joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2025f700
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
test ecx, ecx
je 0x2025f739
test edx, edx
je 0x2025f769
movzx eax, byte [0x2056808f]
cmp al, 0x40
je 0x2025f81b
mov cl, 0x88
nop dword [rax + rax]
mov al, 0x52
lock cmpxchg byte [0x2056808f], cl
je 0x2025f7c9
cmp al, 0x40
jne 0x2025f720
jmp 0x2025f81b
test edx, edx
je 0x2025f799
movzx eax, byte [0x20567fa0]
cmp al, 0xa5
je 0x2025f8a1
mov cl, 0xa
nop
mov al, 0x1d
lock cmpxchg byte [0x20567fa0], cl
je 0x2025f827
cmp al, 0xa5
jne 0x2025f750
jmp 0x2025f8a1
movzx eax, byte [0x20567f22]
cmp al, 0x82
je 0x2025f8b5
mov cl, 0xc8
nop word [rax + rax]
mov al, 0x28
lock cmpxchg byte [0x20567f22], cl
je 0x2025f858
cmp al, 0x82
jne 0x2025f780
jmp 0x2025f8b5
movzx eax, byte [0x20567fb3]
cmp al, 0x58
je 0x2025f953
mov ecx, dword [rsp + 0x38]
mov dl, 0x1f
nop
mov al, 0xe5
lock cmpxchg byte [0x20567fb3], dl
je 0x2025f8c1
cmp al, 0x58
jne 0x2025f7b0
jmp 0x2025f953
xor edx, edx
lea rax, [0x20568080]
lea rcx, [0x204797a0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x2025f7e0
mov al, 0x40
xchg byte [0x2056808f], al
lea rax, [0x20568080]
jmp 0x2025f95a
xor eax, eax
lea rcx, [0x20567f90]
lea rdx, [0x204796c0]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x2025f899
inc rax
jmp 0x2025f840
xor eax, eax
lea rcx, [0x20567f10]
lea rdx, [0x20479650]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
or r9b, r8b
and r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x2025f8ad
inc rax
jmp 0x2025f870
mov al, 0xa5
xchg byte [0x20567fa0], al
lea rax, [0x20567f90]
jmp 0x2025f95a
mov al, 0x82
xchg byte [0x20567f22], al
lea rax, [0x20567f10]
jmp 0x2025f95a
xor r9d, r9d
lea rax, [0x20567fb0]
lea rdx, [0x204796d0]
mov r8d, ecx
xor r8d, 0xc8f4f7bd
xor ecx, 0x370b0842
nop word cs:[rax + rax]
movsxd r9, r9d
movzx r10d, byte [r9 + rdx]
add byte [r9 + rax], r10b
mov r10d, dword [0x205684d0]
mov r11d, r10d
not r11d
mov esi, ecx
and esi, r10d
mov edi, r8d
and edi, r11d
or edi, esi
xor r10d, r8d
and r11d, ecx
or r11d, r10d
not r11d
lea r10d, [rdi + r11*2]
add r9d, r10d
add r9d, 0x70cd8078
mov r10d, r9d
xor r10d, 0x8f327f88
and r9d, 0xf327f88
lea r9d, [r10 + r9*2]
cmp r9d, 3
jl 0x2025f8f0
mov al, 0x58
xchg byte [0x20567fb3], al
lea rax, [0x20567fb0]
pop rdi
pop rsi
ret
Function at 0x2026a9b0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x2026a9ec
test edx, edx
je 0x2026aa1c
movzx eax, byte [0x20569f36]
cmp al, 0x95
je 0x2026a9e4
mov cl, 0x76
nop word cs:[rax + rax]
mov al, 0x1d
lock cmpxchg byte [0x20569f36], cl
je 0x2026aadc
cmp al, 0x95
jne 0x2026a9d0
lea rax, [0x20569f20]
ret
test edx, edx
je 0x2026aa5c
movzx eax, byte [0x20569ff9]
cmp al, 0x82
je 0x2026aa14
mov cl, 0xa4
nop dword [rax]
mov al, 0xad
lock cmpxchg byte [0x20569ff9], cl
je 0x2026ab41
cmp al, 0x82
jne 0x2026aa00
lea rax, [0x20569ff0]
ret
movzx eax, byte [0x20569da4]
movzx ecx, byte [0x2056aa9c]
add cl, 0xd2
cmp al, cl
je 0x2026aa54
mov cl, 0xdd
nop word cs:[rax + rax]
mov al, 0x88
lock cmpxchg byte [0x20569da4], cl
je 0x2026ab88
cmp al, 0xb9
jne 0x2026aa40
lea rax, [0x20569da0]
ret
movzx eax, byte [0x20569e35]
nop word cs:[rax + rax]
cmp al, 0x5d
je 0x2026ac0f
movzx ecx, byte [0x2056aa9c]
mov edx, ecx
xor dl, 0x61
mov eax, ecx
and al, 0x61
add al, al
add al, dl
add al, 0xbc
add cl, 0x7a
lock cmpxchg byte [0x20569e35], cl
jne 0x2026aa70
xor eax, eax
lea rcx, [0x20569e20]
lea rdx, [0x20479f40]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x2026ac07
inc rax
jmp 0x2026aab0
xor edx, edx
lea rax, [0x20569f20]
lea rcx, [0x2047a020]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
not r8d
mov r9d, r8d
and r9d, 1
and r8d, 0x7ffffffe
mov r10d, edx
and r10d, 1
or r10d, r8d
and r10d, edx
xor edx, 0xfffffffe
or edx, r9d
not edx
or edx, r9d
lea edx, [rdx + r10*2]
cmp edx, 0x16
jl 0x2026aaf0
mov al, 0x95
xchg byte [0x20569f36], al
lea rax, [0x20569f20]
ret
xor eax, eax
lea rcx, [0x20569ff0]
lea rdx, [0x2047a0f0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x2026abd5
inc rax
jmp 0x2026ab60
xor eax, eax
lea rcx, [0x20569da0]
lea rdx, [0x20479ed0]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
not r10b
mov r11d, r8d
xor r11b, r10b
not r11b
and r11b, r9b
and r10b, r8b
or r10b, r11b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x2026abe5
inc rax
jmp 0x2026aba0
mov al, 0x82
xchg byte [0x20569ff9], al
lea rax, [0x20569ff0]
ret
movzx eax, byte [0x2056aa9c]
mov ecx, eax
xor cl, 0x50
and al, 0x50
add al, al
add al, cl
add al, 0x82
xchg byte [0x20569da4], al
lea rax, [0x20569da0]
ret
mov al, 0x5d
xchg byte [0x20569e35], al
lea rax, [0x20569e20]
ret
Function at 0x2026adf0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x2026ae7f
test edx, edx
je 0x2026aebc
movzx eax, byte [0x20569e70]
nop word [rax + rax]
cmp al, 0xb6
je 0x2026ae77
movzx ecx, byte [0x2056aa9c]
lea eax, [rcx - 8]
mov edx, ecx
xor dl, 0xb1
and cl, 0x31
add cl, cl
add cl, dl
lock cmpxchg byte [0x20569e70], cl
jne 0x2026ae10
xor edx, edx
lea rax, [0x20569e60]
lea rcx, [0x20479f80]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x2026ae50
mov al, 0xb6
xchg byte [0x20569e70], al
lea rax, [0x20569e60]
ret
mov eax, 0x5875d356
add eax, dword [0x2056aa98]
cmp edx, eax
jne 0x2026aee8
movzx eax, byte [0x20569d02]
cmp al, 0x19
je 0x2026aeb4
mov cl, 0x82
nop dword [rax + rax]
mov al, 0xdd
lock cmpxchg byte [0x20569d02], cl
je 0x2026af79
cmp al, 0x19
jne 0x2026aea0
lea rax, [0x20569d00]
ret
movzx eax, byte [0x2056a02d]
cmp al, 0x1d
je 0x2026aee0
mov cl, 0x4b
nop dword [rax]
mov al, 0xc2
lock cmpxchg byte [0x2056a02d], cl
je 0x2026af26
cmp al, 0x1d
jne 0x2026aed0
lea rax, [0x2056a020]
ret
movzx eax, byte [0x20569ee8]
cmp al, 0x1c
je 0x2026af1e
mov cl, 0x3a
nop word cs:[rax + rax]
mov al, 0x68
lock cmpxchg byte [0x20569ee8], cl
je 0x2026afc1
movzx edx, byte [0x2056aa9c]
add dl, 0x35
cmp al, dl
jne 0x2026af00
lea rax, [0x20569ed0]
ret
xor edx, edx
lea rax, [0x2056a020]
lea rcx, [0x2047a120]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
not edx
and edx, 0x7ffffffe
or edx, r8d
not edx
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x2026af40
mov al, 0x1d
xchg byte [0x2056a02d], al
lea rax, [0x2056a020]
ret
xor eax, eax
lea rcx, [0x20569d00]
lea rdx, [0x20479e50]
nop dword [rax]
movzx r8d, byte [rax + rcx]
mov r9d, r8d
xor r9b, 0x60
and r8b, 0x60
add r8b, r8b
add r8b, r9b
add r8b, byte [rax + rdx]
add r8b, 0xa0
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x2026b026
inc rax
jmp 0x2026af90
xor edx, edx
lea rax, [0x20569ed0]
lea rcx, [0x20479fd0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
xor r9b, r8b
mov r10d, r9d
not r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
mov byte [rdx + rax], r10b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x18
jl 0x2026afe0
mov al, 0x1c
xchg byte [0x20569ee8], al
lea rax, [0x20569ed0]
ret
mov al, 0x19
xchg byte [0x20569d02], al
lea rax, [0x20569d00]
ret
Function at 0x2026cb00
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x2026cb39
test edx, edx
je 0x2026cb69
movzx eax, byte [0x20569d12]
cmp al, 0xa
je 0x2026cc71
mov cl, 0x4c
nop
mov al, 0x33
lock cmpxchg byte [0x20569d12], cl
je 0x2026cc07
cmp al, 0xa
jne 0x2026cb20
jmp 0x2026cc71
test edx, edx
je 0x2026cbb7
movzx eax, byte [0x2056a05d]
cmp al, 0x1b
je 0x2026ccf7
mov cl, 0x4f
nop
mov al, 0xa2
lock cmpxchg byte [0x2056a05d], cl
je 0x2026cc7a
cmp al, 0x1b
jne 0x2026cb50
jmp 0x2026ccf7
movzx eax, byte [0x20569d22]
cmp al, 0x96
je 0x2026cd12
mov cl, 0xc5
nop word [rax + rax]
mov al, 0x8c
lock cmpxchg byte [0x20569d22], cl
je 0x2026cca8
movzx edx, byte [0x2056aa9c]
mov r9d, r8d
xor r9b, 0x51
mov r10d, r9d
xor r10b, dl
and r9b, dl
add r9b, r9b
add r9b, r10b
cmp al, r9b
jne 0x2026cb80
jmp 0x2026cd12
movzx eax, byte [0x20569fef]
cmp al, 0x9f
je 0x2026cd50
mov cl, 0xcf
nop dword [rax + rax]
mov al, 0xfa
lock cmpxchg byte [0x20569fef], cl
je 0x2026cd1b
movzx edx, byte [0x2056aa9c]
mov r9d, r8d
xor r9b, 0x46
mov r10d, r9d
xor r10b, dl
and r9b, dl
add r9b, r9b
add r9b, r10b
cmp al, r9b
jne 0x2026cbd0
jmp 0x2026cd50
xor eax, eax
lea rcx, [0x20569d10]
lea rdx, [0x20479e60]
mov r9d, r8d
xor r9d, 0xdd00f5a9
mov r10d, r8d
xor r10d, 0x22ff0a59
nop dword [rax + rax]
cdqe
movzx r11d, byte [rax + rdx]
xor byte [rax + rcx], r11b
mov r11d, dword [0x2056aa98]
add eax, r9d
add eax, r11d
mov esi, r8d
xor esi, r11d
xor esi, 0xdd00f5a6
not r11d
and r11d, r10d
or r11d, esi
not r11d
lea r11d, [rsi + r11*2]
cmp eax, r11d
jl 0x2026cc30
mov al, 0xa
xchg byte [0x20569d12], al
lea rax, [0x20569d10]
pop rsi
ret
xor eax, eax
lea rcx, [0x2056a050]
lea rdx, [0x2047a150]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x2026ccef
inc rax
jmp 0x2026cc90
xor eax, eax
lea rcx, [0x20569d20]
lea rdx, [0x20479e70]
nop dword [rax + rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
not r10b
mov r11d, r10d
or r11b, r9b
not r11b
and r10b, r9b
or r10b, r11b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
cmp r9d, 1
jg 0x2026cd00
inc rax
jmp 0x2026ccc0
mov al, 0x1b
xchg byte [0x2056a05d], al
lea rax, [0x2056a050]
pop rsi
ret
xor r8b, 0x51
add r8b, byte [0x2056aa9c]
xchg byte [0x20569d22], r8b
lea rax, [0x20569d20]
pop rsi
ret
xor eax, eax
lea rcx, [0x20569fe0]
lea rdx, [0x2047a0e0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x2026cd48
inc rax
jmp 0x2026cd30
mov al, 0x9f
xchg byte [0x20569fef], al
lea rax, [0x20569fe0]
pop rsi
ret
Function at 0x202983f0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebp, dword [rsp + 0x80]
test ecx, ecx
je 0x20298449
test edx, edx
je 0x20298484
movzx eax, byte [0x20572ffd]
mov ecx, ebp
xor cl, 0xad
add cl, byte [0x205731d4]
cmp al, cl
je 0x2029854a
mov cl, 0xe4
nop word [rax + rax]
mov al, 0x3b
lock cmpxchg byte [0x20572ffd], cl
je 0x20298509
cmp al, 0xa1
jne 0x20298430
jmp 0x2029854a
test edx, edx
je 0x202984b9
movzx eax, byte [0x2057302d]
cmp al, 0x1e
je 0x202985f9
mov cl, 0xc2
nop
mov al, 0x99
lock cmpxchg byte [0x2057302d], cl
je 0x20298556
mov edx, ebp
xor dl, 0x2a
add dl, byte [0x205731d4]
cmp al, dl
jne 0x20298460
jmp 0x202985f9
movzx eax, byte [0x20573045]
cmp al, 0xbb
je 0x202985e5
mov cl, 0x34
nop word cs:[rax + rax]
mov al, 0xe5
lock cmpxchg byte [0x20573045], cl
je 0x20298591
cmp al, 0xbb
jne 0x202984a0
jmp 0x202985e5
movzx eax, byte [0x20572f93]
mov ecx, ebp
not cl
and cl, 0xf4
mov edx, ebp
xor dl, 0xb
or dl, cl
not dl
or dl, cl
add dl, byte [0x205731d4]
cmp al, dl
je 0x20298694
mov esi, r9d
mov cl, 0x27
nop word cs:[rax + rax]
mov al, 0x59
lock cmpxchg byte [0x20572f93], cl
je 0x20298605
cmp al, 0xc8
jne 0x202984f0
jmp 0x20298694
xor eax, eax
lea rcx, [0x20572ff0]
lea rdx, [0x2047c230]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x20298538
inc rax
jmp 0x20298520
xor bpl, 0xad
add bpl, byte [0x205731d4]
xchg byte [0x20572ffd], bpl
lea rax, [0x20572ff0]
jmp 0x2029869b
xor eax, eax
lea rcx, [0x20573020]
lea rdx, [0x2047c260]
xor ebp, 0x220b51be
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
mov r9d, dword [0x205731d0]
add r9d, ebp
cmp r8d, r9d
jge 0x202985f1
inc rax
jmp 0x20298570
xor eax, eax
lea rcx, [0x20573030]
lea rdx, [0x2047c270]
xor ebp, 0x220b51b2
nop word [rax + rax]
cdqe
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
mov r8d, dword [0x205731d0]
add r8d, ebp
add eax, r8d
cmp eax, 0x15
jl 0x202985b0
mov al, 0xbb
xchg byte [0x20573045], al
lea rax, [0x20573030]
jmp 0x2029869b
mov al, 0x1e
xchg byte [0x2057302d], al
lea rax, [0x20573020]
jmp 0x2029869b
xor eax, eax
lea r14, [0x20572f70]
lea r15, [0x2047c1b0]
mov edi, esi
xor edi, 0x363bf6fe
lea rbx, [rsp + 0x24]
nop word cs:[rax + rax]
movsxd rcx, eax
movzx eax, byte [rcx + r14]
movzx edx, byte [rcx + r15]
not dl
mov r8d, edx
or r8b, al
not r8b
and dl, al
or dl, r8b
mov byte [rcx + r14], dl
mov rdx, rbx
mov r8d, edi
mov r9d, 0x3050272
call fcn.2012a2f0
mov eax, dword [rsp + 0x24]
cmp eax, 0x23
jl 0x20298630
mov eax, ebp
not eax
and eax, 0xfd12823c
xor ebp, 0x2ed7dc3
or ebp, eax
not ebp
or ebp, eax
add ebp, dword [0x205731d0]
xor esi, ebp
mov ecx, esi
mov edx, 0xd4825cad
call fcn.202983e0
lea rax, [0x20572f70]
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x202986b0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x2029870c
mov eax, dword [0x205731d0]
mov ecx, r8d
xor ecx, 0xdef225c6
mov r9d, ecx
xor r9d, eax
and ecx, eax
lea eax, [r9 + rcx*2]
cmp edx, eax
jne 0x2029874c
movzx eax, byte [0x2057305d]
cmp al, 0x37
je 0x20298704
mov cl, 4
nop word cs:[rax + rax]
mov al, 0x51
lock cmpxchg byte [0x2057305d], cl
je 0x202987ff
cmp al, 0x37
jne 0x202986f0
lea rax, [0x20573050]
ret
test edx, edx
je 0x20298788
movzx eax, byte [0x20572f63]
xor r8b, 0x84
add r8b, byte [0x205731d4]
cmp al, r8b
je 0x20298744
mov cl, 0x5b
nop dword [rax]
mov al, 0x6c
lock cmpxchg byte [0x20572f63], cl
je 0x20298892
cmp al, 0xc7
jne 0x20298730
lea rax, [0x20572f60]
ret
movzx eax, byte [0x20572fe6]
cmp al, 0xee
je 0x20298780
mov cl, 0x54
nop dword [rax]
mov al, 0xbe
lock cmpxchg byte [0x20572fe6], cl
je 0x20298828
mov edx, r8d
xor dl, 0xad
add dl, byte [0x205731d4]
cmp al, dl
jne 0x20298760
lea rax, [0x20572fd0]
ret
movzx eax, byte [0x2057301a]
nop
cmp al, 0x18
je 0x202987f7
movzx ecx, byte [0x205731d4]
mov eax, r8d
xor al, 0xd7
mov edx, eax
xor dl, cl
and al, cl
add al, al
add al, dl
mov edx, r8d
xor dl, 0xb3
add dl, cl
lock cmpxchg byte [0x2057301a], dl
jne 0x20298790
xor edx, edx
lea rax, [0x20573000]
lea rcx, [0x2047c240]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x1a
jl 0x202987d0
mov al, 0x18
xchg byte [0x2057301a], al
lea rax, [0x20573000]
ret
xor eax, eax
lea rcx, [0x20573050]
lea rdx, [0x2047c290]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x20298868
inc rax
jmp 0x20298810
xor eax, eax
lea rcx, [0x20572fd0]
lea rdx, [0x2047c210]
nop dword [rax + rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
cmp r9d, 0x15
jg 0x20298878
inc rax
jmp 0x20298840
mov al, 0x37
xchg byte [0x2057305d], al
lea rax, [0x20573050]
ret
xor r8b, 0xad
add r8b, byte [0x205731d4]
xchg byte [0x20572fe6], r8b
lea rax, [0x20572fd0]
ret
xor eax, eax
lea rcx, [0x20572f60]
lea rdx, [0x2047c1a0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x202988c8
inc rax
jmp 0x202988b0
mov al, 0xc7
xchg byte [0x20572f63], al
lea rax, [0x20572f60]
ret
Function at 0x202b7700
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x205791d0]
mov r8d, eax
xor r8d, 0xf2cb211b
and eax, 0x72cb211b
lea eax, [r8 + rax*2]
cmp ecx, eax
jne 0x202b775c
test edx, edx
je 0x202b77bc
movzx eax, byte [0x2057901f]
cmp al, 0x95
je 0x202b7754
mov cl, 0xd2
nop word cs:[rax + rax]
mov al, 0x18
lock cmpxchg byte [0x2057901f], cl
je 0x202b781c
cmp al, 0x95
jne 0x202b7740
lea rax, [0x20579010]
ret
test edx, edx
je 0x202b77ec
movzx eax, byte [0x2057903d]
nop dword [rax + rax]
cmp al, 7
je 0x202b7877
movzx ecx, byte [0x205791e0]
lea eax, [rcx - 0x1e]
add cl, 0x11
lock cmpxchg byte [0x2057903d], cl
jne 0x202b7770
xor eax, eax
lea rcx, [0x20579030]
lea rdx, [0x2047e5f0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x202b786f
inc rax
jmp 0x202b77a0
movzx eax, byte [0x20578fc8]
cmp al, 0xe6
je 0x202b77e4
mov cl, 0x38
nop dword [rax]
mov al, 0x15
lock cmpxchg byte [0x20578fc8], cl
je 0x202b787f
cmp al, 0xe6
jne 0x202b77d0
lea rax, [0x20578fb0]
ret
movzx eax, byte [0x205790d8]
cmp al, 0x15
je 0x202b7814
mov cl, 0x37
nop dword [rax]
mov al, 0x66
lock cmpxchg byte [0x205790d8], cl
je 0x202b78b8
cmp al, 0x15
jne 0x202b7800
lea rax, [0x205790c0]
ret
xor eax, eax
lea rcx, [0x20579010]
lea rdx, [0x2047e5d0]
nop dword [rax]
cdqe
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
mov r8d, dword [0x205791d0]
mov r9d, r8d
xor r9d, 0xf2cb211c
and r8d, 0x72cb211c
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0xf
jl 0x202b7830
mov al, 0x95
xchg byte [0x2057901f], al
lea rax, [0x20579010]
ret
mov al, 7
xchg byte [0x2057903d], al
lea rax, [0x20579030]
ret
xor eax, eax
lea rcx, [0x20578fb0]
lea rdx, [0x2047e570]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x17
jg 0x202b78e8
inc rax
jmp 0x202b7890
xor eax, eax
lea rcx, [0x205790c0]
lea rdx, [0x2047e680]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x17
jg 0x202b78f8
inc rax
jmp 0x202b78d0
mov al, 0xe6
xchg byte [0x20578fc8], al
lea rax, [0x20578fb0]
ret
movzx eax, byte [0x205791e0]
add al, 0xd1
xchg byte [0x205790d8], al
lea rax, [0x205790c0]
ret
Function at 0x202c0c70
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movdqa xmmword [rsp + 0x20], xmm6
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
setne cl
sete dl
test rsi, rsi
setne al
xor cl, al
xor al, dl
and al, dl
or al, cl
test r8, r8
setne cl
cmp al, cl
je 0x202c0e68
xor al, 1
je 0x202c0e68
mov rbx, r8
mov eax, 0xe899c04d
add eax, dword [rdi + 0xc]
mov ecx, eax
xor ecx, ebx
and eax, ebx
lea eax, [rcx + rax*2]
add eax, 0x17663fb3
mov dword [rdi + 0xc], eax
cmp eax, ebx
jae 0x202c0cd8
inc dword [rdi + 8]
mov rax, qword [rdi]
mov r15d, 0x40
sub r15, rax
cmp r15, rbx
cmovae r15, rbx
lea rcx, [rdi + rax]
add rcx, 0x30
mov rdx, rsi
mov r8, r15
call fcn.2044f800
mov rax, qword [rdi]
add rax, r15
mov qword [rdi], rax
movabs rcx, 0x306a2d48c4f1c6da
add rcx, qword [0x20579b28]
cmp rax, rcx
jne 0x202c0e68
lea r14, [rdi + 0x30]
add rsi, r15
sub rbx, r15
pxor xmm6, xmm6
mov ebp, 0xb443
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rdi + 0x30]
movdqu xmm2, xmmword [rdi + 0x40]
movdqu xmm3, xmmword [rdi + 0x50]
movdqu xmm0, xmmword [rdi + 0x60]
movdqa xmm4, xmm1
punpckhbw xmm4, xmm6
pshuflw xmm4, xmm4, 0x1b
pshufhw xmm4, xmm4, 0x1b
punpcklbw xmm1, xmm6
pshuflw xmm1, xmm1, 0x1b
pshufhw xmm1, xmm1, 0x1b
packuswb xmm1, xmm4
movdqu xmmword [rdi + 0x30], xmm1
movdqa xmm1, xmm2
punpckhbw xmm1, xmm6
pshuflw xmm1, xmm1, 0x1b
pshufhw xmm1, xmm1, 0x1b
punpcklbw xmm2, xmm6
pshuflw xmm2, xmm2, 0x1b
pshufhw xmm2, xmm2, 0x1b
packuswb xmm2, xmm1
movdqu xmmword [rdi + 0x40], xmm2
movdqa xmm1, xmm3
punpckhbw xmm1, xmm6
pshuflw xmm1, xmm1, 0x1b
pshufhw xmm1, xmm1, 0x1b
punpcklbw xmm3, xmm6
pshuflw xmm2, xmm3, 0x1b
pshufhw xmm2, xmm2, 0x1b
packuswb xmm2, xmm1
movdqu xmmword [rdi + 0x50], xmm2
movdqa xmm1, xmm0
punpckhbw xmm1, xmm6
pshuflw xmm1, xmm1, 0x1b
pshufhw xmm1, xmm1, 0x1b
punpcklbw xmm0, xmm6
pshuflw xmm0, xmm0, 0x1b
pshufhw xmm0, xmm0, 0x1b
packuswb xmm0, xmm1
movdqu xmmword [rdi + 0x60], xmm0
mov eax, dword [0x20579b10]
add eax, ebp
cdqe
add rax, qword [0x20579b20]
mov rcx, rdi
mov edx, 0xccd31dd6
mov r8d, 0xdbf383fa
call qword [case.0x2010e313.0]
cmp rbx, 0x40
mov r15d, 0x40
cmovb r15, rbx
mov rcx, r14
mov rdx, rsi
mov r8, r15
call fcn.2044f800
mov qword [rdi], r15
add rsi, r15
neg r15
mov rax, rbx
xor rax, r15
and r15, rbx
add r15, r15
mov rcx, rax
xor rcx, r15
and r15, rax
lea rax, [rcx + r15*2]
cmp rbx, 0x3f
mov rbx, rax
ja 0x202c0d40
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x202cccc0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x202ccd11
test edx, edx
je 0x202ccd4c
movzx eax, byte [0x2057a993]
cmp al, 0xcb
je 0x202ccd09
nop word [rax + rax]
movzx ecx, byte [0x2057aa88]
lea eax, [rcx + 0x76]
add cl, 0x21
lock cmpxchg byte [0x2057a993], cl
je 0x202ccdc5
movzx ecx, byte [0x2057aa88]
add cl, 0xcf
cmp al, cl
jne 0x202ccce0
lea rax, [0x2057a970]
ret
test edx, edx
je 0x202ccd7c
movzx eax, byte [0x2057a957]
cmp al, 0xf7
je 0x202ccd44
mov cl, 0xed
nop word cs:[rax + rax]
mov al, 0x43
lock cmpxchg byte [0x2057a957], cl
je 0x202cce25
cmp al, 0xf7
jne 0x202ccd30
lea rax, [0x2057a950]
ret
movzx eax, byte [0x2057a9af]
cmp al, 0x26
je 0x202ccd74
mov cl, 0x69
nop dword [rax]
mov al, 0x72
lock cmpxchg byte [0x2057a9af], cl
je 0x202cce58
cmp al, 0x26
jne 0x202ccd60
lea rax, [0x2057a9a0]
ret
movzx eax, byte [0x2057a963]
cmp al, 0x1e
je 0x202ccdbd
mov cl, 0x5c
nop dword [rax]
mov al, 0xdc
lock cmpxchg byte [0x2057a963], cl
je 0x202ccea8
movzx edx, byte [0x2057aa88]
mov r8d, edx
xor r8b, 0x9b
and dl, 0x1b
add dl, dl
add dl, r8b
add dl, 0x87
cmp al, dl
jne 0x202ccd90
lea rax, [0x2057a960]
ret
xor eax, eax
lea rcx, [0x2057a970]
lea rdx, [0x20481c70]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, r8b
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x202cce15
inc rax
jmp 0x202ccde0
mov al, 0xcb
xchg byte [0x2057a993], al
lea rax, [0x2057a970]
ret
xor eax, eax
lea rcx, [0x2057a950]
lea rdx, [0x20481c50]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 6
jg 0x202cce88
inc rax
jmp 0x202cce40
xor eax, eax
lea rcx, [0x2057a9a0]
lea rdx, [0x20481ca0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x202cce98
inc rax
jmp 0x202cce70
mov al, 0xf7
xchg byte [0x2057a957], al
lea rax, [0x2057a950]
ret
mov al, 0x26
xchg byte [0x2057a9af], al
lea rax, [0x2057a9a0]
ret
xor edx, edx
lea rax, [0x2057a960]
lea rcx, [0x20481c60]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0x6c31e0be
mov r8d, edx
xor r8d, 0x93ce1f43
and edx, 0x13ce1f43
lea edx, [r8 + rdx*2]
cmp edx, 3
jl 0x202ccec0
mov al, 0x1e
xchg byte [0x2057a963], al
lea rax, [0x2057a960]
ret