joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14026a460
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14026a4b6
mov eax, dword [0x14055dd28]
mov ecx, eax
xor ecx, 0x22932e3a
and eax, 0x22932e3a
lea eax, [rcx + rax*2]
cmp edx, eax
jne 0x14026a4f6
movzx eax, byte [0x14055da64]
cmp al, 0x60
je 0x14026a4ae
mov cl, 0x20
nop dword [rax + rax]
mov al, 0x5b
lock cmpxchg byte [0x14055da64], cl
je 0x14026a5b6
movzx edx, byte [0x14055dd2c]
add dl, 0xae
cmp al, dl
jne 0x14026a490
lea rax, [0x14055da60]
ret
test edx, edx
je 0x14026a581
movzx eax, byte [0x14055dbcd]
cmp al, 0xde
je 0x14026a4ee
mov cl, 0x8f
nop dword [rax + rax]
mov al, 0xe
lock cmpxchg byte [0x14055dbcd], cl
je 0x14026a608
movzx edx, byte [0x14055dd2c]
add dl, 0x2c
cmp al, dl
jne 0x14026a4d0
lea rax, [0x14055dbc0]
ret
movzx eax, byte [0x14055dcdd]
nop dword [rax]
cmp al, 0xae
je 0x14026a579
movzx ecx, byte [0x14055dd2c]
lea eax, [rcx - 0x27]
add cl, 0xad
lock cmpxchg byte [0x14055dcdd], cl
jne 0x14026a500
xor edx, edx
lea rax, [0x14055dcd0]
lea rcx, [0x14046fd50]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x14055dd28]
add edx, r8d
add edx, 0x22932e3b
cmp edx, 0xd
jl 0x14026a530
movzx eax, byte [0x14055dd2c]
mov ecx, eax
xor cl, 0xfc
and al, 0x7c
add al, al
add al, cl
xchg byte [0x14055dcdd], al
lea rax, [0x14055dcd0]
ret
movzx eax, byte [0x14055db4f]
cmp al, 0xbd
je 0x14026a5ae
mov cl, 0x1a
nop
mov al, 0x44
lock cmpxchg byte [0x14055db4f], cl
je 0x14026a64f
movzx edx, byte [0x14055dd2c]
add dl, 0xb
cmp al, dl
jne 0x14026a590
lea rax, [0x14055db40]
ret
xor eax, eax
lea rcx, [0x14055da60]
lea rdx, [0x14046fb00]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x14026a5f8
inc rax
jmp 0x14026a5d0
mov al, 0x60
xchg byte [0x14055da64], al
lea rax, [0x14055da60]
ret
xor eax, eax
lea rcx, [0x14055dbc0]
lea rdx, [0x14046fc40]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14026a638
inc rax
jmp 0x14026a620
movzx eax, byte [0x14055dd2c]
add al, 0x2c
xchg byte [0x14055dbcd], al
lea rax, [0x14055dbc0]
ret
xor eax, eax
lea rcx, [0x14055db40]
lea rdx, [0x14046fbc0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x14026a678
inc rax
jmp 0x14026a660
mov al, 0xbd
xchg byte [0x14055db4f], al
lea rax, [0x14055db40]
ret
Function at 0x14026a6f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x14026a729
test edx, edx
je 0x14026a779
movzx eax, byte [0x14055dbdc]
cmp al, 0x20
je 0x14026a850
mov cl, 0x4c
nop
mov al, 0x19
lock cmpxchg byte [0x14055dbdc], cl
je 0x14026a815
cmp al, 0x20
jne 0x14026a710
jmp 0x14026a850
mov eax, r8d
xor eax, 0x3e4b9f70
add eax, dword [0x14055dd28]
cmp edx, eax
jne 0x14026a7d5
movzx eax, byte [0x14055db33]
mov ecx, r8d
xor cl, 0xb7
add cl, byte [0x14055dd2c]
cmp al, cl
je 0x14026a970
mov cl, 0x99
nop dword [rax]
mov al, 0x22
lock cmpxchg byte [0x14055db33], cl
je 0x14026a8cd
cmp al, 0xaf
jne 0x14026a760
jmp 0x14026a970
movzx eax, byte [0x14055dc1f]
movzx ecx, byte [0x14055dd2c]
mov edx, r8d
xor dl, 0x69
mov r9d, edx
xor r9b, cl
and dl, cl
add dl, dl
add dl, r9b
cmp al, dl
je 0x14026a8c4
mov cl, 0x54
nop word cs:[rax + rax]
mov al, 0xf8
lock cmpxchg byte [0x14055dc1f], cl
je 0x14026a859
mov edx, r8d
xor dl, 0x69
add dl, byte [0x14055dd2c]
cmp al, dl
jne 0x14026a7b0
jmp 0x14026a8c4
movzx eax, byte [0x14055dc2d]
cmp al, 0xe2
je 0x14026a95f
mov cl, 0x53
nop word cs:[rax + rax]
mov al, 0x22
lock cmpxchg byte [0x14055dc2d], cl
je 0x14026a911
mov edx, r8d
xor dl, 0x7a
add dl, byte [0x14055dd2c]
cmp al, dl
jne 0x14026a7f0
jmp 0x14026a95f
xor eax, eax
lea rcx, [0x14055dbd0]
lea rdx, [0x14046fc50]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x14026a848
inc rax
jmp 0x14026a830
mov al, 0x20
xchg byte [0x14055dbdc], al
lea rax, [0x14055dbd0]
pop rsi
ret
xor r9d, r9d
lea rax, [0x14055dc10]
lea rcx, [0x14046fc90]
mov edx, r8d
xor edx, 0x3e4b9f71
xor r8d, 0x3e4b9f03
nop word [rax + rax]
movsxd r9, r9d
movzx r10d, byte [r9 + rcx]
mov r11d, r10d
xor r11b, r10b
not r11b
and r11b, byte [r9 + rax]
xor r11b, r10b
mov byte [r9 + rax], r11b
mov r10d, dword [0x14055dd28]
lea r11d, [rdx + r10]
mov esi, r9d
xor esi, r11d
and r9d, r11d
lea r9d, [rsi + r9*2]
add r10d, r8d
cmp r9d, r10d
jl 0x14026a880
mov al, 0xd5
xchg byte [0x14055dc1f], al
lea rax, [0x14055dc10]
pop rsi
ret
xor eax, eax
lea rcx, [0x14055db10]
lea rdx, [0x14046fb90]
xor r8d, 0x3e4b9f17
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14055dd28]
add r10d, r8d
cmp r9d, r10d
jge 0x14026a968
inc rax
jmp 0x14026a8f0
xor eax, eax
lea rcx, [0x14055dc20]
lea rdx, [0x14046fca0]
xor r8d, 0x3e4b9f71
nop dword [rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x14055dd28]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 0xd
jl 0x14026a930
mov al, 0xe2
xchg byte [0x14055dc2d], al
lea rax, [0x14055dc20]
pop rsi
ret
mov al, 0xaf
xchg byte [0x14055db33], al
lea rax, [0x14055db10]
pop rsi
ret
Function at 0x14026a980
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x14026a9b9
test edx, edx
je 0x14026a9f9
movzx eax, byte [0x14055db9d]
cmp al, 0xad
je 0x14026aafd
mov cl, 0x6d
nop
mov al, 0x10
lock cmpxchg byte [0x14055db9d], cl
je 0x14026aa99
cmp al, 0xad
jne 0x14026a9a0
jmp 0x14026aafd
test edx, edx
je 0x14026aa67
movzx eax, byte [0x14055db03]
cmp al, 0x31
je 0x14026aba6
mov cl, 0x53
nop word cs:[rax + rax]
mov al, 0x64
lock cmpxchg byte [0x14055db03], cl
je 0x14026ab06
cmp al, 0x31
jne 0x14026a9e0
jmp 0x14026aba6
movzx eax, byte [0x14055dccd]
mov ecx, r8d
xor cl, 0x29
add cl, byte [0x14055dd2c]
cmp al, cl
je 0x14026ab95
nop word cs:[rax + rax]
movzx ecx, byte [0x14055dd2c]
mov eax, r8d
xor al, 0x6d
add al, cl
mov edx, r8d
xor dl, 0x9b
add dl, cl
lock cmpxchg byte [0x14055dccd], dl
je 0x14026ab48
movzx ecx, byte [0x14055dd2c]
mov edx, r8d
xor dl, 0x29
mov r9d, edx
xor r9b, cl
and dl, cl
add dl, dl
add dl, r9b
cmp al, dl
jne 0x14026aa20
jmp 0x14026ab95
movzx eax, byte [0x14055dbb3]
cmp al, 0xdc
je 0x14026abf9
mov cl, 0x79
nop dword [rax + rax]
mov al, 0xa6
lock cmpxchg byte [0x14055dbb3], cl
je 0x14026abaf
cmp al, 0xdc
jne 0x14026aa80
jmp 0x14026abf9
xor eax, eax
lea rcx, [0x14055db90]
lea rdx, [0x14046fc10]
mov r9d, r8d
xor r9d, 0x96325e4c
nop word cs:[rax + rax]
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x14055dd28]
mov esi, r9d
xor esi, r11d
and r11d, r9d
lea r11d, [rsi + r11*2]
cmp r10d, r11d
jge 0x14026aaeb
inc rax
jmp 0x14026aac0
xor r8b, 0xf0
add r8b, byte [0x14055dd2c]
xchg byte [0x14055db9d], r8b
lea rax, [0x14055db90]
pop rsi
ret
xor eax, eax
lea rcx, [0x14055db00]
lea rdx, [0x14046fb80]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x14026ab9e
inc rax
jmp 0x14026ab20
xor eax, eax
lea rcx, [0x14055dcc0]
lea rdx, [0x14046fd40]
xor r8d, 0x96325e30
nop
cdqe
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
mov r9d, dword [0x14055dd28]
add r9d, r8d
add eax, r9d
cmp eax, 0xd
jl 0x14026ab60
mov al, 0xd4
xchg byte [0x14055dccd], al
lea rax, [0x14055dcc0]
pop rsi
ret
mov al, 0x31
xchg byte [0x14055db03], al
lea rax, [0x14055db00]
pop rsi
ret
xor eax, eax
lea rcx, [0x14055dba0]
lea rdx, [0x14046fc20]
xor r8d, 0x96325e46
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14055dd28]
add r10d, r8d
cmp r9d, r10d
jge 0x14026abf1
inc rax
jmp 0x14026abd0
mov al, 0xdc
xchg byte [0x14055dbb3], al
lea rax, [0x14055dba0]
pop rsi
ret
Function at 0x140270f10
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14055f878]
movabs rcx, 0xf9a35477669cfa31
movabs rdx, 0xf3133d3fd397e6b7
add rdx, rcx
movabs r8, 0x9bbdac2fa780a04c
sub rdx, r8
sub rdx, rcx
mov rcx, rdx
xor rcx, rax
and rdx, rax
lea rax, [rcx + rdx*2]
add rax, r8
cmp qword [rbx + 0x18], rax
je 0x1402710ed
lea rdi, [rbx + 8]
cmp byte [0x1405aa968], 0
jne 0x140270fd0
mov eax, 0xffff62cd
add eax, dword [0x14055e2a4]
cdqe
add rax, qword [0x14055e2b0]
mov rcx, rbx
call qword [case.0x14013008b.0]
mov ecx, eax
mov edx, dword [0x1405aa960]
lea eax, [rdx - 1]
imul eax, edx
mov r8d, dword [0x14055f870]
mov edx, r8d
xor edx, 0x4aefac7c
mov r9d, r8d
and r9d, 0x4aefac7c
lea r9d, [rdx + r9*2]
xor edx, edx
div r9d
add r8d, 0x4aefac7a
cmp edx, r8d
je 0x140271016
nop
mov eax, 0x809adc47
sub eax, dword [0x14055e2a4]
mov ecx, eax
xor ecx, 0x7f65c0ec
and eax, 0x7f65c0ec
lea eax, [rcx + rax*2]
mov ecx, dword [0x14055f870]
neg eax
add eax, ecx
add eax, 0x4aefac7a
cdqe
add rax, qword [0x14055e2b0]
mov rcx, rbx
call qword [case.0x14013008b.0]
test rbx, rbx
je 0x140270fd0
jmp 0x140270f74
test cl, cl
je 0x140271030
mov eax, 0xffff62cd
add eax, dword [0x14055e2a0]
cdqe
add rax, qword [0x14055e2c0]
jmp 0x14027104a
mov eax, dword [0x14055e2a8]
sub eax, dword [0x14055f870]
add eax, 0xb50fb653
cdqe
add rax, qword [0x14055e2c8]
mov rcx, rsi
call qword [case.0x14013008b.0]
mov r8, qword [rbx + 0x18]
cmp qword [rbx + 0x20], 0x10
jb 0x140271062
mov rdi, qword [rbx + 8]
lea rbx, [rsi + 8]
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x20]
mov rdx, rax
sub rdx, rcx
cmp rdx, r8
jae 0x1402710a3
mov eax, 0xffff62cd
add eax, dword [0x14055e2ac]
cdqe
add rax, qword [0x14055e2b8]
mov qword [rsp + 0x20], r8
mov rcx, rbx
mov rdx, r8
mov r9, rdi
call qword [case.0x14013008b.0]
jmp 0x1402710ed
mov rdx, r8
not rdx
mov r9, rcx
xor r9, rdx
xor rdx, r8
and rdx, rcx
xor rdx, r8
and r9, rcx
movabs r10, 0x52d1ad84af96f83a
sub rdx, r10
lea r14, [rdx + r9*2]
add r14, r10
mov qword [rsi + 0x18], r14
cmp rax, 0x10
jb 0x1402710dd
mov rbx, qword [rsi + 8]
add rcx, rbx
mov rdx, rdi
call fcn.140446180
mov byte [rbx + r14], 0
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140298180
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1405640b0]
mov r8d, eax
xor r8d, 0xc0bc3fff
and eax, 0x40bc3fff
lea eax, [r8 + rax*2]
cmp ecx, eax
jne 0x1402981dc
mov eax, 0xc0bc3fff
add eax, dword [0x1405640b0]
cmp edx, eax
jne 0x140298208
movzx eax, byte [0x140563404]
cmp al, 0x53
je 0x1402981d4
mov cl, 0x35
nop dword [rax]
mov al, 0xf
lock cmpxchg byte [0x140563404], cl
je 0x1402982da
cmp al, 0x53
jne 0x1402981c0
lea rax, [0x1405633f0]
ret
test edx, edx
je 0x14029823c
movzx eax, byte [0x14056342a]
cmp al, 0x4b
je 0x140298200
mov cl, 0x31
nop dword [rax]
mov al, pe_nt_image_headers64
lock cmpxchg byte [0x14056342a], cl
je 0x14029826c
cmp al, 0x4b
jne 0x1402981f0
lea rax, [0x140563420]
ret
movzx eax, byte [0x1405634c6]
movzx ecx, byte [0x1405640c0]
add cl, 0x12
cmp al, cl
je 0x140298234
mov cl, 0xed
nop
mov al, 0xd2
lock cmpxchg byte [0x1405634c6], cl
je 0x14029833c
cmp al, 0x2d
jne 0x140298220
lea rax, [0x1405634b0]
ret
movzx eax, byte [0x140563414]
cmp al, 0x64
je 0x140298264
mov cl, 0x61
nop dword [rax]
mov al, 0x94
lock cmpxchg byte [0x140563414], cl
je 0x140298385
cmp al, 0x64
jne 0x140298250
lea rax, [0x140563410]
ret
xor eax, eax
lea rcx, [0x140563420]
lea rdx, [0x140471be0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
mov r9d, dword [0x1405640b0]
mov r10d, r9d
xor r10d, 0x40ea7758
and r9d, 0x40ea7758
lea r9d, [r10 + r9*2]
add r9d, 0x7fd1c8b1
cmp r8d, r9d
jge 0x1402982ca
inc rax
jmp 0x140298280
mov al, 0x4b
xchg byte [0x14056342a], al
lea rax, [0x140563420]
ret
xor edx, edx
lea rax, [0x1405633f0]
lea rcx, [0x140471bb0]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1405640b0]
mov r9d, edx
xor r9d, 0xb1744dd0
and edx, 0x31744dd0
lea edx, [r9 + rdx*2]
add edx, r8d
add edx, 0xf47f230
cmp edx, 0x14
jl 0x1402982f0
movzx eax, byte [0x1405640c0]
add al, 0x38
xchg byte [0x140563404], al
lea rax, [0x1405633f0]
ret
xor edx, edx
lea rax, [0x1405634b0]
lea rcx, [0x140471c60]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0x7ffffffe
and r8d, edx
xor edx, 1
lea edx, [rdx + r8*2]
cmp edx, 0x16
jl 0x140298350
mov al, 0x2d
xchg byte [0x1405634c6], al
lea rax, [0x1405634b0]
ret
xor eax, eax
lea rcx, [0x140563410]
lea rdx, [0x140471bd0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x1402983b8
inc rax
jmp 0x1402983a0
movzx eax, byte [0x1405640c0]
mov ecx, eax
xor cl, 0x49
and al, 0x49
add al, al
add al, cl
xchg byte [0x140563414], al
lea rax, [0x140563410]
ret
Function at 0x1402d1190
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1402d11cc
test edx, edx
je 0x1402d124f
movzx eax, byte [0x14056e363]
cmp al, 0x94
je 0x1402d11c4
mov cl, 0x2e
nop
mov al, 0x21
lock cmpxchg byte [0x14056e363], cl
je 0x1402d12cc
cmp al, 0x94
jne 0x1402d11b0
lea rax, [0x14056e340]
ret
test edx, edx
je 0x1402d127c
movzx eax, byte [0x14056e1f0]
nop dword [rax + rax]
cmp al, 3
je 0x1402d132f
movzx ecx, byte [0x14056e39c]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0x97
mov eax, r8d
and al, 0x68
or al, r9b
add al, cl
and dl, 0x5e
mov r9d, r8d
and r9b, 0xa1
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x14056e1f0], r9b
jne 0x1402d11e0
xor eax, eax
lea rcx, [0x14056e0f0]
lea rdx, [0x140478220]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xff
jg 0x1402d1327
inc rax
jmp 0x1402d1230
movzx eax, byte [0x14056e37f]
cmp al, 0x83
je 0x1402d1274
mov cl, 0x85
nop dword [rax]
mov al, 0x20
lock cmpxchg byte [0x14056e37f], cl
je 0x1402d1337
cmp al, 0x83
jne 0x1402d1260
lea rax, [0x14056e370]
ret
movzx eax, byte [0x14056e21e]
cmp al, 0x3b
je 0x1402d12c4
nop word [rax + rax]
movzx ecx, byte [0x14056e39c]
mov eax, r8d
xor al, 0xf3
add al, cl
mov edx, r8d
xor dl, 0xf6
add dl, cl
lock cmpxchg byte [0x14056e21e], dl
je 0x1402d139b
mov ecx, r8d
xor cl, 0x9b
add cl, byte [0x14056e39c]
cmp al, cl
jne 0x1402d1290
lea rax, [0x14056e200]
ret
xor eax, eax
lea rcx, [0x14056e340]
lea rdx, [0x140478450]
nop dword [rax]
xor r8d, r8d
sub r8b, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
xor r10d, r10d
sub r10b, r9b
mov r9d, r8d
xor r9b, r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
neg r10b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1402d1317
inc rax
jmp 0x1402d12e0
mov al, 0x94
xchg byte [0x14056e363], al
lea rax, [0x14056e340]
ret
mov al, 3
xchg byte [0x14056e1f0], al
lea rax, [0x14056e0f0]
ret
xor eax, eax
lea rcx, [0x14056e370]
lea rdx, [0x140478480]
mov r9d, r8d
xor r9d, 0xbb7172c0
nop word cs:[rax + rax]
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x14056e398]
add r11d, r9d
cmp r10d, r11d
jge 0x1402d1381
inc rax
jmp 0x1402d1360
xor r8b, 0x53
add r8b, byte [0x14056e39c]
xchg byte [0x14056e37f], r8b
lea rax, [0x14056e370]
ret
xor eax, eax
lea rcx, [0x14056e200]
lea rdx, [0x140478320]
xor r8d, 0xbb7172f2
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
mov r9d, dword [0x14056e398]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 0x1e
jl 0x1402d13c0
mov al, 0x3b
xchg byte [0x14056e21e], al
lea rax, [0x14056e200]
ret
Function at 0x1402e49c0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rcx
mov eax, dword [0x1405ab81c]
cmp eax, 0x5f
jg 0x1402e49f0
mov eax, dword [0x1405ab81c]
cmp eax, 0x5b
jl 0x1402e49fd
nop word cs:[rax + rax]
mov eax, dword [0x1405ab81c]
cmp eax, 0x4f
jge 0x1402e49f0
jmp 0x1402e49d8
mov esi, 0xfffffffe
test rdi, rdi
je 0x1402e4be6
cmp qword [rdi + 0x30], 0
je 0x1402e4be6
cmp qword [rdi + 0x38], 0
je 0x1402e4be6
mov r14, qword [rdi + 0x28]
test r14, r14
je 0x1402e4be6
cmp qword [r14], rdi
jne 0x1402e4be6
mov eax, dword [0x1405ab818]
mov ecx, dword [0x140571f98]
not ecx
add ecx, eax
add ecx, 0x13c7bc34
imul ecx, eax
test cl, 1
jne 0x1402e4a82
mov ecx, dword [r14 + 8]
mov r8d, dword [0x1405a9d28]
mov edx, dword [0x1405ab818]
lea eax, [rdx - 1]
imul eax, edx
mov r9d, 0x8d784e6a
add r9d, dword [0x140571f98]
xor edx, edx
div r9d
test edx, edx
je 0x1402e4ab0
lea rbx, [0x1402ef230]
mov bpl, 1
nop dword [rax]
mov ecx, 0x3d
call fcn.1403fe444
mov qword [0x1405ab810], rax
mov rcx, rbx
call fcn.14041e5a0
test bpl, bpl
je 0x1402e4a90
jmp 0x1402e4a55
lea eax, [r8 + rcx]
add eax, 0xffffc0cc
cmp eax, 0x1f
ja 0x1402e4be6
mov rax, qword [rdi + 0x28]
mov qword [rax + 0x34], 0
mov dword [rax + 0x3c], 0
cmp qword [rdi + 0x30], 0
je 0x1402e4be6
cmp qword [rdi + 0x38], 0
je 0x1402e4be6
mov rax, qword [rdi + 0x28]
test rax, rax
je 0x1402e4be6
cmp qword [rax], rdi
jne 0x1402e4be6
mov ecx, dword [rax + 8]
mov edx, dword [0x140571f98]
add ecx, edx
add ecx, 0x8d780f34
cmp ecx, 0x20
setae cl
setb r8b
movzx edx, byte [0x1405a9868]
mov r9d, edx
xor r9b, 1
mov r10d, r8d
xor r10b, r9b
test r10b, r8b
jne 0x1402e4b42
and r9b, r8b
jne 0x1402e4b42
and dl, cl
je 0x1402e4be6
mov dword [rax + 0x24], 0
mov dword [rdi + 0x1c], 0
mov dword [rdi + 0xc], 0
mov qword [rdi + 0x20], 0
mov ecx, dword [rax + 0x10]
test ecx, ecx
je 0x1402e4b83
mov edx, 0x8d784e69
add edx, dword [0x140571f98]
mov r8d, ecx
xor r8d, edx
or edx, ecx
not edx
or edx, r8d
not edx
mov dword [rdi + 0x4c], edx
mov qword [rax + 8], 0x3f34
movabs rcx, 0xffffffff00000000
mov qword [rax + 0x14], rcx
mov dword [rax + 0x1c], 0x8000
mov qword [rax + 0x28], 0
mov ecx, 0x8d784e68
add ecx, dword [0x140571f98]
mov dword [rax + 0x48], ecx
mov dword [rax + 0x4c], 0
lea rcx, [rax + 0x550]
mov qword [rax + 0x88], rcx
mov qword [rax + 0x68], rcx
mov qword [rax + 0x60], rcx
movabs rcx, 0xffffffff00000001
mov qword [rax + 0x1be0], rcx
xor esi, esi
mov eax, dword [0x1405ab818]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x1402e4c00
mov al, 1
test al, al
jne 0x1402e4c23
nop dword [rax]
mov eax, dword [0x1405ab81c]
mov ecx, dword [0x140571f98]
mov edx, ecx
xor edx, 0x8d784ebc
and ecx, 0xd784ebc
lea ecx, [rdx + rcx*2]
cmp eax, ecx
jge 0x1402e4c00
jmp 0x1402e4bf7
mov eax, esi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140356820
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x75af528
add eax, dword [0x140587380]
cmp ecx, eax
jne 0x14035685c
test edx, edx
je 0x14035688c
movzx eax, byte [0x14058653e]
cmp al, 0x20
je 0x140356854
mov cl, 0xff
mov al, 0x38
lock cmpxchg byte [0x14058653e], cl
je 0x1403568fc
cmp al, 0x20
jne 0x140356840
lea rax, [0x140586530]
ret
test edx, edx
je 0x1403568c0
movzx eax, byte [0x1405862bd]
cmp al, 6
je 0x140356884
mov cl, 0x39
nop dword [rax]
mov al, 0x43
lock cmpxchg byte [0x1405862bd], cl
je 0x140356938
cmp al, 6
jne 0x140356870
lea rax, [0x1405862a0]
ret
movzx eax, byte [0x140586433]
cmp al, 0xd0
je 0x1403568b8
mov cl, 0xe4
nop dword [rax]
mov al, 0xba
lock cmpxchg byte [0x140586433], cl
je 0x140356988
cmp al, byte [0x140587384]
jne 0x1403568a0
lea rax, [0x140586430]
ret
movzx eax, byte [0x140586519]
movzx ecx, byte [0x140587384]
add cl, 0xcb
cmp al, cl
je 0x1403568f4
mov cl, 0xcb
nop word [rax + rax]
mov al, 0x67
lock cmpxchg byte [0x140586519], cl
je 0x1403569d1
cmp al, 0x9b
jne 0x1403568e0
lea rax, [0x140586510]
ret
xor eax, eax
lea rcx, [0x140586530]
lea rdx, [0x1404860b0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x140356968
inc rax
jmp 0x140356910
xor eax, eax
lea rcx, [0x1405862a0]
lea rdx, [0x140485e50]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1c
jg 0x140356978
inc rax
jmp 0x140356950
mov al, 0x20
xchg byte [0x14058653e], al
lea rax, [0x140586530]
ret
mov al, 6
xchg byte [0x1405862bd], al
lea rax, [0x1405862a0]
ret
xor edx, edx
lea rax, [0x140586430]
lea rcx, [0x140485fc0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x140587380]
add edx, r8d
add edx, 0x75af529
cmp edx, 3
jl 0x1403569a0
mov al, 0xd0
xchg byte [0x140586433], al
lea rax, [0x140586430]
ret
xor eax, eax
lea rcx, [0x140586510]
lea rdx, [0x140486090]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x140356a18
inc rax
jmp 0x1403569f0
mov al, 0x9b
xchg byte [0x140586519], al
lea rax, [0x140586510]
ret
Function at 0x14035d530
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov r8d, dword [rsp + 0x40]
test ecx, ecx
je 0x14035d579
test edx, edx
je 0x14035d5b5
movzx eax, byte [0x140587579]
cmp al, 0x61
je 0x14035d650
mov cl, 0x6e
nop word cs:[rax + rax]
mov al, 0x51
lock cmpxchg byte [0x140587579], cl
je 0x14035d619
cmp al, 0x61
jne 0x14035d560
jmp 0x14035d650
test edx, edx
je 0x14035d5e9
movzx eax, byte [0x1405874f2]
cmp al, 0xc4
je 0x14035d70d
mov cl, 9
nop
mov al, 0x13
lock cmpxchg byte [0x1405874f2], cl
je 0x14035d65c
mov edx, r8d
xor dl, 0x65
add dl, byte [0x140587b8c]
cmp al, dl
jne 0x14035d590
jmp 0x14035d70d
movzx eax, byte [0x1405874b0]
cmp al, 0x56
je 0x14035d6fc
mov cl, 0x76
nop word cs:[rax + rax]
mov al, 0xf
lock cmpxchg byte [0x1405874b0], cl
je 0x14035d68c
cmp al, 0x56
jne 0x14035d5d0
jmp 0x14035d6fc
movzx eax, byte [0x140587553]
cmp al, 0xa7
je 0x14035d76d
mov cl, 0x9a
nop word [rax + rax]
mov al, 0xcf
lock cmpxchg byte [0x140587553], cl
je 0x14035d716
cmp al, 0xa7
jne 0x14035d600
jmp 0x14035d76d
xor eax, eax
lea rcx, [0x140587570]
lea rdx, [0x140486440]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x14035d648
inc rax
jmp 0x14035d630
mov al, 0x61
xchg byte [0x140587579], al
lea rax, [0x140587570]
jmp 0x14035d774
xor eax, eax
lea rcx, [0x1405874e0]
lea rdx, [0x1404863b0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x14035d705
inc rax
jmp 0x14035d670
xor r10d, r10d
lea rax, [0x1405874a0]
lea rcx, [0x140486380]
mov edx, r8d
xor edx, 0x2c28831a
mov r9d, r8d
xor r9d, 0x2c28830b
movsxd r10, r10d
movzx r11d, byte [r10 + rcx]
mov ebx, r11d
xor bl, r11b
not bl
and bl, byte [r10 + rax]
xor bl, r11b
mov byte [r10 + rax], bl
mov r11d, dword [0x140587b88]
lea esi, [rdx + r11]
mov edi, r10d
xor edi, esi
and r10d, esi
lea r10d, [rdi + r10*2]
add r11d, r9d
cmp r10d, r11d
jl 0x14035d6b0
xor r8b, 0x17
add r8b, byte [0x140587b8c]
xchg byte [0x1405874b0], r8b
lea rax, [0x1405874a0]
jmp 0x14035d774
mov al, 0xc4
xchg byte [0x1405874f2], al
lea rax, [0x1405874e0]
jmp 0x14035d774
xor eax, eax
lea rcx, [0x140587530]
lea rdx, [0x140486400]
xor r8d, 0x2c28833c
nop dword [rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140587b88]
add r10d, r8d
cmp r9d, r10d
jge 0x14035d765
inc rax
jmp 0x14035d730
mov al, 0xa7
xchg byte [0x140587553], al
lea rax, [0x140587530]
pop rbx
pop rdi
pop rsi
ret