joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140183d60
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140183da5
test edx, edx
je 0x140183ddc
movzx eax, byte [0x14054e725]
cmp al, 0x5d
je 0x140183d9d
mov cl, 0x2f
nop word cs:[rax + rax]
mov al, 0x6d
lock cmpxchg byte [0x14054e725], cl
je 0x140183e45
movzx edx, byte [0x14054f4cc]
dec dl
cmp al, dl
jne 0x140183d80
lea rax, [0x14054e710]
ret
test edx, edx
je 0x140183e0c
movzx eax, byte [0x14054e893]
cmp al, 0xe0
je 0x140183dd4
mov cl, 0x9f
nop word cs:[rax + rax]
mov al, 0xb1
lock cmpxchg byte [0x14054e893], cl
je 0x140183ea2
cmp al, 0xe0
jne 0x140183dc0
lea rax, [0x14054e890]
ret
movzx eax, byte [0x1405b37e8]
cmp al, 0x13
je 0x140183e04
mov cl, 0x69
nop dword [rax]
xor eax, eax
lock cmpxchg byte [0x1405b37e8], cl
je 0x140183edc
cmp al, 0x13
jne 0x140183df0
lea rax, [0x14054e650]
ret
movzx eax, byte [0x14054e815]
cmp al, 0x5d
je 0x140183e3d
mov cl, 0xe5
nop dword [rax]
mov al, 0xcb
lock cmpxchg byte [0x14054e815], cl
je 0x140183f7a
movzx edx, byte [0x14054f4cc]
dec dl
cmp al, dl
jne 0x140183e20
lea rax, [0x14054e800]
ret
xor edx, edx
lea rax, [0x14054e710]
lea rcx, [0x14046ff50]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0xe1aac3d0
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x1e553c30
cmp edx, 0x15
jl 0x140183e60
movzx eax, byte [0x14054f4cc]
dec al
xchg byte [0x14054e725], al
lea rax, [0x14054e710]
ret
xor eax, eax
lea rcx, [0x14054e890]
lea rdx, [0x1404700b0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x140183f6a
inc rax
jmp 0x140183ec0
xor edx, edx
lea rax, [0x14054e650]
lea rcx, [0x14046fe90]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
add r8b, 0xdf
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
add r8b, 0x21
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0xbf02c526
and edx, 0x3f02c526
lea edx, [r8 + rdx*2]
add edx, 0x40fd3adb
mov r8d, dword [0x14054f4c8]
mov r9d, r8d
xor r9d, 0x3c0d3006
and r8d, 0x3c0d3006
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x140183ef0
movzx eax, byte [0x14054f4cc]
add al, 0xb5
xchg byte [0x1405b37e8], al
lea rax, [0x14054e650]
ret
mov al, pe_nt_image_headers64
xchg byte [0x14054e893], al
lea rax, [0x14054e890]
ret
xor eax, eax
lea rcx, [0x14054e800]
lea rdx, [0x140470030]
nop word [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r9b
mov r10d, r9d
or r10b, r8b
not r10b
and r9b, r8b
or r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140183fbf
inc rax
jmp 0x140183f90
mov al, 0x5d
xchg byte [0x14054e815], al
lea rax, [0x14054e800]
ret
Function at 0x140189c30
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140189c6c
mov ecx, dword [rsp + 0x28]
test edx, edx
je 0x140189c9c
movzx eax, byte [0x14054f95e]
cmp al, 0xb7
je 0x140189c64
mov dl, 0x82
nop dword [rax]
mov al, 0xf5
lock cmpxchg byte [0x14054f95e], dl
je 0x140189cfc
cmp al, 0xb7
jne 0x140189c50
lea rax, [0x14054f950]
ret
test edx, edx
je 0x140189ccc
movzx eax, byte [0x14054f8dd]
cmp al, 0x79
je 0x140189c94
mov cl, 0x3c
nop dword [rax]
mov al, 0x55
lock cmpxchg byte [0x14054f8dd], cl
je 0x140189d6b
cmp al, 0x79
jne 0x140189c80
lea rax, [0x14054f8d0]
ret
movzx eax, byte [0x14054fa52]
cmp al, 0x2d
je 0x140189cc4
mov dl, 0xd8
nop dword [rax]
mov al, 0x56
lock cmpxchg byte [0x14054fa52], dl
je 0x140189d98
cmp al, 0x2d
jne 0x140189cb0
lea rax, [0x14054fa40]
ret
movzx eax, byte [0x14054f85d]
cmp al, 0x41
je 0x140189cf4
mov cl, 0x45
nop dword [rax]
mov al, 0x84
lock cmpxchg byte [0x14054f85d], cl
je 0x140189e0f
cmp al, 0x41
jne 0x140189ce0
lea rax, [0x14054f850]
ret
xor eax, eax
lea rdx, [0x14054f950]
lea r8, [0x140470560]
xor ecx, 0x59246775
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
movzx r10d, byte [rax + r8]
not r9b
mov r11d, r9d
and r11b, r10b
not r10b
xor r9b, r10b
and r9b, r10b
or r9b, r11b
mov byte [rax + rdx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14054fd38]
add r10d, ecx
cmp r9d, r10d
jge 0x140189d5b
inc rax
jmp 0x140189d20
mov al, 0xb7
xchg byte [0x14054f95e], al
lea rax, [0x14054f950]
ret
xor eax, eax
lea rcx, [0x14054f8d0]
lea rdx, [0x1404704e0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140189dff
inc rax
jmp 0x140189d80
xor r8d, r8d
lea rax, [0x14054fa40]
lea rdx, [0x140470650]
xor ecx, 0x59246766
nop
movsxd r8, r8d
movzx r9d, byte [r8 + rdx]
xor byte [r8 + rax], r9b
mov r9d, dword [0x14054fd38]
mov r10d, ecx
xor r10d, r9d
and r9d, ecx
lea r9d, [r10 + r9*2]
mov r10d, r8d
xor r10d, r9d
not r8d
not r9d
and r9d, r8d
or r9d, r10d
not r9d
lea r8d, [r10 + r9*2]
cmp r8d, 0x12
jl 0x140189db0
mov al, 0x2d
xchg byte [0x14054fa52], al
lea rax, [0x14054fa40]
ret
mov al, 0x79
xchg byte [0x14054f8dd], al
lea rax, [0x14054f8d0]
ret
xor eax, eax
lea rcx, [0x14054f850]
lea rdx, [0x140470460]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140189e38
inc rax
jmp 0x140189e20
mov al, 0x41
xchg byte [0x14054f85d], al
lea rax, [0x14054f850]
ret
Function at 0x140189e70
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x140189f0c
mov eax, r8d
xor eax, 0x7f11aaa
add eax, dword [0x14054fd38]
cmp edx, eax
jne 0x140189f4c
movzx eax, byte [0x14054f9ed]
nop word [rax + rax]
cmp al, 0x3e
je 0x14018a020
movzx ecx, byte [0x14054fd3c]
mov eax, r8d
xor al, 0x67
add al, cl
mov edx, r8d
xor dl, 0x49
add dl, cl
lock cmpxchg byte [0x14054f9ed], dl
jne 0x140189ea0
xor eax, eax
lea rcx, [0x14054f9e0]
lea rdx, [0x1404705f0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14018a018
inc rax
jmp 0x140189ee0
test edx, edx
je 0x140189fd8
movzx eax, byte [0x14054fa81]
cmp al, 0x1c
je 0x140189f44
mov cl, 0x73
nop word cs:[rax + rax]
mov al, 0xbf
lock cmpxchg byte [0x14054fa81], cl
je 0x14018a038
cmp al, 0x1c
jne 0x140189f30
lea rax, [0x14054fa70]
ret
movzx eax, byte [0x14054f7c1]
nop word cs:[rax + rax]
cmp al, 0xa4
je 0x14018a030
movzx ecx, byte [0x14054fd3c]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0x85
mov eax, r8d
and al, 0x7a
or al, r9b
mov r9d, ecx
xor r9b, cl
not r9b
and r9b, al
xor r9b, cl
and al, cl
add al, al
add al, r9b
add dl, cl
lock cmpxchg byte [0x14054f7c1], dl
jne 0x140189f60
xor eax, eax
lea rcx, [0x14054f7b0]
lea rdx, [0x1404703c0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x14018a028
inc rax
jmp 0x140189fc0
movzx eax, byte [0x14054f87d]
cmp al, 0x38
je 0x14018a010
mov cl, 0xd2
nop word cs:[rax + rax]
mov al, 0x42
lock cmpxchg byte [0x14054f87d], cl
je 0x14018a08f
mov edx, r8d
xor dl, 0xa5
add dl, byte [0x14054fd3c]
cmp al, dl
jne 0x140189ff0
lea rax, [0x14054f870]
ret
mov al, 0x3e
xchg byte [0x14054f9ed], al
lea rax, [0x14054f9e0]
ret
mov al, 0xa4
xchg byte [0x14054f7c1], al
lea rax, [0x14054f7b0]
ret
xor edx, edx
lea rax, [0x14054fa70]
lea rcx, [0x140470680]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x11
jl 0x14018a050
mov al, 0x1c
xchg byte [0x14054fa81], al
lea rax, [0x14054fa70]
ret
xor eax, eax
lea rcx, [0x14054f870]
lea rdx, [0x140470480]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14018a0b8
inc rax
jmp 0x14018a0a0
mov al, 0x38
xchg byte [0x14054f87d], al
lea rax, [0x14054f870]
ret
Function at 0x14018a0d0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14018a128
mov eax, r8d
xor eax, 0xad0d3cda
add eax, dword [0x14054fd38]
cmp edx, eax
jne 0x14018a180
movzx eax, byte [0x14054f9a3]
cmp al, 0x13
je 0x14018a120
mov cl, 0x87
nop dword [rax]
mov al, 0xef
lock cmpxchg byte [0x14054f9a3], cl
je 0x14018a222
mov edx, r8d
xor dl, 0xf0
add dl, byte [0x14054fd3c]
cmp al, dl
jne 0x14018a100
lea rax, [0x14054f990]
ret
test edx, edx
je 0x14018a1a8
movzx eax, byte [0x14054f775]
mov ecx, r8d
xor cl, 0xd3
add cl, byte [0x14054fd3c]
cmp al, cl
je 0x14018a178
nop word cs:[rax + rax]
movzx ecx, byte [0x14054fd3c]
mov eax, r8d
xor al, 0xf7
add al, cl
mov edx, r8d
xor dl, 0x8b
add dl, cl
lock cmpxchg byte [0x14054f775], dl
je 0x14018a27f
cmp al, 0x36
jne 0x14018a150
lea rax, [0x14054f760]
ret
cmp byte [0x14054f8ff], 0
je 0x14018a1a0
mov cl, 0x99
nop dword [rax + rax]
mov al, 0xde
lock cmpxchg byte [0x14054f8ff], cl
je 0x14018a1dc
test al, al
jne 0x14018a190
lea rax, [0x14054f8e0]
ret
movzx eax, byte [0x14054fa6d]
cmp al, 0x48
je 0x14018a1d4
mov cl, 0x2c
nop word cs:[rax + rax]
mov al, 0xa3
lock cmpxchg byte [0x14054fa6d], cl
je 0x14018a2cd
cmp al, 0x48
jne 0x14018a1c0
lea rax, [0x14054fa60]
ret
xor eax, eax
lea rcx, [0x14054f8e0]
lea rdx, [0x1404704f0]
nop dword [rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0x1e
jg 0x14018a208
inc rax
jmp 0x14018a1f0
xor r8b, 0x8d
add r8b, byte [0x14054fd3c]
xchg byte [0x14054f8ff], r8b
lea rax, [0x14054f8e0]
ret
xor edx, edx
lea rax, [0x14054f990]
lea rcx, [0x1404705a0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x13
jl 0x14018a240
mov al, 0x13
xchg byte [0x14054f9a3], al
lea rax, [0x14054f990]
ret
xor eax, eax
lea rcx, [0x14054f760]
lea rdx, [0x140470370]
xor r8d, 0xad0d3cdb
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x14054fd38]
add r9d, r8d
add eax, r9d
cmp eax, 0x15
jl 0x14018a2a0
mov al, 0x36
xchg byte [0x14054f775], al
lea rax, [0x14054f760]
ret
xor eax, eax
lea rcx, [0x14054fa60]
lea rdx, [0x140470670]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14018a308
inc rax
jmp 0x14018a2e0
mov al, 0x48
xchg byte [0x14054fa6d], al
lea rax, [0x14054fa60]
ret
Function at 0x14018ac30
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14018ac7c
mov eax, r8d
xor eax, 0xdd566a7a
add eax, dword [0x14054fd38]
cmp edx, eax
jne 0x14018acac
movzx eax, byte [0x14054f94d]
cmp al, 5
je 0x14018ac74
mov cl, 0xd1
nop dword [rax + rax]
mov al, 0x57
lock cmpxchg byte [0x14054f94d], cl
je 0x14018ad1c
cmp al, 5
jne 0x14018ac60
lea rax, [0x14054f940]
ret
test edx, edx
je 0x14018acdc
movzx eax, byte [0x14054f891]
cmp al, 0xaa
je 0x14018aca4
mov cl, 0xbc
nop dword [rax]
mov al, 0x38
lock cmpxchg byte [0x14054f891], cl
je 0x14018adbf
cmp al, 0xaa
jne 0x14018ac90
lea rax, [0x14054f880]
ret
movzx eax, byte [0x14054f84d]
cmp al, 0xe4
je 0x14018acd4
mov cl, 0x7d
nop dword [rax]
mov al, 0x71
lock cmpxchg byte [0x14054f84d], cl
je 0x14018ad7d
cmp al, 0xe4
jne 0x14018acc0
lea rax, [0x14054f840]
ret
movzx eax, byte [0x14054f96d]
mov ecx, r8d
xor cl, 0xaf
add cl, byte [0x14054fd3c]
cmp al, cl
je 0x14018ad14
mov cl, 0x8b
nop word cs:[rax + rax]
mov al, 0xa7
lock cmpxchg byte [0x14054f96d], cl
je 0x14018ae1a
cmp al, 0x82
jne 0x14018ad00
lea rax, [0x14054f960]
ret
xor eax, eax
lea rcx, [0x14054f940]
lea rdx, [0x140470550]
xor r8d, 0xdd566a7b
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
mov r9d, dword [0x14054fd38]
add r9d, r8d
add eax, r9d
cmp eax, 0xd
jl 0x14018ad40
mov al, 5
xchg byte [0x14054f94d], al
lea rax, [0x14054f940]
ret
xor edx, edx
lea rax, [0x14054f840]
lea rcx, [0x140470450]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x14018ad90
mov al, 0xe4
xchg byte [0x14054f84d], al
lea rax, [0x14054f840]
ret
xor edx, edx
lea rax, [0x14054f880]
lea rcx, [0x140470490]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
add edx, edx
and edx, 2
mov r9d, r8d
xor r9d, edx
and edx, r8d
lea edx, [r9 + rdx*2]
cmp edx, 0x11
jl 0x14018add0
mov al, 0xaa
xchg byte [0x14054f891], al
lea rax, [0x14054f880]
ret
xor eax, eax
lea rcx, [0x14054f960]
lea rdx, [0x140470570]
xor r8d, 0xdd566a77
nop word cs:[rax + rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14054fd38]
add r10d, r8d
cmp r9d, r10d
jge 0x14018ae75
inc rax
jmp 0x14018ae40
mov al, 0x82
xchg byte [0x14054f96d], al
lea rax, [0x14054f960]
ret
Function at 0x14019c090
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov eax, 0xbe6f1718
mov r8d, dword [0x1405506e0]
add r8d, eax
cmp ecx, r8d
jne 0x14019c0e9
add eax, dword [0x1405506e0]
cmp edx, eax
jne 0x14019c115
movzx eax, byte [0x140550152]
movzx ecx, byte [0x1405506e4]
add cl, 0x1d
cmp al, cl
je 0x14019c2bd
mov cl, 0x45
nop dword [rax + rax]
mov al, 0x53
lock cmpxchg byte [0x140550152], cl
je 0x14019c1e2
cmp al, 0x41
jne 0x14019c0d0
jmp 0x14019c2bd
test edx, edx
je 0x14019c149
movzx eax, byte [0x14055022d]
cmp al, 0x91
je 0x14019c1d6
mov cl, 4
nop
mov al, 0x8f
lock cmpxchg byte [0x14055022d], cl
je 0x14019c179
cmp al, 0x91
jne 0x14019c100
jmp 0x14019c1d6
movzx eax, byte [0x1405501be]
movzx ecx, byte [0x1405506e4]
add cl, 0x16
cmp al, cl
je 0x14019c2a2
mov cl, 0x43
mov al, 0x5a
lock cmpxchg byte [0x1405501be], cl
je 0x14019c21c
cmp al, 0x3a
jne 0x14019c130
jmp 0x14019c2a2
movzx eax, byte [0x1405501a8]
cmp al, 0x7f
je 0x14019c32b
xor ecx, ecx
nop word [rax + rax]
mov al, 0x89
lock cmpxchg byte [0x1405501a8], cl
je 0x14019c2c6
cmp al, 0x7f
jne 0x14019c160
jmp 0x14019c32b
xor eax, eax
lea rcx, [0x140550220]
lea rdx, [0x140470bb0]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
mov r11d, r9d
not r11b
xor r8b, r11b
xor r11b, r10b
and r11b, r9b
and r10b, r9b
or r10b, r8b
not r10b
or r10b, r11b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14019c1ce
inc rax
jmp 0x14019c190
mov al, 0x91
xchg byte [0x14055022d], al
lea rax, [0x140550220]
jmp 0x14019c332
xor eax, eax
lea rcx, [0x140550140]
lea rdx, [0x140470ad0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x14019c2ae
inc rax
jmp 0x14019c200
xor r8d, r8d
lea rax, [0x1405501b0]
lea rcx, [0x140470b40]
mov edx, 0xbe6f1726
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rax]
movzx r10d, byte [r8 + rcx]
mov r11d, r9d
not r11b
mov ebx, r11d
xor bl, r10b
not r10b
mov esi, r9d
and sil, r10b
or sil, bl
not sil
xor r10b, r11b
and r10b, r9b
or r10b, sil
mov byte [r8 + rax], r10b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x1405506e0]
add r9d, edx
cmp r8d, r9d
jl 0x14019c240
movzx eax, byte [0x1405506e4]
add al, 0x16
xchg byte [0x1405501be], al
lea rax, [0x1405501b0]
jmp 0x14019c332
movzx eax, byte [0x1405506e4]
add al, 0x1d
xchg byte [0x140550152], al
lea rax, [0x140550140]
jmp 0x14019c332
xor eax, eax
lea rcx, [0x140550190]
lea rdx, [0x140470b20]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
mov r9d, dword [0x1405506e0]
mov r10d, r9d
xor r10d, 0xbe6f1730
and r9d, 0x3e6f1730
lea r9d, [r10 + r9*2]
cmp r8d, r9d
jge 0x14019c323
inc rax
jmp 0x14019c2e0
mov al, 0x7f
xchg byte [0x1405501a8], al
lea rax, [0x140550190]
pop rbx
pop rsi
ret
Function at 0x1401b2f50
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401b2f8c
test edx, edx
je 0x1401b2fc6
movzx eax, byte [0x140550b32]
cmp al, 0x31
je 0x1401b2f84
mov cl, 0xbb
nop word cs:[rax + rax]
mov al, 0xc7
lock cmpxchg byte [0x140550b32], cl
je 0x1401b302c
cmp al, 0x31
jne 0x1401b2f70
lea rax, [0x140550b20]
ret
test edx, edx
je 0x1401b2ffc
movzx eax, byte [0x140550d71]
cmp al, 0xca
je 0x1401b2fbe
mov cl, 0x2e
nop dword [rax]
mov al, 0x70
lock cmpxchg byte [0x140550d71], cl
je 0x1401b3098
movzx edx, byte [0x140553858]
add dl, 0x5b
cmp al, dl
jne 0x1401b2fa0
lea rax, [0x140550d60]
ret
movzx eax, byte [0x140550aac]
cmp al, 0xf0
je 0x1401b2ff4
mov cl, 0x32
nop word cs:[rax + rax]
mov al, 0x4d
lock cmpxchg byte [0x140550aac], cl
je 0x1401b30c8
cmp al, 0xf0
jne 0x1401b2fe0
lea rax, [0x140550aa0]
ret
movzx eax, byte [0x140550c2d]
cmp al, 0xf4
je 0x1401b3024
mov cl, 0x42
nop dword [rax]
mov al, 0xa3
lock cmpxchg byte [0x140550c2d], cl
je 0x1401b3136
cmp al, 0xf4
jne 0x1401b3010
lea rax, [0x140550c20]
ret
xor eax, eax
lea rcx, [0x140550b20]
lea rdx, [0x140470f10]
mov r8d, 0x76a2eb1a
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x140553848]
add r10d, r8d
cmp r9d, r10d
jge 0x1401b3081
inc rax
jmp 0x1401b3050
movzx eax, byte [0x140553858]
add al, 0xc2
xchg byte [0x140550b32], al
lea rax, [0x140550b20]
ret
xor eax, eax
lea rcx, [0x140550d60]
lea rdx, [0x140471140]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x1401b3126
inc rax
jmp 0x1401b30b0
xor edx, edx
lea rax, [0x140550aa0]
lea rcx, [0x140470e90]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x140553848]
add edx, r8d
add edx, 0x76a2eb09
mov r9d, r8d
xor r9d, 0x76a2eb14
and r8d, 0x76a2eb14
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x1401b30e0
mov al, 0xf0
xchg byte [0x140550aac], al
lea rax, [0x140550aa0]
ret
mov al, 0xca
xchg byte [0x140550d71], al
lea rax, [0x140550d60]
ret
xor eax, eax
lea rcx, [0x140550c20]
lea rdx, [0x140471000]
mov r8d, 0x76a2eb15
nop dword [rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140553848]
add r10d, r8d
cmp r9d, r10d
jge 0x1401b3171
inc rax
jmp 0x1401b3150
movzx eax, byte [0x140553858]
mov ecx, eax
xor cl, 0x85
and al, 5
add al, al
add al, cl
xchg byte [0x140550c2d], al
lea rax, [0x140550c20]
ret
Function at 0x1401b4140
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1401b417c
test edx, edx
je 0x1401b41e0
movzx eax, byte [0x140550da1]
cmp al, 2
je 0x1401b4174
mov cl, 0x76
nop
mov al, 0x15
lock cmpxchg byte [0x140550da1], cl
je 0x1401b4258
cmp al, 2
jne 0x1401b4160
lea rax, [0x140550d90]
ret
mov eax, r8d
xor eax, 0xdb5a3a28
add eax, dword [0x140553848]
cmp edx, eax
jne 0x1401b421c
movzx eax, byte [0x140550d5d]
mov ecx, r8d
xor cl, 0x94
add cl, byte [0x140553858]
cmp al, cl
je 0x1401b41d8
nop dword [rax]
movzx ecx, byte [0x140553858]
mov eax, r8d
xor al, 0xda
add al, cl
mov edx, r8d
xor dl, 0x9a
add dl, cl
lock cmpxchg byte [0x140550d5d], dl
je 0x1401b4311
cmp al, 0x23
jne 0x1401b41b0
lea rax, [0x140550d50]
ret
movzx eax, byte [0x140550cfd]
mov ecx, r8d
xor cl, 0xde
add cl, byte [0x140553858]
cmp al, cl
je 0x1401b4214
mov cl, 0x61
nop dword [rax]
mov al, 0x15
lock cmpxchg byte [0x140550cfd], cl
je 0x1401b4298
cmp al, 0x6d
jne 0x1401b4200
lea rax, [0x140550cf0]
ret
movzx eax, byte [0x140550bfd]
cmp al, 0x52
je 0x1401b4250
mov cl, 0x1c
nop dword [rax]
mov al, 0x86
lock cmpxchg byte [0x140550bfd], cl
je 0x1401b435c
mov edx, r8d
xor dl, 0xc3
add dl, byte [0x140553858]
cmp al, dl
jne 0x1401b4230
lea rax, [0x140550bf0]
ret
xor eax, eax
lea rcx, [0x140550d90]
lea rdx, [0x140471170]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x1401b4288
inc rax
jmp 0x1401b4270
mov al, 2
xchg byte [0x140550da1], al
lea rax, [0x140550d90]
ret
xor eax, eax
lea rcx, [0x140550cf0]
lea rdx, [0x1404710d0]
mov r9d, r8d
xor r9d, 0xdb5a3a29
nop word cs:[rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
mov r11d, r10d
xor r11b, r10b
not r11b
and r11b, byte [rax + rcx]
xor r11b, r10b
mov byte [rax + rcx], r11b
mov r10d, dword [0x140553848]
mov r11d, r9d
xor r11d, r10d
and r10d, r9d
lea r10d, [r11 + r10*2]
add eax, r10d
cmp eax, 0xd
jl 0x1401b42c0
xor r8b, 0xde
add r8b, byte [0x140553858]
xchg byte [0x140550cfd], r8b
lea rax, [0x140550cf0]
ret
xor eax, eax
lea rcx, [0x140550d50]
lea rdx, [0x140471130]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401b439f
inc rax
jmp 0x1401b4330
xor edx, edx
lea rax, [0x140550bf0]
lea rcx, [0x140470fd0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x1401b4370
mov al, 0x52
xchg byte [0x140550bfd], al
lea rax, [0x140550bf0]
ret
mov al, 0x23
xchg byte [0x140550d5d], al
lea rax, [0x140550d50]
ret
Function at 0x1401e4a80
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401e4ad9
test edx, edx
je 0x1401e4b53
movzx eax, byte [0x1405566c0]
cmp al, 0xd1
je 0x1401e4ad1
mov cl, 0xd7
nop dword [rax]
mov al, 0x6b
lock cmpxchg byte [0x1405566c0], cl
je 0x1401e4bcc
movzx edx, byte [0x140556900]
mov r8d, edx
xor r8b, 0xda
not dl
and dl, 0x25
or dl, r8b
not dl
add dl, dl
add dl, r8b
cmp al, dl
jne 0x1401e4aa0
lea rax, [0x1405566b0]
ret
test edx, edx
je 0x1401e4b96
movzx eax, byte [0x140556723]
nop dword [rax + rax]
cmp al, 0x26
je 0x1401e4c23
movzx ecx, byte [0x140556900]
lea eax, [rcx + 0x79]
add cl, 0x92
lock cmpxchg byte [0x140556723], cl
jne 0x1401e4af0
xor eax, eax
lea rcx, [0x140556720]
lea rdx, [0x140471c70]
nop
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r8b
not r9b
mov r10d, r8d
xor r10b, r9b
or r9b, r8b
and r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1401e4c1b
inc rax
jmp 0x1401e4b20
movzx eax, byte [0x140556779]
movzx ecx, byte [0x140556900]
add cl, 0x1f
cmp al, cl
je 0x1401e4b8e
mov cl, 0xd3
nop word [rax + rax]
mov al, 0xa1
lock cmpxchg byte [0x140556779], cl
je 0x1401e4c2b
movzx edx, byte [0x140556900]
add dl, 0x1f
cmp al, dl
jne 0x1401e4b70
lea rax, [0x140556770]
ret
movzx eax, byte [0x14055678d]
cmp al, 0x83
je 0x1401e4bc4
mov cl, 0xb7
nop word cs:[rax + rax]
mov al, 0x54
lock cmpxchg byte [0x14055678d], cl
je 0x1401e4c68
cmp al, 0x83
jne 0x1401e4bb0
lea rax, [0x140556780]
ret
xor edx, edx
lea rax, [0x1405566b0]
lea rcx, [0x140471c20]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0xf8c21a1d
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x73de5e3
cmp edx, 0x10
jl 0x1401e4be0
mov al, 0xd1
xchg byte [0x1405566c0], al
lea rax, [0x1405566b0]
ret
mov al, 0x26
xchg byte [0x140556723], al
lea rax, [0x140556720]
ret
xor eax, eax
lea rcx, [0x140556770]
lea rdx, [0x140471cc0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1401e4c58
inc rax
jmp 0x1401e4c40
mov al, 0x16
xchg byte [0x140556779], al
lea rax, [0x140556770]
ret
xor eax, eax
lea rcx, [0x140556780]
lea rdx, [0x140471cd0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401e4ca8
inc rax
jmp 0x1401e4c80
mov al, 0x83
xchg byte [0x14055678d], al
lea rax, [0x140556780]
ret