joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401b4e70
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov esi, r8d
test ecx, ecx
je 0x1401b4ec9
movzx eax, byte [0x14052fec7]
movzx ecx, byte [0x1405302c0]
add cl, 0x8e
cmp al, cl
je 0x1401b4fd0
mov cl, 0x9b
nop word cs:[rax + rax]
mov al, 0xf1
lock cmpxchg byte [0x14052fec7], cl
je 0x1401b4f49
cmp al, 0xbb
jne 0x1401b4eb0
jmp 0x1401b4fd0
movzx eax, byte [0x14052ff40]
cmp al, 0xeb
je 0x1401b4f3d
movzx ecx, byte [0x1405302c0]
lea eax, [rcx + 0x1b]
add cl, 0x6d
lock cmpxchg byte [0x14052ff40], cl
jne 0x1401b4ed0
xor eax, eax
lea rbx, [0x14052ff30]
lea r14, [0x140450370]
xor esi, 0x1eeb498d
lea rdi, [rsp + 0x40]
nop word cs:[rax + rax]
movsxd rcx, eax
movzx eax, byte [rcx + r14]
add byte [rcx + rbx], al
mov rdx, rdi
mov r8d, esi
mov r9d, 0xc5cff884
call fcn.1401b5060
mov eax, dword [rsp + 0x40]
cmp eax, 0x10
jl 0x1401b4f10
mov al, 0xeb
xchg byte [0x14052ff40], al
lea rax, [0x14052ff30]
jmp 0x1401b4fd7
xor eax, eax
lea r12, [0x14052fec0]
mov edi, esi
xor edi, 0x8b051812
mov ebp, 0x392db672
lea rbx, [rsp + 0x3f]
lea r13, [0x140450300]
xor esi, 0x19aa4025
lea r14, [rsp + 0x44]
nop word cs:[rax + rax]
movsxd r15, eax
lea rcx, [r12 + r15]
mov r9d, dword [0x1405302b0]
add r9d, ebp
mov rdx, rbx
mov r8d, edi
call fcn.1400f9890
movzx edx, byte [rsp + 0x3f]
xor dl, byte [r15 + r13]
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x28], 0x92ccc9fd
mov rcx, r15
mov r8d, r15d
mov r9, r14
call fcn.1401b5030
mov eax, dword [rsp + 0x44]
cmp eax, 7
jl 0x1401b4f80
mov al, 0xbb
xchg byte [0x14052fec7], al
lea rax, [0x14052fec0]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401bdd10
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1401bdd5c
mov eax, r8d
xor eax, 0x996d5a8
add eax, dword [0x140530bc0]
cmp edx, eax
jne 0x1401bdd94
movzx eax, byte [0x140530865]
cmp al, 0xa7
je 0x1401bdd54
mov cl, 0xe9
nop dword [rax + rax]
mov al, 0x82
lock cmpxchg byte [0x140530865], cl
je 0x1401bde22
cmp al, 0xa7
jne 0x1401bdd40
lea rax, [0x140530860]
ret
movzx eax, byte [0x1405308ee]
cmp al, 0x9e
je 0x1401bdd8c
mov cl, 0x98
nop dword [rax]
mov al, 0x67
lock cmpxchg byte [0x1405308ee], cl
je 0x1401bddd8
mov edx, r8d
xor dl, 0xa4
add dl, byte [0x140530bc4]
cmp al, dl
jne 0x1401bdd70
lea rax, [0x1405308e0]
ret
movzx eax, byte [0x140530874]
cmp al, 0x67
je 0x1401bddd0
mov cl, 0x8c
nop word cs:[rax + rax]
mov al, 0x5c
lock cmpxchg byte [0x140530874], cl
je 0x1401bde58
mov edx, r8d
xor dl, 0x6d
add dl, byte [0x140530bc4]
cmp al, dl
jne 0x1401bddb0
lea rax, [0x140530870]
ret
xor eax, eax
lea rcx, [0x1405308e0]
lea rdx, [0x140450850]
nop dword [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xd
jg 0x1401bde08
inc rax
jmp 0x1401bddf0
xor r8b, 0xa4
add r8b, byte [0x140530bc4]
xchg byte [0x1405308ee], r8b
lea rax, [0x1405308e0]
ret
xor eax, eax
lea rcx, [0x140530860]
lea rdx, [0x1404507e0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x1401bde9f
inc rax
jmp 0x1401bde40
xor edx, edx
lea rax, [0x140530870]
lea rcx, [0x1404507f0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 4
jl 0x1401bde70
mov al, 0x67
xchg byte [0x140530874], al
lea rax, [0x140530870]
ret
mov al, 0xa7
xchg byte [0x140530865], al
lea rax, [0x140530860]
ret
Function at 0x1401c33b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x218
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x190], 0xfffffffffffffffe
cmp qword [rcx + 0x18], 0
je 0x1401c3544
mov rsi, rcx
lea rbx, [0x140450b50]
mov qword [rbp + 0x108], rbx
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x148], 0xf
mov byte [rbp + 0x130], 0
lea rax, [0x140449f08]
mov qword [rbp + 0x128], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x158], xmm0
mov qword [rbp + 0x168], 0
mov byte [rbp + 0x170], 1
mov dword [rbp + 0x174], 1
movups xmmword [rbp + 0x178], xmm0
mov qword [rbp + 0x188], 0
lea rax, [0x14044bdb8]
mov qword [rbp + 0x150], rax
mov byte [rbp + 0x110], 0
mov qword [rbp + 0x120], 0
mov qword [rbp + 0x118], rdx
mov rax, qword [rcx + 0x20]
mov rcx, qword [rax + 8]
cmp byte [rcx + 0x19], 0
mov r14, rax
jne 0x1401c34c8
mov r14, rax
nop dword [rax]
lea r8, [rcx + 0x10]
cmp qword [rcx + 0x30], rdx
cmovae r14, rcx
cmovae r8, rcx
mov rcx, qword [r8]
movzx r8d, byte [0x1405326a0]
xor r9d, r9d
sub r9b, r8b
mov r8d, r9d
xor r8b, 0xf7
and r9b, 0x77
add r9b, r9b
add r9b, r8b
add r9b, byte [rcx + 0x19]
je 0x1401c3490
cmp byte [r14 + 0x19], 0
je 0x1401c3559
xor edi, edi
lea rcx, [rbp + 0x150]
mov qword [rbp + 0x108], rbx
call fcn.140074720
mov rax, qword [rbp + 0x148]
cmp rax, 0x10
jb 0x1401c3546
mov rcx, qword [rbp + 0x130]
mov rdx, rax
xor rdx, 1
mov r8d, eax
and r8d, 1
lea rdx, [rdx + r8*2]
cmp rdx, 0x1000
jb 0x1401c353d
mov r8, qword [rcx - 8]
sub rcx, r8
add rcx, 0xfffffffffffffff8
cmp rcx, 0x20
jae 0x1401c366f
mov rcx, rax
xor rcx, 0x28
and eax, 0x28
lea rdx, [rcx + rax*2]
mov rcx, r8
call fcn.1400ab270
jmp 0x1401c3546
xor edi, edi
mov rax, rdi
add rsp, 0x218
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
xor edi, edi
cmp qword [r14 + 0x30], rdx
ja 0x1401c34d5
cmp r14, rax
je 0x1401c34d5
cmp byte [r14 + 0x28], 0
je 0x1401c3587
call fcn.14007f750
mov rcx, rax
call fcn.1401437b0
jmp 0x1401c3659
movzx eax, byte [0x1405326a0]
mov ecx, eax
xor cl, 0x76
and cl, al
xor al, 9
add cl, cl
add cl, al
cmp byte [rsi + 8], cl
jne 0x1401c35d3
mov rcx, qword [rsi + 0x10]
mov eax, dword [rsi + 0x34]
mov r9d, dword [rsi + 0x30]
lea rdx, [rsi + 0x38]
mov dword [rsp + 0x20], eax
mov r8d, 0x10
call fcn.140125ca0
test al, al
jne 0x1401c35c7
call fcn.1401602b0
movzx eax, byte [0x1405326a0]
add al, 0xa
mov byte [rsi + 8], al
mov byte [rbp - 0x50], 0
lea r15, [rbp - 0x4c]
mov r8d, 0x150
mov rcx, r15
xor edx, edx
call fcn.14042db60
mov rcx, r15
xor edx, edx
call fcn.1402a5e20
add rsi, 0x38
lea rdi, [rbp + 4]
movzx r9d, byte [rbp - 0x50]
add r9d, dword [0x14058ef04]
add r9d, dword [0x14058f610]
mov qword [rsp + 0x20], rdi
mov r8d, 0x10
mov rcx, r15
mov rdx, rsi
call fcn.1402a5fd0
lea rax, [rbp - 0x4c]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov rdx, qword [r14 + 0x78]
movsxd r8, edx
test rdx, rdx
je 0x1401c3640
mov rdx, qword [r14 + 0x70]
mov rcx, rax
mov r9, rdx
call fcn.1402a6990
mov byte [r14 + 0x28], 1
lea rcx, [rbp - 0x4c]
call fcn.1402a6260
mov rdi, qword [r14 + 0x78]
test rdi, rdi
je 0x1401c34d5
mov rdi, qword [r14 + 0x70]
jmp 0x1401c34d5
call fcn.1403e571c
int3
Function at 0x1401c4af0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401c4b49
test edx, edx
je 0x1401c4bc3
movzx eax, byte [0x140532460]
cmp al, 0xd1
je 0x1401c4b41
mov cl, 0xd7
nop dword [rax]
mov al, 0x6b
lock cmpxchg byte [0x140532460], cl
je 0x1401c4c3c
movzx edx, byte [0x1405326a0]
mov r8d, edx
xor r8b, 0xda
not dl
and dl, 0x25
or dl, r8b
not dl
add dl, dl
add dl, r8b
cmp al, dl
jne 0x1401c4b10
lea rax, [0x140532450]
ret
test edx, edx
je 0x1401c4c06
movzx eax, byte [0x1405324c3]
nop dword [rax + rax]
cmp al, 0x26
je 0x1401c4c93
movzx ecx, byte [0x1405326a0]
lea eax, [rcx + 0x79]
add cl, 0x92
lock cmpxchg byte [0x1405324c3], cl
jne 0x1401c4b60
xor eax, eax
lea rcx, [0x1405324c0]
lea rdx, [0x140450ac0]
nop
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r8b
not r9b
mov r10d, r8d
xor r10b, r9b
or r9b, r8b
and r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1401c4c8b
inc rax
jmp 0x1401c4b90
movzx eax, byte [0x140532519]
movzx ecx, byte [0x1405326a0]
add cl, 0x1f
cmp al, cl
je 0x1401c4bfe
mov cl, 0xd3
nop word [rax + rax]
mov al, 0xa1
lock cmpxchg byte [0x140532519], cl
je 0x1401c4c9b
movzx edx, byte [0x1405326a0]
add dl, 0x1f
cmp al, dl
jne 0x1401c4be0
lea rax, [0x140532510]
ret
movzx eax, byte [0x14053252d]
cmp al, 0x83
je 0x1401c4c34
mov cl, 0xb7
nop word cs:[rax + rax]
mov al, 0x54
lock cmpxchg byte [0x14053252d], cl
je 0x1401c4cd8
cmp al, 0x83
jne 0x1401c4c20
lea rax, [0x140532520]
ret
xor edx, edx
lea rax, [0x140532450]
lea rcx, [0x140450a70]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0xf8c21a1d
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x73de5e3
cmp edx, 0x10
jl 0x1401c4c50
mov al, 0xd1
xchg byte [0x140532460], al
lea rax, [0x140532450]
ret
mov al, 0x26
xchg byte [0x1405324c3], al
lea rax, [0x1405324c0]
ret
xor eax, eax
lea rcx, [0x140532510]
lea rdx, [0x140450b10]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1401c4cc8
inc rax
jmp 0x1401c4cb0
mov al, 0x16
xchg byte [0x140532519], al
lea rax, [0x140532510]
ret
xor eax, eax
lea rcx, [0x140532520]
lea rdx, [0x140450b20]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401c4d18
inc rax
jmp 0x1401c4cf0
mov al, 0x83
xchg byte [0x14053252d], al
lea rax, [0x140532520]
ret
Function at 0x1401c9190
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401c91dc
mov eax, 0x1440fe9b
add eax, dword [0x140533134]
cmp edx, eax
jne 0x1401c923c
movzx eax, byte [0x140533099]
cmp al, 0x73
je 0x1401c91d4
mov cl, 0x98
nop word cs:[rax + rax]
mov al, 0xe7
lock cmpxchg byte [0x140533099], cl
je 0x1401c92ac
cmp al, 0x73
jne 0x1401c91c0
lea rax, [0x140533090]
ret
test edx, edx
je 0x1401c9283
movzx eax, byte [0x140533073]
nop dword [rax + rax]
cmp al, 0xe7
je 0x1401c9359
movzx ecx, byte [0x140533130]
lea eax, [rcx + 0x15]
add cl, 0x61
lock cmpxchg byte [0x140533073], cl
jne 0x1401c91f0
xor eax, eax
lea rcx, [0x140533050]
lea rdx, [0x140450f30]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1401c9351
inc rax
jmp 0x1401c9220
movzx eax, byte [0x14053308f]
movzx ecx, byte [0x140533130]
add cl, 0xf1
cmp al, cl
je 0x1401c927b
nop word cs:[rax + rax]
movzx ecx, byte [0x140533130]
lea eax, [rcx + 0x5d]
add cl, 0x51
lock cmpxchg byte [0x14053308f], cl
je 0x1401c92e8
cmp al, 0xe0
jne 0x1401c9260
lea rax, [0x140533080]
ret
movzx eax, byte [0x140532fd9]
cmp al, 0xf3
je 0x1401c92a4
mov cl, 0xff
mov al, 0x1f
lock cmpxchg byte [0x140532fd9], cl
je 0x1401c9361
cmp al, 0xf3
jne 0x1401c9290
lea rax, [0x140532fb0]
ret
xor eax, eax
lea rcx, [0x140533090]
lea rdx, [0x140450f70]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1401c9341
inc rax
jmp 0x1401c92c0
xor edx, edx
lea rax, [0x140533080]
lea rcx, [0x140450f60]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140533134]
add edx, r8d
add edx, 0x1440fe9c
cmp edx, 0xf
jl 0x1401c9300
mov al, pe_nt_image_headers64
xchg byte [0x14053308f], al
lea rax, [0x140533080]
ret
mov al, 0x73
xchg byte [0x140533099], al
lea rax, [0x140533090]
ret
mov al, 0xe7
xchg byte [0x140533073], al
lea rax, [0x140533050]
ret
xor eax, eax
lea rcx, [0x140532fb0]
lea rdx, [0x140450ea0]
mov r8d, 0x1440fec4
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140533134]
add r10d, r8d
cmp r9d, r10d
jge 0x1401c93a1
inc rax
jmp 0x1401c9380
mov al, 0xf3
xchg byte [0x140532fd9], al
lea rax, [0x140532fb0]
ret
Function at 0x1401cf260
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1401cf2d0
mov eax, r8d
xor eax, 0x9322785a
add eax, dword [0x1405332ec]
cmp edx, eax
jne 0x1401cf30c
movzx eax, byte [0x140533175]
mov ecx, r8d
xor cl, 0x81
add cl, byte [0x1405332e8]
cmp al, cl
je 0x1401cf2c8
nop word cs:[rax + rax]
movzx ecx, byte [0x1405332e8]
mov eax, r8d
xor al, 0x88
add al, cl
mov edx, r8d
xor dl, 0x58
add dl, cl
lock cmpxchg byte [0x140533175], dl
je 0x1401cf36c
cmp al, 0x9a
jne 0x1401cf2a0
lea rax, [0x140533170]
ret
xor r8d, 0x9322785a
add r8d, dword [0x1405332ec]
cmp edx, r8d
jne 0x1401cf33c
movzx eax, byte [0x1405331d2]
cmp al, 0x20
je 0x1401cf304
mov cl, 0xe1
mov al, 0x8f
lock cmpxchg byte [0x1405331d2], cl
je 0x1401cf3f8
cmp al, 0x20
jne 0x1401cf2f0
lea rax, [0x1405331c0]
ret
movzx eax, byte [0x140533299]
cmp al, 0x73
je 0x1401cf334
mov cl, 0xb2
nop dword [rax]
mov al, 0xed
lock cmpxchg byte [0x140533299], cl
je 0x1401cf3bd
cmp al, 0x73
jne 0x1401cf320
lea rax, [0x140533290]
ret
movzx eax, byte [0x14053328f]
cmp al, 0xe4
je 0x1401cf364
mov cl, 0xb8
nop dword [rax]
mov al, 0xf
lock cmpxchg byte [0x14053328f], cl
je 0x1401cf428
cmp al, 0xe4
jne 0x1401cf350
lea rax, [0x140533280]
ret
xor eax, eax
lea rcx, [0x140533170]
lea rdx, [0x140451020]
xor r8d, 0x9322785d
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x1405332ec]
add r9d, r8d
add eax, r9d
cmp eax, 5
jl 0x1401cf390
mov al, 0x9a
xchg byte [0x140533175], al
lea rax, [0x140533170]
ret
xor eax, eax
lea rcx, [0x140533290]
lea rdx, [0x140451120]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1401cf3e8
inc rax
jmp 0x1401cf3d0
mov al, 0x73
xchg byte [0x140533299], al
lea rax, [0x140533290]
ret
xor eax, eax
lea rcx, [0x1405331c0]
lea rdx, [0x140451060]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x1401cf47f
inc rax
jmp 0x1401cf410
xor edx, edx
lea rax, [0x140533280]
lea rcx, [0x140451110]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x1401cf440
mov al, 0xe4
xchg byte [0x14053328f], al
lea rax, [0x140533280]
ret
mov al, 0x20
xchg byte [0x1405331d2], al
lea rax, [0x1405331c0]
ret
Function at 0x1401cf5b0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1401cf5f8
test edx, edx
je 0x1401cf62c
movzx eax, byte [0x1405331b5]
cmp al, 0xc5
je 0x1401cf5f0
mov cl, 0xe9
nop word [rax + rax]
mov al, 0x5f
lock cmpxchg byte [0x1405331b5], cl
je 0x1401cf68c
mov edx, r8d
xor dl, 0x9a
add dl, byte [0x1405332e8]
cmp al, dl
jne 0x1401cf5d0
lea rax, [0x1405331a0]
ret
test edx, edx
je 0x1401cf65c
movzx eax, byte [0x14053322f]
cmp al, 0xf6
je 0x1401cf624
mov cl, 0xc2
nop dword [rax]
mov al, 0x4a
lock cmpxchg byte [0x14053322f], cl
je 0x1401cf6cf
cmp al, 0xf6
jne 0x1401cf610
lea rax, [0x140533220]
ret
movzx eax, byte [0x140533273]
cmp al, 0x5a
je 0x1401cf654
mov cl, 0xe8
nop dword [rax]
mov al, 0xaf
lock cmpxchg byte [0x140533273], cl
je 0x1401cf6f8
cmp al, 0x5a
jne 0x1401cf640
lea rax, [0x140533250]
ret
movzx eax, byte [0x140533243]
cmp al, 0x28
je 0x1401cf684
mov cl, 0xd7
nop dword [rax]
mov al, 6
lock cmpxchg byte [0x140533243], cl
je 0x1401cf769
cmp al, 0x28
jne 0x1401cf670
lea rax, [0x140533240]
ret
xor edx, edx
lea rax, [0x1405331a0]
lea rcx, [0x140451040]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x1401cf6a0
mov al, 0xc5
xchg byte [0x1405331b5], al
lea rax, [0x1405331a0]
ret
xor eax, eax
lea rcx, [0x140533220]
lea rdx, [0x1404510b0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1401cf759
inc rax
jmp 0x1401cf6e0
xor edx, edx
lea rax, [0x140533250]
lea rcx, [0x1404510e0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rdx + rax]
xor r10b, r9b
mov byte [rdx + rax], r10b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
cmp edx, 0x23
jl 0x1401cf710
xor r8b, 0x31
add r8b, byte [0x1405332e8]
xchg byte [0x140533273], r8b
lea rax, [0x140533250]
ret
mov al, 0xf6
xchg byte [0x14053322f], al
lea rax, [0x140533220]
ret
xor eax, eax
lea rcx, [0x140533240]
lea rdx, [0x1404510d0]
nop dword [rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
cmp r9d, 2
jg 0x1401cf7a8
inc rax
jmp 0x1401cf780
xor r8b, 0x7f
add r8b, byte [0x1405332e8]
xchg byte [0x140533243], r8b
lea rax, [0x140533240]
ret
Function at 0x1401d0130
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401d01a1
movzx eax, byte [0x140533a05]
nop dword [rax + rax]
cmp al, 0x27
je 0x1401d01dc
movzx ecx, byte [0x140533ac8]
mov eax, r9d
xor al, 0xca
add al, cl
mov edx, r9d
xor dl, 0xa2
add dl, cl
lock cmpxchg byte [0x140533a05], dl
jne 0x1401d0140
xor eax, eax
lea rcx, [0x1405339f0]
lea rdx, [0x140451300]
xor r9d, 0xdf90263c
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
mov r10d, dword [0x140533acc]
add r10d, r9d
cmp r8d, r10d
jge 0x1401d01d4
inc rax
jmp 0x1401d0180
movzx eax, byte [0x140533993]
cmp al, 0x97
je 0x1401d01cc
mov cl, 0x56
nop
mov al, 0x4e
lock cmpxchg byte [0x140533993], cl
je 0x1401d01e4
mov edx, r9d
xor dl, 0x74
add dl, byte [0x140533ac8]
cmp al, dl
jne 0x1401d01b0
lea rax, [0x140533970]
ret
mov al, 0x27
xchg byte [0x140533a05], al
lea rax, [0x1405339f0]
ret
xor edx, edx
lea rax, [0x140533970]
lea rcx, [0x140451280]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x23
jl 0x1401d0200
mov al, 0x97
xchg byte [0x140533993], al
lea rax, [0x140533970]
ret
Function at 0x1401dcc50
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rcx + 0x68], xmm0
movups xmmword [rcx + 0x58], xmm0
movups xmmword [rcx + 0x48], xmm0
movups xmmword [rcx + 0x38], xmm0
movups xmmword [rcx + 0x28], xmm0
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 8], xmm0
mov rdi, qword [rcx + 0x78]
mov rbx, qword [rcx + 0x80]
cmp rdi, rbx
je 0x1401dccc4
nop dword [rax]
mov eax, dword [0x140535c40]
lea edx, [rax + 0x381efbde]
mov ecx, eax
xor ecx, 0x10afa4d4
not eax
and eax, 0x6f505b2b
or eax, ecx
not eax
lea r8d, [rcx + rax*2]
mov rcx, rdi
call fcn.1401dec80
add rdi, 0x40
cmp rdi, rbx
jne 0x1401dcc90
mov rax, qword [rsi + 0x78]
mov qword [rsi + 0x80], rax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1401de750
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
test ecx, ecx
je 0x1401de789
test edx, edx
je 0x1401de854
movzx eax, byte [0x140535890]
cmp al, 0xae
je 0x1401de919
mov cl, 0x90
nop
mov al, 0xb4
lock cmpxchg byte [0x140535890], cl
je 0x1401de8c9
cmp al, 0xae
jne 0x1401de770
jmp 0x1401de919
test edx, edx
je 0x1401de889
movzx eax, byte [0x1405357d5]
nop dword [rax + rax]
cmp al, 0xd
je 0x1401de848
movzx ecx, byte [0x140535c50]
lea eax, [rcx - 0x37]
mov edx, ecx
xor dl, 0xd2
and cl, 0x52
add cl, cl
add cl, dl
lock cmpxchg byte [0x1405357d5], cl
jne 0x1401de7a0
xor edx, edx
lea rax, [0x1405357c0]
lea rcx, [0x140451f10]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140535c40]
lea r9d, [r8 + 0x6e995980]
mov r10d, edx
not r10d
mov r11d, 0x9166a67f
sub r11d, r8d
mov esi, edx
and esi, r11d
and r11d, r10d
and r10d, r9d
or esi, r10d
xor edx, r9d
or r11d, edx
not r11d
lea edx, [rsi + r11*2]
add r8d, 0x6e995994
cmp edx, r8d
jl 0x1401de7e0
mov al, 0xd
xchg byte [0x1405357d5], al
lea rax, [0x1405357c0]
jmp 0x1401de9d6
movzx eax, byte [0x140535860]
cmp al, 0x8e
je 0x1401de960
mov cl, 0x1b
nop word cs:[rax + rax]
mov al, 0x70
lock cmpxchg byte [0x140535860], cl
je 0x1401de925
cmp al, 0x8e
jne 0x1401de870
jmp 0x1401de960
movzx eax, byte [0x140535742]
movzx ecx, byte [0x140535c50]
add cl, 0xfb
cmp al, cl
je 0x1401de9cf
mov cl, 0xcf
nop word cs:[rax + rax]
mov al, 0x1b
lock cmpxchg byte [0x140535742], cl
je 0x1401de969
cmp al, 0x4c
jne 0x1401de8b0
jmp 0x1401de9cf
xor edx, edx
lea rax, [0x140535880]
lea rcx, [0x140451fc0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140535c40]
add edx, r8d
add edx, 0x6e995980
cmp edx, 0x10
jl 0x1401de8e0
mov al, 0xae
xchg byte [0x140535890], al
lea rax, [0x140535880]
jmp 0x1401de9d6
xor eax, eax
lea rcx, [0x140535850]
lea rdx, [0x140451fa0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1401de958
inc rax
jmp 0x1401de940
mov al, 0x8e
xchg byte [0x140535860], al
lea rax, [0x140535850]
jmp 0x1401de9d6
xor eax, eax
lea rcx, [0x140535740]
lea rdx, [0x140451ea0]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
mov r11d, r10d
xor r11b, r9b
not r9b
mov ebx, r8d
and bl, r9b
or bl, r11b
not bl
xor r9b, r10b
and r9b, r8b
or r9b, bl
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x1401de9c0
inc rax
jmp 0x1401de980
movzx eax, byte [0x140535c50]
add al, 0xfb
xchg byte [0x140535742], al
lea rax, [0x140535740]
pop rbx
pop rsi
ret
Function at 0x1401f6840
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401f687c
test edx, edx
je 0x1401f68ac
movzx eax, byte [0x140536c9d]
cmp al, 0x7d
je 0x1401f6874
mov cl, 0xef
nop word cs:[rax + rax]
mov al, 0xeb
lock cmpxchg byte [0x140536c9d], cl
je 0x1401f691c
cmp al, 0x7d
jne 0x1401f6860
lea rax, [0x140536c90]
ret
test edx, edx
je 0x1401f68ec
movzx eax, byte [0x140536dad]
cmp al, 0xad
je 0x1401f68a4
mov cl, 0xda
nop dword [rax]
mov al, 0x89
lock cmpxchg byte [0x140536dad], cl
je 0x1401f6958
cmp al, 0xad
jne 0x1401f6890
lea rax, [0x140536da0]
ret
movzx eax, byte [0x140536780]
movzx ecx, byte [0x1405379a8]
add cl, 0xac
cmp al, cl
je 0x1401f68e4
mov cl, 0xe8
nop word cs:[rax + rax]
mov al, 0x14
lock cmpxchg byte [0x140536780], cl
je 0x1401f6988
cmp al, 0xe6
jne 0x1401f68d0
lea rax, [0x140536770]
ret
movzx eax, byte [0x14053714d]
cmp al, 0xf7
je 0x1401f6914
mov cl, 0x60
nop dword [rax]
mov al, 0xcf
lock cmpxchg byte [0x14053714d], cl
je 0x1401f69d8
cmp al, 0xf7
jne 0x1401f6900
lea rax, [0x140537140]
ret
xor eax, eax
lea rcx, [0x140536c90]
lea rdx, [0x140452f00]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401f6948
inc rax
jmp 0x1401f6930
mov al, 0x7d
xchg byte [0x140536c9d], al
lea rax, [0x140536c90]
ret
xor eax, eax
lea rcx, [0x140536da0]
lea rdx, [0x140453000]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401f69b8
inc rax
jmp 0x1401f6970
xor eax, eax
lea rcx, [0x140536770]
lea rdx, [0x140452a00]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1401f69c8
inc rax
jmp 0x1401f69a0
mov al, 0xad
xchg byte [0x140536dad], al
lea rax, [0x140536da0]
ret
mov al, 0xe6
xchg byte [0x140536780], al
lea rax, [0x140536770]
ret
xor edx, edx
lea rax, [0x140537140]
lea rcx, [0x140453370]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x1401f69f0
mov al, 0xf7
xchg byte [0x14053714d], al
lea rax, [0x140537140]
ret