joyce8/EMBER2024-capa huggingface dataset:
Function at 0x201b35f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rdx + 8]
test rcx, rcx
je 0x201b3673
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
mov r8, qword [case.0x200fc05d.0]
mov qword [rbp - 0x10], 0
lea rdx, [rbp - 8]
call r8
mov r13, qword [rbp - 8]
test r13, r13
je 0x201b3676
mov rax, qword [r13]
mov rax, qword [rax + 0x18]
mov qword [rbp - 0x18], r13
mov rcx, r13
call qword [case.0x200fc05d.0]
mov rcx, qword [rbp - 8]
test rcx, rcx
mov r13, qword [rbp - 0x18]
je 0x201b3676
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x200fc05d.0]
jmp 0x201b3676
xor r13d, r13d
mov rax, qword [rdi + 0x18]
mov r15, qword [0x2045fc68]
movsxd r12, dword [r15]
mov ebx, dword [0x20379be4]
mov qword [rsi + 0x18], rax
mov eax, dword [0x204a2a3c]
add eax, dword [rdi + 0x20]
mov dword [rsi + 0x20], eax
mov rax, qword [rdi + 0x10]
mov qword [rsi + 0x10], rax
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x201b36c5
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
mov rdx, qword [case.0x200fc05d.0]
mov qword [rbp - 0x10], r13
call rdx
mov qword [rsi + 8], r13
mov eax, dword [0x204a2998]
lea esi, [rax + 1]
mov dword [0x204a2998], esi
mov ecx, eax
not ecx
xor eax, esi
not esi
and esi, ecx
or esi, eax
xor edi, edi
xor esi, 0xffffffff
mov r14d, 0
jne 0x201b3757
mov rax, r12
xor rax, r15
and r12, r15
lea rax, [rax + r12*2]
xor ecx, ecx
mov edi, 0
mov r14d, 0
test ebx, ebx
jle 0x201b3757
xor edx, edx
xor r8d, r8d
nop word cs:[rax + rax]
movsxd rcx, ecx
mov r9, qword [rax + rcx]
mov r10, qword [rax + rcx + 8]
mov rdi, r9
xor rdi, r9
mov r14, r10
xor r14, r10
not r14
and r14, r8
xor r14, r10
not rdi
and rdi, rdx
xor rdi, r9
add ecx, 0x10
mov rdx, rdi
mov r8, r14
cmp ecx, ebx
jl 0x201b3720
test r13, r13
je 0x201b3785
mov rax, qword [r13]
mov rax, qword [rax + 0x18]
mov rdx, qword [case.0x200fc05d.0]
mov qword [rbp - 0x10], r13
mov rcx, r13
call rdx
mov rax, qword [r13]
mov rax, qword [rax + 0x20]
mov rcx, r13
call qword [case.0x200fc05d.0]
mov rcx, qword [0x20379bf8]
xor edx, edx
test esi, esi
setne dl
xor r8d, r8d
add rdx, 0xffffffffffffffff
adc r8, 0xffffffffffffffff
mov rax, qword [0x20379bf0]
sub rax, rdi
sbb rcx, r14
and rcx, r8
and rax, rdx
or rax, rcx
mov rcx, rax
shr rcx, 0x20
or ecx, eax
add dword [0x204a2a3c], ecx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x201b7470
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov r12, qword [0x204602c8]
movsxd r14, dword [r12]
mov rdi, rdx
mov rbx, rcx
mov r15d, dword [0x2037aa2c]
mov eax, 0xffff9d1a
add eax, dword [0x20460350]
cdqe
add rax, qword [0x20460378]
lea rdx, [rbp - 0x40]
mov rcx, r8
mov r8d, 0xafc2dd8b
call qword [case.0x200fc05d.0]
test rdi, rdi
sete al
setne cl
test dil, 0xf
setne dl
sete r8b
xor r8b, cl
and dl, al
or dl, r8b
mov esi, 0xffffffff
cmp dl, 1
je 0x201b7534
lea rcx, [rbp - 0x18]
lea rdx, [rbp - 0x40]
call fcn.20188210
lea rcx, [rbp - 0x18]
mov rdx, rbx
mov r8, rdi
call fcn.20259fd0
mov qword [rbp - 0x10], 0
lea r8, [rbp - 0x10]
mov rcx, rbx
mov rdx, rdi
call fcn.2023c390
mov ecx, dword [0x204a1cc8]
add ecx, dword [rbp - 0x10]
xor esi, esi
neg eax
sbb esi, esi
or esi, ecx
mov rdi, qword [rbp - 0x38]
mov eax, dword [0x204602c0]
mov ecx, eax
xor ecx, 1
mov edx, eax
and edx, 1
lea edx, [rcx + rdx*2]
mov dword [0x204602c0], edx
xor ecx, ecx
test eax, edx
jne 0x201b7582
add r14, r12
test r15d, r15d
jle 0x201b7582
xor r8d, r8d
xor ecx, ecx
nop word cs:[rax + rax]
movsxd r9, r8d
add r9, r14
xor ecx, dword [r9]
add r8d, 4
cmp r8d, r15d
jl 0x201b7570
test rdi, rdi
je 0x201b7613
mov rbx, qword [rbp - 0x28]
and eax, edx
mov edx, dword [0x2037aa38]
xor r8d, r8d
cmp eax, 1
sbb r8d, r8d
sub edx, ecx
and edx, r8d
mov eax, edx
add rax, qword [0x204a1cc8]
mov qword [0x204a1cc8], rax
sub rbx, rdi
mov rcx, rdi
xor edx, edx
mov r8, rbx
call fcn.20354420
cmp rbx, 0xfff
jbe 0x201b75ed
mov rax, qword [0x204a2188]
add rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmp rdi, 0x20
jae 0x201b7624
add rbx, 0x27
mov rdi, rax
mov eax, 0xffff9d1a
add eax, dword [0x2046035c]
cdqe
add rax, qword [0x20460360]
mov rcx, rdi
mov rdx, rbx
mov r8d, 0xebf6dc2e
call qword [case.0x200fc05d.0]
mov eax, esi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
call fcn.2030c4cc
int3

Function at 0x201cb200
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov eax, dword [0x204a2c18]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x201cb22e
mov rcx, rsi
call fcn.2032c150
cmp dword [0x20463a84], 0xec926722
je 0x201cb281
lea rax, [fcn.201cb200]
lea edi, [rax + rax]
add edi, 0x8a0
nop
mov rcx, rsi
call fcn.2032c150
mov eax, dword [0x20463a84]
lea ecx, [rax + 0x136d98df]
xor ecx, edi
not ecx
and ecx, edi
mov edx, dword [0x20462380]
add eax, edx
add eax, 0x136d094e
cdqe
add rax, qword [0x20462390]
mov edx, 0xf054dd93
call qword [case.0x200fc05d.0]
test al, 1
je 0x201cb240
jmp 0x201cb21a
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x201eec50
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
test ecx, ecx
je 0x201eec89
test edx, edx
je 0x201eed7b
movzx eax, byte [0x20466b34]
cmp al, 0xa1
je 0x201eee10
mov cl, 0x90
mov al, 0xf1
lock cmpxchg byte [0x20466b34], cl
je 0x201eedd9
cmp al, 0xa1
jne 0x201eec70
jmp 0x201eee10
test edx, edx
je 0x201eeda9
movzx eax, byte [0x20466ca2]
nop dword [rax + rax]
cmp al, 0x7a
je 0x201eee24
movzx ecx, byte [0x204671cc]
lea eax, [rcx - 0x63]
add cl, 0x63
lock cmpxchg byte [0x20466ca2], cl
jne 0x201eeca0
xor edx, edx
mov r8d, 0xa1ba8c27
lea r9, [0x20466c90]
lea r10, [0x2037c610]
lea rax, [fcn.201eec50]
lea r11d, [rax + rax]
add r11d, 0x2520
mov esi, r11d
not esi
jmp 0x201eecfb
inc edx
cmp edx, 0x12
jge 0x201eee1c
mov eax, dword [0x204a2de4]
mov ecx, dword [0x204671c8]
add ecx, r8d
movsxd rdi, edx
cmp eax, ecx
jge 0x201eed50
nop word cs:[rax + rax]
movzx eax, byte [rdi + r10]
mov ecx, eax
xor cl, al
not cl
and cl, byte [rdi + r9]
xor cl, al
mov byte [rdi + r9], cl
mov eax, dword [0x204a2de0]
lea ecx, [rax + 1]
imul ecx, eax
test cl, 1
je 0x201eecf0
nop word cs:[rax + rax]
movzx eax, byte [rdi + r9]
movzx ecx, byte [rdi + r10]
shl al, cl
sub cl, al
mov ebx, eax
shl bl, cl
sub al, bl
mul bl
mov ecx, ebx
xor cl, bl
not cl
and cl, al
xor cl, bl
mov byte [rdi + r9], cl
test esi, r11d
jne 0x201eed50
jmp 0x201eed20
movzx eax, byte [0x20466c6a]
cmp al, 0x3a
je 0x201eee60
mov cl, 0x8b
nop dword [rax]
mov al, 0x7a
lock cmpxchg byte [0x20466c6a], cl
je 0x201eee30
cmp al, 0x3a
jne 0x201eed90
jmp 0x201eee60
movzx eax, byte [0x20466d1d]
cmp al, 0xe6
je 0x201eeea0
mov cl, 0xbb
nop word [rax + rax]
mov al, 0x58
lock cmpxchg byte [0x20466d1d], cl
je 0x201eee69
cmp al, 0xe6
jne 0x201eedc0
jmp 0x201eeea0
xor eax, eax
lea rcx, [0x20466b30]
lea rdx, [0x2037c4c0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x201eee08
inc rax
jmp 0x201eedf0
mov al, 0xa1
xchg byte [0x20466b34], al
lea rax, [0x20466b30]
jmp 0x201eeee1
mov al, 0x7a
xchg byte [0x20466ca2], al
lea rax, [0x20466c90]
jmp 0x201eeee1
xor eax, eax
lea rcx, [0x20466c50]
lea rdx, [0x2037c5d0]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x19
jg 0x201eee58
inc rax
jmp 0x201eee40
mov al, 0x3a
xchg byte [0x20466c6a], al
lea rax, [0x20466c50]
jmp 0x201eeee1
xor eax, eax
lea rcx, [0x20466d10]
lea rdx, [0x2037c690]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x201eee98
inc rax
jmp 0x201eee80
mov al, 0xe6
xchg byte [0x20466d1d], al
xor eax, eax
test al, al
jne 0x201eeec0
mov eax, dword [0x204a2de4]
mov ecx, 0xa1ba8c18
add ecx, dword [0x204671c8]
cmp eax, ecx
jl 0x201eeeda
nop dword [rax + rax]
mov eax, dword [0x204a2de0]
mov ecx, dword [0x204671c8]
add ecx, eax
inc ecx
imul ecx, eax
test cl, 1
jne 0x201eeec0
jmp 0x201eeea6
lea rax, [0x20466d10]
pop rbx
pop rdi
pop rsi
ret
Function at 0x201f2690
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov rsi, rcx
mov rcx, qword [rcx + 8]
movsxd r13, dword [0x2037cde4]
mov r12d, dword [0x2037cde0]
mov r8, rbp
mov edx, 1
mov r9d, 0xd459d379
call fcn.201f3a60
mov r15d, eax
or byte [rsi + 0x10], 1
lea rdi, [rsi + 0x20]
mov rcx, rdi
call fcn.201f2960
mov qword [rsi + 0x18], 0x7fffffff
mov qword [rsi + 0x38], 0
test r15d, r15d
je 0x201f28ac
mov rcx, qword [rsi + 8]
mov rbx, qword [rcx + 8]
mov eax, dword [0x20467a80]
lea r9d, [rax + 1]
mov dword [0x20467a80], r9d
mov qword [rbp + 8], rax
test eax, r9d
jne 0x201f2732
test r12d, r12d
jg 0x201f28c0
xor r14d, r14d
cmp byte [rcx + 0x18], 0
je 0x201f2749
cmp byte [0x204a1d19], 0
je 0x201f276f
jmp 0x201f28ac
mov rax, qword [rcx]
mov rax, qword [rax + 8]
mov edx, r15d
mov r15d, r9d
call qword [case.0x200fc05d.0]
mov r9d, r15d
mov r15d, eax
cmp byte [0x204a1d19], 0
jne 0x201f28ac
mov eax, r15d
cmp dword [rbx + rax + 0xc], 0
je 0x201f28ac
add rbx, rax
lea r15, [rbp - 0x58]
mov rax, qword [rbp + 8]
and eax, r9d
mov qword [rbp + 8], rax
jmp 0x201f27ae
cmp dword [rbx + 0x20], 0
lea rbx, [rbx + 0x14]
je 0x201f28ac
mov rdx, qword [rsi + 8]
mov rcx, r15
mov r8, rbx
mov r9d, 0x18633fad
call fcn.201f3a80
mov rdx, qword [rsi + 0x28]
cmp rdx, qword [rsi + 0x30]
je 0x201f27e0
mov rcx, rdi
mov r8, r15
call fcn.201f3390
add qword [rsi + 0x28], 0x58
jmp 0x201f2817
movzx eax, byte [0x2037cdec]
cmp dword [rbp + 8], 1
mov ecx, 0
sbb ecx, ecx
sub al, r14b
not al
xor al, cl
test al, cl
setne al
or al, byte [0x204a1d19]
and al, 1
mov byte [0x204a1d19], al
mov rcx, rdi
mov r8, r15
call fcn.201f31b0
lea rcx, [rbp - 0x18]
call fcn.201f2ad0
mov rax, qword [rbp - 0x30]
cmp rax, 0x10
jb 0x201f285f
mov rcx, qword [rbp - 0x48]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x201f285a
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x201f28e5
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.200807c0
mov r13, qword [rsi + 0x28]
add r13, 0xffffffffffffffa8
mov rcx, r13
mov edx, 0xe8ec0ad1
call fcn.201f3a90
mov rcx, r13
mov edx, 0x9f27020
call fcn.201f3a50
mov r12d, eax
mov rcx, r13
mov edx, 0xde331f1
call fcn.201f3aa0
cmp r12d, dword [rsi + 0x18]
jae 0x201f289b
mov dword [rsi + 0x18], r12d
cmp eax, dword [rsi + 0x1c]
jbe 0x201f27a0
mov dword [rsi + 0x1c], eax
jmp 0x201f27a0
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor eax, eax
lea rdx, [0x2037cde4]
xor r14d, r14d
nop dword [rax]
lea r8, [rax + r13]
xor r14b, byte [rdx + r8]
inc rax
cmp eax, r12d
jl 0x201f28d0
jmp 0x201f2735
call fcn.2030c4cc
int3
Function at 0x201fee10
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov r13, qword [0x20468b88]
mov rdi, rdx
mov rax, rcx
movsxd r15, dword [r13]
mov r12d, dword [0x2037dd80]
test rdx, rdx
je 0x201fee8e
mov qword [rbp - 0x30], rax
lea rbx, [rbp - 0x20]
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 7
mov word [rbp - 0x20], 0
mov rcx, rdi
mov edx, 0xdc2f752e
call fcn.20081110
mov r14, rax
cmp rax, 7
jbe 0x201feea2
mov rcx, rbx
mov rdx, r14
mov r9, rdi
call fcn.20075b40
jmp 0x201feebf
cmp qword [rax + 0x20], 0x10
jb 0x201fefbb
mov rcx, qword [rax + 8]
jmp 0x201fefbf
mov qword [rbp - 0x10], r14
mov r8, r14
add r8, r14
mov rcx, rbx
mov rdx, rdi
call fcn.20353d70
mov word [rbp + r14*2 - 0x20], 0
lea rax, [0x2036e6c0]
mov qword [rbp - 0x28], rax
mov edi, dword [0x20468b78]
lea ebx, [rdi + 1]
mov dword [0x20468b78], ebx
xor r14d, r14d
mov esi, 0
test edi, ebx
mov rcx, qword [rbp - 0x30]
jne 0x201fef25
xor eax, eax
mov r14d, 0
mov esi, 0
test r12d, r12d
jle 0x201fef25
add r15, r13
xor r14d, r14d
xor esi, esi
nop word cs:[rax + rax]
movsxd rdx, eax
add rdx, r15
xor r14, qword [rdx]
xor rsi, qword [rdx + 8]
add eax, 0x10
cmp eax, r12d
jl 0x201fef10
lea rdx, [rbp - 0x28]
call fcn.201fe050
mov r11, qword [rbp - 8]
cmp r11, 8
jb 0x201fefe4
mov rdx, qword [rbp - 0x20]
mov rcx, qword [0x2037dd90]
mov r8, qword [0x2037dd88]
xor r9d, r9d
test edi, ebx
setne r9b
xor r10d, r10d
add r9, 0xffffffffffffffff
adc r10, 0xffffffffffffffff
sub r8, r14
sbb rcx, rsi
and r8, r9
and rcx, r10
or rcx, r8
add qword [0x204a2690], rcx
lea r8, [r11 + r11]
add r8, 2
cmp r8, 0x1000
jb 0x201fefcc
mov rcx, qword [0x204a2690]
add rcx, qword [rdx - 8]
sub rdx, rcx
add rdx, 0xfffffffffffffff8
cmp rdx, 0x20
jae 0x201feff5
mov rsi, rax
add r11, r11
mov rdx, r11
xor rdx, 0x29
and r11d, 0x29
lea r8, [rdx + r11*2]
mov rdx, rcx
jmp 0x201fefcf
lea rcx, [rax + 8]
mov qword [rax + 0x18], 0
mov byte [rcx], 0
jmp 0x201fefe4
mov rsi, rax
mov dword [rsp + 0x20], 0xfaf5f4c4
xor ecx, ecx
xor r9d, r9d
call fcn.200febc0
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.2030c4cc
int3
Function at 0x20201bd0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
cmp qword [r8 + 0x20], 0x10
jb 0x20201c04
mov rdx, qword [r8 + 8]
jmp 0x20201c08
lea rdx, [r8 + 8]
lea r13, [rcx + 8]
mov rdi, qword [r8 + 0x18]
mov rax, qword [0x204694d8]
movsxd r14, dword [rax]
add r14, rax
mov r15d, dword [0x2037e644]
movabs rbx, 0x7fffffffffffffff
cmp rdi, 0x10
mov qword [rbp - 8], rcx
jae 0x20201c48
movups xmm0, xmmword [rdx]
movups xmmword [r13], xmm0
mov r12d, 0xf
jmp 0x20201cb1
mov qword [rbp - 0x10], rdx
mov r12, rdi
or r12, 0xf
cmp r12, rbx
cmovae r12, rbx
cmp r12, 0xfff
jb 0x20201c80
lea rcx, [r12 + 0x28]
mov edx, 0xc2b36bea
call fcn.200810a0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x20201c92
lea rcx, [r12 + 1]
mov edx, 0xc2b36bea
call fcn.200810a0
mov rcx, rax
mov qword [r13], rcx
mov rax, qword [0x204a3090]
lea r8, [rdi + rax]
inc r8
mov rdx, qword [rbp - 0x10]
call fcn.20353d70
mov rcx, qword [rbp - 8]
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], r12
lea rdi, [0x2036e458]
mov qword [rcx], rdi
mov r11d, dword [0x204694d0]
lea edx, [r11 + 1]
mov dword [0x204694d0], edx
xor eax, eax
mov r8d, 0
test r11d, edx
jne 0x20201d15
xor r9d, r9d
mov eax, 0
mov r8d, 0
test r15d, r15d
jle 0x20201d15
xor eax, eax
xor r8d, r8d
nop dword [rax]
movsxd r9, r9d
xor r8, qword [r14 + r9 + 8]
xor rax, qword [r14 + r9]
add r9d, 0x10
cmp r9d, r15d
jl 0x20201d00
xorps xmm0, xmm0
movups xmmword [rcx + 0x40], xmm0
mov r14, qword [rsi + 0x18]
cmp qword [rsi + 0x20], 0x10
jb 0x20201d2d
mov rsi, qword [rsi + 8]
jmp 0x20201d31
add rsi, 8
lea r15, [rcx + 0x30]
cmp r14, 0x10
jae 0x20201d4c
movups xmm0, xmmword [rsi]
movups xmmword [r15], xmm0
mov ebx, 0xf
jmp 0x20201dd5
mov r9, r14
or r9, 0xf
xor r10d, r10d
test r11d, edx
setne r10b
mov rdx, qword [0x2037e668]
mov rcx, qword [0x2037e660]
xor r11d, r11d
add r10, 0xffffffffffffffff
adc r11, 0xffffffffffffffff
sub rcx, rax
sbb rdx, r8
and rcx, r10
and rdx, r11
or rcx, rdx
add qword [0x204a3090], rcx
cmp r9, rbx
cmovb rbx, r9
cmp rbx, 0xffe
jbe 0x20201db6
lea rcx, [rbx + 0x28]
call fcn.2032be0c
mov rcx, rax
add rcx, 0x27
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x20201dc2
lea rcx, [rbx + 1]
call fcn.2032be0c
mov rcx, rax
mov qword [r15], rcx
lea r8, [r14 + 1]
mov rdx, rsi
call fcn.20353d70
mov rcx, qword [rbp - 8]
mov qword [rcx + 0x40], r14
mov qword [rcx + 0x48], rbx
mov qword [rcx + 0x28], rdi
mov rax, rcx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x202060b0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x202060ec
test edx, edx
je 0x2020611c
movzx eax, byte [0x20469a97]
cmp al, 0x29
je 0x202060e4
mov cl, 0x8f
nop word cs:[rax + rax]
mov al, 0x64
lock cmpxchg byte [0x20469a97], cl
je 0x2020617c
cmp al, 0x29
jne 0x202060d0
lea rax, [0x20469a80]
ret
test edx, edx
je 0x2020614c
movzx eax, byte [0x20469750]
cmp al, 0xb2
je 0x20206114
mov cl, 0x4c
nop dword [rax]
mov al, 0xf9
lock cmpxchg byte [0x20469750], cl
je 0x202061b1
cmp al, 0xb2
jne 0x20206100
lea rax, [0x20469740]
ret
movzx eax, byte [0x20469896]
cmp al, 0x3c
je 0x20206144
mov cl, 0x8e
nop dword [rax]
mov al, 0xdf
lock cmpxchg byte [0x20469896], cl
je 0x202061f1
cmp al, 0x3c
jne 0x20206130
lea rax, [0x20469880]
ret
movzx eax, byte [0x20469aab]
cmp al, 0xdd
je 0x20206174
mov cl, 0x43
nop dword [rax]
mov al, 0xd4
lock cmpxchg byte [0x20469aab], cl
je 0x20206231
cmp al, 0xdd
jne 0x20206160
lea rax, [0x20469aa0]
ret
xor eax, eax
lea rcx, [0x20469a80]
lea rdx, [0x2037ebf0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x17
jl 0x20206190
mov al, 0x29
xchg byte [0x20469a97], al
lea rax, [0x20469a80]
ret
xor eax, eax
lea rcx, [0x20469740]
lea rdx, [0x2037e8a0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x10
jl 0x202061d0
mov al, 0xb2
xchg byte [0x20469750], al
lea rax, [0x20469740]
ret
xor eax, eax
lea rcx, [0x20469880]
lea rdx, [0x2037e9f0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x16
jl 0x20206210
mov al, 0x3c
xchg byte [0x20469896], al
lea rax, [0x20469880]
ret
xor eax, eax
lea rcx, [0x20469aa0]
lea rdx, [0x2037ec10]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xb
jl 0x20206250
mov al, 0xdd
xchg byte [0x20469aab], al
lea rax, [0x20469aa0]
ret
Function at 0x20206310
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x2020634c
test edx, edx
je 0x2020637c
movzx eax, byte [0x20469a1d]
cmp al, 0x5d
je 0x20206344
mov cl, 0x1d
nop word cs:[rax + rax]
mov al, 0x83
lock cmpxchg byte [0x20469a1d], cl
je 0x202063dc
cmp al, 0x5d
jne 0x20206330
lea rax, [0x20469a10]
ret
test edx, edx
je 0x202063ac
movzx eax, byte [0x204699eb]
cmp al, 0x39
je 0x20206374
mov cl, 0xb5
nop dword [rax]
mov al, 0x3a
lock cmpxchg byte [0x204699eb], cl
je 0x20206411
cmp al, 0x39
jne 0x20206360
lea rax, [0x204699e0]
ret
movzx eax, byte [0x20469738]
cmp al, 0xa5
je 0x202063a4
mov cl, 0xee
nop dword [rax]
mov al, 0x57
lock cmpxchg byte [0x20469738], cl
je 0x20206451
cmp al, 0xa5
jne 0x20206390
lea rax, [0x20469730]
ret
movzx eax, byte [0x20469700]
cmp al, 0x3e
je 0x202063d4
mov cl, 0x52
nop dword [rax]
mov al, 0xb2
lock cmpxchg byte [0x20469700], cl
je 0x20206491
cmp al, 0x3e
jne 0x202063c0
lea rax, [0x204696f0]
ret
xor eax, eax
lea rcx, [0x20469a10]
lea rdx, [0x2037eb80]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xd
jl 0x202063f0
mov al, 0x5d
xchg byte [0x20469a1d], al
lea rax, [0x20469a10]
ret
xor eax, eax
lea rcx, [0x204699e0]
lea rdx, [0x2037eb50]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0xb
jl 0x20206430
mov al, 0x39
xchg byte [0x204699eb], al
lea rax, [0x204699e0]
ret
xor eax, eax
lea rcx, [0x20469730]
lea rdx, [0x2037e890]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 8
jl 0x20206470
mov al, 0xa5
xchg byte [0x20469738], al
lea rax, [0x20469730]
ret
xor eax, eax
lea rcx, [0x204696f0]
lea rdx, [0x2037e860]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x10
jl 0x202064b0
mov al, 0x3e
xchg byte [0x20469700], al
lea rax, [0x204696f0]
ret
Function at 0x20210180
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov edi, r8d
mov rsi, rdx
test ecx, ecx
je 0x202101bc
mov rcx, rsi
test edi, edi
je 0x20210365
call fcn.2032c338
jmp 0x2021036a
cmp byte [rsi + 0x19], 0
jne 0x2021036a
jmp 0x202101ef
call fcn.200807c0
mov edx, 0x40
mov rcx, rsi
call fcn.200807c0
cmp byte [rbx + 0x19], 0
mov rsi, rbx
jne 0x2021036a
mov rdx, qword [rsi + 0x10]
xor ecx, ecx
mov r8d, edi
xor r9d, r9d
call fcn.20210180
mov rbx, qword [rsi]
mov r14, qword [rsi + 0x28]
test r14, r14
je 0x202101d5
mov rax, qword [0x2046b188]
movsxd r15, dword [rax]
mov r12d, dword [0x2037f904]
mov r13, qword [rsi + 0x30]
cmp r14, r13
je 0x20210330
add r15, rax
jmp 0x202102a3
mov r11, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r11
cmp rcx, 0x20
jae 0x2021037c
add rax, 0x28
movzx ecx, word [0x2037f908]
and r8d, r9d
cmp r8d, 1
mov edx, 0
sbb edx, edx
sub ecx, r10d
test cx, dx
setne cl
or cl, byte [0x204a1cc0]
and cl, 1
mov byte [0x204a1cc0], cl
mov rdx, rax
mov rcx, r11
call fcn.200807c0
mov qword [r14 + 0x18], 0
mov qword [r14 + 0x20], 0xf
mov byte [r14 + 8], 0
add r14, 0x30
cmp r14, r13
je 0x20210330
mov rax, qword [r14 + 0x20]
mov r8d, dword [0x2046b184]
lea r9d, [r8 - 0x2403c701]
add r9d, 0x2403c702
mov dword [0x2046b184], r9d
test r8d, r9d
je 0x202102d0
xor r10d, r10d
jmp 0x202102f0
xor ecx, ecx
mov r10d, 0
test r12d, r12d
jle 0x202102f0
xor r10d, r10d
movsxd rcx, ecx
xor r10w, word [r15 + rcx]
add ecx, 2
cmp ecx, r12d
jl 0x202102e0
cmp rax, 0xf
jbe 0x20210281
mov rcx, qword [r14 + 8]
cmp byte [0x204a1ec4], 0
jne 0x20210230
test byte [0x204a1cc0], 1
jne 0x20210230
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x2021027c
jmp 0x20210230
mov rcx, qword [rsi + 0x28]
mov rdx, qword [rsi + 0x38]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x202101d0
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x20210381
add rdx, 0x27
mov rcx, rax
jmp 0x202101d0
call fcn.2032c2d8
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.2030c4cc
call fcn.2030c4cc
int3
Function at 0x20212830
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x458
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3d0], 0xfffffffffffffffe
mov rsi, rdx
cmp qword [0x204a3268], 0
je 0x20212884
mov ecx, 0x5fff0dbe
call fcn.20212a60
mov rcx, qword [rax]
mov r8, qword [rcx + 8]
mov rcx, rax
mov rdx, rsi
mov rax, r8
call qword [case.0x200fc05d.0]
jmp 0x202129a7
lea rdx, [0x2036ed38]
mov rcx, rsi
mov r8d, 0xc5673c7d
call fcn.200f0020
mov qword [rbp + 0x3c8], rsi
mov rsi, qword [0x2046b7d8]
movsxd rbx, dword [rsi]
mov r14d, dword [0x203802e4]
xor ecx, ecx
call fcn.2015ed80
add rbx, rsi
mov esi, dword [0x2046b7d0]
lea edi, [rsi + 1]
mov dword [0x2046b7d0], edi
xor esi, edi
not esi
test esi, edi
je 0x202128d7
xor r15d, r15d
jmp 0x202128fe
xor ecx, ecx
mov r15d, 0
test r14d, r14d
jle 0x202128fe
xor r15d, r15d
nop word [rax + rax]
movsxd rcx, ecx
xor r15b, byte [rbx + rcx]
inc ecx
cmp ecx, r14d
jl 0x202128f0
lea rdx, [rbp - 0x60]
mov rcx, rax
mov r8d, 0x400
call fcn.20143dd0
and esi, edi
movzx eax, byte [0x203802e8]
xor ecx, ecx
cmp esi, 1
sbb ecx, ecx
sub al, r15b
and al, cl
movzx eax, al
add qword [0x204a3090], rax
lea rcx, [rbp + 0x3a0]
lea rdx, [rbp - 0x60]
call fcn.201f8110
lea rdx, [rbp + 0x3a0]
mov rcx, qword [rbp + 0x3c8]
call fcn.201f8270
mov rax, qword [0x204a3090]
add rax, qword [rbp + 0x3c0]
cmp rax, 0x10
mov rsi, qword [rbp + 0x3c8]
jb 0x202129a7
mov rcx, qword [rbp + 0x3a8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x2021299c
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x202129ba
add rax, 0x28
mov rdx, rax
mov rcx, r8
mov r8d, 0xad2d7175
call fcn.200807c0
mov rax, rsi
add rsp, 0x458
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
call fcn.2030c4cc
int3