joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140033750
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r15
mov qword [rsp + 0x10], r15
xchg r15, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r11, rdi
mov r11, rcx
xchg rdi, r11
lea rbx, [rdx + 0x18]
xchg rsi, rbx
mov rdx, rsi
xchg rbx, rsi
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x49
xor byte [rbx + rax], 0x41
add byte [rbx + rax], 0x4f
sub byte [rbx + rax], 0xc
sub byte [rbx + rax], 0x1c
xor byte [rbx + rax], 0x15
sub byte [rbx + rax], 6
sub byte [rbx + rax], 0xa
sub byte [rbx + rax], 0x2a
inc rax
cmp rax, 0x2e
jb 0x14003378c
xchg r13, rdi
mov rax, r13
xchg rdi, r13
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x1400337e0
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rbx
mov qword [rsp + 8], r8
xchg rbx, r8
xchg r11, rdx
mov qword [rsp + 0x10], r11
xchg r11, rdx
push rdi
sub rsp, 0x20
xchg rdi, rsi
mov rsi, rcx
xchg rdi, rsi
lea rbx, [rdx + 0x1a]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x3c
xor byte [rbx + rax], 3
sub byte [rbx + rax], 0x29
add byte [rbx + rax], 0x66
sub byte [rbx + rax], 0xc
sub byte [rbx + rax], 0x4e
add byte [rbx + rax], 0x57
sub byte [rbx + rax], 0x79
inc rax
cmp rax, 0x32
jb 0x140033819
xchg rdx, rax
mov rdx, rdi
xchg rdx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
xchg qword [rsp + 8], rdi
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140033870
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r10
mov qword [rsp + 8], r10
xchg r10, rbx
xchg rsi, rdx
mov qword [rsp + 0x10], rsi
xchg rdx, rsi
push rsi
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rbp
mov rdi, rbp
xchg rcx, rbp
lea rbx, [rdx + 0x1c]
xchg r14, rdx
mov r14, rbx
xchg rdx, r14
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x76
xor byte [rbx + rax], 0xa
xor byte [rbx + rax], 0x3c
sub byte [rbx + rax], 7
xor byte [rbx + rax], 0x29
xor byte [rbx + rax], 0x4b
sub byte [rbx + rax], 0x5b
inc rax
cmp rax, 0x34
jb 0x1400338ad
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rbx
push rax
push rax
push rax
xchg qword [rsp + 0x28], rdi
add rsp, 0x30
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140033990
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x1e]
xchg rbp, rdx
mov rbp, rbx
xchg rdx, rbp
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x6a
sub byte [rbx + rax], 0x20
xor byte [rbx + rax], 3
sub byte [rbx + rax], 0x3b
xor byte [rbx + rax], 0x2b
sub byte [rbx + rax], 0x25
inc rax
cmp rax, 0x38
jb 0x1400339b7
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x1400339f0
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rbx, rdi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x20]
xchg rcx, rdx
mov rcx, rbx
xchg rdx, rcx
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x15
sub byte [rbx + rax], 9
add byte [rbx + rax], 0x6d
sub byte [rbx + rax], 0x5f
add byte [rbx + rax], 0x24
xor byte [rbx + rax], 0x26
xor byte [rbx + rax], 0x51
xor byte [rbx + rax], 0x44
xor byte [rbx + rax], 0xd
inc rax
cmp rax, 0x3e
jb 0x140033a1d
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140033a70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r12
mov qword [rsp + 0x10], r12
xchg rdx, r12
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r13, rcx
mov rdi, r13
xchg r13, rcx
lea rbx, [rdx + 0x22]
xchg rbx, rdi
mov rdx, rdi
xchg rbx, rdi
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x24
add byte [rbx + rax], 0x54
sub byte [rbx + rax], 0x41
xor byte [rbx + rax], 0x47
sub byte [rbx + rax], 0x39
sub byte [rbx + rax], 0x37
inc rax
cmp rax, 0x40
jb 0x140033aac
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rbx, rdx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x140033af0
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rbx
mov qword [rsp + 8], r14
xchg r14, rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x22]
mov rdx, rbx
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0xf
xor byte [rbx + rax], 0x67
sub byte [rbx + rax], 0x29
xor byte [rbx + rax], 0x3f
add byte [rbx + rax], 3
add byte [rbx + rax], 0x36
sub byte [rbx + rax], 0x39
inc rax
cmp rax, 0x42
jb 0x140033b25
xchg rdx, rax
mov rdx, rdi
xchg rdx, rax
xchg r14, rbx
mov r14, qword [rsp + 0x30]
xchg r14, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140033b80
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rbx
mov qword [rsp + 8], r8
xchg rbx, r8
xchg rsi, rdx
mov qword [rsp + 0x10], rsi
xchg rsi, rdx
push rsi
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x24]
xchg r15, rdx
mov r15, rbx
xchg rdx, r15
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x62
xor byte [rbx + rax], 0x57
xor byte [rbx + rax], 0x13
add byte [rbx + rax], 0xe
add byte [rbx + rax], 0x3f
sub byte [rbx + rax], 0x73
inc rax
cmp rax, 0x46
jb 0x140033bbd
xchg r8, rdi
mov rax, r8
xchg r8, rdi
xchg rbx, r8
mov r8, qword [rsp + 0x30]
xchg r8, rbx
add rsp, 0x20
push rcx
push rbx
push rdx
xchg qword [rsp + 0x18], rdi
pop rdx
pop rbx
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140033c80
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 8], r15
xchg r15, rbx
xchg rdi, rdx
mov qword [rsp + 0x10], rdi
xchg rdx, rdi
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x28]
xchg rbx, r14
mov rdx, r14
xchg rbx, r14
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x76
xor byte [rbx + rax], 0x40
sub byte [rbx + rax], 0x28
add byte [rbx + rax], 0x25
add byte [rbx + rax], 0x17
sub byte [rbx + rax], 0x4a
inc rax
cmp rax, 0x4c
jb 0x140033cb9
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rbp
mov rbp, qword [rsp + 0x30]
xchg rbx, rbp
add rsp, 0x20
push rdx
push rax
push rax
push rcx
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140033d10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r14
mov qword [rsp + 0x10], r14
xchg r14, rdx
push rdi
sub rsp, 0x20
xchg rcx, r13
mov rdi, r13
xchg rcx, r13
lea rbx, [rdx + 0x2a]
xchg rbx, rcx
mov rdx, rcx
xchg rbx, rcx
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x56
xor byte [rbx + rax], 0x70
xor byte [rbx + rax], 8
add byte [rbx + rax], 0x2e
sub byte [rbx + rax], 0x3d
add byte [rbx + rax], 0x54
sub byte [rbx + rax], 0x38
add byte [rbx + rax], 0x37
sub byte [rbx + rax], 0x72
inc rax
cmp rax, 0x50
jb 0x140033d43
xchg rsi, rdi
mov rax, rsi
xchg rdi, rsi
xchg rbx, r13
mov r13, qword [rsp + 0x30]
xchg rbx, r13
add rsp, 0x20
push rdx
push rdx
push rax
push rcx
push rbx
push rcx
xchg qword [rsp + 0x30], rdi
add rsp, 0x38
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140033e20
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rbx
mov qword [rsp + 8], r15
xchg rbx, r15
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x2c]
xchg rdx, rdi
mov rdi, rbx
xchg rdi, rdx
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x22
add byte [rbx + rax], 0x45
add byte [rbx + rax], 8
sub byte [rbx + rax], 0x22
sub byte [rbx + rax], 0xe
add byte [rbx + rax], 0x20
xor byte [rbx + rax], 0x71
sub byte [rbx + rax], 0x2e
inc rax
cmp rax, 0x54
jb 0x140033e55
mov rax, rdi
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x140033ea0
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 8], r13
xchg rbx, r13
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x2e]
xchg rbx, r12
mov rdx, r12
xchg r12, rbx
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x59
sub byte [rbx + rax], 0x1a
sub byte [rbx + rax], 0xa
add byte [rbx + rax], 0xe
sub byte [rbx + rax], 0x18
xor byte [rbx + rax], 0x77
xor byte [rbx + rax], 0x4f
sub byte [rbx + rax], 0x13
inc rax
cmp rax, 0x5a
jb 0x140033ecd
xchg r12, rdi
mov rax, r12
xchg r12, rdi
xchg rbx, r15
mov r15, qword [rsp + 0x30]
xchg rbx, r15
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140033f20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r13
mov qword [rsp + 0x10], r13
xchg r13, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdx
mov rdi, rdx
xchg rcx, rdx
lea rbx, [rdx + 0x30]
xchg r13, rdx
mov r13, rbx
xchg r13, rdx
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], SHCreateMemStream
add byte [rbx + rax], 0x2c
xor byte [rbx + rax], 0x39
add byte [rbx + rax], 0x18
add byte [rbx + rax], 0x27
xor byte [rbx + rax], 0xf
add byte [rbx + rax], 0x2e
xor byte [rbx + rax], 0x2a
xor byte [rbx + rax], 0x5a
inc rax
cmp rax, 0x5c
jb 0x140033f5b
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rcx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x140033fb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r12
mov r12, rcx
xchg rdi, r12
lea rbx, [rdx + 0x30]
mov rdx, rbx
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x31
xor byte [rbx + rax], 4
xor byte [rbx + rax], 0x1b
sub byte [rbx + rax], 0x17
add byte [rbx + rax], 0x4e
sub byte [rbx + rax], 0x49
add byte [rbx + rax], 0x17
add byte [rbx + rax], 6
xor byte [rbx + rax], 0x39
inc rax
cmp rax, 0x5e
jb 0x140033fdf
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rcx
push rcx
push rdx
xchg qword [rsp + 0x20], rdi
pop rdx
pop rcx
pop rcx
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140034040
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rbx
mov qword [rsp + 8], rbp
xchg rbx, rbp
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x32]
mov rdx, rbx
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x76
sub byte [rbx + rax], 0x11
sub byte [rbx + rax], 0x37
xor byte [rbx + rax], 0x40
sub byte [rbx + rax], 0x6e
add byte [rbx + rax], 0
inc rax
cmp rax, 0x60
jb 0x14003406d
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rcx, rbx
mov rcx, qword [rsp + 0x30]
xchg rbx, rcx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x140034130
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg rbx, r11
xchg r15, rdx
mov qword [rsp + 0x10], r15
xchg rdx, r15
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r13, rcx
mov rdi, r13
xchg r13, rcx
lea rbx, [rdx + 0x4e]
mov rdx, rbx
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 6
xor byte [rbx + rax], 0x6d
sub byte [rbx + rax], 0x43
add byte [rbx + rax], 0x26
xor byte [rbx + rax], 0x6c
xor byte [rbx + rax], 0x22
inc rax
cmp rax, 0x98
jb 0x14003416b
xchg rdi, rsi
mov rax, rsi
xchg rdi, rsi
xchg r11, rbx
mov r11, qword [rsp + 0x30]
xchg r11, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret
Function at 0x1400341c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x56]
mov rdx, rbx
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x41
xor byte [rbx + rax], 0x1b
sub byte [rbx + rax], 0xa
sub byte [rbx + rax], 0x2b
sub byte [rbx + rax], 9
add byte [rbx + rax], 9
sub byte [rbx + rax], 0x25
inc rax
cmp rax, 0xa8
jb 0x1400341ef
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140034240
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r13
mov qword [rsp + 0x10], r13
xchg rdx, r13
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x5a]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x1b
xor byte [rbx + rax], 0x59
sub byte [rbx + rax], 0x18
add byte [rbx + rax], 0x50
xor byte [rbx + rax], 0x68
add byte [rbx + rax], 0x65
sub byte [rbx + rax], 0x63
xor byte [rbx + rax], 0x14
inc rax
cmp rax, 0xb0
jb 0x140034273
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x1400342c0
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rbx
mov qword [rsp + 8], r15
xchg r15, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rdx
mov rdi, rdx
xchg rcx, rdx
lea rbx, [rdx + 0x70]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x61
xor byte [rbx + rax], 0x7e
xor byte [rbx + rax], 0x1a
xor byte [rbx + rax], 0x64
xor byte [rbx + rax], 0x3c
sub byte [rbx + rax], 0x5d
inc rax
cmp rax, 0xdc
jb 0x1400342f3
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x140034330
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rbx, rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rbx, rdi
mov rbx, rcx
xchg rbx, rdi
lea rbx, [rdx + 0x70]
xchg rdx, rsi
mov rsi, rbx
xchg rdx, rsi
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0xf
xor byte [rbx + rax], 0x7d
sub byte [rbx + rax], 0x45
xor byte [rbx + rax], 0xe
add byte [rbx + rax], 0x43
sub byte [rbx + rax], 0x14
sub byte [rbx + rax], 0x51
xor byte [rbx + rax], 1
inc rax
cmp rax, 0xde
jb 0x140034363
xchg r11, rax
mov r11, rdi
xchg r11, rax
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
add rsp, 0x20
push rbx
xchg qword [rsp + 8], rdi
add rsp, 0x10
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400343c0
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rsi, rbx
xchg rdi, rdx
mov qword [rsp + 0x10], rdi
xchg rdi, rdx
push rdi
sub rsp, 0x20
xchg rdi, r14
mov r14, rcx
xchg r14, rdi
lea rbx, [rdx + 0x76]
xchg r12, rbx
mov rdx, r12
xchg r12, rbx
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x49
xor byte [rbx + rax], 0x48
add byte [rbx + rax], 0x7c
sub byte [rbx + rax], 0x14
sub byte [rbx + rax], 0x38
xor byte [rbx + rax], 0x48
xor byte [rbx + rax], 0x5f
sub byte [rbx + rax], 0x26
inc rax
cmp rax, 0xea
jb 0x1400343f9
mov rax, rdi
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
add rsp, 0x20
push rbx
push rbx
push rbx
push rax
push rax
xchg qword [rsp + 0x28], rdi
add rsp, 0x30
ret

Function at 0x140034450
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rbx
mov qword [rsp + 8], r8
xchg r8, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg r12, rcx
mov rdi, r12
xchg rcx, r12
lea rbx, [rdx + 0x7c]
xchg r14, rdx
mov r14, rbx
xchg rdx, r14
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x3d
xor byte [rbx + rax], 0x16
sub byte [rbx + rax], 0x1c
add byte [rbx + rax], 0x24
xor byte [rbx + rax], 0x70
sub byte [rbx + rax], 0x13
add byte [rbx + rax], 0x46
add byte [rbx + rax], 6
sub byte [rbx + rax], 0x7c
inc rax
cmp rax, 0xf4
jb 0x140034483
xchg r12, rax
mov r12, rdi
xchg r12, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x1400344e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdi, rdx
mov qword [rsp + 0x10], rdi
xchg rdx, rdi
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x9a]
xchg rbx, r14
mov rdx, r14
xchg r14, rbx
call fcn.140031d00
nop
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbx + rax], 0
xor byte [rbx + rax], 0x10
xor byte [rbx + rax], 0x12
xor byte [rbx + rax], 0x20
xor byte [rbx + rax], 0x51
xor byte [rbx + rax], 0x4a
sub byte [rbx + rax], 9
sub byte [rbx + rax], 0x30
inc rax
cmp rax, 0x130
jb 0x140034524
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x140034570
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, rdx
mov qword [rsp + 0x10], rbp
xchg rbp, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0xc]
xchg r11, rbx
mov rdx, r11
xchg rbx, r11
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x1b
xor byte [rbx + rax], 1
xor byte [rbx + rax], 0x3a
add byte [rbx + rax], 0x3a
xor byte [rbx + rax], 0x37
add byte [rbx + rax], 7
sub byte [rbx + rax], 8
sub byte [rbx + rax], 0x6c
inc rax
cmp rax, 0x14
jb 0x1400345ab
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140034600
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 8], r13
xchg r13, rbx
xchg r14, rdx
mov qword [rsp + 0x10], r14
xchg rdx, r14
nop
push r14
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xe]
mov rdx, rbx
call fcn.140031d00
nop
xor eax, eax
mov byte [rbx + rax], 0x62
xor byte [rbx + rax], 0x6f
add byte [rbx + rax], 0x4f
sub byte [rbx + rax], 0xd
add byte [rbx + rax], 0x26
sub byte [rbx + rax], 0x75
inc rax
cmp rax, 0x18
jb 0x140034633
mov rax, rdi
xchg rbp, rbx
mov rbp, qword [rsp + 0x30]
xchg rbx, rbp
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14003ae70
Capabilities:
Encode data using xor

Disassembly:
xchg r11, r8
mov rax, r11
xchg r11, r8
cmp rcx, rdx
je 0x14003afc3
mov r9, rax
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
xchg rdx, rax
movups xmmword [rdx], xmm0
xchg rdx, rax
mov qword [r9 + r8 - 0x70], r10
xchg r10, r14
mov qword [r9 + r8 - 0x68], r14
xchg r10, r14
movups xmm0, xmmword [r8 - 0x80]
movups xmmword [rax], xmm0
xchg r8, r13
movups xmm1, xmmword [r13 - 0x70]
xchg r8, r13
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm1
mov qword [r8 - 0x70], r10
sub rax, 0xffffffffffffffb8
mov qword [r8 - 0x68], 0x512a3eb7
xor qword [r8 - 0x68], 0x15e8373b
sub qword [r8 - 0x68], 0x3e96a622
xor qword [r8 - 0x68], 0x2cf9caeb
add qword [r8 - 0x68], 0x4168c242
sub qword [r8 - 0x68], 0x6986b675
add qword [r8 - 0x68], 0x67c75704
sub qword [r8 - 0x68], 0x6a7c0c4b
mov word [r8 - 0x80], r10w
xchg r12, r9
movups xmmword [r12 + r8 - 0x60], xmm0
xchg r9, r12
xchg r10, r14
mov qword [r9 + r8 - 0x50], r14
xchg r14, r10
xchg rdi, r10
mov qword [r9 + r8 - 0x48], rdi
xchg r10, rdi
xchg r9, r8
movups xmm0, xmmword [r9 - 0x60]
xchg r9, r8
movups xmmword [r9 + r8 - 0x60], xmm0
xchg r8, rdx
movups xmm1, xmmword [rdx - 0x50]
xchg rdx, r8
xchg rcx, r9
movups xmmword [rcx + r8 - 0x50], xmm1
xchg rcx, r9
mov qword [r8 - 0x50], r10
mov qword [r8 - 0x48], 0x3fbea87
add qword [r8 - 0x48], 0x4c1256e7
sub qword [r8 - 0x48], 0x12e7b6dd
sub qword [r8 - 0x48], 0x158759bb
add qword [r8 - 0x48], 0x97116e6
xor qword [r8 - 0x48], 0x71996cd
xor qword [r8 - 0x48], 0x1632d64f
sub qword [r8 - 0x48], 0x203b0737
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x14003ae96
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14003b0e0
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rax
mov r8, rax
xchg r8, rax
cmp rcx, rdx
je 0x14003b1a8
xchg rbx, r9
mov rbx, rax
xchg r9, rbx
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg rbp, rax
movups xmmword [rbp], xmm0
xchg rbp, rax
mov qword [r9 + r8 - 0x28], r10
lea rcx, [r8 - 0x18]
mov qword [r8 + r9 - 0x20], r10
xchg r8, r9
movups xmm0, xmmword [r9 - 0x38]
xchg r8, r9
xchg r15, rax
movups xmmword [r15], xmm0
xchg r15, rax
xchg r8, rbp
movups xmm1, xmmword [rbp - 0x28]
xchg r8, rbp
xchg r8, rax
movups xmmword [r8 + 0x10], xmm1
xchg r8, rax
mov qword [r8 - 0x28], r10
nop
add rax, 0x36c45740
sub rax, 0x36c45720
mov qword [r8 - 0x20], 0x43acc616
xor qword [r8 - 0x20], 0x6125def5
add qword [r8 - 0x20], 0xccc01f1
xor qword [r8 - 0x20], 0xfea79a8
xor qword [r8 - 0x20], 0x7f52150b
xor qword [r8 - 0x20], 0x5fa887f3
sub qword [r8 - 0x20], 0x45f17d
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x14003b10e
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140044860
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0xa], 0x7d
sub byte [rcx + rax + 0xa], 0x77
add byte [rcx + rax + 0xa], 0x1f
xor byte [rcx + rax + 0xa], 0x35
xor byte [rcx + rax + 0xa], 0x3b
sub byte [rcx + rax + 0xa], 0x25
sub byte [rcx + rax + 0xa], 6
inc rax
cmp rax, 0x10
jb 0x140044862
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x1400449a0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0x14], 0x62
sub byte [rcx + rax + 0x14], 0x36
xor byte [rcx + rax + 0x14], 0x71
sub byte [rcx + rax + 0x14], 0x31
xor byte [rcx + rax + 0x14], 0x7c
xor byte [rcx + rax + 0x14], 0x5c
add byte [rcx + rax + 0x14], 0x6b
sub byte [rcx + rax + 0x14], 0x77
inc rax
cmp rax, 0x24
jb 0x1400449a2
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140149e30
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov r10, rdx
xchg rcx, r11
mov rcx, r11
xchg rcx, r11
mov dword [rsp + 0x30], 0x48d8f426
sub dword [rsp + 0x30], 0x3713294f
xor dword [rsp + 0x30], 0x5a0fc96f
sub dword [rsp + 0x30], 0x33719c7c
add dword [rsp + 0x30], 0x2b45edde
add dword [rsp + 0x30], 0x2d8efec6
xor dword [rsp + 0x30], 0xcf93ed5e
mov dword [rsp + 0x36], 0x17595547
add dword [rsp + 0x36], 0x621521b5
sub dword [rsp + 0x36], 0xabb006e
xor dword [rsp + 0x36], 0x3265f5ab
xor dword [rsp + 0x36], 0x7e355bbc
xor dword [rsp + 0x36], 0x769c5919
xor dword [rsp + 0x36], 0x7bc9b439
sub dword [rsp + 0x36], 0x2e7b97a5
add dword [rsp + 0x36], 0xfe57617e
mov dword [rsp + 0x3a], 0x20c03b1f
xor dword [rsp + 0x3a], 0x76c195d1
sub dword [rsp + 0x3a], 0x476f869b
add dword [rsp + 0x3a], 0x49ae7260
xor dword [rsp + 0x3a], 0x54bbcf59
add dword [rsp + 0x3a], 0x4db1373e
xor dword [rsp + 0x3a], 0xa53a729d
xor eax, eax
mov word [rsp + 0x3e], ax
xor ebx, ebx
mov edx, ebx
nop
movzx eax, word [rsp + rdx*2 + 0x36]
movzx ecx, byte [rsp + rdx + 0x30]
add cx, ax
mov word [rsp + rdx*2 + 0x36], cx
mov byte [rsp + rdx + 0x30], bl
inc rdx
cmp rdx, 4
jb 0x140149f06
xchg r10, rax
mov r10, qword [rsp + 0x70]
xchg r10, rax
xchg rsi, rax
mov qword [rsp + 0x28], rsi
xchg rsi, rax
xchg r13, r9
mov qword [rsp + 0x20], r13
xchg r13, r9
xchg r9, rbx
mov rbx, r8
xchg r9, rbx
lea r8, [rsp + 0x36]
xchg r12, r10
mov rdx, r12
xchg r10, r12
mov rcx, r11
call fcn.140149fb0
nop
mov byte [rsp + rbx + 0x36], 0x72
xor byte [rsp + rbx + 0x36], 0x12
add byte [rsp + rbx + 0x36], 0xb
sub byte [rsp + rbx + 0x36], 0x4f
add byte [rsp + rbx + 0x36], 0x15
sub byte [rsp + rbx + 0x36], 0x31
inc rbx
cmp rbx, 8
jb 0x140149f66
add rsp, 0x40
nop
add rsp, 8
xchg qword [rsp - 8], rbx
nop
add rsp, 8
jmp qword [rsp - 8]