joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001b650
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x60
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov r8, qword [rcx]
mov rcx, 0xffffffffffffffff
xor rcx, 0xffffffffffffffff
xor eax, eax
sub rax, 1
sub rcx, rax
mov rax, r8
sub rax, rcx
mov qword [rsp + 0x58], rax
mov rdx, rax
and rdx, r8
shl rdx, 1
mov rcx, rax
add rcx, r8
Function at 0x14001faa0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], rcx
call fcn.14000a534
mov rcx, qword [rsp + 0x38]
add rax, 0x60
mov qword [rsp + 0x40], rax
add rcx, 8
mov qword [rsp + 0x48], rcx
xor eax, eax
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov qword [rsp + 0x30], rdx
cmp rax, rcx
jge 0x14001fb86
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.14001ab00
test al, 1
jne 0x14001fb15
jmp 0x14001fb6e
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
call fcn.140083830
mov rax, qword [rsp + 0x40]
mov al, byte [rax]
mov cl, 0x60
xor cl, 0x60
cmp al, cl
jne 0x14001fb9f
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov rcx, qword [rax + rcx*8 + 8]
movabs rdx, 0x881f4bbfb6c3d627
movabs rax, 0x881f4bbfb6c3d62f
xor rdx, rax
call fcn.14000de70
mov rax, qword [rsp + 0x28]
xor ecx, ecx
sub rcx, 1
sub rax, rcx
mov qword [rsp + 0x50], rax
jmp 0x14001facc
mov rax, qword [rsp + 0x30]
cmp rax, 0
je 0x14001fb9f
mov rcx, qword [rsp + 0x30]
call fcn.14000dddb
mov ecx, dword [0x1401d8d98]
mov edx, dword [0x1401d8d9c]
mov r8d, 0x7d832a62
xor r8d, 0x827cd59d
mov eax, ecx
xor eax, r8d
mov r9d, 0x29fb5b7e
xor r9d, 0xd604a481
mov r8d, ecx
xor r8d, r9d
and eax, r8d
mov r8d, edx
xor r8d, 0xffffffff
mov r9d, edx
xor r9d, 0xffffffff
and r8d, r9d
or eax, r8d
mov r8d, 0x5badfe82
xor r8d, 0xa452017d
xor eax, r8d
or ecx, edx
mov edx, 0x6901b299
xor edx, 0x96fe4d66
xor ecx, edx
or eax, ecx
mov ecx, 0xa6cce04
xor ecx, 0xf59331fb
xor eax, ecx
sub eax, 0x61fe207a
add eax, 0x2ed7e08c
mov ecx, 0x5e2daa1e
xor ecx, 0xa36b7f2d
xor eax, ecx
mov ecx, 0xb4eee902
xor ecx, 0x6b485b16
cmp eax, ecx
je 0x14001fc82
mov eax, dword [0x1401d8da0]
xor eax, 0x8340de42
and eax, dword [0x1401d8da4]
imul eax, eax, 0xe0ab91de
mov ecx, 0xc38b6a54
xor ecx, 0x23afd23f
or eax, ecx
mov ecx, 0x9009897d
xor ecx, 0xa95f5464
xor edx, edx
div ecx
cmp eax, 0xcf99ed59
jae 0x14001fc3f
add rsp, 0x58
ret
mov cl, 0xe
fnstsw word [rbp - 0x4b17]
dec dword [rax - 0x7d]
sub rsp, 0x38
mov qword [rsp + 0x28], rcx

Function at 0x140023861
Capabilities:
Encode data using xor

Disassembly:
and qword [rcx], 0
jmp fcn.140023410
Function at 0x140025490
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov rdx, qword [rcx]
movabs rcx, 0xfa3e079c3eaa34e5
movabs rax, 0x5c1f863c155cb1a
xor rcx, rax
mov rax, rdx
and rax, rcx
mov rcx, rdx
or rcx, 0xffffffffffffffff
add rax, rcx
mov qword [rsp + 0x50], rax
mov rcx, rax
xor rcx, rdx
movabs rdx, 0xd00c32acb8d91162
movabs r8, 0xd00c32acb8d91162
xor rdx, r8
cmp rcx, rdx
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x14002551e
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
add rcx, 8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
jmp 0x140025528
call fcn.140007bb8
jmp 0x140025716
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
cmp rax, rcx
jl 0x140025709
mov rax, qword [rsp + 0x28]
movabs rcx, 0xc87092f22873e599
movabs rdx, 0xc87092f22873e599
xor rcx, rdx
cmp rax, rcx
jl 0x140025578
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
cmp rax, qword [rcx]
jl 0x140025689
mov eax, dword [0x1401d9018]
mov edx, dword [0x1401d901c]
mov ecx, eax
xor ecx, 0xffffffff
mov r8d, edx
xor r8d, 0xffffffff
or ecx, r8d
and eax, edx
xor eax, 0xffffffff
and ecx, eax
xor ecx, 0xffffffff
mov eax, ecx
and eax, 0xf98bca0b
xor ecx, 0xf98bca0b
or eax, ecx
mov ecx, 0xfcb6d465
xor edx, edx
div ecx
mov ecx, eax
mov edx, 0xf842d4c3
xor edx, 0x98f4b6de
mov eax, ecx
and eax, edx
xor ecx, 0x60b6621d
or eax, ecx
mov ecx, 0xac093e65
xor ecx, 0x2ab5f783
cmp eax, ecx
ja 0x14002571b
mov eax, dword [0x1401d9020]
mov ecx, dword [0x1401d9024]
xor ecx, 0xba264872
xor edx, edx
div ecx
mov ecx, eax
mov edx, 0xe224b792
xor edx, 0x2948641d
mov eax, 0x6433474
xor eax, 0xf9bccb8b
xor edx, eax
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0x39bdf082
xor edx, edx
div ecx
mov r8d, 0x247843cb
xor r8d, 0xfb869564
mov ecx, 0xf614198a
xor ecx, 0x9ebe675
xor r8d, ecx
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
mov r8d, 0x4e145fe4
xor r8d, 0xb1eba01b
xor ecx, r8d
imul ecx, edx
mov edx, eax
and edx, 0xdffed6af
or eax, 0xdffed6af
imul eax, edx
add eax, ecx
mov dword [rsp + 0x24], eax
mov rcx, rdx
call fcn.140012270
mov eax, dword [rsp + 0x24]
cmp eax, 0x46509ca2
je 0x1400255e1
jmp 0x140025716
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
add rcx, 8
shl rax, 3
add rcx, rax
call fcn.1400252f0
mov rcx, qword [rsp + 0x28]
mov rax, rcx
add rax, 0xffffffffffffffff
mov rdx, rax
and rdx, rcx
movabs r8, 0x825f54dad21ef539
movabs r9, 0x825f54dad21ef53b
xor r8, r9
imul r8, rdx
mov rdx, rax
add rdx, rcx
sub rdx, r8
cmp rdx, 0
setl dl
cmp rcx, 0
setne cl
and cl, dl
test cl, 1
mov qword [rsp + 0x38], rax
jne 0x1400256ff
jmp 0x140025528
call fcn.140007bb8
jmp 0x140025716
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
add rsp, 0x58
ret
cwde
and dword [rdi - 0x142167f], esp
invalid
Function at 0x1400280a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1401d9128]
xor eax, 0x2949ba50
mov ecx, dword [0x1401d912c]
xor ecx, 0xec50eb1d
add eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x552c7ecb
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
mov edx, 0x4b4e26ba
xor edx, 0xe54b38d8
mov ecx, eax
and ecx, edx
shl ecx, 1
mov edx, 0xf4de20bf
xor edx, 0x5adb3edd
xor eax, edx
add eax, ecx
or eax, 0x5f98f21a
cmp eax, 0x55468672
jbe 0x1400281d2
mov eax, dword [0x1401d9130]
mov r8d, dword [0x1401d9134]
xor r8d, 0xcf4eb024
mov edx, 0x541ab560
xor edx, 0xabe54a9f
mov ecx, eax
xor ecx, edx
mov edx, r8d
and edx, ecx
mov ecx, 0xc6a3008
xor ecx, 0xf395cff7
mov r9d, r8d
xor r9d, ecx
mov ecx, eax
and ecx, r9d
imul ecx, edx
mov edx, eax
and edx, r8d
or eax, r8d
imul eax, edx
add eax, ecx
imul eax, eax, 0xe73c9004
and eax, 0x91b5a7ed
or eax, 0xd64431ae
mov dword [rsp + 0x38], eax
mov eax, 0x58a83837
xor eax, 0xef616c1b
mov dword [rsp + 0x34], eax
call fcn.14000a534
mov rcx, rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rax]
call fcn.1401641cf
mov rdx, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x34]
mov eax, dword [rsp + 0x38]
cmp byte [rdx + 0x60], 0
sete dl
mov byte [rsp + 0x3f], dl
cmp eax, ecx
jbe 0x140028107
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x1400281c2
jmp 0x1400281cc
mov rcx, qword [rsp + 0x40]
call fcn.140164230
nop
add rsp, 0x48
ret
cmp r13b, byte [0x14001aec3]
dec dword [rdi]
invalid

Function at 0x140028830
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1401d9168]
xor eax, 0xe79fad65
and eax, dword [0x1401d916c]
xor ecx, ecx
sub ecx, 0xe68fe210
add eax, ecx
add eax, 0x7c813e9
mov ecx, 0x925f6cfd
xor ecx, 0x7c74061e
sub eax, ecx
sub eax, 0x7c813e9
mov ecx, 0x5742c464
xor ecx, 0x5742c464
mov edx, 0x64ca02a
xor edx, 0xf9f3ab97
sub ecx, edx
sub eax, ecx
mov ecx, 0x7482b952
xor ecx, 0x8498373f
cmp eax, ecx
ja 0x14002890f
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov eax, dword [0x1401d9170]
mov r8d, dword [str.m2T]
xor r8d, 0x9ce5f886
sub eax, r8d
imul eax, eax, 0x2e9c1d30
sub eax, 0x9cf2b4c5
mov r8d, 0x977be552
xor r8d, 0xe22017b6
sub eax, r8d
mov dword [rsp + 0x2c], eax
mov qword [rcx], 0
mov qword [rcx + 8], 0
call fcn.1400287fd
mov eax, dword [rsp + 0x2c]
cmp eax, 0x874e312
jb 0x1400288a2
mov rax, qword [rsp + 0x40]
add rsp, 0x48
ret
xchg byte [rdi - 0x7516f59b], ah
invalid
Function at 0x14002c9b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], rcx
mov eax, dword [0x1401d9338]
mov ecx, dword [0x1401d933c]
mov edx, 0x3a4e1958
xor edx, 0x4368c284
xor ecx, edx
imul eax, ecx
mov ecx, 0x52211903
xor ecx, 0x81ebb8b7
and ecx, eax
xor ecx, 0xffffffff
add eax, 0xd3caa1b4
add eax, 1
add eax, ecx
imul eax, eax, 0xaee6b397
mov ecx, eax
xor ecx, 0x6dab2292
mov edx, 0xfa90a1f7
xor edx, 0x56f5e08
xor ecx, edx
and ecx, 0x6dab2292
shl ecx, 1
sub ecx, 0x6dab2292
sub eax, ecx
cmp eax, 0xdcd754fe
ja 0x14002cc2d
mov rcx, qword [rbp - 8]
mov eax, dword [0x1401d9340]
xor eax, 0x7c852a33
mov edx, dword [0x1401d9344]
add eax, edx
imul eax, eax, 0x346105df
mov edx, eax
not edx
and edx, 0x569b589b
and eax, 0xa964a764
sub eax, edx
mov edx, eax
not edx
mov r8d, eax
and r8d, 0xb6c2e22a
and edx, 0x493d1dd5
imul edx, r8d
mov r8d, eax
and r8d, 0x493d1dd5
or eax, 0x493d1dd5
imul eax, r8d
add eax, edx
mov dword [rbp - 0x1c], eax
mov eax, 0x10
call fcn.1401d7280
sub rsp, rax
mov eax, dword [rbp - 0x1c]
mov rdx, rsp
mov qword [rbp - 0x18], rdx
add rcx, 8
mov qword [rbp - 0x10], rcx
cmp eax, 0xc4eb7e54
je 0x14002ca2b
xor eax, eax
mov qword [rbp - 0x28], rax
jmp 0x14002cabe
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x38], rax
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov qword [rbp - 0x30], rdx
cmp rax, rcx
jge 0x14002cc09
mov ecx, dword [0x1401d9348]
mov edx, dword [0x1401d934c]
mov r8d, 0xb4b9fa06
xor r8d, 0x4b4605f9
mov eax, ecx
xor eax, r8d
mov r9d, 0x3e7d06e
xor r9d, 0xfc182f91
mov r8d, edx
xor r8d, r9d
or eax, r8d
and ecx, edx
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
mov ecx, 0x79796b5f
xor ecx, 0xbabfb0e8
sub eax, ecx
and eax, 0x6f2b7540
sub eax, 0x1fe067b8
mov ecx, 0xc577515c
xor ecx, 0xa898d28e
cmp eax, ecx
jae 0x14002cc36
mov rdx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x30]
mov r8d, dword [0x1401d9350]
imul r8d, dword [0x1401d9354]
mov r9d, 0xca684881
xor r9d, 0xa3516dbb
add r8d, r9d
add r8d, 0xae8d0ea2
mov r9d, 0x714819bd
xor r9d, 0x24fcb650
sub r8d, r9d
mov r9d, 0xa7f1a602
xor r9d, 0x97ca8a0
sub r8d, r9d
add r8d, 0xfb7cb71c
mov dword [rbp - 0x44], r8d
add rax, 8
shl rdx, 4
add rax, rdx
mov rdx, qword [rax]
mov qword [rcx], rdx
mov rax, qword [rax + 8]
mov qword [rcx + 8], rax
sub rsp, 0x20
call fcn.140029f60
mov rcx, qword [rbp - 0x38]
mov eax, dword [rbp - 0x44]
add rsp, 0x20
movabs rdx, 0xa7d4b42e1d16ceef
movabs r8, 0xa7d4b42e1d16ceee
xor rdx, r8
add rcx, rdx
mov qword [rbp - 0x40], rcx
cmp eax, 0x814afd02
je 0x14002cb49
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x28], rax
jmp 0x14002cabe
mov rax, qword [rbp - 0x30]
cmp rax, 0
je 0x14002cc28
mov rcx, qword [rbp - 0x30]
sub rsp, 0x20
call fcn.14000dddb
add rsp, 0x20
mov rsp, rbp
pop rbp
ret
invalid
out 0x86, al
jmp 0x14002cb49

Function at 0x14002d66c
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
xor eax, eax
mov edx, eax
call fcn.14002ce00
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
add rsp, 0x38
jmp 0x14002d120
Function at 0x1400302b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], rcx
mov ecx, dword [0x1401d94f0]
xor ecx, 0x9b5e3a8d
mov edx, dword [0x1401d94f4]
mov eax, ecx
and eax, edx
or ecx, edx
add eax, ecx
mov edx, eax
and edx, 0x8ce53a62
mov ecx, 0x8d594812
xor ecx, 0x8d594810
imul ecx, edx
add eax, 0x8ce53a62
sub eax, ecx
or eax, 0xcac7b9b
mov ecx, 0x4ad5d112
xor edx, edx
div ecx
cmp eax, 0x9ffa8b2e
jae 0x14003054c
mov eax, dword [0x1401d94f8]
imul eax, dword [0x1401d94fc]
and eax, 0x33c900ab
sub eax, 0xd5adc6af
mov ecx, 0x880ea2e
xor edx, edx
div ecx
mov dword [rsp + 0x44], eax
mov eax, 0xf1969184
xor eax, 0x8f3bd5fc
mov dword [rsp + 0x40], eax
call fcn.14002e6c0
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x40]
mov r9, rax
mov eax, dword [rsp + 0x44]
mov qword [rsp + 0x48], r9
mov rdx, qword [rdx]
mov qword [rsp + 0x50], rdx
cmp rdx, r8
setl dl
mov byte [rsp + 0x5f], dl
cmp eax, ecx
ja 0x140030313
mov rax, qword [rsp + 0x50]
mov cl, byte [rsp + 0x5f]
test cl, 1
mov qword [rsp + 0x38], rax
jne 0x14003039a
jmp 0x1400303e2
mov rax, qword [rsp + 0x68]
cmp rax, 0
jge 0x1400303c6
mov rcx, qword [rsp + 0x68]
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
call fcn.14000c4b0
jmp 0x140030547
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
call fcn.140014020
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov r8, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
mov r9, qword [rsp + 0x38]
mov rdx, qword [rax + 8]
movabs r10, 0x136dada9b45816d9
movabs rax, 0x136dada9b45816d9
xor r10, rax
add rdx, 8
lea rax, [0x1401e55c0]
cmp r9, r10
cmove rdx, rax
call fcn.1400300f1
mov rcx, rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rcx
cmp byte [rax], 0
jne 0x140030547
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
cmp rax, qword [rcx]
je 0x140030547
mov rax, qword [rsp + 0x30]
movabs rcx, 0x3cdc21bc0b169e00
movabs rdx, 0x3cdc21bc0b169e00
xor rcx, rdx
cmp rax, rcx
jge 0x140030493
mov rcx, qword [rsp + 0x30]
xor eax, eax
mov edx, eax
movabs r8, 0x7fffffffffffffff
call fcn.14000c4b0
jmp 0x140030547
mov eax, dword [0x1401d9500]
xor eax, 0x1056f3b6
and eax, dword [0x1401d9504]
mov ecx, 0xd31d489f
xor edx, edx
div ecx
mov ecx, eax
sub ecx, 0xbb523267
mov eax, ecx
and eax, 0xea3b5137
or ecx, 0xea3b5137
add eax, ecx
cmp eax, 0xbc85fb69
jae 0x140030555
mov rcx, qword [rsp + 0x60]
mov eax, dword [0x1401d9508]
and eax, dword [0x1401d950c]
mov r8d, 0x57aeed0a
xor edx, edx
div r8d
mov rdx, qword [rsp + 0x30]
mov r8d, eax
mov eax, 0xd73a9588
xor eax, 0x3336d37e
sub r8d, eax
mov eax, r8d
and eax, 0x9e5c4ad5
mov r9d, 0x1658ca24
xor r9d, 0x880480f1
or r8d, r9d
add eax, r8d
mov dword [rsp + 0x2c], eax
mov eax, 0x3a0024ec
xor eax, 0xf5f89527
mov dword [rsp + 0x28], eax
call fcn.140014020
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
cmp eax, ecx
ja 0x140030555
jmp 0x140030547
add rsp, 0x78
ret
int3
mov gs, word [rbx]
notrack jmp 0x1400304cf
Function at 0x1400307c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov word [rbp - 0xa], dx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401d9520]
xor eax, 0xf943d915
mov ecx, dword [0x1401d9524]
mov edx, 0x25504bbb
xor edx, 0x62dad8c3
xor ecx, edx
add eax, ecx
mov ecx, 0x41ae0fd6
xor ecx, 0xb8cdf6e2
add eax, ecx
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x9139c68f
add ecx, eax
xor eax, eax
sub eax, ecx
mov ecx, 0x6995be56
xor ecx, 0x77d05dfe
add eax, ecx
mov ecx, 0x60581b4c
xor ecx, 0x8cadbe78
sub eax, ecx
sub eax, 0x1e45e3a8
cmp eax, 0x86dba9aa
je 0x1400308c0
mov cx, word [rbp - 0xa]
mov eax, dword [0x1401d9528]
xor eax, 0x72203989
mov edx, dword [0x1401d952c]
sub eax, edx
mov edx, eax
or edx, 0x824810b1
xor edx, 0x12421293
or eax, 0x84080020
and eax, edx
or eax, 0x69b5ed4c
mov dword [rbp - 0x10], eax
mov eax, 0x10
call fcn.1401d7280
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
mov word [rax], cx
sub rsp, 0x20
call fcn.14002e6c0
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x18]
add rsp, 0x20
mov r8d, 2
sub rsp, 0x20
call fcn.14003074d
mov eax, dword [rbp - 0x10]
add rsp, 0x20
cmp eax, 0x5523dc23
jbe 0x14003083a
mov rsp, rbp
pop rbp
ret
cld
invalid

Function at 0x1400309a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov eax, dword [0x1401d9530]
xor edx, edx
div dword [0x1401d9534]
mov ecx, 0x6968a784
xor ecx, 0x7dad0034
mov edx, 0xe8b85697
xor edx, 0x1747a968
xor ecx, edx
add eax, ecx
add eax, 1
sub eax, 0xda8dc843
mov ecx, 0x583f1db8
xor edx, edx
div ecx
cmp eax, 0xc84dfddf
ja 0x140030aa4
mov rcx, qword [rbp - 0x10]
mov eax, dword [0x1401d9538]
xor eax, 0x591e2903
mov r10d, dword [0x1401d953c]
mov r9d, r10d
xor r9d, 0x140dd10e
xor r10d, 0xebf22ef1
mov r8d, eax
and r8d, r10d
mov edx, eax
or edx, r10d
not edx
imul edx, r8d
mov r8d, eax
and r8d, r9d
or eax, r9d
imul eax, r8d
add eax, edx
and eax, 0x864bb0f2
add eax, 0x25055f66
mov dword [rbp - 0x14], eax
mov eax, 0x567fdbb7
mov dword [rbp - 0x18], eax
mov eax, 0x10
call fcn.1401d7280
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
mov qword [rax], rcx
sub rsp, 0x20
call fcn.14002e6c0
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x20]
add rsp, 0x20
mov r8d, 8
sub rsp, 0x20
call fcn.14003074d
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0x14]
add rsp, 0x20
cmp eax, ecx
ja 0x1400309f6
mov rsp, rbp
pop rbp
ret
lahf
pop rsi
invalid
Function at 0x140039670
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov byte [rbp - 9], dl
mov qword [rbp - 8], rcx
mov eax, dword [0x1401d9890]
mov edx, dword [0x1401d9894]
xor edx, 0xd74beb43
mov ecx, eax
or ecx, ecx
xor ecx, 0xffffffff
mov r8d, edx
or r8d, r8d
xor r8d, 0xffffffff
xor ecx, 0xffffffff
mov r9d, 0xd9ec4d92
xor r9d, 0x2613b26d
xor r8d, r9d
and ecx, r8d
or eax, edx
mov edx, 0x9c29df5c
xor edx, 0x63d620a3
xor eax, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
and ecx, eax
add ecx, 0xac26990d
sub ecx, 0xa76b0e52
sub ecx, 0xac26990d
xor ecx, 0x8d7f34ff
mov eax, ecx
and eax, 0x5b08cd72
or ecx, 0x5b08cd72
add eax, ecx
cmp eax, 0xe28a1a0
jb 0x1400397ca
mov eax, dword [0x1401d9898]
xor eax, 0xbbb67247
mov ecx, dword [0x1401d989c]
or eax, ecx
add eax, 0x59fe9230
xor eax, 0x3a347acd
mov dword [rbp - 0x10], eax
mov eax, 0x20
call fcn.1401d7280
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
sub rsp, 0x20
call fcn.1400397d3
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
mov edx, 0x20
sub rsp, 0x20
call fcn.1400397ee
mov al, byte [rbp - 9]
mov rdx, qword [rbp - 0x18]
add rsp, 0x20
mov r8b, al
add r8b, 1
mov cl, al
xor cl, 0xff
or cl, 7
add cl, r8b
mov r9b, 1
shl r9b, cl
mov rcx, qword [rbp - 8]
shr al, 3
movzx eax, al
mov r8b, byte [rdx + rax]
and r8b, r8b
xor r8b, 0xff
and r9b, r9b
mov r10b, 0xed
xor r10b, 0x12
xor r9b, r10b
xor r8b, 0xff
xor r9b, 0xff
or r8b, r9b
mov byte [rdx + rax], r8b
sub rsp, 0x20
call fcn.140039390
mov eax, dword [rbp - 0x10]
add rsp, 0x20
cmp eax, 0x73da88f3
jae 0x140039703
mov rsp, rbp
pop rbp
ret
jmp qword [rcx + 0x16]
Function at 0x14003d7f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x38], rcx
call fcn.1400397d3
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x60], 0
mov rax, qword [rcx]
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x60]
xor eax, eax
mov r8d, eax
call fcn.14003432d
mov rcx, rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rcx
mov al, byte [rax]
mov cl, 0x9c
xor cl, 0x9c
cmp al, cl
jne 0x14003d997
mov eax, dword [0x1401d9a60]
mov edx, dword [0x1401d9a64]
mov ecx, eax
xor ecx, edx
mov r8d, 0x4a31b289
xor r8d, 0xb5ce4d76
xor edx, r8d
and eax, edx
shl eax, 1
sub eax, ecx
imul eax, eax, 0x87d8c727
xor ecx, ecx
sub ecx, 0x3139b915
sub eax, ecx
mov ecx, 0x419be729
xor ecx, 0x2f0503f8
or eax, ecx
mov ecx, 0x8738fd27
xor ecx, 0xce2445a0
cmp eax, ecx
je 0x14003d9a1
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
mov eax, dword [0x1401d9a68]
mov r9d, dword [0x1401d9a6c]
mov r8d, eax
and r8d, r9d
shl r8d, 1
add eax, r9d
sub eax, r8d
mov r8d, eax
and r8d, 0x63e88616
shl r8d, 1
add eax, 0x63e88616
sub eax, r8d
or eax, 0x203a71e7
sub eax, 0xa901ff0
cmp rcx, qword [rdx]
setne dl
cmp rcx, 0
sete cl
and cl, cl
xor cl, 0xff
and dl, dl
xor dl, 0xff
xor cl, 0xff
xor dl, 0xff
or cl, dl
mov byte [rsp + 0x37], cl
cmp eax, 0x7f3bf84d
jb 0x14003d8a9
mov al, byte [rsp + 0x37]
test al, 1
jne 0x14003d92f
jmp 0x14003d997
mov ecx, 0x40
mov edx, 8
call fcn.140012010
mov rcx, rax
mov rax, qword [0x1401ee7f0]
mov qword [rcx], rax
lea rax, [0x1401e8100]
mov qword [rcx + 0x10], rax
mov rax, qword [0x1401e8138]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1401e8140]
mov qword [rcx + 0x20], rax
mov qword [rcx + 8], 0
lea rdx, [0x1401e8100]
lea r8, [0x1401e810b]
lea r9, [0x1401e8114]
mov qword [rsp + 0x20], 0x56f73c3e
call fcn.140011f4f
mov rax, qword [rsp + 0x60]
add rsp, 0x68
ret
adc eax, 0xe9ed0230
invalid
Function at 0x1400406d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rcx
call fcn.1400397d3
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x60]
call fcn.1400401eb
mov cl, al
mov rax, qword [rsp + 0x48]
mov al, byte [rax]
test al, al
sete al
and al, cl
test al, 1
jne 0x140040731
jmp 0x140040866
mov ecx, dword [0x1401d9b70]
xor ecx, 0x77603b13
mov eax, dword [0x1401d9b74]
mov edx, 0x7529fbb6
xor edx, 0xc83f0290
xor eax, edx
imul ecx, eax
and ecx, 0x6f575f5a
mov eax, ecx
or eax, eax
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x7e4ddeff
mov r8d, 0xffffffff
xor r8d, 0x7e4ddeff
and edx, r8d
or eax, edx
xor eax, 0xffffffff
or ecx, 0x7e4ddeff
mov edx, 0xc73e91ff
xor edx, 0x38c16e00
xor ecx, edx
or eax, ecx
mov ecx, 0x31469400
xor ecx, 0xceb96bff
xor eax, ecx
add eax, 0x4bda966d
cmp eax, 0x9ed4134e
je 0x14004086f
mov rcx, qword [rsp + 0x40]
mov eax, dword [0x1401d9b78]
and eax, dword [0x1401d9b7c]
sub eax, 0x7099dbdf
sub eax, 0x46803b40
add eax, 0x7099dbdf
mov edx, 0xd48be159
xor edx, 0x50015bc5
xor eax, edx
imul eax, eax, 0x4f87ed76
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
movabs rdx, 0xf4f1c29c7f41ff55
movabs r8, 0xf4f1c29c7f41ff55
xor rdx, r8
cmp rcx, rdx
setg cl
mov byte [rsp + 0x37], cl
cmp eax, 0x6d4d45af
je 0x1400407b2
mov al, byte [rsp + 0x37]
test al, 1
jne 0x14004082a
jmp 0x140040866
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x28]
movabs rdx, 0x8d4ca60fc2ca43f6
movabs r8, 0x72b359f03d35bc09
xor rdx, r8
add rax, rdx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
call fcn.1400402b2
nop
add rsp, 0x88
ret
rol dword [rdx - 0x65], 1
movabs eax, dword [0x841f0fffffff3ae9]
add byte [rax], al
add byte [rax], al
add byte [rsi + 0x57], dl
push rsi
push rdi
Function at 0x140044e80
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x38], r8
mov rax, rdx
mov rdx, rax
imul rdx, rcx
mov qword [rsp + 0x40], rdx
cvtsi2sd xmm0, rcx
cvtsi2sd xmm1, rax
mulsd xmm0, xmm1
movsd qword [rsp + 0x48], xmm0
cvtsi2sd xmm1, rdx
movsd qword [rsp + 0x50], xmm1
ucomisd xmm0, xmm1
jne 0x140044ecc
jp 0x140044ecc
jmp 0x140044f17
movsd xmm1, qword [rsp + 0x48]
movsd xmm0, qword [rsp + 0x50]
subsd xmm0, xmm1
call fcn.1401d7330
movaps xmm1, xmm0
movsd xmm0, qword [rsp + 0x48]
movsd qword [rsp + 0x28], xmm1
call fcn.1401d7330
movsd xmm1, qword [rsp + 0x28]
movsd xmm2, qword [0x1401e81a0]
mulsd xmm1, xmm2
mov al, 1
ucomisd xmm0, xmm1
mov byte [rsp + 0x37], al
jb 0x140044f2a
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
xor eax, eax
mov byte [rsp + 0x37], al
mov al, byte [rsp + 0x37]
mov byte [rsp + 0x27], al
mov eax, dword [0x1401d9d70]
xor eax, 0xfb110deb
sub eax, dword [0x1401d9d74]
imul eax, eax, 0x2557de3b
or eax, 0xd0b6ee46
mov ecx, 0x5dab47d9
xor edx, edx
div ecx
cmp eax, 0x65fae3c8
je 0x140044faa
mov eax, dword [0x1401d9d78]
mov ecx, dword [0x1401d9d7c]
xor ecx, 0xe2d81cd8
xor edx, edx
div ecx
mov ecx, 0x7e93dcd6
xor ecx, 0x102ceb8
xor edx, edx
div ecx
and eax, 0xa10f0d37
or eax, 0x3ed4d1d3
cmp eax, 0x53155528
ja 0x140044f62
mov al, byte [rsp + 0x27]
and al, 1
movzx eax, al
add rsp, 0x58
ret
invalid
Function at 0x140049b50
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x130
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x70], rcx
mov eax, 0x10
mov qword [rbp + 0x58], rax