joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007cd90
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 8], r15
xchg r15, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x2a]
xchg r13, rbx
mov rdx, r13
xchg rbx, r13
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x27
add byte [rbx + rax], 0x4d
sub byte [rbx + rax], 0x2f
add byte [rbx + rax], 0x2a
xor byte [rbx + rax], 0x69
sub byte [rbx + rax], 3
sub byte [rbx + rax], 3
inc rax
cmp rax, 0x52
jb 0x14007cdc3
mov rax, rdi
xchg rbx, r9
mov r9, qword [rsp + 0x30]
xchg r9, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007ce10
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
xchg r9, rbx
mov qword [rsp + 8], r9
xchg rbx, r9
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x2c]
mov rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x65
sub byte [rbx + rax], 0x36
xor byte [rbx + rax], 0x70
add byte [rbx + rax], 0x15
sub byte [rbx + rax], 0x18
xor byte [rbx + rax], 0x6d
xor byte [rbx + rax], 0x5c
sub byte [rbx + rax], 0x35
sub byte [rbx + rax], 0x38
inc rax
cmp rax, 0x54
jb 0x14007ce37
xchg r15, rdi
mov rax, r15
xchg rdi, r15
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007ce90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r15, rdi
mov r15, rcx
xchg rdi, r15
lea rbx, [rdx + 0x2e]
xchg r11, rbx
mov rdx, r11
xchg rbx, r11
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], reloc.SHLWAPI.dll_SHCreateMemStream
add byte [rbx + rax], 0x1e
sub byte [rbx + rax], 0x1b
add byte [rbx + rax], 0x47
sub byte [rbx + rax], 0xb
xor byte [rbx + rax], 0x55
xor byte [rbx + rax], 0x5e
sub byte [rbx + rax], 0x40
inc rax
cmp rax, 0x58
jb 0x14007cec5
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cf20
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg r11, rbx
xchg rbp, rdx
mov qword [rsp + 0x10], rbp
xchg rdx, rbp
nop
push r8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x2e]
xchg rdx, r12
mov r12, rbx
xchg rdx, r12
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x61
xor byte [rbx + rax], 0x33
xor byte [rbx + rax], 0x23
sub byte [rbx + rax], 0x34
add byte [rbx + rax], 0x14
xor byte [rbx + rax], 0x24
xor byte [rbx + rax], 0x5e
sub byte [rbx + rax], 0x2b
inc rax
cmp rax, 0x5a
jb 0x14007cf5f
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007cfb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rdi
mov qword [rsp + 0x10], rdi
xchg rdx, rdi
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x30]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x12
sub byte [rbx + rax], 0xe
add byte [rbx + rax], 0x2c
xor byte [rbx + rax], 0
sub byte [rbx + rax], 0xf
add byte [rbx + rax], 8
sub byte [rbx + rax], 0x22
sub byte [rbx + rax], 7
inc rax
cmp rax, 0x5c
jb 0x14007cfe3
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x14007d030
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rdi, rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x30]
mov rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 3
xor byte [rbx + rax], 0x2d
sub byte [rbx + rax], 0x1f
add byte [rbx + rax], 0x6d
xor byte [rbx + rax], 0x64
add byte [rbx + rax], 0x3a
sub byte [rbx + rax], 0x52
inc rax
cmp rax, 0x5e
jb 0x14007d060
xchg r14, rax
mov r14, rdi
xchg r14, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d0b0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg rbx, r11
xchg rdx, rsi
mov qword [rsp + 0x10], rsi
xchg rdx, rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r11, rcx
mov rdi, r11
xchg r11, rcx
lea rbx, [rdx + 0x32]
xchg rbx, r9
mov rdx, r9
xchg r9, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x10
add byte [rbx + rax], 0x17
sub byte [rbx + rax], 4
xor byte [rbx + rax], 0x33
xor byte [rbx + rax], 0xa
add byte [rbx + rax], 0x45
sub byte [rbx + rax], 0x4e
xor byte [rbx + rax], 0x61
sub byte [rbx + rax], 0x70
inc rax
cmp rax, 0x60
jb 0x14007d0f2
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rdx, rbx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
add rsp, 0x20
push rdx
xchg qword [rsp + 8], rdi
add rsp, 0x10
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d150
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r13, rdx
mov qword [rsp + 0x10], r13
xchg rdx, r13
push rbx
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdx, rcx
mov rdi, rdx
xchg rcx, rdx
lea rbx, [rdx + 0x34]
mov rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x15
xor byte [rbx + rax], 1
add byte [rbx + rax], 0x13
xor byte [rbx + rax], 0x1f
add byte [rbx + rax], 0x41
xor byte [rbx + rax], 0x79
inc rax
cmp rax, 0x64
jb 0x14007d181
xchg r14, rdi
mov rax, r14
xchg rdi, r14
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d1d0
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rbx
mov qword [rsp + 8], rdx
xchg rdx, rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r14, rdi
mov r14, rcx
xchg rdi, r14
lea rbx, [rdx + 0x38]
mov rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x3a
sub byte [rbx + rax], 0x2a
add byte [rbx + rax], 0x42
xor byte [rbx + rax], 0x32
sub byte [rbx + rax], 0x3b
add byte [rbx + rax], 0x14
add byte [rbx + rax], 0x2f
sub byte [rbx + rax], 0x20
sub byte [rbx + rax], 0x48
inc rax
cmp rax, 0x6e
jb 0x14007d205
xchg r10, rax
mov r10, rdi
xchg r10, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d260
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r10
mov qword [rsp + 0x10], r10
xchg rdx, r10
push rdi
sub rsp, 0x20
xchg r9, rcx
mov rdi, r9
xchg r9, rcx
lea rbx, [rdx + 0x4e]
mov rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x15
add byte [rbx + rax], 0x15
add byte [rbx + rax], 0x4f
sub byte [rbx + rax], 0x68
add byte [rbx + rax], 0x60
xor byte [rbx + rax], 0x33
xor byte [rbx + rax], 0x24
xor byte [rbx + rax], 0x4f
sub byte [rbx + rax], 0x29
inc rax
cmp rax, 0x98
jb 0x14007d28d
xchg r13, rax
mov r13, rdi
xchg r13, rax
xchg rbx, rcx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x14007d2e0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg r12, rbx
xchg rdx, r9
mov qword [rsp + 0x10], r9
xchg rdx, r9
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rdx
mov rdx, rcx
xchg rdi, rdx
lea rbx, [rdx + 0x56]
xchg r8, rbx
mov rdx, r8
xchg r8, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x4f
sub byte [rbx + rax], 0x1f
xor byte [rbx + rax], 0x61
xor byte [rbx + rax], 0x15
sub byte [rbx + rax], 4
sub byte [rbx + rax], 0x40
inc rax
cmp rax, 0xa8
jb 0x14007d322
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg r8, rbx
mov r8, qword [rsp + 0x30]
xchg r8, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d370
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rbx, rdx
xchg r8, rdx
mov qword [rsp + 0x10], r8
xchg r8, rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x5a]
mov rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x45
sub byte [rbx + rax], 0x3e
add byte [rbx + rax], 0x1e
xor byte [rbx + rax], 0x6d
sub byte [rbx + rax], 0x25
add byte [rbx + rax], 1
xor byte [rbx + rax], 0x4e
sub byte [rbx + rax], 0x6a
inc rax
cmp rax, 0xb0
jb 0x14007d3a3
xchg rdi, r14
mov rax, r14
xchg rdi, r14
xchg r8, rbx
mov r8, qword [rsp + 0x30]
xchg r8, rbx
add rsp, 0x20
push rdx
push rdx
push rbx
push rdx
push rbx
push rbx
push rbx
push rcx
xchg qword [rsp + 0x40], rdi
add rsp, 0x48
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d400
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
push 0x24f3a90b
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x70]
xchg rbx, r15
mov rdx, r15
xchg r15, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 3
add byte [rbx + rax], 0x6a
sub byte [rbx + rax], 0x6a
add byte [rbx + rax], 0x23
xor byte [rbx + rax], 0x41
xor byte [rbx + rax], 0x67
inc rax
cmp rax, 0xdc
jb 0x14007d430
xchg rdi, r15
mov rax, r15
xchg rdi, r15
xchg rbx, r10
mov r10, qword [rsp + 0x30]
xchg r10, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d480
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r12
mov qword [rsp + 0x10], r12
xchg r12, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x70]
xchg rcx, rdx
mov rcx, rbx
xchg rcx, rdx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x2e
sub byte [rbx + rax], 0x23
add byte [rbx + rax], 6
xor byte [rbx + rax], 0x27
add byte [rbx + rax], 0xb
add byte [rbx + rax], 0x13
sub byte [rbx + rax], 0x54
inc rax
cmp rax, 0xde
jb 0x14007d4b5
xchg r12, rdi
mov rax, r12
xchg r12, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d500
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg rbx, r12
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdx, rcx
mov rdi, rdx
xchg rdx, rcx
lea rbx, [rdx + 0x76]
xchg rbp, rdx
mov rbp, rbx
xchg rdx, rbp
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x12
xor byte [rbx + rax], 0x6e
sub byte [rbx + rax], 6
xor byte [rbx + rax], 0x2e
xor byte [rbx + rax], 0x72
xor byte [rbx + rax], 0x27
add byte [rbx + rax], 0x6c
sub byte [rbx + rax], 0xc
sub byte [rbx + rax], 0x6d
inc rax
cmp rax, 0xea
jb 0x14007d53c
xchg rdi, r10
mov rax, r10
xchg rdi, r10
xchg rbx, r12
mov r12, qword [rsp + 0x30]
xchg r12, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d5a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rdi
mov qword [rsp + 0x10], rdi
xchg rdi, rdx
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x7c]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0xf
add byte [rbx + rax], 0x69
sub byte [rbx + rax], 0x11
sub byte [rbx + rax], 0x29
add byte [rbx + rax], 0x3a
xor byte [rbx + rax], 0x78
inc rax
cmp rax, 0xf4
jb 0x14007d5d3
xchg r8, rdi
mov rax, r8
xchg r8, rdi
xchg rbx, r8
mov r8, qword [rsp + 0x30]
xchg r8, rbx
add rsp, 0x20
push rdx
push rdx
push rcx
push rbx
push rax
push rax
push rbx
xchg qword [rsp + 0x38], rdi
add rsp, 0x40
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d6c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rdi
mov qword [rsp + 0x10], rdi
xchg rdi, rdx
push rdi
sub rsp, 0x20
xchg rdx, rcx
mov rdi, rdx
xchg rcx, rdx
lea rbx, [rdx + 0xc]
xchg r11, rdx
mov r11, rbx
xchg rdx, r11
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x38
xor byte [rbx + rax], 4
add byte [rbx + rax], 0x3f
xor byte [rbx + rax], 0x67
xor byte [rbx + rax], 0x53
sub byte [rbx + rax], 0x34
add byte [rbx + rax], 0x21
sub byte [rbx + rax], 0x3c
inc rax
cmp rax, 0x14
jb 0x14007d6f3
xchg rbp, rax
mov rbp, rdi
xchg rbp, rax
xchg rbx, r12
mov r12, qword [rsp + 0x30]
xchg rbx, r12
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d750
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rcx, rdx
mov qword [rsp + 0x10], rcx
xchg rdx, rcx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xe]
xchg rbx, r8
mov rdx, r8
xchg rbx, r8
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 0x44
xor byte [rbx + rax], 0x78
add byte [rbx + rax], 0x19
sub byte [rbx + rax], 0x2f
add byte [rbx + rax], 0x2d
sub byte [rbx + rax], 0x16
sub byte [rbx + rax], 0x3d
inc rax
cmp rax, 0x18
jb 0x14007d785
xchg r15, rax
mov r15, rdi
xchg r15, rax
xchg rbx, r13
mov r13, qword [rsp + 0x30]
xchg rbx, r13
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007d7d0
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rbx, rsi
mov qword [rsp + 0x10], rdx
nop
push r8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xe]
mov rdx, rbx
call fcn.14007ac50
nop
xor eax, eax
mov byte [rbx + rax], 8
add byte [rbx + rax], 0x52
xor byte [rbx + rax], 0x69
xor byte [rbx + rax], 0x6c
xor byte [rbx + rax], 0x12
add byte [rbx + rax], 0x10
xor byte [rbx + rax], 0x5d
inc rax
cmp rax, 0x1a
jb 0x14007d7fd
xchg rdi, rcx
mov rax, rcx
xchg rcx, rdi
xchg rbx, rbp
mov rbp, qword [rsp + 0x30]
xchg rbp, rbx
add rsp, 0x20
push rcx
push rax
push rax
push rcx
push rdx
push rcx
xchg qword [rsp + 0x30], rdi
add rsp, 0x38
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140081280
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rbx
mov qword [rsp + 0x10], rdx
xchg rdx, rbx
mov qword [rsp + 0x18], rbp
nop
push r11
mov qword [rsp], rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
mov rbx, r8
mov rsi, rdx
xchg rcx, rbp
mov rcx, rbp
xchg rcx, rbp
jne 0x140081348
xchg r9, rdi
mov qword [rsp + 0x30], r9
xchg rdi, r9
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 0x10]
xchg r9, rsi
mov rdx, r9
xchg r9, rsi
mov rcx, rbp
call fcn.140081280
xchg r12, rbx
mov rdi, r12
xchg r12, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x28]
call fcn.140091940
mov edx, 0x5216b94c
xor edx, 0x10c5b13b
add edx, 0x3751eef
xor edx, 0x6e5c278
xor edx, 0x680787dc
add edx, 0x2d08dd5
sub edx, 0x4adc1e7
xor edx, 0x6900846f
sub edx, 0x4fcdaa47
xchg rcx, rdx
mov rdx, rdi
xchg rdx, rcx
call fcn.1401fccd8
cmp byte [rbx + 0x19], 0
je 0x1400812cc
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
xchg rbp, r8
mov r8, qword [rsp + 0x40]
xchg rbp, r8
add rsp, 0x20
push rdx
push rax
xchg qword [rsp + 0x10], rsi
add rsp, 0x18
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140083e60
Capabilities:
Encode data using xor

Disassembly:
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
nop
sub rcx, 0x1d6f25b7
add rcx, 0x1d6f25b5
mov eax, 0x7053673c
sub eax, 0x288c5102
add eax, 0x180d74a7
xor eax, 0x4e1f18c3
add eax, 0x3dde5e40
xor eax, 0x83653caf
mul r8d
shr edx, 1
shr edx, 2
movzx eax, dx
shl ax, 1
shl ax, 1
lea r9d, [rax + rdx]
add r9w, r9w
sub r8w, r9w
sub r8w, 0xffd0
mov word [rcx], r8w
mov r8d, edx
test edx, edx
jne 0x140083e70
xchg rcx, rax
mov rcx, rax
xchg rcx, rax
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140084110
Capabilities:
Encode data using xor

Disassembly:
mov rax, r8
cmp rcx, rdx
je 0x140084273
xchg r12, rax
mov r9, r12
xchg r12, rax
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
xchg r8, rax
movups xmmword [r8], xmm0
xchg r8, rax
xchg rbx, r10
mov qword [r9 + r8 - 0x70], rbx
xchg rbx, r10
mov qword [r9 + r8 - 0x68], r10
xchg rcx, r8
movups xmm0, xmmword [rcx - 0x80]
xchg r8, rcx
xchg rcx, rax
movups xmmword [rcx], xmm0
xchg rcx, rax
xchg r11, r8
movups xmm1, xmmword [r11 - 0x70]
xchg r11, r8
xorps xmm0, xmm0
xchg r10, rax
movups xmmword [r10 + 0x10], xmm1
xchg r10, rax
mov qword [r8 - 0x70], r10
nop
sub rax, 0xc18add
add rax, 0xc18b25
mov qword [r8 - 0x68], 0x24ce8f94
add qword [r8 - 0x68], 0x14ac0b58
add qword [r8 - 0x68], 0x266e4d24
xor qword [r8 - 0x68], 0x7cf9dc12
sub qword [r8 - 0x68], 0x1ab0ecc6
add qword [r8 - 0x68], 0x646e85db
sub qword [r8 - 0x68], 0x640dd048
add qword [r8 - 0x68], 0x3bf58b4d
sub qword [r8 - 0x68], 0x44b68815
mov word [r8 - 0x80], r10w
xchg r9, r14
movups xmmword [r14 + r8 - 0x60], xmm0
xchg r9, r14
xchg r10, rsi
mov qword [r9 + r8 - 0x50], rsi
xchg r10, rsi
mov qword [r9 + r8 - 0x48], r10
xchg rcx, r8
movups xmm0, xmmword [rcx - 0x60]
xchg rcx, r8
movups xmmword [r9 + r8 - 0x60], xmm0
xchg r8, r13
movups xmm1, xmmword [r13 - 0x50]
xchg r13, r8
xchg r12, r9
movups xmmword [r12 + r8 - 0x50], xmm1
xchg r9, r12
mov qword [r8 - 0x50], r10
mov qword [r8 - 0x48], 0xd946e8e
add qword [r8 - 0x48], 0x14e1b316
xor qword [r8 - 0x48], 0x512cc56c
xor qword [r8 - 0x48], 0x4a33fb3e
sub qword [r8 - 0x48], 0x3712c9a9
add qword [r8 - 0x48], 0x57a6834b
sub qword [r8 - 0x48], 0x59fcd991
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x140084134
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140084380
Capabilities:
Encode data using xor

Disassembly:
mov rax, r8
cmp rcx, rdx
je 0x140084443
mov r9, rax
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg r11, rax
movups xmmword [r11], xmm0
xchg r11, rax
xchg rdi, r10
mov qword [r9 + r8 - 0x28], rdi
xchg rdi, r10
lea rcx, [r8 - 0x18]
mov qword [r8 + r9 - 0x20], r10
xchg r8, rdx
movups xmm0, xmmword [rdx - 0x38]
xchg rdx, r8
xchg r11, rax
movups xmmword [r11], xmm0
xchg r11, rax
xchg r8, r13
movups xmm1, xmmword [r13 - 0x28]
xchg r8, r13
xchg r14, rax
movups xmmword [r14 + 0x10], xmm1
xchg r14, rax
mov qword [r8 - 0x28], r10
add rax, 0x20
mov qword [r8 - 0x20], 0x5bdd59ac
sub qword [r8 - 0x20], 0x5b9a750f
xor qword [r8 - 0x20], 0x71ba40d1
xor qword [r8 - 0x20], 0x148dca66
sub qword [r8 - 0x20], 0x1c0fab8a
sub qword [r8 - 0x20], 0x20c4a5d7
xor qword [r8 - 0x20], 0x66093750
sub qword [r8 - 0x20], 0x4ea82b92
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x1400843a4
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14008e880
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0xa], 0x34
xor byte [rcx + rax + 0xa], 0x2f
add byte [rcx + rax + 0xa], 3
xor byte [rcx + rax + 0xa], 3
add byte [rcx + rax + 0xa], 8
sub byte [rcx + rax + 0xa], 0x1a
add byte [rcx + rax + 0xa], 0x6c
sub byte [rcx + rax + 0xa], 0x77
inc rax
cmp rax, 0x10
jb 0x14008e882
ret

Function at 0x14008e9b0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0x14], 0x6a
add byte [rcx + rax + 0x14], 0x12
xor byte [rcx + rax + 0x14], 0x4f
xor byte [rcx + rax + 0x14], 0x7b
xor byte [rcx + rax + 0x14], 3
sub byte [rcx + rax + 0x14], 0x47
add byte [rcx + rax + 0x14], 0x2b
xor byte [rcx + rax + 0x14], 0x2f
inc rax
cmp rax, 0x24
jb 0x14008e9b2
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400f1440
Capabilities:
Create thread

Disassembly:
xchg r13, rbx
mov qword [rsp + 8], r13
xchg rbx, r13
xchg rdx, r10
mov qword [rsp + 0x10], r10
xchg r10, rdx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rsi
nop
push 0x3b8f4ae9
mov qword [rsp], rdi
sub rsp, 0x80
xchg rdi, r9
mov r9, rdi
xchg r9, rdi
mov esi, r8d
xchg r12, rdx
mov rbx, r12
xchg rdx, r12
xor ebp, ebp
lea rcx, [rsp + 0x50]
call fcn.140049a90
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x78], rdi
lea ecx, [rbp + 0x30]
call fcn.1401fcc9c
test rax, rax
je 0x1400f14ee
movups xmm0, xmmword [rsp + 0x50]
xchg r13, rax
movups xmmword [r13], xmm0
xchg r13, rax
movups xmm1, xmmword [rsp + 0x60]
xchg r14, rax
movups xmmword [r14 + 0x10], xmm1
xchg r14, rax
movdqa xmm0, xmmword [0x140002c70]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], bp
mov dword [rax + 0x20], esi
xchg r14, rdi
mov qword [rax + 0x28], r14
xchg r14, rdi
jmp 0x1400f14f5
xchg r15, rax
mov r15, rbp
xchg r15, rax
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0x38]
xchg rcx, rbx
mov qword [rsp + 0x28], rbx
xchg rcx, rbx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x140082100]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400f15b5
cmp dword [rsp + 0x38], 0
je 0x1400f15e2
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x1400f15ad
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x50]
call fcn.14002f8e0
nop
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
nop
xchg qword [rsp], rdi
add rsp, 8
nop
mov rsi, qword [rsp]
add rsp, 8
push rdx
push rbx
push rdx
xchg qword [rsp + 0x18], rbp
pop rdx
pop rbx
pop rdx
add rsp, 8
jmp fcn.14002f8e0
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov dword [rsp + 0x38], ebp
mov ecx, 0x1b2d61da
add ecx, 0x2ed4805a
sub ecx, 0xf5b0a4a
sub ecx, 0x38e7dbe2
xor ecx, 0x6cd0d5f7
sub ecx, 0x6d6e29f9
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 0xbc52030
add ecx, 0xf669950
add ecx, 0x2cabc83f
add ecx, 0x12727c7a
sub ecx, 0x2c57a2ad
xor ecx, 0x2df25b8d
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14015c580
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
je 0x14015c796
push rdi
sub rsp, 0x20
xchg r13, rcx
mov r13, qword [rdx + 0x50]
xchg r13, rcx
xchg rsi, rdi
mov rsi, rdx
xchg rdi, rsi
mov qword [rsp + 0x30], rbx
xor ebx, ebx
test rcx, rcx
je 0x14015c60e
mov rdx, qword [rdx + 0x60]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x14015c5f1
mov r8, qword [rcx - 8]
neg rdx
add rdx, 0xffffffffffffffd9
neg rdx
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14015c797
xchg rcx, r14
mov r14, r8
xchg rcx, r14
call fcn.1401fccd8
xchg rcx, rbx
mov qword [rdi + 0x50], rcx
xchg rcx, rbx
mov qword [rdi + 0x58], rbx
xchg rbp, rbx
mov qword [rdi + 0x60], rbp
xchg rbp, rbx
xchg rcx, r8
mov r8, qword [rdi + 0x40]
xchg rcx, r8
xchg rbx, rax
mov rbx, qword [rcx + 8]
xchg rbx, rax
mov qword [rax], rbx
mov rcx, qword [rcx]
test rcx, rcx
je 0x14015c683
nop word [rax + rax]
xchg rdx, rbx
mov rdx, qword [rcx]
xchg rdx, rbx
mov edx, 0x218a79a2
xor edx, 0x6a38de2a
xor edx, 0x7ad4fbb0
add edx, 0x331eadd9
xor edx, 0x1066e20
sub edx, 0x586bd61e
sub edx, 0xd178dfb
call fcn.1401fccd8
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
test rbx, rbx
jne 0x14015c63a
xchg rcx, r10
mov r10, qword [rdi + 0x40]
xchg rcx, r10
mov edx, 0xbacd065
add edx, 0x67b967d9
xor edx, 0x386d37e0
sub edx, 0x176216a2
xor edx, 0x3fad89f7
xor edx, 0x71a92a07
sub edx, 0x773ef283
add edx, 0x72c765d3
sub edx, 0x7934ce04
call fcn.1401fccd8
xchg r9, rbx
mov r9, qword [rdi + 0x28]
xchg rbx, r9
test rbx, rbx
je 0x14015c740
mov qword [rsp + 0x38], rsi
mov esi, 0x16a400c5
add esi, 0x3669e738
xor esi, 0x3a3aac66
sub esi, 0x36c6b179
add esi, 0x812a47d
xor esi, 0x5d5e97a2
add esi, 0xea2256c2
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14015c73b
xchg rcx, rax
mov rcx, qword [rbx]
xchg rcx, rax
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x14015c73b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rsi, qword [rsp + 0x38]
mov edx, 0x10b817a9
add edx, 0x37162a88
sub edx, 0x15ad62c9
add edx, 0x1c82eec1
add edx, 0x2f5959b7
xor edx, 0x418c8a40
xor edx, 0x77e57b08
sub edx, 0x166bba7b
xor edx, 0x35291d85
xchg r9, rcx
mov r9, rdi
xchg rcx, r9
call fcn.1401fccd8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3