joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140033c30
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 0x10], r14
xchg rbx, r14
xchg rbp, r9
mov qword [rsp + 0x18], r9
xchg r9, rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg r8, rbx
mov r8, rbx
xchg r8, rbx
xchg rdx, rsi
mov rdx, rsi
xchg rsi, rdx
xchg rbp, rcx
mov rcx, rbp
xchg rcx, rbp
jne 0x140033d0d
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 0x10]
xchg rsi, rdx
mov rsi, rdx
xchg rdx, rsi
mov rcx, rbp
call fcn.140033c30
xchg r9, rdi
mov r9, rbx
xchg r9, rdi
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004cbd0
mov edx, 0x3fc9d049
sub edx, 0xa8b2b21
add edx, 0x12ab5cff
add edx, 0x16c2d1b4
xor edx, 0x29d976c6
sub edx, 0x76a3e5fb
add edx, 0x312da65c
sub edx, 0xf22e097
xor edx, 0x22dc84b7
xchg rdi, rcx
mov rdi, rcx
xchg rdi, rcx
call fcn.1401fc804
cmp byte [rbx + 0x19], 0
je 0x140033c8b
xchg rdi, rsi
mov rsi, qword [rsp + 0x30]
xchg rsi, rdi
xchg rbx, r12
mov r12, qword [rsp + 0x38]
xchg rbx, r12
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
nop
mov rsi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140033d40
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r8
mov qword [rsp + 0x10], r8
xchg r8, rbx
xchg rbp, rbx
mov qword [rsp + 0x18], rbx
xchg rbx, rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
mov rbx, r8
xchg rsi, rdx
mov rdx, rsi
xchg rsi, rdx
mov rbp, rcx
jne 0x140033e0b
xchg r12, rdi
mov qword [rsp + 0x30], r12
xchg r12, rdi
nop dword [rax]
nop dword [rax + rax]
xchg rsi, r8
mov rsi, qword [rbx + 0x10]
xchg rsi, r8
xchg rdx, r9
mov r9, rsi
xchg r9, rdx
xchg rcx, r15
mov r15, rbp
xchg r15, rcx
call fcn.140033d40
xchg rdi, rbx
mov rbx, rdi
xchg rdi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004cbd0
mov edx, 0x3173dfd3
add edx, 0x3e131a4f
sub edx, 0x3a9ff2f8
add edx, 0x2d02dd84
sub edx, 0x1096d2c2
xor edx, 0x515311bc
xchg r15, rcx
mov r15, rdi
xchg r15, rcx
call fcn.1401fc804
cmp byte [rbx + 0x19], 0
je 0x140033d95
mov rdi, qword [rsp + 0x30]
xchg rsi, rbx
mov rsi, qword [rsp + 0x38]
xchg rsi, rbx
xchg r14, rbp
mov r14, qword [rsp + 0x40]
xchg r14, rbp
add rsp, 0x20
push rdx
push rcx
push rbx
push rdx
push rax
push rbx
push rbx
push rax
xchg qword [rsp + 0x40], rsi
pop rax
pop rbx
pop rbx
pop rax
pop rdx
pop rbx
pop rcx
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140035a40
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, r12
mov qword [rsp + 8], r12
xchg r12, rcx
nop
push r8
mov qword [rsp], rbx
nop
sub rsp, 8
mov qword [rsp], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r12
push r13
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x30
xchg rdx, r10
mov r15, r10
xchg r10, rdx
xchg rcx, rbp
mov r14, rbp
xchg rcx, rbp
movabs rsi, 0xfffffff5dc52f76
xor rsi, 0x2603e06c
sub rsi, 0x480fc487
xor rsi, 0x69a2b08c
xor rsi, 0x59f8ecdb
add rsi, 0x6cae6931
add rsi, 0x7fffffff
add rsi, 0xf64400b
cmp rdx, rsi
ja 0x140035c98
xchg r12, r15
mov r15, qword [rcx + 8]
xchg r12, r15
sub r12, qword [rcx]
sar r12, 1
sar r12, 2
sar r12, 1
mov rcx, qword [rcx + 0x10]
sub rcx, qword [r14]
sar rcx, 3
sar rcx, 1
xchg rdi, rdx
mov rdi, rcx
xchg rdi, rdx
shr rdx, 1
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
sub rax, rdx
cmp rcx, rax
ja 0x140035b2b
lea rsi, [rdx + rcx]
cmp rsi, r15
cmovb rsi, r15
xchg rsi, rbx
mov qword [rsp + 0x88], rbx
xchg rbx, rsi
xchg rsi, rdx
mov rsi, rdx
xchg rsi, rdx
xchg rbp, r14
mov rcx, rbp
xchg r14, rbp
call fcn.1400536d0
mov r13, rax
xchg r9, rax
mov qword [rsp + 0x28], r9
xchg r9, rax
xchg rbx, rdi
mov rdi, r12
xchg rbx, rdi
shl rbx, 4
add rbx, rax
xchg rbx, r13
mov qword [rsp + 0x20], r13
xchg rbx, r13
xchg rdi, rbx
mov rbx, r15
xchg rdi, rbx
sub rdi, r12
xchg r15, rbx
mov qword [rsp + 0x78], r15
xchg r15, rbx
je 0x140035be0
nop word [rax + rax]
mov byte [rbx], 0x43
add byte [rbx], 0x20
xor byte [rbx], 0x7e
add byte [rbx], 0xa
add byte [rbx], 0x22
xor byte [rbx], 0x49
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004b9c0
nop
nop
sub rbx, 0x3f12c36f
add rbx, 0x3f12c37f
xchg rbx, rbp
mov qword [rsp + 0x78], rbp
xchg rbx, rbp
sub rdi, 1
jne 0x140035b9e
mov r8, qword [r14 + 8]
xchg rdx, r8
mov r8, r13
xchg r8, rdx
mov rcx, qword [r14]
cmp rcx, r8
je 0x140035c2b
xor r9d, r9d
movzx eax, byte [rcx]
mov byte [rdx], al
mov rax, qword [rcx + 8]
xchg r12, rax
mov qword [rdx + 8], r12
xchg r12, rax
mov byte [rcx], r9b
xchg r9, rdi
mov qword [rcx + 8], rdi
xchg rdi, r9
lea rdx, [rdx + 0x10]
sub rcx, 0xfffffffffffffff0
cmp rcx, r8
jne 0x140035bfc
xchg rsi, r9
mov rsi, r9
xchg rsi, r9
mov r8, r15
mov rdx, r13
xchg rdi, r14
mov rcx, rdi
xchg r14, rdi
add rsp, 0x30
nop
mov r15, qword [rsp]
add rsp, 8
push rbx
xchg qword [rsp + 8], r14
pop rbx
add rsp, 8
nop
add rsp, 8
mov r13, qword [rsp - 8]
push rdx
push rbx
push rax
push rcx
push rdx
push rdx
push rcx
push rax
xchg qword [rsp + 0x40], r12
add rsp, 0x48
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
xchg qword [rsp], rsi
add rsp, 8
nop
add rsp, 8
mov rbx, qword [rsp - 8]
jmp fcn.140052850
call fcn.14002f9b0
int3
Function at 0x140035d10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdx, r13
mov rdi, r13
xchg r13, rdx
xchg rbx, rdx
mov rdx, rcx
xchg rdx, rbx
test rdx, rdx
je 0x140035d76
nop word [rax + rax]
mov byte [rbx], 0x79
xor byte [rbx], 0x17
xor byte [rbx], 0x30
xor byte [rbx], 6
sub byte [rbx], 0x1c
xor byte [rbx], 0x60
xor byte [rbx], 0x5c
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004b9c0
nop
neg rbx
add rbx, 0xfffffffffffffff0
neg rbx
sub rdi, 1
jne 0x140035d45
xchg rbx, rdx
mov rax, rdx
xchg rbx, rdx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14004c180
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x58
sub byte [rcx + rax + 6], 0x2a
add byte [rcx + rax + 6], 0x34
sub byte [rcx + rax + 6], 0xb
add byte [rcx + rax + 6], 4
xor byte [rcx + rax + 6], 0x33
sub byte [rcx + rax + 6], 0x68
inc rax
cmp rax, 8
jb 0x14004c182
ret

Function at 0x14004c1b0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x26
sub byte [rcx + rax + 6], 5
add byte [rcx + rax + 6], 0x12
add byte [rcx + rax + 6], 0x26
xor byte [rcx + rax + 6], 0x11
sub byte [rcx + rax + 6], 0x48
inc rax
cmp rax, 0xa
jb 0x14004c1b2
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140076340
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
mov r8d, 0x76a534db
sub r8d, 0x2671a18e
sub r8d, 0x4dfeb70f
add r8d, 0x75a3b65f
sub r8d, 0x1a6f0aa3
add r8d, 0x12b91634
xor r8d, 0x8fdd61d1
test rcx, rcx
je 0x140076446
cmp byte [rcx], 0
je 0x140076446
test rdx, rdx
jne 0x1400763da
nop
movabs rdx, 0xffffffff37bed5ba
add rdx, 0x30ced08b
sub rdx, 0x296d36bb
sub rdx, 0xc6fd0f9
add rdx, 0x2381b71e
add rdx, 0x7fffffff
add rdx, 0x29cdaa51
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x1400763c4
test rdx, rdx
je 0x140076443
xor r10d, r10d
lea r11, [0x140002dd0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
xor rcx, qword [rsp]
add rsp, 0x10
shr r8d, 3
shr r8d, 5
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x1400763ec
not r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007aaf0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 8], rbp
xchg rbp, rbx
push rdi
sub rsp, 0x20
xchg r8, rdi
mov r8, rdx
xchg rdi, r8
xchg rbx, rcx
mov rcx, rbx
xchg rcx, rbx
test rdx, rdx
jne 0x14007ab4d
xchg rdx, r15
mov qword [rcx + 0x10], r15
xchg r15, rdx
xchg rcx, rax
mov rcx, rax
xchg rcx, rax
xchg rbx, r8
mov r8, qword [rsp + 0x30]
xchg rbx, r8
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
nop
movabs r8, 0xffffffff1da6d47d
add r8, 0x4fea982e
add r8, 0xd13357c
xor r8, 0x1f02a0cc
sub r8, 0x62316963
add r8, 0x7fffffff
xor r8, 0x7c8b6678
xchg r8, rcx
mov r8, rcx
xchg r8, rcx
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x14007ab8b
inc rcx
mov eax, 0x30711756
add eax, 0x429362f2
sub eax, 0x4b5a49cf
sub eax, 0x1fa37c84
xor eax, 0x4fec388e
sub eax, 0x281a5cf
sub eax, 0x4568e5aa
mul rcx
xchg r12, rcx
mov qword [rbx + 8], r12
xchg r12, rcx
cmovo rax, r8
xchg rcx, r11
mov r11, rax
xchg rcx, r11
call fcn.1401fc80c
mov r8, qword [rbx + 8]
xchg rdi, r8
mov rdx, r8
xchg r8, rdi
add r8, r8
mov qword [rbx + 0x10], rax
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000ffff
jge 0x14007ac14
dec eax
or eax, 0xffff0000
inc eax
xor edx, edx
mov word [rbx + 2], ax
cmp qword [rbx + 8], rdx
jbe 0x14007ac42
nop
mov rax, qword [rbx + 0x10]
lea rcx, [rax + rdx*2]
movzx eax, word [rbx + 2]
xor word [rcx], ax
inc rdx
cmp rdx, qword [rbx + 8]
jb 0x14007ac26
mov byte [rbx], 0x58
add byte [rbx], 0x1a
sub byte [rbx], 0x26
xor byte [rbx], 0x41
sub byte [rbx], 8
xor byte [rbx], 5
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b220
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg rdx, r9
mov r9, rcx
xchg r9, rdx
test rax, rax
jne 0x14007b239
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x14007b282
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b267
xchg r14, rax
mov r14, qword [rdx + 0x10]
xchg r14, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b247
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x60
xor byte [rdx], 0x4c
sub byte [rdx], 0x24
add byte [rdx], 0x6a
sub byte [rdx], 0x3b
xor byte [rdx], 0x5d
sub byte [rdx], 0x1f
sub byte [rdx], 0x22
xor byte [rdx], 0x28
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b290
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg rcx, rdx
mov rcx, rdx
xchg rdx, rcx
test rax, rax
jne 0x14007b2a9
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x14007b2ef
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b2d4
mov rcx, qword [rdx + 0x10]
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b2b7
xchg rdi, rax
mov rdi, qword [rdx + 0x10]
xchg rdi, rax
mov byte [rdx], reloc.SHLWAPI.dll_SHCreateMemStream
xor byte [rdx], 0x2b
add byte [rdx], 0x56
sub byte [rdx], 0xe
xor byte [rdx], 0x61
add byte [rdx], 0x3b
add byte [rdx], 0xa
xor byte [rdx], 0xe
sub byte [rdx], 0x5c
ret
Function at 0x14007b590
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x14007b604
cmp byte [rcx], 0
je 0x14007b604
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000ffff
jge 0x14007b5bb
dec eax
or eax, 0xffff0000
inc eax
xor word [rbx + 2], ax
xor edx, edx
cmp qword [rbx + 8], rdx
jbe 0x14007b5ec
nop word [rax + rax]
xchg rdi, rax
mov rdi, qword [rbx + 0x10]
xchg rdi, rax
lea rcx, [rax + rdx*2]
movzx eax, word [rbx + 2]
xor word [rcx], ax
inc rdx
cmp rdx, qword [rbx + 8]
jb 0x14007b5d0
mov byte [rbx], 2
add byte [rbx], 0x28
add byte [rbx], 0x42
xor byte [rbx], 0x51
add byte [rbx], 0x26
sub byte [rbx], 0x23
xor byte [rbx], 2
sub byte [rbx], 0x42
add rsp, 0x20
nop
add rsp, 8
mov rbx, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b620
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
mov rdx, rcx
test rax, rax
jne 0x14007b635
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b683
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b668
nop dword [rax + rax]
xchg r9, rax
mov r9, qword [rdx + 0x10]
xchg r9, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b648
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x42
xor byte [rdx], 0x61
sub byte [rdx], 0x1c
add byte [rdx], 0x66
add byte [rdx], 0xf
sub byte [rdx], 0x31
sub byte [rdx], 0x2e
xor byte [rdx], 0x1d
xor byte [rdx], 1
ret

Function at 0x14007bec0
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rdi, rbx
xchg r8, rdx
mov qword [rsp + 0x10], r8
xchg rdx, r8
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rsi, rcx
mov rdi, rsi
xchg rcx, rsi
lea rbx, [rdx + 4]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007aaf0
nop
xor eax, eax
mov byte [rbx + rax], 0xe
xor byte [rbx + rax], 0x1b
xor byte [rbx + rax], 0x3b
xor byte [rbx + rax], 0x61
sub byte [rbx + rax], 0x3a
add byte [rbx + rax], 0xf
sub byte [rbx + rax], 0x20
add byte [rbx + rax], 0x35
sub byte [rbx + rax], 0x39
inc rax
cmp rax, 6
jb 0x14007bf01
xchg r11, rax
mov r11, rdi
xchg r11, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rax
push rdx
push rbx
push rax
push rdx
push rbx
xchg qword [rsp + 0x38], rdi
pop rbx
pop rdx
pop rax
pop rbx
pop rdx
pop rax
pop rbx
add rsp, 8
ret
Function at 0x14007bf60
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg r12, rbx
xchg rdx, rcx
mov qword [rsp + 0x10], rcx
xchg rdx, rcx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r15, rcx
mov rdi, r15
xchg r15, rcx
lea rbx, [rdx + 6]
xchg rbx, r12
mov rdx, r12
xchg r12, rbx
call fcn.14007aaf0
nop
xor eax, eax
mov byte [rbx + rax], 0x64
xor byte [rbx + rax], 6
xor byte [rbx + rax], 0x50
sub byte [rbx + rax], 0xa
add byte [rbx + rax], 0x2d
xor byte [rbx + rax], 0x60
xor byte [rbx + rax], 0x35
inc rax
cmp rax, 8
jb 0x14007bfa2
xchg r8, rdi
mov rax, r8
xchg r8, rdi
xchg r15, rbx
mov r15, qword [rsp + 0x30]
xchg r15, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c000
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg r12, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 6]
xchg rbx, r9
mov rdx, r9
xchg rbx, r9
call fcn.14007aaf0
nop
xor eax, eax
mov byte [rbx + rax], 0x3f
sub byte [rbx + rax], 4
xor byte [rbx + rax], 0x46
sub byte [rbx + rax], 6
sub byte [rbx + rax], 0x1a
sub byte [rbx + rax], 0x5d
inc rax
cmp rax, 0xa
jb 0x14007c033
xchg rdx, rax
mov rdx, rdi
xchg rdx, rax
xchg rbx, r13
mov r13, qword [rsp + 0x30]
xchg r13, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c080
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 8]
xchg r10, rdx
mov r10, rbx
xchg r10, rdx
call fcn.14007aaf0
nop
xor eax, eax
mov byte [rbx + rax], SHCreateMemStream
add byte [rbx + rax], 0xf
add byte [rbx + rax], 0x60
sub byte [rbx + rax], 0x10
sub byte [rbx + rax], 6
xor byte [rbx + rax], 0x12
sub byte [rbx + rax], 0x76
inc rax
cmp rax, 0xe
jb 0x14007c0ad
xchg r11, rax
mov r11, rdi
xchg r11, rax
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c100
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 8], rdi
xchg rdi, rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r10, rdi
mov r10, rcx
xchg r10, rdi
lea rbx, [rdx + 0xa]
mov rdx, rbx
call fcn.14007aaf0
nop
xor eax, eax
mov byte [rbx + rax], 0x66
add byte [rbx + rax], 9
sub byte [rbx + rax], 0xb
xor byte [rbx + rax], 0x49
sub byte [rbx + rax], 4
sub byte [rbx + rax], 0x13
xor byte [rbx + rax], 2
add byte [rbx + rax], 0x18
sub byte [rbx + rax], 0x2c
inc rax
cmp rax, 0x10
jb 0x14007c136
xchg r8, rax
mov r8, rdi
xchg r8, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
xchg qword [rsp + 8], rdi
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007c2a0
Capabilities:
Encode data using xor

Disassembly:
xchg r10, rbx
mov qword [rsp + 8], r10
xchg r10, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, r12
mov rdi, r12
xchg rcx, r12
lea rbx, [rdx + 0x12]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007aaf0
nop
xor eax, eax
mov byte [rbx + rax], 0x66
xor byte [rbx + rax], 0x10
xor byte [rbx + rax], 0x78
add byte [rbx + rax], 0x16
add byte [rbx + rax], 0x18
sub byte [rbx + rax], 0x10
add byte [rbx + rax], 0x10
sub byte [rbx + rax], 0x3c
inc rax
cmp rax, 0x20
jb 0x14007c2d3
xchg r13, rax
mov r13, rdi
xchg r13, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c320
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rbx
mov qword [rsp + 8], rbp
xchg rbp, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x12]
xchg rbx, r11
mov rdx, r11
xchg r11, rbx
call fcn.14007aaf0
nop
xor eax, eax
mov byte [rbx + rax], 0x33
xor byte [rbx + rax], 0x39
add byte [rbx + rax], 0x52
sub byte [rbx + rax], 0x18
xor byte [rbx + rax], 0x7c
sub byte [rbx + rax], 0x38
inc rax
cmp rax, 0x22
jb 0x14007c353
xchg rdi, r10
mov rax, r10
xchg r10, rdi
xchg rbx, rbp
mov rbp, qword [rsp + 0x30]
xchg rbp, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c3a0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r10
mov qword [rsp + 8], r10
xchg rbx, r10
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, r9
mov rdi, r9
xchg r9, rcx
lea rbx, [rdx + 0x14]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007aaf0
nop
xor eax, eax
mov byte [rbx + rax], 3
add byte [rbx + rax], 0x76
sub byte [rbx + rax], 0x49
sub byte [rbx + rax], 0x1e
add byte [rbx + rax], 0x3d
xor byte [rbx + rax], 0x51
add byte [rbx + rax], 0x11
sub byte [rbx + rax], 0x2f
inc rax
cmp rax, 0x24
jb 0x14007c3d3
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007c420
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rdx
mov rdx, rcx
xchg rdx, rdi
lea rbx, [rdx + 0x14]
mov rdx, rbx
call fcn.14007aaf0
nop
xor eax, eax
mov byte [rbx + rax], 0xe
add byte [rbx + rax], 0x20
sub byte [rbx + rax], 0x14
xor byte [rbx + rax], 0x30
add byte [rbx + rax], 5
xor byte [rbx + rax], 0x3f
xor byte [rbx + rax], 0x10
inc rax
cmp rax, 0x26
jb 0x14007c44f
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rsi
mov rsi, qword [rsp + 0x30]
xchg rsi, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret
Function at 0x14007c4a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, r10
mov rdi, r10
xchg rcx, r10
lea rbx, [rdx + 0x16]
xchg rdx, rcx
mov rcx, rbx
xchg rcx, rdx
call fcn.14007aaf0
nop
xor eax, eax
mov byte [rbx + rax], 0x36
sub byte [rbx + rax], 0x2e
add byte [rbx + rax], 0x22
sub byte [rbx + rax], 0x26
add byte [rbx + rax], 0x5e
sub byte [rbx + rax], 0x44
add byte [rbx + rax], 0x48
add byte [rbx + rax], 1
xor byte [rbx + rax], 0x67
inc rax
cmp rax, 0x28
jb 0x14007c4d5
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rbp
mov rbp, qword [rsp + 0x30]
xchg rbp, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c530
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r9
mov qword [rsp + 8], r9
xchg rbx, r9
xchg rbp, rdx
mov qword [rsp + 0x10], rbp
xchg rbp, rdx
nop
push r8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x16]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007aaf0
nop
xor eax, eax
mov byte [rbx + rax], 2
xor byte [rbx + rax], 0x25
xor byte [rbx + rax], 0x59
sub byte [rbx + rax], 0x5e
xor byte [rbx + rax], 0x71
xor byte [rbx + rax], 0x51
inc rax
cmp rax, 0x2a
jb 0x14007c56f
xchg r15, rax
mov r15, rdi
xchg r15, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rcx
xchg qword [rsp + 0x10], rdi
add rsp, 0x18
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c5c0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg r11, rbx
xchg rdx, rcx
mov qword [rsp + 0x10], rcx
xchg rcx, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x18]
mov rdx, rbx
call fcn.14007aaf0
nop
xor eax, eax
mov byte [rbx + rax], 0xf
xor byte [rbx + rax], 0x15
xor byte [rbx + rax], 3
add byte [rbx + rax], 1
xor byte [rbx + rax], 0x7a
sub byte [rbx + rax], 0x4f
xor byte [rbx + rax], 0x54
add byte [rbx + rax], 0
sub byte [rbx + rax], 0x45
inc rax
cmp rax, 0x2e
jb 0x14007c5f5
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rax
push rbx
push rcx
push rax
xchg qword [rsp + 0x28], rdi
pop rax
pop rcx
pop rbx
pop rax
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c650
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 8], r15
xchg r15, rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x1a]
mov rdx, rbx
call fcn.14007aaf0
nop
xor eax, eax
mov byte [rbx + rax], 0x58
sub byte [rbx + rax], 0x33
add byte [rbx + rax], 0xb
sub byte [rbx + rax], 8
xor byte [rbx + rax], 0x2b
add byte [rbx + rax], 6
sub byte [rbx + rax], 9
inc rax
cmp rax, 0x32
jb 0x14007c686
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rdx
push rcx
push rdx
push rcx
push rax
push rdx
xchg qword [rsp + 0x38], rdi
pop rdx
pop rax
pop rcx
pop rdx
pop rcx
pop rdx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]