joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140213c50
Capabilities:
Check for software breakpoints

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x140213cbc
mov eax, r8d
xor eax, 0xf4b469cb
add eax, dword [0x1404dd088]
cmp edx, eax
jne 0x140213cec
movzx eax, byte [0x1404dcd6d]
movzx ecx, byte [0x1404dd098]
mov edx, r8d
xor dl, 0xa3
mov r9d, ecx
xor r9b, cl
not r9b
and r9b, dl
xor r9b, cl
and dl, cl
add dl, dl
add dl, r9b
cmp al, dl
je 0x140213cb4
mov cl, 0x93
nop
mov al, 0xee
lock cmpxchg byte [0x1404dcd6d], cl
je 0x140213dc3
cmp al, 0xc2
jne 0x140213ca0
lea rax, [0x1404dcd60]
ret
test edx, edx
je 0x140213d1c
movzx eax, byte [0x1404dcbb3]
cmp al, 0xc4
je 0x140213ce4
mov cl, 0x34
nop dword [rax]
mov al, 0xea
lock cmpxchg byte [0x1404dcbb3], cl
je 0x140213e52
cmp al, 0xc4
jne 0x140213cd0
lea rax, [0x1404dcbb0]
ret
movzx eax, byte [0x1404dccdf]
cmp al, 0xcc
je 0x140213d14
mov cl, 0x80
nop dword [rax]
mov al, 0xf8
lock cmpxchg byte [0x1404dccdf], cl
je 0x140213df8
cmp al, 0xcc
jne 0x140213d00
lea rax, [0x1404dccd0]
ret
movzx eax, byte [0x1404dcd8d]
nop word cs:[rax + rax]
cmp al, 0xe1
je 0x140213eb3
movzx ecx, byte [0x1404dd098]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0xf9
mov eax, r8d
and al, 6
or al, r9b
add al, 0x51
mov r9d, eax
xor r9b, cl
and al, cl
add al, al
add al, r9b
add al, 0xaf
and dl, 0xf7
mov r9d, r8d
and r9b, 8
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x1404dcd8d], r9b
jne 0x140213d30
xor eax, eax
lea rcx, [0x1404dcd80]
lea rdx, [0x1403f7910]
nop
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r8b
mov r10d, r8d
and r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140213eab
inc rax
jmp 0x140213d90
xor eax, eax
lea rcx, [0x1404dcd60]
lea rdx, [0x1403f78f0]
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xc
jg 0x140213e28
inc rax
jmp 0x140213de0
xor eax, eax
lea rcx, [0x1404dccd0]
lea rdx, [0x1403f7860]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x140213e42
inc rax
jmp 0x140213e10
xor r8b, 0xa3
add r8b, byte [0x1404dd098]
xchg byte [0x1404dcd6d], r8b
lea rax, [0x1404dcd60]
ret
mov al, 0xcc
xchg byte [0x1404dccdf], al
lea rax, [0x1404dccd0]
ret
xor eax, eax
lea rcx, [0x1404dcbb0]
lea rdx, [0x1403f7750]
mov r9d, r8d
xor r9d, 0xf4b469ce
nop dword [rax]
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x1404dd088]
add r11d, r9d
cmp r10d, r11d
jge 0x140213e91
inc rax
jmp 0x140213e70
xor r8b, 0xa5
add r8b, byte [0x1404dd098]
xchg byte [0x1404dcbb3], r8b
lea rax, [0x1404dcbb0]
ret
mov al, 0xe1
xchg byte [0x1404dcd8d], al
lea rax, [0x1404dcd80]
ret
Function at 0x1402262d0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140226371
test edx, edx
je 0x1402263a8
movzx eax, byte [0x1404de9a3]
nop word [rax + rax]
cmp al, 0x9f
je 0x140226369
movzx ecx, byte [0x1404df460]
lea eax, [rcx - 0x21]
add cl, 0x96
lock cmpxchg byte [0x1404de9a3], cl
jne 0x1402262f0
xor edx, edx
lea rax, [0x1404de9a0]
lea rcx, [0x1403f8680]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1404df464]
lea r9d, [r8 + 0x10373ddc]
mov r10d, edx
xor r10d, r9d
and edx, r9d
lea edx, [r10 + rdx*2]
mov r9d, r8d
xor r9d, 0x10373dde
and r8d, 0x10373dde
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x140226320
mov al, 0x9f
xchg byte [0x1404de9a3], al
lea rax, [0x1404de9a0]
ret
test edx, edx
je 0x1402263dc
movzx eax, byte [0x1404dec3d]
cmp al, 0x92
je 0x1402263a0
mov cl, 0x33
nop word cs:[rax + rax]
mov al, 0xcb
lock cmpxchg byte [0x1404dec3d], cl
je 0x14022640c
cmp al, 0x92
jne 0x140226390
lea rax, [0x1404dec30]
ret
movzx eax, byte [0x1404dec7b]
cmp al, 0x84
je 0x1402263d4
mov cl, 0x26
nop word cs:[rax + rax]
mov al, 0x1b
lock cmpxchg byte [0x1404dec7b], cl
je 0x140226461
cmp al, 0x84
jne 0x1402263c0
lea rax, [0x1404dec70]
ret
movzx eax, byte [0x1404deacf]
cmp al, 0xfd
je 0x140226404
mov cl, 0xa
nop dword [rax]
mov al, 0x15
lock cmpxchg byte [0x1404deacf], cl
je 0x1402264b8
cmp al, 0xfd
jne 0x1402263f0
lea rax, [0x1404deac0]
ret
xor eax, eax
lea rcx, [0x1404dec30]
lea rdx, [0x1403f8900]
mov r8d, 0x10373de8
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x1404df464]
add r10d, r8d
cmp r9d, r10d
jge 0x140226498
inc rax
jmp 0x140226430
xor eax, eax
lea rcx, [0x1404dec70]
lea rdx, [0x1403f8940]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x1402264a8
inc rax
jmp 0x140226480
mov al, 0x92
xchg byte [0x1404dec3d], al
lea rax, [0x1404dec30]
ret
mov al, 0x84
xchg byte [0x1404dec7b], al
lea rax, [0x1404dec70]
ret
xor eax, eax
lea rcx, [0x1404deac0]
lea rdx, [0x1403f8790]
nop dword [rax + rax]
cdqe
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
mov r8d, dword [0x1404df464]
mov r9d, r8d
xor r9d, 0x10373ddc
and r8d, 0x10373ddc
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0xf
jl 0x1402264d0
mov al, 0xfd
xchg byte [0x1404deacf], al
lea rax, [0x1404deac0]
ret
Function at 0x1402387d0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140238816
test edx, edx
je 0x140238856
movzx eax, byte [0x1404e0ef3]
cmp al, 0x8f
je 0x14023880e
mov cl, 0x52
nop word cs:[rax + rax]
mov al, 0x23
lock cmpxchg byte [0x1404e0ef3], cl
je 0x1402388d7
movzx edx, byte [0x1404e1544]
add dl, 0x28
cmp al, dl
jne 0x1402387f0
lea rax, [0x1404e0ef0]
ret
test edx, edx
je 0x140238896
movzx eax, byte [0x1404e0eb5]
cmp al, 0x71
je 0x14023884e
mov cl, 0x36
nop word [rax + rax]
mov al, 0xcb
lock cmpxchg byte [0x1404e0eb5], cl
je 0x140238921
movzx edx, byte [0x1404e1544]
add dl, 0xa
cmp al, dl
jne 0x140238830
lea rax, [0x1404e0ea0]
ret
movzx eax, byte [0x1404e0c82]
cmp al, 0xb0
je 0x14023888e
mov cl, 0x60
nop word cs:[rax + rax]
mov al, 0x3d
lock cmpxchg byte [0x1404e0c82], cl
je 0x14023897b
movzx edx, byte [0x1404e1544]
add dl, 0x49
cmp al, dl
jne 0x140238870
lea rax, [0x1404e0c80]
ret
movzx eax, byte [0x1404e1007]
movzx ecx, byte [0x1404e1544]
add cl, 0x3e
cmp al, cl
je 0x1402388cf
nop dword [rax + rax]
movzx ecx, byte [0x1404e1544]
lea eax, [rcx - 0x48]
add cl, 0x3b
lock cmpxchg byte [0x1404e1007], cl
je 0x1402389b8
cmp al, 0xa5
jne 0x1402388b0
lea rax, [0x1404e0ff0]
ret
xor edx, edx
lea rax, [0x1404e0ef0]
lea rcx, [0x1403f9510]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1404e1540]
add edx, r8d
add edx, 0xd87c9fa3
cmp edx, 3
jl 0x1402388f0
mov al, 0x8f
xchg byte [0x1404e0ef3], al
lea rax, [0x1404e0ef0]
ret
xor edx, edx
lea rax, [0x1404e0ea0]
lea rcx, [0x1403f94c0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0xbdf18d08
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x420e72f8
cmp edx, 0x15
jl 0x140238940
mov al, 0x71
xchg byte [0x1404e0eb5], al
lea rax, [0x1404e0ea0]
ret
xor eax, eax
lea rcx, [0x1404e0c80]
lea rdx, [0x1403f92f0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x1402389a8
inc rax
jmp 0x140238990
mov al, 0xb0
xchg byte [0x1404e0c82], al
lea rax, [0x1404e0c80]
ret
xor edx, edx
lea rax, [0x1404e0ff0]
lea rcx, [0x1403f9610]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1404e1540]
add edx, r8d
add edx, 0xd87c9fa3
cmp edx, 0x17
jl 0x1402389d0
mov al, 0xa5
xchg byte [0x1404e1007], al
lea rax, [0x1404e0ff0]
ret
Function at 0x140238d10
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1404e1540]
mov r8d, eax
xor r8d, 0xd87c9fa2
not eax
and eax, 0x2783605d
or eax, r8d
not eax
lea eax, [r8 + rax*2]
cmp ecx, eax
jne 0x140238d6c
test edx, edx
je 0x140238ddc
movzx eax, byte [0x1404e0e96]
cmp al, 0x52
je 0x140238d64
mov cl, 0x55
nop dword [rax]
mov al, 0xf9
lock cmpxchg byte [0x1404e0e96], cl
je 0x140238e0c
cmp al, 0x52
jne 0x140238d50
lea rax, [0x1404e0e80]
ret
mov eax, 0xd87c9fa2
add eax, dword [0x1404e1540]
cmp edx, eax
jne 0x140238dac
movzx eax, byte [0x1404e0f03]
cmp al, 0x34
je 0x140238da4
mov cl, 0xef
nop dword [rax + rax]
mov al, 0xf1
lock cmpxchg byte [0x1404e0f03], cl
je 0x140238e48
cmp al, 0x34
jne 0x140238d90
lea rax, [0x1404e0f00]
ret
movzx eax, byte [0x1404e0e25]
cmp al, 0x38
je 0x140238dd4
mov cl, 0xc8
nop dword [rax]
mov al, 0x32
lock cmpxchg byte [0x1404e0e25], cl
je 0x140238e95
cmp al, 0x38
jne 0x140238dc0
lea rax, [0x1404e0e20]
ret
movzx eax, byte [0x1404e0d28]
cmp al, 0x41
je 0x140238e04
mov cl, 0xed
nop dword [rax]
mov al, 0x3f
lock cmpxchg byte [0x1404e0d28], cl
je 0x140238f0c
cmp al, 0x41
jne 0x140238df0
lea rax, [0x1404e0d20]
ret
xor eax, eax
lea rcx, [0x1404e0e80]
lea rdx, [0x1403f94a0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x15
jg 0x140238e38
inc rax
jmp 0x140238e20
mov al, 0x52
xchg byte [0x1404e0e96], al
lea rax, [0x1404e0e80]
ret
xor edx, edx
lea rax, [0x1404e0f00]
lea rcx, [0x1403f9520]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0x7ffffffe
and r8d, edx
xor edx, 1
lea edx, [rdx + r8*2]
cmp edx, 3
jl 0x140238e60
mov al, 0x34
xchg byte [0x1404e0f03], al
lea rax, [0x1404e0f00]
ret
xor r8d, r8d
lea rax, [0x1404e0e20]
lea rcx, [0x1403f9440]
mov edx, 0xd87c9fa3
nop dword [rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rax]
movzx r10d, byte [r8 + rcx]
not r10b
mov r11d, r10d
or r11b, r9b
not r11b
and r10b, r9b
or r10b, r11b
mov byte [r8 + rax], r10b
mov r9d, dword [0x1404e1540]
add r9d, edx
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
add r9d, r9d
mov r8d, r10d
xor r8d, r9d
and r9d, r10d
lea r8d, [r8 + r9*2]
cmp r8d, 5
jl 0x140238eb0
mov al, 0x38
xchg byte [0x1404e0e25], al
lea rax, [0x1404e0e20]
ret
xor eax, eax
lea rcx, [0x1404e0d20]
lea rdx, [0x1403f9370]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 7
jg 0x140238f38
inc rax
jmp 0x140238f20
mov al, 0x41
xchg byte [0x1404e0d28], al
lea rax, [0x1404e0d20]
ret
Function at 0x140238f50
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140238fb2
test edx, edx
je 0x14023901c
movzx eax, byte [0x1404e0e75]
movzx ecx, byte [0x1404e1544]
add cl, 0x63
cmp al, cl
je 0x140238faa
mov cl, 0xdb
nop word cs:[rax + rax]
mov al, 0x30
lock cmpxchg byte [0x1404e0e75], cl
je 0x14023907c
movzx edx, byte [0x1404e1544]
mov r8d, edx
xor r8b, 0x63
and dl, 0x63
add dl, dl
add dl, r8b
cmp al, dl
jne 0x140238f80
lea rax, [0x1404e0e60]
ret
test edx, edx
je 0x14023904c
movzx eax, byte [0x1404e0d59]
nop word cs:[rax + rax]
cmp al, 0x7c
je 0x1402390da
movzx ecx, byte [0x1404e1544]
lea eax, [rcx - 0x6a]
add cl, 0x66
lock cmpxchg byte [0x1404e0d59], cl
jne 0x140238fd0
xor eax, eax
lea rcx, [0x1404e0d50]
lea rdx, [0x1403f9390]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1402390cb
inc rax
jmp 0x140239000
movzx eax, byte [0x1404e0fed]
cmp al, 0xdc
je 0x140239044
mov cl, 0x9e
nop dword [rax]
mov al, 0xe9
lock cmpxchg byte [0x1404e0fed], cl
je 0x1402390e2
cmp al, 0xdc
jne 0x140239030
lea rax, [0x1404e0fe0]
ret
movzx eax, byte [0x1404e0e16]
cmp al, 0xbf
je 0x140239074
mov cl, 0xaa
nop dword [rax]
mov al, 0x9c
lock cmpxchg byte [0x1404e0e16], cl
je 0x140239160
cmp al, 0xbf
jne 0x140239060
lea rax, [0x1404e0e10]
ret
xor edx, edx
lea rax, [0x1404e0e60]
lea rcx, [0x1403f9480]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0x3a710021
mov r8d, edx
xor r8d, 0xc58effe0
and edx, 0x458effe0
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x140239090
mov al, 0xca
xchg byte [0x1404e0e75], al
lea rax, [0x1404e0e60]
ret
movzx eax, byte [0x1404e1544]
add al, 0x15
xchg byte [0x1404e0d59], al
lea rax, [0x1404e0d50]
ret
xor r8d, r8d
lea rax, [0x1404e0fe0]
lea rcx, [0x1403f9600]
mov edx, 0xd87c9fa3
nop dword [rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rax]
movzx r10d, byte [r8 + rcx]
not r10b
mov r11d, r10d
or r11b, r9b
not r11b
and r10b, r9b
or r10b, r11b
mov byte [r8 + rax], r10b
mov r9d, dword [0x1404e1540]
add r9d, edx
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r8d, [r10 + r9*2]
cmp r8d, 0xd
jl 0x140239100
movzx eax, byte [0x1404e1544]
mov ecx, eax
xor cl, 0x75
and al, 0x75
add al, al
add al, cl
xchg byte [0x1404e0fed], al
lea rax, [0x1404e0fe0]
ret
xor eax, eax
lea rcx, [0x1404e0e10]
lea rdx, [0x1403f9430]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x140239188
inc rax
jmp 0x140239170
mov al, 0xbf
xchg byte [0x1404e0e16], al
lea rax, [0x1404e0e10]
ret
Function at 0x14024b6c0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14024b6fc
test edx, edx
je 0x14024b72c
movzx eax, byte [0x1404e47b8]
cmp al, 0x7f
je 0x14024b6f4
mov cl, 0xe3
nop word cs:[rax + rax]
mov al, 0x82
lock cmpxchg byte [0x1404e47b8], cl
je 0x14024b7b7
cmp al, 0x7f
jne 0x14024b6e0
lea rax, [0x1404e47a0]
ret
test edx, edx
je 0x14024b75c
movzx eax, byte [0x1404e4705]
cmp al, 0xd8
je 0x14024b724
mov cl, 0x58
nop dword [rax]
mov al, 0x8b
lock cmpxchg byte [0x1404e4705], cl
je 0x14024b7f8
cmp al, 0xd8
jne 0x14024b710
lea rax, [0x1404e46f0]
ret
movzx eax, byte [0x1404e485d]
cmp al, 0x41
je 0x14024b754
mov cl, 0xdf
nop dword [rax]
mov al, 0x16
lock cmpxchg byte [0x1404e485d], cl
je 0x14024b838
cmp al, 0x41
jne 0x14024b740
lea rax, [0x1404e4850]
ret
movzx eax, byte [0x1404e464a]
cmp al, 0x60
je 0x14024b7af
nop word [rax + rax]
movzx ecx, byte [0x1404e5070]
mov edx, ecx
xor dl, 0xf6
mov eax, ecx
and al, 0x76
add al, al
add al, dl
mov edx, ecx
xor dl, 0xe4
and cl, 0x64
add cl, cl
add cl, dl
add cl, 0xc
lock cmpxchg byte [0x1404e464a], cl
je 0x14024b888
movzx ecx, byte [0x1404e5070]
add cl, 0xfa
cmp al, cl
jne 0x14024b770
lea rax, [0x1404e4640]
ret
xor eax, eax
lea rcx, [0x1404e47a0]
lea rdx, [0x1403fa4c0]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x17
jg 0x14024b7e8
inc rax
jmp 0x14024b7d0
mov al, 0x7f
xchg byte [0x1404e47b8], al
lea rax, [0x1404e47a0]
ret
xor eax, eax
lea rcx, [0x1404e46f0]
lea rdx, [0x1403fa420]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x14024b868
inc rax
jmp 0x14024b810
xor eax, eax
lea rcx, [0x1404e4850]
lea rdx, [0x1403fa570]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14024b878
inc rax
jmp 0x14024b850
mov al, 0xd8
xchg byte [0x1404e4705], al
lea rax, [0x1404e46f0]
ret
mov al, 0x41
xchg byte [0x1404e485d], al
lea rax, [0x1404e4850]
ret
xor edx, edx
lea rax, [0x1404e4640]
lea rcx, [0x1403fa380]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x1404e5080]
add edx, r8d
add edx, 0xab387154
cmp edx, 0xa
jl 0x14024b8a0
movzx eax, byte [0x1404e5070]
add al, 0xfa
xchg byte [0x1404e464a], al
lea rax, [0x1404e4640]
ret
Function at 0x14024c5d0
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14024c60c
test edx, edx
je 0x14024c64c
movzx eax, byte [0x1404e48ed]
cmp al, 0x88
je 0x14024c604
mov cl, 1
nop word [rax + rax]
mov al, 0xcf
lock cmpxchg byte [0x1404e48ed], cl
je 0x14024c71c
cmp al, 0x88
jne 0x14024c5f0
lea rax, [0x1404e48e0]
ret
test edx, edx
je 0x14024c6cf
movzx eax, byte [0x1404e4786]
cmp al, 0x52
je 0x14024c644
mov cl, 0x1f
nop word cs:[rax + rax]
mov al, 0xe5
lock cmpxchg byte [0x1404e4786], cl
je 0x14024c76c
cmp al, 0x52
jne 0x14024c630
lea rax, [0x1404e4780]
ret
movzx eax, byte [0x1404e493b]
nop word cs:[rax + rax]
cmp al, 8
je 0x14024c6c7
movzx ecx, byte [0x1404e5070]
mov eax, r8d
xor al, 0x42
add al, cl
mov edx, r8d
xor dl, 0x6a
add dl, cl
lock cmpxchg byte [0x1404e493b], dl
jne 0x14024c660
xor edx, edx
lea rax, [0x1404e4930]
lea rcx, [0x1403fa640]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xb
jl 0x14024c6a0
mov al, 8
xchg byte [0x1404e493b], al
lea rax, [0x1404e4930]
ret
movzx eax, byte [0x1404e46e6]
cmp al, 0xcc
je 0x14024c714
nop word [rax + rax]
movzx ecx, byte [0x1404e5070]
mov eax, r8d
xor al, 0xd5
add al, cl
mov edx, r8d
xor dl, 0xd0
add dl, cl
lock cmpxchg byte [0x1404e46e6], dl
je 0x14024c7bd
mov ecx, r8d
xor cl, 0xfa
add cl, byte [0x1404e5070]
cmp al, cl
jne 0x14024c6e0
lea rax, [0x1404e46d0]
ret
xor eax, eax
lea rcx, [0x1404e48e0]
lea rdx, [0x1403fa600]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14024c75c
inc rax
jmp 0x14024c730
mov al, 0x88
xchg byte [0x1404e48ed], al
lea rax, [0x1404e48e0]
ret
xor eax, eax
lea rcx, [0x1404e4780]
lea rdx, [0x1403fa4a0]
xor r8d, 0x4b839cc8
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x1404e5080]
add r9d, r8d
add eax, r9d
cmp eax, 6
jl 0x14024c790
mov al, 0x52
xchg byte [0x1404e4786], al
lea rax, [0x1404e4780]
ret
xor eax, eax
lea rcx, [0x1404e46d0]
lea rdx, [0x1403fa400]
xor r8d, 0x4b839cc8
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x1404e5080]
add r9d, r8d
add eax, r9d
cmp eax, 0x16
jl 0x14024c7e0
mov al, 0xcc
xchg byte [0x1404e46e6], al
lea rax, [0x1404e46d0]
ret
Function at 0x14029db40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0xfffffffe
test rcx, rcx
je 0x14029db8e
cmp qword [rcx + 0x30], 0
je 0x14029db8e
cmp qword [rcx + 0x38], 0
je 0x14029db8e
mov rdx, qword [rcx + 0x28]
test rdx, rdx
setne r8b
sete r10b
movzx r9d, byte [0x14051cf08]
xor r8b, r10b
and r8b, r9b
and r9b, r10b
xor r8b, r10b
test r9b, r8b
jne 0x14029db8e
xor r9b, r8b
test r9b, 1
jne 0x14029db8e
cmp qword [rdx], rcx
je 0x14029db8f
ret
mov r8d, dword [0x14051e168]
add r8d, dword [rdx + 8]
mov edx, dword [0x1404f1268]
mov r9d, edx
xor r9d, 0x22f4bff9
mov r10d, edx
and r10d, 0x22f4bff9
add r10d, r10d
mov r11d, r9d
xor r11d, r10d
and r10d, r9d
lea r9d, [r11 + r10*2]
add r9d, r8d
add edx, 0x22f4ff4d
cmp r9d, edx
jae 0x14029db8e
mov rdx, qword [rcx + 0x28]
mov qword [rdx + 0x34], 0
mov r8d, 0x22f4ff2d
add r8d, dword [0x1404f1268]
mov dword [rdx + 0x3c], r8d
cmp byte [0x14051d0a8], 0
jne 0x14029db8e
cmp qword [rcx + 0x30], 0
je 0x14029db8e
cmp qword [rcx + 0x38], 0
je 0x14029db8e
mov rdx, qword [rcx + 0x28]
test rdx, rdx
je 0x14029db8e
cmp qword [rdx], rcx
jne 0x14029db8e
mov r8d, dword [rdx + 8]
mov r9d, r8d
xor r9d, 0x3f33
and r9d, r8d
xor r8d, 0xffffc0cc
lea r8d, [r8 + r9*2]
cmp r8d, 0x1f
ja 0x14029db8e
mov dword [rdx + 0x24], 0
mov dword [rcx + 0x1c], 0
mov dword [rcx + 0xc], 0
mov qword [rcx + 0x20], 0
mov eax, dword [rdx + 0x10]
test eax, eax
je 0x14029dc7d
mov r8d, eax
not r8d
xor eax, 1
and r8d, 0xfffffffe
or r8d, eax
not r8d
mov dword [rcx + 0x4c], r8d
mov qword [rdx + 8], 0x3f34
movabs rax, 0xffffffff00000000
mov qword [rdx + 0x14], rax
mov dword [rdx + 0x1c], 0x8000
mov qword [rdx + 0x28], 0
mov qword [rdx + 0x48], 0
lea rax, [rdx + 0x550]
mov qword [rdx + 0x88], rax
mov qword [rdx + 0x68], rax
mov qword [rdx + 0x60], rax
mov dword [rdx + 0x1be0], 1
mov eax, 0x22f4ff2c
add eax, dword [0x1404f1268]
mov dword [rdx + 0x1be4], eax
xor eax, eax
ret
Function at 0x14030a5b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov rdx, qword [rcx]
mov r8, qword [rcx + 8]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 0
lea rdi, [rbp - 0x20]
mov rcx, rdi
call fcn.14030c980
cmp rdi, rsi
je 0x14030a60c
movups xmm0, xmmword [rsi]
movaps xmm1, xmmword [rbp - 0x20]
movaps xmmword [rbp - 0x20], xmm0
movups xmmword [rsi], xmm1
mov rax, qword [rbp - 0x10]
mov rcx, qword [rsi + 0x10]
mov qword [rbp - 0x10], rcx
mov qword [rsi + 0x10], rax
mov rsi, qword [rbp - 0x20]
test rsi, rsi
je 0x14030a6eb
mov eax, dword [0x14051fbd0]
mov ecx, dword [0x1404fe540]
neg ecx
add ecx, eax
add ecx, 0x2ed0e208
imul ecx, eax
test cl, 1
jne 0x14030a64c
mov rdi, qword [rbp - 0x18]
mov eax, dword [0x14051fbd0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
je 0x14030a6b5
mov ecx, 0xd12f1df9
nop word cs:[rax + rax]
mov edx, dword [0x14051fbd0]
lea eax, [rdx - 0x58601262]
mov r8d, eax
xor r8d, 0x58601261
and eax, 0x58601261
lea eax, [r8 + rax*2]
imul eax, edx
mov r8d, dword [0x1404fe540]
add r8d, ecx
xor edx, edx
div r8d
test edx, edx
jne 0x14030a660
jmp 0x14030a637
mov rax, qword [rsi]
mov rax, qword [rax]
mov rcx, rsi
xor edx, edx
call qword [case.0x1400f5c95.0]
add rsi, 0x28
cmp rsi, rdi
jne 0x14030a6a0
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x14030a6e6
mov rax, qword [rcx - 8]
sub rcx, rax
add rcx, 0xfffffffffffffff8
cmp rcx, 0x20
jae 0x14030a6f4
add rdx, 0x27
mov rcx, rax
call fcn.1400a8a50
nop
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
call fcn.140388c3c
int3

Function at 0x140310ea0
Capabilities:
Parse pe header

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x18], rdx
call fcn.140327a80
cmp byte [0x14051cf08], 0
jne 0x140310edc
test byte [0x14051d3d1], 1
jne 0x140310edc
test rax, rax
je 0x140310edc
add rsp, 0x40
pop rbp
ret
mov ecx, 0x7f
call fcn.140152bb0
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
mov r8d, 0x277e9ddf
add rsp, 0x40
pop rbp
jmp fcn.140310fe0

Function at 0x140310f30
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov r8d, 0x277e9ddf
jmp fcn.140310fe0
Function at 0x140324490
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
xor eax, eax
test rcx, rcx
je 0x14032467c
test rdx, rdx
je 0x14032467c
mov al, 1
cmp rcx, rdx
je 0x14032467c
movabs r9, 0x471678427cef9952
xor r8d, r8d
xor r10d, r10d
nop word cs:[rax + rax]
movzx r11d, byte [0x140503678]
mov ebx, r11d
mov esi, r11d
mov edi, r11d
xor dil, 0x38
and dil, r11b
xor r11b, 8
and bl, 8
add bl, bl
add bl, r11b
add bl, 0x3e
mov r11, qword [0x14051df88]
sub r11, r9
xor sil, 0x47
add dil, dil
add dil, sil
xor esi, esi
cmp byte [rcx + r8], bl
setne sil
movzx edi, dil
movzx r10d, r10b
cmove r10d, edi
add r11, r9
add r8, r11
add r8, rsi
test r10b, 1
je 0x1403244d0
xor r9d, r9d
xor r10d, r10d
jmp 0x140324575
movzx r10d, byte [0x140503678]
add r10b, 0x47
movzx r10d, r10b
mov r11b, bl
add r9, r11
mov r11d, r10d
not r11b
mov ebx, r10d
xor bl, 1
mov esi, r10d
xor sil, 0xfe
and sil, r11b
or sil, bl
cmp sil, 0xff
jne 0x140324588
xor r11d, r11d
cmp byte [rdx + r9], 0
setne bl
je 0x140324540
movzx r10d, r10b
jmp 0x140324550
cmp r8, r9
jne 0x14032467a
test r8, r8
je 0x14032467c
xor r9d, r9d
xor r10d, r10d
jmp 0x1403245da
cmp r11b, bl
cmove edi, ebp
add r9d, dword [0x140503668]
mov r10d, dword [0x14051df04]
add r9d, r10d
add r9d, 0x409ed8c6
mov r10d, edi
cmp r8, r9
jbe 0x14032467c
movzx r11d, byte [rcx + r9]
movzx esi, byte [rdx + r9]
cmp r11b, sil
je 0x140324641
mov ebx, r10d
not bl
mov edi, r10d
xor dil, 1
and bl, 0xfe
or bl, dil
cmp bl, 0xff
jne 0x14032467a
mov ebx, r11d
lea edi, [r11 - 0x20]
movzx ebp, r11b
xor r11b, 0x9f
and bl, 0x1f
add bl, bl
add bl, r11b
cmp bl, 0x1a
movzx r11d, dil
cmovae r11d, ebp
movzx ebx, byte [0x140503678]
add bl, sil
add bl, 0xe5
cmp bl, 0x1a
jae 0x140324638
add sil, 0xe0
movzx esi, sil
cmp r11b, sil
jne 0x14032467a
movzx r14d, byte [0x140503678]
lea ebx, [r14 + 0x74]
mov edi, r14d
xor dil, 0x74
and r14b, 0x74
add r14b, r14b
add r14b, dil
mov ebp, 1
mov edi, 1
cmp sil, r14b
je 0x1403245b0
movzx edi, r10b
jmp 0x1403245b0
xor eax, eax
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret