joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140245550
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1402455c0
test edx, edx
je 0x1402455fc
movzx eax, byte [0x140623b34]
cmp al, 0x67
je 0x1402455b8
mov cl, 0x8c
nop
mov al, 0x5c
lock cmpxchg byte [0x140623b34], cl
je 0x14024567c
movzx edx, byte [0x140623ecc]
mov r9d, r8d
xor r9b, 0x43
mov r10d, r8d
xor r10b, r9b
xor r10b, 0xbc
and r10b, dl
xor r10b, r9b
and r9b, dl
add r9b, r9b
mov edx, r10d
xor dl, r9b
and r9b, r10b
add r9b, r9b
add r9b, dl
cmp al, r9b
jne 0x140245570
lea rax, [0x140623b30]
ret
test edx, edx
je 0x14024562c
movzx eax, byte [0x140623bf5]
cmp al, 0xf7
je 0x1402455f4
mov cl, 0x9b
nop word cs:[rax + rax]
mov al, 0x1f
lock cmpxchg byte [0x140623bf5], cl
je 0x1402456d9
cmp al, 0xf7
jne 0x1402455e0
lea rax, [0x140623bf0]
ret
movzx eax, byte [0x140623b25]
cmp al, 0xa7
je 0x140245624
mov cl, 0xe9
nop dword [rax]
mov al, 0x82
lock cmpxchg byte [0x140623b25], cl
je 0x140245708
cmp al, 0xa7
jne 0x140245610
lea rax, [0x140623b20]
ret
movzx eax, byte [0x140623bae]
cmp al, 0x9e
je 0x140245674
nop word [rax + rax]
movzx ecx, byte [0x140623ecc]
mov eax, r8d
xor al, 0x43
add al, cl
mov edx, r8d
xor dl, 0x92
add dl, cl
lock cmpxchg byte [0x140623bae], dl
je 0x140245758
mov ecx, r8d
xor cl, 0x9c
add cl, byte [0x140623ecc]
cmp al, cl
jne 0x140245640
lea rax, [0x140623ba0]
ret
xor edx, edx
lea rax, [0x140623b30]
lea rcx, [0x1405369c0]
xor r8d, 0xc119fc27
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
mov r9d, dword [0x140623ec8]
add r9d, r8d
cmp edx, r9d
jl 0x1402456a0
mov al, 0x67
xchg byte [0x140623b34], al
lea rax, [0x140623b30]
ret
xor eax, eax
lea rcx, [0x140623bf0]
lea rdx, [0x140536a60]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x140245738
inc rax
jmp 0x1402456f0
xor eax, eax
lea rcx, [0x140623b20]
lea rdx, [0x1405369b0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x140245748
inc rax
jmp 0x140245720
mov al, 0xf7
xchg byte [0x140623bf5], al
lea rax, [0x140623bf0]
ret
mov al, 0xa7
xchg byte [0x140623b25], al
lea rax, [0x140623b20]
ret
xor eax, eax
lea rcx, [0x140623ba0]
lea rdx, [0x140536a20]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x140245788
inc rax
jmp 0x140245770
mov al, 0x9e
xchg byte [0x140623bae], al
lea rax, [0x140623ba0]
ret
Function at 0x1402552f0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14025532c
test edx, edx
je 0x14025535c
movzx eax, byte [0x140626c42]
cmp al, 0x6b
je 0x140255324
mov cl, 0x37
nop word cs:[rax + rax]
mov al, 0x29
lock cmpxchg byte [0x140626c42], cl
je 0x1402553bc
cmp al, 0x6b
jne 0x140255310
lea rax, [0x140626c30]
ret
test edx, edx
je 0x14025538c
movzx eax, byte [0x140626be9]
cmp al, 0xf3
je 0x140255354
mov cl, 0xff
nop dword [rax]
mov al, 0x1f
lock cmpxchg byte [0x140626be9], cl
je 0x140255435
cmp al, 0xf3
jne 0x140255340
lea rax, [0x140626bc0]
ret
movzx eax, byte [0x140626bb7]
cmp al, 0xee
je 0x140255384
mov cl, 0x77
nop dword [rax]
mov al, 0xb1
lock cmpxchg byte [0x140626bb7], cl
je 0x140255485
cmp al, 0xee
jne 0x140255370
lea rax, [0x140626b90]
ret
movzx eax, byte [0x140626b8d]
cmp al, 0xe5
je 0x1402553b4
mov cl, 0x76
nop dword [rax]
mov al, 0xfe
lock cmpxchg byte [0x140626b8d], cl
je 0x14025550a
cmp al, 0xe5
jne 0x1402553a0
lea rax, [0x140626b80]
ret
xor eax, eax
lea rcx, [0x140626c30]
lea rdx, [0x140537580]
nop dword [rax]
cdqe
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r8b
mov r10d, r8d
and r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov byte [rax + rcx], r8b
mov r8d, dword [0x1406272c4]
mov r9d, r8d
xor r9d, 0x6bbf0163
and r9d, r8d
xor r8d, 0x1440fe9c
add r9d, r9d
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r8d, [r10 + r9*2]
add eax, r8d
cmp eax, 0x12
jl 0x1402553d0
mov al, 0x6b
xchg byte [0x140626c42], al
lea rax, [0x140626c30]
ret
xor eax, eax
lea rcx, [0x140626bc0]
lea rdx, [0x140537520]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
not r9b
mov r11d, r10d
xor r11b, r9b
and r11b, r10b
and r9b, r8b
or r9b, r11b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x28
jg 0x1402554ea
inc rax
jmp 0x140255450
xor eax, eax
lea rcx, [0x140626b90]
lea rdx, [0x1405374f0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
mov r9d, dword [0x1406272c4]
mov r10d, r9d
xor r10d, 0x77b00de2
and r9d, 0x77b00de2
lea r9d, [r10 + r9*2]
add r9d, 0x9c90f0e0
cmp r8d, r9d
jge 0x1402554fa
inc rax
jmp 0x1402554a0
mov al, 0xf3
xchg byte [0x140626be9], al
lea rax, [0x140626bc0]
ret
mov al, 0xee
xchg byte [0x140626bb7], al
lea rax, [0x140626b90]
ret
xor eax, eax
lea rcx, [0x140626b80]
lea rdx, [0x1405374e0]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140255538
inc rax
jmp 0x140255520
mov al, 0xe5
xchg byte [0x140626b8d], al
lea rax, [0x140626b80]
ret
Function at 0x140259e90
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140259ecc
test edx, edx
je 0x140259efc
movzx eax, byte [0x140627302]
cmp al, 0x9b
je 0x140259ec4
mov cl, 6
nop word cs:[rax + rax]
mov al, 0x8f
lock cmpxchg byte [0x140627302], cl
je 0x140259f6c
cmp al, 0x9b
jne 0x140259eb0
lea rax, [0x140627300]
ret
test edx, edx
je 0x140259f2c
movzx eax, byte [0x1406274cb]
cmp al, 0x4b
je 0x140259ef4
mov cl, 0x43
nop dword [rax]
mov al, 0xd
lock cmpxchg byte [0x1406274cb], cl
je 0x140259faf
cmp al, 0x4b
jne 0x140259ee0
lea rax, [0x1406274c0]
ret
movzx eax, byte [0x1406272f6]
cmp al, 0xee
je 0x140259f24
mov cl, 0xf6
nop dword [rax]
mov al, 0xc
lock cmpxchg byte [0x1406272f6], cl
je 0x14025a025
cmp al, 0xee
jne 0x140259f10
lea rax, [0x1406272f0]
ret
movzx eax, byte [0x140627496]
movzx ecx, byte [0x140627578]
add cl, 0x65
cmp al, cl
je 0x140259f64
mov cl, 0x22
nop word cs:[rax + rax]
mov al, 0x48
lock cmpxchg byte [0x140627496], cl
je 0x14025a09c
cmp al, 0x5f
jne 0x140259f50
lea rax, [0x140627470]
ret
xor edx, edx
lea rax, [0x140627300]
lea rcx, [0x140537700]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 2
jl 0x140259f80
mov al, 0x9b
xchg byte [0x140627302], al
lea rax, [0x140627300]
ret
xor edx, edx
lea rax, [0x1406274c0]
lea rcx, [0x1405378a0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x14062757c]
mov r9d, r8d
xor r9d, 0x5371fd6b
and r8d, 0x5371fd6b
add r8d, r8d
mov r10d, r9d
xor r10d, r8d
and r8d, r9d
lea r8d, [r10 + r8*2]
mov r9d, edx
not r9d
mov r10d, r8d
xor r10d, r9d
xor r9d, edx
and r9d, r8d
xor r9d, edx
and r10d, r8d
lea edx, [r9 + r10*2]
cmp edx, 0xb
jl 0x140259fc0
mov al, 0x4b
xchg byte [0x1406274cb], al
lea rax, [0x1406274c0]
ret
xor eax, eax
lea rcx, [0x1406272f0]
lea rdx, [0x1405376f0]
nop word cs:[rax + rax]
cdqe
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r8b
mov r10d, r8d
and r10b, r9b
not r9b
xor r8b, r9b
and r8b, r9b
or r8b, r10b
mov byte [rax + rcx], r8b
mov r8d, dword [0x14062757c]
mov r9d, r8d
xor r9d, 0x2c8e0294
and r9d, r8d
xor r8d, 0x5371fd6b
lea r8d, [r8 + r9*2]
add eax, r8d
cmp eax, 6
jl 0x14025a040
mov al, 0xee
xchg byte [0x1406272f6], al
lea rax, [0x1406272f0]
ret
xor eax, eax
lea rcx, [0x140627470]
lea rdx, [0x140537850]
mov r8d, 0x5371fd90
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14062757c]
add r10d, r8d
cmp r9d, r10d
jge 0x14025a0e1
inc rax
jmp 0x14025a0c0
movzx eax, byte [0x140627578]
add al, 0x65
xchg byte [0x140627496], al
lea rax, [0x140627470]
ret
Function at 0x14025a130
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov esi, r9d
test ecx, ecx
je 0x14025a1ae
movzx eax, byte [0x140627392]
movzx ecx, byte [0x140627578]
add cl, 0x74
cmp al, cl
je 0x14025a2f9
mov bl, 0x98
mov edi, esi
xor edi, 0x8eaeed5
nop word cs:[rax + rax]
mov al, 0x99
lock cmpxchg byte [0x140627392], bl
je 0x14025a274
mov ecx, dword [0x1406274d0]
add ecx, esi
add ecx, 0x52b8
movsxd r8, ecx
add r8, qword [0x1406274e0]
mov ecx, eax
mov edx, edi
mov rax, r8
call qword [0x1405fc400]
test al, 1
je 0x14025a170
jmp 0x14025a2f9
mov eax, 0x5371fd6a
add eax, dword [0x14062757c]
cmp edx, eax
jne 0x14025a215
movzx eax, byte [0x140627355]
cmp al, 0xc5
je 0x14025a399
mov edi, esi
xor edi, 0xdf0a8404
lea rbx, [rsp + 0x2f]
nop dword [rax]
mov eax, dword [0x1406274d4]
add eax, esi
add eax, 0x52b8
cdqe
add rax, qword [0x1406274f0]
mov rcx, rbx
mov edx, edi
call qword [0x1405fc400]
test al, 1
jne 0x14025a305
cmp byte [rsp + 0x2f], 0xc5
jne 0x14025a1e0
jmp 0x14025a399
movzx eax, byte [0x140627382]
movzx ecx, byte [0x140627578]
mov edx, ecx
xor dl, 0xfd
and cl, 0x7d
add cl, cl
add cl, dl
add cl, 0x90
cmp al, cl
je 0x14025a3aa
nop word [rax + rax]
movzx ecx, byte [0x140627578]
mov edx, ecx
xor dl, 0xfe
mov eax, ecx
not al
and al, 1
or al, dl
not al
add al, al
add al, dl
add cl, 0xa4
lock cmpxchg byte [0x140627382], cl
je 0x14025a355
cmp al, 0x87
jne 0x14025a240
jmp 0x14025a3aa
xor edx, edx
lea rax, [0x140627390]
lea rcx, [0x140537780]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
add edx, 0x1f541a4
mov r8d, edx
xor r8d, 0xfe0abe5d
and edx, 0x7e0abe5d
lea edx, [r8 + rdx*2]
cmp edx, 2
jl 0x14025a290
mov ecx, esi
xor ecx, 0xf60430a
mov eax, dword [0x1406274d8]
add esi, dword [0x14062757c]
add eax, esi
add eax, 0x53725022
cdqe
add rax, qword [0x1406274e8]
call qword [0x1405fc400]
lea rax, [0x140627390]
jmp 0x14025a3b1
xor eax, eax
lea rcx, [0x140627340]
lea rdx, [0x140537730]
mov r8d, 0x5371fd7f
nop dword [rax + rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14062757c]
add r10d, r8d
cmp r9d, r10d
jge 0x14025a391
inc rax
jmp 0x14025a320
xor eax, eax
lea rcx, [0x140627380]
lea rdx, [0x140537770]
mov r8d, 0x5371fd6c
nop dword [rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14062757c]
add r10d, r8d
cmp r9d, r10d
jge 0x14025a3a2
inc rax
jmp 0x14025a370
mov al, 0xc5
xchg byte [0x140627355], al
lea rax, [0x140627340]
jmp 0x14025a3b1
mov al, 0x87
xchg byte [0x140627382], al
lea rax, [0x140627380]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x14025a4a0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
call fcn.1404cf2d4
nop
add rsp, 0x28
ret
Function at 0x140261760
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, rcx
movsxd r14, dword [0x140538260]
mov ebx, dword [0x140538264]
lea rsi, [rcx + 8]
mov rcx, rsi
call fcn.140176c90
mov ecx, dword [0x140628910]
lea edx, [rcx + 1]
mov dword [0x140628910], edx
mov r8d, 0xfffffffe
sub r8d, ecx
mov r9d, ecx
xor r9d, edx
xor r8d, edx
and r8d, ecx
xor r8d, edx
and ecx, edx
or ecx, r8d
not ecx
or ecx, r9d
xor ecx, 0xffffffff
je 0x1402617cd
xor edx, edx
jmp 0x140261820
xor r8d, r8d
test ebx, ebx
jg 0x1402617d8
xor edx, edx
jmp 0x140261820
lea rdx, [0x140538260]
mov r9, r14
not r9
mov r10, rdx
xor r10, r9
xor r9, r14
and r9, rdx
xor r9, r14
and r10, rdx
lea r9, [r9 + r10*2]
xor edx, edx
nop dword [rax]
movsxd r8, r8d
xor rdx, qword [r9 + r8]
mov r10d, dword [0x140628c54]
add r8d, r10d
add r8d, 0x2b7edbb2
cmp r8d, ebx
jl 0x140261800
nop dword [rax]
mov r8d, dword [0x140694500]
cmp r8d, 0x2a
jge 0x140261820
test al, al
je 0x1402618d5
mov rax, qword [0x140538268]
movabs r8, 0xa25b35a3c19d689a
xor r8, rax
movabs r9, 0x225b35a3c19d689a
and r9, rax
lea rax, [r8 + r9*2]
sub rax, rdx
sub rax, qword [0x140628c58]
movabs rdx, 0x57e185606a377d3b
add rdx, rax
not rdx
xor eax, eax
neg ecx
sbb rax, rax
mov rcx, rax
xor rcx, rdx
and rcx, rax
or rcx, rdx
cmp rcx, 0xffffffffffffffff
setne al
or al, byte [0x140694504]
and al, 1
mov byte [0x140694504], al
mov byte [rdi + 0x2c], 0
lea rbx, [rdi + 0x20]
mov rcx, rbx
call fcn.14023a6e0
mov rcx, rsi
mov edx, 0x3e8
call fcn.1401778c0
test al, al
jne 0x1402618c5
mov rcx, rsi
call fcn.140176cb0
mov rcx, rsi
call fcn.140176d70
mov rcx, rbx
call fcn.14023a5e0
add rdi, 0x20
mov rcx, rdi
call fcn.14023a5e0
lea rax, [0x1405303e0]
mov qword [rsi], rax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x14026d8f0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14026d98b
mov eax, r8d
xor eax, 0x21946f7
mov ecx, r8d
not ecx
and ecx, r8d
xor ecx, eax
add ecx, dword [0x14062ae80]
cmp edx, ecx
jne 0x14026d9cc
movzx eax, byte [0x14062a67c]
movzx ecx, byte [0x14062ae90]
mov edx, r8d
xor dl, 0x35
add dl, 0xba
mov r9d, edx
xor r9b, cl
and dl, cl
add dl, dl
add dl, r9b
add dl, 0x46
cmp al, dl
je 0x14026d983
nop dword [rax + rax]
movzx ecx, byte [0x14062ae90]
mov eax, r8d
xor al, 0x58
add al, cl
mov edx, r8d
xor dl, 0xa8
mov r9d, edx
xor r9b, cl
and dl, cl
add dl, dl
add dl, r9b
lock cmpxchg byte [0x14062a67c], dl
je 0x14026dac2
cmp al, 0xe9
jne 0x14026d950
lea rax, [0x14062a660]
ret
test edx, edx
je 0x14026da20
movzx eax, byte [0x14062a502]
xor r8b, 0xbb
add r8b, byte [0x14062ae90]
cmp al, r8b
je 0x14026d9c4
mov cl, 0xea
nop dword [rax]
mov al, 0xe9
lock cmpxchg byte [0x14062a502], cl
je 0x14026db76
cmp al, 0x63
jne 0x14026d9b0
lea rax, [0x14062a4f0]
ret
movzx eax, byte [0x14062a4c2]
mov ecx, r8d
xor cl, 0x12
add cl, byte [0x14062ae90]
cmp al, cl
je 0x14026da18
nop word cs:[rax + rax]
movzx ecx, byte [0x14062ae90]
mov eax, r8d
xor al, 0x38
add al, cl
mov edx, r8d
xor dl, 0xea
add dl, cl
lock cmpxchg byte [0x14062a4c2], dl
je 0x14026daf8
cmp al, 0xa
jne 0x14026d9f0
lea rax, [0x14062a4c0]
ret
movzx eax, byte [0x14062a658]
nop word [rax + rax]
cmp al, 0xfe
je 0x14026daba
movzx ecx, byte [0x14062ae90]
mov eax, r8d
xor al, 0xbe
add al, cl
mov edx, r8d
xor dl, 0x87
add dl, cl
lock cmpxchg byte [0x14062a658], dl
jne 0x14026da30
xor edx, edx
lea rax, [0x14062a640]
lea rcx, [0x140539070]
nop dword [rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
cmp edx, 0x18
jl 0x14026da70
movzx eax, byte [0x14062ae90]
xor r8b, 0x1e
mov ecx, r8d
xor cl, al
and r8b, al
add r8b, r8b
mov eax, ecx
xor al, r8b
and r8b, cl
add r8b, r8b
add r8b, al
xchg byte [0x14062a658], r8b
lea rax, [0x14062a640]
ret
xor eax, eax
lea rcx, [0x14062a660]
lea rdx, [0x140539090]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1b
jg 0x14026db66
inc rax
jmp 0x14026dae0
xor edx, edx
lea rax, [0x14062a4c0]
lea rcx, [0x140538f20]
xor r8d, 0x21946f4
nop
movsxd rdx, edx
movzx r9d, byte [rdx + rax]
movzx r10d, byte [rdx + rcx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rdx + rax], r9b
mov r9d, dword [0x14062ae80]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
mov r10d, edx
xor r10d, r9d
and edx, r9d
lea edx, [r10 + rdx*2]
cmp edx, 2
jl 0x14026db10
mov al, 0xa
xchg byte [0x14062a4c2], al
lea rax, [0x14062a4c0]
ret
mov al, 0xe9
xchg byte [0x14062a67c], al
lea rax, [0x14062a660]
ret
xor eax, eax
lea rcx, [0x14062a4f0]
lea rdx, [0x140538f50]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x14026dba8
inc rax
jmp 0x14026db90
mov al, 0x63
xchg byte [0x14062a502], al
lea rax, [0x14062a4f0]
ret
Function at 0x14027d160
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov esi, edx
mov rdi, rcx
cmp qword [0x140694620], 0
jne 0x14027d2d0
mov eax, dword [0x140694744]
cmp eax, 0x2f
jg 0x14027d1f0
mov dword [rsp + 0x20], 0x7a4085e8
mov ecx, 1
xor edx, edx
mov r8d, 0x625d83a5
mov r9d, 0x3f4481f2
call fcn.14028cad0
mov rbx, rax
mov ecx, 1
xor edx, edx
mov r8d, 0xdbf11a48
mov r9d, 0x2728595e
call fcn.14028a2d0
mov rcx, rbx
mov rdx, rax
call fcn.140286820
mov qword [0x140694620], rax
mov eax, dword [0x140694744]
cmp eax, 0x31
jl 0x14027d2d0
nop word cs:[rax + rax]
mov r10d, dword [0x14062d078]
lea ecx, [r10 - 0x47eace9b]
lea edx, [r10 - 0x47eace9c]
lea r8d, [r10 + 0x1a72b509]
lea r9d, [r10 - 0x8a64caa]
mov eax, r10d
not eax
mov r11d, r10d
and r11d, 0xcdaa48b3
mov ebx, eax
and ebx, 0x3255b74c
or ebx, r11d
xor r10d, 0x3255b74c
and eax, 0x4daa48b3
or eax, r10d
not eax
add eax, eax
mov r10d, ebx
not r10d
mov r11d, eax
not r11d
mov r14d, ebx
and r14d, r11d
and r11d, r10d
and r10d, eax
or r14d, r10d
xor eax, ebx
or r11d, eax
not r11d
lea eax, [r14 + r11*2]
mov dword [rsp + 0x20], eax
call fcn.14028cad0
mov rbx, rax
mov ecx, 1
xor edx, edx
mov r8d, 0xdbf11a48
mov r9d, 0x2728595e
call fcn.14028a2d0
mov rcx, rbx
mov rdx, rax
call fcn.140286820
mov qword [0x140694620], rax
mov ecx, dword [0x140694740]
mov r8d, dword [0x14062d078]
mov eax, ecx
sub eax, r8d
add eax, 0x47eace9b
imul eax, ecx
add r8d, 0xb8153166
xor edx, edx
div r8d
test edx, edx
jne 0x14027d1f0
jmp 0x14027d187
mov rax, qword [0x140694620]
mov rcx, rdi
mov edx, esi
call qword [0x1405fc400]
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140289380
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1402893bc
test edx, edx
je 0x1402893ec
movzx eax, byte [0x14062c451]
cmp al, 0x5c
je 0x1402893b4
mov cl, 0x86
nop word cs:[rax + rax]
mov al, 0x95
lock cmpxchg byte [0x14062c451], cl
je 0x14028944c
cmp al, 0x5c
jne 0x1402893a0
lea rax, [0x14062c440]
ret
test edx, edx
je 0x14028941c
movzx eax, byte [0x14062c62d]
cmp al, 0xe9
je 0x1402893e4
mov cl, 0x63
nop dword [rax]
mov al, 0x19
lock cmpxchg byte [0x14062c62d], cl
je 0x1402894a6
cmp al, 0xe9
jne 0x1402893d0
lea rax, [0x14062c620]
ret
movzx eax, byte [0x14062c4cc]
cmp al, 0xd5
je 0x140289414
mov cl, 0x55
nop dword [rax]
mov al, 0x36
lock cmpxchg byte [0x14062c4cc], cl
je 0x1402894d8
cmp al, 0xd5
jne 0x140289400
lea rax, [0x14062c4c0]
ret
movzx eax, byte [0x14062c2fc]
cmp al, 0x69
je 0x140289444
mov cl, 0xba
nop dword [rax]
mov al, 0x92
lock cmpxchg byte [0x14062c2fc], cl
je 0x14028953b
cmp al, 0x69
jne 0x140289430
lea rax, [0x14062c2f0]
ret
xor edx, edx
lea rax, [0x14062c440]
lea rcx, [0x14053a280]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
neg edx
mov r8d, 0x47eace9b
sub r8d, dword [0x14062d078]
mov r9d, edx
xor r9d, r8d
and r8d, edx
lea edx, [r9 + r8*2]
neg edx
cmp edx, 0x11
jl 0x140289460
movzx eax, byte [0x14062d07c]
add al, 0x7a
xchg byte [0x14062c451], al
lea rax, [0x14062c440]
ret
xor eax, eax
lea rcx, [0x14062c620]
lea rdx, [0x14053a460]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140289508
inc rax
jmp 0x1402894c0
xor eax, eax
lea rcx, [0x14062c4c0]
lea rdx, [0x14053a300]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x140289518
inc rax
jmp 0x1402894f0
mov al, 0xe9
xchg byte [0x14062c62d], al
lea rax, [0x14062c620]
ret
xor eax, eax
sub al, byte [0x14062d07c]
mov ecx, eax
xor cl, 0xd
and al, 0xd
add al, al
add al, cl
neg al
xchg byte [0x14062c4cc], al
lea rax, [0x14062c4c0]
ret
xor eax, eax
lea rcx, [0x14062c2f0]
lea rdx, [0x14053a140]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x140289568
inc rax
jmp 0x140289550
movzx eax, byte [0x14062d07c]
add al, 0x87
xchg byte [0x14062c2fc], al
lea rax, [0x14062c2f0]
ret
Function at 0x140289850
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14028988c
test edx, edx
je 0x1402898fc
movzx eax, byte [0x14062c1bc]
cmp al, 0x60
je 0x140289884
mov cl, 0x31
nop dword [rax]
mov al, 0x6d
lock cmpxchg byte [0x14062c1bc], cl
je 0x14028995c
cmp al, 0x60
jne 0x140289870
lea rax, [0x14062c1a0]
ret
mov eax, dword [0x14062d078]
mov ecx, eax
not ecx
mov r8d, eax
and r8d, 0x47eace9b
mov r9d, ecx
and r9d, 0xb8153164
or r9d, r8d
xor eax, 0x38153164
and ecx, 0x47eace9b
or ecx, eax
not ecx
lea eax, [r9 + rcx*2]
cmp edx, eax
jne 0x140289928
movzx eax, byte [0x14062c6aa]
cmp al, 0x7c
je 0x1402898f4
mov cl, 0x8b
nop word cs:[rax + rax]
mov al, 0xdf
lock cmpxchg byte [0x14062c6aa], cl
je 0x1402899f1
cmp al, 0x7c
jne 0x1402898e0
lea rax, [0x14062c6a0]
ret
movzx eax, byte [0x14062c256]
cmp al, 0x7e
je 0x140289920
mov cl, 0xf5
nop dword [rax]
mov al, 0x4d
lock cmpxchg byte [0x14062c256], cl
je 0x140289998
cmp al, 0x7e
jne 0x140289910
lea rax, [0x14062c230]
ret
movzx eax, byte [0x14062c4bd]
movzx ecx, byte [0x14062d07c]
add cl, 0x18
cmp al, cl
je 0x140289954
mov cl, 0xb3
nop
mov al, 0x2c
lock cmpxchg byte [0x14062c4bd], cl
je 0x140289a28
cmp al, 0xfa
jne 0x140289940
lea rax, [0x14062c4b0]
ret
xor eax, eax
lea rcx, [0x14062c1a0]
lea rdx, [0x140539ff0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1b
jg 0x140289988
inc rax
jmp 0x140289970
mov al, 0x60
xchg byte [0x14062c1bc], al
lea rax, [0x14062c1a0]
ret
xor edx, edx
lea rax, [0x14062c230]
lea rcx, [0x14053a080]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x14062d078]
add edx, r8d
add edx, 0xb8153165
cmp edx, 0x26
jl 0x1402899b0
mov al, 0x7e
xchg byte [0x14062c256], al
lea rax, [0x14062c230]
ret
xor eax, eax
lea rcx, [0x14062c6a0]
lea rdx, [0x14053a4e0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 9
jg 0x140289a58
inc rax
jmp 0x140289a10
xor eax, eax
lea rcx, [0x14062c4b0]
lea rdx, [0x14053a2f0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140289a6f
inc rax
jmp 0x140289a40
movzx eax, byte [0x14062d07c]
add al, 0x9a
xchg byte [0x14062c6aa], al
lea rax, [0x14062c6a0]
ret
mov al, 0xfa
xchg byte [0x14062c4bd], al
lea rax, [0x14062c4b0]
ret