joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401913e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
test ecx, ecx
je 0x140191436
test edx, edx
je 0x14019147f
movzx eax, byte [0x14051db1d]
cmp al, 0x96
je 0x140191546
mov cl, 0x73
nop
mov al, 0xe6
lock cmpxchg byte [0x14051db1d], cl
je 0x1401914d9
movzx edx, byte [0x14051e37c]
mov r8d, edx
xor r8b, 0x58
not dl
and dl, 0x27
or dl, r8b
not dl
add dl, dl
add dl, r8b
cmp al, dl
jne 0x140191400
jmp 0x140191546
test edx, edx
je 0x1401914a9
movzx eax, byte [0x14051d9dd]
cmp al, 0xde
je 0x14019160c
mov cl, 0xb9
nop dword [rax + rax]
mov al, 0x4b
lock cmpxchg byte [0x14051d9dd], cl
je 0x14019154f
movzx edx, byte [0x14051e37c]
mov r8d, edx
xor r8b, 0xa0
and dl, 0x20
add dl, dl
add dl, r8b
cmp al, dl
jne 0x140191450
jmp 0x14019160c
movzx eax, byte [0x14051d9af]
cmp al, 0xea
je 0x1401915fb
mov cl, 0x4c
mov al, 0xff
lock cmpxchg byte [0x14051d9af], cl
je 0x14019158c
cmp al, 0xea
jne 0x140191490
jmp 0x1401915fb
movzx eax, byte [0x14051dab1]
cmp al, 0xbf
je 0x14019166a
mov cl, 0x97
nop word [rax + rax]
mov al, 0xa6
lock cmpxchg byte [0x14051dab1], cl
je 0x140191615
cmp al, 0xbf
jne 0x1401914c0
jmp 0x14019166a
xor edx, edx
lea rax, [0x14051db10]
lea rcx, [0x14043ddd0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r9d
not r10b
mov r11d, r8d
and r11b, r10b
xor r10b, r8b
not r8b
mov ebx, r8d
xor bl, r9b
or r11b, bl
not r11b
and r8b, r9b
or r8b, r10b
not r8b
or r8b, r11b
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x1401914f0
mov al, 0x96
xchg byte [0x14051db1d], al
lea rax, [0x14051db10]
pop rbx
ret
xor eax, eax
lea rcx, [0x14051d9d0]
lea rdx, [0x14043dc90]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140191604
inc rax
jmp 0x140191560
xor eax, eax
lea rcx, [0x14051d990]
lea rdx, [0x14043dc50]
nop dword [rax]
cdqe
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
not r9b
mov r11d, r10d
xor r11b, r9b
and r11b, r10b
and r9b, r8b
or r9b, r11b
mov byte [rax + rcx], r9b
mov r8d, dword [0x14051e378]
mov r9d, r8d
xor r9d, 0x87f1575c
and r8d, 0x7f1575c
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0x1f
jl 0x1401915a0
movzx eax, byte [0x14051e37c]
add al, 0xac
xchg byte [0x14051d9af], al
lea rax, [0x14051d990]
pop rbx
ret
mov al, 0xde
xchg byte [0x14051d9dd], al
lea rax, [0x14051d9d0]
pop rbx
ret
xor eax, eax
lea rcx, [0x14051daa0]
lea rdx, [0x14043dd60]
nop word cs:[rax + rax]
cdqe
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
xor r8d, r8d
sub r8d, dword [0x14051e378]
mov r9d, r8d
xor r9d, 0x780ea8a4
and r8d, 0x780ea8a4
lea r8d, [r9 + r8*2]
sub eax, r8d
cmp eax, 0x11
jl 0x140191630
mov al, 0xbf
xchg byte [0x14051dab1], al
lea rax, [0x14051daa0]
pop rbx
ret
Function at 0x1401916c0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401916fc
test edx, edx
je 0x14019172c
movzx eax, byte [0x14051da0e]
movzx ecx, byte [0x14051e37c]
add cl, 0x97
cmp al, cl
je 0x1401916f4
mov cl, 0x5e
nop
mov al, 0x3d
lock cmpxchg byte [0x14051da0e], cl
je 0x14019179c
cmp al, 0xd5
jne 0x1401916e0
lea rax, [0x14051da00]
ret
test edx, edx
je 0x14019175c
movzx eax, byte [0x14051d9ca]
cmp al, 0x55
je 0x140191724
mov cl, 0x3d
nop dword [rax]
mov al, 0x8a
lock cmpxchg byte [0x14051d9ca], cl
je 0x1401917e8
cmp al, 0x55
jne 0x140191710
lea rax, [0x14051d9c0]
ret
movzx eax, byte [0x14051d941]
cmp al, 0x91
je 0x140191754
mov cl, 0xba
nop dword [rax]
mov al, 0xbc
lock cmpxchg byte [0x14051d941], cl
je 0x140191818
cmp al, 0x91
jne 0x140191740
lea rax, [0x14051d930]
ret
movzx eax, byte [0x14051d972]
movzx ecx, byte [0x14051e37c]
add cl, 0x63
cmp al, cl
je 0x140191794
mov cl, 0xba
nop word cs:[rax + rax]
mov al, 0xd7
lock cmpxchg byte [0x14051d972], cl
je 0x140191871
cmp al, 0xa1
jne 0x140191780
lea rax, [0x14051d960]
ret
xor eax, eax
lea rcx, [0x14051da00]
lea rdx, [0x14043dcc0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x1401917d8
inc rax
jmp 0x1401917b0
mov al, 0xd5
xchg byte [0x14051da0e], al
lea rax, [0x14051da00]
ret
xor eax, eax
lea rcx, [0x14051d9c0]
lea rdx, [0x14043dc80]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 9
jg 0x140191851
inc rax
jmp 0x140191800
xor eax, eax
lea rcx, [0x14051d930]
lea rdx, [0x14043dbf0]
mov r8d, 0x87f1576c
nop
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14051e378]
add r10d, r8d
cmp r9d, r10d
jge 0x140191861
inc rax
jmp 0x140191830
mov al, 0x55
xchg byte [0x14051d9ca], al
lea rax, [0x14051d9c0]
ret
mov al, 0x91
xchg byte [0x14051d941], al
lea rax, [0x14051d930]
ret
xor edx, edx
lea rax, [0x14051d960]
lea rcx, [0x14043dc20]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0x1e6d2fce
and edx, 0x1e6d2fce
lea edx, [r8 + rdx*2]
add edx, 0xe192d033
cmp edx, 0x12
jl 0x140191890
movzx eax, byte [0x14051e37c]
add al, 0x63
xchg byte [0x14051d972], al
lea rax, [0x14051d960]
ret
Function at 0x1401918f0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14019192c
test edx, edx
je 0x14019196c
movzx eax, byte [0x14051d9ef]
cmp al, 4
je 0x140191924
mov cl, 0x71
nop word cs:[rax + rax]
mov al, 0xbc
lock cmpxchg byte [0x14051d9ef], cl
je 0x140191a1c
cmp al, 4
jne 0x140191910
lea rax, [0x14051d9e0]
ret
test edx, edx
je 0x1401919ef
movzx eax, byte [0x14051db31]
cmp al, 0x15
je 0x140191964
mov cl, 0x84
nop word cs:[rax + rax]
mov al, 0xee
lock cmpxchg byte [0x14051db31], cl
je 0x140191a78
cmp al, 0x15
jne 0x140191950
lea rax, [0x14051db20]
ret
movzx eax, byte [0x14051da3d]
nop word cs:[rax + rax]
cmp al, 0x8f
je 0x1401919e7
movzx ecx, byte [0x14051e37c]
lea eax, [rcx + 0x66]
add cl, 0x55
lock cmpxchg byte [0x14051da3d], cl
jne 0x140191980
xor edx, edx
lea rax, [0x14051da30]
lea rcx, [0x14043dcf0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x1401919b0
mov al, 0x8f
xchg byte [0x14051da3d], al
lea rax, [0x14051da30]
ret
movzx eax, byte [0x14051d8fd]
cmp al, 0xc4
je 0x140191a14
mov cl, 0x87
nop dword [rax]
mov al, 0xd9
lock cmpxchg byte [0x14051d8fd], cl
je 0x140191ae6
cmp al, 0xc4
jne 0x140191a00
lea rax, [0x14051d8f0]
ret
xor eax, eax
lea rcx, [0x14051d9e0]
lea rdx, [0x14043dca0]
nop dword [rax]
movzx r8d, byte [rax + rcx]
add r8b, byte [rax + rdx]
add r8b, 0x13
mov r9d, r8d
xor r9b, 0xed
and r8b, 0x6d
add r8b, r8b
add r8b, r9b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x140191a61
inc rax
jmp 0x140191a30
movzx eax, byte [0x14051e37c]
add al, 0xc6
xchg byte [0x14051d9ef], al
lea rax, [0x14051d9e0]
ret
xor eax, eax
lea rcx, [0x14051db20]
lea rdx, [0x14043dde0]
nop dword [rax + rax]
cdqe
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r9b
mov r10d, r9d
or r10b, r8b
not r10b
and r9b, r8b
or r9b, r10b
mov byte [rax + rcx], r9b
mov r8d, dword [0x14051e378]
mov r9d, r8d
xor r9d, 0x87f1575c
and r8d, 0x7f1575c
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0x11
jl 0x140191a90
mov al, 0x15
xchg byte [0x14051db31], al
lea rax, [0x14051db20]
ret
xor eax, eax
lea rcx, [0x14051d8f0]
lea rdx, [0x14043dbb0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140191b18
inc rax
jmp 0x140191b00
movzx eax, byte [0x14051e37c]
mov ecx, eax
xor cl, 0x86
and al, 6
add al, al
add al, cl
xchg byte [0x14051d8fd], al
lea rax, [0x14051d8f0]
ret
Function at 0x1401a2a60
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x20], 0
cmp rdx, r8
je 0x1401a2b42
mov rdi, r8
mov rbx, rdx
mov eax, dword [0x140575d9c]
nop dword [rax + rax]
mov eax, dword [0x140575d98]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x1401a2aa0
mov ecx, 0x20
call fcn.1403f542c
mov ecx, dword [rbx + 0x18]
mov dword [rax + 0x18], ecx
mov rcx, qword [rbx + 0x10]
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x18], rax
inc qword [rbp - 0x20]
mov qword [rax + 0x10], rcx
mov rbx, qword [rbx]
cmp rbx, rdi
je 0x1401a2b42
movabs r14, 0x9ba85f90d6778a4
nop word [rax + rax]
mov ecx, 0x20
call fcn.1403f542c
mov ecx, dword [rbx + 0x18]
mov dword [rax + 0x18], ecx
mov rcx, qword [rbx + 0x10]
mov qword [rax + 0x10], rcx
mov rcx, qword [rbp - 0x18]
mov qword [rcx], rax
mov rcx, qword [rbp - 0x18]
mov qword [rax + 8], rcx
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x20]
mov rcx, qword [0x14051ee60]
add rcx, r14
mov rdx, rax
xor rdx, rcx
and rcx, rax
lea rax, [rdx + rcx*2]
mov qword [rbp - 0x20], rax
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1401a2af0
mov ecx, 0x20
call fcn.1403f542c
mov rcx, qword [rbp - 0x20]
mov rdx, qword [0x14051ee60]
movabs r8, 0x9ba85f90d6778a3
mov r9, rdx
xor r9, r8
and rdx, r8
lea rdx, [r9 + rdx*2]
mov qword [rbp - 0x20], rdx
test rcx, rcx
je 0x1401a2b8c
mov rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 0x10]
mov qword [rax], r8
mov qword [rax + 8], rdx
mov qword [r8 + 8], rax
jmp 0x1401a2b96
mov qword [rax], rax
mov rdx, rax
add rdx, 8
mov qword [rdx], rax
mov qword [rsi + 8], rcx
mov qword [rsi], rax
cmp qword [rbp - 0x20], 0
je 0x1401a2be5
mov rax, qword [rbp - 0x10]
mov qword [rax + 8], 0
mov rax, qword [rbp - 0x18]
mov qword [rax], 0
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1401a2be5
nop word [rax + rax]
mov rsi, qword [rcx]
mov edx, 0x20
call fcn.1400a87c0
mov rcx, rsi
test rsi, rsi
jne 0x1401a2bd0
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x1401a48b0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401a48ec
test edx, edx
je 0x1401a493c
movzx eax, byte [0x14051e7b1]
cmp al, 0x3f
je 0x1401a48e4
mov cl, 0x88
nop dword [rax]
mov al, 0xc5
lock cmpxchg byte [0x14051e7b1], cl
je 0x1401a49ac
cmp al, 0x3f
jne 0x1401a48d0
lea rax, [0x14051e780]
ret
mov eax, dword [0x14051ee58]
mov ecx, eax
xor ecx, 0x3eb4ff42
and eax, 0x3eb4ff42
lea eax, [rcx + rax*2]
cmp edx, eax
jne 0x1401a497c
movzx eax, byte [0x14051e911]
cmp al, 0x72
je 0x1401a4934
mov cl, 0xe9
nop word cs:[rax + rax]
mov al, 0x43
lock cmpxchg byte [0x14051e911], cl
je 0x1401a4a38
cmp al, 0x72
jne 0x1401a4920
lea rax, [0x14051e900]
ret
movzx eax, byte [0x14051e882]
movzx ecx, byte [0x14051ee68]
add cl, 0x70
cmp al, cl
je 0x1401a4974
mov cl, 0xfb
nop word cs:[rax + rax]
mov al, 0xa3
lock cmpxchg byte [0x14051e882], cl
je 0x1401a49ff
cmp al, 0x54
jne 0x1401a4960
lea rax, [0x14051e880]
ret
movzx eax, byte [0x14051e9dd]
cmp al, 0x1f
je 0x1401a49a4
mov cl, 0x7d
nop dword [rax]
mov al, 0x47
lock cmpxchg byte [0x14051e9dd], cl
je 0x1401a4a71
cmp al, 0x1f
jne 0x1401a4990
lea rax, [0x14051e9d0]
ret
xor eax, eax
lea rcx, [0x14051e780]
lea rdx, [0x14043e0e0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x30
jg 0x1401a49e8
inc rax
jmp 0x1401a49c0
movzx eax, byte [0x14051ee68]
add al, 0x5b
xchg byte [0x14051e7b1], al
lea rax, [0x14051e780]
ret
xor eax, eax
lea rcx, [0x14051e880]
lea rdx, [0x14043e1e0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x1401a4a28
inc rax
jmp 0x1401a4a10
mov al, 0x54
xchg byte [0x14051e882], al
lea rax, [0x14051e880]
ret
xor eax, eax
lea rcx, [0x14051e900]
lea rdx, [0x14043e250]
mov r8d, 0x3eb4ff53
nop
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14051ee58]
add r10d, r8d
cmp r9d, r10d
jge 0x1401a4ac9
inc rax
jmp 0x1401a4a50
xor r8d, r8d
lea rax, [0x14051e9d0]
lea rcx, [0x14043e320]
mov edx, 0x3eb4ff43
nop word [rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
xor byte [r8 + rax], r9b
mov r9d, dword [0x14051ee58]
add r9d, edx
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r8d, [r10 + r9*2]
cmp r8d, 0xd
jl 0x1401a4a90
mov al, 0x1f
xchg byte [0x14051e9dd], al
lea rax, [0x14051e9d0]
ret
mov al, 0x72
xchg byte [0x14051e911], al
lea rax, [0x14051e900]
ret
Function at 0x1401a4b00
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x3eb4ff42
mov r8d, dword [0x14051ee58]
add r8d, eax
cmp ecx, r8d
jne 0x1401a4b5c
test edx, edx
je 0x1401a4c0c
movzx eax, byte [0x14051e869]
movzx ecx, byte [0x14051ee68]
mov edx, ecx
xor dl, 0x69
and cl, 0x69
add cl, cl
add cl, dl
cmp al, cl
je 0x1401a4b54
mov cl, 0x78
nop dword [rax]
mov al, 0x5c
lock cmpxchg byte [0x14051e869], cl
je 0x1401a4c3c
cmp al, 0x4d
jne 0x1401a4b40
lea rax, [0x14051e860]
ret
add eax, dword [0x14051ee58]
cmp edx, eax
jne 0x1401a4bdc
movzx eax, byte [0x14051e700]
nop dword [rax]
cmp al, 0x16
je 0x1401a4c9e
movzx ecx, byte [0x14051ee68]
lea eax, [rcx + 5]
add cl, 0xe8
lock cmpxchg byte [0x14051e700], cl
jne 0x1401a4b70
xor eax, eax
lea rcx, [0x14051e6d0]
lea rdx, [0x14043e040]
nop
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
not r8b
not r9b
and r9b, r8b
or r9b, r10b
not r9b
add r9b, r9b
add r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x2f
jg 0x1401a4c96
inc rax
jmp 0x1401a4ba0
movzx eax, byte [0x14051e804]
cmp al, 0xe
je 0x1401a4c04
mov cl, 0xd0
nop dword [rax]
mov al, 0x58
lock cmpxchg byte [0x14051e804], cl
je 0x1401a4ca6
cmp al, 0xe
jne 0x1401a4bf0
lea rax, [0x14051e800]
ret
movzx eax, byte [0x14051e7e4]
cmp al, 0x59
je 0x1401a4c34
mov cl, 2
nop dword [rax]
mov al, 0x1d
lock cmpxchg byte [0x14051e7e4], cl
je 0x1401a4cf1
cmp al, 0x59
jne 0x1401a4c20
lea rax, [0x14051e7e0]
ret
xor edx, edx
lea rax, [0x14051e860]
lea rcx, [0x14043e1c0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x14051ee58]
mov r9d, r8d
xor r9d, 0xd60746ed
and r8d, 0x560746ed
lea r8d, [r9 + r8*2]
add edx, r8d
add edx, 0x68adb856
cmp edx, 9
jl 0x1401a4c50
mov al, 0x4d
xchg byte [0x14051e869], al
lea rax, [0x14051e860]
ret
mov al, 0x16
xchg byte [0x14051e700], al
lea rax, [0x14051e6d0]
ret
xor eax, eax
lea rcx, [0x14051e800]
lea rdx, [0x14043e160]
mov r8d, 0x3eb4ff46
nop dword [rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14051ee58]
add r10d, r8d
cmp r9d, r10d
jge 0x1401a4ce1
inc rax
jmp 0x1401a4cc0
mov al, 0xe
xchg byte [0x14051e804], al
lea rax, [0x14051e800]
ret
xor eax, eax
lea rcx, [0x14051e7e0]
lea rdx, [0x14043e140]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x1401a4d28
inc rax
jmp 0x1401a4d10
mov al, 0x59
xchg byte [0x14051e7e4], al
lea rax, [0x14051e7e0]
ret
Function at 0x1401a5d40
Capabilities:
Check for software breakpoints

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1401a5d88
test edx, edx
je 0x1401a5dbc
movzx eax, byte [0x14051e8a0]
cmp al, 0x55
je 0x1401a5d80
mov cl, 0x48
nop word [rax + rax]
mov al, 0xe2
lock cmpxchg byte [0x14051e8a0], cl
je 0x1401a5e2c
mov edx, r8d
xor dl, 0x84
add dl, byte [0x14051ee68]
cmp al, dl
jne 0x1401a5d60
lea rax, [0x14051e890]
ret
test edx, edx
je 0x1401a5dfc
movzx eax, byte [0x14051e94e]
cmp al, 0xcc
je 0x1401a5db4
mov cl, 0xe
nop dword [rax]
mov al, 0x67
lock cmpxchg byte [0x14051e94e], cl
je 0x1401a5e68
cmp al, 0xcc
jne 0x1401a5da0
lea rax, [0x14051e940]
ret
movzx eax, byte [0x14051e8e2]
xor r8b, 0x79
add r8b, byte [0x14051ee68]
cmp al, r8b
je 0x1401a5df4
mov cl, 0xa
nop word cs:[rax + rax]
mov al, 0xd8
lock cmpxchg byte [0x14051e8e2], cl
je 0x1401a5ec7
cmp al, 0x70
jne 0x1401a5de0
lea rax, [0x14051e8d0]
ret
movzx eax, byte [0x14051e99f]
cmp al, 0xf0
je 0x1401a5e24
mov cl, 0xc8
nop dword [rax]
mov al, 0xb8
lock cmpxchg byte [0x14051e99f], cl
je 0x1401a5f08
cmp al, 0xf0
jne 0x1401a5e10
lea rax, [0x14051e990]
ret
xor eax, eax
lea rcx, [0x14051e890]
lea rdx, [0x14043e1f0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1401a5e58
inc rax
jmp 0x1401a5e40
mov al, 0x55
xchg byte [0x14051e8a0], al
lea rax, [0x14051e890]
ret
xor eax, eax
lea rcx, [0x14051e940]
lea rdx, [0x14043e290]
mov r9d, r8d
xor r9d, 0xd57519b6
nop word cs:[rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
add byte [rax + rcx], r10b
mov r10d, dword [0x14051ee58]
add r10d, r9d
add eax, r10d
cmp eax, 0xe
jl 0x1401a5e90
xor r8b, 0x1d
add r8b, byte [0x14051ee68]
xchg byte [0x14051e94e], r8b
lea rax, [0x14051e940]
ret
xor eax, eax
lea rcx, [0x14051e8d0]
lea rdx, [0x14043e220]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x1401a5ef8
inc rax
jmp 0x1401a5ee0
mov al, 0x70
xchg byte [0x14051e8e2], al
lea rax, [0x14051e8d0]
ret
xor eax, eax
lea rcx, [0x14051e990]
lea rdx, [0x14043e2e0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1401a5f38
inc rax
jmp 0x1401a5f20
mov al, 0xf0
xchg byte [0x14051e99f], al
lea rax, [0x14051e990]
ret
Function at 0x1401b8f50
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x284d8a7c
add eax, dword [0x140520b08]
cmp ecx, eax
jne 0x1401b8f8c
test edx, edx
je 0x1401b8fbc
movzx eax, byte [0x14051fafd]
cmp al, 0x72
je 0x1401b8f84
mov cl, 0xd0
mov al, 0x6e
lock cmpxchg byte [0x14051fafd], cl
je 0x1401b902c
cmp al, 0x72
jne 0x1401b8f70
lea rax, [0x14051faf0]
ret
test edx, edx
je 0x1401b8ffc
movzx eax, byte [0x14051fb2b]
cmp al, 0x5d
je 0x1401b8fb4
mov cl, 0x72
nop dword [rax]
mov al, 0x38
lock cmpxchg byte [0x14051fb2b], cl
je 0x1401b9058
cmp al, 0x5d
jne 0x1401b8fa0
lea rax, [0x14051fb20]
ret
movzx eax, byte [0x14051f96d]
movzx ecx, byte [0x140520b18]
add cl, 0xe5
cmp al, cl
je 0x1401b8ff4
mov cl, 0xaf
nop word cs:[rax + rax]
mov al, 0x41
lock cmpxchg byte [0x14051f96d], cl
je 0x1401b90af
cmp al, 0x3f
jne 0x1401b8fe0
lea rax, [0x14051f960]
ret
movzx eax, byte [0x14051fa55]
cmp al, 0x5c
je 0x1401b9024
mov cl, 0x4e
nop dword [rax]
mov al, 0xde
lock cmpxchg byte [0x14051fa55], cl
je 0x1401b90f1
cmp al, 0x5c
jne 0x1401b9010
lea rax, [0x14051fa40]
ret
xor eax, eax
lea rcx, [0x14051faf0]
lea rdx, [0x14043e870]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401b9088
inc rax
jmp 0x1401b9040
xor eax, eax
lea rcx, [0x14051fb20]
lea rdx, [0x14043e8a0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x1401b9098
inc rax
jmp 0x1401b9070
mov al, 0x72
xchg byte [0x14051fafd], al
lea rax, [0x14051faf0]
ret
movzx eax, byte [0x140520b18]
add al, 3
xchg byte [0x14051fb2b], al
lea rax, [0x14051fb20]
ret
xor edx, edx
lea rax, [0x14051f960]
lea rcx, [0x14043e6e0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x140520b08]
add edx, r8d
add edx, 0x284d8a7d
cmp edx, 0xd
jl 0x1401b90c0
mov al, 0x3f
xchg byte [0x14051f96d], al
lea rax, [0x14051f960]
ret
xor eax, eax
lea rcx, [0x14051fa40]
lea rdx, [0x14043e7c0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1401b9128
inc rax
jmp 0x1401b9110
mov al, 0x5c
xchg byte [0x14051fa55], al
lea rax, [0x14051fa40]
ret
Function at 0x1401b9430
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401b946c
test edx, edx
je 0x1401b949c
movzx eax, byte [0x14051fa6d]
movzx ecx, byte [0x140520b18]
add cl, 0x40
cmp al, cl
je 0x1401b9464
mov cl, 0x18
nop
mov al, 0x78
lock cmpxchg byte [0x14051fa6d], cl
je 0x1401b950c
cmp al, 0x9a
jne 0x1401b9450
lea rax, [0x14051fa60]
ret
test edx, edx
je 0x1401b94d6
movzx eax, byte [0x14051f84a]
cmp al, 0xc3
je 0x1401b9494
mov cl, 0x96
nop dword [rax]
mov al, 0x17
lock cmpxchg byte [0x14051f84a], cl
je 0x1401b9569
cmp al, 0xc3
jne 0x1401b9480
lea rax, [0x14051f840]
ret
movzx eax, byte [0x14051fab5]
cmp al, 0x4a
je 0x1401b94ce
mov cl, 0x3d
nop dword [rax]
mov al, 0xe1
lock cmpxchg byte [0x14051fab5], cl
je 0x1401b9598
movzx edx, byte [0x140520b18]
add dl, 0xf0
cmp al, dl
jne 0x1401b94b0
lea rax, [0x14051faa0]
ret
movzx eax, byte [0x14051f94f]
cmp al, 0x4c
je 0x1401b9504
mov cl, 0xad
nop word cs:[rax + rax]
mov al, 0x7e
lock cmpxchg byte [0x14051f94f], cl
je 0x1401b95ef
cmp al, 0x4c
jne 0x1401b94f0
lea rax, [0x14051f940]
ret
xor edx, edx
lea rax, [0x14051fa60]
lea rcx, [0x14043e7e0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
or r9b, r8b
and r9b, r10b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140520b08]
add edx, r8d
add edx, 0x284d8a7d
cmp edx, 0xd
jl 0x1401b9520
movzx eax, byte [0x140520b18]
add al, 0x40
xchg byte [0x14051fa6d], al
lea rax, [0x14051fa60]
ret
xor eax, eax
lea rcx, [0x14051f840]
lea rdx, [0x14043e5d0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 9
jg 0x1401b95c8
inc rax
jmp 0x1401b9580
xor eax, eax
lea rcx, [0x14051faa0]
lea rdx, [0x14043e820]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1401b95df
inc rax
jmp 0x1401b95b0
movzx eax, byte [0x140520b18]
add al, 0x69
xchg byte [0x14051f84a], al
lea rax, [0x14051f840]
ret
mov al, 0x4a
xchg byte [0x14051fab5], al
lea rax, [0x14051faa0]
ret
xor eax, eax
lea rcx, [0x14051f940]
lea rdx, [0x14043e6c0]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1401b9628
inc rax
jmp 0x1401b9600
mov al, 0x4c
xchg byte [0x14051f94f], al
lea rax, [0x14051f940]
ret
Function at 0x1401b96b0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401b9716
mov eax, 0x284d8a7c
add eax, dword [0x140520b08]
cmp edx, eax
jne 0x1401b974c
movzx eax, byte [0x14051f99d]
movzx ecx, byte [0x140520b18]
mov edx, ecx
xor dl, 0x35
and cl, 0x35
add cl, cl
add cl, dl
cmp al, cl
je 0x1401b970e
mov cl, 0x6c
nop word [rax + rax]
mov al, 0x18
lock cmpxchg byte [0x14051f99d], cl
je 0x1401b97bc
movzx edx, byte [0x140520b18]
add dl, 0x35
cmp al, dl
jne 0x1401b96f0
lea rax, [0x14051f990]
ret
test edx, edx
je 0x1401b978d
movzx eax, byte [0x14051f9ed]
cmp al, 0x48
je 0x1401b9744
mov cl, 0x8d
nop word [rax + rax]
mov al, 0xa5
lock cmpxchg byte [0x14051f9ed], cl
je 0x1401b983f
cmp al, 0x48
jne 0x1401b9730
lea rax, [0x14051f9e0]
ret
movzx eax, byte [0x14051facd]
cmp al, 0x80
je 0x1401b9785
nop word [rax + rax]
movzx ecx, byte [0x140520b18]
lea eax, [rcx + 0x7b]
add cl, 0xd1
lock cmpxchg byte [0x14051facd], cl
je 0x1401b97e8
movzx ecx, byte [0x140520b18]
add cl, 0x26
cmp al, cl
jne 0x1401b9760
lea rax, [0x14051fac0]
ret
movzx eax, byte [0x14051f982]
cmp al, 0x88
je 0x1401b97b4
mov cl, 0x4d
nop word [rax + rax]
mov al, 0x7d
lock cmpxchg byte [0x14051f982], cl
je 0x1401b9878
cmp al, 0x88
jne 0x1401b97a0
lea rax, [0x14051f970]
ret
xor eax, eax
lea rcx, [0x14051f990]
lea rdx, [0x14043e710]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401b9818
inc rax
jmp 0x1401b97d0
xor eax, eax
lea rcx, [0x14051fac0]
lea rdx, [0x14043e840]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401b9828
inc rax
jmp 0x1401b9800
mov al, 0x8f
xchg byte [0x14051f99d], al
lea rax, [0x14051f990]
ret
movzx eax, byte [0x140520b18]
add al, 0x26
xchg byte [0x14051facd], al
lea rax, [0x14051fac0]
ret
xor eax, eax
lea rcx, [0x14051f9e0]
lea rdx, [0x14043e760]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401b9868
inc rax
jmp 0x1401b9850
mov al, 0x48
xchg byte [0x14051f9ed], al
lea rax, [0x14051f9e0]
ret
xor edx, edx
lea rax, [0x14051f970]
lea rcx, [0x14043e6f0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x12
jl 0x1401b9890
movzx eax, byte [0x140520b18]
mov ecx, eax
xor cl, 0x2e
and al, 0x2e
add al, al
add al, cl
xchg byte [0x14051f982], al
lea rax, [0x14051f970]
ret