joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140139c90
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140139ccc
test edx, edx
je 0x140139d0c
movzx eax, byte [0x140525213]
cmp al, 0xdc
je 0x140139cc4
mov cl, 0xa2
nop word cs:[rax + rax]
mov al, 0x50
lock cmpxchg byte [0x140525213], cl
je 0x140139dec
cmp al, 0xdc
jne 0x140139cb0
lea rax, [0x140525200]
ret
test edx, edx
je 0x140139daa
movzx eax, byte [0x14052525d]
cmp al, 0x67
je 0x140139d04
mov cl, 0xd4
nop word cs:[rax + rax]
mov al, 0x7f
lock cmpxchg byte [0x14052525d], cl
je 0x140139e38
cmp al, 0x67
jne 0x140139cf0
lea rax, [0x140525250]
ret
movzx eax, byte [0x140525272]
nop word cs:[rax + rax]
cmp al, 0xb
je 0x140139da2
movzx ecx, byte [0x140525338]
lea eax, [rcx - 0x2f]
inc cl
lock cmpxchg byte [0x140525272], cl
jne 0x140139d20
xor edx, edx
lea rax, [0x140525260]
lea rcx, [0x14044f250]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, dword [0x140525328]
add edx, r8d
add edx, 0x3a8ab2b2
mov r9d, r8d
xor r9d, 0x3a8ab2c3
and r8d, 0x3a8ab2c3
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x140139d50
mov al, 0xb
xchg byte [0x140525272], al
lea rax, [0x140525260]
ret
movzx eax, byte [0x1405251fd]
movzx ecx, byte [0x140525338]
add cl, 0xbd
cmp al, cl
je 0x140139de4
mov cl, 0x95
nop word cs:[rax + rax]
mov al, 0xd0
lock cmpxchg byte [0x1405251fd], cl
je 0x140139e81
cmp al, 0x6f
jne 0x140139dd0
lea rax, [0x1405251f0]
ret
xor eax, eax
lea rcx, [0x140525200]
lea rdx, [0x14044f200]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x12
jg 0x140139e28
inc rax
jmp 0x140139e00
mov al, 0xdc
xchg byte [0x140525213], al
lea rax, [0x140525200]
ret
xor eax, eax
lea rcx, [0x140525250]
lea rdx, [0x14044f240]
mov r8d, 0x3a8ab2be
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140525328]
add r10d, r8d
cmp r9d, r10d
jge 0x140139e71
inc rax
jmp 0x140139e50
mov al, 0x67
xchg byte [0x14052525d], al
lea rax, [0x140525250]
ret
xor eax, eax
lea rcx, [0x1405251f0]
lea rdx, [0x14044f1f0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140139eb8
inc rax
jmp 0x140139ea0
mov al, 0x6f
xchg byte [0x1405251fd], al
lea rax, [0x1405251f0]
ret
Function at 0x14013a110
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x14013a16d
test edx, edx
je 0x14013a1a9
movzx eax, byte [0x140525240]
mov ecx, r8d
xor cl, 0x23
add cl, byte [0x140525338]
cmp al, cl
je 0x14013a27c
nop dword [rax]
movzx ecx, byte [0x140525338]
mov eax, r8d
xor al, 0x94
add al, cl
mov edx, r8d
xor dl, 0xa7
add dl, cl
lock cmpxchg byte [0x140525240], dl
je 0x14013a219
cmp al, 0x40
jne 0x14013a140
jmp 0x14013a27c
test edx, edx
je 0x14013a1e9
movzx eax, byte [0x14052522d]
cmp al, 0xa1
je 0x14013a330
mov cl, 0x56
nop word cs:[rax + rax]
mov al, 0xa4
lock cmpxchg byte [0x14052522d], cl
je 0x14013a285
cmp al, 0xa1
jne 0x14013a190
jmp 0x14013a330
movzx eax, byte [0x14052528d]
mov ecx, r8d
xor cl, 0x9e
add cl, byte [0x140525338]
cmp al, cl
je 0x14013a31f
mov cl, 0x12
nop word cs:[rax + rax]
mov al, 0xdf
lock cmpxchg byte [0x14052528d], cl
je 0x14013a2cb
cmp al, 0xe5
jne 0x14013a1d0
jmp 0x14013a31f
movzx eax, byte [0x1405251c3]
cmp al, 0x95
je 0x14013a3a6
mov cl, 0x83
nop word [rax + rax]
mov al, 0x4f
lock cmpxchg byte [0x1405251c3], cl
je 0x14013a339
cmp al, 0x95
jne 0x14013a200
jmp 0x14013a3a6
xor eax, eax
lea rcx, [0x140525230]
lea rdx, [0x14044f230]
mov r9d, r8d
xor r9d, 0x619dee1f
nop word cs:[rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
add byte [rax + rcx], r10b
mov r10d, dword [0x140525328]
xor r10d, r9d
mov r11d, r10d
not r11d
and r11d, r9d
lea r10d, [r10 + r11*2]
add eax, r10d
cmp eax, 0x10
jl 0x14013a240
xor r8b, 0x23
add r8b, byte [0x140525338]
xchg byte [0x140525240], r8b
lea rax, [0x140525230]
pop rbx
ret
xor eax, eax
lea rcx, [0x140525220]
lea rdx, [0x14044f220]
xor r8d, 0x619dee13
nop dword [rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140525328]
mov r11d, r8d
xor r11d, r10d
and r10d, r8d
lea r10d, [r11 + r10*2]
cmp r9d, r10d
jge 0x14013a328
inc rax
jmp 0x14013a2a0
xor eax, eax
lea rcx, [0x140525280]
lea rdx, [0x14044f270]
mov r9d, r8d
xor r9d, 0x619dee1f
nop word cs:[rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
mov r10d, dword [0x140525328]
add r10d, r9d
add eax, r10d
cmp eax, 0xd
jl 0x14013a2f0
xor r8b, 0x9e
add r8b, byte [0x140525338]
xchg byte [0x14052528d], r8b
lea rax, [0x140525280]
pop rbx
ret
mov al, 0xa1
xchg byte [0x14052522d], al
lea rax, [0x140525220]
pop rbx
ret
xor edx, edx
lea rax, [0x1405251a0]
lea rcx, [0x14044f1a0]
xor r8d, 0x619dee1f
movsxd rdx, edx
movzx r9d, byte [rdx + rax]
movzx r10d, byte [rdx + rcx]
mov r11d, r9d
not r11b
not r10b
mov ebx, r11d
xor bl, r10b
and bl, r11b
xor r10b, r9b
not r10b
and r10b, r9b
or r10b, bl
mov byte [rdx + rax], r10b
mov r9d, dword [0x140525328]
add r9d, r8d
xor r9d, edx
mov r10d, r9d
not r10d
and r10d, edx
lea edx, [r9 + r10*2]
cmp edx, 0x23
jl 0x14013a350
mov al, 0x95
xchg byte [0x1405251c3], al
lea rax, [0x1405251a0]
pop rbx
ret
Function at 0x14013f020
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r9, r8
mov rsi, rdx
mov rdi, rcx
mov r8, qword [rcx]
mov rdx, qword [r8 + 8]
xor ebp, ebp
cmp byte [rdx + 0x19], 0
je 0x14013f04e
mov rbx, rdx
mov rax, r8
cmp byte [rax + 0x19], 0
jne 0x14013f0af
jmp 0x14013f0a7
mov ecx, dword [r9]
mov rax, r8
nop word cs:[rax + rax]
mov rbx, rdx
mov r10d, dword [rdx + 0x20]
cmp r10d, ecx
cmovae rax, rdx
lea rdx, [rdx + 0x10]
cmovae rdx, rbx
mov rdx, qword [rdx]
movzx r11d, byte [0x140525e5c]
mov ebp, r11d
xor bpl, 0x8a
and r11b, 0xa
add r11b, r11b
add r11b, bpl
cmp byte [rdx + 0x19], r11b
je 0x14013f060
xor ebp, ebp
cmp r10d, ecx
setae bpl
cmp byte [rax + 0x19], 0
jne 0x14013f0af
mov ecx, dword [r9]
cmp ecx, dword [rax + 0x20]
jae 0x14013f0fb
movabs rax, 0x147ae147ae147ae
cmp qword [rdi + 8], rax
je 0x14013f0ff
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.14013f110
mov r8, qword [rsp + 0x40]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], ebp
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.14013f270
mov cl, 1
mov qword [rsi], rax
mov byte [rsi + 8], cl
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
xor ecx, ecx
jmp 0x14013f0e9
call fcn.1400aaad0
int3
Function at 0x1401497d0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140149821
test edx, edx
je 0x14014985c
movzx eax, byte [0x140526473]
cmp al, 0xd
je 0x140149819
nop word [rax + rax]
movzx ecx, byte [0x1405266e8]
lea eax, [rcx + 0x1f]
add cl, 0x7b
lock cmpxchg byte [0x140526473], cl
je 0x1401498c6
movzx ecx, byte [0x1405266e8]
add cl, 0xe6
cmp al, cl
jne 0x1401497f0
lea rax, [0x140526470]
ret
test edx, edx
je 0x14014988c
movzx eax, byte [0x14052655f]
cmp al, 7
je 0x140149854
mov cl, 0x77
nop word cs:[rax + rax]
mov al, 0x47
lock cmpxchg byte [0x14052655f], cl
je 0x140149911
cmp al, 7
jne 0x140149840
lea rax, [0x140526550]
ret
movzx eax, byte [0x140526462]
cmp al, 0x63
je 0x140149884
mov cl, 5
nop dword [rax]
mov al, 0x6f
lock cmpxchg byte [0x140526462], cl
je 0x140149951
cmp al, 0x63
jne 0x140149870
lea rax, [0x140526460]
ret
movzx eax, byte [0x1405264e2]
cmp al, 0x8f
je 0x1401498be
mov cl, 0x58
nop dword [rax]
mov al, 0x84
lock cmpxchg byte [0x1405264e2], cl
je 0x1401499af
movzx edx, byte [0x1405266e8]
add dl, 0x68
cmp al, dl
jne 0x1401498a0
lea rax, [0x1405264d0]
ret
xor edx, edx
lea rax, [0x140526470]
lea rcx, [0x14044f840]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1405266ec]
add edx, r8d
add edx, 0x8de27085
cmp edx, 3
jl 0x1401498e0
mov al, 0xd
xchg byte [0x140526473], al
lea rax, [0x140526470]
ret
xor eax, eax
lea rcx, [0x140526550]
lea rdx, [0x14044f900]
mov r8d, 0x8de27093
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405266ec]
add r10d, r8d
cmp r9d, r10d
jge 0x14014999f
inc rax
jmp 0x140149930
xor edx, edx
lea rax, [0x140526460]
lea rcx, [0x14044f830]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 2
jl 0x140149970
mov al, 0x63
xchg byte [0x140526462], al
lea rax, [0x140526460]
ret
mov al, 7
xchg byte [0x14052655f], al
lea rax, [0x140526550]
ret
xor edx, edx
lea rax, [0x1405264d0]
lea rcx, [0x14044f890]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1405266ec]
add edx, r8d
add edx, 0x8de27085
cmp edx, 0x12
jl 0x1401499c0
mov al, 0x8f
xchg byte [0x1405264e2], al
lea rax, [0x1405264d0]
ret
Function at 0x140149b50
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140149b96
test edx, edx
je 0x140149bdc
movzx eax, byte [0x1405265cd]
cmp al, 0xcf
je 0x140149b8e
mov cl, 0x5f
nop dword [rax]
mov al, 0xd4
lock cmpxchg byte [0x1405265cd], cl
je 0x140149c3c
movzx edx, byte [0x1405266e8]
add dl, 0xa8
cmp al, dl
jne 0x140149b70
lea rax, [0x1405265c0]
ret
xor eax, eax
sub eax, dword [0x1405266ec]
mov ecx, eax
xor ecx, 0x721d8f7c
and eax, 0x721d8f7c
lea eax, [rcx + rax*2]
add edx, eax
jne 0x140149c08
movzx eax, byte [0x1405264c5]
cmp al, 0x42
je 0x140149bd4
mov cl, 0x68
nop
mov al, 0xcb
lock cmpxchg byte [0x1405264c5], cl
je 0x140149cbf
cmp al, 0x42
jne 0x140149bc0
lea rax, [0x1405264b0]
ret
movzx eax, byte [0x140526512]
cmp al, 0xe8
je 0x140149c00
mov cl, 0x36
nop dword [rax]
mov al, 0xd8
lock cmpxchg byte [0x140526512], cl
je 0x140149c78
cmp al, 0xe8
jne 0x140149bf0
lea rax, [0x140526510]
ret
movzx eax, byte [0x14052661b]
cmp al, 0xe0
je 0x140149c34
mov cl, 0x76
nop word cs:[rax + rax]
mov al, 7
lock cmpxchg byte [0x14052661b], cl
je 0x140149d01
cmp al, 0xe0
jne 0x140149c20
lea rax, [0x140526610]
ret
xor eax, eax
lea rcx, [0x1405265c0]
lea rdx, [0x14044f970]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140149c68
inc rax
jmp 0x140149c50
mov al, 0xcf
xchg byte [0x1405265cd], al
lea rax, [0x1405265c0]
ret
xor eax, eax
lea rcx, [0x140526510]
lea rdx, [0x14044f8d0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x140149ca8
inc rax
jmp 0x140149c90
movzx eax, byte [0x1405266e8]
add al, 0xc1
xchg byte [0x140526512], al
lea rax, [0x140526510]
ret
xor edx, edx
lea rax, [0x1405264b0]
lea rcx, [0x14044f870]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1405266ec]
add edx, r8d
add edx, 0x8de27085
cmp edx, 0x15
jl 0x140149cd0
mov al, 0x42
xchg byte [0x1405264c5], al
lea rax, [0x1405264b0]
ret
xor eax, eax
lea rcx, [0x140526610]
lea rdx, [0x14044f9c0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x140149d38
inc rax
jmp 0x140149d20
mov al, pe_nt_image_headers64
xchg byte [0x14052661b], al
lea rax, [0x140526610]
ret
Function at 0x140159670
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa5c3331b
add eax, dword [0x1405291a4]
cmp ecx, eax
jne 0x1401596bc
test edx, edx
je 0x14015971c
movzx eax, byte [0x140527c50]
cmp al, 0x63
je 0x1401596b4
mov cl, 0x15
nop word cs:[rax + rax]
mov al, 0x10
lock cmpxchg byte [0x140527c50], cl
je 0x140159813
cmp al, 0x63
jne 0x1401596a0
lea rax, [0x140527c40]
ret
test edx, edx
je 0x1401597c1
movzx eax, byte [0x140527be9]
nop dword [rax + rax]
cmp al, 0xdc
je 0x140159850
movzx ecx, byte [0x1405291a0]
lea eax, [rcx - 0x73]
add cl, 0xa3
lock cmpxchg byte [0x140527be9], cl
jne 0x1401596d0
xor eax, eax
lea rcx, [0x140527be0]
lea rdx, [0x140450890]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x140159848
inc rax
jmp 0x140159700
movzx eax, byte [0x140527c06]
nop word cs:[rax + rax]
cmp al, 0x6e
je 0x1401597b9
movzx ecx, byte [0x1405291a0]
lea eax, [rcx - 0x21]
add cl, 0x88
lock cmpxchg byte [0x140527c06], cl
jne 0x140159730
xor eax, eax
lea rcx, [0x140527c00]
lea rdx, [0x1404508b0]
nop
cdqe
xor r8d, r8d
sub r8b, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
xor r10d, r10d
sub r10b, r9b
mov r9d, r8d
xor r9b, r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
neg r10b
mov byte [rax + rcx], r10b
mov r8d, dword [0x1405291a4]
mov r9d, r8d
xor r9d, 0x5a3ccce3
and r9d, r8d
xor r8d, 0xa5c3331c
lea r8d, [r8 + r9*2]
add eax, r8d
cmp eax, 6
jl 0x140159760
mov al, 0x6e
xchg byte [0x140527c06], al
lea rax, [0x140527c00]
ret
movzx eax, byte [0x140527d45]
movzx ecx, byte [0x1405291a0]
add cl, 0xc9
cmp al, cl
je 0x14015980b
nop word cs:[rax + rax]
movzx ecx, byte [0x1405291a0]
mov edx, ecx
xor dl, 0x40
mov eax, ecx
not al
and al, 0x3f
or al, dl
not al
add al, al
add al, dl
add cl, 0xb7
lock cmpxchg byte [0x140527d45], cl
je 0x140159868
cmp al, 0x8d
jne 0x1401597e0
lea rax, [0x140527d30]
ret
xor eax, eax
lea rcx, [0x140527c40]
lea rdx, [0x1404508f0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140159858
inc rax
jmp 0x140159830
mov al, 0xdc
xchg byte [0x140527be9], al
lea rax, [0x140527be0]
ret
mov al, 0x63
xchg byte [0x140527c50], al
lea rax, [0x140527c40]
ret
xor edx, edx
lea rax, [0x140527d30]
lea rcx, [0x1404509d0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x140159880
mov al, 0x8d
xchg byte [0x140527d45], al
lea rax, [0x140527d30]
ret
Function at 0x1401598b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa5c3331b
mov r8d, dword [0x1405291a4]
add r8d, eax
cmp ecx, r8d
jne 0x14015990c
test edx, edx
je 0x1401599bc
movzx eax, byte [0x140527b86]
movzx ecx, byte [0x1405291a0]
mov edx, ecx
xor dl, 0x8a
and cl, 0xa
add cl, cl
add cl, dl
cmp al, cl
je 0x140159904
mov cl, 0xc3
nop dword [rax]
mov al, 0x87
lock cmpxchg byte [0x140527b86], cl
je 0x1401599f6
cmp al, 0x4e
jne 0x1401598f0
lea rax, [0x140527b70]
ret
add eax, dword [0x1405291a4]
cmp edx, eax
jne 0x14015994c
movzx eax, byte [0x140527ad2]
cmp al, 0xb
je 0x140159944
mov cl, 0x2a
nop word cs:[rax + rax]
mov al, 0x65
lock cmpxchg byte [0x140527ad2], cl
je 0x140159a51
cmp al, 0xb
jne 0x140159930
lea rax, [0x140527ac0]
ret
movzx eax, byte [0x140527d2d]
nop word cs:[rax + rax]
cmp al, 0x42
je 0x140159ab7
movzx ecx, byte [0x1405291a0]
lea eax, [rcx - 0x5f]
add cl, 0xeb
lock cmpxchg byte [0x140527d2d], cl
jne 0x140159960
xor eax, eax
lea rcx, [0x140527d20]
lea rdx, [0x1404509c0]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140159aaf
inc rax
jmp 0x140159990
movzx eax, byte [0x140527ab5]
cmp al, 0xab
je 0x1401599ee
mov cl, 0x1c
nop dword [rax]
mov al, 0x3f
lock cmpxchg byte [0x140527ab5], cl
je 0x140159abf
movzx edx, byte [0x1405291a0]
add dl, 0xe7
cmp al, dl
jne 0x1401599d0
lea rax, [0x140527aa0]
ret
xor edx, edx
lea rax, [0x140527b70]
lea rcx, [0x140450840]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x1405291a4]
add edx, r8d
add edx, 0xa5c3331c
cmp edx, 0x16
jl 0x140159a10
mov al, 0x4e
xchg byte [0x140527b86], al
lea rax, [0x140527b70]
ret
xor eax, eax
lea rcx, [0x140527ac0]
lea rdx, [0x140450790]
nop word cs:[rax + rax]
cdqe
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
mov r8d, dword [0x1405291a4]
mov r9d, r8d
xor r9d, 0xa5c3331c
and r8d, 0x25c3331c
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0x12
jl 0x140159a70
mov al, 0xb
xchg byte [0x140527ad2], al
lea rax, [0x140527ac0]
ret
mov al, 0x42
xchg byte [0x140527d2d], al
lea rax, [0x140527d20]
ret
xor eax, eax
lea rcx, [0x140527aa0]
lea rdx, [0x140450770]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140159ae8
inc rax
jmp 0x140159ad0
mov al, 0xab
xchg byte [0x140527ab5], al
lea rax, [0x140527aa0]
ret
Function at 0x14015a0d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa5c3331b
add eax, dword [0x1405291a4]
cmp ecx, eax
jne 0x14015a13c
test edx, edx
je 0x14015a1ca
movzx eax, byte [0x140527c15]
nop
cmp al, 0x13
je 0x14015a25a
movzx ecx, byte [0x1405291a0]
lea eax, [rcx + 0x52]
add cl, 0x46
lock cmpxchg byte [0x140527c15], cl
jne 0x14015a0f0
xor eax, eax
lea rcx, [0x140527c10]
lea rdx, [0x1404508c0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x14015a242
inc rax
jmp 0x14015a120
test edx, edx
je 0x14015a1f8
movzx eax, byte [0x140527d5d]
nop dword [rax + rax]
cmp al, 0x2a
je 0x14015a1c2
movzx ecx, byte [0x1405291a0]
lea eax, [rcx + 0x59]
mov edx, eax
xor dl, 0xb1
and al, 0x31
add al, al
add al, dl
add cl, 0xa4
lock cmpxchg byte [0x140527d5d], cl
jne 0x14015a150
xor r8d, r8d
lea rax, [0x140527d50]
lea rcx, [0x1404509f0]
mov edx, 0xa5c33328
nop dword [rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
add byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x1405291a4]
add r9d, edx
cmp r8d, r9d
jl 0x14015a190
mov al, 0x2a
xchg byte [0x140527d5d], al
lea rax, [0x140527d50]
ret
movzx eax, byte [0x140527d1d]
cmp al, 3
je 0x14015a1f0
mov cl, 0x2e
nop word [rax + rax]
mov al, 0x1f
lock cmpxchg byte [0x140527d1d], cl
je 0x14015a262
cmp al, 3
jne 0x14015a1e0
lea rax, [0x140527d10]
ret
movzx eax, byte [0x140527cb3]
cmp al, 0xfb
je 0x14015a23a
mov cl, 0x31
nop word cs:[rax + rax]
mov al, 0x2d
lock cmpxchg byte [0x140527cb3], cl
je 0x14015a2af
movzx edx, byte [0x1405291a0]
mov r8d, edx
xor r8b, 0x37
and dl, 0x37
add dl, dl
add dl, r8b
cmp al, dl
jne 0x14015a210
lea rax, [0x140527c90]
ret
movzx eax, byte [0x1405291a0]
mov ecx, eax
xor cl, 0x4f
and al, 0x4f
add al, al
add al, cl
xchg byte [0x140527c15], al
lea rax, [0x140527c10]
ret
xor eax, eax
lea rcx, [0x140527d10]
lea rdx, [0x1404509b0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r9b
mov r10d, r9d
or r10b, r8b
not r10b
and r9b, r8b
or r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14015a2d8
inc rax
jmp 0x14015a280
xor eax, eax
lea rcx, [0x140527c90]
lea rdx, [0x140450930]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x14015a2e8
inc rax
jmp 0x14015a2c0
mov al, 3
xchg byte [0x140527d1d], al
lea rax, [0x140527d10]
ret
mov al, 0xfb
xchg byte [0x140527cb3], al
lea rax, [0x140527c90]
ret
Function at 0x14018d480
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0xf3bfb8dc
add eax, dword [0x14052f358]
cmp ecx, eax
jne 0x14018d52b
test edx, edx
je 0x14018d568
movzx eax, byte [0x14052f0f9]
nop word [rax + rax]
cmp al, 0x9a
je 0x14018d523
movzx ecx, byte [0x14052f368]
mov eax, r8d
xor al, 0xc2
add al, cl
mov edx, r8d
xor dl, 0xfc
add dl, cl
lock cmpxchg byte [0x14052f0f9], dl
jne 0x14018d4b0
xor edx, edx
lea rax, [0x14052f0f0]
lea rcx, [0x140451450]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
add edx, 0xd386914c
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x2c796eb4
cmp edx, 9
jl 0x14018d4f0
mov al, 0x9a
xchg byte [0x14052f0f9], al
lea rax, [0x14052f0f0]
ret
test edx, edx
je 0x14018d5e5
movzx eax, byte [0x14052f172]
cmp al, 0x9a
je 0x14018d560
mov cl, 0xa4
mov al, 0x1a
lock cmpxchg byte [0x14052f172], cl
je 0x14018d618
mov edx, r8d
xor dl, 0x49
add dl, byte [0x14052f368]
cmp al, dl
jne 0x14018d540
lea rax, [0x14052f160]
ret
movzx eax, byte [0x14052ef3c]
nop
cmp al, 0xb5
je 0x14018d5dd
movzx ecx, byte [0x14052f368]
mov edx, r8d
not dl
and dl, 0x94
mov eax, r8d
xor al, 0x6b
or al, dl
not al
or al, dl
add al, cl
add cl, r8b
lock cmpxchg byte [0x14052ef3c], cl
jne 0x14018d570
xor edx, edx
lea rax, [0x14052ef10]
lea rcx, [0x140451280]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0x7ffffffe
and r8d, edx
xor edx, 1
lea edx, [rdx + r8*2]
cmp edx, 0x2c
jl 0x14018d5b0
mov al, 0xb5
xchg byte [0x14052ef3c], al
lea rax, [0x14052ef10]
ret
movzx eax, byte [0x14052f125]
cmp al, 0xe0
je 0x14018d610
mov cl, 0x23
nop word cs:[rax + rax]
mov al, 0xfd
lock cmpxchg byte [0x14052f125], cl
je 0x14018d658
cmp al, 0xe0
jne 0x14018d600
lea rax, [0x14052f110]
ret
xor eax, eax
lea rcx, [0x14052f160]
lea rdx, [0x1404514c0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x14018d648
inc rax
jmp 0x14018d630
mov al, 0x9a
xchg byte [0x14052f172], al
lea rax, [0x14052f160]
ret
xor eax, eax
lea rcx, [0x14052f110]
lea rdx, [0x140451470]
xor r8d, 0xf3bfb8dd
neg r8d
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rcx]
mov r10d, r9d
xor r10b, 0xd6
and r9b, 0x56
add r9b, r9b
add r9b, r10b
add r9b, byte [rax + rdx]
add r9b, 0x2a
mov byte [rax + rcx], r9b
xor r9d, r9d
sub r9d, dword [0x14052f358]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
sub eax, r9d
cmp eax, 0x15
jl 0x14018d680
mov al, pe_nt_image_headers64
xchg byte [0x14052f125], al
lea rax, [0x14052f110]
ret
Function at 0x14018d8d0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14018d91c
mov eax, r8d
xor eax, 0xcbd56a66
add eax, dword [0x14052f358]
cmp edx, eax
jne 0x14018d968
movzx eax, byte [0x14052f13b]
cmp al, 0x70
je 0x14018d914
mov cl, 0x21
nop dword [rax + rax]
mov al, 0x46
lock cmpxchg byte [0x14052f13b], cl
je 0x14018d9ec
cmp al, 0x70
jne 0x14018d900
lea rax, [0x14052f130]
ret
test edx, edx
je 0x14018d9ba
movzx eax, byte [0x14052f09e]
cmp al, 0xd0
je 0x14018d960
mov cl, 0x32
nop word cs:[rax + rax]
mov al, 0xa5
lock cmpxchg byte [0x14052f09e], cl
je 0x14018da78
mov edx, r8d
xor dl, 0x85
add dl, byte [0x14052f368]
cmp al, dl
jne 0x14018d940
lea rax, [0x14052f090]
ret
movzx eax, byte [0x14052f0d3]
cmp al, 0xfa
je 0x14018d9b2
mov cl, 0x75
nop word cs:[rax + rax]
mov al, 0x9e
lock cmpxchg byte [0x14052f0d3], cl
je 0x14018da18
movzx edx, byte [0x14052f368]
mov r9d, r8d
xor r9b, 0x53
mov r10d, r9d
xor r10b, dl
and r9b, dl
add r9b, r9b
add r9b, r10b
cmp al, r9b
jne 0x14018d980
lea rax, [0x14052f0b0]
ret
movzx eax, byte [0x14052f10d]
cmp al, 6
je 0x14018d9e4
mov cl, 0xf5
nop word [rax + rax]
mov al, 0x93
lock cmpxchg byte [0x14052f10d], cl
je 0x14018dab8
cmp al, 6
jne 0x14018d9d0
lea rax, [0x14052f100]
ret
xor eax, eax
lea rcx, [0x14052f130]
lea rdx, [0x140451490]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x14018da58
inc rax
jmp 0x14018da00
xor eax, eax
lea rcx, [0x14052f0b0]
lea rdx, [0x140451410]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x14018da68
inc rax
jmp 0x14018da30
mov al, 0x70
xchg byte [0x14052f13b], al
lea rax, [0x14052f130]
ret
mov al, 0xfa
xchg byte [0x14052f0d3], al
lea rax, [0x14052f0b0]
ret
xor eax, eax
lea rcx, [0x14052f090]
lea rdx, [0x1404513f0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x14018daa8
inc rax
jmp 0x14018da90
mov al, 0xd0
xchg byte [0x14052f09e], al
lea rax, [0x14052f090]
ret
xor edx, edx
lea rax, [0x14052f100]
lea rcx, [0x140451460]
xor r8d, 0xcbd56a13
nop
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
mov r9d, dword [0x14052f358]
add r9d, r8d
cmp edx, r9d
jl 0x14018dad0
mov al, 6
xchg byte [0x14052f10d], al
lea rax, [0x14052f100]
ret