joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400abac0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0xf73cd21d
add eax, dword [0x140529c38]
cmp ecx, eax
jne 0x1400abb18
test edx, edx
je 0x1400abb68
movzx eax, byte [0x140529196]
cmp al, 0x1a
je 0x1400abb10
mov cl, 2
nop dword [rax]
mov al, 0x54
lock cmpxchg byte [0x140529196], cl
je 0x1400abbec
mov edx, r8d
xor dl, 0xf5
add dl, byte [0x140529c3c]
cmp al, dl
jne 0x1400abaf0
lea rax, [0x140529190]
ret
test edx, edx
je 0x1400abba8
movzx eax, byte [0x1405292d0]
mov ecx, r8d
xor cl, 0xaf
add cl, byte [0x140529c3c]
cmp al, cl
je 0x1400abb60
mov cl, 0xbc
nop dword [rax]
mov al, 0x20
lock cmpxchg byte [0x1405292d0], cl
je 0x1400abc18
mov edx, r8d
xor dl, 0xaf
add dl, byte [0x140529c3c]
cmp al, dl
jne 0x1400abb40
lea rax, [0x1405292c0]
ret
movzx eax, byte [0x1405293dd]
cmp al, 0x7e
je 0x1400abba0
mov cl, 0x9d
nop word cs:[rax + rax]
mov al, 0x96
lock cmpxchg byte [0x1405293dd], cl
je 0x1400abc72
mov edx, r8d
xor dl, 0x11
add dl, byte [0x140529c3c]
cmp al, dl
jne 0x1400abb80
lea rax, [0x1405293d0]
ret
movzx eax, byte [0x14052930e]
mov ecx, r8d
xor cl, 0x47
add cl, byte [0x140529c3c]
cmp al, cl
je 0x1400abbe4
mov cl, 0xb9
nop word cs:[rax + rax]
mov al, 0x95
lock cmpxchg byte [0x14052930e], cl
je 0x1400abcb8
cmp al, 0xc8
jne 0x1400abbd0
lea rax, [0x140529300]
ret
xor eax, eax
lea rcx, [0x140529190]
lea rdx, [0x140462df0]
nop dword [rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 5
jg 0x1400abc48
inc rax
jmp 0x1400abc00
xor eax, eax
lea rcx, [0x1405292c0]
lea rdx, [0x140462f10]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1400abc62
inc rax
jmp 0x1400abc30
xor r8b, 0xf5
add r8b, byte [0x140529c3c]
xchg byte [0x140529196], r8b
lea rax, [0x140529190]
ret
mov al, pe_nt_image_headers64
xchg byte [0x1405292d0], al
lea rax, [0x1405292c0]
ret
xor eax, eax
lea rcx, [0x1405293d0]
lea rdx, [0x140463010]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1400abd0d
inc rax
jmp 0x1400abc90
xor eax, eax
lea rcx, [0x140529300]
lea rdx, [0x140462f40]
xor r8d, 0xf73cd21c
nop
cdqe
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
mov r9d, dword [0x140529c38]
add r9d, r8d
add eax, r9d
cmp eax, 0xe
jl 0x1400abcd0
mov al, 0xc8
xchg byte [0x14052930e], al
lea rax, [0x140529300]
ret
mov al, 0x7e
xchg byte [0x1405293dd], al
lea rax, [0x1405293d0]
ret
Function at 0x1400abe00
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x1400abe68
test edx, edx
je 0x1400abe99
movzx eax, byte [0x1405291b5]
mov ecx, r8d
xor cl, 0xd7
add cl, byte [0x140529c3c]
cmp al, cl
je 0x1400abf73
nop dword [rax]
movzx ecx, byte [0x140529c3c]
mov edx, r8d
xor dl, 0x6b
mov eax, r8d
not al
and al, r8b
xor al, dl
add al, cl
mov edx, r8d
xor dl, 0x59
add dl, cl
lock cmpxchg byte [0x1405291b5], dl
je 0x1400abf05
cmp al, 0x9d
jne 0x1400abe30
jmp 0x1400abf73
test edx, edx
je 0x1400abec9
movzx eax, byte [0x1405292a6]
cmp al, 0x34
je 0x1400abff0
mov cl, 0xa5
nop dword [rax]
mov al, 0xbd
lock cmpxchg byte [0x1405292a6], cl
je 0x1400abf7c
cmp al, 0x34
jne 0x1400abe80
jmp 0x1400abff0
movzx eax, byte [0x140529186]
cmp al, 0x22
je 0x1400ac00b
mov cl, 0xc2
nop word [rax + rax]
mov al, 0x39
lock cmpxchg byte [0x140529186], cl
je 0x1400abfb8
cmp al, 0x22
jne 0x1400abeb0
jmp 0x1400ac00b
movzx eax, byte [0x14052945d]
cmp al, 0x9f
je 0x1400ac068
mov cl, 0x11
nop word [rax + rax]
mov al, 0xbe
lock cmpxchg byte [0x14052945d], cl
je 0x1400ac014
mov edx, r8d
xor dl, 0xd5
add dl, byte [0x140529c3c]
cmp al, dl
jne 0x1400abee0
jmp 0x1400ac068
xor r9d, r9d
lea rax, [0x1405291a0]
lea rcx, [0x140462e00]
mov edx, r8d
xor edx, 0x4480bbad
nop
movsxd r9, r9d
movzx r10d, byte [r9 + rax]
movzx r11d, byte [r9 + rcx]
not r10b
mov ebx, r10d
and bl, r11b
or r10b, r11b
not r10b
or r10b, bl
mov byte [r9 + rax], r10b
mov r10d, r9d
xor r10d, 1
and r9d, 1
lea r9d, [r10 + r9*2]
mov r10d, dword [0x140529c38]
add r10d, edx
cmp r9d, r10d
jl 0x1400abf20
xor r8b, 0xd7
add r8b, byte [0x140529c3c]
xchg byte [0x1405291b5], r8b
lea rax, [0x1405291a0]
pop rbx
ret
xor eax, eax
lea rcx, [0x140529290]
lea rdx, [0x140462ee0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x15
jg 0x1400abfe8
inc rax
jmp 0x1400abf90
xor eax, eax
lea rcx, [0x140529180]
lea rdx, [0x140462de0]
nop dword [rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 5
jg 0x1400abff9
inc rax
jmp 0x1400abfd0
mov al, 0x34
xchg byte [0x1405292a6], al
lea rax, [0x140529290]
pop rbx
ret
xor r8b, 0x48
add r8b, byte [0x140529c3c]
xchg byte [0x140529186], r8b
lea rax, [0x140529180]
pop rbx
ret
xor eax, eax
lea rcx, [0x140529450]
lea rdx, [0x140463090]
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xc
jg 0x1400ac048
inc rax
jmp 0x1400ac030
movzx eax, byte [0x140529c3c]
xor r8b, 0xd5
mov ecx, r8d
xor cl, al
and r8b, al
add r8b, r8b
add r8b, cl
xchg byte [0x14052945d], r8b
lea rax, [0x140529450]
pop rbx
ret
Function at 0x1400ac230
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov esi, r9d
mov rdi, rcx
mov eax, dword [0x1405a9390]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x1400ac267
mov rcx, rdi
call fcn.140366710
mov eax, dword [0x1405a9390]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
je 0x1400ac293
mov ebx, esi
xor ebx, 0x66481bff
nop
mov rcx, rdi
call fcn.140366710
mov eax, dword [0x1405a9394]
mov ecx, dword [0x140529c38]
mov edx, ebx
xor edx, ecx
and ecx, ebx
lea ecx, [rdx + rcx*2]
cmp eax, ecx
jge 0x1400ac270
jmp 0x1400ac24e
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140114af0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2ea84cd
add eax, dword [0x140537b00]
cmp ecx, eax
jne 0x140114b47
test edx, edx
je 0x140114bac
movzx eax, byte [0x14052cc40]
movzx ecx, byte [0x140537b10]
add cl, 0xaa
cmp al, cl
je 0x140114b3f
nop dword [rax]
movzx ecx, byte [0x140537b10]
lea eax, [rcx - 0x61]
add cl, 0xb8
lock cmpxchg byte [0x14052cc40], cl
je 0x140114c2c
cmp al, 0x52
jne 0x140114b20
lea rax, [0x14052cc30]
ret
test edx, edx
je 0x140114bec
movzx eax, byte [0x14052cdb6]
nop word cs:[rax + rax]
cmp al, 0x6d
je 0x140114c60
movzx ecx, byte [0x140537b10]
lea eax, [rcx - 0x44]
add cl, 0xdc
lock cmpxchg byte [0x14052cdb6], cl
jne 0x140114b60
xor eax, eax
lea rcx, [0x14052cdb0]
lea rdx, [0x140465220]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x140114c58
inc rax
jmp 0x140114b90
movzx eax, byte [0x14052cce5]
movzx ecx, byte [0x140537b10]
add cl, 0x16
cmp al, cl
je 0x140114be4
mov cl, 0x6a
nop word cs:[rax + rax]
mov al, 0xf2
lock cmpxchg byte [0x14052cce5], cl
je 0x140114c78
cmp al, 0xbe
jne 0x140114bd0
lea rax, [0x14052ccd0]
ret
movzx eax, byte [0x14052cda3]
movzx ecx, byte [0x140537b10]
add cl, 0x79
cmp al, cl
je 0x140114c24
mov cl, 0x7a
nop word cs:[rax + rax]
mov al, 0xd4
lock cmpxchg byte [0x14052cda3], cl
je 0x140114cbf
cmp al, 0x21
jne 0x140114c10
lea rax, [0x14052cda0]
ret
xor eax, eax
lea rcx, [0x14052cc30]
lea rdx, [0x1404650c0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140114c68
inc rax
jmp 0x140114c40
mov al, 0x6d
xchg byte [0x14052cdb6], al
lea rax, [0x14052cdb0]
ret
mov al, 0x52
xchg byte [0x14052cc40], al
lea rax, [0x14052cc30]
ret
xor edx, edx
lea rax, [0x14052ccd0]
lea rcx, [0x140465150]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x140114c90
mov al, 0xbe
xchg byte [0x14052cce5], al
lea rax, [0x14052ccd0]
ret
xor edx, edx
lea rax, [0x14052cda0]
lea rcx, [0x140465210]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 3
jl 0x140114cd0
mov al, 0x21
xchg byte [0x14052cda3], al
lea rax, [0x14052cda0]
ret

Function at 0x140114e60
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ebp, dword [rsp + 0x78]
mov eax, dword [0x1405a9690]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x140114eb0
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.140122fb0
mov ecx, dword [0x1405a9690]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
je 0x140114eda
nop word cs:[rax + rax]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.140122fb0
mov eax, dword [0x1405a9690]
mov ecx, dword [0x140537b00]
xor ecx, ebp
mov edx, eax
sub edx, ecx
imul edx, eax
test dl, 1
jne 0x140114eb0
jmp 0x140114e86
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140123c60
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140123c9c
test edx, edx
je 0x140123cdc
movzx eax, byte [0x140539e63]
cmp al, 0xdc
je 0x140123c94
mov cl, 0xa2
nop word cs:[rax + rax]
mov al, 0x50
lock cmpxchg byte [0x140539e63], cl
je 0x140123dbc
cmp al, 0xdc
jne 0x140123c80
lea rax, [0x140539e50]
ret
test edx, edx
je 0x140123d7a
movzx eax, byte [0x140539ead]
cmp al, 0x67
je 0x140123cd4
mov cl, 0xd4
nop word cs:[rax + rax]
mov al, 0x7f
lock cmpxchg byte [0x140539ead], cl
je 0x140123e08
cmp al, 0x67
jne 0x140123cc0
lea rax, [0x140539ea0]
ret
movzx eax, byte [0x140539ec2]
nop word cs:[rax + rax]
cmp al, 0xb
je 0x140123d72
movzx ecx, byte [0x140539f88]
lea eax, [rcx - 0x2f]
inc cl
lock cmpxchg byte [0x140539ec2], cl
jne 0x140123cf0
xor edx, edx
lea rax, [0x140539eb0]
lea rcx, [0x140465aa0]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, dword [0x140539f78]
add edx, r8d
add edx, 0x3a8ab2b2
mov r9d, r8d
xor r9d, 0x3a8ab2c3
and r8d, 0x3a8ab2c3
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x140123d20
mov al, 0xb
xchg byte [0x140539ec2], al
lea rax, [0x140539eb0]
ret
movzx eax, byte [0x140539e4d]
movzx ecx, byte [0x140539f88]
add cl, 0xbd
cmp al, cl
je 0x140123db4
mov cl, 0x95
nop word cs:[rax + rax]
mov al, 0xd0
lock cmpxchg byte [0x140539e4d], cl
je 0x140123e51
cmp al, 0x6f
jne 0x140123da0
lea rax, [0x140539e40]
ret
xor eax, eax
lea rcx, [0x140539e50]
lea rdx, [0x140465a50]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x12
jg 0x140123df8
inc rax
jmp 0x140123dd0
mov al, 0xdc
xchg byte [0x140539e63], al
lea rax, [0x140539e50]
ret
xor eax, eax
lea rcx, [0x140539ea0]
lea rdx, [0x140465a90]
mov r8d, 0x3a8ab2be
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140539f78]
add r10d, r8d
cmp r9d, r10d
jge 0x140123e41
inc rax
jmp 0x140123e20
mov al, 0x67
xchg byte [0x140539ead], al
lea rax, [0x140539ea0]
ret
xor eax, eax
lea rcx, [0x140539e40]
lea rdx, [0x140465a40]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140123e88
inc rax
jmp 0x140123e70
mov al, 0x6f
xchg byte [0x140539e4d], al
lea rax, [0x140539e40]
ret
Function at 0x140128ff0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r9, r8
mov rsi, rdx
mov rdi, rcx
mov r8, qword [rcx]
mov rdx, qword [r8 + 8]
xor ebp, ebp
cmp byte [rdx + 0x19], 0
je 0x14012901e
mov rbx, rdx
mov rax, r8
cmp byte [rax + 0x19], 0
jne 0x14012907f
jmp 0x140129077
mov ecx, dword [r9]
mov rax, r8
nop word cs:[rax + rax]
mov rbx, rdx
mov r10d, dword [rdx + 0x20]
cmp r10d, ecx
cmovae rax, rdx
lea rdx, [rdx + 0x10]
cmovae rdx, rbx
mov rdx, qword [rdx]
movzx r11d, byte [0x14053aaac]
mov ebp, r11d
xor bpl, 0x8a
and r11b, 0xa
add r11b, r11b
add r11b, bpl
cmp byte [rdx + 0x19], r11b
je 0x140129030
xor ebp, ebp
cmp r10d, ecx
setae bpl
cmp byte [rax + 0x19], 0
jne 0x14012907f
mov ecx, dword [r9]
cmp ecx, dword [rax + 0x20]
jae 0x1401290cb
movabs rax, 0x147ae147ae147ae
cmp qword [rdi + 8], rax
je 0x1401290cf
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.1401290e0
mov r8, qword [rsp + 0x40]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], ebp
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140129240
mov cl, 1
mov qword [rsi], rax
mov byte [rsi + 8], cl
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
xor ecx, ecx
jmp 0x1401290b9
call fcn.1400a7570
int3
Function at 0x140133790
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401337e1
test edx, edx
je 0x14013381c
movzx eax, byte [0x14053b0c3]
cmp al, 0xd
je 0x1401337d9
nop word [rax + rax]
movzx ecx, byte [0x14053b338]
lea eax, [rcx + 0x1f]
add cl, 0x7b
lock cmpxchg byte [0x14053b0c3], cl
je 0x140133886
movzx ecx, byte [0x14053b338]
add cl, 0xe6
cmp al, cl
jne 0x1401337b0
lea rax, [0x14053b0c0]
ret
test edx, edx
je 0x14013384c
movzx eax, byte [0x14053b1af]
cmp al, 7
je 0x140133814
mov cl, 0x77
nop word cs:[rax + rax]
mov al, 0x47
lock cmpxchg byte [0x14053b1af], cl
je 0x1401338d1
cmp al, 7
jne 0x140133800
lea rax, [0x14053b1a0]
ret
movzx eax, byte [0x14053b0b2]
cmp al, 0x63
je 0x140133844
mov cl, 5
nop dword [rax]
mov al, 0x6f
lock cmpxchg byte [0x14053b0b2], cl
je 0x140133911
cmp al, 0x63
jne 0x140133830
lea rax, [0x14053b0b0]
ret
movzx eax, byte [0x14053b132]
cmp al, 0x8f
je 0x14013387e
mov cl, 0x58
nop dword [rax]
mov al, 0x84
lock cmpxchg byte [0x14053b132], cl
je 0x14013396f
movzx edx, byte [0x14053b338]
add dl, 0x68
cmp al, dl
jne 0x140133860
lea rax, [0x14053b120]
ret
xor edx, edx
lea rax, [0x14053b0c0]
lea rcx, [0x140466090]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x14053b33c]
add edx, r8d
add edx, 0x8de27085
cmp edx, 3
jl 0x1401338a0
mov al, 0xd
xchg byte [0x14053b0c3], al
lea rax, [0x14053b0c0]
ret
xor eax, eax
lea rcx, [0x14053b1a0]
lea rdx, [0x140466150]
mov r8d, 0x8de27093
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14053b33c]
add r10d, r8d
cmp r9d, r10d
jge 0x14013395f
inc rax
jmp 0x1401338f0
xor edx, edx
lea rax, [0x14053b0b0]
lea rcx, [0x140466080]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 2
jl 0x140133930
mov al, 0x63
xchg byte [0x14053b0b2], al
lea rax, [0x14053b0b0]
ret
mov al, 7
xchg byte [0x14053b1af], al
lea rax, [0x14053b1a0]
ret
xor edx, edx
lea rax, [0x14053b120]
lea rcx, [0x1404660e0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x14053b33c]
add edx, r8d
add edx, 0x8de27085
cmp edx, 0x12
jl 0x140133980
mov al, 0x8f
xchg byte [0x14053b132], al
lea rax, [0x14053b120]
ret
Function at 0x140133b10
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140133b56
test edx, edx
je 0x140133b9c
movzx eax, byte [0x14053b21d]
cmp al, 0xcf
je 0x140133b4e
mov cl, 0x5f
nop dword [rax]
mov al, 0xd4
lock cmpxchg byte [0x14053b21d], cl
je 0x140133bfc
movzx edx, byte [0x14053b338]
add dl, 0xa8
cmp al, dl
jne 0x140133b30
lea rax, [0x14053b210]
ret
xor eax, eax
sub eax, dword [0x14053b33c]
mov ecx, eax
xor ecx, 0x721d8f7c
and eax, 0x721d8f7c
lea eax, [rcx + rax*2]
add edx, eax
jne 0x140133bc8
movzx eax, byte [0x14053b115]
cmp al, 0x42
je 0x140133b94
mov cl, 0x68
nop
mov al, 0xcb
lock cmpxchg byte [0x14053b115], cl
je 0x140133c7f
cmp al, 0x42
jne 0x140133b80
lea rax, [0x14053b100]
ret
movzx eax, byte [0x14053b162]
cmp al, 0xe8
je 0x140133bc0
mov cl, 0x36
nop dword [rax]
mov al, 0xd8
lock cmpxchg byte [0x14053b162], cl
je 0x140133c38
cmp al, 0xe8
jne 0x140133bb0
lea rax, [0x14053b160]
ret
movzx eax, byte [0x14053b26b]
cmp al, 0xe0
je 0x140133bf4
mov cl, 0x76
nop word cs:[rax + rax]
mov al, 7
lock cmpxchg byte [0x14053b26b], cl
je 0x140133cc1
cmp al, 0xe0
jne 0x140133be0
lea rax, [0x14053b260]
ret
xor eax, eax
lea rcx, [0x14053b210]
lea rdx, [0x1404661c0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140133c28
inc rax
jmp 0x140133c10
mov al, 0xcf
xchg byte [0x14053b21d], al
lea rax, [0x14053b210]
ret
xor eax, eax
lea rcx, [0x14053b160]
lea rdx, [0x140466120]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x140133c68
inc rax
jmp 0x140133c50
movzx eax, byte [0x14053b338]
add al, 0xc1
xchg byte [0x14053b162], al
lea rax, [0x14053b160]
ret
xor edx, edx
lea rax, [0x14053b100]
lea rcx, [0x1404660c0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x14053b33c]
add edx, r8d
add edx, 0x8de27085
cmp edx, 0x15
jl 0x140133c90
mov al, 0x42
xchg byte [0x14053b115], al
lea rax, [0x14053b100]
ret
xor eax, eax
lea rcx, [0x14053b260]
lea rdx, [0x140466210]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x140133cf8
inc rax
jmp 0x140133ce0
mov al, pe_nt_image_headers64
xchg byte [0x14053b26b], al
lea rax, [0x14053b260]
ret
Function at 0x140141220
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa5c3331b
add eax, dword [0x14053d584]
cmp ecx, eax
jne 0x14014126c
test edx, edx
je 0x1401412cc
movzx eax, byte [0x14053c030]
cmp al, 0x63
je 0x140141264
mov cl, 0x15
nop word cs:[rax + rax]
mov al, 0x10
lock cmpxchg byte [0x14053c030], cl
je 0x1401413c3
cmp al, 0x63
jne 0x140141250
lea rax, [0x14053c020]
ret
test edx, edx
je 0x140141371
movzx eax, byte [0x14053bfc9]
nop dword [rax + rax]
cmp al, 0xdc
je 0x140141400
movzx ecx, byte [0x14053d580]
lea eax, [rcx - 0x73]
add cl, 0xa3
lock cmpxchg byte [0x14053bfc9], cl
jne 0x140141280
xor eax, eax
lea rcx, [0x14053bfc0]
lea rdx, [0x1404670e0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1401413f8
inc rax
jmp 0x1401412b0
movzx eax, byte [0x14053bfe6]
nop word cs:[rax + rax]
cmp al, 0x6e
je 0x140141369
movzx ecx, byte [0x14053d580]
lea eax, [rcx - 0x21]
add cl, 0x88
lock cmpxchg byte [0x14053bfe6], cl
jne 0x1401412e0
xor eax, eax
lea rcx, [0x14053bfe0]
lea rdx, [0x140467100]
nop
cdqe
xor r8d, r8d
sub r8b, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
xor r10d, r10d
sub r10b, r9b
mov r9d, r8d
xor r9b, r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
neg r10b
mov byte [rax + rcx], r10b
mov r8d, dword [0x14053d584]
mov r9d, r8d
xor r9d, 0x5a3ccce3
and r9d, r8d
xor r8d, 0xa5c3331c
lea r8d, [r8 + r9*2]
add eax, r8d
cmp eax, 6
jl 0x140141310
mov al, 0x6e
xchg byte [0x14053bfe6], al
lea rax, [0x14053bfe0]
ret
movzx eax, byte [0x14053c125]
movzx ecx, byte [0x14053d580]
add cl, 0xc9
cmp al, cl
je 0x1401413bb
nop word cs:[rax + rax]
movzx ecx, byte [0x14053d580]
mov edx, ecx
xor dl, 0x40
mov eax, ecx
not al
and al, 0x3f
or al, dl
not al
add al, al
add al, dl
add cl, 0xb7
lock cmpxchg byte [0x14053c125], cl
je 0x140141418
cmp al, 0x8d
jne 0x140141390
lea rax, [0x14053c110]
ret
xor eax, eax
lea rcx, [0x14053c020]
lea rdx, [0x140467140]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140141408
inc rax
jmp 0x1401413e0
mov al, 0xdc
xchg byte [0x14053bfc9], al
lea rax, [0x14053bfc0]
ret
mov al, 0x63
xchg byte [0x14053c030], al
lea rax, [0x14053c020]
ret
xor edx, edx
lea rax, [0x14053c110]
lea rcx, [0x140467220]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x140141430
mov al, 0x8d
xchg byte [0x14053c125], al
lea rax, [0x14053c110]
ret
Function at 0x140141460
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa5c3331b
mov r8d, dword [0x14053d584]
add r8d, eax
cmp ecx, r8d
jne 0x1401414bc
test edx, edx
je 0x14014156c
movzx eax, byte [0x14053bf66]
movzx ecx, byte [0x14053d580]
mov edx, ecx
xor dl, 0x8a
and cl, 0xa
add cl, cl
add cl, dl
cmp al, cl
je 0x1401414b4
mov cl, 0xc3
nop dword [rax]
mov al, 0x87
lock cmpxchg byte [0x14053bf66], cl
je 0x1401415a6
cmp al, 0x4e
jne 0x1401414a0
lea rax, [0x14053bf50]
ret
add eax, dword [0x14053d584]
cmp edx, eax
jne 0x1401414fc
movzx eax, byte [0x14053beb2]
cmp al, 0xb
je 0x1401414f4
mov cl, 0x2a
nop word cs:[rax + rax]
mov al, 0x65
lock cmpxchg byte [0x14053beb2], cl
je 0x140141601
cmp al, 0xb
jne 0x1401414e0
lea rax, [0x14053bea0]
ret
movzx eax, byte [0x14053c10d]
nop word cs:[rax + rax]
cmp al, 0x42
je 0x140141667
movzx ecx, byte [0x14053d580]
lea eax, [rcx - 0x5f]
add cl, 0xeb
lock cmpxchg byte [0x14053c10d], cl
jne 0x140141510
xor eax, eax
lea rcx, [0x14053c100]
lea rdx, [0x140467210]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14014165f
inc rax
jmp 0x140141540
movzx eax, byte [0x14053be95]
cmp al, 0xab
je 0x14014159e
mov cl, 0x1c
nop dword [rax]
mov al, 0x3f
lock cmpxchg byte [0x14053be95], cl
je 0x14014166f
movzx edx, byte [0x14053d580]
add dl, 0xe7
cmp al, dl
jne 0x140141580
lea rax, [0x14053be80]
ret
xor edx, edx
lea rax, [0x14053bf50]
lea rcx, [0x140467090]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x14053d584]
add edx, r8d
add edx, 0xa5c3331c
cmp edx, 0x16
jl 0x1401415c0
mov al, 0x4e
xchg byte [0x14053bf66], al
lea rax, [0x14053bf50]
ret
xor eax, eax
lea rcx, [0x14053bea0]
lea rdx, [0x140466fe0]
nop word cs:[rax + rax]
cdqe
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
mov r8d, dword [0x14053d584]
mov r9d, r8d
xor r9d, 0xa5c3331c
and r8d, 0x25c3331c
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0x12
jl 0x140141620
mov al, 0xb
xchg byte [0x14053beb2], al
lea rax, [0x14053bea0]
ret
mov al, 0x42
xchg byte [0x14053c10d], al
lea rax, [0x14053c100]
ret
xor eax, eax
lea rcx, [0x14053be80]
lea rdx, [0x140466fc0]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140141698
inc rax
jmp 0x140141680
mov al, 0xab
xchg byte [0x14053be95], al
lea rax, [0x14053be80]
ret