joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14017f080
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14017f0bc
test edx, edx
je 0x14017f0ec
movzx eax, byte [0x14056af63]
movzx ecx, byte [0x14056b6c8]
add cl, 0xbd
cmp al, cl
je 0x14017f0b4
mov cl, 0xc
nop
mov al, 0x71
lock cmpxchg byte [0x14056af63], cl
je 0x14017f14c
cmp al, 0x8f
jne 0x14017f0a0
lea rax, [0x14056af40]
ret
test edx, edx
je 0x14017f11c
movzx eax, byte [0x14056b19d]
cmp al, 0xc0
je 0x14017f0e4
mov cl, 0x9e
nop dword [rax]
mov al, 0xb7
lock cmpxchg byte [0x14056b19d], cl
je 0x14017f1a1
cmp al, 0xc0
jne 0x14017f0d0
lea rax, [0x14056b190]
ret
movzx eax, byte [0x14056b133]
cmp al, 0xc1
je 0x14017f114
mov cl, 0x1d
nop dword [rax]
mov al, 0xcb
lock cmpxchg byte [0x14056b133], cl
je 0x14017f201
cmp al, 0xc1
jne 0x14017f100
lea rax, [0x14056b120]
ret
movzx eax, byte [0x14056b17b]
cmp al, 0x3c
je 0x14017f144
mov cl, 5
nop dword [rax]
mov al, 0x2c
lock cmpxchg byte [0x14056b17b], cl
je 0x14017f248
cmp al, 0x3c
jne 0x14017f130
lea rax, [0x14056b170]
ret
xor eax, eax
lea rcx, [0x14056af40]
lea rdx, [0x14048e790]
mov r8d, 0xaa8bd744
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14056b6cc]
add r10d, r8d
cmp r9d, r10d
jge 0x14017f191
inc rax
jmp 0x14017f170
mov al, 0x8f
xchg byte [0x14056af63], al
lea rax, [0x14056af40]
ret
xor edx, edx
lea rax, [0x14056b190]
lea rcx, [0x14048e9e0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x14056b6cc]
add edx, r8d
add edx, 0xaa8bd722
cmp edx, 0xd
jl 0x14017f1c0
mov al, 0xc0
xchg byte [0x14056b19d], al
lea rax, [0x14056b190]
ret
xor eax, eax
lea rcx, [0x14056b120]
lea rdx, [0x14048e970]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x12
jg 0x14017f238
inc rax
jmp 0x14017f220
mov al, 0xc1
xchg byte [0x14056b133], al
lea rax, [0x14056b120]
ret
xor edx, edx
lea rax, [0x14056b170]
lea rcx, [0x14048e9c0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xb
jl 0x14017f260
mov al, 0x3c
xchg byte [0x14056b17b], al
lea rax, [0x14056b170]
ret
Function at 0x14017f290
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xaa8bd721
add eax, dword [0x14056b6cc]
cmp ecx, eax
jne 0x14017f2fc
test edx, edx
je 0x14017f32c
movzx eax, byte [0x14056b18f]
nop
cmp al, 0x2a
je 0x14017f3e7
movzx ecx, byte [0x14056b6c8]
lea eax, [rcx + 5]
add cl, 0xa7
lock cmpxchg byte [0x14056b18f], cl
jne 0x14017f2b0
xor eax, eax
lea rcx, [0x14056b180]
lea rdx, [0x14048e9d0]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x14017f3df
inc rax
jmp 0x14017f2e0
test edx, edx
je 0x14017f36c
movzx eax, byte [0x14056b07a]
cmp al, 0x1c
je 0x14017f324
mov cl, 0xf7
nop dword [rax]
mov al, 0x73
lock cmpxchg byte [0x14056b07a], cl
je 0x14017f3ef
cmp al, 0x1c
jne 0x14017f310
lea rax, [0x14056b070]
ret
movzx eax, byte [0x14056b161]
movzx ecx, byte [0x14056b6c8]
add cl, 0x78
cmp al, cl
je 0x14017f364
mov cl, 0xe3
nop word cs:[rax + rax]
mov al, 0xe1
lock cmpxchg byte [0x14056b161], cl
je 0x14017f438
cmp al, 0x4a
jne 0x14017f350
lea rax, [0x14056b150]
ret
movzx eax, byte [0x14056afcf]
nop word cs:[rax + rax]
cmp al, 0x3e
je 0x14017f3d7
movzx ecx, byte [0x14056b6c8]
lea eax, [rcx + 0x67]
add cl, 0xf5
lock cmpxchg byte [0x14056afcf], cl
jne 0x14017f380
xor edx, edx
lea rax, [0x14056afc0]
lea rcx, [0x14048e810]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x14017f3b0
mov al, 0x3e
xchg byte [0x14056afcf], al
lea rax, [0x14056afc0]
ret
mov al, 0x2a
xchg byte [0x14056b18f], al
lea rax, [0x14056b180]
ret
xor eax, eax
lea rcx, [0x14056b070]
lea rdx, [0x14048e8c0]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 9
jg 0x14017f428
inc rax
jmp 0x14017f400
mov al, 0x1c
xchg byte [0x14056b07a], al
lea rax, [0x14056b070]
ret
xor eax, eax
lea rcx, [0x14056b150]
lea rdx, [0x14048e9a0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x14017f478
inc rax
jmp 0x14017f450
mov al, 0x4a
xchg byte [0x14056b161], al
lea rax, [0x14056b150]
ret
Function at 0x14017f600
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0x20c08745
add eax, dword [0x14056b6cc]
cmp ecx, eax
jne 0x14017f64c
test edx, edx
je 0x14017f67c
movzx eax, byte [0x14056aef2]
cmp al, 0x71
je 0x14017f644
mov cl, 0x70
nop dword [rax + rax]
mov al, 0xa6
lock cmpxchg byte [0x14056aef2], cl
je 0x14017f6dc
cmp al, 0x71
jne 0x14017f630
lea rax, [0x14056aee0]
ret
test edx, edx
je 0x14017f6ac
movzx eax, byte [0x14056aeb0]
cmp al, 0x78
je 0x14017f674
mov cl, 0x68
nop dword [rax]
mov al, 0x88
lock cmpxchg byte [0x14056aeb0], cl
je 0x14017f708
cmp al, 0x78
jne 0x14017f660
lea rax, [0x14056aea0]
ret
movzx eax, byte [0x14056af0e]
cmp al, 0x72
je 0x14017f6a4
mov cl, 0xf1
nop dword [rax]
mov al, 0x21
lock cmpxchg byte [0x14056af0e], cl
je 0x14017f769
cmp al, 0x72
jne 0x14017f690
lea rax, [0x14056af00]
ret
movzx eax, byte [0x14056b08d]
cmp al, 0x5c
je 0x14017f6d4
mov cl, 0x30
nop dword [rax]
mov al, 0xfe
lock cmpxchg byte [0x14056b08d], cl
je 0x14017f7ac
cmp al, 0x5c
jne 0x14017f6c0
lea rax, [0x14056b080]
ret
xor eax, eax
lea rcx, [0x14056aee0]
lea rdx, [0x14048e730]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x14017f759
inc rax
jmp 0x14017f6f0
xor edx, edx
lea rax, [0x14056aea0]
lea rcx, [0x14048e700]
nop dword [rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
cmp edx, 0x10
jl 0x14017f720
xor r8b, 0xc2
add r8b, byte [0x14056b6c8]
xchg byte [0x14056aeb0], r8b
lea rax, [0x14056aea0]
ret
mov al, 0x71
xchg byte [0x14056aef2], al
lea rax, [0x14056aee0]
ret
xor eax, eax
lea rcx, [0x14056af00]
lea rdx, [0x14048e750]
nop dword [rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xd
jg 0x14017f7fd
inc rax
jmp 0x14017f780
xor eax, eax
lea rcx, [0x14056b080]
lea rdx, [0x14048e8d0]
xor r8d, 0x20c08746
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x14056b6cc]
add r9d, r8d
add eax, r9d
cmp eax, 0xd
jl 0x14017f7d0
mov al, 0x5c
xchg byte [0x14056b08d], al
lea rax, [0x14056b080]
ret
xor r8b, 0xc4
add r8b, byte [0x14056b6c8]
xchg byte [0x14056af0e], r8b
lea rax, [0x14056af00]
ret
Function at 0x1401809b0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, dword [0x14056b6cc]
mov r9d, r8d
xor r9d, 0x118c047f
add eax, r9d
add eax, 0xa00b7989
mov r9d, eax
xor r9d, 0x5ff48677
and eax, 0x5ff48677
lea eax, [r9 + rax*2]
cmp ecx, eax
jne 0x140180a1c
test edx, edx
je 0x140180a58
movzx eax, byte [0x14056aff1]
cmp al, 0xaa
je 0x140180a14
mov cl, 0xbc
nop word cs:[rax + rax]
mov al, 0x38
lock cmpxchg byte [0x14056aff1], cl
je 0x140180abc
cmp al, 0xaa
jne 0x140180a00
lea rax, [0x14056afe0]
ret
test edx, edx
je 0x140180a8c
movzx eax, byte [0x14056afad]
cmp al, 0xe4
je 0x140180a50
mov cl, 0x7d
nop dword [rax]
mov al, 0x71
lock cmpxchg byte [0x14056afad], cl
je 0x140180b22
mov edx, r8d
xor dl, 0x4c
add dl, byte [0x14056b6c8]
cmp al, dl
jne 0x140180a30
lea rax, [0x14056afa0]
ret
movzx eax, byte [0x14056b0cd]
cmp al, 0x82
je 0x140180a84
mov cl, 0x8b
nop word cs:[rax + rax]
mov al, 0xa7
lock cmpxchg byte [0x14056b0cd], cl
je 0x140180b68
cmp al, 0x82
jne 0x140180a70
lea rax, [0x14056b0c0]
ret
movzx eax, byte [0x14056b0ad]
cmp al, 5
je 0x140180ab4
mov cl, 0xd1
nop dword [rax]
mov al, 0x57
lock cmpxchg byte [0x14056b0ad], cl
je 0x140180bbb
cmp al, 5
jne 0x140180aa0
lea rax, [0x14056b0a0]
ret
xor edx, edx
lea rax, [0x14056afe0]
lea rcx, [0x14048e830]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
not r8b
mov r10d, r8d
and r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov byte [rdx + rax], r8b
add edx, 0xdaacf9c1
mov r8d, edx
xor r8d, 0x25530640
and edx, 0x25530640
lea edx, [r8 + rdx*2]
cmp edx, 0x11
jl 0x140180ad0
mov al, 0xaa
xchg byte [0x14056aff1], al
lea rax, [0x14056afe0]
ret
xor eax, eax
lea rcx, [0x14056afa0]
lea rdx, [0x14048e7f0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140180b58
inc rax
jmp 0x140180b40
mov al, 0xe4
xchg byte [0x14056afad], al
lea rax, [0x14056afa0]
ret
xor edx, edx
lea rax, [0x14056b0c0]
lea rcx, [0x14048e910]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0x7d424830
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x82bdb7d0
cmp edx, 0xd
jl 0x140180b80
mov al, 0x82
xchg byte [0x14056b0cd], al
lea rax, [0x14056b0c0]
ret
xor eax, eax
lea rcx, [0x14056b0a0]
lea rdx, [0x14048e8f0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140180be8
inc rax
jmp 0x140180bd0
mov al, 5
xchg byte [0x14056b0ad], al
lea rax, [0x14056b0a0]
ret
Function at 0x14018b910
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov r8d, 0x124
xor edx, edx
call fcn.14046ceb0
lea rcx, [rsi + 0x128]
mov rdi, qword [rsi + 0x128]
mov r8, qword [rdi + 8]
mov rdx, rcx
call fcn.1400a6c80
mov qword [rdi + 8], rdi
mov qword [rdi], rdi
mov qword [rdi + 0x10], rdi
mov qword [rsi + 0x130], 0
lea rdi, [rsi + 0x140]
mov rcx, qword [rsi + 0x140]
test rcx, rcx
je 0x14018b99b
cmp dword [rsi + 0x15c], 1
jne 0x14018b983
mov r8, qword [rsi + 0x148]
xor edx, edx
call fcn.14046ceb0
mov rcx, qword [rdi]
test rcx, rcx
je 0x14018b99b
mov edx, 0x314c86b9
mov r8d, 0x7eeffe7b
call fcn.1400a8fb0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov byte [rsi + 0x158], 1
mov rax, qword [rsi + 0x178]
mov rcx, qword [rax + 8]
mov qword [rcx], 0
mov rcx, qword [rax]
test rcx, rcx
je 0x14018b9e5
nop word [rax + rax]
mov rdi, qword [rcx]
mov edx, 0x20
call fcn.140195f70
mov rcx, rdi
test rdi, rdi
jne 0x14018b9d0
mov rax, qword [rsi + 0x178]
mov qword [rax], rax
mov rax, qword [rsi + 0x178]
mov qword [rax + 8], rax
mov qword [rsi + 0x180], 0
mov rax, qword [rsi + 0x188]
mov rcx, qword [rax + 8]
mov qword [rcx], 0
mov rcx, qword [rax]
test rcx, rcx
je 0x14018ba64
movabs rdi, 0x8eec59f04b8741e8
movabs rbx, 0xeec59f04b8741e8
nop word cs:[rax + rax]
mov r14, qword [rcx]
mov rax, qword [0x14056d0c0]
mov rdx, rax
xor rdx, rdi
and rax, rbx
lea rdx, [rdx + rax*2]
call fcn.140195f70
mov rcx, r14
test r14, r14
jne 0x14018ba40
mov rax, qword [rsi + 0x188]
mov qword [rax], rax
mov rax, qword [rsi + 0x188]
mov qword [rax + 8], rax
mov qword [rsi + 0x190], 0
mov rax, qword [rsi + 0x198]
mov rcx, qword [rax + 8]
mov qword [rcx], 0
mov rcx, qword [rax]
test rcx, rcx
je 0x14018bab5
nop
mov rdi, qword [rcx]
mov edx, 0x20
call fcn.140195f70
mov rcx, rdi
test rdi, rdi
jne 0x14018baa0
mov rax, qword [rsi + 0x198]
mov qword [rax], rax
mov rax, qword [rsi + 0x198]
mov qword [rax + 8], rax
mov qword [rsi + 0x1a0], 0
lea rdi, [rsi + 0x1b0]
mov rcx, qword [rsi + 0x1b0]
test rcx, rcx
je 0x14018bb17
cmp dword [rsi + 0x1cc], 1
jne 0x14018baff
mov r8, qword [rsi + 0x1b8]
xor edx, edx
call fcn.14046ceb0
mov rcx, qword [rdi]
test rcx, rcx
je 0x14018bb17
mov edx, 0x314c86b9
mov r8d, 0x7eeffe7b
call fcn.1400a8fb0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov byte [rsi + 0x1c8], 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140196f20
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140196f5c
test edx, edx
je 0x140196f9c
movzx eax, byte [0x14056bdcb]
cmp al, 2
je 0x140196f54
mov cl, 0xed
nop word cs:[rax + rax]
mov al, 0x3d
lock cmpxchg byte [0x14056bdcb], cl
je 0x14019701c
cmp al, 2
jne 0x140196f40
lea rax, [0x14056bdc0]
ret
mov eax, 0x65e365cc
add eax, dword [0x14056d0b8]
cmp edx, eax
jne 0x140196fe6
movzx eax, byte [0x14056bd9d]
cmp al, 0x68
je 0x140196f94
mov cl, 0x8f
nop dword [rax + rax]
mov al, 0x2f
lock cmpxchg byte [0x14056bd9d], cl
je 0x1401970dc
cmp al, 0x68
jne 0x140196f80
lea rax, [0x14056bd90]
ret
movzx eax, byte [0x14056bb81]
movzx ecx, byte [0x14056d0c8]
add cl, 4
cmp al, cl
je 0x140196fde
mov cl, 0xf1
nop word cs:[rax + rax]
mov al, 0x5e
lock cmpxchg byte [0x14056bb81], cl
je 0x140197081
movzx edx, byte [0x14056d0c8]
add dl, 4
cmp al, dl
jne 0x140196fc0
lea rax, [0x14056bb50]
ret
movzx eax, byte [0x1405d0cb0]
cmp al, 0xa5
je 0x140197014
mov cl, 0xca
nop word cs:[rax + rax]
xor eax, eax
lock cmpxchg byte [0x1405d0cb0], cl
je 0x140197135
cmp al, 0xa5
jne 0x140197000
lea rax, [0x14056bc60]
ret
xor eax, eax
lea rcx, [0x14056bdc0]
lea rdx, [0x14048efb0]
mov r8d, 0x65e365d7
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x14056d0b8]
add r10d, r8d
cmp r9d, r10d
jge 0x140197071
inc rax
jmp 0x140197040
mov al, 2
xchg byte [0x14056bdcb], al
lea rax, [0x14056bdc0]
ret
xor eax, eax
lea rcx, [0x14056bb50]
lea rdx, [0x14048ed40]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x30
jg 0x1401970cc
inc rax
jmp 0x1401970a0
mov al, 0x85
xchg byte [0x14056bb81], al
lea rax, [0x14056bb50]
ret
xor edx, edx
lea rax, [0x14056bd90]
lea rcx, [0x14048ef80]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, dword [0x14056d0b8]
add edx, r8d
add edx, 0x65e365cd
cmp edx, 0xd
jl 0x1401970f0
mov al, 0x68
xchg byte [0x14056bd9d], al
lea rax, [0x14056bd90]
ret
xor eax, eax
lea rcx, [0x14056bc60]
lea rdx, [0x14048ee50]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140197168
inc rax
jmp 0x140197150
movzx eax, byte [0x14056d0c8]
add al, 0x24
xchg byte [0x1405d0cb0], al
lea rax, [0x14056bc60]
ret
Function at 0x140197190
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401971cc
movzx eax, byte [0x14056bd13]
cmp al, 0x53
je 0x1401971c4
mov cl, 0xcf
nop word cs:[rax + rax]
mov al, 0xb4
lock cmpxchg byte [0x14056bd13], cl
je 0x14019724c
cmp al, 0x53
jne 0x1401971b0
lea rax, [0x14056bd10]
ret
mov eax, 0x65e365cc
add eax, dword [0x14056d0b8]
cmp edx, eax
jne 0x140197216
movzx eax, byte [0x14056bcbe]
cmp al, 0x33
je 0x14019720e
mov cl, 0x3c
nop dword [rax + rax]
mov al, 0x76
lock cmpxchg byte [0x14056bcbe], cl
je 0x140197298
movzx edx, byte [0x14056d0c8]
add dl, 0xb2
cmp al, dl
jne 0x1401971f0
lea rax, [0x14056bcb0]
ret
movzx eax, byte [0x14056bbd4]
cmp al, 7
je 0x140197244
mov cl, 0xcc
nop word cs:[rax + rax]
mov al, 0x7f
lock cmpxchg byte [0x14056bbd4], cl
je 0x1401972f1
cmp al, 7
jne 0x140197230
lea rax, [0x14056bbd0]
ret
xor eax, eax
lea rcx, [0x14056bd10]
lea rdx, [0x14048ef00]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x140197288
inc rax
jmp 0x140197260
mov al, 0x53
xchg byte [0x14056bd13], al
lea rax, [0x14056bd10]
ret
xor edx, edx
lea rax, [0x14056bcb0]
lea rcx, [0x14048eea0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x14056d0b8]
add edx, r8d
add edx, 0x65e365cd
cmp edx, 0xe
jl 0x1401972b0
mov al, 0x33
xchg byte [0x14056bcbe], al
lea rax, [0x14056bcb0]
ret
xor r8d, r8d
lea rax, [0x14056bbd0]
lea rcx, [0x14048edc0]
mov edx, 0x65e365d0
nop word [rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [r8 + rax]
xor r10b, r9b
mov byte [r8 + rax], r10b
add r8d, 0x5da2cf35
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
add r8d, 0xa25d30cb
mov r9d, dword [0x14056d0b8]
add r9d, edx
cmp r8d, r9d
jl 0x140197310
mov al, 7
xchg byte [0x14056bbd4], al
lea rax, [0x14056bbd0]
ret
Function at 0x140197a20
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x140197a5c
test edx, edx
je 0x140197ac8
movzx eax, byte [0x14056bd5f]
cmp al, 0xb8
je 0x140197a54
mov cl, 0xed
nop
mov al, 0xb
lock cmpxchg byte [0x14056bd5f], cl
je 0x140197bcb
cmp al, 0xb8
jne 0x140197a40
lea rax, [0x14056bd50]
ret
test edx, edx
je 0x140197b1c
movzx eax, byte [0x14056bbe5]
mov ecx, r8d
xor cl, 0x8c
add cl, byte [0x14056d0c8]
cmp al, cl
je 0x140197ac0
nop dword [rax + rax]
movzx ecx, byte [0x14056d0c8]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0x33
mov eax, r8d
and al, 0xcc
or al, r9b
add al, cl
and dl, 0x75
mov r9d, r8d
and r9b, 0x8a
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x14056bbe5], r9b
je 0x140197c18
cmp al, 0x4a
jne 0x140197a80
lea rax, [0x14056bbe0]
ret
movzx eax, byte [0x14056bcd1]
cmp al, 0xf0
je 0x140197b14
nop word cs:[rax + rax]
movzx ecx, byte [0x14056d0c8]
mov eax, r8d
xor al, 0x90
add al, cl
mov edx, r8d
xor dl, 0x77
add dl, cl
lock cmpxchg byte [0x14056bcd1], dl
je 0x140197c48
mov ecx, r8d
xor cl, 0x2a
add cl, byte [0x14056d0c8]
cmp al, cl
jne 0x140197ae0
lea rax, [0x14056bcc0]
ret
movzx eax, byte [0x14056bb4d]
nop word cs:[rax + rax]
cmp al, 0x4d
je 0x140197bc3
movzx ecx, byte [0x14056d0c8]
mov eax, r8d
xor al, 0x3e
mov edx, eax
xor dl, cl
and al, cl
add al, al
add al, dl
mov edx, r8d
xor dl, 0xaa
add dl, cl
lock cmpxchg byte [0x14056bb4d], dl
jne 0x140197b30
xor eax, eax
lea rcx, [0x14056bb10]
lea rdx, [0x14048ed00]
xor r8d, 0xfaa26088
nop word [rax + rax]
cdqe
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
mov r9d, dword [0x14056d0b8]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 0x3d
jl 0x140197b80
mov al, 0x4d
xchg byte [0x14056bb4d], al
lea rax, [0x14056bb10]
ret
xor eax, eax
lea rcx, [0x14056bd50]
lea rdx, [0x14048ef40]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x140197c08
inc rax
jmp 0x140197be0
mov al, 0xb8
xchg byte [0x14056bd5f], al
lea rax, [0x14056bd50]
ret
xor eax, eax
lea rcx, [0x14056bbe0]
lea rdx, [0x14048edd0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x140197c8c
inc rax
jmp 0x140197c30
xor eax, eax
lea rcx, [0x14056bcc0]
lea rdx, [0x14048eeb0]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x140197c9c
inc rax
jmp 0x140197c60
mov al, 0x4a
xchg byte [0x14056bbe5], al
lea rax, [0x14056bbe0]
ret
mov al, 0xf0
xchg byte [0x14056bcd1], al
lea rax, [0x14056bcc0]
ret
Function at 0x140197e10
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x140197e70
test edx, edx
je 0x140197eac
movzx eax, byte [0x14056ba53]
mov ecx, r8d
xor cl, 0x56
add cl, byte [0x14056d0c8]
cmp al, cl
je 0x140197e68
nop dword [rax + rax]
movzx ecx, byte [0x14056d0c8]
mov eax, r8d
xor al, 0xa4
add al, cl
mov edx, r8d
xor dl, 0x6a
add dl, cl
lock cmpxchg byte [0x14056ba53], dl
je 0x140197f55
cmp al, 0x9e
jne 0x140197e40
lea rax, [0x14056ba20]
ret
test edx, edx
je 0x140197edc
movzx eax, byte [0x14056bc1d]
cmp al, 0x9f
je 0x140197ea4
mov cl, 0x7d
nop word cs:[rax + rax]
mov al, 0x56
lock cmpxchg byte [0x14056bc1d], cl
je 0x140197f98
cmp al, 0x9f
jne 0x140197e90
lea rax, [0x14056bc10]
ret
movzx eax, byte [0x14056bc29]
cmp al, 0x4b
je 0x140197ed4
mov cl, 0x86
nop dword [rax]
mov al, 0xc1
lock cmpxchg byte [0x14056bc29], cl
je 0x140197ff0
cmp al, 0x4b
jne 0x140197ec0
lea rax, [0x14056bc20]
ret
movzx eax, byte [0x14056ba9d]
nop word cs:[rax + rax]
cmp al, 0x80
je 0x140198030
movzx ecx, byte [0x14056d0c8]
mov eax, r8d
xor al, 0xe6
add al, cl
mov edx, r8d
xor dl, 0x83
add dl, cl
lock cmpxchg byte [0x14056ba9d], dl
jne 0x140197ef0
xor eax, eax
lea rcx, [0x14056ba60]
lea rdx, [0x14048ec60]
xor r8d, 0x836bd042
nop
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14056d0b8]
add r10d, r8d
cmp r9d, r10d
jge 0x140198028
inc rax
jmp 0x140197f30
xor eax, eax
lea rcx, [0x14056ba20]
lea rdx, [0x14048ec20]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x32
jg 0x140197f88
inc rax
jmp 0x140197f70
mov al, 0x9e
xchg byte [0x14056ba53], al
lea rax, [0x14056ba20]
ret
xor eax, eax
lea rcx, [0x14056bc10]
lea rdx, [0x14048ee00]
mov r9d, r8d
xor r9d, 0x836bd386
xor r8d, 0x836bd392
nop dword [rax]
cdqe
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
mov r10d, dword [0x14056d0b8]
add eax, r9d
add eax, r10d
add r10d, r8d
cmp eax, r10d
jl 0x140197fc0
mov al, 0x9f
xchg byte [0x14056bc1d], al
lea rax, [0x14056bc10]
ret
xor eax, eax
lea rcx, [0x14056bc20]
lea rdx, [0x14048ee10]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x140198018
inc rax
jmp 0x140198000
mov al, 0x4b
xchg byte [0x14056bc29], al
lea rax, [0x14056bc20]
ret
mov al, 0x80
xchg byte [0x14056ba9d], al
lea rax, [0x14056ba60]
ret