joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403a46b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1405b3a48]
mov ecx, eax
xor ecx, 0xda7fa12c
and eax, 0x5a7fa12c
lea eax, [rcx + rax*2]
lea rcx, [fcn.1403a46b0]
add ecx, ecx
add ecx, 0xfc0
mov edx, ecx
xor edx, eax
not eax
not ecx
and ecx, eax
or ecx, edx
cmp ecx, 0xffffffff
nop dword [rax + rax]
mov ecx, dword [0x1405d3908]
mov eax, dword [0x1405d43d8]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
mov r8d, dword [rax + 0x26838]
mov edx, dword [0x1405d398c]
mov r9d, dword [0x1405b3a48]
mov eax, r9d
xor eax, 0x704d209f
mov r10d, r9d
and r10d, 0x704d209f
sub eax, edx
lea r10d, [rax + r10*2]
mov eax, 0x95cd7f73
sub eax, r10d
imul eax, edx
lea r10d, [r9 - 0x25805ed3]
xor edx, edx
div r10d
add r9d, 0xda7fa12b
cmp edx, r9d
jne 0x1403a46f0
cmp ecx, r8d
jg 0x1403a4769
lea rax, [0x1405d38f0]
add rsp, 0x28
ret
lea rax, [fcn.1403a46b0]
lea ecx, [rax + rax]
add ecx, 0x8a1
add eax, eax
add eax, 0x8a0
not eax
mov edx, ecx
or edx, eax
and edx, ecx
mov ecx, eax
and ecx, edx
mov r8d, edx
and r8d, 0xfffffffe
xor r8d, ecx
and eax, 0xfffffffe
mov ecx, edx
and ecx, eax
or ecx, r8d
or eax, ecx
not edx
or edx, ecx
and edx, eax
cmp edx, 0xffffffff
jne 0x1403a47d0
lea rdx, [0x1405d3908]
mov ecx, 1
mov r8d, 0xaea15085
mov r9d, 0xfbb057c6
call fcn.14029ce30
xor eax, eax
test al, al
je 0x1403a481a
mov r9d, dword [0x1405b3a48]
mov eax, r9d
not eax
mov ecx, r9d
xor ecx, 0xda7fa12c
mov edx, eax
and eax, 0x25805ed3
or eax, ecx
and ecx, r9d
and edx, 0xda7fa12c
or edx, ecx
not eax
lea ecx, [rdx + rax*2]
lea r8d, [r9 - 0x76df0e50]
add r9d, 0xd62ff8f1
lea rdx, [0x1405d3908]
call fcn.14029ce30
jmp 0x1403a47ad
cmp dword [0x1405d3908], 0xffffffff
jne 0x1403a475d
lea rax, [0x1405b31b0]
mov qword [0x1405d38f0], rax
movabs rax, 0x900000090
mov qword [0x1405d38f8], rax
mov eax, 0xa2cfe372
add eax, dword [0x1405b3a48]
mov dword [0x1405d3900], eax
lea rdx, [0x1405d3908]
xor ecx, ecx
mov r8d, 0xaea15085
mov r9d, 0xfbb057c6
call fcn.14029ce30
jmp 0x1403a475d
Function at 0x1403a5a10
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, dword [0x1405b3be0]
mov r9d, r8d
xor r9d, 0x9b45b97
mov r10d, r9d
xor r10d, eax
and r9d, eax
lea eax, [r10 + r9*2]
cmp ecx, eax
jne 0x1403a5a6c
movzx eax, byte [0x1405b3aa0]
cmp al, 0xc0
je 0x1403a5a64
mov cl, 0x9e
nop word cs:[rax + rax]
mov al, 0xd2
lock cmpxchg byte [0x1405b3aa0], cl
je 0x1403a5b0c
cmp al, 0xc0
jne 0x1403a5a50
lea rax, [0x1405b3a90]
ret
test edx, edx
je 0x1403a5a9c
movzx eax, byte [0x1405b3b8c]
cmp al, 0xea
je 0x1403a5a94
mov cl, 0xab
nop dword [rax]
mov al, 0x93
lock cmpxchg byte [0x1405b3b8c], cl
je 0x1403a5b4f
cmp al, 0xea
jne 0x1403a5a80
lea rax, [0x1405b3b80]
ret
movzx eax, byte [0x1405b3a72]
nop word cs:[rax + rax]
cmp al, 0x1d
je 0x1403a5b97
movzx ecx, byte [0x1405b3bf0]
mov eax, r8d
xor al, 0x7a
add al, cl
mov edx, r8d
xor dl, 0xfa
add dl, cl
lock cmpxchg byte [0x1405b3a72], dl
jne 0x1403a5ab0
xor eax, eax
lea rcx, [0x1405b3a70]
lea rdx, [0x1404adf50]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x1403a5b8f
inc rax
jmp 0x1403a5af0
xor edx, edx
lea rax, [0x1405b3a90]
lea rcx, [0x1404adf70]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x1403a5b20
mov al, 0xc0
xchg byte [0x1405b3aa0], al
lea rax, [0x1405b3a90]
ret
xor edx, edx
lea rax, [0x1405b3b80]
lea rcx, [0x1404ae050]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xc
jl 0x1403a5b60
mov al, 0xea
xchg byte [0x1405b3b8c], al
lea rax, [0x1405b3b80]
ret
mov al, 0x1d
xchg byte [0x1405b3a72], al
lea rax, [0x1405b3a70]
ret
Function at 0x1403ad2a0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403ad2dc
test edx, edx
je 0x1403ad33c
movzx eax, byte [0x1405b41dc]
cmp al, 0x25
je 0x1403ad2d4
mov cl, 0xeb
nop dword [rax]
mov al, 0xe5
lock cmpxchg byte [0x1405b41dc], cl
je 0x1403ad3cc
cmp al, 0x25
jne 0x1403ad2c0
lea rax, [0x1405b41d0]
ret
test edx, edx
je 0x1403ad36c
movzx eax, byte [0x1405b421d]
nop dword [rax + rax]
cmp al, 0xe6
je 0x1403ad420
movzx ecx, byte [0x1405b48d4]
lea eax, [rcx + 0x6a]
add cl, 0x42
lock cmpxchg byte [0x1405b421d], cl
jne 0x1403ad2f0
xor eax, eax
lea rcx, [0x1405b4210]
lea rdx, [0x1404ae740]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1403ad418
inc rax
jmp 0x1403ad320
movzx eax, byte [0x1405b4201]
cmp al, 0x55
je 0x1403ad364
mov cl, 0x47
nop dword [rax]
mov al, 0x4f
lock cmpxchg byte [0x1405b4201], cl
je 0x1403ad428
cmp al, 0x55
jne 0x1403ad350
lea rax, [0x1405b41f0]
ret
movzx eax, byte [0x1405b4261]
nop word cs:[rax + rax]
cmp al, 0x36
je 0x1403ad477
movzx eax, byte [0x1405b48d4]
lea ecx, [rax + 5]
lock cmpxchg byte [0x1405b4261], cl
jne 0x1403ad380
xor eax, eax
lea rcx, [0x1405b4250]
lea rdx, [0x1404ae780]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x1403ad46f
inc rax
jmp 0x1403ad3b0
xor eax, eax
lea rcx, [0x1405b41d0]
lea rdx, [0x1404ae700]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x1403ad408
inc rax
jmp 0x1403ad3e0
mov al, 0x25
xchg byte [0x1405b41dc], al
lea rax, [0x1405b41d0]
ret
mov al, 0xe6
xchg byte [0x1405b421d], al
lea rax, [0x1405b4210]
ret
xor edx, edx
lea rax, [0x1405b41f0]
lea rcx, [0x1404ae720]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x11
jl 0x1403ad440
mov al, 0x55
xchg byte [0x1405b4201], al
lea rax, [0x1405b41f0]
ret
mov al, 0x36
xchg byte [0x1405b4261], al
lea rax, [0x1405b4250]
ret
Function at 0x1403ad4c0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403ad4fc
test edx, edx
je 0x1403ad53c
movzx eax, byte [0x1405b41b9]
cmp al, 0xf0
je 0x1403ad4f4
mov cl, 0x35
nop word cs:[rax + rax]
mov al, 0x90
lock cmpxchg byte [0x1405b41b9], cl
je 0x1403ad5dc
cmp al, 0xf0
jne 0x1403ad4e0
lea rax, [0x1405b41b0]
ret
test edx, edx
je 0x1403ad59c
movzx eax, byte [0x1405b424d]
cmp al, 0x34
je 0x1403ad534
mov cl, 0xd2
nop word cs:[rax + rax]
mov al, 0x6d
lock cmpxchg byte [0x1405b424d], cl
je 0x1403ad641
cmp al, 0x34
jne 0x1403ad520
lea rax, [0x1405b4240]
ret
movzx eax, byte [0x1405b4193]
nop word cs:[rax + rax]
cmp al, 0xac
je 0x1403ad6a7
movzx ecx, byte [0x1405b48d4]
lea eax, [rcx + 0x60]
add cl, 0xc9
lock cmpxchg byte [0x1405b4193], cl
jne 0x1403ad550
xor eax, eax
lea rcx, [0x1405b4170]
lea rdx, [0x1404ae6a0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1403ad69f
inc rax
jmp 0x1403ad580
movzx eax, byte [0x1405b41cd]
movzx ecx, byte [0x1405b48d4]
add cl, 0x2a
cmp al, cl
je 0x1403ad5d4
mov cl, 0x5d
nop word cs:[rax + rax]
mov al, 0x7c
lock cmpxchg byte [0x1405b41cd], cl
je 0x1403ad6af
cmp al, 0x11
jne 0x1403ad5c0
lea rax, [0x1405b41c0]
ret
xor eax, eax
lea rcx, [0x1405b41b0]
lea rdx, [0x1404ae6e0]
mov r8d, 0xb62bd7eb
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x1405b48c0]
add r10d, r8d
cmp r9d, r10d
jge 0x1403ad631
inc rax
jmp 0x1403ad600
mov al, 0xf0
xchg byte [0x1405b41b9], al
lea rax, [0x1405b41b0]
ret
xor edx, edx
lea rax, [0x1405b4240]
lea rcx, [0x1404ae770]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x1403ad660
mov al, 0x34
xchg byte [0x1405b424d], al
lea rax, [0x1405b4240]
ret
mov al, 0xac
xchg byte [0x1405b4193], al
lea rax, [0x1405b4170]
ret
xor edx, edx
lea rax, [0x1405b41c0]
lea rcx, [0x1404ae6f0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x1403ad6c0
movzx eax, byte [0x1405b48d4]
add al, 0x2a
xchg byte [0x1405b41cd], al
lea rax, [0x1405b41c0]
ret

Function at 0x1403b4ef0
Capabilities:
Encode data using xor

Disassembly:
test rcx, rcx
je 0x1403b4f5a
movabs rdx, 0x846e90b8d768e544
xor eax, eax
mov r8d, 1
xor r9d, r9d
nop word [rax + rax]
movzx r10d, byte [0x1405b7200]
mov r11d, r10d
xor r11b, 0xa4
and r10b, 0x24
add r10b, r10b
add r10b, r11b
add r10b, 0x18
xor r11d, r11d
cmp byte [rcx + rax], r10b
movzx r9d, r9b
cmove r9d, r8d
setne r11b
mov r10, r11
xor r10, rax
and r11d, eax
sub r10, rdx
lea rax, [r10 + r11*2]
add rax, rdx
test r9b, 1
je 0x1403b4f10
ret
xor eax, eax
ret
Function at 0x1403bb350
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1403bb39c
mov eax, r8d
xor eax, 0x6d6890eb
add eax, dword [0x1405b7204]
cmp edx, eax
jne 0x1403bb3cc
movzx eax, byte [0x1405b6119]
cmp al, 6
je 0x1403bb394
mov cl, 0x85
nop dword [rax + rax]
mov al, 0x8f
lock cmpxchg byte [0x1405b6119], cl
je 0x1403bb438
cmp al, 6
jne 0x1403bb380
lea rax, [0x1405b6110]
ret
test edx, edx
je 0x1403bb3fc
movzx eax, byte [0x1405b6002]
cmp al, 0x14
je 0x1403bb3c4
mov cl, 0xf
nop dword [rax]
mov al, 0xa0
lock cmpxchg byte [0x1405b6002], cl
je 0x1403bb4e1
cmp al, 0x14
jne 0x1403bb3b0
lea rax, [0x1405b6000]
ret
movzx eax, byte [0x1405b60c3]
cmp al, 0x14
je 0x1403bb3f4
mov cl, 0x93
nop dword [rax]
mov al, 0xbe
lock cmpxchg byte [0x1405b60c3], cl
je 0x1403bb478
cmp al, 0x14
jne 0x1403bb3e0
lea rax, [0x1405b60c0]
ret
movzx eax, byte [0x1405b605b]
cmp al, 0x36
je 0x1403bb430
mov cl, 0xbc
nop dword [rax]
mov al, 0x69
lock cmpxchg byte [0x1405b605b], cl
je 0x1403bb52f
mov edx, r8d
xor dl, 0xa4
add dl, byte [0x1405b7200]
cmp al, dl
jne 0x1403bb410
lea rax, [0x1405b6040]
ret
xor eax, eax
lea rcx, [0x1405b6110]
lea rdx, [0x1404aee80]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1403bb4d1
inc rax
jmp 0x1403bb450
xor eax, eax
lea rcx, [0x1405b60c0]
lea rdx, [0x1404aee30]
xor r8d, 0x6d6890e8
nop
cdqe
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
mov r9d, dword [0x1405b7204]
add r9d, r8d
add eax, r9d
cmp eax, 3
jl 0x1403bb490
mov al, 0x14
xchg byte [0x1405b60c3], al
lea rax, [0x1405b60c0]
ret
mov al, 6
xchg byte [0x1405b6119], al
lea rax, [0x1405b6110]
ret
xor edx, edx
lea rax, [0x1405b6000]
lea rcx, [0x1404aed80]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 2
jl 0x1403bb500
mov al, 0x14
xchg byte [0x1405b6002], al
lea rax, [0x1405b6000]
ret
xor eax, eax
lea rcx, [0x1405b6040]
lea rdx, [0x1404aedc0]
xor r8d, 0x6d68908e
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405b7204]
add r10d, r8d
cmp r9d, r10d
jge 0x1403bb571
inc rax
jmp 0x1403bb550
mov al, 0x36
xchg byte [0x1405b605b], al
lea rax, [0x1405b6040]
ret
Function at 0x1403bb9f0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
test rcx, rcx
je 0x1403bbaf6
mov rsi, rdx
mov rdi, rcx
movabs rax, 0xea524dad12d0427e
movabs rcx, 0x6d6382ba081693c0
xor r14d, r14d
movabs rdx, 0x59cb02cc90816fe
mov r8d, r14d
mov r9, qword [0x1405d0970]
add r9, rcx
sub r9, rax
add r8, rax
add r8, r9
sub r8, rdx
sub r8, rcx
add r8, rdx
movzx r9d, word [0x1405d2a50]
xor r10d, r10d
add r9w, word [rdi + r8*2]
setne r10b
add r14d, 0xd3088c99
mov r8d, r14d
xor r8d, r10d
and r14d, r10d
lea r14d, [r8 + r14*2]
add r14d, 0x2cf77367
cmp word [rdi + r14*2], 0
jne 0x1403bba30
test r14d, r14d
je 0x1403bbb1d
mov dword [rsp + 0x38], 0xaac90f97
mov dword [rsp + 0x30], 0x2361860c
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor ebx, ebx
mov ecx, 1
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call fcn.1403c5410
test rax, rax
je 0x1403bbb1f
mov rcx, qword [rax + 0x10]
xor ebx, ebx
test rcx, rcx
je 0x1403bbb1f
mov rdx, qword [rax + 0x18]
test rdx, rdx
je 0x1403bbb1f
inc r14d
mov r15d, r14d
xor ebx, ebx
mov ebp, 1
mov r8, rcx
xor r12d, r12d
mov qword [rsp + 0x40], rsi
jmp 0x1403bbb6c
mov dword [rsp + 0x20], 0xef236587
xor ebx, ebx
xor ecx, ecx
xor edx, edx
xor r8d, r8d
mov r9d, 0xa7b226ad
call fcn.1403c5730
test rax, rax
je 0x1403bbb1f
mov rbx, qword [rax + 0x10]
jmp 0x1403bbb1f
xor ebx, ebx
mov rax, rbx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ebp, 1
nop dword [rax + rax]
mov r10, qword [r8]
test r10, r10
cmovne r8, r10
movzx r12d, r9b
cmove r12d, ebp
mov r9d, r12d
not r9b
mov r10d, r12d
xor r10b, 1
and r9b, 0xfe
or r9b, r10b
cmp r9b, 0xff
jne 0x1403bbb1f
cmp rcx, qword [rax + 0x10]
je 0x1403bbbb8
mov dword [rsp + 0x38], 0xaac90f97
mov dword [rsp + 0x30], 0x2361860c
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov ecx, 1
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call fcn.1403c5410
test rax, rax
je 0x1403bbb1f
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov r8, rcx
mov r9d, r12d
xor r9b, 0xfe
and r9b, r12b
add r9b, byte [0x1405d1ce8]
jne 0x1403bbb52
cmp r8, rdx
movzx r9d, r12b
cmove r9d, ebp
add r9b, byte [0x1405d3d58]
movzx r10d, word [r8 + 0x58]
add r10d, dword [0x1405d0b80]
cmp r14d, r10d
ja 0x1403bbb40
mov r10, qword [r8 + 0x60]
test r10, r10
je 0x1403bbb40
cmp r10, 0xffff
je 0x1403bbb40
test r14d, r14d
je 0x1403bbc6c
xor r11d, r11d
jmp 0x1403bbc32
mov rsi, qword [0x1405d0990]
add r11, rsi
inc r11
cmp r11, r15
je 0x1403bbc6c
movzx r13d, word [rdi + r11*2]
lea esi, [r13 - 0x61]
lea r12d, [r13 - 0x20]
cmp si, 0x1a
cmovae r12d, r13d
test r12w, r12w
je 0x1403bbc20
movzx esi, word [r10 + r11*2]
lea r13d, [rsi - 0x61]
lea ebp, [rsi - 0x20]
cmp r13w, 0x1a
cmovae ebp, esi
cmp r12w, bp
je 0x1403bbc20
jmp 0x1403bbb33
mov rbx, qword [r8 + 0x30]
mov r9b, 1
mov rsi, qword [rsp + 0x40]
test rsi, rsi
mov ebp, 1
je 0x1403bbb40
mov qword [rsi], r8
jmp 0x1403bbb40
Function at 0x1403d72b0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403d72fc
test edx, edx
je 0x1403d732c
movzx eax, byte [0x1405ba620]
movzx ecx, byte [0x1405ba718]
mov edx, ecx
xor dl, 0x35
and cl, 0x35
add cl, cl
add cl, dl
cmp al, cl
je 0x1403d72f4
mov cl, 0x9b
nop dword [rax + rax]
mov al, 0xb7
lock cmpxchg byte [0x1405ba620], cl
je 0x1403d738c
cmp al, 0xac
jne 0x1403d72e0
lea rax, [0x1405ba610]
ret
test edx, edx
je 0x1403d735c
movzx eax, byte [0x1405ba6a9]
cmp al, 0x5b
je 0x1403d7324
mov cl, 0x7d
nop dword [rax]
mov al, 0xf3
lock cmpxchg byte [0x1405ba6a9], cl
je 0x1403d73db
cmp al, 0x5b
jne 0x1403d7310
lea rax, [0x1405ba6a0]
ret
movzx eax, byte [0x1405ba6d7]
cmp al, 0xc8
je 0x1403d7354
mov cl, 0xe2
nop dword [rax]
mov al, 0x1b
lock cmpxchg byte [0x1405ba6d7], cl
je 0x1403d7428
cmp al, 0xc8
jne 0x1403d7340
lea rax, [0x1405ba6c0]
ret
movzx eax, byte [0x1405ba709]
cmp al, 0x96
je 0x1403d7384
mov cl, 0xd5
nop dword [rax]
mov al, 0x61
lock cmpxchg byte [0x1405ba709], cl
je 0x1403d748f
cmp al, 0x96
jne 0x1403d7370
lea rax, [0x1405ba6f0]
ret
xor edx, edx
lea rax, [0x1405ba610]
lea rcx, [0x1404b04b0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
add edx, 0x14266bc3
mov r8d, edx
xor r8d, 0xebd9943e
and edx, 0x6bd9943e
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x1403d73a0
mov al, 0xac
xchg byte [0x1405ba620], al
lea rax, [0x1405ba610]
ret
xor eax, eax
lea rcx, [0x1405ba6a0]
lea rdx, [0x1404b0530]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
not r8b
not r9b
and r9b, r8b
or r9b, r10b
not r9b
add r9b, r9b
add r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1403d747f
inc rax
jmp 0x1403d73f0
xor edx, edx
lea rax, [0x1405ba6c0]
lea rcx, [0x1404b0550]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x17
jl 0x1403d7440
mov al, 0xc8
xchg byte [0x1405ba6d7], al
lea rax, [0x1405ba6c0]
ret
mov al, 0x5b
xchg byte [0x1405ba6a9], al
lea rax, [0x1405ba6a0]
ret
xor eax, eax
lea rcx, [0x1405ba6f0]
lea rdx, [0x1404b0580]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x18
jg 0x1403d74b8
inc rax
jmp 0x1403d74a0
mov al, 0x96
xchg byte [0x1405ba709], al
lea rax, [0x1405ba6f0]
ret
Function at 0x1403d9db0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x85693da1
mov r8d, dword [0x1405bac88]
add r8d, eax
cmp ecx, r8d
jne 0x1403d9e06
add eax, dword [0x1405bac88]
cmp edx, eax
jne 0x1403d9e3c
movzx eax, byte [0x1405ba81c]
cmp al, 0x23
je 0x1403d9dfe
mov cl, 0x1f
nop dword [rax + rax]
mov al, 0x14
lock cmpxchg byte [0x1405ba81c], cl
je 0x1403d9f31
movzx edx, byte [0x1405bac8c]
add dl, 0xc7
cmp al, dl
jne 0x1403d9de0
lea rax, [0x1405ba810]
ret
test edx, edx
je 0x1403d9ec1
movzx eax, byte [0x1405ba835]
cmp al, 0x98
je 0x1403d9e34
mov cl, 0x7a
nop dword [rax + rax]
mov al, 0xdd
lock cmpxchg byte [0x1405ba835], cl
je 0x1403d9eec
cmp al, 0x98
jne 0x1403d9e20
lea rax, [0x1405ba820]
ret
movzx eax, byte [0x1405ba9ad]
nop word cs:[rax + rax]
cmp al, 0x72
je 0x1403d9eb9
movzx ecx, byte [0x1405bac8c]
mov edx, ecx
xor dl, 0xcf
mov eax, ecx
and al, 0x4f
add al, al
add al, dl
mov edx, ecx
xor dl, 0x2b
and cl, 0x2b
add cl, cl
add cl, dl
lock cmpxchg byte [0x1405ba9ad], cl
jne 0x1403d9e50
xor edx, edx
lea rax, [0x1405ba9a0]
lea rcx, [0x1404b0910]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1405bac88]
add edx, r8d
add edx, 0x85693da2
cmp edx, 0xd
jl 0x1403d9e90
mov al, 0x72
xchg byte [0x1405ba9ad], al
lea rax, [0x1405ba9a0]
ret
movzx eax, byte [0x1405ba803]
cmp al, 0xa4
je 0x1403d9ee4
mov cl, 0x4b
nop
mov al, 0xb0
lock cmpxchg byte [0x1405ba803], cl
je 0x1403d9f7f
cmp al, 0xa4
jne 0x1403d9ed0
lea rax, [0x1405ba7f0]
ret
xor edx, edx
lea rax, [0x1405ba820]
lea rcx, [0x1404b07a0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1405bac88]
add edx, r8d
add edx, 0x85693da2
cmp edx, 0x15
jl 0x1403d9f00
mov al, 0x98
xchg byte [0x1405ba835], al
lea rax, [0x1405ba820]
ret
xor eax, eax
lea rcx, [0x1405ba810]
lea rdx, [0x1404b0790]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x1403d9f68
inc rax
jmp 0x1403d9f50
movzx eax, byte [0x1405bac8c]
add al, 0xc7
xchg byte [0x1405ba81c], al
lea rax, [0x1405ba810]
ret
xor eax, eax
lea rcx, [0x1405ba7f0]
lea rdx, [0x1404b0770]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x12
jg 0x1403d9fa8
inc rax
jmp 0x1403d9f90
mov al, 0xa4
xchg byte [0x1405ba803], al
lea rax, [0x1405ba7f0]
ret
Function at 0x1403e8ff0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
movzx eax, byte [0x1405d3dcd]
movabs rcx, 0x1437f92e534ca1f0
add rcx, qword [0x1405bc3c0]
cmp rdx, rcx
ja 0x1403e9271
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov ebx, 1
shl rbx, cl
lea r8, [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov edx, 2
shl rdx, cl
mov ecx, dword [0x1405bc4c4]
add eax, ecx
add eax, 0xd1e2
cdqe
add rax, qword [0x1405bc4d0]
mov rcx, r8
mov r8, rdi
call qword [case.0x14012b313.0]
mov rax, qword [0x1405bc3c0]
add rax, rbx
movabs rcx, 0xc37f92e534ca1ef
add rcx, rax
mov qword [rsi + 0x30], rcx
mov qword [rsi + 0x38], rbx
mov rax, qword [rsi + 8]
mov r9, qword [rax]
cmp r9, rdi
je 0x1403e9263
movabs rax, 0xcbf29ce484222325
movabs rcx, 0x100000001b3
movabs rdx, 0xc37fa2e534ca3a3
jmp 0x1403e90d1
mov qword [r10 + r11*8], r8
mov qword [r10 + r14*8], r8
cmp r9, rdi
je 0x1403e9263
mov r8, r9
movzx r9d, byte [r9 + 0x10]
xor r9, rax
imul r9, rcx
movzx r10d, byte [r8 + 0x11]
xor r10, r9
imul r10, rcx
movzx r11d, byte [r8 + 0x12]
mov r9, r11
not r9
and r9, r10
not r10d
and r10d, r11d
or r9, r10
imul r9, rcx
movzx r10d, byte [r8 + 0x13]
mov r11, r9
xor r11, r10
mov ebx, r10d
xor ebx, r9d
not r9d
and ebx, r10d
not r11
and r9d, r10d
or r9, r11
not r9
or r9, rbx
mov r10, qword [0x1405bc3c0]
add r10, rdx
imul r10, r9
movzx r11d, byte [r8 + 0x14]
mov r9, r11
not r9
and r9, r10
not r10d
and r10d, r11d
or r9, r10
imul r9, rcx
movzx r10d, byte [r8 + 0x15]
mov r11d, r9d
not r11d
xor r9, r10
and r11d, r10d
not r9
or r9, r11
not r9
or r9, r11
imul r9, rcx
movzx r10d, byte [r8 + 0x16]
xor r10, r9
imul r10, rcx
movzx ebx, byte [r8 + 0x17]
xor rbx, r10
imul rbx, rcx
and rbx, qword [rsi + 0x30]
mov r9, qword [r8]
mov r10, qword [rsi + 0x18]
lea r11, [rbx + rbx]
lea r14, [rbx + rbx]
inc r14
shl rbx, 4
mov r15, qword [r10 + rbx]
cmp r15, rdi
je 0x1403e90c0
mov rbx, qword [r10 + r14*8]
mov r12, qword [r8 + 0x10]
cmp r12, qword [rbx + 0x10]
jne 0x1403e9200
mov r11, qword [rbx]
cmp r11, r8
je 0x1403e90c4
mov rbx, qword [r8 + 8]
mov qword [rbx], r9
mov r15, qword [r9 + 8]
mov qword [r15], r11
mov r12, qword [r11 + 8]
mov qword [r12], r8
mov qword [r11 + 8], r15
mov qword [r9 + 8], rbx
mov qword [r8 + 8], r12
jmp 0x1403e90c4
cmp r15, rbx
je 0x1403e9238
mov rbx, qword [rbx + 8]
cmp r12, qword [rbx + 0x10]
jne 0x1403e9200
mov r10, qword [rbx]
mov r11, qword [r8 + 8]
mov qword [r11], r9
mov rbx, qword [r9 + 8]
mov qword [rbx], r10
mov r14, qword [r10 + 8]
mov qword [r14], r8
mov qword [r10 + 8], rbx
mov qword [r9 + 8], r11
mov qword [r8 + 8], r14
jmp 0x1403e90c8
mov r14, qword [r8 + 8]
mov qword [r14], r9
mov r15, qword [r9 + 8]
mov qword [r15], rbx
mov r12, qword [rbx + 8]
mov qword [r12], r8
mov qword [rbx + 8], r15
mov qword [r9 + 8], r14
mov qword [r8 + 8], r12
mov qword [r10 + r11*8], r8
jmp 0x1403e90c8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, dword [0x1405bc4c0]
add eax, ecx
add eax, 0xd1e2
cdqe
add rax, qword [0x1405bc4d8]
mov ecx, 1
xor edx, edx
mov r8d, 0x378c58f7
mov r9d, 0x11248ca5
call qword [case.0x14012b313.0]
mov rcx, rax
call fcn.140446544
int3