joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140113ba0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rsi, rcx
mov rax, qword [0x1405c08a0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, dword [0x1405d0880]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
mov eax, dword [0x140560210]
mov edx, eax
xor edx, 0xc505c973
and eax, 0x4505c973
lea eax, [rdx + rax*2]
cmp ecx, eax
jne 0x140113c57
mov eax, 0xffb1
add eax, dword [0x14055f064]
cdqe
add rax, qword [0x14055f078]
mov rcx, rsi
mov edx, 0x72bfff79
mov r8d, 0xa1facf4c
call qword [case.0x14012b313.0]
lea rcx, [rsi + 0x4c0]
mov qword [rsi + 0x420], 0
mov r8d, 0x428
xor edx, edx
call fcn.14046ceb0
xorps xmm0, xmm0
movups xmmword [rsi + 0x8f0], xmm0
mov eax, dword [0x1405d0880]
mov ecx, dword [0x140560210]
not ecx
add ecx, eax
dec ecx
imul ecx, eax
test cl, 1
je 0x140113d7d
lea rdi, [rsi + 0x4c0]
xorps xmm6, xmm6
mov ebp, 0xffb1
lea rbx, [rsp + 0x24]
nop dword [rax + rax]
mov eax, dword [0x140560210]
sub eax, dword [0x14055f064]
add eax, 0xdd3f6bbf
mov ecx, eax
xor ecx, 0xa4d535c3
and eax, 0x24d535c3
lea eax, [rcx + rax*2]
mov ecx, 0xbd0fd7c0
sub ecx, eax
movsxd rax, ecx
add rax, qword [0x14055f078]
mov rcx, rsi
mov edx, 0x72bfff79
mov r8d, 0xa1facf4c
call qword [case.0x14012b313.0]
mov qword [rsi + 0x420], 0
mov r8d, 0x428
mov rcx, rdi
xor edx, edx
call fcn.14046ceb0
movups xmmword [rsi + 0x8f0], xmm6
mov eax, dword [0x14055f068]
add eax, ebp
cdqe
add rax, qword [0x14055f088]
mov ecx, 0x2771583b
call qword [case.0x14012b313.0]
mov eax, dword [0x14055f060]
mov ecx, dword [0x140560210]
mov edx, ecx
xor edx, 0xc504c9c2
and ecx, 0x4504c9c2
lea ecx, [rdx + rcx*2]
sub eax, ecx
cdqe
add rax, qword [0x14055f080]
mov rcx, rbx
mov edx, 0x8388ccd4
call qword [case.0x14012b313.0]
mov ecx, dword [rsp + 0x24]
mov eax, dword [0x14055f06c]
mov edx, dword [0x140560210]
mov r8d, edx
xor r8d, 0xc504c9c2
mov r9d, edx
and r9d, 0x4504c9c2
lea r8d, [r8 + r9*2]
sub edx, r8d
add eax, edx
add eax, 0xc505c973
cdqe
add rax, qword [0x14055f070]
mov edx, 0x7b990810
call qword [case.0x14012b313.0]
test al, 1
je 0x140113c70
jmp 0x140113be8
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1404448f0
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140128d30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rbx, r9
mov rdi, r8
mov rsi, rcx
mov byte [rcx + 0x38], dl
movzx edx, word [r8 + 0xc22b]
mov dword [rsp + 0x20], 0x6c616445
mov rcx, r9
mov r8d, 0x1658afa6
mov r9d, 0x872438d5
call fcn.1400aca70
lea rcx, [rsi + 0x40]
mov dword [rsp + 0x20], 0x9c1c08d
mov rdx, rax
mov r8d, 0x10dd40d5
mov r9d, 0x71632270
call fcn.14010eed0
movzx edx, word [rdi + 0xc22d]
mov dword [rsp + 0x20], 0x6c616445
mov rcx, rbx
mov r8d, 0x1658afa6
mov r9d, 0x872438d5
call fcn.1400aca70
lea rcx, [rsi + 0x68]
mov dword [rsp + 0x20], 0x9c1c08d
mov rdx, rax
mov r8d, 0x10dd40d5
mov r9d, 0x71632270
call fcn.14010eed0
movzx edx, word [rdi + 0xc22f]
mov eax, dword [0x140561c9c]
lea r8d, [rax + 0x5771e41d]
lea r9d, [rax - 0x37c292b4]
add eax, 0xad7a98bc
mov dword [rsp + 0x20], eax
mov rcx, rbx
call fcn.1400aca70
lea rcx, [rsi + 0x90]
mov edx, dword [0x140561c9c]
lea r8d, [rdx + 0x51f6754c]
lea r9d, [rdx - 0x4d83a919]
add edx, 0x4adaf504
mov dword [rsp + 0x20], edx
mov rdx, rax
call fcn.14010eed0
movzx edx, word [rdi + 0xc231]
mov dword [rsp + 0x20], 0x6c616445
mov rcx, rbx
mov r8d, 0x1658afa6
mov r9d, 0x872438d5
call fcn.1400aca70
lea rcx, [rsi + 0xb8]
mov dword [rsp + 0x20], 0x9c1c08d
mov rdx, rax
mov r8d, 0x10dd40d5
mov r9d, 0x71632270
call fcn.14010eed0
movzx edx, word [rdi + 0xc233]
mov eax, dword [0x140561c9c]
lea r8d, [rax + 0x5771e41d]
lea r9d, [rax - 0x37c292b4]
add eax, 0xad7a98bc
mov dword [rsp + 0x20], eax
mov rcx, rbx
call fcn.1400aca70
lea rcx, [rsi + 0xe0]
mov dword [rsp + 0x20], 0x9c1c08d
mov rdx, rax
mov r8d, 0x10dd40d5
mov r9d, 0x71632270
call fcn.14010eed0
movzx edx, word [rdi + 0xc235]
mov dword [rsp + 0x20], 0x6c616445
mov rcx, rbx
mov r8d, 0x1658afa6
mov r9d, 0x872438d5
call fcn.1400aca70
lea rcx, [rsi + 0x108]
mov dword [rsp + 0x20], 0x9c1c08d
mov rdx, rax
mov r8d, 0x10dd40d5
mov r9d, 0x71632270
call fcn.14010eed0
movzx edx, word [rdi + 0xc237]
mov dword [rsp + 0x20], 0x6c616445
mov rcx, rbx
mov r8d, 0x1658afa6
mov r9d, 0x872438d5
call fcn.1400aca70
lea rcx, [rsi + 0x130]
mov dword [rsp + 0x20], 0x9c1c08d
mov rdx, rax
mov r8d, 0x10dd40d5
mov r9d, 0x71632270
call fcn.14010eed0
mov qword [rdi + 0xc22b], 0
mov qword [rdi + 0xc231], 0
mov eax, dword [0x1405d05d0]
add eax, dword [rdi]
mov ecx, eax
xor ecx, 0xffefffff
test ecx, eax
je 0x140128f7d
movzx eax, byte [0x140561c98]
add al, 0xda
mov byte [rsi + 0x158], al
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x14012f040
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x140561c9c]
mov r8d, eax
xor r8d, 0x41193477
and eax, 0x41193477
lea eax, [r8 + rax*2]
cmp ecx, eax
jne 0x14012f08c
test edx, edx
je 0x14012f0bc
movzx eax, byte [0x14056195b]
cmp al, 0xe0
je 0x14012f084
mov cl, 0x76
nop
mov al, 7
lock cmpxchg byte [0x14056195b], cl
je 0x14012f11c
cmp al, 0xe0
jne 0x14012f070
lea rax, [0x140561950]
ret
test edx, edx
je 0x14012f0ec
movzx eax, byte [0x14056190d]
cmp al, 0xcf
je 0x14012f0b4
mov cl, 0x5f
nop dword [rax]
mov al, 0xd4
lock cmpxchg byte [0x14056190d], cl
je 0x14012f148
cmp al, 0xcf
jne 0x14012f0a0
lea rax, [0x140561900]
ret
movzx eax, byte [0x140561805]
cmp al, 0x42
je 0x14012f0e4
mov cl, 0x68
nop dword [rax]
mov al, 0xcb
lock cmpxchg byte [0x140561805], cl
je 0x14012f19f
cmp al, 0x42
jne 0x14012f0d0
lea rax, [0x1405617f0]
ret
movzx eax, byte [0x140561852]
cmp al, 0xe8
je 0x14012f114
mov cl, 0x36
nop dword [rax]
mov al, 0xd8
lock cmpxchg byte [0x140561852], cl
je 0x14012f210
cmp al, 0xe8
jne 0x14012f100
lea rax, [0x140561850]
ret
xor eax, eax
lea rcx, [0x140561950]
lea rdx, [0x14048c580]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x14012f178
inc rax
jmp 0x14012f130
xor eax, eax
lea rcx, [0x140561900]
lea rdx, [0x14048c530]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14012f18f
inc rax
jmp 0x14012f160
movzx eax, byte [0x140561c98]
add al, 0xb9
xchg byte [0x14056195b], al
lea rax, [0x140561950]
ret
mov al, 0xcf
xchg byte [0x14056190d], al
lea rax, [0x140561900]
ret
xor r8d, r8d
lea rax, [0x1405617f0]
lea rcx, [0x14048c430]
mov edx, 0x41193478
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [r8 + rax]
xor r10b, r9b
mov byte [r8 + rax], r10b
mov r9d, dword [0x140561c9c]
add r9d, edx
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r8d, [r10 + r9*2]
cmp r8d, 0x15
jl 0x14012f1c0
movzx eax, byte [0x140561c98]
add al, 0x1b
xchg byte [0x140561805], al
lea rax, [0x1405617f0]
ret
xor eax, eax
lea rcx, [0x140561850]
lea rdx, [0x14048c490]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x14012f248
inc rax
jmp 0x14012f220
mov al, 0xe8
xchg byte [0x140561852], al
lea rax, [0x140561850]
ret
Function at 0x14012f660
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0x208d6b5d
test ecx, ecx
je 0x14012f6bc
add eax, dword [0x140561c9c]
cmp edx, eax
jne 0x14012f6fc
movzx eax, byte [0x1405617c3]
mov ecx, r8d
xor cl, 0xe6
add cl, byte [0x140561c98]
cmp al, cl
je 0x14012f6b4
mov cl, 5
nop dword [rax + rax]
mov al, 0xbb
lock cmpxchg byte [0x1405617c3], cl
je 0x14012f7af
cmp al, 0xf3
jne 0x14012f6a0
lea rax, [0x1405617c0]
ret
add eax, dword [0x140561c9c]
cmp edx, eax
jne 0x14012f738
movzx eax, byte [0x14056194c]
cmp al, 0xe7
je 0x14012f6f4
mov cl, 0xcd
nop word cs:[rax + rax]
mov al, 0x74
lock cmpxchg byte [0x14056194c], cl
je 0x14012f838
cmp al, 0xe7
jne 0x14012f6e0
lea rax, [0x140561940]
ret
movzx eax, byte [0x1405617e0]
cmp al, 0x5b
je 0x14012f730
mov cl, 0x3e
nop dword [rax]
mov al, 0xc5
lock cmpxchg byte [0x1405617e0], cl
je 0x14012f800
mov edx, r8d
xor dl, 0x1e
add dl, byte [0x140561c98]
cmp al, dl
jne 0x14012f710
lea rax, [0x1405617d0]
ret
movzx eax, byte [0x1405618f9]
nop
cmp al, 0xc7
je 0x14012f7a7
movzx ecx, byte [0x140561c98]
mov eax, r8d
xor al, 0x2d
mov edx, eax
xor dl, cl
and al, cl
add al, al
add al, dl
mov edx, r8d
xor dl, 0x45
add dl, cl
lock cmpxchg byte [0x1405618f9], dl
jne 0x14012f740
xor edx, edx
lea rax, [0x1405618f0]
lea rcx, [0x14048c520]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 9
jl 0x14012f780
mov al, 0xc7
xchg byte [0x1405618f9], al
lea rax, [0x1405618f0]
ret
xor eax, eax
lea rcx, [0x1405617c0]
lea rdx, [0x14048c410]
mov r9d, r8d
xor r9d, 0x208d6b52
xor r8d, 0x208d6b50
cdqe
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
mov r10d, dword [0x140561c9c]
add eax, r9d
add eax, r10d
add r10d, r8d
cmp eax, r10d
jl 0x14012f7d0
mov al, 0xf3
xchg byte [0x1405617c3], al
lea rax, [0x1405617c0]
ret
xor eax, eax
lea rcx, [0x1405617d0]
lea rdx, [0x14048c420]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x14012f828
inc rax
jmp 0x14012f810
mov al, 0x5b
xchg byte [0x1405617e0], al
lea rax, [0x1405617d0]
ret
xor eax, eax
lea rcx, [0x140561940]
lea rdx, [0x14048c570]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x14012f868
inc rax
jmp 0x14012f850
mov al, 0xe7
xchg byte [0x14056194c], al
lea rax, [0x140561940]
ret
Function at 0x14012f9e0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14012fa2c
test edx, edx
je 0x14012fa5c
movzx eax, byte [0x1405617b3]
mov ecx, r8d
xor cl, 0x99
add cl, byte [0x140561c98]
cmp al, cl
je 0x14012fa24
mov cl, 0xa2
nop word cs:[rax + rax]
mov al, 0x46
lock cmpxchg byte [0x1405617b3], cl
je 0x14012fabc
cmp al, 0xd
jne 0x14012fa10
lea rax, [0x1405617b0]
ret
test edx, edx
je 0x14012fa8c
movzx eax, byte [0x14056189f]
cmp al, 7
je 0x14012fa54
mov cl, 0x77
nop dword [rax]
mov al, 0x47
lock cmpxchg byte [0x14056189f], cl
je 0x14012fb11
cmp al, 7
jne 0x14012fa40
lea rax, [0x140561890]
ret
movzx eax, byte [0x1405617a2]
cmp al, 0x63
je 0x14012fa84
mov cl, 5
nop dword [rax]
mov al, 0x6f
lock cmpxchg byte [0x1405617a2], cl
je 0x14012fb6f
cmp al, 0x63
jne 0x14012fa70
lea rax, [0x1405617a0]
ret
movzx eax, byte [0x140561822]
cmp al, 0x8f
je 0x14012fab4
mov cl, 0x58
nop dword [rax]
mov al, 0x84
lock cmpxchg byte [0x140561822], cl
je 0x14012fbb9
cmp al, 0x8f
jne 0x14012faa0
lea rax, [0x140561810]
ret
xor eax, eax
lea rcx, [0x1405617b0]
lea rdx, [0x14048c400]
xor r8d, 0xbed3ba05
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140561c9c]
add r10d, r8d
cmp r9d, r10d
jge 0x14012fb01
inc rax
jmp 0x14012fae0
mov al, 0xd
xchg byte [0x1405617b3], al
lea rax, [0x1405617b0]
ret
xor edx, edx
lea rax, [0x140561890]
lea rcx, [0x14048c4c0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x14012fb30
mov al, 7
xchg byte [0x14056189f], al
lea rax, [0x140561890]
ret
xor edx, edx
lea rax, [0x1405617a0]
lea rcx, [0x14048c3f0]
nop
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
cmp edx, 2
jl 0x14012fb80
xor r8b, 0x43
add r8b, byte [0x140561c98]
xchg byte [0x1405617a2], r8b
lea rax, [0x1405617a0]
ret
xor eax, eax
lea rcx, [0x140561810]
lea rdx, [0x14048c450]
mov r9d, r8d
xor r9d, 0x26839010
xor r8d, 0x99786ee7
and r9d, 0x27abd411
lea r8d, [r8 + r9*2]
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140561c9c]
add r10d, r8d
add r10d, 0xd8542bef
cmp r9d, r10d
jge 0x14012fc18
inc rax
jmp 0x14012fbf0
mov al, 0x8f
xchg byte [0x140561822], al
lea rax, [0x140561810]
ret
Function at 0x14013bf80
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1405d0a00]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
nop
mov eax, dword [0x1405d0a04]
cmp eax, 0x3a
jg 0x14013bf90
test ecx, ecx
je 0x14013bfb2
movzx eax, byte [0x140562b32]
cmp al, 0xa8
jne 0x14013c012
lea rax, [0x140562b20]
ret
movzx eax, byte [0x140562855]
movzx ecx, byte [0x140563380]
add cl, 0xe7
cmp al, cl
je 0x14013c00a
nop word [rax + rax]
movzx ecx, byte [0x140563380]
mov eax, ecx
mov edx, ecx
mov r8d, ecx
xor r8b, 0x27
and r8b, cl
xor cl, 0x7b
and al, 0x7b
add al, al
add al, cl
xor dl, 0x58
add r8b, r8b
add r8b, dl
lock cmpxchg byte [0x140562855], r8b
je 0x14013c161
cmp al, 0xab
jne 0x14013bfd0
lea rax, [0x140562840]
ret
mov ecx, 0xa5c3331b
mov dl, 0x23
mov r8d, 0xa5c33374
nop
mov eax, dword [0x1405d0a00]
lea r9d, [rax - 1]
imul r9d, eax
and r9d, 1
mov eax, dword [0x140563384]
add eax, ecx
cmp r9d, eax
jne 0x14013c080
mov al, 0xe2
lock cmpxchg byte [0x140562b32], dl
sete r9b
mov r10d, dword [0x1405d0a04]
mov r11d, dword [0x140563384]
add r11d, r8d
cmp r10d, r11d
jge 0x14013c080
test r9b, r9b
jne 0x14013c097
cmp al, 0xa8
jne 0x14013c020
jmp 0x14013bfaa
mov al, 0xe2
lock cmpxchg byte [0x140562b32], dl
mov eax, dword [0x1405d0a04]
cmp eax, 0xa
jge 0x14013c020
jmp 0x14013c03f
xor eax, eax
lea rcx, [0x140562b20]
lea rdx, [0x14048d5e0]
nop word [rax + rax]
cdqe
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
not r9b
mov r11d, r10d
xor r11b, r9b
and r11b, r10b
and r9b, r8b
or r9b, r11b
mov byte [rax + rcx], r9b
mov r8d, dword [0x140563384]
mov r9d, r8d
xor r9d, 0xa5c3331c
and r8d, 0x25c3331c
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0x12
jl 0x14013c0b0
xor eax, eax
nop
test al, al
je 0x14013c10f
mov ecx, dword [0x1405d0a04]
cmp ecx, 0x55
jge 0x14013c100
mov ecx, dword [0x1405d0a00]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
jne 0x14013c104
xor eax, eax
nop word cs:[rax + rax]
mov ecx, dword [0x1405d0a04]
cmp ecx, 0x2a
jg 0x14013c14b
mov cl, 0xa8
xchg byte [0x140562b32], cl
test al, al
je 0x14013bfaa
mov cl, 0xa8
xchg byte [0x140562b32], cl
cmp dword [0x140563384], 0x5a3ccce5
jne 0x14013c130
jmp 0x14013c13b
xor edx, edx
lea rax, [0x140562840]
lea rcx, [0x14048d330]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x140563384]
mov r9d, r8d
xor r9d, 0xa5c3331c
and r8d, 0x25c3331c
lea r8d, [r9 + r8*2]
mov r9d, r8d
xor r9d, r9d
not r9d
and r9d, edx
xor r9d, r8d
and edx, r8d
lea edx, [r9 + rdx*2]
cmp edx, 0x15
jl 0x14013c180
mov al, 0xab
xchg byte [0x140562855], al
lea rax, [0x140562840]
ret
Function at 0x14013c420
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14013c45c
movzx eax, byte [0x140562a79]
cmp al, 0x21
je 0x14013c454
mov cl, 0x48
nop word cs:[rax + rax]
mov al, 0x70
lock cmpxchg byte [0x140562a79], cl
je 0x14013c4dc
cmp al, 0x21
jne 0x14013c440
lea rax, [0x140562a70]
ret
mov eax, dword [0x140563384]
mov ecx, eax
xor ecx, 0xa5c3331b
and eax, 0x25c3331b
lea eax, [rcx + rax*2]
cmp edx, eax
jne 0x14013c4ac
movzx eax, byte [0x140562953]
cmp al, 0xa9
je 0x14013c4a4
mov cl, 0xf4
nop word cs:[rax + rax]
mov al, 0x24
lock cmpxchg byte [0x140562953], cl
je 0x14013c55e
cmp al, 0xa9
jne 0x14013c490
lea rax, [0x140562950]
ret
movzx eax, byte [0x140562b1d]
cmp al, 0x14
je 0x14013c4d4
mov cl, 0xfb
nop dword [rax]
mov al, 0xcc
lock cmpxchg byte [0x140562b1d], cl
je 0x14013c588
cmp al, 0x14
jne 0x14013c4c0
lea rax, [0x140562b10]
ret
xor edx, edx
lea rax, [0x140562a70]
lea rcx, [0x14048d530]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
not r10b
mov r11d, r9d
xor r11b, r10b
and r10b, r9b
not r11b
and r11b, r8b
or r11b, r10b
mov byte [rdx + rax], r11b
mov r8d, edx
xor r8d, 0x7ffffffe
and r8d, edx
xor edx, 1
lea edx, [rdx + r8*2]
mov r8d, dword [0x140563384]
mov r9d, r8d
xor r9d, 0xa5c33324
and r8d, 0x25c33324
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x14013c4f0
mov al, 0x21
xchg byte [0x140562a79], al
lea rax, [0x140562a70]
ret
xor eax, eax
lea rcx, [0x140562950]
lea rdx, [0x14048d430]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x14013c5b8
inc rax
jmp 0x14013c570
xor eax, eax
lea rcx, [0x140562b10]
lea rdx, [0x14048d5d0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14013c5c8
inc rax
jmp 0x14013c5a0
mov al, 0xa9
xchg byte [0x140562953], al
lea rax, [0x140562950]
ret
mov al, 0x14
xchg byte [0x140562b1d], al
lea rax, [0x140562b10]
ret
Function at 0x14013d3c0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14013d40c
test edx, edx
je 0x14013d43c
movzx eax, byte [0x1405629d8]
mov ecx, r8d
xor cl, 0x44
add cl, byte [0x140563380]
cmp al, cl
je 0x14013d404
mov cl, 0x11
nop word cs:[rax + rax]
mov al, 0x8c
lock cmpxchg byte [0x1405629d8], cl
je 0x14013d4b8
cmp al, 0xe9
jne 0x14013d3f0
lea rax, [0x1405629c0]
ret
test edx, edx
je 0x14013d478
movzx eax, byte [0x140562b0d]
cmp al, 0xb7
je 0x14013d434
mov cl, 0x12
nop dword [rax]
mov al, 0x54
lock cmpxchg byte [0x140562b0d], cl
je 0x14013d502
cmp al, 0xb7
jne 0x14013d420
lea rax, [0x140562b00]
ret
movzx eax, byte [0x1405628d6]
cmp al, 0x1a
je 0x14013d470
mov cl, 0x1b
nop dword [rax]
mov al, 0xec
lock cmpxchg byte [0x1405628d6], cl
je 0x14013d54f
mov edx, r8d
xor dl, 0x37
add dl, byte [0x140563380]
cmp al, dl
jne 0x14013d450
lea rax, [0x1405628c0]
ret
movzx eax, byte [0x140562a8d]
cmp al, 0x1c
je 0x14013d4b0
mov cl, 0xf5
nop word cs:[rax + rax]
mov al, 0x8d
lock cmpxchg byte [0x140562a8d], cl
je 0x14013d592
mov edx, r8d
xor dl, 0x39
add dl, byte [0x140563380]
cmp al, dl
jne 0x14013d490
lea rax, [0x140562a80]
ret
xor eax, eax
lea rcx, [0x1405629c0]
lea rdx, [0x14048d490]
nop dword [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0x17
jg 0x14013d4e8
inc rax
jmp 0x14013d4d0
xor r8b, 0x44
add r8b, byte [0x140563380]
xchg byte [0x1405629d8], r8b
lea rax, [0x1405629c0]
ret
xor edx, edx
lea rax, [0x140562b00]
lea rcx, [0x14048d5c0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x14013d520
mov al, 0xb7
xchg byte [0x140562b0d], al
lea rax, [0x140562b00]
ret
xor eax, eax
lea rcx, [0x1405628c0]
lea rdx, [0x14048d3b0]
nop
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0x15
jg 0x14013d578
inc rax
jmp 0x14013d560
xor r8b, 0x37
add r8b, byte [0x140563380]
xchg byte [0x1405628d6], r8b
lea rax, [0x1405628c0]
ret
xor edx, edx
lea rax, [0x140562a80]
lea rcx, [0x14048d540]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
not r8b
mov r10d, r8d
and r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, edx
not r8d
mov r9d, r8d
and r9d, 1
mov r10d, edx
and r10d, 0xfffffffe
or r10d, r9d
xor edx, 1
and r8d, 0x7ffffffe
or r8d, edx
not r8d
lea edx, [r10 + r8*2]
cmp edx, 0xd
jl 0x14013d5b0
mov al, 0x1c
xchg byte [0x140562a8d], al
lea rax, [0x140562a80]
ret
Function at 0x14016fed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x14016ff0c
test edx, edx
je 0x14016ff3c
movzx eax, byte [0x140569bb3]
movzx ecx, byte [0x14056a284]
add cl, 0xbe
cmp al, cl
je 0x14016ff04
mov cl, 0x75
nop
mov al, 0x9e
lock cmpxchg byte [0x140569bb3], cl
je 0x14016ff9c
cmp al, 0xfa
jne 0x14016fef0
lea rax, [0x140569b90]
ret
test edx, edx
je 0x14016ff6c
movzx eax, byte [0x140569b7e]
cmp al, 0xd0
je 0x14016ff34
mov cl, 0x32
nop dword [rax]
mov al, 0xa5
lock cmpxchg byte [0x140569b7e], cl
je 0x14016ffdf
cmp al, 0xd0
jne 0x14016ff20
lea rax, [0x140569b70]
ret
movzx eax, byte [0x140569c1b]
cmp al, 0x70
je 0x14016ff64
mov cl, 0x21
nop dword [rax]
mov al, 0x46
lock cmpxchg byte [0x140569c1b], cl
je 0x140170008
cmp al, 0x70
jne 0x14016ff50
lea rax, [0x140569c10]
ret
movzx eax, byte [0x140569bed]
cmp al, 6
je 0x14016ff94
mov cl, 0xf5
nop dword [rax]
mov al, 0x93
lock cmpxchg byte [0x140569bed], cl
je 0x140170071
cmp al, 6
jne 0x14016ff80
lea rax, [0x140569be0]
ret
xor eax, eax
lea rcx, [0x140569b90]
lea rdx, [0x14048df80]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x14016ffc8
inc rax
jmp 0x14016ffb0
movzx eax, byte [0x14056a284]
add al, 0xbe
xchg byte [0x140569bb3], al
lea rax, [0x140569b90]
ret
xor eax, eax
lea rcx, [0x140569b70]
lea rdx, [0x14048df60]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x140170061
inc rax
jmp 0x14016fff0
xor edx, edx
lea rax, [0x140569c10]
lea rcx, [0x14048e000]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x14056a280]
add edx, r8d
add edx, 0xeb429f3
cmp edx, 0xb
jl 0x140170020
movzx eax, byte [0x14056a284]
mov ecx, eax
xor cl, 0x34
and al, 0x34
add al, al
add al, cl
xchg byte [0x140569c1b], al
lea rax, [0x140569c10]
ret
mov al, 0xd0
xchg byte [0x140569b7e], al
lea rax, [0x140569b70]
ret
xor edx, edx
lea rax, [0x140569be0]
lea rcx, [0x14048dfd0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x14056a280]
add edx, r8d
add edx, 0xeb429f3
cmp edx, 0xd
jl 0x140170090
mov al, 6
xchg byte [0x140569bed], al
lea rax, [0x140569be0]
ret
Function at 0x14017ed80
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14017edbc
test edx, edx
je 0x14017edec
cmp byte [0x14056b05f], 0
je 0x14017edb4
mov cl, 0x99
nop word cs:[rax + rax]
mov al, 0xde
lock cmpxchg byte [0x14056b05f], cl
je 0x14017ee9c
test al, al
jne 0x14017eda0
lea rax, [0x14056b040]
ret
test edx, edx
je 0x14017ee26
movzx eax, byte [0x14056aed5]
cmp al, 0x36
je 0x14017ede4
mov cl, 0xfe
nop dword [rax]
mov al, 0x1a
lock cmpxchg byte [0x14056aed5], cl
je 0x14017eef1
cmp al, 0x36
jne 0x14017edd0
lea rax, [0x14056aec0]
ret
movzx eax, byte [0x14056b103]
cmp al, 0x13
je 0x14017ee1e
mov cl, 0x87
nop dword [rax]
mov al, 0xef
lock cmpxchg byte [0x14056b103], cl
je 0x14017ef41
movzx edx, byte [0x14056b6c8]
add dl, 0x41
cmp al, dl
jne 0x14017ee00
lea rax, [0x14056b0f0]
ret
movzx eax, byte [0x14056b1cd]
nop dword [rax]
cmp al, 0x48
je 0x14017efa9
movzx ecx, byte [0x14056b6c8]
lea eax, [rcx - 0x2f]
mov edx, ecx
xor dl, 0x25
and dl, cl
xor cl, 0x5a
add dl, dl
add dl, cl
lock cmpxchg byte [0x14056b1cd], dl
jne 0x14017ee30
xor eax, eax
lea rcx, [0x14056b1c0]
lea rdx, [0x14048ea10]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14017efa1
inc rax
jmp 0x14017ee70
xor eax, eax
lea rcx, [0x14056b040]
lea rdx, [0x14048e890]
mov r8d, 0xaa8bd740
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14056b6cc]
add r10d, r8d
cmp r9d, r10d
jge 0x14017eee1
inc rax
jmp 0x14017eec0
xor eax, eax
xchg byte [0x14056b05f], al
lea rax, [0x14056b040]
ret
xor edx, edx
lea rax, [0x14056aec0]
lea rcx, [0x14048e710]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x14056b6cc]
add edx, r8d
add edx, 0xaa8bd722
cmp edx, 0x15
jl 0x14017ef10
mov al, 0x36
xchg byte [0x14056aed5], al
lea rax, [0x14056aec0]
ret
xor edx, edx
lea rax, [0x14056b0f0]
lea rcx, [0x14048e940]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x14056b6cc]
add edx, r8d
add edx, 0xaa8bd722
cmp edx, 0x13
jl 0x14017ef60
mov al, 0x13
xchg byte [0x14056b103], al
lea rax, [0x14056b0f0]
ret
mov al, 0x48
xchg byte [0x14056b1cd], al
lea rax, [0x14056b1c0]
ret