joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403a7740
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, r8
mov qword [rbp - 0x10], rdx
mov r11, rcx
movzx eax, byte [r8]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx edx, byte [r8 + 1]
mov r8, rcx
not r8
not rdx
mov r9, r8
xor r9, rdx
and r9, r8
and rdx, rcx
or rdx, r9
mov rcx, qword [0x1405794f8]
movabs r8, 0xc193ce52fab3a51e
xor r8, rcx
movabs r9, 0x4193ce52fab3a51e
and r9, rcx
lea r8, [r8 + r9*2]
movabs r9, 0x7f86010b9d1aee51
add r9, r8
imul r9, rdx
movzx edx, byte [rbx + 2]
mov r8, rdx
not r8
and r8, r9
not r9d
and r9d, edx
or r8, r9
imul r8, rax
movzx edx, byte [rbx + 3]
xor rdx, r8
imul rdx, rax
movzx r8d, byte [rbx + 4]
mov r9, r8
not r9
and r9, rdx
not edx
and edx, r8d
or r9, rdx
imul r9, rax
movzx edx, byte [rbx + 5]
mov r8d, r9d
xor r8d, edx
and r8d, edx
not rdx
and rdx, r9
or rdx, r8
movabs r8, 0x4119cf5e97ce936f
add r8, rcx
imul rdx, r8
movzx ecx, byte [rbx + 6]
xor rcx, rdx
imul rcx, r8
movzx r12d, byte [rbx + 7]
xor r12, rcx
imul r12, rax
mov rcx, qword [r11 + 0x30]
xor rcx, r12
not rcx
and rcx, r12
mov r13, qword [r11 + 8]
mov rdx, qword [r11 + 0x18]
mov rax, rcx
shl rax, 4
mov rsi, qword [rdx + rax + 8]
xor eax, eax
cmp rsi, r13
sete al
lea r8d, [rax + rax*2]
lea r8d, [rax + r8*4]
mov r9d, 0x1a
sub r9d, r8d
imul eax, eax, 0xfffffff3
mov r8d, 0x12
sub r8d, eax
lea r14, [0x1405796b0]
movsxd rax, r8d
lea r15, [0x1405795f0]
mov r8d, 0xffffd4a1
mov eax, dword [r15 + rax*4]
add eax, r8d
cdqe
add rax, qword [r14 + r9*8]
jmp rax
Function at 0x1403aa540
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403aa57c
test edx, edx
je 0x1403aa5ac
movzx eax, byte [0x14057816a]
movzx ecx, byte [0x1405794f4]
add cl, 0x42
cmp al, cl
je 0x1403aa574
mov cl, 7
nop
mov al, 0x22
lock cmpxchg byte [0x14057816a], cl
je 0x1403aa66f
cmp al, 0x18
jne 0x1403aa560
lea rax, [0x140578160]
ret
test edx, edx
je 0x1403aa5dc
movzx eax, byte [0x140578256]
cmp al, 0xdc
je 0x1403aa5a4
mov cl, 0xd7
nop dword [rax]
mov al, 0xbd
lock cmpxchg byte [0x140578256], cl
je 0x1403aa6a8
cmp al, 0xdc
jne 0x1403aa590
lea rax, [0x140578250]
ret
movzx eax, byte [0x1405786b8]
cmp al, 0x67
je 0x1403aa5d4
mov cl, 0x5f
nop dword [rax]
mov al, 0x87
lock cmpxchg byte [0x1405786b8], cl
je 0x1403aa6ec
cmp al, 0x67
jne 0x1403aa5c0
lea rax, [0x1405786a0]
ret
movzx eax, byte [0x140578133]
nop word cs:[rax + rax]
cmp al, 0x98
je 0x1403aa667
movzx ecx, byte [0x1405794f4]
mov edx, ecx
xor dl, 0xfb
mov eax, ecx
and al, 0x7b
add al, al
add al, dl
add cl, 0x6d
lock cmpxchg byte [0x140578133], cl
jne 0x1403aa5f0
xor edx, edx
lea rax, [0x140578120]
lea rcx, [0x140470cb0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x13
jl 0x1403aa630
mov al, 0x98
xchg byte [0x140578133], al
lea rax, [0x140578120]
ret
xor eax, eax
lea rcx, [0x140578160]
lea rdx, [0x140470cf0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 9
jg 0x1403aa698
inc rax
jmp 0x1403aa680
mov al, 0x18
xchg byte [0x14057816a], al
lea rax, [0x140578160]
ret
xor eax, eax
lea rcx, [0x140578250]
lea rdx, [0x140470de0]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x1403aa74a
inc rax
jmp 0x1403aa6c0
xor edx, edx
lea rax, [0x1405786a0]
lea rcx, [0x1404711d0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1405794f0]
mov r9d, r8d
xor r9d, 0xac65a43f
and r8d, 0x2c65a43f
lea r8d, [r9 + r8*2]
mov r9d, edx
xor r9d, r8d
and edx, r8d
lea edx, [r9 + rdx*2]
cmp edx, 0x18
jl 0x1403aa700
mov al, 0x67
xchg byte [0x1405786b8], al
lea rax, [0x1405786a0]
ret
mov al, 0xdc
xchg byte [0x140578256], al
lea rax, [0x140578250]
ret
Function at 0x1403aab00
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403aab46
test edx, edx
je 0x1403aab7c
movzx eax, byte [0x140578511]
cmp al, 0xe1
je 0x1403aab3e
mov cl, 0x2c
nop word cs:[rax + rax]
mov al, 0xcb
lock cmpxchg byte [0x140578511], cl
je 0x1403aabdc
movzx edx, byte [0x1405794f4]
add dl, 0xb
cmp al, dl
jne 0x1403aab20
lea rax, [0x140578410]
ret
test edx, edx
je 0x1403aabac
movzx eax, byte [0x140577da3]
cmp al, 0xe4
je 0x1403aab74
mov cl, 0x5b
nop word [rax + rax]
mov al, 0xcc
lock cmpxchg byte [0x140577da3], cl
je 0x1403aac31
cmp al, 0xe4
jne 0x1403aab60
lea rax, [0x140577da0]
ret
movzx eax, byte [0x140578542]
cmp al, 0x20
je 0x1403aaba4
mov cl, 0xc6
nop dword [rax]
mov al, 3
lock cmpxchg byte [0x140578542], cl
je 0x1403aac86
cmp al, 0x20
jne 0x1403aab90
lea rax, [0x140578540]
ret
movzx eax, byte [0x14057833e]
cmp al, 0x22
je 0x1403aabd4
mov cl, 0x1f
nop dword [rax]
mov al, 0x15
lock cmpxchg byte [0x14057833e], cl
je 0x1403aace8
cmp al, 0x22
jne 0x1403aabc0
lea rax, [0x140578330]
ret
xor eax, eax
lea rcx, [0x140578410]
lea rdx, [0x140470f60]
mov r8d, 0xac65a53f
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405794f0]
add r10d, r8d
cmp r9d, r10d
jge 0x1403aac21
inc rax
jmp 0x1403aac00
mov al, 0xe1
xchg byte [0x140578511], al
lea rax, [0x140578410]
ret
xor eax, eax
lea rcx, [0x140577da0]
lea rdx, [0x140470960]
mov r8d, 0xc0ae4deb
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405794f0]
add r10d, r8d
mov r11d, r10d
xor r11d, 0xebb75656
and r10d, 0x6bb75656
lea r10d, [r11 + r10*2]
cmp r9d, r10d
jge 0x1403aacd8
inc rax
jmp 0x1403aac50
xor edx, edx
lea rax, [0x140578540]
lea rcx, [0x140471090]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1405794f0]
add edx, r8d
add edx, 0xac65a43f
add r8d, 0xac65a440
cmp edx, r8d
jl 0x1403aaca0
mov al, 0x20
xchg byte [0x140578542], al
lea rax, [0x140578540]
ret
mov al, 0xe4
xchg byte [0x140577da3], al
lea rax, [0x140577da0]
ret
xor edx, edx
lea rax, [0x140578330]
lea rcx, [0x140470eb0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
not r8d
mov r9d, r8d
and r9d, 1
mov r10d, edx
and r10d, 0xfffffffe
or r10d, r9d
xor edx, 1
and r8d, 0x7ffffffe
or r8d, edx
not r8d
lea edx, [r10 + r8*2]
cmp edx, 0xe
jl 0x1403aad00
movzx eax, byte [0x1405794f4]
add al, 0x4c
xchg byte [0x14057833e], al
lea rax, [0x140578330]
ret
Function at 0x1403aad60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x1403aad9c
test edx, edx
je 0x1403aadcc
movzx eax, byte [0x140577e79]
cmp al, 0xb6
je 0x1403aad94
mov cl, 0xdd
nop word cs:[rax + rax]
mov al, 0x5c
lock cmpxchg byte [0x140577e79], cl
je 0x1403aae2c
cmp al, 0xb6
jne 0x1403aad80
lea rax, [0x140577e60]
ret
test edx, edx
je 0x1403aadfc
movzx eax, byte [0x140577eca]
cmp al, 0xc1
je 0x1403aadc4
mov cl, 0x4f
nop dword [rax]
mov al, 0x84
lock cmpxchg byte [0x140577eca], cl
je 0x1403aae71
cmp al, 0xc1
jne 0x1403aadb0
lea rax, [0x140577ec0]
ret
movzx eax, byte [0x140577fbb]
cmp al, 0xde
je 0x1403aadf4
mov cl, 0x62
nop dword [rax]
mov al, 0xf4
lock cmpxchg byte [0x140577fbb], cl
je 0x1403aaeca
cmp al, 0xde
jne 0x1403aade0
lea rax, [0x140577fa0]
ret
movzx eax, byte [0x1405781ef]
cmp al, 0xf
je 0x1403aae24
mov cl, 0xbb
nop dword [rax]
mov al, 0x15
lock cmpxchg byte [0x1405781ef], cl
je 0x1403aaf1f
cmp al, 0xf
jne 0x1403aae10
lea rax, [0x1405781d0]
ret
xor edx, edx
lea rax, [0x140577e60]
lea rcx, [0x140470a10]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1405794f0]
add edx, r8d
add edx, 0xac65a43f
cmp edx, 0x19
jl 0x1403aae40
mov al, 0xb6
xchg byte [0x140577e79], al
lea rax, [0x140577e60]
ret
xor eax, eax
lea rcx, [0x140577ec0]
lea rdx, [0x140470a70]
mov r8d, 0xac65a448
nop word [rax + rax]
movzx r9d, byte [rax + rcx]
mov r10d, r9d
xor r10b, 0xd6
and r9b, 0x56
add r9b, r9b
add r9b, r10b
add r9b, byte [rax + rdx]
add r9b, 0x2a
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405794f0]
add r10d, r8d
cmp r9d, r10d
jge 0x1403aaef8
inc rax
jmp 0x1403aae90
xor eax, eax
lea rcx, [0x140577fa0]
lea rdx, [0x140470b40]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1a
jg 0x1403aaf0f
inc rax
jmp 0x1403aaee0
movzx eax, byte [0x1405794f4]
add al, 0xeb
xchg byte [0x140577eca], al
lea rax, [0x140577ec0]
ret
mov al, 0xde
xchg byte [0x140577fbb], al
lea rax, [0x140577fa0]
ret
xor eax, eax
lea rcx, [0x1405781d0]
lea rdx, [0x140470d60]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1e
jg 0x1403aaf48
inc rax
jmp 0x1403aaf30
mov al, 0xf
xchg byte [0x1405781ef], al
lea rax, [0x1405781d0]
ret
Function at 0x1403aaf60
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403aaf9c
test edx, edx
je 0x1403aafcc
movzx eax, byte [0x14057811d]
cmp al, 0x8d
je 0x1403aaf94
mov cl, 0x51
nop word cs:[rax + rax]
mov al, 0x67
lock cmpxchg byte [0x14057811d], cl
je 0x1403ab079
cmp al, 0x8d
jne 0x1403aaf80
lea rax, [0x140578110]
ret
test edx, edx
je 0x1403aaffc
movzx eax, byte [0x140577edb]
cmp al, 0x56
je 0x1403aafc4
mov cl, 0x81
nop dword [rax]
mov al, 0x68
lock cmpxchg byte [0x140577edb], cl
je 0x1403ab0b8
cmp al, 0x56
jne 0x1403aafb0
lea rax, [0x140577ed0]
ret
movzx eax, byte [0x140577e17]
cmp al, 0x44
je 0x1403aaff4
mov cl, 0xc4
nop dword [rax]
mov al, 0x72
lock cmpxchg byte [0x140577e17], cl
je 0x1403ab0e8
cmp al, 0x44
jne 0x1403aafe0
lea rax, [0x140577e10]
ret
movzx eax, byte [0x140577dfc]
nop word cs:[rax + rax]
cmp al, 0x70
je 0x1403ab071
movzx ecx, byte [0x1405794f4]
lea eax, [rcx - 0x35]
add cl, 0x18
lock cmpxchg byte [0x140577dfc], cl
jne 0x1403ab010
xor edx, edx
lea rax, [0x140577df0]
lea rcx, [0x1404709a0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
not edx
and edx, 0x7ffffffe
or edx, r8d
not edx
lea edx, [r8 + rdx*2]
cmp edx, 0xc
jl 0x1403ab040
mov al, 0x70
xchg byte [0x140577dfc], al
lea rax, [0x140577df0]
ret
xor eax, eax
lea rcx, [0x140578110]
lea rdx, [0x140470ca0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1403ab0a8
inc rax
jmp 0x1403ab090
mov al, 0x8d
xchg byte [0x14057811d], al
lea rax, [0x140578110]
ret
xor eax, eax
lea rcx, [0x140577ed0]
lea rdx, [0x140470a80]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x1403ab12f
inc rax
jmp 0x1403ab0d0
xor edx, edx
lea rax, [0x140577e10]
lea rcx, [0x1404709c0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 7
jl 0x1403ab100
mov al, 0x44
xchg byte [0x140577e17], al
lea rax, [0x140577e10]
ret
mov al, 0x56
xchg byte [0x140577edb], al
lea rax, [0x140577ed0]
ret
Function at 0x1403ab140
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403ab17c
mov eax, 0xac65a43e
add eax, dword [0x1405794f0]
cmp edx, eax
jne 0x1403ab1ac
movzx eax, byte [0x140578096]
cmp al, 0x43
je 0x1403ab174
mov cl, 0xdd
mov al, 0x39
lock cmpxchg byte [0x140578096], cl
je 0x1403ab20c
cmp al, 0x43
jne 0x1403ab160
lea rax, [0x140578090]
ret
test edx, edx
je 0x1403ab1dc
movzx eax, byte [0x140577d7a]
cmp al, 0xd8
je 0x1403ab1a4
mov cl, 0x79
nop dword [rax]
mov al, 0x9e
lock cmpxchg byte [0x140577d7a], cl
je 0x1403ab2a8
cmp al, 0xd8
jne 0x1403ab190
lea rax, [0x140577d70]
ret
movzx eax, byte [0x140578307]
cmp al, 0xf0
je 0x1403ab1d4
mov cl, 0xb0
nop dword [rax]
mov al, 0xe4
lock cmpxchg byte [0x140578307], cl
je 0x1403ab252
cmp al, 0xf0
jne 0x1403ab1c0
lea rax, [0x140578300]
ret
movzx eax, byte [0x140578562]
cmp al, 0x4c
je 0x1403ab204
mov cl, 0x45
nop dword [rax]
mov al, 0x6c
lock cmpxchg byte [0x140578562], cl
je 0x1403ab2e8
cmp al, 0x4c
jne 0x1403ab1f0
lea rax, [0x140578560]
ret
xor eax, eax
lea rcx, [0x140578090]
lea rdx, [0x140470c20]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r8b
mov r10d, r8d
and r10b, r9b
not r9b
xor r8b, r9b
and r8b, r9b
or r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x1403ab288
inc rax
jmp 0x1403ab220
xor eax, eax
lea rcx, [0x140578300]
lea rdx, [0x140470e80]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 6
jg 0x1403ab298
inc rax
jmp 0x1403ab270
mov al, 0x43
xchg byte [0x140578096], al
lea rax, [0x140578090]
ret
mov al, 0xf0
xchg byte [0x140578307], al
lea rax, [0x140578300]
ret
xor eax, eax
lea rcx, [0x140577d70]
lea rdx, [0x140470930]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 9
jg 0x1403ab2d8
inc rax
jmp 0x1403ab2c0
mov al, 0xd8
xchg byte [0x140577d7a], al
lea rax, [0x140577d70]
ret
xor edx, edx
lea rax, [0x140578560]
lea rcx, [0x1404710b0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
not r10b
mov r11d, r10d
xor r11b, r9b
not r9b
and r8b, r9b
or r8b, r11b
not r8b
xor r10b, r9b
and r10b, r9b
or r10b, r8b
mov byte [rdx + rax], r10b
mov r8d, dword [0x1405794f0]
mov r9d, r8d
xor r9d, 0x55a08015
and r8d, 0x55a08015
lea r8d, [r9 + r8*2]
add edx, r8d
add edx, 0x56c5242a
cmp edx, 2
jl 0x1403ab300
mov al, 0x4c
xchg byte [0x140578562], al
lea rax, [0x140578560]
ret
Function at 0x1403acd30
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403acd76
test edx, edx
je 0x1403acdac
movzx eax, byte [0x140577f1d]
cmp al, 0xb8
je 0x1403acd6e
mov cl, 0x85
nop word cs:[rax + rax]
mov al, 0x16
lock cmpxchg byte [0x140577f1d], cl
je 0x1403ace0c
movzx edx, byte [0x1405794f4]
add dl, 0xe2
cmp al, dl
jne 0x1403acd50
lea rax, [0x140577f10]
ret
test edx, edx
je 0x1403acddc
movzx eax, byte [0x140578522]
cmp al, 0x35
je 0x1403acda4
mov cl, 0xd8
nop word [rax + rax]
mov al, 0x13
lock cmpxchg byte [0x140578522], cl
je 0x1403ace48
cmp al, 0x35
jne 0x1403acd90
lea rax, [0x140578520]
ret
movzx eax, byte [0x140577e55]
cmp al, 0x13
je 0x1403acdd4
mov cl, 0x90
nop dword [rax]
mov al, 0xdd
lock cmpxchg byte [0x140577e55], cl
je 0x1403ace78
cmp al, 0x13
jne 0x1403acdc0
lea rax, [0x140577e50]
ret
movzx eax, byte [0x1405781b3]
cmp al, 0xec
je 0x1403ace04
mov cl, 0xc5
nop dword [rax]
mov al, 0xe6
lock cmpxchg byte [0x1405781b3], cl
je 0x1403acec8
cmp al, 0xec
jne 0x1403acdf0
lea rax, [0x1405781a0]
ret
xor eax, eax
lea rcx, [0x140577f10]
lea rdx, [0x140470ac0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1403ace38
inc rax
jmp 0x1403ace20
mov al, 0xb8
xchg byte [0x140577f1d], al
lea rax, [0x140577f10]
ret
xor eax, eax
lea rcx, [0x140578520]
lea rdx, [0x140471070]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x1403acea8
inc rax
jmp 0x1403ace60
xor eax, eax
lea rcx, [0x140577e50]
lea rdx, [0x140470a00]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x1403aceb8
inc rax
jmp 0x1403ace90
mov al, 0x35
xchg byte [0x140578522], al
lea rax, [0x140578520]
ret
mov al, 0x13
xchg byte [0x140577e55], al
lea rax, [0x140577e50]
ret
xor edx, edx
lea rax, [0x1405781a0]
lea rcx, [0x140470d30]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x13
jl 0x1403acee0
mov al, 0xec
xchg byte [0x1405781b3], al
lea rax, [0x1405781a0]
ret
Function at 0x1403ade70
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403adeac
test edx, edx
je 0x1403adedc
movzx eax, byte [0x140578616]
cmp al, 0x9a
je 0x1403adea4
mov cl, 0xb1
nop word cs:[rax + rax]
mov al, 0xc
lock cmpxchg byte [0x140578616], cl
je 0x1403adf3c
cmp al, 0x9a
jne 0x1403ade90
lea rax, [0x140578600]
ret
test edx, edx
je 0x1403adf0c
movzx eax, byte [0x1405782d9]
cmp al, 0x87
je 0x1403aded4
mov cl, 0x10
nop dword [rax]
mov al, 0xae
lock cmpxchg byte [0x1405782d9], cl
je 0x1403adfaf
cmp al, 0x87
jne 0x1403adec0
lea rax, [0x1405782d0]
ret
movzx eax, byte [0x1405786f3]
cmp al, 0x28
je 0x1403adf04
mov cl, 0xe1
nop dword [rax]
mov al, 0xf9
lock cmpxchg byte [0x1405786f3], cl
je 0x1403adff1
cmp al, 0x28
jne 0x1403adef0
lea rax, [0x1405786f0]
ret
movzx eax, byte [0x1405780be]
cmp al, 0xdc
je 0x1403adf34
mov cl, 0xdd
nop dword [rax]
mov al, 0x70
lock cmpxchg byte [0x1405780be], cl
je 0x1403ae061
cmp al, 0xdc
jne 0x1403adf20
lea rax, [0x1405780a0]
ret
xor eax, eax
lea rcx, [0x140578600]
lea rdx, [0x140471140]
nop dword [rax]
cdqe
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
mov r11d, r9d
xor r11b, r10b
and r10b, r9b
not r11b
and r11b, r8b
or r11b, r10b
mov byte [rax + rcx], r11b
mov r8d, dword [0x1405794f0]
mov r9d, r8d
xor r9d, 0x539a5bc0
and r9d, r8d
xor r8d, 0xac65a43f
lea r8d, [r8 + r9*2]
add eax, r8d
cmp eax, 0x16
jl 0x1403adf50
mov al, 0x9a
xchg byte [0x140578616], al
lea rax, [0x140578600]
ret
xor eax, eax
lea rcx, [0x1405782d0]
lea rdx, [0x140470e50]
mov r8d, 0xac65a447
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405794f0]
add r10d, r8d
cmp r9d, r10d
jge 0x1403ae051
inc rax
jmp 0x1403adfd0
xor edx, edx
lea rax, [0x1405786f0]
lea rcx, [0x140471220]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x1405794f0]
add edx, r8d
add edx, 0xac65a43f
cmp edx, 3
jl 0x1403ae010
mov al, 0x28
xchg byte [0x1405786f3], al
lea rax, [0x1405786f0]
ret
mov al, 0x87
xchg byte [0x1405782d9], al
lea rax, [0x1405782d0]
ret
xor eax, eax
lea rcx, [0x1405780a0]
lea rdx, [0x140470c30]
mov r8d, 0xac65a45c
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405794f0]
add r10d, r8d
cmp r9d, r10d
jge 0x1403ae0a1
inc rax
jmp 0x1403ae080
mov al, 0xdc
xchg byte [0x1405780be], al
lea rax, [0x1405780a0]
ret
Function at 0x1403ae890
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403ae8cc
test edx, edx
je 0x1403ae90c
movzx eax, byte [0x140578010]
cmp al, 0xe8
je 0x1403ae8c4
mov cl, 0x1a
nop word cs:[rax + rax]
mov al, 0xee
lock cmpxchg byte [0x140578010], cl
je 0x1403ae9dc
cmp al, 0xe8
jne 0x1403ae8b0
lea rax, [0x140578000]
ret
test edx, edx
je 0x1403ae9a8
movzx eax, byte [0x140578394]
cmp al, 0x21
je 0x1403ae904
mov cl, 0xcd
nop word cs:[rax + rax]
mov al, 0xdf
lock cmpxchg byte [0x140578394], cl
je 0x1403aea18
cmp al, 0x21
jne 0x1403ae8f0
lea rax, [0x140578380]
ret
movzx eax, byte [0x1405783e9]
nop word cs:[rax + rax]
movzx ecx, byte [0x1405794f4]
add cl, 0x12
cmp al, cl
je 0x1403ae9a0
movzx ecx, byte [0x1405794f4]
lea eax, [rcx + 0x13]
neg cl
mov edx, ecx
xor dl, 0xc2
and cl, 0x42
add cl, cl
add cl, dl
neg cl
lock cmpxchg byte [0x1405783e9], cl
jne 0x1403ae920
xor edx, edx
lea rax, [0x1405783e0]
lea rcx, [0x140470f40]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1405794f0]
add edx, r8d
add edx, 0xac65a43f
add r8d, 0xac65a447
cmp edx, r8d
jl 0x1403ae970
mov al, 0xe8
xchg byte [0x1405783e9], al
lea rax, [0x1405783e0]
ret
movzx eax, byte [0x140578749]
cmp al, 0xc9
je 0x1403ae9d4
mov cl, 0xc0
nop word cs:[rax + rax]
mov al, 0x20
lock cmpxchg byte [0x140578749], cl
je 0x1403aea6f
cmp al, 0xc9
jne 0x1403ae9c0
lea rax, [0x140578740]
ret
xor eax, eax
lea rcx, [0x140578000]
lea rdx, [0x140470ba0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1403aea08
inc rax
jmp 0x1403ae9f0
mov al, 0xe8
xchg byte [0x140578010], al
lea rax, [0x140578000]
ret
xor edx, edx
lea rax, [0x140578380]
lea rcx, [0x140470ef0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x14
jl 0x1403aea30
movzx eax, byte [0x1405794f4]
mov ecx, eax
xor cl, 0x4b
and al, 0x4b
add al, al
add al, cl
xchg byte [0x140578394], al
lea rax, [0x140578380]
ret
xor eax, eax
lea rcx, [0x140578740]
lea rdx, [0x140471270]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1403aea98
inc rax
jmp 0x1403aea80
mov al, 0xc9
xchg byte [0x140578749], al
lea rax, [0x140578740]
ret
Function at 0x1403aedf0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1403aee6c
test edx, edx
je 0x1403aeecc
movzx eax, byte [0x140577c99]
nop dword [rax + rax]
cmp al, 0x69
je 0x1403aef54
movzx ecx, byte [0x1405794f4]
mov eax, r8d
xor al, 0xc1
add al, cl
mov edx, r8d
xor dl, 0x43
add dl, cl
lock cmpxchg byte [0x140577c99], dl
jne 0x1403aee10
xor eax, eax
lea rcx, [0x140577c90]
lea rdx, [0x140470850]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1403aef4c
inc rax
jmp 0x1403aee50
mov ecx, r8d
not ecx
mov eax, ecx
and eax, 0xefb14674
mov r9d, r8d
xor r9d, 0x104eb98b
or r9d, eax
not r9d
or r9d, eax
add r9d, dword [0x1405794f0]
cmp edx, r9d
jne 0x1403aef19
movzx eax, byte [0x140577c54]
cmp al, 0x6a
je 0x1403aeec4
mov cl, 0x4d
nop dword [rax + rax]
mov al, 0xd
lock cmpxchg byte [0x140577c54], cl
je 0x1403aefa2
cmp al, 0x6a
jne 0x1403aeeb0
lea rax, [0x140577c50]
ret
movzx eax, byte [0x140577eaa]
cmp al, 0xb9
je 0x1403aef11
mov cl, 0x3d
nop dword [rax]
mov al, 0x3b
lock cmpxchg byte [0x140577eaa], cl
je 0x1403aef5c
mov edx, r8d
xor dl, 0xa9
movzx r9d, byte [0x1405794f4]
xor r9b, dl
mov r10d, r9d
not r10b
and r10b, dl
add r10b, r10b
add r10b, r9b
cmp al, r10b
jne 0x1403aeee0
lea rax, [0x140577e80]
ret
movzx eax, byte [0x140577dbd]
cmp al, 0xdf
je 0x1403aef44
mov dl, 0x5b
nop word cs:[rax + rax]
mov al, 0x1c
lock cmpxchg byte [0x140577dbd], dl
je 0x1403aefe8
cmp al, 0xdf
jne 0x1403aef30
lea rax, [0x140577db0]
ret
mov al, 0x69
xchg byte [0x140577c99], al
lea rax, [0x140577c90]
ret
xor eax, eax
lea rcx, [0x140577e80]
lea rdx, [0x140470a30]
nop dword [rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0x29
jg 0x1403aef88
inc rax
jmp 0x1403aef70
xor r8b, 0xa9
add r8b, byte [0x1405794f4]
xchg byte [0x140577eaa], r8b
lea rax, [0x140577e80]
ret
xor eax, eax
lea rcx, [0x140577c50]
lea rdx, [0x140470810]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x1403af04a
inc rax
jmp 0x1403aefc0
xor r9d, r9d
lea rax, [0x140577db0]
lea rdx, [0x140470970]
xor r8d, 0xefb14601
or ecx, 0x104eb9fe
and ecx, r8d
nop dword [rax]
movsxd r8, r9d
movzx r9d, byte [r8 + rdx]
xor byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r9d, [r9 + r8*2]
mov r8d, dword [0x1405794f0]
add r8d, ecx
cmp r9d, r8d
jl 0x1403af010
mov al, 0xdf
xchg byte [0x140577dbd], al
lea rax, [0x140577db0]
ret
mov al, 0x6a
xchg byte [0x140577c54], al
lea rax, [0x140577c50]
ret