joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400119d8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
mov eax, 0x1040
call fcn.140013060
sub rsp, rax
mov rax, qword [0x140061568]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov edx, 0x400
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
xor ebx, ebx
test eax, eax
je 0x140011a5d
lea rax, [0x140048ce0]
mov edx, 0x400
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, [0x140048d10]
lea rcx, [rsp + 0x830]
call fcn.140012304
test eax, eax
jle 0x140011a5d
lea rcx, [rsp + 0x830]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140011a59
test al, 0x10
jne 0x140011a59
mov ebx, 1
mov eax, ebx
jmp 0x140011a5f
xor eax, eax
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1400130d0
add rsp, 0x1040
pop rbx
ret

Function at 0x140013994
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push r14
push r15
sub r12, r12
add r12, 0x60
mov r14, qword gs:[r12]
push r11

Function at 0x140025c68
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140025afb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140025afb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140025afb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140025afb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140025afb
cmp dword [rcx + 0x84], 0xe
jbe 0x140025afb
cmp dword [rcx + 0xf8], 0
je 0x140025afb
mov ecx, ebx
call fcn.140025b9c
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14002598c
cmp dword [rbp + 0x20], 0
je 0x140025b48
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140025b50
int3
xor r8d, r8d
xor edx, edx
jmp 0x140025a94

Function at 0x14002657c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14002659c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140026690
or eax, 0xffffffff
jmp 0x14002659e
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400308d0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1400308ad
call fcn.140026700
mov dword [rax], socket
call fcn.140028f80
or eax, 0xffffffff
jmp 0x1400308ca
sub dword [rcx + 0x10], 1
jns 0x1400308bc
add rsp, 0x28
jmp fcn.140036c4c
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x14003088c
Function at 0x140086c60
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
test rdx, rdx
js 0x140086eec
mov rbx, r9
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x18]
mov rax, qword [0x1404edc08]
lea ecx, [rax + 0x60]
mov r12, r15
shr r12, cl
movabs rcx, 0x860c020948643f5e
add rcx, rax
xor rcx, r12
cmp rcx, r15
jae 0x140086ccc
movabs rcx, 0x8000000000000000
movabs r12, 0x7fffffffffffffff
jmp 0x140086d28
mov rax, qword [0x1404edc08]
movabs rcx, 0x60c020948643f6e
add rcx, rax
mov rdx, rdi
not rdx
movabs r8, 0xf9f3fdf6b79bc091
sub r8, rax
and r8, rdx
xor rcx, rdi
or r8, rcx
not r8
or r8, rcx
add r12, r15
cmp r8, r12
cmova r12, r8
lea rcx, [r12 + 1]
cmp rcx, 0x1000
jb 0x140086da3
cmp rcx, 0xffffffffffffffd9
jae 0x140086f06
mov eax, 0xb7fb
add eax, dword [0x1404eee08]
add rcx, 0x27
cdqe
add rax, qword [0x1404eee20]
mov edx, 0x7fd9f583
mov r8d, 0xa73fa0bd
call qword [case.0x140303ece.0]
mov rcx, qword [0x1404edc08]
movabs rdx, 0x60c020948643f86
mov r8, rcx
xor r8, rdx
and rdx, rcx
lea rdx, [r8 + rdx*2]
add rdx, rax
movabs r14, 0x60c020948643f3f
add r14, rcx
mov rcx, rdx
not rcx
mov r8, rcx
xor r8, rdx
and r8, r14
xor r8, rdx
xor r14, rcx
and r14, rcx
or r14, r8
not r14
mov qword [r14 - 8], rax
jmp 0x140086dcb
mov eax, 0xb7fb
add eax, dword [0x1404eee08]
cdqe
add rax, qword [0x1404eee20]
mov edx, 0x7fd9f583
mov r8d, 0xa73fa0bd
call qword [case.0x140303ece.0]
mov r14, rax
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], r12
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.14040cc90
mov byte [r14 + rdi], 0
cmp r15, 0x10
jb 0x140086ed7
mov eax, dword [0x14055b9c4]
cmp eax, 0x13
nop dword [rax]
movabs r8, 0x60c020948644f5e
add r8, qword [0x1404edc08]
mov rcx, qword [rsi]
mov edx, dword [0x14055b9c0]
mov r9d, dword [0x1404edc00]
mov eax, r9d
xor eax, 0x4f81c445
mov r10d, r9d
and r10d, 0x4f81c445
lea r10d, [rax + r10*2]
mov eax, edx
sub eax, r10d
imul eax, edx
mov edx, r9d
xor edx, 0x4f81c446
and r9d, 0x4f81c446
lea r9d, [rdx + r9*2]
xor edx, edx
div r9d
test edx, edx
jne 0x140086e00
lea rdx, [r15 + 1]
cmp rdx, r8
jbe 0x140086eb7
nop word cs:[rax + rax]
mov eax, dword [0x14055b9c4]
cmp eax, 0x12
jg 0x140086e93
mov rax, qword [rcx - 8]
mov edx, dword [0x14055b9c0]
lea r8d, [rdx - 1]
imul r8d, edx
test r8b, 1
je 0x140086ea0
mov eax, dword [0x14055b9c4]
cmp eax, 0x41
jge 0x140086e70
jmp 0x140086e7b
sub rcx, rax
add rcx, 0xfffffffffffffff8
cmp rcx, 0x20
jae 0x140086f20
add r15, 0x28
mov rdx, r15
mov rcx, rax
mov eax, dword [0x1404eee04]
sub eax, dword [0x1404edc00]
add eax, 0xb07ef3b7
cdqe
add rax, qword [0x1404eee10]
call qword [case.0x140303ece.0]
mov qword [rsi], r14
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov eax, 0xb7fb
add eax, dword [0x1404eee00]
cdqe
add rax, qword [0x1404eee28]
call qword [case.0x140303ece.0]
mov eax, 0xb7fb
add eax, dword [0x1404eee0c]
cdqe
add rax, qword [0x1404eee18]
call qword [case.0x140303ece.0]
call fcn.1403c4adc
int3
Function at 0x1400968e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp byte [r8 + 0x19], 0
jne 0x140096978
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov ebp, dword [0x14055ba60]
movabs r14, 0x60c020948643f87
mov eax, ebp
xor eax, ebp
not eax
and eax, dword [0x1404ef524]
mov r8, qword [rbx + 0x10]
xor eax, ebp
sub eax, dword [0x1404edc00]
add eax, 0xb07ebe3c
cdqe
add rax, qword [0x1404ef530]
mov rcx, rdi
mov rdx, rsi
call qword [case.0x140303ece.0]
mov r15, qword [rbx]
mov eax, dword [0x1404ef520]
xor eax, ebp
add eax, 0x8280
cdqe
add rax, qword [0x1404ef538]
mov rdx, qword [0x1404edc08]
add rdx, r14
mov rcx, rbx
call qword [case.0x140303ece.0]
cmp byte [r15 + 0x19], 0
mov rbx, r15
je 0x140096910
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400a5c20
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp byte [r8 + 0x19], 0
jne 0x1400a5cc1
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov ebp, 0xffff4716
mov r14d, 0xe3fc3d37
nop dword [rax + rax]
mov r8, qword [rbx + 0x10]
mov eax, dword [0x1404eee30]
add eax, ebp
cdqe
add rax, qword [0x1404eee40]
mov rcx, rdi
mov rdx, rsi
call qword [case.0x140303ece.0]
mov r15, qword [rbx]
mov rax, qword [rbx + 0x20]
lea rcx, [rbx + 0x20]
mov rax, qword [rax]
xor edx, edx
call qword [case.0x140303ece.0]
mov eax, dword [0x1404eee34]
add eax, r14d
mov ecx, eax
xor ecx, 0x1c0309df
and eax, 0x1c0309df
lea eax, [rcx + rax*2]
cdqe
add rax, qword [0x1404eee48]
mov edx, 0x48
mov rcx, rbx
call qword [case.0x140303ece.0]
cmp byte [r15 + 0x19], 0
mov rbx, r15
je 0x1400a5c50
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400a8690
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400a86cc
test edx, edx
je 0x1400a86fc
movzx eax, byte [0x1404ed2fd]
cmp al, 0x75
je 0x1400a86c4
mov cl, 0xf3
nop word cs:[rax + rax]
mov al, 0xb2
lock cmpxchg byte [0x1404ed2fd], cl
je 0x1400a878c
cmp al, 0x75
jne 0x1400a86b0
lea rax, [0x1404ed2f0]
ret
test edx, edx
je 0x1400a872c
movzx eax, byte [0x1404ed241]
cmp al, 0xfa
je 0x1400a86f4
mov cl, 0x38
nop dword [rax]
mov al, 0x55
lock cmpxchg byte [0x1404ed241], cl
je 0x1400a87c8
cmp al, 0xfa
jne 0x1400a86e0
lea rax, [0x1404ed230]
ret
movzx eax, byte [0x1404ed118]
cmp al, 0xf1
je 0x1400a8724
mov cl, 0x74
nop dword [rax]
mov al, 0x8d
lock cmpxchg byte [0x1404ed118], cl
je 0x1400a8805
cmp al, 0xf1
jne 0x1400a8710
lea rax, [0x1404ed100]
ret
movzx eax, byte [0x1404ed1a9]
nop word cs:[rax + rax]
cmp al, 0x93
je 0x1400a889b
movzx ecx, byte [0x1404edc04]
lea eax, [rcx - 0x5a]
add cl, 0x12
lock cmpxchg byte [0x1404ed1a9], cl
jne 0x1400a8740
xor eax, eax
lea rcx, [0x1404ed1a0]
lea rdx, [0x1404278f0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1400a8893
inc rax
jmp 0x1400a8770
xor eax, eax
lea rcx, [0x1404ed2f0]
lea rdx, [0x140427a30]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1400a87b8
inc rax
jmp 0x1400a87a0
mov al, 0x75
xchg byte [0x1404ed2fd], al
lea rax, [0x1404ed2f0]
ret
xor eax, eax
lea rcx, [0x1404ed230]
lea rdx, [0x140427970]
mov r8d, 0x4f81c455
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1404edc00]
add r10d, r8d
cmp r9d, r10d
jge 0x1400a8883
inc rax
jmp 0x1400a87e0
xor edx, edx
lea rax, [0x1404ed100]
lea rcx, [0x140427860]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x1404edc00]
lea r9d, [r8 + 0x4f81c445]
mov r10d, edx
xor r10d, r9d
and edx, r9d
lea edx, [r10 + rdx*2]
add r8d, 0x4f81c45c
cmp edx, r8d
jl 0x1400a8820
movzx eax, byte [0x1404edc04]
mov ecx, eax
xor cl, 0x2b
and al, 0x2b
add al, al
add al, cl
xchg byte [0x1404ed118], al
lea rax, [0x1404ed100]
ret
mov al, 0xfa
xchg byte [0x1404ed241], al
lea rax, [0x1404ed230]
ret
mov al, 0x93
xchg byte [0x1404ed1a9], al
lea rax, [0x1404ed1a0]
ret
Function at 0x1400a9020
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400a906c
test edx, edx
je 0x1400a90bc
movzx eax, byte [0x1404ed2c6]
movzx ecx, byte [0x1404edc04]
add cl, 0xdc
cmp al, cl
je 0x1400a9064
mov cl, 0x21
nop word cs:[rax + rax]
mov al, 0x5a
lock cmpxchg byte [0x1404ed2c6], cl
je 0x1400a911c
cmp al, 0xa2
jne 0x1400a9050
lea rax, [0x1404ed2c0]
ret
mov eax, 0x4f81c444
add eax, dword [0x1404edc00]
cmp edx, eax
jne 0x1400a90ec
movzx eax, byte [0x1404ed35d]
movzx ecx, byte [0x1404edc04]
add cl, 0xe6
cmp al, cl
je 0x1400a90b4
mov cl, 0x53
nop word cs:[rax + rax]
mov al, 0x42
lock cmpxchg byte [0x1404ed35d], cl
je 0x1400a91b8
cmp al, 0xac
jne 0x1400a90a0
lea rax, [0x1404ed350]
ret
movzx eax, byte [0x1404ed2a9]
cmp al, 0x96
je 0x1400a90e4
mov cl, 0xc7
nop dword [rax]
mov al, 0x83
lock cmpxchg byte [0x1404ed2a9], cl
je 0x1400a9178
cmp al, 0x96
jne 0x1400a90d0
lea rax, [0x1404ed2a0]
ret
movzx eax, byte [0x1404ed0d5]
cmp al, 0x14
je 0x1400a9114
mov cl, 0x24
nop dword [rax]
mov al, 0x25
lock cmpxchg byte [0x1404ed0d5], cl
je 0x1400a91e8
cmp al, 0x14
jne 0x1400a9100
lea rax, [0x1404ed0c0]
ret
xor eax, eax
lea rcx, [0x1404ed2c0]
lea rdx, [0x140427a00]
mov r8d, 0x4f81c44a
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1404edc00]
add r10d, r8d
cmp r9d, r10d
jge 0x1400a9161
inc rax
jmp 0x1400a9140
movzx eax, byte [0x1404edc04]
add al, 0xdc
xchg byte [0x1404ed2c6], al
lea rax, [0x1404ed2c0]
ret
xor eax, eax
lea rcx, [0x1404ed2a0]
lea rdx, [0x1404279e0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1400a91a8
inc rax
jmp 0x1400a9190
mov al, 0x96
xchg byte [0x1404ed2a9], al
lea rax, [0x1404ed2a0]
ret
xor eax, eax
lea rcx, [0x1404ed350]
lea rdx, [0x140427a90]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1400a922f
inc rax
jmp 0x1400a91d0
xor edx, edx
lea rax, [0x1404ed0c0]
lea rcx, [0x140427820]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x1400a9200
mov al, 0x14
xchg byte [0x1404ed0d5], al
lea rax, [0x1404ed0c0]
ret
mov al, 0xac
xchg byte [0x1404ed35d], al
lea rax, [0x1404ed350]
ret

Function at 0x1400a9410
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
call fcn.1403c8ccc
nop
add rsp, 0x28
ret
Function at 0x1400a9640
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400a967c
mov eax, 0x4f81c444
add eax, dword [0x1404edc00]
cmp edx, eax
jne 0x1400a96ac
movzx eax, byte [0x1404ed0b6]
cmp al, 0xb6
je 0x1400a9674
mov cl, 0x88
mov al, 0x26
lock cmpxchg byte [0x1404ed0b6], cl
je 0x1400a970c
cmp al, 0xb6
jne 0x1400a9660
lea rax, [0x1404ed0b0]
ret
test edx, edx
je 0x1400a96d8
movzx eax, byte [0x1404ed36f]
cmp al, 0x7f
je 0x1400a96a4
mov cl, 3
nop dword [rax]
mov al, 0x8b
lock cmpxchg byte [0x1404ed36f], cl
je 0x1400a97a1
cmp al, 0x7f
jne 0x1400a9690
lea rax, [0x1404ed360]
ret
movzx eax, byte [0x1404ed176]
cmp al, 0x2b
je 0x1400a96d0
xor ecx, ecx
nop dword [rax]
mov al, 0x72
lock cmpxchg byte [0x1404ed176], cl
je 0x1400a9738
cmp al, 0x2b
jne 0x1400a96c0
lea rax, [0x1404ed160]
ret
movzx eax, byte [0x1404ed1f0]
movzx ecx, byte [0x1404edc04]
add cl, 0x4f
cmp al, cl
je 0x1400a9704
mov cl, 0x57
nop
mov al, 0x49
lock cmpxchg byte [0x1404ed1f0], cl
je 0x1400a97fa
cmp al, 0x15
jne 0x1400a96f0
lea rax, [0x1404ed1e0]
ret
xor eax, eax
lea rcx, [0x1404ed0b0]
lea rdx, [0x140427810]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x1400a9781
inc rax
jmp 0x1400a9720
xor eax, eax
lea rcx, [0x1404ed160]
lea rdx, [0x1404278b0]
mov r8d, 0x4f81c45a
nop
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x1404edc00]
add r10d, r8d
cmp r9d, r10d
jge 0x1400a9791
inc rax
jmp 0x1400a9750
mov al, 0xb6
xchg byte [0x1404ed0b6], al
lea rax, [0x1404ed0b0]
ret
mov al, 0x2b
xchg byte [0x1404ed176], al
lea rax, [0x1404ed160]
ret
xor edx, edx
lea rax, [0x1404ed360]
lea rcx, [0x140427aa0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
add edx, edx
and edx, 2
mov r9d, r8d
xor r9d, edx
and edx, r8d
lea edx, [r9 + rdx*2]
cmp edx, 0xf
jl 0x1400a97c0
mov al, 0x7f
xchg byte [0x1404ed36f], al
lea rax, [0x1404ed360]
ret
xor eax, eax
lea rcx, [0x1404ed1e0]
lea rdx, [0x140427930]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1400a9828
inc rax
jmp 0x1400a9810
mov al, 0x15
xchg byte [0x1404ed1f0], al
lea rax, [0x1404ed1e0]
ret
Function at 0x1400a98a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x1400a98d9
test edx, edx
je 0x1400a9919
movzx eax, byte [0x1404ed2db]
cmp al, 0x90
je 0x1400a9a05
mov cl, 0x66
nop
mov al, 0xc2
lock cmpxchg byte [0x1404ed2db], cl
je 0x1400a99aa
cmp al, 0x90
jne 0x1400a98c0
jmp 0x1400a9a05
mov eax, r8d
xor eax, 0xbbd0b745
add eax, dword [0x1404edc00]
cmp edx, eax
jne 0x1400a9949
movzx eax, byte [0x1404ed209]
cmp al, 0x99
je 0x1400a9ad7
mov cl, 0x8d
nop dword [rax]
mov al, 0x96
lock cmpxchg byte [0x1404ed209], cl
je 0x1400a9a92
cmp al, 0x99
jne 0x1400a9900
jmp 0x1400a9ad7
movzx eax, byte [0x1404ed130]
cmp al, 0xeb
je 0x1400a9a89
mov cl, 0x64
nop word [rax + rax]
mov al, 0xfa
lock cmpxchg byte [0x1404ed130], cl
je 0x1400a9a0e
cmp al, 0xeb
jne 0x1400a9930
jmp 0x1400a9a89
movzx eax, byte [0x1404ed2ef]
mov ecx, r8d
xor cl, 0xaa
mov edx, r8d
not dl
and dl, r8b
xor dl, cl
add dl, byte [0x1404edc04]
cmp al, dl
je 0x1400a9b10
nop
movzx ecx, byte [0x1404edc04]
mov eax, r8d
xor al, 0xe6
add al, cl
add al, 0xc
mov edx, eax
xor dl, 0xf4
and al, 0x74
add al, al
add al, dl
mov edx, r8d
xor dl, 0xd3
add dl, cl
lock cmpxchg byte [0x1404ed2ef], dl
je 0x1400a9ae0
cmp al, 0x71
jne 0x1400a9970
jmp 0x1400a9b10
xor eax, eax
lea rcx, [0x1404ed2d0]
lea rdx, [0x140427a10]
nop word [rax + rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
not r11b
mov ebx, r10d
xor bl, r11b
and r11b, r10b
not bl
and bl, r9b
or bl, r11b
mov byte [rax + rcx], bl
lea r9d, [rax + 1]
cmp r9d, 0xa
jg 0x1400a99f3
inc rax
jmp 0x1400a99c0
xor r8b, 0xcb
add r8b, byte [0x1404edc04]
xchg byte [0x1404ed2db], r8b
lea rax, [0x1404ed2d0]
pop rbx
ret
xor r9d, r9d
lea rax, [0x1404ed120]
lea rcx, [0x140427880]
mov edx, r8d
xor edx, 0xbbd0b755
nop dword [rax + rax]
movsxd r9, r9d
movzx r10d, byte [r9 + rcx]
add byte [r9 + rax], r10b
mov r10d, r9d
xor r10d, 1
add r9d, r9d
and r9d, 2
mov r11d, r10d
xor r11d, r9d
and r9d, r10d
lea r9d, [r11 + r9*2]
mov r10d, dword [0x1404edc00]
add r10d, edx
cmp r9d, r10d
jl 0x1400a9a30
xor r8b, 0x24
neg r8b
xor eax, eax
sub al, byte [0x1404edc04]
mov ecx, r8d
xor cl, al
and al, r8b
add al, al
add al, cl
neg al
xchg byte [0x1404ed130], al
lea rax, [0x1404ed120]
pop rbx
ret
xor edx, edx
lea rax, [0x1404ed200]
lea rcx, [0x140427940]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 9
jl 0x1400a9ab0
mov al, 0x99
xchg byte [0x1404ed209], al
lea rax, [0x1404ed200]
pop rbx
ret
xor eax, eax
lea rcx, [0x1404ed2e0]
lea rdx, [0x140427a20]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1400a9b08
inc rax
jmp 0x1400a9af0
mov al, 0x71
xchg byte [0x1404ed2ef], al
lea rax, [0x1404ed2e0]
pop rbx
ret
Function at 0x1400aaeb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x1400aaef5
test edx, edx
je 0x1400aaf39
movzx eax, byte [0x1404ed29f]
cmp al, 0xa8
je 0x1400ab050
mov cl, 0xc7
nop
mov al, 0x80
lock cmpxchg byte [0x1404ed29f], cl
je 0x1400ab011
mov edx, r8d
xor dl, 0xcf
add dl, byte [0x1404edc04]
cmp al, dl
jne 0x1400aaed0
jmp 0x1400ab050
test edx, edx
je 0x1400aafb1
movzx eax, byte [0x1404ed32d]
mov ecx, r8d
xor cl, 0x3f
add cl, byte [0x1404edc04]
cmp al, cl
je 0x1400ab117
mov cl, 0x20
nop word [rax + rax]
mov al, 0xca
lock cmpxchg byte [0x1404ed32d], cl
je 0x1400ab059
cmp al, 0xd8
jne 0x1400aaf20
jmp 0x1400ab117
movzx eax, byte [0x1404ed155]
mov ecx, r8d
xor cl, 0x2a
mov edx, r8d
and dl, 0x20
add dl, dl
add dl, cl
add dl, byte [0x1404edc04]
add dl, 0xe0
cmp al, dl
je 0x1400ab128
nop word cs:[rax + rax]
movzx ecx, byte [0x1404edc04]
mov eax, r8d
xor al, 0x3f
add al, cl
mov edx, r8d
not dl
and dl, 0x5e
mov r9d, r8d
xor r9b, 0xa1
or r9b, dl
not r9b
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x1404ed155], r9b
je 0x1400ab0b8
cmp al, 0xed
jne 0x1400aaf70
jmp 0x1400ab128
movzx eax, byte [0x1404ed1c6]
cmp al, 0x48
je 0x1400ab175
mov cl, 0xa7
nop word cs:[rax + rax]
mov al, 0x68
lock cmpxchg byte [0x1404ed1c6], cl
je 0x1400ab131
movzx edx, byte [0x1404edc04]
mov r9d, r8d
xor r9b, 0xaf
mov r10d, r8d
xor r10b, r9b
xor r10b, 0x50
and r10b, dl
xor r10b, r9b
and r9b, dl
add r9b, r9b
add r9b, r10b
cmp al, r9b
jne 0x1400aafd0
jmp 0x1400ab175
xor eax, eax
lea rcx, [0x1404ed290]
lea rdx, [0x1404279d0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1400ab048
inc rax
jmp 0x1400ab030
mov al, 0xa8
xchg byte [0x1404ed29f], al
lea rax, [0x1404ed290]
pop rbx
ret
xor eax, eax
lea rcx, [0x1404ed320]
lea rdx, [0x140427a60]
mov r9d, r8d
xor r9d, 0x2713d17c
nop word cs:[rax + rax]
movzx r10d, byte [rax + rcx]
movzx r11d, byte [rax + rdx]
not r10b
mov ebx, r10d
and bl, r11b
or r10b, r11b
not r10b
or r10b, bl
mov byte [rax + rcx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x1404edc00]
add r11d, r9d
cmp r10d, r11d
jge 0x1400ab105
inc rax
jmp 0x1400ab080
xor eax, eax
lea rcx, [0x1404ed140]
lea rdx, [0x140427890]
xor r8d, 0x2713d174
nop
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1404edc00]
add r10d, r8d
cmp r9d, r10d
jge 0x1400ab120
inc rax
jmp 0x1400ab0d0
xor r8b, 0x3f
add r8b, byte [0x1404edc04]
xchg byte [0x1404ed32d], r8b
lea rax, [0x1404ed320]
pop rbx
ret
mov al, 0xed
xchg byte [0x1404ed155], al
lea rax, [0x1404ed140]
pop rbx
ret
xor eax, eax
lea rcx, [0x1404ed1b0]
lea rdx, [0x140427900]
xor r8d, 0x2713d168
nop dword [rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x1404edc00]
add r9d, r8d
add eax, r9d
cmp eax, 0x16
jl 0x1400ab150
mov al, 0x48
xchg byte [0x1404ed1c6], al
lea rax, [0x1404ed1b0]
pop rbx
ret
Function at 0x1400abee0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400abf18
movzx eax, byte [0x1404ed22e]
mov ecx, r9d
xor cl, 0xc6
add cl, byte [0x1404edc04]
cmp al, cl
je 0x1400abf10
mov cl, 0x39
nop dword [rax]
mov al, 0x70
lock cmpxchg byte [0x1404ed22e], cl
je 0x1400abf48
cmp al, 0xf5
jne 0x1400abf00
lea rax, [0x1404ed220]
ret
movzx eax, byte [0x1404ed195]
cmp al, 0xfb
je 0x1400abf40
mov cl, 0xd6
nop word cs:[rax + rax]
mov al, 0xc9
lock cmpxchg byte [0x1404ed195], cl
je 0x1400abf91
cmp al, 0xfb
jne 0x1400abf30
lea rax, [0x1404ed180]
ret
xor eax, eax
lea rcx, [0x1404ed220]
lea rdx, [0x140427960]
xor r9d, 0x139bb9bb
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
mov r10d, dword [0x1404edc00]
add r10d, r9d
cmp r8d, r10d
jge 0x1400abf81
inc rax
jmp 0x1400abf60
mov al, 0xf5
xchg byte [0x1404ed22e], al
lea rax, [0x1404ed220]
ret
xor edx, edx
lea rax, [0x1404ed180]
lea rcx, [0x1404278d0]
xor r9d, 0x139bb9ac
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1404edc00]
mov r10d, r9d
xor r10d, r8d
and r8d, r9d
lea r8d, [r10 + r8*2]
mov r10d, edx
xor r10d, r8d
and edx, r8d
lea edx, [r10 + rdx*2]
cmp edx, 0x15
jl 0x1400abfb0
mov al, 0xfb
xchg byte [0x1404ed195], al
lea rax, [0x1404ed180]
ret
Function at 0x1401198f0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14011992c
test edx, edx
je 0x140119966
movzx eax, byte [0x1404f0d29]
cmp al, 0x7e
je 0x140119924
mov cl, 0x43
nop word cs:[rax + rax]
mov al, 0x71
lock cmpxchg byte [0x1404f0d29], cl
je 0x1401199d6
cmp al, 0x7e
jne 0x140119910
lea rax, [0x1404f0d20]
ret
test edx, edx
je 0x14011999c
movzx eax, byte [0x1404f0c06]
cmp al, 0xe5
je 0x14011995e
mov cl, 0x53
nop dword [rax]
mov al, 0x17
lock cmpxchg byte [0x1404f0c06], cl
je 0x140119a1f
movzx edx, byte [0x1404fb750]
add dl, 0x20
cmp al, dl
jne 0x140119940
lea rax, [0x1404f0bf0]
ret
movzx eax, byte [0x1404f0b65]
cmp al, 0x82
je 0x140119994
mov cl, 6
nop word cs:[rax + rax]
mov al, 0xb9
lock cmpxchg byte [0x1404f0b65], cl
je 0x140119a48
cmp al, 0x82
jne 0x140119980
lea rax, [0x1404f0b50]
ret
movzx eax, byte [0x1404f0d1f]
cmp al, 0xd
je 0x1401199ce
mov cl, 0x81
nop dword [rax]
mov al, 0xe2
lock cmpxchg byte [0x1404f0d1f], cl
je 0x140119a98
movzx edx, byte [0x1404fb750]
add dl, 0x48
cmp al, dl
jne 0x1401199b0
lea rax, [0x1404f0d10]
ret
xor edx, edx
lea rax, [0x1404f0d20]
lea rcx, [0x140429cc0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 9
jl 0x1401199f0
mov al, 0x7e
xchg byte [0x1404f0d29], al
lea rax, [0x1404f0d20]
ret
xor eax, eax
lea rcx, [0x1404f0bf0]
lea rdx, [0x140429ba0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x15
jg 0x140119a78
inc rax
jmp 0x140119a30
xor eax, eax
lea rcx, [0x1404f0b50]
lea rdx, [0x140429b00]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140119a88
inc rax
jmp 0x140119a60
mov al, 0xe5
xchg byte [0x1404f0c06], al
lea rax, [0x1404f0bf0]
ret
mov al, 0x82
xchg byte [0x1404f0b65], al
lea rax, [0x1404f0b50]
ret
xor eax, eax
lea rcx, [0x1404f0d10]
lea rdx, [0x140429cb0]
mov r8d, 0xcf0897f0
nop
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x1404fb740]
add r10d, r8d
cmp r9d, r10d
jge 0x140119ae1
inc rax
jmp 0x140119ab0
movzx eax, byte [0x1404fb750]
add al, 0x48
xchg byte [0x1404f0d1f], al
lea rax, [0x1404f0d10]
ret