joyce8/EMBER2024-capa huggingface dataset:
Function at 0x201d7b00
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rax, rdx
shr rax, 0x3c
jne 0x201d7b9e
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rcx]
mov rdx, qword [rcx + 0x10]
sub rdx, rax
sar rdx, 4
mov rcx, rdx
shr rcx, 1
movabs r8, 0xfffffffffffffff
mov r9, r8
sub r9, rcx
add rcx, rdx
cmp rcx, rdi
cmovbe rcx, rdi
cmp rdx, r9
cmova rcx, r8
mov rdx, rcx
shr rdx, 0x3c
jne 0x201d7dd2
mov rdx, qword [rsi + 8]
mov r8, qword [0x205b3dd8]
mov r9, r8
xor r9, rdx
and r8, rdx
lea rbx, [r9 + r8*2]
sub rbx, rax
sar rbx, 4
mov eax, dword [0x205b3fd0]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
jne 0x201d7be0
jmp 0x201d7ba3
call fcn.201d7e00
mov r12, rcx
shl r12, 4
mov r15, qword [0x205b3fd8]
add r15, r12
mov edx, dword [0x205b3fd0]
lea eax, [rdx - 1]
imul eax, edx
mov r8d, 0x8dcb3a50
add r8d, dword [0x205591a0]
xor edx, edx
div r8d
test edx, edx
je 0x201d7bfb
nop word cs:[rax + rax]
mov eax, dword [0x205591a0]
mov edx, eax
xor edx, 0x8dcb3a4e
and eax, 0xdcb3a4e
add eax, eax
add eax, edx
jne 0x201d7be0
jmp 0x201d7ba3
cmp rcx, 0x100
jb 0x201d7c5c
movabs rax, 0xffffffffffffffe
cmp rcx, rax
jae 0x201d7dd2
add r15, 0x27
mov rcx, r15
mov edx, 0xa31ed27a
mov r8d, 0x1d2ce382
call fcn.2008daf0
mov rcx, rax
xor rcx, 0x27
mov rdx, rax
not rdx
movabs r8, 0x7fffffffffffffd8
and r8, rdx
or r8, rcx
not r8
lea r14, [rcx + r8*2]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x201d7cce
test rcx, rcx
jne 0x201d7c9e
xor r14d, r14d
jmp 0x201d7cce
mov r8d, dword [0x205591a0]
lea edx, [r8 + 0x30ea0cc8]
add r8d, 0xaaf81dd0
mov rcx, r15
call fcn.2008daf0
mov eax, dword [0x205b3fd0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x201d7c70
mov rcx, r15
mov edx, 0xa31ed27a
mov r8d, 0x1d2ce382
call fcn.2008daf0
mov r14, rax
mov eax, dword [0x205b3fd0]
mov ecx, dword [0x205591a0]
neg ecx
add ecx, eax
inc ecx
imul ecx, eax
test cl, 1
jne 0x201d7c70
cmp rbx, rdi
je 0x201d7cee
mov r8, rdi
sub r8, rbx
shl rbx, 4
add rbx, r14
shl r8, 4
mov rcx, rbx
xor edx, edx
call fcn.2044feb0
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
sub r8, rdx
mov rcx, r14
call fcn.2044f800
mov rdx, qword [rsi]
test rdx, rdx
je 0x201d7dae
mov r9, qword [rsi + 0x10]
sub r9, rdx
mov rax, qword [0x205591a8]
movabs rcx, 0xc702a74d0cbe366c
xor rcx, rax
movabs r8, 0x38fd58b2f341c993
xor r8, rax
and r8, rax
lea rax, [rcx + r8*2]
cmp r9, rax
jbe 0x201d7d6c
mov rax, qword [rdx - 8]
add rdx, 0xfffffffffffffff8
sub rdx, rax
cmp rdx, 0x20
jae 0x201d7dd7
add r9, qword [0x205591a8]
movabs rcx, 0xc702a74d0cbe2694
add r9, rcx
mov rdx, rax
mov eax, dword [0x205591a0]
lea ecx, [rax - 0x7234c5b1]
lea r8d, [rax - 0x4e0a4b06]
mov r10d, r8d
xor r10d, 0xdbd58554
and r8d, 0x5bd58554
lea r8d, [r10 + r8*2]
lea r10d, [rax + 0x2f8a2529]
add eax, 0x79c39fe4
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r10d
call fcn.201d7e90
mov qword [rsi], r14
shl rdi, 4
add rdi, r14
mov qword [rsi + 8], rdi
add r12, r14
mov qword [rsi + 0x10], r12
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
call fcn.20067710
call fcn.20407a4c
int3
Function at 0x201d7ee0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x201d7f1c
test edx, edx
je 0x201d7f4c
movzx eax, byte [0x20558fa0]
cmp al, 0x25
je 0x201d7f14
mov cl, 0x79
nop word cs:[rax + rax]
mov al, 0xdc
lock cmpxchg byte [0x20558fa0], cl
je 0x201d7fcb
cmp al, 0x25
jne 0x201d7f00
lea rax, [0x20558f90]
ret
test edx, edx
je 0x201d7f7c
movzx eax, byte [0x20558fe3]
cmp al, 0xe7
je 0x201d7f44
mov cl, 0x64
nop dword [rax]
mov al, 0x7a
lock cmpxchg byte [0x20558fe3], cl
je 0x201d800f
cmp al, 0xe7
jne 0x201d7f30
lea rax, [0x20558fc0]
ret
movzx eax, byte [0x20559009]
cmp al, 0xd8
je 0x201d7f74
mov cl, 0xa6
nop dword [rax]
mov al, 0xd3
lock cmpxchg byte [0x20559009], cl
je 0x201d804f
cmp al, 0xd8
jne 0x201d7f60
lea rax, [0x20559000]
ret
mov ecx, dword [rsp + 0x28]
movzx eax, byte [0x20558fb3]
mov edx, ecx
xor dl, 0xe9
add dl, byte [0x205591b0]
cmp al, dl
je 0x201d7fc3
mov dl, 0xe9
nop dword [rax + rax]
mov al, 0x8e
lock cmpxchg byte [0x20558fb3], dl
je 0x201d8088
mov r8d, ecx
xor r8b, 0xe9
add r8b, byte [0x205591b0]
cmp al, r8b
jne 0x201d7fa0
lea rax, [0x20558fb0]
ret
xor edx, edx
lea rax, [0x20558f90]
lea rcx, [0x204740e0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x201d7fe0
mov al, 0x25
xchg byte [0x20558fa0], al
lea rax, [0x20558f90]
ret
xor edx, edx
lea rax, [0x20558fc0]
lea rcx, [0x20474100]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x23
jl 0x201d8020
mov al, 0xe7
xchg byte [0x20558fe3], al
lea rax, [0x20558fc0]
ret
xor eax, eax
lea rcx, [0x20559000]
lea rdx, [0x20474140]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x201d8078
inc rax
jmp 0x201d8060
mov al, 0xd8
xchg byte [0x20559009], al
lea rax, [0x20559000]
ret
xor eax, eax
lea rdx, [0x20558fb0]
lea r8, [0x204740f0]
xor ecx, 0xe9b96967
nop
cdqe
movzx r9d, byte [rax + r8]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rdx]
xor r10b, r9b
mov byte [rax + rdx], r10b
mov r9d, dword [0x205591a0]
add r9d, ecx
add eax, r9d
cmp eax, 3
jl 0x201d80a0
mov al, 0x6d
xchg byte [0x20558fb3], al
lea rax, [0x20558fb0]
ret
Function at 0x201dc640
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x6e99597f
add eax, dword [0x20559af0]
cmp ecx, eax
jne 0x201dc6fa
test edx, edx
je 0x201dc72c
movzx eax, byte [0x20559632]
nop word cs:[rax + rax]
cmp al, 0x4c
je 0x201dc6f2
movzx ecx, byte [0x20559b00]
lea eax, [rcx + 0x32]
add cl, 0xe6
lock cmpxchg byte [0x20559632], cl
jne 0x201dc670
xor r8d, r8d
lea rax, [0x20559630]
lea rcx, [0x20474440]
mov edx, 0x6e995981
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [r8 + rax]
xor r10b, r9b
mov byte [r8 + rax], r10b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x20559af0]
add r9d, edx
cmp r8d, r9d
jl 0x201dc6b0
mov al, 0x4c
xchg byte [0x20559632], al
lea rax, [0x20559630]
ret
test edx, edx
je 0x201dc75c
movzx eax, byte [0x20559780]
cmp al, 0xae
je 0x201dc724
mov cl, 0x90
nop dword [rax + rax]
mov al, 0xb4
lock cmpxchg byte [0x20559780], cl
je 0x201dc7a5
cmp al, 0xae
jne 0x201dc710
lea rax, [0x20559770]
ret
movzx eax, byte [0x20559799]
cmp al, 0xe5
je 0x201dc754
mov cl, 0x7a
nop dword [rax]
mov al, 0x33
lock cmpxchg byte [0x20559799], cl
je 0x201dc7e8
cmp al, 0xe5
jne 0x201dc740
lea rax, [0x20559790]
ret
movzx eax, byte [0x205597b6]
cmp al, 0xa6
je 0x201dc79d
mov cl, 0x74
nop dword [rax]
mov al, 0x5e
lock cmpxchg byte [0x205597b6], cl
je 0x201dc851
movzx edx, byte [0x20559b00]
mov r8d, edx
xor r8b, 0x9f
and dl, 0x1f
add dl, dl
add dl, r8b
add dl, 0x1e
cmp al, dl
jne 0x201dc770
lea rax, [0x205597b0]
ret
xor eax, eax
lea rcx, [0x20559770]
lea rdx, [0x20474560]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x201dc7d8
inc rax
jmp 0x201dc7c0
mov al, 0xae
xchg byte [0x20559780], al
lea rax, [0x20559770]
ret
xor edx, edx
lea rax, [0x20559790]
lea rcx, [0x20474570]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
mov r9d, r10d
xor r9b, r8b
and r8b, r10b
add r8b, r8b
add r8b, r9b
mov byte [rdx + rax], r8b
mov r8d, dword [0x20559af0]
add edx, r8d
add edx, 0x6e995980
cmp edx, 9
jl 0x201dc800
mov al, 0xe5
xchg byte [0x20559799], al
lea rax, [0x20559790]
ret
xor eax, eax
lea rcx, [0x205597b0]
lea rdx, [0x20474590]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x201dc89c
inc rax
jmp 0x201dc870
mov al, 0xa6
xchg byte [0x205597b6], al
lea rax, [0x205597b0]
ret
Function at 0x201ede80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, r8
mov rsi, rcx
mov rax, qword [rsp + 0x98]
mov r12, qword [rdx]
and r12, 0xfffffffffffffffe
je 0x201edec4
movzx eax, byte [rdi]
mov r15, qword [rdi]
movzx ecx, byte [0x2055b318]
add cl, 0xa3
shr r15, cl
test al, 1
jne 0x201edede
mov rbx, qword [rdi + 0x10]
jmp 0x201edee8
mov rbx, rdx
xor r14d, r14d
mov bpl, 1
xor r13d, r13d
test rax, rax
jne 0x201edf85
jmp 0x201edf88
lea rbx, [rdi + 1]
shr rax, 1
mov r15, rax
mov r13d, 1
xor r14d, r14d
nop word cs:[rax + rax]
movzx r8d, byte [r12 + 0x18]
test r8b, 1
jne 0x201edf20
mov r8, qword [r12 + 0x18]
shr r8, 1
mov rdx, qword [r12 + 0x28]
jmp 0x201edf28
lea rdx, [r12 + 0x19]
shr r8, 1
xor ebp, ebp
cmp r15, r8
setb bpl
cmovb r8, r15
mov dword [rsp + 0x20], 0xe8f23873
mov rcx, rbx
mov r9d, 0xa91d677e
call fcn.2008e3f0
xor ecx, ecx
test eax, eax
sets cl
cmovne ebp, ecx
test bpl, bpl
cmove r14, r12
mov eax, ebp
xor al, 1
movzx eax, al
mov rax, qword [r12 + rax*8 + 8]
test rax, rax
je 0x201edf75
inc r13
mov r12, rax
jmp 0x201edf00
mov rbx, r12
mov rax, qword [rsp + 0x98]
test rax, rax
je 0x201edf88
mov qword [rax], r13
test r14, r14
je 0x201edffc
movzx eax, byte [r14 + 0x18]
movzx r8d, byte [rdi]
test r8b, 1
jne 0x201edfb3
mov r8, qword [rdi]
shr r8, 1
mov rdi, qword [rdi + 0x10]
test al, 1
je 0x201edfbd
lea rcx, [r14 + 0x19]
shr rax, 1
jmp 0x201edfc8
inc rdi
shr r8, 1
test al, 1
jne 0x201edfaa
mov rax, qword [r14 + 0x18]
shr rax, 1
mov rcx, qword [r14 + 0x28]
xor r15d, r15d
cmp rax, r8
setb r15b
cmovb r8, rax
mov dword [rsp + 0x20], 0xe8f23873
mov rdx, rdi
mov r9d, 0xa91d677e
call fcn.2008e3f0
xor ecx, ecx
test eax, eax
sets cl
cmove ecx, r15d
cmp cl, 1
jne 0x201ee00f
mov rax, qword [rsp + 0x90]
mov byte [rax], bpl
mov qword [rax + 8], rbx
mov al, 1
jmp 0x201ee011
xor eax, eax
mov qword [rsi], r14
mov byte [rsi + 8], al
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x201f4d60
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x201f4dac
test edx, edx
je 0x201f4e1c
movzx eax, byte [0x2055afdd]
movzx ecx, byte [0x2055b324]
add cl, 0x11
cmp al, cl
je 0x201f4da4
mov cl, 0x96
nop word cs:[rax + rax]
mov al, 0x24
lock cmpxchg byte [0x2055afdd], cl
je 0x201f4e9c
cmp al, 0xf3
jne 0x201f4d90
lea rax, [0x2055afd0]
ret
test edx, edx
je 0x201f4e6d
movzx eax, byte [0x2055afcd]
nop dword [rax + rax]
cmp al, 0xa8
je 0x201f4ef9
movzx ecx, byte [0x2055b324]
mov edx, ecx
xor dl, 0x11
mov eax, ecx
and al, 0x11
add al, al
add al, dl
add al, 0x2d
add cl, 0xc9
lock cmpxchg byte [0x2055afcd], cl
jne 0x201f4dc0
xor eax, eax
lea rcx, [0x2055afc0]
lea rdx, [0x20475800]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x201f4ef1
inc rax
jmp 0x201f4e00
movzx eax, byte [0x2055ad7d]
cmp al, 0xed
je 0x201f4e65
nop word [rax + rax]
movzx ecx, byte [0x2055b324]
lea eax, [rcx + 0x11]
add cl, 0x88
lock cmpxchg byte [0x2055ad7d], cl
je 0x201f4f01
movzx ecx, byte [0x2055b324]
mov edx, ecx
xor dl, 0xee
and cl, 0x6e
add cl, cl
add cl, dl
add cl, 0x1d
cmp al, cl
jne 0x201f4e30
lea rax, [0x2055ad70]
ret
movzx eax, byte [0x2055afff]
cmp al, 0x54
je 0x201f4e94
mov cl, 0xc5
nop word [rax + rax]
mov al, 0xb3
lock cmpxchg byte [0x2055afff], cl
je 0x201f4f48
cmp al, 0x54
jne 0x201f4e80
lea rax, [0x2055aff0]
ret
xor edx, edx
lea rax, [0x2055afd0]
lea rcx, [0x20475810]
nop dword [rax]
movsxd r8, edx
movzx edx, byte [r8 + rcx]
mov r9d, edx
xor r9b, dl
not r9b
and r9b, byte [r8 + rax]
xor r9b, dl
mov byte [r8 + rax], r9b
lea edx, [r8 + r8]
sub edx, r8d
inc edx
cmp edx, 0xd
jl 0x201f4eb0
movzx eax, byte [0x2055b324]
add al, 0x11
xchg byte [0x2055afdd], al
lea rax, [0x2055afd0]
ret
mov al, 0xa8
xchg byte [0x2055afcd], al
lea rax, [0x2055afc0]
ret
xor eax, eax
lea rcx, [0x2055ad70]
lea rdx, [0x204755b0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x201f4f38
inc rax
jmp 0x201f4f20
mov al, 0xed
xchg byte [0x2055ad7d], al
lea rax, [0x2055ad70]
ret
xor eax, eax
lea rcx, [0x2055aff0]
lea rdx, [0x20475830]
mov r8d, 0xb8153173
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x2055b320]
add r10d, r8d
cmp r9d, r10d
jge 0x201f4f81
inc rax
jmp 0x201f4f60
mov al, 0x54
xchg byte [0x2055afff], al
lea rax, [0x2055aff0]
ret
Function at 0x201f4fa0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x201f4fdc
test edx, edx
je 0x201f502c
movzx eax, byte [0x2055a666]
cmp al, 7
je 0x201f4fd4
mov cl, 0x9b
nop dword [rax]
mov al, 0xfe
lock cmpxchg byte [0x2055a666], cl
je 0x201f50d1
cmp al, 7
jne 0x201f4fc0
lea rax, [0x2055a650]
ret
test edx, edx
je 0x201f5081
movzx eax, byte [0x2055ab14]
movzx ecx, byte [0x2055b324]
mov edx, ecx
xor dl, 0xe3
and cl, 0x63
add cl, cl
add cl, dl
cmp al, cl
je 0x201f5024
mov cl, 0x56
nop word cs:[rax + rax]
mov al, 0x5b
lock cmpxchg byte [0x2055ab14], cl
je 0x201f5118
cmp al, 0xc5
jne 0x201f5010
lea rax, [0x2055aaf0]
ret
movzx eax, byte [0x2055a712]
movzx ecx, byte [0x2055b324]
mov edx, ecx
xor dl, 0xcf
and cl, 0x4f
add cl, cl
add cl, dl
cmp al, cl
je 0x201f5079
nop word [rax + rax]
movzx ecx, byte [0x2055b324]
mov edx, ecx
xor dl, 0xf4
mov eax, ecx
and al, 0x74
add al, al
add al, dl
add cl, 0xe9
lock cmpxchg byte [0x2055a712], cl
je 0x201f5148
cmp al, 0xb1
jne 0x201f5050
lea rax, [0x2055a700]
ret
movzx eax, byte [0x2055ab9e]
movzx ecx, byte [0x2055b324]
add cl, 0x8f
cmp al, cl
je 0x201f50c9
nop word cs:[rax + rax]
movzx ecx, byte [0x2055b324]
mov edx, ecx
xor dl, 0xfe
mov eax, ecx
and al, 0x7e
add al, al
add al, dl
add cl, 0xbe
lock cmpxchg byte [0x2055ab9e], cl
je 0x201f51bb
cmp al, 0x71
jne 0x201f50a0
lea rax, [0x2055ab90]
ret
xor eax, eax
lea rcx, [0x2055a650]
lea rdx, [0x20474ed0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x15
jg 0x201f5108
inc rax
jmp 0x201f50f0
mov al, 7
xchg byte [0x2055a666], al
lea rax, [0x2055a650]
ret
xor eax, eax
lea rcx, [0x2055aaf0]
lea rdx, [0x20475340]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x23
jg 0x201f51ab
inc rax
jmp 0x201f5130
xor eax, eax
lea rcx, [0x2055a700]
lea rdx, [0x20474f70]
nop dword [rax + rax]
cdqe
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
mov r8d, dword [0x2055b320]
mov r9d, r8d
xor r9d, 0xb8153165
and r8d, 0x38153165
add r8d, r8d
mov r10d, r9d
xor r10d, r8d
and r8d, r9d
lea r8d, [r10 + r8*2]
add eax, r8d
cmp eax, 0x12
jl 0x201f5160
mov al, 0xb1
xchg byte [0x2055a712], al
lea rax, [0x2055a700]
ret
mov al, 0xc5
xchg byte [0x2055ab14], al
lea rax, [0x2055aaf0]
ret
xor eax, eax
lea rcx, [0x2055ab90]
lea rdx, [0x204753e0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x201f51e8
inc rax
jmp 0x201f51d0
mov al, 0x71
xchg byte [0x2055ab9e], al
lea rax, [0x2055ab90]
ret
Function at 0x201f5410
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x201f544c
test edx, edx
je 0x201f547c
movzx eax, byte [0x2055ade1]
movzx ecx, byte [0x2055b324]
add cl, 0x4d
cmp al, cl
je 0x201f5444
mov cl, 0x29
nop
mov al, 0xe9
lock cmpxchg byte [0x2055ade1], cl
je 0x201f54e6
cmp al, 0x2f
jne 0x201f5430
lea rax, [0x2055add0]
ret
test edx, edx
je 0x201f54ac
movzx eax, byte [0x2055ac44]
cmp al, 0x21
je 0x201f5474
mov cl, 0xa0
nop dword [rax]
mov al, 0x88
lock cmpxchg byte [0x2055ac44], cl
je 0x201f5531
cmp al, 0x21
jne 0x201f5460
lea rax, [0x2055ac30]
ret
movzx eax, byte [0x2055adbc]
cmp al, 0xc7
je 0x201f54a4
mov cl, 0x23
nop dword [rax]
mov al, 0xad
lock cmpxchg byte [0x2055adbc], cl
je 0x201f557f
cmp al, 0xc7
jne 0x201f5490
lea rax, [0x2055adb0]
ret
movzx eax, byte [0x2055aebd]
cmp al, 0x81
je 0x201f54de
mov cl, 0xe3
nop dword [rax]
mov al, 0x21
lock cmpxchg byte [0x2055aebd], cl
je 0x201f55c8
movzx edx, byte [0x2055b324]
add dl, 0x9f
cmp al, dl
jne 0x201f54c0
lea rax, [0x2055aeb0]
ret
xor edx, edx
lea rax, [0x2055add0]
lea rcx, [0x20475610]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x2055b320]
add edx, r8d
add edx, 0xb8153165
cmp edx, 0x11
jl 0x201f5500
mov al, 0x2f
xchg byte [0x2055ade1], al
lea rax, [0x2055add0]
ret
xor edx, edx
lea rax, [0x2055ac30]
lea rcx, [0x20475480]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x14
jl 0x201f5550
mov al, 0x21
xchg byte [0x2055ac44], al
lea rax, [0x2055ac30]
ret
xor eax, eax
lea rcx, [0x2055adb0]
lea rdx, [0x204755f0]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x201f55b8
inc rax
jmp 0x201f5590
mov al, 0xc7
xchg byte [0x2055adbc], al
lea rax, [0x2055adb0]
ret
xor edx, edx
lea rax, [0x2055aeb0]
lea rcx, [0x204756f0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x201f55e0
mov al, 0x81
xchg byte [0x2055aebd], al
lea rax, [0x2055aeb0]
ret
Function at 0x201f5690
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xb8153164
add eax, dword [0x2055b320]
cmp ecx, eax
jne 0x201f56cc
test edx, edx
je 0x201f56fc
movzx eax, byte [0x2055aead]
cmp al, 0x9d
je 0x201f56c4
mov cl, 0x71
mov al, 0x54
lock cmpxchg byte [0x2055aead], cl
je 0x201f578c
cmp al, 0x9d
jne 0x201f56b0
lea rax, [0x2055aea0]
ret
test edx, edx
je 0x201f572c
movzx eax, byte [0x2055b01a]
cmp al, 0xc3
je 0x201f56f4
mov cl, 0xd4
nop dword [rax]
mov al, 0x52
lock cmpxchg byte [0x2055b01a], cl
je 0x201f57cf
cmp al, 0xc3
jne 0x201f56e0
lea rax, [0x2055b010]
ret
movzx eax, byte [0x2055ae88]
cmp al, 0xf7
je 0x201f5724
mov cl, 0xa6
nop dword [rax]
mov al, 0x33
lock cmpxchg byte [0x2055ae88], cl
je 0x201f5818
cmp al, 0xf7
jne 0x201f5710
lea rax, [0x2055ae70]
ret
movzx eax, byte [0x2055aedd]
nop word cs:[rax + rax]
cmp al, 0x8d
je 0x201f5860
movzx ecx, byte [0x2055b324]
lea eax, [rcx + 0x6e]
add cl, 0xc7
lock cmpxchg byte [0x2055aedd], cl
jne 0x201f5740
xor eax, eax
lea rcx, [0x2055aed0]
lea rdx, [0x20475710]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x201f5858
inc rax
jmp 0x201f5770
xor edx, edx
lea rax, [0x2055aea0]
lea rcx, [0x204756e0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x201f57a0
mov al, 0x9d
xchg byte [0x2055aead], al
lea rax, [0x2055aea0]
ret
xor eax, eax
lea rcx, [0x2055b010]
lea rdx, [0x20475850]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 9
jg 0x201f5808
inc rax
jmp 0x201f57e0
mov al, 0xc3
xchg byte [0x2055b01a], al
lea rax, [0x2055b010]
ret
xor eax, eax
lea rcx, [0x2055ae70]
lea rdx, [0x204756b0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x17
jg 0x201f5868
inc rax
jmp 0x201f5830
mov al, 0x8d
xchg byte [0x2055aedd], al
lea rax, [0x2055aed0]
ret
mov al, 0xf7
xchg byte [0x2055ae88], al
lea rax, [0x2055ae70]
ret
Function at 0x201f5890
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x201f58cc
test edx, edx
je 0x201f592a
movzx eax, byte [0x2055a824]
cmp al, 0x15
je 0x201f58c4
mov cl, 0x1b
nop dword [rax]
mov al, 0xea
lock cmpxchg byte [0x2055a824], cl
je 0x201f59a6
cmp al, 0x15
jne 0x201f58b0
lea rax, [0x2055a810]
ret
mov eax, 0xb8153164
add eax, dword [0x2055b320]
cmp edx, eax
jne 0x201f595c
movzx eax, byte [0x2055a905]
cmp al, 0x5c
je 0x201f5922
nop word [rax + rax]
movzx ecx, byte [0x2055b324]
lea eax, [rcx + 0x70]
mov edx, ecx
xor dl, 2
and cl, 2
add cl, cl
add cl, dl
lock cmpxchg byte [0x2055a905], cl
je 0x201f5a48
movzx ecx, byte [0x2055b324]
add cl, 0x7a
cmp al, cl
jne 0x201f58f0
lea rax, [0x2055a8f0]
ret
movzx eax, byte [0x2055ab6f]
cmp al, 0xea
je 0x201f5954
mov cl, 0xfc
nop word [rax + rax]
mov al, 0x6c
lock cmpxchg byte [0x2055ab6f], cl
je 0x201f59e8
cmp al, 0xea
jne 0x201f5940
lea rax, [0x2055ab60]
ret
movzx eax, byte [0x2055abfd]
movzx ecx, byte [0x2055b324]
add cl, 0x2c
cmp al, cl
je 0x201f599e
mov cl, 0x81
nop word cs:[rax + rax]
mov al, 0xbf
lock cmpxchg byte [0x2055abfd], cl
je 0x201f5a91
movzx edx, byte [0x2055b324]
add dl, 0x2c
cmp al, dl
jne 0x201f5980
lea rax, [0x2055abf0]
ret
xor eax, eax
lea rcx, [0x2055a810]
lea rdx, [0x20475070]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x13
jg 0x201f59d8
inc rax
jmp 0x201f59c0
mov al, 0x15
xchg byte [0x2055a824], al
lea rax, [0x2055a810]
ret
xor edx, edx
lea rax, [0x2055ab60]
lea rcx, [0x204753b0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x2055b320]
add edx, r8d
add edx, 0xb8153165
cmp edx, 0xf
jl 0x201f5a00
movzx eax, byte [0x2055b324]
add al, 8
xchg byte [0x2055ab6f], al
lea rax, [0x2055ab60]
ret
xor eax, eax
lea rcx, [0x2055a8f0]
lea rdx, [0x20475150]
mov r8d, 0xb8153179
nop
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x2055b320]
add r10d, r8d
cmp r9d, r10d
jge 0x201f5ae3
inc rax
jmp 0x201f5a60
xor eax, eax
lea rcx, [0x2055abf0]
lea rdx, [0x20475440]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
mov r9d, dword [0x2055b320]
mov r10d, r9d
xor r10d, 0xb8153171
and r9d, 0x38153171
lea r9d, [r10 + r9*2]
cmp r8d, r9d
jge 0x201f5af3
inc rax
jmp 0x201f5ab0
mov al, 0x5c
xchg byte [0x2055a905], al
lea rax, [0x2055a8f0]
ret
mov al, 0xe
xchg byte [0x2055abfd], al
lea rax, [0x2055abf0]
ret