joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401df3f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x218
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x190], 0xfffffffffffffffe
cmp qword [rcx + 0x18], 0
je 0x1401df584
mov rsi, rcx
lea rbx, [0x140469d20]
mov qword [rbp + 0x108], rbx
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x148], 0xf
mov byte [rbp + 0x130], 0
lea rax, [0x140463118]
mov qword [rbp + 0x128], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x158], xmm0
mov qword [rbp + 0x168], 0
mov byte [rbp + 0x170], 1
mov dword [rbp + 0x174], 1
movups xmmword [rbp + 0x178], xmm0
mov qword [rbp + 0x188], 0
lea rax, [0x140464fc8]
mov qword [rbp + 0x150], rax
mov byte [rbp + 0x110], 0
mov qword [rbp + 0x120], 0
mov qword [rbp + 0x118], rdx
mov rax, qword [rcx + 0x20]
mov rcx, qword [rax + 8]
cmp byte [rcx + 0x19], 0
mov r14, rax
jne 0x1401df508
mov r14, rax
nop dword [rax]
lea r8, [rcx + 0x10]
cmp qword [rcx + 0x30], rdx
cmovae r14, rcx
cmovae r8, rcx
mov rcx, qword [r8]
movzx r8d, byte [0x14054d070]
xor r9d, r9d
sub r9b, r8b
mov r8d, r9d
xor r8b, 0xf7
and r9b, 0x77
add r9b, r9b
add r9b, r8b
add r9b, byte [rcx + 0x19]
je 0x1401df4d0
cmp byte [r14 + 0x19], 0
je 0x1401df599
xor edi, edi
lea rcx, [rbp + 0x150]
mov qword [rbp + 0x108], rbx
call fcn.140074050
mov rax, qword [rbp + 0x148]
cmp rax, 0x10
jb 0x1401df586
mov rcx, qword [rbp + 0x130]
mov rdx, rax
xor rdx, 1
mov r8d, eax
and r8d, 1
lea rdx, [rdx + r8*2]
cmp rdx, 0x1000
jb 0x1401df57d
mov r8, qword [rcx - 8]
sub rcx, r8
add rcx, 0xfffffffffffffff8
cmp rcx, 0x20
jae 0x1401df6af
mov rcx, rax
xor rcx, 0x28
and eax, 0x28
lea rdx, [rcx + rax*2]
mov rcx, r8
call fcn.1400a82c0
jmp 0x1401df586
xor edi, edi
mov rax, rdi
add rsp, 0x218
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
xor edi, edi
cmp qword [r14 + 0x30], rdx
ja 0x1401df515
cmp r14, rax
je 0x1401df515
cmp byte [r14 + 0x28], 0
je 0x1401df5c7
call fcn.140080870
mov rcx, rax
call fcn.14015c980
jmp 0x1401df699
movzx eax, byte [0x14054d070]
mov ecx, eax
xor cl, 0x76
and cl, al
xor al, 9
add cl, cl
add cl, al
cmp byte [rsi + 8], cl
jne 0x1401df613
mov rcx, qword [rsi + 0x10]
mov eax, dword [rsi + 0x34]
mov r9d, dword [rsi + 0x30]
lea rdx, [rsi + 0x38]
mov dword [rsp + 0x20], eax
mov r8d, 0x10
call fcn.14013edb0
test al, al
jne 0x1401df607
call fcn.14017c320
movzx eax, byte [0x14054d070]
add al, 0xa
mov byte [rsi + 8], al
mov byte [rbp - 0x50], 0
lea r15, [rbp - 0x4c]
mov r8d, 0x150
mov rcx, r15
xor edx, edx
call fcn.140446830
mov rcx, r15
xor edx, edx
call fcn.1402c1e20
add rsi, 0x38
lea rdi, [rbp + 4]
movzx r9d, byte [rbp - 0x50]
add r9d, dword [0x1405a9d28]
add r9d, dword [0x1405a9d2c]
mov qword [rsp + 0x20], rdi
mov r8d, 0x10
mov rcx, r15
mov rdx, rsi
call fcn.1402c1fd0
lea rax, [rbp - 0x4c]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov rdx, qword [r14 + 0x78]
movsxd r8, edx
test rdx, rdx
je 0x1401df680
mov rdx, qword [r14 + 0x70]
mov rcx, rax
mov r9, rdx
call fcn.1402c2990
mov byte [r14 + 0x28], 1
lea rcx, [rbp - 0x4c]
call fcn.1402c2260
mov rdi, qword [r14 + 0x78]
test rdi, rdi
je 0x1401df515
mov rdi, qword [r14 + 0x70]
jmp 0x1401df515
call fcn.1403fe3cc
int3
Function at 0x1401e0b30
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401e0b89
test edx, edx
je 0x1401e0c03
movzx eax, byte [0x14054ce30]
cmp al, 0xd1
je 0x1401e0b81
mov cl, 0xd7
nop dword [rax]
mov al, 0x6b
lock cmpxchg byte [0x14054ce30], cl
je 0x1401e0c7c
movzx edx, byte [0x14054d070]
mov r8d, edx
xor r8b, 0xda
not dl
and dl, 0x25
or dl, r8b
not dl
add dl, dl
add dl, r8b
cmp al, dl
jne 0x1401e0b50
lea rax, [0x14054ce20]
ret
test edx, edx
je 0x1401e0c46
movzx eax, byte [0x14054ce93]
nop dword [rax + rax]
cmp al, 0x26
je 0x1401e0cd3
movzx ecx, byte [0x14054d070]
lea eax, [rcx + 0x79]
add cl, 0x92
lock cmpxchg byte [0x14054ce93], cl
jne 0x1401e0ba0
xor eax, eax
lea rcx, [0x14054ce90]
lea rdx, [0x140469c90]
nop
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r8b
not r9b
mov r10d, r8d
xor r10b, r9b
or r9b, r8b
and r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1401e0ccb
inc rax
jmp 0x1401e0bd0
movzx eax, byte [0x14054cee9]
movzx ecx, byte [0x14054d070]
add cl, 0x1f
cmp al, cl
je 0x1401e0c3e
mov cl, 0xd3
nop word [rax + rax]
mov al, 0xa1
lock cmpxchg byte [0x14054cee9], cl
je 0x1401e0cdb
movzx edx, byte [0x14054d070]
add dl, 0x1f
cmp al, dl
jne 0x1401e0c20
lea rax, [0x14054cee0]
ret
movzx eax, byte [0x14054cefd]
cmp al, 0x83
je 0x1401e0c74
mov cl, 0xb7
nop word cs:[rax + rax]
mov al, 0x54
lock cmpxchg byte [0x14054cefd], cl
je 0x1401e0d18
cmp al, 0x83
jne 0x1401e0c60
lea rax, [0x14054cef0]
ret
xor edx, edx
lea rax, [0x14054ce20]
lea rcx, [0x140469c40]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0xf8c21a1d
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x73de5e3
cmp edx, 0x10
jl 0x1401e0c90
mov al, 0xd1
xchg byte [0x14054ce30], al
lea rax, [0x14054ce20]
ret
mov al, 0x26
xchg byte [0x14054ce93], al
lea rax, [0x14054ce90]
ret
xor eax, eax
lea rcx, [0x14054cee0]
lea rdx, [0x140469ce0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1401e0d08
inc rax
jmp 0x1401e0cf0
mov al, 0x16
xchg byte [0x14054cee9], al
lea rax, [0x14054cee0]
ret
xor eax, eax
lea rcx, [0x14054cef0]
lea rdx, [0x140469cf0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401e0d58
inc rax
jmp 0x1401e0d30
mov al, 0x83
xchg byte [0x14054cefd], al
lea rax, [0x14054cef0]
ret
Function at 0x1401e51b0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401e51fc
mov eax, 0x1440fe9b
add eax, dword [0x14054db04]
cmp edx, eax
jne 0x1401e525c
movzx eax, byte [0x14054da69]
cmp al, 0x73
je 0x1401e51f4
mov cl, 0x98
nop word cs:[rax + rax]
mov al, 0xe7
lock cmpxchg byte [0x14054da69], cl
je 0x1401e52cc
cmp al, 0x73
jne 0x1401e51e0
lea rax, [0x14054da60]
ret
test edx, edx
je 0x1401e52a3
movzx eax, byte [0x14054da43]
nop dword [rax + rax]
cmp al, 0xe7
je 0x1401e5379
movzx ecx, byte [0x14054db00]
lea eax, [rcx + 0x15]
add cl, 0x61
lock cmpxchg byte [0x14054da43], cl
jne 0x1401e5210
xor eax, eax
lea rcx, [0x14054da20]
lea rdx, [0x14046a100]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1401e5371
inc rax
jmp 0x1401e5240
movzx eax, byte [0x14054da5f]
movzx ecx, byte [0x14054db00]
add cl, 0xf1
cmp al, cl
je 0x1401e529b
nop word cs:[rax + rax]
movzx ecx, byte [0x14054db00]
lea eax, [rcx + 0x5d]
add cl, 0x51
lock cmpxchg byte [0x14054da5f], cl
je 0x1401e5308
cmp al, 0xe0
jne 0x1401e5280
lea rax, [0x14054da50]
ret
movzx eax, byte [0x14054d9a9]
cmp al, 0xf3
je 0x1401e52c4
mov cl, 0xff
mov al, 0x1f
lock cmpxchg byte [0x14054d9a9], cl
je 0x1401e5381
cmp al, 0xf3
jne 0x1401e52b0
lea rax, [0x14054d980]
ret
xor eax, eax
lea rcx, [0x14054da60]
lea rdx, [0x14046a140]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1401e5361
inc rax
jmp 0x1401e52e0
xor edx, edx
lea rax, [0x14054da50]
lea rcx, [0x14046a130]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x14054db04]
add edx, r8d
add edx, 0x1440fe9c
cmp edx, 0xf
jl 0x1401e5320
mov al, pe_nt_image_headers64
xchg byte [0x14054da5f], al
lea rax, [0x14054da50]
ret
mov al, 0x73
xchg byte [0x14054da69], al
lea rax, [0x14054da60]
ret
mov al, 0xe7
xchg byte [0x14054da43], al
lea rax, [0x14054da20]
ret
xor eax, eax
lea rcx, [0x14054d980]
lea rdx, [0x14046a070]
mov r8d, 0x1440fec4
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14054db04]
add r10d, r8d
cmp r9d, r10d
jge 0x1401e53c1
inc rax
jmp 0x1401e53a0
mov al, 0xf3
xchg byte [0x14054d9a9], al
lea rax, [0x14054d980]
ret
Function at 0x1401eb280
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1401eb2f0
mov eax, r8d
xor eax, 0x9322785a
add eax, dword [0x14054dcbc]
cmp edx, eax
jne 0x1401eb32c
movzx eax, byte [0x14054db45]
mov ecx, r8d
xor cl, 0x81
add cl, byte [0x14054dcb8]
cmp al, cl
je 0x1401eb2e8
nop word cs:[rax + rax]
movzx ecx, byte [0x14054dcb8]
mov eax, r8d
xor al, 0x88
add al, cl
mov edx, r8d
xor dl, 0x58
add dl, cl
lock cmpxchg byte [0x14054db45], dl
je 0x1401eb38c
cmp al, 0x9a
jne 0x1401eb2c0
lea rax, [0x14054db40]
ret
xor r8d, 0x9322785a
add r8d, dword [0x14054dcbc]
cmp edx, r8d
jne 0x1401eb35c
movzx eax, byte [0x14054dba2]
cmp al, 0x20
je 0x1401eb324
mov cl, 0xe1
mov al, 0x8f
lock cmpxchg byte [0x14054dba2], cl
je 0x1401eb418
cmp al, 0x20
jne 0x1401eb310
lea rax, [0x14054db90]
ret
movzx eax, byte [0x14054dc69]
cmp al, 0x73
je 0x1401eb354
mov cl, 0xb2
nop dword [rax]
mov al, 0xed
lock cmpxchg byte [0x14054dc69], cl
je 0x1401eb3dd
cmp al, 0x73
jne 0x1401eb340
lea rax, [0x14054dc60]
ret
movzx eax, byte [0x14054dc5f]
cmp al, 0xe4
je 0x1401eb384
mov cl, 0xb8
nop dword [rax]
mov al, 0xf
lock cmpxchg byte [0x14054dc5f], cl
je 0x1401eb448
cmp al, 0xe4
jne 0x1401eb370
lea rax, [0x14054dc50]
ret
xor eax, eax
lea rcx, [0x14054db40]
lea rdx, [0x14046a1f0]
xor r8d, 0x9322785d
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x14054dcbc]
add r9d, r8d
add eax, r9d
cmp eax, 5
jl 0x1401eb3b0
mov al, 0x9a
xchg byte [0x14054db45], al
lea rax, [0x14054db40]
ret
xor eax, eax
lea rcx, [0x14054dc60]
lea rdx, [0x14046a2f0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1401eb408
inc rax
jmp 0x1401eb3f0
mov al, 0x73
xchg byte [0x14054dc69], al
lea rax, [0x14054dc60]
ret
xor eax, eax
lea rcx, [0x14054db90]
lea rdx, [0x14046a230]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x1401eb49f
inc rax
jmp 0x1401eb430
xor edx, edx
lea rax, [0x14054dc50]
lea rcx, [0x14046a2e0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x1401eb460
mov al, 0xe4
xchg byte [0x14054dc5f], al
lea rax, [0x14054dc50]
ret
mov al, 0x20
xchg byte [0x14054dba2], al
lea rax, [0x14054db90]
ret
Function at 0x1401eb5d0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1401eb618
test edx, edx
je 0x1401eb64c
movzx eax, byte [0x14054db85]
cmp al, 0xc5
je 0x1401eb610
mov cl, 0xe9
nop word [rax + rax]
mov al, 0x5f
lock cmpxchg byte [0x14054db85], cl
je 0x1401eb6ac
mov edx, r8d
xor dl, 0x9a
add dl, byte [0x14054dcb8]
cmp al, dl
jne 0x1401eb5f0
lea rax, [0x14054db70]
ret
test edx, edx
je 0x1401eb67c
movzx eax, byte [0x14054dbff]
cmp al, 0xf6
je 0x1401eb644
mov cl, 0xc2
nop dword [rax]
mov al, 0x4a
lock cmpxchg byte [0x14054dbff], cl
je 0x1401eb6ef
cmp al, 0xf6
jne 0x1401eb630
lea rax, [0x14054dbf0]
ret
movzx eax, byte [0x14054dc43]
cmp al, 0x5a
je 0x1401eb674
mov cl, 0xe8
nop dword [rax]
mov al, 0xaf
lock cmpxchg byte [0x14054dc43], cl
je 0x1401eb718
cmp al, 0x5a
jne 0x1401eb660
lea rax, [0x14054dc20]
ret
movzx eax, byte [0x14054dc13]
cmp al, 0x28
je 0x1401eb6a4
mov cl, 0xd7
nop dword [rax]
mov al, 6
lock cmpxchg byte [0x14054dc13], cl
je 0x1401eb789
cmp al, 0x28
jne 0x1401eb690
lea rax, [0x14054dc10]
ret
xor edx, edx
lea rax, [0x14054db70]
lea rcx, [0x14046a210]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x1401eb6c0
mov al, 0xc5
xchg byte [0x14054db85], al
lea rax, [0x14054db70]
ret
xor eax, eax
lea rcx, [0x14054dbf0]
lea rdx, [0x14046a280]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1401eb779
inc rax
jmp 0x1401eb700
xor edx, edx
lea rax, [0x14054dc20]
lea rcx, [0x14046a2b0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rdx + rax]
xor r10b, r9b
mov byte [rdx + rax], r10b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
cmp edx, 0x23
jl 0x1401eb730
xor r8b, 0x31
add r8b, byte [0x14054dcb8]
xchg byte [0x14054dc43], r8b
lea rax, [0x14054dc20]
ret
mov al, 0xf6
xchg byte [0x14054dbff], al
lea rax, [0x14054dbf0]
ret
xor eax, eax
lea rcx, [0x14054dc10]
lea rdx, [0x14046a2a0]
nop dword [rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
cmp r9d, 2
jg 0x1401eb7c8
inc rax
jmp 0x1401eb7a0
xor r8b, 0x7f
add r8b, byte [0x14054dcb8]
xchg byte [0x14054dc13], r8b
lea rax, [0x14054dc10]
ret
Function at 0x1401ec150
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401ec1c1
movzx eax, byte [0x14054e3d5]
nop dword [rax + rax]
cmp al, 0x27
je 0x1401ec1fc
movzx ecx, byte [0x14054e498]
mov eax, r9d
xor al, 0xca
add al, cl
mov edx, r9d
xor dl, 0xa2
add dl, cl
lock cmpxchg byte [0x14054e3d5], dl
jne 0x1401ec160
xor eax, eax
lea rcx, [0x14054e3c0]
lea rdx, [0x14046a4d0]
xor r9d, 0xdf90263c
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
mov r10d, dword [0x14054e49c]
add r10d, r9d
cmp r8d, r10d
jge 0x1401ec1f4
inc rax
jmp 0x1401ec1a0
movzx eax, byte [0x14054e363]
cmp al, 0x97
je 0x1401ec1ec
mov cl, 0x56
nop
mov al, 0x4e
lock cmpxchg byte [0x14054e363], cl
je 0x1401ec204
mov edx, r9d
xor dl, 0x74
add dl, byte [0x14054e498]
cmp al, dl
jne 0x1401ec1d0
lea rax, [0x14054e340]
ret
mov al, 0x27
xchg byte [0x14054e3d5], al
lea rax, [0x14054e3c0]
ret
xor edx, edx
lea rax, [0x14054e340]
lea rcx, [0x14046a450]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x23
jl 0x1401ec220
mov al, 0x97
xchg byte [0x14054e363], al
lea rax, [0x14054e340]
ret
Function at 0x1401f8c60
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rcx + 0x68], xmm0
movups xmmword [rcx + 0x58], xmm0
movups xmmword [rcx + 0x48], xmm0
movups xmmword [rcx + 0x38], xmm0
movups xmmword [rcx + 0x28], xmm0
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 8], xmm0
mov rdi, qword [rcx + 0x78]
mov rbx, qword [rcx + 0x80]
cmp rdi, rbx
je 0x1401f8cd4
nop dword [rax]
mov eax, dword [0x140550610]
lea edx, [rax + 0x381efbde]
mov ecx, eax
xor ecx, 0x10afa4d4
not eax
and eax, 0x6f505b2b
or eax, ecx
not eax
lea r8d, [rcx + rax*2]
mov rcx, rdi
call fcn.1401fac90
add rdi, 0x40
cmp rdi, rbx
jne 0x1401f8ca0
mov rax, qword [rsi + 0x78]
mov qword [rsi + 0x80], rax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1401fa760
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
test ecx, ecx
je 0x1401fa799
test edx, edx
je 0x1401fa864
movzx eax, byte [0x140550260]
cmp al, 0xae
je 0x1401fa929
mov cl, 0x90
nop
mov al, 0xb4
lock cmpxchg byte [0x140550260], cl
je 0x1401fa8d9
cmp al, 0xae
jne 0x1401fa780
jmp 0x1401fa929
test edx, edx
je 0x1401fa899
movzx eax, byte [0x1405501a5]
nop dword [rax + rax]
cmp al, 0xd
je 0x1401fa858
movzx ecx, byte [0x140550620]
lea eax, [rcx - 0x37]
mov edx, ecx
xor dl, 0xd2
and cl, 0x52
add cl, cl
add cl, dl
lock cmpxchg byte [0x1405501a5], cl
jne 0x1401fa7b0
xor edx, edx
lea rax, [0x140550190]
lea rcx, [0x14046b0e0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140550610]
lea r9d, [r8 + 0x6e995980]
mov r10d, edx
not r10d
mov r11d, 0x9166a67f
sub r11d, r8d
mov esi, edx
and esi, r11d
and r11d, r10d
and r10d, r9d
or esi, r10d
xor edx, r9d
or r11d, edx
not r11d
lea edx, [rsi + r11*2]
add r8d, 0x6e995994
cmp edx, r8d
jl 0x1401fa7f0
mov al, 0xd
xchg byte [0x1405501a5], al
lea rax, [0x140550190]
jmp 0x1401fa9e6
movzx eax, byte [0x140550230]
cmp al, 0x8e
je 0x1401fa970
mov cl, 0x1b
nop word cs:[rax + rax]
mov al, 0x70
lock cmpxchg byte [0x140550230], cl
je 0x1401fa935
cmp al, 0x8e
jne 0x1401fa880
jmp 0x1401fa970
movzx eax, byte [0x140550112]
movzx ecx, byte [0x140550620]
add cl, 0xfb
cmp al, cl
je 0x1401fa9df
mov cl, 0xcf
nop word cs:[rax + rax]
mov al, 0x1b
lock cmpxchg byte [0x140550112], cl
je 0x1401fa979
cmp al, 0x4c
jne 0x1401fa8c0
jmp 0x1401fa9df
xor edx, edx
lea rax, [0x140550250]
lea rcx, [0x14046b190]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140550610]
add edx, r8d
add edx, 0x6e995980
cmp edx, 0x10
jl 0x1401fa8f0
mov al, 0xae
xchg byte [0x140550260], al
lea rax, [0x140550250]
jmp 0x1401fa9e6
xor eax, eax
lea rcx, [0x140550220]
lea rdx, [0x14046b170]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1401fa968
inc rax
jmp 0x1401fa950
mov al, 0x8e
xchg byte [0x140550230], al
lea rax, [0x140550220]
jmp 0x1401fa9e6
xor eax, eax
lea rcx, [0x140550110]
lea rdx, [0x14046b070]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
mov r11d, r10d
xor r11b, r9b
not r9b
mov ebx, r8d
and bl, r9b
or bl, r11b
not bl
xor r9b, r10b
and r9b, r8b
or r9b, bl
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x1401fa9d0
inc rax
jmp 0x1401fa990
movzx eax, byte [0x140550620]
add al, 0xfb
xchg byte [0x140550112], al
lea rax, [0x140550110]
pop rbx
pop rsi
ret
Function at 0x140212850
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14021288c
test edx, edx
je 0x1402128bc
movzx eax, byte [0x14055166d]
cmp al, 0x7d
je 0x140212884
mov cl, 0xef
nop word cs:[rax + rax]
mov al, 0xeb
lock cmpxchg byte [0x14055166d], cl
je 0x14021292c
cmp al, 0x7d
jne 0x140212870
lea rax, [0x140551660]
ret
test edx, edx
je 0x1402128fc
movzx eax, byte [0x14055177d]
cmp al, 0xad
je 0x1402128b4
mov cl, 0xda
nop dword [rax]
mov al, 0x89
lock cmpxchg byte [0x14055177d], cl
je 0x140212968
cmp al, 0xad
jne 0x1402128a0
lea rax, [0x140551770]
ret
movzx eax, byte [0x140551150]
movzx ecx, byte [0x140552378]
add cl, 0xac
cmp al, cl
je 0x1402128f4
mov cl, 0xe8
nop word cs:[rax + rax]
mov al, 0x14
lock cmpxchg byte [0x140551150], cl
je 0x140212998
cmp al, 0xe6
jne 0x1402128e0
lea rax, [0x140551140]
ret
movzx eax, byte [0x140551b1d]
cmp al, 0xf7
je 0x140212924
mov cl, 0x60
nop dword [rax]
mov al, 0xcf
lock cmpxchg byte [0x140551b1d], cl
je 0x1402129e8
cmp al, 0xf7
jne 0x140212910
lea rax, [0x140551b10]
ret
xor eax, eax
lea rcx, [0x140551660]
lea rdx, [0x14046c0d0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140212958
inc rax
jmp 0x140212940
mov al, 0x7d
xchg byte [0x14055166d], al
lea rax, [0x140551660]
ret
xor eax, eax
lea rcx, [0x140551770]
lea rdx, [0x14046c1d0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1402129c8
inc rax
jmp 0x140212980
xor eax, eax
lea rcx, [0x140551140]
lea rdx, [0x14046bbd0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1402129d8
inc rax
jmp 0x1402129b0
mov al, 0xad
xchg byte [0x14055177d], al
lea rax, [0x140551770]
ret
mov al, 0xe6
xchg byte [0x140551150], al
lea rax, [0x140551140]
ret
xor edx, edx
lea rax, [0x140551b10]
lea rcx, [0x14046c540]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x140212a00
mov al, 0xf7
xchg byte [0x140551b1d], al
lea rax, [0x140551b10]
ret
Function at 0x140215800
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14021583c
test edx, edx
je 0x14021587c
movzx eax, byte [0x1405515d1]
cmp al, 0x19
je 0x140215834
mov cl, 0x2e
nop word [rax + rax]
mov al, 0x25
lock cmpxchg byte [0x1405515d1], cl
je 0x14021591c
cmp al, 0x19
jne 0x140215820
lea rax, [0x1405515c0]
ret
test edx, edx
je 0x1402158ec
movzx eax, byte [0x140551133]
cmp al, 0x8c
je 0x140215874
mov cl, 0x85
nop word cs:[rax + rax]
mov al, 0xb5
lock cmpxchg byte [0x140551133], cl
je 0x140215978
cmp al, 0x8c
jne 0x140215860
lea rax, [0x140551130]
ret
movzx eax, byte [0x140551680]
nop word cs:[rax + rax]
cmp al, 0xff
je 0x140215970
movzx ecx, byte [0x140552378]
mov eax, r8d
xor al, 0x37
add al, cl
mov edx, r8d
xor dl, 0x35
add dl, cl
lock cmpxchg byte [0x140551680], dl
jne 0x140215890
xor eax, eax
lea rcx, [0x140551670]
lea rdx, [0x14046c0e0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140215968
inc rax
jmp 0x1402158d0
movzx eax, byte [0x14055176d]
cmp al, 0x57
je 0x140215914
mov cl, 0x99
nop dword [rax]
mov al, 0xea
lock cmpxchg byte [0x14055176d], cl
je 0x1402159b8
cmp al, 0x57
jne 0x140215900
lea rax, [0x140551760]
ret
xor eax, eax
lea rcx, [0x1405515c0]
lea rdx, [0x14046c030]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x140215958
inc rax
jmp 0x140215930
mov al, 0x19
xchg byte [0x1405515d1], al
lea rax, [0x1405515c0]
ret
mov al, 0xff
xchg byte [0x140551680], al
lea rax, [0x140551670]
ret
xor eax, eax
lea rcx, [0x140551130]
lea rdx, [0x14046bbc0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1402159a8
inc rax
jmp 0x140215990
mov al, 0x8c
xchg byte [0x140551133], al
lea rax, [0x140551130]
ret
xor eax, eax
lea rcx, [0x140551760]
lea rdx, [0x14046c1c0]
xor r8d, 0x4186bf07
nop
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x140552370]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 0xd
jl 0x1402159d0
mov al, 0x57
xchg byte [0x14055176d], al
lea rax, [0x140551760]
ret