joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007cb40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
push 0x763a28c3
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r15
mov r15, rcx
xchg r15, rdi
lea rbx, [rdx + 0x30]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007a840
nop
xor eax, eax
mov byte [rbx + rax], 0x7c
xor byte [rbx + rax], 5
sub byte [rbx + rax], 7
xor byte [rbx + rax], 3
sub byte [rbx + rax], 0x58
sub byte [rbx + rax], 3
add byte [rbx + rax], 0x1f
add byte [rbx + rax], 0x1b
sub byte [rbx + rax], 0x50
inc rax
cmp rax, 0x5c
jb 0x14007cb76
mov rax, rdi
xchg r9, rbx
mov r9, qword [rsp + 0x30]
xchg rbx, r9
add rsp, 0x20
push rdx
push rdx
push rax
push rax
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
ret

Function at 0x14007cc60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbx, rdx
mov qword [rsp + 0x10], rbx
xchg rdx, rbx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x32]
xchg rdx, r11
mov r11, rbx
xchg r11, rdx
call fcn.14007a840
nop
xor eax, eax
mov byte [rbx + rax], 7
sub byte [rbx + rax], 2
add byte [rbx + rax], 0x35
sub byte [rbx + rax], 0x15
add byte [rbx + rax], 0x2c
sub byte [rbx + rax], 0x14
add byte [rbx + rax], 0x1a
add byte [rbx + rax], 0x12
xor byte [rbx + rax], 0x69
inc rax
cmp rax, 0x60
jb 0x14007cc95
mov rax, rdi
xchg r13, rbx
mov r13, qword [rsp + 0x30]
xchg r13, rbx
add rsp, 0x20
push rcx
push rbx
push rcx
xchg qword [rsp + 0x18], rdi
add rsp, 0x20
ret

Function at 0x14007cd80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rbx
mov qword [rsp + 0x10], rbx
xchg rbx, rdx
push rdi
sub rsp, 0x20
xchg r11, rcx
mov rdi, r11
xchg rcx, r11
lea rbx, [rdx + 0x38]
xchg rbp, rbx
mov rdx, rbp
xchg rbp, rbx
call fcn.14007a840
nop
xor eax, eax
mov byte [rbx + rax], 0x7b
sub byte [rbx + rax], 0x4d
sub byte [rbx + rax], 0xa
add byte [rbx + rax], 0x40
xor byte [rbx + rax], 0x54
xor byte [rbx + rax], 0x4a
sub byte [rbx + rax], 0x7a
inc rax
cmp rax, 0x6e
jb 0x14007cdb3
xchg rdi, r10
mov rax, r10
xchg r10, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rax
push rdx
push rdx
push rbx
xchg qword [rsp + 0x28], rdi
add rsp, 0x30
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007ce10
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rbx, rsi
xchg rdx, rcx
mov qword [rsp + 0x10], rcx
xchg rdx, rcx
push rsi
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rdx
mov rdx, rcx
xchg rdx, rdi
lea rbx, [rdx + 0x4e]
xchg r10, rdx
mov r10, rbx
xchg rdx, r10
call fcn.14007a840
nop
xor eax, eax
mov byte [rbx + rax], 0x6f
xor byte [rbx + rax], 0x70
xor byte [rbx + rax], 0x4d
xor byte [rbx + rax], 0xd
sub byte [rbx + rax], 0x45
xor byte [rbx + rax], 0x20
sub byte [rbx + rax], 0x25
xor byte [rbx + rax], 0x56
sub byte [rbx + rax], 0x43
inc rax
cmp rax, 0x98
jb 0x14007ce4d
xchg rdi, r15
mov rax, r15
xchg r15, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
xchg qword [rsp + 8], rdi
add rsp, 0x10
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007ceb0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rbx, rsi
xchg rdx, rbp
mov qword [rsp + 0x10], rbp
xchg rdx, rbp
push rdi
sub rsp, 0x20
xchg rbp, rcx
mov rdi, rbp
xchg rcx, rbp
lea rbx, [rdx + 0x56]
xchg rbp, rdx
mov rbp, rbx
xchg rdx, rbp
call fcn.14007a840
nop
xor eax, eax
mov byte [rbx + rax], 0x23
sub byte [rbx + rax], 0x23
xor byte [rbx + rax], 0x58
add byte [rbx + rax], 4
xor byte [rbx + rax], 0x73
xor byte [rbx + rax], 0x2f
inc rax
cmp rax, 0xa8
jb 0x14007cee9
mov rax, rdi
xchg r11, rbx
mov r11, qword [rsp + 0x30]
xchg rbx, r11
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cf30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x5a]
xchg r14, rdx
mov r14, rbx
xchg rdx, r14
call fcn.14007a840
nop
xor eax, eax
mov byte [rbx + rax], 0x36
add byte [rbx + rax], 0x43
sub byte [rbx + rax], 0x46
add byte [rbx + rax], 0x45
xor byte [rbx + rax], 0x38
sub byte [rbx + rax], 0x1c
xor byte [rbx + rax], 0x24
inc rax
cmp rax, 0xb0
jb 0x14007cf57
xchg rbp, rdi
mov rax, rbp
xchg rbp, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rdx
push rdx
push rdx
push rax
push rbx
push rbx
xchg qword [rsp + 0x38], rdi
pop rbx
pop rbx
pop rax
pop rdx
pop rdx
pop rdx
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cfb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r9, rdx
mov qword [rsp + 0x10], r9
xchg r9, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r10, rdi
mov r10, rcx
xchg r10, rdi
lea rbx, [rdx + 0x70]
xchg rcx, rdx
mov rcx, rbx
xchg rcx, rdx
call fcn.14007a840
nop
xor eax, eax
mov byte [rbx + rax], 0x18
add byte [rbx + rax], 0x10
sub byte [rbx + rax], 9
add byte [rbx + rax], 0x5b
sub byte [rbx + rax], 0x17
xor byte [rbx + rax], 0x74
add byte [rbx + rax], 0x19
sub byte [rbx + rax], 0x2b
xor byte [rbx + rax], 5
inc rax
cmp rax, 0xdc
jb 0x14007cfeb
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x14007d040
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 8], r11
xchg rbx, r11
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x70]
xchg r12, rdx
mov r12, rbx
xchg rdx, r12
call fcn.14007a840
nop
xor eax, eax
mov byte [rbx + rax], reloc.SHLWAPI.dll_SHCreateMemStream
xor byte [rbx + rax], 0x6f
sub byte [rbx + rax], 0x63
add byte [rbx + rax], 2
add byte [rbx + rax], 0x33
sub byte [rbx + rax], 0x33
add byte [rbx + rax], 0x1c
add byte [rbx + rax], 0x34
sub byte [rbx + rax], 0x52
inc rax
cmp rax, 0xde
jb 0x14007d06d
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rcx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d0d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg r14, rdi
mov r14, rcx
xchg r14, rdi
lea rbx, [rdx + 0x76]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007a840
nop
xor eax, eax
mov byte [rbx + rax], 0x44
xor byte [rbx + rax], 0x29
sub byte [rbx + rax], 0x66
add byte [rbx + rax], 4
xor byte [rbx + rax], 0x1f
sub byte [rbx + rax], 0x14
inc rax
cmp rax, 0xea
jb 0x14007d0fd
mov rax, rdi
xchg rbp, rbx
mov rbp, qword [rsp + 0x30]
xchg rbp, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d150
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x7c]
mov rdx, rbx
call fcn.14007a840
nop
xor eax, eax
mov byte [rbx + rax], 0x79
sub byte [rbx + rax], 0x55
add byte [rbx + rax], 0x47
sub byte [rbx + rax], 0x1f
add byte [rbx + rax], 0x1b
xor byte [rbx + rax], 0x6d
add byte [rbx + rax], 0x2a
add byte [rbx + rax], 0x32
sub byte [rbx + rax], 0x66
inc rax
cmp rax, 0xf4
jb 0x14007d180
xchg r8, rax
mov r8, rdi
xchg r8, rax
xchg rbx, r9
mov r9, qword [rsp + 0x30]
xchg rbx, r9
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d1e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rcx, rdx
mov qword [rsp + 0x10], rcx
xchg rdx, rcx
push rdi
sub rsp, 0x20
xchg rdi, r12
mov r12, rcx
xchg rdi, r12
lea rbx, [rdx + 0x9a]
mov rdx, rbx
call fcn.14007a840
nop
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbx + rax], 0x58
xor byte [rbx + rax], 0x7f
add byte [rbx + rax], 0x22
xor byte [rbx + rax], 0x52
add byte [rbx + rax], 0x23
add byte [rbx + rax], 0x32
add byte [rbx + rax], 9
sub byte [rbx + rax], 0x79
inc rax
cmp rax, 0x130
jb 0x14007d21c
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rcx
push rdx
push rdx
push rcx
xchg qword [rsp + 0x28], rdi
pop rcx
pop rdx
pop rdx
pop rcx
pop rbx
add rsp, 8
ret

Function at 0x14007d270
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg r10, rdi
mov r10, rcx
xchg rdi, r10
lea rbx, [rdx + 0xc]
xchg r13, rbx
mov rdx, r13
xchg r13, rbx
call fcn.14007a840
nop
xor eax, eax
mov byte [rbx + rax], 0x3c
sub byte [rbx + rax], 0x2c
xor byte [rbx + rax], 0x2e
xor byte [rbx + rax], 0x6c
sub byte [rbx + rax], 0x31
add byte [rbx + rax], 0xf
sub byte [rbx + rax], 0x17
xor byte [rbx + rax], 0x6e
xor byte [rbx + rax], 0x77
inc rax
cmp rax, 0x14
jb 0x14007d29d
xchg r14, rax
mov r14, rdi
xchg r14, rax
xchg rdx, rbx
mov rdx, qword [rsp + 0x30]
xchg rbx, rdx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d300
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg r13, rdi
mov r13, rcx
xchg r13, rdi
lea rbx, [rdx + 0xe]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007a840
nop
xor eax, eax
mov byte [rbx + rax], 0x18
xor byte [rbx + rax], 0x15
add byte [rbx + rax], 0x1c
add byte [rbx + rax], 0x41
add byte [rbx + rax], 2
sub byte [rbx + rax], 0x53
add byte [rbx + rax], 0x29
sub byte [rbx + rax], 0x3a
sub byte [rbx + rax], 8
inc rax
cmp rax, 0x18
jb 0x14007d32d
xchg rdi, r13
mov rax, r13
xchg rdi, r13
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rcx
xchg qword [rsp + 0x10], rdi
add rsp, 0x18
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d380
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r13
mov qword [rsp + 8], r13
xchg r13, rbx
xchg rdx, r8
mov qword [rsp + 0x10], r8
xchg rdx, r8
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, r14
mov rdi, r14
xchg rcx, r14
lea rbx, [rdx + 0xe]
xchg rbx, rbp
mov rdx, rbp
xchg rbp, rbx
call fcn.14007a840
nop
xor eax, eax
mov byte [rbx + rax], 0x25
add byte [rbx + rax], 0x37
xor byte [rbx + rax], 0x71
xor byte [rbx + rax], 0x5a
sub byte [rbx + rax], 0x40
add byte [rbx + rax], 0x12
xor byte [rbx + rax], 0x60
sub byte [rbx + rax], 0x29
inc rax
cmp rax, 0x1a
jb 0x14007d3c1
xchg r11, rax
mov r11, rdi
xchg r11, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140080dc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg rbx, rcx
mov rcx, r8
xchg rcx, rbx
xchg r11, rsi
mov r11, rdx
xchg r11, rsi
mov rbp, rcx
jne 0x140080e8b
xchg rbx, rdi
mov qword [rsp + 0x30], rbx
xchg rbx, rdi
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 0x10]
mov rdx, rsi
xchg rcx, rbp
mov rbp, rcx
xchg rbp, rcx
call fcn.140080dc0
xchg rbp, rbx
mov rdi, rbp
xchg rbp, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x28]
call fcn.140091380
mov edx, 0x369e2b38
xor edx, 0x16a477e5
xor edx, 0x61e809f8
sub edx, 0x2341f66f
xor edx, 0x1ddeaf85
add edx, 0x22cd1330
add edx, 0x32f23245
add edx, 0x1c8de237
sub edx, 0x759c1847
xchg rdi, rcx
mov rdi, rcx
xchg rcx, rdi
call fcn.1401fc438
cmp byte [rbx + 0x19], 0
je 0x140080e0f
mov rdi, qword [rsp + 0x30]
xchg rbx, rsi
mov rsi, qword [rsp + 0x38]
xchg rbx, rsi
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
nop
mov rsi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140083bd0
Capabilities:
Encode data using xor

Disassembly:
mov rax, r8
cmp rcx, rdx
je 0x140083d04
xchg r13, r9
mov r13, rax
xchg r9, r13
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
movups xmmword [rax], xmm0
mov qword [r9 + r8 - 0x70], r10
mov qword [r9 + r8 - 0x68], r10
movups xmm0, xmmword [r8 - 0x80]
xchg rcx, rax
movups xmmword [rcx], xmm0
xchg rcx, rax
xchg r12, r8
movups xmm1, xmmword [r12 - 0x70]
xchg r8, r12
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm1
xchg rsi, r10
mov qword [r8 - 0x70], rsi
xchg r10, rsi
add rax, 0x48
mov qword [r8 - 0x68], 0xbdfab92
add qword [r8 - 0x68], 0x1774256d
add qword [r8 - 0x68], 0x3010b294
sub qword [r8 - 0x68], 0x136da498
xor qword [r8 - 0x68], 0x21b18a91
xor qword [r8 - 0x68], 0x1e47546d
mov word [r8 - 0x80], r10w
movups xmmword [r9 + r8 - 0x60], xmm0
mov qword [r9 + r8 - 0x50], r10
mov qword [r9 + r8 - 0x48], r10
xchg r15, r8
movups xmm0, xmmword [r15 - 0x60]
xchg r15, r8
movups xmmword [r9 + r8 - 0x60], xmm0
xchg r8, r12
movups xmm1, xmmword [r12 - 0x50]
xchg r12, r8
xchg r10, r9
movups xmmword [r10 + r8 - 0x50], xmm1
xchg r9, r10
mov qword [r8 - 0x50], r10
mov qword [r8 - 0x48], 0x3c159e4a
xor qword [r8 - 0x48], 0x5164d74
sub qword [r8 - 0x48], 0x16f4d96d
xor qword [r8 - 0x48], 0x5e3825f7
sub qword [r8 - 0x48], 0x74a80383
add qword [r8 - 0x48], 0x3b76acb8
xor qword [r8 - 0x48], 0x348c37bf
sub qword [r8 - 0x48], 0x7789b2dd
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x140083bf6
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140083d10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
xchg r8, r12
mov rbx, r12
xchg r12, r8
cmp rcx, rdx
je 0x140083df5
xchg r8, rax
mov r8, rbx
xchg r8, rax
lea r8, [rcx + 0x18]
sub rax, rcx
xor r10d, r10d
nop dword [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg rdi, rbx
movups xmmword [rdi], xmm0
xchg rdi, rbx
xchg r10, r13
mov qword [rax + r8 - 0x28], r13
xchg r13, r10
lea rcx, [r8 - 0x18]
mov qword [r8 + rax - 0x20], r10
xchg r8, r13
movups xmm0, xmmword [r13 - 0x38]
xchg r13, r8
xchg rbx, r15
movups xmmword [r15], xmm0
xchg rbx, r15
xchg r9, r8
movups xmm1, xmmword [r9 - 0x28]
xchg r8, r9
xchg r14, rbx
movups xmmword [r14 + 0x10], xmm1
xchg rbx, r14
mov qword [r8 - 0x28], r10
nop
add rbx, 0x5c95b607
sub rbx, 0x5c95b5e7
mov qword [r8 - 0x20], 0x4a556a61
sub qword [r8 - 0x20], 0x374df7d6
add qword [r8 - 0x20], 0x4552b95f
add qword [r8 - 0x20], 0x1caae837
xor qword [r8 - 0x20], 0x6a7f3cd1
sub qword [r8 - 0x20], 0x1c55d7fb
add qword [r8 - 0x20], 0x68d3e967
sub qword [r8 - 0x20], 0x64475ee5
sub qword [r8 - 0x20], 0x7b0db68
mov byte [r8 - 0x38], r10b
cmp rcx, rdx
jne 0x140083d3e
xchg r9, r12
mov r8, r12
xchg r12, r9
xchg rdx, r14
mov r14, rbx
xchg r14, rdx
xchg rcx, rbx
mov rbx, rcx
xchg rcx, rbx
call fcn.14007eed0
xchg rbx, rsi
mov rax, rsi
xchg rbx, rsi
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rbx
ret
Function at 0x140083e30
Capabilities:
Encode data using xor

Disassembly:
xchg r8, r9
mov rax, r9
xchg r9, r8
cmp rcx, rdx
je 0x140083f08
xchg r11, r9
mov r11, rax
xchg r11, r9
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg r10, rax
movups xmmword [r10], xmm0
xchg r10, rax
mov qword [r9 + r8 - 0x28], r10
lea rcx, [r8 - 0x18]
mov qword [r8 + r9 - 0x20], r10
movups xmm0, xmmword [r8 - 0x38]
xchg r8, rax
movups xmmword [r8], xmm0
xchg r8, rax
xchg r14, r8
movups xmm1, xmmword [r14 - 0x28]
xchg r8, r14
xchg r11, rax
movups xmmword [r11 + 0x10], xmm1
xchg r11, rax
xchg rbp, r10
mov qword [r8 - 0x28], rbp
xchg r10, rbp
neg rax
add rax, 0xffffffffffffffe0
neg rax
mov qword [r8 - 0x20], 0x2cf9c0b0
add qword [r8 - 0x20], 0x151fce0f
xor qword [r8 - 0x20], 0x462eb60
xor qword [r8 - 0x20], 0x728cc3e9
add qword [r8 - 0x20], 0x2f77dfb0
sub qword [r8 - 0x20], 0x5c378373
add qword [r8 - 0x20], 0x5cf36373
xor qword [r8 - 0x20], 0x63bccbad
sub qword [r8 - 0x20], 0x697ae44
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x140083e60
ret

Function at 0x14008e270
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0xa], 0x79
xor byte [rcx + rax + 0xa], 0x62
add byte [rcx + rax + 0xa], 0xf
add byte [rcx + rax + 0xa], 0x1b
sub byte [rcx + rax + 0xa], 2
sub byte [rcx + rax + 0xa], 0xa
sub byte [rcx + rax + 0xa], 0x1c
sub byte [rcx + rax + 0xa], 0x1d
inc rax
cmp rax, 0x10
jb 0x14008e272
ret

Function at 0x14008e3a0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0x14], 2
add byte [rcx + rax + 0x14], 0x58
xor byte [rcx + rax + 0x14], 0x2a
sub byte [rcx + rax + 0x14], 0xd
xor byte [rcx + rax + 0x14], 0x3a
xor byte [rcx + rax + 0x14], 0x41
sub byte [rcx + rax + 0x14], 0x18
inc rax
cmp rax, 0x24
jb 0x14008e3a2
ret
Function at 0x14015b9f0
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
je 0x14015bbfa
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rcx, qword [rdx + 0x50]
xchg rdx, rdi
mov rdx, rdi
xchg rdx, rdi
xchg rbx, rcx
mov qword [rsp + 0x30], rcx
xchg rbx, rcx
xor ebx, ebx
test rcx, rcx
je 0x14015ba85
mov rdx, qword [rdx + 0x60]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x14015ba74
xchg r8, r9
mov r9, qword [rcx - 8]
xchg r8, r9
nop
sub rdx, 0x27f9b8e3
add rdx, 0x27f9b90a
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14015bc03
xchg rcx, r8
mov r8, rcx
xchg r8, rcx
call fcn.1401fc438
mov qword [rdi + 0x50], rbx
mov qword [rdi + 0x58], rbx
mov qword [rdi + 0x60], rbx
xchg rdx, rcx
mov rdx, qword [rdi + 0x40]
xchg rdx, rcx
xchg r14, rax
mov r14, qword [rcx + 8]
xchg r14, rax
mov qword [rax], rbx
mov rcx, qword [rcx]
test rcx, rcx
je 0x14015baf4
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x5cd11b8d
add edx, 0x12171994
sub edx, 0x28ac6e4c
add edx, 0x4219126
xor edx, 0x452955f2
xor edx, 0x7201f752
sub edx, 0x7d75f543
call fcn.1401fc438
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
test rbx, rbx
jne 0x14015bab1
mov rcx, qword [rdi + 0x40]
mov edx, 0x138b68ca
add edx, 0x18ae04a3
xor edx, 0x35bbf354
add edx, 0xf8f7b6d
xor edx, 0x3087aab7
add edx, 0x3d62d7de
sub edx, 0x8571a35
sub edx, 0x4ea170a2
call fcn.1401fc438
mov rbx, qword [rdi + 0x28]
test rbx, rbx
je 0x14015bbb1
xchg rsi, rbx
mov qword [rsp + 0x38], rbx
xchg rbx, rsi
mov esi, 0x1bd982b4
add esi, 0x54b450dc
sub esi, 0x541dbcf3
add esi, 0x4b0f4899
sub esi, 0x41fbdef
xor esi, 0x9ca05eb8
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14015bba6
xchg rdx, rax
mov rdx, qword [rbx]
xchg rdx, rax
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x14015bba6
mov rax, qword [rbx]
xchg rbx, r8
mov rcx, r8
xchg rbx, r8
call qword [rax + 8]
xchg r11, rsi
mov r11, qword [rsp + 0x38]
xchg r11, rsi
mov edx, 0x77b1e615
sub edx, 0x3c064c39
xor edx, 0x46b91e47
sub edx, 0x3b7fcd2c
sub edx, 0xb5ca8a6
add edx, 0x49c963f8
sub edx, 0x7fff7419
xchg r8, rdi
mov rcx, r8
xchg rdi, r8
call fcn.1401fc438
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
push rbp
call 0x14065e2ec
int3
Function at 0x140178aa0
Capabilities:
Encode data using xor

Disassembly:
push r10
mov qword [rsp], rbx
sub rsp, 0x60
mov r8d, edx
lea r9, [rsp + 0x52]
xchg rbx, rcx
mov rcx, rbx
xchg rcx, rbx
xor r10d, r10d
nop dword [rax]
nop dword [rax + rax]
sub r9, 2
mov eax, 0x215f4455
add eax, 0x5880259f
sub eax, 0x47f2b92f
add eax, 0x1f34269b
add eax, 0x983aa73
sub eax, 0x4150b3a0
xor eax, 0x6bc91ffc
add eax, 0x5a31fafe
mul r8d
shr edx, 2
shr edx, 1
movzx eax, dx
shl ax, 1
shl ax, 1
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
nop
add r8w, 0x30c4
sub r8w, 0x3094
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x140178aca
xorps xmm0, xmm0
lea rax, [rsp + 0x52]
xchg r13, rbx
movups xmmword [r13], xmm0
xchg rbx, r13
mov qword [rbx + 0x10], r10
xchg rcx, r10
mov qword [rbx + 0x18], rcx
xchg rcx, r10
cmp r9, rax
jne 0x140178bac
mov qword [rbx + 0x10], r10
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
mov qword [rbx + 0x18], 0x510956be
sub qword [rbx + 0x18], 0x29c5cc07
sub qword [rbx + 0x18], 0x1be525ae
xor qword [rbx + 0x18], 0x4ce0655d
sub qword [rbx + 0x18], 0x3a4c1efa
xor qword [rbx + 0x18], 0xd71e15d
mov word [rbx], r10w
add rsp, 0x60
nop
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
lea r8, [rsp + 0x52]
xchg rdx, r9
mov r9, rdx
xchg rdx, r9
sub r8, r9
xchg rbp, rcx
mov rbp, rbx
xchg rcx, rbp
sar r8, 1
call fcn.14007ea40
mov rax, rbx
add rsp, 0x60
push rcx
xchg qword [rsp + 8], rbx
add rsp, 0x10
ret
Function at 0x1401935e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
xchg r15, rdx
mov r10, r15
xchg rdx, r15
xchg rcx, r13
mov r11, r13
xchg rcx, r13
mov word [rsp + 0x30], 0x576d
sub word [rsp + 0x30], 0x2995
add word [rsp + 0x30], 0x3855
add word [rsp + 0x30], 0xb
sub word [rsp + 0x30], 0x51e1
xor word [rsp + 0x30], 0x130c
add word [rsp + 0x30], 0x51da
sub word [rsp + 0x30], 0x35ce
xor word [rsp + 0x30], 0xd591
mov dword [rsp + 0x34], 0x5c54474c
sub dword [rsp + 0x34], 0x4a1fc874
xor dword [rsp + 0x34], 0x5915d0b
add dword [rsp + 0x34], 0x3bd566e1
sub dword [rsp + 0x34], 0x3aeb9338
add dword [rsp + 0x34], 0xe6c107d5
mov byte [rsp + 0x32], 0x17
xor byte [rsp + 0x32], 0x6a
sub byte [rsp + 0x32], 0x45
sub byte [rsp + 0x32], 0x25
sub byte [rsp + 0x32], 0x12
add byte [rsp + 0x32], 0x57
sub byte [rsp + 0x32], 6
sub byte [rsp + 0x32], 0x50
add byte [rsp + 0x32], 0xf4
mov dword [rsp + 0x38], 0x5fa8bc61
sub dword [rsp + 0x38], 0xad27a0b
xor dword [rsp + 0x38], 0x7355ebf9
add dword [rsp + 0x38], 0x3a095bf3
xor dword [rsp + 0x38], 0x6b86f2a5
add dword [rsp + 0x38], 0x1500fff
add dword [rsp + 0x38], 0x5c163662
add dword [rsp + 0x38], 0xdffacf9
sub dword [rsp + 0x38], 0x7570eb03
xor ebx, ebx
mov edx, ebx
nop dword [rax]
movzx eax, word [rsp + rdx*2 + 0x34]
movzx ecx, byte [rsp + rdx + 0x30]
add cx, ax
mov word [rsp + rdx*2 + 0x34], cx
mov byte [rsp + rdx + 0x30], bl
inc rdx
cmp rdx, 3
jb 0x1401936e3
xchg r8, r14
mov qword [rsp + 0x28], r14
xchg r14, r8
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0x34]
xchg rdx, rbx
mov rbx, r10
xchg rbx, rdx
xchg r14, rcx
mov r14, r11
xchg r14, rcx
call fcn.140193af0
nop
nop dword [rax]
mov byte [rsp + rbx + 0x34], 0x39
sub byte [rsp + rbx + 0x34], 0x34
add byte [rsp + rbx + 0x34], 0x4f
sub byte [rsp + rbx + 0x34], 0x40
add byte [rsp + rbx + 0x34], 0x4a
sub byte [rsp + rbx + 0x34], 4
xor byte [rsp + rbx + 0x34], 0x5a
inc rbx
cmp rbx, 6
jb 0x140193739
add rsp, 0x40
push rcx
push rax
push rdx
push rcx
push rax
push rax
push rax
xchg qword [rsp + 0x38], rbx
add rsp, 0x40
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140193980
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
xchg r8, rdx
mov r10, r8
xchg rdx, r8
mov r11, rcx
mov dword [rsp + 0x30], 0x3e7b671d
add dword [rsp + 0x30], 0x35bdfd2
sub dword [rsp + 0x30], 0x1af397f2
add dword [rsp + 0x30], 0x204a5144
xor dword [rsp + 0x30], 0x2ebc0e22
sub dword [rsp + 0x30], 0x2e7632f6
xor dword [rsp + 0x30], 0x30c7919e
xor dword [rsp + 0x30], 0xfd2abc05
mov dword [rsp + 0x36], 0x23dfaeac
add dword [rsp + 0x36], 0x498b6e2
xor dword [rsp + 0x36], 0x79b22c3e
add dword [rsp + 0x36], 0x1c90862b
sub dword [rsp + 0x36], 0x38e883ac
add dword [rsp + 0x36], 0xc9e7b32b
mov dword [rsp + 0x3a], 0x7f4495ba
xor dword [rsp + 0x3a], 0x25055ba8
sub dword [rsp + 0x3a], 0x32709f2f
add dword [rsp + 0x3a], 0xd112bf4
xor dword [rsp + 0x3a], 0x45b30bf4
sub dword [rsp + 0x3a], 0x2fbe4f92
add dword [rsp + 0x3a], 0xbdcbfdcc
xor eax, eax
mov word [rsp + 0x3e], ax
xor ebx, ebx
mov edx, ebx
nop
movzx eax, word [rsp + rdx*2 + 0x36]
movzx ecx, byte [rsp + rdx + 0x30]
add cx, ax
mov word [rsp + rdx*2 + 0x36], cx
mov byte [rsp + rdx + 0x30], bl
inc rdx
cmp rdx, 4
jb 0x140193a46
xchg r14, rax
mov r14, qword [rsp + 0x70]
xchg r14, rax
xchg r13, rax
mov qword [rsp + 0x28], r13
xchg r13, rax
xchg rsi, r9
mov qword [rsp + 0x20], rsi
xchg r9, rsi
mov r9, r8
lea r8, [rsp + 0x36]
xchg rsi, rdx
mov rsi, r10
xchg rdx, rsi
xchg rdx, rcx
mov rdx, r11
xchg rdx, rcx
call fcn.140193af0
nop
mov byte [rsp + rbx + 0x36], 0x6b
xor byte [rsp + rbx + 0x36], 0xf
xor byte [rsp + rbx + 0x36], 0x2e
xor byte [rsp + rbx + 0x36], 0x14
xor byte [rsp + rbx + 0x36], 0x1d
xor byte [rsp + rbx + 0x36], 0x43
inc rbx
cmp rbx, 8
jb 0x140193aa6
add rsp, 0x40
nop
add rsp, 8
xchg qword [rsp - 8], rbx
nop
add rsp, 8
jmp qword [rsp - 8]