joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14028a2d0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14028a30c
test edx, edx
je 0x14028a33c
movzx eax, byte [0x14062bf85]
cmp al, 0x75
je 0x14028a304
mov cl, 0x3f
nop word cs:[rax + rax]
mov al, 0xa6
lock cmpxchg byte [0x14062bf85], cl
je 0x14028a3bc
cmp al, 0x75
jne 0x14028a2f0
lea rax, [0x14062bf70]
ret
test edx, edx
je 0x14028a386
movzx eax, byte [0x14062c7bd]
cmp al, 5
je 0x14028a334
mov cl, 0x48
nop dword [rax]
mov al, 0xf1
lock cmpxchg byte [0x14062c7bd], cl
je 0x14028a3f8
cmp al, 5
jne 0x14028a320
lea rax, [0x14062c7b0]
ret
movzx eax, byte [0x14062c404]
movzx ecx, byte [0x14062d07c]
add cl, 0xcb
cmp al, cl
je 0x14028a37e
mov cl, 0xda
nop word cs:[rax + rax]
mov al, 0x89
lock cmpxchg byte [0x14062c404], cl
je 0x14028a441
movzx edx, byte [0x14062d07c]
add dl, 0xcb
cmp al, dl
jne 0x14028a360
lea rax, [0x14062c3f0]
ret
movzx eax, byte [0x14062c70f]
cmp al, 0x98
je 0x14028a3b4
mov cl, 0x2d
nop word cs:[rax + rax]
mov al, 0x17
lock cmpxchg byte [0x14062c70f], cl
je 0x14028a491
cmp al, 0x98
jne 0x14028a3a0
lea rax, [0x14062c700]
ret
xor eax, eax
lea rcx, [0x14062bf70]
lea rdx, [0x140539dd0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x14028a3e8
inc rax
jmp 0x14028a3d0
mov al, 0x75
xchg byte [0x14062bf85], al
lea rax, [0x14062bf70]
ret
xor edx, edx
lea rax, [0x14062c7b0]
lea rcx, [0x14053a5e0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x14062d078]
add edx, r8d
add edx, 0xb8153165
cmp edx, 0xd
jl 0x14028a410
mov al, 5
xchg byte [0x14062c7bd], al
lea rax, [0x14062c7b0]
ret
xor eax, eax
lea rcx, [0x14062c3f0]
lea rdx, [0x14053a230]
mov r8d, 0xb8153178
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14062d078]
add r10d, r8d
cmp r9d, r10d
jge 0x14028a481
inc rax
jmp 0x14028a460
mov al, 0xad
xchg byte [0x14062c404], al
lea rax, [0x14062c3f0]
ret
xor edx, edx
lea rax, [0x14062c700]
lea rcx, [0x14053a540]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x14028a4b0
mov al, 0x98
xchg byte [0x14062c70f], al
lea rax, [0x14062c700]
ret
Function at 0x14028cf80
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14028cfbc
test edx, edx
je 0x14028cff8
movzx eax, byte [0x14062c4a1]
cmp al, 0x6f
je 0x14028cfb4
mov cl, 0x6e
nop word [rax + rax]
mov al, 0xaf
lock cmpxchg byte [0x14062c4a1], cl
je 0x14028d0ac
cmp al, 0x6f
jne 0x14028cfa0
lea rax, [0x14062c490]
ret
test edx, edx
je 0x14028d02c
movzx eax, byte [0x14062c2bd]
cmp al, 0xf1
je 0x14028cff0
mov cl, 0xd3
nop dword [rax]
mov al, 0x5b
lock cmpxchg byte [0x14062c2bd], cl
je 0x14028d13c
mov edx, r8d
xor dl, 0x9b
add dl, byte [0x14062d07c]
cmp al, dl
jne 0x14028cfd0
lea rax, [0x14062c2b0]
ret
movzx eax, byte [0x14062c86d]
cmp al, 0x7f
je 0x14028d024
mov cl, 0x38
nop word cs:[rax + rax]
mov al, 0xa6
lock cmpxchg byte [0x14062c86d], cl
je 0x14028d168
cmp al, 0x7f
jne 0x14028d010
lea rax, [0x14062c850]
ret
movzx eax, byte [0x14062c47d]
nop word cs:[rax + rax]
cmp al, 0x2f
je 0x14028d1c0
movzx ecx, byte [0x14062d07c]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0x93
mov eax, r8d
and al, 0x6c
or al, r9b
add al, cl
and dl, 0xd3
mov r9d, r8d
and r9b, 0x2c
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x14062c47d], r9b
jne 0x14028d040
xor eax, eax
lea rcx, [0x14062c470]
lea rdx, [0x14053a2b0]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14028d1b8
inc rax
jmp 0x14028d090
xor edx, edx
lea rax, [0x14062c490]
lea rcx, [0x14053a2d0]
xor r8d, 0x513611e1
neg r8d
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rax]
movzx r10d, byte [rdx + rcx]
xor r10b, r9b
mov r11d, r10d
not r11b
and r11b, r9b
add r11b, r11b
mov r9d, r10d
xor r9b, r11b
and r11b, r10b
add r11b, r11b
add r11b, r9b
mov byte [rdx + rax], r11b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
xor r9d, r9d
sub r9d, dword [0x14062d078]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
neg r9d
cmp edx, r9d
jl 0x14028d0d0
mov al, 0x6f
xchg byte [0x14062c4a1], al
lea rax, [0x14062c490]
ret
xor eax, eax
lea rcx, [0x14062c2b0]
lea rdx, [0x14053a100]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14028d198
inc rax
jmp 0x14028d150
xor eax, eax
lea rcx, [0x14062c850]
lea rdx, [0x14053a660]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1c
jg 0x14028d1a8
inc rax
jmp 0x14028d180
mov al, 0xf1
xchg byte [0x14062c2bd], al
lea rax, [0x14062c2b0]
ret
mov al, 0x7f
xchg byte [0x14062c86d], al
lea rax, [0x14062c850]
ret
mov al, 0x2f
xchg byte [0x14062c47d], al
lea rax, [0x14062c470]
ret
Function at 0x140294b90
Capabilities:
Encode data using xor

Disassembly:
push rbx
test ecx, ecx
je 0x140294bc9
test edx, edx
je 0x140294c39
movzx eax, byte [0x14062e273]
cmp al, 0xd5
je 0x140294d17
mov cl, 0x19
nop
mov al, 0x62
lock cmpxchg byte [0x14062e273], cl
je 0x140294ca9
cmp al, 0xd5
jne 0x140294bb0
jmp 0x140294d17
mov eax, dword [0x14062eb70]
mov ecx, eax
xor ecx, 0xee8c0f33
and eax, 0x6e8c0f33
add eax, eax
add ecx, 0x79feaf8c
mov r8d, ecx
xor r8d, eax
and ecx, eax
lea eax, [r8 + rcx*2]
add eax, 0x86015074
cmp edx, eax
jne 0x140294c73
movzx eax, byte [0x14062e38b]
movzx ecx, byte [0x14062eb80]
add cl, 0x83
cmp al, cl
je 0x140294df8
mov cl, 0xb5
nop word cs:[rax + rax]
mov al, 0xcd
lock cmpxchg byte [0x14062e38b], cl
je 0x140294d59
cmp al, 0xf3
jne 0x140294c20
jmp 0x140294df8
movzx eax, byte [0x14062e54a]
cmp al, 0xc6
je 0x140294d50
mov cl, 0xde
nop word [rax + rax]
mov al, 0x2f
lock cmpxchg byte [0x14062e54a], cl
je 0x140294d20
movzx edx, byte [0x14062eb80]
add dl, 0x56
cmp al, dl
jne 0x140294c50
jmp 0x140294d50
movzx eax, byte [0x14062e32c]
cmp al, 0xfe
je 0x140294e5d
mov cl, 0x94
nop word cs:[rax + rax]
mov al, 0x78
lock cmpxchg byte [0x14062e32c], cl
je 0x140294e01
cmp al, 0xfe
jne 0x140294c90
jmp 0x140294e5d
xor eax, eax
lea rcx, [0x14062e250]
lea rdx, [0x14053af30]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x140294cd8
inc rax
jmp 0x140294cc0
movzx ecx, byte [0x14062eb80]
mov eax, ecx
not al
mov edx, ecx
xor dl, 0x9a
mov r8d, eax
and r8b, 0x65
or r8b, dl
not r8b
xor cl, 0x65
mov edx, ecx
and dl, al
or dl, r8b
and al, 0x1a
or al, cl
not al
add al, al
mov ecx, edx
xor cl, al
and al, dl
add al, al
add al, cl
xchg byte [0x14062e273], al
lea rax, [0x14062e250]
pop rbx
ret
xor eax, eax
lea rcx, [0x14062e530]
lea rdx, [0x14053b210]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x19
jg 0x140294d48
inc rax
jmp 0x140294d30
mov al, 0xc6
xchg byte [0x14062e54a], al
lea rax, [0x14062e530]
pop rbx
ret
xor edx, edx
lea rax, [0x14062e380]
lea rcx, [0x14053b060]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
not r10b
mov r11d, r10d
and r11b, r9b
mov ebx, r8d
xor r8b, r9b
not r9b
and bl, r9b
or bl, r11b
and r9b, r10b
or r9b, r8b
not r9b
add r9b, r9b
mov r8d, ebx
not r8b
mov r10d, r9d
xor r10b, r8b
xor r8b, bl
and r8b, r9b
xor r8b, bl
and r10b, r9b
add r10b, r10b
add r10b, r8b
mov byte [rdx + rax], r10b
mov r8d, 0xdfeba633
sub r8d, edx
mov edx, r8d
xor edx, 0x201459cd
and r8d, 0x201459cd
lea r8d, [rdx + r8*2]
mov edx, 1
sub edx, r8d
cmp edx, 0xb
jl 0x140294d70
mov al, 0xf3
xchg byte [0x14062e38b], al
lea rax, [0x14062e380]
pop rbx
ret
xor eax, eax
lea rcx, [0x14062e310]
lea rdx, [0x14053aff0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r9b
mov r10d, r9d
or r10b, r8b
not r10b
xor r9b, r8b
or r9b, r10b
not r9b
or r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x1b
jg 0x140294e55
inc rax
jmp 0x140294e20
mov al, 0xfe
xchg byte [0x14062e32c], al
lea rax, [0x14062e310]
pop rbx
ret
Function at 0x1402e3060
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1406399e0]
mov r8d, eax
xor r8d, 0xf6f10506
and eax, 0x76f10506
lea eax, [r8 + rax*2]
cmp ecx, eax
jne 0x1402e30ac
test edx, edx
je 0x1402e30dc
movzx eax, byte [0x140639600]
cmp al, 0x3a
je 0x1402e30a4
mov cl, 0x72
nop
mov al, 3
lock cmpxchg byte [0x140639600], cl
je 0x1402e31b5
cmp al, 0x3a
jne 0x1402e3090
lea rax, [0x1406395f0]
ret
test edx, edx
je 0x1402e310c
movzx eax, byte [0x1406397dc]
cmp al, 0x45
je 0x1402e30d4
mov cl, 0x48
nop dword [rax]
mov al, 0xbc
lock cmpxchg byte [0x1406397dc], cl
je 0x1402e322b
cmp al, 0x45
jne 0x1402e30c0
lea rax, [0x1406397d0]
ret
movzx eax, byte [0x1406396eb]
cmp al, 0xce
je 0x1402e3104
mov cl, 0xb7
nop dword [rax]
mov al, 0xa8
lock cmpxchg byte [0x1406396eb], cl
je 0x1402e3281
cmp al, 0xce
jne 0x1402e30f0
lea rax, [0x1406396e0]
ret
movzx eax, byte [0x14063979d]
nop word cs:[rax + rax]
cmp al, 0xa0
je 0x1402e31ad
movzx ecx, byte [0x1406399e4]
mov edx, ecx
xor dl, 0x88
mov eax, ecx
and al, 8
add al, al
add al, dl
add cl, 0xcd
lock cmpxchg byte [0x14063979d], cl
jne 0x1402e3120
xor edx, edx
lea rax, [0x140639790]
lea rcx, [0x14053e250]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
inc r8b
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
dec r8b
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0xdc5d4350
and edx, 0x5c5d4350
lea edx, [r8 + rdx*2]
add edx, 0x23a2bcb1
cmp edx, 0xd
jl 0x1402e3160
mov al, 0xa0
xchg byte [0x14063979d], al
lea rax, [0x140639790]
ret
xor edx, edx
lea rax, [0x1406395f0]
lea rcx, [0x14053e0d0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
xor r9b, r8b
mov r10d, r9d
not r10b
and r8b, r10b
add r8b, r8b
mov r11d, r8d
xor r11b, r10b
xor r10b, r9b
and r10b, r8b
xor r10b, r9b
and r11b, r8b
add r11b, r11b
add r11b, r10b
mov byte [rdx + rax], r11b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x1402e31d0
mov al, 0x3a
xchg byte [0x140639600], al
lea rax, [0x1406395f0]
ret
xor edx, edx
lea rax, [0x1406397d0]
lea rcx, [0x14053e290]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x1406399e0]
add edx, r8d
add edx, 0xf6f10507
cmp edx, 0xc
jl 0x1402e3240
mov al, 0x45
xchg byte [0x1406397dc], al
lea rax, [0x1406397d0]
ret
xor eax, eax
lea rcx, [0x1406396e0]
lea rdx, [0x14053e1a0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x1402e32b8
inc rax
jmp 0x1402e32a0
mov al, 0xce
xchg byte [0x1406396eb], al
lea rax, [0x1406396e0]
ret
Function at 0x1402e83f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
sub rsp, 0x130
mov rsi, rcx
mov eax, dword [0x140695070]
mov ecx, dword [0x140697a88]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x26838]
jg 0x1402e85db
mov rcx, qword [0x140695060]
mov rax, qword [rsi + 0x18]
movabs rdx, 0xd26012f9214e221c
add rdx, qword [0x14063a9a8]
cmp qword [rsi + 0x20], rdx
jbe 0x1402e8448
mov rsi, qword [rsi + 8]
jmp 0x1402e844c
add rsi, 8
test rcx, rcx
sete dl
test rax, rax
sete r8b
setne r9b
and r9b, dl
xor dl, r8b
and dl, r8b
mov r8, rcx
or r8, rax
sete r8b
or r8b, r9b
or r8b, dl
jne 0x1402e85c8
cmp qword [0x140695068], 0x10
jb 0x1402e848f
mov rdx, qword [0x140695050]
jmp 0x1402e8496
lea rdx, [0x140695050]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x120], xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov r9, rcx
mov r8, rdx
and r9, 7
je 0x1402e8536
lea r8, [rdx + 1]
dec r9
nop dword [rax]
movzx r10d, byte [r8 - 1]
mov byte [rsp + r10 + 0x30], 1
sub r9, 1
jb 0x1402e8536
inc r8
jmp 0x1402e8520
cmp rcx, 8
jb 0x1402e8598
add rdx, rcx
nop
movzx ecx, byte [r8]
mov byte [rsp + rcx + 0x30], 1
movzx ecx, byte [r8 + 1]
mov byte [rsp + rcx + 0x30], 1
movzx ecx, byte [r8 + 2]
mov byte [rsp + rcx + 0x30], 1
movzx ecx, byte [r8 + 3]
mov byte [rsp + rcx + 0x30], 1
movzx ecx, byte [r8 + 4]
mov byte [rsp + rcx + 0x30], 1
movzx ecx, byte [r8 + 5]
mov byte [rsp + rcx + 0x30], 1
movzx ecx, byte [r8 + 6]
mov byte [rsp + rcx + 0x30], 1
movzx ecx, byte [r8 + 7]
mov byte [rsp + rcx + 0x30], 1
add r8, 8
cmp r8, rdx
jne 0x1402e8540
test rax, rax
jle 0x1402e85c8
add rax, rsi
inc rsi
xor ecx, ecx
nop word cs:[rax + rax]
movzx edx, byte [rsi - 1]
cmp byte [rsp + rdx + 0x30], 0
jne 0x1402e85d3
cmp rsi, rax
jae 0x1402e85c8
dec rcx
inc rsi
jmp 0x1402e85b0
xor eax, eax
add rsp, 0x130
pop rsi
ret
test rcx, rcx
sete al
jmp 0x1402e85ca
mov dword [rsp + 0x28], 0xe4445752
mov dword [rsp + 0x20], 0x790a6c13
lea rdx, [0x140695070]
mov ecx, 1
xor r8d, r8d
xor r9d, r9d
call fcn.1402ee1a0
cmp dword [0x140695070], 0xffffffff
jne 0x1402e8420
mov qword [0x140695068], 0xf
mov qword [0x140695060], 1
mov word [0x140695050], 0x5c
lea rax, [0x14052ecd8]
mov qword [0x140695048], rax
lea rcx, [0x1402ebaa0]
mov edx, 0x750a0b22
mov r8d, 0x421bd833
call fcn.1401676c0
mov dword [rsp + 0x28], 0xe4445752
mov dword [rsp + 0x20], 0x790a6c13
lea rdx, [0x140695070]
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call fcn.1402ee1a0
jmp 0x1402e8420
Function at 0x1402ed120
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
test ecx, ecx
je 0x1402ed16f
test edx, edx
je 0x1402ed27a
movzx eax, byte [0x140639fb3]
cmp al, 0xce
je 0x1402ed349
mov cl, 0xa9
nop
mov al, 0x73
lock cmpxchg byte [0x140639fb3], cl
je 0x1402ed303
movzx edx, byte [0x14063a9b4]
mov r8d, edx
xor r8b, 0x33
and dl, 0x33
add dl, dl
add dl, r8b
cmp al, dl
jne 0x1402ed140
jmp 0x1402ed349
test edx, edx
je 0x1402ed2c9
movzx eax, byte [0x14063a2dd]
nop
cmp al, 0x2b
je 0x1402ed26e
movzx ecx, byte [0x14063a9b4]
mov eax, ecx
not al
mov edx, ecx
and dl, 0xc9
mov r8d, eax
and r8b, 0x36
or r8b, dl
mov edx, ecx
xor dl, 0x36
and al, 0x49
or al, dl
not al
add al, al
add al, r8b
add cl, 0x5d
lock cmpxchg byte [0x14063a2dd], cl
jne 0x1402ed180
xor eax, eax
lea rcx, [0x14063a2d0]
lea rdx, [0x14053eaa0]
nop
cdqe
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
mov r11d, r9d
not r11b
mov ebx, r8d
and bl, r11b
mov esi, r10d
and sil, r9b
or sil, bl
mov ebx, esi
xor bl, r8b
and bl, sil
xor r11b, r8b
xor r8b, r9b
and r8b, r10b
or r8b, r11b
not bl
mov r9d, ebx
xor r9b, r8b
or bl, r8b
not bl
or bl, r9b
mov byte [rax + rcx], bl
mov r8d, dword [0x14063a9b0]
mov r9d, r8d
not r9d
mov r10d, r8d
and r10d, 0xb5105384
mov r11d, r9d
and r11d, 0x4aefac7b
or r11d, r10d
xor r8d, 0x4aefac7b
and r9d, 0x35105384
or r9d, r8d
not r9d
lea r8d, [r11 + r9*2]
add eax, r8d
cmp eax, 0xd
jl 0x1402ed1d0
mov al, 0x2b
xchg byte [0x14063a2dd], al
lea rax, [0x14063a2d0]
jmp 0x1402ed3e7
movzx eax, byte [0x14063a18d]
movzx ecx, byte [0x14063a9b4]
mov edx, ecx
xor dl, 0x10
and dl, cl
xor cl, 0xef
add dl, dl
add dl, cl
add dl, 0x53
cmp al, dl
je 0x1402ed3a0
mov cl, 0xf0
nop word cs:[rax + rax]
mov al, 0x61
lock cmpxchg byte [0x14063a18d], cl
je 0x1402ed355
cmp al, 0xdd
jne 0x1402ed2b0
jmp 0x1402ed3a0
movzx eax, byte [0x14063a10b]
cmp al, 0x1b
je 0x1402ed3e0
mov cl, 0x28
nop word [rax + rax]
mov al, 0xc5
lock cmpxchg byte [0x14063a10b], cl
je 0x1402ed3a9
movzx edx, byte [0x14063a9b4]
add dl, 0x80
cmp al, dl
jne 0x1402ed2e0
jmp 0x1402ed3e0
xor edx, edx
lea rax, [0x140639fb0]
lea rcx, [0x14053e790]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x14063a9b0]
add edx, r8d
add edx, 0x4aefac7b
cmp edx, 3
jl 0x1402ed320
mov al, 0xce
xchg byte [0x140639fb3], al
lea rax, [0x140639fb0]
jmp 0x1402ed3e7
xor eax, eax
lea rcx, [0x14063a180]
lea rdx, [0x14053e950]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1402ed398
inc rax
jmp 0x1402ed370
mov al, 0xdd
xchg byte [0x14063a18d], al
lea rax, [0x14063a180]
jmp 0x1402ed3e7
xor eax, eax
lea rcx, [0x14063a100]
lea rdx, [0x14053e8d0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x1402ed3d8
inc rax
jmp 0x1402ed3c0
mov al, 0x1b
xchg byte [0x14063a10b], al
lea rax, [0x14063a100]
pop rbx
pop rsi
ret
Function at 0x1402f6720
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
mov rax, qword [rcx + 0x48]
cmp rax, 0x10
jb 0x1402f688b
mov rdi, qword [rsi + 0x30]
mov rcx, rax
xor rcx, 1
mov edx, eax
and edx, 1
lea rbx, [rcx + rdx*2]
cmp rbx, 0x1000
jb 0x1402f67bc
mov ecx, dword [0x140695268]
mov edx, dword [0x14063c140]
lea r8d, [rdx + rcx]
add r8d, 0xba26dc04
imul r8d, ecx
and r8d, 1
add edx, 0xba26dc03
cmp r8d, edx
je 0x1402f67a1
nop dword [rax]
mov ecx, dword [0x140695268]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
jne 0x1402f6790
mov rcx, qword [rdi - 8]
sub rdi, rcx
add rdi, 0xfffffffffffffff8
cmp rdi, 0x20
jae 0x1402f67e8
add rax, 0x28
mov rbx, rax
mov rdi, rcx
mov ecx, dword [0x140695268]
mov r8d, dword [0x14063c140]
mov eax, ecx
sub eax, r8d
add eax, 0x45d923fc
imul eax, ecx
add r8d, 0xba26dc05
xor edx, edx
div r8d
test edx, edx
jne 0x1402f6830
jmp 0x1402f67ed
call fcn.1404ca324
mov dword [rsp + 0x20], 0xdb58558b
mov rcx, rdi
mov rdx, rbx
mov r8d, 0xb048eea3
mov r9d, 0x5de03f02
call fcn.1400a75d0
movabs rax, 0x69a8e0008622d15f
add rax, qword [0x14063c138]
cmp rsi, rax
jne 0x1402f688b
nop word cs:[rax + rax]
mov eax, dword [0x14063c140]
lea r8d, [rax + 0x6a6fcaa6]
mov ecx, eax
xor ecx, 0x18071b05
mov edx, eax
and edx, 0x18071b05
lea r9d, [rcx + rdx*2]
add eax, 0x957f318e
mov dword [rsp + 0x20], eax
mov rcx, rdi
mov rdx, rbx
call fcn.1400a75d0
mov eax, dword [0x14069526c]
mov ecx, dword [0x14063c140]
mov edx, ecx
xor edx, 0xba26dc0d
and ecx, 0x3a26dc0d
lea ecx, [rdx + rcx*2]
cmp eax, ecx
jge 0x1402f6830
jmp 0x1402f67ed
mov rax, qword [0x14063c138]
movabs rcx, 0xd8c5dc47bfed9926
xor rcx, rax
movabs rdx, 0x58c5dc47bfed9926
and rdx, rax
lea rax, [rcx + rdx*2]
movabs rcx, 0x90e303b8c6353839
add rcx, rax
mov qword [rsi + 0x40], rcx
mov qword [rsi + 0x48], 0xf
mov byte [rsi + 0x30], 0
mov rax, qword [rsi + 0x20]
cmp rax, 0x10
jb 0x1402f6924
mov rcx, qword [rsi + 8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1402f690b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1402f6941
mov rcx, qword [0x140693e30]
lea rdx, [rcx + rax]
add rdx, 0x28
mov rcx, r8
mov dword [rsp + 0x20], 0xdb58558b
mov r8d, 0xb048eea3
mov r9d, 0x5de03f02
call fcn.1400a75d0
mov qword [rsi + 0x18], 0
mov qword [rsi + 0x20], 0xf
mov byte [rsi + 8], 0
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop rbp
ret
call fcn.1404ca324
int3
Function at 0x1402fdb70
Capabilities:
Encode data using xor

Disassembly:
push rbx
test ecx, ecx
je 0x1402fdba9
test edx, edx
je 0x1402fdc0c
movzx eax, byte [0x14063c348]
cmp al, 0xb8
je 0x1402fdcc8
mov cl, 0x3d
nop
mov al, 0xb5
lock cmpxchg byte [0x14063c348], cl
je 0x1402fdc69
cmp al, 0xb8
jne 0x1402fdb90
jmp 0x1402fdcc8
test edx, edx
je 0x1402fdc39
movzx eax, byte [0x14063c396]
nop dword [rax + rax]
cmp al, 0x63
je 0x1402fdcd9
movzx ecx, byte [0x14063cc78]
lea eax, [rcx + 0x78]
add cl, 9
lock cmpxchg byte [0x14063c396], cl
jne 0x1402fdbc0
xor eax, eax
lea rcx, [0x14063c380]
lea rdx, [0x14053f850]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x15
jg 0x1402fdcd1
inc rax
jmp 0x1402fdbf0
movzx eax, byte [0x14063c1d0]
cmp al, 7
je 0x1402fdd30
mov cl, 0x3e
nop dword [rax]
mov al, 0xa3
lock cmpxchg byte [0x14063c1d0], cl
je 0x1402fdce2
cmp al, 7
jne 0x1402fdc20
jmp 0x1402fdd30
movzx eax, byte [0x14063c222]
cmp al, 0xa7
je 0x1402fdd9f
mov cl, 0x7f
nop word [rax + rax]
mov al, 0x2e
lock cmpxchg byte [0x14063c222], cl
je 0x1402fdd39
cmp al, 0xa7
jne 0x1402fdc50
jmp 0x1402fdd9f
xor eax, eax
lea rcx, [0x14063c330]
lea rdx, [0x14053f800]
nop dword [rax]
cdqe
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
mov r8d, dword [0x14063cc7c]
mov r9d, r8d
xor r9d, 0x32470090
mov r10d, r8d
and r10d, 0x32470090
lea r9d, [r9 + r10*2]
add eax, r9d
add r8d, 0x324700a7
cmp eax, r8d
jl 0x1402fdc80
movzx eax, byte [0x14063cc78]
add al, 0x8a
xchg byte [0x14063c348], al
lea rax, [0x14063c330]
pop rbx
ret
mov al, 0x63
xchg byte [0x14063c396], al
lea rax, [0x14063c380]
pop rbx
ret
xor edx, edx
lea rax, [0x14063c1a0]
lea rcx, [0x14053f6c0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x14063cc7c]
add edx, r8d
add edx, 0x32470090
cmp edx, 0x30
jl 0x1402fdd00
movzx eax, byte [0x14063cc78]
add al, 0xd9
xchg byte [0x14063c1d0], al
lea rax, [0x14063c1a0]
pop rbx
ret
xor eax, eax
lea rcx, [0x14063c220]
lea rdx, [0x14053f720]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
not r10b
mov r11d, r8d
and r11b, r10b
xor r10b, r8b
not r8b
mov ebx, r8d
xor bl, r9b
or r11b, bl
not r11b
and r8b, r9b
or r8b, r10b
not r8b
or r8b, r11b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x1402fdd97
inc rax
jmp 0x1402fdd50
mov al, 0xa7
xchg byte [0x14063c222], al
lea rax, [0x14063c220]
pop rbx
ret
Function at 0x14035e780
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14035e7d6
mov eax, 0x95a8d81a
add eax, dword [0x14064bb40]
cmp edx, eax
jne 0x14035e8aa
movzx eax, byte [0x14064b95e]
cmp al, 0x3b
je 0x14035e7ce
mov cl, 0xe8
nop word cs:[rax + rax]
mov al, 0xe3
lock cmpxchg byte [0x14064b95e], cl
je 0x14035e90c
movzx edx, byte [0x14064bb44]
add dl, 0x1e
cmp al, dl
jne 0x14035e7b0
lea rax, [0x14064b940]
ret
mov eax, dword [0x14064bb40]
mov ecx, eax
xor ecx, 0x425a9138
and eax, 0x425a9138
lea eax, [rcx + rax*2]
add eax, 0x534e46e2
cmp edx, eax
jne 0x14035e8dc
movzx eax, byte [0x14064baa3]
cmp al, 0xbc
je 0x14035e8a2
movzx ecx, byte [0x14064bb44]
mov edx, ecx
xor dl, 0x77
mov eax, ecx
and al, 0x77
add al, al
add al, dl
add cl, 7
lock cmpxchg byte [0x14064baa3], cl
jne 0x14035e800
xor edx, edx
lea rax, [0x14064baa0]
lea rcx, [0x1405480f0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x14064bb40]
mov r9d, r8d
xor r9d, 0x95a8d81b
and r8d, 0x15a8d81b
add r8d, r8d
add r9d, 0x89501d5f
mov r10d, r9d
xor r10d, r8d
and r9d, r8d
lea r8d, [r10 + r9*2]
mov r9d, 0x89501d5f
sub r9d, r8d
neg edx
mov r8d, edx
xor r8d, r9d
and edx, r9d
lea edx, [r8 + rdx*2]
neg edx
cmp edx, 3
jl 0x14035e840
mov al, 0xbc
xchg byte [0x14064baa3], al
lea rax, [0x14064baa0]
ret
movzx eax, byte [0x14064baeb]
cmp al, 0x40
je 0x14035e8d4
mov cl, 0xa9
nop word [rax + rax]
mov al, 0xf7
lock cmpxchg byte [0x14064baeb], cl
je 0x14035e963
cmp al, 0x40
jne 0x14035e8c0
lea rax, [0x14064bae0]
ret
movzx eax, byte [0x14064ba60]
cmp al, 0x86
je 0x14035e904
mov cl, 0x9e
nop dword [rax]
mov al, 0x74
lock cmpxchg byte [0x14064ba60], cl
je 0x14035e9a8
cmp al, 0x86
jne 0x14035e8f0
lea rax, [0x14064b960]
ret
xor edx, edx
lea rax, [0x14064b940]
lea rcx, [0x140547fa0]
nop dword [rax]
movsxd r8, edx
movzx edx, byte [r8 + rax]
movzx r9d, byte [r8 + rcx]
add dl, 0x11
mov r10d, edx
xor r10b, r9b
and dl, r9b
add dl, dl
add dl, r10b
add dl, 0xef
mov byte [r8 + rax], dl
lea edx, [r8 + r8]
sub edx, r8d
inc edx
cmp edx, 0x1e
jl 0x14035e920
mov al, 0x3b
xchg byte [0x14064b95e], al
lea rax, [0x14064b940]
ret
xor eax, eax
lea rcx, [0x14064bae0]
lea rdx, [0x140548130]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x14035e998
inc rax
jmp 0x14035e980
mov al, 0x40
xchg byte [0x14064baeb], al
lea rax, [0x14064bae0]
ret
xor eax, eax
lea rcx, [0x14064b960]
lea rdx, [0x140547fc0]
mov r8d, 0x95a8d91a
nop
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14064bb40]
add r10d, r8d
cmp r9d, r10d
jge 0x14035e9e1
inc rax
jmp 0x14035e9c0
mov al, 0x86
xchg byte [0x14064ba60], al
lea rax, [0x14064b960]
ret