joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14022cd80
Capabilities:
Check for software breakpoints

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14022cdec
mov eax, r8d
xor eax, 0xf4b469cb
add eax, dword [0x1404f3358]
cmp edx, eax
jne 0x14022ce1c
movzx eax, byte [0x1404f303d]
movzx ecx, byte [0x1404f3368]
mov edx, r8d
xor dl, 0xa3
mov r9d, ecx
xor r9b, cl
not r9b
and r9b, dl
xor r9b, cl
and dl, cl
add dl, dl
add dl, r9b
cmp al, dl
je 0x14022cde4
mov cl, 0x93
nop
mov al, 0xee
lock cmpxchg byte [0x1404f303d], cl
je 0x14022cef3
cmp al, 0xc2
jne 0x14022cdd0
lea rax, [0x1404f3030]
ret
test edx, edx
je 0x14022ce4c
movzx eax, byte [0x1404f2e83]
cmp al, 0xc4
je 0x14022ce14
mov cl, 0x34
nop dword [rax]
mov al, 0xea
lock cmpxchg byte [0x1404f2e83], cl
je 0x14022cf82
cmp al, 0xc4
jne 0x14022ce00
lea rax, [0x1404f2e80]
ret
movzx eax, byte [0x1404f2faf]
cmp al, 0xcc
je 0x14022ce44
mov cl, 0x80
nop dword [rax]
mov al, 0xf8
lock cmpxchg byte [0x1404f2faf], cl
je 0x14022cf28
cmp al, 0xcc
jne 0x14022ce30
lea rax, [0x1404f2fa0]
ret
movzx eax, byte [0x1404f305d]
nop word cs:[rax + rax]
cmp al, 0xe1
je 0x14022cfe3
movzx ecx, byte [0x1404f3368]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0xf9
mov eax, r8d
and al, 6
or al, r9b
add al, 0x51
mov r9d, eax
xor r9b, cl
and al, cl
add al, al
add al, r9b
add al, 0xaf
and dl, 0xf7
mov r9d, r8d
and r9b, 8
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x1404f305d], r9b
jne 0x14022ce60
xor eax, eax
lea rcx, [0x1404f3050]
lea rdx, [0x14040a9d0]
nop
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r8b
mov r10d, r8d
and r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14022cfdb
inc rax
jmp 0x14022cec0
xor eax, eax
lea rcx, [0x1404f3030]
lea rdx, [0x14040a9b0]
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xc
jg 0x14022cf58
inc rax
jmp 0x14022cf10
xor eax, eax
lea rcx, [0x1404f2fa0]
lea rdx, [0x14040a920]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x14022cf72
inc rax
jmp 0x14022cf40
xor r8b, 0xa3
add r8b, byte [0x1404f3368]
xchg byte [0x1404f303d], r8b
lea rax, [0x1404f3030]
ret
mov al, 0xcc
xchg byte [0x1404f2faf], al
lea rax, [0x1404f2fa0]
ret
xor eax, eax
lea rcx, [0x1404f2e80]
lea rdx, [0x14040a810]
mov r9d, r8d
xor r9d, 0xf4b469ce
nop dword [rax]
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x1404f3358]
add r11d, r9d
cmp r10d, r11d
jge 0x14022cfc1
inc rax
jmp 0x14022cfa0
xor r8b, 0xa5
add r8b, byte [0x1404f3368]
xchg byte [0x1404f2e83], r8b
lea rax, [0x1404f2e80]
ret
mov al, 0xe1
xchg byte [0x1404f305d], al
lea rax, [0x1404f3050]
ret
Function at 0x140236450
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14023648c
test edx, edx
je 0x1402364bc
movzx eax, byte [0x1404f4a0c]
cmp al, 0x3f
je 0x140236484
mov cl, pe_nt_image_headers64
nop word cs:[rax + rax]
mov al, 0x56
lock cmpxchg byte [0x1404f4a0c], cl
je 0x14023651c
cmp al, 0x3f
jne 0x140236470
lea rax, [0x1404f4a00]
ret
test edx, edx
je 0x1402364ec
movzx eax, byte [0x1404f4a2d]
cmp al, 0xbf
je 0x1402364b4
mov cl, 0xed
nop dword [rax]
mov al, 0xa8
lock cmpxchg byte [0x1404f4a2d], cl
je 0x140236575
cmp al, 0xbf
jne 0x1402364a0
lea rax, [0x1404f4a20]
ret
movzx eax, byte [0x1404f4902]
cmp al, 0x8f
je 0x1402364e4
mov cl, 0x53
nop dword [rax]
mov al, 0x1d
lock cmpxchg byte [0x1404f4902], cl
je 0x1402365d1
cmp al, 0x8f
jne 0x1402364d0
lea rax, [0x1404f48f0]
ret
movzx eax, byte [0x1404f4abd]
cmp al, 0xb9
je 0x140236514
mov cl, 0x1b
nop dword [rax]
mov al, 0x20
lock cmpxchg byte [0x1404f4abd], cl
je 0x14023663c
cmp al, 0xb9
jne 0x140236500
lea rax, [0x1404f4ab0]
ret
xor edx, edx
lea rax, [0x1404f4a00]
lea rcx, [0x14040b3b0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1404f5550]
add edx, r8d
add edx, 0x762a3c50
mov r8d, edx
xor r8d, 0x51ff041c
and edx, 0x51ff041c
lea edx, [r8 + rdx*2]
cmp edx, 0xc
jl 0x140236530
mov al, 0x3f
xchg byte [0x1404f4a0c], al
lea rax, [0x1404f4a00]
ret
xor edx, edx
lea rax, [0x1404f4a20]
lea rcx, [0x14040b3d0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x1404f5550]
add edx, r8d
add edx, 0xc829406c
cmp edx, 0xd
jl 0x140236590
mov al, 0xbf
xchg byte [0x1404f4a2d], al
lea rax, [0x1404f4a20]
ret
xor eax, eax
lea rcx, [0x1404f48f0]
lea rdx, [0x14040b2b0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
not r9b
mov r11d, r10d
xor r11b, r9b
and r11b, r10b
and r9b, r8b
or r9b, r11b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x140236625
inc rax
jmp 0x1402365f0
movzx eax, byte [0x1404f5560]
add al, 0x88
xchg byte [0x1404f4902], al
lea rax, [0x1404f48f0]
ret
xor edx, edx
lea rax, [0x1404f4ab0]
lea rcx, [0x14040b460]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x140236650
mov al, 0xb9
xchg byte [0x1404f4abd], al
lea rax, [0x1404f4ab0]
ret
Function at 0x140237d90
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x140237ddc
xor r8d, 0xe949c0ae
add r8d, dword [0x1404f5550]
cmp edx, r8d
jne 0x140237e0c
movzx eax, byte [0x1404f48c0]
cmp al, 0xac
je 0x140237dd4
mov cl, 0xdf
nop dword [rax]
mov al, 0x18
lock cmpxchg byte [0x1404f48c0], cl
je 0x140237e6c
cmp al, 0xac
jne 0x140237dc0
lea rax, [0x1404f48b0]
ret
test edx, edx
je 0x140237e38
movzx eax, byte [0x1404f4894]
cmp al, 0xe9
je 0x140237e04
mov cl, 0xe6
nop dword [rax]
mov al, 0xa7
lock cmpxchg byte [0x1404f4894], cl
je 0x140237ee8
cmp al, 0xe9
jne 0x140237df0
lea rax, [0x1404f4890]
ret
movzx eax, byte [0x1404f4aa3]
cmp al, 0xf
je 0x140237e30
mov cl, 0xe7
nop dword [rax]
mov al, 0x7e
lock cmpxchg byte [0x1404f4aa3], cl
je 0x140237e98
cmp al, 0xf
jne 0x140237e20
lea rax, [0x1404f4a90]
ret
movzx eax, byte [0x1404f49fd]
cmp al, 0xed
je 0x140237e64
mov cl, 0x76
nop word cs:[rax + rax]
mov al, 0x70
lock cmpxchg byte [0x1404f49fd], cl
je 0x140237f3f
cmp al, 0xed
jne 0x140237e50
lea rax, [0x1404f49f0]
ret
xor eax, eax
lea rcx, [0x1404f48b0]
lea rdx, [0x14040b280]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140237ec8
inc rax
jmp 0x140237e80
xor eax, eax
lea rcx, [0x1404f4a90]
lea rdx, [0x14040b440]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x12
jg 0x140237ed8
inc rax
jmp 0x140237eb0
mov al, 0xac
xchg byte [0x1404f48c0], al
lea rax, [0x1404f48b0]
ret
mov al, 0xf
xchg byte [0x1404f4aa3], al
lea rax, [0x1404f4a90]
ret
xor edx, edx
lea rax, [0x1404f4890]
lea rcx, [0x14040b260]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 4
jl 0x140237f00
mov al, 0xe9
xchg byte [0x1404f4894], al
lea rax, [0x1404f4890]
ret
xor eax, eax
lea rcx, [0x1404f49f0]
lea rdx, [0x14040b3a0]
mov r11d, r8d
not r11d
mov r10d, r11d
and r10d, 0xe949c0a9
mov r9d, r8d
and r9d, 0x16b63f56
or r9d, r10d
and r11d, 0xe949c0bd
mov r10d, r8d
and r10d, 0x16b63f42
or r10d, r11d
cdqe
movzx r11d, byte [rax + rdx]
add byte [rax + rcx], r11b
mov r11d, dword [0x1404f5550]
add eax, r9d
add eax, r11d
add r11d, r10d
cmp eax, r11d
jl 0x140237f80
xor r8b, 0x23
add r8b, byte [0x1404f5560]
xchg byte [0x1404f49fd], r8b
lea rax, [0x1404f49f0]
ret
Function at 0x140241100
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x11cdb4b8
add eax, dword [0x1404f6350]
cmp ecx, eax
jne 0x14024114c
test edx, edx
je 0x14024117c
movzx eax, byte [0x1404f5913]
movzx ecx, byte [0x1404f6360]
add cl, 0x13
cmp al, cl
je 0x140241144
mov cl, 0xc2
nop word [rax + rax]
mov al, 0x28
lock cmpxchg byte [0x1404f5913], cl
je 0x1402411e6
cmp al, 0x24
jne 0x140241130
lea rax, [0x1404f5910]
ret
test edx, edx
je 0x1402411ac
movzx eax, byte [0x1404f595c]
cmp al, 0xd
je 0x140241174
mov cl, 0x2c
nop dword [rax]
mov al, 0x25
lock cmpxchg byte [0x1404f595c], cl
je 0x140241231
cmp al, 0xd
jne 0x140241160
lea rax, [0x1404f5950]
ret
movzx eax, byte [0x1404f5b53]
cmp al, 0x29
je 0x1402411a4
mov cl, 0xd
nop dword [rax]
mov al, 0xa6
lock cmpxchg byte [0x1404f5b53], cl
je 0x14024128f
cmp al, 0x29
jne 0x140241190
lea rax, [0x1404f5b40]
ret
movzx eax, byte [0x1404f5ac1]
cmp al, 0x98
je 0x1402411de
mov cl, 0xa2
nop dword [rax]
mov al, 0x31
lock cmpxchg byte [0x1404f5ac1], cl
je 0x1402412df
movzx edx, byte [0x1404f6360]
add dl, 0x87
cmp al, dl
jne 0x1402411c0
lea rax, [0x1404f5ab0]
ret
xor edx, edx
lea rax, [0x1404f5910]
lea rcx, [0x14040b6d0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1404f6350]
add edx, r8d
add edx, 0x11cdb4b9
cmp edx, 3
jl 0x140241200
mov al, 0x24
xchg byte [0x1404f5913], al
lea rax, [0x1404f5910]
ret
xor edx, edx
lea rax, [0x1404f5950]
lea rcx, [0x14040b710]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xc
jl 0x140241250
mov al, 0xd
xchg byte [0x1404f595c], al
lea rax, [0x1404f5950]
ret
xor eax, eax
lea rcx, [0x1404f5b40]
lea rdx, [0x14040b8f0]
nop
cdqe
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
mov r8d, dword [0x1404f6350]
mov r9d, r8d
xor r9d, 0x11cdb4b9
and r8d, 0x11cdb4b9
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0x13
jl 0x1402412a0
mov al, 0x29
xchg byte [0x1404f5b53], al
lea rax, [0x1404f5b40]
ret
xor edx, edx
lea rax, [0x1404f5ab0]
lea rcx, [0x14040b860]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
add edx, 0xe5eeebf3
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x1a11140d
cmp edx, 0x11
jl 0x1402412f0
mov al, 0x98
xchg byte [0x1404f5ac1], al
lea rax, [0x1404f5ab0]
ret
Function at 0x1402423a0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1402423dc
test edx, edx
je 0x14024241c
movzx eax, byte [0x1404f5b6d]
cmp al, 0x66
je 0x1402423d4
mov cl, 0x73
nop word [rax + rax]
mov al, 0x5c
lock cmpxchg byte [0x1404f5b6d], cl
je 0x14024247c
cmp al, 0x66
jne 0x1402423c0
lea rax, [0x1404f5b60]
ret
test edx, edx
je 0x14024244c
movzx eax, byte [0x1404f5aad]
mov ecx, r8d
xor cl, 0xaa
add cl, byte [0x1404f6360]
cmp al, cl
je 0x140242414
mov cl, 0xbd
nop dword [rax]
mov al, 0x4e
lock cmpxchg byte [0x1404f5aad], cl
je 0x1402424e1
cmp al, 0x98
jne 0x140242400
lea rax, [0x1404f5aa0]
ret
movzx eax, byte [0x1404f5945]
cmp al, 0xc2
je 0x140242444
mov cl, 0x23
nop dword [rax]
mov al, 0xd5
lock cmpxchg byte [0x1404f5945], cl
je 0x14024255a
cmp al, 0xc2
jne 0x140242430
lea rax, [0x1404f5940]
ret
movzx eax, byte [0x1404f5a6c]
cmp al, 0x75
je 0x140242474
mov cl, 0xa9
nop dword [rax]
mov al, 0xe1
lock cmpxchg byte [0x1404f5a6c], cl
je 0x1402425b9
cmp al, 0x75
jne 0x140242460
lea rax, [0x1404f5a60]
ret
xor eax, eax
lea rcx, [0x1404f5b60]
lea rdx, [0x14040b910]
xor r8d, 0x84c70de8
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x1404f6350]
add r10d, r8d
cmp r9d, r10d
jge 0x1402424d1
inc rax
jmp 0x1402424a0
mov al, 0x66
xchg byte [0x1404f5b6d], al
lea rax, [0x1404f5b60]
ret
xor edx, edx
lea rax, [0x1404f5aa0]
lea rcx, [0x14040b850]
xor r8d, 0x84c70de8
add r8d, 0x549b90c
nop
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rdx + rax]
xor r10b, r9b
mov byte [rdx + rax], r10b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
mov r9d, dword [0x1404f6350]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add r9d, 0xfab646f4
cmp edx, r9d
jl 0x140242500
mov al, 0x98
xchg byte [0x1404f5aad], al
lea rax, [0x1404f5aa0]
ret
xor edx, edx
lea rax, [0x1404f5940]
lea rcx, [0x14040b700]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0x416453a5
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
mov r8d, edx
xor r8d, 0xbe9bac5b
and edx, 0x3e9bac5b
lea edx, [r8 + rdx*2]
cmp edx, 5
jl 0x140242570
mov al, 0xc2
xchg byte [0x1404f5945], al
lea rax, [0x1404f5940]
ret
xor edx, edx
lea rax, [0x1404f5a60]
lea rcx, [0x14040b810]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xc
jl 0x1402425d0
mov al, 0x75
xchg byte [0x1404f5a6c], al
lea rax, [0x1404f5a60]
ret
Function at 0x140245ca0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140245cdc
test edx, edx
je 0x140245d26
movzx eax, byte [0x1404f65e8]
cmp al, 0x67
je 0x140245cd4
mov cl, 0x31
nop word cs:[rax + rax]
mov al, 0xa1
lock cmpxchg byte [0x1404f65e8], cl
je 0x140245d9c
cmp al, 0x67
jne 0x140245cc0
lea rax, [0x1404f65d0]
ret
mov eax, 0x3dcfb543
add eax, dword [0x1404f6ac8]
cmp edx, eax
jne 0x140245d5c
movzx eax, byte [0x1404f66ef]
cmp al, 0x2b
je 0x140245d1e
mov cl, 0x13
nop dword [rax + rax]
mov al, 7
lock cmpxchg byte [0x1404f66ef], cl
je 0x140245e5d
movzx edx, byte [0x1404f6acc]
add dl, 0xd2
cmp al, dl
jne 0x140245d00
lea rax, [0x1404f66e0]
ret
movzx eax, byte [0x1404f66c4]
cmp al, 0x5e
je 0x140245d54
mov cl, 0x25
nop word cs:[rax + rax]
mov al, 0x48
lock cmpxchg byte [0x1404f66c4], cl
je 0x140245df1
cmp al, 0x5e
jne 0x140245d40
lea rax, [0x1404f66b0]
ret
movzx eax, byte [0x1404f6600]
movzx ecx, byte [0x1404f6acc]
mov edx, ecx
xor dl, 0x57
and cl, 0x57
add cl, cl
add cl, dl
cmp al, cl
je 0x140245d94
mov cl, 8
nop dword [rax]
mov al, 0xef
lock cmpxchg byte [0x1404f6600], cl
je 0x140245eb2
cmp al, 0xb0
jne 0x140245d80
lea rax, [0x1404f65f0]
ret
xor eax, eax
lea rcx, [0x1404f65d0]
lea rdx, [0x14040bb10]
mov r8d, 0x3dcfb55b
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1404f6ac8]
add r10d, r8d
cmp r9d, r10d
jge 0x140245de1
inc rax
jmp 0x140245dc0
mov al, 0x67
xchg byte [0x1404f65e8], al
lea rax, [0x1404f65d0]
ret
xor edx, edx
lea rax, [0x1404f66b0]
lea rcx, [0x14040bbe0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
add r8b, 0xd3
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
add r8b, 0x2d
mov byte [rdx + rax], r8b
mov r8d, dword [0x1404f6ac8]
add edx, r8d
add edx, 0x3dcfb544
cmp edx, 0x14
jl 0x140245e10
mov al, 0x5e
xchg byte [0x1404f66c4], al
lea rax, [0x1404f66b0]
ret
xor edx, edx
lea rax, [0x1404f66e0]
lea rcx, [0x14040bc10]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0x9afee8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0xf6501175
cmp edx, 0xf
jl 0x140245e70
movzx eax, byte [0x1404f6acc]
add al, 0xd2
xchg byte [0x1404f66ef], al
lea rax, [0x1404f66e0]
ret
xor eax, eax
lea rcx, [0x1404f65f0]
lea rdx, [0x14040bb30]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140245ef8
inc rax
jmp 0x140245ed0
mov al, 0xb0
xchg byte [0x1404f6600], al
lea rax, [0x1404f65f0]
ret
Function at 0x140247730
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14024779c
test edx, edx
je 0x1402477e6
movzx eax, byte [0x1404f6cf9]
nop word cs:[rax + rax]
cmp al, 0xe9
je 0x140247854
movzx ecx, byte [0x1404f7254]
lea eax, [rcx - 0x14]
add cl, 0x5f
lock cmpxchg byte [0x1404f6cf9], cl
jne 0x140247750
xor eax, eax
lea rcx, [0x1404f6cf0]
lea rdx, [0x14040be90]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x14024784c
inc rax
jmp 0x140247780
mov eax, 0x6229da74
add eax, dword [0x1404f7250]
cmp edx, eax
jne 0x140247818
movzx eax, byte [0x1404f6d93]
cmp al, 0xc9
je 0x1402477de
mov cl, 0x5a
nop dword [rax + rax]
mov al, 0xd6
lock cmpxchg byte [0x1404f6d93], cl
je 0x1402478d5
movzx edx, byte [0x1404f7254]
add dl, 0x1b
cmp al, dl
jne 0x1402477c0
lea rax, [0x1404f6d90]
ret
movzx eax, byte [0x1404f6def]
cmp al, 0x3d
je 0x140247810
mov cl, 0x67
nop word cs:[rax + rax]
mov al, 0x45
lock cmpxchg byte [0x1404f6def], cl
je 0x14024785c
cmp al, 0x3d
jne 0x140247800
lea rax, [0x1404f6de0]
ret
movzx eax, byte [0x1404f6d36]
cmp al, 0x90
je 0x140247844
mov cl, 0x56
nop word cs:[rax + rax]
mov al, 0x96
lock cmpxchg byte [0x1404f6d36], cl
je 0x14024791c
cmp al, 0x90
jne 0x140247830
lea rax, [0x1404f6d20]
ret
mov al, 0xe9
xchg byte [0x1404f6cf9], al
lea rax, [0x1404f6cf0]
ret
xor r8d, r8d
lea rax, [0x1404f6de0]
lea rcx, [0x14040bf80]
mov edx, 0x6229da83
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rax]
movzx r10d, byte [r8 + rcx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x1404f7250]
add r9d, edx
cmp r8d, r9d
jl 0x140247880
movzx eax, byte [0x1404f7254]
add al, 0x8f
xchg byte [0x1404f6def], al
lea rax, [0x1404f6de0]
ret
xor eax, eax
lea rcx, [0x1404f6d90]
lea rdx, [0x14040bf30]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x140247958
inc rax
jmp 0x1402478f0
xor eax, eax
lea rcx, [0x1404f6d20]
lea rdx, [0x14040bec0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x15
jg 0x140247968
inc rax
jmp 0x140247930
mov al, 0xc9
xchg byte [0x1404f6d93], al
lea rax, [0x1404f6d90]
ret
mov al, 0x90
xchg byte [0x1404f6d36], al
lea rax, [0x1404f6d20]
ret
Function at 0x140254b10
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140254b5c
mov eax, dword [0x1404f90a0]
mov ecx, eax
xor ecx, 0xfa76604f
and eax, 0x7a76604f
lea eax, [rcx + rax*2]
cmp edx, eax
jne 0x140254bb8
movzx eax, byte [0x1404f8415]
cmp al, 0x7e
je 0x140254b54
mov cl, 0x46
nop
mov al, 0x25
lock cmpxchg byte [0x1404f8415], cl
je 0x140254bfc
cmp al, 0x7e
jne 0x140254b40
lea rax, [0x1404f8400]
ret
movzx eax, byte [0x1404f84a3]
nop word cs:[rax + rax]
cmp al, 0x2f
je 0x140254bf4
movzx ecx, byte [0x1404f90a4]
lea eax, [rcx - 0x64]
add cl, 0x69
lock cmpxchg byte [0x1404f84a3], cl
jne 0x140254b70
xor eax, eax
lea rcx, [0x1404f84a0]
lea rdx, [0x14040c580]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x140254bec
inc rax
jmp 0x140254ba0
movzx eax, byte [0x1404f82e0]
cmp al, 0x4e
je 0x140254be4
mov cl, 0xb9
nop word cs:[rax + rax]
mov al, 0x39
lock cmpxchg byte [0x1404f82e0], cl
je 0x140254c72
cmp al, 0x4e
jne 0x140254bd0
lea rax, [0x1404f82d0]
ret
mov al, 0x2f
xchg byte [0x1404f84a3], al
lea rax, [0x1404f84a0]
ret
xor r8d, r8d
lea rax, [0x1404f8400]
lea rcx, [0x14040c4e0]
mov edx, 0xfa766050
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rax]
mov r10d, r9d
xor r10b, 0x62
and r9b, 0x62
add r9b, r9b
add r9b, r10b
add r9b, byte [r8 + rcx]
add r9b, 0x9e
mov byte [r8 + rax], r9b
mov r9d, dword [0x1404f90a0]
add r9d, edx
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r8d, [r10 + r9*2]
cmp r8d, 0x15
jl 0x140254c20
mov al, 0x7e
xchg byte [0x1404f8415], al
lea rax, [0x1404f8400]
ret
xor eax, eax
lea rcx, [0x1404f82d0]
lea rdx, [0x14040c3e0]
mov r8d, 0xfa76605f
nop dword [rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1404f90a0]
add r10d, r8d
cmp r9d, r10d
jge 0x140254cb1
inc rax
jmp 0x140254c90
mov al, 0x4e
xchg byte [0x1404f82e0], al
lea rax, [0x1404f82d0]
ret
Function at 0x1402642f0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14026432c
test edx, edx
je 0x14026436c
movzx eax, byte [0x1404fb1f3]
cmp al, 0x8c
je 0x140264324
mov cl, 0xa6
nop word [rax + rax]
mov al, 0x99
lock cmpxchg byte [0x1404fb1f3], cl
je 0x14026440a
cmp al, 0x8c
jne 0x140264310
lea rax, [0x1404fb1f0]
ret
test edx, edx
je 0x1402643c0
movzx eax, byte [0x1404fb2ef]
cmp al, 0x19
je 0x140264364
mov cl, 0x29
nop word cs:[rax + rax]
mov al, 0x3f
lock cmpxchg byte [0x1404fb2ef], cl
je 0x140264448
cmp al, 0x19
jne 0x140264350
lea rax, [0x1404fb2e0]
ret
movzx eax, byte [0x1404fb2f9]
mov ecx, r8d
xor cl, 0xad
add cl, byte [0x1404fb58c]
cmp al, cl
je 0x1402643b8
nop word cs:[rax + rax]
movzx ecx, byte [0x1404fb58c]
mov eax, r8d
xor al, 0x85
add al, cl
mov edx, r8d
xor dl, 0xef
add dl, cl
lock cmpxchg byte [0x1404fb2f9], dl
je 0x14026448d
cmp al, 0xc4
jne 0x140264390
lea rax, [0x1404fb2f0]
ret
movzx eax, byte [0x1404fb290]
cmp al, 0x6c
je 0x140264402
mov cl, 0xcf
nop dword [rax]
mov al, 0x76
lock cmpxchg byte [0x1404fb290], cl
je 0x1402644c8
movzx edx, byte [0x1404fb58c]
mov r9d, r8d
xor r9b, 0x75
mov r10d, r9d
xor r10b, dl
and r9b, dl
add r9b, r9b
add r9b, r10b
cmp al, r9b
jne 0x1402643d0
lea rax, [0x1404fb280]
ret
xor eax, eax
lea rcx, [0x1404fb1f0]
lea rdx, [0x14040d020]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x140264438
inc rax
jmp 0x140264420
mov al, 0x8c
xchg byte [0x1404fb1f3], al
lea rax, [0x1404fb1f0]
ret
xor eax, eax
lea rcx, [0x1404fb2e0]
lea rdx, [0x14040d100]
xor r8d, 0x23146d4d
nop
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x1404fb588]
add r9d, r8d
add eax, r9d
cmp eax, 0xf
jl 0x140264460
mov al, 0x19
xchg byte [0x1404fb2ef], al
lea rax, [0x1404fb2e0]
ret
xor eax, eax
lea rcx, [0x1404fb2f0]
lea rdx, [0x14040d110]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1402644b8
inc rax
jmp 0x1402644a0
mov al, 0xc4
xchg byte [0x1404fb2f9], al
lea rax, [0x1404fb2f0]
ret
xor edx, edx
lea rax, [0x1404fb280]
lea rcx, [0x14040d0b0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x1402644e0
mov al, 0x6c
xchg byte [0x1404fb290], al
lea rax, [0x1404fb280]
ret