joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14020b960
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14020b99c
test edx, edx
je 0x14020b9dc
movzx eax, byte [0x14054e561]
cmp al, 0x19
je 0x14020b994
mov cl, 0x2e
nop word [rax + rax]
mov al, 0x25
lock cmpxchg byte [0x14054e561], cl
je 0x14020ba7c
cmp al, 0x19
jne 0x14020b980
lea rax, [0x14054e550]
ret
test edx, edx
je 0x14020ba4c
movzx eax, byte [0x14054e0c3]
cmp al, 0x8c
je 0x14020b9d4
mov cl, 0x85
nop word cs:[rax + rax]
mov al, 0xb5
lock cmpxchg byte [0x14054e0c3], cl
je 0x14020bad8
cmp al, 0x8c
jne 0x14020b9c0
lea rax, [0x14054e0c0]
ret
movzx eax, byte [0x14054e610]
nop word cs:[rax + rax]
cmp al, 0xff
je 0x14020bad0
movzx ecx, byte [0x14054f308]
mov eax, r8d
xor al, 0x37
add al, cl
mov edx, r8d
xor dl, 0x35
add dl, cl
lock cmpxchg byte [0x14054e610], dl
jne 0x14020b9f0
xor eax, eax
lea rcx, [0x14054e600]
lea rdx, [0x140465fe0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x14020bac8
inc rax
jmp 0x14020ba30
movzx eax, byte [0x14054e6fd]
cmp al, 0x57
je 0x14020ba74
mov cl, 0x99
nop dword [rax]
mov al, 0xea
lock cmpxchg byte [0x14054e6fd], cl
je 0x14020bb18
cmp al, 0x57
jne 0x14020ba60
lea rax, [0x14054e6f0]
ret
xor eax, eax
lea rcx, [0x14054e550]
lea rdx, [0x140465f30]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x14020bab8
inc rax
jmp 0x14020ba90
mov al, 0x19
xchg byte [0x14054e561], al
lea rax, [0x14054e550]
ret
mov al, 0xff
xchg byte [0x14054e610], al
lea rax, [0x14054e600]
ret
xor eax, eax
lea rcx, [0x14054e0c0]
lea rdx, [0x140465ac0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x14020bb08
inc rax
jmp 0x14020baf0
mov al, 0x8c
xchg byte [0x14054e0c3], al
lea rax, [0x14054e0c0]
ret
xor eax, eax
lea rcx, [0x14054e6f0]
lea rdx, [0x1404660c0]
xor r8d, 0x4186bf07
nop
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x14054f300]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 0xd
jl 0x14020bb30
mov al, 0x57
xchg byte [0x14054e6fd], al
lea rax, [0x14054e6f0]
ret
Function at 0x1402605e0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140260636
mov eax, dword [0x14055acb8]
mov ecx, eax
xor ecx, 0x22932e3a
and eax, 0x22932e3a
lea eax, [rcx + rax*2]
cmp edx, eax
jne 0x140260676
movzx eax, byte [0x14055a9f4]
cmp al, 0x60
je 0x14026062e
mov cl, 0x20
nop dword [rax + rax]
mov al, 0x5b
lock cmpxchg byte [0x14055a9f4], cl
je 0x140260736
movzx edx, byte [0x14055acbc]
add dl, 0xae
cmp al, dl
jne 0x140260610
lea rax, [0x14055a9f0]
ret
test edx, edx
je 0x140260701
movzx eax, byte [0x14055ab5d]
cmp al, 0xde
je 0x14026066e
mov cl, 0x8f
nop dword [rax + rax]
mov al, 0xe
lock cmpxchg byte [0x14055ab5d], cl
je 0x140260788
movzx edx, byte [0x14055acbc]
add dl, 0x2c
cmp al, dl
jne 0x140260650
lea rax, [0x14055ab50]
ret
movzx eax, byte [0x14055ac6d]
nop dword [rax]
cmp al, 0xae
je 0x1402606f9
movzx ecx, byte [0x14055acbc]
lea eax, [rcx - 0x27]
add cl, 0xad
lock cmpxchg byte [0x14055ac6d], cl
jne 0x140260680
xor edx, edx
lea rax, [0x14055ac60]
lea rcx, [0x140469c50]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x14055acb8]
add edx, r8d
add edx, 0x22932e3b
cmp edx, 0xd
jl 0x1402606b0
movzx eax, byte [0x14055acbc]
mov ecx, eax
xor cl, 0xfc
and al, 0x7c
add al, al
add al, cl
xchg byte [0x14055ac6d], al
lea rax, [0x14055ac60]
ret
movzx eax, byte [0x14055aadf]
cmp al, 0xbd
je 0x14026072e
mov cl, 0x1a
nop
mov al, 0x44
lock cmpxchg byte [0x14055aadf], cl
je 0x1402607cf
movzx edx, byte [0x14055acbc]
add dl, 0xb
cmp al, dl
jne 0x140260710
lea rax, [0x14055aad0]
ret
xor eax, eax
lea rcx, [0x14055a9f0]
lea rdx, [0x140469a00]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x140260778
inc rax
jmp 0x140260750
mov al, 0x60
xchg byte [0x14055a9f4], al
lea rax, [0x14055a9f0]
ret
xor eax, eax
lea rcx, [0x14055ab50]
lea rdx, [0x140469b40]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1402607b8
inc rax
jmp 0x1402607a0
movzx eax, byte [0x14055acbc]
add al, 0x2c
xchg byte [0x14055ab5d], al
lea rax, [0x14055ab50]
ret
xor eax, eax
lea rcx, [0x14055aad0]
lea rdx, [0x140469ac0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1402607f8
inc rax
jmp 0x1402607e0
mov al, 0xbd
xchg byte [0x14055aadf], al
lea rax, [0x14055aad0]
ret
Function at 0x140260870
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x1402608a9
test edx, edx
je 0x1402608f9
movzx eax, byte [0x14055ab6c]
cmp al, 0x20
je 0x1402609d0
mov cl, 0x4c
nop
mov al, 0x19
lock cmpxchg byte [0x14055ab6c], cl
je 0x140260995
cmp al, 0x20
jne 0x140260890
jmp 0x1402609d0
mov eax, r8d
xor eax, 0x3e4b9f70
add eax, dword [0x14055acb8]
cmp edx, eax
jne 0x140260955
movzx eax, byte [0x14055aac3]
mov ecx, r8d
xor cl, 0xb7
add cl, byte [0x14055acbc]
cmp al, cl
je 0x140260af0
mov cl, 0x99
nop dword [rax]
mov al, 0x22
lock cmpxchg byte [0x14055aac3], cl
je 0x140260a4d
cmp al, 0xaf
jne 0x1402608e0
jmp 0x140260af0
movzx eax, byte [0x14055abaf]
movzx ecx, byte [0x14055acbc]
mov edx, r8d
xor dl, 0x69
mov r9d, edx
xor r9b, cl
and dl, cl
add dl, dl
add dl, r9b
cmp al, dl
je 0x140260a44
mov cl, 0x54
nop word cs:[rax + rax]
mov al, 0xf8
lock cmpxchg byte [0x14055abaf], cl
je 0x1402609d9
mov edx, r8d
xor dl, 0x69
add dl, byte [0x14055acbc]
cmp al, dl
jne 0x140260930
jmp 0x140260a44
movzx eax, byte [0x14055abbd]
cmp al, 0xe2
je 0x140260adf
mov cl, 0x53
nop word cs:[rax + rax]
mov al, 0x22
lock cmpxchg byte [0x14055abbd], cl
je 0x140260a91
mov edx, r8d
xor dl, 0x7a
add dl, byte [0x14055acbc]
cmp al, dl
jne 0x140260970
jmp 0x140260adf
xor eax, eax
lea rcx, [0x14055ab60]
lea rdx, [0x140469b50]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x1402609c8
inc rax
jmp 0x1402609b0
mov al, 0x20
xchg byte [0x14055ab6c], al
lea rax, [0x14055ab60]
pop rsi
ret
xor r9d, r9d
lea rax, [0x14055aba0]
lea rcx, [0x140469b90]
mov edx, r8d
xor edx, 0x3e4b9f71
xor r8d, 0x3e4b9f03
nop word [rax + rax]
movsxd r9, r9d
movzx r10d, byte [r9 + rcx]
mov r11d, r10d
xor r11b, r10b
not r11b
and r11b, byte [r9 + rax]
xor r11b, r10b
mov byte [r9 + rax], r11b
mov r10d, dword [0x14055acb8]
lea r11d, [rdx + r10]
mov esi, r9d
xor esi, r11d
and r9d, r11d
lea r9d, [rsi + r9*2]
add r10d, r8d
cmp r9d, r10d
jl 0x140260a00
mov al, 0xd5
xchg byte [0x14055abaf], al
lea rax, [0x14055aba0]
pop rsi
ret
xor eax, eax
lea rcx, [0x14055aaa0]
lea rdx, [0x140469a90]
xor r8d, 0x3e4b9f17
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14055acb8]
add r10d, r8d
cmp r9d, r10d
jge 0x140260ae8
inc rax
jmp 0x140260a70
xor eax, eax
lea rcx, [0x14055abb0]
lea rdx, [0x140469ba0]
xor r8d, 0x3e4b9f71
nop dword [rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x14055acb8]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 0xd
jl 0x140260ab0
mov al, 0xe2
xchg byte [0x14055abbd], al
lea rax, [0x14055abb0]
pop rsi
ret
mov al, 0xaf
xchg byte [0x14055aac3], al
lea rax, [0x14055aaa0]
pop rsi
ret
Function at 0x140267090
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14055c808]
movabs rcx, 0xf9a35477669cfa31
movabs rdx, 0xf3133d3fd397e6b7
add rdx, rcx
movabs r8, 0x9bbdac2fa780a04c
sub rdx, r8
sub rdx, rcx
mov rcx, rdx
xor rcx, rax
and rdx, rax
lea rax, [rcx + rdx*2]
add rax, r8
cmp qword [rbx + 0x18], rax
je 0x14026726d
lea rdi, [rbx + 8]
cmp byte [0x1405a7ec1], 0
jne 0x140267150
mov eax, 0xffff62cd
add eax, dword [0x14055b234]
cdqe
add rax, qword [0x14055b240]
mov rcx, rbx
call qword [case.0x1401238cb.0]
mov ecx, eax
mov edx, dword [0x1405a7eb8]
lea eax, [rdx - 1]
imul eax, edx
mov r8d, dword [0x14055c800]
mov edx, r8d
xor edx, 0x4aefac7c
mov r9d, r8d
and r9d, 0x4aefac7c
lea r9d, [rdx + r9*2]
xor edx, edx
div r9d
add r8d, 0x4aefac7a
cmp edx, r8d
je 0x140267196
nop
mov eax, 0x809adc47
sub eax, dword [0x14055b234]
mov ecx, eax
xor ecx, 0x7f65c0ec
and eax, 0x7f65c0ec
lea eax, [rcx + rax*2]
mov ecx, dword [0x14055c800]
neg eax
add eax, ecx
add eax, 0x4aefac7a
cdqe
add rax, qword [0x14055b240]
mov rcx, rbx
call qword [case.0x1401238cb.0]
test rbx, rbx
je 0x140267150
jmp 0x1402670f4
test cl, cl
je 0x1402671b0
mov eax, 0xffff62cd
add eax, dword [0x14055b230]
cdqe
add rax, qword [0x14055b250]
jmp 0x1402671ca
mov eax, dword [0x14055b238]
sub eax, dword [0x14055c800]
add eax, 0xb50fb653
cdqe
add rax, qword [0x14055b258]
mov rcx, rsi
call qword [case.0x1401238cb.0]
mov r8, qword [rbx + 0x18]
cmp qword [rbx + 0x20], 0x10
jb 0x1402671e2
mov rdi, qword [rbx + 8]
lea rbx, [rsi + 8]
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x20]
mov rdx, rax
sub rdx, rcx
cmp rdx, r8
jae 0x140267223
mov eax, 0xffff62cd
add eax, dword [0x14055b23c]
cdqe
add rax, qword [0x14055b248]
mov qword [rsp + 0x20], r8
mov rcx, rbx
mov rdx, r8
mov r9, rdi
call qword [case.0x1401238cb.0]
jmp 0x14026726d
mov rdx, r8
not rdx
mov r9, rcx
xor r9, rdx
xor rdx, r8
and rdx, rcx
xor rdx, r8
and r9, rcx
movabs r10, 0x52d1ad84af96f83a
sub rdx, r10
lea r14, [rdx + r9*2]
add r14, r10
mov qword [rsi + 0x18], r14
cmp rax, 0x10
jb 0x14026725d
mov rbx, qword [rsi + 8]
add rcx, rbx
mov rdx, rdi
call fcn.140440940
mov byte [rbx + r14], 0
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14028e2f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x140561040]
mov r8d, eax
xor r8d, 0xc0bc3fff
and eax, 0x40bc3fff
lea eax, [r8 + rax*2]
cmp ecx, eax
jne 0x14028e34c
mov eax, 0xc0bc3fff
add eax, dword [0x140561040]
cmp edx, eax
jne 0x14028e378
movzx eax, byte [0x140560394]
cmp al, 0x53
je 0x14028e344
mov cl, 0x35
nop dword [rax]
mov al, 0xf
lock cmpxchg byte [0x140560394], cl
je 0x14028e44a
cmp al, 0x53
jne 0x14028e330
lea rax, [0x140560380]
ret
test edx, edx
je 0x14028e3ac
movzx eax, byte [0x1405603ba]
cmp al, 0x4b
je 0x14028e370
mov cl, 0x31
nop dword [rax]
mov al, pe_nt_image_headers64
lock cmpxchg byte [0x1405603ba], cl
je 0x14028e3dc
cmp al, 0x4b
jne 0x14028e360
lea rax, [0x1405603b0]
ret
movzx eax, byte [0x140560456]
movzx ecx, byte [0x140561050]
add cl, 0x12
cmp al, cl
je 0x14028e3a4
mov cl, 0xed
nop
mov al, 0xd2
lock cmpxchg byte [0x140560456], cl
je 0x14028e4ac
cmp al, 0x2d
jne 0x14028e390
lea rax, [0x140560440]
ret
movzx eax, byte [0x1405603a4]
cmp al, 0x64
je 0x14028e3d4
mov cl, 0x61
nop dword [rax]
mov al, 0x94
lock cmpxchg byte [0x1405603a4], cl
je 0x14028e4f5
cmp al, 0x64
jne 0x14028e3c0
lea rax, [0x1405603a0]
ret
xor eax, eax
lea rcx, [0x1405603b0]
lea rdx, [0x14046bae0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
mov r9d, dword [0x140561040]
mov r10d, r9d
xor r10d, 0x40ea7758
and r9d, 0x40ea7758
lea r9d, [r10 + r9*2]
add r9d, 0x7fd1c8b1
cmp r8d, r9d
jge 0x14028e43a
inc rax
jmp 0x14028e3f0
mov al, 0x4b
xchg byte [0x1405603ba], al
lea rax, [0x1405603b0]
ret
xor edx, edx
lea rax, [0x140560380]
lea rcx, [0x14046bab0]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x140561040]
mov r9d, edx
xor r9d, 0xb1744dd0
and edx, 0x31744dd0
lea edx, [r9 + rdx*2]
add edx, r8d
add edx, 0xf47f230
cmp edx, 0x14
jl 0x14028e460
movzx eax, byte [0x140561050]
add al, 0x38
xchg byte [0x140560394], al
lea rax, [0x140560380]
ret
xor edx, edx
lea rax, [0x140560440]
lea rcx, [0x14046bb60]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0x7ffffffe
and r8d, edx
xor edx, 1
lea edx, [rdx + r8*2]
cmp edx, 0x16
jl 0x14028e4c0
mov al, 0x2d
xchg byte [0x140560456], al
lea rax, [0x140560440]
ret
xor eax, eax
lea rcx, [0x1405603a0]
lea rdx, [0x14046bad0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x14028e528
inc rax
jmp 0x14028e510
movzx eax, byte [0x140561050]
mov ecx, eax
xor cl, 0x49
and al, 0x49
add al, al
add al, cl
xchg byte [0x1405603a4], al
lea rax, [0x1405603a0]
ret
Function at 0x1402c72d0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1402c730c
test edx, edx
je 0x1402c738f
movzx eax, byte [0x14056b2f3]
cmp al, 0x94
je 0x1402c7304
mov cl, 0x2e
nop
mov al, 0x21
lock cmpxchg byte [0x14056b2f3], cl
je 0x1402c740c
cmp al, 0x94
jne 0x1402c72f0
lea rax, [0x14056b2d0]
ret
test edx, edx
je 0x1402c73bc
movzx eax, byte [0x14056b180]
nop dword [rax + rax]
cmp al, 3
je 0x1402c746f
movzx ecx, byte [0x14056b32c]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0x97
mov eax, r8d
and al, 0x68
or al, r9b
add al, cl
and dl, 0x5e
mov r9d, r8d
and r9b, 0xa1
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x14056b180], r9b
jne 0x1402c7320
xor eax, eax
lea rcx, [0x14056b080]
lea rdx, [0x140472120]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xff
jg 0x1402c7467
inc rax
jmp 0x1402c7370
movzx eax, byte [0x14056b30f]
cmp al, 0x83
je 0x1402c73b4
mov cl, 0x85
nop dword [rax]
mov al, 0x20
lock cmpxchg byte [0x14056b30f], cl
je 0x1402c7477
cmp al, 0x83
jne 0x1402c73a0
lea rax, [0x14056b300]
ret
movzx eax, byte [0x14056b1ae]
cmp al, 0x3b
je 0x1402c7404
nop word [rax + rax]
movzx ecx, byte [0x14056b32c]
mov eax, r8d
xor al, 0xf3
add al, cl
mov edx, r8d
xor dl, 0xf6
add dl, cl
lock cmpxchg byte [0x14056b1ae], dl
je 0x1402c74db
mov ecx, r8d
xor cl, 0x9b
add cl, byte [0x14056b32c]
cmp al, cl
jne 0x1402c73d0
lea rax, [0x14056b190]
ret
xor eax, eax
lea rcx, [0x14056b2d0]
lea rdx, [0x140472350]
nop dword [rax]
xor r8d, r8d
sub r8b, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
xor r10d, r10d
sub r10b, r9b
mov r9d, r8d
xor r9b, r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
neg r10b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1402c7457
inc rax
jmp 0x1402c7420
mov al, 0x94
xchg byte [0x14056b2f3], al
lea rax, [0x14056b2d0]
ret
mov al, 3
xchg byte [0x14056b180], al
lea rax, [0x14056b080]
ret
xor eax, eax
lea rcx, [0x14056b300]
lea rdx, [0x140472380]
mov r9d, r8d
xor r9d, 0xbb7172c0
nop word cs:[rax + rax]
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x14056b328]
add r11d, r9d
cmp r10d, r11d
jge 0x1402c74c1
inc rax
jmp 0x1402c74a0
xor r8b, 0x53
add r8b, byte [0x14056b32c]
xchg byte [0x14056b30f], r8b
lea rax, [0x14056b300]
ret
xor eax, eax
lea rcx, [0x14056b190]
lea rdx, [0x140472220]
xor r8d, 0xbb7172f2
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
mov r9d, dword [0x14056b328]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 0x1e
jl 0x1402c7500
mov al, 0x3b
xchg byte [0x14056b1ae], al
lea rax, [0x14056b190]
ret
Function at 0x1402dab00
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rcx
mov eax, dword [0x1405a8d6c]
cmp eax, 0x5f
jg 0x1402dab30
mov eax, dword [0x1405a8d6c]
cmp eax, 0x5b
jl 0x1402dab3d
nop word cs:[rax + rax]
mov eax, dword [0x1405a8d6c]
cmp eax, 0x4f
jge 0x1402dab30
jmp 0x1402dab18
mov esi, 0xfffffffe
test rdi, rdi
je 0x1402dad26
cmp qword [rdi + 0x30], 0
je 0x1402dad26
cmp qword [rdi + 0x38], 0
je 0x1402dad26
mov r14, qword [rdi + 0x28]
test r14, r14
je 0x1402dad26
cmp qword [r14], rdi
jne 0x1402dad26
mov eax, dword [0x1405a8d68]
mov ecx, dword [0x14056ef28]
not ecx
add ecx, eax
add ecx, 0x13c7bc34
imul ecx, eax
test cl, 1
jne 0x1402dabc2
mov ecx, dword [r14 + 8]
mov r8d, dword [0x1405a7280]
mov edx, dword [0x1405a8d68]
lea eax, [rdx - 1]
imul eax, edx
mov r9d, 0x8d784e6a
add r9d, dword [0x14056ef28]
xor edx, edx
div r9d
test edx, edx
je 0x1402dabf0
lea rbx, [0x1402e5370]
mov bpl, 1
nop dword [rax]
mov ecx, 0x3d
call fcn.1403f8a54
mov qword [0x1405a8d60], rax
mov rcx, rbx
call fcn.140418e40
test bpl, bpl
je 0x1402dabd0
jmp 0x1402dab95
lea eax, [r8 + rcx]
add eax, 0xffffc0cc
cmp eax, 0x1f
ja 0x1402dad26
mov rax, qword [rdi + 0x28]
mov qword [rax + 0x34], 0
mov dword [rax + 0x3c], 0
cmp qword [rdi + 0x30], 0
je 0x1402dad26
cmp qword [rdi + 0x38], 0
je 0x1402dad26
mov rax, qword [rdi + 0x28]
test rax, rax
je 0x1402dad26
cmp qword [rax], rdi
jne 0x1402dad26
mov ecx, dword [rax + 8]
mov edx, dword [0x14056ef28]
add ecx, edx
add ecx, 0x8d780f34
cmp ecx, 0x20
setae cl
setb r8b
movzx edx, byte [0x1405a6d98]
mov r9d, edx
xor r9b, 1
mov r10d, r8d
xor r10b, r9b
test r10b, r8b
jne 0x1402dac82
and r9b, r8b
jne 0x1402dac82
and dl, cl
je 0x1402dad26
mov dword [rax + 0x24], 0
mov dword [rdi + 0x1c], 0
mov dword [rdi + 0xc], 0
mov qword [rdi + 0x20], 0
mov ecx, dword [rax + 0x10]
test ecx, ecx
je 0x1402dacc3
mov edx, 0x8d784e69
add edx, dword [0x14056ef28]
mov r8d, ecx
xor r8d, edx
or edx, ecx
not edx
or edx, r8d
not edx
mov dword [rdi + 0x4c], edx
mov qword [rax + 8], 0x3f34
movabs rcx, 0xffffffff00000000
mov qword [rax + 0x14], rcx
mov dword [rax + 0x1c], 0x8000
mov qword [rax + 0x28], 0
mov ecx, 0x8d784e68
add ecx, dword [0x14056ef28]
mov dword [rax + 0x48], ecx
mov dword [rax + 0x4c], 0
lea rcx, [rax + 0x550]
mov qword [rax + 0x88], rcx
mov qword [rax + 0x68], rcx
mov qword [rax + 0x60], rcx
movabs rcx, 0xffffffff00000001
mov qword [rax + 0x1be0], rcx
xor esi, esi
mov eax, dword [0x1405a8d68]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x1402dad40
mov al, 1
test al, al
jne 0x1402dad63
nop dword [rax]
mov eax, dword [0x1405a8d6c]
mov ecx, dword [0x14056ef28]
mov edx, ecx
xor edx, 0x8d784ebc
and ecx, 0xd784ebc
lea ecx, [rdx + rcx*2]
cmp eax, ecx
jge 0x1402dad40
jmp 0x1402dad37
mov eax, esi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1403449e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x75af528
add eax, dword [0x140582400]
cmp ecx, eax
jne 0x140344a1c
test edx, edx
je 0x140344a4c
movzx eax, byte [0x1405815be]
cmp al, 0x20
je 0x140344a14
mov cl, 0xff
mov al, 0x38
lock cmpxchg byte [0x1405815be], cl
je 0x140344abc
cmp al, 0x20
jne 0x140344a00
lea rax, [0x1405815b0]
ret
test edx, edx
je 0x140344a80
movzx eax, byte [0x14058133d]
cmp al, 6
je 0x140344a44
mov cl, 0x39
nop dword [rax]
mov al, 0x43
lock cmpxchg byte [0x14058133d], cl
je 0x140344af8
cmp al, 6
jne 0x140344a30
lea rax, [0x140581320]
ret
movzx eax, byte [0x1405814b3]
cmp al, 0xd0
je 0x140344a78
mov cl, 0xe4
nop dword [rax]
mov al, 0xba
lock cmpxchg byte [0x1405814b3], cl
je 0x140344b48
cmp al, byte [0x140582404]
jne 0x140344a60
lea rax, [0x1405814b0]
ret
movzx eax, byte [0x140581599]
movzx ecx, byte [0x140582404]
add cl, 0xcb
cmp al, cl
je 0x140344ab4
mov cl, 0xcb
nop word [rax + rax]
mov al, 0x67
lock cmpxchg byte [0x140581599], cl
je 0x140344b91
cmp al, 0x9b
jne 0x140344aa0
lea rax, [0x140581590]
ret
xor eax, eax
lea rcx, [0x1405815b0]
lea rdx, [0x14047ff10]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x140344b28
inc rax
jmp 0x140344ad0
xor eax, eax
lea rcx, [0x140581320]
lea rdx, [0x14047fcb0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1c
jg 0x140344b38
inc rax
jmp 0x140344b10
mov al, 0x20
xchg byte [0x1405815be], al
lea rax, [0x1405815b0]
ret
mov al, 6
xchg byte [0x14058133d], al
lea rax, [0x140581320]
ret
xor edx, edx
lea rax, [0x1405814b0]
lea rcx, [0x14047fe20]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x140582400]
add edx, r8d
add edx, 0x75af529
cmp edx, 3
jl 0x140344b60
mov al, 0xd0
xchg byte [0x1405814b3], al
lea rax, [0x1405814b0]
ret
xor eax, eax
lea rcx, [0x140581590]
lea rdx, [0x14047fef0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x140344bd8
inc rax
jmp 0x140344bb0
mov al, 0x9b
xchg byte [0x140581599], al
lea rax, [0x140581590]
ret
Function at 0x140353630
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov r8d, dword [rsp + 0x40]
test ecx, ecx
je 0x140353679
test edx, edx
je 0x1403536b5
movzx eax, byte [0x1405844f9]
cmp al, 0x61
je 0x140353750
mov cl, 0x6e
nop word cs:[rax + rax]
mov al, 0x51
lock cmpxchg byte [0x1405844f9], cl
je 0x140353719
cmp al, 0x61
jne 0x140353660
jmp 0x140353750
test edx, edx
je 0x1403536e9
movzx eax, byte [0x140584472]
cmp al, 0xc4
je 0x14035380d
mov cl, 9
nop
mov al, 0x13
lock cmpxchg byte [0x140584472], cl
je 0x14035375c
mov edx, r8d
xor dl, 0x65
add dl, byte [0x140584b0c]
cmp al, dl
jne 0x140353690
jmp 0x14035380d
movzx eax, byte [0x140584430]
cmp al, 0x56
je 0x1403537fc
mov cl, 0x76
nop word cs:[rax + rax]
mov al, 0xf
lock cmpxchg byte [0x140584430], cl
je 0x14035378c
cmp al, 0x56
jne 0x1403536d0
jmp 0x1403537fc
movzx eax, byte [0x1405844d3]
cmp al, 0xa7
je 0x14035386d
mov cl, 0x9a
nop word [rax + rax]
mov al, 0xcf
lock cmpxchg byte [0x1405844d3], cl
je 0x140353816
cmp al, 0xa7
jne 0x140353700
jmp 0x14035386d
xor eax, eax
lea rcx, [0x1405844f0]
lea rdx, [0x140480340]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x140353748
inc rax
jmp 0x140353730
mov al, 0x61
xchg byte [0x1405844f9], al
lea rax, [0x1405844f0]
jmp 0x140353874
xor eax, eax
lea rcx, [0x140584460]
lea rdx, [0x1404802b0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x140353805
inc rax
jmp 0x140353770
xor r10d, r10d
lea rax, [0x140584420]
lea rcx, [0x140480280]
mov edx, r8d
xor edx, 0x2c28831a
mov r9d, r8d
xor r9d, 0x2c28830b
movsxd r10, r10d
movzx r11d, byte [r10 + rcx]
mov ebx, r11d
xor bl, r11b
not bl
and bl, byte [r10 + rax]
xor bl, r11b
mov byte [r10 + rax], bl
mov r11d, dword [0x140584b08]
lea esi, [rdx + r11]
mov edi, r10d
xor edi, esi
and r10d, esi
lea r10d, [rdi + r10*2]
add r11d, r9d
cmp r10d, r11d
jl 0x1403537b0
xor r8b, 0x17
add r8b, byte [0x140584b0c]
xchg byte [0x140584430], r8b
lea rax, [0x140584420]
jmp 0x140353874
mov al, 0xc4
xchg byte [0x140584472], al
lea rax, [0x140584460]
jmp 0x140353874
xor eax, eax
lea rcx, [0x1405844b0]
lea rdx, [0x140480300]
xor r8d, 0x2c28833c
nop dword [rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140584b08]
add r10d, r8d
cmp r9d, r10d
jge 0x140353865
inc rax
jmp 0x140353830
mov al, 0xa7
xchg byte [0x1405844d3], al
lea rax, [0x1405844b0]
pop rbx
pop rdi
pop rsi
ret