joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140376a00
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x140376a5c
test edx, edx
je 0x140376adc
movzx eax, byte [0x1405ae593]
cmp al, 0x31
je 0x140376a54
mov cl, 0xd
nop
mov al, 0x97
lock cmpxchg byte [0x1405ae593], cl
je 0x140376bdb
mov edx, r8d
not dl
mov r9d, r8d
xor r9b, 0x8c
and dl, 0x73
or r9b, dl
not r9b
or r9b, dl
add r9b, byte [0x1405aec88]
cmp al, r9b
jne 0x140376a20
lea rax, [0x1405ae590]
ret
test edx, edx
je 0x140376b0c
movzx eax, byte [0x1405ae62d]
nop dword [rax + rax]
cmp al, 0xe9
je 0x140376c20
movzx ecx, byte [0x1405aec88]
mov eax, r8d
xor al, 0x7e
add al, cl
mov edx, r8d
xor dl, 0xc9
add dl, cl
lock cmpxchg byte [0x1405ae62d], dl
jne 0x140376a70
xor eax, eax
lea rcx, [0x1405ae620]
lea rdx, [0x1404ac690]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140376c18
inc rax
jmp 0x140376ab0
movzx eax, byte [0x1405ae3bd]
cmp al, 6
je 0x140376b04
mov cl, 0x39
nop dword [rax]
mov al, 0x43
lock cmpxchg byte [0x1405ae3bd], cl
je 0x140376c28
cmp al, 6
jne 0x140376af0
lea rax, [0x1405ae3a0]
ret
movzx eax, byte [0x1405ae588]
nop word cs:[rax + rax]
cmp al, 0xa9
je 0x140376bd3
movzx eax, byte [0x1405aec88]
mov ecx, r8d
xor cl, al
xor cl, 0x71
mov edx, r8d
xor dl, 0xe
mov r9d, r8d
xor r9b, 0xf3
add r9b, al
not al
and al, dl
or al, cl
not al
add al, al
add al, cl
lock cmpxchg byte [0x1405ae588], r9b
jne 0x140376b20
xor edx, edx
lea rax, [0x1405ae570]
lea rcx, [0x1404ac5e0]
nop
movsxd rdx, edx
xor r8d, r8d
sub r8b, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
xor r10d, r10d
sub r10b, r9b
mov r9d, r8d
xor r9b, r10b
and r10b, r8b
add r10b, r10b
add r10b, r9b
neg r10b
mov byte [rdx + rax], r10b
mov r8d, edx
not r8d
mov r9d, r8d
and r9d, 1
mov r10d, edx
and r10d, 0xfffffffe
or r10d, r9d
xor edx, 1
and r8d, 0x7ffffffe
or r8d, edx
not r8d
lea edx, [r10 + r8*2]
cmp edx, 0x18
jl 0x140376b70
mov al, 0xa9
xchg byte [0x1405ae588], al
lea rax, [0x1405ae570]
ret
xor eax, eax
lea rcx, [0x1405ae590]
lea rdx, [0x1404ac600]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x140376c08
inc rax
jmp 0x140376bf0
mov al, 0x31
xchg byte [0x1405ae593], al
lea rax, [0x1405ae590]
ret
mov al, 0xe9
xchg byte [0x1405ae62d], al
lea rax, [0x1405ae620]
ret
xor eax, eax
lea rcx, [0x1405ae3a0]
lea rdx, [0x1404ac440]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
add r8b, 0xe5
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
add r8b, 0x1b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1c
jg 0x140376c74
inc rax
jmp 0x140376c40
mov al, 6
xchg byte [0x1405ae3bd], al
lea rax, [0x1405ae3a0]
ret
Function at 0x140376ce0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0x803a028e
mov r9d, dword [0x1405aec78]
add r9d, eax
cmp ecx, r9d
jne 0x140376d3c
add eax, dword [0x1405aec78]
cmp edx, eax
jne 0x140376d8c
movzx eax, byte [0x1405ae410]
cmp al, 0xd
je 0x140376d34
mov cl, 0xfc
nop word [rax + rax]
mov al, 0x73
lock cmpxchg byte [0x1405ae410], cl
je 0x140376e3d
cmp al, 0xd
jne 0x140376d20
lea rax, [0x1405ae400]
ret
test edx, edx
je 0x140376dbc
movzx eax, byte [0x1405ae60f]
mov ecx, r8d
xor cl, 0xae
add cl, byte [0x1405aec88]
cmp al, cl
je 0x140376d84
nop word [rax + rax]
movzx ecx, byte [0x1405aec88]
mov eax, r8d
xor al, 0x28
add al, cl
mov edx, r8d
xor dl, 0x5a
add dl, cl
lock cmpxchg byte [0x1405ae60f], dl
je 0x140376df8
cmp al, 0xab
jne 0x140376d60
lea rax, [0x1405ae600]
ret
movzx eax, byte [0x1405ae374]
cmp al, 0x84
je 0x140376db4
mov cl, 0x70
nop dword [rax]
mov al, 0x4b
lock cmpxchg byte [0x1405ae374], cl
je 0x140376e8d
cmp al, 0x84
jne 0x140376da0
lea rax, [0x1405ae360]
ret
movzx eax, byte [0x1405ae3d3]
cmp al, 0xf0
je 0x140376df0
mov cl, 0x67
nop dword [rax]
mov al, 0x5a
lock cmpxchg byte [0x1405ae3d3], cl
je 0x140376f0c
mov edx, r8d
xor dl, 0xeb
add dl, byte [0x1405aec88]
cmp al, dl
jne 0x140376dd0
lea rax, [0x1405ae3c0]
ret
xor eax, eax
lea rcx, [0x1405ae600]
lea rdx, [0x1404ac670]
xor r8d, 0x803a028f
nop
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x1405aec78]
add r9d, r8d
add eax, r9d
cmp eax, 0xf
jl 0x140376e10
mov al, 0xab
xchg byte [0x1405ae60f], al
lea rax, [0x1405ae600]
ret
xor eax, eax
lea rcx, [0x1405ae400]
lea rdx, [0x1404ac4a0]
xor r8d, 0x803a028f
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x1405aec78]
add r9d, r8d
add eax, r9d
cmp eax, 0x10
jl 0x140376e60
mov al, 0xd
xchg byte [0x1405ae410], al
lea rax, [0x1405ae400]
ret
xor edx, edx
lea rax, [0x1405ae360]
lea rcx, [0x1404ac400]
xor r8d, 0x803a029a
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rax]
movzx r10d, byte [rdx + rcx]
not r9b
mov r11d, r9d
and r11b, r10b
or r9b, r10b
not r9b
or r9b, r11b
mov byte [rdx + rax], r9b
add edx, 0xd8edb990
mov r9d, edx
xor r9d, 0x27124671
and edx, 0x27124671
lea edx, [r9 + rdx*2]
mov r9d, dword [0x1405aec78]
add r9d, r8d
cmp edx, r9d
jl 0x140376eb0
mov al, 0x84
xchg byte [0x1405ae374], al
lea rax, [0x1405ae360]
ret
xor eax, eax
lea rcx, [0x1405ae3c0]
lea rdx, [0x1404ac460]
nop dword [rax]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
cmp r9d, 0x12
jg 0x140376f48
inc rax
jmp 0x140376f20
xor r8b, 0xeb
add r8b, byte [0x1405aec88]
xchg byte [0x1405ae3d3], r8b
lea rax, [0x1405ae3c0]
ret
Function at 0x140384b10
Capabilities:
Check for software breakpoints

Disassembly:
sub rsp, 0x28
xor eax, eax
cmp byte [0x1405d0d59], 0
jne 0x140384bc0
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx + 0x10]
cmp rdx, rcx
je 0x140384bc0
nop word cs:[rax + rax]
add rdx, 8
mov rax, qword [rdx - 8]
cmp byte [rax], 0xcc
je 0x140384b56
cmp rdx, rcx
jne 0x140384b40
xor eax, eax
jmp 0x140384bc0
cmp qword [0x1405d3580], 0
jne 0x140384bb1
mov ecx, 0x30
mov edx, 0x1f103d3a
mov r8d, 0x97498951
call fcn.1400aaaf0
mov qword [rax + 0x28], 0xf
lea rcx, [0x140489448]
mov qword [rax + 8], rcx
mov ecx, 0x5de01b89
add ecx, dword [0x1405afab8]
mov dword [rax], ecx
mov qword [rax + 0x20], 0
movzx ecx, byte [0x1405afabc]
add cl, 0x8a
mov byte [rax + 0x10], cl
mov qword [0x1405d3580], rax
mov rax, qword [0x1405d3580]
mov dword [rax], 0xb
mov al, 1
add rsp, 0x28
ret
Function at 0x1403852e0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14038531c
test edx, edx
je 0x140385356
movzx eax, byte [0x1405af97f]
cmp al, 0x4b
je 0x140385314
mov cl, 0xfb
nop word cs:[rax + rax]
mov al, 0x3c
lock cmpxchg byte [0x1405af97f], cl
je 0x1403853cc
cmp al, 0x4b
jne 0x140385300
lea rax, [0x1405af970]
ret
test edx, edx
je 0x14038538c
movzx eax, byte [0x1405af8bd]
cmp al, 0xbe
je 0x14038534e
mov cl, 0xc
nop dword [rax]
mov al, 0x71
lock cmpxchg byte [0x1405af8bd], cl
je 0x140385428
movzx edx, byte [0x1405afabc]
add dl, 0x48
cmp al, dl
jne 0x140385330
lea rax, [0x1405af8b0]
ret
movzx eax, byte [0x1405af8d0]
cmp al, 0x1b
je 0x140385384
mov cl, 0xc2
nop word cs:[rax + rax]
mov al, 0x3b
lock cmpxchg byte [0x1405af8d0], cl
je 0x14038547f
cmp al, 0x1b
jne 0x140385370
lea rax, [0x1405af8c0]
ret
movzx eax, byte [0x1405afa2f]
movzx ecx, byte [0x1405afabc]
mov edx, ecx
xor dl, 0x18
and dl, cl
xor cl, 0x67
add dl, dl
add dl, cl
cmp al, dl
je 0x1403853c4
mov cl, 0x84
nop
mov al, 0xb2
lock cmpxchg byte [0x1405afa2f], cl
je 0x1403854b8
cmp al, 0xdd
jne 0x1403853b0
lea rax, [0x1405afa20]
ret
xor edx, edx
lea rax, [0x1405af970]
lea rcx, [0x1404ad0c0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
not r8b
mov r10d, r8d
and r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, dword [0x1405afab8]
add edx, r8d
add edx, 0x5de01b8a
cmp edx, 0xf
jl 0x1403853e0
mov al, 0x4b
xchg byte [0x1405af97f], al
lea rax, [0x1405af970]
ret
xor edx, edx
lea rax, [0x1405af8b0]
lea rcx, [0x1404ad010]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x140385440
mov al, 0xbe
xchg byte [0x1405af8bd], al
lea rax, [0x1405af8b0]
ret
xor eax, eax
lea rcx, [0x1405af8c0]
lea rdx, [0x1404ad020]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1403854a8
inc rax
jmp 0x140385490
mov al, 0x1b
xchg byte [0x1405af8d0], al
lea rax, [0x1405af8c0]
ret
xor edx, edx
lea rax, [0x1405afa20]
lea rcx, [0x1404ad170]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
not r8b
not r9b
mov r10d, r8d
xor r10b, r9b
or r9b, r8b
and r9b, r10b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x1403854d0
mov al, 0xdd
xchg byte [0x1405afa2f], al
lea rax, [0x1405afa20]
ret
Function at 0x14038a180
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
cmp byte [rcx + 0xb0], 0
je 0x14038a1b6
lea rcx, [rsi + 0xb8]
call fcn.14038b080
mov byte [rsi + 0xb0], 0
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
sub rdx, rcx
mov rax, qword [0x1405b08b8]
movabs r8, 0xabc986a3d181ae3
mov r9, rax
xor r9, r8
and rax, r8
lea rax, [r9 + rax*2]
cmp rdx, rax
jbe 0x14038a216
mov rax, qword [rcx - 8]
add rcx, qword [0x1405b08b8]
sub rcx, rax
movabs r8, 0xabc986a3d180adc
add r8, rcx
cmp r8, 0x20
jae 0x14038a2e9
add rdx, 0x27
mov rcx, rax
lea rdi, [rsi + 0x88]
call fcn.1400a8fb0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov rax, qword [rsi + 0x78]
mov rcx, qword [rax + 8]
mov qword [rcx], 0
mov rdi, qword [rax]
test rdi, rdi
je 0x14038a290
movabs rbx, 0xabc986a3d180b14
nop word cs:[rax + rax]
mov r14, qword [rdi]
lea rcx, [rdi + 0x18]
call fcn.14038b3e0
mov rax, qword [0x1405b08b8]
mov rcx, rax
xor rcx, rbx
and rax, rbx
lea rdx, [rcx + rax*2]
mov rcx, rdi
call fcn.1400a8fb0
mov rdi, r14
test r14, r14
jne 0x14038a260
mov rcx, qword [rsi + 0x78]
mov edx, 0x30
call fcn.1400a8fb0
cmp byte [rsi + 0x63], 0
je 0x14038a2a8
mov byte [rsi + 0x63], 0
cmp byte [rsi + 0x49], 0
je 0x14038a2ba
movzx eax, byte [0x1405b08b0]
add al, 0xc7
mov byte [rsi + 0x49], al
cmp byte [rsi + 0x37], 0
je 0x14038a2cc
movzx eax, byte [0x1405b08b0]
add al, 0xc7
mov byte [rsi + 0x37], al
cmp byte [rsi + 0x1b], 0
je 0x14038a2d6
mov byte [rsi + 0x1b], 0
cmp byte [rsi], 0
je 0x14038a2de
mov byte [rsi], 0
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call fcn.140424a4c
int3
Function at 0x14038a410
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r8
mov rdi, rdx
mov r14, rcx
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov r15, rax
sub r15, rdx
mov rcx, r15
sar rcx, 3
cmp rcx, rdi
jae 0x14038a4a3
mov rax, rdi
shr rax, 0x3d
jne 0x14038a69a
lea rcx, [rdi*8]
cmp rdi, 0x200
jb 0x14038a4d8
movabs rax, 0x1ffffffffffffffc
cmp rdi, rax
jae 0x14038a69a
add rcx, 0x27
mov edx, 0xf20d305
mov r8d, 0xebab57f4
call fcn.1400aaaf0
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
test r15, r15
jne 0x14038a4f0
jmp 0x14038a520
cmp rdx, rax
je 0x14038a68d
mov r8, rax
sub r8, rdx
add r8, 0xfffffffffffffff8
movabs rcx, 0xabc986a3d180afc
add rcx, qword [0x1405b08b8]
cmp r8, rcx
jae 0x14038a5c2
mov r10, rdx
jmp 0x14038a680
mov edx, 0xf20d305
mov r8d, 0xebab57f4
call fcn.1400aaaf0
mov rbx, rax
test r15, r15
je 0x14038a520
mov rcx, qword [r14]
cmp r15, 0x1000
jb 0x14038a518
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14038a69f
add r15, 0x27
mov rcx, rax
mov rdx, r15
call fcn.1400a8fb0
mov qword [r14], rbx
lea rax, [rbx + rdi*8]
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rax
dec rdi
movabs rcx, 0x1fffffffffffffff
and rcx, rdi
cmp rcx, 3
jae 0x14038a54a
mov rdx, rbx
jmp 0x14038a5b0
inc rcx
mov r9d, ecx
not r9d
mov rdx, rcx
xor rdx, 0xfffffffffffffffc
and r9d, 3
or r9, rdx
mov r8, 0xfffffffffffffffb
sub r8, r9
not r9
lea rdx, [rbx + r9*8]
movq xmm0, rsi
pshufd xmm0, xmm0, 0x44
xor r10d, r10d
nop
movdqu xmmword [rbx + r10*8], xmm0
movdqu xmmword [rbx + r10*8 + 0x10], xmm0
cmp r8, r10
je 0x14038a598
add r10, 4
jmp 0x14038a580
cmp rcx, r9
je 0x14038a68d
nop word cs:[rax + rax]
add rdx, 8
mov qword [rdx - 8], rsi
cmp rdx, rax
jne 0x14038a5b0
jmp 0x14038a68d
shr r8, 3
inc r8
mov rcx, r8
not rcx
mov r9, r8
xor r9, 3
mov r10, r9
and r9, rcx
and rcx, 0xfffffffffffffffc
or r10, rcx
not r10
or r9, rcx
or r9, r10
not r9
xor ecx, ecx
sub ecx, dword [0x1405b08b8]
mov r10d, ecx
xor r10d, 0x19
and ecx, 0x19
lea ecx, [r10 + rcx*2]
neg cl
mov r10, r9
shl r10, cl
xor ecx, ecx
add r10, rdx
movq xmm0, rsi
pshufd xmm0, xmm0, 0x44
movabs r11, 0xaa619ba9c9d2fd11
movabs rdi, 0x605afcc073450dd7
movabs rbx, 0x1fa5033f8cbaf228
nop word [rax + rax]
movdqu xmmword [rdx + rcx*8], xmm0
movdqu xmmword [rdx + rcx*8 + 0x10], xmm0
mov r14, qword [0x1405b08b8]
add r14, r11
mov r15, r14
xor r15, rbx
and r15, r14
xor r14, rdi
lea r14, [r14 + r15*2]
add rcx, r14
cmp rcx, r9
jne 0x14038a640
cmp r8, r9
je 0x14038a68d
nop word cs:[rax + rax]
add r10, 8
mov qword [r10 - 8], rsi
cmp r10, rax
jne 0x14038a680
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
call fcn.140084710
call fcn.140424a4c
int3
Function at 0x14038f660
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14038f6b7
mov eax, 0xdfa5325c
add eax, dword [0x1405b08b4]
cmp edx, eax
jne 0x14038f700
movzx eax, byte [0x1405afe0b]
movzx ecx, byte [0x1405b08b0]
add cl, 0x98
cmp al, cl
je 0x14038f6af
nop dword [rax]
movzx ecx, byte [0x1405b08b0]
lea eax, [rcx + 0x6f]
add cl, 0x63
lock cmpxchg byte [0x1405afe0b], cl
je 0x14038f75c
cmp al, 0xd1
jne 0x14038f690
lea rax, [0x1405afdf0]
ret
test edx, edx
je 0x14038f728
movzx eax, byte [0x1405afe7e]
movzx ecx, byte [0x1405b08b0]
dec cl
cmp al, cl
je 0x14038f6f8
nop
movzx ecx, byte [0x1405b08b0]
lea eax, [rcx + 3]
mov edx, ecx
xor dl, 0xd0
and cl, 0x50
add cl, cl
add cl, dl
lock cmpxchg byte [0x1405afe7e], cl
je 0x14038f7d8
cmp al, 0x38
jne 0x14038f6d0
lea rax, [0x1405afe50]
ret
movzx eax, byte [0x1405aff27]
cmp al, 0x4f
je 0x14038f720
mov cl, 0x4c
nop dword [rax]
mov al, 0xd8
lock cmpxchg byte [0x1405aff27], cl
je 0x14038f788
cmp al, 0x4f
jne 0x14038f710
lea rax, [0x1405aff00]
ret
movzx eax, byte [0x1405affaf]
cmp al, 0x86
je 0x14038f754
mov cl, 0xe3
nop word cs:[rax + rax]
mov al, 0x83
lock cmpxchg byte [0x1405affaf], cl
je 0x14038f82c
cmp al, 0x86
jne 0x14038f740
lea rax, [0x1405affa0]
ret
xor eax, eax
lea rcx, [0x1405afdf0]
lea rdx, [0x1404ad300]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1a
jg 0x14038f7b8
inc rax
jmp 0x14038f770
xor eax, eax
lea rcx, [0x1405aff00]
lea rdx, [0x1404ad3f0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x26
jg 0x14038f7c8
inc rax
jmp 0x14038f7a0
mov al, 0xd1
xchg byte [0x1405afe0b], al
lea rax, [0x1405afdf0]
ret
mov al, 0x4f
xchg byte [0x1405aff27], al
lea rax, [0x1405aff00]
ret
xor eax, eax
lea rcx, [0x1405afe50]
lea rdx, [0x1404ad350]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x2d
jg 0x14038f81c
inc rax
jmp 0x14038f7f0
mov al, 0x38
xchg byte [0x1405afe7e], al
lea rax, [0x1405afe50]
ret
xor r8d, r8d
lea rax, [0x1405affa0]
lea rcx, [0x1404ad490]
mov edx, 0xdfa5326b
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [r8 + rax]
xor r10b, r9b
mov byte [r8 + rax], r10b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x1405b08b4]
add r9d, edx
cmp r8d, r9d
jl 0x14038f850
movzx eax, byte [0x1405b08b0]
mov ecx, eax
xor cl, 0x4d
and al, 0x4d
add al, al
add al, cl
xchg byte [0x1405affaf], al
lea rax, [0x1405affa0]
ret
Function at 0x14038f8d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
test ecx, ecx
je 0x14038f909
test edx, edx
je 0x14038f939
movzx eax, byte [0x1405afe40]
cmp al, 0x28
je 0x14038f9f9
mov cl, 0xf1
nop word [rax + rax]
mov al, 4
lock cmpxchg byte [0x1405afe40], cl
je 0x14038f9b9
cmp al, 0x28
jne 0x14038f8f0
jmp 0x14038f9f9
test edx, edx
je 0x14038f984
movzx eax, byte [0x1405afdc5]
cmp al, 0x5c
je 0x14038fa47
mov cl, 0x71
nop
mov al, 0xfe
lock cmpxchg byte [0x1405afdc5], cl
je 0x14038fa02
cmp al, 0x5c
jne 0x14038f920
jmp 0x14038fa47
movzx eax, byte [0x1405affb9]
movzx ecx, byte [0x1405b08b0]
inc cl
cmp al, cl
je 0x14038fa80
nop word cs:[rax + rax]
movzx ecx, byte [0x1405b08b0]
lea eax, [rcx - 0x65]
add cl, 0x92
lock cmpxchg byte [0x1405affb9], cl
je 0x14038fa50
cmp al, 0x3a
jne 0x14038f960
jmp 0x14038fa80
movzx eax, byte [0x1405afec0]
cmp al, 0xb4
je 0x14038faef
mov cl, 0xc0
nop word cs:[rax + rax]
mov al, 0xc2
lock cmpxchg byte [0x1405afec0], cl
je 0x14038fa89
cmp al, 0xb4
jne 0x14038f9a0
jmp 0x14038faef
xor edx, edx
lea rax, [0x1405afe30]
lea rcx, [0x1404ad340]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1405b08b4]
add edx, r8d
add edx, 0xdfa5325d
cmp edx, 0x10
jl 0x14038f9d0
mov al, 0x28
xchg byte [0x1405afe40], al
lea rax, [0x1405afe30]
pop rbx
ret
xor edx, edx
lea rax, [0x1405afdb0]
lea rcx, [0x1404ad2c0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x14038fa20
mov al, 0x5c
xchg byte [0x1405afdc5], al
lea rax, [0x1405afdb0]
pop rbx
ret
xor eax, eax
lea rcx, [0x1405affb0]
lea rdx, [0x1404ad4a0]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x14038fa78
inc rax
jmp 0x14038fa60
mov al, 0x3a
xchg byte [0x1405affb9], al
lea rax, [0x1405affb0]
pop rbx
ret
xor eax, eax
lea rcx, [0x1405afeb0]
lea rdx, [0x1404ad3b0]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
not r10b
mov r11d, r8d
and r11b, r10b
xor r10b, r8b
not r8b
mov ebx, r8d
xor bl, r9b
or r11b, bl
not r11b
and r8b, r9b
or r8b, r10b
not r8b
or r8b, r11b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x14038fae7
inc rax
jmp 0x14038faa0
mov al, 0xb4
xchg byte [0x1405afec0], al
lea rax, [0x1405afeb0]
pop rbx
ret
Function at 0x14039f380
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1405b2478]
mov r8d, eax
xor r8d, 0xd4b213e1
and eax, 0x54b213e1
lea eax, [r8 + rax*2]
cmp ecx, eax
jne 0x14039f3cc
test edx, edx
je 0x14039f3f8
movzx eax, byte [0x1405b214d]
cmp al, 0x95
je 0x14039f3c4
mov cl, 0x45
nop
mov al, 0xa7
lock cmpxchg byte [0x1405b214d], cl
je 0x14039f468
cmp al, 0x95
jne 0x14039f3b0
lea rax, [0x1405b2140]
ret
movzx eax, byte [0x1405b207a]
cmp al, 0x60
je 0x14039f3f0
mov cl, 0xf3
nop dword [rax]
mov al, 0xbb
lock cmpxchg byte [0x1405b207a], cl
je 0x14039f42c
cmp al, 0x60
jne 0x14039f3e0
lea rax, [0x1405b2070]
ret
movzx eax, byte [0x1405b2032]
movzx ecx, byte [0x1405b247c]
add cl, 0x52
cmp al, cl
je 0x14039f424
mov cl, 0x54
nop
mov al, 0x7a
lock cmpxchg byte [0x1405b2032], cl
je 0x14039f4d1
cmp al, 0xf6
jne 0x14039f410
lea rax, [0x1405b2020]
ret
xor eax, eax
lea rcx, [0x1405b2070]
lea rdx, [0x1404ad9f0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 9
jg 0x14039f458
inc rax
jmp 0x14039f440
mov al, 0x60
xchg byte [0x1405b207a], al
lea rax, [0x1405b2070]
ret
xor r8d, r8d
lea rax, [0x1405b2140]
lea rcx, [0x1404adab0]
mov edx, 0xd4b213ee
nop
movsxd r8, r8d
movzx r9d, byte [r8 + rax]
movzx r10d, byte [r8 + rcx]
not r9b
mov r11d, r9d
and r11b, r10b
or r9b, r10b
not r9b
or r9b, r11b
mov byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 1
and r8d, 1
lea r8d, [r9 + r8*2]
mov r9d, dword [0x1405b2478]
add r9d, edx
cmp r8d, r9d
jl 0x14039f480
mov al, 0x95
xchg byte [0x1405b214d], al
lea rax, [0x1405b2140]
ret
xor edx, edx
lea rax, [0x1405b2020]
lea rcx, [0x1404ad9a0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
not r10b
not r9b
mov r11d, r10d
xor r11b, r9b
and r11b, r10b
and r9b, r8b
or r9b, r11b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
mov r8d, dword [0x1405b2478]
mov r9d, r8d
xor r9d, 0xd4b213f3
and r8d, 0x54b213f3
add r8d, r8d
mov r10d, r9d
xor r10d, r8d
and r8d, r9d
lea r8d, [r10 + r8*2]
cmp edx, r8d
jl 0x14039f4f0
mov al, 0xf6
xchg byte [0x1405b2032], al
lea rax, [0x1405b2020]
ret
Function at 0x1403a1840
Capabilities:
Encode data using xor

Disassembly:
push rsi
xor eax, eax
sub eax, dword [0x1405b26f0]
mov edx, eax
xor edx, 0xea72641f
and eax, 0x6a72641f
lea eax, [rdx + rax*2]
add eax, ecx
jne 0x1403a1899
movzx eax, byte [0x1405b26cd]
movzx ecx, byte [0x1405b26e4]
add cl, 0xfa
cmp al, cl
je 0x1403a199b
mov cl, 0x8b
nop dword [rax + rax]
mov al, 0x20
lock cmpxchg byte [0x1405b26cd], cl
je 0x1403a1941
cmp al, 0xae
jne 0x1403a1880
jmp 0x1403a199b
movzx eax, byte [0x1405b25f4]
cmp al, 0xbd
je 0x1403a1a38
lea rax, [fcn.1403a1840]
lea ecx, [rax + rax]
add ecx, 0x1f40
mov edx, ecx
not edx
mov r8b, 0x7a
mov r9d, 0x158d9c08
nop word cs:[rax + rax]
test edx, ecx
jne 0x1403a1920
nop word cs:[rax + rax]
mov al, 0xc8
lock cmpxchg byte [0x1405b25f4], r8b
sete r10b
mov r11d, dword [0x1405d3684]
mov esi, dword [0x1405b26f0]
add esi, r9d
cmp r11d, esi
jge 0x1403a1920
test r10b, r10b
jne 0x1403a19a4
cmp al, 0xbd
jne 0x1403a18d0
jmp 0x1403a1a38
mov al, 0xc8
lock cmpxchg byte [0x1405b25f4], r8b
mov eax, dword [0x1405d3680]
lea r10d, [rax - 1]
imul r10d, eax
test r10b, 1
jne 0x1403a1920
jmp 0x1403a18e0
xor eax, eax
lea rcx, [0x1405b26c0]
lea rdx, [0x1404adc30]
nop word cs:[rax + rax]
movsxd r8, eax
movzx r9d, byte [r8 + rdx]
add byte [r8 + rcx], r9b
not eax
mov r9d, eax
and r9d, 1
xor r8d, 1
and eax, 0x7ffffffe
or eax, r8d
and r8d, 0xfffffffe
or r8d, r9d
not eax
lea eax, [r8 + rax*2]
cmp eax, 0xd
jl 0x1403a1960
mov al, 0xae
xchg byte [0x1405b26cd], al
lea rax, [0x1405b26c0]
pop rsi
ret
xor eax, eax
lea rcx, [0x1405b25f0]
lea rdx, [0x1404adb70]
mov r8d, 0x158d9be5
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405b26f0]
add r10d, r8d
cmp r9d, r10d
jge 0x1403a19e1
inc rax
jmp 0x1403a19c0
cmp dword [0x1405b26f0], 0xea72641f
jne 0x1403a1a2e
mov al, 0xbd
xchg byte [0x1405b25f4], al
mov eax, dword [0x1405b26f0]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xea72641e
xor eax, 0x158d9be1
and eax, ecx
or eax, edx
mov r8d, ecx
and r8d, 0x158d9be1
or r8d, edx
and ecx, 0x6a72641e
or ecx, r8d
not ecx
add ecx, ecx
add ecx, eax
je 0x1403a1a38
mov al, 0xbd
xchg byte [0x1405b25f4], al
jmp 0x1403a19ed
lea rax, [0x1405b25f0]
pop rsi
ret

Function at 0x1403a1aa0
Capabilities:
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x18], rdx
call fcn.1403b89e0
cmp byte [0x1405d0870], 0
jne 0x1403a1adc
test byte [0x1405d0cd9], 1
jne 0x1403a1adc
test rax, rax
je 0x1403a1adc
add rsp, 0x40
pop rbp
ret
mov ecx, 0x7f
call fcn.140189fa0
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
mov r8d, 0x3030073
add rsp, 0x40
pop rbp
jmp fcn.1403a1c10