joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140194ed0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140194f15
test edx, edx
je 0x140194f4c
movzx eax, byte [0x14052ff15]
cmp al, 0x5d
je 0x140194f0d
mov cl, 0x2f
nop word cs:[rax + rax]
mov al, 0x6d
lock cmpxchg byte [0x14052ff15], cl
je 0x140194fb5
movzx edx, byte [0x140530cbc]
dec dl
cmp al, dl
jne 0x140194ef0
lea rax, [0x14052ff00]
ret
test edx, edx
je 0x140194f7c
movzx eax, byte [0x140530083]
cmp al, 0xe0
je 0x140194f44
mov cl, 0x9f
nop word cs:[rax + rax]
mov al, 0xb1
lock cmpxchg byte [0x140530083], cl
je 0x140195012
cmp al, 0xe0
jne 0x140194f30
lea rax, [0x140530080]
ret
movzx eax, byte [0x14058ef08]
cmp al, 0x13
je 0x140194f74
mov cl, 0x69
nop dword [rax]
xor eax, eax
lock cmpxchg byte [0x14058ef08], cl
je 0x14019504c
cmp al, 0x13
jne 0x140194f60
lea rax, [0x14052fe40]
ret
movzx eax, byte [0x140530005]
cmp al, 0x5d
je 0x140194fad
mov cl, 0xe5
nop dword [rax]
mov al, 0xcb
lock cmpxchg byte [0x140530005], cl
je 0x1401950ea
movzx edx, byte [0x140530cbc]
dec dl
cmp al, dl
jne 0x140194f90
lea rax, [0x14052fff0]
ret
xor edx, edx
lea rax, [0x14052ff00]
lea rcx, [0x140451760]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0xe1aac3d0
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x1e553c30
cmp edx, 0x15
jl 0x140194fd0
movzx eax, byte [0x140530cbc]
dec al
xchg byte [0x14052ff15], al
lea rax, [0x14052ff00]
ret
xor eax, eax
lea rcx, [0x140530080]
lea rdx, [0x1404518c0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1401950da
inc rax
jmp 0x140195030
xor edx, edx
lea rax, [0x14052fe40]
lea rcx, [0x1404516a0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
add r8b, 0xdf
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
add r8b, 0x21
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0xbf02c526
and edx, 0x3f02c526
lea edx, [r8 + rdx*2]
add edx, 0x40fd3adb
mov r8d, dword [0x140530cb8]
mov r9d, r8d
xor r9d, 0x3c0d3006
and r8d, 0x3c0d3006
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x140195060
movzx eax, byte [0x140530cbc]
add al, 0xb5
xchg byte [0x14058ef08], al
lea rax, [0x14052fe40]
ret
mov al, pe_nt_image_headers64
xchg byte [0x140530083], al
lea rax, [0x140530080]
ret
xor eax, eax
lea rcx, [0x14052fff0]
lea rdx, [0x140451840]
nop word [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r9b
mov r10d, r9d
or r10b, r8b
not r10b
and r9b, r8b
or r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x14019512f
inc rax
jmp 0x140195100
mov al, 0x5d
xchg byte [0x140530005], al
lea rax, [0x14052fff0]
ret
Function at 0x14019ad90
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14019adcc
mov ecx, dword [rsp + 0x28]
test edx, edx
je 0x14019adfc
movzx eax, byte [0x14053114e]
cmp al, 0xb7
je 0x14019adc4
mov dl, 0x82
nop dword [rax]
mov al, 0xf5
lock cmpxchg byte [0x14053114e], dl
je 0x14019ae5c
cmp al, 0xb7
jne 0x14019adb0
lea rax, [0x140531140]
ret
test edx, edx
je 0x14019ae2c
movzx eax, byte [0x1405310cd]
cmp al, 0x79
je 0x14019adf4
mov cl, 0x3c
nop dword [rax]
mov al, 0x55
lock cmpxchg byte [0x1405310cd], cl
je 0x14019aecb
cmp al, 0x79
jne 0x14019ade0
lea rax, [0x1405310c0]
ret
movzx eax, byte [0x140531242]
cmp al, 0x2d
je 0x14019ae24
mov dl, 0xd8
nop dword [rax]
mov al, 0x56
lock cmpxchg byte [0x140531242], dl
je 0x14019aef8
cmp al, 0x2d
jne 0x14019ae10
lea rax, [0x140531230]
ret
movzx eax, byte [0x14053104d]
cmp al, 0x41
je 0x14019ae54
mov cl, 0x45
nop dword [rax]
mov al, 0x84
lock cmpxchg byte [0x14053104d], cl
je 0x14019af6f
cmp al, 0x41
jne 0x14019ae40
lea rax, [0x140531040]
ret
xor eax, eax
lea rdx, [0x140531140]
lea r8, [0x140451d70]
xor ecx, 0x59246775
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
movzx r10d, byte [rax + r8]
not r9b
mov r11d, r9d
and r11b, r10b
not r10b
xor r9b, r10b
and r9b, r10b
or r9b, r11b
mov byte [rax + rdx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140531528]
add r10d, ecx
cmp r9d, r10d
jge 0x14019aebb
inc rax
jmp 0x14019ae80
mov al, 0xb7
xchg byte [0x14053114e], al
lea rax, [0x140531140]
ret
xor eax, eax
lea rcx, [0x1405310c0]
lea rdx, [0x140451cf0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14019af5f
inc rax
jmp 0x14019aee0
xor r8d, r8d
lea rax, [0x140531230]
lea rdx, [0x140451e60]
xor ecx, 0x59246766
nop
movsxd r8, r8d
movzx r9d, byte [r8 + rdx]
xor byte [r8 + rax], r9b
mov r9d, dword [0x140531528]
mov r10d, ecx
xor r10d, r9d
and r9d, ecx
lea r9d, [r10 + r9*2]
mov r10d, r8d
xor r10d, r9d
not r8d
not r9d
and r9d, r8d
or r9d, r10d
not r9d
lea r8d, [r10 + r9*2]
cmp r8d, 0x12
jl 0x14019af10
mov al, 0x2d
xchg byte [0x140531242], al
lea rax, [0x140531230]
ret
mov al, 0x79
xchg byte [0x1405310cd], al
lea rax, [0x1405310c0]
ret
xor eax, eax
lea rcx, [0x140531040]
lea rdx, [0x140451c70]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14019af98
inc rax
jmp 0x14019af80
mov al, 0x41
xchg byte [0x14053104d], al
lea rax, [0x140531040]
ret
Function at 0x14019afd0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14019b06c
mov eax, r8d
xor eax, 0x7f11aaa
add eax, dword [0x140531528]
cmp edx, eax
jne 0x14019b0ac
movzx eax, byte [0x1405311dd]
nop word [rax + rax]
cmp al, 0x3e
je 0x14019b180
movzx ecx, byte [0x14053152c]
mov eax, r8d
xor al, 0x67
add al, cl
mov edx, r8d
xor dl, 0x49
add dl, cl
lock cmpxchg byte [0x1405311dd], dl
jne 0x14019b000
xor eax, eax
lea rcx, [0x1405311d0]
lea rdx, [0x140451e00]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14019b178
inc rax
jmp 0x14019b040
test edx, edx
je 0x14019b138
movzx eax, byte [0x140531271]
cmp al, 0x1c
je 0x14019b0a4
mov cl, 0x73
nop word cs:[rax + rax]
mov al, 0xbf
lock cmpxchg byte [0x140531271], cl
je 0x14019b198
cmp al, 0x1c
jne 0x14019b090
lea rax, [0x140531260]
ret
movzx eax, byte [0x140530fb1]
nop word cs:[rax + rax]
cmp al, 0xa4
je 0x14019b190
movzx ecx, byte [0x14053152c]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0x85
mov eax, r8d
and al, 0x7a
or al, r9b
mov r9d, ecx
xor r9b, cl
not r9b
and r9b, al
xor r9b, cl
and al, cl
add al, al
add al, r9b
add dl, cl
lock cmpxchg byte [0x140530fb1], dl
jne 0x14019b0c0
xor eax, eax
lea rcx, [0x140530fa0]
lea rdx, [0x140451bd0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x14019b188
inc rax
jmp 0x14019b120
movzx eax, byte [0x14053106d]
cmp al, 0x38
je 0x14019b170
mov cl, 0xd2
nop word cs:[rax + rax]
mov al, 0x42
lock cmpxchg byte [0x14053106d], cl
je 0x14019b1ef
mov edx, r8d
xor dl, 0xa5
add dl, byte [0x14053152c]
cmp al, dl
jne 0x14019b150
lea rax, [0x140531060]
ret
mov al, 0x3e
xchg byte [0x1405311dd], al
lea rax, [0x1405311d0]
ret
mov al, 0xa4
xchg byte [0x140530fb1], al
lea rax, [0x140530fa0]
ret
xor edx, edx
lea rax, [0x140531260]
lea rcx, [0x140451e90]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x11
jl 0x14019b1b0
mov al, 0x1c
xchg byte [0x140531271], al
lea rax, [0x140531260]
ret
xor eax, eax
lea rcx, [0x140531060]
lea rdx, [0x140451c90]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14019b218
inc rax
jmp 0x14019b200
mov al, 0x38
xchg byte [0x14053106d], al
lea rax, [0x140531060]
ret
Function at 0x14019b230
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14019b288
mov eax, r8d
xor eax, 0xad0d3cda
add eax, dword [0x140531528]
cmp edx, eax
jne 0x14019b2e0
movzx eax, byte [0x140531193]
cmp al, 0x13
je 0x14019b280
mov cl, 0x87
nop dword [rax]
mov al, 0xef
lock cmpxchg byte [0x140531193], cl
je 0x14019b382
mov edx, r8d
xor dl, 0xf0
add dl, byte [0x14053152c]
cmp al, dl
jne 0x14019b260
lea rax, [0x140531180]
ret
test edx, edx
je 0x14019b308
movzx eax, byte [0x140530f65]
mov ecx, r8d
xor cl, 0xd3
add cl, byte [0x14053152c]
cmp al, cl
je 0x14019b2d8
nop word cs:[rax + rax]
movzx ecx, byte [0x14053152c]
mov eax, r8d
xor al, 0xf7
add al, cl
mov edx, r8d
xor dl, 0x8b
add dl, cl
lock cmpxchg byte [0x140530f65], dl
je 0x14019b3df
cmp al, 0x36
jne 0x14019b2b0
lea rax, [0x140530f50]
ret
cmp byte [0x1405310ef], 0
je 0x14019b300
mov cl, 0x99
nop dword [rax + rax]
mov al, 0xde
lock cmpxchg byte [0x1405310ef], cl
je 0x14019b33c
test al, al
jne 0x14019b2f0
lea rax, [0x1405310d0]
ret
movzx eax, byte [0x14053125d]
cmp al, 0x48
je 0x14019b334
mov cl, 0x2c
nop word cs:[rax + rax]
mov al, 0xa3
lock cmpxchg byte [0x14053125d], cl
je 0x14019b42d
cmp al, 0x48
jne 0x14019b320
lea rax, [0x140531250]
ret
xor eax, eax
lea rcx, [0x1405310d0]
lea rdx, [0x140451d00]
nop dword [rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0x1e
jg 0x14019b368
inc rax
jmp 0x14019b350
xor r8b, 0x8d
add r8b, byte [0x14053152c]
xchg byte [0x1405310ef], r8b
lea rax, [0x1405310d0]
ret
xor edx, edx
lea rax, [0x140531180]
lea rcx, [0x140451db0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x13
jl 0x14019b3a0
mov al, 0x13
xchg byte [0x140531193], al
lea rax, [0x140531180]
ret
xor eax, eax
lea rcx, [0x140530f50]
lea rdx, [0x140451b80]
xor r8d, 0xad0d3cdb
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x140531528]
add r9d, r8d
add eax, r9d
cmp eax, 0x15
jl 0x14019b400
mov al, 0x36
xchg byte [0x140530f65], al
lea rax, [0x140530f50]
ret
xor eax, eax
lea rcx, [0x140531250]
lea rdx, [0x140451e80]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14019b468
inc rax
jmp 0x14019b440
mov al, 0x48
xchg byte [0x14053125d], al
lea rax, [0x140531250]
ret
Function at 0x14019bd90
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14019bddc
mov eax, r8d
xor eax, 0xdd566a7a
add eax, dword [0x140531528]
cmp edx, eax
jne 0x14019be0c
movzx eax, byte [0x14053113d]
cmp al, 5
je 0x14019bdd4
mov cl, 0xd1
nop dword [rax + rax]
mov al, 0x57
lock cmpxchg byte [0x14053113d], cl
je 0x14019be7c
cmp al, 5
jne 0x14019bdc0
lea rax, [0x140531130]
ret
test edx, edx
je 0x14019be3c
movzx eax, byte [0x140531081]
cmp al, 0xaa
je 0x14019be04
mov cl, 0xbc
nop dword [rax]
mov al, 0x38
lock cmpxchg byte [0x140531081], cl
je 0x14019bf1f
cmp al, 0xaa
jne 0x14019bdf0
lea rax, [0x140531070]
ret
movzx eax, byte [0x14053103d]
cmp al, 0xe4
je 0x14019be34
mov cl, 0x7d
nop dword [rax]
mov al, 0x71
lock cmpxchg byte [0x14053103d], cl
je 0x14019bedd
cmp al, 0xe4
jne 0x14019be20
lea rax, [0x140531030]
ret
movzx eax, byte [0x14053115d]
mov ecx, r8d
xor cl, 0xaf
add cl, byte [0x14053152c]
cmp al, cl
je 0x14019be74
mov cl, 0x8b
nop word cs:[rax + rax]
mov al, 0xa7
lock cmpxchg byte [0x14053115d], cl
je 0x14019bf7a
cmp al, 0x82
jne 0x14019be60
lea rax, [0x140531150]
ret
xor eax, eax
lea rcx, [0x140531130]
lea rdx, [0x140451d60]
xor r8d, 0xdd566a7b
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
mov r9d, dword [0x140531528]
add r9d, r8d
add eax, r9d
cmp eax, 0xd
jl 0x14019bea0
mov al, 5
xchg byte [0x14053113d], al
lea rax, [0x140531130]
ret
xor edx, edx
lea rax, [0x140531030]
lea rcx, [0x140451c60]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x14019bef0
mov al, 0xe4
xchg byte [0x14053103d], al
lea rax, [0x140531030]
ret
xor edx, edx
lea rax, [0x140531070]
lea rcx, [0x140451ca0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
add edx, edx
and edx, 2
mov r9d, r8d
xor r9d, edx
and edx, r8d
lea edx, [r9 + rdx*2]
cmp edx, 0x11
jl 0x14019bf30
mov al, 0xaa
xchg byte [0x140531081], al
lea rax, [0x140531070]
ret
xor eax, eax
lea rcx, [0x140531150]
lea rdx, [0x140451d80]
xor r8d, 0xdd566a77
nop word cs:[rax + rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140531528]
add r10d, r8d
cmp r9d, r10d
jge 0x14019bfd5
inc rax
jmp 0x14019bfa0
mov al, 0x82
xchg byte [0x14053115d], al
lea rax, [0x140531150]
ret
Function at 0x1401acda0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x140531ed0]
mov r8d, eax
xor r8d, 0xbe6f1718
and eax, 0x3e6f1718
lea eax, [r8 + rax*2]
cmp ecx, eax
jne 0x1401acdec
test edx, edx
je 0x1401ace1c
movzx eax, byte [0x140531844]
cmp al, 0x42
je 0x1401acde4
mov cl, 0xc
nop
mov al, 0xcb
lock cmpxchg byte [0x140531844], cl
je 0x1401aceac
cmp al, 0x42
jne 0x1401acdd0
lea rax, [0x140531840]
ret
test edx, edx
je 0x1401ace4c
movzx eax, byte [0x1405319e3]
cmp al, 0x7c
je 0x1401ace14
xor ecx, ecx
nop dword [rax]
mov al, 0x3c
lock cmpxchg byte [0x1405319e3], cl
je 0x1401aced8
cmp al, 0x7c
jne 0x1401ace00
lea rax, [0x1405319c0]
ret
movzx eax, byte [0x1405318e6]
cmp al, 0x5a
je 0x1401ace44
mov cl, 0xd9
nop dword [rax]
mov al, 0x72
lock cmpxchg byte [0x1405318e6], cl
je 0x1401acf38
cmp al, 0x5a
jne 0x1401ace30
lea rax, [0x1405318e0]
ret
movzx eax, byte [0x1405317af]
nop word cs:[rax + rax]
cmp al, 0x77
je 0x1401acf9b
movzx ecx, byte [0x140531ed4]
lea eax, [rcx + 0x27]
add cl, 0x51
lock cmpxchg byte [0x1405317af], cl
jne 0x1401ace60
xor eax, eax
lea rcx, [0x140531780]
lea rdx, [0x140452130]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x2e
jg 0x1401acf93
inc rax
jmp 0x1401ace90
xor eax, eax
lea rcx, [0x140531840]
lea rdx, [0x1404521f0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x1401acf18
inc rax
jmp 0x1401acec0
xor eax, eax
lea rcx, [0x1405319c0]
lea rdx, [0x140452370]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1401acf28
inc rax
jmp 0x1401acef0
mov al, 0x42
xchg byte [0x140531844], al
lea rax, [0x140531840]
ret
mov al, 0x7c
xchg byte [0x1405319e3], al
lea rax, [0x1405319c0]
ret
xor edx, edx
lea rax, [0x1405318e0]
lea rcx, [0x140452290]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 6
jl 0x1401acf50
mov al, 0x5a
xchg byte [0x1405318e6], al
lea rax, [0x1405318e0]
ret
mov al, 0x77
xchg byte [0x1405317af], al
lea rax, [0x140531780]
ret
Function at 0x1401ad270
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov eax, 0xbe6f1718
mov r8d, dword [0x140531ed0]
add r8d, eax
cmp ecx, r8d
jne 0x1401ad2c9
add eax, dword [0x140531ed0]
cmp edx, eax
jne 0x1401ad2f5
movzx eax, byte [0x140531942]
movzx ecx, byte [0x140531ed4]
add cl, 0x1d
cmp al, cl
je 0x1401ad49d
mov cl, 0x45
nop dword [rax + rax]
mov al, 0x53
lock cmpxchg byte [0x140531942], cl
je 0x1401ad3c2
cmp al, 0x41
jne 0x1401ad2b0
jmp 0x1401ad49d
test edx, edx
je 0x1401ad329
movzx eax, byte [0x140531a1d]
cmp al, 0x91
je 0x1401ad3b6
mov cl, 4
nop
mov al, 0x8f
lock cmpxchg byte [0x140531a1d], cl
je 0x1401ad359
cmp al, 0x91
jne 0x1401ad2e0
jmp 0x1401ad3b6
movzx eax, byte [0x1405319ae]
movzx ecx, byte [0x140531ed4]
add cl, 0x16
cmp al, cl
je 0x1401ad482
mov cl, 0x43
mov al, 0x5a
lock cmpxchg byte [0x1405319ae], cl
je 0x1401ad3fc
cmp al, 0x3a
jne 0x1401ad310
jmp 0x1401ad482
movzx eax, byte [0x140531998]
cmp al, 0x7f
je 0x1401ad50b
xor ecx, ecx
nop word [rax + rax]
mov al, 0x89
lock cmpxchg byte [0x140531998], cl
je 0x1401ad4a6
cmp al, 0x7f
jne 0x1401ad340
jmp 0x1401ad50b
xor eax, eax
lea rcx, [0x140531a10]
lea rdx, [0x1404523c0]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
mov r11d, r9d
not r11b
xor r8b, r11b
xor r11b, r10b
and r11b, r9b
and r10b, r9b
or r10b, r8b
not r10b
or r10b, r11b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401ad3ae
inc rax
jmp 0x1401ad370
mov al, 0x91
xchg byte [0x140531a1d], al
lea rax, [0x140531a10]
jmp 0x1401ad512
xor eax, eax
lea rcx, [0x140531930]
lea rdx, [0x1404522e0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x1401ad48e
inc rax
jmp 0x1401ad3e0
xor r8d, r8d
lea rax, [0x1405319a0]
lea rcx, [0x140452350]
mov edx, 0xbe6f1726
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rax]
movzx r10d, byte [r8 + rcx]
mov r11d, r9d
not r11b
mov ebx, r11d
xor bl, r10b
not r10b
mov esi, r9d
and sil, r10b
or sil, bl
not sil
xor r10b, r11b
and r10b, r9b
or r10b, sil
mov byte [r8 + rax], r10b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x140531ed0]
add r9d, edx
cmp r8d, r9d
jl 0x1401ad420
movzx eax, byte [0x140531ed4]
add al, 0x16
xchg byte [0x1405319ae], al
lea rax, [0x1405319a0]
jmp 0x1401ad512
movzx eax, byte [0x140531ed4]
add al, 0x1d
xchg byte [0x140531942], al
lea rax, [0x140531930]
jmp 0x1401ad512
xor eax, eax
lea rcx, [0x140531980]
lea rdx, [0x140452330]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
mov r9d, dword [0x140531ed0]
mov r10d, r9d
xor r10d, 0xbe6f1730
and r9d, 0x3e6f1730
lea r9d, [r10 + r9*2]
cmp r8d, r9d
jge 0x1401ad503
inc rax
jmp 0x1401ad4c0
mov al, 0x7f
xchg byte [0x140531998], al
lea rax, [0x140531980]
pop rbx
pop rsi
ret
Function at 0x1401ad880
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0xb8ab377d
add eax, dword [0x140531ed0]
cmp ecx, eax
jne 0x1401ad8dc
test edx, edx
je 0x1401ad914
movzx eax, byte [0x140531874]
xor r8b, 0x86
add r8b, byte [0x140531ed4]
cmp al, r8b
je 0x1401ad8d4
mov cl, 0xcc
nop word cs:[rax + rax]
mov al, 0x7f
lock cmpxchg byte [0x140531874], cl
je 0x1401ad99b
cmp al, 7
jne 0x1401ad8c0
lea rax, [0x140531870]
ret
movzx eax, byte [0x1405319b3]
cmp al, 0x53
je 0x1401ad90c
mov cl, 0xcf
nop dword [rax]
mov al, 0xb4
lock cmpxchg byte [0x1405319b3], cl
je 0x1401ad94c
mov edx, r8d
xor dl, 0x4a
add dl, byte [0x140531ed4]
cmp al, dl
jne 0x1401ad8f0
lea rax, [0x1405319b0]
ret
movzx eax, byte [0x14053195e]
cmp al, 0x33
je 0x1401ad944
mov cl, 0x3c
nop word cs:[rax + rax]
mov al, 0x76
lock cmpxchg byte [0x14053195e], cl
je 0x1401ad9ef
cmp al, 0x33
jne 0x1401ad930
lea rax, [0x140531950]
ret
xor edx, edx
lea rax, [0x1405319b0]
lea rcx, [0x140452360]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
add edx, 0xbd6bd9fd
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x42942603
cmp edx, 3
jl 0x1401ad960
mov al, 0x53
xchg byte [0x1405319b3], al
lea rax, [0x1405319b0]
ret
xor eax, eax
lea rcx, [0x140531870]
lea rdx, [0x140452220]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r8b
mov r10d, r8d
and r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x1401ad9df
inc rax
jmp 0x1401ad9b0
mov al, 7
xchg byte [0x140531874], al
lea rax, [0x140531870]
ret
xor eax, eax
lea rcx, [0x140531950]
lea rdx, [0x140452300]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x1401ada18
inc rax
jmp 0x1401ada00
mov al, 0x33
xchg byte [0x14053195e], al
lea rax, [0x140531950]
ret
Function at 0x1401c4130
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401c416c
test edx, edx
je 0x1401c41a6
movzx eax, byte [0x140532322]
cmp al, 0x31
je 0x1401c4164
mov cl, 0xbb
nop word cs:[rax + rax]
mov al, 0xc7
lock cmpxchg byte [0x140532322], cl
je 0x1401c420c
cmp al, 0x31
jne 0x1401c4150
lea rax, [0x140532310]
ret
test edx, edx
je 0x1401c41dc
movzx eax, byte [0x140532561]
cmp al, 0xca
je 0x1401c419e
mov cl, 0x2e
nop dword [rax]
mov al, 0x70
lock cmpxchg byte [0x140532561], cl
je 0x1401c4278
movzx edx, byte [0x140535048]
add dl, 0x5b
cmp al, dl
jne 0x1401c4180
lea rax, [0x140532550]
ret
movzx eax, byte [0x14053229c]
cmp al, 0xf0
je 0x1401c41d4
mov cl, 0x32
nop word cs:[rax + rax]
mov al, 0x4d
lock cmpxchg byte [0x14053229c], cl
je 0x1401c42a8
cmp al, 0xf0
jne 0x1401c41c0
lea rax, [0x140532290]
ret
movzx eax, byte [0x14053241d]
cmp al, 0xf4
je 0x1401c4204
mov cl, 0x42
nop dword [rax]
mov al, 0xa3
lock cmpxchg byte [0x14053241d], cl
je 0x1401c4316
cmp al, 0xf4
jne 0x1401c41f0
lea rax, [0x140532410]
ret
xor eax, eax
lea rcx, [0x140532310]
lea rdx, [0x140452720]
mov r8d, 0x76a2eb1a
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x140535038]
add r10d, r8d
cmp r9d, r10d
jge 0x1401c4261
inc rax
jmp 0x1401c4230
movzx eax, byte [0x140535048]
add al, 0xc2
xchg byte [0x140532322], al
lea rax, [0x140532310]
ret
xor eax, eax
lea rcx, [0x140532550]
lea rdx, [0x140452950]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x1401c4306
inc rax
jmp 0x1401c4290
xor edx, edx
lea rax, [0x140532290]
lea rcx, [0x1404526a0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x140535038]
add edx, r8d
add edx, 0x76a2eb09
mov r9d, r8d
xor r9d, 0x76a2eb14
and r8d, 0x76a2eb14
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x1401c42c0
mov al, 0xf0
xchg byte [0x14053229c], al
lea rax, [0x140532290]
ret
mov al, 0xca
xchg byte [0x140532561], al
lea rax, [0x140532550]
ret
xor eax, eax
lea rcx, [0x140532410]
lea rdx, [0x140452810]
mov r8d, 0x76a2eb15
nop dword [rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140535038]
add r10d, r8d
cmp r9d, r10d
jge 0x1401c4351
inc rax
jmp 0x1401c4330
movzx eax, byte [0x140535048]
mov ecx, eax
xor cl, 0x85
and al, 5
add al, al
add al, cl
xchg byte [0x14053241d], al
lea rax, [0x140532410]
ret