joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140264510
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14026455c
mov eax, r8d
xor eax, 0xbc041b1d
add eax, dword [0x1404fb588]
cmp edx, eax
jne 0x14026459c
movzx eax, byte [0x1404fb2d3]
cmp al, 0x71
je 0x140264554
mov cl, 0x56
nop dword [rax + rax]
mov al, 0x90
lock cmpxchg byte [0x1404fb2d3], cl
je 0x14026465c
cmp al, 0x71
jne 0x140264540
lea rax, [0x1404fb2b0]
ret
test edx, edx
je 0x1402645f0
movzx eax, byte [0x1404fb279]
cmp al, 5
je 0x140264594
mov cl, 0x14
nop word cs:[rax + rax]
mov al, 0xe9
lock cmpxchg byte [0x1404fb279], cl
je 0x140264707
cmp al, 5
jne 0x140264580
lea rax, [0x1404fb260]
ret
movzx eax, byte [0x1404fb251]
mov ecx, r8d
xor cl, 0xc
add cl, byte [0x1404fb58c]
cmp al, cl
je 0x1402645e8
nop word cs:[rax + rax]
movzx ecx, byte [0x1404fb58c]
mov eax, r8d
xor al, 0x8d
add al, cl
mov edx, r8d
xor dl, 0x32
add dl, cl
lock cmpxchg byte [0x1404fb251], dl
je 0x1402646a1
cmp al, 0x52
jne 0x1402645c0
lea rax, [0x1404fb240]
ret
movzx eax, byte [0x1404fb232]
nop word [rax + rax]
cmp al, 0xa0
je 0x140264750
movzx ecx, byte [0x1404fb58c]
mov eax, r8d
xor al, 0xdf
mov edx, eax
xor dl, cl
and al, cl
add al, al
add al, dl
mov edx, r8d
xor dl, 0xba
add dl, cl
lock cmpxchg byte [0x1404fb232], dl
jne 0x140264600
xor eax, eax
lea rcx, [0x1404fb220]
lea rdx, [0x14040d050]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x140264748
inc rax
jmp 0x140264640
xor eax, eax
lea rcx, [0x1404fb2b0]
lea rdx, [0x14040d0d0]
mov r9d, r8d
xor r9d, 0xbc041b30
nop word cs:[rax + rax]
movzx r10d, byte [rax + rdx]
add byte [rax + rcx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x1404fb588]
add r11d, r9d
cmp r10d, r11d
jge 0x1402646ed
inc rax
jmp 0x140264680
xor eax, eax
lea rcx, [0x1404fb240]
lea rdx, [0x14040d070]
xor r8d, 0xbc041b12
nop dword [rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x1404fb588]
add r9d, r8d
add eax, r9d
cmp eax, 0x11
jl 0x1402646c0
mov al, 0x52
xchg byte [0x1404fb251], al
lea rax, [0x1404fb240]
ret
xor r8b, 0x2f
add r8b, byte [0x1404fb58c]
xchg byte [0x1404fb2d3], r8b
lea rax, [0x1404fb2b0]
ret
xor eax, eax
lea rcx, [0x1404fb260]
lea rdx, [0x14040d090]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x18
jg 0x140264738
inc rax
jmp 0x140264720
mov al, 5
xchg byte [0x1404fb279], al
lea rax, [0x1404fb260]
ret
mov al, 0xa0
xchg byte [0x1404fb232], al
lea rax, [0x1404fb220]
ret
Function at 0x1402aa190
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1402aa1cc
test edx, edx
je 0x1402aa21c
movzx eax, byte [0x1405055fe]
cmp al, 0x6c
je 0x1402aa1c4
mov cl, 0x61
nop word [rax + rax]
mov al, 0xcb
lock cmpxchg byte [0x1405055fe], cl
je 0x1402aa2ec
cmp al, 0x6c
jne 0x1402aa1b0
lea rax, [0x1405055e0]
ret
test edx, edx
je 0x1402aa2bb
mov eax, r8d
xor al, 0x77
xor ecx, ecx
sub cl, byte [0x140505984]
neg al
mov edx, eax
xor dl, cl
and cl, al
add cl, cl
add cl, dl
add cl, byte [0x140505743]
je 0x1402aa214
mov cl, 0x75
nop word [rax + rax]
mov al, 0xed
lock cmpxchg byte [0x140505743], cl
je 0x1402aa345
cmp al, 0xb5
jne 0x1402aa200
lea rax, [0x140505720]
ret
movzx eax, byte [0x140505713]
nop word cs:[rax + rax]
cmp al, 0xd8
je 0x1402aa2b3
movzx ecx, byte [0x140505984]
mov eax, r8d
xor al, 0x78
add al, cl
mov edx, r8d
xor dl, 0x83
add dl, cl
lock cmpxchg byte [0x140505713], dl
jne 0x1402aa230
xor edx, edx
lea rax, [0x140505710]
lea rcx, [0x140413fa0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
add edx, 0x6baaa103
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x94555efd
cmp edx, 3
jl 0x1402aa270
mov al, 0xd8
xchg byte [0x140505713], al
lea rax, [0x140505710]
ret
movzx eax, byte [0x140505769]
cmp al, 0x74
je 0x1402aa2e4
mov cl, 0x9e
nop dword [rax + rax]
mov al, 0xd6
lock cmpxchg byte [0x140505769], cl
je 0x1402aa394
cmp al, 0x74
jne 0x1402aa2d0
lea rax, [0x140505760]
ret
xor eax, eax
lea rcx, [0x1405055e0]
lea rdx, [0x140413e80]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
mov r11d, r9d
xor r11b, r10b
and r10b, r9b
not r11b
and r11b, r8b
or r11b, r10b
mov byte [rax + rcx], r11b
lea r8d, [rax + 1]
cmp r8d, 0x1d
jg 0x1402aa335
inc rax
jmp 0x1402aa300
mov al, 0x6c
xchg byte [0x1405055fe], al
lea rax, [0x1405055e0]
ret
xor edx, edx
lea rax, [0x140505720]
lea rcx, [0x140413fb0]
nop word cs:[rax + rax]
movsxd r9, edx
movzx edx, byte [r9 + rcx]
xor byte [r9 + rax], dl
lea edx, [r9 + r9]
sub edx, r9d
inc edx
cmp edx, 0x23
jl 0x1402aa360
xor r8b, 0x77
add r8b, byte [0x140505984]
xchg byte [0x140505743], r8b
lea rax, [0x140505720]
ret
xor eax, eax
lea rcx, [0x140505760]
lea rdx, [0x140413ff0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1402aa3c8
inc rax
jmp 0x1402aa3b0
mov al, 0x74
xchg byte [0x140505769], al
lea rax, [0x140505760]
ret
Function at 0x1402fb010
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1402fb090
test edx, edx
je 0x1402fb0d6
movzx eax, byte [0x14050eb46]
nop word cs:[rax + rax]
cmp al, 0x13
je 0x1402fb144
movzx ecx, byte [0x14050f784]
lea eax, [rcx + 0x76]
add cl, 0x26
lock cmpxchg byte [0x14050eb46], cl
jne 0x1402fb030
xor eax, eax
lea rcx, [0x14050eb40]
lea rdx, [0x140421bb0]
nop
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x1402fb13c
inc rax
jmp 0x1402fb060
test edx, edx
je 0x1402fb10c
movzx eax, byte [0x14050ebb9]
cmp al, 0xfd
je 0x1402fb0ce
mov cl, 0x89
nop word cs:[rax + rax]
mov al, 0xfb
lock cmpxchg byte [0x14050ebb9], cl
je 0x1402fb14c
movzx edx, byte [0x14050f784]
add dl, 0xc1
cmp al, dl
jne 0x1402fb0b0
lea rax, [0x14050ebb0]
ret
movzx eax, byte [0x14050e932]
cmp al, 0xa0
je 0x1402fb104
mov cl, 0x3f
nop word cs:[rax + rax]
mov al, 0xcd
lock cmpxchg byte [0x14050e932], cl
je 0x1402fb188
cmp al, 0xa0
jne 0x1402fb0f0
lea rax, [0x14050e930]
ret
movzx eax, byte [0x14050e9b0]
cmp al, 0x7c
je 0x1402fb134
mov cl, 0xbd
nop dword [rax]
mov al, 0x42
lock cmpxchg byte [0x14050e9b0], cl
je 0x1402fb1df
cmp al, 0x7c
jne 0x1402fb120
lea rax, [0x14050e9a0]
ret
mov al, 0x13
xchg byte [0x14050eb46], al
lea rax, [0x14050eb40]
ret
xor eax, eax
lea rcx, [0x14050ebb0]
lea rdx, [0x140421c20]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1402fb1cf
inc rax
jmp 0x1402fb160
xor edx, edx
lea rax, [0x14050e930]
lea rcx, [0x1404219d0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 2
jl 0x1402fb1a0
mov al, 0xa0
xchg byte [0x14050e932], al
lea rax, [0x14050e930]
ret
mov al, 0xfd
xchg byte [0x14050ebb9], al
lea rax, [0x14050ebb0]
ret
xor eax, eax
lea rcx, [0x14050e9a0]
lea rdx, [0x140421a40]
mov r8d, 0xccab9fe1
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x14050f770]
add r10d, r8d
cmp r9d, r10d
jge 0x1402fb231
inc rax
jmp 0x1402fb200
movzx eax, byte [0x14050f784]
add al, 0x40
xchg byte [0x14050e9b0], al
lea rax, [0x14050e9a0]
ret
Function at 0x1403162c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov esi, r9d
mov eax, 0xc16db27c
add eax, dword [0x140513f58]
cmp ecx, eax
jne 0x140316319
test edx, edx
je 0x140316405
movzx eax, byte [0x140513b65]
cmp al, 0x52
je 0x140316497
mov cl, 0xf4
nop dword [rax + rax]
mov al, 0x1a
lock cmpxchg byte [0x140513b65], cl
je 0x140316449
cmp al, 0x52
jne 0x140316300
jmp 0x140316497
mov eax, esi
xor eax, 0x915d0c52
mov ecx, edx
mov edx, eax
mov r8d, 0x61771000
call fcn.1400a8350
test al, 1
je 0x14031637c
movzx eax, byte [0x140513b2d]
cmp al, 0x78
je 0x1403164f4
mov bl, 8
xor esi, 0x173fff36
mov edi, 0xbce5fe18
nop
mov al, 0xb4
lock cmpxchg byte [0x140513b2d], bl
je 0x1403164a3
mov r8d, dword [0x140513f58]
add r8d, edi
mov ecx, eax
mov edx, esi
call fcn.140317000
test al, 1
je 0x140316350
jmp 0x1403164f4
movzx eax, byte [0x140513c3b]
nop word cs:[rax + rax]
cmp al, 0x20
je 0x1403164e0
movzx ecx, byte [0x140513f5c]
lea eax, [rcx - 0x42]
add cl, 0x72
lock cmpxchg byte [0x140513c3b], cl
jne 0x140316390
xor eax, eax
lea rcx, [0x140513c30]
lea rdx, [0x140422780]
mov r8d, 0xc16db287
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x140513f58]
add r10d, r8d
cmp r9d, r10d
jge 0x1403164d8
inc rax
jmp 0x1403163d0
movzx ecx, byte [0x140513b40]
mov edx, esi
xor edx, 0x26c415f
mov r8d, 0x33f62a7d
call fcn.140317070
test al, 1
jne 0x140316580
mov cl, 0xcc
nop dword [rax]
mov al, 0x79
lock cmpxchg byte [0x140513b40], cl
je 0x140316500
cmp al, 0x87
jne 0x140316430
jmp 0x140316580
xor eax, eax
lea rcx, [0x140513b50]
lea rdx, [0x1404226a0]
nop dword [rax]
cdqe
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
mov r8d, dword [0x140513f58]
mov r9d, r8d
xor r9d, 0xc16db27d
and r8d, 0x416db27d
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0x15
jl 0x140316460
mov al, 0x52
xchg byte [0x140513b65], al
lea rax, [0x140513b50]
jmp 0x140316587
xor eax, eax
lea rcx, [0x140513b20]
lea rdx, [0x140422680]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1403164ec
inc rax
jmp 0x1403164c0
mov al, 0x20
xchg byte [0x140513c3b], al
lea rax, [0x140513c30]
jmp 0x140316587
mov al, 0x78
xchg byte [0x140513b2d], al
lea rax, [0x140513b20]
jmp 0x140316587
xor eax, eax
lea r14, [0x140513b30]
lea r15, [0x140422690]
mov ecx, esi
not ecx
and ecx, 0x5e441bb8
xor esi, 0xa1bbe447
or esi, ecx
not esi
or esi, ecx
lea r12, [rsp + 0x40]
lea rdi, [rsp + 0x3f]
movsxd rbx, eax
movzx edx, byte [rbx + r14]
lea rcx, [r15 + rbx]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x30], 0x5687ec83
mov r8d, ebx
mov r9, rdi
call fcn.140316700
movzx eax, byte [rsp + 0x3f]
mov rcx, qword [rsp + 0x40]
mov byte [rcx + r14], al
mov eax, dword [0x140513f58]
add eax, ebx
add eax, 0xc16db27d
cmp eax, 0x10
jl 0x140316530
mov al, 0x87
xchg byte [0x140513b40], al
lea rax, [0x140513b30]
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14031d610
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rax, qword [0x140514918]
mov rcx, rax
not rcx
movabs r8, 0xec982d464f2ba7db
and r8, rax
movabs r9, 0x1367d2b9b0d45824
movabs r10, 0x6c982d464f2ba7db
and r10, rcx
and rcx, r9
or rcx, r8
xor rax, r9
or r10, rax
not r10
lea rax, [rcx + r10*2]
cmp rdx, rax
ja 0x14031d8a1
dec rdx
mov rax, qword [0x140514918]
mov rcx, rax
not rcx
movabs r8, 0xf4982d464f2ba7da
and r8, rax
movabs r9, 0xb67d2b9b0d45825
movabs r10, 0x74982d464f2ba7da
and r10, rcx
and rcx, r9
or rcx, r8
xor rax, r9
or r10, rax
not r10
lea rax, [rcx + r10*2]
or rax, rdx
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov ebx, 1
shl rbx, cl
lea rax, [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, rdi
call fcn.14031ae00
mov rax, qword [0x140514918]
add rax, rbx
movabs rcx, 0xb67d2b9b0d45823
add rcx, rax
mov qword [rsi + 0x30], rcx
mov qword [rsi + 0x38], rbx
mov rax, qword [rsi + 8]
mov r9, qword [rax]
cmp r9, rdi
je 0x14031d892
movabs rax, 0xcbf29ce484222325
movabs rcx, 0x100000001b3
movabs rdx, 0xb67d3b9b0d459d7
jmp 0x14031d751
mov qword [r10 + r11*8], r8
mov qword [r10 + r14*8], r8
cmp r9, rdi
je 0x14031d892
mov r8, r9
movzx r9d, byte [r9 + 0x10]
xor r9, rax
imul r9, rcx
movzx r10d, byte [r8 + 0x11]
mov r11, r9
not r11
not r10
mov rbx, r11
xor rbx, r10
and rbx, r11
and r10, r9
or r10, rbx
mov r9, qword [0x140514918]
add r9, rdx
imul r10, r9
movzx r11d, byte [r8 + 0x12]
mov rbx, r11
not rbx
and rbx, r10
not r10d
and r10d, r11d
or rbx, r10
imul rbx, r9
movzx r9d, byte [r8 + 0x13]
mov r15, r9
not r15
and r15, rbx
not ebx
and ebx, r9d
or r15, rbx
imul r15, rcx
and r15, qword [rsi + 0x30]
mov r9, qword [r8]
mov r10, qword [rsi + 0x18]
lea r11, [r15 + r15]
lea r14, [r15 + r15]
inc r14
shl r15, 4
mov r15, qword [r10 + r15]
cmp r15, rdi
je 0x14031d740
mov rbx, qword [r10 + r14*8]
mov ebp, dword [r8 + 0x10]
cmp ebp, dword [rbx + 0x10]
jne 0x14031d830
mov r11, qword [rbx]
cmp r11, r8
je 0x14031d744
mov rbx, qword [r8 + 8]
mov qword [rbx], r9
mov r15, qword [r9 + 8]
mov qword [r15], r11
mov r12, qword [r11 + 8]
mov qword [r12], r8
mov qword [r11 + 8], r15
mov qword [r9 + 8], rbx
mov qword [r8 + 8], r12
jmp 0x14031d744
cmp r15, rbx
je 0x14031d867
mov rbx, qword [rbx + 8]
cmp ebp, dword [rbx + 0x10]
jne 0x14031d830
mov r10, qword [rbx]
mov r11, qword [r8 + 8]
mov qword [r11], r9
mov rbx, qword [r9 + 8]
mov qword [rbx], r10
mov r14, qword [r10 + 8]
mov qword [r14], r8
mov qword [r10 + 8], rbx
mov qword [r9 + 8], r11
mov qword [r8 + 8], r14
jmp 0x14031d748
mov r14, qword [r8 + 8]
mov qword [r14], r9
mov r15, qword [r9 + 8]
mov qword [r15], rbx
mov r12, qword [rbx + 8]
mov qword [r12], r8
mov qword [rbx + 8], r15
mov qword [r9 + 8], r14
mov qword [r8 + 8], r12
mov qword [r10 + r11*8], r8
jmp 0x14031d748
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor ecx, ecx
xor edx, edx
mov r8d, 0x73774f46
call fcn.14031eb70
mov rcx, rax
call fcn.1403bd734
int3
Function at 0x14032b6d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov esi, r9d
test ecx, ecx
je 0x14032b729
test edx, edx
je 0x14032b778
movzx eax, byte [0x1405154da]
movzx ecx, byte [0x140515d98]
add cl, 0x36
cmp al, cl
je 0x14032b875
mov cl, 0xb0
nop word cs:[rax + rax]
mov al, 0xb6
lock cmpxchg byte [0x1405154da], cl
je 0x14032b804
cmp al, 0xa1
jne 0x14032b710
jmp 0x14032b875
test edx, edx
je 0x14032b7a9
mov ecx, esi
xor ecx, 0x9c392c7c
mov edx, 0x77ba78b
call fcn.14032bd70
test al, 1
jne 0x14032b8c7
mov bl, 0x22
xor esi, 0xbbb699b9
nop
mov al, 0x13
lock cmpxchg byte [0x14051546c], bl
je 0x14032b881
mov ecx, eax
mov edx, esi
mov r8d, 0xe2300355
call fcn.14032bd90
test al, 1
je 0x14032b750
jmp 0x14032b8c7
movzx eax, byte [0x14051558f]
cmp al, 0x2c
je 0x14032b931
mov cl, 0x71
nop dword [rax]
mov al, 0x2d
lock cmpxchg byte [0x14051558f], cl
je 0x14032b8d3
cmp al, 0x2c
jne 0x14032b790
jmp 0x14032b931
mov edx, esi
xor edx, 0xc0d9ccf7
mov r8d, 0xb0a9ef6b
add r8d, dword [0x140515d88]
lea rcx, [rsp + 0x32]
call fcn.14032bd50
cmp byte [rsp + 0x32], 5
je 0x14032b99b
nop word cs:[rax + rax]
movzx ecx, byte [0x140515d98]
lea eax, [rcx + 0x55]
add cl, 0xdf
lock cmpxchg byte [0x140515432], cl
je 0x14032b93a
cmp al, 5
jne 0x14032b7e0
jmp 0x14032b99b
xor eax, eax
lea rbx, [0x1405154c0]
lea r14, [0x140422f80]
mov ebp, esi
xor ebp, 0xab23873d
lea rdi, [rsp + 0x34]
nop word cs:[rax + rax]
movsxd rcx, eax
movzx eax, byte [rcx + r14]
mov edx, eax
xor dl, al
not dl
and dl, byte [rcx + rbx]
xor dl, al
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x28], 0x1c2851d1
mov r8d, ecx
mov r9, rdi
call fcn.14032be10
mov eax, dword [rsp + 0x34]
cmp eax, 0x1a
jl 0x14032b830
xor esi, 0xb72aede2
mov ecx, esi
mov edx, 0x598e7968
call fcn.14032bd40
lea rax, [0x1405154c0]
jmp 0x14032b9a2
xor edx, edx
lea rax, [0x140515460]
lea rcx, [0x140422f30]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xc
jl 0x14032b8a0
mov al, 0x94
xchg byte [0x14051546c], al
lea rax, [0x140515460]
jmp 0x14032b9a2
xor eax, eax
lea rcx, [0x140515580]
lea rdx, [0x140423040]
nop word cs:[rax + rax]
cdqe
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
mov r8d, dword [0x140515d88]
mov r9d, r8d
xor r9d, 0xb0bc69cf
mov r10d, r8d
and r10d, 0x30bc69cf
lea r9d, [r9 + r10*2]
add eax, r9d
add r8d, 0xb0bc69dd
cmp eax, r8d
jl 0x14032b8f0
mov al, 0x2c
xchg byte [0x14051558f], al
lea rax, [0x140515580]
jmp 0x14032b9a2
xor ebx, ebx
lea r14, [0x140515420]
lea r15, [0x140422ef0]
xor esi, 0x68cbfaf1
lea rdi, [rsp + 0x33]
nop word cs:[rax + rax]
movzx ecx, byte [rbx + r14]
movzx edx, byte [rbx + r15]
mov dword [rsp + 0x20], 0xfb5120af
mov r8, rdi
mov r9d, esi
call fcn.1401327a0
movzx eax, byte [rsp + 0x33]
mov byte [rbx + r14], al
lea eax, [rbx + 1]
cmp eax, 0x11
jg 0x14032b993
inc rbx
jmp 0x14032b960
mov al, 5
xchg byte [0x140515432], al
lea rax, [0x140515420]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14032ec20
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x18], rdx
call fcn.14033ffb0
cmp byte [0x1405317c9], 0
jne 0x14032ec5c
test byte [0x140531cb0], 1
jne 0x14032ec5c
test rax, rax
je 0x14032ec5c
add rsp, 0x40
pop rbp
ret
mov ecx, 0x7f
call fcn.140170b10
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
mov r8d, 0xd8e60750
add rsp, 0x40
pop rbp
jmp fcn.14032ed90

Function at 0x14032ecb0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov r8d, 0xd8e60750
jmp fcn.14032ed90
Function at 0x1403419e0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140341a1c
test edx, edx
je 0x140341a4c
movzx eax, byte [0x140518760]
cmp al, 0xc1
je 0x140341a14
mov cl, 0xf8
nop word cs:[rax + rax]
mov al, 0xa0
lock cmpxchg byte [0x140518760], cl
je 0x140341abc
cmp al, 0xc1
jne 0x140341a00
lea rax, [0x140518750]
ret
test edx, edx
je 0x140341a92
movzx eax, byte [0x1405186f2]
cmp al, 0x3e
je 0x140341a44
mov cl, 0xce
nop dword [rax]
mov al, 0x8b
lock cmpxchg byte [0x1405186f2], cl
je 0x140341af8
cmp al, 0x3e
jne 0x140341a30
lea rax, [0x1405186f0]
ret
movzx eax, byte [0x1405187ff]
cmp al, 0x2f
je 0x140341a8a
mov ecx, dword [rsp + 0x28]
nop dword [rax + rax]
movzx edx, byte [0x140518e70]
mov eax, ecx
xor al, 0x6e
add al, dl
mov r8d, ecx
xor r8b, 0xc0
add r8b, dl
lock cmpxchg byte [0x1405187ff], r8b
je 0x140341b3f
cmp al, 0x2f
jne 0x140341a60
lea rax, [0x1405187f0]
ret
movzx eax, byte [0x140518785]
cmp al, 0x26
je 0x140341ab4
mov cl, 0x9e
nop
mov al, 0xef
lock cmpxchg byte [0x140518785], cl
je 0x140341b8c
cmp al, 0x26
jne 0x140341aa0
lea rax, [0x140518770]
ret
xor eax, eax
lea rcx, [0x140518750]
lea rdx, [0x1404244a0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140341ae8
inc rax
jmp 0x140341ad0
mov al, 0xc1
xchg byte [0x140518760], al
lea rax, [0x140518750]
ret
xor edx, edx
lea rax, [0x1405186f0]
lea rcx, [0x140424440]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 2
jl 0x140341b10
mov al, 0x3e
xchg byte [0x1405186f2], al
lea rax, [0x1405186f0]
ret
xor eax, eax
lea rcx, [0x1405187f0]
lea rdx, [0x140424530]
nop
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x140341b7c
inc rax
jmp 0x140341b50
mov al, 0x2f
xchg byte [0x1405187ff], al
lea rax, [0x1405187f0]
ret
xor eax, eax
lea rcx, [0x140518770]
lea rdx, [0x1404244b0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140341bc8
inc rax
jmp 0x140341ba0
mov al, 0x26
xchg byte [0x140518785], al
lea rax, [0x140518770]
ret
Function at 0x140342500
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
test rcx, rcx
je 0x1403425ec
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
nop word cs:[rax + rax]
mov eax, r14d
movzx eax, word [rdi + rax*2]
movzx ecx, word [0x140533698]
mov edx, ecx
xor edx, eax
and ecx, eax
add ecx, ecx
add cx, dx
setne al
or al, byte [0x1405317c9]
movzx eax, al
and eax, 1
mov ecx, dword [0x1405349b0]
mov edx, ecx
xor edx, eax
and eax, ecx
lea eax, [rdx + rax*2]
mov ecx, r14d
xor ecx, eax
and r14d, eax
lea r14d, [rcx + r14*2]
cmp word [rdi + r14*2], 0
jne 0x140342530
test r14d, r14d
je 0x14034261b
mov r15d, dword [0x140531ae0]
mov dword [rsp + 0x28], 0xd74ba33f
mov dword [rsp + 0x20], 0xb8bfd017
xor ebx, ebx
mov ecx, 1
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call fcn.140349080
test rax, rax
je 0x14034261d
mov rcx, qword [rax + 0x10]
xor ebx, ebx
test rcx, rcx
je 0x14034261d
mov rdx, qword [rax + 0x18]
test rdx, rdx
je 0x14034261d
lea ebp, [r15 + r14]
inc ebp
mov r14d, ebp
dec r14
xor ebx, ebx
mov r15d, 1
mov r8, rcx
xor r12d, r12d
mov qword [rsp + 0x30], rsi
jmp 0x140342658
mov dword [rsp + 0x28], 0xd74ba33f
mov dword [rsp + 0x20], 0xb8bfd017
xor ebx, ebx
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call fcn.140349080
test rax, rax
je 0x14034261d
mov rbx, qword [rax + 0x10]
jmp 0x14034261d
xor ebx, ebx
mov rax, rbx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15d, 1
nop word [rax + rax]
mov r10, qword [r8]
test r10, r10
cmovne r8, r10
movzx r12d, r9b
cmove r12d, r15d
test r12b, 1
jne 0x14034261d
cmp rcx, qword [rax + 0x10]
sete r9b
movzx r10d, byte [0x140531628]
test r10b, r9b
jne 0x1403426ab
xor r10b, r9b
jne 0x1403426ab
mov dword [rsp + 0x28], 0xd74ba33f
mov dword [rsp + 0x20], 0xb8bfd017
mov ecx, 1
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call fcn.140349080
test rax, rax
je 0x14034261d
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov r8, rcx
mov r9d, r12d
not r9b
mov r10d, r12d
xor r10b, 1
and r9b, 0xfe
or r9b, r10b
not r9b
add r9b, byte [0x1405349b4]
sete r9b
movzx r10d, byte [0x140531a00]
test r10b, r9b
jne 0x1403426e3
xor r10b, r9b
je 0x140342652
cmp r8, rdx
movzx r9d, r12b
cmove r9d, r15d
movzx r10d, word [r8 + 0x58]
add r10d, dword [0x140532750]
add r10d, dword [0x140531ae0]
cmp ebp, r10d
ja 0x140342640
mov r10, qword [r8 + 0x60]
test r10, r10
je 0x140342640
cmp r10, 0xffff
je 0x140342640
test ebp, ebp
je 0x140342787
xor r11d, r11d
nop dword [rax + rax]
movzx esi, word [rdi + r11*2]
lea r12d, [rsi - 0x61]
mov r15d, esi
xor r15d, 0xffffffe0
mov r13d, esi
and r13d, 0x7fe0
cmp r12w, 0x1a
lea r12d, [r15 + r13*2]
cmovae r12d, esi
test r12w, r12w
je 0x14034277d
movzx esi, word [r10 + r11*2]
lea r15d, [rsi - 0x61]
lea r13d, [rsi - 0x20]
cmp r15w, 0x1a
cmovae r13d, esi
cmp r12w, r13w
jne 0x140342631
cmp r14, r11
je 0x140342787
inc r11
jmp 0x140342730
mov rbx, qword [r8 + 0x30]
mov r9b, 1
mov rsi, qword [rsp + 0x30]
test rsi, rsi
je 0x140342631
mov qword [rsi], r8
jmp 0x140342631