joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401fec80
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1401fecbc
test edx, edx
je 0x1401fed0c
movzx eax, byte [0x14061ded3]
cmp al, 0x9e
je 0x1401fecb4
mov cl, 0xa2
nop word [rax + rax]
mov al, 0x70
lock cmpxchg byte [0x14061ded3], cl
je 0x1401fed6c
cmp al, 0x9e
jne 0x1401feca0
lea rax, [0x14061dea0]
ret
mov eax, dword [0x14061eef0]
xor r8d, 0xf5f2436
mov ecx, r8d
xor ecx, eax
and r8d, eax
lea eax, [rcx + r8*2]
cmp edx, eax
jne 0x1401fed3c
movzx eax, byte [0x14061df1d]
cmp al, 0x80
je 0x1401fed04
mov cl, 0x49
nop word cs:[rax + rax]
mov al, 0x2e
lock cmpxchg byte [0x14061df1d], cl
je 0x1401fee42
cmp al, 0x80
jne 0x1401fecf0
lea rax, [0x14061dee0]
ret
movzx eax, byte [0x14061e0a9]
cmp al, 0x4b
je 0x1401fed34
mov cl, 0x86
nop dword [rax]
mov al, 0xc1
lock cmpxchg byte [0x14061e0a9], cl
je 0x1401fedf2
cmp al, 0x4b
jne 0x1401fed20
lea rax, [0x14061e0a0]
ret
movzx eax, byte [0x14061e09d]
cmp al, 0x9f
je 0x1401fed64
mov cl, 0x7d
nop dword [rax]
mov al, 0x56
lock cmpxchg byte [0x14061e09d], cl
je 0x1401fee9e
cmp al, 0x9f
jne 0x1401fed50
lea rax, [0x14061e090]
ret
xor r9d, r9d
lea rax, [0x14061dea0]
lea rcx, [0x140535430]
mov edx, r8d
xor edx, 0xa040403
xor r8d, 0x95fba9bc
and edx, 0x1aa48d8b
lea edx, [r8 + rdx*2]
nop word [rax + rax]
movsxd r8, r9d
movzx r9d, byte [r8 + rcx]
add byte [r8 + rax], r9b
mov r9d, dword [0x14061eef0]
add r9d, edx
mov r10d, 0x9aa48d8a
sub r10d, r9d
add r9d, 0x655b7275
mov r11d, r10d
xor r11d, r9d
and r11d, r8d
xor r11d, r9d
xor r10d, r8d
and r10d, r8d
lea r9d, [r11 + r10*2]
cmp r9d, 0x33
jl 0x1401feda0
mov al, 0x9e
xchg byte [0x14061ded3], al
lea rax, [0x14061dea0]
ret
xor eax, eax
lea rcx, [0x14061e0a0]
lea rdx, [0x140535620]
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 8
jg 0x1401fee28
inc rax
jmp 0x1401fee10
xor r8b, 0x16
add r8b, byte [0x14061eef4]
xchg byte [0x14061e0a9], r8b
lea rax, [0x14061e0a0]
ret
xor eax, eax
lea rcx, [0x14061dee0]
lea rdx, [0x140535470]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
mov r11d, r10d
xor r11b, r9b
not r9b
and r8b, r9b
or r8b, r11b
not r8b
xor r10b, r9b
and r10b, r9b
or r10b, r8b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 0x3c
jg 0x1401feec8
inc rax
jmp 0x1401fee60
xor eax, eax
lea rcx, [0x14061e090]
lea rdx, [0x140535610]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401feed8
inc rax
jmp 0x1401feeb0
mov al, 0x80
xchg byte [0x14061df1d], al
lea rax, [0x14061dee0]
ret
mov al, 0x9f
xchg byte [0x14061e09d], al
lea rax, [0x14061e090]
ret
Function at 0x140213f50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x140213f96
test edx, edx
je 0x140213fdc
movzx eax, byte [0x14061fcf4]
cmp al, 0xde
je 0x140213f8e
mov cl, 0xfa
nop dword [rax]
mov al, 0xcf
lock cmpxchg byte [0x14061fcf4], cl
je 0x14021404c
movzx edx, byte [0x1406215d4]
add dl, 0x7b
cmp al, dl
jne 0x140213f70
lea rax, [0x14061fce0]
ret
test edx, edx
je 0x140214016
movzx eax, byte [0x14061fada]
movzx ecx, byte [0x1406215d4]
add cl, 0xf8
cmp al, cl
je 0x140213fd4
mov cl, 0xa
nop word cs:[rax + rax]
mov al, 0xe8
lock cmpxchg byte [0x14061fada], cl
je 0x1402140a1
cmp al, 0x5b
jne 0x140213fc0
lea rax, [0x14061fad0]
ret
movzx eax, byte [0x14061fac9]
cmp al, 0xb8
je 0x14021400e
mov cl, 0x35
nop dword [rax]
mov al, 0x27
lock cmpxchg byte [0x14061fac9], cl
je 0x1402140d8
movzx edx, byte [0x1406215d4]
add dl, 0x55
cmp al, dl
jne 0x140213ff0
lea rax, [0x14061fac0]
ret
movzx eax, byte [0x14061fdbd]
cmp al, 0xc
je 0x140214044
mov cl, 0x6c
nop word cs:[rax + rax]
mov al, 0x26
lock cmpxchg byte [0x14061fdbd], cl
je 0x140214128
cmp al, 0xc
jne 0x140214030
lea rax, [0x14061fdb0]
ret
xor eax, eax
lea rcx, [0x14061fce0]
lea rdx, [0x140535ce0]
mov r8d, 0x76a2eb1c
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1406215d0]
add r10d, r8d
cmp r9d, r10d
jge 0x140214091
inc rax
jmp 0x140214070
mov al, 0xde
xchg byte [0x14061fcf4], al
lea rax, [0x14061fce0]
ret
xor eax, eax
lea rcx, [0x14061fad0]
lea rdx, [0x140535ae0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 9
jg 0x140214108
inc rax
jmp 0x1402140c0
xor eax, eax
lea rcx, [0x14061fac0]
lea rdx, [0x140535ad0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x140214118
inc rax
jmp 0x1402140f0
mov al, 0x5b
xchg byte [0x14061fada], al
lea rax, [0x14061fad0]
ret
mov al, 0xb8
xchg byte [0x14061fac9], al
lea rax, [0x14061fac0]
ret
xor edx, edx
lea rax, [0x14061fdb0]
lea rcx, [0x140535db0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0x8c2be74f
and edx, 0xc2be74f
lea edx, [r8 + rdx*2]
add edx, 0x73d418b2
cmp edx, 0xd
jl 0x140214140
mov al, 0xc
xchg byte [0x14061fdbd], al
lea rax, [0x14061fdb0]
ret
Function at 0x140214250
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14021428c
mov eax, 0x76a2eb08
add eax, dword [0x1406215d0]
cmp edx, eax
jne 0x1402142bc
movzx eax, byte [0x14061fabc]
cmp al, 0xf6
je 0x140214284
mov cl, 0x72
mov al, 0x5a
lock cmpxchg byte [0x14061fabc], cl
je 0x14021432c
cmp al, 0xf6
jne 0x140214270
lea rax, [0x14061fab0]
ret
test edx, edx
je 0x1402142f6
movzx eax, byte [0x14061fd75]
cmp al, 0xd3
je 0x1402142b4
mov cl, 0xf2
nop dword [rax]
mov al, 0xbe
lock cmpxchg byte [0x14061fd75], cl
je 0x1402143fa
cmp al, 0xd3
jne 0x1402142a0
lea rax, [0x14061fd60]
ret
movzx eax, byte [0x14061fbc3]
cmp al, 0x7b
je 0x1402142ee
mov cl, 0xd7
nop dword [rax]
mov al, 0xcd
lock cmpxchg byte [0x14061fbc3], cl
je 0x140214372
movzx edx, byte [0x1406215d4]
add dl, 0x18
cmp al, dl
jne 0x1402142d0
lea rax, [0x14061fbc0]
ret
movzx eax, byte [0x14061fc46]
cmp al, 0xbf
je 0x140214324
mov cl, 0x7f
nop word cs:[rax + rax]
mov al, 0xfa
lock cmpxchg byte [0x14061fc46], cl
je 0x140214446
cmp al, 0xbf
jne 0x140214310
lea rax, [0x14061fc20]
ret
xor eax, eax
lea rcx, [0x14061fab0]
lea rdx, [0x140535ac0]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r8b
mov r10d, r8d
and r10b, r9b
not r9b
xor r8b, r9b
and r8b, r9b
or r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x1402143da
inc rax
jmp 0x140214340
xor eax, eax
lea rcx, [0x14061fbc0]
lea rdx, [0x140535bc0]
mov r8d, 0x76a2eb0b
nop dword [rax + rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, 0x8a
and r9b, 0xa
add r9b, r9b
add r9b, r11b
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
add r9b, 0x76
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1406215d0]
add r10d, r8d
cmp r9d, r10d
jge 0x1402143ea
inc rax
jmp 0x140214390
mov al, 0xf6
xchg byte [0x14061fabc], al
lea rax, [0x14061fab0]
ret
mov al, 0x7b
xchg byte [0x14061fbc3], al
lea rax, [0x14061fbc0]
ret
xor edx, edx
lea rax, [0x14061fd60]
lea rcx, [0x140535d60]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x140214410
movzx eax, byte [0x1406215d4]
add al, 0x70
xchg byte [0x14061fd75], al
lea rax, [0x14061fd60]
ret
xor eax, eax
lea rcx, [0x14061fc20]
lea rdx, [0x140535c20]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r9b
mov r10d, r9d
or r10b, r8b
not r10b
and r9b, r8b
or r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x25
jg 0x14021448f
inc rax
jmp 0x140214460
mov al, 0xbf
xchg byte [0x14061fc46], al
lea rax, [0x14061fc20]
ret
Function at 0x140214890
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1402148cc
test edx, edx
je 0x1402148fc
movzx eax, byte [0x14061fd4e]
cmp al, 0xf0
je 0x1402148c4
mov cl, 0xa
nop word cs:[rax + rax]
mov al, 0x83
lock cmpxchg byte [0x14061fd4e], cl
je 0x14021496c
cmp al, 0xf0
jne 0x1402148b0
lea rax, [0x14061fd40]
ret
test edx, edx
je 0x14021492c
movzx eax, byte [0x14061fcbd]
cmp al, 0xcb
je 0x1402148f4
mov cl, 0x9a
nop dword [rax]
mov al, 0x3d
lock cmpxchg byte [0x14061fcbd], cl
je 0x1402149d5
cmp al, 0xcb
jne 0x1402148e0
lea rax, [0x14061fcb0]
ret
movzx eax, byte [0x14061fbf3]
cmp al, 0x9e
je 0x140214924
mov cl, 0x1d
nop dword [rax]
mov al, 0x6d
lock cmpxchg byte [0x14061fbf3], cl
je 0x140214a08
cmp al, 0x9e
jne 0x140214910
lea rax, [0x14061fbd0]
ret
movzx eax, byte [0x14061fcdd]
movzx ecx, byte [0x1406215d4]
add cl, 0x4c
cmp al, cl
je 0x140214964
mov cl, 0xe6
nop word cs:[rax + rax]
mov al, 0xaa
lock cmpxchg byte [0x14061fcdd], cl
je 0x140214a76
cmp al, 0xaf
jne 0x140214950
lea rax, [0x14061fcd0]
ret
xor eax, eax
lea rcx, [0x14061fd40]
lea rdx, [0x140535d40]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
mov r11d, r10d
xor r11b, r9b
not r9b
and r8b, r9b
or r8b, r11b
not r8b
xor r10b, r9b
and r10b, r9b
or r10b, r8b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x1402149be
inc rax
jmp 0x140214980
movzx eax, byte [0x1406215d4]
add al, 0x8d
xchg byte [0x14061fd4e], al
lea rax, [0x14061fd40]
ret
xor eax, eax
lea rcx, [0x14061fcb0]
lea rdx, [0x140535cb0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140214a5f
inc rax
jmp 0x1402149f0
xor edx, edx
lea rax, [0x14061fbd0]
lea rcx, [0x140535bd0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x23
jl 0x140214a20
mov al, 0x9e
xchg byte [0x14061fbf3], al
lea rax, [0x14061fbd0]
ret
movzx eax, byte [0x1406215d4]
add al, 0x68
xchg byte [0x14061fcbd], al
lea rax, [0x14061fcb0]
ret
xor edx, edx
lea rax, [0x14061fcd0]
lea rcx, [0x140535cd0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1406215d0]
mov r9d, r8d
xor r9d, 0x88280a38
and r8d, 0x8280a38
lea r8d, [r9 + r8*2]
add edx, r8d
add edx, 0xee7ae0d1
cmp edx, 0xd
jl 0x140214a90
mov al, 0xaf
xchg byte [0x14061fcdd], al
lea rax, [0x14061fcd0]
ret
Function at 0x140214af0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140214b2c
test edx, edx
je 0x140214b5c
movzx eax, byte [0x14061fda4]
movzx ecx, byte [0x1406215d4]
add cl, 0x6f
cmp al, cl
je 0x140214b24
mov cl, 2
nop
mov al, 0xb6
lock cmpxchg byte [0x14061fda4], cl
je 0x140214bbc
cmp al, 0xd2
jne 0x140214b10
lea rax, [0x14061fd90]
ret
test edx, edx
je 0x140214b8c
movzx eax, byte [0x14061fded]
cmp al, 0x3f
je 0x140214b54
mov cl, 2
nop dword [rax]
mov al, 0x75
lock cmpxchg byte [0x14061fded], cl
je 0x140214c27
cmp al, 0x3f
jne 0x140214b40
lea rax, [0x14061fde0]
ret
movzx eax, byte [0x14061fd0d]
cmp al, 0x5b
je 0x140214b84
mov cl, 0x8e
nop dword [rax]
mov al, 0xe6
lock cmpxchg byte [0x14061fd0d], cl
je 0x140214c86
cmp al, 0x5b
jne 0x140214b70
lea rax, [0x14061fd00]
ret
movzx eax, byte [0x14061fd5d]
cmp al, 0x67
je 0x140214bb4
mov cl, 0x3f
nop dword [rax]
mov al, 2
lock cmpxchg byte [0x14061fd5d], cl
je 0x140214cf7
cmp al, 0x67
jne 0x140214ba0
lea rax, [0x14061fd50]
ret
xor r8d, r8d
lea rax, [0x14061fd90]
lea rcx, [0x140535d90]
mov edx, 0x76a2eb1c
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
add byte [r8 + rax], r9b
add r8d, 0xc2813a15
mov r9d, r8d
xor r9d, 0x3d7ec5ec
and r8d, 0x3d7ec5ec
lea r8d, [r9 + r8*2]
mov r9d, dword [0x1406215d0]
add r9d, edx
cmp r8d, r9d
jl 0x140214be0
mov al, 0xd2
xchg byte [0x14061fda4], al
lea rax, [0x14061fd90]
ret
xor edx, edx
lea rax, [0x14061fde0]
lea rcx, [0x140535de0]
nop word [rax + rax]
movsxd r8, edx
movzx edx, byte [r8 + rcx]
xor byte [r8 + rax], dl
lea edx, [r8 + r8]
sub edx, r8d
inc edx
mov r8d, dword [0x1406215d0]
mov r9d, r8d
xor r9d, 0x76a2eb15
and r8d, 0x76a2eb15
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x140214c40
mov al, 0x3f
xchg byte [0x14061fded], al
lea rax, [0x14061fde0]
ret
xor eax, eax
lea rcx, [0x14061fd00]
lea rdx, [0x140535d00]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
mov r9d, dword [0x1406215d0]
mov r10d, r9d
xor r10d, 0x76a2eb15
and r9d, 0x76a2eb15
lea r9d, [r10 + r9*2]
cmp r8d, r9d
jge 0x140214ce7
inc rax
jmp 0x140214ca0
mov al, 0x5b
xchg byte [0x14061fd0d], al
lea rax, [0x14061fd00]
ret
xor eax, eax
lea rcx, [0x14061fd50]
lea rdx, [0x140535d50]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140214d28
inc rax
jmp 0x140214d10
mov al, 0x67
xchg byte [0x14061fd5d], al
lea rax, [0x14061fd50]
ret
Function at 0x140236f20
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140236f7c
mov eax, dword [0x140621e30]
mov ecx, eax
xor ecx, 0x22f307eb
and ecx, eax
xor eax, 0xdd0cf814
lea eax, [rax + rcx*2]
cmp edx, eax
jne 0x140236fdc
movzx eax, byte [0x140621c17]
cmp al, 0xbb
je 0x140236f74
mov cl, 0x9b
nop word cs:[rax + rax]
mov al, 0xf1
lock cmpxchg byte [0x140621c17], cl
je 0x1402370f6
cmp al, 0xbb
jne 0x140236f60
lea rax, [0x140621c10]
ret
mov eax, dword [0x140621e30]
mov ecx, eax
xor ecx, 0x30577c90
and eax, 0x30577c90
lea eax, [rcx + rax*2]
mov ecx, eax
xor ecx, 0xacb57b84
and eax, 0x2cb57b84
lea eax, [rcx + rax*2]
cmp edx, eax
jne 0x1402370c0
movzx eax, byte [0x140621d56]
cmp al, 1
je 0x140236fd4
mov cl, 0x88
nop word [rax + rax]
mov al, 0xa1
lock cmpxchg byte [0x140621d56], cl
je 0x140237138
cmp al, 1
jne 0x140236fc0
lea rax, [0x140621d30]
ret
movzx eax, byte [0x140621d8b]
nop word cs:[rax + rax]
cmp al, 0x3a
je 0x1402370b8
movzx ecx, byte [0x140621e34]
mov eax, ecx
mov edx, ecx
not dl
mov r8d, edx
and dl, 0x33
mov r9d, ecx
and r9b, 0x4c
or r9b, dl
mov edx, ecx
and r9b, cl
xor cl, 0x5c
and al, 0x5c
add al, al
add al, cl
and dl, 0xb3
and r8b, 0x4c
or r8b, dl
add r9b, r9b
add r9b, r8b
lock cmpxchg byte [0x140621d8b], r9b
jne 0x140236ff0
xor edx, edx
lea rax, [0x140621d80]
lea rcx, [0x140536380]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, 0xf4bfd722
sub r8d, edx
mov edx, r8d
not edx
lea r8d, [rdx + r8*2]
mov edx, 0xf4bfd722
sub edx, r8d
mov r8d, dword [0x140621e30]
mov r9d, r8d
xor r9d, 0xdd0cf81f
not r8d
and r8d, 0x22f307e0
or r8d, r9d
not r8d
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x140237050
mov al, 0x3a
xchg byte [0x140621d8b], al
lea rax, [0x140621d80]
ret
movzx eax, byte [0x140621daf]
cmp al, 0xed
je 0x1402370ee
mov cl, 0xc5
nop dword [rax]
mov al, 0xde
lock cmpxchg byte [0x140621daf], cl
je 0x140237185
movzx edx, byte [0x140621e34]
add dl, 0x29
cmp al, dl
jne 0x1402370d0
lea rax, [0x140621da0]
ret
xor eax, eax
lea rcx, [0x140621c10]
lea rdx, [0x140536220]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 6
jg 0x140237128
inc rax
jmp 0x140237110
mov al, 0xbb
xchg byte [0x140621c17], al
lea rax, [0x140621c10]
ret
xor eax, eax
lea rcx, [0x140621d30]
lea rdx, [0x140536330]
mov r8d, 0xdd0cf83a
nop
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r10d
xor r11b, r9b
xor r11b, r9b
and r11b, r10b
xor r11b, r9b
mov byte [rax + rcx], r11b
lea r9d, [rax + 1]
mov r10d, dword [0x140621e30]
add r10d, r8d
cmp r9d, r10d
jge 0x1402371b8
inc rax
jmp 0x140237150
xor eax, eax
lea rcx, [0x140621da0]
lea rdx, [0x1405363a0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1402371c8
inc rax
jmp 0x1402371a0
mov al, 1
xchg byte [0x140621d56], al
lea rax, [0x140621d30]
ret
mov al, 0xed
xchg byte [0x140621daf], al
lea rax, [0x140621da0]
ret
Function at 0x1402371e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x14023721c
mov eax, 0xdd0cf814
add eax, dword [0x140621e30]
cmp edx, eax
jne 0x14023725c
movzx eax, byte [0x140621c31]
cmp al, 0x33
je 0x140237214
mov cl, 0xa4
mov al, 0xf6
lock cmpxchg byte [0x140621c31], cl
je 0x1402372f6
cmp al, 0x33
jne 0x140237200
lea rax, [0x140621c20]
ret
test edx, edx
je 0x1402372b8
movzx eax, byte [0x140621d03]
cmp al, 0x8d
je 0x140237254
mov cl, 0x70
nop word cs:[rax + rax]
mov al, 0x7f
lock cmpxchg byte [0x140621d03], cl
je 0x140237351
cmp al, 0x8d
jne 0x140237240
lea rax, [0x140621ce0]
ret
movzx eax, byte [0x140621d72]
nop word cs:[rax + rax]
cmp al, 0xf6
je 0x140237339
movzx ecx, byte [0x140621e34]
lea eax, [rcx - 0x11]
add cl, 0x13
lock cmpxchg byte [0x140621d72], cl
jne 0x140237270
xor eax, eax
lea rcx, [0x140621d70]
lea rdx, [0x140536370]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x140237331
inc rax
jmp 0x1402372a0
movzx eax, byte [0x140621dbd]
cmp al, 0xfa
je 0x1402372ee
mov cl, 0x46
nop word cs:[rax + rax]
mov al, 0x77
lock cmpxchg byte [0x140621dbd], cl
je 0x14023739f
movzx edx, byte [0x140621e34]
add dl, 0x36
cmp al, dl
jne 0x1402372d0
lea rax, [0x140621db0]
ret
xor eax, eax
lea rcx, [0x140621c20]
lea rdx, [0x140536230]
mov r8d, 0xdd0cf825
nop dword [rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140621e30]
add r10d, r8d
cmp r9d, r10d
jge 0x140237341
inc rax
jmp 0x140237310
mov al, 0xf6
xchg byte [0x140621d72], al
lea rax, [0x140621d70]
ret
mov al, 0x33
xchg byte [0x140621c31], al
lea rax, [0x140621c20]
ret
xor eax, eax
lea rcx, [0x140621ce0]
lea rdx, [0x1405362e0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x140237388
inc rax
jmp 0x140237370
movzx eax, byte [0x140621e34]
add al, 0xc9
xchg byte [0x140621d03], al
lea rax, [0x140621ce0]
ret
xor edx, edx
lea rax, [0x140621db0]
lea rcx, [0x1405363b0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x140621e30]
add edx, r8d
add edx, 0xdd0cf815
add r8d, 0xdd0cf821
cmp edx, r8d
jl 0x1402373b0
mov al, 0xfa
xchg byte [0x140621dbd], al
lea rax, [0x140621db0]
ret
Function at 0x1402378f0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14023792c
test edx, edx
je 0x140237997
movzx eax, byte [0x140621c06]
cmp al, 0x6c
je 0x140237924
mov cl, 0x3d
nop
mov al, 0xff
lock cmpxchg byte [0x140621c06], cl
je 0x1402379fc
cmp al, 0x6c
jne 0x140237910
lea rax, [0x140621c00]
ret
mov eax, r8d
not eax
mov ecx, r8d
xor ecx, 0x9a245dab
or eax, 0x65dba254
and eax, ecx
add eax, dword [0x140621e30]
cmp edx, eax
jne 0x1402379cc
movzx eax, byte [0x140621dd3]
cmp al, 0x6f
je 0x14023798f
mov cl, 0x8c
nop dword [rax]
mov al, 0xd6
lock cmpxchg byte [0x140621dd3], cl
je 0x140237ac6
mov edx, r8d
xor dl, 0x14
mov r9b, 0xc0
sub r9b, byte [0x140621e34]
not r9b
add r9b, dl
add r9b, 0xc1
cmp al, r9b
jne 0x140237960
lea rax, [0x140621dc0]
ret
movzx eax, byte [0x140621d2f]
cmp al, 9
je 0x1402379c4
mov cl, 0xbf
nop word cs:[rax + rax]
mov al, 0xec
lock cmpxchg byte [0x140621d2f], cl
je 0x140237a67
cmp al, 9
jne 0x1402379b0
lea rax, [0x140621d20]
ret
movzx eax, byte [0x140621c72]
cmp al, 0x2b
je 0x1402379f4
mov cl, 0x1b
nop dword [rax]
mov al, 0xb7
lock cmpxchg byte [0x140621c72], cl
je 0x140237b0f
cmp al, 0x2b
jne 0x1402379e0
lea rax, [0x140621c60]
ret
xor eax, eax
lea rcx, [0x140621c00]
lea rdx, [0x140536210]
xor r8d, 0x9a245daa
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
not r9b
mov r11d, r9d
and r11b, r10b
not r10b
xor r9b, r10b
and r9b, r10b
or r9b, r11b
mov byte [rax + rcx], r9b
mov r9d, dword [0x140621e30]
add r9d, r8d
add eax, r9d
cmp eax, 6
jl 0x140237a20
mov al, 0x6c
xchg byte [0x140621c06], al
lea rax, [0x140621c00]
ret
xor eax, eax
lea rcx, [0x140621d20]
lea rdx, [0x140536320]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
add r8b, byte [rax + rcx]
mov r9b, 0xad
sub r9b, r8b
mov r8d, r9d
xor r8b, 0x53
and r9b, 0x53
add r9b, r9b
add r9b, r8b
neg r9b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x140237ab6
inc rax
jmp 0x140237a80
mov al, 9
xchg byte [0x140621d2f], al
lea rax, [0x140621d20]
ret
xor eax, eax
lea rcx, [0x140621dc0]
lea rdx, [0x1405363c0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r9b
mov r10d, r9d
or r10b, r8b
not r10b
and r9b, r8b
or r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x12
jg 0x140237b38
inc rax
jmp 0x140237ae0
xor eax, eax
lea rcx, [0x140621c60]
lea rdx, [0x140536270]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x140237b48
inc rax
jmp 0x140237b20
mov al, 0x6f
xchg byte [0x140621dd3], al
lea rax, [0x140621dc0]
ret
mov al, 0x2b
xchg byte [0x140621c72], al
lea rax, [0x140621c60]
ret
Function at 0x140241920
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov r15, r8
mov rbx, rdx
mov rdi, rcx
mov rcx, rdx
mov edx, 0x2a695142
mov r8d, 0xff6b6e86
call fcn.1400a77c0
mov r14, rax
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0x10
jb 0x14024195b
mov rdi, qword [rdi]
mov rsi, 0xffffffffffffffff
sub rax, r14
jb 0x140241a31
cmp rax, r15
jb 0x140241a31
movabs rcx, 0x86024cc3620574aa
add rcx, qword [0x140623ec0]
cmp r14, rcx
je 0x140241a2e
lea r12, [rdi + rax]
inc r12
add r15, rdi
movsx ebp, byte [rbx]
mov r8, r12
sub r8, r15
mov dword [rsp + 0x28], 0xaeff818a
mov dword [rsp + 0x20], 0x553ea403
mov rcx, r15
mov edx, ebp
mov r9d, 0x60435d4e
call fcn.140245190
test rax, rax
je 0x140241a31
mov r15, rax
nop dword [rax]
mov eax, dword [0x140623ec8]
lea r9d, [rax + 0x7d71bd3d]
add eax, 0x2294c27c
mov dword [rsp + 0x20], eax
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.1400ab610
test eax, eax
je 0x140241a2b
inc r15
mov r8, r12
sub r8, r15
mov dword [rsp + 0x28], 0xaeff818a
mov dword [rsp + 0x20], 0x553ea403
mov rcx, r15
mov edx, ebp
mov r9d, 0x60435d4e
call fcn.140245190
mov r15, rax
test rax, rax
jne 0x1402419d0
jmp 0x140241a31
sub r15, rdi
mov rsi, r15
xor eax, eax
test al, al
jne 0x140241a50
mov eax, dword [0x1406943c8]
mov ecx, dword [0x140623ec8]
add ecx, eax
dec ecx
imul ecx, eax
test cl, 1
je 0x140241a7b
nop
mov eax, dword [0x1406943c8]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
mov eax, dword [0x140623ec8]
mov edx, eax
xor edx, 0xfa14a9ac
and eax, 0x7a14a9ac
lea eax, [rdx + rax*2]
cmp ecx, eax
jne 0x140241a50
jmp 0x140241a37
mov rax, rsi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret