joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2039e9f0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
test rcx, rcx
je 0x2039eaf6
mov rsi, rdx
mov rdi, rcx
movabs rax, 0xea524dad12d0427e
movabs rcx, 0x6d6382ba081693c0
xor r14d, r14d
movabs rdx, 0x59cb02cc90816fe
mov r8d, r14d
mov r9, qword [0x205b3970]
add r9, rcx
sub r9, rax
add r8, rax
add r8, r9
sub r8, rdx
sub r8, rcx
add r8, rdx
movzx r9d, word [0x205b5a50]
xor r10d, r10d
add r9w, word [rdi + r8*2]
setne r10b
add r14d, 0xd3088c99
mov r8d, r14d
xor r8d, r10d
and r14d, r10d
lea r14d, [r8 + r14*2]
add r14d, 0x2cf77367
cmp word [rdi + r14*2], 0
jne 0x2039ea30
test r14d, r14d
je 0x2039eb1d
mov dword [rsp + 0x38], 0xaac90f97
mov dword [rsp + 0x30], 0x2361860c
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor ebx, ebx
mov ecx, 1
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call fcn.203a8410
test rax, rax
je 0x2039eb1f
mov rcx, qword [rax + 0x10]
xor ebx, ebx
test rcx, rcx
je 0x2039eb1f
mov rdx, qword [rax + 0x18]
test rdx, rdx
je 0x2039eb1f
inc r14d
mov r15d, r14d
xor ebx, ebx
mov ebp, 1
mov r8, rcx
xor r12d, r12d
mov qword [rsp + 0x40], rsi
jmp 0x2039eb6c
mov dword [rsp + 0x20], 0xef236587
xor ebx, ebx
xor ecx, ecx
xor edx, edx
xor r8d, r8d
mov r9d, 0xa7b226ad
call fcn.203a8730
test rax, rax
je 0x2039eb1f
mov rbx, qword [rax + 0x10]
jmp 0x2039eb1f
xor ebx, ebx
mov rax, rbx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ebp, 1
nop dword [rax + rax]
mov r10, qword [r8]
test r10, r10
cmovne r8, r10
movzx r12d, r9b
cmove r12d, ebp
mov r9d, r12d
not r9b
mov r10d, r12d
xor r10b, 1
and r9b, 0xfe
or r9b, r10b
cmp r9b, 0xff
jne 0x2039eb1f
cmp rcx, qword [rax + 0x10]
je 0x2039ebb8
mov dword [rsp + 0x38], 0xaac90f97
mov dword [rsp + 0x30], 0x2361860c
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov ecx, 1
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call fcn.203a8410
test rax, rax
je 0x2039eb1f
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov r8, rcx
mov r9d, r12d
xor r9b, 0xfe
and r9b, r12b
add r9b, byte [0x205b4ce8]
jne 0x2039eb52
cmp r8, rdx
movzx r9d, r12b
cmove r9d, ebp
add r9b, byte [0x205b6d58]
movzx r10d, word [r8 + 0x58]
add r10d, dword [0x205b3b80]
cmp r14d, r10d
ja 0x2039eb40
mov r10, qword [r8 + 0x60]
test r10, r10
je 0x2039eb40
cmp r10, 0xffff
je 0x2039eb40
test r14d, r14d
je 0x2039ec6c
xor r11d, r11d
jmp 0x2039ec32
mov rsi, qword [0x205b3990]
add r11, rsi
inc r11
cmp r11, r15
je 0x2039ec6c
movzx r13d, word [rdi + r11*2]
lea esi, [r13 - 0x61]
lea r12d, [r13 - 0x20]
cmp si, 0x1a
cmovae r12d, r13d
test r12w, r12w
je 0x2039ec20
movzx esi, word [r10 + r11*2]
lea r13d, [rsi - 0x61]
lea ebp, [rsi - 0x20]
cmp r13w, 0x1a
cmovae ebp, esi
cmp r12w, bp
je 0x2039ec20
jmp 0x2039eb33
mov rbx, qword [r8 + 0x30]
mov r9b, 1
mov rsi, qword [rsp + 0x40]
test rsi, rsi
mov ebp, 1
je 0x2039eb40
mov qword [rsi], r8
jmp 0x2039eb40
Function at 0x203ba2b0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x203ba2fc
test edx, edx
je 0x203ba32c
movzx eax, byte [0x2059d620]
movzx ecx, byte [0x2059d718]
mov edx, ecx
xor dl, 0x35
and cl, 0x35
add cl, cl
add cl, dl
cmp al, cl
je 0x203ba2f4
mov cl, 0x9b
nop dword [rax + rax]
mov al, 0xb7
lock cmpxchg byte [0x2059d620], cl
je 0x203ba38c
cmp al, 0xac
jne 0x203ba2e0
lea rax, [0x2059d610]
ret
test edx, edx
je 0x203ba35c
movzx eax, byte [0x2059d6a9]
cmp al, 0x5b
je 0x203ba324
mov cl, 0x7d
nop dword [rax]
mov al, 0xf3
lock cmpxchg byte [0x2059d6a9], cl
je 0x203ba3db
cmp al, 0x5b
jne 0x203ba310
lea rax, [0x2059d6a0]
ret
movzx eax, byte [0x2059d6d7]
cmp al, 0xc8
je 0x203ba354
mov cl, 0xe2
nop dword [rax]
mov al, 0x1b
lock cmpxchg byte [0x2059d6d7], cl
je 0x203ba428
cmp al, 0xc8
jne 0x203ba340
lea rax, [0x2059d6c0]
ret
movzx eax, byte [0x2059d709]
cmp al, 0x96
je 0x203ba384
mov cl, 0xd5
nop dword [rax]
mov al, 0x61
lock cmpxchg byte [0x2059d709], cl
je 0x203ba48f
cmp al, 0x96
jne 0x203ba370
lea rax, [0x2059d6f0]
ret
xor edx, edx
lea rax, [0x2059d610]
lea rcx, [0x204934b0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
add edx, 0x14266bc3
mov r8d, edx
xor r8d, 0xebd9943e
and edx, 0x6bd9943e
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x203ba3a0
mov al, 0xac
xchg byte [0x2059d620], al
lea rax, [0x2059d610]
ret
xor eax, eax
lea rcx, [0x2059d6a0]
lea rdx, [0x20493530]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
not r8b
not r9b
and r9b, r8b
or r9b, r10b
not r9b
add r9b, r9b
add r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x203ba47f
inc rax
jmp 0x203ba3f0
xor edx, edx
lea rax, [0x2059d6c0]
lea rcx, [0x20493550]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x17
jl 0x203ba440
mov al, 0xc8
xchg byte [0x2059d6d7], al
lea rax, [0x2059d6c0]
ret
mov al, 0x5b
xchg byte [0x2059d6a9], al
lea rax, [0x2059d6a0]
ret
xor eax, eax
lea rcx, [0x2059d6f0]
lea rdx, [0x20493580]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x18
jg 0x203ba4b8
inc rax
jmp 0x203ba4a0
mov al, 0x96
xchg byte [0x2059d709], al
lea rax, [0x2059d6f0]
ret
Function at 0x203bcdb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x85693da1
mov r8d, dword [0x2059dc88]
add r8d, eax
cmp ecx, r8d
jne 0x203bce06
add eax, dword [0x2059dc88]
cmp edx, eax
jne 0x203bce3c
movzx eax, byte [0x2059d81c]
cmp al, 0x23
je 0x203bcdfe
mov cl, 0x1f
nop dword [rax + rax]
mov al, 0x14
lock cmpxchg byte [0x2059d81c], cl
je 0x203bcf31
movzx edx, byte [0x2059dc8c]
add dl, 0xc7
cmp al, dl
jne 0x203bcde0
lea rax, [0x2059d810]
ret
test edx, edx
je 0x203bcec1
movzx eax, byte [0x2059d835]
cmp al, 0x98
je 0x203bce34
mov cl, 0x7a
nop dword [rax + rax]
mov al, 0xdd
lock cmpxchg byte [0x2059d835], cl
je 0x203bceec
cmp al, 0x98
jne 0x203bce20
lea rax, [0x2059d820]
ret
movzx eax, byte [0x2059d9ad]
nop word cs:[rax + rax]
cmp al, 0x72
je 0x203bceb9
movzx ecx, byte [0x2059dc8c]
mov edx, ecx
xor dl, 0xcf
mov eax, ecx
and al, 0x4f
add al, al
add al, dl
mov edx, ecx
xor dl, 0x2b
and cl, 0x2b
add cl, cl
add cl, dl
lock cmpxchg byte [0x2059d9ad], cl
jne 0x203bce50
xor edx, edx
lea rax, [0x2059d9a0]
lea rcx, [0x20493910]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x2059dc88]
add edx, r8d
add edx, 0x85693da2
cmp edx, 0xd
jl 0x203bce90
mov al, 0x72
xchg byte [0x2059d9ad], al
lea rax, [0x2059d9a0]
ret
movzx eax, byte [0x2059d803]
cmp al, 0xa4
je 0x203bcee4
mov cl, 0x4b
nop
mov al, 0xb0
lock cmpxchg byte [0x2059d803], cl
je 0x203bcf7f
cmp al, 0xa4
jne 0x203bced0
lea rax, [0x2059d7f0]
ret
xor edx, edx
lea rax, [0x2059d820]
lea rcx, [0x204937a0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x2059dc88]
add edx, r8d
add edx, 0x85693da2
cmp edx, 0x15
jl 0x203bcf00
mov al, 0x98
xchg byte [0x2059d835], al
lea rax, [0x2059d820]
ret
xor eax, eax
lea rcx, [0x2059d810]
lea rdx, [0x20493790]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x203bcf68
inc rax
jmp 0x203bcf50
movzx eax, byte [0x2059dc8c]
add al, 0xc7
xchg byte [0x2059d81c], al
lea rax, [0x2059d810]
ret
xor eax, eax
lea rcx, [0x2059d7f0]
lea rdx, [0x20493770]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x12
jg 0x203bcfa8
inc rax
jmp 0x203bcf90
mov al, 0xa4
xchg byte [0x2059d803], al
lea rax, [0x2059d7f0]
ret
Function at 0x203cbff0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
movzx eax, byte [0x205b6dcd]
movabs rcx, 0x1437f92e534ca1f0
add rcx, qword [0x2059f3c0]
cmp rdx, rcx
ja 0x203cc271
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov ebx, 1
shl rbx, cl
lea r8, [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov edx, 2
shl rdx, cl
mov ecx, dword [0x2059f4c4]
add eax, ecx
add eax, 0xd1e2
cdqe
add rax, qword [0x2059f4d0]
mov rcx, r8
mov r8, rdi
call qword [case.0x2010e313.0]
mov rax, qword [0x2059f3c0]
add rax, rbx
movabs rcx, 0xc37f92e534ca1ef
add rcx, rax
mov qword [rsi + 0x30], rcx
mov qword [rsi + 0x38], rbx
mov rax, qword [rsi + 8]
mov r9, qword [rax]
cmp r9, rdi
je 0x203cc263
movabs rax, 0xcbf29ce484222325
movabs rcx, 0x100000001b3
movabs rdx, 0xc37fa2e534ca3a3
jmp 0x203cc0d1
mov qword [r10 + r11*8], r8
mov qword [r10 + r14*8], r8
cmp r9, rdi
je 0x203cc263
mov r8, r9
movzx r9d, byte [r9 + 0x10]
xor r9, rax
imul r9, rcx
movzx r10d, byte [r8 + 0x11]
xor r10, r9
imul r10, rcx
movzx r11d, byte [r8 + 0x12]
mov r9, r11
not r9
and r9, r10
not r10d
and r10d, r11d
or r9, r10
imul r9, rcx
movzx r10d, byte [r8 + 0x13]
mov r11, r9
xor r11, r10
mov ebx, r10d
xor ebx, r9d
not r9d
and ebx, r10d
not r11
and r9d, r10d
or r9, r11
not r9
or r9, rbx
mov r10, qword [0x2059f3c0]
add r10, rdx
imul r10, r9
movzx r11d, byte [r8 + 0x14]
mov r9, r11
not r9
and r9, r10
not r10d
and r10d, r11d
or r9, r10
imul r9, rcx
movzx r10d, byte [r8 + 0x15]
mov r11d, r9d
not r11d
xor r9, r10
and r11d, r10d
not r9
or r9, r11
not r9
or r9, r11
imul r9, rcx
movzx r10d, byte [r8 + 0x16]
xor r10, r9
imul r10, rcx
movzx ebx, byte [r8 + 0x17]
xor rbx, r10
imul rbx, rcx
and rbx, qword [rsi + 0x30]
mov r9, qword [r8]
mov r10, qword [rsi + 0x18]
lea r11, [rbx + rbx]
lea r14, [rbx + rbx]
inc r14
shl rbx, 4
mov r15, qword [r10 + rbx]
cmp r15, rdi
je 0x203cc0c0
mov rbx, qword [r10 + r14*8]
mov r12, qword [r8 + 0x10]
cmp r12, qword [rbx + 0x10]
jne 0x203cc200
mov r11, qword [rbx]
cmp r11, r8
je 0x203cc0c4
mov rbx, qword [r8 + 8]
mov qword [rbx], r9
mov r15, qword [r9 + 8]
mov qword [r15], r11
mov r12, qword [r11 + 8]
mov qword [r12], r8
mov qword [r11 + 8], r15
mov qword [r9 + 8], rbx
mov qword [r8 + 8], r12
jmp 0x203cc0c4
cmp r15, rbx
je 0x203cc238
mov rbx, qword [rbx + 8]
cmp r12, qword [rbx + 0x10]
jne 0x203cc200
mov r10, qword [rbx]
mov r11, qword [r8 + 8]
mov qword [r11], r9
mov rbx, qword [r9 + 8]
mov qword [rbx], r10
mov r14, qword [r10 + 8]
mov qword [r14], r8
mov qword [r10 + 8], rbx
mov qword [r9 + 8], r11
mov qword [r8 + 8], r14
jmp 0x203cc0c8
mov r14, qword [r8 + 8]
mov qword [r14], r9
mov r15, qword [r9 + 8]
mov qword [r15], rbx
mov r12, qword [rbx + 8]
mov qword [r12], r8
mov qword [rbx + 8], r15
mov qword [r9 + 8], r14
mov qword [r8 + 8], r12
mov qword [r10 + r11*8], r8
jmp 0x203cc0c8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, dword [0x2059f4c0]
add eax, ecx
add eax, 0xd1e2
cdqe
add rax, qword [0x2059f4d8]
mov ecx, 1
xor edx, edx
mov r8d, 0x378c58f7
mov r9d, 0x11248ca5
call qword [case.0x2010e313.0]
mov rcx, rax
call fcn.20429544
int3
Function at 0x203d5ae0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x203d5b26
test edx, edx
je 0x203d5b6c
movzx eax, byte [0x2059dd36]
cmp al, 0x63
je 0x203d5b1e
mov cl, 0x50
nop dword [rax]
mov al, 0x96
lock cmpxchg byte [0x2059dd36], cl
je 0x203d5bec
movzx edx, byte [0x2059f3bc]
add dl, 0xf
cmp al, dl
jne 0x203d5b00
lea rax, [0x2059dd30]
ret
test edx, edx
je 0x203d5bb6
movzx eax, byte [0x2059df45]
movzx ecx, byte [0x2059f3bc]
add cl, 0xbf
cmp al, cl
je 0x203d5b64
mov cl, 0x90
nop word cs:[rax + rax]
mov al, 0xdd
lock cmpxchg byte [0x2059df45], cl
je 0x203d5c48
cmp al, 0x13
jne 0x203d5b50
lea rax, [0x2059df40]
ret
movzx eax, byte [0x2059e128]
movzx ecx, byte [0x2059f3bc]
add cl, 0xfe
cmp al, cl
je 0x203d5bae
mov cl, 0xe2
nop word cs:[rax + rax]
mov al, 0x87
lock cmpxchg byte [0x2059e128], cl
je 0x203d5c95
movzx edx, byte [0x2059f3bc]
add dl, 0xfe
cmp al, dl
jne 0x203d5b90
lea rax, [0x2059e120]
ret
movzx eax, byte [0x2059e288]
cmp al, 0x67
je 0x203d5be4
mov cl, 0x54
nop word cs:[rax + rax]
mov al, 0x23
lock cmpxchg byte [0x2059e288], cl
je 0x203d5cf8
cmp al, 0x67
jne 0x203d5bd0
lea rax, [0x2059e280]
ret
xor edx, edx
lea rax, [0x2059dd30]
lea rcx, [0x204939e0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x2059f3b8]
mov r9d, 0x539a5bc0
sub r9d, r8d
add r8d, 0xac65a43f
xor r9d, r8d
and r9d, edx
xor r9d, r8d
and r8d, edx
lea edx, [r9 + r8*2]
cmp edx, 6
jl 0x203d5c00
mov al, 0x63
xchg byte [0x2059dd36], al
lea rax, [0x2059dd30]
ret
xor eax, eax
lea rcx, [0x2059df40]
lea rdx, [0x20493be0]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, r8b
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x203d5cd8
inc rax
jmp 0x203d5c60
xor eax, eax
lea rcx, [0x2059e120]
lea rdx, [0x20493da0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 7
jg 0x203d5ce8
inc rax
jmp 0x203d5cb0
mov al, 0x13
xchg byte [0x2059df45], al
lea rax, [0x2059df40]
ret
mov al, 0x52
xchg byte [0x2059e128], al
lea rax, [0x2059e120]
ret
xor eax, eax
lea rcx, [0x2059e280]
lea rdx, [0x20493f00]
nop dword [rax + rax]
cdqe
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
xor r8d, r8d
sub r8d, dword [0x2059f3b8]
mov r9d, r8d
xor r9d, 0x539a5bc1
and r8d, 0x539a5bc1
lea r8d, [r9 + r8*2]
sub eax, r8d
cmp eax, 8
jl 0x203d5d10
movzx eax, byte [0x2059f3bc]
add al, 0x13
xchg byte [0x2059e288], al
lea rax, [0x2059e280]
ret
Function at 0x203d5e20
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov esi, r9d
test ecx, ecx
je 0x203d5e99
mov eax, 0xac65a43e
add eax, dword [0x2059f3b8]
cmp edx, eax
jne 0x203d5ee3
mov ecx, esi
xor ecx, 0x17c556d6
mov eax, dword [0x2059f3b8]
mov edx, eax
xor edx, 0x13ca1da9
and eax, 0x13ca1da9
lea edx, [rdx + rax*2]
call fcn.203da700
test al, 1
jne 0x203d6027
mov cl, 0xab
nop word cs:[rax + rax]
mov al, 0x33
lock cmpxchg byte [0x2059e460], cl
je 0x203d5f90
cmp al, 0x2b
jne 0x203d5e80
jmp 0x203d6027
test edx, edx
je 0x203d5f4a
movzx eax, byte [0x2059e484]
cmp al, 0x21
je 0x203d609f
mov cl, 0xcd
nop word cs:[rax + rax]
mov al, 0xdf
lock cmpxchg byte [0x2059e484], cl
je 0x203d6033
movzx edx, byte [0x2059f3bc]
add dl, 0xcd
cmp al, dl
jne 0x203d5ec0
jmp 0x203d609f
movzx eax, byte [0x2059e612]
cmp al, 0x35
je 0x203d6009
mov bl, 0xd8
xor esi, 0x6c654f28
mov ebp, 0xc2d491ee
lea rdi, [rsp + 0x37]
nop word cs:[rax + rax]
mov al, 0x13
lock cmpxchg byte [0x2059e612], bl
sete dl
mov ecx, dword [0x2059f3b8]
add ecx, ebp
mov dword [rsp + 0x20], ecx
mov ecx, eax
mov r8, rdi
mov r9d, esi
call fcn.20190850
test al, 1
jne 0x203d5fc8
cmp byte [rsp + 0x37], 0x35
jne 0x203d5f10
jmp 0x203d6009
movzx eax, byte [0x2059dd96]
cmp al, 0x2a
je 0x203d60e0
mov bl, 0xca
mov edi, 0xd22d55cd
mov al, 0xf3
lock cmpxchg byte [0x2059dd96], bl
je 0x203d60a8
mov edx, dword [0x2059f3b8]
add edx, edi
xor edx, esi
mov ecx, eax
mov r8d, 0xd6320185
call fcn.203da7d0
test al, 1
je 0x203d5f60
jmp 0x203d60e0
xor eax, eax
lea rcx, [0x2059e450]
lea rdx, [0x204940c0]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x203d6015
inc rax
jmp 0x203d5fa0
xor edx, edx
lea rax, [0x2059e610]
lea rcx, [0x20494250]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x2059f3b8]
add edx, r8d
add edx, 0xac65a43f
cmp edx, 2
jl 0x203d5fe0
mov al, 0x35
xchg byte [0x2059e612], al
lea rax, [0x2059e610]
jmp 0x203d60e7
xor esi, 0x64032d15
mov ecx, esi
mov edx, 0xfa90e584
call fcn.203db070
lea rax, [0x2059e450]
jmp 0x203d60e7
xor ebp, ebp
xor esi, 0xbf69a082
lea rdi, [rsp + 0x36]
lea rbx, [rsp + 0x38]
lea r14, [0x2059e470]
nop dword [rax]
mov dword [rsp + 0x20], 0xf63d41e3
mov ecx, ebp
mov rdx, rdi
mov r8, rbx
mov r9d, esi
call fcn.203da7a0
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax]
mov ecx, eax
xor cl, al
not cl
and cl, byte [rsp + 0x36]
xor cl, al
movsxd rax, ebp
mov byte [rax + r14], cl
mov ecx, dword [0x2059f3b8]
lea ebp, [rax + rcx]
add ebp, 0xac65a43f
cmp ebp, 0x14
jl 0x203d6050
mov al, 0x21
xchg byte [0x2059e484], al
lea rax, [0x2059e470]
jmp 0x203d60e7
xor eax, eax
lea rcx, [0x2059dd90]
lea rdx, [0x20493a40]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x203d60d8
inc rax
jmp 0x203d60c0
mov al, 0x2a
xchg byte [0x2059dd96], al
lea rax, [0x2059dd90]
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x203d6120
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xac65a43e
test ecx, ecx
je 0x203d6176
add eax, dword [0x2059f3b8]
cmp edx, eax
jne 0x203d6211
movzx eax, byte [0x2059e720]
cmp al, 0x87
je 0x203d616e
mov cl, 0x92
nop word cs:[rax + rax]
mov al, 0x19
lock cmpxchg byte [0x2059e720], cl
je 0x203d626c
movzx edx, byte [0x2059f3bc]
add dl, 0x33
cmp al, dl
jne 0x203d6150
lea rax, [0x2059e710]
ret
add eax, dword [0x2059f3b8]
cmp edx, eax
jne 0x203d6238
movzx eax, byte [0x2059debd]
nop dword [rax + rax]
cmp al, 0xe7
je 0x203d6209
movzx ecx, byte [0x2059f3bc]
mov edx, ecx
xor dl, 0x10
mov eax, ecx
and al, 0x10
add al, al
add al, dl
add cl, 0x29
lock cmpxchg byte [0x2059debd], cl
jne 0x203d6190
xor edx, edx
lea rax, [0x2059deb0]
lea rcx, [0x20493b60]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x2059f3b8]
add edx, r8d
add edx, 0xac65a43f
cmp edx, 0xd
jl 0x203d61d0
mov al, 0xe7
xchg byte [0x2059debd], al
lea rax, [0x2059deb0]
ret
movzx eax, byte [0x2059e278]
cmp al, 0xfb
je 0x203d6230
mov cl, 0x1a
nop
mov al, 0xcf
lock cmpxchg byte [0x2059e278], cl
je 0x203d6298
cmp al, 0xfb
jne 0x203d6220
lea rax, [0x2059e270]
ret
movzx eax, byte [0x2059dfcb]
cmp al, 0x56
je 0x203d6264
mov cl, 0x81
nop word cs:[rax + rax]
mov al, 0x68
lock cmpxchg byte [0x2059dfcb], cl
je 0x203d6301
cmp al, 0x56
jne 0x203d6250
lea rax, [0x2059dfc0]
ret
xor eax, eax
lea rcx, [0x2059e710]
lea rdx, [0x20494340]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x203d62d1
inc rax
jmp 0x203d6280
xor eax, eax
lea rcx, [0x2059e270]
lea rdx, [0x20493ef0]
mov r8d, 0xac65a446
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x2059f3b8]
add r10d, r8d
cmp r9d, r10d
jge 0x203d62e1
inc rax
jmp 0x203d62b0
mov al, 0x87
xchg byte [0x2059e720], al
lea rax, [0x2059e710]
ret
movzx eax, byte [0x2059f3bc]
mov ecx, eax
xor cl, 0xa7
and al, 0x27
add al, al
add al, cl
xchg byte [0x2059e278], al
lea rax, [0x2059e270]
ret
xor eax, eax
lea rcx, [0x2059dfc0]
lea rdx, [0x20493c60]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x203d6338
inc rax
jmp 0x203d6320
mov al, 0x56
xchg byte [0x2059dfcb], al
lea rax, [0x2059dfc0]
ret
Function at 0x203d7c20
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x28
test ecx, ecx
je 0x203d7c93
test edx, edx
je 0x203d7cf9
movzx eax, byte [0x2059e4a3]
cmp al, 0xa0
je 0x203d7e0d
nop word cs:[rax + rax]
movzx ecx, byte [0x2059f3bc]
mov edx, ecx
xor dl, 0x29
mov eax, ecx
and al, 0x29
add al, al
add al, dl
add al, 0xb3
add cl, 0x57
lock cmpxchg byte [0x2059e4a3], cl
je 0x203d7d99
movzx ecx, byte [0x2059f3bc]
mov edx, ecx
xor dl, 0x4c
and cl, 0x4c
add cl, cl
add cl, dl
cmp al, cl
jne 0x203d7c50
jmp 0x203d7e0d
mov esi, r9d
mov eax, r9d
xor eax, 0xf0e3bb42
mov ecx, edx
mov edx, eax
mov r8d, 0x860b8242
call fcn.2008e940
test al, 1
je 0x203d7d60
xor esi, 0xc03d30fe
mov edx, 0xe3f1fd35
add edx, dword [0x2059f3b8]
mov ecx, esi
call fcn.203da570
test al, 1
jne 0x203d7ece
mov cl, 0xe1
nop word [rax + rax]
mov al, 0xf9
lock cmpxchg byte [0x2059e7e3], cl
je 0x203d7e3d
cmp al, 0x28
jne 0x203d7ce0
jmp 0x203d7ece
movzx eax, byte [0x2059e1f6]
cmp al, 0x57
je 0x203d7e31
movzx ecx, byte [0x2059f3bc]
lea eax, [rcx - 0x3b]
add cl, 0xab
lock cmpxchg byte [0x2059e1f6], cl
jne 0x203d7d00
xor eax, eax
lea rcx, [0x2059e1e0]
lea rdx, [0x20493e60]
nop
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x15
jg 0x203d7e19
inc rax
jmp 0x203d7d30
movzx eax, byte [0x2059e3b7]
cmp al, 7
je 0x203d7ebd
mov cl, 0x3d
nop word cs:[rax + rax]
mov al, 0x61
lock cmpxchg byte [0x2059e3b7], cl
je 0x203d7e78
cmp al, 7
jne 0x203d7d80
jmp 0x203d7ebd
xor r8d, r8d
lea rax, [0x2059e490]
lea rcx, [0x204940f0]
mov edx, 0xac65a43f
nop
movsxd r8, r8d
movzx r9d, byte [r8 + rax]
movzx r10d, byte [r8 + rcx]
mov r11d, r9d
not r11b
not r10b
mov ebx, r11d
xor bl, r10b
and bl, r11b
and r10b, r9b
or r10b, bl
mov byte [r8 + rax], r10b
mov r9d, dword [0x2059f3b8]
add r9d, edx
mov r10d, r8d
not r10d
mov r11d, r9d
xor r11d, r10d
xor r10d, r8d
and r10d, r9d
xor r10d, r8d
and r11d, r9d
lea r8d, [r10 + r11*2]
cmp r8d, 0x13
jl 0x203d7db0
mov al, 0xa0
xchg byte [0x2059e4a3], al
lea rax, [0x2059e490]
jmp 0x203d7ed5
movzx eax, byte [0x2059f3bc]
mov ecx, eax
xor cl, 3
and al, 3
add al, al
add al, cl
xchg byte [0x2059e1f6], al
lea rax, [0x2059e1e0]
jmp 0x203d7ed5
xor eax, eax
lea rcx, [0x2059e7e0]
lea rdx, [0x20494400]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x203d7ec6
inc rax
jmp 0x203d7e50
xor edx, edx
lea rax, [0x2059e3b0]
lea rcx, [0x20494020]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0x7ffffffe
and r8d, edx
xor edx, 1
lea edx, [rdx + r8*2]
cmp edx, 7
jl 0x203d7e90
mov al, 7
xchg byte [0x2059e3b7], al
lea rax, [0x2059e3b0]
jmp 0x203d7ed5
mov al, 0x28
xchg byte [0x2059e7e3], al
lea rax, [0x2059e7e0]
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x203d7f20
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xac65a43e
add eax, dword [0x2059f3b8]
cmp ecx, eax
jne 0x203d7f5c
test edx, edx
je 0x203d7f8c
movzx eax, byte [0x2059dfad]
cmp al, 4
je 0x203d7f54
mov cl, 0x7a
mov al, 0xd2
lock cmpxchg byte [0x2059dfad], cl
je 0x203d7fec
cmp al, 4
jne 0x203d7f40
lea rax, [0x2059dfa0]
ret
test edx, edx
je 0x203d7fbc
movzx eax, byte [0x2059df35]
cmp al, 0x74
je 0x203d7f84
mov cl, 0xcf
nop dword [rax]
mov al, 0x9b
lock cmpxchg byte [0x2059df35], cl
je 0x203d8031
cmp al, 0x74
jne 0x203d7f70
lea rax, [0x2059df30]
ret
movzx eax, byte [0x2059deec]
cmp al, 0x70
je 0x203d7fb4
mov cl, 0xee
nop dword [rax]
mov al, 0xa1
lock cmpxchg byte [0x2059deec], cl
je 0x203d8088
cmp al, 0x70
jne 0x203d7fa0
lea rax, [0x2059dee0]
ret
movzx eax, byte [0x2059de54]
cmp al, 0x69
je 0x203d7fe4
mov cl, 0xdb
nop dword [rax]
mov al, 0x79
lock cmpxchg byte [0x2059de54], cl
je 0x203d80df
cmp al, 0x69
jne 0x203d7fd0
lea rax, [0x2059de50]
ret
xor eax, eax
lea rcx, [0x2059dfa0]
lea rdx, [0x20493c40]
mov r8d, 0xac65a44b
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x2059f3b8]
add r10d, r8d
cmp r9d, r10d
jge 0x203d8068
inc rax
jmp 0x203d8010
xor eax, eax
lea rcx, [0x2059df30]
lea rdx, [0x20493bd0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x203d8078
inc rax
jmp 0x203d8050
mov al, 4
xchg byte [0x2059dfad], al
lea rax, [0x2059dfa0]
ret
mov al, 0x74
xchg byte [0x2059df35], al
lea rax, [0x2059df30]
ret
xor eax, eax
lea rcx, [0x2059dee0]
lea rdx, [0x20493b80]
nop dword [rax + rax]
cdqe
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
mov r8d, dword [0x2059f3b8]
mov r9d, r8d
xor r9d, 0xac65a43f
and r8d, 0x2c65a43f
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0xc
jl 0x203d80a0
mov al, 0x70
xchg byte [0x2059deec], al
lea rax, [0x2059dee0]
ret
xor edx, edx
lea rax, [0x2059de50]
lea rcx, [0x20493b00]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x2059f3b8]
add edx, r8d
add edx, 0xac65a43f
cmp edx, 4
jl 0x203d80f0
mov al, 0x69
xchg byte [0x2059de54], al
lea rax, [0x2059de50]
ret