joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400279c0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rbx, rsi
push rdi
sub rsp, 0x10
xchg rsi, rdx
mov rbx, rsi
xchg rsi, rdx
mov r10, rcx
test r8b, 0xf
je 0x140027a09
xor al, al
xchg rdi, rbx
mov rdi, qword [rsp + 0x20]
xchg rbx, rdi
add rsp, 0x10
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
xor edx, edx
test r8d, r8d
je 0x140027ab2
movdqa xmm2, xmmword [rsp]
nop
movdqu xmm1, xmmword [rdx + rbx]
test edx, edx
jne 0x140027a30
movdqu xmm2, xmmword [r10 + 0x200]
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
pxor xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0x3be384c0
add ecx, 0x3e7da85
add ecx, 0x2b26f471
sub ecx, 0x1a0edac2
xor ecx, 0x18223573
xor ecx, 0x48c14d8a
nop dword [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140027a6c
aesdeclast xmm0, xmmword [r10 + 0x1e0]
pxor xmm0, xmm2
movdqa xmm2, xmm1
xchg r8, rdx
movups xmmword [r8 + r9], xmm0
xchg rdx, r8
nop
sub edx, 0x7509e47c
add edx, 0x7509e48c
cmp edx, r8d
jb 0x140027a1a
xchg rbp, rbx
mov rbp, qword [rsp + 0x20]
xchg rbx, rbp
mov al, 0x68
sub al, 0x56
xor al, 0x27
add al, 0xe
xor al, 0x31
sub al, 0x23
sub al, 0x4e
add rsp, 0x10
push rax
push rax
push rax
push rcx
xchg qword [rsp + 0x20], rdi
pop rcx
pop rax
pop rax
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14002c9a0
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
xchg r10, rsi
mov qword [rsp + 0x18], r10
xchg rsi, r10
xchg rbp, rdi
mov qword [rsp + 0x20], rbp
xchg rdi, rbp
nop
mov qword [rsp - 8], r14
sub rsp, 8
sub rsp, 0x30
mov rsi, rcx
mov rax, qword gs:[0x30]
xchg rcx, rdi
mov rcx, qword [rax + 0x60]
xchg rcx, rdi
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
xchg rcx, rbx
mov qword [rsp + 0x40], rcx
xchg rcx, rbx
neg rcx
add rcx, 0xffffffffffffff38
neg rcx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x3b7b28f9
add dword [rsp + 0x20], 0x2bbefa06
xor dword [rsp + 0x20], 0x5d682b7d
add dword [rsp + 0x20], 0x2a15b227
sub dword [rsp + 0x20], 0x2605f51a
sub dword [rsp + 0x20], 0x3e61c687
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002b660
test eax, eax
js 0x14002ca63
cmp qword [rsp + 0x40], rbx
je 0x14002ca63
lea eax, [rbx + 1]
jmp 0x14002cbb1
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0x70], 2
jbe 0x14002caac
mov eax, 0x1d72dbd0
xor eax, 0x2513b5ef
add eax, 0x255c3a6e
xor eax, 0x177c7519
sub eax, 0x2d858d5c
add eax, 0x2dfb9de9
sub eax, 0x3196fb9d
add eax, 0x2648f5bc
sub eax, 0x3fe9e85e
jmp 0x14002cbb1
cmp dword [rcx + 0x74], ebx
jbe 0x14002cae2
mov eax, 0x42195d1a
xor eax, 0x2ecc83ac
sub eax, 0x4bd46cbc
xor eax, 0x6a85fe9f
add eax, 0xd82b536
sub eax, 0x47e8b5cf
add eax, 0x8df7a4f
sub eax, 0x19fe0918
jmp 0x14002cbb1
cmp byte [rdi + 2], bl
je 0x14002cb18
mov eax, 0x39174da
add eax, 0x3652cbcc
xor eax, 0x94c04f2
xor eax, 0xd0b9c03
sub eax, 0x4cf0af
sub eax, 0x1eccfb22
xor eax, 0x529344c9
sub eax, 0x4c1aa84b
jmp 0x14002cbb1
cmp r14d, 0xa
jb 0x14002cb64
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002cb64
mov eax, 0x213048a6
add eax, 0x4ecb8f04
xor eax, 0x31cf3811
xor eax, 0x564b7ca5
add eax, 0xf2d2c72
add eax, 0x38fcf429
sub eax, 0xf18d871
sub eax, 0x4190db40
jmp 0x14002cbb1
lea rcx, [rsi + 0xb8]
mov edx, 0xfd81c55
xor edx, 0x32ad25a
xor edx, 0x7bbc4678
xor edx, 0x5454c261
add edx, 0x1cd7de5
add edx, 0x25e5f9ca
sub edx, 0x254a78b6
add edx, 0x57605f2c
add edx, 0x1cb5f15e
call fcn.14002bf70
jmp 0x14002cbaf
mov eax, ebx
xchg rbp, rbx
mov rbp, qword [rsp + 0x48]
xchg rbp, rbx
mov rsi, qword [rsp + 0x50]
xchg rdi, r15
mov r15, qword [rsp + 0x58]
xchg rdi, r15
add rsp, 0x30
push rbx
push rcx
push rax
push rbx
push rdx
xchg qword [rsp + 0x28], r14
add rsp, 0x30
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140035930
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rcx
mov qword [rsp + 8], r14
xchg rcx, r14
push rbx
nop
sub rsp, 8
mov qword [rsp], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r12
push r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
push r10
mov qword [rsp], r15
sub rsp, 0x30
xchg r14, r15
mov r14, rdx
xchg r15, r14
xchg r14, rcx
mov rcx, r14
xchg r14, rcx
movabs rsi, 0xfffffff600271e7
sub rsi, 0x38a6ddb1
xor rsi, 0x35b18cbe
xor rsi, 0x2856bd40
add rsi, 0x2dcf4b76
add rsi, 0x127fd5a9
sub rsi, 0x5007853d
add rsi, 0x7fffffff
xor rsi, 0x54fbbe56
cmp rdx, rsi
ja 0x140035b8f
xchg r12, rbp
mov rbp, qword [rcx + 8]
xchg rbp, r12
sub r12, qword [rcx]
sar r12, 3
sar r12, 1
mov rcx, qword [rcx + 0x10]
sub rcx, qword [r14]
sar rcx, 3
sar rcx, 1
xchg rdx, rcx
mov rcx, rdx
xchg rdx, rcx
shr rdx, 1
xchg rcx, rax
mov rcx, rsi
xchg rcx, rax
sub rax, rdx
cmp rcx, rax
ja 0x140035a17
lea rsi, [rdx + rcx]
cmp rsi, r15
cmovb rsi, r15
xchg rdi, rsi
mov qword [rsp + 0x88], rdi
xchg rsi, rdi
mov rdx, rsi
xchg rcx, r10
mov r10, r14
xchg rcx, r10
call fcn.1400538b0
xchg r12, r13
mov r12, rax
xchg r13, r12
mov qword [rsp + 0x28], rax
xchg r12, r13
mov rbx, r13
xchg r13, r12
shl rbx, 1
shl rbx, 1
shl rbx, 1
shl rbx, 1
add rbx, rax
xchg rbx, r9
mov qword [rsp + 0x20], r9
xchg rbx, r9
xchg rdi, r15
mov r15, rdi
xchg rdi, r15
sub rdi, r12
xchg r8, rbx
mov qword [rsp + 0x78], r8
xchg rbx, r8
je 0x140035ace
nop word [rax + rax]
mov byte [rbx], 0x36
xor byte [rbx], 0x78
sub byte [rbx], 0x4d
xor byte [rbx], 2
add byte [rbx], 0x24
add byte [rbx], 7
add byte [rbx], 0x41
xor byte [rbx], 0x42
xor byte [rbx], 0x2d
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004bb40
nop
add rbx, 0x10
xchg rbx, r12
mov qword [rsp + 0x78], r12
xchg rbx, r12
sub rdi, 1
jne 0x140035a8e
xchg r11, r8
mov r11, qword [r14 + 8]
xchg r8, r11
xchg rdx, r13
mov r13, rdx
xchg r13, rdx
xchg rcx, r13
mov r13, qword [r14]
xchg rcx, r13
cmp rcx, r8
je 0x140035b25
xor r9d, r9d
movzx eax, byte [rcx]
mov byte [rdx], al
xchg rsi, rax
mov rsi, qword [rcx + 8]
xchg rsi, rax
mov qword [rdx + 8], rax
mov byte [rcx], r9b
mov qword [rcx + 8], r9
lea rdx, [rdx + 0x10]
neg rcx
add rcx, 0xfffffffffffffff0
neg rcx
cmp rcx, r8
jne 0x140035af6
xchg rsi, r9
mov rsi, r9
xchg rsi, r9
mov r8, r15
mov rdx, r13
mov rcx, r14
add rsp, 0x30
nop
mov r15, qword [rsp]
add rsp, 8
push rax
push rax
push rdx
push rbx
push rcx
push rax
push rbx
push rdx
xchg qword [rsp + 0x40], r14
add rsp, 0x48
nop
mov r13, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], r12
nop
add rsp, 8
xchg qword [rsp - 8], rdi
push rdx
push rbx
push rbx
push rdx
push rdx
xchg qword [rsp + 0x28], rsi
add rsp, 0x30
nop
add rsp, 8
mov rbx, qword [rsp - 8]
jmp fcn.140052a50
call fcn.14002f860
int3
Function at 0x140035c10
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg rbx, r11
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rdx
xchg rcx, rbx
mov rcx, rbx
xchg rbx, rcx
test rdx, rdx
je 0x140035c6d
nop word [rax + rax]
mov byte [rbx], 8
xor byte [rbx], 0x59
sub byte [rbx], 0x28
xor byte [rbx], 0x1b
add byte [rbx], 0x28
xor byte [rbx], 0x5a
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004bb40
nop
sub rbx, 0xfffffffffffffff0
sub rdi, 1
jne 0x140035c45
mov rax, rbx
xchg rbx, rcx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
add rsp, 0x20
push rax
push rcx
push rdx
push rcx
push rcx
push rcx
push rdx
push rdx
xchg qword [rsp + 0x40], rdi
pop rdx
pop rdx
pop rcx
pop rcx
pop rcx
pop rdx
pop rcx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14004c2e0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x38
add byte [rcx + rax + 6], 0x39
sub byte [rcx + rax + 6], 0x54
add byte [rcx + rax + 6], 0x53
sub byte [rcx + rax + 6], 0x3d
xor byte [rcx + rax + 6], 0x79
sub byte [rcx + rax + 6], 0x4a
inc rax
cmp rax, 8
jb 0x14004c2e2
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14004c320
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x24
sub byte [rcx + rax + 6], 3
add byte [rcx + rax + 6], 0x37
xor byte [rcx + rax + 6], 0x16
add byte [rcx + rax + 6], 3
add byte [rcx + rax + 6], 0x1d
sub byte [rcx + rax + 6], 6
sub byte [rcx + rax + 6], 0x2a
xor byte [rcx + rax + 6], 0x3e
inc rax
cmp rax, 0xa
jb 0x14004c322
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400763f0
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rcx
mov r9, r15
xchg r15, rcx
mov r8d, 0x4b5f24f6
xor r8d, 0x61eb1ca9
add r8d, 0x3fabfbaa
xor r8d, 0x6f4f2908
add r8d, 0x72b50dea
sub r8d, 0x79aeff3
sub r8d, 0x1bda1397
add r8d, 0xab90d89e
test rcx, rcx
je 0x140076514
cmp byte [rcx], 0
je 0x140076514
test rdx, rdx
jne 0x1400764a5
nop
movabs rdx, 0xffffffff01f94973
add rdx, 0x2e2dcc5e
sub rdx, 0x99f8f01
add rdx, 0x13aaba5
add rdx, 0x547d91eb
sub rdx, 0x6f4e7012
add rdx, 0x23c770ee
add rdx, 0x7fffffff
add rdx, 0x4f473ac4
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x14007648f
test rdx, rdx
je 0x140076511
xor r10d, r10d
lea r11, [0x140002dd0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
or rcx, qword [rsp]
add rsp, 0x10
shr r8d, 4
shr r8d, 3
shr r8d, 1
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x1400764b7
not r8d
mov eax, r8d
ret

Function at 0x14007b340
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rax
mov r8, qword [rcx + 0x10]
xchg r8, rax
mov rdx, rcx
test rax, rax
jne 0x14007b35f
xor r8d, r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b39f
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b38d
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b36d
xchg r11, rax
mov r11, qword [rdx + 0x10]
xchg r11, rax
mov byte [rdx], 0x51
sub byte [rdx], 0x15
sub byte [rdx], 0xe
sub byte [rdx], 2
add byte [rdx], 0x27
sub byte [rdx], 0x52
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b3b0
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rax
mov r15, qword [rcx + 0x10]
xchg r15, rax
xchg r14, rcx
mov rdx, r14
xchg r14, rcx
test rax, rax
jne 0x14007b3d5
xor r8d, r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b418
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b400
mov rcx, qword [rdx + 0x10]
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b3e3
xchg rbp, rax
mov rbp, qword [rdx + 0x10]
xchg rbp, rax
mov byte [rdx], 0x22
sub byte [rdx], 0xa
add byte [rdx], 0x38
xor byte [rdx], 0x3a
xor byte [rdx], 0x6a
add byte [rdx], 0x43
add byte [rdx], 0x36
sub byte [rdx], 0x78
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b750
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rax
mov r8, qword [rcx + 0x10]
xchg r8, rax
xchg r10, rcx
mov rdx, r10
xchg rcx, r10
test rax, rax
jne 0x14007b76f
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b7b3
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b79e
nop dword [rax + rax]
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b782
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x69
xor byte [rdx], 0x27
sub byte [rdx], 0x1f
add byte [rdx], 0x34
sub byte [rdx], 0xe
sub byte [rdx], 0x2b
sub byte [rdx], 0x29
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007bff0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rsi
mov qword [rsp + 0x10], rsi
xchg rsi, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 4]
mov rdx, rbx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x36
xor byte [rbx + rax], 0x7d
xor byte [rbx + rax], 4
xor byte [rbx + rax], 0x70
xor byte [rbx + rax], 0x7b
sub byte [rbx + rax], 0x44
inc rax
cmp rax, 6
jb 0x14007c020
xchg rbp, rdi
mov rax, rbp
xchg rdi, rbp
xchg r15, rbx
mov r15, qword [rsp + 0x30]
xchg rbx, r15
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c070
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg r10, rbx
mov qword [rsp + 8], r10
xchg rbx, r10
xchg r14, rdx
mov qword [rsp + 0x10], r14
xchg rdx, r14
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r10
mov r10, rcx
xchg rdi, r10
lea rbx, [rdx + 6]
xchg r13, rbx
mov rdx, r13
xchg r13, rbx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x51
add byte [rbx + rax], 9
sub byte [rbx + rax], 0x45
xor byte [rbx + rax], 0x57
xor byte [rbx + rax], 0x1f
xor byte [rbx + rax], 0x5d
inc rax
cmp rax, 8
jb 0x14007c0b1
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c100
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 6]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x44
xor byte [rbx + rax], 2
xor byte [rbx + rax], 0x1c
sub byte [rbx + rax], 0x26
add byte [rbx + rax], 0x10
xor byte [rbx + rax], 3
sub byte [rbx + rax], 0x47
inc rax
cmp rax, 0xa
jb 0x14007c127
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rdi
mov rdi, qword [rsp + 0x30]
xchg rbx, rdi
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x14007c170
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 8]
xchg r8, rdx
mov r8, rbx
xchg r8, rdx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x6a
sub byte [rbx + rax], 0xd
xor byte [rbx + rax], 0x62
sub byte [rbx + rax], 0x34
xor byte [rbx + rax], 0x39
sub byte [rbx + rax], 0x32
inc rax
cmp rax, 0xe
jb 0x14007c19d
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14007c1e0
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rbx, rsi
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, r11
mov r11, rcx
xchg r11, rdi
lea rbx, [rdx + 0xa]
xchg rdx, rcx
mov rcx, rbx
xchg rcx, rdx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x7c
sub byte [rbx + rax], 0x11
sub byte [rbx + rax], 9
xor byte [rbx + rax], 0x79
add byte [rbx + rax], 0x33
xor byte [rbx + rax], 8
add byte [rbx + rax], 8
sub byte [rbx + rax], 0x4e
inc rax
cmp rax, 0x10
jb 0x14007c21c
xchg rdi, rcx
mov rax, rcx
xchg rdi, rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rcx
push rdx
push rcx
push rcx
push rbx
push rdx
push rbx
xchg qword [rsp + 0x40], rdi
pop rbx
pop rdx
pop rbx
pop rcx
pop rcx
pop rdx
pop rcx
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c280
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rdx
mov rdx, rcx
xchg rdi, rdx
lea rbx, [rdx + 0xa]
xchg rdx, r10
mov r10, rbx
xchg rdx, r10
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x3a
xor byte [rbx + rax], 3
add byte [rbx + rax], 9
add byte [rbx + rax], 0xb
sub byte [rbx + rax], 0x49
xor byte [rbx + rax], 0x79
sub byte [rbx + rax], 0xa
xor byte [rbx + rax], 0x73
inc rax
cmp rax, 0x12
jb 0x14007c2b1
xchg rdi, r15
mov rax, r15
xchg rdi, r15
xchg r15, rbx
mov r15, qword [rsp + 0x30]
xchg r15, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c310
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbx, rdx
mov qword [rsp + 0x10], rbx
xchg rbx, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x10]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x4d
sub byte [rbx + rax], 0xe
add byte [rbx + rax], 0x27
xor byte [rbx + rax], 0x4c
add byte [rbx + rax], 0x4e
xor byte [rbx + rax], 0x78
inc rax
cmp rax, 0x1e
jb 0x14007c346
mov rax, rdi
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c420
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x12]
xchg rbx, r9
mov rdx, r9
xchg r9, rbx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x27
add byte [rbx + rax], 0x14
add byte [rbx + rax], 0x36
sub byte [rbx + rax], 0x3e
xor byte [rbx + rax], 0x7e
sub byte [rbx + rax], 0x2f
add byte [rbx + rax], 0x57
sub byte [rbx + rax], 0x75
inc rax
cmp rax, 0x22
jb 0x14007c447
xchg rcx, rax
mov rcx, rdi
xchg rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret
Function at 0x14007c490
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x14]
xchg rcx, rbx
mov rdx, rcx
xchg rbx, rcx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x2a
add byte [rbx + rax], 9
sub byte [rbx + rax], 0x30
add byte [rbx + rax], 0x4b
xor byte [rbx + rax], 0x10
sub byte [rbx + rax], 0x36
add byte [rbx + rax], 4
add byte [rbx + rax], 0x20
xor byte [rbx + rax], 0x4c
inc rax
cmp rax, 0x24
jb 0x14007c4b7
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rax
push rax
push rbx
push rax
push rdx
push rbx
push rcx
xchg qword [rsp + 0x40], rdi
add rsp, 0x48
ret

Function at 0x14007c510
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r10, rcx
mov rdi, r10
xchg r10, rcx
lea rbx, [rdx + 0x14]
xchg r13, rbx
mov rdx, r13
xchg rbx, r13
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x7b
sub byte [rbx + rax], 0x75
add byte [rbx + rax], 0x16
xor byte [rbx + rax], 0x11
add byte [rbx + rax], 0x6b
xor byte [rbx + rax], 0x15
sub byte [rbx + rax], 0x3e
add byte [rbx + rax], 0x43
sub byte [rbx + rax], 0x72
inc rax
cmp rax, 0x26
jb 0x14007c545
mov rax, rdi
xchg rbx, r8
mov r8, qword [rsp + 0x30]
xchg rbx, r8
add rsp, 0x20
push rax
xchg qword [rsp + 8], rdi
add rsp, 0x10
ret

Function at 0x14007c590
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rbx
mov qword [rsp + 0x10], rbx
xchg rbx, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, r11
mov r11, rcx
xchg r11, rdi
lea rbx, [rdx + 0x16]
xchg r12, rbx
mov rdx, r12
xchg rbx, r12
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x63
sub byte [rbx + rax], 0x3f
xor byte [rbx + rax], 0x1a
xor byte [rbx + rax], 0x3f
add byte [rbx + rax], 0x1c
xor byte [rbx + rax], 0x1d
inc rax
cmp rax, 0x28
jb 0x14007c5cc
xchg r13, rdi
mov rax, r13
xchg rdi, r13
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007c610
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r9
mov qword [rsp + 0x10], r9
xchg rdx, r9
push rdi
sub rsp, 0x20
xchg r13, rcx
mov rdi, r13
xchg r13, rcx
lea rbx, [rdx + 0x16]
xchg rcx, rdx
mov rcx, rbx
xchg rdx, rcx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x4f
xor byte [rbx + rax], 4
add byte [rbx + rax], 0x12
sub byte [rbx + rax], 0x2d
xor byte [rbx + rax], 0x3f
add byte [rbx + rax], 0x64
add byte [rbx + rax], 4
xor byte [rbx + rax], 0x29
sub byte [rbx + rax], 0x5e
inc rax
cmp rax, 0x2a
jb 0x14007c643
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rbx
push rax
push rcx
push rax
push rbx
push rbx
push rbx
xchg qword [rsp + 0x40], rdi
add rsp, 0x48
ret
Function at 0x14007c6a0
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rdi, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, r14
mov r14, rcx
xchg rdi, r14
lea rbx, [rdx + 0x18]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x52
add byte [rbx + rax], 0x28
sub byte [rbx + rax], 0x1e
xor byte [rbx + rax], 0x43
add byte [rbx + rax], 0x33
sub byte [rbx + rax], 0x52
inc rax
cmp rax, 0x2e
jb 0x14007c6d3
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c720
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
push 0xc5ac92f
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r13
mov r13, rcx
xchg r13, rdi
lea rbx, [rdx + 0x1a]
xchg r13, rdx
mov r13, rbx
xchg rdx, r13
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x6b
sub byte [rbx + rax], 0x5e
add byte [rbx + rax], 0x13
xor byte [rbx + rax], 6
sub byte [rbx + rax], 0x1c
sub byte [rbx + rax], 0xa
inc rax
cmp rax, 0x32
jb 0x14007c756
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c7a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg r15, rcx
mov rdi, r15
xchg r15, rcx
lea rbx, [rdx + 0x1c]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x67
sub byte [rbx + rax], 0x32
add byte [rbx + rax], 0x2d
add byte [rbx + rax], 0x10
xor byte [rbx + rax], 0x45
xor byte [rbx + rax], 0xa
sub byte [rbx + rax], 0x3d
inc rax
cmp rax, 0x34
jb 0x14007c7cd
xchg rdi, rdx
mov rax, rdx
xchg rdx, rdi
xchg rbx, r9
mov r9, qword [rsp + 0x30]
xchg r9, rbx
add rsp, 0x20
push rbx
push rbx
xchg qword [rsp + 0x10], rdi
pop rbx
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c820
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r8
mov qword [rsp + 8], r8
xchg r8, rbx
xchg rdx, r14
mov qword [rsp + 0x10], r14
xchg rdx, r14
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r8, rcx
mov rdi, r8
xchg rcx, r8
lea rbx, [rdx + 0x1c]
xchg rdx, rbp
mov rbp, rbx
xchg rdx, rbp
call fcn.14007ab70
nop
xor eax, eax
mov byte [rbx + rax], 0x48
sub byte [rbx + rax], 9
xor byte [rbx + rax], 3
sub byte [rbx + rax], 0x2f
add byte [rbx + rax], 0x1d
sub byte [rbx + rax], 0x2a
inc rax
cmp rax, 0x36
jb 0x14007c861
xchg r9, rdi
mov rax, r9
xchg r9, rdi
xchg rbx, rbp
mov rbp, qword [rsp + 0x30]
xchg rbp, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret