joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007c870
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r13
mov qword [rsp + 0x10], r13
xchg rdx, r13
push rdi
sub rsp, 0x20
xchg rdi, r10
mov r10, rcx
xchg rdi, r10
lea rbx, [rdx + 0x1e]
xchg rbx, r9
mov rdx, r9
xchg r9, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x4f
xor byte [rbx + rax], 0x25
sub byte [rbx + rax], 0x1b
add byte [rbx + rax], 0x11
xor byte [rbx + rax], 0x6b
add byte [rbx + rax], 0x4f
sub byte [rbx + rax], 0x5a
inc rax
cmp rax, 0x38
jb 0x14007c8a3
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c900
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 8], r15
xchg r15, rbx
xchg rbp, rdx
mov qword [rsp + 0x10], rbp
xchg rdx, rbp
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, r8
mov rdi, r8
xchg r8, rcx
lea rbx, [rdx + 0x20]
mov rdx, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x60
add byte [rbx + rax], 0x1e
xor byte [rbx + rax], 0x35
sub byte [rbx + rax], 0x42
add byte [rbx + rax], 0x13
add byte [rbx + rax], 7
sub byte [rbx + rax], 0x23
inc rax
cmp rax, 0x3e
jb 0x14007c93b
xchg r14, rax
mov r14, rdi
xchg r14, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rdx
push rdx
xchg qword [rsp + 0x18], rdi
pop rdx
pop rdx
pop rax
add rsp, 8
ret

Function at 0x14007ca10
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rbx, rdi
xchg r8, rdx
mov qword [rsp + 0x10], r8
xchg r8, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x22]
xchg r9, rbx
mov rdx, r9
xchg rbx, r9
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x42
add byte [rbx + rax], 0x39
sub byte [rbx + rax], 0xd
add byte [rbx + rax], 1
xor byte [rbx + rax], 0x5a
sub byte [rbx + rax], 6
sub byte [rbx + rax], 0x2f
inc rax
cmp rax, 0x42
jb 0x14007ca4c
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg r11, rbx
mov r11, qword [rsp + 0x30]
xchg r11, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007caa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r12
mov qword [rsp + 0x10], r12
xchg r12, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r13, rdi
mov r13, rcx
xchg r13, rdi
lea rbx, [rdx + 0x24]
mov rdx, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 5
xor byte [rbx + rax], 0
add byte [rbx + rax], 0x53
xor byte [rbx + rax], 0x14
sub byte [rbx + rax], 0x41
sub byte [rbx + rax], 0xb
add byte [rbx + rax], 0x57
sub byte [rbx + rax], 0x1b
xor byte [rbx + rax], 0x3c
inc rax
cmp rax, 0x46
jb 0x14007cad5
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rdx
xchg qword [rsp + 0x10], rdi
add rsp, 0x18
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007cbb0
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rbx
mov qword [rsp + 8], rcx
xchg rbx, rcx
xchg rdx, rbx
mov qword [rsp + 0x10], rbx
xchg rbx, rdx
nop
push 0x7d8bafcc
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdx
mov rdi, rdx
xchg rcx, rdx
lea rbx, [rdx + 0x2a]
xchg rdx, rbp
mov rbp, rbx
xchg rbp, rdx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0xa
add byte [rbx + rax], 0x4e
sub byte [rbx + rax], 0x51
add byte [rbx + rax], 0x54
xor byte [rbx + rax], 0x4b
add byte [rbx + rax], 0x53
xor byte [rbx + rax], 0x7d
sub byte [rbx + rax], 0x1e
inc rax
cmp rax, 0x50
jb 0x14007cbf2
xchg rdi, rdx
mov rax, rdx
xchg rdx, rdi
xchg rbx, rdi
mov rdi, qword [rsp + 0x30]
xchg rdi, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x14007cc40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rcx, rdx
mov qword [rsp + 0x10], rcx
xchg rdx, rcx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r11, rdi
mov r11, rcx
xchg rdi, r11
lea rbx, [rdx + 0x2a]
mov rdx, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x75
xor byte [rbx + rax], 0x3b
add byte [rbx + rax], 9
sub byte [rbx + rax], 0x1e
xor byte [rbx + rax], 0x49
sub byte [rbx + rax], 5
sub byte [rbx + rax], 0x1d
sub byte [rbx + rax], 0x4e
inc rax
cmp rax, 0x52
jb 0x14007cc76
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007ccc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
push 0x1bfb22e4
mov qword [rsp], rdi
sub rsp, 0x20
xchg r8, rdi
mov r8, rcx
xchg r8, rdi
lea rbx, [rdx + 0x2c]
mov rdx, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0xe
xor byte [rbx + rax], 0x6b
sub byte [rbx + rax], 0x4e
add byte [rbx + rax], 0x55
sub byte [rbx + rax], 0x38
add byte [rbx + rax], 0x3f
sub byte [rbx + rax], 0x68
add byte [rbx + rax], 0x5d
sub byte [rbx + rax], 0x68
inc rax
cmp rax, 0x54
jb 0x14007ccf0
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cd40
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rdi, rbx
xchg rdx, rcx
mov qword [rsp + 0x10], rcx
xchg rcx, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, r10
mov rdi, r10
xchg r10, rcx
lea rbx, [rdx + 0x2e]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x4a
sub byte [rbx + rax], 0x31
sub byte [rbx + rax], 8
sub byte [rbx + rax], 1
add byte [rbx + rax], 0x16
xor byte [rbx + rax], 0x26
inc rax
cmp rax, 0x58
jb 0x14007cd82
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rbx
xchg qword [rsp + 0x10], rdi
pop rbx
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007ce50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r15, rdx
mov qword [rsp + 0x10], r15
xchg rdx, r15
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x30]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 1
add byte [rbx + rax], 3
add byte [rbx + rax], 0x47
add byte [rbx + rax], 2
xor byte [rbx + rax], 0xe
xor byte [rbx + rax], 0x43
inc rax
cmp rax, 0x5c
jb 0x14007ce8b
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007ced0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r8, rdi
mov r8, rcx
xchg rdi, r8
lea rbx, [rdx + 0x30]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x42
add byte [rbx + rax], 0x33
sub byte [rbx + rax], 0x6e
add byte [rbx + rax], 9
add byte [rbx + rax], 0x15
xor byte [rbx + rax], 0x2c
add byte [rbx + rax], 0x1d
xor byte [rbx + rax], 0x42
xor byte [rbx + rax], 0x64
inc rax
cmp rax, 0x5e
jb 0x14007cf06
xchg rsi, rax
mov rsi, rdi
xchg rsi, rax
xchg rbx, r10
mov r10, qword [rsp + 0x30]
xchg r10, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x14007cf60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r14
mov qword [rsp + 0x10], r14
xchg r14, rdx
nop
push 0x5228302c
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, r10
mov rdi, r10
xchg rcx, r10
lea rbx, [rdx + 0x32]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x69
xor byte [rbx + rax], 0x22
add byte [rbx + rax], 7
xor byte [rbx + rax], 0x13
sub byte [rbx + rax], 0x12
xor byte [rbx + rax], 0x1c
add byte [rbx + rax], 0xc
xor byte [rbx + rax], 0x22
xor byte [rbx + rax], 0x1d
inc rax
cmp rax, 0x60
jb 0x14007cf9c
xchg rdi, r9
mov rax, r9
xchg rdi, r9
xchg rbx, r15
mov r15, qword [rsp + 0x30]
xchg r15, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007cff0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r14
mov qword [rsp + 0x10], r14
xchg rdx, r14
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdx, rcx
mov rdi, rdx
xchg rcx, rdx
lea rbx, [rdx + 0x34]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x4c
sub byte [rbx + rax], 0x43
xor byte [rbx + rax], 0x7c
sub byte [rbx + rax], 0x70
add byte [rbx + rax], 0x35
xor byte [rbx + rax], 0x25
xor byte [rbx + rax], 0x1b
sub byte [rbx + rax], 4
inc rax
cmp rax, 0x64
jb 0x14007d02c
xchg rbp, rax
mov rbp, rdi
xchg rbp, rax
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
add rsp, 0x20
push rdx
push rcx
push rcx
push rax
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d090
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rbx
mov qword [rsp + 8], rbp
xchg rbx, rbp
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x38]
xchg rbx, r11
mov rdx, r11
xchg r11, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x40
sub byte [rbx + rax], 0x2c
add byte [rbx + rax], 0x3a
sub byte [rbx + rax], 0x45
xor byte [rbx + rax], 0x53
xor byte [rbx + rax], 0x2e
xor byte [rbx + rax], 0x61
xor byte [rbx + rax], 0x15
inc rax
cmp rax, 0x6e
jb 0x14007d0c5
xchg r14, rax
mov r14, rdi
xchg r14, rax
xchg r9, rbx
mov r9, qword [rsp + 0x30]
xchg r9, rbx
add rsp, 0x20
push rdx
push rax
push rdx
push rbx
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d120
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rbx, rsi
xchg rdx, r8
mov qword [rsp + 0x10], r8
xchg r8, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x4e]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x19
xor byte [rbx + rax], 0x51
add byte [rbx + rax], 0x19
xor byte [rbx + rax], 0x78
add byte [rbx + rax], 0x4b
sub byte [rbx + rax], 0x61
add byte [rbx + rax], 0x44
xor byte [rbx + rax], 0x45
xor byte [rbx + rax], 2
inc rax
cmp rax, 0x98
jb 0x14007d162
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg r10, rbx
mov r10, qword [rsp + 0x30]
xchg rbx, r10
add rsp, 0x20
push rbx
push rbx
push rbx
xchg qword [rsp + 0x18], rdi
pop rbx
pop rbx
pop rbx
add rsp, 8
ret

Function at 0x14007d1c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x56]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x68
sub byte [rbx + rax], 0x11
xor byte [rbx + rax], 0x49
xor byte [rbx + rax], 0
xor byte [rbx + rax], 0x63
sub byte [rbx + rax], 0x7d
inc rax
cmp rax, 0xa8
jb 0x14007d1f6
xchg rbx, rdi
mov rax, rbx
xchg rbx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x14007d2c0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r9
mov qword [rsp + 8], r9
xchg r9, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, r11
mov rdi, r11
xchg r11, rcx
lea rbx, [rdx + 0x70]
xchg r10, rbx
mov rdx, r10
xchg rbx, r10
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x4b
xor byte [rbx + rax], 3
xor byte [rbx + rax], 0x13
sub byte [rbx + rax], 3
sub byte [rbx + rax], 0x32
add byte [rbx + rax], 0x54
sub byte [rbx + rax], 0x29
sub byte [rbx + rax], 0x50
sub byte [rbx + rax], 1
inc rax
cmp rax, 0xdc
jb 0x14007d2f3
xchg rbp, rax
mov rbp, rdi
xchg rbp, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rcx
push rax
push rbx
push rdx
xchg qword [rsp + 0x28], rdi
add rsp, 0x30
ret
Function at 0x14007d350
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rbx, rdx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rbx, rdi
mov rbx, rcx
xchg rbx, rdi
lea rbx, [rdx + 0x70]
mov rdx, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x66
xor byte [rbx + rax], 0x31
sub byte [rbx + rax], 0x34
xor byte [rbx + rax], 0x52
add byte [rbx + rax], 3
sub byte [rbx + rax], 0x1b
sub byte [rbx + rax], 0x59
inc rax
cmp rax, 0xde
jb 0x14007d37d
xchg r9, rax
mov r9, rdi
xchg r9, rax
xchg rcx, rbx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
add rsp, 0x20
push rcx
push rdx
xchg qword [rsp + 0x10], rdi
pop rdx
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d3d0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg r12, rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, r9
mov rdi, r9
xchg rcx, r9
lea rbx, [rdx + 0x76]
xchg rbx, r10
mov rdx, r10
xchg r10, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x30
xor byte [rbx + rax], 0x49
xor byte [rbx + rax], 0x77
add byte [rbx + rax], 0x6b
xor byte [rbx + rax], 7
sub byte [rbx + rax], 0x28
add byte [rbx + rax], 0x16
sub byte [rbx + rax], 0x6c
inc rax
cmp rax, 0xea
jb 0x14007d40c
xchg rcx, rax
mov rcx, rdi
xchg rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d4e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r10, rdx
mov qword [rsp + 0x10], r10
xchg r10, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r15, rdi
mov r15, rcx
xchg r15, rdi
lea rbx, [rdx + 0x9a]
mov rdx, rbx
call fcn.14007ab80
nop
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbx + rax], 0x46
xor byte [rbx + rax], 0x26
xor byte [rbx + rax], 0x28
add byte [rbx + rax], 9
xor byte [rbx + rax], 0x45
xor byte [rbx + rax], 0x67
sub byte [rbx + rax], 0x11
sub byte [rbx + rax], 0x27
xor byte [rbx + rax], 0x3b
inc rax
cmp rax, 0x130
jb 0x14007d524
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007d570
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 8], r14
xchg rbx, r14
mov qword [rsp + 0x10], rdx
nop
push 0x4ba87f76
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r11
mov r11, rcx
xchg rdi, r11
lea rbx, [rdx + 0xc]
mov rdx, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x49
add byte [rbx + rax], 0x32
xor byte [rbx + rax], 0x61
sub byte [rbx + rax], 0x1a
xor byte [rbx + rax], 0x2c
sub byte [rbx + rax], 0x2c
inc rax
cmp rax, 0x14
jb 0x14007d5a6
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
push rcx
push rdx
xchg qword [rsp + 0x10], rdi
pop rdx
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d600
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r11, rdx
mov qword [rsp + 0x10], r11
xchg r11, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xe]
xchg rdx, r14
mov r14, rbx
xchg rdx, r14
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x1a
xor byte [rbx + rax], 0x5f
sub byte [rbx + rax], 0x32
xor byte [rbx + rax], 0x64
sub byte [rbx + rax], 0x6d
sub byte [rbx + rax], 0xa
inc rax
cmp rax, 0x18
jb 0x14007d635
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg r9, rbx
mov r9, qword [rsp + 0x30]
xchg rbx, r9
add rsp, 0x20
push rcx
push rdx
push rax
push rax
push rax
push rbx
xchg qword [rsp + 0x30], rdi
add rsp, 0x38
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d690
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg r12, rbx
xchg r15, rdx
mov qword [rsp + 0x10], r15
xchg r15, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xe]
xchg rbx, rsi
mov rdx, rsi
xchg rsi, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 4
xor byte [rbx + rax], 0x5c
sub byte [rbx + rax], 0x36
add byte [rbx + rax], 0x43
xor byte [rbx + rax], 0x31
add byte [rbx + rax], 0x10
xor byte [rbx + rax], 0x64
inc rax
cmp rax, 0x1a
jb 0x14007d6cb
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140083ef0
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rax
mov rdx, r8
xchg rdx, rax
cmp rcx, rdx
je 0x140084065
mov r9, rax
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
xchg rdx, rax
movups xmmword [rdx], xmm0
xchg rdx, rax
mov qword [r9 + r8 - 0x70], r10
xchg rbx, r10
mov qword [r9 + r8 - 0x68], rbx
xchg r10, rbx
xchg r9, r8
movups xmm0, xmmword [r9 - 0x80]
xchg r9, r8
xchg rcx, rax
movups xmmword [rcx], xmm0
xchg rcx, rax
xchg r8, rsi
movups xmm1, xmmword [rsi - 0x70]
xchg r8, rsi
xorps xmm0, xmm0
xchg r8, rax
movups xmmword [r8 + 0x10], xmm1
xchg r8, rax
mov qword [r8 - 0x70], r10
sub rax, 0xffffffffffffffb8
mov qword [r8 - 0x68], 0x72f16502
add qword [r8 - 0x68], 0xcbee9bb
xor qword [r8 - 0x68], 0x7b44b784
add qword [r8 - 0x68], 0x45569d7
add qword [r8 - 0x68], 0x52a34761
sub qword [r8 - 0x68], 0x53ee2905
add qword [r8 - 0x68], 0x41a75fc3
xor qword [r8 - 0x68], 0x1846d89
xor qword [r8 - 0x68], 0x48228ca1
mov word [r8 - 0x80], r10w
xchg r14, r9
movups xmmword [r14 + r8 - 0x60], xmm0
xchg r9, r14
xchg r13, r10
mov qword [r9 + r8 - 0x50], r13
xchg r13, r10
mov qword [r9 + r8 - 0x48], r10
xchg r13, r8
movups xmm0, xmmword [r13 - 0x60]
xchg r13, r8
xchg r9, r13
movups xmmword [r13 + r8 - 0x60], xmm0
xchg r9, r13
xchg r8, rdi
movups xmm1, xmmword [rdi - 0x50]
xchg r8, rdi
xchg rdi, r9
movups xmmword [rdi + r8 - 0x50], xmm1
xchg rdi, r9
xchg r10, rdi
mov qword [r8 - 0x50], rdi
xchg r10, rdi
mov qword [r8 - 0x48], 0x3b1c944f
xor qword [r8 - 0x48], 0x7a1b9b22
sub qword [r8 - 0x48], 0x1c2eb20e
sub qword [r8 - 0x48], 0x4378d0d
xor qword [r8 - 0x48], 0x64969f07
sub qword [r8 - 0x48], 0x2621d9d0
xor qword [r8 - 0x48], 0x772247fe
sub qword [r8 - 0x48], 0x99708e3
xor qword [r8 - 0x48], 0x5f9f299f
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x140083f14
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140084180
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rax
mov r8, rax
xchg r8, rax
cmp rcx, rdx
je 0x140084252
xchg r9, rcx
mov rcx, rax
xchg rcx, r9
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
movups xmmword [rax], xmm0
mov qword [r9 + r8 - 0x28], r10
lea rcx, [r8 - 0x18]
xchg rcx, r10
mov qword [r8 + r9 - 0x20], rcx
xchg r10, rcx
xchg r8, r11
movups xmm0, xmmword [r11 - 0x38]
xchg r8, r11
movups xmmword [rax], xmm0
xchg r8, rdx
movups xmm1, xmmword [rdx - 0x28]
xchg r8, rdx
xchg r12, rax
movups xmmword [r12 + 0x10], xmm1
xchg r12, rax
mov qword [r8 - 0x28], r10
neg rax
add rax, 0xffffffffffffffe0
neg rax
mov qword [r8 - 0x20], 0x3a90fed4
xor qword [r8 - 0x20], 0x5f05ec0d
xor qword [r8 - 0x20], 0x4223b3ab
add qword [r8 - 0x20], 0x4cc53d2d
sub qword [r8 - 0x20], 0x563a0d18
sub qword [r8 - 0x20], 0x10125ddd
add qword [r8 - 0x20], 0x33a6a9b
xor qword [r8 - 0x20], 0x75bd1a1d
xor qword [r8 - 0x20], 0x64d4c45f
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x1400841ae
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14008e6b0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0xa], 0x56
add byte [rcx + rax + 0xa], 0x1c
xor byte [rcx + rax + 0xa], 0x76
add byte [rcx + rax + 0xa], 7
add byte [rcx + rax + 0xa], 0x2d
xor byte [rcx + rax + 0xa], 0x45
sub byte [rcx + rax + 0xa], 0x7d
inc rax
cmp rax, 0x10
jb 0x14008e6b2
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14008e7a0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0x14], 0x60
sub byte [rcx + rax + 0x14], 0x3b
add byte [rcx + rax + 0x14], 0x12
xor byte [rcx + rax + 0x14], 0x54
sub byte [rcx + rax + 0x14], 0x40
add byte [rcx + rax + 0x14], 0x14
xor byte [rcx + rax + 0x14], 0x37
inc rax
cmp rax, 0x24
jb 0x14008e7a2
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140173200
Capabilities:
Check for software breakpoints

Disassembly:
xchg r13, rbx
mov qword [rsp + 0x10], r13
xchg rbx, r13
mov qword [rsp + 0x18], rbp
push rsi
push r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x20
xchg rdi, rbx
mov rdi, qword [rcx]
xchg rbx, rdi
xchg r9, r11
mov rbp, r11
xchg r11, r9
xchg rdx, r14
mov rdx, r8
xchg r14, rdx
mov r15, rdx
mov rsi, rcx
test rbx, rbx
je 0x1401732d6
xchg rdi, r12
mov qword [rsp + 0x40], r12
xchg rdi, r12
mov rdi, qword [rcx + 8]
cmp rbx, rdi
je 0x14017327e
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
call fcn.14002f830
sub rbx, 0xffffffffffffffe0
cmp rbx, rdi
jne 0x140173263
xchg rcx, r14
mov r14, qword [rsi]
xchg rcx, r14
mov rdx, qword [rsi + 0x10]
mov rdi, qword [rsp + 0x40]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
cmp rdx, 0x1000
jb 0x1401732d1
mov r8, qword [rcx - 8]
nop
sub rdx, 0xf2b01ef
add rdx, 0xf2b0216
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14017333e
xchg r8, r9
mov rcx, r9
xchg r8, r9
call fcn.1401fd098
xchg rbx, rdx
mov rdx, qword [rsp + 0x48]
xchg rbx, rdx
shl r14, 1
shl r14, 3
shl r14, 1
add r14, r15
shl rbp, 1
shl rbp, 2
shl rbp, 1
shl rbp, 1
add rbp, r15
mov qword [rsi], r15
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rbp
xchg rbp, r14
mov r14, qword [rsp + 0x50]
xchg r14, rbp
add rsp, 0x20
nop
xchg qword [rsp], r15
add rsp, 8
push rdx
xchg qword [rsp + 8], r14
add rsp, 0x10
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
call 0x140b0d373
cmp al, 0xcc
int3
Function at 0x1401940a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
xchg rdi, rdx
mov r10, rdi
xchg rdi, rdx
xchg rdi, r11
mov rdi, rcx
xchg rdi, r11
mov word [rsp + 0x30], 0x6989
xor word [rsp + 0x30], 0x3971
sub word [rsp + 0x30], 0x3847
add word [rsp + 0x30], 0x38b0
sub word [rsp + 0x30], 0x1f40
add word [rsp + 0x30], 0xc4d5
mov dword [rsp + 0x34], 0x7a22cb89
xor dword [rsp + 0x34], 0x48f451e1
add dword [rsp + 0x34], 0x1d865b5c
sub dword [rsp + 0x34], 0x36e8e5b1
add dword [rsp + 0x34], 0x26f25a79
add dword [rsp + 0x34], 0xbee994c5
mov byte [rsp + 0x32], SHCreateMemStream
add byte [rsp + 0x32], 0x22
sub byte [rsp + 0x32], 0x1b
xor byte [rsp + 0x32], 0x2b
add byte [rsp + 0x32], 0x3e
sub byte [rsp + 0x32], 0x5f
xor byte [rsp + 0x32], 0x78
xor byte [rsp + 0x32], 0x17
add byte [rsp + 0x32], 0x7f
mov dword [rsp + 0x38], 0x6b937010
xor dword [rsp + 0x38], 0x4e8761
sub dword [rsp + 0x38], 0x1a80537d
add dword [rsp + 0x38], 0x9654278
sub dword [rsp + 0x38], 0x4fceebbe
add dword [rsp + 0x38], 0x20e87bcc
sub dword [rsp + 0x38], 0x2bdb771c
xor ebx, ebx
mov edx, ebx
nop dword [rax]
movzx eax, word [rsp + rdx*2 + 0x34]
movzx ecx, byte [rsp + rdx + 0x30]
add cx, ax
mov word [rsp + rdx*2 + 0x34], cx
mov byte [rsp + rdx + 0x30], bl
inc rdx
cmp rdx, 3
jb 0x14019417f
mov qword [rsp + 0x28], r8
xchg rbx, r11
mov qword [rsp + 0x20], r11
xchg r11, rbx
xor r9d, r9d
lea r8, [rsp + 0x34]
xchg r10, r14
mov rdx, r14
xchg r14, r10
xchg rcx, r11
mov r11, rcx
xchg r11, rcx
call fcn.1401945c0
nop
nop dword [rax]
mov byte [rsp + rbx + 0x34], 0x65
sub byte [rsp + rbx + 0x34], 0x39
xor byte [rsp + rbx + 0x34], 0
add byte [rsp + rbx + 0x34], 0x2f
sub byte [rsp + rbx + 0x34], 0x39
add byte [rsp + rbx + 0x34], 0x30
sub byte [rsp + rbx + 0x34], 0x4d
add byte [rsp + rbx + 0x34], 0x63
sub byte [rsp + rbx + 0x34], 0x68
inc rbx
cmp rbx, 6
jb 0x1401941d5
add rsp, 0x40
nop
add rsp, 8
mov rbx, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]