joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400279b0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rbx, rdi
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x10
xchg rbx, r11
mov r11, rdx
xchg r11, rbx
mov r10, rcx
test r8b, 0xf
je 0x140027a09
xor al, al
xchg r14, rbx
mov r14, qword [rsp + 0x20]
xchg r14, rbx
add rsp, 0x10
push rcx
push rbx
push rbx
push rdx
push rcx
push rbx
push rdx
push rcx
xchg qword [rsp + 0x40], rdi
pop rcx
pop rdx
pop rbx
pop rcx
pop rdx
pop rbx
pop rbx
pop rcx
add rsp, 8
ret
xor edx, edx
test r8d, r8d
je 0x140027ac1
movdqa xmm2, xmmword [rsp]
nop
xchg rdx, r11
movdqu xmm1, xmmword [r11 + rbx]
xchg rdx, r11
test edx, edx
jne 0x140027a3d
xchg r14, r10
movdqu xmm2, xmmword [r14 + 0x200]
xchg r14, r10
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
pxor xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0xfcb34cd
xor ecx, 0x4a91dd62
sub ecx, 0x34c36174
xor ecx, 0x1c3548a
xor ecx, 0x4afd3887
xor ecx, 0x37cdc734
xor ecx, 0x49d10518
xor ecx, 0x25b52617
nop dword [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140027a85
aesdeclast xmm0, xmmword [r10 + 0x1e0]
pxor xmm0, xmm2
movdqa xmm2, xmm1
xchg rcx, rdx
movups xmmword [rcx + r9], xmm0
xchg rdx, rcx
add edx, 0x10
cmp edx, r8d
jb 0x140027a1a
xchg rbx, rbp
mov rbp, qword [rsp + 0x20]
xchg rbp, rbx
mov al, 0x22
add al, 0x2e
sub al, 0x12
xor al, 0x67
sub al, 0x2a
xor al, 0x79
sub al, 0x50
xor al, 7
add rsp, 0x10
push rcx
push rdx
push rcx
push rbx
push rax
xchg qword [rsp + 0x28], rdi
add rsp, 0x30
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140028980
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rcx, rsi
mov qword [rsp + 0x10], rcx
xchg rcx, rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
jne 0x140028a18
nop
mov r8, qword [rbx + 0x10]
xchg rbp, rdx
mov rbp, rdi
xchg rbp, rdx
xchg rsi, r12
mov rcx, r12
xchg rsi, r12
call fcn.140028980
xchg rdx, rbx
mov rcx, rdx
xchg rbx, rdx
mov edx, 0x2c7e6893
xor edx, 0xae8f504
xor edx, 0x4e8498e3
sub edx, 0x289571
sub edx, 0x10224d84
xor edx, 0x2b6c1322
sub edx, 0x5a6c7d5c
sub edx, 0x223eb3d1
mov rbx, qword [rbx]
call fcn.1401fcb70
cmp byte [rbx + 0x19], 0
je 0x1400289b3
mov rbx, qword [rsp + 0x30]
xchg r14, rsi
mov r14, qword [rsp + 0x38]
xchg r14, rsi
add rsp, 0x20
push rdx
push rdx
push rax
push rdx
push rbx
push rcx
push rdx
xchg qword [rsp + 0x38], rdi
pop rdx
pop rcx
pop rbx
pop rdx
pop rax
pop rdx
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140029910
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rbx
mov qword [rsp + 8], r15
xchg r15, rbx
nop
push r12
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rsi
mov rsi, rcx
xchg rsi, rdi
xor ebx, ebx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x140029995
mov rdx, qword [rdi + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x14002997e
mov r8, qword [rcx - 8]
neg rdx
add rdx, 0xffffffffffffffd9
neg rdx
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140029a63
xchg rcx, r12
mov r12, r8
xchg rcx, r12
call fcn.1401fcb70
xchg rbx, rcx
mov qword [rdi + 0x18], rcx
xchg rcx, rbx
mov qword [rdi + 0x20], rbx
mov qword [rdi + 0x28], rbx
mov rcx, qword [rdi + 8]
xchg r8, rax
mov r8, qword [rcx + 8]
xchg r8, rax
mov qword [rax], rbx
mov rcx, qword [rcx]
test rcx, rcx
je 0x140029a0d
nop dword [rax + rax]
xchg rbx, r10
mov r10, qword [rcx]
xchg rbx, r10
mov edx, 0x6d95916c
xor edx, 0xd45be1b
xor edx, 0xe66be96
sub edx, 0x441284b8
add edx, 0x384bc2e6
xor edx, 0x1ddcd74b
sub edx, 0x773e38ad
xor edx, 0x70813d8e
xor edx, 0x7775f301
call fcn.1401fcb70
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
test rbx, rbx
jne 0x1400299b8
xchg rcx, r10
mov r10, qword [rdi + 8]
xchg rcx, r10
mov edx, 0x2ff7ea8e
add edx, 0x247af732
xor edx, 0x5f6b89db
xor edx, 0x1ec0a4f6
add edx, 0x672256e9
xor edx, 0x5822a9dd
add edx, 0x338ddcbe
sub edx, 0x221b5566
sub edx, 0x3651114b
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
jmp fcn.1401fcb70
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14002ca50
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
xchg rbx, rcx
mov qword [rsp + 0x10], rcx
xchg rcx, rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
nop
sub rsp, 8
mov qword [rsp], r14
sub rsp, 0x30
mov rsi, rcx
mov rax, qword gs:[0x30]
xchg rdi, r9
mov r9, qword [rax + 0x60]
xchg rdi, r9
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
mov qword [rsp + 0x40], rbx
sub rcx, 0x17d40c76
add rcx, 0x17d40d3e
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x26c5f7e0
xor dword [rsp + 0x20], 0x19192f83
sub dword [rsp + 0x20], 0x15cc66f9
sub dword [rsp + 0x20], 0x2999ff9d
add dword [rsp + 0x20], 0x726dff96
sub dword [rsp + 0x20], 0x72e4715b
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002b6f0
test eax, eax
js 0x14002cb07
cmp qword [rsp + 0x40], rbx
je 0x14002cb07
lea eax, [rbx + 1]
jmp 0x14002cc4f
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0x70], 2
jbe 0x14002cb4b
mov eax, 0x59dfca90
sub eax, 0x52d94ca6
add eax, 0x3b2dff1b
xor eax, 0x4e348d1
xor eax, 0x72d8d666
sub eax, 0x1ade0999
add eax, 0x63de0765
xor eax, 0x7d0fe17c
jmp 0x14002cc4f
cmp dword [rcx + 0x74], ebx
jbe 0x14002cb86
mov eax, 0x70824c5a
sub eax, 0x4c7909fe
add eax, 0x408ccb6e
xor eax, 0x1f737343
xor eax, 0x54717c83
sub eax, 0x261a9945
add eax, 0xa4c5d60
xor eax, 0x3c0f714e
sub eax, 0x2fcab768
jmp 0x14002cc4f
cmp byte [rdi + 2], bl
je 0x14002cbb7
mov eax, 0x3069125e
sub eax, 0x2313d9ae
add eax, 0x17bcad16
xor eax, 0x4b2ed235
sub eax, 0x19d9835d
sub eax, 0x52a688bf
sub eax, 0x1bf2bd3
jmp 0x14002cc4f
cmp r14d, 0xa
jb 0x14002cc08
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002cc08
mov eax, 0x404f3891
sub eax, 0x2f2b8bdb
add eax, 0x66c79314
xor eax, 0x10a7257a
sub eax, 0x606a7d89
add eax, 0x2630339b
sub eax, 0x167fc500
xor eax, 0x916498f
xor eax, 0x1f844245
jmp 0x14002cc4f
lea rcx, [rsi + 0xb8]
mov edx, 0x29e22791
add edx, 0x32166f13
xor edx, 0x46036bad
add edx, 0x42e97741
xor edx, 0x5e087d78
add edx, 0x1a36d732
add edx, 0x3bace8d
add edx, 0x3cbaeaa8
call fcn.14002c020
jmp 0x14002cc4d
mov eax, ebx
xchg r15, rbx
mov r15, qword [rsp + 0x48]
xchg rbx, r15
xchg rsi, r9
mov r9, qword [rsp + 0x50]
xchg rsi, r9
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14002da30
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
cmp byte [rcx + 6], 0
je 0x14002da54
xor eax, eax
add rsp, 0x20
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret
cmp byte [rcx + 1], 0
je 0x14002da9d
mov eax, 0x748f86ad
sub eax, 0x25ab631c
sub eax, 0x8898396
add eax, 0x1be953c1
sub eax, 0x3400d74a
sub eax, 0x1a7e35df
xor eax, 0x3931d79d
xor eax, 0x2af5310d
add rsp, 0x20
nop
add rsp, 8
mov rbx, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
je 0x14002dae0
mov eax, 0x9337188
xor eax, 0x591b6858
sub eax, 0x19e8344
sub eax, 0x199452ca
xor eax, 0x30d0070e
add eax, 0x4d3e7e9c
xor eax, 0x5163c36c
add rsp, 0x20
nop
add rsp, 8
mov rbx, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx + 4], 0
je 0x14002db21
mov eax, 0x25a201fd
sub eax, 0x13955b8d
add eax, 0x399847a3
add eax, 0x13682d07
sub eax, 0x1637d4ca
sub eax, 0x148a45b0
sub eax, 0xf162ad
sub eax, 0x33599dec
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rbx
ret
mov edx, 0xacd1b34
xor edx, 0x186b967a
add edx, 0x3aa98636
xor edx, 0x593899a1
xor edx, 0x11e25292
add edx, 0x27a696e2
sub edx, 0x2d316f95
mov ecx, dword [rcx + 0xc]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
int3
Function at 0x140033c50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
nop
push r14
mov qword [rsp], rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg rbx, r8
mov r8, rbx
xchg rbx, r8
xchg rsi, r11
mov r11, rdx
xchg rsi, r11
mov rbp, rcx
jne 0x140033d18
xchg rdi, r8
mov qword [rsp + 0x30], r8
xchg r8, rdi
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 0x10]
mov rdx, rsi
xchg rcx, r8
mov r8, rbp
xchg rcx, r8
call fcn.140033c50
xchg r10, rbx
mov rdi, r10
xchg rbx, r10
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004cf00
mov edx, 0x21236632
add edx, 0x5ce75da5
xor edx, 0x52611911
xor edx, 0x4613783c
sub edx, 0x2e8cc382
add edx, 0xf6f48f8
xor edx, 0x79473216
xor edx, 0x1119b46a
sub edx, 0x2305adbc
mov rcx, rdi
call fcn.1401fcb70
cmp byte [rbx + 0x19], 0
je 0x140033c9c
xchg rdi, r12
mov r12, qword [rsp + 0x30]
xchg rdi, r12
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140035970
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
nop
sub rsp, 8
mov qword [rsp], rbx
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
nop
push 0x6a1725c0
mov qword [rsp], r13
nop
sub rsp, 8
mov qword [rsp], r14
push r15
sub rsp, 0x30
xchg rsi, rdx
mov r15, rsi
xchg rsi, rdx
xchg r14, rcx
mov rcx, r14
xchg rcx, r14
movabs rsi, 0xfffffff1511077f
xor rsi, 0x79f6c772
sub rsi, 0x47a5854a
xor rsi, 0x39e21798
add rsi, 0x12e463b4
add rsi, 0xe30f3a
add rsi, 0x7fffffff
add rsi, 0x4f985fb7
cmp rdx, rsi
ja 0x140035bba
xchg r15, r12
mov r15, qword [rcx + 8]
xchg r15, r12
sub r12, qword [rcx]
sar r12, 3
sar r12, 1
mov rcx, qword [rcx + 0x10]
sub rcx, qword [r14]
sar rcx, 1
sar rcx, 3
xchg rcx, r14
mov rdx, r14
xchg r14, rcx
shr rdx, 1
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
sub rax, rdx
cmp rcx, rax
ja 0x140035a4f
lea rsi, [rdx + rcx]
cmp rsi, r15
cmovb rsi, r15
mov qword [rsp + 0x88], rsi
xchg rdx, r13
mov r13, rsi
xchg r13, rdx
xchg r14, rdx
mov rcx, rdx
xchg rdx, r14
call fcn.140053ab0
xchg r13, rax
mov rax, r13
xchg r13, rax
mov qword [rsp + 0x28], rax
xchg r12, rbx
mov r12, rbx
xchg rbx, r12
shl rbx, 4
add rbx, rax
xchg r12, rbx
mov qword [rsp + 0x20], r12
xchg rbx, r12
mov rdi, r15
sub rdi, r12
xchg rbx, r11
mov qword [rsp + 0x78], r11
xchg r11, rbx
je 0x140035af6
nop word [rax + rax]
mov byte [rbx], 0xf
xor byte [rbx], 0x19
xor byte [rbx], 0x35
xor byte [rbx], 0x6e
xor byte [rbx], 0x39
sub byte [rbx], 0x29
xor byte [rbx], 0x50
add byte [rbx], 0x14
sub byte [rbx], 0x2f
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004bcf0
nop
sub rbx, 0xfffffffffffffff0
xchg rbx, r11
mov qword [rsp + 0x78], r11
xchg rbx, r11
sub rdi, 1
jne 0x140035ab6
xchg rbx, r8
mov rbx, qword [r14 + 8]
xchg r8, rbx
xchg rdx, r12
mov r12, r13
xchg rdx, r12
xchg rdx, rcx
mov rdx, qword [r14]
xchg rdx, rcx
cmp rcx, r8
je 0x140035b4e
xor r9d, r9d
movzx eax, byte [rcx]
mov byte [rdx], al
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov byte [rcx], r9b
mov qword [rcx + 8], r9
lea rdx, [rdx + 0x10]
nop
add rcx, 0x2b66f75d
sub rcx, 0x2b66f74d
cmp rcx, r8
jne 0x140035b1e
mov r9, rsi
xchg r8, r11
mov r11, r15
xchg r8, r11
xchg rbp, rdx
mov rbp, r13
xchg rdx, rbp
xchg r14, r13
mov rcx, r13
xchg r13, r14
add rsp, 0x30
nop
add rsp, 8
xchg qword [rsp - 8], r15
nop
add rsp, 8
xchg qword [rsp - 8], r14
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
mov rbx, qword [rsp]
add rsp, 8
jmp fcn.140052be0
call fcn.14002f850
int3
Function at 0x140035c30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x140035c86
nop word [rax + rax]
mov byte [rbx], 0x52
sub byte [rbx], 0x2b
xor byte [rbx], 0x67
xor byte [rbx], 0x6e
add byte [rbx], 7
xor byte [rbx], 0x62
sub byte [rbx], 0x57
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004bcf0
nop
nop
sub rbx, 0x7155df01
add rbx, 0x7155df11
sub rdi, 1
jne 0x140035c50
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
xchg rdx, rbx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14004c4a0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x36
add byte [rcx + rax + 6], 0x43
sub byte [rcx + rax + 6], 0x37
xor byte [rcx + rax + 6], 0x44
xor byte [rcx + rax + 6], 0x68
xor byte [rcx + rax + 6], 0x42
add byte [rcx + rax + 6], 0x3b
add byte [rcx + rax + 6], 0x11
xor byte [rcx + rax + 6], 0x78
inc rax
cmp rax, 8
jb 0x14004c4a2
ret

Function at 0x14004c4e0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x5b
sub byte [rcx + rax + 6], 0x57
xor byte [rcx + rax + 6], 0x41
sub byte [rcx + rax + 6], 7
add byte [rcx + rax + 6], 0x3c
xor byte [rcx + rax + 6], 0xf
sub byte [rcx + rax + 6], 0x65
add byte [rcx + rax + 6], 0x47
sub byte [rcx + rax + 6], 0x57
inc rax
cmp rax, 0xa
jb 0x14004c4e2
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140076680
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
mov r8d, 0x29f976f3
xor r8d, 0x151c8227
sub r8d, 0x153aea31
sub r8d, 0x3d0dc00
sub r8d, 0x10cac27d
sub r8d, 0x12f3de72
add r8d, 0xffe4724b
test rcx, rcx
je 0x140076797
cmp byte [rcx], 0
je 0x140076797
test rdx, rdx
jne 0x14007672f
nop
movabs rdx, 0xffffffff0d8fafb6
add rdx, 0x2ffde4ea
sub rdx, 0xc26e618
sub rdx, 0x9253b65
sub rdx, 0x18a3103b
xor rdx, 0x1b61bfea
add rdx, 0x3186ac8a
add rdx, 0x779e6e6
add rdx, 0x7fffffff
add rdx, 0x31ff8f8e
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x140076719
test rdx, rdx
je 0x140076794
xor r10d, r10d
lea r11, [0x140002dd0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
or rcx, qword [rsp]
add rsp, 0x10
shr r8d, 8
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x140076741
not r8d
mov eax, r8d
ret
Function at 0x14007af20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xchg rdi, r13
mov r13, rdx
xchg rdi, r13
xchg rcx, r10
mov rbx, r10
xchg r10, rcx
test rdx, rdx
jne 0x14007af6b
xchg rdx, rsi
mov qword [rcx + 0x10], rsi
xchg rsi, rdx
xchg r15, rax
mov r15, rcx
xchg r15, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
xchg qword [rsp + 8], rdi
pop rbx
add rsp, 8
ret
nop
movabs r8, 0xffffffff45f5365e
sub r8, 0x2053e3b8
add r8, 0x175ac4b7
xor r8, 0x58572ea8
xor r8, 0x1fa0ca2a
add r8, 0x7fffffff
xor r8, 0x4f40c21
xchg r13, rcx
mov r13, r8
xchg r13, rcx
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x14007afa9
inc rcx
mov eax, 0x10a9b3b9
sub eax, 0xd64b91a
add eax, 0x423c33ab
xor eax, 0x544743c6
xor eax, 0x73262105
sub eax, 0x2b536394
sub eax, 0x334fc4f9
xor eax, 0x4721a708
xor eax, 0x431c84f6
mul rcx
xchg r8, rcx
mov qword [rbx + 8], r8
xchg r8, rcx
cmovo rax, r8
xchg r14, rax
mov rcx, r14
xchg r14, rax
call fcn.1401fcb78
mov r8, qword [rbx + 8]
mov rdx, rdi
add r8, r8
xchg rcx, rax
mov qword [rbx + 0x10], rcx
xchg rcx, rax
xchg r8, rax
mov rcx, r8
xchg r8, rax
call sub.VCRUNTIME140.dll_memcpy
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000ffff
jge 0x14007b03c
dec eax
or eax, 0xffff0000
inc eax
xor edx, edx
mov word [rbx + 2], ax
cmp qword [rbx + 8], rdx
jbe 0x14007b06a
nop
mov rax, qword [rbx + 0x10]
lea rcx, [rax + rdx*2]
movzx eax, word [rbx + 2]
xor word [rcx], ax
inc rdx
cmp rdx, qword [rbx + 8]
jb 0x14007b04e
mov byte [rbx], 0x55
sub byte [rbx], 0x45
xor byte [rbx], 0x45
sub byte [rbx], 0x46
add byte [rbx], 0x66
xor byte [rbx], 6
sub byte [rbx], 0x24
xor byte [rbx], 0x4f
xchg r9, rbx
mov rax, r9
xchg r9, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007b670
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rax
mov r13, qword [rcx + 0x10]
xchg r13, rax
xchg rdx, rcx
mov rcx, rdx
xchg rcx, rdx
test rax, rax
jne 0x14007b695
xor r8d, r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b6d8
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b6c3
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b6a3
xchg r9, rax
mov r9, qword [rdx + 0x10]
xchg r9, rax
mov byte [rdx], 0x64
sub byte [rdx], 0x46
add byte [rdx], 0x22
add byte [rdx], 0x14
sub byte [rdx], 0x1e
add byte [rdx], 0x3e
xor byte [rdx], 0x75
ret

Function at 0x14007b6e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg rdx, rcx
mov rcx, rdx
xchg rcx, rdx
test rax, rax
jne 0x14007b701
xor r8d, r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b744
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b72c
mov rcx, qword [rdx + 0x10]
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b70f
xchg rsi, rax
mov rsi, qword [rdx + 0x10]
xchg rsi, rax
mov byte [rdx], 0x3a
xor byte [rdx], 0x3d
xor byte [rdx], 0x41
add byte [rdx], 0
xor byte [rdx], 0x1d
xor byte [rdx], 0x4f
sub byte [rdx], 0xf
xor byte [rdx], 4
ret
Function at 0x14007ba70
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rax
mov r11, qword [rcx + 0x10]
xchg r11, rax
mov rdx, rcx
test rax, rax
jne 0x14007ba81
ret
cmp byte [rcx], 0
jne 0x14007bacf
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007bab4
nop dword [rax + rax]
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007ba94
xchg rbp, rax
mov rbp, qword [rdx + 0x10]
xchg rbp, rax
mov byte [rdx], 0x48
sub byte [rdx], 0x2a
xor byte [rdx], 0x43
xor byte [rdx], 0x7a
add byte [rdx], 0x29
xor byte [rdx], 0x3f
xor byte [rdx], 0x39
add byte [rdx], 9
sub byte [rdx], 0x5e
ret

Function at 0x14007c300
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg rbx, r11
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r10, rcx
mov rdi, r10
xchg rcx, r10
lea rbx, [rdx + 4]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007af20
nop
xor eax, eax
mov byte [rbx + rax], 0x25
xor byte [rbx + rax], 1
xor byte [rbx + rax], 0x4c
sub byte [rbx + rax], 0x35
add byte [rbx + rax], 0x16
xor byte [rbx + rax], 0x6f
sub byte [rbx + rax], 0x26
inc rax
cmp rax, 6
jb 0x14007c33c
xchg r11, rax
mov r11, rdi
xchg r11, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c390
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rbx, rcx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 6]
xchg rdx, r11
mov r11, rbx
xchg rdx, r11
call fcn.14007af20
nop
xor eax, eax
mov byte [rbx + rax], 0x2d
add byte [rbx + rax], 0xa
sub byte [rbx + rax], 0x22
add byte [rbx + rax], 0x16
sub byte [rbx + rax], 0x18
xor byte [rbx + rax], 0x13
inc rax
cmp rax, 8
jb 0x14007c3c5
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c410
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rdx
mov rdx, rcx
xchg rdx, rdi
lea rbx, [rdx + 6]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007af20
nop
xor eax, eax
mov byte [rbx + rax], 0x78
add byte [rbx + rax], 1
xor byte [rbx + rax], 0x10
sub byte [rbx + rax], 0x16
add byte [rbx + rax], 0x26
sub byte [rbx + rax], 0x39
xor byte [rbx + rax], 0x40
inc rax
cmp rax, 0xa
jb 0x14007c446
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rcx
push rdx
push rax
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c490
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rdi, rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 8]
xchg rbx, r10
mov rdx, r10
xchg rbx, r10
call fcn.14007af20
nop
xor eax, eax
mov byte [rbx + rax], 0x5e
sub byte [rbx + rax], 0x25
xor byte [rbx + rax], 0x7b
add byte [rbx + rax], 9
xor byte [rbx + rax], 0x1d
sub byte [rbx + rax], 0x37
add byte [rbx + rax], 0x37
sub byte [rbx + rax], 0x23
sub byte [rbx + rax], 0x33
inc rax
cmp rax, 0xe
jb 0x14007c4cc
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, r8
mov r8, qword [rsp + 0x30]
xchg rbx, r8
add rsp, 0x20
push rax
push rax
push rax
push rcx
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
ret

Function at 0x14007c520
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xa]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007af20
nop
xor eax, eax
mov byte [rbx + rax], 0x14
add byte [rbx + rax], 0x31
xor byte [rbx + rax], 0x1b
sub byte [rbx + rax], 0x36
sub byte [rbx + rax], 0xc
add byte [rbx + rax], 0x55
sub byte [rbx + rax], 0x71
inc rax
cmp rax, 0x10
jb 0x14007c54f
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rax
xchg qword [rsp + 0x10], rdi
pop rax
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c5a0
Capabilities:
Encode data using xor

Disassembly:
xchg r10, rbx
mov qword [rsp + 8], r10
xchg r10, rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, r8
mov rdi, r8
xchg r8, rcx
lea rbx, [rdx + 0xa]
mov rdx, rbx
call fcn.14007af20
nop
xor eax, eax
mov byte [rbx + rax], 0x1b
xor byte [rbx + rax], 0x23
add byte [rbx + rax], 0x2d
add byte [rbx + rax], 0xa
sub byte [rbx + rax], 0x55
xor byte [rbx + rax], 0x23
sub byte [rbx + rax], 0x22
add byte [rbx + rax], 0x5e
sub byte [rbx + rax], 0x75
inc rax
cmp rax, 0x12
jb 0x14007c5d6
xchg rdx, rax
mov rdx, rdi
xchg rdx, rax
xchg rbx, rbp
mov rbp, qword [rsp + 0x30]
xchg rbp, rbx
add rsp, 0x20
push rcx
push rbx
xchg qword [rsp + 0x10], rdi
pop rbx
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c630
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rbx
mov qword [rsp + 8], rbp
xchg rbp, rbx
xchg rcx, rdx
mov qword [rsp + 0x10], rcx
xchg rdx, rcx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x10]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007af20
nop
xor eax, eax
mov byte [rbx + rax], 0xa
add byte [rbx + rax], 0x70
sub byte [rbx + rax], 0x66
xor byte [rbx + rax], 0x1e
xor byte [rbx + rax], 0x2b
add byte [rbx + rax], 0x16
sub byte [rbx + rax], 0x24
xor byte [rbx + rax], 0x23
xor byte [rbx + rax], 0x30
inc rax
cmp rax, 0x1e
jb 0x14007c66b
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret