joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140228030
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14022806c
test edx, edx
je 0x14022809c
movzx eax, byte [0x14053c73d]
cmp al, 0x7d
je 0x140228064
mov cl, 0xef
nop word cs:[rax + rax]
mov al, 0xeb
lock cmpxchg byte [0x14053c73d], cl
je 0x14022810c
cmp al, 0x7d
jne 0x140228050
lea rax, [0x14053c730]
ret
test edx, edx
je 0x1402280dc
movzx eax, byte [0x14053c84d]
cmp al, 0xad
je 0x140228094
mov cl, 0xda
nop dword [rax]
mov al, 0x89
lock cmpxchg byte [0x14053c84d], cl
je 0x140228148
cmp al, 0xad
jne 0x140228080
lea rax, [0x14053c840]
ret
movzx eax, byte [0x14053c220]
movzx ecx, byte [0x14053d448]
add cl, 0xac
cmp al, cl
je 0x1402280d4
mov cl, 0xe8
nop word cs:[rax + rax]
mov al, 0x14
lock cmpxchg byte [0x14053c220], cl
je 0x140228178
cmp al, 0xe6
jne 0x1402280c0
lea rax, [0x14053c210]
ret
movzx eax, byte [0x14053cbed]
cmp al, 0xf7
je 0x140228104
mov cl, 0x60
nop dword [rax]
mov al, 0xcf
lock cmpxchg byte [0x14053cbed], cl
je 0x1402281c8
cmp al, 0xf7
jne 0x1402280f0
lea rax, [0x14053cbe0]
ret
xor eax, eax
lea rcx, [0x14053c730]
lea rdx, [0x1404558a0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140228138
inc rax
jmp 0x140228120
mov al, 0x7d
xchg byte [0x14053c73d], al
lea rax, [0x14053c730]
ret
xor eax, eax
lea rcx, [0x14053c840]
lea rdx, [0x1404559a0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1402281a8
inc rax
jmp 0x140228160
xor eax, eax
lea rcx, [0x14053c210]
lea rdx, [0x1404553a0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1402281b8
inc rax
jmp 0x140228190
mov al, 0xad
xchg byte [0x14053c84d], al
lea rax, [0x14053c840]
ret
mov al, 0xe6
xchg byte [0x14053c220], al
lea rax, [0x14053c210]
ret
xor edx, edx
lea rax, [0x14053cbe0]
lea rcx, [0x140455d10]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x1402281e0
mov al, 0xf7
xchg byte [0x14053cbed], al
lea rax, [0x14053cbe0]
ret
Function at 0x14022afe0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14022b01c
test edx, edx
je 0x14022b05c
movzx eax, byte [0x14053c6a1]
cmp al, 0x19
je 0x14022b014
mov cl, 0x2e
nop word [rax + rax]
mov al, 0x25
lock cmpxchg byte [0x14053c6a1], cl
je 0x14022b0fc
cmp al, 0x19
jne 0x14022b000
lea rax, [0x14053c690]
ret
test edx, edx
je 0x14022b0cc
movzx eax, byte [0x14053c203]
cmp al, 0x8c
je 0x14022b054
mov cl, 0x85
nop word cs:[rax + rax]
mov al, 0xb5
lock cmpxchg byte [0x14053c203], cl
je 0x14022b158
cmp al, 0x8c
jne 0x14022b040
lea rax, [0x14053c200]
ret
movzx eax, byte [0x14053c750]
nop word cs:[rax + rax]
cmp al, 0xff
je 0x14022b150
movzx ecx, byte [0x14053d448]
mov eax, r8d
xor al, 0x37
add al, cl
mov edx, r8d
xor dl, 0x35
add dl, cl
lock cmpxchg byte [0x14053c750], dl
jne 0x14022b070
xor eax, eax
lea rcx, [0x14053c740]
lea rdx, [0x1404558b0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x14022b148
inc rax
jmp 0x14022b0b0
movzx eax, byte [0x14053c83d]
cmp al, 0x57
je 0x14022b0f4
mov cl, 0x99
nop dword [rax]
mov al, 0xea
lock cmpxchg byte [0x14053c83d], cl
je 0x14022b198
cmp al, 0x57
jne 0x14022b0e0
lea rax, [0x14053c830]
ret
xor eax, eax
lea rcx, [0x14053c690]
lea rdx, [0x140455800]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x14022b138
inc rax
jmp 0x14022b110
mov al, 0x19
xchg byte [0x14053c6a1], al
lea rax, [0x14053c690]
ret
mov al, 0xff
xchg byte [0x14053c750], al
lea rax, [0x14053c740]
ret
xor eax, eax
lea rcx, [0x14053c200]
lea rdx, [0x140455390]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x14022b188
inc rax
jmp 0x14022b170
mov al, 0x8c
xchg byte [0x14053c203], al
lea rax, [0x14053c200]
ret
xor eax, eax
lea rcx, [0x14053c830]
lea rdx, [0x140455990]
xor r8d, 0x4186bf07
nop
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x14053d440]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 0xd
jl 0x14022b1b0
mov al, 0x57
xchg byte [0x14053c83d], al
lea rax, [0x14053c830]
ret
Function at 0x140261000
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140261056
mov eax, dword [0x140545328]
mov ecx, eax
xor ecx, 0x22932e3a
and eax, 0x22932e3a
lea eax, [rcx + rax*2]
cmp edx, eax
jne 0x140261096
movzx eax, byte [0x140545064]
cmp al, 0x60
je 0x14026104e
mov cl, 0x20
nop dword [rax + rax]
mov al, 0x5b
lock cmpxchg byte [0x140545064], cl
je 0x140261156
movzx edx, byte [0x14054532c]
add dl, 0xae
cmp al, dl
jne 0x140261030
lea rax, [0x140545060]
ret
test edx, edx
je 0x140261121
movzx eax, byte [0x1405451cd]
cmp al, 0xde
je 0x14026108e
mov cl, 0x8f
nop dword [rax + rax]
mov al, 0xe
lock cmpxchg byte [0x1405451cd], cl
je 0x1402611a8
movzx edx, byte [0x14054532c]
add dl, 0x2c
cmp al, dl
jne 0x140261070
lea rax, [0x1405451c0]
ret
movzx eax, byte [0x1405452dd]
nop dword [rax]
cmp al, 0xae
je 0x140261119
movzx ecx, byte [0x14054532c]
lea eax, [rcx - 0x27]
add cl, 0xad
lock cmpxchg byte [0x1405452dd], cl
jne 0x1402610a0
xor edx, edx
lea rax, [0x1405452d0]
lea rcx, [0x140459930]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140545328]
add edx, r8d
add edx, 0x22932e3b
cmp edx, 0xd
jl 0x1402610d0
movzx eax, byte [0x14054532c]
mov ecx, eax
xor cl, 0xfc
and al, 0x7c
add al, al
add al, cl
xchg byte [0x1405452dd], al
lea rax, [0x1405452d0]
ret
movzx eax, byte [0x14054514f]
cmp al, 0xbd
je 0x14026114e
mov cl, 0x1a
nop
mov al, 0x44
lock cmpxchg byte [0x14054514f], cl
je 0x1402611ef
movzx edx, byte [0x14054532c]
add dl, 0xb
cmp al, dl
jne 0x140261130
lea rax, [0x140545140]
ret
xor eax, eax
lea rcx, [0x140545060]
lea rdx, [0x1404596e0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x140261198
inc rax
jmp 0x140261170
mov al, 0x60
xchg byte [0x140545064], al
lea rax, [0x140545060]
ret
xor eax, eax
lea rcx, [0x1405451c0]
lea rdx, [0x140459820]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1402611d8
inc rax
jmp 0x1402611c0
movzx eax, byte [0x14054532c]
add al, 0x2c
xchg byte [0x1405451cd], al
lea rax, [0x1405451c0]
ret
xor eax, eax
lea rcx, [0x140545140]
lea rdx, [0x1404597a0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x140261218
inc rax
jmp 0x140261200
mov al, 0xbd
xchg byte [0x14054514f], al
lea rax, [0x140545140]
ret
Function at 0x140261290
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x1402612c9
test edx, edx
je 0x140261319
movzx eax, byte [0x1405451dc]
cmp al, 0x20
je 0x1402613f0
mov cl, 0x4c
nop
mov al, 0x19
lock cmpxchg byte [0x1405451dc], cl
je 0x1402613b5
cmp al, 0x20
jne 0x1402612b0
jmp 0x1402613f0
mov eax, r8d
xor eax, 0x3e4b9f70
add eax, dword [0x140545328]
cmp edx, eax
jne 0x140261375
movzx eax, byte [0x140545133]
mov ecx, r8d
xor cl, 0xb7
add cl, byte [0x14054532c]
cmp al, cl
je 0x140261510
mov cl, 0x99
nop dword [rax]
mov al, 0x22
lock cmpxchg byte [0x140545133], cl
je 0x14026146d
cmp al, 0xaf
jne 0x140261300
jmp 0x140261510
movzx eax, byte [0x14054521f]
movzx ecx, byte [0x14054532c]
mov edx, r8d
xor dl, 0x69
mov r9d, edx
xor r9b, cl
and dl, cl
add dl, dl
add dl, r9b
cmp al, dl
je 0x140261464
mov cl, 0x54
nop word cs:[rax + rax]
mov al, 0xf8
lock cmpxchg byte [0x14054521f], cl
je 0x1402613f9
mov edx, r8d
xor dl, 0x69
add dl, byte [0x14054532c]
cmp al, dl
jne 0x140261350
jmp 0x140261464
movzx eax, byte [0x14054522d]
cmp al, 0xe2
je 0x1402614ff
mov cl, 0x53
nop word cs:[rax + rax]
mov al, 0x22
lock cmpxchg byte [0x14054522d], cl
je 0x1402614b1
mov edx, r8d
xor dl, 0x7a
add dl, byte [0x14054532c]
cmp al, dl
jne 0x140261390
jmp 0x1402614ff
xor eax, eax
lea rcx, [0x1405451d0]
lea rdx, [0x140459830]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x1402613e8
inc rax
jmp 0x1402613d0
mov al, 0x20
xchg byte [0x1405451dc], al
lea rax, [0x1405451d0]
pop rsi
ret
xor r9d, r9d
lea rax, [0x140545210]
lea rcx, [0x140459870]
mov edx, r8d
xor edx, 0x3e4b9f71
xor r8d, 0x3e4b9f03
nop word [rax + rax]
movsxd r9, r9d
movzx r10d, byte [r9 + rcx]
mov r11d, r10d
xor r11b, r10b
not r11b
and r11b, byte [r9 + rax]
xor r11b, r10b
mov byte [r9 + rax], r11b
mov r10d, dword [0x140545328]
lea r11d, [rdx + r10]
mov esi, r9d
xor esi, r11d
and r9d, r11d
lea r9d, [rsi + r9*2]
add r10d, r8d
cmp r9d, r10d
jl 0x140261420
mov al, 0xd5
xchg byte [0x14054521f], al
lea rax, [0x140545210]
pop rsi
ret
xor eax, eax
lea rcx, [0x140545110]
lea rdx, [0x140459770]
xor r8d, 0x3e4b9f17
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140545328]
add r10d, r8d
cmp r9d, r10d
jge 0x140261508
inc rax
jmp 0x140261490
xor eax, eax
lea rcx, [0x140545220]
lea rdx, [0x140459880]
xor r8d, 0x3e4b9f71
nop dword [rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x140545328]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 0xd
jl 0x1402614d0
mov al, 0xe2
xchg byte [0x14054522d], al
lea rax, [0x140545220]
pop rsi
ret
mov al, 0xaf
xchg byte [0x140545133], al
lea rax, [0x140545110]
pop rsi
ret
Function at 0x140267ab0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140546e78]
movabs rcx, 0xf9a35477669cfa31
movabs rdx, 0xf3133d3fd397e6b7
add rdx, rcx
movabs r8, 0x9bbdac2fa780a04c
sub rdx, r8
sub rdx, rcx
mov rcx, rdx
xor rcx, rax
and rdx, rax
lea rax, [rcx + rdx*2]
add rax, r8
cmp qword [rbx + 0x18], rax
je 0x140267c8d
lea rdi, [rbx + 8]
cmp byte [0x14058fd81], 0
jne 0x140267b70
mov eax, 0xffff62cd
add eax, dword [0x1405458a4]
cdqe
add rax, qword [0x1405458b0]
mov rcx, rbx
call qword [case.0x1401460cb.0]
mov ecx, eax
mov edx, dword [0x14058fd78]
lea eax, [rdx - 1]
imul eax, edx
mov r8d, dword [0x140546e70]
mov edx, r8d
xor edx, 0x4aefac7c
mov r9d, r8d
and r9d, 0x4aefac7c
lea r9d, [rdx + r9*2]
xor edx, edx
div r9d
add r8d, 0x4aefac7a
cmp edx, r8d
je 0x140267bb6
nop
mov eax, 0x809adc47
sub eax, dword [0x1405458a4]
mov ecx, eax
xor ecx, 0x7f65c0ec
and eax, 0x7f65c0ec
lea eax, [rcx + rax*2]
mov ecx, dword [0x140546e70]
neg eax
add eax, ecx
add eax, 0x4aefac7a
cdqe
add rax, qword [0x1405458b0]
mov rcx, rbx
call qword [case.0x1401460cb.0]
test rbx, rbx
je 0x140267b70
jmp 0x140267b14
test cl, cl
je 0x140267bd0
mov eax, 0xffff62cd
add eax, dword [0x1405458a0]
cdqe
add rax, qword [0x1405458c0]
jmp 0x140267bea
mov eax, dword [0x1405458a8]
sub eax, dword [0x140546e70]
add eax, 0xb50fb653
cdqe
add rax, qword [0x1405458c8]
mov rcx, rsi
call qword [case.0x1401460cb.0]
mov r8, qword [rbx + 0x18]
cmp qword [rbx + 0x20], 0x10
jb 0x140267c02
mov rdi, qword [rbx + 8]
lea rbx, [rsi + 8]
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x20]
mov rdx, rax
sub rdx, rcx
cmp rdx, r8
jae 0x140267c43
mov eax, 0xffff62cd
add eax, dword [0x1405458ac]
cdqe
add rax, qword [0x1405458b8]
mov qword [rsp + 0x20], r8
mov rcx, rbx
mov rdx, r8
mov r9, rdi
call qword [case.0x1401460cb.0]
jmp 0x140267c8d
mov rdx, r8
not rdx
mov r9, rcx
xor r9, rdx
xor rdx, r8
and rdx, rcx
xor rdx, r8
and r9, rcx
movabs r10, 0x52d1ad84af96f83a
sub rdx, r10
lea r14, [rdx + r9*2]
add r14, r10
mov qword [rsi + 0x18], r14
cmp rax, 0x10
jb 0x140267c7d
mov rbx, qword [rsi + 8]
add rcx, rbx
mov rdx, rdi
call fcn.140430670
mov byte [rbx + r14], 0
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140274cf0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140274d2c
test edx, edx
je 0x140274d5c
movzx eax, byte [0x140547179]
cmp al, 0xf9
je 0x140274d24
mov cl, 0x37
nop word cs:[rax + rax]
mov al, 0x64
lock cmpxchg byte [0x140547179], cl
je 0x140274dcc
cmp al, 0xf9
jne 0x140274d10
lea rax, [0x140547170]
ret
test edx, edx
je 0x140274d8c
movzx eax, byte [0x140547110]
cmp al, 0xa4
je 0x140274d54
mov cl, 0x79
nop dword [rax]
mov al, 0x14
lock cmpxchg byte [0x140547110], cl
je 0x140274e36
cmp al, 0xa4
jne 0x140274d40
lea rax, [0x140547100]
ret
movzx eax, byte [0x14054718d]
cmp al, 0xb0
je 0x140274d84
mov cl, 0x46
nop dword [rax]
mov al, 0xcf
lock cmpxchg byte [0x14054718d], cl
je 0x140274e88
cmp al, 0xb0
jne 0x140274d70
lea rax, [0x140547180]
ret
movzx eax, byte [0x1405470d5]
movzx ecx, byte [0x1405478c8]
add cl, 0xc5
cmp al, cl
je 0x140274dc4
mov cl, 0x7c
nop word cs:[rax + rax]
mov al, 0xf
lock cmpxchg byte [0x1405470d5], cl
je 0x140274ec8
cmp al, 0xa5
jne 0x140274db0
lea rax, [0x1405470c0]
ret
xor eax, eax
lea rcx, [0x140547170]
lea rdx, [0x140459fb0]
nop dword [rax]
cdqe
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
xor r9b, r8b
mov r10d, r9d
not r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
mov byte [rax + rcx], r10b
mov r8d, dword [0x1405478d0]
mov r9d, r8d
xor r9d, 0x69369cf8
and r8d, 0x69369cf8
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 9
jl 0x140274de0
mov al, 0xf9
xchg byte [0x140547179], al
lea rax, [0x140547170]
ret
xor edx, edx
lea rax, [0x140547100]
lea rcx, [0x140459f50]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1405478d0]
add edx, r8d
add edx, 0x69369cf8
cmp edx, 0x10
jl 0x140274e50
movzx eax, byte [0x1405478c8]
add al, 0xc4
xchg byte [0x140547110], al
lea rax, [0x140547100]
ret
xor eax, eax
lea rcx, [0x140547180]
lea rdx, [0x140459fc0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140274eb8
inc rax
jmp 0x140274ea0
mov al, 0xb0
xchg byte [0x14054718d], al
lea rax, [0x140547180]
ret
xor edx, edx
lea rax, [0x1405470c0]
lea rcx, [0x140459f10]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1405478d0]
add edx, r8d
add edx, 0x69369cf8
cmp edx, 0x15
jl 0x140274ee0
mov al, 0xa5
xchg byte [0x1405470d5], al
lea rax, [0x1405470c0]
ret
Function at 0x14028dcb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x14054b0b0]
mov r8d, eax
xor r8d, 0xc0bc3fff
and eax, 0x40bc3fff
lea eax, [r8 + rax*2]
cmp ecx, eax
jne 0x14028dd0c
mov eax, 0xc0bc3fff
add eax, dword [0x14054b0b0]
cmp edx, eax
jne 0x14028dd38
movzx eax, byte [0x14054a404]
cmp al, 0x53
je 0x14028dd04
mov cl, 0x35
nop dword [rax]
mov al, 0xf
lock cmpxchg byte [0x14054a404], cl
je 0x14028de0a
cmp al, 0x53
jne 0x14028dcf0
lea rax, [0x14054a3f0]
ret
test edx, edx
je 0x14028dd6c
movzx eax, byte [0x14054a42a]
cmp al, 0x4b
je 0x14028dd30
mov cl, 0x31
nop dword [rax]
mov al, pe_nt_image_headers64
lock cmpxchg byte [0x14054a42a], cl
je 0x14028dd9c
cmp al, 0x4b
jne 0x14028dd20
lea rax, [0x14054a420]
ret
movzx eax, byte [0x14054a4c6]
movzx ecx, byte [0x14054b0c0]
add cl, 0x12
cmp al, cl
je 0x14028dd64
mov cl, 0xed
nop
mov al, 0xd2
lock cmpxchg byte [0x14054a4c6], cl
je 0x14028de6c
cmp al, 0x2d
jne 0x14028dd50
lea rax, [0x14054a4b0]
ret
movzx eax, byte [0x14054a414]
cmp al, 0x64
je 0x14028dd94
mov cl, 0x61
nop dword [rax]
mov al, 0x94
lock cmpxchg byte [0x14054a414], cl
je 0x14028deb5
cmp al, 0x64
jne 0x14028dd80
lea rax, [0x14054a410]
ret
xor eax, eax
lea rcx, [0x14054a420]
lea rdx, [0x14045b7c0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
mov r9d, dword [0x14054b0b0]
mov r10d, r9d
xor r10d, 0x40ea7758
and r9d, 0x40ea7758
lea r9d, [r10 + r9*2]
add r9d, 0x7fd1c8b1
cmp r8d, r9d
jge 0x14028ddfa
inc rax
jmp 0x14028ddb0
mov al, 0x4b
xchg byte [0x14054a42a], al
lea rax, [0x14054a420]
ret
xor edx, edx
lea rax, [0x14054a3f0]
lea rcx, [0x14045b790]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x14054b0b0]
mov r9d, edx
xor r9d, 0xb1744dd0
and edx, 0x31744dd0
lea edx, [r9 + rdx*2]
add edx, r8d
add edx, 0xf47f230
cmp edx, 0x14
jl 0x14028de20
movzx eax, byte [0x14054b0c0]
add al, 0x38
xchg byte [0x14054a404], al
lea rax, [0x14054a3f0]
ret
xor edx, edx
lea rax, [0x14054a4b0]
lea rcx, [0x14045b840]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0x7ffffffe
and r8d, edx
xor edx, 1
lea edx, [rdx + r8*2]
cmp edx, 0x16
jl 0x14028de80
mov al, 0x2d
xchg byte [0x14054a4c6], al
lea rax, [0x14054a4b0]
ret
xor eax, eax
lea rcx, [0x14054a410]
lea rdx, [0x14045b7b0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x14028dee8
inc rax
jmp 0x14028ded0
movzx eax, byte [0x14054b0c0]
mov ecx, eax
xor cl, 0x49
and al, 0x49
add al, al
add al, cl
xchg byte [0x14054a414], al
lea rax, [0x14054a410]
ret
Function at 0x1402c6980
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1402c69bc
test edx, edx
je 0x1402c6a3f
movzx eax, byte [0x140555363]
cmp al, 0x94
je 0x1402c69b4
mov cl, 0x2e
nop
mov al, 0x21
lock cmpxchg byte [0x140555363], cl
je 0x1402c6abc
cmp al, 0x94
jne 0x1402c69a0
lea rax, [0x140555340]
ret
test edx, edx
je 0x1402c6a6c
movzx eax, byte [0x1405551f0]
nop dword [rax + rax]
cmp al, 3
je 0x1402c6b1f
movzx ecx, byte [0x14055539c]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0x97
mov eax, r8d
and al, 0x68
or al, r9b
add al, cl
and dl, 0x5e
mov r9d, r8d
and r9b, 0xa1
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x1405551f0], r9b
jne 0x1402c69d0
xor eax, eax
lea rcx, [0x1405550f0]
lea rdx, [0x140461e00]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xff
jg 0x1402c6b17
inc rax
jmp 0x1402c6a20
movzx eax, byte [0x14055537f]
cmp al, 0x83
je 0x1402c6a64
mov cl, 0x85
nop dword [rax]
mov al, 0x20
lock cmpxchg byte [0x14055537f], cl
je 0x1402c6b27
cmp al, 0x83
jne 0x1402c6a50
lea rax, [0x140555370]
ret
movzx eax, byte [0x14055521e]
cmp al, 0x3b
je 0x1402c6ab4
nop word [rax + rax]
movzx ecx, byte [0x14055539c]
mov eax, r8d
xor al, 0xf3
add al, cl
mov edx, r8d
xor dl, 0xf6
add dl, cl
lock cmpxchg byte [0x14055521e], dl
je 0x1402c6b8b
mov ecx, r8d
xor cl, 0x9b
add cl, byte [0x14055539c]
cmp al, cl
jne 0x1402c6a80
lea rax, [0x140555200]
ret
xor eax, eax
lea rcx, [0x140555340]
lea rdx, [0x140462030]
nop dword [rax]
xor r8d, r8d
sub r8b, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
xor r10d, r10d
sub r10b, r9b
mov r9d, r8d
xor r9b, r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
neg r10b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1402c6b07
inc rax
jmp 0x1402c6ad0
mov al, 0x94
xchg byte [0x140555363], al
lea rax, [0x140555340]
ret
mov al, 3
xchg byte [0x1405551f0], al
lea rax, [0x1405550f0]
ret
xor eax, eax
lea rcx, [0x140555370]
lea rdx, [0x140462060]
mov r9d, r8d
xor r9d, 0xbb7172c0
nop word cs:[rax + rax]
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x140555398]
add r11d, r9d
cmp r10d, r11d
jge 0x1402c6b71
inc rax
jmp 0x1402c6b50
xor r8b, 0x53
add r8b, byte [0x14055539c]
xchg byte [0x14055537f], r8b
lea rax, [0x140555370]
ret
xor eax, eax
lea rcx, [0x140555200]
lea rdx, [0x140461f00]
xor r8d, 0xbb7172f2
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
mov r9d, dword [0x140555398]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 0x1e
jl 0x1402c6bb0
mov al, 0x3b
xchg byte [0x14055521e], al
lea rax, [0x140555200]
ret
Function at 0x1402da1f0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rcx
mov eax, dword [0x140590c2c]
cmp eax, 0x5f
jg 0x1402da220
mov eax, dword [0x140590c2c]
cmp eax, 0x5b
jl 0x1402da22d
nop word cs:[rax + rax]
mov eax, dword [0x140590c2c]
cmp eax, 0x4f
jge 0x1402da220
jmp 0x1402da208
mov esi, 0xfffffffe
test rdi, rdi
je 0x1402da416
cmp qword [rdi + 0x30], 0
je 0x1402da416
cmp qword [rdi + 0x38], 0
je 0x1402da416
mov r14, qword [rdi + 0x28]
test r14, r14
je 0x1402da416
cmp qword [r14], rdi
jne 0x1402da416
mov eax, dword [0x140590c28]
mov ecx, dword [0x140558f98]
not ecx
add ecx, eax
add ecx, 0x13c7bc34
imul ecx, eax
test cl, 1
jne 0x1402da2b2
mov ecx, dword [r14 + 8]
mov r8d, dword [0x140590c30]
mov edx, dword [0x140590c28]
lea eax, [rdx - 1]
imul eax, edx
mov r9d, 0x8d784e6a
add r9d, dword [0x140558f98]
xor edx, edx
div r9d
test edx, edx
je 0x1402da2e0
lea rbx, [0x1402e4a60]
mov bpl, 1
nop dword [rax]
mov ecx, 0x3d
call fcn.1403e8964
mov qword [0x140590c20], rax
mov rcx, rbx
call fcn.140408a64
test bpl, bpl
je 0x1402da2c0
jmp 0x1402da285
lea eax, [r8 + rcx]
add eax, 0xffffc0cc
cmp eax, 0x1f
ja 0x1402da416
mov rax, qword [rdi + 0x28]
mov qword [rax + 0x34], 0
mov dword [rax + 0x3c], 0
cmp qword [rdi + 0x30], 0
je 0x1402da416
cmp qword [rdi + 0x38], 0
je 0x1402da416
mov rax, qword [rdi + 0x28]
test rax, rax
je 0x1402da416
cmp qword [rax], rdi
jne 0x1402da416
mov ecx, dword [rax + 8]
mov edx, dword [0x140558f98]
add ecx, edx
add ecx, 0x8d780f34
cmp ecx, 0x20
setae cl
setb r8b
movzx edx, byte [0x14058edf8]
mov r9d, edx
xor r9b, 1
mov r10d, r8d
xor r10b, r9b
test r10b, r8b
jne 0x1402da372
and r9b, r8b
jne 0x1402da372
and dl, cl
je 0x1402da416
mov dword [rax + 0x24], 0
mov dword [rdi + 0x1c], 0
mov dword [rdi + 0xc], 0
mov qword [rdi + 0x20], 0
mov ecx, dword [rax + 0x10]
test ecx, ecx
je 0x1402da3b3
mov edx, 0x8d784e69
add edx, dword [0x140558f98]
mov r8d, ecx
xor r8d, edx
or edx, ecx
not edx
or edx, r8d
not edx
mov dword [rdi + 0x4c], edx
mov qword [rax + 8], 0x3f34
movabs rcx, 0xffffffff00000000
mov qword [rax + 0x14], rcx
mov dword [rax + 0x1c], 0x8000
mov qword [rax + 0x28], 0
mov ecx, 0x8d784e68
add ecx, dword [0x140558f98]
mov dword [rax + 0x48], ecx
mov dword [rax + 0x4c], 0
lea rcx, [rax + 0x550]
mov qword [rax + 0x88], rcx
mov qword [rax + 0x68], rcx
mov qword [rax + 0x60], rcx
movabs rcx, 0xffffffff00000001
mov qword [rax + 0x1be0], rcx
xor esi, esi
mov eax, dword [0x140590c28]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x1402da430
mov al, 1
test al, al
jne 0x1402da453
nop dword [rax]
mov eax, dword [0x140590c2c]
mov ecx, dword [0x140558f98]
mov edx, ecx
xor edx, 0x8d784ebc
and ecx, 0xd784ebc
lea ecx, [rdx + rcx*2]
cmp eax, ecx
jge 0x1402da430
jmp 0x1402da427
mov eax, esi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret