joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140154930
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rsi, rcx
mov rax, qword [0x140602660]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, dword [0x140612668]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
mov eax, dword [0x1405a1f50]
mov edx, eax
xor edx, 0xc505c973
and eax, 0x4505c973
lea eax, [rdx + rax*2]
cmp ecx, eax
jne 0x1401549e7
mov eax, 0xffb1
add eax, dword [0x1405a0da4]
cdqe
add rax, qword [0x1405a0db8]
mov rcx, rsi
mov edx, 0x72bfff79
mov r8d, 0xa1facf4c
call qword [case.0x14016c073.0]
lea rcx, [rsi + 0x4c0]
mov qword [rsi + 0x420], 0
mov r8d, 0x428
xor edx, edx
call fcn.1404ad740
xorps xmm0, xmm0
movups xmmword [rsi + 0x8f0], xmm0
mov eax, dword [0x140612668]
mov ecx, dword [0x1405a1f50]
not ecx
add ecx, eax
dec ecx
imul ecx, eax
test cl, 1
je 0x140154b0d
lea rdi, [rsi + 0x4c0]
xorps xmm6, xmm6
mov ebp, 0xffb1
lea rbx, [rsp + 0x24]
nop dword [rax + rax]
mov eax, dword [0x1405a1f50]
sub eax, dword [0x1405a0da4]
add eax, 0xdd3f6bbf
mov ecx, eax
xor ecx, 0xa4d535c3
and eax, 0x24d535c3
lea eax, [rcx + rax*2]
mov ecx, 0xbd0fd7c0
sub ecx, eax
movsxd rax, ecx
add rax, qword [0x1405a0db8]
mov rcx, rsi
mov edx, 0x72bfff79
mov r8d, 0xa1facf4c
call qword [case.0x14016c073.0]
mov qword [rsi + 0x420], 0
mov r8d, 0x428
mov rcx, rdi
xor edx, edx
call fcn.1404ad740
movups xmmword [rsi + 0x8f0], xmm6
mov eax, dword [0x1405a0da8]
add eax, ebp
cdqe
add rax, qword [0x1405a0dc8]
mov ecx, 0x2771583b
call qword [case.0x14016c073.0]
mov eax, dword [0x1405a0da0]
mov ecx, dword [0x1405a1f50]
mov edx, ecx
xor edx, 0xc504c9c2
and ecx, 0x4504c9c2
lea ecx, [rdx + rcx*2]
sub eax, ecx
cdqe
add rax, qword [0x1405a0dc0]
mov rcx, rbx
mov edx, 0x8388ccd4
call qword [case.0x14016c073.0]
mov ecx, dword [rsp + 0x24]
mov eax, dword [0x1405a0dac]
mov edx, dword [0x1405a1f50]
mov r8d, edx
xor r8d, 0xc504c9c2
mov r9d, edx
and r9d, 0x4504c9c2
lea r8d, [r8 + r9*2]
sub edx, r8d
add eax, edx
add eax, 0xc505c973
cdqe
add rax, qword [0x1405a0db0]
mov edx, 0x7b990810
call qword [case.0x14016c073.0]
test al, 1
je 0x140154a00
jmp 0x140154978
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140485180
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1401bf690
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401bf6cc
test edx, edx
je 0x1401bf6fc
cmp byte [0x1405ace1f], 0
je 0x1401bf6c4
mov cl, 0x99
nop word cs:[rax + rax]
mov al, 0xde
lock cmpxchg byte [0x1405ace1f], cl
je 0x1401bf7ac
test al, al
jne 0x1401bf6b0
lea rax, [0x1405ace00]
ret
test edx, edx
je 0x1401bf736
movzx eax, byte [0x1405acc95]
cmp al, 0x36
je 0x1401bf6f4
mov cl, 0xfe
nop dword [rax]
mov al, 0x1a
lock cmpxchg byte [0x1405acc95], cl
je 0x1401bf801
cmp al, 0x36
jne 0x1401bf6e0
lea rax, [0x1405acc80]
ret
movzx eax, byte [0x1405acec3]
cmp al, 0x13
je 0x1401bf72e
mov cl, 0x87
nop dword [rax]
mov al, 0xef
lock cmpxchg byte [0x1405acec3], cl
je 0x1401bf851
movzx edx, byte [0x1405ad488]
add dl, 0x41
cmp al, dl
jne 0x1401bf710
lea rax, [0x1405aceb0]
ret
movzx eax, byte [0x1405acf8d]
nop dword [rax]
cmp al, 0x48
je 0x1401bf8b9
movzx ecx, byte [0x1405ad488]
lea eax, [rcx - 0x2f]
mov edx, ecx
xor dl, 0x25
and dl, cl
xor cl, 0x5a
add dl, dl
add dl, cl
lock cmpxchg byte [0x1405acf8d], dl
jne 0x1401bf740
xor eax, eax
lea rcx, [0x1405acf80]
lea rdx, [0x1404cfa50]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401bf8b1
inc rax
jmp 0x1401bf780
xor eax, eax
lea rcx, [0x1405ace00]
lea rdx, [0x1404cf8d0]
mov r8d, 0xaa8bd740
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405ad48c]
add r10d, r8d
cmp r9d, r10d
jge 0x1401bf7f1
inc rax
jmp 0x1401bf7d0
xor eax, eax
xchg byte [0x1405ace1f], al
lea rax, [0x1405ace00]
ret
xor edx, edx
lea rax, [0x1405acc80]
lea rcx, [0x1404cf750]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1405ad48c]
add edx, r8d
add edx, 0xaa8bd722
cmp edx, 0x15
jl 0x1401bf820
mov al, 0x36
xchg byte [0x1405acc95], al
lea rax, [0x1405acc80]
ret
xor edx, edx
lea rax, [0x1405aceb0]
lea rcx, [0x1404cf980]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x1405ad48c]
add edx, r8d
add edx, 0xaa8bd722
cmp edx, 0x13
jl 0x1401bf870
mov al, 0x13
xchg byte [0x1405acec3], al
lea rax, [0x1405aceb0]
ret
mov al, 0x48
xchg byte [0x1405acf8d], al
lea rax, [0x1405acf80]
ret
Function at 0x1401bf990
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401bf9cc
test edx, edx
je 0x1401bf9fc
movzx eax, byte [0x1405acd23]
movzx ecx, byte [0x1405ad488]
add cl, 0xbd
cmp al, cl
je 0x1401bf9c4
mov cl, 0xc
nop
mov al, 0x71
lock cmpxchg byte [0x1405acd23], cl
je 0x1401bfa5c
cmp al, 0x8f
jne 0x1401bf9b0
lea rax, [0x1405acd00]
ret
test edx, edx
je 0x1401bfa2c
movzx eax, byte [0x1405acf5d]
cmp al, 0xc0
je 0x1401bf9f4
mov cl, 0x9e
nop dword [rax]
mov al, 0xb7
lock cmpxchg byte [0x1405acf5d], cl
je 0x1401bfab1
cmp al, 0xc0
jne 0x1401bf9e0
lea rax, [0x1405acf50]
ret
movzx eax, byte [0x1405acef3]
cmp al, 0xc1
je 0x1401bfa24
mov cl, 0x1d
nop dword [rax]
mov al, 0xcb
lock cmpxchg byte [0x1405acef3], cl
je 0x1401bfb11
cmp al, 0xc1
jne 0x1401bfa10
lea rax, [0x1405acee0]
ret
movzx eax, byte [0x1405acf3b]
cmp al, 0x3c
je 0x1401bfa54
mov cl, 5
nop dword [rax]
mov al, 0x2c
lock cmpxchg byte [0x1405acf3b], cl
je 0x1401bfb58
cmp al, 0x3c
jne 0x1401bfa40
lea rax, [0x1405acf30]
ret
xor eax, eax
lea rcx, [0x1405acd00]
lea rdx, [0x1404cf7d0]
mov r8d, 0xaa8bd744
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405ad48c]
add r10d, r8d
cmp r9d, r10d
jge 0x1401bfaa1
inc rax
jmp 0x1401bfa80
mov al, 0x8f
xchg byte [0x1405acd23], al
lea rax, [0x1405acd00]
ret
xor edx, edx
lea rax, [0x1405acf50]
lea rcx, [0x1404cfa20]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x1405ad48c]
add edx, r8d
add edx, 0xaa8bd722
cmp edx, 0xd
jl 0x1401bfad0
mov al, 0xc0
xchg byte [0x1405acf5d], al
lea rax, [0x1405acf50]
ret
xor eax, eax
lea rcx, [0x1405acee0]
lea rdx, [0x1404cf9b0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x12
jg 0x1401bfb48
inc rax
jmp 0x1401bfb30
mov al, 0xc1
xchg byte [0x1405acef3], al
lea rax, [0x1405acee0]
ret
xor edx, edx
lea rax, [0x1405acf30]
lea rcx, [0x1404cfa00]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xb
jl 0x1401bfb70
mov al, 0x3c
xchg byte [0x1405acf3b], al
lea rax, [0x1405acf30]
ret
Function at 0x1401bfba0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xaa8bd721
add eax, dword [0x1405ad48c]
cmp ecx, eax
jne 0x1401bfc0c
test edx, edx
je 0x1401bfc3c
movzx eax, byte [0x1405acf4f]
nop
cmp al, 0x2a
je 0x1401bfcf7
movzx ecx, byte [0x1405ad488]
lea eax, [rcx + 5]
add cl, 0xa7
lock cmpxchg byte [0x1405acf4f], cl
jne 0x1401bfbc0
xor eax, eax
lea rcx, [0x1405acf40]
lea rdx, [0x1404cfa10]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1401bfcef
inc rax
jmp 0x1401bfbf0
test edx, edx
je 0x1401bfc7c
movzx eax, byte [0x1405ace3a]
cmp al, 0x1c
je 0x1401bfc34
mov cl, 0xf7
nop dword [rax]
mov al, 0x73
lock cmpxchg byte [0x1405ace3a], cl
je 0x1401bfcff
cmp al, 0x1c
jne 0x1401bfc20
lea rax, [0x1405ace30]
ret
movzx eax, byte [0x1405acf21]
movzx ecx, byte [0x1405ad488]
add cl, 0x78
cmp al, cl
je 0x1401bfc74
mov cl, 0xe3
nop word cs:[rax + rax]
mov al, 0xe1
lock cmpxchg byte [0x1405acf21], cl
je 0x1401bfd48
cmp al, 0x4a
jne 0x1401bfc60
lea rax, [0x1405acf10]
ret
movzx eax, byte [0x1405acd8f]
nop word cs:[rax + rax]
cmp al, 0x3e
je 0x1401bfce7
movzx ecx, byte [0x1405ad488]
lea eax, [rcx + 0x67]
add cl, 0xf5
lock cmpxchg byte [0x1405acd8f], cl
jne 0x1401bfc90
xor edx, edx
lea rax, [0x1405acd80]
lea rcx, [0x1404cf850]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x1401bfcc0
mov al, 0x3e
xchg byte [0x1405acd8f], al
lea rax, [0x1405acd80]
ret
mov al, 0x2a
xchg byte [0x1405acf4f], al
lea rax, [0x1405acf40]
ret
xor eax, eax
lea rcx, [0x1405ace30]
lea rdx, [0x1404cf900]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 9
jg 0x1401bfd38
inc rax
jmp 0x1401bfd10
mov al, 0x1c
xchg byte [0x1405ace3a], al
lea rax, [0x1405ace30]
ret
xor eax, eax
lea rcx, [0x1405acf10]
lea rdx, [0x1404cf9e0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x1401bfd88
inc rax
jmp 0x1401bfd60
mov al, 0x4a
xchg byte [0x1405acf21], al
lea rax, [0x1405acf10]
ret
Function at 0x1401bff10
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0x20c08745
add eax, dword [0x1405ad48c]
cmp ecx, eax
jne 0x1401bff5c
test edx, edx
je 0x1401bff8c
movzx eax, byte [0x1405accb2]
cmp al, 0x71
je 0x1401bff54
mov cl, 0x70
nop dword [rax + rax]
mov al, 0xa6
lock cmpxchg byte [0x1405accb2], cl
je 0x1401bffec
cmp al, 0x71
jne 0x1401bff40
lea rax, [0x1405acca0]
ret
test edx, edx
je 0x1401bffbc
movzx eax, byte [0x1405acc70]
cmp al, 0x78
je 0x1401bff84
mov cl, 0x68
nop dword [rax]
mov al, 0x88
lock cmpxchg byte [0x1405acc70], cl
je 0x1401c0018
cmp al, 0x78
jne 0x1401bff70
lea rax, [0x1405acc60]
ret
movzx eax, byte [0x1405accce]
cmp al, 0x72
je 0x1401bffb4
mov cl, 0xf1
nop dword [rax]
mov al, 0x21
lock cmpxchg byte [0x1405accce], cl
je 0x1401c0079
cmp al, 0x72
jne 0x1401bffa0
lea rax, [0x1405accc0]
ret
movzx eax, byte [0x1405ace4d]
cmp al, 0x5c
je 0x1401bffe4
mov cl, 0x30
nop dword [rax]
mov al, 0xfe
lock cmpxchg byte [0x1405ace4d], cl
je 0x1401c00bc
cmp al, 0x5c
jne 0x1401bffd0
lea rax, [0x1405ace40]
ret
xor eax, eax
lea rcx, [0x1405acca0]
lea rdx, [0x1404cf770]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x1401c0069
inc rax
jmp 0x1401c0000
xor edx, edx
lea rax, [0x1405acc60]
lea rcx, [0x1404cf740]
nop dword [rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
cmp edx, 0x10
jl 0x1401c0030
xor r8b, 0xc2
add r8b, byte [0x1405ad488]
xchg byte [0x1405acc70], r8b
lea rax, [0x1405acc60]
ret
mov al, 0x71
xchg byte [0x1405accb2], al
lea rax, [0x1405acca0]
ret
xor eax, eax
lea rcx, [0x1405accc0]
lea rdx, [0x1404cf790]
nop dword [rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xd
jg 0x1401c010d
inc rax
jmp 0x1401c0090
xor eax, eax
lea rcx, [0x1405ace40]
lea rdx, [0x1404cf910]
xor r8d, 0x20c08746
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x1405ad48c]
add r9d, r8d
add eax, r9d
cmp eax, 0xd
jl 0x1401c00e0
mov al, 0x5c
xchg byte [0x1405ace4d], al
lea rax, [0x1405ace40]
ret
xor r8b, 0xc4
add r8b, byte [0x1405ad488]
xchg byte [0x1405accce], r8b
lea rax, [0x1405accc0]
ret
Function at 0x1401c12c0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, dword [0x1405ad48c]
mov r9d, r8d
xor r9d, 0x118c047f
add eax, r9d
add eax, 0xa00b7989
mov r9d, eax
xor r9d, 0x5ff48677
and eax, 0x5ff48677
lea eax, [r9 + rax*2]
cmp ecx, eax
jne 0x1401c132c
test edx, edx
je 0x1401c1368
movzx eax, byte [0x1405acdb1]
cmp al, 0xaa
je 0x1401c1324
mov cl, 0xbc
nop word cs:[rax + rax]
mov al, 0x38
lock cmpxchg byte [0x1405acdb1], cl
je 0x1401c13cc
cmp al, 0xaa
jne 0x1401c1310
lea rax, [0x1405acda0]
ret
test edx, edx
je 0x1401c139c
movzx eax, byte [0x1405acd6d]
cmp al, 0xe4
je 0x1401c1360
mov cl, 0x7d
nop dword [rax]
mov al, 0x71
lock cmpxchg byte [0x1405acd6d], cl
je 0x1401c1432
mov edx, r8d
xor dl, 0x4c
add dl, byte [0x1405ad488]
cmp al, dl
jne 0x1401c1340
lea rax, [0x1405acd60]
ret
movzx eax, byte [0x1405ace8d]
cmp al, 0x82
je 0x1401c1394
mov cl, 0x8b
nop word cs:[rax + rax]
mov al, 0xa7
lock cmpxchg byte [0x1405ace8d], cl
je 0x1401c1478
cmp al, 0x82
jne 0x1401c1380
lea rax, [0x1405ace80]
ret
movzx eax, byte [0x1405ace6d]
cmp al, 5
je 0x1401c13c4
mov cl, 0xd1
nop dword [rax]
mov al, 0x57
lock cmpxchg byte [0x1405ace6d], cl
je 0x1401c14cb
cmp al, 5
jne 0x1401c13b0
lea rax, [0x1405ace60]
ret
xor edx, edx
lea rax, [0x1405acda0]
lea rcx, [0x1404cf870]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
not r8b
mov r10d, r8d
and r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov byte [rdx + rax], r8b
add edx, 0xdaacf9c1
mov r8d, edx
xor r8d, 0x25530640
and edx, 0x25530640
lea edx, [r8 + rdx*2]
cmp edx, 0x11
jl 0x1401c13e0
mov al, 0xaa
xchg byte [0x1405acdb1], al
lea rax, [0x1405acda0]
ret
xor eax, eax
lea rcx, [0x1405acd60]
lea rdx, [0x1404cf830]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401c1468
inc rax
jmp 0x1401c1450
mov al, 0xe4
xchg byte [0x1405acd6d], al
lea rax, [0x1405acd60]
ret
xor edx, edx
lea rax, [0x1405ace80]
lea rcx, [0x1404cf950]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0x7d424830
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x82bdb7d0
cmp edx, 0xd
jl 0x1401c1490
mov al, 0x82
xchg byte [0x1405ace8d], al
lea rax, [0x1405ace80]
ret
xor eax, eax
lea rcx, [0x1405ace60]
lea rdx, [0x1404cf930]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401c14f8
inc rax
jmp 0x1401c14e0
mov al, 5
xchg byte [0x1405ace6d], al
lea rax, [0x1405ace60]
ret
Function at 0x1401cc220
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov r8d, 0x124
xor edx, edx
call fcn.1404ad740
lea rcx, [rsi + 0x128]
mov rdi, qword [rsi + 0x128]
mov r8, qword [rdi + 8]
mov rdx, rcx
call fcn.1400a6390
mov qword [rdi + 8], rdi
mov qword [rdi], rdi
mov qword [rdi + 0x10], rdi
mov qword [rsi + 0x130], 0
lea rdi, [rsi + 0x140]
mov rcx, qword [rsi + 0x140]
test rcx, rcx
je 0x1401cc2ab
cmp dword [rsi + 0x15c], 1
jne 0x1401cc293
mov r8, qword [rsi + 0x148]
xor edx, edx
call fcn.1404ad740
mov rcx, qword [rdi]
test rcx, rcx
je 0x1401cc2ab
mov edx, 0x314c86b9
mov r8d, 0x7eeffe7b
call fcn.1400a8b80
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov byte [rsi + 0x158], 1
mov rax, qword [rsi + 0x178]
mov rcx, qword [rax + 8]
mov qword [rcx], 0
mov rcx, qword [rax]
test rcx, rcx
je 0x1401cc2f5
nop word [rax + rax]
mov rdi, qword [rcx]
mov edx, 0x20
call fcn.1401d6880
mov rcx, rdi
test rdi, rdi
jne 0x1401cc2e0
mov rax, qword [rsi + 0x178]
mov qword [rax], rax
mov rax, qword [rsi + 0x178]
mov qword [rax + 8], rax
mov qword [rsi + 0x180], 0
mov rax, qword [rsi + 0x188]
mov rcx, qword [rax + 8]
mov qword [rcx], 0
mov rcx, qword [rax]
test rcx, rcx
je 0x1401cc374
movabs rdi, 0x8eec59f04b8741e8
movabs rbx, 0xeec59f04b8741e8
nop word cs:[rax + rax]
mov r14, qword [rcx]
mov rax, qword [0x1405aee80]
mov rdx, rax
xor rdx, rdi
and rax, rbx
lea rdx, [rdx + rax*2]
call fcn.1401d6880
mov rcx, r14
test r14, r14
jne 0x1401cc350
mov rax, qword [rsi + 0x188]
mov qword [rax], rax
mov rax, qword [rsi + 0x188]
mov qword [rax + 8], rax
mov qword [rsi + 0x190], 0
mov rax, qword [rsi + 0x198]
mov rcx, qword [rax + 8]
mov qword [rcx], 0
mov rcx, qword [rax]
test rcx, rcx
je 0x1401cc3c5
nop
mov rdi, qword [rcx]
mov edx, 0x20
call fcn.1401d6880
mov rcx, rdi
test rdi, rdi
jne 0x1401cc3b0
mov rax, qword [rsi + 0x198]
mov qword [rax], rax
mov rax, qword [rsi + 0x198]
mov qword [rax + 8], rax
mov qword [rsi + 0x1a0], 0
lea rdi, [rsi + 0x1b0]
mov rcx, qword [rsi + 0x1b0]
test rcx, rcx
je 0x1401cc427
cmp dword [rsi + 0x1cc], 1
jne 0x1401cc40f
mov r8, qword [rsi + 0x1b8]
xor edx, edx
call fcn.1404ad740
mov rcx, qword [rdi]
test rcx, rcx
je 0x1401cc427
mov edx, 0x314c86b9
mov r8d, 0x7eeffe7b
call fcn.1400a8b80
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov byte [rsi + 0x1c8], 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1401d8940
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8d, dword [rsp + 0x38]
mov eax, r8d
xor eax, 0x5f3226
add eax, dword [0x1405aee78]
cmp ecx, eax
jne 0x1401d89b3
test edx, edx
je 0x1401d8a1f
movzx eax, byte [0x1405ad974]
cmp al, 0xf5
je 0x1401d8b42
mov cl, 0xbc
nop word cs:[rax + rax]
mov al, 0x4c
lock cmpxchg byte [0x1405ad974], cl
je 0x1401d8a79
mov edx, r8d
xor dl, 0x9e
mov r9d, r8d
not r9b
and r9b, r8b
xor r9b, dl
add r9b, byte [0x1405aee88]
cmp al, r9b
jne 0x1401d8980
jmp 0x1401d8b42
test edx, edx
je 0x1401d8a49
movzx eax, byte [0x1405adb4d]
cmp al, 0xe9
je 0x1401d8b56
nop word [rax + rax]
movzx ecx, byte [0x1405aee88]
mov eax, r8d
xor al, 0xd8
mov edx, eax
xor dl, cl
and al, cl
add al, al
add al, dl
mov edx, r8d
xor dl, 0xba
add dl, cl
lock cmpxchg byte [0x1405adb4d], dl
je 0x1401d8ac1
mov ecx, r8d
not cl
mov edx, r8d
xor dl, 0x7d
and cl, 0x82
or dl, cl
not dl
or dl, cl
add dl, byte [0x1405aee88]
cmp al, dl
jne 0x1401d89d0
jmp 0x1401d8b56
movzx eax, byte [0x1405ada12]
cmp al, 0x59
je 0x1401d8bfc
mov cl, 0x20
mov al, 0x67
lock cmpxchg byte [0x1405ada12], cl
je 0x1401d8b62
cmp al, 0x59
jne 0x1401d8a30
jmp 0x1401d8bfc
movzx eax, byte [0x1405ad984]
cmp al, 0x7f
je 0x1401d8be1
mov cl, 0xf0
nop word [rax + rax]
mov al, 5
lock cmpxchg byte [0x1405ad984], cl
je 0x1401d8b98
cmp al, 0x7f
jne 0x1401d8a60
jmp 0x1401d8be1
xor eax, eax
lea rcx, [0x1405ad970]
lea rdx, [0x1404cfde0]
mov r9d, r8d
xor r9d, 0x5f323a
nop word cs:[rax + rax]
movzx r10d, byte [rax + rdx]
add byte [rax + rcx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x1405aee78]
add r11d, r9d
cmp r10d, r11d
jge 0x1401d8b30
inc rax
jmp 0x1401d8aa0
xor eax, eax
lea rcx, [0x1405adb40]
lea rdx, [0x1404cffb0]
xor r8d, 0x5f3233
nop dword [rax + rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
not r11b
mov ebx, r11d
and bl, r10b
mov esi, r9d
xor r9b, r10b
not r10b
and sil, r10b
or sil, bl
and r10b, r11b
or r10b, r9b
not r10b
add r10b, r10b
add r10b, sil
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x1405aee78]
add r10d, r8d
cmp r9d, r10d
jge 0x1401d8b4e
inc rax
jmp 0x1401d8ae0
xor r8b, 0x9e
add r8b, byte [0x1405aee88]
xchg byte [0x1405ad974], r8b
lea rax, [0x1405ad970]
jmp 0x1401d8c03
mov al, 0xe9
xchg byte [0x1405adb4d], al
lea rax, [0x1405adb40]
jmp 0x1401d8c03
xor eax, eax
lea rcx, [0x1405ada10]
lea rdx, [0x1404cfe80]
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 1
jg 0x1401d8bea
inc rax
jmp 0x1401d8b80
xor edx, edx
lea rax, [0x1405ad980]
lea rcx, [0x1404cfdf0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
not edx
and edx, 0x7ffffffe
or edx, r8d
not edx
lea edx, [r8 + rdx*2]
cmp edx, 4
jl 0x1401d8bb0
mov al, 0x7f
xchg byte [0x1405ad984], al
lea rax, [0x1405ad980]
jmp 0x1401d8c03
xor r8b, 0x32
add r8b, byte [0x1405aee88]
xchg byte [0x1405ada12], r8b
lea rax, [0x1405ada10]
pop rbx
pop rsi
ret
Function at 0x14021bb10
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14021bb4c
test edx, edx
je 0x14021bb8c
movzx eax, byte [0x1405b41b0]
cmp al, 0xd1
je 0x14021bb44
mov cl, 0xd7
nop word cs:[rax + rax]
mov al, 0x6b
lock cmpxchg byte [0x1405b41b0], cl
je 0x14021bc3c
cmp al, 0xd1
jne 0x14021bb30
lea rax, [0x1405b41a0]
ret
test edx, edx
je 0x14021bc0f
movzx eax, byte [0x1405b4213]
cmp al, 0x26
je 0x14021bb84
mov cl, 0x89
nop word cs:[rax + rax]
mov al, 0x70
lock cmpxchg byte [0x1405b4213], cl
je 0x14021bc78
cmp al, 0x26
jne 0x14021bb70
lea rax, [0x1405b4210]
ret
movzx eax, byte [0x1405b4269]
nop word cs:[rax + rax]
cmp al, 0x16
je 0x14021bc07
movzx ecx, byte [0x1405b4760]
lea eax, [rcx + 0x5b]
add cl, 0x8d
lock cmpxchg byte [0x1405b4269], cl
jne 0x14021bba0
xor edx, edx
lea rax, [0x1405b4260]
lea rcx, [0x1404d1100]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 9
jl 0x14021bbd0
mov al, 0x16
xchg byte [0x1405b4269], al
lea rax, [0x1405b4260]
ret
movzx eax, byte [0x1405b427d]
cmp al, 0x83
je 0x14021bc34
mov cl, 0xb7
nop dword [rax]
mov al, 0x54
lock cmpxchg byte [0x1405b427d], cl
je 0x14021bcb8
cmp al, 0x83
jne 0x14021bc20
lea rax, [0x1405b4270]
ret
xor eax, eax
lea rcx, [0x1405b41a0]
lea rdx, [0x1404d1060]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x14021bc68
inc rax
jmp 0x14021bc50
mov al, 0xd1
xchg byte [0x1405b41b0], al
lea rax, [0x1405b41a0]
ret
xor eax, eax
lea rcx, [0x1405b4210]
lea rdx, [0x1404d10b0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x14021bca8
inc rax
jmp 0x14021bc90
mov al, 0x26
xchg byte [0x1405b4213], al
lea rax, [0x1405b4210]
ret
xor eax, eax
lea rcx, [0x1405b4270]
lea rdx, [0x1404d1110]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14021bce8
inc rax
jmp 0x14021bcd0
mov al, 0x83
xchg byte [0x1405b427d], al
lea rax, [0x1405b4270]
ret