joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14039d1a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x5a062f0b
add eax, dword [0x140548430]
cmp ecx, eax
jne 0x14039d1dc
test edx, edx
je 0x14039d21c
movzx eax, byte [0x140546e41]
cmp al, 0xaa
je 0x14039d1d4
mov cl, 0xca
mov al, 0x97
lock cmpxchg byte [0x140546e41], cl
je 0x14039d2bc
cmp al, 0xaa
jne 0x14039d1c0
lea rax, [0x140546e30]
ret
test edx, edx
je 0x14039d261
movzx eax, byte [0x140546d77]
movzx ecx, byte [0x140548434]
add cl, 0x5b
cmp al, cl
je 0x14039d214
mov cl, 0x79
nop dword [rax + rax]
mov al, 0x15
lock cmpxchg byte [0x140546d77], cl
je 0x14039d328
cmp al, 5
jne 0x14039d200
lea rax, [0x140546d70]
ret
movzx eax, byte [0x140546fc1]
cmp al, 0xcf
je 0x14039d259
nop word [rax + rax]
movzx ecx, byte [0x140548434]
lea eax, [rcx + 0x4c]
add cl, 0x9c
lock cmpxchg byte [0x140546fc1], cl
je 0x14039d368
movzx ecx, byte [0x140548434]
add cl, 0x25
cmp al, cl
jne 0x14039d230
lea rax, [0x140546fa0]
ret
movzx eax, byte [0x140546c25]
nop dword [rax + rax]
cmp al, 0xd6
je 0x14039d3ce
movzx ecx, byte [0x140548434]
lea eax, [rcx + 0x53]
add cl, 0xc
lock cmpxchg byte [0x140546c25], cl
jne 0x14039d270
xor eax, eax
lea rcx, [0x140546c20]
lea rdx, [0x14044f0d0]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x14039d3c6
inc rax
jmp 0x14039d2a0
xor eax, eax
lea rcx, [0x140546e30]
lea rdx, [0x14044f2d0]
nop dword [rax]
cdqe
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
mov r8d, dword [0x140548430]
mov r9d, r8d
xor r9d, 0x5a062f0c
and r8d, 0x5a062f0c
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0x11
jl 0x14039d2d0
movzx eax, byte [0x140548434]
xchg byte [0x140546e41], al
lea rax, [0x140546e30]
ret
xor eax, eax
lea rcx, [0x140546d70]
lea rdx, [0x14044f210]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 6
jg 0x14039d358
inc rax
jmp 0x14039d340
mov al, 5
xchg byte [0x140546d77], al
lea rax, [0x140546d70]
ret
xor eax, eax
lea rcx, [0x140546fa0]
lea rdx, [0x14044f420]
nop dword [rax + rax]
cdqe
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
mov r8d, dword [0x140548430]
mov r9d, r8d
xor r9d, 0x5a062f0c
and r8d, 0x5a062f0c
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0x21
jl 0x14039d380
movzx eax, byte [0x140548434]
add al, 0x25
xchg byte [0x140546fc1], al
lea rax, [0x140546fa0]
ret
mov al, 0xd6
xchg byte [0x140546c25], al
lea rax, [0x140546c20]
ret
Function at 0x14039d410
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14039d4b5
mov eax, 0x5a062f0b
add eax, dword [0x140548430]
cmp edx, eax
jne 0x14039d501
movzx eax, byte [0x140546bcd]
nop word cs:[rax + rax]
cmp al, 0xad
je 0x14039d5f3
movzx ecx, byte [0x140548434]
lea eax, [rcx - 0x7b]
add cl, 0xe9
lock cmpxchg byte [0x140546bcd], cl
jne 0x14039d440
xor eax, eax
lea rcx, [0x140546bc0]
lea rdx, [0x14044f070]
mov r8d, 0x5a062f18
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x140548430]
add r10d, r8d
cmp r9d, r10d
jge 0x14039d5eb
inc rax
jmp 0x14039d480
test edx, edx
je 0x14039d575
movzx eax, byte [0x140546d85]
cmp al, 0xc4
je 0x14039d4f9
nop dword [rax + rax]
movzx ecx, byte [0x140548434]
lea eax, [rcx - 0x3f]
add cl, 0xe9
lock cmpxchg byte [0x140546d85], cl
je 0x14039d5fb
movzx ecx, byte [0x140548434]
add cl, 0x1a
cmp al, cl
jne 0x14039d4d0
lea rax, [0x140546d80]
ret
movzx eax, byte [0x1405470aa]
nop dword [rax + rax]
cmp al, 0x69
je 0x14039d56d
movzx ecx, byte [0x140548434]
lea eax, [rcx - 4]
add cl, 0x3f
lock cmpxchg byte [0x1405470aa], cl
jne 0x14039d510
xor edx, edx
lea rax, [0x1405470a0]
lea rcx, [0x14044f520]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0x7ffffffe
and r8d, edx
xor edx, 1
lea edx, [rdx + r8*2]
cmp edx, 0xa
jl 0x14039d540
mov al, 0x69
xchg byte [0x1405470aa], al
lea rax, [0x1405470a0]
ret
movzx eax, byte [0x140546f9b]
nop dword [rax]
cmp al, 0x9c
je 0x14039d5e3
movzx ecx, byte [0x140548434]
lea eax, [rcx - 0x72]
add cl, 0x50
lock cmpxchg byte [0x140546f9b], cl
jne 0x14039d580
xor edx, edx
lea rax, [0x140546f90]
lea rcx, [0x14044f410]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0x4925a137
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0xb6da5ec9
cmp edx, 0xb
jl 0x14039d5b0
mov al, 0x9c
xchg byte [0x140546f9b], al
lea rax, [0x140546f90]
ret
mov al, 0xad
xchg byte [0x140546bcd], al
lea rax, [0x140546bc0]
ret
xor eax, eax
lea rcx, [0x140546d80]
lea rdx, [0x14044f220]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
add r8b, byte [rax + rdx]
add r8b, 0x3a
mov r9d, r8d
xor r9b, 0xc6
and r8b, 0x46
add r8b, r8b
add r8b, r9b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x14039d641
inc rax
jmp 0x14039d610
mov al, 0xc4
xchg byte [0x140546d85], al
lea rax, [0x140546d80]
ret
Function at 0x14039d8a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x14039d8e6
test edx, edx
je 0x14039d91c
movzx eax, byte [0x140546f6d]
movzx ecx, byte [0x140548434]
add cl, 0x17
cmp al, cl
je 0x14039d8de
mov cl, 0x50
nop
mov al, 0xeb
lock cmpxchg byte [0x140546f6d], cl
je 0x14039d98c
movzx edx, byte [0x140548434]
add dl, 0x17
cmp al, dl
jne 0x14039d8c0
lea rax, [0x140546f60]
ret
test edx, edx
je 0x14039d94c
movzx eax, byte [0x140546f1a]
cmp al, 0xff
je 0x14039d914
mov cl, 0x7a
nop word [rax + rax]
mov al, 0x3c
lock cmpxchg byte [0x140546f1a], cl
je 0x14039d9c8
cmp al, 0xff
jne 0x14039d900
lea rax, [0x140546f00]
ret
movzx eax, byte [0x14054712f]
cmp al, 0xdd
je 0x14039d944
mov cl, 0x5d
nop dword [rax]
mov al, 0xa9
lock cmpxchg byte [0x14054712f], cl
je 0x14039da11
cmp al, 0xdd
jne 0x14039d930
lea rax, [0x140547110]
ret
movzx eax, byte [0x140546d95]
movzx ecx, byte [0x140548434]
add cl, 0xe4
cmp al, cl
je 0x14039d984
mov cl, 0xa4
nop word cs:[rax + rax]
mov al, 0x47
lock cmpxchg byte [0x140546d95], cl
je 0x14039da58
cmp al, 0x8e
jne 0x14039d970
lea rax, [0x140546d90]
ret
xor eax, eax
lea rcx, [0x140546f60]
lea rdx, [0x14044f3e0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14039d9b8
inc rax
jmp 0x14039d9a0
mov al, 0xc1
xchg byte [0x140546f6d], al
lea rax, [0x140546f60]
ret
xor eax, eax
lea rcx, [0x140546f00]
lea rdx, [0x14044f390]
mov r8d, 0x5a062f25
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140548430]
add r10d, r8d
cmp r9d, r10d
jge 0x14039da01
inc rax
jmp 0x14039d9e0
mov al, 0xff
xchg byte [0x140546f1a], al
lea rax, [0x140546f00]
ret
xor eax, eax
lea rcx, [0x140547110]
lea rdx, [0x14044f590]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1e
jg 0x14039da48
inc rax
jmp 0x14039da30
mov al, 0xdd
xchg byte [0x14054712f], al
lea rax, [0x140547110]
ret
xor eax, eax
lea rcx, [0x140546d90]
lea rdx, [0x14044f230]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x14039da88
inc rax
jmp 0x14039da70
movzx eax, byte [0x140548434]
add al, 0xe4
xchg byte [0x140546d95], al
lea rax, [0x140546d90]
ret
Function at 0x14039eab0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14039eb0a
test edx, edx
je 0x14039eb4c
movzx eax, byte [0x1405472b0]
cmp al, 0xa0
je 0x14039eb02
mov cl, 0x3a
nop
mov al, 0x62
lock cmpxchg byte [0x1405472b0], cl
je 0x14039ebac
movzx edx, byte [0x140548434]
mov r9d, r8d
xor r9b, 0x2b
mov r10d, r9d
xor r10b, dl
and r9b, dl
add r9b, r9b
add r9b, r10b
cmp al, r9b
jne 0x14039ead0
lea rax, [0x1405472a0]
ret
mov eax, r8d
xor eax, 0x8a942dd6
add eax, dword [0x140548430]
cmp edx, eax
jne 0x14039eb78
movzx eax, byte [0x140546e0a]
cmp al, 0x89
je 0x14039eb44
mov cl, 0xff
nop dword [rax]
mov al, 0x86
lock cmpxchg byte [0x140546e0a], cl
je 0x14039ec2d
cmp al, 0x89
jne 0x14039eb30
lea rax, [0x140546e00]
ret
movzx eax, byte [0x14054727e]
cmp al, 0x86
je 0x14039eb70
mov cl, 0x5b
nop dword [rax]
mov al, 0x79
lock cmpxchg byte [0x14054727e], cl
je 0x14039ebe8
cmp al, 0x86
jne 0x14039eb60
lea rax, [0x140547270]
ret
movzx eax, byte [0x140547227]
cmp al, 0xe
je 0x14039eba4
mov cl, 0x72
nop word cs:[rax + rax]
mov al, 0xaa
lock cmpxchg byte [0x140547227], cl
je 0x14039ec68
cmp al, 0xe
jne 0x14039eb90
lea rax, [0x140547220]
ret
xor eax, eax
lea rcx, [0x1405472a0]
lea rdx, [0x14044f710]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x14039ebd8
inc rax
jmp 0x14039ebc0
mov al, 0xa0
xchg byte [0x1405472b0], al
lea rax, [0x1405472a0]
ret
xor eax, eax
lea rcx, [0x140547270]
lea rdx, [0x14044f6e0]
xor r8d, 0x8a942dd1
nop
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x140548430]
add r9d, r8d
add eax, r9d
cmp eax, 0xe
jl 0x14039ec00
mov al, 0x86
xchg byte [0x14054727e], al
lea rax, [0x140547270]
ret
xor eax, eax
lea rcx, [0x140546e00]
lea rdx, [0x14044f2a0]
nop dword [rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
cmp r9d, 9
jg 0x14039ecb7
inc rax
jmp 0x14039ec40
xor eax, eax
lea rcx, [0x140547220]
lea rdx, [0x14044f690]
xor r8d, 0x8a942dd1
nop
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x140548430]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 7
jl 0x14039ec80
mov al, 0xe
xchg byte [0x140547227], al
lea rax, [0x140547220]
ret
xor r8b, 2
add r8b, byte [0x140548434]
xchg byte [0x140546e0a], r8b
lea rax, [0x140546e00]
ret
Function at 0x14039f340
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x14039f379
test edx, edx
je 0x14039f3a9
movzx eax, byte [0x140548c8f]
cmp al, 0x3c
je 0x14039f44a
mov cl, 0xbf
nop
mov al, 0x3d
lock cmpxchg byte [0x140548c8f], cl
je 0x14039f409
cmp al, 0x3c
jne 0x14039f360
jmp 0x14039f44a
test edx, edx
je 0x14039f3d9
movzx eax, byte [0x140548c32]
cmp al, 0x2d
je 0x14039f51e
mov cl, 0xca
nop
mov al, 0x4d
lock cmpxchg byte [0x140548c32], cl
je 0x14039f453
cmp al, 0x2d
jne 0x14039f390
jmp 0x14039f51e
movzx eax, byte [0x140548bdd]
cmp al, 0xe6
je 0x14039f50d
mov cl, 0xb9
nop word [rax + rax]
mov al, 0xb0
lock cmpxchg byte [0x140548bdd], cl
je 0x14039f49c
cmp al, 0xe6
jne 0x14039f3c0
jmp 0x14039f50d
movzx eax, byte [0x140548c73]
cmp al, 0x36
je 0x14039f569
mov cl, 0x21
nop word [rax + rax]
mov al, 0xa4
lock cmpxchg byte [0x140548c73], cl
je 0x14039f527
cmp al, 0x36
jne 0x14039f3f0
jmp 0x14039f569
xor eax, eax
lea rcx, [0x140548c80]
lea rdx, [0x14044fb60]
nop dword [rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xe
jg 0x14039f438
inc rax
jmp 0x14039f420
xor r8b, 0x9a
add r8b, byte [0x140548cd8]
xchg byte [0x140548c8f], r8b
lea rax, [0x140548c80]
pop rbx
ret
xor eax, eax
lea rcx, [0x140548c20]
lea rdx, [0x14044fb00]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x14039f516
inc rax
jmp 0x14039f470
xor eax, eax
lea rcx, [0x140548bd0]
lea rdx, [0x14044fac0]
mov r9d, r8d
xor r9d, 0xe48554c4
nop word cs:[rax + rax]
cdqe
movzx r10d, byte [rax + rcx]
movzx r11d, byte [rax + rdx]
mov ebx, r10d
xor bl, r11b
and r10b, r11b
add r10b, r10b
add r10b, bl
mov byte [rax + rcx], r10b
mov r10d, dword [0x140548cdc]
mov r11d, r9d
xor r11d, r10d
and r10d, r9d
lea r10d, [r11 + r10*2]
add eax, r10d
cmp eax, 0xd
jl 0x14039f4c0
xor r8b, 0x6c
add r8b, byte [0x140548cd8]
xchg byte [0x140548bdd], r8b
lea rax, [0x140548bd0]
pop rbx
ret
mov al, 0x2d
xchg byte [0x140548c32], al
lea rax, [0x140548c20]
pop rbx
ret
xor eax, eax
lea rcx, [0x140548c50]
lea rdx, [0x14044fb30]
xor r8d, 0xe4855526
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140548cdc]
add r10d, r8d
cmp r9d, r10d
jge 0x14039f561
inc rax
jmp 0x14039f540
mov al, 0x36
xchg byte [0x140548c73], al
lea rax, [0x140548c50]
pop rbx
ret
Function at 0x1403a2b70
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1403a2bac
test edx, edx
je 0x1403a2bfc
movzx eax, byte [0x140548f2b]
cmp al, 0xf2
je 0x1403a2ba4
mov cl, 0x31
nop word [rax + rax]
mov al, 0x73
lock cmpxchg byte [0x140548f2b], cl
je 0x1403a2c5c
cmp al, 0xf2
jne 0x1403a2b90
lea rax, [0x140548f10]
ret
test edx, edx
je 0x1403a2c2c
movzx eax, byte [0x140548dab]
cmp al, 0x64
je 0x1403a2bf4
nop dword [rax + rax]
movzx ecx, byte [0x1405493e0]
mov eax, r8d
xor al, 0x61
add al, cl
mov edx, r8d
xor dl, 0xf7
add dl, cl
lock cmpxchg byte [0x140548dab], dl
je 0x1403a2cc8
mov ecx, r8d
xor cl, 0xa5
add cl, byte [0x1405493e0]
cmp al, cl
jne 0x1403a2bc0
lea rax, [0x140548da0]
ret
movzx eax, byte [0x140548f90]
cmp al, 0x52
je 0x1403a2c24
mov cl, 0xfd
nop dword [rax]
mov al, 0xae
lock cmpxchg byte [0x140548f90], cl
je 0x1403a2cf8
cmp al, 0x52
jne 0x1403a2c10
lea rax, [0x140548f80]
ret
movzx eax, byte [0x140548d5a]
cmp al, 0xa7
je 0x1403a2c54
mov cl, 0xcb
nop dword [rax]
mov al, 0xf4
lock cmpxchg byte [0x140548d5a], cl
je 0x1403a2d6a
cmp al, 0xa7
jne 0x1403a2c40
lea rax, [0x140548d50]
ret
xor eax, eax
lea rcx, [0x140548f10]
lea rdx, [0x14044fdb0]
xor r8d, 0x64a3df3
nop word cs:[rax + rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
not r9b
mov r11d, r9d
and r11b, r10b
or r9b, r10b
not r9b
or r9b, r11b
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405493d0]
add r10d, r8d
cmp r9d, r10d
jge 0x1403a2cb8
inc rax
jmp 0x1403a2c80
mov al, 0xf2
xchg byte [0x140548f2b], al
lea rax, [0x140548f10]
ret
xor eax, eax
lea rcx, [0x140548da0]
lea rdx, [0x14044fc60]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x1403a2d5a
inc rax
jmp 0x1403a2ce0
xor edx, edx
lea rax, [0x140548f80]
lea rcx, [0x14044fe10]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
add edx, edx
and edx, 2
mov r9d, r8d
xor r9d, edx
and edx, r8d
lea edx, [r9 + rdx*2]
cmp edx, 0x10
jl 0x1403a2d10
mov al, 0x52
xchg byte [0x140548f90], al
lea rax, [0x140548f80]
ret
mov al, 0x64
xchg byte [0x140548dab], al
lea rax, [0x140548da0]
ret
xor edx, edx
lea rax, [0x140548d50]
lea rcx, [0x14044fc20]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
add edx, 0x449fe838
mov r8d, edx
xor r8d, 0xbb6017c9
and edx, 0x3b6017c9
lea edx, [r8 + rdx*2]
cmp edx, 0xa
jl 0x1403a2d80
mov al, 0xa7
xchg byte [0x140548d5a], al
lea rax, [0x140548d50]
ret
Function at 0x1403a4ec0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rsi, r8
mov edi, edx
mov ebx, ecx
cmp qword [0x14055f540], 0
jne 0x1403a5000
mov eax, dword [0x140549cb8]
lea ecx, [rax - 0x5c426f39]
lea rdx, [fcn.1403a4ec0]
add edx, edx
add edx, 0x1460
and edx, ecx
mov ecx, eax
xor ecx, 0xa3bd90c6
and eax, 0x23bd90c6
add eax, eax
mov r8d, ecx
xor r8d, eax
and eax, ecx
lea eax, [r8 + rax*2]
cmp edx, eax
jne 0x1403a4f74
mov dword [rsp + 0x20], 0xd347f021
xor ecx, ecx
xor edx, edx
mov r8d, 0xc47fb644
mov r9d, 0x97590d50
call fcn.1403a61b0
mov r14, rax
xor ecx, ecx
mov edx, 0x5158879e
mov r8d, 0x97127699
mov r9d, 0xa1303e1f
call fcn.1403a57b0
mov rcx, r14
mov rdx, rax
call fcn.1403a50a0
mov qword [0x14055f540], rax
mov eax, dword [0x14055f554]
cmp eax, 0x39
jl 0x1403a5000
lea rax, [fcn.1403a4ec0]
lea ebp, [rax + rax]
add ebp, 0x4a80
nop word cs:[rax + rax]
mov dword [rsp + 0x20], 0xd347f021
xor ecx, ecx
xor edx, edx
mov r8d, 0xc47fb644
mov r9d, 0x97590d50
call fcn.1403a61b0
mov r14, rax
xor ecx, ecx
mov edx, 0x5158879e
mov r8d, 0x97127699
mov r9d, 0xa1303e1f
call fcn.1403a57b0
mov rcx, r14
mov rdx, rax
call fcn.1403a50a0
mov qword [0x14055f540], rax
mov eax, dword [0x140549cb8]
lea ecx, [rax - 0x5c426f39]
mov edx, ebp
xor edx, ecx
or ecx, ebp
not ecx
or ecx, edx
not ecx
add eax, 0xa3bd90c6
cmp ecx, eax
jne 0x1403a4f90
jmp 0x1403a4f1b
mov rax, qword [0x14055f540]
mov ecx, ebx
mov edx, edi
mov r8, rsi
call qword [case.0x140303ece.0]
nop
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1403a5690
Capabilities:
Enumerate processes

Disassembly:
sub rsp, 0x28
mov eax, 0xefffad88
xor eax, dword [rsp + 0x58]
add eax, dword [0x140549cb8]
cmp ecx, eax
jne 0x1403a56b4
mov rcx, rdx
mov rdx, r8
call sub.KERNEL32.dll_Process32Next
jmp 0x1403a56bf
mov rcx, rdx
mov rdx, r8
call sub.KERNEL32.dll_Process32First
nop
add rsp, 0x28
ret
Function at 0x1403a9750
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8d, dword [rsp + 0x38]
test ecx, ecx
je 0x1403a9789
test edx, edx
je 0x1403a97c9
movzx eax, byte [0x140549ded]
cmp al, 0xd0
je 0x1403a9860
mov cl, 0xf6
mov al, 0xee
lock cmpxchg byte [0x140549ded], cl
je 0x1403a9829
cmp al, 0xd0
jne 0x1403a9770
jmp 0x1403a9860
mov eax, r8d
xor eax, 0x41bd99c2
add eax, dword [0x140549f38]
cmp edx, eax
jne 0x1403a97f9
movzx eax, byte [0x140549e83]
cmp al, 0x82
je 0x1403a99cd
mov cl, 0x14
nop dword [rax]
mov al, 0xab
lock cmpxchg byte [0x140549e83], cl
je 0x1403a995e
cmp al, 0x82
jne 0x1403a97b0
jmp 0x1403a99cd
movzx eax, byte [0x140549e5b]
cmp al, 0xda
je 0x1403a98e0
mov cl, 0x4a
nop word [rax + rax]
mov al, 0xe
lock cmpxchg byte [0x140549e5b], cl
je 0x1403a986c
cmp al, 0xda
jne 0x1403a97e0
jmp 0x1403a98e0
cmp byte [0x140549ecf], 0
je 0x1403a9955
mov cl, 0x52
nop dword [rax + rax]
mov al, 0x2e
lock cmpxchg byte [0x140549ecf], cl
je 0x1403a98ec
test al, al
jne 0x1403a9810
jmp 0x1403a9955
xor eax, eax
lea rcx, [0x140549de0]
lea rdx, [0x140450580]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1403a9858
inc rax
jmp 0x1403a9840
mov al, 0xd0
xchg byte [0x140549ded], al
lea rax, [0x140549de0]
jmp 0x1403a99d4
xor eax, eax
lea rcx, [0x140549e40]
lea rdx, [0x1404505e0]
mov r9d, r8d
xor r9d, 0x41bd99c1
nop word cs:[rax + rax]
cdqe
movzx r10d, byte [rax + rcx]
movzx r11d, byte [rax + rdx]
mov ebx, r10d
not bl
not r11b
mov esi, ebx
xor sil, r11b
and sil, bl
xor r11b, r10b
not r11b
and r11b, r10b
or r11b, sil
mov byte [rax + rcx], r11b
mov r10d, dword [0x140549f38]
add r10d, r9d
add eax, r10d
cmp eax, 0x1b
jl 0x1403a9890
xor r8b, 0xaa
add r8b, byte [0x140549f3c]
xchg byte [0x140549e5b], r8b
lea rax, [0x140549e40]
jmp 0x1403a99d4
xor eax, eax
lea rcx, [0x140549ec0]
lea rdx, [0x140450660]
xor r8d, 0x41bd99b3
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140549f38]
add r10d, r8d
add r10d, 0x4b857642
mov r11d, r10d
xor r11d, 0xb47a89be
and r10d, 0x347a89be
lea r10d, [r11 + r10*2]
cmp r9d, r10d
jge 0x1403a994d
inc rax
jmp 0x1403a9910
xor eax, eax
xchg byte [0x140549ecf], al
lea rax, [0x140549ec0]
jmp 0x1403a99d4
xor edx, edx
lea rax, [0x140549e80]
lea rcx, [0x140450620]
xor r8d, 0x41bd99c1
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, dword [0x140549f38]
xor r9d, r8d
mov r10d, r9d
not r10d
and r10d, r8d
lea r9d, [r9 + r10*2]
add edx, r9d
add edx, 0x87b2f638
mov r9d, edx
xor r9d, 0x784d09c8
and edx, 0x784d09c8
lea edx, [r9 + rdx*2]
cmp edx, 3
jl 0x1403a9980
mov al, 0x82
xchg byte [0x140549e83], al
lea rax, [0x140549e80]
pop rbx
pop rsi
ret
Function at 0x1403aa120
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403aa15c
test edx, edx
je 0x1403aa19c
movzx eax, byte [0x140549f5c]
cmp al, 0xcc
je 0x1403aa154
mov cl, 0xea
nop word cs:[rax + rax]
mov al, 0xf1
lock cmpxchg byte [0x140549f5c], cl
je 0x1403aa1fc
cmp al, 0xcc
jne 0x1403aa140
lea rax, [0x140549f50]
ret
mov eax, 0x672e55ee
add eax, dword [0x140549ff8]
cmp edx, eax
jne 0x1403aa1cc
movzx eax, byte [0x140549fef]
cmp al, 0x7d
je 0x1403aa194
mov cl, 0x68
nop dword [rax + rax]
mov al, 0xaf
lock cmpxchg byte [0x140549fef], cl
je 0x1403aa2c1
cmp al, 0x7d
jne 0x1403aa180
lea rax, [0x140549fe0]
ret
movzx eax, byte [0x140549f92]
cmp al, 0x32
je 0x1403aa1c4
mov cl, 0x7d
nop dword [rax]
mov al, 0xc
lock cmpxchg byte [0x140549f92], cl
je 0x1403aa278
cmp al, 0x32
jne 0x1403aa1b0
lea rax, [0x140549f80]
ret
movzx eax, byte [0x140549fda]
cmp al, 0x86
je 0x1403aa1f4
mov cl, 0xb
nop dword [rax]
mov al, 0x7e
lock cmpxchg byte [0x140549fda], cl
je 0x1403aa315
cmp al, 0x86
jne 0x1403aa1e0
lea rax, [0x140549fc0]
ret
xor edx, edx
lea rax, [0x140549f50]
lea rcx, [0x140450690]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
mov r8d, dword [0x140549ff8]
mov r9d, r8d
xor r9d, 0x672e55fa
not r8d
and r8d, 0x18d1aa05
or r8d, r9d
not r8d
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x1403aa210
mov al, 0xcc
xchg byte [0x140549f5c], al
lea rax, [0x140549f50]
ret
xor edx, edx
lea rax, [0x140549f80]
lea rcx, [0x1404506c0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x140549ff8]
add edx, r8d
add edx, 0x672e55ef
cmp edx, 0x12
jl 0x1403aa290
mov al, 0x32
xchg byte [0x140549f92], al
lea rax, [0x140549f80]
ret
xor eax, eax
lea rcx, [0x140549fe0]
lea rdx, [0x140450720]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
not r9b
mov r11d, r10d
xor r11b, r9b
and r11b, r10b
and r9b, r8b
or r9b, r11b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1403aa35c
inc rax
jmp 0x1403aa2e0
xor eax, eax
lea rcx, [0x140549fc0]
lea rdx, [0x140450700]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x19
jg 0x1403aa373
inc rax
jmp 0x1403aa330
movzx eax, byte [0x140549ffc]
add al, 0x81
xchg byte [0x140549fef], al
lea rax, [0x140549fe0]
ret
mov al, 0x86
xchg byte [0x140549fda], al
lea rax, [0x140549fc0]
ret
Function at 0x1403af180
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov eax, edx
mov rcx, qword [0x14054b938]
xor rcx, rsp
mov qword [rsp + 0x40], rcx
movaps xmm0, xmmword [0x140455510]
movaps xmmword [rsp + 0x20], xmm0
movabs rcx, 0x1716151413121110
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x38], 0x18
movzx ecx, byte [0x14054bd00]
add cl, 0x1f
mov byte [rsp + 0x39], cl
mov byte [rsp + 0x3a], 0x1a
mov ecx, 0x1a
movabs r8, 0x410b97f569509a84
nop dword [rax]
imul r9d, eax, 0x6255
mov r10d, dword [0x14054bd04]
lea r11d, [rcx + r10]
add r11d, 0xef7d131a
xor edx, edx
div r11d
movzx eax, byte [rsp + rcx + 0x20]
movzx r11d, byte [rsp + rdx + 0x20]
mov byte [rsp + rcx + 0x20], r11b
mov byte [rsp + rdx + 0x20], al
mov eax, r9d
xor eax, 0x3619
not r9d
and r9d, 0x7fffc9e6
or r9d, eax
not r9d
lea eax, [rax + r9*2]
add r10d, 0xef7e1318
and r10d, eax
mov rdx, qword [0x14054bd08]
add rdx, rcx
add rdx, r8
mov eax, r10d
cmp rcx, 1
mov rcx, rdx
ja 0x1403af1e0
xor eax, eax
lea rdx, [0x140560910]
xor r8d, r8d
nop dword [rax]
movzx esi, byte [rsp + rax + 0x20]
movzx ecx, byte [0x14054bd00]
add cl, 0x15
mov r9d, 6
cmp sil, cl
ja 0x1403af2d0
mov r9d, 5
cmp sil, 7
ja 0x1403af2d0
movzx ecx, byte [0x14054bd00]
mov r9d, ecx
xor r9b, 0x13
and cl, 0x13
add cl, cl
add cl, r9b
add cl, 0xf6
mov r9d, 4
cmp sil, cl
ja 0x1403af2d0
mov r9d, 3
cmp sil, 1
ja 0x1403af2d0
cmp rsi, 1
mov r9d, 2
sbb r9d, 0
nop word cs:[rax + rax]
mov ecx, r8d
and ecx, 7
mov r10d, 0xffffffff
shl r10d, cl
mov r11d, r8d
and r11b, 7
add ecx, r9d
mov ebx, 0xffffffff
shl ebx, cl
xor ebx, r10d
mov ecx, r8d
shr ecx, 3
mov byte [rdx + rsi*4], cl
mov byte [rdx + rsi*4 + 3], r11b
mov byte [rdx + rsi*4 + 1], bl
mov byte [rdx + rsi*4 + 2], bh
cmp rax, 0x1a
je 0x1403af324
mov ecx, r9d
xor ecx, r8d
and r9d, r8d
lea r8d, [rcx + r9*2]
inc rax
jmp 0x1403af260
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1403e4d80
nop
add rsp, 0x48
pop rbx
pop rsi
ret