bc508
and eax, edx
sub eax, ecx
and eax, 0x2a34404f
mov ecx, 0x257680f4
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x20]
xor ecx, ecx
test rdx, rdx
cmovg rcx, rdx
mov qword [rsp + 0x18], rcx
cmp eax, 0x91239c43
ja 0x1401170e9
xor eax, eax
mov qword [rsp + 0x10], rax
jmp 0x140117149
mov rax, qword [rsp + 0x10]
mov qword [rsp + 8], rax
mov eax, dword [0x1401e23c0]
mov ecx, dword [0x1401e23c4]
mov edx, 0x1bd69818
xor edx, 0xe42967e7
xor ecx, edx
mov edx, 0xe851ec64
xor edx, 0xe851ec64
mov r8d, 0x65cb4494
xor r8d, 0x65cb4495
sub edx, r8d
sub ecx, edx
sub eax, ecx
sub eax, 0x42a2aa1e
mov ecx, eax
xor ecx, 0x25e2351
mov edx, 0x5bb9f244
xor edx, 0x59e7d115
mov r8d, 0x4955bd1b
xor r8d, 0xb6aa42e4
xor edx, r8d
and eax, edx
shl eax, 1
sub eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0x5f74ed39
xor edx, 0x825493e5
and edx, ecx
mov r8d, 0xffffffff
xor r8d, 0xdd207edc
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov r8d, 0x323091a9
xor r8d, 0xef10ef75
mov edx, eax
and edx, r8d
or eax, 0xdd207edc
imul eax, edx
add eax, ecx
cmp eax, 0x1cec2d77
jb 0x1401172b5
mov rcx, qword [rsp + 8]
mov eax, dword [0x1401e23c8]
mov edx, 0x691243d2
xor edx, 0xbc94f45b
xor eax, edx
sub eax, dword [0x1401e23cc]
mov r8d, 0x6ab02f34
xor r8d, 0x3d7118f3
xor edx, edx
div r8d
sub eax, 0xdc7becf9
mov r8d, 0x495a136
xor r8d, 0x33ffbd6f
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x18]
cmp rcx, rdx
sete cl
mov byte [rsp + 7], cl
cmp eax, 0x224743e
ja 0x140117208
mov al, byte [rsp + 7]
test al, 1
jne 0x1401172a7
jmp 0x14011727a
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov dl, byte [rdx + rcx]
mov byte [rax + rcx], dl
adc al, 8
mov rax, rcx
and rax, 1
or rcx, 1
add rax, rcx
mov qword [rsp + 0x10], rax
jmp 0x140117149
add rsp, 0x38
ret
jb 0x14011728d
jmp 0x1401170e9
push 0xa
invalid
Function at 0x140117880
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov ecx, dword [0x1401e23e0]
mov edx, dword [0x1401e23e4]
mov r8d, 0x1e2cda53
xor r8d, 0xe1d325ac
mov eax, ecx
xor eax, r8d
mov r8d, edx
xor r8d, 0xffffffff
or eax, r8d
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov ecx, eax
xor ecx, 0x278e31d3
xor ecx, 0xffffffff
and ecx, 0x278e31d3
shl ecx, 1
mov edx, 0xcfd5c3dc
xor edx, 0xe85bf20f
sub ecx, edx
sub eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0xf0f0621
mov edx, 0xffffffff
xor edx, 0xf0f0621
and eax, edx
sub eax, ecx
and eax, 0x24d65736
mov ecx, 0x1eea713b
xor ecx, 0x5653e17
cmp eax, ecx
jb 0x1401179c8
mov rdx, qword [rbp - 8]
mov r8d, dword [0x1401e23e8]
mov eax, dword [0x1401e23ec]
xor eax, 0x40942cf9
imul r8d, eax
mov eax, r8d
xor eax, 0x24bb10e2
or r8d, 0xdb44ef1d
and r8d, eax
mov eax, r8d
and eax, 0x2fd6fec4
xor r8d, 0xafd6fec4
mov ecx, eax
mov eax, r8d
lea eax, [rax + rcx*2]
imul eax, eax, 0x4639c1fb
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.1401da3e0
sub rsp, rax
mov rax, qword [rbp - 0x10]
mov rcx, rsp
mov qword [rbp - 0x20], rcx
mov r8d, 0xce180f6f
xor r8d, 0xce180f6f
mov dword [rcx], r8d
add rdx, rax
mov r8d, 4
sub rsp, 0x20
call fcn.140117080
mov rcx, qword [rbp - 0x20]
mov eax, dword [rbp - 0x18]
add rsp, 0x20
mov ecx, dword [rcx]
mov dword [rbp - 0x14], ecx
cmp eax, 0x11f1e2e5
jb 0x14011791f
mov eax, dword [rbp - 0x14]
mov rsp, rbp
pop rbp
ret
push rsi
pop rbx
invalid
Function at 0x1401228b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rax
cmp rax, 0
je 0x1401229f4
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
movabs rdx, 0x4000000000000000
mov rcx, rax
xor rcx, rdx
xor rcx, 0xffffffffffffffff
movabs rdx, 0x50d17f5dd26f057e
movabs r8, 0x10d17f5dd26f057e
xor rdx, r8
or rax, rdx
and rax, rcx
movabs rcx, 0x7547c9943ce956ec
movabs rdx, 0x7547c9943ce956ec
xor rcx, rdx
cmp rax, rcx
je 0x1401229f4
mov eax, dword [0x1401e27a8]
mov r8d, dword [0x1401e27ac]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x28956ba0
xor edx, edx
div ecx
mov edx, 0xb543cdb9
xor edx, 0xd7f5592
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
mov edx, 0xd7b003b3
xor edx, 0x6f8c9b98
and edx, ecx
mov ecx, 0xd1331f19
xor ecx, 0xd1331f1b
imul ecx, edx
sub ecx, 0xb83c982b
sub eax, ecx
imul eax, eax, 0x59211326
cmp eax, 0xd6c68cb8
jae 0x1401229f9
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401e27b0]
mov edx, dword [0x1401e27b4]
xor edx, 0x4cfe7c1a
or eax, edx
sub eax, 0xec49019b
xor eax, 0x97416602
mov edx, 0x5caf0739
xor edx, 0xc9b31f81
and eax, edx
mov dword [rsp + 0x24], eax
call fcn.140014fb0
mov eax, dword [rsp + 0x24]
cmp eax, 0xdba4a5a
jb 0x1401229a7
jmp 0x1401229f4
add rsp, 0x38
ret
sbb esp, ebp
rol byte [0x14011cfeb], 0xff
Function at 0x140122f90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov dword [rsp + 0x34], edx
mov qword [rsp + 0x38], rcx
call fcn.140122cec
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rdx, qword [rcx]
movabs rax, 0x259516af956135e2
movabs rcx, 0x259516af956135e6
xor rax, rcx
mov rcx, rdx
add rcx, rax
mov qword [rsp + 0x48], rcx
mov r8, rdx
and r8, 0xffffffffffffffff
movabs rax, 0x88ce80a3300b7f8d
movabs r9, 0x88ce80a3300b7f8f
xor rax, r9
imul rax, r8
add rdx, 0xffffffffffffffff
sub rdx, rax
xor rdx, 0xffffffffffffffff
mov rax, rcx
xor rax, rdx
and rax, rcx
cmp rax, 0
jge 0x14012301b
call fcn.1400067fe
jmp 0x140123187
mov rax, qword [rsp + 0x48]
cmp rax, 0
jge 0x140123047
mov rcx, qword [rsp + 0x48]
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
call fcn.14000c499
jmp 0x140123187
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
call fcn.140015730
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x54], eax
mov edx, 4
call fcn.14012324a
mov rcx, rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
cmp byte [rax], 0
jne 0x140123187
mov eax, dword [0x1401e27d8]
xor eax, 0x9d44fa23
mov r8d, dword [0x1401e27dc]
mov ecx, 0xf97326ad
xor ecx, 0xc9729287
xor r8d, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov edx, eax
and edx, r9d
mov ecx, eax
or ecx, r9d
mov r9d, 0x788a8d22
xor r9d, 0x877572dd
xor ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
add eax, 0xc0d69843
mov ecx, 0xcb9f4187
xor ecx, 0xc05ec10c
xor eax, ecx
imul eax, eax, 0x691cdc6c
cmp eax, 0x513f756a
je 0x140123238
mov rcx, qword [rsp + 0x28]
mov eax, dword [0x1401e27e0]
xor eax, 0xa7ecf08b
mov r8d, dword [0x1401e27e4]
mov edx, eax
and edx, r8d
shl edx, 1
xor eax, r8d
add eax, edx
add eax, 0xfa174140
add eax, 0xc57b9c4d
sub eax, 0xfa174140
imul eax, eax, 0x2093c483
add eax, 0xd1025d47
sub eax, 0x85ed1603
sub eax, 0xd1025d47
mov dword [rsp + 0x24], eax
mov eax, 0x887150c0
xor eax, 0x355009ec
mov dword [rsp + 0x20], eax
movabs r8, 0xbdd7a12e6083f3e
movabs rax, 0xbdd7a12e6083f3a
xor r8, rax
lea rdx, [rsp + 0x54]
call fcn.1401233df
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
cmp eax, ecx
ja 0x1401230f7
jmp 0x140123187
mov ecx, dword [0x1401e27e8]
xor ecx, 0x12ab372b
mov edx, dword [0x1401e27ec]
mov eax, ecx
xor eax, 0xffffffff
and eax, edx
xor edx, 0xffffffff
and ecx, edx
sub ecx, eax
mov eax, ecx
xor eax, 0x53b8eac9
xor eax, 0xffffffff
and eax, 0x53b8eac9
shl eax, 1
sub eax, 0x53b8eac9
sub ecx, eax
mov edx, 0x5f964672
xor edx, 0xa069b98d
mov eax, ecx
xor eax, edx
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x3624616b
or ecx, 0x3624616b
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
and eax, 0xad274ee9
mov ecx, 0x58ebfdb
xor ecx, 0x2773c2c0
cmp eax, ecx
ja 0x140123241
mov eax, dword [0x1401e27f0]
sub eax, dword [0x1401e27f4]
and eax, 0x2a34404f
mov ecx, 0x257680f4
xor edx, edx
div ecx
mov ecx, 0xc0dc675d
xor ecx, 0xa6078c99
xor edx, edx
div ecx
cmp eax, 0xae4ccc8e
je 0x1401231ff
add rsp, 0x58
ret
mov eax, 0xe987023d
mov dh, 0xfe
invalid
pop rsp
retf 0xa59d
Function at 0x1401290a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
call fcn.14012908d
mov rcx, qword [rsp + 0x28]
add rax, 0x60
mov qword [rsp + 0x30], rax
movabs rax, 0xe30dbc36ff7e6516
movabs rdx, 0xe30dbc36ff7e65e9
xor rax, rdx
cmp rcx, rax
jbe 0x1401290f0
mov rcx, qword [rsp + 0x28]
mov edx, 0xff
call fcn.1400137e9
jmp 0x1401291f4
mov rax, qword [rsp + 0x28]
lea rcx, [0x140202b70]
imul rax, rax, 0x528
add rcx, rax
mov qword [rsp + 0x20], rcx
call fcn.1401289a0
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
jne 0x1401291f4
mov rax, qword [rsp + 0x28]
lea rcx, [0x140202b70]
imul rax, rax, 0x528
add rcx, rax
add rcx, 0x38
call fcn.1401289a0
mov rax, qword [rsp + 0x30]
mov al, byte [rax]
mov cl, 0x25
xor cl, 0x25
cmp al, cl
jne 0x1401291f4
mov rax, qword [rsp + 0x28]
lea rcx, [0x140202b70]
imul rdx, rax, 0x528
add rcx, rdx
add rcx, 0x81
mov byte [rcx], 1
lea rcx, [0x140202b70]
imul rax, rax, 0x528
add rcx, rax
add rcx, 0xb8
call fcn.1401289a0
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
jne 0x1401291f4
mov rax, qword [rsp + 0x28]
lea rcx, [0x140202b70]
imul rax, rax, 0x528
add rcx, rax
add rcx, 0x90
mov rax, qword [0x1401f09c0]
call qword [rax]
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
jne 0x1401291f4
mov r8, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
lea rcx, [0x140255370]
shl rax, 5
add rcx, rax
lea rdx, [0x140128ca6]
call fcn.140003a56
mov eax, dword [0x1401e2a88]
and eax, dword [0x1401e2a8c]
mov ecx, 0xc715259
xor ecx, 0x7621ec5d
or eax, ecx
mov r8d, 0xffffffff
xor r8d, 0xa8caa760
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0xb961feb
xor r8d, 0xf469e014
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xa8caa760
or eax, 0xa8caa760
imul eax, edx
add eax, ecx
add eax, 0xc0d69843
mov ecx, 0x41d0f1e7
xor ecx, 0x25d5bafb
cmp eax, ecx
je 0x1401292c5
mov eax, dword [0x1401e2a90]
xor eax, 0xd588f18f
sub eax, dword [0x1401e2a94]
mov ecx, 0x6db38c33
xor ecx, 0x255aa6f9
xor eax, ecx
mov ecx, 0xae4bca49
xor ecx, 0x61bc3e50
add eax, ecx
add eax, 0x227a18c0
sub eax, 0xcff7f419
mov ecx, 0x4656669a
xor ecx, 0xd285540d
add eax, ecx
mov ecx, 0x15c45ac9
xor ecx, 0xd0bfc684
add eax, ecx
sub eax, 0x94d33297
cmp eax, 0xd67449c9
je 0x140129261
add rsp, 0x38
ret
mov eax, 0xe987023d
xchg ebx, eax
invalid
Function at 0x1401293a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
call fcn.14012908d
mov qword [rsp + 0x30], rax
add rax, 0x60
mov qword [rsp + 0x28], rax
lea rcx, [0x140202b38]
mov rax, qword [0x1401f09c0]
call qword [rax]
mov rax, qword [rsp + 0x30]
cmp byte [rax + 0x60], 0
jne 0x1401294f5
lea rcx, [0x140202b00]
call fcn.1401289a0
mov rax, qword [rsp + 0x28]
cmp byte [rax], 0
jne 0x1401294f5
lea rcx, [0x140257370]
mov rax, qword [0x1401f09c0]
call qword [rax]
mov rax, qword [rsp + 0x28]
mov al, byte [rax]
mov cl, 0xa4
xor cl, 0xa4
cmp al, cl
jne 0x1401294f5
mov eax, dword [0x1401e2a98]
xor edx, edx
div dword [0x1401e2a9c]
mov edx, 0x41b958b5
xor edx, 0x41b958b4
mov ecx, eax
add ecx, edx
xor eax, 0xffffffff
or eax, 0x27862427
add eax, ecx
mov ecx, 0xf48d98a8
xor edx, edx
div ecx
sub eax, 0x440eee00
cmp eax, 0x9429d171
jbe 0x1401295a1
mov eax, dword [0x1401e2aa0]
mov edx, dword [0x1401e2aa4]
mov ecx, edx
and ecx, eax
mov r8d, 0x5bb9f244
xor r8d, 0xa4460dbb
xor ecx, r8d
add eax, edx
add eax, 1
add eax, ecx
mov ecx, 0xfe9a586a
xor ecx, 0xa6b24dd1
imul eax, ecx
add eax, 0x9be6ce5a
mov ecx, 0x5f74ed39
xor ecx, 0xdb8629f6
sub eax, ecx
sub eax, 0x9be6ce5a
mov ecx, 0x323091a9
xor ecx, 0x57b4451f
xor eax, ecx
mov dword [rsp + 0x20], eax
lea rcx, [0x140257398]
mov rax, qword [0x1401f09c0]
call qword [rax]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rsp + 0x20]
cmp byte [rcx], 0
sete cl
mov byte [rsp + 0x27], cl
cmp eax, 0x7f1d2b
jb 0x140129454
mov al, byte [rsp + 0x27]
test al, 1
jne 0x1401294f0
jmp 0x1401294f5
call fcn.1401292ce
mov eax, dword [0x1401e2aa8]
xor edx, edx
div dword [0x1401e2aac]
mov ecx, eax
mov eax, 0x6ab02f34
xor eax, 0x2f39866e
imul ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0x495a136
xor edx, 0x36820572
mov r8d, 0x4da83425
xor r8d, 0xb257cbda
xor edx, r8d
and eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x3217a444
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, eax
xor ecx, 0xe6d6fec3
xor ecx, 0xffffffff
or eax, 0xe6d6fec3
and eax, ecx
cmp eax, 0x11677bdc
jbe 0x1401295aa
mov eax, dword [0x1401e2ab0]
mov edx, dword [0x1401e2ab4]
xor edx, 0xa48a3e54
xor ecx, ecx
sub ecx, edx
add eax, ecx
sub eax, 0x8bfd17ab
imul eax, eax, 0x19d55098
xor eax, 0x300b3cbf
cmp eax, 0x4b43a3cc
jb 0x1401295aa
add rsp, 0x38
ret
mov ch, 0x6a
invalid
add ebp, dword [rax - 0x4916ebde]
invalid
Function at 0x1401295c0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rcx
call fcn.14012dbd0
mov rcx, qword [rsp + 0x28]
add rax, 0x60
mov qword [rsp + 0x30], rax
xor eax, eax
cmp rcx, 0
mov qword [rsp + 0x38], rax
je 0x14012969b
mov rcx, qword [rsp + 0x28]
xor eax, eax
cmp word [rcx], 0x5a4d
mov qword [rsp + 0x38], rax
jne 0x14012969b
mov ecx, 0x340
call fcn.140066190
mov ecx, eax
mov rax, qword [rsp + 0x30]
mov dword [rsp + 0x24], ecx
cmp byte [rax], 0
jne 0x14012969b
mov ecx, dword [rsp + 0x24]
mov rax, qword [rsp + 0x28]
mov edx, dword [rax + 0x3c]
mov dword [rsp + 0x20], edx
xor eax, eax
cmp ecx, edx
mov qword [rsp + 0x38], rax
jl 0x14012969b
mov eax, dword [rsp + 0x20]
movsxd rcx, eax
mov edx, 1
lea r8, [rsp + 0x40]
call fcn.1401296a5
test al, 1
jne 0x140129664
jmp 0x14012966e
call fcn.1400067fe
jmp 0x14012969b
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
xor eax, eax
sub rax, rcx
xor ecx, ecx
sub rcx, rdx
add rax, rcx
xor ecx, ecx
sub rcx, rax
xor eax, eax
cmp dword [rcx], 0x4550
cmove rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
add rsp, 0x48
ret
Function at 0x140136860
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rcx
call fcn.14015ddd5
mov rcx, qword [rsp + 0x58]
xor eax, eax
cmp rcx, 0
mov byte [rsp + 0x67], al
je 0x140136aac
mov ecx, dword [0x1401e2fe8]
xor ecx, 0xe5a8c993
mov eax, dword [0x1401e2fec]
xor eax, 0x7d69eb2f
imul ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xf2dedd3b
xor edx, 0xd2122c4
xor ecx, edx
or eax, ecx
mov ecx, 0x3e779965
and ecx, 0x3e779965
mov edx, 0x4c4a9e7
xor edx, 0xfb3b5618
xor ecx, edx
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0x8793a42
xor edx, edx
div ecx
mov ecx, 0xbb3fc394
xor ecx, 0x16124a60
or eax, ecx
cmp eax, 0x54dcd6a
jbe 0x140136abf
mov rcx, qword [rsp + 0x58]
mov eax, dword [0x1401e2ff0]
imul eax, dword [0x1401e2ff4]
mov r8d, 0x7ae679de
xor r8d, 0xabb736b2
mov edx, 0x86c4eb8a
xor edx, 0x793b1475
xor r8d, edx
mov edx, eax
and edx, r8d
mov r8d, eax
xor r8d, 0xd1514f6c
add eax, r8d
sub eax, edx
mov edx, 0x23f085ab
xor edx, 0x70c884aa
xor eax, edx
mov r8d, 0x93ded09a
xor edx, edx
div r8d
mov rdx, rcx
add rdx, 0xfffffffffffffff0
mov qword [rsp + 0x38], rdx
mov rcx, qword [rcx - 0x10]
mov qword [rsp + 0x40], rcx
cmp rcx, 0x10
setb cl
mov byte [rsp + 0x4f], cl
cmp eax, 0xe9b9189
ja 0x1401368f4
mov cl, byte [rsp + 0x4f]
mov al, 1
test cl, 1
mov byte [rsp + 0x37], al
jne 0x140136a86
jmp 0x140136990
mov r8, qword [rsp + 0x40]
movabs rcx, 0xe72905aa77137d90
mov rax, r8
add rax, rcx
add rax, 0xfffffffffffffff0
movabs rcx, 0xe72905aa77137d90
sub rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, rax
xor rcx, 0xffffffffffffffff
mov rdx, rax
xor rdx, 0xffffffffffffffff
and rcx, rdx
mov rdx, r8
or rdx, rdx
xor rdx, 0xffffffffffffffff
or rcx, rdx
movabs rdx, 0x931545821bf2eb3b
movabs r9, 0x6ceaba7de40d14c4
xor rdx, r9
xor rcx, rdx
mov rdx, rax
xor rdx, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
and rdx, r8
movabs r8, 0x28e15ae60753f78f
movabs r9, 0xd71ea519f8ac0870
xor r8, r9
xor rcx, r8
xor rdx, 0xffffffffffffffff
and rcx, rdx
cmp rcx, 0
setl cl
movabs rdx, 0x7e72cbd7bd81a8e1
movabs r8, 0x818d3428427e571e
xor rdx, r8
cmp rax, rdx
setg al
or al, al
xor al, 0xff
or cl, cl
xor cl, 0xff
xor al, 0xff
xor cl, 0xff
and al, cl
test al, 1
jne 0x140136a63
jmp 0x140136a73
call fcn.1400067fe
xor eax, eax
mov byte [rsp + 0x67], al
jmp 0x140136aac
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x37], al
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x38]
mov cl, byte [rsp + 0x4f]
mov al, byte [rsp + 0x37]
mov byte [rsp + 0x27], al
and cl, 1
call fcn.14000f8f0
mov al, byte [rsp + 0x27]
mov byte [rsp + 0x67], al
mov al, byte [rsp + 0x67]
cmp al, 0
setne al
and al, 1
movzx eax, al
add rsp, 0x68
ret
invalid