joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140119c20
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140119ca1
test edx, edx
je 0x140119ce6
movzx eax, byte [0x1404f0d03]
nop word cs:[rax + rax]
cmp al, 0xe4
je 0x140119c99
movzx ecx, byte [0x1404fb750]
lea eax, [rcx - 0x6f]
add cl, 0xf3
lock cmpxchg byte [0x1404f0d03], cl
jne 0x140119c40
xor edx, edx
lea rax, [0x1404f0ce0]
lea rcx, [0x140429c80]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1404fb740]
add edx, r8d
add edx, 0xcf0897e2
cmp edx, 0x23
jl 0x140119c70
mov al, 0xe4
xchg byte [0x1404f0d03], al
lea rax, [0x1404f0ce0]
ret
test edx, edx
je 0x140119d75
movzx eax, byte [0x1404f0cc5]
cmp al, 0xb4
je 0x140119cde
mov cl, 0x55
nop word cs:[rax + rax]
mov al, 7
lock cmpxchg byte [0x1404f0cc5], cl
je 0x140119da8
movzx edx, byte [0x1404fb750]
add dl, 0xef
cmp al, dl
jne 0x140119cc0
lea rax, [0x1404f0cc0]
ret
movzx eax, byte [0x1404f0b82]
nop dword [rax]
movzx ecx, byte [0x1404fb750]
add cl, 0x66
cmp al, cl
je 0x140119d6d
movzx ecx, byte [0x1404fb750]
mov edx, ecx
xor dl, 0x82
mov eax, ecx
and al, 2
add al, al
add al, dl
add cl, 0x5e
lock cmpxchg byte [0x1404f0b82], cl
jne 0x140119cf0
xor edx, edx
lea rax, [0x1404f0b70]
lea rcx, [0x140429b20]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, dword [0x1404fb740]
add edx, r8d
add edx, 0xcf0897e2
cmp edx, 0x12
jl 0x140119d30
mov al, 0x2b
xchg byte [0x1404f0b82], al
lea rax, [0x1404f0b70]
ret
movzx eax, byte [0x1404f0c25]
cmp al, 0x72
je 0x140119da0
mov cl, 0x99
nop word cs:[rax + rax]
mov al, 0x65
lock cmpxchg byte [0x1404f0c25], cl
je 0x140119df6
cmp al, 0x72
jne 0x140119d90
lea rax, [0x1404f0c10]
ret
xor edx, edx
lea rax, [0x1404f0cc0]
lea rcx, [0x140429c60]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 5
jl 0x140119dc0
movzx eax, byte [0x1404fb750]
add al, 0xef
xchg byte [0x1404f0cc5], al
lea rax, [0x1404f0cc0]
ret
xor eax, eax
lea rcx, [0x1404f0c10]
lea rdx, [0x140429bc0]
nop word cs:[rax + rax]
cdqe
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
mov r8d, dword [0x1404fb740]
mov r9d, r8d
xor r9d, 0xcf0897e2
and r8d, 0x4f0897e2
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0x15
jl 0x140119e10
mov al, 0x72
xchg byte [0x1404f0c25], al
lea rax, [0x1404f0c10]
ret
Function at 0x14011a150
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14011a18c
test edx, edx
je 0x14011a20c
movzx eax, byte [0x1404f0ba8]
cmp al, 0x21
je 0x14011a184
mov cl, 0x3a
nop
mov al, 0xd
lock cmpxchg byte [0x1404f0ba8], cl
je 0x14011a28c
cmp al, 0x21
jne 0x14011a170
lea rax, [0x1404f0b90]
ret
test edx, edx
je 0x14011a25c
movzx eax, byte [0x1404f0b40]
nop dword [rax + rax]
cmp al, 0x83
je 0x14011a31b
movzx ecx, byte [0x1404fb750]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0x80
mov eax, r8d
and al, 0x7f
or al, r9b
add al, cl
and dl, 0xa3
mov r9d, r8d
and r9b, 0x5c
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x1404f0b40], r9b
jne 0x14011a1a0
xor eax, eax
lea rcx, [0x1404f0b30]
lea rdx, [0x140429af0]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xf
jg 0x14011a309
inc rax
jmp 0x14011a1f0
movzx eax, byte [0x1404f0ca3]
movzx ecx, byte [0x1404fb750]
xor r8b, 0x56
mov edx, r8d
xor dl, cl
and r8b, cl
add r8b, r8b
add r8b, dl
cmp al, r8b
je 0x14011a254
mov cl, 0x34
nop word cs:[rax + rax]
mov al, 0x28
lock cmpxchg byte [0x1404f0ca3], cl
je 0x14011a323
cmp al, 0xf0
jne 0x14011a240
lea rax, [0x1404f0ca0]
ret
movzx eax, byte [0x1404f0d3b]
cmp al, 0xf9
je 0x14011a284
mov cl, 0xd0
nop dword [rax]
mov al, 0xa8
lock cmpxchg byte [0x1404f0d3b], cl
je 0x14011a37a
cmp al, 0xf9
jne 0x14011a270
lea rax, [0x1404f0d30]
ret
xor edx, edx
lea rax, [0x1404f0b90]
lea rcx, [0x140429b40]
xor r8d, 0x55d8a39f
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rdx + rax]
xor r10b, r9b
mov byte [rdx + rax], r10b
mov r9d, dword [0x1404fb740]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
neg edx
neg r9d
mov r10d, edx
xor r10d, r9d
and r9d, edx
lea edx, [r10 + r9*2]
neg edx
cmp edx, 0x18
jl 0x14011a2b0
mov al, 0x21
xchg byte [0x1404f0ba8], al
lea rax, [0x1404f0b90]
ret
xor r8b, 0xc3
add r8b, byte [0x1404fb750]
xchg byte [0x1404f0b40], r8b
lea rax, [0x1404f0b30]
ret
xor edx, edx
lea rax, [0x1404f0ca0]
lea rcx, [0x140429c40]
nop word cs:[rax + rax]
movsxd r8, edx
movzx edx, byte [r8 + rcx]
mov r9d, edx
xor r9b, dl
not r9b
and r9b, byte [r8 + rax]
xor r9b, dl
mov byte [r8 + rax], r9b
lea edx, [r8 + r8]
sub edx, r8d
inc edx
cmp edx, 3
jl 0x14011a340
mov al, 0xf0
xchg byte [0x1404f0ca3], al
lea rax, [0x1404f0ca0]
ret
xor edx, edx
lea rax, [0x1404f0d30]
lea rcx, [0x140429cd0]
nop word [rax + rax]
movsxd rdx, edx
xor r8d, r8d
sub r8b, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
xor r10d, r10d
sub r10b, r9b
mov r9d, r8d
xor r9b, r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
neg r10b
mov byte [rdx + rax], r10b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xb
jl 0x14011a390
mov al, 0xf9
xchg byte [0x1404f0d3b], al
lea rax, [0x1404f0d30]
ret
Function at 0x14011a580
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14011a5cc
test edx, edx
je 0x14011a60c
movzx eax, byte [0x1404f0c99]
xor r8b, 0x56
add r8b, byte [0x1404fb750]
cmp al, r8b
je 0x14011a5c4
mov cl, 0xc6
nop word cs:[rax + rax]
mov al, 0xb7
lock cmpxchg byte [0x1404f0c99], cl
je 0x14011a6cc
cmp al, 0xaa
jne 0x14011a5b0
lea rax, [0x1404f0c90]
ret
mov eax, r8d
xor eax, 0x38ffa452
add eax, dword [0x1404fb740]
cmp edx, eax
jne 0x14011a69b
movzx eax, byte [0x1404f0c80]
cmp al, 0xa6
je 0x14011a604
mov cl, 0xf6
nop
mov al, 0x58
lock cmpxchg byte [0x1404f0c80], cl
je 0x14011a74d
cmp al, 0xa6
jne 0x14011a5f0
lea rax, [0x1404f0c70]
ret
movzx eax, byte [0x1404f0d4f]
nop word cs:[rax + rax]
cmp al, 0xd6
je 0x14011a745
movzx ecx, byte [0x1404fb750]
mov eax, r8d
xor al, 0x64
add al, cl
mov edx, r8d
xor dl, 0x69
add dl, cl
lock cmpxchg byte [0x1404f0d4f], dl
jne 0x14011a620
xor eax, eax
lea rcx, [0x1404f0d40]
lea rdx, [0x140429ce0]
nop dword [rax + rax]
xor r9d, r9d
sub r9b, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
xor r11d, r11d
sub r11b, r10b
mov r10d, r9d
xor r10b, r11b
and r11b, r9b
add r11b, r11b
add r11b, r10b
neg r11b
mov byte [rax + rcx], r11b
lea r9d, [rax + 1]
cmp r9d, 0xe
jg 0x14011a725
inc rax
jmp 0x14011a660
movzx eax, byte [0x1404f0cd3]
cmp al, 0x8a
je 0x14011a6c4
mov cl, 0x11
nop dword [rax + rax]
mov al, 0x83
lock cmpxchg byte [0x1404f0cd3], cl
je 0x14011a791
cmp al, 0x8a
jne 0x14011a6b0
lea rax, [0x1404f0cd0]
ret
xor eax, eax
lea rcx, [0x1404f0c90]
lea rdx, [0x140429c30]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
mov r11d, r9d
xor r11b, r10b
and r10b, r9b
not r11b
and r11b, r8b
or r11b, r10b
mov byte [rax + rcx], r11b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x14011a715
inc rax
jmp 0x14011a6e0
mov al, 0xaa
xchg byte [0x1404f0c99], al
lea rax, [0x1404f0c90]
ret
movzx eax, byte [0x1404fb750]
xor r8b, 0xa2
mov ecx, r8d
xor cl, al
and r8b, al
add r8b, r8b
add r8b, cl
xchg byte [0x1404f0d4f], r8b
lea rax, [0x1404f0d40]
ret
xor eax, eax
lea rcx, [0x1404f0c70]
lea rdx, [0x140429c20]
xor r8d, 0x38ffa442
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1404fb740]
add r10d, r8d
cmp r9d, r10d
jge 0x14011a7fe
inc rax
jmp 0x14011a770
xor edx, edx
lea rax, [0x1404f0cd0]
lea rcx, [0x140429c70]
nop word cs:[rax + rax]
movsxd rdx, edx
xor r8d, r8d
sub r8b, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
xor r10d, r10d
sub r10b, r9b
mov r9d, r8d
xor r9b, r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
neg r10b
mov byte [rdx + rax], r10b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 3
jl 0x14011a7b0
mov al, 0x8a
xchg byte [0x1404f0cd3], al
lea rax, [0x1404f0cd0]
ret
mov al, 0xa6
xchg byte [0x1404f0c80], al
lea rax, [0x1404f0c70]
ret
Function at 0x140120560
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x140120605
test edx, edx
je 0x140120635
movzx eax, byte [0x1404fc4c0]
nop dword [rax]
cmp al, 0xb6
je 0x14012067b
movzx ecx, byte [0x1404fca74]
mov eax, r8d
xor al, 0xbd
add al, cl
mov edx, r8d
xor dl, 0xcc
add dl, cl
lock cmpxchg byte [0x1404fc4c0], dl
jne 0x140120580
xor eax, eax
lea rcx, [0x1404fc4b0]
lea rdx, [0x14042a330]
mov r9d, r8d
xor r9d, 0x27caa4a3
nop word cs:[rax + rax]
movzx r10d, byte [rax + rcx]
movzx r11d, byte [rax + rdx]
mov ebx, r10d
xor bl, r11b
and r10b, r11b
add r10b, r10b
add r10b, bl
mov byte [rax + rcx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x1404fca70]
add r11d, r9d
cmp r10d, r11d
jge 0x140120669
inc rax
jmp 0x1401205d0
movzx eax, byte [0x1404fc50f]
cmp al, 0xe1
je 0x1401206fd
mov cl, 0xef
nop word cs:[rax + rax]
mov al, 0xf6
lock cmpxchg byte [0x1404fc50f], cl
je 0x140120684
cmp al, 0xe1
jne 0x140120620
jmp 0x1401206fd
movzx eax, byte [0x1404fc4f3]
cmp al, 0xe3
je 0x140120740
mov cl, 0x6d
nop word cs:[rax + rax]
mov al, 0x72
lock cmpxchg byte [0x1404fc4f3], cl
je 0x140120706
cmp al, 0xe3
jne 0x140120650
jmp 0x140120740
xor r8b, 0xd7
add r8b, byte [0x1404fca74]
xchg byte [0x1404fc4c0], r8b
lea rax, [0x1404fc4b0]
pop rbx
ret
xor r9d, r9d
lea rax, [0x1404fc500]
lea rcx, [0x14042a370]
mov edx, r8d
xor edx, 0x27caa4b2
nop
movsxd r9, r9d
movzx r10d, byte [r9 + rax]
movzx r11d, byte [r9 + rcx]
mov ebx, r10d
xor bl, r11b
and r10b, r11b
add r10b, r10b
add r10b, bl
mov byte [r9 + rax], r10b
mov r10d, dword [0x1404fca70]
add r10d, edx
mov r11d, r9d
xor r11d, r10d
and r10d, r9d
lea r9d, [r11 + r10*2]
cmp r9d, 0xf
jl 0x1401206a0
movzx eax, byte [0x1404fca74]
xor r8b, 0x20
mov ecx, r8d
xor cl, al
and r8b, al
add r8b, r8b
add r8b, cl
xchg byte [0x1404fc50f], r8b
lea rax, [0x1404fc500]
pop rbx
ret
xor eax, eax
lea rcx, [0x1404fc4d0]
lea rdx, [0x14042a340]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x140120738
inc rax
jmp 0x140120720
mov al, 0xe3
xchg byte [0x1404fc4f3], al
lea rax, [0x1404fc4d0]
pop rbx
ret
Function at 0x140126620
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14012666c
xor r8d, 0xed8f37ea
add r8d, dword [0x1404fcf48]
cmp edx, r8d
jne 0x14012669c
movzx eax, byte [0x1404fcd03]
cmp al, 0x77
je 0x140126664
mov cl, 0x7c
nop dword [rax]
mov al, 0x44
lock cmpxchg byte [0x1404fcd03], cl
je 0x1401266fc
cmp al, 0x77
jne 0x140126650
lea rax, [0x1404fcd00]
ret
test edx, edx
je 0x1401266cc
movzx eax, byte [0x1404fce12]
cmp al, 0xc3
je 0x140126694
mov cl, 0x1e
nop dword [rax]
mov al, 0x80
lock cmpxchg byte [0x1404fce12], cl
je 0x1401267bc
cmp al, 0xc3
jne 0x140126680
lea rax, [0x1404fce00]
ret
movzx eax, byte [0x1404fcd59]
cmp al, 0x57
je 0x1401266c4
mov cl, 4
nop dword [rax]
mov al, 0x40
lock cmpxchg byte [0x1404fcd59], cl
je 0x140126741
cmp al, 0x57
jne 0x1401266b0
lea rax, [0x1404fcd50]
ret
movzx eax, byte [0x1404fcdcd]
cmp al, 0x9c
je 0x1401266f4
mov cl, 0x2a
nop dword [rax]
mov al, 0x6b
lock cmpxchg byte [0x1404fcdcd], cl
je 0x140126802
cmp al, 0x9c
jne 0x1401266e0
lea rax, [0x1404fcdc0]
ret
xor eax, eax
lea rcx, [0x1404fcd00]
lea rdx, [0x14042a410]
nop dword [rax]
movzx r8d, byte [rax + rcx]
add r8b, byte [rax + rdx]
add r8b, 0x7f
mov r9d, r8d
xor r9b, 0x81
and r8b, 1
add r8b, r8b
add r8b, r9b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1401267ac
inc rax
jmp 0x140126710
xor edx, edx
lea rax, [0x1404fcd50]
lea rcx, [0x14042a460]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
not r8d
mov r9d, r8d
and r9d, 1
mov r10d, edx
and r10d, 0xfffffffe
or r10d, r9d
xor edx, 1
and r8d, 0x7ffffffe
or r8d, edx
not r8d
lea edx, [r10 + r8*2]
cmp edx, 9
jl 0x140126760
mov al, 0x57
xchg byte [0x1404fcd59], al
lea rax, [0x1404fcd50]
ret
mov al, 0x77
xchg byte [0x1404fcd03], al
lea rax, [0x1404fcd00]
ret
xor eax, eax
lea rcx, [0x1404fce00]
lea rdx, [0x14042a500]
nop dword [rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0x11
jg 0x1401267e8
inc rax
jmp 0x1401267d0
xor r8b, 0xc0
add r8b, byte [0x1404fcf58]
xchg byte [0x1404fce12], r8b
lea rax, [0x1404fce00]
ret
xor eax, eax
lea rcx, [0x1404fcdc0]
lea rdx, [0x14042a4c0]
mov r9d, r8d
not r9d
mov r10d, r8d
xor r10d, 0xed8f37f9
and r10d, r9d
xor r8d, 0x1270c806
and r9d, 0xed8f37f9
or r9d, r8d
not r9d
or r9d, r10d
neg r9d
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
xor r10d, r10d
sub r10d, dword [0x1404fcf48]
mov r11d, r9d
xor r11d, r10d
and r10d, r9d
lea r10d, [r11 + r10*2]
neg r10d
cmp r8d, r10d
jge 0x140126871
inc rax
jmp 0x140126840
mov al, 0x9c
xchg byte [0x1404fcdcd], al
lea rax, [0x1404fcdc0]
ret
Function at 0x1401393e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
test ecx, ecx
je 0x14013947b
movzx eax, byte [0x1404fec85]
cmp al, 0xfc
je 0x140139570
mov ecx, 0x86550ae4
xor r8d, r8d
mov r9b, 0xf
mov r10d, 0x86550ae3
lea rax, [fcn.1401393e0]
lea r11d, [rax + rax]
add r11d, 0x1d80
nop dword [rax + rax]
mov edx, dword [0x14055bde8]
lea eax, [rdx - 1]
imul eax, edx
mov esi, dword [0x1404fef18]
add esi, ecx
xor edx, edx
div esi
test edx, edx
jne 0x140139460
mov al, 0x21
lock cmpxchg byte [0x1404fec85], r9b
sete dl
test r8b, r8b
jne 0x140139460
test dl, dl
jne 0x14013953f
cmp al, 0xfc
jne 0x140139420
jmp 0x140139570
mov al, 0x21
lock cmpxchg byte [0x1404fec85], r9b
mov eax, dword [0x1404fef18]
add eax, r10d
test r11d, eax
jne 0x140139420
jmp 0x14013943c
movzx eax, byte [0x1404feda9]
cmp al, 0x2c
je 0x1401395e0
mov ecx, 0x86550ae2
mov r8b, 0xc3
nop word cs:[rax + rax]
mov eax, dword [0x14055bdec]
cmp eax, 0x1f
jg 0x140139500
nop dword [rax + rax]
movzx edx, byte [0x1404fef08]
lea eax, [rdx + 0x7b]
add dl, 0xf9
lock cmpxchg byte [0x1404feda9], dl
sete dl
mov r9d, dword [0x14055bde8]
lea r10d, [r9 - 1]
imul r10d, r9d
and r10d, 1
mov r9d, dword [0x1404fef18]
add r9d, ecx
cmp r10d, r9d
jne 0x140139500
test dl, dl
jne 0x140139579
cmp al, 0x2c
jne 0x1401394a0
jmp 0x1401395e0
mov al, 0x45
lock cmpxchg byte [0x1404feda9], r8b
mov edx, dword [0x14055bde8]
lea eax, [rdx - 1]
imul eax, edx
mov edx, dword [0x1404fef18]
mov r9d, edx
xor r9d, 0x86550ae4
and edx, 0x6550ae4
lea r9d, [r9 + rdx*2]
xor edx, edx
div r9d
test edx, edx
jne 0x140139500
jmp 0x1401394b0
xor eax, eax
lea rcx, [0x1404fec70]
lea rdx, [0x14042ab20]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140139568
inc rax
jmp 0x140139550
mov al, 0xfc
xchg byte [0x1404fec85], al
lea rax, [0x1404fec70]
pop rsi
ret
mov eax, dword [0x14055bdec]
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x140139590
xor eax, eax
lea rcx, [0x1404fed90]
lea rdx, [0x14042ac30]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x18
jg 0x1401395d8
inc rax
jmp 0x1401395b0
xor eax, eax
test al, al
je 0x14013961c
jmp 0x140139644
mov al, 1
nop word cs:[rax + rax]
mov ecx, dword [0x14055bde8]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
jne 0x14013960d
cmp dword [0x1404fef18], 0x79aaf51e
je 0x140139613
test al, al
je 0x1401395f0
jmp 0x140139601
lea rax, [0x1404fed90]
pop rsi
ret
mov ecx, dword [0x14055bde8]
lea eax, [rcx - 1]
imul eax, ecx
mov ecx, dword [0x1404fef18]
lea r8d, [rcx - 0x79aaf51c]
xor edx, edx
div r8d
add ecx, 0x86550ae2
cmp edx, ecx
je 0x140139671
mov ecx, 0x86550ae4
nop dword [rax]
mov edx, dword [0x14055bde8]
lea eax, [rdx - 1]
imul eax, edx
mov r8d, dword [0x1404fef18]
add r8d, ecx
xor edx, edx
div r8d
test edx, edx
jne 0x140139650
jmp 0x14013961c
mov al, 0x2c
xchg byte [0x1404feda9], al
jmp 0x1401395e0
Function at 0x1401396e0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14013971c
mov eax, 0x86550ae2
add eax, dword [0x1404fef18]
cmp edx, eax
jne 0x14013974c
movzx eax, byte [0x1404fed1f]
cmp al, 0x8e
je 0x140139714
mov cl, 0xd0
mov al, 0xcb
lock cmpxchg byte [0x1404fed1f], cl
je 0x1401397ac
cmp al, 0x8e
jne 0x140139700
lea rax, [0x1404fed10]
ret
test edx, edx
je 0x14013977c
movzx eax, byte [0x1404fec43]
cmp al, 0x8f
je 0x140139744
mov cl, 0x4c
nop dword [rax]
mov al, 0x50
lock cmpxchg byte [0x1404fec43], cl
je 0x140139848
cmp al, 0x8f
jne 0x140139730
lea rax, [0x1404fec40]
ret
movzx eax, byte [0x1404fec60]
cmp al, 0xe3
je 0x140139774
mov cl, 0x42
nop dword [rax]
mov al, 0x90
lock cmpxchg byte [0x1404fec60], cl
je 0x1401397f1
cmp al, 0xe3
jne 0x140139760
lea rax, [0x1404fec50]
ret
movzx eax, byte [0x1404fedec]
cmp al, 0xef
je 0x1401397a4
mov cl, 0x76
nop dword [rax]
mov al, 0x60
lock cmpxchg byte [0x1404fedec], cl
je 0x1401398a1
cmp al, 0xef
jne 0x140139790
lea rax, [0x1404fede0]
ret
xor eax, eax
lea rcx, [0x1404fed10]
lea rdx, [0x14042abb0]
mov r8d, 0x86550af1
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1404fef18]
add r10d, r8d
cmp r9d, r10d
jge 0x140139828
inc rax
jmp 0x1401397d0
xor eax, eax
lea rcx, [0x1404fec50]
lea rdx, [0x14042ab10]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140139838
inc rax
jmp 0x140139810
mov al, 0x8e
xchg byte [0x1404fed1f], al
lea rax, [0x1404fed10]
ret
mov al, 0xe3
xchg byte [0x1404fec60], al
lea rax, [0x1404fec50]
ret
xor edx, edx
lea rax, [0x1404fec40]
lea rcx, [0x14042ab00]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x1404fef18]
add edx, r8d
add edx, 0x86550ae3
cmp edx, 3
jl 0x140139860
mov al, 0x8f
xchg byte [0x1404fec43], al
lea rax, [0x1404fec40]
ret
xor eax, eax
lea rcx, [0x1404fede0]
lea rdx, [0x14042ac80]
mov r8d, 0x86550aee
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x1404fef18]
add r10d, r8d
cmp r9d, r10d
jge 0x1401398f1
inc rax
jmp 0x1401398c0
movzx eax, byte [0x1404fef08]
mov ecx, eax
xor cl, 0x25
and al, 0x25
add al, al
add al, cl
xchg byte [0x1404fedec], al
lea rax, [0x1404fede0]
ret
Function at 0x140139ba0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140139be2
movzx eax, byte [0x1404fed79]
cmp al, 0x60
je 0x140139bda
mov cl, 0xc9
nop word cs:[rax + rax]
mov al, 0xf1
lock cmpxchg byte [0x1404fed79], cl
je 0x140139c26
movzx edx, byte [0x1404fef08]
add dl, 0x96
cmp al, dl
jne 0x140139bc0
lea rax, [0x1404fed70]
ret
test edx, edx
je 0x140139c71
movzx eax, byte [0x1404fed53]
cmp al, 0xd5
je 0x140139c1e
mov cl, 0x5b
nop word [rax + rax]
mov al, 0xfe
lock cmpxchg byte [0x1404fed53], cl
je 0x140139ca8
movzx edx, byte [0x1404fef08]
add dl, 0xb
cmp al, dl
jne 0x140139c00
lea rax, [0x1404fed30]
ret
xor edx, edx
lea rax, [0x1404fed70]
lea rcx, [0x14042ac10]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1404fef18]
add edx, r8d
add edx, 0x86550ae3
cmp edx, 9
jl 0x140139c40
mov al, 0x60
xchg byte [0x1404fed79], al
lea rax, [0x1404fed70]
ret
movzx eax, byte [0x1404fec33]
movzx ecx, byte [0x1404fef08]
add cl, 0x7c
cmp al, cl
je 0x140139ca0
mov cl, 0xde
nop dword [rax + rax]
mov al, 0xe
lock cmpxchg byte [0x1404fec33], cl
je 0x140139ce8
cmp al, 0x46
jne 0x140139c90
lea rax, [0x1404fec30]
ret
xor eax, eax
lea rcx, [0x1404fed30]
lea rdx, [0x14042abd0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x140139cd8
inc rax
jmp 0x140139cc0
mov al, 0xd5
xchg byte [0x1404fed53], al
lea rax, [0x1404fed30]
ret
xor edx, edx
lea rax, [0x1404fec30]
lea rcx, [0x14042aaf0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
not edx
and edx, 0x7ffffffe
or edx, r8d
not edx
lea edx, [r8 + rdx*2]
cmp edx, 3
jl 0x140139d00
mov al, 0x46
xchg byte [0x1404fec33], al
lea rax, [0x1404fec30]
ret
Function at 0x140145110
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x14055be94]
cmp eax, 0x48
nop
xor ebp, ebp
test bpl, bpl
jne 0x140145130
mov r14, qword [rdi]
mov rcx, qword [r14 + 8]
cmp byte [rcx + 0x19], 0
je 0x1401451a6
mov r15, rcx
mov rax, r14
cmp byte [rax + 0x19], 0
jne 0x140145205
jmp 0x1401451fe
mov edx, dword [0x14055be90]
lea eax, [rdx - 1]
imul eax, edx
mov r8d, dword [0x140500800]
mov edx, r8d
xor edx, 0x6c45f96a
mov r9d, r8d
and r9d, 0x6c45f96a
lea r9d, [rdx + r9*2]
xor edx, edx
div r9d
mov eax, r8d
xor eax, 0x6c45f968
and r8d, 0x6c45f968
lea eax, [rax + r8*2]
cmp edx, eax
jne 0x140145160
mov eax, dword [0x140500800]
mov edx, eax
xor edx, 0x6c45f968
and eax, 0x6c45f968
add eax, eax
add eax, edx
jne 0x140145160
mov edx, dword [rbx]
mov rax, r14
nop word cs:[rax + rax]
mov r15, rcx
mov r8d, dword [rcx + 0x1c]
add rcx, 0x10
cmp r8d, edx
cmovge rax, r15
cmovge rcx, r15
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401451d0
xor ebp, ebp
cmp r8d, edx
setge bpl
cmp byte [rax + 0x19], 0
jne 0x140145205
mov ecx, dword [rbx]
cmp ecx, dword [rax + 0x1c]
jge 0x140145273
movabs rax, 0x666666666666666
cmp qword [rdi + 8], rax
je 0x140145277
mov ecx, 0x28
mov edx, 0xa4c97cfe
mov r8d, 0x3012c785
call fcn.1400a9550
mov rcx, qword [rbx]
mov qword [rax + 0x1c], rcx
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
mov word [rax + 0x18], 0
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x30], ebp
lea rdx, [rsp + 0x28]
mov rcx, rdi
mov r8, rax
call fcn.140145280
mov cl, 1
mov qword [rsi], rax
mov byte [rsi + 8], cl
mov rax, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
xor ecx, ecx
jmp 0x14014525d
call fcn.1400a6f20
int3