joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140277d00
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
mov r8d, dword [rsp + 0x38]
mov eax, r8d
xor eax, 0xc0b6c2c0
mov r9d, dword [0x140584e30]
add r9d, eax
cmp ecx, r9d
jne 0x140277d59
test edx, edx
je 0x140277dc9
movzx eax, byte [0x1405836dd]
cmp al, 0xf2
je 0x140277e35
mov cl, 8
nop word [rax + rax]
mov al, 0xba
lock cmpxchg byte [0x1405836dd], cl
je 0x140277df9
cmp al, 0xf2
jne 0x140277d40
jmp 0x140277e35
add eax, dword [0x140584e30]
cmp edx, eax
jne 0x140277d99
movzx eax, byte [0x140583721]
cmp al, 0xc9
je 0x140277efe
mov cl, 0x4a
nop word cs:[rax + rax]
mov al, 0x70
lock cmpxchg byte [0x140583721], cl
je 0x140277e41
cmp al, 0xc9
jne 0x140277d80
jmp 0x140277efe
movzx eax, byte [0x140583605]
cmp al, 0x4e
je 0x140277eed
mov cl, 0x33
nop word [rax + rax]
mov al, 0x65
lock cmpxchg byte [0x140583605], cl
je 0x140277e88
cmp al, 0x4e
jne 0x140277db0
jmp 0x140277eed
movzx eax, byte [0x1405837cd]
cmp al, 0xc9
je 0x140277f54
mov cl, 0x78
nop word [rax + rax]
mov al, 0xfc
lock cmpxchg byte [0x1405837cd], cl
je 0x140277f07
cmp al, 0xc9
jne 0x140277de0
jmp 0x140277f54
xor eax, eax
lea rcx, [0x1405836d0]
lea rdx, [0x1404963c0]
xor r8d, 0xc0b6c2c3
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x140584e30]
add r9d, r8d
add eax, r9d
cmp eax, 0xd
jl 0x140277e10
mov al, 0xf2
xchg byte [0x1405836dd], al
lea rax, [0x1405836d0]
jmp 0x140277f5b
xor eax, eax
lea rcx, [0x140583710]
lea rdx, [0x140496400]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x140277ef6
inc rax
jmp 0x140277e60
xor eax, eax
lea rcx, [0x1405835f0]
lea rdx, [0x1404962e0]
mov r9d, r8d
xor r9d, 0xc0b6c2c3
mov r10d, r8d
xor r10d, 0xc0b6c2df
nop dword [rax]
cdqe
movzx r11d, byte [rax + rdx]
xor byte [rax + rcx], r11b
mov r11d, dword [0x140584e30]
mov esi, r9d
xor esi, r11d
mov edi, r9d
and edi, r11d
lea esi, [rsi + rdi*2]
add eax, esi
add r11d, r10d
cmp eax, r11d
jl 0x140277eb0
xor r8b, 0x1a
add r8b, byte [0x140584e34]
xchg byte [0x140583605], r8b
lea rax, [0x1405835f0]
jmp 0x140277f5b
mov al, 0xc9
xchg byte [0x140583721], al
lea rax, [0x140583710]
jmp 0x140277f5b
xor eax, eax
lea rcx, [0x1405837c0]
lea rdx, [0x1404964b0]
nop word [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140277f4c
inc rax
jmp 0x140277f20
mov al, 0xc9
xchg byte [0x1405837cd], al
lea rax, [0x1405837c0]
pop rdi
pop rsi
ret
Function at 0x14027c700
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
test ecx, ecx
je 0x14027c739
test edx, edx
je 0x14027c769
movzx eax, byte [0x14058508f]
cmp al, 0x40
je 0x14027c81b
mov cl, 0x88
nop dword [rax + rax]
mov al, 0x52
lock cmpxchg byte [0x14058508f], cl
je 0x14027c7c9
cmp al, 0x40
jne 0x14027c720
jmp 0x14027c81b
test edx, edx
je 0x14027c799
movzx eax, byte [0x140584fa0]
cmp al, 0xa5
je 0x14027c8a1
mov cl, 0xa
nop
mov al, 0x1d
lock cmpxchg byte [0x140584fa0], cl
je 0x14027c827
cmp al, 0xa5
jne 0x14027c750
jmp 0x14027c8a1
movzx eax, byte [0x140584f22]
cmp al, 0x82
je 0x14027c8b5
mov cl, 0xc8
nop word [rax + rax]
mov al, 0x28
lock cmpxchg byte [0x140584f22], cl
je 0x14027c858
cmp al, 0x82
jne 0x14027c780
jmp 0x14027c8b5
movzx eax, byte [0x140584fb3]
cmp al, 0x58
je 0x14027c953
mov ecx, dword [rsp + 0x38]
mov dl, 0x1f
nop
mov al, 0xe5
lock cmpxchg byte [0x140584fb3], dl
je 0x14027c8c1
cmp al, 0x58
jne 0x14027c7b0
jmp 0x14027c953
xor edx, edx
lea rax, [0x140585080]
lea rcx, [0x1404967a0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x14027c7e0
mov al, 0x40
xchg byte [0x14058508f], al
lea rax, [0x140585080]
jmp 0x14027c95a
xor eax, eax
lea rcx, [0x140584f90]
lea rdx, [0x1404966c0]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x14027c899
inc rax
jmp 0x14027c840
xor eax, eax
lea rcx, [0x140584f10]
lea rdx, [0x140496650]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
or r9b, r8b
and r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x14027c8ad
inc rax
jmp 0x14027c870
mov al, 0xa5
xchg byte [0x140584fa0], al
lea rax, [0x140584f90]
jmp 0x14027c95a
mov al, 0x82
xchg byte [0x140584f22], al
lea rax, [0x140584f10]
jmp 0x14027c95a
xor r9d, r9d
lea rax, [0x140584fb0]
lea rdx, [0x1404966d0]
mov r8d, ecx
xor r8d, 0xc8f4f7bd
xor ecx, 0x370b0842
nop word cs:[rax + rax]
movsxd r9, r9d
movzx r10d, byte [r9 + rdx]
add byte [r9 + rax], r10b
mov r10d, dword [0x1405854d0]
mov r11d, r10d
not r11d
mov esi, ecx
and esi, r10d
mov edi, r8d
and edi, r11d
or edi, esi
xor r10d, r8d
and r11d, ecx
or r11d, r10d
not r11d
lea r10d, [rdi + r11*2]
add r9d, r10d
add r9d, 0x70cd8078
mov r10d, r9d
xor r10d, 0x8f327f88
and r9d, 0xf327f88
lea r9d, [r10 + r9*2]
cmp r9d, 3
jl 0x14027c8f0
mov al, 0x58
xchg byte [0x140584fb3], al
lea rax, [0x140584fb0]
pop rdi
pop rsi
ret
Function at 0x1402879b0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1402879ec
test edx, edx
je 0x140287a1c
movzx eax, byte [0x140586f36]
cmp al, 0x95
je 0x1402879e4
mov cl, 0x76
nop word cs:[rax + rax]
mov al, 0x1d
lock cmpxchg byte [0x140586f36], cl
je 0x140287adc
cmp al, 0x95
jne 0x1402879d0
lea rax, [0x140586f20]
ret
test edx, edx
je 0x140287a5c
movzx eax, byte [0x140586ff9]
cmp al, 0x82
je 0x140287a14
mov cl, 0xa4
nop dword [rax]
mov al, 0xad
lock cmpxchg byte [0x140586ff9], cl
je 0x140287b41
cmp al, 0x82
jne 0x140287a00
lea rax, [0x140586ff0]
ret
movzx eax, byte [0x140586da4]
movzx ecx, byte [0x140587a9c]
add cl, 0xd2
cmp al, cl
je 0x140287a54
mov cl, 0xdd
nop word cs:[rax + rax]
mov al, 0x88
lock cmpxchg byte [0x140586da4], cl
je 0x140287b88
cmp al, 0xb9
jne 0x140287a40
lea rax, [0x140586da0]
ret
movzx eax, byte [0x140586e35]
nop word cs:[rax + rax]
cmp al, 0x5d
je 0x140287c0f
movzx ecx, byte [0x140587a9c]
mov edx, ecx
xor dl, 0x61
mov eax, ecx
and al, 0x61
add al, al
add al, dl
add al, 0xbc
add cl, 0x7a
lock cmpxchg byte [0x140586e35], cl
jne 0x140287a70
xor eax, eax
lea rcx, [0x140586e20]
lea rdx, [0x140496f40]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140287c07
inc rax
jmp 0x140287ab0
xor edx, edx
lea rax, [0x140586f20]
lea rcx, [0x140497020]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
not r8d
mov r9d, r8d
and r9d, 1
and r8d, 0x7ffffffe
mov r10d, edx
and r10d, 1
or r10d, r8d
and r10d, edx
xor edx, 0xfffffffe
or edx, r9d
not edx
or edx, r9d
lea edx, [rdx + r10*2]
cmp edx, 0x16
jl 0x140287af0
mov al, 0x95
xchg byte [0x140586f36], al
lea rax, [0x140586f20]
ret
xor eax, eax
lea rcx, [0x140586ff0]
lea rdx, [0x1404970f0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x140287bd5
inc rax
jmp 0x140287b60
xor eax, eax
lea rcx, [0x140586da0]
lea rdx, [0x140496ed0]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
not r10b
mov r11d, r8d
xor r11b, r10b
not r11b
and r11b, r9b
and r10b, r8b
or r10b, r11b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x140287be5
inc rax
jmp 0x140287ba0
mov al, 0x82
xchg byte [0x140586ff9], al
lea rax, [0x140586ff0]
ret
movzx eax, byte [0x140587a9c]
mov ecx, eax
xor cl, 0x50
and al, 0x50
add al, al
add al, cl
add al, 0x82
xchg byte [0x140586da4], al
lea rax, [0x140586da0]
ret
mov al, 0x5d
xchg byte [0x140586e35], al
lea rax, [0x140586e20]
ret
Function at 0x140287df0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140287e7f
test edx, edx
je 0x140287ebc
movzx eax, byte [0x140586e70]
nop word [rax + rax]
cmp al, 0xb6
je 0x140287e77
movzx ecx, byte [0x140587a9c]
lea eax, [rcx - 8]
mov edx, ecx
xor dl, 0xb1
and cl, 0x31
add cl, cl
add cl, dl
lock cmpxchg byte [0x140586e70], cl
jne 0x140287e10
xor edx, edx
lea rax, [0x140586e60]
lea rcx, [0x140496f80]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x140287e50
mov al, 0xb6
xchg byte [0x140586e70], al
lea rax, [0x140586e60]
ret
mov eax, 0x5875d356
add eax, dword [0x140587a98]
cmp edx, eax
jne 0x140287ee8
movzx eax, byte [0x140586d02]
cmp al, 0x19
je 0x140287eb4
mov cl, 0x82
nop dword [rax + rax]
mov al, 0xdd
lock cmpxchg byte [0x140586d02], cl
je 0x140287f79
cmp al, 0x19
jne 0x140287ea0
lea rax, [0x140586d00]
ret
movzx eax, byte [0x14058702d]
cmp al, 0x1d
je 0x140287ee0
mov cl, 0x4b
nop dword [rax]
mov al, 0xc2
lock cmpxchg byte [0x14058702d], cl
je 0x140287f26
cmp al, 0x1d
jne 0x140287ed0
lea rax, [0x140587020]
ret
movzx eax, byte [0x140586ee8]
cmp al, 0x1c
je 0x140287f1e
mov cl, 0x3a
nop word cs:[rax + rax]
mov al, 0x68
lock cmpxchg byte [0x140586ee8], cl
je 0x140287fc1
movzx edx, byte [0x140587a9c]
add dl, 0x35
cmp al, dl
jne 0x140287f00
lea rax, [0x140586ed0]
ret
xor edx, edx
lea rax, [0x140587020]
lea rcx, [0x140497120]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
not edx
and edx, 0x7ffffffe
or edx, r8d
not edx
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x140287f40
mov al, 0x1d
xchg byte [0x14058702d], al
lea rax, [0x140587020]
ret
xor eax, eax
lea rcx, [0x140586d00]
lea rdx, [0x140496e50]
nop dword [rax]
movzx r8d, byte [rax + rcx]
mov r9d, r8d
xor r9b, 0x60
and r8b, 0x60
add r8b, r8b
add r8b, r9b
add r8b, byte [rax + rdx]
add r8b, 0xa0
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x140288026
inc rax
jmp 0x140287f90
xor edx, edx
lea rax, [0x140586ed0]
lea rcx, [0x140496fd0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
xor r9b, r8b
mov r10d, r9d
not r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
mov byte [rdx + rax], r10b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x18
jl 0x140287fe0
mov al, 0x1c
xchg byte [0x140586ee8], al
lea rax, [0x140586ed0]
ret
mov al, 0x19
xchg byte [0x140586d02], al
lea rax, [0x140586d00]
ret
Function at 0x1402ddc70
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movdqa xmmword [rsp + 0x20], xmm6
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
setne cl
sete dl
test rsi, rsi
setne al
xor cl, al
xor al, dl
and al, dl
or al, cl
test r8, r8
setne cl
cmp al, cl
je 0x1402dde68
xor al, 1
je 0x1402dde68
mov rbx, r8
mov eax, 0xe899c04d
add eax, dword [rdi + 0xc]
mov ecx, eax
xor ecx, ebx
and eax, ebx
lea eax, [rcx + rax*2]
add eax, 0x17663fb3
mov dword [rdi + 0xc], eax
cmp eax, ebx
jae 0x1402ddcd8
inc dword [rdi + 8]
mov rax, qword [rdi]
mov r15d, 0x40
sub r15, rax
cmp r15, rbx
cmovae r15, rbx
lea rcx, [rdi + rax]
add rcx, 0x30
mov rdx, rsi
mov r8, r15
call fcn.14046c800
mov rax, qword [rdi]
add rax, r15
mov qword [rdi], rax
movabs rcx, 0x306a2d48c4f1c6da
add rcx, qword [0x140596b28]
cmp rax, rcx
jne 0x1402dde68
lea r14, [rdi + 0x30]
add rsi, r15
sub rbx, r15
pxor xmm6, xmm6
mov ebp, 0xb443
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rdi + 0x30]
movdqu xmm2, xmmword [rdi + 0x40]
movdqu xmm3, xmmword [rdi + 0x50]
movdqu xmm0, xmmword [rdi + 0x60]
movdqa xmm4, xmm1
punpckhbw xmm4, xmm6
pshuflw xmm4, xmm4, 0x1b
pshufhw xmm4, xmm4, 0x1b
punpcklbw xmm1, xmm6
pshuflw xmm1, xmm1, 0x1b
pshufhw xmm1, xmm1, 0x1b
packuswb xmm1, xmm4
movdqu xmmword [rdi + 0x30], xmm1
movdqa xmm1, xmm2
punpckhbw xmm1, xmm6
pshuflw xmm1, xmm1, 0x1b
pshufhw xmm1, xmm1, 0x1b
punpcklbw xmm2, xmm6
pshuflw xmm2, xmm2, 0x1b
pshufhw xmm2, xmm2, 0x1b
packuswb xmm2, xmm1
movdqu xmmword [rdi + 0x40], xmm2
movdqa xmm1, xmm3
punpckhbw xmm1, xmm6
pshuflw xmm1, xmm1, 0x1b
pshufhw xmm1, xmm1, 0x1b
punpcklbw xmm3, xmm6
pshuflw xmm2, xmm3, 0x1b
pshufhw xmm2, xmm2, 0x1b
packuswb xmm2, xmm1
movdqu xmmword [rdi + 0x50], xmm2
movdqa xmm1, xmm0
punpckhbw xmm1, xmm6
pshuflw xmm1, xmm1, 0x1b
pshufhw xmm1, xmm1, 0x1b
punpcklbw xmm0, xmm6
pshuflw xmm0, xmm0, 0x1b
pshufhw xmm0, xmm0, 0x1b
packuswb xmm0, xmm1
movdqu xmmword [rdi + 0x60], xmm0
mov eax, dword [0x140596b10]
add eax, ebp
cdqe
add rax, qword [0x140596b20]
mov rcx, rdi
mov edx, 0xccd31dd6
mov r8d, 0xdbf383fa
call qword [case.0x14012b313.0]
cmp rbx, 0x40
mov r15d, 0x40
cmovb r15, rbx
mov rcx, r14
mov rdx, rsi
mov r8, r15
call fcn.14046c800
mov qword [rdi], r15
add rsi, r15
neg r15
mov rax, rbx
xor rax, r15
and r15, rbx
add r15, r15
mov rcx, rax
xor rcx, r15
and r15, rax
lea rax, [rcx + r15*2]
cmp rbx, 0x3f
mov rbx, rax
ja 0x1402ddd40
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1402e9cc0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1402e9d11
test edx, edx
je 0x1402e9d4c
movzx eax, byte [0x140597993]
cmp al, 0xcb
je 0x1402e9d09
nop word [rax + rax]
movzx ecx, byte [0x140597a88]
lea eax, [rcx + 0x76]
add cl, 0x21
lock cmpxchg byte [0x140597993], cl
je 0x1402e9dc5
movzx ecx, byte [0x140597a88]
add cl, 0xcf
cmp al, cl
jne 0x1402e9ce0
lea rax, [0x140597970]
ret
test edx, edx
je 0x1402e9d7c
movzx eax, byte [0x140597957]
cmp al, 0xf7
je 0x1402e9d44
mov cl, 0xed
nop word cs:[rax + rax]
mov al, 0x43
lock cmpxchg byte [0x140597957], cl
je 0x1402e9e25
cmp al, 0xf7
jne 0x1402e9d30
lea rax, [0x140597950]
ret
movzx eax, byte [0x1405979af]
cmp al, 0x26
je 0x1402e9d74
mov cl, 0x69
nop dword [rax]
mov al, 0x72
lock cmpxchg byte [0x1405979af], cl
je 0x1402e9e58
cmp al, 0x26
jne 0x1402e9d60
lea rax, [0x1405979a0]
ret
movzx eax, byte [0x140597963]
cmp al, 0x1e
je 0x1402e9dbd
mov cl, 0x5c
nop dword [rax]
mov al, 0xdc
lock cmpxchg byte [0x140597963], cl
je 0x1402e9ea8
movzx edx, byte [0x140597a88]
mov r8d, edx
xor r8b, 0x9b
and dl, 0x1b
add dl, dl
add dl, r8b
add dl, 0x87
cmp al, dl
jne 0x1402e9d90
lea rax, [0x140597960]
ret
xor eax, eax
lea rcx, [0x140597970]
lea rdx, [0x14049ec70]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, r8b
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x1402e9e15
inc rax
jmp 0x1402e9de0
mov al, 0xcb
xchg byte [0x140597993], al
lea rax, [0x140597970]
ret
xor eax, eax
lea rcx, [0x140597950]
lea rdx, [0x14049ec50]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 6
jg 0x1402e9e88
inc rax
jmp 0x1402e9e40
xor eax, eax
lea rcx, [0x1405979a0]
lea rdx, [0x14049eca0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1402e9e98
inc rax
jmp 0x1402e9e70
mov al, 0xf7
xchg byte [0x140597957], al
lea rax, [0x140597950]
ret
mov al, 0x26
xchg byte [0x1405979af], al
lea rax, [0x1405979a0]
ret
xor edx, edx
lea rax, [0x140597960]
lea rcx, [0x14049ec60]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0x6c31e0be
mov r8d, edx
xor r8d, 0x93ce1f43
and edx, 0x13ce1f43
lea edx, [r8 + rdx*2]
cmp edx, 3
jl 0x1402e9ec0
mov al, 0x1e
xchg byte [0x140597963], al
lea rax, [0x140597960]
ret
Function at 0x140374ad0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140374b0c
test edx, edx
je 0x140374b3c
movzx eax, byte [0x1405ae353]
cmp al, 0x51
je 0x140374b04
mov cl, 0xa8
nop word cs:[rax + rax]
mov al, 0x80
lock cmpxchg byte [0x1405ae353], cl
je 0x140374b9c
cmp al, 0x51
jne 0x140374af0
lea rax, [0x1405ae350]
ret
test edx, edx
je 0x140374b6c
movzx eax, byte [0x1405ae63e]
cmp al, 0x20
je 0x140374b34
mov cl, 0xff
nop dword [rax]
mov al, 0x38
lock cmpxchg byte [0x1405ae63e], cl
je 0x140374be8
cmp al, 0x20
jne 0x140374b20
lea rax, [0x1405ae630]
ret
movzx eax, byte [0x1405ae471]
cmp al, 0xd2
je 0x140374b64
mov cl, 0x68
nop dword [rax]
mov al, 0x64
lock cmpxchg byte [0x1405ae471], cl
je 0x140374c18
cmp al, 0xd2
jne 0x140374b50
lea rax, [0x1405ae460]
ret
movzx eax, byte [0x1405ae4d5]
cmp al, 0x8c
je 0x140374b94
mov cl, 3
nop dword [rax]
mov al, 0x30
lock cmpxchg byte [0x1405ae4d5], cl
je 0x140374c81
cmp al, 0x8c
jne 0x140374b80
lea rax, [0x1405ae4c0]
ret
xor eax, eax
lea rcx, [0x1405ae350]
lea rdx, [0x1404ac3f0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x140374bc8
inc rax
jmp 0x140374bb0
movzx eax, byte [0x1405aec88]
mov ecx, eax
xor cl, 0xae
and al, 0x2e
add al, al
add al, cl
xchg byte [0x1405ae353], al
lea rax, [0x1405ae350]
ret
xor eax, eax
lea rcx, [0x1405ae630]
lea rdx, [0x1404ac6a0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x140374c71
inc rax
jmp 0x140374c00
xor edx, edx
lea rax, [0x1405ae460]
lea rcx, [0x1404ac4f0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x1405aec78]
add edx, r8d
add edx, 0x75af529
cmp edx, 0x11
jl 0x140374c30
mov al, 0xd2
xchg byte [0x1405ae471], al
lea rax, [0x1405ae460]
ret
mov al, 0x20
xchg byte [0x1405ae63e], al
lea rax, [0x1405ae630]
ret
xor eax, eax
lea rcx, [0x1405ae4c0]
lea rdx, [0x1404ac550]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140374cb8
inc rax
jmp 0x140374ca0
movzx eax, byte [0x1405aec88]
add al, 0xe9
xchg byte [0x1405ae4d5], al
lea rax, [0x1405ae4c0]
ret
Function at 0x140374cd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1405aec78]
mov r8d, eax
xor r8d, 0x75af528
and eax, 0x75af528
lea eax, [r8 + rax*2]
cmp ecx, eax
jne 0x140374d26
test edx, edx
je 0x140374d5c
movzx eax, byte [0x1405ae343]
cmp al, 0xae
je 0x140374d1e
mov cl, 0x32
nop
mov al, 0xd0
lock cmpxchg byte [0x1405ae343], cl
je 0x140374dfc
movzx edx, byte [0x1405aec88]
add dl, 0xb
cmp al, dl
jne 0x140374d00
lea rax, [0x1405ae340]
ret
test edx, edx
je 0x140374dcf
movzx eax, byte [0x1405ae569]
cmp al, 0x2b
je 0x140374d54
mov cl, 0x53
nop dword [rax + rax]
mov al, 0x22
lock cmpxchg byte [0x1405ae569], cl
je 0x140374e59
cmp al, 0x2b
jne 0x140374d40
lea rax, [0x1405ae560]
ret
movzx eax, byte [0x1405ae5f3]
nop word cs:[rax + rax]
cmp al, 0x33
je 0x140374dc7
movzx ecx, byte [0x1405aec88]
lea eax, [rcx + 0x29]
add cl, 0xee
lock cmpxchg byte [0x1405ae5f3], cl
jne 0x140374d70
xor edx, edx
lea rax, [0x1405ae5d0]
lea rcx, [0x1404ac640]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x23
jl 0x140374da0
mov al, 0x33
xchg byte [0x1405ae5f3], al
lea rax, [0x1405ae5d0]
ret
movzx eax, byte [0x1405ae4b6]
cmp al, 0xb7
je 0x140374df4
mov cl, 0xb1
nop dword [rax]
mov al, 0xa4
lock cmpxchg byte [0x1405ae4b6], cl
je 0x140374ea1
cmp al, 0xb7
jne 0x140374de0
lea rax, [0x1405ae4a0]
ret
xor r8d, r8d
lea rax, [0x1405ae340]
lea rcx, [0x1404ac3e0]
mov edx, 0x75af529
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
add byte [r8 + rax], r9b
mov r9d, dword [0x1405aec78]
add r9d, edx
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r8d, [r10 + r9*2]
cmp r8d, 3
jl 0x140374e20
mov al, 0xae
xchg byte [0x1405ae343], al
lea rax, [0x1405ae340]
ret
xor eax, eax
lea rcx, [0x1405ae560]
lea rdx, [0x1404ac5d0]
mov r8d, 0x75af531
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405aec78]
add r10d, r8d
cmp r9d, r10d
jge 0x140374e91
inc rax
jmp 0x140374e70
mov al, 0x2b
xchg byte [0x1405ae569], al
lea rax, [0x1405ae560]
ret
xor edx, edx
lea rax, [0x1405ae4a0]
lea rcx, [0x1404ac530]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x16
jl 0x140374ec0
mov al, 0xb7
xchg byte [0x1405ae4b6], al
lea rax, [0x1405ae4a0]
ret
Function at 0x140375570
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403755d3
test edx, edx
je 0x14037560c
movzx eax, byte [0x1405ae533]
cmp al, 0xd0
je 0x1403755cb
mov cl, 0xe4
nop dword [rax]
mov al, 0xba
lock cmpxchg byte [0x1405ae533], cl
je 0x14037568c
movzx edx, byte [0x1405aec88]
mov r8d, edx
xor r8b, 0x52
and r8b, dl
xor dl, 0x2d
add r8b, r8b
mov r9d, edx
xor r9b, r8b
and r8b, dl
add r8b, r8b
add r8b, r9b
cmp al, r8b
jne 0x140375590
lea rax, [0x1405ae530]
ret
test edx, edx
je 0x140375657
movzx eax, byte [0x1405ae4e9]
cmp al, 0xbc
je 0x140375604
mov cl, 0xd4
nop dword [rax + rax]
mov al, 0x3d
lock cmpxchg byte [0x1405ae4e9], cl
je 0x1403756df
cmp al, 0xbc
jne 0x1403755f0
lea rax, [0x1405ae4e0]
ret
movzx eax, byte [0x1405ae392]
movzx ecx, byte [0x1405aec88]
add cl, 0xc9
cmp al, cl
je 0x14037564f
nop word cs:[rax + rax]
movzx ecx, byte [0x1405aec88]
lea eax, [rcx + 0x3f]
add cl, 0x99
lock cmpxchg byte [0x1405ae392], cl
je 0x140375739
cmp al, 0x6c
jne 0x140375630
lea rax, [0x1405ae390]
ret
movzx eax, byte [0x1405ae5b5]
cmp al, 0xd1
je 0x140375684
mov cl, 0xff
nop word cs:[rax + rax]
mov al, 0xa4
lock cmpxchg byte [0x1405ae5b5], cl
je 0x140375778
cmp al, 0xd1
jne 0x140375670
lea rax, [0x1405ae5b0]
ret
xor eax, eax
lea rcx, [0x1405ae530]
lea rdx, [0x1404ac5b0]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r8b
mov r10d, r8d
and r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1403756cf
inc rax
jmp 0x1403756a0
mov al, 0xd0
xchg byte [0x1405ae533], al
lea rax, [0x1405ae530]
ret
xor eax, eax
lea rcx, [0x1405ae4e0]
lea rdx, [0x1404ac570]
nop
cdqe
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
mov r8d, dword [0x1405aec78]
mov r9d, r8d
xor r9d, 0x75af529
mov r10d, r8d
and r10d, 0x75af529
lea r9d, [r9 + r10*2]
add eax, r9d
add r8d, 0x75af531
cmp eax, r8d
jl 0x1403756f0
mov al, 0xbc
xchg byte [0x1405ae4e9], al
lea rax, [0x1405ae4e0]
ret
xor eax, eax
lea rcx, [0x1405ae390]
lea rdx, [0x1404ac430]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x140375768
inc rax
jmp 0x140375750
mov al, 0x6c
xchg byte [0x1405ae392], al
lea rax, [0x1405ae390]
ret
xor eax, eax
lea rcx, [0x1405ae5b0]
lea rdx, [0x1404ac620]
nop dword [rax + rax]
xor r8d, r8d
sub r8b, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
xor r10d, r10d
sub r10b, r9b
mov r9d, r8d
xor r9b, r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
neg r10b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x1403757c7
inc rax
jmp 0x140375790
mov al, 0xd1
xchg byte [0x1405ae5b5], al
lea rax, [0x1405ae5b0]
ret