joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401c4390
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401c43cc
test edx, edx
je 0x1401c440c
movzx eax, byte [0x14053246d]
movzx ecx, byte [0x140535048]
add cl, 0x86
cmp al, cl
je 0x1401c43c4
mov cl, 0x15
nop
mov al, 0x79
lock cmpxchg byte [0x14053246d], cl
je 0x1401c44a6
cmp al, 0xf5
jne 0x1401c43b0
lea rax, [0x140532460]
ret
test edx, edx
je 0x1401c446a
movzx eax, byte [0x14053243d]
movzx ecx, byte [0x140535048]
add cl, 0x39
cmp al, cl
je 0x1401c4404
mov cl, 0xbe
nop dword [rax + rax]
mov al, 0x53
lock cmpxchg byte [0x14053243d], cl
je 0x1401c44f9
cmp al, 0xa8
jne 0x1401c43f0
lea rax, [0x140532430]
ret
movzx eax, byte [0x1405323b3]
cmp al, 0xcd
je 0x1401c4462
nop word [rax + rax]
movzx ecx, byte [0x140535048]
mov edx, ecx
xor dl, 0x29
mov eax, ecx
and al, 0x29
add al, al
add al, dl
mov edx, ecx
xor dl, 0x71
not cl
and cl, 0xe
or cl, dl
not cl
add cl, cl
add cl, dl
lock cmpxchg byte [0x1405323b3], cl
je 0x1401c4547
movzx ecx, byte [0x140535048]
add cl, 0x5e
cmp al, cl
jne 0x1401c4420
lea rax, [0x140532390]
ret
movzx eax, byte [0x14053233e]
cmp al, 0x72
je 0x1401c449e
mov cl, 0x2c
nop word [rax + rax]
mov al, 0x12
lock cmpxchg byte [0x14053233e], cl
je 0x1401c45bf
movzx edx, byte [0x140535048]
add dl, 3
cmp al, dl
jne 0x1401c4480
lea rax, [0x140532330]
ret
xor r8d, r8d
lea rax, [0x140532460]
lea rcx, [0x140452860]
mov edx, 0x76a2eb09
nop dword [rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
xor byte [r8 + rax], r9b
mov r9d, dword [0x140535038]
add r9d, edx
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r8d, [r10 + r9*2]
cmp r8d, 0xd
jl 0x1401c44c0
mov al, 0xf5
xchg byte [0x14053246d], al
lea rax, [0x140532460]
ret
xor eax, eax
lea rcx, [0x140532430]
lea rdx, [0x140452830]
nop dword [rax]
xor r8d, r8d
sub r8b, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
xor r10d, r10d
sub r10b, r9b
mov r9d, r8d
xor r9b, r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
neg r10b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401c4598
inc rax
jmp 0x1401c4510
xor eax, eax
lea rcx, [0x140532390]
lea rdx, [0x140452790]
nop word [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
mov r9d, r10d
xor r9b, r8b
and r8b, r10b
add r8b, r8b
add r8b, r9b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1401c45a8
inc rax
jmp 0x1401c4560
mov al, 0xa8
xchg byte [0x14053243d], al
lea rax, [0x140532430]
ret
movzx eax, byte [0x140535048]
add al, 0x5e
xchg byte [0x1405323b3], al
lea rax, [0x140532390]
ret
xor r8d, r8d
lea rax, [0x140532330]
lea rcx, [0x140452740]
mov edx, 0x76a2eb16
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
add byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x140535038]
add r9d, edx
cmp r8d, r9d
jl 0x1401c45e0
mov al, 0x72
xchg byte [0x14053233e], al
lea rax, [0x140532330]
ret
Function at 0x1401c5310
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1401c534c
test edx, edx
je 0x1401c53b0
movzx eax, byte [0x140532591]
cmp al, 2
je 0x1401c5344
mov cl, 0x76
nop
mov al, 0x15
lock cmpxchg byte [0x140532591], cl
je 0x1401c5428
cmp al, 2
jne 0x1401c5330
lea rax, [0x140532580]
ret
mov eax, r8d
xor eax, 0xdb5a3a28
add eax, dword [0x140535038]
cmp edx, eax
jne 0x1401c53ec
movzx eax, byte [0x14053254d]
mov ecx, r8d
xor cl, 0x94
add cl, byte [0x140535048]
cmp al, cl
je 0x1401c53a8
nop dword [rax]
movzx ecx, byte [0x140535048]
mov eax, r8d
xor al, 0xda
add al, cl
mov edx, r8d
xor dl, 0x9a
add dl, cl
lock cmpxchg byte [0x14053254d], dl
je 0x1401c54e1
cmp al, 0x23
jne 0x1401c5380
lea rax, [0x140532540]
ret
movzx eax, byte [0x1405324ed]
mov ecx, r8d
xor cl, 0xde
add cl, byte [0x140535048]
cmp al, cl
je 0x1401c53e4
mov cl, 0x61
nop dword [rax]
mov al, 0x15
lock cmpxchg byte [0x1405324ed], cl
je 0x1401c5468
cmp al, 0x6d
jne 0x1401c53d0
lea rax, [0x1405324e0]
ret
movzx eax, byte [0x1405323ed]
cmp al, 0x52
je 0x1401c5420
mov cl, 0x1c
nop dword [rax]
mov al, 0x86
lock cmpxchg byte [0x1405323ed], cl
je 0x1401c552c
mov edx, r8d
xor dl, 0xc3
add dl, byte [0x140535048]
cmp al, dl
jne 0x1401c5400
lea rax, [0x1405323e0]
ret
xor eax, eax
lea rcx, [0x140532580]
lea rdx, [0x140452980]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x1401c5458
inc rax
jmp 0x1401c5440
mov al, 2
xchg byte [0x140532591], al
lea rax, [0x140532580]
ret
xor eax, eax
lea rcx, [0x1405324e0]
lea rdx, [0x1404528e0]
mov r9d, r8d
xor r9d, 0xdb5a3a29
nop word cs:[rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
mov r11d, r10d
xor r11b, r10b
not r11b
and r11b, byte [rax + rcx]
xor r11b, r10b
mov byte [rax + rcx], r11b
mov r10d, dword [0x140535038]
mov r11d, r9d
xor r11d, r10d
and r10d, r9d
lea r10d, [r11 + r10*2]
add eax, r10d
cmp eax, 0xd
jl 0x1401c5490
xor r8b, 0xde
add r8b, byte [0x140535048]
xchg byte [0x1405324ed], r8b
lea rax, [0x1405324e0]
ret
xor eax, eax
lea rcx, [0x140532540]
lea rdx, [0x140452940]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401c556f
inc rax
jmp 0x1401c5500
xor edx, edx
lea rax, [0x1405323e0]
lea rcx, [0x1404527e0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x1401c5540
mov al, 0x52
xchg byte [0x1405323ed], al
lea rax, [0x1405323e0]
ret
mov al, 0x23
xchg byte [0x14053254d], al
lea rax, [0x140532540]
ret
Function at 0x1401e5db0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401e5e1b
mov eax, dword [0x140535d00]
mov ecx, eax
xor ecx, 0xeafc5318
and eax, 0x6afc5318
lea eax, [rcx + rax*2]
cmp edx, eax
jne 0x1401e5e4c
movzx eax, byte [0x1405359ef]
cmp al, 0xc
je 0x1401e5e13
nop dword [rax]
movzx ecx, byte [0x140535d10]
mov edx, ecx
xor dl, 0x97
mov eax, ecx
and al, 0x17
add al, al
add al, dl
add cl, 0xe2
lock cmpxchg byte [0x1405359ef], cl
je 0x1401e5eac
movzx ecx, byte [0x140535d10]
add cl, 0xdf
cmp al, cl
jne 0x1401e5de0
lea rax, [0x1405359e0]
ret
test edx, edx
je 0x1401e5e7c
movzx eax, byte [0x1405359f9]
cmp al, 0xed
je 0x1401e5e44
mov cl, 0x4e
nop dword [rax]
mov al, 0x5f
lock cmpxchg byte [0x1405359f9], cl
je 0x1401e5f48
cmp al, 0xed
jne 0x1401e5e30
lea rax, [0x1405359f0]
ret
movzx eax, byte [0x140535906]
cmp al, 0x6c
je 0x1401e5e74
mov cl, 0x3d
nop dword [rax]
mov al, 0xff
lock cmpxchg byte [0x140535906], cl
je 0x1401e5f0a
cmp al, 0x6c
jne 0x1401e5e60
lea rax, [0x140535900]
ret
movzx eax, byte [0x140535931]
cmp al, 0x33
je 0x1401e5ea4
mov cl, 0xa4
nop dword [rax]
mov al, 0xf6
lock cmpxchg byte [0x140535931], cl
je 0x1401e5f88
cmp al, 0x33
jne 0x1401e5e90
lea rax, [0x140535920]
ret
xor r8d, r8d
lea rax, [0x1405359e0]
lea rcx, [0x140452d80]
mov edx, 0xeafc5327
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
xor byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x140535d00]
add r9d, edx
cmp r8d, r9d
jl 0x1401e5ed0
mov al, 0xc
xchg byte [0x1405359ef], al
lea rax, [0x1405359e0]
ret
xor eax, eax
lea rcx, [0x140535900]
lea rdx, [0x140452cb0]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x1401e5f38
inc rax
jmp 0x1401e5f20
mov al, 0x6c
xchg byte [0x140535906], al
lea rax, [0x140535900]
ret
xor eax, eax
lea rcx, [0x1405359f0]
lea rdx, [0x140452d90]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1401e5f78
inc rax
jmp 0x1401e5f60
mov al, 0xed
xchg byte [0x1405359f9], al
lea rax, [0x1405359f0]
ret
xor edx, edx
lea rax, [0x140535920]
lea rcx, [0x140452cd0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x140535d00]
add edx, r8d
add edx, 0xeafc5319
add r8d, 0xeafc5329
cmp edx, r8d
jl 0x1401e5fa0
mov al, 0x33
xchg byte [0x140535931], al
lea rax, [0x140535920]
ret
Function at 0x1401e5fe0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov esi, r8d
test ecx, ecx
je 0x1401e6039
movzx eax, byte [0x140535917]
movzx ecx, byte [0x140535d10]
add cl, 0x8e
cmp al, cl
je 0x1401e6140
mov cl, 0x9b
nop word cs:[rax + rax]
mov al, 0xf1
lock cmpxchg byte [0x140535917], cl
je 0x1401e60b9
cmp al, 0xbb
jne 0x1401e6020
jmp 0x1401e6140
movzx eax, byte [0x140535990]
cmp al, 0xeb
je 0x1401e60ad
movzx ecx, byte [0x140535d10]
lea eax, [rcx + 0x1b]
add cl, 0x6d
lock cmpxchg byte [0x140535990], cl
jne 0x1401e6040
xor eax, eax
lea rbx, [0x140535980]
lea r14, [0x140452d30]
xor esi, 0x1eeb498d
lea rdi, [rsp + 0x40]
nop word cs:[rax + rax]
movsxd rcx, eax
movzx eax, byte [rcx + r14]
add byte [rcx + rbx], al
mov rdx, rdi
mov r8d, esi
mov r9d, 0xc5cff884
call fcn.1401e61d0
mov eax, dword [rsp + 0x40]
cmp eax, 0x10
jl 0x1401e6080
mov al, 0xeb
xchg byte [0x140535990], al
lea rax, [0x140535980]
jmp 0x1401e6147
xor eax, eax
lea r12, [0x140535910]
mov edi, esi
xor edi, 0x8b051812
mov ebp, 0x392db672
lea rbx, [rsp + 0x3f]
lea r13, [0x140452cc0]
xor esi, 0x19aa4025
lea r14, [rsp + 0x44]
nop word cs:[rax + rax]
movsxd r15, eax
lea rcx, [r12 + r15]
mov r9d, dword [0x140535d00]
add r9d, ebp
mov rdx, rbx
mov r8d, edi
call fcn.14012b300
movzx edx, byte [rsp + 0x3f]
xor dl, byte [r15 + r13]
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x28], 0x92ccc9fd
mov rcx, r15
mov r8d, r15d
mov r9, r14
call fcn.1401e61a0
mov eax, dword [rsp + 0x44]
cmp eax, 7
jl 0x1401e60f0
mov al, 0xbb
xchg byte [0x140535917], al
lea rax, [0x140535910]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401eee70
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1401eeebc
mov eax, r8d
xor eax, 0x996d5a8
add eax, dword [0x140536610]
cmp edx, eax
jne 0x1401eeef4
movzx eax, byte [0x1405362b5]
cmp al, 0xa7
je 0x1401eeeb4
mov cl, 0xe9
nop dword [rax + rax]
mov al, 0x82
lock cmpxchg byte [0x1405362b5], cl
je 0x1401eef82
cmp al, 0xa7
jne 0x1401eeea0
lea rax, [0x1405362b0]
ret
movzx eax, byte [0x14053633e]
cmp al, 0x9e
je 0x1401eeeec
mov cl, 0x98
nop dword [rax]
mov al, 0x67
lock cmpxchg byte [0x14053633e], cl
je 0x1401eef38
mov edx, r8d
xor dl, 0xa4
add dl, byte [0x140536614]
cmp al, dl
jne 0x1401eeed0
lea rax, [0x140536330]
ret
movzx eax, byte [0x1405362c4]
cmp al, 0x67
je 0x1401eef30
mov cl, 0x8c
nop word cs:[rax + rax]
mov al, 0x5c
lock cmpxchg byte [0x1405362c4], cl
je 0x1401eefb8
mov edx, r8d
xor dl, 0x6d
add dl, byte [0x140536614]
cmp al, dl
jne 0x1401eef10
lea rax, [0x1405362c0]
ret
xor eax, eax
lea rcx, [0x140536330]
lea rdx, [0x140453210]
nop dword [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xd
jg 0x1401eef68
inc rax
jmp 0x1401eef50
xor r8b, 0xa4
add r8b, byte [0x140536614]
xchg byte [0x14053633e], r8b
lea rax, [0x140536330]
ret
xor eax, eax
lea rcx, [0x1405362b0]
lea rdx, [0x1404531a0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x1401eefff
inc rax
jmp 0x1401eefa0
xor edx, edx
lea rax, [0x1405362c0]
lea rcx, [0x1404531b0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 4
jl 0x1401eefd0
mov al, 0x67
xchg byte [0x1405362c4], al
lea rax, [0x1405362c0]
ret
mov al, 0xa7
xchg byte [0x1405362b5], al
lea rax, [0x1405362b0]
ret
Function at 0x1401fa9a0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401fa9ec
mov eax, 0x1440fe9b
add eax, dword [0x140538bd4]
cmp edx, eax
jne 0x1401faa4c
movzx eax, byte [0x140538b39]
cmp al, 0x73
je 0x1401fa9e4
mov cl, 0x98
nop word cs:[rax + rax]
mov al, 0xe7
lock cmpxchg byte [0x140538b39], cl
je 0x1401faabc
cmp al, 0x73
jne 0x1401fa9d0
lea rax, [0x140538b30]
ret
test edx, edx
je 0x1401faa93
movzx eax, byte [0x140538b13]
nop dword [rax + rax]
cmp al, 0xe7
je 0x1401fab69
movzx ecx, byte [0x140538bd0]
lea eax, [rcx + 0x15]
add cl, 0x61
lock cmpxchg byte [0x140538b13], cl
jne 0x1401faa00
xor eax, eax
lea rcx, [0x140538af0]
lea rdx, [0x1404538d0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1401fab61
inc rax
jmp 0x1401faa30
movzx eax, byte [0x140538b2f]
movzx ecx, byte [0x140538bd0]
add cl, 0xf1
cmp al, cl
je 0x1401faa8b
nop word cs:[rax + rax]
movzx ecx, byte [0x140538bd0]
lea eax, [rcx + 0x5d]
add cl, 0x51
lock cmpxchg byte [0x140538b2f], cl
je 0x1401faaf8
cmp al, 0xe0
jne 0x1401faa70
lea rax, [0x140538b20]
ret
movzx eax, byte [0x140538a79]
cmp al, 0xf3
je 0x1401faab4
mov cl, 0xff
mov al, 0x1f
lock cmpxchg byte [0x140538a79], cl
je 0x1401fab71
cmp al, 0xf3
jne 0x1401faaa0
lea rax, [0x140538a50]
ret
xor eax, eax
lea rcx, [0x140538b30]
lea rdx, [0x140453910]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1401fab51
inc rax
jmp 0x1401faad0
xor edx, edx
lea rax, [0x140538b20]
lea rcx, [0x140453900]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140538bd4]
add edx, r8d
add edx, 0x1440fe9c
cmp edx, 0xf
jl 0x1401fab10
mov al, pe_nt_image_headers64
xchg byte [0x140538b2f], al
lea rax, [0x140538b20]
ret
mov al, 0x73
xchg byte [0x140538b39], al
lea rax, [0x140538b30]
ret
mov al, 0xe7
xchg byte [0x140538b13], al
lea rax, [0x140538af0]
ret
xor eax, eax
lea rcx, [0x140538a50]
lea rdx, [0x140453840]
mov r8d, 0x1440fec4
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140538bd4]
add r10d, r8d
cmp r9d, r10d
jge 0x1401fabb1
inc rax
jmp 0x1401fab90
mov al, 0xf3
xchg byte [0x140538a79], al
lea rax, [0x140538a50]
ret
Function at 0x140200a60
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x140200ad0
mov eax, r8d
xor eax, 0x9322785a
add eax, dword [0x140538d8c]
cmp edx, eax
jne 0x140200b0c
movzx eax, byte [0x140538c15]
mov ecx, r8d
xor cl, 0x81
add cl, byte [0x140538d88]
cmp al, cl
je 0x140200ac8
nop word cs:[rax + rax]
movzx ecx, byte [0x140538d88]
mov eax, r8d
xor al, 0x88
add al, cl
mov edx, r8d
xor dl, 0x58
add dl, cl
lock cmpxchg byte [0x140538c15], dl
je 0x140200b6c
cmp al, 0x9a
jne 0x140200aa0
lea rax, [0x140538c10]
ret
xor r8d, 0x9322785a
add r8d, dword [0x140538d8c]
cmp edx, r8d
jne 0x140200b3c
movzx eax, byte [0x140538c72]
cmp al, 0x20
je 0x140200b04
mov cl, 0xe1
mov al, 0x8f
lock cmpxchg byte [0x140538c72], cl
je 0x140200bf8
cmp al, 0x20
jne 0x140200af0
lea rax, [0x140538c60]
ret
movzx eax, byte [0x140538d39]
cmp al, 0x73
je 0x140200b34
mov cl, 0xb2
nop dword [rax]
mov al, 0xed
lock cmpxchg byte [0x140538d39], cl
je 0x140200bbd
cmp al, 0x73
jne 0x140200b20
lea rax, [0x140538d30]
ret
movzx eax, byte [0x140538d2f]
cmp al, 0xe4
je 0x140200b64
mov cl, 0xb8
nop dword [rax]
mov al, 0xf
lock cmpxchg byte [0x140538d2f], cl
je 0x140200c28
cmp al, 0xe4
jne 0x140200b50
lea rax, [0x140538d20]
ret
xor eax, eax
lea rcx, [0x140538c10]
lea rdx, [0x1404539c0]
xor r8d, 0x9322785d
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x140538d8c]
add r9d, r8d
add eax, r9d
cmp eax, 5
jl 0x140200b90
mov al, 0x9a
xchg byte [0x140538c15], al
lea rax, [0x140538c10]
ret
xor eax, eax
lea rcx, [0x140538d30]
lea rdx, [0x140453ac0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x140200be8
inc rax
jmp 0x140200bd0
mov al, 0x73
xchg byte [0x140538d39], al
lea rax, [0x140538d30]
ret
xor eax, eax
lea rcx, [0x140538c60]
lea rdx, [0x140453a00]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x140200c7f
inc rax
jmp 0x140200c10
xor edx, edx
lea rax, [0x140538d20]
lea rcx, [0x140453ab0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x140200c40
mov al, 0xe4
xchg byte [0x140538d2f], al
lea rax, [0x140538d20]
ret
mov al, 0x20
xchg byte [0x140538c72], al
lea rax, [0x140538c60]
ret
Function at 0x140200db0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x140200df8
test edx, edx
je 0x140200e2c
movzx eax, byte [0x140538c55]
cmp al, 0xc5
je 0x140200df0
mov cl, 0xe9
nop word [rax + rax]
mov al, 0x5f
lock cmpxchg byte [0x140538c55], cl
je 0x140200e8c
mov edx, r8d
xor dl, 0x9a
add dl, byte [0x140538d88]
cmp al, dl
jne 0x140200dd0
lea rax, [0x140538c40]
ret
test edx, edx
je 0x140200e5c
movzx eax, byte [0x140538ccf]
cmp al, 0xf6
je 0x140200e24
mov cl, 0xc2
nop dword [rax]
mov al, 0x4a
lock cmpxchg byte [0x140538ccf], cl
je 0x140200ecf
cmp al, 0xf6
jne 0x140200e10
lea rax, [0x140538cc0]
ret
movzx eax, byte [0x140538d13]
cmp al, 0x5a
je 0x140200e54
mov cl, 0xe8
nop dword [rax]
mov al, 0xaf
lock cmpxchg byte [0x140538d13], cl
je 0x140200ef8
cmp al, 0x5a
jne 0x140200e40
lea rax, [0x140538cf0]
ret
movzx eax, byte [0x140538ce3]
cmp al, 0x28
je 0x140200e84
mov cl, 0xd7
nop dword [rax]
mov al, 6
lock cmpxchg byte [0x140538ce3], cl
je 0x140200f69
cmp al, 0x28
jne 0x140200e70
lea rax, [0x140538ce0]
ret
xor edx, edx
lea rax, [0x140538c40]
lea rcx, [0x1404539e0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x140200ea0
mov al, 0xc5
xchg byte [0x140538c55], al
lea rax, [0x140538c40]
ret
xor eax, eax
lea rcx, [0x140538cc0]
lea rdx, [0x140453a50]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x140200f59
inc rax
jmp 0x140200ee0
xor edx, edx
lea rax, [0x140538cf0]
lea rcx, [0x140453a80]
nop dword [rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rdx + rax]
xor r10b, r9b
mov byte [rdx + rax], r10b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
cmp edx, 0x23
jl 0x140200f10
xor r8b, 0x31
add r8b, byte [0x140538d88]
xchg byte [0x140538d13], r8b
lea rax, [0x140538cf0]
ret
mov al, 0xf6
xchg byte [0x140538ccf], al
lea rax, [0x140538cc0]
ret
xor eax, eax
lea rcx, [0x140538ce0]
lea rdx, [0x140453a70]
nop dword [rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
cmp r9d, 2
jg 0x140200fa8
inc rax
jmp 0x140200f80
xor r8b, 0x7f
add r8b, byte [0x140538d88]
xchg byte [0x140538ce3], r8b
lea rax, [0x140538ce0]
ret
Function at 0x140201930
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1402019a1
movzx eax, byte [0x1405394a5]
nop dword [rax + rax]
cmp al, 0x27
je 0x1402019dc
movzx ecx, byte [0x140539568]
mov eax, r9d
xor al, 0xca
add al, cl
mov edx, r9d
xor dl, 0xa2
add dl, cl
lock cmpxchg byte [0x1405394a5], dl
jne 0x140201940
xor eax, eax
lea rcx, [0x140539490]
lea rdx, [0x140453ca0]
xor r9d, 0xdf90263c
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
mov r10d, dword [0x14053956c]
add r10d, r9d
cmp r8d, r10d
jge 0x1402019d4
inc rax
jmp 0x140201980
movzx eax, byte [0x140539433]
cmp al, 0x97
je 0x1402019cc
mov cl, 0x56
nop
mov al, 0x4e
lock cmpxchg byte [0x140539433], cl
je 0x1402019e4
mov edx, r9d
xor dl, 0x74
add dl, byte [0x140539568]
cmp al, dl
jne 0x1402019b0
lea rax, [0x140539410]
ret
mov al, 0x27
xchg byte [0x1405394a5], al
lea rax, [0x140539490]
ret
xor edx, edx
lea rax, [0x140539410]
lea rcx, [0x140453c20]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x23
jl 0x140201a00
mov al, 0x97
xchg byte [0x140539433], al
lea rax, [0x140539410]
ret
Function at 0x14020e440
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rcx + 0x68], xmm0
movups xmmword [rcx + 0x58], xmm0
movups xmmword [rcx + 0x48], xmm0
movups xmmword [rcx + 0x38], xmm0
movups xmmword [rcx + 0x28], xmm0
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 8], xmm0
mov rdi, qword [rcx + 0x78]
mov rbx, qword [rcx + 0x80]
cmp rdi, rbx
je 0x14020e4b4
nop dword [rax]
mov eax, dword [0x14053b6e0]
lea edx, [rax + 0x381efbde]
mov ecx, eax
xor ecx, 0x10afa4d4
not eax
and eax, 0x6f505b2b
or eax, ecx
not eax
lea r8d, [rcx + rax*2]
mov rcx, rdi
call fcn.140210470
add rdi, 0x40
cmp rdi, rbx
jne 0x14020e480
mov rax, qword [rsi + 0x78]
mov qword [rsi + 0x80], rax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x14020ff40
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
test ecx, ecx
je 0x14020ff79
test edx, edx
je 0x140210044
movzx eax, byte [0x14053b330]
cmp al, 0xae
je 0x140210109
mov cl, 0x90
nop
mov al, 0xb4
lock cmpxchg byte [0x14053b330], cl
je 0x1402100b9
cmp al, 0xae
jne 0x14020ff60
jmp 0x140210109
test edx, edx
je 0x140210079
movzx eax, byte [0x14053b275]
nop dword [rax + rax]
cmp al, 0xd
je 0x140210038
movzx ecx, byte [0x14053b6f0]
lea eax, [rcx - 0x37]
mov edx, ecx
xor dl, 0xd2
and cl, 0x52
add cl, cl
add cl, dl
lock cmpxchg byte [0x14053b275], cl
jne 0x14020ff90
xor edx, edx
lea rax, [0x14053b260]
lea rcx, [0x1404548b0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x14053b6e0]
lea r9d, [r8 + 0x6e995980]
mov r10d, edx
not r10d
mov r11d, 0x9166a67f
sub r11d, r8d
mov esi, edx
and esi, r11d
and r11d, r10d
and r10d, r9d
or esi, r10d
xor edx, r9d
or r11d, edx
not r11d
lea edx, [rsi + r11*2]
add r8d, 0x6e995994
cmp edx, r8d
jl 0x14020ffd0
mov al, 0xd
xchg byte [0x14053b275], al
lea rax, [0x14053b260]
jmp 0x1402101c6
movzx eax, byte [0x14053b300]
cmp al, 0x8e
je 0x140210150
mov cl, 0x1b
nop word cs:[rax + rax]
mov al, 0x70
lock cmpxchg byte [0x14053b300], cl
je 0x140210115
cmp al, 0x8e
jne 0x140210060
jmp 0x140210150
movzx eax, byte [0x14053b1e2]
movzx ecx, byte [0x14053b6f0]
add cl, 0xfb
cmp al, cl
je 0x1402101bf
mov cl, 0xcf
nop word cs:[rax + rax]
mov al, 0x1b
lock cmpxchg byte [0x14053b1e2], cl
je 0x140210159
cmp al, 0x4c
jne 0x1402100a0
jmp 0x1402101bf
xor edx, edx
lea rax, [0x14053b320]
lea rcx, [0x140454960]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x14053b6e0]
add edx, r8d
add edx, 0x6e995980
cmp edx, 0x10
jl 0x1402100d0
mov al, 0xae
xchg byte [0x14053b330], al
lea rax, [0x14053b320]
jmp 0x1402101c6
xor eax, eax
lea rcx, [0x14053b2f0]
lea rdx, [0x140454940]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140210148
inc rax
jmp 0x140210130
mov al, 0x8e
xchg byte [0x14053b300], al
lea rax, [0x14053b2f0]
jmp 0x1402101c6
xor eax, eax
lea rcx, [0x14053b1e0]
lea rdx, [0x140454840]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
mov r11d, r10d
xor r11b, r9b
not r9b
mov ebx, r8d
and bl, r9b
or bl, r11b
not bl
xor r9b, r10b
and r9b, r8b
or r9b, bl
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x1402101b0
inc rax
jmp 0x140210170
movzx eax, byte [0x14053b6f0]
add al, 0xfb
xchg byte [0x14053b1e2], al
lea rax, [0x14053b1e0]
pop rbx
pop rsi
ret