joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402705b0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1402705ec
test edx, edx
je 0x14027061c
movzx eax, byte [0x14052b7d5]
cmp al, 0xd
je 0x1402705e4
mov cl, 0x11
nop word cs:[rax + rax]
mov al, 0xe3
lock cmpxchg byte [0x14052b7d5], cl
je 0x1402706e1
cmp al, 0xd
jne 0x1402705d0
lea rax, [0x14052b7c0]
ret
test edx, edx
je 0x140270656
movzx eax, byte [0x14052b893]
cmp al, 0x8e
je 0x140270614
mov cl, 0xf8
nop dword [rax]
mov al, 0x63
lock cmpxchg byte [0x14052b893], cl
je 0x140270731
cmp al, 0x8e
jne 0x140270600
lea rax, [0x14052b890]
ret
movzx eax, byte [0x14052b8c3]
cmp al, 0x4c
je 0x14027064e
mov cl, 0xb8
nop dword [rax]
mov al, 0xac
lock cmpxchg byte [0x14052b8c3], cl
je 0x140270768
movzx edx, byte [0x14052c3f4]
add dl, 0xd
cmp al, dl
jne 0x140270630
lea rax, [0x14052b8a0]
ret
movzx eax, byte [0x14052b772]
nop dword [rax]
cmp al, 0xd6
je 0x1402706d9
movzx ecx, byte [0x14052c3f4]
lea eax, [rcx - 0x79]
mov edx, ecx
xor dl, 0x69
and cl, 0x69
add cl, cl
add cl, dl
lock cmpxchg byte [0x14052b772], cl
jne 0x140270660
xor edx, edx
lea rax, [0x14052b760]
lea rcx, [0x1404356b0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x14052c3f0]
add edx, r8d
add edx, 0x7ee10461
cmp edx, 0x12
jl 0x1402706a0
mov al, 0xd6
xchg byte [0x14052b772], al
lea rax, [0x14052b760]
ret
xor eax, eax
lea rcx, [0x14052b7c0]
lea rdx, [0x140435710]
mov r8d, 0x7ee10475
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14052c3f0]
add r10d, r8d
cmp r9d, r10d
jge 0x140270721
inc rax
jmp 0x140270700
mov al, 0xd
xchg byte [0x14052b7d5], al
lea rax, [0x14052b7c0]
ret
xor eax, eax
lea rcx, [0x14052b890]
lea rdx, [0x1404357d0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x140270798
inc rax
jmp 0x140270750
xor eax, eax
lea rcx, [0x14052b8a0]
lea rdx, [0x1404357e0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1402707a8
inc rax
jmp 0x140270780
mov al, 0x8e
xchg byte [0x14052b893], al
lea rax, [0x14052b890]
ret
mov al, 0x4c
xchg byte [0x14052b8c3], al
lea rax, [0x14052b8a0]
ret
Function at 0x1402bfa00
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
test al, al
nop word cs:[rax + rax]
lea rax, [fcn.1402bfa00]
add eax, eax
add eax, 0x180
mov edx, eax
not edx
test edx, eax
jne 0x1402bfa10
test rcx, rcx
je 0x1402bfa5f
movaps xmm0, xmmword [0x14043c260]
movups xmmword [rcx + 0x20], xmm0
movaps xmm0, xmmword [0x14043c250]
movups xmmword [rcx + 0x10], xmm0
xorps xmm0, xmm0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm0
mov qword [rcx + 0x70], 0
movups xmmword [rcx], xmm0
mov eax, 0x6aaa177c
mov cl, 1
nop word cs:[rax + rax]
mov edx, dword [0x140566038]
mov r8d, dword [0x140537da8]
neg r8d
add r8d, edx
add r8d, 0x9555e8c2
imul r8d, edx
test r8b, 1
jne 0x1402bfaa9
mov edx, dword [0x14056603c]
mov r8d, dword [0x140537da8]
add r8d, eax
cmp edx, r8d
jl 0x1402bfaaf
test cl, cl
je 0x1402bfa70
jmp 0x1402bfa94
ret
Function at 0x1402d1ba0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test rcx, rcx
sete dl
movzx r8d, byte [0x140564750]
mov eax, 0xfffffffe
test r8b, dl
jne 0x1402d1c1e
xor r8b, dl
jne 0x1402d1c1e
nop dword [rax]
mov edx, dword [0x140566088]
lea r8d, [rdx - 1]
imul r8d, edx
test r8b, 1
jne 0x1402d1be5
mov rdx, qword [rcx + 0x30]
mov r8d, dword [0x14056608c]
cmp r8d, 0x39
jle 0x1402d1bfb
mov edx, dword [0x140566088]
lea r8d, [rdx - 1]
imul r8d, edx
test r8b, 1
jne 0x1402d1bc0
jmp 0x1402d1bd4
test rdx, rdx
je 0x1402d1c1e
cmp qword [rcx + 0x38], 0
je 0x1402d1c1e
cmp byte [0x14056459c], 0
jne 0x1402d1c1e
mov rdx, qword [rcx + 0x28]
test rdx, rdx
je 0x1402d1c1e
cmp qword [rdx], rcx
je 0x1402d1c1f
ret
mov r8d, 0xffffc0cc
add r8d, dword [rdx + 8]
cmp r8d, 0x1f
ja 0x1402d1c1e
mov rdx, qword [rcx + 0x28]
mov qword [rdx + 0x34], 0
mov dword [rdx + 0x3c], 0
cmp qword [rcx + 0x30], 0
sete dl
movzx r8d, byte [0x140564750]
test r8b, dl
jne 0x1402d1c1e
xor r8b, dl
jne 0x1402d1c1e
cmp qword [rcx + 0x38], 0
je 0x1402d1c1e
mov rdx, qword [rcx + 0x28]
test rdx, rdx
je 0x1402d1c1e
cmp qword [rdx], rcx
jne 0x1402d1c1e
mov r8d, 0xffffc0cc
add r8d, dword [rdx + 8]
cmp r8d, 0x1f
ja 0x1402d1c1e
mov eax, 0x73a19c2c
mov r8d, dword [0x14056608c]
cmp r8d, 0x5b
jg 0x1402d1cc1
mov dword [rdx + 0x24], 0
mov dword [rcx + 0x1c], 0
mov dword [rcx + 0xc], 0
mov qword [rcx + 0x20], 0
mov r8d, dword [rdx + 0x10]
mov r9d, dword [0x14056608c]
cmp r9d, 0xb
jle 0x1402d1cf4
mov dword [rdx + 0x24], 0
mov dword [rcx + 0x1c], 0
mov r8d, dword [0x1405395d0]
add r8d, eax
mov dword [rcx + 0xc], r8d
mov qword [rcx + 0x20], 0
mov r8d, dword [0x14056608c]
cmp r8d, 0x4a
jge 0x1402d1c86
jmp 0x1402d1c93
test r8d, r8d
je 0x1402d1d17
mov eax, r8d
not eax
mov r9d, eax
and r9d, 1
and r8d, 0xfffffffe
or r8d, r9d
and eax, 0xfffffffe
or eax, r8d
not eax
mov dword [rcx + 0x4c], eax
mov dword [rdx + 8], 0x3f34
mov eax, dword [0x1405395d0]
mov ecx, eax
xor ecx, 0x73a19c2c
and eax, 0x73a19c2c
lea eax, [rcx + rax*2]
mov dword [rdx + 0xc], eax
movabs rax, 0xffffffff00000000
mov qword [rdx + 0x14], rax
mov dword [rdx + 0x1c], 0x8000
mov qword [rdx + 0x28], 0
mov dword [rdx + 0x48], 0
mov eax, 0x73a19c2c
add eax, dword [0x1405395d0]
mov dword [rdx + 0x4c], eax
lea rax, [rdx + 0x550]
mov qword [rdx + 0x88], rax
mov qword [rdx + 0x68], rax
mov qword [rdx + 0x60], rax
mov eax, dword [0x1405395d0]
mov ecx, eax
xor ecx, 0x91238dd5
and eax, 0x11238dd5
lea eax, [rcx + rax*2]
add eax, 0xe27e0e58
mov dword [rdx + 0x1be0], eax
mov dword [rdx + 0x1be4], 0xffffffff
xor eax, eax
ret
Function at 0x140308a10
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1c8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x140], 0xfffffffffffffffe
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov eax, dword [0x140540528]
mov ecx, 0xafef7bdc
sub ecx, eax
add eax, 0x50108423
lea rdx, [fcn.140308a10]
add edx, edx
add edx, 0x13e0
xor eax, edx
not edx
and edx, ecx
or edx, eax
cmp edx, 0xffffffff
jne 0x140308b20
mov eax, dword [rdi + 8]
mov dword [rbp + 0x130], eax
mov eax, dword [rdi + 4]
mov ecx, eax
xor ecx, eax
not ecx
and ecx, dword [rbx]
xor ecx, eax
mov dword [rbp + 0x134], ecx
mov eax, dword [rdi]
mov dword [rbp + 0x138], eax
mov eax, dword [rdi + 0xc]
mov dword [rbp + 0x13c], eax
mov byte [rbp - 0x28], 0
lea r14, [rbp - 0x24]
mov r8d, 0x150
mov rcx, r14
xor edx, edx
call fcn.14040c5e0
mov dword [rsp + 0x48], 0x5fd3f468
mov dword [rsp + 0x40], 0xc2bda260
mov dword [rsp + 0x38], 0x44a10f6a
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 1
mov r8, r14
xor r9d, r9d
call fcn.140313820
movzx r9d, byte [rbp - 0x28]
mov eax, dword [0x140566b9c]
mov ecx, dword [0x140540528]
mov edx, ecx
xor edx, 0x5010843f
and ecx, 0x5010843f
lea ecx, [rdx + rcx*2]
cmp eax, ecx
jl 0x140308c1b
lea r14, [0x140312df0]
lea r15, [rbp - 0x24]
nop dword [rax + rax]
mov eax, dword [rdi + 8]
mov dword [rbp + 0x130], eax
mov eax, dword [rdi + 4]
mov edx, dword [rbx]
mov r8d, dword [0x140540528]
mov ecx, r8d
sub ecx, edx
add ecx, 0x50108422
mov r9d, ecx
xor r9d, eax
and ecx, eax
lea ecx, [r9 + rcx*2]
mov eax, ecx
sub eax, edx
sub r8d, eax
shl eax, cl
add r8d, 0x50108422
mov ecx, r8d
xor ecx, eax
and r8d, eax
lea ecx, [rcx + r8*2]
neg ecx
imul ecx, eax
xor ecx, eax
mov dword [rbp + 0x134], ecx
mov eax, dword [rdi]
mov dword [rbp + 0x138], eax
mov ecx, 0x60
call fcn.1403c3d24
mov qword [0x140566b88], rax
mov rcx, r14
call fcn.1403e45e0
mov eax, dword [rdi + 0xc]
mov dword [rbp + 0x13c], eax
mov byte [rbp - 0x28], 0
mov r8d, 0x150
mov rcx, r15
xor edx, edx
call fcn.14040c5e0
mov dword [rsp + 0x48], 0x5fd3f468
mov dword [rsp + 0x40], 0xc2bda260
mov dword [rsp + 0x38], 0x44a10f6a
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 1
mov r8, r15
xor r9d, r9d
call fcn.140313820
mov eax, dword [0x140566b9c]
cmp eax, 0xc
jge 0x140308b30
jmp 0x140308a6d
lea rax, [rbp + 0x2c]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x130]
mov r8d, 0x10
mov rcx, r14
call fcn.1402b4600
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x24]
mov r8, rdx
call fcn.1402b48c0
lea rdx, [rbp + 0x130]
mov rcx, rsi
call fcn.1403b4a60
lea rcx, [rbp - 0x24]
call fcn.1402b48a0
nop
add rsp, 0x1c8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x1403133e0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14031341c
test edx, edx
je 0x14031345c
movzx eax, byte [0x14053fe1b]
cmp al, 0x53
je 0x140313414
mov cl, 0x8b
nop word cs:[rax + rax]
mov al, 0xd4
lock cmpxchg byte [0x14053fe1b], cl
je 0x1403134ec
cmp al, 0x53
jne 0x140313400
lea rax, [0x14053fdf0]
ret
test edx, edx
je 0x1403134bc
movzx eax, byte [0x14054011e]
movzx ecx, byte [0x140540538]
add cl, 0xf0
cmp al, cl
je 0x140313454
mov cl, 0x63
nop dword [rax + rax]
mov al, 0x35
lock cmpxchg byte [0x14054011e], cl
je 0x140313538
cmp al, 0xa6
jne 0x140313440
lea rax, [0x140540110]
ret
movzx eax, byte [0x14053fe69]
nop word cs:[rax + rax]
cmp al, 0x43
je 0x140313570
movzx ecx, byte [0x140540538]
lea eax, [rcx + 0x74]
add cl, 0xd7
lock cmpxchg byte [0x14053fe69], cl
jne 0x140313470
xor eax, eax
lea rcx, [0x14053fe60]
lea rdx, [0x140449c20]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x140313568
inc rax
jmp 0x1403134a0
movzx eax, byte [0x14053feb3]
cmp al, 0xd4
je 0x1403134e4
mov cl, 0x66
nop dword [rax]
mov al, 0x53
lock cmpxchg byte [0x14053feb3], cl
je 0x140313588
cmp al, 0xd4
jne 0x1403134d0
lea rax, [0x14053fea0]
ret
xor edx, edx
lea rax, [0x14053fdf0]
lea rcx, [0x140449bb0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x140540528]
add edx, r8d
add edx, 0x50108423
add r8d, 0x5010844d
cmp edx, r8d
jl 0x140313500
mov al, 0x53
xchg byte [0x14053fe1b], al
lea rax, [0x14053fdf0]
ret
xor eax, eax
lea rcx, [0x140540110]
lea rdx, [0x140449ea0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x140313578
inc rax
jmp 0x140313550
mov al, 0x43
xchg byte [0x14053fe69], al
lea rax, [0x14053fe60]
ret
mov al, 0xa6
xchg byte [0x14054011e], al
lea rax, [0x140540110]
ret
xor edx, edx
lea rax, [0x14053fea0]
lea rcx, [0x140449c60]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140540528]
add edx, r8d
add edx, 0x50108423
cmp edx, 0x13
jl 0x1403135a0
mov al, 0xd4
xchg byte [0x14053feb3], al
lea rax, [0x14053fea0]
ret
Function at 0x140313620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x50108422
add eax, dword [0x140540528]
cmp ecx, eax
jne 0x14031365c
test edx, edx
je 0x1403136a7
movzx eax, byte [0x14053fe23]
cmp al, 0x3b
je 0x140313654
mov cl, 0xa7
mov al, 0x36
lock cmpxchg byte [0x14053fe23], cl
je 0x14031375c
cmp al, 0x3b
jne 0x140313640
lea rax, [0x14053fe20]
ret
test edx, edx
je 0x1403136fc
movzx eax, byte [0x140540095]
movzx ecx, byte [0x140540538]
add cl, 0xbb
cmp al, cl
je 0x14031369f
nop dword [rax]
movzx ecx, byte [0x140540538]
lea eax, [rcx + 0x65]
add cl, 0x6d
lock cmpxchg byte [0x140540095], cl
je 0x140313788
cmp al, 0x71
jne 0x140313680
lea rax, [0x140540090]
ret
movzx eax, byte [0x14053ff32]
nop
cmp al, 0xee
je 0x1403137e0
movzx ecx, byte [0x140540538]
lea eax, [rcx + 0x27]
add cl, 0x99
lock cmpxchg byte [0x14053ff32], cl
jne 0x1403136b0
xor eax, eax
lea rcx, [0x14053ff20]
lea rdx, [0x140449cd0]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x1403137d8
inc rax
jmp 0x1403136e0
movzx eax, byte [0x14053fef0]
nop word cs:[rax + rax]
cmp al, 0x2e
je 0x1403137f0
movzx ecx, byte [0x140540538]
lea eax, [rcx - 0x76]
add cl, 0x21
lock cmpxchg byte [0x14053fef0], cl
jne 0x140313710
xor eax, eax
lea rcx, [0x14053fee0]
lea rdx, [0x140449ca0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1403137e8
inc rax
jmp 0x140313740
xor eax, eax
lea rcx, [0x14053fe20]
lea rdx, [0x140449be0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1403137b8
inc rax
jmp 0x140313770
xor eax, eax
lea rcx, [0x140540090]
lea rdx, [0x140449e20]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x1403137c8
inc rax
jmp 0x1403137a0
mov al, 0x3b
xchg byte [0x14053fe23], al
lea rax, [0x14053fe20]
ret
mov al, 0x71
xchg byte [0x140540095], al
lea rax, [0x140540090]
ret
mov al, 0xee
xchg byte [0x14053ff32], al
lea rax, [0x14053ff20]
ret
mov al, 0x2e
xchg byte [0x14053fef0], al
lea rax, [0x14053fee0]
ret
Function at 0x140332850
Capabilities:
Check for software breakpoints

Disassembly:
sub rsp, 0x28
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx + 0x10]
cmp rdx, rcx
je 0x14033288f
nop word cs:[rax + rax]
add rdx, 8
mov rax, qword [rdx - 8]
cmp byte [rax], 0xcc
je 0x140332893
xor eax, eax
cmp byte [0x140564750], 0
jne 0x1403328f3
cmp rdx, rcx
jne 0x140332870
jmp 0x1403328f3
xor eax, eax
jmp 0x1403328f3
cmp qword [0x140566c18], 0
jne 0x1403328e4
mov ecx, 0x30
mov edx, 0xe620b864
mov r8d, 0x6442e4f2
mov r9d, 0xf21041ca
call fcn.1400aaef0
mov qword [rax + 0x28], 0xf
lea rcx, [0x140426b18]
mov qword [rax + 8], rcx
mov dword [rax], 0
mov qword [rax + 0x20], 0
mov byte [rax + 0x10], 0
mov qword [0x140566c18], rax
mov rax, qword [0x140566c18]
mov dword [rax], 0xb
mov al, 1
add rsp, 0x28
ret
Function at 0x140347ca0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov eax, dword [0x140566cbc]
cmp eax, 0x61
nop dword [rax + rax]
xor eax, eax
test al, al
jne 0x140347cd0
cmp rdi, 6
ja 0x140347e7c
mov eax, dword [0x140566cb8]
lea ecx, [rax - 1]
imul ecx, eax
jmp 0x140347d17
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
mov eax, dword [0x140566cb8]
mov ecx, dword [0x140548180]
not ecx
add ecx, eax
imul ecx, eax
test cl, 1
jne 0x140347cf0
test rbx, rbx
lea r14, [0x1404273f8]
cmovne r14, rbx
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
mov rcx, r14
mov edx, 0x5a401cd7
mov r8d, 0xf19aea5c
mov r9d, 0xd743711e
call fcn.1400ac7d0
mov r15, rax
mov ecx, dword [0x140566cb8]
lea eax, [rcx - 1]
imul eax, ecx
mov ecx, 0xc41fd0dc
add ecx, dword [0x140548180]
xor edx, edx
div ecx
test edx, edx
jne 0x140347cf0
lea rax, [rdi + rdi*2]
lea rsi, [rsi + rax*8]
add rsi, 0xb0
lea rcx, [rbp - 0x20]
cmp r15, 0xf
jbe 0x140347da3
mov rdx, r15
mov r9, r14
call fcn.140088500
jmp 0x140347db8
mov qword [rbp - 0x10], r15
mov rdx, r14
mov r8, r15
call fcn.14040bf30
mov byte [rbp + r15 - 0x20], 0
lea rax, [0x140426b18]
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x28]
mov rcx, rsi
call fcn.140258920
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x140347e7c
mov rcx, qword [rbp - 0x20]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140347e77
mov edx, dword [0x140566cbc]
cmp edx, 0x3b
jg 0x140347e20
jmp 0x140347dff
mov r8, qword [rcx - 8]
mov edx, dword [0x140566cb8]
lea r9d, [rdx + 1]
imul r9d, edx
test r9b, 1
je 0x140347e53
nop word [rax + rax]
mov edx, dword [0x140566cb8]
lea r8d, [rdx - 1]
imul r8d, edx
and r8d, 1
mov edx, dword [0x140548180]
mov r9d, edx
xor r9d, 0xc41fd0da
and edx, 0x441fd0da
lea edx, [r9 + rdx*2]
cmp r8d, edx
jne 0x140347e20
jmp 0x140347dff
sub rcx, r8
add rcx, 0xfffffffffffffff8
cmp rcx, 0x20
jae 0x140347e8a
add rax, qword [0x140548188]
movabs rdx, 0xe6be1a7c6418f7af
add rdx, rax
mov rcx, r8
call fcn.1400a9560
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov eax, dword [0x140566cbc]
cmp eax, 0x52
jg 0x140347ef7
mov ecx, dword [0x140566cb8]
mov edx, dword [0x140548180]
mov eax, ecx
sub eax, edx
add eax, 0x8e90f4a0
mov r8d, eax
xor r8d, 0xad4f3a85
and eax, 0x2d4f3a85
lea eax, [r8 + rax*2]
imul eax, ecx
mov ecx, edx
not ecx
mov r8d, edx
and r8d, 0x3be02f23
mov r9d, ecx
and r9d, 0xc41fd0dc
or r9d, r8d
xor edx, 0x441fd0dc
and ecx, 0x3be02f23
or ecx, edx
not ecx
lea ecx, [r9 + rcx*2]
xor edx, edx
div ecx
test edx, edx
je 0x140347f14
mov eax, 0xc41fd0ef
nop dword [rax]
mov ecx, dword [0x140566cbc]
mov edx, dword [0x140548180]
add edx, eax
cmp ecx, edx
jge 0x140347f00
jmp 0x140347e95
call fcn.1403c3cac
int3
Function at 0x14034a230
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14034a26c
test edx, edx
je 0x14034a2ca
movzx eax, byte [0x14054817f]
cmp al, 0x9c
je 0x14034a264
mov cl, 0xd0
nop dword [rax]
mov al, 0xdc
lock cmpxchg byte [0x14054817f], cl
je 0x14034a34c
cmp al, 0x9c
jne 0x14034a250
lea rax, [0x140548170]
ret
mov eax, 0xc41fd0da
add eax, dword [0x140548180]
cmp edx, eax
jne 0x14034a322
movzx eax, byte [0x140548005]
cmp al, 0x14
je 0x14034a2c2
nop word [rax + rax]
movzx ecx, byte [0x140548184]
lea eax, [rcx + 3]
add cl, 0xe6
lock cmpxchg byte [0x140548005], cl
je 0x14034a3e3
movzx ecx, byte [0x140548184]
mov edx, ecx
xor dl, 0xdd
and cl, 0x5d
add cl, cl
add cl, dl
cmp al, cl
jne 0x14034a290
lea rax, [0x140547ff0]
ret
movzx eax, byte [0x14054816b]
movzx ecx, byte [0x140548184]
add cl, 0x25
cmp al, cl
je 0x14034a31a
mov cl, 0xb8
nop word cs:[rax + rax]
mov al, 0x20
lock cmpxchg byte [0x14054816b], cl
je 0x14034a388
movzx edx, byte [0x140548184]
mov r8d, edx
xor r8b, 0x25
and dl, 0x25
add dl, dl
add dl, r8b
cmp al, dl
jne 0x14034a2f0
lea rax, [0x140548160]
ret
movzx eax, byte [0x14054805c]
cmp al, 0x75
je 0x14034a344
mov cl, 0x2b
nop
mov al, 0x27
lock cmpxchg byte [0x14054805c], cl
je 0x14034a418
cmp al, 0x75
jne 0x14034a330
lea rax, [0x140548050]
ret
xor eax, eax
lea rcx, [0x140548170]
lea rdx, [0x14044b2c0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x14034a378
inc rax
jmp 0x14034a360
mov al, 0x9c
xchg byte [0x14054817f], al
lea rax, [0x140548170]
ret
xor edx, edx
lea rax, [0x140548160]
lea rcx, [0x14044b2b0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x140548180]
lea r9d, [r8 - 0x3be02f25]
mov r10d, edx
xor r10d, r9d
and edx, r9d
lea edx, [r10 + rdx*2]
add r8d, 0xc41fd0e5
cmp edx, r8d
jl 0x14034a3a0
mov al, 0x5c
xchg byte [0x14054816b], al
lea rax, [0x140548160]
ret
xor eax, eax
lea rcx, [0x140547ff0]
lea rdx, [0x14044b150]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x14034a448
inc rax
jmp 0x14034a400
xor eax, eax
lea rcx, [0x140548050]
lea rdx, [0x14044b1b0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x14034a458
inc rax
jmp 0x14034a430
mov al, 0x14
xchg byte [0x140548005], al
lea rax, [0x140547ff0]
ret
mov al, 0x75
xchg byte [0x14054805c], al
lea rax, [0x140548050]
ret
Function at 0x14034a780
Capabilities:
Check for software breakpoints

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14034a810
test edx, edx
je 0x14034a898
movzx eax, byte [0x140548041]
nop dword [rax]
cmp al, 0x94
je 0x14034a900
movzx ecx, byte [0x140548184]
mov eax, r8d
xor al, 0x3f
add al, cl
mov edx, r8d
xor dl, 0x39
add dl, cl
lock cmpxchg byte [0x140548041], dl
jne 0x14034a7a0
xor eax, eax
lea rcx, [0x140548030]
lea rdx, [0x14044b190]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x14034a8f8
inc rax
jmp 0x14034a7e0
test edx, edx
je 0x14034a8c8
movzx eax, byte [0x140548022]
nop
cmp al, 0xc1
je 0x14034a910
movzx ecx, byte [0x140548184]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 9
mov eax, r8d
and al, 0xf6
or al, r9b
add al, cl
and dl, 0xce
mov r9d, r8d
and r9b, 0x31
or r9b, dl
mov edx, r9d
xor dl, cl
and r9b, cl
add r9b, r9b
add r9b, dl
lock cmpxchg byte [0x140548022], r9b
jne 0x14034a820
xor eax, eax
lea rcx, [0x140548010]
lea rdx, [0x14044b170]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x14034a908
inc rax
jmp 0x14034a880
movzx eax, byte [0x14054811f]
cmp al, 0x94
je 0x14034a8c0
mov cl, 0xc8
nop word cs:[rax + rax]
mov al, 0xf0
lock cmpxchg byte [0x14054811f], cl
je 0x14034a918
cmp al, 0x94
jne 0x14034a8b0
lea rax, [0x140548110]
ret
movzx eax, byte [0x140547fe4]
cmp al, 0xcd
je 0x14034a8f0
mov cl, 0x9b
nop word cs:[rax + rax]
mov al, 0x6c
lock cmpxchg byte [0x140547fe4], cl
je 0x14034a958
cmp al, 0xcd
jne 0x14034a8e0
lea rax, [0x140547fe0]
ret
mov al, 0x94
xchg byte [0x140548041], al
lea rax, [0x140548030]
ret
mov al, 0xc1
xchg byte [0x140548022], al
lea rax, [0x140548010]
ret
xor eax, eax
lea rcx, [0x140548110]
lea rdx, [0x14044b260]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x14034a948
inc rax
jmp 0x14034a930
mov al, 0x94
xchg byte [0x14054811f], al
lea rax, [0x140548110]
ret
xor eax, eax
lea rcx, [0x140547fe0]
lea rdx, [0x14044b140]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x14034a988
inc rax
jmp 0x14034a970
mov al, 0xcd
xchg byte [0x140547fe4], al
lea rax, [0x140547fe0]
ret