joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a9e70
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400a9eac
test edx, edx
je 0x1400a9f0c
movzx eax, byte [0x14050037f]
cmp al, 8
je 0x1400a9ea4
mov cl, 0xbe
nop dword [rax]
mov al, 0x14
lock cmpxchg byte [0x14050037f], cl
je 0x1400a9f6c
cmp al, 8
jne 0x1400a9e90
lea rax, [0x140500370]
ret
test edx, edx
je 0x1400a9f3c
movzx eax, byte [0x140500120]
nop dword [rax + rax]
cmp al, 0xd3
je 0x1400a9fb7
movzx ecx, byte [0x1405015c4]
lea eax, [rcx + 0x41]
add cl, 0xaf
lock cmpxchg byte [0x140500120], cl
jne 0x1400a9ec0
xor eax, eax
lea rcx, [0x140500110]
lea rdx, [0x140438640]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1400a9fa8
inc rax
jmp 0x1400a9ef0
movzx eax, byte [0x140500334]
cmp al, 0xe0
je 0x1400a9f34
mov cl, 0x89
nop dword [rax]
mov al, 0x60
lock cmpxchg byte [0x140500334], cl
je 0x1400a9fbf
cmp al, 0xe0
jne 0x1400a9f20
lea rax, [0x140500320]
ret
movzx eax, byte [0x1405001e0]
cmp al, 0x4b
je 0x1400a9f64
mov cl, 0xb4
nop dword [rax]
mov al, 1
lock cmpxchg byte [0x1405001e0], cl
je 0x1400aa001
cmp al, 0x4b
jne 0x1400a9f50
lea rax, [0x1405001d0]
ret
xor eax, eax
lea rcx, [0x140500370]
lea rdx, [0x140438880]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1400a9f98
inc rax
jmp 0x1400a9f80
mov al, 8
xchg byte [0x14050037f], al
lea rax, [0x140500370]
ret
movzx eax, byte [0x1405015c4]
add al, 0x8c
xchg byte [0x140500120], al
lea rax, [0x140500110]
ret
xor edx, edx
lea rax, [0x140500320]
lea rcx, [0x140438830]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1405015c0]
add edx, r8d
add edx, 0x7380dc9e
cmp edx, 0x14
jl 0x1400a9fd0
mov al, pe_nt_image_headers64
xchg byte [0x140500334], al
lea rax, [0x140500320]
ret
xor edx, edx
lea rax, [0x1405001d0]
lea rcx, [0x1404386f0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
mov r9d, r8d
xor r9b, 0xa3
and r8b, 0x23
add r8b, r8b
add r8b, r9b
add r8b, byte [rdx + rcx]
add r8b, 0x5d
mov byte [rdx + rax], r8b
add edx, 0x19a3ffda
mov r8d, edx
xor r8d, 0xe65c0027
and edx, 0x665c0027
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x1400aa020
mov al, 0x4b
xchg byte [0x1405001e0], al
lea rax, [0x1405001d0]
ret
Function at 0x1400aa310
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400aa34c
test edx, edx
je 0x1400aa386
movzx eax, byte [0x1405002cb]
cmp al, 0xa9
je 0x1400aa344
mov cl, 0xca
nop word cs:[rax + rax]
mov al, 0x6c
lock cmpxchg byte [0x1405002cb], cl
je 0x1400aa3ec
cmp al, 0xa9
jne 0x1400aa330
lea rax, [0x1405002c0]
ret
test edx, edx
je 0x1400aa3bc
movzx eax, byte [0x14050031d]
cmp al, 0x2a
je 0x1400aa37e
mov cl, 0x80
nop dword [rax]
mov al, 0xce
lock cmpxchg byte [0x14050031d], cl
je 0x1400aa428
movzx edx, byte [0x1405015c4]
add dl, 0xe3
cmp al, dl
jne 0x1400aa360
lea rax, [0x140500310]
ret
movzx eax, byte [0x14050036d]
cmp al, 0x4a
je 0x1400aa3b4
mov cl, 0x54
nop word cs:[rax + rax]
mov al, 6
lock cmpxchg byte [0x14050036d], cl
je 0x1400aa488
cmp al, 0x4a
jne 0x1400aa3a0
lea rax, [0x140500360]
ret
movzx eax, byte [0x140500199]
cmp al, 0x7c
je 0x1400aa3e4
mov cl, 0x2d
nop dword [rax]
mov al, 0xcc
lock cmpxchg byte [0x140500199], cl
je 0x1400aa4d1
cmp al, 0x7c
jne 0x1400aa3d0
lea rax, [0x140500190]
ret
xor eax, eax
lea rcx, [0x1405002c0]
lea rdx, [0x1404387d0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x1400aa418
inc rax
jmp 0x1400aa400
mov al, 0xa9
xchg byte [0x1405002cb], al
lea rax, [0x1405002c0]
ret
xor edx, edx
lea rax, [0x140500310]
lea rcx, [0x140438820]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
not r8b
mov r10d, r8d
and r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, dword [0x1405015c0]
add edx, r8d
add edx, 0x7380dc9e
cmp edx, 0xd
jl 0x1400aa440
mov al, 0x2a
xchg byte [0x14050031d], al
lea rax, [0x140500310]
ret
xor edx, edx
lea rax, [0x140500360]
lea rcx, [0x140438870]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1405015c0]
add edx, r8d
add edx, 0x7380dc9e
cmp edx, 0xd
jl 0x1400aa4a0
mov al, 0x4a
xchg byte [0x14050036d], al
lea rax, [0x140500360]
ret
xor eax, eax
lea rcx, [0x140500190]
lea rdx, [0x1404386b0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1400aa508
inc rax
jmp 0x1400aa4f0
mov al, 0x7c
xchg byte [0x140500199], al
lea rax, [0x140500190]
ret
Function at 0x1400aa700
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400aa746
test edx, edx
je 0x1400aa78c
movzx eax, byte [0x1405002b6]
cmp al, 0xd4
je 0x1400aa73e
mov cl, 4
nop dword [rax]
mov al, 0x8f
lock cmpxchg byte [0x1405002b6], cl
je 0x1400aa7fc
movzx edx, byte [0x1405015c4]
add dl, 0x8d
cmp al, dl
jne 0x1400aa720
lea rax, [0x1405002b0]
ret
test edx, edx
je 0x1400aa7cc
movzx eax, byte [0x140500108]
movzx ecx, byte [0x1405015c4]
add cl, 0xe0
cmp al, cl
je 0x1400aa784
mov cl, 0xb3
nop word cs:[rax + rax]
mov al, 0x42
lock cmpxchg byte [0x140500108], cl
je 0x1400aa848
cmp al, 0x27
jne 0x1400aa770
lea rax, [0x1405000f0]
ret
movzx eax, byte [0x1405002ad]
movzx ecx, byte [0x1405015c4]
add cl, 0x15
cmp al, cl
je 0x1400aa7c4
mov cl, 0x78
nop word cs:[rax + rax]
mov al, 0xba
lock cmpxchg byte [0x1405002ad], cl
je 0x1400aa8a6
cmp al, 0x5c
jne 0x1400aa7b0
lea rax, [0x1405002a0]
ret
movzx eax, byte [0x1405000c5]
cmp al, 0x21
je 0x1400aa7f4
mov cl, 2
nop dword [rax]
mov al, 0xd7
lock cmpxchg byte [0x1405000c5], cl
je 0x1400aa90a
cmp al, 0x21
jne 0x1400aa7e0
lea rax, [0x1405000b0]
ret
xor eax, eax
lea rcx, [0x1405002b0]
lea rdx, [0x1404387c0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x1400aa838
inc rax
jmp 0x1400aa810
mov al, 0xd4
xchg byte [0x1405002b6], al
lea rax, [0x1405002b0]
ret
xor eax, eax
lea rcx, [0x1405000f0]
lea rdx, [0x140438620]
nop dword [rax + rax]
cdqe
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
mov r8d, dword [0x1405015c0]
mov r9d, r8d
xor r9d, 0x7380dc9e
and r8d, 0x7380dc9e
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0x18
jl 0x1400aa860
movzx eax, byte [0x1405015c4]
add al, 0xe0
xchg byte [0x140500108], al
lea rax, [0x1405000f0]
ret
xor edx, edx
lea rax, [0x1405002a0]
lea rcx, [0x1404387b0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1405015c0]
lea r9d, [r8 + 0x7380dc9e]
mov r10d, edx
xor r10d, r9d
and edx, r9d
lea edx, [r10 + rdx*2]
add r8d, 0x7380dcaa
cmp edx, r8d
jl 0x1400aa8c0
movzx eax, byte [0x1405015c4]
add al, 0x15
xchg byte [0x1405002ad], al
lea rax, [0x1405002a0]
ret
xor eax, eax
lea rcx, [0x1405000b0]
lea rdx, [0x1404385e0]
mov r8d, 0x7380dcb2
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405015c0]
add r10d, r8d
cmp r9d, r10d
jge 0x1400aa941
inc rax
jmp 0x1400aa920
mov al, 0x21
xchg byte [0x1405000c5], al
lea rax, [0x1405000b0]
ret
Function at 0x1400abeb0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0x622b2e55
add eax, dword [0x1405015c0]
cmp ecx, eax
jne 0x1400abefc
test edx, edx
je 0x1400abf38
movzx eax, byte [0x140500096]
cmp al, 0xbb
je 0x1400abef4
mov cl, 0x8b
nop dword [rax + rax]
mov al, 0xf5
lock cmpxchg byte [0x140500096], cl
je 0x1400abf9c
cmp al, 0xbb
jne 0x1400abee0
lea rax, [0x140500090]
ret
test edx, edx
je 0x1400abf6c
movzx eax, byte [0x140500303]
cmp al, 0xa0
je 0x1400abf30
mov cl, 0x6e
nop dword [rax]
mov al, 0x1e
lock cmpxchg byte [0x140500303], cl
je 0x1400abff7
mov edx, r8d
xor dl, 0x91
add dl, byte [0x1405015c4]
cmp al, dl
jne 0x1400abf10
lea rax, [0x1405002f0]
ret
movzx eax, byte [0x1405002df]
cmp al, 0xc7
je 0x1400abf64
mov cl, 0xbc
nop word cs:[rax + rax]
mov al, 0x5d
lock cmpxchg byte [0x1405002df], cl
je 0x1400ac038
cmp al, 0xc7
jne 0x1400abf50
lea rax, [0x1405002d0]
ret
movzx eax, byte [0x1405001c3]
cmp al, 0x13
je 0x1400abf94
mov cl, 0xad
nop dword [rax]
mov al, 0x55
lock cmpxchg byte [0x1405001c3], cl
je 0x1400ac068
cmp al, 0x13
jne 0x1400abf80
lea rax, [0x1405001c0]
ret
xor eax, eax
lea rcx, [0x140500090]
lea rdx, [0x1404385c0]
xor r8d, 0x622b2e56
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x1405015c0]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 6
jl 0x1400abfc0
mov al, 0xbb
xchg byte [0x140500096], al
lea rax, [0x140500090]
ret
xor eax, eax
lea rcx, [0x1405002f0]
lea rdx, [0x140438800]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x12
jg 0x1400ac028
inc rax
jmp 0x1400ac010
mov al, 0xa0
xchg byte [0x140500303], al
lea rax, [0x1405002f0]
ret
xor eax, eax
lea rcx, [0x1405002d0]
lea rdx, [0x1404387e0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1400ac0a8
inc rax
jmp 0x1400ac050
xor eax, eax
lea rcx, [0x1405001c0]
lea rdx, [0x1404386e0]
nop dword [rax + rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
cmp r9d, 2
jg 0x1400ac0b8
inc rax
jmp 0x1400ac080
mov al, 0xc7
xchg byte [0x1405002df], al
lea rax, [0x1405002d0]
ret
xor r8b, 4
add r8b, byte [0x1405015c4]
xchg byte [0x1405001c3], r8b
lea rax, [0x1405001c0]
ret
Function at 0x1400ac280
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1400ac2bc
test edx, edx
je 0x1400ac2ec
movzx eax, byte [0x140500273]
cmp al, 0x53
je 0x1400ac2b4
mov cl, 0xe3
nop word [rax + rax]
mov al, 0x50
lock cmpxchg byte [0x140500273], cl
je 0x1400ac368
cmp al, 0x53
jne 0x1400ac2a0
lea rax, [0x140500250]
ret
test edx, edx
je 0x1400ac32c
movzx eax, byte [0x1405001f9]
cmp al, 0xa6
je 0x1400ac2e4
mov cl, 0xef
nop dword [rax]
mov al, 0xe2
lock cmpxchg byte [0x1405001f9], cl
je 0x1400ac3a8
cmp al, 0xa6
jne 0x1400ac2d0
lea rax, [0x1405001f0]
ret
movzx eax, byte [0x14050021e]
mov ecx, r8d
xor cl, 0xc2
add cl, byte [0x1405015c4]
cmp al, cl
je 0x1400ac324
mov cl, 0xaa
nop word cs:[rax + rax]
mov al, 0x6e
lock cmpxchg byte [0x14050021e], cl
je 0x1400ac3ec
cmp al, 0xea
jne 0x1400ac310
lea rax, [0x140500210]
ret
movzx eax, byte [0x140500299]
cmp al, 0x9a
je 0x1400ac360
mov cl, 0xd9
nop dword [rax]
mov al, 0xe9
lock cmpxchg byte [0x140500299], cl
je 0x1400ac480
mov edx, r8d
xor dl, 0x32
add dl, byte [0x1405015c4]
cmp al, dl
jne 0x1400ac340
lea rax, [0x140500290]
ret
xor eax, eax
lea rcx, [0x140500250]
lea rdx, [0x140438760]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1400ac398
inc rax
jmp 0x1400ac380
mov al, 0x53
xchg byte [0x140500273], al
lea rax, [0x140500250]
ret
xor eax, eax
lea rcx, [0x1405001f0]
lea rdx, [0x140438700]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1400ac470
inc rax
jmp 0x1400ac3c0
xor eax, eax
lea rcx, [0x140500210]
lea rdx, [0x140438720]
mov r10d, r8d
not r10d
mov r11d, r10d
and r11d, 0xcfe427ff
mov r9d, r8d
and r9d, 0x301bd800
or r9d, r11d
and r10d, 0xcfe427ca
and r8d, 0x301bd835
or r8d, r10d
nop word [rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
mov r11d, r10d
xor r11b, r10b
not r11b
and r11b, byte [rax + rcx]
xor r11b, r10b
mov byte [rax + rcx], r11b
mov r10d, dword [0x1405015c0]
add eax, r9d
add eax, r10d
add r10d, r8d
cmp eax, r10d
jl 0x1400ac430
mov al, 0xea
xchg byte [0x14050021e], al
lea rax, [0x140500210]
ret
mov al, 0xa6
xchg byte [0x1405001f9], al
lea rax, [0x1405001f0]
ret
xor eax, eax
lea rcx, [0x140500290]
lea rdx, [0x1404387a0]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1400ac4a8
inc rax
jmp 0x1400ac490
mov al, 0x9a
xchg byte [0x140500299], al
lea rax, [0x140500290]
ret
Function at 0x1400ac4f0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0xdffea33b
mov r9d, dword [0x1405015c0]
add r9d, eax
cmp ecx, r9d
jne 0x1400ac54c
add eax, dword [0x1405015c0]
cmp edx, eax
jne 0x1400ac5b8
movzx eax, byte [0x140500185]
cmp al, 0x4b
je 0x1400ac544
mov cl, 0xad
nop word [rax + rax]
mov al, 0xf0
lock cmpxchg byte [0x140500185], cl
je 0x1400ac646
cmp al, 0x4b
jne 0x1400ac530
lea rax, [0x140500170]
ret
test edx, edx
je 0x1400ac5ec
movzx eax, byte [0x14050034d]
nop dword [rax + rax]
cmp al, 0x52
je 0x1400ac63e
movzx ecx, byte [0x1405015c4]
mov eax, r8d
xor al, 0xbd
add al, cl
mov edx, r8d
xor dl, 0x75
add dl, cl
lock cmpxchg byte [0x14050034d], dl
jne 0x1400ac560
xor eax, eax
lea rcx, [0x140500340]
lea rdx, [0x140438850]
nop dword [rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xc
jg 0x1400ac61c
inc rax
jmp 0x1400ac5a0
movzx eax, byte [0x14050028f]
cmp al, 0x18
je 0x1400ac5e4
mov cl, 0x9c
nop word cs:[rax + rax]
mov al, 0xe5
lock cmpxchg byte [0x14050028f], cl
je 0x1400ac678
cmp al, 0x18
jne 0x1400ac5d0
lea rax, [0x140500280]
ret
movzx eax, byte [0x1405002ed]
cmp al, 0x65
je 0x1400ac614
mov cl, 0x51
nop dword [rax]
mov al, 0x84
lock cmpxchg byte [0x1405002ed], cl
je 0x1400ac6db
cmp al, 0x65
jne 0x1400ac600
lea rax, [0x1405002e0]
ret
mov eax, r8d
not al
xor r8b, 0x52
and al, 0xad
or r8b, al
not r8b
or r8b, al
add r8b, byte [0x1405015c4]
xchg byte [0x14050034d], r8b
lea rax, [0x140500340]
ret
xor eax, eax
lea rcx, [0x140500170]
lea rdx, [0x140438690]
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0x14
jg 0x1400ac6b1
inc rax
jmp 0x1400ac660
xor eax, eax
lea rcx, [0x140500280]
lea rdx, [0x140438790]
xor r8d, 0xdffea30a
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405015c0]
add r10d, r8d
cmp r9d, r10d
jge 0x1400ac6cb
inc rax
jmp 0x1400ac690
xor r8b, 0xa2
add r8b, byte [0x1405015c4]
xchg byte [0x140500185], r8b
lea rax, [0x140500170]
ret
mov al, 0x18
xchg byte [0x14050028f], al
lea rax, [0x140500280]
ret
xor edx, edx
lea rax, [0x1405002e0]
lea rcx, [0x1404387f0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 0xba4f740c
and edx, 0x3a4f740c
lea edx, [r8 + rdx*2]
add edx, 0x45b08bf5
cmp edx, 0xd
jl 0x1400ac6f0
mov al, 0x65
xchg byte [0x1405002ed], al
lea rax, [0x1405002e0]
ret
Function at 0x140125aa0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140575974]
cmp eax, 0x41
jg 0x140125ac0
call fcn.1403f8024
mov ecx, dword [0x140575974]
cmp ecx, 0x32
jl 0x140125aea
nop
call fcn.1403f8024
mov eax, dword [0x1405115cc]
mov ecx, eax
xor ecx, 0x5b3b6413
and ecx, eax
xor eax, 0xa4c49bec
add ecx, ecx
mov edx, eax
xor edx, ecx
and ecx, eax
add ecx, ecx
add ecx, edx
jne 0x140125ac0
jmp 0x140125aaf
add rsp, 0x28
ret

Function at 0x140125d90
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa4c49bec
add eax, dword [0x1405115cc]
cmp ecx, eax
jne 0x140125dcc
test edx, edx
je 0x140125e16
movzx eax, byte [0x140504643]
cmp al, 0xa
je 0x140125dc4
mov cl, 0xfa
mov al, 0xe
lock cmpxchg byte [0x140504643], cl
je 0x140125e8c
cmp al, 0xa
jne 0x140125db0
lea rax, [0x140504640]
ret
test edx, edx
je 0x140125e56
movzx eax, byte [0x1405045a6]
movzx ecx, byte [0x1405115c8]
add cl, 6
cmp al, cl
je 0x140125e0e
mov cl, 0x3d
nop dword [rax + rax]
mov al, 0x74
lock cmpxchg byte [0x1405045a6], cl
je 0x140125ecf
movzx edx, byte [0x1405115c8]
add dl, 6
cmp al, dl
jne 0x140125df0
lea rax, [0x140504590]
ret
movzx eax, byte [0x1405046a3]
cmp al, 0x1c
je 0x140125e4e
mov cl, 0xe2
nop word cs:[rax + rax]
mov al, 0xf
lock cmpxchg byte [0x1405046a3], cl
je 0x140125f08
movzx edx, byte [0x1405115c8]
add dl, 0xab
cmp al, dl
jne 0x140125e30
lea rax, [0x140504680]
ret
movzx eax, byte [0x140504505]
cmp al, 0xd1
je 0x140125e84
mov cl, 0x3b
nop word cs:[rax + rax]
mov al, 0x9b
lock cmpxchg byte [0x140504505], cl
je 0x140125f4f
cmp al, 0xd1
jne 0x140125e70
lea rax, [0x1405044f0]
ret
xor edx, edx
lea rax, [0x140504640]
lea rcx, [0x14043a9f0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 3
jl 0x140125ea0
mov al, 0xa
xchg byte [0x140504643], al
lea rax, [0x140504640]
ret
xor eax, eax
lea rcx, [0x140504590]
lea rdx, [0x14043a950]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x15
jg 0x140125ef8
inc rax
jmp 0x140125ee0
mov al, 0x77
xchg byte [0x1405045a6], al
lea rax, [0x140504590]
ret
xor edx, edx
lea rax, [0x140504680]
lea rcx, [0x14043aa30]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x23
jl 0x140125f20
mov al, 0x1c
xchg byte [0x1405046a3], al
lea rax, [0x140504680]
ret
xor eax, eax
lea rcx, [0x1405044f0]
lea rdx, [0x14043a8b0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140125f78
inc rax
jmp 0x140125f60
mov al, 0xd1
xchg byte [0x140504505], al
lea rax, [0x1405044f0]
ret
Function at 0x140125fa0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140125fdc
test edx, edx
je 0x140126022
movzx eax, byte [0x140504561]
cmp al, 0xfa
je 0x140125fd4
mov cl, 0xdd
nop word cs:[rax + rax]
mov al, pe_nt_image_headers64
lock cmpxchg byte [0x140504561], cl
je 0x14012607c
cmp al, 0xfa
jne 0x140125fc0
lea rax, [0x140504550]
ret
test edx, edx
je 0x14012604c
movzx eax, byte [0x140504585]
cmp al, 0x51
je 0x14012601a
mov cl, 6
nop dword [rax]
mov al, 0xca
lock cmpxchg byte [0x140504585], cl
je 0x1401260b8
movzx edx, byte [0x1405115c8]
mov r8d, edx
xor r8b, 0xe0
and dl, 0x60
add dl, dl
add dl, r8b
cmp al, dl
jne 0x140125ff0
lea rax, [0x140504570]
ret
movzx eax, byte [0x1405046ef]
cmp al, 0x2d
je 0x140126044
mov cl, 0xb
nop
mov al, 0xf2
lock cmpxchg byte [0x1405046ef], cl
je 0x1401260f1
cmp al, 0x2d
jne 0x140126030
lea rax, [0x1405046e0]
ret
movzx eax, byte [0x1405045f6]
cmp al, 0x94
je 0x140126074
mov cl, 0xca
nop dword [rax]
mov al, 0x87
lock cmpxchg byte [0x1405045f6], cl
je 0x14012615f
cmp al, 0x94
jne 0x140126060
lea rax, [0x1405045e0]
ret
xor eax, eax
lea rcx, [0x140504550]
lea rdx, [0x14043a910]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x1401260a8
inc rax
jmp 0x140126090
mov al, 0xfa
xchg byte [0x140504561], al
lea rax, [0x140504550]
ret
xor eax, eax
lea rcx, [0x140504570]
lea rdx, [0x14043a930]
mov r8d, 0xa4c49c01
nop
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405115cc]
add r10d, r8d
cmp r9d, r10d
jge 0x14012614f
inc rax
jmp 0x1401260d0
xor edx, edx
lea rax, [0x1405046e0]
lea rcx, [0x14043aa90]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x140126110
mov al, 0x2d
xchg byte [0x1405046ef], al
lea rax, [0x1405046e0]
ret
mov al, 0x51
xchg byte [0x140504585], al
lea rax, [0x140504570]
ret
xor r8d, r8d
lea rax, [0x1405045e0]
lea rcx, [0x14043a9a0]
mov edx, 0xa4c49bed
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [r8 + rax]
xor r10b, r9b
mov byte [r8 + rax], r10b
mov r9d, dword [0x1405115cc]
add r9d, edx
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r8d, [r10 + r9*2]
cmp r8d, 0x16
jl 0x140126180
mov al, 0x94
xchg byte [0x1405045f6], al
lea rax, [0x1405045e0]
ret
Function at 0x1401261f0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14012622c
test edx, edx
je 0x14012626c
movzx eax, byte [0x140504603]
cmp al, 0xa4
je 0x140126224
mov cl, 0x5f
nop word cs:[rax + rax]
mov al, 0x3e
lock cmpxchg byte [0x140504603], cl
je 0x14012630c
cmp al, 0xa4
jne 0x140126210
lea rax, [0x140504600]
ret
test edx, edx
je 0x1401262df
movzx eax, byte [0x1405044e0]
cmp al, 0x83
je 0x140126264
mov cl, 0x55
nop word cs:[rax + rax]
mov al, 0x9b
lock cmpxchg byte [0x1405044e0], cl
je 0x140126348
cmp al, 0x83
jne 0x140126250
lea rax, [0x1405044d0]
ret
movzx eax, byte [0x140504639]
nop word cs:[rax + rax]
cmp al, 0x3b
je 0x1401262d7
movzx ecx, byte [0x1405115c8]
lea eax, [rcx + 0x26]
add cl, 0xa2
lock cmpxchg byte [0x140504639], cl
jne 0x140126280
xor edx, edx
lea rax, [0x140504630]
lea rcx, [0x14043a9e0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 9
jl 0x1401262b0
mov al, 0x3b
xchg byte [0x140504639], al
lea rax, [0x140504630]
ret
movzx eax, byte [0x1405044c8]
cmp al, 0x85
je 0x140126304
mov cl, 0x27
nop dword [rax]
mov al, 0xec
lock cmpxchg byte [0x1405044c8], cl
je 0x140126388
cmp al, 0x85
jne 0x1401262f0
lea rax, [0x1405044c0]
ret
xor eax, eax
lea rcx, [0x140504600]
lea rdx, [0x14043a9c0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x140126338
inc rax
jmp 0x140126320
mov al, 0xa4
xchg byte [0x140504603], al
lea rax, [0x140504600]
ret
xor eax, eax
lea rcx, [0x1405044d0]
lea rdx, [0x14043a8a0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140126378
inc rax
jmp 0x140126360
mov al, 0x83
xchg byte [0x1405044e0], al
lea rax, [0x1405044d0]
ret
xor eax, eax
lea rcx, [0x1405044c0]
lea rdx, [0x14043a890]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
mov r9d, dword [0x1405115cc]
mov r10d, r9d
xor r10d, 0xa4c49bf4
and r9d, 0x24c49bf4
lea r9d, [r10 + r9*2]
cmp r8d, r9d
jge 0x1401263d3
inc rax
jmp 0x1401263a0
mov al, 0x85
xchg byte [0x1405044c8], al
lea rax, [0x1405044c0]
ret