joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007c830
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r9
mov qword [rsp + 8], r9
xchg rbx, r9
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r14
mov r14, rcx
xchg r14, rdi
lea rbx, [rdx + 0x24]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x70
sub byte [rbx + rax], 0x6b
add byte [rbx + rax], 0x1f
add byte [rbx + rax], 0x32
xor byte [rbx + rax], 0x6f
xor byte [rbx + rax], 0x39
inc rax
cmp rax, 0x46
jb 0x14007c86b
xchg r13, rax
mov r13, rdi
xchg r13, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c8b0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg rbx, r11
xchg rsi, rdx
mov qword [rsp + 0x10], rsi
xchg rdx, rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x28]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x40
xor byte [rbx + rax], 0x4a
add byte [rbx + rax], 0x57
xor byte [rbx + rax], 0x47
add byte [rbx + rax], 7
add byte [rbx + rax], 0x51
sub byte [rbx + rax], 0x18
sub byte [rbx + rax], 0x49
sub byte [rbx + rax], 0x1d
inc rax
cmp rax, 0x4c
jb 0x14007c8ec
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c940
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rbx, rcx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x2a]
xchg r15, rdx
mov r15, rbx
xchg r15, rdx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x3b
sub byte [rbx + rax], 5
xor byte [rbx + rax], 0x37
add byte [rbx + rax], 0x3f
add byte [rbx + rax], 1
xor byte [rbx + rax], 0x7f
xor byte [rbx + rax], 5
xor byte [rbx + rax], 0x54
xor byte [rbx + rax], 0x6f
inc rax
cmp rax, 0x50
jb 0x14007c975
xchg r14, rax
mov r14, rdi
xchg r14, rax
xchg r14, rbx
mov r14, qword [rsp + 0x30]
xchg r14, rbx
add rsp, 0x20
push rax
push rcx
push rdx
push rax
push rdx
push rbx
xchg qword [rsp + 0x30], rdi
pop rbx
pop rdx
pop rax
pop rdx
pop rcx
pop rax
add rsp, 8
ret

Function at 0x14007c9d0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r13
mov qword [rsp + 8], r13
xchg r13, rbx
xchg rdi, rdx
mov qword [rsp + 0x10], rdi
xchg rdx, rdi
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rbp, rdi
mov rbp, rcx
xchg rbp, rdi
lea rbx, [rdx + 0x2a]
mov rdx, rbx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 1
xor byte [rbx + rax], 0x6f
xor byte [rbx + rax], 0x6a
xor byte [rbx + rax], 3
xor byte [rbx + rax], 0x30
sub byte [rbx + rax], 0x11
sub byte [rbx + rax], 0x26
inc rax
cmp rax, 0x52
jb 0x14007ca0b
xchg rcx, rdi
mov rax, rcx
xchg rcx, rdi
xchg rbx, rdi
mov rdi, qword [rsp + 0x30]
xchg rbx, rdi
add rsp, 0x20
push rcx
push rdx
push rdx
push rdx
push rdx
push rcx
push rdx
push rdx
xchg qword [rsp + 0x40], rdi
pop rdx
pop rdx
pop rcx
pop rdx
pop rdx
pop rdx
pop rdx
pop rcx
add rsp, 8
ret
Function at 0x14007ca70
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 8], rdi
xchg rdi, rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r14, rdi
mov r14, rcx
xchg rdi, r14
lea rbx, [rdx + 0x2c]
xchg r13, rbx
mov rdx, r13
xchg rbx, r13
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x66
xor byte [rbx + rax], 0x5c
add byte [rbx + rax], 0x19
xor byte [rbx + rax], 0x24
xor byte [rbx + rax], 0x70
sub byte [rbx + rax], 7
inc rax
cmp rax, 0x54
jb 0x14007caab
xchg rbx, rdi
mov rax, rbx
xchg rbx, rdi
xchg rbx, r8
mov r8, qword [rsp + 0x30]
xchg rbx, r8
add rsp, 0x20
push rax
xchg qword [rsp + 8], rdi
add rsp, 0x10
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cb00
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 8], r11
xchg r11, rbx
xchg rdx, r8
mov qword [rsp + 0x10], r8
xchg rdx, r8
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r14
mov r14, rcx
xchg r14, rdi
lea rbx, [rdx + 0x2e]
xchg rbx, r8
mov rdx, r8
xchg r8, rbx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x5c
sub byte [rbx + rax], 0x40
xor byte [rbx + rax], 0x6f
xor byte [rbx + rax], 0x50
xor byte [rbx + rax], 0x6d
sub byte [rbx + rax], 0x4e
inc rax
cmp rax, 0x58
jb 0x14007cb41
xchg rbx, rax
mov rbx, rdi
xchg rbx, rax
xchg r10, rbx
mov r10, qword [rsp + 0x30]
xchg r10, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cb90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, r11
mov r11, rcx
xchg rdi, r11
lea rbx, [rdx + 0x2e]
mov rdx, rbx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x14
xor byte [rbx + rax], 0x2f
add byte [rbx + rax], 0x40
sub byte [rbx + rax], 0xf
xor byte [rbx + rax], 0x51
sub byte [rbx + rax], 0x3d
inc rax
cmp rax, 0x5a
jb 0x14007cbb7
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rax
push rbx
xchg qword [rsp + 0x18], rdi
add rsp, 0x20
ret

Function at 0x14007cc00
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r13
mov qword [rsp + 0x10], r13
xchg r13, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rbx, rcx
mov rdi, rbx
xchg rcx, rbx
lea rbx, [rdx + 0x30]
xchg rbx, r9
mov rdx, r9
xchg r9, rbx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0xe
xor byte [rbx + rax], 0x38
add byte [rbx + rax], 0x26
xor byte [rbx + rax], 0x2d
sub byte [rbx + rax], 0x4b
xor byte [rbx + rax], 0x26
inc rax
cmp rax, 0x5c
jb 0x14007cc3c
xchg r14, rdi
mov rax, r14
xchg r14, rdi
xchg rbx, r10
mov r10, qword [rsp + 0x30]
xchg rbx, r10
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007cc90
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rsi
mov qword [rsp + 8], rsi
xchg rbx, rsi
xchg r8, rdx
mov qword [rsp + 0x10], r8
xchg r8, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rdx
mov rdx, rcx
xchg rdi, rdx
lea rbx, [rdx + 0x30]
xchg rdx, r13
mov r13, rbx
xchg r13, rdx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x7c
sub byte [rbx + rax], 0x75
xor byte [rbx + rax], 0x37
xor byte [rbx + rax], 0x7b
add byte [rbx + rax], 0x2f
sub byte [rbx + rax], 0x63
add byte [rbx + rax], 0x66
sub byte [rbx + rax], 0x42
xor byte [rbx + rax], 0x3b
inc rax
cmp rax, 0x5e
jb 0x14007ccd2
xchg rdi, r11
mov rax, r11
xchg rdi, r11
xchg rbx, rcx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cd30
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rbx
mov qword [rsp + 8], r15
xchg rbx, r15
xchg rdx, r12
mov qword [rsp + 0x10], r12
xchg rdx, r12
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rdx
mov rdx, rcx
xchg rdi, rdx
lea rbx, [rdx + 0x32]
mov rdx, rbx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x3d
xor byte [rbx + rax], 0x3e
xor byte [rbx + rax], 0x64
xor byte [rbx + rax], 0x3c
xor byte [rbx + rax], 0x13
add byte [rbx + rax], 0x17
sub byte [rbx + rax], 0x20
sub byte [rbx + rax], 0x3f
inc rax
cmp rax, 0x60
jb 0x14007cd6b
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rbp
mov rbp, qword [rsp + 0x30]
xchg rbp, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007cdc0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 8], rbp
xchg rbx, rbp
xchg rdi, rdx
mov qword [rsp + 0x10], rdi
xchg rdx, rdi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x34]
mov rdx, rbx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x56
xor byte [rbx + rax], 5
sub byte [rbx + rax], 5
sub byte [rbx + rax], 0x1d
add byte [rbx + rax], 0x19
xor byte [rbx + rax], 0x55
sub byte [rbx + rax], 6
add byte [rbx + rax], 0x36
sub byte [rbx + rax], 0x4f
inc rax
cmp rax, 0x64
jb 0x14007cded
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rdx
push rcx
push rax
push rcx
push rbx
push rbx
xchg qword [rsp + 0x38], rdi
add rsp, 0x40
ret
Function at 0x14007ce40
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 8], r13
xchg r13, rbx
xchg rdx, r12
mov qword [rsp + 0x10], r12
xchg r12, rdx
nop
push 0xbda1802
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rsi
mov rdi, rsi
xchg rcx, rsi
lea rbx, [rdx + 0x38]
xchg rbx, r9
mov rdx, r9
xchg r9, rbx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x2c
xor byte [rbx + rax], 0x1a
xor byte [rbx + rax], 0x2b
add byte [rbx + rax], 8
xor byte [rbx + rax], 0xe
xor byte [rbx + rax], 0x73
add byte [rbx + rax], 4
sub byte [rbx + rax], 0x5c
inc rax
cmp rax, 0x6e
jb 0x14007ce82
xchg rdi, r14
mov rax, r14
xchg rdi, r14
xchg rbx, r9
mov r9, qword [rsp + 0x30]
xchg r9, rbx
add rsp, 0x20
push rcx
push rbx
push rax
push rdx
push rax
push rax
xchg qword [rsp + 0x30], rdi
pop rax
pop rax
pop rdx
pop rax
pop rbx
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cef0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rcx, rdx
mov qword [rsp + 0x10], rcx
xchg rcx, rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x4e]
xchg r10, rdx
mov r10, rbx
xchg rdx, r10
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x4a
xor byte [rbx + rax], 0x1c
sub byte [rbx + rax], 0x2f
xor byte [rbx + rax], 0x48
sub byte [rbx + rax], 0x2f
add byte [rbx + rax], 2
sub byte [rbx + rax], 0x42
inc rax
cmp rax, 0x98
jb 0x14007cf23
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rdx, rbx
mov rdx, qword [rsp + 0x30]
xchg rbx, rdx
add rsp, 0x20
push rax
push rcx
push rax
push rax
push rbx
push rdx
push rbx
xchg qword [rsp + 0x38], rdi
add rsp, 0x40
ret

Function at 0x14007cf80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r12, rdx
mov qword [rsp + 0x10], r12
xchg r12, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r15
mov r15, rcx
xchg r15, rdi
lea rbx, [rdx + 0x56]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x1e
add byte [rbx + rax], 0x37
xor byte [rbx + rax], 0x63
add byte [rbx + rax], 0x3b
xor byte [rbx + rax], 0x32
sub byte [rbx + rax], 0x37
xor byte [rbx + rax], 0x51
sub byte [rbx + rax], 0x46
xor byte [rbx + rax], 0x17
inc rax
cmp rax, 0xa8
jb 0x14007cfbb
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rdx
push rax
push rdx
push rdx
push rax
xchg qword [rsp + 0x30], rdi
pop rax
pop rdx
pop rdx
pop rax
pop rdx
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d020
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 8], rdi
xchg rbx, rdi
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, r12
mov rdi, r12
xchg rcx, r12
lea rbx, [rdx + 0x5a]
xchg rbp, rdx
mov rbp, rbx
xchg rdx, rbp
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x54
add byte [rbx + rax], 8
sub byte [rbx + rax], 0x59
xor byte [rbx + rax], 0x65
sub byte [rbx + rax], 0x4e
xor byte [rbx + rax], 0x3a
add byte [rbx + rax], 0x30
xor byte [rbx + rax], 0x52
inc rax
cmp rax, 0xb0
jb 0x14007d05c
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d0b0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 8], rbp
xchg rbp, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x70]
mov rdx, rbx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x1d
add byte [rbx + rax], 0x15
xor byte [rbx + rax], 0x48
sub byte [rbx + rax], 4
xor byte [rbx + rax], 0x3b
sub byte [rbx + rax], 0x1c
sub byte [rbx + rax], 0x31
inc rax
cmp rax, 0xdc
jb 0x14007d0dd
xchg r14, rdi
mov rax, r14
xchg rdi, r14
xchg r8, rbx
mov r8, qword [rsp + 0x30]
xchg r8, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007d130
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rbx
mov qword [rsp + 8], r14
xchg rbx, r14
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x70]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 3
add byte [rbx + rax], 0x12
xor byte [rbx + rax], 0x64
sub byte [rbx + rax], 0x26
xor byte [rbx + rax], 0x77
add byte [rbx + rax], 0x12
add byte [rbx + rax], 0x2a
xor byte [rbx + rax], 0x78
inc rax
cmp rax, 0xde
jb 0x14007d16c
xchg r13, rax
mov r13, rdi
xchg r13, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rdx
push rcx
xchg qword [rsp + 0x18], rdi
add rsp, 0x20
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d1c0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rsi
mov qword [rsp + 8], rsi
xchg rbx, rsi
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x76]
mov rdx, rbx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x5f
sub byte [rbx + rax], 0x24
add byte [rbx + rax], 0xf
sub byte [rbx + rax], 0x34
xor byte [rbx + rax], 0x36
add byte [rbx + rax], 0x5e
sub byte [rbx + rax], 0x7e
inc rax
cmp rax, 0xea
jb 0x14007d1f6
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14007d240
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbx, rdx
mov qword [rsp + 0x10], rbx
xchg rbx, rdx
push rdi
sub rsp, 0x20
xchg r12, rcx
mov rdi, r12
xchg rcx, r12
lea rbx, [rdx + 0x7c]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0xe
sub byte [rbx + rax], 0xa
add byte [rbx + rax], 0x12
add byte [rbx + rax], 0x5f
xor byte [rbx + rax], 0x66
add byte [rbx + rax], 0x45
sub byte [rbx + rax], 0x31
xor byte [rbx + rax], 0x53
xor byte [rbx + rax], 0x74
inc rax
cmp rax, 0xf4
jb 0x14007d273
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d2d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r15, rdx
mov qword [rsp + 0x10], r15
xchg rdx, r15
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, r10
mov rdi, r10
xchg r10, rcx
lea rbx, [rdx + 0x9a]
xchg r14, rbx
mov rdx, r14
xchg rbx, r14
call fcn.14007a820
nop
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbx + rax], 0x43
add byte [rbx + rax], 0xb
sub byte [rbx + rax], 0x41
xor byte [rbx + rax], 0x31
add byte [rbx + rax], 0x26
sub byte [rbx + rax], 0x62
inc rax
cmp rax, 0x130
jb 0x14007d31b
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x14007d360
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0xc]
xchg rbp, rdx
mov rbp, rbx
xchg rdx, rbp
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x48
add byte [rbx + rax], 0x29
add byte [rbx + rax], 0xa
xor byte [rbx + rax], 0x79
add byte [rbx + rax], 0x32
xor byte [rbx + rax], 0x34
inc rax
cmp rax, 0x14
jb 0x14007d396
xchg rcx, rax
mov rcx, rdi
xchg rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rax
push rcx
push rbx
push rax
xchg qword [rsp + 0x28], rdi
pop rax
pop rbx
pop rcx
pop rax
pop rdx
add rsp, 8
ret

Function at 0x14007d3e0
Capabilities:
Encode data using xor

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg rbx, r12
mov qword [rsp + 0x10], rdx
nop
push r15
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rbx
mov rdi, rbx
xchg rcx, rbx
lea rbx, [rdx + 0xe]
mov rdx, rbx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x3e
xor byte [rbx + rax], 0x56
sub byte [rbx + rax], 0x4e
xor byte [rbx + rax], 0x78
xor byte [rbx + rax], 2
sub byte [rbx + rax], 0x32
sub byte [rbx + rax], 0x2e
inc rax
cmp rax, 0x18
jb 0x14007d413
mov rax, rdi
xchg r14, rbx
mov r14, qword [rsp + 0x30]
xchg r14, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d460
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rbx
mov qword [rsp + 8], rcx
xchg rbx, rcx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0xe]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007a820
nop
xor eax, eax
mov byte [rbx + rax], 0x27
add byte [rbx + rax], 0x2e
sub byte [rbx + rax], 0x53
add byte [rbx + rax], 0x45
add byte [rbx + rax], 0x26
xor byte [rbx + rax], 0x78
add byte [rbx + rax], 0x50
xor byte [rbx + rax], 0x15
xor byte [rbx + rax], 0x70
inc rax
cmp rax, 0x1a
jb 0x14007d49c
xchg rdi, rcx
mov rax, rcx
xchg rdi, rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140083d90
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rax
mov r8, rax
xchg r8, rax
cmp rcx, rdx
je 0x140083ede
mov r9, rax
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
movups xmmword [rax], xmm0
mov qword [r9 + r8 - 0x70], r10
mov qword [r9 + r8 - 0x68], r10
movups xmm0, xmmword [r8 - 0x80]
movups xmmword [rax], xmm0
xchg r8, r14
movups xmm1, xmmword [r14 - 0x70]
xchg r14, r8
xorps xmm0, xmm0
xchg rdi, rax
movups xmmword [rdi + 0x10], xmm1
xchg rdi, rax
xchg r10, rbx
mov qword [r8 - 0x70], rbx
xchg rbx, r10
nop
add rax, 0x6091ebd5
sub rax, 0x6091eb8d
mov qword [r8 - 0x68], 0x56627637
sub qword [r8 - 0x68], 0x429a9ea3
add qword [r8 - 0x68], 0xf2fed7a
sub qword [r8 - 0x68], 0xe429dcd
add qword [r8 - 0x68], 0x63684313
sub qword [r8 - 0x68], 0x36063f8b
add qword [r8 - 0x68], 0x1852d4c1
xor qword [r8 - 0x68], 0x5a69ff8d
mov word [r8 - 0x80], r10w
xchg r9, r10
movups xmmword [r10 + r8 - 0x60], xmm0
xchg r10, r9
mov qword [r9 + r8 - 0x50], r10
xchg r11, r10
mov qword [r9 + r8 - 0x48], r11
xchg r11, r10
xchg r15, r8
movups xmm0, xmmword [r15 - 0x60]
xchg r15, r8
xchg r9, r11
movups xmmword [r11 + r8 - 0x60], xmm0
xchg r9, r11
xchg r8, r12
movups xmm1, xmmword [r12 - 0x50]
xchg r12, r8
movups xmmword [r9 + r8 - 0x50], xmm1
mov qword [r8 - 0x50], r10
mov qword [r8 - 0x48], 0x24c2d4c6
add qword [r8 - 0x48], 0x3567851f
xor qword [r8 - 0x48], 0x661de4ef
xor qword [r8 - 0x48], 0x67ad031a
add qword [r8 - 0x48], 0x134e4bc
sub qword [r8 - 0x48], 0x5a6d60ec
sub qword [r8 - 0x48], 0x26241d9
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x140083db4
ret

Function at 0x140083fd0
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rax
mov rcx, r8
xchg rcx, rax
cmp rcx, rdx
je 0x140084098
xchg r12, r9
mov r12, rax
xchg r9, r12
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg rbx, rax
movups xmmword [rbx], xmm0
xchg rbx, rax
xchg r14, r10
mov qword [r9 + r8 - 0x28], r14
xchg r14, r10
lea rcx, [r8 - 0x18]
mov qword [r8 + r9 - 0x20], r10
xchg r13, r8
movups xmm0, xmmword [r13 - 0x38]
xchg r13, r8
movups xmmword [rax], xmm0
xchg rbp, r8
movups xmm1, xmmword [rbp - 0x28]
xchg rbp, r8
xchg r12, rax
movups xmmword [r12 + 0x10], xmm1
xchg r12, rax
mov qword [r8 - 0x28], r10
sub rax, 0xffffffffffffffe0
mov qword [r8 - 0x20], 0x15239a37
add qword [r8 - 0x20], 0x190c92f4
xor qword [r8 - 0x20], 0x356390d6
add qword [r8 - 0x20], 0x3777a344
sub qword [r8 - 0x20], 0x560eef4
xor qword [r8 - 0x20], 0x23aed986
sub qword [r8 - 0x20], 0x175e7316
xor qword [r8 - 0x20], 0x576638b2
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x140083ffe
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14008e450
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0xa], 0x41
sub byte [rcx + rax + 0xa], 0x2a
add byte [rcx + rax + 0xa], 0x5c
xor byte [rcx + rax + 0xa], 0x26
xor byte [rcx + rax + 0xa], 0x5a
sub byte [rcx + rax + 0xa], 0xf
inc rax
cmp rax, 0x10
jb 0x14008e452
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14008e560
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0x14], 3
add byte [rcx + rax + 0x14], 0x6b
xor byte [rcx + rax + 0x14], 0x79
xor byte [rcx + rax + 0x14], 0x6d
xor byte [rcx + rax + 0x14], 0x37
sub byte [rcx + rax + 0x14], 0x45
xor byte [rcx + rax + 0x14], 0xd
xor byte [rcx + rax + 0x14], 0x2a
sub byte [rcx + rax + 0x14], 0x2f
inc rax
cmp rax, 0x24
jb 0x14008e562
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401984f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x58
mov rbx, r9
xchg rsi, rdx
mov rdx, rsi
xchg rsi, rdx
mov r9, rcx
xor ebp, ebp
test rdx, rdx
jne 0x14019856a
mov eax, ebp
jmp 0x1401985bd
mov eax, 0x24f0af09
add eax, 0x1cc49e73
xor eax, 0x611b3317
add eax, 0x1b4dc160
sub eax, 0xbcd727e
add eax, 0x2230e858
xor eax, 0x4a64bb71
add eax, 0x58e2ba22
xor eax, 0x711d92bb
cmp word [rdx], ax
je 0x1401985ac
xchg rbp, rax
mov rbp, rax
xchg rbp, rax
jmp 0x1401985bd
movsxd rax, dword [rdx + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
cmovne rax, rbp
mov ecx, 0x4ce777a
add ecx, 0x4955d74b
sub ecx, 0x4b43db01
add ecx, 0x3ebec872
add ecx, 0x2661661a
add ecx, 0x33da90f
xor ecx, 0x3ba8e2bd
add ecx, 0x1c2012f4
sub ecx, 0x6cb6bacb
cmp word [rax + 0x18], cx
jne 0x140198711
mov r14d, dword [rax + 0x88]
add r14, rsi
je 0x140198711
mov r15d, dword [r14 + 0x1c]
add r15, rsi
mov r12d, dword [r14 + 0x24]
add r12, rsi
mov r13d, dword [r14 + 0x20]
add r13, rsi
mov edi, ebp
cmp dword [r14 + 0x18], 0
jbe 0x1401986d9
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
mov ecx, dword [r13 + rax*4]
add rcx, rsi
movzx eax, word [r12 + rax*2]
mov edx, dword [r15 + rax*4]
add rdx, rsi
cmp rcx, 0xffff
jbe 0x1401986cd
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0x30], rcx
xchg r8, r11
mov qword [rsp + 0x38], r11
xchg r8, r11
mov qword [rsp + 0x40], r9
xchg rcx, rdx
mov rdx, qword [rbx + 0x38]
xchg rdx, rcx
test rcx, rcx
je 0x14019878b
mov rax, qword [rcx]
lea rdx, [rsp + 0xa8]
xchg r8, rdx
mov qword [rsp + 0x20], r8
xchg rdx, r8
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
test al, al
je 0x1401986d9
mov r8, qword [rsp + 0xb0]
mov r9, qword [rsp + 0xa0]
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x14019863a
xchg rcx, r11
mov r11, qword [rbx + 0x38]
xchg rcx, r11
test rcx, rcx
je 0x140198700
cmp rcx, rbx
xchg rdx, rax
mov rdx, qword [rcx]
xchg rdx, rax
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], rbp
mov al, 0x4e
sub al, 3
xor al, 0x5c
sub al, 0xc
add al, 0x58
xor al, 0x62
jmp 0x14019873c
xchg rcx, r15
mov r15, qword [rbx + 0x38]
xchg r15, rcx
test rcx, rcx
je 0x14019873a
mov rax, qword [rcx]
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
xchg r10, rbp
mov qword [rbx + 0x38], r10
xchg rbp, r10
xor al, al
add rsp, 0x58
nop
xchg qword [rsp], r15
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], r14
nop
xchg qword [rsp], r13
add rsp, 8
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
nop
xchg qword [rsp], rsi
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rbp
nop
xchg qword [rsp], rbx
add rsp, 8
ret
call fcn.1401fdb42
nop
int3