joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401e9120
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401e916c
mov eax, 0x1440fe9b
add eax, dword [0x140557394]
cmp edx, eax
jne 0x1401e91cc
movzx eax, byte [0x1405572f9]
cmp al, 0x73
je 0x1401e9164
mov cl, 0x98
nop word cs:[rax + rax]
mov al, 0xe7
lock cmpxchg byte [0x1405572f9], cl
je 0x1401e923c
cmp al, 0x73
jne 0x1401e9150
lea rax, [0x1405572f0]
ret
test edx, edx
je 0x1401e9213
movzx eax, byte [0x1405572d3]
nop dword [rax + rax]
cmp al, 0xe7
je 0x1401e92e9
movzx ecx, byte [0x140557390]
lea eax, [rcx + 0x15]
add cl, 0x61
lock cmpxchg byte [0x1405572d3], cl
jne 0x1401e9180
xor eax, eax
lea rcx, [0x1405572b0]
lea rdx, [0x1404720e0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1401e92e1
inc rax
jmp 0x1401e91b0
movzx eax, byte [0x1405572ef]
movzx ecx, byte [0x140557390]
add cl, 0xf1
cmp al, cl
je 0x1401e920b
nop word cs:[rax + rax]
movzx ecx, byte [0x140557390]
lea eax, [rcx + 0x5d]
add cl, 0x51
lock cmpxchg byte [0x1405572ef], cl
je 0x1401e9278
cmp al, 0xe0
jne 0x1401e91f0
lea rax, [0x1405572e0]
ret
movzx eax, byte [0x140557239]
cmp al, 0xf3
je 0x1401e9234
mov cl, 0xff
mov al, 0x1f
lock cmpxchg byte [0x140557239], cl
je 0x1401e92f1
cmp al, 0xf3
jne 0x1401e9220
lea rax, [0x140557210]
ret
xor eax, eax
lea rcx, [0x1405572f0]
lea rdx, [0x140472120]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1401e92d1
inc rax
jmp 0x1401e9250
xor edx, edx
lea rax, [0x1405572e0]
lea rcx, [0x140472110]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140557394]
add edx, r8d
add edx, 0x1440fe9c
cmp edx, 0xf
jl 0x1401e9290
mov al, pe_nt_image_headers64
xchg byte [0x1405572ef], al
lea rax, [0x1405572e0]
ret
mov al, 0x73
xchg byte [0x1405572f9], al
lea rax, [0x1405572f0]
ret
mov al, 0xe7
xchg byte [0x1405572d3], al
lea rax, [0x1405572b0]
ret
xor eax, eax
lea rcx, [0x140557210]
lea rdx, [0x140472050]
mov r8d, 0x1440fec4
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140557394]
add r10d, r8d
cmp r9d, r10d
jge 0x1401e9331
inc rax
jmp 0x1401e9310
mov al, 0xf3
xchg byte [0x140557239], al
lea rax, [0x140557210]
ret
Function at 0x1401fcbe0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rcx + 0x68], xmm0
movups xmmword [rcx + 0x58], xmm0
movups xmmword [rcx + 0x48], xmm0
movups xmmword [rcx + 0x38], xmm0
movups xmmword [rcx + 0x28], xmm0
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 8], xmm0
mov rdi, qword [rcx + 0x78]
mov rbx, qword [rcx + 0x80]
cmp rdi, rbx
je 0x1401fcc54
nop dword [rax]
mov eax, dword [0x140559ea0]
lea edx, [rax + 0x381efbde]
mov ecx, eax
xor ecx, 0x10afa4d4
not eax
and eax, 0x6f505b2b
or eax, ecx
not eax
lea r8d, [rcx + rax*2]
mov rcx, rdi
call fcn.1401fec10
add rdi, 0x40
cmp rdi, rbx
jne 0x1401fcc20
mov rax, qword [rsi + 0x78]
mov qword [rsi + 0x80], rax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1401fe6e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
test ecx, ecx
je 0x1401fe719
test edx, edx
je 0x1401fe7e4
movzx eax, byte [0x140559af0]
cmp al, 0xae
je 0x1401fe8a9
mov cl, 0x90
nop
mov al, 0xb4
lock cmpxchg byte [0x140559af0], cl
je 0x1401fe859
cmp al, 0xae
jne 0x1401fe700
jmp 0x1401fe8a9
test edx, edx
je 0x1401fe819
movzx eax, byte [0x140559a35]
nop dword [rax + rax]
cmp al, 0xd
je 0x1401fe7d8
movzx ecx, byte [0x140559eb0]
lea eax, [rcx - 0x37]
mov edx, ecx
xor dl, 0xd2
and cl, 0x52
add cl, cl
add cl, dl
lock cmpxchg byte [0x140559a35], cl
jne 0x1401fe730
xor edx, edx
lea rax, [0x140559a20]
lea rcx, [0x1404730c0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140559ea0]
lea r9d, [r8 + 0x6e995980]
mov r10d, edx
not r10d
mov r11d, 0x9166a67f
sub r11d, r8d
mov esi, edx
and esi, r11d
and r11d, r10d
and r10d, r9d
or esi, r10d
xor edx, r9d
or r11d, edx
not r11d
lea edx, [rsi + r11*2]
add r8d, 0x6e995994
cmp edx, r8d
jl 0x1401fe770
mov al, 0xd
xchg byte [0x140559a35], al
lea rax, [0x140559a20]
jmp 0x1401fe966
movzx eax, byte [0x140559ac0]
cmp al, 0x8e
je 0x1401fe8f0
mov cl, 0x1b
nop word cs:[rax + rax]
mov al, 0x70
lock cmpxchg byte [0x140559ac0], cl
je 0x1401fe8b5
cmp al, 0x8e
jne 0x1401fe800
jmp 0x1401fe8f0
movzx eax, byte [0x1405599a2]
movzx ecx, byte [0x140559eb0]
add cl, 0xfb
cmp al, cl
je 0x1401fe95f
mov cl, 0xcf
nop word cs:[rax + rax]
mov al, 0x1b
lock cmpxchg byte [0x1405599a2], cl
je 0x1401fe8f9
cmp al, 0x4c
jne 0x1401fe840
jmp 0x1401fe95f
xor edx, edx
lea rax, [0x140559ae0]
lea rcx, [0x140473170]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140559ea0]
add edx, r8d
add edx, 0x6e995980
cmp edx, 0x10
jl 0x1401fe870
mov al, 0xae
xchg byte [0x140559af0], al
lea rax, [0x140559ae0]
jmp 0x1401fe966
xor eax, eax
lea rcx, [0x140559ab0]
lea rdx, [0x140473150]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1401fe8e8
inc rax
jmp 0x1401fe8d0
mov al, 0x8e
xchg byte [0x140559ac0], al
lea rax, [0x140559ab0]
jmp 0x1401fe966
xor eax, eax
lea rcx, [0x1405599a0]
lea rdx, [0x140473050]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
mov r11d, r10d
xor r11b, r9b
not r9b
mov ebx, r8d
and bl, r9b
or bl, r11b
not bl
xor r9b, r10b
and r9b, r8b
or r9b, bl
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x1401fe950
inc rax
jmp 0x1401fe910
movzx eax, byte [0x140559eb0]
add al, 0xfb
xchg byte [0x1405599a2], al
lea rax, [0x1405599a0]
pop rbx
pop rsi
ret
Function at 0x1402167d0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14021680c
test edx, edx
je 0x14021683c
movzx eax, byte [0x14055aefd]
cmp al, 0x7d
je 0x140216804
mov cl, 0xef
nop word cs:[rax + rax]
mov al, 0xeb
lock cmpxchg byte [0x14055aefd], cl
je 0x1402168ac
cmp al, 0x7d
jne 0x1402167f0
lea rax, [0x14055aef0]
ret
test edx, edx
je 0x14021687c
movzx eax, byte [0x14055b00d]
cmp al, 0xad
je 0x140216834
mov cl, 0xda
nop dword [rax]
mov al, 0x89
lock cmpxchg byte [0x14055b00d], cl
je 0x1402168e8
cmp al, 0xad
jne 0x140216820
lea rax, [0x14055b000]
ret
movzx eax, byte [0x14055a9e0]
movzx ecx, byte [0x14055bc08]
add cl, 0xac
cmp al, cl
je 0x140216874
mov cl, 0xe8
nop word cs:[rax + rax]
mov al, 0x14
lock cmpxchg byte [0x14055a9e0], cl
je 0x140216918
cmp al, 0xe6
jne 0x140216860
lea rax, [0x14055a9d0]
ret
movzx eax, byte [0x14055b3ad]
cmp al, 0xf7
je 0x1402168a4
mov cl, 0x60
nop dword [rax]
mov al, 0xcf
lock cmpxchg byte [0x14055b3ad], cl
je 0x140216968
cmp al, 0xf7
jne 0x140216890
lea rax, [0x14055b3a0]
ret
xor eax, eax
lea rcx, [0x14055aef0]
lea rdx, [0x1404740b0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1402168d8
inc rax
jmp 0x1402168c0
mov al, 0x7d
xchg byte [0x14055aefd], al
lea rax, [0x14055aef0]
ret
xor eax, eax
lea rcx, [0x14055b000]
lea rdx, [0x1404741b0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140216948
inc rax
jmp 0x140216900
xor eax, eax
lea rcx, [0x14055a9d0]
lea rdx, [0x140473bb0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140216958
inc rax
jmp 0x140216930
mov al, 0xad
xchg byte [0x14055b00d], al
lea rax, [0x14055b000]
ret
mov al, 0xe6
xchg byte [0x14055a9e0], al
lea rax, [0x14055a9d0]
ret
xor edx, edx
lea rax, [0x14055b3a0]
lea rcx, [0x140474520]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x140216980
mov al, 0xf7
xchg byte [0x14055b3ad], al
lea rax, [0x14055b3a0]
ret
Function at 0x140219780
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1402197bc
test edx, edx
je 0x1402197fc
movzx eax, byte [0x14055ae61]
cmp al, 0x19
je 0x1402197b4
mov cl, 0x2e
nop word [rax + rax]
mov al, 0x25
lock cmpxchg byte [0x14055ae61], cl
je 0x14021989c
cmp al, 0x19
jne 0x1402197a0
lea rax, [0x14055ae50]
ret
test edx, edx
je 0x14021986c
movzx eax, byte [0x14055a9c3]
cmp al, 0x8c
je 0x1402197f4
mov cl, 0x85
nop word cs:[rax + rax]
mov al, 0xb5
lock cmpxchg byte [0x14055a9c3], cl
je 0x1402198f8
cmp al, 0x8c
jne 0x1402197e0
lea rax, [0x14055a9c0]
ret
movzx eax, byte [0x14055af10]
nop word cs:[rax + rax]
cmp al, 0xff
je 0x1402198f0
movzx ecx, byte [0x14055bc08]
mov eax, r8d
xor al, 0x37
add al, cl
mov edx, r8d
xor dl, 0x35
add dl, cl
lock cmpxchg byte [0x14055af10], dl
jne 0x140219810
xor eax, eax
lea rcx, [0x14055af00]
lea rdx, [0x1404740c0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1402198e8
inc rax
jmp 0x140219850
movzx eax, byte [0x14055affd]
cmp al, 0x57
je 0x140219894
mov cl, 0x99
nop dword [rax]
mov al, 0xea
lock cmpxchg byte [0x14055affd], cl
je 0x140219938
cmp al, 0x57
jne 0x140219880
lea rax, [0x14055aff0]
ret
xor eax, eax
lea rcx, [0x14055ae50]
lea rdx, [0x140474010]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x1402198d8
inc rax
jmp 0x1402198b0
mov al, 0x19
xchg byte [0x14055ae61], al
lea rax, [0x14055ae50]
ret
mov al, 0xff
xchg byte [0x14055af10], al
lea rax, [0x14055af00]
ret
xor eax, eax
lea rcx, [0x14055a9c0]
lea rdx, [0x140473ba0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x140219928
inc rax
jmp 0x140219910
mov al, 0x8c
xchg byte [0x14055a9c3], al
lea rax, [0x14055a9c0]
ret
xor eax, eax
lea rcx, [0x14055aff0]
lea rdx, [0x1404741a0]
xor r8d, 0x4186bf07
nop
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x14055bc00]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 0xd
jl 0x140219950
mov al, 0x57
xchg byte [0x14055affd], al
lea rax, [0x14055aff0]
ret
Function at 0x14026e3e0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14026e436
mov eax, dword [0x1405675b8]
mov ecx, eax
xor ecx, 0x22932e3a
and eax, 0x22932e3a
lea eax, [rcx + rax*2]
cmp edx, eax
jne 0x14026e476
movzx eax, byte [0x1405672f4]
cmp al, 0x60
je 0x14026e42e
mov cl, 0x20
nop dword [rax + rax]
mov al, 0x5b
lock cmpxchg byte [0x1405672f4], cl
je 0x14026e536
movzx edx, byte [0x1405675bc]
add dl, 0xae
cmp al, dl
jne 0x14026e410
lea rax, [0x1405672f0]
ret
test edx, edx
je 0x14026e501
movzx eax, byte [0x14056745d]
cmp al, 0xde
je 0x14026e46e
mov cl, 0x8f
nop dword [rax + rax]
mov al, 0xe
lock cmpxchg byte [0x14056745d], cl
je 0x14026e588
movzx edx, byte [0x1405675bc]
add dl, 0x2c
cmp al, dl
jne 0x14026e450
lea rax, [0x140567450]
ret
movzx eax, byte [0x14056756d]
nop dword [rax]
cmp al, 0xae
je 0x14026e4f9
movzx ecx, byte [0x1405675bc]
lea eax, [rcx - 0x27]
add cl, 0xad
lock cmpxchg byte [0x14056756d], cl
jne 0x14026e480
xor edx, edx
lea rax, [0x140567560]
lea rcx, [0x140477d30]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x1405675b8]
add edx, r8d
add edx, 0x22932e3b
cmp edx, 0xd
jl 0x14026e4b0
movzx eax, byte [0x1405675bc]
mov ecx, eax
xor cl, 0xfc
and al, 0x7c
add al, al
add al, cl
xchg byte [0x14056756d], al
lea rax, [0x140567560]
ret
movzx eax, byte [0x1405673df]
cmp al, 0xbd
je 0x14026e52e
mov cl, 0x1a
nop
mov al, 0x44
lock cmpxchg byte [0x1405673df], cl
je 0x14026e5cf
movzx edx, byte [0x1405675bc]
add dl, 0xb
cmp al, dl
jne 0x14026e510
lea rax, [0x1405673d0]
ret
xor eax, eax
lea rcx, [0x1405672f0]
lea rdx, [0x140477ae0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x14026e578
inc rax
jmp 0x14026e550
mov al, 0x60
xchg byte [0x1405672f4], al
lea rax, [0x1405672f0]
ret
xor eax, eax
lea rcx, [0x140567450]
lea rdx, [0x140477c20]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14026e5b8
inc rax
jmp 0x14026e5a0
movzx eax, byte [0x1405675bc]
add al, 0x2c
xchg byte [0x14056745d], al
lea rax, [0x140567450]
ret
xor eax, eax
lea rcx, [0x1405673d0]
lea rdx, [0x140477ba0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x14026e5f8
inc rax
jmp 0x14026e5e0
mov al, 0xbd
xchg byte [0x1405673df], al
lea rax, [0x1405673d0]
ret
Function at 0x14026e670
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x14026e6a9
test edx, edx
je 0x14026e6f9
movzx eax, byte [0x14056746c]
cmp al, 0x20
je 0x14026e7d0
mov cl, 0x4c
nop
mov al, 0x19
lock cmpxchg byte [0x14056746c], cl
je 0x14026e795
cmp al, 0x20
jne 0x14026e690
jmp 0x14026e7d0
mov eax, r8d
xor eax, 0x3e4b9f70
add eax, dword [0x1405675b8]
cmp edx, eax
jne 0x14026e755
movzx eax, byte [0x1405673c3]
mov ecx, r8d
xor cl, 0xb7
add cl, byte [0x1405675bc]
cmp al, cl
je 0x14026e8f0
mov cl, 0x99
nop dword [rax]
mov al, 0x22
lock cmpxchg byte [0x1405673c3], cl
je 0x14026e84d
cmp al, 0xaf
jne 0x14026e6e0
jmp 0x14026e8f0
movzx eax, byte [0x1405674af]
movzx ecx, byte [0x1405675bc]
mov edx, r8d
xor dl, 0x69
mov r9d, edx
xor r9b, cl
and dl, cl
add dl, dl
add dl, r9b
cmp al, dl
je 0x14026e844
mov cl, 0x54
nop word cs:[rax + rax]
mov al, 0xf8
lock cmpxchg byte [0x1405674af], cl
je 0x14026e7d9
mov edx, r8d
xor dl, 0x69
add dl, byte [0x1405675bc]
cmp al, dl
jne 0x14026e730
jmp 0x14026e844
movzx eax, byte [0x1405674bd]
cmp al, 0xe2
je 0x14026e8df
mov cl, 0x53
nop word cs:[rax + rax]
mov al, 0x22
lock cmpxchg byte [0x1405674bd], cl
je 0x14026e891
mov edx, r8d
xor dl, 0x7a
add dl, byte [0x1405675bc]
cmp al, dl
jne 0x14026e770
jmp 0x14026e8df
xor eax, eax
lea rcx, [0x140567460]
lea rdx, [0x140477c30]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x14026e7c8
inc rax
jmp 0x14026e7b0
mov al, 0x20
xchg byte [0x14056746c], al
lea rax, [0x140567460]
pop rsi
ret
xor r9d, r9d
lea rax, [0x1405674a0]
lea rcx, [0x140477c70]
mov edx, r8d
xor edx, 0x3e4b9f71
xor r8d, 0x3e4b9f03
nop word [rax + rax]
movsxd r9, r9d
movzx r10d, byte [r9 + rcx]
mov r11d, r10d
xor r11b, r10b
not r11b
and r11b, byte [r9 + rax]
xor r11b, r10b
mov byte [r9 + rax], r11b
mov r10d, dword [0x1405675b8]
lea r11d, [rdx + r10]
mov esi, r9d
xor esi, r11d
and r9d, r11d
lea r9d, [rsi + r9*2]
add r10d, r8d
cmp r9d, r10d
jl 0x14026e800
mov al, 0xd5
xchg byte [0x1405674af], al
lea rax, [0x1405674a0]
pop rsi
ret
xor eax, eax
lea rcx, [0x1405673a0]
lea rdx, [0x140477b70]
xor r8d, 0x3e4b9f17
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405675b8]
add r10d, r8d
cmp r9d, r10d
jge 0x14026e8e8
inc rax
jmp 0x14026e870
xor eax, eax
lea rcx, [0x1405674b0]
lea rdx, [0x140477c80]
xor r8d, 0x3e4b9f71
nop dword [rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x1405675b8]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 0xd
jl 0x14026e8b0
mov al, 0xe2
xchg byte [0x1405674bd], al
lea rax, [0x1405674b0]
pop rsi
ret
mov al, 0xaf
xchg byte [0x1405673c3], al
lea rax, [0x1405673a0]
pop rsi
ret
Function at 0x140274e90
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140569108]
movabs rcx, 0xf9a35477669cfa31
movabs rdx, 0xf3133d3fd397e6b7
add rdx, rcx
movabs r8, 0x9bbdac2fa780a04c
sub rdx, r8
sub rdx, rcx
mov rcx, rdx
xor rcx, rax
and rdx, rax
lea rax, [rcx + rdx*2]
add rax, r8
cmp qword [rbx + 0x18], rax
je 0x14027506d
lea rdi, [rbx + 8]
cmp byte [0x1405b47c0], 0
jne 0x140274f50
mov eax, 0xffff62cd
add eax, dword [0x140567b34]
cdqe
add rax, qword [0x140567b40]
mov rcx, rbx
call qword [case.0x14013082b.0]
mov ecx, eax
mov edx, dword [0x1405b47b8]
lea eax, [rdx - 1]
imul eax, edx
mov r8d, dword [0x140569100]
mov edx, r8d
xor edx, 0x4aefac7c
mov r9d, r8d
and r9d, 0x4aefac7c
lea r9d, [rdx + r9*2]
xor edx, edx
div r9d
add r8d, 0x4aefac7a
cmp edx, r8d
je 0x140274f96
nop
mov eax, 0x809adc47
sub eax, dword [0x140567b34]
mov ecx, eax
xor ecx, 0x7f65c0ec
and eax, 0x7f65c0ec
lea eax, [rcx + rax*2]
mov ecx, dword [0x140569100]
neg eax
add eax, ecx
add eax, 0x4aefac7a
cdqe
add rax, qword [0x140567b40]
mov rcx, rbx
call qword [case.0x14013082b.0]
test rbx, rbx
je 0x140274f50
jmp 0x140274ef4
test cl, cl
je 0x140274fb0
mov eax, 0xffff62cd
add eax, dword [0x140567b30]
cdqe
add rax, qword [0x140567b50]
jmp 0x140274fca
mov eax, dword [0x140567b38]
sub eax, dword [0x140569100]
add eax, 0xb50fb653
cdqe
add rax, qword [0x140567b58]
mov rcx, rsi
call qword [case.0x14013082b.0]
mov r8, qword [rbx + 0x18]
cmp qword [rbx + 0x20], 0x10
jb 0x140274fe2
mov rdi, qword [rbx + 8]
lea rbx, [rsi + 8]
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x20]
mov rdx, rax
sub rdx, rcx
cmp rdx, r8
jae 0x140275023
mov eax, 0xffff62cd
add eax, dword [0x140567b3c]
cdqe
add rax, qword [0x140567b48]
mov qword [rsp + 0x20], r8
mov rcx, rbx
mov rdx, r8
mov r9, rdi
call qword [case.0x14013082b.0]
jmp 0x14027506d
mov rdx, r8
not rdx
mov r9, rcx
xor r9, rdx
xor rdx, r8
and rdx, rcx
xor rdx, r8
and r9, rcx
movabs r10, 0x52d1ad84af96f83a
sub rdx, r10
lea r14, [rdx + r9*2]
add r14, r10
mov qword [rsi + 0x18], r14
cmp rax, 0x10
jb 0x14027505d
mov rbx, qword [rsi + 8]
add rcx, rbx
mov rdx, rdi
call fcn.14044e610
mov byte [rbx + r14], 0
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14029c100
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x14056d940]
mov r8d, eax
xor r8d, 0xc0bc3fff
and eax, 0x40bc3fff
lea eax, [r8 + rax*2]
cmp ecx, eax
jne 0x14029c15c
mov eax, 0xc0bc3fff
add eax, dword [0x14056d940]
cmp edx, eax
jne 0x14029c188
movzx eax, byte [0x14056cc94]
cmp al, 0x53
je 0x14029c154
mov cl, 0x35
nop dword [rax]
mov al, 0xf
lock cmpxchg byte [0x14056cc94], cl
je 0x14029c25a
cmp al, 0x53
jne 0x14029c140
lea rax, [0x14056cc80]
ret
test edx, edx
je 0x14029c1bc
movzx eax, byte [0x14056ccba]
cmp al, 0x4b
je 0x14029c180
mov cl, 0x31
nop dword [rax]
mov al, pe_nt_image_headers64
lock cmpxchg byte [0x14056ccba], cl
je 0x14029c1ec
cmp al, 0x4b
jne 0x14029c170
lea rax, [0x14056ccb0]
ret
movzx eax, byte [0x14056cd56]
movzx ecx, byte [0x14056d950]
add cl, 0x12
cmp al, cl
je 0x14029c1b4
mov cl, 0xed
nop
mov al, 0xd2
lock cmpxchg byte [0x14056cd56], cl
je 0x14029c2bc
cmp al, 0x2d
jne 0x14029c1a0
lea rax, [0x14056cd40]
ret
movzx eax, byte [0x14056cca4]
cmp al, 0x64
je 0x14029c1e4
mov cl, 0x61
nop dword [rax]
mov al, 0x94
lock cmpxchg byte [0x14056cca4], cl
je 0x14029c305
cmp al, 0x64
jne 0x14029c1d0
lea rax, [0x14056cca0]
ret
xor eax, eax
lea rcx, [0x14056ccb0]
lea rdx, [0x140479bc0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
mov r9d, dword [0x14056d940]
mov r10d, r9d
xor r10d, 0x40ea7758
and r9d, 0x40ea7758
lea r9d, [r10 + r9*2]
add r9d, 0x7fd1c8b1
cmp r8d, r9d
jge 0x14029c24a
inc rax
jmp 0x14029c200
mov al, 0x4b
xchg byte [0x14056ccba], al
lea rax, [0x14056ccb0]
ret
xor edx, edx
lea rax, [0x14056cc80]
lea rcx, [0x140479b90]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x14056d940]
mov r9d, edx
xor r9d, 0xb1744dd0
and edx, 0x31744dd0
lea edx, [r9 + rdx*2]
add edx, r8d
add edx, 0xf47f230
cmp edx, 0x14
jl 0x14029c270
movzx eax, byte [0x14056d950]
add al, 0x38
xchg byte [0x14056cc94], al
lea rax, [0x14056cc80]
ret
xor edx, edx
lea rax, [0x14056cd40]
lea rcx, [0x140479c40]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0x7ffffffe
and r8d, edx
xor edx, 1
lea edx, [rdx + r8*2]
cmp edx, 0x16
jl 0x14029c2d0
mov al, 0x2d
xchg byte [0x14056cd56], al
lea rax, [0x14056cd40]
ret
xor eax, eax
lea rcx, [0x14056cca0]
lea rdx, [0x140479bb0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x14029c338
inc rax
jmp 0x14029c320
movzx eax, byte [0x14056d950]
mov ecx, eax
xor cl, 0x49
and al, 0x49
add al, al
add al, cl
xchg byte [0x14056cca4], al
lea rax, [0x14056cca0]
ret
Function at 0x1402d5110
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1402d514c
test edx, edx
je 0x1402d51cf
movzx eax, byte [0x140577bf3]
cmp al, 0x94
je 0x1402d5144
mov cl, 0x2e
nop
mov al, 0x21
lock cmpxchg byte [0x140577bf3], cl
je 0x1402d524c
cmp al, 0x94
jne 0x1402d5130
lea rax, [0x140577bd0]
ret
test edx, edx
je 0x1402d51fc
movzx eax, byte [0x140577a80]
nop dword [rax + rax]
cmp al, 3
je 0x1402d52af
movzx ecx, byte [0x140577c2c]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0x97
mov eax, r8d
and al, 0x68
or al, r9b
add al, cl
and dl, 0x5e
mov r9d, r8d
and r9b, 0xa1
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x140577a80], r9b
jne 0x1402d5160
xor eax, eax
lea rcx, [0x140577980]
lea rdx, [0x140480200]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xff
jg 0x1402d52a7
inc rax
jmp 0x1402d51b0
movzx eax, byte [0x140577c0f]
cmp al, 0x83
je 0x1402d51f4
mov cl, 0x85
nop dword [rax]
mov al, 0x20
lock cmpxchg byte [0x140577c0f], cl
je 0x1402d52b7
cmp al, 0x83
jne 0x1402d51e0
lea rax, [0x140577c00]
ret
movzx eax, byte [0x140577aae]
cmp al, 0x3b
je 0x1402d5244
nop word [rax + rax]
movzx ecx, byte [0x140577c2c]
mov eax, r8d
xor al, 0xf3
add al, cl
mov edx, r8d
xor dl, 0xf6
add dl, cl
lock cmpxchg byte [0x140577aae], dl
je 0x1402d531b
mov ecx, r8d
xor cl, 0x9b
add cl, byte [0x140577c2c]
cmp al, cl
jne 0x1402d5210
lea rax, [0x140577a90]
ret
xor eax, eax
lea rcx, [0x140577bd0]
lea rdx, [0x140480430]
nop dword [rax]
xor r8d, r8d
sub r8b, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
xor r10d, r10d
sub r10b, r9b
mov r9d, r8d
xor r9b, r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
neg r10b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1402d5297
inc rax
jmp 0x1402d5260
mov al, 0x94
xchg byte [0x140577bf3], al
lea rax, [0x140577bd0]
ret
mov al, 3
xchg byte [0x140577a80], al
lea rax, [0x140577980]
ret
xor eax, eax
lea rcx, [0x140577c00]
lea rdx, [0x140480460]
mov r9d, r8d
xor r9d, 0xbb7172c0
nop word cs:[rax + rax]
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x140577c28]
add r11d, r9d
cmp r10d, r11d
jge 0x1402d5301
inc rax
jmp 0x1402d52e0
xor r8b, 0x53
add r8b, byte [0x140577c2c]
xchg byte [0x140577c0f], r8b
lea rax, [0x140577c00]
ret
xor eax, eax
lea rcx, [0x140577a90]
lea rdx, [0x140480300]
xor r8d, 0xbb7172f2
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
mov r9d, dword [0x140577c28]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 0x1e
jl 0x1402d5340
mov al, 0x3b
xchg byte [0x140577aae], al
lea rax, [0x140577a90]
ret