joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140076320
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, r9
mov rcx, r9
xchg rcx, r9
mov r8d, 0x5df540c9
sub r8d, 0xa73fbdd
sub r8d, 0x50fb2fc5
add r8d, 0x242ce108
sub r8d, 0x1acaa71d
add r8d, 0xf417b0ed
test rcx, rcx
je 0x14007643a
cmp byte [rcx], 0
je 0x14007643a
test rdx, rdx
jne 0x1400763c7
nop
movabs rdx, 0xffffffff6f0b8d57
sub rdx, 0x37368b88
xor rdx, 0x7f143546
sub rdx, 0x34568c74
xor rdx, 0x6628c2c8
xor rdx, 0x68698b63
add rdx, 0x372aa9f6
add rdx, 0x7fffffff
add rdx, 0x2ea9744c
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x1400763b1
test rdx, rdx
je 0x140076437
xor r10d, r10d
lea r11, [0x140002dd0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
or rcx, qword [rsp]
add rsp, 0x10
shr r8d, 3
shr r8d, 2
shr r8d, 2
shr r8d, 1
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x1400763d9
not r8d
mov eax, r8d
ret

Function at 0x14007b160
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg rcx, rbx
mov rdx, rbx
xchg rcx, rbx
test rax, rax
jne 0x14007b181
xor r8d, r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b1ca
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b1af
xchg r9, rax
mov r9, qword [rdx + 0x10]
xchg r9, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b18f
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x77
xor byte [rdx], 0x15
sub byte [rdx], 0x4d
add byte [rdx], 0x5f
sub byte [rdx], 0x73
add byte [rdx], 6
add byte [rdx], 0x68
sub byte [rdx], 0x3b
sub byte [rdx], 0x33
ret

Function at 0x14007b1d0
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rax
mov r15, qword [rcx + 0x10]
xchg r15, rax
xchg r8, rdx
mov r8, rcx
xchg rdx, r8
test rax, rax
jne 0x14007b1ed
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x14007b22f
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b214
mov rcx, qword [rdx + 0x10]
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b1fb
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x55
add byte [rdx], 0x26
sub byte [rdx], 0x6c
xor byte [rdx], 0x4f
add byte [rdx], 2
sub byte [rdx], 0x1b
xor byte [rdx], 0xf
add byte [rdx], 0x11
xor byte [rdx], 0x38
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007b4d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
xchg rcx, rbx
mov rcx, rbx
xchg rcx, rbx
je 0x14007b546
cmp byte [rcx], 0
je 0x14007b546
push rsi
call 0x140a241ba
and eax, 0x8000ffff
jge 0x14007b501
dec eax
or eax, 0xffff0000
inc eax
xor word [rbx + 2], ax
xor edx, edx
cmp qword [rbx + 8], rdx
jbe 0x14007b52e
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
lea rcx, [rax + rdx*2]
movzx eax, word [rbx + 2]
xor word [rcx], ax
inc rdx
cmp rdx, qword [rbx + 8]
jb 0x14007b516
mov byte [rbx], 0xd
xor byte [rbx], 0xc
xor byte [rbx], 0x36
add byte [rbx], 1
add byte [rbx], 0x11
sub byte [rbx], 0x22
sub byte [rbx], 8
sub byte [rbx], 0x1f
add rsp, 0x20
nop
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b560
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg r15, rdx
mov r15, rcx
xchg rdx, r15
test rax, rax
jne 0x14007b57b
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b5c6
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b5ae
nop dword [rax + rax]
xchg r8, rax
mov r8, qword [rdx + 0x10]
xchg r8, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b58e
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x7a
sub byte [rdx], 0x5f
add byte [rdx], 0x2b
add byte [rdx], 0x28
xor byte [rdx], 0x21
sub byte [rdx], 8
sub byte [rdx], 0xd
sub byte [rdx], 0x39
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007bde0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r9
mov qword [rsp + 8], r9
xchg r9, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, r12
mov rdi, r12
xchg r12, rcx
lea rbx, [rdx + 4]
mov rdx, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x33
xor byte [rbx + rax], 0x30
add byte [rbx + rax], 0x6b
xor byte [rbx + rax], 0x6a
xor byte [rbx + rax], 0x49
add byte [rbx + rax], 0xb
xor byte [rbx + rax], 0x3e
xor byte [rbx + rax], 0x66
inc rax
cmp rax, 6
jb 0x14007be0d
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007be60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rbp
mov qword [rsp + 0x10], rbp
xchg rdx, rbp
push rdi
sub rsp, 0x20
xchg rbx, rdi
mov rbx, rcx
xchg rbx, rdi
lea rbx, [rdx + 6]
xchg rbp, rdx
mov rbp, rbx
xchg rbp, rdx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x3a
add byte [rbx + rax], 0x3a
sub byte [rbx + rax], 0x70
xor byte [rbx + rax], 0x58
xor byte [rbx + rax], 0x55
add byte [rbx + rax], 0x27
sub byte [rbx + rax], 0x29
add byte [rbx + rax], 0x1b
sub byte [rbx + rax], 0x22
inc rax
cmp rax, 8
jb 0x14007be93
mov rax, rdi
xchg r11, rbx
mov r11, qword [rsp + 0x30]
xchg rbx, r11
add rsp, 0x20
push rcx
push rbx
xchg qword [rsp + 0x10], rdi
pop rbx
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007bf60
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r8
mov qword [rsp + 8], r8
xchg r8, rbx
xchg rbp, rdx
mov qword [rsp + 0x10], rbp
xchg rbp, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 8]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x3d
xor byte [rbx + rax], 0x6b
xor byte [rbx + rax], 1
xor byte [rbx + rax], 0x23
sub byte [rbx + rax], 0xf
sub byte [rbx + rax], 0x65
inc rax
cmp rax, 0xe
jb 0x14007bfa1
xchg r8, rdi
mov rax, r8
xchg rdi, r8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007bfe0
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rbx
mov qword [rsp + 8], rdx
xchg rbx, rdx
xchg rdx, r13
mov qword [rsp + 0x10], r13
xchg r13, rdx
nop
push r10
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, r12
mov rdi, r12
xchg rcx, r12
lea rbx, [rdx + 0xa]
xchg r12, rdx
mov r12, rbx
xchg rdx, r12
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x5f
xor byte [rbx + rax], 0x2a
sub byte [rbx + rax], 0x71
add byte [rbx + rax], 0x17
add byte [rbx + rax], 0x62
xor byte [rbx + rax], 0x3a
sub byte [rbx + rax], 0x47
inc rax
cmp rax, 0x10
jb 0x14007c01f
mov rax, rdi
xchg r14, rbx
mov r14, qword [rsp + 0x30]
xchg r14, rbx
add rsp, 0x20
push rbx
push rdx
push rbx
push rax
push rcx
xchg qword [rsp + 0x28], rdi
pop rcx
pop rax
pop rbx
pop rdx
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c080
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg r11, rbx
xchg r15, rdx
mov qword [rsp + 0x10], r15
xchg rdx, r15
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r8, rcx
mov rdi, r8
xchg r8, rcx
lea rbx, [rdx + 0xa]
mov rdx, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x5a
xor byte [rbx + rax], 0x18
sub byte [rbx + rax], 0x1e
sub byte [rbx + rax], 0x1f
add byte [rbx + rax], 0x14
xor byte [rbx + rax], 0x7d
sub byte [rbx + rax], 0x64
inc rax
cmp rax, 0x12
jb 0x14007c0bb
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, r13
mov r13, qword [rsp + 0x30]
xchg r13, rbx
add rsp, 0x20
push rdx
push rcx
push rbx
push rdx
push rcx
push rcx
push rax
xchg qword [rsp + 0x38], rdi
pop rax
pop rcx
pop rcx
pop rdx
pop rbx
pop rcx
pop rdx
add rsp, 8
ret

Function at 0x14007c110
Capabilities:
Encode data using xor

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg r12, rbx
xchg rdx, r9
mov qword [rsp + 0x10], r9
xchg rdx, r9
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x10]
xchg r8, rdx
mov r8, rbx
xchg rdx, r8
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], SHCreateMemStream
add byte [rbx + rax], 0x39
sub byte [rbx + rax], 0x28
sub byte [rbx + rax], 0x1c
add byte [rbx + rax], 0x59
sub byte [rbx + rax], 0x13
xor byte [rbx + rax], 0x7d
sub byte [rbx + rax], 0x3b
inc rax
cmp rax, 0x1e
jb 0x14007c149
xchg rdi, rbp
mov rax, rbp
xchg rdi, rbp
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c1a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r12, rcx
mov rdi, r12
xchg r12, rcx
lea rbx, [rdx + 0x12]
xchg r12, rdx
mov r12, rbx
xchg r12, rdx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x15
xor byte [rbx + rax], 5
xor byte [rbx + rax], 0x74
sub byte [rbx + rax], 0x56
add byte [rbx + rax], 0x6d
sub byte [rbx + rax], 0x38
add byte [rbx + rax], 0x32
sub byte [rbx + rax], 0x75
inc rax
cmp rax, 0x20
jb 0x14007c1d5
xchg r15, rdi
mov rax, r15
xchg rdi, r15
xchg r14, rbx
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c230
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rbx
mov qword [rsp + 8], rdx
xchg rdx, rbx
xchg rdx, rbp
mov qword [rsp + 0x10], rbp
xchg rdx, rbp
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, r13
mov rdi, r13
xchg r13, rcx
lea rbx, [rdx + 0x12]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x72
sub byte [rbx + rax], 0x2f
add byte [rbx + rax], 0x13
xor byte [rbx + rax], 0
xor byte [rbx + rax], 0x4d
sub byte [rbx + rax], 0xd
sub byte [rbx + rax], 0xe
inc rax
cmp rax, 0x22
jb 0x14007c272
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c2c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r8
mov r8, rcx
xchg rdi, r8
lea rbx, [rdx + 0x14]
mov rdx, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x75
xor byte [rbx + rax], 0x29
sub byte [rbx + rax], 0x22
add byte [rbx + rax], 0x24
xor byte [rbx + rax], 0x2f
xor byte [rbx + rax], 0x38
xor byte [rbx + rax], 0x49
inc rax
cmp rax, 0x24
jb 0x14007c2ef
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c340
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r13
mov qword [rsp + 0x10], r13
xchg r13, rdx
push rdi
sub rsp, 0x20
xchg rdx, rdi
mov rdx, rcx
xchg rdi, rdx
lea rbx, [rdx + 0x14]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x10
xor byte [rbx + rax], 0x12
add byte [rbx + rax], 0x3a
sub byte [rbx + rax], 0x14
add byte [rbx + rax], 0x4c
sub byte [rbx + rax], 0x74
inc rax
cmp rax, 0x26
jb 0x14007c373
xchg rbp, rax
mov rbp, rdi
xchg rbp, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rax
push rdx
push rdx
push rax
push rbx
push rdx
xchg qword [rsp + 0x38], rdi
add rsp, 0x40
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c3c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x16]
xchg rdx, rbp
mov rbp, rbx
xchg rdx, rbp
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x33
xor byte [rbx + rax], 0x68
sub byte [rbx + rax], 0xe
add byte [rbx + rax], 0x1a
xor byte [rbx + rax], 0x21
sub byte [rbx + rax], 0x46
inc rax
cmp rax, 0x28
jb 0x14007c3ed
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rdx
push rdx
push rbx
push rdx
xchg qword [rsp + 0x28], rdi
pop rdx
pop rbx
pop rdx
pop rdx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c440
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rbx
mov qword [rsp + 8], rdx
xchg rbx, rdx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x16]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x7d
xor byte [rbx + rax], 0x27
sub byte [rbx + rax], 3
xor byte [rbx + rax], 0x42
add byte [rbx + rax], 0x33
sub byte [rbx + rax], 0x18
xor byte [rbx + rax], 0xf
xor byte [rbx + rax], 0x3f
inc rax
cmp rax, 0x2a
jb 0x14007c475
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x14007c4c0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rbx, rcx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r14, rcx
mov rdi, r14
xchg rcx, r14
lea rbx, [rdx + 0x18]
xchg r15, rdx
mov r15, rbx
xchg r15, rdx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x1a
xor byte [rbx + rax], 0x66
xor byte [rbx + rax], 0x26
sub byte [rbx + rax], 0x53
add byte [rbx + rax], 0x22
sub byte [rbx + rax], 0x29
inc rax
cmp rax, 0x2e
jb 0x14007c4fc
mov rax, rdi
xchg rsi, rbx
mov rsi, qword [rsp + 0x30]
xchg rsi, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c550
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg r12, rbx
xchg rbp, rdx
mov qword [rsp + 0x10], rbp
xchg rdx, rbp
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x1a]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x56
xor byte [rbx + rax], 0x60
add byte [rbx + rax], 0x2b
sub byte [rbx + rax], 6
xor byte [rbx + rax], 0x4e
sub byte [rbx + rax], 0x15
inc rax
cmp rax, 0x32
jb 0x14007c589
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c5e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x1c]
mov rdx, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x53
sub byte [rbx + rax], 0xc
sub byte [rbx + rax], 0x23
add byte [rbx + rax], 0x15
xor byte [rbx + rax], 0x27
xor byte [rbx + rax], 0xb
sub byte [rbx + rax], 0x15
inc rax
cmp rax, 0x34
jb 0x14007c60a
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007c750
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r8
mov qword [rsp + 0x10], r8
xchg r8, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x20]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x3b
xor byte [rbx + rax], 0x4c
xor byte [rbx + rax], 0x54
add byte [rbx + rax], 0x51
sub byte [rbx + rax], 0x1e
sub byte [rbx + rax], 0x23
add byte [rbx + rax], 0x29
sub byte [rbx + rax], 0x5c
inc rax
cmp rax, 0x3e
jb 0x14007c78b
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c7e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, r14
mov r14, rcx
xchg rdi, r14
lea rbx, [rdx + 0x22]
xchg r10, rbx
mov rdx, r10
xchg rbx, r10
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x1b
xor byte [rbx + rax], 0x7d
xor byte [rbx + rax], 0x52
add byte [rbx + rax], 0x16
sub byte [rbx + rax], 0x34
sub byte [rbx + rax], 0xd
sub byte [rbx + rax], 9
inc rax
cmp rax, 0x40
jb 0x14007c80d
xchg r9, rax
mov r9, rdi
xchg r9, rax
xchg rbx, rbp
mov rbp, qword [rsp + 0x30]
xchg rbp, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c860
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 8], rdi
xchg rdi, rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x22]
mov rdx, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x2f
add byte [rbx + rax], 0x36
sub byte [rbx + rax], 1
xor byte [rbx + rax], 0x10
sub byte [rbx + rax], 0x6c
add byte [rbx + rax], 0x18
xor byte [rbx + rax], 0x66
add byte [rbx + rax], 6
sub byte [rbx + rax], 0x4c
inc rax
cmp rax, 0x42
jb 0x14007c896
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c8f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x24]
xchg r13, rdx
mov r13, rbx
xchg r13, rdx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0xe
xor byte [rbx + rax], 0x66
sub byte [rbx + rax], 0x3f
add byte [rbx + rax], 0x41
sub byte [rbx + rax], 0x28
xor byte [rbx + rax], 0x7a
xor byte [rbx + rax], 0x4b
sub byte [rbx + rax], 0x73
inc rax
cmp rax, 0x46
jb 0x14007c925
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007c970
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rbp
mov rbp, rcx
xchg rbp, rdi
lea rbx, [rdx + 0x28]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 4
add byte [rbx + rax], 0x13
add byte [rbx + rax], 0x5c
sub byte [rbx + rax], 0x6f
xor byte [rbx + rax], 8
xor byte [rbx + rax], 0x3a
add byte [rbx + rax], 0x48
sub byte [rbx + rax], 0x7e
inc rax
cmp rax, 0x4c
jb 0x14007c9a6
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007ca00
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rdi, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x2a]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x76
xor byte [rbx + rax], 0x7d
add byte [rbx + rax], 0x42
add byte [rbx + rax], 0x1a
sub byte [rbx + rax], 0xe
add byte [rbx + rax], 7
sub byte [rbx + rax], 0x5c
xor byte [rbx + rax], 4
inc rax
cmp rax, 0x50
jb 0x14007ca2d
xchg r9, rdi
mov rax, r9
xchg r9, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rcx
push rcx
push rbx
xchg qword [rsp + 0x20], rdi
pop rbx
pop rcx
pop rcx
pop rbx
add rsp, 8
ret

Function at 0x14007ca80
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rbx
mov qword [rsp + 8], r14
xchg rbx, r14
xchg rbx, rdx
mov qword [rsp + 0x10], rbx
xchg rdx, rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rbx, rdi
mov rbx, rcx
xchg rbx, rdi
lea rbx, [rdx + 0x2a]
mov rdx, rbx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x35
add byte [rbx + rax], 0x2b
sub byte [rbx + rax], 0x2d
xor byte [rbx + rax], 0x78
xor byte [rbx + rax], 0x23
sub byte [rbx + rax], 6
sub byte [rbx + rax], 0x62
xor byte [rbx + rax], 0x14
xor byte [rbx + rax], 0x14
inc rax
cmp rax, 0x52
jb 0x14007cabc
xchg rdi, r8
mov rax, r8
xchg r8, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rbx
push rcx
push rdx
push rax
push rax
push rax
xchg qword [rsp + 0x38], rdi
add rsp, 0x40
ret
Function at 0x14007cb10
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 8], rbp
xchg rbx, rbp
mov qword [rsp + 0x10], rdx
nop
push r12
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x2c]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], reloc.SHLWAPI.dll_SHCreateMemStream
xor byte [rbx + rax], 0x2b
add byte [rbx + rax], 0x13
sub byte [rbx + rax], 0xc
sub byte [rbx + rax], 3
xor byte [rbx + rax], 0x2b
inc rax
cmp rax, 0x54
jb 0x14007cb43
xchg r9, rax
mov r9, rdi
xchg r9, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rbx
push rdx
push rax
push rbx
push rbx
push rax
push rcx
xchg qword [rsp + 0x40], rdi
add rsp, 0x48
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cb90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rdi
mov qword [rsp + 0x10], rdi
xchg rdx, rdi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, r13
mov rdi, r13
xchg r13, rcx
lea rbx, [rdx + 0x2e]
xchg rdx, rcx
mov rcx, rbx
xchg rdx, rcx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x5b
xor byte [rbx + rax], 0x18
sub byte [rbx + rax], 0x38
xor byte [rbx + rax], 0x71
xor byte [rbx + rax], 0x72
xor byte [rbx + rax], 8
inc rax
cmp rax, 0x58
jb 0x14007cbcc
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007cc10
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, r8
mov rdi, r8
xchg rcx, r8
lea rbx, [rdx + 0x2e]
xchg rdx, r13
mov r13, rbx
xchg r13, rdx
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 1
add byte [rbx + rax], 0x64
xor byte [rbx + rax], 0xb
xor byte [rbx + rax], 6
xor byte [rbx + rax], 0x3f
sub byte [rbx + rax], 0x57
inc rax
cmp rax, 0x5a
jb 0x14007cc3d
xchg rbx, rax
mov rbx, rdi
xchg rbx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rcx
push rdx
push rbx
push rdx
push rdx
xchg qword [rsp + 0x30], rdi
add rsp, 0x38
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cc90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r12
mov qword [rsp + 0x10], r12
xchg rdx, r12
push rdi
sub rsp, 0x20
xchg r13, rdi
mov r13, rcx
xchg rdi, r13
lea rbx, [rdx + 0x30]
xchg rdx, r11
mov r11, rbx
xchg rdx, r11
call fcn.14007aa00
nop
xor eax, eax
mov byte [rbx + rax], 0x63
sub byte [rbx + rax], 0xa
xor byte [rbx + rax], 0x22
sub byte [rbx + rax], 0x27
add byte [rbx + rax], 7
sub byte [rbx + rax], 0x33
xor byte [rbx + rax], 0x77
xor byte [rbx + rax], 0x5f
inc rax
cmp rax, 0x5c
jb 0x14007ccc3
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]