joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007cd30
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 8], rdi
xchg rbx, rdi
xchg rdx, r15
mov qword [rsp + 0x10], r15
xchg rdx, r15
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x2a]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ac30
nop
xor eax, eax
mov byte [rbx + rax], 4
add byte [rbx + rax], 0x41
sub byte [rbx + rax], 6
xor byte [rbx + rax], 0x7e
add byte [rbx + rax], 0x32
sub byte [rbx + rax], 3
sub byte [rbx + rax], 0x70
inc rax
cmp rax, 0x50
jb 0x14007cd69
xchg r9, rax
mov r9, rdi
xchg r9, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cdc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r10, rdx
mov qword [rsp + 0x10], r10
xchg r10, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x2a]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ac30
nop
xor eax, eax
mov byte [rbx + rax], 0x14
xor byte [rbx + rax], 0x77
xor byte [rbx + rax], 0x72
add byte [rbx + rax], 0xf
sub byte [rbx + rax], 0x15
add byte [rbx + rax], 0x5e
sub byte [rbx + rax], 0x2f
xor byte [rbx + rax], 0x52
xor byte [rbx + rax], 0x68
inc rax
cmp rax, 0x52
jb 0x14007cdfc
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cee0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rdi
mov qword [rsp + 0x10], rdi
xchg rdi, rdx
nop
push 0x39db2cc1
mov qword [rsp], rdi
sub rsp, 0x20
xchg r15, rdi
mov r15, rcx
xchg rdi, r15
lea rbx, [rdx + 0x2e]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ac30
nop
xor eax, eax
mov byte [rbx + rax], 0x11
add byte [rbx + rax], 0x35
sub byte [rbx + rax], 0x28
xor byte [rbx + rax], 0x1d
add byte [rbx + rax], 0x2e
sub byte [rbx + rax], 0x17
add byte [rbx + rax], 7
add byte [rbx + rax], 0xf
sub byte [rbx + rax], 0x30
inc rax
cmp rax, 0x58
jb 0x14007cf1c
xchg r9, rdi
mov rax, r9
xchg r9, rdi
xchg rbx, r15
mov r15, qword [rsp + 0x30]
xchg rbx, r15
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007cf70
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rbx, rdx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x2e]
xchg rdx, r15
mov r15, rbx
xchg rdx, r15
call fcn.14007ac30
nop
xor eax, eax
mov byte [rbx + rax], 0x6b
sub byte [rbx + rax], 0x28
sub byte [rbx + rax], 0x3b
xor byte [rbx + rax], 0x53
xor byte [rbx + rax], 0x51
xor byte [rbx + rax], 0x2e
add byte [rbx + rax], 0xb
add byte [rbx + rax], 0x47
xor byte [rbx + rax], 0x76
inc rax
cmp rax, 0x5a
jb 0x14007cfa3
mov rax, rdi
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg r14, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r14, rdi
mov r14, rcx
xchg rdi, r14
lea rbx, [rdx + 0x30]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ac30
nop
xor eax, eax
mov byte [rbx + rax], 0x1e
add byte [rbx + rax], 0x3b
add byte [rbx + rax], 0x15
xor byte [rbx + rax], 0x41
add byte [rbx + rax], 0x27
sub byte [rbx + rax], 0x41
sub byte [rbx + rax], 0x15
inc rax
cmp rax, 0x5c
jb 0x14007d036
xchg r13, rdi
mov rax, r13
xchg rdi, r13
xchg rdx, rbx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007d080
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rbx
mov qword [rsp + 8], rdx
xchg rdx, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x30]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ac30
nop
xor eax, eax
mov byte [rbx + rax], 0x27
add byte [rbx + rax], 0x52
sub byte [rbx + rax], 0x3a
add byte [rbx + rax], 0x22
add byte [rbx + rax], 0x18
xor byte [rbx + rax], 0x57
sub byte [rbx + rax], 0x2e
inc rax
cmp rax, 0x5e
jb 0x14007d0ad
mov rax, rdi
xchg rcx, rbx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x14007d0f0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 8], r15
xchg r15, rbx
xchg rdx, rbx
mov qword [rsp + 0x10], rbx
xchg rdx, rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdx, rcx
mov rdi, rdx
xchg rcx, rdx
lea rbx, [rdx + 0x32]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ac30
nop
xor eax, eax
mov byte [rbx + rax], 0x57
xor byte [rbx + rax], 0x5b
sub byte [rbx + rax], 0xb
xor byte [rbx + rax], 0x47
add byte [rbx + rax], 0x17
sub byte [rbx + rax], 0x5d
inc rax
cmp rax, 0x60
jb 0x14007d132
mov rax, rdi
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
push rax
xchg qword [rsp + 8], rdi
add rsp, 0x10
ret

Function at 0x14007d170
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg rbx, r11
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x34]
mov rdx, rbx
call fcn.14007ac30
nop
xor eax, eax
mov byte [rbx + rax], 0xf
add byte [rbx + rax], 0x43
add byte [rbx + rax], 0x24
sub byte [rbx + rax], 0x30
sub byte [rbx + rax], 0x39
xor byte [rbx + rax], 0x2a
sub byte [rbx + rax], 0x27
inc rax
cmp rax, 0x64
jb 0x14007d1a6
mov rax, rdi
xchg rbx, r9
mov r9, qword [rsp + 0x30]
xchg rbx, r9
add rsp, 0x20
push rcx
push rdx
push rcx
push rdx
push rdx
push rdx
push rdx
push rbx
xchg qword [rsp + 0x40], rdi
add rsp, 0x48
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d200
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x38]
xchg r12, rbx
mov rdx, r12
xchg r12, rbx
call fcn.14007ac30
nop
xor eax, eax
mov byte [rbx + rax], 6
add byte [rbx + rax], 0x2f
add byte [rbx + rax], 0x14
sub byte [rbx + rax], 0x36
xor byte [rbx + rax], 0x57
add byte [rbx + rax], 5
sub byte [rbx + rax], 0x36
xor byte [rbx + rax], 0x60
sub byte [rbx + rax], 0x73
inc rax
cmp rax, 0x6e
jb 0x14007d236
mov rax, rdi
xchg rbx, rdi
mov rdi, qword [rsp + 0x30]
xchg rdi, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d290
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, r12
mov rdi, r12
xchg rcx, r12
lea rbx, [rdx + 0x4e]
xchg r9, rbx
mov rdx, r9
xchg rbx, r9
call fcn.14007ac30
nop
xor eax, eax
mov byte [rbx + rax], 0x3c
xor byte [rbx + rax], 0xe
xor byte [rbx + rax], 0x7e
add byte [rbx + rax], 0x17
sub byte [rbx + rax], 0x50
xor byte [rbx + rax], 0x4f
xor byte [rbx + rax], 0x5c
inc rax
cmp rax, 0x98
jb 0x14007d2bd
xchg r12, rax
mov r12, rdi
xchg r12, rax
xchg rbx, r15
mov r15, qword [rsp + 0x30]
xchg r15, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007d310
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r12, rdx
mov qword [rsp + 0x10], r12
xchg r12, rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x56]
xchg rbx, r9
mov rdx, r9
xchg r9, rbx
call fcn.14007ac30
nop
xor eax, eax
mov byte [rbx + rax], 0x6c
xor byte [rbx + rax], 0x2d
sub byte [rbx + rax], 0x1d
add byte [rbx + rax], 0x35
xor byte [rbx + rax], 0x69
xor byte [rbx + rax], 0x7f
sub byte [rbx + rax], 0xf
xor byte [rbx + rax], 0x5e
xor byte [rbx + rax], 0x1e
inc rax
cmp rax, 0xa8
jb 0x14007d343
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007d390
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 8], rdi
xchg rbx, rdi
xchg rdx, r9
mov qword [rsp + 0x10], r9
xchg r9, rdx
nop
push 0x71c94c71
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rdx
mov rdx, rcx
xchg rdx, rdi
lea rbx, [rdx + 0x5a]
mov rdx, rbx
call fcn.14007ac30
nop
xor eax, eax
mov byte [rbx + rax], 0x5c
xor byte [rbx + rax], 0x4e
add byte [rbx + rax], 0x4c
xor byte [rbx + rax], 8
xor byte [rbx + rax], 0x57
xor byte [rbx + rax], 0x48
xor byte [rbx + rax], 0x49
inc rax
cmp rax, 0xb0
jb 0x14007d3cc
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rcx, rbx
mov rcx, qword [rsp + 0x30]
xchg rbx, rcx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d420
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg rbx, r11
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x70]
xchg r11, rdx
mov r11, rbx
xchg rdx, r11
call fcn.14007ac30
nop
xor eax, eax
mov byte [rbx + rax], 0x61
sub byte [rbx + rax], 0x5c
add byte [rbx + rax], 0x70
sub byte [rbx + rax], 0x52
xor byte [rbx + rax], 0xa
add byte [rbx + rax], 0x54
xor byte [rbx + rax], 0x77
xor byte [rbx + rax], 0x7d
sub byte [rbx + rax], 0x77
inc rax
cmp rax, 0xdc
jb 0x14007d453
xchg rbx, rdi
mov rax, rbx
xchg rbx, rdi
xchg rbx, rsi
mov rsi, qword [rsp + 0x30]
xchg rbx, rsi
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x14007d4b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r14
mov qword [rsp + 0x10], r14
xchg rdx, r14
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, r9
mov rdi, r9
xchg rcx, r9
lea rbx, [rdx + 0x70]
mov rdx, rbx
call fcn.14007ac30
nop
xor eax, eax
mov byte [rbx + rax], 0x6b
xor byte [rbx + rax], 0x35
add byte [rbx + rax], 2
xor byte [rbx + rax], 0x78
add byte [rbx + rax], 0x4a
xor byte [rbx + rax], 0x21
sub byte [rbx + rax], 0x43
inc rax
cmp rax, 0xde
jb 0x14007d4e6
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d530
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rbx
mov qword [rsp + 8], r15
xchg r15, rbx
xchg rdx, rcx
mov qword [rsp + 0x10], rcx
xchg rdx, rcx
nop
push r9
mov qword [rsp], rdi
sub rsp, 0x20
xchg rbx, rdi
mov rbx, rcx
xchg rdi, rbx
lea rbx, [rdx + 0x76]
mov rdx, rbx
call fcn.14007ac30
nop
xor eax, eax
mov byte [rbx + rax], reloc.SHLWAPI.dll_SHCreateMemStream
add byte [rbx + rax], 0x36
sub byte [rbx + rax], 0x3f
xor byte [rbx + rax], 0x66
add byte [rbx + rax], 7
sub byte [rbx + rax], 0x45
sub byte [rbx + rax], 0x27
inc rax
cmp rax, 0xea
jb 0x14007d569
mov rax, rdi
xchg r8, rbx
mov r8, qword [rsp + 0x30]
xchg rbx, r8
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d5c0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 8], r14
xchg r14, rbx
xchg rdx, rdi
mov qword [rsp + 0x10], rdi
xchg rdx, rdi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rsi
mov rdi, rsi
xchg rcx, rsi
lea rbx, [rdx + 0x7c]
xchg rsi, rdx
mov rsi, rbx
xchg rsi, rdx
call fcn.14007ac30
nop
xor eax, eax
mov byte [rbx + rax], 0x20
add byte [rbx + rax], 0x24
sub byte [rbx + rax], 0xd
xor byte [rbx + rax], 0x15
sub byte [rbx + rax], 0x19
sub byte [rbx + rax], 9
inc rax
cmp rax, 0xf4
jb 0x14007d602
xchg r9, rax
mov r9, rdi
xchg r9, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rbx
push rax
push rax
push rbx
xchg qword [rsp + 0x28], rdi
pop rbx
pop rax
pop rax
pop rbx
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d660
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rbx
mov qword [rsp + 8], r9
xchg r9, rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x9a]
mov rdx, rbx
call fcn.14007ac30
nop
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbx + rax], 0x56
sub byte [rbx + rax], 0x1a
add byte [rbx + rax], 0xd
xor byte [rbx + rax], 0x28
add byte [rbx + rax], 4
add byte [rbx + rax], 5
xor byte [rbx + rax], 0x6a
inc rax
cmp rax, 0x130
jb 0x14007d69f
xchg r11, rdi
mov rax, r11
xchg rdi, r11
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d6f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0xc]
xchg r12, rdx
mov r12, rbx
xchg rdx, r12
call fcn.14007ac30
nop
xor eax, eax
mov byte [rbx + rax], 3
add byte [rbx + rax], 0x6b
sub byte [rbx + rax], 0x14
add byte [rbx + rax], 0x1d
sub byte [rbx + rax], 0x14
xor byte [rbx + rax], 0x12
sub byte [rbx + rax], 0x71
inc rax
cmp rax, 0x14
jb 0x14007d726
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, r8
mov r8, qword [rsp + 0x30]
xchg rbx, r8
add rsp, 0x20
push rdx
push rbx
push rcx
xchg qword [rsp + 0x18], rdi
pop rcx
pop rbx
pop rdx
add rsp, 8
ret

Function at 0x14007d780
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 8], r11
xchg r11, rbx
xchg r8, rdx
mov qword [rsp + 0x10], r8
xchg rdx, r8
push rdi
sub rsp, 0x20
xchg rdi, rbp
mov rbp, rcx
xchg rbp, rdi
lea rbx, [rdx + 0xe]
mov rdx, rbx
call fcn.14007ac30
nop
xor eax, eax
mov byte [rbx + rax], 0x28
sub byte [rbx + rax], 0x12
add byte [rbx + rax], 0x57
sub byte [rbx + rax], 0x13
xor byte [rbx + rax], 0x44
sub byte [rbx + rax], 0x1e
inc rax
cmp rax, 0x18
jb 0x14007d7b3
xchg rbx, rax
mov rbx, rdi
xchg rbx, rax
xchg rbx, r13
mov r13, qword [rsp + 0x30]
xchg rbx, r13
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x1400811d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg r9, rbp
mov qword [rsp + 0x18], r9
xchg rbp, r9
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg rbx, r9
mov r9, r8
xchg r9, rbx
xchg r9, rdx
mov rsi, r9
xchg r9, rdx
xchg r13, rcx
mov rbp, r13
xchg rcx, r13
jne 0x1400812a7
xchg rbp, rdi
mov qword [rsp + 0x30], rbp
xchg rbp, rdi
nop dword [rax]
nop dword [rax + rax]
xchg rdi, r8
mov rdi, qword [rbx + 0x10]
xchg r8, rdi
mov rdx, rsi
xchg rcx, rbp
mov rbp, rcx
xchg rbp, rcx
call fcn.1400811d0
mov rdi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x28]
call fcn.140091710
mov edx, 0x1dab3a45
xor edx, 0xe735d09
add edx, 0x5a9eb51f
add edx, 0xa2884c1
xor edx, 0x6d87ab0
sub edx, 0x23196fd3
sub edx, 0x27e59390
xor edx, 0x243f9c98
xor edx, 0x17774439
xchg rsi, rcx
mov rsi, rdi
xchg rsi, rcx
call fcn.1401fd0ac
cmp byte [rbx + 0x19], 0
je 0x14008122b
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
nop
xchg qword [rsp], rsi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140083e00
Capabilities:
Encode data using xor

Disassembly:
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
sub rcx, 2
mov eax, 0x2b9bc770
add eax, 0x1d3646bf
sub eax, 0x11700174
xor eax, 0x27446e45
xor eax, 0x45e5cea7
xor eax, 0x3bf0d817
sub eax, 0x42e4db58
sub eax, 0x1048678a
add eax, 0xb1c69b61
mul r8d
shr edx, 1
shr edx, 1
shr edx, 1
movzx eax, dx
shl ax, 2
lea r9d, [rax + rdx]
add r9w, r9w
sub r8w, r9w
neg r8w
add r8w, 0xffd0
neg r8w
mov word [rcx], r8w
mov r8d, edx
test edx, edx
jne 0x140083e10
xchg rcx, rax
mov rcx, rax
xchg rcx, rax
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x1400840d0
Capabilities:
Encode data using xor

Disassembly:
xchg r11, r8
mov rax, r11
xchg r11, r8
cmp rcx, rdx
je 0x14008422c
mov r9, rax
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
xchg rsi, rax
movups xmmword [rsi], xmm0
xchg rsi, rax
mov qword [r9 + r8 - 0x70], r10
xchg r10, r14
mov qword [r9 + r8 - 0x68], r14
xchg r10, r14
movups xmm0, xmmword [r8 - 0x80]
movups xmmword [rax], xmm0
xchg r10, r8
movups xmm1, xmmword [r10 - 0x70]
xchg r10, r8
xorps xmm0, xmm0
xchg rbx, rax
movups xmmword [rbx + 0x10], xmm1
xchg rbx, rax
mov qword [r8 - 0x70], r10
neg rax
add rax, 0xffffffffffffffb8
neg rax
mov qword [r8 - 0x68], 0x47731ad3
sub qword [r8 - 0x68], 0x29eba3ed
xor qword [r8 - 0x68], 0x76c5e5e4
xor qword [r8 - 0x68], 0x5d55023d
add qword [r8 - 0x68], 0x19eb4085
xor qword [r8 - 0x68], 0x397ed6dd
sub qword [r8 - 0x68], 0x697c0712
mov word [r8 - 0x80], r10w
xchg r9, r10
movups xmmword [r10 + r8 - 0x60], xmm0
xchg r9, r10
mov qword [r9 + r8 - 0x50], r10
xchg r10, rdx
mov qword [r9 + r8 - 0x48], rdx
xchg r10, rdx
xchg r8, rdi
movups xmm0, xmmword [rdi - 0x60]
xchg r8, rdi
xchg r9, r12
movups xmmword [r12 + r8 - 0x60], xmm0
xchg r12, r9
xchg rdx, r8
movups xmm1, xmmword [rdx - 0x50]
xchg rdx, r8
movups xmmword [r9 + r8 - 0x50], xmm1
xchg r10, r12
mov qword [r8 - 0x50], r12
xchg r12, r10
mov qword [r8 - 0x48], 0x43a9ad11
xor qword [r8 - 0x48], 0x18d5f1e5
add qword [r8 - 0x48], 0x8dad39e
sub qword [r8 - 0x48], 0x3058e6dc
sub qword [r8 - 0x48], 0xd82eb7e
sub qword [r8 - 0x48], 0x546350e
add qword [r8 - 0x48], 0x52c9d2a6
sub qword [r8 - 0x48], 0x1ebfaf6e
xor qword [r8 - 0x48], 0x553f4c65
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x1400840f6
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140084350
Capabilities:
Encode data using xor

Disassembly:
xchg r8, r11
mov rax, r11
xchg r8, r11
cmp rcx, rdx
je 0x140084409
xchg r10, r9
mov r10, rax
xchg r10, r9
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg r15, rax
movups xmmword [r15], xmm0
xchg r15, rax
mov qword [r9 + r8 - 0x28], r10
lea rcx, [r8 - 0x18]
mov qword [r8 + r9 - 0x20], r10
movups xmm0, xmmword [r8 - 0x38]
movups xmmword [rax], xmm0
movups xmm1, xmmword [r8 - 0x28]
xchg rsi, rax
movups xmmword [rsi + 0x10], xmm1
xchg rsi, rax
mov qword [r8 - 0x28], r10
nop
sub rax, 0x56c0807e
add rax, 0x56c0809e
mov qword [r8 - 0x20], 0x49bfffec
sub qword [r8 - 0x20], 0x3ecd9ae4
xor qword [r8 - 0x20], 0x20269af5
add qword [r8 - 0x20], 0x2c0279e5
add qword [r8 - 0x20], 0x14d9fa37
sub qword [r8 - 0x20], 0x60c6d82
sub qword [r8 - 0x20], 0x65a50690
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x140084380
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14008e860
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0x14], 0x1d
xor byte [rcx + rax + 0x14], 0x5e
sub byte [rcx + rax + 0x14], 0x1f
xor byte [rcx + rax + 0x14], 0x22
add byte [rcx + rax + 0x14], 0x57
sub byte [rcx + rax + 0x14], 0x2d
sub byte [rcx + rax + 0x14], 0x2b
add byte [rcx + rax + 0x14], 0x43
sub byte [rcx + rax + 0x14], 0x48
inc rax
cmp rax, 0x24
jb 0x14008e862
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140194280
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov r10, rdx
xchg r14, r11
mov r14, rcx
xchg r14, r11
mov word [rsp + 0x30], 0x7ae4
sub word [rsp + 0x30], 0xa36
sub word [rsp + 0x30], 0x3ba1
sub word [rsp + 0x30], 0x411
sub word [rsp + 0x30], 0x1a1c
xor word [rsp + 0x30], 0x789e
xor word [rsp + 0x30], 0x3d1b
sub word [rsp + 0x30], 0x603
add word [rsp + 0x30], 0xa994
mov dword [rsp + 0x34], 0x4363d18d
sub dword [rsp + 0x34], 0x7ebcbea
sub dword [rsp + 0x34], 0x2277d54f
xor dword [rsp + 0x34], 0x250a81dd
xor dword [rsp + 0x34], 0x7ec30706
add dword [rsp + 0x34], 0xbc8648c2
mov byte [rsp + 0x32], 4
add byte [rsp + 0x32], 0x76
xor byte [rsp + 0x32], 0x78
xor byte [rsp + 0x32], 0x18
add byte [rsp + 0x32], 0xf
xor byte [rsp + 0x32], 0x7c
xor byte [rsp + 0x32], 0x45
xor byte [rsp + 0x32], 0x6a
add byte [rsp + 0x32], 0x7c
mov dword [rsp + 0x38], 0x75f3b2a1
sub dword [rsp + 0x38], 0xd8bd820
xor dword [rsp + 0x38], 0x4e9125bc
xor dword [rsp + 0x38], 0x15d8de57
add dword [rsp + 0x38], 0x290299fc
xor dword [rsp + 0x38], 0x5c304438
xor ebx, ebx
mov edx, ebx
nop dword [rax]
movzx eax, word [rsp + rdx*2 + 0x34]
movzx ecx, byte [rsp + rdx + 0x30]
add cx, ax
mov word [rsp + rdx*2 + 0x34], cx
mov byte [rsp + rdx + 0x30], bl
inc rdx
cmp rdx, 3
jb 0x140194366
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0x34]
xchg r11, r10
mov rdx, r11
xchg r10, r11
xchg r11, rcx
mov r11, rcx
xchg rcx, r11
call fcn.1401947a0
nop
nop dword [rax]
mov byte [rsp + rbx + 0x34], 0x1b
add byte [rsp + rbx + 0x34], 0x42
sub byte [rsp + rbx + 0x34], 0x4b
add byte [rsp + rbx + 0x34], 0x3c
sub byte [rsp + rbx + 0x34], 9
xor byte [rsp + rbx + 0x34], 0x72
xor byte [rsp + rbx + 0x34], 0x4d
xor byte [rsp + rbx + 0x34], 0x7a
inc rbx
cmp rbx, 6
jb 0x1401943b6
add rsp, 0x40
push rcx
push rcx
push rcx
push rax
push rcx
push rcx
push rcx
xchg qword [rsp + 0x38], rbx
add rsp, 0x40
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401ab370
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xchg r11, rdx
mov rdx, r11
xchg rdx, r11
xchg rsi, r10
mov rsi, rcx
xchg r10, rsi
test rdx, rdx
je 0x1401ab3ee
mov qword [rsp], rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1401ab3e1
movzx eax, byte [r10]
test bl, bl
je 0x1401ab3c3
lea rcx, [r9 - 1]
xchg rbp, rdx
mov rbp, r9
xchg rbp, rdx
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1401ab3b2
jmp 0x1401ab3e1
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1401ab3d2
inc r10
sub r11, 1
jne 0x1401ab394
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401b0790
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, qword [rcx]
mov r9d, 0x2f9a3e83
xor r9d, 0x11ce3978
xor r9d, 0x2ae398e3
sub r9d, 0xb11c3b9
xor r9d, 0x30026436
add r9d, 0x332e19de
sub r9d, 0x6cd5d6d7
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x1401b0823
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1401b07de
mov ecx, dword [r10]
jmp 0x1401b0968
cmp ecx, 0x4e0
jb 0x1401b0968
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0x46e17b3
xor ebx, 0x50153b90
sub ebx, 0x35798439
add ebx, 0x164490ab
add ebx, 0x48365833
sub ebx, 0x2bc4279a
sub ebx, 0x3d19ee83
add ebx, 0x5b1d61d0
sub ebx, 0x6fbbdb98
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b0872
lea r11, [r10 + 0xd50]
mov ebx, 0x719b8637
sub ebx, 0x4e439fea
add ebx, 0xa5eb9ed
add ebx, 0x51781a06
sub ebx, 0x98e77f6
xor ebx, 0x75a043c6
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b08e4
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
xchg rsi, rbx
mov rsi, qword [rsp]
xchg rsi, rbx
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 7
shr ecx, 2
shr ecx, 1
shr ecx, 1
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 1
shl eax, 2
shl eax, 2
shl eax, 1
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 9
shl eax, 5
shl eax, 1
xor edx, eax
mov eax, edx
shr eax, 0xb
shr eax, 7
xor eax, edx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]