joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007c8b0
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rsi, rbx
xchg rdx, rbp
mov qword [rsp + 0x10], rbp
xchg rbp, rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x1e]
mov rdx, rbx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x10
xor byte [rbx + rax], 0x4f
sub byte [rbx + rax], 0xa
xor byte [rbx + rax], 0x44
sub byte [rbx + rax], 5
sub byte [rbx + rax], 0xc
inc rax
cmp rax, 0x38
jb 0x14007c8e3
xchg r10, rax
mov r10, rdi
xchg r10, rax
xchg r10, rbx
mov r10, qword [rsp + 0x30]
xchg r10, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007c930
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rbx
mov qword [rsp + 0x10], rbx
xchg rdx, rbx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, r14
mov rdi, r14
xchg rcx, r14
lea rbx, [rdx + 0x20]
xchg rbx, r11
mov rdx, r11
xchg rbx, r11
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x6a
sub byte [rbx + rax], 0x56
xor byte [rbx + rax], 0x7d
sub byte [rbx + rax], 0x61
add byte [rbx + rax], 0x20
sub byte [rbx + rax], 0x28
inc rax
cmp rax, 0x3e
jb 0x14007c96b
xchg rsi, rax
mov rsi, rdi
xchg rsi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rax
push rdx
push rbx
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007ca40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r13
mov qword [rsp + 0x10], r13
xchg r13, rdx
push rax
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x22]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x53
sub byte [rbx + rax], 0x52
add byte [rbx + rax], 0x63
xor byte [rbx + rax], 0x5c
add byte [rbx + rax], 0x1c
sub byte [rbx + rax], 0x2e
add byte [rbx + rax], 0x29
sub byte [rbx + rax], 0xd
xor byte [rbx + rax], 0x42
inc rax
cmp rax, 0x42
jb 0x14007ca71
xchg r12, rax
mov r12, rdi
xchg r12, rax
xchg r14, rbx
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007cb40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r12
mov qword [rsp + 0x10], r12
xchg r12, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x28]
xchg rbx, rbp
mov rdx, rbp
xchg rbx, rbp
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x66
sub byte [rbx + rax], 0x1b
xor byte [rbx + rax], 0x41
sub byte [rbx + rax], 9
add byte [rbx + rax], 0x6b
sub byte [rbx + rax], 0x6c
inc rax
cmp rax, 0x4c
jb 0x14007cb75
xchg rbx, rdi
mov rax, rbx
xchg rbx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14007cbc0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rbx, rdx
xchg r9, rdx
mov qword [rsp + 0x10], r9
xchg r9, rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x2a]
xchg r15, rbx
mov rdx, r15
xchg r15, rbx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x60
xor byte [rbx + rax], 0x27
xor byte [rbx + rax], 0x32
add byte [rbx + rax], 9
sub byte [rbx + rax], 0x6a
add byte [rbx + rax], 0
sub byte [rbx + rax], 0x14
inc rax
cmp rax, 0x50
jb 0x14007cbf3
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cc40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdi, rdx
mov qword [rsp + 0x10], rdi
xchg rdi, rdx
nop
push 0x307342a5
mov qword [rsp], rdi
sub rsp, 0x20
xchg r14, rdi
mov r14, rcx
xchg rdi, r14
lea rbx, [rdx + 0x2a]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x61
sub byte [rbx + rax], 0x49
add byte [rbx + rax], 0x30
add byte [rbx + rax], 0x20
xor byte [rbx + rax], 0x14
sub byte [rbx + rax], 0x7c
inc rax
cmp rax, 0x52
jb 0x14007cc7c
xchg r9, rdi
mov rax, r9
xchg r9, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rbx
xchg qword [rsp + 0x10], rdi
pop rbx
pop rcx
add rsp, 8
ret

Function at 0x14007ccc0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 8], r14
xchg r14, rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rsi, rdi
mov rsi, rcx
xchg rsi, rdi
lea rbx, [rdx + 0x2c]
xchg r9, rdx
mov r9, rbx
xchg r9, rdx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x21
add byte [rbx + rax], 0x46
xor byte [rbx + rax], 0x75
xor byte [rbx + rax], 0x54
sub byte [rbx + rax], 0x41
sub byte [rbx + rax], 5
inc rax
cmp rax, 0x54
jb 0x14007ccfb
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007cd40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r8, rdi
mov r8, rcx
xchg r8, rdi
lea rbx, [rdx + 0x2e]
xchg rbx, rcx
mov rdx, rcx
xchg rcx, rbx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x62
xor byte [rbx + rax], 0x67
add byte [rbx + rax], 0x76
sub byte [rbx + rax], 0x5e
xor byte [rbx + rax], 0x47
sub byte [rbx + rax], 0xf
sub byte [rbx + rax], 0x2e
sub byte [rbx + rax], 0x1d
inc rax
cmp rax, 0x58
jb 0x14007cd75
mov rax, rdi
xchg rbx, r15
mov r15, qword [rsp + 0x30]
xchg rbx, r15
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007cdd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rsi
mov rdi, rsi
xchg rsi, rcx
lea rbx, [rdx + 0x2e]
mov rdx, rbx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x51
sub byte [rbx + rax], 0x2d
xor byte [rbx + rax], 0x41
sub byte [rbx + rax], 0x10
add byte [rbx + rax], 0x28
xor byte [rbx + rax], 0x6d
sub byte [rbx + rax], 0x10
inc rax
cmp rax, 0x5a
jb 0x14007cdf7
mov rax, rdi
xchg rdx, rbx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007ce50
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rdi, rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x30]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x2f
sub byte [rbx + rax], 0xa
xor byte [rbx + rax], 0x2a
xor byte [rbx + rax], 0xf
xor byte [rbx + rax], 0x35
xor byte [rbx + rax], 0x18
sub byte [rbx + rax], 0x17
add byte [rbx + rax], 0x5e
sub byte [rbx + rax], 0x74
inc rax
cmp rax, 0x5c
jb 0x14007ce8b
mov rax, rdi
xchg r14, rbx
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x14007cee0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r15, rdx
mov qword [rsp + 0x10], r15
xchg r15, rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x30]
xchg r15, rbx
mov rdx, r15
xchg rbx, r15
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x19
add byte [rbx + rax], 0x3b
xor byte [rbx + rax], 0x6f
xor byte [rbx + rax], 0x45
sub byte [rbx + rax], 0x70
add byte [rbx + rax], 0x4d
sub byte [rbx + rax], 0x5b
inc rax
cmp rax, 0x5e
jb 0x14007cf13
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rax
xchg qword [rsp + 0x10], rdi
pop rax
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cf60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r12
mov qword [rsp + 0x10], r12
xchg r12, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rsi, rdi
mov rsi, rcx
xchg rdi, rsi
lea rbx, [rdx + 0x32]
mov rdx, rbx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x53
sub byte [rbx + rax], 0x36
add byte [rbx + rax], 0x3c
sub byte [rbx + rax], 0x3d
xor byte [rbx + rax], 9
sub byte [rbx + rax], 0x15
inc rax
cmp rax, 0x60
jb 0x14007cf95
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, r10
mov r10, qword [rsp + 0x30]
xchg r10, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007cfe0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r11
mov qword [rsp + 0x10], r11
xchg rdx, r11
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x34]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x32
add byte [rbx + rax], 0x47
xor byte [rbx + rax], 0x3a
sub byte [rbx + rax], 0xc
add byte [rbx + rax], 0x1e
xor byte [rbx + rax], 0x59
add byte [rbx + rax], 4
xor byte [rbx + rax], 0x10
inc rax
cmp rax, 0x64
jb 0x14007d00d
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rdx, rbx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x14007d060
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 8], r14
xchg r14, rbx
xchg rdx, r12
mov qword [rsp + 0x10], r12
xchg rdx, r12
nop
push 0x1c6b615d
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x38]
mov rdx, rbx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x62
xor byte [rbx + rax], 0x53
xor byte [rbx + rax], 0xc
sub byte [rbx + rax], 0x1c
xor byte [rbx + rax], 3
add byte [rbx + rax], 0x19
sub byte [rbx + rax], 9
sub byte [rbx + rax], 0x32
inc rax
cmp rax, 0x6e
jb 0x14007d09c
mov rax, rdi
xchg rbx, rcx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d0f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rsi, rcx
mov rdi, rsi
xchg rcx, rsi
lea rbx, [rdx + 0x4e]
xchg rsi, rdx
mov rsi, rbx
xchg rdx, rsi
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x31
add byte [rbx + rax], 0x3a
add byte [rbx + rax], 0xc
xor byte [rbx + rax], 0x5b
xor byte [rbx + rax], 0x49
sub byte [rbx + rax], 0x65
inc rax
cmp rax, 0x98
jb 0x14007d126
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rdx
push rcx
push rcx
push rcx
push rbx
push rax
push rcx
xchg qword [rsp + 0x40], rdi
pop rcx
pop rax
pop rbx
pop rcx
pop rcx
pop rcx
pop rdx
pop rcx
add rsp, 8
ret

Function at 0x14007d180
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 8], r15
xchg r15, rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rbp, rcx
mov rdi, rbp
xchg rbp, rcx
lea rbx, [rdx + 0x56]
mov rdx, rbx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x35
xor byte [rbx + rax], 0x77
add byte [rbx + rax], 0x2c
xor byte [rbx + rax], 3
add byte [rbx + rax], 0xf
sub byte [rbx + rax], 0x72
xor byte [rbx + rax], 0x79
sub byte [rbx + rax], 0x73
inc rax
cmp rax, 0xa8
jb 0x14007d1b5
mov rax, rdi
xchg r9, rbx
mov r9, qword [rsp + 0x30]
xchg r9, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret
Function at 0x14007d200
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r9, rdx
mov qword [rsp + 0x10], r9
xchg rdx, r9
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x5a]
mov rdx, rbx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x4f
sub byte [rbx + rax], 0x1f
add byte [rbx + rax], 0x3e
sub byte [rbx + rax], 0x40
add byte [rbx + rax], 0x27
sub byte [rbx + rax], 0x22
add byte [rbx + rax], 9
xor byte [rbx + rax], 0x71
sub byte [rbx + rax], 0x4d
inc rax
cmp rax, 0xb0
jb 0x14007d236
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d290
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x70]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x3d
add byte [rbx + rax], 0x2a
xor byte [rbx + rax], 0x53
add byte [rbx + rax], 0x2f
sub byte [rbx + rax], 0x2b
xor byte [rbx + rax], 0x4a
sub byte [rbx + rax], 0x6f
sub byte [rbx + rax], 3
inc rax
cmp rax, 0xdc
jb 0x14007d2c0
xchg r13, rax
mov r13, rdi
xchg r13, rax
xchg r11, rbx
mov r11, qword [rsp + 0x30]
xchg r11, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d320
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rbx
mov qword [rsp + 8], r15
xchg rbx, r15
xchg rdx, r10
mov qword [rsp + 0x10], r10
xchg r10, rdx
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x70]
mov rdx, rbx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x68
xor byte [rbx + rax], 0x20
xor byte [rbx + rax], 0x66
add byte [rbx + rax], 4
add byte [rbx + rax], 0x42
sub byte [rbx + rax], 0x54
sub byte [rbx + rax], 0x20
inc rax
cmp rax, 0xde
jb 0x14007d353
xchg r10, rax
mov r10, rdi
xchg r10, rax
xchg r10, rbx
mov r10, qword [rsp + 0x30]
xchg rbx, r10
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d3b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x76]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x22
add byte [rbx + rax], 7
add byte [rbx + rax], 0x3b
sub byte [rbx + rax], 0x38
xor byte [rbx + rax], 0x21
add byte [rbx + rax], 0x36
sub byte [rbx + rax], 0x33
sub byte [rbx + rax], 0x10
inc rax
cmp rax, 0xea
jb 0x14007d3e6
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rbx
push rbx
push rcx
push rbx
push rdx
push rax
push rax
xchg qword [rsp + 0x40], rdi
pop rax
pop rax
pop rdx
pop rbx
pop rcx
pop rbx
pop rbx
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d440
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rbx
mov qword [rsp + 8], r8
xchg r8, rbx
xchg rdx, r9
mov qword [rsp + 0x10], r9
xchg rdx, r9
push rdi
sub rsp, 0x20
xchg rcx, r12
mov rdi, r12
xchg r12, rcx
lea rbx, [rdx + 0x7c]
mov rdx, rbx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x7e
xor byte [rbx + rax], 0x11
sub byte [rbx + rax], 0x3f
add byte [rbx + rax], 0xf
add byte [rbx + rax], 0x32
sub byte [rbx + rax], 0x42
xor byte [rbx + rax], 0x2f
inc rax
cmp rax, 0xf4
jb 0x14007d473
mov rax, rdi
xchg r15, rbx
mov r15, qword [rsp + 0x30]
xchg r15, rbx
add rsp, 0x20
push rax
push rax
push rbx
push rdx
push rbx
xchg qword [rsp + 0x28], rdi
pop rbx
pop rdx
pop rbx
pop rax
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d560
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0xc]
xchg r14, rbx
mov rdx, r14
xchg r14, rbx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x22
add byte [rbx + rax], 0xf
add byte [rbx + rax], 0x46
sub byte [rbx + rax], 0x1d
sub byte [rbx + rax], 0x1c
sub byte [rbx + rax], 0x14
sub byte [rbx + rax], 6
xor byte [rbx + rax], 0x24
inc rax
cmp rax, 0x14
jb 0x14007d58d
xchg r9, rdi
mov rax, r9
xchg r9, rdi
xchg rbx, r15
mov r15, qword [rsp + 0x30]
xchg r15, rbx
add rsp, 0x20
push rax
push rax
xchg qword [rsp + 0x10], rdi
pop rax
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d5f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r9
mov qword [rsp + 0x10], r9
xchg r9, rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xe]
xchg r14, rdx
mov r14, rbx
xchg rdx, r14
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x2c
add byte [rbx + rax], 0xf
add byte [rbx + rax], 0x2e
xor byte [rbx + rax], 0x22
sub byte [rbx + rax], 0xd
xor byte [rbx + rax], 0x40
sub byte [rbx + rax], 0x7e
inc rax
cmp rax, 0x18
jb 0x14007d61d
xchg rbp, rax
mov rbp, rdi
xchg rbp, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rdx
push rbx
push rax
push rcx
push rbx
xchg qword [rsp + 0x30], rdi
pop rbx
pop rcx
pop rax
pop rbx
pop rdx
pop rax
add rsp, 8
ret

Function at 0x14007d670
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xe]
mov rdx, rbx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x19
add byte [rbx + rax], 0x2e
xor byte [rbx + rax], 0x7b
sub byte [rbx + rax], 2
add byte [rbx + rax], 0xa
sub byte [rbx + rax], 0x44
inc rax
cmp rax, 0x1a
jb 0x14007d699
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rax
push rdx
push rcx
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140084070
Capabilities:
Encode data using xor

Disassembly:
mov rax, r8
cmp rcx, rdx
je 0x1400841ca
xchg rcx, rax
mov r9, rcx
xchg rcx, rax
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
xchg rdi, rax
movups xmmword [rdi], xmm0
xchg rdi, rax
xchg r12, r10
mov qword [r9 + r8 - 0x70], r12
xchg r12, r10
xchg r10, r14
mov qword [r9 + r8 - 0x68], r14
xchg r10, r14
movups xmm0, xmmword [r8 - 0x80]
movups xmmword [rax], xmm0
xchg r8, rdi
movups xmm1, xmmword [rdi - 0x70]
xchg r8, rdi
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm1
xchg rbp, r10
mov qword [r8 - 0x70], rbp
xchg r10, rbp
sub rax, 0xffffffffffffffb8
mov qword [r8 - 0x68], 0x481b6d0d
sub qword [r8 - 0x68], 0x3558d088
add qword [r8 - 0x68], 0x14a1cf21
sub qword [r8 - 0x68], 0x177819ab
add qword [r8 - 0x68], 0x531c366a
xor qword [r8 - 0x68], 0x1b73eb09
sub qword [r8 - 0x68], 0x787b6365
mov word [r8 - 0x80], r10w
xchg r9, rdi
movups xmmword [rdi + r8 - 0x60], xmm0
xchg r9, rdi
xchg r10, r13
mov qword [r9 + r8 - 0x50], r13
xchg r13, r10
xchg r10, rbx
mov qword [r9 + r8 - 0x48], rbx
xchg rbx, r10
xchg r8, r11
movups xmm0, xmmword [r11 - 0x60]
xchg r8, r11
movups xmmword [r9 + r8 - 0x60], xmm0
xchg rbx, r8
movups xmm1, xmmword [rbx - 0x50]
xchg r8, rbx
xchg rdi, r9
movups xmmword [rdi + r8 - 0x50], xmm1
xchg rdi, r9
xchg rdi, r10
mov qword [r8 - 0x50], rdi
xchg r10, rdi
mov qword [r8 - 0x48], 0x11a312d9
add qword [r8 - 0x48], 0x46832df9
sub qword [r8 - 0x48], 0x37ecec12
add qword [r8 - 0x48], 0x30bfeae6
xor qword [r8 - 0x48], 0x767c8367
add qword [r8 - 0x48], 0x16b2247d
xor qword [r8 - 0x48], 0x170831a5
sub qword [r8 - 0x48], 0x2a3fd094
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x140084094
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140084310
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rax
mov r13, r8
xchg r13, rax
cmp rcx, rdx
je 0x1400843e7
xchg rsi, r9
mov rsi, rax
xchg rsi, r9
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
movups xmmword [rax], xmm0
xchg r10, r15
mov qword [r9 + r8 - 0x28], r15
xchg r15, r10
lea rcx, [r8 - 0x18]
mov qword [r8 + r9 - 0x20], r10
xchg rbp, r8
movups xmm0, xmmword [rbp - 0x38]
xchg rbp, r8
xchg r8, rax
movups xmmword [r8], xmm0
xchg r8, rax
xchg r11, r8
movups xmm1, xmmword [r11 - 0x28]
xchg r11, r8
xchg r10, rax
movups xmmword [r10 + 0x10], xmm1
xchg r10, rax
xchg r10, rdi
mov qword [r8 - 0x28], rdi
xchg r10, rdi
nop
add rax, 0x37c6dbce
sub rax, 0x37c6dbae
mov qword [r8 - 0x20], 0x24af0657
xor qword [r8 - 0x20], 0x4f9916b4
xor qword [r8 - 0x20], 0xda177f8
sub qword [r8 - 0x20], 0x566c5903
add qword [r8 - 0x20], 0x61b1800f
xor qword [r8 - 0x20], 0x4086397c
sub qword [r8 - 0x20], 0x2129e91e
sub qword [r8 - 0x20], 0x1030ce36
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x14008433e
ret
Function at 0x14008e730
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0xa], 0x78
xor byte [rcx + rax + 0xa], 0x4f
add byte [rcx + rax + 0xa], 0x10
add byte [rcx + rax + 0xa], 0xc
sub byte [rcx + rax + 0xa], 0x2c
add byte [rcx + rax + 0xa], 0x39
xor byte [rcx + rax + 0xa], 0x50
xor byte [rcx + rax + 0xa], 0x78
sub byte [rcx + rax + 0xa], 0x48
inc rax
cmp rax, 0x10
jb 0x14008e732
ret

Function at 0x14008e860
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0x14], 0x2c
add byte [rcx + rax + 0x14], 0x3c
sub byte [rcx + rax + 0x14], 0x52
add byte [rcx + rax + 0x14], 0x28
xor byte [rcx + rax + 0x14], 0x7c
sub byte [rcx + rax + 0x14], 0xe
xor byte [rcx + rax + 0x14], 0x34
inc rax
cmp rax, 0x24
jb 0x14008e862
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140199970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
nop
sub rsp, 8
mov qword [rsp], r13
sub rsp, 0x30
xor ebx, ebx
mov r13d, r8d
xchg rdi, rbx
mov rbx, rdx
xchg rdi, rbx
test rdx, rdx
jne 0x14019999e
mov eax, ebx
jmp 0x1401999e2
mov eax, 0x6b217b1a
sub eax, 0xfeafa57
xor eax, 0x4668adaf
add eax, 0x38d59b90
sub eax, 0x2704d64c
sub eax, 0x2f2e9863
cmp word [rdx], ax
je 0x1401999d1
xchg rdx, rax
mov rdx, rbx
xchg rdx, rax
jmp 0x1401999e2
movsxd rax, dword [rdx + 0x3c]
add rax, rdi
cmp dword [rax], 0x4550
cmovne rax, rbx
xchg rbp, rdi
mov qword [rsp + 0x50], rdi
xchg rdi, rbp
mov ecx, 0x12ac30ab
add ecx, 0x359161a0
add ecx, 0x7f84fbe
sub ecx, 0x300a8bc7
add ecx, 0x4c9e22a6
sub ecx, 0x5790f1f0
add ecx, 0x654be964
sub ecx, 0x1ff5dd1f
sub ecx, 0x5a8e9132
mov qword [rsp + 0x58], rsi
xchg rsi, r12
mov qword [rsp + 0x60], rsi
xchg rsi, r12
xchg r14, r11
mov qword [rsp + 0x28], r11
xchg r11, r14
xchg r8, r15
mov qword [rsp + 0x20], r8
xchg r8, r15
cmp word [rax + 0x18], cx
jne 0x140199abc
mov esi, dword [rax + 0x88]
add rsi, rdi
je 0x140199abc
mov r14d, dword [rsi + 0x1c]
mov r15d, dword [rsi + 0x24]
add r14, rdi
mov r12d, dword [rsi + 0x20]
add r15, rdi
add r12, rdi
cmp dword [rsi + 0x18], 0
jbe 0x140199abc
nop dword [rax]
nop dword [rax + rax]
mov eax, ebx
xor edx, edx
mov ecx, dword [r12 + rax*4]
movzx eax, word [r15 + rax*2]
add rcx, rdi
mov ebp, dword [r14 + rax*4]
add rbp, rdi
call fcn.1400763f0
cmp eax, r13d
je 0x140199b01
inc ebx
cmp ebx, dword [rsi + 0x18]
jb 0x140199a8c
xor eax, eax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
xchg r10, rbp
mov r10, qword [rsp + 0x50]
xchg rbp, r10
add rsp, 0x30
push rax
push rdx
xchg qword [rsp + 0x10], r13
pop rdx
pop rax
add rsp, 8
nop
xchg qword [rsp], rdi
add rsp, 8
nop
mov rbx, qword [rsp]
add rsp, 8
ret
mov rax, rbp
jmp 0x140199abe
Function at 0x1401ab660
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r11, rdx
xchg r10, r11
mov r11, rcx
xchg r10, r11
test rdx, rdx
je 0x1401ab6d8
mov qword [rsp], rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1401ab6cb
movzx eax, byte [r10]
test bl, bl
je 0x1401ab6ad
lea rcx, [r9 - 1]
xchg rdx, r9
mov r9, rdx
xchg rdx, r9
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1401ab69c
jmp 0x1401ab6cb
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1401ab6bc
inc r10
sub r11, 1
jne 0x1401ab67e
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]