joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400711d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
lea r10, [rsp + 0x3d]
mov r8d, edx
xchg rcx, rbx
mov rcx, rbx
xchg rcx, rbx
test edx, edx
jns 0x14007127e
neg r8d
nop dword [rax + rax]
dec r10
mov eax, 0x3a797868
add eax, 0x192735a6
sub eax, 0x34bdb398
xor eax, 0x5f83cd02
sub eax, 0x3ce3cab3
add eax, 0x522cad31
sub eax, 0x31161f2f
add eax, 0xa738d20a
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
neg r8b
add r8b, 0xd0
neg r8b
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x1400711fa
dec r10
mov byte [r10], 6
add byte [r10], 0x6a
sub byte [r10], 0x61
xor byte [r10], 0x23
xor byte [r10], 0xf
add byte [r10], 0xa
jmp 0x1400712d1
dec r10
mov eax, 0x19cc2613
add eax, 0x2bdd9db1
add eax, 0x2c3261ba
xor eax, 0x248375d9
xor eax, 0x685d3b74
xor eax, 0x78eb7462
xor eax, 0x78cd38cf
add eax, 0x8fa8a54f
mul r8d
shr edx, 2
shr edx, 1
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x14007127e
lea r9, [rsp + 0x58]
xchg rdx, rsi
mov rsi, r10
xchg rsi, rdx
lea r8, [rsp + 0x3d]
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.14002ff00
mov rax, rbx
add rsp, 0x40
nop
add rsp, 8
xchg qword [rsp - 8], rbx
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140076430
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rcx
mov r9, rdx
xchg rcx, rdx
mov r8d, 0x4c7cb7a9
xor r8d, 0x4ec8d299
xor r8d, 0x4b7eed90
xor r8d, 0xe5a6002
sub r8d, 0x41dcaef8
add r8d, 0xfa4bc655
test rcx, rcx
je 0x140076542
cmp byte [rcx], 0
je 0x140076542
test rdx, rdx
jne 0x1400764d0
nop
movabs rdx, 0xffffffff0172489f
xor rdx, 0x2e47d66e
xor rdx, 0x12881b76
add rdx, 0x1a1fcc91
sub rdx, 0x2f4d850d
add rdx, 0x1da7940c
add rdx, 0x7fffffff
add rdx, 0x39c89ee9
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x1400764ba
test rdx, rdx
je 0x14007653f
xor r10d, r10d
lea r11, [0x140002dd0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
xor rcx, qword [rsp]
add rsp, 0x10
shr r8d, 4
shr r8d, 2
shr r8d, 1
shr r8d, 1
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x1400764e2
not r8d
mov eax, r8d
ret
Function at 0x14007ab90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rdx
xchg rcx, rsi
mov rbx, rsi
xchg rcx, rsi
test rdx, rdx
jne 0x14007abe4
mov qword [rcx + 0x10], rdx
xchg rcx, rax
mov rcx, rax
xchg rcx, rax
xchg rbp, rbx
mov rbp, qword [rsp + 0x30]
xchg rbx, rbp
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
nop
movabs r8, 0xffffffff5ee37bcf
xor r8, 0x2e44ba30
sub r8, 0x1b5dcbfa
sub r8, 0x256b7550
sub r8, 0x281f0d0a
add r8, 0x7fffffff
xor r8, 0x78408c55
xchg rcx, r11
mov r11, r8
xchg rcx, r11
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x14007ac22
inc rcx
mov eax, 0x1dc10264
add eax, 0xe408400
add eax, 0x40488aa3
sub eax, 0x1b9f574b
add eax, 0x55fb8e8
xor eax, 0x560a72a6
mul rcx
xchg rcx, rsi
mov qword [rbx + 8], rsi
xchg rcx, rsi
cmovo rax, r8
xchg rsi, rcx
mov rsi, rax
xchg rsi, rcx
call fcn.1401fd2a4
xchg r8, r9
mov r9, qword [rbx + 8]
xchg r8, r9
xchg rdi, rdx
mov rdi, rdx
xchg rdx, rdi
add r8, r8
xchg r14, rax
mov qword [rbx + 0x10], r14
xchg r14, rax
xchg r11, rax
mov rcx, r11
xchg r11, rax
call sub.VCRUNTIME140.dll_memcpy
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000ffff
jge 0x14007acb4
dec eax
or eax, 0xffff0000
inc eax
xor edx, edx
mov word [rbx + 2], ax
cmp qword [rbx + 8], rdx
jbe 0x14007ace6
nop
xchg rdi, rax
mov rdi, qword [rbx + 0x10]
xchg rdi, rax
lea rcx, [rax + rdx*2]
movzx eax, word [rbx + 2]
xor word [rcx], ax
inc rdx
cmp rdx, qword [rbx + 8]
jb 0x14007acc6
mov byte [rbx], 0x43
xor byte [rbx], 0x29
sub byte [rbx], 0x4c
add byte [rbx], 0x47
sub byte [rbx], 0xe
xor byte [rbx], 0
add byte [rbx], 0x16
xor byte [rbx], 4
xor byte [rbx], 0x69
mov rax, rbx
xchg rbx, rdi
mov rdi, qword [rsp + 0x30]
xchg rbx, rdi
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b310
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rax
mov rdx, qword [rcx + 0x10]
xchg rdx, rax
xchg rdx, rcx
mov rcx, rdx
xchg rdx, rcx
test rax, rax
jne 0x14007b335
xor r8d, r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b375
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b363
xchg rbp, rax
mov rbp, qword [rdx + 0x10]
xchg rbp, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b343
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x55
xor byte [rdx], 0xe
xor byte [rdx], 0x4d
xor byte [rdx], 4
add byte [rdx], 0x50
sub byte [rdx], 0x61
ret

Function at 0x14007b380
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
mov rdx, rcx
test rax, rax
jne 0x14007b393
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x14007b3cf
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b3ba
mov rcx, qword [rdx + 0x10]
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b3a1
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x5a
add byte [rdx], 0xd
sub byte [rdx], 0x30
sub byte [rdx], 0x31
add byte [rdx], 0x2b
xor byte [rdx], 0x58
sub byte [rdx], 0x68
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007b710
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rax
mov r8, qword [rcx + 0x10]
xchg r8, rax
xchg rdx, rbx
mov rbx, rcx
xchg rbx, rdx
test rax, rax
jne 0x14007b727
ret
cmp byte [rcx], 0
jne 0x14007b775
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b75a
nop dword [rax + rax]
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b73a
xchg r11, rax
mov r11, qword [rdx + 0x10]
xchg r11, rax
mov byte [rdx], 0x65
xor byte [rdx], 2
add byte [rdx], 0xe
xor byte [rdx], 2
sub byte [rdx], 0x66
add byte [rdx], 0x3d
sub byte [rdx], 0x17
sub byte [rdx], 0x1d
sub byte [rdx], 0x19
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c070
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, r14
mov rdi, r14
xchg r14, rcx
lea rbx, [rdx + 6]
xchg r12, rdx
mov r12, rbx
xchg r12, rdx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 4
xor byte [rbx + rax], 0x38
add byte [rbx + rax], 0x22
sub byte [rbx + rax], 0x33
add byte [rbx + rax], 0xe
xor byte [rbx + rax], 0x33
sub byte [rbx + rax], 0xa
inc rax
cmp rax, 8
jb 0x14007c0a6
xchg rdi, rsi
mov rax, rsi
xchg rdi, rsi
xchg r8, rbx
mov r8, qword [rsp + 0x30]
xchg r8, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007c0f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbx, rdx
mov qword [rsp + 0x10], rbx
xchg rdx, rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 6]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x49
sub byte [rbx + rax], 0x34
add byte [rbx + rax], 0x3b
sub byte [rbx + rax], 8
xor byte [rbx + rax], 0x72
xor byte [rbx + rax], 0x5b
sub byte [rbx + rax], 0x3f
sub byte [rbx + rax], 0x22
inc rax
cmp rax, 0xa
jb 0x14007c12c
xchg r14, rdi
mov rax, r14
xchg r14, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007c180
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r15, rdx
mov qword [rsp + 0x10], r15
xchg rdx, r15
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 8]
xchg r14, rdx
mov r14, rbx
xchg r14, rdx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 4
add byte [rbx + rax], 0x13
sub byte [rbx + rax], 0x13
add byte [rbx + rax], 0x44
sub byte [rbx + rax], 8
add byte [rbx + rax], 0xf
add byte [rbx + rax], 0x1a
xor byte [rbx + rax], 2
xor byte [rbx + rax], 0x6b
inc rax
cmp rax, 0xe
jb 0x14007c1b5
xchg rbp, rax
mov rbp, rdi
xchg rbp, rax
xchg rbx, r13
mov r13, qword [rsp + 0x30]
xchg rbx, r13
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c210
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 8], r15
xchg rbx, r15
xchg rdx, rbp
mov qword [rsp + 0x10], rbp
xchg rdx, rbp
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, r12
mov r12, rcx
xchg rdi, r12
lea rbx, [rdx + 0xa]
xchg r11, rbx
mov rdx, r11
xchg r11, rbx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x4c
sub byte [rbx + rax], 9
add byte [rbx + rax], 0x23
xor byte [rbx + rax], 0x75
add byte [rbx + rax], 0xa
sub byte [rbx + rax], 0x1d
inc rax
cmp rax, 0x10
jb 0x14007c252
xchg r12, rax
mov r12, rdi
xchg r12, rax
xchg rcx, rbx
mov rcx, qword [rsp + 0x30]
xchg rbx, rcx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c2a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0xa]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x45
add byte [rbx + rax], 0x26
xor byte [rbx + rax], 0x16
sub byte [rbx + rax], 0x78
add byte [rbx + rax], 0x38
xor byte [rbx + rax], 0x52
xor byte [rbx + rax], 0x6f
inc rax
cmp rax, 0x12
jb 0x14007c2cd
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg r14, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c320
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r10
mov qword [rsp + 0x10], r10
xchg r10, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r12, rdi
mov r12, rcx
xchg r12, rdi
lea rbx, [rdx + 0x10]
mov rdx, rbx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x66
sub byte [rbx + rax], 0x35
sub byte [rbx + rax], 0x26
add byte [rbx + rax], 0x1b
add byte [rbx + rax], 0x43
xor byte [rbx + rax], 0x69
inc rax
cmp rax, 0x1e
jb 0x14007c356
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007c3a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbx, rdx
mov qword [rsp + 0x10], rbx
xchg rdx, rbx
push rdi
sub rsp, 0x20
xchg rbp, rcx
mov rdi, rbp
xchg rbp, rcx
lea rbx, [rdx + 0x12]
mov rdx, rbx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x44
xor byte [rbx + rax], 0x78
add byte [rbx + rax], 0x30
xor byte [rbx + rax], 0x7b
add byte [rbx + rax], 0x54
sub byte [rbx + rax], 0x57
sub byte [rbx + rax], 0x14
xor byte [rbx + rax], 0
inc rax
cmp rax, 0x20
jb 0x14007c3cd
xchg rsi, rdi
mov rax, rsi
xchg rdi, rsi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14007c420
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 8], r13
xchg rbx, r13
mov qword [rsp + 0x10], rdx
nop
push r8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x12]
xchg r15, rdx
mov r15, rbx
xchg rdx, r15
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x67
sub byte [rbx + rax], 0x4c
add byte [rbx + rax], 0x48
sub byte [rbx + rax], 0x1a
add byte [rbx + rax], 0x1e
sub byte [rbx + rax], 0x62
xor byte [rbx + rax], 5
inc rax
cmp rax, 0x22
jb 0x14007c453
xchg r15, rdi
mov rax, r15
xchg rdi, r15
xchg rbx, rcx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c4b0
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rbx, rsi
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r9, rdi
mov r9, rcx
xchg rdi, r9
lea rbx, [rdx + 0x14]
mov rdx, rbx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x32
sub byte [rbx + rax], 0x16
add byte [rbx + rax], 0x26
add byte [rbx + rax], 0x29
xor byte [rbx + rax], 0x17
sub byte [rbx + rax], 0x47
sub byte [rbx + rax], 0x13
xor byte [rbx + rax], 0x22
inc rax
cmp rax, 0x24
jb 0x14007c4e6
xchg r10, rax
mov r10, rdi
xchg r10, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rax
xchg qword [rsp + 0x10], rdi
pop rax
pop rcx
add rsp, 8
ret

Function at 0x14007c530
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 8], rbp
xchg rbx, rbp
xchg rdx, r10
mov qword [rsp + 0x10], r10
xchg r10, rdx
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x14]
xchg rdx, rsi
mov rsi, rbx
xchg rsi, rdx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x4c
sub byte [rbx + rax], 0x1c
add byte [rbx + rax], 8
xor byte [rbx + rax], 0x39
xor byte [rbx + rax], 0x2e
sub byte [rbx + rax], 0x19
add byte [rbx + rax], 0xc
sub byte [rbx + rax], 0x22
inc rax
cmp rax, 0x26
jb 0x14007c569
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c5b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x16]
mov rdx, rbx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x41
sub byte [rbx + rax], 0x18
sub byte [rbx + rax], 0x28
xor byte [rbx + rax], 0x12
sub byte [rbx + rax], 0xe
xor byte [rbx + rax], 0xb
sub byte [rbx + rax], 8
xor byte [rbx + rax], 0x12
sub byte [rbx + rax], 0x14
inc rax
cmp rax, 0x28
jb 0x14007c5df
xchg r9, rax
mov r9, rdi
xchg r9, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret
Function at 0x14007c630
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rbp
mov rdi, rbp
xchg rcx, rbp
lea rbx, [rdx + 0x16]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 6
add byte [rbx + rax], 9
xor byte [rbx + rax], 0x16
sub byte [rbx + rax], 0xa
add byte [rbx + rax], 0x43
add byte [rbx + rax], 0
sub byte [rbx + rax], 0x15
xor byte [rbx + rax], 0x2e
sub byte [rbx + rax], 0x13
inc rax
cmp rax, 0x2a
jb 0x14007c65d
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c6b0
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rbx
mov qword [rsp + 8], r14
xchg r14, rbx
mov qword [rsp + 0x10], rdx
push rcx
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x18]
xchg rbx, r11
mov rdx, r11
xchg r11, rbx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x62
xor byte [rbx + rax], 0x2d
sub byte [rbx + rax], 0x1a
sub byte [rbx + rax], 2
sub byte [rbx + rax], 0x1f
xor byte [rbx + rax], 0x52
xor byte [rbx + rax], 0x79
xor byte [rbx + rax], 0x3f
inc rax
cmp rax, 0x2e
jb 0x14007c6e7
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rcx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
add rsp, 0x20
push rax
push rcx
xchg qword [rsp + 0x10], rdi
pop rcx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c740
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rsi, rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rbp
mov rdi, rbp
xchg rbp, rcx
lea rbx, [rdx + 0x1a]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x5a
sub byte [rbx + rax], 0xa
xor byte [rbx + rax], 0x73
add byte [rbx + rax], 0x18
add byte [rbx + rax], 0x13
xor byte [rbx + rax], 0x5c
sub byte [rbx + rax], 0x12
inc rax
cmp rax, 0x32
jb 0x14007c77c
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c7d0
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rbx
mov qword [rsp + 8], r14
xchg r14, rbx
xchg rcx, rdx
mov qword [rsp + 0x10], rcx
xchg rcx, rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x1c]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 5
xor byte [rbx + rax], 0x2d
sub byte [rbx + rax], 0x26
add byte [rbx + rax], 0x71
sub byte [rbx + rax], 0xf
sub byte [rbx + rax], 0x64
add byte [rbx + rax], 0
inc rax
cmp rax, 0x34
jb 0x14007c803
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c8d0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 8], r14
xchg rbx, r14
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdx, rcx
mov rdi, rdx
xchg rcx, rdx
lea rbx, [rdx + 0x1e]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x2e
sub byte [rbx + rax], 0x25
add byte [rbx + rax], 0x6e
sub byte [rbx + rax], 0x49
sub byte [rbx + rax], 0x2a
xor byte [rbx + rax], 0xe
xor byte [rbx + rax], 0x25
xor byte [rbx + rax], 0x2f
inc rax
cmp rax, 0x38
jb 0x14007c903
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c960
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 8], r11
xchg r11, rbx
xchg rdx, r14
mov qword [rsp + 0x10], r14
xchg rdx, r14
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x20]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x29
add byte [rbx + rax], 0x55
sub byte [rbx + rax], 2
xor byte [rbx + rax], 0x1b
xor byte [rbx + rax], 0x7c
xor byte [rbx + rax], 0x3f
add byte [rbx + rax], 0x40
xor byte [rbx + rax], 0x64
inc rax
cmp rax, 0x3e
jb 0x14007c99c
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c9f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x22]
xchg rbp, rdx
mov rbp, rbx
xchg rbp, rdx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x56
add byte [rbx + rax], 9
xor byte [rbx + rax], 0x71
add byte [rbx + rax], 0x32
sub byte [rbx + rax], 0xa
sub byte [rbx + rax], 0x56
inc rax
cmp rax, 0x40
jb 0x14007ca25
xchg r14, rax
mov r14, rdi
xchg r14, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rcx
push rcx
push rcx
push rax
push rdx
push rax
push rdx
xchg qword [rsp + 0x40], rdi
pop rdx
pop rax
pop rdx
pop rax
pop rcx
pop rcx
pop rcx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007ca80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r13, rdi
mov r13, rcx
xchg rdi, r13
lea rbx, [rdx + 0x22]
xchg r8, rdx
mov r8, rbx
xchg rdx, r8
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x29
add byte [rbx + rax], 0x2d
xor byte [rbx + rax], 0x60
sub byte [rbx + rax], 0x28
add byte [rbx + rax], 0x4e
add byte [rbx + rax], 6
sub byte [rbx + rax], 0x57
add byte [rbx + rax], 0x63
xor byte [rbx + rax], 0x6e
inc rax
cmp rax, 0x42
jb 0x14007cab6
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14007cb00
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rbx
mov qword [rsp + 8], rcx
xchg rcx, rbx
xchg rdx, rsi
mov qword [rsp + 0x10], rsi
xchg rdx, rsi
push rdi
sub rsp, 0x20
xchg rdi, r10
mov r10, rcx
xchg r10, rdi
lea rbx, [rdx + 0x24]
xchg rbx, r14
mov rdx, r14
xchg r14, rbx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x14
add byte [rbx + rax], 0x56
sub byte [rbx + rax], 0x2e
sub byte [rbx + rax], 0x31
add byte [rbx + rax], 0x6d
sub byte [rbx + rax], 0x58
xor byte [rbx + rax], 0x36
xor byte [rbx + rax], 0x6e
sub byte [rbx + rax], 0x78
inc rax
cmp rax, 0x46
jb 0x14007cb39
xchg rdi, r12
mov rax, r12
xchg r12, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x14007cb90
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 8], r11
xchg r11, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rbp, rcx
mov rdi, rbp
xchg rbp, rcx
lea rbx, [rdx + 0x28]
mov rdx, rbx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], reloc.SHLWAPI.dll_SHCreateMemStream
xor byte [rbx + rax], 0
xor byte [rbx + rax], 0x5f
xor byte [rbx + rax], 0x66
add byte [rbx + rax], 0xd
xor byte [rbx + rax], 0x42
inc rax
cmp rax, 0x4c
jb 0x14007cbbd
mov rax, rdi
xchg r13, rbx
mov r13, qword [rsp + 0x30]
xchg rbx, r13
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cc10
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rbx
mov qword [rsp + 8], r8
xchg r8, rbx
xchg rdx, r13
mov qword [rsp + 0x10], r13
xchg r13, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x2a]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x68
add byte [rbx + rax], 0
sub byte [rbx + rax], 0x4e
add byte [rbx + rax], 0x58
sub byte [rbx + rax], 0x1c
sub byte [rbx + rax], 0x55
add byte [rbx + rax], 0x3d
add byte [rbx + rax], 0xb
xor byte [rbx + rax], 0x49
inc rax
cmp rax, 0x50
jb 0x14007cc4b
mov rax, rdi
xchg r13, rbx
mov r13, qword [rsp + 0x30]
xchg rbx, r13
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cca0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x2a]
mov rdx, rbx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x68
add byte [rbx + rax], 0
xor byte [rbx + rax], 0x3a
xor byte [rbx + rax], 0x3d
sub byte [rbx + rax], 8
xor byte [rbx + rax], 0x67
inc rax
cmp rax, 0x52
jb 0x14007ccca
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, r11
mov r11, qword [rsp + 0x30]
xchg r11, rbx
add rsp, 0x20
push rbx
push rdx
push rdx
push rbx
push rax
push rbx
push rbx
push rcx
xchg qword [rsp + 0x40], rdi
pop rcx
pop rbx
pop rbx
pop rax
pop rbx
pop rdx
pop rdx
pop rbx
add rsp, 8
ret