joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400aa800
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400aa847
test edx, edx
je 0x1400aa87c
movzx eax, byte [0x1404b12df]
movzx ecx, byte [0x1404b2b8c]
add cl, 0x74
cmp al, cl
je 0x1400aa83f
nop dword [rax]
movzx ecx, byte [0x1404b2b8c]
lea eax, [rcx - 0x5e]
add cl, 0xec
lock cmpxchg byte [0x1404b12df], cl
je 0x1400aa8ec
cmp al, 0x6b
jne 0x1400aa820
lea rax, [0x1404b12d0]
ret
test edx, edx
je 0x1400aa8b6
movzx eax, byte [0x1404b12ed]
cmp al, 0x4b
je 0x1400aa874
mov cl, 0x5b
nop dword [rax + rax]
mov al, 0x89
lock cmpxchg byte [0x1404b12ed], cl
je 0x1400aa928
cmp al, 0x4b
jne 0x1400aa860
lea rax, [0x1404b12e0]
ret
movzx eax, byte [0x1404b137f]
cmp al, 0x7d
je 0x1400aa8ae
mov cl, 0xfb
nop dword [rax]
mov al, 0x79
lock cmpxchg byte [0x1404b137f], cl
je 0x1400aa9b0
movzx edx, byte [0x1404b2b8c]
add dl, 0x86
cmp al, dl
jne 0x1400aa890
lea rax, [0x1404b1370]
ret
movzx eax, byte [0x1404b1120]
cmp al, 0x40
je 0x1400aa8e4
mov cl, 0xe7
nop word cs:[rax + rax]
mov al, 0x6e
lock cmpxchg byte [0x1404b1120], cl
je 0x1400aa9f8
cmp al, 0x40
jne 0x1400aa8d0
lea rax, [0x1404b1110]
ret
xor eax, eax
lea rcx, [0x1404b12d0]
lea rdx, [0x1403eb7b0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1400aa918
inc rax
jmp 0x1400aa900
mov al, 0x6b
xchg byte [0x1404b12df], al
lea rax, [0x1404b12d0]
ret
xor edx, edx
lea rax, [0x1404b12e0]
lea rcx, [0x1403eb7c0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, dword [0x1404b2b88]
mov r9d, r8d
xor r9d, 0x41637b52
and r8d, 0x41637b52
lea r8d, [r9 + r8*2]
mov r9d, edx
xor r9d, r8d
and edx, r8d
lea edx, [r9 + rdx*2]
cmp edx, 0xd
jl 0x1400aa940
movzx eax, byte [0x1404b2b8c]
mov ecx, eax
xor cl, 0xf4
and al, 0x74
add al, al
add al, cl
add al, 0x60
xchg byte [0x1404b12ed], al
lea rax, [0x1404b12e0]
ret
xor eax, eax
lea rcx, [0x1404b1370]
lea rdx, [0x1403eb850]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1400aa9e8
inc rax
jmp 0x1400aa9c0
mov al, 0x7d
xchg byte [0x1404b137f], al
lea rax, [0x1404b1370]
ret
xor eax, eax
lea rcx, [0x1404b1110]
lea rdx, [0x1403eb610]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1400aaa28
inc rax
jmp 0x1400aaa10
mov al, 0x40
xchg byte [0x1404b1120], al
lea rax, [0x1404b1110]
ret
Function at 0x1400ab510
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1400ab54c
test edx, edx
je 0x1400ab58c
movzx eax, byte [0x1404b121e]
cmp al, 0x4a
je 0x1400ab544
mov cl, 0x90
nop word [rax + rax]
mov al, 0x20
lock cmpxchg byte [0x1404b121e], cl
je 0x1400ab60c
cmp al, 0x4a
jne 0x1400ab530
lea rax, [0x1404b1210]
ret
test edx, edx
je 0x1400ab5cc
movzx eax, byte [0x1404b11f9]
xor r8b, 0xb2
add r8b, byte [0x1404b2b8c]
cmp al, r8b
je 0x1400ab584
mov cl, 0x9b
nop dword [rax]
mov al, 0xe5
lock cmpxchg byte [0x1404b11f9], cl
je 0x1400ab658
cmp al, 0x56
jne 0x1400ab570
lea rax, [0x1404b11f0]
ret
movzx eax, byte [0x1404b12cb]
xor r8b, 0x37
add r8b, byte [0x1404b2b8c]
cmp al, r8b
je 0x1400ab5c4
mov cl, 0x6b
nop word cs:[rax + rax]
mov al, 0x18
lock cmpxchg byte [0x1404b12cb], cl
je 0x1400ab688
cmp al, 0xd1
jne 0x1400ab5b0
lea rax, [0x1404b12c0]
ret
movzx eax, byte [0x1404b1334]
mov ecx, r8d
xor cl, 0xe1
add cl, byte [0x1404b2b8c]
cmp al, cl
je 0x1400ab604
mov cl, 0xbb
nop word cs:[rax + rax]
mov al, 0xe6
lock cmpxchg byte [0x1404b1334], cl
je 0x1400ab6f3
cmp al, 3
jne 0x1400ab5f0
lea rax, [0x1404b1320]
ret
xor eax, eax
lea rcx, [0x1404b1210]
lea rdx, [0x1403eb6f0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x1400ab648
inc rax
jmp 0x1400ab620
mov al, 0x4a
xchg byte [0x1404b121e], al
lea rax, [0x1404b1210]
ret
xor eax, eax
lea rcx, [0x1404b11f0]
lea rdx, [0x1403eb6d0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1400ab6e3
inc rax
jmp 0x1400ab670
xor edx, edx
lea rax, [0x1404b12c0]
lea rcx, [0x1403eb7a0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xb
jl 0x1400ab6a0
mov al, 0xd1
xchg byte [0x1404b12cb], al
lea rax, [0x1404b12c0]
ret
mov al, 0x56
xchg byte [0x1404b11f9], al
lea rax, [0x1404b11f0]
ret
xor eax, eax
lea rcx, [0x1404b1320]
lea rdx, [0x1403eb800]
xor r8d, 0xe0079bf
nop word [rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x1404b2b88]
add r9d, r8d
add eax, r9d
cmp eax, 0x14
jl 0x1400ab710
mov al, 3
xchg byte [0x1404b1334], al
lea rax, [0x1404b1320]
ret
Function at 0x1400dc120
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400dc15c
test edx, edx
je 0x1400dc1bc
movzx eax, byte [0x1404b54b8]
cmp al, 0x7f
je 0x1400dc154
mov cl, 0xca
nop dword [rax]
mov al, 0x6a
lock cmpxchg byte [0x1404b54b8], cl
je 0x1400dc23c
cmp al, 0x7f
jne 0x1400dc140
lea rax, [0x1404b54b0]
ret
test edx, edx
je 0x1400dc207
movzx eax, byte [0x1404b5575]
nop dword [rax + rax]
cmp al, 0xe
je 0x1400dc28e
movzx ecx, byte [0x1404bb58c]
lea eax, [rcx + 0x55]
add cl, 0x51
lock cmpxchg byte [0x1404b5575], cl
jne 0x1400dc170
xor eax, eax
lea rcx, [0x1404b5560]
lea rdx, [0x1403ed900]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1400dc286
inc rax
jmp 0x1400dc1a0
movzx eax, byte [0x1404b55f3]
movzx ecx, byte [0x1404bb58c]
add cl, 0x56
cmp al, cl
je 0x1400dc1ff
nop word cs:[rax + rax]
movzx ecx, byte [0x1404bb58c]
lea eax, [rcx + 0x15]
add cl, 0x81
lock cmpxchg byte [0x1404b55f3], cl
je 0x1400dc296
cmp al, 0x51
jne 0x1400dc1e0
lea rax, [0x1404b55f0]
ret
movzx eax, byte [0x1404b54d0]
cmp al, 0x41
je 0x1400dc234
mov cl, 0x88
nop word cs:[rax + rax]
mov al, 0xe6
lock cmpxchg byte [0x1404b54d0], cl
je 0x1400dc2d8
cmp al, 0x41
jne 0x1400dc220
lea rax, [0x1404b54c0]
ret
xor edx, edx
lea rax, [0x1404b54b0]
lea rcx, [0x1403ed860]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 8
jl 0x1400dc250
movzx eax, byte [0x1404bb58c]
add al, 0x84
xchg byte [0x1404b54b8], al
lea rax, [0x1404b54b0]
ret
mov al, 0xe
xchg byte [0x1404b5575], al
lea rax, [0x1404b5560]
ret
xor eax, eax
lea rcx, [0x1404b55f0]
lea rdx, [0x1403ed990]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1400dc2c8
inc rax
jmp 0x1400dc2b0
mov al, 0x51
xchg byte [0x1404b55f3], al
lea rax, [0x1404b55f0]
ret
xor edx, edx
lea rax, [0x1404b54c0]
lea rcx, [0x1403ed870]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
mov r8d, dword [0x1404bb588]
mov r9d, r8d
xor r9d, 0xf565a3b2
and r8d, 0x7565a3b2
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x1400dc2f0
mov al, 0x41
xchg byte [0x1404b54d0], al
lea rax, [0x1404b54c0]
ret
Function at 0x1400dc3c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
test ecx, ecx
je 0x1400dc3f9
test edx, edx
je 0x1400dc429
movzx eax, byte [0x1404b5655]
cmp al, 0x9b
je 0x1400dc507
mov cl, 0x33
nop word [rax + rax]
mov al, 0x9f
lock cmpxchg byte [0x1404b5655], cl
je 0x1400dc499
cmp al, 0x9b
jne 0x1400dc3e0
jmp 0x1400dc507
test edx, edx
je 0x1400dc463
movzx eax, byte [0x1404b5596]
cmp al, 0xd5
je 0x1400dc597
mov cl, 0xaf
nop
mov al, 0x56
lock cmpxchg byte [0x1404b5596], cl
je 0x1400dc510
cmp al, 0xd5
jne 0x1400dc410
jmp 0x1400dc597
movzx eax, byte [0x1404b5646]
cmp al, 0xc7
je 0x1400dc5a8
mov cl, 0x94
nop word [rax + rax]
mov al, 0xfa
lock cmpxchg byte [0x1404b5646], cl
je 0x1400dc551
movzx edx, byte [0x1404bb58c]
add dl, 0xcc
cmp al, dl
jne 0x1400dc440
jmp 0x1400dc5a8
movzx eax, byte [0x1404b5512]
cmp al, 0x73
je 0x1400dc619
mov cl, 0x29
nop word cs:[rax + rax]
mov al, 0xa0
lock cmpxchg byte [0x1404b5512], cl
je 0x1400dc5b1
cmp al, 0x73
jne 0x1400dc480
jmp 0x1400dc619
xor edx, edx
lea rax, [0x1404b5650]
lea rcx, [0x1403ed9e0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
not r8b
not r9b
and r9b, r8b
or r9b, r10b
not r9b
add r9b, r9b
add r9b, r10b
mov byte [rdx + rax], r9b
mov r8d, dword [0x1404bb588]
add edx, r8d
add edx, 0xf565a3a3
add r8d, 0xf565a3a7
cmp edx, r8d
jl 0x1400dc4b0
movzx eax, byte [0x1404bb58c]
add al, 0xa0
xchg byte [0x1404b5655], al
lea rax, [0x1404b5650]
pop rbx
ret
xor eax, eax
lea rcx, [0x1404b5580]
lea rdx, [0x1403ed920]
mov r8d, 0xf565a3b8
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1404bb588]
add r10d, r8d
cmp r9d, r10d
jge 0x1400dc588
inc rax
jmp 0x1400dc530
xor eax, eax
lea rcx, [0x1404b5640]
lea rdx, [0x1403ed9d0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x1400dc5a0
inc rax
jmp 0x1400dc570
movzx eax, byte [0x1404bb58c]
add al, 0xda
xchg byte [0x1404b5596], al
lea rax, [0x1404b5580]
pop rbx
ret
mov al, 0xc7
xchg byte [0x1404b5646], al
lea rax, [0x1404b5640]
pop rbx
ret
xor eax, eax
lea rcx, [0x1404b5500]
lea rdx, [0x1403ed8a0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
mov r11d, r9d
not r11b
mov ebx, r10d
xor bl, r11b
and bl, r10b
xor r11b, r8b
and r10b, r9b
or r10b, r11b
not r10b
or r10b, bl
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x1400dc611
inc rax
jmp 0x1400dc5d0
mov al, 0x73
xchg byte [0x1404b5512], al
lea rax, [0x1404b5500]
pop rbx
ret
Function at 0x1400dc6a0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400dc6dc
test edx, edx
je 0x1400dc71c
movzx eax, byte [0x1404b5693]
cmp al, 0xee
je 0x1400dc6d4
mov cl, 0xf4
nop word cs:[rax + rax]
mov al, 0x24
lock cmpxchg byte [0x1404b5693], cl
je 0x1400dc77c
cmp al, 0xee
jne 0x1400dc6c0
lea rax, [0x1404b5670]
ret
mov ecx, dword [rsp + 0x28]
mov eax, ecx
xor eax, 0x5cc3238a
add eax, dword [0x1404bb588]
cmp edx, eax
jne 0x1400dc748
movzx eax, byte [0x1404b5538]
cmp al, 0x4e
je 0x1400dc714
mov dl, 0x89
nop
mov al, 0x35
lock cmpxchg byte [0x1404b5538], dl
je 0x1400dc7f8
cmp al, 0x4e
jne 0x1400dc700
lea rax, [0x1404b5520]
ret
movzx eax, byte [0x1404b55e6]
cmp al, 0x16
je 0x1400dc740
mov cl, 0x84
nop dword [rax]
mov al, 0x26
lock cmpxchg byte [0x1404b55e6], cl
je 0x1400dc7b8
cmp al, 0x16
jne 0x1400dc730
lea rax, [0x1404b55d0]
ret
movzx eax, byte [0x1404b56b9]
xor cl, 0x7e
add cl, byte [0x1404bb58c]
cmp al, cl
je 0x1400dc774
mov cl, 0x10
nop
mov al, 0xf2
lock cmpxchg byte [0x1404b56b9], cl
je 0x1400dc83d
cmp al, 0x51
jne 0x1400dc760
lea rax, [0x1404b56b0]
ret
xor eax, eax
lea rcx, [0x1404b5670]
lea rdx, [0x1403eda00]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1400dc7a8
inc rax
jmp 0x1400dc790
mov al, 0xee
xchg byte [0x1404b5693], al
lea rax, [0x1404b5670]
ret
xor eax, eax
lea rcx, [0x1404b55d0]
lea rdx, [0x1403ed970]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x15
jg 0x1400dc7e8
inc rax
jmp 0x1400dc7d0
mov al, 0x16
xchg byte [0x1404b55e6], al
lea rax, [0x1404b55d0]
ret
xor eax, eax
lea rdx, [0x1404b5520]
lea r8, [0x1403ed8c0]
xor ecx, 0x5cc3238b
nop
cdqe
movzx r9d, byte [rax + r8]
xor byte [rax + rdx], r9b
mov r9d, dword [0x1404bb588]
add r9d, ecx
add eax, r9d
cmp eax, 0x18
jl 0x1400dc810
mov al, 0x4e
xchg byte [0x1404b5538], al
lea rax, [0x1404b5520]
ret
xor eax, eax
lea rcx, [0x1404b56b0]
lea rdx, [0x1403eda40]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1400dc878
inc rax
jmp 0x1400dc850
mov al, 0x51
xchg byte [0x1404b56b9], al
lea rax, [0x1404b56b0]
ret
Function at 0x1400e89a0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1400e89dc
test edx, edx
je 0x1400e8a6d
movzx eax, byte [0x1404bca42]
cmp al, 0x8f
je 0x1400e89d4
mov cl, 0xe6
nop
mov al, 0x6d
lock cmpxchg byte [0x1404bca42], cl
je 0x1400e8acc
cmp al, 0x8f
jne 0x1400e89c0
lea rax, [0x1404bca30]
ret
test edx, edx
je 0x1400e8a9c
movzx eax, byte [0x1404bc9af]
mov ecx, r8d
xor cl, 0xfa
add cl, byte [0x1404bcae0]
cmp al, cl
je 0x1400e8a65
nop dword [rax + rax]
movzx ecx, byte [0x1404bcae0]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0xdb
mov eax, r8d
and al, 0x24
or al, r9b
add al, cl
and dl, 0x91
mov r9d, r8d
and r9b, 0x6e
or r9b, dl
mov edx, r9d
xor dl, cl
and r9b, cl
add r9b, r9b
add r9b, dl
lock cmpxchg byte [0x1404bc9af], r9b
je 0x1400e8b31
movzx ecx, byte [0x1404bcae0]
mov edx, r8d
xor dl, 0xfa
mov r9d, edx
xor r9b, cl
and dl, cl
add dl, dl
add dl, r9b
cmp al, dl
jne 0x1400e8a00
lea rax, [0x1404bc9a0]
ret
movzx eax, byte [0x1404bc993]
cmp al, 0x96
je 0x1400e8a94
mov cl, 0xfb
nop word [rax + rax]
mov al, 0x38
lock cmpxchg byte [0x1404bc993], cl
je 0x1400e8b78
cmp al, 0x96
jne 0x1400e8a80
lea rax, [0x1404bc970]
ret
movzx eax, byte [0x1404bc9fd]
cmp al, 0xec
je 0x1400e8ac4
mov cl, 0x4c
nop dword [rax]
mov al, 0xfa
lock cmpxchg byte [0x1404bc9fd], cl
je 0x1400e8bc8
cmp al, 0xec
jne 0x1400e8ab0
lea rax, [0x1404bc9f0]
ret
xor eax, eax
lea rcx, [0x1404bca30]
lea rdx, [0x1403ee280]
xor r8d, 0x42468881
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
mov r9d, dword [0x1404bcad0]
add r9d, r8d
add eax, r9d
cmp eax, 0x12
jl 0x1400e8af0
mov al, 0x8f
xchg byte [0x1404bca42], al
lea rax, [0x1404bca30]
ret
xor eax, eax
lea rcx, [0x1404bc9a0]
lea rdx, [0x1403ee200]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1400e8ba8
inc rax
jmp 0x1400e8b50
xor eax, eax
lea rcx, [0x1404bc970]
lea rdx, [0x1403ee1d0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1400e8bb8
inc rax
jmp 0x1400e8b90
mov al, 0x45
xchg byte [0x1404bc9af], al
lea rax, [0x1404bc9a0]
ret
mov al, 0x96
xchg byte [0x1404bc993], al
lea rax, [0x1404bc970]
ret
xor edx, edx
lea rax, [0x1404bc9f0]
lea rcx, [0x1403ee250]
nop dword [rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
xor byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
cmp edx, 0xd
jl 0x1400e8be0
xor r8b, 0x25
add r8b, byte [0x1404bcae0]
xchg byte [0x1404bc9fd], r8b
lea rax, [0x1404bc9f0]
ret
Function at 0x1400eb520
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r9
mov rsi, r8
mov r8, rdx
mov eax, dword [0x14051cf84]
cmp eax, 0x16
jg 0x1400eb560
mov qword [rcx], r8
mov qword [rcx + 8], 0
cmp qword [0x14051cf88], 0
je 0x1400eb5ae
mov qword [rcx], r8
mov qword [rcx + 8], 0
mov r10d, dword [0x14051cf80]
mov r9d, dword [0x1404bccd8]
mov eax, r9d
xor eax, 0xa1382b79
mov edx, r9d
not edx
and edx, 0x5ec7d486
or edx, eax
not edx
lea edx, [rax + rdx*2]
mov eax, r10d
sub eax, edx
imul eax, r10d
add r9d, 0xa1382b7a
xor edx, edx
div r9d
test edx, edx
jne 0x1400eb560
jmp 0x1400eb54b
mov qword [rbp - 0x10], rcx
mov ecx, 0xc8
call fcn.1403a8a84
mov rbx, rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 8], rbx
mov eax, dword [rdi]
mov ecx, dword [0x14051cf90]
mov edx, ecx
xor edx, eax
and ecx, eax
lea eax, [rdx + rcx*2]
mov dword [rbx + 0x20], eax
movups xmm0, xmmword [rdi + 8]
movups xmm1, xmmword [rdi + 0x18]
movups xmmword [rbx + 0x28], xmm0
movups xmmword [rbx + 0x38], xmm1
lea r14, [rbx + 0x48]
lea rdx, [rdi + 0x28]
mov rcx, r14
call fcn.1400eb030
mov qword [rbp - 0x18], r14
add rbx, 0x88
add rdi, 0x68
lea rax, [fcn.1400eb520]
lea ecx, [rax + rax]
add ecx, 0x4400
mov r8d, ecx
not r8d
and ecx, r8d
lea r9d, [rax + rax]
add r9d, 0x4401
nop
mov edx, dword [0x14051cf80]
lea eax, [rdx - 1]
imul eax, edx
mov r10d, dword [0x1404bccd8]
lea r11d, [r10 - 0x5ec7d486]
xor edx, edx
div r11d
add r10d, 0xa1382b78
cmp edx, r10d
jne 0x1400eb66b
mov eax, r8d
and eax, 0xfffffffe
xor eax, r9d
or eax, ecx
cmp eax, 0xffffffff
je 0x1400eb678
mov eax, dword [0x14051cf84]
cmp eax, 0x23
jge 0x1400eb630
jmp 0x1400eb65b
mov rcx, rbx
mov rdx, rdi
call fcn.1400eb030
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax + 8]
mov qword [rcx], rsi
mov rcx, qword [rax + 8]
mov qword [rcx + 8], rsi
mov rcx, qword [rax + 8]
mov qword [rcx + 0x10], rsi
mov rcx, qword [rax + 8]
mov byte [rcx + 0x18], 0
mov rdx, qword [rax + 8]
movzx ecx, byte [0x1404bcce8]
add cl, 0xb0
mov byte [rdx + 0x19], cl
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x140138530
Capabilities:
Check for software breakpoints

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14013857c
mov eax, r8d
xor eax, 0x9bcc2f24
add eax, dword [0x1404c6600]
cmp edx, eax
jne 0x1401385ac
movzx eax, byte [0x1404c5ff5]
cmp al, 0xb0
je 0x140138574
mov cl, 0xa
nop dword [rax + rax]
mov al, 0x5a
lock cmpxchg byte [0x1404c5ff5], cl
je 0x14013862c
cmp al, 0xb0
jne 0x140138560
lea rax, [0x1404c5fc0]
ret
test edx, edx
je 0x1401385ec
movzx eax, byte [0x1404c610e]
cmp al, 0xcc
je 0x1401385a4
mov cl, 0xaa
nop dword [rax]
mov al, 0x44
lock cmpxchg byte [0x1404c610e], cl
je 0x1401386d8
cmp al, 0xcc
jne 0x140138590
lea rax, [0x1404c6100]
ret
movzx eax, byte [0x1404c61cd]
xor r8b, 0x67
add r8b, byte [0x1404c6604]
cmp al, r8b
je 0x1401385e4
mov cl, 0xcc
nop word cs:[rax + rax]
mov al, 0xd0
lock cmpxchg byte [0x1404c61cd], cl
je 0x140138681
cmp al, 0xce
jne 0x1401385d0
lea rax, [0x1404c61c0]
ret
movzx eax, byte [0x1404c6169]
xor r8b, 0xe0
add r8b, byte [0x1404c6604]
cmp al, r8b
je 0x140138624
mov cl, 0xf3
nop word cs:[rax + rax]
mov al, 0x1e
lock cmpxchg byte [0x1404c6169], cl
je 0x140138718
cmp al, 0x53
jne 0x140138610
lea rax, [0x1404c6160]
ret
xor eax, eax
lea rcx, [0x1404c5fc0]
lea rdx, [0x1403f0330]
xor r8d, 0x9bcc2f71
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x1404c6600]
add r10d, r8d
cmp r9d, r10d
jge 0x1401386b8
inc rax
jmp 0x140138650
xor eax, eax
lea rcx, [0x1404c61c0]
lea rdx, [0x1403f0520]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401386c8
inc rax
jmp 0x1401386a0
mov al, 0xb0
xchg byte [0x1404c5ff5], al
lea rax, [0x1404c5fc0]
ret
mov al, 0xce
xchg byte [0x1404c61cd], al
lea rax, [0x1404c61c0]
ret
xor eax, eax
lea rcx, [0x1404c6100]
lea rdx, [0x1403f0460]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x140138708
inc rax
jmp 0x1401386f0
mov al, 0xcc
xchg byte [0x1404c610e], al
lea rax, [0x1404c6100]
ret
xor eax, eax
lea rcx, [0x1404c6160]
lea rdx, [0x1403f04c0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x140138748
inc rax
jmp 0x140138730
mov al, 0x53
xchg byte [0x1404c6169], al
lea rax, [0x1404c6160]
ret
Function at 0x140138760
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r8d, dword [rsp + 0x30]
mov eax, r8d
xor eax, 0xc858031
add eax, dword [0x1404c6600]
cmp ecx, eax
jne 0x1401387a9
test edx, edx
je 0x1401387e9
movzx eax, byte [0x1404c615f]
cmp al, 0x7a
je 0x140138918
mov cl, 0xff
nop dword [rax]
mov al, 0x86
lock cmpxchg byte [0x1404c615f], cl
je 0x140138879
cmp al, 0x7a
jne 0x140138790
jmp 0x140138918
test edx, edx
je 0x14013883b
movzx eax, byte [0x1404c6143]
xor r8b, 0x9f
add r8b, byte [0x1404c6604]
cmp al, r8b
je 0x140138907
mov cl, 0xd2
nop
mov al, 0x68
lock cmpxchg byte [0x1404c6143], cl
je 0x1401388d0
cmp al, 0x39
jne 0x1401387d0
jmp 0x140138907
movzx eax, byte [0x1404c6195]
cmp al, 0xc1
je 0x140138967
mov cl, 0x26
nop word [rax + rax]
mov al, 0xa5
lock cmpxchg byte [0x1404c6195], cl
je 0x140138921
movzx edx, byte [0x1404c6604]
mov r9d, r8d
xor r9b, dl
mov r10d, r9d
xor r10b, 0x67
xor r9b, 0x18
and r9b, dl
add r9b, r9b
add r9b, r10b
cmp al, r9b
jne 0x140138800
jmp 0x140138967
movzx eax, byte [0x1404c5fac]
mov ecx, r8d
xor cl, 0xb3
add cl, byte [0x1404c6604]
cmp al, cl
je 0x1401389d5
mov cl, 0xc4
nop dword [rax + rax]
mov al, 0xb4
lock cmpxchg byte [0x1404c5fac], cl
je 0x140138970
cmp al, 0xd
jne 0x140138860
jmp 0x1401389d5
xor eax, eax
lea rcx, [0x1404c6150]
lea rdx, [0x1403f04b0]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
mov r11d, r10d
xor r11b, r9b
not r9b
mov ebx, r8d
and bl, r9b
or bl, r11b
not bl
xor r9b, r10b
and r9b, r8b
or r9b, bl
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x140138910
inc rax
jmp 0x140138890
xor edx, edx
lea rax, [0x1404c6120]
lea rcx, [0x1403f0480]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x23
jl 0x1401388e0
mov al, 0x39
xchg byte [0x1404c6143], al
lea rax, [0x1404c6120]
pop rbx
ret
mov al, 0x7a
xchg byte [0x1404c615f], al
lea rax, [0x1404c6150]
pop rbx
ret
xor edx, edx
lea rax, [0x1404c6180]
lea rcx, [0x1403f04e0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x140138940
mov al, 0xc1
xchg byte [0x1404c6195], al
lea rax, [0x1404c6180]
pop rbx
ret
xor eax, eax
lea rcx, [0x1404c5f80]
lea rdx, [0x1403f02f0]
mov r9d, r8d
xor r9d, 0xc858030
nop word [rax + rax]
cdqe
movzx r10d, byte [rax + rcx]
movzx r11d, byte [rax + rdx]
not r11b
mov ebx, r11d
or bl, r10b
not bl
and r11b, r10b
or r11b, bl
mov byte [rax + rcx], r11b
mov r10d, dword [0x1404c6600]
add r10d, r9d
add eax, r10d
cmp eax, 0x2c
jl 0x140138990
xor r8b, 0xb3
add r8b, byte [0x1404c6604]
xchg byte [0x1404c5fac], r8b
lea rax, [0x1404c5f80]
pop rbx
ret