joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140126fd0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140127021
test edx, edx
je 0x14012705c
movzx eax, byte [0x140537b73]
cmp al, 0xd
je 0x140127019
nop word [rax + rax]
movzx ecx, byte [0x140537de8]
lea eax, [rcx + 0x1f]
add cl, 0x7b
lock cmpxchg byte [0x140537b73], cl
je 0x1401270c6
movzx ecx, byte [0x140537de8]
add cl, 0xe6
cmp al, cl
jne 0x140126ff0
lea rax, [0x140537b70]
ret
test edx, edx
je 0x14012708c
movzx eax, byte [0x140537c5f]
cmp al, 7
je 0x140127054
mov cl, 0x77
nop word cs:[rax + rax]
mov al, 0x47
lock cmpxchg byte [0x140537c5f], cl
je 0x140127111
cmp al, 7
jne 0x140127040
lea rax, [0x140537c50]
ret
movzx eax, byte [0x140537b62]
cmp al, 0x63
je 0x140127084
mov cl, 5
nop dword [rax]
mov al, 0x6f
lock cmpxchg byte [0x140537b62], cl
je 0x140127151
cmp al, 0x63
jne 0x140127070
lea rax, [0x140537b60]
ret
movzx eax, byte [0x140537be2]
cmp al, 0x8f
je 0x1401270be
mov cl, 0x58
nop dword [rax]
mov al, 0x84
lock cmpxchg byte [0x140537be2], cl
je 0x1401271af
movzx edx, byte [0x140537de8]
add dl, 0x68
cmp al, dl
jne 0x1401270a0
lea rax, [0x140537bd0]
ret
xor edx, edx
lea rax, [0x140537b70]
lea rcx, [0x14045ff70]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x140537dec]
add edx, r8d
add edx, 0x8de27085
cmp edx, 3
jl 0x1401270e0
mov al, 0xd
xchg byte [0x140537b73], al
lea rax, [0x140537b70]
ret
xor eax, eax
lea rcx, [0x140537c50]
lea rdx, [0x140460030]
mov r8d, 0x8de27093
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140537dec]
add r10d, r8d
cmp r9d, r10d
jge 0x14012719f
inc rax
jmp 0x140127130
xor edx, edx
lea rax, [0x140537b60]
lea rcx, [0x14045ff60]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 2
jl 0x140127170
mov al, 0x63
xchg byte [0x140537b62], al
lea rax, [0x140537b60]
ret
mov al, 7
xchg byte [0x140537c5f], al
lea rax, [0x140537c50]
ret
xor edx, edx
lea rax, [0x140537bd0]
lea rcx, [0x14045ffc0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x140537dec]
add edx, r8d
add edx, 0x8de27085
cmp edx, 0x12
jl 0x1401271c0
mov al, 0x8f
xchg byte [0x140537be2], al
lea rax, [0x140537bd0]
ret
Function at 0x140127350
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140127396
test edx, edx
je 0x1401273dc
movzx eax, byte [0x140537ccd]
cmp al, 0xcf
je 0x14012738e
mov cl, 0x5f
nop dword [rax]
mov al, 0xd4
lock cmpxchg byte [0x140537ccd], cl
je 0x14012743c
movzx edx, byte [0x140537de8]
add dl, 0xa8
cmp al, dl
jne 0x140127370
lea rax, [0x140537cc0]
ret
xor eax, eax
sub eax, dword [0x140537dec]
mov ecx, eax
xor ecx, 0x721d8f7c
and eax, 0x721d8f7c
lea eax, [rcx + rax*2]
add edx, eax
jne 0x140127408
movzx eax, byte [0x140537bc5]
cmp al, 0x42
je 0x1401273d4
mov cl, 0x68
nop
mov al, 0xcb
lock cmpxchg byte [0x140537bc5], cl
je 0x1401274bf
cmp al, 0x42
jne 0x1401273c0
lea rax, [0x140537bb0]
ret
movzx eax, byte [0x140537c12]
cmp al, 0xe8
je 0x140127400
mov cl, 0x36
nop dword [rax]
mov al, 0xd8
lock cmpxchg byte [0x140537c12], cl
je 0x140127478
cmp al, 0xe8
jne 0x1401273f0
lea rax, [0x140537c10]
ret
movzx eax, byte [0x140537d1b]
cmp al, 0xe0
je 0x140127434
mov cl, 0x76
nop word cs:[rax + rax]
mov al, 7
lock cmpxchg byte [0x140537d1b], cl
je 0x140127501
cmp al, 0xe0
jne 0x140127420
lea rax, [0x140537d10]
ret
xor eax, eax
lea rcx, [0x140537cc0]
lea rdx, [0x1404600a0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140127468
inc rax
jmp 0x140127450
mov al, 0xcf
xchg byte [0x140537ccd], al
lea rax, [0x140537cc0]
ret
xor eax, eax
lea rcx, [0x140537c10]
lea rdx, [0x140460000]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x1401274a8
inc rax
jmp 0x140127490
movzx eax, byte [0x140537de8]
add al, 0xc1
xchg byte [0x140537c12], al
lea rax, [0x140537c10]
ret
xor edx, edx
lea rax, [0x140537bb0]
lea rcx, [0x14045ffa0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x140537dec]
add edx, r8d
add edx, 0x8de27085
cmp edx, 0x15
jl 0x1401274d0
mov al, 0x42
xchg byte [0x140537bc5], al
lea rax, [0x140537bb0]
ret
xor eax, eax
lea rcx, [0x140537d10]
lea rdx, [0x1404600f0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x140127538
inc rax
jmp 0x140127520
mov al, pe_nt_image_headers64
xchg byte [0x140537d1b], al
lea rax, [0x140537d10]
ret
Function at 0x140134a40
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa5c3331b
add eax, dword [0x14053a034]
cmp ecx, eax
jne 0x140134a8c
test edx, edx
je 0x140134aec
movzx eax, byte [0x140538ae0]
cmp al, 0x63
je 0x140134a84
mov cl, 0x15
nop word cs:[rax + rax]
mov al, 0x10
lock cmpxchg byte [0x140538ae0], cl
je 0x140134be3
cmp al, 0x63
jne 0x140134a70
lea rax, [0x140538ad0]
ret
test edx, edx
je 0x140134b91
movzx eax, byte [0x140538a79]
nop dword [rax + rax]
cmp al, 0xdc
je 0x140134c20
movzx ecx, byte [0x14053a030]
lea eax, [rcx - 0x73]
add cl, 0xa3
lock cmpxchg byte [0x140538a79], cl
jne 0x140134aa0
xor eax, eax
lea rcx, [0x140538a70]
lea rdx, [0x140460fc0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x140134c18
inc rax
jmp 0x140134ad0
movzx eax, byte [0x140538a96]
nop word cs:[rax + rax]
cmp al, 0x6e
je 0x140134b89
movzx ecx, byte [0x14053a030]
lea eax, [rcx - 0x21]
add cl, 0x88
lock cmpxchg byte [0x140538a96], cl
jne 0x140134b00
xor eax, eax
lea rcx, [0x140538a90]
lea rdx, [0x140460fe0]
nop
cdqe
xor r8d, r8d
sub r8b, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
xor r10d, r10d
sub r10b, r9b
mov r9d, r8d
xor r9b, r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
neg r10b
mov byte [rax + rcx], r10b
mov r8d, dword [0x14053a034]
mov r9d, r8d
xor r9d, 0x5a3ccce3
and r9d, r8d
xor r8d, 0xa5c3331c
lea r8d, [r8 + r9*2]
add eax, r8d
cmp eax, 6
jl 0x140134b30
mov al, 0x6e
xchg byte [0x140538a96], al
lea rax, [0x140538a90]
ret
movzx eax, byte [0x140538bd5]
movzx ecx, byte [0x14053a030]
add cl, 0xc9
cmp al, cl
je 0x140134bdb
nop word cs:[rax + rax]
movzx ecx, byte [0x14053a030]
mov edx, ecx
xor dl, 0x40
mov eax, ecx
not al
and al, 0x3f
or al, dl
not al
add al, al
add al, dl
add cl, 0xb7
lock cmpxchg byte [0x140538bd5], cl
je 0x140134c38
cmp al, 0x8d
jne 0x140134bb0
lea rax, [0x140538bc0]
ret
xor eax, eax
lea rcx, [0x140538ad0]
lea rdx, [0x140461020]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140134c28
inc rax
jmp 0x140134c00
mov al, 0xdc
xchg byte [0x140538a79], al
lea rax, [0x140538a70]
ret
mov al, 0x63
xchg byte [0x140538ae0], al
lea rax, [0x140538ad0]
ret
xor edx, edx
lea rax, [0x140538bc0]
lea rcx, [0x140461100]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x140134c50
mov al, 0x8d
xchg byte [0x140538bd5], al
lea rax, [0x140538bc0]
ret
Function at 0x140134c80
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa5c3331b
mov r8d, dword [0x14053a034]
add r8d, eax
cmp ecx, r8d
jne 0x140134cdc
test edx, edx
je 0x140134d8c
movzx eax, byte [0x140538a16]
movzx ecx, byte [0x14053a030]
mov edx, ecx
xor dl, 0x8a
and cl, 0xa
add cl, cl
add cl, dl
cmp al, cl
je 0x140134cd4
mov cl, 0xc3
nop dword [rax]
mov al, 0x87
lock cmpxchg byte [0x140538a16], cl
je 0x140134dc6
cmp al, 0x4e
jne 0x140134cc0
lea rax, [0x140538a00]
ret
add eax, dword [0x14053a034]
cmp edx, eax
jne 0x140134d1c
movzx eax, byte [0x140538962]
cmp al, 0xb
je 0x140134d14
mov cl, 0x2a
nop word cs:[rax + rax]
mov al, 0x65
lock cmpxchg byte [0x140538962], cl
je 0x140134e21
cmp al, 0xb
jne 0x140134d00
lea rax, [0x140538950]
ret
movzx eax, byte [0x140538bbd]
nop word cs:[rax + rax]
cmp al, 0x42
je 0x140134e87
movzx ecx, byte [0x14053a030]
lea eax, [rcx - 0x5f]
add cl, 0xeb
lock cmpxchg byte [0x140538bbd], cl
jne 0x140134d30
xor eax, eax
lea rcx, [0x140538bb0]
lea rdx, [0x1404610f0]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140134e7f
inc rax
jmp 0x140134d60
movzx eax, byte [0x140538945]
cmp al, 0xab
je 0x140134dbe
mov cl, 0x1c
nop dword [rax]
mov al, 0x3f
lock cmpxchg byte [0x140538945], cl
je 0x140134e8f
movzx edx, byte [0x14053a030]
add dl, 0xe7
cmp al, dl
jne 0x140134da0
lea rax, [0x140538930]
ret
xor edx, edx
lea rax, [0x140538a00]
lea rcx, [0x140460f70]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x14053a034]
add edx, r8d
add edx, 0xa5c3331c
cmp edx, 0x16
jl 0x140134de0
mov al, 0x4e
xchg byte [0x140538a16], al
lea rax, [0x140538a00]
ret
xor eax, eax
lea rcx, [0x140538950]
lea rdx, [0x140460ec0]
nop word cs:[rax + rax]
cdqe
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
mov r8d, dword [0x14053a034]
mov r9d, r8d
xor r9d, 0xa5c3331c
and r8d, 0x25c3331c
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0x12
jl 0x140134e40
mov al, 0xb
xchg byte [0x140538962], al
lea rax, [0x140538950]
ret
mov al, 0x42
xchg byte [0x140538bbd], al
lea rax, [0x140538bb0]
ret
xor eax, eax
lea rcx, [0x140538930]
lea rdx, [0x140460ea0]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140134eb8
inc rax
jmp 0x140134ea0
mov al, 0xab
xchg byte [0x140538945], al
lea rax, [0x140538930]
ret
Function at 0x140135490
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa5c3331b
add eax, dword [0x14053a034]
cmp ecx, eax
jne 0x1401354fc
test edx, edx
je 0x14013558a
movzx eax, byte [0x140538aa5]
nop
cmp al, 0x13
je 0x14013561a
movzx ecx, byte [0x14053a030]
lea eax, [rcx + 0x52]
add cl, 0x46
lock cmpxchg byte [0x140538aa5], cl
jne 0x1401354b0
xor eax, eax
lea rcx, [0x140538aa0]
lea rdx, [0x140460ff0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x140135602
inc rax
jmp 0x1401354e0
test edx, edx
je 0x1401355b8
movzx eax, byte [0x140538bed]
nop dword [rax + rax]
cmp al, 0x2a
je 0x140135582
movzx ecx, byte [0x14053a030]
lea eax, [rcx + 0x59]
mov edx, eax
xor dl, 0xb1
and al, 0x31
add al, al
add al, dl
add cl, 0xa4
lock cmpxchg byte [0x140538bed], cl
jne 0x140135510
xor r8d, r8d
lea rax, [0x140538be0]
lea rcx, [0x140461120]
mov edx, 0xa5c33328
nop dword [rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
add byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x14053a034]
add r9d, edx
cmp r8d, r9d
jl 0x140135550
mov al, 0x2a
xchg byte [0x140538bed], al
lea rax, [0x140538be0]
ret
movzx eax, byte [0x140538bad]
cmp al, 3
je 0x1401355b0
mov cl, 0x2e
nop word [rax + rax]
mov al, 0x1f
lock cmpxchg byte [0x140538bad], cl
je 0x140135622
cmp al, 3
jne 0x1401355a0
lea rax, [0x140538ba0]
ret
movzx eax, byte [0x140538b43]
cmp al, 0xfb
je 0x1401355fa
mov cl, 0x31
nop word cs:[rax + rax]
mov al, 0x2d
lock cmpxchg byte [0x140538b43], cl
je 0x14013566f
movzx edx, byte [0x14053a030]
mov r8d, edx
xor r8b, 0x37
and dl, 0x37
add dl, dl
add dl, r8b
cmp al, dl
jne 0x1401355d0
lea rax, [0x140538b20]
ret
movzx eax, byte [0x14053a030]
mov ecx, eax
xor cl, 0x4f
and al, 0x4f
add al, al
add al, cl
xchg byte [0x140538aa5], al
lea rax, [0x140538aa0]
ret
xor eax, eax
lea rcx, [0x140538ba0]
lea rdx, [0x1404610e0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r9b
mov r10d, r9d
or r10b, r8b
not r10b
and r9b, r8b
or r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140135698
inc rax
jmp 0x140135640
xor eax, eax
lea rcx, [0x140538b20]
lea rdx, [0x140461060]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1401356a8
inc rax
jmp 0x140135680
mov al, 3
xchg byte [0x140538bad], al
lea rax, [0x140538ba0]
ret
mov al, 0xfb
xchg byte [0x140538b43], al
lea rax, [0x140538b20]
ret
Function at 0x14015af10
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
cmp qword [rcx + 0x18], 0
je 0x14015b08a
mov rsi, rcx
mov eax, dword [0x1405a6e34]
movabs rbx, 0x6beb9065485c4480
cmp eax, 0x3e
jg 0x14015af7e
mov rax, qword [0x14053f7c0]
add rax, rbx
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x18], 0
mov byte [rbp - 0x28], 0
lea rax, [0x14045cff8]
mov qword [rbp - 0x30], rax
mov rdx, qword [rsi + 0x18]
mov eax, dword [0x1405a6e34]
cmp eax, 0x40
jl 0x14015affc
lea rdi, [0x14015d680]
lea r14, [0x14045cff8]
nop dword [rax]
mov rax, qword [0x14053f7c0]
add rax, rbx
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x18], 0
mov eax, dword [0x14053f7c8]
mov ecx, eax
xor ecx, 0xb1908369
not eax
and eax, 0x4e6f7c96
or eax, ecx
not eax
add eax, eax
mov edx, ecx
xor edx, eax
and eax, ecx
lea ecx, [rdx + rax*2]
call fcn.1403f8a54
mov qword [0x1405a6e08], rax
mov rcx, rdi
call fcn.140418e40
mov byte [rbp - 0x28], 0
mov qword [rbp - 0x30], r14
mov eax, dword [0x1405a6e30]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x14015af90
jmp 0x14015af4a
mov dword [rsp + 0x20], 0
lea r9, [rbp - 0x30]
mov rcx, rsi
xor r8d, r8d
call fcn.1401d5200
mov rax, qword [rbp - 0x10]
add rbx, qword [0x14053f7c0]
cmp rax, rbx
jbe 0x14015b08a
mov rsi, qword [rbp - 0x28]
lea rdi, [rax + 1]
cmp rdi, 0x1000
jb 0x14015b04f
mov rcx, qword [rsi - 8]
sub rsi, rcx
add rsi, 0xfffffffffffffff8
cmp rsi, 0x20
jae 0x14015b05c
add rax, 0x28
mov rdi, rax
mov rsi, rcx
mov eax, dword [0x1405a6e34]
cmp eax, 0x22
jle 0x14015b061
jmp 0x14015b07d
call fcn.1403f89dc
mov rcx, rsi
mov rdx, rdi
call fcn.1400ad790
mov eax, dword [0x1405a6e30]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
je 0x14015b08a
mov rcx, rsi
mov rdx, rdi
call fcn.1400ad790
jmp 0x14015b061
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x14015de30
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14015de6c
mov ecx, dword [rsp + 0x28]
test edx, edx
je 0x14015de9c
movzx eax, byte [0x14053f159]
cmp al, 2
je 0x14015de64
mov dl, 0x1e
nop dword [rax]
mov al, 0xcf
lock cmpxchg byte [0x14053f159], dl
je 0x14015defc
cmp al, 2
jne 0x14015de50
lea rax, [0x14053f150]
ret
test edx, edx
je 0x14015decc
movzx eax, byte [0x14053f0a5]
cmp al, 0xec
je 0x14015de94
mov cl, 0x53
nop dword [rax]
mov al, 0xc4
lock cmpxchg byte [0x14053f0a5], cl
je 0x14015df58
cmp al, 0xec
jne 0x14015de80
lea rax, [0x14053f090]
ret
movzx eax, byte [0x14053f100]
cmp al, 0x1d
je 0x14015dec4
mov dl, 0x62
nop dword [rax]
mov al, 0xd1
lock cmpxchg byte [0x14053f100], dl
je 0x14015df98
cmp al, 0x1d
jne 0x14015deb0
lea rax, [0x14053f0f0]
ret
movzx eax, byte [0x14053f130]
cmp al, 0x1c
je 0x14015def4
mov cl, 0x59
nop dword [rax]
mov al, 0x1a
lock cmpxchg byte [0x14053f130], cl
je 0x14015dfef
cmp al, 0x1c
jne 0x14015dee0
lea rax, [0x14053f120]
ret
xor r8d, r8d
lea rax, [0x14053f150]
lea rdx, [0x140461820]
nop dword [rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [r8 + rax]
xor r10b, r9b
mov byte [r8 + rax], r10b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
cmp r8d, 9
jl 0x14015df10
xor cl, 0x43
add cl, byte [0x1405a6e38]
xchg byte [0x14053f159], cl
lea rax, [0x14053f150]
ret
xor eax, eax
lea rcx, [0x14053f090]
lea rdx, [0x140461780]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x14015dfc8
inc rax
jmp 0x14015df70
xor eax, eax
lea rdx, [0x14053f0f0]
lea r8, [0x1404617e0]
nop dword [rax + rax]
movzx r9d, byte [rax + r8]
add byte [rax + rdx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xf
jg 0x14015dfd8
inc rax
jmp 0x14015dfb0
mov al, 0xec
xchg byte [0x14053f0a5], al
lea rax, [0x14053f090]
ret
xor cl, 0x5c
add cl, byte [0x1405a6e38]
xchg byte [0x14053f100], cl
lea rax, [0x14053f0f0]
ret
xor edx, edx
lea rax, [0x14053f120]
lea rcx, [0x140461800]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
add edx, 0xf40dee33
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0xbf211cd
cmp edx, 0x10
jl 0x14015e000
mov al, 0x1c
xchg byte [0x14053f130], al
lea rax, [0x14053f120]
ret
Function at 0x14016e500
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0xf3bfb8dc
add eax, dword [0x140541268]
cmp ecx, eax
jne 0x14016e5ab
test edx, edx
je 0x14016e5e8
movzx eax, byte [0x140541009]
nop word [rax + rax]
cmp al, 0x9a
je 0x14016e5a3
movzx ecx, byte [0x140541278]
mov eax, r8d
xor al, 0xc2
add al, cl
mov edx, r8d
xor dl, 0xfc
add dl, cl
lock cmpxchg byte [0x140541009], dl
jne 0x14016e530
xor edx, edx
lea rax, [0x140541000]
lea rcx, [0x140461b60]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
add edx, 0xd386914c
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x2c796eb4
cmp edx, 9
jl 0x14016e570
mov al, 0x9a
xchg byte [0x140541009], al
lea rax, [0x140541000]
ret
test edx, edx
je 0x14016e665
movzx eax, byte [0x140541082]
cmp al, 0x9a
je 0x14016e5e0
mov cl, 0xa4
mov al, 0x1a
lock cmpxchg byte [0x140541082], cl
je 0x14016e698
mov edx, r8d
xor dl, 0x49
add dl, byte [0x140541278]
cmp al, dl
jne 0x14016e5c0
lea rax, [0x140541070]
ret
movzx eax, byte [0x140540e4c]
nop
cmp al, 0xb5
je 0x14016e65d
movzx ecx, byte [0x140541278]
mov edx, r8d
not dl
and dl, 0x94
mov eax, r8d
xor al, 0x6b
or al, dl
not al
or al, dl
add al, cl
add cl, r8b
lock cmpxchg byte [0x140540e4c], cl
jne 0x14016e5f0
xor edx, edx
lea rax, [0x140540e20]
lea rcx, [0x140461990]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0x7ffffffe
and r8d, edx
xor edx, 1
lea edx, [rdx + r8*2]
cmp edx, 0x2c
jl 0x14016e630
mov al, 0xb5
xchg byte [0x140540e4c], al
lea rax, [0x140540e20]
ret
movzx eax, byte [0x140541035]
cmp al, 0xe0
je 0x14016e690
mov cl, 0x23
nop word cs:[rax + rax]
mov al, 0xfd
lock cmpxchg byte [0x140541035], cl
je 0x14016e6d8
cmp al, 0xe0
jne 0x14016e680
lea rax, [0x140541020]
ret
xor eax, eax
lea rcx, [0x140541070]
lea rdx, [0x140461bd0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x14016e6c8
inc rax
jmp 0x14016e6b0
mov al, 0x9a
xchg byte [0x140541082], al
lea rax, [0x140541070]
ret
xor eax, eax
lea rcx, [0x140541020]
lea rdx, [0x140461b80]
xor r8d, 0xf3bfb8dd
neg r8d
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rcx]
mov r10d, r9d
xor r10b, 0xd6
and r9b, 0x56
add r9b, r9b
add r9b, r10b
add r9b, byte [rax + rdx]
add r9b, 0x2a
mov byte [rax + rcx], r9b
xor r9d, r9d
sub r9d, dword [0x140541268]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
sub eax, r9d
cmp eax, 0x15
jl 0x14016e700
mov al, pe_nt_image_headers64
xchg byte [0x140541035], al
lea rax, [0x140541020]
ret
Function at 0x14016e930
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14016e97c
mov eax, r8d
xor eax, 0xcbd56a66
add eax, dword [0x140541268]
cmp edx, eax
jne 0x14016e9c8
movzx eax, byte [0x14054104b]
cmp al, 0x70
je 0x14016e974
mov cl, 0x21
nop dword [rax + rax]
mov al, 0x46
lock cmpxchg byte [0x14054104b], cl
je 0x14016ea4c
cmp al, 0x70
jne 0x14016e960
lea rax, [0x140541040]
ret
test edx, edx
je 0x14016ea1a
movzx eax, byte [0x140540fae]
cmp al, 0xd0
je 0x14016e9c0
mov cl, 0x32
nop word cs:[rax + rax]
mov al, 0xa5
lock cmpxchg byte [0x140540fae], cl
je 0x14016ead8
mov edx, r8d
xor dl, 0x85
add dl, byte [0x140541278]
cmp al, dl
jne 0x14016e9a0
lea rax, [0x140540fa0]
ret
movzx eax, byte [0x140540fe3]
cmp al, 0xfa
je 0x14016ea12
mov cl, 0x75
nop word cs:[rax + rax]
mov al, 0x9e
lock cmpxchg byte [0x140540fe3], cl
je 0x14016ea78
movzx edx, byte [0x140541278]
mov r9d, r8d
xor r9b, 0x53
mov r10d, r9d
xor r10b, dl
and r9b, dl
add r9b, r9b
add r9b, r10b
cmp al, r9b
jne 0x14016e9e0
lea rax, [0x140540fc0]
ret
movzx eax, byte [0x14054101d]
cmp al, 6
je 0x14016ea44
mov cl, 0xf5
nop word [rax + rax]
mov al, 0x93
lock cmpxchg byte [0x14054101d], cl
je 0x14016eb18
cmp al, 6
jne 0x14016ea30
lea rax, [0x140541010]
ret
xor eax, eax
lea rcx, [0x140541040]
lea rdx, [0x140461ba0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x14016eab8
inc rax
jmp 0x14016ea60
xor eax, eax
lea rcx, [0x140540fc0]
lea rdx, [0x140461b20]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x14016eac8
inc rax
jmp 0x14016ea90
mov al, 0x70
xchg byte [0x14054104b], al
lea rax, [0x140541040]
ret
mov al, 0xfa
xchg byte [0x140540fe3], al
lea rax, [0x140540fc0]
ret
xor eax, eax
lea rcx, [0x140540fa0]
lea rdx, [0x140461b00]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x14016eb08
inc rax
jmp 0x14016eaf0
mov al, 0xd0
xchg byte [0x140540fae], al
lea rax, [0x140540fa0]
ret
xor edx, edx
lea rax, [0x140541010]
lea rcx, [0x140461b70]
xor r8d, 0xcbd56a13
nop
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
mov r9d, dword [0x140541268]
add r9d, r8d
cmp edx, r9d
jl 0x14016eb30
mov al, 6
xchg byte [0x14054101d], al
lea rax, [0x140541010]
ret
Function at 0x140175f30
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140175f75
test edx, edx
je 0x140175fac
movzx eax, byte [0x140541e25]
cmp al, 0x5d
je 0x140175f6d
mov cl, 0x2f
nop word cs:[rax + rax]
mov al, 0x6d
lock cmpxchg byte [0x140541e25], cl
je 0x140176015
movzx edx, byte [0x140542bcc]
dec dl
cmp al, dl
jne 0x140175f50
lea rax, [0x140541e10]
ret
test edx, edx
je 0x140175fdc
movzx eax, byte [0x140541f93]
cmp al, 0xe0
je 0x140175fa4
mov cl, 0x9f
nop word cs:[rax + rax]
mov al, 0xb1
lock cmpxchg byte [0x140541f93], cl
je 0x140176072
cmp al, 0xe0
jne 0x140175f90
lea rax, [0x140541f90]
ret
movzx eax, byte [0x1405a6ee0]
cmp al, 0x13
je 0x140175fd4
mov cl, 0x69
nop dword [rax]
xor eax, eax
lock cmpxchg byte [0x1405a6ee0], cl
je 0x1401760ac
cmp al, 0x13
jne 0x140175fc0
lea rax, [0x140541d50]
ret
movzx eax, byte [0x140541f15]
cmp al, 0x5d
je 0x14017600d
mov cl, 0xe5
nop dword [rax]
mov al, 0xcb
lock cmpxchg byte [0x140541f15], cl
je 0x14017614a
movzx edx, byte [0x140542bcc]
dec dl
cmp al, dl
jne 0x140175ff0
lea rax, [0x140541f00]
ret
xor edx, edx
lea rax, [0x140541e10]
lea rcx, [0x140461e70]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0xe1aac3d0
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x1e553c30
cmp edx, 0x15
jl 0x140176030
movzx eax, byte [0x140542bcc]
dec al
xchg byte [0x140541e25], al
lea rax, [0x140541e10]
ret
xor eax, eax
lea rcx, [0x140541f90]
lea rdx, [0x140461fd0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x14017613a
inc rax
jmp 0x140176090
xor edx, edx
lea rax, [0x140541d50]
lea rcx, [0x140461db0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
add r8b, 0xdf
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
add r8b, 0x21
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0xbf02c526
and edx, 0x3f02c526
lea edx, [r8 + rdx*2]
add edx, 0x40fd3adb
mov r8d, dword [0x140542bc8]
mov r9d, r8d
xor r9d, 0x3c0d3006
and r8d, 0x3c0d3006
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x1401760c0
movzx eax, byte [0x140542bcc]
add al, 0xb5
xchg byte [0x1405a6ee0], al
lea rax, [0x140541d50]
ret
mov al, pe_nt_image_headers64
xchg byte [0x140541f93], al
lea rax, [0x140541f90]
ret
xor eax, eax
lea rcx, [0x140541f00]
lea rdx, [0x140461f50]
nop word [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r9b
mov r10d, r9d
or r10b, r8b
not r10b
and r9b, r8b
or r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x14017618f
inc rax
jmp 0x140176160
mov al, 0x5d
xchg byte [0x140541f15], al
lea rax, [0x140541f00]
ret