joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007c9d0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r8
mov qword [rsp + 8], r8
xchg r8, rbx
xchg rdx, r10
mov qword [rsp + 0x10], r10
xchg rdx, r10
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x2a]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x6f
sub byte [rbx + rax], 0x52
xor byte [rbx + rax], 0x53
sub byte [rbx + rax], 0x46
add byte [rbx + rax], 0x54
sub byte [rbx + rax], 0x33
xor byte [rbx + rax], 0x29
inc rax
cmp rax, 0x50
jb 0x14007ca12
xchg r11, rax
mov r11, rdi
xchg r11, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007ca60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rsi, rdx
mov qword [rsp + 0x10], rsi
xchg rsi, rdx
push rdi
sub rsp, 0x20
xchg rdi, r8
mov r8, rcx
xchg r8, rdi
lea rbx, [rdx + 0x2a]
xchg r12, rbx
mov rdx, r12
xchg rbx, r12
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x32
add byte [rbx + rax], 0x46
xor byte [rbx + rax], 0x1d
sub byte [rbx + rax], 0x1f
xor byte [rbx + rax], 0xd
add byte [rbx + rax], 0x30
sub byte [rbx + rax], 0x13
xor byte [rbx + rax], 0x69
sub byte [rbx + rax], 1
inc rax
cmp rax, 0x52
jb 0x14007ca93
xchg rdi, r11
mov rax, r11
xchg r11, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007caf0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 8], rdi
xchg rbx, rdi
xchg rdx, r15
mov qword [rsp + 0x10], r15
xchg r15, rdx
push rdi
sub rsp, 0x20
xchg rdi, r9
mov r9, rcx
xchg r9, rdi
lea rbx, [rdx + 0x2c]
xchg rbx, r13
mov rdx, r13
xchg rbx, r13
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x2c
xor byte [rbx + rax], 0x42
xor byte [rbx + rax], 0xa
sub byte [rbx + rax], 0x4d
xor byte [rbx + rax], 0x6e
sub byte [rbx + rax], 0x79
inc rax
cmp rax, 0x54
jb 0x14007cb29
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cb70
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rbx
mov qword [rsp + 8], r15
xchg rbx, r15
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r9, rdi
mov r9, rcx
xchg r9, rdi
lea rbx, [rdx + 0x2e]
xchg rdx, r13
mov r13, rbx
xchg r13, rdx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x42
sub byte [rbx + rax], 0x22
add byte [rbx + rax], 0x52
xor byte [rbx + rax], 0x17
sub byte [rbx + rax], 0x3e
add byte [rbx + rax], 0x2d
sub byte [rbx + rax], 0x2b
add byte [rbx + rax], 0xd
xor byte [rbx + rax], 0x36
inc rax
cmp rax, 0x58
jb 0x14007cbab
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14007cbf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rcx
mov qword [rsp + 0x10], rcx
xchg rcx, rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x2e]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x19
add byte [rbx + rax], 0x15
add byte [rbx + rax], 0x2b
add byte [rbx + rax], 0x21
sub byte [rbx + rax], 0x6a
add byte [rbx + rax], 0x59
sub byte [rbx + rax], 0x3c
xor byte [rbx + rax], 0x2d
inc rax
cmp rax, 0x5a
jb 0x14007cc1d
xchg rsi, rdi
mov rax, rsi
xchg rsi, rdi
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
push rbx
push rbx
push rcx
push rcx
push rdx
push rcx
xchg qword [rsp + 0x30], rdi
pop rcx
pop rdx
pop rcx
pop rcx
pop rbx
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cc80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x30]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x26
sub byte [rbx + rax], 0x15
xor byte [rbx + rax], 0x41
sub byte [rbx + rax], 0x30
xor byte [rbx + rax], 0x7b
xor byte [rbx + rax], 0x79
xor byte [rbx + rax], 0x7b
sub byte [rbx + rax], 0x59
inc rax
cmp rax, 0x5c
jb 0x14007ccb6
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rcx, rbx
mov rcx, qword [rsp + 0x30]
xchg rbx, rcx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cd10
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 8], rbp
xchg rbp, rbx
xchg r8, rdx
mov qword [rsp + 0x10], r8
xchg r8, rdx
push rdi
sub rsp, 0x20
xchg r15, rdi
mov r15, rcx
xchg rdi, r15
lea rbx, [rdx + 0x30]
mov rdx, rbx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x5c
add byte [rbx + rax], 0x17
xor byte [rbx + rax], 0x5e
add byte [rbx + rax], 6
xor byte [rbx + rax], 0x1c
sub byte [rbx + rax], 0x17
xor byte [rbx + rax], 0x3b
sub byte [rbx + rax], 0x23
inc rax
cmp rax, 0x5e
jb 0x14007cd43
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
xchg qword [rsp + 8], rdi
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cd90
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 8], rdi
xchg rdi, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x32]
xchg rbx, r11
mov rdx, r11
xchg r11, rbx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x77
sub byte [rbx + rax], 0x2d
add byte [rbx + rax], 0x11
xor byte [rbx + rax], 0x2c
xor byte [rbx + rax], 0x40
xor byte [rbx + rax], 0x39
add byte [rbx + rax], 0x2c
sub byte [rbx + rax], 0x1f
sub byte [rbx + rax], 0x1b
inc rax
cmp rax, 0x60
jb 0x14007cdc3
xchg rbp, rax
mov rbp, rdi
xchg rbp, rax
xchg rbx, rcx
mov rcx, qword [rsp + 0x30]
xchg rbx, rcx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007ce20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rdi, r14
mov r14, rcx
xchg rdi, r14
lea rbx, [rdx + 0x34]
xchg rcx, rdx
mov rcx, rbx
xchg rcx, rdx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x6a
add byte [rbx + rax], 7
xor byte [rbx + rax], 0x77
add byte [rbx + rax], 0x3c
add byte [rbx + rax], 0x28
sub byte [rbx + rax], 7
sub byte [rbx + rax], 0x63
inc rax
cmp rax, 0x64
jb 0x14007ce4d
mov rax, rdi
xchg r8, rbx
mov r8, qword [rsp + 0x30]
xchg r8, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007cea0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r15, rdx
mov qword [rsp + 0x10], r15
xchg r15, rdx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x38]
mov rdx, rbx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x10
add byte [rbx + rax], 0x50
xor byte [rbx + rax], 0x6d
add byte [rbx + rax], 0x19
add byte [rbx + rax], 0x22
xor byte [rbx + rax], 0x70
sub byte [rbx + rax], 0x38
inc rax
cmp rax, 0x6e
jb 0x14007cec7
xchg rdi, rcx
mov rax, rcx
xchg rcx, rdi
xchg r13, rbx
mov r13, qword [rsp + 0x30]
xchg rbx, r13
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d020
Capabilities:
Encode data using xor

Disassembly:
xchg r10, rbx
mov qword [rsp + 8], r10
xchg r10, rbx
mov qword [rsp + 0x10], rdx
nop
push r10
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0x5a]
mov rdx, rbx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x49
sub byte [rbx + rax], 0x27
sub byte [rbx + rax], 0x14
add byte [rbx + rax], 0x5f
sub byte [rbx + rax], 0x4c
add byte [rbx + rax], 0x49
sub byte [rbx + rax], 0x53
xor byte [rbx + rax], 0x17
inc rax
cmp rax, 0xb0
jb 0x14007d053
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d0a0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 8], r14
xchg rbx, r14
xchg rbx, rdx
mov qword [rsp + 0x10], rbx
xchg rdx, rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x70]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x53
sub byte [rbx + rax], 5
xor byte [rbx + rax], 0x6c
xor byte [rbx + rax], 0x18
add byte [rbx + rax], 0xe
sub byte [rbx + rax], 0x37
xor byte [rbx + rax], 0x11
inc rax
cmp rax, 0xdc
jb 0x14007d0d3
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007d120
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg r11, rbx
xchg rdx, rcx
mov qword [rsp + 0x10], rcx
xchg rcx, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r10, rdi
mov r10, rcx
xchg r10, rdi
lea rbx, [rdx + 0x70]
xchg rdx, rbp
mov rbp, rbx
xchg rdx, rbp
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x53
add byte [rbx + rax], 0x28
sub byte [rbx + rax], 0x76
xor byte [rbx + rax], 0
add byte [rbx + rax], 0x5d
xor byte [rbx + rax], 0x62
inc rax
cmp rax, 0xde
jb 0x14007d162
xchg r14, rax
mov r14, rdi
xchg r14, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x14007d1a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r15
mov qword [rsp + 0x10], r15
xchg rdx, r15
nop
push 0xae8f7fc
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x76]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x56
sub byte [rbx + rax], 0x11
sub byte [rbx + rax], 0x41
xor byte [rbx + rax], 0x24
xor byte [rbx + rax], 0x58
sub byte [rbx + rax], 0x78
inc rax
cmp rax, 0xea
jb 0x14007d1d6
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rcx
push rcx
push rbx
push rdx
push rcx
push rcx
xchg qword [rsp + 0x38], rdi
add rsp, 0x40
ret

Function at 0x14007d220
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rcx, rdx
mov qword [rsp + 0x10], rcx
xchg rcx, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x7c]
xchg rdx, rdi
mov rdi, rbx
xchg rdi, rdx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x60
sub byte [rbx + rax], 0x1f
sub byte [rbx + rax], 0x38
xor byte [rbx + rax], 0x15
sub byte [rbx + rax], 0x19
xor byte [rbx + rax], 7
add byte [rbx + rax], 0x4c
add byte [rbx + rax], 4
xor byte [rbx + rax], 0x54
inc rax
cmp rax, 0xf4
jb 0x14007d25b
xchg r14, rdi
mov rax, r14
xchg r14, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d2b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdi, r12
mov r12, rcx
xchg r12, rdi
lea rbx, [rdx + 0x9a]
mov rdx, rbx
call fcn.14007a9b0
nop
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbx + rax], 0x20
add byte [rbx + rax], 0x25
xor byte [rbx + rax], 9
sub byte [rbx + rax], 3
xor byte [rbx + rax], 0x50
xor byte [rbx + rax], 0x1f
xor byte [rbx + rax], 0x19
add byte [rbx + rax], 0x10
sub byte [rbx + rax], 0x2f
inc rax
cmp rax, 0x130
jb 0x14007d2ef
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rbx
push rax
push rbx
xchg qword [rsp + 0x20], rdi
pop rbx
pop rax
pop rbx
pop rcx
add rsp, 8
ret
Function at 0x14007d340
Capabilities:
Encode data using xor

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg rbx, r12
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0xc]
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x26
xor byte [rbx + rax], 1
sub byte [rbx + rax], 0x1d
add byte [rbx + rax], 0x30
xor byte [rbx + rax], 0x5b
sub byte [rbx + rax], 0x28
add byte [rbx + rax], 0x45
sub byte [rbx + rax], 0x5d
sub byte [rbx + rax], 0x21
inc rax
cmp rax, 0x14
jb 0x14007d37b
xchg r11, rdi
mov rax, r11
xchg r11, rdi
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d3e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r13
mov qword [rsp + 0x10], r13
xchg rdx, r13
push rdi
sub rsp, 0x20
xchg rbp, rcx
mov rdi, rbp
xchg rbp, rcx
lea rbx, [rdx + 0xe]
xchg rbx, rbp
mov rdx, rbp
xchg rbx, rbp
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x4d
add byte [rbx + rax], 0x28
sub byte [rbx + rax], 0x67
xor byte [rbx + rax], 0x55
sub byte [rbx + rax], 0x49
add byte [rbx + rax], 7
add byte [rbx + rax], 0x3f
sub byte [rbx + rax], 0x58
inc rax
cmp rax, 0x18
jb 0x14007d413
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007d460
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r8
mov qword [rsp + 8], r8
xchg r8, rbx
xchg rdx, r12
mov qword [rsp + 0x10], r12
xchg r12, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rbx
mov rbx, rcx
xchg rbx, rdi
lea rbx, [rdx + 0xe]
xchg rdx, rbp
mov rbp, rbx
xchg rbp, rdx
call fcn.14007a9b0
nop
xor eax, eax
mov byte [rbx + rax], 0x77
sub byte [rbx + rax], 0x3a
add byte [rbx + rax], 0x17
xor byte [rbx + rax], 0x4d
add byte [rbx + rax], 0x53
xor byte [rbx + rax], 0x6c
inc rax
cmp rax, 0x1a
jb 0x14007d4a1
xchg r13, rdi
mov rax, r13
xchg rdi, r13
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140080ea0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
mov rbx, r8
xchg rsi, rdx
mov rdx, rsi
xchg rsi, rdx
xchg rdx, rcx
mov rbp, rdx
xchg rdx, rcx
jne 0x140080f62
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
xchg rdx, r8
mov rdx, qword [rbx + 0x10]
xchg rdx, r8
mov rdx, rsi
xchg rbp, rdx
mov rcx, rdx
xchg rbp, rdx
call fcn.140080ea0
xchg r8, rdi
mov r8, rbx
xchg rdi, r8
mov rbx, qword [rbx]
lea rcx, [rdi + 0x28]
call fcn.1400915f0
mov edx, 0x16e3dc92
add edx, 0x235c911c
xor edx, 0x21d9d5f8
add edx, 0x263f4e69
xor edx, 0x783c04d6
add edx, 0x45355890
xor edx, 0x5fb65c67
xor edx, 0x39a0d41d
sub edx, 0x190cd1eb
xchg rcx, rdi
mov rdi, rcx
xchg rcx, rdi
call fcn.1401fcb00
cmp byte [rbx + 0x19], 0
je 0x140080ee0
mov rdi, qword [rsp + 0x30]
xchg r9, rbx
mov r9, qword [rsp + 0x38]
xchg rbx, r9
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
nop
mov rsi, qword [rsp]
add rsp, 8
ret
Function at 0x140083da0
Capabilities:
Encode data using xor

Disassembly:
xchg r14, r8
mov rax, r14
xchg r8, r14
cmp rcx, rdx
je 0x140083f07
xchg r9, rax
mov rax, r9
xchg r9, rax
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
movups xmmword [rax], xmm0
xchg rbp, r10
mov qword [r9 + r8 - 0x70], rbp
xchg r10, rbp
mov qword [r9 + r8 - 0x68], r10
xchg r8, r10
movups xmm0, xmmword [r10 - 0x80]
xchg r8, r10
xchg r9, rax
movups xmmword [r9], xmm0
xchg r9, rax
movups xmm1, xmmword [r8 - 0x70]
xorps xmm0, xmm0
xchg rdx, rax
movups xmmword [rdx + 0x10], xmm1
xchg rdx, rax
mov qword [r8 - 0x70], r10
neg rax
add rax, 0xffffffffffffffb8
neg rax
mov qword [r8 - 0x68], 0xf3f6bad
add qword [r8 - 0x68], 0x38ecb40a
xor qword [r8 - 0x68], 0x69b3598d
add qword [r8 - 0x68], 0x5d06c9c2
sub qword [r8 - 0x68], 0x46668d05
sub qword [r8 - 0x68], 0x229d8191
xor qword [r8 - 0x68], 0x1f04fc2a
add qword [r8 - 0x68], 0x5c821a4b
sub qword [r8 - 0x68], 0x67291790
mov word [r8 - 0x80], r10w
xchg r12, r9
movups xmmword [r12 + r8 - 0x60], xmm0
xchg r12, r9
xchg rbx, r10
mov qword [r9 + r8 - 0x50], rbx
xchg rbx, r10
xchg r15, r10
mov qword [r9 + r8 - 0x48], r15
xchg r15, r10
xchg r8, rdi
movups xmm0, xmmword [rdi - 0x60]
xchg rdi, r8
xchg r9, r15
movups xmmword [r15 + r8 - 0x60], xmm0
xchg r15, r9
xchg r8, rbx
movups xmm1, xmmword [rbx - 0x50]
xchg rbx, r8
xchg r9, rbx
movups xmmword [rbx + r8 - 0x50], xmm1
xchg r9, rbx
mov qword [r8 - 0x50], r10
mov qword [r8 - 0x48], 0x7506a2c6
sub qword [r8 - 0x48], 0x5b650b70
xor qword [r8 - 0x48], 0x2ae1d588
add qword [r8 - 0x48], 0x3b71a6ed
xor qword [r8 - 0x48], 0x547892ca
sub qword [r8 - 0x48], 0x97ec663
sub qword [r8 - 0x48], 0x314ab497
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x140083dca
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140084000
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rax
mov r8, rax
xchg r8, rax
cmp rcx, rdx
je 0x1400840bb
xchg r9, r13
mov r13, rax
xchg r9, r13
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg r11, rax
movups xmmword [r11], xmm0
xchg r11, rax
xchg r10, rbp
mov qword [r9 + r8 - 0x28], rbp
xchg r10, rbp
lea rcx, [r8 - 0x18]
mov qword [r8 + r9 - 0x20], r10
movups xmm0, xmmword [r8 - 0x38]
xchg r15, rax
movups xmmword [r15], xmm0
xchg r15, rax
xchg rbp, r8
movups xmm1, xmmword [rbp - 0x28]
xchg r8, rbp
movups xmmword [rax + 0x10], xmm1
mov qword [r8 - 0x28], r10
nop
sub rax, 0x365fbff7
add rax, 0x365fc017
mov qword [r8 - 0x20], 0x4cd910b9
xor qword [r8 - 0x20], 0x75ef262
sub qword [r8 - 0x20], 0xf50f4e7
add qword [r8 - 0x20], 0x3da82e74
sub qword [r8 - 0x20], 0x29554dac
sub qword [r8 - 0x20], 0x5089ceb5
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x14008402e
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14008e500
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0xa], 0x13
xor byte [rcx + rax + 0xa], 0x1f
add byte [rcx + rax + 0xa], 0x37
xor byte [rcx + rax + 0xa], 0x11
xor byte [rcx + rax + 0xa], 0xc
xor byte [rcx + rax + 0xa], 0x25
sub byte [rcx + rax + 0xa], 0x47
sub byte [rcx + rax + 0xa], 0x34
inc rax
cmp rax, 0x10
jb 0x14008e502
ret

Function at 0x14008e620
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0x14], 0x3d
add byte [rcx + rax + 0x14], 0x39
xor byte [rcx + rax + 0x14], 0x46
sub byte [rcx + rax + 0x14], 8
add byte [rcx + rax + 0x14], 0x1e
xor byte [rcx + rax + 0x14], 0x46
inc rax
cmp rax, 0x24
jb 0x14008e622
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400f12b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
xchg r11, rdx
mov qword [rsp + 0x10], r11
xchg rdx, r11
nop
sub rsp, 8
mov qword [rsp], rbp
push rdi
mov qword [rsp], rsi
nop
push 0x7dbffb63
mov qword [rsp], rdi
sub rsp, 0x80
xchg rdi, r9
mov r9, rdi
xchg rdi, r9
mov esi, r8d
xchg rcx, rdx
mov rbx, rcx
xchg rcx, rdx
xor ebp, ebp
lea rcx, [rsp + 0x50]
call fcn.140049bc0
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x78], rdi
lea ecx, [rbp + 0x30]
call fcn.1401fcac4
test rax, rax
je 0x1400f1356
movups xmm0, xmmword [rsp + 0x50]
xchg r13, rax
movups xmmword [r13], xmm0
xchg r13, rax
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rax + 0x10], xmm1
movdqa xmm0, xmmword [0x140002c70]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], bp
mov dword [rax + 0x20], esi
xchg r10, rdi
mov qword [rax + 0x28], r10
xchg rdi, r10
jmp 0x1400f135d
xchg rbp, rax
mov rbp, rax
xchg rbp, rax
xchg rcx, rax
mov qword [rsp + 0xb8], rcx
xchg rcx, rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
xchg rcx, rax
mov r9, rcx
xchg rcx, rax
lea r8, [0x140081d00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400f141a
cmp dword [rsp + 0x38], 0
je 0x1400f1453
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.1401fd8ea
test eax, eax
jne 0x1400f1412
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x50]
call fcn.14002f850
nop
xchg rsi, rcx
mov rsi, rbx
xchg rsi, rcx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
xchg qword [rsp], rsi
add rsp, 8
nop
xchg qword [rsp], rbp
add rsp, 8
jmp fcn.14002f850
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov dword [rsp + 0x38], ebp
mov ecx, 0x33f8260e
add ecx, 0x46ad6b35
sub ecx, 0x271d7f81
xor ecx, 0x7ad58ea2
xor ecx, 0x7b19c172
sub ecx, 0x93c5875
sub ecx, 0x412ef400
sub ecx, 0x7d91197
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 0x7510f03f
sub ecx, 0x67f2849d
add ecx, 0x293cee7c
add ecx, 0x26551b20
sub ecx, 0x1ff6a786
sub ecx, 0x3cb9cdb7
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14015c100
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
je 0x14015c30c
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rcx
mov rdi, qword [rdx + 0x50]
xchg rdi, rcx
xchg r12, rdx
mov rdi, r12
xchg rdx, r12
mov qword [rsp + 0x30], rbx
xor ebx, ebx
test rcx, rcx
je 0x14015c196
mov rdx, qword [rdx + 0x60]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x14015c173
mov r8, qword [rcx - 8]
sub rdx, 0xffffffffffffffd9
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14015c315
xchg r8, rbx
mov rcx, rbx
xchg rbx, r8
call fcn.1401fcb00
xchg r8, rbx
mov qword [rdi + 0x50], r8
xchg rbx, r8
xchg rbx, r11
mov qword [rdi + 0x58], r11
xchg rbx, r11
xchg r12, rbx
mov qword [rdi + 0x60], r12
xchg r12, rbx
mov rcx, qword [rdi + 0x40]
xchg r8, rax
mov r8, qword [rcx + 8]
xchg r8, rax
xchg rbx, rdi
mov qword [rax], rdi
xchg rbx, rdi
mov rcx, qword [rcx]
test rcx, rcx
je 0x14015c211
nop word [rax + rax]
xchg r13, rbx
mov r13, qword [rcx]
xchg rbx, r13
mov edx, 0x2bebacb2
add edx, 0x3cb5ed73
sub edx, 0x2496d88b
xor edx, 0x51d6f8d0
add edx, 0x45bebf31
sub edx, 0x7d556eb
xor edx, 0x7656c378
xor edx, 0x590449a9
sub edx, 0x7c972b29
call fcn.1401fcb00
mov rcx, rbx
test rbx, rbx
jne 0x14015c1c2
mov rcx, qword [rdi + 0x40]
mov edx, 0x4c502bca
add edx, 0x338a2a3f
sub edx, 0x1cf772b
sub edx, 0x49d176df
sub edx, 0x1d977129
xor edx, 0x47596a0a
sub edx, 0x3459d3a5
xor edx, 0x15de6931
sub edx, 0x8409fee
call fcn.1401fcb00
mov rbx, qword [rdi + 0x28]
test rbx, rbx
je 0x14015c2c2
mov qword [rsp + 0x38], rsi
mov esi, 0x2d579ab7
xor esi, 0x725a2e07
sub esi, 0x42796809
xor esi, 0x1514ffe1
add esi, 0x53cb0bae
add esi, 0xa2b4410b
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14015c2bd
xchg rbp, rax
mov rbp, qword [rbx]
xchg rbp, rax
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x14015c2bd
mov rax, qword [rbx]
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call qword [rax + 8]
mov rsi, qword [rsp + 0x38]
mov edx, 0x2947e96b
add edx, 0x4b30047b
xor edx, 0x6eb9ab10
add edx, 0x1bc8ce9c
add edx, 0x36ab6187
xor edx, 0x10e65e17
sub edx, 0x7da42766
mov rcx, rdi
call fcn.1401fcb00
xchg rbx, r8
mov r8, qword [rsp + 0x30]
xchg r8, rbx
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3