joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005a5c
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xdeac
cmp ecx, eax
ja 0x140005ab4
je 0x140005aab
mov eax, 0xc433
cmp ecx, eax
ja 0x140005a8f
je 0x140005aab
mov eax, ecx
sub eax, 0x2a
je 0x140005aab
sub eax, 0xc402
je 0x140005aab
sub eax, 1
je 0x140005aab
sub eax, 1
je 0x140005aab
cmp eax, 3
jmp 0x140005aa9
mov eax, ecx
sub eax, 0xc435
je 0x140005aab
sub eax, 0x1263
je 0x140005ae7
sub eax, 0x812
je 0x140005aab
cmp eax, 1
jne 0x140005aad
xor edx, edx
call 0x1400b3e14
add byte [rbx - 0x2152d23f], cl
add byte [rax], al
mov eax, ecx
sub eax, 0xdead
je 0x140005aab
sub eax, 1
je 0x140005aab
sub eax, 1
je 0x140005aab
sub eax, 1
je 0x140005aab
sub eax, 1
je 0x140005aab
sub eax, 1
je 0x140005aab
sub eax, 1
je 0x140005aab
sub eax, 0x1f35
je 0x140005aab
cmp eax, 1
jne 0x140005aad
and edx, 8
jmp 0x140005aad

Function at 0x1400265a0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1400265cd
xor al, al
jmp 0x14002672f
mov rax, qword [0x1400466c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1400466c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1400466d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1400466d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1400466e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1400466e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1400466f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1400466f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x140046700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x140026721
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x140026679
mov r11d, 2
jmp 0x14002669d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x140026693
mov r11d, 1
jmp 0x14002669d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x140026745
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1400266e2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1400266fa
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14002670a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x140026718
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x140026660
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14002672a
Function at 0x140087db0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rsi, rcx
mov rdi, qword [rcx + 8]
cmp rdi, qword [rcx + 0x10]
je 0x140087de5
xorps xmm0, xmm0
movups xmmword [rdi + 0x18], xmm0
mov r14, qword [rbx + 0x18]
cmp qword [rbx + 0x20], 0x10
jb 0x140087e00
mov rbx, qword [rbx + 8]
jmp 0x140087e04
mov rcx, rsi
mov rdx, rdi
mov r8, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140087ed0
add rbx, 8
lea r12, [rdi + 8]
cmp r14, 0xf
ja 0x140087e21
movups xmm0, xmmword [rbx]
movups xmmword [r12], xmm0
mov r15d, 0xf
jmp 0x140087eaa
mov r15, r14
or r15, 0xf
movabs rax, 0x7fffffffffffffff
cmp r15, rax
cmovae r15, rax
cmp r15, 0xfff
jb 0x140087e70
lea rcx, [r15 + 0x28]
mov edx, 0xa76360c9
mov r8d, 0x89b7d590
call fcn.1400ae650
mov rcx, rax
xor rcx, 0x27
mov edx, eax
and edx, 0x27
lea rcx, [rcx + rdx*2]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140087e9a
mov rax, qword [0x140512a78]
add rax, r15
movabs rcx, 0x243c83c7e537ebbb
add rcx, rax
mov edx, 0xa76360c9
mov r8d, 0x89b7d590
call fcn.1400ae650
mov rcx, rax
mov qword [r12], rcx
lea r8, [r14 + 1]
mov rdx, rbx
call fcn.140430670
mov qword [rdi + 0x18], r14
mov qword [rdi + 0x20], r15
lea rax, [0x14044c8c8]
mov qword [rdi], rax
add qword [rsi + 8], 0x28
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14008c390
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
test rdx, rdx
js 0x14008c5d6
mov rbx, r9
mov rdi, rdx
mov rsi, rcx
xor eax, eax
test al, al
nop word cs:[rax + rax]
mov r15, qword [rsi + 0x18]
movzx ecx, byte [0x140512a78]
add cl, 0xbb
mov rax, r15
shr rax, cl
mov ecx, 0x99d46e3c
add ecx, dword [0x140512a80]
lea rdx, [fcn.14008c390]
lea r8d, [rdx + rdx]
add r8d, 0x3600
mov r9d, r8d
not r9d
and r8d, r9d
add edx, edx
add edx, 0x3601
and r9d, 0xfffffffe
xor r9d, edx
or r9d, r8d
not r9d
cmp r9d, ecx
jne 0x14008c3d0
movabs r12, 0x7fffffffffffffff
mov rcx, rax
xor rcx, r12
cmp rcx, r15
jae 0x14008c445
movabs rcx, 0x8000000000000000
jmp 0x14008c471
mov rcx, rdi
or rcx, 0xf
add rax, r15
cmp rcx, rax
mov r12, rax
cmova r12, rcx
lea rcx, [r12 + 1]
cmp rcx, 0x1000
jb 0x14008c4ce
cmp rcx, 0xffffffffffffffd9
jae 0x14008c5db
add rcx, 0x27
mov edx, 0xa76360c9
mov r8d, 0x89b7d590
call fcn.1400ae650
mov rcx, qword [0x140512a78]
movabs rdx, 0x243c83c7e537ebe1
add rdx, rcx
mov r8, rax
xor r8, rdx
and rdx, rax
lea rdx, [r8 + rdx*2]
movabs r14, 0x243c83c7e537eb9a
add r14, rcx
mov rcx, rdx
not rcx
xor rdx, r14
not r14
and r14, rcx
or r14, rdx
not r14
mov qword [r14 - 8], rax
jmp 0x14008c4e1
mov edx, 0xa76360c9
mov r8d, 0x89b7d590
call fcn.1400ae650
mov r14, rax
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], r12
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.140430670
mov byte [r14 + rdi], 0
cmp r15, 0x10
jb 0x14008c59e
mov eax, r15d
not eax
and eax, 1
mov rcx, r15
and rcx, 0xfffffffffffffffe
or rcx, rax
movabs rax, 0x7ffffffffffffffe
xor rax, r15
and rax, r15
lea rdx, [rcx + rax*2]
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14008c57e
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
movabs rdx, 0xc844d2d2324e5f6b
xor rdx, rcx
movabs r8, 0x4844d2d2324e5f6b
and r8, rcx
lea rcx, [rdx + r8*2]
sub rcx, rax
movabs rdx, 0x37bb2d2dcdb1a095
add rdx, rcx
cmp rdx, 0x20
jae 0x14008c5e0
add r15, 0x28
mov rdx, r15
mov rcx, rax
call fcn.1400ab9e0
jmp 0x14008c59e
mov qword [rsi], r14
mov eax, dword [0x14058e924]
cmp eax, 0x20
jl 0x14008c5b6
mov eax, dword [0x14058e920]
mov ecx, dword [0x140512a80]
add ecx, eax
dec ecx
imul ecx, eax
test cl, 1
jne 0x14008c590
mov qword [rsi], r14
mov eax, dword [0x14058e924]
cmp eax, 0x28
jg 0x14008c590
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
call fcn.14008a5c0
call fcn.140088910
call fcn.1403e88ec
int3
Function at 0x140097c00
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
movaps xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov rsi, rcx
lea rax, [0x14044de18]
mov qword [rcx], rax
lea rax, [rcx + 8]
mov qword [rbp - 0x58], rax
mov dword [rcx + 8], 0
mov word [rcx + 0xc], 0
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x30], 0
mov qword [rcx + 0x38], 0xf
mov byte [rcx + 0x20], 0
lea rax, [0x14044c8c8]
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x58], 0
mov qword [rcx + 0x60], 0xf
mov byte [rcx + 0x48], 0
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x80], 0
mov qword [rcx + 0x88], 0xf
mov byte [rcx + 0x70], 0
mov qword [rcx + 0x68], rax
mov byte [rcx + 0x90], 0
mov dword [rcx + 0x94], 0
lea rax, [rcx + 0xa8]
mov qword [rbp - 0x50], rax
xorps xmm6, xmm6
movups xmmword [rcx + 0xb0], xmm6
mov qword [rcx + 0xc0], 0
mov byte [rcx + 0xc8], 1
mov dword [rcx + 0xcc], 1
movups xmmword [rcx + 0xd0], xmm6
mov qword [rcx + 0xe0], 0
lea rdi, [0x14044e778]
mov qword [rcx + 0xa8], rdi
mov qword [rcx + 0xa0], 0
mov byte [rcx + 0x1e0], 0
lea rbx, [rcx + 0x1e4]
mov r8d, 0x150
mov rcx, rbx
xor edx, edx
call fcn.140430d20
mov qword [rbp - 0x48], rbx
mov rcx, rbx
xor edx, edx
call fcn.1402b7600
mov dword [rsi + 0x334], 0
lea rax, [rsi + 0x348]
mov qword [rbp - 0x40], rax
movups xmmword [rsi + 0x348], xmm6
movups xmmword [rsi + 0x358], xmm6
mov qword [rsi + 0x368], 0
mov ecx, 0x70
call fcn.140408a7c
lea rcx, [rsi + 0x360]
mov qword [rbp - 0x38], rcx
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsi + 0x360], rax
lea rax, [rsi + 0x370]
mov qword [rbp - 0x30], rax
movups xmmword [rsi + 0x370], xmm6
mov qword [rsi + 0x380], 0
lea rax, [rsi + 0x390]
mov qword [rbp - 0x28], rax
movups xmmword [rsi + 0x390], xmm6
mov qword [rsi + 0x3a0], 0
mov eax, dword [0x14058eb98]
mov ecx, dword [0x140592644]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x26838]
jg 0x140097e5d
lea rax, [0x14058e9d0]
mov qword [rsi + 0x3a8], rax
lea rax, [rsi + 0x3c8]
mov qword [rbp - 0x20], rax
movups xmmword [rsi + 0x3d0], xmm6
mov qword [rsi + 0x3e0], 0
mov byte [rsi + 0x3e8], 1
mov dword [rsi + 0x3ec], 1
movups xmmword [rsi + 0x3f0], xmm6
mov qword [rsi + 0x400], 0
mov qword [rsi + 0x3c8], rdi
mov rcx, rsi
call fcn.1400982a0
mov rax, rsi
movaps xmm6, xmmword [rbp - 0x10]
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rdx, [0x14058eb98]
xor ecx, ecx
xor r8d, r8d
mov r9d, 0x240f1c81
call fcn.1400abba0
cmp dword [0x14058eb98], 0xffffffff
jne 0x140097ded
lea rcx, [0x14058e9d0]
call fcn.140098dd0
lea rcx, [0x140099060]
mov edx, 0xfc2cf9e8
mov r8d, 0xae75a44d
call fcn.1400ae660
lea rdx, [0x14058eb98]
mov ecx, 1
xor r8d, r8d
mov r9d, 0x240f1c81
call fcn.1400abba0
jmp 0x140097ded
Function at 0x1400ad100
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400ad165
test edx, edx
je 0x1400ad19c
movzx eax, byte [0x140510276]
movzx ecx, byte [0x140512a84]
add cl, 0xde
cmp al, cl
je 0x1400ad15d
nop word cs:[rax + rax]
movzx ecx, byte [0x140512a84]
mov eax, ecx
neg al
mov edx, eax
xor dl, 0x26
and al, 0x26
add al, al
add al, dl
neg al
add cl, 0x18
lock cmpxchg byte [0x140510276], cl
je 0x1400ad20c
cmp al, 0x4e
jne 0x1400ad130
lea rax, [0x140510260]
ret
test edx, edx
je 0x1400ad1e1
movzx eax, byte [0x14051042d]
cmp al, 0x33
je 0x1400ad194
mov cl, 0x29
nop word cs:[rax + rax]
mov al, 0xaa
lock cmpxchg byte [0x14051042d], cl
je 0x1400ad248
cmp al, 0x33
jne 0x1400ad180
lea rax, [0x140510420]
ret
movzx eax, byte [0x1405103c6]
cmp al, 3
je 0x1400ad1d9
nop word [rax + rax]
movzx ecx, byte [0x140512a84]
lea eax, [rcx + 0x29]
add cl, 0xce
lock cmpxchg byte [0x1405103c6], cl
je 0x1400ad288
movzx ecx, byte [0x140512a84]
add cl, 0x93
cmp al, cl
jne 0x1400ad1b0
lea rax, [0x1405103c0]
ret
movzx eax, byte [0x14051032e]
cmp al, 0x1b
je 0x1400ad204
mov cl, 0x84
nop
mov al, 0x1a
lock cmpxchg byte [0x14051032e], cl
je 0x1400ad300
cmp al, 0x1b
jne 0x1400ad1f0
lea rax, [0x140510320]
ret
xor eax, eax
lea rcx, [0x140510260]
lea rdx, [0x14044c640]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x15
jg 0x1400ad238
inc rax
jmp 0x1400ad220
mov al, 0x4e
xchg byte [0x140510276], al
lea rax, [0x140510260]
ret
xor eax, eax
lea rcx, [0x140510420]
lea rdx, [0x14044c7f0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1400ad2e9
inc rax
jmp 0x1400ad260
xor eax, eax
lea rcx, [0x1405103c0]
lea rdx, [0x14044c790]
nop dword [rax + rax]
cdqe
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
mov r8d, dword [0x140512a80]
mov r9d, r8d
xor r9d, 0x99d46e3d
mov r10d, r8d
and r10d, 0x19d46e3d
lea r9d, [r9 + r10*2]
add eax, r9d
add r8d, 0x99d46e42
cmp eax, r8d
jl 0x1400ad2a0
mov al, 3
xchg byte [0x1405103c6], al
lea rax, [0x1405103c0]
ret
movzx eax, byte [0x140512a84]
add al, 0xc3
xchg byte [0x14051042d], al
lea rax, [0x140510420]
ret
xor eax, eax
lea rcx, [0x140510320]
lea rdx, [0x14044c6f0]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x1400ad328
inc rax
jmp 0x1400ad310
mov al, 0x1b
xchg byte [0x14051032e], al
lea rax, [0x140510320]
ret
Function at 0x1400ad340
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400ad37c
test edx, edx
je 0x1400ad3ac
movzx eax, byte [0x1405102f0]
cmp al, 0xf9
je 0x1400ad374
mov cl, 0x4d
nop word cs:[rax + rax]
mov al, 0xcc
lock cmpxchg byte [0x1405102f0], cl
je 0x1400ad436
cmp al, 0xf9
jne 0x1400ad360
lea rax, [0x1405102e0]
ret
test edx, edx
je 0x1400ad3f7
movzx eax, byte [0x14051046f]
cmp al, 0x8c
je 0x1400ad3a4
mov cl, 0xf2
nop dword [rax]
mov al, 0xda
lock cmpxchg byte [0x14051046f], cl
je 0x1400ad481
cmp al, 0x8c
jne 0x1400ad390
lea rax, [0x140510460]
ret
movzx eax, byte [0x1405102c6]
movzx ecx, byte [0x140512a84]
add cl, 0xe8
cmp al, cl
je 0x1400ad3ef
nop word cs:[rax + rax]
movzx ecx, byte [0x140512a84]
lea eax, [rcx + 0x1e]
add cl, 0xb3
lock cmpxchg byte [0x1405102c6], cl
je 0x1400ad4c1
cmp al, 0x58
jne 0x1400ad3d0
lea rax, [0x1405102b0]
ret
movzx eax, byte [0x140510309]
movzx ecx, byte [0x140512a84]
add cl, 0x61
cmp al, cl
je 0x1400ad42e
mov cl, 0x28
nop
mov al, 0xe6
lock cmpxchg byte [0x140510309], cl
je 0x1400ad531
movzx edx, byte [0x140512a84]
add dl, 0x61
cmp al, dl
jne 0x1400ad410
lea rax, [0x140510300]
ret
xor edx, edx
lea rax, [0x1405102e0]
lea rcx, [0x14044c6c0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x140512a80]
add edx, r8d
add edx, 0x99d46e3d
cmp edx, 0x10
jl 0x1400ad450
mov al, 0xf9
xchg byte [0x1405102f0], al
lea rax, [0x1405102e0]
ret
xor eax, eax
lea rcx, [0x140510460]
lea rdx, [0x14044c830]
mov r8d, 0x99d46e4b
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140512a80]
add r10d, r8d
cmp r9d, r10d
jge 0x1400ad521
inc rax
jmp 0x1400ad4a0
xor edx, edx
lea rax, [0x1405102b0]
lea rcx, [0x14044c690]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140512a80]
add edx, r8d
add edx, 0x99d46e3d
cmp edx, 0x16
jl 0x1400ad4e0
mov al, 0x58
xchg byte [0x1405102c6], al
lea rax, [0x1405102b0]
ret
mov al, 0x8c
xchg byte [0x14051046f], al
lea rax, [0x140510460]
ret
xor edx, edx
lea rax, [0x140510300]
lea rcx, [0x14044c6d0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140512a80]
add edx, r8d
add edx, 0x99d46e3d
add r8d, 0x99d46e45
cmp edx, r8d
jl 0x1400ad550
mov al, 0xd1
xchg byte [0x140510309], al
lea rax, [0x140510300]
ret
Function at 0x1400adac0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x99d46e3c
add eax, dword [0x140512a80]
cmp ecx, eax
jne 0x1400adb0c
test edx, edx
je 0x1400adb63
movzx eax, byte [0x1405103db]
cmp al, 0xec
je 0x1400adb04
mov cl, 0x56
nop word cs:[rax + rax]
mov al, 0xd5
lock cmpxchg byte [0x1405103db], cl
je 0x1400adbbc
cmp al, 0xec
jne 0x1400adaf0
lea rax, [0x1405103d0]
ret
test edx, edx
je 0x1400adb8c
movzx eax, byte [0x140510255]
cmp al, 0x5a
je 0x1400adb5b
nop dword [rax + rax]
movzx ecx, byte [0x140512a84]
lea eax, [rcx + 0x6c]
mov edx, ecx
xor dl, 0x5b
and cl, 0x5b
add cl, cl
add cl, dl
lock cmpxchg byte [0x140510255], cl
je 0x1400adbe8
movzx ecx, byte [0x140512a84]
mov edx, ecx
xor dl, 0xea
and cl, 0x6a
add cl, cl
add cl, dl
cmp al, cl
jne 0x1400adb20
lea rax, [0x140510240]
ret
movzx eax, byte [0x1405101d5]
cmp al, 0x76
je 0x1400adb84
mov cl, 0x83
mov al, 6
lock cmpxchg byte [0x1405101d5], cl
je 0x1400adc51
cmp al, 0x76
jne 0x1400adb70
lea rax, [0x1405101c0]
ret
movzx eax, byte [0x1405102d3]
cmp al, 0xbe
je 0x1400adbb4
mov cl, 0xfa
nop dword [rax]
mov al, 0x35
lock cmpxchg byte [0x1405102d3], cl
je 0x1400adc9c
cmp al, 0xbe
jne 0x1400adba0
lea rax, [0x1405102d0]
ret
xor eax, eax
lea rcx, [0x1405103d0]
lea rdx, [0x14044c7a0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x1400adc41
inc rax
jmp 0x1400adbd0
xor edx, edx
lea rax, [0x140510240]
lea rcx, [0x14044c620]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140512a80]
add edx, r8d
add edx, 0x99d46e3d
cmp edx, 0x15
jl 0x1400adc00
mov al, 0x5a
xchg byte [0x140510255], al
lea rax, [0x140510240]
ret
mov al, 0xec
xchg byte [0x1405103db], al
lea rax, [0x1405103d0]
ret
xor eax, eax
lea rcx, [0x1405101c0]
lea rdx, [0x14044c5b0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1400adcd8
inc rax
jmp 0x1400adc70
xor eax, eax
lea rcx, [0x1405102d0]
lea rdx, [0x14044c6b0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1400adce8
inc rax
jmp 0x1400adcb0
mov al, 0x76
xchg byte [0x1405101d5], al
lea rax, [0x1405101c0]
ret
mov al, 0xbe
xchg byte [0x1405102d3], al
lea rax, [0x1405102d0]
ret
Function at 0x1400ae2b0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400ae2ec
test edx, edx
je 0x1400ae32c
movzx eax, byte [0x140510444]
cmp al, 0x10
je 0x1400ae2e4
mov cl, 0x7b
nop word cs:[rax + rax]
mov al, 0x50
lock cmpxchg byte [0x140510444], cl
je 0x1400ae38c
cmp al, 0x10
jne 0x1400ae2d0
lea rax, [0x140510430]
ret
mov eax, 0x99d46e3c
add eax, dword [0x140512a80]
cmp edx, eax
jne 0x1400ae358
movzx eax, byte [0x140510230]
cmp al, 0xe
je 0x1400ae324
mov cl, 0x46
nop dword [rax + rax]
mov al, 0xca
lock cmpxchg byte [0x140510230], cl
je 0x1400ae411
cmp al, 0xe
jne 0x1400ae310
lea rax, [0x140510220]
ret
movzx eax, byte [0x1405102a9]
cmp al, 0x34
je 0x1400ae350
mov cl, 0xae
nop dword [rax]
mov al, 0xa
lock cmpxchg byte [0x1405102a9], cl
je 0x1400ae3c8
cmp al, 0x34
jne 0x1400ae340
lea rax, [0x1405102a0]
ret
movzx eax, byte [0x140510413]
cmp al, 0x98
je 0x1400ae384
mov cl, 0x40
nop word cs:[rax + rax]
mov al, 0x1e
lock cmpxchg byte [0x140510413], cl
je 0x1400ae448
cmp al, 0x98
jne 0x1400ae370
lea rax, [0x140510400]
ret
xor eax, eax
lea rcx, [0x140510430]
lea rdx, [0x14044c800]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x13
jg 0x1400ae3b8
inc rax
jmp 0x1400ae3a0
mov al, 0x10
xchg byte [0x140510444], al
lea rax, [0x140510430]
ret
xor eax, eax
lea rcx, [0x1405102a0]
lea rdx, [0x14044c680]
mov r8d, 0x99d46e45
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140512a80]
add r10d, r8d
cmp r9d, r10d
jge 0x1400ae401
inc rax
jmp 0x1400ae3e0
mov al, 0x34
xchg byte [0x1405102a9], al
lea rax, [0x1405102a0]
ret
xor eax, eax
lea rcx, [0x140510220]
lea rdx, [0x14044c610]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1400ae48f
inc rax
jmp 0x1400ae430
xor edx, edx
lea rax, [0x140510400]
lea rcx, [0x14044c7d0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x13
jl 0x1400ae460
mov al, 0x98
xchg byte [0x140510413], al
lea rax, [0x140510400]
ret
movzx eax, byte [0x140512a84]
add al, 0x9e
xchg byte [0x140510230], al
lea rax, [0x140510220]
ret

Function at 0x1400ae4d0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
call fcn.1403ecc5c
nop
add rsp, 0x28
ret
Function at 0x140129f80
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov esi, r9d
test ecx, ecx
je 0x140129ffc
test edx, edx
je 0x14012a05d
movzx eax, byte [0x140515436]
nop word cs:[rax + rax]
cmp al, 0x21
je 0x14012a0e0
movzx ecx, byte [0x1405223b8]
lea eax, [rcx - 0x19]
add cl, 0x9d
lock cmpxchg byte [0x140515436], cl
jne 0x140129fb0
xor eax, eax
lea rcx, [0x140515420]
lea rdx, [0x14044e980]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x15
jg 0x14012a0d8
inc rax
jmp 0x140129fe0
test edx, edx
je 0x14012a089
movzx eax, byte [0x1405153f1]
cmp al, 0x27
je 0x14012a160
xor esi, 0x75f62e0f
lea rdi, [rsp + 0x33]
nop
mov eax, dword [0x1405223a8]
mov ecx, eax
xor ecx, 0x6b304ee2
and eax, 0x6b304ee2
lea r8d, [rcx + rax*2]
mov rcx, rdi
mov edx, esi
call fcn.14012b750
test al, 1
jne 0x14012a0ec
movzx eax, byte [0x1405223b8]
add al, 0x4f
cmp byte [rsp + 0x33], al
jne 0x14012a020
jmp 0x14012a160
movzx eax, byte [0x1405153b2]
cmp al, 0xc
je 0x14012a17e
mov cl, 0xf5
nop
mov al, 0x40
lock cmpxchg byte [0x1405153b2], cl
je 0x14012a118
cmp al, 0xc
jne 0x14012a070
jmp 0x14012a17e
movzx eax, byte [0x140515486]
cmp al, 0xb9
je 0x14012a219
mov bl, 0x9c
mov edi, esi
xor edi, 0x73dab617
nop word cs:[rax + rax]
mov al, 0x78
lock cmpxchg byte [0x140515486], bl
je 0x14012a18a
mov ecx, eax
mov edx, edi
mov r8d, 0xc4d81919
call fcn.14012b7f0
test al, 1
je 0x14012a0b0
jmp 0x14012a219
mov al, 0x21
xchg byte [0x140515436], al
lea rax, [0x140515420]
jmp 0x14012a220
xor eax, eax
lea rcx, [0x1405153e0]
lea rdx, [0x14044e940]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x14012a158
inc rax
jmp 0x14012a100
xor eax, eax
lea rcx, [0x1405153a0]
lea rdx, [0x14044e900]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x14012a16c
inc rax
jmp 0x14012a130
mov al, 0x27
xchg byte [0x1405153f1], al
lea rax, [0x1405153e0]
jmp 0x14012a220
xor esi, 0xe9fdcd97
mov ecx, esi
mov edx, 0xb2933be5
call fcn.14012b7e0
lea rax, [0x1405153a0]
jmp 0x14012a220
xor ecx, ecx
lea r12, [0x140515470]
lea rdi, [rsp + 0x32]
mov r13d, esi
xor r13d, 0xe5b7bdb7
lea rbx, [rsp + 0x34]
nop word [rax + rax]
movsxd r14, ecx
lea r15, [r12 + r14]
movzx ebp, byte [r14 + r12]
lea rax, [0x14044e9d0]
lea rcx, [rax + r14]
mov r9d, dword [0x1405223a8]
lea r8d, [r9 + 0x676dc22b]
xor r8d, esi
add r9d, 0x8b2a7fec
mov rdx, rdi
call fcn.14012b300
add bpl, byte [rsp + 0x32]
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x28], 0x9ea31e40
mov ecx, ebp
mov rdx, r15
mov r8d, r14d
mov r9, rbx
call fcn.14012b890
mov ecx, dword [rsp + 0x34]
test al, 1
je 0x14012a1b0
mov al, 0xb9
xchg byte [0x140515486], al
lea rax, [0x140515470]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret