joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14034bcf0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14034bd28
movzx eax, byte [0x1405560e2]
cmp al, 0x80
je 0x14034bd20
mov cl, 0x8d
nop word cs:[rax + rax]
mov al, 0xd9
lock cmpxchg byte [0x1405560e2], cl
je 0x14034bd6c
cmp al, 0x80
jne 0x14034bd10
lea rax, [0x1405560d0]
ret
test edx, edx
je 0x14034bdc8
movzx eax, byte [0x140556080]
mov ecx, r8d
xor cl, 0x67
add cl, byte [0x14055649c]
cmp al, cl
je 0x14034bd64
mov cl, 0xbc
nop dword [rax]
mov al, pe_nt_image_headers64
lock cmpxchg byte [0x140556080], cl
je 0x14034be04
cmp al, 0x5a
jne 0x14034bd50
lea rax, [0x140556040]
ret
xor edx, edx
lea rax, [0x1405560d0]
lea rcx, [0x14045c500]
xor r8d, 0x36acd715
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, dword [0x140556498]
add r9d, r8d
mov r10d, edx
xor r10d, r9d
and r9d, edx
lea edx, [r10 + r9*2]
cmp edx, 0x12
jl 0x14034bd90
mov al, 0x80
xchg byte [0x1405560e2], al
lea rax, [0x1405560d0]
ret
movzx eax, byte [0x140556149]
cmp al, 0xf0
je 0x14034bdfc
mov cl, 0xad
nop word cs:[rax + rax]
mov al, 0xb0
lock cmpxchg byte [0x140556149], cl
je 0x14034be60
mov edx, r8d
xor dl, 0xf1
add dl, byte [0x14055649c]
cmp al, dl
jne 0x14034bde0
lea rax, [0x140556140]
ret
xor eax, eax
lea rcx, [0x140556040]
lea rdx, [0x14045c490]
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0x3f
jg 0x14034be38
inc rax
jmp 0x14034be20
movzx eax, byte [0x14055649c]
xor r8b, 0x67
mov ecx, r8d
xor cl, al
and r8b, al
add r8b, r8b
add r8b, cl
xchg byte [0x140556080], r8b
lea rax, [0x140556040]
ret
xor eax, eax
lea rcx, [0x140556140]
lea rdx, [0x14045c570]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x14034be88
inc rax
jmp 0x14034be70
mov al, 0xf0
xchg byte [0x140556149], al
lea rax, [0x140556140]
ret
Function at 0x14034d9d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
cmp byte [rcx + 0xb0], 0
je 0x14034da1b
mov eax, 0x33ed
add eax, dword [0x140556c48]
lea rcx, [rsi + 0xb8]
cdqe
add rax, qword [0x140556c50]
call qword [case.0x14013cbc3.0]
mov byte [rsi + 0xb0], 0
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x14034da81
mov rax, qword [rcx - 8]
mov r8, qword [0x140556ae0]
movabs r9, 0xc35ea9e1666fd7a8
xor r9, r8
movabs r10, 0x435ea9e1666fd7a8
and r10, r8
lea r9, [r9 + r10*2]
add r9, rcx
sub r9, rax
movabs rcx, 0xc35ea9e1666fd7d0
add rcx, r8
cmp r9, rcx
jae 0x14034db98
add rdx, 0x27
mov rcx, rax
lea rdi, [rsi + 0x88]
mov ebx, 0x33ed
mov eax, dword [0x140556c44]
add eax, ebx
cdqe
add rax, qword [0x140556c58]
call qword [case.0x14013cbc3.0]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov rax, qword [rsi + 0x78]
mov rcx, qword [rax + 8]
mov qword [rcx], 0
mov rdi, qword [rax]
test rdi, rdi
je 0x14034db1e
nop dword [rax]
mov r14, qword [rdi]
lea rcx, [rdi + 0x18]
mov eax, dword [0x140556c40]
add eax, ebx
cdqe
add rax, qword [0x140556c60]
call qword [case.0x14013cbc3.0]
mov eax, dword [0x140556c44]
sub eax, dword [0x140556ad0]
add eax, 0x28f6f2d5
cdqe
add rax, qword [0x140556c58]
mov edx, 0x30
mov rcx, rdi
call qword [case.0x14013cbc3.0]
mov rdi, r14
test r14, r14
jne 0x14034dad0
add ebx, dword [0x140556c44]
mov rcx, qword [rsi + 0x78]
movsxd rax, ebx
add rax, qword [0x140556c58]
mov edx, 0x30
call qword [case.0x14013cbc3.0]
cmp byte [rsi + 0x63], 0
je 0x14034db4f
movzx eax, byte [0x140556ad4]
add al, 0xe5
mov byte [rsi + 0x63], al
cmp byte [rsi + 0x49], 0
je 0x14034db59
mov byte [rsi + 0x49], 0
cmp byte [rsi + 0x37], 0
je 0x14034db6b
movzx eax, byte [0x140556ad4]
add al, 0xe5
mov byte [rsi + 0x37], al
cmp byte [rsi + 0x1b], 0
je 0x14034db7d
movzx eax, byte [0x140556ad4]
add al, 0xe5
mov byte [rsi + 0x1b], al
movzx eax, byte [0x140556ad4]
add al, 0xe5
cmp byte [rsi], al
je 0x14034db8d
mov byte [rsi], 0
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call fcn.1403d599c
int3
Function at 0x14035c830
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ebp, dword [rsp + 0x78]
mov ecx, dword [0x140578688]
lea eax, [rcx - 1]
imul eax, ecx
mov ecx, ebp
xor ecx, 0xd1000eb2
add ecx, dword [0x140557aac]
xor edx, edx
div ecx
test edx, edx
jne 0x14035c882
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.14041df80
mov ecx, dword [0x14057868c]
cmp ecx, 0x2c
jl 0x14035c8d0
mov r14d, ebp
xor r14d, 0xd1000e8c
nop dword [rax]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.14041df80
mov eax, dword [0x140578688]
mov ecx, eax
not ecx
imul ecx, eax
and ecx, 1
mov eax, dword [0x140557aac]
mov edx, ebp
xor edx, r14d
xor edx, 0x2efff173
and edx, eax
xor edx, r14d
and eax, r14d
lea eax, [rdx + rax*2]
cmp ecx, eax
jne 0x14035c890
jmp 0x14035c869
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x14035c980
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov edi, r9d
mov esi, r8d
test ecx, ecx
je 0x14035c9ee
movzx eax, byte [0x140557160]
mov ecx, edi
xor cl, 0x8b
add cl, byte [0x140557aa8]
cmp al, cl
je 0x14035caa1
mov bl, 0x5f
mov ebp, edi
xor ebp, 0xb2ea33c1
nop word cs:[rax + rax]
mov al, 0x26
lock cmpxchg byte [0x140557160], bl
je 0x14035ca19
mov ecx, dword [0x140557aac]
add ecx, ebp
mov edx, ecx
xor edx, ecx
not edx
and edx, esi
xor edx, ecx
mov ecx, eax
call fcn.14035c7d0
test al, 1
je 0x14035c9c0
jmp 0x14035caa1
movzx eax, byte [0x1405571a2]
cmp al, 0x46
je 0x14035caed
mov cl, 0x37
nop
mov al, 0x22
lock cmpxchg byte [0x1405571a2], cl
je 0x14035caaa
cmp al, 0x46
jne 0x14035ca00
jmp 0x14035caed
xor eax, eax
lea rcx, [0x140557150]
lea rdx, [0x14045ca50]
mov r9d, edi
not r9d
mov r10d, r9d
and r10d, 0xebe55cff
mov r8d, edi
and r8d, 0x141aa300
or r8d, r10d
and r9d, 0xebe55cce
and edi, 0x141aa331
or edi, r9d
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
mov r9d, dword [0x140557aac]
add eax, r8d
add eax, r9d
add r9d, edi
cmp eax, r9d
jl 0x14035ca60
xor esi, 0xdef1c3e8
mov ecx, esi
call fcn.14035c7c0
lea rax, [0x140557150]
jmp 0x14035caf4
xor eax, eax
lea rcx, [0x140557190]
lea rdx, [0x14045ca80]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x14035cad8
inc rax
jmp 0x14035cac0
xor edi, 0x37bc2cca
add edi, dword [0x140557aac]
xor esi, edi
mov ecx, esi
call fcn.14035c7b0
lea rax, [0x140557190]
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140360170
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1403601ac
test edx, edx
je 0x140360230
movzx eax, byte [0x140557f1a]
cmp al, 3
je 0x1403601a4
mov cl, 0x8d
nop
mov al, 0x8e
lock cmpxchg byte [0x140557f1a], cl
je 0x14036029c
cmp al, 3
jne 0x140360190
lea rax, [0x140557f10]
ret
test edx, edx
je 0x14036026c
movzx eax, byte [0x140557ed2]
nop dword [rax + rax]
cmp al, 0x74
je 0x1403602ff
movzx ecx, byte [0x140558090]
mov eax, r8d
xor al, 0x12
add al, cl
mov edx, r8d
xor dl, 0x77
add dl, cl
lock cmpxchg byte [0x140557ed2], dl
jne 0x1403601c0
xor eax, eax
lea rcx, [0x140557ec0]
lea rdx, [0x14045ccd0]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x1403602f7
inc rax
jmp 0x140360200
movzx eax, byte [0x140557ef1]
mov ecx, r8d
xor cl, 0xa
add cl, byte [0x140558090]
cmp al, cl
je 0x140360264
mov cl, 0x73
nop dword [rax]
mov al, 0x69
lock cmpxchg byte [0x140557ef1], cl
je 0x140360307
cmp al, 0x8b
jne 0x140360250
lea rax, [0x140557ee0]
ret
movzx eax, byte [0x140557fed]
cmp al, 0x2f
je 0x140360294
mov cl, 0x80
nop dword [rax]
mov al, 0xe3
lock cmpxchg byte [0x140557fed], cl
je 0x140360360
cmp al, 0x2f
jne 0x140360280
lea rax, [0x140557fe0]
ret
xor edx, edx
lea rax, [0x140557f10]
lea rcx, [0x14045cd20]
nop dword [rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
cmp edx, 0xa
jl 0x1403602b0
movzx eax, byte [0x140558090]
xor r8b, 0x72
mov ecx, r8d
xor cl, al
and r8b, al
add r8b, r8b
add r8b, cl
xchg byte [0x140557f1a], r8b
lea rax, [0x140557f10]
ret
mov al, 0x74
xchg byte [0x140557ed2], al
lea rax, [0x140557ec0]
ret
xor eax, eax
lea rcx, [0x140557ee0]
lea rdx, [0x14045ccf0]
mov r9d, r8d
xor r9d, 0xbfc52e4c
xor r8d, 0xbfc52e5c
nop dword [rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
mov r10d, dword [0x140558080]
add eax, r9d
add eax, r10d
add r10d, r8d
cmp eax, r10d
jl 0x140360330
mov al, 0x8b
xchg byte [0x140557ef1], al
lea rax, [0x140557ee0]
ret
xor eax, eax
lea rcx, [0x140557fe0]
lea rdx, [0x14045cde0]
xor r8d, 0xbfc52e4c
nop word [rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
mov r9d, dword [0x140558080]
add r9d, r8d
add eax, r9d
cmp eax, 0xd
jl 0x140360380
mov al, 0x2f
xchg byte [0x140557fed], al
lea rax, [0x140557fe0]
ret

Function at 0x140361760
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x18], rdx
call fcn.140375560
test rax, rax
sete cl
cmp byte [0x140575adc], 0
jne 0x1403617a7
movzx edx, byte [0x1405759f0]
mov r8d, edx
and r8b, cl
jne 0x1403617a7
xor dl, cl
jne 0x1403617a7
add rsp, 0x40
pop rbp
ret
mov ecx, 0x7f
call fcn.14019a030
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
mov r8d, 0x708ee5c7
add rsp, 0x40
pop rbp
jmp fcn.1403618b0
Function at 0x140361800
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov r8d, 0x708ee5c7
jmp fcn.1403618b0

Function at 0x140367670
Capabilities:
Check for software breakpoints

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1403676bc
mov eax, r8d
xor eax, 0x6526c3cd
add eax, dword [0x14055a368]
cmp edx, eax
jne 0x1403676f8
movzx eax, byte [0x140559e3d]
cmp al, 0xcc
je 0x1403676b4
mov cl, 0x27
nop dword [rax + rax]
mov al, 0xeb
lock cmpxchg byte [0x140559e3d], cl
je 0x14036777c
cmp al, 0xcc
jne 0x1403676a0
lea rax, [0x140559e30]
ret
test edx, edx
je 0x14036772c
movzx eax, byte [0x140559d93]
cmp al, 0xb4
je 0x1403676f0
mov cl, 0x9a
nop dword [rax]
mov al, 8
lock cmpxchg byte [0x140559d93], cl
je 0x140367811
mov edx, r8d
xor dl, 0xb4
add dl, byte [0x14055a358]
cmp al, dl
jne 0x1403676d0
lea rax, [0x140559d90]
ret
movzx eax, byte [0x140559e1d]
cmp al, 0x69
je 0x140367724
mov cl, 0x21
nop word cs:[rax + rax]
mov al, 0xa9
lock cmpxchg byte [0x140559e1d], cl
je 0x1403677bf
cmp al, 0x69
jne 0x140367710
lea rax, [0x140559e10]
ret
movzx eax, byte [0x140559d12]
cmp al, 0x62
je 0x140367774
nop word [rax + rax]
movzx ecx, byte [0x14055a358]
mov eax, r8d
xor al, 0xb0
add al, cl
mov edx, r8d
xor dl, 0xaf
add dl, cl
lock cmpxchg byte [0x140559d12], dl
je 0x140367862
mov ecx, r8d
xor cl, 0xe6
add cl, byte [0x14055a358]
cmp al, cl
jne 0x140367740
lea rax, [0x140559d10]
ret
xor eax, eax
lea rcx, [0x140559e30]
lea rdx, [0x14045d320]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r8b
not r9b
mov r10d, r8d
xor r10b, r9b
or r9b, r8b
and r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1403677e8
inc rax
jmp 0x140367790
xor eax, eax
lea rcx, [0x140559e10]
lea rdx, [0x14045d300]
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xc
jg 0x1403677f8
inc rax
jmp 0x1403677d0
mov al, 0xcc
xchg byte [0x140559e3d], al
lea rax, [0x140559e30]
ret
not r8b
add r8b, byte [0x14055a358]
xchg byte [0x140559e1d], r8b
lea rax, [0x140559e10]
ret
xor eax, eax
lea rcx, [0x140559d90]
lea rdx, [0x14045d280]
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 2
jg 0x140367848
inc rax
jmp 0x140367830
xor r8b, 0xb4
add r8b, byte [0x14055a358]
xchg byte [0x140559d93], r8b
lea rax, [0x140559d90]
ret
xor eax, eax
lea rcx, [0x140559d10]
lea rdx, [0x14045d210]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x140367898
inc rax
jmp 0x140367880
mov al, 0x62
xchg byte [0x140559d12], al
lea rax, [0x140559d10]
ret
Function at 0x14036c740
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, dword [0x140575a3c]
mov ecx, dword [0x140578a68]
lea eax, [rcx - 1]
imul eax, ecx
mov ecx, 0x4fada2cb
add ecx, dword [0x14055af78]
xor edx, edx
div ecx
test edx, edx
jne 0x14036c7d1
mov eax, dword [0x14055a9d0]
add eax, esi
add eax, 0xffff2ad9
cdqe
add rax, qword [0x14055a9e0]
mov r8d, dword [0x14055af78]
lea ecx, [r8 + 0x4fada2ca]
mov edx, r8d
xor edx, 0x7edd7937
mov r9d, r8d
and r9d, 0x7edd7937
lea edx, [rdx + r9*2]
add r8d, 0x5e7416bf
call qword [case.0x14013cbc3.0]
mov ecx, dword [0x140578a68]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
mov ecx, 0x4fada2c9
add ecx, dword [0x14055af78]
cmp edx, ecx
je 0x14036c815
mov bl, 1
nop word cs:[rax + rax]
mov eax, dword [0x14055a9d0]
xor eax, esi
add eax, 0xffff2ad9
cdqe
add rax, qword [0x14055a9e0]
mov ecx, 1
mov edx, 0x2f2fd66e
mov r8d, 0xec673f6
call qword [case.0x14013cbc3.0]
test bl, bl
je 0x14036c7e0
jmp 0x14036c76b
test rax, rax
je 0x14036c820
mov rax, qword [rax + 0x48]
jmp 0x14036c822
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x140373b20
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
test rcx, rcx
sete r8b
test rdx, rdx
setne r9b
xor eax, eax
cmp r9b, r8b
je 0x140373cb2
test rdx, rdx
je 0x140373cb2
mov al, 1
cmp rcx, rdx
je 0x140373cb2
xor r8d, r8d
xor r9d, r9d
nop word [rax + rax]
mov r10, r8
movzx r11d, byte [0x14055bd54]
add r11b, 0x14
xor r8d, r8d
cmp byte [rcx + r10], 0
setne r8b
movzx esi, r9b
movzx r9d, r11b
cmovne r9d, esi
add r8, r10
mov r10d, r9d
xor r10b, 0xfe
test r10b, r9b
je 0x140373b60
xor r9d, r9d
xor r10d, r10d
jmp 0x140373bcf
mov r10d, 1
mov r11b, bl
mov rsi, r11
xor rsi, r9
and r11d, r9d
lea r9, [rsi + r11*2]
mov r11d, r10d
not r11b
mov ebx, r10d
xor bl, 1
and r11b, 0xfe
or r11b, bl
cmp r11b, 0xff
jne 0x140373be2
xor r11d, r11d
cmp byte [rdx + r9], 0
setne bl
je 0x140373ba0
movzx r10d, r10b
jmp 0x140373ba6
cmp r8, r9
jne 0x140373cb0
movabs r9, 0x9bd69c558f64fc
add r9, qword [0x14055bd58]
cmp r8, r9
je 0x140373cb2
xor r9d, r9d
xor r10d, r10d
jmp 0x140373c54
movzx ebx, byte [0x14055bd54]
add bl, 0x14
cmp sil, 0x2e
movzx r10d, r10b
movzx esi, bl
cmove r10d, esi
cmp r11b, 0x2e
cmove r10d, esi
inc r9d
mov r11d, dword [0x1405769e4]
mov esi, r11d
xor esi, r9d
and r9d, r11d
lea r9d, [rsi + r9*2]
add r9d, dword [0x1405766c0]
cmp r8, r9
jbe 0x140373cb2
movzx r11d, byte [rcx + r9]
movzx esi, byte [rdx + r9]
cmp r11b, sil
je 0x140373c10
mov ebx, r10d
xor bl, 0xfe
test bl, r10b
jne 0x140373cb0
lea edi, [r11 - 0x61]
movzx ebx, byte [0x14055bd54]
lea ebp, [r11 + rbx]
add bl, 0x2d
add bpl, 0xf3
cmp dil, bl
movzx edi, bpl
movzx r11d, r11b
cmovb r11d, edi
lea edi, [rsi - 0x61]
lea ebx, [rsi - 0x20]
cmp dil, 0x1a
movzx edi, sil
movzx esi, bl
cmovae esi, edi
cmp r11b, sil
je 0x140373c10
xor eax, eax
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x140373cc0
Capabilities:
Encode data using xor

Disassembly:
test rcx, rcx
je 0x140373d2d
movabs rdx, 0xa6e8e51fc66d807f
xor r9d, r9d
xor r8d, r8d
nop word cs:[rax + rax]
movzx r10d, byte [0x14055bd54]
lea r11d, [r10 + 0x13]
add r10b, 0x14
xor eax, eax
cmp byte [rcx + r9], r11b
lea r9, [r9 + rdx]
setne al
movzx r11d, r8b
movzx r8d, r10b
cmovne r8d, r11d
add rax, r9
sub rax, rdx
mov r10d, r8d
not r10b
mov r9d, r8d
xor r9b, 1
and r10b, 0xfe
or r10b, r9b
mov r9, rax
cmp r10b, 0xff
je 0x140373ce0
ret
xor eax, eax
ret
Function at 0x14037e1d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov esi, r9d
mov edi, r8d
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x1405650e0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, dword [0x140578db8]
cmp eax, 0x11
jg 0x14037e232
mov dword [rsp + 0x20], 0xbc69db62
xor ecx, ecx
mov edx, 1
mov r8d, 0x20ca3a3a
mov r9d, 0x6e6d786
call fcn.14037ebc0
mov r15, rax
mov eax, dword [0x140578db8]
cmp eax, 0x30
jl 0x14037e288
mov bpl, 1
nop word cs:[rax + rax]
mov eax, dword [0x14055cc58]
lea ecx, [rax + 0x19d48691]
mov edx, eax
xor edx, 0x19d48692
mov r8d, eax
and r8d, 0x19d48692
lea edx, [rdx + r8*2]
lea r8d, [rax + 0x3a9ec0cb]
lea r9d, [rax + 0x20bb5e17]
add eax, 0xd63e61f3
mov dword [rsp + 0x20], eax
call fcn.14037ebc0
test bpl, bpl
je 0x14037e240
jmp 0x14037e204
test r15, r15
je 0x14037e29a
mov eax, dword [0x140578db8]
cmp eax, 0x4b
jle 0x14037e2a2
jmp 0x14037e2fc
xor r12d, r12d
jmp 0x14037e330
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
xor r12d, r12d
lea rdx, [rsp + 0x40]
lea r9, [rsp + 0x38]
mov rcx, 0xffffffffffffffff
xor r8d, r8d
mov rax, r15
call qword [case.0x14013cbc3.0]
test eax, eax
jne 0x14037e2dd
mov r12, qword [rsp + 0x40]
mov ecx, dword [0x140578db4]
lea eax, [rcx - 1]
imul eax, ecx
mov ecx, 0x19d48693
add ecx, dword [0x14055cc58]
xor edx, edx
div ecx
test edx, edx
je 0x14037e330
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
lea rdx, [rsp + 0x40]
lea r9, [rsp + 0x38]
mov rcx, 0xffffffffffffffff
xor r8d, r8d
mov rax, r15
call qword [case.0x14013cbc3.0]
jmp 0x14037e2a2
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1403f5480
mov rax, r12
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1403875d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x240
mov rax, qword [0x1405650e0]
xor rax, rsp
mov qword [rsp + 0x238], rax
mov eax, dword [0x140578dc0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x140387640
mov rax, qword [0x140578ce0]
mov ecx, dword [0x140578dc0]
mov edx, dword [0x14055dbe0]
lea r8d, [rdx + rcx]
add r8d, 0xaa755a0c
imul r8d, ecx
and r8d, 1
mov ecx, edx
xor ecx, 0x6d25dd05
and edx, 0x6d25dd05
lea ecx, [rcx + rdx*2]
cmp r8d, ecx
je 0x140387683
nop word [rax + rax]
mov rax, qword [0x140578ce0]
mov ecx, dword [0x140578dc0]
mov edx, dword [0x14055dbe0]
mov eax, ecx
sub eax, edx
add eax, 0x92da22fa
imul eax, ecx
mov ecx, edx
xor ecx, 0xf8ac3b6e
and edx, 0x78ac3b6e
lea ecx, [rcx + rdx*2]
add ecx, 0x7479a199
xor edx, edx
div ecx
test edx, edx
jne 0x140387640
jmp 0x1403875fb
test rax, rax
je 0x1403876da
mov rax, qword [0x14055dbd8]
movabs rcx, 0x45421315d38bb5a8
sub rax, rcx
add rax, qword [0x14055b520]
movabs rdx, 0xe0dd605da3910827
add rdx, rcx
add rdx, rax
mov qword [0x14055b520], rdx
mov rsi, qword [0x140578ce0]
mov eax, esi
not eax
and eax, 0x11223344
and rsi, 0xffffffffeeddccbb
or rsi, rax
jne 0x1403877cb
movaps xmm0, xmmword [0x14045ea30]
movaps xmmword [rsp + 0x30], xmm0
movabs rax, 0x1804242b697f3d33
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov edx, 6
mov r8d, 0x6ae24a62
mov r9d, 0xfe87439d
call fcn.14036c270
mov qword [rsp + 0x28], 0
lea rdx, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xc1b73ff8
mov r9d, 0x4a50c9b3
call fcn.140388ea0
mov rsi, rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
test rax, rax
je 0x1403877ae
mov rax, qword [0x140578ce0]
test rax, rax
jne 0x1403877ae
xor eax, eax
test al, al
jne 0x140387793
mov qword [0x140578ce0], rsi
xor qword [0x140578ce0], 0x11223344
mov eax, dword [0x140578dc0]
mov ecx, dword [0x14055dbe0]
add ecx, eax
add ecx, 0x92da22fa
imul ecx, eax
test cl, 1
je 0x1403877ae
mov qword [0x140578ce0], rsi
mov rax, qword [0x140578ce0]
mov qword [0x140578ce0], 0
jmp 0x140387765
xor eax, eax
test al, al
nop word cs:[rax + rax]
mov eax, dword [0x140578dc4]
cmp eax, 0x16
jg 0x1403877c0
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.1403f5480
mov rax, rsi
add rsp, 0x240
pop rsi
ret
Function at 0x1403903e0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14039041c
test edx, edx
je 0x140390466
movzx eax, byte [0x14055e69d]
cmp al, 0x47
je 0x140390414
mov cl, 0x63
nop word cs:[rax + rax]
mov al, 0xb1
lock cmpxchg byte [0x14055e69d], cl
je 0x1403904d1
cmp al, 0x47
jne 0x140390400
lea rax, [0x14055e690]
ret
movzx eax, byte [0x14055e687]
movzx ecx, byte [0x14055e728]
add cl, 0xaa
cmp al, cl
je 0x14039045e
mov cl, 0x33
nop word cs:[rax + rax]
mov al, 0x2d
lock cmpxchg byte [0x14055e687], cl
je 0x14039051f
movzx edx, byte [0x14055e728]
add dl, 0xaa
cmp al, dl
jne 0x140390440
lea rax, [0x14055e670]
ret
movzx eax, byte [0x14055e66d]
nop dword [rax]
cmp al, 0x7d
je 0x1403904c9
movzx ecx, byte [0x14055e728]
lea eax, [rcx + 0x51]
add cl, 0xd5
lock cmpxchg byte [0x14055e66d], cl
jne 0x140390470
xor edx, edx
lea rax, [0x14055e660]
lea rcx, [0x14045f800]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x14055e718]
add edx, r8d
add edx, 0x27bd685c
cmp edx, 0xd
jl 0x1403904a0
mov al, 0x7d
xchg byte [0x14055e66d], al
lea rax, [0x14055e660]
ret
xor edx, edx
lea rax, [0x14055e690]
lea rcx, [0x14045f830]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x1403904f0
mov al, 0x47
xchg byte [0x14055e69d], al
lea rax, [0x14055e690]
ret
xor eax, eax
lea rcx, [0x14055e670]
lea rdx, [0x14045f810]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x16
jg 0x140390548
inc rax
jmp 0x140390530
mov al, 0x21
xchg byte [0x14055e687], al
lea rax, [0x14055e670]
ret