joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401c8740
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1401c877c
test edx, edx
je 0x1401c87ff
movzx eax, byte [0x1406194d2]
cmp al, 0x92
je 0x1401c8774
mov cl, 0x2e
nop
mov al, 0xc
lock cmpxchg byte [0x1406194d2], cl
je 0x1401c886c
cmp al, 0x92
jne 0x1401c8760
lea rax, [0x1406194c0]
ret
test edx, edx
je 0x1401c8838
movzx eax, byte [0x140619510]
nop dword [rax + rax]
cmp al, 0x85
je 0x1401c87f7
movzx ecx, byte [0x14061980c]
mov eax, r8d
xor al, 0xc4
add al, cl
mov edx, r8d
xor dl, 0x78
add dl, cl
lock cmpxchg byte [0x140619510], dl
jne 0x1401c8790
xor edx, edx
lea rax, [0x140619500]
lea rcx, [0x1405341b0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x1401c87d0
mov al, 0x85
xchg byte [0x140619510], al
lea rax, [0x140619500]
ret
movzx eax, byte [0x140619540]
xor r8b, 0x64
add r8b, byte [0x14061980c]
cmp al, r8b
je 0x1401c8830
mov cl, 0xd
nop dword [rax + rax]
mov al, 0x6e
lock cmpxchg byte [0x140619540], cl
je 0x1401c88a8
cmp al, 0xe9
jne 0x1401c8820
lea rax, [0x140619530]
ret
movzx eax, byte [0x1406194b5]
cmp al, 0x61
je 0x1401c8864
mov cl, 0x80
nop word cs:[rax + rax]
mov al, 0x23
lock cmpxchg byte [0x1406194b5], cl
je 0x1401c88e8
cmp al, 0x61
jne 0x1401c8850
lea rax, [0x1406194a0]
ret
xor eax, eax
lea rcx, [0x1406194c0]
lea rdx, [0x140534170]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x1401c8898
inc rax
jmp 0x1401c8880
mov al, 0x92
xchg byte [0x1406194d2], al
lea rax, [0x1406194c0]
ret
xor eax, eax
lea rcx, [0x140619530]
lea rdx, [0x1405341d0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1401c88d8
inc rax
jmp 0x1401c88c0
mov al, 0xe9
xchg byte [0x140619540], al
lea rax, [0x140619530]
ret
xor eax, eax
lea rcx, [0x1406194a0]
lea rdx, [0x140534150]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1401c8918
inc rax
jmp 0x1401c8900
mov al, 0x61
xchg byte [0x1406194b5], al
lea rax, [0x1406194a0]
ret
Function at 0x1401d8790
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401d87dc
test edx, edx
je 0x1401d882c
movzx eax, byte [0x14061a39d]
movzx ecx, byte [0x14061c704]
add cl, 0x89
cmp al, cl
je 0x1401d87d4
mov cl, 0xd6
nop word cs:[rax + rax]
mov al, 0x7a
lock cmpxchg byte [0x14061a39d], cl
je 0x1401d888c
cmp al, 0xbb
jne 0x1401d87c0
lea rax, [0x14061a390]
ret
test edx, edx
je 0x1401d885c
movzx eax, byte [0x14061a365]
movzx ecx, byte [0x14061c704]
add cl, 0xfb
mov edx, ecx
xor dl, 0xf1
and cl, 0x71
add cl, cl
add cl, dl
cmp al, cl
je 0x1401d8824
mov cl, 0x8f
nop word cs:[rax + rax]
mov al, 0x51
lock cmpxchg byte [0x14061a365], cl
je 0x1401d88ff
cmp al, 0x1e
jne 0x1401d8810
lea rax, [0x14061a350]
ret
movzx eax, byte [0x14061a2df]
cmp al, 0xd9
je 0x1401d8854
mov cl, pe_nt_image_headers64
nop dword [rax]
mov al, 0x23
lock cmpxchg byte [0x14061a2df], cl
je 0x1401d895b
cmp al, 0xd9
jne 0x1401d8840
lea rax, [0x14061a2d0]
ret
movzx eax, byte [0x14061a0ec]
cmp al, 0xb5
je 0x1401d8884
mov cl, 0xe1
nop dword [rax]
mov al, 0x75
lock cmpxchg byte [0x14061a0ec], cl
je 0x1401d899f
cmp al, 0xb5
jne 0x1401d8870
lea rax, [0x14061a0c0]
ret
xor eax, eax
lea rcx, [0x14061a390]
lea rdx, [0x140534720]
nop dword [rax]
cdqe
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
mov r8d, dword [0x14061c700]
mov r9d, r8d
not r9d
mov r10d, r8d
and r10d, 0x43dad44a
mov r11d, r9d
and r11d, 0xbc252bb5
or r11d, r10d
xor r8d, 0x3c252bb5
and r9d, 0x43dad44a
or r9d, r8d
not r9d
lea r8d, [r11 + r9*2]
add eax, r8d
cmp eax, 0xd
jl 0x1401d88a0
mov al, 0xbb
xchg byte [0x14061a39d], al
lea rax, [0x14061a390]
ret
xor edx, edx
lea rax, [0x14061a350]
lea rcx, [0x1405346e0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 0x9780646d
and edx, 0x1780646d
lea edx, [r8 + rdx*2]
add edx, 0x687f9b94
cmp edx, 0x15
jl 0x1401d8910
mov al, 0x1e
xchg byte [0x14061a365], al
lea rax, [0x14061a350]
ret
xor eax, eax
lea rcx, [0x14061a2d0]
lea rdx, [0x140534660]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1401d8988
inc rax
jmp 0x1401d8970
movzx eax, byte [0x14061c704]
add al, 0xa7
xchg byte [0x14061a2df], al
lea rax, [0x14061a2d0]
ret
xor edx, edx
lea rax, [0x14061a0c0]
lea rcx, [0x140534460]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0x759fbe03
and edx, 0x759fbe03
lea edx, [r8 + rdx*2]
add edx, 0x8a6041fe
cmp edx, 0x2c
jl 0x1401d89b0
mov al, 0xb5
xchg byte [0x14061a0ec], al
lea rax, [0x14061a0c0]
ret
Function at 0x1401e16a0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401e16f1
test edx, edx
je 0x1401e1736
movzx eax, byte [0x14061d01b]
cmp al, 0xf5
je 0x1401e16e9
nop word [rax + rax]
movzx ecx, byte [0x14061d508]
lea eax, [rcx - 0x65]
add cl, 0xda
lock cmpxchg byte [0x14061d01b], cl
je 0x1401e179c
movzx ecx, byte [0x14061d508]
add cl, 0xdf
cmp al, cl
jne 0x1401e16c0
lea rax, [0x14061d010]
ret
test edx, edx
je 0x1401e176c
movzx eax, byte [0x14061cf93]
movzx ecx, byte [0x14061d508]
add cl, 0x1d
cmp al, cl
je 0x1401e172e
mov cl, 0xd4
nop dword [rax]
mov al, 0x10
lock cmpxchg byte [0x14061cf93], cl
je 0x1401e17d8
movzx edx, byte [0x14061d508]
add dl, 0x1d
cmp al, dl
jne 0x1401e1710
lea rax, [0x14061cf70]
ret
movzx eax, byte [0x14061ce95]
cmp al, 0x5d
je 0x1401e1764
mov cl, 0xe5
nop word cs:[rax + rax]
mov al, 0xcb
lock cmpxchg byte [0x14061ce95], cl
je 0x1401e181f
cmp al, 0x5d
jne 0x1401e1750
lea rax, [0x14061ce80]
ret
movzx eax, byte [0x14061cfab]
cmp al, 0x6b
je 0x1401e1794
mov cl, 0xba
nop dword [rax]
mov al, 0xec
lock cmpxchg byte [0x14061cfab], cl
je 0x1401e1871
cmp al, 0x6b
jne 0x1401e1780
lea rax, [0x14061cfa0]
ret
xor eax, eax
lea rcx, [0x14061d010]
lea rdx, [0x140534c50]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x1401e17c8
inc rax
jmp 0x1401e17b0
mov al, 0xf5
xchg byte [0x14061d01b], al
lea rax, [0x14061d010]
ret
xor edx, edx
lea rax, [0x14061cf70]
lea rcx, [0x140534bb0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x23
jl 0x1401e17f0
mov al, 0x33
xchg byte [0x14061cf93], al
lea rax, [0x14061cf70]
ret
xor eax, eax
lea rcx, [0x14061ce80]
lea rdx, [0x140534ad0]
mov r8d, 0x34961e21
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14061d4f8]
add r10d, r8d
cmp r9d, r10d
jge 0x1401e1861
inc rax
jmp 0x1401e1840
mov al, 0x5d
xchg byte [0x14061ce95], al
lea rax, [0x14061ce80]
ret
xor eax, eax
lea rcx, [0x14061cfa0]
lea rdx, [0x140534be0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x1401e18a8
inc rax
jmp 0x1401e1890
movzx eax, byte [0x14061d508]
add al, 0x55
xchg byte [0x14061cfab], al
lea rax, [0x14061cfa0]
ret
Function at 0x1401e8ef0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
test ecx, ecx
je 0x1401e8f22
movzx eax, byte [0x14061d971]
cmp al, 0x6d
je 0x1401e8f97
mov cl, 0x1c
nop dword [rax]
mov al, 0x73
lock cmpxchg byte [0x14061d971], cl
je 0x1401e8f55
cmp al, 0x6d
jne 0x1401e8f10
jmp 0x1401e8f97
movzx eax, byte [0x14061d9f1]
cmp al, 0x49
je 0x1401e8ff6
mov cl, 0xd7
nop word cs:[rax + rax]
mov al, 0x6d
lock cmpxchg byte [0x14061d9f1], cl
je 0x1401e8fa0
cmp al, 0x49
jne 0x1401e8f40
jmp 0x1401e8ff6
xor edx, edx
lea rax, [0x14061d960]
lea rcx, [0x1405351b0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x11
jl 0x1401e8f70
mov al, 0x6d
xchg byte [0x14061d971], al
lea rax, [0x14061d960]
jmp 0x1401e8ffd
xor eax, eax
lea rdi, [0x14061d9e0]
lea rbx, [0x140535230]
lea rsi, [rsp + 0x3c]
nop word cs:[rax + rax]
movsxd rcx, eax
movzx edx, byte [rcx + rdi]
add dl, byte [rcx + rbx]
mov dword [rsp + 0x28], 0x1bc53024
mov dword [rsp + 0x20], 0x5080e1dd
mov r8d, ecx
mov r9, rsi
call fcn.1401e92f0
mov eax, dword [rsp + 0x3c]
cmp eax, 0x11
jl 0x1401e8fc0
mov al, 0x49
xchg byte [0x14061d9f1], al
lea rax, [0x14061d9e0]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x1401e9030
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1401e90d1
test edx, edx
je 0x1401e910c
movzx eax, byte [0x14061d6a1]
cmp al, 0xa4
je 0x1401e90c9
movzx ecx, byte [0x14061db80]
mov r9d, r8d
xor r9b, cl
xor r9b, 0xbf
mov eax, r8d
xor al, 0x40
mov edx, ecx
not dl
and al, dl
or al, r9b
not al
add al, al
add al, r9b
mov r9d, r8d
not r9b
mov r10d, r8d
xor r10b, 0x7e
and r9b, 0x81
or r10b, r9b
not r10b
or r10b, r9b
xor dl, cl
and dl, r10b
xor dl, cl
and r10b, cl
add r10b, r10b
add r10b, dl
lock cmpxchg byte [0x14061d6a1], r10b
je 0x1401e916c
mov ecx, r8d
xor cl, 0x23
mov edx, r8d
not dl
and dl, r8b
xor dl, cl
add dl, byte [0x14061db80]
cmp al, dl
jne 0x1401e9050
lea rax, [0x14061d690]
ret
test edx, edx
je 0x1401e913c
movzx eax, byte [0x14061d88a]
cmp al, 0xe5
je 0x1401e9104
mov cl, 0x5a
nop word cs:[rax + rax]
mov al, 0x25
lock cmpxchg byte [0x14061d88a], cl
je 0x1401e91a8
cmp al, 0xe5
jne 0x1401e90f0
lea rax, [0x14061d880]
ret
movzx eax, byte [0x14061d8dd]
cmp al, 0xfa
je 0x1401e9134
mov cl, 0x1e
nop dword [rax]
mov al, 0x3e
lock cmpxchg byte [0x14061d8dd], cl
je 0x1401e91d8
cmp al, 0xfa
jne 0x1401e9120
lea rax, [0x14061d8d0]
ret
movzx eax, byte [0x14061d8ce]
cmp al, 0x85
je 0x1401e9164
mov cl, 0x5b
nop dword [rax]
mov al, 0xc1
lock cmpxchg byte [0x14061d8ce], cl
je 0x1401e9256
cmp al, 0x85
jne 0x1401e9150
lea rax, [0x14061d8c0]
ret
xor eax, eax
lea rcx, [0x14061d690]
lea rdx, [0x140534ee0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x1401e9198
inc rax
jmp 0x1401e9180
mov al, 0xa4
xchg byte [0x14061d6a1], al
lea rax, [0x14061d690]
ret
xor eax, eax
lea rcx, [0x14061d880]
lea rdx, [0x1405350d0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 9
jg 0x1401e921c
inc rax
jmp 0x1401e91c0
xor eax, eax
lea rcx, [0x14061d8d0]
lea rdx, [0x140535120]
nop dword [rax + rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xc
jg 0x1401e922c
inc rax
jmp 0x1401e91f0
mov al, 0xe5
xchg byte [0x14061d88a], al
lea rax, [0x14061d880]
ret
mov eax, r8d
not al
and al, 0x99
xor r8b, 0x66
or r8b, al
not r8b
or r8b, al
add r8b, byte [0x14061db80]
xchg byte [0x14061d8dd], r8b
lea rax, [0x14061d8d0]
ret
xor eax, eax
lea rcx, [0x14061d8c0]
lea rdx, [0x140535110]
mov r9d, r8d
not r9d
xor r8d, 0x41e10c20
and r9d, 0xbe1ef3df
or r8d, r9d
not r8d
or r8d, r9d
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
mov r9d, dword [0x14061db70]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 0xe
jl 0x1401e9290
mov al, 0x85
xchg byte [0x14061d8ce], al
lea rax, [0x14061d8c0]
ret
Function at 0x1401e9960
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r8d, dword [rsp + 0x30]
mov eax, r8d
xor eax, 0x9a4930f6
mov r9d, dword [0x14061db70]
add r9d, eax
cmp ecx, r9d
jne 0x1401e99b9
test edx, edx
je 0x1401e9a9c
movzx eax, byte [0x14061d7bd]
cmp al, 0xe1
je 0x1401e9b00
mov cl, 0xae
nop word cs:[rax + rax]
mov al, 0xc
lock cmpxchg byte [0x14061d7bd], cl
je 0x1401e9ac5
cmp al, 0xe1
jne 0x1401e99a0
jmp 0x1401e9b00
add eax, dword [0x14061db70]
cmp edx, eax
jne 0x1401e99f9
movzx eax, byte [0x14061d99f]
cmp al, 0x2d
je 0x1401e9b9b
mov cl, 0x69
nop word cs:[rax + rax]
mov al, 0x6d
lock cmpxchg byte [0x14061d99f], cl
je 0x1401e9b09
cmp al, 0x2d
jne 0x1401e99e0
jmp 0x1401e9b9b
movzx eax, byte [0x14061d832]
cmp al, 0x59
je 0x1401e9a93
movzx ecx, byte [0x14061db80]
mov eax, r8d
xor al, 0x34
mov edx, eax
xor dl, cl
and al, cl
add al, al
add al, dl
mov edx, r8d
xor dl, 0xc4
add dl, cl
lock cmpxchg byte [0x14061d832], dl
jne 0x1401e9a00
xor eax, eax
lea rcx, [0x14061d820]
lea rdx, [0x140535070]
mov r9d, r8d
xor r9d, 0x9a4930f7
nop word [rax + rax]
cdqe
movzx r10d, byte [rax + rcx]
movzx r11d, byte [rax + rdx]
mov ebx, r10d
xor bl, r11b
and r10b, r11b
add r10b, r10b
add r10b, bl
mov byte [rax + rcx], r10b
mov r10d, dword [0x14061db70]
add r10d, r9d
add eax, r10d
cmp eax, 0x12
jl 0x1401e9a50
xor r8b, 0x50
add r8b, byte [0x14061db80]
xchg byte [0x14061d832], r8b
lea rax, [0x14061d820]
pop rbx
ret
cmp byte [0x14061d7ed], 0
je 0x1401e9b80
mov cl, 0x99
nop dword [rax + rax]
mov al, 0xde
lock cmpxchg byte [0x14061d7ed], cl
je 0x1401e9b38
test al, al
jne 0x1401e9ab0
jmp 0x1401e9b80
xor eax, eax
lea rcx, [0x14061d7b0]
lea rdx, [0x140535000]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401e9af8
inc rax
jmp 0x1401e9ae0
mov al, 0xe1
xchg byte [0x14061d7bd], al
lea rax, [0x14061d7b0]
pop rbx
ret
xor eax, eax
lea rcx, [0x14061d990]
lea rdx, [0x1405351e0]
nop dword [rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xe
jg 0x1401e9b89
inc rax
jmp 0x1401e9b20
xor edx, edx
lea rax, [0x14061d7e0]
lea rcx, [0x140535030]
xor r8d, 0x9a4930f7
nop
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, dword [0x14061db70]
add r9d, r8d
mov r10d, edx
xor r10d, r9d
and r9d, edx
lea edx, [r10 + r9*2]
cmp edx, 0xd
jl 0x1401e9b50
xor eax, eax
xchg byte [0x14061d7ed], al
lea rax, [0x14061d7e0]
pop rbx
ret
xor r8b, 0x7c
add r8b, byte [0x14061db80]
xchg byte [0x14061d99f], r8b
lea rax, [0x14061d990]
pop rbx
ret
Function at 0x1401fd8b0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401fd8ec
test edx, edx
je 0x1401fd92c
movzx eax, byte [0x14061e1c3]
cmp al, 0x34
je 0x1401fd8e4
mov cl, 0x7a
nop word cs:[rax + rax]
mov al, 0x7c
lock cmpxchg byte [0x14061e1c3], cl
je 0x1401fd98c
cmp al, 0x34
jne 0x1401fd8d0
lea rax, [0x14061e1c0]
ret
test edx, edx
je 0x1401fd95c
movzx eax, byte [0x14061e065]
movzx ecx, byte [0x14061eef4]
mov edx, ecx
xor dl, 0x37
and cl, 0x37
add cl, cl
add cl, dl
cmp al, cl
je 0x1401fd924
mov cl, 0xb1
mov al, 0xf7
lock cmpxchg byte [0x14061e065], cl
je 0x1401fda09
cmp al, 0x4a
jne 0x1401fd910
lea rax, [0x14061e060]
ret
movzx eax, byte [0x14061e2db]
cmp al, 0x6d
je 0x1401fd954
mov cl, 0xce
nop dword [rax]
mov al, 0x80
lock cmpxchg byte [0x14061e2db], cl
je 0x1401fda72
cmp al, 0x6d
jne 0x1401fd940
lea rax, [0x14061e2d0]
ret
movzx eax, byte [0x14061dfcd]
cmp al, 0x4d
je 0x1401fd984
mov cl, 0x70
nop dword [rax]
mov al, 0xfc
lock cmpxchg byte [0x14061dfcd], cl
je 0x1401fdab8
cmp al, 0x4d
jne 0x1401fd970
lea rax, [0x14061df90]
ret
xor edx, edx
lea rax, [0x14061e1c0]
lea rcx, [0x140535740]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
not r10b
mov r11d, r9d
xor r11b, r10b
and r10b, r9b
not r11b
and r11b, r8b
or r11b, r10b
mov byte [rdx + rax], r11b
mov r8d, edx
not r8d
mov r9d, r8d
and r9d, 1
mov r10d, edx
and r10d, 0xfffffffe
or r10d, r9d
xor edx, 1
and r8d, 0x7ffffffe
or r8d, edx
not r8d
lea edx, [r10 + r8*2]
cmp edx, 3
jl 0x1401fd9a0
mov al, 0x34
xchg byte [0x14061e1c3], al
lea rax, [0x14061e1c0]
ret
xor edx, edx
lea rax, [0x14061e060]
lea rcx, [0x1405355e0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
add edx, 0xb4f76687
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x4b089979
cmp edx, 5
jl 0x1401fda20
movzx eax, byte [0x14061eef4]
add al, 0x37
xchg byte [0x14061e065], al
lea rax, [0x14061e060]
ret
xor eax, eax
lea rcx, [0x14061e2d0]
lea rdx, [0x140535850]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x1401fdaa8
inc rax
jmp 0x1401fda90
mov al, 0x6d
xchg byte [0x14061e2db], al
lea rax, [0x14061e2d0]
ret
xor edx, edx
lea rax, [0x14061df90]
lea rcx, [0x140535510]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, dword [0x14061eef0]
mov r9d, edx
not r9d
mov r10d, 0x4190e8e6
sub r10d, r8d
add r8d, 0xbe6f1719
mov r11d, edx
and r11d, r10d
and r10d, r9d
and r9d, r8d
or r11d, r9d
xor r8d, edx
or r10d, r8d
not r10d
lea edx, [r11 + r10*2]
cmp edx, 0x3d
jl 0x1401fdad0
mov al, 0x4d
xchg byte [0x14061dfcd], al
lea rax, [0x14061df90]
ret
Function at 0x1401fdc10
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401fdc4c
test edx, edx
je 0x1401fdc8c
movzx eax, byte [0x14061e18e]
cmp al, 0x3a
je 0x1401fdc44
mov cl, 0x43
nop word cs:[rax + rax]
mov al, 0x5a
lock cmpxchg byte [0x14061e18e], cl
je 0x1401fdd0c
cmp al, 0x3a
jne 0x1401fdc30
lea rax, [0x14061e180]
ret
mov eax, 0xbe6f1718
add eax, dword [0x14061eef0]
cmp edx, eax
jne 0x1401fdcda
movzx eax, byte [0x14061e0c6]
cmp al, 0x5a
je 0x1401fdc84
mov cl, 0xd9
nop dword [rax + rax]
mov al, 0x72
lock cmpxchg byte [0x14061e0c6], cl
je 0x1401fddd9
cmp al, 0x5a
jne 0x1401fdc70
lea rax, [0x14061e0c0]
ret
movzx eax, byte [0x14061e1ac]
cmp al, 0x59
je 0x1401fdcd2
mov cl, 0x75
nop dword [rax]
mov al, 0xde
lock cmpxchg byte [0x14061e1ac], cl
je 0x1401fdd7f
movzx edx, byte [0x14061eef4]
xor r8d, r8d
sub r8b, dl
mov edx, r8d
xor dl, 0xba
and r8b, 0x3a
add r8b, r8b
add r8b, dl
add al, r8b
jne 0x1401fdca0
lea rax, [0x14061e190]
ret
movzx eax, byte [0x14061e29d]
cmp al, 0x40
je 0x1401fdd04
mov cl, 0x2e
nop word [rax + rax]
mov al, 0x28
lock cmpxchg byte [0x14061e29d], cl
je 0x1401fde41
cmp al, 0x40
jne 0x1401fdcf0
lea rax, [0x14061e290]
ret
xor r8d, r8d
lea rax, [0x14061e180]
lea rcx, [0x140535700]
mov edx, 0xbe6f1726
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
xor byte [r8 + rax], r9b
add r8d, 0xb70f1edd
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
add r8d, 0x48f0e123
mov r9d, dword [0x14061eef0]
add r9d, edx
cmp r8d, r9d
jl 0x1401fdd30
movzx eax, byte [0x14061eef4]
add al, 0x27
xchg byte [0x14061e18e], al
lea rax, [0x14061e180]
ret
xor r8d, r8d
lea rax, [0x14061e190]
lea rcx, [0x140535710]
mov edx, 0xbe6f1719
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
xor byte [r8 + rax], r9b
mov r9d, dword [0x14061eef0]
add r9d, edx
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r8d, [r10 + r9*2]
cmp r8d, 0x1c
jl 0x1401fdda0
mov al, 0x59
xchg byte [0x14061e1ac], al
lea rax, [0x14061e190]
ret
xor edx, edx
lea rax, [0x14061e0c0]
lea rcx, [0x140535640]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add r8b, byte [rdx + rax]
add r8b, 0x37
mov r9d, r8d
xor r9b, 0xc9
and r8b, 0x49
add r8b, r8b
add r8b, r9b
mov byte [rdx + rax], r8b
mov r8d, dword [0x14061eef0]
add edx, r8d
add edx, 0xbe6f1719
cmp edx, 6
jl 0x1401fddf0
movzx eax, byte [0x14061eef4]
add al, 0x47
xchg byte [0x14061e0c6], al
lea rax, [0x14061e0c0]
ret
xor eax, eax
lea rcx, [0x14061e290]
lea rdx, [0x140535810]
mov r8d, 0xbe6f1725
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x14061eef0]
add r10d, r8d
cmp r9d, r10d
jge 0x1401fde91
inc rax
jmp 0x1401fde60
movzx eax, byte [0x14061eef4]
add al, 0x2d
xchg byte [0x14061e29d], al
lea rax, [0x14061e290]
ret
Function at 0x1401fe0a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x1401fe0d9
test edx, edx
je 0x1401fe125
movzx eax, byte [0x14061e262]
cmp al, 0xac
je 0x1401fe203
mov cl, 0x11
nop
mov al, 0x8c
lock cmpxchg byte [0x14061e262], cl
je 0x1401fe199
cmp al, 0xac
jne 0x1401fe0c0
jmp 0x1401fe203
mov eax, r8d
xor eax, 0xefd1a6a8
add eax, dword [0x14061eef0]
cmp edx, eax
jne 0x1401fe165
movzx eax, byte [0x14061e0b9]
cmp al, 0x99
je 0x1401fe301
mov cl, 0xde
nop dword [rax]
mov al, 0xa2
lock cmpxchg byte [0x14061e0b9], cl
je 0x1401fe264
mov edx, r8d
xor dl, 0x36
add dl, byte [0x14061eef4]
cmp al, dl
jne 0x1401fe100
jmp 0x1401fe301
movzx eax, byte [0x14061e001]
cmp al, 0x85
je 0x1401fe25b
mov cl, 0xf1
nop word cs:[rax + rax]
mov al, 0x5e
lock cmpxchg byte [0x14061e001], cl
je 0x1401fe20c
mov edx, r8d
xor dl, 0xc2
add dl, byte [0x14061eef4]
cmp al, dl
jne 0x1401fe140
jmp 0x1401fe25b
movzx eax, byte [0x14061e151]
cmp al, 0xf0
je 0x1401fe312
mov cl, 0xb3
nop word cs:[rax + rax]
mov al, 0x56
lock cmpxchg byte [0x14061e151], cl
je 0x1401fe2a8
cmp al, 0xf0
jne 0x1401fe180
jmp 0x1401fe312
xor eax, eax
lea rcx, [0x14061e260]
lea rdx, [0x1405357e0]
mov r9d, r8d
xor r9d, 0xefd1a6a9
nop word cs:[rax + rax]
cdqe
movzx r10d, byte [rax + rcx]
movzx r11d, byte [rax + rdx]
mov ebx, r10d
xor bl, r11b
and r10b, r11b
add r10b, r10b
add r10b, bl
mov byte [rax + rcx], r10b
mov r10d, dword [0x14061eef0]
add r10d, r9d
add eax, r10d
cmp eax, 2
jl 0x1401fe1c0
xor r8b, 0x29
add r8b, byte [0x14061eef4]
xchg byte [0x14061e262], r8b
lea rax, [0x14061e260]
pop rbx
ret
xor edx, edx
lea rax, [0x14061dfd0]
lea rcx, [0x140535550]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x31
jl 0x1401fe220
mov al, 0x85
xchg byte [0x14061e001], al
lea rax, [0x14061dfd0]
pop rbx
ret
xor eax, eax
lea rcx, [0x14061e0b0]
lea rdx, [0x140535630]
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
cmp r9d, 8
jg 0x1401fe2e1
inc rax
jmp 0x1401fe280
xor eax, eax
lea rcx, [0x14061e140]
lea rdx, [0x1405356c0]
xor r8d, 0xefd1a699
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14061eef0]
add r10d, r8d
cmp r9d, r10d
jge 0x1401fe30a
inc rax
jmp 0x1401fe2c0
movzx eax, byte [0x14061eef4]
xor r8b, 0x36
mov ecx, r8d
xor cl, al
and r8b, al
add r8b, r8b
add r8b, cl
xchg byte [0x14061e0b9], r8b
lea rax, [0x14061e0b0]
pop rbx
ret
mov al, 0xf0
xchg byte [0x14061e151], al
lea rax, [0x14061e140]
pop rbx
ret