joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14012ded0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa5c3331b
add eax, dword [0x1404f9474]
cmp ecx, eax
jne 0x14012df3c
test edx, edx
je 0x14012dfca
movzx eax, byte [0x1404f7ee5]
nop
cmp al, 0x13
je 0x14012e05a
movzx ecx, byte [0x1404f9470]
lea eax, [rcx + 0x52]
add cl, 0x46
lock cmpxchg byte [0x1404f7ee5], cl
jne 0x14012def0
xor eax, eax
lea rcx, [0x1404f7ee0]
lea rdx, [0x1404248c0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x14012e042
inc rax
jmp 0x14012df20
test edx, edx
je 0x14012dff8
movzx eax, byte [0x1404f802d]
nop dword [rax + rax]
cmp al, 0x2a
je 0x14012dfc2
movzx ecx, byte [0x1404f9470]
lea eax, [rcx + 0x59]
mov edx, eax
xor dl, 0xb1
and al, 0x31
add al, al
add al, dl
add cl, 0xa4
lock cmpxchg byte [0x1404f802d], cl
jne 0x14012df50
xor r8d, r8d
lea rax, [0x1404f8020]
lea rcx, [0x1404249f0]
mov edx, 0xa5c33328
nop dword [rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
add byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x1404f9474]
add r9d, edx
cmp r8d, r9d
jl 0x14012df90
mov al, 0x2a
xchg byte [0x1404f802d], al
lea rax, [0x1404f8020]
ret
movzx eax, byte [0x1404f7fed]
cmp al, 3
je 0x14012dff0
mov cl, 0x2e
nop word [rax + rax]
mov al, 0x1f
lock cmpxchg byte [0x1404f7fed], cl
je 0x14012e062
cmp al, 3
jne 0x14012dfe0
lea rax, [0x1404f7fe0]
ret
movzx eax, byte [0x1404f7f83]
cmp al, 0xfb
je 0x14012e03a
mov cl, 0x31
nop word cs:[rax + rax]
mov al, 0x2d
lock cmpxchg byte [0x1404f7f83], cl
je 0x14012e0af
movzx edx, byte [0x1404f9470]
mov r8d, edx
xor r8b, 0x37
and dl, 0x37
add dl, dl
add dl, r8b
cmp al, dl
jne 0x14012e010
lea rax, [0x1404f7f60]
ret
movzx eax, byte [0x1404f9470]
mov ecx, eax
xor cl, 0x4f
and al, 0x4f
add al, al
add al, cl
xchg byte [0x1404f7ee5], al
lea rax, [0x1404f7ee0]
ret
xor eax, eax
lea rcx, [0x1404f7fe0]
lea rdx, [0x1404249b0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r9b
mov r10d, r9d
or r10b, r8b
not r10b
and r9b, r8b
or r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14012e0d8
inc rax
jmp 0x14012e080
xor eax, eax
lea rcx, [0x1404f7f60]
lea rdx, [0x140424930]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x14012e0e8
inc rax
jmp 0x14012e0c0
mov al, 3
xchg byte [0x1404f7fed], al
lea rax, [0x1404f7fe0]
ret
mov al, 0xfb
xchg byte [0x1404f7f83], al
lea rax, [0x1404f7f60]
ret
Function at 0x140154c20
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140154c6c
test edx, edx
je 0x140154ca6
movzx eax, byte [0x1404fe550]
movzx ecx, byte [0x1404febb4]
mov edx, ecx
xor dl, 0x81
and cl, 1
add cl, cl
add cl, dl
cmp al, cl
je 0x140154c64
mov cl, 0x62
nop dword [rax + rax]
mov al, 0xd1
lock cmpxchg byte [0x1404fe550], cl
je 0x140154d1c
cmp al, 0x1d
jne 0x140154c50
lea rax, [0x1404fe540]
ret
test edx, edx
je 0x140154ce6
movzx eax, byte [0x1404fe512]
cmp al, 0xb6
je 0x140154c9e
mov cl, 0x61
nop dword [rax]
mov al, 0x3f
lock cmpxchg byte [0x1404fe512], cl
je 0x140154d58
movzx edx, byte [0x1404febb4]
add dl, 0x1a
cmp al, dl
jne 0x140154c80
lea rax, [0x1404fe500]
ret
movzx eax, byte [0x1404fe646]
cmp al, 0xb
je 0x140154cde
mov cl, 0xf7
nop word cs:[rax + rax]
mov al, 0x2a
lock cmpxchg byte [0x1404fe646], cl
je 0x140154d9f
movzx edx, byte [0x1404febb4]
add dl, 0x6f
cmp al, dl
jne 0x140154cc0
lea rax, [0x1404fe630]
ret
movzx eax, byte [0x1404fe5df]
cmp al, 0xaf
je 0x140154d14
mov cl, 0xa6
nop word cs:[rax + rax]
mov al, 0x18
lock cmpxchg byte [0x1404fe5df], cl
je 0x140154de8
cmp al, 0xaf
jne 0x140154d00
lea rax, [0x1404fe5d0]
ret
xor eax, eax
lea rcx, [0x1404fe540]
lea rdx, [0x140425090]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140154d48
inc rax
jmp 0x140154d30
mov al, 0x1d
xchg byte [0x1404fe550], al
lea rax, [0x1404fe540]
ret
xor edx, edx
lea rax, [0x1404fe500]
lea rcx, [0x140425050]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x12
jl 0x140154d70
mov al, 0xb6
xchg byte [0x1404fe512], al
lea rax, [0x1404fe500]
ret
xor eax, eax
lea rcx, [0x1404fe630]
lea rdx, [0x140425160]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x15
jg 0x140154dd8
inc rax
jmp 0x140154db0
mov al, 0xb
xchg byte [0x1404fe646], al
lea rax, [0x1404fe630]
ret
xor eax, eax
lea rcx, [0x1404fe5d0]
lea rdx, [0x140425100]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x140154e18
inc rax
jmp 0x140154e00
mov al, 0xaf
xchg byte [0x1404fe5df], al
lea rax, [0x1404fe5d0]
ret
Function at 0x140161710
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0xf3bfb8dc
add eax, dword [0x1404ff818]
cmp ecx, eax
jne 0x1401617bb
test edx, edx
je 0x1401617f8
movzx eax, byte [0x1404ff5b9]
nop word [rax + rax]
cmp al, 0x9a
je 0x1401617b3
movzx ecx, byte [0x1404ff828]
mov eax, r8d
xor al, 0xc2
add al, cl
mov edx, r8d
xor dl, 0xfc
add dl, cl
lock cmpxchg byte [0x1404ff5b9], dl
jne 0x140161740
xor edx, edx
lea rax, [0x1404ff5b0]
lea rcx, [0x140425430]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
add edx, 0xd386914c
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x2c796eb4
cmp edx, 9
jl 0x140161780
mov al, 0x9a
xchg byte [0x1404ff5b9], al
lea rax, [0x1404ff5b0]
ret
test edx, edx
je 0x140161875
movzx eax, byte [0x1404ff632]
cmp al, 0x9a
je 0x1401617f0
mov cl, 0xa4
mov al, 0x1a
lock cmpxchg byte [0x1404ff632], cl
je 0x1401618a8
mov edx, r8d
xor dl, 0x49
add dl, byte [0x1404ff828]
cmp al, dl
jne 0x1401617d0
lea rax, [0x1404ff620]
ret
movzx eax, byte [0x1404ff3fc]
nop
cmp al, 0xb5
je 0x14016186d
movzx ecx, byte [0x1404ff828]
mov edx, r8d
not dl
and dl, 0x94
mov eax, r8d
xor al, 0x6b
or al, dl
not al
or al, dl
add al, cl
add cl, r8b
lock cmpxchg byte [0x1404ff3fc], cl
jne 0x140161800
xor edx, edx
lea rax, [0x1404ff3d0]
lea rcx, [0x140425260]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0x7ffffffe
and r8d, edx
xor edx, 1
lea edx, [rdx + r8*2]
cmp edx, 0x2c
jl 0x140161840
mov al, 0xb5
xchg byte [0x1404ff3fc], al
lea rax, [0x1404ff3d0]
ret
movzx eax, byte [0x1404ff5e5]
cmp al, 0xe0
je 0x1401618a0
mov cl, 0x23
nop word cs:[rax + rax]
mov al, 0xfd
lock cmpxchg byte [0x1404ff5e5], cl
je 0x1401618e8
cmp al, 0xe0
jne 0x140161890
lea rax, [0x1404ff5d0]
ret
xor eax, eax
lea rcx, [0x1404ff620]
lea rdx, [0x1404254a0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x1401618d8
inc rax
jmp 0x1401618c0
mov al, 0x9a
xchg byte [0x1404ff632], al
lea rax, [0x1404ff620]
ret
xor eax, eax
lea rcx, [0x1404ff5d0]
lea rdx, [0x140425450]
xor r8d, 0xf3bfb8dd
neg r8d
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rcx]
mov r10d, r9d
xor r10b, 0xd6
and r9b, 0x56
add r9b, r9b
add r9b, r10b
add r9b, byte [rax + rdx]
add r9b, 0x2a
mov byte [rax + rcx], r9b
xor r9d, r9d
sub r9d, dword [0x1404ff818]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
sub eax, r9d
cmp eax, 0x15
jl 0x140161910
mov al, pe_nt_image_headers64
xchg byte [0x1404ff5e5], al
lea rax, [0x1404ff5d0]
ret
Function at 0x140161b60
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x140161bac
mov eax, r8d
xor eax, 0xcbd56a66
add eax, dword [0x1404ff818]
cmp edx, eax
jne 0x140161bf8
movzx eax, byte [0x1404ff5fb]
cmp al, 0x70
je 0x140161ba4
mov cl, 0x21
nop dword [rax + rax]
mov al, 0x46
lock cmpxchg byte [0x1404ff5fb], cl
je 0x140161c7c
cmp al, 0x70
jne 0x140161b90
lea rax, [0x1404ff5f0]
ret
test edx, edx
je 0x140161c4a
movzx eax, byte [0x1404ff55e]
cmp al, 0xd0
je 0x140161bf0
mov cl, 0x32
nop word cs:[rax + rax]
mov al, 0xa5
lock cmpxchg byte [0x1404ff55e], cl
je 0x140161d08
mov edx, r8d
xor dl, 0x85
add dl, byte [0x1404ff828]
cmp al, dl
jne 0x140161bd0
lea rax, [0x1404ff550]
ret
movzx eax, byte [0x1404ff593]
cmp al, 0xfa
je 0x140161c42
mov cl, 0x75
nop word cs:[rax + rax]
mov al, 0x9e
lock cmpxchg byte [0x1404ff593], cl
je 0x140161ca8
movzx edx, byte [0x1404ff828]
mov r9d, r8d
xor r9b, 0x53
mov r10d, r9d
xor r10b, dl
and r9b, dl
add r9b, r9b
add r9b, r10b
cmp al, r9b
jne 0x140161c10
lea rax, [0x1404ff570]
ret
movzx eax, byte [0x1404ff5cd]
cmp al, 6
je 0x140161c74
mov cl, 0xf5
nop word [rax + rax]
mov al, 0x93
lock cmpxchg byte [0x1404ff5cd], cl
je 0x140161d48
cmp al, 6
jne 0x140161c60
lea rax, [0x1404ff5c0]
ret
xor eax, eax
lea rcx, [0x1404ff5f0]
lea rdx, [0x140425470]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x140161ce8
inc rax
jmp 0x140161c90
xor eax, eax
lea rcx, [0x1404ff570]
lea rdx, [0x1404253f0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x140161cf8
inc rax
jmp 0x140161cc0
mov al, 0x70
xchg byte [0x1404ff5fb], al
lea rax, [0x1404ff5f0]
ret
mov al, 0xfa
xchg byte [0x1404ff593], al
lea rax, [0x1404ff570]
ret
xor eax, eax
lea rcx, [0x1404ff550]
lea rdx, [0x1404253d0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x140161d38
inc rax
jmp 0x140161d20
mov al, 0xd0
xchg byte [0x1404ff55e], al
lea rax, [0x1404ff550]
ret
xor edx, edx
lea rax, [0x1404ff5c0]
lea rcx, [0x140425440]
xor r8d, 0xcbd56a13
nop
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
mov r9d, dword [0x1404ff818]
add r9d, r8d
cmp edx, r9d
jl 0x140161d60
mov al, 6
xchg byte [0x1404ff5cd], al
lea rax, [0x1404ff5c0]
ret
Function at 0x140169160
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401691a5
test edx, edx
je 0x1401691dc
movzx eax, byte [0x1405003d5]
cmp al, 0x5d
je 0x14016919d
mov cl, 0x2f
nop word cs:[rax + rax]
mov al, 0x6d
lock cmpxchg byte [0x1405003d5], cl
je 0x140169245
movzx edx, byte [0x14050117c]
dec dl
cmp al, dl
jne 0x140169180
lea rax, [0x1405003c0]
ret
test edx, edx
je 0x14016920c
movzx eax, byte [0x140500543]
cmp al, 0xe0
je 0x1401691d4
mov cl, 0x9f
nop word cs:[rax + rax]
mov al, 0xb1
lock cmpxchg byte [0x140500543], cl
je 0x1401692a2
cmp al, 0xe0
jne 0x1401691c0
lea rax, [0x140500540]
ret
movzx eax, byte [0x14055f3d8]
cmp al, 0x13
je 0x140169204
mov cl, 0x69
nop dword [rax]
xor eax, eax
lock cmpxchg byte [0x14055f3d8], cl
je 0x1401692dc
cmp al, 0x13
jne 0x1401691f0
lea rax, [0x140500300]
ret
movzx eax, byte [0x1405004c5]
cmp al, 0x5d
je 0x14016923d
mov cl, 0xe5
nop dword [rax]
mov al, 0xcb
lock cmpxchg byte [0x1405004c5], cl
je 0x14016937a
movzx edx, byte [0x14050117c]
dec dl
cmp al, dl
jne 0x140169220
lea rax, [0x1405004b0]
ret
xor edx, edx
lea rax, [0x1405003c0]
lea rcx, [0x140425740]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0xe1aac3d0
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x1e553c30
cmp edx, 0x15
jl 0x140169260
movzx eax, byte [0x14050117c]
dec al
xchg byte [0x1405003d5], al
lea rax, [0x1405003c0]
ret
xor eax, eax
lea rcx, [0x140500540]
lea rdx, [0x1404258a0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x14016936a
inc rax
jmp 0x1401692c0
xor edx, edx
lea rax, [0x140500300]
lea rcx, [0x140425680]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
add r8b, 0xdf
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
add r8b, 0x21
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0xbf02c526
and edx, 0x3f02c526
lea edx, [r8 + rdx*2]
add edx, 0x40fd3adb
mov r8d, dword [0x140501178]
mov r9d, r8d
xor r9d, 0x3c0d3006
and r8d, 0x3c0d3006
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x1401692f0
movzx eax, byte [0x14050117c]
add al, 0xb5
xchg byte [0x14055f3d8], al
lea rax, [0x140500300]
ret
mov al, pe_nt_image_headers64
xchg byte [0x140500543], al
lea rax, [0x140500540]
ret
xor eax, eax
lea rcx, [0x1405004b0]
lea rdx, [0x140425820]
nop word [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r9b
mov r10d, r9d
or r10b, r8b
not r10b
and r9b, r8b
or r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1401693bf
inc rax
jmp 0x140169390
mov al, 0x5d
xchg byte [0x1405004c5], al
lea rax, [0x1405004b0]
ret
Function at 0x14016f020
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14016f05c
mov ecx, dword [rsp + 0x28]
test edx, edx
je 0x14016f08c
movzx eax, byte [0x14050160e]
cmp al, 0xb7
je 0x14016f054
mov dl, 0x82
nop dword [rax]
mov al, 0xf5
lock cmpxchg byte [0x14050160e], dl
je 0x14016f0ec
cmp al, 0xb7
jne 0x14016f040
lea rax, [0x140501600]
ret
test edx, edx
je 0x14016f0bc
movzx eax, byte [0x14050158d]
cmp al, 0x79
je 0x14016f084
mov cl, 0x3c
nop dword [rax]
mov al, 0x55
lock cmpxchg byte [0x14050158d], cl
je 0x14016f15b
cmp al, 0x79
jne 0x14016f070
lea rax, [0x140501580]
ret
movzx eax, byte [0x140501702]
cmp al, 0x2d
je 0x14016f0b4
mov dl, 0xd8
nop dword [rax]
mov al, 0x56
lock cmpxchg byte [0x140501702], dl
je 0x14016f188
cmp al, 0x2d
jne 0x14016f0a0
lea rax, [0x1405016f0]
ret
movzx eax, byte [0x14050150d]
cmp al, 0x41
je 0x14016f0e4
mov cl, 0x45
nop dword [rax]
mov al, 0x84
lock cmpxchg byte [0x14050150d], cl
je 0x14016f1ff
cmp al, 0x41
jne 0x14016f0d0
lea rax, [0x140501500]
ret
xor eax, eax
lea rdx, [0x140501600]
lea r8, [0x140425d50]
xor ecx, 0x59246775
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
movzx r10d, byte [rax + r8]
not r9b
mov r11d, r9d
and r11b, r10b
not r10b
xor r9b, r10b
and r9b, r10b
or r9b, r11b
mov byte [rax + rdx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405019e8]
add r10d, ecx
cmp r9d, r10d
jge 0x14016f14b
inc rax
jmp 0x14016f110
mov al, 0xb7
xchg byte [0x14050160e], al
lea rax, [0x140501600]
ret
xor eax, eax
lea rcx, [0x140501580]
lea rdx, [0x140425cd0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14016f1ef
inc rax
jmp 0x14016f170
xor r8d, r8d
lea rax, [0x1405016f0]
lea rdx, [0x140425e40]
xor ecx, 0x59246766
nop
movsxd r8, r8d
movzx r9d, byte [r8 + rdx]
xor byte [r8 + rax], r9b
mov r9d, dword [0x1405019e8]
mov r10d, ecx
xor r10d, r9d
and r9d, ecx
lea r9d, [r10 + r9*2]
mov r10d, r8d
xor r10d, r9d
not r8d
not r9d
and r9d, r8d
or r9d, r10d
not r9d
lea r8d, [r10 + r9*2]
cmp r8d, 0x12
jl 0x14016f1a0
mov al, 0x2d
xchg byte [0x140501702], al
lea rax, [0x1405016f0]
ret
mov al, 0x79
xchg byte [0x14050158d], al
lea rax, [0x140501580]
ret
xor eax, eax
lea rcx, [0x140501500]
lea rdx, [0x140425c50]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14016f228
inc rax
jmp 0x14016f210
mov al, 0x41
xchg byte [0x14050150d], al
lea rax, [0x140501500]
ret
Function at 0x14016f260
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14016f2fc
mov eax, r8d
xor eax, 0x7f11aaa
add eax, dword [0x1405019e8]
cmp edx, eax
jne 0x14016f33c
movzx eax, byte [0x14050169d]
nop word [rax + rax]
cmp al, 0x3e
je 0x14016f410
movzx ecx, byte [0x1405019ec]
mov eax, r8d
xor al, 0x67
add al, cl
mov edx, r8d
xor dl, 0x49
add dl, cl
lock cmpxchg byte [0x14050169d], dl
jne 0x14016f290
xor eax, eax
lea rcx, [0x140501690]
lea rdx, [0x140425de0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14016f408
inc rax
jmp 0x14016f2d0
test edx, edx
je 0x14016f3c8
movzx eax, byte [0x140501731]
cmp al, 0x1c
je 0x14016f334
mov cl, 0x73
nop word cs:[rax + rax]
mov al, 0xbf
lock cmpxchg byte [0x140501731], cl
je 0x14016f428
cmp al, 0x1c
jne 0x14016f320
lea rax, [0x140501720]
ret
movzx eax, byte [0x140501471]
nop word cs:[rax + rax]
cmp al, 0xa4
je 0x14016f420
movzx ecx, byte [0x1405019ec]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0x85
mov eax, r8d
and al, 0x7a
or al, r9b
mov r9d, ecx
xor r9b, cl
not r9b
and r9b, al
xor r9b, cl
and al, cl
add al, al
add al, r9b
add dl, cl
lock cmpxchg byte [0x140501471], dl
jne 0x14016f350
xor eax, eax
lea rcx, [0x140501460]
lea rdx, [0x140425bb0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x14016f418
inc rax
jmp 0x14016f3b0
movzx eax, byte [0x14050152d]
cmp al, 0x38
je 0x14016f400
mov cl, 0xd2
nop word cs:[rax + rax]
mov al, 0x42
lock cmpxchg byte [0x14050152d], cl
je 0x14016f47f
mov edx, r8d
xor dl, 0xa5
add dl, byte [0x1405019ec]
cmp al, dl
jne 0x14016f3e0
lea rax, [0x140501520]
ret
mov al, 0x3e
xchg byte [0x14050169d], al
lea rax, [0x140501690]
ret
mov al, 0xa4
xchg byte [0x140501471], al
lea rax, [0x140501460]
ret
xor edx, edx
lea rax, [0x140501720]
lea rcx, [0x140425e70]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x11
jl 0x14016f440
mov al, 0x1c
xchg byte [0x140501731], al
lea rax, [0x140501720]
ret
xor eax, eax
lea rcx, [0x140501520]
lea rdx, [0x140425c70]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14016f4a8
inc rax
jmp 0x14016f490
mov al, 0x38
xchg byte [0x14050152d], al
lea rax, [0x140501520]
ret
Function at 0x14016f4c0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14016f518
mov eax, r8d
xor eax, 0xad0d3cda
add eax, dword [0x1405019e8]
cmp edx, eax
jne 0x14016f570
movzx eax, byte [0x140501653]
cmp al, 0x13
je 0x14016f510
mov cl, 0x87
nop dword [rax]
mov al, 0xef
lock cmpxchg byte [0x140501653], cl
je 0x14016f612
mov edx, r8d
xor dl, 0xf0
add dl, byte [0x1405019ec]
cmp al, dl
jne 0x14016f4f0
lea rax, [0x140501640]
ret
test edx, edx
je 0x14016f598
movzx eax, byte [0x140501425]
mov ecx, r8d
xor cl, 0xd3
add cl, byte [0x1405019ec]
cmp al, cl
je 0x14016f568
nop word cs:[rax + rax]
movzx ecx, byte [0x1405019ec]
mov eax, r8d
xor al, 0xf7
add al, cl
mov edx, r8d
xor dl, 0x8b
add dl, cl
lock cmpxchg byte [0x140501425], dl
je 0x14016f66f
cmp al, 0x36
jne 0x14016f540
lea rax, [0x140501410]
ret
cmp byte [0x1405015af], 0
je 0x14016f590
mov cl, 0x99
nop dword [rax + rax]
mov al, 0xde
lock cmpxchg byte [0x1405015af], cl
je 0x14016f5cc
test al, al
jne 0x14016f580
lea rax, [0x140501590]
ret
movzx eax, byte [0x14050171d]
cmp al, 0x48
je 0x14016f5c4
mov cl, 0x2c
nop word cs:[rax + rax]
mov al, 0xa3
lock cmpxchg byte [0x14050171d], cl
je 0x14016f6bd
cmp al, 0x48
jne 0x14016f5b0
lea rax, [0x140501710]
ret
xor eax, eax
lea rcx, [0x140501590]
lea rdx, [0x140425ce0]
nop dword [rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0x1e
jg 0x14016f5f8
inc rax
jmp 0x14016f5e0
xor r8b, 0x8d
add r8b, byte [0x1405019ec]
xchg byte [0x1405015af], r8b
lea rax, [0x140501590]
ret
xor edx, edx
lea rax, [0x140501640]
lea rcx, [0x140425d90]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x13
jl 0x14016f630
mov al, 0x13
xchg byte [0x140501653], al
lea rax, [0x140501640]
ret
xor eax, eax
lea rcx, [0x140501410]
lea rdx, [0x140425b60]
xor r8d, 0xad0d3cdb
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x1405019e8]
add r9d, r8d
add eax, r9d
cmp eax, 0x15
jl 0x14016f690
mov al, 0x36
xchg byte [0x140501425], al
lea rax, [0x140501410]
ret
xor eax, eax
lea rcx, [0x140501710]
lea rdx, [0x140425e60]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14016f6f8
inc rax
jmp 0x14016f6d0
mov al, 0x48
xchg byte [0x14050171d], al
lea rax, [0x140501710]
ret
Function at 0x140170020
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14017006c
mov eax, r8d
xor eax, 0xdd566a7a
add eax, dword [0x1405019e8]
cmp edx, eax
jne 0x14017009c
movzx eax, byte [0x1405015fd]
cmp al, 5
je 0x140170064
mov cl, 0xd1
nop dword [rax + rax]
mov al, 0x57
lock cmpxchg byte [0x1405015fd], cl
je 0x14017010c
cmp al, 5
jne 0x140170050
lea rax, [0x1405015f0]
ret
test edx, edx
je 0x1401700cc
movzx eax, byte [0x140501541]
cmp al, 0xaa
je 0x140170094
mov cl, 0xbc
nop dword [rax]
mov al, 0x38
lock cmpxchg byte [0x140501541], cl
je 0x1401701af
cmp al, 0xaa
jne 0x140170080
lea rax, [0x140501530]
ret
movzx eax, byte [0x1405014fd]
cmp al, 0xe4
je 0x1401700c4
mov cl, 0x7d
nop dword [rax]
mov al, 0x71
lock cmpxchg byte [0x1405014fd], cl
je 0x14017016d
cmp al, 0xe4
jne 0x1401700b0
lea rax, [0x1405014f0]
ret
movzx eax, byte [0x14050161d]
mov ecx, r8d
xor cl, 0xaf
add cl, byte [0x1405019ec]
cmp al, cl
je 0x140170104
mov cl, 0x8b
nop word cs:[rax + rax]
mov al, 0xa7
lock cmpxchg byte [0x14050161d], cl
je 0x14017020a
cmp al, 0x82
jne 0x1401700f0
lea rax, [0x140501610]
ret
xor eax, eax
lea rcx, [0x1405015f0]
lea rdx, [0x140425d40]
xor r8d, 0xdd566a7b
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
mov r9d, dword [0x1405019e8]
add r9d, r8d
add eax, r9d
cmp eax, 0xd
jl 0x140170130
mov al, 5
xchg byte [0x1405015fd], al
lea rax, [0x1405015f0]
ret
xor edx, edx
lea rax, [0x1405014f0]
lea rcx, [0x140425c40]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x140170180
mov al, 0xe4
xchg byte [0x1405014fd], al
lea rax, [0x1405014f0]
ret
xor edx, edx
lea rax, [0x140501530]
lea rcx, [0x140425c80]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
add edx, edx
and edx, 2
mov r9d, r8d
xor r9d, edx
and edx, r8d
lea edx, [r9 + rdx*2]
cmp edx, 0x11
jl 0x1401701c0
mov al, 0xaa
xchg byte [0x140501541], al
lea rax, [0x140501530]
ret
xor eax, eax
lea rcx, [0x140501610]
lea rdx, [0x140425d60]
xor r8d, 0xdd566a77
nop word cs:[rax + rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405019e8]
add r10d, r8d
cmp r9d, r10d
jge 0x140170265
inc rax
jmp 0x140170230
mov al, 0x82
xchg byte [0x14050161d], al
lea rax, [0x140501610]
ret