joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140138aa0
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x140138af8
test edx, edx
je 0x140138b2c
mov dword [0x14051d178], 0
movzx eax, byte [0x1404c6002]
cmp al, 0x9d
je 0x140138af0
mov cl, 0xfd
nop word cs:[rax + rax]
mov al, 0xa2
lock cmpxchg byte [0x1404c6002], cl
je 0x140138b8c
mov edx, r8d
xor dl, 0x2e
add dl, byte [0x1404c6604]
cmp al, dl
jne 0x140138ad0
lea rax, [0x1404c6000]
ret
test edx, edx
je 0x140138b5c
movzx eax, byte [0x1404c602f]
cmp al, 0x65
je 0x140138b24
mov cl, 0xfe
nop dword [rax]
mov al, 0xc8
lock cmpxchg byte [0x1404c602f], cl
je 0x140138bd8
cmp al, 0x65
jne 0x140138b10
lea rax, [0x1404c6020]
ret
movzx eax, byte [0x1404c6048]
cmp al, 0x6a
je 0x140138b54
mov cl, 0x18
nop dword [rax]
mov al, 0xd5
lock cmpxchg byte [0x1404c6048], cl
je 0x140138c18
cmp al, 0x6a
jne 0x140138b40
lea rax, [0x1404c6030]
ret
movzx eax, byte [0x1404c5fb7]
cmp al, 0xcc
je 0x140138b84
mov cl, 0x41
nop dword [rax]
mov al, 0xb7
lock cmpxchg byte [0x1404c5fb7], cl
je 0x140138c91
cmp al, 0xcc
jne 0x140138b70
lea rax, [0x1404c5fb0]
ret
xor eax, eax
lea rcx, [0x1404c6000]
lea rdx, [0x1403f0370]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x140138bc8
inc rax
jmp 0x140138ba0
mov al, 0x9d
xchg byte [0x1404c6002], al
lea rax, [0x1404c6000]
ret
xor eax, eax
lea rcx, [0x1404c6020]
lea rdx, [0x1403f0390]
nop dword [rax + rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
cmp r9d, 0xe
jg 0x140138c77
inc rax
jmp 0x140138bf0
xor edx, edx
lea rax, [0x1404c6030]
lea rcx, [0x1403f03a0]
nop dword [rax + rax]
movsxd r9, edx
movzx edx, byte [r9 + rax]
movzx r10d, byte [r9 + rcx]
mov r11d, edx
xor r11b, r10b
and dl, r10b
add dl, dl
add dl, r11b
mov byte [r9 + rax], dl
lea edx, [r9 + r9]
sub edx, r9d
inc edx
cmp edx, 0x18
jl 0x140138c30
xor r8b, 0xe3
add r8b, byte [0x1404c6604]
xchg byte [0x1404c6048], r8b
lea rax, [0x1404c6030]
ret
xor r8b, 0xe6
add r8b, byte [0x1404c6604]
xchg byte [0x1404c602f], r8b
lea rax, [0x1404c6020]
ret
xor eax, eax
lea rcx, [0x1404c5fb0]
lea rdx, [0x1403f0320]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 6
jg 0x140138cd8
inc rax
jmp 0x140138cb0
mov al, 0xcc
xchg byte [0x1404c5fb7], al
lea rax, [0x1404c5fb0]
ret
Function at 0x140147ae0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x140147b1c
test edx, edx
je 0x140147b68
movzx eax, byte [0x1404c808b]
cmp al, 0xb7
je 0x140147b14
mov cl, 0xee
nop word [rax + rax]
mov al, 0x85
lock cmpxchg byte [0x1404c808b], cl
je 0x140147c18
cmp al, 0xb7
jne 0x140147b00
lea rax, [0x1404c8080]
ret
test edx, edx
je 0x140147bdc
movzx eax, byte [0x1404c7ead]
cmp al, 0xf7
je 0x140147b60
mov cl, 0xda
nop word cs:[rax + rax]
mov al, 0xc3
lock cmpxchg byte [0x1404c7ead], cl
je 0x140147c6d
mov edx, r8d
xor dl, 0x2c
add dl, byte [0x1404c8634]
cmp al, dl
jne 0x140147b40
lea rax, [0x1404c7ea0]
ret
movzx eax, byte [0x1404c7dc0]
nop
cmp al, 0xa
je 0x140147cb0
movzx ecx, byte [0x1404c8634]
mov eax, r8d
xor al, 0xb1
add al, cl
mov edx, r8d
xor dl, 0x21
add dl, cl
lock cmpxchg byte [0x1404c7dc0], dl
jne 0x140147b70
xor eax, eax
lea rcx, [0x1404c7db0]
lea rdx, [0x1403f0bf0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140147ca8
inc rax
jmp 0x140147bb0
movzx eax, byte [0x1404c809f]
cmp al, 0xbe
je 0x140147c10
mov cl, 8
nop dword [rax]
mov al, 0xb4
lock cmpxchg byte [0x1404c809f], cl
je 0x140147cc8
mov edx, r8d
xor dl, 0xf5
add dl, byte [0x1404c8634]
cmp al, dl
jne 0x140147bf0
lea rax, [0x1404c8090]
ret
xor eax, eax
lea rcx, [0x1404c8080]
lea rdx, [0x1403f0eb0]
xor r8d, 0x7fa4f43d
nop
cdqe
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
mov r9d, dword [0x1404c8630]
add r9d, r8d
add eax, r9d
cmp eax, 0xb
jl 0x140147c30
mov al, 0xb7
xchg byte [0x1404c808b], al
lea rax, [0x1404c8080]
ret
xor eax, eax
lea rcx, [0x1404c7ea0]
lea rdx, [0x1403f0cd0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140147cb8
inc rax
jmp 0x140147c80
mov al, 0xa
xchg byte [0x1404c7dc0], al
lea rax, [0x1404c7db0]
ret
mov al, 0xf7
xchg byte [0x1404c7ead], al
lea rax, [0x1404c7ea0]
ret
xor edx, edx
lea rax, [0x1404c8090]
lea rcx, [0x1403f0ec0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x140147ce0
mov al, 0xbe
xchg byte [0x1404c809f], al
lea rax, [0x1404c8090]
ret
Function at 0x140147e00
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0x12c0c82a
mov r9d, dword [0x1404c8630]
add r9d, eax
cmp ecx, r9d
jne 0x140147e5c
test edx, edx
je 0x140147ecc
movzx eax, byte [0x1404c7fce]
cmp al, 0xd5
je 0x140147e54
mov cl, 0x5a
nop word cs:[rax + rax]
mov al, 0xf0
lock cmpxchg byte [0x1404c7fce], cl
je 0x140147f0c
cmp al, 0xd5
jne 0x140147e40
lea rax, [0x1404c7fc0]
ret
add eax, dword [0x1404c8630]
cmp edx, eax
jne 0x140147e9c
movzx eax, byte [0x1404c8013]
cmp al, 0xf3
je 0x140147e94
mov cl, 0xfe
nop word cs:[rax + rax]
mov al, 0xc1
lock cmpxchg byte [0x1404c8013], cl
je 0x140147f48
cmp al, 0xf3
jne 0x140147e80
lea rax, [0x1404c8000]
ret
movzx eax, byte [0x1404c7e8f]
cmp al, 0x7a
je 0x140147ec4
mov cl, 0x52
nop dword [rax]
mov al, 0x75
lock cmpxchg byte [0x1404c7e8f], cl
je 0x140147fa8
cmp al, 0x7a
jne 0x140147eb0
lea rax, [0x1404c7e80]
ret
movzx eax, byte [0x1404c8071]
xor r8b, 0xb5
add r8b, byte [0x1404c8634]
cmp al, r8b
je 0x140147f04
mov cl, 0xc
nop word cs:[rax + rax]
mov al, 0xfc
lock cmpxchg byte [0x1404c8071], cl
je 0x140147fe8
cmp al, 0x76
jne 0x140147ef0
lea rax, [0x1404c8060]
ret
xor eax, eax
lea rcx, [0x1404c7fc0]
lea rdx, [0x1403f0df0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x140147f38
inc rax
jmp 0x140147f20
mov al, 0xd5
xchg byte [0x1404c7fce], al
lea rax, [0x1404c7fc0]
ret
xor edx, edx
lea rax, [0x1404c8000]
lea rcx, [0x1403f0e30]
xor r8d, 0x12c0c825
nop
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rdx + rax]
xor r10b, r9b
mov byte [rdx + rax], r10b
mov r9d, dword [0x1404c8630]
add r9d, r8d
mov r10d, edx
xor r10d, r9d
and r9d, edx
lea edx, [r10 + r9*2]
cmp edx, 0x13
jl 0x140147f60
mov al, 0xf3
xchg byte [0x1404c8013], al
lea rax, [0x1404c8000]
ret
xor eax, eax
lea rcx, [0x1404c7e80]
lea rdx, [0x1403f0cb0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x140147fd8
inc rax
jmp 0x140147fc0
mov al, 0x7a
xchg byte [0x1404c7e8f], al
lea rax, [0x1404c7e80]
ret
xor eax, eax
lea rcx, [0x1404c8060]
lea rdx, [0x1403f0e90]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x140148018
inc rax
jmp 0x140148000
mov al, 0x76
xchg byte [0x1404c8071], al
lea rax, [0x1404c8060]
ret
Function at 0x140148070
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r8d, dword [rsp + 0x30]
mov eax, r8d
xor eax, 0xd74c6309
add eax, dword [0x1404c8630]
cmp ecx, eax
jne 0x140148145
movzx eax, byte [0x1404c7f7d]
movzx ecx, byte [0x1404c8634]
mov edx, r8d
xor dl, 0x76
add dl, 0x51
mov r9d, edx
xor r9b, cl
and dl, cl
add dl, dl
add dl, r9b
mov ecx, edx
xor cl, 0xaf
and dl, 0x2f
add dl, dl
add dl, cl
cmp al, dl
je 0x14014820e
nop word cs:[rax + rax]
movzx eax, byte [0x1404c8634]
mov edx, r8d
not dl
mov ecx, r8d
xor cl, 0xd
mov r9d, edx
and r9b, 0xf2
or cl, r9b
not cl
or cl, r9b
mov r9d, ecx
not r9b
mov r10d, r9d
and r10b, al
mov r11d, ecx
xor cl, al
and dl, 0xd1
mov ebx, r8d
and bl, 0x2e
or bl, dl
add bl, al
not al
and r11b, al
or r11b, r10b
and al, r9b
or al, cl
not al
add al, al
add al, r11b
add bl, 0x5b
mov ecx, ebx
xor cl, 0xa5
and bl, 0x25
add bl, bl
add bl, cl
lock cmpxchg byte [0x1404c7f7d], bl
je 0x1401481b5
cmp al, 0x16
jne 0x1401480d0
jmp 0x14014820e
test edx, edx
je 0x140148179
movzx eax, byte [0x1404c7e73]
cmp al, 0x52
je 0x140148250
mov cl, 0xa8
nop word [rax + rax]
mov al, 0xe
lock cmpxchg byte [0x1404c7e73], cl
je 0x140148217
cmp al, 0x52
jne 0x140148160
jmp 0x140148250
movzx eax, byte [0x1404c7e02]
cmp al, 0x6f
je 0x1401482a1
mov cl, 0xdf
nop word [rax + rax]
mov al, 0xe5
lock cmpxchg byte [0x1404c7e02], cl
je 0x140148259
mov edx, r8d
xor dl, 0x9f
add dl, byte [0x1404c8634]
cmp al, dl
jne 0x140148190
jmp 0x1401482a1
xor edx, edx
lea rax, [0x1404c7f70]
lea rcx, [0x1403f0da0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
not r8b
mov r10d, r8d
and r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x1401481d0
mov al, 0x16
xchg byte [0x1404c7f7d], al
lea rax, [0x1404c7f70]
pop rbx
ret
xor eax, eax
lea rcx, [0x1404c7e50]
lea rdx, [0x1403f0c80]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x140148248
inc rax
jmp 0x140148230
mov al, 0x52
xchg byte [0x1404c7e73], al
lea rax, [0x1404c7e50]
pop rbx
ret
xor edx, edx
lea rax, [0x1404c7df0]
lea rcx, [0x1403f0c20]
xor r8d, 0xd74c6377
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
mov r9d, dword [0x1404c8630]
add r9d, r8d
cmp edx, r9d
jl 0x140148270
mov al, 0x6f
xchg byte [0x1404c7e02], al
lea rax, [0x1404c7df0]
pop rbx
ret
Function at 0x140148330
Capabilities:
Encode data using xor

Disassembly:
push rsi
test ecx, ecx
je 0x140148369
test edx, edx
je 0x140148399
movzx eax, byte [0x1404c7ffd]
cmp al, 0x71
je 0x14014845d
mov cl, 0x24
nop word [rax + rax]
mov al, 0x70
lock cmpxchg byte [0x1404c7ffd], cl
je 0x140148409
cmp al, 0x71
jne 0x140148350
jmp 0x14014845d
test edx, edx
je 0x1401483d8
movzx eax, byte [0x1404c7f32]
cmp al, 0xc2
je 0x1401484a7
mov cl, 0xa3
nop
mov al, 0x99
lock cmpxchg byte [0x1404c7f32], cl
je 0x140148466
cmp al, 0xc2
jne 0x140148380
jmp 0x1401484a7
movzx eax, byte [0x1404c7ecd]
cmp al, 0xe4
je 0x140148511
mov ecx, dword [rsp + 0x30]
mov dl, 0x81
nop
mov al, 0xc1
lock cmpxchg byte [0x1404c7ecd], dl
je 0x1401484b0
mov r8d, ecx
xor r8b, 0xd7
add r8b, byte [0x1404c8634]
cmp al, r8b
jne 0x1401483b0
jmp 0x140148511
movzx eax, byte [0x1404c80f1]
cmp al, 0x6b
je 0x140148550
mov cl, 0x86
nop dword [rax]
mov al, 0xbe
lock cmpxchg byte [0x1404c80f1], cl
je 0x14014851a
cmp al, 0x6b
jne 0x1401483f0
jmp 0x140148550
xor eax, eax
lea rcx, [0x1404c7ff0]
lea rdx, [0x1403f0e20]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
not r10b
mov r11d, r8d
xor r11b, r10b
not r11b
and r11b, r9b
and r10b, r8b
or r10b, r11b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140148455
inc rax
jmp 0x140148420
mov al, 0x71
xchg byte [0x1404c7ffd], al
lea rax, [0x1404c7ff0]
pop rsi
ret
xor edx, edx
lea rax, [0x1404c7f20]
lea rcx, [0x1403f0d50]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x12
jl 0x140148480
mov al, 0xc2
xchg byte [0x1404c7f32], al
lea rax, [0x1404c7f20]
pop rsi
ret
xor eax, eax
lea rdx, [0x1404c7ec0]
lea r8, [0x1403f0cf0]
mov r9d, ecx
xor r9d, 0x54deac7a
nop word [rax + rax]
movzx r10d, byte [rax + r8]
xor byte [rax + rdx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x1404c8630]
mov esi, ecx
xor esi, r11d
xor esi, 0xab215385
not r11d
and r11d, r9d
or r11d, esi
not r11d
lea r11d, [rsi + r11*2]
cmp r10d, r11d
jge 0x140148509
inc rax
jmp 0x1401484d0
mov al, 0xe4
xchg byte [0x1404c7ecd], al
lea rax, [0x1404c7ec0]
pop rsi
ret
xor eax, eax
lea rcx, [0x1404c80e0]
lea rdx, [0x1403f0f10]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x140148548
inc rax
jmp 0x140148530
mov al, 0x6b
xchg byte [0x1404c80f1], al
lea rax, [0x1404c80e0]
pop rsi
ret
Function at 0x140148680
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov r9d, dword [0x1404c8630]
mov eax, r8d
xor eax, 0xbbb8a907
mov r10d, eax
xor r10d, r9d
and r9d, eax
lea r9d, [r10 + r9*2]
cmp ecx, r9d
jne 0x1401486ec
add eax, dword [0x1404c8630]
cmp edx, eax
jne 0x14014872c
movzx eax, byte [0x1404c7fbd]
xor r8b, 0x92
add r8b, byte [0x1404c8634]
cmp al, r8b
je 0x1401486e4
mov cl, 0xdb
nop dword [rax]
mov al, 0x5a
lock cmpxchg byte [0x1404c7fbd], cl
je 0x14014878c
cmp al, 0x70
jne 0x1401486d0
lea rax, [0x1404c7fb0]
ret
add eax, dword [0x1404c8630]
cmp edx, eax
jne 0x14014875c
movzx eax, byte [0x1404c7f1d]
xor r8b, 0xb5
add r8b, byte [0x1404c8634]
cmp al, r8b
je 0x140148724
mov cl, 0x78
nop
mov al, 0xb7
lock cmpxchg byte [0x1404c7f1d], cl
je 0x1401487cc
cmp al, 0x53
jne 0x140148710
lea rax, [0x1404c7f10]
ret
movzx eax, byte [0x1404c80c2]
cmp al, 0xc9
je 0x140148754
mov cl, 0x86
nop dword [rax]
mov al, 0x99
lock cmpxchg byte [0x1404c80c2], cl
je 0x1401487fc
cmp al, 0xc9
jne 0x140148740
lea rax, [0x1404c80b0]
ret
movzx eax, byte [0x1404c7fdd]
cmp al, 0xaa
je 0x140148784
mov cl, 0xb9
nop dword [rax]
mov al, 0xd9
lock cmpxchg byte [0x1404c7fdd], cl
je 0x14014884d
cmp al, 0xaa
jne 0x140148770
lea rax, [0x1404c7fd0]
ret
xor eax, eax
lea rcx, [0x1404c7fb0]
lea rdx, [0x1403f0de0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140148878
inc rax
jmp 0x1401487a0
xor eax, eax
lea rcx, [0x1404c7f10]
lea rdx, [0x1403f0d40]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140148888
inc rax
jmp 0x1401487e0
xor eax, eax
lea rcx, [0x1404c80b0]
lea rdx, [0x1403f0ee0]
xor r8d, 0xbbb8a908
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x1404c8630]
add r9d, r8d
add eax, r9d
cmp eax, 0x12
jl 0x140148820
mov al, 0xc9
xchg byte [0x1404c80c2], al
lea rax, [0x1404c80b0]
ret
xor eax, eax
lea rcx, [0x1404c7fd0]
lea rdx, [0x1403f0e00]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140148898
inc rax
jmp 0x140148860
mov al, 0x70
xchg byte [0x1404c7fbd], al
lea rax, [0x1404c7fb0]
ret
mov al, 0x53
xchg byte [0x1404c7f1d], al
lea rax, [0x1404c7f10]
ret
mov al, 0xaa
xchg byte [0x1404c7fdd], al
lea rax, [0x1404c7fd0]
ret
Function at 0x140148950
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0x50c5adff
add eax, dword [0x1404c8630]
cmp ecx, eax
jne 0x14014899c
test edx, edx
je 0x1401489cc
movzx eax, byte [0x1404c80ad]
cmp al, 0xfe
je 0x140148994
xor ecx, ecx
nop dword [rax + rax]
mov al, 2
lock cmpxchg byte [0x1404c80ad], cl
je 0x140148a90
cmp al, 0xfe
jne 0x140148980
lea rax, [0x1404c80a0]
ret
test edx, edx
je 0x1401489fc
movzx eax, byte [0x1404c7f8a]
cmp al, 0xb4
je 0x1401489c4
mov cl, 5
nop dword [rax]
mov al, 0x33
lock cmpxchg byte [0x1404c7f8a], cl
je 0x140148acf
cmp al, 0xb4
jne 0x1401489b0
lea rax, [0x1404c7f80]
ret
movzx eax, byte [0x1404c7f6f]
cmp al, 0x1c
je 0x1401489f4
mov cl, 0xc6
nop dword [rax]
mov al, 0x10
lock cmpxchg byte [0x1404c7f6f], cl
je 0x140148b18
cmp al, 0x1c
jne 0x1401489e0
lea rax, [0x1404c7f50]
ret
movzx eax, byte [0x1404c7faf]
nop word cs:[rax + rax]
cmp al, 0xdd
je 0x140148a88
movzx ecx, byte [0x1404c8634]
mov eax, r8d
xor al, 0x5a
mov edx, eax
xor dl, cl
and al, cl
add al, al
add al, dl
mov edx, r8d
xor dl, 0xef
add dl, cl
lock cmpxchg byte [0x1404c7faf], dl
jne 0x140148a10
xor eax, eax
lea rcx, [0x1404c7fa0]
lea rdx, [0x1403f0dd0]
mov r9d, r8d
xor r9d, 0x50c5adf0
xor r8d, 0x50c5ad8e
nop dword [rax]
cdqe
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
mov r10d, dword [0x1404c8630]
add eax, r9d
add eax, r10d
add r10d, r8d
cmp eax, r10d
jl 0x140148a60
mov al, 0xdd
xchg byte [0x1404c7faf], al
lea rax, [0x1404c7fa0]
ret
xor edx, edx
lea rax, [0x1404c80a0]
lea rcx, [0x1403f0ed0]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x140148aa0
mov al, 0xfe
xchg byte [0x1404c80ad], al
lea rax, [0x1404c80a0]
ret
xor eax, eax
lea rcx, [0x1404c7f80]
lea rdx, [0x1403f0db0]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 9
jg 0x140148b08
inc rax
jmp 0x140148ae0
mov al, 0xb4
xchg byte [0x1404c7f8a], al
lea rax, [0x1404c7f80]
ret
xor eax, eax
lea rcx, [0x1404c7f50]
lea rdx, [0x1403f0d80]
nop dword [rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0x1e
jg 0x140148b48
inc rax
jmp 0x140148b30
movzx eax, byte [0x1404c8634]
xor r8b, 0x86
mov ecx, r8d
xor cl, al
and r8b, al
add r8b, r8b
add r8b, cl
xchg byte [0x1404c7f6f], r8b
lea rax, [0x1404c7f50]
ret
Function at 0x14015a340
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov r14, qword [rcx]
mov rcx, qword [r14]
cmp rcx, r14
je 0x14015a392
nop
cmp rbx, rdi
je 0x14015a43f
mov eax, dword [rbx + 0x18]
mov dword [rcx + 0x18], eax
mov rax, qword [rbx + 0x10]
mov qword [rcx + 0x10], rax
mov rbx, qword [rbx]
mov rcx, qword [rcx]
cmp rcx, r14
jne 0x14015a370
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], 0
cmp rbx, rdi
je 0x14015a4f5
mov ecx, 0x20
call fcn.1403a8a84
mov ecx, dword [rbx + 0x18]
mov dword [rax + 0x18], ecx
mov rcx, qword [rbx + 0x10]
mov qword [rax + 0x10], rcx
mov qword [rbp - 0x10], rax
nop word cs:[rax + rax]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x20]
inc rax
mov qword [rbp - 0x20], rax
mov rbx, qword [rbx]
cmp rbx, rdi
je 0x14015a410
mov ecx, 0x20
call fcn.1403a8a84
mov ecx, dword [rbx + 0x18]
mov dword [rax + 0x18], ecx
mov rcx, qword [rbx + 0x10]
mov qword [rax + 0x10], rcx
mov rcx, qword [rbp - 0x18]
mov qword [rcx], rax
mov rcx, qword [rbp - 0x18]
mov qword [rax + 8], rcx
jmp 0x14015a3d0
test rax, rax
je 0x14015a4a9
mov rcx, qword [rsi]
mov rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 0x10]
mov r9, qword [rcx + 8]
mov qword [r8 + 8], r9
mov qword [r9], r8
mov qword [rdx], rcx
mov qword [rcx + 8], rdx
add qword [rsi + 8], rax
jmp 0x14015a4f5
mov rax, qword [rcx + 8]
mov qword [rax], r14
mov qword [r14 + 8], rax
xor r15d, r15d
movabs rdi, 0x5ac7f302c6543c52
movabs rbx, 0xa5380cfd39abc3ae
nop word cs:[rax + rax]
mov r12, qword [rcx]
mov edx, 0x20
call fcn.1400a8a50
mov rax, r15
xor rax, rdi
and r15, rdi
lea rax, [rax + r15*2]
mov rcx, rax
xor rcx, 1
and eax, 1
lea r15, [rcx + rax*2]
add r15, rbx
mov rcx, r12
cmp r12, r14
jne 0x14015a470
sub qword [rsi + 8], r15
jmp 0x14015a4f5
movabs rax, 0x60691faff8fbcdba
add rax, qword [0x1404cb3f0]
cmp qword [rbp - 0x20], rax
je 0x14015a4f5
mov rax, qword [rbp - 0x10]
mov qword [rax + 8], 0
mov rax, qword [rbp - 0x18]
mov qword [rax], 0
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14015a4f5
mov rsi, qword [rcx]
mov edx, 0x20
call fcn.1400a8a50
mov rcx, rsi
test rsi, rsi
jne 0x14015a4e0
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
Function at 0x14017b730
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0xf5e79ab6
add eax, dword [0x1404cda48]
cmp ecx, eax
jne 0x14017b78c
test edx, edx
je 0x14017b7bc
movzx eax, byte [0x1404cd6bf]
xor r8b, 0x73
add r8b, byte [0x1404cda4c]
cmp al, r8b
je 0x14017b784
mov cl, 0x61
nop word cs:[rax + rax]
mov al, 0x71
lock cmpxchg byte [0x1404cd6bf], cl
je 0x14017b828
cmp al, 0x97
jne 0x14017b770
lea rax, [0x1404cd6b0]
ret
test edx, edx
je 0x14017b7ec
movzx eax, byte [0x1404cd72d]
cmp al, 0x6d
je 0x14017b7b4
mov cl, 0x47
nop dword [rax]
mov al, 0xa6
lock cmpxchg byte [0x1404cd72d], cl
je 0x14017b858
cmp al, 0x6d
jne 0x14017b7a0
lea rax, [0x1404cd720]
ret
movzx eax, byte [0x1404cd73b]
cmp al, 0xcd
je 0x14017b7e4
mov cl, 0x72
nop dword [rax]
mov al, 0x23
lock cmpxchg byte [0x1404cd73b], cl
je 0x14017b8ca
cmp al, 0xcd
jne 0x14017b7d0
lea rax, [0x1404cd730]
ret
movzx eax, byte [0x1404cd635]
cmp al, 0x52
je 0x14017b820
mov cl, 0x93
nop dword [rax]
mov al, 0x2c
lock cmpxchg byte [0x1404cd635], cl
je 0x14017b8f8
mov edx, r8d
xor dl, 0x3c
add dl, byte [0x1404cda4c]
cmp al, dl
jne 0x14017b800
lea rax, [0x1404cd620]
ret
xor eax, eax
lea rcx, [0x1404cd6b0]
lea rdx, [0x1403f1b40]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x14017b8ba
inc rax
jmp 0x14017b840
xor eax, eax
lea rcx, [0x1404cd720]
lea rdx, [0x1403f1bb0]
mov r9d, r8d
xor r9d, 0xf5e79aa9
mov r10d, r8d
xor r10d, 0xf5e79aa5
nop dword [rax]
cdqe
movzx r11d, byte [rax + rdx]
xor byte [rax + rcx], r11b
mov r11d, dword [0x1404cda48]
add eax, r9d
add eax, r11d
add r11d, r10d
cmp eax, r11d
jl 0x14017b880
xor r8b, 0x19
add r8b, byte [0x1404cda4c]
xchg byte [0x1404cd72d], r8b
lea rax, [0x1404cd720]
ret
mov al, 0x97
xchg byte [0x1404cd6bf], al
lea rax, [0x1404cd6b0]
ret
xor eax, eax
lea rcx, [0x1404cd730]
lea rdx, [0x1403f1bc0]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x14017b928
inc rax
jmp 0x14017b8e0
xor eax, eax
lea rcx, [0x1404cd620]
lea rdx, [0x1403f1ab0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x14017b938
inc rax
jmp 0x14017b910
mov al, 0xcd
xchg byte [0x1404cd73b], al
lea rax, [0x1404cd730]
ret
mov al, 0x52
xchg byte [0x1404cd635], al
lea rax, [0x1404cd620]
ret