joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400996f0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
movaps xmmword [rbp], xmm6
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
lea rax, [0x14045e548]
mov qword [rcx], rax
lea rax, [rcx + 8]
mov qword [rbp - 0x48], rax
mov dword [rcx + 8], 0
mov word [rcx + 0xc], 0
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x30], 0
mov qword [rcx + 0x38], 0xf
mov byte [rcx + 0x20], 0
lea rax, [0x14045cff8]
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x58], 0
mov qword [rcx + 0x60], 0xf
mov byte [rcx + 0x48], 0
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x80], 0
mov qword [rcx + 0x88], 0xf
mov byte [rcx + 0x70], 0
mov qword [rcx + 0x68], rax
mov byte [rcx + 0x90], 0
mov dword [rcx + 0x94], 0
lea rax, [rcx + 0xa8]
mov qword [rbp - 0x40], rax
xorps xmm6, xmm6
movups xmmword [rcx + 0xb0], xmm6
mov qword [rcx + 0xc0], 0
mov byte [rcx + 0xc8], 1
mov dword [rcx + 0xcc], 1
movups xmmword [rcx + 0xd0], xmm6
mov qword [rcx + 0xe0], 0
lea rdi, [0x14045eea8]
mov qword [rcx + 0xa8], rdi
mov qword [rcx + 0xa0], 0
mov byte [rcx + 0x1e0], 0
lea rbx, [rcx + 0x1e4]
mov r8d, 0x150
mov rcx, rbx
xor edx, edx
call fcn.140440780
mov qword [rbp - 0x38], rbx
mov rcx, rbx
xor edx, edx
call fcn.1402b7f80
mov dword [rsi + 0x334], 0
lea rax, [rsi + 0x348]
mov qword [rbp - 0x30], rax
movups xmmword [rsi + 0x348], xmm6
movups xmmword [rsi + 0x358], xmm6
mov qword [rsi + 0x368], 0
mov ecx, 0x70
call fcn.14041885c
lea rcx, [rsi + 0x360]
mov qword [rbp - 0x28], rcx
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsi + 0x360], rax
lea rax, [rsi + 0x370]
mov qword [rbp - 0x20], rax
movups xmmword [rsi + 0x370], xmm6
mov qword [rsi + 0x380], 0
lea rax, [rsi + 0x390]
mov qword [rbp - 0x18], rax
movups xmmword [rsi + 0x390], xmm6
mov qword [rsi + 0x3a0], 0
mov eax, dword [0x1405a6b70]
mov ecx, dword [0x1405aa758]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x26838]
jg 0x14009994d
lea rax, [0x1405a69a8]
mov qword [rsi + 0x3a8], rax
lea rax, [rsi + 0x3c8]
mov qword [rbp - 0x10], rax
movups xmmword [rsi + 0x3d0], xmm6
mov qword [rsi + 0x3e0], 0
mov byte [rsi + 0x3e8], 1
mov dword [rsi + 0x3ec], 1
movups xmmword [rsi + 0x3f0], xmm6
mov qword [rsi + 0x400], 0
mov qword [rsi + 0x3c8], rdi
mov rcx, rsi
call fcn.140099e10
mov rax, rsi
movaps xmm6, xmmword [rbp]
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x28], 0x3bcde07a
mov dword [rsp + 0x20], 0x4d83ddaf
lea r8, [0x1405a6b70]
mov ecx, 1
mov edx, 1
mov r9d, 0x5cca6902
call fcn.1400b3bf0
cmp dword [0x1405a6b70], 0xffffffff
jne 0x1400998dd
lea rcx, [0x1405a69a8]
call fcn.14009a810
lea rcx, [0x14009aa90]
mov edx, 0x11651386
mov r8d, 0x16bc4d75
mov r9d, 0xc5299111
call fcn.1400b2ce0
mov dword [rsp + 0x28], 0x3bcde07a
mov dword [rsp + 0x20], 0x4d83ddaf
lea r8, [0x1405a6b70]
mov ecx, 1
xor edx, edx
mov r9d, 0x5cca6902
call fcn.1400b3bf0
jmp 0x1400998dd
Function at 0x1400ab2f0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
movzx eax, byte [0x1405260b4]
mov ecx, eax
not cl
mov edx, eax
and dl, 0x76
mov r8d, ecx
and r8b, 0x89
or r8b, dl
xor al, 9
and cl, 0x76
or cl, al
not cl
add cl, cl
add cl, r8b
cmp byte [rbx + 0x19], cl
jne 0x1400ab39c
movabs r14, 0xff8bf72f3e1e6bf7
movabs r15, 0x7f8bf72f3e1e6bf7
nop word [rax + rax]
mov r8, qword [rbx + 0x10]
mov rcx, rdi
mov rdx, rsi
call fcn.1400ab2f0
mov r12, qword [rbx]
mov rax, qword [rbx + 0x20]
lea rcx, [rbx + 0x20]
mov rax, qword [rax]
xor edx, edx
call qword [case.0x1401238cb.0]
mov rax, qword [0x1405260b8]
mov rcx, rax
xor rcx, r14
and rax, r15
lea rdx, [rcx + rax*2]
mov rcx, rbx
call fcn.1400ad790
cmp byte [r12 + 0x19], 0
mov rbx, r12
je 0x1400ab350
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400ae7a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov esi, r9d
test ecx, ecx
je 0x1400ae82b
mov eax, esi
xor eax, 0x9d31904f
mov ecx, edx
mov edx, eax
mov r8d, 0x5ff5f4ce
call fcn.1400712d0
test al, 1
je 0x1400ae874
movzx eax, byte [0x140523256]
cmp al, 0xa2
je 0x1400ae9fb
lea rdi, [rsp + 0x20]
nop word cs:[rax + rax]
mov r8d, dword [0x1405260b0]
lea eax, [r8 + 0x3977d508]
mov edx, eax
xor edx, eax
not edx
and edx, esi
xor edx, eax
add r8d, 0x8197aa88
mov rcx, rdi
call fcn.1400b2c40
test al, 1
jne 0x1400ae924
cmp byte [rsp + 0x20], 0xa2
jne 0x1400ae7f0
jmp 0x1400ae9fb
movzx eax, byte [0x14052344f]
cmp al, 0x7b
je 0x1400ae918
nop word [rax + rax]
movzx ecx, byte [0x1405260b4]
mov edx, ecx
xor dl, 0xc2
mov eax, ecx
and al, 0x42
add al, al
add al, dl
add cl, 0xdc
lock cmpxchg byte [0x14052344f], cl
je 0x1400ae8c4
movzx ecx, byte [0x1405260b4]
add cl, 4
cmp al, cl
jne 0x1400ae840
jmp 0x1400ae918
mov edx, esi
xor edx, 0x765b3659
lea rcx, [rsp + 0x20]
mov r8d, 0x1eabe90b
call fcn.1400b1ba0
cmp byte [rsp + 0x20], 0xd
je 0x1400ae9ea
nop word [rax + rax]
movzx ecx, byte [0x1405260b4]
lea eax, [rcx + 0x67]
add cl, 0x89
lock cmpxchg byte [0x140523321], cl
je 0x1400ae95c
cmp al, 0xd
jne 0x1400ae8a0
jmp 0x1400ae9ea
xor eax, eax
lea rbx, [0x140523440]
lea r14, [0x14045cf60]
xor esi, 0x37efc54d
lea rdi, [rsp + 0x20]
nop
movsxd rcx, eax
movzx eax, byte [rcx + r14]
mov edx, eax
xor dl, al
not dl
and dl, byte [rcx + rbx]
xor dl, al
mov byte [rcx + rbx], dl
mov rdx, rdi
mov r8d, esi
mov r9d, 0xc7fd5d32
call fcn.1400b1f20
mov eax, dword [rsp + 0x20]
cmp eax, 0xf
jl 0x1400ae8e0
mov al, 0x7b
xchg byte [0x14052344f], al
lea rax, [0x140523440]
jmp 0x1400aea02
xor eax, eax
lea rcx, [0x140523240]
lea rdx, [0x14045cd70]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x15
jg 0x1400ae9f3
inc rax
jmp 0x1400ae940
xor ebp, ebp
mov eax, esi
not eax
mov ecx, eax
and ecx, 0xca451cd0
mov edi, esi
and edi, 0x35bae32f
or edi, ecx
lea rbx, [rsp + 0x20]
lea r14, [0x140523310]
lea r15, [0x14045ce30]
and eax, 0x810ef20
and esi, 0xf7ef10df
or esi, eax
nop word cs:[rax + rax]
mov ecx, ebp
mov rdx, rbx
mov r8d, edi
mov r9d, 0x7d87267
call fcn.1400b30b0
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + r14]
movsxd rcx, ebp
add al, byte [rcx + r15]
mov byte [rcx + r14], al
mov rdx, rbx
mov r8d, esi
mov r9d, 0x2048981c
call fcn.1400b2d70
mov ebp, dword [rsp + 0x20]
cmp ebp, 0x11
jl 0x1400ae9a0
mov al, 0xd
xchg byte [0x140523321], al
lea rax, [0x140523310]
jmp 0x1400aea02
mov al, 0xa2
xchg byte [0x140523256], al
lea rax, [0x140523240]
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400aeb10
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
push rbx
test ecx, ecx
je 0x1400aeb49
test edx, edx
je 0x1400aeb89
movzx eax, byte [0x140523210]
cmp al, 0x33
je 0x1400aec9b
mov cl, 0x6c
nop word [rax + rax]
mov al, 0xe5
lock cmpxchg byte [0x140523210], cl
je 0x1400aec19
cmp al, 0x33
jne 0x1400aeb30
jmp 0x1400aec9b
mov eax, 0x2d49cab8
add eax, dword [0x1405260b0]
cmp edx, eax
jne 0x1400aebec
movzx eax, byte [0x1405232e9]
cmp al, 0x2b
je 0x1400aed65
mov cl, 0xf7
nop dword [rax]
mov al, 0xbc
lock cmpxchg byte [0x1405232e9], cl
je 0x1400aecb5
cmp al, 0x2b
jne 0x1400aeb70
jmp 0x1400aed65
movzx eax, byte [0x1405233f3]
cmp al, 0xcc
je 0x1400aecac
movzx ecx, byte [0x1405260b4]
lea eax, [rcx + 0x2e]
mov edx, ecx
xor dl, 0xde
not cl
and cl, 0x21
or cl, dl
not cl
add cl, cl
add cl, dl
lock cmpxchg byte [0x1405233f3], cl
jne 0x1400aeb90
xor eax, eax
lea rcx, [0x1405233e0]
lea rdx, [0x14045cf00]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x12
jg 0x1400aeca4
inc rax
jmp 0x1400aebd0
movzx eax, byte [0x140523275]
cmp al, 0x98
je 0x1400aed4d
mov cl, 0xba
nop dword [rax]
mov al, 0x43
lock cmpxchg byte [0x140523275], cl
je 0x1400aece8
cmp al, 0x98
jne 0x1400aec00
jmp 0x1400aed4d
xor eax, eax
lea rcx, [0x140523200]
lea rdx, [0x14045cd40]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
mov r11d, r9d
not r11b
mov ebx, r10d
xor bl, r11b
and bl, r10b
xor r11b, r8b
and r10b, r9b
or r10b, r11b
not r10b
or r10b, bl
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
mov r9d, dword [0x1405260b0]
mov r10d, r9d
xor r10d, 0x2d49cac8
and r9d, 0x2d49cac8
lea r9d, [r10 + r9*2]
cmp r8d, r9d
jge 0x1400aec8c
inc rax
jmp 0x1400aec30
movzx eax, byte [0x1405260b4]
add al, 0xbc
xchg byte [0x140523210], al
lea rax, [0x140523200]
pop rbx
ret
mov al, 0xcc
xchg byte [0x1405233f3], al
lea rax, [0x1405233e0]
pop rbx
ret
xor eax, eax
lea rcx, [0x1405232e0]
lea rdx, [0x14045ce00]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1400aed56
inc rax
jmp 0x1400aecd0
xor edx, edx
lea rax, [0x140523260]
lea rcx, [0x14045cd90]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
not r10b
mov r11d, r9d
xor r11b, r10b
and r10b, r9b
not r11b
and r11b, r8b
or r11b, r10b
mov byte [rdx + rax], r11b
mov r8d, dword [0x1405260b0]
add edx, r8d
add edx, 0x2d49cab9
add r8d, 0x2d49cacd
cmp edx, r8d
jl 0x1400aed00
mov al, 0x98
xchg byte [0x140523275], al
lea rax, [0x140523260]
pop rbx
ret
movzx eax, byte [0x1405260b4]
add al, 0xb4
xchg byte [0x1405232e9], al
lea rax, [0x1405232e0]
pop rbx
ret
Function at 0x1400aee70
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1405260b0]
mov r8d, eax
xor r8d, 0x2d49cab8
and eax, 0x2d49cab8
lea eax, [r8 + rax*2]
cmp ecx, eax
jne 0x1400aeec6
test edx, edx
je 0x1400aef0c
movzx eax, byte [0x14052337f]
cmp al, 0xac
je 0x1400aeebe
mov cl, 0x2d
nop
mov al, 0xc0
lock cmpxchg byte [0x14052337f], cl
je 0x1400aef6c
movzx edx, byte [0x1405260b4]
add dl, 0x35
cmp al, dl
jne 0x1400aeea0
lea rax, [0x140523370]
ret
test edx, edx
je 0x1400aef3c
movzx eax, byte [0x1405233bb]
movzx ecx, byte [0x1405260b4]
add cl, 0x5e
cmp al, cl
je 0x1400aef04
mov cl, 0x55
nop word cs:[rax + rax]
mov al, pe_nt_image_headers64
lock cmpxchg byte [0x1405233bb], cl
je 0x1400aefaf
cmp al, 0xd5
jne 0x1400aeef0
lea rax, [0x1405233b0]
ret
movzx eax, byte [0x140523333]
cmp al, 0xeb
je 0x1400aef34
mov cl, 0x2a
nop dword [rax]
mov al, 0x71
lock cmpxchg byte [0x140523333], cl
je 0x1400aefff
cmp al, 0xeb
jne 0x1400aef20
lea rax, [0x140523330]
ret
movzx eax, byte [0x140523363]
cmp al, 0xe3
je 0x1400aef64
mov cl, 0x11
nop dword [rax]
mov al, 0x2c
lock cmpxchg byte [0x140523363], cl
je 0x1400af028
cmp al, 0xe3
jne 0x1400aef50
lea rax, [0x140523340]
ret
xor edx, edx
lea rax, [0x140523370]
lea rcx, [0x14045ce90]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x1400aef80
mov al, 0xac
xchg byte [0x14052337f], al
lea rax, [0x140523370]
ret
xor edx, edx
lea rax, [0x1405233b0]
lea rcx, [0x14045ced0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xb
jl 0x1400aefc0
mov al, 0xd5
xchg byte [0x1405233bb], al
lea rax, [0x1405233b0]
ret
xor eax, eax
lea rcx, [0x140523330]
lea rdx, [0x14045ce50]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1400af071
inc rax
jmp 0x1400af010
xor edx, edx
lea rax, [0x140523340]
lea rcx, [0x14045ce60]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1405260b0]
add edx, r8d
add edx, 0x2d49cab9
cmp edx, 0x23
jl 0x1400af040
mov al, 0xe3
xchg byte [0x140523363], al
lea rax, [0x140523340]
ret
mov al, 0xeb
xchg byte [0x140523333], al
lea rax, [0x140523330]
ret
Function at 0x1400b1c20
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1400b1c5c
test edx, edx
je 0x1400b1c8c
movzx eax, byte [0x1405231b5]
cmp al, 0x9d
je 0x1400b1c54
mov cl, 0x13
nop word [rax + rax]
mov al, 0x41
lock cmpxchg byte [0x1405231b5], cl
je 0x1400b1d08
cmp al, 0x9d
jne 0x1400b1c40
lea rax, [0x1405231a0]
ret
test edx, edx
je 0x1400b1ccc
movzx eax, byte [0x1405232a6]
cmp al, 0x34
je 0x1400b1c84
mov cl, 0xa5
nop dword [rax]
mov al, 0xbd
lock cmpxchg byte [0x1405232a6], cl
je 0x1400b1d55
cmp al, 0x34
jne 0x1400b1c70
lea rax, [0x140523290]
ret
movzx eax, byte [0x140523186]
xor r8b, 0x29
add r8b, byte [0x1405260b4]
cmp al, r8b
je 0x1400b1cc4
mov cl, 0xc2
nop word cs:[rax + rax]
mov al, 0x39
lock cmpxchg byte [0x140523186], cl
je 0x1400b1dbb
cmp al, 0x22
jne 0x1400b1cb0
lea rax, [0x140523180]
ret
movzx eax, byte [0x14052345d]
cmp al, 0x9f
je 0x1400b1d00
mov cl, 0x11
nop dword [rax]
mov al, 0xbe
lock cmpxchg byte [0x14052345d], cl
je 0x1400b1df8
mov edx, r8d
xor dl, 0xaa
add dl, byte [0x1405260b4]
cmp al, dl
jne 0x1400b1ce0
lea rax, [0x140523450]
ret
xor edx, edx
lea rax, [0x1405231a0]
lea rcx, [0x14045cce0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0x7ffffffe
and r8d, edx
xor edx, 1
lea edx, [rdx + r8*2]
cmp edx, 0x15
jl 0x1400b1d20
mov al, 0x9d
xchg byte [0x1405231b5], al
lea rax, [0x1405231a0]
ret
xor edx, edx
lea rax, [0x140523290]
lea rcx, [0x14045cdc0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 0xee1f77f4
and edx, 0x6e1f77f4
lea edx, [r8 + rdx*2]
add edx, 0x11e0880d
cmp edx, 0x16
jl 0x1400b1d70
mov al, 0x34
xchg byte [0x1405232a6], al
lea rax, [0x140523290]
ret
xor eax, eax
lea rcx, [0x140523180]
lea rdx, [0x14045ccc0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x1400b1de8
inc rax
jmp 0x1400b1dd0
mov al, 0x22
xchg byte [0x140523186], al
lea rax, [0x140523180]
ret
xor eax, eax
lea rcx, [0x140523450]
lea rdx, [0x14045cf70]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1400b1e38
inc rax
jmp 0x1400b1e10
mov al, 0x9f
xchg byte [0x14052345d], al
lea rax, [0x140523450]
ret
Function at 0x140107030
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140107097
test edx, edx
je 0x1401070f6
movzx eax, byte [0x140528665]
movzx ecx, byte [0x140534180]
add cl, 0x8a
cmp al, cl
je 0x14010708f
mov cl, 0x67
nop word cs:[rax + rax]
mov al, 0x8e
lock cmpxchg byte [0x140528665], cl
je 0x14010718c
movzx edx, byte [0x140534180]
mov r8d, edx
xor r8b, 0x75
and r8b, dl
xor dl, 0x8a
add r8b, r8b
add r8b, dl
cmp al, r8b
jne 0x140107060
lea rax, [0x140528660]
ret
mov eax, dword [0x140534170]
mov ecx, eax
xor ecx, 0x22131230
and eax, 0x22131230
lea eax, [rcx + rax*2]
add eax, 0xe0d7729d
cmp edx, eax
jne 0x14010712c
movzx eax, byte [0x1405286a3]
cmp al, 0xbe
je 0x1401070ee
mov cl, 0x93
nop word cs:[rax + rax]
mov al, 0x7f
lock cmpxchg byte [0x1405286a3], cl
je 0x140107247
movzx edx, byte [0x140534180]
add dl, 0xa4
cmp al, dl
jne 0x1401070d0
lea rax, [0x140528680]
ret
movzx eax, byte [0x140528639]
cmp al, 0x1a
je 0x140107124
mov cl, 0xa7
nop word cs:[rax + rax]
mov al, 0x4a
lock cmpxchg byte [0x140528639], cl
je 0x1401071e2
cmp al, 0x1a
jne 0x140107110
lea rax, [0x140528630]
ret
movzx eax, byte [0x140528548]
nop word cs:[rax + rax]
cmp al, 0xec
je 0x1401072be
movzx ecx, byte [0x140534180]
lea eax, [rcx - 0x68]
add cl, 0x58
lock cmpxchg byte [0x140528548], cl
jne 0x140107140
xor eax, eax
lea rcx, [0x140528530]
lea rdx, [0x14045eff0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x17
jg 0x1401072b6
inc rax
jmp 0x140107170
xor eax, eax
lea rcx, [0x140528660]
lea rdx, [0x14045f110]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r8b
mov r10d, r8d
and r10b, r9b
not r9b
xor r8b, r9b
and r8b, r9b
or r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x1401071d2
inc rax
jmp 0x1401071a0
mov al, 0xa4
xchg byte [0x140528665], al
lea rax, [0x140528660]
ret
xor eax, eax
lea rcx, [0x140528630]
lea rdx, [0x14045f0e0]
nop word cs:[rax + rax]
xor r8d, r8d
sub r8b, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
xor r10d, r10d
sub r10b, r9b
mov r9d, r8d
xor r9b, r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
neg r10b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x140107237
inc rax
jmp 0x140107200
mov al, 0x1a
xchg byte [0x140528639], al
lea rax, [0x140528630]
ret
xor edx, edx
lea rax, [0x140528680]
lea rcx, [0x14045f130]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
add edx, edx
and edx, 2
mov r9d, r8d
xor r9d, edx
and edx, r8d
lea edx, [r9 + rdx*2]
mov r8d, dword [0x140534170]
mov r9d, r8d
xor r9d, 0x2ea84f0
and r8d, 0x2ea84f0
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x140107260
mov al, 0xbe
xchg byte [0x1405286a3], al
lea rax, [0x140528680]
ret
mov al, 0xec
xchg byte [0x140528548], al
lea rax, [0x140528530]
ret
Function at 0x140117490
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401174cc
test edx, edx
je 0x14011750c
movzx eax, byte [0x140536913]
cmp al, 0xdc
je 0x1401174c4
mov cl, 0xa2
nop word cs:[rax + rax]
mov al, 0x50
lock cmpxchg byte [0x140536913], cl
je 0x1401175ec
cmp al, 0xdc
jne 0x1401174b0
lea rax, [0x140536900]
ret
test edx, edx
je 0x1401175aa
movzx eax, byte [0x14053695d]
cmp al, 0x67
je 0x140117504
mov cl, 0xd4
nop word cs:[rax + rax]
mov al, 0x7f
lock cmpxchg byte [0x14053695d], cl
je 0x140117638
cmp al, 0x67
jne 0x1401174f0
lea rax, [0x140536950]
ret
movzx eax, byte [0x140536972]
nop word cs:[rax + rax]
cmp al, 0xb
je 0x1401175a2
movzx ecx, byte [0x140536a38]
lea eax, [rcx - 0x2f]
inc cl
lock cmpxchg byte [0x140536972], cl
jne 0x140117520
xor edx, edx
lea rax, [0x140536960]
lea rcx, [0x14045f980]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, dword [0x140536a28]
add edx, r8d
add edx, 0x3a8ab2b2
mov r9d, r8d
xor r9d, 0x3a8ab2c3
and r8d, 0x3a8ab2c3
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x140117550
mov al, 0xb
xchg byte [0x140536972], al
lea rax, [0x140536960]
ret
movzx eax, byte [0x1405368fd]
movzx ecx, byte [0x140536a38]
add cl, 0xbd
cmp al, cl
je 0x1401175e4
mov cl, 0x95
nop word cs:[rax + rax]
mov al, 0xd0
lock cmpxchg byte [0x1405368fd], cl
je 0x140117681
cmp al, 0x6f
jne 0x1401175d0
lea rax, [0x1405368f0]
ret
xor eax, eax
lea rcx, [0x140536900]
lea rdx, [0x14045f930]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x12
jg 0x140117628
inc rax
jmp 0x140117600
mov al, 0xdc
xchg byte [0x140536913], al
lea rax, [0x140536900]
ret
xor eax, eax
lea rcx, [0x140536950]
lea rdx, [0x14045f970]
mov r8d, 0x3a8ab2be
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140536a28]
add r10d, r8d
cmp r9d, r10d
jge 0x140117671
inc rax
jmp 0x140117650
mov al, 0x67
xchg byte [0x14053695d], al
lea rax, [0x140536950]
ret
xor eax, eax
lea rcx, [0x1405368f0]
lea rdx, [0x14045f920]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401176b8
inc rax
jmp 0x1401176a0
mov al, 0x6f
xchg byte [0x1405368fd], al
lea rax, [0x1405368f0]
ret
Function at 0x140117910
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x14011796d
test edx, edx
je 0x1401179a9
movzx eax, byte [0x140536940]
mov ecx, r8d
xor cl, 0x23
add cl, byte [0x140536a38]
cmp al, cl
je 0x140117a7c
nop dword [rax]
movzx ecx, byte [0x140536a38]
mov eax, r8d
xor al, 0x94
add al, cl
mov edx, r8d
xor dl, 0xa7
add dl, cl
lock cmpxchg byte [0x140536940], dl
je 0x140117a19
cmp al, 0x40
jne 0x140117940
jmp 0x140117a7c
test edx, edx
je 0x1401179e9
movzx eax, byte [0x14053692d]
cmp al, 0xa1
je 0x140117b30
mov cl, 0x56
nop word cs:[rax + rax]
mov al, 0xa4
lock cmpxchg byte [0x14053692d], cl
je 0x140117a85
cmp al, 0xa1
jne 0x140117990
jmp 0x140117b30
movzx eax, byte [0x14053698d]
mov ecx, r8d
xor cl, 0x9e
add cl, byte [0x140536a38]
cmp al, cl
je 0x140117b1f
mov cl, 0x12
nop word cs:[rax + rax]
mov al, 0xdf
lock cmpxchg byte [0x14053698d], cl
je 0x140117acb
cmp al, 0xe5
jne 0x1401179d0
jmp 0x140117b1f
movzx eax, byte [0x1405368c3]
cmp al, 0x95
je 0x140117ba6
mov cl, 0x83
nop word [rax + rax]
mov al, 0x4f
lock cmpxchg byte [0x1405368c3], cl
je 0x140117b39
cmp al, 0x95
jne 0x140117a00
jmp 0x140117ba6
xor eax, eax
lea rcx, [0x140536930]
lea rdx, [0x14045f960]
mov r9d, r8d
xor r9d, 0x619dee1f
nop word cs:[rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
add byte [rax + rcx], r10b
mov r10d, dword [0x140536a28]
xor r10d, r9d
mov r11d, r10d
not r11d
and r11d, r9d
lea r10d, [r10 + r11*2]
add eax, r10d
cmp eax, 0x10
jl 0x140117a40
xor r8b, 0x23
add r8b, byte [0x140536a38]
xchg byte [0x140536940], r8b
lea rax, [0x140536930]
pop rbx
ret
xor eax, eax
lea rcx, [0x140536920]
lea rdx, [0x14045f950]
xor r8d, 0x619dee13
nop dword [rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140536a28]
mov r11d, r8d
xor r11d, r10d
and r10d, r8d
lea r10d, [r11 + r10*2]
cmp r9d, r10d
jge 0x140117b28
inc rax
jmp 0x140117aa0
xor eax, eax
lea rcx, [0x140536980]
lea rdx, [0x14045f9a0]
mov r9d, r8d
xor r9d, 0x619dee1f
nop word cs:[rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
mov r10d, dword [0x140536a28]
add r10d, r9d
add eax, r10d
cmp eax, 0xd
jl 0x140117af0
xor r8b, 0x9e
add r8b, byte [0x140536a38]
xchg byte [0x14053698d], r8b
lea rax, [0x140536980]
pop rbx
ret
mov al, 0xa1
xchg byte [0x14053692d], al
lea rax, [0x140536920]
pop rbx
ret
xor edx, edx
lea rax, [0x1405368a0]
lea rcx, [0x14045f8d0]
xor r8d, 0x619dee1f
movsxd rdx, edx
movzx r9d, byte [rdx + rax]
movzx r10d, byte [rdx + rcx]
mov r11d, r9d
not r11b
not r10b
mov ebx, r11d
xor bl, r10b
and bl, r11b
xor r10b, r9b
not r10b
and r10b, r9b
or r10b, bl
mov byte [rdx + rax], r10b
mov r9d, dword [0x140536a28]
add r9d, r8d
xor r9d, edx
mov r10d, r9d
not r10d
and r10d, edx
lea edx, [r9 + r10*2]
cmp edx, 0x23
jl 0x140117b50
mov al, 0x95
xchg byte [0x1405368c3], al
lea rax, [0x1405368a0]
pop rbx
ret
Function at 0x14011c820
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r9, r8
mov rsi, rdx
mov rdi, rcx
mov r8, qword [rcx]
mov rdx, qword [r8 + 8]
xor ebp, ebp
cmp byte [rdx + 0x19], 0
je 0x14011c84e
mov rbx, rdx
mov rax, r8
cmp byte [rax + 0x19], 0
jne 0x14011c8af
jmp 0x14011c8a7
mov ecx, dword [r9]
mov rax, r8
nop word cs:[rax + rax]
mov rbx, rdx
mov r10d, dword [rdx + 0x20]
cmp r10d, ecx
cmovae rax, rdx
lea rdx, [rdx + 0x10]
cmovae rdx, rbx
mov rdx, qword [rdx]
movzx r11d, byte [0x14053755c]
mov ebp, r11d
xor bpl, 0x8a
and r11b, 0xa
add r11b, r11b
add r11b, bpl
cmp byte [rdx + 0x19], r11b
je 0x14011c860
xor ebp, ebp
cmp r10d, ecx
setae bpl
cmp byte [rax + 0x19], 0
jne 0x14011c8af
mov ecx, dword [r9]
cmp ecx, dword [rax + 0x20]
jae 0x14011c8fb
movabs rax, 0x147ae147ae147ae
cmp qword [rdi + 8], rax
je 0x14011c8ff
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.14011c910
mov r8, qword [rsp + 0x40]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], ebp
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.14011ca70
mov cl, 1
mov qword [rsi], rax
mov byte [rsi + 8], cl
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
xor ecx, ecx
jmp 0x14011c8e9
call fcn.1400ac6b0
int3