joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14023bd40
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140517338]
movabs rcx, 0xf9a35477669cfa31
movabs rdx, 0xf3133d3fd397e6b7
add rdx, rcx
movabs r8, 0x9bbdac2fa780a04c
sub rdx, r8
sub rdx, rcx
mov rcx, rdx
xor rcx, rax
and rdx, rax
lea rax, [rcx + rdx*2]
add rax, r8
cmp qword [rbx + 0x18], rax
je 0x14023bf1d
lea rdi, [rbx + 8]
cmp byte [0x140560259], 0
jne 0x14023be00
mov eax, 0xffff62cd
add eax, dword [0x140515d64]
cdqe
add rax, qword [0x140515d70]
mov rcx, rbx
call qword [case.0x140119ecb.0]
mov ecx, eax
mov edx, dword [0x140560250]
lea eax, [rdx - 1]
imul eax, edx
mov r8d, dword [0x140517330]
mov edx, r8d
xor edx, 0x4aefac7c
mov r9d, r8d
and r9d, 0x4aefac7c
lea r9d, [rdx + r9*2]
xor edx, edx
div r9d
add r8d, 0x4aefac7a
cmp edx, r8d
je 0x14023be46
nop
mov eax, 0x809adc47
sub eax, dword [0x140515d64]
mov ecx, eax
xor ecx, 0x7f65c0ec
and eax, 0x7f65c0ec
lea eax, [rcx + rax*2]
mov ecx, dword [0x140517330]
neg eax
add eax, ecx
add eax, 0x4aefac7a
cdqe
add rax, qword [0x140515d70]
mov rcx, rbx
call qword [case.0x140119ecb.0]
test rbx, rbx
je 0x14023be00
jmp 0x14023bda4
test cl, cl
je 0x14023be60
mov eax, 0xffff62cd
add eax, dword [0x140515d60]
cdqe
add rax, qword [0x140515d80]
jmp 0x14023be7a
mov eax, dword [0x140515d68]
sub eax, dword [0x140517330]
add eax, 0xb50fb653
cdqe
add rax, qword [0x140515d88]
mov rcx, rsi
call qword [case.0x140119ecb.0]
mov r8, qword [rbx + 0x18]
cmp qword [rbx + 0x20], 0x10
jb 0x14023be92
mov rdi, qword [rbx + 8]
lea rbx, [rsi + 8]
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x20]
mov rdx, rax
sub rdx, rcx
cmp rdx, r8
jae 0x14023bed3
mov eax, 0xffff62cd
add eax, dword [0x140515d6c]
cdqe
add rax, qword [0x140515d78]
mov qword [rsp + 0x20], r8
mov rcx, rbx
mov rdx, r8
mov r9, rdi
call qword [case.0x140119ecb.0]
jmp 0x14023bf1d
mov rdx, r8
not rdx
mov r9, rcx
xor r9, rdx
xor rdx, r8
and rdx, rcx
xor rdx, r8
and r9, rcx
movabs r10, 0x52d1ad84af96f83a
sub rdx, r10
lea r14, [rdx + r9*2]
add r14, r10
mov qword [rsi + 0x18], r14
cmp rax, 0x10
jb 0x14023bf0d
mov rbx, qword [rsi + 8]
add rcx, rbx
mov rdx, rdi
call fcn.1404048d0
mov byte [rbx + r14], 0
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140248f80
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140248fbc
test edx, edx
je 0x140248fec
movzx eax, byte [0x140517639]
cmp al, 0xf9
je 0x140248fb4
mov cl, 0x37
nop word cs:[rax + rax]
mov al, 0x64
lock cmpxchg byte [0x140517639], cl
je 0x14024905c
cmp al, 0xf9
jne 0x140248fa0
lea rax, [0x140517630]
ret
test edx, edx
je 0x14024901c
movzx eax, byte [0x1405175d0]
cmp al, 0xa4
je 0x140248fe4
mov cl, 0x79
nop dword [rax]
mov al, 0x14
lock cmpxchg byte [0x1405175d0], cl
je 0x1402490c6
cmp al, 0xa4
jne 0x140248fd0
lea rax, [0x1405175c0]
ret
movzx eax, byte [0x14051764d]
cmp al, 0xb0
je 0x140249014
mov cl, 0x46
nop dword [rax]
mov al, 0xcf
lock cmpxchg byte [0x14051764d], cl
je 0x140249118
cmp al, 0xb0
jne 0x140249000
lea rax, [0x140517640]
ret
movzx eax, byte [0x140517595]
movzx ecx, byte [0x140517d88]
add cl, 0xc5
cmp al, cl
je 0x140249054
mov cl, 0x7c
nop word cs:[rax + rax]
mov al, 0xf
lock cmpxchg byte [0x140517595], cl
je 0x140249158
cmp al, 0xa5
jne 0x140249040
lea rax, [0x140517580]
ret
xor eax, eax
lea rcx, [0x140517630]
lea rdx, [0x14042df90]
nop dword [rax]
cdqe
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
xor r9b, r8b
mov r10d, r9d
not r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
mov byte [rax + rcx], r10b
mov r8d, dword [0x140517d90]
mov r9d, r8d
xor r9d, 0x69369cf8
and r8d, 0x69369cf8
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 9
jl 0x140249070
mov al, 0xf9
xchg byte [0x140517639], al
lea rax, [0x140517630]
ret
xor edx, edx
lea rax, [0x1405175c0]
lea rcx, [0x14042df30]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x140517d90]
add edx, r8d
add edx, 0x69369cf8
cmp edx, 0x10
jl 0x1402490e0
movzx eax, byte [0x140517d88]
add al, 0xc4
xchg byte [0x1405175d0], al
lea rax, [0x1405175c0]
ret
xor eax, eax
lea rcx, [0x140517640]
lea rdx, [0x14042dfa0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140249148
inc rax
jmp 0x140249130
mov al, 0xb0
xchg byte [0x14051764d], al
lea rax, [0x140517640]
ret
xor edx, edx
lea rax, [0x140517580]
lea rcx, [0x14042def0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x140517d90]
add edx, r8d
add edx, 0x69369cf8
cmp edx, 0x15
jl 0x140249170
mov al, 0xa5
xchg byte [0x140517595], al
lea rax, [0x140517580]
ret
Function at 0x140261f40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x14051b570]
mov r8d, eax
xor r8d, 0xc0bc3fff
and eax, 0x40bc3fff
lea eax, [r8 + rax*2]
cmp ecx, eax
jne 0x140261f9c
mov eax, 0xc0bc3fff
add eax, dword [0x14051b570]
cmp edx, eax
jne 0x140261fc8
movzx eax, byte [0x14051a8c4]
cmp al, 0x53
je 0x140261f94
mov cl, 0x35
nop dword [rax]
mov al, 0xf
lock cmpxchg byte [0x14051a8c4], cl
je 0x14026209a
cmp al, 0x53
jne 0x140261f80
lea rax, [0x14051a8b0]
ret
test edx, edx
je 0x140261ffc
movzx eax, byte [0x14051a8ea]
cmp al, 0x4b
je 0x140261fc0
mov cl, 0x31
nop dword [rax]
mov al, pe_nt_image_headers64
lock cmpxchg byte [0x14051a8ea], cl
je 0x14026202c
cmp al, 0x4b
jne 0x140261fb0
lea rax, [0x14051a8e0]
ret
movzx eax, byte [0x14051a986]
movzx ecx, byte [0x14051b580]
add cl, 0x12
cmp al, cl
je 0x140261ff4
mov cl, 0xed
nop
mov al, 0xd2
lock cmpxchg byte [0x14051a986], cl
je 0x1402620fc
cmp al, 0x2d
jne 0x140261fe0
lea rax, [0x14051a970]
ret
movzx eax, byte [0x14051a8d4]
cmp al, 0x64
je 0x140262024
mov cl, 0x61
nop dword [rax]
mov al, 0x94
lock cmpxchg byte [0x14051a8d4], cl
je 0x140262145
cmp al, 0x64
jne 0x140262010
lea rax, [0x14051a8d0]
ret
xor eax, eax
lea rcx, [0x14051a8e0]
lea rdx, [0x14042f7a0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
mov r9d, dword [0x14051b570]
mov r10d, r9d
xor r10d, 0x40ea7758
and r9d, 0x40ea7758
lea r9d, [r10 + r9*2]
add r9d, 0x7fd1c8b1
cmp r8d, r9d
jge 0x14026208a
inc rax
jmp 0x140262040
mov al, 0x4b
xchg byte [0x14051a8ea], al
lea rax, [0x14051a8e0]
ret
xor edx, edx
lea rax, [0x14051a8b0]
lea rcx, [0x14042f770]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x14051b570]
mov r9d, edx
xor r9d, 0xb1744dd0
and edx, 0x31744dd0
lea edx, [r9 + rdx*2]
add edx, r8d
add edx, 0xf47f230
cmp edx, 0x14
jl 0x1402620b0
movzx eax, byte [0x14051b580]
add al, 0x38
xchg byte [0x14051a8c4], al
lea rax, [0x14051a8b0]
ret
xor edx, edx
lea rax, [0x14051a970]
lea rcx, [0x14042f820]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0x7ffffffe
and r8d, edx
xor edx, 1
lea edx, [rdx + r8*2]
cmp edx, 0x16
jl 0x140262110
mov al, 0x2d
xchg byte [0x14051a986], al
lea rax, [0x14051a970]
ret
xor eax, eax
lea rcx, [0x14051a8d0]
lea rdx, [0x14042f790]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x140262178
inc rax
jmp 0x140262160
movzx eax, byte [0x14051b580]
mov ecx, eax
xor cl, 0x49
and al, 0x49
add al, al
add al, cl
xchg byte [0x14051a8d4], al
lea rax, [0x14051a8d0]
ret
Function at 0x14029ac00
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14029ac3c
test edx, edx
je 0x14029acbf
movzx eax, byte [0x140525823]
cmp al, 0x94
je 0x14029ac34
mov cl, 0x2e
nop
mov al, 0x21
lock cmpxchg byte [0x140525823], cl
je 0x14029ad3c
cmp al, 0x94
jne 0x14029ac20
lea rax, [0x140525800]
ret
test edx, edx
je 0x14029acec
movzx eax, byte [0x1405256b0]
nop dword [rax + rax]
cmp al, 3
je 0x14029ad9f
movzx ecx, byte [0x14052585c]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0x97
mov eax, r8d
and al, 0x68
or al, r9b
add al, cl
and dl, 0x5e
mov r9d, r8d
and r9b, 0xa1
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x1405256b0], r9b
jne 0x14029ac50
xor eax, eax
lea rcx, [0x1405255b0]
lea rdx, [0x140435de0]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xff
jg 0x14029ad97
inc rax
jmp 0x14029aca0
movzx eax, byte [0x14052583f]
cmp al, 0x83
je 0x14029ace4
mov cl, 0x85
nop dword [rax]
mov al, 0x20
lock cmpxchg byte [0x14052583f], cl
je 0x14029ada7
cmp al, 0x83
jne 0x14029acd0
lea rax, [0x140525830]
ret
movzx eax, byte [0x1405256de]
cmp al, 0x3b
je 0x14029ad34
nop word [rax + rax]
movzx ecx, byte [0x14052585c]
mov eax, r8d
xor al, 0xf3
add al, cl
mov edx, r8d
xor dl, 0xf6
add dl, cl
lock cmpxchg byte [0x1405256de], dl
je 0x14029ae0b
mov ecx, r8d
xor cl, 0x9b
add cl, byte [0x14052585c]
cmp al, cl
jne 0x14029ad00
lea rax, [0x1405256c0]
ret
xor eax, eax
lea rcx, [0x140525800]
lea rdx, [0x140436010]
nop dword [rax]
xor r8d, r8d
sub r8b, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
xor r10d, r10d
sub r10b, r9b
mov r9d, r8d
xor r9b, r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
neg r10b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x14029ad87
inc rax
jmp 0x14029ad50
mov al, 0x94
xchg byte [0x140525823], al
lea rax, [0x140525800]
ret
mov al, 3
xchg byte [0x1405256b0], al
lea rax, [0x1405255b0]
ret
xor eax, eax
lea rcx, [0x140525830]
lea rdx, [0x140436040]
mov r9d, r8d
xor r9d, 0xbb7172c0
nop word cs:[rax + rax]
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x140525858]
add r11d, r9d
cmp r10d, r11d
jge 0x14029adf1
inc rax
jmp 0x14029add0
xor r8b, 0x53
add r8b, byte [0x14052585c]
xchg byte [0x14052583f], r8b
lea rax, [0x140525830]
ret
xor eax, eax
lea rcx, [0x1405256c0]
lea rdx, [0x140435ee0]
xor r8d, 0xbb7172f2
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
mov r9d, dword [0x140525858]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 0x1e
jl 0x14029ae30
mov al, 0x3b
xchg byte [0x1405256de], al
lea rax, [0x1405256c0]
ret
Function at 0x1402ae460
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rcx
mov eax, dword [0x14056110c]
cmp eax, 0x5f
jg 0x1402ae490
mov eax, dword [0x14056110c]
cmp eax, 0x5b
jl 0x1402ae49d
nop word cs:[rax + rax]
mov eax, dword [0x14056110c]
cmp eax, 0x4f
jge 0x1402ae490
jmp 0x1402ae478
mov esi, 0xfffffffe
test rdi, rdi
je 0x1402ae686
cmp qword [rdi + 0x30], 0
je 0x1402ae686
cmp qword [rdi + 0x38], 0
je 0x1402ae686
mov r14, qword [rdi + 0x28]
test r14, r14
je 0x1402ae686
cmp qword [r14], rdi
jne 0x1402ae686
mov eax, dword [0x140561108]
mov ecx, dword [0x140529458]
not ecx
add ecx, eax
add ecx, 0x13c7bc34
imul ecx, eax
test cl, 1
jne 0x1402ae522
mov ecx, dword [r14 + 8]
mov r8d, dword [0x140561110]
mov edx, dword [0x140561108]
lea eax, [rdx - 1]
imul eax, edx
mov r9d, 0x8d784e6a
add r9d, dword [0x140529458]
xor edx, edx
div r9d
test edx, edx
je 0x1402ae550
lea rbx, [0x1402b8cd0]
mov bpl, 1
nop dword [rax]
mov ecx, 0x3d
call fcn.1403bcbb4
mov qword [0x140561100], rax
mov rcx, rbx
call fcn.1403dccbc
test bpl, bpl
je 0x1402ae530
jmp 0x1402ae4f5
lea eax, [r8 + rcx]
add eax, 0xffffc0cc
cmp eax, 0x1f
ja 0x1402ae686
mov rax, qword [rdi + 0x28]
mov qword [rax + 0x34], 0
mov dword [rax + 0x3c], 0
cmp qword [rdi + 0x30], 0
je 0x1402ae686
cmp qword [rdi + 0x38], 0
je 0x1402ae686
mov rax, qword [rdi + 0x28]
test rax, rax
je 0x1402ae686
cmp qword [rax], rdi
jne 0x1402ae686
mov ecx, dword [rax + 8]
mov edx, dword [0x140529458]
add ecx, edx
add ecx, 0x8d780f34
cmp ecx, 0x20
setae cl
setb r8b
movzx edx, byte [0x14055f2c8]
mov r9d, edx
xor r9b, 1
mov r10d, r8d
xor r10b, r9b
test r10b, r8b
jne 0x1402ae5e2
and r9b, r8b
jne 0x1402ae5e2
and dl, cl
je 0x1402ae686
mov dword [rax + 0x24], 0
mov dword [rdi + 0x1c], 0
mov dword [rdi + 0xc], 0
mov qword [rdi + 0x20], 0
mov ecx, dword [rax + 0x10]
test ecx, ecx
je 0x1402ae623
mov edx, 0x8d784e69
add edx, dword [0x140529458]
mov r8d, ecx
xor r8d, edx
or edx, ecx
not edx
or edx, r8d
not edx
mov dword [rdi + 0x4c], edx
mov qword [rax + 8], 0x3f34
movabs rcx, 0xffffffff00000000
mov qword [rax + 0x14], rcx
mov dword [rax + 0x1c], 0x8000
mov qword [rax + 0x28], 0
mov ecx, 0x8d784e68
add ecx, dword [0x140529458]
mov dword [rax + 0x48], ecx
mov dword [rax + 0x4c], 0
lea rcx, [rax + 0x550]
mov qword [rax + 0x88], rcx
mov qword [rax + 0x68], rcx
mov qword [rax + 0x60], rcx
movabs rcx, 0xffffffff00000001
mov qword [rax + 0x1be0], rcx
xor esi, esi
mov eax, dword [0x140561108]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x1402ae6a0
mov al, 1
test al, al
jne 0x1402ae6c3
nop dword [rax]
mov eax, dword [0x14056110c]
mov ecx, dword [0x140529458]
mov edx, ecx
xor edx, 0x8d784ebc
and ecx, 0xd784ebc
lea ecx, [rdx + rcx*2]
cmp eax, ecx
jge 0x1402ae6a0
jmp 0x1402ae697
mov eax, esi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1403183b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x75af528
add eax, dword [0x14053c930]
cmp ecx, eax
jne 0x1403183ec
test edx, edx
je 0x14031841c
movzx eax, byte [0x14053baee]
cmp al, 0x20
je 0x1403183e4
mov cl, 0xff
mov al, 0x38
lock cmpxchg byte [0x14053baee], cl
je 0x14031848c
cmp al, 0x20
jne 0x1403183d0
lea rax, [0x14053bae0]
ret
test edx, edx
je 0x140318450
movzx eax, byte [0x14053b86d]
cmp al, 6
je 0x140318414
mov cl, 0x39
nop dword [rax]
mov al, 0x43
lock cmpxchg byte [0x14053b86d], cl
je 0x1403184c8
cmp al, 6
jne 0x140318400
lea rax, [0x14053b850]
ret
movzx eax, byte [0x14053b9e3]
cmp al, 0xd0
je 0x140318448
mov cl, 0xe4
nop dword [rax]
mov al, 0xba
lock cmpxchg byte [0x14053b9e3], cl
je 0x140318518
cmp al, byte [0x14053c934]
jne 0x140318430
lea rax, [0x14053b9e0]
ret
movzx eax, byte [0x14053bac9]
movzx ecx, byte [0x14053c934]
add cl, 0xcb
cmp al, cl
je 0x140318484
mov cl, 0xcb
nop word [rax + rax]
mov al, 0x67
lock cmpxchg byte [0x14053bac9], cl
je 0x140318561
cmp al, 0x9b
jne 0x140318470
lea rax, [0x14053bac0]
ret
xor eax, eax
lea rcx, [0x14053bae0]
lea rdx, [0x140443bd0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x1403184f8
inc rax
jmp 0x1403184a0
xor eax, eax
lea rcx, [0x14053b850]
lea rdx, [0x140443970]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1c
jg 0x140318508
inc rax
jmp 0x1403184e0
mov al, 0x20
xchg byte [0x14053baee], al
lea rax, [0x14053bae0]
ret
mov al, 6
xchg byte [0x14053b86d], al
lea rax, [0x14053b850]
ret
xor edx, edx
lea rax, [0x14053b9e0]
lea rcx, [0x140443ae0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x14053c930]
add edx, r8d
add edx, 0x75af529
cmp edx, 3
jl 0x140318530
mov al, 0xd0
xchg byte [0x14053b9e3], al
lea rax, [0x14053b9e0]
ret
xor eax, eax
lea rcx, [0x14053bac0]
lea rdx, [0x140443bb0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1403185a8
inc rax
jmp 0x140318580
mov al, 0x9b
xchg byte [0x14053bac9], al
lea rax, [0x14053bac0]
ret
Function at 0x140327010
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov r8d, dword [rsp + 0x40]
test ecx, ecx
je 0x140327059
test edx, edx
je 0x140327095
movzx eax, byte [0x14053ea29]
cmp al, 0x61
je 0x140327130
mov cl, 0x6e
nop word cs:[rax + rax]
mov al, 0x51
lock cmpxchg byte [0x14053ea29], cl
je 0x1403270f9
cmp al, 0x61
jne 0x140327040
jmp 0x140327130
test edx, edx
je 0x1403270c9
movzx eax, byte [0x14053e9a2]
cmp al, 0xc4
je 0x1403271ed
mov cl, 9
nop
mov al, 0x13
lock cmpxchg byte [0x14053e9a2], cl
je 0x14032713c
mov edx, r8d
xor dl, 0x65
add dl, byte [0x14053f03c]
cmp al, dl
jne 0x140327070
jmp 0x1403271ed
movzx eax, byte [0x14053e960]
cmp al, 0x56
je 0x1403271dc
mov cl, 0x76
nop word cs:[rax + rax]
mov al, 0xf
lock cmpxchg byte [0x14053e960], cl
je 0x14032716c
cmp al, 0x56
jne 0x1403270b0
jmp 0x1403271dc
movzx eax, byte [0x14053ea03]
cmp al, 0xa7
je 0x14032724d
mov cl, 0x9a
nop word [rax + rax]
mov al, 0xcf
lock cmpxchg byte [0x14053ea03], cl
je 0x1403271f6
cmp al, 0xa7
jne 0x1403270e0
jmp 0x14032724d
xor eax, eax
lea rcx, [0x14053ea20]
lea rdx, [0x140444000]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x140327128
inc rax
jmp 0x140327110
mov al, 0x61
xchg byte [0x14053ea29], al
lea rax, [0x14053ea20]
jmp 0x140327254
xor eax, eax
lea rcx, [0x14053e990]
lea rdx, [0x140443f70]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x1403271e5
inc rax
jmp 0x140327150
xor r10d, r10d
lea rax, [0x14053e950]
lea rcx, [0x140443f40]
mov edx, r8d
xor edx, 0x2c28831a
mov r9d, r8d
xor r9d, 0x2c28830b
movsxd r10, r10d
movzx r11d, byte [r10 + rcx]
mov ebx, r11d
xor bl, r11b
not bl
and bl, byte [r10 + rax]
xor bl, r11b
mov byte [r10 + rax], bl
mov r11d, dword [0x14053f038]
lea esi, [rdx + r11]
mov edi, r10d
xor edi, esi
and r10d, esi
lea r10d, [rdi + r10*2]
add r11d, r9d
cmp r10d, r11d
jl 0x140327190
xor r8b, 0x17
add r8b, byte [0x14053f03c]
xchg byte [0x14053e960], r8b
lea rax, [0x14053e950]
jmp 0x140327254
mov al, 0xc4
xchg byte [0x14053e9a2], al
lea rax, [0x14053e990]
jmp 0x140327254
xor eax, eax
lea rcx, [0x14053e9e0]
lea rdx, [0x140443fc0]
xor r8d, 0x2c28833c
nop dword [rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14053f038]
add r10d, r8d
cmp r9d, r10d
jge 0x140327245
inc rax
jmp 0x140327210
mov al, 0xa7
xchg byte [0x14053ea03], al
lea rax, [0x14053e9e0]
pop rbx
pop rdi
pop rsi
ret
Function at 0x140327460
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov r9d, r8d
not r9d
mov eax, r9d
and eax, 0x6a283c6b
mov r10d, r8d
xor r10d, 0x95d7c394
or r10d, eax
not r10d
or r10d, eax
add r10d, dword [0x14053f038]
cmp ecx, r10d
jne 0x140327564
test edx, edx
je 0x14032759c
movzx eax, byte [0x14053e9c3]
nop word cs:[rax + rax]
cmp al, 0x8f
je 0x14032755c
movzx ecx, byte [0x14053f03c]
mov eax, r8d
xor al, 0x69
add al, cl
mov edx, r8d
xor dl, cl
xor dl, 0x8d
mov r10d, r8d
xor r10b, 0x72
not cl
and cl, r10b
or cl, dl
not cl
add cl, cl
add cl, dl
lock cmpxchg byte [0x14053e9c3], cl
jne 0x1403274b0
xor edx, edx
lea rax, [0x14053e9b0]
lea rcx, [0x140443f90]
mov r10d, r8d
xor r10d, 0x6a283c7c
and r10d, r9d
xor r8d, 0x95d7c383
and r9d, 0x6a283c7c
or r9d, r8d
not r9d
or r9d, r10d
movsxd r8, edx
movzx edx, byte [r8 + rcx]
mov r10d, edx
xor r10b, dl
not r10b
and r10b, byte [r8 + rax]
xor r10b, dl
mov byte [r8 + rax], r10b
lea edx, [r8 + r8]
sub edx, r8d
inc edx
mov r8d, dword [0x14053f038]
add r8d, r9d
cmp edx, r8d
jl 0x140327520
mov al, 0x8f
xchg byte [0x14053e9c3], al
lea rax, [0x14053e9b0]
ret
test edx, edx
je 0x1403275cc
movzx eax, byte [0x14053ea1f]
cmp al, 0xe2
je 0x140327594
mov cl, 0xc3
nop word cs:[rax + rax]
mov al, 0xd7
lock cmpxchg byte [0x14053ea1f], cl
je 0x140327633
cmp al, 0xe2
jne 0x140327580
lea rax, [0x14053ea10]
ret
movzx eax, byte [0x14053e985]
cmp al, 0xe4
je 0x1403275c4
mov cl, 0x9d
nop dword [rax]
mov al, 0xc9
lock cmpxchg byte [0x14053e985], cl
je 0x1403276a5
cmp al, 0xe4
jne 0x1403275b0
lea rax, [0x14053e970]
ret
movzx eax, byte [0x14053e9d3]
mov ecx, r8d
xor cl, 0xe8
add cl, byte [0x14053f03c]
cmp al, cl
je 0x14032762b
mov cl, 0xc
nop word cs:[rax + rax]
mov al, 0x4e
lock cmpxchg byte [0x14053e9d3], cl
je 0x1403276d8
movzx edx, byte [0x14053f03c]
mov r9d, r8d
xor r9b, dl
xor r9b, 0xe8
mov r10d, r8d
xor r10b, 0x17
not dl
and dl, r10b
or dl, r9b
not dl
add dl, dl
add dl, r9b
cmp al, dl
jne 0x1403275f0
lea rax, [0x14053e9d0]
ret
xor edx, edx
lea rax, [0x14053ea10]
lea rcx, [0x140443ff0]
xor r8d, 0x6a283c78
nop word [rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rdx + rax]
xor r10b, r9b
mov byte [rdx + rax], r10b
add edx, 0xe1756e0c
mov r9d, edx
xor r9d, 0x1e8a91f5
and edx, 0x1e8a91f5
lea edx, [r9 + rdx*2]
mov r9d, dword [0x14053f038]
add r9d, r8d
cmp edx, r9d
jl 0x140327650
mov al, 0xe2
xchg byte [0x14053ea1f], al
lea rax, [0x14053ea10]
ret
xor eax, eax
lea rcx, [0x14053e970]
lea rdx, [0x140443f50]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140327708
inc rax
jmp 0x1403276c0
xor eax, eax
lea rcx, [0x14053e9d0]
lea rdx, [0x140443fb0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x140327718
inc rax
jmp 0x1403276f0
mov al, 0xe4
xchg byte [0x14053e985], al
lea rax, [0x14053e970]
ret
mov al, 0xc9
xchg byte [0x14053e9d3], al
lea rax, [0x14053e9d0]
ret
Function at 0x140347540
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x18], rdx
call fcn.14035e540
test rax, rax
sete cl
or cl, byte [0x14055f8b0]
movzx edx, byte [0x14055f8e0]
mov r8d, edx
and r8b, cl
test r8b, 1
jne 0x14034759e
mov r8d, edx
xor r8b, 1
and r8b, cl
test r8b, 1
jne 0x14034759e
xor cl, 1
and dl, cl
test dl, 1
jne 0x14034759e
add rsp, 0x40
pop rbp
ret
mov ecx, 0x7f
call fcn.140177c80
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
mov r8d, 0xc649bf83
mov r9d, 0xb8dcf098
add rsp, 0x40
pop rbp
jmp fcn.140347cb0
Function at 0x14035c800
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
xor eax, eax
test rcx, rcx
je 0x14035c979
test rdx, rdx
je 0x14035c979
mov al, 1
cmp rcx, rdx
je 0x14035c979
movabs r9, 0xef0d2a040d9994a9
xor r8d, r8d
xor r10d, r10d
nop word cs:[rax + rax]
mov r11, r8
sub r11, r9
movzx ebx, byte [0x140546988]
add bl, 0xb3
xor esi, esi
cmp byte [rcx + r8], 0
setne sil
movzx r8d, r10b
movzx r10d, bl
cmovne r10d, r8d
add r11, r9
mov r8, r11
add r8, rsi
test r10b, 1
je 0x14035c840
xor r9d, r9d
mov r10d, 1
xor r11d, r11d
nop word cs:[rax + rax]
xor esi, esi
cmp byte [rdx + r9], 0
setne sil
movzx r11d, r11b
cmove r11d, r10d
mov rdi, rsi
xor rdi, r9
and esi, r9d
lea r9, [rdi + rsi*2]
mov ebx, r11d
and bl, 1
movzx esi, byte [0x140546988]
add sil, 0xb2
cmp bl, sil
je 0x14035c890
cmp r8, r9
jne 0x14035c977
test r8, r8
je 0x14035c979
xor r9d, r9d
xor r10d, r10d
jmp 0x14035c913
movzx ebx, byte [0x140546988]
add bl, 0xb3
cmp sil, 0x2e
movzx r10d, r10b
movzx esi, bl
cmove r10d, esi
cmp r11b, 0x2e
cmove r10d, esi
mov r11d, dword [0x14055f570]
add r9d, r11d
inc r9d
cmp r8, r9
jbe 0x14035c979
movzx r11d, byte [rcx + r9]
movzx esi, byte [rdx + r9]
cmp r11b, sil
je 0x14035c8e0
test r10b, 1
jne 0x14035c977
lea ebx, [r11 - 0x61]
movzx edi, byte [0x140546988]
lea ebp, [rdi + r11]
add bpl, 0x92
cmp bl, 0x1a
movzx ebx, bpl
movzx r11d, r11b
cmovb r11d, ebx
lea ebx, [rsi - 0x61]
mov ebp, edi
xor bpl, 0xcc
and dil, 0x4c
add dil, dil
add dil, bpl
lea ebp, [rsi - 0x20]
cmp bl, dil
movzx edi, sil
movzx esi, bpl
cmovae esi, edi
cmp r11b, sil
je 0x14035c8e0
xor eax, eax
pop rbx
pop rbp
pop rdi
pop rsi
ret