joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140215ff0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14021602c
test edx, edx
je 0x140216068
movzx eax, byte [0x140512000]
cmp al, 0x8f
je 0x140216024
mov cl, 0xec
nop word [rax + rax]
mov al, 0xa7
lock cmpxchg byte [0x140512000], cl
je 0x1402160dc
cmp al, 0x8f
jne 0x140216010
lea rax, [0x140511ff0]
ret
test edx, edx
je 0x1402160a8
movzx eax, byte [0x14051262d]
cmp al, 6
je 0x140216060
mov cl, 0xa9
nop dword [rax]
mov al, 0x88
lock cmpxchg byte [0x14051262d], cl
je 0x14021611f
mov edx, r8d
xor dl, 0x42
add dl, byte [0x140512ee4]
cmp al, dl
jne 0x140216040
lea rax, [0x140512620]
ret
movzx eax, byte [0x140512a1d]
cmp al, 0xea
je 0x1402160a0
mov cl, 0xc5
nop word cs:[rax + rax]
mov al, 0x79
lock cmpxchg byte [0x140512a1d], cl
je 0x140216158
mov edx, r8d
xor dl, 0xae
add dl, byte [0x140512ee4]
cmp al, dl
jne 0x140216080
lea rax, [0x140512a00]
ret
movzx eax, byte [0x140512413]
cmp al, 0x71
je 0x1402160d4
mov cl, 0xf
nop word cs:[rax + rax]
mov al, 0x7c
lock cmpxchg byte [0x140512413], cl
je 0x1402161a8
cmp al, 0x71
jne 0x1402160c0
lea rax, [0x1405123f0]
ret
xor edx, edx
lea rax, [0x140511ff0]
lea rcx, [0x140430590]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x1402160f0
mov al, 0x8f
xchg byte [0x140512000], al
lea rax, [0x140511ff0]
ret
xor eax, eax
lea rcx, [0x140512620]
lea rdx, [0x140430b90]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140216188
inc rax
jmp 0x140216130
xor eax, eax
lea rcx, [0x140512a00]
lea rdx, [0x140430f40]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1c
jg 0x140216198
inc rax
jmp 0x140216170
mov al, 6
xchg byte [0x14051262d], al
lea rax, [0x140512620]
ret
mov al, 0xea
xchg byte [0x140512a1d], al
lea rax, [0x140512a00]
ret
xor eax, eax
lea rcx, [0x1405123f0]
lea rdx, [0x140430970]
xor r8d, 0xa4b9b987
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140512ee0]
add r10d, r8d
cmp r9d, r10d
jge 0x1402161e1
inc rax
jmp 0x1402161c0
mov al, 0x71
xchg byte [0x140512413], al
lea rax, [0x1405123f0]
ret
Function at 0x140264a20
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140264a58
movzx eax, byte [0x14051e28f]
cmp al, 0xc0
je 0x140264a50
mov cl, 0x52
nop word cs:[rax + rax]
mov al, 0x76
lock cmpxchg byte [0x14051e28f], cl
je 0x140264a92
cmp al, 0xc0
jne 0x140264a40
lea rax, [0x14051e280]
ret
movzx eax, byte [0x14051e2dd]
cmp al, 0x93
je 0x140264a8a
mov cl, 0x19
nop word cs:[rax + rax]
mov al, 0x8a
lock cmpxchg byte [0x14051e2dd], cl
je 0x140264af1
movzx edx, byte [0x14051ea34]
add dl, 0xc9
cmp al, dl
jne 0x140264a70
lea rax, [0x14051e2d0]
ret
xor r8d, r8d
lea rax, [0x14051e280]
lea rcx, [0x140434520]
mov edx, 0xf7b6481f
nop dword [rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
xor byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x14051ea30]
add r9d, edx
cmp r8d, r9d
jl 0x140264ab0
movzx eax, byte [0x14051ea34]
add al, 0xf6
xchg byte [0x14051e28f], al
lea rax, [0x14051e280]
ret
xor eax, eax
lea rcx, [0x14051e2d0]
lea rdx, [0x140434570]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140264b28
inc rax
jmp 0x140264b10
mov al, 0x93
xchg byte [0x14051e2dd], al
lea rax, [0x14051e2d0]
ret
Function at 0x14026e810
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xf4c1ee6b
mov r8d, dword [0x14051f428]
add r8d, eax
cmp ecx, r8d
jne 0x14026e85c
test edx, edx
je 0x14026e906
movzx eax, byte [0x14051ec97]
cmp al, 0xa
je 0x14026e854
mov cl, 0xa7
nop dword [rax]
mov al, 0x8d
lock cmpxchg byte [0x14051ec97], cl
je 0x14026e93c
cmp al, 0xa
jne 0x14026e840
lea rax, [0x14051ec90]
ret
add eax, dword [0x14051f428]
cmp edx, eax
jne 0x14026e8cc
movzx eax, byte [0x14051eef8]
nop dword [rax]
cmp al, 0x82
je 0x14026e9b2
movzx ecx, byte [0x14051f42c]
lea eax, [rcx + 0x6e]
add cl, 4
lock cmpxchg byte [0x14051eef8], cl
jne 0x14026e870
xor eax, eax
lea rcx, [0x14051eee0]
lea rdx, [0x140434b20]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x17
jg 0x14026e9aa
inc rax
jmp 0x14026e8a0
movzx eax, byte [0x14051ef1d]
cmp al, 0x12
je 0x14026e8fe
mov cl, 0x6b
nop dword [rax]
mov al, 0x99
lock cmpxchg byte [0x14051ef1d], cl
je 0x14026e9ba
movzx edx, byte [0x14051f42c]
add dl, 0x23
cmp al, dl
jne 0x14026e8e0
lea rax, [0x14051ef10]
ret
movzx eax, byte [0x14051eec3]
cmp al, 0xf9
je 0x14026e934
mov cl, 0x8e
nop word cs:[rax + rax]
mov al, 0x32
lock cmpxchg byte [0x14051eec3], cl
je 0x14026e9ff
cmp al, 0xf9
jne 0x14026e920
lea rax, [0x14051eeb0]
ret
xor r8d, r8d
lea rax, [0x14051ec90]
lea rcx, [0x1404348e0]
mov edx, 0xf4c1ee72
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [r8 + rax]
xor r10b, r9b
mov byte [r8 + rax], r10b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x14051f428]
add r9d, edx
cmp r8d, r9d
jl 0x14026e960
mov al, 0xa
xchg byte [0x14051ec97], al
lea rax, [0x14051ec90]
ret
mov al, 0x82
xchg byte [0x14051eef8], al
lea rax, [0x14051eee0]
ret
xor eax, eax
lea rcx, [0x14051ef10]
lea rdx, [0x140434b50]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14026e9e8
inc rax
jmp 0x14026e9d0
movzx eax, byte [0x14051f42c]
add al, 0x23
xchg byte [0x14051ef1d], al
lea rax, [0x14051ef10]
ret
xor eax, eax
lea rcx, [0x14051eeb0]
lea rdx, [0x140434af0]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x12
jg 0x14026ea38
inc rax
jmp 0x14026ea10
mov al, 0xf9
xchg byte [0x14051eec3], al
lea rax, [0x14051eeb0]
ret
Function at 0x140273b90
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140273bd6
test edx, edx
je 0x140273c0c
movzx eax, byte [0x14051f654]
cmp al, 0x35
je 0x140273bce
mov cl, 0xc5
nop word cs:[rax + rax]
mov al, 0x83
lock cmpxchg byte [0x14051f654], cl
je 0x140273c6c
movzx edx, byte [0x14051fba0]
add dl, 0x6b
cmp al, dl
jne 0x140273bb0
lea rax, [0x14051f640]
ret
test edx, edx
je 0x140273c3c
movzx eax, byte [0x14051f5c0]
cmp al, 0x93
je 0x140273c04
mov cl, 0x77
nop word [rax + rax]
mov al, 0xe
lock cmpxchg byte [0x14051f5c0], cl
je 0x140273cb8
cmp al, 0x93
jne 0x140273bf0
lea rax, [0x14051f5b0]
ret
movzx eax, byte [0x14051f585]
cmp al, 0xf9
je 0x140273c34
mov cl, 0xbc
nop dword [rax]
mov al, 0x47
lock cmpxchg byte [0x14051f585], cl
je 0x140273d18
cmp al, 0xf9
jne 0x140273c20
lea rax, [0x14051f570]
ret
movzx eax, byte [0x14051f629]
cmp al, 0xb1
je 0x140273c64
mov cl, 0x6a
nop dword [rax]
mov al, 0x2a
lock cmpxchg byte [0x14051f629], cl
je 0x140273d58
cmp al, 0xb1
jne 0x140273c50
lea rax, [0x14051f620]
ret
xor eax, eax
lea rcx, [0x14051f640]
lea rdx, [0x140434da0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x13
jg 0x140273ca8
inc rax
jmp 0x140273c80
mov al, 0x35
xchg byte [0x14051f654], al
lea rax, [0x14051f640]
ret
xor edx, edx
lea rax, [0x14051f5b0]
lea rcx, [0x140434d20]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x14051fb90]
add edx, r8d
add edx, 0xc070f375
cmp edx, 0x10
jl 0x140273cd0
movzx eax, byte [0x14051fba0]
add al, 0xc9
xchg byte [0x14051f5c0], al
lea rax, [0x14051f5b0]
ret
xor eax, eax
lea rcx, [0x14051f570]
lea rdx, [0x140434ce0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140273d48
inc rax
jmp 0x140273d30
mov al, 0xf9
xchg byte [0x14051f585], al
lea rax, [0x14051f570]
ret
xor eax, eax
lea rcx, [0x14051f620]
lea rdx, [0x140434d80]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x140273d88
inc rax
jmp 0x140273d70
mov al, 0xb1
xchg byte [0x14051f629], al
lea rax, [0x14051f620]
ret
Function at 0x140274bc0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140274c0c
test edx, edx
je 0x140274c61
movzx eax, byte [0x14051fe46]
movzx ecx, byte [0x140520010]
add cl, 0x9e
cmp al, cl
je 0x140274c04
mov cl, 0x1c
nop word cs:[rax + rax]
mov al, 0xe2
lock cmpxchg byte [0x14051fe46], cl
je 0x140274d11
cmp al, 0xd6
jne 0x140274bf0
lea rax, [0x14051fe30]
ret
mov eax, 0xda2451bb
add eax, dword [0x140520000]
cmp edx, eax
jne 0x140274ca6
movzx eax, byte [0x14051fdf6]
cmp al, 0xe7
je 0x140274c59
nop word [rax + rax]
movzx ecx, byte [0x140520010]
lea eax, [rcx + 0x47]
add cl, 0x90
lock cmpxchg byte [0x14051fdf6], cl
je 0x140274db8
movzx ecx, byte [0x140520010]
add cl, 0xaf
cmp al, cl
jne 0x140274c30
lea rax, [0x14051fde0]
ret
movzx eax, byte [0x14051fe29]
movzx ecx, byte [0x140520010]
add cl, 0xfa
cmp al, cl
je 0x140274c9e
mov cl, 0x1c
nop dword [rax + rax]
mov al, 0xb6
lock cmpxchg byte [0x14051fe29], cl
je 0x140274d76
movzx edx, byte [0x140520010]
add dl, 0xfa
cmp al, dl
jne 0x140274c80
lea rax, [0x14051fe20]
ret
movzx eax, byte [0x14051fd30]
nop dword [rax]
cmp al, 0x68
je 0x140274d09
movzx ecx, byte [0x140520010]
lea eax, [rcx + 0x21]
add cl, 0xbb
lock cmpxchg byte [0x14051fd30], cl
jne 0x140274cb0
xor edx, edx
lea rax, [0x14051fd20]
lea rcx, [0x140434fb0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x140520000]
add edx, r8d
add edx, 0xda2451bc
cmp edx, 0x10
jl 0x140274ce0
mov al, 0x68
xchg byte [0x14051fd30], al
lea rax, [0x14051fd20]
ret
xor edx, edx
lea rax, [0x14051fe30]
lea rcx, [0x1404350a0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x16
jl 0x140274d30
movzx eax, byte [0x140520010]
add al, 0x9e
xchg byte [0x14051fe46], al
lea rax, [0x14051fe30]
ret
xor eax, eax
lea rcx, [0x14051fe20]
lea rdx, [0x140435090]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x140274da8
inc rax
jmp 0x140274d90
mov al, 0x32
xchg byte [0x14051fe29], al
lea rax, [0x14051fe20]
ret
xor edx, edx
lea rax, [0x14051fde0]
lea rcx, [0x140435050]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x16
jl 0x140274dd0
mov al, 0xe7
xchg byte [0x14051fdf6], al
lea rax, [0x14051fde0]
ret
Function at 0x140274e40
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140274e7c
test edx, edx
je 0x140274eac
movzx eax, byte [0x14051fdb9]
movzx ecx, byte [0x140520010]
add cl, 0xac
cmp al, cl
je 0x140274e74
mov cl, 0x52
nop
mov al, 0xeb
lock cmpxchg byte [0x14051fdb9], cl
je 0x140274f36
cmp al, 0xe4
jne 0x140274e60
lea rax, [0x14051fdb0]
ret
test edx, edx
je 0x140274ef7
movzx eax, byte [0x14051fe15]
cmp al, 0xcf
je 0x140274ea4
mov cl, 0xa9
nop dword [rax]
mov al, 0xc2
lock cmpxchg byte [0x14051fe15], cl
je 0x140274f81
cmp al, 0xcf
jne 0x140274e90
lea rax, [0x14051fe00]
ret
movzx eax, byte [0x14051feb9]
movzx ecx, byte [0x140520010]
add cl, 0x77
cmp al, cl
je 0x140274eef
nop word cs:[rax + rax]
movzx ecx, byte [0x140520010]
lea eax, [rcx + 0x3e]
add cl, 0x84
lock cmpxchg byte [0x14051feb9], cl
je 0x140274fd8
cmp al, 0xaf
jne 0x140274ed0
lea rax, [0x14051feb0]
ret
movzx eax, byte [0x14051fcd2]
cmp al, 2
je 0x140274f2e
mov cl, 0x8c
nop word cs:[rax + rax]
mov al, 0xcf
lock cmpxchg byte [0x14051fcd2], cl
je 0x140275038
movzx edx, byte [0x140520010]
add dl, 0xca
cmp al, dl
jne 0x140274f10
lea rax, [0x14051fcd0]
ret
xor edx, edx
lea rax, [0x14051fdb0]
lea rcx, [0x140435020]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x140520000]
add edx, r8d
add edx, 0xda2451bc
cmp edx, 9
jl 0x140274f50
mov al, 0xe4
xchg byte [0x14051fdb9], al
lea rax, [0x14051fdb0]
ret
xor edx, edx
lea rax, [0x14051fe00]
lea rcx, [0x140435070]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x140520000]
add edx, r8d
add edx, 0xda2451bc
add r8d, 0xda2451d0
cmp edx, r8d
jl 0x140274fa0
mov al, 0xcf
xchg byte [0x14051fe15], al
lea rax, [0x14051fe00]
ret
xor eax, eax
lea rcx, [0x14051feb0]
lea rdx, [0x140435120]
mov r8d, 0xda2451c4
nop
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x140520000]
add r10d, r8d
cmp r9d, r10d
jge 0x140275021
inc rax
jmp 0x140274ff0
movzx eax, byte [0x140520010]
add al, 0x77
xchg byte [0x14051feb9], al
lea rax, [0x14051feb0]
ret
xor edx, edx
lea rax, [0x14051fcd0]
lea rcx, [0x140434f60]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140520000]
add edx, r8d
add edx, 0xda2451bc
cmp edx, 2
jl 0x140275050
mov al, 2
xchg byte [0x14051fcd2], al
lea rax, [0x14051fcd0]
ret
Function at 0x14027d4d0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14027d532
mov eax, 0x31ad5d14
add eax, dword [0x14052173c]
cmp edx, eax
jne 0x14027d576
movzx eax, byte [0x140520a35]
cmp al, 0x15
je 0x14027d52a
mov cl, 0xf1
nop word cs:[rax + rax]
mov al, 0x10
lock cmpxchg byte [0x140520a35], cl
je 0x14027d5dc
movzx edx, byte [0x140521738]
mov r8d, edx
xor r8b, 0xc5
and dl, 0x45
add dl, dl
add dl, r8b
cmp al, dl
jne 0x14027d500
lea rax, [0x140520a20]
ret
test edx, edx
je 0x14027d5a8
movzx eax, byte [0x1405208d5]
cmp al, 0xcf
je 0x14027d56e
mov cl, 0xb1
nop word cs:[rax + rax]
mov al, 0x18
lock cmpxchg byte [0x1405208d5], cl
je 0x14027d66f
movzx edx, byte [0x140521738]
add dl, 0x7f
cmp al, dl
jne 0x14027d550
lea rax, [0x1405208c0]
ret
movzx eax, byte [0x1405209af]
cmp al, 0x7a
je 0x14027d5a0
mov cl, 0xe1
nop word cs:[rax + rax]
mov al, 0xa7
lock cmpxchg byte [0x1405209af], cl
je 0x14027d618
cmp al, 0x7a
jne 0x14027d590
lea rax, [0x1405209a0]
ret
movzx eax, byte [0x140520876]
cmp al, 0x11
je 0x14027d5d4
mov cl, 0x3c
nop word cs:[rax + rax]
mov al, 0xee
lock cmpxchg byte [0x140520876], cl
je 0x14027d6a8
cmp al, 0x11
jne 0x14027d5c0
lea rax, [0x140520870]
ret
xor eax, eax
lea rcx, [0x140520a20]
lea rdx, [0x1404357d0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x14027d65f
inc rax
jmp 0x14027d5f0
xor edx, edx
lea rax, [0x1405209a0]
lea rcx, [0x140435750]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x14027d630
mov al, 0x7a
xchg byte [0x1405209af], al
lea rax, [0x1405209a0]
ret
mov al, 0x15
xchg byte [0x140520a35], al
lea rax, [0x140520a20]
ret
xor eax, eax
lea rcx, [0x1405208c0]
lea rdx, [0x140435670]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x14027d698
inc rax
jmp 0x14027d680
mov al, 0xcf
xchg byte [0x1405208d5], al
lea rax, [0x1405208c0]
ret
xor eax, eax
lea rcx, [0x140520870]
lea rdx, [0x140435620]
mov r8d, 0x31ad5d1a
nop
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14052173c]
add r10d, r8d
cmp r9d, r10d
jge 0x14027d6e1
inc rax
jmp 0x14027d6c0
mov al, 0x11
xchg byte [0x140520876], al
lea rax, [0x140520870]
ret
Function at 0x14027d700
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x14027d73c
test edx, edx
je 0x14027d76c
movzx eax, byte [0x1405208f6]
cmp al, 0x18
je 0x14027d734
mov cl, 0x82
nop word cs:[rax + rax]
mov al, 0xc5
lock cmpxchg byte [0x1405208f6], cl
je 0x14027d7d6
cmp al, 0x18
jne 0x14027d720
lea rax, [0x1405208e0]
ret
test edx, edx
je 0x14027d79c
movzx eax, byte [0x140520764]
cmp al, 0x1e
je 0x14027d764
mov cl, 0xec
nop dword [rax]
mov al, 8
lock cmpxchg byte [0x140520764], cl
je 0x14027d81f
cmp al, 0x1e
jne 0x14027d750
lea rax, [0x140520760]
ret
movzx eax, byte [0x1405209b9]
cmp al, 0xd3
je 0x14027d794
mov cl, 0x38
nop dword [rax]
mov al, 0x63
lock cmpxchg byte [0x1405209b9], cl
je 0x14027d848
cmp al, 0xd3
jne 0x14027d780
lea rax, [0x1405209b0]
ret
movzx eax, byte [0x140520a05]
cmp al, 0x55
je 0x14027d7ce
mov cl, 0xe4
nop dword [rax]
mov al, 0xe7
lock cmpxchg byte [0x140520a05], cl
je 0x14027d8a8
movzx edx, byte [0x140521738]
add dl, 5
cmp al, dl
jne 0x14027d7b0
lea rax, [0x1405209f0]
ret
xor edx, edx
lea rax, [0x1405208e0]
lea rcx, [0x140435690]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x16
jl 0x14027d7f0
mov al, 0x18
xchg byte [0x1405208f6], al
lea rax, [0x1405208e0]
ret
xor eax, eax
lea rcx, [0x140520760]
lea rdx, [0x140435540]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x14027d891
inc rax
jmp 0x14027d830
xor edx, edx
lea rax, [0x1405209b0]
lea rcx, [0x140435760]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x14052173c]
add edx, r8d
add edx, 0x31ad5d15
cmp edx, 9
jl 0x14027d860
mov al, 0xd3
xchg byte [0x1405209b9], al
lea rax, [0x1405209b0]
ret
movzx eax, byte [0x140521738]
add al, 0xce
xchg byte [0x140520764], al
lea rax, [0x140520760]
ret
xor edx, edx
lea rax, [0x1405209f0]
lea rcx, [0x1404357a0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x14052173c]
add edx, r8d
add edx, 0x31ad5d15
cmp edx, 0x15
jl 0x14027d8c0
mov al, 0x55
xchg byte [0x140520a05], al
lea rax, [0x1405209f0]
ret
Function at 0x14027db10
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x14027db4c
mov eax, 0x31ad5d14
add eax, dword [0x14052173c]
cmp edx, eax
jne 0x14027db7c
movzx eax, byte [0x140520a67]
cmp al, 0xd4
je 0x14027db44
mov cl, 0x25
mov al, 0x46
lock cmpxchg byte [0x140520a67], cl
je 0x14027dbdc
cmp al, 0xd4
jne 0x14027db30
lea rax, [0x140520a50]
ret
test edx, edx
je 0x14027dbac
movzx eax, byte [0x1405206c2]
cmp al, 0xc9
je 0x14027db74
mov cl, 0x74
nop dword [rax]
mov al, 0xfc
lock cmpxchg byte [0x1405206c2], cl
je 0x14027dc71
cmp al, 0xc9
jne 0x14027db60
lea rax, [0x1405206c0]
ret
movzx eax, byte [0x1405208b9]
cmp al, 0x1c
je 0x14027dba4
mov cl, 6
nop dword [rax]
mov al, 0xc9
lock cmpxchg byte [0x1405208b9], cl
je 0x14027dc21
cmp al, 0x1c
jne 0x14027db90
lea rax, [0x1405208b0]
ret
movzx eax, byte [0x140520915]
cmp al, 0xa
je 0x14027dbd4
mov cl, 0x10
nop dword [rax]
mov al, 0x53
lock cmpxchg byte [0x140520915], cl
je 0x14027dcb8
cmp al, 0xa
jne 0x14027dbc0
lea rax, [0x140520900]
ret
xor edx, edx
lea rax, [0x140520a50]
lea rcx, [0x140435800]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x14052173c]
add edx, r8d
add edx, 0x31ad5d15
cmp edx, 0x17
jl 0x14027dbf0
mov al, 0xd4
xchg byte [0x140520a67], al
lea rax, [0x140520a50]
ret
xor eax, eax
lea rcx, [0x1405208b0]
lea rdx, [0x140435660]
mov r8d, 0x31ad5d1d
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14052173c]
add r10d, r8d
cmp r9d, r10d
jge 0x14027dc61
inc rax
jmp 0x14027dc40
mov al, 0x1c
xchg byte [0x1405208b9], al
lea rax, [0x1405208b0]
ret
xor eax, eax
lea rcx, [0x1405206c0]
lea rdx, [0x1404354c0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x14027dca8
inc rax
jmp 0x14027dc90
mov al, 0xc9
xchg byte [0x1405206c2], al
lea rax, [0x1405206c0]
ret
xor eax, eax
lea rcx, [0x140520900]
lea rdx, [0x1404356b0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x14027dce8
inc rax
jmp 0x14027dcd0
mov al, 0xa
xchg byte [0x140520915], al
lea rax, [0x140520900]
ret
Function at 0x14028c660
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14028c698
movzx eax, byte [0x140523df3]
cmp al, 0x71
je 0x14028c690
mov cl, 0x2c
nop word cs:[rax + rax]
mov al, 0x3e
lock cmpxchg byte [0x140523df3], cl
je 0x14028c6c8
cmp al, 0x71
jne 0x14028c680
lea rax, [0x140523df0]
ret
movzx eax, byte [0x140523e51]
cmp al, 4
je 0x14028c6c0
mov cl, 0x3c
nop word cs:[rax + rax]
mov al, 0x74
lock cmpxchg byte [0x140523e51], cl
je 0x14028c70f
cmp al, 4
jne 0x14028c6b0
lea rax, [0x140523e40]
ret
xor edx, edx
lea rax, [0x140523df0]
lea rcx, [0x140436180]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 3
jl 0x14028c6e0
mov al, 0x71
xchg byte [0x140523df3], al
lea rax, [0x140523df0]
ret
xor eax, eax
lea rcx, [0x140523e40]
lea rdx, [0x1404361d0]
xor r9d, 0x6c61cd9f
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r8b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r8b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
mov r10d, dword [0x140523f80]
add r10d, r9d
cmp r8d, r10d
jge 0x14028c761
inc rax
jmp 0x14028c730
mov al, 4
xchg byte [0x140523e51], al
lea rax, [0x140523e40]
ret