joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140128110
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa5c3331b
add eax, dword [0x140523754]
cmp ecx, eax
jne 0x14012815c
test edx, edx
je 0x1401281bc
movzx eax, byte [0x140522200]
cmp al, 0x63
je 0x140128154
mov cl, 0x15
nop word cs:[rax + rax]
mov al, 0x10
lock cmpxchg byte [0x140522200], cl
je 0x1401282b3
cmp al, 0x63
jne 0x140128140
lea rax, [0x1405221f0]
ret
test edx, edx
je 0x140128261
movzx eax, byte [0x140522199]
nop dword [rax + rax]
cmp al, 0xdc
je 0x1401282f0
movzx ecx, byte [0x140523750]
lea eax, [rcx - 0x73]
add cl, 0xa3
lock cmpxchg byte [0x140522199], cl
jne 0x140128170
xor eax, eax
lea rcx, [0x140522190]
lea rdx, [0x14044ded0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1401282e8
inc rax
jmp 0x1401281a0
movzx eax, byte [0x1405221b6]
nop word cs:[rax + rax]
cmp al, 0x6e
je 0x140128259
movzx ecx, byte [0x140523750]
lea eax, [rcx - 0x21]
add cl, 0x88
lock cmpxchg byte [0x1405221b6], cl
jne 0x1401281d0
xor eax, eax
lea rcx, [0x1405221b0]
lea rdx, [0x14044def0]
nop
cdqe
xor r8d, r8d
sub r8b, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
xor r10d, r10d
sub r10b, r9b
mov r9d, r8d
xor r9b, r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
neg r10b
mov byte [rax + rcx], r10b
mov r8d, dword [0x140523754]
mov r9d, r8d
xor r9d, 0x5a3ccce3
and r9d, r8d
xor r8d, 0xa5c3331c
lea r8d, [r8 + r9*2]
add eax, r8d
cmp eax, 6
jl 0x140128200
mov al, 0x6e
xchg byte [0x1405221b6], al
lea rax, [0x1405221b0]
ret
movzx eax, byte [0x1405222f5]
movzx ecx, byte [0x140523750]
add cl, 0xc9
cmp al, cl
je 0x1401282ab
nop word cs:[rax + rax]
movzx ecx, byte [0x140523750]
mov edx, ecx
xor dl, 0x40
mov eax, ecx
not al
and al, 0x3f
or al, dl
not al
add al, al
add al, dl
add cl, 0xb7
lock cmpxchg byte [0x1405222f5], cl
je 0x140128308
cmp al, 0x8d
jne 0x140128280
lea rax, [0x1405222e0]
ret
xor eax, eax
lea rcx, [0x1405221f0]
lea rdx, [0x14044df30]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1401282f8
inc rax
jmp 0x1401282d0
mov al, 0xdc
xchg byte [0x140522199], al
lea rax, [0x140522190]
ret
mov al, 0x63
xchg byte [0x140522200], al
lea rax, [0x1405221f0]
ret
xor edx, edx
lea rax, [0x1405222e0]
lea rcx, [0x14044e010]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x140128320
mov al, 0x8d
xchg byte [0x1405222f5], al
lea rax, [0x1405222e0]
ret
Function at 0x140128350
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa5c3331b
mov r8d, dword [0x140523754]
add r8d, eax
cmp ecx, r8d
jne 0x1401283ac
test edx, edx
je 0x14012845c
movzx eax, byte [0x140522136]
movzx ecx, byte [0x140523750]
mov edx, ecx
xor dl, 0x8a
and cl, 0xa
add cl, cl
add cl, dl
cmp al, cl
je 0x1401283a4
mov cl, 0xc3
nop dword [rax]
mov al, 0x87
lock cmpxchg byte [0x140522136], cl
je 0x140128496
cmp al, 0x4e
jne 0x140128390
lea rax, [0x140522120]
ret
add eax, dword [0x140523754]
cmp edx, eax
jne 0x1401283ec
movzx eax, byte [0x140522082]
cmp al, 0xb
je 0x1401283e4
mov cl, 0x2a
nop word cs:[rax + rax]
mov al, 0x65
lock cmpxchg byte [0x140522082], cl
je 0x1401284f1
cmp al, 0xb
jne 0x1401283d0
lea rax, [0x140522070]
ret
movzx eax, byte [0x1405222dd]
nop word cs:[rax + rax]
cmp al, 0x42
je 0x140128557
movzx ecx, byte [0x140523750]
lea eax, [rcx - 0x5f]
add cl, 0xeb
lock cmpxchg byte [0x1405222dd], cl
jne 0x140128400
xor eax, eax
lea rcx, [0x1405222d0]
lea rdx, [0x14044e000]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14012854f
inc rax
jmp 0x140128430
movzx eax, byte [0x140522065]
cmp al, 0xab
je 0x14012848e
mov cl, 0x1c
nop dword [rax]
mov al, 0x3f
lock cmpxchg byte [0x140522065], cl
je 0x14012855f
movzx edx, byte [0x140523750]
add dl, 0xe7
cmp al, dl
jne 0x140128470
lea rax, [0x140522050]
ret
xor edx, edx
lea rax, [0x140522120]
lea rcx, [0x14044de80]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140523754]
add edx, r8d
add edx, 0xa5c3331c
cmp edx, 0x16
jl 0x1401284b0
mov al, 0x4e
xchg byte [0x140522136], al
lea rax, [0x140522120]
ret
xor eax, eax
lea rcx, [0x140522070]
lea rdx, [0x14044ddd0]
nop word cs:[rax + rax]
cdqe
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
mov r8d, dword [0x140523754]
mov r9d, r8d
xor r9d, 0xa5c3331c
and r8d, 0x25c3331c
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0x12
jl 0x140128510
mov al, 0xb
xchg byte [0x140522082], al
lea rax, [0x140522070]
ret
mov al, 0x42
xchg byte [0x1405222dd], al
lea rax, [0x1405222d0]
ret
xor eax, eax
lea rcx, [0x140522050]
lea rdx, [0x14044ddb0]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140128588
inc rax
jmp 0x140128570
mov al, 0xab
xchg byte [0x140522065], al
lea rax, [0x140522050]
ret
Function at 0x140128b60
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa5c3331b
add eax, dword [0x140523754]
cmp ecx, eax
jne 0x140128bcc
test edx, edx
je 0x140128c5a
movzx eax, byte [0x1405221c5]
nop
cmp al, 0x13
je 0x140128cea
movzx ecx, byte [0x140523750]
lea eax, [rcx + 0x52]
add cl, 0x46
lock cmpxchg byte [0x1405221c5], cl
jne 0x140128b80
xor eax, eax
lea rcx, [0x1405221c0]
lea rdx, [0x14044df00]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x140128cd2
inc rax
jmp 0x140128bb0
test edx, edx
je 0x140128c88
movzx eax, byte [0x14052230d]
nop dword [rax + rax]
cmp al, 0x2a
je 0x140128c52
movzx ecx, byte [0x140523750]
lea eax, [rcx + 0x59]
mov edx, eax
xor dl, 0xb1
and al, 0x31
add al, al
add al, dl
add cl, 0xa4
lock cmpxchg byte [0x14052230d], cl
jne 0x140128be0
xor r8d, r8d
lea rax, [0x140522300]
lea rcx, [0x14044e030]
mov edx, 0xa5c33328
nop dword [rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
add byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x140523754]
add r9d, edx
cmp r8d, r9d
jl 0x140128c20
mov al, 0x2a
xchg byte [0x14052230d], al
lea rax, [0x140522300]
ret
movzx eax, byte [0x1405222cd]
cmp al, 3
je 0x140128c80
mov cl, 0x2e
nop word [rax + rax]
mov al, 0x1f
lock cmpxchg byte [0x1405222cd], cl
je 0x140128cf2
cmp al, 3
jne 0x140128c70
lea rax, [0x1405222c0]
ret
movzx eax, byte [0x140522263]
cmp al, 0xfb
je 0x140128cca
mov cl, 0x31
nop word cs:[rax + rax]
mov al, 0x2d
lock cmpxchg byte [0x140522263], cl
je 0x140128d3f
movzx edx, byte [0x140523750]
mov r8d, edx
xor r8b, 0x37
and dl, 0x37
add dl, dl
add dl, r8b
cmp al, dl
jne 0x140128ca0
lea rax, [0x140522240]
ret
movzx eax, byte [0x140523750]
mov ecx, eax
xor cl, 0x4f
and al, 0x4f
add al, al
add al, cl
xchg byte [0x1405221c5], al
lea rax, [0x1405221c0]
ret
xor eax, eax
lea rcx, [0x1405222c0]
lea rdx, [0x14044dff0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r9b
mov r10d, r9d
or r10b, r8b
not r10b
and r9b, r8b
or r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140128d68
inc rax
jmp 0x140128d10
xor eax, eax
lea rcx, [0x140522240]
lea rdx, [0x14044df70]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x140128d78
inc rax
jmp 0x140128d50
mov al, 3
xchg byte [0x1405222cd], al
lea rax, [0x1405222c0]
ret
mov al, 0xfb
xchg byte [0x140522263], al
lea rax, [0x140522240]
ret
Function at 0x1401463c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, rcx
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 0
lea r8, [rbp - 0x20]
call fcn.14010ee90
nop word cs:[rax + rax]
mov rsi, qword [rbp - 0x20]
mov r14, qword [rbp - 0x18]
mov eax, dword [0x14058f1dc]
cmp eax, 0x21
jl 0x14014642c
nop word cs:[rax + rax]
cmp qword [0x14058f1e8], 0
jne 0x140146420
jmp 0x140146400
cmp rsi, r14
je 0x14014649f
add rdi, 0x10
lea rbx, [rbp - 0x30]
nop dword [rax]
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
call fcn.1400f2e20
mov eax, dword [0x14058f1d8]
lea ecx, [rax + 1]
imul ecx, eax
test cl, 1
mov eax, dword [0x14058f1dc]
mov ecx, dword [0x140528f38]
mov edx, ecx
xor edx, 0xb190833f
and ecx, 0x3190833f
lea ecx, [rdx + rcx*2]
cmp eax, ecx
jge 0x14014645d
add rsi, 4
cmp rsi, r14
jne 0x140146440
mov eax, dword [0x14058f1d8]
mov ecx, eax
sub ecx, dword [0x140528f38]
imul ecx, eax
test cl, 1
mov rsi, qword [rbp - 0x20]
test rsi, rsi
je 0x14014651d
mov rdx, qword [rbp - 0x10]
sub rdx, rsi
cmp rdx, 0x1000
jb 0x140146515
mov rax, qword [rsi - 8]
add rsi, qword [0x140528f30]
movabs rcx, 0x6beb9065485c4469
add rcx, rsi
mov r8, rax
neg r8
mov r9, rcx
xor r9, r8
and r8, rcx
lea rcx, [r9 + r8*2]
cmp rcx, 0x20
jae 0x14014654a
movabs rcx, 0x6beb9065485c4498
add rcx, qword [0x140528f30]
mov r8, rcx
not r8
mov r9, rdx
xor r9, r8
xor r8, rcx
and r8, rdx
xor r8, rcx
and r9, rdx
lea rdx, [r8 + r9*2]
mov rsi, rax
mov rcx, rsi
call fcn.1400ab270
mov ecx, dword [0x14058f1d8]
lea eax, [rcx - 1]
imul eax, ecx
mov ecx, dword [0x140528f38]
mov edx, ecx
xor edx, 0xb1908315
and ecx, 0x31908315
lea ecx, [rdx + rcx*2]
xor edx, edx
div ecx
test edx, edx
jne 0x1401465c0
jmp 0x14014659a
mov ecx, 0xb1908315
mov edx, dword [0x14058f1d8]
lea eax, [rdx - 1]
imul eax, edx
mov r8d, dword [0x140528f38]
add r8d, ecx
xor edx, edx
div r8d
test edx, edx
jne 0x140146587
mov eax, dword [0x140528f38]
mov edx, eax
xor edx, 0xb1908313
and eax, 0x31908313
add eax, eax
add eax, edx
je 0x140146595
cmp dword [0x140528f38], 0x4e6f7ced
jne 0x14014654f
jmp 0x14014656e
call fcn.1403e571c
mov eax, dword [0x14058f1d8]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
mov eax, 0xb1908313
add eax, dword [0x140528f38]
cmp ecx, eax
je 0x1401465cd
nop dword [rax + rax]
mov eax, dword [0x14058f1dc]
cmp eax, 0x4c
jge 0x1401465c0
jmp 0x14014659a
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x14015c310
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0xf3bfb8dc
add eax, dword [0x140529908]
cmp ecx, eax
jne 0x14015c3bb
test edx, edx
je 0x14015c3f8
movzx eax, byte [0x1405296a9]
nop word [rax + rax]
cmp al, 0x9a
je 0x14015c3b3
movzx ecx, byte [0x140529918]
mov eax, r8d
xor al, 0xc2
add al, cl
mov edx, r8d
xor dl, 0xfc
add dl, cl
lock cmpxchg byte [0x1405296a9], dl
jne 0x14015c340
xor edx, edx
lea rax, [0x1405296a0]
lea rcx, [0x14044ea90]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
add edx, 0xd386914c
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x2c796eb4
cmp edx, 9
jl 0x14015c380
mov al, 0x9a
xchg byte [0x1405296a9], al
lea rax, [0x1405296a0]
ret
test edx, edx
je 0x14015c475
movzx eax, byte [0x140529722]
cmp al, 0x9a
je 0x14015c3f0
mov cl, 0xa4
mov al, 0x1a
lock cmpxchg byte [0x140529722], cl
je 0x14015c4a8
mov edx, r8d
xor dl, 0x49
add dl, byte [0x140529918]
cmp al, dl
jne 0x14015c3d0
lea rax, [0x140529710]
ret
movzx eax, byte [0x1405294ec]
nop
cmp al, 0xb5
je 0x14015c46d
movzx ecx, byte [0x140529918]
mov edx, r8d
not dl
and dl, 0x94
mov eax, r8d
xor al, 0x6b
or al, dl
not al
or al, dl
add al, cl
add cl, r8b
lock cmpxchg byte [0x1405294ec], cl
jne 0x14015c400
xor edx, edx
lea rax, [0x1405294c0]
lea rcx, [0x14044e8c0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0x7ffffffe
and r8d, edx
xor edx, 1
lea edx, [rdx + r8*2]
cmp edx, 0x2c
jl 0x14015c440
mov al, 0xb5
xchg byte [0x1405294ec], al
lea rax, [0x1405294c0]
ret
movzx eax, byte [0x1405296d5]
cmp al, 0xe0
je 0x14015c4a0
mov cl, 0x23
nop word cs:[rax + rax]
mov al, 0xfd
lock cmpxchg byte [0x1405296d5], cl
je 0x14015c4e8
cmp al, 0xe0
jne 0x14015c490
lea rax, [0x1405296c0]
ret
xor eax, eax
lea rcx, [0x140529710]
lea rdx, [0x14044eb00]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x14015c4d8
inc rax
jmp 0x14015c4c0
mov al, 0x9a
xchg byte [0x140529722], al
lea rax, [0x140529710]
ret
xor eax, eax
lea rcx, [0x1405296c0]
lea rdx, [0x14044eab0]
xor r8d, 0xf3bfb8dd
neg r8d
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rcx]
mov r10d, r9d
xor r10b, 0xd6
and r9b, 0x56
add r9b, r9b
add r9b, r10b
add r9b, byte [rax + rdx]
add r9b, 0x2a
mov byte [rax + rcx], r9b
xor r9d, r9d
sub r9d, dword [0x140529908]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
sub eax, r9d
cmp eax, 0x15
jl 0x14015c510
mov al, pe_nt_image_headers64
xchg byte [0x1405296d5], al
lea rax, [0x1405296c0]
ret
Function at 0x14015c760
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14015c7ac
mov eax, r8d
xor eax, 0xcbd56a66
add eax, dword [0x140529908]
cmp edx, eax
jne 0x14015c7f8
movzx eax, byte [0x1405296eb]
cmp al, 0x70
je 0x14015c7a4
mov cl, 0x21
nop dword [rax + rax]
mov al, 0x46
lock cmpxchg byte [0x1405296eb], cl
je 0x14015c87c
cmp al, 0x70
jne 0x14015c790
lea rax, [0x1405296e0]
ret
test edx, edx
je 0x14015c84a
movzx eax, byte [0x14052964e]
cmp al, 0xd0
je 0x14015c7f0
mov cl, 0x32
nop word cs:[rax + rax]
mov al, 0xa5
lock cmpxchg byte [0x14052964e], cl
je 0x14015c908
mov edx, r8d
xor dl, 0x85
add dl, byte [0x140529918]
cmp al, dl
jne 0x14015c7d0
lea rax, [0x140529640]
ret
movzx eax, byte [0x140529683]
cmp al, 0xfa
je 0x14015c842
mov cl, 0x75
nop word cs:[rax + rax]
mov al, 0x9e
lock cmpxchg byte [0x140529683], cl
je 0x14015c8a8
movzx edx, byte [0x140529918]
mov r9d, r8d
xor r9b, 0x53
mov r10d, r9d
xor r10b, dl
and r9b, dl
add r9b, r9b
add r9b, r10b
cmp al, r9b
jne 0x14015c810
lea rax, [0x140529660]
ret
movzx eax, byte [0x1405296bd]
cmp al, 6
je 0x14015c874
mov cl, 0xf5
nop word [rax + rax]
mov al, 0x93
lock cmpxchg byte [0x1405296bd], cl
je 0x14015c948
cmp al, 6
jne 0x14015c860
lea rax, [0x1405296b0]
ret
xor eax, eax
lea rcx, [0x1405296e0]
lea rdx, [0x14044ead0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x14015c8e8
inc rax
jmp 0x14015c890
xor eax, eax
lea rcx, [0x140529660]
lea rdx, [0x14044ea50]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x14015c8f8
inc rax
jmp 0x14015c8c0
mov al, 0x70
xchg byte [0x1405296eb], al
lea rax, [0x1405296e0]
ret
mov al, 0xfa
xchg byte [0x140529683], al
lea rax, [0x140529660]
ret
xor eax, eax
lea rcx, [0x140529640]
lea rdx, [0x14044ea30]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x14015c938
inc rax
jmp 0x14015c920
mov al, 0xd0
xchg byte [0x14052964e], al
lea rax, [0x140529640]
ret
xor edx, edx
lea rax, [0x1405296b0]
lea rcx, [0x14044eaa0]
xor r8d, 0xcbd56a13
nop
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
mov r9d, dword [0x140529908]
add r9d, r8d
cmp edx, r9d
jl 0x14015c960
mov al, 6
xchg byte [0x1405296bd], al
lea rax, [0x1405296b0]
ret
Function at 0x140163d60
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140163da5
test edx, edx
je 0x140163ddc
movzx eax, byte [0x14052a4c5]
cmp al, 0x5d
je 0x140163d9d
mov cl, 0x2f
nop word cs:[rax + rax]
mov al, 0x6d
lock cmpxchg byte [0x14052a4c5], cl
je 0x140163e45
movzx edx, byte [0x14052b26c]
dec dl
cmp al, dl
jne 0x140163d80
lea rax, [0x14052a4b0]
ret
test edx, edx
je 0x140163e0c
movzx eax, byte [0x14052a633]
cmp al, 0xe0
je 0x140163dd4
mov cl, 0x9f
nop word cs:[rax + rax]
mov al, 0xb1
lock cmpxchg byte [0x14052a633], cl
je 0x140163ea2
cmp al, 0xe0
jne 0x140163dc0
lea rax, [0x14052a630]
ret
movzx eax, byte [0x14058f270]
cmp al, 0x13
je 0x140163e04
mov cl, 0x69
nop dword [rax]
xor eax, eax
lock cmpxchg byte [0x14058f270], cl
je 0x140163edc
cmp al, 0x13
jne 0x140163df0
lea rax, [0x14052a3f0]
ret
movzx eax, byte [0x14052a5b5]
cmp al, 0x5d
je 0x140163e3d
mov cl, 0xe5
nop dword [rax]
mov al, 0xcb
lock cmpxchg byte [0x14052a5b5], cl
je 0x140163f7a
movzx edx, byte [0x14052b26c]
dec dl
cmp al, dl
jne 0x140163e20
lea rax, [0x14052a5a0]
ret
xor edx, edx
lea rax, [0x14052a4b0]
lea rcx, [0x14044eda0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0xe1aac3d0
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x1e553c30
cmp edx, 0x15
jl 0x140163e60
movzx eax, byte [0x14052b26c]
dec al
xchg byte [0x14052a4c5], al
lea rax, [0x14052a4b0]
ret
xor eax, eax
lea rcx, [0x14052a630]
lea rdx, [0x14044ef00]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x140163f6a
inc rax
jmp 0x140163ec0
xor edx, edx
lea rax, [0x14052a3f0]
lea rcx, [0x14044ece0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
add r8b, 0xdf
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
add r8b, 0x21
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0xbf02c526
and edx, 0x3f02c526
lea edx, [r8 + rdx*2]
add edx, 0x40fd3adb
mov r8d, dword [0x14052b268]
mov r9d, r8d
xor r9d, 0x3c0d3006
and r8d, 0x3c0d3006
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x140163ef0
movzx eax, byte [0x14052b26c]
add al, 0xb5
xchg byte [0x14058f270], al
lea rax, [0x14052a3f0]
ret
mov al, pe_nt_image_headers64
xchg byte [0x14052a633], al
lea rax, [0x14052a630]
ret
xor eax, eax
lea rcx, [0x14052a5a0]
lea rdx, [0x14044ee80]
nop word [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r9b
mov r10d, r9d
or r10b, r8b
not r10b
and r9b, r8b
or r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140163fbf
inc rax
jmp 0x140163f90
mov al, 0x5d
xchg byte [0x14052a5b5], al
lea rax, [0x14052a5a0]
ret
Function at 0x140169c20
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140169c5c
mov ecx, dword [rsp + 0x28]
test edx, edx
je 0x140169c8c
movzx eax, byte [0x14052b6fe]
cmp al, 0xb7
je 0x140169c54
mov dl, 0x82
nop dword [rax]
mov al, 0xf5
lock cmpxchg byte [0x14052b6fe], dl
je 0x140169cec
cmp al, 0xb7
jne 0x140169c40
lea rax, [0x14052b6f0]
ret
test edx, edx
je 0x140169cbc
movzx eax, byte [0x14052b67d]
cmp al, 0x79
je 0x140169c84
mov cl, 0x3c
nop dword [rax]
mov al, 0x55
lock cmpxchg byte [0x14052b67d], cl
je 0x140169d5b
cmp al, 0x79
jne 0x140169c70
lea rax, [0x14052b670]
ret
movzx eax, byte [0x14052b7f2]
cmp al, 0x2d
je 0x140169cb4
mov dl, 0xd8
nop dword [rax]
mov al, 0x56
lock cmpxchg byte [0x14052b7f2], dl
je 0x140169d88
cmp al, 0x2d
jne 0x140169ca0
lea rax, [0x14052b7e0]
ret
movzx eax, byte [0x14052b5fd]
cmp al, 0x41
je 0x140169ce4
mov cl, 0x45
nop dword [rax]
mov al, 0x84
lock cmpxchg byte [0x14052b5fd], cl
je 0x140169dff
cmp al, 0x41
jne 0x140169cd0
lea rax, [0x14052b5f0]
ret
xor eax, eax
lea rdx, [0x14052b6f0]
lea r8, [0x14044f3b0]
xor ecx, 0x59246775
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
movzx r10d, byte [rax + r8]
not r9b
mov r11d, r9d
and r11b, r10b
not r10b
xor r9b, r10b
and r9b, r10b
or r9b, r11b
mov byte [rax + rdx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14052bad8]
add r10d, ecx
cmp r9d, r10d
jge 0x140169d4b
inc rax
jmp 0x140169d10
mov al, 0xb7
xchg byte [0x14052b6fe], al
lea rax, [0x14052b6f0]
ret
xor eax, eax
lea rcx, [0x14052b670]
lea rdx, [0x14044f330]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140169def
inc rax
jmp 0x140169d70
xor r8d, r8d
lea rax, [0x14052b7e0]
lea rdx, [0x14044f4a0]
xor ecx, 0x59246766
nop
movsxd r8, r8d
movzx r9d, byte [r8 + rdx]
xor byte [r8 + rax], r9b
mov r9d, dword [0x14052bad8]
mov r10d, ecx
xor r10d, r9d
and r9d, ecx
lea r9d, [r10 + r9*2]
mov r10d, r8d
xor r10d, r9d
not r8d
not r9d
and r9d, r8d
or r9d, r10d
not r9d
lea r8d, [r10 + r9*2]
cmp r8d, 0x12
jl 0x140169da0
mov al, 0x2d
xchg byte [0x14052b7f2], al
lea rax, [0x14052b7e0]
ret
mov al, 0x79
xchg byte [0x14052b67d], al
lea rax, [0x14052b670]
ret
xor eax, eax
lea rcx, [0x14052b5f0]
lea rdx, [0x14044f2b0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140169e28
inc rax
jmp 0x140169e10
mov al, 0x41
xchg byte [0x14052b5fd], al
lea rax, [0x14052b5f0]
ret
Function at 0x140169e60
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x140169efc
mov eax, r8d
xor eax, 0x7f11aaa
add eax, dword [0x14052bad8]
cmp edx, eax
jne 0x140169f3c
movzx eax, byte [0x14052b78d]
nop word [rax + rax]
cmp al, 0x3e
je 0x14016a010
movzx ecx, byte [0x14052badc]
mov eax, r8d
xor al, 0x67
add al, cl
mov edx, r8d
xor dl, 0x49
add dl, cl
lock cmpxchg byte [0x14052b78d], dl
jne 0x140169e90
xor eax, eax
lea rcx, [0x14052b780]
lea rdx, [0x14044f440]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14016a008
inc rax
jmp 0x140169ed0
test edx, edx
je 0x140169fc8
movzx eax, byte [0x14052b821]
cmp al, 0x1c
je 0x140169f34
mov cl, 0x73
nop word cs:[rax + rax]
mov al, 0xbf
lock cmpxchg byte [0x14052b821], cl
je 0x14016a028
cmp al, 0x1c
jne 0x140169f20
lea rax, [0x14052b810]
ret
movzx eax, byte [0x14052b561]
nop word cs:[rax + rax]
cmp al, 0xa4
je 0x14016a020
movzx ecx, byte [0x14052badc]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0x85
mov eax, r8d
and al, 0x7a
or al, r9b
mov r9d, ecx
xor r9b, cl
not r9b
and r9b, al
xor r9b, cl
and al, cl
add al, al
add al, r9b
add dl, cl
lock cmpxchg byte [0x14052b561], dl
jne 0x140169f50
xor eax, eax
lea rcx, [0x14052b550]
lea rdx, [0x14044f210]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x14016a018
inc rax
jmp 0x140169fb0
movzx eax, byte [0x14052b61d]
cmp al, 0x38
je 0x14016a000
mov cl, 0xd2
nop word cs:[rax + rax]
mov al, 0x42
lock cmpxchg byte [0x14052b61d], cl
je 0x14016a07f
mov edx, r8d
xor dl, 0xa5
add dl, byte [0x14052badc]
cmp al, dl
jne 0x140169fe0
lea rax, [0x14052b610]
ret
mov al, 0x3e
xchg byte [0x14052b78d], al
lea rax, [0x14052b780]
ret
mov al, 0xa4
xchg byte [0x14052b561], al
lea rax, [0x14052b550]
ret
xor edx, edx
lea rax, [0x14052b810]
lea rcx, [0x14044f4d0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x11
jl 0x14016a040
mov al, 0x1c
xchg byte [0x14052b821], al
lea rax, [0x14052b810]
ret
xor eax, eax
lea rcx, [0x14052b610]
lea rdx, [0x14044f2d0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14016a0a8
inc rax
jmp 0x14016a090
mov al, 0x38
xchg byte [0x14052b61d], al
lea rax, [0x14052b610]
ret