joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a9080
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xfd3fe02f
mov r8d, dword [0x140532d9c]
add r8d, eax
cmp ecx, r8d
jne 0x1400a90d6
add eax, dword [0x140532d9c]
cmp edx, eax
jne 0x1400a910c
movzx eax, byte [0x140531343]
cmp al, 0xeb
je 0x1400a90ce
mov cl, 0x2a
nop dword [rax + rax]
mov al, 0x71
lock cmpxchg byte [0x140531343], cl
je 0x1400a916c
movzx edx, byte [0x140532d98]
add dl, 0xf9
cmp al, dl
jne 0x1400a90b0
lea rax, [0x140531340]
ret
add eax, dword [0x140532d9c]
cmp edx, eax
jne 0x1400a913c
movzx eax, byte [0x140531373]
cmp al, 0xe3
je 0x1400a9104
mov cl, 0x11
nop dword [rax]
mov al, 0x2c
lock cmpxchg byte [0x140531373], cl
je 0x1400a919c
cmp al, 0xe3
jne 0x1400a90f0
lea rax, [0x140531350]
ret
movzx eax, byte [0x14053138f]
cmp al, 0xac
je 0x1400a9134
mov cl, 0x2d
nop dword [rax]
mov al, 0xc0
lock cmpxchg byte [0x14053138f], cl
je 0x1400a91e6
cmp al, 0xac
jne 0x1400a9120
lea rax, [0x140531380]
ret
movzx eax, byte [0x1405313cb]
cmp al, 0xd5
je 0x1400a9164
mov cl, 0x55
nop dword [rax]
mov al, pe_nt_image_headers64
lock cmpxchg byte [0x1405313cb], cl
je 0x1400a9221
cmp al, 0xd5
jne 0x1400a9150
lea rax, [0x1405313c0]
ret
xor eax, eax
lea rcx, [0x140531340]
lea rdx, [0x14046aef0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1400a926f
inc rax
jmp 0x1400a9180
xor edx, edx
lea rax, [0x140531350]
lea rcx, [0x14046af00]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x23
jl 0x1400a91b0
movzx eax, byte [0x140532d98]
add al, 0xf1
xchg byte [0x140531373], al
lea rax, [0x140531350]
ret
xor eax, eax
lea rcx, [0x140531380]
lea rdx, [0x14046af30]
mov r8d, 0xfd3fe03e
nop dword [rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140532d9c]
add r10d, r8d
cmp r9d, r10d
jge 0x1400a927f
inc rax
jmp 0x1400a9200
xor edx, edx
lea rax, [0x1405313c0]
lea rcx, [0x14046af70]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xb
jl 0x1400a9240
mov al, 0xd5
xchg byte [0x1405313cb], al
lea rax, [0x1405313c0]
ret
mov al, 0xeb
xchg byte [0x140531343], al
lea rax, [0x140531340]
ret
movzx eax, byte [0x140532d98]
add al, 0xba
xchg byte [0x14053138f], al
lea rax, [0x140531380]
ret
Function at 0x1400a93b0
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400a93ec
test edx, edx
je 0x1400a942c
movzx eax, byte [0x140531220]
cmp al, 0x33
je 0x1400a93e4
mov cl, 0x6c
nop word cs:[rax + rax]
mov al, 0xe5
lock cmpxchg byte [0x140531220], cl
je 0x1400a9496
cmp al, 0x33
jne 0x1400a93d0
lea rax, [0x140531210]
ret
mov eax, 0xfd3fe02f
add eax, dword [0x140532d9c]
cmp edx, eax
jne 0x1400a945c
movzx eax, byte [0x1405312f9]
cmp al, 0x2b
je 0x1400a9424
mov cl, 0xf7
nop dword [rax + rax]
mov al, 0xbc
lock cmpxchg byte [0x1405312f9], cl
je 0x1400a9553
cmp al, 0x2b
jne 0x1400a9410
lea rax, [0x1405312f0]
ret
movzx eax, byte [0x140531403]
cmp al, 0xcc
je 0x1400a9454
mov cl, 0x55
nop dword [rax]
mov al, 0xa5
lock cmpxchg byte [0x140531403], cl
je 0x1400a94e1
cmp al, 0xcc
jne 0x1400a9440
lea rax, [0x1405313f0]
ret
movzx eax, byte [0x140531285]
cmp al, 0x98
je 0x1400a948e
mov cl, 0xba
nop dword [rax]
mov al, 0x43
lock cmpxchg byte [0x140531285], cl
je 0x1400a95a1
movzx edx, byte [0x140532d98]
add dl, 0xa6
cmp al, dl
jne 0x1400a9470
lea rax, [0x140531270]
ret
xor eax, eax
lea rcx, [0x140531210]
lea rdx, [0x14046ade0]
mov r8d, 0xfd3fe03f
nop dword [rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140532d9c]
add r10d, r8d
cmp r9d, r10d
jge 0x1400a94d1
inc rax
jmp 0x1400a94b0
mov al, 0x33
xchg byte [0x140531220], al
lea rax, [0x140531210]
ret
xor eax, eax
lea rcx, [0x1405313f0]
lea rdx, [0x14046afa0]
nop word cs:[rax + rax]
cdqe
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
mov r8d, dword [0x140532d9c]
mov r9d, r8d
xor r9d, 0xfd3fe030
and r8d, 0x7d3fe030
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0x13
jl 0x1400a9500
mov al, 0xcc
xchg byte [0x140531403], al
lea rax, [0x1405313f0]
ret
xor edx, edx
lea rax, [0x1405312f0]
lea rcx, [0x14046aea0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x140532d9c]
add edx, r8d
add edx, 0xfd3fe030
cmp edx, 9
jl 0x1400a9570
mov al, 0x2b
xchg byte [0x1405312f9], al
lea rax, [0x1405312f0]
ret
xor eax, eax
lea rcx, [0x140531270]
lea rdx, [0x14046ae30]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1400a95d8
inc rax
jmp 0x1400a95c0
mov al, 0x98
xchg byte [0x140531285], al
lea rax, [0x140531270]
ret
Function at 0x1400a97a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x1400a97d8
test edx, edx
je 0x1400a980c
movzx eax, byte [0x140531331]
cmp al, 0xd
je 0x1400a97d0
xor ecx, ecx
nop word cs:[rax + rax]
mov al, 0xde
lock cmpxchg byte [0x140531331], cl
je 0x1400a983c
cmp al, 0xd
jne 0x1400a97c0
lea rax, [0x140531320]
ret
movzx eax, byte [0x14053145f]
cmp al, 0x7b
je 0x1400a9804
mov cl, 0x53
nop word cs:[rax + rax]
mov al, 0x39
lock cmpxchg byte [0x14053145f], cl
je 0x1400a9898
cmp al, 0x7b
jne 0x1400a97f0
lea rax, [0x140531450]
ret
movzx eax, byte [0x140531266]
cmp al, 0xa2
je 0x1400a9834
mov cl, 0xce
nop dword [rax]
mov al, 0x77
lock cmpxchg byte [0x140531266], cl
je 0x1400a98d8
cmp al, 0xa2
jne 0x1400a9820
lea rax, [0x140531250]
ret
xor eax, eax
lea rcx, [0x140531320]
lea rdx, [0x14046aed0]
mov r8d, 0xfd3fe040
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140532d9c]
add r10d, r8d
cmp r9d, r10d
jge 0x1400a9881
inc rax
jmp 0x1400a9860
movzx eax, byte [0x140532d98]
add al, 0x1b
xchg byte [0x140531331], al
lea rax, [0x140531320]
ret
xor eax, eax
lea rcx, [0x140531450]
lea rdx, [0x14046b000]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1400a98c8
inc rax
jmp 0x1400a98b0
mov al, 0x7b
xchg byte [0x14053145f], al
lea rax, [0x140531450]
ret
xor eax, eax
lea rcx, [0x140531250]
lea rdx, [0x14046ae10]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x15
jg 0x1400a9908
inc rax
jmp 0x1400a98f0
movzx eax, byte [0x140532d98]
add al, 0xb0
xchg byte [0x140531266], al
lea rax, [0x140531250]
ret
Function at 0x140115870
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401158b6
test edx, edx
je 0x14011592a
movzx eax, byte [0x140535106]
cmp al, 0x6d
je 0x1401158ae
mov cl, 0x84
nop dword [rax]
mov al, 0x64
lock cmpxchg byte [0x140535106], cl
je 0x1401159a6
movzx edx, byte [0x14053fcb0]
add dl, 0xd0
cmp al, dl
jne 0x140115890
lea rax, [0x140535100]
ret
test edx, edx
je 0x140115966
movzx eax, byte [0x140534f90]
nop word cs:[rax + rax]
cmp al, 0x52
je 0x140115922
movzx ecx, byte [0x14053fcb0]
lea eax, [rcx - 0x56]
add cl, 0xc3
lock cmpxchg byte [0x140534f90], cl
jne 0x1401158d0
xor edx, edx
lea rax, [0x140534f80]
lea rcx, [0x14046d040]
nop dword [rax + rax]
movsxd r8, edx
movzx edx, byte [r8 + rcx]
add byte [r8 + rax], dl
lea edx, [r8 + r8]
sub edx, r8d
inc edx
cmp edx, 0x10
jl 0x140115900
mov al, 0x52
xchg byte [0x140534f90], al
lea rax, [0x140534f80]
ret
movzx eax, byte [0x1405350f3]
cmp al, 0x21
je 0x14011595e
mov cl, 0x7a
nop word [rax + rax]
mov al, 0xd4
lock cmpxchg byte [0x1405350f3], cl
je 0x140115a08
movzx edx, byte [0x14053fcb0]
add dl, 0x84
cmp al, dl
jne 0x140115940
lea rax, [0x1405350f0]
ret
movzx eax, byte [0x140535035]
movzx ecx, byte [0x14053fcb0]
add cl, 0x21
cmp al, cl
je 0x14011599e
mov cl, 0x6a
nop dword [rax]
mov al, 0xf2
lock cmpxchg byte [0x140535035], cl
je 0x140115a6f
movzx edx, byte [0x14053fcb0]
add dl, 0x21
cmp al, dl
jne 0x140115980
lea rax, [0x140535020]
ret
xor eax, eax
lea rcx, [0x140535100]
lea rdx, [0x14046d1a0]
mov r8d, 0x2ea84d3
nop dword [rax]
movzx r9d, byte [rax + rdx]
movzx r10d, byte [rax + rcx]
xor r10b, r9b
mov r11d, r10d
not r11b
and r11b, r9b
add r11b, r11b
add r11b, r10b
mov byte [rax + rcx], r11b
lea r9d, [rax + 1]
mov r10d, dword [0x14053fca0]
add r10d, r8d
cmp r9d, r10d
jge 0x1401159f8
inc rax
jmp 0x1401159c0
mov al, 0x6d
xchg byte [0x140535106], al
lea rax, [0x140535100]
ret
xor eax, eax
lea rcx, [0x1405350f0]
lea rdx, [0x14046d190]
nop dword [rax + rax]
cdqe
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
mov r8d, dword [0x14053fca0]
mov r9d, r8d
xor r9d, 0x2ea84ce
and r8d, 0x2ea84ce
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 3
jl 0x140115a20
mov al, 0x21
xchg byte [0x1405350f3], al
lea rax, [0x1405350f0]
ret
xor eax, eax
lea rcx, [0x140535020]
lea rdx, [0x14046d0d0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140115a98
inc rax
jmp 0x140115a80
mov al, 0xbe
xchg byte [0x140535035], al
lea rax, [0x140535020]
ret
Function at 0x140115eb0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
test ecx, ecx
je 0x140115ee5
movzx eax, byte [0x140535089]
cmp al, 0x95
je 0x140115fa0
mov cl, 0x23
nop dword [rax + rax]
mov al, 0x9c
lock cmpxchg byte [0x140535089], cl
je 0x140115f59
cmp al, 0x95
jne 0x140115ed0
jmp 0x140115fa0
mov ecx, dword [rsp + 0x40]
mov eax, ecx
xor eax, 0x6f6a88c7
add eax, dword [0x14053fca0]
cmp edx, eax
jne 0x140115f29
movzx eax, byte [0x140535179]
cmp al, 0x94
je 0x14011606b
mov cl, 0x9c
nop dword [rax + rax]
mov al, 0xe3
lock cmpxchg byte [0x140535179], cl
je 0x140115fac
cmp al, 0x94
jne 0x140115f10
jmp 0x14011606b
movzx eax, byte [0x14053518b]
cmp al, 0xd8
je 0x14011605a
mov dl, 0x6d
nop word [rax + rax]
mov al, 0x5e
lock cmpxchg byte [0x14053518b], dl
je 0x140115fdc
cmp al, 0xd8
jne 0x140115f40
jmp 0x14011605a
xor eax, eax
lea rcx, [0x140535080]
lea rdx, [0x14046d130]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x140115f98
inc rax
jmp 0x140115f70
mov al, 0x95
xchg byte [0x140535089], al
lea rax, [0x140535080]
jmp 0x140116072
xor eax, eax
lea rcx, [0x140535170]
lea rdx, [0x14046d210]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x140116063
inc rax
jmp 0x140115fc0
xor eax, eax
lea rdx, [0x140535180]
lea r8, [0x14046d220]
mov r9d, ecx
xor r9d, 0x6f6a88c4
nop word cs:[rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
movzx r11d, byte [rax + r8]
mov ebx, r11d
not bl
mov esi, r10d
and sil, bl
xor bl, r10b
not r10b
mov edi, r10d
xor dil, r11b
or sil, dil
not sil
and r10b, r11b
or r10b, bl
not r10b
or r10b, sil
mov byte [rax + rdx], r10b
mov r10d, dword [0x14053fca0]
add r10d, r9d
add eax, r10d
cmp eax, 0xb
jl 0x140116000
xor cl, 0x31
add cl, byte [0x14053fcb0]
xchg byte [0x14053518b], cl
lea rax, [0x140535180]
jmp 0x140116072
mov al, 0x94
xchg byte [0x140535179], al
lea rax, [0x140535170]
pop rbx
pop rdi
pop rsi
ret
Function at 0x1401243f0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14012442c
test edx, edx
je 0x14012446c
movzx eax, byte [0x140542193]
cmp al, 0xdc
je 0x140124424
mov cl, 0xa2
nop word cs:[rax + rax]
mov al, 0x50
lock cmpxchg byte [0x140542193], cl
je 0x14012454c
cmp al, 0xdc
jne 0x140124410
lea rax, [0x140542180]
ret
test edx, edx
je 0x14012450a
movzx eax, byte [0x1405421dd]
cmp al, 0x67
je 0x140124464
mov cl, 0xd4
nop word cs:[rax + rax]
mov al, 0x7f
lock cmpxchg byte [0x1405421dd], cl
je 0x140124598
cmp al, 0x67
jne 0x140124450
lea rax, [0x1405421d0]
ret
movzx eax, byte [0x1405421f2]
nop word cs:[rax + rax]
cmp al, 0xb
je 0x140124502
movzx ecx, byte [0x1405422b8]
lea eax, [rcx - 0x2f]
inc cl
lock cmpxchg byte [0x1405421f2], cl
jne 0x140124480
xor edx, edx
lea rax, [0x1405421e0]
lea rcx, [0x14046da20]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, dword [0x1405422a8]
add edx, r8d
add edx, 0x3a8ab2b2
mov r9d, r8d
xor r9d, 0x3a8ab2c3
and r8d, 0x3a8ab2c3
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x1401244b0
mov al, 0xb
xchg byte [0x1405421f2], al
lea rax, [0x1405421e0]
ret
movzx eax, byte [0x14054217d]
movzx ecx, byte [0x1405422b8]
add cl, 0xbd
cmp al, cl
je 0x140124544
mov cl, 0x95
nop word cs:[rax + rax]
mov al, 0xd0
lock cmpxchg byte [0x14054217d], cl
je 0x1401245e1
cmp al, 0x6f
jne 0x140124530
lea rax, [0x140542170]
ret
xor eax, eax
lea rcx, [0x140542180]
lea rdx, [0x14046d9d0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x12
jg 0x140124588
inc rax
jmp 0x140124560
mov al, 0xdc
xchg byte [0x140542193], al
lea rax, [0x140542180]
ret
xor eax, eax
lea rcx, [0x1405421d0]
lea rdx, [0x14046da10]
mov r8d, 0x3a8ab2be
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405422a8]
add r10d, r8d
cmp r9d, r10d
jge 0x1401245d1
inc rax
jmp 0x1401245b0
mov al, 0x67
xchg byte [0x1405421dd], al
lea rax, [0x1405421d0]
ret
xor eax, eax
lea rcx, [0x140542170]
lea rdx, [0x14046d9c0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140124618
inc rax
jmp 0x140124600
mov al, 0x6f
xchg byte [0x14054217d], al
lea rax, [0x140542170]
ret
Function at 0x140129780
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r9, r8
mov rsi, rdx
mov rdi, rcx
mov r8, qword [rcx]
mov rdx, qword [r8 + 8]
xor ebp, ebp
cmp byte [rdx + 0x19], 0
je 0x1401297ae
mov rbx, rdx
mov rax, r8
cmp byte [rax + 0x19], 0
jne 0x14012980f
jmp 0x140129807
mov ecx, dword [r9]
mov rax, r8
nop word cs:[rax + rax]
mov rbx, rdx
mov r10d, dword [rdx + 0x20]
cmp r10d, ecx
cmovae rax, rdx
lea rdx, [rdx + 0x10]
cmovae rdx, rbx
mov rdx, qword [rdx]
movzx r11d, byte [0x140542ddc]
mov ebp, r11d
xor bpl, 0x8a
and r11b, 0xa
add r11b, r11b
add r11b, bpl
cmp byte [rdx + 0x19], r11b
je 0x1401297c0
xor ebp, ebp
cmp r10d, ecx
setae bpl
cmp byte [rax + 0x19], 0
jne 0x14012980f
mov ecx, dword [r9]
cmp ecx, dword [rax + 0x20]
jae 0x14012985b
movabs rax, 0x147ae147ae147ae
cmp qword [rdi + 8], rax
je 0x14012985f
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.140129870
mov r8, qword [rsp + 0x40]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], ebp
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.1401299d0
mov cl, 1
mov qword [rsi], rax
mov byte [rsi + 8], cl
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
xor ecx, ecx
jmp 0x140129849
call fcn.1400a6a10
int3
Function at 0x1401419c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa5c3331b
add eax, dword [0x1405458b4]
cmp ecx, eax
jne 0x140141a0c
test edx, edx
je 0x140141a6c
movzx eax, byte [0x140544360]
cmp al, 0x63
je 0x140141a04
mov cl, 0x15
nop word cs:[rax + rax]
mov al, 0x10
lock cmpxchg byte [0x140544360], cl
je 0x140141b63
cmp al, 0x63
jne 0x1401419f0
lea rax, [0x140544350]
ret
test edx, edx
je 0x140141b11
movzx eax, byte [0x1405442f9]
nop dword [rax + rax]
cmp al, 0xdc
je 0x140141ba0
movzx ecx, byte [0x1405458b0]
lea eax, [rcx - 0x73]
add cl, 0xa3
lock cmpxchg byte [0x1405442f9], cl
jne 0x140141a20
xor eax, eax
lea rcx, [0x1405442f0]
lea rdx, [0x14046f060]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x140141b98
inc rax
jmp 0x140141a50
movzx eax, byte [0x140544316]
nop word cs:[rax + rax]
cmp al, 0x6e
je 0x140141b09
movzx ecx, byte [0x1405458b0]
lea eax, [rcx - 0x21]
add cl, 0x88
lock cmpxchg byte [0x140544316], cl
jne 0x140141a80
xor eax, eax
lea rcx, [0x140544310]
lea rdx, [0x14046f080]
nop
cdqe
xor r8d, r8d
sub r8b, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
xor r10d, r10d
sub r10b, r9b
mov r9d, r8d
xor r9b, r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
neg r10b
mov byte [rax + rcx], r10b
mov r8d, dword [0x1405458b4]
mov r9d, r8d
xor r9d, 0x5a3ccce3
and r9d, r8d
xor r8d, 0xa5c3331c
lea r8d, [r8 + r9*2]
add eax, r8d
cmp eax, 6
jl 0x140141ab0
mov al, 0x6e
xchg byte [0x140544316], al
lea rax, [0x140544310]
ret
movzx eax, byte [0x140544455]
movzx ecx, byte [0x1405458b0]
add cl, 0xc9
cmp al, cl
je 0x140141b5b
nop word cs:[rax + rax]
movzx ecx, byte [0x1405458b0]
mov edx, ecx
xor dl, 0x40
mov eax, ecx
not al
and al, 0x3f
or al, dl
not al
add al, al
add al, dl
add cl, 0xb7
lock cmpxchg byte [0x140544455], cl
je 0x140141bb8
cmp al, 0x8d
jne 0x140141b30
lea rax, [0x140544440]
ret
xor eax, eax
lea rcx, [0x140544350]
lea rdx, [0x14046f0c0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140141ba8
inc rax
jmp 0x140141b80
mov al, 0xdc
xchg byte [0x1405442f9], al
lea rax, [0x1405442f0]
ret
mov al, 0x63
xchg byte [0x140544360], al
lea rax, [0x140544350]
ret
xor edx, edx
lea rax, [0x140544440]
lea rcx, [0x14046f1a0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x140141bd0
mov al, 0x8d
xchg byte [0x140544455], al
lea rax, [0x140544440]
ret
Function at 0x14017c310
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0xf3bfb8dc
add eax, dword [0x14054db68]
cmp ecx, eax
jne 0x14017c3bb
test edx, edx
je 0x14017c3f8
movzx eax, byte [0x14054d909]
nop word [rax + rax]
cmp al, 0x9a
je 0x14017c3b3
movzx ecx, byte [0x14054db78]
mov eax, r8d
xor al, 0xc2
add al, cl
mov edx, r8d
xor dl, 0xfc
add dl, cl
lock cmpxchg byte [0x14054d909], dl
jne 0x14017c340
xor edx, edx
lea rax, [0x14054d900]
lea rcx, [0x14046fc40]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
add edx, 0xd386914c
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x2c796eb4
cmp edx, 9
jl 0x14017c380
mov al, 0x9a
xchg byte [0x14054d909], al
lea rax, [0x14054d900]
ret
test edx, edx
je 0x14017c475
movzx eax, byte [0x14054d982]
cmp al, 0x9a
je 0x14017c3f0
mov cl, 0xa4
mov al, 0x1a
lock cmpxchg byte [0x14054d982], cl
je 0x14017c4a8
mov edx, r8d
xor dl, 0x49
add dl, byte [0x14054db78]
cmp al, dl
jne 0x14017c3d0
lea rax, [0x14054d970]
ret
movzx eax, byte [0x14054d74c]
nop
cmp al, 0xb5
je 0x14017c46d
movzx ecx, byte [0x14054db78]
mov edx, r8d
not dl
and dl, 0x94
mov eax, r8d
xor al, 0x6b
or al, dl
not al
or al, dl
add al, cl
add cl, r8b
lock cmpxchg byte [0x14054d74c], cl
jne 0x14017c400
xor edx, edx
lea rax, [0x14054d720]
lea rcx, [0x14046fa70]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0x7ffffffe
and r8d, edx
xor edx, 1
lea edx, [rdx + r8*2]
cmp edx, 0x2c
jl 0x14017c440
mov al, 0xb5
xchg byte [0x14054d74c], al
lea rax, [0x14054d720]
ret
movzx eax, byte [0x14054d935]
cmp al, 0xe0
je 0x14017c4a0
mov cl, 0x23
nop word cs:[rax + rax]
mov al, 0xfd
lock cmpxchg byte [0x14054d935], cl
je 0x14017c4e8
cmp al, 0xe0
jne 0x14017c490
lea rax, [0x14054d920]
ret
xor eax, eax
lea rcx, [0x14054d970]
lea rdx, [0x14046fcb0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x14017c4d8
inc rax
jmp 0x14017c4c0
mov al, 0x9a
xchg byte [0x14054d982], al
lea rax, [0x14054d970]
ret
xor eax, eax
lea rcx, [0x14054d920]
lea rdx, [0x14046fc60]
xor r8d, 0xf3bfb8dd
neg r8d
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rcx]
mov r10d, r9d
xor r10b, 0xd6
and r9b, 0x56
add r9b, r9b
add r9b, r10b
add r9b, byte [rax + rdx]
add r9b, 0x2a
mov byte [rax + rcx], r9b
xor r9d, r9d
sub r9d, dword [0x14054db68]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
sub eax, r9d
cmp eax, 0x15
jl 0x14017c510
mov al, pe_nt_image_headers64
xchg byte [0x14054d935], al
lea rax, [0x14054d920]
ret
Function at 0x14017c760
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14017c7ac
mov eax, r8d
xor eax, 0xcbd56a66
add eax, dword [0x14054db68]
cmp edx, eax
jne 0x14017c7f8
movzx eax, byte [0x14054d94b]
cmp al, 0x70
je 0x14017c7a4
mov cl, 0x21
nop dword [rax + rax]
mov al, 0x46
lock cmpxchg byte [0x14054d94b], cl
je 0x14017c87c
cmp al, 0x70
jne 0x14017c790
lea rax, [0x14054d940]
ret
test edx, edx
je 0x14017c84a
movzx eax, byte [0x14054d8ae]
cmp al, 0xd0
je 0x14017c7f0
mov cl, 0x32
nop word cs:[rax + rax]
mov al, 0xa5
lock cmpxchg byte [0x14054d8ae], cl
je 0x14017c908
mov edx, r8d
xor dl, 0x85
add dl, byte [0x14054db78]
cmp al, dl
jne 0x14017c7d0
lea rax, [0x14054d8a0]
ret
movzx eax, byte [0x14054d8e3]
cmp al, 0xfa
je 0x14017c842
mov cl, 0x75
nop word cs:[rax + rax]
mov al, 0x9e
lock cmpxchg byte [0x14054d8e3], cl
je 0x14017c8a8
movzx edx, byte [0x14054db78]
mov r9d, r8d
xor r9b, 0x53
mov r10d, r9d
xor r10b, dl
and r9b, dl
add r9b, r9b
add r9b, r10b
cmp al, r9b
jne 0x14017c810
lea rax, [0x14054d8c0]
ret
movzx eax, byte [0x14054d91d]
cmp al, 6
je 0x14017c874
mov cl, 0xf5
nop word [rax + rax]
mov al, 0x93
lock cmpxchg byte [0x14054d91d], cl
je 0x14017c948
cmp al, 6
jne 0x14017c860
lea rax, [0x14054d910]
ret
xor eax, eax
lea rcx, [0x14054d940]
lea rdx, [0x14046fc80]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x14017c8e8
inc rax
jmp 0x14017c890
xor eax, eax
lea rcx, [0x14054d8c0]
lea rdx, [0x14046fc00]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x14017c8f8
inc rax
jmp 0x14017c8c0
mov al, 0x70
xchg byte [0x14054d94b], al
lea rax, [0x14054d940]
ret
mov al, 0xfa
xchg byte [0x14054d8e3], al
lea rax, [0x14054d8c0]
ret
xor eax, eax
lea rcx, [0x14054d8a0]
lea rdx, [0x14046fbe0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x14017c938
inc rax
jmp 0x14017c920
mov al, 0xd0
xchg byte [0x14054d8ae], al
lea rax, [0x14054d8a0]
ret
xor edx, edx
lea rax, [0x14054d910]
lea rcx, [0x14046fc50]
xor r8d, 0xcbd56a13
nop
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
mov r9d, dword [0x14054db68]
add r9d, r8d
cmp edx, r9d
jl 0x14017c960
mov al, 6
xchg byte [0x14054d91d], al
lea rax, [0x14054d910]
ret