joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140198040
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8d, dword [rsp + 0x38]
mov eax, r8d
xor eax, 0x5f3226
add eax, dword [0x14056d0b8]
cmp ecx, eax
jne 0x1401980b3
test edx, edx
je 0x14019811f
movzx eax, byte [0x14056bbb4]
cmp al, 0xf5
je 0x140198242
mov cl, 0xbc
nop word cs:[rax + rax]
mov al, 0x4c
lock cmpxchg byte [0x14056bbb4], cl
je 0x140198179
mov edx, r8d
xor dl, 0x9e
mov r9d, r8d
not r9b
and r9b, r8b
xor r9b, dl
add r9b, byte [0x14056d0c8]
cmp al, r9b
jne 0x140198080
jmp 0x140198242
test edx, edx
je 0x140198149
movzx eax, byte [0x14056bd8d]
cmp al, 0xe9
je 0x140198256
nop word [rax + rax]
movzx ecx, byte [0x14056d0c8]
mov eax, r8d
xor al, 0xd8
mov edx, eax
xor dl, cl
and al, cl
add al, al
add al, dl
mov edx, r8d
xor dl, 0xba
add dl, cl
lock cmpxchg byte [0x14056bd8d], dl
je 0x1401981c1
mov ecx, r8d
not cl
mov edx, r8d
xor dl, 0x7d
and cl, 0x82
or dl, cl
not dl
or dl, cl
add dl, byte [0x14056d0c8]
cmp al, dl
jne 0x1401980d0
jmp 0x140198256
movzx eax, byte [0x14056bc52]
cmp al, 0x59
je 0x1401982fc
mov cl, 0x20
mov al, 0x67
lock cmpxchg byte [0x14056bc52], cl
je 0x140198262
cmp al, 0x59
jne 0x140198130
jmp 0x1401982fc
movzx eax, byte [0x14056bbc4]
cmp al, 0x7f
je 0x1401982e1
mov cl, 0xf0
nop word [rax + rax]
mov al, 5
lock cmpxchg byte [0x14056bbc4], cl
je 0x140198298
cmp al, 0x7f
jne 0x140198160
jmp 0x1401982e1
xor eax, eax
lea rcx, [0x14056bbb0]
lea rdx, [0x14048eda0]
mov r9d, r8d
xor r9d, 0x5f323a
nop word cs:[rax + rax]
movzx r10d, byte [rax + rdx]
add byte [rax + rcx], r10b
lea r10d, [rax + 1]
mov r11d, dword [0x14056d0b8]
add r11d, r9d
cmp r10d, r11d
jge 0x140198230
inc rax
jmp 0x1401981a0
xor eax, eax
lea rcx, [0x14056bd80]
lea rdx, [0x14048ef70]
xor r8d, 0x5f3233
nop dword [rax + rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
not r11b
mov ebx, r11d
and bl, r10b
mov esi, r9d
xor r9b, r10b
not r10b
and sil, r10b
or sil, bl
and r10b, r11b
or r10b, r9b
not r10b
add r10b, r10b
add r10b, sil
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x14056d0b8]
add r10d, r8d
cmp r9d, r10d
jge 0x14019824e
inc rax
jmp 0x1401981e0
xor r8b, 0x9e
add r8b, byte [0x14056d0c8]
xchg byte [0x14056bbb4], r8b
lea rax, [0x14056bbb0]
jmp 0x140198303
mov al, 0xe9
xchg byte [0x14056bd8d], al
lea rax, [0x14056bd80]
jmp 0x140198303
xor eax, eax
lea rcx, [0x14056bc50]
lea rdx, [0x14048ee40]
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 1
jg 0x1401982ea
inc rax
jmp 0x140198280
xor edx, edx
lea rax, [0x14056bbc0]
lea rcx, [0x14048edb0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
not edx
and edx, 0x7ffffffe
or edx, r8d
not edx
lea edx, [r8 + rdx*2]
cmp edx, 4
jl 0x1401982b0
mov al, 0x7f
xchg byte [0x14056bbc4], al
lea rax, [0x14056bbc0]
jmp 0x140198303
xor r8b, 0x32
add r8b, byte [0x14056d0c8]
xchg byte [0x14056bc52], r8b
lea rax, [0x14056bc50]
pop rbx
pop rsi
ret
Function at 0x1401acd20
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401acd66
test edx, edx
je 0x1401acd9c
movzx eax, byte [0x14056dced]
movzx ecx, byte [0x14056f2f0]
add cl, 0x67
cmp al, cl
je 0x1401acd5e
mov cl, 0x72
nop
mov al, pe_nt_image_headers64
lock cmpxchg byte [0x14056dced], cl
je 0x1401ace2c
movzx edx, byte [0x14056f2f0]
add dl, 0x67
cmp al, dl
jne 0x1401acd40
lea rax, [0x14056dce0]
ret
test edx, edx
je 0x1401acdcc
movzx eax, byte [0x14056dc8f]
cmp al, 0x4c
je 0x1401acd94
mov cl, 0x67
nop word [rax + rax]
mov al, 0x9f
lock cmpxchg byte [0x14056dc8f], cl
je 0x1401ace8e
cmp al, 0x4c
jne 0x1401acd80
lea rax, [0x14056dc80]
ret
movzx eax, byte [0x14056de3d]
cmp al, 0xe3
je 0x1401acdc4
mov cl, 0x2d
nop dword [rax]
mov al, 0x58
lock cmpxchg byte [0x14056de3d], cl
je 0x1401aceb8
cmp al, 0xe3
jne 0x1401acdb0
lea rax, [0x14056de30]
ret
movzx eax, byte [0x14056dc30]
nop word cs:[rax + rax]
cmp al, 0xb6
je 0x1401acf47
movzx ecx, byte [0x14056f2f0]
lea eax, [rcx + 0x3e]
add cl, 0x3f
lock cmpxchg byte [0x14056dc30], cl
jne 0x1401acde0
xor eax, eax
lea rcx, [0x14056dc20]
lea rdx, [0x14048f2d0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1401acf3f
inc rax
jmp 0x1401ace10
xor eax, eax
lea rcx, [0x14056dce0]
lea rdx, [0x14048f380]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
mov r11d, r9d
not r11b
xor r8b, r11b
xor r11b, r10b
and r11b, r9b
and r10b, r9b
or r10b, r8b
not r10b
or r10b, r11b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401ace7e
inc rax
jmp 0x1401ace40
mov al, 0x98
xchg byte [0x14056dced], al
lea rax, [0x14056dce0]
ret
xor eax, eax
lea rcx, [0x14056dc80]
lea rdx, [0x14048f320]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1401acf28
inc rax
jmp 0x1401acea0
xor edx, edx
lea rax, [0x14056de30]
lea rcx, [0x14048f4d0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r9d
not r10b
mov r11d, r8d
xor r11b, r10b
not r11b
and r11b, r9b
and r10b, r8b
or r10b, r11b
mov byte [rdx + rax], r10b
add edx, 0x263b916d
mov r8d, edx
xor r8d, 0xd9c46e94
and edx, 0x59c46e94
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x1401aced0
mov al, 0xe3
xchg byte [0x14056de3d], al
lea rax, [0x14056de30]
ret
movzx eax, byte [0x14056f2f0]
add al, 0x1b
xchg byte [0x14056dc8f], al
lea rax, [0x14056dc80]
ret
mov al, 0xb6
xchg byte [0x14056dc30], al
lea rax, [0x14056dc20]
ret
Function at 0x1401ad050
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1401ad098
test edx, edx
je 0x1401ad0d8
movzx eax, byte [0x14056de51]
cmp al, 2
je 0x1401ad090
mov cl, 0x76
nop word [rax + rax]
mov al, 0x15
lock cmpxchg byte [0x14056de51], cl
je 0x1401ad18c
mov edx, r8d
xor dl, 0xe2
add dl, byte [0x14056f2f0]
cmp al, dl
jne 0x1401ad070
lea rax, [0x14056de40]
ret
test edx, edx
je 0x1401ad11c
movzx eax, byte [0x14056dcad]
cmp al, 0x52
je 0x1401ad0d0
mov cl, 0x1c
nop dword [rax]
mov al, 0x86
lock cmpxchg byte [0x14056dcad], cl
je 0x1401ad1dd
mov edx, r8d
xor dl, 0x12
add dl, byte [0x14056f2f0]
cmp al, dl
jne 0x1401ad0b0
lea rax, [0x14056dca0]
ret
movzx eax, byte [0x14056ddad]
xor r8b, 0xf
add r8b, byte [0x14056f2f0]
cmp al, r8b
je 0x1401ad114
mov cl, 0x61
nop word cs:[rax + rax]
mov al, 0x15
lock cmpxchg byte [0x14056ddad], cl
je 0x1401ad208
cmp al, 0x6d
jne 0x1401ad100
lea rax, [0x14056dda0]
ret
movzx eax, byte [0x14056de0d]
nop word cs:[rax + rax]
cmp al, 0x23
je 0x1401ad260
movzx ecx, byte [0x14056f2f0]
mov eax, r8d
xor al, 0xb
add al, cl
mov edx, r8d
xor dl, 0xcb
add dl, cl
lock cmpxchg byte [0x14056de0d], dl
jne 0x1401ad130
xor eax, eax
lea rcx, [0x14056de00]
lea rdx, [0x14048f4a0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401ad258
inc rax
jmp 0x1401ad170
xor eax, eax
lea rcx, [0x14056de40]
lea rdx, [0x14048f4e0]
xor r8d, 0xf97ee520
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x14056f2e0]
add r9d, r8d
add eax, r9d
cmp eax, 0x11
jl 0x1401ad1b0
mov al, 2
xchg byte [0x14056de51], al
lea rax, [0x14056de40]
ret
xor eax, eax
lea rcx, [0x14056dca0]
lea rdx, [0x14048f340]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401ad238
inc rax
jmp 0x1401ad1f0
xor eax, eax
lea rcx, [0x14056dda0]
lea rdx, [0x14048f440]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401ad248
inc rax
jmp 0x1401ad220
mov al, 0x52
xchg byte [0x14056dcad], al
lea rax, [0x14056dca0]
ret
mov al, 0x6d
xchg byte [0x14056ddad], al
lea rax, [0x14056dda0]
ret
mov al, 0x23
xchg byte [0x14056de0d], al
lea rax, [0x14056de00]
ret
Function at 0x1401ad5e0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1401ad62c
test edx, edx
je 0x1401ad65c
movzx eax, byte [0x14056dc43]
xor r8b, 0x5f
add r8b, byte [0x14056f2f0]
cmp al, r8b
je 0x1401ad624
mov cl, 0x5b
nop word cs:[rax + rax]
mov al, 0xdd
lock cmpxchg byte [0x14056dc43], cl
je 0x1401ad6bc
cmp al, 0x2c
jne 0x1401ad610
lea rax, [0x14056dc40]
ret
test edx, edx
je 0x1401ad68c
movzx eax, byte [0x14056dd4b]
cmp al, 0x51
je 0x1401ad654
mov cl, 0x64
nop dword [rax]
mov al, 0x72
lock cmpxchg byte [0x14056dd4b], cl
je 0x1401ad6f8
cmp al, 0x51
jne 0x1401ad640
lea rax, [0x14056dd30]
ret
movzx eax, byte [0x14056dcc2]
cmp al, 0xa1
je 0x1401ad684
mov cl, 0x6b
nop dword [rax]
mov al, 0x32
lock cmpxchg byte [0x14056dcc2], cl
je 0x1401ad73f
cmp al, 0xa1
jne 0x1401ad670
lea rax, [0x14056dcb0]
ret
movzx eax, byte [0x14056ddc4]
cmp al, 0x9c
je 0x1401ad6b4
mov cl, 0xc2
nop dword [rax]
mov al, 0x8c
lock cmpxchg byte [0x14056ddc4], cl
je 0x1401ad782
cmp al, 0x9c
jne 0x1401ad6a0
lea rax, [0x14056ddb0]
ret
xor eax, eax
lea rcx, [0x14056dc40]
lea rdx, [0x14048f2e0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1401ad6e8
inc rax
jmp 0x1401ad6d0
mov al, 0x2c
xchg byte [0x14056dc43], al
lea rax, [0x14056dc40]
ret
xor edx, edx
lea rax, [0x14056dd30]
lea rcx, [0x14048f3d0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x1b
jl 0x1401ad710
mov al, 0x51
xchg byte [0x14056dd4b], al
lea rax, [0x14056dd30]
ret
xor eax, eax
lea rcx, [0x14056dcb0]
lea rdx, [0x14048f350]
nop
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0x11
jg 0x1401ad768
inc rax
jmp 0x1401ad750
xor r8b, 0xd4
add r8b, byte [0x14056f2f0]
xchg byte [0x14056dcc2], r8b
lea rax, [0x14056dcb0]
ret
xor eax, eax
lea rcx, [0x14056ddb0]
lea rdx, [0x14048f450]
xor r8d, 0x3b080a82
nop dword [rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14056f2e0]
add r10d, r8d
cmp r9d, r10d
jge 0x1401ad7c1
inc rax
jmp 0x1401ad7a0
mov al, 0x9c
xchg byte [0x14056ddc4], al
lea rax, [0x14056ddb0]
ret
Function at 0x1401c94a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
mov rax, qword [rcx]
mov r12, qword [rcx + 8]
sub r12, rax
mov r9, qword [0x1405700d0]
lea ecx, [r9 - 6]
sar r12, cl
mov r14, rdx
mov rdi, rdx
sub rdi, rax
mov ecx, r9d
xor ecx, 0xfa
and r9d, 0x7a
lea ecx, [rcx + r9*2]
sar rdi, cl
inc r12
mov rcx, qword [rsi + 0x10]
sub rcx, rax
sar rcx, 3
mov r13, rcx
shr r13, 1
movabs rax, 0x1fffffffffffffff
mov rdx, rax
sub rdx, r13
add r13, rcx
cmp r13, r12
cmovbe r13, r12
cmp rcx, rdx
cmova r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x1401c96df
mov r15, r8
lea rcx, [r13*8]
cmp r13, 0x200
jb 0x1401c958d
movabs rax, 0x84f10f83f7bef8f3
add rax, qword [0x1405700d0]
cmp r13, rax
jae 0x1401c96df
add rcx, 0x27
mov edx, 0xe7d9f685
mov r8d, 0xfc4339e7
mov r9d, 0x176c9676
call fcn.1400aaaf0
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1401c95dd
mov eax, dword [0x1405d0dd0]
mov edx, dword [0x1405700d8]
neg edx
add edx, eax
inc edx
imul edx, eax
test dl, 1
je 0x1401c95bb
nop word [rax + rax]
mov eax, dword [0x1405d0dd4]
cmp eax, 0x21
jge 0x1401c95b0
test r13, r13
je 0x1401c95db
mov edx, 0xe7d9f685
mov r8d, 0xfc4339e7
mov r9d, 0x176c9676
call fcn.1400aaaf0
mov rbx, rax
jmp 0x1401c95dd
xor ebx, ebx
lea rcx, [rbx + rdi*8]
mov rax, qword [r15]
mov qword [rbx + rdi*8], rax
mov r8, qword [rsi + 8]
cmp r8, r14
je 0x1401c9618
mov rdi, rcx
lea r15, [rcx + 8]
mov rdx, qword [rsi]
mov r8, r14
sub r8, rdx
mov rcx, rbx
call fcn.14046c800
mov r8, qword [rsi + 8]
sub r8, r14
mov rcx, r15
mov rdx, r14
jmp 0x1401c9624
mov rdi, rcx
mov rdx, qword [rsi]
sub r8, rdx
mov rcx, rbx
call fcn.14046c800
lea rax, [fcn.1401c94a0]
add eax, eax
add eax, 0x2f00
nop word [rax + rax]
mov ecx, dword [0x1405700d8]
lea edx, [rcx - 0x22f307eb]
xor edx, eax
not edx
and edx, eax
add ecx, 0xdd0cf814
cmp edx, ecx
jne 0x1401c9640
mov rcx, qword [rsi]
test rcx, rcx
je 0x1401c96b8
mov rdx, qword [rsi + 0x10]
sub rdx, rcx
movabs rax, 0x64f10f83f7bf08f6
add rax, qword [0x1405700d0]
cmp rdx, rax
jbe 0x1401c96b3
mov rax, qword [rcx - 8]
add rcx, qword [0x1405700d0]
sub rcx, rax
movabs r8, 0x64f10f83f7bef8ef
add r8, rcx
cmp r8, 0x20
jae 0x1401c96e4
mov rcx, rdx
xor rcx, 0x27
and edx, 0x27
lea rdx, [rcx + rdx*2]
mov rcx, rax
call fcn.1400a8fb0
mov qword [rsi], rbx
lea rax, [rbx + r12*8]
mov qword [rsi + 8], rax
lea rax, [rbx + r13*8]
mov qword [rsi + 0x10], rax
mov rax, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.140084710
call fcn.140424a4c
int3
Function at 0x1401ca7a0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1401ca7dc
test edx, edx
je 0x1401ca80c
movzx eax, byte [0x14056f9a6]
cmp al, 0x6c
je 0x1401ca7d4
mov cl, 0x3d
nop word [rax + rax]
mov al, 0xff
lock cmpxchg byte [0x14056f9a6], cl
je 0x1401ca86c
cmp al, 0x6c
jne 0x1401ca7c0
lea rax, [0x14056f9a0]
ret
test edx, edx
je 0x1401ca83c
movzx eax, byte [0x14056faab]
cmp al, 0x29
je 0x1401ca804
mov cl, 0xc6
nop dword [rax]
mov al, 0xf0
lock cmpxchg byte [0x14056faab], cl
je 0x1401ca8d0
cmp al, 0x29
jne 0x1401ca7f0
lea rax, [0x14056faa0]
ret
movzx eax, byte [0x14056fabf]
cmp al, 0xc
je 0x1401ca834
mov cl, 0x5f
nop dword [rax]
mov al, 0xb2
lock cmpxchg byte [0x14056fabf], cl
je 0x1401ca8f8
cmp al, 0xc
jne 0x1401ca820
lea rax, [0x14056fab0]
ret
movzx eax, byte [0x14056f9f5]
cmp al, 0x81
je 0x1401ca864
mov cl, 0xeb
nop dword [rax]
mov al, 0x5e
lock cmpxchg byte [0x14056f9f5], cl
je 0x1401ca948
cmp al, 0x81
jne 0x1401ca850
lea rax, [0x14056f9e0]
ret
xor eax, eax
lea rcx, [0x14056f9a0]
lea rdx, [0x14048f840]
mov r9d, r8d
xor r9d, 0xdf5a1ef3
xor r8d, 0xdf5a1efc
nop dword [rax]
cdqe
movzx r10d, byte [rax + rdx]
mov r11d, r10d
xor r11b, r10b
not r11b
and r11b, byte [rax + rcx]
xor r11b, r10b
mov byte [rax + rcx], r11b
mov r10d, dword [0x1405700d8]
add eax, r9d
add eax, r10d
add r10d, r8d
cmp eax, r10d
jl 0x1401ca890
mov al, 0x6c
xchg byte [0x14056f9a6], al
lea rax, [0x14056f9a0]
ret
xor eax, eax
lea rcx, [0x14056faa0]
lea rdx, [0x14048f930]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x1401ca928
inc rax
jmp 0x1401ca8e0
xor eax, eax
lea rcx, [0x14056fab0]
lea rdx, [0x14048f940]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1401ca938
inc rax
jmp 0x1401ca910
mov al, 0x29
xchg byte [0x14056faab], al
lea rax, [0x14056faa0]
ret
mov al, 0xc
xchg byte [0x14056fabf], al
lea rax, [0x14056fab0]
ret
xor edx, edx
lea rax, [0x14056f9e0]
lea rcx, [0x14048f880]
nop dword [rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
cmp edx, 0x15
jl 0x1401ca960
xor r8b, 0x5b
add r8b, byte [0x1405700dc]
xchg byte [0x14056f9f5], r8b
lea rax, [0x14056f9e0]
ret
Function at 0x1401db210
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401db24c
test edx, edx
je 0x1401db28c
movzx eax, byte [0x1405723f0]
cmp al, 0xd1
je 0x1401db244
mov cl, 0xd7
nop word cs:[rax + rax]
mov al, 0x6b
lock cmpxchg byte [0x1405723f0], cl
je 0x1401db33c
cmp al, 0xd1
jne 0x1401db230
lea rax, [0x1405723e0]
ret
test edx, edx
je 0x1401db30f
movzx eax, byte [0x140572453]
cmp al, 0x26
je 0x1401db284
mov cl, 0x89
nop word cs:[rax + rax]
mov al, 0x70
lock cmpxchg byte [0x140572453], cl
je 0x1401db378
cmp al, 0x26
jne 0x1401db270
lea rax, [0x140572450]
ret
movzx eax, byte [0x1405724a9]
nop word cs:[rax + rax]
cmp al, 0x16
je 0x1401db307
movzx ecx, byte [0x1405729a0]
lea eax, [rcx + 0x5b]
add cl, 0x8d
lock cmpxchg byte [0x1405724a9], cl
jne 0x1401db2a0
xor edx, edx
lea rax, [0x1405724a0]
lea rcx, [0x1404900c0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 9
jl 0x1401db2d0
mov al, 0x16
xchg byte [0x1405724a9], al
lea rax, [0x1405724a0]
ret
movzx eax, byte [0x1405724bd]
cmp al, 0x83
je 0x1401db334
mov cl, 0xb7
nop dword [rax]
mov al, 0x54
lock cmpxchg byte [0x1405724bd], cl
je 0x1401db3b8
cmp al, 0x83
jne 0x1401db320
lea rax, [0x1405724b0]
ret
xor eax, eax
lea rcx, [0x1405723e0]
lea rdx, [0x140490020]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1401db368
inc rax
jmp 0x1401db350
mov al, 0xd1
xchg byte [0x1405723f0], al
lea rax, [0x1405723e0]
ret
xor eax, eax
lea rcx, [0x140572450]
lea rdx, [0x140490070]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1401db3a8
inc rax
jmp 0x1401db390
mov al, 0x26
xchg byte [0x140572453], al
lea rax, [0x140572450]
ret
xor eax, eax
lea rcx, [0x1405724b0]
lea rdx, [0x1404900d0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1401db3e8
inc rax
jmp 0x1401db3d0
mov al, 0x83
xchg byte [0x1405724bd], al
lea rax, [0x1405724b0]
ret
Function at 0x1401e8ed0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1401e8f51
test edx, edx
je 0x1401e8f8c
movzx eax, byte [0x140573c09]
mov ecx, r8d
xor cl, 0x58
add cl, byte [0x140574228]
cmp al, cl
je 0x1401e8f49
nop dword [rax + rax]
movzx ecx, byte [0x140574228]
mov eax, r8d
xor al, 0xd2
add al, 0xe
mov edx, eax
xor dl, cl
and al, cl
add al, al
add al, dl
add al, 0xf2
mov edx, r8d
xor dl, 0x99
mov r9d, r8d
xor r9b, dl
xor r9b, 0x66
and r9b, cl
xor r9b, dl
and dl, cl
add dl, dl
add dl, r9b
lock cmpxchg byte [0x140573c09], dl
je 0x1401e9010
cmp al, 0x73
jne 0x1401e8f00
lea rax, [0x140573c00]
ret
test edx, edx
je 0x1401e8fc8
movzx eax, byte [0x140573b62]
mov ecx, r8d
xor cl, 0x55
add cl, byte [0x140574228]
cmp al, cl
je 0x1401e8f84
mov cl, 0x98
nop
mov al, 0x99
lock cmpxchg byte [0x140573b62], cl
je 0x1401e904f
cmp al, 0x6e
jne 0x1401e8f70
lea rax, [0x140573b60]
ret
movzx eax, byte [0x140573baa]
cmp al, 0xea
je 0x1401e8fc0
mov cl, 0xce
nop dword [rax]
mov al, 4
lock cmpxchg byte [0x140573baa], cl
je 0x1401e90b1
mov edx, r8d
xor dl, 0xd1
add dl, byte [0x140574228]
cmp al, dl
jne 0x1401e8fa0
lea rax, [0x140573ba0]
ret
movzx eax, byte [0x140573b42]
mov ecx, r8d
xor cl, 7
add cl, byte [0x140574228]
cmp al, cl
je 0x1401e9008
nop
movzx ecx, byte [0x140574228]
mov eax, r8d
xor al, 0xb4
add al, cl
mov edx, r8d
xor dl, 0xc6
add dl, cl
lock cmpxchg byte [0x140573b42], dl
je 0x1401e9108
cmp al, 0x20
jne 0x1401e8fe0
lea rax, [0x140573b30]
ret
xor edx, edx
lea rax, [0x140573c00]
lea rcx, [0x1404906e0]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 9
jl 0x1401e9020
mov al, 0x73
xchg byte [0x140573c09], al
lea rax, [0x140573c00]
ret
xor eax, eax
lea rcx, [0x140573b60]
lea rdx, [0x140490650]
xor r8d, 0xd641b24a
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
mov byte [rax + rcx], r9b
mov r9d, dword [0x14057422c]
add r9d, r8d
add eax, r9d
cmp eax, 2
jl 0x1401e9070
mov al, 0x6e
xchg byte [0x140573b62], al
lea rax, [0x140573b60]
ret
xor eax, eax
lea rcx, [0x140573ba0]
lea rdx, [0x140490680]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 9
jg 0x1401e90f8
inc rax
jmp 0x1401e90d0
mov al, 0xea
xchg byte [0x140573baa], al
lea rax, [0x140573ba0]
ret
xor eax, eax
lea rcx, [0x140573b30]
lea rdx, [0x140490620]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x1401e9148
inc rax
jmp 0x1401e9120
mov al, 0x20
xchg byte [0x140573b42], al
lea rax, [0x140573b30]
ret
Function at 0x1401e9180
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x1401e91c9
test edx, edx
je 0x1401e924e
movzx eax, byte [0x140573bff]
cmp al, 0xe4
je 0x1401e9350
mov cl, 0xb8
nop word cs:[rax + rax]
mov al, 0xf
lock cmpxchg byte [0x140573bff], cl
je 0x1401e9315
cmp al, 0xe4
jne 0x1401e91b0
jmp 0x1401e9350
test edx, edx
je 0x1401e92ed
movzx eax, byte [0x140573ad2]
nop dword [rax + rax]
cmp al, 0x9b
je 0x1401e9245
movzx ecx, byte [0x140574228]
mov eax, r8d
xor al, 0xa6
add al, cl
mov edx, r8d
xor dl, 0x3f
add dl, cl
lock cmpxchg byte [0x140573ad2], dl
jne 0x1401e91e0
xor eax, eax
lea rcx, [0x140573ad0]
lea rdx, [0x1404905d0]
xor r8d, 0xebf33e58
nop dword [rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x14057422c]
add r9d, r8d
add eax, r9d
cmp eax, 2
jl 0x1401e9220
mov al, 0x9b
xchg byte [0x140573ad2], al
lea rax, [0x140573ad0]
pop rsi
ret
movzx eax, byte [0x140573b9f]
nop word cs:[rax + rax]
cmp al, 0xf6
je 0x1401e92e4
movzx ecx, byte [0x140574228]
mov eax, r8d
xor al, 0x63
add al, cl
mov edx, r8d
xor dl, 0xfb
add dl, cl
lock cmpxchg byte [0x140573b9f], dl
jne 0x1401e9260
xor r9d, r9d
lea rax, [0x140573b90]
lea rcx, [0x140490670]
mov edx, r8d
xor edx, 0xebf33e58
xor r8d, 0xebf33e4a
nop dword [rax]
movsxd r9, r9d
movzx r10d, byte [r9 + rcx]
add byte [r9 + rax], r10b
mov r10d, dword [0x14057422c]
lea r11d, [rdx + r10]
mov esi, r9d
xor esi, r11d
and r9d, r11d
lea r9d, [rsi + r9*2]
add r10d, r8d
cmp r9d, r10d
jl 0x1401e92b0
mov al, 0xf6
xchg byte [0x140573b9f], al
lea rax, [0x140573b90]
pop rsi
ret
movzx eax, byte [0x140573b80]
cmp al, 0xf6
je 0x1401e93a5
mov cl, 0xe1
nop
mov al, 0xa5
lock cmpxchg byte [0x140573b80], cl
je 0x1401e9359
cmp al, 0xf6
jne 0x1401e9300
jmp 0x1401e93a5
xor eax, eax
lea rcx, [0x140573bf0]
lea rdx, [0x1404906d0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1401e9348
inc rax
jmp 0x1401e9330
mov al, 0xe4
xchg byte [0x140573bff], al
lea rax, [0x140573bf0]
pop rsi
ret
xor eax, eax
lea rcx, [0x140573b70]
lea rdx, [0x140490660]
xor r8d, 0xebf33e58
cdqe
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
mov r9d, dword [0x14057422c]
add r9d, r8d
add eax, r9d
cmp eax, 0x10
jl 0x1401e9370
mov al, 0xf6
xchg byte [0x140573b80], al
lea rax, [0x140573b70]
pop rsi
ret

Function at 0x1401e93e0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
call fcn.14042a084
nop
add rsp, 0x28
ret