joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140157cb0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140157cec
test edx, edx
je 0x140157d1c
movzx eax, byte [0x1404dde7d]
cmp al, 0x8f
je 0x140157ce4
mov cl, 0xe5
nop word cs:[rax + rax]
mov al, 0xbc
lock cmpxchg byte [0x1404dde7d], cl
je 0x140157d7c
cmp al, 0x8f
jne 0x140157cd0
lea rax, [0x1404dde70]
ret
test edx, edx
je 0x140157d4c
movzx eax, byte [0x1404de01d]
cmp al, 0x58
je 0x140157d14
mov cl, 0xdc
nop dword [rax]
mov al, 0x66
lock cmpxchg byte [0x1404de01d], cl
je 0x140157db8
cmp al, 0x58
jne 0x140157d00
lea rax, [0x1404de010]
ret
movzx eax, byte [0x1404ddf21]
cmp al, 0xd4
je 0x140157d44
mov cl, 0x82
nop dword [rax]
mov al, 0x88
lock cmpxchg byte [0x1404ddf21], cl
je 0x140157dff
cmp al, 0xd4
jne 0x140157d30
lea rax, [0x1404ddf10]
ret
movzx eax, byte [0x1404ddffb]
cmp al, 0xc0
je 0x140157d74
mov ecx, dword [rsp + 0x28]
mov dl, 0xe4
nop dword [rax]
mov al, 0x7b
lock cmpxchg byte [0x1404ddffb], dl
je 0x140157e3f
cmp al, 0xc0
jne 0x140157d60
lea rax, [0x1404ddff0]
ret
xor eax, eax
lea rcx, [0x1404dde70]
lea rdx, [0x140403430]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140157da8
inc rax
jmp 0x140157d90
mov al, 0x8f
xchg byte [0x1404dde7d], al
lea rax, [0x1404dde70]
ret
xor edx, edx
lea rax, [0x1404de010]
lea rcx, [0x1404035d0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x140157dd0
mov al, 0x58
xchg byte [0x1404de01d], al
lea rax, [0x1404de010]
ret
xor edx, edx
lea rax, [0x1404ddf10]
lea rcx, [0x1404034d0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x11
jl 0x140157e10
mov al, 0xd4
xchg byte [0x1404ddf21], al
lea rax, [0x1404ddf10]
ret
xor eax, eax
lea rdx, [0x1404ddff0]
lea r8, [0x1404035b0]
nop
movzx r9d, byte [rax + r8]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rdx]
xor r10b, r9b
mov byte [rax + rdx], r10b
lea r9d, [rax + 1]
cmp r9d, 0xa
jg 0x140157e78
inc rax
jmp 0x140157e50
xor cl, 0x4a
add cl, byte [0x1404de1f8]
xchg byte [0x1404ddffb], cl
lea rax, [0x1404ddff0]
ret
Function at 0x140157e90
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x140157ec9
test edx, edx
je 0x140157ef9
movzx eax, byte [0x1404dded5]
cmp al, 0xc3
je 0x140157fdf
mov cl, 0xf7
nop
mov al, 0x25
lock cmpxchg byte [0x1404dded5], cl
je 0x140157f59
cmp al, 0xc3
jne 0x140157eb0
jmp 0x140157fdf
test edx, edx
je 0x140157f29
movzx eax, byte [0x1404ddea8]
cmp al, 9
je 0x140158050
mov cl, 0x3a
nop
mov al, 0xa5
lock cmpxchg byte [0x1404ddea8], cl
je 0x140157fe8
cmp al, 9
jne 0x140157ee0
jmp 0x140158050
movzx eax, byte [0x1404ddf0e]
cmp al, 0xfa
je 0x140158061
mov cl, 0x6d
nop word [rax + rax]
mov al, 0x7e
lock cmpxchg byte [0x1404ddf0e], cl
je 0x140158018
cmp al, 0xfa
jne 0x140157f10
jmp 0x140158061
movzx eax, byte [0x1404ddf48]
cmp al, 0x57
je 0x1401580c3
mov cl, 0x8c
nop word [rax + rax]
mov al, 0x45
lock cmpxchg byte [0x1404ddf48], cl
je 0x14015806a
cmp al, 0x57
jne 0x140157f40
jmp 0x1401580c3
xor eax, eax
lea rcx, [0x1404ddec0]
lea rdx, [0x140403480]
mov r11d, r8d
not r11d
mov r10d, r11d
and r10d, 0x10b419f8
mov r9d, r8d
and r9d, 0xef4be607
or r9d, r10d
and r11d, 0x10b419cc
mov r10d, r8d
and r10d, 0xef4be633
or r10d, r11d
nop word [rax + rax]
cdqe
movzx r11d, byte [rax + rdx]
mov ebx, r11d
xor bl, r11b
not bl
and bl, byte [rax + rcx]
xor bl, r11b
mov byte [rax + rcx], bl
mov r11d, dword [0x1404de1e8]
add eax, r9d
add eax, r11d
add r11d, r10d
cmp eax, r11d
jl 0x140157fa0
xor r8b, 0x5d
add r8b, byte [0x1404de1f8]
xchg byte [0x1404dded5], r8b
lea rax, [0x1404ddec0]
pop rbx
ret
xor eax, eax
lea rcx, [0x1404dde90]
lea rdx, [0x140403450]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x17
jg 0x140158048
inc rax
jmp 0x140158000
xor eax, eax
lea rcx, [0x1404ddf00]
lea rdx, [0x1404034c0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x140158059
inc rax
jmp 0x140158030
mov al, 9
xchg byte [0x1404ddea8], al
lea rax, [0x1404dde90]
pop rbx
ret
mov al, 0xfa
xchg byte [0x1404ddf0e], al
lea rax, [0x1404ddf00]
pop rbx
ret
xor eax, eax
lea rcx, [0x1404ddf30]
lea rdx, [0x1404034f0]
mov r9d, r8d
xor r9d, 0x10b419c1
nop word cs:[rax + rax]
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x1404de1e8]
add r11d, r9d
cmp r10d, r11d
jge 0x1401580b1
inc rax
jmp 0x140158090
xor r8b, 0x21
add r8b, byte [0x1404de1f8]
xchg byte [0x1404ddf48], r8b
lea rax, [0x1404ddf30]
pop rbx
ret
Function at 0x14015fbc0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14015fbfc
mov eax, 0x4b258b71
add eax, dword [0x1404df370]
cmp edx, eax
jne 0x14015fc2c
movzx eax, byte [0x1404de8d8]
cmp al, 0x84
je 0x14015fbf4
mov cl, 0xd7
mov al, 0x4b
lock cmpxchg byte [0x1404de8d8], cl
je 0x14015fc96
cmp al, 0x84
jne 0x14015fbe0
lea rax, [0x1404de8c0]
ret
test edx, edx
je 0x14015fc58
movzx eax, byte [0x1404de9d6]
cmp al, 0xd0
je 0x14015fc24
mov cl, 0x4c
nop dword [rax]
mov al, 0xf3
lock cmpxchg byte [0x1404de9d6], cl
je 0x14015fd18
cmp al, 0xd0
jne 0x14015fc10
lea rax, [0x1404de9c0]
ret
movzx eax, byte [0x1404deb82]
cmp al, 0xa4
je 0x14015fc50
mov cl, 0xa
nop dword [rax]
mov al, 0xcb
lock cmpxchg byte [0x1404deb82], cl
je 0x14015fcc8
cmp al, 0xa4
jne 0x14015fc40
lea rax, [0x1404deb70]
ret
movzx eax, byte [0x1404deb6d]
cmp al, 0x75
je 0x14015fc8e
mov cl, 0x8a
nop word cs:[rax + rax]
mov al, 0xc9
lock cmpxchg byte [0x1404deb6d], cl
je 0x14015fd7e
movzx edx, byte [0x1404df380]
add dl, 0x9d
cmp al, dl
jne 0x14015fc70
lea rax, [0x1404deb60]
ret
xor eax, eax
lea rcx, [0x1404de8c0]
lea rdx, [0x140403870]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x17
jg 0x14015fcf8
inc rax
jmp 0x14015fcb0
xor eax, eax
lea rcx, [0x1404deb70]
lea rdx, [0x140403b00]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x14015fd08
inc rax
jmp 0x14015fce0
mov al, 0x84
xchg byte [0x1404de8d8], al
lea rax, [0x1404de8c0]
ret
mov al, 0xa4
xchg byte [0x1404deb82], al
lea rax, [0x1404deb70]
ret
xor eax, eax
lea rcx, [0x1404de9c0]
lea rdx, [0x140403960]
mov r8d, 0x4b258b87
nop
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r10d
xor r11b, r10b
not r11b
and r11b, r9b
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1404df370]
add r10d, r8d
cmp r9d, r10d
jge 0x14015fd6e
inc rax
jmp 0x14015fd30
mov al, 0xd0
xchg byte [0x1404de9d6], al
lea rax, [0x1404de9c0]
ret
xor r8d, r8d
lea rax, [0x1404deb60]
lea rcx, [0x140403af0]
mov edx, 0x4b258b72
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
add byte [r8 + rax], r9b
mov r9d, dword [0x1404df370]
add r9d, edx
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r8d, [r10 + r9*2]
cmp r8d, 0xd
jl 0x14015fda0
mov al, 0x75
xchg byte [0x1404deb6d], al
lea rax, [0x1404deb60]
ret
Function at 0x140167fa0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x9da3dd51
add eax, dword [0x1404e0188]
cmp ecx, eax
jne 0x140167fdc
test edx, edx
je 0x14016800c
movzx eax, byte [0x1404df8d9]
cmp al, 0xef
je 0x140167fd4
mov cl, 0xa7
mov al, 0xa1
lock cmpxchg byte [0x1404df8d9], cl
je 0x1401680b6
cmp al, 0xef
jne 0x140167fc0
lea rax, [0x1404df8d0]
ret
test edx, edx
je 0x14016803c
movzx eax, byte [0x1404df8ad]
cmp al, 0x7d
je 0x140168004
mov cl, 0x75
nop dword [rax]
mov al, 0xa6
lock cmpxchg byte [0x1404df8ad], cl
je 0x1401680e8
cmp al, 0x7d
jne 0x140167ff0
lea rax, [0x1404df8a0]
ret
movzx eax, byte [0x1404df9e1]
cmp al, 0x36
je 0x140168034
mov cl, 4
nop dword [rax]
mov al, 0x33
lock cmpxchg byte [0x1404df9e1], cl
je 0x14016814f
cmp al, 0x36
jne 0x140168020
lea rax, [0x1404df9d0]
ret
movzx eax, byte [0x1404df85f]
nop word cs:[rax + rax]
cmp al, 0xc3
je 0x140168197
movzx ecx, byte [0x1404e0198]
lea eax, [rcx - 0x74]
add cl, 0x2d
lock cmpxchg byte [0x1404df85f], cl
jne 0x140168050
xor eax, eax
lea rcx, [0x1404df840]
lea rdx, [0x140403e40]
nop
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r8b
mov r10d, r8d
and r10b, r9b
not r9b
xor r8b, r9b
and r8b, r9b
or r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1e
jg 0x14016818f
inc rax
jmp 0x140168080
xor eax, eax
lea rcx, [0x1404df8d0]
lea rdx, [0x140403ed0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x140168138
inc rax
jmp 0x1401680d0
xor edx, edx
lea rax, [0x1404df8a0]
lea rcx, [0x140403ea0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1404e0188]
add edx, r8d
add edx, 0x9da3dd52
cmp edx, 0xd
jl 0x140168100
movzx eax, byte [0x1404e0198]
add al, 0xd9
xchg byte [0x1404df8ad], al
lea rax, [0x1404df8a0]
ret
movzx eax, byte [0x1404e0198]
add al, 0x4b
xchg byte [0x1404df8d9], al
lea rax, [0x1404df8d0]
ret
xor edx, edx
lea rax, [0x1404df9d0]
lea rcx, [0x140403fd0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x11
jl 0x140168160
mov al, 0x36
xchg byte [0x1404df9e1], al
lea rax, [0x1404df9d0]
ret
mov al, 0xc3
xchg byte [0x1404df85f], al
lea rax, [0x1404df840]
ret
Function at 0x1401681d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x9da3dd51
add eax, dword [0x1404e0188]
cmp ecx, eax
jne 0x14016820c
test edx, edx
je 0x140168256
movzx eax, byte [0x1404df89f]
cmp al, 0xfd
je 0x140168204
mov cl, 0x30
mov al, 0x14
lock cmpxchg byte [0x1404df89f], cl
je 0x1401682bc
cmp al, 0xfd
jne 0x1401681f0
lea rax, [0x1404df890]
ret
test edx, edx
je 0x14016828c
movzx eax, byte [0x1404df88d]
movzx ecx, byte [0x1404e0198]
add cl, 0x65
cmp al, cl
je 0x14016824e
mov cl, 0xc3
nop word [rax + rax]
mov al, 0x97
lock cmpxchg byte [0x1404df88d], cl
je 0x1401682e8
movzx edx, byte [0x1404e0198]
add dl, 0x65
cmp al, dl
jne 0x140168230
lea rax, [0x1404df880]
ret
movzx eax, byte [0x1404df87a]
cmp al, 0x5a
je 0x140168284
mov cl, 0xf7
nop word cs:[rax + rax]
mov al, 0xde
lock cmpxchg byte [0x1404df87a], cl
je 0x140168338
cmp al, 0x5a
jne 0x140168270
lea rax, [0x1404df870]
ret
movzx eax, byte [0x1404df8be]
cmp al, 0x1c
je 0x1401682b4
mov cl, 0x3c
nop dword [rax]
mov al, 0x90
lock cmpxchg byte [0x1404df8be], cl
je 0x140168368
cmp al, 0x1c
jne 0x1401682a0
lea rax, [0x1404df8b0]
ret
xor eax, eax
lea rcx, [0x1404df890]
lea rdx, [0x140403e90]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x140168318
inc rax
jmp 0x1401682d0
xor eax, eax
lea rcx, [0x1404df880]
lea rdx, [0x140403e80]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140168328
inc rax
jmp 0x140168300
mov al, 0xfd
xchg byte [0x1404df89f], al
lea rax, [0x1404df890]
ret
mov al, 9
xchg byte [0x1404df88d], al
lea rax, [0x1404df880]
ret
xor eax, eax
lea rcx, [0x1404df870]
lea rdx, [0x140403e70]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 9
jg 0x1401683a1
inc rax
jmp 0x140168350
xor eax, eax
lea rcx, [0x1404df8b0]
lea rdx, [0x140403eb0]
mov r8d, 0x9da3dd5f
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1404e0188]
add r10d, r8d
cmp r9d, r10d
jge 0x1401683b1
inc rax
jmp 0x140168380
mov al, 0x5a
xchg byte [0x1404df87a], al
lea rax, [0x1404df870]
ret
mov al, 0x1c
xchg byte [0x1404df8be], al
lea rax, [0x1404df8b0]
ret
Function at 0x1401683d0
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140168417
test edx, edx
je 0x1401684b8
movzx eax, byte [0x1404df9cd]
movzx ecx, byte [0x1404e0198]
dec cl
cmp al, cl
je 0x14016840f
movzx ecx, byte [0x1404e0198]
lea eax, [rcx + 0x50]
add cl, 3
lock cmpxchg byte [0x1404df9cd], cl
je 0x14016851c
cmp al, 0xa3
jne 0x1401683f0
lea rax, [0x1404df9c0]
ret
test edx, edx
je 0x1401684ec
movzx eax, byte [0x1404df903]
nop word cs:[rax + rax]
cmp al, 0xe1
je 0x1401684b0
movzx ecx, byte [0x1404e0198]
lea eax, [rcx + 0x2e]
add cl, 0x90
lock cmpxchg byte [0x1404df903], cl
jne 0x140168430
xor edx, edx
lea rax, [0x1404df8f0]
lea rcx, [0x140403ef0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
not r10b
mov r11d, r9d
xor r11b, r10b
and r10b, r9b
not r11b
and r11b, r8b
or r11b, r10b
mov byte [rdx + rax], r11b
add edx, 0x50ac1155
mov r8d, edx
xor r8d, 0xaf53eeac
and edx, 0x2f53eeac
lea edx, [r8 + rdx*2]
cmp edx, 0x13
jl 0x140168460
mov al, 0xe1
xchg byte [0x1404df903], al
lea rax, [0x1404df8f0]
ret
movzx eax, byte [0x1404df721]
cmp al, 0x75
je 0x1401684e4
mov cl, 0x72
nop word cs:[rax + rax]
mov al, 0xc7
lock cmpxchg byte [0x1404df721], cl
je 0x140168568
cmp al, 0x75
jne 0x1401684d0
lea rax, [0x1404df710]
ret
movzx eax, byte [0x1404df86d]
cmp al, 0xcc
je 0x140168514
mov cl, 0xa1
nop dword [rax]
mov al, 0x28
lock cmpxchg byte [0x1404df86d], cl
je 0x1401685bf
cmp al, 0xcc
jne 0x140168500
lea rax, [0x1404df860]
ret
xor eax, eax
lea rcx, [0x1404df9c0]
lea rdx, [0x140403fc0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140168558
inc rax
jmp 0x140168530
mov al, 0xa3
xchg byte [0x1404df9cd], al
lea rax, [0x1404df9c0]
ret
xor eax, eax
lea rcx, [0x1404df710]
lea rdx, [0x140403d10]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r9b
mov r10d, r9d
or r10b, r8b
not r10b
and r9b, r8b
or r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x1401685af
inc rax
jmp 0x140168580
mov al, 0x75
xchg byte [0x1404df721], al
lea rax, [0x1404df710]
ret
xor eax, eax
lea rcx, [0x1404df860]
lea rdx, [0x140403e60]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401685e8
inc rax
jmp 0x1401685d0
mov al, 0xcc
xchg byte [0x1404df86d], al
lea rax, [0x1404df860]
ret
Function at 0x1401688e0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x140168942
test edx, edx
je 0x14016898c
movzx eax, byte [0x1404df79d]
cmp al, 0x13
je 0x14016893a
mov cl, 0xba
nop
mov al, 0x2e
lock cmpxchg byte [0x1404df79d], cl
je 0x1401689fc
movzx edx, byte [0x1404e0198]
mov r9d, r8d
xor r9b, 0xd5
add r9b, 0x12
mov r10d, r9d
xor r10b, dl
and r9b, dl
add r9b, r9b
add r9b, r10b
add r9b, 0xee
cmp al, r9b
jne 0x140168900
lea rax, [0x1404df790]
ret
mov eax, r8d
xor eax, 0xf0faeeeb
add eax, dword [0x1404e0188]
cmp edx, eax
jne 0x1401689c8
movzx eax, byte [0x1404df8ed]
cmp al, 0xac
je 0x140168984
mov cl, 0xf0
nop word cs:[rax + rax]
mov al, 0x57
lock cmpxchg byte [0x1404df8ed], cl
je 0x140168a9b
cmp al, 0xac
jne 0x140168970
lea rax, [0x1404df8e0]
ret
movzx eax, byte [0x1404df77f]
cmp al, 0xfa
je 0x1401689c0
mov cl, 0xf7
nop dword [rax]
mov al, 9
lock cmpxchg byte [0x1404df77f], cl
je 0x140168a48
mov edx, r8d
xor dl, 0xec
add dl, byte [0x1404e0198]
cmp al, dl
jne 0x1401689a0
lea rax, [0x1404df770]
ret
movzx eax, byte [0x1404df961]
cmp al, 0x70
je 0x1401689f4
mov cl, 0x34
nop word cs:[rax + rax]
mov al, 0xcd
lock cmpxchg byte [0x1404df961], cl
je 0x140168acc
cmp al, 0x70
jne 0x1401689e0
lea rax, [0x1404df950]
ret
xor eax, eax
lea rcx, [0x1404df790]
lea rdx, [0x140403d90]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140168a38
inc rax
jmp 0x140168a10
mov al, 0x13
xchg byte [0x1404df79d], al
lea rax, [0x1404df790]
ret
xor eax, eax
lea rcx, [0x1404df770]
lea rdx, [0x140403d70]
xor r8d, 0xf0faeeda
nop
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1404e0188]
mov r11d, r8d
xor r11d, r10d
and r10d, r8d
lea r10d, [r11 + r10*2]
cmp r9d, r10d
jge 0x140168a8b
inc rax
jmp 0x140168a60
mov al, 0xfa
xchg byte [0x1404df77f], al
lea rax, [0x1404df770]
ret
xor eax, eax
lea rcx, [0x1404df8e0]
lea rdx, [0x140403ee0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140168b47
inc rax
jmp 0x140168ab0
xor r9d, r9d
lea rax, [0x1404df950]
lea rcx, [0x140403f50]
mov edx, r8d
xor edx, 0xf0faeee8
nop word cs:[rax + rax]
movsxd r9, r9d
movzx r10d, byte [r9 + rcx]
add byte [r9 + rax], r10b
mov r10d, dword [0x1404e0188]
add r10d, edx
mov r11d, r9d
xor r11d, r10d
and r10d, r9d
lea r9d, [r11 + r10*2]
cmp r9d, 0x11
jl 0x140168af0
mov eax, r8d
not al
mov ecx, r8d
xor cl, 0x76
and cl, al
xor r8b, 0x89
and al, 0x76
or al, r8b
not al
or al, cl
add al, byte [0x1404e0198]
xchg byte [0x1404df961], al
lea rax, [0x1404df950]
ret
mov al, 0xac
xchg byte [0x1404df8ed], al
lea rax, [0x1404df8e0]
ret
Function at 0x140168c00
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x140168c3c
test edx, edx
je 0x140168ccc
movzx eax, byte [0x1404df9b2]
cmp al, 0x78
je 0x140168c34
mov cl, 0x33
nop
mov al, 0x6d
lock cmpxchg byte [0x1404df9b2], cl
je 0x140168cf8
cmp al, 0x78
jne 0x140168c20
lea rax, [0x1404df9a0]
ret
movzx eax, byte [0x1404df99d]
nop word cs:[rax + rax]
cmp al, 0x7b
je 0x140168d5a
movzx ecx, byte [0x1404e0198]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0x8b
mov eax, r8d
and al, 0x74
or al, r9b
mov r9d, eax
xor r9b, cl
and al, cl
add al, al
add al, r9b
and dl, 0x4a
mov r9d, r8d
and r9b, 0xb5
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x1404df99d], r9b
jne 0x140168c50
xor eax, eax
lea rcx, [0x1404df990]
lea rdx, [0x140403f90]
nop dword [rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xc
jg 0x140168d49
inc rax
jmp 0x140168cb0
movzx eax, byte [0x1404df763]
cmp al, 0x48
je 0x140168cf0
mov cl, 0x25
nop dword [rax]
mov al, 0x3d
lock cmpxchg byte [0x1404df763], cl
je 0x140168d62
cmp al, 0x48
jne 0x140168ce0
lea rax, [0x1404df740]
ret
xor edx, edx
lea rax, [0x1404df9a0]
lea rcx, [0x140403fa0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
cmp edx, 0x12
jl 0x140168d10
xor r8b, 0xfc
add r8b, byte [0x1404e0198]
xchg byte [0x1404df9b2], r8b
lea rax, [0x1404df9a0]
ret
not r8b
add r8b, byte [0x1404e0198]
xchg byte [0x1404df99d], r8b
lea rax, [0x1404df990]
ret
xor eax, eax
lea rcx, [0x1404df740]
lea rdx, [0x140403d40]
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0x22
jg 0x140168d98
inc rax
jmp 0x140168d80
xor r8b, 0x8c
add r8b, byte [0x1404e0198]
xchg byte [0x1404df763], r8b
lea rax, [0x1404df740]
ret
Function at 0x140174b20
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x348
mov rsi, r8
mov rdi, rcx
lea rcx, [rsp + 0x20]
call fcn.1401753f0
mov rcx, qword [rdi + 0x38]
mov rdx, qword [rcx + 8]
cmp byte [rdx + 0x19], 0
mov rax, rcx
jne 0x140174b92
mov r8, qword [rsp + 0x38]
mov rax, rcx
nop word cs:[rax + rax]
cmp qword [rdx + 0x38], r8
cmovae rax, rdx
lea r9, [rdx + 0x10]
cmovae r9, rdx
mov rdx, qword [r9]
movzx r9d, byte [0x1404e1360]
mov r10d, r9d
xor r10b, 0xed
and r9b, 0x6d
add r9b, r9b
add r9b, r10b
cmp byte [rdx + 0x19], r9b
je 0x140174b60
cmp byte [rax + 0x19], 0
je 0x140174be3
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rcx + 8]
movzx r8d, byte [0x1404e1360]
add r8b, 0xed
mov rax, rcx
cmp byte [rdx + 0x19], r8b
jne 0x140174bd9
mov r8, qword [rsp + 0x38]
mov rax, rcx
nop dword [rax]
lea r9, [rdx + 0x10]
cmp qword [rdx + 0x38], r8
cmovae rax, rdx
cmovae r9, rdx
mov rdx, qword [r9]
cmp byte [rdx + 0x19], 0
je 0x140174bc0
cmp byte [rax + 0x19], 0
je 0x140174bf5
xor edi, edi
jmp 0x140174c11
mov rdx, qword [rsp + 0x38]
cmp rdx, qword [rax + 0x38]
jb 0x140174b98
cmp rax, rcx
jne 0x140174c07
jmp 0x140174b98
mov rdx, qword [rsp + 0x38]
xor edi, edi
cmp rdx, qword [rax + 0x38]
jb 0x140174c11
cmp rax, rcx
je 0x140174c11
add rax, 0x20
mov qword [rsi], rax
mov dil, 1
lea rcx, [rsp + 0x20]
call fcn.140174260
mov eax, edi
add rsp, 0x348
pop rdi
pop rsi
ret
Function at 0x14017b4b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0xd7a3e98a
test ecx, ecx
je 0x14017b4ec
add eax, dword [0x1404e1364]
cmp edx, eax
jne 0x14017b52c
movzx eax, byte [0x1404e088d]
cmp al, 0x5b
je 0x14017b4e4
mov cl, 0xfa
mov al, 0x16
lock cmpxchg byte [0x1404e088d], cl
je 0x14017b5c8
cmp al, 0x5b
jne 0x14017b4d0
lea rax, [0x1404e0880]
ret
add eax, dword [0x1404e1364]
cmp edx, eax
jne 0x14017b5a1
movzx eax, byte [0x1404e087d]
cmp al, 0x89
je 0x14017b524
mov cl, 0xbf
nop word [rax + rax]
mov al, 0xf0
lock cmpxchg byte [0x1404e087d], cl
je 0x14017b608
cmp al, 0x89
jne 0x14017b510
lea rax, [0x1404e0870]
ret
movzx eax, byte [0x1404e07ae]
nop word cs:[rax + rax]
cmp al, 0x63
je 0x14017b599
movzx ecx, byte [0x1404e1360]
lea eax, [rcx + 0x51]
add cl, 8
lock cmpxchg byte [0x1404e07ae], cl
jne 0x14017b540
xor edx, edx
lea rax, [0x1404e07a0]
lea rcx, [0x140404430]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1404e1364]
add edx, r8d
add edx, 0xd7a3e98b
cmp edx, 0xe
jl 0x14017b570
mov al, 0x63
xchg byte [0x1404e07ae], al
lea rax, [0x1404e07a0]
ret
movzx eax, byte [0x1404e057d]
cmp al, 0xd0
je 0x14017b5c0
mov cl, 0xc0
nop
mov al, 0xd4
lock cmpxchg byte [0x1404e057d], cl
je 0x14017b638
cmp al, 0xd0
jne 0x14017b5b0
lea rax, [0x1404e0540]
ret
xor eax, eax
lea rcx, [0x1404e0880]
lea rdx, [0x140404510]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14017b5f8
inc rax
jmp 0x14017b5e0
mov al, 0x5b
xchg byte [0x1404e088d], al
lea rax, [0x1404e0880]
ret
xor eax, eax
lea rcx, [0x1404e0870]
lea rdx, [0x140404500]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14017b668
inc rax
jmp 0x14017b620
xor eax, eax
lea rcx, [0x1404e0540]
lea rdx, [0x1404041f0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x3c
jg 0x14017b678
inc rax
jmp 0x14017b650
mov al, 0x89
xchg byte [0x1404e087d], al
lea rax, [0x1404e0870]
ret
mov al, 0xd0
xchg byte [0x1404e057d], al
lea rax, [0x1404e0540]
ret