joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ed310
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
test ecx, ecx
je 0x1400ed349
test edx, edx
je 0x1400ed379
movzx eax, byte [0x14043a8d3]
cmp al, 0x87
je 0x1400ed409
mov cl, 0x1c
nop
mov al, 0x6a
lock cmpxchg byte [0x14043a8d3], cl
je 0x1400ed3d9
cmp al, 0x87
jne 0x1400ed330
jmp 0x1400ed409
test edx, edx
je 0x1400ed3a9
movzx eax, byte [0x14043a8ee]
cmp al, 0xef
je 0x1400ed489
mov cl, 0xbf
nop
mov al, 0xf7
lock cmpxchg byte [0x14043a8ee], cl
je 0x1400ed415
cmp al, 0xef
jne 0x1400ed360
jmp 0x1400ed489
movzx eax, byte [0x14043ab0c]
cmp al, 0x53
je 0x1400ed4c9
mov cl, 0xeb
nop word [rax + rax]
mov al, 0x6e
lock cmpxchg byte [0x14043ab0c], cl
je 0x1400ed495
cmp al, 0x53
jne 0x1400ed390
jmp 0x1400ed4c9
movzx eax, byte [0x14043a8ed]
cmp al, 0x87
je 0x1400ed549
mov cl, 0x57
nop word [rax + rax]
mov al, 0x77
lock cmpxchg byte [0x14043a8ed], cl
je 0x1400ed4d2
cmp al, 0x87
jne 0x1400ed3c0
jmp 0x1400ed549
xor eax, eax
lea rcx, [0x14043a8d0]
lea rdx, [0x14035f7a0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 3
jl 0x1400ed3f0
mov al, 0x87
xchg byte [0x14043a8d3], al
lea rax, [0x14043a8d0]
jmp 0x1400ed550
cmp qword [0x1404904d8], 0
jne 0x1400ed45f
mov ecx, 4
call fcn.1402f9c64
mov rsi, rax
mov qword [0x1404904d8], rax
lea rcx, [0x1400ed270]
call fcn.140319880
xor eax, eax
lea rcx, [0x14035f900]
nop dword [rax + rax]
movzx edx, byte [rax + rcx]
mov byte [rsi + rax], dl
inc rax
cmp eax, 2
jle 0x1400ed450
mov rax, qword [0x1404904d8]
xor ecx, ecx
lea rdx, [0x14035f910]
nop
movzx r8d, byte [rcx + rdx]
xor byte [rax + rcx], r8b
inc rcx
cmp ecx, 3
jl 0x1400ed470
mov al, 0xef
xchg byte [0x14043a8ee], al
mov rax, qword [0x1404904d8]
jmp 0x1400ed550
xor eax, eax
lea rcx, [0x14043ab00]
lea rdx, [0x14035fb80]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xc
jl 0x1400ed4b0
mov al, 0x53
xchg byte [0x14043ab0c], al
lea rax, [0x14043ab00]
jmp 0x1400ed550
cmp qword [0x1404904d0], 0
jne 0x1400ed51f
mov ecx, 4
call fcn.1402f9c64
mov rsi, rax
mov qword [0x1404904d0], rax
lea rcx, [0x1400ed250]
call fcn.140319880
xor eax, eax
lea rcx, [0x14035f8e0]
nop word cs:[rax + rax]
movzx edx, byte [rax + rcx]
mov byte [rsi + rax], dl
inc rax
cmp eax, 2
jle 0x1400ed510
mov rax, qword [0x1404904d0]
xor ecx, ecx
lea rdx, [0x14035f8f0]
nop
movzx r8d, byte [rcx + rdx]
xor byte [rax + rcx], r8b
inc rcx
cmp ecx, 3
jl 0x1400ed530
mov al, 0x87
xchg byte [0x14043a8ed], al
mov rax, qword [0x1404904d0]
add rsp, 0x20
pop rsi
ret
Function at 0x1400ed560
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x1400ed59c
test edx, edx
je 0x1400ed5cc
movzx eax, byte [0x14043aafb]
cmp al, 0x6a
je 0x1400ed594
mov cl, 0xa9
nop word cs:[rax + rax]
mov al, 0xf9
lock cmpxchg byte [0x14043aafb], cl
je 0x1400ed62c
cmp al, 0x6a
jne 0x1400ed580
lea rax, [0x14043aaf0]
ret
test edx, edx
je 0x1400ed5fc
movzx eax, byte [0x14043a8c2]
cmp al, 0x15
je 0x1400ed5c4
mov cl, 0x22
nop dword [rax]
mov al, 0x4b
lock cmpxchg byte [0x14043a8c2], cl
je 0x1400ed661
cmp al, 0x15
jne 0x1400ed5b0
lea rax, [0x14043a8c0]
ret
movzx eax, byte [0x14043a9b0]
cmp al, 0x30
je 0x1400ed5f4
mov cl, 0x88
nop dword [rax]
mov al, 0x1a
lock cmpxchg byte [0x14043a9b0], cl
je 0x1400ed6a1
cmp al, 0x30
jne 0x1400ed5e0
lea rax, [0x14043a9a0]
ret
movzx eax, byte [0x14043a952]
cmp al, 0xa5
je 0x1400ed624
mov cl, 0x23
nop dword [rax]
mov al, 0x93
lock cmpxchg byte [0x14043a952], cl
je 0x1400ed6e1
cmp al, 0xa5
jne 0x1400ed610
lea rax, [0x14043a940]
ret
xor eax, eax
lea rcx, [0x14043aaf0]
lea rdx, [0x14035fb70]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xb
jl 0x1400ed640
mov al, 0x6a
xchg byte [0x14043aafb], al
lea rax, [0x14043aaf0]
ret
xor eax, eax
lea rcx, [0x14043a8c0]
lea rdx, [0x14035f790]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 2
jl 0x1400ed680
mov al, 0x15
xchg byte [0x14043a8c2], al
lea rax, [0x14043a8c0]
ret
xor eax, eax
lea rcx, [0x14043a9a0]
lea rdx, [0x14035fa30]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x10
jl 0x1400ed6c0
mov al, 0x30
xchg byte [0x14043a9b0], al
lea rax, [0x14043a9a0]
ret
xor eax, eax
lea rcx, [0x14043a940]
lea rdx, [0x14035f9d0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x12
jl 0x1400ed700
mov al, 0xa5
xchg byte [0x14043a952], al
lea rax, [0x14043a940]
ret
Function at 0x1400f83b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
movabs rbx, 0x9984d958403a33d5
mov r8, qword [rcx + 0x370]
mov rax, qword [rcx + 0x378]
sub rax, r8
shr rax, 5
imul eax, eax, 0xcccccccd
test eax, eax
jle 0x1400f8498
mov edi, 0x80
movabs r14, 0xe5e28847bf04b4f5
xor r15d, r15d
mov ebp, 0x3748020e
movabs r12, 0xcccccccccccccccd
jmp 0x1400f8486
mov edx, dword [r8 + rdi - 0x5c]
add r8, rdi
mov r9d, dword [0x14043ce78]
add r9d, ebp
mov rcx, rsi
call fcn.140084860
mov r8, qword [rsi + 0x370]
mov rax, qword [rsi + 0x378]
sub rax, r8
sar rax, 5
imul rax, r12
mov ecx, dword [0x14043ce70]
mov edx, ebx
sub edx, r14d
add edx, 0x1e
mov r9d, edx
xor r9d, ecx
and edx, ecx
lea ecx, [r9 + rdx*2]
add ecx, r14d
shl rax, cl
inc r15
sar rax, 0x20
add rdi, 0xa0
cmp r15, rax
jge 0x1400f8498
cmp dword [r8 + rdi + 8], 0
jne 0x1400f8420
cmp qword [r8 + rdi + 8], 0
je 0x1400f843a
jmp 0x1400f8420
movabs rcx, 0xf91cf246740c8e7b
mov rax, qword [rsi + 0x398]
add rax, rcx
sub rax, qword [rsi + 0x390]
sub rax, rcx
mov ecx, ebx
neg ecx
movabs rdx, 0xcf593503a9962f7a
mov r8d, dword [0x14043ce70]
add r8d, edx
sub edx, r8d
mov r8d, ecx
xor r8d, edx
and edx, ecx
lea ecx, [r8 + rdx*2]
neg cl
shr rax, cl
test eax, eax
jle 0x1400f8575
movabs r14, 0xc9493ced50350c8e
movabs r15, 0xb47fdf03dcec7634
movabs r12, 0x4db164be369a5b5c
xor edi, edi
movabs r13, 0x3c7328343466b8a8
lea rbp, [r14 + r15]
add rbp, r13
nop dword [rax + rax]
mov eax, dword [0x14043ce78]
mov ecx, eax
xor ecx, 0x3748020e
and eax, 0x3748020e
lea r9d, [rcx + rax*2]
mov rcx, rsi
mov edx, edi
xor r8d, r8d
call fcn.140084860
inc edi
mov rax, qword [rsi + 0x398]
sub rax, r14
sub rax, r12
sub rax, r15
add rax, rbp
sub rax, qword [rsi + 0x390]
sub rax, r13
add rax, r12
mov ecx, dword [0x14043ce70]
add ecx, ebx
shr rax, cl
cmp edi, eax
jl 0x1400f8520
lea rdi, [rsi + 0x558]
mov rcx, qword [rsi + 0x558]
test rcx, rcx
je 0x1400f85b1
cmp dword [rsi + 0x574], 1
jne 0x1400f859f
mov r8, qword [rsi + 0x560]
xor edx, edx
call fcn.140341b50
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400f85b1
mov edx, 0x3935ad9d
call fcn.140084550
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov byte [rsi + 0x570], 1
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14007c540
Function at 0x1400fe5a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov r11, qword [0x14043d3d8]
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x1404905dc]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
movsxd r8, dword [r11]
mov r10d, dword [0x140360ed4]
test rdx, rdx
js 0x1400fe77a
mov r14, qword [rdi + 8]
mov rbx, qword [rdi + 0x18]
sub rbx, r14
mov r9, rbx
shr r9, 1
movabs rax, 0x7fffffffffffffff
mov rdx, r9
xor rdx, rax
movzx ecx, byte [0x140490428]
mov r12d, dword [0x14043d3d0]
lea r15d, [r12 + 1]
mov dword [0x14043d3d0], r15d
mov r13d, r12d
not r13d
xor r12d, r15d
not r15d
and r15d, r13d
or r15d, r12d
xor r12d, r12d
xor r15d, 0xffffffff
jne 0x1400fe663
test r10d, r10d
jle 0x1400fe663
add r8, r11
xor r11d, r11d
xor r12d, r12d
movsxd r13, r11d
mov r13d, dword [r8 + r13]
xor r12d, r13d
add r11d, 4
cmp r11d, r10d
jl 0x1400fe650
mov r8, r9
xor r8, rbx
and r9, rbx
lea r8, [r8 + r9*2]
cmp r8, rsi
cmova rsi, r8
cmp rbx, rdx
cmova rsi, rax
test cl, 1
cmovne rsi, rax
test r14, r14
je 0x1400fe6ea
mov rcx, r14
xor edx, edx
mov r8, rbx
call fcn.140341b50
cmp rbx, 0x1000
jb 0x1400fe6c5
mov rax, qword [r14 - 8]
cmp byte [0x1404905fc], 0
jne 0x1400fe6be
sub r14, rax
add r14, 0xfffffffffffffff8
cmp r14, 0x20
jae 0x1400fe784
add rbx, 0x27
mov r14, rax
lea r13, [rdi + 8]
mov rcx, r14
mov rdx, rbx
mov r8d, 0xa270e721
call fcn.140084550
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], 0
cmp rsi, 0x1000
jb 0x1400fe744
cmp rsi, 0xffffffffffffffd9
jae 0x1400fe77f
lea rcx, [rsi + 0x27]
mov edx, 0x2eede17
call fcn.140084ab0
mov rcx, rax
mov eax, dword [0x140360fdc]
xor edx, edx
cmp r15d, 1
sbb edx, edx
sub eax, r12d
xor edx, eax
not edx
test edx, eax
setne al
or al, byte [0x140490428]
and al, 1
mov byte [0x140490428], al
lea rax, [rcx + 0x27]
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400fe75a
test rsi, rsi
je 0x1400fe758
mov rcx, rsi
mov edx, 0x2eede17
call fcn.140084ab0
jmp 0x1400fe75a
xor eax, eax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
add rsi, rax
mov qword [rdi + 0x18], rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.1400fd610
call fcn.14006f950
call fcn.1402f9bec
int3
Function at 0x14012ef90
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test ecx, ecx
je 0x14012efc9
test edx, edx
je 0x14012eff9
movzx eax, byte [0x140442549]
cmp al, 0x2f
je 0x14012f089
mov cl, 0x35
nop
mov al, 0xff
lock cmpxchg byte [0x140442549], cl
je 0x14012f059
cmp al, 0x2f
jne 0x14012efb0
jmp 0x14012f089
test edx, edx
je 0x14012f029
movzx eax, byte [0x1404423c5]
cmp al, 7
je 0x14012f0c9
mov cl, 0xc2
nop
mov al, 0x45
lock cmpxchg byte [0x1404423c5], cl
je 0x14012f095
cmp al, 7
jne 0x14012efe0
jmp 0x14012f0c9
movzx eax, byte [0x140442568]
cmp al, 0x64
je 0x14012f159
mov cl, 0x67
nop word [rax + rax]
mov al, 0x5c
lock cmpxchg byte [0x140442568], cl
je 0x14012f0d5
cmp al, 0x64
jne 0x14012f010
jmp 0x14012f159
movzx eax, byte [0x140442495]
cmp al, 0xe7
je 0x14012f199
mov cl, 0xa3
nop word [rax + rax]
mov al, 0x5d
lock cmpxchg byte [0x140442495], cl
je 0x14012f162
cmp al, 0xe7
jne 0x14012f040
jmp 0x14012f199
xor eax, eax
lea rcx, [0x140442540]
lea rdx, [0x140361eb0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 9
jl 0x14012f070
mov al, 0x2f
xchg byte [0x140442549], al
lea rax, [0x140442540]
jmp 0x14012f1a0
xor eax, eax
lea rcx, [0x1404423c0]
lea rdx, [0x140361d50]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 5
jl 0x14012f0b0
mov al, 7
xchg byte [0x1404423c5], al
lea rax, [0x1404423c0]
jmp 0x14012f1a0
cmp qword [0x140490718], 0
jne 0x14012f12f
xor edi, edi
xor ecx, ecx
mov edx, 1
mov r8d, 4
mov r9d, 0x21d5f4e4
call fcn.14012ef30
mov rsi, rax
mov qword [0x140490718], rax
lea rcx, [0x14012e560]
mov edx, 0x5006f992
call fcn.1400db710
lea rax, [0x140361f00]
nop dword [rax + rax]
movzx ecx, byte [rdi + rax]
mov byte [rsi + rdi], cl
inc rdi
cmp edi, 2
jle 0x14012f120
mov rax, qword [0x140490718]
xor ecx, ecx
lea rdx, [0x140361f10]
nop
movzx r8d, byte [rcx + rdx]
xor byte [rax + rcx], r8b
inc rcx
cmp ecx, 3
jl 0x14012f140
mov al, 0x64
xchg byte [0x140442568], al
mov rax, qword [0x140490718]
jmp 0x14012f1a0
xor eax, eax
lea rcx, [0x140442480]
lea rdx, [0x140361e00]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x15
jl 0x14012f180
mov al, 0xe7
xchg byte [0x140442495], al
lea rax, [0x140442480]
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14016ec80
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x14016ecbc
test edx, edx
je 0x14016ecec
cmp byte [0x140448617], 0
je 0x14016ecb4
mov cl, 0x75
nop word cs:[rax + rax]
mov al, 0xa0
lock cmpxchg byte [0x140448617], cl
je 0x14016ed4c
test al, al
jne 0x14016eca0
lea rax, [0x140448610]
ret
test edx, edx
je 0x14016ed1c
movzx eax, byte [0x14044878b]
cmp al, 0x7f
je 0x14016ece4
mov cl, 0xa2
nop dword [rax]
mov al, 0x20
lock cmpxchg byte [0x14044878b], cl
je 0x14016ed81
cmp al, 0x7f
jne 0x14016ecd0
lea rax, [0x140448780]
ret
movzx eax, byte [0x140448756]
cmp al, 0x46
je 0x14016ed14
mov cl, 0x5c
nop dword [rax]
mov al, 0x93
lock cmpxchg byte [0x140448756], cl
je 0x14016edc1
cmp al, 0x46
jne 0x14016ed00
lea rax, [0x140448730]
ret
movzx eax, byte [0x140448606]
cmp al, 0xdc
je 0x14016ed44
mov cl, 0xd1
nop dword [rax]
mov al, 0xcc
lock cmpxchg byte [0x140448606], cl
je 0x14016ee01
cmp al, 0xdc
jne 0x14016ed30
lea rax, [0x140448600]
ret
xor eax, eax
lea rcx, [0x140448610]
lea rdx, [0x1403635e0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 7
jl 0x14016ed60
xor eax, eax
xchg byte [0x140448617], al
lea rax, [0x140448610]
ret
xor eax, eax
lea rcx, [0x140448780]
lea rdx, [0x140363740]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xb
jl 0x14016eda0
mov al, 0x7f
xchg byte [0x14044878b], al
lea rax, [0x140448780]
ret
xor eax, eax
lea rcx, [0x140448730]
lea rdx, [0x1403636f0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x26
jl 0x14016ede0
mov al, 0x46
xchg byte [0x140448756], al
lea rax, [0x140448730]
ret
xor eax, eax
lea rcx, [0x140448600]
lea rdx, [0x1403635d0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 6
jl 0x14016ee20
mov al, 0xdc
xchg byte [0x140448606], al
lea rax, [0x140448600]
ret
Function at 0x14016fe50
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
mov rdi, qword [rcx]
mov r12, qword [rcx + 8]
sub r12, rdi
sar r12, 4
inc r12
mov rcx, qword [rcx + 0x10]
sub rcx, rdi
sar rcx, 4
mov rax, rcx
shr rax, 1
movabs r11, 0xfffffffffffffff
mov r10, r11
sub r10, rax
add rax, rcx
cmp rax, r12
cmovbe rax, r12
cmp rcx, r10
cmova rax, r11
mov rcx, rax
shr rcx, 0x3c
jne 0x1401700e9
mov r15, rdx
mov rcx, rax
shl rcx, 4
cmp rax, 0x100
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], r8
jb 0x14016ff21
cmp byte [0x1404902e8], 0
jne 0x14016fef6
movabs rdx, 0xffffffffffffffe
cmp rax, rdx
jae 0x1401700e9
mov r13, r9
add rcx, 0x27
mov edx, 0x97df8c59
call fcn.140084ab0
mov rcx, rax
xor rcx, 0x27
mov edx, eax
and edx, 0x27
lea rbx, [rcx + rdx*2]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14016ff31
mov r13, r9
mov edx, 0x97df8c59
call fcn.140084ab0
mov rbx, rax
mov r14, r15
sub r14, rdi
sar r14, 4
shl r14, 4
mov rax, qword [r13]
mov rcx, qword [rbp - 0x10]
mov rcx, qword [rcx]
mov qword [rbx + r14], rcx
mov qword [rbx + r14 + 8], rax
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
cmp rax, r15
je 0x14016ffb6
cmp rcx, r15
je 0x14016ff83
mov rax, rbx
nop word [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
add rax, 0x10
add rcx, 0x10
cmp rcx, r15
jne 0x14016ff70
mov rax, qword [rsi + 8]
cmp rax, r15
je 0x14016ffd3
lea rcx, [r14 + rbx]
add rcx, 0x10
nop word cs:[rax + rax]
movups xmm0, xmmword [r15]
movups xmmword [rcx], xmm0
add r15, 0x10
add rcx, 0x10
cmp r15, rax
jne 0x14016ffa0
jmp 0x14016ffd3
cmp rcx, rax
je 0x14016ffd6
mov rdx, rbx
nop
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
add rdx, 0x10
add rcx, 0x10
cmp rcx, rax
jne 0x14016ffc0
mov rcx, qword [rsi]
add r14, rbx
movsxd r11, dword [0x1403638dc]
mov edi, dword [0x1403638d8]
test rcx, rcx
je 0x1401700bc
mov rdx, qword [rsi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1401700b1
lea rax, [0x1403638dc]
add r11, rax
mov rax, qword [rcx - 8]
mov r8d, dword [0x1404489e4]
lea r9d, [r8 + 1]
mov dword [0x1404489e4], r9d
xor r10d, r10d
test r8d, r9d
jne 0x140170053
test edi, edi
jle 0x140170053
xor r15d, r15d
xor r10d, r10d
nop word cs:[rax + rax]
movsxd r13, r15d
add r13, r11
xor r10d, dword [r13]
add r15d, 4
cmp r15d, edi
jl 0x140170040
cmp byte [0x1404909ac], 0
jne 0x14017006d
sub rcx, rax
add rcx, 0xfffffffffffffff8
cmp rcx, 0x20
jae 0x1401700ee
xor r11d, r11d
test r8d, r9d
setne r11b
mov r8d, dword [0x1403638c4]
sub r8d, r10d
lea ecx, [r11 - 1]
xor ecx, r8d
not r8d
neg r11d
and r11d, r8d
or ecx, r11d
not ecx
test ecx, ecx
setne cl
or cl, byte [0x1404909ac]
and cl, 1
mov byte [0x1404909ac], cl
add rdx, 0x27
mov rcx, rax
mov r8d, 0x404aba79
call fcn.140084550
mov qword [rsi], rbx
shl r12, 4
add r12, rbx
mov qword [rsi + 8], r12
mov rax, qword [rbp - 8]
add rax, rbx
mov qword [rsi + 0x10], rax
mov rax, r14
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.14006f950
call fcn.1402f9bec
int3
Function at 0x14017a4b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rax, qword [rcx]
mov r14, qword [0x14044a2f8]
mov rdi, rdx
mov rsi, rcx
movsxd r15, dword [r14]
mov ebx, dword [0x140364294]
cmp rax, 0xffffffffffffffff
je 0x14017a540
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x14017a525
mov rax, qword [rsi + 0x10]
mov rax, qword [rax + 0x6e0]
xor ecx, ecx
call qword [case.0x1400eabdd.0]
cmp eax, 1
sete al
movzx ecx, byte [0x140490959]
test cl, al
jne 0x14017a51d
xor cl, al
je 0x14017a525
mov qword [rsi + 8], 0
mov rcx, qword [rsi]
mov rax, qword [rsi + 0x10]
mov rax, qword [rax + 0x6e8]
call qword [case.0x1400eabdd.0]
mov qword [rsi], 0xffffffffffffffff
mov rax, r15
xor rax, r14
and r15, r14
lea rax, [rax + r15*2]
mov r14d, dword [0x14044a2f0]
mov ecx, r14d
neg ecx
mov r15d, 1
sub r15d, ecx
mov dword [0x14044a2f0], r15d
xor r15d, r14d
not r15d
xor r12d, r12d
test r15d, r14d
jne 0x14017a58e
test ebx, ebx
jle 0x14017a58e
xor ecx, ecx
xor r12d, r12d
movsxd rcx, ecx
xor r12d, dword [rax + rcx]
add ecx, 4
cmp ecx, ebx
jl 0x14017a580
mov rax, qword [rsi + 0x10]
cmp qword [rax + 0x6d0], 0
je 0x14017a662
mov rax, qword [rax + 0x698]
mov r13d, 1
mov edx, 1
mov r8d, 0x18
mov rcx, rdi
call qword [case.0x1400eabdd.0]
test rax, rax
jne 0x14017a61d
mov rax, qword [rsi + 0x10]
mov ecx, dword [0x140364290]
and r15d, r14d
xor ebx, ebx
cmp r15d, 1
mov edx, 0
sbb edx, edx
sub ecx, r12d
test ecx, edx
setne cl
or cl, byte [0x140490959]
and cl, 1
mov byte [0x140490959], cl
mov rax, qword [rax + 0x698]
mov r13d, 2
mov edx, 2
mov r8d, 0x18
mov rcx, rdi
call qword [case.0x1400eabdd.0]
test rax, rax
je 0x14017a664
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x10], 0
movabs rax, 0x8800000038
mov qword [rbp - 0x38], rax
mov qword [rbp - 8], rdi
mov qword [rbp - 0x18], r13
mov rax, qword [rsi + 0x10]
mov rax, qword [rax + 0x6d0]
lea rcx, [rbp - 0x38]
call qword [case.0x1400eabdd.0]
mov qword [rsi], rax
mov bl, 1
jmp 0x14017a664
xor ebx, ebx
mov eax, ebx
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14017ad40
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
movzx edx, byte [0x14049095b]
mov eax, dword [0x14044a79c]
mov qword [rbp - 8], rdx
or eax, edx
add eax, 0xffffe5ab
cdqe
add rax, qword [0x14044a7c8]
lea rcx, [rbp - 0x50]
mov edx, 0x4dd23840
call qword [case.0x1400eabdd.0]
mov rbx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
mov qword [rbp - 0x38], rax
mov rax, qword [0x14044a578]
movsxd r15, dword [rax]
add r15, rax
mov r12d, dword [0x140364504]
mov rax, qword [rbp - 8]
neg eax
mov qword [rbp - 0x30], rax
jmp 0x14017ae27
add rax, 0x28
mov rdx, rax
mov rcx, r8
and esi, r13d
movzx eax, word [0x14036451c]
cmp esi, 1
mov r8d, 0
sbb r8d, r8d
sub eax, r14d
and eax, r8d
test ax, ax
setne al
or al, byte [0x14049095b]
and al, 1
mov byte [0x14049095b], al
mov eax, dword [0x14044a7a0]
xor eax, dword [rbp - 8]
add eax, 0xffffe5ab
cdqe
add rax, qword [0x14044a7d8]
mov r8d, 0x1da5cedd
call qword [case.0x1400eabdd.0]
mov rcx, qword [rbx + 8]
mov rax, rdi
call qword [case.0x1400eabdd.0]
add rbx, 0x10
cmp rbx, qword [rbp - 0x38]
je 0x14017af3a
cmp qword [rbx + 8], 0
je 0x14017ae23
mov esi, dword [0x14044a570]
lea r13d, [rsi + 1]
mov dword [0x14044a570], r13d
test esi, r13d
je 0x14017ae60
xor r14d, r14d
jmp 0x14017aea0
xor eax, eax
mov r14d, 0
test r12d, r12d
jle 0x14017aea0
xor ecx, ecx
nop
movsxd rdx, eax
add rdx, r15
movzx edx, word [rdx]
mov r14d, edx
xor r14d, edx
not r14d
and r14d, ecx
xor r14d, edx
add eax, 2
mov ecx, r14d
cmp eax, r12d
jl 0x14017ae70
nop word cs:[rax + rax]
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], 0xf
mov eax, dword [0x14044a794]
mov rcx, qword [rbp - 0x30]
add eax, ecx
add eax, 0xffffe5ab
cdqe
add rax, qword [0x14044a7b0]
mov ecx, 0x256b8913
call qword [case.0x1400eabdd.0]
mov rcx, qword [rax]
mov rax, qword [rax + 7]
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x21], rax
mov byte [rbp - 0x19], 0
lea rcx, [rbp - 0x28]
call fcn.14017b250
mov rdi, rax
mov rax, qword [rbp - 0x10]
cmp byte [0x1404905d4], 0
jne 0x14017af0b
cmp rax, 0x10
jb 0x14017ae16
mov rcx, qword [rbp - 0x28]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14017adc3
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jb 0x14017adb9
call fcn.1402f9bec
mov eax, dword [0x14044a798]
mov rcx, qword [rbp - 8]
add eax, ecx
add eax, 0xffffe5ab
cdqe
add rax, qword [0x14044a7d0]
lea rcx, [rbp - 0x50]
call qword [case.0x1400eabdd.0]
nop
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14017cbb0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14017cbec
test edx, edx
je 0x14017cc2c
movzx eax, byte [0x14044a8fc]
cmp al, 0x21
je 0x14017cbe4
mov cl, 0x9c
nop word cs:[rax + rax]
mov al, 0x5f
lock cmpxchg byte [0x14044a8fc], cl
je 0x14017cc9c
cmp al, 0x21
jne 0x14017cbd0
lea rax, [0x14044a8e0]
ret
test edx, edx
je 0x14017cc5c
test r8d, r8d
je 0x14017ccd1
movzx eax, byte [0x14044a81d]
cmp al, 0x72
je 0x14017cc24
mov cl, 0xf9
nop word cs:[rax + rax]
mov al, 0x29
lock cmpxchg byte [0x14044a81d], cl
je 0x14017cd69
cmp al, 0x72
jne 0x14017cc10
lea rax, [0x14044a810]
ret
movzx eax, byte [0x14044a95b]
cmp al, 0x45
je 0x14017cc54
mov cl, 0xb8
nop dword [rax]
mov al, 0xfb
lock cmpxchg byte [0x14044a95b], cl
je 0x14017ccfc
cmp al, 0x45
jne 0x14017cc40
lea rax, [0x14044a950]
ret
test r8d, r8d
je 0x14017cd31
movzx eax, byte [0x14044a8b5]
cmp al, 0x60
je 0x14017cc94
mov cl, 0xaf
nop word cs:[rax + rax]
mov al, 0x7c
lock cmpxchg byte [0x14044a8b5], cl
je 0x14017cda1
cmp al, 0x60
jne 0x14017cc80
lea rax, [0x14044a8a0]
ret
xor eax, eax
lea rcx, [0x14044a8e0]
lea rdx, [0x1403647b0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x1c
jl 0x14017ccb0
mov al, 0x21
xchg byte [0x14044a8fc], al
lea rax, [0x14044a8e0]
ret
movzx eax, byte [0x14044a913]
cmp al, 0x47
je 0x14017ccf4
mov cl, 0x69
nop
mov al, 0x94
lock cmpxchg byte [0x14044a913], cl
je 0x14017cde1
cmp al, 0x47
jne 0x14017cce0
lea rax, [0x14044a910]
ret
xor eax, eax
lea rcx, [0x14044a950]
lea rdx, [0x140364820]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xb
jl 0x14017cd10
mov al, 0x45
xchg byte [0x14044a95b], al
lea rax, [0x14044a950]
ret
movzx eax, byte [0x14044a8d2]
cmp al, 0xf9
je 0x14017ce59
mov cl, 0xb2
nop word cs:[rax + rax]
mov al, 0xe8
lock cmpxchg byte [0x14044a8d2], cl
je 0x14017ce21
cmp al, 0xf9
jne 0x14017cd50
jmp 0x14017ce59
xor eax, eax
lea rcx, [0x14044a810]
lea rdx, [0x1403646f0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xd
jl 0x14017cd80
mov al, 0x72
xchg byte [0x14044a81d], al
lea rax, [0x14044a810]
ret
xor eax, eax
lea rcx, [0x14044a8a0]
lea rdx, [0x140364770]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x15
jl 0x14017cdc0
mov al, 0x60
xchg byte [0x14044a8b5], al
lea rax, [0x14044a8a0]
ret
xor eax, eax
lea rcx, [0x14044a910]
lea rdx, [0x1403647e0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 3
jl 0x14017ce00
mov al, 0x47
xchg byte [0x14044a913], al
lea rax, [0x14044a910]
ret
xor eax, eax
lea rcx, [0x14044a8c0]
lea rdx, [0x140364790]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x12
jl 0x14017ce40
mov al, 0xf9
xchg byte [0x14044a8d2], al
lea rax, [0x14044a8c0]
ret