joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400acdf0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400ace2c
test edx, edx
je 0x1400ace77
movzx eax, byte [0x14051039d]
cmp al, 0x49
je 0x1400ace24
mov cl, 0x1e
nop word cs:[rax + rax]
mov al, 0x54
lock cmpxchg byte [0x14051039d], cl
je 0x1400acedc
cmp al, 0x49
jne 0x1400ace10
lea rax, [0x140510390]
ret
mov eax, 0xd0112a2
add eax, dword [0x1405109d4]
cmp edx, eax
jne 0x1400aceac
movzx eax, byte [0x1405102f3]
movzx ecx, byte [0x1405109d0]
add cl, 0xbd
cmp al, cl
je 0x1400ace6f
movzx ecx, byte [0x1405109d0]
lea eax, [rcx + 0x31]
add cl, 0x73
lock cmpxchg byte [0x1405102f3], cl
je 0x1400acf78
cmp al, 5
jne 0x1400ace50
lea rax, [0x1405102f0]
ret
movzx eax, byte [0x14051043d]
cmp al, 0x90
je 0x1400acea4
mov cl, 0x74
nop word cs:[rax + rax]
mov al, 0x2e
lock cmpxchg byte [0x14051043d], cl
je 0x1400acf3d
cmp al, 0x90
jne 0x1400ace90
lea rax, [0x140510430]
ret
movzx eax, byte [0x140510424]
cmp al, 0x2b
je 0x1400aced4
mov cl, 0xdb
nop dword [rax]
mov al, 0x6f
lock cmpxchg byte [0x140510424], cl
je 0x1400acfdf
cmp al, 0x2b
jne 0x1400acec0
lea rax, [0x140510410]
ret
xor edx, edx
lea rax, [0x140510390]
lea rcx, [0x140449dc0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
add r8b, 0xb6
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
add r8b, 0x4a
mov byte [rdx + rax], r8b
mov r8d, dword [0x1405109d4]
add edx, r8d
add edx, 0xd0112a3
cmp edx, 0xd
jl 0x1400acef0
mov al, 0x49
xchg byte [0x14051039d], al
lea rax, [0x140510390]
ret
xor eax, eax
lea rcx, [0x140510430]
lea rdx, [0x140449e60]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1400acf68
inc rax
jmp 0x1400acf50
mov al, 0x90
xchg byte [0x14051043d], al
lea rax, [0x140510430]
ret
xor edx, edx
lea rax, [0x1405102f0]
lea rcx, [0x140449d20]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
add edx, 0x4d1f955a
mov r8d, edx
xor r8d, 0xb2e06aa7
and edx, 0x32e06aa7
lea edx, [r8 + rdx*2]
cmp edx, 3
jl 0x1400acf90
mov al, 5
xchg byte [0x1405102f3], al
lea rax, [0x1405102f0]
ret
xor edx, edx
lea rax, [0x140510410]
lea rcx, [0x140449e40]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x14
jl 0x1400acff0
movzx eax, byte [0x1405109d0]
add al, 0xe3
xchg byte [0x140510424], al
lea rax, [0x140510410]
ret

Function at 0x1400ad9b0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
call fcn.1403e9e54
nop
add rsp, 0x28
ret
Function at 0x1400ada40
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1400ada7c
test edx, edx
je 0x1400adaac
movzx eax, byte [0x140510210]
cmp al, 0x33
je 0x1400ada74
mov cl, 0x6c
nop word [rax + rax]
mov al, 0xe5
lock cmpxchg byte [0x140510210], cl
je 0x1400adb1c
cmp al, 0x33
jne 0x1400ada60
lea rax, [0x140510200]
ret
test edx, edx
je 0x1400adaec
movzx eax, byte [0x140510275]
cmp al, 0x98
je 0x1400adaa4
mov cl, 0xba
nop dword [rax]
mov al, 0x43
lock cmpxchg byte [0x140510275], cl
je 0x1400adb58
cmp al, 0x98
jne 0x1400ada90
lea rax, [0x140510260]
ret
movzx eax, byte [0x1405103f3]
mov ecx, r8d
xor cl, 0x7d
add cl, byte [0x1405109d0]
cmp al, cl
je 0x1400adae4
mov cl, 0x55
nop word cs:[rax + rax]
mov al, 0xa5
lock cmpxchg byte [0x1405103f3], cl
je 0x1400adbcb
cmp al, 0xcc
jne 0x1400adad0
lea rax, [0x1405103e0]
ret
movzx eax, byte [0x1405102e9]
cmp al, 0x2b
je 0x1400adb14
mov cl, 0xf7
nop dword [rax]
mov al, 0xbc
lock cmpxchg byte [0x1405102e9], cl
je 0x1400adc28
cmp al, 0x2b
jne 0x1400adb00
lea rax, [0x1405102e0]
ret
xor eax, eax
lea rcx, [0x140510200]
lea rdx, [0x140449c50]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1400adb48
inc rax
jmp 0x1400adb30
mov al, 0x33
xchg byte [0x140510210], al
lea rax, [0x140510200]
ret
xor edx, edx
lea rax, [0x140510260]
lea rcx, [0x140449ca0]
xor r8d, 0x36a6065a
nop
movsxd rdx, edx
movzx r9d, byte [rdx + rax]
movzx r10d, byte [rdx + rcx]
not r10b
mov r11d, r10d
or r11b, r9b
not r11b
and r10b, r9b
or r10b, r11b
mov byte [rdx + rax], r10b
mov r9d, dword [0x1405109d4]
add r9d, r8d
add edx, 0xebca8773
mov r10d, edx
xor r10d, r9d
and edx, r9d
lea edx, [r10 + rdx*2]
add edx, 0x1435788d
cmp edx, 0x15
jl 0x1400adb70
mov al, 0x98
xchg byte [0x140510275], al
lea rax, [0x140510260]
ret
xor edx, edx
lea rax, [0x1405103e0]
lea rcx, [0x140449e10]
xor r8d, 0x36a6065a
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, dword [0x1405109d4]
add r9d, r8d
mov r10d, edx
xor r10d, r9d
and r9d, edx
lea edx, [r10 + r9*2]
cmp edx, 0x13
jl 0x1400adbf0
mov al, 0xcc
xchg byte [0x1405103f3], al
lea rax, [0x1405103e0]
ret
xor eax, eax
lea rcx, [0x1405102e0]
lea rdx, [0x140449d10]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1400adc58
inc rax
jmp 0x1400adc40
mov al, 0x2b
xchg byte [0x1405102e9], al
lea rax, [0x1405102e0]
ret
Function at 0x1400ae500
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1400ae53c
test edx, edx
je 0x1400ae5a8
movzx eax, byte [0x1405103bb]
cmp al, 0xd5
je 0x1400ae534
mov cl, 0x55
nop
mov al, pe_nt_image_headers64
lock cmpxchg byte [0x1405103bb], cl
je 0x1400ae63c
cmp al, 0xd5
jne 0x1400ae520
lea rax, [0x1405103b0]
ret
test edx, edx
je 0x1400ae60c
movzx eax, byte [0x14051037f]
mov ecx, r8d
xor cl, 1
add cl, byte [0x1405109d0]
cmp al, cl
je 0x1400ae5a0
nop dword [rax + rax]
movzx ecx, byte [0x1405109d0]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0x1d
mov eax, r8d
and al, 0xe2
or al, r9b
add al, cl
and dl, 0x80
mov r9d, r8d
and r9b, 0x7f
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x14051037f], r9b
je 0x1400ae698
cmp al, 0xac
jne 0x1400ae560
lea rax, [0x140510370]
ret
movzx eax, byte [0x140510363]
nop
cmp al, 0xe3
je 0x1400ae6f5
movzx ecx, byte [0x1405109d0]
mov eax, r8d
xor al, 0x81
add al, cl
mov edx, r8d
xor dl, 0xac
add dl, cl
lock cmpxchg byte [0x140510363], dl
jne 0x1400ae5b0
xor eax, eax
lea rcx, [0x140510340]
lea rdx, [0x140449d70]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1400ae6ed
inc rax
jmp 0x1400ae5f0
movzx eax, byte [0x140510333]
cmp al, 0xeb
je 0x1400ae634
mov cl, 0x2a
nop dword [rax]
mov al, 0x71
lock cmpxchg byte [0x140510333], cl
je 0x1400ae6fd
cmp al, 0xeb
jne 0x1400ae620
lea rax, [0x140510330]
ret
xor edx, edx
lea rax, [0x1405103b0]
lea rcx, [0x140449de0]
xor r8d, 0x5aaf9dc6
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
xor byte [rdx + rax], r9b
mov r9d, dword [0x1405109d4]
add r9d, r8d
mov r10d, edx
xor r10d, r9d
and r9d, edx
lea edx, [r10 + r9*2]
cmp edx, 0xb
jl 0x1400ae660
mov al, 0xd5
xchg byte [0x1405103bb], al
lea rax, [0x1405103b0]
ret
xor eax, eax
lea rcx, [0x140510370]
lea rdx, [0x140449da0]
xor r8d, 0x5aaf9dc6
nop
cdqe
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
mov r9d, dword [0x1405109d4]
add r9d, r8d
add eax, r9d
cmp eax, 0xf
jl 0x1400ae6b0
mov al, 0xac
xchg byte [0x14051037f], al
lea rax, [0x140510370]
ret
mov al, 0xe3
xchg byte [0x140510363], al
lea rax, [0x140510340]
ret
xor eax, eax
lea rcx, [0x140510330]
lea rdx, [0x140449d60]
mov r9d, r8d
xor r9d, 0x5aaf9dc6
nop word [rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
add byte [rax + rcx], r10b
mov r10d, dword [0x1405109d4]
add r10d, r9d
add eax, r10d
cmp eax, 3
jl 0x1400ae720
xor r8b, 0xc6
add r8b, byte [0x1405109d0]
xchg byte [0x140510333], r8b
lea rax, [0x140510330]
ret
Function at 0x1400f8340
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400f837c
test edx, edx
je 0x1400f83c6
movzx eax, byte [0x1405130e5]
cmp al, 0xa4
je 0x1400f8374
mov cl, 0x67
nop word cs:[rax + rax]
mov al, 0x8e
lock cmpxchg byte [0x1405130e5], cl
je 0x1400f844c
cmp al, 0xa4
jne 0x1400f8360
lea rax, [0x1405130e0]
ret
test edx, edx
je 0x1400f8417
movzx eax, byte [0x140512fc8]
cmp al, 0xec
je 0x1400f83be
mov cl, 0x72
nop word cs:[rax + rax]
mov al, 0xb2
lock cmpxchg byte [0x140512fc8], cl
je 0x1400f84a1
movzx edx, byte [0x14051d8a0]
add dl, 0x4f
cmp al, dl
jne 0x1400f83a0
lea rax, [0x140512fb0]
ret
movzx eax, byte [0x1405130b9]
cmp al, 0x1a
je 0x1400f840f
mov cl, 0xa7
nop word cs:[rax + rax]
mov al, 0x4a
lock cmpxchg byte [0x1405130b9], cl
je 0x1400f84d8
movzx edx, byte [0x14051d8a0]
mov r8d, edx
xor r8b, 2
and r8b, dl
xor dl, 0x7d
add r8b, r8b
add r8b, dl
cmp al, r8b
jne 0x1400f83e0
lea rax, [0x1405130b0]
ret
movzx eax, byte [0x140513123]
cmp al, 0xbe
je 0x1400f8444
mov cl, 0x93
nop word cs:[rax + rax]
mov al, 0x7f
lock cmpxchg byte [0x140513123], cl
je 0x1400f8528
cmp al, 0xbe
jne 0x1400f8430
lea rax, [0x140513100]
ret
xor eax, eax
lea rcx, [0x1405130e0]
lea rdx, [0x14044c020]
mov r8d, 0x2ea84d2
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14051d890]
add r10d, r8d
cmp r9d, r10d
jge 0x1400f8491
inc rax
jmp 0x1400f8470
mov al, 0xa4
xchg byte [0x1405130e5], al
lea rax, [0x1405130e0]
ret
xor eax, eax
lea rcx, [0x140512fb0]
lea rdx, [0x14044bf00]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x17
jg 0x1400f8508
inc rax
jmp 0x1400f84c0
xor eax, eax
lea rcx, [0x1405130b0]
lea rdx, [0x14044bff0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1400f8518
inc rax
jmp 0x1400f84f0
mov al, 0xec
xchg byte [0x140512fc8], al
lea rax, [0x140512fb0]
ret
mov al, 0x1a
xchg byte [0x1405130b9], al
lea rax, [0x1405130b0]
ret
xor r8d, r8d
lea rax, [0x140513100]
lea rcx, [0x14044c040]
mov edx, 0x2ea84ce
nop
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [r8 + rax]
xor r10b, r9b
mov byte [r8 + rax], r10b
mov r9d, dword [0x14051d890]
add r9d, edx
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r8d, [r10 + r9*2]
cmp r8d, 0x23
jl 0x1400f8540
mov al, 0xbe
xchg byte [0x140513123], al
lea rax, [0x140513100]
ret
Function at 0x1400f93e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x1400f941c
test edx, edx
je 0x1400f944c
movzx eax, byte [0x1405130d6]
cmp al, 0x6d
je 0x1400f9414
mov cl, 0x84
nop word cs:[rax + rax]
mov al, 0x64
lock cmpxchg byte [0x1405130d6], cl
je 0x1400f94bc
cmp al, 0x6d
jne 0x1400f9400
lea rax, [0x1405130d0]
ret
test edx, edx
je 0x1400f947c
movzx eax, byte [0x140512f60]
cmp al, 0x52
je 0x1400f9444
mov cl, 0x60
nop dword [rax]
mov al, 0x47
lock cmpxchg byte [0x140512f60], cl
je 0x1400f94f8
cmp al, 0x52
jne 0x1400f9430
lea rax, [0x140512f50]
ret
movzx eax, byte [0x1405130c3]
cmp al, 0x21
je 0x1400f9474
mov cl, 0x7a
nop dword [rax]
mov al, 0xd4
lock cmpxchg byte [0x1405130c3], cl
je 0x1400f9528
cmp al, 0x21
jne 0x1400f9460
lea rax, [0x1405130c0]
ret
movzx eax, byte [0x140513005]
movzx ecx, byte [0x14051d8a0]
add cl, 0x21
cmp al, cl
je 0x1400f94b4
mov cl, 0x6a
nop word cs:[rax + rax]
mov al, 0xf2
lock cmpxchg byte [0x140513005], cl
je 0x1400f9581
cmp al, 0xbe
jne 0x1400f94a0
lea rax, [0x140512ff0]
ret
xor eax, eax
lea rcx, [0x1405130d0]
lea rdx, [0x14044c010]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x1400f94e8
inc rax
jmp 0x1400f94d0
mov al, 0x6d
xchg byte [0x1405130d6], al
lea rax, [0x1405130d0]
ret
xor eax, eax
lea rcx, [0x140512f50]
lea rdx, [0x14044beb0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1400f9561
inc rax
jmp 0x1400f9510
xor eax, eax
lea rcx, [0x1405130c0]
lea rdx, [0x14044c000]
mov r8d, 0x2ea84d0
nop
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14051d890]
add r10d, r8d
cmp r9d, r10d
jge 0x1400f9571
inc rax
jmp 0x1400f9540
mov al, 0x52
xchg byte [0x140512f60], al
lea rax, [0x140512f50]
ret
mov al, 0x21
xchg byte [0x1405130c3], al
lea rax, [0x1405130c0]
ret
xor eax, eax
lea rcx, [0x140512ff0]
lea rdx, [0x14044bf40]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1400f95b8
inc rax
jmp 0x1400f95a0
mov al, 0xbe
xchg byte [0x140513005], al
lea rax, [0x140512ff0]
ret
Function at 0x140108720
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14010875c
test edx, edx
je 0x14010879c
movzx eax, byte [0x14051f7c3]
cmp al, 0xdc
je 0x140108754
mov cl, 0xa2
nop word cs:[rax + rax]
mov al, 0x50
lock cmpxchg byte [0x14051f7c3], cl
je 0x14010887c
cmp al, 0xdc
jne 0x140108740
lea rax, [0x14051f7b0]
ret
test edx, edx
je 0x14010883a
movzx eax, byte [0x14051f80d]
cmp al, 0x67
je 0x140108794
mov cl, 0xd4
nop word cs:[rax + rax]
mov al, 0x7f
lock cmpxchg byte [0x14051f80d], cl
je 0x1401088c8
cmp al, 0x67
jne 0x140108780
lea rax, [0x14051f800]
ret
movzx eax, byte [0x14051f822]
nop word cs:[rax + rax]
cmp al, 0xb
je 0x140108832
movzx ecx, byte [0x14051f8e8]
lea eax, [rcx - 0x2f]
inc cl
lock cmpxchg byte [0x14051f822], cl
jne 0x1401087b0
xor edx, edx
lea rax, [0x14051f810]
lea rcx, [0x14044c890]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, dword [0x14051f8d8]
add edx, r8d
add edx, 0x3a8ab2b2
mov r9d, r8d
xor r9d, 0x3a8ab2c3
and r8d, 0x3a8ab2c3
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x1401087e0
mov al, 0xb
xchg byte [0x14051f822], al
lea rax, [0x14051f810]
ret
movzx eax, byte [0x14051f7ad]
movzx ecx, byte [0x14051f8e8]
add cl, 0xbd
cmp al, cl
je 0x140108874
mov cl, 0x95
nop word cs:[rax + rax]
mov al, 0xd0
lock cmpxchg byte [0x14051f7ad], cl
je 0x140108911
cmp al, 0x6f
jne 0x140108860
lea rax, [0x14051f7a0]
ret
xor eax, eax
lea rcx, [0x14051f7b0]
lea rdx, [0x14044c840]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x12
jg 0x1401088b8
inc rax
jmp 0x140108890
mov al, 0xdc
xchg byte [0x14051f7c3], al
lea rax, [0x14051f7b0]
ret
xor eax, eax
lea rcx, [0x14051f800]
lea rdx, [0x14044c880]
mov r8d, 0x3a8ab2be
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14051f8d8]
add r10d, r8d
cmp r9d, r10d
jge 0x140108901
inc rax
jmp 0x1401088e0
mov al, 0x67
xchg byte [0x14051f80d], al
lea rax, [0x14051f800]
ret
xor eax, eax
lea rcx, [0x14051f7a0]
lea rdx, [0x14044c830]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140108948
inc rax
jmp 0x140108930
mov al, 0x6f
xchg byte [0x14051f7ad], al
lea rax, [0x14051f7a0]
ret
Function at 0x140108ba0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x140108bfd
test edx, edx
je 0x140108c39
movzx eax, byte [0x14051f7f0]
mov ecx, r8d
xor cl, 0x23
add cl, byte [0x14051f8e8]
cmp al, cl
je 0x140108d0c
nop dword [rax]
movzx ecx, byte [0x14051f8e8]
mov eax, r8d
xor al, 0x94
add al, cl
mov edx, r8d
xor dl, 0xa7
add dl, cl
lock cmpxchg byte [0x14051f7f0], dl
je 0x140108ca9
cmp al, 0x40
jne 0x140108bd0
jmp 0x140108d0c
test edx, edx
je 0x140108c79
movzx eax, byte [0x14051f7dd]
cmp al, 0xa1
je 0x140108dc0
mov cl, 0x56
nop word cs:[rax + rax]
mov al, 0xa4
lock cmpxchg byte [0x14051f7dd], cl
je 0x140108d15
cmp al, 0xa1
jne 0x140108c20
jmp 0x140108dc0
movzx eax, byte [0x14051f83d]
mov ecx, r8d
xor cl, 0x9e
add cl, byte [0x14051f8e8]
cmp al, cl
je 0x140108daf
mov cl, 0x12
nop word cs:[rax + rax]
mov al, 0xdf
lock cmpxchg byte [0x14051f83d], cl
je 0x140108d5b
cmp al, 0xe5
jne 0x140108c60
jmp 0x140108daf
movzx eax, byte [0x14051f773]
cmp al, 0x95
je 0x140108e36
mov cl, 0x83
nop word [rax + rax]
mov al, 0x4f
lock cmpxchg byte [0x14051f773], cl
je 0x140108dc9
cmp al, 0x95
jne 0x140108c90
jmp 0x140108e36
xor eax, eax
lea rcx, [0x14051f7e0]
lea rdx, [0x14044c870]
mov r9d, r8d
xor r9d, 0x619dee1f
nop word cs:[rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
add byte [rax + rcx], r10b
mov r10d, dword [0x14051f8d8]
xor r10d, r9d
mov r11d, r10d
not r11d
and r11d, r9d
lea r10d, [r10 + r11*2]
add eax, r10d
cmp eax, 0x10
jl 0x140108cd0
xor r8b, 0x23
add r8b, byte [0x14051f8e8]
xchg byte [0x14051f7f0], r8b
lea rax, [0x14051f7e0]
pop rbx
ret
xor eax, eax
lea rcx, [0x14051f7d0]
lea rdx, [0x14044c860]
xor r8d, 0x619dee13
nop dword [rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14051f8d8]
mov r11d, r8d
xor r11d, r10d
and r10d, r8d
lea r10d, [r11 + r10*2]
cmp r9d, r10d
jge 0x140108db8
inc rax
jmp 0x140108d30
xor eax, eax
lea rcx, [0x14051f830]
lea rdx, [0x14044c8b0]
mov r9d, r8d
xor r9d, 0x619dee1f
nop word cs:[rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
mov r10d, dword [0x14051f8d8]
add r10d, r9d
add eax, r10d
cmp eax, 0xd
jl 0x140108d80
xor r8b, 0x9e
add r8b, byte [0x14051f8e8]
xchg byte [0x14051f83d], r8b
lea rax, [0x14051f830]
pop rbx
ret
mov al, 0xa1
xchg byte [0x14051f7dd], al
lea rax, [0x14051f7d0]
pop rbx
ret
xor edx, edx
lea rax, [0x14051f750]
lea rcx, [0x14044c7e0]
xor r8d, 0x619dee1f
movsxd rdx, edx
movzx r9d, byte [rdx + rax]
movzx r10d, byte [rdx + rcx]
mov r11d, r9d
not r11b
not r10b
mov ebx, r11d
xor bl, r10b
and bl, r11b
xor r10b, r9b
not r10b
and r10b, r9b
or r10b, bl
mov byte [rdx + rax], r10b
mov r9d, dword [0x14051f8d8]
add r9d, r8d
xor r9d, edx
mov r10d, r9d
not r10d
and r10d, edx
lea edx, [r9 + r10*2]
cmp edx, 0x23
jl 0x140108de0
mov al, 0x95
xchg byte [0x14051f773], al
lea rax, [0x14051f750]
pop rbx
ret
Function at 0x14010dab0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r9, r8
mov rsi, rdx
mov rdi, rcx
mov r8, qword [rcx]
mov rdx, qword [r8 + 8]
xor ebp, ebp
cmp byte [rdx + 0x19], 0
je 0x14010dade
mov rbx, rdx
mov rax, r8
cmp byte [rax + 0x19], 0
jne 0x14010db3f
jmp 0x14010db37
mov ecx, dword [r9]
mov rax, r8
nop word cs:[rax + rax]
mov rbx, rdx
mov r10d, dword [rdx + 0x20]
cmp r10d, ecx
cmovae rax, rdx
lea rdx, [rdx + 0x10]
cmovae rdx, rbx
mov rdx, qword [rdx]
movzx r11d, byte [0x14052040c]
mov ebp, r11d
xor bpl, 0x8a
and r11b, 0xa
add r11b, r11b
add r11b, bpl
cmp byte [rdx + 0x19], r11b
je 0x14010daf0
xor ebp, ebp
cmp r10d, ecx
setae bpl
cmp byte [rax + 0x19], 0
jne 0x14010db3f
mov ecx, dword [r9]
cmp ecx, dword [rax + 0x20]
jae 0x14010db8b
movabs rax, 0x147ae147ae147ae
cmp qword [rdi + 8], rax
je 0x14010db8f
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.14010dba0
mov r8, qword [rsp + 0x40]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], ebp
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.14010dd00
mov cl, 1
mov qword [rsi], rax
mov byte [rsi + 8], cl
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
xor ecx, ecx
jmp 0x14010db79
call fcn.1400aa0f0
int3
Function at 0x140118270
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401182c1
test edx, edx
je 0x1401182fc
movzx eax, byte [0x140520a23]
cmp al, 0xd
je 0x1401182b9
nop word [rax + rax]
movzx ecx, byte [0x140520c98]
lea eax, [rcx + 0x1f]
add cl, 0x7b
lock cmpxchg byte [0x140520a23], cl
je 0x140118366
movzx ecx, byte [0x140520c98]
add cl, 0xe6
cmp al, cl
jne 0x140118290
lea rax, [0x140520a20]
ret
test edx, edx
je 0x14011832c
movzx eax, byte [0x140520b0f]
cmp al, 7
je 0x1401182f4
mov cl, 0x77
nop word cs:[rax + rax]
mov al, 0x47
lock cmpxchg byte [0x140520b0f], cl
je 0x1401183b1
cmp al, 7
jne 0x1401182e0
lea rax, [0x140520b00]
ret
movzx eax, byte [0x140520a12]
cmp al, 0x63
je 0x140118324
mov cl, 5
nop dword [rax]
mov al, 0x6f
lock cmpxchg byte [0x140520a12], cl
je 0x1401183f1
cmp al, 0x63
jne 0x140118310
lea rax, [0x140520a10]
ret
movzx eax, byte [0x140520a92]
cmp al, 0x8f
je 0x14011835e
mov cl, 0x58
nop dword [rax]
mov al, 0x84
lock cmpxchg byte [0x140520a92], cl
je 0x14011844f
movzx edx, byte [0x140520c98]
add dl, 0x68
cmp al, dl
jne 0x140118340
lea rax, [0x140520a80]
ret
xor edx, edx
lea rax, [0x140520a20]
lea rcx, [0x14044ce80]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x140520c9c]
add edx, r8d
add edx, 0x8de27085
cmp edx, 3
jl 0x140118380
mov al, 0xd
xchg byte [0x140520a23], al
lea rax, [0x140520a20]
ret
xor eax, eax
lea rcx, [0x140520b00]
lea rdx, [0x14044cf40]
mov r8d, 0x8de27093
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140520c9c]
add r10d, r8d
cmp r9d, r10d
jge 0x14011843f
inc rax
jmp 0x1401183d0
xor edx, edx
lea rax, [0x140520a10]
lea rcx, [0x14044ce70]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 2
jl 0x140118410
mov al, 0x63
xchg byte [0x140520a12], al
lea rax, [0x140520a10]
ret
mov al, 7
xchg byte [0x140520b0f], al
lea rax, [0x140520b00]
ret
xor edx, edx
lea rax, [0x140520a80]
lea rcx, [0x14044ced0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x140520c9c]
add edx, r8d
add edx, 0x8de27085
cmp edx, 0x12
jl 0x140118460
mov al, 0x8f
xchg byte [0x140520a92], al
lea rax, [0x140520a80]
ret
Function at 0x1401185f0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140118636
test edx, edx
je 0x14011867c
movzx eax, byte [0x140520b7d]
cmp al, 0xcf
je 0x14011862e
mov cl, 0x5f
nop dword [rax]
mov al, 0xd4
lock cmpxchg byte [0x140520b7d], cl
je 0x1401186dc
movzx edx, byte [0x140520c98]
add dl, 0xa8
cmp al, dl
jne 0x140118610
lea rax, [0x140520b70]
ret
xor eax, eax
sub eax, dword [0x140520c9c]
mov ecx, eax
xor ecx, 0x721d8f7c
and eax, 0x721d8f7c
lea eax, [rcx + rax*2]
add edx, eax
jne 0x1401186a8
movzx eax, byte [0x140520a75]
cmp al, 0x42
je 0x140118674
mov cl, 0x68
nop
mov al, 0xcb
lock cmpxchg byte [0x140520a75], cl
je 0x14011875f
cmp al, 0x42
jne 0x140118660
lea rax, [0x140520a60]
ret
movzx eax, byte [0x140520ac2]
cmp al, 0xe8
je 0x1401186a0
mov cl, 0x36
nop dword [rax]
mov al, 0xd8
lock cmpxchg byte [0x140520ac2], cl
je 0x140118718
cmp al, 0xe8
jne 0x140118690
lea rax, [0x140520ac0]
ret
movzx eax, byte [0x140520bcb]
cmp al, 0xe0
je 0x1401186d4
mov cl, 0x76
nop word cs:[rax + rax]
mov al, 7
lock cmpxchg byte [0x140520bcb], cl
je 0x1401187a1
cmp al, 0xe0
jne 0x1401186c0
lea rax, [0x140520bc0]
ret
xor eax, eax
lea rcx, [0x140520b70]
lea rdx, [0x14044cfb0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140118708
inc rax
jmp 0x1401186f0
mov al, 0xcf
xchg byte [0x140520b7d], al
lea rax, [0x140520b70]
ret
xor eax, eax
lea rcx, [0x140520ac0]
lea rdx, [0x14044cf10]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x140118748
inc rax
jmp 0x140118730
movzx eax, byte [0x140520c98]
add al, 0xc1
xchg byte [0x140520ac2], al
lea rax, [0x140520ac0]
ret
xor edx, edx
lea rax, [0x140520a60]
lea rcx, [0x14044ceb0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x140520c9c]
add edx, r8d
add edx, 0x8de27085
cmp edx, 0x15
jl 0x140118770
mov al, 0x42
xchg byte [0x140520a75], al
lea rax, [0x140520a60]
ret
xor eax, eax
lea rcx, [0x140520bc0]
lea rdx, [0x14044d000]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x1401187d8
inc rax
jmp 0x1401187c0
mov al, pe_nt_image_headers64
xchg byte [0x140520bcb], al
lea rax, [0x140520bc0]
ret