joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403af820
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0x39520693
add eax, dword [0x1405794f0]
cmp ecx, eax
jne 0x1403af88c
test edx, edx
je 0x1403af8bc
movzx eax, byte [0x140577f3d]
movzx ecx, byte [0x1405794f4]
xor r8b, 0x38
mov edx, r8d
xor dl, cl
and r8b, cl
add r8b, r8b
add r8b, dl
cmp al, r8b
je 0x1403af884
mov cl, 0x54
nop word cs:[rax + rax]
mov al, 0x5a
lock cmpxchg byte [0x140577f3d], cl
je 0x1403af91c
cmp al, 0x6b
jne 0x1403af870
lea rax, [0x140577f30]
ret
test edx, edx
je 0x1403af8ec
movzx eax, byte [0x140577f2d]
cmp al, 0x83
je 0x1403af8b4
mov cl, 0x3a
nop dword [rax]
mov al, 0x7e
lock cmpxchg byte [0x140577f2d], cl
je 0x1403af95f
cmp al, 0x83
jne 0x1403af8a0
lea rax, [0x140577f20]
ret
movzx eax, byte [0x140577cb8]
cmp al, 0x20
je 0x1403af8e4
mov cl, 0x7f
nop dword [rax]
mov al, 0xb0
lock cmpxchg byte [0x140577cb8], cl
je 0x1403af998
cmp al, 0x20
jne 0x1403af8d0
lea rax, [0x140577cb0]
ret
movzx eax, byte [0x1405782f5]
cmp al, 0x4a
je 0x1403af914
mov cl, 0x52
nop dword [rax]
mov al, 0xc6
lock cmpxchg byte [0x1405782f5], cl
je 0x1403af9dd
cmp al, 0x4a
jne 0x1403af900
lea rax, [0x1405782f0]
ret
xor edx, edx
lea rax, [0x140577f30]
lea rcx, [0x140470ae0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x1403af930
mov al, 0x6b
xchg byte [0x140577f3d], al
lea rax, [0x140577f30]
ret
xor eax, eax
lea rcx, [0x140577f20]
lea rdx, [0x140470ad0]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1403af988
inc rax
jmp 0x1403af970
mov al, 0x83
xchg byte [0x140577f2d], al
lea rax, [0x140577f20]
ret
xor eax, eax
lea rcx, [0x140577cb0]
lea rdx, [0x140470870]
xor r8d, 0x39520692
nop
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x1405794f0]
add r9d, r8d
add eax, r9d
cmp eax, 8
jl 0x1403af9b0
mov al, 0x20
xchg byte [0x140577cb8], al
lea rax, [0x140577cb0]
ret
xor eax, eax
lea rcx, [0x1405782f0]
lea rdx, [0x140470e70]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x1403afa1c
inc rax
jmp 0x1403af9f0
mov al, 0x4a
xchg byte [0x1405782f5], al
lea rax, [0x1405782f0]
ret
Function at 0x1403afa50
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403afa8c
test edx, edx
je 0x1403afacc
movzx eax, byte [0x140577ca6]
cmp al, 0x2a
je 0x1403afa84
mov cl, 0xca
nop word cs:[rax + rax]
mov al, 0xf3
lock cmpxchg byte [0x140577ca6], cl
je 0x1403afb3b
cmp al, 0x2a
jne 0x1403afa70
lea rax, [0x140577ca0]
ret
mov ecx, dword [rsp + 0x28]
test edx, edx
je 0x1403afafc
movzx eax, byte [0x140577f01]
cmp al, 0x5b
je 0x1403afac4
mov dl, 0x96
nop word cs:[rax + rax]
mov al, 0x11
lock cmpxchg byte [0x140577f01], dl
je 0x1403afb78
cmp al, 0x5b
jne 0x1403afab0
lea rax, [0x140577ef0]
ret
movzx eax, byte [0x140578656]
cmp al, 0xf0
je 0x1403afaf4
mov cl, 0xa1
nop dword [rax]
mov al, 0xd8
lock cmpxchg byte [0x140578656], cl
je 0x1403afbb1
cmp al, 0xf0
jne 0x1403afae0
lea rax, [0x140578650]
ret
movzx eax, byte [0x140577d0a]
cmp al, 0x4a
je 0x1403afb33
mov dl, 0xb1
nop dword [rax]
mov al, 0x94
lock cmpxchg byte [0x140577d0a], dl
je 0x1403afc08
mov r8d, ecx
xor r8b, 0x4a
add r8b, byte [0x1405794f4]
cmp al, r8b
jne 0x1403afb10
lea rax, [0x140577d00]
ret
xor eax, eax
lea rcx, [0x140577ca0]
lea rdx, [0x140470860]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x1403afb68
inc rax
jmp 0x1403afb50
mov al, 0x2a
xchg byte [0x140577ca6], al
lea rax, [0x140577ca0]
ret
xor eax, eax
lea rdx, [0x140577ef0]
lea r8, [0x140470aa0]
xor ecx, 0x341cfd71
nop
movzx r9d, byte [rax + r8]
add byte [rax + rdx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405794f0]
add r10d, ecx
cmp r9d, r10d
jge 0x1403afbe8
inc rax
jmp 0x1403afb90
xor eax, eax
lea rcx, [0x140578650]
lea rdx, [0x140471180]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x1403afbf8
inc rax
jmp 0x1403afbd0
mov al, 0x5b
xchg byte [0x140577f01], al
lea rax, [0x140577ef0]
ret
mov al, 0xf0
xchg byte [0x140578656], al
lea rax, [0x140578650]
ret
xor r8d, r8d
lea rax, [0x140577d00]
lea rdx, [0x1404708c0]
xor ecx, 0x341cfd01
nop
movsxd r8, r8d
movzx r9d, byte [r8 + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [r8 + rax]
xor r10b, r9b
mov byte [r8 + rax], r10b
mov r9d, dword [0x1405794f0]
mov r10d, ecx
xor r10d, r9d
and r9d, ecx
lea r9d, [r10 + r9*2]
mov r10d, r8d
xor r10d, r9d
and r8d, r9d
lea r8d, [r10 + r8*2]
cmp r8d, 0xa
jl 0x1403afc20
mov al, 0x4a
xchg byte [0x140577d0a], al
lea rax, [0x140577d00]
ret

Function at 0x1403b0180
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x28]
movzx ecx, cl
xor rcx, rdx
movabs rdx, 0x100000001b3
imul rdx, rcx
mov qword [r9], rdx
add r8, 0x16
mov qword [rax], r8
ret
Function at 0x1403b4580
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403b45bc
test edx, edx
je 0x1403b45fc
movzx eax, byte [0x14057a687]
cmp al, 0xc8
je 0x1403b45b4
mov cl, 0xe2
nop word cs:[rax + rax]
mov al, 0x1b
lock cmpxchg byte [0x14057a687], cl
je 0x1403b469c
cmp al, 0xc8
jne 0x1403b45a0
lea rax, [0x14057a670]
ret
mov eax, 0xe9612b80
add eax, dword [0x14057aae8]
cmp edx, eax
jne 0x1403b462c
movzx eax, byte [0x14057a64f]
cmp al, 0xa7
je 0x1403b45f4
mov cl, 0xaa
nop dword [rax + rax]
mov al, 0xd8
lock cmpxchg byte [0x14057a64f], cl
je 0x1403b4721
cmp al, 0xa7
jne 0x1403b45e0
lea rax, [0x14057a640]
ret
movzx eax, byte [0x14057a5d0]
cmp al, 0xac
je 0x1403b4624
mov cl, 0x9b
nop dword [rax]
mov al, 0xb7
lock cmpxchg byte [0x14057a5d0], cl
je 0x1403b46d8
cmp al, 0xac
jne 0x1403b4610
lea rax, [0x14057a5c0]
ret
movzx eax, byte [0x14057a603]
nop word cs:[rax + rax]
cmp al, 0x9a
je 0x1403b4760
movzx ecx, byte [0x14057aaf8]
lea eax, [rcx - 0x39]
add cl, 0xec
lock cmpxchg byte [0x14057a603], cl
jne 0x1403b4640
xor eax, eax
lea rcx, [0x14057a600]
lea rdx, [0x140471860]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1403b4758
inc rax
jmp 0x1403b4670
xor eax, eax
lea rcx, [0x14057a670]
lea rdx, [0x1404718d0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x16
jg 0x1403b46c8
inc rax
jmp 0x1403b46b0
mov al, 0xc8
xchg byte [0x14057a687], al
lea rax, [0x14057a670]
ret
xor edx, edx
lea rax, [0x14057a5c0]
lea rcx, [0x140471830]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x14057aae8]
add edx, r8d
add edx, 0xe9612b81
cmp edx, 0x10
jl 0x1403b46f0
mov al, 0xac
xchg byte [0x14057a5d0], al
lea rax, [0x14057a5c0]
ret
xor eax, eax
lea rcx, [0x14057a640]
lea rdx, [0x1404718a0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1403b4768
inc rax
jmp 0x1403b4740
mov al, 0x9a
xchg byte [0x14057a603], al
lea rax, [0x14057a600]
ret
mov al, 0xa7
xchg byte [0x14057a64f], al
lea rax, [0x14057a640]
ret
Function at 0x1403b77f0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403b782c
test edx, edx
je 0x1403b785c
movzx eax, byte [0x14057acb1]
cmp al, 0x43
je 0x1403b7824
mov cl, 0x5a
nop word cs:[rax + rax]
mov al, 0x5c
lock cmpxchg byte [0x14057acb1], cl
je 0x1403b78ec
cmp al, 0x43
jne 0x1403b7810
lea rax, [0x14057aca0]
ret
test edx, edx
je 0x1403b788c
movzx eax, byte [0x14057ac20]
cmp al, 0x14
je 0x1403b7854
mov cl, 0x71
nop dword [rax]
mov al, 0xd5
lock cmpxchg byte [0x14057ac20], cl
je 0x1403b792f
cmp al, 0x14
jne 0x1403b7840
lea rax, [0x14057ac10]
ret
movzx eax, byte [0x14057acdc]
cmp al, 0xb2
je 0x1403b7884
mov cl, 0xfe
nop dword [rax]
mov al, 0xf2
lock cmpxchg byte [0x14057acdc], cl
je 0x1403b7971
cmp al, 0xb2
jne 0x1403b7870
lea rax, [0x14057acd0]
ret
movzx eax, byte [0x14057ad1d]
nop word cs:[rax + rax]
cmp al, 0xcf
je 0x1403b79c0
movzx ecx, byte [0x14057ae74]
lea eax, [rcx - 0x54]
add cl, 0xbe
lock cmpxchg byte [0x14057ad1d], cl
jne 0x1403b78a0
xor eax, eax
lea rcx, [0x14057ad10]
lea rdx, [0x140471c60]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1403b79b8
inc rax
jmp 0x1403b78d0
xor eax, eax
lea rcx, [0x14057aca0]
lea rdx, [0x140471bf0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x1403b7918
inc rax
jmp 0x1403b7900
movzx eax, byte [0x14057ae74]
add al, 0xf8
xchg byte [0x14057acb1], al
lea rax, [0x14057aca0]
ret
xor edx, edx
lea rax, [0x14057ac10]
lea rcx, [0x140471b70]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x14057ae70]
add edx, r8d
add edx, 0xc6c6a47e
cmp edx, 0x10
jl 0x1403b7940
mov al, 0x14
xchg byte [0x14057ac20], al
lea rax, [0x14057ac10]
ret
xor eax, eax
lea rcx, [0x14057acd0]
lea rdx, [0x140471c20]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x1403b79a8
inc rax
jmp 0x1403b7990
mov al, 0xb2
xchg byte [0x14057acdc], al
lea rax, [0x14057acd0]
ret
mov al, 0xcf
xchg byte [0x14057ad1d], al
lea rax, [0x14057ad10]
ret
Function at 0x1403b7db0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0x94df3957
add eax, dword [0x14057ae70]
cmp ecx, eax
jne 0x1403b7dfc
test edx, edx
je 0x1403b7e2c
movzx eax, byte [0x14057aced]
cmp al, 0xf3
je 0x1403b7df4
mov cl, 0x20
nop dword [rax + rax]
mov al, 0xbf
lock cmpxchg byte [0x14057aced], cl
je 0x1403b7e98
cmp al, 0xf3
jne 0x1403b7de0
lea rax, [0x14057ace0]
ret
test edx, edx
je 0x1403b7e5c
movzx eax, byte [0x14057ada0]
cmp al, 0x46
je 0x1403b7e24
mov cl, 0xc5
nop dword [rax]
mov al, 0x1f
lock cmpxchg byte [0x14057ada0], cl
je 0x1403b7ec8
cmp al, 0x46
jne 0x1403b7e10
lea rax, [0x14057ad90]
ret
movzx eax, byte [0x14057adbd]
cmp al, 0x10
je 0x1403b7e54
mov cl, 0xd
nop dword [rax]
mov al, 0xb8
lock cmpxchg byte [0x14057adbd], cl
je 0x1403b7f43
cmp al, 0x10
jne 0x1403b7e40
lea rax, [0x14057adb0]
ret
movzx eax, byte [0x14057ad0d]
cmp al, 0xce
je 0x1403b7e90
mov cl, 0xc4
nop dword [rax]
mov al, 0xbf
lock cmpxchg byte [0x14057ad0d], cl
je 0x1403b7f8d
mov edx, r8d
xor dl, 0xa9
add dl, byte [0x14057ae74]
cmp al, dl
jne 0x1403b7e70
lea rax, [0x14057ad00]
ret
xor eax, eax
lea rcx, [0x14057ace0]
lea rdx, [0x140471c30]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1403b7f33
inc rax
jmp 0x1403b7eb0
xor r9d, r9d
lea rax, [0x14057ad90]
lea rcx, [0x140471ce0]
mov edx, r8d
xor edx, 0x94df3954
nop word cs:[rax + rax]
movsxd r9, r9d
movzx r10d, byte [r9 + rcx]
add byte [r9 + rax], r10b
mov r10d, dword [0x14057ae70]
add r10d, edx
mov r11d, r9d
xor r11d, r10d
and r10d, r9d
lea r9d, [r11 + r10*2]
cmp r9d, 0x10
jl 0x1403b7ef0
xor r8b, 0xd1
add r8b, byte [0x14057ae74]
xchg byte [0x14057ada0], r8b
lea rax, [0x14057ad90]
ret
mov al, 0xf3
xchg byte [0x14057aced], al
lea rax, [0x14057ace0]
ret
xor eax, eax
lea rcx, [0x14057adb0]
lea rdx, [0x140471cf0]
xor r8d, 0x94df3954
nop word [rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x14057ae70]
add r9d, r8d
add eax, r9d
cmp eax, 0xd
jl 0x1403b7f60
mov al, 0x10
xchg byte [0x14057adbd], al
lea rax, [0x14057adb0]
ret
xor eax, eax
lea rcx, [0x14057ad00]
lea rdx, [0x140471c50]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1403b7fb8
inc rax
jmp 0x1403b7fa0
mov al, 0xce
xchg byte [0x14057ad0d], al
lea rax, [0x14057ad00]
ret
Function at 0x1403bc190
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xfad20494
add eax, dword [0x14057bd20]
cmp ecx, eax
jne 0x1403bc1cc
test edx, edx
je 0x1403bc1fc
movzx eax, byte [0x14057b9b4]
cmp al, 0xec
je 0x1403bc1c4
mov cl, 0xbd
mov al, 0x94
lock cmpxchg byte [0x14057b9b4], cl
je 0x1403bc281
cmp al, 0xec
jne 0x1403bc1b0
lea rax, [0x14057b9a0]
ret
test edx, edx
je 0x1403bc22c
movzx eax, byte [0x14057b84b]
cmp al, 0x12
je 0x1403bc1f4
mov cl, 0xc7
nop dword [rax]
mov al, 0x1e
lock cmpxchg byte [0x14057b84b], cl
je 0x1403bc2fd
cmp al, 0x12
jne 0x1403bc1e0
lea rax, [0x14057b830]
ret
movzx eax, byte [0x14057b9fb]
cmp al, 0xf5
je 0x1403bc224
mov cl, 0xcc
nop dword [rax]
mov al, 0x26
lock cmpxchg byte [0x14057b9fb], cl
je 0x1403bc338
cmp al, 0xf5
jne 0x1403bc210
lea rax, [0x14057b9f0]
ret
movzx eax, byte [0x14057b9cd]
movzx ecx, byte [0x14057bd24]
add cl, 0xd8
cmp al, cl
je 0x1403bc279
nop word cs:[rax + rax]
movzx ecx, byte [0x14057bd24]
mov edx, ecx
xor dl, 0x40
mov eax, ecx
and al, 0x40
add al, al
add al, dl
add cl, 0xf0
lock cmpxchg byte [0x14057b9cd], cl
je 0x1403bc3aa
cmp al, 0x8f
jne 0x1403bc250
lea rax, [0x14057b9c0]
ret
xor edx, edx
lea rax, [0x14057b9a0]
lea rcx, [0x140472260]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x14057bd20]
lea r9d, [r8 - 0x52dfb6b]
add edx, 0x38fdc6a1
mov r10d, edx
xor r10d, r9d
and edx, r9d
lea edx, [r10 + rdx*2]
add edx, 0xc702395f
mov r9d, r8d
xor r9d, 0xfad204a8
and r8d, 0x7ad204a8
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x1403bc2a0
mov al, 0xec
xchg byte [0x14057b9b4], al
lea rax, [0x14057b9a0]
ret
xor eax, eax
lea rcx, [0x14057b830]
lea rdx, [0x140472100]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1a
jg 0x1403bc328
inc rax
jmp 0x1403bc310
mov al, 0x12
xchg byte [0x14057b84b], al
lea rax, [0x14057b830]
ret
xor edx, edx
lea rax, [0x14057b9f0]
lea rcx, [0x1404722b0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
mov r9d, r10d
xor r9b, r8b
and r8b, r10b
add r8b, r8b
add r8b, r9b
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
add edx, edx
and edx, 2
mov r9d, r8d
xor r9d, edx
and edx, r8d
lea edx, [r9 + rdx*2]
cmp edx, 0xb
jl 0x1403bc350
mov al, 0xf5
xchg byte [0x14057b9fb], al
lea rax, [0x14057b9f0]
ret
xor eax, eax
lea rcx, [0x14057b9c0]
lea rdx, [0x140472280]
nop word [rax + rax]
cdqe
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
mov r8d, dword [0x14057bd20]
mov r9d, r8d
xor r9d, 0xfad20495
and r8d, 0x7ad20495
add r8d, r8d
mov r10d, r9d
xor r10d, r8d
and r8d, r9d
lea r8d, [r10 + r8*2]
add eax, r8d
cmp eax, 0xd
jl 0x1403bc3c0
mov al, 0x8f
xchg byte [0x14057b9cd], al
lea rax, [0x14057b9c0]
ret

Function at 0x1403bc680
Capabilities:
Enumerate processes

Disassembly:
sub rsp, 0x28
test ecx, ecx
je 0x1403bc695
mov rcx, rdx
mov rdx, r8
call sub.KERNEL32.dll_Process32First
jmp 0x1403bc6a0
mov rcx, rdx
mov rdx, r8
call sub.KERNEL32.dll_Process32Next
nop
add rsp, 0x28
ret
Function at 0x1403bc6c0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403bc6f8
movzx eax, byte [0x14057b91a]
cmp al, 0xcb
je 0x1403bc6f0
mov cl, 0xe5
nop word cs:[rax + rax]
mov al, 0xf3
lock cmpxchg byte [0x14057b91a], cl
je 0x1403bc728
cmp al, 0xcb
jne 0x1403bc6e0
lea rax, [0x14057b910]
ret
movzx eax, byte [0x14057b909]
cmp al, 0x66
je 0x1403bc720
mov cl, 0xb9
nop word cs:[rax + rax]
mov al, 0x8a
lock cmpxchg byte [0x14057b909], cl
je 0x1403bc787
cmp al, 0x66
jne 0x1403bc710
lea rax, [0x14057b900]
ret
xor eax, eax
lea rcx, [0x14057b910]
lea rdx, [0x1404721d0]
mov r8d, r9d
xor r8d, 0xf164df69
nop word cs:[rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
mov r10d, dword [0x14057bd20]
add r10d, r8d
add eax, r10d
cmp eax, 0xa
jl 0x1403bc750
xor r9b, 0xe8
add r9b, byte [0x14057bd24]
xchg byte [0x14057b91a], r9b
lea rax, [0x14057b910]
ret
xor eax, eax
lea rcx, [0x14057b900]
lea rdx, [0x1404721c0]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1403bc7b8
inc rax
jmp 0x1403bc7a0
xor r9b, 0x53
add r9b, byte [0x14057bd24]
xchg byte [0x14057b909], r9b
lea rax, [0x14057b900]
ret
Function at 0x1403bce90
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1403bcedc
test edx, edx
je 0x1403bcf5c
movzx eax, byte [0x14057b885]
xor r8b, 0x8c
add r8b, byte [0x14057bd24]
cmp al, r8b
je 0x1403bced4
mov cl, 0x80
nop word [rax + rax]
mov al, 0x3d
lock cmpxchg byte [0x14057b885], cl
je 0x1403bcfbc
cmp al, 0x46
jne 0x1403bcec0
lea rax, [0x14057b870]
ret
test edx, edx
je 0x1403bcf8c
movzx eax, byte [0x14057b94d]
nop dword [rax + rax]
cmp al, 0xb7
je 0x1403bd000
movzx ecx, byte [0x14057bd24]
mov eax, r8d
xor al, 0x6d
add al, cl
mov edx, r8d
xor dl, 0xb7
add dl, cl
lock cmpxchg byte [0x14057b94d], dl
jne 0x1403bcef0
xor eax, eax
lea rcx, [0x14057b940]
lea rdx, [0x140472200]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1403bcff8
inc rax
jmp 0x1403bcf30
movzx eax, byte [0x14057b82b]
cmp al, 0xb2
je 0x1403bcf84
mov cl, 0x13
nop dword [rax]
mov al, 0x8c
lock cmpxchg byte [0x14057b82b], cl
je 0x1403bd008
cmp al, 0xb2
jne 0x1403bcf70
lea rax, [0x14057b7f0]
ret
movzx eax, byte [0x14057b860]
cmp al, 0xe9
je 0x1403bcfb4
mov cl, 0x4b
nop dword [rax]
mov al, 0xef
lock cmpxchg byte [0x14057b860], cl
je 0x1403bd05f
cmp al, 0xe9
jne 0x1403bcfa0
lea rax, [0x14057b850]
ret
xor eax, eax
lea rcx, [0x14057b870]
lea rdx, [0x140472130]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1403bcfe8
inc rax
jmp 0x1403bcfd0
mov al, 0x46
xchg byte [0x14057b885], al
lea rax, [0x14057b870]
ret
mov al, 0xb7
xchg byte [0x14057b94d], al
lea rax, [0x14057b940]
ret
xor edx, edx
lea rax, [0x14057b7f0]
lea rcx, [0x1404720c0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x3b
jl 0x1403bd020
mov al, 0xb2
xchg byte [0x14057b82b], al
lea rax, [0x14057b7f0]
ret
xor eax, eax
lea rcx, [0x14057b850]
lea rdx, [0x140472120]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1403bd088
inc rax
jmp 0x1403bd070
mov al, 0xe9
xchg byte [0x14057b860], al
lea rax, [0x14057b850]
ret
Function at 0x1403bd870
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403bd94e
movzx eax, byte [0x14057be5f]
cmp al, 0x10
je 0x1403bda7b
mov r8d, 0x1766406
lea rax, [fcn.1403bd870]
lea r9d, [rax + rax]
add r9d, 0x1100
mov r10d, r9d
not r10d
jmp 0x1403bd8c1
movzx eax, byte [0x14057c180]
add al, 0x7c
cmp cl, al
je 0x1403bda7b
movzx ecx, byte [0x14057c180]
mov edx, ecx
xor dl, 0xda
mov eax, ecx
and al, 0x5a
add al, al
add al, dl
add cl, 0x85
lock cmpxchg byte [0x14057be5f], cl
je 0x1403bd9ec
mov ecx, eax
mov edx, dword [0x1405927c8]
lea eax, [rdx - 1]
imul eax, edx
mov r11d, dword [0x14057c170]
add r11d, r8d
xor edx, edx
div r11d
test edx, edx
jne 0x1403bd920
nop word [rax + rax]
test r10d, r9d
je 0x1403bd8b0
nop word cs:[rax + rax]
mov eax, dword [0x1405927c8]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
mov eax, dword [0x14057c170]
mov r11d, eax
xor r11d, 0x1766404
and eax, 0x1766404
lea eax, [r11 + rax*2]
cmp edx, eax
jne 0x1403bd920
jmp 0x1403bd910
movzx eax, byte [0x14057bd6c]
cmp al, 0xed
je 0x1403bdac9
mov ecx, 0x1766463
mov dl, 0x5f
nop word cs:[rax + rax]
mov eax, dword [0x1405927cc]
mov r8d, dword [0x14057c170]
add r8d, ecx
cmp eax, r8d
jge 0x1403bd9e0
nop word cs:[rax + rax]
mov al, 0xa2
lock cmpxchg byte [0x14057bd6c], dl
sete r8b
mov r9d, dword [0x1405927cc]
cmp r9d, 0x12
jg 0x1403bd9e0
test r8b, r8b
jne 0x1403bda83
movzx r8d, byte [0x14057c180]
mov r9d, r8d
xor r9b, 0x59
and r8b, 0x59
add r8b, r8b
add r8b, r9b
cmp al, r8b
jne 0x1403bd970
jmp 0x1403bdac9
mov al, 0xa2
lock cmpxchg byte [0x14057bd6c], dl
jmp 0x1403bd990
xor edx, edx
lea rax, [0x14057be50]
lea rcx, [0x1404723f0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x1403bda00
lea rax, [fcn.1403bd870]
add eax, eax
add eax, 0x2980
mov ecx, eax
not ecx
mov edx, 0x1766404
nop word cs:[rax + rax]
test ecx, eax
je 0x1403bda51
mov r8d, dword [0x1405927cc]
cmp r8d, 0xb
jge 0x1403bda40
mov r8d, dword [0x1405927c8]
lea r9d, [r8 - 1]
imul r9d, r8d
and r9d, 1
mov r8d, dword [0x14057c170]
add r8d, edx
cmp r9d, r8d
jne 0x1403bda44
mov al, 0x10
xchg byte [0x14057be5f], al
lea rax, [0x14057be50]
ret
xor eax, eax
lea rcx, [0x14057bd60]
lea rdx, [0x140472310]
mov r8d, 0x1766410
nop dword [rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14057c170]
add r10d, r8d
cmp r9d, r10d
jge 0x1403bdac1
inc rax
jmp 0x1403bdaa0
mov al, 0xed
xchg byte [0x14057bd6c], al
lea rax, [0x14057bd60]
ret
Function at 0x1403c7d10
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1403c7d5c
test edx, edx
je 0x1403c7d8c
movzx eax, byte [0x14057c8cb]
xor r8b, 0x89
add r8b, byte [0x14057ce58]
cmp al, r8b
je 0x1403c7d54
mov cl, 0x8a
nop word cs:[rax + rax]
mov al, 0xd5
lock cmpxchg byte [0x14057c8cb], cl
je 0x1403c7dec
cmp al, 0xea
jne 0x1403c7d40
lea rax, [0x14057c8b0]
ret
test edx, edx
je 0x1403c7dbc
movzx eax, byte [0x14057c81f]
cmp al, 0x18
je 0x1403c7d84
mov cl, 0x8b
nop dword [rax]
mov al, 0xc3
lock cmpxchg byte [0x14057c81f], cl
je 0x1403c7e38
cmp al, 0x18
jne 0x1403c7d70
lea rax, [0x14057c810]
ret
movzx eax, byte [0x14057c6a5]
cmp al, 0xda
je 0x1403c7db4
mov cl, 0x57
nop dword [rax]
mov al, 0xab
lock cmpxchg byte [0x14057c6a5], cl
je 0x1403c7e8b
cmp al, 0xda
jne 0x1403c7da0
lea rax, [0x14057c6a0]
ret
movzx eax, byte [0x14057c71d]
cmp al, 0xea
je 0x1403c7de4
mov cl, 0xa9
nop dword [rax]
mov al, 0xe8
lock cmpxchg byte [0x14057c71d], cl
je 0x1403c7ec8
cmp al, 0xea
jne 0x1403c7dd0
lea rax, [0x14057c710]
ret
xor eax, eax
lea rcx, [0x14057c8b0]
lea rdx, [0x140472840]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x1a
jg 0x1403c7e28
inc rax
jmp 0x1403c7e00
mov al, 0xea
xchg byte [0x14057c8cb], al
lea rax, [0x14057c8b0]
ret
xor edx, edx
lea rax, [0x14057c810]
lea rcx, [0x1404727b0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0x2481072b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0xdb7ef8d5
cmp edx, 0xf
jl 0x1403c7e50
mov al, 0x18
xchg byte [0x14057c81f], al
lea rax, [0x14057c810]
ret
xor eax, eax
lea rcx, [0x14057c6a0]
lea rdx, [0x140472660]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x1403c7eb8
inc rax
jmp 0x1403c7ea0
mov al, 0xda
xchg byte [0x14057c6a5], al
lea rax, [0x14057c6a0]
ret
xor edx, edx
lea rax, [0x14057c710]
lea rcx, [0x1404726d0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
cmp edx, 0xd
jl 0x1403c7ee0
xor r8b, 0x89
add r8b, byte [0x14057ce58]
xchg byte [0x14057c71d], r8b
lea rax, [0x14057c710]
ret
Function at 0x140011dac
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140011ba8