joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14015ed20
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14015ed5c
test edx, edx
je 0x14015ed8c
movzx eax, byte [0x14050a431]
movzx ecx, byte [0x14050bdc4]
add cl, 0x7c
cmp al, cl
je 0x14015ed54
mov cl, 0xfb
nop
mov al, 0x59
lock cmpxchg byte [0x14050a431], cl
je 0x14015edf6
cmp al, 0xd3
jne 0x14015ed40
lea rax, [0x14050a420]
ret
test edx, edx
je 0x14015edbc
movzx eax, byte [0x14050a4b6]
cmp al, 0x68
je 0x14015ed84
mov cl, 0x87
nop dword [rax]
mov al, 0x56
lock cmpxchg byte [0x14050a4b6], cl
je 0x14015ee68
cmp al, 0x68
jne 0x14015ed70
lea rax, [0x14050a4a0]
ret
movzx eax, byte [0x14050a583]
cmp al, 0x61
je 0x14015edb4
mov cl, 0xca
nop dword [rax]
mov al, 0xdf
lock cmpxchg byte [0x14050a583], cl
je 0x14015ee98
cmp al, 0x61
jne 0x14015eda0
lea rax, [0x14050a580]
ret
movzx eax, byte [0x14050a64d]
cmp al, 0xa6
je 0x14015edee
mov cl, 0x53
nop dword [rax]
mov al, 0x8d
lock cmpxchg byte [0x14050a64d], cl
je 0x14015eee8
movzx edx, byte [0x14050bdc4]
add dl, 0x4f
cmp al, dl
jne 0x14015edd0
lea rax, [0x14050a640]
ret
xor edx, edx
lea rax, [0x14050a420]
lea rcx, [0x14042b9b0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r9d
not r10b
mov r11d, r8d
xor r11b, r10b
not r11b
and r11b, r9b
and r10b, r8b
or r10b, r11b
mov byte [rdx + rax], r10b
add edx, 0x6d5554b9
mov r8d, edx
xor r8d, 0x92aaab48
and edx, 0x12aaab48
lea edx, [r8 + rdx*2]
cmp edx, 0x11
jl 0x14015ee10
mov al, 0xd3
xchg byte [0x14050a431], al
lea rax, [0x14050a420]
ret
xor eax, eax
lea rcx, [0x14050a4a0]
lea rdx, [0x14042ba20]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x15
jg 0x14015eec8
inc rax
jmp 0x14015ee80
xor eax, eax
lea rcx, [0x14050a580]
lea rdx, [0x14042baf0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x14015eed8
inc rax
jmp 0x14015eeb0
mov al, 0x68
xchg byte [0x14050a4b6], al
lea rax, [0x14050a4a0]
ret
mov al, 0x61
xchg byte [0x14050a583], al
lea rax, [0x14050a580]
ret
xor eax, eax
lea rcx, [0x14050a640]
lea rdx, [0x14042bbb0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14015ef28
inc rax
jmp 0x14015ef00
mov al, 0xa6
xchg byte [0x14050a64d], al
lea rax, [0x14050a640]
ret
Function at 0x140164c10
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140164ca1
test edx, edx
je 0x140164cd8
movzx eax, byte [0x14050c1c9]
nop word [rax + rax]
cmp al, 0xc8
je 0x140164c99
movzx ecx, byte [0x14050c644]
lea eax, [rcx - 0x52]
add cl, 0x9a
lock cmpxchg byte [0x14050c1c9], cl
jne 0x140164c30
xor edx, edx
lea rax, [0x14050c1c0]
lea rcx, [0x14042bfa0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x14050c640]
add edx, r8d
add edx, 0x1314ed21
cmp edx, 9
jl 0x140164c60
mov al, 0xc8
xchg byte [0x14050c1c9], al
lea rax, [0x14050c1c0]
ret
test edx, edx
je 0x140164d08
movzx eax, byte [0x14050c17d]
cmp al, 0x56
je 0x140164cd0
mov cl, 0xc3
nop word cs:[rax + rax]
mov al, 0x2b
lock cmpxchg byte [0x14050c17d], cl
je 0x140164d3c
cmp al, 0x56
jne 0x140164cc0
lea rax, [0x14050c170]
ret
movzx eax, byte [0x14050c15d]
cmp al, 0x7f
je 0x140164d00
mov cl, 0x63
nop word cs:[rax + rax]
mov al, 0xe
lock cmpxchg byte [0x14050c15d], cl
je 0x140164d68
cmp al, 0x7f
jne 0x140164cf0
lea rax, [0x14050c150]
ret
movzx eax, byte [0x14050c0bf]
cmp al, 0x5c
je 0x140164d34
mov cl, 0xe1
nop word cs:[rax + rax]
mov al, 0x4e
lock cmpxchg byte [0x14050c0bf], cl
je 0x140164dbf
cmp al, 0x5c
jne 0x140164d20
lea rax, [0x14050c0b0]
ret
xor eax, eax
lea rcx, [0x14050c170]
lea rdx, [0x14042bf50]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140164daf
inc rax
jmp 0x140164d50
xor edx, edx
lea rax, [0x14050c150]
lea rcx, [0x14042bf30]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x140164d80
mov al, 0x7f
xchg byte [0x14050c15d], al
lea rax, [0x14050c150]
ret
mov al, 0x56
xchg byte [0x14050c17d], al
lea rax, [0x14050c170]
ret
xor eax, eax
lea rcx, [0x14050c0b0]
lea rdx, [0x14042be90]
mov r8d, 0x1314ed2f
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14050c640]
add r10d, r8d
cmp r9d, r10d
jge 0x140164e01
inc rax
jmp 0x140164de0
mov al, 0x5c
xchg byte [0x14050c0bf], al
lea rax, [0x14050c0b0]
ret
Function at 0x140165c00
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140165c3c
test edx, edx
je 0x140165c6c
movzx eax, byte [0x14050c223]
cmp al, 0xb5
je 0x140165c34
mov cl, 0xe8
nop word cs:[rax + rax]
mov al, 0xd3
lock cmpxchg byte [0x14050c223], cl
je 0x140165cec
cmp al, 0xb5
jne 0x140165c20
lea rax, [0x14050c210]
ret
test edx, edx
je 0x140165cba
movzx eax, byte [0x14050c2a2]
cmp al, 0xfd
je 0x140165c64
mov cl, 0x3a
nop dword [rax]
mov al, 0xd
lock cmpxchg byte [0x14050c2a2], cl
je 0x140165d2a
cmp al, 0xfd
jne 0x140165c50
lea rax, [0x14050c290]
ret
movzx eax, byte [0x14050c18f]
cmp al, 0x86
je 0x140165cb2
mov cl, 0xca
nop dword [rax]
mov al, 0x32
lock cmpxchg byte [0x14050c18f], cl
je 0x140165d58
movzx edx, byte [0x14050c644]
xor r8d, r8d
sub r8b, dl
mov edx, r8d
xor dl, 0x82
and r8b, 2
add r8b, r8b
add r8b, dl
add al, r8b
jne 0x140165c80
lea rax, [0x14050c180]
ret
movzx eax, byte [0x14050c0fd]
cmp al, 0x29
je 0x140165ce4
mov cl, 5
nop word [rax + rax]
mov al, 0x54
lock cmpxchg byte [0x14050c0fd], cl
je 0x140165dbc
cmp al, 0x29
jne 0x140165cd0
lea rax, [0x14050c0f0]
ret
xor edx, edx
lea rax, [0x14050c210]
lea rcx, [0x14042bff0]
nop dword [rax]
movsxd r8, edx
movzx edx, byte [r8 + rcx]
xor byte [r8 + rax], dl
lea edx, [r8 + r8]
sub edx, r8d
inc edx
cmp edx, 0x13
jl 0x140165d00
mov al, 0xb5
xchg byte [0x14050c223], al
lea rax, [0x14050c210]
ret
xor eax, eax
lea rcx, [0x14050c290]
lea rdx, [0x14042c070]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x140165d9c
inc rax
jmp 0x140165d40
xor eax, eax
lea rcx, [0x14050c180]
lea rdx, [0x14042bf60]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x140165dac
inc rax
jmp 0x140165d70
mov al, 0xfd
xchg byte [0x14050c2a2], al
lea rax, [0x14050c290]
ret
mov al, 0x86
xchg byte [0x14050c18f], al
lea rax, [0x14050c180]
ret
xor eax, eax
lea rcx, [0x14050c0f0]
lea rdx, [0x14042bed0]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
not r8b
not r9b
and r9b, r8b
or r9b, r10b
not r9b
add r9b, r9b
add r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140165e08
inc rax
jmp 0x140165dd0
mov al, 0x29
xchg byte [0x14050c0fd], al
lea rax, [0x14050c0f0]
ret
Function at 0x140166050
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14016608c
test edx, edx
je 0x1401660bc
movzx eax, byte [0x14050c12d]
movzx ecx, byte [0x14050c644]
add cl, 0x9d
cmp al, cl
je 0x140166084
mov cl, 0xd0
nop
mov al, 0x37
lock cmpxchg byte [0x14050c12d], cl
je 0x140166185
cmp al, 0xa5
jne 0x140166070
lea rax, [0x14050c120]
ret
test edx, edx
je 0x1401660ec
movzx eax, byte [0x14050bffe]
cmp al, 0x25
je 0x1401660b4
mov cl, 0x21
nop dword [rax]
mov al, 0xa1
lock cmpxchg byte [0x14050bffe], cl
je 0x1401661c8
cmp al, 0x25
jne 0x1401660a0
lea rax, [0x14050bff0]
ret
movzx eax, byte [0x14050c053]
cmp al, 0xe
je 0x1401660e4
mov cl, 0x45
nop dword [rax]
mov al, 0xee
lock cmpxchg byte [0x14050c053], cl
je 0x14016622b
cmp al, 0xe
jne 0x1401660d0
lea rax, [0x14050c030]
ret
movzx eax, byte [0x14050c251]
nop word cs:[rax + rax]
movzx ecx, byte [0x14050c644]
add cl, 0x60
cmp al, cl
je 0x14016617d
movzx ecx, byte [0x14050c644]
lea eax, [rcx - 0x7b]
add cl, 0x4c
lock cmpxchg byte [0x14050c251], cl
jne 0x140166100
xor edx, edx
lea rax, [0x14050c240]
lea rcx, [0x14042c020]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x14050c640]
add edx, r8d
add edx, 0x233d0ffd
mov r8d, edx
xor r8d, 0xefd7dd24
and edx, 0x6fd7dd24
lea edx, [r8 + rdx*2]
cmp edx, 0x11
jl 0x140166140
mov al, 0x68
xchg byte [0x14050c251], al
lea rax, [0x14050c240]
ret
xor eax, eax
lea rcx, [0x14050c120]
lea rdx, [0x14042bf00]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401661b8
inc rax
jmp 0x1401661a0
mov al, 0xa5
xchg byte [0x14050c12d], al
lea rax, [0x14050c120]
ret
xor edx, edx
lea rax, [0x14050bff0]
lea rcx, [0x14042bdd0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
add r8b, 0x80
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
add r8b, 0x80
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xe
jl 0x1401661e0
mov al, 0x25
xchg byte [0x14050bffe], al
lea rax, [0x14050bff0]
ret
xor eax, eax
lea rcx, [0x14050c030]
lea rdx, [0x14042be10]
mov r8d, 0x1314ed43
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14050c640]
add r10d, r8d
cmp r9d, r10d
jge 0x140166271
inc rax
jmp 0x140166250
mov al, 0xe
xchg byte [0x14050c053], al
lea rax, [0x14050c030]
ret
Function at 0x1401668e0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14016691c
test edx, edx
je 0x14016694c
movzx eax, byte [0x14050c16a]
cmp al, 0x81
je 0x140166914
mov cl, 0xf5
nop word [rax + rax]
mov al, 0x7f
lock cmpxchg byte [0x14050c16a], cl
je 0x1401669ac
cmp al, 0x81
jne 0x140166900
lea rax, [0x14050c160]
ret
test edx, edx
je 0x14016697c
movzx eax, byte [0x14050bfe2]
cmp al, 0x43
je 0x140166944
mov cl, 0x7a
nop dword [rax]
mov al, 0xe4
lock cmpxchg byte [0x14050bfe2], cl
je 0x1401669e8
cmp al, 0x43
jne 0x140166930
lea rax, [0x14050bfd0]
ret
movzx eax, byte [0x14050bfc5]
cmp al, 0xe
je 0x140166974
mov cl, 0xdc
nop dword [rax]
mov al, 8
lock cmpxchg byte [0x14050bfc5], cl
je 0x140166a18
cmp al, 0xe
jne 0x140166960
lea rax, [0x14050bfb0]
ret
movzx eax, byte [0x14050c0ad]
cmp al, 0x44
je 0x1401669a4
mov cl, 0x47
nop dword [rax]
mov al, 0xf9
lock cmpxchg byte [0x14050c0ad], cl
je 0x140166a7b
cmp al, 0x44
jne 0x140166990
lea rax, [0x14050c0a0]
ret
xor eax, eax
lea rcx, [0x14050c160]
lea rdx, [0x14042bf40]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 9
jg 0x1401669d8
inc rax
jmp 0x1401669c0
mov al, 0x81
xchg byte [0x14050c16a], al
lea rax, [0x14050c160]
ret
xor eax, eax
lea rcx, [0x14050bfd0]
lea rdx, [0x14042bdb0]
nop dword [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0x11
jg 0x140166a51
inc rax
jmp 0x140166a00
xor eax, eax
lea rcx, [0x14050bfb0]
lea rdx, [0x14042bd90]
xor r8d, 0x750ce608
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14050c640]
add r10d, r8d
cmp r9d, r10d
jge 0x140166a6b
inc rax
jmp 0x140166a30
xor r8b, 6
add r8b, byte [0x14050c644]
xchg byte [0x14050bfe2], r8b
lea rax, [0x14050bfd0]
ret
mov al, 0xe
xchg byte [0x14050bfc5], al
lea rax, [0x14050bfb0]
ret
xor edx, edx
lea rax, [0x14050c0a0]
lea rcx, [0x14042be80]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x140166a90
mov al, 0x44
xchg byte [0x14050c0ad], al
lea rax, [0x14050c0a0]
ret
Function at 0x14016f4e0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov r8d, 0x124
xor edx, edx
call fcn.14040c5e0
lea rcx, [rsi + 0x128]
mov rdi, qword [rsi + 0x128]
mov r8, qword [rdi + 8]
mov rdx, rcx
call fcn.1400a70d0
mov qword [rdi + 8], rdi
mov qword [rdi], rdi
mov qword [rdi + 0x10], rdi
mov qword [rsi + 0x130], 0
lea rdi, [rsi + 0x140]
mov rcx, qword [rsi + 0x140]
test rcx, rcx
je 0x14016f56b
cmp dword [rsi + 0x15c], 1
jne 0x14016f553
mov r8, qword [rsi + 0x148]
xor edx, edx
call fcn.14040c5e0
mov rcx, qword [rdi]
test rcx, rcx
je 0x14016f56b
mov edx, 0x96918669
mov r8d, 0x6611936a
call fcn.1400a9560
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov byte [rsi + 0x158], 1
mov rax, qword [rsi + 0x178]
mov rcx, qword [rax + 8]
mov qword [rcx], 0
mov rcx, qword [rax]
movabs rdi, 0xf97aa6c2ad5a8fd4
test rcx, rcx
je 0x14016f5ca
nop word cs:[rax + rax]
mov rbx, qword [rcx]
mov rdx, qword [0x14050cee8]
add rdx, rdi
call fcn.140177950
mov rcx, rbx
test rbx, rbx
jne 0x14016f5b0
mov rax, qword [rsi + 0x178]
mov qword [rax], rax
mov rax, qword [rsi + 0x178]
mov qword [rax + 8], rax
mov qword [rsi + 0x180], 0
mov rax, qword [rsi + 0x188]
mov rcx, qword [rax + 8]
mov qword [rcx], 0
mov rcx, qword [rax]
test rcx, rcx
je 0x14016f625
nop word cs:[rax + rax]
mov rbx, qword [rcx]
mov edx, 0x20
call fcn.140177950
mov rcx, rbx
test rbx, rbx
jne 0x14016f610
mov rax, qword [rsi + 0x188]
mov qword [rax], rax
mov rax, qword [rsi + 0x188]
mov qword [rax + 8], rax
mov qword [rsi + 0x190], 0
mov rax, qword [rsi + 0x198]
mov rcx, qword [rax + 8]
mov qword [rcx], 0
mov rcx, qword [rax]
test rcx, rcx
je 0x14016f694
movabs rbx, 0x797aa6c2ad5a8fd4
nop dword [rax]
mov r14, qword [rcx]
mov rax, qword [0x14050cee8]
mov rdx, rax
xor rdx, rdi
and rax, rbx
lea rdx, [rdx + rax*2]
call fcn.140177950
mov rcx, r14
test r14, r14
jne 0x14016f670
mov rax, qword [rsi + 0x198]
mov qword [rax], rax
mov rax, qword [rsi + 0x198]
mov qword [rax + 8], rax
mov qword [rsi + 0x1a0], 0
lea rdi, [rsi + 0x1b0]
mov rcx, qword [rsi + 0x1b0]
test rcx, rcx
je 0x14016f6f6
cmp dword [rsi + 0x1cc], 1
jne 0x14016f6de
mov r8, qword [rsi + 0x1b8]
xor edx, edx
call fcn.14040c5e0
mov rcx, qword [rdi]
test rcx, rcx
je 0x14016f6f6
mov edx, 0x96918669
mov r8d, 0x6611936a
call fcn.1400a9560
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov byte [rsi + 0x1c8], 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140177de0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x30
mov r10, qword [rsp + 0x68]
mov eax, dword [rsp + 0x60]
mov r11d, dword [0x140564474]
cmp r11d, 0x3c
nop dword [rax]
mov r11d, dword [0x14050cee0]
mov esi, r11d
xor esi, 0x130b22f2
and r11d, 0x130b22f2
add r11d, r11d
add r11d, esi
jne 0x140177e00
test ecx, ecx
je 0x140177e3b
mov qword [rsp + 0x20], r10
mov rcx, rdx
mov rdx, r8
mov r8, r9
mov r9d, eax
call fcn.1402b4600
jmp 0x140177e46
mov rcx, rdx
mov rdx, r8
call fcn.1402b4880
nop
add rsp, 0x30
pop rsi
ret

Function at 0x140177ea0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x14050cee0]
mov r8d, eax
xor r8d, 0x130b22f2
and eax, 0x130b22f2
lea eax, [r8 + rax*2]
cmp ecx, eax
jne 0x140177eec
test edx, edx
je 0x140177f18
movzx eax, byte [0x14050ca0d]
cmp al, 0x69
je 0x140177ee4
mov cl, 0x52
nop
mov al, 0xf1
lock cmpxchg byte [0x14050ca0d], cl
je 0x140177fb8
cmp al, 0x69
jne 0x140177ed0
lea rax, [0x14050ca00]
ret
test edx, edx
je 0x140177f4c
movzx eax, byte [0x14050ca60]
cmp al, 0xff
je 0x140177f10
mov cl, 0xbf
nop dword [rax]
mov al, 0xa6
lock cmpxchg byte [0x14050ca60], cl
je 0x140177f7c
cmp al, 0xff
jne 0x140177f00
lea rax, [0x14050ca50]
ret
movzx eax, byte [0x14050cbcb]
cmp al, 0x69
je 0x140177f44
mov cl, 0x41
nop word cs:[rax + rax]
mov al, 0x93
lock cmpxchg byte [0x14050cbcb], cl
je 0x140178011
cmp al, 0x69
jne 0x140177f30
lea rax, [0x14050cbc0]
ret
movzx eax, byte [0x14050cb9d]
cmp al, 0x6c
je 0x140177f74
mov cl, 0x13
nop dword [rax]
mov al, 0x31
lock cmpxchg byte [0x14050cb9d], cl
je 0x14017805f
cmp al, 0x6c
jne 0x140177f60
lea rax, [0x14050cb90]
ret
xor eax, eax
lea rcx, [0x14050ca50]
lea rdx, [0x14042c4b0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140177fa8
inc rax
jmp 0x140177f90
mov al, 0xff
xchg byte [0x14050ca60], al
lea rax, [0x14050ca50]
ret
xor edx, edx
lea rax, [0x14050ca00]
lea rcx, [0x14042c460]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x14050cee0]
add edx, r8d
add edx, 0x130b22f3
cmp edx, 0xd
jl 0x140177fd0
mov al, 0x69
xchg byte [0x14050ca0d], al
lea rax, [0x14050ca00]
ret
xor edx, edx
lea rax, [0x14050cbc0]
lea rcx, [0x14042c610]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xb
jl 0x140178030
mov al, 0x69
xchg byte [0x14050cbcb], al
lea rax, [0x14050cbc0]
ret
xor eax, eax
lea rcx, [0x14050cb90]
lea rdx, [0x14042c5e0]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140178088
inc rax
jmp 0x140178070
mov al, 0x6c
xchg byte [0x14050cb9d], al
lea rax, [0x14050cb90]
ret
Function at 0x140178700
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14017873c
test edx, edx
je 0x1401787cf
movzx eax, byte [0x14050cbdf]
cmp al, 0xfd
je 0x140178734
mov cl, 0xc7
nop
mov al, 0xa7
lock cmpxchg byte [0x14050cbdf], cl
je 0x14017888c
cmp al, 0xfd
jne 0x140178720
lea rax, [0x14050cbd0]
ret
mov eax, r8d
xor eax, 0xf8fb8891
add eax, dword [0x14050cee0]
cmp edx, eax
jne 0x140178820
movzx eax, byte [0x14050cb13]
nop dword [rax]
cmp al, 0x9e
je 0x1401787c7
movzx ecx, byte [0x14050cee4]
mov eax, r8d
xor al, 0xd5
add al, cl
mov edx, r8d
xor dl, 0xa8
add dl, cl
lock cmpxchg byte [0x14050cb13], dl
jne 0x140178760
xor edx, edx
lea rax, [0x14050cb10]
lea rcx, [0x14042c560]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 3
jl 0x1401787a0
mov al, 0x9e
xchg byte [0x14050cb13], al
lea rax, [0x14050cb10]
ret
movzx eax, byte [0x14050c8c0]
mov ecx, r8d
xor cl, 0xdd
add cl, byte [0x14050cee4]
cmp al, cl
je 0x140178818
nop word cs:[rax + rax]
movzx ecx, byte [0x14050cee4]
mov eax, r8d
xor al, 0x6d
add al, cl
mov edx, r8d
xor dl, 0xf7
add dl, cl
lock cmpxchg byte [0x14050c8c0], dl
je 0x1401788c8
cmp al, 0xfc
jne 0x1401787f0
lea rax, [0x14050c890]
ret
movzx eax, byte [0x14050c971]
nop word [rax + rax]
cmp al, 0x93
je 0x140178919
movzx ecx, byte [0x14050cee4]
mov eax, r8d
xor al, 0x12
add al, cl
mov edx, r8d
xor dl, 0xe8
add dl, cl
lock cmpxchg byte [0x14050c971], dl
jne 0x140178830
xor eax, eax
lea rcx, [0x14050c940]
lea rdx, [0x14042c3a0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x30
jg 0x140178911
inc rax
jmp 0x140178870
xor eax, eax
lea rcx, [0x14050cbd0]
lea rdx, [0x14042c620]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1401788b8
inc rax
jmp 0x1401788a0
mov al, 0xfd
xchg byte [0x14050cbdf], al
lea rax, [0x14050cbd0]
ret
xor eax, eax
lea rcx, [0x14050c890]
lea rdx, [0x14042c300]
xor r8d, 0xf8fb8941
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14050cee0]
add r10d, r8d
cmp r9d, r10d
jge 0x140178901
inc rax
jmp 0x1401788e0
mov al, 0xfc
xchg byte [0x14050c8c0], al
lea rax, [0x14050c890]
ret
mov al, 0x93
xchg byte [0x14050c971], al
lea rax, [0x14050c940]
ret
Function at 0x1401789a0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401789dc
test edx, edx
je 0x140178a0c
movzx eax, byte [0x14050cabe]
cmp al, 0x33
je 0x1401789d4
mov cl, 0x27
nop word cs:[rax + rax]
mov al, 0x8f
lock cmpxchg byte [0x14050cabe], cl
je 0x140178a6c
cmp al, 0x33
jne 0x1401789c0
lea rax, [0x14050cab0]
ret
test edx, edx
je 0x140178a3c
movzx eax, byte [0x14050c994]
cmp al, 0x19
je 0x140178a04
mov cl, 0x22
nop dword [rax]
mov al, 0xa6
lock cmpxchg byte [0x14050c994], cl
je 0x140178aaf
cmp al, 0x19
jne 0x1401789f0
lea rax, [0x14050c990]
ret
movzx eax, byte [0x14050c843]
cmp al, 0x95
je 0x140178a34
mov cl, 0x35
nop dword [rax]
mov al, 0xb1
lock cmpxchg byte [0x14050c843], cl
je 0x140178ad8
cmp al, 0x95
jne 0x140178a20
lea rax, [0x14050c810]
ret
movzx eax, byte [0x14050c8ff]
cmp al, 0xde
je 0x140178a64
mov cl, 0x31
nop dword [rax]
mov al, 0xb9
lock cmpxchg byte [0x14050c8ff], cl
je 0x140178b3f
cmp al, 0xde
jne 0x140178a50
lea rax, [0x14050c8d0]
ret
xor edx, edx
lea rax, [0x14050cab0]
lea rcx, [0x14042c500]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xe
jl 0x140178a80
mov al, 0x33
xchg byte [0x14050cabe], al
lea rax, [0x14050cab0]
ret
xor eax, eax
lea rcx, [0x14050c990]
lea rdx, [0x14042c3f0]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x140178b1f
inc rax
jmp 0x140178ac0
xor eax, eax
lea rcx, [0x14050c810]
lea rdx, [0x14042c280]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
xor r9b, r8b
mov r10d, r9d
not r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 0x32
jg 0x140178b2f
inc rax
jmp 0x140178af0
mov al, 0x19
xchg byte [0x14050c994], al
lea rax, [0x14050c990]
ret
mov al, 0x95
xchg byte [0x14050c843], al
lea rax, [0x14050c810]
ret
xor eax, eax
lea rcx, [0x14050c8d0]
lea rdx, [0x14042c330]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x2e
jg 0x140178b68
inc rax
jmp 0x140178b50
mov al, 0xde
xchg byte [0x14050c8ff], al
lea rax, [0x14050c8d0]
ret
Function at 0x140178c70
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x140178d27
test edx, edx
je 0x140178d78
movzx eax, byte [0x14050c88d]
nop dword [rax]
cmp al, 0xa1
je 0x140178d1f
movzx ecx, byte [0x14050cee4]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0x2d
mov eax, r8d
and al, 0xd2
or al, r9b
add al, cl
and dl, 0x99
mov r9d, r8d
and r9b, 0x66
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x14050c88d], r9b
jne 0x140178c90
xor eax, eax
lea rcx, [0x14050c850]
lea rdx, [0x14042c2c0]
xor r8d, 0x55c7a9af
nop word [rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x14050cee0]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 0x3d
jl 0x140178cf0
mov al, 0xa1
xchg byte [0x14050c88d], al
lea rax, [0x14050c850]
ret
test edx, edx
je 0x140178da8
movzx eax, byte [0x14050c93d]
mov ecx, r8d
xor cl, 0x6f
add cl, byte [0x14050cee4]
cmp al, cl
je 0x140178d70
mov cl, 0x5c
nop word cs:[rax + rax]
mov al, 0x41
lock cmpxchg byte [0x14050c93d], cl
je 0x140178ddc
mov edx, r8d
xor dl, 0x6f
add dl, byte [0x14050cee4]
cmp al, dl
jne 0x140178d50
lea rax, [0x14050c900]
ret
movzx eax, byte [0x14050ca36]
cmp al, 0xca
je 0x140178da0
mov cl, 0xd9
nop word cs:[rax + rax]
mov al, 0x2b
lock cmpxchg byte [0x14050ca36], cl
je 0x140178e08
cmp al, 0xca
jne 0x140178d90
lea rax, [0x14050ca30]
ret
cmp byte [0x14050c9a4], 0
je 0x140178dd4
mov cl, 0xb0
nop word cs:[rax + rax]
mov al, 0xf
lock cmpxchg byte [0x14050c9a4], cl
je 0x140178e58
test al, al
jne 0x140178dc0
lea rax, [0x14050c9a0]
ret
xor eax, eax
lea rcx, [0x14050c900]
lea rdx, [0x14042c360]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x3c
jg 0x140178e38
inc rax
jmp 0x140178df0
xor eax, eax
lea rcx, [0x14050ca30]
lea rdx, [0x14042c490]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x140178e48
inc rax
jmp 0x140178e20
mov al, 0x71
xchg byte [0x14050c93d], al
lea rax, [0x14050c900]
ret
mov al, 0xca
xchg byte [0x14050ca36], al
lea rax, [0x14050ca30]
ret
xor eax, eax
lea rcx, [0x14050c9a0]
lea rdx, [0x14042c400]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x140178e88
inc rax
jmp 0x140178e70
xor eax, eax
xchg byte [0x14050c9a4], al
lea rax, [0x14050c9a0]
ret