joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140141c80
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa5c3331b
add eax, dword [0x14053d584]
cmp ecx, eax
jne 0x140141cec
test edx, edx
je 0x140141d7a
movzx eax, byte [0x14053bff5]
nop
cmp al, 0x13
je 0x140141e0a
movzx ecx, byte [0x14053d580]
lea eax, [rcx + 0x52]
add cl, 0x46
lock cmpxchg byte [0x14053bff5], cl
jne 0x140141ca0
xor eax, eax
lea rcx, [0x14053bff0]
lea rdx, [0x140467110]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 4
jg 0x140141df2
inc rax
jmp 0x140141cd0
test edx, edx
je 0x140141da8
movzx eax, byte [0x14053c13d]
nop dword [rax + rax]
cmp al, 0x2a
je 0x140141d72
movzx ecx, byte [0x14053d580]
lea eax, [rcx + 0x59]
mov edx, eax
xor dl, 0xb1
and al, 0x31
add al, al
add al, dl
add cl, 0xa4
lock cmpxchg byte [0x14053c13d], cl
jne 0x140141d00
xor r8d, r8d
lea rax, [0x14053c130]
lea rcx, [0x140467240]
mov edx, 0xa5c33328
nop dword [rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
add byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x14053d584]
add r9d, edx
cmp r8d, r9d
jl 0x140141d40
mov al, 0x2a
xchg byte [0x14053c13d], al
lea rax, [0x14053c130]
ret
movzx eax, byte [0x14053c0fd]
cmp al, 3
je 0x140141da0
mov cl, 0x2e
nop word [rax + rax]
mov al, 0x1f
lock cmpxchg byte [0x14053c0fd], cl
je 0x140141e12
cmp al, 3
jne 0x140141d90
lea rax, [0x14053c0f0]
ret
movzx eax, byte [0x14053c093]
cmp al, 0xfb
je 0x140141dea
mov cl, 0x31
nop word cs:[rax + rax]
mov al, 0x2d
lock cmpxchg byte [0x14053c093], cl
je 0x140141e5f
movzx edx, byte [0x14053d580]
mov r8d, edx
xor r8b, 0x37
and dl, 0x37
add dl, dl
add dl, r8b
cmp al, dl
jne 0x140141dc0
lea rax, [0x14053c070]
ret
movzx eax, byte [0x14053d580]
mov ecx, eax
xor cl, 0x4f
and al, 0x4f
add al, al
add al, cl
xchg byte [0x14053bff5], al
lea rax, [0x14053bff0]
ret
xor eax, eax
lea rcx, [0x14053c0f0]
lea rdx, [0x140467200]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r9b
mov r10d, r9d
or r10b, r8b
not r10b
and r9b, r8b
or r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140141e88
inc rax
jmp 0x140141e30
xor eax, eax
lea rcx, [0x14053c070]
lea rdx, [0x140467180]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x140141e98
inc rax
jmp 0x140141e70
mov al, 3
xchg byte [0x14053c0fd], al
lea rax, [0x14053c0f0]
ret
mov al, 0xfb
xchg byte [0x14053c093], al
lea rax, [0x14053c070]
ret
Function at 0x1401687d0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0xf4c8b1e1
add eax, dword [0x1405429f4]
cmp ecx, eax
jne 0x14016881c
test edx, edx
je 0x1401688f2
movzx eax, byte [0x1405425f5]
cmp al, 0xec
je 0x140168814
mov cl, 0x53
nop dword [rax]
mov al, 0xc4
lock cmpxchg byte [0x1405425f5], cl
je 0x14016898c
cmp al, 0xec
jne 0x140168800
lea rax, [0x1405425e0]
ret
test edx, edx
je 0x140168948
movzx eax, byte [0x1405426a9]
nop dword [rax + rax]
cmp al, 2
je 0x1401688ea
movzx ecx, byte [0x1405429f0]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0xf4
mov eax, r8d
and al, 0xb
or al, r9b
add al, cl
and dl, 5
mov r9d, r8d
and r9b, 0xfa
or r9b, dl
mov edx, r9d
xor dl, cl
not r9b
not cl
and cl, r9b
or cl, dl
not cl
add cl, cl
add cl, dl
lock cmpxchg byte [0x1405426a9], cl
jne 0x140168830
xor edx, edx
lea rax, [0x1405426a0]
lea rcx, [0x140467920]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r9d
not r10b
mov r11d, r8d
xor r11b, r10b
not r11b
and r11b, r9b
and r10b, r8b
or r10b, r11b
mov byte [rdx + rax], r10b
mov r8d, edx
xor r8d, 0x7ffffffe
and r8d, edx
xor edx, 1
lea edx, [rdx + r8*2]
cmp edx, 9
jl 0x1401688a0
mov al, 2
xchg byte [0x1405426a9], al
lea rax, [0x1405426a0]
ret
movzx eax, byte [0x140542680]
mov ecx, r8d
xor cl, 0xb
add cl, byte [0x1405429f0]
cmp al, cl
je 0x140168940
nop dword [rax]
movzx ecx, byte [0x1405429f0]
mov eax, r8d
xor al, 9
mov edx, eax
xor dl, cl
and al, cl
add al, al
add al, dl
mov edx, r8d
xor dl, 0x4e
add dl, cl
lock cmpxchg byte [0x140542680], dl
je 0x140168a05
cmp al, 0x1c
jne 0x140168910
lea rax, [0x140542670]
ret
movzx eax, byte [0x140542650]
movzx ecx, byte [0x1405429f0]
xor r8b, 0xa
mov edx, r8d
xor dl, cl
and r8b, cl
add r8b, r8b
add r8b, dl
cmp al, r8b
je 0x140168984
mov cl, 0x62
nop
mov al, 0xd1
lock cmpxchg byte [0x140542650], cl
je 0x140168a58
cmp al, 0x1d
jne 0x140168970
lea rax, [0x140542640]
ret
xor edx, edx
lea rax, [0x1405425e0]
lea rcx, [0x140467880]
xor r8d, 0xf4c8b1cc
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rdx + rax]
xor r10b, r9b
mov byte [rdx + rax], r10b
mov r9d, edx
xor r9d, 0x7cbcd2e4
and edx, 0x7cbcd2e4
lea edx, [r9 + rdx*2]
add edx, 0x83432d1d
mov r9d, dword [0x1405429f4]
add r9d, r8d
cmp edx, r9d
jl 0x1401689b0
mov al, 0xec
xchg byte [0x1405425f5], al
lea rax, [0x1405425e0]
ret
xor eax, eax
lea rcx, [0x140542670]
lea rdx, [0x140467900]
xor r8d, 0xf4c8b1f1
nop dword [rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
not r9b
mov r11d, r9d
and r11b, r10b
or r9b, r10b
not r9b
or r9b, r11b
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405429f4]
add r10d, r8d
cmp r9d, r10d
jge 0x140168a88
inc rax
jmp 0x140168a20
xor eax, eax
lea rcx, [0x140542640]
lea rdx, [0x1404678e0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140168a98
inc rax
jmp 0x140168a70
mov al, 0x1c
xchg byte [0x140542680], al
lea rax, [0x140542670]
ret
mov al, 0x1d
xchg byte [0x140542650], al
lea rax, [0x140542640]
ret
Function at 0x140178390
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0xf3bfb8dc
add eax, dword [0x1405442d8]
cmp ecx, eax
jne 0x14017843b
test edx, edx
je 0x140178478
movzx eax, byte [0x140544079]
nop word [rax + rax]
cmp al, 0x9a
je 0x140178433
movzx ecx, byte [0x1405442e8]
mov eax, r8d
xor al, 0xc2
add al, cl
mov edx, r8d
xor dl, 0xfc
add dl, cl
lock cmpxchg byte [0x140544079], dl
jne 0x1401783c0
xor edx, edx
lea rax, [0x140544070]
lea rcx, [0x140467c60]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
add edx, 0xd386914c
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x2c796eb4
cmp edx, 9
jl 0x140178400
mov al, 0x9a
xchg byte [0x140544079], al
lea rax, [0x140544070]
ret
test edx, edx
je 0x1401784f5
movzx eax, byte [0x1405440f2]
cmp al, 0x9a
je 0x140178470
mov cl, 0xa4
mov al, 0x1a
lock cmpxchg byte [0x1405440f2], cl
je 0x140178528
mov edx, r8d
xor dl, 0x49
add dl, byte [0x1405442e8]
cmp al, dl
jne 0x140178450
lea rax, [0x1405440e0]
ret
movzx eax, byte [0x140543ebc]
nop
cmp al, 0xb5
je 0x1401784ed
movzx ecx, byte [0x1405442e8]
mov edx, r8d
not dl
and dl, 0x94
mov eax, r8d
xor al, 0x6b
or al, dl
not al
or al, dl
add al, cl
add cl, r8b
lock cmpxchg byte [0x140543ebc], cl
jne 0x140178480
xor edx, edx
lea rax, [0x140543e90]
lea rcx, [0x140467a90]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0x7ffffffe
and r8d, edx
xor edx, 1
lea edx, [rdx + r8*2]
cmp edx, 0x2c
jl 0x1401784c0
mov al, 0xb5
xchg byte [0x140543ebc], al
lea rax, [0x140543e90]
ret
movzx eax, byte [0x1405440a5]
cmp al, 0xe0
je 0x140178520
mov cl, 0x23
nop word cs:[rax + rax]
mov al, 0xfd
lock cmpxchg byte [0x1405440a5], cl
je 0x140178568
cmp al, 0xe0
jne 0x140178510
lea rax, [0x140544090]
ret
xor eax, eax
lea rcx, [0x1405440e0]
lea rdx, [0x140467cd0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x140178558
inc rax
jmp 0x140178540
mov al, 0x9a
xchg byte [0x1405440f2], al
lea rax, [0x1405440e0]
ret
xor eax, eax
lea rcx, [0x140544090]
lea rdx, [0x140467c80]
xor r8d, 0xf3bfb8dd
neg r8d
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rcx]
mov r10d, r9d
xor r10b, 0xd6
and r9b, 0x56
add r9b, r9b
add r9b, r10b
add r9b, byte [rax + rdx]
add r9b, 0x2a
mov byte [rax + rcx], r9b
xor r9d, r9d
sub r9d, dword [0x1405442d8]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
sub eax, r9d
cmp eax, 0x15
jl 0x140178590
mov al, pe_nt_image_headers64
xchg byte [0x1405440a5], al
lea rax, [0x140544090]
ret
Function at 0x1401787d0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14017881c
mov eax, r8d
xor eax, 0xcbd56a66
add eax, dword [0x1405442d8]
cmp edx, eax
jne 0x140178868
movzx eax, byte [0x1405440bb]
cmp al, 0x70
je 0x140178814
mov cl, 0x21
nop dword [rax + rax]
mov al, 0x46
lock cmpxchg byte [0x1405440bb], cl
je 0x1401788ec
cmp al, 0x70
jne 0x140178800
lea rax, [0x1405440b0]
ret
test edx, edx
je 0x1401788ba
movzx eax, byte [0x14054401e]
cmp al, 0xd0
je 0x140178860
mov cl, 0x32
nop word cs:[rax + rax]
mov al, 0xa5
lock cmpxchg byte [0x14054401e], cl
je 0x140178978
mov edx, r8d
xor dl, 0x85
add dl, byte [0x1405442e8]
cmp al, dl
jne 0x140178840
lea rax, [0x140544010]
ret
movzx eax, byte [0x140544053]
cmp al, 0xfa
je 0x1401788b2
mov cl, 0x75
nop word cs:[rax + rax]
mov al, 0x9e
lock cmpxchg byte [0x140544053], cl
je 0x140178918
movzx edx, byte [0x1405442e8]
mov r9d, r8d
xor r9b, 0x53
mov r10d, r9d
xor r10b, dl
and r9b, dl
add r9b, r9b
add r9b, r10b
cmp al, r9b
jne 0x140178880
lea rax, [0x140544030]
ret
movzx eax, byte [0x14054408d]
cmp al, 6
je 0x1401788e4
mov cl, 0xf5
nop word [rax + rax]
mov al, 0x93
lock cmpxchg byte [0x14054408d], cl
je 0x1401789b8
cmp al, 6
jne 0x1401788d0
lea rax, [0x140544080]
ret
xor eax, eax
lea rcx, [0x1405440b0]
lea rdx, [0x140467ca0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x140178958
inc rax
jmp 0x140178900
xor eax, eax
lea rcx, [0x140544030]
lea rdx, [0x140467c20]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x22
jg 0x140178968
inc rax
jmp 0x140178930
mov al, 0x70
xchg byte [0x1405440bb], al
lea rax, [0x1405440b0]
ret
mov al, 0xfa
xchg byte [0x140544053], al
lea rax, [0x140544030]
ret
xor eax, eax
lea rcx, [0x140544010]
lea rdx, [0x140467c00]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xd
jg 0x1401789a8
inc rax
jmp 0x140178990
mov al, 0xd0
xchg byte [0x14054401e], al
lea rax, [0x140544010]
ret
xor edx, edx
lea rax, [0x140544080]
lea rcx, [0x140467c70]
xor r8d, 0xcbd56a13
nop
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
mov r9d, dword [0x1405442d8]
add r9d, r8d
cmp edx, r9d
jl 0x1401789d0
mov al, 6
xchg byte [0x14054408d], al
lea rax, [0x140544080]
ret
Function at 0x14017fdd0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14017fe15
test edx, edx
je 0x14017fe4c
movzx eax, byte [0x140544e95]
cmp al, 0x5d
je 0x14017fe0d
mov cl, 0x2f
nop word cs:[rax + rax]
mov al, 0x6d
lock cmpxchg byte [0x140544e95], cl
je 0x14017feb5
movzx edx, byte [0x140545c3c]
dec dl
cmp al, dl
jne 0x14017fdf0
lea rax, [0x140544e80]
ret
test edx, edx
je 0x14017fe7c
movzx eax, byte [0x140545003]
cmp al, 0xe0
je 0x14017fe44
mov cl, 0x9f
nop word cs:[rax + rax]
mov al, 0xb1
lock cmpxchg byte [0x140545003], cl
je 0x14017ff12
cmp al, 0xe0
jne 0x14017fe30
lea rax, [0x140545000]
ret
movzx eax, byte [0x1405a9998]
cmp al, 0x13
je 0x14017fe74
mov cl, 0x69
nop dword [rax]
xor eax, eax
lock cmpxchg byte [0x1405a9998], cl
je 0x14017ff4c
cmp al, 0x13
jne 0x14017fe60
lea rax, [0x140544dc0]
ret
movzx eax, byte [0x140544f85]
cmp al, 0x5d
je 0x14017fead
mov cl, 0xe5
nop dword [rax]
mov al, 0xcb
lock cmpxchg byte [0x140544f85], cl
je 0x14017ffea
movzx edx, byte [0x140545c3c]
dec dl
cmp al, dl
jne 0x14017fe90
lea rax, [0x140544f70]
ret
xor edx, edx
lea rax, [0x140544e80]
lea rcx, [0x140467f70]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0xe1aac3d0
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x1e553c30
cmp edx, 0x15
jl 0x14017fed0
movzx eax, byte [0x140545c3c]
dec al
xchg byte [0x140544e95], al
lea rax, [0x140544e80]
ret
xor eax, eax
lea rcx, [0x140545000]
lea rdx, [0x1404680d0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x14017ffda
inc rax
jmp 0x14017ff30
xor edx, edx
lea rax, [0x140544dc0]
lea rcx, [0x140467eb0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
add r8b, 0xdf
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
add r8b, 0x21
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0xbf02c526
and edx, 0x3f02c526
lea edx, [r8 + rdx*2]
add edx, 0x40fd3adb
mov r8d, dword [0x140545c38]
mov r9d, r8d
xor r9d, 0x3c0d3006
and r8d, 0x3c0d3006
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x14017ff60
movzx eax, byte [0x140545c3c]
add al, 0xb5
xchg byte [0x1405a9998], al
lea rax, [0x140544dc0]
ret
mov al, pe_nt_image_headers64
xchg byte [0x140545003], al
lea rax, [0x140545000]
ret
xor eax, eax
lea rcx, [0x140544f70]
lea rdx, [0x140468050]
nop word [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r9b
mov r10d, r9d
or r10b, r8b
not r10b
and r9b, r8b
or r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x14018002f
inc rax
jmp 0x140180000
mov al, 0x5d
xchg byte [0x140544f85], al
lea rax, [0x140544f70]
ret
Function at 0x140185c90
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140185ccc
mov ecx, dword [rsp + 0x28]
test edx, edx
je 0x140185cfc
movzx eax, byte [0x1405460ce]
cmp al, 0xb7
je 0x140185cc4
mov dl, 0x82
nop dword [rax]
mov al, 0xf5
lock cmpxchg byte [0x1405460ce], dl
je 0x140185d5c
cmp al, 0xb7
jne 0x140185cb0
lea rax, [0x1405460c0]
ret
test edx, edx
je 0x140185d2c
movzx eax, byte [0x14054604d]
cmp al, 0x79
je 0x140185cf4
mov cl, 0x3c
nop dword [rax]
mov al, 0x55
lock cmpxchg byte [0x14054604d], cl
je 0x140185dcb
cmp al, 0x79
jne 0x140185ce0
lea rax, [0x140546040]
ret
movzx eax, byte [0x1405461c2]
cmp al, 0x2d
je 0x140185d24
mov dl, 0xd8
nop dword [rax]
mov al, 0x56
lock cmpxchg byte [0x1405461c2], dl
je 0x140185df8
cmp al, 0x2d
jne 0x140185d10
lea rax, [0x1405461b0]
ret
movzx eax, byte [0x140545fcd]
cmp al, 0x41
je 0x140185d54
mov cl, 0x45
nop dword [rax]
mov al, 0x84
lock cmpxchg byte [0x140545fcd], cl
je 0x140185e6f
cmp al, 0x41
jne 0x140185d40
lea rax, [0x140545fc0]
ret
xor eax, eax
lea rdx, [0x1405460c0]
lea r8, [0x140468580]
xor ecx, 0x59246775
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
movzx r10d, byte [rax + r8]
not r9b
mov r11d, r9d
and r11b, r10b
not r10b
xor r9b, r10b
and r9b, r10b
or r9b, r11b
mov byte [rax + rdx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405464a8]
add r10d, ecx
cmp r9d, r10d
jge 0x140185dbb
inc rax
jmp 0x140185d80
mov al, 0xb7
xchg byte [0x1405460ce], al
lea rax, [0x1405460c0]
ret
xor eax, eax
lea rcx, [0x140546040]
lea rdx, [0x140468500]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140185e5f
inc rax
jmp 0x140185de0
xor r8d, r8d
lea rax, [0x1405461b0]
lea rdx, [0x140468670]
xor ecx, 0x59246766
nop
movsxd r8, r8d
movzx r9d, byte [r8 + rdx]
xor byte [r8 + rax], r9b
mov r9d, dword [0x1405464a8]
mov r10d, ecx
xor r10d, r9d
and r9d, ecx
lea r9d, [r10 + r9*2]
mov r10d, r8d
xor r10d, r9d
not r8d
not r9d
and r9d, r8d
or r9d, r10d
not r9d
lea r8d, [r10 + r9*2]
cmp r8d, 0x12
jl 0x140185e10
mov al, 0x2d
xchg byte [0x1405461c2], al
lea rax, [0x1405461b0]
ret
mov al, 0x79
xchg byte [0x14054604d], al
lea rax, [0x140546040]
ret
xor eax, eax
lea rcx, [0x140545fc0]
lea rdx, [0x140468480]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140185e98
inc rax
jmp 0x140185e80
mov al, 0x41
xchg byte [0x140545fcd], al
lea rax, [0x140545fc0]
ret
Function at 0x140185ed0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x140185f6c
mov eax, r8d
xor eax, 0x7f11aaa
add eax, dword [0x1405464a8]
cmp edx, eax
jne 0x140185fac
movzx eax, byte [0x14054615d]
nop word [rax + rax]
cmp al, 0x3e
je 0x140186080
movzx ecx, byte [0x1405464ac]
mov eax, r8d
xor al, 0x67
add al, cl
mov edx, r8d
xor dl, 0x49
add dl, cl
lock cmpxchg byte [0x14054615d], dl
jne 0x140185f00
xor eax, eax
lea rcx, [0x140546150]
lea rdx, [0x140468610]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140186078
inc rax
jmp 0x140185f40
test edx, edx
je 0x140186038
movzx eax, byte [0x1405461f1]
cmp al, 0x1c
je 0x140185fa4
mov cl, 0x73
nop word cs:[rax + rax]
mov al, 0xbf
lock cmpxchg byte [0x1405461f1], cl
je 0x140186098
cmp al, 0x1c
jne 0x140185f90
lea rax, [0x1405461e0]
ret
movzx eax, byte [0x140545f31]
nop word cs:[rax + rax]
cmp al, 0xa4
je 0x140186090
movzx ecx, byte [0x1405464ac]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0x85
mov eax, r8d
and al, 0x7a
or al, r9b
mov r9d, ecx
xor r9b, cl
not r9b
and r9b, al
xor r9b, cl
and al, cl
add al, al
add al, r9b
add dl, cl
lock cmpxchg byte [0x140545f31], dl
jne 0x140185fc0
xor eax, eax
lea rcx, [0x140545f20]
lea rdx, [0x1404683e0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x140186088
inc rax
jmp 0x140186020
movzx eax, byte [0x140545fed]
cmp al, 0x38
je 0x140186070
mov cl, 0xd2
nop word cs:[rax + rax]
mov al, 0x42
lock cmpxchg byte [0x140545fed], cl
je 0x1401860ef
mov edx, r8d
xor dl, 0xa5
add dl, byte [0x1405464ac]
cmp al, dl
jne 0x140186050
lea rax, [0x140545fe0]
ret
mov al, 0x3e
xchg byte [0x14054615d], al
lea rax, [0x140546150]
ret
mov al, 0xa4
xchg byte [0x140545f31], al
lea rax, [0x140545f20]
ret
xor edx, edx
lea rax, [0x1405461e0]
lea rcx, [0x1404686a0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x11
jl 0x1401860b0
mov al, 0x1c
xchg byte [0x1405461f1], al
lea rax, [0x1405461e0]
ret
xor eax, eax
lea rcx, [0x140545fe0]
lea rdx, [0x1404684a0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140186118
inc rax
jmp 0x140186100
mov al, 0x38
xchg byte [0x140545fed], al
lea rax, [0x140545fe0]
ret
Function at 0x140186130
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x140186188
mov eax, r8d
xor eax, 0xad0d3cda
add eax, dword [0x1405464a8]
cmp edx, eax
jne 0x1401861e0
movzx eax, byte [0x140546113]
cmp al, 0x13
je 0x140186180
mov cl, 0x87
nop dword [rax]
mov al, 0xef
lock cmpxchg byte [0x140546113], cl
je 0x140186282
mov edx, r8d
xor dl, 0xf0
add dl, byte [0x1405464ac]
cmp al, dl
jne 0x140186160
lea rax, [0x140546100]
ret
test edx, edx
je 0x140186208
movzx eax, byte [0x140545ee5]
mov ecx, r8d
xor cl, 0xd3
add cl, byte [0x1405464ac]
cmp al, cl
je 0x1401861d8
nop word cs:[rax + rax]
movzx ecx, byte [0x1405464ac]
mov eax, r8d
xor al, 0xf7
add al, cl
mov edx, r8d
xor dl, 0x8b
add dl, cl
lock cmpxchg byte [0x140545ee5], dl
je 0x1401862df
cmp al, 0x36
jne 0x1401861b0
lea rax, [0x140545ed0]
ret
cmp byte [0x14054606f], 0
je 0x140186200
mov cl, 0x99
nop dword [rax + rax]
mov al, 0xde
lock cmpxchg byte [0x14054606f], cl
je 0x14018623c
test al, al
jne 0x1401861f0
lea rax, [0x140546050]
ret
movzx eax, byte [0x1405461dd]
cmp al, 0x48
je 0x140186234
mov cl, 0x2c
nop word cs:[rax + rax]
mov al, 0xa3
lock cmpxchg byte [0x1405461dd], cl
je 0x14018632d
cmp al, 0x48
jne 0x140186220
lea rax, [0x1405461d0]
ret
xor eax, eax
lea rcx, [0x140546050]
lea rdx, [0x140468510]
nop dword [rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0x1e
jg 0x140186268
inc rax
jmp 0x140186250
xor r8b, 0x8d
add r8b, byte [0x1405464ac]
xchg byte [0x14054606f], r8b
lea rax, [0x140546050]
ret
xor edx, edx
lea rax, [0x140546100]
lea rcx, [0x1404685c0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x13
jl 0x1401862a0
mov al, 0x13
xchg byte [0x140546113], al
lea rax, [0x140546100]
ret
xor eax, eax
lea rcx, [0x140545ed0]
lea rdx, [0x140468390]
xor r8d, 0xad0d3cdb
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x1405464a8]
add r9d, r8d
add eax, r9d
cmp eax, 0x15
jl 0x140186300
mov al, 0x36
xchg byte [0x140545ee5], al
lea rax, [0x140545ed0]
ret
xor eax, eax
lea rcx, [0x1405461d0]
lea rdx, [0x140468690]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140186368
inc rax
jmp 0x140186340
mov al, 0x48
xchg byte [0x1405461dd], al
lea rax, [0x1405461d0]
ret
Function at 0x140186c90
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x140186cdc
mov eax, r8d
xor eax, 0xdd566a7a
add eax, dword [0x1405464a8]
cmp edx, eax
jne 0x140186d0c
movzx eax, byte [0x1405460bd]
cmp al, 5
je 0x140186cd4
mov cl, 0xd1
nop dword [rax + rax]
mov al, 0x57
lock cmpxchg byte [0x1405460bd], cl
je 0x140186d7c
cmp al, 5
jne 0x140186cc0
lea rax, [0x1405460b0]
ret
test edx, edx
je 0x140186d3c
movzx eax, byte [0x140546001]
cmp al, 0xaa
je 0x140186d04
mov cl, 0xbc
nop dword [rax]
mov al, 0x38
lock cmpxchg byte [0x140546001], cl
je 0x140186e1f
cmp al, 0xaa
jne 0x140186cf0
lea rax, [0x140545ff0]
ret
movzx eax, byte [0x140545fbd]
cmp al, 0xe4
je 0x140186d34
mov cl, 0x7d
nop dword [rax]
mov al, 0x71
lock cmpxchg byte [0x140545fbd], cl
je 0x140186ddd
cmp al, 0xe4
jne 0x140186d20
lea rax, [0x140545fb0]
ret
movzx eax, byte [0x1405460dd]
mov ecx, r8d
xor cl, 0xaf
add cl, byte [0x1405464ac]
cmp al, cl
je 0x140186d74
mov cl, 0x8b
nop word cs:[rax + rax]
mov al, 0xa7
lock cmpxchg byte [0x1405460dd], cl
je 0x140186e7a
cmp al, 0x82
jne 0x140186d60
lea rax, [0x1405460d0]
ret
xor eax, eax
lea rcx, [0x1405460b0]
lea rdx, [0x140468570]
xor r8d, 0xdd566a7b
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
mov r9d, dword [0x1405464a8]
add r9d, r8d
add eax, r9d
cmp eax, 0xd
jl 0x140186da0
mov al, 5
xchg byte [0x1405460bd], al
lea rax, [0x1405460b0]
ret
xor edx, edx
lea rax, [0x140545fb0]
lea rcx, [0x140468470]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x140186df0
mov al, 0xe4
xchg byte [0x140545fbd], al
lea rax, [0x140545fb0]
ret
xor edx, edx
lea rax, [0x140545ff0]
lea rcx, [0x1404684b0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
add edx, edx
and edx, 2
mov r9d, r8d
xor r9d, edx
and edx, r8d
lea edx, [r9 + rdx*2]
cmp edx, 0x11
jl 0x140186e30
mov al, 0xaa
xchg byte [0x140546001], al
lea rax, [0x140545ff0]
ret
xor eax, eax
lea rcx, [0x1405460d0]
lea rdx, [0x140468590]
xor r8d, 0xdd566a77
nop word cs:[rax + rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405464a8]
add r10d, r8d
cmp r9d, r10d
jge 0x140186ed5
inc rax
jmp 0x140186ea0
mov al, 0x82
xchg byte [0x1405460dd], al
lea rax, [0x1405460d0]
ret