joyce8/EMBER2024-capa huggingface dataset:
Function at 0x20372660
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x203726b7
mov eax, 0xdfa5325c
add eax, dword [0x205938b4]
cmp edx, eax
jne 0x20372700
movzx eax, byte [0x20592e0b]
movzx ecx, byte [0x205938b0]
add cl, 0x98
cmp al, cl
je 0x203726af
nop dword [rax]
movzx ecx, byte [0x205938b0]
lea eax, [rcx + 0x6f]
add cl, 0x63
lock cmpxchg byte [0x20592e0b], cl
je 0x2037275c
cmp al, 0xd1
jne 0x20372690
lea rax, [0x20592df0]
ret
test edx, edx
je 0x20372728
movzx eax, byte [0x20592e7e]
movzx ecx, byte [0x205938b0]
dec cl
cmp al, cl
je 0x203726f8
nop
movzx ecx, byte [0x205938b0]
lea eax, [rcx + 3]
mov edx, ecx
xor dl, 0xd0
and cl, 0x50
add cl, cl
add cl, dl
lock cmpxchg byte [0x20592e7e], cl
je 0x203727d8
cmp al, 0x38
jne 0x203726d0
lea rax, [0x20592e50]
ret
movzx eax, byte [0x20592f27]
cmp al, 0x4f
je 0x20372720
mov cl, 0x4c
nop dword [rax]
mov al, 0xd8
lock cmpxchg byte [0x20592f27], cl
je 0x20372788
cmp al, 0x4f
jne 0x20372710
lea rax, [0x20592f00]
ret
movzx eax, byte [0x20592faf]
cmp al, 0x86
je 0x20372754
mov cl, 0xe3
nop word cs:[rax + rax]
mov al, 0x83
lock cmpxchg byte [0x20592faf], cl
je 0x2037282c
cmp al, 0x86
jne 0x20372740
lea rax, [0x20592fa0]
ret
xor eax, eax
lea rcx, [0x20592df0]
lea rdx, [0x20490300]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1a
jg 0x203727b8
inc rax
jmp 0x20372770
xor eax, eax
lea rcx, [0x20592f00]
lea rdx, [0x204903f0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x26
jg 0x203727c8
inc rax
jmp 0x203727a0
mov al, 0xd1
xchg byte [0x20592e0b], al
lea rax, [0x20592df0]
ret
mov al, 0x4f
xchg byte [0x20592f27], al
lea rax, [0x20592f00]
ret
xor eax, eax
lea rcx, [0x20592e50]
lea rdx, [0x20490350]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x2d
jg 0x2037281c
inc rax
jmp 0x203727f0
mov al, 0x38
xchg byte [0x20592e7e], al
lea rax, [0x20592e50]
ret
xor r8d, r8d
lea rax, [0x20592fa0]
lea rcx, [0x20490490]
mov edx, 0xdfa5326b
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [r8 + rax]
xor r10b, r9b
mov byte [r8 + rax], r10b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x205938b4]
add r9d, edx
cmp r8d, r9d
jl 0x20372850
movzx eax, byte [0x205938b0]
mov ecx, eax
xor cl, 0x4d
and al, 0x4d
add al, al
add al, cl
xchg byte [0x20592faf], al
lea rax, [0x20592fa0]
ret
Function at 0x203728d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
test ecx, ecx
je 0x20372909
test edx, edx
je 0x20372939
movzx eax, byte [0x20592e40]
cmp al, 0x28
je 0x203729f9
mov cl, 0xf1
nop word [rax + rax]
mov al, 4
lock cmpxchg byte [0x20592e40], cl
je 0x203729b9
cmp al, 0x28
jne 0x203728f0
jmp 0x203729f9
test edx, edx
je 0x20372984
movzx eax, byte [0x20592dc5]
cmp al, 0x5c
je 0x20372a47
mov cl, 0x71
nop
mov al, 0xfe
lock cmpxchg byte [0x20592dc5], cl
je 0x20372a02
cmp al, 0x5c
jne 0x20372920
jmp 0x20372a47
movzx eax, byte [0x20592fb9]
movzx ecx, byte [0x205938b0]
inc cl
cmp al, cl
je 0x20372a80
nop word cs:[rax + rax]
movzx ecx, byte [0x205938b0]
lea eax, [rcx - 0x65]
add cl, 0x92
lock cmpxchg byte [0x20592fb9], cl
je 0x20372a50
cmp al, 0x3a
jne 0x20372960
jmp 0x20372a80
movzx eax, byte [0x20592ec0]
cmp al, 0xb4
je 0x20372aef
mov cl, 0xc0
nop word cs:[rax + rax]
mov al, 0xc2
lock cmpxchg byte [0x20592ec0], cl
je 0x20372a89
cmp al, 0xb4
jne 0x203729a0
jmp 0x20372aef
xor edx, edx
lea rax, [0x20592e30]
lea rcx, [0x20490340]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x205938b4]
add edx, r8d
add edx, 0xdfa5325d
cmp edx, 0x10
jl 0x203729d0
mov al, 0x28
xchg byte [0x20592e40], al
lea rax, [0x20592e30]
pop rbx
ret
xor edx, edx
lea rax, [0x20592db0]
lea rcx, [0x204902c0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x20372a20
mov al, 0x5c
xchg byte [0x20592dc5], al
lea rax, [0x20592db0]
pop rbx
ret
xor eax, eax
lea rcx, [0x20592fb0]
lea rdx, [0x204904a0]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x20372a78
inc rax
jmp 0x20372a60
mov al, 0x3a
xchg byte [0x20592fb9], al
lea rax, [0x20592fb0]
pop rbx
ret
xor eax, eax
lea rcx, [0x20592eb0]
lea rdx, [0x204903b0]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
not r10b
mov r11d, r8d
and r11b, r10b
xor r10b, r8b
not r8b
mov ebx, r8d
xor bl, r9b
or r11b, bl
not r11b
and r8b, r9b
or r8b, r10b
not r8b
or r8b, r11b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x20372ae7
inc rax
jmp 0x20372aa0
mov al, 0xb4
xchg byte [0x20592ec0], al
lea rax, [0x20592eb0]
pop rbx
ret
Function at 0x20382100
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x2038215c
mov eax, 0xd4b213e1
add eax, dword [0x20595478]
cmp edx, eax
jne 0x2038218c
movzx eax, byte [0x2059518f]
movzx ecx, byte [0x2059547c]
mov edx, ecx
xor dl, 0x5e
and cl, 0x5e
add cl, cl
add cl, dl
add cl, 0xd9
cmp al, cl
je 0x20382154
mov cl, 0xe0
nop word cs:[rax + rax]
mov al, 0x88
lock cmpxchg byte [0x2059518f], cl
je 0x20382206
cmp al, 0xdb
jne 0x20382140
lea rax, [0x20595180]
ret
test edx, edx
je 0x203821c8
movzx eax, byte [0x205950da]
cmp al, 0xd5
je 0x20382184
mov cl, 0xb8
nop dword [rax]
mov al, 0x1d
lock cmpxchg byte [0x205950da], cl
je 0x2038229f
cmp al, 0xd5
jne 0x20382170
lea rax, [0x205950c0]
ret
movzx eax, byte [0x20595015]
movzx ecx, byte [0x2059547c]
add cl, 0x89
cmp al, cl
je 0x203821c0
mov cl, 0x21
nop word cs:[rax + rax]
mov al, 0x6c
lock cmpxchg byte [0x20595015], cl
je 0x20382238
cmp al, 0x2d
jne 0x203821b0
lea rax, [0x20595000]
ret
movzx eax, byte [0x20595162]
cmp al, 0xd
je 0x203821fe
mov cl, 0x39
nop word cs:[rax + rax]
mov al, 0x72
lock cmpxchg byte [0x20595162], cl
je 0x203822f9
movzx edx, byte [0x2059547c]
add dl, 0x69
cmp al, dl
jne 0x203821e0
lea rax, [0x20595150]
ret
xor eax, eax
lea rcx, [0x20595180]
lea rdx, [0x20490af0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x2038227f
inc rax
jmp 0x20382220
xor eax, eax
lea rcx, [0x20595000]
lea rdx, [0x20490980]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r8b
mov r10d, r8d
and r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x2038228f
inc rax
jmp 0x20382250
mov al, 0xdb
xchg byte [0x2059518f], al
lea rax, [0x20595180]
ret
mov al, 0x2d
xchg byte [0x20595015], al
lea rax, [0x20595000]
ret
xor edx, edx
lea rax, [0x205950c0]
lea rcx, [0x20490a30]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0xaa6b4bf4
and edx, 0x2a6b4bf4
lea edx, [r8 + rdx*2]
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x5594b40c
cmp edx, 0x1a
jl 0x203822b0
mov al, 0xd5
xchg byte [0x205950da], al
lea rax, [0x205950c0]
ret
xor eax, eax
lea rcx, [0x20595150]
lea rdx, [0x20490ac0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x20382338
inc rax
jmp 0x20382310
movzx eax, byte [0x2059547c]
add al, 0x69
xchg byte [0x20595162], al
lea rax, [0x20595150]
ret
Function at 0x20382380
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x20595478]
mov r8d, eax
xor r8d, 0xd4b213e1
and eax, 0x54b213e1
lea eax, [r8 + rax*2]
cmp ecx, eax
jne 0x203823cc
test edx, edx
je 0x203823f8
movzx eax, byte [0x2059514d]
cmp al, 0x95
je 0x203823c4
mov cl, 0x45
nop
mov al, 0xa7
lock cmpxchg byte [0x2059514d], cl
je 0x20382468
cmp al, 0x95
jne 0x203823b0
lea rax, [0x20595140]
ret
movzx eax, byte [0x2059507a]
cmp al, 0x60
je 0x203823f0
mov cl, 0xf3
nop dword [rax]
mov al, 0xbb
lock cmpxchg byte [0x2059507a], cl
je 0x2038242c
cmp al, 0x60
jne 0x203823e0
lea rax, [0x20595070]
ret
movzx eax, byte [0x20595032]
movzx ecx, byte [0x2059547c]
add cl, 0x52
cmp al, cl
je 0x20382424
mov cl, 0x54
nop
mov al, 0x7a
lock cmpxchg byte [0x20595032], cl
je 0x203824d1
cmp al, 0xf6
jne 0x20382410
lea rax, [0x20595020]
ret
xor eax, eax
lea rcx, [0x20595070]
lea rdx, [0x204909f0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 9
jg 0x20382458
inc rax
jmp 0x20382440
mov al, 0x60
xchg byte [0x2059507a], al
lea rax, [0x20595070]
ret
xor r8d, r8d
lea rax, [0x20595140]
lea rcx, [0x20490ab0]
mov edx, 0xd4b213ee
nop
movsxd r8, r8d
movzx r9d, byte [r8 + rax]
movzx r10d, byte [r8 + rcx]
not r9b
mov r11d, r9d
and r11b, r10b
or r9b, r10b
not r9b
or r9b, r11b
mov byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x20595478]
add r9d, edx
cmp r8d, r9d
jl 0x20382480
mov al, 0x95
xchg byte [0x2059514d], al
lea rax, [0x20595140]
ret
xor edx, edx
lea rax, [0x20595020]
lea rcx, [0x204909a0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
not r10b
not r9b
mov r11d, r10d
xor r11b, r9b
and r11b, r10b
and r9b, r8b
or r9b, r11b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
mov r8d, dword [0x20595478]
mov r9d, r8d
xor r9d, 0xd4b213f3
and r8d, 0x54b213f3
add r8d, r8d
mov r10d, r9d
xor r10d, r8d
and r8d, r9d
lea r8d, [r10 + r8*2]
cmp edx, r8d
jl 0x203824f0
mov al, 0xf6
xchg byte [0x20595032], al
lea rax, [0x20595020]
ret
Function at 0x20384840
Capabilities:
Encode data using xor

Disassembly:
push rsi
xor eax, eax
sub eax, dword [0x205956f0]
mov edx, eax
xor edx, 0xea72641f
and eax, 0x6a72641f
lea eax, [rdx + rax*2]
add eax, ecx
jne 0x20384899
movzx eax, byte [0x205956cd]
movzx ecx, byte [0x205956e4]
add cl, 0xfa
cmp al, cl
je 0x2038499b
mov cl, 0x8b
nop dword [rax + rax]
mov al, 0x20
lock cmpxchg byte [0x205956cd], cl
je 0x20384941
cmp al, 0xae
jne 0x20384880
jmp 0x2038499b
movzx eax, byte [0x205955f4]
cmp al, 0xbd
je 0x20384a38
lea rax, [fcn.20384840]
lea ecx, [rax + rax]
add ecx, 0x1f40
mov edx, ecx
not edx
mov r8b, 0x7a
mov r9d, 0x158d9c08
nop word cs:[rax + rax]
test edx, ecx
jne 0x20384920
nop word cs:[rax + rax]
mov al, 0xc8
lock cmpxchg byte [0x205955f4], r8b
sete r10b
mov r11d, dword [0x205b6684]
mov esi, dword [0x205956f0]
add esi, r9d
cmp r11d, esi
jge 0x20384920
test r10b, r10b
jne 0x203849a4
cmp al, 0xbd
jne 0x203848d0
jmp 0x20384a38
mov al, 0xc8
lock cmpxchg byte [0x205955f4], r8b
mov eax, dword [0x205b6680]
lea r10d, [rax - 1]
imul r10d, eax
test r10b, 1
jne 0x20384920
jmp 0x203848e0
xor eax, eax
lea rcx, [0x205956c0]
lea rdx, [0x20490c30]
nop word cs:[rax + rax]
movsxd r8, eax
movzx r9d, byte [r8 + rdx]
add byte [r8 + rcx], r9b
not eax
mov r9d, eax
and r9d, 1
xor r8d, 1
and eax, 0x7ffffffe
or eax, r8d
and r8d, 0xfffffffe
or r8d, r9d
not eax
lea eax, [r8 + rax*2]
cmp eax, 0xd
jl 0x20384960
mov al, 0xae
xchg byte [0x205956cd], al
lea rax, [0x205956c0]
pop rsi
ret
xor eax, eax
lea rcx, [0x205955f0]
lea rdx, [0x20490b70]
mov r8d, 0x158d9be5
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x205956f0]
add r10d, r8d
cmp r9d, r10d
jge 0x203849e1
inc rax
jmp 0x203849c0
cmp dword [0x205956f0], 0xea72641f
jne 0x20384a2e
mov al, 0xbd
xchg byte [0x205955f4], al
mov eax, dword [0x205956f0]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xea72641e
xor eax, 0x158d9be1
and eax, ecx
or eax, edx
mov r8d, ecx
and r8d, 0x158d9be1
or r8d, edx
and ecx, 0x6a72641e
or ecx, r8d
not ecx
add ecx, ecx
add ecx, eax
je 0x20384a38
mov al, 0xbd
xchg byte [0x205955f4], al
jmp 0x203849ed
lea rax, [0x205955f0]
pop rsi
ret

Function at 0x20384aa0
Capabilities:
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x18], rdx
call fcn.2039b9e0
cmp byte [0x205b3870], 0
jne 0x20384adc
test byte [0x205b3cd9], 1
jne 0x20384adc
test rax, rax
je 0x20384adc
add rsp, 0x40
pop rbp
ret
mov ecx, 0x7f
call fcn.2016cfa0
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
mov r8d, 0x3030073
add rsp, 0x40
pop rbp
jmp fcn.20384c10
Function at 0x203876b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov eax, dword [0x20596a48]
mov ecx, eax
xor ecx, 0xda7fa12c
and eax, 0x5a7fa12c
lea eax, [rcx + rax*2]
lea rcx, [fcn.203876b0]
add ecx, ecx
add ecx, 0xfc0
mov edx, ecx
xor edx, eax
not eax
not ecx
and ecx, eax
or ecx, edx
cmp ecx, 0xffffffff
nop dword [rax + rax]
mov ecx, dword [0x205b6908]
mov eax, dword [0x205b73d8]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
mov r8d, dword [rax + 0x26838]
mov edx, dword [0x205b698c]
mov r9d, dword [0x20596a48]
mov eax, r9d
xor eax, 0x704d209f
mov r10d, r9d
and r10d, 0x704d209f
sub eax, edx
lea r10d, [rax + r10*2]
mov eax, 0x95cd7f73
sub eax, r10d
imul eax, edx
lea r10d, [r9 - 0x25805ed3]
xor edx, edx
div r10d
add r9d, 0xda7fa12b
cmp edx, r9d
jne 0x203876f0
cmp ecx, r8d
jg 0x20387769
lea rax, [0x205b68f0]
add rsp, 0x28
ret
lea rax, [fcn.203876b0]
lea ecx, [rax + rax]
add ecx, 0x8a1
add eax, eax
add eax, 0x8a0
not eax
mov edx, ecx
or edx, eax
and edx, ecx
mov ecx, eax
and ecx, edx
mov r8d, edx
and r8d, 0xfffffffe
xor r8d, ecx
and eax, 0xfffffffe
mov ecx, edx
and ecx, eax
or ecx, r8d
or eax, ecx
not edx
or edx, ecx
and edx, eax
cmp edx, 0xffffffff
jne 0x203877d0
lea rdx, [0x205b6908]
mov ecx, 1
mov r8d, 0xaea15085
mov r9d, 0xfbb057c6
call fcn.2027fe30
xor eax, eax
test al, al
je 0x2038781a
mov r9d, dword [0x20596a48]
mov eax, r9d
not eax
mov ecx, r9d
xor ecx, 0xda7fa12c
mov edx, eax
and eax, 0x25805ed3
or eax, ecx
and ecx, r9d
and edx, 0xda7fa12c
or edx, ecx
not eax
lea ecx, [rdx + rax*2]
lea r8d, [r9 - 0x76df0e50]
add r9d, 0xd62ff8f1
lea rdx, [0x205b6908]
call fcn.2027fe30
jmp 0x203877ad
cmp dword [0x205b6908], 0xffffffff
jne 0x2038775d
lea rax, [0x205961b0]
mov qword [0x205b68f0], rax
movabs rax, 0x900000090
mov qword [0x205b68f8], rax
mov eax, 0xa2cfe372
add eax, dword [0x20596a48]
mov dword [0x205b6900], eax
lea rdx, [0x205b6908]
xor ecx, ecx
mov r8d, 0xaea15085
mov r9d, 0xfbb057c6
call fcn.2027fe30
jmp 0x2038775d
Function at 0x20388a10
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, dword [0x20596be0]
mov r9d, r8d
xor r9d, 0x9b45b97
mov r10d, r9d
xor r10d, eax
and r9d, eax
lea eax, [r10 + r9*2]
cmp ecx, eax
jne 0x20388a6c
movzx eax, byte [0x20596aa0]
cmp al, 0xc0
je 0x20388a64
mov cl, 0x9e
nop word cs:[rax + rax]
mov al, 0xd2
lock cmpxchg byte [0x20596aa0], cl
je 0x20388b0c
cmp al, 0xc0
jne 0x20388a50
lea rax, [0x20596a90]
ret
test edx, edx
je 0x20388a9c
movzx eax, byte [0x20596b8c]
cmp al, 0xea
je 0x20388a94
mov cl, 0xab
nop dword [rax]
mov al, 0x93
lock cmpxchg byte [0x20596b8c], cl
je 0x20388b4f
cmp al, 0xea
jne 0x20388a80
lea rax, [0x20596b80]
ret
movzx eax, byte [0x20596a72]
nop word cs:[rax + rax]
cmp al, 0x1d
je 0x20388b97
movzx ecx, byte [0x20596bf0]
mov eax, r8d
xor al, 0x7a
add al, cl
mov edx, r8d
xor dl, 0xfa
add dl, cl
lock cmpxchg byte [0x20596a72], dl
jne 0x20388ab0
xor eax, eax
lea rcx, [0x20596a70]
lea rdx, [0x20490f50]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x20388b8f
inc rax
jmp 0x20388af0
xor edx, edx
lea rax, [0x20596a90]
lea rcx, [0x20490f70]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x20388b20
mov al, 0xc0
xchg byte [0x20596aa0], al
lea rax, [0x20596a90]
ret
xor edx, edx
lea rax, [0x20596b80]
lea rcx, [0x20491050]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xc
jl 0x20388b60
mov al, 0xea
xchg byte [0x20596b8c], al
lea rax, [0x20596b80]
ret
mov al, 0x1d
xchg byte [0x20596a72], al
lea rax, [0x20596a70]
ret
Function at 0x203902a0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x203902dc
test edx, edx
je 0x2039033c
movzx eax, byte [0x205971dc]
cmp al, 0x25
je 0x203902d4
mov cl, 0xeb
nop dword [rax]
mov al, 0xe5
lock cmpxchg byte [0x205971dc], cl
je 0x203903cc
cmp al, 0x25
jne 0x203902c0
lea rax, [0x205971d0]
ret
test edx, edx
je 0x2039036c
movzx eax, byte [0x2059721d]
nop dword [rax + rax]
cmp al, 0xe6
je 0x20390420
movzx ecx, byte [0x205978d4]
lea eax, [rcx + 0x6a]
add cl, 0x42
lock cmpxchg byte [0x2059721d], cl
jne 0x203902f0
xor eax, eax
lea rcx, [0x20597210]
lea rdx, [0x20491740]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x20390418
inc rax
jmp 0x20390320
movzx eax, byte [0x20597201]
cmp al, 0x55
je 0x20390364
mov cl, 0x47
nop dword [rax]
mov al, 0x4f
lock cmpxchg byte [0x20597201], cl
je 0x20390428
cmp al, 0x55
jne 0x20390350
lea rax, [0x205971f0]
ret
movzx eax, byte [0x20597261]
nop word cs:[rax + rax]
cmp al, 0x36
je 0x20390477
movzx eax, byte [0x205978d4]
lea ecx, [rax + 5]
lock cmpxchg byte [0x20597261], cl
jne 0x20390380
xor eax, eax
lea rcx, [0x20597250]
lea rdx, [0x20491780]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x2039046f
inc rax
jmp 0x203903b0
xor eax, eax
lea rcx, [0x205971d0]
lea rdx, [0x20491700]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x20390408
inc rax
jmp 0x203903e0
mov al, 0x25
xchg byte [0x205971dc], al
lea rax, [0x205971d0]
ret
mov al, 0xe6
xchg byte [0x2059721d], al
lea rax, [0x20597210]
ret
xor edx, edx
lea rax, [0x205971f0]
lea rcx, [0x20491720]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x11
jl 0x20390440
mov al, 0x55
xchg byte [0x20597201], al
lea rax, [0x205971f0]
ret
mov al, 0x36
xchg byte [0x20597261], al
lea rax, [0x20597250]
ret
Function at 0x203904c0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x203904fc
test edx, edx
je 0x2039053c
movzx eax, byte [0x205971b9]
cmp al, 0xf0
je 0x203904f4
mov cl, 0x35
nop word cs:[rax + rax]
mov al, 0x90
lock cmpxchg byte [0x205971b9], cl
je 0x203905dc
cmp al, 0xf0
jne 0x203904e0
lea rax, [0x205971b0]
ret
test edx, edx
je 0x2039059c
movzx eax, byte [0x2059724d]
cmp al, 0x34
je 0x20390534
mov cl, 0xd2
nop word cs:[rax + rax]
mov al, 0x6d
lock cmpxchg byte [0x2059724d], cl
je 0x20390641
cmp al, 0x34
jne 0x20390520
lea rax, [0x20597240]
ret
movzx eax, byte [0x20597193]
nop word cs:[rax + rax]
cmp al, 0xac
je 0x203906a7
movzx ecx, byte [0x205978d4]
lea eax, [rcx + 0x60]
add cl, 0xc9
lock cmpxchg byte [0x20597193], cl
jne 0x20390550
xor eax, eax
lea rcx, [0x20597170]
lea rdx, [0x204916a0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x2039069f
inc rax
jmp 0x20390580
movzx eax, byte [0x205971cd]
movzx ecx, byte [0x205978d4]
add cl, 0x2a
cmp al, cl
je 0x203905d4
mov cl, 0x5d
nop word cs:[rax + rax]
mov al, 0x7c
lock cmpxchg byte [0x205971cd], cl
je 0x203906af
cmp al, 0x11
jne 0x203905c0
lea rax, [0x205971c0]
ret
xor eax, eax
lea rcx, [0x205971b0]
lea rdx, [0x204916e0]
mov r8d, 0xb62bd7eb
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x205978c0]
add r10d, r8d
cmp r9d, r10d
jge 0x20390631
inc rax
jmp 0x20390600
mov al, 0xf0
xchg byte [0x205971b9], al
lea rax, [0x205971b0]
ret
xor edx, edx
lea rax, [0x20597240]
lea rcx, [0x20491770]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x20390660
mov al, 0x34
xchg byte [0x2059724d], al
lea rax, [0x20597240]
ret
mov al, 0xac
xchg byte [0x20597193], al
lea rax, [0x20597170]
ret
xor edx, edx
lea rax, [0x205971c0]
lea rcx, [0x204916f0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x203906c0
movzx eax, byte [0x205978d4]
add al, 0x2a
xchg byte [0x205971cd], al
lea rax, [0x205971c0]
ret
Function at 0x20397ef0
Capabilities:
Encode data using xor

Disassembly:
test rcx, rcx
je 0x20397f5a
movabs rdx, 0x846e90b8d768e544
xor eax, eax
mov r8d, 1
xor r9d, r9d
nop word [rax + rax]
movzx r10d, byte [0x2059a200]
mov r11d, r10d
xor r11b, 0xa4
and r10b, 0x24
add r10b, r10b
add r10b, r11b
add r10b, 0x18
xor r11d, r11d
cmp byte [rcx + rax], r10b
movzx r9d, r9b
cmove r9d, r8d
setne r11b
mov r10, r11
xor r10, rax
and r11d, eax
sub r10, rdx
lea rax, [r10 + r11*2]
add rax, rdx
test r9b, 1
je 0x20397f10
ret
xor eax, eax
ret
Function at 0x2039e350
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x2039e39c
mov eax, r8d
xor eax, 0x6d6890eb
add eax, dword [0x2059a204]
cmp edx, eax
jne 0x2039e3cc
movzx eax, byte [0x20599119]
cmp al, 6
je 0x2039e394
mov cl, 0x85
nop dword [rax + rax]
mov al, 0x8f
lock cmpxchg byte [0x20599119], cl
je 0x2039e438
cmp al, 6
jne 0x2039e380
lea rax, [0x20599110]
ret
test edx, edx
je 0x2039e3fc
movzx eax, byte [0x20599002]
cmp al, 0x14
je 0x2039e3c4
mov cl, 0xf
nop dword [rax]
mov al, 0xa0
lock cmpxchg byte [0x20599002], cl
je 0x2039e4e1
cmp al, 0x14
jne 0x2039e3b0
lea rax, [0x20599000]
ret
movzx eax, byte [0x205990c3]
cmp al, 0x14
je 0x2039e3f4
mov cl, 0x93
nop dword [rax]
mov al, 0xbe
lock cmpxchg byte [0x205990c3], cl
je 0x2039e478
cmp al, 0x14
jne 0x2039e3e0
lea rax, [0x205990c0]
ret
movzx eax, byte [0x2059905b]
cmp al, 0x36
je 0x2039e430
mov cl, 0xbc
nop dword [rax]
mov al, 0x69
lock cmpxchg byte [0x2059905b], cl
je 0x2039e52f
mov edx, r8d
xor dl, 0xa4
add dl, byte [0x2059a200]
cmp al, dl
jne 0x2039e410
lea rax, [0x20599040]
ret
xor eax, eax
lea rcx, [0x20599110]
lea rdx, [0x20491e80]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x2039e4d1
inc rax
jmp 0x2039e450
xor eax, eax
lea rcx, [0x205990c0]
lea rdx, [0x20491e30]
xor r8d, 0x6d6890e8
nop
cdqe
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
mov r9d, dword [0x2059a204]
add r9d, r8d
add eax, r9d
cmp eax, 3
jl 0x2039e490
mov al, 0x14
xchg byte [0x205990c3], al
lea rax, [0x205990c0]
ret
mov al, 6
xchg byte [0x20599119], al
lea rax, [0x20599110]
ret
xor edx, edx
lea rax, [0x20599000]
lea rcx, [0x20491d80]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 2
jl 0x2039e500
mov al, 0x14
xchg byte [0x20599002], al
lea rax, [0x20599000]
ret
xor eax, eax
lea rcx, [0x20599040]
lea rdx, [0x20491dc0]
xor r8d, 0x6d68908e
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x2059a204]
add r10d, r8d
cmp r9d, r10d
jge 0x2039e571
inc rax
jmp 0x2039e550
mov al, 0x36
xchg byte [0x2059905b], al
lea rax, [0x20599040]
ret