joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140239f00
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x6e99597f
add eax, dword [0x1405b88b0]
cmp ecx, eax
jne 0x140239fba
test edx, edx
je 0x140239fec
movzx eax, byte [0x1405b83f2]
nop word cs:[rax + rax]
cmp al, 0x4c
je 0x140239fb2
movzx ecx, byte [0x1405b88c0]
lea eax, [rcx + 0x32]
add cl, 0xe6
lock cmpxchg byte [0x1405b83f2], cl
jne 0x140239f30
xor r8d, r8d
lea rax, [0x1405b83f0]
lea rcx, [0x1404d2480]
mov edx, 0x6e995981
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [r8 + rax]
xor r10b, r9b
mov byte [r8 + rax], r10b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x1405b88b0]
add r9d, edx
cmp r8d, r9d
jl 0x140239f70
mov al, 0x4c
xchg byte [0x1405b83f2], al
lea rax, [0x1405b83f0]
ret
test edx, edx
je 0x14023a01c
movzx eax, byte [0x1405b8540]
cmp al, 0xae
je 0x140239fe4
mov cl, 0x90
nop dword [rax + rax]
mov al, 0xb4
lock cmpxchg byte [0x1405b8540], cl
je 0x14023a065
cmp al, 0xae
jne 0x140239fd0
lea rax, [0x1405b8530]
ret
movzx eax, byte [0x1405b8559]
cmp al, 0xe5
je 0x14023a014
mov cl, 0x7a
nop dword [rax]
mov al, 0x33
lock cmpxchg byte [0x1405b8559], cl
je 0x14023a0a8
cmp al, 0xe5
jne 0x14023a000
lea rax, [0x1405b8550]
ret
movzx eax, byte [0x1405b8576]
cmp al, 0xa6
je 0x14023a05d
mov cl, 0x74
nop dword [rax]
mov al, 0x5e
lock cmpxchg byte [0x1405b8576], cl
je 0x14023a111
movzx edx, byte [0x1405b88c0]
mov r8d, edx
xor r8b, 0x9f
and dl, 0x1f
add dl, dl
add dl, r8b
add dl, 0x1e
cmp al, dl
jne 0x14023a030
lea rax, [0x1405b8570]
ret
xor eax, eax
lea rcx, [0x1405b8530]
lea rdx, [0x1404d25a0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x14023a098
inc rax
jmp 0x14023a080
mov al, 0xae
xchg byte [0x1405b8540], al
lea rax, [0x1405b8530]
ret
xor edx, edx
lea rax, [0x1405b8550]
lea rcx, [0x1404d25b0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
mov r9d, r10d
xor r9b, r8b
and r8b, r10b
add r8b, r8b
add r8b, r9b
mov byte [rdx + rax], r8b
mov r8d, dword [0x1405b88b0]
add edx, r8d
add edx, 0x6e995980
cmp edx, 9
jl 0x14023a0c0
mov al, 0xe5
xchg byte [0x1405b8559], al
lea rax, [0x1405b8550]
ret
xor eax, eax
lea rcx, [0x1405b8570]
lea rdx, [0x1404d25d0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 5
jg 0x14023a15c
inc rax
jmp 0x14023a130
mov al, 0xa6
xchg byte [0x1405b8576], al
lea rax, [0x1405b8570]
ret
Function at 0x1402b6c10
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1402b6c67
test edx, edx
je 0x1402b6cac
movzx eax, byte [0x1405c5333]
movzx ecx, byte [0x1405c6bf4]
mov edx, ecx
xor dl, 0x3f
and cl, 0x3f
add cl, cl
add cl, dl
cmp al, cl
je 0x1402b6c5f
nop word [rax + rax]
movzx ecx, byte [0x1405c6bf4]
lea eax, [rcx - 0x1c]
add cl, 0x1a
lock cmpxchg byte [0x1405c5333], cl
je 0x1402b6d58
cmp al, 0xce
jne 0x1402b6c40
lea rax, [0x1405c5330]
ret
mov eax, 0xd62cbe65
add eax, dword [0x1405c6bf0]
cmp edx, eax
jne 0x1402b6d28
movzx eax, byte [0x1405c547d]
cmp al, 0x62
je 0x1402b6ca4
mov cl, 0x2a
nop word [rax + rax]
mov al, 0xa2
lock cmpxchg byte [0x1405c547d], cl
je 0x1402b6def
cmp al, 0x62
jne 0x1402b6c90
lea rax, [0x1405c5470]
ret
movzx eax, byte [0x1405c54fd]
nop word cs:[rax + rax]
cmp al, 0x69
je 0x1402b6d20
movzx ecx, byte [0x1405c6bf4]
lea eax, [rcx - 0x73]
add cl, 0x5f
lock cmpxchg byte [0x1405c54fd], cl
jne 0x1402b6cc0
xor edx, edx
lea rax, [0x1405c54f0]
lea rcx, [0x1404d7460]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1405c6bf0]
add edx, r8d
add edx, 0xd62cbe66
add r8d, 0xd62cbe72
cmp edx, r8d
jl 0x1402b6cf0
mov al, 0x69
xchg byte [0x1405c54fd], al
lea rax, [0x1405c54f0]
ret
cmp byte [0x1405c5469], 0
je 0x1402b6d50
mov cl, 0xaf
nop word cs:[rax + rax]
mov al, 0xa3
lock cmpxchg byte [0x1405c5469], cl
je 0x1402b6da1
test al, al
jne 0x1402b6d40
lea rax, [0x1405c5460]
ret
xor eax, eax
lea rcx, [0x1405c5330]
lea rdx, [0x1404d72b0]
mov r8d, 0xd62cbe68
nop
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405c6bf0]
add r10d, r8d
cmp r9d, r10d
jge 0x1402b6d91
inc rax
jmp 0x1402b6d70
mov al, 0xce
xchg byte [0x1405c5333], al
lea rax, [0x1405c5330]
ret
xor edx, edx
lea rax, [0x1405c5460]
lea rcx, [0x1404d73d0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 9
jl 0x1402b6dc0
xor eax, eax
xchg byte [0x1405c5469], al
lea rax, [0x1405c5460]
ret
xor eax, eax
lea rcx, [0x1405c5470]
lea rdx, [0x1404d73e0]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1402b6e18
inc rax
jmp 0x1402b6e00
movzx eax, byte [0x1405c6bf4]
add al, 0xd3
xchg byte [0x1405c547d], al
lea rax, [0x1405c5470]
ret
Function at 0x1402bcff0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
test ecx, ecx
je 0x1402bd029
test edx, edx
je 0x1402bd059
movzx eax, byte [0x1405c6e4f]
cmp al, 0x40
je 0x1402bd10b
mov cl, 0x88
nop dword [rax + rax]
mov al, 0x52
lock cmpxchg byte [0x1405c6e4f], cl
je 0x1402bd0b9
cmp al, 0x40
jne 0x1402bd010
jmp 0x1402bd10b
test edx, edx
je 0x1402bd089
movzx eax, byte [0x1405c6d60]
cmp al, 0xa5
je 0x1402bd191
mov cl, 0xa
nop
mov al, 0x1d
lock cmpxchg byte [0x1405c6d60], cl
je 0x1402bd117
cmp al, 0xa5
jne 0x1402bd040
jmp 0x1402bd191
movzx eax, byte [0x1405c6ce2]
cmp al, 0x82
je 0x1402bd1a5
mov cl, 0xc8
nop word [rax + rax]
mov al, 0x28
lock cmpxchg byte [0x1405c6ce2], cl
je 0x1402bd148
cmp al, 0x82
jne 0x1402bd070
jmp 0x1402bd1a5
movzx eax, byte [0x1405c6d73]
cmp al, 0x58
je 0x1402bd243
mov ecx, dword [rsp + 0x38]
mov dl, 0x1f
nop
mov al, 0xe5
lock cmpxchg byte [0x1405c6d73], dl
je 0x1402bd1b1
cmp al, 0x58
jne 0x1402bd0a0
jmp 0x1402bd243
xor edx, edx
lea rax, [0x1405c6e40]
lea rcx, [0x1404d77e0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x1402bd0d0
mov al, 0x40
xchg byte [0x1405c6e4f], al
lea rax, [0x1405c6e40]
jmp 0x1402bd24a
xor eax, eax
lea rcx, [0x1405c6d50]
lea rdx, [0x1404d7700]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1402bd189
inc rax
jmp 0x1402bd130
xor eax, eax
lea rcx, [0x1405c6cd0]
lea rdx, [0x1404d7690]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
or r9b, r8b
and r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x1402bd19d
inc rax
jmp 0x1402bd160
mov al, 0xa5
xchg byte [0x1405c6d60], al
lea rax, [0x1405c6d50]
jmp 0x1402bd24a
mov al, 0x82
xchg byte [0x1405c6ce2], al
lea rax, [0x1405c6cd0]
jmp 0x1402bd24a
xor r9d, r9d
lea rax, [0x1405c6d70]
lea rdx, [0x1404d7710]
mov r8d, ecx
xor r8d, 0xc8f4f7bd
xor ecx, 0x370b0842
nop word cs:[rax + rax]
movsxd r9, r9d
movzx r10d, byte [r9 + rdx]
add byte [r9 + rax], r10b
mov r10d, dword [0x1405c7290]
mov r11d, r10d
not r11d
mov esi, ecx
and esi, r10d
mov edi, r8d
and edi, r11d
or edi, esi
xor r10d, r8d
and r11d, ecx
or r11d, r10d
not r11d
lea r10d, [rdi + r11*2]
add r9d, r10d
add r9d, 0x70cd8078
mov r10d, r9d
xor r10d, 0x8f327f88
and r9d, 0xf327f88
lea r9d, [r10 + r9*2]
cmp r9d, 3
jl 0x1402bd1e0
mov al, 0x58
xchg byte [0x1405c6d73], al
lea rax, [0x1405c6d70]
pop rdi
pop rsi
ret
Function at 0x1402c82a0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1402c82dc
test edx, edx
je 0x1402c830c
movzx eax, byte [0x1405c8cf6]
cmp al, 0x95
je 0x1402c82d4
mov cl, 0x76
nop word cs:[rax + rax]
mov al, 0x1d
lock cmpxchg byte [0x1405c8cf6], cl
je 0x1402c83cc
cmp al, 0x95
jne 0x1402c82c0
lea rax, [0x1405c8ce0]
ret
test edx, edx
je 0x1402c834c
movzx eax, byte [0x1405c8db9]
cmp al, 0x82
je 0x1402c8304
mov cl, 0xa4
nop dword [rax]
mov al, 0xad
lock cmpxchg byte [0x1405c8db9], cl
je 0x1402c8431
cmp al, 0x82
jne 0x1402c82f0
lea rax, [0x1405c8db0]
ret
movzx eax, byte [0x1405c8b64]
movzx ecx, byte [0x1405c985c]
add cl, 0xd2
cmp al, cl
je 0x1402c8344
mov cl, 0xdd
nop word cs:[rax + rax]
mov al, 0x88
lock cmpxchg byte [0x1405c8b64], cl
je 0x1402c8478
cmp al, 0xb9
jne 0x1402c8330
lea rax, [0x1405c8b60]
ret
movzx eax, byte [0x1405c8bf5]
nop word cs:[rax + rax]
cmp al, 0x5d
je 0x1402c84ff
movzx ecx, byte [0x1405c985c]
mov edx, ecx
xor dl, 0x61
mov eax, ecx
and al, 0x61
add al, al
add al, dl
add al, 0xbc
add cl, 0x7a
lock cmpxchg byte [0x1405c8bf5], cl
jne 0x1402c8360
xor eax, eax
lea rcx, [0x1405c8be0]
lea rdx, [0x1404d7f80]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1402c84f7
inc rax
jmp 0x1402c83a0
xor edx, edx
lea rax, [0x1405c8ce0]
lea rcx, [0x1404d8060]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
not r8d
mov r9d, r8d
and r9d, 1
and r8d, 0x7ffffffe
mov r10d, edx
and r10d, 1
or r10d, r8d
and r10d, edx
xor edx, 0xfffffffe
or edx, r9d
not edx
or edx, r9d
lea edx, [rdx + r10*2]
cmp edx, 0x16
jl 0x1402c83e0
mov al, 0x95
xchg byte [0x1405c8cf6], al
lea rax, [0x1405c8ce0]
ret
xor eax, eax
lea rcx, [0x1405c8db0]
lea rdx, [0x1404d8130]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1402c84c5
inc rax
jmp 0x1402c8450
xor eax, eax
lea rcx, [0x1405c8b60]
lea rdx, [0x1404d7f10]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
not r10b
mov r11d, r8d
xor r11b, r10b
not r11b
and r11b, r9b
and r10b, r8b
or r10b, r11b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x1402c84d5
inc rax
jmp 0x1402c8490
mov al, 0x82
xchg byte [0x1405c8db9], al
lea rax, [0x1405c8db0]
ret
movzx eax, byte [0x1405c985c]
mov ecx, eax
xor cl, 0x50
and al, 0x50
add al, al
add al, cl
add al, 0x82
xchg byte [0x1405c8b64], al
lea rax, [0x1405c8b60]
ret
mov al, 0x5d
xchg byte [0x1405c8bf5], al
lea rax, [0x1405c8be0]
ret
Function at 0x14032a5b0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14032a601
test edx, edx
je 0x14032a63c
movzx eax, byte [0x1405d9753]
cmp al, 0xcb
je 0x14032a5f9
nop word [rax + rax]
movzx ecx, byte [0x1405d9848]
lea eax, [rcx + 0x76]
add cl, 0x21
lock cmpxchg byte [0x1405d9753], cl
je 0x14032a6b5
movzx ecx, byte [0x1405d9848]
add cl, 0xcf
cmp al, cl
jne 0x14032a5d0
lea rax, [0x1405d9730]
ret
test edx, edx
je 0x14032a66c
movzx eax, byte [0x1405d9717]
cmp al, 0xf7
je 0x14032a634
mov cl, 0xed
nop word cs:[rax + rax]
mov al, 0x43
lock cmpxchg byte [0x1405d9717], cl
je 0x14032a715
cmp al, 0xf7
jne 0x14032a620
lea rax, [0x1405d9710]
ret
movzx eax, byte [0x1405d976f]
cmp al, 0x26
je 0x14032a664
mov cl, 0x69
nop dword [rax]
mov al, 0x72
lock cmpxchg byte [0x1405d976f], cl
je 0x14032a748
cmp al, 0x26
jne 0x14032a650
lea rax, [0x1405d9760]
ret
movzx eax, byte [0x1405d9723]
cmp al, 0x1e
je 0x14032a6ad
mov cl, 0x5c
nop dword [rax]
mov al, 0xdc
lock cmpxchg byte [0x1405d9723], cl
je 0x14032a798
movzx edx, byte [0x1405d9848]
mov r8d, edx
xor r8b, 0x9b
and dl, 0x1b
add dl, dl
add dl, r8b
add dl, 0x87
cmp al, dl
jne 0x14032a680
lea rax, [0x1405d9720]
ret
xor eax, eax
lea rcx, [0x1405d9730]
lea rdx, [0x1404dfcc0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, r8b
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x14032a705
inc rax
jmp 0x14032a6d0
mov al, 0xcb
xchg byte [0x1405d9753], al
lea rax, [0x1405d9730]
ret
xor eax, eax
lea rcx, [0x1405d9710]
lea rdx, [0x1404dfca0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 6
jg 0x14032a778
inc rax
jmp 0x14032a730
xor eax, eax
lea rcx, [0x1405d9760]
lea rdx, [0x1404dfcf0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x14032a788
inc rax
jmp 0x14032a760
mov al, 0xf7
xchg byte [0x1405d9717], al
lea rax, [0x1405d9710]
ret
mov al, 0x26
xchg byte [0x1405d976f], al
lea rax, [0x1405d9760]
ret
xor edx, edx
lea rax, [0x1405d9720]
lea rcx, [0x1404dfcb0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0x6c31e0be
mov r8d, edx
xor r8d, 0x93ce1f43
and edx, 0x13ce1f43
lea edx, [r8 + rdx*2]
cmp edx, 3
jl 0x14032a7b0
mov al, 0x1e
xchg byte [0x1405d9723], al
lea rax, [0x1405d9720]
ret
Function at 0x1403aa5e0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403aa61c
test edx, edx
je 0x1403aa64c
movzx eax, byte [0x1405ee283]
cmp al, 0x51
je 0x1403aa614
mov cl, 0xa8
nop word cs:[rax + rax]
mov al, 0x80
lock cmpxchg byte [0x1405ee283], cl
je 0x1403aa6ac
cmp al, 0x51
jne 0x1403aa600
lea rax, [0x1405ee280]
ret
test edx, edx
je 0x1403aa67c
movzx eax, byte [0x1405ee56e]
cmp al, 0x20
je 0x1403aa644
mov cl, 0xff
nop dword [rax]
mov al, 0x38
lock cmpxchg byte [0x1405ee56e], cl
je 0x1403aa6f8
cmp al, 0x20
jne 0x1403aa630
lea rax, [0x1405ee560]
ret
movzx eax, byte [0x1405ee3a1]
cmp al, 0xd2
je 0x1403aa674
mov cl, 0x68
nop dword [rax]
mov al, 0x64
lock cmpxchg byte [0x1405ee3a1], cl
je 0x1403aa728
cmp al, 0xd2
jne 0x1403aa660
lea rax, [0x1405ee390]
ret
movzx eax, byte [0x1405ee405]
cmp al, 0x8c
je 0x1403aa6a4
mov cl, 3
nop dword [rax]
mov al, 0x30
lock cmpxchg byte [0x1405ee405], cl
je 0x1403aa791
cmp al, 0x8c
jne 0x1403aa690
lea rax, [0x1405ee3f0]
ret
xor eax, eax
lea rcx, [0x1405ee280]
lea rdx, [0x1404ed380]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1403aa6d8
inc rax
jmp 0x1403aa6c0
movzx eax, byte [0x1405eebb8]
mov ecx, eax
xor cl, 0xae
and al, 0x2e
add al, al
add al, cl
xchg byte [0x1405ee283], al
lea rax, [0x1405ee280]
ret
xor eax, eax
lea rcx, [0x1405ee560]
lea rdx, [0x1404ed630]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x1403aa781
inc rax
jmp 0x1403aa710
xor edx, edx
lea rax, [0x1405ee390]
lea rcx, [0x1404ed480]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x1405eeba8]
add edx, r8d
add edx, 0x75af529
cmp edx, 0x11
jl 0x1403aa740
mov al, 0xd2
xchg byte [0x1405ee3a1], al
lea rax, [0x1405ee390]
ret
mov al, 0x20
xchg byte [0x1405ee56e], al
lea rax, [0x1405ee560]
ret
xor eax, eax
lea rcx, [0x1405ee3f0]
lea rdx, [0x1404ed4e0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1403aa7c8
inc rax
jmp 0x1403aa7b0
movzx eax, byte [0x1405eebb8]
add al, 0xe9
xchg byte [0x1405ee405], al
lea rax, [0x1405ee3f0]
ret
Function at 0x1403aa7e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1405eeba8]
mov r8d, eax
xor r8d, 0x75af528
and eax, 0x75af528
lea eax, [r8 + rax*2]
cmp ecx, eax
jne 0x1403aa836
test edx, edx
je 0x1403aa86c
movzx eax, byte [0x1405ee273]
cmp al, 0xae
je 0x1403aa82e
mov cl, 0x32
nop
mov al, 0xd0
lock cmpxchg byte [0x1405ee273], cl
je 0x1403aa90c
movzx edx, byte [0x1405eebb8]
add dl, 0xb
cmp al, dl
jne 0x1403aa810
lea rax, [0x1405ee270]
ret
test edx, edx
je 0x1403aa8df
movzx eax, byte [0x1405ee499]
cmp al, 0x2b
je 0x1403aa864
mov cl, 0x53
nop dword [rax + rax]
mov al, 0x22
lock cmpxchg byte [0x1405ee499], cl
je 0x1403aa969
cmp al, 0x2b
jne 0x1403aa850
lea rax, [0x1405ee490]
ret
movzx eax, byte [0x1405ee523]
nop word cs:[rax + rax]
cmp al, 0x33
je 0x1403aa8d7
movzx ecx, byte [0x1405eebb8]
lea eax, [rcx + 0x29]
add cl, 0xee
lock cmpxchg byte [0x1405ee523], cl
jne 0x1403aa880
xor edx, edx
lea rax, [0x1405ee500]
lea rcx, [0x1404ed5d0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x23
jl 0x1403aa8b0
mov al, 0x33
xchg byte [0x1405ee523], al
lea rax, [0x1405ee500]
ret
movzx eax, byte [0x1405ee3e6]
cmp al, 0xb7
je 0x1403aa904
mov cl, 0xb1
nop dword [rax]
mov al, 0xa4
lock cmpxchg byte [0x1405ee3e6], cl
je 0x1403aa9b1
cmp al, 0xb7
jne 0x1403aa8f0
lea rax, [0x1405ee3d0]
ret
xor r8d, r8d
lea rax, [0x1405ee270]
lea rcx, [0x1404ed370]
mov edx, 0x75af529
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
add byte [r8 + rax], r9b
mov r9d, dword [0x1405eeba8]
add r9d, edx
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r8d, [r10 + r9*2]
cmp r8d, 3
jl 0x1403aa930
mov al, 0xae
xchg byte [0x1405ee273], al
lea rax, [0x1405ee270]
ret
xor eax, eax
lea rcx, [0x1405ee490]
lea rdx, [0x1404ed560]
mov r8d, 0x75af531
nop
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405eeba8]
add r10d, r8d
cmp r9d, r10d
jge 0x1403aa9a1
inc rax
jmp 0x1403aa980
mov al, 0x2b
xchg byte [0x1405ee499], al
lea rax, [0x1405ee490]
ret
xor edx, edx
lea rax, [0x1405ee3d0]
lea rcx, [0x1404ed4c0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x16
jl 0x1403aa9d0
mov al, 0xb7
xchg byte [0x1405ee3e6], al
lea rax, [0x1405ee3d0]
ret
Function at 0x1403ab080
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403ab0e3
test edx, edx
je 0x1403ab11c
movzx eax, byte [0x1405ee463]
cmp al, 0xd0
je 0x1403ab0db
mov cl, 0xe4
nop dword [rax]
mov al, 0xba
lock cmpxchg byte [0x1405ee463], cl
je 0x1403ab19c
movzx edx, byte [0x1405eebb8]
mov r8d, edx
xor r8b, 0x52
and r8b, dl
xor dl, 0x2d
add r8b, r8b
mov r9d, edx
xor r9b, r8b
and r8b, dl
add r8b, r8b
add r8b, r9b
cmp al, r8b
jne 0x1403ab0a0
lea rax, [0x1405ee460]
ret
test edx, edx
je 0x1403ab167
movzx eax, byte [0x1405ee419]
cmp al, 0xbc
je 0x1403ab114
mov cl, 0xd4
nop dword [rax + rax]
mov al, 0x3d
lock cmpxchg byte [0x1405ee419], cl
je 0x1403ab1ef
cmp al, 0xbc
jne 0x1403ab100
lea rax, [0x1405ee410]
ret
movzx eax, byte [0x1405ee2c2]
movzx ecx, byte [0x1405eebb8]
add cl, 0xc9
cmp al, cl
je 0x1403ab15f
nop word cs:[rax + rax]
movzx ecx, byte [0x1405eebb8]
lea eax, [rcx + 0x3f]
add cl, 0x99
lock cmpxchg byte [0x1405ee2c2], cl
je 0x1403ab249
cmp al, 0x6c
jne 0x1403ab140
lea rax, [0x1405ee2c0]
ret
movzx eax, byte [0x1405ee4e5]
cmp al, 0xd1
je 0x1403ab194
mov cl, 0xff
nop word cs:[rax + rax]
mov al, 0xa4
lock cmpxchg byte [0x1405ee4e5], cl
je 0x1403ab288
cmp al, 0xd1
jne 0x1403ab180
lea rax, [0x1405ee4e0]
ret
xor eax, eax
lea rcx, [0x1405ee460]
lea rdx, [0x1404ed540]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r8b
mov r10d, r8d
and r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1403ab1df
inc rax
jmp 0x1403ab1b0
mov al, 0xd0
xchg byte [0x1405ee463], al
lea rax, [0x1405ee460]
ret
xor eax, eax
lea rcx, [0x1405ee410]
lea rdx, [0x1404ed500]
nop
cdqe
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
mov r8d, dword [0x1405eeba8]
mov r9d, r8d
xor r9d, 0x75af529
mov r10d, r8d
and r10d, 0x75af529
lea r9d, [r9 + r10*2]
add eax, r9d
add r8d, 0x75af531
cmp eax, r8d
jl 0x1403ab200
mov al, 0xbc
xchg byte [0x1405ee419], al
lea rax, [0x1405ee410]
ret
xor eax, eax
lea rcx, [0x1405ee2c0]
lea rdx, [0x1404ed3c0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x1403ab278
inc rax
jmp 0x1403ab260
mov al, 0x6c
xchg byte [0x1405ee2c2], al
lea rax, [0x1405ee2c0]
ret
xor eax, eax
lea rcx, [0x1405ee4e0]
lea rdx, [0x1404ed5b0]
nop dword [rax + rax]
xor r8d, r8d
sub r8b, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
xor r10d, r10d
sub r10b, r9b
mov r9d, r8d
xor r9b, r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
neg r10b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x1403ab2d7
inc rax
jmp 0x1403ab2a0
mov al, 0xd1
xchg byte [0x1405ee4e5], al
lea rax, [0x1405ee4e0]
ret
Function at 0x1403ac500
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1403ac55c
test edx, edx
je 0x1403ac5dc
movzx eax, byte [0x1405ee4c3]
cmp al, 0x31
je 0x1403ac554
mov cl, 0xd
nop
mov al, 0x97
lock cmpxchg byte [0x1405ee4c3], cl
je 0x1403ac6db
mov edx, r8d
not dl
mov r9d, r8d
xor r9b, 0x8c
and dl, 0x73
or r9b, dl
not r9b
or r9b, dl
add r9b, byte [0x1405eebb8]
cmp al, r9b
jne 0x1403ac520
lea rax, [0x1405ee4c0]
ret
test edx, edx
je 0x1403ac60c
movzx eax, byte [0x1405ee55d]
nop dword [rax + rax]
cmp al, 0xe9
je 0x1403ac720
movzx ecx, byte [0x1405eebb8]
mov eax, r8d
xor al, 0x7e
add al, cl
mov edx, r8d
xor dl, 0xc9
add dl, cl
lock cmpxchg byte [0x1405ee55d], dl
jne 0x1403ac570
xor eax, eax
lea rcx, [0x1405ee550]
lea rdx, [0x1404ed620]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1403ac718
inc rax
jmp 0x1403ac5b0
movzx eax, byte [0x1405ee2ed]
cmp al, 6
je 0x1403ac604
mov cl, 0x39
nop dword [rax]
mov al, 0x43
lock cmpxchg byte [0x1405ee2ed], cl
je 0x1403ac728
cmp al, 6
jne 0x1403ac5f0
lea rax, [0x1405ee2d0]
ret
movzx eax, byte [0x1405ee4b8]
nop word cs:[rax + rax]
cmp al, 0xa9
je 0x1403ac6d3
movzx eax, byte [0x1405eebb8]
mov ecx, r8d
xor cl, al
xor cl, 0x71
mov edx, r8d
xor dl, 0xe
mov r9d, r8d
xor r9b, 0xf3
add r9b, al
not al
and al, dl
or al, cl
not al
add al, al
add al, cl
lock cmpxchg byte [0x1405ee4b8], r9b
jne 0x1403ac620
xor edx, edx
lea rax, [0x1405ee4a0]
lea rcx, [0x1404ed570]
nop
movsxd rdx, edx
xor r8d, r8d
sub r8b, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
xor r10d, r10d
sub r10b, r9b
mov r9d, r8d
xor r9b, r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
neg r10b
mov byte [rdx + rax], r10b
mov r8d, edx
not r8d
mov r9d, r8d
and r9d, 1
mov r10d, edx
and r10d, 0xfffffffe
or r10d, r9d
xor edx, 1
and r8d, 0x7ffffffe
or r8d, edx
not r8d
lea edx, [r10 + r8*2]
cmp edx, 0x18
jl 0x1403ac670
mov al, 0xa9
xchg byte [0x1405ee4b8], al
lea rax, [0x1405ee4a0]
ret
xor eax, eax
lea rcx, [0x1405ee4c0]
lea rdx, [0x1404ed590]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1403ac708
inc rax
jmp 0x1403ac6f0
mov al, 0x31
xchg byte [0x1405ee4c3], al
lea rax, [0x1405ee4c0]
ret
mov al, 0xe9
xchg byte [0x1405ee55d], al
lea rax, [0x1405ee550]
ret
xor eax, eax
lea rcx, [0x1405ee2d0]
lea rdx, [0x1404ed3d0]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
add r8b, 0xe5
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
add r8b, 0x1b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1c
jg 0x1403ac774
inc rax
jmp 0x1403ac740
mov al, 6
xchg byte [0x1405ee2ed], al
lea rax, [0x1405ee2d0]
ret