joyce8/EMBER2024-capa huggingface dataset:
Function at 0x200f1b20
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x200f1b5c
test edx, edx
je 0x200f1ba1
movzx eax, byte [0x205367e5]
cmp al, 0x5c
je 0x200f1b54
mov cl, 0xca
nop word cs:[rax + rax]
mov al, 0x43
lock cmpxchg byte [0x205367e5], cl
je 0x200f1c17
cmp al, 0x5c
jne 0x200f1b40
lea rax, [0x205367d0]
ret
test edx, edx
je 0x200f1bcc
movzx eax, byte [0x20536828]
cmp al, 0xfa
je 0x200f1b99
nop dword [rax + rax]
movzx ecx, byte [0x205416e8]
lea eax, [rcx + 0x20]
add cl, 0x64
lock cmpxchg byte [0x20536828], cl
je 0x200f1c5f
movzx ecx, byte [0x205416e8]
add cl, 0x81
cmp al, cl
jne 0x200f1b70
lea rax, [0x20536810]
ret
movzx eax, byte [0x205368e3]
cmp al, 0xc9
je 0x200f1bc4
mov cl, 0xe2
nop
mov al, 0x93
lock cmpxchg byte [0x205368e3], cl
je 0x200f1c9c
cmp al, 0xc9
jne 0x200f1bb0
lea rax, [0x205368e0]
ret
movzx eax, byte [0x205368a5]
movzx ecx, byte [0x205416e8]
add cl, 0x4d
cmp al, cl
je 0x200f1c0f
nop word cs:[rax + rax]
movzx ecx, byte [0x205416e8]
lea eax, [rcx + 0x14]
add cl, 0x9a
lock cmpxchg byte [0x205368a5], cl
je 0x200f1ce8
cmp al, 0xc6
jne 0x200f1bf0
lea rax, [0x20536890]
ret
xor eax, eax
lea rcx, [0x205367d0]
lea rdx, [0x2046e400]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x200f1c48
inc rax
jmp 0x200f1c30
movzx eax, byte [0x205416e8]
add al, 0xe3
xchg byte [0x205367e5], al
lea rax, [0x205367d0]
ret
xor eax, eax
lea rcx, [0x20536810]
lea rdx, [0x2046e440]
nop
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x17
jg 0x200f1cc8
inc rax
jmp 0x200f1c70
xor eax, eax
lea rcx, [0x205368e0]
lea rdx, [0x2046e510]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x200f1cd8
inc rax
jmp 0x200f1cb0
mov al, 0xfa
xchg byte [0x20536828], al
lea rax, [0x20536810]
ret
mov al, 0xc9
xchg byte [0x205368e3], al
lea rax, [0x205368e0]
ret
xor edx, edx
lea rax, [0x20536890]
lea rcx, [0x2046e4c0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x15
jl 0x200f1d00
movzx eax, byte [0x205416e8]
add al, 0x4d
xchg byte [0x205368a5], al
lea rax, [0x20536890]
ret
Function at 0x200f6ba0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rsi, rcx
mov rax, qword [0x205a38a0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, dword [0x205b3880]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
mov eax, dword [0x20543210]
mov edx, eax
xor edx, 0xc505c973
and eax, 0x4505c973
lea eax, [rdx + rax*2]
cmp ecx, eax
jne 0x200f6c57
mov eax, 0xffb1
add eax, dword [0x20542064]
cdqe
add rax, qword [0x20542078]
mov rcx, rsi
mov edx, 0x72bfff79
mov r8d, 0xa1facf4c
call qword [case.0x2010e313.0]
lea rcx, [rsi + 0x4c0]
mov qword [rsi + 0x420], 0
mov r8d, 0x428
xor edx, edx
call fcn.2044feb0
xorps xmm0, xmm0
movups xmmword [rsi + 0x8f0], xmm0
mov eax, dword [0x205b3880]
mov ecx, dword [0x20543210]
not ecx
add ecx, eax
dec ecx
imul ecx, eax
test cl, 1
je 0x200f6d7d
lea rdi, [rsi + 0x4c0]
xorps xmm6, xmm6
mov ebp, 0xffb1
lea rbx, [rsp + 0x24]
nop dword [rax + rax]
mov eax, dword [0x20543210]
sub eax, dword [0x20542064]
add eax, 0xdd3f6bbf
mov ecx, eax
xor ecx, 0xa4d535c3
and eax, 0x24d535c3
lea eax, [rcx + rax*2]
mov ecx, 0xbd0fd7c0
sub ecx, eax
movsxd rax, ecx
add rax, qword [0x20542078]
mov rcx, rsi
mov edx, 0x72bfff79
mov r8d, 0xa1facf4c
call qword [case.0x2010e313.0]
mov qword [rsi + 0x420], 0
mov r8d, 0x428
mov rcx, rdi
xor edx, edx
call fcn.2044feb0
movups xmmword [rsi + 0x8f0], xmm6
mov eax, dword [0x20542068]
add eax, ebp
cdqe
add rax, qword [0x20542088]
mov ecx, 0x2771583b
call qword [case.0x2010e313.0]
mov eax, dword [0x20542060]
mov ecx, dword [0x20543210]
mov edx, ecx
xor edx, 0xc504c9c2
and ecx, 0x4504c9c2
lea ecx, [rdx + rcx*2]
sub eax, ecx
cdqe
add rax, qword [0x20542080]
mov rcx, rbx
mov edx, 0x8388ccd4
call qword [case.0x2010e313.0]
mov ecx, dword [rsp + 0x24]
mov eax, dword [0x2054206c]
mov edx, dword [0x20543210]
mov r8d, edx
xor r8d, 0xc504c9c2
mov r9d, edx
and r9d, 0x4504c9c2
lea r8d, [r8 + r9*2]
sub edx, r8d
add eax, edx
add eax, 0xc505c973
cdqe
add rax, qword [0x20542070]
mov edx, 0x7b990810
call qword [case.0x2010e313.0]
test al, 1
je 0x200f6c70
jmp 0x200f6be8
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.204278f0
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x2010bd30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rbx, r9
mov rdi, r8
mov rsi, rcx
mov byte [rcx + 0x38], dl
movzx edx, word [r8 + 0xc22b]
mov dword [rsp + 0x20], 0x6c616445
mov rcx, r9
mov r8d, 0x1658afa6
mov r9d, 0x872438d5
call fcn.2008fa70
lea rcx, [rsi + 0x40]
mov dword [rsp + 0x20], 0x9c1c08d
mov rdx, rax
mov r8d, 0x10dd40d5
mov r9d, 0x71632270
call fcn.200f1ed0
movzx edx, word [rdi + 0xc22d]
mov dword [rsp + 0x20], 0x6c616445
mov rcx, rbx
mov r8d, 0x1658afa6
mov r9d, 0x872438d5
call fcn.2008fa70
lea rcx, [rsi + 0x68]
mov dword [rsp + 0x20], 0x9c1c08d
mov rdx, rax
mov r8d, 0x10dd40d5
mov r9d, 0x71632270
call fcn.200f1ed0
movzx edx, word [rdi + 0xc22f]
mov eax, dword [0x20544c9c]
lea r8d, [rax + 0x5771e41d]
lea r9d, [rax - 0x37c292b4]
add eax, 0xad7a98bc
mov dword [rsp + 0x20], eax
mov rcx, rbx
call fcn.2008fa70
lea rcx, [rsi + 0x90]
mov edx, dword [0x20544c9c]
lea r8d, [rdx + 0x51f6754c]
lea r9d, [rdx - 0x4d83a919]
add edx, 0x4adaf504
mov dword [rsp + 0x20], edx
mov rdx, rax
call fcn.200f1ed0
movzx edx, word [rdi + 0xc231]
mov dword [rsp + 0x20], 0x6c616445
mov rcx, rbx
mov r8d, 0x1658afa6
mov r9d, 0x872438d5
call fcn.2008fa70
lea rcx, [rsi + 0xb8]
mov dword [rsp + 0x20], 0x9c1c08d
mov rdx, rax
mov r8d, 0x10dd40d5
mov r9d, 0x71632270
call fcn.200f1ed0
movzx edx, word [rdi + 0xc233]
mov eax, dword [0x20544c9c]
lea r8d, [rax + 0x5771e41d]
lea r9d, [rax - 0x37c292b4]
add eax, 0xad7a98bc
mov dword [rsp + 0x20], eax
mov rcx, rbx
call fcn.2008fa70
lea rcx, [rsi + 0xe0]
mov dword [rsp + 0x20], 0x9c1c08d
mov rdx, rax
mov r8d, 0x10dd40d5
mov r9d, 0x71632270
call fcn.200f1ed0
movzx edx, word [rdi + 0xc235]
mov dword [rsp + 0x20], 0x6c616445
mov rcx, rbx
mov r8d, 0x1658afa6
mov r9d, 0x872438d5
call fcn.2008fa70
lea rcx, [rsi + 0x108]
mov dword [rsp + 0x20], 0x9c1c08d
mov rdx, rax
mov r8d, 0x10dd40d5
mov r9d, 0x71632270
call fcn.200f1ed0
movzx edx, word [rdi + 0xc237]
mov dword [rsp + 0x20], 0x6c616445
mov rcx, rbx
mov r8d, 0x1658afa6
mov r9d, 0x872438d5
call fcn.2008fa70
lea rcx, [rsi + 0x130]
mov dword [rsp + 0x20], 0x9c1c08d
mov rdx, rax
mov r8d, 0x10dd40d5
mov r9d, 0x71632270
call fcn.200f1ed0
mov qword [rdi + 0xc22b], 0
mov qword [rdi + 0xc231], 0
mov eax, dword [0x205b35d0]
add eax, dword [rdi]
mov ecx, eax
xor ecx, 0xffefffff
test ecx, eax
je 0x2010bf7d
movzx eax, byte [0x20544c98]
add al, 0xda
mov byte [rsi + 0x158], al
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x20112040
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x20544c9c]
mov r8d, eax
xor r8d, 0x41193477
and eax, 0x41193477
lea eax, [r8 + rax*2]
cmp ecx, eax
jne 0x2011208c
test edx, edx
je 0x201120bc
movzx eax, byte [0x2054495b]
cmp al, 0xe0
je 0x20112084
mov cl, 0x76
nop
mov al, 7
lock cmpxchg byte [0x2054495b], cl
je 0x2011211c
cmp al, 0xe0
jne 0x20112070
lea rax, [0x20544950]
ret
test edx, edx
je 0x201120ec
movzx eax, byte [0x2054490d]
cmp al, 0xcf
je 0x201120b4
mov cl, 0x5f
nop dword [rax]
mov al, 0xd4
lock cmpxchg byte [0x2054490d], cl
je 0x20112148
cmp al, 0xcf
jne 0x201120a0
lea rax, [0x20544900]
ret
movzx eax, byte [0x20544805]
cmp al, 0x42
je 0x201120e4
mov cl, 0x68
nop dword [rax]
mov al, 0xcb
lock cmpxchg byte [0x20544805], cl
je 0x2011219f
cmp al, 0x42
jne 0x201120d0
lea rax, [0x205447f0]
ret
movzx eax, byte [0x20544852]
cmp al, 0xe8
je 0x20112114
mov cl, 0x36
nop dword [rax]
mov al, 0xd8
lock cmpxchg byte [0x20544852], cl
je 0x20112210
cmp al, 0xe8
jne 0x20112100
lea rax, [0x20544850]
ret
xor eax, eax
lea rcx, [0x20544950]
lea rdx, [0x2046f580]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x20112178
inc rax
jmp 0x20112130
xor eax, eax
lea rcx, [0x20544900]
lea rdx, [0x2046f530]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x2011218f
inc rax
jmp 0x20112160
movzx eax, byte [0x20544c98]
add al, 0xb9
xchg byte [0x2054495b], al
lea rax, [0x20544950]
ret
mov al, 0xcf
xchg byte [0x2054490d], al
lea rax, [0x20544900]
ret
xor r8d, r8d
lea rax, [0x205447f0]
lea rcx, [0x2046f430]
mov edx, 0x41193478
nop word cs:[rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [r8 + rax]
xor r10b, r9b
mov byte [r8 + rax], r10b
mov r9d, dword [0x20544c9c]
add r9d, edx
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r8d, [r10 + r9*2]
cmp r8d, 0x15
jl 0x201121c0
movzx eax, byte [0x20544c98]
add al, 0x1b
xchg byte [0x20544805], al
lea rax, [0x205447f0]
ret
xor eax, eax
lea rcx, [0x20544850]
lea rdx, [0x2046f490]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x20112248
inc rax
jmp 0x20112220
mov al, 0xe8
xchg byte [0x20544852], al
lea rax, [0x20544850]
ret
Function at 0x20112660
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0x208d6b5d
test ecx, ecx
je 0x201126bc
add eax, dword [0x20544c9c]
cmp edx, eax
jne 0x201126fc
movzx eax, byte [0x205447c3]
mov ecx, r8d
xor cl, 0xe6
add cl, byte [0x20544c98]
cmp al, cl
je 0x201126b4
mov cl, 5
nop dword [rax + rax]
mov al, 0xbb
lock cmpxchg byte [0x205447c3], cl
je 0x201127af
cmp al, 0xf3
jne 0x201126a0
lea rax, [0x205447c0]
ret
add eax, dword [0x20544c9c]
cmp edx, eax
jne 0x20112738
movzx eax, byte [0x2054494c]
cmp al, 0xe7
je 0x201126f4
mov cl, 0xcd
nop word cs:[rax + rax]
mov al, 0x74
lock cmpxchg byte [0x2054494c], cl
je 0x20112838
cmp al, 0xe7
jne 0x201126e0
lea rax, [0x20544940]
ret
movzx eax, byte [0x205447e0]
cmp al, 0x5b
je 0x20112730
mov cl, 0x3e
nop dword [rax]
mov al, 0xc5
lock cmpxchg byte [0x205447e0], cl
je 0x20112800
mov edx, r8d
xor dl, 0x1e
add dl, byte [0x20544c98]
cmp al, dl
jne 0x20112710
lea rax, [0x205447d0]
ret
movzx eax, byte [0x205448f9]
nop
cmp al, 0xc7
je 0x201127a7
movzx ecx, byte [0x20544c98]
mov eax, r8d
xor al, 0x2d
mov edx, eax
xor dl, cl
and al, cl
add al, al
add al, dl
mov edx, r8d
xor dl, 0x45
add dl, cl
lock cmpxchg byte [0x205448f9], dl
jne 0x20112740
xor edx, edx
lea rax, [0x205448f0]
lea rcx, [0x2046f520]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 9
jl 0x20112780
mov al, 0xc7
xchg byte [0x205448f9], al
lea rax, [0x205448f0]
ret
xor eax, eax
lea rcx, [0x205447c0]
lea rdx, [0x2046f410]
mov r9d, r8d
xor r9d, 0x208d6b52
xor r8d, 0x208d6b50
cdqe
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
mov r10d, dword [0x20544c9c]
add eax, r9d
add eax, r10d
add r10d, r8d
cmp eax, r10d
jl 0x201127d0
mov al, 0xf3
xchg byte [0x205447c3], al
lea rax, [0x205447c0]
ret
xor eax, eax
lea rcx, [0x205447d0]
lea rdx, [0x2046f420]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x20112828
inc rax
jmp 0x20112810
mov al, 0x5b
xchg byte [0x205447e0], al
lea rax, [0x205447d0]
ret
xor eax, eax
lea rcx, [0x20544940]
lea rdx, [0x2046f570]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xb
jg 0x20112868
inc rax
jmp 0x20112850
mov al, 0xe7
xchg byte [0x2054494c], al
lea rax, [0x20544940]
ret
Function at 0x20112880
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x201128c4
movzx eax, byte [0x2054496c]
cmp al, 0xb4
je 0x201128bc
mov cl, 0xc
nop word cs:[rax + rax]
mov al, 0xb2
lock cmpxchg byte [0x2054496c], cl
je 0x201128f8
mov edx, r9d
xor dl, 0xa0
add dl, byte [0x20544c98]
cmp al, dl
jne 0x201128a0
lea rax, [0x20544960]
ret
movzx eax, byte [0x2054493b]
mov ecx, r9d
xor cl, 0x57
add cl, byte [0x20544c98]
cmp al, cl
je 0x201128f0
mov cl, 0x71
nop dword [rax]
mov al, 0x24
lock cmpxchg byte [0x2054493b], cl
je 0x2011294b
cmp al, 0xa1
jne 0x201128e0
lea rax, [0x20544930]
ret
xor edx, edx
lea rax, [0x20544960]
lea rcx, [0x2046f590]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0xb87bd4b7
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0x47842b49
cmp edx, 0xc
jl 0x20112910
mov al, 0xb4
xchg byte [0x2054496c], al
lea rax, [0x20544960]
ret
xor eax, eax
lea rcx, [0x20544930]
lea rdx, [0x2046f560]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x20112978
inc rax
jmp 0x20112960
xor r9b, 0x57
add r9b, byte [0x20544c98]
xchg byte [0x2054493b], r9b
lea rax, [0x20544930]
ret
Function at 0x201129e0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x20112a2c
test edx, edx
je 0x20112a5c
movzx eax, byte [0x205447b3]
mov ecx, r8d
xor cl, 0x99
add cl, byte [0x20544c98]
cmp al, cl
je 0x20112a24
mov cl, 0xa2
nop word cs:[rax + rax]
mov al, 0x46
lock cmpxchg byte [0x205447b3], cl
je 0x20112abc
cmp al, 0xd
jne 0x20112a10
lea rax, [0x205447b0]
ret
test edx, edx
je 0x20112a8c
movzx eax, byte [0x2054489f]
cmp al, 7
je 0x20112a54
mov cl, 0x77
nop dword [rax]
mov al, 0x47
lock cmpxchg byte [0x2054489f], cl
je 0x20112b11
cmp al, 7
jne 0x20112a40
lea rax, [0x20544890]
ret
movzx eax, byte [0x205447a2]
cmp al, 0x63
je 0x20112a84
mov cl, 5
nop dword [rax]
mov al, 0x6f
lock cmpxchg byte [0x205447a2], cl
je 0x20112b6f
cmp al, 0x63
jne 0x20112a70
lea rax, [0x205447a0]
ret
movzx eax, byte [0x20544822]
cmp al, 0x8f
je 0x20112ab4
mov cl, 0x58
nop dword [rax]
mov al, 0x84
lock cmpxchg byte [0x20544822], cl
je 0x20112bb9
cmp al, 0x8f
jne 0x20112aa0
lea rax, [0x20544810]
ret
xor eax, eax
lea rcx, [0x205447b0]
lea rdx, [0x2046f400]
xor r8d, 0xbed3ba05
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x20544c9c]
add r10d, r8d
cmp r9d, r10d
jge 0x20112b01
inc rax
jmp 0x20112ae0
mov al, 0xd
xchg byte [0x205447b3], al
lea rax, [0x205447b0]
ret
xor edx, edx
lea rax, [0x20544890]
lea rcx, [0x2046f4c0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xf
jl 0x20112b30
mov al, 7
xchg byte [0x2054489f], al
lea rax, [0x20544890]
ret
xor edx, edx
lea rax, [0x205447a0]
lea rcx, [0x2046f3f0]
nop
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
cmp edx, 2
jl 0x20112b80
xor r8b, 0x43
add r8b, byte [0x20544c98]
xchg byte [0x205447a2], r8b
lea rax, [0x205447a0]
ret
xor eax, eax
lea rcx, [0x20544810]
lea rdx, [0x2046f450]
mov r9d, r8d
xor r9d, 0x26839010
xor r8d, 0x99786ee7
and r9d, 0x27abd411
lea r8d, [r8 + r9*2]
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x20544c9c]
add r10d, r8d
add r10d, 0xd8542bef
cmp r9d, r10d
jge 0x20112c18
inc rax
jmp 0x20112bf0
mov al, 0x8f
xchg byte [0x20544822], al
lea rax, [0x20544810]
ret
Function at 0x2011ef80
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x205b3a00]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
nop
mov eax, dword [0x205b3a04]
cmp eax, 0x3a
jg 0x2011ef90
test ecx, ecx
je 0x2011efb2
movzx eax, byte [0x20545b32]
cmp al, 0xa8
jne 0x2011f012
lea rax, [0x20545b20]
ret
movzx eax, byte [0x20545855]
movzx ecx, byte [0x20546380]
add cl, 0xe7
cmp al, cl
je 0x2011f00a
nop word [rax + rax]
movzx ecx, byte [0x20546380]
mov eax, ecx
mov edx, ecx
mov r8d, ecx
xor r8b, 0x27
and r8b, cl
xor cl, 0x7b
and al, 0x7b
add al, al
add al, cl
xor dl, 0x58
add r8b, r8b
add r8b, dl
lock cmpxchg byte [0x20545855], r8b
je 0x2011f161
cmp al, 0xab
jne 0x2011efd0
lea rax, [0x20545840]
ret
mov ecx, 0xa5c3331b
mov dl, 0x23
mov r8d, 0xa5c33374
nop
mov eax, dword [0x205b3a00]
lea r9d, [rax - 1]
imul r9d, eax
and r9d, 1
mov eax, dword [0x20546384]
add eax, ecx
cmp r9d, eax
jne 0x2011f080
mov al, 0xe2
lock cmpxchg byte [0x20545b32], dl
sete r9b
mov r10d, dword [0x205b3a04]
mov r11d, dword [0x20546384]
add r11d, r8d
cmp r10d, r11d
jge 0x2011f080
test r9b, r9b
jne 0x2011f097
cmp al, 0xa8
jne 0x2011f020
jmp 0x2011efaa
mov al, 0xe2
lock cmpxchg byte [0x20545b32], dl
mov eax, dword [0x205b3a04]
cmp eax, 0xa
jge 0x2011f020
jmp 0x2011f03f
xor eax, eax
lea rcx, [0x20545b20]
lea rdx, [0x204705e0]
nop word [rax + rax]
cdqe
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
not r9b
mov r11d, r10d
xor r11b, r9b
and r11b, r10b
and r9b, r8b
or r9b, r11b
mov byte [rax + rcx], r9b
mov r8d, dword [0x20546384]
mov r9d, r8d
xor r9d, 0xa5c3331c
and r8d, 0x25c3331c
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 0x12
jl 0x2011f0b0
xor eax, eax
nop
test al, al
je 0x2011f10f
mov ecx, dword [0x205b3a04]
cmp ecx, 0x55
jge 0x2011f100
mov ecx, dword [0x205b3a00]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
jne 0x2011f104
xor eax, eax
nop word cs:[rax + rax]
mov ecx, dword [0x205b3a04]
cmp ecx, 0x2a
jg 0x2011f14b
mov cl, 0xa8
xchg byte [0x20545b32], cl
test al, al
je 0x2011efaa
mov cl, 0xa8
xchg byte [0x20545b32], cl
cmp dword [0x20546384], 0x5a3ccce5
jne 0x2011f130
jmp 0x2011f13b
xor edx, edx
lea rax, [0x20545840]
lea rcx, [0x20470330]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, dword [0x20546384]
mov r9d, r8d
xor r9d, 0xa5c3331c
and r8d, 0x25c3331c
lea r8d, [r9 + r8*2]
mov r9d, r8d
xor r9d, r9d
not r9d
and r9d, edx
xor r9d, r8d
and edx, r8d
lea edx, [r9 + rdx*2]
cmp edx, 0x15
jl 0x2011f180
mov al, 0xab
xchg byte [0x20545855], al
lea rax, [0x20545840]
ret
Function at 0x2011f420
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x2011f45c
movzx eax, byte [0x20545a79]
cmp al, 0x21
je 0x2011f454
mov cl, 0x48
nop word cs:[rax + rax]
mov al, 0x70
lock cmpxchg byte [0x20545a79], cl
je 0x2011f4dc
cmp al, 0x21
jne 0x2011f440
lea rax, [0x20545a70]
ret
mov eax, dword [0x20546384]
mov ecx, eax
xor ecx, 0xa5c3331b
and eax, 0x25c3331b
lea eax, [rcx + rax*2]
cmp edx, eax
jne 0x2011f4ac
movzx eax, byte [0x20545953]
cmp al, 0xa9
je 0x2011f4a4
mov cl, 0xf4
nop word cs:[rax + rax]
mov al, 0x24
lock cmpxchg byte [0x20545953], cl
je 0x2011f55e
cmp al, 0xa9
jne 0x2011f490
lea rax, [0x20545950]
ret
movzx eax, byte [0x20545b1d]
cmp al, 0x14
je 0x2011f4d4
mov cl, 0xfb
nop dword [rax]
mov al, 0xcc
lock cmpxchg byte [0x20545b1d], cl
je 0x2011f588
cmp al, 0x14
jne 0x2011f4c0
lea rax, [0x20545b10]
ret
xor edx, edx
lea rax, [0x20545a70]
lea rcx, [0x20470530]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r8d
not r10b
mov r11d, r9d
xor r11b, r10b
and r10b, r9b
not r11b
and r11b, r8b
or r11b, r10b
mov byte [rdx + rax], r11b
mov r8d, edx
xor r8d, 0x7ffffffe
and r8d, edx
xor edx, 1
lea edx, [rdx + r8*2]
mov r8d, dword [0x20546384]
mov r9d, r8d
xor r9d, 0xa5c33324
and r8d, 0x25c33324
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x2011f4f0
mov al, 0x21
xchg byte [0x20545a79], al
lea rax, [0x20545a70]
ret
xor eax, eax
lea rcx, [0x20545950]
lea rdx, [0x20470430]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x2011f5b8
inc rax
jmp 0x2011f570
xor eax, eax
lea rcx, [0x20545b10]
lea rdx, [0x204705d0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x2011f5c8
inc rax
jmp 0x2011f5a0
mov al, 0xa9
xchg byte [0x20545953], al
lea rax, [0x20545950]
ret
mov al, 0x14
xchg byte [0x20545b1d], al
lea rax, [0x20545b10]
ret
Function at 0x201203c0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x2012040c
test edx, edx
je 0x2012043c
movzx eax, byte [0x205459d8]
mov ecx, r8d
xor cl, 0x44
add cl, byte [0x20546380]
cmp al, cl
je 0x20120404
mov cl, 0x11
nop word cs:[rax + rax]
mov al, 0x8c
lock cmpxchg byte [0x205459d8], cl
je 0x201204b8
cmp al, 0xe9
jne 0x201203f0
lea rax, [0x205459c0]
ret
test edx, edx
je 0x20120478
movzx eax, byte [0x20545b0d]
cmp al, 0xb7
je 0x20120434
mov cl, 0x12
nop dword [rax]
mov al, 0x54
lock cmpxchg byte [0x20545b0d], cl
je 0x20120502
cmp al, 0xb7
jne 0x20120420
lea rax, [0x20545b00]
ret
movzx eax, byte [0x205458d6]
cmp al, 0x1a
je 0x20120470
mov cl, 0x1b
nop dword [rax]
mov al, 0xec
lock cmpxchg byte [0x205458d6], cl
je 0x2012054f
mov edx, r8d
xor dl, 0x37
add dl, byte [0x20546380]
cmp al, dl
jne 0x20120450
lea rax, [0x205458c0]
ret
movzx eax, byte [0x20545a8d]
cmp al, 0x1c
je 0x201204b0
mov cl, 0xf5
nop word cs:[rax + rax]
mov al, 0x8d
lock cmpxchg byte [0x20545a8d], cl
je 0x20120592
mov edx, r8d
xor dl, 0x39
add dl, byte [0x20546380]
cmp al, dl
jne 0x20120490
lea rax, [0x20545a80]
ret
xor eax, eax
lea rcx, [0x205459c0]
lea rdx, [0x20470490]
nop dword [rax + rax]
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0x17
jg 0x201204e8
inc rax
jmp 0x201204d0
xor r8b, 0x44
add r8b, byte [0x20546380]
xchg byte [0x205459d8], r8b
lea rax, [0x205459c0]
ret
xor edx, edx
lea rax, [0x20545b00]
lea rcx, [0x204705c0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x20120520
mov al, 0xb7
xchg byte [0x20545b0d], al
lea rax, [0x20545b00]
ret
xor eax, eax
lea rcx, [0x205458c0]
lea rdx, [0x204703b0]
nop
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0x15
jg 0x20120578
inc rax
jmp 0x20120560
xor r8b, 0x37
add r8b, byte [0x20546380]
xchg byte [0x205458d6], r8b
lea rax, [0x205458c0]
ret
xor edx, edx
lea rax, [0x20545a80]
lea rcx, [0x20470540]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
not r8b
mov r10d, r8d
and r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, edx
not r8d
mov r9d, r8d
and r9d, 1
mov r10d, edx
and r10d, 0xfffffffe
or r10d, r9d
xor edx, 1
and r8d, 0x7ffffffe
or r8d, edx
not r8d
lea edx, [r10 + r8*2]
cmp edx, 0xd
jl 0x201205b0
mov al, 0x1c
xchg byte [0x20545a8d], al
lea rax, [0x20545a80]
ret