joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140227080
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1402270bc
test edx, edx
je 0x14022713d
movzx eax, byte [0x14052c5a7]
cmp al, 0x8b
je 0x1402270b4
mov cl, 0x63
nop
mov al, 0x11
lock cmpxchg byte [0x14052c5a7], cl
je 0x1402271ac
cmp al, 0x8b
jne 0x1402270a0
lea rax, [0x14052c580]
ret
test edx, edx
je 0x14022716c
movzx eax, byte [0x14052c80d]
nop dword [rax + rax]
cmp al, 0x66
je 0x140227135
movzx ecx, byte [0x14052c860]
mov eax, r8d
xor al, 0x90
add al, cl
mov edx, r8d
xor dl, 0xa4
add dl, cl
lock cmpxchg byte [0x14052c80d], dl
jne 0x1402270d0
xor eax, eax
lea rcx, [0x14052c800]
lea rdx, [0x140442380]
xor r8d, 0x8720677d
nop dword [rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x14052c858]
add r9d, r8d
add eax, r9d
cmp eax, 0xd
jl 0x140227110
mov al, 0x66
xchg byte [0x14052c80d], al
lea rax, [0x14052c800]
ret
movzx eax, byte [0x14052c6ca]
cmp al, 0xf7
je 0x140227164
mov cl, 0x97
nop word [rax + rax]
mov al, 0xf
lock cmpxchg byte [0x14052c6ca], cl
je 0x1402271fd
cmp al, 0xf7
jne 0x140227150
lea rax, [0x14052c6b0]
ret
movzx eax, byte [0x14052c786]
xor r8b, 0x4b
add r8b, byte [0x14052c860]
cmp al, r8b
je 0x1402271a4
mov cl, 0x1e
nop word cs:[rax + rax]
mov al, 0x57
lock cmpxchg byte [0x14052c786], cl
je 0x140227238
cmp al, 0xd8
jne 0x140227190
lea rax, [0x14052c780]
ret
xor eax, eax
lea rcx, [0x14052c580]
lea rdx, [0x140442100]
xor r8d, 0x8720677d
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x14052c858]
add r9d, r8d
add eax, r9d
cmp eax, 0x27
jl 0x1402271d0
mov al, 0x8b
xchg byte [0x14052c5a7], al
lea rax, [0x14052c580]
ret
xor eax, eax
lea rcx, [0x14052c6b0]
lea rdx, [0x140442230]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x19
jg 0x140227228
inc rax
jmp 0x140227210
mov al, 0xf7
xchg byte [0x14052c6ca], al
lea rax, [0x14052c6b0]
ret
xor eax, eax
lea rcx, [0x14052c780]
lea rdx, [0x140442300]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x140227268
inc rax
jmp 0x140227250
mov al, 0xd8
xchg byte [0x14052c786], al
lea rax, [0x14052c780]
ret
Function at 0x140245bf0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140245c2c
test edx, edx
je 0x140245c5c
movzx eax, byte [0x14052f63d]
cmp al, 0xbc
je 0x140245c24
mov cl, 0x41
nop word cs:[rax + rax]
mov al, 0x99
lock cmpxchg byte [0x14052f63d], cl
je 0x140245cc6
cmp al, 0xbc
jne 0x140245c10
lea rax, [0x14052f630]
ret
test edx, edx
je 0x140245c8c
movzx eax, byte [0x14052f3bb]
cmp al, 0xdb
je 0x140245c54
mov cl, 0x94
nop dword [rax]
mov al, 0x4f
lock cmpxchg byte [0x14052f3bb], cl
je 0x140245d08
cmp al, 0xdb
jne 0x140245c40
lea rax, [0x14052f3a0]
ret
movzx eax, byte [0x14052f59e]
cmp al, 0xd2
je 0x140245c84
mov cl, 0xa9
nop dword [rax]
mov al, 0xe2
lock cmpxchg byte [0x14052f59e], cl
je 0x140245d38
cmp al, 0xd2
jne 0x140245c70
lea rax, [0x14052f590]
ret
movzx eax, byte [0x14052f745]
cmp al, 0xc4
je 0x140245cbe
mov cl, 0x71
nop dword [rax]
mov al, 0x3d
lock cmpxchg byte [0x14052f745], cl
je 0x140245d96
movzx edx, byte [0x1405312e8]
add dl, 0xd5
cmp al, dl
jne 0x140245ca0
lea rax, [0x14052f730]
ret
xor eax, eax
lea rcx, [0x14052f630]
lea rdx, [0x140443450]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140245cf8
inc rax
jmp 0x140245ce0
mov al, 0xbc
xchg byte [0x14052f63d], al
lea rax, [0x14052f630]
ret
xor eax, eax
lea rcx, [0x14052f3a0]
lea rdx, [0x1404431e0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1a
jg 0x140245d7f
inc rax
jmp 0x140245d20
xor edx, edx
lea rax, [0x14052f590]
lea rcx, [0x1404433b0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xe
jl 0x140245d50
mov al, 0xd2
xchg byte [0x14052f59e], al
lea rax, [0x14052f590]
ret
movzx eax, byte [0x1405312e8]
add al, 0xec
xchg byte [0x14052f3bb], al
lea rax, [0x14052f3a0]
ret
xor edx, edx
lea rax, [0x14052f730]
lea rcx, [0x140443540]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1405312d8]
add edx, r8d
add edx, 0x4a2b697
add r8d, 0x4a2b6ab
cmp edx, r8d
jl 0x140245db0
mov al, 0xc4
xchg byte [0x14052f745], al
lea rax, [0x14052f730]
ret
Function at 0x140247600
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140247651
test edx, edx
je 0x140247696
movzx eax, byte [0x14052f7d5]
cmp al, 0xe3
je 0x140247649
nop word [rax + rax]
movzx ecx, byte [0x1405312e8]
lea eax, [rcx - 0x3d]
add cl, 0x5e
lock cmpxchg byte [0x14052f7d5], cl
je 0x14024770c
movzx ecx, byte [0x1405312e8]
add cl, 0xf4
cmp al, cl
jne 0x140247620
lea rax, [0x14052f7c0]
ret
mov eax, 0x4a2b696
add eax, dword [0x1405312d8]
cmp edx, eax
jne 0x1402476d6
movzx eax, byte [0x14052f9dc]
cmp al, 0x60
je 0x14024768e
mov cl, 0x2a
nop dword [rax]
mov al, 0x30
lock cmpxchg byte [0x14052f9dc], cl
je 0x140247798
movzx edx, byte [0x1405312e8]
add dl, 0x71
cmp al, dl
jne 0x140247670
lea rax, [0x14052f9d0]
ret
movzx eax, byte [0x14052f51a]
movzx ecx, byte [0x1405312e8]
add cl, 0x38
cmp al, cl
je 0x1402476ce
mov cl, 0xfd
nop dword [rax]
mov al, 0x9e
lock cmpxchg byte [0x14052f51a], cl
je 0x140247758
movzx edx, byte [0x1405312e8]
add dl, 0x38
cmp al, dl
jne 0x1402476b0
lea rax, [0x14052f500]
ret
movzx eax, byte [0x14052f9bc]
movzx ecx, byte [0x1405312e8]
add cl, 0xd7
cmp al, cl
je 0x140247704
mov cl, 0x84
nop dword [rax]
mov al, 0xfd
lock cmpxchg byte [0x14052f9bc], cl
je 0x1402477df
cmp al, 0xc6
jne 0x1402476f0
lea rax, [0x14052f9b0]
ret
xor eax, eax
lea rcx, [0x14052f7c0]
lea rdx, [0x1404435d0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140247748
inc rax
jmp 0x140247720
mov al, 0xe3
xchg byte [0x14052f7d5], al
lea rax, [0x14052f7c0]
ret
xor eax, eax
lea rcx, [0x14052f500]
lea rdx, [0x140443320]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x19
jg 0x140247788
inc rax
jmp 0x140247770
mov al, 0x27
xchg byte [0x14052f51a], al
lea rax, [0x14052f500]
ret
xor edx, edx
lea rax, [0x14052f9d0]
lea rcx, [0x1404437e0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xc
jl 0x1402477b0
mov al, 0x60
xchg byte [0x14052f9dc], al
lea rax, [0x14052f9d0]
ret
xor eax, eax
lea rcx, [0x14052f9b0]
lea rdx, [0x1404437c0]
mov r8d, 0x4a2b6a2
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405312d8]
add r10d, r8d
cmp r9d, r10d
jge 0x140247821
inc rax
jmp 0x140247800
movzx eax, byte [0x1405312e8]
add al, 0xd7
xchg byte [0x14052f9bc], al
lea rax, [0x14052f9b0]
ret
Function at 0x140249790
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov edi, r9d
mov esi, dword [rsp + 0xa0]
test ecx, ecx
je 0x1402497f9
mov eax, edi
xor eax, 0x11bab71d
mov r8d, esi
xor r8d, 0xb542edbb
mov ecx, edx
mov edx, eax
call fcn.140249730
test al, 1
je 0x140249839
movzx eax, byte [0x14052f95d]
cmp al, 0x2f
je 0x1402498f7
mov cl, 0x96
nop dword [rax + rax]
mov al, 0xa3
lock cmpxchg byte [0x14052f95d], cl
je 0x1402498b9
cmp al, 0x2f
jne 0x1402497e0
jmp 0x1402498f7
test edx, edx
je 0x140249884
mov ecx, edi
xor ecx, 0x66290b97
mov edx, esi
xor edx, 0x22918e6d
call fcn.1402481f0
test al, 1
jne 0x1402499d4
mov cl, 0x7e
mov al, 0xfd
lock cmpxchg byte [0x14052f83d], cl
je 0x14024994c
cmp al, 0x25
jne 0x140249820
jmp 0x1402499d4
xor edi, 0xf7c36511
mov edx, esi
xor edx, 0xd12f0993
add edx, dword [0x1405312d8]
xor edx, esi
mov ecx, edi
call fcn.140249770
test al, 1
jne 0x140249940
mov cl, 0xc
xor eax, eax
lock cmpxchg byte [0x140576838], cl
je 0x140249903
mov edx, esi
xor dl, 0x1d
add dl, byte [0x1405312e8]
cmp al, dl
jne 0x140249860
jmp 0x140249940
movzx eax, byte [0x14052f0e0]
cmp al, 0x4d
je 0x140249a2a
mov cl, 0xf8
nop word cs:[rax + rax]
mov al, 0x11
lock cmpxchg byte [0x14052f0e0], cl
je 0x1402499dd
cmp al, 0x4d
jne 0x1402498a0
jmp 0x140249a2a
xor edx, edx
lea rax, [0x14052f950]
lea rcx, [0x140443760]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x1402498d0
mov al, 0x2f
xchg byte [0x14052f95d], al
lea rax, [0x14052f950]
jmp 0x140249a31
xor eax, eax
lea rcx, [0x14052f2b0]
lea rdx, [0x1404430f0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1e
jg 0x140249938
inc rax
jmp 0x140249920
mov al, 0xd1
xchg byte [0x140576838], al
lea rax, [0x14052f2b0]
jmp 0x140249a31
xor eax, eax
lea r14, [0x14052f830]
lea r15, [0x140443640]
mov ebp, edi
xor ebp, 0xf91c2727
mov r12d, esi
xor r12d, 0x6ca5660c
lea rbx, [rsp + 0x3c]
nop word cs:[rax + rax]
movsxd r8, eax
movzx ecx, byte [r8 + r14]
movzx edx, byte [r8 + r15]
mov eax, dword [0x1405312d8]
add eax, r12d
mov r9d, eax
xor r9d, eax
not r9d
and r9d, esi
xor r9d, eax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x28], r9d
mov r9, rbx
call fcn.140247de0
mov eax, dword [rsp + 0x3c]
cmp eax, 0xd
jl 0x140249980
xor edi, 0xe2d58504
xor esi, 0x95a4f797
mov ecx, edi
mov edx, esi
call fcn.140249da0
lea rax, [0x14052f830]
jmp 0x140249a31
xor ecx, ecx
lea r14, [0x14052f0c0]
lea r15, [0x140442f20]
xor edi, 0xf7765a81
xor esi, 0x7a094d1d
lea rbx, [rsp + 0x38]
nop
movsxd rcx, ecx
movzx eax, byte [rcx + r15]
xor byte [rcx + r14], al
mov rdx, rbx
mov r8d, edi
mov r9d, esi
call fcn.140247b00
mov ecx, dword [rsp + 0x38]
test al, 1
je 0x140249a00
mov al, 0x4d
xchg byte [0x14052f0e0], al
lea rax, [0x14052f0c0]
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14024cf60
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xe353e10
add eax, dword [0x140531f20]
cmp ecx, eax
jne 0x14024cf9c
test edx, edx
je 0x14024cfcc
movzx eax, byte [0x140531d44]
cmp al, 0x3f
je 0x14024cf94
mov cl, 0x28
mov al, 0xc4
lock cmpxchg byte [0x140531d44], cl
je 0x14024d04a
cmp al, 0x3f
jne 0x14024cf80
lea rax, [0x140531d30]
ret
test edx, edx
je 0x14024cffc
movzx eax, byte [0x140531d5d]
cmp al, 0x32
je 0x14024cfc4
mov cl, 0x28
nop dword [rax]
mov al, 0x47
lock cmpxchg byte [0x140531d5d], cl
je 0x14024d09f
cmp al, 0x32
jne 0x14024cfb0
lea rax, [0x140531d50]
ret
movzx eax, byte [0x140531c62]
cmp al, 0xa8
je 0x14024cff4
mov cl, 0x91
nop dword [rax]
mov al, 0xb8
lock cmpxchg byte [0x140531c62], cl
je 0x14024d0d8
cmp al, 0xa8
jne 0x14024cfe0
lea rax, [0x140531c50]
ret
movzx eax, byte [0x140531b92]
cmp al, 0xa
je 0x14024d042
nop word [rax + rax]
movzx ecx, byte [0x140531f30]
lea eax, [rcx + 0x33]
add cl, 0x42
lock cmpxchg byte [0x140531b92], cl
je 0x14024d121
movzx ecx, byte [0x140531f30]
mov edx, ecx
xor dl, 0xe8
and cl, 0x68
add cl, cl
add cl, dl
cmp al, cl
jne 0x14024d010
lea rax, [0x140531b90]
ret
xor edx, edx
lea rax, [0x140531d30]
lea rcx, [0x140444000]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x14
jl 0x14024d060
mov al, 0x3f
xchg byte [0x140531d44], al
lea rax, [0x140531d30]
ret
xor eax, eax
lea rcx, [0x140531d50]
lea rdx, [0x140444020]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14024d0c8
inc rax
jmp 0x14024d0b0
mov al, 0x32
xchg byte [0x140531d5d], al
lea rax, [0x140531d50]
ret
xor edx, edx
lea rax, [0x140531c50]
lea rcx, [0x140443f20]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x140531f20]
add edx, r8d
add edx, 0xe353e11
cmp edx, 0x12
jl 0x14024d0f0
mov al, 0xa8
xchg byte [0x140531c62], al
lea rax, [0x140531c50]
ret
xor eax, eax
lea rcx, [0x140531b90]
lea rdx, [0x140443e60]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x14024d168
inc rax
jmp 0x14024d140
mov al, 0xa
xchg byte [0x140531b92], al
lea rax, [0x140531b90]
ret
Function at 0x14025a2b0
Capabilities:
Check for software breakpoints

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14025a31c
mov eax, r8d
xor eax, 0xf4b469cb
add eax, dword [0x140533218]
cmp edx, eax
jne 0x14025a34c
movzx eax, byte [0x140532efd]
movzx ecx, byte [0x140533228]
mov edx, r8d
xor dl, 0xa3
mov r9d, ecx
xor r9b, cl
not r9b
and r9b, dl
xor r9b, cl
and dl, cl
add dl, dl
add dl, r9b
cmp al, dl
je 0x14025a314
mov cl, 0x93
nop
mov al, 0xee
lock cmpxchg byte [0x140532efd], cl
je 0x14025a423
cmp al, 0xc2
jne 0x14025a300
lea rax, [0x140532ef0]
ret
test edx, edx
je 0x14025a37c
movzx eax, byte [0x140532d43]
cmp al, 0xc4
je 0x14025a344
mov cl, 0x34
nop dword [rax]
mov al, 0xea
lock cmpxchg byte [0x140532d43], cl
je 0x14025a4b2
cmp al, 0xc4
jne 0x14025a330
lea rax, [0x140532d40]
ret
movzx eax, byte [0x140532e6f]
cmp al, 0xcc
je 0x14025a374
mov cl, 0x80
nop dword [rax]
mov al, 0xf8
lock cmpxchg byte [0x140532e6f], cl
je 0x14025a458
cmp al, 0xcc
jne 0x14025a360
lea rax, [0x140532e60]
ret
movzx eax, byte [0x140532f1d]
nop word cs:[rax + rax]
cmp al, 0xe1
je 0x14025a513
movzx ecx, byte [0x140533228]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0xf9
mov eax, r8d
and al, 6
or al, r9b
add al, 0x51
mov r9d, eax
xor r9b, cl
and al, cl
add al, al
add al, r9b
add al, 0xaf
and dl, 0xf7
mov r9d, r8d
and r9b, 8
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x140532f1d], r9b
jne 0x14025a390
xor eax, eax
lea rcx, [0x140532f10]
lea rdx, [0x140444830]
nop
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r8b
mov r10d, r8d
and r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14025a50b
inc rax
jmp 0x14025a3f0
xor eax, eax
lea rcx, [0x140532ef0]
lea rdx, [0x140444810]
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xc
jg 0x14025a488
inc rax
jmp 0x14025a440
xor eax, eax
lea rcx, [0x140532e60]
lea rdx, [0x140444780]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x14025a4a2
inc rax
jmp 0x14025a470
xor r8b, 0xa3
add r8b, byte [0x140533228]
xchg byte [0x140532efd], r8b
lea rax, [0x140532ef0]
ret
mov al, 0xcc
xchg byte [0x140532e6f], al
lea rax, [0x140532e60]
ret
xor eax, eax
lea rcx, [0x140532d40]
lea rdx, [0x140444670]
mov r9d, r8d
xor r9d, 0xf4b469ce
nop dword [rax]
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x140533218]
add r11d, r9d
cmp r10d, r11d
jge 0x14025a4f1
inc rax
jmp 0x14025a4d0
xor r8b, 0xa5
add r8b, byte [0x140533228]
xchg byte [0x140532d43], r8b
lea rax, [0x140532d40]
ret
mov al, 0xe1
xchg byte [0x140532f1d], al
lea rax, [0x140532f10]
ret
Function at 0x140262f00
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140262f47
test edx, edx
je 0x140262f7c
movzx eax, byte [0x14053467d]
movzx ecx, byte [0x140534858]
add cl, 0xa7
cmp al, cl
je 0x140262f3f
nop dword [rax]
movzx ecx, byte [0x140534858]
lea eax, [rcx + 0xa]
add cl, 0x7d
lock cmpxchg byte [0x14053467d], cl
je 0x14026303c
cmp al, 0xe8
jne 0x140262f20
lea rax, [0x140534670]
ret
test edx, edx
je 0x140262fdc
movzx eax, byte [0x14053461d]
cmp al, 0xdc
je 0x140262f74
mov cl, 0x11
nop dword [rax]
mov al, 0x22
lock cmpxchg byte [0x14053461d], cl
je 0x14026308f
cmp al, 0xdc
jne 0x140262f60
lea rax, [0x140534610]
ret
movzx eax, byte [0x140534552]
nop word cs:[rax + rax]
cmp al, 0x85
je 0x140263087
movzx ecx, byte [0x140534858]
lea eax, [rcx + 2]
add cl, 0xd
lock cmpxchg byte [0x140534552], cl
jne 0x140262f90
xor eax, eax
lea rcx, [0x140534540]
lea rdx, [0x1404451e0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x14026307f
inc rax
jmp 0x140262fc0
movzx eax, byte [0x1405344e4]
nop word cs:[rax + rax]
cmp al, 0xe6
je 0x1402630d9
movzx ecx, byte [0x140534858]
lea eax, [rcx + 0x5d]
add cl, 0x76
lock cmpxchg byte [0x1405344e4], cl
jne 0x140262ff0
xor eax, eax
lea rcx, [0x1405344e0]
lea rdx, [0x140445190]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x1402630d1
inc rax
jmp 0x140263020
xor edx, edx
lea rax, [0x140534670]
lea rcx, [0x140445300]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x140263050
mov al, 0xe8
xchg byte [0x14053467d], al
lea rax, [0x140534670]
ret
mov al, 0x85
xchg byte [0x140534552], al
lea rax, [0x140534540]
ret
xor edx, edx
lea rax, [0x140534610]
lea rcx, [0x1404452a0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x140534848]
add edx, r8d
add edx, 0x89db2e37
cmp edx, 0xd
jl 0x1402630a0
mov al, 0xdc
xchg byte [0x14053461d], al
lea rax, [0x140534610]
ret
mov al, 0xe6
xchg byte [0x1405344e4], al
lea rax, [0x1405344e0]
ret
Function at 0x14026f970
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x14026fa1e
test edx, edx
je 0x14026fa55
movzx eax, byte [0x140534d8f]
nop dword [rax]
cmp al, 0xf1
je 0x14026fa15
movzx ecx, byte [0x140535d60]
mov eax, r8d
not al
mov edx, r8d
xor dl, 0xef
and dl, al
mov r9d, eax
and r9b, 0xb0
mov eax, r8d
xor al, 0xb0
and al, r8b
or al, r9b
add al, cl
mov r9d, r8d
and r9b, 0x10
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x140534d8f], r9b
jne 0x14026f990
xor eax, eax
lea rcx, [0x140534d80]
lea rdx, [0x1404458e0]
xor r8d, 0xc77cc3de
nop
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x140535d64]
add r9d, r8d
add eax, r9d
cmp eax, 0xf
jl 0x14026f9f0
mov al, 0xf1
xchg byte [0x140534d8f], al
lea rax, [0x140534d80]
pop rsi
ret
test edx, edx
je 0x14026fa85
movzx eax, byte [0x140534c51]
cmp al, 0x21
je 0x14026fb80
mov cl, 0x83
nop word cs:[rax + rax]
mov al, 0x77
lock cmpxchg byte [0x140534c51], cl
je 0x14026fab9
cmp al, 0x21
jne 0x14026fa40
jmp 0x14026fb80
movzx eax, byte [0x140534d18]
cmp al, 0x6c
je 0x14026fb65
mov cl, 0x4c
nop word cs:[rax + rax]
mov al, 0xae
lock cmpxchg byte [0x140534d18], cl
je 0x14026faf8
cmp al, 0x6c
jne 0x14026fa70
jmp 0x14026fb65
movzx eax, byte [0x140534bb3]
cmp al, 0x87
je 0x14026fbd0
mov cl, 0x68
nop word cs:[rax + rax]
mov al, 0x34
lock cmpxchg byte [0x140534bb3], cl
je 0x14026fb89
cmp al, 0x87
jne 0x14026faa0
jmp 0x14026fbd0
xor eax, eax
lea rcx, [0x140534c40]
lea rdx, [0x1404457a0]
nop dword [rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
cmp r9d, 0x10
jg 0x14026fb6e
inc rax
jmp 0x14026fad0
xor eax, eax
lea rcx, [0x140534d00]
lea rdx, [0x140445860]
mov r10d, r8d
not r10d
and r10d, 0xc77cc3de
mov r9d, r8d
xor r9d, 0x38833c21
or r9d, r10d
not r9d
or r9d, r10d
xor r8d, 0xc77cc327
nop
cdqe
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
mov r10d, dword [0x140535d64]
mov r11d, r9d
xor r11d, r10d
mov esi, r9d
and esi, r10d
lea r11d, [r11 + rsi*2]
add eax, r11d
add r10d, r8d
cmp eax, r10d
jl 0x14026fb30
mov al, 0x6c
xchg byte [0x140534d18], al
lea rax, [0x140534d00]
pop rsi
ret
xor r8b, 0x3c
add r8b, byte [0x140535d60]
xchg byte [0x140534c51], r8b
lea rax, [0x140534c40]
pop rsi
ret
xor eax, eax
lea rcx, [0x140534b90]
lea rdx, [0x1404456f0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x14026fbc8
inc rax
jmp 0x14026fba0
mov al, 0x87
xchg byte [0x140534bb3], al
lea rax, [0x140534b90]
pop rsi
ret
Function at 0x14027f070
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x5a89a641
add eax, dword [0x140538180]
cmp ecx, eax
jne 0x14027f0ac
test edx, edx
je 0x14027f0dc
movzx eax, byte [0x1405379b7]
cmp al, 0x30
je 0x14027f0a4
mov cl, 0xde
mov al, 0xb4
lock cmpxchg byte [0x1405379b7], cl
je 0x14027f13c
cmp al, 0x30
jne 0x14027f090
lea rax, [0x1405379a0]
ret
test edx, edx
je 0x14027f10c
movzx eax, byte [0x1405376d8]
cmp al, 0xa8
je 0x14027f0d4
mov cl, 0x81
nop dword [rax]
mov al, 0x41
lock cmpxchg byte [0x1405376d8], cl
je 0x14027f18f
cmp al, 0xa8
jne 0x14027f0c0
lea rax, [0x1405376d0]
ret
movzx eax, byte [0x140537780]
cmp al, 0xc6
je 0x14027f104
mov cl, 0xf2
nop dword [rax]
mov al, 0xc3
lock cmpxchg byte [0x140537780], cl
je 0x14027f1cf
cmp al, 0xc6
jne 0x14027f0f0
lea rax, [0x140537770]
ret
movzx eax, byte [0x140537865]
cmp al, 0xca
je 0x14027f134
mov cl, 0xd0
nop dword [rax]
mov al, 0x75
lock cmpxchg byte [0x140537865], cl
je 0x14027f223
cmp al, 0xca
jne 0x14027f120
lea rax, [0x140537850]
ret
xor eax, eax
lea rcx, [0x1405379a0]
lea rdx, [0x1404464a0]
nop dword [rax]
cdqe
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
mov r8d, dword [0x140538180]
mov r9d, r8d
xor r9d, 0x5a89a642
and r8d, 0x5a89a642
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0x17
jl 0x14027f150
mov al, 0x30
xchg byte [0x1405379b7], al
lea rax, [0x1405379a0]
ret
xor edx, edx
lea rax, [0x1405376d0]
lea rcx, [0x140446200]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 8
jl 0x14027f1a0
mov al, 0xa8
xchg byte [0x1405376d8], al
lea rax, [0x1405376d0]
ret
xor edx, edx
lea rax, [0x140537770]
lea rcx, [0x140446290]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x14027f1e0
mov al, 0xc6
xchg byte [0x140537780], al
lea rax, [0x140537770]
ret
xor eax, eax
lea rcx, [0x140537850]
lea rdx, [0x140446350]
mov r8d, 0x5a89a656
nop dword [rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x140538180]
add r10d, r8d
cmp r9d, r10d
jge 0x14027f261
inc rax
jmp 0x14027f240
mov al, 0xca
xchg byte [0x140537865], al
lea rax, [0x140537850]
ret