joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400fb680
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400fb6bc
test edx, edx
je 0x1400fb6ec
movzx eax, byte [0x1404c875f]
cmp al, 0x4a
je 0x1400fb6b4
mov cl, 0xb1
nop word cs:[rax + rax]
mov al, 0x9f
lock cmpxchg byte [0x1404c875f], cl
je 0x1400fb761
cmp al, 0x4a
jne 0x1400fb6a0
lea rax, [0x1404c8750]
ret
test edx, edx
je 0x1400fb71c
movzx eax, byte [0x1404c85b8]
cmp al, 0x22
je 0x1400fb6e4
mov cl, 0x99
nop dword [rax]
mov al, 0x72
lock cmpxchg byte [0x1404c85b8], cl
je 0x1400fb7c1
cmp al, 0x22
jne 0x1400fb6d0
lea rax, [0x1404c85a0]
ret
movzx eax, byte [0x1404c8635]
cmp al, 0x1d
je 0x1400fb714
mov cl, 0x5a
nop dword [rax]
mov al, 0x83
lock cmpxchg byte [0x1404c8635], cl
je 0x1400fb80f
cmp al, 0x1d
jne 0x1400fb700
lea rax, [0x1404c8620]
ret
movzx eax, byte [0x1404c8616]
cmp al, 0xe0
je 0x1400fb759
nop word [rax + rax]
movzx ecx, byte [0x1404d3e90]
lea eax, [rcx - 0x3a]
add cl, 0xc1
lock cmpxchg byte [0x1404c8616], cl
je 0x1400fb85c
movzx ecx, byte [0x1404d3e90]
add cl, 0x8b
cmp al, cl
jne 0x1400fb730
lea rax, [0x1404c8600]
ret
xor edx, edx
lea rax, [0x1404c8750]
lea rcx, [0x140400b60]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1404d3e94]
add edx, r8d
add edx, 0x9cb39ba5
cmp edx, 0xf
jl 0x1400fb780
movzx eax, byte [0x1404d3e90]
mov ecx, eax
xor cl, 0xf5
and al, 0x75
add al, al
add al, cl
xchg byte [0x1404c875f], al
lea rax, [0x1404c8750]
ret
xor edx, edx
lea rax, [0x1404c85a0]
lea rcx, [0x1404009c0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x18
jl 0x1400fb7e0
mov al, 0x22
xchg byte [0x1404c85b8], al
lea rax, [0x1404c85a0]
ret
xor eax, eax
lea rcx, [0x1404c8620]
lea rdx, [0x140400a40]
nop
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1400fb84c
inc rax
jmp 0x1400fb820
mov al, 0x1d
xchg byte [0x1404c8635], al
lea rax, [0x1404c8620]
ret
xor edx, edx
lea rax, [0x1404c8600]
lea rcx, [0x140400a20]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x16
jl 0x1400fb870
mov al, pe_nt_image_headers64
xchg byte [0x1404c8616], al
lea rax, [0x1404c8600]
ret
Function at 0x1400fb9b0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400fb9ec
mov eax, 0x9cb39ba4
add eax, dword [0x1404d3e94]
cmp edx, eax
jne 0x1400fba18
movzx eax, byte [0x1404c85f5]
cmp al, 4
je 0x1400fb9e4
mov cl, 0x9c
mov al, 0x3b
lock cmpxchg byte [0x1404c85f5], cl
je 0x1400fbab6
cmp al, 4
jne 0x1400fb9d0
lea rax, [0x1404c85e0]
ret
movzx eax, byte [0x1404c8690]
cmp al, 0x4a
je 0x1400fba10
mov cl, 0xf0
nop dword [rax]
mov al, 0xc1
lock cmpxchg byte [0x1404c8690], cl
je 0x1400fba4c
cmp al, 0x4a
jne 0x1400fba00
lea rax, [0x1404c8680]
ret
movzx eax, byte [0x1404c8592]
cmp al, 0xbc
je 0x1400fba44
mov cl, 0x14
nop word cs:[rax + rax]
mov al, 0x49
lock cmpxchg byte [0x1404c8592], cl
je 0x1400fbb05
cmp al, 0xbc
jne 0x1400fba30
lea rax, [0x1404c8580]
ret
xor eax, eax
lea rcx, [0x1404c8680]
lea rdx, [0x140400aa0]
nop dword [rax]
cdqe
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r9b
mov r10d, r9d
or r10b, r8b
not r10b
and r9b, r8b
or r9b, r10b
mov byte [rax + rcx], r9b
mov r8d, dword [0x1404d3e94]
mov r9d, r8d
xor r9d, 0x9cb39ba5
and r8d, 0x1cb39ba5
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0x10
jl 0x1400fba60
mov al, 0x4a
xchg byte [0x1404c8690], al
lea rax, [0x1404c8680]
ret
xor eax, eax
lea rcx, [0x1404c85e0]
lea rdx, [0x140400a00]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
not r9b
mov r11d, r10d
xor r11b, r9b
and r11b, r10b
and r9b, r8b
or r9b, r11b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1400fbb41
inc rax
jmp 0x1400fbad0
xor eax, eax
lea rcx, [0x1404c8580]
lea rdx, [0x1404009a0]
mov r8d, 0x9cb39bb6
nop dword [rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1404d3e94]
add r10d, r8d
cmp r9d, r10d
jge 0x1400fbb51
inc rax
jmp 0x1400fbb20
mov al, 4
xchg byte [0x1404c85f5], al
lea rax, [0x1404c85e0]
ret
mov al, 0xbc
xchg byte [0x1404c8592], al
lea rax, [0x1404c8580]
ret
Function at 0x1400fbc00
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400fbc66
mov eax, 0x9cb39ba4
add eax, dword [0x1404d3e94]
cmp edx, eax
jne 0x1400fbc9c
movzx eax, byte [0x1404c8538]
movzx ecx, byte [0x1404d3e90]
mov edx, ecx
xor dl, 0x8b
and cl, 0xb
add cl, cl
add cl, dl
cmp al, cl
je 0x1400fbc5e
mov cl, 0xc3
nop word [rax + rax]
mov al, 0xf2
lock cmpxchg byte [0x1404c8538], cl
je 0x1400fbd36
movzx edx, byte [0x1404d3e90]
add dl, 0x8b
cmp al, dl
jne 0x1400fbc40
lea rax, [0x1404c8530]
ret
test edx, edx
je 0x1400fbce1
movzx eax, byte [0x1404c8739]
cmp al, 0x51
je 0x1400fbc94
mov cl, 0xd6
nop word [rax + rax]
mov al, 3
lock cmpxchg byte [0x1404c8739], cl
je 0x1400fbdbf
cmp al, 0x51
jne 0x1400fbc80
lea rax, [0x1404c8730]
ret
movzx eax, byte [0x1404c8575]
cmp al, 0xf
je 0x1400fbcd9
nop word [rax + rax]
movzx ecx, byte [0x1404d3e90]
lea eax, [rcx - 0xf]
add cl, 0x5e
lock cmpxchg byte [0x1404c8575], cl
je 0x1400fbd68
movzx ecx, byte [0x1404d3e90]
add cl, 0xba
cmp al, cl
jne 0x1400fbcb0
lea rax, [0x1404c8560]
ret
movzx eax, byte [0x1404c8649]
movzx ecx, byte [0x1404d3e90]
mov edx, ecx
xor dl, 0xe1
and cl, 0x61
add cl, cl
add cl, dl
cmp al, cl
je 0x1400fbd2e
mov cl, 0xac
nop word cs:[rax + rax]
mov al, 0x34
lock cmpxchg byte [0x1404c8649], cl
je 0x1400fbdf8
movzx edx, byte [0x1404d3e90]
add dl, 0xe1
cmp al, dl
jne 0x1400fbd10
lea rax, [0x1404c8640]
ret
xor eax, eax
lea rcx, [0x1404c8530]
lea rdx, [0x140400960]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 7
jg 0x1400fbd98
inc rax
jmp 0x1400fbd50
xor eax, eax
lea rcx, [0x1404c8560]
lea rdx, [0x140400980]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1400fbda8
inc rax
jmp 0x1400fbd80
mov al, pe_nt_image_headers64
xchg byte [0x1404c8538], al
lea rax, [0x1404c8530]
ret
movzx eax, byte [0x1404d3e90]
add al, 0xba
xchg byte [0x1404c8575], al
lea rax, [0x1404c8560]
ret
xor eax, eax
lea rcx, [0x1404c8730]
lea rdx, [0x140400b40]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1400fbde8
inc rax
jmp 0x1400fbdd0
mov al, 0x51
xchg byte [0x1404c8739], al
lea rax, [0x1404c8730]
ret
xor edx, edx
lea rax, [0x1404c8640]
lea rcx, [0x140400a60]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1404d3e94]
add edx, r8d
add edx, 0x9cb39ba5
cmp edx, 9
jl 0x1400fbe10
mov al, 0x36
xchg byte [0x1404c8649], al
lea rax, [0x1404c8640]
ret
Function at 0x140108000
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
push rsi
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x140108039
test edx, edx
je 0x140108069
movzx eax, byte [0x1404d54ff]
cmp al, 0x5e
je 0x140108117
mov cl, 0xc4
nop
mov al, 0x28
lock cmpxchg byte [0x1404d54ff], cl
je 0x1401080d5
cmp al, 0x5e
jne 0x140108020
jmp 0x140108117
test edx, edx
je 0x140108099
movzx eax, byte [0x1404d55c2]
cmp al, 0x4d
je 0x1401081ca
mov cl, 0xaf
nop
mov al, 0xbc
lock cmpxchg byte [0x1404d55c2], cl
je 0x140108120
cmp al, 0x4d
jne 0x140108050
jmp 0x1401081ca
movzx eax, byte [0x1404d551d]
cmp al, 0xac
je 0x1401081b9
mov cl, 0x58
nop word [rax + rax]
mov al, 0x6e
lock cmpxchg byte [0x1404d551d], cl
je 0x140108148
cmp al, 0xac
jne 0x140108080
jmp 0x1401081b9
movzx eax, byte [0x1404d55ad]
cmp al, 0xcc
je 0x14010822d
mov cl, 0xa7
nop word [rax + rax]
mov al, 0xd4
lock cmpxchg byte [0x1404d55ad], cl
je 0x1401081d3
mov edx, r8d
xor dl, 0xd3
add dl, byte [0x1404d5764]
cmp al, dl
jne 0x1401080b0
jmp 0x14010822d
xor edx, edx
lea rax, [0x1404d54f0]
lea rcx, [0x1404012f0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x1401080f0
mov al, 0x5e
xchg byte [0x1404d54ff], al
lea rax, [0x1404d54f0]
pop rsi
ret
xor eax, eax
lea rcx, [0x1404d55b0]
lea rdx, [0x1404013a0]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x1401081c2
inc rax
jmp 0x140108130
xor eax, eax
lea rcx, [0x1404d5510]
lea rdx, [0x140401310]
mov r9d, r8d
xor r9d, 0xe5609e6
nop word cs:[rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
mov r11d, r10d
xor r11b, r10b
not r11b
and r11b, byte [rax + rcx]
xor r11b, r10b
mov byte [rax + rcx], r11b
mov r10d, dword [0x1404d5760]
mov r11d, r9d
xor r11d, r10d
and r10d, r9d
lea r10d, [r11 + r10*2]
add eax, r10d
cmp eax, 0xd
jl 0x140108170
xor r8b, 0xf3
add r8b, byte [0x1404d5764]
xchg byte [0x1404d551d], r8b
lea rax, [0x1404d5510]
pop rsi
ret
mov al, 0x4d
xchg byte [0x1404d55c2], al
lea rax, [0x1404d55b0]
pop rsi
ret
xor eax, eax
lea rcx, [0x1404d55a0]
lea rdx, [0x140401390]
mov r9d, r8d
xor r9d, 0xe5609da
nop dword [rax]
movzx r10d, byte [rax + rdx]
add byte [rax + rcx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x1404d5760]
mov esi, r9d
xor esi, r11d
and r11d, r9d
lea r11d, [rsi + r11*2]
cmp r10d, r11d
jge 0x14010821b
inc rax
jmp 0x1401081f0
xor r8b, 0xd3
add r8b, byte [0x1404d5764]
xchg byte [0x1404d55ad], r8b
lea rax, [0x1404d55a0]
pop rsi
ret
Function at 0x140117690
Capabilities:
Encode data using xor

Disassembly:
push rbx
test ecx, ecx
je 0x1401176c9
movzx eax, byte [0x1404d60f8]
cmp al, 0xa1
je 0x140117797
mov cl, 0x53
nop word cs:[rax + rax]
mov al, 0x38
lock cmpxchg byte [0x1404d60f8], cl
je 0x14011773f
cmp al, 0xa1
jne 0x1401176b0
jmp 0x140117797
test edx, edx
je 0x1401177a0
mov ecx, dword [rsp + 0x30]
movzx eax, byte [0x1404d6052]
movzx edx, byte [0x1404d66b8]
mov r8d, ecx
xor r8b, dl
xor r8b, 0x74
mov r9d, ecx
xor r9b, 0xb
not dl
and dl, r9b
or dl, r8b
not dl
add dl, dl
add dl, r8b
cmp al, dl
je 0x14011783f
nop dword [rax + rax]
movzx edx, byte [0x1404d66b8]
mov eax, ecx
xor al, 0x7a
add al, dl
mov r8d, ecx
xor r8b, 0xf0
add r8b, dl
lock cmpxchg byte [0x1404d6052], r8b
je 0x1401177d5
cmp al, 0x98
jne 0x140117710
jmp 0x14011783f
xor edx, edx
lea rax, [0x1404d60e0]
lea rcx, [0x140401a00]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
add edx, 0x262a1cf4
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0xd9d5e30c
cmp edx, 0x18
jl 0x140117750
mov al, 0xa1
xchg byte [0x1404d60f8], al
lea rax, [0x1404d60e0]
pop rbx
ret
movzx eax, byte [0x1404d61bd]
cmp al, 0x3f
je 0x140117890
mov cl, 0x5a
nop word cs:[rax + rax]
mov al, 0x32
lock cmpxchg byte [0x1404d61bd], cl
je 0x140117848
cmp al, 0x3f
jne 0x1401177c0
jmp 0x140117890
xor edx, edx
lea rax, [0x1404d6050]
lea rcx, [0x140401980]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
not r10b
mov r11d, r10d
xor r11b, r9b
not r9b
mov ebx, r8d
and bl, r9b
or bl, r11b
not bl
xor r9b, r10b
and r9b, r8b
or r9b, bl
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 2
jl 0x1401177f0
mov al, 0x98
xchg byte [0x1404d6052], al
lea rax, [0x1404d6050]
pop rbx
ret
xor eax, eax
lea rcx, [0x1404d61b0]
lea rdx, [0x140401ac0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140117888
inc rax
jmp 0x140117860
mov al, 0x3f
xchg byte [0x1404d61bd], al
lea rax, [0x1404d61b0]
pop rbx
ret
Function at 0x1401181e0
Capabilities:
Check for software breakpoints

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0xf7ecb4a4
mov r9d, dword [0x1404d66bc]
add r9d, eax
cmp ecx, r9d
jne 0x14011823c
add eax, dword [0x1404d66bc]
cmp edx, eax
jne 0x140118268
movzx eax, byte [0x1404d60b5]
cmp al, 0xb
je 0x140118234
mov cl, 0x2d
nop word cs:[rax + rax]
mov al, 0xda
lock cmpxchg byte [0x1404d60b5], cl
je 0x14011831d
cmp al, 0xb
jne 0x140118220
lea rax, [0x1404d60a0]
ret
test edx, edx
je 0x14011829c
movzx eax, byte [0x1404d6063]
cmp al, 0xa1
je 0x140118260
mov cl, 0xa8
nop dword [rax]
mov al, 1
lock cmpxchg byte [0x1404d6063], cl
je 0x1401182cc
cmp al, 0xa1
jne 0x140118250
lea rax, [0x1404d6060]
ret
movzx eax, byte [0x1404d6183]
cmp al, 0xbd
je 0x140118294
mov cl, 0x35
nop word cs:[rax + rax]
mov al, 0xe1
lock cmpxchg byte [0x1404d6183], cl
je 0x140118348
cmp al, 0xbd
jne 0x140118280
lea rax, [0x1404d6160]
ret
movzx eax, byte [0x1404d6090]
cmp al, 0xcc
je 0x1401182c4
mov cl, 0x3a
nop dword [rax]
mov al, 0xea
lock cmpxchg byte [0x1404d6090], cl
je 0x140118398
cmp al, 0xcc
jne 0x1401182b0
lea rax, [0x1404d6080]
ret
xor eax, eax
lea rcx, [0x1404d6060]
lea rdx, [0x140401990]
xor r8d, 0xf7ecb4a3
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x1404d66bc]
add r9d, r8d
add eax, r9d
cmp eax, 3
jl 0x1401182f0
mov al, 0xa1
xchg byte [0x1404d6063], al
lea rax, [0x1404d6060]
ret
xor eax, eax
lea rcx, [0x1404d60a0]
lea rdx, [0x1404019c0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140118378
inc rax
jmp 0x140118330
xor eax, eax
lea rcx, [0x1404d6160]
lea rdx, [0x140401a70]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x140118388
inc rax
jmp 0x140118360
mov al, 0xb
xchg byte [0x1404d60b5], al
lea rax, [0x1404d60a0]
ret
mov al, 0xbd
xchg byte [0x1404d6183], al
lea rax, [0x1404d6160]
ret
xor eax, eax
lea rcx, [0x1404d6080]
lea rdx, [0x1404019b0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1401183c8
inc rax
jmp 0x1401183b0
mov al, 0xcc
xchg byte [0x1404d6090], al
lea rax, [0x1404d6080]
ret
Function at 0x140124a50
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1404d7c90]
mov r8d, eax
xor r8d, 0x53711cb4
and eax, 0x53711cb4
lea eax, [r8 + rax*2]
cmp ecx, eax
jne 0x140124a9c
test edx, edx
je 0x140124ad6
movzx eax, byte [0x1404d78b0]
cmp al, 0x38
je 0x140124a94
mov cl, 0xbb
nop
mov al, 0xfb
lock cmpxchg byte [0x1404d78b0], cl
je 0x140124b4c
cmp al, 0x38
jne 0x140124a80
lea rax, [0x1404d78a0]
ret
test edx, edx
je 0x140124b0c
movzx eax, byte [0x1404d79a5]
cmp al, 0x18
je 0x140124ace
mov cl, 0xb4
nop dword [rax]
mov al, 0x75
lock cmpxchg byte [0x1404d79a5], cl
je 0x140124b78
movzx edx, byte [0x1404d7c94]
add dl, 0x52
cmp al, dl
jne 0x140124ab0
lea rax, [0x1404d7990]
ret
movzx eax, byte [0x1404d7800]
cmp al, 0xc3
je 0x140124b04
mov cl, 0x48
nop word cs:[rax + rax]
mov al, 0x1e
lock cmpxchg byte [0x1404d7800], cl
je 0x140124bdf
cmp al, 0xc3
jne 0x140124af0
lea rax, [0x1404d77f0]
ret
movzx eax, byte [0x1404d7796]
movzx ecx, byte [0x1404d7c94]
add cl, 0x23
cmp al, cl
je 0x140124b44
mov cl, 0xb7
nop word cs:[rax + rax]
mov al, 0xc9
lock cmpxchg byte [0x1404d7796], cl
je 0x140124c1c
cmp al, 0xe9
jne 0x140124b30
lea rax, [0x1404d7780]
ret
xor eax, eax
lea rcx, [0x1404d78a0]
lea rdx, [0x140402a40]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140124bb8
inc rax
jmp 0x140124b60
xor eax, eax
lea rcx, [0x1404d7990]
lea rdx, [0x140402b20]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140124bcf
inc rax
jmp 0x140124b90
movzx eax, byte [0x1404d7c94]
add al, 0x72
xchg byte [0x1404d78b0], al
lea rax, [0x1404d78a0]
ret
mov al, 0x18
xchg byte [0x1404d79a5], al
lea rax, [0x1404d7990]
ret
xor eax, eax
lea rcx, [0x1404d77f0]
lea rdx, [0x1404029b0]
nop
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140124c6f
inc rax
jmp 0x140124bf0
xor edx, edx
lea rax, [0x1404d7780]
lea rcx, [0x140402940]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1404d7c90]
add edx, r8d
add edx, 0x53711cb5
add r8d, 0x53711cca
cmp edx, r8d
jl 0x140124c30
movzx eax, byte [0x1404d7c94]
add al, 0x23
xchg byte [0x1404d7796], al
lea rax, [0x1404d7780]
ret
mov al, 0xc3
xchg byte [0x1404d7800], al
lea rax, [0x1404d77f0]
ret
Function at 0x140124c90
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140124ccc
test edx, edx
je 0x140124d31
movzx eax, byte [0x1404d798d]
cmp al, 0xf4
je 0x140124cc4
mov cl, 0xa8
nop dword [rax]
mov al, 0xb6
lock cmpxchg byte [0x1404d798d], cl
je 0x140124d9c
cmp al, 0xf4
jne 0x140124cb0
lea rax, [0x1404d7980]
ret
mov eax, dword [0x1404d7c90]
mov ecx, eax
xor ecx, 0x53711cb4
and eax, 0x53711cb4
lea eax, [rcx + rax*2]
cmp edx, eax
jne 0x140124d5c
movzx eax, byte [0x1404d7913]
cmp al, 0x7b
je 0x140124d29
nop word cs:[rax + rax]
movzx ecx, byte [0x1404d7c94]
lea eax, [rcx - 0x4c]
add cl, 0xb3
lock cmpxchg byte [0x1404d7913], cl
je 0x140124e28
movzx ecx, byte [0x1404d7c94]
add cl, 0xb5
cmp al, cl
jne 0x140124d00
lea rax, [0x1404d78f0]
ret
movzx eax, byte [0x1404d77e6]
cmp al, 0xde
je 0x140124d54
mov cl, 0xed
nop
mov al, 0xe8
lock cmpxchg byte [0x1404d77e6], cl
je 0x140124de1
cmp al, 0xde
jne 0x140124d40
lea rax, [0x1404d77d0]
ret
movzx eax, byte [0x1404d797d]
movzx ecx, byte [0x1404d7c94]
add cl, 0x38
cmp al, cl
je 0x140124d94
mov cl, 0x55
nop word cs:[rax + rax]
mov al, 4
lock cmpxchg byte [0x1404d797d], cl
je 0x140124e68
cmp al, 0xfe
jne 0x140124d80
lea rax, [0x1404d7970]
ret
xor edx, edx
lea rax, [0x1404d7980]
lea rcx, [0x140402b10]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1404d7c90]
add edx, r8d
add edx, 0x53711cb5
cmp edx, 0xd
jl 0x140124db0
mov al, 0xf4
xchg byte [0x1404d798d], al
lea rax, [0x1404d7980]
ret
xor eax, eax
lea rcx, [0x1404d77d0]
lea rdx, [0x140402990]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x15
jg 0x140124e18
inc rax
jmp 0x140124e00
mov al, 0xde
xchg byte [0x1404d77e6], al
lea rax, [0x1404d77d0]
ret
xor eax, eax
lea rcx, [0x1404d78f0]
lea rdx, [0x140402a80]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x140124e98
inc rax
jmp 0x140124e40
xor eax, eax
lea rcx, [0x1404d7970]
lea rdx, [0x140402b00]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140124ea8
inc rax
jmp 0x140124e80
mov al, 0x7b
xchg byte [0x1404d7913], al
lea rax, [0x1404d78f0]
ret
mov al, 0xfe
xchg byte [0x1404d797d], al
lea rax, [0x1404d7970]
ret
Function at 0x140157670
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401576b6
test edx, edx
je 0x1401576ec
movzx eax, byte [0x1404dde62]
cmp al, 0xe8
je 0x1401576ae
mov cl, 0xc7
nop word cs:[rax + rax]
mov al, 0x78
lock cmpxchg byte [0x1404dde62], cl
je 0x140157756
movzx edx, byte [0x1404de1f8]
add dl, 0x99
cmp al, dl
jne 0x140157690
lea rax, [0x1404dde60]
ret
test edx, edx
je 0x14015771c
movzx eax, byte [0x1404ddfb9]
cmp al, 0x96
je 0x1401576e4
mov cl, 0x1c
nop word [rax + rax]
mov al, 0x39
lock cmpxchg byte [0x1404ddfb9], cl
je 0x140157798
cmp al, 0x96
jne 0x1401576d0
lea rax, [0x1404ddfb0]
ret
movzx eax, byte [0x140531858]
cmp al, 0xf2
je 0x140157714
mov cl, 0x80
nop dword [rax]
xor eax, eax
lock cmpxchg byte [0x140531858], cl
je 0x1401577df
cmp al, 0xf2
jne 0x140157700
lea rax, [0x1404ddeb0]
ret
movzx eax, byte [0x1404ddfe5]
cmp al, 0x34
je 0x14015774e
mov cl, 0x25
nop dword [rax]
mov al, 0xc6
lock cmpxchg byte [0x1404ddfe5], cl
je 0x14015782c
movzx edx, byte [0x1404de1f8]
add dl, 0xe5
cmp al, dl
jne 0x140157730
lea rax, [0x1404ddfd0]
ret
xor eax, eax
lea rcx, [0x1404dde60]
lea rdx, [0x140403420]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x140157788
inc rax
jmp 0x140157770
mov al, 0xe8
xchg byte [0x1404dde62], al
lea rax, [0x1404dde60]
ret
xor edx, edx
lea rax, [0x1404ddfb0]
lea rcx, [0x140403570]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 9
jl 0x1401577b0
mov al, 0x96
xchg byte [0x1404ddfb9], al
lea rax, [0x1404ddfb0]
ret
xor eax, eax
lea rcx, [0x1404ddeb0]
lea rdx, [0x140403470]
nop
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x14015781c
inc rax
jmp 0x1401577f0
mov al, 0xf2
xchg byte [0x140531858], al
lea rax, [0x1404ddeb0]
ret
xor eax, eax
lea rcx, [0x1404ddfd0]
lea rdx, [0x140403590]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140157858
inc rax
jmp 0x140157840
mov al, 0x34
xchg byte [0x1404ddfe5], al
lea rax, [0x1404ddfd0]
ret
Function at 0x1401578d0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0x7b3b4265
mov r9d, dword [0x1404de1e8]
add r9d, eax
cmp ecx, r9d
jne 0x14015797c
test edx, edx
je 0x1401579e8
movzx eax, byte [0x1404ddfcd]
nop
cmp al, 0x8d
je 0x140157a24
movzx ecx, byte [0x1404de1f8]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0x67
mov eax, r8d
and al, 0x98
or al, r9b
add al, cl
and dl, 0x7e
mov r9d, r8d
and r9b, 0x81
or r9b, dl
mov edx, r9d
xor dl, cl
and r9b, cl
add r9b, r9b
add r9b, dl
lock cmpxchg byte [0x1404ddfcd], r9b
jne 0x140157900
xor eax, eax
lea rcx, [0x1404ddfc0]
lea rdx, [0x140403580]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140157a1c
inc rax
jmp 0x140157960
add eax, dword [0x1404de1e8]
cmp edx, eax
jne 0x1401579bc
movzx eax, byte [0x1404de032]
cmp al, 0xef
je 0x1401579b4
mov cl, 0x78
nop word cs:[rax + rax]
mov al, 0x9f
lock cmpxchg byte [0x1404de032], cl
je 0x140157a2c
cmp al, 0xef
jne 0x1401579a0
lea rax, [0x1404de020]
ret
movzx eax, byte [0x1404dde0c]
cmp al, 9
je 0x1401579e0
mov cl, 0x5e
nop dword [rax]
mov al, 0x77
lock cmpxchg byte [0x1404dde0c], cl
je 0x140157a58
cmp al, 9
jne 0x1401579d0
lea rax, [0x1404ddde0]
ret
movzx eax, byte [0x1404dde55]
cmp al, 0x5c
je 0x140157a14
mov cl, 5
nop word cs:[rax + rax]
mov al, 0x14
lock cmpxchg byte [0x1404dde55], cl
je 0x140157aaf
cmp al, 0x5c
jne 0x140157a00
lea rax, [0x1404dde20]
ret
mov al, 0x8d
xchg byte [0x1404ddfcd], al
lea rax, [0x1404ddfc0]
ret
xor eax, eax
lea rcx, [0x1404de020]
lea rdx, [0x1404035e0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x140157a9f
inc rax
jmp 0x140157a40
xor edx, edx
lea rax, [0x1404ddde0]
lea rcx, [0x1404033a0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x2c
jl 0x140157a70
mov al, 9
xchg byte [0x1404dde0c], al
lea rax, [0x1404ddde0]
ret
mov al, 0xef
xchg byte [0x1404de032], al
lea rax, [0x1404de020]
ret
xor eax, eax
lea rcx, [0x1404dde20]
lea rdx, [0x1404033e0]
xor r8d, 0x7b3b4264
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x1404de1e8]
add r9d, r8d
add eax, r9d
cmp eax, 0x35
jl 0x140157ad0
mov al, 0x5c
xchg byte [0x1404dde55], al
lea rax, [0x1404dde20]
ret