joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2016e910
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov r8d, 0x124
xor edx, edx
call fcn.2044feb0
lea rcx, [rsi + 0x128]
mov rdi, qword [rsi + 0x128]
mov r8, qword [rdi + 8]
mov rdx, rcx
call fcn.20089c80
mov qword [rdi + 8], rdi
mov qword [rdi], rdi
mov qword [rdi + 0x10], rdi
mov qword [rsi + 0x130], 0
lea rdi, [rsi + 0x140]
mov rcx, qword [rsi + 0x140]
test rcx, rcx
je 0x2016e99b
cmp dword [rsi + 0x15c], 1
jne 0x2016e983
mov r8, qword [rsi + 0x148]
xor edx, edx
call fcn.2044feb0
mov rcx, qword [rdi]
test rcx, rcx
je 0x2016e99b
mov edx, 0x314c86b9
mov r8d, 0x7eeffe7b
call fcn.2008bfb0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov byte [rsi + 0x158], 1
mov rax, qword [rsi + 0x178]
mov rcx, qword [rax + 8]
mov qword [rcx], 0
mov rcx, qword [rax]
test rcx, rcx
je 0x2016e9e5
nop word [rax + rax]
mov rdi, qword [rcx]
mov edx, 0x20
call fcn.20178f70
mov rcx, rdi
test rdi, rdi
jne 0x2016e9d0
mov rax, qword [rsi + 0x178]
mov qword [rax], rax
mov rax, qword [rsi + 0x178]
mov qword [rax + 8], rax
mov qword [rsi + 0x180], 0
mov rax, qword [rsi + 0x188]
mov rcx, qword [rax + 8]
mov qword [rcx], 0
mov rcx, qword [rax]
test rcx, rcx
je 0x2016ea64
movabs rdi, 0x8eec59f04b8741e8
movabs rbx, 0xeec59f04b8741e8
nop word cs:[rax + rax]
mov r14, qword [rcx]
mov rax, qword [0x205500c0]
mov rdx, rax
xor rdx, rdi
and rax, rbx
lea rdx, [rdx + rax*2]
call fcn.20178f70
mov rcx, r14
test r14, r14
jne 0x2016ea40
mov rax, qword [rsi + 0x188]
mov qword [rax], rax
mov rax, qword [rsi + 0x188]
mov qword [rax + 8], rax
mov qword [rsi + 0x190], 0
mov rax, qword [rsi + 0x198]
mov rcx, qword [rax + 8]
mov qword [rcx], 0
mov rcx, qword [rax]
test rcx, rcx
je 0x2016eab5
nop
mov rdi, qword [rcx]
mov edx, 0x20
call fcn.20178f70
mov rcx, rdi
test rdi, rdi
jne 0x2016eaa0
mov rax, qword [rsi + 0x198]
mov qword [rax], rax
mov rax, qword [rsi + 0x198]
mov qword [rax + 8], rax
mov qword [rsi + 0x1a0], 0
lea rdi, [rsi + 0x1b0]
mov rcx, qword [rsi + 0x1b0]
test rcx, rcx
je 0x2016eb17
cmp dword [rsi + 0x1cc], 1
jne 0x2016eaff
mov r8, qword [rsi + 0x1b8]
xor edx, edx
call fcn.2044feb0
mov rcx, qword [rdi]
test rcx, rcx
je 0x2016eb17
mov edx, 0x314c86b9
mov r8d, 0x7eeffe7b
call fcn.2008bfb0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov byte [rsi + 0x1c8], 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x20179f20
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x20179f5c
test edx, edx
je 0x20179f9c
movzx eax, byte [0x2054edcb]
cmp al, 2
je 0x20179f54
mov cl, 0xed
nop word cs:[rax + rax]
mov al, 0x3d
lock cmpxchg byte [0x2054edcb], cl
je 0x2017a01c
cmp al, 2
jne 0x20179f40
lea rax, [0x2054edc0]
ret
mov eax, 0x65e365cc
add eax, dword [0x205500b8]
cmp edx, eax
jne 0x20179fe6
movzx eax, byte [0x2054ed9d]
cmp al, 0x68
je 0x20179f94
mov cl, 0x8f
nop dword [rax + rax]
mov al, 0x2f
lock cmpxchg byte [0x2054ed9d], cl
je 0x2017a0dc
cmp al, 0x68
jne 0x20179f80
lea rax, [0x2054ed90]
ret
movzx eax, byte [0x2054eb81]
movzx ecx, byte [0x205500c8]
add cl, 4
cmp al, cl
je 0x20179fde
mov cl, 0xf1
nop word cs:[rax + rax]
mov al, 0x5e
lock cmpxchg byte [0x2054eb81], cl
je 0x2017a081
movzx edx, byte [0x205500c8]
add dl, 4
cmp al, dl
jne 0x20179fc0
lea rax, [0x2054eb50]
ret
movzx eax, byte [0x205b3cb0]
cmp al, 0xa5
je 0x2017a014
mov cl, 0xca
nop word cs:[rax + rax]
xor eax, eax
lock cmpxchg byte [0x205b3cb0], cl
je 0x2017a135
cmp al, 0xa5
jne 0x2017a000
lea rax, [0x2054ec60]
ret
xor eax, eax
lea rcx, [0x2054edc0]
lea rdx, [0x20471fb0]
mov r8d, 0x65e365d7
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x205500b8]
add r10d, r8d
cmp r9d, r10d
jge 0x2017a071
inc rax
jmp 0x2017a040
mov al, 2
xchg byte [0x2054edcb], al
lea rax, [0x2054edc0]
ret
xor eax, eax
lea rcx, [0x2054eb50]
lea rdx, [0x20471d40]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x30
jg 0x2017a0cc
inc rax
jmp 0x2017a0a0
mov al, 0x85
xchg byte [0x2054eb81], al
lea rax, [0x2054eb50]
ret
xor edx, edx
lea rax, [0x2054ed90]
lea rcx, [0x20471f80]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, dword [0x205500b8]
add edx, r8d
add edx, 0x65e365cd
cmp edx, 0xd
jl 0x2017a0f0
mov al, 0x68
xchg byte [0x2054ed9d], al
lea rax, [0x2054ed90]
ret
xor eax, eax
lea rcx, [0x2054ec60]
lea rdx, [0x20471e50]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x2017a168
inc rax
jmp 0x2017a150
movzx eax, byte [0x205500c8]
add al, 0x24
xchg byte [0x205b3cb0], al
lea rax, [0x2054ec60]
ret
Function at 0x2017a190
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x2017a1cc
movzx eax, byte [0x2054ed13]
cmp al, 0x53
je 0x2017a1c4
mov cl, 0xcf
nop word cs:[rax + rax]
mov al, 0xb4
lock cmpxchg byte [0x2054ed13], cl
je 0x2017a24c
cmp al, 0x53
jne 0x2017a1b0
lea rax, [0x2054ed10]
ret
mov eax, 0x65e365cc
add eax, dword [0x205500b8]
cmp edx, eax
jne 0x2017a216
movzx eax, byte [0x2054ecbe]
cmp al, 0x33
je 0x2017a20e
mov cl, 0x3c
nop dword [rax + rax]
mov al, 0x76
lock cmpxchg byte [0x2054ecbe], cl
je 0x2017a298
movzx edx, byte [0x205500c8]
add dl, 0xb2
cmp al, dl
jne 0x2017a1f0
lea rax, [0x2054ecb0]
ret
movzx eax, byte [0x2054ebd4]
cmp al, 7
je 0x2017a244
mov cl, 0xcc
nop word cs:[rax + rax]
mov al, 0x7f
lock cmpxchg byte [0x2054ebd4], cl
je 0x2017a2f1
cmp al, 7
jne 0x2017a230
lea rax, [0x2054ebd0]
ret
xor eax, eax
lea rcx, [0x2054ed10]
lea rdx, [0x20471f00]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x2017a288
inc rax
jmp 0x2017a260
mov al, 0x53
xchg byte [0x2054ed13], al
lea rax, [0x2054ed10]
ret
xor edx, edx
lea rax, [0x2054ecb0]
lea rcx, [0x20471ea0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x205500b8]
add edx, r8d
add edx, 0x65e365cd
cmp edx, 0xe
jl 0x2017a2b0
mov al, 0x33
xchg byte [0x2054ecbe], al
lea rax, [0x2054ecb0]
ret
xor r8d, r8d
lea rax, [0x2054ebd0]
lea rcx, [0x20471dc0]
mov edx, 0x65e365d0
nop word [rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [r8 + rax]
xor r10b, r9b
mov byte [r8 + rax], r10b
add r8d, 0x5da2cf35
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
add r8d, 0xa25d30cb
mov r9d, dword [0x205500b8]
add r9d, edx
cmp r8d, r9d
jl 0x2017a310
mov al, 7
xchg byte [0x2054ebd4], al
lea rax, [0x2054ebd0]
ret
Function at 0x2017aa20
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x2017aa5c
test edx, edx
je 0x2017aac8
movzx eax, byte [0x2054ed5f]
cmp al, 0xb8
je 0x2017aa54
mov cl, 0xed
nop
mov al, 0xb
lock cmpxchg byte [0x2054ed5f], cl
je 0x2017abcb
cmp al, 0xb8
jne 0x2017aa40
lea rax, [0x2054ed50]
ret
test edx, edx
je 0x2017ab1c
movzx eax, byte [0x2054ebe5]
mov ecx, r8d
xor cl, 0x8c
add cl, byte [0x205500c8]
cmp al, cl
je 0x2017aac0
nop dword [rax + rax]
movzx ecx, byte [0x205500c8]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0x33
mov eax, r8d
and al, 0xcc
or al, r9b
add al, cl
and dl, 0x75
mov r9d, r8d
and r9b, 0x8a
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x2054ebe5], r9b
je 0x2017ac18
cmp al, 0x4a
jne 0x2017aa80
lea rax, [0x2054ebe0]
ret
movzx eax, byte [0x2054ecd1]
cmp al, 0xf0
je 0x2017ab14
nop word cs:[rax + rax]
movzx ecx, byte [0x205500c8]
mov eax, r8d
xor al, 0x90
add al, cl
mov edx, r8d
xor dl, 0x77
add dl, cl
lock cmpxchg byte [0x2054ecd1], dl
je 0x2017ac48
mov ecx, r8d
xor cl, 0x2a
add cl, byte [0x205500c8]
cmp al, cl
jne 0x2017aae0
lea rax, [0x2054ecc0]
ret
movzx eax, byte [0x2054eb4d]
nop word cs:[rax + rax]
cmp al, 0x4d
je 0x2017abc3
movzx ecx, byte [0x205500c8]
mov eax, r8d
xor al, 0x3e
mov edx, eax
xor dl, cl
and al, cl
add al, al
add al, dl
mov edx, r8d
xor dl, 0xaa
add dl, cl
lock cmpxchg byte [0x2054eb4d], dl
jne 0x2017ab30
xor eax, eax
lea rcx, [0x2054eb10]
lea rdx, [0x20471d00]
xor r8d, 0xfaa26088
nop word [rax + rax]
cdqe
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
mov r9d, dword [0x205500b8]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 0x3d
jl 0x2017ab80
mov al, 0x4d
xchg byte [0x2054eb4d], al
lea rax, [0x2054eb10]
ret
xor eax, eax
lea rcx, [0x2054ed50]
lea rdx, [0x20471f40]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x2017ac08
inc rax
jmp 0x2017abe0
mov al, 0xb8
xchg byte [0x2054ed5f], al
lea rax, [0x2054ed50]
ret
xor eax, eax
lea rcx, [0x2054ebe0]
lea rdx, [0x20471dd0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x2017ac8c
inc rax
jmp 0x2017ac30
xor eax, eax
lea rcx, [0x2054ecc0]
lea rdx, [0x20471eb0]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x2017ac9c
inc rax
jmp 0x2017ac60
mov al, 0x4a
xchg byte [0x2054ebe5], al
lea rax, [0x2054ebe0]
ret
mov al, 0xf0
xchg byte [0x2054ecd1], al
lea rax, [0x2054ecc0]
ret
Function at 0x2017ae10
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x2017ae70
test edx, edx
je 0x2017aeac
movzx eax, byte [0x2054ea53]
mov ecx, r8d
xor cl, 0x56
add cl, byte [0x205500c8]
cmp al, cl
je 0x2017ae68
nop dword [rax + rax]
movzx ecx, byte [0x205500c8]
mov eax, r8d
xor al, 0xa4
add al, cl
mov edx, r8d
xor dl, 0x6a
add dl, cl
lock cmpxchg byte [0x2054ea53], dl
je 0x2017af55
cmp al, 0x9e
jne 0x2017ae40
lea rax, [0x2054ea20]
ret
test edx, edx
je 0x2017aedc
movzx eax, byte [0x2054ec1d]
cmp al, 0x9f
je 0x2017aea4
mov cl, 0x7d
nop word cs:[rax + rax]
mov al, 0x56
lock cmpxchg byte [0x2054ec1d], cl
je 0x2017af98
cmp al, 0x9f
jne 0x2017ae90
lea rax, [0x2054ec10]
ret
movzx eax, byte [0x2054ec29]
cmp al, 0x4b
je 0x2017aed4
mov cl, 0x86
nop dword [rax]
mov al, 0xc1
lock cmpxchg byte [0x2054ec29], cl
je 0x2017aff0
cmp al, 0x4b
jne 0x2017aec0
lea rax, [0x2054ec20]
ret
movzx eax, byte [0x2054ea9d]
nop word cs:[rax + rax]
cmp al, 0x80
je 0x2017b030
movzx ecx, byte [0x205500c8]
mov eax, r8d
xor al, 0xe6
add al, cl
mov edx, r8d
xor dl, 0x83
add dl, cl
lock cmpxchg byte [0x2054ea9d], dl
jne 0x2017aef0
xor eax, eax
lea rcx, [0x2054ea60]
lea rdx, [0x20471c60]
xor r8d, 0x836bd042
nop
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x205500b8]
add r10d, r8d
cmp r9d, r10d
jge 0x2017b028
inc rax
jmp 0x2017af30
xor eax, eax
lea rcx, [0x2054ea20]
lea rdx, [0x20471c20]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x32
jg 0x2017af88
inc rax
jmp 0x2017af70
mov al, 0x9e
xchg byte [0x2054ea53], al
lea rax, [0x2054ea20]
ret
xor eax, eax
lea rcx, [0x2054ec10]
lea rdx, [0x20471e00]
mov r9d, r8d
xor r9d, 0x836bd386
xor r8d, 0x836bd392
nop dword [rax]
cdqe
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
mov r10d, dword [0x205500b8]
add eax, r9d
add eax, r10d
add r10d, r8d
cmp eax, r10d
jl 0x2017afc0
mov al, 0x9f
xchg byte [0x2054ec1d], al
lea rax, [0x2054ec10]
ret
xor eax, eax
lea rcx, [0x2054ec20]
lea rdx, [0x20471e10]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x2017b018
inc rax
jmp 0x2017b000
mov al, 0x4b
xchg byte [0x2054ec29], al
lea rax, [0x2054ec20]
ret
mov al, 0x80
xchg byte [0x2054ea9d], al
lea rax, [0x2054ea60]
ret
Function at 0x2017b040
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8d, dword [rsp + 0x38]
mov eax, r8d
xor eax, 0x5f3226
add eax, dword [0x205500b8]
cmp ecx, eax
jne 0x2017b0b3
test edx, edx
je 0x2017b11f
movzx eax, byte [0x2054ebb4]
cmp al, 0xf5
je 0x2017b242
mov cl, 0xbc
nop word cs:[rax + rax]
mov al, 0x4c
lock cmpxchg byte [0x2054ebb4], cl
je 0x2017b179
mov edx, r8d
xor dl, 0x9e
mov r9d, r8d
not r9b
and r9b, r8b
xor r9b, dl
add r9b, byte [0x205500c8]
cmp al, r9b
jne 0x2017b080
jmp 0x2017b242
test edx, edx
je 0x2017b149
movzx eax, byte [0x2054ed8d]
cmp al, 0xe9
je 0x2017b256
nop word [rax + rax]
movzx ecx, byte [0x205500c8]
mov eax, r8d
xor al, 0xd8
mov edx, eax
xor dl, cl
and al, cl
add al, al
add al, dl
mov edx, r8d
xor dl, 0xba
add dl, cl
lock cmpxchg byte [0x2054ed8d], dl
je 0x2017b1c1
mov ecx, r8d
not cl
mov edx, r8d
xor dl, 0x7d
and cl, 0x82
or dl, cl
not dl
or dl, cl
add dl, byte [0x205500c8]
cmp al, dl
jne 0x2017b0d0
jmp 0x2017b256
movzx eax, byte [0x2054ec52]
cmp al, 0x59
je 0x2017b2fc
mov cl, 0x20
mov al, 0x67
lock cmpxchg byte [0x2054ec52], cl
je 0x2017b262
cmp al, 0x59
jne 0x2017b130
jmp 0x2017b2fc
movzx eax, byte [0x2054ebc4]
cmp al, 0x7f
je 0x2017b2e1
mov cl, 0xf0
nop word [rax + rax]
mov al, 5
lock cmpxchg byte [0x2054ebc4], cl
je 0x2017b298
cmp al, 0x7f
jne 0x2017b160
jmp 0x2017b2e1
xor eax, eax
lea rcx, [0x2054ebb0]
lea rdx, [0x20471da0]
mov r9d, r8d
xor r9d, 0x5f323a
nop word cs:[rax + rax]
movzx r10d, byte [rax + rdx]
add byte [rax + rcx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x205500b8]
add r11d, r9d
cmp r10d, r11d
jge 0x2017b230
inc rax
jmp 0x2017b1a0
xor eax, eax
lea rcx, [0x2054ed80]
lea rdx, [0x20471f70]
xor r8d, 0x5f3233
nop dword [rax + rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
not r11b
mov ebx, r11d
and bl, r10b
mov esi, r9d
xor r9b, r10b
not r10b
and sil, r10b
or sil, bl
and r10b, r11b
or r10b, r9b
not r10b
add r10b, r10b
add r10b, sil
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x205500b8]
add r10d, r8d
cmp r9d, r10d
jge 0x2017b24e
inc rax
jmp 0x2017b1e0
xor r8b, 0x9e
add r8b, byte [0x205500c8]
xchg byte [0x2054ebb4], r8b
lea rax, [0x2054ebb0]
jmp 0x2017b303
mov al, 0xe9
xchg byte [0x2054ed8d], al
lea rax, [0x2054ed80]
jmp 0x2017b303
xor eax, eax
lea rcx, [0x2054ec50]
lea rdx, [0x20471e40]
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 1
jg 0x2017b2ea
inc rax
jmp 0x2017b280
xor edx, edx
lea rax, [0x2054ebc0]
lea rcx, [0x20471db0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
not edx
and edx, 0x7ffffffe
or edx, r8d
not edx
lea edx, [r8 + rdx*2]
cmp edx, 4
jl 0x2017b2b0
mov al, 0x7f
xchg byte [0x2054ebc4], al
lea rax, [0x2054ebc0]
jmp 0x2017b303
xor r8b, 0x32
add r8b, byte [0x205500c8]
xchg byte [0x2054ec52], r8b
lea rax, [0x2054ec50]
pop rbx
pop rsi
ret
Function at 0x2018fd20
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x2018fd66
test edx, edx
je 0x2018fd9c
movzx eax, byte [0x20550ced]
movzx ecx, byte [0x205522f0]
add cl, 0x67
cmp al, cl
je 0x2018fd5e
mov cl, 0x72
nop
mov al, 0xe0
lock cmpxchg byte [0x20550ced], cl
je 0x2018fe2c
movzx edx, byte [0x205522f0]
add dl, 0x67
cmp al, dl
jne 0x2018fd40
lea rax, [0x20550ce0]
ret
test edx, edx
je 0x2018fdcc
movzx eax, byte [0x20550c8f]
cmp al, 0x4c
je 0x2018fd94
mov cl, 0x67
nop word [rax + rax]
mov al, 0x9f
lock cmpxchg byte [0x20550c8f], cl
je 0x2018fe8e
cmp al, 0x4c
jne 0x2018fd80
lea rax, [0x20550c80]
ret
movzx eax, byte [0x20550e3d]
cmp al, 0xe3
je 0x2018fdc4
mov cl, 0x2d
nop dword [rax]
mov al, 0x58
lock cmpxchg byte [0x20550e3d], cl
je 0x2018feb8
cmp al, 0xe3
jne 0x2018fdb0
lea rax, [0x20550e30]
ret
movzx eax, byte [0x20550c30]
nop word cs:[rax + rax]
cmp al, 0xb6
je 0x2018ff47
movzx ecx, byte [0x205522f0]
lea eax, [rcx + 0x3e]
add cl, 0x3f
lock cmpxchg byte [0x20550c30], cl
jne 0x2018fde0
xor eax, eax
lea rcx, [0x20550c20]
lea rdx, [0x204722d0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x2018ff3f
inc rax
jmp 0x2018fe10
xor eax, eax
lea rcx, [0x20550ce0]
lea rdx, [0x20472380]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
mov r11d, r9d
not r11b
xor r8b, r11b
xor r11b, r10b
and r11b, r9b
and r10b, r9b
or r10b, r8b
not r10b
or r10b, r11b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x2018fe7e
inc rax
jmp 0x2018fe40
mov al, 0x98
xchg byte [0x20550ced], al
lea rax, [0x20550ce0]
ret
xor eax, eax
lea rcx, [0x20550c80]
lea rdx, [0x20472320]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x2018ff28
inc rax
jmp 0x2018fea0
xor edx, edx
lea rax, [0x20550e30]
lea rcx, [0x204724d0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r9d
not r10b
mov r11d, r8d
xor r11b, r10b
not r11b
and r11b, r9b
and r10b, r8b
or r10b, r11b
mov byte [rdx + rax], r10b
add edx, 0x263b916d
mov r8d, edx
xor r8d, 0xd9c46e94
and edx, 0x59c46e94
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x2018fed0
mov al, 0xe3
xchg byte [0x20550e3d], al
lea rax, [0x20550e30]
ret
movzx eax, byte [0x205522f0]
add al, 0x1b
xchg byte [0x20550c8f], al
lea rax, [0x20550c80]
ret
mov al, 0xb6
xchg byte [0x20550c30], al
lea rax, [0x20550c20]
ret
Function at 0x20190050
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x20190098
test edx, edx
je 0x201900d8
movzx eax, byte [0x20550e51]
cmp al, 2
je 0x20190090
mov cl, 0x76
nop word [rax + rax]
mov al, 0x15
lock cmpxchg byte [0x20550e51], cl
je 0x2019018c
mov edx, r8d
xor dl, 0xe2
add dl, byte [0x205522f0]
cmp al, dl
jne 0x20190070
lea rax, [0x20550e40]
ret
test edx, edx
je 0x2019011c
movzx eax, byte [0x20550cad]
cmp al, 0x52
je 0x201900d0
mov cl, 0x1c
nop dword [rax]
mov al, 0x86
lock cmpxchg byte [0x20550cad], cl
je 0x201901dd
mov edx, r8d
xor dl, 0x12
add dl, byte [0x205522f0]
cmp al, dl
jne 0x201900b0
lea rax, [0x20550ca0]
ret
movzx eax, byte [0x20550dad]
xor r8b, 0xf
add r8b, byte [0x205522f0]
cmp al, r8b
je 0x20190114
mov cl, 0x61
nop word cs:[rax + rax]
mov al, 0x15
lock cmpxchg byte [0x20550dad], cl
je 0x20190208
cmp al, 0x6d
jne 0x20190100
lea rax, [0x20550da0]
ret
movzx eax, byte [0x20550e0d]
nop word cs:[rax + rax]
cmp al, 0x23
je 0x20190260
movzx ecx, byte [0x205522f0]
mov eax, r8d
xor al, 0xb
add al, cl
mov edx, r8d
xor dl, 0xcb
add dl, cl
lock cmpxchg byte [0x20550e0d], dl
jne 0x20190130
xor eax, eax
lea rcx, [0x20550e00]
lea rdx, [0x204724a0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x20190258
inc rax
jmp 0x20190170
xor eax, eax
lea rcx, [0x20550e40]
lea rdx, [0x204724e0]
xor r8d, 0xf97ee520
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x205522e0]
add r9d, r8d
add eax, r9d
cmp eax, 0x11
jl 0x201901b0
mov al, 2
xchg byte [0x20550e51], al
lea rax, [0x20550e40]
ret
xor eax, eax
lea rcx, [0x20550ca0]
lea rdx, [0x20472340]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x20190238
inc rax
jmp 0x201901f0
xor eax, eax
lea rcx, [0x20550da0]
lea rdx, [0x20472440]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x20190248
inc rax
jmp 0x20190220
mov al, 0x52
xchg byte [0x20550cad], al
lea rax, [0x20550ca0]
ret
mov al, 0x6d
xchg byte [0x20550dad], al
lea rax, [0x20550da0]
ret
mov al, 0x23
xchg byte [0x20550e0d], al
lea rax, [0x20550e00]
ret
Function at 0x201905e0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x2019062c
test edx, edx
je 0x2019065c
movzx eax, byte [0x20550c43]
xor r8b, 0x5f
add r8b, byte [0x205522f0]
cmp al, r8b
je 0x20190624
mov cl, 0x5b
nop word cs:[rax + rax]
mov al, 0xdd
lock cmpxchg byte [0x20550c43], cl
je 0x201906bc
cmp al, 0x2c
jne 0x20190610
lea rax, [0x20550c40]
ret
test edx, edx
je 0x2019068c
movzx eax, byte [0x20550d4b]
cmp al, 0x51
je 0x20190654
mov cl, 0x64
nop dword [rax]
mov al, 0x72
lock cmpxchg byte [0x20550d4b], cl
je 0x201906f8
cmp al, 0x51
jne 0x20190640
lea rax, [0x20550d30]
ret
movzx eax, byte [0x20550cc2]
cmp al, 0xa1
je 0x20190684
mov cl, 0x6b
nop dword [rax]
mov al, 0x32
lock cmpxchg byte [0x20550cc2], cl
je 0x2019073f
cmp al, 0xa1
jne 0x20190670
lea rax, [0x20550cb0]
ret
movzx eax, byte [0x20550dc4]
cmp al, 0x9c
je 0x201906b4
mov cl, 0xc2
nop dword [rax]
mov al, 0x8c
lock cmpxchg byte [0x20550dc4], cl
je 0x20190782
cmp al, 0x9c
jne 0x201906a0
lea rax, [0x20550db0]
ret
xor eax, eax
lea rcx, [0x20550c40]
lea rdx, [0x204722e0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x201906e8
inc rax
jmp 0x201906d0
mov al, 0x2c
xchg byte [0x20550c43], al
lea rax, [0x20550c40]
ret
xor edx, edx
lea rax, [0x20550d30]
lea rcx, [0x204723d0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x1b
jl 0x20190710
mov al, 0x51
xchg byte [0x20550d4b], al
lea rax, [0x20550d30]
ret
xor eax, eax
lea rcx, [0x20550cb0]
lea rdx, [0x20472350]
nop
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0x11
jg 0x20190768
inc rax
jmp 0x20190750
xor r8b, 0xd4
add r8b, byte [0x205522f0]
xchg byte [0x20550cc2], r8b
lea rax, [0x20550cb0]
ret
xor eax, eax
lea rcx, [0x20550db0]
lea rdx, [0x20472450]
xor r8d, 0x3b080a82
nop dword [rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x205522e0]
add r10d, r8d
cmp r9d, r10d
jge 0x201907c1
inc rax
jmp 0x201907a0
mov al, 0x9c
xchg byte [0x20550dc4], al
lea rax, [0x20550db0]
ret