joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400af9a0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0x42321f39
add eax, dword [0x1404e52a8]
cmp ecx, eax
jne 0x1400af9ec
test edx, edx
je 0x1400afa2c
movzx eax, byte [0x1404e43f3]
cmp al, 0x98
je 0x1400af9e4
mov cl, 0x40
nop dword [rax + rax]
mov al, 0x1e
lock cmpxchg byte [0x1404e43f3], cl
je 0x1400afadc
cmp al, 0x98
jne 0x1400af9d0
lea rax, [0x1404e43e0]
ret
test edx, edx
je 0x1400afaaf
movzx eax, byte [0x1404e4424]
cmp al, 0x10
je 0x1400afa24
mov cl, 0x7b
nop word cs:[rax + rax]
mov al, 0x50
lock cmpxchg byte [0x1404e4424], cl
je 0x1400afb08
cmp al, 0x10
jne 0x1400afa10
lea rax, [0x1404e4410]
ret
movzx eax, byte [0x1404e4210]
nop word cs:[rax + rax]
cmp al, 0xe
je 0x1400afaa7
movzx ecx, byte [0x1404e52ac]
mov eax, r8d
xor al, 0x5f
add al, cl
mov edx, r8d
xor dl, 0xd3
add dl, cl
lock cmpxchg byte [0x1404e4210], dl
jne 0x1400afa40
xor edx, edx
lea rax, [0x1404e4200]
lea rcx, [0x140420620]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x1400afa80
mov al, 0xe
xchg byte [0x1404e4210], al
lea rax, [0x1404e4200]
ret
movzx eax, byte [0x1404e4289]
cmp al, 0x34
je 0x1400afad4
mov cl, 0xae
nop dword [rax]
mov al, 0xa
lock cmpxchg byte [0x1404e4289], cl
je 0x1400afb68
cmp al, 0x34
jne 0x1400afac0
lea rax, [0x1404e4280]
ret
xor eax, eax
lea rcx, [0x1404e43e0]
lea rdx, [0x1404207e0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x12
jg 0x1400afb48
inc rax
jmp 0x1400afaf0
xor eax, eax
lea rcx, [0x1404e4410]
lea rdx, [0x140420810]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x13
jg 0x1400afb58
inc rax
jmp 0x1400afb20
mov al, 0x98
xchg byte [0x1404e43f3], al
lea rax, [0x1404e43e0]
ret
mov al, 0x10
xchg byte [0x1404e4424], al
lea rax, [0x1404e4410]
ret
xor eax, eax
lea rcx, [0x1404e4280]
lea rdx, [0x140420690]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1400afb98
inc rax
jmp 0x1400afb80
mov al, 0x34
xchg byte [0x1404e4289], al
lea rax, [0x1404e4280]
ret
Function at 0x1400afcc0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1400afcfc
test edx, edx
je 0x1400afd2c
movzx eax, byte [0x1404e4186]
cmp al, 0x6e
je 0x1400afcf4
mov cl, 0xdf
nop word [rax + rax]
mov al, 0xce
lock cmpxchg byte [0x1404e4186], cl
je 0x1400afd8c
cmp al, 0x6e
jne 0x1400afce0
lea rax, [0x1404e4180]
ret
test edx, edx
je 0x1400afd5c
movzx eax, byte [0x1404e445d]
cmp al, 0x43
je 0x1400afd24
mov cl, 0x8a
nop dword [rax]
mov al, 0xae
lock cmpxchg byte [0x1404e445d], cl
je 0x1400afdd2
cmp al, 0x43
jne 0x1400afd10
lea rax, [0x1404e4450]
ret
movzx eax, byte [0x14055edc8]
cmp al, 0xcd
je 0x1400afd54
mov cl, 0x3c
nop dword [rax]
xor eax, eax
lock cmpxchg byte [0x14055edc8], cl
je 0x1400afe29
cmp al, 0xcd
jne 0x1400afd40
lea rax, [0x1404e43d0]
ret
movzx eax, byte [0x1404e437f]
cmp al, 0x96
je 0x1400afd84
mov cl, 0xbf
nop dword [rax]
mov al, 0x68
lock cmpxchg byte [0x1404e437f], cl
je 0x1400afe81
cmp al, 0x96
jne 0x1400afd70
lea rax, [0x1404e4370]
ret
xor eax, eax
lea rcx, [0x1404e4180]
lea rdx, [0x1404205a0]
nop dword [rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 5
jg 0x1400afdb8
inc rax
jmp 0x1400afda0
xor r8b, 0x57
add r8b, byte [0x1404e52ac]
xchg byte [0x1404e4186], r8b
lea rax, [0x1404e4180]
ret
xor edx, edx
lea rax, [0x1404e4450]
lea rcx, [0x140420850]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
cmp edx, 0xd
jl 0x1400afdf0
xor r8b, 0x7a
add r8b, byte [0x1404e52ac]
xchg byte [0x1404e445d], r8b
lea rax, [0x1404e4450]
ret
xor eax, eax
lea rcx, [0x1404e43d0]
lea rdx, [0x1404207d0]
xor r8d, 0xf676dbe0
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x1404e52a8]
add r10d, r8d
cmp r9d, r10d
jge 0x1400afe71
inc rax
jmp 0x1400afe40
mov al, 0xcd
xchg byte [0x14055edc8], al
lea rax, [0x1404e43d0]
ret
xor eax, eax
lea rcx, [0x1404e4370]
lea rdx, [0x140420770]
xor r8d, 0xf676dbe2
nop dword [rax + rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x1404e52a8]
add r10d, r8d
cmp r9d, r10d
jge 0x1400afed1
inc rax
jmp 0x1400afea0
mov al, 0x96
xchg byte [0x1404e437f], al
lea rax, [0x1404e4370]
ret
Function at 0x1400fe260
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400fe29c
test edx, edx
je 0x1400fe38a
movzx eax, byte [0x1404e8445]
cmp al, 0xa4
je 0x1400fe294
mov cl, 0x67
nop dword [rax]
mov al, 0x8e
lock cmpxchg byte [0x1404e8445], cl
je 0x1400fe3ec
cmp al, 0xa4
jne 0x1400fe280
lea rax, [0x1404e8440]
ret
test edx, edx
je 0x1400fe3b8
movzx eax, byte [0x1404e8328]
nop dword [rax + rax]
cmp al, 0xec
je 0x1400fe382
movzx ecx, byte [0x1404f3720]
mov eax, ecx
not al
mov edx, ecx
and dl, 0x45
mov r8d, eax
and r8b, 0xba
or r8b, dl
mov edx, ecx
xor dl, 0x3a
and al, 0x45
or al, dl
not al
add al, al
add al, r8b
add cl, 0x7a
lock cmpxchg byte [0x1404e8328], cl
jne 0x1400fe2b0
xor edx, edx
lea rax, [0x1404e8310]
lea rcx, [0x140422920]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
add r8b, 0xa
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
add r8b, 0xf6
mov byte [rdx + rax], r8b
mov r8d, dword [0x1404f3710]
mov r9d, r8d
xor r9d, 0x2ea84ce
not r8d
and r8d, 0x7d157b31
or r8d, r9d
not r8d
lea r8d, [r9 + r8*2]
mov r9d, edx
not r9d
mov r10d, r9d
and r10d, r8d
mov r11d, edx
xor edx, r8d
not r8d
and r11d, r8d
or r11d, r10d
and r8d, r9d
or r8d, edx
not r8d
lea edx, [r11 + r8*2]
cmp edx, 0x18
jl 0x1400fe300
mov al, 0xec
xchg byte [0x1404e8328], al
lea rax, [0x1404e8310]
ret
movzx eax, byte [0x1404e8419]
cmp al, 0x1a
je 0x1400fe3b0
mov cl, 0xa7
nop word [rax + rax]
mov al, 0x4a
lock cmpxchg byte [0x1404e8419], cl
je 0x1400fe428
cmp al, 0x1a
jne 0x1400fe3a0
lea rax, [0x1404e8410]
ret
movzx eax, byte [0x1404e8483]
cmp al, 0xbe
je 0x1400fe3e4
mov cl, 0x93
nop word cs:[rax + rax]
mov al, 0x7f
lock cmpxchg byte [0x1404e8483], cl
je 0x1400fe468
cmp al, 0xbe
jne 0x1400fe3d0
lea rax, [0x1404e8460]
ret
xor eax, eax
lea rcx, [0x1404e8440]
lea rdx, [0x140422a40]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x1400fe418
inc rax
jmp 0x1400fe400
mov al, 0xa4
xchg byte [0x1404e8445], al
lea rax, [0x1404e8440]
ret
xor eax, eax
lea rcx, [0x1404e8410]
lea rdx, [0x140422a10]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1400fe458
inc rax
jmp 0x1400fe440
mov al, 0x1a
xchg byte [0x1404e8419], al
lea rax, [0x1404e8410]
ret
xor eax, eax
lea rcx, [0x1404e8460]
lea rdx, [0x140422a60]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r8b
mov r10d, r9d
not r10b
mov r11d, r10d
xor r11b, r8b
xor r8b, r9b
not r8b
and r8b, r9b
and r11b, r10b
or r11b, r8b
mov byte [rax + rcx], r11b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1400fe4bb
inc rax
jmp 0x1400fe480
mov al, 0xbe
xchg byte [0x1404e8483], al
lea rax, [0x1404e8460]
ret
Function at 0x14010da90
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14010dacc
test edx, edx
je 0x14010db0c
movzx eax, byte [0x1404f54e3]
cmp al, 0xdc
je 0x14010dac4
mov cl, 0xa2
nop word cs:[rax + rax]
mov al, 0x50
lock cmpxchg byte [0x1404f54e3], cl
je 0x14010dbec
cmp al, 0xdc
jne 0x14010dab0
lea rax, [0x1404f54d0]
ret
test edx, edx
je 0x14010dbaa
movzx eax, byte [0x1404f552d]
cmp al, 0x67
je 0x14010db04
mov cl, 0xd4
nop word cs:[rax + rax]
mov al, 0x7f
lock cmpxchg byte [0x1404f552d], cl
je 0x14010dc38
cmp al, 0x67
jne 0x14010daf0
lea rax, [0x1404f5520]
ret
movzx eax, byte [0x1404f5542]
nop word cs:[rax + rax]
cmp al, 0xb
je 0x14010dba2
movzx ecx, byte [0x1404f5608]
lea eax, [rcx - 0x2f]
inc cl
lock cmpxchg byte [0x1404f5542], cl
jne 0x14010db20
xor edx, edx
lea rax, [0x1404f5530]
lea rcx, [0x140423250]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, dword [0x1404f55f8]
add edx, r8d
add edx, 0x3a8ab2b2
mov r9d, r8d
xor r9d, 0x3a8ab2c3
and r8d, 0x3a8ab2c3
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x14010db50
mov al, 0xb
xchg byte [0x1404f5542], al
lea rax, [0x1404f5530]
ret
movzx eax, byte [0x1404f54cd]
movzx ecx, byte [0x1404f5608]
add cl, 0xbd
cmp al, cl
je 0x14010dbe4
mov cl, 0x95
nop word cs:[rax + rax]
mov al, 0xd0
lock cmpxchg byte [0x1404f54cd], cl
je 0x14010dc81
cmp al, 0x6f
jne 0x14010dbd0
lea rax, [0x1404f54c0]
ret
xor eax, eax
lea rcx, [0x1404f54d0]
lea rdx, [0x140423200]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x12
jg 0x14010dc28
inc rax
jmp 0x14010dc00
mov al, 0xdc
xchg byte [0x1404f54e3], al
lea rax, [0x1404f54d0]
ret
xor eax, eax
lea rcx, [0x1404f5520]
lea rdx, [0x140423240]
mov r8d, 0x3a8ab2be
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1404f55f8]
add r10d, r8d
cmp r9d, r10d
jge 0x14010dc71
inc rax
jmp 0x14010dc50
mov al, 0x67
xchg byte [0x1404f552d], al
lea rax, [0x1404f5520]
ret
xor eax, eax
lea rcx, [0x1404f54c0]
lea rdx, [0x1404231f0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14010dcb8
inc rax
jmp 0x14010dca0
mov al, 0x6f
xchg byte [0x1404f54cd], al
lea rax, [0x1404f54c0]
ret
Function at 0x14010df10
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x14010df6d
test edx, edx
je 0x14010dfa9
movzx eax, byte [0x1404f5510]
mov ecx, r8d
xor cl, 0x23
add cl, byte [0x1404f5608]
cmp al, cl
je 0x14010e07c
nop dword [rax]
movzx ecx, byte [0x1404f5608]
mov eax, r8d
xor al, 0x94
add al, cl
mov edx, r8d
xor dl, 0xa7
add dl, cl
lock cmpxchg byte [0x1404f5510], dl
je 0x14010e019
cmp al, 0x40
jne 0x14010df40
jmp 0x14010e07c
test edx, edx
je 0x14010dfe9
movzx eax, byte [0x1404f54fd]
cmp al, 0xa1
je 0x14010e130
mov cl, 0x56
nop word cs:[rax + rax]
mov al, 0xa4
lock cmpxchg byte [0x1404f54fd], cl
je 0x14010e085
cmp al, 0xa1
jne 0x14010df90
jmp 0x14010e130
movzx eax, byte [0x1404f555d]
mov ecx, r8d
xor cl, 0x9e
add cl, byte [0x1404f5608]
cmp al, cl
je 0x14010e11f
mov cl, 0x12
nop word cs:[rax + rax]
mov al, 0xdf
lock cmpxchg byte [0x1404f555d], cl
je 0x14010e0cb
cmp al, 0xe5
jne 0x14010dfd0
jmp 0x14010e11f
movzx eax, byte [0x1404f5493]
cmp al, 0x95
je 0x14010e1a6
mov cl, 0x83
nop word [rax + rax]
mov al, 0x4f
lock cmpxchg byte [0x1404f5493], cl
je 0x14010e139
cmp al, 0x95
jne 0x14010e000
jmp 0x14010e1a6
xor eax, eax
lea rcx, [0x1404f5500]
lea rdx, [0x140423230]
mov r9d, r8d
xor r9d, 0x619dee1f
nop word cs:[rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
add byte [rax + rcx], r10b
mov r10d, dword [0x1404f55f8]
xor r10d, r9d
mov r11d, r10d
not r11d
and r11d, r9d
lea r10d, [r10 + r11*2]
add eax, r10d
cmp eax, 0x10
jl 0x14010e040
xor r8b, 0x23
add r8b, byte [0x1404f5608]
xchg byte [0x1404f5510], r8b
lea rax, [0x1404f5500]
pop rbx
ret
xor eax, eax
lea rcx, [0x1404f54f0]
lea rdx, [0x140423220]
xor r8d, 0x619dee13
nop dword [rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1404f55f8]
mov r11d, r8d
xor r11d, r10d
and r10d, r8d
lea r10d, [r11 + r10*2]
cmp r9d, r10d
jge 0x14010e128
inc rax
jmp 0x14010e0a0
xor eax, eax
lea rcx, [0x1404f5550]
lea rdx, [0x140423270]
mov r9d, r8d
xor r9d, 0x619dee1f
nop word cs:[rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
mov r10d, dword [0x1404f55f8]
add r10d, r9d
add eax, r10d
cmp eax, 0xd
jl 0x14010e0f0
xor r8b, 0x9e
add r8b, byte [0x1404f5608]
xchg byte [0x1404f555d], r8b
lea rax, [0x1404f5550]
pop rbx
ret
mov al, 0xa1
xchg byte [0x1404f54fd], al
lea rax, [0x1404f54f0]
pop rbx
ret
xor edx, edx
lea rax, [0x1404f5470]
lea rcx, [0x1404231a0]
xor r8d, 0x619dee1f
movsxd rdx, edx
movzx r9d, byte [rdx + rax]
movzx r10d, byte [rdx + rcx]
mov r11d, r9d
not r11b
not r10b
mov ebx, r11d
xor bl, r10b
and bl, r11b
xor r10b, r9b
not r10b
and r10b, r9b
or r10b, bl
mov byte [rdx + rax], r10b
mov r9d, dword [0x1404f55f8]
add r9d, r8d
xor r9d, edx
mov r10d, r9d
not r10d
and r10d, edx
lea edx, [r9 + r10*2]
cmp edx, 0x23
jl 0x14010e150
mov al, 0x95
xchg byte [0x1404f5493], al
lea rax, [0x1404f5470]
pop rbx
ret
Function at 0x140112e20
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r9, r8
mov rsi, rdx
mov rdi, rcx
mov r8, qword [rcx]
mov rdx, qword [r8 + 8]
xor ebp, ebp
cmp byte [rdx + 0x19], 0
je 0x140112e4e
mov rbx, rdx
mov rax, r8
cmp byte [rax + 0x19], 0
jne 0x140112eaf
jmp 0x140112ea7
mov ecx, dword [r9]
mov rax, r8
nop word cs:[rax + rax]
mov rbx, rdx
mov r10d, dword [rdx + 0x20]
cmp r10d, ecx
cmovae rax, rdx
lea rdx, [rdx + 0x10]
cmovae rdx, rbx
mov rdx, qword [rdx]
movzx r11d, byte [0x1404f612c]
mov ebp, r11d
xor bpl, 0x8a
and r11b, 0xa
add r11b, r11b
add r11b, bpl
cmp byte [rdx + 0x19], r11b
je 0x140112e60
xor ebp, ebp
cmp r10d, ecx
setae bpl
cmp byte [rax + 0x19], 0
jne 0x140112eaf
mov ecx, dword [r9]
cmp ecx, dword [rax + 0x20]
jae 0x140112efb
movabs rax, 0x147ae147ae147ae
cmp qword [rdi + 8], rax
je 0x140112eff
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.140112f10
mov r8, qword [rsp + 0x40]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], ebp
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140113070
mov cl, 1
mov qword [rsi], rax
mov byte [rsi + 8], cl
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
xor ecx, ecx
jmp 0x140112ee9
call fcn.1400ab3d0
int3
Function at 0x14011d5d0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14011d621
test edx, edx
je 0x14011d65c
movzx eax, byte [0x1404f6743]
cmp al, 0xd
je 0x14011d619
nop word [rax + rax]
movzx ecx, byte [0x1404f69b8]
lea eax, [rcx + 0x1f]
add cl, 0x7b
lock cmpxchg byte [0x1404f6743], cl
je 0x14011d6c6
movzx ecx, byte [0x1404f69b8]
add cl, 0xe6
cmp al, cl
jne 0x14011d5f0
lea rax, [0x1404f6740]
ret
test edx, edx
je 0x14011d68c
movzx eax, byte [0x1404f682f]
cmp al, 7
je 0x14011d654
mov cl, 0x77
nop word cs:[rax + rax]
mov al, 0x47
lock cmpxchg byte [0x1404f682f], cl
je 0x14011d711
cmp al, 7
jne 0x14011d640
lea rax, [0x1404f6820]
ret
movzx eax, byte [0x1404f6732]
cmp al, 0x63
je 0x14011d684
mov cl, 5
nop dword [rax]
mov al, 0x6f
lock cmpxchg byte [0x1404f6732], cl
je 0x14011d751
cmp al, 0x63
jne 0x14011d670
lea rax, [0x1404f6730]
ret
movzx eax, byte [0x1404f67b2]
cmp al, 0x8f
je 0x14011d6be
mov cl, 0x58
nop dword [rax]
mov al, 0x84
lock cmpxchg byte [0x1404f67b2], cl
je 0x14011d7af
movzx edx, byte [0x1404f69b8]
add dl, 0x68
cmp al, dl
jne 0x14011d6a0
lea rax, [0x1404f67a0]
ret
xor edx, edx
lea rax, [0x1404f6740]
lea rcx, [0x140423840]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1404f69bc]
add edx, r8d
add edx, 0x8de27085
cmp edx, 3
jl 0x14011d6e0
mov al, 0xd
xchg byte [0x1404f6743], al
lea rax, [0x1404f6740]
ret
xor eax, eax
lea rcx, [0x1404f6820]
lea rdx, [0x140423900]
mov r8d, 0x8de27093
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1404f69bc]
add r10d, r8d
cmp r9d, r10d
jge 0x14011d79f
inc rax
jmp 0x14011d730
xor edx, edx
lea rax, [0x1404f6730]
lea rcx, [0x140423830]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 2
jl 0x14011d770
mov al, 0x63
xchg byte [0x1404f6732], al
lea rax, [0x1404f6730]
ret
mov al, 7
xchg byte [0x1404f682f], al
lea rax, [0x1404f6820]
ret
xor edx, edx
lea rax, [0x1404f67a0]
lea rcx, [0x140423890]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1404f69bc]
add edx, r8d
add edx, 0x8de27085
cmp edx, 0x12
jl 0x14011d7c0
mov al, 0x8f
xchg byte [0x1404f67b2], al
lea rax, [0x1404f67a0]
ret
Function at 0x14011d950
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14011d996
test edx, edx
je 0x14011d9dc
movzx eax, byte [0x1404f689d]
cmp al, 0xcf
je 0x14011d98e
mov cl, 0x5f
nop dword [rax]
mov al, 0xd4
lock cmpxchg byte [0x1404f689d], cl
je 0x14011da3c
movzx edx, byte [0x1404f69b8]
add dl, 0xa8
cmp al, dl
jne 0x14011d970
lea rax, [0x1404f6890]
ret
xor eax, eax
sub eax, dword [0x1404f69bc]
mov ecx, eax
xor ecx, 0x721d8f7c
and eax, 0x721d8f7c
lea eax, [rcx + rax*2]
add edx, eax
jne 0x14011da08
movzx eax, byte [0x1404f6795]
cmp al, 0x42
je 0x14011d9d4
mov cl, 0x68
nop
mov al, 0xcb
lock cmpxchg byte [0x1404f6795], cl
je 0x14011dabf
cmp al, 0x42
jne 0x14011d9c0
lea rax, [0x1404f6780]
ret
movzx eax, byte [0x1404f67e2]
cmp al, 0xe8
je 0x14011da00
mov cl, 0x36
nop dword [rax]
mov al, 0xd8
lock cmpxchg byte [0x1404f67e2], cl
je 0x14011da78
cmp al, 0xe8
jne 0x14011d9f0
lea rax, [0x1404f67e0]
ret
movzx eax, byte [0x1404f68eb]
cmp al, 0xe0
je 0x14011da34
mov cl, 0x76
nop word cs:[rax + rax]
mov al, 7
lock cmpxchg byte [0x1404f68eb], cl
je 0x14011db01
cmp al, 0xe0
jne 0x14011da20
lea rax, [0x1404f68e0]
ret
xor eax, eax
lea rcx, [0x1404f6890]
lea rdx, [0x140423970]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14011da68
inc rax
jmp 0x14011da50
mov al, 0xcf
xchg byte [0x1404f689d], al
lea rax, [0x1404f6890]
ret
xor eax, eax
lea rcx, [0x1404f67e0]
lea rdx, [0x1404238d0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x14011daa8
inc rax
jmp 0x14011da90
movzx eax, byte [0x1404f69b8]
add al, 0xc1
xchg byte [0x1404f67e2], al
lea rax, [0x1404f67e0]
ret
xor edx, edx
lea rax, [0x1404f6780]
lea rcx, [0x140423870]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1404f69bc]
add edx, r8d
add edx, 0x8de27085
cmp edx, 0x15
jl 0x14011dad0
mov al, 0x42
xchg byte [0x1404f6795], al
lea rax, [0x1404f6780]
ret
xor eax, eax
lea rcx, [0x1404f68e0]
lea rdx, [0x1404239c0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x14011db38
inc rax
jmp 0x14011db20
mov al, pe_nt_image_headers64
xchg byte [0x1404f68eb], al
lea rax, [0x1404f68e0]
ret
Function at 0x14012d470
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa5c3331b
add eax, dword [0x1404f9474]
cmp ecx, eax
jne 0x14012d4bc
test edx, edx
je 0x14012d51c
movzx eax, byte [0x1404f7f20]
cmp al, 0x63
je 0x14012d4b4
mov cl, 0x15
nop word cs:[rax + rax]
mov al, 0x10
lock cmpxchg byte [0x1404f7f20], cl
je 0x14012d613
cmp al, 0x63
jne 0x14012d4a0
lea rax, [0x1404f7f10]
ret
test edx, edx
je 0x14012d5c1
movzx eax, byte [0x1404f7eb9]
nop dword [rax + rax]
cmp al, 0xdc
je 0x14012d650
movzx ecx, byte [0x1404f9470]
lea eax, [rcx - 0x73]
add cl, 0xa3
lock cmpxchg byte [0x1404f7eb9], cl
jne 0x14012d4d0
xor eax, eax
lea rcx, [0x1404f7eb0]
lea rdx, [0x140424890]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x14012d648
inc rax
jmp 0x14012d500
movzx eax, byte [0x1404f7ed6]
nop word cs:[rax + rax]
cmp al, 0x6e
je 0x14012d5b9
movzx ecx, byte [0x1404f9470]
lea eax, [rcx - 0x21]
add cl, 0x88
lock cmpxchg byte [0x1404f7ed6], cl
jne 0x14012d530
xor eax, eax
lea rcx, [0x1404f7ed0]
lea rdx, [0x1404248b0]
nop
cdqe
xor r8d, r8d
sub r8b, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
xor r10d, r10d
sub r10b, r9b
mov r9d, r8d
xor r9b, r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
neg r10b
mov byte [rax + rcx], r10b
mov r8d, dword [0x1404f9474]
mov r9d, r8d
xor r9d, 0x5a3ccce3
and r9d, r8d
xor r8d, 0xa5c3331c
lea r8d, [r8 + r9*2]
add eax, r8d
cmp eax, 6
jl 0x14012d560
mov al, 0x6e
xchg byte [0x1404f7ed6], al
lea rax, [0x1404f7ed0]
ret
movzx eax, byte [0x1404f8015]
movzx ecx, byte [0x1404f9470]
add cl, 0xc9
cmp al, cl
je 0x14012d60b
nop word cs:[rax + rax]
movzx ecx, byte [0x1404f9470]
mov edx, ecx
xor dl, 0x40
mov eax, ecx
not al
and al, 0x3f
or al, dl
not al
add al, al
add al, dl
add cl, 0xb7
lock cmpxchg byte [0x1404f8015], cl
je 0x14012d668
cmp al, 0x8d
jne 0x14012d5e0
lea rax, [0x1404f8000]
ret
xor eax, eax
lea rcx, [0x1404f7f10]
lea rdx, [0x1404248f0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x14012d658
inc rax
jmp 0x14012d630
mov al, 0xdc
xchg byte [0x1404f7eb9], al
lea rax, [0x1404f7eb0]
ret
mov al, 0x63
xchg byte [0x1404f7f20], al
lea rax, [0x1404f7f10]
ret
xor edx, edx
lea rax, [0x1404f8000]
lea rcx, [0x1404249d0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x14012d680
mov al, 0x8d
xchg byte [0x1404f8015], al
lea rax, [0x1404f8000]
ret
Function at 0x14012d6b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa5c3331b
mov r8d, dword [0x1404f9474]
add r8d, eax
cmp ecx, r8d
jne 0x14012d70c
test edx, edx
je 0x14012d7bc
movzx eax, byte [0x1404f7e56]
movzx ecx, byte [0x1404f9470]
mov edx, ecx
xor dl, 0x8a
and cl, 0xa
add cl, cl
add cl, dl
cmp al, cl
je 0x14012d704
mov cl, 0xc3
nop dword [rax]
mov al, 0x87
lock cmpxchg byte [0x1404f7e56], cl
je 0x14012d7f6
cmp al, 0x4e
jne 0x14012d6f0
lea rax, [0x1404f7e40]
ret
add eax, dword [0x1404f9474]
cmp edx, eax
jne 0x14012d74c
movzx eax, byte [0x1404f7da2]
cmp al, 0xb
je 0x14012d744
mov cl, 0x2a
nop word cs:[rax + rax]
mov al, 0x65
lock cmpxchg byte [0x1404f7da2], cl
je 0x14012d851
cmp al, 0xb
jne 0x14012d730
lea rax, [0x1404f7d90]
ret
movzx eax, byte [0x1404f7ffd]
nop word cs:[rax + rax]
cmp al, 0x42
je 0x14012d8b7
movzx ecx, byte [0x1404f9470]
lea eax, [rcx - 0x5f]
add cl, 0xeb
lock cmpxchg byte [0x1404f7ffd], cl
jne 0x14012d760
xor eax, eax
lea rcx, [0x1404f7ff0]
lea rdx, [0x1404249c0]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14012d8af
inc rax
jmp 0x14012d790
movzx eax, byte [0x1404f7d85]
cmp al, 0xab
je 0x14012d7ee
mov cl, 0x1c
nop dword [rax]
mov al, 0x3f
lock cmpxchg byte [0x1404f7d85], cl
je 0x14012d8bf
movzx edx, byte [0x1404f9470]
add dl, 0xe7
cmp al, dl
jne 0x14012d7d0
lea rax, [0x1404f7d70]
ret
xor edx, edx
lea rax, [0x1404f7e40]
lea rcx, [0x140424840]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x1404f9474]
add edx, r8d
add edx, 0xa5c3331c
cmp edx, 0x16
jl 0x14012d810
mov al, 0x4e
xchg byte [0x1404f7e56], al
lea rax, [0x1404f7e40]
ret
xor eax, eax
lea rcx, [0x1404f7d90]
lea rdx, [0x140424790]
nop word cs:[rax + rax]
cdqe
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
mov r8d, dword [0x1404f9474]
mov r9d, r8d
xor r9d, 0xa5c3331c
and r8d, 0x25c3331c
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0x12
jl 0x14012d870
mov al, 0xb
xchg byte [0x1404f7da2], al
lea rax, [0x1404f7d90]
ret
mov al, 0x42
xchg byte [0x1404f7ffd], al
lea rax, [0x1404f7ff0]
ret
xor eax, eax
lea rcx, [0x1404f7d70]
lea rdx, [0x140424770]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x14012d8e8
inc rax
jmp 0x14012d8d0
mov al, 0xab
xchg byte [0x1404f7d85], al
lea rax, [0x1404f7d70]
ret