joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401ec820
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401ec8a5
test edx, edx
je 0x1401ec8f6
movzx eax, byte [0x14050fc45]
nop word [rax + rax]
movzx ecx, byte [0x14050fcac]
add cl, 0xcc
cmp al, cl
je 0x1401ec964
movzx ecx, byte [0x14050fcac]
lea eax, [rcx - 6]
add cl, 0xe0
lock cmpxchg byte [0x14050fc45], cl
jne 0x1401ec840
xor eax, eax
lea rcx, [0x14050fc30]
lea rdx, [0x14042ef10]
mov r8d, 0x332d80a0
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14050fcb8]
add r10d, r8d
cmp r9d, r10d
jge 0x1401ec95c
inc rax
jmp 0x1401ec880
mov eax, dword [0x14050fcb8]
mov ecx, eax
xor ecx, 0x332d808b
and eax, 0x332d808b
lea eax, [rcx + rax*2]
cmp edx, eax
jne 0x1401ec932
movzx eax, byte [0x14050fbc3]
cmp al, 0xfa
je 0x1401ec8ee
mov cl, 5
nop dword [rax]
mov al, 0xb3
lock cmpxchg byte [0x14050fbc3], cl
je 0x1401ec9af
movzx edx, byte [0x14050fcac]
add dl, 0xb6
cmp al, dl
jne 0x1401ec8d0
lea rax, [0x14050fba0]
ret
movzx eax, byte [0x14050fc83]
cmp al, 0x6d
je 0x1401ec92a
mov cl, 0x4c
nop word cs:[rax + rax]
mov al, 0x9b
lock cmpxchg byte [0x14050fc83], cl
je 0x1401ec96c
movzx edx, byte [0x14050fcac]
add dl, 0x29
cmp al, dl
jne 0x1401ec910
lea rax, [0x14050fc60]
ret
movzx eax, byte [0x14050fc9f]
cmp al, 0x1c
je 0x1401ec954
mov cl, 0x3c
nop
mov al, 0xcc
lock cmpxchg byte [0x14050fc9f], cl
je 0x1401eca10
cmp al, 0x1c
jne 0x1401ec940
lea rax, [0x14050fc90]
ret
mov al, 0x10
xchg byte [0x14050fc45], al
lea rax, [0x14050fc30]
ret
xor eax, eax
lea rcx, [0x14050fc60]
lea rdx, [0x14042ef40]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1401ec998
inc rax
jmp 0x1401ec980
movzx eax, byte [0x14050fcac]
add al, 0x29
xchg byte [0x14050fc83], al
lea rax, [0x14050fc60]
ret
xor edx, edx
lea rax, [0x14050fba0]
lea rcx, [0x14042ee90]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
movzx r9d, byte [rdx + rax]
xor r9b, r8b
mov r10d, r9d
not r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
mov byte [rdx + rax], r10b
mov r8d, edx
xor r8d, 1
not edx
and edx, 0x7ffffffe
or edx, r8d
not edx
lea edx, [r8 + rdx*2]
cmp edx, 0x23
jl 0x1401ec9c0
mov al, 0xfa
xchg byte [0x14050fbc3], al
lea rax, [0x14050fba0]
ret
xor r8d, r8d
lea rax, [0x14050fc90]
lea rcx, [0x14042ef70]
mov edx, 0x332d809a
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
add byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x14050fcb8]
add r9d, edx
cmp r8d, r9d
jl 0x1401eca30
mov al, 0x1c
xchg byte [0x14050fc9f], al
lea rax, [0x14050fc90]
ret
Function at 0x1401f0c60
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, rcx
lea rsi, [rcx + 8]
mov rcx, rsi
call fcn.140125080
mov r15, qword [0x140510598]
movsxd r13, dword [r15]
mov ecx, dword [0x14055c44c]
nop dword [rax]
mov ecx, dword [0x14055c448]
mov edx, dword [0x140510610]
neg edx
add edx, ecx
add edx, 0x3c85232
imul edx, ecx
test dl, 1
jne 0x1401f0ca0
mov qword [rbp - 8], r13
xor r13, r15
mov ecx, 0xfc37ade0
nop word [rax + rax]
mov edx, dword [0x14055c44c]
cmp edx, 0x4a
jg 0x1401f0cef
mov edx, dword [0x14055c448]
lea r8d, [rdx - 1]
imul r8d, edx
test r8b, 1
je 0x1401f0d06
mov edx, dword [0x14055c44c]
mov r8d, dword [0x140510610]
add r8d, ecx
cmp edx, r8d
jge 0x1401f0cd0
jmp 0x1401f0cdb
mov r14d, dword [0x14042f3a8]
test al, al
je 0x1401f0d4a
mov byte [rdi + 0x2c], 0
lea rbx, [rdi + 0x20]
mov rcx, rbx
call fcn.1401d4f80
mov rcx, rsi
mov edx, 0x3e8
call fcn.140125cf0
test al, al
jne 0x1401f0d3a
mov rcx, rsi
call fcn.1401250a0
mov rcx, rsi
call fcn.1401251a0
mov rcx, rbx
call fcn.1401d4ec0
mov qword [rbp - 0x10], rsi
mov eax, dword [0x140510590]
mov ecx, eax
xor ecx, 1
mov edx, eax
and edx, 1
lea ebx, [rcx + rdx*2]
mov dword [0x140510590], ebx
mov ecx, 0xfc37adcc
add ecx, dword [0x140510610]
xor ecx, eax
xor eax, ebx
not ebx
and ebx, ecx
or ebx, eax
xor esi, esi
xor ebx, 0xffffffff
mov r12d, 0
jne 0x1401f0e10
xor eax, eax
mov esi, 0
mov r12d, 0
test r14d, r14d
jle 0x1401f0e10
mov rcx, qword [rbp - 8]
and rcx, r15
lea rcx, [rcx*2]
add rcx, r13
xor edx, edx
xor r8d, r8d
nop word cs:[rax + rax]
cdqe
mov r9, qword [rcx + rax]
mov r10, qword [rcx + rax + 8]
mov rsi, r9
xor rsi, r9
mov r12, r10
xor r12, r10
not r12
and r12, r8
xor r12, r10
not rsi
and rsi, rdx
xor rsi, r9
mov edx, dword [0x140510610]
mov r8d, edx
xor r8d, 0xfc37addd
and edx, 0x7c37addd
lea edx, [r8 + rdx*2]
add eax, edx
mov rdx, rsi
mov r8, r12
cmp eax, r14d
jl 0x1401f0dc0
add rdi, 0x20
mov rcx, rdi
call fcn.1401d4ec0
xor ecx, ecx
test ebx, ebx
setne cl
mov rax, qword [0x14042f3a0]
xor r8d, r8d
add rcx, 0xffffffffffffffff
adc r8, 0xffffffffffffffff
mov rdx, qword [0x14042f398]
sub rdx, rsi
sbb rax, r12
mov r9d, dword [0x14055c448]
lea r10d, [r9 - 1]
imul r10d, r9d
and r10d, 1
mov r9d, 0xfc37adcd
add r9d, dword [0x140510610]
cmp r10d, r9d
mov r9, rdx
not r9
mov r10, rax
not r10
mov r11, rcx
not r11
mov rsi, r8
not rsi
mov edi, dword [0x14055c44c]
cmp edi, 0x4d
jg 0x1401f0eb0
jmp 0x1401f0e8a
mov edi, dword [0x140510610]
mov ebx, edi
xor ebx, 0xfc37adcd
and edi, 0x7c37adcd
add edi, edi
add edi, ebx
je 0x1401f0ed0
nop word cs:[rax + rax]
mov edi, dword [0x14055c448]
mov ebx, dword [0x140510610]
neg ebx
add ebx, edi
add ebx, 0x3c85232
imul ebx, edi
test bl, 1
jne 0x1401f0eb0
jmp 0x1401f0e8a
xor rdx, rcx
xor rax, r8
and r10, rsi
or r10, rax
and r9, r11
or r9, rdx
and r9, r10
cmp r9, 0xffffffffffffffff
setne al
or al, byte [0x14055bd28]
and al, 1
mov byte [0x14055bd28], al
lea rax, [0x140429250]
mov rcx, qword [rbp - 0x10]
mov qword [rcx], rax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1401f7de0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov r13, r8
sub r13, rdx
sar r13, 6
mov r14, qword [rcx]
mov rax, qword [rcx + 8]
mov r12, rax
sub r12, r14
mov r15, r12
sar r15, 6
cmp r13, r15
jbe 0x1401f7e4d
mov rcx, qword [rsi + 0x10]
sub rcx, r14
sar rcx, 6
cmp r13, rcx
jbe 0x1401f7f1e
mov rcx, rsi
mov rdx, r13
call fcn.1401f80d0
jmp 0x1401f7f63
shl r13, 6
add r13, r14
jmp 0x1401f7e70
mov rcx, r14
call fcn.14011b850
add r14, 0x40
add rbx, 0x40
cmp rbx, rdi
je 0x1401f7e8c
cmp r14, rbx
je 0x1401f7e68
mov r8, qword [rbx + 0x10]
mov rdx, r8
test r8, r8
je 0x1401f7e60
mov rdx, qword [rbx + 8]
jmp 0x1401f7e60
mov rbx, qword [rsi + 8]
cmp r13, rbx
je 0x1401f7fa2
mov r14d, 0xe2aefd80
lea rax, [fcn.1401f7de0]
lea r15d, [rax + rax]
add r15d, 0x42a0
mov rdi, r13
jmp 0x1401f7ecd
add rdi, 0x40
cmp rdi, rbx
je 0x1401f7fa2
mov eax, dword [0x14055c4a4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x1401f7f00
nop
mov rax, qword [rdi]
mov rax, qword [rax]
mov rcx, rdi
xor edx, edx
call qword [case.0x140303ece.0]
mov eax, dword [0x1405112b0]
add eax, r14d
test r15d, eax
je 0x1401f7ec0
nop
mov rax, qword [rdi]
mov rax, qword [rax]
mov rcx, rdi
xor edx, edx
call qword [case.0x140303ece.0]
mov eax, dword [0x14055c4a8]
cmp eax, 0x56
jge 0x1401f7f00
jmp 0x1401f7ee0
shl r15, 6
add r15, rbx
cmp rax, r14
je 0x1401f7f60
mov r14, qword [rsi]
nop dword [rax]
add r12, 0xffffffffffffffc0
cmp r14, rbx
je 0x1401f7f51
mov r8, qword [rbx + 0x10]
mov rdx, r8
test r8, r8
je 0x1401f7f49
mov rdx, qword [rbx + 8]
mov rcx, r14
call fcn.14011b850
test r12, r12
je 0x1401f7f60
add r14, 0x40
add rbx, 0x40
jmp 0x1401f7f30
mov rbx, r15
mov r13, qword [rsi + 8]
cmp rbx, rdi
je 0x1401f7fa2
xor eax, eax
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], r13
nop word cs:[rax + rax]
mov rcx, rsi
mov rdx, r13
mov r8, rbx
call fcn.1401f8340
add rbx, 0x40
add r13, 0x40
cmp rbx, rdi
je 0x1401f7fa2
add qword [rbp - 8], 0xffffffffffffffc0
jmp 0x1401f7f80
mov eax, dword [0x14055c4a8]
cmp eax, 0x2e
jle 0x1401f7fdf
lea rax, [fcn.1401f7de0]
add eax, eax
add eax, 0x4160
nop dword [rax + rax]
mov qword [rsi + 8], r13
mov ecx, dword [0x1405112b0]
mov edx, ecx
xor edx, 0xe2aefd80
and ecx, 0x62aefd80
lea ecx, [rdx + rcx*2]
test eax, ecx
jne 0x1401f7fc0
mov qword [rsi + 8], r13
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140213dc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x6f76d62d
add eax, dword [0x140512ee0]
cmp ecx, eax
jne 0x140213e06
test edx, edx
je 0x140213e3c
movzx eax, byte [0x14051244d]
cmp al, 0x75
je 0x140213dfe
mov cl, 0xc9
mov al, 0xcb
lock cmpxchg byte [0x14051244d], cl
je 0x140213eac
movzx edx, byte [0x140512ee4]
add dl, 4
cmp al, dl
jne 0x140213de0
lea rax, [0x140512440]
ret
test edx, edx
je 0x140213e7c
movzx eax, byte [0x1405125cd]
cmp al, 0x4c
je 0x140213e34
mov cl, 0x60
nop word [rax + rax]
mov al, 0x42
lock cmpxchg byte [0x1405125cd], cl
je 0x140213eef
cmp al, 0x4c
jne 0x140213e20
lea rax, [0x1405125c0]
ret
movzx eax, byte [0x140511fb5]
movzx ecx, byte [0x140512ee4]
add cl, 0xbb
cmp al, cl
je 0x140213e74
mov cl, 0x2a
nop word cs:[rax + rax]
mov al, 0xc5
lock cmpxchg byte [0x140511fb5], cl
je 0x140213f46
cmp al, 0x2c
jne 0x140213e60
lea rax, [0x140511fa0]
ret
movzx eax, byte [0x1405125ed]
cmp al, 0xf1
je 0x140213ea4
mov cl, 0xfe
nop dword [rax]
mov al, 0xda
lock cmpxchg byte [0x1405125ed], cl
je 0x140213f78
cmp al, 0xf1
jne 0x140213e90
lea rax, [0x1405125e0]
ret
xor eax, eax
lea rcx, [0x140512440]
lea rdx, [0x1404309c0]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r9b
mov r10d, r9d
or r10b, r8b
not r10b
and r9b, r8b
or r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140213f2f
inc rax
jmp 0x140213ec0
xor edx, edx
lea rax, [0x1405125c0]
lea rcx, [0x140430b30]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x140213f00
mov al, 0x4c
xchg byte [0x1405125cd], al
lea rax, [0x1405125c0]
ret
movzx eax, byte [0x140512ee4]
add al, 4
xchg byte [0x14051244d], al
lea rax, [0x140512440]
ret
xor eax, eax
lea rcx, [0x140511fa0]
lea rdx, [0x140430540]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140213fa8
inc rax
jmp 0x140213f60
xor eax, eax
lea rcx, [0x1405125e0]
lea rdx, [0x140430b50]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140213fb8
inc rax
jmp 0x140213f90
mov al, 0x2c
xchg byte [0x140511fb5], al
lea rax, [0x140511fa0]
ret
mov al, 0xf1
xchg byte [0x1405125ed], al
lea rax, [0x1405125e0]
ret
Function at 0x140213fd0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140214025
test edx, edx
je 0x140214066
movzx eax, byte [0x1405121c5]
cmp al, 0x38
je 0x14021401d
mov cl, 0x74
nop dword [rax]
mov al, 0x3c
lock cmpxchg byte [0x1405121c5], cl
je 0x1402140dc
movzx edx, byte [0x140512ee4]
mov r8d, edx
xor r8b, 4
and dl, 4
add dl, dl
add dl, r8b
add dl, 0xc3
cmp al, dl
jne 0x140213ff0
lea rax, [0x1405121b0]
ret
test edx, edx
je 0x1402140a6
movzx eax, byte [0x14051259d]
movzx ecx, byte [0x140512ee4]
add cl, 0x52
cmp al, cl
je 0x14021405e
mov cl, 0xdf
mov al, 0x71
lock cmpxchg byte [0x14051259d], cl
je 0x140214118
movzx edx, byte [0x140512ee4]
add dl, 0x52
cmp al, dl
jne 0x140214040
lea rax, [0x140512590]
ret
movzx eax, byte [0x1405123d4]
cmp al, 0x9d
je 0x14021409e
mov cl, 7
nop word cs:[rax + rax]
mov al, 0x37
lock cmpxchg byte [0x1405123d4], cl
je 0x140214161
movzx edx, byte [0x140512ee4]
add dl, 0x2c
cmp al, dl
jne 0x140214080
lea rax, [0x1405123b0]
ret
movzx eax, byte [0x140512287]
cmp al, 0xa9
je 0x1402140d4
mov cl, 0xdd
nop word cs:[rax + rax]
mov al, 0x16
lock cmpxchg byte [0x140512287], cl
je 0x1402141a8
cmp al, 0xa9
jne 0x1402140c0
lea rax, [0x140512280]
ret
xor eax, eax
lea rcx, [0x1405121b0]
lea rdx, [0x140430740]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140214108
inc rax
jmp 0x1402140f0
mov al, 0x38
xchg byte [0x1405121c5], al
lea rax, [0x1405121b0]
ret
xor edx, edx
lea rax, [0x140512590]
lea rcx, [0x140430b00]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x140512ee0]
add edx, r8d
add edx, 0x6f76d62e
cmp edx, 0xd
jl 0x140214130
mov al, 0xc3
xchg byte [0x14051259d], al
lea rax, [0x140512590]
ret
xor eax, eax
lea rcx, [0x1405123b0]
lea rdx, [0x140430930]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x23
jg 0x140214198
inc rax
jmp 0x140214180
mov al, 0x9d
xchg byte [0x1405123d4], al
lea rax, [0x1405123b0]
ret
xor eax, eax
lea rcx, [0x140512280]
lea rdx, [0x140430810]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 6
jg 0x1402141e8
inc rax
jmp 0x1402141c0
movzx eax, byte [0x140512ee4]
add al, 0x38
xchg byte [0x140512287], al
lea rax, [0x140512280]
ret
Function at 0x1402144b0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1402144ec
test edx, edx
je 0x140214531
movzx eax, byte [0x1405121a4]
movzx ecx, byte [0x140512ee4]
add cl, 0x4d
cmp al, cl
je 0x1402144e4
mov cl, 0xb3
nop
mov al, 0xc
lock cmpxchg byte [0x1405121a4], cl
je 0x14021459c
cmp al, 0xbe
jne 0x1402144d0
lea rax, [0x140512190]
ret
test edx, edx
je 0x14021455c
movzx eax, byte [0x1405125dd]
cmp al, 0x7c
je 0x140214529
nop dword [rax + rax]
movzx ecx, byte [0x140512ee4]
lea eax, [rcx - 0x58]
add cl, 0x4a
lock cmpxchg byte [0x1405125dd], cl
je 0x1402145f9
movzx ecx, byte [0x140512ee4]
add cl, 0xb
cmp al, cl
jne 0x140214500
lea rax, [0x1405125d0]
ret
movzx eax, byte [0x14051284d]
cmp al, 0x6e
je 0x140214554
mov cl, 0x8c
nop
mov al, 1
lock cmpxchg byte [0x14051284d], cl
je 0x140214648
cmp al, 0x6e
jne 0x140214540
lea rax, [0x140512840]
ret
movzx eax, byte [0x14051261d]
movzx ecx, byte [0x140512ee4]
add cl, 0x13
cmp al, cl
je 0x140214594
mov cl, 0xd4
nop word cs:[rax + rax]
mov al, 0x54
lock cmpxchg byte [0x14051261d], cl
je 0x1402146a3
cmp al, 0x84
jne 0x140214580
lea rax, [0x140512610]
ret
xor r8d, r8d
lea rax, [0x140512190]
lea rcx, [0x140430720]
mov edx, 0x6f76d62e
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
xor byte [r8 + rax], r9b
mov r9d, dword [0x140512ee0]
add r9d, edx
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r8d, [r10 + r9*2]
cmp r8d, 0x14
jl 0x1402145c0
mov al, 0xbe
xchg byte [0x1405121a4], al
lea rax, [0x140512190]
ret
xor edx, edx
lea rax, [0x1405125d0]
lea rcx, [0x140430b40]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x140512ee0]
add edx, r8d
add edx, 0x6f76d62e
cmp edx, 0xd
jl 0x140214610
movzx eax, byte [0x140512ee4]
add al, 0xb
xchg byte [0x1405125dd], al
lea rax, [0x1405125d0]
ret
xor eax, eax
lea rcx, [0x140512840]
lea rdx, [0x140430db0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
mov r9d, dword [0x140512ee0]
mov r10d, r9d
xor r10d, 0x6f76d63a
and r9d, 0x6f76d63a
lea r9d, [r10 + r9*2]
cmp r8d, r9d
jge 0x140214693
inc rax
jmp 0x140214660
mov al, 0x6e
xchg byte [0x14051284d], al
lea rax, [0x140512840]
ret
xor eax, eax
lea rcx, [0x140512610]
lea rdx, [0x140430b80]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1402146d8
inc rax
jmp 0x1402146c0
mov al, 0x84
xchg byte [0x14051261d], al
lea rax, [0x140512610]
ret
Function at 0x140214ae0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0xd94b9ab7
mov r9d, dword [0x140512ee0]
add r9d, eax
cmp ecx, r9d
jne 0x140214b3c
add eax, dword [0x140512ee0]
cmp edx, eax
jne 0x140214b6c
movzx eax, byte [0x14051293d]
cmp al, 0xbc
je 0x140214b34
mov cl, 0x86
nop word cs:[rax + rax]
mov al, 0x51
lock cmpxchg byte [0x14051293d], cl
je 0x140214c38
cmp al, 0xbc
jne 0x140214b20
lea rax, [0x140512930]
ret
test edx, edx
je 0x140214ba8
movzx eax, byte [0x14051299d]
cmp al, 0x81
je 0x140214b64
mov cl, 0xd0
nop dword [rax]
mov al, 0xaf
lock cmpxchg byte [0x14051299d], cl
je 0x140214bf8
cmp al, 0x81
jne 0x140214b50
lea rax, [0x140512990]
ret
movzx eax, byte [0x14051246d]
cmp al, 0xfa
je 0x140214ba0
mov cl, 0x57
nop dword [rax]
mov al, 0xb5
lock cmpxchg byte [0x14051246d], cl
je 0x140214c78
mov edx, r8d
xor dl, 0x13
add dl, byte [0x140512ee4]
cmp al, dl
jne 0x140214b80
lea rax, [0x140512460]
ret
movzx eax, byte [0x140512370]
mov ecx, r8d
xor cl, 0x31
add cl, byte [0x140512ee4]
cmp al, cl
je 0x140214bf0
xor ecx, ecx
nop word cs:[rax + rax]
mov al, 0xa3
lock cmpxchg byte [0x140512370], cl
je 0x140214ccf
mov edx, r8d
xor dl, 0x31
add dl, byte [0x140512ee4]
cmp al, dl
jne 0x140214bd0
lea rax, [0x140512360]
ret
xor eax, eax
lea rcx, [0x140512990]
lea rdx, [0x140430ee0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140214c28
inc rax
jmp 0x140214c10
mov al, 0x81
xchg byte [0x14051299d], al
lea rax, [0x140512990]
ret
xor eax, eax
lea rcx, [0x140512930]
lea rdx, [0x140430ea0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140214cbf
inc rax
jmp 0x140214c50
xor edx, edx
lea rax, [0x140512460]
lea rcx, [0x1404309e0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x140214c90
mov al, 0xfa
xchg byte [0x14051246d], al
lea rax, [0x140512460]
ret
mov al, 0xbc
xchg byte [0x14051293d], al
lea rax, [0x140512930]
ret
xor edx, edx
lea rax, [0x140512360]
lea rcx, [0x1404308f0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x140214ce0
mov al, 0x1c
xchg byte [0x140512370], al
lea rax, [0x140512360]
ret
Function at 0x140215000
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0xb40fab15
mov r9d, dword [0x140512ee0]
add r9d, eax
cmp ecx, r9d
jne 0x1402150bc
add eax, dword [0x140512ee0]
cmp edx, eax
jne 0x1402150f8
movzx eax, byte [0x1405127cc]
nop word cs:[rax + rax]
cmp al, 0xf5
je 0x1402151f4
movzx ecx, byte [0x140512ee4]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0x65
mov eax, r8d
and al, 0x9a
or al, r9b
mov r9d, eax
xor r9b, cl
and al, cl
add al, al
add al, r9b
and dl, 0x40
mov r9d, r8d
and r9b, 0xbf
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x1405127cc], r9b
jne 0x140215040
xor eax, eax
lea rcx, [0x1405127c0]
lea rdx, [0x140430d30]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x1402151ec
inc rax
jmp 0x1402150a0
test edx, edx
je 0x14021512c
movzx eax, byte [0x1405128ad]
cmp al, 0x91
je 0x1402150f0
mov cl, 0x5e
nop dword [rax]
mov al, 0xd3
lock cmpxchg byte [0x1405128ad], cl
je 0x14021519c
mov edx, r8d
xor dl, 0x18
add dl, byte [0x140512ee4]
cmp al, dl
jne 0x1402150d0
lea rax, [0x1405128a0]
ret
movzx eax, byte [0x140512562]
cmp al, 0x9c
je 0x140215124
mov cl, 0xfe
nop word cs:[rax + rax]
mov al, 0x58
lock cmpxchg byte [0x140512562], cl
je 0x1402151fc
cmp al, 0x9c
jne 0x140215110
lea rax, [0x140512550]
ret
movzx eax, byte [0x14051207f]
nop word cs:[rax + rax]
cmp al, 0x3a
je 0x140215247
movzx ecx, byte [0x140512ee4]
mov eax, r8d
xor al, 0xf7
add al, cl
add cl, r8b
add cl, 0x80
lock cmpxchg byte [0x14051207f], cl
jne 0x140215140
xor eax, eax
lea rcx, [0x140512070]
lea rdx, [0x140430600]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x14021523f
inc rax
jmp 0x140215180
xor eax, eax
lea rcx, [0x1405128a0]
lea rdx, [0x140430e10]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1402151dc
inc rax
jmp 0x1402151b0
mov al, 0x91
xchg byte [0x1405128ad], al
lea rax, [0x1405128a0]
ret
mov al, 0xf5
xchg byte [0x1405127cc], al
lea rax, [0x1405127c0]
ret
xor edx, edx
lea rax, [0x140512550]
lea rcx, [0x140430ac0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x12
jl 0x140215210
mov al, 0x9c
xchg byte [0x140512562], al
lea rax, [0x140512550]
ret
mov al, 0x3a
xchg byte [0x14051207f], al
lea rax, [0x140512070]
ret
Function at 0x140215280
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1402152bc
test edx, edx
je 0x1402152ec
movzx eax, byte [0x1405127aa]
cmp al, 3
je 0x1402152b4
mov cl, 0x36
nop word [rax + rax]
mov al, 0xd
lock cmpxchg byte [0x1405127aa], cl
je 0x1402153c5
cmp al, 3
jne 0x1402152a0
lea rax, [0x1405127a0]
ret
test edx, edx
je 0x14021531c
movzx eax, byte [0x140512308]
cmp al, 0xb9
je 0x1402152e4
mov cl, 0x45
nop dword [rax]
mov al, 0xb4
lock cmpxchg byte [0x140512308], cl
je 0x14021540d
cmp al, 0xb9
jne 0x1402152d0
lea rax, [0x1405122f0]
ret
movzx eax, byte [0x14051279d]
cmp al, 0x5e
je 0x140215314
mov cl, 0x55
nop dword [rax]
mov al, 0xcf
lock cmpxchg byte [0x14051279d], cl
je 0x140215480
cmp al, 0x5e
jne 0x140215300
lea rax, [0x140512790]
ret
movzx eax, byte [0x14051266d]
nop word cs:[rax + rax]
cmp al, 0x67
je 0x1402154c0
movzx ecx, byte [0x140512ee4]
mov eax, r8d
not al
mov edx, r8d
xor dl, 0x4f
and dl, al
mov r9d, eax
and r9b, 0xbb
mov eax, r8d
and al, 0x44
or al, r9b
add al, cl
mov r9d, r8d
and r9b, 0xb0
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x14051266d], r9b
jne 0x140215330
xor eax, eax
lea rcx, [0x140512660]
lea rdx, [0x140430bd0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
add r8b, byte [rax + rdx]
add r8b, 0x2b
mov r9d, r8d
xor r9b, 0xd5
and r8b, 0x55
add r8b, r8b
add r8b, r9b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1402154b8
inc rax
jmp 0x140215390
xor eax, eax
lea rcx, [0x1405127a0]
lea rdx, [0x140430d10]
xor r8d, 0xa5f70909
nop dword [rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x140512ee0]
add r9d, r8d
add eax, r9d
cmp eax, 0xa
jl 0x1402153e0
mov al, 3
xchg byte [0x1405127aa], al
lea rax, [0x1405127a0]
ret
xor eax, eax
lea rcx, [0x1405122f0]
lea rdx, [0x140430880]
mov r10d, r8d
not r10d
mov r11d, r10d
and r11d, 0xa5f70909
mov r9d, r8d
and r9d, 0x5a08f6f6
or r9d, r11d
and r10d, 0xa5f70962
and r8d, 0x5a08f69d
or r8d, r10d
nop dword [rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
mov r10d, dword [0x140512ee0]
add eax, r9d
add eax, r10d
add r10d, r8d
cmp eax, r10d
jl 0x140215450
mov al, 0xb9
xchg byte [0x140512308], al
lea rax, [0x1405122f0]
ret
xor eax, eax
lea rcx, [0x140512790]
lea rdx, [0x140430d00]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1402154a8
inc rax
jmp 0x140215490
mov al, 0x5e
xchg byte [0x14051279d], al
lea rax, [0x140512790]
ret
mov al, 0x67
xchg byte [0x14051266d], al
lea rax, [0x140512660]
ret