joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403f2ae0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403f2b26
test edx, edx
je 0x1403f2b6c
movzx eax, byte [0x1405bad36]
cmp al, 0x63
je 0x1403f2b1e
mov cl, 0x50
nop dword [rax]
mov al, 0x96
lock cmpxchg byte [0x1405bad36], cl
je 0x1403f2bec
movzx edx, byte [0x1405bc3bc]
add dl, 0xf
cmp al, dl
jne 0x1403f2b00
lea rax, [0x1405bad30]
ret
test edx, edx
je 0x1403f2bb6
movzx eax, byte [0x1405baf45]
movzx ecx, byte [0x1405bc3bc]
add cl, 0xbf
cmp al, cl
je 0x1403f2b64
mov cl, 0x90
nop word cs:[rax + rax]
mov al, 0xdd
lock cmpxchg byte [0x1405baf45], cl
je 0x1403f2c48
cmp al, 0x13
jne 0x1403f2b50
lea rax, [0x1405baf40]
ret
movzx eax, byte [0x1405bb128]
movzx ecx, byte [0x1405bc3bc]
add cl, 0xfe
cmp al, cl
je 0x1403f2bae
mov cl, 0xe2
nop word cs:[rax + rax]
mov al, 0x87
lock cmpxchg byte [0x1405bb128], cl
je 0x1403f2c95
movzx edx, byte [0x1405bc3bc]
add dl, 0xfe
cmp al, dl
jne 0x1403f2b90
lea rax, [0x1405bb120]
ret
movzx eax, byte [0x1405bb288]
cmp al, 0x67
je 0x1403f2be4
mov cl, 0x54
nop word cs:[rax + rax]
mov al, 0x23
lock cmpxchg byte [0x1405bb288], cl
je 0x1403f2cf8
cmp al, 0x67
jne 0x1403f2bd0
lea rax, [0x1405bb280]
ret
xor edx, edx
lea rax, [0x1405bad30]
lea rcx, [0x1404b09e0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1405bc3b8]
mov r9d, 0x539a5bc0
sub r9d, r8d
add r8d, 0xac65a43f
xor r9d, r8d
and r9d, edx
xor r9d, r8d
and r8d, edx
lea edx, [r9 + r8*2]
cmp edx, 6
jl 0x1403f2c00
mov al, 0x63
xchg byte [0x1405bad36], al
lea rax, [0x1405bad30]
ret
xor eax, eax
lea rcx, [0x1405baf40]
lea rdx, [0x1404b0be0]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, r8b
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x1403f2cd8
inc rax
jmp 0x1403f2c60
xor eax, eax
lea rcx, [0x1405bb120]
lea rdx, [0x1404b0da0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 7
jg 0x1403f2ce8
inc rax
jmp 0x1403f2cb0
mov al, 0x13
xchg byte [0x1405baf45], al
lea rax, [0x1405baf40]
ret
mov al, 0x52
xchg byte [0x1405bb128], al
lea rax, [0x1405bb120]
ret
xor eax, eax
lea rcx, [0x1405bb280]
lea rdx, [0x1404b0f00]
nop dword [rax + rax]
cdqe
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
xor r8d, r8d
sub r8d, dword [0x1405bc3b8]
mov r9d, r8d
xor r9d, 0x539a5bc1
and r8d, 0x539a5bc1
lea r8d, [r9 + r8*2]
sub eax, r8d
cmp eax, 8
jl 0x1403f2d10
movzx eax, byte [0x1405bc3bc]
add al, 0x13
xchg byte [0x1405bb288], al
lea rax, [0x1405bb280]
ret
Function at 0x1403f2e20
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov esi, r9d
test ecx, ecx
je 0x1403f2e99
mov eax, 0xac65a43e
add eax, dword [0x1405bc3b8]
cmp edx, eax
jne 0x1403f2ee3
mov ecx, esi
xor ecx, 0x17c556d6
mov eax, dword [0x1405bc3b8]
mov edx, eax
xor edx, 0x13ca1da9
and eax, 0x13ca1da9
lea edx, [rdx + rax*2]
call fcn.1403f7700
test al, 1
jne 0x1403f3027
mov cl, 0xab
nop word cs:[rax + rax]
mov al, 0x33
lock cmpxchg byte [0x1405bb460], cl
je 0x1403f2f90
cmp al, 0x2b
jne 0x1403f2e80
jmp 0x1403f3027
test edx, edx
je 0x1403f2f4a
movzx eax, byte [0x1405bb484]
cmp al, 0x21
je 0x1403f309f
mov cl, 0xcd
nop word cs:[rax + rax]
mov al, 0xdf
lock cmpxchg byte [0x1405bb484], cl
je 0x1403f3033
movzx edx, byte [0x1405bc3bc]
add dl, 0xcd
cmp al, dl
jne 0x1403f2ec0
jmp 0x1403f309f
movzx eax, byte [0x1405bb612]
cmp al, 0x35
je 0x1403f3009
mov bl, 0xd8
xor esi, 0x6c654f28
mov ebp, 0xc2d491ee
lea rdi, [rsp + 0x37]
nop word cs:[rax + rax]
mov al, 0x13
lock cmpxchg byte [0x1405bb612], bl
sete dl
mov ecx, dword [0x1405bc3b8]
add ecx, ebp
mov dword [rsp + 0x20], ecx
mov ecx, eax
mov r8, rdi
mov r9d, esi
call fcn.1401ad850
test al, 1
jne 0x1403f2fc8
cmp byte [rsp + 0x37], 0x35
jne 0x1403f2f10
jmp 0x1403f3009
movzx eax, byte [0x1405bad96]
cmp al, 0x2a
je 0x1403f30e0
mov bl, 0xca
mov edi, 0xd22d55cd
mov al, 0xf3
lock cmpxchg byte [0x1405bad96], bl
je 0x1403f30a8
mov edx, dword [0x1405bc3b8]
add edx, edi
xor edx, esi
mov ecx, eax
mov r8d, 0xd6320185
call fcn.1403f77d0
test al, 1
je 0x1403f2f60
jmp 0x1403f30e0
xor eax, eax
lea rcx, [0x1405bb450]
lea rdx, [0x1404b10c0]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1403f3015
inc rax
jmp 0x1403f2fa0
xor edx, edx
lea rax, [0x1405bb610]
lea rcx, [0x1404b1250]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1405bc3b8]
add edx, r8d
add edx, 0xac65a43f
cmp edx, 2
jl 0x1403f2fe0
mov al, 0x35
xchg byte [0x1405bb612], al
lea rax, [0x1405bb610]
jmp 0x1403f30e7
xor esi, 0x64032d15
mov ecx, esi
mov edx, 0xfa90e584
call fcn.1403f8070
lea rax, [0x1405bb450]
jmp 0x1403f30e7
xor ebp, ebp
xor esi, 0xbf69a082
lea rdi, [rsp + 0x36]
lea rbx, [rsp + 0x38]
lea r14, [0x1405bb470]
nop dword [rax]
mov dword [rsp + 0x20], 0xf63d41e3
mov ecx, ebp
mov rdx, rdi
mov r8, rbx
mov r9d, esi
call fcn.1403f77a0
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax]
mov ecx, eax
xor cl, al
not cl
and cl, byte [rsp + 0x36]
xor cl, al
movsxd rax, ebp
mov byte [rax + r14], cl
mov ecx, dword [0x1405bc3b8]
lea ebp, [rax + rcx]
add ebp, 0xac65a43f
cmp ebp, 0x14
jl 0x1403f3050
mov al, 0x21
xchg byte [0x1405bb484], al
lea rax, [0x1405bb470]
jmp 0x1403f30e7
xor eax, eax
lea rcx, [0x1405bad90]
lea rdx, [0x1404b0a40]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x1403f30d8
inc rax
jmp 0x1403f30c0
mov al, 0x2a
xchg byte [0x1405bad96], al
lea rax, [0x1405bad90]
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1403f3120
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xac65a43e
test ecx, ecx
je 0x1403f3176
add eax, dword [0x1405bc3b8]
cmp edx, eax
jne 0x1403f3211
movzx eax, byte [0x1405bb720]
cmp al, 0x87
je 0x1403f316e
mov cl, 0x92
nop word cs:[rax + rax]
mov al, 0x19
lock cmpxchg byte [0x1405bb720], cl
je 0x1403f326c
movzx edx, byte [0x1405bc3bc]
add dl, 0x33
cmp al, dl
jne 0x1403f3150
lea rax, [0x1405bb710]
ret
add eax, dword [0x1405bc3b8]
cmp edx, eax
jne 0x1403f3238
movzx eax, byte [0x1405baebd]
nop dword [rax + rax]
cmp al, 0xe7
je 0x1403f3209
movzx ecx, byte [0x1405bc3bc]
mov edx, ecx
xor dl, 0x10
mov eax, ecx
and al, 0x10
add al, al
add al, dl
add cl, 0x29
lock cmpxchg byte [0x1405baebd], cl
jne 0x1403f3190
xor edx, edx
lea rax, [0x1405baeb0]
lea rcx, [0x1404b0b60]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x1405bc3b8]
add edx, r8d
add edx, 0xac65a43f
cmp edx, 0xd
jl 0x1403f31d0
mov al, 0xe7
xchg byte [0x1405baebd], al
lea rax, [0x1405baeb0]
ret
movzx eax, byte [0x1405bb278]
cmp al, 0xfb
je 0x1403f3230
mov cl, 0x1a
nop
mov al, 0xcf
lock cmpxchg byte [0x1405bb278], cl
je 0x1403f3298
cmp al, 0xfb
jne 0x1403f3220
lea rax, [0x1405bb270]
ret
movzx eax, byte [0x1405bafcb]
cmp al, 0x56
je 0x1403f3264
mov cl, 0x81
nop word cs:[rax + rax]
mov al, 0x68
lock cmpxchg byte [0x1405bafcb], cl
je 0x1403f3301
cmp al, 0x56
jne 0x1403f3250
lea rax, [0x1405bafc0]
ret
xor eax, eax
lea rcx, [0x1405bb710]
lea rdx, [0x1404b1340]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1403f32d1
inc rax
jmp 0x1403f3280
xor eax, eax
lea rcx, [0x1405bb270]
lea rdx, [0x1404b0ef0]
mov r8d, 0xac65a446
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405bc3b8]
add r10d, r8d
cmp r9d, r10d
jge 0x1403f32e1
inc rax
jmp 0x1403f32b0
mov al, 0x87
xchg byte [0x1405bb720], al
lea rax, [0x1405bb710]
ret
movzx eax, byte [0x1405bc3bc]
mov ecx, eax
xor cl, 0xa7
and al, 0x27
add al, al
add al, cl
xchg byte [0x1405bb278], al
lea rax, [0x1405bb270]
ret
xor eax, eax
lea rcx, [0x1405bafc0]
lea rdx, [0x1404b0c60]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x1403f3338
inc rax
jmp 0x1403f3320
mov al, 0x56
xchg byte [0x1405bafcb], al
lea rax, [0x1405bafc0]
ret
Function at 0x1403f4c20
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x28
test ecx, ecx
je 0x1403f4c93
test edx, edx
je 0x1403f4cf9
movzx eax, byte [0x1405bb4a3]
cmp al, 0xa0
je 0x1403f4e0d
nop word cs:[rax + rax]
movzx ecx, byte [0x1405bc3bc]
mov edx, ecx
xor dl, 0x29
mov eax, ecx
and al, 0x29
add al, al
add al, dl
add al, 0xb3
add cl, 0x57
lock cmpxchg byte [0x1405bb4a3], cl
je 0x1403f4d99
movzx ecx, byte [0x1405bc3bc]
mov edx, ecx
xor dl, 0x4c
and cl, 0x4c
add cl, cl
add cl, dl
cmp al, cl
jne 0x1403f4c50
jmp 0x1403f4e0d
mov esi, r9d
mov eax, r9d
xor eax, 0xf0e3bb42
mov ecx, edx
mov edx, eax
mov r8d, 0x860b8242
call fcn.1400ab940
test al, 1
je 0x1403f4d60
xor esi, 0xc03d30fe
mov edx, 0xe3f1fd35
add edx, dword [0x1405bc3b8]
mov ecx, esi
call fcn.1403f7570
test al, 1
jne 0x1403f4ece
mov cl, 0xe1
nop word [rax + rax]
mov al, 0xf9
lock cmpxchg byte [0x1405bb7e3], cl
je 0x1403f4e3d
cmp al, 0x28
jne 0x1403f4ce0
jmp 0x1403f4ece
movzx eax, byte [0x1405bb1f6]
cmp al, 0x57
je 0x1403f4e31
movzx ecx, byte [0x1405bc3bc]
lea eax, [rcx - 0x3b]
add cl, 0xab
lock cmpxchg byte [0x1405bb1f6], cl
jne 0x1403f4d00
xor eax, eax
lea rcx, [0x1405bb1e0]
lea rdx, [0x1404b0e60]
nop
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x15
jg 0x1403f4e19
inc rax
jmp 0x1403f4d30
movzx eax, byte [0x1405bb3b7]
cmp al, 7
je 0x1403f4ebd
mov cl, 0x3d
nop word cs:[rax + rax]
mov al, 0x61
lock cmpxchg byte [0x1405bb3b7], cl
je 0x1403f4e78
cmp al, 7
jne 0x1403f4d80
jmp 0x1403f4ebd
xor r8d, r8d
lea rax, [0x1405bb490]
lea rcx, [0x1404b10f0]
mov edx, 0xac65a43f
nop
movsxd r8, r8d
movzx r9d, byte [r8 + rax]
movzx r10d, byte [r8 + rcx]
mov r11d, r9d
not r11b
not r10b
mov ebx, r11d
xor bl, r10b
and bl, r11b
and r10b, r9b
or r10b, bl
mov byte [r8 + rax], r10b
mov r9d, dword [0x1405bc3b8]
add r9d, edx
mov r10d, r8d
not r10d
mov r11d, r9d
xor r11d, r10d
xor r10d, r8d
and r10d, r9d
xor r10d, r8d
and r11d, r9d
lea r8d, [r10 + r11*2]
cmp r8d, 0x13
jl 0x1403f4db0
mov al, 0xa0
xchg byte [0x1405bb4a3], al
lea rax, [0x1405bb490]
jmp 0x1403f4ed5
movzx eax, byte [0x1405bc3bc]
mov ecx, eax
xor cl, 3
and al, 3
add al, al
add al, cl
xchg byte [0x1405bb1f6], al
lea rax, [0x1405bb1e0]
jmp 0x1403f4ed5
xor eax, eax
lea rcx, [0x1405bb7e0]
lea rdx, [0x1404b1400]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1403f4ec6
inc rax
jmp 0x1403f4e50
xor edx, edx
lea rax, [0x1405bb3b0]
lea rcx, [0x1404b1020]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0x7ffffffe
and r8d, edx
xor edx, 1
lea edx, [rdx + r8*2]
cmp edx, 7
jl 0x1403f4e90
mov al, 7
xchg byte [0x1405bb3b7], al
lea rax, [0x1405bb3b0]
jmp 0x1403f4ed5
mov al, 0x28
xchg byte [0x1405bb7e3], al
lea rax, [0x1405bb7e0]
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x1403f4f20
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xac65a43e
add eax, dword [0x1405bc3b8]
cmp ecx, eax
jne 0x1403f4f5c
test edx, edx
je 0x1403f4f8c
movzx eax, byte [0x1405bafad]
cmp al, 4
je 0x1403f4f54
mov cl, 0x7a
mov al, 0xd2
lock cmpxchg byte [0x1405bafad], cl
je 0x1403f4fec
cmp al, 4
jne 0x1403f4f40
lea rax, [0x1405bafa0]
ret
test edx, edx
je 0x1403f4fbc
movzx eax, byte [0x1405baf35]
cmp al, 0x74
je 0x1403f4f84
mov cl, 0xcf
nop dword [rax]
mov al, 0x9b
lock cmpxchg byte [0x1405baf35], cl
je 0x1403f5031
cmp al, 0x74
jne 0x1403f4f70
lea rax, [0x1405baf30]
ret
movzx eax, byte [0x1405baeec]
cmp al, 0x70
je 0x1403f4fb4
mov cl, 0xee
nop dword [rax]
mov al, 0xa1
lock cmpxchg byte [0x1405baeec], cl
je 0x1403f5088
cmp al, 0x70
jne 0x1403f4fa0
lea rax, [0x1405baee0]
ret
movzx eax, byte [0x1405bae54]
cmp al, 0x69
je 0x1403f4fe4
mov cl, 0xdb
nop dword [rax]
mov al, 0x79
lock cmpxchg byte [0x1405bae54], cl
je 0x1403f50df
cmp al, 0x69
jne 0x1403f4fd0
lea rax, [0x1405bae50]
ret
xor eax, eax
lea rcx, [0x1405bafa0]
lea rdx, [0x1404b0c40]
mov r8d, 0xac65a44b
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405bc3b8]
add r10d, r8d
cmp r9d, r10d
jge 0x1403f5068
inc rax
jmp 0x1403f5010
xor eax, eax
lea rcx, [0x1405baf30]
lea rdx, [0x1404b0bd0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x1403f5078
inc rax
jmp 0x1403f5050
mov al, 4
xchg byte [0x1405bafad], al
lea rax, [0x1405bafa0]
ret
mov al, 0x74
xchg byte [0x1405baf35], al
lea rax, [0x1405baf30]
ret
xor eax, eax
lea rcx, [0x1405baee0]
lea rdx, [0x1404b0b80]
nop dword [rax + rax]
cdqe
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
mov r8d, dword [0x1405bc3b8]
mov r9d, r8d
xor r9d, 0xac65a43f
and r8d, 0x2c65a43f
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0xc
jl 0x1403f50a0
mov al, 0x70
xchg byte [0x1405baeec], al
lea rax, [0x1405baee0]
ret
xor edx, edx
lea rax, [0x1405bae50]
lea rcx, [0x1404b0b00]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1405bc3b8]
add edx, r8d
add edx, 0xac65a43f
cmp edx, 4
jl 0x1403f50f0
mov al, 0x69
xchg byte [0x1405bae54], al
lea rax, [0x1405bae50]
ret
Function at 0x1403f5460
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403f549c
test edx, edx
je 0x1403f54cc
movzx eax, byte [0x1405baed0]
cmp al, 0xd7
je 0x1403f5494
mov cl, 0xd9
nop word cs:[rax + rax]
mov al, 0x2f
lock cmpxchg byte [0x1405baed0], cl
je 0x1403f552c
cmp al, 0xd7
jne 0x1403f5480
lea rax, [0x1405baec0]
ret
test edx, edx
je 0x1403f54fc
movzx eax, byte [0x1405bb25a]
cmp al, 0x18
je 0x1403f54c4
mov cl, 7
nop dword [rax]
mov al, 0x22
lock cmpxchg byte [0x1405bb25a], cl
je 0x1403f558e
cmp al, 0x18
jne 0x1403f54b0
lea rax, [0x1405bb250]
ret
movzx eax, byte [0x1405bae93]
cmp al, 0xe4
je 0x1403f54f4
mov cl, 0x5b
nop dword [rax]
mov al, 0xcc
lock cmpxchg byte [0x1405bae93], cl
je 0x1403f560c
cmp al, 0xe4
jne 0x1403f54e0
lea rax, [0x1405bae90]
ret
movzx eax, byte [0x1405bb695]
cmp al, 0xc1
je 0x1403f5524
mov cl, 0xb4
nop dword [rax]
mov al, 0x2d
lock cmpxchg byte [0x1405bb695], cl
je 0x1403f5669
cmp al, 0xc1
jne 0x1403f5510
lea rax, [0x1405bb680]
ret
xor eax, eax
lea rcx, [0x1405baec0]
lea rdx, [0x1404b0b70]
nop dword [rax]
movzx r8d, byte [rax + rcx]
mov r9d, r8d
xor r9b, 0xd4
and r8b, 0x54
add r8b, r8b
add r8b, r9b
add r8b, byte [rax + rdx]
mov r9d, r8d
xor r9b, 0x2c
and r8b, 0x2c
add r8b, r8b
add r8b, r9b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1403f557e
inc rax
jmp 0x1403f5540
mov al, 0xd7
xchg byte [0x1405baed0], al
lea rax, [0x1405baec0]
ret
xor edx, edx
lea rax, [0x1405bb250]
lea rcx, [0x1404b0ed0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0xdc29ba7b
mov r8d, edx
not r8d
mov r9d, r8d
and r9d, 1
mov r10d, edx
and r10d, 0xfffffffe
or r10d, r9d
xor edx, 1
and r8d, 0x7ffffffe
or r8d, edx
not r8d
lea edx, [r10 + r8*2]
add edx, 0x23d64585
cmp edx, 0xa
jl 0x1403f55a0
movzx eax, byte [0x1405bc3bc]
add al, 0xe7
mov ecx, eax
xor cl, 0x2a
and al, 0x2a
add al, al
add al, cl
add al, 0xb3
xchg byte [0x1405bb25a], al
lea rax, [0x1405bb250]
ret
xor r8d, r8d
lea rax, [0x1405bae90]
lea rcx, [0x1404b0b40]
mov edx, 0xac65a43f
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
add byte [r8 + rax], r9b
mov r9d, dword [0x1405bc3b8]
add r9d, edx
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r8d, [r10 + r9*2]
cmp r8d, 3
jl 0x1403f5630
mov al, 0xe4
xchg byte [0x1405bae93], al
lea rax, [0x1405bae90]
ret
xor eax, eax
lea rcx, [0x1405bb680]
lea rdx, [0x1404b12b0]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
add r8b, 0x96
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov r9d, r8d
xor r9b, 0x6a
and r8b, 0x6a
add r8b, r8b
add r8b, r9b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1403f56c1
inc rax
jmp 0x1403f5680
mov al, 0xc1
xchg byte [0x1405bb695], al
lea rax, [0x1405bb680]
ret
Function at 0x1403f5910
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403f594c
test edx, edx
je 0x1403f597c
movzx eax, byte [0x1405bb601]
cmp al, 0xe1
je 0x1403f5944
mov cl, 0x2c
nop word cs:[rax + rax]
mov al, 0xcb
lock cmpxchg byte [0x1405bb601], cl
je 0x1403f5a31
cmp al, 0xe1
jne 0x1403f5930
lea rax, [0x1405bb500]
ret
test edx, edx
je 0x1403f59ac
movzx eax, byte [0x1405bb33b]
cmp al, 0x7d
je 0x1403f5974
mov cl, 0x64
nop dword [rax]
mov al, 0x98
lock cmpxchg byte [0x1405bb33b], cl
je 0x1403f5a8a
cmp al, 0x7d
jne 0x1403f5960
lea rax, [0x1405bb300]
ret
movzx eax, byte [0x1405bb20d]
cmp al, 0x8d
je 0x1403f59a4
mov cl, 0x51
nop dword [rax]
mov al, 0x67
lock cmpxchg byte [0x1405bb20d], cl
je 0x1403f5ad8
cmp al, 0x8d
jne 0x1403f5990
lea rax, [0x1405bb200]
ret
movzx eax, byte [0x1405bad26]
nop word cs:[rax + rax]
cmp al, 0x71
je 0x1403f5a29
movzx ecx, byte [0x1405bc3bc]
lea eax, [rcx + 1]
mov edx, ecx
xor dl, 0x3b
and cl, 0x3b
add cl, cl
add cl, dl
lock cmpxchg byte [0x1405bad26], cl
jne 0x1403f59c0
xor edx, edx
lea rax, [0x1405bad20]
lea rcx, [0x1404b09d0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1405bc3b8]
add edx, r8d
add edx, 0xac65a43f
cmp edx, 6
jl 0x1403f5a00
mov al, 0x71
xchg byte [0x1405bad26], al
lea rax, [0x1405bad20]
ret
xor r8d, r8d
lea rax, [0x1405bb500]
lea rcx, [0x1404b1140]
mov edx, 0xac65a53f
nop word [rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
xor byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x1405bc3b8]
add r9d, edx
cmp r8d, r9d
jl 0x1403f5a50
mov al, 0xe1
xchg byte [0x1405bb601], al
lea rax, [0x1405bb500]
ret
xor edx, edx
lea rax, [0x1405bb300]
lea rcx, [0x1404b0f80]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1405bc3b8]
add edx, r8d
add edx, 0xac65a43f
cmp edx, 0x3b
jl 0x1403f5aa0
movzx eax, byte [0x1405bc3bc]
add al, 0x29
xchg byte [0x1405bb33b], al
lea rax, [0x1405bb300]
ret
xor edx, edx
lea rax, [0x1405bb200]
lea rcx, [0x1404b0e80]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1405bc3b8]
add edx, r8d
add edx, 0xac65a43f
cmp edx, 0xd
jl 0x1403f5af0
mov al, 0x8d
xchg byte [0x1405bb20d], al
lea rax, [0x1405bb200]
ret
Function at 0x1403f6670
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403f66f5
mov eax, 0xac65a43e
add eax, dword [0x1405bc3b8]
cmp edx, eax
jne 0x1403f675c
movzx eax, byte [0x1405bb43d]
cmp al, 0x2a
je 0x1403f66ed
nop word cs:[rax + rax]
movzx ecx, byte [0x1405bc3bc]
mov edx, ecx
xor dl, 0x9e
mov eax, ecx
not al
and al, 0x61
or al, dl
not al
add al, al
mov r8d, edx
xor r8b, al
and al, dl
add al, al
mov edx, r8d
xor dl, al
and al, r8b
add al, al
add al, dl
add cl, 0x9b
lock cmpxchg byte [0x1405bb43d], cl
je 0x1403f67bc
movzx ecx, byte [0x1405bc3bc]
add cl, 0xd6
cmp al, cl
jne 0x1403f66a0
lea rax, [0x1405bb430]
ret
test edx, edx
je 0x1403f678c
movzx eax, byte [0x1405bb396]
nop word cs:[rax + rax]
cmp al, 0x61
je 0x1403f68a8
movzx ecx, byte [0x1405bc3bc]
lea eax, [rcx - 0xe]
add cl, 0x3a
lock cmpxchg byte [0x1405bb396], cl
jne 0x1403f6710
xor eax, eax
lea rcx, [0x1405bb390]
lea rdx, [0x1404b1000]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x1403f68a0
inc rax
jmp 0x1403f6740
movzx eax, byte [0x1405bb6b6]
cmp al, 0xec
je 0x1403f6784
mov cl, 0x72
nop dword [rax]
mov al, 0xf8
lock cmpxchg byte [0x1405bb6b6], cl
je 0x1403f6836
cmp al, 0xec
jne 0x1403f6770
lea rax, [0x1405bb6a0]
ret
movzx eax, byte [0x1405bb1ae]
cmp al, 0xdc
je 0x1403f67b4
mov cl, 0xdd
nop dword [rax]
mov al, 0x70
lock cmpxchg byte [0x1405bb1ae], cl
je 0x1403f68b0
cmp al, 0xdc
jne 0x1403f67a0
lea rax, [0x1405bb190]
ret
xor edx, edx
lea rax, [0x1405bb430]
lea rcx, [0x1404b10a0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
not r8d
mov r9d, r8d
and r9d, 1
mov r10d, edx
and r10d, 0xfffffffe
or r10d, r9d
xor edx, 1
and r8d, 0x7ffffffe
or r8d, edx
not r8d
lea edx, [r10 + r8*2]
add edx, 0xfbd94e44
mov r8d, edx
xor r8d, 0x426b1bc
and edx, 0x426b1bc
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x1403f67d0
mov al, 0x2a
xchg byte [0x1405bb43d], al
lea rax, [0x1405bb430]
ret
xor edx, edx
lea rax, [0x1405bb6a0]
lea rcx, [0x1404b12d0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0x2a74537
not edx
and edx, 0x7d58bac8
or edx, r8d
not edx
lea edx, [r8 + rdx*2]
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0xfd58bac9
cmp edx, 0x16
jl 0x1403f6850
mov al, 0xec
xchg byte [0x1405bb6b6], al
lea rax, [0x1405bb6a0]
ret
mov al, 0x61
xchg byte [0x1405bb396], al
lea rax, [0x1405bb390]
ret
xor eax, eax
lea rcx, [0x1405bb190]
lea rdx, [0x1404b0e10]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1d
jg 0x1403f68d8
inc rax
jmp 0x1403f68c0
mov al, 0xdc
xchg byte [0x1405bb1ae], al
lea rax, [0x1405bb190]
ret
Function at 0x1403f6b00
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403f6b3c
test edx, edx
je 0x1403f6b7c
movzx eax, byte [0x1405bb42e]
movzx ecx, byte [0x1405bc3bc]
add cl, 0xce
cmp al, cl
je 0x1403f6b34
mov cl, 0x1f
nop
mov al, 0x15
lock cmpxchg byte [0x1405bb42e], cl
je 0x1403f6c2c
cmp al, 0x22
jne 0x1403f6b20
lea rax, [0x1405bb420]
ret
test edx, edx
je 0x1403f6c00
movzx eax, byte [0x1405bb040]
cmp al, 0x1c
je 0x1403f6b74
mov cl, 0x1d
nop word cs:[rax + rax]
mov al, 0x6d
lock cmpxchg byte [0x1405bb040], cl
je 0x1403f6c7b
cmp al, 0x1c
jne 0x1403f6b60
lea rax, [0x1405bb030]
ret
movzx eax, byte [0x1405bb245]
nop word cs:[rax + rax]
cmp al, 0x99
je 0x1403f6cb0
movzx ecx, byte [0x1405bc3bc]
lea eax, [rcx - 0x6c]
mov edx, ecx
xor dl, 0x66
and cl, 0x66
add cl, cl
add cl, dl
lock cmpxchg byte [0x1405bb245], cl
jne 0x1403f6b90
xor eax, eax
lea rcx, [0x1405bb230]
lea rdx, [0x1404b0eb0]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1403f6ca8
inc rax
jmp 0x1403f6bd0
movzx eax, byte [0x1405bb26b]
cmp al, 0x53
je 0x1403f6c24
mov cl, 0x2e
nop dword [rax]
mov al, 0x9d
lock cmpxchg byte [0x1405bb26b], cl
je 0x1403f6cc8
cmp al, 0x53
jne 0x1403f6c10
lea rax, [0x1405bb260]
ret
xor edx, edx
lea rax, [0x1405bb420]
lea rcx, [0x1404b1090]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0xd195556c
and edx, 0x5195556c
lea edx, [r8 + rdx*2]
add edx, 0x2e6aaa95
cmp edx, 0xe
jl 0x1403f6c40
mov al, 0x22
xchg byte [0x1405bb42e], al
lea rax, [0x1405bb420]
ret
xor eax, eax
lea rcx, [0x1405bb030]
lea rdx, [0x1404b0cd0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1403f6cb8
inc rax
jmp 0x1403f6c90
mov al, 0x99
xchg byte [0x1405bb245], al
lea rax, [0x1405bb230]
ret
mov al, 0x1c
xchg byte [0x1405bb040], al
lea rax, [0x1405bb030]
ret
xor eax, eax
lea rcx, [0x1405bb260]
lea rdx, [0x1404b0ee0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
movzx r9d, byte [rax + rcx]
xor r9b, r8b
mov r10d, r9d
not r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x1403f6d0f
inc rax
jmp 0x1403f6ce0
mov al, 0x53
xchg byte [0x1405bb26b], al
lea rax, [0x1405bb260]
ret