joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002ca90
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
xchg r14, rbx
mov qword [rsp + 0x10], r14
xchg rbx, r14
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
xchg r13, rcx
mov rsi, r13
xchg r13, rcx
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x60]
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
mov qword [rsp + 0x40], rbx
add rcx, 0x4c726fe4
sub rcx, 0x4c726f1c
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x570cc125
sub dword [rsp + 0x20], 0x15800617
xor dword [rsp + 0x20], 0x64eb1887
add dword [rsp + 0x20], 0x3f395d58
xor dword [rsp + 0x20], 0x730e0e7b
add dword [rsp + 0x20], 0x164c41b7
add dword [rsp + 0x20], 0x48b999de
sub dword [rsp + 0x20], 0x1b9e655c
sub dword [rsp + 0x20], 0x5b1684cb
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002b6d0
test eax, eax
js 0x14002cb58
cmp qword [rsp + 0x40], rbx
je 0x14002cb58
lea eax, [rbx + 1]
jmp 0x14002cca2
mov rax, qword gs:[0x60]
xchg rbx, rcx
mov rbx, qword [rax + 0x30]
xchg rbx, rcx
cmp dword [rcx + 0x70], 2
jbe 0x14002cba7
mov eax, 0x1b969623
xor eax, 0x2c46f94a
xor eax, 0x6abe9150
add eax, 0x9de73f9
xor eax, 0x4442a90c
add eax, 0x5253dbeb
sub eax, 0x611be957
sub eax, 0xd37e97b
xor eax, 0x70fe455
jmp 0x14002cca2
cmp dword [rcx + 0x74], ebx
jbe 0x14002cbd3
mov eax, 0x1992cda6
xor eax, 0x701495ed
sub eax, 0x4f7c1ada
add eax, 0x3bcf62e3
xor eax, 0x55717f62
sub eax, 0xa8df33
jmp 0x14002cca2
cmp byte [rdi + 2], bl
je 0x14002cc09
mov eax, 0x3a5cf610
add eax, 0x42ca9ed5
sub eax, 0x5cb006e6
add eax, 0x59f11b57
xor eax, 0x13ccd04f
xor eax, 0x71a2eef9
add eax, 0x4deaf3db
sub eax, 0x65f18bb7
jmp 0x14002cca2
cmp r14d, 0xa
jb 0x14002cc55
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002cc55
mov eax, 0x42fa4440
sub eax, 0x41f2cfc5
add eax, 0x238cc489
add eax, 0x5b3b83e4
sub eax, 0x609faf95
sub eax, 0x7a114cd
add eax, 0x66cf8b1b
xor eax, 0x7e5e83a9
jmp 0x14002cca2
lea rcx, [rsi + 0xb8]
mov edx, 0x60611313
sub edx, 0x33ad993
sub edx, 0xe343d45
xor edx, 0x57ccb1de
add edx, 0x1a127a6d
xor edx, 0x726cbf11
add edx, 0x95275cf
add edx, 0x28dde250
add edx, 0x2645ca37
call fcn.14002c060
jmp 0x14002cca0
mov eax, ebx
xchg r9, rbx
mov r9, qword [rsp + 0x48]
xchg r9, rbx
xchg r9, rsi
mov r9, qword [rsp + 0x50]
xchg rsi, r9
xchg r12, rdi
mov r12, qword [rsp + 0x58]
xchg rdi, r12
add rsp, 0x30
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x140035950
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, r15
mov qword [rsp + 8], r15
xchg rcx, r15
push rbx
push rcx
mov qword [rsp], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
push r13
push r14
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x30
xchg rdx, r10
mov r15, r10
xchg rdx, r10
mov r14, rcx
movabs rsi, 0xfffffff3e44b142
xor rsi, 0x23b63ed2
xor rsi, 0x3dd666e7
xor rsi, 0x226865c6
add rsi, 0x19e745f3
add rsi, 0x58523216
add rsi, 0x7fffffff
add rsi, 0xb79fb46
cmp rdx, rsi
ja 0x140035b8f
xchg r11, r12
mov r11, qword [rcx + 8]
xchg r12, r11
sub r12, qword [rcx]
sar r12, 2
sar r12, 1
sar r12, 1
mov rcx, qword [rcx + 0x10]
sub rcx, qword [r14]
sar rcx, 1
sar rcx, 2
sar rcx, 1
xchg rcx, rbp
mov rdx, rbp
xchg rcx, rbp
shr rdx, 1
xchg r13, rsi
mov rax, r13
xchg rsi, r13
sub rax, rdx
cmp rcx, rax
ja 0x140035a22
lea rsi, [rdx + rcx]
cmp rsi, r15
cmovb rsi, r15
xchg rsi, rbp
mov qword [rsp + 0x88], rbp
xchg rbp, rsi
mov rdx, rsi
xchg rcx, r14
mov r14, rcx
xchg rcx, r14
call fcn.1400538f0
xchg r9, rax
mov r13, r9
xchg r9, rax
xchg rdx, rax
mov qword [rsp + 0x28], rdx
xchg rdx, rax
xchg rbx, r11
mov r11, r12
xchg rbx, r11
shl rbx, 4
add rbx, rax
xchg r12, rbx
mov qword [rsp + 0x20], r12
xchg rbx, r12
xchg r10, rdi
mov r10, r15
xchg r10, rdi
sub rdi, r12
mov qword [rsp + 0x78], rbx
je 0x140035aca
nop word [rax + rax]
mov byte [rbx], 0x61
add byte [rbx], 7
xor byte [rbx], 0x58
xor byte [rbx], 0x56
xor byte [rbx], 4
sub byte [rbx], 0x62
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004baf0
nop
neg rbx
add rbx, 0xfffffffffffffff0
neg rbx
xchg rbx, r9
mov qword [rsp + 0x78], r9
xchg r9, rbx
sub rdi, 1
jne 0x140035a8d
mov r8, qword [r14 + 8]
xchg rdx, rbx
mov rbx, r13
xchg rbx, rdx
mov rcx, qword [r14]
cmp rcx, r8
je 0x140035b19
xor r9d, r9d
movzx eax, byte [rcx]
mov byte [rdx], al
xchg rbx, rax
mov rbx, qword [rcx + 8]
xchg rbx, rax
xchg r14, rax
mov qword [rdx + 8], r14
xchg r14, rax
mov byte [rcx], r9b
xchg r9, rbp
mov qword [rcx + 8], rbp
xchg rbp, r9
lea rdx, [rdx + 0x10]
add rcx, 0x10
cmp rcx, r8
jne 0x140035ae6
xchg rsi, r13
mov r9, r13
xchg r13, rsi
xchg r15, rbp
mov r8, rbp
xchg rbp, r15
xchg rdx, r13
mov r13, rdx
xchg rdx, r13
mov rcx, r14
add rsp, 0x30
push rax
push rax
push rdx
push rax
push rdx
push rax
push rdx
push rax
xchg qword [rsp + 0x40], r15
add rsp, 0x48
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], r13
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
xchg qword [rsp], rdi
add rsp, 8
push rbx
push rcx
push rax
push rdx
push rax
push rbx
xchg qword [rsp + 0x30], rsi
add rsp, 0x38
nop
xchg qword [rsp], rbx
add rsp, 8
jmp fcn.140052a00
call fcn.14002f940
int3
Function at 0x140035c10
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rbx
mov qword [rsp + 8], r9
xchg rbx, r9
nop
push 0x2cff13f
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r11
mov r11, rdx
xchg rdi, r11
mov rbx, rcx
test rdx, rdx
je 0x140035c73
nop word [rax + rax]
mov byte [rbx], 0xa
add byte [rbx], 0x62
sub byte [rbx], 0x59
add byte [rbx], 0x41
sub byte [rbx], 0x53
add byte [rbx], 0x70
sub byte [rbx], 0x6b
xor byte [rbx], 6
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004baf0
nop
add rbx, 0x10
sub rdi, 1
jne 0x140035c45
xchg rbx, rsi
mov rax, rsi
xchg rsi, rbx
xchg rbx, rdi
mov rdi, qword [rsp + 0x30]
xchg rdi, rbx
add rsp, 0x20
push rax
xchg qword [rsp + 8], rdi
add rsp, 0x10
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14004c2c0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0xe
xor byte [rcx + rax + 6], 0x30
xor byte [rcx + rax + 6], 0x45
sub byte [rcx + rax + 6], 0x6b
add byte [rcx + rax + 6], 0x2f
sub byte [rcx + rax + 6], 0x1d
xor byte [rcx + rax + 6], 0x22
inc rax
cmp rax, 8
jb 0x14004c2c2
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14004c300
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x4d
sub byte [rcx + rax + 6], 0xd
xor byte [rcx + rax + 6], 0
xor byte [rcx + rax + 6], 0x25
xor byte [rcx + rax + 6], 0x36
sub byte [rcx + rax + 6], 0x13
add byte [rcx + rax + 6], 0x3a
xor byte [rcx + rax + 6], 0x7a
inc rax
cmp rax, 0xa
jb 0x14004c302
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140071200
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
lea r10, [rsp + 0x3d]
mov r8d, edx
xchg r8, rcx
mov rbx, r8
xchg rcx, r8
test edx, edx
jns 0x1400712b0
neg r8d
nop dword [rax + rax]
dec r10
mov eax, 0x7e38e229
sub eax, 0x2e08319e
xor eax, 0x6fa55790
xor eax, 0x77cdfe2
add eax, 0x25f9b590
xor eax, 0x922e2244
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
neg r8b
add r8b, 0xd0
neg r8b
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x14007122a
dec r10
mov byte [r10], 0x6d
add byte [r10], 5
sub byte [r10], 0x5a
add byte [r10], 0x42
sub byte [r10], 0x11
add byte [r10], 7
xor byte [r10], 0x30
xor byte [r10], 0x2c
sub byte [r10], 0x1f
jmp 0x1400712ff
dec r10
mov eax, 0x177e6f15
sub eax, 0x96e50c4
xor eax, 0x3caaab7e
add eax, 0x1f6a160e
sub eax, 0x12a08932
xor eax, 0x24bf5fd
add eax, 0x8efd14d7
mul r8d
shr edx, 2
shr edx, 1
movzx eax, dl
shl al, 1
shl al, 1
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x1400712b0
lea r9, [rsp + 0x58]
xchg r10, rbx
mov rdx, rbx
xchg r10, rbx
lea r8, [rsp + 0x3d]
xchg rdi, rcx
mov rdi, rbx
xchg rdi, rcx
call fcn.140030000
xchg rbx, rdi
mov rax, rdi
xchg rbx, rdi
add rsp, 0x40
nop
xchg qword [rsp], rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x1400763e0
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
mov r8d, 0x3bdc071c
add r8d, 0x42075b97
sub r8d, 0x79dc73b0
xor r8d, 0xaf81151
add r8d, 0x16cb1523
add r8d, 0x242ef67d
sub r8d, 0x33a552d2
xor r8d, 0x11111f06
add r8d, 0xf8bd57d9
test rcx, rcx
je 0x140076504
cmp byte [rcx], 0
je 0x140076504
test rdx, rdx
jne 0x140076496
nop
movabs rdx, 0xffffffff0d8010df
add rdx, 0x2f096de1
sub rdx, 0x1ce18f6f
xor rdx, 0x5d60d050
xor rdx, 0x76fda64f
xor rdx, 0x4cf9f7b4
sub rdx, 0x3349c65
add rdx, 0x7fffffff
add rdx, 0xa712d6b
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x140076480
test rdx, rdx
je 0x140076501
xor r10d, r10d
lea r11, [0x140002dd0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
or rcx, qword [rsp]
add rsp, 0x10
shr r8d, 6
shr r8d, 1
shr r8d, 1
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x1400764a8
not r8d
mov eax, r8d
ret
Function at 0x14007b2d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg r14, rdx
mov r14, rcx
xchg rdx, r14
test rax, rax
jne 0x14007b2e9
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x14007b32d
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b31b
xchg r13, rax
mov r13, qword [rdx + 0x10]
xchg r13, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b2f7
xchg r15, rax
mov r15, qword [rdx + 0x10]
xchg r15, rax
mov byte [rdx], 0x63
sub byte [rdx], 0x38
sub byte [rdx], 0x21
xor byte [rdx], 0x45
sub byte [rdx], 0x20
sub byte [rdx], 0x2e
ret

Function at 0x14007b330
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rax
mov rdx, qword [rcx + 0x10]
xchg rdx, rax
xchg r10, rcx
mov rdx, r10
xchg r10, rcx
test rax, rax
jne 0x14007b355
xor r8d, r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b38e
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b37c
mov rcx, qword [rdx + 0x10]
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b363
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x17
add byte [rdx], 0x56
sub byte [rdx], 0x41
xor byte [rdx], 0x3f
add byte [rdx], 0x60
sub byte [rdx], 0x72
ret

Function at 0x14007b6b0
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rax
mov rsi, qword [rcx + 0x10]
xchg rsi, rax
xchg rcx, r10
mov rdx, r10
xchg r10, rcx
test rax, rax
jne 0x14007b6cf
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b71a
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b702
nop dword [rax + rax]
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b6e2
xchg rcx, rax
mov rcx, qword [rdx + 0x10]
xchg rcx, rax
mov byte [rdx], 0xd
xor byte [rdx], 0x24
xor byte [rdx], 0x19
add byte [rdx], 0x49
sub byte [rdx], 0x50
sub byte [rdx], 0x25
add byte [rdx], 0x2b
xor byte [rdx], 0x2e
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007bfa0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rbx, rdx
xchg r10, rdx
mov qword [rsp + 0x10], r10
xchg rdx, r10
nop
push r9
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 4]
xchg rbx, rcx
mov rdx, rcx
xchg rcx, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x36
sub byte [rbx + rax], 0x17
xor byte [rbx + rax], 0x61
sub byte [rbx + rax], 0x4a
xor byte [rbx + rax], 0x5b
sub byte [rbx + rax], 0x2c
xor byte [rbx + rax], 0x43
inc rax
cmp rax, 6
jb 0x14007bfdf
mov rax, rdi
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rbx, rdx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c030
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rbx, rsi
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 6]
xchg rdx, r10
mov r10, rbx
xchg r10, rdx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x7d
sub byte [rbx + rax], 0x76
xor byte [rbx + rax], 0x5b
xor byte [rbx + rax], 0x21
sub byte [rbx + rax], 0x55
xor byte [rbx + rax], 0x75
sub byte [rbx + rax], 7
xor byte [rbx + rax], 0x3a
xor byte [rbx + rax], 0x6c
inc rax
cmp rax, 8
jb 0x14007c06c
xchg r11, rax
mov r11, rdi
xchg r11, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rax
push rcx
push rax
push rcx
push rcx
push rax
push rax
xchg qword [rsp + 0x40], rdi
add rsp, 0x48
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c0d0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rbx, rcx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rbp, rdi
mov rbp, rcx
xchg rdi, rbp
lea rbx, [rdx + 6]
mov rdx, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x35
sub byte [rbx + rax], 0xc
add byte [rbx + rax], 0x49
sub byte [rbx + rax], 0x3f
xor byte [rbx + rax], 0x10
add byte [rbx + rax], 0x25
sub byte [rbx + rax], 0x1a
sub byte [rbx + rax], 0x1d
xor byte [rbx + rax], 0x11
inc rax
cmp rax, 0xa
jb 0x14007c106
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x14007c150
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r11
mov qword [rsp + 0x10], r11
xchg rdx, r11
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 8]
xchg rbx, rdi
mov rdx, rdi
xchg rdi, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x7d
xor byte [rbx + rax], 0x32
add byte [rbx + rax], 3
sub byte [rbx + rax], 0x1a
xor byte [rbx + rax], 0x76
add byte [rbx + rax], 0x25
sub byte [rbx + rax], 0x73
inc rax
cmp rax, 0xe
jb 0x14007c17d
xchg rbx, rdi
mov rax, rbx
xchg rdi, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c1d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg rbx, r8
mov qword [rsp + 8], r8
xchg rbx, r8
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xa]
xchg rbx, rbp
mov rdx, rbp
xchg rbp, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x2a
xor byte [rbx + rax], 0x63
sub byte [rbx + rax], 0x3b
add byte [rbx + rax], 0x38
xor byte [rbx + rax], 0x45
xor byte [rbx + rax], 3
inc rax
cmp rax, 0x10
jb 0x14007c1fd
xchg r14, rax
mov r14, rdi
xchg r14, rax
xchg r10, rbx
mov r10, qword [rsp + 0x30]
xchg rbx, r10
add rsp, 0x20
push rax
push rcx
push rcx
push rax
push rdx
push rcx
push rcx
push rax
xchg qword [rsp + 0x40], rdi
add rsp, 0x48
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c250
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
push 0x3eb45336
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xa]
mov rdx, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 9
add byte [rbx + rax], 0x30
sub byte [rbx + rax], 5
sub byte [rbx + rax], 0xa
sub byte [rbx + rax], 5
add byte [rbx + rax], 0x1e
add byte [rbx + rax], 0x1c
xor byte [rbx + rax], 0x11
xor byte [rbx + rax], 0x4e
inc rax
cmp rax, 0x12
jb 0x14007c27a
xchg rcx, rax
mov rcx, rdi
xchg rcx, rax
xchg rbp, rbx
mov rbp, qword [rsp + 0x30]
xchg rbx, rbp
add rsp, 0x20
push rax
push rax
push rcx
push rax
push rbx
push rbx
xchg qword [rsp + 0x30], rdi
add rsp, 0x38
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c2e0
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 8], r13
xchg r13, rbx
xchg rdx, r9
mov qword [rsp + 0x10], r9
xchg rdx, r9
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x10]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x1b
xor byte [rbx + rax], 2
add byte [rbx + rax], 3
add byte [rbx + rax], 0x27
xor byte [rbx + rax], 7
xor byte [rbx + rax], 0x47
sub byte [rbx + rax], 3
inc rax
cmp rax, 0x1e
jb 0x14007c313
xchg r11, rax
mov r11, rdi
xchg r11, rax
xchg rbx, r8
mov r8, qword [rsp + 0x30]
xchg r8, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c360
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r13, rdx
mov qword [rsp + 0x10], r13
xchg rdx, r13
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x12]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 7
add byte [rbx + rax], 0x53
add byte [rbx + rax], 0x20
sub byte [rbx + rax], 0x3e
add byte [rbx + rax], 0xa
xor byte [rbx + rax], 0x27
sub byte [rbx + rax], 0x61
inc rax
cmp rax, 0x20
jb 0x14007c38d
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c3e0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg rbx, r12
xchg r10, rdx
mov qword [rsp + 0x10], r10
xchg rdx, r10
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x12]
mov rdx, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x7c
xor byte [rbx + rax], 0x7f
add byte [rbx + rax], 0x4e
sub byte [rbx + rax], 0x3e
add byte [rbx + rax], 0x40
add byte [rbx + rax], 0x2b
sub byte [rbx + rax], 0x45
xor byte [rbx + rax], 0x18
sub byte [rbx + rax], 0x21
inc rax
cmp rax, 0x22
jb 0x14007c413
xchg r8, rdi
mov rax, r8
xchg r8, rdi
xchg rbx, rdi
mov rdi, qword [rsp + 0x30]
xchg rdi, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c470
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rsi, rdx
mov qword [rsp + 0x10], rsi
xchg rdx, rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x14]
xchg rsi, rdx
mov rsi, rbx
xchg rsi, rdx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x6a
xor byte [rbx + rax], 0x61
xor byte [rbx + rax], 0x5b
xor byte [rbx + rax], 0x64
xor byte [rbx + rax], 0x12
xor byte [rbx + rax], 0x1e
xor byte [rbx + rax], 0x38
inc rax
cmp rax, 0x24
jb 0x14007c49d
xchg r15, rax
mov r15, rdi
xchg r15, rax
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c4f0
Capabilities:
Encode data using xor

Disassembly:
xchg r10, rbx
mov qword [rsp + 8], r10
xchg r10, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x14]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x75
sub byte [rbx + rax], 0x15
sub byte [rbx + rax], 3
xor byte [rbx + rax], 0x30
xor byte [rbx + rax], 6
sub byte [rbx + rax], 0x39
sub byte [rbx + rax], 0x32
inc rax
cmp rax, 0x26
jb 0x14007c51d
mov rax, rdi
xchg r9, rbx
mov r9, qword [rsp + 0x30]
xchg r9, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c570
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rcx
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x16]
xchg rbp, rbx
mov rdx, rbp
xchg rbp, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x1a
xor byte [rbx + rax], 0x2e
add byte [rbx + rax], 0x13
xor byte [rbx + rax], 0x75
xor byte [rbx + rax], 0x58
sub byte [rbx + rax], 0x35
sub byte [rbx + rax], 0x35
inc rax
cmp rax, 0x28
jb 0x14007c59b
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c5e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r12, rdx
mov qword [rsp + 0x10], r12
xchg r12, rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x16]
xchg rdx, rcx
mov rcx, rbx
xchg rcx, rdx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x50
sub byte [rbx + rax], 0x15
sub byte [rbx + rax], 0xd
add byte [rbx + rax], 0x4c
sub byte [rbx + rax], 0x63
add byte [rbx + rax], 0x5d
sub byte [rbx + rax], 0x61
xor byte [rbx + rax], 0x24
xor byte [rbx + rax], 0x37
inc rax
cmp rax, 0x2a
jb 0x14007c613
xchg r13, rax
mov r13, rdi
xchg r13, rax
xchg r13, rbx
mov r13, qword [rsp + 0x30]
xchg r13, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c670
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rbx
mov qword [rsp + 8], rbp
xchg rbx, rbp
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg r13, rdi
mov r13, rcx
xchg rdi, r13
lea rbx, [rdx + 0x18]
mov rdx, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x12
add byte [rbx + rax], 0x25
xor byte [rbx + rax], 0x24
add byte [rbx + rax], 0x51
xor byte [rbx + rax], 0x2e
sub byte [rbx + rax], 0x25
sub byte [rbx + rax], 0x25
inc rax
cmp rax, 0x2e
jb 0x14007c69d
xchg rdi, r14
mov rax, r14
xchg rdi, r14
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x14007c6e0
Capabilities:
Encode data using xor

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg r12, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rbx, rdi
mov rbx, rcx
xchg rbx, rdi
lea rbx, [rdx + 0x1a]
xchg r14, rbx
mov rdx, r14
xchg r14, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x46
xor byte [rbx + rax], 0x1d
xor byte [rbx + rax], 0x18
xor byte [rbx + rax], 6
xor byte [rbx + rax], 0x40
add byte [rbx + rax], 0x14
xor byte [rbx + rax], 0x19
inc rax
cmp rax, 0x32
jb 0x14007c713
xchg r12, rdi
mov rax, r12
xchg rdi, r12
xchg rbx, r8
mov r8, qword [rsp + 0x30]
xchg r8, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c770
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r11, rdx
mov qword [rsp + 0x10], r11
xchg r11, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r12, rcx
mov rdi, r12
xchg rcx, r12
lea rbx, [rdx + 0x1c]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x57
xor byte [rbx + rax], 0x39
sub byte [rbx + rax], 0x55
xor byte [rbx + rax], 0x2c
add byte [rbx + rax], 0x25
sub byte [rbx + rax], 0x5a
inc rax
cmp rax, 0x34
jb 0x14007c7ab
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c7f0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 8], r15
xchg rbx, r15
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x1c]
mov rdx, rbx
call fcn.14007ab80
nop
xor eax, eax
mov byte [rbx + rax], 0x71
sub byte [rbx + rax], 0xa
xor byte [rbx + rax], 0x4c
xor byte [rbx + rax], 0x40
sub byte [rbx + rax], 0x37
sub byte [rbx + rax], 0x12
add byte [rbx + rax], 0x55
xor byte [rbx + rax], 0x77
inc rax
cmp rax, 0x36
jb 0x14007c820
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]