joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140098e60
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
movaps xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov rsi, rcx
lea rax, [0x140428068]
mov qword [rcx], rax
lea rax, [rcx + 8]
mov qword [rbp - 0x58], rax
mov dword [rcx + 8], 0
mov word [rcx + 0xc], 0
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x30], 0
mov qword [rcx + 0x38], 0xf
mov byte [rcx + 0x20], 0
lea rax, [0x140426b18]
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x58], 0
mov qword [rcx + 0x60], 0xf
mov byte [rcx + 0x48], 0
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x80], 0
mov qword [rcx + 0x88], 0xf
mov byte [rcx + 0x70], 0
mov qword [rcx + 0x68], rax
mov byte [rcx + 0x90], 0
mov dword [rcx + 0x94], 0
lea rax, [rcx + 0xa8]
mov qword [rbp - 0x50], rax
xorps xmm6, xmm6
movups xmmword [rcx + 0xb0], xmm6
mov qword [rcx + 0xc0], 0
mov byte [rcx + 0xc8], 1
mov dword [rcx + 0xcc], 1
movups xmmword [rcx + 0xd0], xmm6
mov qword [rcx + 0xe0], 0
lea rdi, [0x1404289c8]
mov qword [rcx + 0xa8], rdi
mov qword [rcx + 0xa0], 0
mov byte [rcx + 0x1e0], 0
lea rbx, [rcx + 0x1e4]
mov r8d, 0x150
mov rcx, rbx
xor edx, edx
call fcn.14040c5e0
mov qword [rbp - 0x48], rbx
mov rcx, rbx
xor edx, edx
call fcn.1402b4460
mov dword [rsi + 0x334], 0
lea rax, [rsi + 0x348]
mov qword [rbp - 0x40], rax
movups xmmword [rsi + 0x348], xmm6
movups xmmword [rsi + 0x358], xmm6
mov qword [rsi + 0x368], 0
mov ecx, 0x70
call fcn.1403e3fbc
lea r8, [rsi + 0x360]
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsi + 0x360], rax
lea r9, [rsi + 0x370]
xorps xmm0, xmm0
movups xmmword [rsi + 0x370], xmm0
mov qword [rsi + 0x380], 0
movups xmmword [rsi + 0x390], xmm0
mov qword [rsi + 0x3a0], 0
mov eax, dword [0x140563f10]
mov ecx, dword [0x140567a90]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
xor edx, edx
cmp eax, dword [rcx + 0x26838]
lea r10, [rsi + 0x390]
setg dl
lea eax, [rdx + rdx*2]
xor edx, 3
mov ebx, 4
mov ecx, 4
sub ecx, eax
lea r15, [0x1404f2100]
mov eax, 0xd693
add eax, dword [r15 + rcx*4]
lea r14, [0x1404f2120]
cdqe
add rax, qword [r14 + rdx*8]
mov qword [rbp - 0x38], r8
mov qword [rbp - 0x30], r9
mov qword [rbp - 0x28], r10
jmp rax

Function at 0x1400a93e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
jne 0x1400a9448
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
movabs r14, 0x6c92fe8685d0b01a
nop word cs:[rax + rax]
mov r8, qword [rbx + 0x10]
mov rcx, rdi
mov rdx, rsi
call fcn.1400a93e0
mov r15, qword [rbx]
mov rax, qword [0x1404f14e0]
mov rcx, rax
xor rcx, r14
and rax, r14
lea rdx, [rcx + rax*2]
mov rcx, rbx
call fcn.1400a9560
cmp byte [r15 + 0x19], 0
mov rbx, r15
je 0x1400a9410
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400aabb0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400aac1c
mov eax, 0xdab323d4
add eax, dword [0x1404f14e8]
cmp edx, eax
jne 0x1400aac7c
movzx eax, byte [0x1404f01a9]
nop
cmp al, 0xd9
je 0x1400aace4
movzx ecx, byte [0x1404f14d8]
lea eax, [rcx + 0xe]
add cl, 0xd2
lock cmpxchg byte [0x1404f01a9], cl
jne 0x1400aabd0
xor eax, eax
lea rcx, [0x1404f01a0]
lea rdx, [0x1404268d0]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1400aacdc
inc rax
jmp 0x1400aac00
test edx, edx
je 0x1400aaca8
movzx eax, byte [0x1404f0195]
nop dword [rax + rax]
cmp al, 0x15
je 0x1400aad47
movzx ecx, byte [0x1404f14d8]
lea eax, [rcx + 0x2d]
add cl, 8
lock cmpxchg byte [0x1404f0195], cl
jne 0x1400aac30
xor eax, eax
lea rcx, [0x1404f0180]
lea rdx, [0x1404268b0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1400aad38
inc rax
jmp 0x1400aac60
movzx eax, byte [0x1404f0344]
cmp al, 0x99
je 0x1400aaca0
mov cl, 0xb6
nop dword [rax]
mov al, 0x6d
lock cmpxchg byte [0x1404f0344], cl
je 0x1400aacec
cmp al, 0x99
jne 0x1400aac90
lea rax, [0x1404f0330]
ret
movzx eax, byte [0x1404f02fd]
movzx ecx, byte [0x1404f14d8]
add cl, 0xed
cmp al, cl
je 0x1400aacd4
mov cl, 0xf8
nop
mov al, 0xef
lock cmpxchg byte [0x1404f02fd], cl
je 0x1400aad4f
cmp al, 0x86
jne 0x1400aacc0
lea rax, [0x1404f02f0]
ret
mov al, 0xd9
xchg byte [0x1404f01a9], al
lea rax, [0x1404f01a0]
ret
xor eax, eax
lea rcx, [0x1404f0330]
lea rdx, [0x140426a50]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x13
jg 0x1400aad28
inc rax
jmp 0x1400aad00
mov al, 0x99
xchg byte [0x1404f0344], al
lea rax, [0x1404f0330]
ret
movzx eax, byte [0x1404f14d8]
add al, 0x7c
xchg byte [0x1404f0195], al
lea rax, [0x1404f0180]
ret
xor edx, edx
lea rax, [0x1404f02f0]
lea rcx, [0x140426a10]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x1400aad60
mov al, 0x86
xchg byte [0x1404f02fd], al
lea rax, [0x1404f02f0]
ret
Function at 0x1400aaf20
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400aaf5c
movzx eax, byte [0x140563c78]
cmp al, 0xd0
je 0x1400aaf54
mov cl, 0xa9
nop word cs:[rax + rax]
xor eax, eax
lock cmpxchg byte [0x140563c78], cl
je 0x1400aafcc
cmp al, 0xd0
jne 0x1400aaf40
lea rax, [0x1404f0140]
ret
mov eax, 0xdab323d4
add eax, dword [0x1404f14e8]
cmp edx, eax
jne 0x1400aaf98
movzx eax, byte [0x1404f01d3]
cmp al, 7
je 0x1400aaf90
mov cl, 0x96
nop dword [rax + rax]
mov al, 0x1e
lock cmpxchg byte [0x1404f01d3], cl
je 0x1400ab008
cmp al, 7
jne 0x1400aaf80
lea rax, [0x1404f01d0]
ret
movzx eax, byte [0x1404f02a9]
cmp al, 0x2e
je 0x1400aafc4
mov cl, 0x6a
nop word cs:[rax + rax]
mov al, 0xff
lock cmpxchg byte [0x1404f02a9], cl
je 0x1400ab05a
cmp al, 0x2e
jne 0x1400aafb0
lea rax, [0x1404f02a0]
ret
xor eax, eax
lea rcx, [0x1404f0140]
lea rdx, [0x140426870]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1400aaff8
inc rax
jmp 0x1400aafe0
mov al, 0xd0
xchg byte [0x140563c78], al
lea rax, [0x1404f0140]
ret
xor r8d, r8d
lea rax, [0x1404f01d0]
lea rcx, [0x140426900]
mov edx, 0xdab323d7
nop
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
xor byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x1404f14e8]
add r9d, edx
cmp r8d, r9d
jl 0x1400ab020
mov al, 7
xchg byte [0x1404f01d3], al
lea rax, [0x1404f01d0]
ret
xor edx, edx
lea rax, [0x1404f02a0]
lea rcx, [0x1404269c0]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x1404f14e8]
add edx, r8d
add edx, 0xdab323d5
cmp edx, 9
jl 0x1400ab070
mov al, 0x2e
xchg byte [0x1404f02a9], al
lea rax, [0x1404f02a0]
ret
Function at 0x1400ac2d0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1400ac30c
test edx, edx
je 0x1400ac33c
movzx eax, byte [0x1404f032d]
cmp al, 0x50
je 0x1400ac304
mov cl, 0x29
nop word [rax + rax]
mov al, 0x58
lock cmpxchg byte [0x1404f032d], cl
je 0x1400ac3ac
cmp al, 0x50
jne 0x1400ac2f0
lea rax, [0x1404f0320]
ret
test edx, edx
je 0x1400ac37c
movzx eax, byte [0x1404f02db]
cmp al, 0x37
je 0x1400ac334
mov cl, 0x55
nop dword [rax]
mov al, 0x98
lock cmpxchg byte [0x1404f02db], cl
je 0x1400ac3e8
cmp al, 0x37
jne 0x1400ac320
lea rax, [0x1404f02d0]
ret
movzx eax, byte [0x1404f00d5]
xor r8b, 0x50
add r8b, byte [0x1404f14d8]
cmp al, r8b
je 0x1400ac374
mov cl, 0xbe
nop word cs:[rax + rax]
mov al, 0x43
lock cmpxchg byte [0x1404f00d5], cl
je 0x1400ac428
cmp al, 0x2e
jne 0x1400ac360
lea rax, [0x1404f00c0]
ret
movzx eax, byte [0x1404f0213]
cmp al, 0xaf
je 0x1400ac3a4
mov cl, 0x94
nop dword [rax]
mov al, 0x29
lock cmpxchg byte [0x1404f0213], cl
je 0x1400ac47f
cmp al, 0xaf
jne 0x1400ac390
lea rax, [0x1404f0210]
ret
xor eax, eax
lea rcx, [0x1404f0320]
lea rdx, [0x140426a40]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1400ac3d8
inc rax
jmp 0x1400ac3c0
mov al, 0x50
xchg byte [0x1404f032d], al
lea rax, [0x1404f0320]
ret
xor eax, eax
lea rcx, [0x1404f02d0]
lea rdx, [0x1404269f0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x1400ac46f
inc rax
jmp 0x1400ac400
xor edx, edx
lea rax, [0x1404f00c0]
lea rcx, [0x140426800]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x1400ac440
mov al, 0x2e
xchg byte [0x1404f00d5], al
lea rax, [0x1404f00c0]
ret
mov al, 0x37
xchg byte [0x1404f02db], al
lea rax, [0x1404f02d0]
ret
xor eax, eax
lea rcx, [0x1404f0210]
lea rdx, [0x140426930]
xor r8d, 0x7d741310
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x1404f14e8]
add r9d, r8d
add eax, r9d
cmp eax, 3
jl 0x1400ac4a0
mov al, 0xaf
xchg byte [0x1404f0213], al
lea rax, [0x1404f0210]
ret
Function at 0x1400ada70
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1400adaac
test edx, edx
je 0x1400adadc
movzx eax, byte [0x1404f0283]
cmp al, 0x8d
je 0x1400adaa4
mov cl, 0xc5
nop word [rax + rax]
mov al, 0xce
lock cmpxchg byte [0x1404f0283], cl
je 0x1400adb5c
cmp al, 0x8d
jne 0x1400ada90
lea rax, [0x1404f0260]
ret
test edx, edx
je 0x1400adb0c
movzx eax, byte [0x1404f037d]
cmp al, 0x4f
je 0x1400adad4
mov cl, 0xb6
nop dword [rax]
mov al, 0x28
lock cmpxchg byte [0x1404f037d], cl
je 0x1400adb98
cmp al, 0x4f
jne 0x1400adac0
lea rax, [0x1404f0370]
ret
movzx eax, byte [0x1404f01c6]
cmp al, 0x85
je 0x1400adb04
mov cl, 0x89
nop dword [rax]
mov al, 0x42
lock cmpxchg byte [0x1404f01c6], cl
je 0x1400adbef
cmp al, 0x85
jne 0x1400adaf0
lea rax, [0x1404f01b0]
ret
movzx eax, byte [0x1404f0118]
xor r8b, 0xa2
movzx ecx, byte [0x1404f14d8]
xor cl, r8b
mov edx, ecx
not dl
and dl, r8b
add dl, dl
add dl, cl
cmp al, dl
je 0x1400adb54
mov cl, 0xf6
nop word cs:[rax + rax]
mov al, 0xc7
lock cmpxchg byte [0x1404f0118], cl
je 0x1400adc51
cmp al, 0x98
jne 0x1400adb40
lea rax, [0x1404f0100]
ret
xor eax, eax
lea rcx, [0x1404f0260]
lea rdx, [0x140426980]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1400adb88
inc rax
jmp 0x1400adb70
mov al, 0x8d
xchg byte [0x1404f0283], al
lea rax, [0x1404f0260]
ret
xor edx, edx
lea rax, [0x1404f0370]
lea rcx, [0x140426a90]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x1400adbb0
mov al, 0x4f
xchg byte [0x1404f037d], al
lea rax, [0x1404f0370]
ret
xor edx, edx
lea rax, [0x1404f01b0]
lea rcx, [0x1404268e0]
nop
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
not edx
and edx, 0x7ffffffe
or edx, r9d
not edx
lea edx, [r9 + rdx*2]
cmp edx, 0x16
jl 0x1400adc00
movzx eax, byte [0x1404f14d8]
xor r8b, 0xb1
mov ecx, r8d
xor cl, al
and r8b, al
add r8b, r8b
add r8b, cl
xchg byte [0x1404f01c6], r8b
lea rax, [0x1404f01b0]
ret
xor eax, eax
lea rcx, [0x1404f0100]
lea rdx, [0x140426840]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x17
jg 0x1400adc88
inc rax
jmp 0x1400adc70
mov al, 0x98
xchg byte [0x1404f0118], al
lea rax, [0x1404f0100]
ret
Function at 0x1400fcf30
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1400fcf6c
test edx, edx
je 0x1400fcf9c
movzx eax, byte [0x1404f4d90]
cmp al, 0xa5
je 0x1400fcf64
mov cl, 7
nop word [rax + rax]
mov al, 0x32
lock cmpxchg byte [0x1404f4d90], cl
je 0x1400fd03c
cmp al, 0xa5
jne 0x1400fcf50
lea rax, [0x1404f4d80]
ret
test edx, edx
je 0x1400fcfcc
movzx eax, byte [0x1404f4d35]
cmp al, 0xb2
je 0x1400fcf94
mov cl, 6
nop dword [rax]
mov al, 0x10
lock cmpxchg byte [0x1404f4d35], cl
je 0x1400fd0a3
cmp al, 0xb2
jne 0x1400fcf80
lea rax, [0x1404f4d20]
ret
movzx eax, byte [0x1404f4cf5]
cmp al, 0x21
je 0x1400fcfc4
mov cl, 0xb9
nop dword [rax]
mov al, 0x3f
lock cmpxchg byte [0x1404f4cf5], cl
je 0x1400fd0ed
cmp al, 0x21
jne 0x1400fcfb0
lea rax, [0x1404f4ce0]
ret
movzx eax, byte [0x1404f4e39]
nop word cs:[rax + rax]
cmp al, 0x7d
je 0x1400fd130
movzx ecx, byte [0x1404fffd8]
mov eax, r8d
xor al, 0xc9
mov edx, eax
xor dl, cl
and al, cl
add al, al
add al, dl
mov edx, r8d
xor dl, 0xa0
add dl, cl
lock cmpxchg byte [0x1404f4e39], dl
jne 0x1400fcfe0
xor eax, eax
lea rcx, [0x1404f4e30]
lea rdx, [0x140428c90]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1400fd128
inc rax
jmp 0x1400fd020
xor r9d, r9d
lea rax, [0x1404f4d80]
lea rcx, [0x140428bf0]
mov edx, r8d
xor edx, 0xbc5360c9
nop word cs:[rax + rax]
movsxd r9, r9d
movzx r10d, byte [r9 + rcx]
xor byte [r9 + rax], r10b
mov r10d, dword [0x1404fffc8]
add r10d, edx
mov r11d, r9d
xor r11d, r10d
and r10d, r9d
lea r9d, [r11 + r10*2]
cmp r9d, 0x10
jl 0x1400fd060
xor r8b, 0xdf
add r8b, byte [0x1404fffd8]
xchg byte [0x1404f4d90], r8b
lea rax, [0x1404f4d80]
ret
xor eax, eax
lea rcx, [0x1404f4d20]
lea rdx, [0x140428b90]
xor r8d, 0xbc5360c9
nop word [rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x1404fffc8]
add r9d, r8d
add eax, r9d
cmp eax, 0x15
jl 0x1400fd0c0
mov al, 0xb2
xchg byte [0x1404f4d35], al
lea rax, [0x1404f4d20]
ret
xor eax, eax
lea rcx, [0x1404f4ce0]
lea rdx, [0x140428b50]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1400fd118
inc rax
jmp 0x1400fd100
mov al, 0x21
xchg byte [0x1404f4cf5], al
lea rax, [0x1404f4ce0]
ret
mov al, 0x7d
xchg byte [0x1404f4e39], al
lea rax, [0x1404f4e30]
ret
Function at 0x1400fd250
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1400fd298
test edx, edx
je 0x1400fd2cc
movzx eax, byte [0x1404f4cb8]
cmp al, 0x9d
je 0x1400fd290
mov cl, 0x2c
nop word [rax + rax]
mov al, 0x63
lock cmpxchg byte [0x1404f4cb8], cl
je 0x1400fd32c
mov edx, r8d
xor dl, 0xa1
add dl, byte [0x1404fffd8]
cmp al, dl
jne 0x1400fd270
lea rax, [0x1404f4ca0]
ret
test edx, edx
je 0x1400fd2fc
movzx eax, byte [0x1404f4dc6]
cmp al, 0xf9
je 0x1400fd2c4
mov cl, 0x4e
nop dword [rax]
mov al, 9
lock cmpxchg byte [0x1404f4dc6], cl
je 0x1400fd391
cmp al, 0xf9
jne 0x1400fd2b0
lea rax, [0x1404f4dc0]
ret
movzx eax, byte [0x1404f4e5f]
cmp al, 0xc5
je 0x1400fd2f4
mov cl, 2
nop dword [rax]
mov al, 0xd5
lock cmpxchg byte [0x1404f4e5f], cl
je 0x1400fd3fb
cmp al, 0xc5
jne 0x1400fd2e0
lea rax, [0x1404f4e50]
ret
movzx eax, byte [0x1404f4c50]
cmp al, 0xbf
je 0x1400fd324
mov cl, 0xef
nop dword [rax]
mov al, 0x61
lock cmpxchg byte [0x1404f4c50], cl
je 0x1400fd448
cmp al, 0xbf
jne 0x1400fd310
lea rax, [0x1404f4c40]
ret
xor eax, eax
lea rcx, [0x1404f4ca0]
lea rdx, [0x140428b10]
mov r9d, r8d
not r9d
and r9d, 0xab8cd596
xor r8d, 0x54732a69
or r8d, r9d
not r8d
or r8d, r9d
nop dword [rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1404fffc8]
add r10d, r8d
cmp r9d, r10d
jge 0x1400fd381
inc rax
jmp 0x1400fd360
mov al, 0x9d
xchg byte [0x1404f4cb8], al
lea rax, [0x1404f4ca0]
ret
xor edx, edx
lea rax, [0x1404f4dc0]
lea rcx, [0x140428c20]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
add r8b, 0xdd
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
add r8b, 0x23
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 6
jl 0x1400fd3b0
mov al, 0xf9
xchg byte [0x1404f4dc6], al
lea rax, [0x1404f4dc0]
ret
xor eax, eax
lea rcx, [0x1404f4e50]
lea rdx, [0x140428cb0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1400fd438
inc rax
jmp 0x1400fd410
mov al, 0xc5
xchg byte [0x1404f4e5f], al
lea rax, [0x1404f4e50]
ret
xor eax, eax
lea rcx, [0x1404f4c40]
lea rdx, [0x140428ac0]
nop dword [rax + rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
cmp r9d, 0xf
jg 0x1400fd488
inc rax
jmp 0x1400fd460
xor r8b, 0x83
add r8b, byte [0x1404fffd8]
xchg byte [0x1404f4c50], r8b
lea rax, [0x1404f4c40]
ret
Function at 0x1400fd4b0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1400fd4ec
test edx, edx
je 0x1400fd528
movzx eax, byte [0x1404f4c75]
cmp al, 0x84
je 0x1400fd4e4
mov cl, 0xf5
nop word [rax + rax]
mov al, 0xf0
lock cmpxchg byte [0x1404f4c75], cl
je 0x1400fd59c
cmp al, 0x84
jne 0x1400fd4d0
lea rax, [0x1404f4c60]
ret
test edx, edx
je 0x1400fd56c
movzx eax, byte [0x1404f4d66]
cmp al, 8
je 0x1400fd520
mov cl, 0xd6
nop dword [rax]
mov al, 0x69
lock cmpxchg byte [0x1404f4d66], cl
je 0x1400fd5d8
mov edx, r8d
xor dl, 0x4d
add dl, byte [0x1404fffd8]
cmp al, dl
jne 0x1400fd500
lea rax, [0x1404f4d50]
ret
movzx eax, byte [0x1404f4dd5]
mov ecx, r8d
xor cl, 0x22
add cl, byte [0x1404fffd8]
cmp al, cl
je 0x1400fd564
mov cl, 0x3a
nop word cs:[rax + rax]
mov al, 0x3f
lock cmpxchg byte [0x1404f4dd5], cl
je 0x1400fd63a
cmp al, 0xf7
jne 0x1400fd550
lea rax, [0x1404f4dd0]
ret
movzx eax, byte [0x1404f4de3]
cmp al, 0x9d
je 0x1400fd594
mov cl, 0xd9
nop dword [rax]
mov al, 0x90
lock cmpxchg byte [0x1404f4de3], cl
je 0x1400fd68d
cmp al, 0x9d
jne 0x1400fd580
lea rax, [0x1404f4de0]
ret
xor eax, eax
lea rcx, [0x1404f4c60]
lea rdx, [0x140428ad0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1400fd5c8
inc rax
jmp 0x1400fd5b0
mov al, 0x84
xchg byte [0x1404f4c75], al
lea rax, [0x1404f4c60]
ret
xor eax, eax
lea rcx, [0x1404f4d50]
lea rdx, [0x140428bc0]
mov r9d, r8d
xor r9d, 0xe56ef9c6
mov r10d, r8d
xor r10d, 0xe56ef9ed
nop dword [rax]
cdqe
movzx r11d, byte [rax + rdx]
xor byte [rax + rcx], r11b
mov r11d, dword [0x1404fffc8]
add eax, r9d
add eax, r11d
add r11d, r10d
cmp eax, r11d
jl 0x1400fd600
xor r8b, 0x4d
add r8b, byte [0x1404fffd8]
xchg byte [0x1404f4d66], r8b
lea rax, [0x1404f4d50]
ret
xor eax, eax
lea rcx, [0x1404f4dd0]
lea rdx, [0x140428c30]
xor r8d, 0xe56ef9c6
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x1404fffc8]
add r9d, r8d
add eax, r9d
cmp eax, 5
jl 0x1400fd660
mov al, 0xf7
xchg byte [0x1404f4dd5], al
lea rax, [0x1404f4dd0]
ret
xor edx, edx
lea rax, [0x1404f4de0]
lea rcx, [0x140428c40]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 3
jl 0x1400fd6a0
mov al, 0x9d
xchg byte [0x1404f4de3], al
lea rax, [0x1404f4de0]
ret
Function at 0x140101390
Capabilities:
Encode data using xor

Disassembly:
mov eax, r9d
not eax
mov edx, r9d
xor edx, 0xe225e467
and edx, eax
mov r8d, r9d
xor r8d, 0x1dda1b98
and eax, 0xe225e467
or eax, r8d
not eax
or eax, edx
add eax, dword [0x140500a64]
cmp ecx, eax
jne 0x1401013e8
movzx eax, byte [0x140500a63]
cmp al, 0x6b
je 0x1401013e0
mov cl, 0x3a
nop dword [rax]
mov al, 0xf7
lock cmpxchg byte [0x140500a63], cl
je 0x140101418
cmp al, 0x6b
jne 0x1401013d0
lea rax, [0x140500a40]
ret
movzx eax, byte [0x140500a30]
cmp al, 0xfd
je 0x140101410
mov cl, 0xac
nop word cs:[rax + rax]
mov al, 0xc5
lock cmpxchg byte [0x140500a30], cl
je 0x140101451
cmp al, 0xfd
jne 0x140101400
lea rax, [0x140500a20]
ret
xor eax, eax
lea rcx, [0x140500a40]
lea rdx, [0x140429300]
xor r9d, 0xe225e58a
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
mov r10d, dword [0x140500a64]
add r10d, r9d
cmp r8d, r10d
jge 0x1401014b9
inc rax
jmp 0x140101430
xor eax, eax
lea rcx, [0x140500a20]
lea rdx, [0x1404292f0]
xor r9d, 0xe225e464
nop dword [rax + rax]
cdqe
movzx r8d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
add r8b, 0x65
mov r11d, r8d
xor r11b, r10b
and r8b, r10b
add r8b, r8b
add r8b, r11b
add r8b, 0x9b
mov byte [rax + rcx], r8b
mov r8d, dword [0x140500a64]
add r8d, r9d
add eax, r8d
cmp eax, 0x10
jl 0x140101470
mov al, 0xfd
xchg byte [0x140500a30], al
lea rax, [0x140500a20]
ret
mov al, 0x6b
xchg byte [0x140500a63], al
lea rax, [0x140500a40]
ret
Function at 0x140108a20
Capabilities:
Encode data using xor

Disassembly:
push rbx
test ecx, ecx
je 0x140108a6f
test edx, edx
je 0x140108af2
movzx eax, byte [0x140500d7d]
cmp al, 0xb3
je 0x140108bb5
mov cl, 0x88
nop
mov al, 0x84
lock cmpxchg byte [0x140500d7d], cl
je 0x140108b59
movzx edx, byte [0x140500f94]
mov r8d, edx
xor r8b, 0x38
and dl, 0x38
add dl, dl
add dl, r8b
cmp al, dl
jne 0x140108a40
jmp 0x140108bb5
test edx, edx
je 0x140108b29
movzx eax, byte [0x140500d13]
nop
cmp al, 0xfd
je 0x140108ae9
movzx ecx, byte [0x140500f94]
mov edx, ecx
xor dl, 0xa2
mov eax, ecx
and al, 0x22
add al, al
add al, dl
add cl, 0xc5
lock cmpxchg byte [0x140500d13], cl
jne 0x140108a80
xor edx, edx
lea rax, [0x140500d10]
lea rcx, [0x1404293a0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x140500f90]
add edx, r8d
add edx, 0xcb991b02
cmp edx, 3
jl 0x140108ac0
mov al, 0xfd
xchg byte [0x140500d13], al
lea rax, [0x140500d10]
pop rbx
ret
movzx eax, byte [0x140500d69]
cmp al, 0xc8
je 0x140108c2e
mov cl, 0xfe
nop word cs:[rax + rax]
mov al, 0xdf
lock cmpxchg byte [0x140500d69], cl
je 0x140108bbe
cmp al, 0xc8
jne 0x140108b10
jmp 0x140108c2e
movzx eax, byte [0x140500d43]
cmp al, 0x31
je 0x140108c94
mov cl, 0x89
nop word [rax + rax]
mov al, 0x9a
lock cmpxchg byte [0x140500d43], cl
je 0x140108c37
cmp al, 0x31
jne 0x140108b40
jmp 0x140108c94
xor edx, edx
lea rax, [0x140500d70]
lea rcx, [0x140429400]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
add r8b, 0x27
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
add r8b, 0xd9
mov byte [rdx + rax], r8b
mov r8d, dword [0x140500f90]
add edx, r8d
add edx, 0xcb991b02
cmp edx, 0xd
jl 0x140108b70
mov al, 0xb3
xchg byte [0x140500d7d], al
lea rax, [0x140500d70]
pop rbx
ret
xor r8d, r8d
lea rax, [0x140500d60]
lea rcx, [0x1404293f0]
mov edx, 0xcb991b0a
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rax]
movzx r10d, byte [r8 + rcx]
mov r11d, r9d
not r11b
mov ebx, r10d
xor bl, r11b
and r11b, r10b
not bl
and bl, r9b
or bl, r11b
mov byte [r8 + rax], bl
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x140500f90]
add r9d, edx
cmp r8d, r9d
jl 0x140108be0
mov al, 0xc8
xchg byte [0x140500d69], al
lea rax, [0x140500d60]
pop rbx
ret
xor edx, edx
lea rax, [0x140500d20]
lea rcx, [0x1404293b0]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, r8b
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x23
jl 0x140108c50
mov al, 0x31
xchg byte [0x140500d43], al
lea rax, [0x140500d20]
pop rbx
ret