joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401aaaf0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov esi, r9d
test ecx, ecx
je 0x1401aab5e
test edx, edx
je 0x1401aabae
movzx ecx, byte [0x1404d0e1d]
mov edx, esi
xor edx, 0xeab4e9d
call fcn.1401ab020
test al, 1
jne 0x1401aac9c
mov edi, esi
xor edi, 0x797c895f
lea rbx, [rsp + 0x2e]
nop dword [rax + rax]
mov rcx, rbx
mov edx, edi
call fcn.1401aaa70
test al, 1
jne 0x1401aac29
cmp byte [rsp + 0x2e], 0x16
jne 0x1401aab40
jmp 0x1401aac9c
test edx, edx
je 0x1401aabf2
movzx eax, byte [0x1404d0ee3]
cmp al, 9
je 0x1401aad15
mov edi, esi
xor edi, 0x817480bf
lea rbx, [rsp + 0x2d]
nop word cs:[rax + rax]
mov rcx, rbx
mov edx, edi
call fcn.1401aaa90
test al, 1
jne 0x1401aaca8
cmp byte [rsp + 0x2d], 9
jne 0x1401aab90
jmp 0x1401aad15
movzx eax, byte [0x1404d0e47]
movzx ecx, byte [0x1404d0f6c]
add cl, 0x1d
cmp al, cl
je 0x1401aad29
mov bl, 0xd1
xor esi, 0x1de281de
nop
mov al, 0x6e
lock cmpxchg byte [0x1404d0e47], bl
je 0x1401aacd8
mov ecx, eax
mov edx, esi
call fcn.1401aafc0
test al, 1
je 0x1401aabd0
jmp 0x1401aad29
movzx eax, byte [0x1404d0f13]
cmp al, 0xdf
je 0x1401aadab
mov cl, 0x36
nop word cs:[rax + rax]
mov al, 0xe6
lock cmpxchg byte [0x1404d0f13], cl
je 0x1401aad35
cmp al, 0xdf
jne 0x1401aac10
jmp 0x1401aadab
xor ecx, ecx
lea r12, [0x1404d0e10]
mov edi, esi
xor edi, 0x39993769
lea rbx, [rsp + 0x2f]
xor esi, 0xfa477b26
lea r14, [rsp + 0x34]
nop word [rax + rax]
movsxd r15, ecx
movzx ebp, byte [r15 + r12]
mov ecx, r15d
mov rdx, rbx
mov r8d, edi
call fcn.1401aaad0
movzx edx, byte [rsp + 0x2f]
mov dword [rsp + 0x20], esi
mov ecx, ebp
mov r8d, r15d
mov r9, r14
call fcn.1401aaab0
mov ecx, dword [rsp + 0x34]
test al, 1
je 0x1401aac50
movzx eax, byte [0x1404d0f6c]
mov ecx, eax
xor cl, 0xa5
and al, 0x25
add al, al
add al, cl
xchg byte [0x1404d0e1d], al
lea rax, [0x1404d0e10]
jmp 0x1401aadb2
xor eax, eax
lea rcx, [0x1404d0ee0]
lea rdx, [0x1403f2950]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1401aad08
inc rax
jmp 0x1401aacc0
xor eax, eax
lea rcx, [0x1404d0e20]
lea rdx, [0x1403f28a0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x26
jg 0x1401aad21
inc rax
jmp 0x1401aacf0
xor esi, 0xc35446d8
mov ecx, esi
call fcn.1401aafd0
lea rax, [0x1404d0ee0]
jmp 0x1401aadb2
mov al, 0x8e
xchg byte [0x1404d0e47], al
lea rax, [0x1404d0e20]
jmp 0x1401aadb2
xor ecx, ecx
lea r13, [0x1404d0ef0]
mov edi, esi
xor edi, 0xb440663b
lea rbx, [rsp + 0x2c]
mov ebp, 0x8d36231d
lea r14, [rsp + 0x30]
nop word cs:[rax + rax]
movsxd r15, ecx
lea r12, [r15 + r13]
movzx edx, byte [r15 + r13]
mov ecx, r15d
mov r8, rbx
mov r9d, edi
call fcn.1401aafe0
movzx ecx, byte [rsp + 0x2c]
mov eax, dword [0x1404d0f68]
add eax, ebp
xor eax, esi
mov dword [rsp + 0x20], eax
mov rdx, r12
mov r8d, r15d
mov r9, r14
call fcn.1401ab000
mov ecx, dword [rsp + 0x30]
test al, 1
je 0x1401aad60
mov al, 0xdf
xchg byte [0x1404d0f13], al
lea rax, [0x1404d0ef0]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401aadd0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401aae0c
test edx, edx
je 0x1401aae6c
movzx eax, byte [0x1404d0e90]
cmp al, 0xbf
je 0x1401aae04
mov cl, 0xc3
nop dword [rax]
mov al, 0x68
lock cmpxchg byte [0x1404d0e90], cl
je 0x1401aaedc
cmp al, 0xbf
jne 0x1401aadf0
lea rax, [0x1404d0e80]
ret
test edx, edx
je 0x1401aae9c
movzx eax, byte [0x1404d0e79]
nop dword [rax + rax]
cmp al, 0x7e
je 0x1401aaf37
movzx ecx, byte [0x1404d0f6c]
lea eax, [rcx + 0x3a]
add cl, 0xc6
lock cmpxchg byte [0x1404d0e79], cl
jne 0x1401aae20
xor eax, eax
lea rcx, [0x1404d0e50]
lea rdx, [0x1403f28d0]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x28
jg 0x1401aaf2f
inc rax
jmp 0x1401aae50
movzx eax, byte [0x1404d0f2f]
cmp al, 0x2b
je 0x1401aae94
mov cl, 0x18
nop dword [rax]
mov al, 0xc8
lock cmpxchg byte [0x1404d0f2f], cl
je 0x1401aaf3f
cmp al, 0x2b
jne 0x1401aae80
lea rax, [0x1404d0f20]
ret
movzx eax, byte [0x1404d0eb5]
movzx ecx, byte [0x1404d0f6c]
add cl, 0x8f
cmp al, cl
je 0x1401aaed4
mov cl, 0x34
nop word cs:[rax + rax]
mov al, 0x26
lock cmpxchg byte [0x1404d0eb5], cl
je 0x1401aaf7f
test al, al
jne 0x1401aaec0
lea rax, [0x1404d0ea0]
ret
xor eax, eax
lea rcx, [0x1404d0e80]
lea rdx, [0x1403f2900]
nop dword [rax]
cdqe
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
mov r8d, dword [0x1404d0f68]
mov r9d, r8d
xor r9d, 0xa486c308
and r8d, 0x2486c308
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0x10
jl 0x1401aaef0
mov al, 0xbf
xchg byte [0x1404d0e90], al
lea rax, [0x1404d0e80]
ret
mov al, 0x7e
xchg byte [0x1404d0e79], al
lea rax, [0x1404d0e50]
ret
xor eax, eax
lea rcx, [0x1404d0f20]
lea rdx, [0x1403f2990]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1401aaf68
inc rax
jmp 0x1401aaf50
movzx eax, byte [0x1404d0f6c]
add al, 0xba
xchg byte [0x1404d0f2f], al
lea rax, [0x1404d0f20]
ret
xor eax, eax
lea rcx, [0x1404d0ea0]
lea rdx, [0x1403f2910]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1401aafa8
inc rax
jmp 0x1401aaf90
xor eax, eax
xchg byte [0x1404d0eb5], al
lea rax, [0x1404d0ea0]
ret
Function at 0x1401b2770
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401b27db
mov ecx, dword [rsp + 0x28]
test edx, edx
je 0x1401b280c
movzx eax, byte [0x1404d106a]
movzx edx, byte [0x1404d18b8]
mov r8d, ecx
xor r8b, 0xcd
mov r9d, r8d
xor r9b, dl
and r8b, dl
add r8b, r8b
add r8b, r9b
cmp al, r8b
je 0x1401b27d3
mov dl, 0x7d
nop dword [rax + rax]
mov al, 0xa5
lock cmpxchg byte [0x1404d106a], dl
je 0x1401b283c
mov r8d, ecx
xor r8b, 0xcd
add r8b, byte [0x1404d18b8]
cmp al, r8b
jne 0x1401b27b0
lea rax, [0x1404d1060]
ret
movzx eax, byte [0x1404d105f]
cmp al, 0xe7
je 0x1401b2804
mov cl, 0x6f
nop dword [rax + rax]
mov al, 0x9b
lock cmpxchg byte [0x1404d105f], cl
je 0x1401b287f
cmp al, 0xe7
jne 0x1401b27f0
lea rax, [0x1404d1050]
ret
movzx eax, byte [0x1404d0f86]
cmp al, 0xbe
je 0x1401b2834
mov dl, 0x59
nop dword [rax]
mov al, 0x4e
lock cmpxchg byte [0x1404d0f86], dl
je 0x1401b28c8
cmp al, 0xbe
jne 0x1401b2820
lea rax, [0x1404d0f80]
ret
xor edx, edx
lea rax, [0x1404d1060]
lea rcx, [0x1403f2c10]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xa
jl 0x1401b2850
mov al, 0x16
xchg byte [0x1404d106a], al
lea rax, [0x1404d1060]
ret
xor eax, eax
lea rcx, [0x1404d1050]
lea rdx, [0x1403f2c00]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1401b28b8
inc rax
jmp 0x1401b2890
mov al, 0xe7
xchg byte [0x1404d105f], al
lea rax, [0x1404d1050]
ret
xor eax, eax
lea rdx, [0x1404d0f80]
lea r8, [0x1403f2b50]
xor ecx, 0x18bbcbe2
nop
cdqe
movzx r9d, byte [rax + r8]
xor byte [rax + rdx], r9b
mov r9d, dword [0x1404d18bc]
add r9d, ecx
add eax, r9d
cmp eax, 6
jl 0x1401b28e0
mov al, 0xbe
xchg byte [0x1404d0f86], al
lea rax, [0x1404d0f80]
ret
Function at 0x1401bf4e0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1401bf55c
test edx, edx
je 0x1401bf58c
movzx eax, byte [0x1404d3759]
nop dword [rax + rax]
cmp al, 0xb
je 0x1401bf604
movzx ecx, byte [0x1404d38d0]
mov eax, r8d
xor al, 0x2a
add al, cl
mov edx, r8d
xor dl, 0xee
add dl, cl
lock cmpxchg byte [0x1404d3759], dl
jne 0x1401bf500
xor eax, eax
lea rcx, [0x1404d3750]
lea rdx, [0x1403f3960]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1401bf5fc
inc rax
jmp 0x1401bf540
test edx, edx
je 0x1401bf5cc
movzx eax, byte [0x1404d3625]
cmp al, 0xf
je 0x1401bf584
mov cl, 0xa7
nop dword [rax]
mov al, 0xa1
lock cmpxchg byte [0x1404d3625], cl
je 0x1401bf60c
cmp al, 0xf
jne 0x1401bf570
lea rax, [0x1404d3610]
ret
movzx eax, byte [0x1404d36f6]
xor r8b, 0x31
add r8b, byte [0x1404d38d0]
cmp al, r8b
je 0x1401bf5c4
mov cl, 0xa9
nop word cs:[rax + rax]
mov al, 0xa7
lock cmpxchg byte [0x1404d36f6], cl
je 0x1401bf665
cmp al, 0xec
jne 0x1401bf5b0
lea rax, [0x1404d36e0]
ret
movzx eax, byte [0x1404d35f2]
cmp al, 0x81
je 0x1401bf5f4
mov cl, 0xf8
nop dword [rax]
mov al, 0xeb
lock cmpxchg byte [0x1404d35f2], cl
je 0x1401bf6b8
cmp al, 0x81
jne 0x1401bf5e0
lea rax, [0x1404d35f0]
ret
mov al, 0xb
xchg byte [0x1404d3759], al
lea rax, [0x1404d3750]
ret
xor eax, eax
lea rcx, [0x1404d3610]
lea rdx, [0x1403f3850]
xor r8d, 0x14f2a817
nop word cs:[rax + rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1404d38c0]
add r10d, r8d
cmp r9d, r10d
jge 0x1401bf698
inc rax
jmp 0x1401bf630
xor eax, eax
lea rcx, [0x1404d36e0]
lea rdx, [0x1403f3910]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x15
jg 0x1401bf6a8
inc rax
jmp 0x1401bf680
mov al, 0xf
xchg byte [0x1404d3625], al
lea rax, [0x1404d3610]
ret
mov al, 0xec
xchg byte [0x1404d36f6], al
lea rax, [0x1404d36e0]
ret
xor edx, edx
lea rax, [0x1404d35f0]
lea rcx, [0x1403f3830]
xor r8d, 0x14f2a87a
nop
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
mov r9d, dword [0x1404d38c0]
add r9d, r8d
cmp edx, r9d
jl 0x1401bf6d0
mov al, 0x81
xchg byte [0x1404d35f2], al
lea rax, [0x1404d35f0]
ret
Function at 0x1401d5b80
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401d5be0
test edx, edx
je 0x1401d5c1c
movzx eax, byte [0x1404d4420]
movzx ecx, byte [0x1404d55fc]
add cl, 0xf2
cmp al, cl
je 0x1401d5bd8
nop word cs:[rax + rax]
movzx ecx, byte [0x1404d55fc]
lea eax, [rcx + 0x64]
mov edx, ecx
xor dl, 0xf3
and cl, 0x73
add cl, cl
add cl, dl
lock cmpxchg byte [0x1404d4420], cl
je 0x1401d5c7c
cmp al, 0x15
jne 0x1401d5bb0
lea rax, [0x1404d4410]
ret
test edx, edx
je 0x1401d5c4c
movzx eax, byte [0x1404d4a0d]
cmp al, 0x14
je 0x1401d5c14
mov cl, 0x9b
nop word cs:[rax + rax]
mov al, 0xa9
lock cmpxchg byte [0x1404d4a0d], cl
je 0x1401d5cbf
cmp al, 0x14
jne 0x1401d5c00
lea rax, [0x1404d4a00]
ret
movzx eax, byte [0x1404d48cc]
cmp al, 0xc8
je 0x1401d5c44
mov cl, 0x99
nop dword [rax]
mov al, 0xc4
lock cmpxchg byte [0x1404d48cc], cl
je 0x1401d5ce8
cmp al, 0xc8
jne 0x1401d5c30
lea rax, [0x1404d48c0]
ret
movzx eax, byte [0x1404d4c7a]
cmp al, 0xdf
je 0x1401d5c74
mov cl, 0x29
nop dword [rax]
mov al, 0xac
lock cmpxchg byte [0x1404d4c7a], cl
je 0x1401d5d3f
cmp al, 0xdf
jne 0x1401d5c60
lea rax, [0x1404d4c70]
ret
xor edx, edx
lea rax, [0x1404d4410]
lea rcx, [0x1403f43a0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x1401d5c90
mov al, 0x15
xchg byte [0x1404d4420], al
lea rax, [0x1404d4410]
ret
xor eax, eax
lea rcx, [0x1404d4a00]
lea rdx, [0x1403f4960]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401d5d2f
inc rax
jmp 0x1401d5cd0
xor edx, edx
lea rax, [0x1404d48c0]
lea rcx, [0x1403f4830]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xc
jl 0x1401d5d00
mov al, 0xc8
xchg byte [0x1404d48cc], al
lea rax, [0x1404d48c0]
ret
mov al, 0x14
xchg byte [0x1404d4a0d], al
lea rax, [0x1404d4a00]
ret
xor eax, eax
lea rcx, [0x1404d4c70]
lea rdx, [0x1403f4bd0]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 9
jg 0x1401d5d68
inc rax
jmp 0x1401d5d50
mov al, 0xdf
xchg byte [0x1404d4c7a], al
lea rax, [0x1404d4c70]
ret
Function at 0x1401ff5c0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401ff5fc
test edx, edx
je 0x1401ff62c
movzx eax, byte [0x1404d94ad]
cmp al, 0xbc
je 0x1401ff5f4
mov cl, 0x41
nop word cs:[rax + rax]
mov al, 0x99
lock cmpxchg byte [0x1404d94ad], cl
je 0x1401ff696
cmp al, 0xbc
jne 0x1401ff5e0
lea rax, [0x1404d94a0]
ret
test edx, edx
je 0x1401ff65c
movzx eax, byte [0x1404d922b]
cmp al, 0xdb
je 0x1401ff624
mov cl, 0x94
nop dword [rax]
mov al, 0x4f
lock cmpxchg byte [0x1404d922b], cl
je 0x1401ff6d8
cmp al, 0xdb
jne 0x1401ff610
lea rax, [0x1404d9210]
ret
movzx eax, byte [0x1404d940e]
cmp al, 0xd2
je 0x1401ff654
mov cl, 0xa9
nop dword [rax]
mov al, 0xe2
lock cmpxchg byte [0x1404d940e], cl
je 0x1401ff708
cmp al, 0xd2
jne 0x1401ff640
lea rax, [0x1404d9400]
ret
movzx eax, byte [0x1404d95b5]
cmp al, 0xc4
je 0x1401ff68e
mov cl, 0x71
nop dword [rax]
mov al, 0x3d
lock cmpxchg byte [0x1404d95b5], cl
je 0x1401ff766
movzx edx, byte [0x1404db158]
add dl, 0xd5
cmp al, dl
jne 0x1401ff670
lea rax, [0x1404d95a0]
ret
xor eax, eax
lea rcx, [0x1404d94a0]
lea rdx, [0x1403f6530]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401ff6c8
inc rax
jmp 0x1401ff6b0
mov al, 0xbc
xchg byte [0x1404d94ad], al
lea rax, [0x1404d94a0]
ret
xor eax, eax
lea rcx, [0x1404d9210]
lea rdx, [0x1403f62c0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1a
jg 0x1401ff74f
inc rax
jmp 0x1401ff6f0
xor edx, edx
lea rax, [0x1404d9400]
lea rcx, [0x1403f6490]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xe
jl 0x1401ff720
mov al, 0xd2
xchg byte [0x1404d940e], al
lea rax, [0x1404d9400]
ret
movzx eax, byte [0x1404db158]
add al, 0xec
xchg byte [0x1404d922b], al
lea rax, [0x1404d9210]
ret
xor edx, edx
lea rax, [0x1404d95a0]
lea rcx, [0x1403f6620]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1404db148]
add edx, r8d
add edx, 0x4a2b697
add r8d, 0x4a2b6ab
cmp edx, r8d
jl 0x1401ff780
mov al, 0xc4
xchg byte [0x1404d95b5], al
lea rax, [0x1404d95a0]
ret
Function at 0x140200fe0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140201031
test edx, edx
je 0x140201076
movzx eax, byte [0x1404d9645]
cmp al, 0xe3
je 0x140201029
nop word [rax + rax]
movzx ecx, byte [0x1404db158]
lea eax, [rcx - 0x3d]
add cl, 0x5e
lock cmpxchg byte [0x1404d9645], cl
je 0x1402010ec
movzx ecx, byte [0x1404db158]
add cl, 0xf4
cmp al, cl
jne 0x140201000
lea rax, [0x1404d9630]
ret
mov eax, 0x4a2b696
add eax, dword [0x1404db148]
cmp edx, eax
jne 0x1402010b6
movzx eax, byte [0x1404d984c]
cmp al, 0x60
je 0x14020106e
mov cl, 0x2a
nop dword [rax]
mov al, 0x30
lock cmpxchg byte [0x1404d984c], cl
je 0x140201178
movzx edx, byte [0x1404db158]
add dl, 0x71
cmp al, dl
jne 0x140201050
lea rax, [0x1404d9840]
ret
movzx eax, byte [0x1404d938a]
movzx ecx, byte [0x1404db158]
add cl, 0x38
cmp al, cl
je 0x1402010ae
mov cl, 0xfd
nop dword [rax]
mov al, 0x9e
lock cmpxchg byte [0x1404d938a], cl
je 0x140201138
movzx edx, byte [0x1404db158]
add dl, 0x38
cmp al, dl
jne 0x140201090
lea rax, [0x1404d9370]
ret
movzx eax, byte [0x1404d982c]
movzx ecx, byte [0x1404db158]
add cl, 0xd7
cmp al, cl
je 0x1402010e4
mov cl, 0x84
nop dword [rax]
mov al, 0xfd
lock cmpxchg byte [0x1404d982c], cl
je 0x1402011bf
cmp al, 0xc6
jne 0x1402010d0
lea rax, [0x1404d9820]
ret
xor eax, eax
lea rcx, [0x1404d9630]
lea rdx, [0x1403f66b0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140201128
inc rax
jmp 0x140201100
mov al, 0xe3
xchg byte [0x1404d9645], al
lea rax, [0x1404d9630]
ret
xor eax, eax
lea rcx, [0x1404d9370]
lea rdx, [0x1403f6400]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x19
jg 0x140201168
inc rax
jmp 0x140201150
mov al, 0x27
xchg byte [0x1404d938a], al
lea rax, [0x1404d9370]
ret
xor edx, edx
lea rax, [0x1404d9840]
lea rcx, [0x1403f68c0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xc
jl 0x140201190
mov al, 0x60
xchg byte [0x1404d984c], al
lea rax, [0x1404d9840]
ret
xor eax, eax
lea rcx, [0x1404d9820]
lea rdx, [0x1403f68a0]
mov r8d, 0x4a2b6a2
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1404db148]
add r10d, r8d
cmp r9d, r10d
jge 0x140201201
inc rax
jmp 0x1402011e0
movzx eax, byte [0x1404db158]
add al, 0xd7
xchg byte [0x1404d982c], al
lea rax, [0x1404d9820]
ret
Function at 0x140203140
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov edi, r9d
mov esi, dword [rsp + 0xa0]
test ecx, ecx
je 0x1402031a9
mov eax, edi
xor eax, 0x11bab71d
mov r8d, esi
xor r8d, 0xb542edbb
mov ecx, edx
mov edx, eax
call fcn.1402030e0
test al, 1
je 0x1402031e9
movzx eax, byte [0x1404d97cd]
cmp al, 0x2f
je 0x1402032a7
mov cl, 0x96
nop dword [rax + rax]
mov al, 0xa3
lock cmpxchg byte [0x1404d97cd], cl
je 0x140203269
cmp al, 0x2f
jne 0x140203190
jmp 0x1402032a7
test edx, edx
je 0x140203234
mov ecx, edi
xor ecx, 0x66290b97
mov edx, esi
xor edx, 0x22918e6d
call fcn.140201bd0
test al, 1
jne 0x140203384
mov cl, 0x7e
mov al, 0xfd
lock cmpxchg byte [0x1404d96ad], cl
je 0x1402032fc
cmp al, 0x25
jne 0x1402031d0
jmp 0x140203384
xor edi, 0xf7c36511
mov edx, esi
xor edx, 0xd12f0993
add edx, dword [0x1404db148]
xor edx, esi
mov ecx, edi
call fcn.140203120
test al, 1
jne 0x1402032f0
mov cl, 0xc
xor eax, eax
lock cmpxchg byte [0x14051dd78], cl
je 0x1402032b3
mov edx, esi
xor dl, 0x1d
add dl, byte [0x1404db158]
cmp al, dl
jne 0x140203210
jmp 0x1402032f0
movzx eax, byte [0x1404d8f50]
cmp al, 0x4d
je 0x1402033da
mov cl, 0xf8
nop word cs:[rax + rax]
mov al, 0x11
lock cmpxchg byte [0x1404d8f50], cl
je 0x14020338d
cmp al, 0x4d
jne 0x140203250
jmp 0x1402033da
xor edx, edx
lea rax, [0x1404d97c0]
lea rcx, [0x1403f6840]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x140203280
mov al, 0x2f
xchg byte [0x1404d97cd], al
lea rax, [0x1404d97c0]
jmp 0x1402033e1
xor eax, eax
lea rcx, [0x1404d9120]
lea rdx, [0x1403f61d0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1e
jg 0x1402032e8
inc rax
jmp 0x1402032d0
mov al, 0xd1
xchg byte [0x14051dd78], al
lea rax, [0x1404d9120]
jmp 0x1402033e1
xor eax, eax
lea r14, [0x1404d96a0]
lea r15, [0x1403f6720]
mov ebp, edi
xor ebp, 0xf91c2727
mov r12d, esi
xor r12d, 0x6ca5660c
lea rbx, [rsp + 0x3c]
nop word cs:[rax + rax]
movsxd r8, eax
movzx ecx, byte [r8 + r14]
movzx edx, byte [r8 + r15]
mov eax, dword [0x1404db148]
add eax, r12d
mov r9d, eax
xor r9d, eax
not r9d
and r9d, esi
xor r9d, eax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x28], r9d
mov r9, rbx
call fcn.1402017c0
mov eax, dword [rsp + 0x3c]
cmp eax, 0xd
jl 0x140203330
xor edi, 0xe2d58504
xor esi, 0x95a4f797
mov ecx, edi
mov edx, esi
call fcn.140203750
lea rax, [0x1404d96a0]
jmp 0x1402033e1
xor ecx, ecx
lea r14, [0x1404d8f30]
lea r15, [0x1403f6000]
xor edi, 0xf7765a81
xor esi, 0x7a094d1d
lea rbx, [rsp + 0x38]
nop
movsxd rcx, ecx
movzx eax, byte [rcx + r15]
xor byte [rcx + r14], al
mov rdx, rbx
mov r8d, edi
mov r9d, esi
call fcn.1402014e0
mov ecx, dword [rsp + 0x38]
test al, 1
je 0x1402033b0
mov al, 0x4d
xchg byte [0x1404d8f50], al
lea rax, [0x1404d8f30]
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140206910
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xe353e10
add eax, dword [0x1404dbd90]
cmp ecx, eax
jne 0x14020694c
test edx, edx
je 0x14020697c
movzx eax, byte [0x1404dbbb4]
cmp al, 0x3f
je 0x140206944
mov cl, 0x28
mov al, 0xc4
lock cmpxchg byte [0x1404dbbb4], cl
je 0x1402069fa
cmp al, 0x3f
jne 0x140206930
lea rax, [0x1404dbba0]
ret
test edx, edx
je 0x1402069ac
movzx eax, byte [0x1404dbbcd]
cmp al, 0x32
je 0x140206974
mov cl, 0x28
nop dword [rax]
mov al, 0x47
lock cmpxchg byte [0x1404dbbcd], cl
je 0x140206a4f
cmp al, 0x32
jne 0x140206960
lea rax, [0x1404dbbc0]
ret
movzx eax, byte [0x1404dbad2]
cmp al, 0xa8
je 0x1402069a4
mov cl, 0x91
nop dword [rax]
mov al, 0xb8
lock cmpxchg byte [0x1404dbad2], cl
je 0x140206a88
cmp al, 0xa8
jne 0x140206990
lea rax, [0x1404dbac0]
ret
movzx eax, byte [0x1404dba02]
cmp al, 0xa
je 0x1402069f2
nop word [rax + rax]
movzx ecx, byte [0x1404dbda0]
lea eax, [rcx + 0x33]
add cl, 0x42
lock cmpxchg byte [0x1404dba02], cl
je 0x140206ad1
movzx ecx, byte [0x1404dbda0]
mov edx, ecx
xor dl, 0xe8
and cl, 0x68
add cl, cl
add cl, dl
cmp al, cl
jne 0x1402069c0
lea rax, [0x1404dba00]
ret
xor edx, edx
lea rax, [0x1404dbba0]
lea rcx, [0x1403f70e0]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x14
jl 0x140206a10
mov al, 0x3f
xchg byte [0x1404dbbb4], al
lea rax, [0x1404dbba0]
ret
xor eax, eax
lea rcx, [0x1404dbbc0]
lea rdx, [0x1403f7100]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140206a78
inc rax
jmp 0x140206a60
mov al, 0x32
xchg byte [0x1404dbbcd], al
lea rax, [0x1404dbbc0]
ret
xor edx, edx
lea rax, [0x1404dbac0]
lea rcx, [0x1403f7000]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1404dbd90]
add edx, r8d
add edx, 0xe353e11
cmp edx, 0x12
jl 0x140206aa0
mov al, 0xa8
xchg byte [0x1404dbad2], al
lea rax, [0x1404dbac0]
ret
xor eax, eax
lea rcx, [0x1404dba00]
lea rdx, [0x1403f6f40]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x140206b18
inc rax
jmp 0x140206af0
mov al, 0xa
xchg byte [0x1404dba02], al
lea rax, [0x1404dba00]
ret