joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14027f280
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14027f2bc
test edx, edx
je 0x14027f2fc
movzx eax, byte [0x14053796d]
cmp al, 0x99
je 0x14027f2b4
mov cl, 0x1a
nop word cs:[rax + rax]
mov al, 0x1b
lock cmpxchg byte [0x14053796d], cl
je 0x14027f35c
cmp al, 0x99
jne 0x14027f2a0
lea rax, [0x140537960]
ret
test edx, edx
je 0x14027f32c
movzx eax, byte [0x140537632]
movzx ecx, byte [0x140538184]
mov edx, ecx
xor dl, 0xa6
and cl, 0x26
add cl, cl
add cl, dl
cmp al, cl
je 0x14027f2f4
mov cl, 0x61
mov al, 0x2d
lock cmpxchg byte [0x140537632], cl
je 0x14027f3a8
cmp al, 0x15
jne 0x14027f2e0
lea rax, [0x140537630]
ret
movzx eax, byte [0x140537896]
cmp al, 0xe2
je 0x14027f324
mov cl, 0x21
nop dword [rax]
mov al, 0xb7
lock cmpxchg byte [0x140537896], cl
je 0x14027f3d8
cmp al, 0xe2
jne 0x14027f310
lea rax, [0x140537880]
ret
movzx eax, byte [0x1405376f0]
cmp al, 0x49
je 0x14027f354
mov cl, 0x58
nop dword [rax]
mov al, 0x91
lock cmpxchg byte [0x1405376f0], cl
je 0x14027f431
cmp al, 0x49
jne 0x14027f340
lea rax, [0x1405376e0]
ret
xor eax, eax
lea rcx, [0x140537960]
lea rdx, [0x140446460]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14027f398
inc rax
jmp 0x14027f370
mov al, 0x99
xchg byte [0x14053796d], al
lea rax, [0x140537960]
ret
xor eax, eax
lea rcx, [0x140537630]
lea rdx, [0x140446180]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x14027f421
inc rax
jmp 0x14027f3c0
xor edx, edx
lea rax, [0x140537880]
lea rcx, [0x140446380]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x140538180]
add edx, r8d
add edx, 0x5a89a642
cmp edx, 0x16
jl 0x14027f3f0
mov al, 0xe2
xchg byte [0x140537896], al
lea rax, [0x140537880]
ret
mov al, 0x15
xchg byte [0x140537632], al
lea rax, [0x140537630]
ret
xor edx, edx
lea rax, [0x1405376e0]
lea rcx, [0x140446210]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x14027f450
mov al, 0x49
xchg byte [0x1405376f0], al
lea rax, [0x1405376e0]
ret
Function at 0x140280630
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0x95616542
mov r9d, dword [0x140538180]
add r9d, eax
cmp ecx, r9d
jne 0x140280698
test edx, edx
je 0x1402806fc
movzx eax, byte [0x140537879]
cmp al, 0x1d
je 0x140280690
mov cl, 0x8d
nop word cs:[rax + rax]
mov al, 0xfd
lock cmpxchg byte [0x140537879], cl
je 0x14028072c
mov edx, r8d
xor dl, 0xad
add dl, byte [0x140538184]
cmp al, dl
jne 0x140280670
lea rax, [0x140537870]
ret
add eax, dword [0x140538180]
cmp edx, eax
jne 0x1402806cc
movzx eax, byte [0x140537985]
cmp al, 0x1e
je 0x1402806c4
mov cl, 0xbf
nop
mov al, 0x35
lock cmpxchg byte [0x140537985], cl
je 0x140280787
cmp al, 0x1e
jne 0x1402806b0
lea rax, [0x140537970]
ret
movzx eax, byte [0x1405376c2]
cmp al, 0x31
je 0x1402806f4
mov cl, 0xd6
nop dword [rax]
mov al, 0x13
lock cmpxchg byte [0x1405376c2], cl
je 0x1402807c8
cmp al, 0x31
jne 0x1402806e0
lea rax, [0x1405376c0]
ret
movzx eax, byte [0x140537846]
cmp al, 0x62
je 0x140280724
mov cl, 0x32
nop dword [rax]
mov al, 0x59
lock cmpxchg byte [0x140537846], cl
je 0x14028082d
cmp al, 0x62
jne 0x140280710
lea rax, [0x140537830]
ret
xor eax, eax
lea rcx, [0x140537870]
lea rdx, [0x140446370]
xor r8d, 0x95616541
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x140538180]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 9
jl 0x140280750
mov al, 0x1d
xchg byte [0x140537879], al
lea rax, [0x140537870]
ret
xor eax, eax
lea rcx, [0x140537970]
lea rdx, [0x140446470]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x14028081d
inc rax
jmp 0x1402807a0
xor eax, eax
lea rcx, [0x1405376c0]
lea rdx, [0x1404461f0]
xor r8d, 0x95616541
nop
cdqe
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
mov r9d, dword [0x140538180]
add r9d, r8d
add eax, r9d
cmp eax, 2
jl 0x1402807e0
mov al, 0x31
xchg byte [0x1405376c2], al
lea rax, [0x1405376c0]
ret
mov al, 0x1e
xchg byte [0x140537985], al
lea rax, [0x140537970]
ret
xor eax, eax
lea rcx, [0x140537830]
lea rdx, [0x140446330]
xor r8d, 0x95616554
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140538180]
add r10d, r8d
cmp r9d, r10d
jge 0x140280871
inc rax
jmp 0x140280850
mov al, 0x62
xchg byte [0x140537846], al
lea rax, [0x140537830]
ret
Function at 0x140281570
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1402815ac
test edx, edx
je 0x1402815f8
movzx eax, byte [0x140537825]
cmp al, 0x35
je 0x1402815a4
mov cl, 0xa1
nop word [rax + rax]
mov al, 0xbf
lock cmpxchg byte [0x140537825], cl
je 0x14028165c
cmp al, 0x35
jne 0x140281590
lea rax, [0x140537810]
ret
test edx, edx
je 0x14028162c
movzx eax, byte [0x1405377b3]
mov ecx, r8d
xor cl, 0x4a
add cl, byte [0x140538184]
cmp al, cl
je 0x1402815f0
mov cl, 0xed
nop dword [rax]
mov al, 0x24
lock cmpxchg byte [0x1405377b3], cl
je 0x1402816b7
mov edx, r8d
xor dl, 0x4a
add dl, byte [0x140538184]
cmp al, dl
jne 0x1402815d0
lea rax, [0x1405377b0]
ret
movzx eax, byte [0x140537745]
cmp al, 0x6c
je 0x140281624
mov cl, 0xf5
nop word cs:[rax + rax]
mov al, 5
lock cmpxchg byte [0x140537745], cl
je 0x1402816e8
cmp al, 0x6c
jne 0x140281610
lea rax, [0x140537730]
ret
movzx eax, byte [0x14053799d]
cmp al, 0x69
je 0x140281654
mov cl, 0x5b
nop dword [rax]
mov al, 0x88
lock cmpxchg byte [0x14053799d], cl
je 0x14028173f
cmp al, 0x69
jne 0x140281640
lea rax, [0x140537990]
ret
xor eax, eax
lea rcx, [0x140537810]
lea rdx, [0x140446310]
mov r9d, r8d
xor r9d, 0xacb4230d
nop word cs:[rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
mov r10d, dword [0x140538180]
add r10d, r9d
add eax, r10d
cmp eax, 0x15
jl 0x140281680
xor r8b, 0x89
add r8b, byte [0x140538184]
xchg byte [0x140537825], r8b
lea rax, [0x140537810]
ret
xor eax, eax
lea rcx, [0x1405377b0]
lea rdx, [0x1404462b0]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x14028172f
inc rax
jmp 0x1402816d0
xor edx, edx
lea rax, [0x140537730]
lea rcx, [0x140446250]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x140281700
mov al, 0x6c
xchg byte [0x140537745], al
lea rax, [0x140537730]
ret
mov al, 0x74
xchg byte [0x1405377b3], al
lea rax, [0x1405377b0]
ret
xor eax, eax
lea rcx, [0x140537990]
lea rdx, [0x140446490]
nop
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xc
jg 0x140281768
inc rax
jmp 0x140281750
xor r8b, 0xb5
add r8b, byte [0x140538184]
xchg byte [0x14053799d], r8b
lea rax, [0x140537990]
ret
Function at 0x14028f910
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14028f9a6
test edx, edx
je 0x14028f9e3
movzx eax, byte [0x140539555]
cmp al, 0xd
je 0x14028fa90
mov cl, 0x8c
jmp 0x14028f948
cmp al, 0xd
je 0x14028fa90
mov al, 0xcc
lock cmpxchg byte [0x140539555], cl
je 0x14028fa60
mov edx, dword [0x140576f14]
cmp edx, 0x5e
jg 0x14028f990
nop word cs:[rax + rax]
mov edx, dword [0x140576f10]
lea r8d, [rdx - 1]
imul r8d, edx
test r8b, 1
je 0x14028f940
nop word cs:[rax + rax]
mov edx, dword [0x140576f10]
lea r8d, [rdx - 1]
imul r8d, edx
test r8b, 1
jne 0x14028f990
jmp 0x14028f970
test edx, edx
je 0x14028fa23
movzx eax, byte [0x14053977d]
cmp al, 0x62
je 0x14028fad7
mov cl, 0x99
nop dword [rax + rax]
mov al, 0xc9
lock cmpxchg byte [0x14053977d], cl
je 0x14028fa98
movzx edx, byte [0x14053a240]
add dl, 0xfe
cmp al, dl
jne 0x14028f9c0
jmp 0x14028fad7
movzx eax, byte [0x1405395a9]
cmp al, 0x66
je 0x14028fb63
mov cl, 0x78
nop word cs:[rax + rax]
mov al, 0x94
lock cmpxchg byte [0x1405395a9], cl
je 0x14028fb13
movzx edx, byte [0x14053a240]
add dl, 2
cmp al, dl
jne 0x14028fa00
jmp 0x14028fb63
movzx eax, byte [0x1405394c4]
cmp al, 7
je 0x14028fa58
mov cl, 0xe5
mov al, 0x6b
lock cmpxchg byte [0x1405394c4], cl
je 0x14028fb76
mov edx, dword [0x140576f14]
cmp edx, 0x3a
mov edx, dword [0x140576f14]
cmp edx, 0x20
jg 0x14028fa49
cmp al, 7
jne 0x14028fa30
lea rax, [0x1405394c0]
ret
xor eax, eax
lea rcx, [0x140539540]
lea rdx, [0x140447360]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x14028fa88
inc rax
jmp 0x14028fa70
mov al, 0xd
xchg byte [0x140539555], al
lea rax, [0x140539540]
ret
xor edx, edx
lea rax, [0x140539770]
lea rcx, [0x140447580]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x14028fab0
mov al, 0x62
xchg byte [0x14053977d], al
mov eax, dword [0x140576f14]
nop dword [rax]
mov ecx, dword [0x140576f10]
lea eax, [rcx - 1]
imul eax, ecx
mov ecx, dword [0x14053a230]
mov edx, ecx
xor edx, 0xc2ddbc5b
and ecx, 0x42ddbc5b
lea ecx, [rdx + rcx*2]
xor edx, edx
div ecx
test edx, edx
jne 0x14028fae0
lea rax, [0x140539770]
ret
xor eax, eax
lea rcx, [0x1405395a0]
lea rdx, [0x1404473c0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x14028fb48
inc rax
jmp 0x14028fb30
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x14028fb50
movzx eax, byte [0x14053a240]
add al, 2
xchg byte [0x1405395a9], al
mov eax, dword [0x140576f10]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x14028fbc3
jmp 0x14028fbb8
xor eax, eax
lea rcx, [0x1405394c0]
lea rdx, [0x1404472f0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x14028fba8
inc rax
jmp 0x14028fb90
mov al, 7
xchg byte [0x1405394c4], al
lea rax, [0x1405394c0]
ret
mov eax, dword [0x140576f14]
cmp eax, 0x58
jl 0x14028fbd6
mov al, 1
nop word cs:[rax + rax]
test al, al
je 0x14028fbd0
jmp 0x14028fbb8
lea rax, [0x1405395a0]
ret
Function at 0x140290c90
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x140290ce6
test edx, edx
je 0x140290d1c
movzx eax, byte [0x14053969f]
cmp al, 0xe4
je 0x140290cde
mov cl, 0x48
nop word [rax + rax]
mov al, 0xce
lock cmpxchg byte [0x14053969f], cl
je 0x140290dc8
mov edx, r8d
xor dl, 0x1f
mov r9d, r8d
not r9b
and r9b, r8b
xor r9b, dl
add r9b, byte [0x14053a240]
cmp al, r9b
jne 0x140290cb0
lea rax, [0x140539690]
ret
test edx, edx
je 0x140290d84
movzx eax, byte [0x140539595]
cmp al, 0xea
je 0x140290d14
mov cl, 0x33
nop dword [rax + rax]
mov al, 0xf1
lock cmpxchg byte [0x140539595], cl
je 0x140290e18
cmp al, 0xea
jne 0x140290d00
lea rax, [0x140539580]
ret
movzx eax, byte [0x1405396bd]
mov ecx, r8d
xor cl, 0x3f
add cl, byte [0x14053a240]
cmp al, cl
je 0x140290d7c
nop word cs:[rax + rax]
movzx ecx, byte [0x14053a240]
mov eax, r8d
xor al, 0x7f
add al, cl
mov edx, r8d
xor dl, cl
xor dl, 0x7c
mov r9d, r8d
xor r9b, 3
not cl
and cl, r9b
or cl, dl
not cl
add cl, cl
add cl, dl
lock cmpxchg byte [0x1405396bd], cl
je 0x140290e74
cmp al, 4
jne 0x140290d40
lea rax, [0x1405396b0]
ret
movzx eax, byte [0x140539653]
cmp al, 0x2b
je 0x140290dc0
mov cl, 0x45
nop word cs:[rax + rax]
mov al, 0x6b
lock cmpxchg byte [0x140539653], cl
je 0x140290eb8
mov edx, r8d
xor dl, 0x58
add dl, byte [0x14053a240]
cmp al, dl
jne 0x140290da0
lea rax, [0x140539650]
ret
xor eax, eax
lea rcx, [0x140539690]
lea rdx, [0x1404474a0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x140290e08
inc rax
jmp 0x140290de0
mov al, 0xe4
xchg byte [0x14053969f], al
lea rax, [0x140539690]
ret
xor edx, edx
lea rax, [0x140539580]
lea rcx, [0x1404473a0]
xor r8d, 0xe79bdfc5
nop
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, dword [0x14053a230]
add r9d, r8d
add edx, 0x271a1a0a
mov r10d, edx
xor r10d, r9d
and edx, r9d
lea edx, [r10 + rdx*2]
add edx, 0xd8e5e5f6
cmp edx, 0x15
jl 0x140290e30
mov al, 0xea
xchg byte [0x140539595], al
lea rax, [0x140539580]
ret
xor eax, eax
lea rcx, [0x1405396b0]
lea rdx, [0x1404474c0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140290ea8
inc rax
jmp 0x140290e90
mov al, 4
xchg byte [0x1405396bd], al
lea rax, [0x1405396b0]
ret
xor eax, eax
lea rcx, [0x140539650]
lea rdx, [0x140447460]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x140290ee8
inc rax
jmp 0x140290ed0
mov al, 0x2b
xchg byte [0x140539653], al
lea rax, [0x140539650]
ret
Function at 0x1402e1400
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1402e1438
movzx eax, byte [0x140548440]
cmp al, 0xc0
je 0x1402e1430
mov cl, 0x69
nop word cs:[rax + rax]
mov al, 0xbd
lock cmpxchg byte [0x140548440], cl
je 0x1402e146c
cmp al, 0xc0
jne 0x1402e1420
lea rax, [0x140548340]
ret
test edx, edx
je 0x1402e14cb
movzx eax, byte [0x140548483]
cmp al, 0xfc
je 0x1402e1464
mov cl, 0xa9
nop dword [rax]
mov al, 0x9d
lock cmpxchg byte [0x140548483], cl
je 0x1402e14f8
cmp al, 0xfc
jne 0x1402e1450
lea rax, [0x140548460]
ret
xor eax, eax
lea rcx, [0x140548340]
lea rdx, [0x14044dc70]
mov r9d, r8d
xor r9d, 0x11e375d6
nop word cs:[rax + rax]
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x140548548]
add r11d, r9d
cmp r10d, r11d
jge 0x1402e14b1
inc rax
jmp 0x1402e1490
xor r8b, 0xe3
add r8b, byte [0x14054854c]
xchg byte [0x140548440], r8b
lea rax, [0x140548340]
ret
movzx eax, byte [0x140548310]
cmp al, 0x19
je 0x1402e14f0
mov cl, 0x45
nop dword [rax + rax]
mov al, 0x4b
lock cmpxchg byte [0x140548310], cl
je 0x1402e1549
cmp al, 0x19
jne 0x1402e14e0
lea rax, [0x140548210]
ret
xor edx, edx
lea rax, [0x140548460]
lea rcx, [0x14044dd80]
nop dword [rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
cmp edx, 0x23
jl 0x1402e1510
xor r8b, 0x27
add r8b, byte [0x14054854c]
xchg byte [0x140548483], r8b
lea rax, [0x140548460]
ret
xor eax, eax
lea rcx, [0x140548210]
lea rdx, [0x14044db50]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xff
jg 0x1402e158f
inc rax
jmp 0x1402e1560
mov al, 0x19
xchg byte [0x140548310], al
lea rax, [0x140548210]
ret
Function at 0x1402e15a0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1402e15dc
test edx, edx
je 0x1402e160c
movzx eax, byte [0x14054833e]
cmp al, 0x4d
je 0x1402e15d4
mov cl, 0x9f
nop word [rax + rax]
mov al, 0x3a
lock cmpxchg byte [0x14054833e], cl
je 0x1402e16bf
cmp al, 0x4d
jne 0x1402e15c0
lea rax, [0x140548320]
ret
test edx, edx
je 0x1402e163c
movzx eax, byte [0x1405484a9]
cmp al, 0x3e
je 0x1402e1604
mov cl, 0x2c
nop dword [rax]
mov al, 0xac
lock cmpxchg byte [0x1405484a9], cl
je 0x1402e170c
cmp al, 0x3e
jne 0x1402e15f0
lea rax, [0x1405484a0]
ret
movzx eax, byte [0x140548453]
cmp al, 0x5f
je 0x1402e1634
mov cl, 0x31
nop dword [rax]
mov al, 0xdf
lock cmpxchg byte [0x140548453], cl
je 0x1402e1751
cmp al, 0x5f
jne 0x1402e1620
lea rax, [0x140548450]
ret
movzx eax, byte [0x14054849f]
nop word cs:[rax + rax]
cmp al, 0xb1
je 0x1402e16b7
movzx ecx, byte [0x14054854c]
mov eax, r8d
xor al, 0xef
add al, cl
mov edx, r8d
xor dl, 0xec
add dl, cl
lock cmpxchg byte [0x14054849f], dl
jne 0x1402e1650
xor edx, edx
lea rax, [0x140548490]
lea rcx, [0x14044ddb0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x1402e1690
mov al, 0xb1
xchg byte [0x14054849f], al
lea rax, [0x140548490]
ret
xor eax, eax
lea rcx, [0x140548320]
lea rdx, [0x14044dc50]
nop
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1d
jg 0x1402e16fc
inc rax
jmp 0x1402e16d0
mov al, 0x4d
xchg byte [0x14054833e], al
lea rax, [0x140548320]
ret
xor eax, eax
lea rcx, [0x1405484a0]
lea rdx, [0x14044ddc0]
xor r8d, 0x57048dfd
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140548548]
add r10d, r8d
cmp r9d, r10d
jge 0x1402e17a5
inc rax
jmp 0x1402e1730
xor eax, eax
lea rcx, [0x140548450]
lea rdx, [0x14044dd70]
xor r8d, 0x57048dc3
nop dword [rax + rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140548548]
add r10d, r8d
cmp r9d, r10d
jge 0x1402e17b5
inc rax
jmp 0x1402e1770
mov al, 0x3e
xchg byte [0x1405484a9], al
lea rax, [0x1405484a0]
ret
mov al, 0x5f
xchg byte [0x140548453], al
lea rax, [0x140548450]
ret
Function at 0x1402efb70
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov eax, edx
shr eax, 3
mov r8d, edx
shr r8d, 8
mov r9d, edx
shr r9d, 9
add eax, edx
add eax, r8d
add eax, r9d
add eax, 4
mov r8d, edx
shr r8d, 5
mov r9d, edx
shr r9d, 7
mov r10d, edx
shr r10d, 0xb
add r8d, edx
add r8d, 7
mov r11d, r8d
xor r11d, r9d
not r8d
not r9d
and r9d, r8d
or r9d, r11d
not r9d
lea r8d, [r11 + r9*2]
mov r9d, r8d
xor r9d, r10d
and r10d, r8d
lea r8d, [r9 + r10*2]
test rcx, rcx
je 0x1402efbf2
cmp qword [rcx + 0x30], 0
je 0x1402efbf2
cmp qword [rcx + 0x38], 0
je 0x1402efbf2
mov r9, qword [rcx + 0x28]
test r9, r9
je 0x1402efbf2
cmp qword [r9], rcx
je 0x1402efc07
cmp eax, r8d
cmova r8d, eax
mov eax, dword [0x1405766c0]
add eax, r8d
add eax, 6
pop rsi
ret
mov r9d, dword [r9 + 8]
lea r10d, [r9 - 0x39]
cmp r10d, 0x38
ja 0x1402efc4d
movabs r11, 0x100400400011001
bt r11, r10
jae 0x1402efc4d
mov rcx, qword [rcx + 0x28]
mov r9d, dword [rcx + 0x2c]
cmp r9d, 2
je 0x1402efc5e
cmp r9d, 1
je 0x1402efc83
test r9d, r9d
je 0x1402efd08
mov r9d, 6
jmp 0x1402efd08
cmp r9d, 0x2a
je 0x1402efc25
cmp r9d, 0x29a
jne 0x1402efbf2
jmp 0x1402efc25
mov r9, qword [rcx + 0x30]
test r9, r9
je 0x1402efc9b
cmp qword [r9 + 0x10], 0
je 0x1402efca3
mov r10d, dword [r9 + 0x18]
mov r11d, r10d
xor r11d, 0x14
and r10d, 0x14
lea r10d, [r11 + r10*2]
jmp 0x1402efca9
xor r9d, r9d
cmp dword [rcx + 0x94], 0
setne r9b
lea r9d, [r9*4 + 6]
jmp 0x1402efd08
mov r9d, 0x12
jmp 0x1402efd08
mov r10d, 0x12
mov r11, qword [r9 + 0x20]
test r11, r11
je 0x1402efcc0
inc r10d
cmp byte [r11], 0
je 0x1402efcc0
inc r11
jmp 0x1402efcb2
mov r11, qword [r9 + 0x30]
test r11, r11
je 0x1402efcee
mov esi, r10d
xor esi, 0x5d203064
and r10d, 0x5d203064
lea r10d, [rsi + r10*2]
add r10d, 0xa2dfcf9d
cmp byte [r11], 0
lea r11, [r11 + 1]
jne 0x1402efcc9
mov r11d, r10d
xor r11d, 2
mov esi, r10d
and esi, 2
cmp dword [r9 + 0x3c], 0
lea r9d, [r11 + rsi*2]
cmove r9d, r10d
mov r10d, dword [rcx + 0x48]
cmp r10d, 0xf
jne 0x1402efd5c
cmp dword [rcx + 0x78], 0xf
jne 0x1402efd5c
mov eax, edx
shr eax, 0xc
mov ecx, edx
shr ecx, 0xe
add ecx, eax
mov eax, edx
shr eax, 0x19
mov r8d, edx
xor r8d, 0x77b2bbc0
and edx, 0x77b2bbc0
lea edx, [r8 + rdx*2]
add edx, ecx
mov ecx, 0x77b2bbb9
sub ecx, edx
neg eax
mov edx, ecx
xor edx, eax
and eax, ecx
lea eax, [rdx + rax*2]
sub r9d, eax
mov eax, r9d
jmp 0x1402efc05
cmp r10d, dword [rcx + 0x78]
cmova eax, r8d
add eax, r9d
jmp 0x1402efc05
Function at 0x140348a10
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x140348a4c
test edx, edx
je 0x140348adc
movzx eax, byte [0x140555cd0]
cmp al, 0xf5
je 0x140348a44
mov cl, 0x13
nop
mov al, 0x72
lock cmpxchg byte [0x140555cd0], cl
je 0x140348b7f
cmp al, 0xf5
jne 0x140348a30
lea rax, [0x140555cc0]
ret
test edx, edx
je 0x140348b1c
movzx eax, byte [0x140555dcb]
nop dword [rax + rax]
cmp al, 0xe2
je 0x140348bc0
movzx ecx, byte [0x14055600c]
mov eax, r8d
xor al, 0x12
add al, cl
mov edx, r8d
xor dl, 0x4a
mov r9d, edx
xor r9b, cl
and dl, cl
add dl, dl
add dl, r9b
lock cmpxchg byte [0x140555dcb], dl
jne 0x140348a60
xor eax, eax
lea rcx, [0x140555dc0]
lea rdx, [0x14045c3e0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x140348bb8
inc rax
jmp 0x140348ab0
movzx eax, byte [0x140555d25]
xor r8b, 0x3f
add r8b, byte [0x14055600c]
cmp al, r8b
je 0x140348b14
mov cl, 0xcd
nop word cs:[rax + rax]
mov al, 0xc7
lock cmpxchg byte [0x140555d25], cl
je 0x140348bc8
cmp al, 0x33
jne 0x140348b00
lea rax, [0x140555d20]
ret
movzx eax, byte [0x140555ddf]
mov ecx, r8d
xor cl, 0x43
add cl, byte [0x14055600c]
cmp al, cl
je 0x140348b77
nop word cs:[rax + rax]
movzx ecx, byte [0x14055600c]
mov eax, r8d
xor al, 0x86
add al, cl
mov edx, r8d
xor dl, 0x50
add dl, cl
add dl, 0xdb
mov ecx, edx
xor cl, 0x25
and dl, 0x25
add dl, dl
add dl, cl
lock cmpxchg byte [0x140555ddf], dl
je 0x140348c33
cmp al, 0xa7
jne 0x140348b40
lea rax, [0x140555dd0]
ret
xor eax, eax
lea rcx, [0x140555cc0]
lea rdx, [0x14045c2f0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140348ba8
inc rax
jmp 0x140348b90
mov al, 0xf5
xchg byte [0x140555cd0], al
lea rax, [0x140555cc0]
ret
mov al, 0xe2
xchg byte [0x140555dcb], al
lea rax, [0x140555dc0]
ret
xor edx, edx
lea rax, [0x140555d20]
lea rcx, [0x14045c340]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
mov r9d, r8d
xor r9b, 0x5c
and r8b, 0x5c
add r8b, r8b
add r8b, r9b
add r8b, byte [rdx + rcx]
add r8b, 0xa4
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
add edx, edx
and edx, 2
mov r9d, r8d
xor r9d, edx
and edx, r8d
lea edx, [r9 + rdx*2]
cmp edx, 5
jl 0x140348be0
mov al, 0x33
xchg byte [0x140555d25], al
lea rax, [0x140555d20]
ret
xor eax, eax
lea rcx, [0x140555dd0]
lea rdx, [0x14045c3f0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
add r8b, 0xe2
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov r9d, r8d
xor r9b, 0x1e
and r8b, 0x1e
add r8b, r8b
add r8b, r9b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x140348c91
inc rax
jmp 0x140348c50
mov al, 0xa7
xchg byte [0x140555ddf], al
lea rax, [0x140555dd0]
ret