joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140179170
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401791ac
test edx, edx
je 0x1401791dc
movzx eax, byte [0x14050c984]
cmp al, 0x9c
je 0x1401791a4
mov cl, 0x47
nop word cs:[rax + rax]
mov al, 0x80
lock cmpxchg byte [0x14050c984], cl
je 0x14017924c
cmp al, 0x9c
jne 0x140179190
lea rax, [0x14050c980]
ret
test edx, edx
je 0x14017921b
movzx eax, byte [0x14050ca85]
cmp al, 0x48
je 0x1401791d4
mov cl, 0x84
nop dword [rax]
mov al, 0xa0
lock cmpxchg byte [0x14050ca85], cl
je 0x14017929b
cmp al, 0x48
jne 0x1401791c0
lea rax, [0x14050ca70]
ret
movzx eax, byte [0x14050cbb2]
cmp al, 0xac
je 0x140179213
mov ecx, dword [rsp + 0x28]
mov dl, 0xfe
nop dword [rax]
mov al, 0x75
lock cmpxchg byte [0x14050cbb2], dl
je 0x1401792c8
mov r8d, ecx
xor r8b, 0xd5
add r8b, byte [0x14050cee4]
cmp al, r8b
jne 0x1401791f0
lea rax, [0x14050cba0]
ret
movzx eax, byte [0x14050cb0e]
cmp al, 0xbb
je 0x140179244
mov cl, 0x90
nop dword [rax + rax]
mov al, 0xef
lock cmpxchg byte [0x14050cb0e], cl
je 0x140179318
cmp al, 0xbb
jne 0x140179230
lea rax, [0x14050cb00]
ret
xor edx, edx
lea rax, [0x14050c980]
lea rcx, [0x14042c3e0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0x48170b2b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0xb7e8f4d5
cmp edx, 4
jl 0x140179260
mov al, 0x9c
xchg byte [0x14050c984], al
lea rax, [0x14050c980]
ret
xor eax, eax
lea rcx, [0x14050ca70]
lea rdx, [0x14042c4c0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1401792f8
inc rax
jmp 0x1401792b0
xor eax, eax
lea rcx, [0x14050cba0]
lea rdx, [0x14042c5f0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x140179308
inc rax
jmp 0x1401792e0
mov al, 0x48
xchg byte [0x14050ca85], al
lea rax, [0x14050ca70]
ret
mov al, 0xac
xchg byte [0x14050cbb2], al
lea rax, [0x14050cba0]
ret
xor eax, eax
lea rcx, [0x14050cb00]
lea rdx, [0x14042c550]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x140179348
inc rax
jmp 0x140179330
mov al, 0xbb
xchg byte [0x14050cb0e], al
lea rax, [0x14050cb00]
ret

Function at 0x14018e9e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x1405644fc]
cmp eax, 0x57
jg 0x14018ea15
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
call fcn.14014abc0
mov eax, dword [0x1405644fc]
cmp eax, 0x52
jl 0x14018ea5a
lea rax, [fcn.14018e9e0]
lea ebp, [rax + rax]
add ebp, 0x2f00
nop word cs:[rax + rax]
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
call fcn.14014abc0
mov eax, dword [0x14050fe38]
mov ecx, eax
xor ecx, 0x56f5ddb1
and eax, 0x56f5ddb1
lea eax, [rcx + rax*2]
test ebp, eax
jne 0x14018ea30
jmp 0x14018e9fc
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14018ef40
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x56f5ddb0
add eax, dword [0x14050fe38]
cmp ecx, eax
jne 0x14018ef8c
test edx, edx
je 0x14018f01c
cmp byte [0x14050d525], 0
je 0x14018ef84
mov cl, 0x3f
nop word cs:[rax + rax]
mov al, 0x3c
lock cmpxchg byte [0x14050d525], cl
je 0x14018f04c
test al, al
jne 0x14018ef70
lea rax, [0x14050d510]
ret
mov eax, dword [0x14050fe38]
mov ecx, eax
xor ecx, 0x56f5ddb0
and eax, 0x56f5ddb0
lea eax, [rcx + rax*2]
cmp edx, eax
jne 0x14018efe6
movzx eax, byte [0x14050d55e]
cmp al, 0x65
je 0x14018efde
mov cl, 0xde
nop word cs:[rax + rax]
mov al, 0x89
lock cmpxchg byte [0x14050d55e], cl
je 0x14018f091
movzx edx, byte [0x14050fe48]
add dl, 0xe6
cmp al, dl
jne 0x14018efc0
lea rax, [0x14050d550]
ret
movzx eax, byte [0x14050d60d]
cmp al, 0x1a
je 0x14018f014
mov cl, 0x63
nop word cs:[rax + rax]
mov al, 0x48
lock cmpxchg byte [0x14050d60d], cl
je 0x14018f0c8
cmp al, 0x1a
jne 0x14018f000
lea rax, [0x14050d600]
ret
movzx eax, byte [0x14050d76d]
cmp al, 0x8c
je 0x14018f044
mov cl, 0xe7
nop dword [rax]
mov al, 0xb9
lock cmpxchg byte [0x14050d76d], cl
je 0x14018f118
cmp al, 0x8c
jne 0x14018f030
lea rax, [0x14050d760]
ret
xor edx, edx
lea rax, [0x14050d510]
lea rcx, [0x14042c8f0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x14050fe38]
add edx, r8d
add edx, 0x56f5ddb1
cmp edx, 0x15
jl 0x14018f060
xor eax, eax
xchg byte [0x14050d525], al
lea rax, [0x14050d510]
ret
xor eax, eax
lea rcx, [0x14050d550]
lea rdx, [0x14042c930]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x14018f0f8
inc rax
jmp 0x14018f0b0
xor eax, eax
lea rcx, [0x14050d600]
lea rdx, [0x14042c9d0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14018f108
inc rax
jmp 0x14018f0e0
mov al, 0x65
xchg byte [0x14050d55e], al
lea rax, [0x14050d550]
ret
mov al, 0x1a
xchg byte [0x14050d60d], al
lea rax, [0x14050d600]
ret
xor eax, eax
lea rcx, [0x14050d760]
lea rdx, [0x14042cb30]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14018f148
inc rax
jmp 0x14018f130
mov al, 0x8c
xchg byte [0x14050d76d], al
lea rax, [0x14050d760]
ret
Function at 0x14018f160
Capabilities:
Encode data using xor

Disassembly:
push rbx
test ecx, ecx
je 0x14018f199
test edx, edx
je 0x14018f1c9
movzx eax, byte [0x14050d6bd]
cmp al, 0xad
je 0x14018f297
mov cl, 0x64
nop word [rax + rax]
mov al, 0x73
lock cmpxchg byte [0x14050d6bd], cl
je 0x14018f25c
cmp al, 0xad
jne 0x14018f180
jmp 0x14018f297
test edx, edx
je 0x14018f1f9
movzx eax, byte [0x14050d590]
cmp al, 0xe
je 0x14018f343
mov cl, 0xd4
nop
mov al, 0x39
lock cmpxchg byte [0x14050d590], cl
je 0x14018f2a0
cmp al, 0xe
jne 0x14018f1b0
jmp 0x14018f343
movzx eax, byte [0x14050d6f5]
cmp al, 0xe1
je 0x14018f332
mov cl, 0x85
nop word [rax + rax]
mov al, 0xef
lock cmpxchg byte [0x14050d6f5], cl
je 0x14018f2f0
cmp al, 0xe1
jne 0x14018f1e0
jmp 0x14018f332
movzx eax, byte [0x14050d4d9]
cmp al, 0x9a
je 0x14018f354
movzx ecx, byte [0x14050fe48]
lea eax, [rcx - 0x40]
mov edx, ecx
xor dl, 0x49
and cl, 0x49
add cl, cl
add cl, dl
lock cmpxchg byte [0x14050d4d9], cl
jne 0x14018f200
xor eax, eax
lea rcx, [0x14050d4d0]
lea rdx, [0x14042c8b0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x14018f34c
inc rax
jmp 0x14018f240
xor eax, eax
lea rcx, [0x14050d6b0]
lea rdx, [0x14042ca80]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14018f288
inc rax
jmp 0x14018f270
movzx eax, byte [0x14050fe48]
add al, 0x2e
xchg byte [0x14050d6bd], al
lea rax, [0x14050d6b0]
pop rbx
ret
xor eax, eax
lea rcx, [0x14050d580]
lea rdx, [0x14042c960]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
mov r11d, r10d
xor r11b, r9b
not r9b
mov ebx, r8d
and bl, r9b
or bl, r11b
not bl
xor r9b, r10b
and r9b, r8b
or r9b, bl
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x14018f33b
inc rax
jmp 0x14018f2b0
xor edx, edx
lea rax, [0x14050d6e0]
lea rcx, [0x14042cab0]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
add edx, edx
and edx, 2
mov r9d, r8d
xor r9d, edx
and edx, r8d
lea edx, [r9 + rdx*2]
cmp edx, 0x15
jl 0x14018f300
mov al, 0xe1
xchg byte [0x14050d6f5], al
lea rax, [0x14050d6e0]
pop rbx
ret
mov al, 0xe
xchg byte [0x14050d590], al
lea rax, [0x14050d580]
pop rbx
ret
mov al, 0x9a
xchg byte [0x14050d4d9], al
lea rax, [0x14050d4d0]
pop rbx
ret
Function at 0x14018f360
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14018f39c
test edx, edx
je 0x14018f3dc
movzx eax, byte [0x14050d5ef]
cmp al, 0xa
je 0x14018f394
mov cl, 0x76
nop word cs:[rax + rax]
mov al, 0x13
lock cmpxchg byte [0x14050d5ef], cl
je 0x14018f43c
cmp al, 0xa
jne 0x14018f380
lea rax, [0x14050d5e0]
ret
mov eax, 0x56f5ddb0
add eax, dword [0x14050fe38]
cmp edx, eax
jne 0x14018f40c
movzx eax, byte [0x14050d755]
cmp al, 0x80
je 0x14018f3d4
mov cl, 5
nop dword [rax + rax]
mov al, 0xcc
lock cmpxchg byte [0x14050d755], cl
je 0x14018f4df
cmp al, 0x80
jne 0x14018f3c0
lea rax, [0x14050d740]
ret
movzx eax, byte [0x14050d6ab]
cmp al, 0xbb
je 0x14018f404
mov cl, 0x5a
nop dword [rax]
mov al, 0x95
lock cmpxchg byte [0x14050d6ab], cl
je 0x14018f491
cmp al, 0xbb
jne 0x14018f3f0
lea rax, [0x14050d690]
ret
movzx eax, byte [0x14050d4cc]
cmp al, 0x3b
je 0x14018f434
mov cl, 0x82
nop dword [rax]
mov al, 0x72
lock cmpxchg byte [0x14050d4cc], cl
je 0x14018f53c
cmp al, 0x3b
jne 0x14018f420
lea rax, [0x14050d4c0]
ret
xor eax, eax
lea rcx, [0x14050d5e0]
lea rdx, [0x14042c9b0]
nop dword [rax]
movzx r8d, byte [rax + rcx]
mov r9d, r8d
xor r9b, 0xd7
and r8b, 0x57
add r8b, r8b
add r8b, r9b
add r8b, byte [rax + rdx]
add r8b, 0x29
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x14018f481
inc rax
jmp 0x14018f450
mov al, 0xa
xchg byte [0x14050d5ef], al
lea rax, [0x14050d5e0]
ret
xor edx, edx
lea rax, [0x14050d690]
lea rcx, [0x14042ca60]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x1b
jl 0x14018f4b0
mov al, 0xbb
xchg byte [0x14050d6ab], al
lea rax, [0x14050d690]
ret
xor edx, edx
lea rax, [0x14050d740]
lea rcx, [0x14042cb10]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, r8b
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x14018f4f0
mov al, 0x80
xchg byte [0x14050d755], al
lea rax, [0x14050d740]
ret
xor edx, edx
lea rax, [0x14050d4c0]
lea rcx, [0x14042c8a0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
add edx, 0x221dd5d4
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0xdde22a2c
cmp edx, 0xc
jl 0x14018f550
mov al, 0x3b
xchg byte [0x14050d4cc], al
lea rax, [0x14050d4c0]
ret
Function at 0x14018f5c0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14018f5fc
test edx, edx
je 0x14018f63c
movzx eax, byte [0x14050d5a3]
movzx ecx, byte [0x14050fe48]
add cl, 0x73
cmp al, cl
je 0x14018f5f4
mov cl, 2
nop
mov al, 0xbe
lock cmpxchg byte [0x14050d5a3], cl
je 0x14018f6ec
cmp al, 0xf2
jne 0x14018f5e0
lea rax, [0x14050d5a0]
ret
test edx, edx
je 0x14018f6bc
movzx eax, byte [0x14050d4ea]
cmp al, 0xde
je 0x14018f634
mov cl, 0x63
nop word cs:[rax + rax]
mov al, 0x92
lock cmpxchg byte [0x14050d4ea], cl
je 0x14018f749
cmp al, 0xde
jne 0x14018f620
lea rax, [0x14050d4e0]
ret
movzx eax, byte [0x14050d674]
nop word cs:[rax + rax]
movzx ecx, byte [0x14050fe48]
add cl, 0x29
cmp al, cl
je 0x14018f7bd
movzx ecx, byte [0x14050fe48]
lea eax, [rcx + 0x23]
mov edx, ecx
xor dl, 0xbc
and cl, 0x3c
add cl, cl
add cl, dl
add cl, 0xc2
lock cmpxchg byte [0x14050d674], cl
jne 0x14018f650
xor eax, eax
lea rcx, [0x14050d660]
lea rdx, [0x14042ca30]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x13
jg 0x14018f7b5
inc rax
jmp 0x14018f6a0
movzx eax, byte [0x14050d622]
cmp al, 0x86
je 0x14018f6e4
mov cl, 0xf6
nop dword [rax]
mov al, 0x34
lock cmpxchg byte [0x14050d622], cl
je 0x14018f7c5
cmp al, 0x86
jne 0x14018f6d0
lea rax, [0x14050d610]
ret
xor r8d, r8d
lea rax, [0x14050d5a0]
lea rcx, [0x14042c970]
mov edx, 0x56f5ddb1
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
add byte [r8 + rax], r9b
mov r9d, dword [0x14050fe38]
add r9d, edx
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r8d, [r10 + r9*2]
cmp r8d, 3
jl 0x14018f710
mov al, 0xf2
xchg byte [0x14050d5a3], al
lea rax, [0x14050d5a0]
ret
xor edx, edx
lea rax, [0x14050d4e0]
lea rcx, [0x14042c8c0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, dword [0x14050fe38]
add edx, r8d
add edx, 0x56f5ddb1
cmp edx, 0xa
jl 0x14018f760
movzx eax, byte [0x14050fe48]
mov ecx, eax
xor cl, 0x5f
and al, 0x5f
add al, al
add al, cl
xchg byte [0x14050d4ea], al
lea rax, [0x14050d4e0]
ret
mov al, 0xa8
xchg byte [0x14050d674], al
lea rax, [0x14050d660]
ret
xor edx, edx
lea rax, [0x14050d610]
lea rcx, [0x14042c9e0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x14050fe38]
add edx, r8d
add edx, 0x56f5ddb1
cmp edx, 0x12
jl 0x14018f7e0
movzx eax, byte [0x14050fe48]
add al, 7
xchg byte [0x14050d622], al
lea rax, [0x14050d610]
ret
Function at 0x14018f820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x14018f85c
test edx, edx
je 0x14018f88c
movzx eax, byte [0x14050d79d]
cmp al, 0xd
je 0x14018f854
mov cl, 0x10
nop word cs:[rax + rax]
mov al, 0x57
lock cmpxchg byte [0x14050d79d], cl
je 0x14018f8f6
cmp al, 0xd
jne 0x14018f840
lea rax, [0x14050d790]
ret
test edx, edx
je 0x14018f8bc
movzx eax, byte [0x14050d64d]
cmp al, 0x12
je 0x14018f884
mov cl, 0x57
nop dword [rax]
mov al, 0xdb
lock cmpxchg byte [0x14050d64d], cl
je 0x14018f938
cmp al, 0x12
jne 0x14018f870
lea rax, [0x14050d640]
ret
movzx eax, byte [0x14050d781]
cmp al, 0x74
je 0x14018f8b4
mov cl, 0xe4
nop dword [rax]
mov al, 0xf5
lock cmpxchg byte [0x14050d781], cl
je 0x14018f988
cmp al, 0x74
jne 0x14018f8a0
lea rax, [0x14050d770]
ret
movzx eax, byte [0x14050d73d]
cmp al, 0x1d
je 0x14018f8ee
mov cl, 0x97
nop dword [rax]
mov al, 0x4b
lock cmpxchg byte [0x14050d73d], cl
je 0x14018f9c8
movzx edx, byte [0x14050fe48]
add dl, 0x9e
cmp al, dl
jne 0x14018f8d0
lea rax, [0x14050d730]
ret
xor eax, eax
lea rcx, [0x14050d790]
lea rdx, [0x14042cb60]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14018f928
inc rax
jmp 0x14018f910
mov al, 0xd
xchg byte [0x14050d79d], al
lea rax, [0x14050d790]
ret
xor edx, edx
lea rax, [0x14050d640]
lea rcx, [0x14042ca10]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x14050fe38]
add edx, r8d
add edx, 0x56f5ddb1
cmp edx, 0xd
jl 0x14018f950
movzx eax, byte [0x14050fe48]
add al, 0x93
xchg byte [0x14050d64d], al
lea rax, [0x14050d640]
ret
xor eax, eax
lea rcx, [0x14050d770]
lea rdx, [0x14042cb40]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x14018f9b8
inc rax
jmp 0x14018f9a0
mov al, 0x74
xchg byte [0x14050d781], al
lea rax, [0x14050d770]
ret
xor eax, eax
lea rcx, [0x14050d730]
lea rdx, [0x14042cb00]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14018f9f8
inc rax
jmp 0x14018f9e0
mov al, 0x1d
xchg byte [0x14050d73d], al
lea rax, [0x14050d730]
ret
Function at 0x140190460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x14019049c
test edx, edx
je 0x1401904cc
movzx eax, byte [0x14050d6dd]
cmp al, 0xb9
je 0x140190494
mov cl, 0x38
nop word cs:[rax + rax]
mov al, 0xce
lock cmpxchg byte [0x14050d6dd], cl
je 0x14019052c
cmp al, 0xb9
jne 0x140190480
lea rax, [0x14050d6d0]
ret
test edx, edx
je 0x1401904fc
movzx eax, byte [0x14050d7df]
cmp al, 0xf2
je 0x1401904c4
mov cl, 0xd3
nop dword [rax]
mov al, 0xae
lock cmpxchg byte [0x14050d7df], cl
je 0x140190568
cmp al, 0xf2
jne 0x1401904b0
lea rax, [0x14050d7d0]
ret
movzx eax, byte [0x14050d65d]
cmp al, 0x97
je 0x1401904f4
mov cl, 0x35
nop dword [rax]
mov al, 0x43
lock cmpxchg byte [0x14050d65d], cl
je 0x140190598
cmp al, 0x97
jne 0x1401904e0
lea rax, [0x14050d650]
ret
movzx eax, byte [0x14050d7cb]
cmp al, 0x7e
je 0x140190524
mov ecx, dword [rsp + 0x28]
mov dl, 0xd4
nop dword [rax]
mov al, 0xfd
lock cmpxchg byte [0x14050d7cb], dl
je 0x1401905e8
cmp al, 0x7e
jne 0x140190510
lea rax, [0x14050d7c0]
ret
xor eax, eax
lea rcx, [0x14050d6d0]
lea rdx, [0x14042caa0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140190558
inc rax
jmp 0x140190540
mov al, 0xb9
xchg byte [0x14050d6dd], al
lea rax, [0x14050d6d0]
ret
xor eax, eax
lea rcx, [0x14050d7d0]
lea rdx, [0x14042cba0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1401905c8
inc rax
jmp 0x140190580
xor eax, eax
lea rcx, [0x14050d650]
lea rdx, [0x14042ca20]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401905d8
inc rax
jmp 0x1401905b0
mov al, 0xf2
xchg byte [0x14050d7df], al
lea rax, [0x14050d7d0]
ret
mov al, 0x97
xchg byte [0x14050d65d], al
lea rax, [0x14050d650]
ret
xor eax, eax
lea rdx, [0x14050d7c0]
lea r8, [0x14042cb90]
nop dword [rax + rax]
movzx r9d, byte [rax + r8]
add byte [rax + rdx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xa
jg 0x140190618
inc rax
jmp 0x140190600
mov eax, ecx
not al
and al, 0xf3
xor cl, 0xc
or cl, al
not cl
or cl, al
add cl, byte [0x14050fe48]
xchg byte [0x14050d7cb], cl
lea rax, [0x14050d7c0]
ret
Function at 0x1401ad0f0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401ad13c
mov eax, dword [0x140510ae0]
mov ecx, eax
xor ecx, 0x31e7f279
and eax, 0x31e7f279
lea eax, [rcx + rax*2]
cmp edx, eax
jne 0x1401ad181
movzx eax, byte [0x140510742]
cmp al, 0x49
je 0x1401ad134
mov cl, 8
nop dword [rax + rax]
mov al, 0x32
lock cmpxchg byte [0x140510742], cl
je 0x1401ad1f6
cmp al, 0x49
jne 0x1401ad120
lea rax, [0x140510730]
ret
test edx, edx
je 0x1401ad1bc
movzx eax, byte [0x140510725]
cmp al, 0x61
je 0x1401ad179
nop dword [rax + rax]
movzx ecx, byte [0x140510adc]
lea eax, [rcx - 0x70]
add cl, 0x3a
lock cmpxchg byte [0x140510725], cl
je 0x1401ad2b6
movzx ecx, byte [0x140510adc]
add cl, 0x87
cmp al, cl
jne 0x1401ad150
lea rax, [0x140510710]
ret
movzx eax, byte [0x140510701]
movzx ecx, byte [0x140510adc]
add cl, 0x31
cmp al, cl
je 0x1401ad1b4
mov cl, 0xb3
nop dword [rax + rax]
mov al, 0xeb
lock cmpxchg byte [0x140510701], cl
je 0x1401ad241
cmp al, 0xb
jne 0x1401ad1a0
lea rax, [0x1405106f0]
ret
movzx eax, byte [0x1405106e7]
cmp al, 0xd4
je 0x1401ad1ee
mov cl, 0xbf
nop dword [rax]
mov al, 0xc3
lock cmpxchg byte [0x1405106e7], cl
je 0x1401ad313
movzx edx, byte [0x140510adc]
add dl, 0xfa
cmp al, dl
jne 0x1401ad1d0
lea rax, [0x1405106e0]
ret
xor eax, eax
lea rcx, [0x140510730]
lea rdx, [0x14042cf40]
mov r8d, 0x31e7f28b
nop dword [rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x140510ae0]
add r10d, r8d
cmp r9d, r10d
jge 0x1401ad2a6
inc rax
jmp 0x1401ad210
xor edx, edx
lea rax, [0x1405106f0]
lea rcx, [0x14042cf00]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x11
jl 0x1401ad260
movzx eax, byte [0x140510adc]
add al, 0x31
xchg byte [0x140510701], al
lea rax, [0x1405106f0]
ret
mov al, 0x49
xchg byte [0x140510742], al
lea rax, [0x140510730]
ret
xor edx, edx
lea rax, [0x140510710]
lea rcx, [0x14042cf20]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x140510ae0]
lea r9d, [r8 + 0x31e7f27a]
mov r10d, edx
xor r10d, r9d
and edx, r9d
lea edx, [r10 + rdx*2]
add r8d, 0x31e7f28e
cmp edx, r8d
jl 0x1401ad2d0
mov al, 0x61
xchg byte [0x140510725], al
lea rax, [0x140510710]
ret
xor eax, eax
lea rcx, [0x1405106e0]
lea rdx, [0x14042cef0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 6
jg 0x1401ad348
inc rax
jmp 0x1401ad330
mov al, 0xd4
xchg byte [0x1405106e7], al
lea rax, [0x1405106e0]
ret
Function at 0x1401ad360
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401ad39c
test edx, edx
je 0x1401ad40c
movzx eax, byte [0x1405106d6]
cmp al, 0x31
je 0x1401ad394
mov cl, 0xb1
nop dword [rax]
mov al, 0x1b
lock cmpxchg byte [0x1405106d6], cl
je 0x1401ad51c
cmp al, 0x31
jne 0x1401ad380
lea rax, [0x1405106d0]
ret
test edx, edx
je 0x1401ad456
movzx eax, byte [0x1405107c9]
nop dword [rax + rax]
cmp al, 0xbe
je 0x1401ad574
movzx ecx, byte [0x140510adc]
lea eax, [rcx - 4]
add cl, 0xf0
lock cmpxchg byte [0x1405107c9], cl
jne 0x1401ad3b0
xor eax, eax
lea rcx, [0x1405107c0]
lea rdx, [0x14042cfc0]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1401ad56c
inc rax
jmp 0x1401ad3e0
movzx eax, byte [0x140510773]
movzx ecx, byte [0x140510adc]
add cl, 0x16
cmp al, cl
je 0x1401ad44e
mov cl, 0xe1
nop word cs:[rax + rax]
mov al, 0x19
lock cmpxchg byte [0x140510773], cl
je 0x1401ad57c
movzx edx, byte [0x140510adc]
add dl, 0x16
cmp al, dl
jne 0x1401ad430
lea rax, [0x140510770]
ret
movzx eax, byte [0x140510760]
nop dword [rax]
movzx ecx, byte [0x140510adc]
add cl, 0xfc
cmp al, cl
je 0x1401ad514
movzx ecx, byte [0x140510adc]
mov edx, ecx
xor dl, 0x6a
mov eax, ecx
and al, 0x6a
add al, al
add al, dl
add al, 0x4c
mov edx, ecx
xor dl, 0x8f
not cl
and cl, 0x70
or cl, dl
not cl
add cl, cl
add cl, dl
lock cmpxchg byte [0x140510760], cl
jne 0x1401ad460
xor edx, edx
lea rax, [0x140510750]
lea rcx, [0x14042cf60]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
not r10b
mov r11d, r10d
xor r11b, r9b
not r9b
and r8b, r9b
or r8b, r11b
not r8b
xor r10b, r9b
and r10b, r9b
or r10b, r8b
mov byte [rdx + rax], r10b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x1401ad4c0
movzx eax, byte [0x140510adc]
add al, 0xfc
xchg byte [0x140510760], al
lea rax, [0x140510750]
ret
xor eax, eax
lea rcx, [0x1405106d0]
lea rdx, [0x14042cee0]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x1401ad55c
inc rax
jmp 0x1401ad530
mov al, 0x31
xchg byte [0x1405106d6], al
lea rax, [0x1405106d0]
ret
mov al, 0xbe
xchg byte [0x1405107c9], al
lea rax, [0x1405107c0]
ret
xor eax, eax
lea rcx, [0x140510770]
lea rdx, [0x14042cf70]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1401ad5a8
inc rax
jmp 0x1401ad590
mov al, 0xf0
xchg byte [0x140510773], al
lea rax, [0x140510770]
ret
Function at 0x1401b7730
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401b7768
mov ecx, dword [rsp + 0x28]
test edx, edx
je 0x1401b779c
movzx eax, byte [0x140511a10]
cmp al, 0x25
je 0x1401b7760
mov dl, 0xb
nop dword [rax]
mov al, 0x51
lock cmpxchg byte [0x140511a10], dl
je 0x1401b77cc
cmp al, 0x25
jne 0x1401b7750
lea rax, [0x140511a00]
ret
movzx eax, byte [0x1405119c5]
cmp al, 0x6e
je 0x1401b7794
mov cl, 0xc7
nop word cs:[rax + rax]
mov al, 0x8b
lock cmpxchg byte [0x1405119c5], cl
je 0x1401b781d
cmp al, 0x6e
jne 0x1401b7780
lea rax, [0x1405119b0]
ret
movzx eax, byte [0x140511aad]
cmp al, 0xa8
je 0x1401b77c4
mov dl, 0x4d
nop dword [rax]
mov al, 0x9c
lock cmpxchg byte [0x140511aad], dl
je 0x1401b785f
cmp al, 0xa8
jne 0x1401b77b0
lea rax, [0x140511aa0]
ret
xor eax, eax
lea rdx, [0x140511a00]
lea r8, [0x14042d410]
xor ecx, 0x1e97b0d0
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + r8]
xor byte [rax + rdx], r9b
mov r9d, dword [0x140511ee0]
add r9d, ecx
add eax, r9d
cmp eax, 0x10
jl 0x1401b77f0
mov al, 0x25
xchg byte [0x140511a10], al
lea rax, [0x140511a00]
ret
xor edx, edx
lea rax, [0x1405119b0]
lea rcx, [0x14042d3c0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x1401b7830
mov al, 0x6e
xchg byte [0x1405119c5], al
lea rax, [0x1405119b0]
ret
xor eax, eax
lea rdx, [0x140511aa0]
lea r8, [0x14042d4a0]
xor ecx, 0x1e97b0a4
nop word cs:[rax + rax]
movzx r9d, byte [rax + r8]
add byte [rax + rdx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140511ee0]
add r10d, ecx
cmp r9d, r10d
jge 0x1401b78a1
inc rax
jmp 0x1401b7880
mov al, 0xa8
xchg byte [0x140511aad], al
lea rax, [0x140511aa0]
ret