joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140126450
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401264a6
mov eax, dword [0x1405115cc]
mov ecx, eax
xor ecx, 0xa4c49bec
and eax, 0x24c49bec
lea eax, [rcx + rax*2]
cmp edx, eax
jne 0x1401264ec
movzx eax, byte [0x1405045d9]
cmp al, 0xac
je 0x14012649e
mov cl, 1
nop dword [rax + rax]
mov al, 5
lock cmpxchg byte [0x1405045d9], cl
je 0x14012655c
movzx edx, byte [0x1405115c8]
add dl, 0x3b
cmp al, dl
jne 0x140126480
lea rax, [0x1405045d0]
ret
mov eax, 0xa4c49bec
add eax, dword [0x1405115cc]
cmp edx, eax
jne 0x140126533
movzx eax, byte [0x1405045c5]
cmp al, 0xd9
je 0x1401264e4
mov cl, 0xda
nop word cs:[rax + rax]
mov al, 0x5e
lock cmpxchg byte [0x1405045c5], cl
je 0x1401265e8
cmp al, 0xd9
jne 0x1401264d0
lea rax, [0x1405045b0]
ret
movzx eax, byte [0x140504673]
movzx ecx, byte [0x1405115c8]
add cl, 0xb1
cmp al, cl
je 0x14012652b
nop word cs:[rax + rax]
movzx ecx, byte [0x1405115c8]
lea eax, [rcx + 0x66]
add cl, 0xc9
lock cmpxchg byte [0x140504673], cl
je 0x1401265a1
cmp al, 0x22
jne 0x140126510
lea rax, [0x140504670]
ret
movzx eax, byte [0x140504656]
cmp al, 0x77
je 0x140126554
mov cl, 0x7a
mov al, 0xdb
lock cmpxchg byte [0x140504656], cl
je 0x140126618
cmp al, 0x77
jne 0x140126540
lea rax, [0x140504650]
ret
xor edx, edx
lea rax, [0x1405045d0]
lea rcx, [0x14043a990]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1405115cc]
add edx, r8d
add edx, 0xa4c49bed
cmp edx, 9
jl 0x140126570
mov al, 0xac
xchg byte [0x1405045d9], al
lea rax, [0x1405045d0]
ret
xor eax, eax
lea rcx, [0x140504670]
lea rdx, [0x14043aa20]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1401265d8
inc rax
jmp 0x1401265c0
mov al, 0x22
xchg byte [0x140504673], al
lea rax, [0x140504670]
ret
xor eax, eax
lea rcx, [0x1405045b0]
lea rdx, [0x14043a970]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x14012667e
inc rax
jmp 0x140126600
xor r8d, r8d
lea rax, [0x140504650]
lea rcx, [0x14043aa00]
mov edx, 0xa4c49bf2
nop
movsxd r8, r8d
movzx r9d, byte [r8 + rax]
movzx r10d, byte [r8 + rcx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x1405115cc]
add r9d, edx
cmp r8d, r9d
jl 0x140126630
mov al, 0x77
xchg byte [0x140504656], al
lea rax, [0x140504650]
ret
mov al, 0xd9
xchg byte [0x1405045c5], al
lea rax, [0x1405045b0]
ret
Function at 0x140141cf0
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
push rsi
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x140141d6c
test edx, edx
je 0x140141da9
movzx eax, byte [0x140513eb3]
nop dword [rax]
cmp al, 0xcc
je 0x140141e1b
movzx ecx, byte [0x140514968]
mov eax, r8d
xor al, 0xab
add al, cl
mov edx, r8d
xor dl, 0xac
add dl, cl
lock cmpxchg byte [0x140513eb3], dl
jne 0x140141d10
xor eax, eax
lea rcx, [0x140513eb0]
lea rdx, [0x14043b930]
nop dword [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 2
jg 0x140141e09
inc rax
jmp 0x140141d50
test edx, edx
je 0x140141dd9
movzx eax, byte [0x140513e62]
cmp al, 0x1e
je 0x140141e98
mov cl, 0xba
nop word cs:[rax + rax]
mov al, 0xf6
lock cmpxchg byte [0x140513e62], cl
je 0x140141e24
cmp al, 0x1e
jne 0x140141d90
jmp 0x140141e98
movzx eax, byte [0x140513f09]
cmp al, 0x48
je 0x140141ef0
mov cl, 4
nop word [rax + rax]
mov al, 0x85
lock cmpxchg byte [0x140513f09], cl
je 0x140141ea1
cmp al, 0x48
jne 0x140141dc0
jmp 0x140141ef0
movzx eax, byte [0x140513dc3]
cmp al, 0xe6
je 0x140141f54
mov cl, 0x25
nop word [rax + rax]
mov al, 0x66
lock cmpxchg byte [0x140513dc3], cl
je 0x140141ef9
cmp al, 0xe6
jne 0x140141df0
jmp 0x140141f54
xor r8b, 0xd7
add r8b, byte [0x140514968]
xchg byte [0x140513eb3], r8b
lea rax, [0x140513eb0]
pop rsi
ret
xor eax, eax
lea rcx, [0x140513e60]
lea rdx, [0x14043b8f0]
mov r10d, r8d
not r10d
mov r11d, r10d
and r11d, 0xafd814ac
mov r9d, r8d
and r9d, 0x5027eb53
or r9d, r11d
and r10d, 0xafd814ad
and r8d, 0x5027eb52
or r8d, r10d
nop word cs:[rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
mov r10d, dword [0x14051496c]
add eax, r9d
add eax, r10d
add r10d, r8d
cmp eax, r10d
jl 0x140141e70
mov al, 0x1e
xchg byte [0x140513e62], al
lea rax, [0x140513e60]
pop rsi
ret
xor eax, eax
lea rcx, [0x140513f00]
lea rdx, [0x14043b980]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x140141ee8
inc rax
jmp 0x140141ec0
mov al, 0x48
xchg byte [0x140513f09], al
lea rax, [0x140513f00]
pop rsi
ret
xor r9d, r9d
lea rax, [0x140513dc0]
lea rcx, [0x14043b860]
mov edx, r8d
xor edx, 0xafd814ac
xor r8d, 0xafd814ae
nop word [rax + rax]
movsxd r9, r9d
movzx r10d, byte [r9 + rcx]
xor byte [r9 + rax], r10b
mov r10d, dword [0x14051496c]
lea r11d, [rdx + r10]
mov esi, r9d
xor esi, r11d
and r9d, r11d
lea r9d, [rsi + r9*2]
add r10d, r8d
cmp r9d, r10d
jl 0x140141f20
mov al, 0xe6
xchg byte [0x140513dc3], al
lea rax, [0x140513dc0]
pop rsi
ret
Function at 0x14014dc80
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xd2f6f5a1
add eax, dword [0x140515ac0]
cmp ecx, eax
jne 0x14014dcbc
test edx, edx
je 0x14014dcfc
movzx eax, byte [0x140515742]
cmp al, 0xa7
je 0x14014dcb4
mov cl, 0x3c
mov al, 0x77
lock cmpxchg byte [0x140515742], cl
je 0x14014dd5c
cmp al, 0xa7
jne 0x14014dca0
lea rax, [0x140515730]
ret
test edx, edx
je 0x14014dd2c
movzx eax, byte [0x1405155c5]
movzx ecx, byte [0x140515ac4]
add cl, 0x95
cmp al, cl
je 0x14014dcf4
mov cl, 0x76
nop word [rax + rax]
mov al, 0x8a
lock cmpxchg byte [0x1405155c5], cl
je 0x14014dd98
cmp al, 0xc1
jne 0x14014dce0
lea rax, [0x1405155c0]
ret
movzx eax, byte [0x140515633]
cmp al, 0xd0
je 0x14014dd24
mov cl, 0xa4
nop dword [rax]
mov al, 0x68
lock cmpxchg byte [0x140515633], cl
je 0x14014de06
cmp al, 0xd0
jne 0x14014dd10
lea rax, [0x140515630]
ret
movzx eax, byte [0x140515621]
cmp al, 0xc3
je 0x14014dd54
mov cl, 0xc6
nop dword [rax]
mov al, pe_nt_image_headers64
lock cmpxchg byte [0x140515621], cl
je 0x14014de38
cmp al, 0xc3
jne 0x14014dd40
lea rax, [0x140515610]
ret
xor eax, eax
lea rcx, [0x140515730]
lea rdx, [0x14043c9f0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x14014dddf
inc rax
jmp 0x14014dd70
xor eax, eax
lea rcx, [0x1405155c0]
lea rdx, [0x14043c890]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r8b
mov r10d, r8d
and r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x14014ddf6
inc rax
jmp 0x14014ddb0
movzx eax, byte [0x140515ac4]
add al, 0x7b
xchg byte [0x140515742], al
lea rax, [0x140515730]
ret
mov al, 0xc1
xchg byte [0x1405155c5], al
lea rax, [0x1405155c0]
ret
xor eax, eax
lea rcx, [0x140515630]
lea rdx, [0x14043c8f0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x14014de91
inc rax
jmp 0x14014de20
xor edx, edx
lea rax, [0x140515610]
lea rcx, [0x14043c8d0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140515ac0]
add edx, r8d
add edx, 0xd2f6f5a2
cmp edx, 0x11
jl 0x14014de50
mov al, 0xc3
xchg byte [0x140515621], al
lea rax, [0x140515610]
ret
mov al, 0xd0
xchg byte [0x140515633], al
lea rax, [0x140515630]
ret
Function at 0x14014e250
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14014e2e1
test edx, edx
je 0x14014e31c
movzx eax, byte [0x140515600]
nop word [rax + rax]
cmp al, 0x3f
je 0x14014e2d9
movzx ecx, byte [0x140515ac4]
lea eax, [rcx - 6]
add cl, 0x7d
lock cmpxchg byte [0x140515600], cl
jne 0x14014e270
xor edx, edx
lea rax, [0x1405155f0]
lea rcx, [0x14043c8c0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140515ac0]
add edx, r8d
add edx, 0xd2f6f5a2
cmp edx, 0x10
jl 0x14014e2a0
mov al, 0x3f
xchg byte [0x140515600], al
lea rax, [0x1405155f0]
ret
test edx, edx
je 0x14014e378
movzx eax, byte [0x1405155e8]
movzx ecx, byte [0x140515ac4]
add cl, 0xaa
cmp al, cl
je 0x14014e314
mov cl, 0x16
mov al, 0xd
lock cmpxchg byte [0x1405155e8], cl
je 0x14014e3d8
cmp al, 0xd6
jne 0x14014e300
lea rax, [0x1405155d0]
ret
movzx eax, byte [0x1405156dd]
nop word cs:[rax + rax]
cmp al, 0xb7
je 0x14014e3d0
movzx ecx, byte [0x140515ac4]
lea eax, [rcx - 0x24]
add cl, 0x3e
lock cmpxchg byte [0x1405156dd], cl
jne 0x14014e330
xor eax, eax
lea rcx, [0x1405156d0]
lea rdx, [0x14043c990]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14014e3c8
inc rax
jmp 0x14014e360
movzx eax, byte [0x1405155a3]
nop
cmp al, 0x9d
je 0x14014e430
movzx ecx, byte [0x140515ac4]
lea eax, [rcx + 0x10]
add cl, 0xca
lock cmpxchg byte [0x1405155a3], cl
jne 0x14014e380
xor eax, eax
lea rcx, [0x1405155a0]
lea rdx, [0x14043c870]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x14014e428
inc rax
jmp 0x14014e3b0
mov al, 0xb7
xchg byte [0x1405156dd], al
lea rax, [0x1405156d0]
ret
xor eax, eax
lea rcx, [0x1405155d0]
lea rdx, [0x14043c8a0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x17
jg 0x14014e408
inc rax
jmp 0x14014e3f0
movzx eax, byte [0x140515ac4]
mov ecx, eax
xor cl, 0xaa
and al, 0x2a
add al, al
add al, cl
xchg byte [0x1405155e8], al
lea rax, [0x1405155d0]
ret
mov al, 0x9d
xchg byte [0x1405155a3], al
lea rax, [0x1405155a0]
ret
Function at 0x14014e480
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14014e4bc
test edx, edx
je 0x14014e4ec
movzx eax, byte [0x14051567f]
cmp al, 0x1b
je 0x14014e4b4
mov cl, 0x25
nop word [rax + rax]
mov al, 0x47
lock cmpxchg byte [0x14051567f], cl
je 0x14014e5a9
cmp al, 0x1b
jne 0x14014e4a0
lea rax, [0x140515670]
ret
test edx, edx
je 0x14014e51c
movzx eax, byte [0x1405156cd]
cmp al, 0xf5
je 0x14014e4e4
mov cl, 0xcf
nop dword [rax]
mov al, 0xe7
lock cmpxchg byte [0x1405156cd], cl
je 0x14014e5f2
cmp al, 0xf5
jne 0x14014e4d0
lea rax, [0x1405156c0]
ret
movzx eax, byte [0x140515536]
cmp al, 0xfb
je 0x14014e514
mov cl, 0x64
nop dword [rax]
mov al, 0x52
lock cmpxchg byte [0x140515536], cl
je 0x14014e65d
cmp al, 0xfb
jne 0x14014e500
lea rax, [0x140515520]
ret
movzx eax, byte [0x1405154ab]
nop word cs:[rax + rax]
cmp al, 0xee
je 0x14014e6b7
movzx ecx, byte [0x140515ac4]
mov eax, r8d
xor al, 0xf4
add al, cl
mov edx, r8d
xor dl, 0x51
add dl, cl
lock cmpxchg byte [0x1405154ab], dl
jne 0x14014e530
xor eax, eax
lea rcx, [0x1405154a0]
lea rdx, [0x14043c790]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, r8b
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x14014e6af
inc rax
jmp 0x14014e570
xor eax, eax
lea rcx, [0x140515670]
lea rdx, [0x14043c930]
nop dword [rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xe
jg 0x14014e5d8
inc rax
jmp 0x14014e5c0
xor r8b, 0xb0
add r8b, byte [0x140515ac4]
xchg byte [0x14051567f], r8b
lea rax, [0x140515670]
ret
xor eax, eax
lea rcx, [0x1405156c0]
lea rdx, [0x14043c980]
mov r9d, r8d
not r9d
and r9d, 0x8227cffd
xor r8d, 0x7dd83002
or r8d, r9d
not r8d
or r8d, r9d
nop
cdqe
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
mov r9d, dword [0x140515ac0]
add r9d, r8d
add eax, r9d
cmp eax, 0xd
jl 0x14014e620
mov al, 0xf5
xchg byte [0x1405156cd], al
lea rax, [0x1405156c0]
ret
xor eax, eax
lea rcx, [0x140515520]
lea rdx, [0x14043c810]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r8b
mov r10d, r8d
and r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x15
jg 0x14014e69f
inc rax
jmp 0x14014e670
mov al, 0xfb
xchg byte [0x140515536], al
lea rax, [0x140515520]
ret
mov al, 0xee
xchg byte [0x1405154ab], al
lea rax, [0x1405154a0]
ret
Function at 0x140183b40
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0x64b5cabd
add eax, dword [0x14051cc90]
cmp ecx, eax
jne 0x140183b98
test edx, edx
je 0x140183bcc
movzx eax, byte [0x14051bf68]
cmp al, 0x53
je 0x140183b90
mov cl, 0xf9
nop dword [rax + rax]
mov al, 0xd0
lock cmpxchg byte [0x14051bf68], cl
je 0x140183c4c
mov edx, r8d
xor dl, 0x89
add dl, byte [0x14051cc94]
cmp al, dl
jne 0x140183b70
lea rax, [0x14051bf50]
ret
test edx, edx
je 0x140183c0c
movzx eax, byte [0x14051c063]
cmp al, 0x44
je 0x140183bc4
mov cl, 0xb4
nop dword [rax]
mov al, 0x19
lock cmpxchg byte [0x14051c063], cl
je 0x140183cb2
cmp al, 0x44
jne 0x140183bb0
lea rax, [0x14051c040]
ret
movzx eax, byte [0x14051bf3d]
xor r8b, 0x5b
add r8b, byte [0x14051cc94]
cmp al, r8b
je 0x140183c04
mov cl, 0x41
nop word cs:[rax + rax]
mov al, 0x2f
lock cmpxchg byte [0x14051bf3d], cl
je 0x140183cf8
cmp al, 0x21
jne 0x140183bf0
lea rax, [0x14051bf30]
ret
movzx eax, byte [0x14051bff1]
xor r8b, 0x13
add r8b, byte [0x14051cc94]
cmp al, r8b
je 0x140183c44
mov cl, 0x5a
nop word cs:[rax + rax]
mov al, 0x59
lock cmpxchg byte [0x14051bff1], cl
je 0x140183d3f
cmp al, 0xd9
jne 0x140183c30
lea rax, [0x14051bfe0]
ret
xor edx, edx
lea rax, [0x14051bf50]
lea rcx, [0x14043d250]
xor r8d, 0x64b5caba
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, dword [0x14051cc90]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
mov r10d, edx
xor r10d, r9d
and edx, r9d
lea edx, [r10 + rdx*2]
cmp edx, 0x18
jl 0x140183c70
mov al, 0x53
xchg byte [0x14051bf68], al
lea rax, [0x14051bf50]
ret
xor eax, eax
lea rcx, [0x14051c040]
lea rdx, [0x14043d330]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x140183ce8
inc rax
jmp 0x140183cd0
mov al, 0x44
xchg byte [0x14051c063], al
lea rax, [0x14051c040]
ret
xor edx, edx
lea rax, [0x14051bf30]
lea rcx, [0x14043d230]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x140183d10
mov al, 0x21
xchg byte [0x14051bf3d], al
lea rax, [0x14051bf30]
ret
xor eax, eax
lea rcx, [0x14051bfe0]
lea rdx, [0x14043d2d0]
nop
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x140183d7c
inc rax
jmp 0x140183d50
mov al, 0xd9
xchg byte [0x14051bff1], al
lea rax, [0x14051bfe0]
ret
Function at 0x14018b930
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14018b96c
test edx, edx
je 0x14018b9a8
movzx eax, byte [0x14051d589]
cmp al, 0x6f
je 0x14018b964
mov cl, 0xad
nop word [rax + rax]
mov al, 0x80
lock cmpxchg byte [0x14051d589], cl
je 0x14018b9ec
cmp al, 0x6f
jne 0x14018b950
lea rax, [0x14051d580]
ret
movzx eax, byte [0x14051d2bc]
cmp al, 0x23
je 0x14018b9a0
mov cl, 0x89
nop dword [rax]
mov al, 0x18
lock cmpxchg byte [0x14051d2bc], cl
je 0x14018ba28
mov edx, r8d
xor dl, 0x9a
add dl, byte [0x14051d6c8]
cmp al, dl
jne 0x14018b980
lea rax, [0x14051d2b0]
ret
movzx eax, byte [0x14051d466]
mov ecx, r8d
xor cl, 0xcd
add cl, byte [0x14051d6c8]
cmp al, cl
je 0x14018b9e4
mov cl, 0xcc
nop word cs:[rax + rax]
mov al, 0x84
lock cmpxchg byte [0x14051d466], cl
je 0x14018ba68
cmp al, 0xf2
jne 0x14018b9d0
lea rax, [0x14051d450]
ret
xor eax, eax
lea rcx, [0x14051d580]
lea rdx, [0x14043d880]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x14018ba18
inc rax
jmp 0x14018ba00
mov al, 0x6f
xchg byte [0x14051d589], al
lea rax, [0x14051d580]
ret
xor eax, eax
lea rcx, [0x14051d2b0]
lea rdx, [0x14043d5d0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x14018ba58
inc rax
jmp 0x14018ba40
mov al, 0x23
xchg byte [0x14051d2bc], al
lea rax, [0x14051d2b0]
ret
xor edx, edx
lea rax, [0x14051d450]
lea rcx, [0x14043d760]
xor r8d, 0xcf6eb906
nop
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
xor byte [rdx + rax], r9b
mov r9d, dword [0x14051d6cc]
add r9d, r8d
mov r10d, edx
xor r10d, r9d
and r9d, edx
lea edx, [r10 + r9*2]
cmp edx, 0x16
jl 0x14018ba80
mov al, 0xf2
xchg byte [0x14051d466], al
lea rax, [0x14051d450]
ret
Function at 0x14018be00
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14018be48
test edx, edx
je 0x14018be9c
movzx eax, byte [0x14051d445]
cmp al, 0x42
je 0x14018be40
mov cl, 0x4c
nop
mov al, 0x18
lock cmpxchg byte [0x14051d445], cl
je 0x14018bf3c
mov edx, r8d
xor dl, 0xcb
add dl, byte [0x14051d6c8]
cmp al, dl
jne 0x14018be20
lea rax, [0x14051d430]
ret
mov eax, r8d
xor eax, 0xa8ae7caf
add eax, dword [0x14051d6cc]
cmp edx, eax
jne 0x14018bf0c
movzx eax, byte [0x14051d499]
xor r8b, 0x2e
add r8b, byte [0x14051d6c8]
cmp al, r8b
je 0x14018be94
mov cl, 0x4c
nop word [rax + rax]
mov al, 0x9d
lock cmpxchg byte [0x14051d499], cl
je 0x14018bfb7
cmp al, 0x25
jne 0x14018be80
lea rax, [0x14051d490]
ret
movzx eax, byte [0x14051d3b2]
nop word cs:[rax + rax]
cmp al, 0x8a
je 0x14018bfaf
movzx ecx, byte [0x14051d6c8]
mov eax, r8d
xor al, 0xc8
add al, cl
mov edx, r8d
xor dl, 0xd
add dl, cl
lock cmpxchg byte [0x14051d3b2], dl
jne 0x14018beb0
xor eax, eax
lea rcx, [0x14051d3a0]
lea rdx, [0x14043d6c0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x14018bfa7
inc rax
jmp 0x14018bef0
movzx eax, byte [0x14051d395]
cmp al, 0xbe
je 0x14018bf34
mov cl, 0xd5
nop dword [rax]
mov al, pe_nt_image_headers64
lock cmpxchg byte [0x14051d395], cl
je 0x14018c00b
cmp al, 0xbe
jne 0x14018bf20
lea rax, [0x14051d380]
ret
xor eax, eax
lea rcx, [0x14051d430]
lea rdx, [0x14043d740]
xor r8d, 0xa8ae7cb0
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
mov r9d, dword [0x14051d6cc]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 0x15
jl 0x14018bf60
mov al, 0x42
xchg byte [0x14051d445], al
lea rax, [0x14051d430]
ret
mov al, 0x8a
xchg byte [0x14051d3b2], al
lea rax, [0x14051d3a0]
ret
xor edx, edx
lea rax, [0x14051d490]
lea rcx, [0x14043d7a0]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
add edx, 0xd12e696e
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x2ed19692
cmp edx, 9
jl 0x14018bfd0
mov al, 0x25
xchg byte [0x14051d499], al
lea rax, [0x14051d490]
ret
xor eax, eax
lea rcx, [0x14051d380]
lea rdx, [0x14043d6a0]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
xor r9b, r8b
mov r10d, r9d
not r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x14018c04f
inc rax
jmp 0x14018c020
mov al, 0xbe
xchg byte [0x14051d395], al
lea rax, [0x14051d380]
ret
Function at 0x140190a10
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140190a4c
mov eax, 0x87f1575b
add eax, dword [0x14051e378]
cmp edx, eax
jne 0x140190a7c
movzx eax, byte [0x14051d8ed]
cmp al, 0x82
je 0x140190a44
mov cl, 0x18
mov al, 0x9e
lock cmpxchg byte [0x14051d8ed], cl
je 0x140190adc
cmp al, 0x82
jne 0x140190a30
lea rax, [0x14051d8e0]
ret
test edx, edx
je 0x140190aac
movzx eax, byte [0x14051d825]
cmp al, 0xaf
je 0x140190a74
mov cl, 0x3b
nop dword [rax]
mov al, 0x8f
lock cmpxchg byte [0x14051d825], cl
je 0x140190b78
cmp al, 0xaf
jne 0x140190a60
lea rax, [0x14051d810]
ret
movzx eax, byte [0x14051d9fd]
cmp al, 0xdf
je 0x140190aa4
mov cl, 0x4b
nop dword [rax]
mov al, 0x93
lock cmpxchg byte [0x14051d9fd], cl
je 0x140190b24
cmp al, 0xdf
jne 0x140190a90
lea rax, [0x14051d9f0]
ret
movzx eax, byte [0x14051daed]
cmp al, 0x47
je 0x140190ad4
mov cl, 0xe2
nop dword [rax]
mov al, 0xbf
lock cmpxchg byte [0x14051daed], cl
je 0x140190bc8
cmp al, 0x47
jne 0x140190ac0
lea rax, [0x14051dae0]
ret
xor eax, eax
lea rcx, [0x14051d8e0]
lea rdx, [0x14043dba0]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
add r8b, 0xd6
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
add r8b, 0x2a
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140190b58
inc rax
jmp 0x140190af0
xor eax, eax
lea rcx, [0x14051d9f0]
lea rdx, [0x14043dcb0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140190b68
inc rax
jmp 0x140190b40
mov al, 0x82
xchg byte [0x14051d8ed], al
lea rax, [0x14051d8e0]
ret
mov al, 0xdf
xchg byte [0x14051d9fd], al
lea rax, [0x14051d9f0]
ret
xor edx, edx
lea rax, [0x14051d810]
lea rcx, [0x14043dad0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x14051e378]
add edx, r8d
add edx, 0x87f1575c
add r8d, 0x87f15770
cmp edx, r8d
jl 0x140190b90
mov al, 0xaf
xchg byte [0x14051d825], al
lea rax, [0x14051d810]
ret
xor r8d, r8d
lea rax, [0x14051dae0]
lea rcx, [0x14043dda0]
mov edx, 0x87f15768
nop
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [r8 + rax]
xor r10b, r9b
mov byte [r8 + rax], r10b
mov r9d, r8d
xor r9d, 1
not r8d
and r8d, 0x7ffffffe
or r8d, r9d
not r8d
lea r8d, [r9 + r8*2]
mov r9d, dword [0x14051e378]
add r9d, edx
cmp r8d, r9d
jl 0x140190be0
mov al, 0x47
xchg byte [0x14051daed], al
lea rax, [0x14051dae0]
ret