joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140033b50
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 0x10], r15
xchg r15, rbx
xchg r9, rbp
mov qword [rsp + 0x18], r9
xchg rbp, r9
nop
sub rsp, 8
mov qword [rsp], rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg rbx, rsi
mov rsi, r8
xchg rsi, rbx
xchg r11, rdx
mov rsi, r11
xchg r11, rdx
xchg r8, rbp
mov r8, rcx
xchg r8, rbp
jne 0x140033c2c
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
xchg r8, r9
mov r9, qword [rbx + 0x10]
xchg r9, r8
xchg rsi, rdx
mov rsi, rdx
xchg rdx, rsi
xchg r10, rbp
mov rcx, r10
xchg rbp, r10
call fcn.140033b50
xchg r14, rdi
mov r14, rbx
xchg r14, rdi
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004cdc0
mov edx, 0x409a358f
add edx, 0x268e252e
add edx, 0x14c99b22
xor edx, 0x694d42bf
xor edx, 0x1dabe19e
xor edx, 0x1bc79573
xor edx, 0x76caba62
add edx, 0x1325d234
sub edx, 0x75404bd3
mov rcx, rdi
call fcn.1401fc5cc
cmp byte [rbx + 0x19], 0
je 0x140033baa
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
push rdx
push rcx
push rax
push rcx
push rax
xchg qword [rsp + 0x28], rsi
pop rax
pop rcx
pop rax
pop rcx
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140033c60
Capabilities:
Encode data using xor

Disassembly:
xchg r10, rbx
mov qword [rsp + 0x10], r10
xchg r10, rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg r13, r8
mov rbx, r13
xchg r13, r8
xchg rdx, r12
mov rsi, r12
xchg r12, rdx
xchg r9, rcx
mov rbp, r9
xchg r9, rcx
jne 0x140033d28
xchg rdi, rsi
mov qword [rsp + 0x30], rsi
xchg rsi, rdi
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 0x10]
xchg rdx, rsi
mov rsi, rdx
xchg rsi, rdx
xchg rbp, rsi
mov rcx, rsi
xchg rsi, rbp
call fcn.140033c60
xchg rbx, r8
mov rdi, r8
xchg rbx, r8
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004cdc0
mov edx, 0x6ee89325
sub edx, 0x1f16ad28
sub edx, 0x1157e447
xor edx, 0x6c8bc1cd
xor edx, 0x45fb6c22
xor edx, 0x3147f59c
sub edx, 0x264d5975
xchg rcx, rdi
mov rdi, rcx
xchg rdi, rcx
call fcn.1401fc5cc
cmp byte [rbx + 0x19], 0
je 0x140033cb2
mov rdi, qword [rsp + 0x30]
xchg rbx, r8
mov r8, qword [rsp + 0x38]
xchg rbx, r8
xchg r12, rbp
mov r12, qword [rsp + 0x40]
xchg rbp, r12
add rsp, 0x20
nop
add rsp, 8
mov rsi, qword [rsp - 8]
ret
Function at 0x140035990
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbx
nop
sub rsp, 8
mov qword [rsp], rsi
push rdi
push r12
nop
sub rsp, 8
mov qword [rsp], r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x30
xchg r15, rsi
mov rsi, rdx
xchg r15, rsi
xchg r14, rcx
mov rcx, r14
xchg r14, rcx
movabs rsi, 0xfffffff29f16eef
add rsi, 0x520d07cd
sub rsi, 0x44f0248e
sub rsi, 0x335f3c0e
add rsi, 0x27e5fe96
xor rsi, 0x2341a14d
add rsi, 0x7fffffff
add rsi, 0x772b4a05
cmp rdx, rsi
ja 0x140035bd0
mov r12, qword [rcx + 8]
sub r12, qword [rcx]
sar r12, 2
sar r12, 1
sar r12, 1
mov rcx, qword [rcx + 0x10]
sub rcx, qword [r14]
sar rcx, 3
sar rcx, 1
xchg rcx, rdx
mov rcx, rdx
xchg rdx, rcx
shr rdx, 1
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
sub rax, rdx
cmp rcx, rax
ja 0x140035a62
lea rsi, [rdx + rcx]
cmp rsi, r15
cmovb rsi, r15
mov qword [rsp + 0x88], rsi
xchg rsi, rbx
mov rdx, rbx
xchg rsi, rbx
xchg rcx, r14
mov r14, rcx
xchg rcx, r14
call fcn.140053970
xchg rbp, rax
mov r13, rbp
xchg rbp, rax
mov qword [rsp + 0x28], rax
mov rbx, r12
shl rbx, 4
add rbx, rax
mov qword [rsp + 0x20], rbx
mov rdi, r15
sub rdi, r12
mov qword [rsp + 0x78], rbx
je 0x140035af9
nop word [rax + rax]
mov byte [rbx], 0x64
xor byte [rbx], 0x5b
add byte [rbx], 0x30
xor byte [rbx], 0x72
sub byte [rbx], 0xf
xor byte [rbx], 3
add byte [rbx], 0x6b
sub byte [rbx], 0x78
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004bbe0
nop
nop
add rbx, 0x4950c515
sub rbx, 0x4950c505
mov qword [rsp + 0x78], rbx
sub rdi, 1
jne 0x140035ab7
mov r8, qword [r14 + 8]
xchg r13, rsi
mov rdx, rsi
xchg r13, rsi
xchg rcx, r15
mov r15, qword [r14]
xchg rcx, r15
cmp rcx, r8
je 0x140035b50
xor r9d, r9d
movzx eax, byte [rcx]
mov byte [rdx], al
mov rax, qword [rcx + 8]
xchg r13, rax
mov qword [rdx + 8], r13
xchg r13, rax
mov byte [rcx], r9b
xchg r14, r9
mov qword [rcx + 8], r14
xchg r9, r14
lea rdx, [rdx + 0x10]
neg rcx
add rcx, 0xfffffffffffffff0
neg rcx
cmp rcx, r8
jne 0x140035b1b
xchg r9, rdx
mov rdx, rsi
xchg rdx, r9
xchg r15, rcx
mov r8, rcx
xchg r15, rcx
xchg r13, rcx
mov rdx, rcx
xchg rcx, r13
mov rcx, r14
add rsp, 0x30
push rcx
push rbx
xchg qword [rsp + 0x10], r15
add rsp, 0x18
nop
add rsp, 8
xchg qword [rsp - 8], r14
nop
xchg qword [rsp], r13
add rsp, 8
push rdx
push rax
push rdx
push rcx
push rcx
xchg qword [rsp + 0x28], r12
pop rcx
pop rcx
pop rdx
pop rax
pop rdx
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rdi
push rax
push rdx
push rbx
push rbx
push rcx
push rax
push rax
push rdx
xchg qword [rsp + 0x40], rsi
add rsp, 0x48
push rcx
push rax
push rax
push rdx
xchg qword [rsp + 0x20], rbx
add rsp, 0x28
jmp fcn.140052af0
call fcn.14002f900
int3
Function at 0x140035c50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rdx
xchg rbx, r15
mov r15, rcx
xchg r15, rbx
test rdx, rdx
je 0x140035caa
nop word [rax + rax]
mov byte [rbx], 0x61
sub byte [rbx], 3
xor byte [rbx], 0x3c
xor byte [rbx], 0x77
add byte [rbx], 0x23
xor byte [rbx], 0x1d
sub byte [rbx], 0x25
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004bbe0
nop
sub rbx, 0xfffffffffffffff0
sub rdi, 1
jne 0x140035c7f
xchg r14, rax
mov r14, rbx
xchg r14, rax
xchg rdi, rbx
mov rdi, qword [rsp + 0x30]
xchg rdi, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14004c3d0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 6
xor byte [rcx + rax + 6], 1
xor byte [rcx + rax + 6], 0x24
add byte [rcx + rax + 6], 0x33
sub byte [rcx + rax + 6], 0x21
add byte [rcx + rax + 6], 0x30
xor byte [rcx + rax + 6], 0x47
add byte [rcx + rax + 6], 0x37
sub byte [rcx + rax + 6], 0x59
inc rax
cmp rax, 8
jb 0x14004c3d2
ret

Function at 0x14004c410
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x40
add byte [rcx + rax + 6], 0x20
add byte [rcx + rax + 6], 3
sub byte [rcx + rax + 6], 0x42
xor byte [rcx + rax + 6], 0x71
sub byte [rcx + rax + 6], 0x50
inc rax
cmp rax, 0xa
jb 0x14004c412
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14004ff90
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov byte [rsp + 0x20], r9b
xchg rdx, r8
mov qword [rsp + 0x18], rdx
xchg rdx, r8
xchg r14, rcx
mov qword [rsp + 8], r14
xchg rcx, r14
push rbx
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x860
mov rbx, rdx
xor edi, edi
mov dword [rsp + 0xc0], edi
xchg rsi, rdx
mov rcx, rsi
xchg rdx, rsi
call fcn.140070580
test rax, rax
je 0x14005196e
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
xchg rdx, rdi
mov qword [rsp + 0x80], rdx
xchg rdx, rdi
movdqu xmmword [rsp + 0x128], xmm0
xchg rdi, r14
mov qword [rsp + 0x138], r14
xchg rdi, r14
mov dword [rsp + 0xc0], 0x55944e61
sub dword [rsp + 0xc0], 0x1e71661a
sub dword [rsp + 0xc0], 0x2e6a2ec1
xor dword [rsp + 0xc0], 0xcfe5040
sub dword [rsp + 0xc0], 0xde665c
xor dword [rsp + 0xc0], 0x368836b
lea ecx, [rdi + 0x20]
call fcn.1401fc590
mov qword [rsp + 0x88], rax
test rax, rax
je 0x140050129
xorps xmm0, xmm0
xchg rcx, rax
movups xmmword [rcx], xmm0
xchg rcx, rax
mov dword [rax + 8], 0x5f1ad770
add dword [rax + 8], 0xe515955
sub dword [rax + 8], 0x617288be
xor dword [rax + 8], 0x10a146b9
add dword [rax + 8], 0x465d7da7
xor dword [rax + 8], 0x44adb1a4
xor dword [rax + 8], 0x251bddc0
mov dword [rax + 0xc], 0x3e879cb8
add dword [rax + 0xc], 0x2c34204b
sub dword [rax + 0xc], 0x4703a093
add dword [rax + 0xc], 0x566deb69
xor dword [rax + 0xc], 0x47f7bd62
xor dword [rax + 0xc], 0x3dd1baba
lea rcx, [0x140002b88]
mov qword [rax], rcx
lea rcx, [0x1400017e0]
xchg rcx, rbp
mov qword [rax + 0x10], rbp
xchg rbp, rcx
lea rcx, [rsp + 0x128]
xchg r8, rcx
mov qword [rax + 0x18], r8
xchg r8, rcx
jmp 0x140050130
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
or dword [rsp + 0xc0], 2
lea rcx, [rax + 0x10]
mov qword [rsp + 0xe8], rcx
mov qword [rsp + 0xf0], rax
lea rdx, [rsp + 0xe8]
mov qword [rsp + 0x88], rdx
test rax, rax
je fcn.14005017d
lock inc dword [rax + 8]
xchg r8, rax
mov r8, qword [rsp + 0xf0]
xchg r8, rax
mov rcx, qword [rsp + 0xe8]
Function at 0x140071300
Capabilities:
Encode data using xor

Disassembly:
push rdx
mov qword [rsp], rbx
sub rsp, 0x40
lea r10, [rsp + 0x3d]
mov r8d, edx
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
test edx, edx
jns 0x1400713b3
neg r8d
nop dword [rax + rax]
dec r10
mov eax, 0x235d84a8
xor eax, 0x403365a8
sub eax, 0x27a3ea76
xor eax, 0x6d4e57e7
add eax, 0xaaaf75d
sub eax, 0x50026ead
add eax, 0x59efc97f
add eax, 0x61afd931
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x14007132d
dec r10
mov byte [r10], 0x4b
xor byte [r10], 0x42
xor byte [r10], 0xb
add byte [r10], 0x1b
add byte [r10], 0x48
sub byte [r10], 0x5c
xor byte [r10], 0x5b
sub byte [r10], 0x25
jmp 0x140071400
dec r10
mov eax, 0x5ccd54cf
sub eax, 0x54ae0701
xor eax, 0x6c30cf74
sub eax, 0x1a970c64
sub eax, 0x1cfd645
xor eax, 0x28ddfd92
add eax, 0x5db76f4a
mul r8d
shr edx, 3
movzx eax, dl
shl al, 1
shl al, 1
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x1400713b3
lea r9, [rsp + 0x58]
xchg rdx, r10
mov r10, rdx
xchg r10, rdx
lea r8, [rsp + 0x3d]
xchg rbx, rsi
mov rcx, rsi
xchg rbx, rsi
call fcn.140030000
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
add rsp, 0x40
push rdx
xchg qword [rsp + 8], rbx
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140076580
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
mov r8d, 0x1811df8c
add r8d, 0x38e41f6e
xor r8d, 0x69ba80cb
add r8d, 0x27cc7517
sub r8d, 0x37cbfbb7
sub r8d, 0x13f88926
add r8d, 0x2f3f3204
sub r8d, 0xacb1f60
add r8d, 0xc6347ef0
test rcx, rcx
je 0x1400766a5
cmp byte [rcx], 0
je 0x1400766a5
test rdx, rdx
jne 0x140076636
nop
movabs rdx, 0xffffffff240976ba
add rdx, 0x3215aebd
add rdx, 0x1bc98983
xor rdx, 0x41bc7663
sub rdx, 0x7ff3a50
add rdx, 0x2650b5e8
xor rdx, 0x3105a81d
add rdx, 0x7fffffff
add rdx, 0x5c03d4
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x140076620
test rdx, rdx
je 0x1400766a2
xor r10d, r10d
lea r11, [0x140002dd0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
or rcx, qword [rsp]
add rsp, 0x10
shr r8d, 2
shr r8d, 5
shr r8d, 1
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x140076648
not r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007ad70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xchg r12, rdx
mov rdi, r12
xchg rdx, r12
xchg rbx, rcx
mov rcx, rbx
xchg rcx, rbx
test rdx, rdx
jne 0x14007adc2
xchg rdx, rbx
mov qword [rcx + 0x10], rbx
xchg rbx, rdx
xchg rcx, rbp
mov rax, rbp
xchg rcx, rbp
xchg rbx, r8
mov r8, qword [rsp + 0x30]
xchg r8, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
nop
movabs r8, 0xffffffff60fdfee2
sub r8, 0x4f6a01f8
add r8, 0x6c83bf79
xor r8, 0x4e32eb58
xor r8, 0x3b67fe03
xor r8, 0xabed852
xor r8, 0x270d0e17
add r8, 0x33c94992
add r8, 0x7fffffff
add r8, 0x254536f1
mov rcx, r8
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x14007ae0f
inc rcx
mov eax, 0x58d501a7
sub eax, 0x30f7d2fd
sub eax, 0x45c03e3
add eax, 0x13a1064d
add eax, 0x165346e4
sub eax, 0x423c6128
xor eax, 0x32a0060c
sub eax, 0x399910da
mul rcx
xchg r11, rcx
mov qword [rbx + 8], r11
xchg r11, rcx
cmovo rax, r8
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.1401fc5d4
mov r8, qword [rbx + 8]
mov rdx, rdi
add r8, r8
xchg r8, rax
mov qword [rbx + 0x10], r8
xchg r8, rax
xchg rcx, r15
mov r15, rax
xchg rcx, r15
call sub.VCRUNTIME140.dll_memcpy
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000ffff
jge 0x14007ae9f
dec eax
or eax, 0xffff0000
inc eax
xor edx, edx
mov word [rbx + 2], ax
cmp qword [rbx + 8], rdx
jbe 0x14007aecd
nop
mov rax, qword [rbx + 0x10]
lea rcx, [rax + rdx*2]
movzx eax, word [rbx + 2]
xor word [rcx], ax
inc rdx
cmp rdx, qword [rbx + 8]
jb 0x14007aeb1
mov byte [rbx], 5
add byte [rbx], 0x5a
sub byte [rbx], 0x24
sub byte [rbx], 0x3a
add byte [rbx], 0x1c
xor byte [rbx], 0x4d
xor byte [rbx], 0x43
sub byte [rbx], 0x13
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
xchg r9, rbx
mov r9, qword [rsp + 0x30]
xchg rbx, r9
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b520
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg rdx, r14
mov r14, rcx
xchg rdx, r14
test rax, rax
jne 0x14007b539
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x14007b57c
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b567
xchg r14, rax
mov r14, qword [rdx + 0x10]
xchg r14, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b547
mov rax, qword [rdx + 0x10]
mov byte [rdx], 3
add byte [rdx], 0xb
add byte [rdx], 0x51
xor byte [rdx], 0x4c
add byte [rdx], 0x69
add byte [rdx], 1
sub byte [rdx], 0x7c
ret

Function at 0x14007b580
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg rdx, rcx
mov rcx, rdx
xchg rcx, rdx
test rax, rax
jne 0x14007b599
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x14007b5d5
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b5c0
mov rcx, qword [rdx + 0x10]
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b5a7
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x6d
sub byte [rdx], 0x28
add byte [rdx], 0xb
sub byte [rdx], 0x1d
sub byte [rdx], 0x2b
sub byte [rdx], 2
xor byte [rdx], 7
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007b910
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg r9, rdx
mov r9, rcx
xchg r9, rdx
test rax, rax
jne 0x14007b923
ret
cmp byte [rcx], 0
jne 0x14007b971
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b956
nop dword [rax + rax]
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b936
xchg rbp, rax
mov rbp, qword [rdx + 0x10]
xchg rbp, rax
mov byte [rdx], 0x27
add byte [rdx], 0x39
sub byte [rdx], 0x30
add byte [rdx], 5
sub byte [rdx], 0x27
add byte [rdx], 0x1d
xor byte [rdx], 0x25
xor byte [rdx], 0x28
xor byte [rdx], 0x27
ret

Function at 0x14007c1a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r10
mov qword [rsp + 0x10], r10
xchg r10, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rsi
mov rdi, rsi
xchg rsi, rcx
lea rbx, [rdx + 4]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x6b
sub byte [rbx + rax], 0x43
xor byte [rbx + rax], 0x5d
sub byte [rbx + rax], 0x22
xor byte [rbx + rax], 0x17
add byte [rbx + rax], 0x28
xor byte [rbx + rax], 0x6c
inc rax
cmp rax, 6
jb 0x14007c1dc
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, r12
mov r12, qword [rsp + 0x30]
xchg r12, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c230
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 8], r13
xchg r13, rbx
xchg rdx, r9
mov qword [rsp + 0x10], r9
xchg r9, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, r9
mov rdi, r9
xchg r9, rcx
lea rbx, [rdx + 6]
xchg r8, rdx
mov r8, rbx
xchg r8, rdx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x4f
xor byte [rbx + rax], 0x18
add byte [rbx + rax], 0xb
xor byte [rbx + rax], 0x7d
add byte [rbx + rax], 0x26
xor byte [rbx + rax], 0x55
add byte [rbx + rax], 0x12
sub byte [rbx + rax], 0x22
inc rax
cmp rax, 8
jb 0x14007c272
xchg rbx, rax
mov rbx, rdi
xchg rbx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c2c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 6]
mov rdx, rbx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x30
add byte [rbx + rax], 0x1c
xor byte [rbx + rax], 0xf
sub byte [rbx + rax], 0x2f
add byte [rbx + rax], 0x1a
sub byte [rbx + rax], 0x2e
inc rax
cmp rax, 0xa
jb 0x14007c2e7
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rsi, rbx
mov rsi, qword [rsp + 0x30]
xchg rsi, rbx
add rsp, 0x20
push rdx
push rax
push rcx
push rdx
push rbx
push rax
xchg qword [rsp + 0x30], rdi
pop rax
pop rbx
pop rdx
pop rcx
pop rax
pop rdx
add rsp, 8
ret
Function at 0x14007c340
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rbx, rcx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, r8
mov r8, rcx
xchg rdi, r8
lea rbx, [rdx + 8]
xchg rbx, r14
mov rdx, r14
xchg rbx, r14
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x4a
xor byte [rbx + rax], 0x5e
sub byte [rbx + rax], 0x14
add byte [rbx + rax], 0x69
sub byte [rbx + rax], 0x5d
xor byte [rbx + rax], 0x46
xor byte [rbx + rax], 0x4a
inc rax
cmp rax, 0xe
jb 0x14007c373
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, r9
mov r9, qword [rsp + 0x30]
xchg r9, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c3d0
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rbx
mov qword [rsp + 8], rbp
xchg rbx, rbp
xchg rdx, r9
mov qword [rsp + 0x10], r9
xchg rdx, r9
push rdi
sub rsp, 0x20
xchg rcx, r11
mov rdi, r11
xchg rcx, r11
lea rbx, [rdx + 0xa]
xchg rbx, r9
mov rdx, r9
xchg rbx, r9
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x30
add byte [rbx + rax], 8
xor byte [rbx + rax], 0x15
xor byte [rbx + rax], 0xc
sub byte [rbx + rax], 0xb
add byte [rbx + rax], 0x1f
xor byte [rbx + rax], 0x35
inc rax
cmp rax, 0x10
jb 0x14007c409
mov rax, rdi
xchg rbx, r13
mov r13, qword [rsp + 0x30]
xchg rbx, r13
add rsp, 0x20
push rcx
push rbx
push rcx
push rdx
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
ret

Function at 0x14007c450
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rbx, rcx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, r12
mov r12, rcx
xchg rdi, r12
lea rbx, [rdx + 0xa]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x4b
add byte [rbx + rax], 2
xor byte [rbx + rax], 0x79
xor byte [rbx + rax], 0x23
sub byte [rbx + rax], 7
xor byte [rbx + rax], 0x10
inc rax
cmp rax, 0x12
jb 0x14007c48c
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, r8
mov r8, qword [rsp + 0x30]
xchg rbx, r8
add rsp, 0x20
push rbx
push rbx
push rbx
push rax
push rdx
push rcx
push rdx
push rdx
xchg qword [rsp + 0x40], rdi
add rsp, 0x48
ret

Function at 0x14007c4e0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rbx, rcx
xchg rdx, r15
mov qword [rsp + 0x10], r15
xchg rdx, r15
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x10]
xchg rsi, rdx
mov rsi, rbx
xchg rsi, rdx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x45
xor byte [rbx + rax], 0xe
xor byte [rbx + rax], 0x13
sub byte [rbx + rax], 0x26
xor byte [rbx + rax], 0x45
sub byte [rbx + rax], 0x69
sub byte [rbx + rax], 0xe
inc rax
cmp rax, 0x1e
jb 0x14007c519
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, r13
mov r13, qword [rsp + 0x30]
xchg r13, rbx
add rsp, 0x20
push rcx
push rbx
xchg qword [rsp + 0x10], rdi
add rsp, 0x18
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c570
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 8], rdi
xchg rbx, rdi
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x12]
mov rdx, rbx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x44
sub byte [rbx + rax], 0x14
add byte [rbx + rax], 0x4c
sub byte [rbx + rax], 0x1b
add byte [rbx + rax], 0x1c
xor byte [rbx + rax], 0x65
add byte [rbx + rax], 0x24
xor byte [rbx + rax], 0x5c
sub byte [rbx + rax], 0x60
inc rax
cmp rax, 0x20
jb 0x14007c5a0
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007c690
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rbx
mov qword [rsp + 8], r14
xchg rbx, r14
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x14]
mov rdx, rbx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x65
add byte [rbx + rax], 0x19
sub byte [rbx + rax], 0x5b
sub byte [rbx + rax], 0x11
add byte [rbx + rax], 0x32
xor byte [rbx + rax], 0x63
add byte [rbx + rax], 0x34
sub byte [rbx + rax], 0x13
sub byte [rbx + rax], 0x48
inc rax
cmp rax, 0x24
jb 0x14007c6c5
xchg rdx, rax
mov rdx, rdi
xchg rdx, rax
xchg rbx, r15
mov r15, qword [rsp + 0x30]
xchg rbx, r15
add rsp, 0x20
push rbx
xchg qword [rsp + 8], rdi
pop rbx
add rsp, 8
ret

Function at 0x14007c720
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdi, rdx
mov qword [rsp + 0x10], rdi
xchg rdi, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x14]
xchg rdi, rbx
mov rdx, rdi
xchg rbx, rdi
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x7e
sub byte [rbx + rax], 0x78
add byte [rbx + rax], 0x10
add byte [rbx + rax], 0x51
sub byte [rbx + rax], 0x2f
xor byte [rbx + rax], 0x5d
sub byte [rbx + rax], 0x56
xor byte [rbx + rax], 0x1c
sub byte [rbx + rax], 0x13
inc rax
cmp rax, 0x26
jb 0x14007c756
xchg rdi, rdx
mov rax, rdx
xchg rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rax
push rcx
push rax
push rbx
push rax
push rdx
xchg qword [rsp + 0x38], rdi
add rsp, 0x40
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c7b0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg r12, rbx
xchg rdx, rcx
mov qword [rsp + 0x10], rcx
xchg rcx, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x16]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ad70
nop
xor eax, eax
mov byte [rbx + rax], 0x15
add byte [rbx + rax], 0x18
sub byte [rbx + rax], 9
sub byte [rbx + rax], 1
xor byte [rbx + rax], 9
add byte [rbx + rax], 0x2a
sub byte [rbx + rax], 0x2d
xor byte [rbx + rax], 0x33
xor byte [rbx + rax], 0x14
inc rax
cmp rax, 0x28
jb 0x14007c7ec
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
xchg qword [rsp + 8], rdi
add rsp, 0x10
nop
add rsp, 8
jmp qword [rsp - 8]