joyce8/EMBER2024-capa huggingface dataset:
Function at 0x20194100
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x2019413c
test edx, edx
je 0x201941a0
movzx eax, byte [0x205523ae]
cmp al, 0xf0
je 0x20194134
mov cl, 0xbd
nop dword [rax]
mov al, 0x4e
lock cmpxchg byte [0x205523ae], cl
je 0x201941fc
cmp al, 0xf0
jne 0x20194120
lea rax, [0x205523a0]
ret
test edx, edx
je 0x201941cc
movzx eax, byte [0x2055246d]
movzx ecx, byte [0x20552884]
mov edx, ecx
xor dl, 0x52
and cl, 0x52
add cl, cl
add cl, dl
add cl, 0x46
cmp al, cl
je 0x20194198
nop word cs:[rax + rax]
movzx ecx, byte [0x20552884]
lea eax, [rcx - 0x65]
mov edx, ecx
xor dl, 0xe8
and cl, 0x68
add cl, cl
add cl, dl
lock cmpxchg byte [0x2055246d], cl
je 0x20194261
cmp al, 0x5f
jne 0x20194170
lea rax, [0x20552460]
ret
movzx eax, byte [0x205523e3]
cmp al, 0x78
je 0x201941c4
mov cl, 0x5b
nop dword [rax]
mov al, 0x65
lock cmpxchg byte [0x205523e3], cl
je 0x201942af
cmp al, 0x78
jne 0x201941b0
lea rax, [0x205523c0]
ret
movzx eax, byte [0x20552392]
cmp al, 0x2f
je 0x201941f4
mov cl, 0xcd
nop dword [rax]
mov al, 0xa9
lock cmpxchg byte [0x20552392], cl
je 0x201942e8
cmp al, 0x2f
jne 0x201941e0
lea rax, [0x20552380]
ret
xor eax, eax
lea rcx, [0x205523a0]
lea rdx, [0x204725f0]
mov r8d, 0x32eb0329
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x20552880]
add r10d, r8d
cmp r9d, r10d
jge 0x20194251
inc rax
jmp 0x20194220
mov al, 0xf0
xchg byte [0x205523ae], al
lea rax, [0x205523a0]
ret
xor edx, edx
lea rax, [0x20552460]
lea rcx, [0x204726b0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x20194280
mov al, 0x5f
xchg byte [0x2055246d], al
lea rax, [0x20552460]
ret
xor eax, eax
lea rcx, [0x205523c0]
lea rdx, [0x20472610]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x201942d8
inc rax
jmp 0x201942c0
mov al, 0x78
xchg byte [0x205523e3], al
lea rax, [0x205523c0]
ret
xor eax, eax
lea rcx, [0x20552380]
lea rdx, [0x204725d0]
mov r8d, 0x32eb032d
nop
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x20552880]
add r10d, r8d
cmp r9d, r10d
jge 0x20194335
inc rax
jmp 0x20194300
mov al, 0x2f
xchg byte [0x20552392], al
lea rax, [0x20552380]
ret
Function at 0x201ac4a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
mov rax, qword [rcx]
mov r12, qword [rcx + 8]
sub r12, rax
mov r9, qword [0x205530d0]
lea ecx, [r9 - 6]
sar r12, cl
mov r14, rdx
mov rdi, rdx
sub rdi, rax
mov ecx, r9d
xor ecx, 0xfa
and r9d, 0x7a
lea ecx, [rcx + r9*2]
sar rdi, cl
inc r12
mov rcx, qword [rsi + 0x10]
sub rcx, rax
sar rcx, 3
mov r13, rcx
shr r13, 1
movabs rax, 0x1fffffffffffffff
mov rdx, rax
sub rdx, r13
add r13, rcx
cmp r13, r12
cmovbe r13, r12
cmp rcx, rdx
cmova r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x201ac6df
mov r15, r8
lea rcx, [r13*8]
cmp r13, 0x200
jb 0x201ac58d
movabs rax, 0x84f10f83f7bef8f3
add rax, qword [0x205530d0]
cmp r13, rax
jae 0x201ac6df
add rcx, 0x27
mov edx, 0xe7d9f685
mov r8d, 0xfc4339e7
mov r9d, 0x176c9676
call fcn.2008daf0
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x201ac5dd
mov eax, dword [0x205b3dd0]
mov edx, dword [0x205530d8]
neg edx
add edx, eax
inc edx
imul edx, eax
test dl, 1
je 0x201ac5bb
nop word [rax + rax]
mov eax, dword [0x205b3dd4]
cmp eax, 0x21
jge 0x201ac5b0
test r13, r13
je 0x201ac5db
mov edx, 0xe7d9f685
mov r8d, 0xfc4339e7
mov r9d, 0x176c9676
call fcn.2008daf0
mov rbx, rax
jmp 0x201ac5dd
xor ebx, ebx
lea rcx, [rbx + rdi*8]
mov rax, qword [r15]
mov qword [rbx + rdi*8], rax
mov r8, qword [rsi + 8]
cmp r8, r14
je 0x201ac618
mov rdi, rcx
lea r15, [rcx + 8]
mov rdx, qword [rsi]
mov r8, r14
sub r8, rdx
mov rcx, rbx
call fcn.2044f800
mov r8, qword [rsi + 8]
sub r8, r14
mov rcx, r15
mov rdx, r14
jmp 0x201ac624
mov rdi, rcx
mov rdx, qword [rsi]
sub r8, rdx
mov rcx, rbx
call fcn.2044f800
lea rax, [fcn.201ac4a0]
add eax, eax
add eax, 0x2f00
nop word [rax + rax]
mov ecx, dword [0x205530d8]
lea edx, [rcx - 0x22f307eb]
xor edx, eax
not edx
and edx, eax
add ecx, 0xdd0cf814
cmp edx, ecx
jne 0x201ac640
mov rcx, qword [rsi]
test rcx, rcx
je 0x201ac6b8
mov rdx, qword [rsi + 0x10]
sub rdx, rcx
movabs rax, 0x64f10f83f7bf08f6
add rax, qword [0x205530d0]
cmp rdx, rax
jbe 0x201ac6b3
mov rax, qword [rcx - 8]
add rcx, qword [0x205530d0]
sub rcx, rax
movabs r8, 0x64f10f83f7bef8ef
add r8, rcx
cmp r8, 0x20
jae 0x201ac6e4
mov rcx, rdx
xor rcx, 0x27
and edx, 0x27
lea rdx, [rcx + rdx*2]
mov rcx, rax
call fcn.2008bfb0
mov qword [rsi], rbx
lea rax, [rbx + r12*8]
mov qword [rsi + 8], rax
lea rax, [rbx + r13*8]
mov qword [rsi + 0x10], rax
mov rax, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.20067710
call fcn.20407a4c
int3
Function at 0x201ad7a0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x201ad7dc
test edx, edx
je 0x201ad80c
movzx eax, byte [0x205529a6]
cmp al, 0x6c
je 0x201ad7d4
mov cl, 0x3d
nop word [rax + rax]
mov al, 0xff
lock cmpxchg byte [0x205529a6], cl
je 0x201ad86c
cmp al, 0x6c
jne 0x201ad7c0
lea rax, [0x205529a0]
ret
test edx, edx
je 0x201ad83c
movzx eax, byte [0x20552aab]
cmp al, 0x29
je 0x201ad804
mov cl, 0xc6
nop dword [rax]
mov al, 0xf0
lock cmpxchg byte [0x20552aab], cl
je 0x201ad8d0
cmp al, 0x29
jne 0x201ad7f0
lea rax, [0x20552aa0]
ret
movzx eax, byte [0x20552abf]
cmp al, 0xc
je 0x201ad834
mov cl, 0x5f
nop dword [rax]
mov al, 0xb2
lock cmpxchg byte [0x20552abf], cl
je 0x201ad8f8
cmp al, 0xc
jne 0x201ad820
lea rax, [0x20552ab0]
ret
movzx eax, byte [0x205529f5]
cmp al, 0x81
je 0x201ad864
mov cl, 0xeb
nop dword [rax]
mov al, 0x5e
lock cmpxchg byte [0x205529f5], cl
je 0x201ad948
cmp al, 0x81
jne 0x201ad850
lea rax, [0x205529e0]
ret
xor eax, eax
lea rcx, [0x205529a0]
lea rdx, [0x20472840]
mov r9d, r8d
xor r9d, 0xdf5a1ef3
xor r8d, 0xdf5a1efc
nop dword [rax]
cdqe
movzx r10d, byte [rax + rdx]
mov r11d, r10d
xor r11b, r10b
not r11b
and r11b, byte [rax + rcx]
xor r11b, r10b
mov byte [rax + rcx], r11b
mov r10d, dword [0x205530d8]
add eax, r9d
add eax, r10d
add r10d, r8d
cmp eax, r10d
jl 0x201ad890
mov al, 0x6c
xchg byte [0x205529a6], al
lea rax, [0x205529a0]
ret
xor eax, eax
lea rcx, [0x20552aa0]
lea rdx, [0x20472930]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x201ad928
inc rax
jmp 0x201ad8e0
xor eax, eax
lea rcx, [0x20552ab0]
lea rdx, [0x20472940]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x201ad938
inc rax
jmp 0x201ad910
mov al, 0x29
xchg byte [0x20552aab], al
lea rax, [0x20552aa0]
ret
mov al, 0xc
xchg byte [0x20552abf], al
lea rax, [0x20552ab0]
ret
xor edx, edx
lea rax, [0x205529e0]
lea rcx, [0x20472880]
nop dword [rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
cmp edx, 0x15
jl 0x201ad960
xor r8b, 0x5b
add r8b, byte [0x205530dc]
xchg byte [0x205529f5], r8b
lea rax, [0x205529e0]
ret
Function at 0x201be210
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x201be24c
test edx, edx
je 0x201be28c
movzx eax, byte [0x205553f0]
cmp al, 0xd1
je 0x201be244
mov cl, 0xd7
nop word cs:[rax + rax]
mov al, 0x6b
lock cmpxchg byte [0x205553f0], cl
je 0x201be33c
cmp al, 0xd1
jne 0x201be230
lea rax, [0x205553e0]
ret
test edx, edx
je 0x201be30f
movzx eax, byte [0x20555453]
cmp al, 0x26
je 0x201be284
mov cl, 0x89
nop word cs:[rax + rax]
mov al, 0x70
lock cmpxchg byte [0x20555453], cl
je 0x201be378
cmp al, 0x26
jne 0x201be270
lea rax, [0x20555450]
ret
movzx eax, byte [0x205554a9]
nop word cs:[rax + rax]
cmp al, 0x16
je 0x201be307
movzx ecx, byte [0x205559a0]
lea eax, [rcx + 0x5b]
add cl, 0x8d
lock cmpxchg byte [0x205554a9], cl
jne 0x201be2a0
xor edx, edx
lea rax, [0x205554a0]
lea rcx, [0x204730c0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 9
jl 0x201be2d0
mov al, 0x16
xchg byte [0x205554a9], al
lea rax, [0x205554a0]
ret
movzx eax, byte [0x205554bd]
cmp al, 0x83
je 0x201be334
mov cl, 0xb7
nop dword [rax]
mov al, 0x54
lock cmpxchg byte [0x205554bd], cl
je 0x201be3b8
cmp al, 0x83
jne 0x201be320
lea rax, [0x205554b0]
ret
xor eax, eax
lea rcx, [0x205553e0]
lea rdx, [0x20473020]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x201be368
inc rax
jmp 0x201be350
mov al, 0xd1
xchg byte [0x205553f0], al
lea rax, [0x205553e0]
ret
xor eax, eax
lea rcx, [0x20555450]
lea rdx, [0x20473070]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x201be3a8
inc rax
jmp 0x201be390
mov al, 0x26
xchg byte [0x20555453], al
lea rax, [0x20555450]
ret
xor eax, eax
lea rcx, [0x205554b0]
lea rdx, [0x204730d0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x201be3e8
inc rax
jmp 0x201be3d0
mov al, 0x83
xchg byte [0x205554bd], al
lea rax, [0x205554b0]
ret
Function at 0x201c2a00
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x201c2aaf
mov eax, r8d
xor eax, 0xb5b9b81c
add eax, dword [0x20555f78]
cmp edx, eax
jne 0x201c2adc
movzx eax, byte [0x20555df0]
nop word [rax + rax]
cmp al, 8
je 0x201c2aa7
movzx ecx, byte [0x20555f88]
mov eax, r8d
xor al, 0x87
add al, cl
mov edx, r8d
xor dl, 0x10
add dl, cl
lock cmpxchg byte [0x20555df0], dl
jne 0x201c2a30
xor edx, edx
lea rax, [0x20555de0]
lea rcx, [0x20473370]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x201c2a70
mov al, 8
xchg byte [0x20555df0], al
lea rax, [0x20555de0]
ret
test edx, edx
je 0x201c2b08
movzx eax, byte [0x20555e33]
cmp al, 0xe2
je 0x201c2ad4
mov cl, 0x28
mov al, 0x93
lock cmpxchg byte [0x20555e33], cl
je 0x201c2b98
cmp al, 0xe2
jne 0x201c2ac0
lea rax, [0x20555e10]
ret
movzx eax, byte [0x20555d8c]
cmp al, 0x2a
je 0x201c2b00
mov cl, 0xec
nop dword [rax]
mov al, 0xe7
lock cmpxchg byte [0x20555d8c], cl
je 0x201c2b4c
cmp al, 0x2a
jne 0x201c2af0
lea rax, [0x20555d80]
ret
movzx eax, byte [0x20555e03]
xor r8b, 0xed
add r8b, byte [0x20555f88]
cmp al, r8b
je 0x201c2b44
mov cl, 0x1e
nop word cs:[rax + rax]
mov al, 0xb6
lock cmpxchg byte [0x20555e03], cl
je 0x201c2bd8
cmp al, 3
jne 0x201c2b30
lea rax, [0x20555e00]
ret
xor eax, eax
lea rcx, [0x20555d80]
lea rdx, [0x20473320]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x201c2b88
inc rax
jmp 0x201c2b60
mov al, 0x2a
xchg byte [0x20555d8c], al
lea rax, [0x20555d80]
ret
xor eax, eax
lea rcx, [0x20555e10]
lea rdx, [0x20473390]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x201c2bc8
inc rax
jmp 0x201c2bb0
mov al, 0xe2
xchg byte [0x20555e33], al
lea rax, [0x20555e10]
ret
xor edx, edx
lea rax, [0x20555e00]
lea rcx, [0x20473380]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 3
jl 0x201c2bf0
mov al, 3
xchg byte [0x20555e03], al
lea rax, [0x20555e00]
ret
Function at 0x201cbed0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x201cbf51
test edx, edx
je 0x201cbf8c
movzx eax, byte [0x20556c09]
mov ecx, r8d
xor cl, 0x58
add cl, byte [0x20557228]
cmp al, cl
je 0x201cbf49
nop dword [rax + rax]
movzx ecx, byte [0x20557228]
mov eax, r8d
xor al, 0xd2
add al, 0xe
mov edx, eax
xor dl, cl
and al, cl
add al, al
add al, dl
add al, 0xf2
mov edx, r8d
xor dl, 0x99
mov r9d, r8d
xor r9b, dl
xor r9b, 0x66
and r9b, cl
xor r9b, dl
and dl, cl
add dl, dl
add dl, r9b
lock cmpxchg byte [0x20556c09], dl
je 0x201cc010
cmp al, 0x73
jne 0x201cbf00
lea rax, [0x20556c00]
ret
test edx, edx
je 0x201cbfc8
movzx eax, byte [0x20556b62]
mov ecx, r8d
xor cl, 0x55
add cl, byte [0x20557228]
cmp al, cl
je 0x201cbf84
mov cl, 0x98
nop
mov al, 0x99
lock cmpxchg byte [0x20556b62], cl
je 0x201cc04f
cmp al, 0x6e
jne 0x201cbf70
lea rax, [0x20556b60]
ret
movzx eax, byte [0x20556baa]
cmp al, 0xea
je 0x201cbfc0
mov cl, 0xce
nop dword [rax]
mov al, 4
lock cmpxchg byte [0x20556baa], cl
je 0x201cc0b1
mov edx, r8d
xor dl, 0xd1
add dl, byte [0x20557228]
cmp al, dl
jne 0x201cbfa0
lea rax, [0x20556ba0]
ret
movzx eax, byte [0x20556b42]
mov ecx, r8d
xor cl, 7
add cl, byte [0x20557228]
cmp al, cl
je 0x201cc008
nop
movzx ecx, byte [0x20557228]
mov eax, r8d
xor al, 0xb4
add al, cl
mov edx, r8d
xor dl, 0xc6
add dl, cl
lock cmpxchg byte [0x20556b42], dl
je 0x201cc108
cmp al, 0x20
jne 0x201cbfe0
lea rax, [0x20556b30]
ret
xor edx, edx
lea rax, [0x20556c00]
lea rcx, [0x204736e0]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 9
jl 0x201cc020
mov al, 0x73
xchg byte [0x20556c09], al
lea rax, [0x20556c00]
ret
xor eax, eax
lea rcx, [0x20556b60]
lea rdx, [0x20473650]
xor r8d, 0xd641b24a
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
mov r9d, dword [0x2055722c]
add r9d, r8d
add eax, r9d
cmp eax, 2
jl 0x201cc070
mov al, 0x6e
xchg byte [0x20556b62], al
lea rax, [0x20556b60]
ret
xor eax, eax
lea rcx, [0x20556ba0]
lea rdx, [0x20473680]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 9
jg 0x201cc0f8
inc rax
jmp 0x201cc0d0
mov al, 0xea
xchg byte [0x20556baa], al
lea rax, [0x20556ba0]
ret
xor eax, eax
lea rcx, [0x20556b30]
lea rdx, [0x20473620]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x201cc148
inc rax
jmp 0x201cc120
mov al, 0x20
xchg byte [0x20556b42], al
lea rax, [0x20556b30]
ret
Function at 0x201cc180
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x201cc1c9
test edx, edx
je 0x201cc24e
movzx eax, byte [0x20556bff]
cmp al, 0xe4
je 0x201cc350
mov cl, 0xb8
nop word cs:[rax + rax]
mov al, 0xf
lock cmpxchg byte [0x20556bff], cl
je 0x201cc315
cmp al, 0xe4
jne 0x201cc1b0
jmp 0x201cc350
test edx, edx
je 0x201cc2ed
movzx eax, byte [0x20556ad2]
nop dword [rax + rax]
cmp al, 0x9b
je 0x201cc245
movzx ecx, byte [0x20557228]
mov eax, r8d
xor al, 0xa6
add al, cl
mov edx, r8d
xor dl, 0x3f
add dl, cl
lock cmpxchg byte [0x20556ad2], dl
jne 0x201cc1e0
xor eax, eax
lea rcx, [0x20556ad0]
lea rdx, [0x204735d0]
xor r8d, 0xebf33e58
nop dword [rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x2055722c]
add r9d, r8d
add eax, r9d
cmp eax, 2
jl 0x201cc220
mov al, 0x9b
xchg byte [0x20556ad2], al
lea rax, [0x20556ad0]
pop rsi
ret
movzx eax, byte [0x20556b9f]
nop word cs:[rax + rax]
cmp al, 0xf6
je 0x201cc2e4
movzx ecx, byte [0x20557228]
mov eax, r8d
xor al, 0x63
add al, cl
mov edx, r8d
xor dl, 0xfb
add dl, cl
lock cmpxchg byte [0x20556b9f], dl
jne 0x201cc260
xor r9d, r9d
lea rax, [0x20556b90]
lea rcx, [0x20473670]
mov edx, r8d
xor edx, 0xebf33e58
xor r8d, 0xebf33e4a
nop dword [rax]
movsxd r9, r9d
movzx r10d, byte [r9 + rcx]
add byte [r9 + rax], r10b
mov r10d, dword [0x2055722c]
lea r11d, [rdx + r10]
mov esi, r9d
xor esi, r11d
and r9d, r11d
lea r9d, [rsi + r9*2]
add r10d, r8d
cmp r9d, r10d
jl 0x201cc2b0
mov al, 0xf6
xchg byte [0x20556b9f], al
lea rax, [0x20556b90]
pop rsi
ret
movzx eax, byte [0x20556b80]
cmp al, 0xf6
je 0x201cc3a5
mov cl, 0xe1
nop
mov al, 0xa5
lock cmpxchg byte [0x20556b80], cl
je 0x201cc359
cmp al, 0xf6
jne 0x201cc300
jmp 0x201cc3a5
xor eax, eax
lea rcx, [0x20556bf0]
lea rdx, [0x204736d0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x201cc348
inc rax
jmp 0x201cc330
mov al, 0xe4
xchg byte [0x20556bff], al
lea rax, [0x20556bf0]
pop rsi
ret
xor eax, eax
lea rcx, [0x20556b70]
lea rdx, [0x20473660]
xor r8d, 0xebf33e58
cdqe
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
mov r9d, dword [0x2055722c]
add r9d, r8d
add eax, r9d
cmp eax, 0x10
jl 0x201cc370
mov al, 0xf6
xchg byte [0x20556b80], al
lea rax, [0x20556b70]
pop rsi
ret

Function at 0x201cc3e0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
call fcn.2040d084
nop
add rsp, 0x28
ret
Function at 0x201cc470
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov esi, dword [rsp + 0xc0]
mov eax, esi
xor eax, 0x26ea0373
add eax, dword [0x2055722c]
cmp ecx, eax
jne 0x201cc4f4
mov edi, r9d
test edx, edx
je 0x201cc535
movzx eax, byte [0x20556b52]
cmp al, 0x87
je 0x201cc617
xor edi, 0x58c36447
xor esi, 0x9875af8
lea rbx, [rsp + 0x30]
nop word cs:[rax + rax]
mov rcx, rbx
mov edx, edi
mov r8d, esi
call fcn.201cbe90
cmp byte [rsp + 0x31], 0
jne 0x201cc5dc
cmp byte [rsp + 0x30], 0x87
jne 0x201cc4d0
jmp 0x201cc617
movzx eax, byte [0x20556ac6]
movzx ecx, byte [0x20557228]
xor sil, 0xed
mov edx, esi
xor dl, cl
and sil, cl
add sil, sil
add sil, dl
cmp al, sil
je 0x201cc5d0
mov cl, 0xf6
nop
mov al, 0xc
lock cmpxchg byte [0x20556ac6], cl
je 0x201cc588
cmp al, 0xee
jne 0x201cc520
jmp 0x201cc5d0
movzx eax, byte [0x20556b25]
cmp al, 0xc5
je 0x201cc692
mov ebx, edi
xor ebx, 0xaf5a55e2
mov ebp, esi
xor ebp, 0xea30e7f9
lea r14, [rsp + 0x40]
lea r15, [rsp + 0x2f]
nop
mov rcx, r14
mov rdx, r15
mov r8d, ebx
mov r9d, ebp
call fcn.201cc6f0
cmp byte [rsp + 0x41], 0
jne 0x201cc620
cmp byte [rsp + 0x2f], 0xc5
jne 0x201cc560
jmp 0x201cc692
xor eax, eax
lea rcx, [0x20556ac0]
lea rdx, [0x204735c0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x201cc5c8
inc rax
jmp 0x201cc5a0
mov al, 0xee
xchg byte [0x20556ac6], al
lea rax, [0x20556ac0]
jmp 0x201cc699
xor edx, edx
lea rax, [0x20556b50]
lea rcx, [0x20473640]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 2
jl 0x201cc5f0
mov al, 0x87
xchg byte [0x20556b52], al
lea rax, [0x20556b50]
jmp 0x201cc699
xor ebx, ebx
mov ebp, edi
xor ebp, 0xb6997159
mov r14d, esi
xor r14d, 0x694ba95b
lea r15, [rsp + 0x50]
lea r12, [0x20473600]
lea r13, [0x20556b10]
nop word [rax + rax]
mov ecx, ebx
mov rdx, r15
mov r8d, ebp
mov r9d, r14d
call fcn.201cc6b0
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
add al, byte [rbx + r12]
mov byte [rbx + r13], al
lea eax, [rbx + 1]
cmp eax, 0x14
jg 0x201cc67d
inc rbx
jmp 0x201cc650
xor edi, 0x6a5c3a6
xor esi, 0xf2f27acd
mov ecx, edi
mov edx, esi
call fcn.201cc3b0
lea rax, [0x20556b10]
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x201cfb20
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
lea rdi, [rcx + 0x10]
mov rcx, rdi
call fcn.201d35b0
mov rax, qword [rsi]
mov rbx, qword [rax]
cmp rbx, rax
jne 0x201cfbdc
mov rcx, qword [rsi + 0xa8]
test rcx, rcx
je 0x201cfb81
lea rax, [rsi + 0x70]
cmp rcx, rax
setne dl
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x2010e313.0]
mov qword [rsi + 0xa8], 0
lea rcx, [rsi + 0x40]
call fcn.20100e90
mov rcx, rdi
call fcn.201d27a0
mov rax, qword [rsi]
mov r8, qword [rax + 8]
mov rcx, rsi
mov rdx, rsi
call fcn.201d1ab0
mov rcx, qword [rsi]
mov edx, 0x30
mov r8d, 0x6d683f52
mov r9d, 0x36b30e65
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
jmp fcn.2008bfb0
mov rax, rbx
nop dword [rax + rax]
mov rbx, rax
cmp rax, qword [rsi]
je 0x201cfb53
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x201cfbf6
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [case.0x2010e313.0]
mov rcx, qword [rbx + 0x10]
cmp byte [rcx + 0x19], 0
je 0x201cfc40
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x201cfbd0
nop word [rax + rax]
mov rcx, rbx
mov rbx, rax
cmp rcx, qword [rax + 0x10]
jne 0x201cfbc5
mov rax, qword [rbx + 8]
movzx ecx, byte [0x205587f8]
add cl, 0x11
cmp byte [rax + 0x19], cl
je 0x201cfc10
jmp 0x201cfbd0
mov rax, rcx
mov rcx, qword [rcx]
movzx edx, byte [0x205587f8]
mov r8d, edx
xor r8b, 0x11
and dl, 0x11
add dl, dl
add dl, r8b
cmp byte [rcx + 0x19], dl
je 0x201cfc40
jmp 0x201cfbd0