joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a79d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, 0x5b65d711
add eax, dword [0x1405ff11c]
cmp ecx, eax
jne 0x1400a7a7c
test edx, edx
je 0x1400a7af9
movzx eax, byte [0x1405fe3b0]
nop word cs:[rax + rax]
cmp al, 0xf9
je 0x1400a7b31
movzx ecx, byte [0x1405ff118]
mov edx, ecx
not dl
mov r8d, ecx
and r8b, 0xa9
mov eax, ecx
and al, 0x29
or al, dl
and dl, 0x56
or dl, r8b
not al
add al, al
add al, dl
add cl, 0xd7
lock cmpxchg byte [0x1405fe3b0], cl
jne 0x1400a7a00
xor eax, eax
lea rcx, [0x1405fe3a0]
lea rdx, [0x14052ea40]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1400a7b29
inc rax
jmp 0x1400a7a50
xor eax, eax
sub eax, dword [0x1405ff11c]
mov ecx, eax
xor ecx, 0xa49a28ef
and eax, 0x249a28ef
lea eax, [rcx + rax*2]
add edx, eax
jne 0x1400a7ac9
movzx eax, byte [0x1405fe295]
cmp al, 0x76
je 0x1400a7b77
mov cl, 0x83
nop dword [rax]
mov al, 6
lock cmpxchg byte [0x1405fe295], cl
je 0x1400a7b3a
cmp al, byte [0x1405ff118]
jne 0x1400a7ab0
jmp 0x1400a7b77
movzx eax, byte [0x1405fe393]
cmp al, 0xbe
je 0x1400a7be6
mov cl, 0xfa
nop word [rax + rax]
mov al, 0x35
lock cmpxchg byte [0x1405fe393], cl
je 0x1400a7b80
cmp al, 0xbe
jne 0x1400a7ae0
jmp 0x1400a7be6
movzx eax, byte [0x1405fe5ad]
cmp al, 0x85
je 0x1400a7c84
mov cl, 0xc8
nop word [rax + rax]
mov al, 0x93
lock cmpxchg byte [0x1405fe5ad], cl
je 0x1400a7bef
cmp al, 0x85
jne 0x1400a7b10
jmp 0x1400a7c84
mov al, 0xf9
xchg byte [0x1405fe3b0], al
lea rax, [0x1405fe3a0]
pop rbx
ret
xor edx, edx
lea rax, [0x1405fe280]
lea rcx, [0x14052e930]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x1400a7b50
mov al, 0x76
xchg byte [0x1405fe295], al
lea rax, [0x1405fe280]
pop rbx
ret
xor eax, eax
lea rcx, [0x1405fe390]
lea rdx, [0x14052ea30]
mov r8d, 0x5b65d714
nop word cs:[rax + rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
not r11b
not r10b
mov ebx, r11d
xor bl, r10b
and bl, r11b
and r10b, r9b
or r10b, bl
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x1405ff11c]
add r10d, r8d
cmp r9d, r10d
jge 0x1400a7bde
inc rax
jmp 0x1400a7ba0
mov al, 0xbe
xchg byte [0x1405fe393], al
lea rax, [0x1405fe390]
pop rbx
ret
xor r8d, r8d
lea rax, [0x1405fe5a0]
lea rcx, [0x14052ec30]
mov edx, 0x5b65d71e
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rax]
movzx r10d, byte [r8 + rcx]
mov r11d, r10d
not r11b
mov ebx, r9d
xor bl, r11b
not bl
and bl, r10b
and r11b, r9b
mov r9d, r11d
xor r9b, r11b
not r9b
and r9b, bl
and bl, r11b
xor r9b, r11b
or r9b, bl
mov byte [r8 + rax], r9b
mov r9d, 0xfea714c4
sub r9d, r8d
mov r8d, r9d
add r8d, r8d
neg r8d
add r8d, r9d
add r8d, 0xfea714c5
mov r9d, dword [0x1405ff11c]
add r9d, edx
cmp r8d, r9d
jl 0x1400a7c10
movzx eax, byte [0x1405ff118]
add al, 0xf
xchg byte [0x1405fe5ad], al
lea rax, [0x1405fe5a0]
pop rbx
ret
Function at 0x1400a7d60
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
test ecx, ecx
je 0x1400a7db2
test edx, edx
je 0x1400a7de9
movzx eax, byte [0x1405fe3ee]
cmp al, 0x86
je 0x1400a7eb9
mov cl, 0x60
nop dword [rax + rax]
mov al, 0x30
lock cmpxchg byte [0x1405fe3ee], cl
je 0x1400a7e79
movzx edx, byte [0x1405ff118]
mov r8d, edx
xor r8b, 0xb1
and dl, 0x31
add dl, dl
add dl, r8b
add dl, 0x5f
cmp al, dl
jne 0x1400a7d80
jmp 0x1400a7eb9
test edx, edx
je 0x1400a7e4b
movzx eax, byte [0x1405fe53f]
cmp al, 0xb3
je 0x1400a7f67
mov cl, 0x19
nop dword [rax + rax]
mov al, 0xa7
lock cmpxchg byte [0x1405fe53f], cl
je 0x1400a7ec5
cmp al, 0xb3
jne 0x1400a7dd0
jmp 0x1400a7f67
movzx eax, byte [0x1405fe516]
cmp al, 0xee
je 0x1400a7f7b
mov cl, 0x4e
nop word [rax + rax]
mov al, 0xca
lock cmpxchg byte [0x1405fe516], cl
je 0x1400a7ef8
movzx edx, byte [0x1405ff118]
mov r8d, edx
not r8b
mov r9d, edx
and r9b, 0x87
mov r10d, r8d
and r10b, 0x78
or r10b, r9b
xor dl, 0x78
and r8b, 7
or r8b, dl
not r8b
add r8b, r8b
add r8b, r10b
cmp al, r8b
jne 0x1400a7e00
jmp 0x1400a7f7b
movzx eax, byte [0x1405fe2b2]
cmp al, 0x38
je 0x1400a8024
mov cl, 0xbc
nop dword [rax]
mov al, 0xce
lock cmpxchg byte [0x1405fe2b2], cl
je 0x1400a7f87
cmp al, 0x38
jne 0x1400a7e60
jmp 0x1400a8024
xor edx, edx
lea rax, [0x1405fe3e0]
lea rcx, [0x14052ea70]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1405ff11c]
add edx, r8d
add edx, 0x5b65d712
cmp edx, 0xe
jl 0x1400a7e90
mov al, 0x86
xchg byte [0x1405fe3ee], al
lea rax, [0x1405fe3e0]
jmp 0x1400a802b
xor eax, eax
lea rcx, [0x1405fe530]
lea rdx, [0x14052ebc0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1400a7f5f
inc rax
jmp 0x1400a7ee0
xor eax, eax
lea rcx, [0x1405fe510]
lea rdx, [0x14052eba0]
mov r8d, 0x5b65d717
nop
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r10d
not r11b
mov ebx, r9d
and bl, r11b
xor r11b, r9b
not r9b
mov esi, r9d
xor sil, r10b
or bl, sil
not bl
and r9b, r10b
or r9b, r11b
not r9b
or r9b, bl
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405ff11c]
add r10d, r8d
cmp r9d, r10d
jge 0x1400a7f73
inc rax
jmp 0x1400a7f10
mov al, 0xb3
xchg byte [0x1405fe53f], al
lea rax, [0x1405fe530]
jmp 0x1400a802b
mov al, 0xee
xchg byte [0x1405fe516], al
lea rax, [0x1405fe510]
jmp 0x1400a802b
xor edx, edx
lea rax, [0x1405fe2a0]
lea rcx, [0x14052e950]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, dword [0x1405ff11c]
mov r9d, r8d
xor r9d, 0xf55c8b4c
and r8d, 0x755c8b4c
lea r8d, [r9 + r8*2]
add r8d, 0x66094bc6
mov r9d, edx
not r9d
mov r10d, r9d
and r10d, r8d
mov r11d, edx
xor edx, r8d
not r8d
and r11d, r8d
or r11d, r10d
and r8d, r9d
or r8d, edx
not r8d
add r8d, r8d
mov edx, r11d
xor edx, r8d
and r8d, r11d
lea edx, [rdx + r8*2]
cmp edx, 0x12
jl 0x1400a7fa0
mov al, 0x38
xchg byte [0x1405fe2b2], al
lea rax, [0x1405fe2a0]
pop rbx
pop rsi
ret
Function at 0x1400a8060
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x5b65d711
add eax, dword [0x1405ff11c]
cmp ecx, eax
jne 0x1400a809c
test edx, edx
je 0x1400a80e1
movzx eax, byte [0x1405fe49f]
cmp al, 0xe1
je 0x1400a8094
mov cl, 0xe6
mov al, 0x64
lock cmpxchg byte [0x1405fe49f], cl
je 0x1400a813c
cmp al, 0xe1
jne 0x1400a8080
lea rax, [0x1405fe490]
ret
test edx, edx
je 0x1400a810c
movzx eax, byte [0x1405fe336]
cmp al, 0x4e
je 0x1400a80d9
nop dword [rax + rax]
movzx ecx, byte [0x1405ff118]
lea eax, [rcx - 0x2c]
add cl, 0x12
lock cmpxchg byte [0x1405fe336], cl
je 0x1400a8186
movzx ecx, byte [0x1405ff118]
add cl, 0xd8
cmp al, cl
jne 0x1400a80b0
lea rax, [0x1405fe320]
ret
movzx eax, byte [0x1405fe54d]
cmp al, 0x2d
je 0x1400a8104
mov cl, 0x39
nop
mov al, 0x9c
lock cmpxchg byte [0x1405fe54d], cl
je 0x1400a81dc
cmp al, 0x2d
jne 0x1400a80f0
lea rax, [0x1405fe540]
ret
movzx eax, byte [0x1405fe42c]
cmp al, 0x1c
je 0x1400a8134
mov cl, 0x53
nop dword [rax]
mov al, 0xbe
lock cmpxchg byte [0x1405fe42c], cl
je 0x1400a8221
cmp al, 0x1c
jne 0x1400a8120
lea rax, [0x1405fe410]
ret
xor edx, edx
lea rax, [0x1405fe490]
lea rcx, [0x14052eb20]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x1400a8150
movzx eax, byte [0x1405ff118]
add al, 0x6b
xchg byte [0x1405fe49f], al
lea rax, [0x1405fe490]
ret
xor eax, eax
lea rcx, [0x1405fe320]
lea rdx, [0x14052e9c0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x15
jg 0x1400a81cc
inc rax
jmp 0x1400a81a0
mov al, 0x4e
xchg byte [0x1405fe336], al
lea rax, [0x1405fe320]
ret
xor eax, eax
lea rcx, [0x1405fe540]
lea rdx, [0x14052ebd0]
mov r8d, 0x5b65d71e
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405ff11c]
add r10d, r8d
cmp r9d, r10d
jge 0x1400a827b
inc rax
jmp 0x1400a8200
xor edx, edx
lea rax, [0x1405fe410]
lea rcx, [0x14052eaa0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0x627f1ff2
and edx, 0x627f1ff2
lea edx, [r8 + rdx*2]
add edx, 0x9d80e00f
cmp edx, 0x1c
jl 0x1400a8240
mov al, 0x1c
xchg byte [0x1405fe42c], al
lea rax, [0x1405fe410]
ret
mov al, 0x2d
xchg byte [0x1405fe54d], al
lea rax, [0x1405fe540]
ret
Function at 0x1400a85c0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400a861c
mov eax, dword [0x1405ff11c]
mov ecx, eax
xor ecx, 0x5b65d711
not eax
and eax, 0x249a28ee
or eax, ecx
not eax
lea eax, [rcx + rax*2]
cmp edx, eax
jne 0x1400a865c
movzx eax, byte [0x1405fe315]
cmp al, 0x5a
je 0x1400a8614
mov cl, 0xcb
nop word cs:[rax + rax]
mov al, 0xdc
lock cmpxchg byte [0x1405fe315], cl
je 0x1400a86bc
cmp al, 0x5a
jne 0x1400a8600
lea rax, [0x1405fe300]
ret
mov eax, 0x5b65d711
add eax, dword [0x1405ff11c]
cmp edx, eax
jne 0x1400a868c
movzx eax, byte [0x1405fe355]
cmp al, 0xca
je 0x1400a8654
mov cl, 0xa9
nop dword [rax + rax]
mov al, 0xfa
lock cmpxchg byte [0x1405fe355], cl
je 0x1400a8748
cmp al, 0xca
jne 0x1400a8640
lea rax, [0x1405fe340]
ret
movzx eax, byte [0x1405fe473]
cmp al, 0x3b
je 0x1400a8684
mov cl, 0x9c
nop dword [rax]
mov al, 0x4b
lock cmpxchg byte [0x1405fe473], cl
je 0x1400a870b
cmp al, 0x3b
jne 0x1400a8670
lea rax, [0x1405fe450]
ret
movzx eax, byte [0x1405fe4fb]
cmp al, 0x30
je 0x1400a86b4
mov cl, 0x76
nop dword [rax]
mov al, 0x98
lock cmpxchg byte [0x1405fe4fb], cl
je 0x1400a8778
cmp al, 0x30
jne 0x1400a86a0
lea rax, [0x1405fe4f0]
ret
xor edx, edx
lea rax, [0x1405fe300]
lea rcx, [0x14052e9a0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
add edx, 0xf53b975d
mov r8d, edx
xor r8d, 0xac468a4
and edx, 0xac468a4
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x1400a86d0
mov al, 0x5a
xchg byte [0x1405fe315], al
lea rax, [0x1405fe300]
ret
xor eax, eax
lea rcx, [0x1405fe450]
lea rdx, [0x14052eae0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1400a8738
inc rax
jmp 0x1400a8720
mov al, 0x3b
xchg byte [0x1405fe473], al
lea rax, [0x1405fe450]
ret
xor eax, eax
lea rcx, [0x1405fe340]
lea rdx, [0x14052e9e0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1400a87a8
inc rax
jmp 0x1400a8760
xor eax, eax
lea rcx, [0x1405fe4f0]
lea rdx, [0x14052eb80]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x1400a87b8
inc rax
jmp 0x1400a8790
mov al, 0xca
xchg byte [0x1405fe355], al
lea rax, [0x1405fe340]
ret
mov al, 0x30
xchg byte [0x1405fe4fb], al
lea rax, [0x1405fe4f0]
ret
Function at 0x1400a8820
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400a886c
test edx, edx
je 0x1400a88bc
movzx eax, byte [0x1405fe4c6]
movzx ecx, byte [0x1405ff118]
add cl, 0x8a
cmp al, cl
je 0x1400a8864
mov cl, 0xd5
nop word cs:[rax + rax]
mov al, 0xc7
lock cmpxchg byte [0x1405fe4c6], cl
je 0x1400a891c
test al, al
jne 0x1400a8850
lea rax, [0x1405fe4a0]
ret
mov eax, 0x5b65d711
add eax, dword [0x1405ff11c]
cmp edx, eax
jne 0x1400a88f2
movzx eax, byte [0x1405fe563]
movzx ecx, byte [0x1405ff118]
add cl, 0x36
cmp al, cl
je 0x1400a88b4
mov cl, 0x5b
nop word cs:[rax + rax]
mov al, 0x8d
lock cmpxchg byte [0x1405fe563], cl
je 0x1400a89b5
cmp al, 0xac
jne 0x1400a88a0
lea rax, [0x1405fe550]
ret
movzx eax, byte [0x1405fe2d8]
cmp al, 0x2e
je 0x1400a88ea
mov cl, 0xff
nop dword [rax]
mov al, 0x77
lock cmpxchg byte [0x1405fe2d8], cl
je 0x1400a8958
movzx edx, byte [0x1405ff118]
add dl, 0xb8
cmp al, dl
jne 0x1400a88d0
lea rax, [0x1405fe2c0]
ret
movzx eax, byte [0x1405fe266]
cmp al, 0x6e
je 0x1400a8914
mov cl, 0xdf
nop
mov al, 0xce
lock cmpxchg byte [0x1405fe266], cl
je 0x1400a89e8
cmp al, 0x6e
jne 0x1400a8900
lea rax, [0x1405fe260]
ret
xor eax, eax
lea rcx, [0x1405fe4a0]
lea rdx, [0x14052eb30]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x25
jg 0x1400a8948
inc rax
jmp 0x1400a8930
xor eax, eax
xchg byte [0x1405fe4c6], al
lea rax, [0x1405fe4a0]
ret
xor edx, edx
lea rax, [0x1405fe2c0]
lea rcx, [0x14052e970]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, dword [0x1405ff11c]
add edx, r8d
add edx, 0x5b65d712
cmp edx, 0x18
jl 0x1400a8970
mov al, 0x2e
xchg byte [0x1405fe2d8], al
lea rax, [0x1405fe2c0]
ret
xor eax, eax
lea rcx, [0x1405fe550]
lea rdx, [0x14052ebe0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x12
jg 0x1400a8a21
inc rax
jmp 0x1400a89d0
xor eax, eax
lea rcx, [0x1405fe260]
lea rdx, [0x14052e910]
mov r8d, 0x5b65d717
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405ff11c]
add r10d, r8d
cmp r9d, r10d
jge 0x1400a8a31
inc rax
jmp 0x1400a8a00
mov al, 0xac
xchg byte [0x1405fe563], al
lea rax, [0x1405fe550]
ret
mov al, 0x6e
xchg byte [0x1405fe266], al
lea rax, [0x1405fe260]
ret
Function at 0x1400b1e30
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
mov rbx, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400b1e56
mov rdi, qword [rdi]
lea r14, [rsi + 8]
movabs rax, 0xdd20170550cb7793
add rax, qword [0x14060e2f8]
cmp rbx, rax
jae 0x1400b1e84
mov eax, dword [0x140693cec]
cmp eax, 0x28
jg 0x1400b1f70
jmp 0x1400b1f3d
mov eax, dword [0x140693cec]
cmp eax, 0x32
nop dword [rax]
mov r15, rbx
or r15, 0xf
movabs rax, 0x7fffffffffffffff
cmp r15, rax
cmovae r15, rax
mov eax, dword [0x140693ce8]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
mov eax, dword [0x14060e2f4]
mov edx, eax
xor edx, 0x304ed2e
and eax, 0x304ed2e
lea eax, [rdx + rax*2]
cmp ecx, eax
jne 0x1400b1e90
cmp r15, 0xfff
jb 0x1400b1f09
lea rcx, [r15 + 0x28]
mov edx, 0xe3fba6d5
mov r8d, 0x30b3869b
call fcn.1400a8810
lea rdx, [rax + 0x27]
mov ecx, edx
not ecx
xor rdx, 0xffffffffffffffe0
and ecx, 0x1f
or rcx, rdx
not rcx
mov qword [rcx - 8], rax
jmp 0x1400b1f20
lea rcx, [r15 + 1]
mov edx, 0xe3fba6d5
mov r8d, 0x30b3869b
call fcn.1400a8810
mov rcx, rax
mov qword [r14], rcx
mov rax, rbx
xor rax, 1
mov edx, ebx
and edx, 1
lea r8, [rax + rdx*2]
mov rdx, rdi
call fcn.140511c70
jmp 0x1400b1f8a
movups xmm0, xmmword [rdi]
movups xmmword [r14], xmm0
mov ecx, dword [0x140693ce8]
lea eax, [rcx - 1]
imul eax, ecx
mov ecx, 0x304ed30
add ecx, dword [0x14060e2f4]
xor edx, edx
div ecx
test edx, edx
je 0x1400b1f84
nop word cs:[rax + rax]
movups xmm0, xmmword [rdi]
movups xmmword [r14], xmm0
mov eax, dword [0x140693cec]
cmp eax, 0x38
jge 0x1400b1f70
jmp 0x1400b1f3d
mov r15d, 0xf
mov qword [rsi + 0x18], rbx
mov qword [rsi + 0x20], r15
lea rax, [0x14052ecd8]
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1401649f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x304ed2e
add eax, dword [0x14060e2f4]
cmp ecx, eax
jne 0x140164a71
test edx, edx
je 0x140164aac
movzx eax, byte [0x140601a03]
nop
cmp al, 0xc1
je 0x140164a69
movzx ecx, byte [0x14060e2f0]
lea eax, [rcx - 0x4f]
add cl, 0x36
lock cmpxchg byte [0x140601a03], cl
jne 0x140164a10
xor edx, edx
lea rax, [0x140601a00]
lea rcx, [0x140530ec0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x14060e2f4]
add edx, r8d
add edx, 0x304ed2f
cmp edx, 3
jl 0x140164a40
mov al, 0xc1
xchg byte [0x140601a03], al
lea rax, [0x140601a00]
ret
test edx, edx
je 0x140164b25
movzx eax, byte [0x140601af2]
movzx ecx, byte [0x14060e2f0]
add cl, 0x20
cmp al, cl
je 0x140164aa4
mov cl, 0x7d
mov al, 0x8e
lock cmpxchg byte [0x140601af2], cl
je 0x140164b88
cmp al, 0x99
jne 0x140164a90
lea rax, [0x140601af0]
ret
movzx eax, byte [0x140601945]
nop word cs:[rax + rax]
cmp al, 0x12
je 0x140164bf2
movzx ecx, byte [0x14060e2f0]
lea eax, [rcx + 0x6a]
add cl, 0xe4
lock cmpxchg byte [0x140601945], cl
jne 0x140164ac0
xor eax, eax
lea rcx, [0x140601930]
lea rdx, [0x140530e00]
mov r8d, 0x304ed43
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14060e2f4]
add r10d, r8d
cmp r9d, r10d
jge 0x140164bea
inc rax
jmp 0x140164b00
movzx eax, byte [0x1406019e0]
nop dword [rax]
cmp al, 0xf8
je 0x140164c02
movzx ecx, byte [0x14060e2f0]
mov edx, ecx
xor dl, 0x69
mov eax, ecx
and al, 0x69
add al, al
add al, dl
add cl, 0xd8
lock cmpxchg byte [0x1406019e0], cl
jne 0x140164b30
xor eax, eax
lea rcx, [0x1406019d0]
lea rdx, [0x140530ea0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140164bfa
inc rax
jmp 0x140164b70
xor edx, edx
lea rax, [0x140601af0]
lea rcx, [0x140530fb0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
add edx, edx
and edx, 2
mov r9d, r8d
xor r9d, edx
and edx, r8d
lea edx, [r9 + rdx*2]
cmp edx, 2
jl 0x140164ba0
mov al, 0x99
xchg byte [0x140601af2], al
lea rax, [0x140601af0]
ret
mov al, 0x12
xchg byte [0x140601945], al
lea rax, [0x140601930]
ret
mov al, 0xf8
xchg byte [0x1406019e0], al
lea rax, [0x1406019d0]
ret
Function at 0x14016cb10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x14016cb4c
test edx, edx
je 0x14016cb7c
movzx eax, byte [0x14060f120]
cmp al, 0xd1
je 0x14016cb44
mov cl, 0x9e
nop word cs:[rax + rax]
mov al, 0xeb
lock cmpxchg byte [0x14060f120], cl
je 0x14016cbdc
cmp al, 0xd1
jne 0x14016cb30
lea rax, [0x14060f110]
ret
test edx, edx
je 0x14016cbac
movzx eax, byte [0x14060f1a2]
cmp al, 0x7b
je 0x14016cb74
mov cl, 0xc2
nop dword [rax]
mov al, 0xe3
lock cmpxchg byte [0x14060f1a2], cl
je 0x14016cc18
cmp al, 0x7b
jne 0x14016cb60
lea rax, [0x14060f1a0]
ret
movzx eax, byte [0x14060f19b]
cmp al, 0xd3
je 0x14016cba4
mov cl, 0xea
nop dword [rax]
mov al, 0x43
lock cmpxchg byte [0x14060f19b], cl
je 0x14016cc48
cmp al, 0xd3
jne 0x14016cb90
lea rax, [0x14060f190]
ret
movzx eax, byte [0x14060f155]
cmp al, 0xd7
je 0x14016cbd4
mov cl, 0xbc
nop dword [rax]
mov al, 0x7e
lock cmpxchg byte [0x14060f155], cl
je 0x14016cc98
cmp al, 0xd7
jne 0x14016cbc0
lea rax, [0x14060f150]
ret
xor eax, eax
lea rcx, [0x14060f110]
lea rdx, [0x140531650]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x14016cc08
inc rax
jmp 0x14016cbf0
mov al, 0xd1
xchg byte [0x14060f120], al
lea rax, [0x14060f110]
ret
xor eax, eax
lea rcx, [0x14060f1a0]
lea rdx, [0x1405316d0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x14016cc78
inc rax
jmp 0x14016cc30
xor eax, eax
lea rcx, [0x14060f190]
lea rdx, [0x1405316c0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x14016cc88
inc rax
jmp 0x14016cc60
mov al, 0x7b
xchg byte [0x14060f1a2], al
lea rax, [0x14060f1a0]
ret
mov al, 0xd3
xchg byte [0x14060f19b], al
lea rax, [0x14060f190]
ret
xor eax, eax
lea rcx, [0x14060f150]
lea rdx, [0x140531680]
mov r8d, 0xb75c7679
nop
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14060f208]
add r10d, r8d
cmp r9d, r10d
jge 0x14016ccd1
inc rax
jmp 0x14016ccb0
mov al, 0xd7
xchg byte [0x14060f155], al
lea rax, [0x14060f150]
ret
Function at 0x140196b00
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa5c3331b
add eax, dword [0x1406143d4]
cmp ecx, eax
jne 0x140196b3c
test edx, edx
je 0x140196b7c
movzx eax, byte [0x140613bed]
cmp al, 0xb2
je 0x140196b34
mov cl, 0xf2
mov al, 0x2e
lock cmpxchg byte [0x140613bed], cl
je 0x140196bdc
cmp al, 0xb2
jne 0x140196b20
lea rax, [0x140613be0]
ret
test edx, edx
je 0x140196bac
movzx eax, byte [0x140613959]
movzx ecx, byte [0x1406143d0]
dec cl
cmp al, cl
je 0x140196b74
mov cl, 0xf7
nop word cs:[rax + rax]
mov al, 0x50
lock cmpxchg byte [0x140613959], cl
je 0x140196c38
cmp al, 0xc3
jne 0x140196b60
lea rax, [0x140613950]
ret
movzx eax, byte [0x140613905]
cmp al, 0x1c
je 0x140196ba4
mov cl, 0x36
nop dword [rax]
mov al, 0xed
lock cmpxchg byte [0x140613905], cl
je 0x140196c8c
cmp al, 0x1c
jne 0x140196b90
lea rax, [0x1406138f0]
ret
movzx eax, byte [0x140613a51]
cmp al, 0x25
je 0x140196bd4
mov cl, 0x3a
nop dword [rax]
mov al, 0x62
lock cmpxchg byte [0x140613a51], cl
je 0x140196cbc
cmp al, 0x25
jne 0x140196bc0
lea rax, [0x140613a40]
ret
xor edx, edx
lea rax, [0x140613be0]
lea rcx, [0x140533760]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x1406143d4]
add edx, r8d
add edx, 0xa5c3331c
cmp edx, 0xd
jl 0x140196bf0
movzx eax, byte [0x1406143d0]
add al, 0xee
xchg byte [0x140613bed], al
lea rax, [0x140613be0]
ret
xor eax, eax
lea rcx, [0x140613950]
lea rdx, [0x140533500]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x140196c7c
inc rax
jmp 0x140196c50
mov al, 0xc3
xchg byte [0x140613959], al
lea rax, [0x140613950]
ret
xor eax, eax
lea rcx, [0x1406138f0]
lea rdx, [0x1405334a0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140196d37
inc rax
jmp 0x140196ca0
xor eax, eax
lea rcx, [0x140613a40]
lea rdx, [0x1405335c0]
nop dword [rax]
cdqe
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
mov r8d, dword [0x1406143d4]
mov r9d, r8d
xor r9d, 0xa5c3331c
mov r10d, r8d
and r10d, 0x25c3331c
lea r9d, [r9 + r10*2]
add eax, r9d
mov r9d, r8d
xor r9d, 0xa5c3332c
and r8d, 0x25c3332c
lea r8d, [r9 + r8*2]
cmp eax, r8d
jl 0x140196cd0
mov al, 0x25
xchg byte [0x140613a51], al
lea rax, [0x140613a40]
ret
mov al, 0x1c
xchg byte [0x140613905], al
lea rax, [0x1406138f0]
ret