joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401f8e90
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
test ecx, ecx
je 0x1401f8f25
mov edi, dword [rsp + 0x90]
mov ecx, edx
mov edx, 0xe551cfe2
call fcn.1400712d0
test al, 1
je 0x1401f8f69
movzx eax, byte [0x14053703f]
cmp al, 0x54
je 0x1401f908b
mov bl, 0xc5
lea rsi, [rsp + 0x2e]
xor edi, 0x9cc6a923
nop dword [rax + rax]
mov al, 0xb3
lock cmpxchg byte [0x14053703f], bl
sete bpl
sete dl
mov ecx, eax
mov r8, rsi
mov r9d, 0x6ae402bd
call fcn.140169170
test bpl, bpl
jne 0x1401f8fed
movzx ecx, byte [rsp + 0x2e]
mov edx, dword [0x1405379a0]
add edx, edi
call fcn.1401f6310
test al, 1
je 0x1401f8ee0
jmp 0x1401f908b
mov ecx, edx
mov edx, 0x10e0a855
call fcn.1400712d0
test al, 1
je 0x1401f8fa4
mov ecx, 0x5de884f
call fcn.1401f4ca0
test al, 1
jne 0x1401f9126
mov cl, 0x1f
nop dword [rax]
mov al, 0xcf
lock cmpxchg byte [0x140536d34], cl
je 0x1401f9097
cmp al, 0xb9
jne 0x1401f8f50
jmp 0x1401f9126
movzx eax, byte [0x14053702d]
cmp al, 0xe9
je 0x1401f9077
mov cl, 0xea
nop word [rax + rax]
mov al, 0x4d
lock cmpxchg byte [0x14053702d], cl
je 0x1401f9035
mov edx, edi
xor dl, 0xae
add dl, byte [0x1405379a8]
cmp al, dl
jne 0x1401f8f80
jmp 0x1401f9077
movzx eax, byte [0x14053706d]
cmp al, 0xfb
je 0x1401f9137
lea rsi, [rsp + 0x2c]
nop dword [rax + rax]
mov rcx, rsi
mov edx, 0x2443cce0
call fcn.1401f50c0
test al, 1
jne 0x1401f90c8
movzx ecx, byte [rsp + 0x2c]
mov edx, 0xf66009d6
call fcn.1401f60f0
test al, 1
je 0x1401f8fc0
jmp 0x1401f9137
xor esi, esi
lea r14, [0x140537030]
lea rdi, [rsp + 0x2f]
lea rbx, [rsp + 0x30]
movzx edx, byte [rsi + r14]
mov dword [rsp + 0x20], 0xa703d976
mov ecx, esi
mov r8, rdi
mov r9, rbx
call fcn.1401f5e60
movzx eax, byte [rsp + 0x2f]
mov rcx, qword [rsp + 0x30]
mov byte [rcx + r14], al
lea eax, [rsi + 1]
cmp eax, 0xe
jg 0x1401f9083
inc rsi
jmp 0x1401f9000
xor eax, eax
lea rcx, [0x140537020]
lea rdx, [0x140453280]
xor edi, 0x6a93393c
nop dword [rax + rax]
cdqe
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
mov r8d, dword [0x1405379a0]
add r8d, edi
add eax, r8d
cmp eax, 0xd
jl 0x1401f9050
mov ecx, 0xe838f7d
call fcn.1401f5c20
lea rax, [0x140537020]
jmp 0x1401f913e
mov al, 0x54
xchg byte [0x14053703f], al
lea rax, [0x140537030]
jmp 0x1401f913e
xor eax, eax
lea rcx, [0x140536d20]
lea rdx, [0x140452f80]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x13
jg 0x1401f911c
inc rax
jmp 0x1401f90b0
xor ebx, ebx
lea r14, [0x140537060]
lea r15, [0x1404532c0]
lea rsi, [rsp + 0x2d]
nop dword [rax]
lea rdi, [r14 + rbx]
movzx ecx, byte [rbx + r14]
movzx edx, byte [rbx + r15]
mov r8, rsi
mov r9d, 0xa3e13497
call fcn.140132a30
movzx ecx, byte [rsp + 0x2d]
mov rdx, rdi
mov r8d, 0x27eb8c4f
call fcn.1400ae330
lea eax, [rbx + 1]
cmp eax, 0xc
jg 0x1401f912f
inc rbx
jmp 0x1401f90e0
mov ecx, 0xaa95bc73
call fcn.1401f6080
lea rax, [0x140536d20]
jmp 0x1401f913e
mov al, 0xfb
xchg byte [0x14053706d], al
lea rax, [0x140537060]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1401f97f0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1401f982c
test edx, edx
je 0x1401f986c
movzx eax, byte [0x140536c01]
cmp al, 0x19
je 0x1401f9824
mov cl, 0x2e
nop word [rax + rax]
mov al, 0x25
lock cmpxchg byte [0x140536c01], cl
je 0x1401f990c
cmp al, 0x19
jne 0x1401f9810
lea rax, [0x140536bf0]
ret
test edx, edx
je 0x1401f98dc
movzx eax, byte [0x140536763]
cmp al, 0x8c
je 0x1401f9864
mov cl, 0x85
nop word cs:[rax + rax]
mov al, 0xb5
lock cmpxchg byte [0x140536763], cl
je 0x1401f9968
cmp al, 0x8c
jne 0x1401f9850
lea rax, [0x140536760]
ret
movzx eax, byte [0x140536cb0]
nop word cs:[rax + rax]
cmp al, 0xff
je 0x1401f9960
movzx ecx, byte [0x1405379a8]
mov eax, r8d
xor al, 0x37
add al, cl
mov edx, r8d
xor dl, 0x35
add dl, cl
lock cmpxchg byte [0x140536cb0], dl
jne 0x1401f9880
xor eax, eax
lea rcx, [0x140536ca0]
lea rdx, [0x140452f10]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1401f9958
inc rax
jmp 0x1401f98c0
movzx eax, byte [0x140536d9d]
cmp al, 0x57
je 0x1401f9904
mov cl, 0x99
nop dword [rax]
mov al, 0xea
lock cmpxchg byte [0x140536d9d], cl
je 0x1401f99a8
cmp al, 0x57
jne 0x1401f98f0
lea rax, [0x140536d90]
ret
xor eax, eax
lea rcx, [0x140536bf0]
lea rdx, [0x140452e60]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x1401f9948
inc rax
jmp 0x1401f9920
mov al, 0x19
xchg byte [0x140536c01], al
lea rax, [0x140536bf0]
ret
mov al, 0xff
xchg byte [0x140536cb0], al
lea rax, [0x140536ca0]
ret
xor eax, eax
lea rcx, [0x140536760]
lea rdx, [0x1404529f0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1401f9998
inc rax
jmp 0x1401f9980
mov al, 0x8c
xchg byte [0x140536763], al
lea rax, [0x140536760]
ret
xor eax, eax
lea rcx, [0x140536d90]
lea rdx, [0x140452ff0]
xor r8d, 0x4186bf07
nop
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x1405379a0]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 0xd
jl 0x1401f99c0
mov al, 0x57
xchg byte [0x140536d9d], al
lea rax, [0x140536d90]
ret
Function at 0x14024e470
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14024e4c6
mov eax, dword [0x140543358]
mov ecx, eax
xor ecx, 0x22932e3a
and eax, 0x22932e3a
lea eax, [rcx + rax*2]
cmp edx, eax
jne 0x14024e506
movzx eax, byte [0x140543094]
cmp al, 0x60
je 0x14024e4be
mov cl, 0x20
nop dword [rax + rax]
mov al, 0x5b
lock cmpxchg byte [0x140543094], cl
je 0x14024e5c6
movzx edx, byte [0x14054335c]
add dl, 0xae
cmp al, dl
jne 0x14024e4a0
lea rax, [0x140543090]
ret
test edx, edx
je 0x14024e591
movzx eax, byte [0x1405431fd]
cmp al, 0xde
je 0x14024e4fe
mov cl, 0x8f
nop dword [rax + rax]
mov al, 0xe
lock cmpxchg byte [0x1405431fd], cl
je 0x14024e618
movzx edx, byte [0x14054335c]
add dl, 0x2c
cmp al, dl
jne 0x14024e4e0
lea rax, [0x1405431f0]
ret
movzx eax, byte [0x14054330d]
nop dword [rax]
cmp al, 0xae
je 0x14024e589
movzx ecx, byte [0x14054335c]
lea eax, [rcx - 0x27]
add cl, 0xad
lock cmpxchg byte [0x14054330d], cl
jne 0x14024e510
xor edx, edx
lea rax, [0x140543300]
lea rcx, [0x140456b80]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140543358]
add edx, r8d
add edx, 0x22932e3b
cmp edx, 0xd
jl 0x14024e540
movzx eax, byte [0x14054335c]
mov ecx, eax
xor cl, 0xfc
and al, 0x7c
add al, al
add al, cl
xchg byte [0x14054330d], al
lea rax, [0x140543300]
ret
movzx eax, byte [0x14054317f]
cmp al, 0xbd
je 0x14024e5be
mov cl, 0x1a
nop
mov al, 0x44
lock cmpxchg byte [0x14054317f], cl
je 0x14024e65f
movzx edx, byte [0x14054335c]
add dl, 0xb
cmp al, dl
jne 0x14024e5a0
lea rax, [0x140543170]
ret
xor eax, eax
lea rcx, [0x140543090]
lea rdx, [0x140456930]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x14024e608
inc rax
jmp 0x14024e5e0
mov al, 0x60
xchg byte [0x140543094], al
lea rax, [0x140543090]
ret
xor eax, eax
lea rcx, [0x1405431f0]
lea rdx, [0x140456a70]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14024e648
inc rax
jmp 0x14024e630
movzx eax, byte [0x14054335c]
add al, 0x2c
xchg byte [0x1405431fd], al
lea rax, [0x1405431f0]
ret
xor eax, eax
lea rcx, [0x140543170]
lea rdx, [0x1404569f0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x14024e688
inc rax
jmp 0x14024e670
mov al, 0xbd
xchg byte [0x14054317f], al
lea rax, [0x140543170]
ret
Function at 0x14024e700
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x14024e739
test edx, edx
je 0x14024e789
movzx eax, byte [0x14054320c]
cmp al, 0x20
je 0x14024e860
mov cl, 0x4c
nop
mov al, 0x19
lock cmpxchg byte [0x14054320c], cl
je 0x14024e825
cmp al, 0x20
jne 0x14024e720
jmp 0x14024e860
mov eax, r8d
xor eax, 0x3e4b9f70
add eax, dword [0x140543358]
cmp edx, eax
jne 0x14024e7e5
movzx eax, byte [0x140543163]
mov ecx, r8d
xor cl, 0xb7
add cl, byte [0x14054335c]
cmp al, cl
je 0x14024e980
mov cl, 0x99
nop dword [rax]
mov al, 0x22
lock cmpxchg byte [0x140543163], cl
je 0x14024e8dd
cmp al, 0xaf
jne 0x14024e770
jmp 0x14024e980
movzx eax, byte [0x14054324f]
movzx ecx, byte [0x14054335c]
mov edx, r8d
xor dl, 0x69
mov r9d, edx
xor r9b, cl
and dl, cl
add dl, dl
add dl, r9b
cmp al, dl
je 0x14024e8d4
mov cl, 0x54
nop word cs:[rax + rax]
mov al, 0xf8
lock cmpxchg byte [0x14054324f], cl
je 0x14024e869
mov edx, r8d
xor dl, 0x69
add dl, byte [0x14054335c]
cmp al, dl
jne 0x14024e7c0
jmp 0x14024e8d4
movzx eax, byte [0x14054325d]
cmp al, 0xe2
je 0x14024e96f
mov cl, 0x53
nop word cs:[rax + rax]
mov al, 0x22
lock cmpxchg byte [0x14054325d], cl
je 0x14024e921
mov edx, r8d
xor dl, 0x7a
add dl, byte [0x14054335c]
cmp al, dl
jne 0x14024e800
jmp 0x14024e96f
xor eax, eax
lea rcx, [0x140543200]
lea rdx, [0x140456a80]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x14024e858
inc rax
jmp 0x14024e840
mov al, 0x20
xchg byte [0x14054320c], al
lea rax, [0x140543200]
pop rsi
ret
xor r9d, r9d
lea rax, [0x140543240]
lea rcx, [0x140456ac0]
mov edx, r8d
xor edx, 0x3e4b9f71
xor r8d, 0x3e4b9f03
nop word [rax + rax]
movsxd r9, r9d
movzx r10d, byte [r9 + rcx]
mov r11d, r10d
xor r11b, r10b
not r11b
and r11b, byte [r9 + rax]
xor r11b, r10b
mov byte [r9 + rax], r11b
mov r10d, dword [0x140543358]
lea r11d, [rdx + r10]
mov esi, r9d
xor esi, r11d
and r9d, r11d
lea r9d, [rsi + r9*2]
add r10d, r8d
cmp r9d, r10d
jl 0x14024e890
mov al, 0xd5
xchg byte [0x14054324f], al
lea rax, [0x140543240]
pop rsi
ret
xor eax, eax
lea rcx, [0x140543140]
lea rdx, [0x1404569c0]
xor r8d, 0x3e4b9f17
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140543358]
add r10d, r8d
cmp r9d, r10d
jge 0x14024e978
inc rax
jmp 0x14024e900
xor eax, eax
lea rcx, [0x140543250]
lea rdx, [0x140456ad0]
xor r8d, 0x3e4b9f71
nop dword [rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x140543358]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 0xd
jl 0x14024e940
mov al, 0xe2
xchg byte [0x14054325d], al
lea rax, [0x140543250]
pop rsi
ret
mov al, 0xaf
xchg byte [0x140543163], al
lea rax, [0x140543140]
pop rsi
ret
Function at 0x14024e990
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x14024e9c9
test edx, edx
je 0x14024ea09
movzx eax, byte [0x1405431cd]
cmp al, 0xad
je 0x14024eb0d
mov cl, 0x6d
nop
mov al, 0x10
lock cmpxchg byte [0x1405431cd], cl
je 0x14024eaa9
cmp al, 0xad
jne 0x14024e9b0
jmp 0x14024eb0d
test edx, edx
je 0x14024ea77
movzx eax, byte [0x140543133]
cmp al, 0x31
je 0x14024ebb6
mov cl, 0x53
nop word cs:[rax + rax]
mov al, 0x64
lock cmpxchg byte [0x140543133], cl
je 0x14024eb16
cmp al, 0x31
jne 0x14024e9f0
jmp 0x14024ebb6
movzx eax, byte [0x1405432fd]
mov ecx, r8d
xor cl, 0x29
add cl, byte [0x14054335c]
cmp al, cl
je 0x14024eba5
nop word cs:[rax + rax]
movzx ecx, byte [0x14054335c]
mov eax, r8d
xor al, 0x6d
add al, cl
mov edx, r8d
xor dl, 0x9b
add dl, cl
lock cmpxchg byte [0x1405432fd], dl
je 0x14024eb58
movzx ecx, byte [0x14054335c]
mov edx, r8d
xor dl, 0x29
mov r9d, edx
xor r9b, cl
and dl, cl
add dl, dl
add dl, r9b
cmp al, dl
jne 0x14024ea30
jmp 0x14024eba5
movzx eax, byte [0x1405431e3]
cmp al, 0xdc
je 0x14024ec09
mov cl, 0x79
nop dword [rax + rax]
mov al, 0xa6
lock cmpxchg byte [0x1405431e3], cl
je 0x14024ebbf
cmp al, 0xdc
jne 0x14024ea90
jmp 0x14024ec09
xor eax, eax
lea rcx, [0x1405431c0]
lea rdx, [0x140456a40]
mov r9d, r8d
xor r9d, 0x96325e4c
nop word cs:[rax + rax]
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x140543358]
mov esi, r9d
xor esi, r11d
and r11d, r9d
lea r11d, [rsi + r11*2]
cmp r10d, r11d
jge 0x14024eafb
inc rax
jmp 0x14024ead0
xor r8b, 0xf0
add r8b, byte [0x14054335c]
xchg byte [0x1405431cd], r8b
lea rax, [0x1405431c0]
pop rsi
ret
xor eax, eax
lea rcx, [0x140543130]
lea rdx, [0x1404569b0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x14024ebae
inc rax
jmp 0x14024eb30
xor eax, eax
lea rcx, [0x1405432f0]
lea rdx, [0x140456b70]
xor r8d, 0x96325e30
nop
cdqe
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
mov r9d, dword [0x140543358]
add r9d, r8d
add eax, r9d
cmp eax, 0xd
jl 0x14024eb70
mov al, 0xd4
xchg byte [0x1405432fd], al
lea rax, [0x1405432f0]
pop rsi
ret
mov al, 0x31
xchg byte [0x140543133], al
lea rax, [0x140543130]
pop rsi
ret
xor eax, eax
lea rcx, [0x1405431d0]
lea rdx, [0x140456a50]
xor r8d, 0x96325e46
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140543358]
add r10d, r8d
cmp r9d, r10d
jge 0x14024ec01
inc rax
jmp 0x14024ebe0
mov al, 0xdc
xchg byte [0x1405431e3], al
lea rax, [0x1405431d0]
pop rsi
ret
Function at 0x140254f20
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140544ea8]
movabs rcx, 0xf9a35477669cfa31
movabs rdx, 0xf3133d3fd397e6b7
add rdx, rcx
movabs r8, 0x9bbdac2fa780a04c
sub rdx, r8
sub rdx, rcx
mov rcx, rdx
xor rcx, rax
and rdx, rax
lea rax, [rcx + rdx*2]
add rax, r8
cmp qword [rbx + 0x18], rax
je 0x1402550fd
lea rdi, [rbx + 8]
cmp byte [0x14058ed00], 0
jne 0x140254fe0
mov eax, 0xffff62cd
add eax, dword [0x1405438d4]
cdqe
add rax, qword [0x1405438e0]
mov rcx, rbx
call qword [case.0x140114b5b.0]
mov ecx, eax
mov edx, dword [0x140590250]
lea eax, [rdx - 1]
imul eax, edx
mov r8d, dword [0x140544ea0]
mov edx, r8d
xor edx, 0x4aefac7c
mov r9d, r8d
and r9d, 0x4aefac7c
lea r9d, [rdx + r9*2]
xor edx, edx
div r9d
add r8d, 0x4aefac7a
cmp edx, r8d
je 0x140255026
nop
mov eax, 0x809adc47
sub eax, dword [0x1405438d4]
mov ecx, eax
xor ecx, 0x7f65c0ec
and eax, 0x7f65c0ec
lea eax, [rcx + rax*2]
mov ecx, dword [0x140544ea0]
neg eax
add eax, ecx
add eax, 0x4aefac7a
cdqe
add rax, qword [0x1405438e0]
mov rcx, rbx
call qword [case.0x140114b5b.0]
test rbx, rbx
je 0x140254fe0
jmp 0x140254f84
test cl, cl
je 0x140255040
mov eax, 0xffff62cd
add eax, dword [0x1405438d0]
cdqe
add rax, qword [0x1405438f0]
jmp 0x14025505a
mov eax, dword [0x1405438d8]
sub eax, dword [0x140544ea0]
add eax, 0xb50fb653
cdqe
add rax, qword [0x1405438f8]
mov rcx, rsi
call qword [case.0x140114b5b.0]
mov r8, qword [rbx + 0x18]
cmp qword [rbx + 0x20], 0x10
jb 0x140255072
mov rdi, qword [rbx + 8]
lea rbx, [rsi + 8]
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x20]
mov rdx, rax
sub rdx, rcx
cmp rdx, r8
jae 0x1402550b3
mov eax, 0xffff62cd
add eax, dword [0x1405438dc]
cdqe
add rax, qword [0x1405438e8]
mov qword [rsp + 0x20], r8
mov rcx, rbx
mov rdx, r8
mov r9, rdi
call qword [case.0x140114b5b.0]
jmp 0x1402550fd
mov rdx, r8
not rdx
mov r9, rcx
xor r9, rdx
xor rdx, r8
and rdx, rcx
xor rdx, r8
and r9, rcx
movabs r10, 0x52d1ad84af96f83a
sub rdx, r10
lea r14, [rdx + r9*2]
add r14, r10
mov qword [rsi + 0x18], r14
cmp rax, 0x10
jb 0x1402550ed
mov rbx, qword [rsi + 8]
add rcx, rbx
mov rdx, rdi
call fcn.14042d4b0
mov byte [rbx + r14], 0
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14027c190
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1405496e0]
mov r8d, eax
xor r8d, 0xc0bc3fff
and eax, 0x40bc3fff
lea eax, [r8 + rax*2]
cmp ecx, eax
jne 0x14027c1ec
mov eax, 0xc0bc3fff
add eax, dword [0x1405496e0]
cmp edx, eax
jne 0x14027c218
movzx eax, byte [0x140548a34]
cmp al, 0x53
je 0x14027c1e4
mov cl, 0x35
nop dword [rax]
mov al, 0xf
lock cmpxchg byte [0x140548a34], cl
je 0x14027c2ea
cmp al, 0x53
jne 0x14027c1d0
lea rax, [0x140548a20]
ret
test edx, edx
je 0x14027c24c
movzx eax, byte [0x140548a5a]
cmp al, 0x4b
je 0x14027c210
mov cl, 0x31
nop dword [rax]
mov al, pe_nt_image_headers64
lock cmpxchg byte [0x140548a5a], cl
je 0x14027c27c
cmp al, 0x4b
jne 0x14027c200
lea rax, [0x140548a50]
ret
movzx eax, byte [0x140548af6]
movzx ecx, byte [0x1405496f0]
add cl, 0x12
cmp al, cl
je 0x14027c244
mov cl, 0xed
nop
mov al, 0xd2
lock cmpxchg byte [0x140548af6], cl
je 0x14027c34c
cmp al, 0x2d
jne 0x14027c230
lea rax, [0x140548ae0]
ret
movzx eax, byte [0x140548a44]
cmp al, 0x64
je 0x14027c274
mov cl, 0x61
nop dword [rax]
mov al, 0x94
lock cmpxchg byte [0x140548a44], cl
je 0x14027c395
cmp al, 0x64
jne 0x14027c260
lea rax, [0x140548a40]
ret
xor eax, eax
lea rcx, [0x140548a50]
lea rdx, [0x140458a10]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
mov r9d, dword [0x1405496e0]
mov r10d, r9d
xor r10d, 0x40ea7758
and r9d, 0x40ea7758
lea r9d, [r10 + r9*2]
add r9d, 0x7fd1c8b1
cmp r8d, r9d
jge 0x14027c2da
inc rax
jmp 0x14027c290
mov al, 0x4b
xchg byte [0x140548a5a], al
lea rax, [0x140548a50]
ret
xor edx, edx
lea rax, [0x140548a20]
lea rcx, [0x1404589e0]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1405496e0]
mov r9d, edx
xor r9d, 0xb1744dd0
and edx, 0x31744dd0
lea edx, [r9 + rdx*2]
add edx, r8d
add edx, 0xf47f230
cmp edx, 0x14
jl 0x14027c300
movzx eax, byte [0x1405496f0]
add al, 0x38
xchg byte [0x140548a34], al
lea rax, [0x140548a20]
ret
xor edx, edx
lea rax, [0x140548ae0]
lea rcx, [0x140458a90]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0x7ffffffe
and r8d, edx
xor edx, 1
lea edx, [rdx + r8*2]
cmp edx, 0x16
jl 0x14027c360
mov al, 0x2d
xchg byte [0x140548af6], al
lea rax, [0x140548ae0]
ret
xor eax, eax
lea rcx, [0x140548a40]
lea rdx, [0x140458a00]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x14027c3c8
inc rax
jmp 0x14027c3b0
movzx eax, byte [0x1405496f0]
mov ecx, eax
xor cl, 0x49
and al, 0x49
add al, al
add al, cl
xchg byte [0x140548a44], al
lea rax, [0x140548a40]
ret
Function at 0x1402b51a0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1402b51dc
test edx, edx
je 0x1402b525f
movzx eax, byte [0x140553993]
cmp al, 0x94
je 0x1402b51d4
mov cl, 0x2e
nop
mov al, 0x21
lock cmpxchg byte [0x140553993], cl
je 0x1402b52dc
cmp al, 0x94
jne 0x1402b51c0
lea rax, [0x140553970]
ret
test edx, edx
je 0x1402b528c
movzx eax, byte [0x140553820]
nop dword [rax + rax]
cmp al, 3
je 0x1402b533f
movzx ecx, byte [0x1405539cc]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0x97
mov eax, r8d
and al, 0x68
or al, r9b
add al, cl
and dl, 0x5e
mov r9d, r8d
and r9b, 0xa1
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x140553820], r9b
jne 0x1402b51f0
xor eax, eax
lea rcx, [0x140553720]
lea rdx, [0x14045f050]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xff
jg 0x1402b5337
inc rax
jmp 0x1402b5240
movzx eax, byte [0x1405539af]
cmp al, 0x83
je 0x1402b5284
mov cl, 0x85
nop dword [rax]
mov al, 0x20
lock cmpxchg byte [0x1405539af], cl
je 0x1402b5347
cmp al, 0x83
jne 0x1402b5270
lea rax, [0x1405539a0]
ret
movzx eax, byte [0x14055384e]
cmp al, 0x3b
je 0x1402b52d4
nop word [rax + rax]
movzx ecx, byte [0x1405539cc]
mov eax, r8d
xor al, 0xf3
add al, cl
mov edx, r8d
xor dl, 0xf6
add dl, cl
lock cmpxchg byte [0x14055384e], dl
je 0x1402b53ab
mov ecx, r8d
xor cl, 0x9b
add cl, byte [0x1405539cc]
cmp al, cl
jne 0x1402b52a0
lea rax, [0x140553830]
ret
xor eax, eax
lea rcx, [0x140553970]
lea rdx, [0x14045f280]
nop dword [rax]
xor r8d, r8d
sub r8b, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
xor r10d, r10d
sub r10b, r9b
mov r9d, r8d
xor r9b, r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
neg r10b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1402b5327
inc rax
jmp 0x1402b52f0
mov al, 0x94
xchg byte [0x140553993], al
lea rax, [0x140553970]
ret
mov al, 3
xchg byte [0x140553820], al
lea rax, [0x140553720]
ret
xor eax, eax
lea rcx, [0x1405539a0]
lea rdx, [0x14045f2b0]
mov r9d, r8d
xor r9d, 0xbb7172c0
nop word cs:[rax + rax]
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x1405539c8]
add r11d, r9d
cmp r10d, r11d
jge 0x1402b5391
inc rax
jmp 0x1402b5370
xor r8b, 0x53
add r8b, byte [0x1405539cc]
xchg byte [0x1405539af], r8b
lea rax, [0x1405539a0]
ret
xor eax, eax
lea rcx, [0x140553830]
lea rdx, [0x14045f150]
xor r8d, 0xbb7172f2
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
mov r9d, dword [0x1405539c8]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 0x1e
jl 0x1402b53d0
mov al, 0x3b
xchg byte [0x14055384e], al
lea rax, [0x140553830]
ret
Function at 0x1402c89f0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rcx
mov eax, dword [0x1405910fc]
cmp eax, 0x5f
jg 0x1402c8a20
mov eax, dword [0x1405910fc]
cmp eax, 0x5b
jl 0x1402c8a2d
nop word cs:[rax + rax]
mov eax, dword [0x1405910fc]
cmp eax, 0x4f
jge 0x1402c8a20
jmp 0x1402c8a08
mov esi, 0xfffffffe
test rdi, rdi
je 0x1402c8c16
cmp qword [rdi + 0x30], 0
je 0x1402c8c16
cmp qword [rdi + 0x38], 0
je 0x1402c8c16
mov r14, qword [rdi + 0x28]
test r14, r14
je 0x1402c8c16
cmp qword [r14], rdi
jne 0x1402c8c16
mov eax, dword [0x1405910f8]
mov ecx, dword [0x1405575c8]
not ecx
add ecx, eax
add ecx, 0x13c7bc34
imul ecx, eax
test cl, 1
jne 0x1402c8ab2
mov ecx, dword [r14 + 8]
mov r8d, dword [0x14058ef04]
mov edx, dword [0x1405910f8]
lea eax, [rdx - 1]
imul eax, edx
mov r9d, 0x8d784e6a
add r9d, dword [0x1405575c8]
xor edx, edx
div r9d
test edx, edx
je 0x1402c8ae0
lea rbx, [0x1402d3260]
mov bpl, 1
nop dword [rax]
mov ecx, 0x3d
call fcn.1403e5794
mov qword [0x1405910f0], rax
mov rcx, rbx
call fcn.1404058a4
test bpl, bpl
je 0x1402c8ac0
jmp 0x1402c8a85
lea eax, [r8 + rcx]
add eax, 0xffffc0cc
cmp eax, 0x1f
ja 0x1402c8c16
mov rax, qword [rdi + 0x28]
mov qword [rax + 0x34], 0
mov dword [rax + 0x3c], 0
cmp qword [rdi + 0x30], 0
je 0x1402c8c16
cmp qword [rdi + 0x38], 0
je 0x1402c8c16
mov rax, qword [rdi + 0x28]
test rax, rax
je 0x1402c8c16
cmp qword [rax], rdi
jne 0x1402c8c16
mov ecx, dword [rax + 8]
mov edx, dword [0x1405575c8]
add ecx, edx
add ecx, 0x8d780f34
cmp ecx, 0x20
setae cl
setb r8b
movzx edx, byte [0x14058f160]
mov r9d, edx
xor r9b, 1
mov r10d, r8d
xor r10b, r9b
test r10b, r8b
jne 0x1402c8b72
and r9b, r8b
jne 0x1402c8b72
and dl, cl
je 0x1402c8c16
mov dword [rax + 0x24], 0
mov dword [rdi + 0x1c], 0
mov dword [rdi + 0xc], 0
mov qword [rdi + 0x20], 0
mov ecx, dword [rax + 0x10]
test ecx, ecx
je 0x1402c8bb3
mov edx, 0x8d784e69
add edx, dword [0x1405575c8]
mov r8d, ecx
xor r8d, edx
or edx, ecx
not edx
or edx, r8d
not edx
mov dword [rdi + 0x4c], edx
mov qword [rax + 8], 0x3f34
movabs rcx, 0xffffffff00000000
mov qword [rax + 0x14], rcx
mov dword [rax + 0x1c], 0x8000
mov qword [rax + 0x28], 0
mov ecx, 0x8d784e68
add ecx, dword [0x1405575c8]
mov dword [rax + 0x48], ecx
mov dword [rax + 0x4c], 0
lea rcx, [rax + 0x550]
mov qword [rax + 0x88], rcx
mov qword [rax + 0x68], rcx
mov qword [rax + 0x60], rcx
movabs rcx, 0xffffffff00000001
mov qword [rax + 0x1be0], rcx
xor esi, esi
mov eax, dword [0x1405910f8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x1402c8c30
mov al, 1
test al, al
jne 0x1402c8c53
nop dword [rax]
mov eax, dword [0x1405910fc]
mov ecx, dword [0x1405575c8]
mov edx, ecx
xor edx, 0x8d784ebc
and ecx, 0xd784ebc
lea ecx, [rdx + rcx*2]
cmp eax, ecx
jge 0x1402c8c30
jmp 0x1402c8c27
mov eax, esi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret