joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403a8f60
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [rcx]
mov rax, qword [rbx + 8]
mov r15, rax
sub r15, rcx
mov rdx, r15
sar rdx, 3
cmp rdx, rdi
jae 0x1403a9029
mov rax, rdi
shr rax, 0x3d
jne 0x1403a920a
mov rdx, qword [0x140561990]
lea ecx, [rdx - 0x3f]
mov rax, rdi
shl rax, cl
movabs rcx, 0xa30f80af8907cbd
mov r8, rdx
xor r8, rcx
and rdx, rcx
lea rcx, [r8 + rdx*2]
cmp rdi, rcx
jbe 0x1403a905e
movabs rcx, 0x2a30f80af8907aba
add rcx, qword [0x140561990]
cmp rdi, rcx
jae 0x1403a920a
add rax, 0x27
mov rcx, rax
mov edx, 0x6c0faea4
mov r8d, 0xcefd43f1
call fcn.1400aaae0
lea rcx, [rax + 0x27]
mov r14, rcx
xor r14, 0x1f
and r14, rcx
mov qword [r14 - 8], rax
test r15, r15
jne 0x1403a9079
jmp 0x1403a90b9
cmp rcx, rax
je 0x1403a91fd
mov rdx, rax
neg rdx
mov r8, rdx
xor r8, 8
and edx, 8
lea r8, [r8 + rdx*2]
add r8, rcx
neg r8
cmp r8, 0x18
jae 0x1403a9172
mov rdx, rcx
jmp 0x1403a91f0
mov rcx, rax
mov edx, 0x6c0faea4
mov r8d, 0xcefd43f1
call fcn.1400aaae0
mov r14, rax
test r15, r15
je 0x1403a90b9
mov rcx, qword [rbx]
cmp r15, 0x1000
jb 0x1403a90b1
mov rax, qword [rcx - 8]
add rcx, qword [0x140561990]
sub rcx, rax
movabs rdx, 0xa30f80af8907ab6
add rdx, rcx
cmp rdx, 0x20
jae 0x1403a920f
add r15, 0x27
mov rcx, rax
mov rdx, r15
call fcn.1400a87c0
mov qword [rbx], r14
lea rax, [r14 + rdi*8]
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
dec rdi
movabs rdx, 0x1fffffffffffffff
and rdx, rdi
cmp rdx, 3
jae 0x1403a90e6
mov r8, r14
jmp 0x1403a9160
inc rdx
mov r10, rdx
not r10
or r10, 3
mov r9, 0xfffffffffffffffb
sub r9, r10
not r10
movzx ecx, byte [0x140561990]
add cl, 0xc1
mov r8, r10
shl r8, cl
add r8, r14
movq xmm0, rsi
pshufd xmm0, xmm0, 0x44
xor r11d, r11d
mov ecx, dword [0x140561990]
mov edi, ecx
xor edi, 0xc1
and ecx, 0x41
lea ecx, [rdi + rcx*2]
mov rdi, r11
shl rdi, cl
movdqu xmmword [r14 + rdi], xmm0
movdqu xmmword [r14 + rdi + 0x10], xmm0
cmp r9, r11
je 0x1403a9152
add r11, 4
jmp 0x1403a9120
cmp rdx, r10
je 0x1403a91fd
nop dword [rax + rax]
add r8, 8
mov qword [r8 - 8], rsi
cmp r8, rax
jne 0x1403a9160
jmp 0x1403a91fd
shr r8, 3
inc r8
mov r9, r8
and r9, 0xfffffffffffffffc
lea rdx, [rcx + r9*8]
movq xmm0, rsi
pshufd xmm0, xmm0, 0x44
xor r10d, r10d
movabs r11, 0x5771eb35b174f866
movabs rdi, 0xb2bf0cd5471b825c
movabs rbx, 0x32bf0cd5471b825c
nop
movdqu xmmword [rcx + r10*8], xmm0
movdqu xmmword [rcx + r10*8 + 0x10], xmm0
mov r14, qword [0x140561990]
add r14, r11
mov r15, r14
xor r15, rdi
and r14, rbx
lea r14, [r15 + r14*2]
add r10, r14
cmp r10, r9
jne 0x1403a91b0
cmp r8, r9
je 0x1403a91fd
nop word cs:[rax + rax]
add rdx, 8
mov qword [rdx - 8], rsi
cmp rdx, rax
jne 0x1403a91f0
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
call fcn.140085ac0
call fcn.1403d599c
int3
Function at 0x1403a9260
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rax, qword [0x1405650e0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14, qword [rdx + 8]
mov r15, qword [r14]
cmp r15, r14
je 0x1403a93e8
mov rsi, rcx
movabs r12, 0xcbf29ce484222325
movabs r13, 0xa30f90af8907c71
movabs rbp, 0x100000001b3
lea rdi, [rsp + 0x20]
lea rbx, [rsp + 0x30]
jmp 0x1403a92eb
mov rax, qword [r15 + 0x10]
mov qword [rsp + 0x30], rax
mov eax, dword [r15 + 0x18]
mov dword [rsp + 0x38], eax
mov rcx, rsi
mov rdx, rdi
mov r8, rbx
call fcn.1403a9410
mov r15, qword [r15]
cmp r15, r14
je 0x1403a93e8
movzx eax, byte [r15 + 0x10]
mov ecx, r12d
not ecx
and ecx, eax
not rax
and rax, r12
or rcx, rax
imul rcx, rbp
movzx eax, byte [r15 + 0x11]
xor rax, rcx
imul rax, rbp
movzx ecx, byte [r15 + 0x12]
xor rcx, rax
imul rcx, rbp
movzx eax, byte [r15 + 0x13]
xor rax, rcx
imul rax, rbp
movzx ecx, byte [r15 + 0x14]
xor rcx, rax
imul rcx, rbp
movzx eax, byte [r15 + 0x15]
xor rax, rcx
imul rax, rbp
movzx ecx, byte [r15 + 0x16]
xor rcx, rax
imul rcx, rbp
movzx eax, byte [r15 + 0x17]
xor rax, rcx
mov rcx, qword [0x140561990]
mov rdx, r13
xor rdx, rcx
mov r8, r13
and r8, rcx
lea r8, [rdx + r8*2]
imul r8, rax
mov rdx, qword [rsi + 0x30]
mov rax, r8
not rax
xor r8, rdx
not rdx
and rdx, rax
or rdx, r8
not rdx
mov rax, qword [rsi + 8]
mov r8, qword [rsi + 0x18]
add cl, 0xbf
shl rdx, cl
lea rcx, [rdx*8]
or rcx, 8
mov rcx, qword [r8 + rcx]
cmp rcx, rax
je 0x1403a92c0
mov r9, qword [r15 + 0x10]
cmp r9, qword [rcx + 0x10]
je 0x1403a93d3
mov rdx, qword [r8 + rdx*8]
nop dword [rax]
cmp rcx, rdx
je 0x1403a92c0
mov rcx, qword [rcx + 8]
cmp r9, qword [rcx + 0x10]
jne 0x1403a93c0
cmp rcx, rax
je 0x1403a92c0
mov eax, dword [r15 + 0x18]
add dword [rcx + 0x18], eax
jmp 0x1403a92df
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1403f5480
nop
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1403a9790
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x1403a9a01
mov rsi, rcx
add rdx, qword [0x140561990]
movabs rax, 0xa30f80af8907abd
add rax, rdx
or rax, 1
bsr rax, rax
xor eax, 0x3f
mov ecx, eax
neg cl
mov r14d, 1
shl r14, cl
mov bl, 0x40
sub bl, al
lea rax, [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, rdi
call fcn.1403a8f60
mov rax, 0xfffffffffffffffe
mov ecx, ebx
rol rax, cl
lea rax, [rax + r14*2]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], r14
mov rax, qword [rsi + 8]
mov rax, qword [rax]
cmp rax, rdi
je 0x1403a99f3
movabs rdx, 0xcbf29ce484222325
movabs r8, 0x100000001b3
movabs r9, 0xa30f90af8907c71
jmp 0x1403a9861
mov qword [r11 + rbx*8], r10
mov qword [r11 + rcx*8], r10
cmp rax, rdi
je 0x1403a99f3
mov r10, rax
mov rax, qword [rax]
movzx ecx, byte [r10 + 0x10]
xor rcx, rdx
imul rcx, r8
movzx r11d, byte [r10 + 0x11]
mov rbx, r11
not rbx
and rbx, rcx
not ecx
and ecx, r11d
or rbx, rcx
mov rcx, qword [0x140561990]
mov r11, rcx
xor r11, r9
mov r14, rcx
and r14, r9
lea r11, [r11 + r14*2]
imul r11, rbx
movzx ebx, byte [r10 + 0x12]
not rbx
mov r14, r11
and r14, rbx
or rbx, r11
not rbx
or rbx, r14
imul rbx, r8
movzx r11d, byte [r10 + 0x13]
xor r11, rbx
imul r11, r8
movzx ebx, byte [r10 + 0x14]
mov r14, rbx
not r14
and r14, r11
not r11d
and r11d, ebx
or r14, r11
imul r14, r8
movzx r11d, byte [r10 + 0x15]
xor r11, r14
imul r11, r8
movzx ebx, byte [r10 + 0x16]
mov r14, rbx
not r14
and r14, r11
not r11d
and r11d, ebx
or r14, r11
imul r14, r8
movzx r11d, byte [r10 + 0x17]
xor r11, r14
imul r11, r8
mov rbx, qword [rsi + 0x30]
xor rbx, r11
not rbx
and rbx, r11
mov r11, qword [rsi + 0x18]
add cl, 0xbf
shl rbx, cl
mov rcx, rbx
or rcx, 1
mov r15, qword [r11 + rbx*8]
cmp r15, rdi
je 0x1403a9850
mov r14, qword [r11 + rcx*8]
mov r12, qword [r10 + 0x10]
cmp r12, qword [r14 + 0x10]
jne 0x1403a9990
mov rbx, qword [r14]
cmp rbx, r10
je 0x1403a9854
mov r14, qword [r10 + 8]
mov qword [r14], rax
mov r15, qword [rax + 8]
mov qword [r15], rbx
mov r12, qword [rbx + 8]
mov qword [r12], r10
mov qword [rbx + 8], r15
mov qword [rax + 8], r14
mov qword [r10 + 8], r12
jmp 0x1403a9854
cmp r15, r14
je 0x1403a99c8
mov r14, qword [r14 + 8]
cmp r12, qword [r14 + 0x10]
jne 0x1403a9990
mov rcx, qword [r14]
mov r11, qword [r10 + 8]
mov qword [r11], rax
mov rbx, qword [rax + 8]
mov qword [rbx], rcx
mov r14, qword [rcx + 8]
mov qword [r14], r10
mov qword [rcx + 8], rbx
mov qword [rax + 8], r11
mov qword [r10 + 8], r14
jmp 0x1403a9858
mov rcx, qword [r10 + 8]
mov qword [rcx], rax
mov r15, qword [rax + 8]
mov qword [r15], r14
mov r12, qword [r14 + 8]
mov qword [r12], r10
mov qword [r14 + 8], r15
mov qword [rax + 8], rcx
mov qword [r10 + 8], r12
mov qword [r11 + rbx*8], r10
jmp 0x1403a9858
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor ecx, ecx
mov edx, 1
mov r8d, 0xd928fa46
mov r9d, 0xcc5592f3
call fcn.1403ae9e0
mov rcx, rax
call fcn.1403f70e4
int3
Function at 0x1403ae9e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xeda651b9
add eax, dword [0x140561988]
cmp ecx, eax
jne 0x1403aea1c
test edx, edx
je 0x1403aea4c
movzx eax, byte [0x14055fa4a]
cmp al, 0x48
je 0x1403aea14
mov cl, 0xe8
mov al, 0xa2
lock cmpxchg byte [0x14055fa4a], cl
je 0x1403aeaac
cmp al, 0x48
jne 0x1403aea00
lea rax, [0x14055fa30]
ret
test edx, edx
je 0x1403aea7c
movzx eax, byte [0x14055f8a7]
cmp al, 0x4c
je 0x1403aea44
mov cl, 0xd3
nop dword [rax]
mov al, 0x51
lock cmpxchg byte [0x14055f8a7], cl
je 0x1403aeb01
cmp al, 0x4c
jne 0x1403aea30
lea rax, [0x14055f8a0]
ret
movzx eax, byte [0x14055f8b5]
cmp al, 0x26
je 0x1403aea74
mov cl, 0x4e
nop dword [rax]
mov al, 0x24
lock cmpxchg byte [0x14055f8b5], cl
je 0x1403aeb5c
cmp al, 0x26
jne 0x1403aea60
lea rax, [0x14055f8b0]
ret
movzx eax, byte [0x14055fba3]
cmp al, 0x39
je 0x1403aeaa4
mov cl, 0x54
nop dword [rax]
mov al, 0x80
lock cmpxchg byte [0x14055fba3], cl
je 0x1403aeb88
cmp al, 0x39
jne 0x1403aea90
lea rax, [0x14055fb90]
ret
xor edx, edx
lea rax, [0x14055fa30]
lea rcx, [0x14045fff0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140561988]
add edx, r8d
add edx, 0xeda651ba
cmp edx, 0x1a
jl 0x1403aeac0
mov al, 0x48
xchg byte [0x14055fa4a], al
lea rax, [0x14055fa30]
ret
xor eax, eax
lea rcx, [0x14055f8a0]
lea rdx, [0x14045fe70]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 6
jg 0x1403aeb4c
inc rax
jmp 0x1403aeb20
mov al, 0x4c
xchg byte [0x14055f8a7], al
lea rax, [0x14055f8a0]
ret
xor eax, eax
lea rcx, [0x14055f8b0]
lea rdx, [0x14045fe80]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x1403aebb8
inc rax
jmp 0x1403aeb70
xor eax, eax
lea rcx, [0x14055fb90]
lea rdx, [0x140460140]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x12
jg 0x1403aebc8
inc rax
jmp 0x1403aeba0
mov al, 0x26
xchg byte [0x14055f8b5], al
lea rax, [0x14055f8b0]
ret
mov al, 0x39
xchg byte [0x14055fba3], al
lea rax, [0x14055fb90]
ret
Function at 0x1403aebe0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403aec2c
test edx, edx
je 0x1403aec6c
movzx eax, byte [0x14055fa2b]
movzx ecx, byte [0x140561998]
mov edx, ecx
xor dl, 0x53
and dl, cl
xor cl, 0x2c
add dl, dl
add dl, cl
cmp al, dl
je 0x1403aec24
mov cl, 0x55
nop
mov al, 0xa4
lock cmpxchg byte [0x14055fa2b], cl
je 0x1403aece1
cmp al, 0x3e
jne 0x1403aec10
lea rax, [0x14055fa10]
ret
test edx, edx
je 0x1403aec9c
movzx eax, byte [0x14055fd49]
movzx ecx, byte [0x140561998]
add cl, 0x96
cmp al, cl
je 0x1403aec64
mov cl, 0x62
nop word [rax + rax]
mov al, 0x92
lock cmpxchg byte [0x14055fd49], cl
je 0x1403aed3a
cmp al, 0xa8
jne 0x1403aec50
lea rax, [0x14055fd40]
ret
movzx eax, byte [0x14055f9ad]
cmp al, 0x55
je 0x1403aec94
mov cl, 0x41
nop dword [rax]
mov al, 0x60
lock cmpxchg byte [0x14055f9ad], cl
je 0x1403aed68
cmp al, 0x55
jne 0x1403aec80
lea rax, [0x14055f9a0]
ret
movzx eax, byte [0x14055fd00]
cmp al, 0x9d
je 0x1403aecd9
nop word [rax + rax]
movzx ecx, byte [0x140561998]
lea eax, [rcx + 0x4d]
add cl, 0x93
lock cmpxchg byte [0x14055fd00], cl
je 0x1403aedd5
movzx ecx, byte [0x140561998]
add cl, 0x8b
cmp al, cl
jne 0x1403aecb0
lea rax, [0x14055fcf0]
ret
xor r8d, r8d
lea rax, [0x14055fa10]
lea rcx, [0x14045ffd0]
mov edx, 0xeda651d4
nop word [rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
add byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x140561988]
add r9d, edx
cmp r8d, r9d
jl 0x1403aed00
mov al, 0x3e
xchg byte [0x14055fa2b], al
lea rax, [0x14055fa10]
ret
xor eax, eax
lea rcx, [0x14055fd40]
lea rdx, [0x1404602e0]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1403aedb5
inc rax
jmp 0x1403aed50
xor eax, eax
lea rcx, [0x14055f9a0]
lea rdx, [0x14045ff70]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
not r10b
mov r11d, r8d
xor r11b, r10b
not r11b
and r11b, r9b
and r10b, r8b
or r10b, r11b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1403aedc5
inc rax
jmp 0x1403aed80
mov al, 0xa8
xchg byte [0x14055fd49], al
lea rax, [0x14055fd40]
ret
mov al, 0x55
xchg byte [0x14055f9ad], al
lea rax, [0x14055f9a0]
ret
xor eax, eax
lea rcx, [0x14055fcf0]
lea rdx, [0x1404602a0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1403aee08
inc rax
jmp 0x1403aedf0
mov al, 0x9d
xchg byte [0x14055fd00], al
lea rax, [0x14055fcf0]
ret
Function at 0x1403aee20
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403aeebf
test edx, edx
je 0x1403aef0c
movzx eax, byte [0x14055f794]
nop word [rax + rax]
cmp al, 0xa9
je 0x1403aeeb7
movzx ecx, byte [0x140561998]
lea eax, [rcx + 0x15]
neg cl
mov edx, ecx
xor dl, 0x49
and cl, 0x49
add cl, cl
add cl, dl
neg cl
lock cmpxchg byte [0x14055f794], cl
jne 0x1403aee40
xor edx, edx
lea rax, [0x14055f790]
lea rcx, [0x14045fd70]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 4
jl 0x1403aee80
mov al, 0xa9
xchg byte [0x14055f794], al
lea rax, [0x14055f790]
ret
mov eax, 0x2ef67d
add eax, dword [0x140561988]
mov ecx, eax
xor ecx, 0xed775b3c
and eax, 0x6d775b3c
lea eax, [rcx + rax*2]
cmp edx, eax
jne 0x1403aef38
movzx eax, byte [0x14055fc71]
cmp al, 0x8d
je 0x1403aef04
mov cl, 0x9c
nop dword [rax + rax]
mov al, 0x69
lock cmpxchg byte [0x14055fc71], cl
je 0x1403aefb1
cmp al, 0x8d
jne 0x1403aeef0
lea rax, [0x14055fc60]
ret
movzx eax, byte [0x1405601b9]
cmp al, 0xcf
je 0x1403aef30
mov cl, 0xc4
nop dword [rax]
mov al, 0x95
lock cmpxchg byte [0x1405601b9], cl
je 0x1403aef6c
cmp al, 0xcf
jne 0x1403aef20
lea rax, [0x1405601b0]
ret
movzx eax, byte [0x14055fd57]
cmp al, 0xc3
je 0x1403aef64
mov cl, 0x1d
nop word cs:[rax + rax]
mov al, 0xd2
lock cmpxchg byte [0x14055fd57], cl
je 0x1403aeff1
cmp al, 0xc3
jne 0x1403aef50
lea rax, [0x14055fd50]
ret
xor edx, edx
lea rax, [0x1405601b0]
lea rcx, [0x140460700]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x140561988]
add edx, r8d
add edx, 0xeda651ba
cmp edx, 9
jl 0x1403aef80
mov al, 0xcf
xchg byte [0x1405601b9], al
lea rax, [0x1405601b0]
ret
xor eax, eax
lea rcx, [0x14055fc60]
lea rdx, [0x140460210]
mov r8d, 0xeda651ca
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140561988]
add r10d, r8d
cmp r9d, r10d
jge 0x1403af05f
inc rax
jmp 0x1403aefd0
xor edx, edx
lea rax, [0x14055fd50]
lea rcx, [0x1404602f0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140561988]
add edx, r8d
add edx, 0xeda651ba
add r8d, 0xeda651c0
cmp edx, r8d
jl 0x1403af010
movzx eax, byte [0x140561998]
add al, 0xb1
xchg byte [0x14055fd57], al
lea rax, [0x14055fd50]
ret
mov al, 0x8d
xchg byte [0x14055fc71], al
lea rax, [0x14055fc60]
ret
Function at 0x1403afc50
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403afc8c
test edx, edx
je 0x1403afcbc
movzx eax, byte [0x140560055]
cmp al, 0x9c
je 0x1403afc84
mov cl, 0x15
nop word cs:[rax + rax]
mov al, 0x43
lock cmpxchg byte [0x140560055], cl
je 0x1403afd65
cmp al, 0x9c
jne 0x1403afc70
lea rax, [0x140560040]
ret
test edx, edx
je 0x1403afcec
movzx eax, byte [0x14055fc23]
cmp al, 0xa0
je 0x1403afcb4
mov cl, 0x7e
nop dword [rax]
mov al, 0x7b
lock cmpxchg byte [0x14055fc23], cl
je 0x1403afdb8
cmp al, 0xa0
jne 0x1403afca0
lea rax, [0x14055fc10]
ret
movzx eax, byte [0x14055fe59]
cmp al, 0xe1
je 0x1403afce4
mov cl, 0x35
nop dword [rax]
mov al, 0xf9
lock cmpxchg byte [0x14055fe59], cl
je 0x1403afe0a
cmp al, 0xe1
jne 0x1403afcd0
lea rax, [0x14055fe50]
ret
movzx eax, byte [0x14055f971]
nop word cs:[rax + rax]
cmp al, 0xcd
je 0x1403afe50
movzx ecx, byte [0x140561998]
lea eax, [rcx - 7]
add cl, 0x41
lock cmpxchg byte [0x14055f971], cl
jne 0x1403afd00
xor eax, eax
lea rcx, [0x14055f960]
lea rdx, [0x14045ff30]
mov r8d, 0xeda651ca
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140561988]
add r10d, r8d
cmp r9d, r10d
jge 0x1403afe48
inc rax
jmp 0x1403afd40
xor eax, eax
lea rcx, [0x140560040]
lea rdx, [0x1404605a0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1403afda8
inc rax
jmp 0x1403afd80
mov al, 0x9c
xchg byte [0x140560055], al
lea rax, [0x140560040]
ret
xor r8d, r8d
lea rax, [0x14055fc10]
lea rcx, [0x1404601c0]
mov edx, 0xeda651cc
nop
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
xor byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x140561988]
add r9d, edx
cmp r8d, r9d
jl 0x1403afdd0
mov al, 0xa0
xchg byte [0x14055fc23], al
lea rax, [0x14055fc10]
ret
xor eax, eax
lea rcx, [0x14055fe50]
lea rdx, [0x1404603d0]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1403afe38
inc rax
jmp 0x1403afe20
mov al, 0xe1
xchg byte [0x14055fe59], al
lea rax, [0x14055fe50]
ret
mov al, 0xcd
xchg byte [0x14055f971], al
lea rax, [0x14055f960]
ret
Function at 0x1403b14d0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403b151c
mov ecx, dword [rsp + 0x28]
mov eax, ecx
xor eax, 0x9dab688a
add eax, dword [0x140561988]
cmp edx, eax
jne 0x1403b154c
movzx eax, byte [0x14055f77a]
cmp al, 0x55
je 0x1403b1514
mov dl, 0xbe
nop word cs:[rax + rax]
mov al, 0xb8
lock cmpxchg byte [0x14055f77a], dl
je 0x1403b15ac
cmp al, 0x55
jne 0x1403b1500
lea rax, [0x14055f770]
ret
test edx, edx
je 0x1403b157c
movzx eax, byte [0x14055fd8e]
cmp al, 0xec
je 0x1403b1544
mov cl, 0xc4
nop dword [rax]
mov al, 0xd3
lock cmpxchg byte [0x14055fd8e], cl
je 0x1403b1648
cmp al, 0xec
jne 0x1403b1530
lea rax, [0x14055fd80]
ret
movzx eax, byte [0x14055fbf8]
cmp al, 0xc5
je 0x1403b1574
mov cl, 0x44
nop dword [rax]
mov al, 0x42
lock cmpxchg byte [0x14055fbf8], cl
je 0x1403b15f1
cmp al, 0xc5
jne 0x1403b1560
lea rax, [0x14055fbf0]
ret
movzx eax, byte [0x14055f95b]
cmp al, 0xbb
je 0x1403b15a4
mov cl, 0xdc
nop dword [rax]
mov al, 1
lock cmpxchg byte [0x14055f95b], cl
je 0x1403b1688
cmp al, 0xbb
jne 0x1403b1590
lea rax, [0x14055f950]
ret
xor eax, eax
lea rdx, [0x14055f770]
lea r8, [0x14045fd50]
xor ecx, 0x9dab68f0
nop word cs:[rax + rax]
movzx r9d, byte [rax + r8]
xor byte [rax + rdx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140561988]
add r10d, ecx
cmp r9d, r10d
jge 0x1403b1628
inc rax
jmp 0x1403b15d0
xor eax, eax
lea rcx, [0x14055fbf0]
lea rdx, [0x1404601a0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 7
jg 0x1403b1638
inc rax
jmp 0x1403b1610
mov al, 0x55
xchg byte [0x14055f77a], al
lea rax, [0x14055f770]
ret
mov al, 0xc5
xchg byte [0x14055fbf8], al
lea rax, [0x14055fbf0]
ret
xor eax, eax
lea rcx, [0x14055fd80]
lea rdx, [0x140460320]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x1403b1678
inc rax
jmp 0x1403b1660
mov al, 0xec
xchg byte [0x14055fd8e], al
lea rax, [0x14055fd80]
ret
xor edx, edx
lea rax, [0x14055f950]
lea rcx, [0x14045ff20]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xb
jl 0x1403b16a0
mov al, 0xbb
xchg byte [0x14055f95b], al
lea rax, [0x14055f950]
ret
Function at 0x1403b21f0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1403b222c
test edx, edx
je 0x1403b22bc
movzx eax, byte [0x14055fb54]
cmp al, 0x5c
je 0x1403b2224
mov cl, 0xb4
nop
mov al, 0x46
lock cmpxchg byte [0x14055fb54], cl
je 0x1403b2358
cmp al, 0x5c
jne 0x1403b2210
lea rax, [0x14055fb40]
ret
test edx, edx
je 0x1403b230c
movzx eax, byte [0x14055f6c4]
nop dword [rax + rax]
cmp al, 0x7e
je 0x1403b23a0
movzx ecx, byte [0x140561998]
mov eax, r8d
xor al, 0x43
add al, 0xe8
mov edx, eax
xor dl, cl
and al, cl
add al, al
add al, dl
add al, 0x18
mov edx, r8d
xor dl, 0x8c
add dl, cl
lock cmpxchg byte [0x14055f6c4], dl
jne 0x1403b2240
xor eax, eax
lea rcx, [0x14055f6c0]
lea rdx, [0x14045fca0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x1403b2398
inc rax
jmp 0x1403b2290
movzx eax, byte [0x14055fa9d]
movzx ecx, byte [0x140561998]
mov edx, r8d
xor dl, cl
xor dl, 0x31
mov r9d, r8d
xor r9b, 0x4e
not cl
and cl, r9b
or cl, dl
not cl
add cl, cl
add cl, dl
cmp al, cl
je 0x1403b2304
mov cl, 0x55
nop dword [rax]
mov al, 0x8d
lock cmpxchg byte [0x14055fa9d], cl
je 0x1403b23a8
cmp al, 0xa9
jne 0x1403b22f0
lea rax, [0x14055fa90]
ret
movzx eax, byte [0x14055f6a6]
mov ecx, r8d
xor cl, 0x72
add cl, byte [0x140561998]
cmp al, cl
je 0x1403b2350
mov cl, 0xf6
nop word cs:[rax + rax]
mov al, 0x37
lock cmpxchg byte [0x14055f6a6], cl
je 0x1403b2420
mov edx, r8d
xor dl, 0x72
add dl, byte [0x140561998]
cmp al, dl
jne 0x1403b2330
lea rax, [0x14055f6a0]
ret
xor eax, eax
lea rcx, [0x14055fb40]
lea rdx, [0x1404600f0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x13
jg 0x1403b2388
inc rax
jmp 0x1403b2370
mov al, 0x5c
xchg byte [0x14055fb54], al
lea rax, [0x14055fb40]
ret
mov al, 0x7e
xchg byte [0x14055f6c4], al
lea rax, [0x14055f6c0]
ret
xor eax, eax
lea rcx, [0x14055fa90]
lea rdx, [0x140460040]
mov r9d, r8d
not r9d
xor r8d, 0x66994ae3
and r9d, 0x9966b51c
or r8d, r9d
not r8d
or r8d, r9d
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x140561988]
mov r10d, r9d
xor r10d, r10d
not r10d
and r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 0xd
jl 0x1403b23e0
mov al, 0xa9
xchg byte [0x14055fa9d], al
lea rax, [0x14055fa90]
ret
xor eax, eax
lea rcx, [0x14055f6a0]
lea rdx, [0x14045fc80]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x1403b2448
inc rax
jmp 0x1403b2430
mov al, 0xe6
xchg byte [0x14055f6a6], al
lea rax, [0x14055f6a0]
ret