joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140295180
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8d, dword [rsp + 0x38]
mov eax, r8d
xor eax, 0x9644ea46
mov r9d, dword [0x140525c18]
add r9d, eax
cmp ecx, r9d
jne 0x1402951d9
add eax, dword [0x140525c18]
cmp edx, eax
jne 0x140295215
movzx eax, byte [0x1405250dd]
cmp al, 0x12
je 0x14029533e
mov cl, 0x74
nop dword [rax]
mov al, 0x6c
lock cmpxchg byte [0x1405250dd], cl
je 0x1402952cf
cmp al, 0x12
jne 0x1402951c0
jmp 0x14029533e
test edx, edx
je 0x140295249
movzx eax, byte [0x14052516f]
xor r8b, 0x6a
add r8b, byte [0x140525c1c]
cmp al, r8b
je 0x1402952c3
mov cl, 0xe4
nop word [rax + rax]
mov al, 0x38
lock cmpxchg byte [0x14052516f], cl
je 0x140295279
cmp al, 0x66
jne 0x140295200
jmp 0x1402952c3
movzx eax, byte [0x140525142]
cmp al, 0x3f
je 0x140295390
mov cl, 0x52
nop word cs:[rax + rax]
mov al, 0x53
lock cmpxchg byte [0x140525142], cl
je 0x14029534a
cmp al, 0x3f
jne 0x140295230
jmp 0x140295390
movzx eax, byte [0x140524e90]
cmp al, 0xce
je 0x1402953e5
mov cl, 0xac
nop word [rax + rax]
mov al, 0x68
lock cmpxchg byte [0x140524e90], cl
je 0x140295399
cmp al, 0xce
jne 0x140295260
jmp 0x1402953e5
xor edx, edx
lea rax, [0x140525160]
lea rcx, [0x140436cd0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0x66df9fc0
mov r8d, edx
xor r8d, 0x99206041
and edx, 0x19206041
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x140295290
mov al, 0x66
xchg byte [0x14052516f], al
lea rax, [0x140525160]
jmp 0x1402953ec
xor eax, eax
lea rcx, [0x1405250d0]
lea rdx, [0x140436c40]
xor r8d, 0x9644ea45
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
not r11b
mov ebx, r11d
xor bl, r10b
not r10b
mov esi, r9d
and sil, r10b
or sil, bl
not sil
xor r10b, r11b
and r10b, r9b
or r10b, sil
mov byte [rax + rcx], r10b
mov r9d, dword [0x140525c18]
add r9d, r8d
add eax, r9d
cmp eax, 0xd
jl 0x1402952f0
mov al, 0x12
xchg byte [0x1405250dd], al
lea rax, [0x1405250d0]
jmp 0x1402953ec
xor eax, eax
lea rcx, [0x140525130]
lea rdx, [0x140436ca0]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x140295388
inc rax
jmp 0x140295360
mov al, 0x3f
xchg byte [0x140525142], al
lea rax, [0x140525130]
jmp 0x1402953ec
xor eax, eax
lea rcx, [0x140524e80]
lea rdx, [0x140436a10]
xor r8d, 0x9644ea45
cdqe
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
mov r9d, dword [0x140525c18]
add r9d, r8d
add eax, r9d
cmp eax, 0x10
jl 0x1402953b0
mov al, 0xce
xchg byte [0x140524e90], al
lea rax, [0x140524e80]
pop rbx
pop rsi
ret
Function at 0x140325d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x140325d3c
test edx, edx
je 0x140325d6c
movzx eax, byte [0x140539fd6]
cmp al, 0xcd
je 0x140325d34
mov cl, 1
nop word cs:[rax + rax]
mov al, 0xe4
lock cmpxchg byte [0x140539fd6], cl
je 0x140325ddc
cmp al, 0xcd
jne 0x140325d20
lea rax, [0x140539fc0]
ret
test edx, edx
je 0x140325d9c
movzx eax, byte [0x140539f69]
cmp al, 0xf3
je 0x140325d64
mov cl, 0x8d
nop dword [rax]
mov al, 0x6a
lock cmpxchg byte [0x140539f69], cl
je 0x140325e18
cmp al, 0xf3
jne 0x140325d50
lea rax, [0x140539f60]
ret
movzx eax, byte [0x14053a0c9]
cmp al, 0xde
je 0x140325d94
mov cl, 0x2a
nop dword [rax]
mov al, 0xaa
lock cmpxchg byte [0x14053a0c9], cl
je 0x140325e51
cmp al, 0xde
jne 0x140325d80
lea rax, [0x14053a0c0]
ret
movzx eax, byte [0x140539f1b]
movzx ecx, byte [0x14053a8c4]
add cl, 9
cmp al, cl
je 0x140325dd4
mov cl, 4
nop word cs:[rax + rax]
mov al, 0x8f
lock cmpxchg byte [0x140539f1b], cl
je 0x140325ea8
cmp al, 0x7e
jne 0x140325dc0
lea rax, [0x140539ef0]
ret
xor eax, eax
lea rcx, [0x140539fc0]
lea rdx, [0x14044ab20]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x15
jg 0x140325e08
inc rax
jmp 0x140325df0
mov al, 0xcd
xchg byte [0x140539fd6], al
lea rax, [0x140539fc0]
ret
xor eax, eax
lea rcx, [0x140539f60]
lea rdx, [0x14044aac0]
mov r8d, 0xa72b6aab
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14053a8c0]
add r10d, r8d
cmp r9d, r10d
jge 0x140325e88
inc rax
jmp 0x140325e30
xor eax, eax
lea rcx, [0x14053a0c0]
lea rdx, [0x14044ac10]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x140325e98
inc rax
jmp 0x140325e70
mov al, 0xf3
xchg byte [0x140539f69], al
lea rax, [0x140539f60]
ret
mov al, 0xde
xchg byte [0x14053a0c9], al
lea rax, [0x14053a0c0]
ret
xor eax, eax
lea rcx, [0x140539ef0]
lea rdx, [0x14044aa50]
mov r8d, 0xa72b6acd
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14053a8c0]
add r10d, r8d
cmp r9d, r10d
jge 0x140325ee1
inc rax
jmp 0x140325ec0
mov al, 0x7e
xchg byte [0x140539f1b], al
lea rax, [0x140539ef0]
ret
Function at 0x140326340
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14032637c
test edx, edx
je 0x1403263c1
movzx eax, byte [0x14053a032]
cmp al, 0xa
je 0x140326374
mov cl, 4
nop word cs:[rax + rax]
mov al, 0x43
lock cmpxchg byte [0x14053a032], cl
je 0x14032641c
cmp al, 0xa
jne 0x140326360
lea rax, [0x14053a020]
ret
test edx, edx
je 0x1403263ec
movzx eax, byte [0x14053a168]
cmp al, 0xd7
je 0x1403263b9
nop dword [rax + rax]
movzx ecx, byte [0x14053a8c4]
lea eax, [rcx - 0x43]
add cl, 0xb9
lock cmpxchg byte [0x14053a168], cl
je 0x14032647c
movzx ecx, byte [0x14053a8c4]
add cl, 0x62
cmp al, cl
jne 0x140326390
lea rax, [0x14053a150]
ret
movzx eax, byte [0x140539f33]
cmp al, 0x25
je 0x1403263e4
mov cl, 0xfc
nop
mov al, 0x2a
lock cmpxchg byte [0x140539f33], cl
je 0x1403264a8
cmp al, 0x25
jne 0x1403263d0
lea rax, [0x140539f30]
ret
movzx eax, byte [0x140539f54]
cmp al, 0x51
je 0x140326414
mov cl, 0x63
nop dword [rax]
mov al, 0xb7
lock cmpxchg byte [0x140539f54], cl
je 0x14032651b
cmp al, 0x51
jne 0x140326400
lea rax, [0x140539f40]
ret
xor edx, edx
lea rax, [0x14053a020]
lea rcx, [0x14044ab70]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
not r9b
mov r10d, r9d
or r10b, r8b
not r10b
and r9b, r8b
or r9b, r10b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 0x7ffffffe
and r8d, edx
xor edx, 1
lea edx, [rdx + r8*2]
cmp edx, 0x12
jl 0x140326430
mov al, 0xa
xchg byte [0x14053a032], al
lea rax, [0x14053a020]
ret
xor eax, eax
lea rcx, [0x14053a150]
lea rdx, [0x14044ac80]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x17
jg 0x1403264fb
inc rax
jmp 0x140326490
xor edx, edx
lea rax, [0x140539f30]
lea rcx, [0x14044aa90]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0xa65571ab
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x59aa8e55
cmp edx, 3
jl 0x1403264c0
mov al, 0x25
xchg byte [0x140539f33], al
lea rax, [0x140539f30]
ret
movzx eax, byte [0x14053a8c4]
mov ecx, eax
xor cl, 0x62
and al, 0x62
add al, al
add al, cl
xchg byte [0x14053a168], al
lea rax, [0x14053a150]
ret
xor eax, eax
lea rcx, [0x140539f40]
lea rdx, [0x14044aaa0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x13
jg 0x140326548
inc rax
jmp 0x140326530
mov al, 0x51
xchg byte [0x140539f54], al
lea rax, [0x140539f40]
ret
Function at 0x1403265d0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14032660c
test edx, edx
je 0x14032664c
movzx eax, byte [0x140539f23]
cmp al, 0xf7
je 0x140326604
mov cl, 0x38
nop word cs:[rax + rax]
mov al, 0x57
lock cmpxchg byte [0x140539f23], cl
je 0x14032673c
cmp al, 0xf7
jne 0x1403265f0
lea rax, [0x140539f20]
ret
test edx, edx
je 0x1403266d1
movzx eax, byte [0x140539ff0]
cmp al, 0xe5
je 0x140326644
mov cl, 0xf8
nop word cs:[rax + rax]
mov al, 0xa8
lock cmpxchg byte [0x140539ff0], cl
je 0x140326793
cmp al, 0xe5
jne 0x140326630
lea rax, [0x140539fe0]
ret
movzx eax, byte [0x14053a0e6]
nop word cs:[rax + rax]
cmp al, 0x6e
je 0x1403266c9
movzx ecx, byte [0x14053a8c4]
lea eax, [rcx + 0x5d]
add cl, 0x25
lock cmpxchg byte [0x14053a0e6], cl
jne 0x140326660
xor edx, edx
lea rax, [0x14053a0d0]
lea rcx, [0x14044ac20]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x14053a8c0]
add edx, r8d
add edx, 0xa72b6aa3
cmp edx, 0x16
jl 0x140326690
mov al, 0x6e
xchg byte [0x14053a0e6], al
lea rax, [0x14053a0d0]
ret
movzx eax, byte [0x14053a100]
nop dword [rax + rax]
cmp al, 0x70
je 0x1403267fb
movzx ecx, byte [0x14053a8c4]
lea eax, [rcx - 0x33]
add cl, 0x8e
lock cmpxchg byte [0x14053a100], cl
jne 0x1403266e0
xor eax, eax
lea rcx, [0x14053a0f0]
lea rdx, [0x14044ac40]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1403267f3
inc rax
jmp 0x140326710
xor eax, eax
lea rcx, [0x140539f20]
lea rdx, [0x14044aa80]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x14032677c
inc rax
jmp 0x140326750
movzx eax, byte [0x14053a8c4]
add al, 0x82
xchg byte [0x140539f23], al
lea rax, [0x140539f20]
ret
xor eax, eax
lea rcx, [0x140539fe0]
lea rdx, [0x14044ab40]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
mov r9d, dword [0x14053a8c0]
mov r10d, r9d
xor r10d, 0xa72b6ab2
and r9d, 0x272b6ab2
lea r9d, [r10 + r9*2]
cmp r8d, r9d
jge 0x1403267e3
inc rax
jmp 0x1403267b0
mov al, 0xe5
xchg byte [0x140539ff0], al
lea rax, [0x140539fe0]
ret
mov al, 0x70
xchg byte [0x14053a100], al
lea rax, [0x14053a0f0]
ret
Function at 0x140328eb0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov ebp, r8d
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rcx + 0x78]
mov r14, qword [rax + 0x3a8]
mov rbx, qword [rax + 0x3b0]
mov r15d, dword [rcx]
mov r12d, r15d
xor r12d, 0xfffffffe
test r12d, r15d
mov eax, 0xa
mov edx, 0x14
cmove edx, eax
mov rcx, r14
call fcn.140142b70
mov ecx, dword [0x14053b0f0]
mov edx, ecx
xor edx, 0xf2fded7d
and ecx, 0x72fded7d
lea ecx, [rdx + rcx*2]
cmp eax, ecx
jne 0x140328f20
mov rcx, rbx
xor edx, edx
call fcn.1403290f0
mov eax, dword [0x14055e9bc]
cmp eax, 0x53
nop dword [rax]
mov eax, dword [rdi]
and eax, 2
mov ecx, dword [0x14053b0f0]
mov edx, ecx
xor edx, 0xf2fded74
mov r8d, ecx
and r8d, 0x72fded74
lea edx, [rdx + r8*2]
xor r8d, r8d
cmp eax, edx
sete r8b
mov r8d, dword [rdi + r8*4 + 0x14]
mov edx, dword [0x14055e9b8]
lea eax, [rdx - 1]
imul eax, edx
add ecx, 0xf2fded76
xor edx, edx
div ecx
test edx, edx
jne 0x140328f30
test r12d, r15d
je 0x140329037
mov ecx, r8d
mov eax, r8d
xor eax, 0xcfffffff
and eax, r8d
cmp eax, 0x20000000
setne dl
movabs rax, 0xd1f99d50599ef6a5
movabs r9, 0xa828b0c410404a79
add r9, rax
movabs r10, 0xfe2e1e2ae18fed9b
sub r9, r10
sub r9, rax
add r9, qword [0x14053b0f8]
add r9, r10
mov rax, rcx
not rax
xor rcx, r9
not r9
and r9, rax
or r9, rcx
cmp r9, 0xffffffffffffffff
setne cl
xor dl, cl
not dl
test dl, cl
jne 0x140329037
mov ecx, eax
and ecx, 0x400000
mov edx, r8d
and edx, 0xffbfffff
or edx, ecx
and rax, 0xffffffffffbfffff
or rax, rdx
not rax
test rax, rax
jne 0x140329037
mov rcx, r14
mov edx, 0x14
call fcn.140142b70
cmp eax, 9
jne 0x1403290c7
mov edx, dword [rdi + 4]
mov rcx, rbx
mov r8b, 1
call fcn.140329520
jmp 0x1403290c7
mov rcx, rdi
mov edx, r8d
mov r8d, ebp
call fcn.140328540
test al, al
je 0x140329056
mov eax, dword [0x14055e9bc]
cmp eax, 0x59
jle 0x14032905a
jmp 0x140329086
xor eax, eax
jmp 0x1403290d8
mov eax, dword [rdi]
and eax, 0xfffffffc
or eax, 1
mov dword [rdi], eax
mov rcx, r14
mov edx, 0xa
call fcn.140142b70
mov ecx, dword [0x14055e9b8]
mov edx, 0x44429b45
sub edx, ecx
imul edx, ecx
test dl, 1
je 0x1403290b8
mov dword [rdi], 0
mov rcx, r14
mov edx, 0xa
call fcn.140142b70
mov ecx, 0x23
call fcn.1403c4b54
mov qword [0x14055e9b0], rax
lea rcx, [0x14032bc30]
call fcn.1403e5350
jmp 0x14032905a
cmp eax, 9
jne 0x1403290c7
mov rcx, rbx
xor edx, edx
call fcn.1403290f0
movups xmm0, xmmword [rdi + 0x58]
movups xmm1, xmmword [rdi + 0x68]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov al, 1
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140333820
Capabilities:
Check for software breakpoints

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 8]
mov rcx, qword [rcx + 0x10]
cmp rax, rcx
je 0x140333852
nop word cs:[rax + rax]
add rax, 8
mov rdx, qword [rax - 8]
cmp byte [rdx], 0xcc
je 0x140333859
cmp rax, rcx
jne 0x140333840
xor eax, eax
jmp 0x1403338e2
cmp qword [0x14055ea10], 0
sete al
movzx ecx, byte [0x14055c288]
mov edx, ecx
xor dl, al
mov r8d, ecx
and r8b, dl
not dl
and dl, r8b
test dl, 1
jne 0x140333885
or al, cl
test al, 1
je 0x1403338d3
mov ecx, 0x30
mov edx, 0x302e096
mov r8d, 0x24c9428d
call fcn.1400a9550
movabs rcx, 0x44baa6273c7cc8bf
add rcx, qword [0x14053bc90]
mov qword [rax + 0x28], rcx
lea rcx, [0x140427b38]
mov qword [rax + 8], rcx
mov dword [rax], 0
mov qword [rax + 0x20], 0
mov byte [rax + 0x10], 0
mov qword [0x14055ea10], rax
mov rax, qword [0x14055ea10]
mov dword [rax], 0xb
mov al, 1
add rsp, 0x28
ret
Function at 0x140339bd0
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
movzx eax, byte [r8]
add rax, qword [0x14055c1b0]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx edx, byte [r8 + 1]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r8 + 2]
xor rcx, rdx
imul rcx, rax
movzx eax, byte [r8 + 3]
mov rdx, rax
not rdx
and rdx, rcx
not ecx
and ecx, eax
or rdx, rcx
mov rcx, qword [0x14053c818]
movabs r14, 0xdd85c633ba943b82
add r14, rcx
imul r14, rdx
mov r8, qword [rdi + 0x30]
mov rdx, r14
not rdx
mov rax, r14
xor rax, r8
not r8
mov qword [rbp - 0x20], rdx
and r8, rdx
or r8, rax
not r8
mov r12, qword [rdi + 8]
mov r9, qword [rdi + 0x18]
add cl, 0xd0
shl r8, cl
lea rax, [r8*8]
or rax, 8
mov rax, qword [r9 + rax]
xor ecx, ecx
cmp rax, r12
sete cl
lea edx, [rcx + rcx]
add edx, 0x11
imul ecx, ecx, 0xfffffff3
mov r10d, 0x17
sub r10d, ecx
lea r13, [0x14053ce20]
movsxd rcx, r10d
lea r15, [0x14053cd60]
mov ecx, dword [r15 + rcx*4]
sub ecx, dword [0x14053c810]
add ecx, 0x1ed9ce62
movsxd rcx, ecx
add rcx, qword [r13 + rdx*8]
jmp rcx
Function at 0x14033a770
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x14033a963
mov rsi, rcx
dec rdx
or rdx, 1
bsr rax, rdx
xor eax, 0x3f
mov ecx, dword [0x14053c818]
sub ecx, eax
add cl, 0xf
mov ebx, 1
shl rbx, cl
mov edx, 2
shl rdx, cl
lea rcx, [rsi + 0x18]
mov eax, 0xffff5c53
add eax, dword [0x14053cac0]
mov rdi, qword [rsi + 8]
cdqe
add rax, qword [0x14053cad8]
mov r8, rdi
call qword [case.0x140303ece.0]
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
mov rax, qword [rsi + 8]
mov r9, qword [rax]
cmp r9, rdi
je 0x14033a954
movabs rax, 0xa97862183eb65cf4
movabs rcx, 0x100000001b3
movabs rdx, 0xdd85c633ba943b82
jmp 0x14033a831
mov qword [r10 + r11*8], r8
mov qword [r10 + r14*8], r8
cmp r9, rdi
je 0x14033a954
mov r8, r9
movzx r9d, byte [r9 + 0x10]
mov r10, qword [0x14053c818]
lea r11, [r10 + rax]
xor r11, r9
imul r11, rcx
movzx r9d, byte [r8 + 0x11]
xor r9, r11
add r10, rdx
imul r9, r10
movzx r11d, byte [r8 + 0x12]
xor r11, r9
imul r11, r10
movzx ebx, byte [r8 + 0x13]
xor rbx, r11
imul rbx, rcx
and rbx, qword [rsi + 0x30]
mov r9, qword [r8]
mov r10, qword [rsi + 0x18]
lea r11, [rbx + rbx]
lea r14, [rbx + rbx]
inc r14
shl rbx, 4
mov r15, qword [r10 + rbx]
cmp r15, rdi
je 0x14033a820
mov rbx, qword [r10 + r14*8]
mov ebp, dword [r8 + 0x10]
cmp ebp, dword [rbx + 0x10]
jne 0x14033a8e0
mov r11, qword [rbx]
cmp r11, r8
je 0x14033a824
mov rbx, qword [r8 + 8]
mov qword [rbx], r9
mov r15, qword [r9 + 8]
mov qword [r15], r11
mov r12, qword [r11 + 8]
mov qword [r12], r8
mov qword [r11 + 8], r15
mov qword [r9 + 8], rbx
mov qword [r8 + 8], r12
jmp 0x14033a824
cmp r15, rbx
je 0x14033a922
mov rbx, qword [rbx + 8]
mov r14d, dword [0x14055bec8]
add r14d, dword [rbx + 0x10]
cmp ebp, r14d
jne 0x14033a8e0
mov r10, qword [rbx]
mov r11, qword [r8 + 8]
mov qword [r11], r9
mov rbx, qword [r9 + 8]
mov qword [rbx], r10
mov r14, qword [r10 + 8]
mov qword [r14], r8
mov qword [r10 + 8], rbx
mov qword [r9 + 8], r11
mov qword [r8 + 8], r14
jmp 0x14033a828
mov r14, qword [r8 + 8]
mov qword [r14], r9
mov r15, qword [r9 + 8]
mov qword [r15], rbx
mov r12, qword [rbx + 8]
mov qword [r12], r8
mov qword [rbx + 8], r15
mov qword [r9 + 8], r14
mov qword [r8 + 8], r12
add r8, qword [0x14055c1b0]
mov qword [r10 + r11*8], r8
jmp 0x14033a828
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov eax, 0xffff5c53
add eax, dword [0x14053cac4]
cdqe
add rax, qword [0x14053cad0]
mov ecx, 1
mov edx, 1
mov r8d, 0x8764f7a5
call qword [case.0x140303ece.0]
mov rcx, rax
call fcn.1403e69d4
int3
Function at 0x14033e9e0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14033ea26
test edx, edx
je 0x14033ea5c
movzx eax, byte [0x14053c013]
cmp al, 0xfa
je 0x14033ea1e
mov cl, 0xf7
nop word cs:[rax + rax]
mov al, 0xd6
lock cmpxchg byte [0x14053c013], cl
je 0x14033eabc
movzx edx, byte [0x14053c814]
add dl, 0x85
cmp al, dl
jne 0x14033ea00
lea rax, [0x14053bff0]
ret
test edx, edx
je 0x14033ea8c
movzx eax, byte [0x14053c079]
cmp al, 0x56
je 0x14033ea54
mov cl, 0xf2
nop word [rax + rax]
mov al, 0xd1
lock cmpxchg byte [0x14053c079], cl
je 0x14033eb01
cmp al, 0x56
jne 0x14033ea40
lea rax, [0x14053c070]
ret
movzx eax, byte [0x14053bf00]
cmp al, 0x6c
je 0x14033ea84
mov cl, 0xc9
nop dword [rax]
mov al, 0xf1
lock cmpxchg byte [0x14053bf00], cl
je 0x14033eb68
cmp al, 0x6c
jne 0x14033ea70
lea rax, [0x14053bef0]
ret
movzx eax, byte [0x14053bea2]
cmp al, 0x89
je 0x14033eab4
mov cl, 0x61
nop dword [rax]
mov al, 0x17
lock cmpxchg byte [0x14053bea2], cl
je 0x14033ebb8
cmp al, 0x89
jne 0x14033eaa0
lea rax, [0x14053be90]
ret
xor edx, edx
lea rax, [0x14053bff0]
lea rcx, [0x14044bc10]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x14053c810]
add edx, r8d
add edx, 0xe12688a5
cmp edx, 0x23
jl 0x14033ead0
mov al, 0xfa
xchg byte [0x14053c013], al
lea rax, [0x14053bff0]
ret
xor edx, edx
lea rax, [0x14053c070]
lea rcx, [0x14044bc90]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x14053c810]
add edx, r8d
add edx, 0xe12688a5
add r8d, 0xe12688ad
cmp edx, r8d
jl 0x14033eb20
mov al, 0x56
xchg byte [0x14053c079], al
lea rax, [0x14053c070]
ret
xor eax, eax
lea rcx, [0x14053bef0]
lea rdx, [0x14044bb30]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x14033eba8
inc rax
jmp 0x14033eb80
mov al, 0x6c
xchg byte [0x14053bf00], al
lea rax, [0x14053bef0]
ret
xor eax, eax
lea rcx, [0x14053be90]
lea rdx, [0x14044bad0]
mov r8d, 0xe12688b6
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14053c810]
add r10d, r8d
cmp r9d, r10d
jge 0x14033ebf1
inc rax
jmp 0x14033ebd0
mov al, 0x89
xchg byte [0x14053bea2], al
lea rax, [0x14053be90]
ret
Function at 0x14034a440
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14034a4bc
test edx, edx
je 0x14034a4fc
movzx eax, byte [0x14053dd5b]
nop dword [rax + rax]
cmp al, 0x80
je 0x14034a564
movzx ecx, byte [0x14053dd70]
mov eax, r8d
xor al, 0xa6
add al, cl
mov edx, r8d
xor dl, 0x74
add dl, cl
lock cmpxchg byte [0x14053dd5b], dl
jne 0x14034a460
xor eax, eax
lea rcx, [0x14053dd50]
lea rdx, [0x14044c210]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x14034a55c
inc rax
jmp 0x14034a4a0
test edx, edx
je 0x14034a52c
movzx eax, byte [0x14053dc35]
mov ecx, r8d
xor cl, 0x9f
add cl, byte [0x14053dd70]
cmp al, cl
je 0x14034a4f4
mov cl, 0x58
nop dword [rax]
mov al, 0x59
lock cmpxchg byte [0x14053dc35], cl
je 0x14034a56c
cmp al, 0x4f
jne 0x14034a4e0
lea rax, [0x14053dc20]
ret
movzx eax, byte [0x14053dc9a]
cmp al, 0xf7
je 0x14034a524
mov cl, 0x40
nop dword [rax]
mov al, 0xdd
lock cmpxchg byte [0x14053dc9a], cl
je 0x14034a5b9
cmp al, 0xf7
jne 0x14034a510
lea rax, [0x14053dc90]
ret
movzx eax, byte [0x14053dc8c]
cmp al, 0xe2
je 0x14034a554
mov cl, 5
nop dword [rax]
mov al, 0x65
lock cmpxchg byte [0x14053dc8c], cl
je 0x14034a61b
cmp al, 0xe2
jne 0x14034a540
lea rax, [0x14053dc80]
ret
mov al, 0x80
xchg byte [0x14053dd5b], al
lea rax, [0x14053dd50]
ret
xor edx, edx
lea rax, [0x14053dc20]
lea rcx, [0x14044c0f0]
nop dword [rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
cmp edx, 0x15
jl 0x14034a580
xor r8b, 0x9f
add r8b, byte [0x14053dd70]
xchg byte [0x14053dc35], r8b
lea rax, [0x14053dc20]
ret
xor eax, eax
lea rcx, [0x14053dc90]
lea rdx, [0x14044c160]
mov r9d, r8d
xor r9d, 0xae5a4fa8
nop word cs:[rax + rax]
movzx r10d, byte [rax + rdx]
add byte [rax + rcx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x14053dd74]
add r11d, r9d
cmp r10d, r11d
jge 0x14034a601
inc rax
jmp 0x14034a5e0
xor r8b, 0xf7
add r8b, byte [0x14053dd70]
xchg byte [0x14053dc9a], r8b
lea rax, [0x14053dc90]
ret
xor eax, eax
lea rcx, [0x14053dc80]
lea rdx, [0x14044c150]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x14034a648
inc rax
jmp 0x14034a630
mov al, 0xe2
xchg byte [0x14053dc8c], al
lea rax, [0x14053dc80]
ret