joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140376100
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14037613c
test edx, edx
je 0x14037616c
movzx eax, byte [0x14051c72e]
cmp al, 0xc3
je 0x140376134
mov cl, 0x22
nop word cs:[rax + rax]
mov al, 0xc8
lock cmpxchg byte [0x14051c72e], cl
je 0x1403761cc
cmp al, 0xc3
jne 0x140376120
lea rax, [0x14051c720]
ret
test edx, edx
je 0x14037619c
movzx eax, byte [0x14051c6d7]
cmp al, 0x6a
je 0x140376164
mov cl, 0x81
nop dword [rax]
mov al, 0x6d
lock cmpxchg byte [0x14051c6d7], cl
je 0x140376208
cmp al, 0x6a
jne 0x140376150
lea rax, [0x14051c6d0]
ret
movzx eax, byte [0x14051c52d]
cmp al, 0x4d
je 0x140376194
mov cl, 0xe6
nop dword [rax]
mov al, 0xf8
lock cmpxchg byte [0x14051c52d], cl
je 0x14037624c
cmp al, 0x4d
jne 0x140376180
lea rax, [0x14051c520]
ret
movzx eax, byte [0x14051c420]
cmp al, 0x24
je 0x1403761c4
mov cl, 0xe1
nop dword [rax]
mov al, 0x85
lock cmpxchg byte [0x14051c420], cl
je 0x14037629f
cmp al, 0x24
jne 0x1403761b0
lea rax, [0x14051c410]
ret
xor eax, eax
lea rcx, [0x14051c720]
lea rdx, [0x140426770]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x1403761f8
inc rax
jmp 0x1403761e0
mov al, 0xc3
xchg byte [0x14051c72e], al
lea rax, [0x14051c720]
ret
xor eax, eax
lea rcx, [0x14051c6d0]
lea rdx, [0x140426720]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 6
jg 0x14037628f
inc rax
jmp 0x140376220
xor edx, edx
lea rax, [0x14051c520]
lea rcx, [0x140426580]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x140376260
mov al, 0x4d
xchg byte [0x14051c52d], al
lea rax, [0x14051c520]
ret
mov al, 0x6a
xchg byte [0x14051c6d7], al
lea rax, [0x14051c6d0]
ret
xor eax, eax
lea rcx, [0x14051c410]
lea rdx, [0x140426480]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1403762d8
inc rax
jmp 0x1403762b0
movzx eax, byte [0x14051dddc]
add al, 0xb3
xchg byte [0x14051c420], al
lea rax, [0x14051c410]
ret
Function at 0x1403775d0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14037760c
test edx, edx
je 0x140377656
movzx eax, byte [0x14051c9d6]
cmp al, 0x80
je 0x140377604
mov cl, 0xda
nop word cs:[rax + rax]
mov al, 0xa6
lock cmpxchg byte [0x14051c9d6], cl
je 0x1403776dc
cmp al, 0x80
jne 0x1403775f0
lea rax, [0x14051c9c0]
ret
test edx, edx
je 0x1403776a2
movzx eax, byte [0x14051c076]
cmp al, 0xe6
je 0x14037764e
mov cl, 0x28
nop word cs:[rax + rax]
mov al, 0x8c
lock cmpxchg byte [0x14051c076], cl
je 0x140377738
movzx edx, byte [0x14051dddc]
add dl, 0x75
cmp al, dl
jne 0x140377630
lea rax, [0x14051c070]
ret
movzx eax, byte [0x14051c46b]
cmp al, 0x9d
je 0x14037769a
mov cl, 0xa9
nop word cs:[rax + rax]
mov al, 0xc3
lock cmpxchg byte [0x14051c46b], cl
je 0x140377781
movzx edx, byte [0x14051dddc]
mov r8d, edx
xor r8b, 0x2c
and dl, 0x2c
add dl, dl
add dl, r8b
cmp al, dl
jne 0x140377670
lea rax, [0x14051c460]
ret
movzx eax, byte [0x14051c810]
movzx ecx, byte [0x14051dddc]
add cl, 0x32
cmp al, cl
je 0x1403776d4
mov cl, 0x94
nop dword [rax]
mov al, 0xfb
lock cmpxchg byte [0x14051c810], cl
je 0x1403777cf
cmp al, 0xa3
jne 0x1403776c0
lea rax, [0x14051c800]
ret
xor edx, edx
lea rax, [0x14051c9c0]
lea rcx, [0x1404269d0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x14051ddd8]
add edx, r8d
add edx, 0x4937e5c1
add r8d, 0x4937e5d6
cmp edx, r8d
jl 0x1403776f0
mov al, 0x80
xchg byte [0x14051c9d6], al
lea rax, [0x14051c9c0]
ret
xor edx, edx
lea rax, [0x14051c070]
lea rcx, [0x140426100]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x14051ddd8]
add edx, r8d
add edx, 0x4937e5c1
cmp edx, 6
jl 0x140377750
mov al, 0xe6
xchg byte [0x14051c076], al
lea rax, [0x14051c070]
ret
xor edx, edx
lea rax, [0x14051c460]
lea rcx, [0x1404264c0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xb
jl 0x1403777a0
mov al, 0x9d
xchg byte [0x14051c46b], al
lea rax, [0x14051c460]
ret
xor eax, eax
lea rcx, [0x14051c800]
lea rdx, [0x140426830]
mov r8d, 0x4937e5d0
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14051ddd8]
add r10d, r8d
cmp r9d, r10d
jge 0x140377811
inc rax
jmp 0x1403777f0
mov al, 0xa3
xchg byte [0x14051c810], al
lea rax, [0x14051c800]
ret
Function at 0x140377830
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14037786c
test edx, edx
je 0x1403778df
movzx eax, byte [0x14051c459]
cmp al, 0x52
je 0x140377864
mov cl, 0x2b
nop dword [rax]
mov al, 0x3b
lock cmpxchg byte [0x14051c459], cl
je 0x140377956
cmp al, 0x52
jne 0x140377850
lea rax, [0x14051c450]
ret
test edx, edx
je 0x14037790c
movzx eax, byte [0x14051c685]
nop dword [rax + rax]
cmp al, 0x69
je 0x1403778d7
movzx ecx, byte [0x14051dddc]
lea eax, [rcx - 0x1b]
add cl, 0x20
lock cmpxchg byte [0x14051c685], cl
jne 0x140377880
xor edx, edx
lea rax, [0x14051c670]
lea rcx, [0x1404266d0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x1403778b0
mov al, 0x69
xchg byte [0x14051c685], al
lea rax, [0x14051c670]
ret
movzx eax, byte [0x14051c780]
cmp al, 0x7c
je 0x140377904
mov cl, 0xa7
nop dword [rax]
mov al, 0x61
lock cmpxchg byte [0x14051c780], cl
je 0x1403779aa
cmp al, 0x7c
jne 0x1403778f0
lea rax, [0x14051c770]
ret
movzx eax, byte [0x14051c255]
movzx ecx, byte [0x14051dddc]
add cl, 0x30
cmp al, cl
je 0x14037794e
mov cl, 0x92
nop word cs:[rax + rax]
mov al, 0x99
lock cmpxchg byte [0x14051c255], cl
je 0x1403779f6
movzx edx, byte [0x14051dddc]
add dl, 0x30
cmp al, dl
jne 0x140377930
lea rax, [0x14051c250]
ret
xor r8d, r8d
lea rax, [0x14051c450]
lea rcx, [0x1404264b0]
mov edx, 0x4937e5c9
nop dword [rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
add byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x14051ddd8]
add r9d, edx
cmp r8d, r9d
jl 0x140377970
mov al, 0x52
xchg byte [0x14051c459], al
lea rax, [0x14051c450]
ret
xor edx, edx
lea rax, [0x14051c770]
lea rcx, [0x1404267c0]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x1403779c0
movzx eax, byte [0x14051dddc]
add al, 0xb
xchg byte [0x14051c780], al
lea rax, [0x14051c770]
ret
xor eax, eax
lea rcx, [0x14051c250]
lea rdx, [0x1404262d0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x140377a28
inc rax
jmp 0x140377a10
mov al, 0xa1
xchg byte [0x14051c255], al
lea rax, [0x14051c250]
ret
Function at 0x140377c50
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140377c9c
mov eax, dword [0x14051ddd8]
mov ecx, eax
xor ecx, 0x4937e5c0
and eax, 0x4937e5c0
lea eax, [rcx + rax*2]
cmp edx, eax
jne 0x140377cdc
movzx eax, byte [0x14051c0f5]
cmp al, 0x82
je 0x140377c94
mov cl, 0x8e
nop dword [rax + rax]
mov al, 0x1e
lock cmpxchg byte [0x14051c0f5], cl
je 0x140377df8
cmp al, 0x82
jne 0x140377c80
lea rax, [0x14051c0f0]
ret
test edx, edx
je 0x140377d61
movzx eax, byte [0x14051c43d]
movzx ecx, byte [0x14051dddc]
add cl, 0x84
cmp al, cl
je 0x140377cd4
mov cl, 0x5e
nop dword [rax + rax]
mov al, 0xd1
lock cmpxchg byte [0x14051c43d], cl
je 0x140377e4c
cmp al, 0xf5
jne 0x140377cc0
lea rax, [0x14051c430]
ret
movzx eax, byte [0x14051c962]
nop word cs:[rax + rax]
cmp al, 0xd5
je 0x140377d59
movzx ecx, byte [0x14051dddc]
lea eax, [rcx + 0x22]
add cl, 0xae
lock cmpxchg byte [0x14051c962], cl
jne 0x140377cf0
xor edx, edx
lea rax, [0x14051c960]
lea rcx, [0x140426980]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x14051ddd8]
add edx, r8d
add edx, 0x4937e5c1
cmp edx, 2
jl 0x140377d20
mov al, 0xd5
xchg byte [0x14051c962], al
lea rax, [0x14051c960]
ret
movzx eax, byte [0x14051c10b]
nop dword [rax + rax]
cmp al, 0x29
je 0x140377df0
movzx ecx, byte [0x14051dddc]
lea eax, [rcx + 0x6f]
mov edx, ecx
xor dl, 0x74
and cl, 0x74
add cl, cl
add cl, dl
add cl, 0x92
lock cmpxchg byte [0x14051c10b], cl
jne 0x140377d70
xor edx, edx
lea rax, [0x14051c100]
lea rcx, [0x140426190]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x14051ddd8]
add edx, r8d
add edx, 0x4937e5c1
add r8d, 0x4937e5cb
cmp edx, r8d
jl 0x140377db0
mov al, 0x29
xchg byte [0x14051c10b], al
lea rax, [0x14051c100]
ret
xor eax, eax
lea rcx, [0x14051c0f0]
lea rdx, [0x140426180]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x140377e3c
inc rax
jmp 0x140377e10
mov al, 0x82
xchg byte [0x14051c0f5], al
lea rax, [0x14051c0f0]
ret
xor edx, edx
lea rax, [0x14051c430]
lea rcx, [0x140426490]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x14051ddd8]
add edx, r8d
add edx, 0x4937e5c1
add r8d, 0x4937e5cd
cmp edx, r8d
jl 0x140377e60
mov al, 0xf5
xchg byte [0x14051c43d], al
lea rax, [0x14051c430]
ret
Function at 0x140378130
Capabilities:
Encode data using xor

Disassembly:
push rbx
test ecx, ecx
je 0x140378189
mov eax, 0x4937e5c0
add eax, dword [0x14051ddd8]
cmp edx, eax
jne 0x14037823b
movzx eax, byte [0x14051c227]
movzx ecx, byte [0x14051dddc]
mov edx, ecx
xor dl, 0x86
and cl, 6
add cl, cl
add cl, dl
cmp al, cl
je 0x140378306
mov cl, 0x5f
nop dword [rax]
mov al, 0x2d
lock cmpxchg byte [0x14051c227], cl
je 0x1403782a9
cmp al, 0xf7
jne 0x140378170
jmp 0x140378306
test edx, edx
je 0x140378273
movzx eax, byte [0x14051c3ea]
nop dword [rax + rax]
cmp al, 0xed
je 0x140378363
movzx ecx, byte [0x14051dddc]
mov edx, ecx
xor dl, 0x1a
mov eax, ecx
and al, 0x1a
add al, al
add al, dl
add cl, 0x50
mov edx, ecx
xor dl, 0xf0
and cl, 0x70
add cl, cl
add cl, dl
lock cmpxchg byte [0x14051c3ea], cl
jne 0x1403781a0
xor eax, eax
lea rcx, [0x14051c3d0]
lea rdx, [0x140426440]
mov r8d, 0x4937e5da
nop dword [rax + rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
not r11b
mov ebx, r11d
xor bl, r10b
not r10b
and r9b, r10b
or r9b, bl
not r9b
xor r11b, r10b
and r11b, r10b
or r11b, r9b
mov byte [rax + rcx], r11b
lea r9d, [rax + 1]
mov r10d, dword [0x14051ddd8]
add r10d, r8d
cmp r9d, r10d
jge 0x14037835b
inc rax
jmp 0x1403781f0
movzx eax, byte [0x14051c972]
cmp al, 0x2f
je 0x140378352
mov cl, 0xca
nop dword [rax]
mov al, 0x36
lock cmpxchg byte [0x14051c972], cl
je 0x14037830f
movzx edx, byte [0x14051dddc]
add dl, 0xbe
cmp al, dl
jne 0x140378250
jmp 0x140378352
movzx eax, byte [0x14051c33d]
cmp al, 0xf4
je 0x1403783a0
mov cl, 0xc5
nop word cs:[rax + rax]
mov al, 0x8d
lock cmpxchg byte [0x14051c33d], cl
je 0x14037836c
cmp al, 0xf4
jne 0x140378290
jmp 0x1403783a0
xor edx, edx
lea rax, [0x14051c220]
lea rcx, [0x1404262a0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
not r10b
mov r11d, r9d
xor r11b, r10b
and r10b, r9b
not r11b
and r11b, r8b
or r11b, r10b
mov byte [rdx + rax], r11b
mov r8d, dword [0x14051ddd8]
add edx, r8d
add edx, 0x4937e5c1
cmp edx, 7
jl 0x1403782c0
mov al, 0xf7
xchg byte [0x14051c227], al
lea rax, [0x14051c220]
pop rbx
ret
xor edx, edx
lea rax, [0x14051c970]
lea rcx, [0x140426990]
nop
movsxd r8, edx
movzx edx, byte [r8 + rcx]
mov r9d, edx
xor r9b, dl
not r9b
and r9b, byte [r8 + rax]
xor r9b, dl
mov byte [r8 + rax], r9b
lea edx, [r8 + r8]
sub edx, r8d
inc edx
cmp edx, 2
jl 0x140378320
mov al, 0x2f
xchg byte [0x14051c972], al
lea rax, [0x14051c970]
pop rbx
ret
mov al, 0xed
xchg byte [0x14051c3ea], al
lea rax, [0x14051c3d0]
pop rbx
ret
xor eax, eax
lea rcx, [0x14051c330]
lea rdx, [0x1404263b0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140378398
inc rax
jmp 0x140378380
mov al, 0xf4
xchg byte [0x14051c33d], al
lea rax, [0x14051c330]
pop rbx
ret
Function at 0x140378a40
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140378abc
mov eax, 0x4937e5c0
add eax, dword [0x14051ddd8]
cmp edx, eax
jne 0x140378aec
movzx eax, byte [0x14051c5d7]
nop
cmp al, 0x9e
je 0x140378b94
movzx ecx, byte [0x14051dddc]
lea eax, [rcx + 0x5b]
add cl, 0x8f
lock cmpxchg byte [0x14051c5d7], cl
jne 0x140378a60
xor eax, eax
lea rcx, [0x14051c5d0]
lea rdx, [0x140426630]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 6
jg 0x140378b8c
inc rax
jmp 0x140378a90
test edx, edx
je 0x140378b1c
movzx eax, byte [0x14051c2cd]
cmp al, 0x6c
je 0x140378ae4
mov cl, 0x2e
nop dword [rax]
mov al, 0xcd
lock cmpxchg byte [0x14051c2cd], cl
je 0x140378be1
cmp al, 0x6c
jne 0x140378ad0
lea rax, [0x14051c2c0]
ret
movzx eax, byte [0x14051c7c3]
cmp al, 0xc0
je 0x140378b14
mov cl, 0x83
nop dword [rax]
mov al, 0x20
lock cmpxchg byte [0x14051c7c3], cl
je 0x140378b9c
cmp al, 0xc0
jne 0x140378b00
lea rax, [0x14051c7b0]
ret
movzx eax, byte [0x14051c192]
nop word cs:[rax + rax]
cmp al, 0x86
je 0x140378c5f
movzx ecx, byte [0x14051dddc]
mov edx, ecx
xor dl, 0x6a
mov eax, ecx
and al, 0x6a
add al, al
add al, dl
add cl, 0xc4
lock cmpxchg byte [0x14051c192], cl
jne 0x140378b30
xor eax, eax
lea rcx, [0x14051c190]
lea rdx, [0x140426220]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x140378c57
inc rax
jmp 0x140378b70
mov al, 0x9e
xchg byte [0x14051c5d7], al
lea rax, [0x14051c5d0]
ret
xor edx, edx
lea rax, [0x14051c7b0]
lea rcx, [0x1404267f0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x14051ddd8]
add edx, r8d
add edx, 0x4937e5c1
cmp edx, 0x13
jl 0x140378bb0
mov al, 0xc0
xchg byte [0x14051c7c3], al
lea rax, [0x14051c7b0]
ret
xor eax, eax
lea rcx, [0x14051c2c0]
lea rdx, [0x140426340]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
mov r9d, dword [0x14051ddd8]
mov r10d, r9d
xor r10d, 0x4937e5cd
and r9d, 0x4937e5cd
lea r9d, [r10 + r9*2]
cmp r8d, r9d
jge 0x140378c47
inc rax
jmp 0x140378c00
mov al, 0x6c
xchg byte [0x14051c2cd], al
lea rax, [0x14051c2c0]
ret
mov al, 0x86
xchg byte [0x14051c192], al
lea rax, [0x14051c190]
ret
Function at 0x140378c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x4937e5c0
add eax, dword [0x14051ddd8]
cmp ecx, eax
jne 0x140378cd6
test edx, edx
je 0x140378d26
movzx eax, byte [0x14051c491]
cmp al, 0xa8
je 0x140378cce
mov cl, 0xa5
nop word cs:[rax + rax]
mov al, 0xec
lock cmpxchg byte [0x14051c491], cl
je 0x140378d8c
movzx edx, byte [0x14051dddc]
add dl, 0x37
cmp al, dl
jne 0x140378cb0
lea rax, [0x14051c470]
ret
test edx, edx
je 0x140378d5c
movzx eax, byte [0x14051c5ff]
movzx ecx, byte [0x14051dddc]
add cl, 0x52
cmp al, cl
je 0x140378d1e
mov cl, 0x40
nop word cs:[rax + rax]
mov al, 0x8e
lock cmpxchg byte [0x14051c5ff], cl
je 0x140378dd1
movzx edx, byte [0x14051dddc]
add dl, 0x52
cmp al, dl
jne 0x140378d00
lea rax, [0x14051c5e0]
ret
movzx eax, byte [0x14051c6e9]
cmp al, 0xed
je 0x140378d54
mov cl, 0xea
nop word cs:[rax + rax]
mov al, 0xef
lock cmpxchg byte [0x14051c6e9], cl
je 0x140378e18
cmp al, 0xed
jne 0x140378d40
lea rax, [0x14051c6e0]
ret
movzx eax, byte [0x14051cac8]
cmp al, 0x9f
je 0x140378d84
mov cl, 0x74
nop dword [rax]
mov al, 0x6d
lock cmpxchg byte [0x14051cac8], cl
je 0x140378e51
cmp al, 0x9f
jne 0x140378d70
lea rax, [0x14051cab0]
ret
xor edx, edx
lea rax, [0x14051c470]
lea rcx, [0x1404264d0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x14051ddd8]
add edx, r8d
add edx, 0x4937e5c1
cmp edx, 0x21
jl 0x140378da0
mov al, 0xa8
xchg byte [0x14051c491], al
lea rax, [0x14051c470]
ret
xor eax, eax
lea rcx, [0x14051c5e0]
lea rdx, [0x140426640]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1e
jg 0x140378e08
inc rax
jmp 0x140378df0
mov al, 0xc3
xchg byte [0x14051c5ff], al
lea rax, [0x14051c5e0]
ret
xor eax, eax
lea rcx, [0x14051c6e0]
lea rdx, [0x140426730]
mov r8d, 0x4937e5c9
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14051ddd8]
add r10d, r8d
cmp r9d, r10d
jge 0x140378ea1
inc rax
jmp 0x140378e30
xor edx, edx
lea rax, [0x14051cab0]
lea rcx, [0x140426ab0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x14051ddd8]
add edx, r8d
add edx, 0x4937e5c1
cmp edx, 0x18
jl 0x140378e70
mov al, 0x9f
xchg byte [0x14051cac8], al
lea rax, [0x14051cab0]
ret
movzx eax, byte [0x14051dddc]
add al, 0xbb
mov ecx, eax
xor cl, 0xc1
and al, 0x41
add al, al
add al, cl
xchg byte [0x14051c6e9], al
lea rax, [0x14051c6e0]
ret
Function at 0x140379460
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403794b6
mov eax, dword [0x14051ddd8]
mov ecx, eax
xor ecx, 0x4937e5c0
and eax, 0x4937e5c0
lea eax, [rcx + rax*2]
cmp edx, eax
jne 0x1403794ec
movzx eax, byte [0x14051c360]
cmp al, 0x48
je 0x1403794ae
mov cl, 0x84
nop dword [rax + rax]
mov al, 0x79
lock cmpxchg byte [0x14051c360], cl
je 0x14037954c
movzx edx, byte [0x14051dddc]
add dl, 0xd7
cmp al, dl
jne 0x140379490
lea rax, [0x14051c350]
ret
test edx, edx
je 0x140379518
movzx eax, byte [0x14051c167]
cmp al, 0xa2
je 0x1403794e4
mov cl, 0xe4
nop word [rax + rax]
mov al, 0xa6
lock cmpxchg byte [0x14051c167], cl
je 0x1403795c8
cmp al, 0xa2
jne 0x1403794d0
lea rax, [0x14051c160]
ret
movzx eax, byte [0x14051c265]
cmp al, 0xe0
je 0x140379510
mov cl, 0x1d
nop dword [rax]
mov al, 0x9c
lock cmpxchg byte [0x14051c265], cl
je 0x140379578
cmp al, 0xe0
jne 0x140379500
lea rax, [0x14051c260]
ret
movzx eax, byte [0x14051c134]
movzx ecx, byte [0x14051dddc]
add cl, 0x4a
cmp al, cl
je 0x140379544
mov cl, 0xf4
nop
mov al, 0x59
lock cmpxchg byte [0x14051c134], cl
je 0x140379611
cmp al, 0xbb
jne 0x140379530
lea rax, [0x14051c130]
ret
xor eax, eax
lea rcx, [0x14051c350]
lea rdx, [0x1404263d0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1403795a8
inc rax
jmp 0x140379560
xor eax, eax
lea rcx, [0x14051c260]
lea rdx, [0x1404262e0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x1403795b8
inc rax
jmp 0x140379590
mov al, 0x48
xchg byte [0x14051c360], al
lea rax, [0x14051c350]
ret
mov al, pe_nt_image_headers64
xchg byte [0x14051c265], al
lea rax, [0x14051c260]
ret
xor eax, eax
lea rcx, [0x14051c160]
lea rdx, [0x1404261f0]
mov r8d, 0x4937e5c7
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14051ddd8]
add r10d, r8d
cmp r9d, r10d
jge 0x140379601
inc rax
jmp 0x1403795e0
mov al, 0xa2
xchg byte [0x14051c167], al
lea rax, [0x14051c160]
ret
xor r8d, r8d
lea rax, [0x14051c130]
lea rcx, [0x1404261c0]
mov edx, 0x4937e5c4
nop word [rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
add byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x14051ddd8]
add r9d, edx
cmp r8d, r9d
jl 0x140379630
movzx eax, byte [0x14051dddc]
add al, 0x4a
xchg byte [0x14051c134], al
lea rax, [0x14051c130]
ret
Function at 0x14037a2a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r8d, dword [rsp + 0x30]
mov eax, r8d
xor eax, 0xcc9292cd
add eax, dword [0x14051ddd8]
cmp ecx, eax
jne 0x14037a370
test edx, edx
je 0x14037a3b5
movzx eax, byte [0x14051c7a4]
nop dword [rax + rax]
cmp al, 0x29
je 0x14037a367
movzx ecx, byte [0x14051dddc]
mov eax, r8d
xor al, 0x5a
mov edx, eax
xor dl, cl
and al, cl
add al, al
add al, dl
mov edx, r8d
xor dl, 0x71
add dl, cl
lock cmpxchg byte [0x14051c7a4], dl
jne 0x14037a2d0
xor edx, edx
lea rax, [0x14051c790]
lea rcx, [0x1404267d0]
xor r8d, 0xcc9292d9
nop word [rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
add edx, 0xb11f8e6d
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
add edx, 0x4ee07193
mov r9d, dword [0x14051ddd8]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
cmp edx, r9d
jl 0x14037a320
mov al, 0x29
xchg byte [0x14051c7a4], al
lea rax, [0x14051c790]
pop rbx
ret
test edx, edx
je 0x14037a3e9
movzx eax, byte [0x14051c34d]
mov ecx, r8d
xor cl, 0x25
add cl, byte [0x14051dddc]
cmp al, cl
je 0x14037a459
mov cl, 0xda
nop word cs:[rax + rax]
mov al, 0xfc
lock cmpxchg byte [0x14051c34d], cl
je 0x14037a419
cmp al, 0x99
jne 0x14037a3a0
jmp 0x14037a459
movzx eax, byte [0x14051c2ba]
cmp al, 0x4e
je 0x14037a4c6
mov cl, 0x48
nop word cs:[rax + rax]
mov al, 0xd1
lock cmpxchg byte [0x14051c2ba], cl
je 0x14037a462
cmp al, 0x4e
jne 0x14037a3d0
jmp 0x14037a4c6
movzx eax, byte [0x14051c311]
cmp al, 0xea
je 0x14037a523
mov cl, 0x32
nop word [rax + rax]
mov al, 0xac
lock cmpxchg byte [0x14051c311], cl
je 0x14037a4cf
cmp al, 0xea
jne 0x14037a400
jmp 0x14037a523
xor eax, eax
lea rcx, [0x14051c340]
lea rdx, [0x1404263c0]
xor r8d, 0xcc9292c0
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14051ddd8]
add r10d, r8d
cmp r9d, r10d
jge 0x14037a451
inc rax
jmp 0x14037a430
mov al, 0x99
xchg byte [0x14051c34d], al
lea rax, [0x14051c340]
pop rbx
ret
xor eax, eax
lea rcx, [0x14051c290]
lea rdx, [0x140426310]
xor r8d, 0xcc9292cc
nop dword [rax]
cdqe
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
not r11b
mov ebx, r10d
xor bl, r11b
xor r11b, r9b
and r11b, r10b
xor r11b, r9b
and bl, r10b
add bl, bl
add bl, r11b
mov byte [rax + rcx], bl
mov r9d, dword [0x14051ddd8]
add r9d, r8d
add eax, r9d
cmp eax, 0x2a
jl 0x14037a480
mov al, 0x4e
xchg byte [0x14051c2ba], al
lea rax, [0x14051c290]
pop rbx
ret
xor eax, eax
lea rcx, [0x14051c300]
lea rdx, [0x140426380]
xor r8d, 0xcc9292dc
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14051ddd8]
mov r11d, r8d
xor r11d, r10d
and r10d, r8d
lea r10d, [r11 + r10*2]
cmp r9d, r10d
jge 0x14037a51b
inc rax
jmp 0x14037a4f0
mov al, 0xea
xchg byte [0x14051c311], al
lea rax, [0x14051c300]
pop rbx
ret