joyce8/EMBER2024-capa huggingface dataset:
Function at 0x201fbab0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov eax, dword [0x205b4568]
lea r8, [fcn.201fbab0]
lea r9d, [r8 + r8]
add r9d, 0x1ca1
add r8d, r8d
add r8d, 0x1ca0
xor r8d, r9d
cmp r8d, 1
nop dword [rax]
mov r8d, 0x376c766e
add r8d, dword [0x2055c1c8]
lea r9, [fcn.201fbab0]
add r9d, r9d
add r9d, 0x4c0
xor r9d, r8d
not r9d
test r9d, r8d
jne 0x201fbaf0
movzx r8d, dx
cmp r8d, 0x577
jbe 0x201fbb39
cmp r8d, 0x2710
jae 0x201fbb7c
mov word [rcx], dx
add rsp, 0x48
pop rsi
pop rbp
ret
mov ecx, dword [0x2055c560]
mov edx, ecx
xor edx, eax
and ecx, eax
lea eax, [rdx + rcx*2]
neg eax
mov ecx, eax
xor ecx, 0xb1a
and ecx, eax
xor eax, 0xfffff4e5
lea eax, [rax + rcx*2]
neg eax
cdqe
add rax, qword [0x2055c570]
lea rsi, [rbp - 0x18]
mov rcx, rsi
call qword [case.0x2010e313.0]
mov rcx, rsi
call fcn.201fbc70
xor eax, dword [0x2055c560]
add eax, 0xb1b
cdqe
add rax, qword [0x2055c570]
lea rsi, [rbp - 0x18]
mov rcx, rsi
call qword [case.0x2010e313.0]
mov rcx, rsi
call fcn.201fbc70
int3
Function at 0x201fe330
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8d, dword [rsp + 0x38]
test ecx, ecx
je 0x201fe369
test edx, edx
je 0x201fe399
movzx eax, byte [0x2055c03d]
cmp al, 0xdf
je 0x201fe450
mov cl, 0x31
mov al, 0x73
lock cmpxchg byte [0x2055c03d], cl
je 0x201fe415
cmp al, 0xdf
jne 0x201fe350
jmp 0x201fe450
test edx, edx
je 0x201fe3c9
movzx eax, byte [0x2055c06d]
cmp al, 0xb5
je 0x201fe497
mov cl, 0xb9
nop
mov al, 0x89
lock cmpxchg byte [0x2055c06d], cl
je 0x201fe45c
cmp al, 0xb5
jne 0x201fe380
jmp 0x201fe497
movzx eax, byte [0x2055c0ca]
cmp al, 0xdf
je 0x201fe519
mov cl, 0xed
nop word [rax + rax]
mov al, 0xd7
lock cmpxchg byte [0x2055c0ca], cl
je 0x201fe4a3
cmp al, 0xdf
jne 0x201fe3b0
jmp 0x201fe519
movzx eax, byte [0x2055bee3]
mov ecx, r8d
xor cl, 0xa6
add cl, byte [0x2055c1d8]
cmp al, cl
je 0x201fe560
mov cl, 0x9c
nop word cs:[rax + rax]
mov al, 0xc9
lock cmpxchg byte [0x2055bee3], cl
je 0x201fe522
mov edx, r8d
xor dl, 0xa6
add dl, byte [0x2055c1d8]
cmp al, dl
jne 0x201fe3f0
jmp 0x201fe560
xor eax, eax
lea rcx, [0x2055c030]
lea rdx, [0x20476300]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x201fe448
inc rax
jmp 0x201fe430
mov al, 0xdf
xchg byte [0x2055c03d], al
lea rax, [0x2055c030]
jmp 0x201fe567
xor edx, edx
lea rax, [0x2055c060]
lea rcx, [0x20476330]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x201fe470
mov al, 0xb5
xchg byte [0x2055c06d], al
lea rax, [0x2055c060]
jmp 0x201fe567
xor eax, eax
lea rcx, [0x2055c0b0]
lea rdx, [0x20476380]
mov r9d, r8d
xor r9d, 0x575d9a85
xor r8d, 0x575d9a6c
nop word cs:[rax + rax]
cdqe
movzx r10d, byte [rax + rcx]
movzx r11d, byte [rax + rdx]
mov ebx, r10d
xor bl, r11b
and r10b, r11b
add r10b, r10b
add r10b, bl
mov byte [rax + rcx], r10b
mov r10d, dword [0x2055c1c8]
mov r11d, r9d
xor r11d, r10d
mov esi, r9d
and esi, r10d
lea r11d, [r11 + rsi*2]
add eax, r11d
add r10d, r8d
cmp eax, r10d
jl 0x201fe4d0
mov al, 0xdf
xchg byte [0x2055c0ca], al
lea rax, [0x2055c0b0]
jmp 0x201fe567
xor eax, eax
lea rcx, [0x2055bec0]
lea rdx, [0x20476190]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x201fe558
inc rax
jmp 0x201fe540
mov al, 0x1e
xchg byte [0x2055bee3], al
lea rax, [0x2055bec0]
pop rbx
pop rsi
ret
Function at 0x2021b540
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov eax, dword [0x205b4760]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x2021b56e
mov rcx, rsi
call fcn.20427ec0
cmp dword [0x20560dd4], 0xec926722
je 0x2021b5c1
lea rax, [fcn.2021b540]
lea edi, [rax + rax]
add edi, 0x8a0
nop
mov rcx, rsi
call fcn.20427ec0
mov eax, dword [0x20560dd4]
lea ecx, [rax + 0x136d98df]
xor ecx, edi
not ecx
and ecx, edi
mov edx, dword [0x2055f6d0]
add eax, edx
add eax, 0x136d094e
cdqe
add rax, qword [0x2055f6e0]
mov edx, 0xf054dd93
call qword [case.0x2010e313.0]
test al, 1
je 0x2021b580
jmp 0x2021b55a
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x2023ef20
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
test ecx, ecx
je 0x2023ef59
test edx, edx
je 0x2023f04b
movzx eax, byte [0x20563e84]
cmp al, 0xa1
je 0x2023f0e0
mov cl, 0x90
mov al, 0xf1
lock cmpxchg byte [0x20563e84], cl
je 0x2023f0a9
cmp al, 0xa1
jne 0x2023ef40
jmp 0x2023f0e0
test edx, edx
je 0x2023f079
movzx eax, byte [0x20563ff2]
nop dword [rax + rax]
cmp al, 0x7a
je 0x2023f0f4
movzx ecx, byte [0x2056451c]
lea eax, [rcx - 0x63]
add cl, 0x63
lock cmpxchg byte [0x20563ff2], cl
jne 0x2023ef70
xor edx, edx
mov r8d, 0xa1ba8c27
lea r9, [0x20563fe0]
lea r10, [0x20478470]
lea rax, [fcn.2023ef20]
lea r11d, [rax + rax]
add r11d, 0x2520
mov esi, r11d
not esi
jmp 0x2023efcb
inc edx
cmp edx, 0x12
jge 0x2023f0ec
mov eax, dword [0x205b492c]
mov ecx, dword [0x20564518]
add ecx, r8d
movsxd rdi, edx
cmp eax, ecx
jge 0x2023f020
nop word cs:[rax + rax]
movzx eax, byte [rdi + r10]
mov ecx, eax
xor cl, al
not cl
and cl, byte [rdi + r9]
xor cl, al
mov byte [rdi + r9], cl
mov eax, dword [0x205b4928]
lea ecx, [rax + 1]
imul ecx, eax
test cl, 1
je 0x2023efc0
nop word cs:[rax + rax]
movzx eax, byte [rdi + r9]
movzx ecx, byte [rdi + r10]
shl al, cl
sub cl, al
mov ebx, eax
shl bl, cl
sub al, bl
mul bl
mov ecx, ebx
xor cl, bl
not cl
and cl, al
xor cl, bl
mov byte [rdi + r9], cl
test esi, r11d
jne 0x2023f020
jmp 0x2023eff0
movzx eax, byte [0x20563fba]
cmp al, 0x3a
je 0x2023f130
mov cl, 0x8b
nop dword [rax]
mov al, 0x7a
lock cmpxchg byte [0x20563fba], cl
je 0x2023f100
cmp al, 0x3a
jne 0x2023f060
jmp 0x2023f130
movzx eax, byte [0x2056406d]
cmp al, 0xe6
je 0x2023f170
mov cl, 0xbb
nop word [rax + rax]
mov al, 0x58
lock cmpxchg byte [0x2056406d], cl
je 0x2023f139
cmp al, 0xe6
jne 0x2023f090
jmp 0x2023f170
xor eax, eax
lea rcx, [0x20563e80]
lea rdx, [0x20478320]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x2023f0d8
inc rax
jmp 0x2023f0c0
mov al, 0xa1
xchg byte [0x20563e84], al
lea rax, [0x20563e80]
jmp 0x2023f1b1
mov al, 0x7a
xchg byte [0x20563ff2], al
lea rax, [0x20563fe0]
jmp 0x2023f1b1
xor eax, eax
lea rcx, [0x20563fa0]
lea rdx, [0x20478430]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x19
jg 0x2023f128
inc rax
jmp 0x2023f110
mov al, 0x3a
xchg byte [0x20563fba], al
lea rax, [0x20563fa0]
jmp 0x2023f1b1
xor eax, eax
lea rcx, [0x20564060]
lea rdx, [0x204784f0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x2023f168
inc rax
jmp 0x2023f150
mov al, 0xe6
xchg byte [0x2056406d], al
xor eax, eax
test al, al
jne 0x2023f190
mov eax, dword [0x205b492c]
mov ecx, 0xa1ba8c18
add ecx, dword [0x20564518]
cmp eax, ecx
jl 0x2023f1aa
nop dword [rax + rax]
mov eax, dword [0x205b4928]
mov ecx, dword [0x20564518]
add ecx, eax
inc ecx
imul ecx, eax
test cl, 1
jne 0x2023f190
jmp 0x2023f176
lea rax, [0x20564060]
pop rbx
pop rdi
pop rsi
ret
Function at 0x20249a50
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x20249a8c
test edx, edx
je 0x20249abc
movzx eax, byte [0x20565802]
cmp al, 0x82
je 0x20249a84
mov cl, 5
nop word cs:[rax + rax]
mov al, 0x86
lock cmpxchg byte [0x20565802], cl
je 0x20249b1c
cmp al, 0x82
jne 0x20249a70
lea rax, [0x20565800]
ret
test edx, edx
je 0x20249aec
movzx eax, byte [0x20565820]
cmp al, 0xbd
je 0x20249ab4
mov cl, 6
nop dword [rax]
mov al, 0xcb
lock cmpxchg byte [0x20565820], cl
je 0x20249b68
cmp al, 0xbd
jne 0x20249aa0
lea rax, [0x20565810]
ret
movzx eax, byte [0x205658a3]
cmp al, 0x51
je 0x20249ae4
mov cl, 0x91
nop dword [rax]
mov al, 0xd4
lock cmpxchg byte [0x205658a3], cl
je 0x20249b98
cmp al, 0x51
jne 0x20249ad0
lea rax, [0x20565880]
ret
movzx eax, byte [0x205658bf]
cmp al, 0xb6
je 0x20249b14
mov ecx, dword [rsp + 0x28]
mov dl, 0x4f
nop dword [rax]
mov al, 0x92
lock cmpxchg byte [0x205658bf], dl
je 0x20249be8
cmp al, 0xb6
jne 0x20249b00
lea rax, [0x205658b0]
ret
xor eax, eax
lea rcx, [0x20565800]
lea rdx, [0x20478d60]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x20249b58
inc rax
jmp 0x20249b30
mov al, 0x82
xchg byte [0x20565802], al
lea rax, [0x20565800]
ret
xor eax, eax
lea rcx, [0x20565810]
lea rdx, [0x20478d70]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x20249bc8
inc rax
jmp 0x20249b80
xor eax, eax
lea rcx, [0x20565880]
lea rdx, [0x20478dd0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x20249bd8
inc rax
jmp 0x20249bb0
mov al, 0xbd
xchg byte [0x20565820], al
lea rax, [0x20565810]
ret
mov al, 0x51
xchg byte [0x205658a3], al
lea rax, [0x20565880]
ret
xor r9d, r9d
lea rax, [0x205658b0]
lea rdx, [0x20478e00]
mov r8d, ecx
xor r8d, 0x36be1206
nop word cs:[rax + rax]
movsxd r9, r9d
movzx r10d, byte [r9 + rdx]
xor byte [r9 + rax], r10b
mov r10d, r9d
xor r10d, 1
and r9d, 1
lea r9d, [r10 + r9*2]
mov r10d, dword [0x20565ba0]
add r10d, r8d
cmp r9d, r10d
jl 0x20249c10
xor cl, 0xdb
add cl, byte [0x20565b90]
xchg byte [0x205658bf], cl
lea rax, [0x205658b0]
ret
Function at 0x2024bda0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x2024bde9
test edx, edx
je 0x2024be49
movzx eax, byte [0x20565e4d]
cmp al, 0xae
je 0x2024bf01
mov cl, 0x5f
nop word cs:[rax + rax]
mov al, 0x8b
lock cmpxchg byte [0x20565e4d], cl
je 0x2024bea9
cmp al, 0xae
jne 0x2024bdd0
jmp 0x2024bf01
mov eax, r8d
xor eax, 0xa843a251
mov ecx, r8d
not ecx
and ecx, r8d
xor ecx, eax
add ecx, dword [0x20566358]
cmp edx, ecx
jne 0x2024be79
movzx eax, byte [0x20565cbf]
xor r8b, 0x35
add r8b, byte [0x2056635c]
cmp al, r8b
je 0x2024bffd
mov cl, 0x1a
nop word cs:[rax + rax]
mov al, 0x44
lock cmpxchg byte [0x20565cbf], cl
je 0x2024bf63
cmp al, 0xbd
jne 0x2024be30
jmp 0x2024bffd
movzx eax, byte [0x20565bd4]
cmp al, 0x60
je 0x2024bf5a
mov cl, 0x20
nop word [rax + rax]
mov al, 0x5b
lock cmpxchg byte [0x20565bd4], cl
je 0x2024bf0a
cmp al, 0x60
jne 0x2024be60
jmp 0x2024bf5a
movzx eax, byte [0x20565d3d]
cmp al, 0xde
je 0x2024c018
mov cl, 0x8f
nop word [rax + rax]
mov al, 0xe
lock cmpxchg byte [0x20565d3d], cl
je 0x2024bf98
cmp al, 0xde
jne 0x2024be90
jmp 0x2024c018
xor edx, edx
lea rax, [0x20565e40]
lea rcx, [0x20479090]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
not edx
and edx, 0x7ffffffe
or edx, r8d
not edx
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x2024bec0
mov al, 0xae
xchg byte [0x20565e4d], al
lea rax, [0x20565e40]
pop rbx
ret
xor eax, eax
lea rcx, [0x20565bd0]
lea rdx, [0x20478e40]
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
cmp r9d, 3
jg 0x2024bf48
inc rax
jmp 0x2024bf20
xor r8b, 0x52
add r8b, byte [0x2056635c]
xchg byte [0x20565bd4], r8b
lea rax, [0x20565bd0]
pop rbx
ret
xor eax, eax
lea rcx, [0x20565cb0]
lea rdx, [0x20478f00]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x2024bff5
inc rax
jmp 0x2024bf80
xor eax, eax
lea rcx, [0x20565d30]
lea rdx, [0x20478f80]
mov r9d, r8d
xor r9d, 0xa843a244
nop word cs:[rax + rax]
movzx r10d, byte [rax + rcx]
movzx r11d, byte [rax + rdx]
mov ebx, r10d
xor bl, r11b
and r10b, r11b
add r10b, r10b
add r10b, bl
mov byte [rax + rcx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x20566358]
add r11d, r9d
cmp r10d, r11d
jge 0x2024c006
inc rax
jmp 0x2024bfc0
mov al, 0xbd
xchg byte [0x20565cbf], al
lea rax, [0x20565cb0]
pop rbx
ret
xor r8b, 0xd4
add r8b, byte [0x2056635c]
xchg byte [0x20565d3d], r8b
lea rax, [0x20565d30]
pop rbx
ret
Function at 0x20259320
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x20259377
test edx, edx
je 0x202593bc
movzx eax, byte [0x20566573]
movzx ecx, byte [0x20567e34]
mov edx, ecx
xor dl, 0x3f
and cl, 0x3f
add cl, cl
add cl, dl
cmp al, cl
je 0x2025936f
nop word [rax + rax]
movzx ecx, byte [0x20567e34]
lea eax, [rcx - 0x1c]
add cl, 0x1a
lock cmpxchg byte [0x20566573], cl
je 0x20259468
cmp al, 0xce
jne 0x20259350
lea rax, [0x20566570]
ret
mov eax, 0xd62cbe65
add eax, dword [0x20567e30]
cmp edx, eax
jne 0x20259438
movzx eax, byte [0x205666bd]
cmp al, 0x62
je 0x202593b4
mov cl, 0x2a
nop word [rax + rax]
mov al, 0xa2
lock cmpxchg byte [0x205666bd], cl
je 0x202594ff
cmp al, 0x62
jne 0x202593a0
lea rax, [0x205666b0]
ret
movzx eax, byte [0x2056673d]
nop word cs:[rax + rax]
cmp al, 0x69
je 0x20259430
movzx ecx, byte [0x20567e34]
lea eax, [rcx - 0x73]
add cl, 0x5f
lock cmpxchg byte [0x2056673d], cl
jne 0x202593d0
xor edx, edx
lea rax, [0x20566730]
lea rcx, [0x20479420]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x20567e30]
add edx, r8d
add edx, 0xd62cbe66
add r8d, 0xd62cbe72
cmp edx, r8d
jl 0x20259400
mov al, 0x69
xchg byte [0x2056673d], al
lea rax, [0x20566730]
ret
cmp byte [0x205666a9], 0
je 0x20259460
mov cl, 0xaf
nop word cs:[rax + rax]
mov al, 0xa3
lock cmpxchg byte [0x205666a9], cl
je 0x202594b1
test al, al
jne 0x20259450
lea rax, [0x205666a0]
ret
xor eax, eax
lea rcx, [0x20566570]
lea rdx, [0x20479270]
mov r8d, 0xd62cbe68
nop
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x20567e30]
add r10d, r8d
cmp r9d, r10d
jge 0x202594a1
inc rax
jmp 0x20259480
mov al, 0xce
xchg byte [0x20566573], al
lea rax, [0x20566570]
ret
xor edx, edx
lea rax, [0x205666a0]
lea rcx, [0x20479390]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 9
jl 0x202594d0
xor eax, eax
xchg byte [0x205666a9], al
lea rax, [0x205666a0]
ret
xor eax, eax
lea rcx, [0x205666b0]
lea rdx, [0x204793a0]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x20259528
inc rax
jmp 0x20259510
movzx eax, byte [0x20567e34]
add al, 0xd3
xchg byte [0x205666bd], al
lea rax, [0x205666b0]
ret
Function at 0x2025a530
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0x20066a48
test ecx, ecx
je 0x2025a5a3
add eax, dword [0x20567e30]
cmp edx, eax
jne 0x2025a5dc
movzx eax, byte [0x205667e8]
cmp al, 0xe5
je 0x2025a59b
mov cl, 0x7d
nop dword [rax]
mov al, 0x37
lock cmpxchg byte [0x205667e8], cl
je 0x2025a6bc
mov edx, r8d
not dl
mov r9d, r8d
xor r9b, 0x7b
and r9b, dl
mov r10d, r8d
xor r10b, 0x84
and dl, 0x7b
or dl, r10b
not dl
or dl, r9b
add dl, byte [0x20567e34]
cmp al, dl
jne 0x2025a560
lea rax, [0x205667d0]
ret
add eax, dword [0x20567e30]
cmp edx, eax
jne 0x2025a68d
movzx eax, byte [0x20566622]
cmp al, 0xf9
je 0x2025a5d4
mov cl, 0xf3
nop
mov al, 0x1b
lock cmpxchg byte [0x20566622], cl
je 0x2025a6f8
cmp al, 0xf9
jne 0x2025a5c0
lea rax, [0x20566610]
ret
movzx eax, byte [0x205667fd]
nop word cs:[rax + rax]
cmp al, 0xf9
je 0x2025a685
movzx ecx, byte [0x20567e34]
mov edx, r8d
not dl
mov r9d, r8d
xor r9b, 0x75
and r9b, dl
mov r10d, r8d
xor r10b, 0x8a
mov eax, edx
and al, 0x75
or al, r10b
not al
or al, r9b
add al, cl
and dl, 0x32
mov r9d, r8d
and r9b, 0xcd
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x205667fd], r9b
jne 0x2025a5f0
xor eax, eax
lea rcx, [0x205667f0]
lea rdx, [0x204794e0]
xor r8d, 0x20066a4b
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x20567e30]
add r9d, r8d
add eax, r9d
cmp eax, 0xd
jl 0x2025a660
mov al, 0xf9
xchg byte [0x205667fd], al
lea rax, [0x205667f0]
ret
movzx eax, byte [0x20566587]
cmp al, 0xbe
je 0x2025a6b4
mov cl, 0xda
nop word [rax + rax]
mov al, 0x13
lock cmpxchg byte [0x20566587], cl
je 0x2025a744
cmp al, 0xbe
jne 0x2025a6a0
lea rax, [0x20566580]
ret
xor eax, eax
lea rcx, [0x205667d0]
lea rdx, [0x204794c0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x17
jg 0x2025a6e8
inc rax
jmp 0x2025a6d0
mov al, 0xe5
xchg byte [0x205667e8], al
lea rax, [0x205667d0]
ret
xor eax, eax
lea rcx, [0x20566610]
lea rdx, [0x20479300]
nop dword [rax + rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
add r9b, 0x7b
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
add r9b, 0x85
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0x11
jg 0x2025a778
inc rax
jmp 0x2025a710
xor eax, eax
lea rcx, [0x20566580]
lea rdx, [0x20479280]
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 6
jg 0x2025a7a2
inc rax
jmp 0x2025a760
mov eax, r8d
not al
xor r8b, 0xb8
and al, 0x47
or r8b, al
not r8b
or r8b, al
add r8b, byte [0x20567e34]
xchg byte [0x20566622], r8b
lea rax, [0x20566610]
ret
mov eax, r8d
not al
and al, 2
xor r8b, 0xfd
or r8b, al
not r8b
or r8b, al
add r8b, byte [0x20567e34]
xchg byte [0x20566587], r8b
lea rax, [0x20566580]
ret
Function at 0x2025a800
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r13d, r9d
mov esi, r8d
test ecx, ecx
je 0x2025a919
mov dword [rsp + 0x40], esi
movzx eax, byte [0x2056676d]
cmp al, 0x6f
je 0x2025a9b0
mov ecx, dword [rsp + 0x40]
mov r12d, ecx
not r12d
mov eax, r12d
and eax, 0xc08d773
mov edx, ecx
xor edx, 0xc08d773
and edx, ecx
or edx, eax
mov dword [rsp + 0x44], edx
mov r15d, r13d
not r15d
mov eax, r15d
and eax, 0xbb7310d7
mov ebp, r13d
and ebp, 0x448cef28
or ebp, eax
mov eax, r15d
and eax, 0x349cfa65
mov r14d, r13d
and r14d, 0xcb63059a
or r14d, eax
mov eax, r15d
and eax, 0x1bebb1fc
mov esi, r13d
and esi, 0xe4144e03
or esi, eax
mov ebx, dword [rsp + 0x40]
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x2f]
mov r8d, dword [rsp + 0x44]
mov r9d, ebp
call fcn.2025aae0
movzx edi, byte [rsp + 0x2f]
movzx ecx, byte [rsp + 0x30]
movzx edx, byte [rsp + 0x31]
mov eax, dword [0x20567e30]
lea r8d, [r14 + rax]
mov r9d, r8d
not r9d
mov r10d, r12d
xor r10d, r8d
mov r11d, ebx
and r11d, r9d
or r11d, r10d
not r11d
xor r9d, ebx
and r8d, r12d
or r8d, r9d
not r8d
or r8d, r11d
add eax, esi
mov r9d, r15d
xor r9d, r13d
and r9d, eax
xor r9d, r13d
call fcn.201f7e30
test al, 1
jne 0x2025a975
cmp dil, 0x6f
jne 0x2025a8a0
jmp 0x2025a9b0
mov ecx, esi
mov edx, r13d
not edx
mov eax, r13d
xor eax, 0x696c1ca7
and eax, edx
mov r8d, r13d
and r8d, 0x9693e358
or r8d, eax
add r8d, dword [0x20567e30]
xor ecx, 0x7f70ecff
xor edx, r13d
and edx, r8d
xor edx, r13d
call fcn.2025aaa0
test al, 1
jne 0x2025aa33
mov cl, 0x2d
nop dword [rax]
mov al, 0x41
lock cmpxchg byte [0x2056684b], cl
je 0x2025a9bc
cmp al, 0x7e
jne 0x2025a960
jmp 0x2025aa33
xor eax, eax
lea rcx, [0x20566760]
lea rdx, [0x20479450]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x2025a9a8
inc rax
jmp 0x2025a990
mov al, 0x6f
xchg byte [0x2056676d], al
lea rax, [0x20566760]
jmp 0x2025aa3a
xor eax, eax
lea rcx, [0x20566840]
lea rdx, [0x20479530]
mov r8d, r13d
xor r8d, 0xc6c5538f
add r8d, 0x1f5e7b52
nop dword [rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x20567e30]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
mov r10d, r9d
xor r10d, 0xe0a184ae
and r9d, 0x60a184ae
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 0xb
jl 0x2025a9e0
xor esi, 0xdeda13ca
xor r13d, 0x1e9194e7
mov ecx, esi
mov edx, r13d
call fcn.2025a7e0
lea rax, [0x20566840]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x2025ad00
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
mov r8d, dword [rsp + 0x38]
mov eax, r8d
xor eax, 0xc0b6c2c0
mov r9d, dword [0x20567e30]
add r9d, eax
cmp ecx, r9d
jne 0x2025ad59
test edx, edx
je 0x2025adc9
movzx eax, byte [0x205666dd]
cmp al, 0xf2
je 0x2025ae35
mov cl, 8
nop word [rax + rax]
mov al, 0xba
lock cmpxchg byte [0x205666dd], cl
je 0x2025adf9
cmp al, 0xf2
jne 0x2025ad40
jmp 0x2025ae35
add eax, dword [0x20567e30]
cmp edx, eax
jne 0x2025ad99
movzx eax, byte [0x20566721]
cmp al, 0xc9
je 0x2025aefe
mov cl, 0x4a
nop word cs:[rax + rax]
mov al, 0x70
lock cmpxchg byte [0x20566721], cl
je 0x2025ae41
cmp al, 0xc9
jne 0x2025ad80
jmp 0x2025aefe
movzx eax, byte [0x20566605]
cmp al, 0x4e
je 0x2025aeed
mov cl, 0x33
nop word [rax + rax]
mov al, 0x65
lock cmpxchg byte [0x20566605], cl
je 0x2025ae88
cmp al, 0x4e
jne 0x2025adb0
jmp 0x2025aeed
movzx eax, byte [0x205667cd]
cmp al, 0xc9
je 0x2025af54
mov cl, 0x78
nop word [rax + rax]
mov al, 0xfc
lock cmpxchg byte [0x205667cd], cl
je 0x2025af07
cmp al, 0xc9
jne 0x2025ade0
jmp 0x2025af54
xor eax, eax
lea rcx, [0x205666d0]
lea rdx, [0x204793c0]
xor r8d, 0xc0b6c2c3
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x20567e30]
add r9d, r8d
add eax, r9d
cmp eax, 0xd
jl 0x2025ae10
mov al, 0xf2
xchg byte [0x205666dd], al
lea rax, [0x205666d0]
jmp 0x2025af5b
xor eax, eax
lea rcx, [0x20566710]
lea rdx, [0x20479400]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x2025aef6
inc rax
jmp 0x2025ae60
xor eax, eax
lea rcx, [0x205665f0]
lea rdx, [0x204792e0]
mov r9d, r8d
xor r9d, 0xc0b6c2c3
mov r10d, r8d
xor r10d, 0xc0b6c2df
nop dword [rax]
cdqe
movzx r11d, byte [rax + rdx]
xor byte [rax + rcx], r11b
mov r11d, dword [0x20567e30]
mov esi, r9d
xor esi, r11d
mov edi, r9d
and edi, r11d
lea esi, [rsi + rdi*2]
add eax, esi
add r11d, r10d
cmp eax, r11d
jl 0x2025aeb0
xor r8b, 0x1a
add r8b, byte [0x20567e34]
xchg byte [0x20566605], r8b
lea rax, [0x205665f0]
jmp 0x2025af5b
mov al, 0xc9
xchg byte [0x20566721], al
lea rax, [0x20566710]
jmp 0x2025af5b
xor eax, eax
lea rcx, [0x205667c0]
lea rdx, [0x204794b0]
nop word [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x2025af4c
inc rax
jmp 0x2025af20
mov al, 0xc9
xchg byte [0x205667cd], al
lea rax, [0x205667c0]
pop rdi
pop rsi
ret