joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140033c30
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 0x10], r14
xchg rbx, r14
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg rdi, rbx
mov rdi, r8
xchg rbx, rdi
xchg rdx, r11
mov rsi, r11
xchg r11, rdx
xchg rbp, r8
mov r8, rcx
xchg rbp, r8
jne 0x140033cfe
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
xchg r15, r8
mov r15, qword [rbx + 0x10]
xchg r8, r15
xchg r13, rsi
mov rdx, r13
xchg r13, rsi
mov rcx, rbp
call fcn.140033c30
xchg rdi, rbx
mov rbx, rdi
xchg rdi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004ccb0
mov edx, 0x2d7a38c2
add edx, 0x28c769ad
add edx, 0xa9e072b
sub edx, 0x31d3e1f0
sub edx, 0x9ef017e
add edx, 0x5a7e8e5
xor edx, 0x6e23bd85
sub edx, 0x44e71244
xchg rdi, r8
mov rcx, r8
xchg rdi, r8
call fcn.1401fcb00
cmp byte [rbx + 0x19], 0
je 0x140033c7c
xchg rdi, rsi
mov rsi, qword [rsp + 0x30]
xchg rsi, rdi
xchg rbx, r15
mov r15, qword [rsp + 0x38]
xchg r15, rbx
xchg rbp, r10
mov r10, qword [rsp + 0x40]
xchg rbp, r10
add rsp, 0x20
nop
mov rsi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140033d30
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 0x10], r11
xchg r11, rbx
mov qword [rsp + 0x18], rbp
push rdi
mov qword [rsp], rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
mov rbx, r8
xchg rdx, r8
mov rsi, r8
xchg r8, rdx
xchg rbp, rcx
mov rcx, rbp
xchg rcx, rbp
jne 0x140033df0
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
xchg r13, r8
mov r13, qword [rbx + 0x10]
xchg r13, r8
xchg r12, rsi
mov rdx, r12
xchg rsi, r12
xchg rsi, rbp
mov rcx, rsi
xchg rbp, rsi
call fcn.140033d30
xchg rdi, rbx
mov rbx, rdi
xchg rbx, rdi
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004ccb0
mov edx, 0x55cf1523
add edx, 0x49927a6
xor edx, 0x36b80f83
sub edx, 0x4994b16c
add edx, 0x854f084
xor edx, 0x37dae11e
sub edx, 0x1c4a932c
mov rcx, rdi
call fcn.1401fcb00
cmp byte [rbx + 0x19], 0
je 0x140033d7a
mov rdi, qword [rsp + 0x30]
xchg rbx, rsi
mov rsi, qword [rsp + 0x38]
xchg rsi, rbx
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
nop
mov rsi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14004c350
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x46
add byte [rcx + rax + 6], 0x22
sub byte [rcx + rax + 6], 0x50
xor byte [rcx + rax + 6], 0x3a
add byte [rcx + rax + 6], 0x26
sub byte [rcx + rax + 6], 0x25
add byte [rcx + rax + 6], 0x50
xor byte [rcx + rax + 6], 0x4d
xor byte [rcx + rax + 6], 0x3e
inc rax
cmp rax, 8
jb 0x14004c352
ret

Function at 0x14004c390
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x4e
sub byte [rcx + rax + 6], 0x14
xor byte [rcx + rax + 6], 0x7c
add byte [rcx + rax + 6], 0xd
sub byte [rcx + rax + 6], 0x29
add byte [rcx + rax + 6], 0x52
xor byte [rcx + rax + 6], 0x1b
xor byte [rcx + rax + 6], 0x67
inc rax
cmp rax, 0xa
jb 0x14004c392
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400761d0
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
mov r8d, 0x6ff5e29b
sub r8d, 0x4392e634
add r8d, 0x32639e1c
add r8d, 0xb29df9b
add r8d, 0x73b06b2
sub r8d, 0x4dd272c5
add r8d, 0x1ff62b48
add r8d, 0xbcb0c6ac
test rcx, rcx
je 0x1400762f3
cmp byte [rcx], 0
je 0x1400762f3
test rdx, rdx
jne 0x14007627f
nop
movabs rdx, 0xffffffff1b2f3a54
add rdx, 0x398720f4
sub rdx, 0x4be28434
add rdx, 0x13b8df5c
add rdx, 0x2573d669
add rdx, 0x18c0102e
sub rdx, 0x28491eec
add rdx, 0x7fffffff
add rdx, 0x4d8881e5
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x140076269
test rdx, rdx
je 0x1400762f0
xor r10d, r10d
lea r11, [0x140002dd0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
xor rcx, qword [rsp]
add rsp, 0x10
shr r8d, 4
shr r8d, 1
shr r8d, 1
shr r8d, 1
shr r8d, 1
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x140076291
not r8d
mov eax, r8d
ret
Function at 0x14007a9b0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 8], rbp
xchg rbp, rbx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rdx
mov rdx, rdi
xchg rdi, rdx
xchg rcx, r11
mov rbx, r11
xchg r11, rcx
test rdx, rdx
jne 0x14007aa1d
xchg rdx, r11
mov qword [rcx + 0x10], r11
xchg rdx, r11
xchg rcx, rax
mov rcx, rax
xchg rcx, rax
xchg r10, rbx
mov r10, qword [rsp + 0x30]
xchg rbx, r10
add rsp, 0x20
push rbx
push rax
push rcx
push rdx
xchg qword [rsp + 0x20], rdi
pop rdx
pop rcx
pop rax
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
nop
movabs r8, 0xffffffff7c18f436
xor r8, 0x2e228986
sub r8, 0x35bcc00b
xor r8, 0x784ed317
xor r8, 0x632bc3a0
add r8, 0x7fffffff
add r8, 0x78e752ee
xchg rdx, r8
mov rcx, rdx
xchg r8, rdx
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x14007aa5b
inc rcx
mov eax, 0x47f21613
xor eax, 0x1dd66ffa
sub eax, 0x250f0424
add eax, 0xe89c457
add eax, 0x6684dbb
add eax, 0x257d6b1e
sub eax, 0x2ebce24f
sub eax, 0x40c810a4
mul rcx
xchg rcx, r15
mov qword [rbx + 8], r15
xchg rcx, r15
cmovo rax, r8
mov rcx, rax
call fcn.1401fcb08
xchg r15, r8
mov r15, qword [rbx + 8]
xchg r8, r15
xchg rdx, r11
mov r11, rdi
xchg r11, rdx
add r8, r8
mov qword [rbx + 0x10], rax
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call sub.VCRUNTIME140.dll_memcpy
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000ffff
jge 0x14007aaed
dec eax
or eax, 0xffff0000
inc eax
xor edx, edx
mov word [rbx + 2], ax
cmp qword [rbx + 8], rdx
jbe 0x14007ab1b
nop
mov rax, qword [rbx + 0x10]
lea rcx, [rax + rdx*2]
movzx eax, word [rbx + 2]
xor word [rcx], ax
inc rdx
cmp rdx, qword [rbx + 8]
jb 0x14007aaff
mov byte [rbx], 0x6c
sub byte [rbx], 0x3e
xor byte [rbx], 0x2d
add byte [rbx], 0x27
add byte [rbx], 0x2e
xor byte [rbx], 0
sub byte [rbx], 0x49
xor byte [rbx], 0x17
sub byte [rbx], 0x18
mov rax, rbx
xchg r12, rbx
mov r12, qword [rsp + 0x30]
xchg r12, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007b0f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg rdx, r12
mov r12, rcx
xchg r12, rdx
test rax, rax
jne 0x14007b111
xor r8d, r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b153
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b13b
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b11f
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x5b
add byte [rdx], 0x1f
sub byte [rdx], 0x39
sub byte [rdx], 0x38
add byte [rdx], 0x1d
add byte [rdx], 0x19
sub byte [rdx], 9
sub byte [rdx], 0x35
ret
Function at 0x14007b160
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg rdx, r11
mov r11, rcx
xchg r11, rdx
test rax, rax
jne 0x14007b179
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x14007b1bc
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b1aa
xchg rdi, rcx
mov rdi, qword [rdx + 0x10]
xchg rcx, rdi
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b187
xchg r9, rax
mov r9, qword [rdx + 0x10]
xchg r9, rax
mov byte [rdx], 0x2e
xor byte [rdx], 0x45
sub byte [rdx], 9
xor byte [rdx], 0x1b
sub byte [rdx], 0x62
sub byte [rdx], 0x16
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b460
Capabilities:
Encode data using xor

Disassembly:
push r8
mov qword [rsp], rbx
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
xchg r9, rcx
mov rbx, r9
xchg r9, rcx
je 0x14007b4d4
cmp byte [rcx], 0
je 0x14007b4d4
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000ffff
jge 0x14007b495
dec eax
or eax, 0xffff0000
inc eax
xor word [rbx + 2], ax
xor edx, edx
cmp qword [rbx + 8], rdx
jbe 0x14007b4c2
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
lea rcx, [rax + rdx*2]
movzx eax, word [rbx + 2]
xor word [rcx], ax
inc rdx
cmp rdx, qword [rbx + 8]
jb 0x14007b4aa
mov byte [rbx], 0x1c
add byte [rbx], 0x25
add byte [rbx], 0x2b
sub byte [rbx], 0x2b
xor byte [rbx], 0x5a
xor byte [rbx], 0x1b
add rsp, 0x20
nop
xchg qword [rsp], rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b4f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg rcx, rsi
mov rdx, rsi
xchg rsi, rcx
test rax, rax
jne 0x14007b50b
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b55d
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b542
nop dword [rax + rax]
xchg rdi, rax
mov rdi, qword [rdx + 0x10]
xchg rdi, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b51e
xchg rbp, rax
mov rbp, qword [rdx + 0x10]
xchg rbp, rax
mov byte [rdx], 0x1b
add byte [rdx], 0x14
sub byte [rdx], 0x19
xor byte [rdx], 0x35
add byte [rdx], 6
xor byte [rdx], 0xe
add byte [rdx], 0x16
xor byte [rdx], 0x4b
sub byte [rdx], 0x75
ret

Function at 0x14007bdb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 4]
mov rdx, rbx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x76
xor byte [rbx + rax], 0x53
sub byte [rbx + rax], 0x18
xor byte [rbx + rax], 0x41
add byte [rbx + rax], 0x30
sub byte [rbx + rax], 0x14
xor byte [rbx + rax], 0x6b
add byte [rbx + rax], 0x5a
sub byte [rbx + rax], 0x5d
inc rax
cmp rax, 6
jb 0x14007bdda
xchg r14, rax
mov r14, rdi
xchg r14, rax
xchg rdi, rbx
mov rdi, qword [rsp + 0x30]
xchg rbx, rdi
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret
Function at 0x14007be30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbx, rdx
mov qword [rsp + 0x10], rbx
xchg rbx, rdx
nop
push r11
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 6]
mov rdx, rbx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x54
xor byte [rbx + rax], 0x41
add byte [rbx + rax], 0x1d
add byte [rbx + rax], 0x35
sub byte [rbx + rax], 0x60
add byte [rbx + rax], 0x22
sub byte [rbx + rax], 0x29
inc rax
cmp rax, 8
jb 0x14007be63
xchg rdi, rbp
mov rax, rbp
xchg rbp, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007beb0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r8
mov qword [rsp + 8], r8
xchg r8, rbx
mov qword [rsp + 0x10], rdx
nop
push 0x69059973
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 6]
mov rdx, rbx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x2c
add byte [rbx + rax], 0xa
sub byte [rbx + rax], 0x26
xor byte [rbx + rax], 0x12
add byte [rbx + rax], 0x3c
add byte [rbx + rax], 0x33
xor byte [rbx + rax], 0x71
inc rax
cmp rax, 0xa
jb 0x14007bee6
xchg rdi, rbp
mov rax, rbp
xchg rbp, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007bf30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, rdx
mov qword [rsp + 0x10], rbp
xchg rbp, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 8]
mov rdx, rbx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x43
sub byte [rbx + rax], 0x30
xor byte [rbx + rax], 0x3f
add byte [rbx + rax], 0x36
sub byte [rbx + rax], 0xc
xor byte [rbx + rax], 0x56
inc rax
cmp rax, 0xe
jb 0x14007bf60
xchg rbx, rdi
mov rax, rbx
xchg rdi, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rcx
push rdx
push rdx
push rbx
push rbx
push rcx
push rax
xchg qword [rsp + 0x40], rdi
add rsp, 0x48
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007bfb0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r8
mov qword [rsp + 8], r8
xchg r8, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg r14, rdi
mov r14, rcx
xchg rdi, r14
lea rbx, [rdx + 0xa]
mov rdx, rbx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x55
xor byte [rbx + rax], 0x35
sub byte [rbx + rax], 0x52
add byte [rbx + rax], 0x44
add byte [rbx + rax], 0x26
sub byte [rbx + rax], 0x2f
sub byte [rbx + rax], 0x49
inc rax
cmp rax, 0x10
jb 0x14007bfdd
xchg rdi, r10
mov rax, r10
xchg rdi, r10
xchg rbx, r13
mov r13, qword [rsp + 0x30]
xchg rbx, r13
add rsp, 0x20
push rax
push rax
push rbx
push rdx
push rax
push rdx
push rbx
push rcx
xchg qword [rsp + 0x40], rdi
pop rcx
pop rbx
pop rdx
pop rax
pop rdx
pop rbx
pop rax
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c040
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 8], r11
xchg rbx, r11
xchg r13, rdx
mov qword [rsp + 0x10], r13
xchg r13, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, r9
mov rdi, r9
xchg rcx, r9
lea rbx, [rdx + 0xa]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x7a
sub byte [rbx + rax], 0x10
xor byte [rbx + rax], 0x62
xor byte [rbx + rax], 0x7b
sub byte [rbx + rax], 0x36
sub byte [rbx + rax], 0x1a
add byte [rbx + rax], 0x4e
xor byte [rbx + rax], 0x5c
sub byte [rbx + rax], 0x2d
inc rax
cmp rax, 0x12
jb 0x14007c082
mov rax, rdi
xchg rbx, r12
mov r12, qword [rsp + 0x30]
xchg r12, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c0e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
push 0x42d6d529
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x10]
mov rdx, rbx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x43
add byte [rbx + rax], 0x2b
xor byte [rbx + rax], 0x5e
add byte [rbx + rax], 0x3b
sub byte [rbx + rax], 0x5c
xor byte [rbx + rax], 0xf
inc rax
cmp rax, 0x1e
jb 0x14007c110
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg r9, rbx
mov r9, qword [rsp + 0x30]
xchg rbx, r9
add rsp, 0x20
push rdx
push rbx
push rdx
push rcx
xchg qword [rsp + 0x20], rdi
pop rcx
pop rdx
pop rbx
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c170
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rcx
mov qword [rsp + 0x10], rcx
xchg rcx, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x12]
mov rdx, rbx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x6e
sub byte [rbx + rax], 0x29
add byte [rbx + rax], 7
xor byte [rbx + rax], 0x43
sub byte [rbx + rax], 7
xor byte [rbx + rax], 0x11
xor byte [rbx + rax], 0x19
inc rax
cmp rax, 0x20
jb 0x14007c1a6
xchg rbx, rdi
mov rax, rbx
xchg rdi, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c1f0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 8], r14
xchg rbx, r14
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x12]
mov rdx, rbx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0
add byte [rbx + rax], 0x5d
add byte [rbx + rax], 0x14
xor byte [rbx + rax], 0x44
add byte [rbx + rax], 0x1f
sub byte [rbx + rax], 0xb
sub byte [rbx + rax], 0x49
inc rax
cmp rax, 0x22
jb 0x14007c217
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14007c2e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r13
mov qword [rsp + 0x10], r13
xchg rdx, r13
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x14]
mov rdx, rbx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x12
add byte [rbx + rax], 8
add byte [rbx + rax], 9
xor byte [rbx + rax], 0x40
xor byte [rbx + rax], 0x7e
xor byte [rbx + rax], 0x1d
inc rax
cmp rax, 0x26
jb 0x14007c315
xchg r12, rdi
mov rax, r12
xchg rdi, r12
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c360
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x16]
xchg rdx, r15
mov r15, rbx
xchg rdx, r15
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x52
xor byte [rbx + rax], 0x51
xor byte [rbx + rax], 0x47
add byte [rbx + rax], 9
xor byte [rbx + rax], 0xc
sub byte [rbx + rax], 0x12
sub byte [rbx + rax], 0x2d
xor byte [rbx + rax], 2
inc rax
cmp rax, 0x28
jb 0x14007c387
xchg rdx, rdi
mov rax, rdx
xchg rdi, rdx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rbx
push rcx
push rbx
push rdx
push rdx
push rdx
xchg qword [rsp + 0x38], rdi
pop rdx
pop rdx
pop rdx
pop rbx
pop rcx
pop rbx
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c3f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rsi, rdx
mov qword [rsp + 0x10], rsi
xchg rsi, rdx
push rdi
sub rsp, 0x20
xchg rcx, r8
mov rdi, r8
xchg r8, rcx
lea rbx, [rdx + 0x16]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x3d
sub byte [rbx + rax], 5
xor byte [rbx + rax], 0x11
add byte [rbx + rax], 7
add byte [rbx + rax], 0x2c
sub byte [rbx + rax], 0x2a
sub byte [rbx + rax], 0x32
inc rax
cmp rax, 0x2a
jb 0x14007c423
xchg rdx, rdi
mov rax, rdx
xchg rdi, rdx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c470
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rdx, rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x18]
xchg rdx, r15
mov r15, rbx
xchg rdx, r15
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x4f
xor byte [rbx + rax], 0x47
add byte [rbx + rax], 0x56
sub byte [rbx + rax], 0xa
xor byte [rbx + rax], 0x63
sub byte [rbx + rax], 0x2b
add byte [rbx + rax], 0x6f
sub byte [rbx + rax], 0x23
xor byte [rbx + rax], 0x58
inc rax
cmp rax, 0x2e
jb 0x14007c4ac
xchg r13, rax
mov r13, rdi
xchg r13, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14007c500
Capabilities:
Encode data using xor

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg r12, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, r14
mov r14, rcx
xchg r14, rdi
lea rbx, [rdx + 0x1a]
xchg rdx, rsi
mov rsi, rbx
xchg rdx, rsi
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x64
sub byte [rbx + rax], 0x36
sub byte [rbx + rax], 0x2b
xor byte [rbx + rax], 0x77
add byte [rbx + rax], 6
sub byte [rbx + rax], 3
sub byte [rbx + rax], 0x77
inc rax
cmp rax, 0x32
jb 0x14007c533
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c580
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 8], r13
xchg r13, rbx
xchg r11, rdx
mov qword [rsp + 0x10], r11
xchg r11, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdx, rcx
mov rdi, rdx
xchg rdx, rcx
lea rbx, [rdx + 0x1c]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x40
add byte [rbx + rax], 0x1d
sub byte [rbx + rax], 0x55
add byte [rbx + rax], 0x54
xor byte [rbx + rax], 2
xor byte [rbx + rax], 0x12
sub byte [rbx + rax], 0x4c
inc rax
cmp rax, 0x34
jb 0x14007c5c1
xchg r12, rax
mov r12, rdi
xchg r12, rax
xchg rbx, rdi
mov rdi, qword [rsp + 0x30]
xchg rdi, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c610
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x1c]
xchg rbx, r10
mov rdx, r10
xchg r10, rbx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x6f
sub byte [rbx + rax], 0x49
xor byte [rbx + rax], 0x7a
add byte [rbx + rax], 0x11
sub byte [rbx + rax], 0x24
xor byte [rbx + rax], 0x68
xor byte [rbx + rax], 0x35
add byte [rbx + rax], 0x13
sub byte [rbx + rax], 0x27
inc rax
cmp rax, 0x36
jb 0x14007c645
mov rax, rdi
xchg rbx, r12
mov r12, qword [rsp + 0x30]
xchg r12, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c6a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x1e]
mov rdx, rbx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x1b
add byte [rbx + rax], 0
add byte [rbx + rax], 0x31
sub byte [rbx + rax], 0x2b
add byte [rbx + rax], 0x25
sub byte [rbx + rax], 0x20
xor byte [rbx + rax], 0x78
xor byte [rbx + rax], 0x5e
inc rax
cmp rax, 0x38
jb 0x14007c6c7
xchg rdi, r8
mov rax, r8
xchg rdi, r8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rbx
push rdx
push rax
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c720
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg r11, rcx
mov rdi, r11
xchg r11, rcx
lea rbx, [rdx + 0x20]
xchg r12, rdx
mov r12, rbx
xchg r12, rdx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x43
sub byte [rbx + rax], 2
xor byte [rbx + rax], 0x7f
xor byte [rbx + rax], 0x32
add byte [rbx + rax], 0x42
add byte [rbx + rax], 0x1e
xor byte [rbx + rax], 0x3b
xor byte [rbx + rax], 0x57
inc rax
cmp rax, 0x3e
jb 0x14007c74d
xchg rdi, r14
mov rax, r14
xchg rdi, r14
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rdx
push rbx
push rax
push rcx
push rdx
push rbx
push rcx
xchg qword [rsp + 0x40], rdi
pop rcx
pop rbx
pop rdx
pop rcx
pop rax
pop rbx
pop rdx
pop rcx
add rsp, 8
ret

Function at 0x14007c830
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rbx, rdi
xchg rsi, rdx
mov qword [rsp + 0x10], rsi
xchg rsi, rdx
nop
push r10
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x22]
xchg r13, rbx
mov rdx, r13
xchg rbx, r13
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x61
xor byte [rbx + rax], 0x6b
add byte [rbx + rax], 0x45
add byte [rbx + rax], 0x12
sub byte [rbx + rax], 0x3c
add byte [rbx + rax], 0x2d
sub byte [rbx + rax], 0x40
add byte [rbx + rax], 0x5c
xor byte [rbx + rax], 0x6e
inc rax
cmp rax, 0x42
jb 0x14007c869
mov rax, rdi
xchg rbx, r11
mov r11, qword [rsp + 0x30]
xchg r11, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c8c0
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 8], r11
xchg rbx, r11
xchg rdx, r14
mov qword [rsp + 0x10], r14
xchg r14, rdx
push rsi
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x24]
xchg rcx, rdx
mov rcx, rbx
xchg rdx, rcx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0xa
add byte [rbx + rax], 0x63
add byte [rbx + rax], 0x10
xor byte [rbx + rax], 0x54
sub byte [rbx + rax], 0xc
add byte [rbx + rax], 0x47
sub byte [rbx + rax], 0x51
sub byte [rbx + rax], 0x13
inc rax
cmp rax, 0x46
jb 0x14007c8f7
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg r14, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c950
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rcx
mov qword [rsp + 0x10], rcx
xchg rdx, rcx
push rdi
sub rsp, 0x20
xchg rdi, r9
mov r9, rcx
xchg rdi, r9
lea rbx, [rdx + 0x28]
mov rdx, rbx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x24
add byte [rbx + rax], 0x3e
add byte [rbx + rax], 0x18
xor byte [rbx + rax], 0x42
sub byte [rbx + rax], 0x37
add byte [rbx + rax], 0x65
xor byte [rbx + rax], 9
sub byte [rbx + rax], 0x6f
inc rax
cmp rax, 0x4c
jb 0x14007c97d
xchg r11, rax
mov r11, rdi
xchg r11, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]