joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140181040
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x140502390]
mov r8d, eax
xor r8d, 0xbe6f1718
and eax, 0x3e6f1718
lea eax, [r8 + rax*2]
cmp ecx, eax
jne 0x14018108c
test edx, edx
je 0x1401810bc
movzx eax, byte [0x140501d04]
cmp al, 0x42
je 0x140181084
mov cl, 0xc
nop
mov al, 0xcb
lock cmpxchg byte [0x140501d04], cl
je 0x14018114c
cmp al, 0x42
jne 0x140181070
lea rax, [0x140501d00]
ret
test edx, edx
je 0x1401810ec
movzx eax, byte [0x140501ea3]
cmp al, 0x7c
je 0x1401810b4
xor ecx, ecx
nop dword [rax]
mov al, 0x3c
lock cmpxchg byte [0x140501ea3], cl
je 0x140181178
cmp al, 0x7c
jne 0x1401810a0
lea rax, [0x140501e80]
ret
movzx eax, byte [0x140501da6]
cmp al, 0x5a
je 0x1401810e4
mov cl, 0xd9
nop dword [rax]
mov al, 0x72
lock cmpxchg byte [0x140501da6], cl
je 0x1401811d8
cmp al, 0x5a
jne 0x1401810d0
lea rax, [0x140501da0]
ret
movzx eax, byte [0x140501c6f]
nop word cs:[rax + rax]
cmp al, 0x77
je 0x14018123b
movzx ecx, byte [0x140502394]
lea eax, [rcx + 0x27]
add cl, 0x51
lock cmpxchg byte [0x140501c6f], cl
jne 0x140181100
xor eax, eax
lea rcx, [0x140501c40]
lea rdx, [0x140426110]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x2e
jg 0x140181233
inc rax
jmp 0x140181130
xor eax, eax
lea rcx, [0x140501d00]
lea rdx, [0x1404261d0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x1401811b8
inc rax
jmp 0x140181160
xor eax, eax
lea rcx, [0x140501e80]
lea rdx, [0x140426350]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1401811c8
inc rax
jmp 0x140181190
mov al, 0x42
xchg byte [0x140501d04], al
lea rax, [0x140501d00]
ret
mov al, 0x7c
xchg byte [0x140501ea3], al
lea rax, [0x140501e80]
ret
xor edx, edx
lea rax, [0x140501da0]
lea rcx, [0x140426270]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 6
jl 0x1401811f0
mov al, 0x5a
xchg byte [0x140501da6], al
lea rax, [0x140501da0]
ret
mov al, 0x77
xchg byte [0x140501c6f], al
lea rax, [0x140501c40]
ret
Function at 0x140181510
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov eax, 0xbe6f1718
mov r8d, dword [0x140502390]
add r8d, eax
cmp ecx, r8d
jne 0x140181569
add eax, dword [0x140502390]
cmp edx, eax
jne 0x140181595
movzx eax, byte [0x140501e02]
movzx ecx, byte [0x140502394]
add cl, 0x1d
cmp al, cl
je 0x14018173d
mov cl, 0x45
nop dword [rax + rax]
mov al, 0x53
lock cmpxchg byte [0x140501e02], cl
je 0x140181662
cmp al, 0x41
jne 0x140181550
jmp 0x14018173d
test edx, edx
je 0x1401815c9
movzx eax, byte [0x140501edd]
cmp al, 0x91
je 0x140181656
mov cl, 4
nop
mov al, 0x8f
lock cmpxchg byte [0x140501edd], cl
je 0x1401815f9
cmp al, 0x91
jne 0x140181580
jmp 0x140181656
movzx eax, byte [0x140501e6e]
movzx ecx, byte [0x140502394]
add cl, 0x16
cmp al, cl
je 0x140181722
mov cl, 0x43
mov al, 0x5a
lock cmpxchg byte [0x140501e6e], cl
je 0x14018169c
cmp al, 0x3a
jne 0x1401815b0
jmp 0x140181722
movzx eax, byte [0x140501e58]
cmp al, 0x7f
je 0x1401817ab
xor ecx, ecx
nop word [rax + rax]
mov al, 0x89
lock cmpxchg byte [0x140501e58], cl
je 0x140181746
cmp al, 0x7f
jne 0x1401815e0
jmp 0x1401817ab
xor eax, eax
lea rcx, [0x140501ed0]
lea rdx, [0x1404263a0]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
mov r11d, r9d
not r11b
xor r8b, r11b
xor r11b, r10b
and r11b, r9b
and r10b, r9b
or r10b, r8b
not r10b
or r10b, r11b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14018164e
inc rax
jmp 0x140181610
mov al, 0x91
xchg byte [0x140501edd], al
lea rax, [0x140501ed0]
jmp 0x1401817b2
xor eax, eax
lea rcx, [0x140501df0]
lea rdx, [0x1404262c0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x14018172e
inc rax
jmp 0x140181680
xor r8d, r8d
lea rax, [0x140501e60]
lea rcx, [0x140426330]
mov edx, 0xbe6f1726
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rax]
movzx r10d, byte [r8 + rcx]
mov r11d, r9d
not r11b
mov ebx, r11d
xor bl, r10b
not r10b
mov esi, r9d
and sil, r10b
or sil, bl
not sil
xor r10b, r11b
and r10b, r9b
or r10b, sil
mov byte [r8 + rax], r10b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x140502390]
add r9d, edx
cmp r8d, r9d
jl 0x1401816c0
movzx eax, byte [0x140502394]
add al, 0x16
xchg byte [0x140501e6e], al
lea rax, [0x140501e60]
jmp 0x1401817b2
movzx eax, byte [0x140502394]
add al, 0x1d
xchg byte [0x140501e02], al
lea rax, [0x140501df0]
jmp 0x1401817b2
xor eax, eax
lea rcx, [0x140501e40]
lea rdx, [0x140426310]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
mov r9d, dword [0x140502390]
mov r10d, r9d
xor r10d, 0xbe6f1730
and r9d, 0x3e6f1730
lea r9d, [r10 + r9*2]
cmp r8d, r9d
jge 0x1401817a3
inc rax
jmp 0x140181760
mov al, 0x7f
xchg byte [0x140501e58], al
lea rax, [0x140501e40]
pop rbx
pop rsi
ret
Function at 0x140181b20
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0xb8ab377d
add eax, dword [0x140502390]
cmp ecx, eax
jne 0x140181b7c
test edx, edx
je 0x140181bb4
movzx eax, byte [0x140501d34]
xor r8b, 0x86
add r8b, byte [0x140502394]
cmp al, r8b
je 0x140181b74
mov cl, 0xcc
nop word cs:[rax + rax]
mov al, 0x7f
lock cmpxchg byte [0x140501d34], cl
je 0x140181c3b
cmp al, 7
jne 0x140181b60
lea rax, [0x140501d30]
ret
movzx eax, byte [0x140501e73]
cmp al, 0x53
je 0x140181bac
mov cl, 0xcf
nop dword [rax]
mov al, 0xb4
lock cmpxchg byte [0x140501e73], cl
je 0x140181bec
mov edx, r8d
xor dl, 0x4a
add dl, byte [0x140502394]
cmp al, dl
jne 0x140181b90
lea rax, [0x140501e70]
ret
movzx eax, byte [0x140501e1e]
cmp al, 0x33
je 0x140181be4
mov cl, 0x3c
nop word cs:[rax + rax]
mov al, 0x76
lock cmpxchg byte [0x140501e1e], cl
je 0x140181c8f
cmp al, 0x33
jne 0x140181bd0
lea rax, [0x140501e10]
ret
xor edx, edx
lea rax, [0x140501e70]
lea rcx, [0x140426340]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
add edx, 0xbd6bd9fd
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x42942603
cmp edx, 3
jl 0x140181c00
mov al, 0x53
xchg byte [0x140501e73], al
lea rax, [0x140501e70]
ret
xor eax, eax
lea rcx, [0x140501d30]
lea rdx, [0x140426200]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r8b
mov r10d, r8d
and r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x140181c7f
inc rax
jmp 0x140181c50
mov al, 7
xchg byte [0x140501d34], al
lea rax, [0x140501d30]
ret
xor eax, eax
lea rcx, [0x140501e10]
lea rdx, [0x1404262e0]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x140181cb8
inc rax
jmp 0x140181ca0
mov al, 0x33
xchg byte [0x140501e1e], al
lea rax, [0x140501e10]
ret
Function at 0x1401983d0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14019840c
test edx, edx
je 0x140198446
movzx eax, byte [0x1405027e2]
cmp al, 0x31
je 0x140198404
mov cl, 0xbb
nop word cs:[rax + rax]
mov al, 0xc7
lock cmpxchg byte [0x1405027e2], cl
je 0x1401984ac
cmp al, 0x31
jne 0x1401983f0
lea rax, [0x1405027d0]
ret
test edx, edx
je 0x14019847c
movzx eax, byte [0x140502a21]
cmp al, 0xca
je 0x14019843e
mov cl, 0x2e
nop dword [rax]
mov al, 0x70
lock cmpxchg byte [0x140502a21], cl
je 0x140198518
movzx edx, byte [0x140505508]
add dl, 0x5b
cmp al, dl
jne 0x140198420
lea rax, [0x140502a10]
ret
movzx eax, byte [0x14050275c]
cmp al, 0xf0
je 0x140198474
mov cl, 0x32
nop word cs:[rax + rax]
mov al, 0x4d
lock cmpxchg byte [0x14050275c], cl
je 0x140198548
cmp al, 0xf0
jne 0x140198460
lea rax, [0x140502750]
ret
movzx eax, byte [0x1405028dd]
cmp al, 0xf4
je 0x1401984a4
mov cl, 0x42
nop dword [rax]
mov al, 0xa3
lock cmpxchg byte [0x1405028dd], cl
je 0x1401985b6
cmp al, 0xf4
jne 0x140198490
lea rax, [0x1405028d0]
ret
xor eax, eax
lea rcx, [0x1405027d0]
lea rdx, [0x140426700]
mov r8d, 0x76a2eb1a
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x1405054f8]
add r10d, r8d
cmp r9d, r10d
jge 0x140198501
inc rax
jmp 0x1401984d0
movzx eax, byte [0x140505508]
add al, 0xc2
xchg byte [0x1405027e2], al
lea rax, [0x1405027d0]
ret
xor eax, eax
lea rcx, [0x140502a10]
lea rdx, [0x140426930]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x1401985a6
inc rax
jmp 0x140198530
xor edx, edx
lea rax, [0x140502750]
lea rcx, [0x140426680]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1405054f8]
add edx, r8d
add edx, 0x76a2eb09
mov r9d, r8d
xor r9d, 0x76a2eb14
and r8d, 0x76a2eb14
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x140198560
mov al, 0xf0
xchg byte [0x14050275c], al
lea rax, [0x140502750]
ret
mov al, 0xca
xchg byte [0x140502a21], al
lea rax, [0x140502a10]
ret
xor eax, eax
lea rcx, [0x1405028d0]
lea rdx, [0x1404267f0]
mov r8d, 0x76a2eb15
nop dword [rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405054f8]
add r10d, r8d
cmp r9d, r10d
jge 0x1401985f1
inc rax
jmp 0x1401985d0
movzx eax, byte [0x140505508]
mov ecx, eax
xor cl, 0x85
and al, 5
add al, al
add al, cl
xchg byte [0x1405028dd], al
lea rax, [0x1405028d0]
ret
Function at 0x140198630
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14019866c
test edx, edx
je 0x1401986ac
movzx eax, byte [0x14050292d]
movzx ecx, byte [0x140505508]
add cl, 0x86
cmp al, cl
je 0x140198664
mov cl, 0x15
nop
mov al, 0x79
lock cmpxchg byte [0x14050292d], cl
je 0x140198746
cmp al, 0xf5
jne 0x140198650
lea rax, [0x140502920]
ret
test edx, edx
je 0x14019870a
movzx eax, byte [0x1405028fd]
movzx ecx, byte [0x140505508]
add cl, 0x39
cmp al, cl
je 0x1401986a4
mov cl, 0xbe
nop dword [rax + rax]
mov al, 0x53
lock cmpxchg byte [0x1405028fd], cl
je 0x140198799
cmp al, 0xa8
jne 0x140198690
lea rax, [0x1405028f0]
ret
movzx eax, byte [0x140502873]
cmp al, 0xcd
je 0x140198702
nop word [rax + rax]
movzx ecx, byte [0x140505508]
mov edx, ecx
xor dl, 0x29
mov eax, ecx
and al, 0x29
add al, al
add al, dl
mov edx, ecx
xor dl, 0x71
not cl
and cl, 0xe
or cl, dl
not cl
add cl, cl
add cl, dl
lock cmpxchg byte [0x140502873], cl
je 0x1401987e7
movzx ecx, byte [0x140505508]
add cl, 0x5e
cmp al, cl
jne 0x1401986c0
lea rax, [0x140502850]
ret
movzx eax, byte [0x1405027fe]
cmp al, 0x72
je 0x14019873e
mov cl, 0x2c
nop word [rax + rax]
mov al, 0x12
lock cmpxchg byte [0x1405027fe], cl
je 0x14019885f
movzx edx, byte [0x140505508]
add dl, 3
cmp al, dl
jne 0x140198720
lea rax, [0x1405027f0]
ret
xor r8d, r8d
lea rax, [0x140502920]
lea rcx, [0x140426840]
mov edx, 0x76a2eb09
nop dword [rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
xor byte [r8 + rax], r9b
mov r9d, dword [0x1405054f8]
add r9d, edx
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r8d, [r10 + r9*2]
cmp r8d, 0xd
jl 0x140198760
mov al, 0xf5
xchg byte [0x14050292d], al
lea rax, [0x140502920]
ret
xor eax, eax
lea rcx, [0x1405028f0]
lea rdx, [0x140426810]
nop dword [rax]
xor r8d, r8d
sub r8b, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
xor r10d, r10d
sub r10b, r9b
mov r9d, r8d
xor r9b, r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
neg r10b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140198838
inc rax
jmp 0x1401987b0
xor eax, eax
lea rcx, [0x140502850]
lea rdx, [0x140426770]
nop word [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
mov r9d, r10d
xor r9b, r8b
and r8b, r10b
add r8b, r8b
add r8b, r9b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x140198848
inc rax
jmp 0x140198800
mov al, 0xa8
xchg byte [0x1405028fd], al
lea rax, [0x1405028f0]
ret
movzx eax, byte [0x140505508]
add al, 0x5e
xchg byte [0x140502873], al
lea rax, [0x140502850]
ret
xor r8d, r8d
lea rax, [0x1405027f0]
lea rcx, [0x140426720]
mov edx, 0x76a2eb16
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
add byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x1405054f8]
add r9d, edx
cmp r8d, r9d
jl 0x140198880
mov al, 0x72
xchg byte [0x1405027fe], al
lea rax, [0x1405027f0]
ret
Function at 0x1401995c0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1401995fc
test edx, edx
je 0x140199660
movzx eax, byte [0x140502a51]
cmp al, 2
je 0x1401995f4
mov cl, 0x76
nop
mov al, 0x15
lock cmpxchg byte [0x140502a51], cl
je 0x1401996d8
cmp al, 2
jne 0x1401995e0
lea rax, [0x140502a40]
ret
mov eax, r8d
xor eax, 0xdb5a3a28
add eax, dword [0x1405054f8]
cmp edx, eax
jne 0x14019969c
movzx eax, byte [0x140502a0d]
mov ecx, r8d
xor cl, 0x94
add cl, byte [0x140505508]
cmp al, cl
je 0x140199658
nop dword [rax]
movzx ecx, byte [0x140505508]
mov eax, r8d
xor al, 0xda
add al, cl
mov edx, r8d
xor dl, 0x9a
add dl, cl
lock cmpxchg byte [0x140502a0d], dl
je 0x140199791
cmp al, 0x23
jne 0x140199630
lea rax, [0x140502a00]
ret
movzx eax, byte [0x1405029ad]
mov ecx, r8d
xor cl, 0xde
add cl, byte [0x140505508]
cmp al, cl
je 0x140199694
mov cl, 0x61
nop dword [rax]
mov al, 0x15
lock cmpxchg byte [0x1405029ad], cl
je 0x140199718
cmp al, 0x6d
jne 0x140199680
lea rax, [0x1405029a0]
ret
movzx eax, byte [0x1405028ad]
cmp al, 0x52
je 0x1401996d0
mov cl, 0x1c
nop dword [rax]
mov al, 0x86
lock cmpxchg byte [0x1405028ad], cl
je 0x1401997dc
mov edx, r8d
xor dl, 0xc3
add dl, byte [0x140505508]
cmp al, dl
jne 0x1401996b0
lea rax, [0x1405028a0]
ret
xor eax, eax
lea rcx, [0x140502a40]
lea rdx, [0x140426960]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x140199708
inc rax
jmp 0x1401996f0
mov al, 2
xchg byte [0x140502a51], al
lea rax, [0x140502a40]
ret
xor eax, eax
lea rcx, [0x1405029a0]
lea rdx, [0x1404268c0]
mov r9d, r8d
xor r9d, 0xdb5a3a29
nop word cs:[rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
mov r11d, r10d
xor r11b, r10b
not r11b
and r11b, byte [rax + rcx]
xor r11b, r10b
mov byte [rax + rcx], r11b
mov r10d, dword [0x1405054f8]
mov r11d, r9d
xor r11d, r10d
and r10d, r9d
lea r10d, [r11 + r10*2]
add eax, r10d
cmp eax, 0xd
jl 0x140199740
xor r8b, 0xde
add r8b, byte [0x140505508]
xchg byte [0x1405029ad], r8b
lea rax, [0x1405029a0]
ret
xor eax, eax
lea rcx, [0x140502a00]
lea rdx, [0x140426920]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14019981f
inc rax
jmp 0x1401997b0
xor edx, edx
lea rax, [0x1405028a0]
lea rcx, [0x1404267c0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x1401997f0
mov al, 0x52
xchg byte [0x1405028ad], al
lea rax, [0x1405028a0]
ret
mov al, 0x23
xchg byte [0x140502a0d], al
lea rax, [0x140502a00]
ret
Function at 0x1401ba060
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401ba0cb
mov eax, dword [0x1405061c0]
mov ecx, eax
xor ecx, 0xeafc5318
and eax, 0x6afc5318
lea eax, [rcx + rax*2]
cmp edx, eax
jne 0x1401ba0fc
movzx eax, byte [0x140505eaf]
cmp al, 0xc
je 0x1401ba0c3
nop dword [rax]
movzx ecx, byte [0x1405061d0]
mov edx, ecx
xor dl, 0x97
mov eax, ecx
and al, 0x17
add al, al
add al, dl
add cl, 0xe2
lock cmpxchg byte [0x140505eaf], cl
je 0x1401ba15c
movzx ecx, byte [0x1405061d0]
add cl, 0xdf
cmp al, cl
jne 0x1401ba090
lea rax, [0x140505ea0]
ret
test edx, edx
je 0x1401ba12c
movzx eax, byte [0x140505eb9]
cmp al, 0xed
je 0x1401ba0f4
mov cl, 0x4e
nop dword [rax]
mov al, 0x5f
lock cmpxchg byte [0x140505eb9], cl
je 0x1401ba1f8
cmp al, 0xed
jne 0x1401ba0e0
lea rax, [0x140505eb0]
ret
movzx eax, byte [0x140505dc6]
cmp al, 0x6c
je 0x1401ba124
mov cl, 0x3d
nop dword [rax]
mov al, 0xff
lock cmpxchg byte [0x140505dc6], cl
je 0x1401ba1ba
cmp al, 0x6c
jne 0x1401ba110
lea rax, [0x140505dc0]
ret
movzx eax, byte [0x140505df1]
cmp al, 0x33
je 0x1401ba154
mov cl, 0xa4
nop dword [rax]
mov al, 0xf6
lock cmpxchg byte [0x140505df1], cl
je 0x1401ba238
cmp al, 0x33
jne 0x1401ba140
lea rax, [0x140505de0]
ret
xor r8d, r8d
lea rax, [0x140505ea0]
lea rcx, [0x140426d60]
mov edx, 0xeafc5327
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
xor byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x1405061c0]
add r9d, edx
cmp r8d, r9d
jl 0x1401ba180
mov al, 0xc
xchg byte [0x140505eaf], al
lea rax, [0x140505ea0]
ret
xor eax, eax
lea rcx, [0x140505dc0]
lea rdx, [0x140426c90]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x1401ba1e8
inc rax
jmp 0x1401ba1d0
mov al, 0x6c
xchg byte [0x140505dc6], al
lea rax, [0x140505dc0]
ret
xor eax, eax
lea rcx, [0x140505eb0]
lea rdx, [0x140426d70]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1401ba228
inc rax
jmp 0x1401ba210
mov al, 0xed
xchg byte [0x140505eb9], al
lea rax, [0x140505eb0]
ret
xor edx, edx
lea rax, [0x140505de0]
lea rcx, [0x140426cb0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1405061c0]
add edx, r8d
add edx, 0xeafc5319
add r8d, 0xeafc5329
cmp edx, r8d
jl 0x1401ba250
mov al, 0x33
xchg byte [0x140505df1], al
lea rax, [0x140505de0]
ret
Function at 0x1401ba290
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov esi, r8d
test ecx, ecx
je 0x1401ba2e9
movzx eax, byte [0x140505dd7]
movzx ecx, byte [0x1405061d0]
add cl, 0x8e
cmp al, cl
je 0x1401ba3f0
mov cl, 0x9b
nop word cs:[rax + rax]
mov al, 0xf1
lock cmpxchg byte [0x140505dd7], cl
je 0x1401ba369
cmp al, 0xbb
jne 0x1401ba2d0
jmp 0x1401ba3f0
movzx eax, byte [0x140505e50]
cmp al, 0xeb
je 0x1401ba35d
movzx ecx, byte [0x1405061d0]
lea eax, [rcx + 0x1b]
add cl, 0x6d
lock cmpxchg byte [0x140505e50], cl
jne 0x1401ba2f0
xor eax, eax
lea rbx, [0x140505e40]
lea r14, [0x140426d10]
xor esi, 0x1eeb498d
lea rdi, [rsp + 0x40]
nop word cs:[rax + rax]
movsxd rcx, eax
movzx eax, byte [rcx + r14]
add byte [rcx + rbx], al
mov rdx, rdi
mov r8d, esi
mov r9d, 0xc5cff884
call fcn.1401ba480
mov eax, dword [rsp + 0x40]
cmp eax, 0x10
jl 0x1401ba330
mov al, 0xeb
xchg byte [0x140505e50], al
lea rax, [0x140505e40]
jmp 0x1401ba3f7
xor eax, eax
lea r12, [0x140505dd0]
mov edi, esi
xor edi, 0x8b051812
mov ebp, 0x392db672
lea rbx, [rsp + 0x3f]
lea r13, [0x140426ca0]
xor esi, 0x19aa4025
lea r14, [rsp + 0x44]
nop word cs:[rax + rax]
movsxd r15, eax
lea rcx, [r12 + r15]
mov r9d, dword [0x1405061c0]
add r9d, ebp
mov rdx, rbx
mov r8d, edi
call fcn.140137aa0
movzx edx, byte [rsp + 0x3f]
xor dl, byte [r15 + r13]
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x28], 0x92ccc9fd
mov rcx, r15
mov r8d, r15d
mov r9, r14
call fcn.1401ba450
mov eax, dword [rsp + 0x44]
cmp eax, 7
jl 0x1401ba3a0
mov al, 0xbb
xchg byte [0x140505dd7], al
lea rax, [0x140505dd0]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401c3120
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1401c316c
mov eax, r8d
xor eax, 0x996d5a8
add eax, dword [0x140506ad0]
cmp edx, eax
jne 0x1401c31a4
movzx eax, byte [0x140506775]
cmp al, 0xa7
je 0x1401c3164
mov cl, 0xe9
nop dword [rax + rax]
mov al, 0x82
lock cmpxchg byte [0x140506775], cl
je 0x1401c3232
cmp al, 0xa7
jne 0x1401c3150
lea rax, [0x140506770]
ret
movzx eax, byte [0x1405067fe]
cmp al, 0x9e
je 0x1401c319c
mov cl, 0x98
nop dword [rax]
mov al, 0x67
lock cmpxchg byte [0x1405067fe], cl
je 0x1401c31e8
mov edx, r8d
xor dl, 0xa4
add dl, byte [0x140506ad4]
cmp al, dl
jne 0x1401c3180
lea rax, [0x1405067f0]
ret
movzx eax, byte [0x140506784]
cmp al, 0x67
je 0x1401c31e0
mov cl, 0x8c
nop word cs:[rax + rax]
mov al, 0x5c
lock cmpxchg byte [0x140506784], cl
je 0x1401c3268
mov edx, r8d
xor dl, 0x6d
add dl, byte [0x140506ad4]
cmp al, dl
jne 0x1401c31c0
lea rax, [0x140506780]
ret
xor eax, eax
lea rcx, [0x1405067f0]
lea rdx, [0x1404271f0]
nop dword [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xd
jg 0x1401c3218
inc rax
jmp 0x1401c3200
xor r8b, 0xa4
add r8b, byte [0x140506ad4]
xchg byte [0x1405067fe], r8b
lea rax, [0x1405067f0]
ret
xor eax, eax
lea rcx, [0x140506770]
lea rdx, [0x140427180]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x1401c32af
inc rax
jmp 0x1401c3250
xor edx, edx
lea rax, [0x140506780]
lea rcx, [0x140427190]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 4
jl 0x1401c3280
mov al, 0x67
xchg byte [0x140506784], al
lea rax, [0x140506780]
ret
mov al, 0xa7
xchg byte [0x140506775], al
lea rax, [0x140506770]
ret
Function at 0x1401cec30
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401cec7c
mov eax, 0x1440fe9b
add eax, dword [0x140509094]
cmp edx, eax
jne 0x1401cecdc
movzx eax, byte [0x140508ff9]
cmp al, 0x73
je 0x1401cec74
mov cl, 0x98
nop word cs:[rax + rax]
mov al, 0xe7
lock cmpxchg byte [0x140508ff9], cl
je 0x1401ced4c
cmp al, 0x73
jne 0x1401cec60
lea rax, [0x140508ff0]
ret
test edx, edx
je 0x1401ced23
movzx eax, byte [0x140508fd3]
nop dword [rax + rax]
cmp al, 0xe7
je 0x1401cedf9
movzx ecx, byte [0x140509090]
lea eax, [rcx + 0x15]
add cl, 0x61
lock cmpxchg byte [0x140508fd3], cl
jne 0x1401cec90
xor eax, eax
lea rcx, [0x140508fb0]
lea rdx, [0x1404278b0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1401cedf1
inc rax
jmp 0x1401cecc0
movzx eax, byte [0x140508fef]
movzx ecx, byte [0x140509090]
add cl, 0xf1
cmp al, cl
je 0x1401ced1b
nop word cs:[rax + rax]
movzx ecx, byte [0x140509090]
lea eax, [rcx + 0x5d]
add cl, 0x51
lock cmpxchg byte [0x140508fef], cl
je 0x1401ced88
cmp al, 0xe0
jne 0x1401ced00
lea rax, [0x140508fe0]
ret
movzx eax, byte [0x140508f39]
cmp al, 0xf3
je 0x1401ced44
mov cl, 0xff
mov al, 0x1f
lock cmpxchg byte [0x140508f39], cl
je 0x1401cee01
cmp al, 0xf3
jne 0x1401ced30
lea rax, [0x140508f10]
ret
xor eax, eax
lea rcx, [0x140508ff0]
lea rdx, [0x1404278f0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1401cede1
inc rax
jmp 0x1401ced60
xor edx, edx
lea rax, [0x140508fe0]
lea rcx, [0x1404278e0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140509094]
add edx, r8d
add edx, 0x1440fe9c
cmp edx, 0xf
jl 0x1401ceda0
mov al, pe_nt_image_headers64
xchg byte [0x140508fef], al
lea rax, [0x140508fe0]
ret
mov al, 0x73
xchg byte [0x140508ff9], al
lea rax, [0x140508ff0]
ret
mov al, 0xe7
xchg byte [0x140508fd3], al
lea rax, [0x140508fb0]
ret
xor eax, eax
lea rcx, [0x140508f10]
lea rdx, [0x140427820]
mov r8d, 0x1440fec4
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140509094]
add r10d, r8d
cmp r9d, r10d
jge 0x1401cee41
inc rax
jmp 0x1401cee20
mov al, 0xf3
xchg byte [0x140508f39], al
lea rax, [0x140508f10]
ret