joyce8/EMBER2024-capa huggingface dataset:
Function at 0x20120a80
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc374e088
mov r8d, dword [0x205467a0]
add r8d, eax
cmp ecx, r8d
jne 0x20120ae6
add eax, dword [0x205467a0]
cmp edx, eax
jne 0x20120b1c
movzx eax, byte [0x205466e2]
movzx ecx, byte [0x205467a4]
add cl, 0xe6
cmp al, cl
je 0x20120ade
mov cl, 0x1a
nop word cs:[rax + rax]
mov al, 0x1c
lock cmpxchg byte [0x205466e2], cl
je 0x20120bfe
movzx edx, byte [0x205467a4]
add dl, 0xe6
cmp al, dl
jne 0x20120ac0
lea rax, [0x205466d0]
ret
test edx, edx
je 0x20120b62
movzx eax, byte [0x20546743]
cmp al, 0xec
je 0x20120b14
mov cl, 0xa9
nop word [rax + rax]
mov al, 0xc1
lock cmpxchg byte [0x20546743], cl
je 0x20120b8c
cmp al, 0xec
jne 0x20120b00
lea rax, [0x20546720]
ret
movzx eax, byte [0x2054675f]
cmp al, 0x22
je 0x20120b5a
mov cl, 0xa9
nop dword [rax]
mov al, 0x11
lock cmpxchg byte [0x2054675f], cl
je 0x20120c28
movzx edx, byte [0x205467a4]
mov r8d, edx
xor r8b, 0x33
and dl, 0x33
add dl, dl
add dl, r8b
cmp al, dl
jne 0x20120b30
lea rax, [0x20546750]
ret
movzx eax, byte [0x20546713]
cmp al, 0xec
je 0x20120b84
mov cl, 0x49
nop
mov al, 0x32
lock cmpxchg byte [0x20546713], cl
je 0x20120c78
cmp al, 0xec
jne 0x20120b70
lea rax, [0x20546710]
ret
xor r8d, r8d
lea rax, [0x20546720]
lea rcx, [0x204706a0]
mov edx, 0xc374e0ab
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
xor byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 0xfc13f7b0
and r8d, 0x7c13f7b0
lea r8d, [r9 + r8*2]
add r8d, 0x3ec0851
mov r9d, dword [0x205467a0]
add r9d, edx
cmp r8d, r9d
jl 0x20120bb0
movzx eax, byte [0x205467a4]
add al, 0xfd
xchg byte [0x20546743], al
lea rax, [0x20546720]
ret
xor eax, eax
lea rcx, [0x205466d0]
lea rdx, [0x20470650]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x20120c58
inc rax
jmp 0x20120c10
xor eax, eax
lea rcx, [0x20546750]
lea rdx, [0x204706d0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x20120c68
inc rax
jmp 0x20120c40
mov al, 0xd5
xchg byte [0x205466e2], al
lea rax, [0x205466d0]
ret
mov al, 0x22
xchg byte [0x2054675f], al
lea rax, [0x20546750]
ret
xor eax, eax
lea rcx, [0x20546710]
lea rdx, [0x20470690]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x20120ca8
inc rax
jmp 0x20120c90
movzx eax, byte [0x205467a4]
add al, 0xfd
xchg byte [0x20546713], al
lea rax, [0x20546710]
ret
Function at 0x20129740
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x20129796
mov eax, dword [0x20548658]
mov ecx, eax
xor ecx, 0x6fd5d65b
and eax, 0x6fd5d65b
lea eax, [rcx + rax*2]
cmp edx, eax
jne 0x201297cc
movzx eax, byte [0x20546890]
cmp al, 0x8f
je 0x2012978e
mov cl, 0x51
nop dword [rax + rax]
mov al, 0x13
lock cmpxchg byte [0x20546890], cl
je 0x201298c6
movzx edx, byte [0x20548648]
add dl, 0x82
cmp al, dl
jne 0x20129770
lea rax, [0x20546880]
ret
movzx eax, byte [0x205468d2]
cmp al, 0xbf
je 0x201297c4
mov cl, 0x46
nop word cs:[rax + rax]
mov al, 0x6e
lock cmpxchg byte [0x205468d2], cl
je 0x2012986a
cmp al, 0xbf
jne 0x201297b0
lea rax, [0x205468c0]
ret
movzx eax, byte [0x2054692f]
nop word cs:[rax + rax]
cmp al, 0xe3
je 0x20129862
movzx ecx, byte [0x20548648]
lea eax, [rcx - 0x47]
lock cmpxchg byte [0x2054692f], cl
jne 0x201297e0
xor edx, edx
lea rax, [0x20546920]
lea rcx, [0x20470890]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
not r10b
mov r11d, r10d
xor r11b, r9b
and r10b, r9b
not r9b
and r9b, r8b
or r11b, r9b
not r11b
or r10b, r9b
and r10b, r8b
or r10b, r11b
mov byte [rdx + rax], r10b
mov r8d, dword [0x20548658]
add edx, r8d
add edx, 0x6fd5d65c
cmp edx, 0xf
jl 0x20129810
mov al, 0xe3
xchg byte [0x2054692f], al
lea rax, [0x20546920]
ret
xor edx, edx
lea rax, [0x205468c0]
lea rcx, [0x20470830]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0x69bff934
mov r8d, edx
xor r8d, 0x964006cd
and edx, 0x164006cd
add edx, edx
mov r9d, r8d
xor r9d, edx
and edx, r8d
lea edx, [r9 + rdx*2]
cmp edx, 0x12
jl 0x20129880
mov al, 0xbf
xchg byte [0x205468d2], al
lea rax, [0x205468c0]
ret
xor edx, edx
lea rax, [0x20546880]
lea rcx, [0x20470800]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x201298e0
mov al, 0x8f
xchg byte [0x20546890], al
lea rax, [0x20546880]
ret
Function at 0x20152ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x20152f0c
test edx, edx
je 0x20152f3c
movzx eax, byte [0x2054cbb3]
movzx ecx, byte [0x2054d284]
add cl, 0xbe
cmp al, cl
je 0x20152f04
mov cl, 0x75
nop
mov al, 0x9e
lock cmpxchg byte [0x2054cbb3], cl
je 0x20152f9c
cmp al, 0xfa
jne 0x20152ef0
lea rax, [0x2054cb90]
ret
test edx, edx
je 0x20152f6c
movzx eax, byte [0x2054cb7e]
cmp al, 0xd0
je 0x20152f34
mov cl, 0x32
nop dword [rax]
mov al, 0xa5
lock cmpxchg byte [0x2054cb7e], cl
je 0x20152fdf
cmp al, 0xd0
jne 0x20152f20
lea rax, [0x2054cb70]
ret
movzx eax, byte [0x2054cc1b]
cmp al, 0x70
je 0x20152f64
mov cl, 0x21
nop dword [rax]
mov al, 0x46
lock cmpxchg byte [0x2054cc1b], cl
je 0x20153008
cmp al, 0x70
jne 0x20152f50
lea rax, [0x2054cc10]
ret
movzx eax, byte [0x2054cbed]
cmp al, 6
je 0x20152f94
mov cl, 0xf5
nop dword [rax]
mov al, 0x93
lock cmpxchg byte [0x2054cbed], cl
je 0x20153071
cmp al, 6
jne 0x20152f80
lea rax, [0x2054cbe0]
ret
xor eax, eax
lea rcx, [0x2054cb90]
lea rdx, [0x20470f80]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x20152fc8
inc rax
jmp 0x20152fb0
movzx eax, byte [0x2054d284]
add al, 0xbe
xchg byte [0x2054cbb3], al
lea rax, [0x2054cb90]
ret
xor eax, eax
lea rcx, [0x2054cb70]
lea rdx, [0x20470f60]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x20153061
inc rax
jmp 0x20152ff0
xor edx, edx
lea rax, [0x2054cc10]
lea rcx, [0x20471000]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x2054d280]
add edx, r8d
add edx, 0xeb429f3
cmp edx, 0xb
jl 0x20153020
movzx eax, byte [0x2054d284]
mov ecx, eax
xor cl, 0x34
and al, 0x34
add al, al
add al, cl
xchg byte [0x2054cc1b], al
lea rax, [0x2054cc10]
ret
mov al, 0xd0
xchg byte [0x2054cb7e], al
lea rax, [0x2054cb70]
ret
xor edx, edx
lea rax, [0x2054cbe0]
lea rcx, [0x20470fd0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x2054d280]
add edx, r8d
add edx, 0xeb429f3
cmp edx, 0xd
jl 0x20153090
mov al, 6
xchg byte [0x2054cbed], al
lea rax, [0x2054cbe0]
ret
Function at 0x2015a730
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0xc4c1d1ed
add eax, dword [0x2054dd70]
cmp ecx, eax
jne 0x2015a76c
test edx, edx
je 0x2015a7ac
movzx eax, byte [0x2054d660]
cmp al, 0x2c
je 0x2015a764
mov cl, 0xda
mov al, 0x72
lock cmpxchg byte [0x2054d660], cl
je 0x2015a856
cmp al, 0x2c
jne 0x2015a750
lea rax, [0x2054d650]
ret
test edx, edx
je 0x2015a80c
movzx eax, byte [0x2054d51c]
cmp al, 0x19
je 0x2015a7a4
mov cl, 0x8f
nop word cs:[rax + rax]
mov al, 0xf3
lock cmpxchg byte [0x2054d51c], cl
je 0x2015a888
cmp al, 0x19
jne 0x2015a790
lea rax, [0x2054d510]
ret
movzx eax, byte [0x2054d641]
nop word cs:[rax + rax]
cmp al, 0xbd
je 0x2015a8e7
movzx ecx, byte [0x2054dd74]
lea eax, [rcx + 9]
add cl, 0xbf
lock cmpxchg byte [0x2054d641], cl
jne 0x2015a7c0
xor eax, eax
lea rcx, [0x2054d630]
lea rdx, [0x20471340]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x2015a8d8
inc rax
jmp 0x2015a7f0
movzx eax, byte [0x2054d84c]
movzx ecx, byte [0x2054dd74]
add cl, 0x19
cmp al, cl
je 0x2015a84e
mov cl, 0x4b
nop word cs:[rax + rax]
mov al, 0x1b
lock cmpxchg byte [0x2054d84c], cl
je 0x2015a8ef
movzx edx, byte [0x2054dd74]
add dl, 0x19
cmp al, dl
jne 0x2015a830
lea rax, [0x2054d840]
ret
xor eax, eax
lea rcx, [0x2054d650]
lea rdx, [0x20471360]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x2015a8b8
inc rax
jmp 0x2015a870
xor eax, eax
lea rcx, [0x2054d510]
lea rdx, [0x20471220]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x2015a8c8
inc rax
jmp 0x2015a8a0
mov al, 0x2c
xchg byte [0x2054d660], al
lea rax, [0x2054d650]
ret
mov al, 0x19
xchg byte [0x2054d51c], al
lea rax, [0x2054d510]
ret
movzx eax, byte [0x2054dd74]
add al, 0x26
xchg byte [0x2054d641], al
lea rax, [0x2054d630]
ret
xor eax, eax
lea rcx, [0x2054d840]
lea rdx, [0x20471530]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x2015a918
inc rax
jmp 0x2015a900
movzx eax, byte [0x2054dd74]
add al, 0x19
xchg byte [0x2054d84c], al
lea rax, [0x2054d840]
ret
Function at 0x2015b8f0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x2015b936
test edx, edx
je 0x2015b96c
movzx eax, byte [0x2054d592]
cmp al, 0x9e
je 0x2015b92e
mov cl, 0xd4
nop word cs:[rax + rax]
mov al, 0x56
lock cmpxchg byte [0x2054d592], cl
je 0x2015b9cc
movzx edx, byte [0x2054dd74]
add dl, 7
cmp al, dl
jne 0x2015b910
lea rax, [0x2054d580]
ret
test edx, edx
je 0x2015b99c
movzx eax, byte [0x2054d716]
cmp al, 0xa5
je 0x2015b964
mov cl, 0x5f
nop word [rax + rax]
mov al, 9
lock cmpxchg byte [0x2054d716], cl
je 0x2015ba35
cmp al, 0xa5
jne 0x2015b950
lea rax, [0x2054d700]
ret
movzx eax, byte [0x2054d872]
cmp al, 0x3e
je 0x2015b994
mov cl, 0x7a
nop dword [rax]
mov al, 0xfc
lock cmpxchg byte [0x2054d872], cl
je 0x2015ba7f
cmp al, 0x3e
jne 0x2015b980
lea rax, [0x2054d860]
ret
movzx eax, byte [0x2054d82c]
cmp al, 0xc7
je 0x2015b9c4
mov cl, 0xee
nop dword [rax]
mov al, 0x19
lock cmpxchg byte [0x2054d82c], cl
je 0x2015bad1
cmp al, 0xc7
jne 0x2015b9b0
lea rax, [0x2054d820]
ret
xor edx, edx
lea rax, [0x2054d580]
lea rcx, [0x20471290]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r9d
not r10b
mov r11d, r8d
xor r11b, r10b
not r11b
and r11b, r9b
and r10b, r8b
or r10b, r11b
mov byte [rdx + rax], r10b
mov r8d, dword [0x2054dd70]
add edx, r8d
add edx, 0xc4c1d1ee
cmp edx, 0x12
jl 0x2015b9e0
movzx eax, byte [0x2054dd74]
add al, 7
xchg byte [0x2054d592], al
lea rax, [0x2054d580]
ret
xor edx, edx
lea rax, [0x2054d700]
lea rcx, [0x20471400]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x16
jl 0x2015ba50
mov al, 0xa5
xchg byte [0x2054d716], al
lea rax, [0x2054d700]
ret
xor edx, edx
lea rax, [0x2054d860]
lea rcx, [0x20471550]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x2054dd70]
add edx, r8d
add edx, 0xc4c1d1ee
cmp edx, 0x12
jl 0x2015ba90
movzx eax, byte [0x2054dd74]
mov ecx, eax
xor cl, 0xa7
and al, 0x27
add al, al
add al, cl
xchg byte [0x2054d872], al
lea rax, [0x2054d860]
ret
xor edx, edx
lea rax, [0x2054d820]
lea rcx, [0x20471510]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
mov r8d, dword [0x2054dd70]
mov r9d, r8d
xor r9d, 0x397e25e5
and r8d, 0x397e25e5
lea r8d, [r9 + r8*2]
add r8d, 0x8b43ac14
cmp edx, r8d
jl 0x2015baf0
movzx eax, byte [0x2054dd74]
add al, 0x30
xchg byte [0x2054d82c], al
lea rax, [0x2054d820]
ret
Function at 0x20161d80
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x20161dbc
test edx, edx
je 0x20161dec
cmp byte [0x2054e05f], 0
je 0x20161db4
mov cl, 0x99
nop word cs:[rax + rax]
mov al, 0xde
lock cmpxchg byte [0x2054e05f], cl
je 0x20161e9c
test al, al
jne 0x20161da0
lea rax, [0x2054e040]
ret
test edx, edx
je 0x20161e26
movzx eax, byte [0x2054ded5]
cmp al, 0x36
je 0x20161de4
mov cl, 0xfe
nop dword [rax]
mov al, 0x1a
lock cmpxchg byte [0x2054ded5], cl
je 0x20161ef1
cmp al, 0x36
jne 0x20161dd0
lea rax, [0x2054dec0]
ret
movzx eax, byte [0x2054e103]
cmp al, 0x13
je 0x20161e1e
mov cl, 0x87
nop dword [rax]
mov al, 0xef
lock cmpxchg byte [0x2054e103], cl
je 0x20161f41
movzx edx, byte [0x2054e6c8]
add dl, 0x41
cmp al, dl
jne 0x20161e00
lea rax, [0x2054e0f0]
ret
movzx eax, byte [0x2054e1cd]
nop dword [rax]
cmp al, 0x48
je 0x20161fa9
movzx ecx, byte [0x2054e6c8]
lea eax, [rcx - 0x2f]
mov edx, ecx
xor dl, 0x25
and dl, cl
xor cl, 0x5a
add dl, dl
add dl, cl
lock cmpxchg byte [0x2054e1cd], dl
jne 0x20161e30
xor eax, eax
lea rcx, [0x2054e1c0]
lea rdx, [0x20471a10]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x20161fa1
inc rax
jmp 0x20161e70
xor eax, eax
lea rcx, [0x2054e040]
lea rdx, [0x20471890]
mov r8d, 0xaa8bd740
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x2054e6cc]
add r10d, r8d
cmp r9d, r10d
jge 0x20161ee1
inc rax
jmp 0x20161ec0
xor eax, eax
xchg byte [0x2054e05f], al
lea rax, [0x2054e040]
ret
xor edx, edx
lea rax, [0x2054dec0]
lea rcx, [0x20471710]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x2054e6cc]
add edx, r8d
add edx, 0xaa8bd722
cmp edx, 0x15
jl 0x20161f10
mov al, 0x36
xchg byte [0x2054ded5], al
lea rax, [0x2054dec0]
ret
xor edx, edx
lea rax, [0x2054e0f0]
lea rcx, [0x20471940]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x2054e6cc]
add edx, r8d
add edx, 0xaa8bd722
cmp edx, 0x13
jl 0x20161f60
mov al, 0x13
xchg byte [0x2054e103], al
lea rax, [0x2054e0f0]
ret
mov al, 0x48
xchg byte [0x2054e1cd], al
lea rax, [0x2054e1c0]
ret
Function at 0x20162080
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x201620bc
test edx, edx
je 0x201620ec
movzx eax, byte [0x2054df63]
movzx ecx, byte [0x2054e6c8]
add cl, 0xbd
cmp al, cl
je 0x201620b4
mov cl, 0xc
nop
mov al, 0x71
lock cmpxchg byte [0x2054df63], cl
je 0x2016214c
cmp al, 0x8f
jne 0x201620a0
lea rax, [0x2054df40]
ret
test edx, edx
je 0x2016211c
movzx eax, byte [0x2054e19d]
cmp al, 0xc0
je 0x201620e4
mov cl, 0x9e
nop dword [rax]
mov al, 0xb7
lock cmpxchg byte [0x2054e19d], cl
je 0x201621a1
cmp al, 0xc0
jne 0x201620d0
lea rax, [0x2054e190]
ret
movzx eax, byte [0x2054e133]
cmp al, 0xc1
je 0x20162114
mov cl, 0x1d
nop dword [rax]
mov al, 0xcb
lock cmpxchg byte [0x2054e133], cl
je 0x20162201
cmp al, 0xc1
jne 0x20162100
lea rax, [0x2054e120]
ret
movzx eax, byte [0x2054e17b]
cmp al, 0x3c
je 0x20162144
mov cl, 5
nop dword [rax]
mov al, 0x2c
lock cmpxchg byte [0x2054e17b], cl
je 0x20162248
cmp al, 0x3c
jne 0x20162130
lea rax, [0x2054e170]
ret
xor eax, eax
lea rcx, [0x2054df40]
lea rdx, [0x20471790]
mov r8d, 0xaa8bd744
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x2054e6cc]
add r10d, r8d
cmp r9d, r10d
jge 0x20162191
inc rax
jmp 0x20162170
mov al, 0x8f
xchg byte [0x2054df63], al
lea rax, [0x2054df40]
ret
xor edx, edx
lea rax, [0x2054e190]
lea rcx, [0x204719e0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x2054e6cc]
add edx, r8d
add edx, 0xaa8bd722
cmp edx, 0xd
jl 0x201621c0
mov al, 0xc0
xchg byte [0x2054e19d], al
lea rax, [0x2054e190]
ret
xor eax, eax
lea rcx, [0x2054e120]
lea rdx, [0x20471970]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x12
jg 0x20162238
inc rax
jmp 0x20162220
mov al, 0xc1
xchg byte [0x2054e133], al
lea rax, [0x2054e120]
ret
xor edx, edx
lea rax, [0x2054e170]
lea rcx, [0x204719c0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xb
jl 0x20162260
mov al, 0x3c
xchg byte [0x2054e17b], al
lea rax, [0x2054e170]
ret
Function at 0x20162290
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xaa8bd721
add eax, dword [0x2054e6cc]
cmp ecx, eax
jne 0x201622fc
test edx, edx
je 0x2016232c
movzx eax, byte [0x2054e18f]
nop
cmp al, 0x2a
je 0x201623e7
movzx ecx, byte [0x2054e6c8]
lea eax, [rcx + 5]
add cl, 0xa7
lock cmpxchg byte [0x2054e18f], cl
jne 0x201622b0
xor eax, eax
lea rcx, [0x2054e180]
lea rdx, [0x204719d0]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x201623df
inc rax
jmp 0x201622e0
test edx, edx
je 0x2016236c
movzx eax, byte [0x2054e07a]
cmp al, 0x1c
je 0x20162324
mov cl, 0xf7
nop dword [rax]
mov al, 0x73
lock cmpxchg byte [0x2054e07a], cl
je 0x201623ef
cmp al, 0x1c
jne 0x20162310
lea rax, [0x2054e070]
ret
movzx eax, byte [0x2054e161]
movzx ecx, byte [0x2054e6c8]
add cl, 0x78
cmp al, cl
je 0x20162364
mov cl, 0xe3
nop word cs:[rax + rax]
mov al, 0xe1
lock cmpxchg byte [0x2054e161], cl
je 0x20162438
cmp al, 0x4a
jne 0x20162350
lea rax, [0x2054e150]
ret
movzx eax, byte [0x2054dfcf]
nop word cs:[rax + rax]
cmp al, 0x3e
je 0x201623d7
movzx ecx, byte [0x2054e6c8]
lea eax, [rcx + 0x67]
add cl, 0xf5
lock cmpxchg byte [0x2054dfcf], cl
jne 0x20162380
xor edx, edx
lea rax, [0x2054dfc0]
lea rcx, [0x20471810]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x201623b0
mov al, 0x3e
xchg byte [0x2054dfcf], al
lea rax, [0x2054dfc0]
ret
mov al, 0x2a
xchg byte [0x2054e18f], al
lea rax, [0x2054e180]
ret
xor eax, eax
lea rcx, [0x2054e070]
lea rdx, [0x204718c0]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 9
jg 0x20162428
inc rax
jmp 0x20162400
mov al, 0x1c
xchg byte [0x2054e07a], al
lea rax, [0x2054e070]
ret
xor eax, eax
lea rcx, [0x2054e150]
lea rdx, [0x204719a0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x20162478
inc rax
jmp 0x20162450
mov al, 0x4a
xchg byte [0x2054e161], al
lea rax, [0x2054e150]
ret
Function at 0x20162600
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0x20c08745
add eax, dword [0x2054e6cc]
cmp ecx, eax
jne 0x2016264c
test edx, edx
je 0x2016267c
movzx eax, byte [0x2054def2]
cmp al, 0x71
je 0x20162644
mov cl, 0x70
nop dword [rax + rax]
mov al, 0xa6
lock cmpxchg byte [0x2054def2], cl
je 0x201626dc
cmp al, 0x71
jne 0x20162630
lea rax, [0x2054dee0]
ret
test edx, edx
je 0x201626ac
movzx eax, byte [0x2054deb0]
cmp al, 0x78
je 0x20162674
mov cl, 0x68
nop dword [rax]
mov al, 0x88
lock cmpxchg byte [0x2054deb0], cl
je 0x20162708
cmp al, 0x78
jne 0x20162660
lea rax, [0x2054dea0]
ret
movzx eax, byte [0x2054df0e]
cmp al, 0x72
je 0x201626a4
mov cl, 0xf1
nop dword [rax]
mov al, 0x21
lock cmpxchg byte [0x2054df0e], cl
je 0x20162769
cmp al, 0x72
jne 0x20162690
lea rax, [0x2054df00]
ret
movzx eax, byte [0x2054e08d]
cmp al, 0x5c
je 0x201626d4
mov cl, 0x30
nop dword [rax]
mov al, 0xfe
lock cmpxchg byte [0x2054e08d], cl
je 0x201627ac
cmp al, 0x5c
jne 0x201626c0
lea rax, [0x2054e080]
ret
xor eax, eax
lea rcx, [0x2054dee0]
lea rdx, [0x20471730]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x20162759
inc rax
jmp 0x201626f0
xor edx, edx
lea rax, [0x2054dea0]
lea rcx, [0x20471700]
nop dword [rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
cmp edx, 0x10
jl 0x20162720
xor r8b, 0xc2
add r8b, byte [0x2054e6c8]
xchg byte [0x2054deb0], r8b
lea rax, [0x2054dea0]
ret
mov al, 0x71
xchg byte [0x2054def2], al
lea rax, [0x2054dee0]
ret
xor eax, eax
lea rcx, [0x2054df00]
lea rdx, [0x20471750]
nop dword [rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xd
jg 0x201627fd
inc rax
jmp 0x20162780
xor eax, eax
lea rcx, [0x2054e080]
lea rdx, [0x204718d0]
xor r8d, 0x20c08746
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x2054e6cc]
add r9d, r8d
add eax, r9d
cmp eax, 0xd
jl 0x201627d0
mov al, 0x5c
xchg byte [0x2054e08d], al
lea rax, [0x2054e080]
ret
xor r8b, 0xc4
add r8b, byte [0x2054e6c8]
xchg byte [0x2054df0e], r8b
lea rax, [0x2054df00]
ret
Function at 0x201639b0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, dword [0x2054e6cc]
mov r9d, r8d
xor r9d, 0x118c047f
add eax, r9d
add eax, 0xa00b7989
mov r9d, eax
xor r9d, 0x5ff48677
and eax, 0x5ff48677
lea eax, [r9 + rax*2]
cmp ecx, eax
jne 0x20163a1c
test edx, edx
je 0x20163a58
movzx eax, byte [0x2054dff1]
cmp al, 0xaa
je 0x20163a14
mov cl, 0xbc
nop word cs:[rax + rax]
mov al, 0x38
lock cmpxchg byte [0x2054dff1], cl
je 0x20163abc
cmp al, 0xaa
jne 0x20163a00
lea rax, [0x2054dfe0]
ret
test edx, edx
je 0x20163a8c
movzx eax, byte [0x2054dfad]
cmp al, 0xe4
je 0x20163a50
mov cl, 0x7d
nop dword [rax]
mov al, 0x71
lock cmpxchg byte [0x2054dfad], cl
je 0x20163b22
mov edx, r8d
xor dl, 0x4c
add dl, byte [0x2054e6c8]
cmp al, dl
jne 0x20163a30
lea rax, [0x2054dfa0]
ret
movzx eax, byte [0x2054e0cd]
cmp al, 0x82
je 0x20163a84
mov cl, 0x8b
nop word cs:[rax + rax]
mov al, 0xa7
lock cmpxchg byte [0x2054e0cd], cl
je 0x20163b68
cmp al, 0x82
jne 0x20163a70
lea rax, [0x2054e0c0]
ret
movzx eax, byte [0x2054e0ad]
cmp al, 5
je 0x20163ab4
mov cl, 0xd1
nop dword [rax]
mov al, 0x57
lock cmpxchg byte [0x2054e0ad], cl
je 0x20163bbb
cmp al, 5
jne 0x20163aa0
lea rax, [0x2054e0a0]
ret
xor edx, edx
lea rax, [0x2054dfe0]
lea rcx, [0x20471830]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
not r8b
mov r10d, r8d
and r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov byte [rdx + rax], r8b
add edx, 0xdaacf9c1
mov r8d, edx
xor r8d, 0x25530640
and edx, 0x25530640
lea edx, [r8 + rdx*2]
cmp edx, 0x11
jl 0x20163ad0
mov al, 0xaa
xchg byte [0x2054dff1], al
lea rax, [0x2054dfe0]
ret
xor eax, eax
lea rcx, [0x2054dfa0]
lea rdx, [0x204717f0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x20163b58
inc rax
jmp 0x20163b40
mov al, 0xe4
xchg byte [0x2054dfad], al
lea rax, [0x2054dfa0]
ret
xor edx, edx
lea rax, [0x2054e0c0]
lea rcx, [0x20471910]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0x7d424830
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x82bdb7d0
cmp edx, 0xd
jl 0x20163b80
mov al, 0x82
xchg byte [0x2054e0cd], al
lea rax, [0x2054e0c0]
ret
xor eax, eax
lea rcx, [0x2054e0a0]
lea rdx, [0x204718f0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x20163be8
inc rax
jmp 0x20163bd0
mov al, 5
xchg byte [0x2054e0ad], al
lea rax, [0x2054e0a0]
ret