joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007cd20
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 8], r14
xchg r14, rbx
xchg rsi, rdx
mov qword [rsp + 0x10], rsi
xchg rsi, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r13, rdi
mov r13, rcx
xchg rdi, r13
lea rbx, [rdx + 0x2c]
xchg rdx, r11
mov r11, rbx
xchg r11, rdx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 1
add byte [rbx + rax], 0x2e
add byte [rbx + rax], 0x1e
add byte [rbx + rax], 0x14
sub byte [rbx + rax], 0xc
xor byte [rbx + rax], 0x55
inc rax
cmp rax, 0x54
jb 0x14007cd62
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, r15
mov r15, qword [rsp + 0x30]
xchg r15, rbx
add rsp, 0x20
push rcx
push rcx
push rcx
xchg qword [rsp + 0x18], rdi
add rsp, 0x20
ret

Function at 0x14007cdb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rcx, rdx
mov qword [rsp + 0x10], rcx
xchg rdx, rcx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x2e]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x78
sub byte [rbx + rax], 0x68
xor byte [rbx + rax], 9
xor byte [rbx + rax], 0x5f
sub byte [rbx + rax], 0x12
sub byte [rbx + rax], 1
add byte [rbx + rax], 0x3b
sub byte [rbx + rax], 0x6e
inc rax
cmp rax, 0x58
jb 0x14007cdeb
mov rax, rdi
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
push rax
push rbx
push rdx
push rbx
push rdx
push rbx
xchg qword [rsp + 0x30], rdi
add rsp, 0x38
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007ce40
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rsi
mov qword [rsp + 8], rsi
xchg rbx, rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x2e]
mov rdx, rbx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x34
xor byte [rbx + rax], 0xe
xor byte [rbx + rax], 0x77
sub byte [rbx + rax], 0x25
add byte [rbx + rax], 0x2c
sub byte [rbx + rax], 0xc
sub byte [rbx + rax], 0xd
sub byte [rbx + rax], 0x3b
inc rax
cmp rax, 0x5a
jb 0x14007ce6d
mov rax, rdi
xchg rbx, rcx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cec0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
xchg rbp, rbx
mov qword [rsp + 8], rbp
xchg rbx, rbp
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x30]
xchg rbx, r14
mov rdx, r14
xchg r14, rbx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x6b
xor byte [rbx + rax], 0x64
add byte [rbx + rax], 0x24
add byte [rbx + rax], 0xf
sub byte [rbx + rax], 0x11
xor byte [rbx + rax], 0xd
add byte [rbx + rax], 0x2b
xor byte [rbx + rax], 0x51
sub byte [rbx + rax], 0x36
inc rax
cmp rax, 0x5c
jb 0x14007cefc
xchg r11, rdi
mov rax, r11
xchg r11, rdi
xchg rbx, rsi
mov rsi, qword [rsp + 0x30]
xchg rbx, rsi
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14007cf50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rbx
mov qword [rsp + 0x10], rbx
xchg rbx, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x30]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x6e
sub byte [rbx + rax], 0x40
add byte [rbx + rax], 0x33
xor byte [rbx + rax], 0
xor byte [rbx + rax], 0x4a
add byte [rbx + rax], 0x2d
xor byte [rbx + rax], 0x37
sub byte [rbx + rax], 0x13
xor byte [rbx + rax], 0x5c
inc rax
cmp rax, 0x5e
jb 0x14007cf8b
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cfe0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rsi
mov qword [rsp + 8], rsi
xchg rsi, rbx
mov qword [rsp + 0x10], rdx
nop
push r9
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x32]
xchg rbx, rsi
mov rdx, rsi
xchg rbx, rsi
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x2c
xor byte [rbx + rax], 0x2a
xor byte [rbx + rax], 0x27
sub byte [rbx + rax], 6
add byte [rbx + rax], 0x3b
sub byte [rbx + rax], 0x56
inc rax
cmp rax, 0x60
jb 0x14007d013
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rbp
mov rbp, qword [rsp + 0x30]
xchg rbx, rbp
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d060
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x34]
xchg rbx, r12
mov rdx, r12
xchg rbx, r12
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x4d
add byte [rbx + rax], 9
sub byte [rbx + rax], 0x2d
add byte [rbx + rax], 0x2c
xor byte [rbx + rax], 5
sub byte [rbx + rax], 0x50
inc rax
cmp rax, 0x64
jb 0x14007d087
xchg rdi, rdx
mov rax, rdx
xchg rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d0d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
push 0x6b95083a
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x38]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x26
sub byte [rbx + rax], 0x20
add byte [rbx + rax], 0x74
sub byte [rbx + rax], 0x6f
add byte [rbx + rax], 0x4a
xor byte [rbx + rax], 0x47
add byte [rbx + rax], 0x4f
xor byte [rbx + rax], 0x61
inc rax
cmp rax, 0x6e
jb 0x14007d100
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14007d140
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rbx
mov qword [rsp + 8], r14
xchg r14, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x4e]
xchg rbx, r14
mov rdx, r14
xchg r14, rbx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x76
sub byte [rbx + rax], 0x46
xor byte [rbx + rax], 0x5e
sub byte [rbx + rax], 0x2c
xor byte [rbx + rax], 0x29
sub byte [rbx + rax], 0x57
sub byte [rbx + rax], 0x14
xor byte [rbx + rax], 0x58
sub byte [rbx + rax], 0x58
inc rax
cmp rax, 0x98
jb 0x14007d16d
xchg r10, rdi
mov rax, r10
xchg r10, rdi
xchg rbp, rbx
mov rbp, qword [rsp + 0x30]
xchg rbp, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d1d0
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rdi, rbx
xchg rdx, r12
mov qword [rsp + 0x10], r12
xchg r12, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdx, rdi
mov rdx, rcx
xchg rdi, rdx
lea rbx, [rdx + 0x56]
xchg rcx, rbx
mov rdx, rcx
xchg rbx, rcx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x7d
sub byte [rbx + rax], 0x1b
xor byte [rbx + rax], 0x4a
add byte [rbx + rax], 0x48
sub byte [rbx + rax], 4
sub byte [rbx + rax], 0x6c
inc rax
cmp rax, 0xa8
jb 0x14007d212
xchg rdi, r14
mov rax, r14
xchg rdi, r14
xchg rsi, rbx
mov rsi, qword [rsp + 0x30]
xchg rbx, rsi
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007d260
Capabilities:
Encode data using xor

Disassembly:
xchg r10, rbx
mov qword [rsp + 8], r10
xchg r10, rbx
xchg rdx, r14
mov qword [rsp + 0x10], r14
xchg rdx, r14
push rdx
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x5a]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x49
xor byte [rbx + rax], 0x50
add byte [rbx + rax], 0x3c
add byte [rbx + rax], 0x25
sub byte [rbx + rax], 3
sub byte [rbx + rax], 6
sub byte [rbx + rax], 0x67
add byte [rbx + rax], 0x3f
sub byte [rbx + rax], 0x49
inc rax
cmp rax, 0xb0
jb 0x14007d297
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rbx
push rcx
push rax
push rbx
push rbx
xchg qword [rsp + 0x30], rdi
pop rbx
pop rbx
pop rax
pop rcx
pop rbx
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d300
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rbx
mov qword [rsp + 8], r14
xchg rbx, r14
xchg rbp, rdx
mov qword [rsp + 0x10], rbp
xchg rbp, rdx
push rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x70]
mov rdx, rbx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x3d
sub byte [rbx + rax], 4
sub byte [rbx + rax], 2
add byte [rbx + rax], 0x1f
xor byte [rbx + rax], 0x45
xor byte [rbx + rax], 0x48
sub byte [rbx + rax], 0x18
xor byte [rbx + rax], 0x75
xor byte [rbx + rax], 0x36
inc rax
cmp rax, 0xdc
jb 0x14007d333
mov rax, rdi
xchg rbx, r15
mov r15, qword [rsp + 0x30]
xchg rbx, r15
add rsp, 0x20
push rcx
push rax
push rcx
push rdx
push rdx
push rbx
push rcx
push rdx
xchg qword [rsp + 0x40], rdi
add rsp, 0x48
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d390
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbx, rdx
mov qword [rsp + 0x10], rbx
xchg rbx, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r10, rdi
mov r10, rcx
xchg rdi, r10
lea rbx, [rdx + 0x70]
xchg rdx, r14
mov r14, rbx
xchg r14, rdx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x47
sub byte [rbx + rax], 0x15
add byte [rbx + rax], 7
add byte [rbx + rax], 0x1f
xor byte [rbx + rax], 0x23
xor byte [rbx + rax], 0x18
xor byte [rbx + rax], 0x63
inc rax
cmp rax, 0xde
jb 0x14007d3cc
xchg r10, rax
mov r10, rdi
xchg r10, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x14007d410
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg rbx, r11
xchg r12, rdx
mov qword [rsp + 0x10], r12
xchg r12, rdx
nop
push r13
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r13
mov r13, rcx
xchg rdi, r13
lea rbx, [rdx + 0x76]
mov rdx, rbx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x42
sub byte [rbx + rax], 0x18
xor byte [rbx + rax], 0x22
xor byte [rbx + rax], 0x78
xor byte [rbx + rax], 0x31
xor byte [rbx + rax], 0x5d
xor byte [rbx + rax], 0x1c
inc rax
cmp rax, 0xea
jb 0x14007d449
xchg r9, rax
mov r9, rdi
xchg r9, rax
xchg rbx, r8
mov r8, qword [rsp + 0x30]
xchg r8, rbx
add rsp, 0x20
push rax
push rbx
push rbx
push rax
push rbx
xchg qword [rsp + 0x28], rdi
add rsp, 0x30
ret

Function at 0x14007d4a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, rdx
mov rdx, rcx
xchg rdx, rdi
lea rbx, [rdx + 0x7c]
xchg rbp, rdx
mov rbp, rbx
xchg rbp, rdx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x13
add byte [rbx + rax], 0x62
xor byte [rbx + rax], 0x31
add byte [rbx + rax], 6
xor byte [rbx + rax], 0x57
xor byte [rbx + rax], 0x1d
inc rax
cmp rax, 0xf4
jb 0x14007d4cd
xchg r13, rax
mov r13, rdi
xchg r13, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rcx
push rdx
push rcx
push rdx
push rcx
push rbx
push rbx
xchg qword [rsp + 0x40], rdi
pop rbx
pop rbx
pop rcx
pop rdx
pop rcx
pop rdx
pop rcx
pop rcx
add rsp, 8
ret

Function at 0x14007d520
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdx, rcx
mov rdi, rdx
xchg rcx, rdx
lea rbx, [rdx + 0x9a]
xchg rsi, rdx
mov rsi, rbx
xchg rsi, rdx
call fcn.14007ab90
nop
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbx + rax], 0x2b
sub byte [rbx + rax], 0x11
xor byte [rbx + rax], 0x6f
sub byte [rbx + rax], 0x5e
sub byte [rbx + rax], 1
add byte [rbx + rax], 0
add byte [rbx + rax], 0x5c
xor byte [rbx + rax], 0x72
inc rax
cmp rax, 0x130
jb 0x14007d564
xchg rbx, rax
mov rbx, rdi
xchg rbx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d640
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rsi
mov qword [rsp + 0x10], rsi
xchg rdx, rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, r13
mov r13, rcx
xchg r13, rdi
lea rbx, [rdx + 0xe]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x68
add byte [rbx + rax], 0x15
sub byte [rbx + rax], 0x2f
sub byte [rbx + rax], 0xb
xor byte [rbx + rax], 0xd
sub byte [rbx + rax], 0x4e
inc rax
cmp rax, 0x18
jb 0x14007d67c
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rbx
push rbx
push rdx
push rax
xchg qword [rsp + 0x28], rdi
add rsp, 0x30
ret

Function at 0x14007d6c0
Capabilities:
Encode data using xor

Disassembly:
xchg r11, rbx
mov qword [rsp + 8], r11
xchg r11, rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xe]
xchg rbx, rdi
mov rdx, rdi
xchg rbx, rdi
call fcn.14007ab90
nop
xor eax, eax
mov byte [rbx + rax], 0x16
xor byte [rbx + rax], 0x60
sub byte [rbx + rax], 0x25
sub byte [rbx + rax], 0xb
add byte [rbx + rax], 0x10
sub byte [rbx + rax], 0x56
inc rax
cmp rax, 0x1a
jb 0x14007d6f6
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x1400810d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg r13, rbp
mov qword [rsp + 0x18], r13
xchg rbp, r13
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg r8, rbx
mov r8, rbx
xchg rbx, r8
xchg rsi, rdx
mov rdx, rsi
xchg rdx, rsi
xchg r13, rcx
mov rbp, r13
xchg rcx, r13
jne 0x1400811a1
xchg rdi, r13
mov qword [rsp + 0x30], r13
xchg rdi, r13
nop dword [rax]
nop dword [rax + rax]
xchg r15, r8
mov r15, qword [rbx + 0x10]
xchg r15, r8
xchg rdx, rdi
mov rdi, rsi
xchg rdx, rdi
mov rcx, rbp
call fcn.1400810d0
xchg rdi, r13
mov r13, rbx
xchg r13, rdi
mov rbx, qword [rbx]
lea rcx, [rdi + 0x28]
call fcn.1400915d0
mov edx, 0x5255eb0e
xor edx, 0x32635846
sub edx, 0x40494f2b
add edx, 0x5924098c
xor edx, 0x4f0e142d
sub edx, 0x361f78ec
xchg rdi, rcx
mov rdi, rcx
xchg rcx, rdi
call fcn.1401fd29c
cmp byte [rbx + 0x19], 0
je 0x14008112b
xchg r15, rdi
mov r15, qword [rsp + 0x30]
xchg r15, rdi
xchg rbx, rcx
mov rcx, qword [rsp + 0x38]
xchg rcx, rbx
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
push rbx
push rax
push rbx
xchg qword [rsp + 0x18], rsi
pop rbx
pop rax
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140083c80
Capabilities:
Encode data using xor

Disassembly:
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
add rcx, 0xfffffffffffffffe
mov eax, 0x233a9fb3
add eax, 0x3e904c99
sub eax, 0x3fa91f4a
xor eax, 0x5e6804f
add eax, 0x35c9cddb
xor eax, 0x915dd7e5
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea r9d, [rax + rdx]
add r9w, r9w
sub r8w, r9w
sub r8w, 0xffd0
mov word [rcx], r8w
mov r8d, edx
test edx, edx
jne 0x140083c90
mov rax, rcx
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140083f50
Capabilities:
Encode data using xor

Disassembly:
mov rax, r8
cmp rcx, rdx
je 0x140084092
xchg r9, rax
mov rax, r9
xchg r9, rax
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
xchg r15, rax
movups xmmword [r15], xmm0
xchg r15, rax
xchg r10, rdi
mov qword [r9 + r8 - 0x70], rdi
xchg r10, rdi
xchg r10, rbp
mov qword [r9 + r8 - 0x68], rbp
xchg r10, rbp
xchg r8, rdi
movups xmm0, xmmword [rdi - 0x80]
xchg r8, rdi
xchg r10, rax
movups xmmword [r10], xmm0
xchg r10, rax
xchg r8, r9
movups xmm1, xmmword [r9 - 0x70]
xchg r9, r8
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm1
xchg r10, rbp
mov qword [r8 - 0x70], rbp
xchg rbp, r10
sub rax, 0xffffffffffffffb8
mov qword [r8 - 0x68], 0x6e72dcd1
sub qword [r8 - 0x68], 0x33fa16ce
add qword [r8 - 0x68], 0x192ed96f
sub qword [r8 - 0x68], 0x1acb242f
xor qword [r8 - 0x68], 0x46c93f4f
sub qword [r8 - 0x68], 0x7e154405
mov word [r8 - 0x80], r10w
xchg rdi, r9
movups xmmword [rdi + r8 - 0x60], xmm0
xchg rdi, r9
xchg r10, rbp
mov qword [r9 + r8 - 0x50], rbp
xchg r10, rbp
mov qword [r9 + r8 - 0x48], r10
movups xmm0, xmmword [r8 - 0x60]
xchg r9, rbx
movups xmmword [rbx + r8 - 0x60], xmm0
xchg rbx, r9
xchg r8, rdx
movups xmm1, xmmword [rdx - 0x50]
xchg rdx, r8
xchg rcx, r9
movups xmmword [rcx + r8 - 0x50], xmm1
xchg rcx, r9
mov qword [r8 - 0x50], r10
mov qword [r8 - 0x48], 0x26a1435a
sub qword [r8 - 0x48], 0x148fca73
xor qword [r8 - 0x48], 0x4e53c1b6
xor qword [r8 - 0x48], 0x1e273e7d
add qword [r8 - 0x48], 0x327e1dbf
sub qword [r8 - 0x48], 0x74e3a4e4
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x140083f74
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400841b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, r8
cmp rcx, rdx
je 0x140084280
mov r9, rax
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
movups xmmword [rax], xmm0
mov qword [r9 + r8 - 0x28], r10
lea rcx, [r8 - 0x18]
xchg r10, rdx
mov qword [r8 + r9 - 0x20], rdx
xchg rdx, r10
xchg r8, r9
movups xmm0, xmmword [r9 - 0x38]
xchg r8, r9
movups xmmword [rax], xmm0
xchg r14, r8
movups xmm1, xmmword [r14 - 0x28]
xchg r14, r8
xchg rdi, rax
movups xmmword [rdi + 0x10], xmm1
xchg rdi, rax
xchg r10, r12
mov qword [r8 - 0x28], r12
xchg r12, r10
nop
sub rax, 0x575d1e4e
add rax, 0x575d1e6e
mov qword [r8 - 0x20], 0x2c1a3566
add qword [r8 - 0x20], 0x2807f840
xor qword [r8 - 0x20], 0x4875e30d
add qword [r8 - 0x20], 0x57ba9e5a
xor qword [r8 - 0x20], 0x5ad0d84a
add qword [r8 - 0x20], 0x81547ac
add qword [r8 - 0x20], 0x363a54ce
xor qword [r8 - 0x20], 0x719a308e
xor qword [r8 - 0x20], 0x1c886140
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x1400841d4
ret
Function at 0x14008e5e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0xa], 0x15
xor byte [rcx + rax + 0xa], 0x52
sub byte [rcx + rax + 0xa], 0x3e
xor byte [rcx + rax + 0xa], 0x17
add byte [rcx + rax + 0xa], 0x50
xor byte [rcx + rax + 0xa], 0x6e
inc rax
cmp rax, 0x10
jb 0x14008e5e2
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400f10e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
push r11
mov qword [rsp], rbp
push rsi
push rsi
mov qword [rsp], rdi
sub rsp, 0x80
xchg r12, r9
mov rdi, r12
xchg r9, r12
mov esi, r8d
xchg rbx, rdx
mov rdx, rbx
xchg rbx, rdx
xor ebp, ebp
lea rcx, [rsp + 0x50]
call fcn.140049b90
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x78], rdi
lea ecx, [rbp + 0x30]
call fcn.1401fd260
test rax, rax
je 0x1400f1171
movups xmm0, xmmword [rsp + 0x50]
xchg rdi, rax
movups xmmword [rdi], xmm0
xchg rdi, rax
movups xmm1, xmmword [rsp + 0x60]
xchg rbx, rax
movups xmmword [rbx + 0x10], xmm1
xchg rbx, rax
movdqa xmm0, xmmword [0x140002c70]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], bp
mov dword [rax + 0x20], esi
mov qword [rax + 0x28], rdi
jmp 0x1400f1174
mov rax, rbp
xchg r10, rax
mov qword [rsp + 0xb8], r10
xchg r10, rax
lea rcx, [rsp + 0x38]
xchg rcx, rdx
mov qword [rsp + 0x28], rdx
xchg rcx, rdx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x140081f60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
xchg r13, rax
mov qword [rsp + 0x30], r13
xchg r13, rax
test rax, rax
je 0x1400f1255
cmp dword [rsp + 0x38], 0
je 0x1400f1288
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x1400f124d
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x50]
call fcn.14002f750
nop
xchg rbx, r8
mov rcx, r8
xchg rbx, r8
xchg r10, rbx
mov r10, qword [rsp + 0xa0]
xchg r10, rbx
add rsp, 0x80
nop
add rsp, 8
mov rdi, qword [rsp - 8]
push rcx
push rdx
push rcx
push rcx
push rax
push rbx
push rcx
push rax
xchg qword [rsp + 0x40], rsi
add rsp, 0x48
push rax
push rbx
push rdx
push rax
push rax
push rbx
push rax
push rdx
xchg qword [rsp + 0x40], rbp
pop rdx
pop rax
pop rbx
pop rax
pop rax
pop rdx
pop rbx
pop rax
add rsp, 8
jmp fcn.14002f750
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov dword [rsp + 0x38], ebp
mov ecx, 0x7ce7f119
sub ecx, 0xcc40522
sub ecx, 0x2e911502
xor ecx, 0x7f3dab93
sub ecx, 0x36c3c168
add ecx, 0x9a6d7af
xor ecx, 0x119293ab
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 0x17634a29
xor ecx, 0x68eadd30
sub ecx, 0x610d61a9
add ecx, 0x570c93db
sub ecx, 0x21183d64
sub ecx, 0x54708be6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14015c930
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
je 0x14015cb45
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rsi, rcx
mov rsi, qword [rdx + 0x50]
xchg rcx, rsi
xchg rdi, rdx
mov rdx, rdi
xchg rdx, rdi
mov qword [rsp + 0x30], rbx
xor ebx, ebx
test rcx, rcx
je 0x14015c9d1
mov rdx, qword [rdx + 0x60]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x14015c9b4
xchg r8, r9
mov r9, qword [rcx - 8]
xchg r9, r8
nop
sub rdx, 0x7df2d92e
add rdx, 0x7df2d955
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14015cb4e
xchg rbx, r8
mov rcx, rbx
xchg r8, rbx
call fcn.1401fd29c
xchg r9, rbx
mov qword [rdi + 0x50], r9
xchg r9, rbx
mov qword [rdi + 0x58], rbx
xchg r13, rbx
mov qword [rdi + 0x60], r13
xchg rbx, r13
mov rcx, qword [rdi + 0x40]
xchg rbp, rax
mov rbp, qword [rcx + 8]
xchg rbp, rax
mov qword [rax], rbx
mov rcx, qword [rcx]
test rcx, rcx
je 0x14015ca46
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x36ee0025
sub edx, 0x25424bb1
xor edx, 0x1772ccd3
add edx, 0x5dfe196c
xor edx, 0x5c22c1ef
add edx, 0x1c4867f4
xor edx, 0x6cf1239d
xor edx, 0x32b78bc0
xor edx, 0xb7b13b5
call fcn.1401fd29c
xchg rcx, r11
mov r11, rbx
xchg r11, rcx
test rbx, rbx
jne 0x14015c9f7
xchg r14, rcx
mov r14, qword [rdi + 0x40]
xchg r14, rcx
mov edx, 0x55d31953
sub edx, 0x472f33b5
xor edx, 0x47cdfef6
add edx, 0xde83994
xor edx, 0x25d60be
xor edx, 0x550b345a
call fcn.1401fd29c
mov rbx, qword [rdi + 0x28]
test rbx, rbx
je 0x14015cafb
xchg rsi, rdi
mov qword [rsp + 0x38], rdi
xchg rdi, rsi
mov esi, 0x1cd37710
add esi, 0x5f0bc36
add esi, 0x2a248f5
add esi, 0x5066291b
xor esi, 0x36853df1
add esi, 0xbcb66758
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14015caf6
xchg r9, rax
mov r9, qword [rbx]
xchg r9, rax
xchg r8, rbx
mov rcx, r8
xchg rbx, r8
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x14015caf6
xchg rsi, rax
mov rsi, qword [rbx]
xchg rsi, rax
xchg rsi, rbx
mov rcx, rsi
xchg rsi, rbx
call qword [rax + 8]
mov rsi, qword [rsp + 0x38]
mov edx, 0x566c255e
xor edx, 0x2c4019e6
sub edx, 0x2ea46086
sub edx, 0xe8b8673
add edx, 0x3a38711e
sub edx, 0x7134ae28
add edx, 0x290456e2
xor edx, 0x2f046e3f
mov rcx, rdi
call fcn.1401fd29c
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3