joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2014eeb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r14, rcx
lea rax, [0x20470788]
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x20], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov byte [rbp - 8], 0
lea rcx, [rbp - 0x28]
call fcn.200e4e70
mov ebx, eax
test al, al
je 0x2014ef64
movabs rax, 0x555555555555555
cmp qword [r14 + 0x48], rax
je 0x2014efa5
nop
mov r13, qword [rsi]
mov r15, qword [rdi + 0x30]
mov r12, qword [r14 + 0x40]
mov ecx, 0x30
call fcn.200782b0
lea rcx, [0x20472fd8]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], r15
mov qword [rax + 0x20], r13
mov qword [rax + 0x28], rsi
inc qword [r14 + 0x48]
mov rcx, qword [r12 + 8]
mov qword [rax], r12
mov qword [rax + 8], rcx
mov qword [r12 + 8], rax
mov qword [rcx], rax
mov rax, qword [rdi + 0x30]
mov qword [rsi], rax
jmp 0x2014ef6e
mov ecx, 6
call fcn.2012d810
lea rax, [0x20470788]
mov qword [rbp - 0x28], rax
cmp byte [0x205ebd78], 0
jne 0x2014ef92
nop
cmp byte [rbp - 8], 0
je 0x2014ef92
lea rcx, [rbp - 0x28]
call fcn.200d0e60
mov eax, ebx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
nop
movzx eax, byte [0x20584ade]
cmp al, 0x41
je 0x2014f02e
mov cl, 0x58
mov al, 0xe2
lock cmpxchg byte [0x20584ade], cl
je 0x2014efc5
cmp al, 0x41
jne 0x2014efb3
jmp 0x2014f02e
mov ecx, 0x5cf4373e
xor r8d, r8d
movabs r9, 0x4924924924924925
lea r10, [0x204730b0]
lea r11, [0x20584ad0]
mov rax, rcx
shr rax, 1
mul r9
shr rdx, 1
imul rax, rdx, 0xfffffffffffffff2
add rax, r10
movzx edx, byte [r8 + rax + 0x5cf4373e]
movzx eax, byte [r8 + rax + 0x5cf4373f]
xor dl, 0x22
add byte [r8 + r11], dl
xor al, 0x22
add byte [r8 + r11 + 1], al
add r8, 2
add rcx, 2
cmp r8, 0xe
jne 0x2014efe5
mov al, 0x41
xchg byte [0x20584ade], al
lea rcx, [0x20584ad0]
call fcn.2007a760
int3

Function at 0x201795a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
movzx eax, byte [0x20586d00]
cmp al, 0x59
je 0x201795d0
mov cl, 0x69
nop word cs:[rax + rax]
mov al, 0x70
lock cmpxchg byte [0x20586d00], cl
je 0x201795dc
cmp al, 0x59
jne 0x201795c0
lea rcx, [0x20586cf0]
call fcn.2007a760
mov eax, 0xf03200c5
mov ecx, 0xfcdff4e
mov edx, 0xf03200c6
mov r8d, 0xfcdff4c
xor r9d, r9d
mov r10d, 0xcccccccd
lea r11, [0x20586cf0]
lea rsi, [0x20473860]
nop dword [rax + rax]
mov edi, ecx
imul rdi, r10
shr rdi, 0x24
lea edi, [rdi + rdi*4]
lea edi, [rax + rdi*4]
mov ebx, r8d
imul rbx, r10
shr rbx, 0x24
lea ebx, [rbx + rbx*4]
lea ebx, [rdx + rbx*4]
movzx ebx, byte [rbx + rsi]
xor bl, 0x5f
add byte [r9 + r11], bl
movzx ebx, byte [rdi + rsi]
xor bl, 0x5f
add byte [r9 + r11 + 1], bl
add r9, 2
add eax, 0xfffffffe
add ecx, 2
add edx, 0xfffffffe
add r8d, 2
cmp r9, 0x10
jne 0x20179610
mov al, 0x59
xchg byte [0x20586d00], al
lea rcx, [0x20586cf0]
call fcn.2007a760
int3
Function at 0x201b8520
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
cmp qword [0x205ec560], 0
jne 0x201b8746
movzx eax, byte [0x2058d10d]
cmp al, 0x92
je 0x201b8631
mov r8b, 0x38
nop
mov al, 0x42
lock cmpxchg byte [0x2058d10d], r8b
je 0x201b8566
cmp al, 0x92
jne 0x201b8550
jmp 0x201b8631
mov eax, 1
mov r8d, 0x6928fad1
mov r9d, 0x96d70541
mov r10d, 0x6928fad2
mov r11d, 0x96d70540
mov esi, 0xaf286bcb
lea rdi, [0x2058d100]
lea rbx, [0x20476100]
nop word cs:[rax + rax]
mov r14d, r11d
imul r14, rsi
shr r14, 0x20
mov r15d, r11d
sub r15d, r14d
shr r15d, 1
add r15d, r14d
shr r15d, 4
lea r14d, [r15 + r15*8]
lea r14d, [r15 + r14*2]
add r14d, r10d
movzx ebp, byte [r14 + rbx]
xor bpl, 0x73
add byte [rax + rdi - 1], bpl
cmp rax, 0xd
je 0x201b8629
mov r14d, r9d
imul r14, rsi
shr r14, 0x20
mov r15d, r9d
sub r15d, r14d
shr r15d, 1
add r15d, r14d
shr r15d, 4
lea r14d, [r15 + r15*8]
lea ebp, [r15 + r14*2]
add ebp, r8d
mov r14d, ebp
movzx ebp, byte [r14 + rbx]
xor bpl, 0x73
add byte [rax + rdi], bpl
add rax, 2
add r8d, 0xfffffffe
add r9d, 2
add r10d, 0xfffffffe
add r11d, 2
jmp 0x201b85a0
mov al, 0x92
xchg byte [0x2058d10d], al
mov rsi, rcx
mov rdi, rdx
movzx eax, byte [0x2058d11e]
cmp al, 0x86
je 0x201b871c
mov cl, 0x3a
nop dword [rax + rax]
mov al, 0x6c
lock cmpxchg byte [0x2058d11e], cl
je 0x201b8665
cmp al, 0x86
jne 0x201b8650
jmp 0x201b871c
mov eax, 0xea3f365f
mov ecx, 0x15c0c9ae
mov edx, 1
mov r8d, 0xea3f3660
mov r9d, 0x15c0c9ac
mov r10d, 0x92492493
lea r11, [0x2058d110]
lea rbx, [0x20476120]
nop word cs:[rax + rax]
mov r14d, ecx
shr r14d, 1
imul r14, r10
shr r14, 0x22
lea ebp, [r14 + r14]
shl r14d, 4
sub r14d, ebp
add r14d, eax
mov r15d, r9d
shr r15d, 1
imul r15, r10
shr r15, 0x22
lea ebp, [r15 + r15]
shl r15d, 4
sub r15d, ebp
add r15d, r8d
movzx ebp, byte [rdx + r11 - 1]
movzx r12d, byte [rdx + r11]
xor bpl, byte [r15 + rbx]
xor bpl, 0xf6
mov byte [rdx + r11 - 1], bpl
xor r12b, byte [r14 + rbx]
xor r12b, 0xf6
mov byte [rdx + r11], r12b
add eax, 0xfffffffe
add ecx, 2
add rdx, 2
add r8d, 0xfffffffe
add r9d, 2
cmp rdx, 0xf
jne 0x201b86a0
mov al, 0x86
xchg byte [0x2058d11e], al
lea rax, [0x2058d100]
mov qword [rsp + 0x28], rax
lea r9, [0x2058d110]
mov edx, 0x7ffca01e
call fcn.201c2790
mov qword [0x205ec560], rax
mov rdx, rdi
mov rcx, rsi
mov rax, qword [0x205ec560]
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp rax
Function at 0x201ba8e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
cmp qword [0x205ec5b8], 0
jne 0x201baac2
movzx eax, byte [0x2058d2cd]
cmp al, 0xde
je 0x201ba9b5
mov r10b, 0xea
nop
mov al, 0xcf
lock cmpxchg byte [0x2058d2cd], r10b
je 0x201ba926
cmp al, 0xde
jne 0x201ba910
jmp 0x201ba9b5
mov edi, edx
mov r10d, 0x3becc8aa
mov r11d, 0x3becc8a9
xor ebx, ebx
movabs r14, 0x4ec4ec4ec4ec4ec5
lea r15, [0x204762a0]
lea r12, [0x2058d2c0]
nop
mov rax, r10
mul r14
mov rsi, rdx
mov rax, r11
mul r14
shr rdx, 2
imul rax, rdx, 0xfffffffffffffff3
add rax, r15
add rax, 0x3becc8a3
movzx eax, byte [rbx + rax + 6]
xor al, 0xe5
add byte [rbx + r12], al
cmp rbx, 0xc
je 0x201ba9ab
shr rsi, 2
imul rax, rsi, 0xfffffffffffffff3
add rax, r15
add rax, 0x3becc8aa
movzx eax, byte [rax + rbx]
xor al, 0xe5
add byte [rbx + r12 + 1], al
add rbx, 2
add r10, 2
add r11, 2
jmp 0x201ba950
mov al, 0xde
xchg byte [0x2058d2cd], al
mov edx, edi
mov rsi, rcx
mov edi, edx
mov rbx, r8
mov ebp, r9d
movzx eax, byte [0x2058d2ea]
cmp al, 0x83
je 0x201baa93
mov cl, 0xff
nop word cs:[rax + rax]
mov al, 0xc8
lock cmpxchg byte [0x2058d2ea], cl
je 0x201ba9f5
cmp al, 0x83
jne 0x201ba9e0
jmp 0x201baa93
mov eax, 0x90af6573
mov ecx, 0x6f509aa6
mov edx, 1
mov r8d, 0x90af6574
mov r9d, 0x6f509aa4
lea r10, [0x2058d2d0]
lea r11, [0x204762b0]
nop
mov r14d, ecx
imul r14, r14, 0x4ec4ec4f
shr r14, 0x23
lea r15d, [r14 + r14*4]
lea r15d, [r15 + r15*4]
add r14d, eax
add r14d, r15d
mov r15d, r9d
imul r15, r15, 0x4ec4ec4f
shr r15, 0x23
lea r12d, [r15 + r15*4]
lea r12d, [r12 + r12*4]
add r15d, r8d
add r15d, r12d
movzx r15d, byte [r15 + r11]
xor r15b, 0xf8
add byte [rdx + r10 - 1], r15b
movzx r14d, byte [r14 + r11]
xor r14b, 0xf8
add byte [rdx + r10], r14b
add eax, 0xfffffffe
add ecx, 2
add rdx, 2
add r8d, 0xfffffffe
add r9d, 2
cmp rdx, 0x1b
jne 0x201baa20
mov al, 0x83
xchg byte [0x2058d2ea], al
lea rax, [0x2058d2c0]
mov qword [rsp + 0x28], rax
lea r9, [0x2058d2d0]
mov edx, 0x7ffca01e
call fcn.201c2790
mov qword [0x205ec5b8], rax
mov r9d, ebp
mov r8, rbx
mov edx, edi
mov rcx, rsi
mov rax, qword [0x205ec5b8]
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp rax
Function at 0x201dd520
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x201dd55c
test edx, edx
je 0x201dd58c
movzx eax, byte [0x2058fe5d]
cmp al, 9
je 0x201dd554
mov cl, 0x32
nop word cs:[rax + rax]
mov al, 0x9b
lock cmpxchg byte [0x2058fe5d], cl
je 0x201dd5ec
cmp al, 9
jne 0x201dd540
lea rax, [0x2058fe50]
ret
test edx, edx
je 0x201dd5bc
movzx eax, byte [0x2058f9b5]
cmp al, 0x22
je 0x201dd584
mov cl, 0x78
nop dword [rax]
mov al, 0xc0
lock cmpxchg byte [0x2058f9b5], cl
je 0x201dd621
cmp al, 0x22
jne 0x201dd570
lea rax, [0x2058f9a0]
ret
movzx eax, byte [0x2058fcbc]
cmp al, 0xd1
je 0x201dd5b4
mov cl, 0x6a
nop dword [rax]
mov al, 0xc1
lock cmpxchg byte [0x2058fcbc], cl
je 0x201dd661
cmp al, 0xd1
jne 0x201dd5a0
lea rax, [0x2058fcb0]
ret
movzx eax, byte [0x2058f9f5]
cmp al, 0xb7
je 0x201dd5e4
mov cl, 0x54
nop dword [rax]
mov al, 0x23
lock cmpxchg byte [0x2058f9f5], cl
je 0x201dd6a1
cmp al, 0xb7
jne 0x201dd5d0
lea rax, [0x2058f9e0]
ret
xor eax, eax
lea rcx, [0x2058fe50]
lea rdx, [0x20477e10]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xd
jl 0x201dd600
mov al, 9
xchg byte [0x2058fe5d], al
lea rax, [0x2058fe50]
ret
xor eax, eax
lea rcx, [0x2058f9a0]
lea rdx, [0x20477980]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x15
jl 0x201dd640
mov al, 0x22
xchg byte [0x2058f9b5], al
lea rax, [0x2058f9a0]
ret
xor eax, eax
lea rcx, [0x2058fcb0]
lea rdx, [0x20477c70]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0xc
jl 0x201dd680
mov al, 0xd1
xchg byte [0x2058fcbc], al
lea rax, [0x2058fcb0]
ret
xor eax, eax
lea rcx, [0x2058f9e0]
lea rdx, [0x204779b0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x15
jl 0x201dd6c0
mov al, 0xb7
xchg byte [0x2058f9f5], al
lea rax, [0x2058f9e0]
ret
Function at 0x201dd780
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x201dd7bc
test edx, edx
je 0x201dd7ec
movzx eax, byte [0x2058fe2d]
cmp al, 0x6e
je 0x201dd7b4
mov cl, 0xea
nop word cs:[rax + rax]
mov al, 0x6c
lock cmpxchg byte [0x2058fe2d], cl
je 0x201dd84c
cmp al, 0x6e
jne 0x201dd7a0
lea rax, [0x2058fe20]
ret
test edx, edx
je 0x201dd81c
movzx eax, byte [0x2058f92d]
cmp al, 0x52
je 0x201dd7e4
mov cl, 0xb7
nop dword [rax]
mov al, 0x17
lock cmpxchg byte [0x2058f92d], cl
je 0x201dd881
cmp al, 0x52
jne 0x201dd7d0
lea rax, [0x2058f910]
ret
movzx eax, byte [0x2058ffba]
cmp al, 0xc5
je 0x201dd814
mov cl, 0x18
nop dword [rax]
mov al, 8
lock cmpxchg byte [0x2058ffba], cl
je 0x201dd8c1
cmp al, 0xc5
jne 0x201dd800
lea rax, [0x2058ffb0]
ret
movzx eax, byte [0x2058fe73]
cmp al, 0x93
je 0x201dd844
mov cl, 0x98
nop dword [rax]
mov al, 0xa3
lock cmpxchg byte [0x2058fe73], cl
je 0x201dd901
cmp al, 0x93
jne 0x201dd830
lea rax, [0x2058fe60]
ret
xor eax, eax
lea rcx, [0x2058fe20]
lea rdx, [0x20477de0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0xd
jl 0x201dd860
mov al, 0x6e
xchg byte [0x2058fe2d], al
lea rax, [0x2058fe20]
ret
xor eax, eax
lea rcx, [0x2058f910]
lea rdx, [0x20477900]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x1d
jl 0x201dd8a0
mov al, 0x52
xchg byte [0x2058f92d], al
lea rax, [0x2058f910]
ret
xor eax, eax
lea rcx, [0x2058ffb0]
lea rdx, [0x20477f70]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0xa
jl 0x201dd8e0
mov al, 0xc5
xchg byte [0x2058ffba], al
lea rax, [0x2058ffb0]
ret
xor eax, eax
lea rcx, [0x2058fe60]
lea rdx, [0x20477e20]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x13
jl 0x201dd920
mov al, 0x93
xchg byte [0x2058fe73], al
lea rax, [0x2058fe60]
ret
Function at 0x201ebc40
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x201ebc7c
test edx, edx
je 0x201ebcac
movzx eax, byte [0x20591883]
cmp al, 0x90
je 0x201ebc74
mov cl, 0xd8
nop word cs:[rax + rax]
mov al, 0xe0
lock cmpxchg byte [0x20591883], cl
je 0x201ebd0c
cmp al, 0x90
jne 0x201ebc60
lea rax, [0x20591880]
ret
test edx, edx
je 0x201ebcdc
movzx eax, byte [0x2059186c]
cmp al, 7
je 0x201ebca4
mov cl, 0xe7
nop dword [rax]
mov al, 0xb4
lock cmpxchg byte [0x2059186c], cl
je 0x201ebd41
cmp al, 7
jne 0x201ebc90
lea rax, [0x20591850]
ret
movzx eax, byte [0x205917b8]
cmp al, 0xb7
je 0x201ebcd4
mov cl, 0x90
nop dword [rax]
mov al, 0x53
lock cmpxchg byte [0x205917b8], cl
je 0x201ebd81
cmp al, 0xb7
jne 0x201ebcc0
lea rax, [0x205917b0]
ret
movzx eax, byte [0x2059182e]
cmp al, 0xda
je 0x201ebd04
mov cl, 0xf3
nop dword [rax]
mov al, 0xe
lock cmpxchg byte [0x2059182e], cl
je 0x201ebdc1
cmp al, 0xda
jne 0x201ebcf0
lea rax, [0x20591820]
ret
xor eax, eax
lea rcx, [0x20591880]
lea rdx, [0x20479440]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 3
jl 0x201ebd20
mov al, 0x90
xchg byte [0x20591883], al
lea rax, [0x20591880]
ret
xor eax, eax
lea rcx, [0x20591850]
lea rdx, [0x20479410]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x1c
jl 0x201ebd60
mov al, 7
xchg byte [0x2059186c], al
lea rax, [0x20591850]
ret
xor eax, eax
lea rcx, [0x205917b0]
lea rdx, [0x20479370]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 8
jl 0x201ebda0
mov al, 0xb7
xchg byte [0x205917b8], al
lea rax, [0x205917b0]
ret
xor eax, eax
lea rcx, [0x20591820]
lea rdx, [0x204793e0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0xe
jl 0x201ebde0
mov al, 0xda
xchg byte [0x2059182e], al
lea rax, [0x20591820]
ret
Function at 0x20210620
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
cmp qword [0x205ece40], 0
jne 0x202107e4
movzx eax, byte [0x205960ed]
cmp al, 0x56
je 0x202106f9
mov dl, 0x84
nop word cs:[rax + rax]
mov al, 0xb7
lock cmpxchg byte [0x205960ed], dl
je 0x20210665
cmp al, 0x56
jne 0x20210650
jmp 0x202106f9
mov eax, 1
mov edx, 0x72b88fc1
mov r8d, 0x8d47704b
mov r9d, 0x72b88fc2
mov r10d, 0x8d47704a
lea r11, [0x205960e0]
lea rsi, [0x2047a840]
nop
mov edi, r10d
imul rdi, rdi, 0x4ec4ec4f
shr rdi, 0x22
lea ebx, [rdi + rdi*2]
lea edi, [rdi + rbx*4]
add edi, r9d
movzx ebx, byte [rdi + rsi]
xor bl, 0xfa
add byte [rax + r11 - 1], bl
cmp rax, 0xd
je 0x202106f1
mov edi, r8d
imul rdi, rdi, 0x4ec4ec4f
shr rdi, 0x22
lea ebx, [rdi + rdi*2]
lea edi, [rdi + rbx*4]
add edi, edx
mov edi, edi
movzx ebx, byte [rdi + rsi]
xor bl, 0xfa
add byte [rax + r11], bl
add rax, 2
add edx, 0xfffffffe
add r8d, 2
add r9d, 0xfffffffe
add r10d, 2
jmp 0x20210690
mov al, 0x56
xchg byte [0x205960ed], al
mov rsi, rcx
movzx eax, byte [0x205960fe]
cmp al, 7
je 0x202107bc
mov cl, 0xa1
nop dword [rax]
mov al, 0x82
lock cmpxchg byte [0x205960fe], cl
je 0x20210725
cmp al, 7
jne 0x20210710
jmp 0x202107bc
lea r10, [0x2047a850]
lea r11, [r10 + 0x692c946f]
add r10, 0x692c946e
mov ecx, 0x692c946f
mov r8d, 0x692c946e
movabs rdi, 0x4ec4ec4ec4ec4ec5
lea rbx, [0x205960f0]
nop word cs:[rax + rax]
mov rax, rcx
mul rdi
mov r9, rdx
mov rax, r8
mul rdi
shr rdx, 2
imul rax, rdx, 0xfffffffffffffff3
movzx eax, byte [r10 + rax]
xor al, 0x24
add byte [rcx + rbx - 0x692c946f], al
shr r9, 2
imul rax, r9, 0xfffffffffffffff3
movzx eax, byte [r11 + rax]
xor al, 0x24
add byte [rcx + rbx - 0x692c946e], al
add r11, 2
add rcx, 2
add r10, 2
add r8, 2
cmp rcx, 0x692c947d
jne 0x20210760
mov al, 7
xchg byte [0x205960fe], al
lea rax, [0x205960f0]
mov qword [rsp + 0x20], rax
lea r8, [0x205960e0]
mov r9d, 0x28532f91
call fcn.2021a510
mov qword [0x205ece40], rax
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [0x205ece40]
Function at 0x20244510
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
movzx eax, byte [0x2059b050]
cmp al, 0xcd
je 0x20244540
mov cl, 0x3c
nop word cs:[rax + rax]
mov al, 0x1c
lock cmpxchg byte [0x2059b050], cl
je 0x2024454c
cmp al, 0xcd
jne 0x20244530
lea rcx, [0x2059b040]
call fcn.2007a760
mov eax, 0x226bd5a7
mov ecx, 0xdd942a6c
mov edx, 0x226bd5a8
mov r8d, 0xdd942a6a
xor r9d, r9d
mov r10d, 0xcccccccd
lea r11, [0x2059b040]
lea rsi, [0x2047be80]
nop dword [rax + rax]
mov edi, ecx
imul rdi, r10
shr rdi, 0x24
lea edi, [rdi + rdi*4]
lea edi, [rax + rdi*4]
mov ebx, r8d
imul rbx, r10
shr rbx, 0x24
lea ebx, [rbx + rbx*4]
lea ebx, [rdx + rbx*4]
movzx ebx, byte [rbx + rsi]
xor bl, 0xd5
add byte [r9 + r11], bl
movzx ebx, byte [rdi + rsi]
xor bl, 0xd5
add byte [r9 + r11 + 1], bl
add r9, 2
add eax, 0xfffffffe
add ecx, 2
add edx, 0xfffffffe
add r8d, 2
cmp r9, 0x10
jne 0x20244580
mov al, 0xcd
xchg byte [0x2059b050], al
lea rcx, [0x2059b040]
call fcn.2007a760
int3
Function at 0x20255fb0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp qword [0x205ed150], 0
jne 0x2025618d
movzx eax, byte [0x2059e99d]
cmp al, 0x55
je 0x2025608d
mov dl, 0xcf
nop dword [rax + rax]
mov al, 0x2d
lock cmpxchg byte [0x2059e99d], dl
je 0x20255ff5
cmp al, 0x55
jne 0x20255fe0
jmp 0x2025608d
mov r8d, 0xbe1e02ce
lea r9, [r8 + 1]
xor r11d, r11d
movabs rsi, 0x4ec4ec4ec4ec4ec5
lea rax, [0x2047c7a0]
mov edi, 0xbe1e02c4
add rdi, rax
lea rbx, [0x2059e990]
nop word cs:[rax + rax]
mov rax, r9
mul rsi
mov r10, rdx
mov rax, r8
mul rsi
shr rdx, 2
imul rax, rdx, 0xfffffffffffffff3
add rax, rdi
movzx eax, byte [r11 + rax + 0xa]
xor al, 0x6d
add byte [r11 + rbx], al
cmp r11, 0xc
je 0x20256085
shr r10, 2
imul rax, r10, 0xfffffffffffffff3
add rax, rdi
add rax, 0xb
movzx eax, byte [rax + r11]
xor al, 0x6d
add byte [r11 + rbx + 1], al
add r11, 2
add r9, 2
add r8, 2
jmp 0x20256030
mov al, 0x55
xchg byte [0x2059e99d], al
movzx eax, byte [0x2059e9b6]
cmp al, 0xa0
je 0x2025615c
mov dl, 0xac
nop
mov al, 0x75
lock cmpxchg byte [0x2059e9b6], dl
je 0x202560b5
cmp al, 0xa0
jne 0x202560a0
jmp 0x2025615c
mov eax, 0xcecc280e
mov edx, 0x3133d800
mov r8d, 1
mov r9d, 0xcecc280f
mov r10d, 0x3133d7ff
mov r11d, 0x88888889
lea rsi, [0x2059e9a0]
lea rdi, [0x2047c7b0]
nop word cs:[rax + rax]
mov ebx, edx
imul rbx, r11
shr rbx, 0x23
lea ebx, [rbx + rbx*4]
lea ebx, [rbx + rbx*2]
add ebx, eax
mov r14d, r10d
imul r14, r11
shr r14, 0x23
lea r14d, [r14 + r14*4]
lea r14d, [r14 + r14*2]
add r14d, r9d
movzx ebp, byte [r8 + rsi - 1]
movzx r15d, byte [r8 + rsi]
xor bpl, byte [r14 + rdi]
xor bpl, 0xe1
mov byte [r8 + rsi - 1], bpl
xor r15b, byte [rbx + rdi]
xor r15b, 0xe1
mov byte [r8 + rsi], r15b
add eax, 0xfffffffe
add edx, 2
add r8, 2
add r9d, 0xfffffffe
add r10d, 2
cmp r8, 0x17
jne 0x202560f0
mov al, 0xa0
xchg byte [0x2059e9b6], al
mov rsi, rcx
lea rcx, [0x2059e990]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x20256181
lea rdx, [0x2059e9a0]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
jmp 0x20256183
xor eax, eax
mov rcx, rsi
mov qword [0x205ed150], rax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [0x205ed150]
Function at 0x202561a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp qword [0x205ed158], 0
jne 0x20256385
movzx eax, byte [0x2059e9cd]
cmp al, 0x84
je 0x20256279
mov dl, 0x31
nop dword [rax + rax]
mov al, 0x8b
lock cmpxchg byte [0x2059e9cd], dl
je 0x202561e5
cmp al, 0x84
jne 0x202561d0
jmp 0x20256279
mov eax, 1
mov edx, 0xf829be4f
mov r8d, 0x7d641bd
mov r9d, 0xf829be50
mov r10d, 0x7d641bc
lea r11, [0x2059e9c0]
lea rsi, [0x2047c7c0]
nop
mov edi, r10d
imul rdi, rdi, 0x4ec4ec4f
shr rdi, 0x22
lea ebx, [rdi + rdi*2]
lea edi, [rdi + rbx*4]
add edi, r9d
movzx ebx, byte [rdi + rsi]
xor bl, 0xc6
add byte [rax + r11 - 1], bl
cmp rax, 0xd
je 0x20256271
mov edi, r8d
imul rdi, rdi, 0x4ec4ec4f
shr rdi, 0x22
lea ebx, [rdi + rdi*2]
lea edi, [rdi + rbx*4]
add edi, edx
mov edi, edi
movzx ebx, byte [rdi + rsi]
xor bl, 0xc6
add byte [rax + r11], bl
add rax, 2
add edx, 0xfffffffe
add r8d, 2
add r9d, 0xfffffffe
add r10d, 2
jmp 0x20256210
mov al, 0x84
xchg byte [0x2059e9cd], al
movzx eax, byte [0x2059e9ea]
cmp al, 9
je 0x20256354
mov dl, 0xfb
nop word [rax + rax]
mov al, 0xbd
lock cmpxchg byte [0x2059e9ea], dl
je 0x202562a5
cmp al, 9
jne 0x20256290
jmp 0x20256354
mov eax, 0x2db5de17
mov edx, 0xd24a21ff
mov r8d, 1
mov r9d, 0x2db5de18
mov r10d, 0xd24a21fe
mov r11d, 0xb21642c9
lea rsi, [0x2059e9d0]
lea rdi, [0x2047c7d0]
nop word cs:[rax + rax]
mov r14d, edx
imul r14, r11
shr r14, 0x24
lea ebx, [r14 + r14*2]
shl ebx, 3
sub ebx, r14d
add ebx, eax
mov r14d, r10d
imul r14, r11
shr r14, 0x24
lea r15d, [r14 + r14*2]
shl r15d, 3
sub r15d, r14d
add r15d, r9d
movzx ebp, byte [r8 + rsi - 1]
movzx r14d, byte [r8 + rsi]
xor bpl, byte [r15 + rdi]
xor bpl, 0x4f
mov byte [r8 + rsi - 1], bpl
xor r14b, byte [rbx + rdi]
xor r14b, 0x4f
mov byte [r8 + rsi], r14b
add eax, 0xfffffffe
add edx, 2
add r8, 2
add r9d, 0xfffffffe
add r10d, 2
cmp r8, 0x1b
jne 0x202562e0
mov al, 9
xchg byte [0x2059e9ea], al
mov rsi, rcx
lea rcx, [0x2059e9c0]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x20256379
lea rdx, [0x2059e9d0]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
jmp 0x2025637b
xor eax, eax
mov rcx, rsi
mov qword [0x205ed158], rax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [0x205ed158]
Function at 0x20258340
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov qword [rsp + 0x20], r9
cmp qword [0x205ed198], 0
jne 0x20258525
movzx eax, byte [0x2059ec0d]
cmp al, 5
je 0x20258411
mov r10b, 0xdf
nop word cs:[rax + rax]
mov al, 0x32
lock cmpxchg byte [0x2059ec0d], r10b
je 0x20258393
cmp al, 5
jne 0x20258380
jmp 0x20258411
mov r11d, edx
mov r10d, 0x284e4de8
xor esi, esi
movabs rdi, 0xcccccccccccccccd
lea rbx, [0x2047ca40]
lea r14, [0x2059ec00]
nop word cs:[rax + rax]
mov rax, r10
mul rdi
shr rdx, 2
and rdx, 0xfffffffffffffffe
lea rdx, [rdx + rdx*4]
mov rax, rbx
sub rax, rdx
movzx edx, byte [rax + rsi + 0x284e4de8]
xor dl, 0xd9
add byte [rsi + r14], dl
cmp rsi, 0xc
je 0x20258406
movzx eax, byte [rax + rsi + 0x284e4de9]
xor al, 0xd9
add byte [rsi + r14 + 1], al
add rsi, 2
add r10, 2
jmp 0x202583c0
mov al, 5
xchg byte [0x2059ec0d], al
mov edx, r11d
movzx eax, byte [0x2059ec1c]
cmp al, 0xe0
je 0x202584ea
mov r10b, 0xd5
nop word cs:[rax + rax]
mov al, 0x9b
lock cmpxchg byte [0x2059ec1c], r10b
je 0x20258446
cmp al, 0xe0
jne 0x20258430
jmp 0x202584ea
mov eax, 0x3f8ab5d7
mov r10d, 0xc0754a34
mov r11d, 1
mov esi, 0x3f8ab5d8
mov edi, 0xc0754a32
mov r9d, 0xaaaaaaab
lea r14, [0x2059ec10]
lea r15, [0x2047ca50]
nop word cs:[rax + rax]
mov r12d, r10d
imul r12, r9
shr r12, 0x23
lea r12d, [r12 + r12*2]
lea r12d, [rax + r12*4]
mov r13d, edi
imul r13, r9
shr r13, 0x23
lea r13d, [r13 + r13*2]
lea r13d, [rsi + r13*4]
movzx ebp, byte [r11 + r14 - 1]
movzx ebx, byte [r11 + r14]
xor bpl, byte [r13 + r15]
xor bpl, 0x6c
mov byte [r11 + r14 - 1], bpl
xor bl, byte [r12 + r15]
xor bl, 0x6c
mov byte [r11 + r14], bl
add eax, 0xfffffffe
add r10d, 2
add r11, 2
add esi, 0xfffffffe
add edi, 2
cmp r11, 0xd
jne 0x20258480
mov al, 0xe0
xchg byte [0x2059ec1c], al
mov rsi, rcx
mov edi, edx
mov ebx, r8d
lea rcx, [0x2059ec00]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x20258514
lea rdx, [0x2059ec10]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
jmp 0x20258516
xor eax, eax
mov r8d, ebx
mov edx, edi
mov rcx, rsi
mov qword [0x205ed198], rax
mov rax, qword [0x205ed198]
mov r9, qword [rsp + 0x20]
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp rax