joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007cb00
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r8
mov qword [rsp + 8], r8
xchg rbx, r8
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, r11
mov r11, rcx
xchg rdi, r11
lea rbx, [rdx + 0x2c]
xchg rbx, r11
mov rdx, r11
xchg r11, rbx
call fcn.14007a9c0
nop
xor eax, eax
mov byte [rbx + rax], 0x28
add byte [rbx + rax], 0x48
sub byte [rbx + rax], 0x62
add byte [rbx + rax], 0x44
xor byte [rbx + rax], 0x1e
xor byte [rbx + rax], 0x62
add byte [rbx + rax], 0x34
sub byte [rbx + rax], 0x62
inc rax
cmp rax, 0x54
jb 0x14007cb3c
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg r14, rbx
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
push rbx
push rdx
push rcx
push rdx
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cba0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rbx, rcx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x2e]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007a9c0
nop
xor eax, eax
mov byte [rbx + rax], 0x13
add byte [rbx + rax], 1
xor byte [rbx + rax], 0xb
xor byte [rbx + rax], 0x3d
add byte [rbx + rax], 7
xor byte [rbx + rax], 0x78
xor byte [rbx + rax], 0x51
inc rax
cmp rax, 0x58
jb 0x14007cbd6
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cc20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x2e]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007a9c0
nop
xor eax, eax
mov byte [rbx + rax], 0x1e
add byte [rbx + rax], 0x31
add byte [rbx + rax], 0x1b
sub byte [rbx + rax], 0x4e
sub byte [rbx + rax], 0x12
xor byte [rbx + rax], 0x61
sub byte [rbx + rax], 0x6b
inc rax
cmp rax, 0x5a
jb 0x14007cc50
xchg r8, rdi
mov rax, r8
xchg rdi, r8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x14007cca0
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rbx
mov qword [rsp + 8], rbp
xchg rbp, rbx
mov qword [rsp + 0x10], rdx
nop
push r8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rbx, rcx
mov rdi, rbx
xchg rcx, rbx
lea rbx, [rdx + 0x30]
mov rdx, rbx
call fcn.14007a9c0
nop
xor eax, eax
mov byte [rbx + rax], 0x46
xor byte [rbx + rax], 0x5e
xor byte [rbx + rax], 0x74
sub byte [rbx + rax], 0x3b
xor byte [rbx + rax], 0xe
add byte [rbx + rax], 1
sub byte [rbx + rax], 0x40
inc rax
cmp rax, 0x5c
jb 0x14007ccd3
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg r11, rbx
mov r11, qword [rsp + 0x30]
xchg r11, rbx
add rsp, 0x20
push rcx
push rcx
push rax
push rcx
push rax
xchg qword [rsp + 0x28], rdi
add rsp, 0x30
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007cd30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rsi, rdx
mov qword [rsp + 0x10], rsi
xchg rsi, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x30]
xchg rdx, rdi
mov rdi, rbx
xchg rdi, rdx
call fcn.14007a9c0
nop
xor eax, eax
mov byte [rbx + rax], 0x24
xor byte [rbx + rax], 0x79
xor byte [rbx + rax], 0x5e
add byte [rbx + rax], 0x4c
add byte [rbx + rax], 0x15
add byte [rbx + rax], 7
sub byte [rbx + rax], 0x6b
inc rax
cmp rax, 0x5e
jb 0x14007cd66
xchg r13, rax
mov r13, rdi
xchg r13, rax
xchg rbx, r8
mov r8, qword [rsp + 0x30]
xchg rbx, r8
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cdc0
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rdi, rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rsi
mov rdi, rsi
xchg rsi, rcx
lea rbx, [rdx + 0x32]
mov rdx, rbx
call fcn.14007a9c0
nop
xor eax, eax
mov byte [rbx + rax], 0x17
add byte [rbx + rax], 0x1c
sub byte [rbx + rax], 0x11
add byte [rbx + rax], 3
add byte [rbx + rax], 0x50
xor byte [rbx + rax], 0x75
inc rax
cmp rax, 0x60
jb 0x14007cdf5
xchg rbx, rax
mov rbx, rdi
xchg rbx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007ce40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x34]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007a9c0
nop
xor eax, eax
mov byte [rbx + rax], 0x34
sub byte [rbx + rax], 0x19
add byte [rbx + rax], 0x28
xor byte [rbx + rax], 0x3b
sub byte [rbx + rax], 0x43
add byte [rbx + rax], 0x2c
xor byte [rbx + rax], 0x66
sub byte [rbx + rax], 7
inc rax
cmp rax, 0x64
jb 0x14007ce6d
xchg rbx, rax
mov rbx, rdi
xchg rbx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rdx
push rdx
push rcx
push rcx
push rcx
push rbx
xchg qword [rsp + 0x38], rdi
add rsp, 0x40
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cec0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r13
mov qword [rsp + 8], r13
xchg rbx, r13
xchg r13, rdx
mov qword [rsp + 0x10], r13
xchg r13, rdx
push rdi
sub rsp, 0x20
xchg r10, rdi
mov r10, rcx
xchg r10, rdi
lea rbx, [rdx + 0x38]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007a9c0
nop
xor eax, eax
mov byte [rbx + rax], 0x7b
xor byte [rbx + rax], 0x5d
sub byte [rbx + rax], 0x13
add byte [rbx + rax], 0x42
xor byte [rbx + rax], 0x1e
xor byte [rbx + rax], 0x39
sub byte [rbx + rax], 0x39
sub byte [rbx + rax], 0x39
inc rax
cmp rax, 0x6e
jb 0x14007cef9
xchg r9, rax
mov r9, rdi
xchg r9, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007cf50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rsi
mov qword [rsp + 0x10], rsi
xchg rsi, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x4e]
xchg r15, rbx
mov rdx, r15
xchg r15, rbx
call fcn.14007a9c0
nop
xor eax, eax
mov byte [rbx + rax], 0x44
sub byte [rbx + rax], 3
sub byte [rbx + rax], 0x15
add byte [rbx + rax], 0x3c
sub byte [rbx + rax], 0x21
xor byte [rbx + rax], 0x6d
add byte [rbx + rax], 0x30
sub byte [rbx + rax], 4
sub byte [rbx + rax], 0x56
inc rax
cmp rax, 0x98
jb 0x14007cf8b
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rcx
mov rcx, qword [rsp + 0x30]
xchg rbx, rcx
add rsp, 0x20
push rbx
push rbx
push rcx
push rbx
push rbx
push rdx
xchg qword [rsp + 0x30], rdi
pop rdx
pop rbx
pop rbx
pop rcx
pop rbx
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cff0
Capabilities:
Encode data using xor

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rdi, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, r10
mov rdi, r10
xchg rcx, r10
lea rbx, [rdx + 0x56]
mov rdx, rbx
call fcn.14007a9c0
nop
xor eax, eax
mov byte [rbx + rax], 0x2a
xor byte [rbx + rax], 0x27
add byte [rbx + rax], 0x51
sub byte [rbx + rax], 0x40
add byte [rbx + rax], 0x4b
xor byte [rbx + rax], 0x2f
xor byte [rbx + rax], 0x59
add byte [rbx + rax], 0x54
sub byte [rbx + rax], 0x73
inc rax
cmp rax, 0xa8
jb 0x14007d01d
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d070
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rcx
mov qword [rsp], rdi
sub rsp, 0x20
xchg r13, rcx
mov rdi, r13
xchg rcx, r13
lea rbx, [rdx + 0x5a]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007a9c0
nop
xor eax, eax
mov byte [rbx + rax], 0x43
xor byte [rbx + rax], 0x31
sub byte [rbx + rax], 0x1c
sub byte [rbx + rax], 0x46
xor byte [rbx + rax], 0x60
sub byte [rbx + rax], 0x5d
add byte [rbx + rax], 0x67
xor byte [rbx + rax], 0x7a
inc rax
cmp rax, 0xb0
jb 0x14007d0a1
mov rax, rdi
xchg rbx, rsi
mov rsi, qword [rsp + 0x30]
xchg rsi, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d0f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, r9
mov r9, rcx
xchg rdi, r9
lea rbx, [rdx + 0x70]
mov rdx, rbx
call fcn.14007a9c0
nop
xor eax, eax
mov byte [rbx + rax], 0x54
sub byte [rbx + rax], 0x51
xor byte [rbx + rax], 0x36
xor byte [rbx + rax], 0x4b
xor byte [rbx + rax], 0x2f
sub byte [rbx + rax], 0x3f
xor byte [rbx + rax], 0x12
inc rax
cmp rax, 0xdc
jb 0x14007d120
xchg r9, rax
mov r9, rdi
xchg r9, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rax
push rcx
push rdx
push rbx
push rax
xchg qword [rsp + 0x28], rdi
pop rax
pop rbx
pop rdx
pop rcx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d180
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
push r14
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r8
mov r8, rcx
xchg r8, rdi
lea rbx, [rdx + 0x70]
mov rdx, rbx
call fcn.14007a9c0
nop
xor eax, eax
mov byte [rbx + rax], 0x10
add byte [rbx + rax], 0x31
add byte [rbx + rax], 0x34
xor byte [rbx + rax], 0x32
sub byte [rbx + rax], 6
xor byte [rbx + rax], 0x71
sub byte [rbx + rax], 0x16
xor byte [rbx + rax], 0x1a
inc rax
cmp rax, 0xde
jb 0x14007d1ad
xchg r12, rax
mov r12, rdi
xchg r12, rax
xchg rbx, r11
mov r11, qword [rsp + 0x30]
xchg rbx, r11
add rsp, 0x20
push rax
push rax
push rcx
push rcx
push rbx
push rcx
push rdx
xchg qword [rsp + 0x38], rdi
add rsp, 0x40
ret

Function at 0x14007d200
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r13
mov qword [rsp + 8], r13
xchg r13, rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x76]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007a9c0
nop
xor eax, eax
mov byte [rbx + rax], 9
add byte [rbx + rax], 0xa
add byte [rbx + rax], 7
xor byte [rbx + rax], 0x6d
sub byte [rbx + rax], 0x75
add byte [rbx + rax], 0x48
xor byte [rbx + rax], 0x4a
inc rax
cmp rax, 0xea
jb 0x14007d236
mov rax, rdi
xchg rbx, r10
mov r10, qword [rsp + 0x30]
xchg rbx, r10
add rsp, 0x20
push rcx
push rdx
push rdx
push rax
push rax
push rdx
push rax
push rax
xchg qword [rsp + 0x40], rdi
add rsp, 0x48
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d290
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 8], r13
xchg r13, rbx
xchg r13, rdx
mov qword [rsp + 0x10], r13
xchg r13, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x7c]
xchg rbx, rbp
mov rdx, rbp
xchg rbp, rbx
call fcn.14007a9c0
nop
xor eax, eax
mov byte [rbx + rax], 0x2c
sub byte [rbx + rax], 0x20
add byte [rbx + rax], 0x57
xor byte [rbx + rax], 0x46
add byte [rbx + rax], 0x2b
sub byte [rbx + rax], 0x50
inc rax
cmp rax, 0xf4
jb 0x14007d2cb
xchg r9, rax
mov r9, rdi
xchg r9, rax
xchg rbx, r11
mov r11, qword [rsp + 0x30]
xchg rbx, r11
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret

Function at 0x14007d310
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rbx, rsi
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rsi
mov rdi, rsi
xchg rcx, rsi
lea rbx, [rdx + 0x9a]
xchg r9, rdx
mov r9, rbx
xchg r9, rdx
call fcn.14007a9c0
nop
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbx + rax], 0x7e
sub byte [rbx + rax], 0x4b
sub byte [rbx + rax], 0x22
add byte [rbx + rax], 0x58
sub byte [rbx + rax], 9
xor byte [rbx + rax], 0x24
xor byte [rbx + rax], 0
xor byte [rbx + rax], 0x44
inc rax
cmp rax, 0x130
jb 0x14007d35a
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rcx
push rcx
push rbx
push rcx
push rbx
push rdx
xchg qword [rsp + 0x38], rdi
add rsp, 0x40
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d3b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, r9
mov r9, rcx
xchg rdi, r9
lea rbx, [rdx + 0xc]
xchg rbx, r11
mov rdx, r11
xchg rbx, r11
call fcn.14007a9c0
nop
xor eax, eax
mov byte [rbx + rax], 0x66
sub byte [rbx + rax], 0x31
add byte [rbx + rax], 0x43
xor byte [rbx + rax], 0x40
xor byte [rbx + rax], 0x4f
xor byte [rbx + rax], 0x7b
xor byte [rbx + rax], 0x77
sub byte [rbx + rax], 0x2d
sub byte [rbx + rax], 0x4e
inc rax
cmp rax, 0x14
jb 0x14007d3dd
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d430
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 8], r15
xchg rbx, r15
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xe]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007a9c0
nop
xor eax, eax
mov byte [rbx + rax], 0x4a
sub byte [rbx + rax], 7
xor byte [rbx + rax], 0x59
xor byte [rbx + rax], 0xa
add byte [rbx + rax], 0x60
sub byte [rbx + rax], 0x70
inc rax
cmp rax, 0x18
jb 0x14007d466
xchg r14, rax
mov r14, rdi
xchg r14, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d4b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rcx, rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, r11
mov r11, rcx
xchg rdi, r11
lea rbx, [rdx + 0xe]
xchg r8, rdx
mov r8, rbx
xchg r8, rdx
call fcn.14007a9c0
nop
xor eax, eax
mov byte [rbx + rax], 0x6e
xor byte [rbx + rax], 0x12
xor byte [rbx + rax], 0x7b
add byte [rbx + rax], 0x43
sub byte [rbx + rax], 0x30
xor byte [rbx + rax], 0x79
xor byte [rbx + rax], 0x63
inc rax
cmp rax, 0x1a
jb 0x14007d4ec
xchg rdi, rdx
mov rax, rdx
xchg rdx, rdi
xchg rdx, rbx
mov rdx, qword [rsp + 0x30]
xchg rbx, rdx
add rsp, 0x20
push rbx
xchg qword [rsp + 8], rdi
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140083e10
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rsi
mov rax, rsi
xchg rsi, r8
cmp rcx, rdx
je 0x140083f78
xchg r9, rcx
mov rcx, rax
xchg r9, rcx
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
xchg rbp, rax
movups xmmword [rbp], xmm0
xchg rbp, rax
xchg r10, r15
mov qword [r9 + r8 - 0x70], r15
xchg r10, r15
mov qword [r9 + r8 - 0x68], r10
xchg r13, r8
movups xmm0, xmmword [r13 - 0x80]
xchg r8, r13
movups xmmword [rax], xmm0
xchg rdi, r8
movups xmm1, xmmword [rdi - 0x70]
xchg rdi, r8
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm1
xchg r15, r10
mov qword [r8 - 0x70], r15
xchg r15, r10
sub rax, 0xffffffffffffffb8
mov qword [r8 - 0x68], 0x13812ea9
add qword [r8 - 0x68], 0x5daabb82
sub qword [r8 - 0x68], 0x30004d94
sub qword [r8 - 0x68], 0x401b8d7a
add qword [r8 - 0x68], 0x78c8398
add qword [r8 - 0x68], 0x6d8c6b9a
sub qword [r8 - 0x68], 0x2b816a45
sub qword [r8 - 0x68], 0x174920f5
sub qword [r8 - 0x68], 0x335e730e
mov word [r8 - 0x80], r10w
movups xmmword [r9 + r8 - 0x60], xmm0
mov qword [r9 + r8 - 0x50], r10
mov qword [r9 + r8 - 0x48], r10
xchg rbp, r8
movups xmm0, xmmword [rbp - 0x60]
xchg r8, rbp
xchg rcx, r9
movups xmmword [rcx + r8 - 0x60], xmm0
xchg rcx, r9
xchg r12, r8
movups xmm1, xmmword [r12 - 0x50]
xchg r8, r12
xchg rbp, r9
movups xmmword [rbp + r8 - 0x50], xmm1
xchg rbp, r9
xchg rcx, r10
mov qword [r8 - 0x50], rcx
xchg rcx, r10
mov qword [r8 - 0x48], 0x7199dc3a
xor qword [r8 - 0x48], 0x1e32418e
sub qword [r8 - 0x48], 0x26e6da6b
sub qword [r8 - 0x48], 0x47a393da
xor qword [r8 - 0x48], 0x3d232d70
sub qword [r8 - 0x48], 0x304b7540
xor qword [r8 - 0x48], 0x5d83998c
sub qword [r8 - 0x48], 0x5635154c
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x140083e3c
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x1400840b0
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rax
mov rbp, r8
xchg rbp, rax
cmp rcx, rdx
je 0x140084185
xchg r9, rax
mov rax, r9
xchg r9, rax
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg rbp, rax
movups xmmword [rbp], xmm0
xchg rbp, rax
xchg r11, r10
mov qword [r9 + r8 - 0x28], r11
xchg r10, r11
lea rcx, [r8 - 0x18]
mov qword [r8 + r9 - 0x20], r10
xchg r8, r14
movups xmm0, xmmword [r14 - 0x38]
xchg r14, r8
movups xmmword [rax], xmm0
xchg r14, r8
movups xmm1, xmmword [r14 - 0x28]
xchg r8, r14
xchg rsi, rax
movups xmmword [rsi + 0x10], xmm1
xchg rsi, rax
xchg r10, r9
mov qword [r8 - 0x28], r9
xchg r9, r10
nop
add rax, 0x7fbc87cc
sub rax, 0x7fbc87ac
mov qword [r8 - 0x20], 0x2950ecaf
xor qword [r8 - 0x20], 0x21991b50
add qword [r8 - 0x20], 0x3d9cbff2
sub qword [r8 - 0x20], 0x398619b
add qword [r8 - 0x20], 0x1892d847
xor qword [r8 - 0x20], 0x375d4a94
sub qword [r8 - 0x20], 0x46fda049
sub qword [r8 - 0x20], 0x253ec3b9
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x1400840dc
ret
Function at 0x14008e4e0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0xa], 0x56
xor byte [rcx + rax + 0xa], 0x56
add byte [rcx + rax + 0xa], 0x6d
sub byte [rcx + rax + 0xa], 0x47
sub byte [rcx + rax + 0xa], 6
sub byte [rcx + rax + 0xa], 0x20
inc rax
cmp rax, 0x10
jb 0x14008e4e2
ret
Function at 0x140194130
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
xchg rdx, r9
mov r10, r9
xchg r9, rdx
xchg r8, rcx
mov r11, r8
xchg rcx, r8
mov dword [rsp + 0x30], 0x28fd5612
add dword [rsp + 0x30], 0x44e31e62
xor dword [rsp + 0x30], 0x2b70772a
xor dword [rsp + 0x30], 0x85e8324
sub dword [rsp + 0x30], 0x3e7df33f
add dword [rsp + 0x30], 0x575811ad
add dword [rsp + 0x30], 0xed7d988
xor dword [rsp + 0x30], 0x80768e86
mov dword [rsp + 0x36], 0x4b8ea94a
sub dword [rsp + 0x36], 0x18283b5c
sub dword [rsp + 0x36], 0x2e172084
add dword [rsp + 0x36], 0x4f0ee7a5
xor dword [rsp + 0x36], 0x7a3aa173
add dword [rsp + 0x36], 0x25d24406
xor dword [rsp + 0x36], 0xab6f27d8
mov dword [rsp + 0x3a], 0x41637884
add dword [rsp + 0x3a], 0xe75f8ad
sub dword [rsp + 0x3a], 0x35ee5139
add dword [rsp + 0x3a], 0x4e509c38
add dword [rsp + 0x3a], 0x12292677
sub dword [rsp + 0x3a], 0x176087b
sub dword [rsp + 0x3a], 0x58786f4f
xor dword [rsp + 0x3a], 0x5a7a3519
add dword [rsp + 0x3a], 0x85529f99
xor eax, eax
mov word [rsp + 0x3e], ax
xor ebx, ebx
mov edx, ebx
nop
movzx eax, word [rsp + rdx*2 + 0x36]
movzx ecx, byte [rsp + rdx + 0x30]
add cx, ax
mov word [rsp + rdx*2 + 0x36], cx
mov byte [rsp + rdx + 0x30], bl
inc rdx
cmp rdx, 4
jb 0x140194214
mov rax, qword [rsp + 0x70]
xchg rdi, rax
mov qword [rsp + 0x28], rdi
xchg rdi, rax
xchg r9, r8
mov qword [rsp + 0x20], r8
xchg r9, r8
xchg r8, r9
mov r8, r9
xchg r8, r9
lea r8, [rsp + 0x36]
xchg rdx, r14
mov r14, r10
xchg rdx, r14
mov rcx, r11
call fcn.1401942c0
nop
mov byte [rsp + rbx + 0x36], 8
xor byte [rsp + rbx + 0x36], 0x12
xor byte [rsp + rbx + 0x36], 0x53
add byte [rsp + rbx + 0x36], 0x19
xor byte [rsp + rbx + 0x36], 0x6f
add byte [rsp + rbx + 0x36], 0x13
xor byte [rsp + rbx + 0x36], 0x6e
xor byte [rsp + rbx + 0x36], 0x5e
sub byte [rsp + rbx + 0x36], 0x10
inc rbx
cmp rbx, 8
jb 0x140194270
add rsp, 0x40
nop
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x1401986b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
xchg rbx, r8
mov qword [rsp + 0x18], rbx
xchg r8, rbx
xchg rcx, r11
mov qword [rsp + 8], r11
xchg rcx, r11
nop
sub rsp, 8
mov qword [rsp], rbx
nop
push r15
mov qword [rsp], rbp
push rsi
push rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r13
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x58
xchg r9, rbx
mov r9, rbx
xchg r9, rbx
xchg rdx, rsi
mov rdx, rsi
xchg rsi, rdx
xchg rcx, r10
mov r9, r10
xchg r10, rcx
xor ebp, ebp
test rdx, rdx
jne 0x14019872c
mov eax, ebp
jmp 0x140198772
mov eax, 0x745daa77
sub eax, 0x75502c9
xor eax, 0x2fb90386
sub eax, 0x2089fa04
xor eax, 0x328945ff
sub eax, 0x10ae958e
cmp word [rdx], ax
je 0x140198761
xchg rbp, r10
mov rax, r10
xchg rbp, r10
jmp 0x140198772
movsxd rax, dword [rdx + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
cmovne rax, rbp
mov ecx, 0x340ceaf0
xor ecx, 0x2578fdce
xor ecx, 0x39de0ae5
sub ecx, 0x5bec2d
sub ecx, 0x14f5f2e1
sub ecx, 0x13583cc2
cmp word [rax + 0x18], cx
jne 0x1401988ba
mov r14d, dword [rax + 0x88]
add r14, rsi
je 0x1401988ba
mov r15d, dword [r14 + 0x1c]
add r15, rsi
mov r12d, dword [r14 + 0x24]
add r12, rsi
mov r13d, dword [r14 + 0x20]
add r13, rsi
mov edi, ebp
cmp dword [r14 + 0x18], 0
jbe 0x14019887a
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
mov ecx, dword [r13 + rax*4]
add rcx, rsi
movzx eax, word [r12 + rax*2]
mov edx, dword [r15 + rax*4]
add rdx, rsi
cmp rcx, 0xffff
jbe 0x14019886e
mov qword [rsp + 0xa8], rdx
xchg rcx, rbx
mov qword [rsp + 0x30], rbx
xchg rcx, rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r9
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x140198942
xchg r10, rax
mov r10, qword [rcx]
xchg r10, rax
lea rdx, [rsp + 0xa8]
xchg rdx, r9
mov qword [rsp + 0x20], r9
xchg r9, rdx
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
test al, al
je 0x14019887a
mov r8, qword [rsp + 0xb0]
mov r9, qword [rsp + 0xa0]
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x1401987dd
xchg rcx, r9
mov r9, qword [rbx + 0x38]
xchg rcx, r9
test rcx, rcx
je 0x1401988a3
cmp rcx, rbx
mov rax, qword [rcx]
setne dl
call qword [rax + 0x20]
xchg rbp, r9
mov qword [rbx + 0x38], r9
xchg r9, rbp
mov al, 0x45
sub al, 0x25
add al, 0x3b
sub al, 0x2c
sub al, 0x2f
xor al, 0x48
sub al, 0x1c
xor al, 0x52
xor al, 0x7f
jmp 0x1401988e3
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1401988e1
xchg r11, rax
mov r11, qword [rcx]
xchg r11, rax
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
xchg r13, rbp
mov qword [rbx + 0x38], r13
xchg rbp, r13
xor al, al
add rsp, 0x58
nop
mov r15, qword [rsp]
add rsp, 8
push rbx
push rcx
xchg qword [rsp + 0x10], r14
pop rcx
pop rbx
add rsp, 8
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
add rsp, 8
xchg qword [rsp - 8], r12
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rsi
nop
add rsp, 8
xchg qword [rsp - 8], rbp
push rax
xchg qword [rsp + 8], rbx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
call fcn.1401fda22
nop
int3
Function at 0x1401aac60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r11, rdx
xchg rdi, rcx
mov r10, rdi
xchg rdi, rcx
test rdx, rdx
je 0x1401aacde
mov qword [rsp], rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1401aaccb
movzx eax, byte [r10]
test bl, bl
je 0x1401aacad
lea rcx, [r9 - 1]
xchg r9, rcx
mov rdx, rcx
xchg rcx, r9
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1401aac9c
jmp 0x1401aaccb
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1401aacbc
inc r10
sub r11, 1
jne 0x1401aac7e
xchg rbx, r11
mov r11, qword [rsp]
xchg r11, rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]