joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400310a0
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x1401f2ad8]
xor eax, 0xecf0f442
sub eax, dword [0x1401f2adc]
mov r8d, 0x9372cdeb
xor r8d, 0x459362ff
mov ecx, 0x53ae418
xor ecx, 0xfac51be7
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xd6e1af14
or eax, 0xd6e1af14
imul eax, edx
add eax, ecx
sub eax, 0xa666a412
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0x6feeb5e6
xor edx, 0xc18c5a9c
and edx, ecx
mov r8d, 0xffffffff
xor r8d, 0xae62ef7a
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xae62ef7a
mov r8d, 0x78c5b2b5
xor r8d, 0xd6a75dcf
or eax, r8d
imul eax, edx
add eax, ecx
cmp eax, 0x9bb64e63
jae 0x14003122b
mov rcx, qword [rsp + 0x30]
mov edx, dword [0x1401f2ae0]
mov eax, dword [0x1401f2ae4]
xor eax, 0x6a359e2a
sub edx, eax
mov eax, edx
xor eax, 0xffffffff
mov r8d, 0xdb5f12fa
xor r8d, 0x24a0ed05
xor edx, r8d
or eax, edx
mov edx, 0xffffffff
xor edx, 0x5f89d453
mov r8d, 0xffffffff
xor r8d, 0x5f89d453
or edx, r8d
and eax, edx
mov edx, 0xabcdeca3
xor edx, 0x5432135c
xor eax, edx
mov r8d, 0xfd5a0b3b
xor edx, edx
div r8d
mov r9d, 0xffffffff
xor r9d, 0x45eecb49
mov r8d, eax
and r8d, r9d
mov edx, eax
or edx, r9d
xor edx, 0xffffffff
imul edx, r8d
mov r8d, eax
and r8d, 0x45eecb49
or eax, 0x45eecb49
imul eax, r8d
add eax, edx
mov dword [rsp + 0x24], eax
movabs rdx, 0xbf0e1b939e50a140
movabs rax, 0xbf0e1b939e50a140
xor rdx, rax
call fcn.140030910
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
call fcn.140030b90
mov eax, dword [rsp + 0x24]
cmp eax, 0x7257b3ad
jae 0x140031150
add rsp, 0x38
ret
pop rdx
fnsave dword [rdi - 0xe3169e]
invalid

Function at 0x140031ea1
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
xor eax, eax
mov edx, eax
call fcn.140031520
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x140031a80
Function at 0x140033b90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1401f2c48]
mov edx, dword [0x1401f2c4c]
mov ecx, 0x9323b38a
xor ecx, 0x5aa71945
xor edx, ecx
mov r8d, eax
xor r8d, edx
xor r8d, 0xffffffff
mov ecx, edx
and ecx, r8d
shl ecx, 1
sub ecx, edx
sub eax, ecx
and eax, 0xc12aea8
mov ecx, 0x2fd613e6
xor edx, edx
div ecx
mov ecx, 0x5649d56e
xor ecx, 0x4ad63dde
xor edx, edx
div ecx
cmp eax, 0x2e576fa2
ja 0x140033cfc
mov eax, dword [0x1401f2c50]
mov ecx, 0x34303e77
xor ecx, 0x239758c7
xor eax, ecx
xor edx, edx
div dword [0x1401f2c54]
mov ecx, 0x9eea7ae0
xor edx, edx
div ecx
sub eax, 0xf614fdbc
imul eax, eax, 0x2a367daf
mov dword [rsp + 0x38], eax
call fcn.14000c8dc
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
call fcn.1401d1d54
mov rcx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x38]
cmp byte [rcx + 0x60], 0
sete cl
mov byte [rsp + 0x3f], cl
cmp eax, 0x137071bb
jbe 0x140033cfc
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x140033c67
jmp 0x140033cf7
mov eax, dword [0x1401f2c58]
sub eax, dword [0x1401f2c5c]
xor eax, 0x3d159c99
imul eax, eax, 0x32890b06
mov ecx, 0xffffffff
xor ecx, 0x36b7a413
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
cmp eax, 0x3c543871
jb 0x140033d05
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x1401f2c60]
mov edx, dword [0x1401f2c64]
xor edx, 0xfe8f172f
imul eax, edx
mov r8d, 0x11aef042
xor edx, edx
div r8d
mov r8d, 0xe5573c86
xor edx, edx
div r8d
mov edx, 0xa7392245
xor edx, 0x6d66722e
cmp dword [rdi + 0x722ef281], esp
insw word [rdi], dx
or eax, edx
mov dword [rsp + 0x2c], eax
call fcn.1401d1da0
mov eax, dword [rsp + 0x2c]
cmp eax, 0x42bc55f8
jb 0x140033c9d
jmp 0x140033cf7
add rsp, 0x48
ret
mov dl, 0x8a
sub bl, byte [rbp - 0x11417]
jmp rax
loopne 0x140033cd0
invalid
Function at 0x1400358f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x40], rdx
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rcx, qword [rax]
mov qword [rsp + 0x50], rcx
mov rdx, rax
add rdx, 8
mov qword [rsp + 0x58], rdx
mov rax, qword [rax + 8]
mov qword [rsp + 0x60], rax
mov r8, rcx
add r8, 1
mov qword [rsp + 0x68], r8
mov rdx, rcx
or rdx, rdx
xor rdx, 0xffffffffffffffff
movabs r9, 0xad7ff48ba80e1632
movabs r10, 0x52800b7457f1e9cd
xor r9, r10
movabs r10, 0xdc86cff933b9d2d6
movabs r11, 0x23793006cc462d29
xor r10, r11
xor r9, r10
mov r10, 0xffffffffffffffff
xor r10, 0xffffffffffffffff
and r9, r10
or rdx, r9
xor rdx, 0xffffffffffffffff
xor rcx, 0xffffffffffffffff
movabs r9, 0x9dc4b62493122415
movabs r10, 0x623b49db6ceddbea
xor r9, r10
movabs r10, 0xa166db1368c86b07
movabs r11, 0x5e9924ec973794f8
xor r10, r11
xor r9, r10
and rcx, r9
xor rdx, 0xffffffffffffffff
movabs r9, 0x4195b17079a5eaa
movabs r10, 0xfbe6a4e8f865a155
xor r9, r10
xor rcx, r9
and rdx, rcx
mov rcx, r8
xor rcx, 0xffffffffffffffff
xor r8, 0xffffffffffffffff
and rcx, r8
or rdx, rdx
xor rdx, 0xffffffffffffffff
or rcx, rdx
xor rcx, 0xffffffffffffffff
mov qword [rsp + 0x70], rcx
cmp rax, 0
je 0x140035ac5
mov rax, qword [rsp + 0x70]
cmp rax, 0
jl 0x140035abb
mov eax, dword [str.I9u]
mov ecx, dword [0x1401f2d5c]
xor ecx, 0xf7cfaef9
xor edx, edx
div ecx
and eax, 0xb2b38ff5
or eax, 0x58da5d6
imul eax, eax, 0x6ecd7657
cmp eax, 0x6e428eb3
je 0x140035b51
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x60]
mov eax, dword [0x1401f2d60]
mov ecx, dword [0x1401f2d64]
xor ecx, 0xf65acf9b
or eax, ecx
imul eax, eax, 0x5aaddad3
mov ecx, 0xc3728359
xor edx, edx
div ecx
xor ecx, ecx
sub ecx, 0xbd024445
sub eax, ecx
mov ecx, 0xed143dd4
xor ecx, 0x3206e478
movabs rdx, 0xbfffffffffffffff
and rdx, qword [r9]
cmp rdx, r8
setl dl
mov byte [rsp + 0x3f], dl
cmp eax, ecx
je 0x140035a3e
mov rax, qword [rsp + 0x60]
mov cl, byte [rsp + 0x3f]
test cl, 1
mov qword [rsp + 0x30], rax
jne 0x140035ac5
jmp 0x140035b0f
call fcn.1400091c0
jmp 0x140035b4c
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
mov r8d, 1
mov r9d, 0x18
mov qword [rsp + 0x20], 8
call fcn.140014320
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
mov qword [rdx], rax
cmp rcx, 0
mov qword [rsp + 0x30], rax
jge 0x140035b0f
call fcn.1400091c0
jmp 0x140035b4c
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
mov r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x30]
mov qword [r8], r9
add rax, 8
imul rdx, rdx, 0x18
add rax, rdx
mov rdx, qword [rcx]
mov qword [rax], rdx
mov rdx, qword [rcx + 8]
mov qword [rax + 8], rdx
mov rcx, qword [rcx + 0x10]
mov qword [rax + 0x10], rcx
add rsp, 0x78
ret
retf 0x52ff
Function at 0x14003da70
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
call fcn.14003dca0
mov rcx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rax, qword [rcx]
mov qword [rsp + 0x50], rax
mov rcx, r8
xor rcx, 0xffffffffffffffff
and rcx, 0xffffffffffffffff
mov rdx, 0xffffffffffffffff
xor rdx, 0xffffffffffffffff
and r8, rdx
or rcx, r8
add rax, rcx
cmp rax, 0xffffffffffffffff
je 0x14003dc3a
mov r8d, dword [0x1401f31e0]
mov edx, dword [0x1401f31e4]
xor edx, 0xcf0246ea
mov ecx, 0xbd91771e
xor ecx, 0x426e88e1
mov eax, r8d
xor eax, ecx
and eax, 0x6b8814c5
mov r9d, 0xffffffff
xor r9d, 0x6b8814c5
and r8d, r9d
mov r10d, 0x566d578e
xor r10d, 0xa992a871
mov ecx, edx
xor ecx, r10d
and ecx, 0x6b8814c5
and edx, r9d
or eax, r8d
or ecx, edx
xor eax, ecx
or eax, 0xa805510f
mov ecx, 0x69fe7104
xor ecx, 0x78a6edbd
sub eax, ecx
mov ecx, 0x9793129a
xor ecx, 0x686ced65
xor eax, ecx
mov edx, 0x4df53e09
xor edx, 0xdfec9f5f
mov ecx, 0x2bb04087
xor ecx, 0xd44fbf78
xor edx, ecx
mov ecx, 0xe77fa773
xor ecx, 0xa510c757
mov r8d, 0xa965f07b
xor r8d, 0x569a0f84
xor ecx, r8d
or eax, edx
or ecx, 0x426f6024
xor eax, 0xffffffff
and eax, ecx
cmp eax, 0x38a80118
jb 0x14003dc93
mov rdx, qword [rsp + 0x50]
mov r9, qword [rsp + 0x48]
mov eax, dword [0x1401f31e8]
mov r10d, dword [0x1401f31ec]
mov r8d, r10d
not r8d
mov ecx, eax
and ecx, r8d
mov r8d, eax
xor r8d, r10d
add eax, r8d
sub eax, ecx
add eax, 0x3b2df526
and eax, 0xe9a3f580
test r9, r9
sets cl
mov r8, rdx
sub r8, r9
setle r8b
or cl, r8b
test rdx, rdx
setle dl
or cl, dl
mov byte [rsp + 0x2f], cl
cmp eax, 0x6642f48a
jae 0x14003db8c
mov al, byte [rsp + 0x2f]
test al, 1
jne 0x14003dbfe
jmp 0x14003dc3a
mov r8, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x33cce0105c797578
movabs rdx, 0x33cce0105c797578
xor rax, rdx
sub rax, r8
xor edx, edx
sub rdx, 0xffffffffffffffff
add rax, rdx
xor edx, edx
sub rdx, rax
call fcn.1400216eb
jmp 0x14003dc89
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x50]
mov r10, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov r11, qword [rax + 8]
mov rcx, r11
add rcx, 8
add rcx, r10
xor eax, eax
cmp r11, 0
cmove rcx, rax
mov rax, rdx
xor rax, 0xffffffffffffffff
and rax, r10
xor r10, 0xffffffffffffffff
and rdx, r10
sub rdx, rax
call fcn.14003d0b0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
add rsp, 0x58
ret
int 6
enter 0xffffffffffffe9d2, 0xfffffffffffffff0
invalid
Function at 0x14004e7a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov byte [rbp - 9], dl
mov qword [rbp - 8], rcx
mov eax, dword [0x1401f3a00]
add eax, dword [0x1401f3a04]
mov ecx, 0x226dbe19
xor edx, edx
div ecx
mov ecx, eax
and ecx, ecx
xor ecx, 0xffffffff
mov eax, 0xfaa90a69
and eax, 0xfaa90a69
mov edx, 0xed444671
xor edx, 0x12bbb98e
xor eax, edx
mov edx, 0x634a8afe
xor edx, 0x9cb57501
xor ecx, edx
xor eax, 0xffffffff
or ecx, eax
mov edx, 0x69ee3200
xor edx, 0x9611cdff
mov eax, ecx
xor eax, edx
mov edx, 0x69795c34
xor edx, 0xd34455db
mov r8d, 0xf7711b86
xor r8d, 0x88ee479
xor edx, r8d
and eax, edx
mov edx, 0x9cb5295a
xor edx, 0x634ad6a5
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0xba3d09ef
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
cmp eax, 0x8dd4652e
jb 0x14004e925
mov eax, dword [0x1401f3a08]
mov ecx, dword [0x1401f3a0c]
xor ecx, 0x9739ab6e
xor edx, edx
div ecx
xor eax, 0xa33c38d7
imul eax, eax, 0x76c23a77
mov ecx, eax
not ecx
and ecx, 0xd228e65c
and eax, 0x2dd719a3
sub eax, ecx
mov dword [rbp - 0x10], eax
mov eax, 0x20
call fcn.1401f0aa0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
sub rsp, 0x20
call fcn.140045cab
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov edx, 0x20
sub rsp, 0x20
call fcn.140045cc6
mov al, byte [rbp - 9]
mov rdx, qword [rbp - 0x18]
add rsp, 0x20
mov cl, al
xor cl, 0xff
mov r8b, al
xor r8b, 0xff
and cl, r8b
mov r8b, 0xff
xor r8b, 7
mov r9b, 0xff
xor r9b, 7
and r8b, r9b
xor cl, 0xff
xor r8b, 0xff
and cl, r8b
mov r8b, 0x6f
xor r8b, 0x6e
shl r8b, cl
mov rcx, qword [rbp - 8]
shr al, 3
movzx eax, al
or r8b, byte [rdx + rax]
mov byte [rdx + rax], r8b
sub rsp, 0x20
call fcn.14004e4d0
mov eax, dword [rbp - 0x10]
add rsp, 0x20
cmp eax, 0x79d10850
jb 0x14004e84c
mov rsp, rbp
pop rbp
ret
pop rsi
outsd dx, dword [rsi]
xchg ebx, eax
xor ecx, ebp
invalid
Function at 0x14004ffa0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rdx
mov rax, rcx
mov rcx, rax
shl rcx, 1
mov qword [rsp + 0x40], rcx
cvtsi2sd xmm0, rax
movsd xmm1, qword [0x1402020f0]
mulsd xmm0, xmm1
movsd qword [rsp + 0x48], xmm0
cvtsi2sd xmm1, rcx
movsd qword [rsp + 0x50], xmm1
ucomisd xmm0, xmm1
jne 0x14004ffef
jp 0x14004ffef
jmp 0x140050140
mov eax, dword [0x1401f3a90]
mov ecx, dword [str.CA]
mov edx, 0x441565e5
xor edx, 0x52200c01
add eax, edx
add eax, ecx
mov ecx, 0x3a8408f2
xor ecx, 0x2cb16116
sub eax, ecx
sub eax, 0xc033d92
mov edx, eax
xor edx, 0xffffffff
and edx, 0x4697ee68
mov r8d, 0x641cfe43
xor r8d, 0x228b102b
mov ecx, 0xbde6fc7
xor ecx, 0xf4219038
xor r8d, ecx
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0x4697ee68
or eax, 0x4697ee68
imul eax, edx
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xcdbeddc3
mov r8d, 0xffffffff
xor r8d, 0xcdbeddc3
mov ecx, eax
and ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xcdbeddc3
mov r8d, 0xbbff7567
xor r8d, 0x7641a8a4
or eax, r8d
imul eax, edx
add eax, ecx
cmp eax, 0xce472150
jbe 0x140050161
movsd xmm1, qword [rsp + 0x48]
movsd xmm0, qword [rsp + 0x50]
mov eax, dword [0x1401f3a98]
xor edx, edx
div dword [0x1401f3a9c]
xor eax, 0x5446e9b9
mov ecx, 0xe63e926a
xor edx, edx
div ecx
mov ecx, 0xc08702e2
xor ecx, 0x3b864ace
xor edx, edx
div ecx
mov dword [rsp + 0x30], eax
subsd xmm0, xmm1
call fcn.1401f0b50
movaps xmm1, xmm0
movsd xmm0, qword [rsp + 0x48]
movsd qword [rsp + 0x28], xmm1
call fcn.1401f0b50
movsd xmm1, qword [rsp + 0x28]
mov eax, dword [rsp + 0x30]
movsd xmm2, qword [0x1402020f8]
mulsd xmm1, xmm2
ucomisd xmm0, xmm1
setb cl
mov byte [rsp + 0x37], cl
cmp eax, 0x7aba51fe
ja 0x1400500a4
mov cl, byte [rsp + 0x37]
mov al, 1
test cl, 1
mov byte [rsp + 0x27], al
jne 0x140050153
jmp 0x140050140
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x27], al
mov al, byte [rsp + 0x27]
and al, 1
movzx eax, al
add rsp, 0x58
ret
and qword [rdx - 0xc5163a], rdx
invalid
Function at 0x140051780
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x38], r9
mov dword [rsp + 0x44], r8d
mov rcx, rdx
mov qword [rsp + 0x48], rcx
mov rdx, qword [rsp + 0x98]
mov qword [rsp + 0x50], rdx
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x58], rax
test rdx, rdx
setns al
mov rcx, qword [rcx]
mov qword [rsp + 0x60], rcx
sub rcx, rdx
setg cl
and al, cl
test al, 1
jne 0x140051800
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x60]
movabs rax, 0xe7219fb41324aa52
sub rdx, rax
add rdx, 0xffffffffffffffff
movabs rax, 0xe7219fb41324aa52
add rdx, rax
call fcn.140016582
jmp 0x1400518de
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
mov r9d, dword [rsp + 0x44]
mov r8, rcx
add r8, 8
mov qword [rsp + 0x28], r8
mov rcx, qword [rcx + 8]
mov r8, rcx
add r8, 8
imul r10, rax, 0x18
add r8, r10
add r8, 8
mov dword [r8], r9d
add rcx, 8
imul rax, rax, 0x18
add rcx, rax
add rcx, 0x10
call fcn.14009ee54
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
cmp rax, rcx
jg 0x1400518be
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x30]
mov rax, 0xffffffffffffffff
xor rax, 0xffffffffffffffff
movabs r8, 0xf68c8fa3bb5ac67f
movabs r9, 0xf68c8fa3bb5ac67f
xor r8, r9
movabs r9, 0xc381e2b3bb04d711
movabs r10, 0xc381e2b3bb04d710
xor r9, r10
sub r8, r9
sub rax, r8
sub rdx, rax
call fcn.140016582
jmp 0x1400518de
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
add rax, 8
imul rdx, rdx, 0x18
add rax, rdx
mov qword [rax], rcx
mov eax, dword [0x1401f3b30]
mov ecx, 0x6b4c22e5
xor ecx, 0xb220dcc3
xor eax, ecx
mov ecx, dword [0x1401f3b34]
mov edx, 0xf5197f26
xor edx, 0xb0805722
xor ecx, edx
xor edx, edx
div ecx
sub eax, 0x59ff2a5d
mov edx, eax
and edx, 0x4ca87dae
mov ecx, 0x2732c483
xor ecx, 0x2732c481
imul ecx, edx
add eax, 0x4ca87dae
sub eax, ecx
sub eax, 0x3a2b814c
add eax, 0x12b3b433
add eax, 0x3a2b814c
mov ecx, 0xc7882c6e
xor ecx, 0xd8a18b4d
cmp eax, ecx
jb 0x140051999
mov eax, dword [0x1401f3b38]
or eax, dword [0x1401f3b3c]
mov ecx, 0x30d1d3a4
xor edx, edx
div ecx
mov ecx, 0x2c0d22bd
xor edx, edx
div ecx
mov ecx, 0xc5526ed1
xor ecx, 0x8d92fb3b
sub eax, ecx
sub eax, 0x1629e4c3
add eax, 0x48c095ea
mov ecx, 0x25247ce1
xor ecx, 0x8b27369b
cmp eax, ecx
je 0x14005194c
add rsp, 0x68
ret
adc eax, edx
popfq
shr cl, 0xaa
invalid
Function at 0x140059870
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], rcx
mov eax, dword [0x1401f3e30]
xor edx, edx
div dword [0x1401f3e34]
and eax, 0x9fc15f9
mov ecx, eax
xor ecx, 0x776f773c
mov edx, 0xffffffff
xor edx, 0x776f773c
and eax, edx
shl eax, 1
sub eax, ecx
mov ecx, 0x35528344
xor edx, edx
div ecx
mov ecx, 0xb019c99f
xor ecx, 0xc7e5cec1
cmp eax, ecx
je 0x140059a04
mov eax, dword [0x1401f3e38]
mov ecx, dword [0x1401f3e3c]
xor ecx, 0xc1af0cb2
sub eax, ecx
imul rax, rax, 0x395be779
shr rax, 0x3d
imul eax, eax, 0x4b037f5d
add eax, 0x646b00b4
mov dword [rbp - 0x10], eax
mov eax, 0x20
mov qword [rbp - 0x30], rax
call fcn.1401f0aa0
sub rsp, rax
mov rax, qword [rbp - 0x30]
mov rcx, rsp
mov qword [rbp - 0x28], rcx
call fcn.1401f0aa0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
sub rsp, 0x20
call fcn.140051260
add rsp, 0x20
mov qword [rbp - 0x18], rax
xor eax, eax
mov ecx, eax
sub rsp, 0x20
call fcn.140059227
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbp - 0x10]
add rsp, 0x20
mov cl, byte [rcx]
mov dl, 0x50
xor dl, 0x50
cmp cl, dl
sete cl
mov byte [rbp - 9], cl
cmp eax, 0xe8fc5cff
je 0x1400598c7
mov cl, byte [rbp - 9]
xor eax, eax
test cl, 1
mov qword [rbp - 0x38], rax
jne 0x140059979
jmp 0x1400599fb
mov ecx, 0x18
mov edx, 8
sub rsp, 0x20
call fcn.140016330
mov rcx, qword [rbp - 0x28]
mov rdx, qword [rbp - 8]
add rsp, 0x20
mov qword [rbp - 0x40], rax
sub rsp, 0x20
call fcn.14005979d
mov rcx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x40]
add rsp, 0x20
mov cl, byte [rcx]
mov dl, 0xc0
xor dl, 0xc0
cmp cl, dl
mov qword [rbp - 0x38], rax
jne 0x1400599fb
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x28]
mov r8, qword [rax]
mov qword [rdx], r8
mov r8, qword [rax + 8]
mov qword [rdx + 8], r8
mov rax, qword [rax + 0x10]
mov qword [rdx + 0x10], rax
sub rsp, 0x20
call fcn.14005929d
mov rax, qword [rbp - 0x40]
add rsp, 0x20
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x38]
mov rsp, rbp
pop rbp
ret
ret 0x65b6
Function at 0x14005b8d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x18], r8
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401f3ef0]
mov r8d, dword [0x1401f3ef4]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, r8d
and edx, ecx
mov r9d, r8d
xor r9d, 0xffffffff
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
imul ecx, eax, 0xf9ea5f61
sub ecx, 0x23f48704
mov edx, 0x5b579de6
xor edx, 0xa4a86219
mov eax, ecx
xor eax, edx
mov edx, ecx
xor edx, 0xffffffff
and eax, edx
mov edx, 0xffffffff
xor edx, 0xc47c2ecb
mov r8d, 0xffffffff
xor r8d, 0xc47c2ecb
and edx, r8d
or eax, edx
xor eax, 0xffffffff
or ecx, 0xc47c2ecb
xor ecx, 0xffffffff
xor eax, 0xffffffff
mov edx, 0xd9e502f4
xor edx, 0x261afd0b
xor ecx, edx
and eax, ecx
mov ecx, 0xb659c31c
xor ecx, 0xa4da18e
cmp eax, ecx
je 0x14005ba2a
mov eax, dword [0x1401f3ef8]
mov ecx, dword [0x1401f3efc]
xor edx, edx
div ecx
mov edx, eax
mov r8d, edx
add r8d, 0xbdfe372b
mov ecx, r8d
and ecx, 0xafd13a
xor r8d, 0x3f502ec5
mov eax, edx
mov edx, r8d
lea eax, [rax + rdx - 0x4201c8d5]
sub eax, ecx
or eax, 0xdd1dc83c
mov dword [rbp - 0x1c], eax
mov eax, 0x10
call fcn.1401f0aa0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
sub rsp, 0x20
call fcn.140051260
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
add rsp, 0x20
mov rax, qword [rbp - 0x10]
mov r9, qword [rax]
mov qword [rdx], r9
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14005a580
mov eax, dword [rbp - 0x1c]
add rsp, 0x20
cmp eax, 0xd5d3b764
je 0x14005b989
mov rsp, rbp
pop rbp
ret
and dword [rsi + 0x67], esp
adc al, 0xe9
push rsi
invalid
Function at 0x14005c9f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], rcx
mov r11d, dword [0x1401f3f70]
mov eax, dword [0x1401f3f74]
xor eax, 0xffffffff
add r11d, eax
add r11d, 1
mov eax, 0xf0fee365
xor eax, 0xfe7c383
and r11d, eax
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, 0xc7b3e7e7
xor r8d, 0x3e357704
mov eax, 0x62f9c7a4
xor eax, 0x9d06385b
xor r8d, eax
mov edx, 0xffffffff
xor edx, 0x5e5c0603
mov eax, ecx
and eax, 0x5e5c0603
and r11d, edx
mov r10d, 0xbf22d782
xor r10d, 0xe17ed181
mov r9d, r8d
and r9d, r10d
mov r10d, edx
and r10d, 0xf98690e3
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
xor ecx, 0xffffffff
or edx, 0x5e5c0603
and ecx, edx
or eax, ecx
and eax, 0xfe9c94bf
mov ecx, 0x456f9ab2
xor ecx, 0x3f59720b
cmp eax, ecx
je 0x14005cbed
mov eax, dword [0x1401f3f78]
mov r8d, dword [0x1401f3f7c]
mov edx, r8d
not edx
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, r8d
add eax, edx
sub eax, ecx
add eax, 0xb4e8eef4
mov dword [rbp - 0xc], eax
mov eax, 0x10
mov qword [rbp - 0x30], rax
call fcn.1401f0aa0
sub rsp, rax
mov rax, qword [rbp - 0x30]
mov rcx, rsp
mov qword [rbp - 0x20], rcx
call fcn.1401f0aa0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
mov ecx, 0x40
mov edx, 8
sub rsp, 0x20
call fcn.140016330
mov rcx, qword [rbp - 0x20]
add rsp, 0x20
mov rdx, rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x18], rdx
mov r8, qword [0x140208578]
mov qword [rdx], r8
lea r8, [0x1402021a8]
mov qword [rdx + 0x10], r8
mov qword [rcx], 0
mov qword [rcx + 8], 0
mov rdx, qword [rax]
sub rsp, 0x20
call fcn.14001e097
mov rcx, qword [rbp - 0x20]
add rsp, 0x20
lea rdx, [0x1402021d0]
sub rsp, 0x20
call fcn.14005cc00
mov rax, qword [rbp - 8]
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
add rsp, 0x20
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14005cc00
mov rax, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov rdx, qword [rax]
mov qword [rcx + 0x18], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 0x20], rax
mov qword [rcx + 8], 0
lea rdx, [0x1402021a8]
lea r8, [0x1402021b1]
lea r9, [0x1402021bf]
sub rsp, 0x30
mov qword [rsp + 0x20], 0x11b15f25
call fcn.140016090
mov eax, dword [rbp - 0xc]
add rsp, 0x30
cmp eax, 0x2f09068e
jb 0x14005caa5
mov rsp, rbp
pop rbp
ret
sidt [rsi]
jmp 0x14005caa5
Function at 0x14005d790
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov ecx, dword [0x1401f3fb0]
mov edx, dword [0x1401f3fb4]
mov eax, 0x598d8447
xor eax, 0xa6727bb8
xor edx, eax
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, eax
and ecx, 0xbd665935
shl ecx, 1
add eax, 0xbd665935
sub eax, ecx
or eax, 0x4dd98b3b
mov ecx, 0xdd380ac6
xor ecx, 0x986a6899
xor edx, edx
div ecx
mov ecx, 0xa96fdf74
xor ecx, 0xb3cc6d5e
cmp eax, ecx
jae 0x14005d887
mov eax, dword [0x1401f3fb8]
xor eax, 0x112005e4
mov ecx, dword [0x1401f3fbc]
and eax, ecx
add eax, 0xa70c99fe
imul rax, rax, 0x580d2c13
shr rax, 0x3d
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.1401f0aa0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
sub rsp, 0x20
call fcn.140051260
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x20]
add rsp, 0x20
mov rax, qword [rbp - 0x10]
mov r8, qword [rax]
mov qword [rdx], r8
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
sub rsp, 0x20
call fcn.14005d721
add rsp, 0x20
mov cl, al
mov eax, dword [rbp - 0x18]
mov byte [rbp - 0x11], cl
cmp eax, 0xfb73bd2a
je 0x14005d7f9
mov al, byte [rbp - 0x11]
and al, 1
movzx eax, al
mov rsp, rbp
pop rbp
ret
invalid