joyce8/EMBER2024-capa huggingface dataset:
Function at 0x201f6100
Capabilities:
Encode data using xor

Disassembly:
push rbx
test ecx, ecx
je 0x201f6164
mov eax, 0xb8153164
add eax, dword [0x2055b320]
cmp edx, eax
jne 0x201f6199
movzx eax, byte [0x2055ab23]
cmp al, 0x61
je 0x201f6251
nop word [rax + rax]
movzx ecx, byte [0x2055b324]
lea eax, [rcx - 0x24]
add cl, 0xd5
lock cmpxchg byte [0x2055ab23], cl
je 0x201f61f9
movzx ecx, byte [0x2055b324]
mov edx, ecx
xor dl, 0x7f
add cl, cl
add cl, dl
cmp al, cl
jne 0x201f6130
jmp 0x201f6251
test edx, edx
je 0x201f61c9
movzx eax, byte [0x2055ae0f]
cmp al, 0xaf
je 0x201f6354
mov cl, 0xc8
nop dword [rax]
mov al, 0xe5
lock cmpxchg byte [0x2055ae0f], cl
je 0x201f62f4
cmp al, 0xaf
jne 0x201f6180
jmp 0x201f6354
movzx eax, byte [0x2055aab0]
cmp al, 0x82
je 0x201f62eb
mov cl, 0xc4
nop word [rax + rax]
mov al, 0xa5
lock cmpxchg byte [0x2055aab0], cl
je 0x201f625a
cmp al, 0x82
jne 0x201f61b0
jmp 0x201f62eb
movzx eax, byte [0x2055afed]
cmp al, 0xe9
je 0x201f63a0
mov cl, 0xea
nop word [rax + rax]
mov al, 0x4d
lock cmpxchg byte [0x2055afed], cl
je 0x201f635d
cmp al, 0xe9
jne 0x201f61e0
jmp 0x201f63a0
xor r8d, r8d
lea rax, [0x2055ab20]
lea rcx, [0x20475370]
mov edx, 0xb8153165
nop
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [r8 + rax]
xor r10b, r9b
mov byte [r8 + rax], r10b
mov r9d, dword [0x2055b320]
add r9d, edx
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r8d, [r10 + r9*2]
cmp r8d, 3
jl 0x201f6210
mov al, 0x61
xchg byte [0x2055ab23], al
lea rax, [0x2055ab20]
pop rbx
ret
xor edx, edx
lea rax, [0x2055aaa0]
lea rcx, [0x20475300]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r9d
not r10b
mov r11d, r8d
xor r11b, r10b
and r10b, r8b
not r8b
mov ebx, r8d
and bl, r9b
xor r8b, r9b
or r10b, r8b
not r10b
or r10b, r11b
not r10b
or r10b, bl
mov byte [rdx + rax], r10b
add edx, 0x5cb163fb
mov r8d, edx
xor r8d, 0xb0abdfa8
and edx, 0x30abdfa8
lea edx, [r8 + rdx*2]
inc edx
mov r8d, edx
xor r8d, 0xd5d43a2
and r8d, edx
xor edx, 0xf2a2bc5d
lea edx, [rdx + r8*2]
cmp edx, 0x10
jl 0x201f6270
mov al, 0x82
xchg byte [0x2055aab0], al
lea rax, [0x2055aaa0]
pop rbx
ret
xor edx, edx
lea rax, [0x2055ae00]
lea rcx, [0x20475640]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, r8b
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x201f6310
mov al, 0xaf
xchg byte [0x2055ae0f], al
lea rax, [0x2055ae00]
pop rbx
ret
xor edx, edx
lea rax, [0x2055afe0]
lea rcx, [0x20475820]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x2055b320]
add edx, r8d
add edx, 0xb8153165
add r8d, 0xb8153171
cmp edx, r8d
jl 0x201f6370
mov al, 0xe9
xchg byte [0x2055afed], al
lea rax, [0x2055afe0]
pop rbx
ret
Function at 0x201f6410
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x201f644c
test edx, edx
je 0x201f64ac
movzx eax, byte [0x2055af8d]
cmp al, 0xe9
je 0x201f6444
mov cl, 0x63
nop dword [rax]
mov al, 0x19
lock cmpxchg byte [0x2055af8d], cl
je 0x201f650c
cmp al, 0xe9
jne 0x201f6430
lea rax, [0x2055af80]
ret
test edx, edx
je 0x201f64dc
movzx eax, byte [0x2055b19d]
nop dword [rax + rax]
cmp al, 0xf0
je 0x201f6567
movzx ecx, byte [0x2055b324]
lea eax, [rcx - 0x57]
add cl, 0xe0
lock cmpxchg byte [0x2055b19d], cl
jne 0x201f6460
xor eax, eax
lea rcx, [0x2055b190]
lea rdx, [0x204759a0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x201f655f
inc rax
jmp 0x201f6490
movzx eax, byte [0x2055aca2]
cmp al, 0x46
je 0x201f64d4
mov cl, 0x67
nop dword [rax]
mov al, 0xd
lock cmpxchg byte [0x2055aca2], cl
je 0x201f656f
cmp al, 0x46
jne 0x201f64c0
lea rax, [0x2055ac90]
ret
movzx eax, byte [0x205b4188]
cmp al, 0x31
je 0x201f6504
mov cl, 0xa2
nop dword [rax]
xor eax, eax
lock cmpxchg byte [0x205b4188], cl
je 0x201f65b8
cmp al, 0x31
jne 0x201f64f0
lea rax, [0x2055ae20]
ret
xor eax, eax
lea rcx, [0x2055af80]
lea rdx, [0x204757c0]
nop dword [rax]
cdqe
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
mov r8d, dword [0x2055b320]
mov r9d, r8d
xor r9d, 0xb8153165
and r8d, 0x38153165
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0xd
jl 0x201f6520
mov al, 0xe9
xchg byte [0x2055af8d], al
lea rax, [0x2055af80]
ret
mov al, 0xf0
xchg byte [0x2055b19d], al
lea rax, [0x2055b190]
ret
xor eax, eax
lea rcx, [0x2055ac90]
lea rdx, [0x204754d0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x201f6598
inc rax
jmp 0x201f6580
movzx eax, byte [0x2055b324]
mov ecx, eax
xor cl, 0x64
and al, 0x64
add al, al
add al, cl
xchg byte [0x2055aca2], al
lea rax, [0x2055ac90]
ret
xor eax, eax
lea rcx, [0x2055ae20]
lea rdx, [0x20475660]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x201f65e8
inc rax
jmp 0x201f65d0
mov al, 0x31
xchg byte [0x205b4188], al
lea rax, [0x2055ae20]
ret
Function at 0x201f6600
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x201f663c
test edx, edx
je 0x201f66bc
movzx eax, byte [0x2055a9b3]
cmp al, 0x6a
je 0x201f6634
mov cl, 0xef
nop
mov al, 0xb5
lock cmpxchg byte [0x2055a9b3], cl
je 0x201f672c
cmp al, 0x6a
jne 0x201f6620
lea rax, [0x2055a990]
ret
test edx, edx
je 0x201f66fc
movzx eax, byte [0x2055abc1]
nop dword [rax + rax]
cmp al, 0x19
je 0x201f678a
movzx ecx, byte [0x2055b324]
mov edx, r8d
xor dl, 0x72
mov eax, r8d
not al
and al, r8b
xor al, dl
add al, cl
mov edx, r8d
xor dl, 0x7d
add dl, cl
lock cmpxchg byte [0x2055abc1], dl
jne 0x201f6650
xor eax, eax
lea rcx, [0x2055abb0]
lea rdx, [0x20475400]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x201f6782
inc rax
jmp 0x201f66a0
movzx eax, byte [0x2055ac70]
xor r8b, 0x2c
add r8b, byte [0x2055b324]
cmp al, r8b
je 0x201f66f4
mov cl, 0x49
nop word cs:[rax + rax]
mov al, 0x47
lock cmpxchg byte [0x2055ac70], cl
je 0x201f6792
cmp al, 0xff
jne 0x201f66e0
lea rax, [0x2055ac60]
ret
movzx eax, byte [0x2055ac2d]
cmp al, 0x46
je 0x201f6724
mov cl, 0x42
nop dword [rax]
mov al, 0x2d
lock cmpxchg byte [0x2055ac2d], cl
je 0x201f67eb
cmp al, 0x46
jne 0x201f6710
lea rax, [0x2055ac20]
ret
xor eax, eax
lea rcx, [0x2055a990]
lea rdx, [0x204751f0]
nop dword [rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
cmp r9d, 0x22
jg 0x201f6768
inc rax
jmp 0x201f6740
xor r8b, 0xb9
add r8b, byte [0x2055b324]
xchg byte [0x2055a9b3], r8b
lea rax, [0x2055a990]
ret
mov al, 0x19
xchg byte [0x2055abc1], al
lea rax, [0x2055abb0]
ret
xor edx, edx
lea rax, [0x2055ac60]
lea rcx, [0x204754b0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
add edx, 0xc64a51c9
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x39b5ae37
cmp edx, 0x10
jl 0x201f67b0
mov al, 0xff
xchg byte [0x2055ac70], al
lea rax, [0x2055ac60]
ret
xor eax, eax
lea rcx, [0x2055ac20]
lea rdx, [0x20475470]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x201f6818
inc rax
jmp 0x201f6800
mov al, 0x46
xchg byte [0x2055ac2d], al
lea rax, [0x2055ac20]
ret
Function at 0x201f6830
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0xd390f3fe
add eax, dword [0x2055b320]
cmp ecx, eax
jne 0x201f687c
test edx, edx
je 0x201f68ac
movzx eax, byte [0x2055ad91]
cmp al, 0xd4
je 0x201f6874
mov cl, 0x2d
nop dword [rax + rax]
mov al, 0x5f
lock cmpxchg byte [0x2055ad91], cl
je 0x201f693f
cmp al, 0xd4
jne 0x201f6860
lea rax, [0x2055ad80]
ret
test edx, edx
je 0x201f68dc
movzx eax, byte [0x2055aa26]
cmp al, 0x43
je 0x201f68a4
mov cl, 0xe3
nop dword [rax]
mov al, 0x68
lock cmpxchg byte [0x2055aa26], cl
je 0x201f698a
cmp al, 0x43
jne 0x201f6890
lea rax, [0x2055a9d0]
ret
movzx eax, byte [0x2055a9c7]
cmp al, 0xce
je 0x201f68d4
mov cl, 4
nop dword [rax]
mov al, 0x52
lock cmpxchg byte [0x2055a9c7], cl
je 0x201f69e5
cmp al, 0xce
jne 0x201f68c0
lea rax, [0x2055a9c0]
ret
movzx eax, byte [0x2055aaed]
cmp al, 0xf1
je 0x201f6937
mov cl, 0x60
nop dword [rax]
mov al, 0x4d
lock cmpxchg byte [0x2055aaed], cl
je 0x201f6a2f
movzx edx, byte [0x2055b324]
mov r9d, r8d
xor r9b, 0x95
mov r10d, edx
xor r10b, dl
not r10b
and r10b, r9b
xor r10b, dl
and r9b, dl
add r9b, r9b
mov edx, r10d
xor dl, r9b
and r9b, r10b
add r9b, r9b
add r9b, dl
cmp al, r9b
jne 0x201f68f0
lea rax, [0x2055aac0]
ret
xor edx, edx
lea rax, [0x2055ad80]
lea rcx, [0x204755c0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
add edx, edx
and edx, 2
mov r9d, r8d
xor r9d, edx
and edx, r8d
lea edx, [r9 + rdx*2]
cmp edx, 0x11
jl 0x201f6950
mov al, 0xd4
xchg byte [0x2055ad91], al
lea rax, [0x2055ad80]
ret
xor eax, eax
lea rcx, [0x2055a9d0]
lea rdx, [0x20475230]
nop word [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
not r9b
mov r11d, r10d
xor r11b, r9b
and r11b, r10b
and r9b, r8b
or r9b, r11b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x55
jg 0x201f69d5
inc rax
jmp 0x201f69a0
mov al, 0x43
xchg byte [0x2055aa26], al
lea rax, [0x2055a9d0]
ret
xor eax, eax
lea rcx, [0x2055a9c0]
lea rdx, [0x20475220]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r9b
mov r10d, r9d
or r10b, r8b
not r10b
and r9b, r8b
or r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 6
jg 0x201f6a58
inc rax
jmp 0x201f6a00
xor eax, eax
lea rcx, [0x2055aac0]
lea rdx, [0x20475310]
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0x2c
jg 0x201f6a68
inc rax
jmp 0x201f6a40
mov al, 0xce
xchg byte [0x2055a9c7], al
lea rax, [0x2055a9c0]
ret
xor r8b, 0x95
add r8b, byte [0x2055b324]
xchg byte [0x2055aaed], r8b
lea rax, [0x2055aac0]
ret
Function at 0x201f6e10
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x201f6e4c
test edx, edx
je 0x201f6f05
movzx eax, byte [0x2055ae9d]
cmp al, 0xf2
je 0x201f6e44
mov cl, 0x37
nop
mov al, 0xf3
lock cmpxchg byte [0x2055ae9d], cl
je 0x201f6f6c
cmp al, 0xf2
jne 0x201f6e30
lea rax, [0x2055ae90]
ret
test edx, edx
je 0x201f6f3c
movzx eax, byte [0x2055ae6d]
nop dword [rax + rax]
cmp al, 0xc
je 0x201f6fc5
movzx ecx, byte [0x2055b324]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0x93
mov eax, r8d
and al, 0x6c
or al, r9b
add al, cl
and dl, 0xf0
mov r9d, r8d
xor r9b, 0xf
or r9b, dl
not r9b
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x2055ae6d], r9b
jne 0x201f6e60
xor eax, eax
lea rcx, [0x2055ae60]
lea rdx, [0x204756a0]
xor r8d, 0xf92e09f7
nop dword [rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
mov r10d, r11d
xor r10b, r9b
and r9b, r11b
add r9b, r9b
add r9b, r10b
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x2055b320]
add r10d, r8d
cmp r9d, r10d
jge 0x201f6fbd
inc rax
jmp 0x201f6ec0
movzx eax, byte [0x2055af6d]
cmp al, 0x79
je 0x201f6f34
mov cl, 0x88
nop word cs:[rax + rax]
mov al, 0x8c
lock cmpxchg byte [0x2055af6d], cl
je 0x201f6fcd
cmp al, 0x79
jne 0x201f6f20
lea rax, [0x2055af60]
ret
movzx eax, byte [0x2055b063]
cmp al, 0xec
je 0x201f6f64
mov cl, 0x13
nop dword [rax]
mov al, 0x16
lock cmpxchg byte [0x2055b063], cl
je 0x201f7008
cmp al, 0xec
jne 0x201f6f50
lea rax, [0x2055b050]
ret
xor eax, eax
lea rcx, [0x2055ae90]
lea rdx, [0x204756d0]
xor r8d, 0xf92e09e3
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x2055b320]
add r9d, r8d
add eax, r9d
cmp eax, 0xd
jl 0x201f6f90
mov al, 0xf2
xchg byte [0x2055ae9d], al
lea rax, [0x2055ae90]
ret
mov al, 0xc
xchg byte [0x2055ae6d], al
lea rax, [0x2055ae60]
ret
xor eax, eax
lea rcx, [0x2055af60]
lea rdx, [0x204757a0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x201f6ff8
inc rax
jmp 0x201f6fe0
mov al, 0x79
xchg byte [0x2055af6d], al
lea rax, [0x2055af60]
ret
xor eax, eax
lea rcx, [0x2055b050]
lea rdx, [0x20475890]
xor r8d, 0xf92e09e3
nop
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x2055b320]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
add r9d, r9d
mov r11d, r10d
xor r11d, r9d
and r9d, r10d
lea r9d, [r11 + r9*2]
add eax, r9d
cmp eax, 0x13
jl 0x201f7020
mov al, 0xec
xchg byte [0x2055b063], al
lea rax, [0x2055b050]
ret
Function at 0x201f7700
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x201f77ac
mov eax, r8d
xor eax, 0xf5d9ce29
add eax, dword [0x2055b320]
cmp edx, eax
jne 0x201f77ec
movzx eax, byte [0x2055a763]
nop word [rax + rax]
cmp al, 0x61
je 0x201f78d0
movzx ecx, byte [0x2055b324]
mov edx, r8d
xor dl, 0xf5
mov r9d, ecx
not r9b
mov eax, edx
xor al, r9b
xor r9b, cl
and r9b, dl
xor r9b, cl
and al, dl
add al, al
add al, r9b
mov edx, r8d
xor dl, 0x42
add dl, cl
lock cmpxchg byte [0x2055a763], dl
jne 0x201f7730
xor eax, eax
lea rcx, [0x2055a760]
lea rdx, [0x20474fc0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x201f78c8
inc rax
jmp 0x201f7790
test edx, edx
je 0x201f7895
movzx eax, byte [0x2055acf4]
xor r8b, 0x9a
add r8b, byte [0x2055b324]
cmp al, r8b
je 0x201f77e4
mov cl, 0x1f
nop dword [rax]
mov al, 0xcf
lock cmpxchg byte [0x2055acf4], cl
je 0x201f78e8
cmp al, 0xb9
jne 0x201f77d0
lea rax, [0x2055ace0]
ret
movzx eax, byte [0x2055afbe]
nop word cs:[rax + rax]
cmp al, 0x8f
je 0x201f78e0
movzx ecx, byte [0x2055b324]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0x6e
mov eax, r8d
and al, 0x91
or al, r9b
add al, cl
mov r9d, r8d
xor r9b, 0x6a
and r9b, dl
mov r10d, r8d
xor r10b, 0x95
and dl, 0x6a
or dl, r10b
not dl
or dl, r9b
add dl, cl
lock cmpxchg byte [0x2055afbe], dl
jne 0x201f7800
xor eax, eax
lea rcx, [0x2055afb0]
lea rdx, [0x204757f0]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, r8b
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x201f78d8
inc rax
jmp 0x201f7860
movzx eax, byte [0x2055a923]
cmp al, 0x28
je 0x201f78c0
mov cl, 0x12
nop word cs:[rax + rax]
mov al, 0x24
lock cmpxchg byte [0x2055a923], cl
je 0x201f793b
cmp al, 0x28
jne 0x201f78b0
lea rax, [0x2055a910]
ret
mov al, 0x61
xchg byte [0x2055a763], al
lea rax, [0x2055a760]
ret
mov al, 0x8f
xchg byte [0x2055afbe], al
lea rax, [0x2055afb0]
ret
xor edx, edx
lea rax, [0x2055ace0]
lea rcx, [0x20475520]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0x4b6a2e4c
and edx, 0x4b6a2e4c
lea edx, [r8 + rdx*2]
add edx, 0xb495d1b5
cmp edx, 0x14
jl 0x201f7900
mov al, 0xb9
xchg byte [0x2055acf4], al
lea rax, [0x2055ace0]
ret
xor eax, eax
lea rcx, [0x2055a910]
lea rdx, [0x20475170]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x12
jg 0x201f7968
inc rax
jmp 0x201f7950
mov al, 0x28
xchg byte [0x2055a923], al
lea rax, [0x2055a910]
ret
Function at 0x201f8420
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x201f845c
test edx, edx
je 0x201f84dc
movzx eax, byte [0x2055adfd]
cmp al, 0xb6
je 0x201f8454
mov cl, 0xe8
nop
mov al, 1
lock cmpxchg byte [0x2055adfd], cl
je 0x201f85bc
cmp al, 0xb6
jne 0x201f8440
lea rax, [0x2055adf0]
ret
test edx, edx
je 0x201f8575
movzx eax, byte [0x2055a626]
nop dword [rax + rax]
cmp al, 0x55
je 0x201f8648
movzx ecx, byte [0x2055b324]
mov edx, r8d
xor dl, 0x8d
mov eax, r8d
not al
and al, r8b
xor al, dl
add al, cl
mov edx, r8d
xor dl, 0xdf
add dl, cl
lock cmpxchg byte [0x2055a626], dl
jne 0x201f8470
xor eax, eax
lea rcx, [0x2055a620]
lea rdx, [0x20474ea0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x201f8640
inc rax
jmp 0x201f84c0
movzx eax, byte [0x2055af2e]
nop word cs:[rax + rax]
cmp al, 0xe3
je 0x201f8658
movzx ecx, byte [0x2055b324]
mov edx, r8d
xor dl, 1
mov r9d, r8d
xor r9b, 0xfe
mov eax, ecx
xor al, r9b
xor r9b, dl
and r9b, cl
xor r9b, dl
and al, cl
add al, al
add al, r9b
mov edx, r8d
xor dl, 0x3c
add dl, cl
lock cmpxchg byte [0x2055af2e], dl
jne 0x201f84f0
xor eax, eax
lea rcx, [0x2055af20]
lea rdx, [0x20475760]
xor r8d, 0x81b5f9cb
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x2055b320]
add r10d, r8d
cmp r9d, r10d
jge 0x201f8650
inc rax
jmp 0x201f8550
movzx eax, byte [0x2055af9a]
movzx ecx, byte [0x2055b324]
mov edx, r8d
xor dl, cl
mov r9d, edx
xor r9b, 0xc4
xor dl, 0x3b
and dl, cl
add dl, dl
add dl, r9b
cmp al, dl
je 0x201f85b4
mov cl, 0xff
nop
mov al, 0xea
lock cmpxchg byte [0x2055af9a], cl
je 0x201f8660
cmp al, 0x5f
jne 0x201f85a0
lea rax, [0x2055af90]
ret
xor edx, edx
lea rax, [0x2055adf0]
lea rcx, [0x20475630]
xor r8d, 0x81b5f9dc
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rax]
movzx r10d, byte [rdx + rcx]
add r9b, 0xec
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
add r9b, 0x14
mov byte [rdx + rax], r9b
mov r9d, dword [0x2055b320]
add r9d, r8d
mov r10d, edx
xor r10d, r9d
and r9d, edx
add r9d, r9d
mov edx, r10d
xor edx, r9d
and r9d, r10d
lea edx, [rdx + r9*2]
cmp edx, 0xd
jl 0x201f85e0
mov al, 0xb6
xchg byte [0x2055adfd], al
lea rax, [0x2055adf0]
ret
mov al, 0x55
xchg byte [0x2055a626], al
lea rax, [0x2055a620]
ret
mov al, 0xe3
xchg byte [0x2055af2e], al
lea rax, [0x2055af20]
ret
xor eax, eax
lea rcx, [0x2055af90]
lea rdx, [0x204757d0]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 9
jg 0x201f8688
inc rax
jmp 0x201f8670
xor r8b, 0xc4
add r8b, byte [0x2055b324]
xchg byte [0x2055af9a], r8b
lea rax, [0x2055af90]
ret
Function at 0x201f8830
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x201f887c
mov eax, r8d
xor eax, 0xc4e2b371
add eax, dword [0x2055b320]
cmp edx, eax
jne 0x201f88c8
movzx eax, byte [0x2055ab8d]
cmp al, 0x89
je 0x201f8874
mov cl, 0x64
nop dword [rax + rax]
mov al, 0x1e
lock cmpxchg byte [0x2055ab8d], cl
je 0x201f898c
cmp al, 0x89
jne 0x201f8860
lea rax, [0x2055ab80]
ret
test edx, edx
je 0x201f894f
movzx eax, byte [0x2055a759]
mov ecx, r8d
xor cl, 0xad
add cl, byte [0x2055b324]
cmp al, cl
je 0x201f88c0
mov cl, 0xd6
nop dword [rax]
mov al, 0xe8
lock cmpxchg byte [0x2055a759], cl
je 0x201f89dd
mov edx, r8d
xor dl, 0xad
add dl, byte [0x2055b324]
cmp al, dl
jne 0x201f88a0
lea rax, [0x2055a750]
ret
movzx eax, byte [0x2055a8c1]
nop
cmp al, 0xf1
je 0x201f8947
movzx ecx, byte [0x2055b324]
mov eax, r8d
xor al, 0x2a
add al, cl
mov edx, r8d
xor dl, 0xaf
mov r9d, edx
xor r9b, cl
and dl, cl
add dl, dl
add dl, r9b
lock cmpxchg byte [0x2055a8c1], dl
jne 0x201f88d0
xor edx, edx
lea rax, [0x2055a880]
lea rcx, [0x204750e0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x41
jl 0x201f8910
mov al, 0xf1
xchg byte [0x2055a8c1], al
lea rax, [0x2055a880]
ret
movzx eax, byte [0x2055a6d0]
xor r8b, 0x1a
add r8b, byte [0x2055b324]
cmp al, r8b
je 0x201f8984
mov cl, 0x6c
nop dword [rax + rax]
mov al, 0x87
lock cmpxchg byte [0x2055a6d0], cl
je 0x201f8a1f
cmp al, 0xf1
jne 0x201f8970
lea rax, [0x2055a6c0]
ret
xor eax, eax
lea rcx, [0x2055ab80]
lea rdx, [0x204753d0]
xor r8d, 0xc4e2b370
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x2055b320]
add r9d, r8d
add eax, r9d
cmp eax, 0xd
jl 0x201f89b0
mov al, 0x89
xchg byte [0x2055ab8d], al
lea rax, [0x2055ab80]
ret
xor edx, edx
lea rax, [0x2055a750]
lea rcx, [0x20474fb0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 9
jl 0x201f89f0
mov al, 0x9a
xchg byte [0x2055a759], al
lea rax, [0x2055a750]
ret
xor edx, edx
lea rax, [0x2055a6c0]
lea rcx, [0x20474f40]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x201f8a30
mov al, 0xf1
xchg byte [0x2055a6d0], al
lea rax, [0x2055a6c0]
ret
Function at 0x201f8aa0
Capabilities:
Check for software breakpoints

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
test ecx, ecx
je 0x201f8af9
test edx, edx
je 0x201f8b49
movzx eax, byte [0x2055af1d]
mov ecx, ebx
xor cl, 0x10
add cl, byte [0x2055b324]
cmp al, cl
je 0x201f8c98
mov cl, 0xc0
nop dword [rax]
mov al, 0x60
lock cmpxchg byte [0x2055af1d], cl
je 0x201f8c2d
cmp al, 0x6a
jne 0x201f8ae0
jmp 0x201f8c98
mov ecx, edx
mov edx, 0x8b22b4ae
mov r8d, 0xcfe5d72b
call fcn.2008e940
test al, 1
je 0x201f8bac
mov ecx, 0x667c1a8b
mov edx, 0x3308d06d
call fcn.201f7080
test al, 1
jne 0x201f8d57
mov cl, 0x96
nop dword [rax]
mov al, 0xea
lock cmpxchg byte [0x2055aa92], cl
je 0x201f8ce4
cmp al, 0x17
jne 0x201f8b30
jmp 0x201f8d57
movzx eax, byte [0x2055ae5a]
cmp al, 0x60
je 0x201f8cd8
movzx ecx, byte [0x2055b324]
mov eax, ebx
xor al, 0xc0
add al, cl
mov edx, ebx
xor dl, 0xd9
add dl, cl
lock cmpxchg byte [0x2055ae5a], dl
jne 0x201f8b50
xor eax, eax
lea rcx, [0x2055ae40]
lea rdx, [0x20475680]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x19
jg 0x201f8ca4
inc rax
jmp 0x201f8b90
movzx eax, byte [0x2055a983]
cmp al, 0xcc
je 0x201f8d68
mov sil, 0x48
mov eax, ebx
not eax
and eax, 0x8d4a5028
mov edi, ebx
xor edi, 0x72b5afd7
or edi, eax
not edi
or edi, eax
xor ebx, 0xb77c5df0
add ebx, 0xa54c1206
nop word cs:[rax + rax]
mov al, 0x97
lock cmpxchg byte [0x2055a983], sil
je 0x201f8d18
mov ecx, dword [0x2055b320]
lea edx, [rdi + rcx]
mov r8d, ebx
xor r8d, ecx
and ecx, ebx
lea r8d, [r8 + rcx*2]
add r8d, 0x5ab3edfa
mov ecx, eax
call fcn.201f7e10
test al, 1
je 0x201f8bf0
jmp 0x201f8d68
xor esi, esi
lea r14, [0x2055af10]
lea rdi, [rsp + 0x2f]
mov eax, ebx
not eax
and eax, 0xf44c16e9
xor ebx, 0xbb3e916
or ebx, eax
not ebx
or ebx, eax
movzx ebp, byte [rsi + r14]
mov rcx, rsi
mov rdx, rdi
mov r8d, 0xdfb2b8b8
mov r9d, 0x91354bc7
call fcn.201f7ee0
add bpl, byte [rsp + 0x2f]
mov byte [rsi + r14], bpl
lea eax, [rsi + 1]
mov ecx, dword [0x2055b320]
mov edx, ebx
xor edx, ecx
and ecx, ebx
lea ecx, [rdx + rcx*2]
cmp eax, ecx
jge 0x201f8c90
inc rsi
jmp 0x201f8c50
mov al, 0x6a
xchg byte [0x2055af1d], al
lea rax, [0x2055af10]
jmp 0x201f8d6f
mov eax, dword [0x2055b320]
mov ecx, ebx
xor ecx, 0xe6ee5824
add ecx, eax
mov edx, ebx
not edx
xor ebx, 0x1848676b
and edx, 0xe7b79894
or ebx, edx
not ebx
or ebx, edx
mov edx, ebx
xor edx, eax
and ebx, eax
lea edx, [rdx + rbx*2]
call fcn.201f8720
lea rax, [0x2055ae40]
jmp 0x201f8d6f
xor eax, eax
lea rcx, [0x2055aa90]
lea rdx, [0x204752f0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x201f8d48
inc rax
jmp 0x201f8d00
xor eax, eax
lea rcx, [0x2055a960]
lea rdx, [0x204751c0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x201f8d60
inc rax
jmp 0x201f8d30
xor bl, 0xad
add bl, byte [0x2055b324]
xchg byte [0x2055aa92], bl
lea rax, [0x2055aa90]
jmp 0x201f8d6f
mov al, 0xcc
xchg byte [0x2055a983], al
lea rax, [0x2055a960]
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret