joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a6350
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1401a638c
test edx, edx
je 0x1401a63f0
movzx eax, byte [0x1405444a1]
cmp al, 2
je 0x1401a6384
mov cl, 0x76
nop
mov al, 0x15
lock cmpxchg byte [0x1405444a1], cl
je 0x1401a6468
cmp al, 2
jne 0x1401a6370
lea rax, [0x140544490]
ret
mov eax, r8d
xor eax, 0xdb5a3a28
add eax, dword [0x140546f48]
cmp edx, eax
jne 0x1401a642c
movzx eax, byte [0x14054445d]
mov ecx, r8d
xor cl, 0x94
add cl, byte [0x140546f58]
cmp al, cl
je 0x1401a63e8
nop dword [rax]
movzx ecx, byte [0x140546f58]
mov eax, r8d
xor al, 0xda
add al, cl
mov edx, r8d
xor dl, 0x9a
add dl, cl
lock cmpxchg byte [0x14054445d], dl
je 0x1401a6521
cmp al, 0x23
jne 0x1401a63c0
lea rax, [0x140544450]
ret
movzx eax, byte [0x1405443fd]
mov ecx, r8d
xor cl, 0xde
add cl, byte [0x140546f58]
cmp al, cl
je 0x1401a6424
mov cl, 0x61
nop dword [rax]
mov al, 0x15
lock cmpxchg byte [0x1405443fd], cl
je 0x1401a64a8
cmp al, 0x6d
jne 0x1401a6410
lea rax, [0x1405443f0]
ret
movzx eax, byte [0x1405442fd]
cmp al, 0x52
je 0x1401a6460
mov cl, 0x1c
nop dword [rax]
mov al, 0x86
lock cmpxchg byte [0x1405442fd], cl
je 0x1401a656c
mov edx, r8d
xor dl, 0xc3
add dl, byte [0x140546f58]
cmp al, dl
jne 0x1401a6440
lea rax, [0x1405442f0]
ret
xor eax, eax
lea rcx, [0x140544490]
lea rdx, [0x140463090]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x1401a6498
inc rax
jmp 0x1401a6480
mov al, 2
xchg byte [0x1405444a1], al
lea rax, [0x140544490]
ret
xor eax, eax
lea rcx, [0x1405443f0]
lea rdx, [0x140462ff0]
mov r9d, r8d
xor r9d, 0xdb5a3a29
nop word cs:[rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
mov r11d, r10d
xor r11b, r10b
not r11b
and r11b, byte [rax + rcx]
xor r11b, r10b
mov byte [rax + rcx], r11b
mov r10d, dword [0x140546f48]
mov r11d, r9d
xor r11d, r10d
and r10d, r9d
lea r10d, [r11 + r10*2]
add eax, r10d
cmp eax, 0xd
jl 0x1401a64d0
xor r8b, 0xde
add r8b, byte [0x140546f58]
xchg byte [0x1405443fd], r8b
lea rax, [0x1405443f0]
ret
xor eax, eax
lea rcx, [0x140544450]
lea rdx, [0x140463050]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401a65af
inc rax
jmp 0x1401a6540
xor edx, edx
lea rax, [0x1405442f0]
lea rcx, [0x140462ef0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x1401a6580
mov al, 0x52
xchg byte [0x1405442fd], al
lea rax, [0x1405442f0]
ret
mov al, 0x23
xchg byte [0x14054445d], al
lea rax, [0x140544450]
ret
Function at 0x1401c6e00
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401c6e6b
mov eax, dword [0x140547c10]
mov ecx, eax
xor ecx, 0xeafc5318
and eax, 0x6afc5318
lea eax, [rcx + rax*2]
cmp edx, eax
jne 0x1401c6e9c
movzx eax, byte [0x1405478ff]
cmp al, 0xc
je 0x1401c6e63
nop dword [rax]
movzx ecx, byte [0x140547c20]
mov edx, ecx
xor dl, 0x97
mov eax, ecx
and al, 0x17
add al, al
add al, dl
add cl, 0xe2
lock cmpxchg byte [0x1405478ff], cl
je 0x1401c6efc
movzx ecx, byte [0x140547c20]
add cl, 0xdf
cmp al, cl
jne 0x1401c6e30
lea rax, [0x1405478f0]
ret
test edx, edx
je 0x1401c6ecc
movzx eax, byte [0x140547909]
cmp al, 0xed
je 0x1401c6e94
mov cl, 0x4e
nop dword [rax]
mov al, 0x5f
lock cmpxchg byte [0x140547909], cl
je 0x1401c6f98
cmp al, 0xed
jne 0x1401c6e80
lea rax, [0x140547900]
ret
movzx eax, byte [0x140547816]
cmp al, 0x6c
je 0x1401c6ec4
mov cl, 0x3d
nop dword [rax]
mov al, 0xff
lock cmpxchg byte [0x140547816], cl
je 0x1401c6f5a
cmp al, 0x6c
jne 0x1401c6eb0
lea rax, [0x140547810]
ret
movzx eax, byte [0x140547841]
cmp al, 0x33
je 0x1401c6ef4
mov cl, 0xa4
nop dword [rax]
mov al, 0xf6
lock cmpxchg byte [0x140547841], cl
je 0x1401c6fd8
cmp al, 0x33
jne 0x1401c6ee0
lea rax, [0x140547830]
ret
xor r8d, r8d
lea rax, [0x1405478f0]
lea rcx, [0x140463490]
mov edx, 0xeafc5327
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
xor byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x140547c10]
add r9d, edx
cmp r8d, r9d
jl 0x1401c6f20
mov al, 0xc
xchg byte [0x1405478ff], al
lea rax, [0x1405478f0]
ret
xor eax, eax
lea rcx, [0x140547810]
lea rdx, [0x1404633c0]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x1401c6f88
inc rax
jmp 0x1401c6f70
mov al, 0x6c
xchg byte [0x140547816], al
lea rax, [0x140547810]
ret
xor eax, eax
lea rcx, [0x140547900]
lea rdx, [0x1404634a0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1401c6fc8
inc rax
jmp 0x1401c6fb0
mov al, 0xed
xchg byte [0x140547909], al
lea rax, [0x140547900]
ret
xor edx, edx
lea rax, [0x140547830]
lea rcx, [0x1404633e0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x140547c10]
add edx, r8d
add edx, 0xeafc5319
add r8d, 0xeafc5329
cmp edx, r8d
jl 0x1401c6ff0
mov al, 0x33
xchg byte [0x140547841], al
lea rax, [0x140547830]
ret
Function at 0x1401c7030
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov esi, r8d
test ecx, ecx
je 0x1401c7089
movzx eax, byte [0x140547827]
movzx ecx, byte [0x140547c20]
add cl, 0x8e
cmp al, cl
je 0x1401c7190
mov cl, 0x9b
nop word cs:[rax + rax]
mov al, 0xf1
lock cmpxchg byte [0x140547827], cl
je 0x1401c7109
cmp al, 0xbb
jne 0x1401c7070
jmp 0x1401c7190
movzx eax, byte [0x1405478a0]
cmp al, 0xeb
je 0x1401c70fd
movzx ecx, byte [0x140547c20]
lea eax, [rcx + 0x1b]
add cl, 0x6d
lock cmpxchg byte [0x1405478a0], cl
jne 0x1401c7090
xor eax, eax
lea rbx, [0x140547890]
lea r14, [0x140463440]
xor esi, 0x1eeb498d
lea rdi, [rsp + 0x40]
nop word cs:[rax + rax]
movsxd rcx, eax
movzx eax, byte [rcx + r14]
add byte [rcx + rbx], al
mov rdx, rdi
mov r8d, esi
mov r9d, 0xc5cff884
call fcn.1401c7220
mov eax, dword [rsp + 0x40]
cmp eax, 0x10
jl 0x1401c70d0
mov al, 0xeb
xchg byte [0x1405478a0], al
lea rax, [0x140547890]
jmp 0x1401c7197
xor eax, eax
lea r12, [0x140547820]
mov edi, esi
xor edi, 0x8b051812
mov ebp, 0x392db672
lea rbx, [rsp + 0x3f]
lea r13, [0x1404633d0]
xor esi, 0x19aa4025
lea r14, [rsp + 0x44]
nop word cs:[rax + rax]
movsxd r15, eax
lea rcx, [r12 + r15]
mov r9d, dword [0x140547c10]
add r9d, ebp
mov rdx, rbx
mov r8d, edi
call fcn.1400b2b80
movzx edx, byte [rsp + 0x3f]
xor dl, byte [r15 + r13]
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x28], 0x92ccc9fd
mov rcx, r15
mov r8d, r15d
mov r9, r14
call fcn.1401c71f0
mov eax, dword [rsp + 0x44]
cmp eax, 7
jl 0x1401c7140
mov al, 0xbb
xchg byte [0x140547827], al
lea rax, [0x140547820]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401cfeb0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1401cfefc
mov eax, r8d
xor eax, 0x996d5a8
add eax, dword [0x140548520]
cmp edx, eax
jne 0x1401cff34
movzx eax, byte [0x1405481c5]
cmp al, 0xa7
je 0x1401cfef4
mov cl, 0xe9
nop dword [rax + rax]
mov al, 0x82
lock cmpxchg byte [0x1405481c5], cl
je 0x1401cffc2
cmp al, 0xa7
jne 0x1401cfee0
lea rax, [0x1405481c0]
ret
movzx eax, byte [0x14054824e]
cmp al, 0x9e
je 0x1401cff2c
mov cl, 0x98
nop dword [rax]
mov al, 0x67
lock cmpxchg byte [0x14054824e], cl
je 0x1401cff78
mov edx, r8d
xor dl, 0xa4
add dl, byte [0x140548524]
cmp al, dl
jne 0x1401cff10
lea rax, [0x140548240]
ret
movzx eax, byte [0x1405481d4]
cmp al, 0x67
je 0x1401cff70
mov cl, 0x8c
nop word cs:[rax + rax]
mov al, 0x5c
lock cmpxchg byte [0x1405481d4], cl
je 0x1401cfff8
mov edx, r8d
xor dl, 0x6d
add dl, byte [0x140548524]
cmp al, dl
jne 0x1401cff50
lea rax, [0x1405481d0]
ret
xor eax, eax
lea rcx, [0x140548240]
lea rdx, [0x140463920]
nop dword [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xd
jg 0x1401cffa8
inc rax
jmp 0x1401cff90
xor r8b, 0xa4
add r8b, byte [0x140548524]
xchg byte [0x14054824e], r8b
lea rax, [0x140548240]
ret
xor eax, eax
lea rcx, [0x1405481c0]
lea rdx, [0x1404638b0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x1401d003f
inc rax
jmp 0x1401cffe0
xor edx, edx
lea rax, [0x1405481d0]
lea rcx, [0x1404638c0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 4
jl 0x1401d0010
mov al, 0x67
xchg byte [0x1405481d4], al
lea rax, [0x1405481d0]
ret
mov al, 0xa7
xchg byte [0x1405481c5], al
lea rax, [0x1405481c0]
ret
Function at 0x1401d5540
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x218
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x190], 0xfffffffffffffffe
cmp qword [rcx + 0x18], 0
je 0x1401d56d4
mov rsi, rcx
lea rbx, [0x140463c20]
mov qword [rbp + 0x108], rbx
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x148], 0xf
mov byte [rbp + 0x130], 0
lea rax, [0x14045cff8]
mov qword [rbp + 0x128], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x158], xmm0
mov qword [rbp + 0x168], 0
mov byte [rbp + 0x170], 1
mov dword [rbp + 0x174], 1
movups xmmword [rbp + 0x178], xmm0
mov qword [rbp + 0x188], 0
lea rax, [0x14045eea8]
mov qword [rbp + 0x150], rax
mov byte [rbp + 0x110], 0
mov qword [rbp + 0x120], 0
mov qword [rbp + 0x118], rdx
mov rax, qword [rcx + 0x20]
mov rcx, qword [rax + 8]
cmp byte [rcx + 0x19], 0
mov r14, rax
jne 0x1401d5658
mov r14, rax
nop dword [rax]
lea r8, [rcx + 0x10]
cmp qword [rcx + 0x30], rdx
cmovae r14, rcx
cmovae r8, rcx
mov rcx, qword [r8]
movzx r8d, byte [0x14054a000]
xor r9d, r9d
sub r9b, r8b
mov r8d, r9d
xor r8b, 0xf7
and r9b, 0x77
add r9b, r9b
add r9b, r8b
add r9b, byte [rcx + 0x19]
je 0x1401d5620
cmp byte [r14 + 0x19], 0
je 0x1401d56e9
xor edi, edi
lea rcx, [rbp + 0x150]
mov qword [rbp + 0x108], rbx
call fcn.140075050
mov rax, qword [rbp + 0x148]
cmp rax, 0x10
jb 0x1401d56d6
mov rcx, qword [rbp + 0x130]
mov rdx, rax
xor rdx, 1
mov r8d, eax
and r8d, 1
lea rdx, [rdx + r8*2]
cmp rdx, 0x1000
jb 0x1401d56cd
mov r8, qword [rcx - 8]
sub rcx, r8
add rcx, 0xfffffffffffffff8
cmp rcx, 0x20
jae 0x1401d57ff
mov rcx, rax
xor rcx, 0x28
and eax, 0x28
lea rdx, [rcx + rax*2]
mov rcx, r8
call fcn.1400ad790
jmp 0x1401d56d6
xor edi, edi
mov rax, rdi
add rsp, 0x218
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
xor edi, edi
cmp qword [r14 + 0x30], rdx
ja 0x1401d5665
cmp r14, rax
je 0x1401d5665
cmp byte [r14 + 0x28], 0
je 0x1401d5717
call fcn.14007fbe0
mov rcx, rax
call fcn.140150ed0
jmp 0x1401d57e9
movzx eax, byte [0x14054a000]
mov ecx, eax
xor cl, 0x76
and cl, al
xor al, 9
add cl, cl
add cl, al
cmp byte [rsi + 8], cl
jne 0x1401d5763
mov rcx, qword [rsi + 0x10]
mov eax, dword [rsi + 0x34]
mov r9d, dword [rsi + 0x30]
lea rdx, [rsi + 0x38]
mov dword [rsp + 0x20], eax
mov r8d, 0x10
call fcn.1401325d0
test al, al
jne 0x1401d5757
call fcn.140172480
movzx eax, byte [0x14054a000]
add al, 0xa
mov byte [rsi + 8], al
mov byte [rbp - 0x50], 0
lea r15, [rbp - 0x4c]
mov r8d, 0x150
mov rcx, r15
xor edx, edx
call fcn.140440780
mov rcx, r15
xor edx, edx
call fcn.1402b7f80
add rsi, 0x38
lea rdi, [rbp + 4]
movzx r9d, byte [rbp - 0x50]
add r9d, dword [0x1405a7280]
add r9d, dword [0x1405a7284]
mov qword [rsp + 0x20], rdi
mov r8d, 0x10
mov rcx, r15
mov rdx, rsi
call fcn.1402b8130
lea rax, [rbp - 0x4c]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov rdx, qword [r14 + 0x78]
movsxd r8, edx
test rdx, rdx
je 0x1401d57d0
mov rdx, qword [r14 + 0x70]
mov rcx, rax
mov r9, rdx
call fcn.1402b8af0
mov byte [r14 + 0x28], 1
lea rcx, [rbp - 0x4c]
call fcn.1402b83c0
mov rdi, qword [r14 + 0x78]
test rdi, rdi
je 0x1401d5665
mov rdi, qword [r14 + 0x70]
jmp 0x1401d5665
call fcn.1403f89dc
int3
Function at 0x1401d6c80
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401d6cd9
test edx, edx
je 0x1401d6d53
movzx eax, byte [0x140549dc0]
cmp al, 0xd1
je 0x1401d6cd1
mov cl, 0xd7
nop dword [rax]
mov al, 0x6b
lock cmpxchg byte [0x140549dc0], cl
je 0x1401d6dcc
movzx edx, byte [0x14054a000]
mov r8d, edx
xor r8b, 0xda
not dl
and dl, 0x25
or dl, r8b
not dl
add dl, dl
add dl, r8b
cmp al, dl
jne 0x1401d6ca0
lea rax, [0x140549db0]
ret
test edx, edx
je 0x1401d6d96
movzx eax, byte [0x140549e23]
nop dword [rax + rax]
cmp al, 0x26
je 0x1401d6e23
movzx ecx, byte [0x14054a000]
lea eax, [rcx + 0x79]
add cl, 0x92
lock cmpxchg byte [0x140549e23], cl
jne 0x1401d6cf0
xor eax, eax
lea rcx, [0x140549e20]
lea rdx, [0x140463b90]
nop
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r8b
not r9b
mov r10d, r8d
xor r10b, r9b
or r9b, r8b
and r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1401d6e1b
inc rax
jmp 0x1401d6d20
movzx eax, byte [0x140549e79]
movzx ecx, byte [0x14054a000]
add cl, 0x1f
cmp al, cl
je 0x1401d6d8e
mov cl, 0xd3
nop word [rax + rax]
mov al, 0xa1
lock cmpxchg byte [0x140549e79], cl
je 0x1401d6e2b
movzx edx, byte [0x14054a000]
add dl, 0x1f
cmp al, dl
jne 0x1401d6d70
lea rax, [0x140549e70]
ret
movzx eax, byte [0x140549e8d]
cmp al, 0x83
je 0x1401d6dc4
mov cl, 0xb7
nop word cs:[rax + rax]
mov al, 0x54
lock cmpxchg byte [0x140549e8d], cl
je 0x1401d6e68
cmp al, 0x83
jne 0x1401d6db0
lea rax, [0x140549e80]
ret
xor edx, edx
lea rax, [0x140549db0]
lea rcx, [0x140463b40]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0xf8c21a1d
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x73de5e3
cmp edx, 0x10
jl 0x1401d6de0
mov al, 0xd1
xchg byte [0x140549dc0], al
lea rax, [0x140549db0]
ret
mov al, 0x26
xchg byte [0x140549e23], al
lea rax, [0x140549e20]
ret
xor eax, eax
lea rcx, [0x140549e70]
lea rdx, [0x140463be0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1401d6e58
inc rax
jmp 0x1401d6e40
mov al, 0x16
xchg byte [0x140549e79], al
lea rax, [0x140549e70]
ret
xor eax, eax
lea rcx, [0x140549e80]
lea rdx, [0x140463bf0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401d6ea8
inc rax
jmp 0x1401d6e80
mov al, 0x83
xchg byte [0x140549e8d], al
lea rax, [0x140549e80]
ret
Function at 0x1401db310
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401db35c
mov eax, 0x1440fe9b
add eax, dword [0x14054aa94]
cmp edx, eax
jne 0x1401db3bc
movzx eax, byte [0x14054a9f9]
cmp al, 0x73
je 0x1401db354
mov cl, 0x98
nop word cs:[rax + rax]
mov al, 0xe7
lock cmpxchg byte [0x14054a9f9], cl
je 0x1401db42c
cmp al, 0x73
jne 0x1401db340
lea rax, [0x14054a9f0]
ret
test edx, edx
je 0x1401db403
movzx eax, byte [0x14054a9d3]
nop dword [rax + rax]
cmp al, 0xe7
je 0x1401db4d9
movzx ecx, byte [0x14054aa90]
lea eax, [rcx + 0x15]
add cl, 0x61
lock cmpxchg byte [0x14054a9d3], cl
jne 0x1401db370
xor eax, eax
lea rcx, [0x14054a9b0]
lea rdx, [0x140464000]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1401db4d1
inc rax
jmp 0x1401db3a0
movzx eax, byte [0x14054a9ef]
movzx ecx, byte [0x14054aa90]
add cl, 0xf1
cmp al, cl
je 0x1401db3fb
nop word cs:[rax + rax]
movzx ecx, byte [0x14054aa90]
lea eax, [rcx + 0x5d]
add cl, 0x51
lock cmpxchg byte [0x14054a9ef], cl
je 0x1401db468
cmp al, 0xe0
jne 0x1401db3e0
lea rax, [0x14054a9e0]
ret
movzx eax, byte [0x14054a939]
cmp al, 0xf3
je 0x1401db424
mov cl, 0xff
mov al, 0x1f
lock cmpxchg byte [0x14054a939], cl
je 0x1401db4e1
cmp al, 0xf3
jne 0x1401db410
lea rax, [0x14054a910]
ret
xor eax, eax
lea rcx, [0x14054a9f0]
lea rdx, [0x140464040]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1401db4c1
inc rax
jmp 0x1401db440
xor edx, edx
lea rax, [0x14054a9e0]
lea rcx, [0x140464030]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x14054aa94]
add edx, r8d
add edx, 0x1440fe9c
cmp edx, 0xf
jl 0x1401db480
mov al, pe_nt_image_headers64
xchg byte [0x14054a9ef], al
lea rax, [0x14054a9e0]
ret
mov al, 0x73
xchg byte [0x14054a9f9], al
lea rax, [0x14054a9f0]
ret
mov al, 0xe7
xchg byte [0x14054a9d3], al
lea rax, [0x14054a9b0]
ret
xor eax, eax
lea rcx, [0x14054a910]
lea rdx, [0x140463f70]
mov r8d, 0x1440fec4
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14054aa94]
add r10d, r8d
cmp r9d, r10d
jge 0x1401db521
inc rax
jmp 0x1401db500
mov al, 0xf3
xchg byte [0x14054a939], al
lea rax, [0x14054a910]
ret
Function at 0x1401e22b0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401e2321
movzx eax, byte [0x14054b365]
nop dword [rax + rax]
cmp al, 0x27
je 0x1401e235c
movzx ecx, byte [0x14054b428]
mov eax, r9d
xor al, 0xca
add al, cl
mov edx, r9d
xor dl, 0xa2
add dl, cl
lock cmpxchg byte [0x14054b365], dl
jne 0x1401e22c0
xor eax, eax
lea rcx, [0x14054b350]
lea rdx, [0x1404643d0]
xor r9d, 0xdf90263c
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
mov r10d, dword [0x14054b42c]
add r10d, r9d
cmp r8d, r10d
jge 0x1401e2354
inc rax
jmp 0x1401e2300
movzx eax, byte [0x14054b2f3]
cmp al, 0x97
je 0x1401e234c
mov cl, 0x56
nop
mov al, 0x4e
lock cmpxchg byte [0x14054b2f3], cl
je 0x1401e2364
mov edx, r9d
xor dl, 0x74
add dl, byte [0x14054b428]
cmp al, dl
jne 0x1401e2330
lea rax, [0x14054b2d0]
ret
mov al, 0x27
xchg byte [0x14054b365], al
lea rax, [0x14054b350]
ret
xor edx, edx
lea rax, [0x14054b2d0]
lea rcx, [0x140464350]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x23
jl 0x1401e2380
mov al, 0x97
xchg byte [0x14054b2f3], al
lea rax, [0x14054b2d0]
ret
Function at 0x1401eedc0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rcx + 0x68], xmm0
movups xmmword [rcx + 0x58], xmm0
movups xmmword [rcx + 0x48], xmm0
movups xmmword [rcx + 0x38], xmm0
movups xmmword [rcx + 0x28], xmm0
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 8], xmm0
mov rdi, qword [rcx + 0x78]
mov rbx, qword [rcx + 0x80]
cmp rdi, rbx
je 0x1401eee34
nop dword [rax]
mov eax, dword [0x14054d5a0]
lea edx, [rax + 0x381efbde]
mov ecx, eax
xor ecx, 0x10afa4d4
not eax
and eax, 0x6f505b2b
or eax, ecx
not eax
lea r8d, [rcx + rax*2]
mov rcx, rdi
call fcn.1401f0df0
add rdi, 0x40
cmp rdi, rbx
jne 0x1401eee00
mov rax, qword [rsi + 0x78]
mov qword [rsi + 0x80], rax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1401f08c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
test ecx, ecx
je 0x1401f08f9
test edx, edx
je 0x1401f09c4
movzx eax, byte [0x14054d1f0]
cmp al, 0xae
je 0x1401f0a89
mov cl, 0x90
nop
mov al, 0xb4
lock cmpxchg byte [0x14054d1f0], cl
je 0x1401f0a39
cmp al, 0xae
jne 0x1401f08e0
jmp 0x1401f0a89
test edx, edx
je 0x1401f09f9
movzx eax, byte [0x14054d135]
nop dword [rax + rax]
cmp al, 0xd
je 0x1401f09b8
movzx ecx, byte [0x14054d5b0]
lea eax, [rcx - 0x37]
mov edx, ecx
xor dl, 0xd2
and cl, 0x52
add cl, cl
add cl, dl
lock cmpxchg byte [0x14054d135], cl
jne 0x1401f0910
xor edx, edx
lea rax, [0x14054d120]
lea rcx, [0x140464fe0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x14054d5a0]
lea r9d, [r8 + 0x6e995980]
mov r10d, edx
not r10d
mov r11d, 0x9166a67f
sub r11d, r8d
mov esi, edx
and esi, r11d
and r11d, r10d
and r10d, r9d
or esi, r10d
xor edx, r9d
or r11d, edx
not r11d
lea edx, [rsi + r11*2]
add r8d, 0x6e995994
cmp edx, r8d
jl 0x1401f0950
mov al, 0xd
xchg byte [0x14054d135], al
lea rax, [0x14054d120]
jmp 0x1401f0b46
movzx eax, byte [0x14054d1c0]
cmp al, 0x8e
je 0x1401f0ad0
mov cl, 0x1b
nop word cs:[rax + rax]
mov al, 0x70
lock cmpxchg byte [0x14054d1c0], cl
je 0x1401f0a95
cmp al, 0x8e
jne 0x1401f09e0
jmp 0x1401f0ad0
movzx eax, byte [0x14054d0a2]
movzx ecx, byte [0x14054d5b0]
add cl, 0xfb
cmp al, cl
je 0x1401f0b3f
mov cl, 0xcf
nop word cs:[rax + rax]
mov al, 0x1b
lock cmpxchg byte [0x14054d0a2], cl
je 0x1401f0ad9
cmp al, 0x4c
jne 0x1401f0a20
jmp 0x1401f0b3f
xor edx, edx
lea rax, [0x14054d1e0]
lea rcx, [0x140465090]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x14054d5a0]
add edx, r8d
add edx, 0x6e995980
cmp edx, 0x10
jl 0x1401f0a50
mov al, 0xae
xchg byte [0x14054d1f0], al
lea rax, [0x14054d1e0]
jmp 0x1401f0b46
xor eax, eax
lea rcx, [0x14054d1b0]
lea rdx, [0x140465070]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1401f0ac8
inc rax
jmp 0x1401f0ab0
mov al, 0x8e
xchg byte [0x14054d1c0], al
lea rax, [0x14054d1b0]
jmp 0x1401f0b46
xor eax, eax
lea rcx, [0x14054d0a0]
lea rdx, [0x140464f70]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
mov r11d, r10d
xor r11b, r9b
not r9b
mov ebx, r8d
and bl, r9b
or bl, r11b
not bl
xor r9b, r10b
and r9b, r8b
or r9b, bl
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x1401f0b30
inc rax
jmp 0x1401f0af0
movzx eax, byte [0x14054d5b0]
add al, 0xfb
xchg byte [0x14054d0a2], al
lea rax, [0x14054d0a0]
pop rbx
pop rsi
ret
Function at 0x1402089b0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1402089ec
test edx, edx
je 0x140208a1c
movzx eax, byte [0x14054e5fd]
cmp al, 0x7d
je 0x1402089e4
mov cl, 0xef
nop word cs:[rax + rax]
mov al, 0xeb
lock cmpxchg byte [0x14054e5fd], cl
je 0x140208a8c
cmp al, 0x7d
jne 0x1402089d0
lea rax, [0x14054e5f0]
ret
test edx, edx
je 0x140208a5c
movzx eax, byte [0x14054e70d]
cmp al, 0xad
je 0x140208a14
mov cl, 0xda
nop dword [rax]
mov al, 0x89
lock cmpxchg byte [0x14054e70d], cl
je 0x140208ac8
cmp al, 0xad
jne 0x140208a00
lea rax, [0x14054e700]
ret
movzx eax, byte [0x14054e0e0]
movzx ecx, byte [0x14054f308]
add cl, 0xac
cmp al, cl
je 0x140208a54
mov cl, 0xe8
nop word cs:[rax + rax]
mov al, 0x14
lock cmpxchg byte [0x14054e0e0], cl
je 0x140208af8
cmp al, 0xe6
jne 0x140208a40
lea rax, [0x14054e0d0]
ret
movzx eax, byte [0x14054eaad]
cmp al, 0xf7
je 0x140208a84
mov cl, 0x60
nop dword [rax]
mov al, 0xcf
lock cmpxchg byte [0x14054eaad], cl
je 0x140208b48
cmp al, 0xf7
jne 0x140208a70
lea rax, [0x14054eaa0]
ret
xor eax, eax
lea rcx, [0x14054e5f0]
lea rdx, [0x140465fd0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140208ab8
inc rax
jmp 0x140208aa0
mov al, 0x7d
xchg byte [0x14054e5fd], al
lea rax, [0x14054e5f0]
ret
xor eax, eax
lea rcx, [0x14054e700]
lea rdx, [0x1404660d0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140208b28
inc rax
jmp 0x140208ae0
xor eax, eax
lea rcx, [0x14054e0d0]
lea rdx, [0x140465ad0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140208b38
inc rax
jmp 0x140208b10
mov al, 0xad
xchg byte [0x14054e70d], al
lea rax, [0x14054e700]
ret
mov al, 0xe6
xchg byte [0x14054e0e0], al
lea rax, [0x14054e0d0]
ret
xor edx, edx
lea rax, [0x14054eaa0]
lea rcx, [0x140466440]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x140208b60
mov al, 0xf7
xchg byte [0x14054eaad], al
lea rax, [0x14054eaa0]
ret