joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140027980
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov qword [rsp + 8], rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x10
xchg rbx, rdx
mov rdx, rbx
xchg rbx, rdx
xchg r12, r10
mov r12, rcx
xchg r12, r10
test r8b, 0xf
je 0x1400279d3
xor al, al
xchg rbx, rdi
mov rdi, qword [rsp + 0x20]
xchg rbx, rdi
add rsp, 0x10
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
xor edx, edx
test r8d, r8d
je 0x140027a89
movdqa xmm2, xmmword [rsp]
nop
xchg rdx, r15
movdqu xmm1, xmmword [r15 + rbx]
xchg r15, rdx
test edx, edx
jne 0x140027a01
movdqu xmm2, xmmword [r10 + 0x200]
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
pxor xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0x30ebef
xor ecx, 0x6c52438c
xor ecx, 0x6a64924c
add ecx, 0x43f3ffff
add ecx, 0x151cae37
xor ecx, 0x6a8d2e6c
xor ecx, 0x359bc604
nop dword [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140027a43
aesdeclast xmm0, xmmword [r10 + 0x1e0]
pxor xmm0, xmm2
movdqa xmm2, xmm1
xchg rbx, rdx
movups xmmword [rbx + r9], xmm0
xchg rdx, rbx
nop
add edx, 0x41751309
sub edx, 0x417512f9
cmp edx, r8d
jb 0x1400279e4
xchg r11, rbx
mov r11, qword [rsp + 0x20]
xchg rbx, r11
mov al, 0x13
add al, 3
xor al, 0x12
add al, 0x36
sub al, 0x35
add al, 0x18
sub al, 0xe
sub al, 0xe
add rsp, 0x10
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret
Function at 0x140028980
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg rbx, r8
mov r8, rbx
xchg r8, rbx
xchg rcx, rdx
mov rdi, rcx
xchg rcx, rdx
xchg r9, rcx
mov rsi, r9
xchg rcx, r9
jne 0x140028a24
nop
mov r8, qword [rbx + 0x10]
xchg r12, rdi
mov rdx, r12
xchg r12, rdi
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
call fcn.140028980
mov rcx, rbx
mov edx, 0x6331fb81
sub edx, 0xc2d7d75
xor edx, 0x78702050
xor edx, 0x492dc5a6
xor edx, 0x7f92d23f
xor edx, 0x34352dbc
add edx, 0x1ddd5c4a
xor edx, 0x3cb4925d
xor edx, 0x776f52ae
mov rbx, qword [rbx]
call fcn.1401fc608
cmp byte [rbx + 0x19], 0
je 0x1400289bf
mov rbx, qword [rsp + 0x30]
xchg r9, rsi
mov r9, qword [rsp + 0x38]
xchg rsi, r9
add rsp, 0x20
push rbx
push rdx
push rax
push rax
push rax
push rax
push rdx
push rax
xchg qword [rsp + 0x40], rdi
pop rax
pop rdx
pop rax
pop rax
pop rax
pop rax
pop rdx
pop rbx
add rsp, 8
ret

Function at 0x140029980
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x140029a07
xchg rdx, r15
mov r15, qword [rdi + 0x28]
xchg r15, rdx
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1400299f0
mov r8, qword [rcx - 8]
nop
sub rdx, 0x7366fbf4
add rdx, 0x7366fc1b
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140029ac8
xchg rsi, rcx
mov rsi, r8
xchg rcx, rsi
call fcn.1401fc608
xchg rsi, rbx
mov qword [rdi + 0x18], rsi
xchg rbx, rsi
mov qword [rdi + 0x20], rbx
mov qword [rdi + 0x28], rbx
xchg rcx, r12
mov r12, qword [rdi + 8]
xchg rcx, r12
xchg rbp, rax
mov rbp, qword [rcx + 8]
xchg rbp, rax
mov qword [rax], rbx
mov rcx, qword [rcx]
test rcx, rcx
je 0x140029a79
nop dword [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x30ae9717
add edx, 0x2774401c
add edx, 0x1045c56b
xor edx, 0x77ad549f
add edx, 0xad41393
add edx, 0x44b6f9f3
add edx, 0x2cb2d78
sub edx, 0x721c02e7
call fcn.1401fc608
xchg rbx, r15
mov rcx, r15
xchg r15, rbx
test rbx, rbx
jne 0x140029a30
xchg r8, rcx
mov r8, qword [rdi + 8]
xchg r8, rcx
mov edx, 0x2fca190a
sub edx, 0x131e519c
add edx, 0x5e89baca
xor edx, 0x75fe3b60
xor edx, 0x255582d6
xor edx, 0x2b9e3b96
xchg rdx, rbx
mov rdx, qword [rsp + 0x30]
xchg rbx, rdx
add rsp, 0x20
push rcx
push rdx
push rbx
push rbx
push rcx
xchg qword [rsp + 0x28], rdi
add rsp, 0x30
jmp fcn.1401fc608
push rdi
call 0x1402eadbd
int3
Function at 0x14002cb10
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rsi, rdx
mov qword [rsp + 0x18], rdx
xchg rsi, rdx
xchg rdi, rdx
mov qword [rsp + 0x20], rdx
xchg rdi, rdx
push r14
sub rsp, 0x30
mov rsi, rcx
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x60]
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
xchg r15, rbx
mov qword [rsp + 0x40], r15
xchg r15, rbx
add rcx, 0xc8
xchg rbx, rcx
mov qword [rsp + 0x28], rcx
xchg rbx, rcx
mov dword [rsp + 0x20], 0x51613e4e
xor dword [rsp + 0x20], 0x19e452f5
sub dword [rsp + 0x20], 0x186fc2f
xor dword [rsp + 0x20], 0x1233e169
xor dword [rsp + 0x20], 0x3bbcf14d
sub dword [rsp + 0x20], 0x6f7160a0
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002b790
test eax, eax
js 0x14002cbc5
cmp qword [rsp + 0x40], rbx
je 0x14002cbc5
lea eax, [rbx + 1]
jmp 0x14002cce9
mov rax, qword gs:[0x60]
xchg rdx, rcx
mov rdx, qword [rax + 0x30]
xchg rdx, rcx
cmp dword [rcx + 0x70], 2
jbe 0x14002cc05
mov eax, 0x122acd1a
xor eax, 0x64f15f11
sub eax, 0x6eec5e89
xor eax, 0x50229805
add eax, 0x266ff4d2
sub eax, 0x7e3da057
jmp 0x14002cce9
cmp dword [rcx + 0x74], ebx
jbe 0x14002cc31
mov eax, 0x72ca3d04
sub eax, 0x1d2aab76
add eax, 0x28eda451
sub eax, 0x4affbd20
add eax, 0x31808ec8
sub eax, 0x650e0784
jmp 0x14002cce9
cmp byte [rdi + 2], bl
je 0x14002cc6c
mov eax, 0x60363e77
xor eax, 0x4b62a4e1
sub eax, 0xb5a182d
add eax, 0x5d219613
sub eax, 0x386d56dd
sub eax, 0x11307770
xor eax, 0x7789892d
xor eax, 0x1981db90
sub eax, 0x5d76188e
jmp 0x14002cce9
cmp r14d, 0xa
jb 0x14002ccae
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002ccae
mov eax, 0x72241db7
sub eax, 0x2cdc48ab
add eax, 0x1f869ab5
add eax, 0x18023bd1
xor eax, 0x39c79f66
sub eax, 0x451734ec
jmp 0x14002cce9
lea rcx, [rsi + 0xb8]
mov edx, 0x6acfa1d3
sub edx, 0x65b4d45b
add edx, 0x724ae7bd
sub edx, 0x3bcb0bb4
xor edx, 0x67fb3d98
add edx, 0x3d380580
call fcn.14002c0e0
jmp 0x14002cce7
mov eax, ebx
mov rbx, qword [rsp + 0x48]
xchg rdx, rsi
mov rdx, qword [rsp + 0x50]
xchg rdx, rsi
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140033cf0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 0x10], rdi
xchg rbx, rdi
mov qword [rsp + 0x18], rbp
push rax
mov qword [rsp], rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg r8, rbx
mov r8, rbx
xchg rbx, r8
xchg rdx, r8
mov rsi, r8
xchg r8, rdx
xchg r9, rbp
mov r9, rcx
xchg r9, rbp
jne 0x140033dc2
xchg r11, rdi
mov qword [rsp + 0x30], r11
xchg r11, rdi
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 0x10]
mov rdx, rsi
xchg rbp, rcx
mov rbp, rcx
xchg rcx, rbp
call fcn.140033cf0
xchg rdi, rbx
mov rbx, rdi
xchg rdi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004cb90
mov edx, 0x1438793b
add edx, 0x4e639573
sub edx, 0x5d0e6ba9
add edx, 0x35b2ad53
sub edx, 0xbf20f24
sub edx, 0x3436d20
add edx, 0x1d73e7c
xor edx, 0x2de212c0
xchg rdx, rcx
mov rdx, rdi
xchg rcx, rdx
call fcn.1401fc608
cmp byte [rbx + 0x19], 0
je 0x140033d46
xchg rdi, rdx
mov rdx, qword [rsp + 0x30]
xchg rdi, rdx
mov rbx, qword [rsp + 0x38]
xchg r9, rbp
mov r9, qword [rsp + 0x40]
xchg r9, rbp
add rsp, 0x20
push rcx
push rbx
push rdx
push rbx
xchg qword [rsp + 0x20], rsi
add rsp, 0x28
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140035a30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
nop
mov qword [rsp - 8], rbx
sub rsp, 8
push rsi
push rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r13
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x30
xchg r8, r15
mov r8, rdx
xchg r15, r8
xchg rbp, r14
mov rbp, rcx
xchg r14, rbp
movabs rsi, 0xfffffff62c0bda5
sub rsi, 0x134a6b40
sub rsi, 0x2ef051bb
add rsi, 0x43ed3630
add rsi, 0x1561bb46
xor rsi, 0x306773b5
add rsi, 0x7fffffff
add rsi, 0x364c7e6b
cmp rdx, rsi
ja 0x140035c84
xchg r12, rbp
mov rbp, qword [rcx + 8]
xchg rbp, r12
sub r12, qword [rcx]
sar r12, 1
sar r12, 2
sar r12, 1
mov rcx, qword [rcx + 0x10]
sub rcx, qword [r14]
sar rcx, 3
sar rcx, 1
xchg r14, rdx
mov r14, rcx
xchg rdx, r14
shr rdx, 1
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
sub rax, rdx
cmp rcx, rax
ja 0x140035b0f
lea rsi, [rdx + rcx]
cmp rsi, r15
cmovb rsi, r15
mov qword [rsp + 0x88], rsi
mov rdx, rsi
xchg r8, rcx
mov r8, r14
xchg rcx, r8
call fcn.140053660
xchg r9, rax
mov r13, r9
xchg r9, rax
xchg rbp, rax
mov qword [rsp + 0x28], rbp
xchg rbp, rax
xchg rbx, rcx
mov rcx, r12
xchg rcx, rbx
shl rbx, 2
shl rbx, 1
shl rbx, 1
add rbx, rax
mov qword [rsp + 0x20], rbx
xchg r15, r12
mov rdi, r12
xchg r15, r12
sub rdi, r12
xchg rbx, r9
mov qword [rsp + 0x78], r9
xchg r9, rbx
je 0x140035bbf
nop word [rax + rax]
mov byte [rbx], 0x3d
xor byte [rbx], 0xb
sub byte [rbx], 0x2a
add byte [rbx], 0x43
add byte [rbx], 0x21
sub byte [rbx], 0x6e
xor byte [rbx], 2
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004b980
nop
nop
sub rbx, 0xd626705
add rbx, 0xd626715
xchg rbx, r14
mov qword [rsp + 0x78], r14
xchg r14, rbx
sub rdi, 1
jne 0x140035b7a
mov r8, qword [r14 + 8]
mov rdx, r13
xchg rcx, rbx
mov rbx, qword [r14]
xchg rcx, rbx
cmp rcx, r8
je 0x140035c04
xor r9d, r9d
movzx eax, byte [rcx]
mov byte [rdx], al
mov rax, qword [rcx + 8]
xchg rdi, rax
mov qword [rdx + 8], rdi
xchg rdi, rax
mov byte [rcx], r9b
mov qword [rcx + 8], r9
lea rdx, [rdx + 0x10]
add rcx, 0x10
cmp rcx, r8
jne 0x140035bdb
xchg rcx, r9
mov rcx, rsi
xchg r9, rcx
xchg r8, r12
mov r12, r15
xchg r8, r12
xchg rdx, rsi
mov rsi, r13
xchg rdx, rsi
xchg r14, r13
mov rcx, r13
xchg r13, r14
add rsp, 0x30
push rbx
push rbx
push rbx
push rcx
xchg qword [rsp + 0x20], r15
pop rcx
pop rbx
pop rbx
pop rbx
add rsp, 8
push rdx
push rdx
push rcx
xchg qword [rsp + 0x18], r14
add rsp, 0x20
push rbx
push rdx
push rax
push rax
push rdx
push rbx
xchg qword [rsp + 0x30], r13
add rsp, 0x38
nop
mov r12, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
add rsp, 8
mov rbx, qword [rsp - 8]
jmp fcn.1400527a0
call fcn.14002f950
int3
Function at 0x140035d10
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rbx
mov qword [rsp + 8], r14
xchg rbx, r14
nop
push 0x15daad49
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rdx
xchg r13, rcx
mov rbx, r13
xchg rcx, r13
test rdx, rdx
je 0x140035d76
nop word [rax + rax]
mov byte [rbx], 0x16
add byte [rbx], 0xf
add byte [rbx], 0x3a
xor byte [rbx], 0x5f
xor byte [rbx], 0x4b
sub byte [rbx], 0x37
add byte [rbx], 8
add byte [rbx], 0x2a
sub byte [rbx], 0x46
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004b980
nop
sub rbx, 0xfffffffffffffff0
sub rdi, 1
jne 0x140035d45
xchg r14, rax
mov r14, rbx
xchg r14, rax
xchg r8, rbx
mov r8, qword [rsp + 0x30]
xchg rbx, r8
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14004c1b0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x3d
add byte [rcx + rax + 6], 0x29
xor byte [rcx + rax + 6], 0x65
add byte [rcx + rax + 6], 0x4c
add byte [rcx + rax + 6], 0x29
xor byte [rcx + rax + 6], 0x1c
add byte [rcx + rax + 6], 0x17
xor byte [rcx + rax + 6], 0x7f
sub byte [rcx + rax + 6], 4
inc rax
cmp rax, 0xa
jb 0x14004c1b2
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140076130
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, r9
mov rcx, r9
xchg rcx, r9
mov r8d, 0x786b4f89
xor r8d, 0x22491028
sub r8d, 0x39c0b0ea
xor r8d, 0x45020998
sub r8d, 0x571b769b
add r8d, 0x50b5b646
add r8d, 0xa1021925
test rcx, rcx
je 0x14007623f
cmp byte [rcx], 0
je 0x14007623f
test rdx, rdx
jne 0x1400761d0
nop
movabs rdx, 0xffffffff2b9fcaec
xor rdx, 0x4c5cf797
xor rdx, 0x71f664be
add rdx, 0x189536b1
add rdx, 0x1b4a1900
add rdx, 0x7fffffff
xor rdx, 0x35eb568a
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x1400761ba
test rdx, rdx
je 0x14007623c
xor r10d, r10d
lea r11, [0x140002dd0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
or rcx, qword [rsp]
add rsp, 0x10
shr r8d, 5
shr r8d, 1
shr r8d, 2
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x1400761e2
not r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007b050
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rax
mov r11, qword [rcx + 0x10]
xchg r11, rax
xchg r10, rdx
mov r10, rcx
xchg r10, rdx
test rax, rax
jne 0x14007b06d
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x14007b0b6
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b09b
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b07b
xchg r10, rax
mov r10, qword [rdx + 0x10]
xchg r10, rax
mov byte [rdx], 0x77
xor byte [rdx], 0x6a
sub byte [rdx], 1
xor byte [rdx], 0x41
add byte [rdx], 6
sub byte [rdx], 7
add byte [rdx], 0xe
xor byte [rdx], 0x51
xor byte [rdx], 0x3a
ret

Function at 0x14007b0c0
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rax
mov rdi, qword [rcx + 0x10]
xchg rdi, rax
xchg r14, rdx
mov r14, rcx
xchg r14, rdx
test rax, rax
jne 0x14007b0e5
xor r8d, r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b128
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b116
xchg r15, rcx
mov r15, qword [rdx + 0x10]
xchg r15, rcx
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b0f3
xchg rsi, rax
mov rsi, qword [rdx + 0x10]
xchg rsi, rax
mov byte [rdx], 0x3d
xor byte [rdx], 0x1b
add byte [rdx], 0x53
xor byte [rdx], 0x7a
add byte [rdx], 0x18
xor byte [rdx], 0x1a
ret

Function at 0x14007b460
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg r12, rcx
mov rdx, r12
xchg rcx, r12
test rax, rax
jne 0x14007b47b
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b4bc
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b4aa
nop dword [rax + rax]
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b48e
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x4b
sub byte [rdx], 0x28
sub byte [rdx], 0x10
add byte [rdx], 0x52
sub byte [rdx], 0x3b
sub byte [rdx], 0x29
ret

Function at 0x14007bcf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 4]
xchg rbx, r13
mov rdx, r13
xchg r13, rbx
call fcn.14007a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0x54
xor byte [rbx + rax], 0x59
xor byte [rbx + rax], 0x40
sub byte [rbx + rax], 0xb
xor byte [rbx + rax], 0x3f
sub byte [rbx + rax], 0x3b
xor byte [rbx + rax], 5
add byte [rbx + rax], 0x37
sub byte [rbx + rax], 0x7e
inc rax
cmp rax, 6
jb 0x14007bd17
xchg r9, rax
mov r9, rdi
xchg r9, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007bd70
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 8], r11
xchg r11, rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rbx, rdi
mov rbx, rcx
xchg rbx, rdi
lea rbx, [rdx + 6]
xchg rbx, rbp
mov rdx, rbp
xchg rbp, rbx
call fcn.14007a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0x29
sub byte [rbx + rax], 0x27
xor byte [rbx + rax], 0x74
xor byte [rbx + rax], 0x20
sub byte [rbx + rax], 0x37
xor byte [rbx + rax], 0x62
xor byte [rbx + rax], 0x7d
inc rax
cmp rax, 8
jb 0x14007bdab
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007bdf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 6]
mov rdx, rbx
call fcn.14007a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0x6e
xor byte [rbx + rax], 0x7d
add byte [rbx + rax], 0x6a
sub byte [rbx + rax], 0x3e
sub byte [rbx + rax], 4
add byte [rbx + rax], 0x1b
xor byte [rbx + rax], 0x6c
sub byte [rbx + rax], 0x3a
inc rax
cmp rax, 0xa
jb 0x14007be20
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rbx, rdx
add rsp, 0x20
push rax
push rdx
push rcx
push rbx
xchg qword [rsp + 0x20], rdi
pop rbx
pop rcx
pop rdx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007be80
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rcx, rbx
xchg rdx, r12
mov qword [rsp + 0x10], r12
xchg rdx, r12
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 8]
xchg r8, rbx
mov rdx, r8
xchg rbx, r8
call fcn.14007a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0x19
xor byte [rbx + rax], 0x4b
xor byte [rbx + rax], 0x2e
sub byte [rbx + rax], 0xa
xor byte [rbx + rax], 0x26
xor byte [rbx + rax], 0x54
inc rax
cmp rax, 0xe
jb 0x14007bec2
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, r10
mov r10, qword [rsp + 0x30]
xchg rbx, r10
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007bf10
Capabilities:
Encode data using xor

Disassembly:
xchg r10, rbx
mov qword [rsp + 8], r10
xchg rbx, r10
mov qword [rsp + 0x10], rdx
nop
push r12
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xa]
mov rdx, rbx
call fcn.14007a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0x22
add byte [rbx + rax], 0x40
xor byte [rbx + rax], 0x15
sub byte [rbx + rax], 0x43
xor byte [rbx + rax], 0x1f
add byte [rbx + rax], 0x10
add byte [rbx + rax], 0x30
xor byte [rbx + rax], 0x15
sub byte [rbx + rax], 0x7e
inc rax
cmp rax, 0x10
jb 0x14007bf3d
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c030
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rbx
mov qword [rsp + 8], r9
xchg rbx, r9
xchg r11, rdx
mov qword [rsp + 0x10], r11
xchg r11, rdx
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x10]
mov rdx, rbx
call fcn.14007a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0x38
sub byte [rbx + rax], 0x11
xor byte [rbx + rax], 0x22
xor byte [rbx + rax], 0x46
xor byte [rbx + rax], 0x74
xor byte [rbx + rax], 0x37
inc rax
cmp rax, 0x1e
jb 0x14007c063
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rdx
push rax
push rbx
push rbx
push rdx
xchg qword [rsp + 0x30], rdi
pop rdx
pop rbx
pop rbx
pop rax
pop rdx
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c0c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, rdx
mov qword [rsp + 0x10], rbp
xchg rdx, rbp
push rdi
sub rsp, 0x20
xchg rbp, rcx
mov rdi, rbp
xchg rbp, rcx
lea rbx, [rdx + 0x12]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0x6c
xor byte [rbx + rax], 0x1c
sub byte [rbx + rax], 9
sub byte [rbx + rax], 0x59
add byte [rbx + rax], 0x4c
xor byte [rbx + rax], 1
xor byte [rbx + rax], 0x5b
inc rax
cmp rax, 0x20
jb 0x14007c0f3
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007c130
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r8, rdx
mov qword [rsp + 0x10], r8
xchg rdx, r8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rbx, rdi
mov rbx, rcx
xchg rdi, rbx
lea rbx, [rdx + 0x12]
xchg r11, rbx
mov rdx, r11
xchg r11, rbx
call fcn.14007a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0x37
xor byte [rbx + rax], 0x17
sub byte [rbx + rax], 0x15
xor byte [rbx + rax], 0x2d
add byte [rbx + rax], 0x32
xor byte [rbx + rax], 0x6b
add byte [rbx + rax], 0xf
sub byte [rbx + rax], 0x11
sub byte [rbx + rax], 0x31
inc rax
cmp rax, 0x22
jb 0x14007c16c
xchg r15, rdi
mov rax, r15
xchg r15, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rbx
push rbx
push rbx
push rbx
push rcx
push rdx
push rax
xchg qword [rsp + 0x40], rdi
pop rax
pop rdx
pop rcx
pop rbx
pop rbx
pop rbx
pop rbx
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c1d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rbp
mov rdi, rbp
xchg rbp, rcx
lea rbx, [rdx + 0x14]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0xa
xor byte [rbx + rax], 0x4a
xor byte [rbx + rax], 0x5a
add byte [rbx + rax], 0x20
sub byte [rbx + rax], 0x2d
xor byte [rbx + rax], 0x38
add byte [rbx + rax], 0xe
xor byte [rbx + rax], 0x5c
sub byte [rbx + rax], 0x1f
inc rax
cmp rax, 0x24
jb 0x14007c1fd
xchg rdi, rbx
mov rax, rbx
xchg rbx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rbx
push rax
push rdx
push rax
push rdx
push rdx
push rdx
xchg qword [rsp + 0x40], rdi
pop rdx
pop rdx
pop rdx
pop rax
pop rdx
pop rax
pop rbx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c260
Capabilities:
Encode data using xor

Disassembly:
xchg r10, rbx
mov qword [rsp + 8], r10
xchg rbx, r10
mov qword [rsp + 0x10], rdx
push rdx
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x14]
mov rdx, rbx
call fcn.14007a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0x61
sub byte [rbx + rax], 0xa
xor byte [rbx + rax], 0x3e
sub byte [rbx + rax], 0x1e
sub byte [rbx + rax], 0x2b
sub byte [rbx + rax], 0x20
inc rax
cmp rax, 0x26
jb 0x14007c291
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rbx
push rdx
push rdx
push rdx
push rdx
xchg qword [rsp + 0x30], rdi
add rsp, 0x38
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c2e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, r14
mov r14, rcx
xchg rdi, r14
lea rbx, [rdx + 0x16]
xchg rbx, rsi
mov rdx, rsi
xchg rsi, rbx
call fcn.14007a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0x26
add byte [rbx + rax], 0x3e
sub byte [rbx + rax], 0x2d
sub byte [rbx + rax], 0x2a
add byte [rbx + rax], 0x6a
xor byte [rbx + rax], 0x5a
sub byte [rbx + rax], 0x2d
inc rax
cmp rax, 0x28
jb 0x14007c30d
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c360
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r9
mov qword [rsp + 0x10], r9
xchg r9, rdx
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x16]
mov rdx, rbx
call fcn.14007a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0x19
sub byte [rbx + rax], 0x10
xor byte [rbx + rax], 0x28
xor byte [rbx + rax], 0x1c
sub byte [rbx + rax], 6
sub byte [rbx + rax], 0x37
inc rax
cmp rax, 0x2a
jb 0x14007c38d
xchg rdi, r13
mov rax, r13
xchg r13, rdi
xchg rsi, rbx
mov rsi, qword [rsp + 0x30]
xchg rsi, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c3e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r15, rdx
mov qword [rsp + 0x10], r15
xchg r15, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, r14
mov rdi, r14
xchg r14, rcx
lea rbx, [rdx + 0x18]
xchg rbx, r13
mov rdx, r13
xchg rbx, r13
call fcn.14007a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0x47
xor byte [rbx + rax], 0x19
sub byte [rbx + rax], 0x4d
sub byte [rbx + rax], 0xe
add byte [rbx + rax], 8
add byte [rbx + rax], 0x21
sub byte [rbx + rax], 0x2c
inc rax
cmp rax, 0x2e
jb 0x14007c41b
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg r8, rbx
mov r8, qword [rsp + 0x30]
xchg rbx, r8
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]