joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401d2850
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x1401d28d0
movzx eax, byte [0x1404e8030]
cmp al, 0x33
je 0x1401d28c8
mov cl, 0xab
nop word cs:[rax + rax]
cmp dword [0x1404e8178], 0x73c71a55
jne 0x1401d289e
mov al, 0xb5
lock cmpxchg byte [0x1404e8030], cl
sete dl
mov r8d, dword [0x140531d30]
lea r9d, [r8 - 1]
imul r9d, r8d
test r9b, 1
je 0x1401d28c0
mov al, 0xb5
lock cmpxchg byte [0x1404e8030], cl
mov eax, dword [0x140531d34]
cmp eax, 0x58
jge 0x1401d2870
jmp 0x1401d287c
test dl, dl
jne 0x1401d2910
cmp al, 0x33
jne 0x1401d2870
lea rax, [0x1404e8020]
ret
test edx, edx
je 0x1401d2948
movzx eax, byte [0x1404e8073]
movzx ecx, byte [0x1404e817c]
add cl, 0xed
cmp al, cl
je 0x1401d2a75
nop dword [rax]
movzx ecx, byte [0x1404e817c]
lea eax, [rcx + 0x3c]
add cl, 0xe3
lock cmpxchg byte [0x1404e8073], cl
je 0x1401d2950
cmp al, 0x4e
jne 0x1401d28f0
jmp 0x1401d2a75
xor eax, eax
lea rcx, [0x1404e8020]
lea rdx, [0x1404065d0]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1401d2938
inc rax
jmp 0x1401d2920
mov al, 0x33
xchg byte [0x1404e8030], al
lea rax, [0x1404e8020]
ret
xor eax, eax
test al, al
jne 0x1401d29be
jmp 0x1401d2987
xor eax, eax
lea rcx, [0x1404e8050]
lea rdx, [0x1404065f0]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1401d2978
inc rax
jmp 0x1401d2960
mov al, 1
test al, al
je 0x1401d2a60
jmp 0x1401d2a4b
movzx eax, byte [0x1404e8043]
mov ecx, dword [0x140531d30]
mov edx, dword [0x1404e8178]
mov r8d, ecx
sub r8d, edx
imul r8d, ecx
and r8d, 1
mov ecx, edx
xor ecx, 0x8c38e5ab
and edx, 0xc38e5ab
lea ecx, [rcx + rdx*2]
cmp r8d, ecx
je 0x1401d29c7
movzx eax, byte [0x1404e8043]
jmp 0x1401d2987
cmp al, 0x7d
je 0x1401d29f5
nop dword [rax + rax]
movzx ecx, byte [0x1404e817c]
lea eax, [rcx - 0x70]
add cl, 0xe2
lock cmpxchg byte [0x1404e8043], cl
je 0x1401d29fd
movzx ecx, byte [0x1404e817c]
add cl, 0x1c
cmp al, cl
jne 0x1401d29d0
lea rax, [0x1404e8040]
ret
xor eax, eax
lea rcx, [0x1404e8040]
lea rdx, [0x1404065e0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1401d2a28
inc rax
jmp 0x1401d2a10
mov eax, dword [0x140531d34]
xor eax, eax
test al, al
jne 0x1401d2a30
movzx eax, byte [0x1404e817c]
add al, 0x1c
xchg byte [0x1404e8043], al
lea rax, [0x1404e8040]
ret
mov al, 0x4e
xchg byte [0x1404e8073], al
mov eax, dword [0x140531d34]
cmp eax, 0x29
jl 0x1401d2a75
nop
mov al, 0x4e
xchg byte [0x1404e8073], al
mov eax, dword [0x140531d34]
cmp eax, 0x61
jge 0x1401d2a60
jmp 0x1401d2a4b
lea rax, [0x1404e8050]
ret
Function at 0x1401f02c0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401f02fc
test edx, edx
je 0x1401f033c
movzx eax, byte [0x1404ea38d]
cmp al, 0x86
je 0x1401f02f4
mov cl, 8
nop word cs:[rax + rax]
mov al, 0x75
lock cmpxchg byte [0x1404ea38d], cl
je 0x1401f03f6
cmp al, 0x86
jne 0x1401f02e0
lea rax, [0x1404ea380]
ret
test edx, edx
je 0x1401f03bf
movzx eax, byte [0x1404ea0d0]
cmp al, 0xfd
je 0x1401f0334
mov cl, 0x49
nop word cs:[rax + rax]
mov al, 9
lock cmpxchg byte [0x1404ea0d0], cl
je 0x1401f043f
cmp al, 0xfd
jne 0x1401f0320
lea rax, [0x1404ea0c0]
ret
movzx eax, byte [0x1404e9e94]
nop word cs:[rax + rax]
cmp al, 0xd1
je 0x1401f03b7
movzx ecx, byte [0x1404eb190]
mov edx, ecx
xor dl, 0x1d
mov eax, ecx
and al, 0x1d
add al, al
add al, dl
add cl, 0xa8
lock cmpxchg byte [0x1404e9e94], cl
jne 0x1401f0350
xor edx, edx
lea rax, [0x1404e9e50]
lea rcx, [0x140407550]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x44
jl 0x1401f0390
mov al, 0xd1
xchg byte [0x1404e9e94], al
lea rax, [0x1404e9e50]
ret
movzx eax, byte [0x1404ea47a]
cmp al, 0x53
je 0x1401f03ee
mov cl, 0xc0
nop dword [rax]
mov al, 0xee
lock cmpxchg byte [0x1404ea47a], cl
je 0x1401f0478
movzx edx, byte [0x1404eb190]
add dl, 0x3f
cmp al, dl
jne 0x1401f03d0
lea rax, [0x1404ea460]
ret
xor edx, edx
lea rax, [0x1404ea380]
lea rcx, [0x140407a60]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x1401f0410
mov al, 0x86
xchg byte [0x1404ea38d], al
lea rax, [0x1404ea380]
ret
xor eax, eax
lea rcx, [0x1404ea0c0]
lea rdx, [0x1404077c0]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1401f0468
inc rax
jmp 0x1401f0450
mov al, 0xfd
xchg byte [0x1404ea0d0], al
lea rax, [0x1404ea0c0]
ret
xor eax, eax
lea rcx, [0x1404ea460]
lea rdx, [0x140407b40]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x19
jg 0x1401f04a8
inc rax
jmp 0x1401f0490
mov al, 0x53
xchg byte [0x1404ea47a], al
lea rax, [0x1404ea460]
ret
Function at 0x1401f04c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1404eb1a0]
mov r8d, eax
xor r8d, 0xc645e0c6
and eax, 0x4645e0c6
lea eax, [r8 + rax*2]
cmp ecx, eax
jne 0x1401f051c
mov eax, 0xc645e0c6
add eax, dword [0x1404eb1a0]
cmp edx, eax
jne 0x1401f0556
movzx eax, byte [0x1404ea314]
cmp al, 0x4f
je 0x1401f0514
mov cl, 0x67
nop dword [rax]
mov al, 0x6b
lock cmpxchg byte [0x1404ea314], cl
je 0x1401f0656
cmp al, 0x4f
jne 0x1401f0500
lea rax, [0x1404ea300]
ret
test edx, edx
je 0x1401f058c
movzx eax, byte [0x1404ea1e1]
cmp al, 0x3c
je 0x1401f054e
mov cl, 0xad
nop dword [rax]
mov al, 0x4a
lock cmpxchg byte [0x1404ea1e1], cl
je 0x1401f05fc
movzx edx, byte [0x1404eb190]
add dl, 0x28
cmp al, dl
jne 0x1401f0530
lea rax, [0x1404ea1d0]
ret
movzx eax, byte [0x1404ea63a]
cmp al, 0x95
je 0x1401f0584
mov cl, 0x54
nop word cs:[rax + rax]
mov al, 0x3e
lock cmpxchg byte [0x1404ea63a], cl
je 0x1401f06c6
cmp al, 0x95
jne 0x1401f0570
lea rax, [0x1404ea630]
ret
movzx eax, byte [0x1404ea62d]
nop word cs:[rax + rax]
cmp al, 0x19
je 0x1401f0719
movzx ecx, byte [0x1404eb190]
lea eax, [rcx - 0x76]
add cl, 0xc8
lock cmpxchg byte [0x1404ea62d], cl
jne 0x1401f05a0
xor eax, eax
lea rcx, [0x1404ea620]
lea rdx, [0x140407d00]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401f0711
inc rax
jmp 0x1401f05d0
xor eax, eax
lea rcx, [0x1404ea1d0]
lea rdx, [0x1404078c0]
nop dword [rax]
cdqe
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
mov r8d, dword [0x1404eb1a0]
mov r9d, r8d
xor r9d, 0xc645e0c7
and r8d, 0x4645e0c7
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0x11
jl 0x1401f0610
movzx eax, byte [0x1404eb190]
add al, 0x28
xchg byte [0x1404ea1e1], al
lea rax, [0x1404ea1d0]
ret
xor edx, edx
lea rax, [0x1404ea300]
lea rcx, [0x1404079e0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
not r8b
not r9b
and r9b, r8b
or r9b, r10b
not r9b
add r9b, r9b
add r9b, r10b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x14
jl 0x1401f0670
movzx eax, byte [0x1404eb190]
add al, 0x3b
xchg byte [0x1404ea314], al
lea rax, [0x1404ea300]
ret
xor edx, edx
lea rax, [0x1404ea630]
lea rcx, [0x140407d10]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1404eb1a0]
add edx, r8d
add edx, 0xc645e0c7
cmp edx, 0xa
jl 0x1401f06e0
mov al, 0x95
xchg byte [0x1404ea63a], al
lea rax, [0x1404ea630]
ret
mov al, 0x19
xchg byte [0x1404ea62d], al
lea rax, [0x1404ea620]
ret
Function at 0x1401f22e0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401f231c
test edx, edx
je 0x1401f234c
movzx eax, byte [0x1404ea77d]
cmp al, 0xb1
je 0x1401f2314
mov cl, 0xdb
nop word cs:[rax + rax]
mov al, 0x8a
lock cmpxchg byte [0x1404ea77d], cl
je 0x1401f23bc
cmp al, 0xb1
jne 0x1401f2300
lea rax, [0x1404ea760]
ret
test edx, edx
je 0x1401f237c
movzx eax, byte [0x1404e9cb9]
cmp al, 0xb0
je 0x1401f2344
mov cl, 0x3d
nop dword [rax]
mov al, 0x87
lock cmpxchg byte [0x1404e9cb9], cl
je 0x1401f2408
cmp al, 0xb0
jne 0x1401f2330
lea rax, [0x1404e9cb0]
ret
movzx eax, byte [0x1404ea710]
cmp al, 0x7c
je 0x1401f2374
mov cl, 0x70
nop dword [rax]
mov al, 3
lock cmpxchg byte [0x1404ea710], cl
je 0x1401f2438
cmp al, 0x7c
jne 0x1401f2360
lea rax, [0x1404ea700]
ret
movzx eax, byte [0x1404ea41d]
movzx ecx, byte [0x1404eb190]
add cl, 0xfe
cmp al, cl
je 0x1401f23b4
mov cl, 0x18
nop word cs:[rax + rax]
mov al, 0xd9
lock cmpxchg byte [0x1404ea41d], cl
je 0x1401f248f
cmp al, 0x12
jne 0x1401f23a0
lea rax, [0x1404ea410]
ret
xor edx, edx
lea rax, [0x1404ea760]
lea rcx, [0x140407e10]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1404eb1a0]
add edx, r8d
add edx, 0xc645e0c7
cmp edx, 0x1d
jl 0x1401f23d0
movzx eax, byte [0x1404eb190]
add al, 0x9d
xchg byte [0x1404ea77d], al
lea rax, [0x1404ea760]
ret
xor eax, eax
lea rcx, [0x1404e9cb0]
lea rdx, [0x1404073d0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1401f247f
inc rax
jmp 0x1401f2420
xor edx, edx
lea rax, [0x1404ea700]
lea rcx, [0x140407dc0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x1401f2450
mov al, 0x7c
xchg byte [0x1404ea710], al
lea rax, [0x1404ea700]
ret
mov al, 0xb0
xchg byte [0x1404e9cb9], al
lea rax, [0x1404e9cb0]
ret
xor eax, eax
lea rcx, [0x1404ea410]
lea rdx, [0x140407af0]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401f24c8
inc rax
jmp 0x1401f24a0
mov al, 0x12
xchg byte [0x1404ea41d], al
lea rax, [0x1404ea410]
ret
Function at 0x1401faac0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1401fab4c
test edx, edx
je 0x1401faba8
movzx eax, byte [0x1404ec229]
nop dword [rax]
cmp al, 0x20
je 0x1401fac14
movzx ecx, byte [0x1404ec5a8]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0xfa
mov eax, r8d
and al, 5
or al, r9b
add al, cl
and dl, 0x6e
mov r9d, r8d
and r9b, 0x91
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x1404ec229], r9b
jne 0x1401faae0
xor eax, eax
lea rcx, [0x1404ec200]
lea rdx, [0x140408220]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x28
jg 0x1401fac0c
inc rax
jmp 0x1401fab30
mov eax, dword [0x1404ec5ac]
mov ecx, r8d
xor ecx, 0x4862b4e3
mov r9d, ecx
xor r9d, eax
and ecx, eax
lea eax, [r9 + rcx*2]
cmp edx, eax
jne 0x1401fabd8
movzx eax, byte [0x1404ec49d]
cmp al, 0x68
je 0x1401faba0
mov cl, 0xaa
nop dword [rax + rax]
mov al, 0xb5
lock cmpxchg byte [0x1404ec49d], cl
je 0x1401fac6d
mov edx, r8d
xor dl, 0xce
add dl, byte [0x1404ec5a8]
cmp al, dl
jne 0x1401fab80
lea rax, [0x1404ec490]
ret
movzx eax, byte [0x1404ec40e]
cmp al, 0xb6
je 0x1401fabd0
mov cl, 7
nop word cs:[rax + rax]
mov al, 0x7a
lock cmpxchg byte [0x1404ec40e], cl
je 0x1401fac1c
cmp al, 0xb6
jne 0x1401fabc0
lea rax, [0x1404ec400]
ret
movzx eax, byte [0x1404ec3cd]
cmp al, 0x59
je 0x1401fac04
mov cl, 0x1e
nop word cs:[rax + rax]
mov al, 0xf4
lock cmpxchg byte [0x1404ec3cd], cl
je 0x1401facbd
cmp al, 0x59
jne 0x1401fabf0
lea rax, [0x1404ec3c0]
ret
mov al, 0x20
xchg byte [0x1404ec229], al
lea rax, [0x1404ec200]
ret
xor eax, eax
lea rcx, [0x1404ec400]
lea rdx, [0x140408410]
xor r8d, 0x4862b4e0
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x1404ec5ac]
add r9d, r8d
add eax, r9d
cmp eax, 0xe
jl 0x1401fac40
mov al, 0xb6
xchg byte [0x1404ec40e], al
lea rax, [0x1404ec400]
ret
xor eax, eax
lea rcx, [0x1404ec490]
lea rdx, [0x1404084a0]
xor r8d, 0x4862b4e0
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x1404ec5ac]
add r9d, r8d
add eax, r9d
cmp eax, 0xd
jl 0x1401fac90
mov al, 0x68
xchg byte [0x1404ec49d], al
lea rax, [0x1404ec490]
ret
xor edx, edx
lea rax, [0x1404ec3c0]
lea rcx, [0x1404083d0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0xf6b2f426
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x94d0bda
cmp edx, 0xd
jl 0x1401facd0
mov al, 0x59
xchg byte [0x1404ec3cd], al
lea rax, [0x1404ec3c0]
ret
Function at 0x1402186f0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14021872c
test edx, edx
je 0x14021875c
movzx eax, byte [0x1404ef77d]
cmp al, 0xbc
je 0x140218724
mov cl, 0x41
nop word cs:[rax + rax]
mov al, 0x99
lock cmpxchg byte [0x1404ef77d], cl
je 0x1402187c6
cmp al, 0xbc
jne 0x140218710
lea rax, [0x1404ef770]
ret
test edx, edx
je 0x14021878c
movzx eax, byte [0x1404ef4fb]
cmp al, 0xdb
je 0x140218754
mov cl, 0x94
nop dword [rax]
mov al, 0x4f
lock cmpxchg byte [0x1404ef4fb], cl
je 0x140218808
cmp al, 0xdb
jne 0x140218740
lea rax, [0x1404ef4e0]
ret
movzx eax, byte [0x1404ef6de]
cmp al, 0xd2
je 0x140218784
mov cl, 0xa9
nop dword [rax]
mov al, 0xe2
lock cmpxchg byte [0x1404ef6de], cl
je 0x140218838
cmp al, 0xd2
jne 0x140218770
lea rax, [0x1404ef6d0]
ret
movzx eax, byte [0x1404ef885]
cmp al, 0xc4
je 0x1402187be
mov cl, 0x71
nop dword [rax]
mov al, 0x3d
lock cmpxchg byte [0x1404ef885], cl
je 0x140218896
movzx edx, byte [0x1404f1428]
add dl, 0xd5
cmp al, dl
jne 0x1402187a0
lea rax, [0x1404ef870]
ret
xor eax, eax
lea rcx, [0x1404ef770]
lea rdx, [0x1404095f0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1402187f8
inc rax
jmp 0x1402187e0
mov al, 0xbc
xchg byte [0x1404ef77d], al
lea rax, [0x1404ef770]
ret
xor eax, eax
lea rcx, [0x1404ef4e0]
lea rdx, [0x140409380]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1a
jg 0x14021887f
inc rax
jmp 0x140218820
xor edx, edx
lea rax, [0x1404ef6d0]
lea rcx, [0x140409550]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xe
jl 0x140218850
mov al, 0xd2
xchg byte [0x1404ef6de], al
lea rax, [0x1404ef6d0]
ret
movzx eax, byte [0x1404f1428]
add al, 0xec
xchg byte [0x1404ef4fb], al
lea rax, [0x1404ef4e0]
ret
xor edx, edx
lea rax, [0x1404ef870]
lea rcx, [0x1404096e0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1404f1418]
add edx, r8d
add edx, 0x4a2b697
add r8d, 0x4a2b6ab
cmp edx, r8d
jl 0x1402188b0
mov al, 0xc4
xchg byte [0x1404ef885], al
lea rax, [0x1404ef870]
ret
Function at 0x14021a100
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14021a151
test edx, edx
je 0x14021a196
movzx eax, byte [0x1404ef915]
cmp al, 0xe3
je 0x14021a149
nop word [rax + rax]
movzx ecx, byte [0x1404f1428]
lea eax, [rcx - 0x3d]
add cl, 0x5e
lock cmpxchg byte [0x1404ef915], cl
je 0x14021a20c
movzx ecx, byte [0x1404f1428]
add cl, 0xf4
cmp al, cl
jne 0x14021a120
lea rax, [0x1404ef900]
ret
mov eax, 0x4a2b696
add eax, dword [0x1404f1418]
cmp edx, eax
jne 0x14021a1d6
movzx eax, byte [0x1404efb1c]
cmp al, 0x60
je 0x14021a18e
mov cl, 0x2a
nop dword [rax]
mov al, 0x30
lock cmpxchg byte [0x1404efb1c], cl
je 0x14021a298
movzx edx, byte [0x1404f1428]
add dl, 0x71
cmp al, dl
jne 0x14021a170
lea rax, [0x1404efb10]
ret
movzx eax, byte [0x1404ef65a]
movzx ecx, byte [0x1404f1428]
add cl, 0x38
cmp al, cl
je 0x14021a1ce
mov cl, 0xfd
nop dword [rax]
mov al, 0x9e
lock cmpxchg byte [0x1404ef65a], cl
je 0x14021a258
movzx edx, byte [0x1404f1428]
add dl, 0x38
cmp al, dl
jne 0x14021a1b0
lea rax, [0x1404ef640]
ret
movzx eax, byte [0x1404efafc]
movzx ecx, byte [0x1404f1428]
add cl, 0xd7
cmp al, cl
je 0x14021a204
mov cl, 0x84
nop dword [rax]
mov al, 0xfd
lock cmpxchg byte [0x1404efafc], cl
je 0x14021a2df
cmp al, 0xc6
jne 0x14021a1f0
lea rax, [0x1404efaf0]
ret
xor eax, eax
lea rcx, [0x1404ef900]
lea rdx, [0x140409770]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x14021a248
inc rax
jmp 0x14021a220
mov al, 0xe3
xchg byte [0x1404ef915], al
lea rax, [0x1404ef900]
ret
xor eax, eax
lea rcx, [0x1404ef640]
lea rdx, [0x1404094c0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x19
jg 0x14021a288
inc rax
jmp 0x14021a270
mov al, 0x27
xchg byte [0x1404ef65a], al
lea rax, [0x1404ef640]
ret
xor edx, edx
lea rax, [0x1404efb10]
lea rcx, [0x140409980]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xc
jl 0x14021a2b0
mov al, 0x60
xchg byte [0x1404efb1c], al
lea rax, [0x1404efb10]
ret
xor eax, eax
lea rcx, [0x1404efaf0]
lea rdx, [0x140409960]
mov r8d, 0x4a2b6a2
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1404f1418]
add r10d, r8d
cmp r9d, r10d
jge 0x14021a321
inc rax
jmp 0x14021a300
movzx eax, byte [0x1404f1428]
add al, 0xd7
xchg byte [0x1404efafc], al
lea rax, [0x1404efaf0]
ret
Function at 0x14021c270
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov edi, r9d
mov esi, dword [rsp + 0xa0]
test ecx, ecx
je 0x14021c2d9
mov eax, edi
xor eax, 0x11bab71d
mov r8d, esi
xor r8d, 0xb542edbb
mov ecx, edx
mov edx, eax
call fcn.14021c210
test al, 1
je 0x14021c319
movzx eax, byte [0x1404efa9d]
cmp al, 0x2f
je 0x14021c3d7
mov cl, 0x96
nop dword [rax + rax]
mov al, 0xa3
lock cmpxchg byte [0x1404efa9d], cl
je 0x14021c399
cmp al, 0x2f
jne 0x14021c2c0
jmp 0x14021c3d7
test edx, edx
je 0x14021c364
mov ecx, edi
xor ecx, 0x66290b97
mov edx, esi
xor edx, 0x22918e6d
call fcn.14021acf0
test al, 1
jne 0x14021c4b4
mov cl, 0x7e
mov al, 0xfd
lock cmpxchg byte [0x1404ef97d], cl
je 0x14021c42c
cmp al, 0x25
jne 0x14021c300
jmp 0x14021c4b4
xor edi, 0xf7c36511
mov edx, esi
xor edx, 0xd12f0993
add edx, dword [0x1404f1418]
xor edx, esi
mov ecx, edi
call fcn.14021c250
test al, 1
jne 0x14021c420
mov cl, 0xc
xor eax, eax
lock cmpxchg byte [0x140532450], cl
je 0x14021c3e3
mov edx, esi
xor dl, 0x1d
add dl, byte [0x1404f1428]
cmp al, dl
jne 0x14021c340
jmp 0x14021c420
movzx eax, byte [0x1404ef220]
cmp al, 0x4d
je 0x14021c50a
mov cl, 0xf8
nop word cs:[rax + rax]
mov al, 0x11
lock cmpxchg byte [0x1404ef220], cl
je 0x14021c4bd
cmp al, 0x4d
jne 0x14021c380
jmp 0x14021c50a
xor edx, edx
lea rax, [0x1404efa90]
lea rcx, [0x140409900]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x14021c3b0
mov al, 0x2f
xchg byte [0x1404efa9d], al
lea rax, [0x1404efa90]
jmp 0x14021c511
xor eax, eax
lea rcx, [0x1404ef3f0]
lea rdx, [0x140409290]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1e
jg 0x14021c418
inc rax
jmp 0x14021c400
mov al, 0xd1
xchg byte [0x140532450], al
lea rax, [0x1404ef3f0]
jmp 0x14021c511
xor eax, eax
lea r14, [0x1404ef970]
lea r15, [0x1404097e0]
mov ebp, edi
xor ebp, 0xf91c2727
mov r12d, esi
xor r12d, 0x6ca5660c
lea rbx, [rsp + 0x3c]
nop word cs:[rax + rax]
movsxd r8, eax
movzx ecx, byte [r8 + r14]
movzx edx, byte [r8 + r15]
mov eax, dword [0x1404f1418]
add eax, r12d
mov r9d, eax
xor r9d, eax
not r9d
and r9d, esi
xor r9d, eax
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x28], r9d
mov r9, rbx
call fcn.14021a8e0
mov eax, dword [rsp + 0x3c]
cmp eax, 0xd
jl 0x14021c460
xor edi, 0xe2d58504
xor esi, 0x95a4f797
mov ecx, edi
mov edx, esi
call fcn.14021c880
lea rax, [0x1404ef970]
jmp 0x14021c511
xor ecx, ecx
lea r14, [0x1404ef200]
lea r15, [0x1404090c0]
xor edi, 0xf7765a81
xor esi, 0x7a094d1d
lea rbx, [rsp + 0x38]
nop
movsxd rcx, ecx
movzx eax, byte [rcx + r15]
xor byte [rcx + r14], al
mov rdx, rbx
mov r8d, edi
mov r9d, esi
call fcn.14021a600
mov ecx, dword [rsp + 0x38]
test al, 1
je 0x14021c4e0
mov al, 0x4d
xchg byte [0x1404ef220], al
lea rax, [0x1404ef200]
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14021fa40
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xe353e10
add eax, dword [0x1404f2060]
cmp ecx, eax
jne 0x14021fa7c
test edx, edx
je 0x14021faac
movzx eax, byte [0x1404f1e84]
cmp al, 0x3f
je 0x14021fa74
mov cl, 0x28
mov al, 0xc4
lock cmpxchg byte [0x1404f1e84], cl
je 0x14021fb2a
cmp al, 0x3f
jne 0x14021fa60
lea rax, [0x1404f1e70]
ret
test edx, edx
je 0x14021fadc
movzx eax, byte [0x1404f1e9d]
cmp al, 0x32
je 0x14021faa4
mov cl, 0x28
nop dword [rax]
mov al, 0x47
lock cmpxchg byte [0x1404f1e9d], cl
je 0x14021fb7f
cmp al, 0x32
jne 0x14021fa90
lea rax, [0x1404f1e90]
ret
movzx eax, byte [0x1404f1da2]
cmp al, 0xa8
je 0x14021fad4
mov cl, 0x91
nop dword [rax]
mov al, 0xb8
lock cmpxchg byte [0x1404f1da2], cl
je 0x14021fbb8
cmp al, 0xa8
jne 0x14021fac0
lea rax, [0x1404f1d90]
ret
movzx eax, byte [0x1404f1cd2]
cmp al, 0xa
je 0x14021fb22
nop word [rax + rax]
movzx ecx, byte [0x1404f2070]
lea eax, [rcx + 0x33]
add cl, 0x42
lock cmpxchg byte [0x1404f1cd2], cl
je 0x14021fc01
movzx ecx, byte [0x1404f2070]
mov edx, ecx
xor dl, 0xe8
and cl, 0x68
add cl, cl
add cl, dl
cmp al, cl
jne 0x14021faf0
lea rax, [0x1404f1cd0]
ret
xor edx, edx
lea rax, [0x1404f1e70]
lea rcx, [0x14040a1a0]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x14
jl 0x14021fb40
mov al, 0x3f
xchg byte [0x1404f1e84], al
lea rax, [0x1404f1e70]
ret
xor eax, eax
lea rcx, [0x1404f1e90]
lea rdx, [0x14040a1c0]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x14021fba8
inc rax
jmp 0x14021fb90
mov al, 0x32
xchg byte [0x1404f1e9d], al
lea rax, [0x1404f1e90]
ret
xor edx, edx
lea rax, [0x1404f1d90]
lea rcx, [0x14040a0c0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1404f2060]
add edx, r8d
add edx, 0xe353e11
cmp edx, 0x12
jl 0x14021fbd0
mov al, 0xa8
xchg byte [0x1404f1da2], al
lea rax, [0x1404f1d90]
ret
xor eax, eax
lea rcx, [0x1404f1cd0]
lea rdx, [0x14040a000]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x14021fc48
inc rax
jmp 0x14021fc20
mov al, 0xa
xchg byte [0x1404f1cd2], al
lea rax, [0x1404f1cd0]
ret