joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140108ee0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140108f1c
test edx, edx
je 0x140108f4c
movzx eax, byte [0x140500df2]
cmp al, 0x85
je 0x140108f14
mov cl, 0xb
nop word cs:[rax + rax]
mov al, 0x67
lock cmpxchg byte [0x140500df2], cl
je 0x140108fac
cmp al, 0x85
jne 0x140108f00
lea rax, [0x140500de0]
ret
test edx, edx
je 0x140108f7c
movzx eax, byte [0x140500d93]
cmp al, 0x6d
je 0x140108f44
mov cl, 0x62
nop dword [rax]
mov al, 0x15
lock cmpxchg byte [0x140500d93], cl
je 0x140108fe8
cmp al, 0x6d
jne 0x140108f30
lea rax, [0x140500d80]
ret
movzx eax, byte [0x140500ddd]
cmp al, 0xf8
je 0x140108f74
mov ecx, dword [rsp + 0x28]
mov dl, 0x21
nop dword [rax]
mov al, 0x43
lock cmpxchg byte [0x140500ddd], dl
je 0x14010903a
cmp al, 0xf8
jne 0x140108f60
lea rax, [0x140500dd0]
ret
movzx eax, byte [0x140500e22]
cmp al, 0xde
je 0x140108fa4
mov cl, 0x91
nop dword [rax]
mov al, 0x6b
lock cmpxchg byte [0x140500e22], cl
je 0x14010907f
cmp al, 0xde
jne 0x140108f90
lea rax, [0x140500e10]
ret
xor eax, eax
lea rcx, [0x140500de0]
lea rdx, [0x140429460]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x140108fd8
inc rax
jmp 0x140108fc0
mov al, 0x85
xchg byte [0x140500df2], al
lea rax, [0x140500de0]
ret
xor edx, edx
lea rax, [0x140500d80]
lea rcx, [0x140429410]
nop dword [rax + rax]
movsxd r8, edx
movzx edx, byte [r8 + rcx]
mov r9d, edx
xor r9b, dl
not r9b
and r9b, byte [r8 + rax]
xor r9b, dl
mov byte [r8 + rax], r9b
lea edx, [r8 + r8]
sub edx, r8d
inc edx
cmp edx, 0x13
jl 0x140109000
mov al, 0x6d
xchg byte [0x140500d93], al
lea rax, [0x140500d80]
ret
xor eax, eax
lea rdx, [0x140500dd0]
lea r8, [0x140429450]
nop word [rax + rax]
movzx r9d, byte [rax + r8]
add byte [rax + rdx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xc
jg 0x140109068
inc rax
jmp 0x140109050
xor cl, 0xdb
add cl, byte [0x140500f94]
xchg byte [0x140500ddd], cl
lea rax, [0x140500dd0]
ret
xor eax, eax
lea rcx, [0x140500e10]
lea rdx, [0x140429490]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x1401090a8
inc rax
jmp 0x140109090
mov al, 0xde
xchg byte [0x140500e22], al
lea rax, [0x140500e10]
ret
Function at 0x14010c3c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r9, r8
mov rsi, rdx
mov rdi, rcx
mov r8, qword [rcx]
mov rdx, qword [r8 + 8]
xor ebp, ebp
cmp byte [rdx + 0x19], 0
je 0x14010c3ee
mov rbx, rdx
mov rax, r8
cmp byte [rax + 0x19], 0
jne 0x14010c452
jmp 0x14010c44a
mov ecx, dword [r9]
mov rax, r8
nop word cs:[rax + rax]
mov rbx, rdx
mov edx, dword [rdx + 0x20]
mov r10d, dword [0x1405640a8]
mov r11d, edx
xor r11d, r11d
not r11d
and r11d, r10d
xor r11d, edx
and r10d, edx
lea r10d, [r11 + r10*2]
lea rdx, [rbx + 0x10]
cmp r10d, ecx
cmovae rax, rbx
cmovae rdx, rbx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], 0
je 0x14010c400
xor ebp, ebp
cmp r10d, ecx
setae bpl
cmp byte [rax + 0x19], 0
jne 0x14010c452
mov ecx, dword [r9]
cmp ecx, dword [rax + 0x20]
jae 0x14010c4a5
movabs rax, 0x4319bbf3ac0f099b
add rax, qword [0x140501188]
cmp qword [rdi + 8], rax
je 0x14010c4a9
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.14010c4b0
mov r8, qword [rsp + 0x40]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], ebp
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.14010c650
mov cl, 1
mov qword [rsi], rax
mov byte [rsi + 8], cl
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
xor ecx, ecx
jmp 0x14010c493
call fcn.1400a84a0
int3
Function at 0x140111750
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xe3cf9ea3
add eax, dword [0x140501b88]
cmp ecx, eax
jne 0x14011178c
test edx, edx
je 0x1401117bc
movzx eax, byte [0x1405019c0]
cmp al, 0x45
je 0x140111784
mov cl, 0xf1
mov al, 0xf4
lock cmpxchg byte [0x1405019c0], cl
je 0x14011181c
cmp al, 0x45
jne 0x140111770
lea rax, [0x1405019b0]
ret
test edx, edx
je 0x1401117ec
movzx eax, byte [0x140501a6d]
cmp al, 0x12
je 0x1401117b4
mov cl, 0x59
nop dword [rax]
mov al, 0x85
lock cmpxchg byte [0x140501a6d], cl
je 0x140111848
cmp al, 0x12
jne 0x1401117a0
lea rax, [0x140501a60]
ret
movzx eax, byte [0x140501a83]
cmp al, 0x7a
je 0x1401117e4
mov cl, 0x26
nop dword [rax]
mov al, 0xec
lock cmpxchg byte [0x140501a83], cl
je 0x140111898
cmp al, 0x7a
jne 0x1401117d0
lea rax, [0x140501a70]
ret
movzx eax, byte [0x140501a02]
cmp al, 0x52
je 0x140111814
mov cl, 0x1a
nop dword [rax]
mov al, 0x9c
lock cmpxchg byte [0x140501a02], cl
je 0x1401118d8
cmp al, 0x52
jne 0x140111800
lea rax, [0x1405019f0]
ret
xor eax, eax
lea rcx, [0x1405019b0]
lea rdx, [0x1404297c0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140111878
inc rax
jmp 0x140111830
xor eax, eax
lea rcx, [0x140501a60]
lea rdx, [0x140429860]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140111888
inc rax
jmp 0x140111860
mov al, 0x45
xchg byte [0x1405019c0], al
lea rax, [0x1405019b0]
ret
mov al, 0x12
xchg byte [0x140501a6d], al
lea rax, [0x140501a60]
ret
xor eax, eax
lea rcx, [0x140501a70]
lea rdx, [0x140429870]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x12
jg 0x140111921
inc rax
jmp 0x1401118b0
xor edx, edx
lea rax, [0x1405019f0]
lea rcx, [0x1404297f0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x140501b88]
add edx, r8d
add edx, 0xe3cf9ea4
cmp edx, 0x12
jl 0x1401118f0
mov al, 0x52
xchg byte [0x140501a02], al
lea rax, [0x1405019f0]
ret
mov al, 0x7a
xchg byte [0x140501a83], al
lea rax, [0x140501a70]
ret
Function at 0x1401190c0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401190fc
test edx, edx
je 0x14011913c
movzx eax, byte [0x140501d4f]
cmp al, 0x66
je 0x1401190f4
mov cl, 0x99
nop word cs:[rax + rax]
mov al, 0x8a
lock cmpxchg byte [0x140501d4f], cl
je 0x1401191c1
cmp al, 0x66
jne 0x1401190e0
lea rax, [0x140501d40]
ret
test edx, edx
je 0x140119176
movzx eax, byte [0x140501c52]
movzx ecx, byte [0x140501ff8]
add cl, 0x61
cmp al, cl
je 0x140119134
mov cl, 0x61
nop word [rax + rax]
mov al, 0xb0
lock cmpxchg byte [0x140501c52], cl
je 0x140119226
cmp al, 0xfa
jne 0x140119120
lea rax, [0x140501c50]
ret
movzx eax, byte [0x140501c73]
cmp al, 0x8d
je 0x14011916e
mov cl, 0xd6
nop dword [rax]
mov al, 0xda
lock cmpxchg byte [0x140501c73], cl
je 0x140119258
movzx edx, byte [0x140501ff8]
add dl, 0xf4
cmp al, dl
jne 0x140119150
lea rax, [0x140501c70]
ret
movzx eax, byte [0x140501dfc]
cmp al, 0x6a
je 0x1401191b9
nop word cs:[rax + rax]
movzx ecx, byte [0x140501ff8]
lea eax, [rcx + 0xd]
add cl, 0x85
lock cmpxchg byte [0x140501dfc], cl
je 0x1401192af
movzx ecx, byte [0x140501ff8]
add cl, 0xd1
cmp al, cl
jne 0x140119190
lea rax, [0x140501df0]
ret
xor edx, edx
lea rax, [0x140501d40]
lea rcx, [0x140429b20]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x1401191e0
movzx eax, byte [0x140501ff8]
add al, 0xcd
xchg byte [0x140501d4f], al
lea rax, [0x140501d40]
ret
xor eax, eax
lea rcx, [0x140501c50]
lea rdx, [0x140429a50]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x140119288
inc rax
jmp 0x140119240
xor eax, eax
lea rcx, [0x140501c70]
lea rdx, [0x140429a70]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x14011929f
inc rax
jmp 0x140119270
movzx eax, byte [0x140501ff8]
add al, 0x61
xchg byte [0x140501c52], al
lea rax, [0x140501c50]
ret
mov al, 0x8d
xchg byte [0x140501c73], al
lea rax, [0x140501c70]
ret
xor edx, edx
lea rax, [0x140501df0]
lea rcx, [0x140429bd0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140501ffc]
add edx, r8d
add edx, 0x2fb19105
cmp edx, 0xc
jl 0x1401192c0
mov al, 0x6a
xchg byte [0x140501dfc], al
lea rax, [0x140501df0]
ret
Function at 0x140119b10
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140119b48
movzx eax, byte [0x140501dd9]
cmp al, 0xf1
je 0x140119b40
mov cl, 0x40
nop word cs:[rax + rax]
mov al, 0xd1
lock cmpxchg byte [0x140501dd9], cl
je 0x140119b78
cmp al, 0xf1
jne 0x140119b30
lea rax, [0x140501dc0]
ret
movzx eax, byte [0x140501d02]
cmp al, 0x39
je 0x140119b70
mov cl, 0x8c
nop word cs:[rax + rax]
mov al, 0x18
lock cmpxchg byte [0x140501d02], cl
je 0x140119bcb
cmp al, 0x39
jne 0x140119b60
lea rax, [0x140501d00]
ret
xor edx, edx
lea rax, [0x140501dc0]
lea rcx, [0x140429ba0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0x46223ea
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0xfb9ddc16
cmp edx, 0x19
jl 0x140119b90
mov al, 0xf1
xchg byte [0x140501dd9], al
lea rax, [0x140501dc0]
ret
xor eax, eax
lea rcx, [0x140501d00]
lea rdx, [0x140429af0]
xor r9d, 0xa6f2a72f
nop word cs:[rax + rax]
cdqe
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
mov r8d, dword [0x140501ffc]
add r8d, r9d
add eax, r8d
cmp eax, 2
jl 0x140119bf0
mov al, 0x39
xchg byte [0x140501d02], al
lea rax, [0x140501d00]
ret
Function at 0x140121900
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov r14d, r9d
mov rdi, rdx
mov rsi, rcx
mov ebx, r8d
lea r15, [0x14042a448]
mov qword [rbp - 8], r15
mov dword [rbp], 0
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov byte [rbp + 0x18], 0
mov dword [rsp + 0x28], 0xdd371523
mov dword [rsp + 0x20], 0x149eed15
lea rcx, [rbp - 8]
mov r8, rbx
mov r9d, 0x3360944b
call fcn.14011e340
mov byte [rbp + 0x18], al
cmp byte [rsi + 0x6ec], 0
jne 0x1401219f0
or dword [rsi + 0x98], 0x100
movsxd rax, r14d
lea r14, [rax + rax*4]
shl r14, 5
add r14, qword [rsi + 0x370]
lea rdx, [rbp - 0x30]
mov rcx, r14
xor r8d, r8d
call fcn.140321bf0
test al, al
je 0x140121abc
lea rdx, [rbp - 0x50]
lea r8, [rbp - 0x30]
mov rcx, r14
mov r9d, 0x20
call fcn.1403226d0
lea rcx, [rsi + 0x59c]
lea r14, [rsi + 0x5ec]
movzx r9d, byte [rsi + 0x598]
mov qword [rsp + 0x20], r14
lea rdx, [rbp - 0x50]
mov r8d, 0x20
call fcn.1402b4600
xorps xmm0, xmm0
movups xmmword [r14], xmm0
lea rcx, [rsi + 0x59c]
mov rdx, rdi
mov r8, rbx
mov r9, rdi
call fcn.1402b4e70
mov r14d, dword [rbp + 0x80]
mov ecx, 0x14542dfb
nop word cs:[rax + rax]
mov byte [rsi + 0x6ec], 1
mov dword [rbp - 0x30], 0
mov edx, dword [0x140564198]
lea eax, [rdx - 1]
imul eax, edx
mov r8d, dword [0x14050300c]
add r8d, ecx
xor edx, edx
div r8d
test edx, edx
je 0x140121a65
movzx eax, byte [0x140503008]
add al, 0x48
mov byte [rsi + 0x6ec], al
mov dword [rbp - 0x30], 0
jmp 0x140121a20
lea rcx, [rbp - 0x30]
call fcn.1402b9780
lea rcx, [rbp - 0x30]
mov rdx, rdi
mov r8, rbx
call fcn.1402b9790
mov eax, dword [0x14056419c]
cmp eax, 0x2c
nop word cs:[rax + rax]
mov eax, dword [0x14056419c]
cmp eax, 0x3a
jg 0x140121a90
lea rcx, [rbp - 0x30]
call fcn.1402b9e00
cmp eax, r14d
jne 0x140121ab8
xor eax, eax
test al, al
je 0x140121b47
jmp 0x140121b72
xor edi, edi
jmp 0x140121ac0
xor edi, edi
jmp 0x140121b04
mov eax, dword [0x14056419c]
mov ecx, 0x14542e3a
add ecx, dword [0x14050300c]
cmp eax, ecx
jge 0x140121ae1
cmp dword [0x14050300c], 0xebabd207
je 0x140121b04
mov eax, 0x14542e58
nop word cs:[rax + rax]
mov ecx, dword [0x14056419c]
mov edx, dword [0x14050300c]
add edx, eax
cmp ecx, edx
jge 0x140121af0
jmp 0x140121ad5
mov qword [rbp - 8], r15
cmp byte [rbp + 0x18], 0
je 0x140121b35
cmp dword [0x14050300c], 0xebabd207
nop dword [rax + rax]
cmp dword [0x14050300c], 0xebabd207
jne 0x140121b20
lea rcx, [rbp - 8]
call fcn.140119e40
mov eax, edi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov eax, dword [rsi + 0x98]
and eax, 0x100
mov ecx, 0x14542df9
add ecx, dword [0x14050300c]
cmp eax, ecx
setne dil
mov eax, dword [0x14056419c]
cmp eax, 0x35
jl 0x140121ac0
lea rax, [fcn.140121900]
add eax, eax
add eax, 0x3380
mov ecx, eax
not ecx
nop word cs:[rax + rax]
mov edx, dword [rsi + 0x98]
mov edx, dword [0x14050300c]
lea r8d, [rdx + 0x14542dfa]
mov r9d, eax
xor r9d, r8d
not r8d
and r8d, ecx
or r8d, r9d
not r8d
add edx, 0x14542df9
cmp r8d, edx
jne 0x140121b90
jmp 0x140121b47
Function at 0x140121c20
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
movzx ebx, byte [0x1405641a0]
mov r8, qword [rcx + 0x370]
mov rax, qword [rcx + 0x378]
movabs rcx, 0x77bdff273cab8082
sub rax, rcx
movabs rdx, 0xb64c0246fb7575e3
sub rax, rdx
add rax, rcx
sub rax, r8
add rax, rdx
shr rax, 5
imul eax, eax, 0xcccccccd
test eax, eax
jle 0x140121d23
mov edi, 0x80
mov r14d, 1
nop word cs:[rax + rax]
mov eax, dword [0x14050300c]
mov ecx, eax
xor ecx, 0x14542df9
and eax, 0x14542df9
lea eax, [rcx + rax*2]
cmp dword [r8 + rdi + 8], eax
jne 0x140121cb5
cmp qword [r8 + rdi + 8], 0
je 0x140121cf2
mov edx, dword [r8 + rdi - 0x5c]
add r8, rdi
mov eax, dword [0x140502f54]
xor eax, ebx
mov ecx, dword [0x14050300c]
add eax, ecx
add eax, 0x1454e473
cdqe
add rax, qword [0x140502f68]
mov dword [rsp + 0x20], 0x48cb1db7
mov rcx, rsi
mov r9d, 0xcd272ff7
call qword [0x1404ee420]
mov r8, qword [rsi + 0x370]
mov rax, qword [rsi + 0x378]
sub rax, r8
shr rax, 5
imul eax, eax, 0xcccccccd
cdqe
cmp r14, rax
jge 0x140121d23
add rdi, 0xa0
inc r14
jmp 0x140121c90
movabs rax, 0x47347648eb7c5ac0
movabs rcx, 0x3f1593f8982766b9
mov edx, dword [0x140564198]
lea r8d, [rdx - 1]
imul r8d, edx
test r8b, 1
jne 0x140121d70
mov rdx, qword [rsi + 0x398]
sub rdx, rcx
sub rdx, qword [rsi + 0x390]
mov r8d, dword [0x14056419c]
cmp r8d, 0x37
jl 0x140121d7d
nop dword [rax]
mov edx, dword [0x14056419c]
cmp edx, 0x31
jge 0x140121d70
jmp 0x140121d4b
add rcx, rax
add rdx, rcx
sub rdx, rax
shr rdx, 2
test edx, edx
jle 0x140121de1
xor edi, edi
mov eax, dword [0x140502f54]
mov ecx, eax
xor ecx, ebx
and eax, ebx
lea eax, [rcx + rax*2]
add eax, 0xb67a
cdqe
add rax, qword [0x140502f68]
mov dword [rsp + 0x20], 0x48cb1db7
mov rcx, rsi
mov edx, edi
xor r8d, r8d
mov r9d, 0xcd272ff7
call qword [0x1404ee420]
inc edi
mov rax, qword [rsi + 0x398]
sub rax, qword [rsi + 0x390]
shr rax, 2
cmp edi, eax
jl 0x140121d90
lea rdi, [rsi + 0x558]
mov rcx, qword [rsi + 0x558]
test rcx, rcx
je 0x140121e3a
cmp dword [rsi + 0x574], 1
jne 0x140121e0b
mov r8, qword [rsi + 0x560]
xor edx, edx
call fcn.14040c5e0
mov rcx, qword [rdi]
test rcx, rcx
je 0x140121e3a
mov eax, dword [0x140502f50]
xor eax, ebx
add eax, 0xb67a
cdqe
add rax, qword [0x140502f70]
mov edx, 0x23f910e0
mov r8d, 0x6bd69996
call qword [0x1404ee420]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov byte [rsi + 0x570], 1
mov eax, dword [0x140502f58]
mov ecx, ebx
xor ecx, ecx
not ecx
and ecx, eax
and eax, ebx
xor ecx, ebx
or ecx, eax
mov eax, dword [0x14050300c]
add eax, ecx
add eax, 0x1454e473
cdqe
add rax, qword [0x140502f60]
mov rdx, qword [0x1404ee420]
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp rdx
Function at 0x1401241d0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14012420c
movzx eax, byte [0x140502ecd]
cmp al, 0xd3
je 0x140124204
mov cl, 0xc2
nop word cs:[rax + rax]
mov al, 0x39
lock cmpxchg byte [0x140502ecd], cl
je 0x140124299
cmp al, 0xd3
jne 0x1401241f0
lea rax, [0x140502ec0]
ret
test edx, edx
je 0x1401242ec
movzx eax, byte [0x140502f1d]
nop dword [rax + rax]
cmp al, 0x6c
je 0x140124291
movzx ecx, byte [0x140503008]
mov edx, ecx
xor dl, 0xf2
mov eax, ecx
and al, 0x72
add al, al
add al, dl
add al, 0x88
add cl, 0x8f
lock cmpxchg byte [0x140502f1d], cl
jne 0x140124220
xor edx, edx
lea rax, [0x140502f10]
lea rcx, [0x14042ac00]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
not edx
and edx, 0x7ffffffe
or edx, r8d
not edx
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x140124260
mov al, 0x6c
xchg byte [0x140502f1d], al
lea rax, [0x140502f10]
ret
xor eax, eax
lea rcx, [0x140502ec0]
lea rdx, [0x14042abb0]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401242dc
inc rax
jmp 0x1401242b0
mov al, 0xd3
xchg byte [0x140502ecd], al
lea rax, [0x140502ec0]
ret
movzx eax, byte [0x140502ea7]
movzx ecx, byte [0x140503008]
add cl, 0xb3
cmp al, cl
je 0x140124320
mov cl, 0xa1
nop word cs:[rax + rax]
mov al, 0x32
lock cmpxchg byte [0x140502ea7], cl
je 0x140124328
cmp al, 0x6c
jne 0x140124310
lea rax, [0x140502ea0]
ret
xor eax, eax
lea rcx, [0x140502ea0]
lea rdx, [0x14042ab90]
mov r8d, 0x14542e00
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14050300c]
add r10d, r8d
cmp r9d, r10d
jge 0x140124361
inc rax
jmp 0x140124340
mov al, 0x6c
xchg byte [0x140502ea7], al
lea rax, [0x140502ea0]
ret
Function at 0x1401245e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14542df9
add eax, dword [0x14050300c]
cmp ecx, eax
jne 0x14012461c
test edx, edx
je 0x14012465c
movzx eax, byte [0x140502e33]
cmp al, 9
je 0x140124614
mov cl, 0xc4
mov al, 0x70
lock cmpxchg byte [0x140502e33], cl
je 0x14012470c
cmp al, 9
jne 0x140124600
lea rax, [0x140502e30]
ret
test edx, edx
je 0x1401246df
movzx eax, byte [0x140502dc5]
cmp al, 0x3f
je 0x140124654
mov cl, 0x9e
nop word cs:[rax + rax]
mov al, 0x7a
lock cmpxchg byte [0x140502dc5], cl
je 0x140124751
cmp al, 0x3f
jne 0x140124640
lea rax, [0x140502dc0]
ret
movzx eax, byte [0x140502d05]
nop word cs:[rax + rax]
cmp al, 0xf6
je 0x1401246d7
movzx ecx, byte [0x140503008]
lea eax, [rcx - 8]
mov edx, ecx
xor dl, 0x95
and cl, 0x15
add cl, cl
add cl, dl
lock cmpxchg byte [0x140502d05], cl
jne 0x140124670
xor edx, edx
lea rax, [0x140502cf0]
lea rcx, [0x14042aa10]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x1401246b0
mov al, 0xf6
xchg byte [0x140502d05], al
lea rax, [0x140502cf0]
ret
movzx eax, byte [0x140502f2d]
cmp al, 0x43
je 0x140124704
mov cl, 0x4c
nop dword [rax]
mov al, 0x8c
lock cmpxchg byte [0x140502f2d], cl
je 0x1401247b1
cmp al, 0x43
jne 0x1401246f0
lea rax, [0x140502f20]
ret
xor eax, eax
lea rcx, [0x140502e30]
lea rdx, [0x14042ab20]
mov r8d, 0x14542dfc
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14050300c]
add r10d, r8d
cmp r9d, r10d
jge 0x140124791
inc rax
jmp 0x140124730
xor eax, eax
lea rcx, [0x140502dc0]
lea rdx, [0x14042aac0]
mov r8d, 0x14542dfe
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14050300c]
add r10d, r8d
cmp r9d, r10d
jge 0x1401247a1
inc rax
jmp 0x140124770
mov al, 9
xchg byte [0x140502e33], al
lea rax, [0x140502e30]
ret
mov al, 0x3f
xchg byte [0x140502dc5], al
lea rax, [0x140502dc0]
ret
xor eax, eax
lea rcx, [0x140502f20]
lea rdx, [0x14042ac10]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401247e8
inc rax
jmp 0x1401247d0
mov al, 0x43
xchg byte [0x140502f2d], al
lea rax, [0x140502f20]
ret
Function at 0x140153570
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x40
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14015359c
mov eax, dword [0x1405642c4]
cmp eax, 0x2e
jle 0x1401535f1
jmp 0x140153611
mov eax, dword [0x1405642c4]
cmp eax, 0x26
jg 0x1401535d0
mov qword [rsp + 0x20], 0
mov eax, dword [0x1405642c0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
je 0x1401535e6
nop word cs:[rax + rax]
mov qword [rsp + 0x20], 0
mov eax, dword [0x1405642c4]
cmp eax, 0x39
jge 0x1401535d0
jmp 0x1401535a7
mov rax, qword [rsp + 0x20]
add rsp, 0x40
pop rsi
ret
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
mov eax, dword [0x1405642c4]
cmp eax, 0x34
jl 0x1401535e6
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call rsi
mov qword [rsp + 0x20], rax
mov ecx, dword [0x1405642c0]
lea eax, [rcx - 1]
imul eax, ecx
mov ecx, dword [0x140509dd8]
mov edx, ecx
neg edx
mov r8d, edx
xor r8d, 0x5576898a
and edx, 0x5576898a
lea r8d, [r8 + rdx*2]
neg r8d
xor edx, edx
div r8d
add ecx, 0xaa897674
cmp edx, ecx
jne 0x140153620
jmp 0x1401535f1
Function at 0x140153a00
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140153a7c
mov eax, 0xaa897674
add eax, dword [0x140509dd8]
cmp edx, eax
jne 0x140153aac
movzx eax, byte [0x140509972]
nop
cmp al, 0x62
je 0x140153b34
movzx ecx, byte [0x140509ddc]
lea eax, [rcx - 0x4d]
add cl, 0x71
lock cmpxchg byte [0x140509972], cl
jne 0x140153a20
xor eax, eax
lea rcx, [0x140509960]
lea rdx, [0x14042b6b0]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x140153b2c
inc rax
jmp 0x140153a50
test edx, edx
je 0x140153ad8
movzx eax, byte [0x140509832]
cmp al, 0x4c
je 0x140153aa4
mov cl, 0x73
nop dword [rax]
mov al, 0xd
lock cmpxchg byte [0x140509832], cl
je 0x140153b78
cmp al, 0x4c
jne 0x140153a90
lea rax, [0x140509820]
ret
movzx eax, byte [0x140509925]
cmp al, 0xbd
je 0x140153ad0
mov cl, 0x67
nop dword [rax]
mov al, 0xe
lock cmpxchg byte [0x140509925], cl
je 0x140153b3c
cmp al, 0xbd
jne 0x140153ac0
lea rax, [0x140509910]
ret
movzx eax, byte [0x140509785]
nop
cmp al, 0x9f
je 0x140153bc7
movzx ecx, byte [0x140509ddc]
lea eax, [rcx + 0x57]
add cl, 0x87
lock cmpxchg byte [0x140509785], cl
jne 0x140153ae0
xor eax, eax
lea rcx, [0x140509750]
lea rdx, [0x14042b4b0]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x34
jg 0x140153bbf
inc rax
jmp 0x140153b10
mov al, 0x62
xchg byte [0x140509972], al
lea rax, [0x140509960]
ret
xor eax, eax
lea rcx, [0x140509910]
lea rdx, [0x14042b660]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140153b68
inc rax
jmp 0x140153b50
mov al, 0xbd
xchg byte [0x140509925], al
lea rax, [0x140509910]
ret
xor edx, edx
lea rax, [0x140509820]
lea rcx, [0x14042b570]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x12
jl 0x140153b90
mov al, 0x4c
xchg byte [0x140509832], al
lea rax, [0x140509820]
ret
mov al, 0x9f
xchg byte [0x140509785], al
lea rax, [0x140509750]
ret